Context Mode
Operate Context Mode safely: execution privileges, stored evidence and purge scope
Distinguish child-process controls from OS isolation, inspect environment inheritance, and plan explicit session or project retention without accidental deletion.
What you will learn
- Child processes inherit meaningful host privileges and environment.
- A deny-only helper is not equivalent to interactive confirmation.
- Choose session or project retention explicitly before deletion.
Before you start
- Basic JSON and MCP concepts
- An isolated test client and invented data
Explain the chapter’s actual implementation boundary and verify it with an explicit evidence fixture.
Key takeaways
- Child processes inherit meaningful host privileges and environment.
- A deny-only helper is not equivalent to interactive confirmation.
- Choose session or project retention explicitly before deletion.
A temporary script directory is not an OS boundary
PolyglotExecutor writes a script in a temporary directory and launches a language runtime as a child process. In the reviewed execute path, ordinary language processes use the project directory as their working directory unless an override is supplied. Those implementation details do not establish a container, virtual machine or independently enforced network boundary. Evaluate the actual host account and surrounding sandbox controls.
The environment builder removes a set of runtime-injection variables, but passes through other defined environment values and preserves a real home path. This is not an allowlist that strips every credential. Do not run untrusted snippets in an account containing production secrets merely because a tool description uses the word sandbox. Use an isolated account or separately enforced sandbox and verify filesystem and network restrictions.
Policies and retrieval filters have narrower meanings
security.ts contains both an interactive-style permission evaluator and evaluateCommandDenyOnly. The latter returns allow when no deny pattern matches because that server-side helper cannot display an ask prompt. This observation does not describe every call site’s full authorization flow, but it demonstrates why a host confirmation policy cannot be assumed to transfer unchanged into a standalone MCP execution path.
Indexed passages, session events and auto-memory can contain sensitive material. Project-scoped ContentStore filtering deliberately preserves legacy unattributed chunks, as the architecture chapter explains. Treat source labels and retrieval filters as query controls, not complete confidentiality guarantees. A two-project fixture with a unique harmless marker is a better isolation check than observing that an ordinary search happened to show only expected results.
Purge requires an explicit scope and a recovery decision
The inspected ctx_purge interface requires confirmation and distinguishes one session from the whole project. Session-scoped removal preserves sibling sessions and shared project files, whereas project-scoped removal covers a much broader set of artifacts. The backward-compatible bare confirmation maps to a project wipe with a warning. Never use that ambiguous short form in a runbook or an exploratory test.
Prepare an inventory of data paths and retention requirements before any deletion. If a backup is appropriate, protect it under the same sensitive-data policy; a backup can also defeat the intended retention deadline. This article deliberately supplies a review record rather than an executable purge command. No user data, configuration, sessions or indexed content was deleted during this editorial review.
Implementation steps
- 1
Map the host account, environment and actual isolation controls.
- 2
Test harmless cross-project markers and denied operations in a disposable setup.
- 3
Inventory stored artifacts and backup retention.
- 4
Obtain an explicit scoped deletion decision before invoking purge.
Copy-ready example
{"operation":"retention review only","scope":"undecided","sessionId":null,"dataPathsReviewed":false,"backupRetentionReviewed":false,"deletionApproved":false}Frequently asked questions
Does sandboxed execution mean no access to my secrets?
Not by itself. The reviewed child-process implementation is not proof of OS isolation, and its environment denylist does not remove every credential.
Is deleting one session the same as clearing all project data?
No. The inspected purge implementation intentionally gives those scopes different effects; use an explicit scope and review the artifact inventory.
Sources
- README.mdSource checked 2026-09-07
- package.jsonSource checked 2026-09-07
- LICENSESource checked 2026-09-07
- src/store.tsSource checked 2026-09-07
- src/search/unified.tsSource checked 2026-09-07
- src/server.tsSource checked 2026-09-07
- src/executor.tsSource checked 2026-09-07
- src/security.tsSource checked 2026-09-07
- src/session/purge.tsSource checked 2026-09-07
- tests/store-bytecap.test.tsSource checked 2026-09-07