context-mode 1.0.163 → 1.0.164

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.163"
+    "version": "1.0.164"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.163",
+      "version": "1.0.164",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.163",
+  "version": "1.0.164",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.163",
+  "version": "1.0.164",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.163",
+  "version": "1.0.164",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.163",
+  "version": "1.0.164",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/README.md

@@ -825,9 +825,11 @@ Full documentation: [`docs/adapters/kimi-code.md`](docs/adapters/kimi-code.md)
 </details>
 
 <details>
-<summary><strong>Antigravity</strong> — MCP-only, no hooks</summary>
+<summary><strong>Antigravity IDE</strong> — MCP-only, no hooks</summary>
 
-**Prerequisites:** Node.js >= 22.5 (or Bun), Antigravity installed.
+> This is the Antigravity **desktop IDE**. For the `agy` **command-line tool**, see **Antigravity CLI (`agy`)** below — it installs as a full plugin with hooks.
+
+**Prerequisites:** Node.js >= 22.5 (or Bun), the Antigravity IDE installed.
 
 **Install:**
 
@@ -868,43 +870,28 @@ Full configs: [`configs/antigravity/mcp_config.json`](configs/antigravity/mcp_co
 <details>
 <summary><strong>Antigravity CLI (<code>agy</code>)</strong> — plugin (MCP + skill + hooks)</summary>
 
-**Prerequisites:** Node.js >= 22.5 (or Bun), Antigravity CLI (`agy`) installed.
-
-`agy` has a native **plugin** system, so context-mode installs as a first-class agy plugin that bundles the MCP server, a routing rule, a routing skill, and bounded hooks in one step.
-
-**Install** (same one-command pattern as OpenClaw — the script resolves the bundle path for you):
-
-1. Make the MCP server available globally (the plugin runs the `context-mode` binary):
-
-   ```bash
-   npm install -g context-mode
-   ```
-
-2. Clone and install the plugin:
-
-   ```bash
-   git clone https://github.com/mksglu/context-mode.git
-   cd context-mode
-   npm run install:agy
-   ```
-
-   `npm run install:agy` runs `agy plugin install` on the bundle at `configs/antigravity-cli/` — registering the MCP server from the bundle's native `mcp_config.json`, the routing rule, routing skill, bounded `PreToolUse`, `PostToolUse` capture, and best-effort `Stop` capture hooks — then clears agy's stale tool-schema cache so the `ctx_*` tools appear in the model's tool list (agy caches MCP schemas and doesn't refresh them; an old cache hides the tools). The installer is cross-platform Node (runs natively on Windows, macOS, and Linux — no bash required). Restart `agy`.
+> The `agy` **command-line tool**, not the Antigravity desktop IDE above.
 
-   agy's native validation path expects root `plugin.json` + `mcp_config.json`; the bundle intentionally uses that single manifest shape.
+**Prerequisites:** Node.js >= 22.5 (or Bun), Antigravity CLI (`agy`) **≥ 1.0.7** (`agy update` to upgrade). Verified on agy 1.0.10.
 
-> **Hook version note:** the agy hooks run the **global** `context-mode` binary (`context-mode hook antigravity-cli <event>`), so they need a context-mode version with Antigravity CLI hook support. On an older global the **MCP server + routing rule + routing skill still work**, but hook enforcement/capture may be inert — the installer probes for this and prints a warning if your global is too old (upgrade with `npm install -g context-mode@latest`). To remove the plugin later: `agy plugin uninstall context-mode`.
+**Install:**
 
-> **Already using context-mode in Claude Code?** `agy plugin import claude` can import that existing Claude setup, but the native context-mode agy bundle above is the supported path for agy hooks.
+```bash
+npm install -g context-mode                                                                  # the plugin's MCP server + hooks run the global binary
+agy plugin install https://github.com/mksglu/context-mode/tree/main/configs/antigravity-cli  # registers MCP + rule + skill + hooks
+```
 
-**Verify:** `agy -p "Use the context-mode ctx_execute MCP tool to compute 7 + 5. Answer only the number." --dangerously-skip-permissions` should print `12`.
+Restart `agy`.
 
