context-mode 1.0.39 → 1.0.40

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.39"
+    "version": "1.0.40"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.39",
+      "version": "1.0.40",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/build/adapters/detect.d.ts

@@ -10,7 +10,7 @@
  *   - Claude Code:    CLAUDE_PROJECT_DIR, CLAUDE_SESSION_ID | ~/.claude/
  *   - Gemini CLI:     GEMINI_PROJECT_DIR (hooks), GEMINI_CLI (MCP) | ~/.gemini/
  *   - OpenCode:       OPENCODE, OPENCODE_PID | ~/.config/opencode/
- *   - OpenClaw:       OPENCLAW_HOME, OPENCLAW_PROJECT_DIR | ~/.openclaw/
+ *   - OpenClaw:       OPENCLAW_HOME, OPENCLAW_CLI | ~/.openclaw/
  *   - Codex CLI:      CODEX_CI, CODEX_THREAD_ID | ~/.codex/
  *   - Cursor:         CURSOR_TRACE_ID (MCP), CURSOR_CLI (terminal) | ~/.cursor/
  *   - VS Code Copilot: VSCODE_PID, VSCODE_CWD | ~/.vscode/

package/build/adapters/detect.js

@@ -10,7 +10,7 @@
  *   - Claude Code:    CLAUDE_PROJECT_DIR, CLAUDE_SESSION_ID | ~/.claude/
  *   - Gemini CLI:     GEMINI_PROJECT_DIR (hooks), GEMINI_CLI (MCP) | ~/.gemini/
  *   - OpenCode:       OPENCODE, OPENCODE_PID | ~/.config/opencode/
- *   - OpenClaw:       OPENCLAW_HOME, OPENCLAW_PROJECT_DIR | ~/.openclaw/
+ *   - OpenClaw:       OPENCLAW_HOME, OPENCLAW_CLI | ~/.openclaw/
  *   - Codex CLI:      CODEX_CI, CODEX_THREAD_ID | ~/.codex/
  *   - Cursor:         CURSOR_TRACE_ID (MCP), CURSOR_CLI (terminal) | ~/.cursor/
  *   - VS Code Copilot: VSCODE_PID, VSCODE_CWD | ~/.vscode/
@@ -67,11 +67,11 @@ export function detectPlatform(clientInfo) {
             reason: "GEMINI_PROJECT_DIR or GEMINI_CLI env var set",
         };
     }
-    if (process.env.OPENCLAW_HOME || process.env.OPENCLAW_PROJECT_DIR) {
+    if (process.env.OPENCLAW_HOME || process.env.OPENCLAW_CLI) {
         return {
             platform: "openclaw",
             confidence: "high",
-            reason: "OPENCLAW_HOME or OPENCLAW_PROJECT_DIR env var set",
+            reason: "OPENCLAW_HOME or OPENCLAW_CLI env var set",
         };
     }
     if (process.env.OPENCODE || process.env.OPENCODE_PID) {

package/build/adapters/openclaw/index.d.ts

@@ -11,7 +11,7 @@
  *   - Arg modification: mutate event.params in tool_call:before
  *   - Blocking: return { block: true, blockReason } from tool_call:before
  *   - Session ID: event context (no specific env var)
- *   - Project dir: process.env.OPENCLAW_PROJECT_DIR or process.cwd()
+ *   - Project dir: process.cwd()
  *   - Config: openclaw.json plugins.entries, ~/.openclaw/extensions/
  *   - Session dir: ~/.openclaw/context-mode/sessions/
  */

package/build/adapters/openclaw/index.js

@@ -11,7 +11,7 @@
  *   - Arg modification: mutate event.params in tool_call:before
  *   - Blocking: return { block: true, blockReason } from tool_call:before
  *   - Session ID: event context (no specific env var)
- *   - Project dir: process.env.OPENCLAW_PROJECT_DIR or process.cwd()
+ *   - Project dir: process.cwd()
  *   - Config: openclaw.json plugins.entries, ~/.openclaw/extensions/
  *   - Session dir: ~/.openclaw/context-mode/sessions/
  */
@@ -45,7 +45,7 @@ export class OpenClawAdapter {
             toolName: input.toolName ?? input.tool_name ?? "",
             toolInput: input.params ?? input.tool_input ?? {},
             sessionId: this.extractSessionId(input),
-            projectDir: process.env.OPENCLAW_PROJECT_DIR || process.cwd(),
+            projectDir: process.cwd(),
             raw,
         };
     }
@@ -57,7 +57,7 @@ export class OpenClawAdapter {
             toolOutput: input.output ?? input.tool_output,
             isError: input.isError ?? input.is_error,
             sessionId: this.extractSessionId(input),
-            projectDir: process.env.OPENCLAW_PROJECT_DIR || process.cwd(),
+            projectDir: process.cwd(),
             raw,
         };
     }
@@ -65,7 +65,7 @@ export class OpenClawAdapter {
         const input = raw;
         return {
             sessionId: this.extractSessionId(input),
-            projectDir: process.env.OPENCLAW_PROJECT_DIR || process.cwd(),
+            projectDir: process.cwd(),
             raw,
         };
     }
@@ -89,7 +89,7 @@ export class OpenClawAdapter {
         return {
             sessionId: this.extractSessionId(input),
             source,
-            projectDir: process.env.OPENCLAW_PROJECT_DIR || process.cwd(),
+            projectDir: process.cwd(),
             raw,
         };
     }

