arkaos 4.3.3 → 4.3.5

package/VERSION

@@ -1 +1 @@
-4.3.3
+4.3.5

package/config/hooks/cwd-changed.sh

@@ -28,40 +28,43 @@ ECOSYSTEM=""
 ECOSYSTEM_NAME=""
 
 if [ -f "$ECOSYSTEMS_FILE" ] && command -v "$ARKA_PY" >/dev/null 2>&1; then
-  eval "$("$ARKA_PY" -c "
+  # OWASP A03: NEW_CWD is untrusted harness input. It is passed through the
+  # environment (never interpolated into the Python source), and the result
+  # is emitted as JSON read by jq — no `eval`, so a crafted cwd can neither
+  # break the source string nor inject a shell command.
+  _ECO_JSON=$(ARKA_CWD="$NEW_CWD" ARKA_ECO_FILE="$ECOSYSTEMS_FILE" "$ARKA_PY" -c '
 import json, os, sys
 
-cwd = '$NEW_CWD'
-eco_file = os.path.expanduser('$ECOSYSTEMS_FILE')
+cwd = os.environ["ARKA_CWD"]
+eco_file = os.path.expanduser(os.environ["ARKA_ECO_FILE"])
+
+
+def emit(eco_id, name):
+    print(json.dumps({"ecosystem": eco_id, "name": name}))
+    sys.exit(0)
+
 
 try:
     data = json.load(open(eco_file))
-    ecosystems = data.get('ecosystems', {})
+    ecosystems = data.get("ecosystems", {})
 
     for eco_id, eco in ecosystems.items():
-        projects = eco.get('projects', [])
-        for proj in projects:
-            # Check if cwd contains the project name
+        for proj in eco.get("projects", []):
             if proj in cwd:
-                print(f'ECOSYSTEM=\"{eco_id}\"')
-                print(f'ECOSYSTEM_NAME=\"{eco.get(\"name\", eco_id)}\"')
-                sys.exit(0)
+                emit(eco_id, eco.get("name", eco_id))
 
-    # No match by project name, try by path patterns
-    if '/herd/' in cwd or '/Herd/' in cwd:
-        dir_name = os.path.basename(cwd.rstrip('/'))
+    if "/herd/" in cwd or "/Herd/" in cwd:
+        dir_name = os.path.basename(cwd.rstrip("/"))
         for eco_id, eco in ecosystems.items():
-            for proj in eco.get('projects', []):
-                if proj == dir_name:
-                    print(f'ECOSYSTEM=\"{eco_id}\"')
-                    print(f'ECOSYSTEM_NAME=\"{eco.get(\"name\", eco_id)}\"')
-                    sys.exit(0)
+            if dir_name in eco.get("projects", []):
+                emit(eco_id, eco.get("name", eco_id))
 except Exception:
     pass
 
-print('ECOSYSTEM=\"\"')
-print('ECOSYSTEM_NAME=\"\"')
-" 2>/dev/null)"
+print(json.dumps({"ecosystem": "", "name": ""}))
+' 2>/dev/null)
+  ECOSYSTEM=$(echo "$_ECO_JSON" | jq -r '.ecosystem // ""' 2>/dev/null)
+  ECOSYSTEM_NAME=$(echo "$_ECO_JSON" | jq -r '.name // ""' 2>/dev/null)
 fi
 
 # ─── Detect stack ──────────────────────────────────────────────────────
@@ -113,5 +116,7 @@ if [ -n "$DESCRIPTOR" ]; then
 fi
 
 if [ -n "$CONTEXT" ]; then
-  echo "{\"additionalContext\": \"${CONTEXT}\"}"
+  # Build the JSON with jq so any quote/backslash in the ecosystem name or
+  # descriptor path is escaped, never breaking the envelope (OWASP A03).
+  jq -nc --arg ctx "$CONTEXT" '{additionalContext: $ctx}'
 fi

