arkaos 4.3.4 → 4.3.5

package/VERSION

@@ -1 +1 @@
-4.3.4
+4.3.5

package/config/hooks/cwd-changed.sh

@@ -28,40 +28,43 @@ ECOSYSTEM=""
 ECOSYSTEM_NAME=""
 
 if [ -f "$ECOSYSTEMS_FILE" ] && command -v "$ARKA_PY" >/dev/null 2>&1; then
-  eval "$("$ARKA_PY" -c "
+  # OWASP A03: NEW_CWD is untrusted harness input. It is passed through the
+  # environment (never interpolated into the Python source), and the result
+  # is emitted as JSON read by jq — no `eval`, so a crafted cwd can neither
+  # break the source string nor inject a shell command.
+  _ECO_JSON=$(ARKA_CWD="$NEW_CWD" ARKA_ECO_FILE="$ECOSYSTEMS_FILE" "$ARKA_PY" -c '
 import json, os, sys
 
-cwd = '$NEW_CWD'
-eco_file = os.path.expanduser('$ECOSYSTEMS_FILE')
+cwd = os.environ["ARKA_CWD"]
+eco_file = os.path.expanduser(os.environ["ARKA_ECO_FILE"])
+
+
+def emit(eco_id, name):
+    print(json.dumps({"ecosystem": eco_id, "name": name}))
+    sys.exit(0)
+
 
 try:
     data = json.load(open(eco_file))
-    ecosystems = data.get('ecosystems', {})
+    ecosystems = data.get("ecosystems", {})
 
     for eco_id, eco in ecosystems.items():
-        projects = eco.get('projects', [])
-        for proj in projects:
-            # Check if cwd contains the project name
+        for proj in eco.get("projects", []):
             if proj in cwd:
-                print(f'ECOSYSTEM=\"{eco_id}\"')
-                print(f'ECOSYSTEM_NAME=\"{eco.get(\"name\", eco_id)}\"')
-                sys.exit(0)
+                emit(eco_id, eco.get("name", eco_id))
 
-    # No match by project name, try by path patterns
-    if '/herd/' in cwd or '/Herd/' in cwd:
-        dir_name = os.path.basename(cwd.rstrip('/'))
+    if "/herd/" in cwd or "/Herd/" in cwd:
+        dir_name = os.path.basename(cwd.rstrip("/"))
         for eco_id, eco in ecosystems.items():
-            for proj in eco.get('projects', []):
-                if proj == dir_name:
-                    print(f'ECOSYSTEM=\"{eco_id}\"')
-                    print(f'ECOSYSTEM_NAME=\"{eco.get(\"name\", eco_id)}\"')
-                    sys.exit(0)
+            if dir_name in eco.get("projects", []):
+                emit(eco_id, eco.get("name", eco_id))
 except Exception:
     pass
 
-print('ECOSYSTEM=\"\"')
-print('ECOSYSTEM_NAME=\"\"')
-" 2>/dev/null)"
+print(json.dumps({"ecosystem": "", "name": ""}))
+' 2>/dev/null)
+  ECOSYSTEM=$(echo "$_ECO_JSON" | jq -r '.ecosystem // ""' 2>/dev/null)
+  ECOSYSTEM_NAME=$(echo "$_ECO_JSON" | jq -r '.name // ""' 2>/dev/null)
 fi
 
 # ─── Detect stack ──────────────────────────────────────────────────────
@@ -113,5 +116,7 @@ if [ -n "$DESCRIPTOR" ]; then
 fi
 
 if [ -n "$CONTEXT" ]; then
-  echo "{\"additionalContext\": \"${CONTEXT}\"}"
+  # Build the JSON with jq so any quote/backslash in the ecosystem name or
+  # descriptor path is escaped, never breaking the envelope (OWASP A03).
+  jq -nc --arg ctx "$CONTEXT" '{additionalContext: $ctx}'
 fi

package/config/hooks/session-start.sh

@@ -184,8 +184,11 @@ except Exception:
 fi
 
 # ─── Output as systemMessage (same protocol as claude-mem) ─────────────
-"$ARKA_PY" -c "
-import json
-msg = '''$(echo -e "$MSG")'''
-print(json.dumps({'systemMessage': msg}))
+# OWASP A03: MSG carries profile-derived NAME/COMPANY. Pass it through the
+# environment (with \n already expanded) rather than interpolating it into
+# the Python source, so a name containing quotes or ''' cannot break the
+# script or the JSON envelope.
+ARKA_MSG="$(echo -e "$MSG")" "$ARKA_PY" -c "
+import json, os
+print(json.dumps({'systemMessage': os.environ['ARKA_MSG']}))
 "

