@arbiterforge/ca-pi 0.15.10 → 0.16.0

package/plugins/ca-pi/hooks/_hooklib.py

@@ -46,7 +46,7 @@
 #                                         own checkout — the root gate MARKERS
 #                                         (.codearbiter/.markers/) live under (#604)
 #   repo_rel(fpath, root) -> str         repo-relative POSIX path, or "" if outside root
-#   line_digest(line) -> str             sha256 hex of one diff line (H-09b/H-10b gate)
+#   line_digest(line, path=None) -> str  path-bound sha256 of one diff line (H-09b/H-10b gate)
 #   content_digest(text) -> str          sha256 hex of a whole file's content (H-14 gate)
 #   migration_globs(root) -> tuple[list, list]   (includes, excludes) for migration detection
 #   scope_globs(root, defaults, decl_re) -> tuple[list, list]   generic glob scope resolver
@@ -144,6 +144,7 @@ from _activationlib import (  # noqa: F401
     arbiter_active,
     frontmatter_enabled,
     frontmatter_enabled_text,
+    initialized_body_text,
     get_host,
     marker_root,
     project_root,

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.15.10"
+    adapter_version = "0.16.0"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_intentlib.py

@@ -239,18 +239,18 @@ def main(argv):
             from _artifactlib import resolve_spec_file, helper_installation
             client, entry = resolve_spec_file(positional[0], helper_installation(__file__))
             result = client.call("validate", {"artifact_id": entry["artifact_id"], "gate": "ready"}, permit_invalid=True)
-            # Native success uses null for an empty diagnostic slice. Normalize
-            # only that documented absence, never arbitrary falsey malformed data.
             if (result.get("artifact_id") != entry["artifact_id"]
                     or result.get("gate") != "ready"
                     or type(result.get("valid")) is not bool
-                    or not re.fullmatch(r"[0-9a-f]{64}", result.get("model_sha256", ""))):
+                    or not isinstance(result.get("model_sha256"), str)
+                    or not re.fullmatch(r"[0-9a-f]{64}", result["model_sha256"])
+                    or "diagnostics" not in result):
                 raise RuntimeError("malformed HTML validation result")
             diagnostics = result.get("diagnostics")
             if diagnostics is None:
                 diagnostics = []
             if not isinstance(diagnostics, list):
-                raise RuntimeError("HTML validation diagnostics must be a list or null")
+                raise ValueError("HTML validation diagnostics must be a list or null")
             findings = []
             for item in diagnostics:
                 if (not isinstance(item, dict)
@@ -272,7 +272,7 @@ def main(argv):
                         findings.append("[UNCOVERED-CHECKBOX] " + box)
             fresh = client.call("identity", {"artifact_id": entry["artifact_id"]})
             if (fresh.get("artifact_id") != entry["artifact_id"]
-                    or fresh["model_sha256"] != result["model_sha256"]):
+                    or fresh.get("model_sha256") != result["model_sha256"]):
                 raise RuntimeError("HTML spec changed during intent verification; retry a fresh read")
             for finding in findings:
                 print(finding)

package/plugins/ca-pi/hooks/_protectedlib.py

@@ -218,7 +218,7 @@ def is_marker_path(rel):
     return bool(MARKERS_RE.search(norm_path(rel)))
 
 
-def is_registered_state_path(rel):
+def is_registered_state_path(rel, root=None):
     """True iff `rel` carries a policy in the protected-state registry
     (`_protectedstatelib.lookup_policy`, B1/#564) — the fifth protected class
     `classify_protected` recognizes (T-05a), evaluated strictly AFTER the
@@ -253,7 +253,7 @@ def is_registered_state_path(rel):
     It is a local import, not file I/O or a git call, so it does not violate
     this module's zero-side-effects-at-import invariant."""
     import _protectedstatelib
-    return _protectedstatelib.lookup_policy(rel) is not None
+    return _protectedstatelib.lookup_policy(rel, root=root) is not None
 
