* focus Context7 documentation queries
* narrow documentation query prompt changes
* remove focused from query prompts
* use lookup wording in query prompts
* distinguish documentation lookup from task
* allow live Pi test more time
* add prompt guidance changeset
* docs(enterprise): add multi-container scaling guide
Document running On-Premise as multiple replicas with PostgreSQL + object
storage. Add the Scaling page under Deployment and cross-reference it from the
Kubernetes single-replica notes.
* docs(enterprise): migration guide for existing deployments + docker scaling pointer
- Scaling page: step-by-step migration using the built-in migrate command
(Docker one-shot and Kubernetes Job), vector sync, encryption-key reuse
- Docker page: add a Scaling pointer
* docs(enterprise): add Settings > Scaling helper screenshots
Show the migration helper (single-container) and the multi-replica confirmation
in the migration section of the Scaling guide.
* docs(enterprise): point Scaling guide at the Helm chart and turnkey compose
- Docker Compose: reference the one-command bundled stack (Postgres + MinIO + LB)
- Kubernetes: use the Helm chart (single default, scaling.enabled to scale out)
- add on-prem / S3-compatible object storage (VECTOR_STORE_ENDPOINT)
* docs(enterprise): make Scaling deployment sections self-contained
On-prem customers get the image and docs, not the source repo, so inline the
full Docker Compose stack (with nginx.conf and .env) and the scaled Kubernetes
manifests (Secret + Deployment) instead of referencing repo files. Note the Helm
chart ships with the enterprise distribution.
* docs(enterprise): pgvector default for scaling, Postgres the only dependency
Vectors go to pgvector in the same Postgres, so object storage is no longer
required. Update config, compose (pgvector image, no MinIO), k8s secret, and the
migration (copies vectors into pgvector, no bucket sync). Object storage is now
an optional escape hatch for very large indexes.
* docs(enterprise): refresh Settings > Scaling screenshot for pgvector migration command
* docs(enterprise): pgvector only, drop the object storage option from the guide
Remove the VECTOR_STORE_URI config row and the 'Vectors on object storage'
section. Multi-replica uses Postgres + pgvector with no object storage.
* docs(enterprise): detailed pgvector provisioning guide
Expand the provisioning step with per-provider instructions (RDS/Aurora, Cloud
SQL, Azure Flexible Server, self-hosted/Docker), the 0.5.0 HNSW requirement,
CREATE EXTENSION, version verification, permission notes, and references. Add a
note on how vectors are stored (HNSW cosine, dimension from the model).
* docs(enterprise): explain the scaling model in Scale out
Every replica serves traffic and indexes; adding replicas grows both. Note how to
bound parse-vs-query contention with Max concurrent parses.
* docs(enterprise): drop SESSION_SECRET; ENCRYPTION_KEY now signs sessions
* docs(enterprise): add scaling sections to docker/kubernetes, link scaling page
- kubernetes: new Scaling section (StatefulSet -> Deployment + pgvector, Helm note)
- docker: refresh Scaling section (pgvector, turnkey compose)
- drop stale object-storage wording, both link to the Scaling guide
* docs(enterprise): add architecture diagram and a Helm page
- scaling: add an Architecture section with a Mermaid multi-replica diagram
- new Helm deployment page (install, scale, ingress, migration, values)
- add Helm to deployment nav; link it from the kubernetes and scaling pages
* docs(enterprise): move Helm page to its own PR (CTX7-1846)
* docs(enterprise): describe per-run Postgres lock instead of leader election
Match the code: scheduled jobs take a short advisory lock at fire time so one
replica runs each, rather than a persistent elected leader. Drop the leader
highlight from the architecture diagram; replicas are interchangeable.
* docs(enterprise): add Vector Stores page covering LanceDB, pgvector, and Milvus
Dedicated vector-store configuration page: backend comparison, VECTOR_STORE
selection, and Milvus / Zilliz Cloud setup. Cross-link from the scaling guide.
* docs(enterprise): note library access + SSO groups carry over in migration
The migrate command now copies per-library access rules and SSO group
memberships (and session epochs) alongside the other tables, so list them
in the migration step.
The skill download step in `ctx7 setup` hits the git tree API on
api.github.com to enumerate a skill's files. When that host is blocked
or unreachable (while the docs host is fine), the fetch throws and setup
reports "Skill failed / fetch failed" (#2936).
Fall back to fetching the single SKILL.md directly from
raw.githubusercontent.com — the URL the docs API already resolves — so
single-file skills install even when api.github.com is not reachable.
