context-mode 1.0.96 → 1.0.97

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.96"
+    "version": "1.0.97"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.96",
+      "version": "1.0.97",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.96",
+  "version": "1.0.97",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.96",
+  "version": "1.0.97",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.96",
+  "version": "1.0.97",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/build/server.js

@@ -3,9 +3,9 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
-import { existsSync, unlinkSync, readdirSync, readFileSync, writeFileSync, rmSync, mkdirSync, cpSync, statSync, symlinkSync } from "node:fs";
+import { existsSync, unlinkSync, readdirSync, readFileSync, writeFileSync, rmSync, mkdirSync, cpSync, statSync, symlinkSync, lstatSync } from "node:fs";
 import { execSync } from "node:child_process";
-import { join, dirname, resolve } from "node:path";
+import { join, dirname, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir, tmpdir } from "node:os";
 import { request as httpsRequest } from "node:https";
@@ -276,19 +276,30 @@ function healCacheMidSession() {
         if (!existsSync(ipPath))
             return;
         const ip = JSON.parse(readFileSync(ipPath, "utf-8"));
+        const cacheRoot = resolve(homedir(), ".claude", "plugins", "cache");
+        // Plugin root: build/ for tsc, plugin root for bundle
+        const pluginRoot = existsSync(resolve(__pkg_dir, "package.json")) ? __pkg_dir : dirname(__pkg_dir);
         for (const [key, entries] of Object.entries((ip.plugins ?? {}))) {
-            if (!key.toLowerCase().includes("context-mode"))
+            if (key !== "context-mode@context-mode")
                 continue;
             for (const entry of entries) {
                 const rp = entry.installPath;
                 if (!rp || existsSync(rp))
                     continue;
+                // Path traversal guard
+                if (!resolve(rp).startsWith(cacheRoot + sep))
+                    continue;
+                // Remove dangling symlink
+                try {
+                    if (lstatSync(rp).isSymbolicLink())
+                        unlinkSync(rp);
+                }
+                catch { }
                 const parent = dirname(rp);
                 if (!existsSync(parent))
                     mkdirSync(parent, { recursive: true });
-                const target = resolve(__pkg_dir, "..");
-                if (existsSync(target)) {
-                    symlinkSync(target, rp, process.platform === "win32" ? "junction" : undefined);
+                if (existsSync(pluginRoot)) {
+                    symlinkSync(pluginRoot, rp, process.platform === "win32" ? "junction" : undefined);
                 }
             }
         }