@arbiterforge/ca-pi 0.21.4 → 0.21.5

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 3.2.4" src="https://img.shields.io/badge/version-3.2.4-2b7489">
+<img alt="version 3.2.5" src="https://img.shields.io/badge/version-3.2.5-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.4",
+  "version": "0.21.5",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.21.5] - 2026-10-19
+
+### Fixed
+
+- The H-05 (audit logs), H-11 (ADRs) and H-18 (`CONTEXT.md`) shell guards blocked any interpreter command that merely named a protected path, so a read-only `python -c` read, an issue body citing the path, or an `ArtifactClient` request whose record text named an audit log was refused as a write. Their interpreter legs now block only when the command shows write intent after the interpreter (a write, delete, copy, move or in-place edit call, a non-read `open` mode, PowerShell content cmdlets, or dynamic execution such as `exec`, `eval` or `subprocess`), or when the interpreter is handed a script or module argument. H-18 also lets a `sed` without `-i` or a `w` command read `CONTEXT.md` (#997, #911).
+
 ## [0.21.4] - 2026-10-19
 
 ### Fixed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -37,12 +37,12 @@
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
+      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39285460301",
+      "run_id": "39337812494",
       "binary_sha256": "e501ca2b817c882feec23bc3560223f20d88ca372400f950679bfe01ba47cebd",
-      "observation_sha256": "fe57f74d7cda25cf36e845fcb7b74226d0651120f9129bd7abf9e394d10091ca",
-      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
+      "observation_sha256": "c832f3aff1d1c2b553173e16bb4fcd5b7ddf1cbf45c2a57e32840f58232c5a7a",
+      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
+      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39285460301",
+      "run_id": "39337812494",
       "binary_sha256": "0fe9c4672486a28db1340c77d9eebf37bc33774fc34b5c055728f135afe4d7e8",
-      "observation_sha256": "0c070e5db7e5296d7492d374ebff59d0da38167d746b29d924fc9508cafaf365",
-      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
+      "observation_sha256": "8007bb64505d6f4163df70b58d0a52d950f718caf284846b3a79b9936c759dee",
+      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
+      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39285460301",
+      "run_id": "39337812494",
       "binary_sha256": "f98d2647144640b226d0fa3fae6369eefbcee477e9d2bb818f767711e6a3e506",
-      "observation_sha256": "26ca308b11f988606f2ad007560010c863aec29af92d277fb5aa65f80dcdad13",
-      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
+      "observation_sha256": "d7c40f95cd3189dee10f26db25d63fbc2891181280efc2403dda058912f80236",
+      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
+      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39285460301",
+      "run_id": "39337812494",
       "binary_sha256": "7abc7f188851bde8c082c2b812b74378e9e1848541aeb9029ee8551f4b68fdaa",
-      "observation_sha256": "dcee8721dfb207509ae3e487fa45e73f27ee1cb8740ad6e4b6f157302a21a3f9",
-      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
+      "observation_sha256": "1bd885c3ecb6efacb789404d0d97db91596943de630c1cecbcee25482f2bf26f",
+      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
+      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39285460301",
+      "run_id": "39337812494",
       "binary_sha256": "3fe0a4b867fbcc8a278248f92697b649f4b9b208d51c5168885ba92fcbb73961",
-      "observation_sha256": "169b76151423856386be0bed088ebde2684fcb46faef49c354cf1e4db77136dc",
-      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
+      "observation_sha256": "8439eeadb753215c8e5e983091ff61e1920ac12480d9406e9cc6a837faa7725f",
+      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "4e33a9a7ef7ad22eeec2d925305164ccb9179922",
+      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39285460301",
+      "run_id": "39337812494",
       "binary_sha256": "339210645436d11bca4129f74d4a7885ad12a9489f449669b5f46a6f9cd1056d",
-      "observation_sha256": "bcb30a463547d0ee70cccf0063a08c337f371a9f2a206fe7775e9de59c55bb68",
-      "module_sha256": "896150db84c968920a4397b61b5be1d4d0d3775de7816d172f0bf4885e9e7133",
+      "observation_sha256": "062e23804043c352163576ced022881e88e849f1d9b202b14c08958ec9c63ae8",
+      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -516,6 +516,147 @@ CONTEXT_INTERP_RE = re.compile(
     _INTERP_EXECUTABLE + r"[\s\S]*" + CONTEXT_MD, re.I,
 )
 
+# #997/#911: the three legs above match an interpreter token followed ANYWHERE
+# by a protected name, so a read-only `python -c "print(open(...).read())"` or
+# an issue body that merely cites the path blocked like a write. They are now a
+# pre-filter: `_interp_protected_write` blocks only when the command shows
+# write intent after the interpreter, or hands the interpreter a script or
+# module argument (script argv stays conservative: its writes are invisible
+# here). Write intent is lexical and deliberately broad; dynamic execution
+# (`exec`, `eval`, `system`, `subprocess`) counts, because it hides the write.
