DEV-5902: Harden ctx for untrusted transcript analysis

.claude-plugin/marketplace.json

@@ -1,7 +1,7 @@
 {
   "name": "ctx",
   "owner": {
-    "name": "ctxrs"
+    "name": "Enrich Layer"
   },
   "plugins": [
     {
@@ -11,10 +11,10 @@
       "description": "Use ctx to search local coding-agent history and retrieve cited session context before working.",
       "version": "0.1.0",
       "author": {
-        "name": "ctxrs"
+        "name": "Enrich Layer"
       },
-      "homepage": "https://github.com/ctxrs/ctx",
-      "repository": "https://github.com/ctxrs/ctx",
+      "homepage": "https://github.com/enrichlayer/ctx",
+      "repository": "https://github.com/enrichlayer/ctx",
       "license": "Apache-2.0",
       "keywords": [
         "ctx",

.cursor-plugin/marketplace.json

@@ -1,7 +1,7 @@
 {
   "name": "ctx-plugins",
   "owner": {
-    "name": "ctxrs"
+    "name": "Enrich Layer"
   },
   "metadata": {
     "description": "ctx plugins for local agent history search."

.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    name: Rust checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install 1.88.0 --profile minimal --component clippy,rustfmt
+          rustup default 1.88.0
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run clippy
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      - name: Run tests
+        env:
+          TMPDIR: /tmp
+        run: cargo test --workspace --locked -- --test-threads=1

Cargo.toml

@@ -13,8 +13,8 @@ resolver = "2"
 [workspace.package]
 edition = "2021"
 license = "Apache-2.0"
-repository = "https://github.com/ctxrs/ctx"
-homepage = "https://github.com/ctxrs/ctx"
+repository = "https://github.com/enrichlayer/ctx"
+homepage = "https://github.com/enrichlayer/ctx"
 rust-version = "1.88"
 
 [workspace.dependencies]

README.md

@@ -11,22 +11,21 @@ Those sessions are full of useful context:
 
 ctx indexes those logs into SQLite on your machine, then gives current and future agents a CLI for finding the prior discussion, command, or failed attempt before they repeat it.
 
-## Install and set up ctx
+## Install and set up the hardened fork
+
+Build a reviewed Enrich Layer fork commit from source (Rust 1.88 or newer):
 
-macOS, Linux, and FreeBSD:
 ```bash
-curl -fsSL https://ctx.rs/install | sh
+git clone https://github.com/enrichlayer/ctx.git
+cd ctx
+git checkout <reviewed-commit-or-tag>
+cargo install --locked --path crates/ctx-cli
+ctx integrations install skills
+ctx setup
 ```
 
-Windows PowerShell:
-```powershell
-irm https://ctx.rs/install.ps1 | iex
-```
-
-or prompt your agent:
-```
-Please install and set up ctx CLI (see github.com/ctxrs/ctx)
-```
+Do not pipe a remote installer into a shell. Pin and review the commit or tag
+before building so a later upstream change cannot replace the hardened code.
 
 ## 50x more token-efficient than raw transcript search
 
@@ -72,6 +71,12 @@ Those IDs let your current agent recover as much context from previous sessions
 
 ctx does not send your prompts, transcripts, or indexed history to a cloud service, call model APIs, require API keys, or write into your source repositories.
 
+This fork is offline-safe by default: automatic network reporting, managed background upgrades,
+history-source plugin auto-refresh, daemon maintenance, and semantic search are
+disabled until explicitly enabled. Search is limited to the current canonical
+Git workspace unless an absolute Git worktree-root `--workspace` scope or
+`--all-workspaces` is supplied.
+
 The installed binary also includes local docs and man-page generation:
 
 ```bash
@@ -80,7 +85,7 @@ ctx docs show cli-reference
 ctx docs man --print ctx
 ```
 
