@arbiterforge/ca-pi 0.21.2 → 0.21.4

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 3.2.2" src="https://img.shields.io/badge/version-3.2.2-2b7489">
+<img alt="version 3.2.4" src="https://img.shields.io/badge/version-3.2.4-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.2",
+  "version": "0.21.4",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.21.4] - 2026-10-19
+
+### Fixed
+
+- On Windows the artifact bridge read its binary's architecture through `platform.machine()`, which asks WMI and then the `PROCESSOR_*` environment variables. A read-only sandbox can block WMI and strip that environment, so reads failed with `UNSUPPORTED_PLATFORM: unsupported architecture`. The bridge now asks the kernel (`IsWow64Process2`) for the native machine, consults no environment, and still fails closed when the OS gives no answer (#986).
+
+## [0.21.3] - 2026-10-19
+
+### Fixed
+
+- Evidence snapshots open each bound farm projection once, from the walk's own read, and no longer list directories ahead of the walk when farm bindings exist. A stale binding no longer opens its projection twice (#962).
+- A snapshot re-checks a cached directory anchor against its parent's current entry each time it reuses it, and caps the anchor cache at 512 handles so a very wide root policy fails with `MAX_INPUTS` instead of exhausting file descriptors (#962).
+- On macOS the store opens files and directories non-blocking, so a FIFO planted in place of a listed file is refused instead of hanging the scan (#962).
+- Git membership probes drop environment-injected Git configuration (`GIT_CONFIG_PARAMETERS`, `GIT_CONFIG` and `GIT_CONFIG_KEY_n`/`VALUE_n` pairs) except the bridge's resolved `core.excludesFile` (#962).
+- A root below the top level of an enclosing Git work tree, such as a monorepo package, now uses that work tree's membership scoped to the root instead of reading every file from disk. Ignored files there no longer count as inputs, so existing receipts for such roots go stale once. A root the enclosing work tree ignores fails closed (#962).
+
 ## [0.21.2] - 2026-10-18
 
