context-mode 1.0.163 → 1.0.165

package/build/security.js

@@ -1,5 +1,5 @@
 import { readFileSync, realpathSync } from "node:fs";
-import { resolve } from "node:path";
+import { relative, resolve, sep } from "node:path";
 import { resolveAdapterGlobalSettingsPaths } from "./util/claude-config.js";
 // ==============================================================================
 // Pattern Parsing
@@ -367,6 +367,21 @@ export function readBashPolicies(projectDir, globalSettingsPath) {
  * Each inner array contains the extracted glob strings.
  */
 export function readToolDenyPatterns(toolName, projectDir, globalSettingsPath) {
+    return readToolPermissionPatterns(toolName, "deny", projectDir, globalSettingsPath);
+}
+/**
+ * Read `permissions.{deny|allow}` globs for a tool from every settings file in
+ * precedence order (project local → project shared → adapter globals).
+ *
+ * Generalizes the original deny-only reader so the project-boundary guard
+ * (#852) can consult the SAME `permissions.allow` rules the user already
+ * maintains for the host's `Read` tool — instead of inventing a context-mode-
+ * specific opt-out env that would rot into dead code. A user who legitimately
+ * needs an out-of-project read expresses it once, in the host config, e.g.
+ * `"permissions": { "allow": ["Read(/var/log/**)"] }`, and both the host and
+ * context-mode honor it.
+ */
+export function readToolPermissionPatterns(toolName, kind, projectDir, globalSettingsPath) {
     const result = [];
     const extractGlobs = (path) => {
         let raw;
@@ -383,11 +398,11 @@ export function readToolDenyPatterns(toolName, projectDir, globalSettingsPath) {
         catch {
             return null;
         }
-        const deny = parsed?.permissions?.deny;
-        if (!Array.isArray(deny))
+        const entries = parsed?.permissions?.[kind];
+        if (!Array.isArray(entries))
             return [];
         const globs = [];
-        for (const entry of deny) {
+        for (const entry of entries) {
             if (typeof entry !== "string")
                 continue;
             const tp = parseToolPattern(entry);
@@ -552,6 +567,125 @@ export function evaluateFilePath(filePath, denyGlobs, caseInsensitive = process.
     return { denied: false };
 }
 // ==============================================================================
+// Project-Boundary Containment (Issue #852)
+// ==============================================================================
+/**
+ * Pure, algorithmic (no-regex) test: does `filePath` resolve to a location
+ * inside `projectRoot`?
+ *
+ * Issue #852 — `ctx_execute_file` previously fed its `path` argument straight
+ * into `resolve(projectRoot, path)`. Because `path.resolve` lets an *absolute*
+ * argument win outright, an agent could read any file on the host
+ * (`/home/user/secret`, `/etc/passwd`) regardless of the project root, and
+ * `../` traversal escaped just as easily. Claude Code's harness sandbox cannot
+ * inspect MCP input params, so the user approving the MCP call could not see
+ * that the path escaped the workspace. This guard re-anchors the path to the
+ * project boundary.
+ *
+ * Containment is decided on the *resolved* form. When the file (or its parent
+ * chain) exists, the symlink-canonical form is ALSO required to stay inside —
+ * this closes the symlink-escape class (a project-local `safe.log` whose
+ * realpath points at `~/.ssh/id_rsa`), mirroring `evaluateFilePath`.
+ *
+ * A path equal to the project root itself counts as inside. Comparison is
+ * case-insensitive on Windows/macOS to match those filesystems' semantics.
+ *
+ * Returns `true` when `projectRoot` is falsy (no boundary to enforce) so the
+ * caller's fail-open posture is preserved when the root cannot be resolved.
+ */
+export function isPathInsideProject(filePath, projectRoot, caseInsensitive = process.platform === "win32" || process.platform === "darwin") {
+    if (!projectRoot)
+        return true;
+    const root = resolve(projectRoot);
+    const lexical = resolve(projectRoot, filePath);
+    const within = (root, candidate) => {
+        let a = root;
+        let b = candidate;
+        if (caseInsensitive) {
+            a = a.toLowerCase();
+            b = b.toLowerCase();
+        }
+        if (a === b)
+            return true;
+        // `path.relative` is pure string arithmetic — no regex. A candidate inside
+        // the root yields a relative path that neither starts with `..` (escapes
+        // upward) nor is absolute (a different drive/root on Windows that cannot be
+        // expressed relatively).