package/build/adapters/opencode/index.js

@@ -42,8 +42,8 @@ export class OpenCodeAdapter {
     parsePreToolUseInput(raw) {
         const input = raw;
         return {
-            toolName: input.tool_name ?? "",
-            toolInput: input.tool_input ?? {},
+            toolName: input.tool ?? "",
+            toolInput: input.args ?? {},
             sessionId: this.extractSessionId(input),
             projectDir: process.env.OPENCODE_PROJECT_DIR || process.cwd(),
             raw,
@@ -52,10 +52,10 @@ export class OpenCodeAdapter {
     parsePostToolUseInput(raw) {
         const input = raw;
         return {
-            toolName: input.tool_name ?? "",
-            toolInput: input.tool_input ?? {},
-            toolOutput: input.tool_output,
-            isError: input.is_error,
+            toolName: input.tool ?? "",
+            toolInput: input.args ?? {},
+            toolOutput: input.output,
+            isError: undefined, // OpenCode doesn't provide isError
             sessionId: this.extractSessionId(input),
             projectDir: process.env.OPENCODE_PROJECT_DIR || process.cwd(),
             raw,

package/build/openclaw-plugin.js

@@ -98,7 +98,7 @@ export default {
     register(api) {
         // Resolve build dir from compiled JS location
         const buildDir = dirname(fileURLToPath(import.meta.url));
-        const projectDir = process.env.OPENCLAW_PROJECT_DIR || process.cwd();
+        const projectDir = process.cwd();
         const pluginRoot = resolve(buildDir, "..");
         // Structured logger — wraps api.logger, falls back to no-op.
         // info/error always emit; debug only when api.logger.debug is present

package/build/opencode-plugin.d.ts

@@ -17,21 +17,45 @@
 interface PluginContext {
     directory: string;
 }
-/** Shape of the input object OpenCode passes to hook functions. */
-interface ToolHookInput {
-    tool_name?: string;
-    tool_input?: Record<string, unknown>;
-    tool_output?: string;
-    is_error?: boolean;
-    sessionID?: string;
+/** OpenCode tool.execute.before — first parameter */
+interface BeforeHookInput {
+    tool: string;
+    sessionID: string;
+    callID: string;
+}
+/** OpenCode tool.execute.before — second parameter */
+interface BeforeHookOutput {
+    args: any;
+}
+/** OpenCode tool.execute.after — first parameter */
+interface AfterHookInput {
+    tool: string;
+    sessionID: string;
+    callID: string;
+    args: any;
+}
+/** OpenCode tool.execute.after — second parameter */
+interface AfterHookOutput {
+    title: string;
+    output: string;
+    metadata: any;
+}
+/** OpenCode experimental.session.compacting — first parameter */
+interface CompactingHookInput {
+    sessionID: string;
+}
+/** OpenCode experimental.session.compacting — second parameter */
+interface CompactingHookOutput {
+    context: string[];
+    prompt?: string;
 }
 /**
  * OpenCode plugin factory. Called once when OpenCode loads the plugin.
  * Returns an object mapping hook event names to async handler functions.
  */
 export declare const ContextModePlugin: (ctx: PluginContext) => Promise<{
-    "tool.execute.before": (input: ToolHookInput) => Promise<void>;
-    "tool.execute.after": (input: ToolHookInput) => Promise<void>;
-    "experimental.session.compacting": () => Promise<string>;
+    "tool.execute.before": (input: BeforeHookInput, output: BeforeHookOutput) => Promise<void>;
+    "tool.execute.after": (input: AfterHookInput, output: AfterHookOutput) => Promise<void>;
+    "experimental.session.compacting": (input: CompactingHookInput, output: CompactingHookOutput) => Promise<string>;
 }>;
 export {};

