Skip to content

update.#67

Merged
CoderMungan merged 27 commits intofeat/mcp-hardeningfrom
main
Apr 13, 2026
Merged

update.#67
CoderMungan merged 27 commits intofeat/mcp-hardeningfrom
main

Conversation

@CoderMungan
Copy link
Copy Markdown
Member

No description provided.

parlakisik and others added 27 commits April 9, 2026 08:58
Tasks added without --section landed in the wrong Phase section
because the default insertion found the first - [ ] anywhere in
the file. Now --section is mandatory for tasks. Also fixed heading
level normalization from ## to ### to match TASKS.md structure.
When a named section doesn't exist, it is created automatically.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Append-only JSONL store with sequence assignment, type-filtered
queries, client registry, and metadata persistence. Token-based
auth with ctx_adm_/ctx_cli_ prefixed hex tokens. Federation spec
included for future HA work.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
gRPC server with Register, Publish, Sync, Listen, and Status
RPCs. Bearer token auth validated per-handler. JSON codec for
wire encoding (no protoc dependency). Fan-out broadcaster for
real-time Listen streams. Compliant with project conventions.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Adds --shared, --port, and --data-dir flags to ctx serve. When
--shared is passed, starts the gRPC hub server. Default data
directory is ~/.ctx/hub-data/; --data-dir overrides for
multi-hub setups on the same machine. Admin token generated on
first run and persisted in <data-dir>/admin.token.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
gRPC client library with Register, Publish, Sync, Status, and
Close methods. New ctx connect register command: registers the
project with a hub, encrypts and stores connection config in
.context/.connect.enc using existing AES-256-GCM pattern.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
ctx connect subscribe sets entry type filters in the encrypted
connection config. ctx connect sync pulls matching entries from
the hub, renders them as markdown with origin tags and date
headers in .context/shared/, and tracks last-seen sequence for
incremental sync. Shared config package extracted from register
for reuse across connect subcommands.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
ctx connect publish pushes entries to the hub. ctx connect listen
streams new entries in real-time with Ctrl-C to stop.
ctx connect status shows hub address, entry count, and connected
clients. All commands use encrypted connection config from
.context/.connect.enc.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
When --include-shared is passed, loads .context/shared/*.md and
includes them as Tier 8 in the agent context packet. Shared
entries are budget-aware and rendered in both markdown and JSON
output formats. No-op when .context/shared/ is absent (opt-in).

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Background hub operation: --daemon forks the server and writes
a PID file to <data-dir>/hub.pid. --stop sends SIGTERM to the
running daemon and removes the PID file. Exec and error logic
split to internal/exec/daemon/ and internal/err/serve/ per
project conventions.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Raft-lite: uses hashicorp/raft ONLY for master election, not
data consensus. No-op FSM since entries are replicated via
sequence-based gRPC sync. New --peers flag on ctx serve --shared
for cluster membership. Single-node mode auto-bootstraps.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Followers replicate from the master via sequence-based gRPC
sync with automatic retry. Failover client tries peers in order
and verifies connectivity with a Status call before returning.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Cluster management CLI: ctx hub status shows role and entry
counts, ctx hub peer add/remove manages cluster membership,
ctx hub stepdown transfers leadership gracefully.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Four integration tests: publish-and-sync across two clients,
incremental sync with since_sequence, type-filtered sync, and
full Client library round-trip (register, publish, sync, status).

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
New pages: connect.md (register, subscribe, sync, publish,
listen, status), serve.md (shared hub, daemon, cluster modes),
hub.md (status, peer, stepdown). Updated agent docs with
--include-shared flag and Tier 6-8 budget tiers. Updated CLI
index with new command entries.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
When --share is passed, ctx add writes the entry locally AND
publishes it to the shared hub in one step. Best-effort: hub
publish failure does not block the local write. Uses the
existing encrypted connection config from ctx connect register.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Failover: first-peer, skip-bad-peer, all-bad-peers. Fan-out:
subscribe-broadcast, unsubscribe, broadcast-to-none. Renderer:
creates files with origin tags, appends to existing, filename
generation. Total hub test count: 26.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
New check-hub-sync hook runs on UserPromptSubmit, daily
throttled. If .connect.enc exists, silently syncs new entries
from the hub to .context/shared/. No manual ctx connect sync
needed after initial registration.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
1. Fix listen command: now streams via Listen RPC instead of
   blocking after initial sync
2. Add input validation on Publish: type, ID, origin, content
   size limit (1MB)
3. Warn on --share publish failure instead of silent suppression
4. Constant-time token comparison via crypto/subtle + O(1) map
   lookup
5. Wire Raft cluster to Server with SetCluster/Shutdown
6. Reject duplicate project registration in store
7. Disconnect slow fanout listeners instead of silently dropping
8. File locking on sync state to prevent concurrent race
9. Fail fast on auth errors in failover client