-**Install (alternative — MCP only):** add context-mode to `~/.gemini/config/mcp_config.json` (agy's **global** MCP profile — `config/`, distinct from the Antigravity IDE's `antigravity/` path):
+**MCP-only (no plugin, no hooks):** if you only want the `ctx_*` tools, skip the plugin and add context-mode to agy's global MCP profile `~/.gemini/config/mcp_config.json` (distinct from the Antigravity IDE's `~/.gemini/antigravity/` path), then restart `agy`:
 
 ```json
 { "mcpServers": { "context-mode": { "command": "context-mode" } } }
 ```
 
-**Routing & capture:** The routing rule plus routing skill provide the durable instruction layer, and bounded `PreToolUse` enforcement blocks mapped high-flood tools before execution (`run_command`, `view_file`, `grep_search`, `web_fetch`, `read_url_content`). `PostToolUse` records executed tool calls into `~/.gemini/context-mode/sessions/` and normalizes agy basics (`run_command`, `view_file`, `grep_search`, `list_dir`, `read_url_content`, `search_web`) onto context-mode's canonical tool names; `list_dir` and `search_web` are capture-only because context-mode has no LS/WebSearch PreToolUse routing branch. `Stop` is registered as best-effort session-end capture, but agy `-p` probes have not emitted it. `PreInvocation` and `PostInvocation` are intentionally not registered until agy's payload/response contract is verified for context-mode's pipeline. Auto-detected via MCP `clientInfo.name` (`agy`) or, in a bare shell, the `~/.local/bin/agy` / `~/.gemini/config/mcp_config.json` markers — probed before the generic `~/.claude` fallback so a gemini-cli→agy migrant is not mis-detected as Claude Code ([#774](https://github.com/mksglu/context-mode/issues/774)).
+**Verify:** type `ctx stats` in an agy session, or run any prompt from [Try It](#try-it) and check the savings. `context-mode doctor` confirms MCP + hook registration. Remove with `agy plugin uninstall context-mode`.
+
+**Routing:** the routing rule and skill provide the instruction layer; bounded `PreToolUse` blocks high-flood tools and `PostToolUse` captures sessions. The bundle pins `CONTEXT_MODE_PLATFORM=antigravity-cli` so agy is detected even when Claude Code is co-installed ([#774](https://github.com/mksglu/context-mode/issues/774)).
 
 </details>
 
@@ -1567,6 +1554,24 @@ Commands chained with `&&`, `;`, or `|` are split — each part is checked separ
 
 **deny** always wins over **allow**. More specific (project-level) rules override global ones.
 
+### Project-boundary containment
+
+`ctx_execute_file` is confined to the project root. A `path` that resolves **outside** the workspace — an absolute path like `/home/user/secrets`, a `../../` traversal, or a project-local symlink whose target escapes the project — is refused with a `File access blocked` error. This closes the [#852](https://github.com/mksglu/context-mode/issues/852) escape vector where an agent, denied an out-of-project read by the host sandbox, retried through the MCP sandbox (the host's MCP approval prompt cannot inspect the tool's input params, so the escape was invisible to the approver).
+
+The guard is **on by default** and requires no configuration. To intentionally process a file outside the project (e.g. a shared log under `/var/log`), opt that path back in with the **same `permissions.allow` rule you already use for the host `Read` tool** — there is no context-mode-specific env flag:
+
+```json
+{
+  "permissions": {
+    "allow": ["Read(/var/log/**)"]
+  }
+}
+```
+
+context-mode honors that allow rule (read from your `.claude/settings.json` / `~/.claude/settings.json`) exactly as Claude Code does, so an out-of-project grant lives in one place and stays meaningful.
+
+Reviewing the prompt: the `ctx_execute` / `ctx_execute_file` approval titles now read as code execution ("Run code in a sandbox…", "Run code over a file…") so an unfamiliar reviewer can recognise the action class even though the MCP prompt renders only the tool title and raw arguments. `ctx_execute` and `ctx_batch_execute` run arbitrary code and still inherit the process's filesystem access, so the boundary guard is a defense-in-depth layer for the *file-read* tool, not a full OS sandbox — treat approving any execution tool as approving arbitrary code, and keep host-level sandboxing enabled.
+
 ### Network fetch hardening
 