package/build/opencode-plugin.js

@@ -63,9 +63,9 @@ export const ContextModePlugin = async (ctx) => {
     db.cleanupOldSessions(0);
     return {
         // ── PreToolUse: Routing enforcement ─────────────────
-        "tool.execute.before": async (input) => {
-            const toolName = input.tool_name ?? "";
-            const toolInput = input.tool_input ?? {};
+        "tool.execute.before": async (input, output) => {
+            const toolName = input.tool ?? "";
+            const toolInput = output.args ?? {};
             let decision;
             try {
                 decision = routing.routePreToolUse(toolName, toolInput, projectDir);
@@ -80,19 +80,19 @@ export const ContextModePlugin = async (ctx) => {
                 throw new Error(decision.reason ?? "Blocked by context-mode");
             }
             if (decision.action === "modify" && decision.updatedInput) {
-                // Mutate args in place — OpenCode reads the mutated input
-                Object.assign(toolInput, decision.updatedInput);
+                // Mutate output.args — OpenCode reads the mutated output object
+                Object.assign(output.args, decision.updatedInput);
             }
             // "context" action → no-op (OpenCode doesn't support context injection)
         },
         // ── PostToolUse: Session event capture ──────────────
-        "tool.execute.after": async (input) => {
+        "tool.execute.after": async (input, output) => {
             try {
                 const hookInput = {
-                    tool_name: input.tool_name ?? "",
-                    tool_input: input.tool_input ?? {},
-                    tool_response: input.tool_output,
-                    tool_output: input.is_error ? { isError: true } : undefined,
+                    tool_name: input.tool ?? "",
+                    tool_input: input.args ?? {},
+                    tool_response: output.output,
+                    tool_output: undefined, // OpenCode doesn't provide isError
                 };
                 const events = extractEvents(hookInput);
                 for (const event of events) {
@@ -105,7 +105,7 @@ export const ContextModePlugin = async (ctx) => {
             }
         },
         // ── PreCompact: Snapshot generation ─────────────────
-        "experimental.session.compacting": async () => {
+        "experimental.session.compacting": async (input, output) => {
             try {
                 const events = db.getEvents(sessionId);
                 if (events.length === 0)
@@ -116,6 +116,8 @@ export const ContextModePlugin = async (ctx) => {
                 });
                 db.upsertResume(sessionId, snapshot, events.length);
                 db.incrementCompactCount(sessionId);
+                // Mutate output.context to inject the snapshot
+                output.context.push(snapshot);
                 return snapshot;
             }
             catch {

