@arbiterforge/ca-pi 0.17.2 → 0.17.4

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.25.2" src="https://img.shields.io/badge/version-2.25.2-2b7489">
+<img alt="version 2.25.3" src="https://img.shields.io/badge/version-2.25.3-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">
@@ -183,7 +183,7 @@ Replace `<version>` with the numeric suffix from the chosen tag while retaining
 it is a partial install that cannot author typed HTML specs and plans; use the npm channel for
 that.
 
-Pi 1.0.2 is the supported host for this release line. Generated aliases use `/ca-*`;
+Pi 1.1.0 is the supported host for this release line. Generated aliases use `/ca-*`;
 `/skill:ca-*` is the host-native fallback. Every `ca-pi-v*` tag is also published to npm as
 `npm:@arbiterforge/ca-pi` with provenance (ADR-0029); the pinned Git tag remains the reproducible
 install. The [Pi runbook](./docs/pi-parity-testing.md) covers isolated install, trust, verification,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.17.4] - 2026-10-09
+
+### Changed
+
+- Promote the verified Pi host window through exact Pi 1.1.0.
+
+### Fixed
+
+- Accept Pi 1.1.0 execution timing fields and settlement outcomes without treating aborted child work as successful.
+- Recognize Pi's renamed Azure provider while retaining parent-only provider credentials.
+
+## [0.17.3] - 2026-10-09
+
+### Fixed
+
+- Keep managed Git hooks working with a restricted PATH while preserving
+  trusted executable identities, cross-host path resolution and stale-registration checks.
+
 ## [0.17.2] - 2026-10-08
 
 ### Fixed

package/plugins/ca-pi/extensions/codearbiter-child.js

@@ -629,7 +629,7 @@ function resolvePythonCommand(platform = process.platform, probe = systemPythonP
 }
 
 // src/compatibility.ts
-var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["1.0.2"]);
+var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["1.1.0"]);
 var MINIMUM_NODE = [22, 19, 0];
 var SEMVER_PREFIX = /^(\d+)\.(\d+)\.(\d+)(?:$|[-+])/u;
 function atLeast(version, minimum) {
@@ -644,7 +644,7 @@ function atLeast(version, minimum) {
 }
 function compatibilityDirection(input) {
   if (!SUPPORTED_PI_VERSIONS.has(input.piVersion)) {
-    return "codeArbiter requires Pi 1.0.2; install a supported Pi version and run /ca-doctor.";
+    return "codeArbiter requires Pi 1.1.0; install a supported Pi version and run /ca-doctor.";
   }
   if (!atLeast(input.nodeVersion, MINIMUM_NODE)) {
     return "codeArbiter requires Node >=22.19.0 for Pi; upgrade Node and run /ca-doctor.";

package/plugins/ca-pi/extensions/codearbiter.js

@@ -2,7 +2,7 @@
 var define_CODEARBITER_PI_PERMISSION_POLICY_SURFACES_default = { "ca-plan": "planning-write", codearbiter_background_bash: "background-launch" };
 
 // <define:__CODEARBITER_PI_SKILL_EXPANSION_FINGERPRINTS__>
-var define_CODEARBITER_PI_SKILL_EXPANSION_FINGERPRINTS_default = { "1.0.2": "12632f365440b07d5183cff871d889b796a3c711b6b49df20f95d9bc198d6c51" };
+var define_CODEARBITER_PI_SKILL_EXPANSION_FINGERPRINTS_default = { "1.1.0": "12632f365440b07d5183cff871d889b796a3c711b6b49df20f95d9bc198d6c51" };
 
 // <define:__CODEARBITER_PI_TOOL_CLASSES__>
 var define_CODEARBITER_PI_TOOL_CLASSES_default = { bash: "EXEC", codearbiter_background_bash: "EXEC", codearbiter_dispatch: "EXEC", codearbiter_farm_preview: "EXEC", write: "WRITE", edit: "EDIT", read: "READ" };
@@ -16,7 +16,7 @@ import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from
 import { types as utilTypes9 } from "node:util";
 