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "4.3.4",
+  "version": "4.3.5",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {
@@ -45,7 +45,18 @@
     "departments/",
     "scripts/",
     "config/",
-    "bin/",
+    "bin/arka",
+    "bin/arka-claude",
+    "bin/arka-claude.cmd",
+    "bin/arka-claude.ps1",
+    "bin/arka-doctor",
+    "bin/arka-providers",
+    "bin/arka-py",
+    "bin/arka-py.cmd",
+    "bin/arka-py.ps1",
+    "bin/arka-skill",
+    "bin/arkaos",
+    "bin/scheduler-daemon.py",
     "arka/",
     "knowledge/",
     "dashboard/app/",

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "4.3.4"
+version = "4.3.5"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}

package/bin/arka-registry-gen

@@ -1,185 +0,0 @@
-#!/usr/bin/env bash
-# ============================================================================
-# ARKA OS — Commands Registry Generator
-# Scans SKILL.md files + keyword data to generate commands-registry.json
-# Usage: bash bin/arka-registry-gen
-# ============================================================================
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-KEYWORDS_FILE="$REPO_DIR/knowledge/commands-keywords.json"
-OUTPUT_FILE="$REPO_DIR/knowledge/commands-registry.json"
-ARKA_OS="${ARKA_OS:-$HOME/.claude/skills/arka}"
-TEMP_COMMANDS=$(mktemp)
-trap 'rm -f "$TEMP_COMMANDS"' EXIT
-
-# Require jq
-command -v jq &>/dev/null || { echo "Error: jq is required. Install: brew install jq"; exit 1; }
-
-# ─── Helper: Map department directory name to command prefix ───────────────
-dept_prefix_for() {
-  case "$1" in
-    dev)        echo "dev" ;;
-    marketing)  echo "mkt" ;;
-    ecommerce)  echo "ecom" ;;
-    finance)    echo "fin" ;;
-    operations) echo "ops" ;;
-    strategy)   echo "strat" ;;
-    knowledge)  echo "kb" ;;
-    brand)      echo "brand" ;;
-    *)          echo "$1" ;;
-  esac
-}
-
-# ─── Helper: Detect metadata for a command ─────────────────────────────────
-get_metadata() {
-  local command="$1"
-  local rw="false" mc="false" tier=2
-
-  case "$command" in
-    "/dev feature"*|"/dev api"*|"/dev debug"*|"/dev refactor"*|"/dev db"*)
-      rw="true"; mc="true"; tier=1 ;;
-    "/dev scaffold"*|"/dev deploy"*|"/dev test"*)
-      mc="true" ;;
-    "/dev security-audit"*)
-      tier=1 ;;
-  esac
-  echo "$rw $mc $tier"
-}
-
-# ─── Helper: Extract commands from a SKILL.md file ────────────────────────
-# Parses markdown tables: | `/<prefix> <command> [args]` | description |
-extract_commands() {
-  local file="$1"
-  local department="$2"
-  local source="${3:-builtin}"
-
-  [ -f "$file" ] || return 0
-
-  # Extract lead agent from frontmatter
-  local lead_agent=""
-  lead_agent=$(sed -n '/^---$/,/^---$/{ /^name:/s/.*: *//p; }' "$file" 2>/dev/null | head -1 | xargs 2>/dev/null || echo "")
-
-  # Parse command table rows
-  # Match: | `/<word> <word>...` | description |
-  # The backtick-wrapped command must START with / immediately after the backtick
-  grep -E '^\| *`/[a-z]' "$file" 2>/dev/null | while IFS= read -r line; do
-    # Extract command from backticks
-    local command
-    command=$(echo "$line" | sed -n 's/.*`\(\/[^`]*\)`.*/\1/p' | xargs 2>/dev/null)
-    [ -z "$command" ] && continue
-
-    # Extract description (second column)
-    local description
-    description=$(echo "$line" | sed 's/^[^|]*|[^|]*| *//' | sed 's/ *|.*//' | sed 's/^ *//;s/ *$//' | sed 's/^— *//;s/^- *//')
-    [ -z "$description" ] && continue
-    # Skip if description looks like a separator
-    echo "$description" | grep -qE '^[-]+$' && continue
-
-    # Generate command ID: /dev feature <desc> -> dev-feature