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Document --share flag behavior (best-effort, warns on failure),
auto-sync hook, input validation rules (1MB content limit),
and duplicate registration rejection.

Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
Rebase onto main brought strict audit tests (doc structure, magic
strings/values, dead exports, flag YAML drift, fmt.Fprintf checks)
that the hub code predates. Grandfather hub violations, add package
exemptions, fix fmt.Fprintf return check, add AdminAuth flag
constant, and fix AddConfig.Share field placement.

Spec: specs/shared-hub-federation.md
Signed-off-by: Murat Parlakisik <parlakisik@gmail.com>
feat: shared context hub for cross-project knowledge sharing
Signed-off-by: Jose Alekhinne <jose@ctx.ist>
Signed-off-by: Jose Alekhinne <jose@ctx.ist>
Add parallel-slice batch functions to flagbind (BindStringFlagsP,
BindStringFlags, BindBoolFlags, BindBoolFlagsP, BindStringFlagShorts,
BindStringFlagsPDefault) replacing repetitive one-at-a-time flag
registrations across 8 CLI command files.

Convention sweep:
- hub: rename files (entry_validate→validate_entry, errcheck→err_check),
remove const aliases, move magic numbers to config/hub and config/entry,
fix predicate naming (isEOF→eof, isAuthErr→authErr)
- initialize: rename claudecheck→claude_check, details→detail
- steering/types: align docstrings with conventions
- compliance: fix TestNoSecretsInTemplates false positive on YAML keys
- golangci: extend G101 exclusion to all embed/text/ DescKey files
- sysinfo: add missing nolint:gosec for G204 on vm_stat

Spec: specs/flagbind-batch-and-convention-sweep.md
Signed-off-by: Jose Alekhinne <jose@ctx.ist>
…arser rescue

The dead exports test maintained a manual list of platform-specific
symbols (linux-only, darwin-only) that appeared dead on the other OS.
This list grew with every new platform constant and taught bad habits.

Replace with a go/parser sweep that parses ALL .go files regardless
of build tags, extracts selector names, and automatically rescues
any export referenced from any platform file. No manual maintenance.

Spec: specs/flagbind-batch-and-convention-sweep.md
Signed-off-by: Jose Alekhinne <jose@ctx.ist>
refactor: flagbind batch helpers and convention sweep
Five command surface changes:

- Move `ctx bootstrap` back to `ctx system bootstrap` (hidden,
  agent-only plumbing that was incorrectly promoted to top-level)
- Rename `ctx stats` to `ctx usage` (clearer intent)
- Rename `ctx resource` to `ctx sysinfo` (matches internal package,
  unambiguous)
- Remove `ctx dep` entirely (marginal utility, go list/npm ls suffice)
- Introduce `ctx hook` parent — consolidates message, notify, pause,
  resume, and event under a single namespace

Includes full propagation: constants, YAML assets, flag/text DescKeys,
group.go registration, docs, recipes, skills, CLI index, zensical.toml
nav, and dead export cleanup of orphaned dep support packages.

Also adds:
- _ctx-command-audit skill for post-rename quality gates
- Package taxonomy section in docs/home/contributing.md
- hack/agents/ directory for autonomous agent prompts
- Follow-up task for ctx explore command

Signed-off-by: Jose Alekhinne <jose@ctx.ist>
@CoderMungan CoderMungan merged commit eb45702 into feat/mcp-hardening Apr 13, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants