@arbiterforge/ca-pi 0.17.2 → 0.17.3

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.25.2" src="https://img.shields.io/badge/version-2.25.2-2b7489">
+<img alt="version 2.25.3" src="https://img.shields.io/badge/version-2.25.3-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.17.3] - 2026-10-09
+
+### Fixed
+
+- Keep managed Git hooks working with a restricted PATH while preserving
+  trusted executable identities, cross-host path resolution and stale-registration checks.
+
 ## [0.17.2] - 2026-10-08
 
 ### Fixed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -37,11 +37,11 @@
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "f5160861dbfde0b231d9fe557961bf3117ad7039",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37888003877",
       "binary_sha256": "433780fa59913512346069f9e1891e306a8bec41ed6fcc7cd26b50748d03ae06",
-      "observation_sha256": "b33c522a6fd07896b7a3a97a024e534c3039ad1e5d615e83745dba051d5f65f6",
+      "observation_sha256": "ca81998a6da2435635942bfaf8fb385c953f4879c7c9b42793060009182cfc76",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -53,11 +53,11 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "f5160861dbfde0b231d9fe557961bf3117ad7039",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37888003877",
       "binary_sha256": "b68192c7a1da2cd2f9031f71ab4c7e015673f060d6bfdfa3aa4b57d9f090bf34",
-      "observation_sha256": "e6fb8c16b74f1a058fa48fc3d68bda8e867b9bbe8219c8f527159c154dd56a4c",
+      "observation_sha256": "e35ee74a7b33dd195f2ae32a575cb9cffe5546367879d0ab81af59804f5115ed",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -69,11 +69,11 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "f5160861dbfde0b231d9fe557961bf3117ad7039",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37888003877",
       "binary_sha256": "09582eabdef3f828a12de21b85ccc7b52a188651c2a4f69f3f776a2e62c86036",
-      "observation_sha256": "da082cbcf35fd28bb0fbd2d699c8e895e1e65e38c0331f22473620582711cc3e",
+      "observation_sha256": "302266907f2ecc6ac4bc3db169d0ea119d76dedd3c286d0495caf073878ea817",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -85,11 +85,11 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "f5160861dbfde0b231d9fe557961bf3117ad7039",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37888003877",
       "binary_sha256": "f7699ce8f2f07200ea8508f21a6d369506443392aa8897d84e9d5e7dd6469770",
-      "observation_sha256": "71d41defe020a403fd6fe890587a18daf11a7a520fa24e7667447d4fbaca133c",
+      "observation_sha256": "3497e9d18b7a6b255119460a6fe41edffc08c27043c9d8805ea4d1cec6395f81",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -101,11 +101,11 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "f5160861dbfde0b231d9fe557961bf3117ad7039",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37888003877",
       "binary_sha256": "9a0f186e2a1bcfd92c8f9db5cb0aa2f6dfb128dd6f0dad2708a78596f0364e16",
-      "observation_sha256": "c718eff474fc9860fc58ab130ac833c5cc87107ba3e6603b648f9252bd5bad63",
+      "observation_sha256": "c3b9c4bd123596887b4d04b7d5b1f88e0dcdeaae51fc6f92ba4fe0d298039683",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -117,11 +117,11 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "f5160861dbfde0b231d9fe557961bf3117ad7039",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37888003877",
       "binary_sha256": "3f1bc7d00f9488b4a4a9f21e5ca414fd5c97031ad7b1c2b52c02f5d7f2956e3a",
-      "observation_sha256": "78f6ccf77cf840641372bf17481dc1dd6a0aa5062811455e3fd6be9a6bfa85d6",
+      "observation_sha256": "31a5b206eccbf6fd80916f7e4b6803d36d906e5171e43ee279373a619517f3ce",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",

