ai-consultants 2.17.0 → 2.17.2

package/CLAUDE.md

@@ -6,7 +6,7 @@ AI Consultants is a multi-model AI deliberation system that queries up to 15 AI
 
 **Self-Exclusion**: The invoking agent is automatically excluded from the panel to prevent self-consultation. Claude Code won't query Claude, Codex CLI won't query Codex, etc.
 
-**Version**: 2.17.0
+**Version**: 2.17.2
 
 ## Distribution
 
@@ -826,6 +826,19 @@ curl -fsSL https://raw.githubusercontent.com/matteoscurati/ai-consultants/main/s
 
 ## Changelog
 
+### v2.17.2
+- **SECURITY: revert v2.17.1's `allow_absolute=true` for context files — it opened a secret-exfiltration surface (caught in `/code-review max`).** v2.17.1 fixed the macOS `/private/tmp` drop by letting `build_context.sh` accept *any* absolute context path behind `validate_file_path`'s prefix-only blocklist (`/etc /root /var/log /proc /sys /dev`). That blocklist covers no home secrets, so a context arg of `~/.ssh/id_rsa`, `~/.aws/credentials`, `~/.netrc`, or `~/.config/gh/hosts.yml` was read verbatim and **sent to the external AI providers**. It also matched literal non-canonical prefixes, so `/private/etc/master.passwd` (the real `/etc` on macOS, via the same symlink aliasing) bypassed the `/etc` rule.
+- **Fix (correct altitude — allowlist, not blocklist)**: context files are now accepted only when (a) relative and in-tree (`validate_file_path ... false` — rejects absolute and `..`), or (b) under a recognized temp root via the new `_is_temp_path` helper (`/tmp`, `/private/tmp`, `$TMPDIR`, and the `/private`-prefixed macOS alias of `$TMPDIR`; `..` rejected so a temp prefix can't traverse out). Still fixes the original macOS scratch-file regression (Claude Code writes `/private/tmp/...`) **without** widening to the whole filesystem. Verified: `/tmp`, `/private/tmp`, `$TMPDIR/...`, relative in-tree → accepted; `~/.ssh/id_rsa`, `/etc/passwd`, `/private/etc/master.passwd`, `/tmp/../etc/passwd` → rejected.
+- **`build_context.sh` OUTPUT_FILE**: removed the `/tmp/*` short-circuit that jumped past `validate_file_path` (so `/tmp/../etc/x` bypassed the `..` check). Output paths now always run through `validate_file_path "$OUTPUT_FILE" "true"` — absolute allowed (output lives under the XDG cache or `/tmp`), traversal + sensitive-path guards enforced. The two validation sites are intentionally different now (OUTPUT is tool-chosen; context files are untrusted input) and the comments say so.
+- **Test**: rewrote `test_context_optimization.sh` Test 15 as a *boundary* test — temp-root accepted, `~/.ssh/id_rsa` rejected (exfiltration blocked), `/etc/passwd` rejected. Uses the auto-cleaned `$_TMPDIR` (no `$HOME` litter) and `QUESTION_CATEGORY=SECURITY` to skip the project-tree `find` the assertions don't need. Fixed the stale suite-header comment that contradicted the new behavior. 8 suites pass; shellcheck clean.
+- **Note**: v2.17.1 was tagged and GitHub-released but **never published to npm** (npm stayed at 2.17.0), so no npm user received the vulnerable version. Publish **2.17.2**, not 2.17.1.
+
+### v2.17.1
+- **Fix: context files at absolute paths outside `/tmp` were silently dropped.** `build_context.sh`'s context-file gate accepted only relative paths or a literal `/tmp/*` prefix (`if [[ "$_PARSED_PATH" == /tmp/* ]] || validate_file_path "$_PARSED_PATH" "false"`). On macOS `/tmp` is a symlink to `/private/tmp`, so Claude Code scratch files arrive as `/private/tmp/...` and matched neither branch → `log_warn "Skipping invalid file path"` and the file was excluded, with `build_context.sh` falling back to a generic repo auto-context. Net effect: a consultation looked like it ran with the user's context but the consultants never received it. (Reported from a real session where the passed context was dropped and an auto-context substituted.)
+- **Fix**: the gate now uses `validate_file_path "$_PARSED_PATH" "true"` (allow absolute), mirroring the OUTPUT_FILE handling a few lines above. Context files are explicitly user/agent-provided, so absolute paths are legitimate; the sensitive-path blocklist (`/etc /root /var/log /proc /sys /dev`), path-traversal (`..`), and null-byte guards in `validate_file_path` still apply. Verified: `/private/tmp/...`, `/tmp/...`, relative, and `$HOME/...` paths accepted; `/etc/passwd`, `/var/log/...`, `../../etc/...` still rejected.
+- **Test**: `test_context_optimization.sh` Test 15 — an absolute context path outside `/tmp` (a `$HOME` file) is now included in the built context, and `/etc/passwd` is still skipped. 8 suites pass; shellcheck clean.
+- **Note (not a code change)**: the same session also showed Gemini/Codex failing immediately — because the *installed* skill at `~/.claude/skills/ai-consultants` was **v2.10.0** (pre-agy migration), so Gemini called the deprecated `gemini` binary. Updating the installed skill to ≥v2.15 (now v2.17.1) resolves that; it's an install-staleness issue, not a current-code bug.
+
 ### v2.17.0
 - **Model catalog refresh (June 2026)** across all three tiers + cost rates, for every agent. Source of truth stays `config.sh::get_model_for_tier` (+ default `*_MODEL` vars) mirrored by `docs/cost_rates.json` (`model_tiers` + `consultant_fallbacks` + per-1K `models` rates). CLI-addressed models verified by querying the installed binaries (`agy models`, `agent --list-models`, kimi config); API/provider models + pricing researched against official sources. Superseded IDs kept in `cost_rates.json` for historical/pinned lookups.
 - **Changed models** (premium / standard / economy):