+# The guard stays defense in depth behind the Write/Edit tool guards; a path
+# assembled at runtime (`'.codearbiter/' + 'CONTEXT.md'`) was never seen.
+_PS_WRITE_ALIASES = (r"sc|ac|ni|ri|mi|cpi|rni|ren|clc|del|erase|rd|rmdir|rm|mv|cp"
+                     r"|move|copy|tee")
+INTERP_WRITE_INTENT_RE = re.compile(
+    # Calls whose name carries a write/destroy verb: write_text, writeFileSync,
+    # WriteAllText, fwrite, appendFile, os.remove, unlink, shutil.move/copy,
+    # rmtree, Path.touch/chmod, os.truncate, rename/replace, File.Delete.
+    r"[\w$]*(?:write|append|unlink|remove|rename|replace|truncate|rmtree|rmdir"
+    r"|delete|move|copy|symlink|touch|chmod|chown|mkfifo|put_contents|fputs)"
+    r"[\w$]*\s*\("
+    r"|(?:\b|\.)(?:rm|cp|link)(?:Sync)?\s*\("
+    r"|\w*Writer\b|\w*WriteStream\b|\bFileStream\b|\bFileUtils\b"
+    r"|::\s*(?:Create\w*|Open(?:Write)?)\s*\("
+    # open() with a second positional argument that is not a literal read
+    # mode (a write mode, a flag, or a variable), or a non-read mode= keyword.
+    r"|\b\w*open(?:Sync)?\s*\(\s*[^,()]+(?:\([^()]*\))?[^,()]*,"
+    r"(?!\s*['\"](?:[rbtU]*|<)['\"]\s*[,)]|\s*[A-Za-z_]+\s*=)"
+    r"|\bmode\s*=\s*(?!['\"][rbtU]*['\"])"
+    r"|\b(?:Set-Content|Add-Content|Out-File|Clear-Content|Remove-Item|Move-Item"
+    r"|Copy-Item|Rename-Item|New-Item|Tee-Object|Invoke-Expression|Start-Process"
+    r"|Invoke-Command)\b"
+    r"|(?:^|[;&|({\n\"'`])\s*(?:" + _PS_WRITE_ALIASES + r")\s"
+    r"|\b(?:exec\w*|eval|system|popen|spawn\w*|check_call|check_output|getattr"
+    r"|setattr|__import__|compile)\s*\("
+    r"|\bsubprocess\b|\bmethodcaller\b|\bDeno\.(?:run|Command)\b|\.Invoke\w*\s*\("
+    # Reflection hides the called name: dunders (`os.__dict__['remove']`),
+    # vars()/globals(), and a computed member call (`fs['write' + x](...)`).
+    r"|__\w+__|\b(?:vars|globals|locals)\s*\(|\]\s*\("
+    # A write-mode literal passed or assigned anywhere: `o = open; o(p, 'w')`.