 ### Fixed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "bde0e781a7119541e1325def15c329b8cc3114358e2fdc54e416f675e57b1d0a",
+      "sha256": "e501ca2b817c882feec23bc3560223f20d88ca372400f950679bfe01ba47cebd",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "c267724fc38d0e952e501bbc6e4820b88bcdeb19eb2aa8aad964d5330af80d60",
+      "sha256": "0fe9c4672486a28db1340c77d9eebf37bc33774fc34b5c055728f135afe4d7e8",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "a680c8dfaf3da2938ba847b194bc412e62e6e29d0cb389888a01e8fd09af642b",
+      "sha256": "f98d2647144640b226d0fa3fae6369eefbcee477e9d2bb818f767711e6a3e506",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "830407027be16846bad137ec752e1f7c8f82c1573abb3ccf0518bb725360c0ee",
+      "sha256": "7abc7f188851bde8c082c2b812b74378e9e1848541aeb9029ee8551f4b68fdaa",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "e20696157edee640b24fffed031aa5e8b242cc5ba8123d16bc7a8b88a5d0cdd4",
+      "sha256": "3fe0a4b867fbcc8a278248f92697b649f4b9b208d51c5168885ba92fcbb73961",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "cda09717df58c45cbc982df48748870cb34af6be9ed1036d5c8e6ef8323b7974",
+      "sha256": "339210645436d11bca4129f74d4a7885ad12a9489f449669b5f46a6f9cd1056d",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "2208aad373face7bf8888ff37973fe6a5e32254e",
+      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39203172407",
-      "binary_sha256": "bde0e781a7119541e1325def15c329b8cc3114358e2fdc54e416f675e57b1d0a",
-      "observation_sha256": "f1653c18deca394017558c4332aec7aed5a53b5d213713feaafb6a2bfcee24db",
-      "module_sha256": "65001c9fedd9085c9d0c4f62a6768fd2528d222e0a495812c24890b44b896c2a",
+      "run_id": "39285460301",
+      "binary_sha256": "e501ca2b817c882feec23bc3560223f20d88ca372400f950679bfe01ba47cebd",
+      "observation_sha256": "fe57f74d7cda25cf36e845fcb7b74226d0651120f9129bd7abf9e394d10091ca",
+      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "2208aad373face7bf8888ff37973fe6a5e32254e",
+      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39203172407",
-      "binary_sha256": "c267724fc38d0e952e501bbc6e4820b88bcdeb19eb2aa8aad964d5330af80d60",
-      "observation_sha256": "f8bb354ccf8fc5c902e78b2a541017ba5e53665b0c471026053d4dfbf5d11c47",
-      "module_sha256": "65001c9fedd9085c9d0c4f62a6768fd2528d222e0a495812c24890b44b896c2a",
+      "run_id": "39285460301",
+      "binary_sha256": "0fe9c4672486a28db1340c77d9eebf37bc33774fc34b5c055728f135afe4d7e8",
+      "observation_sha256": "0c070e5db7e5296d7492d374ebff59d0da38167d746b29d924fc9508cafaf365",
+      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "2208aad373face7bf8888ff37973fe6a5e32254e",
+      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39203172407",
-      "binary_sha256": "a680c8dfaf3da2938ba847b194bc412e62e6e29d0cb389888a01e8fd09af642b",
-      "observation_sha256": "93ce3ee5b82f86a749f96791fb5a44a5878564ebc12eed275f32c79ec611ce7c",
-      "module_sha256": "65001c9fedd9085c9d0c4f62a6768fd2528d222e0a495812c24890b44b896c2a",
+      "run_id": "39285460301",
+      "binary_sha256": "f98d2647144640b226d0fa3fae6369eefbcee477e9d2bb818f767711e6a3e506",
+      "observation_sha256": "26ca308b11f988606f2ad007560010c863aec29af92d277fb5aa65f80dcdad13",
+      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "2208aad373face7bf8888ff37973fe6a5e32254e",
+      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39203172407",
-      "binary_sha256": "830407027be16846bad137ec752e1f7c8f82c1573abb3ccf0518bb725360c0ee",
-      "observation_sha256": "4d0abea75dc6987812f90d82c2c7453d7dcc05f194b44bd095f0d92c68f0233a",
-      "module_sha256": "65001c9fedd9085c9d0c4f62a6768fd2528d222e0a495812c24890b44b896c2a",
+      "run_id": "39285460301",
+      "binary_sha256": "7abc7f188851bde8c082c2b812b74378e9e1848541aeb9029ee8551f4b68fdaa",
+      "observation_sha256": "dcee8721dfb207509ae3e487fa45e73f27ee1cb8740ad6e4b6f157302a21a3f9",
+      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "2208aad373face7bf8888ff37973fe6a5e32254e",
+      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39203172407",
-      "binary_sha256": "e20696157edee640b24fffed031aa5e8b242cc5ba8123d16bc7a8b88a5d0cdd4",
-      "observation_sha256": "d5c94cbe63ccc4e02f4fd576c65ad5bd5cb1381bdb75eaf8fbe22299a71ade68",
-      "module_sha256": "65001c9fedd9085c9d0c4f62a6768fd2528d222e0a495812c24890b44b896c2a",
+      "run_id": "39285460301",
+      "binary_sha256": "3fe0a4b867fbcc8a278248f92697b649f4b9b208d51c5168885ba92fcbb73961",
+      "observation_sha256": "169b76151423856386be0bed088ebde2684fcb46faef49c354cf1e4db77136dc",
+      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "2208aad373face7bf8888ff37973fe6a5e32254e",
+      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39203172407",
-      "binary_sha256": "cda09717df58c45cbc982df48748870cb34af6be9ed1036d5c8e6ef8323b7974",
-      "observation_sha256": "c7da7ff3cb244e3e065c50deec6d664bd076195cd351017d5e2a7e9f0d44abd2",
-      "module_sha256": "65001c9fedd9085c9d0c4f62a6768fd2528d222e0a495812c24890b44b896c2a",
+      "run_id": "39285460301",
+      "binary_sha256": "339210645436d11bca4129f74d4a7885ad12a9489f449669b5f46a6f9cd1056d",
+      "observation_sha256": "bcb30a463547d0ee70cccf0063a08c337f371a9f2a206fe7775e9de59c55bb68",
+      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_artifactlib.py

