v3.11.0

Highlights

• (Preview) Context Gateway admission screens supported reads, derived stores, and supported proxy requests by default, and reports when content was not fully inspected.
• Semantic code views use language-server evidence when available, label uncertain relationships, and avoid linking same-named symbols across language families.
• The optional Claude Code mod shapes large native Bash output, wakes a turn when a watched background job finishes, and restores lean-ctx session context after compaction.
• CLI reads use the same path boundary as MCP reads, command help is side-effect free, and multi-word shell allowlist entries are scoped to their subcommand.
• Anonymous telemetry v2 reports bounded usage aggregates without prompts, source text, paths, commands, or tool arguments, with explicit opt-outs.
• Windows indexing accepts legacy UTF-16 and Windows-1252 text, and Windows CUDA embeddings report missing CUDA 12/cuDNN 9 libraries by name.
• (Preview) The Context Store links one task's plan, delivery and outcome, measures read strategies per workload, and records a learned read policy in shadow unless you opt in.
• lean-ctx pack --limit produces a bounded context bundle, and lean-ctx index why explains why a file is or is not indexed.

Upgrade notes

• Context Gateway (Preview): admission is on by default. Set LEAN_CTX_CONTEXT_GATEWAY=off for one run, or set context_gateway.enabled = false in the global config to disable it persistently. The CLI lean-ctx read path used by shell hooks is outside gateway admission unless a policy pack is active; output redaction still applies.
• Telemetry: v2 is on by default. Setup now asks "Keep anonymous telemetry on? [Y/n]" and lists what is sent; answering n stores an explicit opt-out that every later upgrade keeps. Earlier versions did not store a declined prompt, so an installation that declined before 3.11.0 is on after the upgrade: the first interactive command shows a one-time notice with the full list, and lean-ctx telemetry off turns it off. Disable it any time with DO_NOT_TRACK=1, LEAN_CTX_TELEMETRY=off, or lean-ctx telemetry off; an earlier explicit opt-out remains in effect. CI jobs (CI, GITHUB_ACTIONS, GITLAB_CI, and other common CI markers) never collect or send telemetry; LEAN_CTX_TELEMETRY_IN_CI=1 opts a non-CI machine with such a marker back in. Use lean-ctx telemetry status|show|history|purge-local|delete-remote|reset-id to inspect or manage its payload and ledger.
• Indexes: GRAPH_ENGINE_VERSION and graph INDEX_VERSION are now 7. Existing graph indexes rebuild before use; do not reuse a version 6 graph.
• Semantic mode: semantic_mode = "auto" is the default. It uses running language servers or a live IDE; it does not start servers unless semantic_mode = "eager" is selected in a trusted workspace. Use semantic_mode = "off" to disable semantic enrichment.
• Shell allowlist: multi-word entries now match the exact command unless they end in *. For example, use "git status *" for prefix matching. Set shell_allowlist_subcommand_scoping = false to restore the former base-binary matching.
• Other new defaults: intelligence_runtime.context_policy_apply = false. Each stdio MCP server targets mcp_max_rss_mb = 512 (raise it, or set LEAN_CTX_MCP_MAX_RSS_MB, for very large indexes); mcp_idle_exit_minutes = 0 keeps idle servers running. The engine-context-store-v1 contract and context-gateway-v1 vocabulary are experimental, not stable compatibility promises.
• Claude Code mod: the mod is installed explicitly. When active, set its keep_hook_context option to retain lean-ctx hook context, or shape_native_output to disable native Bash shaping.
• Removed runtime paths: automatic model routing is gone; a leftover proxy.routing.tiers table is ignored and reported by lean-ctx doctor. Rust embedders importing removed internal modules must move to ContextEngine or lean-ctx-sdk.
• Removed shell cache: the opt-in shell output cache was removed; legacy config files still load, but shell_cache_enabled no longer enables cached results.