+    r"|(?<=[,(=\s])['\"][rbtU]*[wax+][rbtUwax+]*['\"](?=\s*[,);\]])",
+    re.I,
+)
+_INTERP_ARG_RE = re.compile(r"\s+([^\s|;&]+)")
+# Words that precede a command without ending a shell word list.
+_COMMAND_PREFIXES = frozenset({"env", "sudo", "call", "exec", "nohup", "time",
+                               "command", "xargs", "then", "do", "else", "&"})
+
+
+def _interp_operand(cmd, end):
+    """Classify what an interpreter token ending at `end` is handed:
+    'inline' (an inline-code switch or a heredoc), 'stdin' (`-`, code that
+    may arrive from a pipe), 'script' (a positional argument or `<` input
+    shaped like a path), 'word' (any other positional argument, such as a
+    `-m` module or a dotless script name) or 'bare' (nothing before the
+    command ends)."""
+    rest = cmd[end:]
+    suffix = re.match(r"[\w.-]*[\"'`]?", rest)
+    pos = suffix.end()
+    while True:
+        m = _INTERP_ARG_RE.match(rest, pos)
+        if not m:
+            return "bare"
+        token = m.group(1).rstrip("\"'`")
+        inline = re.match(_INTERP_INLINE_CODE, token, re.I)
+        if inline and inline.end() == len(token):
+            return "inline"
+        if token.startswith("<<"):
+            return "inline"
+        if token == "-":
+            return "stdin"
+        if not token.startswith("-"):
+            return "script" if re.search(r"[./\\]", token) else "word"
+        pos = m.end()
+
+
+def _at_command_position(cmd, start):
+    """True when the interpreter token at `start` sits where a command starts,
+    rather than inside prose such as "each node in the graph"."""
+    before = re.sub(r"[^\s;&|()`\"'{}]*$", "", cmd[:start]).rstrip()
+    if not before or before[-1] in ";&|({\n`\"'" or before.endswith("$("):
+        return True
+    word = before.split()[-1]
+    return word.lower() in _COMMAND_PREFIXES or "=" in word
+
+
+def _interp_protected_write(cmd, interp_re, name_re):
+    """True when an interpreter invocation can write the protected `name_re`
+    target: `interp_re` (token then name) matched, and after some interpreter
+    token that precedes the name either write intent appears, or the code it
+    runs is not visible on the command line (a script, module or file, piped
+    stdin, or a dotless argument in command position)."""
+    if not interp_re.search(cmd):
+        return False
+    names = [m.start() for m in name_re.finditer(cmd)]
+    for m in re.finditer(_INTERP_EXECUTABLE, cmd, re.I):
+        if not any(n >= m.end() for n in names):
+            continue
+        # Perl and Ruby calls need no parentheses (`open F, ">", p`,
+        # `File.write p, ""`), which the lexical intent scan cannot see, so
+        # they keep the conservative pre-#997 behavior.
+        if m.group(1).lower() in ("perl", "ruby"):
+            return True
+        if INTERP_WRITE_INTENT_RE.search(cmd, m.start()):
+            return True
+        operand = _interp_operand(cmd, m.end())
+        if operand == "script":
+            return True
+        if operand == "stdin" and "<<" not in cmd[m.end():]:
+            return True
+        if operand in ("word", "bare") and _at_command_position(cmd, m.start()):
+            return True
+    return False
+
+
+LOG_NAME_RE = re.compile(LOG_NAMES, re.I)
+DECISIONS_NAME_RE = re.compile(DECISIONS, re.I)
+CONTEXT_NAME_RE = re.compile(CONTEXT_MD, re.I)
+
+# #997: `sed` writes a file only in place (`-i`, `--in-place`) or through a
+# `w`/`W` script command; `sed -n 1,20p .codearbiter/CONTEXT.md` is a read.
+_SED_WRITES_RE = re.compile(
+    r"(?<![\w-])-[a-zA-Z]*i|--in-place|(?:^|[\s'\";{}/\d$,])[wW]\s+\S")
+
+
+def _context_shell_write(cmd):
+    """CONTEXT_WRITE_RE, except a `sed` invocation that cannot write."""