package/config/hooks/session-start.sh

@@ -184,8 +184,11 @@ except Exception:
 fi
 
 # ─── Output as systemMessage (same protocol as claude-mem) ─────────────
-"$ARKA_PY" -c "
-import json
-msg = '''$(echo -e "$MSG")'''
-print(json.dumps({'systemMessage': msg}))
+# OWASP A03: MSG carries profile-derived NAME/COMPANY. Pass it through the
+# environment (with \n already expanded) rather than interpolating it into
+# the Python source, so a name containing quotes or ''' cannot break the
+# script or the JSON envelope.
+ARKA_MSG="$(echo -e "$MSG")" "$ARKA_PY" -c "
+import json, os
+print(json.dumps({'systemMessage': os.environ['ARKA_MSG']}))
 "

package/core/sync/features/forge.yaml

@@ -2,9 +2,10 @@ name: forge-integration
 added_in: "2.14.0"
 mandatory: true
 section_title: "Forge Integration"
-detection_pattern: "arka-forge"
+detection_pattern: "arka:feature:forge-integration|## Forge Integration|arka-forge"
 deprecated_in: null
 content: |
+  <!-- arka:feature:forge-integration:start -->
   ## Forge Integration
 
   Complex requests (complexity score >= 5) are automatically routed to
@@ -14,3 +15,4 @@ content: |
   - Complexity assessment: automatic via Synapse L8 (ForgeContextLayer)
   - Manual invocation: `/forge` command
   - Handoff: Forge outputs structured plan → squad executes phases
+  <!-- arka:feature:forge-integration:end -->

package/core/sync/features/quality-gate.yaml

@@ -2,9 +2,10 @@ name: quality-gate
 added_in: "2.10.0"
 mandatory: true
 section_title: "Quality Gate"
-detection_pattern: "Marta.*CQO|Quality Gate"
+detection_pattern: "arka:feature:quality-gate|## Quality Gate"
 deprecated_in: null
 content: |
+  <!-- arka:feature:quality-gate:start -->
   ## Quality Gate
 
   Mandatory on every workflow. Nothing ships without approval.
@@ -13,3 +14,4 @@ content: |
   - **Eduardo (Copy Director):** Reviews all text output
   - **Francisca (Tech Director):** Reviews all code and technical output
   - Verdict: APPROVED or REJECTED (binary, no partial)
+  <!-- arka:feature:quality-gate:end -->

package/core/sync/features/spec-gate.yaml

@@ -2,9 +2,10 @@ name: spec-driven-gate
 added_in: "2.13.0"
 mandatory: true
 section_title: "Spec-Driven Development"
-detection_pattern: "arka-spec"
+detection_pattern: "arka:feature:spec-driven-gate|## Spec-Driven Development|arka-spec"
 deprecated_in: null
 content: |
+  <!-- arka:feature:spec-driven-gate:start -->
   ## Spec-Driven Development
 
   Phase 0 of all workflows. No implementation begins without a validated spec.
@@ -13,3 +14,4 @@ content: |
   - Gate: spec must be approved before planning phase starts
   - Storage: `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md`
   - Review: user approval required on written spec
+  <!-- arka:feature:spec-driven-gate:end -->

package/core/sync/features/workflow-tiers.yaml

@@ -2,9 +2,10 @@ name: workflow-tiers
 added_in: "2.12.0"
 mandatory: true
 section_title: "Workflow Tiers"
-detection_pattern: "Enterprise.*phase|Focused.*phase|Specialist.*phase"
+detection_pattern: "arka:feature:workflow-tiers|## Workflow Tiers"
 deprecated_in: null
 content: |
+  <!-- arka:feature:workflow-tiers:start -->
   ## Workflow Tiers
 
   Three workflow tiers based on task complexity:
@@ -17,3 +18,4 @@ content: |
 
   Tier selection is automatic based on complexity assessment.
   Quality Gate phase is mandatory on ALL tiers.
+  <!-- arka:feature:workflow-tiers:end -->

package/departments/ops/skills/update/references/sync-engine.md

@@ -74,9 +74,11 @@ Returns JSON report for downstream consumption.
 ## Feature Registry
 
 YAML files under `core/sync/features/*.yaml` (or `~/.arkaos/config/sync/features/*.yaml`). Each feature has:
-- `detection_pattern` — regex/string searched in ecosystem SKILL.md to decide if the feature is already present
-- `content` — the section to inject if missing
-- `deprecated_in` — if set, the matching section is removed
+- `detection_pattern` — regex searched in ecosystem SKILL.md to decide if the feature is already present. Matches any of: the `arka:feature:<name>` marker, the bare `## <section_title>` heading (legacy/customized sections), or — only where a token is unique enough to never appear in unrelated prose (e.g. `arka-forge`) — a historical keyword
+- `content` — the section to inject if missing, wrapped in `<!-- arka:feature:<name>:start -->` / `<!-- arka:feature:<name>:end -->` markers so future runs detect it and deprecation can remove it precisely
+- `deprecated_in` — if set, the matching section is removed (marker pair preferred; fall back to the `## <section_title>` heading block)
+
+The registry is self-detecting by contract: `detection_pattern` MUST match the feature's own `content` (locked by `tests/python/test_sync_features_registry.py`), otherwise every naive sync re-injects a duplicate section.
 
 ## Key Paths
 

package/departments/ops/skills/update/references/workflows.md

@@ -47,10 +47,10 @@ After the Python engine completes, dispatch ONE subagent.
 **Subagent task — for each `~/.claude/skills/arka-{ecosystem}/SKILL.md`:**
 1. Read the SKILL.md.
 2. For each feature YAML where `deprecated_in` is null:
-   - Search SKILL.md for `detection_pattern`.
-   - If NOT found: inject `content` after the last existing feature section, or after the "Commands" table if no feature sections exist (before "Orchestration Workflows").
+   - Apply the `detection_pattern` regex to the SKILL.md text. It matches the `arka:feature:<name>` marker, the bare `## <section_title>` heading, or a unique historical keyword — a customized section without markers still counts as present and MUST NOT be duplicated.
+   - If NOT found: inject `content` (already marker-wrapped) after the last existing feature section, or after the "Commands" table if no feature sections exist (before "Orchestration Workflows").
 3. For each feature where `deprecated_in` is set:
-   - Locate and remove the matching section.
+   - Remove the `<!-- arka:feature:<name>:start -->` … `:end -->` block when markers exist; otherwise remove the `## <section_title>` section.
 4. PRESERVE all custom content: commands, architecture, tech stack, business descriptions, ecosystem-specific workflow details.
 
 ### Report

package/installer/hook-lib.js

@@ -0,0 +1,25 @@
+import { existsSync, cpSync, chmodSync, readdirSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+
+// Deploys config/hooks/_lib/ (shared hook libraries — the Python
+// interpreter resolver lives here) into an install's hooks directory.
+// Single implementation shared by the fresh-install path
+// (index.js::installHooks) and the update path (update.js): the v4.3.2
+// regression existed precisely because the two deploy loops drifted.
+// Returns true when the lib dir was copied, false when the source has
+// no _lib/ to deploy.
+export function copyHookLib(srcHooksDir, destHooksDir) {
+  const srcLibDir = join(srcHooksDir, "_lib");
+  if (!existsSync(srcLibDir)) return false;
+  const destLibDir = join(destHooksDir, "_lib");
+  mkdirSync(destLibDir, { recursive: true });
+  cpSync(srcLibDir, destLibDir, { recursive: true });
+  // chmod is a no-op on Windows (NTFS ACLs aren't POSIX); the try/catch
+  // keeps the copy result authoritative even if it throws.
+  try {
+    for (const f of readdirSync(destLibDir)) {
+      if (f.endsWith(".sh")) chmodSync(join(destLibDir, f), 0o755);
+    }
+  } catch {}
+  return true;
+}

package/installer/index.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { getRuntimeConfig } from "./detect-runtime.js";
 import { findSystemPython, ensureVenv, getArkaosPython, getArkaosPip, pipInstall } from "./python-resolver.js";
 import { IS_WINDOWS, HOOK_EXT } from "./platform.js";
+import { copyHookLib } from "./hook-lib.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -665,16 +666,7 @@ function installHooks(installDir) {
     }
   }
 