package/build/server.js

@@ -80,7 +80,7 @@ function maybeIndexSessionEvents(store) {
 function getStorePath() {
     const projectDir = process.env.CLAUDE_PROJECT_DIR
         || process.env.GEMINI_PROJECT_DIR
-        || process.env.OPENCLAW_PROJECT_DIR
+        || process.env.OPENCLAW_HOME
         || process.cwd();
     const normalized = projectDir.replace(/\\/g, "/");
     const hash = createHash("sha256").update(normalized).digest("hex").slice(0, 16);
@@ -1504,43 +1504,70 @@ server.registerTool("ctx_stats", {
         content: [{ type: "text", text }],
     });
 });
-// ── ctx-doctor: diagnostics meta-tool ──────────────────────────────────────
+// ── ctx-doctor: diagnostics (server-side) ─────────────────────────────────
 server.registerTool("ctx_doctor", {
     title: "Run Diagnostics",
-    description: "Diagnose context-mode installation. Returns a shell command to execute. " +
-        "You MUST run the returned command using your shell tool (Bash, shell_execute, " +
-        "run_in_terminal, etc.) and display the output as a markdown checklist.",
+    description: "Diagnose context-mode installation. Runs all checks server-side and " +
+        "returns results as a markdown checklist. No CLI execution needed.",
     inputSchema: z.object({}),
 }, async () => {
+    const lines = ["## context-mode doctor", ""];
     const pluginRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-    const bundlePath = resolve(pluginRoot, "cli.bundle.mjs");
-    const fallbackPath = resolve(pluginRoot, "build", "cli.js");
-    const cliPath = existsSync(bundlePath) ? bundlePath : fallbackPath;
-    const cmd = `node "${cliPath}" doctor`;
-    const text = [
-        "## ctx-doctor",
-        "",
-        "Run this command using your shell execution tool:",
-        "",
-        "```",
-        cmd,
-        "```",
-        "",
-        "After the command completes, display results as a markdown checklist:",
-        "- `[x]` for PASS, `[ ]` for FAIL, `[-]` for WARN",
-        "- Example format:",
-        "  ```",
-        "  ## context-mode doctor",
-        "  - [x] Runtimes: 6/10 (javascript, typescript, python, shell, ruby, perl)",
-        "  - [x] Performance: FAST (Bun)",
-        "  - [x] Server test: PASS",
-        "  - [x] Hooks: PASS",
-        "  - [x] FTS5: PASS",
-        "  - [x] npm: v0.9.23",
-        "  ```",
-    ].join("\n");
+    // Runtimes
+    const total = 11;
+    const pct = ((available.length / total) * 100).toFixed(0);
+    lines.push(`- [x] Runtimes: ${available.length}/${total} (${pct}%) — ${available.join(", ")}`);
+    // Performance
+    if (hasBunRuntime()) {
+        lines.push("- [x] Performance: FAST (Bun)");
+    }
+    else {
+        lines.push("- [-] Performance: NORMAL — install Bun for 3-5x speed boost");
+    }
+    // Server test
+    try {
+        const testExecutor = new PolyglotExecutor({ runtimes });
+        const result = await testExecutor.execute({ language: "javascript", code: 'console.log("ok");', timeout: 5000 });
+        if (result.exitCode === 0 && result.stdout.trim() === "ok") {
+            lines.push("- [x] Server test: PASS");
+        }
+        else {
+            lines.push(`- [ ] Server test: FAIL — exit ${result.exitCode}`);
+        }
+    }
+    catch (err) {
+        lines.push(`- [ ] Server test: FAIL — ${err instanceof Error ? err.message : err}`);
+    }
+    // FTS5 / SQLite
+    try {
+        const Database = loadDatabase();
+        const db = new Database(":memory:");
+        db.exec("CREATE VIRTUAL TABLE fts_test USING fts5(content)");
+        db.exec("INSERT INTO fts_test(content) VALUES ('hello world')");
+        const row = db.prepare("SELECT * FROM fts_test WHERE fts_test MATCH 'hello'").get();
+        db.close();
+        if (row && row.content === "hello world") {
+            lines.push("- [x] FTS5 / SQLite: PASS — native module works");
+        }
+        else {
+            lines.push("- [ ] FTS5 / SQLite: FAIL — unexpected result");
+        }
+    }
+    catch (err) {
+        lines.push(`- [ ] FTS5 / SQLite: FAIL — ${err instanceof Error ? err.message : err}`);
+    }
+    // Hook script
+    const hookPath = resolve(pluginRoot, "hooks", "pretooluse.mjs");
+    if (existsSync(hookPath)) {
+        lines.push(`- [x] Hook script: PASS — ${hookPath}`);
+    }
+    else {
+        lines.push(`- [ ] Hook script: FAIL — not found at ${hookPath}`);
+    }
+    // Version
+    lines.push(`- [x] Version: v${VERSION}`);
     return trackResponse("ctx_doctor", {
-        content: [{ type: "text", text }],
+        content: [{ type: "text", text: lines.join("\n") }],
     });
 });
 // ── ctx-upgrade: upgrade meta-tool ─────────────────────────────────────────
@@ -1555,8 +1582,54 @@ server.registerTool("ctx_upgrade", {
     const pluginRoot = dirname(dirname(fileURLToPath(import.meta.url)));
     const bundlePath = resolve(pluginRoot, "cli.bundle.mjs");
     const fallbackPath = resolve(pluginRoot, "build", "cli.js");
-    const cliPath = existsSync(bundlePath) ? bundlePath : fallbackPath;
-    const cmd = `node "${cliPath}" upgrade`;
+    let cmd;
+    if (existsSync(bundlePath)) {
+        cmd = `node "${bundlePath}" upgrade`;
+    }
+    else if (existsSync(fallbackPath)) {
+        cmd = `node "${fallbackPath}" upgrade`;
+    }
+    else {
+        // Inline fallback: neither CLI file exists (e.g. marketplace installs).
+        // Generate a self-contained node -e script that performs the upgrade.
+        const repoUrl = "https://github.com/mksglu/context-mode.git";
+        const copyDirs = ["build", "hooks", "skills", "scripts", ".claude-plugin"];
+        const copyFiles = ["start.mjs", "server.bundle.mjs", "cli.bundle.mjs", "package.json"];
+        // Write inline script to a temp .mjs file — avoids quote-escaping issues
+        // across cmd.exe, PowerShell, and bash (node -e '...' breaks on Windows).
+        const scriptLines = [
+            `import{execSync}from"node:child_process";`,
+            `import{cpSync,rmSync,existsSync,mkdtempSync}from"node:fs";`,
+            `import{join}from"node:path";`,
+            `import{tmpdir}from"node:os";`,
+            `const P=${JSON.stringify(pluginRoot)};`,
+            `const T=mkdtempSync(join(tmpdir(),"ctx-upgrade-"));`,
+            `try{`,
+            `console.log("- [x] Starting inline upgrade (no CLI found)");`,
+            `execSync("git clone --depth 1 ${repoUrl} \\""+T+"\\"",{stdio:"inherit"});`,
+            `console.log("- [x] Cloned latest source");`,
+            `execSync("npm install",{cwd:T,stdio:"inherit"});`,
+            `execSync("npm run build",{cwd:T,stdio:"inherit"});`,
+            `console.log("- [x] Built from source");`,
+            ...copyDirs.map((d) => `if(existsSync(join(T,${JSON.stringify(d)})))cpSync(join(T,${JSON.stringify(d)}),join(P,${JSON.stringify(d)}),{recursive:true,force:true});`),
+            ...copyFiles.map((f) => `if(existsSync(join(T,${JSON.stringify(f)})))cpSync(join(T,${JSON.stringify(f)}),join(P,${JSON.stringify(f)}),{force:true});`),
+            `console.log("- [x] Copied build artifacts");`,
+            `execSync("npm install --production",{cwd:P,stdio:"inherit"});`,
+            `console.log("- [x] Installed production dependencies");`,
+            `console.log("## context-mode upgrade complete");`,
+            `}catch(e){`,
+            `console.error("- [ ] Upgrade failed:",e.message);`,
+            `process.exit(1);`,
+            `}finally{`,
+            `try{rmSync(T,{recursive:true,force:true})}catch{}`,
+            `}`,
+        ].join("\n");
+        // Server writes the temp script file — avoids shell quoting issues entirely
+        const tmpScript = resolve(pluginRoot, ".ctx-upgrade-inline.mjs");
+        const { writeFileSync: writeTmp } = await import("node:fs");
+        writeTmp(tmpScript, scriptLines);
+        cmd = `node "${tmpScript}"`;
+    }
     const text = [
         "## ctx-upgrade",
         "",