 // src/compatibility.ts
-var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["1.0.2"]);
+var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["1.1.0"]);
 var MINIMUM_NODE = [22, 19, 0];
 var SEMVER_PREFIX = /^(\d+)\.(\d+)\.(\d+)(?:$|[-+])/u;
 function atLeast(version, minimum) {
@@ -31,7 +31,7 @@ function atLeast(version, minimum) {
 }
 function compatibilityDirection(input) {
   if (!SUPPORTED_PI_VERSIONS.has(input.piVersion)) {
-    return "codeArbiter requires Pi 1.0.2; install a supported Pi version and run /ca-doctor.";
+    return "codeArbiter requires Pi 1.1.0; install a supported Pi version and run /ca-doctor.";
   }
   if (!atLeast(input.nodeVersion, MINIMUM_NODE)) {
     return "codeArbiter requires Node >=22.19.0 for Pi; upgrade Node and run /ca-doctor.";
@@ -6881,10 +6881,10 @@ async function collectPiDoctorInput(dependencies) {
 var REMEDIATION = {
   package: "Reinstall ca-pi from the approved pinned Git tag, then restart Pi.",
   trust: "Run /trust in Pi, inspect the project, grant trust only if you accept it, then start a new session.",
-  version: "Upgrade Pi to 1.0.2 and Node to >=22.19.0, then restart Pi.",
+  version: "Upgrade Pi to 1.1.0 and Node to >=22.19.0, then restart Pi.",
   python: "Upgrade or install Python 3, then run /ca-doctor again.",
   core: "Reinstall ca-pi to restore the generated shared core, then run /ca-doctor again.",
-  commands: "Remove conflicting command owners or run Pi 1.0.2, then restart Pi and run /ca-doctor.",
+  commands: "Remove conflicting command owners or run Pi 1.1.0, then restart Pi and run /ca-doctor.",
   bridge: "Reinstall ca-pi and Python 3, then run /ca-doctor again.",
   child: "Reinstall ca-pi if the hardened child artifact is missing or tampered, then run /ca-doctor again.",
   "ambient-marker": "Remove CODEARBITER_SUBAGENT from the parent environment and restart Pi.",
@@ -6913,7 +6913,7 @@ function diagnosePi(input) {
   const packageHealthy = input.package.declared && input.package.name === "@arbiterforge/ca-pi" && existsSync(input.package.root) && existsSync(input.package.extensionPath) && samePath2(input.package.extensionPath, expectedExtension) && canonicallyInside(input.package.extensionPath, input.package.root);
   const trustHealthy = input.trust.inspected && (!input.trust.required || input.trust.projectTrusted);
   const waitingForTrust = input.trust.required && !input.trust.projectTrusted;
-  const versionHealthy = input.runtime.piVersion === "1.0.2" && atLeast(input.runtime.nodeVersion, [22, 19, 0]);
+  const versionHealthy = input.runtime.piVersion === "1.1.0" && atLeast(input.runtime.nodeVersion, [22, 19, 0]);
   const piBelowMinimum = !atLeast(input.runtime.piVersion, [0, 80, 5]);
   const supportedExpansion = input.commands.expansionVerifiedVersions.includes(input.runtime.piVersion);
   const expectedDoctorSkill = resolve9(input.package.root, "skills", "ca-doctor", "SKILL.md");
@@ -7034,7 +7034,7 @@ function diagnosePi(input) {
     {
       id: "active-dispatch",
       state: "degraded",
-      message: "Supported Pi 1.0.2 public extension APIs cannot submit this deterministic self-test through the active dispatcher; the wrapper self-test does not exercise active dispatch.",
+      message: "Supported Pi 1.1.0 public extension APIs cannot submit this deterministic self-test through the active dispatcher; the wrapper self-test does not exercise active dispatch.",
       remediation: REMEDIATION["active-dispatch"]
     }
   ];
@@ -7806,6 +7806,7 @@ var PI_PROVIDER_ENV = Object.freeze({
   "amazon-bedrock": ["AWS_PROFILE", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_BEARER_TOKEN_BEDROCK", "AWS_REGION"],
   "ant-ling": ["ANT_LING_API_KEY"],
   anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
+  azure: ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_BASE_URL", "AZURE_OPENAI_RESOURCE_NAME", "AZURE_OPENAI_API_VERSION", "AZURE_OPENAI_DEPLOYMENT_NAME_MAP"],
   "azure-openai-responses": ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_BASE_URL", "AZURE_OPENAI_RESOURCE_NAME", "AZURE_OPENAI_API_VERSION", "AZURE_OPENAI_DEPLOYMENT_NAME_MAP"],
   cerebras: ["CEREBRAS_API_KEY"],
   "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY", "CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_GATEWAY_ID"],
@@ -8351,16 +8352,16 @@ function validMessage(value) {
   if (value.role === "assistant") {
     return exactKeys4(
       value,
-      ["role", "content", "api", "provider", "model", "responseModel", "responseId", "providerThinkingLevel", "thinkingLevel", "diagnostics", "usage", "stopReason", "errorMessage", "rawStopReason", "deferred", "endTurn", "timestamp"],
+      ["role", "content", "api", "provider", "model", "responseModel", "responseId", "providerThinkingLevel", "thinkingLevel", "diagnostics", "usage", "stopReason", "errorMessage", "rawStopReason", "deferred", "endTurn", "timestamp", "durationMs"],
       ["role", "content", "api", "provider", "model", "usage", "stopReason", "timestamp"]
-    ) && validContent(value.content, "assistant") && ["api", "provider", "model", "stopReason"].every((key) => typeof value[key] === "string") && (value.responseModel === void 0 || boundedString2(value.responseModel)) && (value.responseId === void 0 || boundedString2(value.responseId)) && (value.errorMessage === void 0 || boundedString2(value.errorMessage)) && (value.rawStopReason === void 0 || boundedString2(value.rawStopReason)) && (value.providerThinkingLevel === void 0 || boundedString2(value.providerThinkingLevel)) && (value.thinkingLevel === void 0 || boundedString2(value.thinkingLevel)) && (value.endTurn === void 0 || typeof value.endTurn === "boolean") && (value.deferred === void 0 || validDeferredHandle(value.deferred)) && (value.diagnostics === void 0 || Array.isArray(value.diagnostics) && value.diagnostics.length <= MAX_JSON_ARRAY && value.diagnostics.every(validDiagnostic)) && validUsage(value.usage) && typeof value.timestamp === "number" && Number.isFinite(value.timestamp);
+    ) && validContent(value.content, "assistant") && ["api", "provider", "model", "stopReason"].every((key) => typeof value[key] === "string") && (value.responseModel === void 0 || boundedString2(value.responseModel)) && (value.responseId === void 0 || boundedString2(value.responseId)) && (value.errorMessage === void 0 || boundedString2(value.errorMessage)) && (value.rawStopReason === void 0 || boundedString2(value.rawStopReason)) && (value.providerThinkingLevel === void 0 || boundedString2(value.providerThinkingLevel)) && (value.thinkingLevel === void 0 || boundedString2(value.thinkingLevel)) && (value.endTurn === void 0 || typeof value.endTurn === "boolean") && (value.durationMs === void 0 || typeof value.durationMs === "number" && Number.isFinite(value.durationMs) && value.durationMs >= 0) && (value.deferred === void 0 || validDeferredHandle(value.deferred)) && (value.diagnostics === void 0 || Array.isArray(value.diagnostics) && value.diagnostics.length <= MAX_JSON_ARRAY && value.diagnostics.every(validDiagnostic)) && validUsage(value.usage) && typeof value.timestamp === "number" && Number.isFinite(value.timestamp);
   }
   if (value.role === "toolResult") {
     return exactKeys4(
       value,
-      ["role", "toolCallId", "toolName", "content", "details", "isError", "usage", "nestedCalls", "timestamp"],
+      ["role", "toolCallId", "toolName", "content", "details", "isError", "usage", "nestedCalls", "timestamp", "durationMs"],
       ["role", "toolCallId", "toolName", "content", "isError", "timestamp"]
-    ) && typeof value.toolCallId === "string" && typeof value.toolName === "string" && validContent(value.content, "toolResult") && (value.details === void 0 || validOpaqueJson(value.details)) && (value.usage === void 0 || validUsage(value.usage)) && (value.nestedCalls === void 0 || validNestedCalls(value.nestedCalls)) && typeof value.isError === "boolean" && typeof value.timestamp === "number" && Number.isFinite(value.timestamp);
+    ) && typeof value.toolCallId === "string" && typeof value.toolName === "string" && validContent(value.content, "toolResult") && (value.details === void 0 || validOpaqueJson(value.details)) && (value.usage === void 0 || validUsage(value.usage)) && (value.nestedCalls === void 0 || validNestedCalls(value.nestedCalls)) && (value.durationMs === void 0 || typeof value.durationMs === "number" && Number.isFinite(value.durationMs) && value.durationMs >= 0) && typeof value.isError === "boolean" && typeof value.timestamp === "number" && Number.isFinite(value.timestamp);
   }
   return false;
 }
@@ -8449,10 +8450,12 @@ function parseChildJsonLine(line) {
       } else if (!exactKeys4(record2, ["type", "id", "command", "success", "error"]) || typeof record2.error !== "string") invalidProtocol();
       break;
     case "agent_start":
-    case "agent_settled":
     case "turn_start":
       if (!exactKeys4(record2, ["type"])) invalidProtocol();
       break;
+    case "agent_settled":
+      if (!exactKeys4(record2, ["type", "aborted"]) || typeof record2.aborted !== "boolean") invalidProtocol();
+      break;
     case "agent_end":
       if (!exactKeys4(record2, ["type", "messages", "willRetry"]) || !Array.isArray(record2.messages) || record2.messages.length > MAX_JSON_ARRAY || !record2.messages.every(validMessage) || typeof record2.willRetry !== "boolean") invalidProtocol();
       break;
@@ -8473,7 +8476,7 @@ function parseChildJsonLine(line) {
       if (!exactKeys4(record2, ["type", "toolCallId", "toolName", "args", "partialResult", "parentToolCallId"], ["type", "toolCallId", "toolName", "args", "partialResult"]) || record2.parentToolCallId !== void 0 && !boundedString2(record2.parentToolCallId) || typeof record2.toolCallId !== "string" || typeof record2.toolName !== "string" || !validOpaqueJson(record2.args) || !validOpaqueJson(record2.partialResult)) invalidProtocol();
       break;
     case "tool_execution_end":
-      if (!exactKeys4(record2, ["type", "toolCallId", "toolName", "result", "isError", "parentToolCallId"], ["type", "toolCallId", "toolName", "result", "isError"]) || record2.parentToolCallId !== void 0 && !boundedString2(record2.parentToolCallId) || typeof record2.toolCallId !== "string" || typeof record2.toolName !== "string" || !validOpaqueJson(record2.result) || typeof record2.isError !== "boolean") invalidProtocol();
+      if (!exactKeys4(record2, ["type", "toolCallId", "toolName", "result", "isError", "parentToolCallId", "durationMs"], ["type", "toolCallId", "toolName", "result", "isError"]) || record2.parentToolCallId !== void 0 && !boundedString2(record2.parentToolCallId) || record2.durationMs !== void 0 && (typeof record2.durationMs !== "number" || !Number.isFinite(record2.durationMs) || record2.durationMs < 0) || typeof record2.toolCallId !== "string" || typeof record2.toolName !== "string" || !validOpaqueJson(record2.result) || typeof record2.isError !== "boolean") invalidProtocol();
       break;
     case "extension_error":
       if (!exactKeys4(record2, ["type", "extensionPath", "event", "error"]) || typeof record2.extensionPath !== "string" || typeof record2.event !== "string" || typeof record2.error !== "string") invalidProtocol();
@@ -8773,6 +8776,10 @@ async function runPiChild(request, signal) {
             finishFailure("protocol_error");
             return;
           }
+          if (record2.aborted === true) {
+            finishFailure("cancelled");
+            return;
+          }
           phase = "complete";
           endInput();
         } else {
@@ -10598,7 +10605,7 @@ async function codeArbiterPi(pi) {
         activeTools: pi.getActiveTools(),
         allTools: pi.getAllTools(),
         expansionFingerprints,
-        childFingerprint: "cc75f11e8eb1df2ab70c4ae0d8c510c61fcf178d905db29a734842d8c5905752"
+        childFingerprint: "98a945a0d55cc25f75a50bbe7c94cbea192b81f3db44fd9b3133d977a2973430"
       });
       const wrapperSelfTest = await runPiWrapperSelfTest({
         enabled: enabledForDoctor,

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -37,11 +37,11 @@
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37938394077",
       "binary_sha256": "433780fa59913512346069f9e1891e306a8bec41ed6fcc7cd26b50748d03ae06",
-      "observation_sha256": "b33c522a6fd07896b7a3a97a024e534c3039ad1e5d615e83745dba051d5f65f6",
+      "observation_sha256": "017903dc1173484279e8029e5edee028cd81d1eb71c60e706b0476d7ea1d0e42",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -53,11 +53,11 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37938394077",
       "binary_sha256": "b68192c7a1da2cd2f9031f71ab4c7e015673f060d6bfdfa3aa4b57d9f090bf34",
-      "observation_sha256": "e6fb8c16b74f1a058fa48fc3d68bda8e867b9bbe8219c8f527159c154dd56a4c",
+      "observation_sha256": "28682b5ece3e695125587ff8578d22ce5ccd75f6643f626b64246bc7dd664716",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -69,11 +69,11 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37938394077",
       "binary_sha256": "09582eabdef3f828a12de21b85ccc7b52a188651c2a4f69f3f776a2e62c86036",
-      "observation_sha256": "da082cbcf35fd28bb0fbd2d699c8e895e1e65e38c0331f22473620582711cc3e",
+      "observation_sha256": "0782dc40b8b03584b6f048204234fbf3896e0ee33ebfb52da4b72237d18679a6",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -85,11 +85,11 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37938394077",
       "binary_sha256": "f7699ce8f2f07200ea8508f21a6d369506443392aa8897d84e9d5e7dd6469770",
-      "observation_sha256": "71d41defe020a403fd6fe890587a18daf11a7a520fa24e7667447d4fbaca133c",
+      "observation_sha256": "451808d71946bed78727672d0c8ed94903eb9179a3907dd86248c1885eb7b094",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -101,11 +101,11 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37938394077",
       "binary_sha256": "9a0f186e2a1bcfd92c8f9db5cb0aa2f6dfb128dd6f0dad2708a78596f0364e16",
-      "observation_sha256": "c718eff474fc9860fc58ab130ac833c5cc87107ba3e6603b648f9252bd5bad63",
+      "observation_sha256": "336b9ea6f4b53b2aaa98cf5ee47f7d2792e2ece09eaafef8f37b0ae51c222275",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",
@@ -117,11 +117,11 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "fc35117016f47de4bbfc15195057cf57c30a8a4a",
+      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37873082145",
+      "run_id": "37938394077",
       "binary_sha256": "3f1bc7d00f9488b4a4a9f21e5ca414fd5c97031ad7b1c2b52c02f5d7f2956e3a",
-      "observation_sha256": "78f6ccf77cf840641372bf17481dc1dd6a0aa5062811455e3fd6be9a6bfa85d6",
+      "observation_sha256": "817414c35d85c544d9554544af86fc14aa11f866f0df0f6fe28f64adda5bfe1a",
       "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
       "native_cases": [
         "TestContextBoundedRender",

package/plugins/ca-pi/hooks/_githooks.py

@@ -349,13 +349,23 @@ def _resolve_live_dir(path):
 # semantics like `_path_form_candidates` on POSIX -- embedded verbatim into
 # every generated shim so the REAL git-hook execution path (not just Python
 # diagnostics) resolves a foreign-but-translatable spelling instead of
-# failing closed on it. Pure POSIX sh (`case`, `cut`, `tr`, parameter
-# expansion) -- no extra process spawn beyond the cheap utilities already
-# used elsewhere in this shim. Prints the resolved path and returns 0 on the
+# failing closed on it. POSIX shell builtins only: the trusted-identity path
+# must also work when PATH contains no trusted utilities (ADR-0015).
+# Prints the resolved path and returns 0 on the
 # first candidate that exists; returns 1 with nothing printed when NONE of
 # the (as-is, plus up to two translated) candidates resolves -- callers must
 # treat that as "does not exist," preserving ADR-0014's fail-closed contract.
+_CX_DRIVE_CASE_SH = "".join(
+    f"    {letter.lower()}|{letter}) DRL={letter.lower()}; DRU={letter} ;;\n"
+    for letter in "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+)
 _CX_RESOLVE_SH = (
+    "_cx_drive_case() {\n"
+    '  case "$1" in\n'
+    f"{_CX_DRIVE_CASE_SH}"
+    "    *) return 1 ;;\n"
+    "  esac\n"
+    "}\n"
     "_cx_resolve() {\n"
     "  P=$1\n"
     "  K=-f\n"
@@ -364,17 +374,15 @@ _CX_RESOLVE_SH = (
     "    /mnt/[A-Za-z]/*)\n"
     '      [ "$K" "$P" ] && { printf \'%s\' "$P"; return 0; }\n'
     '      REST=${P#/mnt/?/}\n'
-    '      DR=$(printf \'%s\' "$P" | cut -c6)\n'
-    '      DRL=$(printf \'%s\' "$DR" | tr \'A-Z\' \'a-z\')\n'
-    '      DRU=$(printf \'%s\' "$DR" | tr \'a-z\' \'A-Z\')\n'
+    '      DR=${P#/mnt/}; DR=${DR%%/*}\n'
+    '      _cx_drive_case "$DR" || return 1\n'
     '      A1="/$DRL/$REST"; A2="$DRU:/$REST"\n'
     "      ;;\n"
     "    /[A-Za-z]/*)\n"
     '      [ "$K" "$P" ] && { printf \'%s\' "$P"; return 0; }\n'
     '      REST=${P#/?/}\n'
-    '      DR=$(printf \'%s\' "$P" | cut -c2)\n'
-    '      DRL=$(printf \'%s\' "$DR" | tr \'A-Z\' \'a-z\')\n'
-    '      DRU=$(printf \'%s\' "$DR" | tr \'a-z\' \'A-Z\')\n'
+    '      DR=${P#/}; DR=${DR%%/*}\n'
+    '      _cx_drive_case "$DR" || return 1\n'
     '      A1="/mnt/$DRL/$REST"; A2="$DRU:/$REST"\n'
     "      ;;\n"
     "    [A-Za-z]:/*)\n"
@@ -387,7 +395,8 @@ _CX_RESOLVE_SH = (
     "      # Git-Bash resolves this same spelling too, but via A1 (\"/<drive>/\n"
     "      # ...\"), which Git-Bash ALSO resolves -- so nothing is lost by\n"
     "      # withholding the raw as-is test for this one grammar.\n"
-    '      DR=$(printf \'%s\' "$P" | cut -c1 | tr \'A-Z\' \'a-z\')\n'
+    '      DR=${P%%:*}\n'
+    '      _cx_drive_case "$DR" || return 1\n'
     "      # ??: (two wildcards, literal colon) never matches a drive-letter\n"
     "      # path like C:/... (its 3rd char is / , not the required literal\n"
     "      # ':'), so it left REST completely unstripped -- a confirmed\n"
@@ -396,7 +405,7 @@ _CX_RESOLVE_SH = (
     "      # correct 3-char match for this branch's own case pattern.\n"
     '      REST=${P#?:/}\n'
     '      REST=${REST#/}\n'
-    '      A1="/$DR/$REST"; A2="/mnt/$DR/$REST"\n'
+    '      A1="/$DRL/$REST"; A2="/mnt/$DRL/$REST"\n'
     "      ;;\n"
     "    *)\n"
     '      [ "$K" "$P" ] && { printf \'%s\' "$P"; return 0; }\n'
@@ -801,14 +810,15 @@ def _shim(dropin_dir, phase):
         f"{_FRESHNESS_PY}"
         "CODEARBITER_556_FRESHNESS\n"
         ")\n"
-        # Match each line from the probe, including native Windows CRLF output.
-        "SKIP=$(printf '%s' \"$SKIP\" | tr '\\r\\n' '  ')\n"
+        # Match whole LF/CRLF lines without executing a PATH-resolved utility.
+        "CR=$(printf '\\r')\n"
+        "NL='\n'\n"
         "SEEN=0\n"
         'for c in "$D"/*.path; do\n'
         '  [ -f "$c" ] || continue\n'
         '  N=${c##*/}\n'
         '  case "$N" in [0-9]*.[0-9]*.[0-9]*.path) continue ;; esac\n'
-        '  case " $SKIP " in *" ${N%.path} "*) continue ;; esac\n'
+        '  case "$NL$SKIP$NL" in *"$NL${N%.path}$NL"*|*"$NL${N%.path}$CR$NL"*) continue ;; esac\n'
         '  IFS= read -r E < "$c" || continue\n'
         '  E=$(_cx_resolve "$E") || continue\n'
         '  SEEN=1\n'