Security

• lean-ctx -c and -t enforce the shell allowlist under pass-through (#2004). An agent process can inherit LEAN_CTX_WRAPPED from a wrapped parent; lean-ctx -c then passed the command through raw and skipped the allowlist, so a command ctx_shell blocks ran through the Bash-hook rewrite. Pass-through now skips only compression; the allowlist applies on every route, with the same warn-only rule for an interactive terminal.
• Graph summaries are admitted before indexing. The graph index no longer stores each file's first source line verbatim; summaries pass admission, and files with secret-like paths receive no summary. The graph index version advances to 7.
• Context Gateway admission (Preview). Reads through ctx_read in every mode, plus its shared readers, pass built-in secret, checksum-validated PII, prompt-injection, and classification checks before caching, compression, rendering, or indexing. Search, recovery, and provider paths use admitted content as well. Redactions and withheld reads report reason codes without exposing values; blocking evaluates the original text and withholds content if a redaction leaves a detectable value behind.
  • BM25/trigram indexes, dense snippets, caches, archives and their full-text index, tee/reference results, project knowledge, handoffs, and provider artifacts store admitted text only. Policy changes invalidate affected indexes and caches; recovery is rechecked under the current policy.
  • The local BYOK proxy applies admission to parsed content for supported Anthropic, OpenAI Chat/Responses (including WebSocket), Gemini, and Bedrock request paths, including token-count probes. Provider-sealed fields are not rewritten. Media, malformed bodies, partial scans under max_inspected_bytes, detector timeouts, and invalid custom patterns are reported as not fully inspected; governed/sovereign modes withhold those cases. Restricted content is not sent to a remote model.
  • lean-ctx inspect reports receipt-backed sources, detector coverage, and delivered/withheld outcomes. Receipts include the policy digest and returned-byte digest; tampered receipts are not displayed. context_gateway.hud = auto keeps pure-redaction counts out of the installed Claude Code status line.
• Secret redaction covers more forms. Detection now includes AWS session keys, fine-grained GitHub and GitLab tokens, Anthropic/OpenAI keys, JWTs, Slack/Stripe/npm tokens, private-key blocks, URL-encoded and JSON-escaped values, and secrets split by zero-width or full-width characters. UUIDs and already-masked values are left intact. MCP resources, prompts, lean-ctx call, the agent-tools CLI, and the embed crate use the same output-redaction path.
• Recovery handles are verified before use. Tee, archive, reference-store, and context-ledger handles are checked for resolution, expiry, digest match, and path escape without exposing content; policy refusals are reported as unavailable to the model rather than as broken handles.
• CLI reads and shell allowlists enforce their stated boundaries (#1901, #1903, #1906, #1419, #1930).
  • lean-ctx read uses the MCP ctx_read PathJail and secret-path rules. Broad roots are refused unless path_jail = false; relative paths resolve from the current directory. Shell rewrites leave refused reads on the native command, and worktrees under .claude/worktrees are treated as projects.
  • lean-ctx COMMAND --help prints help without running the command; only handlers with verified side-effect-free help receive the flag. upgrade --check only checks.
  • Multi-word allowlist entries such as "git status" match that command only; add a trailing * for a prefix. Binary-specific entries take precedence over project-root auto-allow. lean-ctx doctor reports entries whose meaning changed or is shadowed; the compatibility switch is trust-gated.
  • PowerShell statements are split and checked at their executable commands, including conditions, expressions, and script-block bodies. Only read-only .NET members count as inert; file writers, process starters, and compilers remain blocked. Under bash or zsh, operators and script blocks keep their native meaning; only single inert operands are treated as inert PowerShell.