Node 26 bundles undici 8, whose built-in fetch reads a global-dispatcher symbol
(Symbol.for('undici.globalDispatcher.2')) that the bundled undici 6
setGlobalDispatcher never wrote. The ProxyAgent and custom-CA Agent in api.ts
were therefore ignored, so HTTPS_PROXY and NODE_EXTRA_CA_CERTS were silently
dropped and requests failed with ENOTFOUND behind CONNECT proxies (#2935).
undici 7 writes both the legacy and current symbols, restoring proxy and CA
support across Node 20-26. It requires Node >=20.18.1, so Node 18 (EOL) is no
longer supported; the engines field and README are updated accordingly.
Fixes#2935
- Document the By page URL mode on the Confluence integration page (with screenshot)
alongside Browse spaces, including per-page Sub-pages and cross-space support.
- Document the confluence pageUrls / includeSubPages manifest fields in GitOps.
- Correct the space picker step to the current lazy-loaded dropdown.
* docs(enterprise): add Other Git integration page (HTTPS + SSH)
Document ingesting private repos from self-managed Git hosts (Gerrit, Gitea,
self-hosted Bitbucket) over HTTPS basic auth and SSH deploy keys, with Docker
and Kubernetes mount examples. Clarifies that SSH keys are mounted into the
container and never stored by Context7.
* docs(enterprise): SSH deploy key is configurable in the UI (mount is the alternative)
* docs(enterprise): add Other Git screenshots + Add a repository steps
- HTTPS and SSH tab screenshots
- 'Add a repository' Steps showing the clone-URL scheme selects auth
- ssh-keyscan snippet for known_hosts
* docs(enterprise): remove em dashes from Other Git page
* fix(cli): avoid shell for GitHub auth token
* fix(cli): document the shell-free constraint and harden gh token tests
Record why `gh auth token` must stay shell-free so the .cmd/.bat shim gap
is not "fixed" by re-adding `shell`, which would restore the cmd.exe
process that #2918 is about.
- reset mock implementations between tests so they stop leaking
- assert listSkillsFromGitHub's result; the tests passed green without it
- cover the GH_TOKEN fallback, which was previously untested
- reword the changeset: execSync spawned a shell on every platform, and
on Windows that shell was load-bearing rather than "unnecessary"
---------
Co-authored-by: Fahreddin Özcan <ozcanfahrettinn@gmail.com>
- Document the manifest 'type' field routing entries to Confluence, website,
llms.txt, and OpenAPI parsers (bare entries stay git)
- Add the per-type field table and the no-secrets/strict-validation notes
- Confluence: document the space URL field, 'index entire space' scope, and
paginated page browsing; cross-link GitOps confluence entries
* docs(enterprise): document programmatic library import/export API
- Add POST /import-libraries endpoint reference (openapi-enterprise.json + page)
- Register it under API Reference → Parse in the nav
- Add an Automating with the API section to the Library Import feature doc,
covering the cloud license-key export and the on-prem JSON import
* docs: update export endpoint to /api/v1/enterprise/export, plain language
Match the renamed cloud export path, move the license key into the request
body, and reword the automation section without em dashes.
* docs(enterprise): export uses Authorization header; import requires an API key
* docs(enterprise): document the force query param on import
On issues.opened for 'Library Report' titles, forward the issue number to the
triage service (context7app), which runs the read-only agent and comments its
findings. Requires repo secrets TRIAGE_WEBHOOK_URL and TRIAGE_WEBHOOK_SECRET.
* docs(enterprise): add Confluence integration page
Document connecting Confluence (Cloud and self-hosted Data Center) and
indexing a space from Add. Includes screenshots and a nav entry under
Enterprise > Integrations.
* docs(enterprise): wider Confluence settings screenshot with mock site URL
* fix(mcp): skip loopback and IPv6 private IPs in getClientIp
Extract getClientIp into lib/client-ip.ts and extend the private/local
IP filter to cover 127.0.0.0/8, 169.254.0.0/16, ::1, fe80::/10, and
fc00::/7 when walking X-Forwarded-For. Proxies that prepend loopback or
health-check addresses no longer pollute mcp-client-ip analytics.
Fixes#2874
* fix(mcp): tighten private IP detection and add changeset
Anchor the fe80::/10 and fc00::/7 regexes to full 4-digit first hextets
so abbreviated hextets like fe8::1 or fc::1 are no longer misclassified
as private. Match IPv6 loopback in any textual form (0::1,
0:0:0:0:0:0:0:1), add CGNAT (100.64.0.0/10) to the skip list, and add a
patch changeset.
---------
Co-authored-by: syf2211 <syf2211@users.noreply.github.com>
Co-authored-by: Fahreddin Özcan <ozcanfahrettinn@gmail.com>
Fixes#2860
- Use npx ctx7@latest as the canonical CLI invocation in find-docs SKILL.md
- Add official library naming guidance matching rules/context7-cli.md
- De-emphasize global npm install as the primary workflow
- Add regression tests to keep skill and rule guidance aligned
Co-authored-by: syf2211 <syf2211@users.noreply.github.com>
Document setting the GitHub Enterprise host before creating the App or token, so the App flow targets the on-prem server instead of github.com. Note the GITHUB_URL env var as a deploy-time alternative.