 `ctx_fetch_and_index` blocks dangerous URL targets by default:

package/build/adapters/antigravity-cli/index.d.ts

@@ -24,7 +24,7 @@ export declare function antigravityCliConfigDir(): string;
 export declare function antigravityCliHooksPath(): string;
 /**
  * `agy plugin install <bundle>` registers MCP + hook + skill into agy's plugin
- * profile under ~/.gemini/config/plugins/<name>/ (verified on agy 1.0.6) — the
+ * profile under ~/.gemini/config/plugins/<name>/ (verified on agy 1.0.6, re-verified 1.0.10) — the
  * canonical install. The global mcp_config.json / hooks.json paths above are the
  * manual (no-plugin) fallback. doctor must recognize BOTH.
  */

package/build/adapters/antigravity-cli/index.js

@@ -33,7 +33,7 @@ export function antigravityCliHooksPath() {
 }
 /**
  * `agy plugin install <bundle>` registers MCP + hook + skill into agy's plugin
- * profile under ~/.gemini/config/plugins/<name>/ (verified on agy 1.0.6) — the
+ * profile under ~/.gemini/config/plugins/<name>/ (verified on agy 1.0.6, re-verified 1.0.10) — the
  * canonical install. The global mcp_config.json / hooks.json paths above are the
  * manual (no-plugin) fallback. doctor must recognize BOTH.
  */
@@ -130,8 +130,9 @@ function readRegisteredHooks(paths) {
             /* unreadable/missing — try next */
         }
     }
-    // Stop is registered when possible, but agy 1.0.6 `-p` probes did not emit it.
-    // Treat it as best-effort so doctor does not mark a working Pre/Post install
+    // Stop is registered when possible, but agy 1.0.6 `-p` probes did not emit it
+    // (no Stop-hook change in agy's changelog through 1.0.10). Treat it as
+    // best-effort so doctor does not mark a working Pre/Post install
     // as degraded solely because Stop is absent.
     return { ...found, ok: found.preOk && found.postOk };
 }
@@ -251,7 +252,7 @@ export class AntigravityCliAdapter extends AntigravityAdapter {
             check: "MCP registration",
             status: "fail",
             message: "context-mode not found in Antigravity CLI mcpServers",
-            fix: "npm run install:agy",
+            fix: "agy plugin install https://github.com/mksglu/context-mode/tree/main/configs/antigravity-cli",
         };
     }
     getInstalledVersion() {
@@ -333,8 +334,8 @@ export class AntigravityCliAdapter extends AntigravityAdapter {
                 status: ok ? "pass" : "warn",
                 message: ok
                     ? `PreToolUse guard and PostToolUse capture configured in ${where}${stopOk ? "; best-effort Stop hook also configured" : ""}`
-                    : `Antigravity CLI hooks incomplete (${missing || "none found"} missing) — MCP tools still work, but bounded routing enforcement and session capture are degraded. Run \`npm run install:agy\` (agy plugin) or \`context-mode upgrade\` to repair hooks.`,
-                ...(ok ? {} : { fix: "npm run install:agy" }),
+                    : `Antigravity CLI hooks incomplete (${missing || "none found"} missing) — MCP tools still work, but bounded routing enforcement and session capture are degraded. Run \`agy plugin install https://github.com/mksglu/context-mode/tree/main/configs/antigravity-cli\` or \`context-mode upgrade\` to repair hooks.`,
+                ...(ok ? {} : { fix: "agy plugin install https://github.com/mksglu/context-mode/tree/main/configs/antigravity-cli" }),
             },
         ];
     }

