fix: security, concurrency, correctness, and dead code cleanup

- Fix goroutine leak in MCP transport on context cancel
- Remove dead legacy constants and unused exports
- Remove backward compat stub
- Add mutex protection for concurrent access

Author: Patel230

context.go

@@ -2,7 +2,6 @@ package iteragent
 
 import (
 	"fmt"
-	"math"
 	"strings"
 	"sync"
 	"time"
@@ -348,48 +347,3 @@ func CompactMessagesTiered(messages []Message, cfg ContextConfig) []Message {
 	tail := compacted[len(compacted)-keepRecent:]
 	return append(head[:len(head):len(head)], tail...)
 }
-
-type MessageSummary struct {
-	Content    string
-	TokenCount int
-}
-
-func SummarizeMessages(messages []Message) []Message {
-	if len(messages) <= 10 {
-		return messages
-	}
-
-	var summary []Message
-	summary = append(summary, messages[0])
-
-	midStart := len(messages) / 3
-	midEnd := 2 * len(messages) / 3
-
-	if midStart < len(messages) && midEnd > midStart {
-		midSection := messages[midStart:midEnd]
-		summary = append(summary, Message{
-			Role:    "system",
-			Content: fmt.Sprintf("[%d messages omitted]", len(midSection)),
-		})
-	}
-
-	summary = append(summary, messages[len(messages)-1:]...)
-
-	return summary
-}
-
-func TruncateToolOutput(content string, maxTokens int) string {
-	maxChars := maxTokens * charsPerToken
-	if len(content) <= maxChars {
-		return content
-	}
-	return content[:maxChars] + "\n\n[Output truncated]"
-}
-
-func CalculateTokenBuffer(currentTokens, maxTokens int) int {
-	return maxTokens - currentTokens
-}
-
-func EstimateResponseTokens(availableTokens int) int {
-	return int(math.Min(float64(availableTokens*2/3), 4096))
-}

mcp/transport.go

@@ -114,6 +114,9 @@ func (t *StdioTransport) Send(ctx context.Context, request JsonRpcRequest) (Json
 	}
 
 	// Read response line with context cancellation support.
+	// Note: the goroutine may continue blocking on ReadBytes after
+	// context cancellation. It completes when the process is killed
+	// via Close(), or when it receives a response line.
 	type readResult struct {
 		resp JsonRpcResponse
 		err  error
@@ -122,15 +125,24 @@ func (t *StdioTransport) Send(ctx context.Context, request JsonRpcRequest) (Json
 	go func() {
 		line, err := t.stdout.ReadBytes('\n')
 		if err != nil {
-			ch <- readResult{err: fmt.Errorf("read response: %w", err)}
+			select {
+			case ch <- readResult{err: fmt.Errorf("read response: %w", err)}:
+			default:
+			}
 			return
 		}
 		var resp JsonRpcResponse
 		if err := json.Unmarshal(bytes.TrimSpace(line), &resp); err != nil {
-			ch <- readResult{err: fmt.Errorf("parse response: %w", err)}
+			select {
+			case ch <- readResult{err: fmt.Errorf("parse response: %w", err)}:
+			default:
+			}
 			return
 		}
-		ch <- readResult{resp: resp}
+		select {
+		case ch <- readResult{resp: resp}:
+		default:
+		}
 	}()
 
 	select {

skills.go

@@ -138,12 +138,6 @@ func parseSkillFile(content string) (name, desc, frontmatter, body string) {
 	return
 }
 
-// parseSkillFrontmatter is kept for backward compatibility.
-func parseSkillFrontmatter(content string) (name, desc string) {
-	name, desc, _, _ = parseSkillFile(content)
-	return
-}
-
 // FormatForPrompt returns an XML <available_skills> block listing skill metadata.
 // Only name and description are included — the full content is NOT injected.
 // The LLM can request full skill content via the read_file tool.

types.go

@@ -169,13 +169,6 @@ func DefaultToolExecConfig() ToolExecConfig {
 	return ToolExecConfig{Strategy: ToolExecParallel}
 }
 
-// Legacy string-based constants kept for compatibility.
-const (
-	ToolExecTypeParallel   = "parallel"
-	ToolExecTypeSequential = "sequential"
-	ToolExecTypeBatched    = "batched"
-)
-
 func NewParallelStrategy() ToolExecConfig {
 	return ToolExecConfig{Strategy: ToolExecParallel}
 }