-  const srcLibDir = join(srcHooksDir, "_lib");
-  if (existsSync(srcLibDir)) {
-    const destLibDir = join(hooksDir, "_lib");
-    ensureDir(destLibDir);
-    cpSync(srcLibDir, destLibDir, { recursive: true });
-    try {
-      for (const f of readdirSync(destLibDir)) {
-        if (f.endsWith(".sh")) chmodSync(join(destLibDir, f), 0o755);
-      }
-    } catch {}
+  if (copyHookLib(srcHooksDir, hooksDir)) {
     ok("Hook lib: _lib/");
   }
 }

package/installer/update.js

@@ -3,6 +3,7 @@ import { join, dirname, resolve } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { ensureVenv, ensureVenvHealthy, getArkaosPython, pipInstall } from "./python-resolver.js";
+import { copyHookLib } from "./hook-lib.js";
 import { getRuntimeConfig } from "./detect-runtime.js";
 import { loadAdapter } from "./index.js";
 import { migrateUserData, printMigrationReport } from "./migrate-user-data.js";
@@ -218,20 +219,10 @@ export async function update() {
   console.log("         ✓ Hook scripts updated");
 
   // Shared hook libraries (config/hooks/_lib/ — the Python interpreter
-  // resolver lives here). Keep in lockstep with index.js::installHooks:
-  // the hooks deployed above source _lib/arka_python.sh from the install
-  // dir, so skipping this copy leaves them falling back to a bare
-  // `python3` without ArkaOS deps.
-  const srcLibDir = join(srcHooksDir, "_lib");
-  if (existsSync(srcLibDir)) {
-    const destLibDir = join(destHooksDir, "_lib");
-    mkdirSync(destLibDir, { recursive: true });
-    cpSync(srcLibDir, destLibDir, { recursive: true });
-    try {
-      for (const f of readdirSync(destLibDir)) {
-        if (f.endsWith(".sh")) chmodSync(join(destLibDir, f), 0o755);
-      }
-    } catch {}
+  // resolver lives here). The hooks deployed above source
+  // _lib/arka_python.sh from the install dir, so skipping this copy
+  // leaves them falling back to a bare `python3` without ArkaOS deps.
+  if (copyHookLib(srcHooksDir, destHooksDir)) {
     console.log("         ✓ Hook lib updated (_lib/)");
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "4.3.3",
+  "version": "4.3.5",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {
@@ -45,7 +45,18 @@
     "departments/",
     "scripts/",
     "config/",
-    "bin/",
+    "bin/arka",
+    "bin/arka-claude",
+    "bin/arka-claude.cmd",
+    "bin/arka-claude.ps1",
+    "bin/arka-doctor",
+    "bin/arka-providers",
+    "bin/arka-py",
+    "bin/arka-py.cmd",
+    "bin/arka-py.ps1",
+    "bin/arka-skill",
+    "bin/arkaos",
+    "bin/scheduler-daemon.py",
     "arka/",
     "knowledge/",
     "dashboard/app/",