Added

• mcp_idle_exit_minutes (LEAN_CTX_MCP_IDLE_EXIT_MINUTES, default 0 =
  off) ends a stdio MCP server after that many idle minutes. It is opt-in
  because Codex does not restart exited MCP servers. stdin EOF and a dead
  parent already end the server.
• Gateway proof registry and source planning. A proof registry maps admission cases and bypass checks to their tests, and the release gate can refuse while a proof entry is open. engine context-plan-sources omits caller-supplied sources unrelated to the task even when budget remains; it drops stop words, splits identifiers, and keeps sources related by task terms. lean-ctx inspect shows receipt-derived redaction, withholding, and source-use facts. A local claims catalog records what the release can say and what it does not claim.
• Per-host gateway coverage. lean-ctx doctor reports whether each configured host is enforced, partial, MCP-only/not observable, or unsupported; partial means lean-ctx tools and rewritten shell commands are covered while host-native file tools can bypass admission, and not_observable means MCP-only. lean-ctx inspect shows the same coverage. The generated matrix does not claim observation without an integration that provides it. Claude Code traffic is enforced only with an Anthropic API key; Pro/Max sign-in cannot be proxied. Credential-forwarding journeys for Claude Code /v1/messages and Codex subscription /backend-api/codex/responses show a tool-result credential withheld while the rest of the turn proceeds.
• Claude Code mod (#1981, #1986, #1989, #1991, #1997, #1998). lean-ctx claude-mod install|status|uninstall manages an embedded local plugin for Claude Code 2.1.287 or later; interactive setup offers installation, while non-interactive setup and update only refresh an existing install. MCP is marked always-load, and the mod shapes native Bash output of at least 2,000 characters with fail-open behavior. The shell deny lets Bash(run_in_background) through only when the exact command passes the enforced allowlist; ctx_shape remains an internal hook rather than a listed tool.
  • A configurable set of tool descriptions is front-loaded while the rest is deferred. A watched ctx_shell background job wakes the model once instead of requiring status polling; the mod also answers a bare sleep N while a job is watched.
  • SessionStart/UserPromptSubmit attachments authored by lean-ctx are removed to avoid repeating the same guidance; other hooks and non-lean-ctx text pass through. Use keep_hook_context to opt out. /leanctx shows session-only request, token, ToolSearch, wake, and dropped-context counts; it does not persist them or send telemetry.
  • Before main-conversation compaction, the mod saves session state and asks the summarizer to keep recovery handles and still-reporting job IDs. The first following prompt carries that state once; user compaction instructions and subagent compactions are preserved. Plugin versions include a content hash, and doctor recognizes Claude Code's normalized cache directory name.
• Semantic code intelligence (#1976, #1979, #1983, #1990, #1996). Tree-sitter remains the baseline; semantic_mode = auto uses an already-running language server or live IDE to verify uncertain structure, with bounded background refreshes that do not interrupt a backend call. Call edges carry evidence and are shown as verified, resolved, or heuristic; ambiguous callees do not bind to the alphabetically first match. Per-language capability status appears in ctx_graph status and lean-ctx doctor.
  • ctx_impact propagates exact and weaker name-match paths separately. ctx_repomap uses verified graph call edges or caller-scope resolution, and an ambiguous name or vetoed guess does not become a link. Calls are bound within the caller's language family.
  • implements and extends relations are collected where a backend offers them; references are checked on demand by ctx_impact rather than stored as graph edges. TypeScript 7 projects use tsc --lsp --stdio; older projects use typescript-language-server.
  • A VS Code/Cursor/Windsurf extension bridges the editor's existing language features through a per-workspace, token-protected, read-only local navigation endpoint. It does not edit files, start servers, or displace a live server or IDE.
• Context Store (Preview; experimental contract engine-context-store-v1). One task's plan → delivery → outcome lineage, joined from the execution ledger and Decision Receipts and scoped per tenant/project, is shown by lean-ctx inspect --task and lean-ctx engine context-lineage; missing links are listed as gaps rather than filled in.
  • Read-strategy evidence per workload: quality, security (deliveries without full inspection) and runtime friction (re-reads, expansions, failed edits after a compressed read) are measured per task, and anything unmeasured is reported as unmeasured. Available through lean-ctx autopilot evidence, lean-ctx engine context-policy-evidence and lean-ctx eval frontier --save-evidence.
  • lean-ctx autopilot policy status|promote|monitor|rollback keeps a promoted read-strategy policy (active plus last stable) supplied by the optional licensed runtime. Planning records it in shadow only; intelligence_runtime.context_policy_apply = true applies it, and security rules and explicit user choices still take precedence.
  • The context kernel also draws on the BM25 search index and the code graph; it never builds or refreshes an index while planning. Surprise, graph proximity and redundancy are measured from the candidate set.
• lean-ctx pack --limit (#1885). Writes a deterministic, self-contained XML bundle under a hard character or token cap, ranking files by the task and import graph. It can include current curated knowledge, with that material counted inside the cap; secret-bearing files and secret-like paths are withheld. Emit modes, output files, clipboard, stats, include/ignore globs, and ctx_pack action=bundle are supported. Exit 1 means even the frame could not fit; exit 2 means invalid flags.
• Browser OAuth for HTTP MCP servers (#1391). lean-ctx addon auth NAME supports OAuth 2.1 discovery, registration, PKCE, loopback redirect, token attachment, and refresh; --status, --logout, and --no-browser are available. Credentials are encrypted per server using the macOS Keychain, Windows Credential Manager, or a Linux 0600 key file. OAuth declarations on stdio servers or alongside an Authorization header are refused.
• lean-ctx index why FILE. Explains which indexing rule included or excluded a file, reports encoding and BM25 chunk/freshness information for eligible files, supports --json, and exits 1 for an excluded file. MCP: ctx_index action=why path=FILE.
• Windows CUDA embeddings. The x86_64 Windows CUDA build is installed and retained by enable-gpu and update. CUDA 12/cuDNN 9 libraries can be loaded from installed pip wheels, the CUDA Toolkit, or the cuDNN installer without changing PATH; CPU-fallback diagnostics name missing DLLs and explain that CUDA 13 alone does not provide CUDA 12 DLLs.
• Clearer ONNX Runtime setup diagnostics. ORT_DYLIB_PATH errors identify whether the variable is absent or malformed and explain process versus MCP configuration scope. Hints identify JSON control characters, quotes, and unexpanded %VAR%, $VAR, or ~ values. lean-ctx embeddings status reports the selected runtime, version check, and execution-provider policy, with platform-specific setup guidance.