package/build/adapters/pi/extension.js

@@ -565,11 +565,22 @@ export default function piExtension(pi) {
             // Pi-3 + Pi-4: Always build active_memory (not just post-compact),
             // capped at 500 tokens via buildAutoInjection. Falls back to inline
             // budget loop if the helper is unavailable.
-            const activeEvents = db.getEvents(_sessionId, {
+            //
+            // Issue #856 — do NOT re-inject `role` as a standing behavioral_directive
+            // on every turn. A casual past phrase that classified as a role would
+            // otherwise be pinned and replayed each turn ("since you said 'that's
+            // fine for now', I'll leave it"), producing a do-nothing loop. Defense in
+            // depth: even if a stale `role` event exists (from an older build, or a
+            // genuine persona the user has since moved past), it must not become an
+            // inescapable per-turn standing order. Role events stay in the DB and
+            // remain queryable via ctx_search(source: "session-events"); intent,
+            // skills, decisions, and the resume snapshot are unaffected.
+            const activeEvents = db
+                .getEvents(_sessionId, {
                 minPriority: 3,
                 limit: 50,
-            });
-            let behavioralDirective = "";
+            })
+                .filter((e) => String(e.category ?? "") !== "role");
             if (activeEvents.length > 0) {
                 const buildAuto = await getAutoInjection(pluginRoot);
                 let memoryContext = "";
@@ -578,14 +589,6 @@ export default function piExtension(pi) {
                         category: String(e.category ?? ""),
                         data: String(e.data ?? ""),
                     })));
-                    const bdMatch = memoryContext.match(/(<behavioral_directive>\n[^<]*\n<\/behavioral_directive>)/);
-                    if (bdMatch) {
-                        behavioralDirective = bdMatch[1];
-                        memoryContext = memoryContext.replace(bdMatch[1], "");
-                        if (memoryContext.match(/^<session_state[^>]*>\s*<\/session_state>\s*$/)) {
-                            memoryContext = "";
-                        }
-                    }
                 }
                 // Fallback (or if helper produced empty output): inline 500-token cap.
                 if (!memoryContext) {
@@ -611,8 +614,6 @@ export default function piExtension(pi) {
                 parts.push(resume.snapshot);
                 db.markResumeConsumed(_sessionId);
             }
-            if (behavioralDirective)
-                parts.push(behavioralDirective);
             // Store extra context (routing anchor, active_memory, resume, behavioralDirective)
             // for injection via the 'context' hook as a message, NOT as a systemPrompt
             // modification. Mutating systemPrompt breaks prefix prompt caching on

package/build/lifecycle.d.ts

@@ -11,6 +11,12 @@
  * next poll tick), which closes the multi-day CPU-spin window seen in
  * #311/#388 without reintroducing the false-positive shutdowns of #236.
  *
+ * Additionally, for MCP BRIDGE CHILDREN only (CONTEXT_MODE_BRIDGE_DEPTH>0), a
+ * request-idle self-shutdown reaps a child that a pi/omp sub-context abandoned
+ * while its long-lived parent keeps running (#854) — gated so the depth-0
+ * keep-alive servers #602 restored are never reaped, never via stdin EOF, and
+ * never while a tool call is in flight (#643).
+ *
  * Cross-platform: macOS, Linux, Windows.
  */
 export interface LifecycleGuardOptions {
@@ -20,6 +26,12 @@ export interface LifecycleGuardOptions {
     onShutdown: () => void;
     /** Injectable parent-alive check (for testing). Default: ppid-based check. */
     isParentAlive?: () => boolean;
+    /**
+     * #854: request-idle shutdown timeout (ms) for MCP bridge children. Default:
+     * {@link bridgeChildIdleTimeoutMs}() — 0 (disabled) unless CONTEXT_MODE_BRIDGE_DEPTH>0.
+     * Exposed for testing.
+     */
+    bridgeIdleMs?: number;
 }
 /** Injectable dependencies for {@link makeDefaultIsParentAlive}. */
 export interface IsParentAliveDeps {
@@ -59,6 +71,42 @@ export declare function makeDefaultIsParentAlive(deps?: IsParentAliveDeps): () =
  * Exported for unit-testing.
  */
 export declare function lifecycleGuardIntervalForEnv(env?: NodeJS.ProcessEnv): number;
+/**
+ * #854: idle-shutdown timeout (ms) for an MCP BRIDGE CHILD. Returns 0 (disabled)
+ * unless this process is a bridge child (CONTEXT_MODE_BRIDGE_DEPTH>0). depth-0 /
+ * absent always returns 0, so the long-lived keep-alive servers that #602
+ * restored are NEVER reaped on idle. Default for bridge children is 3 min;
+ * override with CONTEXT_MODE_BRIDGE_IDLE_MS (a non-positive value disables it).
+ * The reaper additionally never fires while a tool call is in flight (see
+ * {@link noteRequestStart}), so the window only bounds how fast *abandoned*
+ * children drain — it does not cap legitimate long-running calls.
+ *
+ * Exported for unit-testing.
+ */
+export declare function bridgeChildIdleTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/**
+ * #854: record MCP activity (inbound message or response). The server calls this
+ * so the bridge-child idle reaper in {@link startLifecycleGuard} can distinguish
+ * an actively-used child from an abandoned one. Cheap; safe on the hot path.
+ */
+export declare function noteMcpActivity(): void;
+/**
+ * #854: mark a tool call as started. Suppresses the bridge-child idle reaper so a
+ * single long-running ctx_execute / ctx_batch_execute (which sends one inbound
+ * frame then runs unbounded, #643) is never reaped mid-execution.
+ */
+export declare function noteRequestStart(): void;
+/** #854: mark a tool call as finished (success or error). */
+export declare function noteRequestEnd(): void;
+/**
+ * #854: wrap an MCP stdio transport's `onmessage` so each inbound message
+ * refreshes the idle clock. Best-effort: call after `connect()` (onmessage set);
+ * a no-op if it isn't a function, and a throw in noteMcpActivity never breaks
+ * dispatch. No stdin touch (preserves the #236 contract). Exported for testing.
+ */
+export declare function attachMcpActivityTap(transport: {
+    onmessage?: (message: unknown, extra?: unknown) => unknown;
+} | null | undefined): void;
 /**
  * Start the lifecycle guard. Returns a cleanup function.
  * Skipped automatically when stdin is a TTY (e.g. OpenCode ts-plugin).

