Skip to content

Arkiv 0.3.1: hardened context hook and import check

Latest
Latest

Choose a tag to compare

View all tags
@SantiagoDevRel SantiagoDevRel released this 17 Oct 17:22
· 2 commits to main since this release
arkiv--v0.3.1
2a23695
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Plugin 0.3.1 hardens the local SDK context hook and the installed-import check added in 0.3.0. On ordinary projects the agent sees the same SDK context as before.

Fixes

Each fix began as a failing test.

  • Context text is fixed. The hook injects only text made entirely of its own fact lines, whatever answers on the session's local IPC name. Installed versions are measured only up to six digits per part.
  • Import check never echoes unusual imports. It reports unmeasured for any SDK import that is not a plain package subpath with short names. Re-export reads are bounded: each declaration file is read once, at most 128 per check. Canonical skills Arkiv-Network/skills@cd8bb37 (#63).
  • Four edge cases are now handled correctly:
    • A hook request retried after a lost reply still delivers its change.
    • A declaration-only change re-states the declaration count.
    • A workspaces root (a workspaces field, pnpm-workspace.yaml or lerna.json) with no SDK dependency of its own is unmeasured instead of absent.
    • An SDK found above the lockfile's folder is no longer confirmed by that lock.
  • The Codex manifest now carries the shared keywords.

Evidence

  • 88/88 tests on Linux ARM64. 87/88 on Windows, where one Linux-only test is skipped. claude plugin validate --strict passes.
  • Comparison with 0.3.0 on ordinary inputs:
    • 320 comparisons on both hosts, with and without the session process, using six SDK fixtures and eight import-check files.
    • The injected text is identical in all of them, so the October 16 ablation still applies.
  • Public installs of 0.3.1 in isolated Windows profiles match the repository packages exactly: 347 Claude files and 47 Codex files. Both updated from 0.3.0.
  • Native sessions from those installs, run on Claude Code 2.1.302 and Codex CLI 0.163.0:
    • Claude: 54/54 checks. They cover every category, file and directory changes, compaction, /clear, resume, the import check, 8 concurrent sessions, missing Node and the connection header.
    • Codex: 20/20 checks. They cover every category, resume, the untrusted-hook gate, cleanup and the header.
    • Long session: one Claude session ran for 11 minutes, past the 600-second timeout of the asynchronous hook that starts its session process. That process stayed up and delivered a later SDK downgrade correctly.
    • No production traffic: Claude ran with no MCP servers, and Codex used a local mock.

Update

  • Claude Code: claude plugin marketplace update arkiv, then claude plugin update arkiv@arkiv, then restart.
  • Codex CLI: codex plugin marketplace upgrade arkiv, then codex plugin add arkiv@arkiv, then start a new session. If you have not trusted the Arkiv hooks yet, do it once with /hooks.
Assets 2
Loading