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "4.3.3"
+version = "4.3.5"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}

package/bin/arka-registry-gen

@@ -1,185 +0,0 @@
-#!/usr/bin/env bash
-# ============================================================================
-# ARKA OS — Commands Registry Generator
-# Scans SKILL.md files + keyword data to generate commands-registry.json
-# Usage: bash bin/arka-registry-gen
-# ============================================================================
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-KEYWORDS_FILE="$REPO_DIR/knowledge/commands-keywords.json"
-OUTPUT_FILE="$REPO_DIR/knowledge/commands-registry.json"
-ARKA_OS="${ARKA_OS:-$HOME/.claude/skills/arka}"
-TEMP_COMMANDS=$(mktemp)
-trap 'rm -f "$TEMP_COMMANDS"' EXIT
-
-# Require jq
-command -v jq &>/dev/null || { echo "Error: jq is required. Install: brew install jq"; exit 1; }
-
-# ─── Helper: Map department directory name to command prefix ───────────────
-dept_prefix_for() {
-  case "$1" in
-    dev)        echo "dev" ;;
-    marketing)  echo "mkt" ;;
-    ecommerce)  echo "ecom" ;;
-    finance)    echo "fin" ;;
-    operations) echo "ops" ;;
-    strategy)   echo "strat" ;;
-    knowledge)  echo "kb" ;;
-    brand)      echo "brand" ;;
-    *)          echo "$1" ;;
-  esac
-}
-
-# ─── Helper: Detect metadata for a command ─────────────────────────────────
-get_metadata() {
-  local command="$1"
-  local rw="false" mc="false" tier=2
-
-  case "$command" in
-    "/dev feature"*|"/dev api"*|"/dev debug"*|"/dev refactor"*|"/dev db"*)
-      rw="true"; mc="true"; tier=1 ;;
-    "/dev scaffold"*|"/dev deploy"*|"/dev test"*)
-      mc="true" ;;
-    "/dev security-audit"*)
-      tier=1 ;;
-  esac
-  echo "$rw $mc $tier"
-}
-
-# ─── Helper: Extract commands from a SKILL.md file ────────────────────────
-# Parses markdown tables: | `/<prefix> <command> [args]` | description |
-extract_commands() {
-  local file="$1"
-  local department="$2"
-  local source="${3:-builtin}"
-
-  [ -f "$file" ] || return 0
-
-  # Extract lead agent from frontmatter
-  local lead_agent=""
-  lead_agent=$(sed -n '/^---$/,/^---$/{ /^name:/s/.*: *//p; }' "$file" 2>/dev/null | head -1 | xargs 2>/dev/null || echo "")
-
-  # Parse command table rows
-  # Match: | `/<word> <word>...` | description |
-  # The backtick-wrapped command must START with / immediately after the backtick
-  grep -E '^\| *`/[a-z]' "$file" 2>/dev/null | while IFS= read -r line; do
-    # Extract command from backticks
-    local command
-    command=$(echo "$line" | sed -n 's/.*`\(\/[^`]*\)`.*/\1/p' | xargs 2>/dev/null)
-    [ -z "$command" ] && continue
-
-    # Extract description (second column)
-    local description
-    description=$(echo "$line" | sed 's/^[^|]*|[^|]*| *//' | sed 's/ *|.*//' | sed 's/^ *//;s/ *$//' | sed 's/^— *//;s/^- *//')
-    [ -z "$description" ] && continue
-    # Skip if description looks like a separator
-    echo "$description" | grep -qE '^[-]+$' && continue
-
-    # Generate command ID: /dev feature <desc> -> dev-feature
-    local id
-    id=$(echo "$command" | sed 's/ *<[^>]*>//g' | sed 's/ *\[.*//g' | sed 's/^\/\([^ ]*\) *\(.*\)/\1-\2/' | sed 's/-$//' | sed 's/ /-/g')
-    [ -z "$id" ] && continue
-
-    # Get metadata
-    local meta
-    meta=$(get_metadata "$command")