Changed

• Bounded memory for long-lived MCP servers. Each stdio MCP server now
  has a per-process RSS target, mcp_max_rss_mb (default 512 MB,
  LEAN_CTX_MCP_MAX_RSS_MB). The guardian uses the lower of it and
  max_ram_percent, which on large machines was several GB per process. A
  Codex app-server that keeps one server per loaded thread therefore no longer
  accumulates ~1 GB instances.
• Idle MCP servers release their caches. After the memory_cleanup TTL
  without a tool call, a server drops its read cache and resident indexes
  without waiting for the next call. A running call or background job keeps
  it busy. The release logs process memory and live heap before and after.
• macOS: the memory guard measures physical footprint. It now uses the
  figure Activity Monitor shows instead of resident size, which leaves out
  pages the memory compressor has taken. An idle server measured 40 MB
  resident while still holding a ~180 MB heap. Footprint is read through
  proc_pid_rusage, which also replaces a ps spawn per sample.
• Quieter, cheaper guardian. Eviction rounds that reclaim nothing back off
  (1 s → 60 s, then a five-minute pause) at every pressure level, not only
  Critical. Sampling stays at one second, so a rise to a higher level still
  evicts at once. Pressure lines log on a level change and at most once a
  minute after that; a baseline above a small cap used to log every second.
• Bundled MCP SDK 1.32.1 in the pi extension (#2017). @modelcontextprotocol/sdk 1.30.0 → 1.32.1, proxy-addr 2.0.8 and source-map-js 1.2.2; THIRD_PARTY_NOTICES and the asset manifest record the new versions and digests.
• One capability registry. Capability IDs remain stable lookup names, while one registry determines which capabilities are backed by the local source tree and how their availability is described.
• Local use remains accountless. Signing in alone no longer enables shared agent-presence or lease paths; a single developer's local Runtime remains available without an account.
• Quality evidence reports its limits (#1905). Eval/A-B/footprint/frontier reports label runs with fewer than 30 paired tasks or without bootstrap as underpowered; --gate fails those runs. --mechanism is for small wiring fixtures, fails only on regression, and cannot support a quality claim. Non-regression is reported as NON-INFERIOR, and schema v2 reports evidence tiers from mechanism through production; fixture recordings are mechanism evidence only. Shadow reports identify their baseline as simulated and describe outcome acceptance relative to that baseline.
  • Footprint pruning requires powered real-model evidence. --export and --compare evaluate the same tasks against a baseline. eval frontier compares strategies against one baseline and guards against leaking gold answers into task metadata.
  • quality-lab uses representation_grade, which describes representation fidelity rather than task quality. Its receipt reports retention, recovery, security, and task-quality dimensions, with unmeasured dimensions shown as UNMEASURED; --gate also fails when a critical fact is lost. quality_floor and max_context_tokens remain offline-only; other profile constraint fields are not read.
• Prompt-cache requests stay stable (#1912). Complexity-driven thinking blocks stay consistent across turns, are capped at half of max_tokens, and respect the client's OpenAI reasoning_effort; requests with max_tokens below 2048 do not receive an injected block. Unchanged or reverted proxy requests forward the client's original bytes, and rewritten gzip/zstd bodies are re-encoded. A warm conversation does not alternate between compressed and uncompressed system prompts.
• Anonymous telemetry v2 is on by default. The former opt-in heartbeat is replaced by a typed batch. It sends version, platform, a random installation ID, client family, integration/embedding state, bounded daily built-in-tool call/failure counts, and coarse session/sync/error aggregates; tool calls are now counted in production. It never sends prompts, code, file contents, paths, commands, tool arguments, or foreign MCP tool names. Counters are per UTC day; resends replace daily totals. An unreadable config fails closed and prior opt-outs remain effective. Setup, telemetry on and a one-time notice on the first interactive command show the same list of what is sent; a declined setup prompt is stored as an explicit opt-out; CI jobs never collect or send.