package/hooks/session-loaders.mjs

@@ -1,28 +1,44 @@
 /**
- * Session module loaders — bundle-only.
+ * Session module loaders — bundle-first with build/ fallback.
  *
  * All session modules are loaded from esbuild bundles (hooks/session-*.bundle.mjs).
  * Bundles are built by CI (bundle.yml) and shipped with every release.
- * No fallback to build/ — if the bundle is missing, the error surfaces immediately.
+ * Fallback: if bundles are missing (marketplace installs), try build/session/*.js.
  */
 
-import { join, basename } from "node:path";
+import { join } from "node:path";
 import { pathToFileURL } from "node:url";
+import { existsSync } from "node:fs";
 
 export function createSessionLoaders(hookDir) {
-  const bundleDir = basename(hookDir) === "vscode-copilot"
-    ? join(hookDir, "..")
-    : hookDir;
+  // Auto-detect bundle directory: bundles live in hooks/ root, not platform subdirs.
+  // If hookDir itself has bundles, use it; otherwise go up one level.
+  const bundleDir = existsSync(join(hookDir, "session-db.bundle.mjs"))
+    ? hookDir
+    : join(hookDir, "..");
+
+  // Fallback: if bundles missing, try build/session/*.js (marketplace installs)
+  const pluginRoot = join(bundleDir, "..");
+  const buildSession = join(pluginRoot, "build", "session");
+
+  async function loadModule(bundleName, buildName) {
+    const bundlePath = join(bundleDir, bundleName);
+    if (existsSync(bundlePath)) {
+      return await import(pathToFileURL(bundlePath).href);
+    }
+    const buildPath = join(buildSession, buildName);
+    return await import(pathToFileURL(buildPath).href);
+  }
 
   return {
     async loadSessionDB() {
-      return await import(pathToFileURL(join(bundleDir, "session-db.bundle.mjs")).href);
+      return await loadModule("session-db.bundle.mjs", "db.js");
     },
     async loadExtract() {
-      return await import(pathToFileURL(join(bundleDir, "session-extract.bundle.mjs")).href);
+      return await loadModule("session-extract.bundle.mjs", "extract.js");
     },
     async loadSnapshot() {
-      return await import(pathToFileURL(join(bundleDir, "session-snapshot.bundle.mjs")).href);
+      return await loadModule("session-snapshot.bundle.mjs", "snapshot.js");
     },
   };
 }