* CTX7-1760: document GitOps for on-premise
Add the GitOps page under the On-Premise docs: how reconciliation works, the
manifest format and fields, dashboard configuration, webhooks, disaster
recovery, and the REST API. Includes a dashboard screenshot.
* CTX7-1760: clarify GitOps webhook requirements (reachable host, push subscription)
* CTX7-1760: call out webhook caveat for pre-existing GitHub Apps
* CTX7-1760: add a Before you start prerequisites section to GitOps docs
* CTX7-1760: add GitHub Integration page; trim GitOps prerequisites to reference it
* CTX7-1760: group on-prem feature pages under a Features nav section
* CTX7-1760: move GitHub docs under an Integrations group, add setup screenshots
* Remove accidentally-staged docs/enterprise/integrations/github-actions.mdx
* CTX7-1760: use an admin API key example for the reconcile endpoint instead of a session cookie
* CTX7-1760: use connected-state GitHub App screenshot; split setup into create + install steps
* CTX7-1760: add Verify the App configuration section with permissions and webhook screenshots
Documents generic OIDC SSO setup for Context7 On-Premise, with dashboard
screenshots and a troubleshooting section. Adds the page to the On-Premise
Security nav group.
Adds Part 4 Step 3 covering Microsoft Graph permissions (GroupMember.Read.All
+ User.ReadBasic.All), the WIF federated credential setup (issuer, subject,
audience values copied from the dashboard), group creation, dashboard config,
and "Sync now" verification. Updates the Step 2 roadmap note and adds a
troubleshooting entry for the most common pitfall: missing User.ReadBasic.All
returns 0 members synced even when the group has members.
Document the offline library transfer flow: export libraries from Context7
Cloud, import the bundle into an airgapped on-premise install (snippets are
re-embedded locally). Adds the page under Enterprise > On-Premise.
Adds the redirect URI registration step that VS Code with GitHub Copilot
requires, plus troubleshooting entries for AADSTS500113 and AADSTS50011.
Also notes the CLI alternative when the Manifest UI silently fails to
persist requestedAccessTokenVersion.
* docs: backup and restore guide for on-premise
* docs: add dashboard restore flow and Keep all retention
* docs: use ctx7:restore in the local restore command
* docs: use consistent library/index vocabulary in backup-restore
* feat(mcp): switch anonymous sign-in nudge to elicitation
Replace the in-result markdown nudge with an MCP `elicitation/create`
form request. The previous text-injection approach instructed the
assistant to relay the message to the user, which some agents flagged
as prompt injection. Elicitations are delivered out-of-band to the
client UI, bypassing that surface entirely.
- `maybeElicitAuthSignIn` fires after each tool response when the
backend has set `ctx.shouldPrompt` (via `X-Context7-Auth-Prompt: 1`)
and the caller is anonymous.
- Gated on the client advertising the `elicitation` capability;
no-op otherwise.
- Includes a "Don't show this again" checkbox; opting out suppresses
further nudges for the lifetime of the MCP process, keyed per
session id / client IP.
- Fire-and-forget: the elicitation never blocks or fails the
surrounding tool response.
* feat(mcp): two-option choice in sign-in elicitation
Replace the "Don't show this again" checkbox with a single-select
radio between "I'll run the command to sign in" and "Continue
anonymously with smaller limits". The radio makes the user's intent
explicit and softens the protocol-fixed Accept/Decline labels —
Accept now just submits the choice.
Picking "Continue anonymously" (or declining/cancelling outright)
suppresses further nudges for the lifetime of the MCP process.
The command itself stays in the dialog message for the user to
copy; the server does not attempt to drive the client to execute it.
* fix(mcp): use plain enum schema for choice radio
Switch the elicitation's choice field from `oneOf` with separate
`const`/`title` entries to the simpler `enum: [...]` shape. Cursor's
elicitation UI does not render the `oneOf`-with-titles pattern
correctly — it falls back to a plain text input with the const string
as the default value. The flat enum form is rendered as a proper
dropdown / radio across the clients we tested.
The user-facing strings are now also the enum const values, so the
elicitation response surfaces the chosen label directly. Suppression
logic compares against the same string constants.
* refactor(mcp): drop in-memory suppression, let backend own prompt frequency
The MCP server no longer keeps a per-session suppression set. It fires the
elicitation whenever X-Context7-Auth-Prompt is present; the backend now emits
that header at most once per MCP session.
github-actions[bot]