• Agent registration records presence without a session cap (#1765). New sessions keep their explicit role and available tools regardless of how many other sessions are present. Build and test commands remain serialized where they run; cargo_build_jobs and shared_cargo_target still apply. agents.max_concurrent_mutating_workers remains readable for compatibility but is no longer used.
• Public copy is consistent across shipped surfaces (#1987). README, current documentation, package descriptions, help, and skill templates now use one product category and state implementation and evidence boundaries consistently. Measurement documentation distinguishes local hash-chain integrity from an explicitly signed batch export and describes what each comparison measures.
• Compression holdout is available as an opt-in measurement (#1977). proxy.compression_holdout / LEAN_CTX_PROXY_COMPRESSION_HOLDOUT defaults to 0; a deterministic conversation cohort forwards the control arm without input compression and records token counts for both arms. The report is pending until each arm has 30 turns, then reports a reduction with a Welch 95% interval. Quality remains unknown in every state, and the holdout does not change thresholds or policy.

Removed

• Automatic model routing. Intent-tier selection, routing-quality fallback, Thompson-sampling feedback, the OCLA ModelRouter, built-in router registry/API/health entries, routing evals, experiment arms, and routing savings are removed. A released runtime package can still be recognized, but its model-ranking capability is not invoked. Existing routing ledger events and previously recorded history remain readable/exportable; operator-written aliases, outbound allow/deny policy, model ceilings, budgets, rate limits, and reasoning budgets remain. A stale proxy.routing.tiers table is ignored and reported by lean-ctx doctor.
• Unused modules and unsupported proof claims (#1914, #1915, #1923). Uncalled internals were removed, including core::solution_rules, predictive_prefetch, multiscale_index, context_column, adaptive_chunking, cognitive_load, graph_features, progressive_compression, structural_diff, structural_tokenizer, adaptive_compression, agent_attribution, cache_diagnostics, chain_compression, content_handle, cross_customer_learning, delta_response, evidence_classification, evidence_flow, fleet_analytics, json_sample, negative_knowledge, query_aware, rule_scorer, session_budget, token_calibration, the unused context-kernel feedback, learning and attribution modules, the marginal-information gate, attention placement, MDL selector, gamma cover, predictive-coding deltas, attention-weighted context assembly, U-curve attention model, semantic chunk reorder, and io_boundary::read_file_scanned.
  • The execution ledger and work graph are kept: they back the Context Store lineage and Decision Receipts.
  • No CLI command, MCP tool, configuration key, or contract was removed by these module deletions. Rust embedders that imported the internal paths must drop those imports; core::solution_types and the OCP export adapter remain. The supported embedding surfaces are ContextEngine and lean-ctx-sdk.
  • ctx_verify action=proof no longer reports Lean4 or FormallyVerified; its highest level is PolicyChecked. Empty BM25 indexes report empty, and graph metadata-file size is no longer presented as graph-index size. review no longer sets the no-op layout.enabled; no layout driver or regulated role is available, and regulated redaction belongs to policy-pack filters. Documentation and source comments no longer claim cognitive-mode savings or Jira access without evidence.
• Opt-in shell result cache (#1982). Cached shell results are removed because command output depends on workspace state outside the old cache key; old config files still load.

