context-mode 1.0.39 → 1.0.41

package/hooks/session-loaders.mjs

@@ -1,28 +1,44 @@
 /**
- * Session module loaders — bundle-only.
+ * Session module loaders — bundle-first with build/ fallback.
  *
  * All session modules are loaded from esbuild bundles (hooks/session-*.bundle.mjs).
  * Bundles are built by CI (bundle.yml) and shipped with every release.
- * No fallback to build/ — if the bundle is missing, the error surfaces immediately.
+ * Fallback: if bundles are missing (marketplace installs), try build/session/*.js.
  */
 
-import { join, basename } from "node:path";
+import { join } from "node:path";
 import { pathToFileURL } from "node:url";
+import { existsSync } from "node:fs";
 
 export function createSessionLoaders(hookDir) {
-  const bundleDir = basename(hookDir) === "vscode-copilot"
-    ? join(hookDir, "..")
-    : hookDir;
+  // Auto-detect bundle directory: bundles live in hooks/ root, not platform subdirs.
+  // If hookDir itself has bundles, use it; otherwise go up one level.
+  const bundleDir = existsSync(join(hookDir, "session-db.bundle.mjs"))
+    ? hookDir
+    : join(hookDir, "..");
+
+  // Fallback: if bundles missing, try build/session/*.js (marketplace installs)
+  const pluginRoot = join(bundleDir, "..");
+  const buildSession = join(pluginRoot, "build", "session");
+
+  async function loadModule(bundleName, buildName) {
+    const bundlePath = join(bundleDir, bundleName);
+    if (existsSync(bundlePath)) {
+      return await import(pathToFileURL(bundlePath).href);
+    }
+    const buildPath = join(buildSession, buildName);
+    return await import(pathToFileURL(buildPath).href);
+  }
 
   return {
     async loadSessionDB() {
-      return await import(pathToFileURL(join(bundleDir, "session-db.bundle.mjs")).href);
+      return await loadModule("session-db.bundle.mjs", "db.js");
     },
     async loadExtract() {
-      return await import(pathToFileURL(join(bundleDir, "session-extract.bundle.mjs")).href);
+      return await loadModule("session-extract.bundle.mjs", "extract.js");
     },
     async loadSnapshot() {
-      return await import(pathToFileURL(join(bundleDir, "session-snapshot.bundle.mjs")).href);
+      return await loadModule("session-snapshot.bundle.mjs", "snapshot.js");
     },
   };
 }

package/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.39",
+  "version": "1.0.41",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.39",
+  "version": "1.0.41",
   "type": "module",
   "description": "MCP plugin that saves 98% of your context window. Works with Claude Code, Gemini CLI, VS Code Copilot, OpenCode, and Codex CLI. Sandboxed code execution, FTS5 knowledge base, and intent-driven search.",
   "author": "Mert Koseoğlu",

package/scripts/postinstall.mjs

@@ -16,6 +16,14 @@ import { fileURLToPath } from "node:url";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkgRoot = resolve(__dirname, "..");
 
+/**
+ * Validate that a path is safe to interpolate into a cmd.exe command.
+ * Rejects characters that could enable command injection via cmd.exe.
+ */
+function isSafeWindowsPath(p) {
+  return !/[&|<>"^%\r\n]/.test(p);
+}
+
 // ── 1. OpenClaw detection ────────────────────────────────────────────
 if (process.env.OPENCLAW_STATE_DIR) {
   console.log("\n  OpenClaw detected. Run: npm run install:openclaw\n");
@@ -73,12 +81,17 @@ if (process.platform === "win32" && process.env.npm_config_global === "true") {
         }
 
         // Create directory junction (no admin privileges needed on Windows 10+)
-        execSync(`mklink /J "${expectedPkgDir}" "${actualPkgDir}"`, {
-          shell: "cmd.exe",
-          stdio: "pipe",
-        });
-        console.log(`\n  context-mode: created junction for nvm4w compatibility`);
-        console.log(`    ${expectedPkgDir} → ${actualPkgDir}\n`);
+        // Validate paths to prevent cmd.exe injection via shell metacharacters
+        if (!isSafeWindowsPath(expectedPkgDir) || !isSafeWindowsPath(actualPkgDir)) {
+          console.warn(`  context-mode: skipping junction — path contains unsafe characters`);
+        } else {
+          execSync(`mklink /J "${expectedPkgDir}" "${actualPkgDir}"`, {
+            shell: "cmd.exe",
+            stdio: "pipe",
+          });
+          console.log(`\n  context-mode: created junction for nvm4w compatibility`);
+          console.log(`    ${expectedPkgDir} → ${actualPkgDir}\n`);
+        }
       }
     }