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "type": "module",
   "description": "MCP plugin that saves 98% of your context window. Works with Claude Code, Gemini CLI, VS Code Copilot, OpenCode, and Codex CLI. Sandboxed code execution, FTS5 knowledge base, and intent-driven search.",
   "author": "Mert Koseoğlu",

package/scripts/postinstall.mjs

@@ -16,6 +16,14 @@ import { fileURLToPath } from "node:url";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkgRoot = resolve(__dirname, "..");
 
+/**
+ * Validate that a path is safe to interpolate into a cmd.exe command.
+ * Rejects characters that could enable command injection via cmd.exe.
+ */
+function isSafeWindowsPath(p) {
+  return !/[&|<>"^%\r\n]/.test(p);
+}
+
 // ── 1. OpenClaw detection ────────────────────────────────────────────
 if (process.env.OPENCLAW_STATE_DIR) {
   console.log("\n  OpenClaw detected. Run: npm run install:openclaw\n");
@@ -73,12 +81,17 @@ if (process.platform === "win32" && process.env.npm_config_global === "true") {
         }
 
         // Create directory junction (no admin privileges needed on Windows 10+)
-        execSync(`mklink /J "${expectedPkgDir}" "${actualPkgDir}"`, {
-          shell: "cmd.exe",
-          stdio: "pipe",
-        });
-        console.log(`\n  context-mode: created junction for nvm4w compatibility`);
-        console.log(`    ${expectedPkgDir} → ${actualPkgDir}\n`);
+        // Validate paths to prevent cmd.exe injection via shell metacharacters
+        if (!isSafeWindowsPath(expectedPkgDir) || !isSafeWindowsPath(actualPkgDir)) {
+          console.warn(`  context-mode: skipping junction — path contains unsafe characters`);
+        } else {
+          execSync(`mklink /J "${expectedPkgDir}" "${actualPkgDir}"`, {
+            shell: "cmd.exe",
+            stdio: "pipe",
+          });
+          console.log(`\n  context-mode: created junction for nvm4w compatibility`);
+          console.log(`    ${expectedPkgDir} → ${actualPkgDir}\n`);
+        }
       }
     }
 

package/skills/ctx-doctor/SKILL.md

@@ -13,20 +13,10 @@ Run diagnostics and display results directly in the conversation.
 
 ## Instructions
 
-1. Derive the **plugin root** from this skill's base directory (go up 2 levels — remove `/skills/ctx-doctor`).
-2. Run with Bash:
+1. Call the `ctx_doctor` MCP tool directly. It runs all checks server-side and returns a markdown checklist.
+2. Display the results verbatim — they are already formatted as a checklist with `[x]` PASS, `[ ]` FAIL, `[-]` WARN.
+3. **Fallback** (only if MCP tool call fails): Derive the **plugin root** from this skill's base directory (go up 2 levels — remove `/skills/ctx-doctor`), then run with Bash:
    ```
    CLI="<PLUGIN_ROOT>/cli.bundle.mjs"; [ ! -f "$CLI" ] && CLI="<PLUGIN_ROOT>/build/cli.js"; node "$CLI" doctor
    ```
-3. **IMPORTANT**: After the Bash tool completes, re-display the key results as markdown text directly in the conversation so the user sees them without expanding the tool output. Format as a checklist:
-   ```
-   ## context-mode doctor
-   - [x] Runtimes: 6/10 (javascript, typescript, python, shell, ruby, perl)
-   - [x] Performance: FAST (Bun)
-   - [x] Server test: PASS
-   - [x] Hooks: PASS
-   - [x] FTS5: PASS
-   - [x] npm: v0.7.1
-   - [x] Marketplace: v0.7.1
-   ```
-   Use `[x]` for PASS, `[ ]` for FAIL, `[-]` for WARN.
+   Re-display results as a markdown checklist.

package/skills/ctx-upgrade/SKILL.md

@@ -13,20 +13,19 @@ Pull latest from GitHub and reinstall the plugin.
 