+        const rel = relative(a, b);
+        if (rel === "")
+            return true;
+        if (rel === ".." || rel.startsWith(".." + sep))
+            return false;
+        if (isAbsoluteRel(rel))
+            return false;
+        return true;
+    };
+    // Lexical containment is the primary gate.
+    if (!within(root, lexical))
+        return false;
+    // Defense-in-depth: when the path (or a parent) is a symlink that points
+    // outside the project, the canonical form must ALSO stay inside. Best-effort
+    // — a not-yet-created file (ENOENT) falls back to the lexical decision above.
+    try {
+        const canonicalRoot = realpathSync(root);
+        const canonical = realpathSync(lexical);
+        if (!within(canonicalRoot, canonical))
+            return false;
+    }
+    catch {
+        /* file does not exist yet / realpath failed — lexical decision stands */
+    }
+    return true;
+}
+/** Pure helper: is a `path.relative` result an absolute path? (no regex) */
+function isAbsoluteRel(rel) {
+    if (rel.startsWith("/"))
+        return true; // POSIX absolute
+    // Windows drive-absolute: "C:\..." or "C:/..."
+    if (rel.length >= 3 && rel[1] === ":" && (rel[2] === "\\" || rel[2] === "/")) {
+        const c = rel.charCodeAt(0);
+        return (c >= 65 && c <= 90) || (c >= 97 && c <= 122);
+    }
+    return false;
+}
+/**
+ * Decide whether `filePath` may be processed, given the project boundary AND
+ * the user's existing host `Read(...)` allow rules.
+ *
+ * Decision order:
+ *   1. Inside the project root  → allowed (the common case; no config needed).
+ *   2. Outside the project, but matching a `permissions.allow` `Read(...)` glob
+ *      the user already configured for the host → allowed. This is the
+ *      principled escape hatch: a deliberate out-of-project read is expressed
+ *      ONCE in the host config the user already maintains, reusing the same
+ *      mechanism Claude Code itself uses to whitelist a path outside the
+ *      sandbox — no context-mode-specific opt-out env that would rot into
+ *      dead code.
+ *   3. Outside the project, no allow match → denied (closes the #852 escape).
+ *
+ * `allowGlobs` has the same per-settings-file shape as the deny globs returned
+ * by `readToolPermissionPatterns(toolName, "allow", …)`. Allow-matching reuses
+ * `evaluateFilePath` so absolute/`..`/symlink-canonical candidate resolution is
+ * identical to the deny path — one matcher, no divergence.
+ *
+ * Fail-open on an unknown project root (boundary cannot be computed) so the
+ * guard never blocks legitimate in-project work when resolution fails.
+ */
+export function evaluateProjectContainment(filePath, projectRoot, allowGlobs = [], caseInsensitive = process.platform === "win32" || process.platform === "darwin") {
+    if (isPathInsideProject(filePath, projectRoot, caseInsensitive)) {
+        return { allowed: true, reason: "inside" };
+    }
+    // Outside the project — permit only if the user explicitly allowed this path
+    // for the host Read tool. `evaluateFilePath` returns `denied:true` when a glob
+    // MATCHES, so a match here means "explicitly allowed".
+    if (allowGlobs.some((g) => g.length > 0)) {
+        const matched = evaluateFilePath(filePath, allowGlobs, caseInsensitive, projectRoot);
+        if (matched.denied)
+            return { allowed: true, reason: "allow-rule" };
+    }
+    return { allowed: false, reason: "outside" };
+}
+// ==============================================================================
 // Shell-Escape Scanner
 // ==============================================================================
 // Regex patterns that detect shell-escape calls in non-shell languages.

