qiansc · Oct 19, 2026 · Oct 19, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 All notable changes to Context are documented here.
 
+## 0.7.73 - 2026-10-19
+
+- Plugin host discovery now preserves the inherited PATH, matching the environment used to launch commands, and safely quotes executable names.
+- Permission-sensitive production submission tests use a native temporary filesystem so shared development mounts do not change their assertions.
+
 ## 0.7.72 - 2026-10-15
 
 - Settling a source update or a revision queue no longer leaves `knowledge/structure.yaml` stale. When citations were relocated or repository content references advanced, the structure kept its previous input hash, so `verify` reported "Structure is stale; run Close" until Close ran again. The hash is now recomputed with the rewritten references; a structure that was already stale stays stale for Close.

diff --git a/bun.lock b/bun.lock
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "packageManager": "bun@1.3.9",
   "repository": {
     "type": "git",

diff --git a/packages/context-cli/context-workflow/provider.yaml b/packages/context-cli/context-workflow/provider.yaml
@@ -1,6 +1,6 @@
 schema: agent-graph.provider.v1
 id: c4a/context
-version: 0.7.72
+version: 0.7.73
 name: Context workflow
 description: Internal work contract for Context knowledge workspaces.
 graphs:

diff --git a/packages/context-cli/package.json b/packages/context-cli/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/context-cli",
   "description": "Local runtime and Agent integration for traceable knowledge production",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/context-cli/src/__tests__/pluginCommandAvailable.test.ts b/packages/context-cli/src/__tests__/pluginCommandAvailable.test.ts
@@ -0,0 +1,19 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { commandAvailable } from "../project/pluginInstallTargets.js";
+
+test("host discovery uses inherited PATH and treats command names literally", async () => {
+  const root = await mkdtemp(join(tmpdir(), "context-plugin-path-"));
+  const previous = process.env.PATH;
+  try {
+    await writeFile(join(root, "context test host"), "#!/bin/sh\nexit 0\n", { mode: 0o755 });
+    process.env.PATH = `${root}:${previous ?? "/usr/bin:/bin"}`;
+    expect(await commandAvailable("context test host")).toBe(true);
+    expect(await commandAvailable("missing-host; true")).toBe(false);
+  } finally {
+    process.env.PATH = previous;
+    await rm(root, { recursive: true, force: true });
+  }
+});
diff --git a/packages/context-cli/src/__tests__/productionSubmission.integration.test.ts b/packages/context-cli/src/__tests__/productionSubmission.integration.test.ts
@@ -1,6 +1,7 @@
 import { afterEach, expect, test } from "bun:test";
 import { chmod, cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import YAML from "yaml";
 import { execFileSync, spawnSync } from "node:child_process";
 import { completeProductionSubmission, productionSourceBaseline } from "../project/productionSubmission.js";
@@ -34,8 +35,7 @@ import { registerKnowledgeMaintenance, observeKnowledgeMaintenance, maintenanceR
 const roots: string[] = [];
 afterEach(async () => { for (const root of roots.splice(0)) await rm(root, { recursive: true, force: true }); });
 
-async function fixture(initialize = false) {
-  const parent = resolve(".tmp/production-submission-tests");
+async function fixture(initialize = false, parent = resolve(".tmp/production-submission-tests")) {
   await mkdir(parent, { recursive: true });
   const outer = await mkdtemp(join(parent, "case-"));
   roots.push(outer);
@@ -333,7 +333,8 @@ test("changed long-term scope blocks pending acceptance without discarding accep
 });
 
 test("accepted production reaches actual Review apply without a Provider compile or revision batch", async () => {
-  const f = await fixture(true);
+  // Permission failure checks need native filesystem semantics, not a host bind mount.
+  const f = await fixture(true, join(tmpdir(), "context-production-submission-tests"));
   // Isolate formal version discovery from the parent repository's ignored .tmp.
   execFileSync("git", ["init", "--quiet"], { cwd: f.root });
   await expect(readProductionReviewCandidates(f.root)).rejects.toThrow("Complete the current production stage");

diff --git a/packages/context-cli/src/project/indexerBaseContracts.ts b/packages/context-cli/src/project/indexerBaseContracts.ts
@@ -21,7 +21,7 @@ import { bundledMarkdownReaderQuestionContracts } from
   "./indexerBaseMarkdownAuthoringCatalog.js";
 