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.17.2"
+    adapter_version = "0.17.4"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.25.2"
+    adapter_version = "2.25.3"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/pi-host-notes.md

@@ -87,7 +87,7 @@ file maps those actions to Pi's extension API.
   operator-launched Pi CLI, imported module, package root, and reported version.
   It does not prove publisher authenticity. Verify the source separately with
   `pi list` and `pi config`.
-- The supported promotion target is exact Pi 1.0.2. The package is
+- The supported promotion target is exact Pi 1.1.0. The package is
   published as `npm:@arbiterforge/ca-pi` on every `ca-pi-v*` tag (ADR-0029);
   the pinned Git tag remains the reproducible install. A Pi-native embedded
   farm worker is a future spike, not an installed dependency.

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",

package/plugins/ca-pi/skills/ca-doctor/SKILL.md

@@ -32,7 +32,7 @@ repository binary, mutate an artifact, or silently fall back to Markdown.
    Pi bash wrapper. The exact shared-core `[H-03]` block is healthy and cannot stage files; execution
    or a different block is unhealthy. This self-test does not traverse Pi's active dispatcher. Do not
    rerun or respell it.
-4. Its `active-dispatch` row remains degraded because supported Pi 1.0.2 public extension
+4. Its `active-dispatch` row remains degraded because supported Pi 1.1.0 public extension
    APIs cannot submit that deterministic call through the active dispatcher. PI-AC-28 remains blocked
    until supported-version real-host promotion/CI evidence closes the gap.
 5. Resolve Python once, run `<plugin-root>/hooks/doctor.py`, and present its mechanical report