package/build/lifecycle.js

@@ -11,6 +11,12 @@
  * next poll tick), which closes the multi-day CPU-spin window seen in
  * #311/#388 without reintroducing the false-positive shutdowns of #236.
  *
+ * Additionally, for MCP BRIDGE CHILDREN only (CONTEXT_MODE_BRIDGE_DEPTH>0), a
+ * request-idle self-shutdown reaps a child that a pi/omp sub-context abandoned
+ * while its long-lived parent keeps running (#854) — gated so the depth-0
+ * keep-alive servers #602 restored are never reaped, never via stdin EOF, and
+ * never while a tool call is in flight (#643).
+ *
  * Cross-platform: macOS, Linux, Windows.
  */
 import { execFileSync } from "node:child_process";
@@ -94,6 +100,80 @@ export function lifecycleGuardIntervalForEnv(env = process.env) {
         return 30_000;
     return 1000;
 }
+/**
+ * #854: idle-shutdown timeout (ms) for an MCP BRIDGE CHILD. Returns 0 (disabled)
+ * unless this process is a bridge child (CONTEXT_MODE_BRIDGE_DEPTH>0). depth-0 /
+ * absent always returns 0, so the long-lived keep-alive servers that #602
+ * restored are NEVER reaped on idle. Default for bridge children is 3 min;
+ * override with CONTEXT_MODE_BRIDGE_IDLE_MS (a non-positive value disables it).
+ * The reaper additionally never fires while a tool call is in flight (see
+ * {@link noteRequestStart}), so the window only bounds how fast *abandoned*
+ * children drain — it does not cap legitimate long-running calls.
+ *
+ * Exported for unit-testing.
+ */
+export function bridgeChildIdleTimeoutMs(env = process.env) {
+    const depth = Number.parseInt(env.CONTEXT_MODE_BRIDGE_DEPTH ?? "", 10);
+    if (!Number.isFinite(depth) || depth <= 0)
+        return 0;
+    const raw = env.CONTEXT_MODE_BRIDGE_IDLE_MS;
+    if (raw !== undefined) {
+        const v = Number.parseInt(raw, 10);
+        return Number.isFinite(v) && v > 0 ? v : 0;
+    }
+    return 180_000;
+}
+// #854 idle-reaper state, module-level by design: an MCP server is exactly one
+// process (one StdioServerTransport + one lifecycle guard), so these are never
+// shared across concurrent servers in production. Multiple startLifecycleGuard()
+// instances arise only in tests, which pair/reset these explicitly.
+/** Last MCP activity timestamp (inbound message, tool-call start/end, or response). */
+let _lastMcpActivity = Date.now();
+/** In-flight tool-call count — the reaper never fires while this is > 0. */
+let _inFlight = 0;
+/**
+ * #854: record MCP activity (inbound message or response). The server calls this
+ * so the bridge-child idle reaper in {@link startLifecycleGuard} can distinguish
+ * an actively-used child from an abandoned one. Cheap; safe on the hot path.
+ */
+export function noteMcpActivity() {
+    _lastMcpActivity = Date.now();
+}
+/**
+ * #854: mark a tool call as started. Suppresses the bridge-child idle reaper so a
+ * single long-running ctx_execute / ctx_batch_execute (which sends one inbound
+ * frame then runs unbounded, #643) is never reaped mid-execution.
+ */
+export function noteRequestStart() {
+    _inFlight++;
+    _lastMcpActivity = Date.now();
+}
+/** #854: mark a tool call as finished (success or error). */
+export function noteRequestEnd() {
+    if (_inFlight > 0)