-Official installer-managed binaries support signed self-upgrades:
+Official installer-managed binaries support explicit signed self-upgrades:
 
 ```bash
 ctx upgrade status
@@ -89,7 +94,7 @@ ctx upgrade check
 
 Source builds and package-manager installs remain unmanaged and do not self-upgrade.
 
-For the full pipeline, see [How ctx works](https://ctx.rs/concepts/how-it-works). For a quick first run, see [Quickstart](https://ctx.rs/first-search).
+For the full pipeline, see the local [product contract](docs/product-contract.md). For a quick first run, see [the first 10 minutes](docs/first-10-minutes.md).
 
 ## Supported agent histories
 
@@ -143,20 +148,20 @@ Agent memory tools usually save compact facts, summaries, vectors, or graph node
 
 Graphify-style tools answer a different question. They map the current repository: files, symbols, imports, folders, and relationships. ctx searches the prior agent sessions that explain what happened while people and agents changed that repository.
 
-ctx keeps retrieval tied to sessions and events, so another agent can inspect the source before using it. Read more about [agent memory](https://ctx.rs/comparisons/agent-memory), [Graphify-style codebase graphs](https://ctx.rs/comparisons/codebase-graphs), and [grep or log search](https://ctx.rs/comparisons/grep-log-search).
+ctx keeps retrieval tied to sessions and events, so another agent can inspect the source before using it. Read the local [product contract](docs/product-contract.md), [threat model](docs/threat-model.md), and [search behavior](docs/search.md) before using transcript-derived output in an agent workflow.
 
 ## Explore the docs
 
 | Page | What it covers |
 | --- | --- |
-| [Install](https://ctx.rs/getting-started/install) | Install ctx, initialize local storage, and index discovered local history. |
-| [Quickstart](https://ctx.rs/first-search) | Search local history, inspect an event, open the session, and use JSON output. |
-| [Install the ctx skill](https://ctx.rs/skill) | Install the agent-history search skill with the open skills installer. |
+| [Install](docs/getting-started.md) | Build the reviewed fork, initialize local storage, and index discovered local history. |
+| [Quickstart](docs/first-10-minutes.md) | Search local history, inspect an event, open the session, and use JSON output. |
+| [Install the ctx skill](docs/agent-skill-install.md) | Install the agent-history search skill from a reviewed fork revision. |
 | [Package managers and unmanaged installs](docs/unmanaged-installs.md) | Install from GitHub Releases, mise, Homebrew, or source builds. |
 | [Agent plugin installs](docs/agent-skill-install.md) | Install the ctx skill through Codex, Claude Code, Cursor, or a raw skill folder. |
 | [SDKs](docs/sdks.md) | Use ctx agent history search from TypeScript, Python, Rust, Go, JVM, Swift, or .NET code. |
 | [Custom history plugins](docs/history-source-plugins.md) | Build an advanced local adapter for agent formats ctx does not support natively. |
-| [Cursor](https://ctx.rs/agents/cursor) | Import Cursor agent transcripts and ask Cursor to cite retrieved local history before editing. |
-| [How it works](https://ctx.rs/concepts/how-it-works) | Understand discovery, import, SQLite storage, search refresh, and cited retrieval. |
-| [Supported agents](https://ctx.rs/concepts/supported-agents) | See which agent histories ctx can discover, import, and search today. |
-| [CLI reference](https://ctx.rs/reference/cli) | Review setup, status, sources, import, show, locate, search, SQL, MCP, and doctor. |
+| [Provider support](docs/provider-support.md) | See which agent histories ctx can discover, import, and search today. |
+| [How it works](docs/product-contract.md) | Understand discovery, import, SQLite storage, search refresh, and cited retrieval. |
+| [Security and privacy](docs/threat-model.md) | Review the local threat model before exposing transcripts to an agent. |
+| [CLI reference](docs/cli-reference.md) | Review setup, status, sources, import, show, locate, search, SQL, MCP, and doctor. |

crates/ctx-cli/src/commands/import.rs

@@ -55,8 +55,8 @@ use ctx_history_store::{
 
 use crate::analytics::AnalyticsProperties;
 use crate::history_source_plugins::{
-    discover_history_source_plugins, run_history_source_plugin, HistorySourcePluginRunOptions,
-    HistorySourcePluginSource,
+    discover_history_source_plugins, discover_installed_history_source_plugins,
+    run_history_source_plugin, HistorySourcePluginRunOptions, HistorySourcePluginSource,
 };
 use crate::output::print_json;
 use crate::progress::{
@@ -154,6 +154,8 @@ pub(crate) struct ImportRunOptions {
     pub(crate) print_human: bool,
     pub(crate) allow_empty_sources: bool,
     pub(crate) include_history_source_plugins: bool,
+    pub(crate) allow_automatic_plugin_execution: bool,
+    pub(crate) plugin_execution_disabled: bool,
     pub(crate) operation: &'static str,
 }
 
@@ -268,6 +270,8 @@ pub(crate) fn run_import(
     args: ImportArgs,
     data_root: PathBuf,
     analytics_properties: &mut AnalyticsProperties,
+    allow_automatic_plugin_execution: bool,
+    plugin_execution_disabled: bool,
 ) -> Result<()> {
     let json = args.json;
     let progress = args.progress;
@@ -281,6 +285,8 @@ pub(crate) fn run_import(
             print_human: !json,
             allow_empty_sources: false,
             include_history_source_plugins: true,
+            allow_automatic_plugin_execution,
+            plugin_execution_disabled,
             operation: "import",
         },
     )?;
@@ -317,6 +323,8 @@ pub(crate) fn run_import_internal(
         args,
         &data_root,
         options.include_history_source_plugins,
+        options.allow_automatic_plugin_execution,
+        options.plugin_execution_disabled,
     )?;
     if requests.is_empty() && plugin_requests.is_empty() {
         if options.allow_empty_sources {

crates/ctx-cli/src/commands/import/requests.rs

@@ -103,14 +103,28 @@ pub(crate) fn history_source_plugin_import_requests(
     args: &ImportArgs,
     data_root: &Path,
     include_plugins: bool,
+    allow_automatic_plugin_execution: bool,
+    plugin_execution_disabled: bool,
 ) -> Result<Vec<HistorySourcePluginSource>> {
     if !include_plugins {
         return Ok(Vec::new());
     }
     if !args.all && args.history_source.is_none() && args.history_source_manifest.is_empty() {
         return Ok(Vec::new());
     }
-    let sources = discover_history_source_plugins(data_root, &args.history_source_manifest)?;
+    if plugin_execution_disabled
+        && (args.history_source.is_some() || !args.history_source_manifest.is_empty())
+    {
+        return Err(anyhow!(
+            "history-source plugin execution is disabled by CTX_DISABLE_PLUGIN_EXECUTION"
+        ));
+    }
+    let sources =
+        if args.all && args.history_source.is_none() && args.history_source_manifest.is_empty() {
+            discover_installed_history_source_plugins(data_root)?
+        } else {
+            discover_history_source_plugins(data_root, &args.history_source_manifest)?
+        };
     if let Some(selector) = &args.history_source {
         let matches = sources
             .into_iter()
@@ -134,6 +148,9 @@ pub(crate) fn history_source_plugin_import_requests(
         return Ok(matches);
     }
     if args.all {
+        if plugin_execution_disabled || !allow_automatic_plugin_execution {
+            return Ok(Vec::new());
+        }
         return Ok(sources
             .into_iter()
             .filter(|source| source.enabled)