package/build/server.js

@@ -14,10 +14,10 @@ import { PolyglotExecutor } from "./executor.js";
 import { runPool } from "./runPool.js";
 import { ContentStore, cleanupStaleDBs, cleanupStaleContentDBs } from "./store.js";
 import { composeFetchCacheKey } from "./fetch-cache.js";
-import { readBashPolicies, evaluateCommandDenyOnly, extractShellCommands, readToolDenyPatterns, evaluateFilePath, } from "./security.js";
+import { readBashPolicies, evaluateCommandDenyOnly, extractShellCommands, readToolDenyPatterns, readToolPermissionPatterns, evaluateFilePath, evaluateProjectContainment, } from "./security.js";
 import { detectRuntimes, getRuntimeSummary, getAvailableLanguages, hasBunRuntime, } from "./runtime.js";
 import { classifyNonZeroExit } from "./exit-classify.js";
-import { startLifecycleGuard } from "./lifecycle.js";
+import { startLifecycleGuard, noteMcpActivity, noteRequestStart, noteRequestEnd, attachMcpActivityTap } from "./lifecycle.js";
 import { charSafePrefix } from "./truncate.js";
 import { describeStorageDirectorySource, ensureWritableStorageDir, formatStorageDirectoryError, hashProjectDirCanonical, hashProjectDirLegacy, resolveContentStorePath, resolveContentStorageDir, resolveDefaultSessionDir, resolveSessionDbPath, resolveSessionStorageDir, resolveStatsStorageDir, SessionDB, StorageDirectoryError, } from "./session/db.js";
 import { purgeSession } from "./session/purge.js";
@@ -235,6 +235,10 @@ server.registerTool = (...args) => {
 };
 function wrapToolHandler(name, handler) {
     return async (toolArgs) => {
+        // #854: mark a tool call in-flight so the bridge-child idle reaper never
+        // shuts the server down mid-execution during a long ctx_execute/batch that
+        // emits no further inbound messages. Symmetric end in finally (success+error).
+        noteRequestStart();
         try {
             return await handler(toolArgs);
         }
@@ -252,6 +256,9 @@ function wrapToolHandler(name, handler) {
             }
             throw err;
         }
+        finally {
+            noteRequestEnd();
+        }
     };
 }
 // Issue #637 — when suppression is active, install the empty tools/list handler
@@ -811,6 +818,9 @@ function healCacheMidSession() {
     catch { /* best effort */ }
 }
 function trackResponse(toolName, response) {
+    // #854: a response is activity too — refresh the bridge-child idle clock so a
+    // chatty/streaming call keeps its server alive even between inbound frames.
+    noteMcpActivity();
     // Mid-session cache heal — one-shot, first tool call
     healCacheMidSession();
     // Prepend version outdated warning if needed
@@ -1034,6 +1044,50 @@ function checkNonShellDenyPolicy(code, language, toolName) {
     }
     return null;
 }
+/**
+ * Issue #852 — project-boundary containment for `ctx_execute_file`.
+ *
+ * The harness sandbox (Claude Code, etc.) cannot inspect MCP input params, so a
+ * user approving a `ctx_execute_file` call cannot see that its `path` escapes
+ * the workspace. This guard refuses a `path` that resolves outside the project
+ * root (absolute escape, `../` traversal, or symlink-out), restoring the
+ * boundary the host believes it is enforcing.
+ *
+ * Escape hatch — NO bespoke opt-out env. A deliberate out-of-project read is
+ * expressed in the SAME host config the user already maintains: a
+ * `permissions.allow` rule like `Read(/var/log/**)`. This reuses the exact
+ * mechanism Claude Code uses to whitelist a path outside its sandbox, so the
+ * grant lives in one place and stays meaningful instead of rotting into a
+ * context-mode-only env flag nobody sets.
+ *
+ * Fail-open on resolver failure (consistent with the other deny checks): if the
+ * project root cannot be resolved, containment evaluates as "inside" and the
+ * path is allowed through rather than spuriously blocking legitimate work.
