arkaos 2.46.0 → 2.46.1

package/VERSION

@@ -1 +1 @@
-2.46.0
+2.46.1

package/config/hooks/stop.sh

@@ -140,17 +140,25 @@ try:
     except Exception:
         safe_sid = None
     if safe_sid:
-        cite_dir = Path("/tmp/arkaos-cite")
-        cite_dir.mkdir(parents=True, exist_ok=True)
-        cite_path = cite_dir / f"{safe_sid}.json"
-        cite_payload = {
-            "passed": cr.passed,
-            "reason": cr.reason,
-            "suggestion": cr.suggestion,
-            "citation_count": cr.citation_count,
-            "topic_score": cr.topic_score,
-        }
-        cite_path.write_text(json.dumps(cite_payload), encoding="utf-8")
+        # PR25 v2.46.1 — restrict cite-file permissions on shared
+        # multi-user systems. umask(0o077) makes the directory and the
+        # JSON file owner-only (mode 0600 / 0700). No-op on single-user
+        # dev boxes; defence in depth otherwise.
+        prev_umask = os.umask(0o077)
+        try:
+            cite_dir = Path("/tmp/arkaos-cite")
+            cite_dir.mkdir(parents=True, exist_ok=True)
+            cite_path = cite_dir / f"{safe_sid}.json"
+            cite_payload = {
+                "passed": cr.passed,
+                "reason": cr.reason,
+                "suggestion": cr.suggestion,
+                "citation_count": cr.citation_count,
+                "topic_score": cr.topic_score,
+            }
+            cite_path.write_text(json.dumps(cite_payload), encoding="utf-8")
+        finally:
+            os.umask(prev_umask)
 except Exception:
     pass
 

package/core/release/preflight.py

@@ -26,6 +26,9 @@ _DEFAULT_REPO_ROOT = Path.cwd()
 _SUBPROCESS_TIMEOUT = 10
 _NPM_PACKAGE_VERSION_RE = re.compile(r'"version"\s*:\s*"([^"]+)"')
 _PYPROJECT_VERSION_RE = re.compile(r'^version\s*=\s*"([^"]+)"', re.MULTILINE)
+# PR25 v2.46.1 — Redact `user:token@` from git remote URLs before
+# surfacing them in CLI output (some operators use PAT-in-URL remotes).
+_GIT_URL_CREDENTIAL_RE = re.compile(r"://[^/\s@]+:[^/\s@]+@")
 
 
 @dataclass(frozen=True)
@@ -229,12 +232,18 @@ def check_git_remote() -> CheckResult:
             reason="no `origin` remote configured",
             remediation="set up the remote with `git remote add origin <url>`",
         )
+    url = _redact_git_credentials(out.stdout.strip())
     return CheckResult(
         name="git-remote", passed=True,
-        reason=out.stdout.strip(),
+        reason=url,
     )
 
 
+def _redact_git_credentials(url: str) -> str:
+    """Strip `user:token@` segments from a remote URL before display."""
+    return _GIT_URL_CREDENTIAL_RE.sub("://<redacted-credentials>@", url)
+
+
 def check_git_clean() -> CheckResult:
     """Flag uncommitted changes as a WARNING (not blocking)."""
     out = _run(["git", "status", "--porcelain"])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "2.46.0",
+  "version": "2.46.1",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "2.46.0"
+version = "2.46.1"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}