Fixed

• Parallel reads no longer time out on file locks (#2016). Every completed ctx_read persists its ledger entry before it is acknowledged; 16 parallel reads on Windows queued past the 750 ms lock wait and failed with a misleading "agent registry lock" error. Ledger persistence now waits up to 10 s, lock errors name the lock file, and concurrent first tool calls register the session's bus presence once instead of racing.
• Runtime install no longer reports Busy for a lock it just released (#2019). A child process forked by another thread briefly shares the install and configuration locks; install now retries for up to 2 s before reporting Busy.
• ctx_read honours the documented bare multi-select (#2000). mode="3,7-9" selects those lines like lines:3,7-9 instead of falling through to a full read; malformed comma payloads still reach the unknown-mode path.
• Control flow inside a shell function body passes the allowlist (#2002). A function body is expanded like a top-level line, so for, if, while and case are control flow and only the commands inside them are checked; the block message no longer contains a stray run of spaces.
• A heredoc after a multi-line quoted string is recognised (#2003). The heredoc scanner keeps the quote state across lines, so echo "a⏎b"; cat <<'EOF' no longer gates the heredoc body as commands; an apostrophe in a comment cannot hide a later heredoc.
• A directory override never touches the real install (#2007). With LEAN_CTX_CONFIG_DIR, LEAN_CTX_DATA_DIR, LEAN_CTX_STATE_DIR or LEAN_CTX_CACHE_DIR set, startup layout healing no longer moves the default ~/.lean-ctx or XDG config files or writes the layout pin; previously a scratch run renamed the real ~/.lean-ctx/config.toml to config.toml.superseded.
• MCP startup no longer waits on recently used files (#2006). Collecting the cache-warming history resolved every recently touched file synchronously before the server answered initialize; with the project on a network drive that took 95-150 s. It now runs on the warming thread before that thread takes the cache lock, and each session's project root is resolved once instead of once per file. Daily background housekeeping removes orphaned session save locks and prunes stores above 300 sessions by session_retention_days (at least 1 day; the newest session per project and the latest pointer are kept).
• ctx_expand(id=) works without a status poll (#2005). A finished background job is archived on expand; a running job is reported as still running and an unknown ID as nonexistent, instead of "unavailable or expired" for all three.
• gain no longer presents an estimate as a bill saving. When the provider request path is not observed, lean-ctx gain reports provider bill impact as unknown, labels gross tool-output savings as a local estimate, and leaves ROI unavailable. ctx_gain exposes the evidence type, provider-path observability, and null net bill impact when it cannot be observed.
• Other gateways keep their endpoint (#1972). Install, uninstall, cleanup, doctor, and supported host wiring treat only configured, UID-derived, or historical lean-ctx ports as lean-ctx endpoints. Other local or remote URLs are preserved unless --force is used; Codex no longer receives a duplicate base URL.
• lean-ctx-status reflects OFF (#1971). Bash, zsh, and fish read the value of LEAN_CTX_ENABLED; the command exits 0 for ON and 1 for OFF/DISABLED.
• Raw tail windows stay bounded (#1965). mode=-N, raw=true returns the requested final lines verbatim, like lines:-N, rather than the whole file.
• Package upgrades refresh stale shell hooks (#1959). On MCP server start, existing stale hook files are refreshed without rewriting shell rc files; disabled hooks are skipped, and present env.sh and _lc PATH shims are refreshed with bash/zsh hooks.
• Background maintenance preserves config edits (#1934). It writes only timestamps it changed and writes nothing when none changed, so concurrent config set or editor changes are not overwritten. Test configuration is passed directly instead of leaking through process-wide state.
• Read stubs are only reused by the caller that received them (#1904, #1909). Delivery IDs are per process rather than shared across Claude Code processes. A content-free “already in your context” stub is returned only when delivery to that conversation is known; Claude Code subagent re-reads return compressed content. Relayed content must match the requested view. LEAN_CTX_SCOPE opts back in for integrations that run one agent per process.