+ */
+function checkProjectBoundary(filePath, toolName) {
+    try {
+        const projectDir = getProjectDir();
+        const allowGlobs = readToolPermissionPatterns("Read", "allow", projectDir);
+        const verdict = evaluateProjectContainment(filePath, projectDir, allowGlobs);
+        if (verdict.allowed)
+            return null;
+        return trackResponse(toolName, {
+            content: [{
+                    type: "text",
+                    text: `File access blocked: "${filePath}" resolves outside the project root ` +
+                        `(${projectDir}). context-mode confines ${toolName} to the workspace so it ` +
+                        `cannot be used to bypass the host's sandbox/permission controls (issue #852). ` +
+                        `To intentionally process a file outside the project, add a host allow rule, ` +
+                        `e.g. "permissions": { "allow": ["Read(${filePath})"] } in your settings.`,
+                }],
+            isError: true,
+        });
+    }
+    catch {
+        // Fail-open — resolver failure must not block legitimate in-project work.
+    }
+    return null;
+}
 /**
  * Check a file path against Read deny patterns.
  * Returns an error ToolResult if denied, or null if allowed.
@@ -1388,7 +1442,9 @@ export async function runBatchCommands(commands, opts, executor) {
 // Tool: execute
 // ─────────────────────────────────────────────────────────
 server.registerTool("ctx_execute", {
-    title: "Execute Code",
+    // #852: surface code execution in the host approval prompt's title (the
+    // only server-controlled field the MCP permission UI renders besides args).
+    title: "Run code in a sandbox (executes the supplied code)",
     // #846: runs arbitrary code in a sandbox with full network access.
     annotations: {
         readOnlyHint: false,
@@ -1741,7 +1797,10 @@ function intentSearch(stdout, intent, source, maxResults = 5) {
 // Tool: execute_file
 // ─────────────────────────────────────────────────────────
 server.registerTool("ctx_execute_file", {
-    title: "Execute File Processing",
+    // #852: the host's MCP approval prompt renders only the tool name/title +
+    // raw args — the title is the one server-controlled signal, so make it
+    // unambiguously announce code execution + file read for the reviewer.
+    title: "Run code over a file (executes code, reads the given path)",
     // #846: runs arbitrary code over a file in a sandbox with full network access.
     annotations: {
         readOnlyHint: false,
@@ -1803,6 +1862,12 @@ EXAMPLE: ctx_execute_file(path: "data.csv", language: "javascript", code: "const
             "returns only matching sections via BM25 search instead of truncated output."),
     }),
 }, async ({ path, language, code, timeout, intent }) => {
+    // Security (#852): confine the processed file to the project root so
+    // ctx_execute_file cannot be used to escape the host's sandbox/permission
+    // controls. Runs before the deny-glob check — boundary first, then policy.
+    const boundaryDenied = checkProjectBoundary(path, "ctx_execute_file");
+    if (boundaryDenied)
+        return boundaryDenied;
     // Security: check file path against Read deny patterns
     const pathDenied = checkFilePathDenyPolicy(path, "ctx_execute_file");
     if (pathDenied)
@@ -4384,6 +4449,10 @@ async function main() {
     startLifecycleGuard({ onShutdown: () => gracefulShutdown() });
     const transport = new StdioServerTransport();
     await server.connect(transport);
+    // #854: refresh the bridge-child idle clock on each inbound MCP message so an
+    // abandoned bridge child (CONTEXT_MODE_BRIDGE_DEPTH>0) self-terminates instead
+    // of accumulating under a long-lived Pi/omp parent. Best-effort; no stdin touch.
+    attachMcpActivityTap(transport);
     // Write MCP readiness sentinel (#230)
     try {
         writeFileSync(mcpSentinel, String(process.pid));

package/build/session/extract.js

@@ -1439,6 +1439,72 @@ const ROLE_MIN_CHARS = 8;
 const ROLE_MAX_CHARS = 120;
 const TWO_LEXICAL_TOKENS_PATTERN = /\p{L}+\s+\p{L}+/u;
 const CONTINUOUS_LETTER_RUN_PATTERN = /\p{L}{6,}/u;
+// Issue #856 — persona / standing-directive cue gate.