package/README.md

@@ -1,8 +1,8 @@
-# AI Consultants v2.17.0
+# AI Consultants v2.17.2
 
 > **A harness for every question.** A panel of up to 15 frontier models that writes its own playbook per question — fan out, debate to convergence, cross-examine under adversarial review, or run a tournament — and checks its work before it reaches you.
 
-[![Version](https://img.shields.io/badge/version-2.17.0-blue.svg)](https://github.com/matteoscurati/ai-consultants)
+[![Version](https://img.shields.io/badge/version-2.17.2-blue.svg)](https://github.com/matteoscurati/ai-consultants)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![Claude Code Skill](https://img.shields.io/badge/Claude%20Code-Skill-orange.svg)](https://docs.anthropic.com/en/docs/claude-code/skills)
 [![GitHub stars](https://img.shields.io/github/stars/matteoscurati/ai-consultants?style=social)](https://github.com/matteoscurati/ai-consultants)

package/SKILL.md

@@ -5,10 +5,10 @@ license: MIT
 compatibility: Requires bash, jq, and at least 2 AI CLI tools (agy, codex, vibe, etc.). macOS and Linux.
 metadata:
   author: matteoscurati
-  version: 2.17.0
+  version: 2.17.2
 ---
 
-# AI Consultants v2.17.0 - AI Expert Panel
+# AI Consultants v2.17.2 - AI Expert Panel
 
 **A harness for every question.** Convene a panel of AI "consultants" for coding questions — and let the engine pick *how* they deliberate: a quick read, a convergence loop, an adversarial refutation gate, a tournament, or an exhaustive sweep. Each consultant has a **configurable persona** that shapes its analysis.
 

package/docs/COST_RATES.md

@@ -1,4 +1,4 @@
-# Cost Rates - AI Consultants v2.17.0
+# Cost Rates - AI Consultants v2.17.2
 
 This page documents the per-token rates used by the cost tracking system.
 

package/docs/cost_rates.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.17.0",
+  "version": "2.17.2",
   "updated": "2026-06-24",
   "models": {
     "_comment_units": "All rates are USD per 1,000 tokens (per-1K). lib/costs.sh computes cost as (token_count / 1000) * rate, so every value here MUST be a per-1K rate = (provider $/1M price) / 1000. Do NOT paste $/MTok figures directly.",

