@arbiterforge/ca-pi 0.10.6 → 0.10.8

package/README.md

@@ -10,7 +10,7 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.17.5" src="https://img.shields.io/badge/version-2.17.5-2b7489">
+<img alt="version 2.17.7" src="https://img.shields.io/badge/version-2.17.7-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-23-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-19-555">
@@ -117,7 +117,7 @@ Approve the normal plugin trust prompt, open the target repository, and continue
 
 ### Codex CLI
 
-The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.9.5`;
+The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.9.7`;
 the dated end-to-end public-install record discovered `ca-codex 0.2.4` from release `v2.8.13`.
 Current packaging and shared-core parity are continuously verified, while that dated live-install
 record stays labeled rather than being silently promoted to evidence for a newer adapter:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.10.6",
+  "version": "0.10.8",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.10.8] - 2026-09-06
+
+### Fixed
+
+- Distinguish ordinary return-code identifiers such as `rc2` from cipher configuration in the crypto/TLS commit gate.
+
+## [0.10.7] - 2026-09-06
+
+### Fixed
+
+- Recover an unsettled mode-enter audit row on a repeated request instead of reporting an ineffective posture as a no-op.
+
 ## [0.10.6] - 2026-09-06
 
 ### Changed

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -38,7 +38,7 @@
 #                                         (case-insensitive)
 #   head_on_protected_tip(cwd) -> bool|None  True iff detached HEAD sits on a
 #                                         protected branch's tip
-#   added_lines(cwd, ref, paths=None) -> str|None  added ('+') diff lines,
+#   added_lines(cwd, ref, paths=None) -> SecurityScan|None  classified added lines,
 #                                         narrowed to the H-09b/H-10b candidate
 #                                         set, or None on a git-read failure
 #   staged_paths(cwd) -> set|None        index paths (`git diff --cached
@@ -84,7 +84,7 @@ from _hooklib import (
     ADR_LIFECYCLE_LOG_BASENAME, AUDIT_LOG_BASENAMES, AUDIT_LOG_FLAT_BASENAMES,
     AUDIT_LOG_NAMES, CRYPTO_RE, DECISION_AUDIT_LOG_NAMES, DECISION_LOG_BASENAME, DECISIONS_DIR_RE,
     GATE_MARKER_NAMES, MARKER_FRESHNESS_MINUTES, SECRET_RE, SECURITY_DIFF_GIT_ARGS, block,
-    content_digest, is_migration_path, line_digest, marker_fresh, sensitive_scan_added_lines,
+    content_digest, is_migration_path, line_digest, marker_fresh, security_scan_diff,
 )
 from _gitexec import git_executable
 import _gitlib  # reused for its spawn-free, worktree-aware (.git-as-a-FILE /
@@ -1042,7 +1042,7 @@ def head_on_protected_tip(cwd):
 
 
 def added_lines(cwd, ref, paths=None):
-    """The added (`+`) lines of a diff — what a commit would introduce — or None
+    """The shared classification/bindings for a diff, or None
     when git could not produce the diff (nonzero exit / timeout / error). The
     None return (not "") lets the H-09b/H-10b security scan fail CLOSED on a read
     error rather than silently passing — an empty diff and an unreadable diff are
@@ -1073,7 +1073,10 @@ def added_lines(cwd, ref, paths=None):
     except Exception as e:  # noqa: BLE001
         _note_read_err(argv, repr(e))
         return None
-    return "\n".join(sensitive_scan_added_lines(out.stdout))
+    result = security_scan_diff(out.stdout)
+    if result is None:
+        _note_read_err(argv, "malformed or incomplete crypto context")
+    return result
 