@@ -976,6 +976,45 @@ def _engine_timeout() -> float:
     return value
 
 
+# IMAGE_FILE_MACHINE values IsWow64Process2 reports for the native machine.
+_WINDOWS_NATIVE_MACHINES = {0x8664: "amd64", 0xAA64: "arm64"}
+
+
+def _windows_native_architecture() -> str | None:
+    """Ask Windows itself for the native machine, through IsWow64Process2.
+
+    platform.machine() asks WMI first and then falls back to PROCESSOR_*
+    environment variables. A read-only sandbox can block WMI and strip that
+    environment, which left the architecture empty (#986). The kernel call
+    needs neither, and the environment is never consulted. None means the OS
+    gave no answer, and the caller fails closed."""
+    try:
+        import ctypes
+        query = ctypes.WinDLL("kernel32", use_last_error=True).IsWow64Process2
+    except (ImportError, OSError, AttributeError):
+        return None
+    # BOOL IsWow64Process2(HANDLE, USHORT *process, USHORT *native); the
+    # current-process pseudo-handle is -1. One-element arrays pass as pointers.
+    query.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p]
+    query.restype = ctypes.c_uint32
+    process, native = (ctypes.c_uint16 * 1)(), (ctypes.c_uint16 * 1)()
+    if not query(ctypes.c_void_p(-1), process, native):
+        return None
+    return _WINDOWS_NATIVE_MACHINES.get(native[0])
+
+
+def _host_platform() -> tuple[str, str]:
+    """The installed binary's platform cell, or UNSUPPORTED_PLATFORM."""
+    system = {"Linux":"linux", "Darwin":"darwin", "Windows":"windows"}.get(platform.system())
+    if system == "windows":
+        arch = _windows_native_architecture()
+    else:
+        arch = {"x86_64":"amd64", "amd64":"amd64", "aarch64":"arm64", "arm64":"arm64"}.get(platform.machine().lower())
+    if system is None or arch is None:
+        raise ArtifactError("UNSUPPORTED_PLATFORM", "unsupported architecture")
+    return system, arch
+
+
 class ArtifactClient:
     def __init__(self, root: str | Path, installation: str | Path, *, timeout: float | None = None,
                  initialize_store: bool = True):
@@ -1013,10 +1052,7 @@ class ArtifactClient:
         return dict(context)
 
     def _open_binary(self) -> int:
-        system = {"Linux":"linux", "Darwin":"darwin", "Windows":"windows"}.get(platform.system())
-        arch = {"x86_64":"amd64", "amd64":"amd64", "aarch64":"arm64", "arm64":"arm64"}.get(platform.machine().lower())
-        if system is None or arch is None:
-            raise ArtifactError("UNSUPPORTED_PLATFORM", "unsupported architecture")
+        system, arch = _host_platform()
         manifest_path = self.installation / "release.json"
         try:
             mf = _open_pinned_regular(manifest_path)
@@ -1162,8 +1198,7 @@ class ArtifactClient:
 
     @staticmethod
     def _binary_name() -> str:
-        system = {"Linux":"linux", "Darwin":"darwin", "Windows":"windows"}[platform.system()]
-        arch = {"x86_64":"amd64", "amd64":"amd64", "aarch64":"arm64", "arm64":"arm64"}[platform.machine().lower()]
+        system, arch = _host_platform()
         return f"ca-artifact-{system}-{arch}" + (".exe" if system == "windows" else "")
 
     @staticmethod

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.21.2"
+    adapter_version = "0.21.4"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "3.2.2"
+    adapter_version = "3.2.4"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.2",
+  "version": "0.21.4",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",