package/docs/releases/v2.17.1.md

@@ -0,0 +1,46 @@
+# Release v2.17.1
+
+**Date:** 2026-06-25
+**Type:** Patch — context-file path fix
+**Previous:** v2.17.0
+
+## Highlights
+
+- **Fixes a silent failure where context files you passed were dropped** and replaced with a generic auto-context, so consultants never saw the context you intended.
+
+## What's New
+
+### Absolute context paths are now accepted
+
+`build_context.sh` (which assembles the context bundle sent to the consultants) only accepted context files at **relative paths** or under a literal **`/tmp/`** prefix. Any other absolute path was rejected with `Skipping invalid file path` and excluded — and the script quietly fell back to building a generic context from the repository.
+
+The most common way to hit this: on macOS, `/tmp` is a symlink to `/private/tmp`, so scratch files (e.g. the ones Claude Code writes) arrive as `/private/tmp/...` and missed the `/tmp/` check. The result looked like a normal consultation, but the consultants received auto-generated repo context instead of what you passed.
+
+Context files are explicitly provided by you (or the calling agent), so absolute paths are now accepted. The safety guards are unchanged: the sensitive-path blocklist (`/etc`, `/root`, `/var/log`, `/proc`, `/sys`, `/dev`), path-traversal (`..`), and null-byte checks still reject dangerous paths.
+
+## Breaking Changes
+
+None.
+
+## Upgrade Guide
+
+```bash
+# If installed via git clone
+cd ~/.claude/skills/ai-consultants && git pull
+
+# If installed via curl | bash
+curl -fsSL https://raw.githubusercontent.com/matteoscurati/ai-consultants/main/scripts/install.sh | bash
+
+# Or via npx (always latest)
+npx ai-consultants@latest install
+```
+
+> If your installed skill is well behind (e.g. v2.10.x), update it: pre-v2.15 versions still call the now-deprecated `gemini` CLI, which is why Gemini (and possibly Codex) fail immediately. v2.15+ uses the Antigravity CLI (`agy`).
+
+## Commits
+
+- `_______` fix(context): accept absolute context-file paths (macOS /private/tmp was dropped)
+
+## Contributors
+
+- @matteoscurati

package/docs/releases/v2.17.2.md

@@ -0,0 +1,51 @@
+# Release v2.17.2
+
+**Date:** 2026-06-25
+**Type:** Patch — security fix (supersedes v2.17.1)
+**Previous:** v2.17.1
+
+## Highlights
+
+- **Security fix.** v2.17.1's context-path change was too broad: it let a context file argument point at **any** absolute path — including secrets like `~/.ssh/id_rsa`, `~/.aws/credentials`, or `~/.netrc` — whose contents would then be sent to the external AI consultants. v2.17.2 closes that.
+- The original bug v2.17.1 set out to fix (macOS `/private/tmp` scratch files being dropped) is still fixed — just with a safe allowlist instead of an open door.
+
+> ⚠️ **v2.17.1 was tagged and GitHub-released but never published to npm** (npm stayed at 2.17.0), so no npm user received the vulnerable build. Install **2.17.2**.
+
+## What's New
+
+### Context files: allowlist instead of blocklist
+
+`build_context.sh` assembles the files you pass and sends their contents to the consultant models. v2.17.1 accepted any absolute path and relied on a small blocklist (`/etc`, `/root`, …) to keep dangerous paths out — but that list covers no home-directory secrets, and it matched non-canonical prefixes (so `/private/etc/master.passwd`, the real `/etc` on macOS, slipped through).
+
+v2.17.2 restricts context files to:
+- **relative, in-tree paths** (absolute paths and `..` traversal rejected), or
+- **recognized temp roots**: `/tmp`, `/private/tmp`, and `$TMPDIR` (plus the `/private`-prefixed macOS alias), with `..` rejected so a temp prefix can't traverse out.
+
+Everything else — `~/.ssh/id_rsa`, `/etc/passwd`, `/private/etc/master.passwd`, `/tmp/../etc/passwd` — is rejected. The macOS scratch-file case that v2.17.1 targeted (`/private/tmp/...`) still works.
+
+### Output-path hardening
+
+`build_context.sh`'s output path no longer short-circuits past the traversal/sensitive-path guards for `/tmp` outputs; all output paths run through `validate_file_path` uniformly.
+
+## Breaking Changes
+
+If you relied on passing an **absolute context path outside a temp directory** (introduced for one patch in v2.17.1), it is now rejected. Pass the file by a relative path from the project root, or place it under a temp dir. This is the same boundary as v2.17.0 and earlier.
+
+## Upgrade Guide
+
+```bash
+# git clone
+cd ~/.claude/skills/ai-consultants && git pull
+# curl | bash
+curl -fsSL https://raw.githubusercontent.com/matteoscurati/ai-consultants/main/scripts/install.sh | bash
+# npx
+npx ai-consultants@latest install
+```
+
+## Commits
+
+- `_______` fix(security): restrict context files to relative/temp paths (revert v2.17.1 allow-absolute)
+
+## Contributors
+
+- @matteoscurati