 ## Instructions
 
-1. Derive the **plugin root** from this skill's base directory (go up 2 levels — remove `/skills/ctx-upgrade`).
-2. Run with Bash:
-   ```
-   CLI="<PLUGIN_ROOT>/cli.bundle.mjs"; [ ! -f "$CLI" ] && CLI="<PLUGIN_ROOT>/build/cli.js"; node "$CLI" upgrade
-   ```
-3. **IMPORTANT**: After the Bash tool completes, re-display the key results as markdown text directly in the conversation so the user sees them without expanding the tool output. Format as:
+1. Call the `ctx_upgrade` MCP tool directly. It returns a shell command to execute.
+2. Run the returned command using your shell execution tool (Bash, shell_execute, etc.).
+3. Display results as a markdown checklist:
    ```
    ## context-mode upgrade
    - [x] Pulled latest from GitHub
-   - [x] Built and installed v0.9.13
-   - [x] npm global updated
+   - [x] Built and installed v1.0.39
    - [x] Hooks configured
-   - [x] Permissions set
    - [x] Doctor: all checks PASS
    ```
-   Use `[x]` for success, `[ ]` for failure. Show the actual version numbers and any warnings.
-   Tell the user to **restart their Claude Code session** to pick up the new version.
+   Use `[x]` for success, `[ ]` for failure. Show actual version numbers.
+4. Tell the user to **restart their session** to pick up the new version.
+5. **Fallback** (only if MCP tool call fails): Derive the **plugin root** from this skill's base directory (go up 2 levels — remove `/skills/ctx-upgrade`), then run with Bash:
+   ```
+   CLI="<PLUGIN_ROOT>/cli.bundle.mjs"; [ ! -f "$CLI" ] && CLI="<PLUGIN_ROOT>/build/cli.js"; node "$CLI" upgrade
+   ```

package/start.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { execSync } from "node:child_process";
-import { existsSync, copyFileSync, readFileSync, writeFileSync, readdirSync } from "node:fs";
+import { existsSync, copyFileSync, chmodSync, readFileSync, writeFileSync, readdirSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
@@ -56,47 +56,65 @@ if (!process.env.CLAUDE_PROJECT_DIR) {
   process.env.CLAUDE_PROJECT_DIR = originalCwd;
 }
 
-// Auto-write routing instructions file for the detected platform
+// Auto-write routing instructions file for NON-hook-capable platforms only.
+// Hook-capable platforms (Claude Code, Gemini CLI, VS Code Copilot, OpenCode, OpenClaw)
+// inject routing via SessionStart hook — writing to disk dirties the git tree (#158).
+// server.ts also guards this with adapter.capabilities.sessionStart.
 try {
-  const projectDir =
-    process.env.CLAUDE_PROJECT_DIR ||
-    process.env.GEMINI_PROJECT_DIR ||
-    process.env.VSCODE_CWD ||
-    process.cwd();
-
-  const configsDir = resolve(__dirname, "configs");
-
-  // Detect platform and determine instruction file
-  const platformConfigs = [
-    { env: ["CLAUDE_PROJECT_DIR", "CLAUDE_SESSION_ID"], dir: "claude-code", file: "CLAUDE.md", target: "CLAUDE.md" },
-    { env: ["GEMINI_PROJECT_DIR", "GEMINI_SESSION_ID"], dir: "gemini-cli", file: "GEMINI.md", target: "GEMINI.md" },
-    { env: ["VSCODE_PID", "VSCODE_CWD"], dir: "vscode-copilot", file: "copilot-instructions.md", target: ".github/copilot-instructions.md" },
-    { env: ["OPENCODE_PROJECT_DIR", "OPENCODE_SESSION_ID"], dir: "opencode", file: "AGENTS.md", target: "AGENTS.md" },
-    { env: ["OPENCLAW_HOME", "OPENCLAW_PROJECT_DIR"], dir: "openclaw", file: "AGENTS.md", target: "AGENTS.md" },
-    { env: ["CODEX_HOME"], dir: "codex", file: "AGENTS.md", target: "AGENTS.md" },
+  // Hook-capable platforms set these env vars — skip file write for them.
+  // Uses verified env vars from src/adapters/detect.ts (not invented session IDs).
+  const hookCapableSessionVars = [
+    "CLAUDE_SESSION_ID",        // Claude Code
+    "GEMINI_PROJECT_DIR",       // Gemini CLI (GEMINI_CLI also valid)
+    "OPENCODE",                 // OpenCode (OPENCODE_PID also valid)
+    "OPENCLAW_HOME",            // OpenClaw (user-set home dir)
+    "OPENCLAW_CLI",             // OpenClaw (set at runtime by openclaw CLI)
+    // VS Code Copilot: VSCODE_PID is too broad (set for ALL VS Code extensions).
+    // Accept occasional harmless write rather than false-positive suppression.
   ];
+  const hasHookSupport = hookCapableSessionVars.some((e) => process.env[e]);
+
+  if (!hasHookSupport) {
+    const projectDir =
+      process.env.CLAUDE_PROJECT_DIR ||
+      process.env.GEMINI_PROJECT_DIR ||
+      process.env.VSCODE_CWD ||
+      process.cwd();
+
+    const configsDir = resolve(__dirname, "configs");
+
+    // Detect platform and determine instruction file
+    const platformConfigs = [
+      { env: ["CLAUDE_PROJECT_DIR"], dir: "claude-code", file: "CLAUDE.md", target: "CLAUDE.md" },
+      { env: ["GEMINI_PROJECT_DIR"], dir: "gemini-cli", file: "GEMINI.md", target: "GEMINI.md" },
+      { env: ["VSCODE_CWD"], dir: "vscode-copilot", file: "copilot-instructions.md", target: ".github/copilot-instructions.md" },
+      { env: ["OPENCODE_PROJECT_DIR"], dir: "opencode", file: "AGENTS.md", target: "AGENTS.md" },
+      { env: ["OPENCLAW_HOME"], dir: "openclaw", file: "AGENTS.md", target: "AGENTS.md" },
+      { env: ["CODEX_HOME"], dir: "codex", file: "AGENTS.md", target: "AGENTS.md" },
+    ];
+
+    const detected = platformConfigs.find((p) => p.env.some((e) => process.env[e]));
+    if (detected) {
+      const targetPath = resolve(projectDir, detected.target);
+      const sourcePath = resolve(configsDir, detected.dir, detected.file);
+
+      // Ensure parent dir exists (for .github/copilot-instructions.md)
+      const targetDir = resolve(targetPath, "..");
+      if (!existsSync(targetDir)) {
+        const { mkdirSync } = await import("node:fs");
+        mkdirSync(targetDir, { recursive: true });
+      }
 