+        _inFlight--;
+    _lastMcpActivity = Date.now();
+}
+/**
+ * #854: wrap an MCP stdio transport's `onmessage` so each inbound message
+ * refreshes the idle clock. Best-effort: call after `connect()` (onmessage set);
+ * a no-op if it isn't a function, and a throw in noteMcpActivity never breaks
+ * dispatch. No stdin touch (preserves the #236 contract). Exported for testing.
+ */
+export function attachMcpActivityTap(transport) {
+    if (!transport)
+        return;
+    const prev = typeof transport.onmessage === "function" ? transport.onmessage.bind(transport) : null;
+    if (!prev)
+        return;
+    transport.onmessage = (message, extra) => {
+        try {
+            noteMcpActivity();
+        }
+        catch { /* never break message dispatch */ }
+        return prev(message, extra);
+    };
+}
 /**
  * Start the lifecycle guard. Returns a cleanup function.
  * Skipped automatically when stdin is a TTY (e.g. OpenCode ts-plugin).
@@ -142,9 +222,40 @@ export function startLifecycleGuard(opts) {
     if (!process.stdin.isTTY) {
         process.stdin.on("end", onStdinEnd);
     }
+    // #854: request-idle self-shutdown for MCP BRIDGE CHILDREN only
+    // (CONTEXT_MODE_BRIDGE_DEPTH>0). Pi/omp loads the extension once per
+    // sub-context and spawns one bridge child each, tearing them down only at
+    // session_shutdown — which never fires for sub-contexts while the long-lived
+    // parent stays alive, so idle children accumulate (#854, same class as #565).
+    // A bridge child that receives no inbound MCP message for `idleMs` exits
+    // itself; the extension's single-flight path respawns one on the next call.
+    //
+    // Scoped strictly to depth>0 so the depth-0 keep-alive servers that #602
+    // restored are never reaped on idle. The trigger is idle TIME via
+    // noteMcpActivity() (NOT stdin EOF), so the #236 contract — and lifecycle's
+    // hands-off-stdin invariant — are untouched.
+    const idleMs = opts.bridgeIdleMs ?? bridgeChildIdleTimeoutMs();
+    let idleTimer;
+    if (idleMs > 0) {
+        _lastMcpActivity = Date.now();
+        idleTimer = setInterval(() => {
+            // Reap only when truly quiescent: NO tool call in flight AND no MCP
+            // activity for `idleMs`. The in-flight guard prevents reaping a child
+            // mid-execution during a long single ctx_execute/batch that sends no
+            // further messages (#643 unbounded calls) — the false-reap regression the
+            // adversarial review flagged.
+            if (_inFlight === 0 && Date.now() - _lastMcpActivity >= idleMs) {
+                process.stderr.write(`[context-mode] idle MCP bridge child self-shutdown after ${idleMs}ms with no activity (#854)\n`);
+                shutdown();
+            }
+        }, Math.max(1000, Math.min(Math.floor(idleMs / 4), 30_000)));
+        idleTimer.unref();
+    }
     return () => {
         stopped = true;
         clearInterval(timer);
+        if (idleTimer)
+            clearInterval(idleTimer);
         for (const sig of signals)
             process.removeListener(sig, shutdown);
         process.stdin.removeListener("end", onStdinEnd);