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-consultants",
-  "version": "2.17.0",
+  "version": "2.17.2",
   "description": "A harness for every question - a panel of up to 15 AI models that picks its own deliberation strategy per question (convergence, adversarial verification, tournament) and checks its work before answering",
   "bin": {
     "ai-consultants": "bin/ai-consultants"

package/scripts/build_context.sh

@@ -475,10 +475,31 @@ shift
 QUERY="$1"
 shift
 
-# Validate output file path (allow /tmp for output)
-if [[ "$OUTPUT_FILE" == /tmp/* ]]; then
-    : # Allow /tmp paths for output
-elif ! validate_file_path "$OUTPUT_FILE" "true"; then
+# Returns 0 if PATH is under a recognized temp root: /tmp, /private/tmp (macOS:
+# /tmp is a symlink to /private/tmp), $TMPDIR, or the /private-prefixed macOS
+# alias of $TMPDIR. Rejects any path containing ".." so a temp prefix cannot be
+# used to traverse out (e.g. /tmp/../etc/...).
+_is_temp_path() {
+    local p="$1"
+    [[ "$p" == *".."* ]] && return 1
+    case "$p" in
+        /tmp/*|/private/tmp/*) return 0 ;;
+    esac
+    if [[ -n "${TMPDIR:-}" ]]; then
+        local t="${TMPDIR%/}"
+        [[ "$p" == "$t"/* ]] && return 0
+        [[ "$p" == /private"$t"/* ]] && return 0
+    fi
+    return 1
+}
+
+# Validate output file path. OUTPUT_FILE is tool-chosen (consult_all picks the
+# output dir — under the XDG cache or /tmp), so absolute is allowed, but the
+# traversal + sensitive-path guards in validate_file_path must still apply.
+# (Previously a literal "/tmp/*" prefix short-circuited past those guards, so an
+# output path like /tmp/../etc/x bypassed the ".." check — fixed by routing all
+# output paths through validate_file_path uniformly.)
+if ! validate_file_path "$OUTPUT_FILE" "true"; then
     log_error "Invalid output file path: $OUTPUT_FILE"
     exit 1
 fi
@@ -492,8 +513,20 @@ while [[ $# -gt 0 ]]; do
     file_arg="$1"
     shift
     _parse_tagged_path "$file_arg"
-    # Allow relative paths and /tmp paths for context files
-    if [[ "$_PARSED_PATH" == /tmp/* ]] || validate_file_path "$_PARSED_PATH" "false" 2>/dev/null; then
+    # SECURITY: build_context sends file contents to EXTERNAL AI providers, so a
+    # context arg must NOT be able to read arbitrary absolute paths (e.g.
+    # ~/.ssh/id_rsa, ~/.aws/credentials, ~/.netrc). Accept only:
+    #   (a) relative, in-tree paths — validate_file_path with allow_absolute=false
+    #       rejects absolute paths and ".." traversal, keeping them under cwd; or
+    #   (b) files under a recognized temp root (_is_temp_path).
+    # This fixes the macOS scratch-file regression (Claude Code writes
+    # /private/tmp/...; /tmp is a symlink to /private/tmp, and $TMPDIR is
+    # /var/folders/...) WITHOUT widening to the whole filesystem.
+    # NOTE: v2.17.1 briefly used allow_absolute=true here, which let any absolute
+    # path through a prefix-only blocklist — a secret-exfiltration surface. Do not
+    # reintroduce it. (OUTPUT_FILE above is tool-chosen, not user input, so it is
+    # validated differently — the two sites are intentionally not identical.)
+    if _is_temp_path "$_PARSED_PATH" || validate_file_path "$_PARSED_PATH" "false" 2>/dev/null; then
         FILES+=("$_PARSED_PATH")
         FILE_TAGS+=("$_PARSED_TAG")
     else