 
 def _names(cwd, args):
@@ -1531,11 +1534,9 @@ def _check_h09b_h10b_crypto_secret(commit, add, cwd, root):
                        "read (git unavailable or timed out) — failing closed "
                        "(ORCHESTRATOR §2). Retry, or run the crypto-compliance / "
                        "secret-handling gate, then commit." + _read_err_hint())
-    added = "\n".join(parts)
-    sensitive = [ln for ln in added.splitlines()
-                 if CRYPTO_RE.search(ln) or SECRET_RE.search(ln)]
+    sensitive = set().union(*(part.digests for part in parts))
     if sensitive:
-        touches_crypto = bool(CRYPTO_RE.search(added))
+        touches_crypto = any(part.crypto for part in parts)
         kind = "crypto/TLS" if touches_crypto else "secret"
         tag = "H-09b" if touches_crypto else "H-10b"
         skill = "crypto-compliance" if touches_crypto else "secret-handling"
@@ -1551,7 +1552,7 @@ def _check_h09b_h10b_crypto_secret(commit, add, cwd, root):
                 approved = set(f.read().split())
         except Exception:  # noqa: BLE001
             approved = set()
-        uncovered = [ln for ln in sensitive if line_digest(ln) not in approved]
+        uncovered = sensitive - approved
         if uncovered:
             block(tag, f"{len(uncovered)} {kind} line(s) in this commit are not covered "
                        f"by the recorded security-gate pass — the pass is bound to the "

package/plugins/ca-pi/hooks/_hooklib.py

@@ -209,6 +209,10 @@ from _sensitivelib import (  # noqa: F401
     is_sensitive_scan_exempt,
     line_digest,
     sensitive_scan_added_lines,
+    SecurityScan,
+    security_scan_diff,
+    security_scan_lines,
+    security_scan_source,
 )
 
 

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.10.6"
+    adapter_version = "0.10.8"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_modelib.py

@@ -353,13 +353,14 @@ def flip(session_id, mode, root=None, payload=None, host_name=None, now=None):
     """Attempt to set `session_id`'s mode to `mode`. Returns one of
     FLIP_FLIPPED / FLIP_NOOP / FLIP_FAILED. Never raises.
 
-    AC-6: a flip TO THE ALREADY-ACTIVE mode is a no-op — no write is even
-    attempted and no audit row is appended, so `overrides.log` is left
-    byte-identical. This is also the mechanism behind T-14's fail-direction
-    asymmetry: once a failed flip has left the session's resolved mode
-    unchanged, any LATER flip back to that same resolved mode is a no-op
-    under ANY filesystem state — including a markers directory that cannot
-    be written to at all — because a no-op never touches disk.
+    AC-6: a flip TO AN ALREADY-ACTIVE, LEDGER-BACKED mode is a no-op — no
+    write is attempted and no audit row is appended, so `overrides.log` is
+    left byte-identical. The default arbiter posture needs no authorizing row.
+    If a prior non-arbiter write landed but its staged enter row did not, a
+    repeat request retries settlement: success reports the effective flip,
+    while another failure stays explicit instead of claiming the posture is
+    already active. This preserves T-14's fail direction because an unbacked
+    non-arbiter marker still cannot authorize persona composition.
 
     On a genuine transition the order is deliberate: write first, audit row
     ONLY on a confirmed write. AC-11's `ledger_backs` exists to catch exactly
@@ -369,7 +370,12 @@ def flip(session_id, mode, root=None, payload=None, host_name=None, now=None):
     root = root if root is not None else marker_root(payload)
     current, _diag = current_mode(session_id, root=root, payload=payload)
     if current == mode:
-        return FLIP_NOOP
+        if mode == MODES[0] or ledger_backs(root, mode, session_id=session_id):
+            return FLIP_NOOP
+        _settle_dev_close(root, host_name=host_name)
+        return (FLIP_FLIPPED
+                if ledger_backs(root, mode, session_id=session_id)
+                else FLIP_FAILED)
     if not write_mode(session_id, mode, root=root, payload=payload):
         return FLIP_FAILED
     # ADR-0030 position 4: EVERY transition row is staged through the #396

package/plugins/ca-pi/hooks/_sensitivelib.py

@@ -26,7 +26,12 @@
 from __future__ import annotations
 
 import hashlib
+import io
+import json
 import re
+import tokenize
+from bisect import bisect_right
+from collections import namedtuple
 