-  const detected = platformConfigs.find((p) => p.env.some((e) => process.env[e]));
-  if (detected) {
-    const targetPath = resolve(projectDir, detected.target);
-    const sourcePath = resolve(configsDir, detected.dir, detected.file);
-
-    // Ensure parent dir exists (for .github/copilot-instructions.md)
-    const targetDir = resolve(targetPath, "..");
-    if (!existsSync(targetDir)) {
-      const { mkdirSync } = await import("node:fs");
-      mkdirSync(targetDir, { recursive: true });
-    }
-
-    if (existsSync(sourcePath)) {
-      const content = readFileSync(sourcePath, "utf-8");
-      if (existsSync(targetPath)) {
-        const existing = readFileSync(targetPath, "utf-8");
-        if (!existing.includes("context-mode")) {
-          writeFileSync(targetPath, existing.trimEnd() + "\n\n" + content, "utf-8");
+      if (existsSync(sourcePath)) {
+        const content = readFileSync(sourcePath, "utf-8");
+        if (existsSync(targetPath)) {
+          const existing = readFileSync(targetPath, "utf-8");
+          if (!existing.includes("context-mode")) {
+            writeFileSync(targetPath, existing.trimEnd() + "\n\n" + content, "utf-8");
+          }
+        } else {
+          writeFileSync(targetPath, content, "utf-8");
         }
-      } else {
-        writeFileSync(targetPath, content, "utf-8");
       }
     }
   }
@@ -172,6 +190,13 @@ for (const pkg of ["better-sqlite3", "turndown", "turndown-plugin-gfm", "@mixmar
 // Each ABI needs its own compiled binary — cache them side-by-side.
 ensureNativeCompat(__dirname);
 
+// Self-heal: create CLI shim if cli.bundle.mjs is missing (marketplace installs)
+if (!existsSync(resolve(__dirname, "cli.bundle.mjs")) && existsSync(resolve(__dirname, "build", "cli.js"))) {
+  const shimPath = resolve(__dirname, "cli.bundle.mjs");
+  writeFileSync(shimPath, '#!/usr/bin/env node\nawait import("./build/cli.js");\n');
+  if (process.platform !== "win32") chmodSync(shimPath, 0o755);
+}
+
 // Bundle exists (CI-built) — start instantly
 if (existsSync(resolve(__dirname, "server.bundle.mjs"))) {
   await import("./server.bundle.mjs");