 
 def classify_protected(fpath, root):
@@ -315,7 +315,7 @@ def classify_protected(fpath, root):
     for p in (raw_repo_rel(fpath, root), repo_rel(fpath, root)):
         if not p:
             continue
-        if is_registered_state_path(p):
+        if is_registered_state_path(p, root):
             hits.add("state")
             break
     return hits

package/plugins/ca-pi/hooks/_protectedstatelib.py

@@ -120,6 +120,9 @@
 from __future__ import annotations
 
 import os
+import posixpath
+import re
+import stat
 from enum import Enum
 
 from _hooklib import MARKER_FRESHNESS_MINUTES, marker_fresh
@@ -211,6 +214,150 @@ REGISTRY: dict[str, ProtectedPolicy] = {
 }
 
 
+def context_writer_protection() -> dict[str, ProtectedPolicy]:
+    """Return context candidates only after a fresh shipped-writer check.
+
+    Called only while resolving a context target, never at module import.
+    """
+    import _artifactlib
+
+    if not _artifactlib.context_writer_qualified():
+        return {}
+    return {path: ProtectedPolicy.HELPER_ONLY
+            for path in _artifactlib._CONTEXT_TARGETS.values()}
+
+
+def _committed_context_journal(root, document_id, target):
+    """Find the native writer's durable two-target commit, with bounded reads.
+
+    None means the journal inventory is uncertain: protect context paths until
+    it is reconciled. An empty or absent directory is not enrollment.
+    """
+    import _artifactlib
+
+    directory = os.path.join(root, ".codearbiter", ".artifacts", "transactions")
+    for parent in (os.path.join(root, ".codearbiter"),
+                   os.path.join(root, ".codearbiter", ".artifacts"), directory):
+        if os.path.islink(parent):
+            return None
+    if not os.path.lexists(directory):
+        return False
+    if not os.path.isdir(directory):
+        return None
+    try:
+        entries = []
+        with os.scandir(directory) as scan:
+            for entry in scan:
+                entries.append(entry)
+                if len(entries) > 1024:
+                    return None
+        total_bytes = 0
+        for entry in entries:
+            if entry.name.endswith(".next"):
+                continue
+            if (not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{7,79}\.json", entry.name)
+                    or not entry.is_file(follow_symlinks=False)):
+                return None
+            descriptor = _artifactlib._open_pinned_regular(entry.path)
+            try:
+                info = os.fstat(descriptor)
+                total_bytes += info.st_size
+                if (info.st_size > 65536 or info.st_size <= 0 or total_bytes > 8 << 20
+                        or not stat.S_ISREG(info.st_mode)
+                        or getattr(info, "st_file_attributes", 0) &
+                        getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0)):
+                    return None
+                raw = os.read(descriptor, 65537)
+            finally:
+                os.close(descriptor)
+            journal = _artifactlib._decode(raw)
+            if not isinstance(journal, dict):
+                return None
+            historical = journal.get("format") == "codearbiter.transaction/0.1.0"
+            if (journal.get("format") not in {"codearbiter.transaction/0.1.0",
+                                               "codearbiter.transaction/0.2.0"}
+                    or set(journal) != ({"format", "operation_id", "request_sha256",
+                                         "state", "entries"} if historical else
+                                        {"format", "operation_id", "request_sha256",
+                                         "state", "entries", "result"})
+                    or journal.get("operation_id") != entry.name[:-5]
+                    or not isinstance(journal.get("request_sha256"), str)
+                    or re.fullmatch(r"[0-9a-f]{64}", journal["request_sha256"]) is None
+                    or journal.get("state") not in {"prepared", "committed", "rolled_back"}):
+                return None
+            rows = journal.get("entries")
+            if (not isinstance(rows, list) or not 1 <= len(rows) <= 128
+                    or any(not isinstance(row, dict)
+                           or set(row) != {"path", "stage", "backup", "before_sha256",
+                                              "after_sha256", "size"}
+                           or not isinstance(row["path"], str)
+                           or not row["path"] or row["path"].startswith("/")
+                           or posixpath.normpath(row["path"]) != row["path"]
+                           or any(part in {"", ".", ".."} or part.endswith((".", " "))
+                                  or re.fullmatch(