 from _pathnorm import norm_path
 
@@ -38,10 +43,31 @@ from _pathnorm import norm_path
 # catch-all is narrowed to the members that actually sign, encrypt, derive
 # keys, or produce security-relevant randomness. bcrypt stays: approved or
 # not, a password-hashing change is exactly what crypto-compliance reviews.
+# Short names also occur as return-code variables and ordinary prose (#678).
+# Require configuration, known mode/padding suffixes, a crypto call/member, or
+# an import/crypto namespace. A standalone quoted value also matches when its
+# config key is outside the diff; unrelated quoted labels and prose do not.
+# Line-shape arms also work in joined content (the H-09b verdict/reminder read).
+_SHORT_CRYPTO_NAME = r"(?:rc2|rc4|des|rsa)"
+_CRYPTO_LINE_END = r"(?:[ \t]*[,;\])}])*[ \t]*(?:(?:\#|//)[^\r\n]*)?\r?$"
 CRYPTO_RE = re.compile(
-    r"(createHash|createCipher|createHmac|\bmd5\b|\bsha1\b|\brc4\b|\bdes\b|3des"
-    r"|\brc2\b|\bblowfish\b"
-    r"|\bRSA\b|x509|bcrypt"
+    r"(createHash|createCipher|createHmac|\bmd5\b|\bsha1\b|3des"
+    r"|\bblowfish\b|x509|bcrypt"
+    rf"""|(?m:^[ \t]*(?:-[ \t]*)?["']{_SHORT_CRYPTO_NAME}["']{_CRYPTO_LINE_END})"""
+    rf"|\b{_SHORT_CRYPTO_NAME}[-/](?:cbc|ecb|cfb|ofb|ctr|ede3?|oaep|pss|pkcs1)\b"
+    rf"|\b{_SHORT_CRYPTO_NAME}\s*\("
+    rf"|\b{_SHORT_CRYPTO_NAME}\s*\.\s*"
+    r"(?:new|create|generate|construct|import_?key|encrypt|decrypt|sign|verify"
+    r"|(?:rsa)?(?:public|private)(?:key|numbers)|rsakey|mode_)\w*\b"
+    rf"""|\b(?:cipher|algorithm)["']?\s*[:=]\s*["']?{_SHORT_CRYPTO_NAME}\b"""
+    r"""|\bkey_type["']?\s*[:=]\s*["']?rsa\b"""
+    rf"""|\b(?:Cipher|KeyFactory)\s*\.\s*getInstance\s*\(\s*["']{_SHORT_CRYPTO_NAME}\b"""
+    rf"|\b(?:Cipher|PublicKey|algorithms|asymmetric|Cryptography)\s*\.\s*{_SHORT_CRYPTO_NAME}\b"
+    rf"|\bcrypto/{_SHORT_CRYPTO_NAME}\b"
+    rf"|\b(?:from|import)(?:\s+(?:\(\s*)?|\(\s*)"
+    rf"(?:\w+(?:\.\w+)*(?:\s+as\s+\w+)?\s*,\s*)*"
+    rf"(?:\w+\.)*{_SHORT_CRYPTO_NAME}\b"
+    rf"|(?m:^[ \t]*{_SHORT_CRYPTO_NAME}[ \t]+as[ \t]+\w+{_CRYPTO_LINE_END})"
     r"|crypto\.(subtle|sign|verify|createSign|createVerify|generateKey"
     r"|publicEncrypt|privateDecrypt|pbkdf2|scrypt|randomBytes|createDiffieHellman)"
     r"|InsecureSkipVerify|verify=False"
@@ -118,7 +144,8 @@ def is_sensitive_scan_exempt(rel):
 # forget to pin it (that was exactly how this hole would keep reopening).
 SECURITY_DIFF_GIT_ARGS = (
     "-c", "diff.mnemonicPrefix=false", "-c", "diff.noprefix=false",
-    "diff", "--no-ext-diff", "--src-prefix=a/", "--dst-prefix=b/",
+    "diff", "--no-ext-diff", "--no-textconv", "--no-color",
+    "--src-prefix=a/", "--dst-prefix=b/", "--unified=2147483647",
 )
 