+//
+// The structural test below ("two lexical tokens OR a 6-codepoint letter run,
+// 8..120 chars, no '?', no clause separator") is intentionally coarse and
+// matches ANY short declarative sentence. That let casual conversational
+// acknowledgements ("that's fine for now", "go with the second option") freeze
+// as a priority-3 `role`, which the Pi adapter then re-injected as a standing
+// behavioral_directive every turn → do-nothing loop.
+//
+// A genuine role/behavioral prompt always LEADS with a persona declaration
+// ("You are X", "Tu es X", "あなたは…", "你是…") or a standing-directive verb
+// ("always respond…", "act as…"). Casual phrases never do, so we require that
+// cue as a NECESSARY condition. This preserves legitimate role persistence
+// (issue #535 multilingual corpus) while killing the casual-phrase loop.
+//
+// ALGORITHMIC ONLY — pure lowercase + prefix membership, no regex (project
+// hard rule). Multilingual openers are matched by `startsWith` on the
+// normalized first clause; leading conversational filler tokens are stripped
+// by array operations before the check.
+const ROLE_FILLER_TOKENS = new Set([
+    "ok", "okay", "sure", "yeah", "yep", "yup", "alright", "fine",
+    "well", "so", "hmm", "right", "please",
+]);
+// Second-person persona openers across the supported-language corpus
+// (issue #535 multilingual role test set) plus common English persona framings.
+const ROLE_PERSONA_PREFIXES = [
+    "you are", "you're", "your role", "you will be", "you act", "you will act",
+    "act as", "act like", "behave as", "behave like", "imagine you", "pretend you",
+    "assume the role", "take the role", "play the role", "respond as",
+    "tu es", "tu est", "vous etes", "vous êtes", // French
+    "sen ", "siz ", // Turkish (Sen kıdemli…)
+    "eres ", "tú eres", "usted es", // Spanish (Eres…)
+    "ты ", "вы ", // Russian (Ты опытный…)
+    "あなたは", "君は", "お前は", "あなたが", // Japanese (あなたは…)
+    "你是", "您是", // Chinese (你是…)
+    "तुम ", "आप ", "तू ", // Hindi (तुम…)
+    "أنت ", "انت ", "أنتَ ", // Arabic (أنت…)
+];
+// Standing-directive verb openers — imperative behavioral rules that should
+// persist ("always respond in TypeScript", "never use emojis").
+const ROLE_DIRECTIVE_PREFIXES = [
+    "always ", "never ", "respond ", "reply ", "answer ", "speak ",
+    "write ", "prefer ", "format ", "output ", "communicate ", "use only ",
+];
+function hasRoleCue(firstClause) {
+    const lower = firstClause.toLowerCase().trim();
+    if (!lower)
+        return false;
+    // Strip leading conversational filler tokens via array ops (no regex).
+    const tokens = lower.split(" ").filter((t) => t.length > 0);
+    while (tokens.length > 0 && ROLE_FILLER_TOKENS.has(tokens[0])) {
+        tokens.shift();
+    }
+    const normalized = tokens.join(" ");
+    if (!normalized)
+        return false;
+    for (const prefix of ROLE_PERSONA_PREFIXES) {
+        if (normalized.startsWith(prefix))
+            return true;
+    }
+    for (const prefix of ROLE_DIRECTIVE_PREFIXES) {
+        if (normalized.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
 function looksLikeRole(trimmed) {
     // Role prompts are persona-prefix shaped: the FIRST SENTENCE declares the
     // role (e.g. "You are a senior backend engineer. <long context...>").
@@ -1457,6 +1523,10 @@ function looksLikeRole(trimmed) {
     const codepointLength = [...firstClause].length;
     if (codepointLength < ROLE_MIN_CHARS || codepointLength > ROLE_MAX_CHARS)
         return false;
+    // Issue #856 — require a persona / standing-directive cue so casual
+    // conversational acknowledgements do not freeze as a role directive.
+    if (!hasRoleCue(firstClause))
+        return false;
     return (TWO_LEXICAL_TOKENS_PATTERN.test(firstClause) ||
         CONTINUOUS_LETTER_RUN_PATTERN.test(firstClause));
 }