package/build/security.d.ts

@@ -76,6 +76,19 @@ export declare function readBashPolicies(projectDir?: string, globalSettingsPath
  * Each inner array contains the extracted glob strings.
  */
 export declare function readToolDenyPatterns(toolName: string, projectDir?: string, globalSettingsPath?: string): string[][];
+/**
+ * Read `permissions.{deny|allow}` globs for a tool from every settings file in
+ * precedence order (project local → project shared → adapter globals).
+ *
+ * Generalizes the original deny-only reader so the project-boundary guard
+ * (#852) can consult the SAME `permissions.allow` rules the user already
+ * maintains for the host's `Read` tool — instead of inventing a context-mode-
+ * specific opt-out env that would rot into dead code. A user who legitimately
+ * needs an out-of-project read expresses it once, in the host config, e.g.
+ * `"permissions": { "allow": ["Read(/var/log/**)"] }`, and both the host and
+ * context-mode honor it.
+ */
+export declare function readToolPermissionPatterns(toolName: string, kind: "deny" | "allow", projectDir?: string, globalSettingsPath?: string): string[][];
 interface CommandDecision {
     decision: PermissionDecision;
     matchedPattern?: string;
@@ -130,6 +143,58 @@ export declare function evaluateFilePath(filePath: string, denyGlobs: string[][]
     denied: boolean;
     matchedPattern?: string;
 };
+/**
+ * Pure, algorithmic (no-regex) test: does `filePath` resolve to a location
+ * inside `projectRoot`?
+ *
+ * Issue #852 — `ctx_execute_file` previously fed its `path` argument straight
+ * into `resolve(projectRoot, path)`. Because `path.resolve` lets an *absolute*
+ * argument win outright, an agent could read any file on the host
+ * (`/home/user/secret`, `/etc/passwd`) regardless of the project root, and
+ * `../` traversal escaped just as easily. Claude Code's harness sandbox cannot
+ * inspect MCP input params, so the user approving the MCP call could not see
+ * that the path escaped the workspace. This guard re-anchors the path to the
+ * project boundary.
+ *
+ * Containment is decided on the *resolved* form. When the file (or its parent
+ * chain) exists, the symlink-canonical form is ALSO required to stay inside —
+ * this closes the symlink-escape class (a project-local `safe.log` whose
+ * realpath points at `~/.ssh/id_rsa`), mirroring `evaluateFilePath`.
+ *
+ * A path equal to the project root itself counts as inside. Comparison is
+ * case-insensitive on Windows/macOS to match those filesystems' semantics.
+ *
+ * Returns `true` when `projectRoot` is falsy (no boundary to enforce) so the
+ * caller's fail-open posture is preserved when the root cannot be resolved.
+ */
+export declare function isPathInsideProject(filePath: string, projectRoot: string | undefined, caseInsensitive?: boolean): boolean;
+/**
+ * Decide whether `filePath` may be processed, given the project boundary AND
+ * the user's existing host `Read(...)` allow rules.
+ *
+ * Decision order:
+ *   1. Inside the project root  → allowed (the common case; no config needed).
+ *   2. Outside the project, but matching a `permissions.allow` `Read(...)` glob
+ *      the user already configured for the host → allowed. This is the
+ *      principled escape hatch: a deliberate out-of-project read is expressed
+ *      ONCE in the host config the user already maintains, reusing the same
+ *      mechanism Claude Code itself uses to whitelist a path outside the
+ *      sandbox — no context-mode-specific opt-out env that would rot into
+ *      dead code.
+ *   3. Outside the project, no allow match → denied (closes the #852 escape).
+ *
+ * `allowGlobs` has the same per-settings-file shape as the deny globs returned
+ * by `readToolPermissionPatterns(toolName, "allow", …)`. Allow-matching reuses
+ * `evaluateFilePath` so absolute/`..`/symlink-canonical candidate resolution is
+ * identical to the deny path — one matcher, no divergence.
+ *
+ * Fail-open on an unknown project root (boundary cannot be computed) so the
+ * guard never blocks legitimate in-project work when resolution fails.
+ */
+export declare function evaluateProjectContainment(filePath: string, projectRoot: string | undefined, allowGlobs?: string[][], caseInsensitive?: boolean): {
+    allowed: boolean;
+    reason: "inside" | "allow-rule" | "outside";
+};
 /**
  * Scan non-shell code for shell-escape calls and extract the embedded
  * command strings.