 const BASE_CONTRACT_VERSION = "1.1.0";
-export const BUNDLED_INDEXER_PARSER_PACKAGE_VERSION = "0.7.72";
+export const BUNDLED_INDEXER_PARSER_PACKAGE_VERSION = "0.7.73";
 const BUNDLED_PARSER_REQUIREMENTS = buildIndexerParserCapabilityRequirements(
   BUNDLED_INDEXER_PARSER_PACKAGE_VERSION,
 );

diff --git a/packages/context-cli/src/project/pluginInstallTargets.ts b/packages/context-cli/src/project/pluginInstallTargets.ts
@@ -59,7 +59,8 @@ async function runExternalOptional(command: string, args: readonly string[]): Pr
 }
 
 export async function commandAvailable(command: string): Promise<boolean> {
-  return runExternalOptional("sh", ["-lc", `command -v ${command} >/dev/null 2>&1`]);
+  // Probe the same inherited PATH used by execFile; login profiles can replace it.
+  return runExternalOptional("sh", ["-c", `command -v ${shellQuote(command)} >/dev/null 2>&1`]);
 }
 
 async function claudePluginInstalled(pluginId: string): Promise<boolean> {

diff --git a/packages/context/package.json b/packages/context/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/context",
   "description": "Declarative SDK for Context knowledge sources, workflows, review, and package outputs",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/core",
   "description": "Shared extraction types, schemas, and utilities for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/dev-cli/package.json b/packages/dev-cli/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/dev-cli",
   "description": "Developer menu for Context build, verification, link, and release preparation",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "private": true,
   "type": "module",
   "license": "MIT",

diff --git a/packages/extract-contract/package.json b/packages/extract-contract/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-contract",
   "description": "OpenAPI and GraphQL contract catalog adapter for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-go/package.json b/packages/extract-go/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-go",
   "description": "Go extraction plugin and structural index for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-mdx/package.json b/packages/extract-mdx/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-mdx",
   "description": "MDX component and example catalog bridge for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-proto/package.json b/packages/extract-proto/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-proto",
   "description": "Protocol Buffers IDL catalog parser for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-rush/package.json b/packages/extract-rush/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-rush",
   "description": "Rush workspace structural index for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-sql/package.json b/packages/extract-sql/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-sql",
   "description": "Dialect-bound lightweight SQL evidence adapter for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-style/package.json b/packages/extract-style/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-style",
   "description": "Lightweight CSS and SCSS evidence adapter for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-thrift/package.json b/packages/extract-thrift/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-thrift",
   "description": "Apache Thrift IDL catalog parser for Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract-ts/package.json b/packages/extract-ts/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract-ts",
   "description": "TypeScript and JavaScript extraction plugin for the Context ExtractionResult v2 contract",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/extract/package.json b/packages/extract/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/extract",
   "description": "Language-plugin framework and repository runner for Context code evidence",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "type": "module",
   "license": "MIT",
   "engines": {

diff --git a/packages/tui/package.json b/packages/tui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@c4a/tui",
   "description": "Shared terminal UI components (Ink + React) for Context development tools",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "private": true,
   "type": "module",
   "license": "MIT",

diff --git a/plugins/context/repo-install/claude/.claude-plugin/plugin.json b/plugins/context/repo-install/claude/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "c4a",
   "description": "Start or continue a project-local knowledge workspace through one graph-routed entry.",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "author": {
     "name": "c4a"
   },

diff --git a/plugins/context/repo-install/codex/.codex-plugin/plugin.json b/plugins/context/repo-install/codex/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "c4a",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "description": "Start or continue a project-local knowledge workspace through one graph-routed entry.",
   "author": { "name": "c4a" },
   "homepage": "https://github.com/context4ai/c4a",
@@ -10,7 +10,7 @@
   "skills": "./skills/",
   "interface": {
     "displayName": "C4A Context",
-    "shortDescription": "Initialize and advance a local, source-linked project knowledge workspace.\nv0.7.72",
+    "shortDescription": "Initialize and advance a local, source-linked project knowledge workspace.\nv0.7.73",
     "longDescription": "Create a Context workspace and use agent-guided next steps to register sources, run extraction, review candidates, build package outputs, and verify health without silently mutating source repositories.",
     "developerName": "c4a",
     "category": "Productivity",

diff --git a/plugins/context/repo-install/cursor/.cursor-plugin/plugin.json b/plugins/context/repo-install/cursor/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "c4a",
   "displayName": "C4A Context",
-  "version": "0.7.72",
+  "version": "0.7.73",
   "description": "Start or continue a project-local knowledge workspace through one graph-routed entry.",
   "author": {
     "name": "Context4AI",