package/scripts/config.sh

@@ -858,4 +858,4 @@ EOF
 # VERSION
 # =============================================================================
 
-AI_CONSULTANTS_VERSION="2.17.0"
+AI_CONSULTANTS_VERSION="2.17.2"

package/scripts/test_context_optimization.sh

@@ -9,8 +9,9 @@ set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-# Relative path is required: lib/common.sh::validate_file_path rejects
-# absolute paths in non-/tmp locations.
+# Fixtures are referenced by RELATIVE path: build_context.sh's context gate
+# accepts only relative in-tree paths or temp-root paths (/tmp, /private/tmp,
+# $TMPDIR) and rejects arbitrary absolute paths (see Test 15 for the boundary).
 FIXTURES_REL="scripts/test_fixtures/context"
 
 # Always invoke build_context.sh from the project root so relative fixture
@@ -282,6 +283,37 @@ test_legacy_inlined_query() {
 # Suite runner
 # -----------------------------------------------------------------------------
 echo "test_context_optimization.sh — v2.14 context handoff regression suite"
+# -----------------------------------------------------------------------------
+# Test 15: context-file path boundary (v2.17.2)
+# -----------------------------------------------------------------------------
+# build_context.sh sends file contents to external AI providers, so the context
+# gate must (a) ACCEPT temp-root paths — fixing the macOS /private/tmp scratch-file
+# regression — and (b) REJECT arbitrary absolute paths so secrets like ~/.ssh/id_rsa
+# can't be exfiltrated. ($_TMPDIR is itself a temp root: /var/folders/... on macOS,
+# /tmp/... on Linux — the exact accept case, auto-cleaned, no $HOME litter.)
+# QUESTION_CATEGORY=SECURITY skips the project-tree find these assertions don't need.
+test_context_path_boundary() {
+    local tmpfile="$_TMPDIR/aic_ctx_abs.txt"
+    printf 'UNIQUE_CTX_MARKER_42 lorem ipsum\n' > "$tmpfile"
+    QUESTION_CATEGORY=SECURITY "$SCRIPT_DIR/build_context.sh" "$_TMPDIR/ctx_tmp.md" "summarize this" "$tmpfile" >/dev/null 2>&1
+    local content
+    content=$(cat "$_TMPDIR/ctx_tmp.md" 2>/dev/null)
+    assert_match "UNIQUE_CTX_MARKER_42" "$content" \
+        "temp-root context path is included (macOS /private/tmp regression class)"
+
+    # Arbitrary absolute path outside the temp roots must be REJECTED (no secret
+    # exfiltration). Path need not exist — rejection happens at validation.
+    local stderr
+    stderr=$(QUESTION_CATEGORY=SECURITY "$SCRIPT_DIR/build_context.sh" "$_TMPDIR/ctx_sec.md" "q" "$HOME/.ssh/id_rsa" 2>&1)
+    assert_match "Skipping invalid file path: $HOME/.ssh/id_rsa" "$stderr" \
+        "absolute path outside temp roots is rejected (secret exfiltration blocked)"
+
+    # Sensitive system path still rejected.
+    stderr=$(QUESTION_CATEGORY=SECURITY "$SCRIPT_DIR/build_context.sh" "$_TMPDIR/ctx_etc.md" "q" "/etc/passwd" 2>&1)
+    assert_match "Skipping invalid file path: /etc/passwd" "$stderr" \
+        "sensitive /etc path is still rejected"
+}
+
 run_test "Test 1: @TAG defaults to PRIMARY" test_tag_default_primary
 run_test "Test 2: @TAG honored when explicit" test_tag_explicit
 run_test "Test 3: @TAG unknown falls back to PRIMARY with warning" test_tag_unknown_fallback
@@ -296,5 +328,6 @@ run_test "Test 11: --query-file is parsed correctly" test_query_file_flag
 run_test "Test 12: --query-file with missing file is rejected" test_query_file_missing
 run_test "Test 13: --query-file conflicts with positional query" test_query_file_conflict
 run_test "Test 14: Legacy no-FILES path still works" test_legacy_inlined_query
+run_test "Test 15: context-file path boundary (v2.17.2)" test_context_path_boundary
 
 test_summary "test_context_optimization.sh"