 # The fixed-width destination-path prefix `diff_added_lines` strips off a
@@ -249,6 +276,238 @@ def sensitive_scan_added_lines(diff_text):
             if not (path and is_sensitive_scan_exempt(path))]
 
 
+# H-09b contextual additions (#678): raw line bindings stay compatible. Only
+# bare short-name import items require lexical destination context. Context
+# bindings use a separate marker namespace; a user-authored source string or
+# an old line-only approval cannot impersonate one of these records.
+# SecurityScan(crypto, digests): classification and exact approval identities.
+# security_scan_lines(lines) -> SecurityScan|None: line-bound scan or refusal.
+# security_scan_source(path, source, added_rows) -> SecurityScan|None.
+# security_scan_diff(text) -> SecurityScan|None: None means untrusted context.
+SecurityScan = namedtuple("SecurityScan", "crypto digests")
+_SHORT_CRYPTO_TOKEN_RE = re.compile(rf"\b{_SHORT_CRYPTO_NAME}\b", re.I)
+_IMPORT_ITEM = r"[^\W\d]\w*(?:[ \t]+as[ \t]+[^\W\d]\w*)?"
+_IMPORT_ITEM_LINE_RE = re.compile(
+    rf"[ \t]*{_IMPORT_ITEM}(?:[ \t]*,[ \t]*{_IMPORT_ITEM})*[ \t]*,?[ \t]*"
+    r"(?:\\|\)[ \t]*(?:;[^\r\n]*)?)?[ \t]*(?:\#[^\r\n]*)?", re.I)
+_FULL_HUNK_RE = re.compile(r"@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?")
+_MAX_CRYPTO_CONTEXT_BYTES = 1_000_000
+
+
+def _is_context_item_line(line):
+    """Route bounded import-list syntax to context, never classify it alone."""
+    if not _SHORT_CRYPTO_TOKEN_RE.search(line):
+        return False
+    # Collapse only the temporary routing text, avoiding overlapping whitespace
+    # partitions. Tokenization and approval binding still use the original source.
+    candidate = re.sub(r"[ \t]+", " ", line)
+    return bool(_IMPORT_ITEM_LINE_RE.fullmatch(candidate))
+
+
+def _cross_line_crypto_spans(lines):
+    """Locate joined matches by zero-based row/column, without quadratic slicing."""
+    starts = [0]
+    for line in lines:
+        starts.append(starts[-1] + len(line) + 1)
+    spans = set()
+    for match in CRYPTO_RE.finditer("\n".join(lines)):
+        if "\n" not in match.group():
+            continue
+        first = bisect_right(starts, match.start()) - 1
+        last = bisect_right(starts, match.end()) - 1
+        spans.add((first, match.start() - starts[first],
+                   last, match.end() - starts[last]))
+    return spans
+
+
+def _scan_bound_lines(lines, contextual_bindings):
+    """Each cross-line match needs its own recognized contextual identity."""
+    spans = _cross_line_crypto_spans(lines)
+    if not spans <= contextual_bindings.keys():
+        return None
+    return SecurityScan(bool(spans) or any(CRYPTO_RE.search(line) for line in lines), {
+        line_digest(line) for line in lines
+        if CRYPTO_RE.search(line) or SECRET_RE.search(line)
+    } | set(contextual_bindings.values()))
+
+
+def security_scan_lines(lines):
+    """Preserve same-line bindings; refuse crypto spanning unbound lines."""
+    return _scan_bound_lines(lines, {})
+
+
+def security_scan_source(path, source, added_rows):
+    """Classify original added lines plus narrowly recognized Python imports.
+
+    `source` is ONE destination snapshot; rows are one-based positions in it.
+    Tokenization only separates import NAME/OP tokens from strings/comments;
+    this is not an expression, type, or general-language parser. Invalid or
+    unavailable required context returns None, never an ordinary exemption.
+    """
+    lines = source.splitlines()
+    if any(row < 1 or row > len(lines) for row in added_rows):
+        return None
+    added = [lines[row - 1] for row in added_rows]
+    result = security_scan_lines(added)
