mksglu/context-mode v1.0.112

on GitHub

v1.0.112 — Highlights

This release leans hard on the community. Thirty-three external pull requests landed between v1.0.111 and v1.0.112, alongside a wave of Windows-class bug reports that finally get the surgical fixes they deserve. Headline themes: an FTS5 case-fold migration that quietly retires a whole class of stats corruption, a SessionDB-backed statusline that ends per-PID sidecar JSON, three independent security patches from the community (SSRF DNS-rebind, ctx_insight shell-injection, ctx_index path traversal), Cursor Marketplace packaging, and a Windows-hardening sweep covering MS Store Python stubs, non-ASCII tmpdirs, FTS5 detection on Node 22.5+, and bun.exe resolution for npm-installed Bun.

What's new

Stats & analytics

• FTS5 content-store case-fold migration with dual-hash purge — no more silently-orphaned rows after Windows path-case mismatches (internal; covers leftover #507 reported by @Scotchy49).
• SessionDB-backed statusline replaces per-PID sidecar JSON; richer event accounting with real-bytes wiring through ctx_stats (internal D2 work).
• Five-section narrative renderer simplifications: prose Section 3, marketing-trim Section 4, dual-unit byte formatter (internal).
• Statusline timeline reads from SessionDB so cross-process state stays consistent (internal).

Adapters & platforms

• Cursor Marketplace plugin packaging (#489 by @maxwell-orange, closes #485 by @maxwell-orange).
• New OMP (Oh My Pi) platform adapter and getAdapter('pi') fallthrough fix (#480 by @ousamabenyounes, closes #473 by @binhex).
• Pi extension session routing through PiAdapter.getSessionDir, MCP bridge bootstrap awaited in before_agent_start, MCP tools bridged into pi.registerTool() so the LLM can actually call them (#490, #472 by @ousamabenyounes, closes #426 by @leing2021).
• Pi extension lifecycle events corrected (#465 by @nicholasoxenden).
• Pi session age timestamps parsed as UTC (#488 by @s010mn).
• Pi extension routing and session start corrections (#497 by @ToniBig).
• OpenCode plugin: structured logging, removed per-session dedup sets, tighter plugin types, no more duplicate routing-block injection or AGENTS.md capture (#448, #487 by @mikij).
• Codex adapter: stale better-sqlite3 ABI repair (#446 by @TyceHerrman, addresses #408 by @Asureu); hook error normalization and patch-continuity guards (#479 by @Minghou-Lei); compact hook support (#492 by @MarcusNeufeldt).
• Claude Code adapter honours $CLAUDE_CONFIG_DIR (#458 by @voidborne-d, #460 by @halindrome, closes #453 by @halindrome).
• Kilo platform detection now checks KILO=1 and KILO_PID (#424 by @mikij).

Security

• DNS-rebinding gap closed in ctx_fetch_and_index SSRF guard (#476 by @aaronjmars).
• ctx_insight execSync string interpolation replaced with spawnSync and tightened port schema (#452 by @sebastianbreguel, closes #441 by @simtel12).
• Read deny-policy now enforced for ctx_index path argument; TOCTOU window closed via fd-bound reads with refresh deny re-check (#451 by @sebastianbreguel, closes #442 by @simtel12).
• Security policies no longer silently fail-open when build/security.js is missing (#468 by @maxwell-orange, closes #466, #467 by @maxwell-orange and #443 by @simtel12).
• ctx_insight helper spawnSync now capped, with locale-independent Windows netstat parser (#469 by @ousamabenyounes).

Hooks & runtime

• Worktree suffix project-root detection corrected (#435 by @ken-jo, closes #434 by @ken-jo).
• Shell executor preserves PATH after startup (#459 by @TyceHerrman).
• Bash routing nudge no longer fires on structurally-bounded commands (#470 by @ousamabenyounes, closes #463 by @rpickmans).
• Live UUID events preserved during fresh-startup cleanup; SessionStart hook errors investigated and tightened (internal; touches #414 by @Asureu and #471 by @Hermezenix).
• Tier-2 E2E smoke scaffolding asserting real token savings via ctx_* tools across Pi / Claude Code / OpenCode (#478 by @ousamabenyounes, closes #477 by @ousamabenyounes).

Cross-platform (Windows / Linux)

• FTS5 probed before node:sqlite adoption — fixes Linux + Node 22.5+ where node:sqlite lacks FTS5 (#464 by @ousamabenyounes, closes #461 by @Bobatev).
• Robust rmSync for Windows + non-ASCII tmpdir paths (#456 by @maxwell-orange, closes #454, #455 by @maxwell-orange).
• Windows MS Store Python stubs filtered; runnability verified before spawn (#457 by @maxwell-orange).
• Absolute bun.exe path resolved on Windows when Bun installed via npm (internal fix; closes #506 by @tomerikjansen-crypto).
• Windows path-separator normalization across D2 + multi-adapter test fixtures (internal).
• Statusline tests skip the darwin ps-walk path on win32; Windows CI dynamic-import uses file:// URLs (internal).

Build & DX

• ctx_upgrade inline fallback now copies package files correctly so bin/ survives (#431 by @NgoQuocViet2001, closes #429 by @alaa-nassef).
• UPSTREAM-CREDITS.md moved out of skills/ so the Pi skill scanner stops treating it as a malformed skill (#428 by @musaddiq-dev, closes #430 by @vipinks, #444 by @HorseArcher567, #447 by @tdietert, #475 by @oisili, #483, #484 by @MuziIsabel, and #496 by @davegomez).
• Maintainer-only skills relocated to .claude/skills/ (#439 by @KOCEAN33).
• Temporary checkout dirs ignored (#486 by @mkc909).
• Routing-rules and grep documentation refreshed (#498, #499 by @mikij).

Contributors

Huge thanks to everyone who shipped, reported, or reviewed this release:

@0xLeathery, @aaronjmars, @alaa-nassef, @asherepenko, @Asureu, @binhex, @Bobatev, @cjduncana, @davegomez, @halindrome, @Hermezenix, @HorseArcher567, @JewelSamAmy, @ken-jo, @KOCEAN33, @leing2021, @makoMakoGo, @MarcusNeufeldt, @markg85, @mateuszruszkowski, @maxwell-orange (4 PRs), @mikij (5 PRs), @Minghou-Lei, @mkc909, @murataslan1, @musaddiq-dev, @MuziIsabel, @NgoQuocViet2001, @nicholasoxenden, @oisili, @ousamabenyounes (7 PRs), @petarvucetin, @rpickmans, @s010mn, @Scotchy49, @sebastianbreguel (2 PRs), @simtel12, @tdietert, @tomerikjansen-crypto, @ToniBig, @TyceHerrman (2 PRs), @udisun, @vipinks, @voidborne-d

Special note: outsized contribution this cycle from @ousamabenyounes (7 PRs across Pi, security, and CI), @mikij (5 PRs across OpenCode, Kilo, and docs), and @maxwell-orange (4 PRs hardening Windows + Cursor packaging).

Upgrade

ctx-upgrade                # plugin
npm install -g context-mode  # standalone