+    text = cmd
+    while True:
+        m = CONTEXT_WRITE_RE.search(text)
+        if not m:
+            return False
+        if m.group(1).lower() != "sed":
+            return True
+        # GNU sed accepts options after operands (`sed s/a/b/ FILE -i`), so
+        # scan the whole command segment, not only the text before the path.
+        segment = re.match(r"[^|;&]*", text[m.end(1):]).group(0)
+        if _SED_WRITES_RE.search(segment):
+            return True
+        # Blank this read-only `sed` and rescan, so another verb later in the
+        # same segment is still seen.
+        text = text[:m.start(1)] + "   " + text[m.end(1):]
+
 # H-22's shell flank: the protected-state registry (B1/#564) — Write/Edit are
 # guarded via classify_protected's "state" class (pre-write.py/pre-edit.py,
 # T-05a/T-06/T-07); this closes the shell flank the SAME way the four
@@ -1430,7 +1571,8 @@ def _check_h05_audit_log(cmd):
     if enrolled_name and (
             LOG_TRUNC_RE.search(cmd) or LOG_DESTROY_RE.search(cmd)
             or LOG_GIT_RESTORE_RE.search(cmd)
-            or LOG_INTERP_RE.search(cmd) and not _is_direct_taskwrite(cmd)):
+            or _interp_protected_write(cmd, LOG_INTERP_RE, LOG_NAME_RE)
+            and not _is_direct_taskwrite(cmd)):
         block("H-05", "The .codearbiter audit logs (overrides.log, triage.log, sprint-log.md, "
                       "gate-events.log, decisions/decision-log.md) are append-only "
                       "(ORCHESTRATOR §7). Truncating, overwriting, or deleting the audit "
@@ -1457,7 +1599,7 @@ def _check_h11_decisions(cmd):
     cmd = DECISION_LOG_SHELL_RE.sub(" ", cmd)
     cmd = ADR_LIFECYCLE_LOG_SHELL_RE.sub(" ", cmd)
     if (DECISIONS_REDIRECT_RE.search(cmd) or DECISIONS_WRITE_RE.search(cmd)
-            or DECISIONS_INTERP_RE.search(cmd)):
+            or _interp_protected_write(cmd, DECISIONS_INTERP_RE, DECISIONS_NAME_RE)):
         block("H-11", "ADR files under .codearbiter/decisions/ are authored only via "
                       "/adr and are immutable history (ORCHESTRATOR §6) — shell writes, "
                       "edits, and deletions there are prohibited.")
@@ -1469,9 +1611,13 @@ def _check_h18_context_md(cmd):
     Write tool, so nothing legitimate is blocked. Reads pass.
 
     #574: CONTEXT_INTERP_RE closes the interpreter-one-liner flank the same
-    way LOG_INTERP_RE/DECISIONS_INTERP_RE do for H-05/H-11."""
-    if (CONTEXT_REDIRECT_RE.search(cmd) or CONTEXT_WRITE_RE.search(cmd)
-            or CONTEXT_INTERP_RE.search(cmd)):
+    way LOG_INTERP_RE/DECISIONS_INTERP_RE do for H-05/H-11.
+
+    #997: reads pass on both flanks. `sed` without in-place or a `w` command
+    is a read, and an interpreter needs write intent or a script argument
+    (`_interp_protected_write`)."""
+    if (CONTEXT_REDIRECT_RE.search(cmd) or _context_shell_write(cmd)
+            or _interp_protected_write(cmd, CONTEXT_INTERP_RE, CONTEXT_NAME_RE)):
         block("H-18", ".codearbiter/CONTEXT.md is the activation switch every enforcement "
                       "hook reads (#159) — shell rewrites, edits, or deletions that could flip "
                       "`arbiter: enabled` off or corrupt its frontmatter are prohibited. Edit it "

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.21.4"
+    adapter_version = "0.21.5"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "3.2.4"
+    adapter_version = "3.2.5"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.4",
+  "version": "0.21.5",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",