-    local id
-    id=$(echo "$command" | sed 's/ *<[^>]*>//g' | sed 's/ *\[.*//g' | sed 's/^\/\([^ ]*\) *\(.*\)/\1-\2/' | sed 's/-$//' | sed 's/ /-/g')
-    [ -z "$id" ] && continue
-
-    # Get metadata
-    local meta
-    meta=$(get_metadata "$command")
-    local rw mc tier
-    rw=$(echo "$meta" | cut -d' ' -f1)
-    mc=$(echo "$meta" | cut -d' ' -f2)
-    tier=$(echo "$meta" | cut -d' ' -f3)
-
-    # Output JSON line
-    jq -nc \
-      --arg id "$id" \
-      --arg command "$command" \
-      --arg department "$department" \
-      --arg description "$description" \
-      --arg lead_agent "$lead_agent" \
-      --argjson tier "$tier" \
-      --argjson requires_branch "$rw" \
-      --argjson modifies_code "$mc" \
-      --arg source "$source" \
-      '{id:$id,command:$command,department:$department,description:$description,lead_agent:$lead_agent,tier:$tier,requires_branch:$requires_branch,modifies_code:$modifies_code,keywords:[],examples:[],source:$source}'
-  done
-}
-
-# ─── Collect commands from all SKILL.md files ─────────────────────────────
-
-# Main orchestrator
-extract_commands "$REPO_DIR/arka/SKILL.md" "arka" >> "$TEMP_COMMANDS"
-
-# Department SKILL.md files
-for dept_dir in "$REPO_DIR"/departments/*/; do
-  [ -d "$dept_dir" ] || continue
-  dept_name=$(basename "$dept_dir")
-  dept_prefix=$(dept_prefix_for "$dept_name")
-
-  # Main department skill
-  [ -f "${dept_dir}SKILL.md" ] && extract_commands "${dept_dir}SKILL.md" "$dept_prefix" >> "$TEMP_COMMANDS"
-
-  # Sub-skills
-  for sub_skill in "${dept_dir}skills"/*/SKILL.md; do
-    [ -f "$sub_skill" ] || continue
-    extract_commands "$sub_skill" "$dept_prefix" >> "$TEMP_COMMANDS"
-  done
-done
-
-# External skills
-for ext_skill in "$HOME/.claude/skills"/arka-ext-*/SKILL.md; do
-  [ -f "$ext_skill" ] || continue
-  ext_name=$(basename "$(dirname "$ext_skill")" | sed 's/^arka-ext-//')
-  extract_commands "$ext_skill" "$ext_name" "external" >> "$TEMP_COMMANDS"
-done
-
-# Pro skills
-for pro_skill in "$HOME/.claude/skills"/arka-pro-*/SKILL.md; do
-  [ -f "$pro_skill" ] || continue
-  pro_name=$(basename "$(dirname "$pro_skill")" | sed 's/^arka-pro-//')
-  extract_commands "$pro_skill" "$pro_name" "pro" >> "$TEMP_COMMANDS"
-done
-
-# ─── Build commands array from temp file ───────────────────────────────────
-if [ -s "$TEMP_COMMANDS" ]; then
-  COMMANDS_JSON=$(jq -s '.' "$TEMP_COMMANDS")
-else
-  COMMANDS_JSON="[]"
-fi
-
-# ─── Deduplicate by command ID (keep first occurrence) ─────────────────────
-COMMANDS_JSON=$(echo "$COMMANDS_JSON" | jq '[group_by(.id) | .[] | .[0]]')
-
-# ─── Merge keywords and examples from seed data ───────────────────────────
-if [ -f "$KEYWORDS_FILE" ]; then
-  COMMANDS_JSON=$(jq --slurpfile kw "$KEYWORDS_FILE" '
-    [.[] | . as $cmd |
-      if $kw[0][$cmd.id] then
-        .keywords = ($kw[0][$cmd.id].keywords // []) |
-        .examples = ($kw[0][$cmd.id].examples // [])
-      else . end
-    ]
-  ' <<< "$COMMANDS_JSON")
-fi
-
-# ─── Build final registry ─────────────────────────────────────────────────
-TOTAL=$(echo "$COMMANDS_JSON" | jq 'length')
-NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-jq -n \
-  --arg version "1.0.0" \
-  --arg generated "$NOW" \
-  --argjson total "$TOTAL" \
-  --arg generator "bin/arka-registry-gen" \
-  --argjson commands "$COMMANDS_JSON" \
-  '{
-    _meta: {
-      version: $version,
-      generated: $generated,
-      total_commands: $total,
-      generator: $generator
-    },
-    commands: $commands
-  }' > "$OUTPUT_FILE"
-
-echo "Registry generated: $OUTPUT_FILE ($TOTAL commands)"