• Compressed reads do not expand output or silently lose facts (#1910, #1911). Auto mode falls back to bare file content when a mode cannot shrink it; explicit modes keep their notice. Over-budget reads name the truncation and raw=true. Cache entries distinguish auto from explicit modes. Entropy filtering is deterministic and uses file-relative thresholds; higher aggressiveness drops more. Terse shell/tool output falls back when compression would lose critical status, error, count, or location facts. Proxy CCR handles resolve in ctx_expand, map exports preserve nested Rust generics, and repeated edit failures escalate to full mode.
• The agent surface reports callable operations (#1913). Agent cards list tools that are available through the public tool endpoints, authentication descriptions match enforced /a2a checks, and task cancellation is limited to the caller's own task. Agent action schemas follow the dispatcher's actions; the inactive OclaBus no-op was removed.
• Windows timeouts stop child processes (#1920). ctx_shell, ctx_execute, and sandbox commands run in a private job object, so timeout, cancellation, or an unexpected lean-ctx exit ends the process tree. Deliberately started background processes still survive a normally completed command, as on Unix.
• Integration tests use an isolated data directory. The cargo test --test main binary uses a per-process temporary data directory unless LEAN_CTX_DATA_DIR is set, and clears ambient agent-scope variables.
• Hook rewrites preserve visible content (#1916, #1917, #1918). Read dedup is per agent; a named file can be searched up to 64 MB, skipped files and timeouts are reported, and lean-ctx grep exits 2 when the search was incomplete or errored. Unquoted shell globs are expanded by the shell before a whole-command rewrite; quoted patterns keep the direct rewrite.
• Parallel first reads no longer fail on cache contention. Tokenizer and path-protection config load before the cache lock; if a read cannot obtain the lock in time, its content is returned without caching.
• Legacy Windows text encodings are indexed. UTF-16 LE/BE, UTF-8 with or without a BOM, lossy UTF-8, and Windows-1252 are decoded with line numbers preserved. NUL-byte binary detection no longer rejects UTF-16 text; run lean-ctx index build once to add affected files.
• Pip ONNX Runtime libraries are found. lean-ctx locates onnxruntime and onnxruntime-gpu libraries in active environments, PYTHONPATH, user sites, and system sites without running an interpreter. ORT_DYLIB_PATH accepts a containing directory, and versioned library names are recognized.
• Write refusals, batch reads, and zero-hit search are precise (#1995; fixes #1992, #1993, #1994). Redirect/tee/heredoc/download refusals explain the read-before-write path and are unchanged by smaller commands or raw=true. Batch ctx_read appends kernel enrichment once after the summary and never in raw mode; supplements stop on line boundaries, and out-of-project episodes are not offered. ctx_search zero-hit output reports its scanned scope, index-pruned files count as covered, empty scopes explain why, and comma-separated include values are glob lists.
• Wide project source directories are valid scan roots (#1985; tracked in #1984). A broad directory inside a marked project can be searched using its ancestor project marker; directories without a marker in their ancestry remain protected.
• Shell and proxy outputs are not replayed from stale state (#1982). Shell commands run again against current workspace state. Proxy dedup is stateless across requests and replaces output only with a same-request reference or reconstructable line delta; the newest two outputs remain verbatim, outputs without a tool-call ID are not referenced, and dedup runs after compression.

Upgrade

lean-ctx update                 # recommended (auto-downloads + refreshes shell hooks)
cargo install lean-ctx          # or
npm update -g lean-ctx-bin      # or
brew upgrade lean-ctx

Note: After upgrading via cargo/npm/brew, run lean-ctx setup to refresh shell aliases. lean-ctx update does this automatically.

Full Changelog: v3.10.5...v3.11.0