+    candidates = {row for row in added_rows
+                  if _is_context_item_line(lines[row - 1])}
+    if not candidates:
+        return result
+    if not path or len(source.encode("utf-8", "replace")) > _MAX_CRYPTO_CONTEXT_BYTES:
+        return None
+    # Replacement decoding can collapse distinct original bytes. Even a
+    # literal replacement character is ambiguous here: refuse contextual proof.
+    if "\ufffd" in source:
+        return None
+    try:
+        tokens = [token for token in tokenize.generate_tokens(io.StringIO(source).readline)
+                  if token.type not in (tokenize.COMMENT, tokenize.NL,
+                                        tokenize.INDENT, tokenize.DEDENT)]
+    except (tokenize.TokenError, SyntaxError):
+        return None
+    if any(token.type == tokenize.ERRORTOKEN and not token.string.isspace()
+           for token in tokens):
+        return None
+    matched = set()
+    import_spans = []
+    start = [(tokenize.NAME, "from"), (tokenize.NAME, "Crypto"),
+             (tokenize.OP, "."), (tokenize.NAME, "Cipher"),
+             (tokenize.NAME, "import"), (tokenize.OP, "(")]
+    for index in range(len(tokens) - len(start)):
+        if [(token.type, token.string) for token in tokens[index:index + len(start)]] != start:
+            continue
+        cursor = index + len(start)
+        while cursor < len(tokens) and tokens[cursor].string != ")":
+            item = tokens[cursor]
+            if item.type != tokenize.NAME:
+                return None
+            cursor += 1
+            if cursor < len(tokens) and tokens[cursor].string == "as":
+                cursor += 1
+                if cursor >= len(tokens) or tokens[cursor].type != tokenize.NAME:
+                    return None
+                cursor += 1
+            if item.start[0] in candidates and _SHORT_CRYPTO_TOKEN_RE.fullmatch(item.string):
+                matched.add(item.start[0])
+                import_spans.append((tokens[index + 4].start, item.end))
+            if cursor >= len(tokens) or tokens[cursor].string not in (",", ")"):
+                return None
+            if tokens[cursor].string == ",":
+                cursor += 1
+        if cursor >= len(tokens):
+            return None
+    # Preserve lexical whitespace; only transport CRLF decoding is normalized.
+    destination = hashlib.sha256(source.encode("utf-8", "replace")).hexdigest()
+    contexts = {row: "ctx-v1:" + hashlib.sha256(json.dumps(
+        [path, destination, row, lines[row - 1]], separators=(",", ":")
+    ).encode("utf-8")).hexdigest() for row in matched}
+    positions = {row: index for index, row in enumerate(added_rows)}
+    bindings = {(positions[first[0]], first[1], positions[last[0]], last[1]): contexts[last[0]]
+                for first, last in import_spans
+                if first[0] in positions and last[0] in positions}
+    result = _scan_bound_lines(added, bindings)
+    if result is None:
+        return None
+    return SecurityScan(result.crypto or bool(contexts), result.digests | set(contexts.values()))
+
+
+def _full_destination(section):
+    """Validate one whole-file Git hunk before using its destination context."""
+    path = None
+    hunk = None
+    for index, line in enumerate(section):
+        if line.startswith(_PLUS_B_PREFIX):
+            path = line[len(_PLUS_B_PREFIX):]
+        if line.startswith("@@"):
+            hunk = index
+            break
+    if not path or hunk is None:
+        return None
+    header = _FULL_HUNK_RE.fullmatch(section[hunk])
+    if header is None:
+        return None
+    old_start, old_count, new_start, new_count = header.groups()