-    local rw mc tier
-    rw=$(echo "$meta" | cut -d' ' -f1)
-    mc=$(echo "$meta" | cut -d' ' -f2)
-    tier=$(echo "$meta" | cut -d' ' -f3)
-
-    # Output JSON line
-    jq -nc \
-      --arg id "$id" \
-      --arg command "$command" \
-      --arg department "$department" \
-      --arg description "$description" \
-      --arg lead_agent "$lead_agent" \
-      --argjson tier "$tier" \
-      --argjson requires_branch "$rw" \
-      --argjson modifies_code "$mc" \
-      --arg source "$source" \
-      '{id:$id,command:$command,department:$department,description:$description,lead_agent:$lead_agent,tier:$tier,requires_branch:$requires_branch,modifies_code:$modifies_code,keywords:[],examples:[],source:$source}'
-  done
-}
-
-# ─── Collect commands from all SKILL.md files ─────────────────────────────
-
-# Main orchestrator
-extract_commands "$REPO_DIR/arka/SKILL.md" "arka" >> "$TEMP_COMMANDS"
-
-# Department SKILL.md files
-for dept_dir in "$REPO_DIR"/departments/*/; do
-  [ -d "$dept_dir" ] || continue
-  dept_name=$(basename "$dept_dir")
-  dept_prefix=$(dept_prefix_for "$dept_name")
-
-  # Main department skill
-  [ -f "${dept_dir}SKILL.md" ] && extract_commands "${dept_dir}SKILL.md" "$dept_prefix" >> "$TEMP_COMMANDS"
-
-  # Sub-skills
-  for sub_skill in "${dept_dir}skills"/*/SKILL.md; do
-    [ -f "$sub_skill" ] || continue
-    extract_commands "$sub_skill" "$dept_prefix" >> "$TEMP_COMMANDS"
-  done
-done
-
-# External skills
-for ext_skill in "$HOME/.claude/skills"/arka-ext-*/SKILL.md; do
-  [ -f "$ext_skill" ] || continue
-  ext_name=$(basename "$(dirname "$ext_skill")" | sed 's/^arka-ext-//')
-  extract_commands "$ext_skill" "$ext_name" "external" >> "$TEMP_COMMANDS"
-done
-
-# Pro skills
-for pro_skill in "$HOME/.claude/skills"/arka-pro-*/SKILL.md; do
-  [ -f "$pro_skill" ] || continue
-  pro_name=$(basename "$(dirname "$pro_skill")" | sed 's/^arka-pro-//')
-  extract_commands "$pro_skill" "$pro_name" "pro" >> "$TEMP_COMMANDS"
-done
-
-# ─── Build commands array from temp file ───────────────────────────────────
-if [ -s "$TEMP_COMMANDS" ]; then
-  COMMANDS_JSON=$(jq -s '.' "$TEMP_COMMANDS")
-else
-  COMMANDS_JSON="[]"
-fi
-
-# ─── Deduplicate by command ID (keep first occurrence) ─────────────────────
-COMMANDS_JSON=$(echo "$COMMANDS_JSON" | jq '[group_by(.id) | .[] | .[0]]')
-
-# ─── Merge keywords and examples from seed data ───────────────────────────
-if [ -f "$KEYWORDS_FILE" ]; then
-  COMMANDS_JSON=$(jq --slurpfile kw "$KEYWORDS_FILE" '
-    [.[] | . as $cmd |
-      if $kw[0][$cmd.id] then
-        .keywords = ($kw[0][$cmd.id].keywords // []) |
-        .examples = ($kw[0][$cmd.id].examples // [])
-      else . end
-    ]
-  ' <<< "$COMMANDS_JSON")
-fi
-
-# ─── Build final registry ─────────────────────────────────────────────────
-TOTAL=$(echo "$COMMANDS_JSON" | jq 'length')
-NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-jq -n \
-  --arg version "1.0.0" \
-  --arg generated "$NOW" \
-  --argjson total "$TOTAL" \
-  --arg generator "bin/arka-registry-gen" \
-  --argjson commands "$COMMANDS_JSON" \
-  '{
-    _meta: {
-      version: $version,
-      generated: $generated,
-      total_commands: $total,
-      generator: $generator
-    },
-    commands: $commands
-  }' > "$OUTPUT_FILE"
-
-echo "Registry generated: $OUTPUT_FILE ($TOTAL commands)"