+                                      r"(?i)(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\..*)?",
+                                      part) is not None
+                                  for part in row["path"].split("/"))
+                           or any(char in row["path"] for char in '\\:*?<>|"')
+                           or any(ord(char) < 32 or ord(char) == 127 for char in row["path"])
+                           or not isinstance(row["after_sha256"], str)
+                           or re.fullmatch(r"[0-9a-f]{64}", row["after_sha256"]) is None
+                           or (row["before_sha256"] is not None and
+                               (not isinstance(row["before_sha256"], str) or
+                                re.fullmatch(r"[0-9a-f]{64}", row["before_sha256"]) is None))
+                           or type(row["size"]) is not int or not 0 <= row["size"] <= 8 << 20
+                           or row["stage"] !=
+                           f"{os.path.dirname(row['path'])}/.ca-artifact-{journal['operation_id']}-{i}.new"
+                           or row["backup"] !=
+                           f".codearbiter/.artifacts/history/{journal['operation_id']}-{i}.before"
+                           for i, row in enumerate(rows))):
+                return None
+            paths = [row["path"] for row in rows]
+            if historical:
+                if target in paths:
+                    return None
+                continue
+            result = journal.get("result")
+            if not isinstance(result, dict):
+                if target in paths:
+                    return None
+                continue
+            if result.get("document_id") != document_id or result.get("target_path") != target:
+                if target in paths:
+                    return None
+                continue
+            if (set(result) != {"document_id", "target_path", "document_sha256",
+                                "provenance_sha256", "mode"}
+                    or result["mode"] not in {"create", "adopt", "update"}
+                    or len(rows) != 2
+                    or paths !=
+                    [target, f".codearbiter/.provenance/{document_id}.json"]
+                    or rows[0].get("after_sha256") != result["document_sha256"]
+                    or rows[1].get("after_sha256") != result["provenance_sha256"]):
+                return None
+            if journal.get("state") == "committed":
+                return True
+            if journal.get("state") == "prepared":
+                return None
+        return False
+    except (OSError, ValueError, _artifactlib.ArtifactError):
+        return None
+
+
+def _context_policy(rel_path, root):
+    import _artifactlib
+
+    document_id = next((doc for doc, target in _artifactlib._CONTEXT_TARGETS.items()
+                        if _canon(target) == _canon(rel_path)), None)
+    if document_id is None:
+        return None
+    target = _artifactlib._CONTEXT_TARGETS[document_id]
+    enrolled = _committed_context_journal(root, document_id, target)
+    if enrolled is not False:
+        return ProtectedPolicy.HELPER_ONLY
+    return context_writer_protection().get(target)
+
+
 def _canon(rel_path):
     """Canonical comparison form of a repo-relative path: separator-
     normalized (`norm_path`), then whitespace-stripped, `./`-prefix-
@@ -263,7 +410,7 @@ def _canon(rel_path):
     return p.lower()
 
 
-def lookup_policy(rel_path, registry=None):
+def lookup_policy(rel_path, registry=None, *, root=None):
     """The ProtectedPolicy registered for `rel_path`, or None if it carries
     no policy. Both `rel_path` and every registry key are canonicalized
     (`_canon`, above) before comparison — separator-normalized, `./`/
@@ -284,12 +431,15 @@ def lookup_policy(rel_path, registry=None):
     and realpath-resolved forms of a path - a flank that calls
     `lookup_policy` directly with its own ad hoc dict re-opens the symlink
     alias this module does not itself guard against."""
+    dynamic = registry is None and root is not None
     if registry is None:
         registry = REGISTRY
     normalized = _canon(rel_path)
     for key, policy in registry.items():
         if _canon(key) == normalized:
             return policy
+    if dynamic:
+        return _context_policy(rel_path, root)
     return None
 
 
@@ -341,7 +491,7 @@ def resolve_registered_path(fpath, root, registry=None):
     for p in (raw_repo_rel(fpath, root), repo_rel(fpath, root)):
         if not p:
             continue
-        policy = lookup_policy(p, registry)
+        policy = lookup_policy(p, registry, root=root)
         if policy is not None:
             return p, policy
     return None, None