+    old_start, new_start = int(old_start), int(new_start)
+    old_count, new_count = int(old_count or 1), int(new_count or 1)
+    if old_start != (1 if old_count else 0) or new_start != 1:
+        return None
+    destination, rows = [], []
+    old_seen = new_seen = 0
+    previous = None
+    for line in section[hunk + 1:]:
+        if line.startswith("\\"):
+            if line != "\" or previous not in ("+", "-", " "):
+                return None
+            if previous != "-":
+                destination[-1] = destination[-1].removesuffix("\n")
+            previous = None
+            continue
+        if not line or line[0] not in ("+", "-", " "):
+            return None
+        previous = line[0]
+        if previous in ("-", " "):
+            old_seen += 1
+        if previous in ("+", " "):
+            new_seen += 1
+            destination.append(line[1:] + "\n")
+            if previous == "+":
+                rows.append(new_seen)
+    if (old_seen, new_seen) != (old_count, new_count):
+        return None
+    return path, "".join(destination), rows
+
+
+def security_scan_diff(diff_text):
+    """Shared producer/consumer scan; context comes from this one pinned diff.
+
+    Legacy classification and audit-path handling remain unchanged. Only a
+    section with an ambiguous bare added item pays the full-context/token cost.
+    Missing attribution, incomplete hunks and unsupported context fail closed.
+    """
+    # A flattened match may not borrow approval from a different file section.
+    cross_spans = _cross_line_crypto_spans(sensitive_scan_added_lines(diff_text))
+    covered_spans = set()
+    added_offset = 0
+    result = SecurityScan(False, set())
+    sections = []
+    for line in diff_text.splitlines():
+        if line.startswith("diff ") or not sections:
+            sections.append([])
+        sections[-1].append(line)
+    for section in sections:
+        attributed = diff_added_lines("\n".join(section))
+        if attributed and all(path and is_sensitive_scan_exempt(path)
+                              for path, _ in attributed):
+            continue
+        added = sensitive_scan_added_lines("\n".join(section))
+        # A damaged hunk header must not make an apparent added item disappear
+        # in the legacy permissive walker before context validation even runs.
+        if not any(line.startswith("+") and _is_context_item_line(line[1:])
+                   for line in section):
+            contextual = security_scan_lines(added)
+        else:
+            if not section[0].startswith("diff --git "):
+                return None
+            context = _full_destination(section)
+            if context is None:
+                return None
+            path, source, rows = context
+            source_lines = source.splitlines()
+            if attributed != [(path, source_lines[row - 1]) for row in rows]:
+                return None
+            contextual = security_scan_source(path, source, rows)
+        if contextual is None:
+            return None
+        covered_spans.update((first + added_offset, col, last + added_offset, end)
+                             for first, col, last, end in _cross_line_crypto_spans(added))
+        added_offset += len(added)
+        result = SecurityScan(result.crypto or contextual.crypto,
+                              result.digests | contextual.digests)
+    if not cross_spans <= covered_spans:
+        return None
+    return result
+
+
 def line_digest(line):
     """Digest of one added diff line, for the security-gate binding
     (H-09b/H-10b). The gate-pass marker stores these digests instead of being