package/plugins/ca-pi/hooks/_githooks.py

@@ -349,13 +349,23 @@ def _resolve_live_dir(path):
 # semantics like `_path_form_candidates` on POSIX -- embedded verbatim into
 # every generated shim so the REAL git-hook execution path (not just Python
 # diagnostics) resolves a foreign-but-translatable spelling instead of
-# failing closed on it. Pure POSIX sh (`case`, `cut`, `tr`, parameter
-# expansion) -- no extra process spawn beyond the cheap utilities already
-# used elsewhere in this shim. Prints the resolved path and returns 0 on the
+# failing closed on it. POSIX shell builtins only: the trusted-identity path
+# must also work when PATH contains no trusted utilities (ADR-0015).
+# Prints the resolved path and returns 0 on the
 # first candidate that exists; returns 1 with nothing printed when NONE of
 # the (as-is, plus up to two translated) candidates resolves -- callers must
 # treat that as "does not exist," preserving ADR-0014's fail-closed contract.
+_CX_DRIVE_CASE_SH = "".join(
+    f"    {letter.lower()}|{letter}) DRL={letter.lower()}; DRU={letter} ;;\n"
+    for letter in "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+)
 _CX_RESOLVE_SH = (
+    "_cx_drive_case() {\n"
+    '  case "$1" in\n'
+    f"{_CX_DRIVE_CASE_SH}"
+    "    *) return 1 ;;\n"
+    "  esac\n"
+    "}\n"
     "_cx_resolve() {\n"
     "  P=$1\n"
     "  K=-f\n"
@@ -364,17 +374,15 @@ _CX_RESOLVE_SH = (
     "    /mnt/[A-Za-z]/*)\n"
     '      [ "$K" "$P" ] && { printf \'%s\' "$P"; return 0; }\n'
     '      REST=${P#/mnt/?/}\n'
-    '      DR=$(printf \'%s\' "$P" | cut -c6)\n'
-    '      DRL=$(printf \'%s\' "$DR" | tr \'A-Z\' \'a-z\')\n'
-    '      DRU=$(printf \'%s\' "$DR" | tr \'a-z\' \'A-Z\')\n'
+    '      DR=${P#/mnt/}; DR=${DR%%/*}\n'
+    '      _cx_drive_case "$DR" || return 1\n'
     '      A1="/$DRL/$REST"; A2="$DRU:/$REST"\n'
     "      ;;\n"
     "    /[A-Za-z]/*)\n"
     '      [ "$K" "$P" ] && { printf \'%s\' "$P"; return 0; }\n'
     '      REST=${P#/?/}\n'
-    '      DR=$(printf \'%s\' "$P" | cut -c2)\n'
-    '      DRL=$(printf \'%s\' "$DR" | tr \'A-Z\' \'a-z\')\n'
-    '      DRU=$(printf \'%s\' "$DR" | tr \'a-z\' \'A-Z\')\n'
+    '      DR=${P#/}; DR=${DR%%/*}\n'
+    '      _cx_drive_case "$DR" || return 1\n'
     '      A1="/mnt/$DRL/$REST"; A2="$DRU:/$REST"\n'
     "      ;;\n"
     "    [A-Za-z]:/*)\n"
@@ -387,7 +395,8 @@ _CX_RESOLVE_SH = (
     "      # Git-Bash resolves this same spelling too, but via A1 (\"/<drive>/\n"
     "      # ...\"), which Git-Bash ALSO resolves -- so nothing is lost by\n"
     "      # withholding the raw as-is test for this one grammar.\n"
-    '      DR=$(printf \'%s\' "$P" | cut -c1 | tr \'A-Z\' \'a-z\')\n'
+    '      DR=${P%%:*}\n'
+    '      _cx_drive_case "$DR" || return 1\n'
     "      # ??: (two wildcards, literal colon) never matches a drive-letter\n"
     "      # path like C:/... (its 3rd char is / , not the required literal\n"
     "      # ':'), so it left REST completely unstripped -- a confirmed\n"
@@ -396,7 +405,7 @@ _CX_RESOLVE_SH = (
     "      # correct 3-char match for this branch's own case pattern.\n"
     '      REST=${P#?:/}\n'
     '      REST=${REST#/}\n'
-    '      A1="/$DR/$REST"; A2="/mnt/$DR/$REST"\n'
+    '      A1="/$DRL/$REST"; A2="/mnt/$DRL/$REST"\n'
     "      ;;\n"
     "    *)\n"
     '      [ "$K" "$P" ] && { printf \'%s\' "$P"; return 0; }\n'
@@ -801,14 +810,15 @@ def _shim(dropin_dir, phase):
         f"{_FRESHNESS_PY}"
         "CODEARBITER_556_FRESHNESS\n"
         ")\n"
-        # Match each line from the probe, including native Windows CRLF output.
-        "SKIP=$(printf '%s' \"$SKIP\" | tr '\\r\\n' '  ')\n"
+        # Match whole LF/CRLF lines without executing a PATH-resolved utility.
+        "CR=$(printf '\\r')\n"
+        "NL='\n'\n"
         "SEEN=0\n"
         'for c in "$D"/*.path; do\n'
         '  [ -f "$c" ] || continue\n'
         '  N=${c##*/}\n'
         '  case "$N" in [0-9]*.[0-9]*.[0-9]*.path) continue ;; esac\n'
-        '  case " $SKIP " in *" ${N%.path} "*) continue ;; esac\n'
+        '  case "$NL$SKIP$NL" in *"$NL${N%.path}$NL"*|*"$NL${N%.path}$CR$NL"*) continue ;; esac\n'
         '  IFS= read -r E < "$c" || continue\n'
         '  E=$(_cx_resolve "$E") || continue\n'
         '  SEEN=1\n'

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.17.2"
+    adapter_version = "0.17.3"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.25.2"
+    adapter_version = "2.25.3"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",