package/plugins/ca-pi/hooks/git-enforce.py

@@ -32,7 +32,7 @@ from _gitexec import git_executable  # noqa: E402
 from _hooklib import (  # noqa: E402
     CRYPTO_RE, MARKER_FRESHNESS_MINUTES, SECRET_RE, SECURITY_DIFF_GIT_ARGS,
     arbiter_active, content_digest, is_migration_path, line_digest,
-    marker_fresh, sensitive_scan_added_lines, set_host, utf8_stdio,
+    marker_fresh, security_scan_diff, set_host, utf8_stdio,
 )
 
 
@@ -164,7 +164,7 @@ def cached_added_lines(cwd):
     r = _git([*SECURITY_DIFF_GIT_ARGS, "--cached"], cwd)
     if r is None or r.returncode != 0:
         return None
-    return sensitive_scan_added_lines(r.stdout)
+    return security_scan_diff(r.stdout)
 
 
 def cached_names(cwd):
@@ -229,10 +229,9 @@ def pre_commit(root):
     if added is None:
         block("H-09b", "the staged diff for the crypto/secret scan could not be read — "
                        "failing closed (ORCHESTRATOR §2).")
-    sensitive = [ln for ln in added if CRYPTO_RE.search(ln) or SECRET_RE.search(ln)]
+    sensitive = added.digests
     if sensitive:
-        joined = "\n".join(added)
-        touches_crypto = bool(CRYPTO_RE.search(joined))
+        touches_crypto = added.crypto
         kind = "crypto/TLS" if touches_crypto else "secret"
         tag = "H-09b" if touches_crypto else "H-10b"
         skill = "crypto-compliance" if touches_crypto else "secret-handling"
@@ -242,7 +241,7 @@ def pre_commit(root):
             block(tag, f"This commit introduces {kind} changes, but no security-gate pass is "
                        f"recorded (#161 git backstop). Run the {skill} gate, then commit.")
         approved = _marker_set(marker_root, "security-gate-passed")
-        uncovered = [ln for ln in sensitive if line_digest(ln) not in approved]
+        uncovered = sensitive - approved
         if uncovered:
             block(tag, f"{len(uncovered)} {kind} line(s) in this commit are not covered by the "
                        f"recorded security-gate pass (#161 git backstop) — re-run the {skill} "

package/plugins/ca-pi/hooks/hostapi.py

@@ -218,7 +218,7 @@ def git_worktree_main_root(root):
     of the command's effective exec root).
 
     Deliberately NOT wired into `Host.project_root()` itself: `project_root()`
-    also backs `security-pass.py`'s DIFF SCAN (`candidate_lines()`), which
+    also backs `security-pass.py`'s DIFF SCAN (`candidate_scan()`), which
     must stay worktree-local — escalating the general project root to "main"
     would bind digests to the wrong (unrelated, possibly dirty) tree and
     silently drop coverage for the diff actually being committed, the exact
@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.17.5"
+    adapter_version = "2.17.7"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/hooks/security-pass.py

@@ -17,6 +17,7 @@
 #   "$PY" "<plugin>/hooks/security-pass.py"
 
 import os
+import stat
 import subprocess
 
 from _gitexec import git_executable
@@ -26,8 +27,8 @@ sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import hostapi  # noqa: E402 — host seam (ADR-0011)
 import _entrylib  # noqa: E402 — shared run() dispatch (jscpd dedup)
 from _hooklib import (  # noqa: E402
-    CRYPTO_RE, SECRET_RE, SECURITY_DIFF_GIT_ARGS, is_sensitive_scan_exempt,
-    line_digest, marker_root, project_root, sensitive_scan_added_lines,
+    SECURITY_DIFF_GIT_ARGS, SecurityScan, is_sensitive_scan_exempt,
+    marker_root, project_root, security_scan_diff, security_scan_source,
     set_host, utf8_stdio, warn, write_text_atomic,
 )
 
@@ -41,20 +42,26 @@ def run_git(args, cwd):
     )
 
 
-def file_lines(root, rel):
+def file_scan(root, rel):
     p = os.path.join(root, rel)
     try:
-        if os.path.getsize(p) > MAX_UNTRACKED_BYTES:
-            return []
+        metadata = os.lstat(p)
+        if not stat.S_ISREG(metadata.st_mode):
+            return None
+        if metadata.st_size > MAX_UNTRACKED_BYTES:
+            return SecurityScan(False, set())
         with open(p, encoding="utf-8", errors="replace") as f:
-            return f.read().splitlines()
+            source = f.read()
+        return security_scan_source(rel, source, range(1, len(source.splitlines()) + 1))
     except Exception:  # noqa: BLE001
-        return []
+        return None
 
 
-def candidate_lines(root):
-    """Every line the next commit could introduce: added lines of the
-    worktree-vs-HEAD diff (staged and unstaged alike), plus the full content
+def candidate_scan(root):
+    """Separate classified index and worktree snapshots, plus untracked content.
+
+    Every line the next commit could introduce: added lines of the
+    staged diff AND worktree-vs-HEAD diff, plus the full content
     of untracked files — `git diff HEAD` never shows those, but they land in
     the staged diff the moment commit-gate stages them.
 
@@ -69,23 +76,41 @@ def candidate_lines(root):
     it pins the `a/`/`b/` prefix format `sensitive_scan_added_lines` depends
     on for path attribution, regardless of the caller's `diff.mnemonicPrefix`
     / `diff.noprefix` / external-diff config (#279 review MEDIUM-1)."""
-    lines = []
+    staged = run_git([*SECURITY_DIFF_GIT_ARGS, "--cached"], root)
+    if staged.returncode != 0:
+        return None
+    scans = [security_scan_diff(staged.stdout)]
     diff = run_git([*SECURITY_DIFF_GIT_ARGS, "HEAD"], root)
     if diff.returncode == 0:
-        lines += sensitive_scan_added_lines(diff.stdout)
+        scans.append(security_scan_diff(diff.stdout))
     else:
-        # Unborn branch (no HEAD yet): every tracked file is new content.
+        # Confirm an absent branch ref, not merely a failed diff read. A real
+        # read/parse failure must never be laundered through the unborn path.
+        head = run_git(["rev-parse", "--verify", "--quiet", "HEAD"], root)
+        branch = run_git(["symbolic-ref", "--quiet", "HEAD"], root)
+        if head.returncode != 1 or branch.returncode != 0:
+            return None
+        absent = run_git(["show-ref", "--verify", "--quiet", branch.stdout.strip()], root)
+        if absent.returncode != 1:
+            return None
         ls = run_git(["ls-files"], root)
+        if ls.returncode != 0:
+            return None
         for rel in ls.stdout.splitlines():
             if is_sensitive_scan_exempt(rel):
                 continue
-            lines += file_lines(root, rel)
+            scans.append(file_scan(root, rel))
     untracked = run_git(["ls-files", "--others", "--exclude-standard"], root)
+    if untracked.returncode != 0:
+        return None
     for rel in untracked.stdout.splitlines():
         if is_sensitive_scan_exempt(rel):
             continue
-        lines += file_lines(root, rel)
-    return lines
+        scans.append(file_scan(root, rel))
+    if any(scan is None for scan in scans):
+        return None
+    return SecurityScan(any(scan.crypto for scan in scans),
+                        set().union(*(scan.digests for scan in scans)))
 
 
 def main():
@@ -95,11 +120,16 @@ def main():
         warn("no .codearbiter/ here — security-pass.py records nothing outside "
              "an initialized repo")
         sys.exit(1)
-    sensitive = [ln for ln in candidate_lines(root)
-                 if CRYPTO_RE.search(ln) or SECRET_RE.search(ln)]
+    try:
+        scan = candidate_scan(root)
+    except (OSError, subprocess.SubprocessError, ValueError):
+        scan = None
+    if scan is None:
+        warn("security-gate pass refused: unavailable or malformed crypto/secret context")
+        sys.exit(1)
     # #604: the MARKER root is deliberately NOT `root` above. `root` (plain
     # project_root()) must stay wherever this process is actually running —
-    # candidate_lines(root) just scanned exactly that tree's diff, and binding
+    # candidate_scan(root) just scanned exactly that tree's diff, and binding
     # digests to a DIFFERENT tree would review lines nobody staged. But in a
     # linked git worktree, `root` names the worktree's own (gitignored,
     # never-checked-out) `.codearbiter/.markers/`, while the H-09b/H-10b
@@ -110,7 +140,7 @@ def main():
     marker_dir = os.path.join(write_root, ".codearbiter", ".markers")
     os.makedirs(marker_dir, exist_ok=True)
     marker = os.path.join(marker_dir, "security-gate-passed")
-    digests = sorted({line_digest(ln) for ln in sensitive})
+    digests = sorted(scan.digests)
     # Atomic write (migration-002): a crash mid-write never leaves a half-written
     # marker, which the backstop would read as an unrecognized digest and force a
     # spurious gate re-run.