instar 1.3.1139 → 1.3.1140

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139",
+  "packageVersion": "1.3.1140",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "422eccbf1f686ac1baca812ee72a9dc62bad75bb662ab2482fa66457e9caedc4",
+  "sha256": "15c9d6c3753ee5491f6774991e683e3b99cc67f05376ab66dcbd63ebd26a9f38",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1140"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1140"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1139",
+  "version": "1.3.1140",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-no-unbounded-llm-spawn.js

@@ -66,7 +66,53 @@ const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs']);
 // `new <ProviderClass>(` — the construction. An IMPORT of the class is fine
 // (the factory imports them); only a direct `new …(` outside the funnel is a
 // bypass.
-const PATTERNS = PROVIDER_CLASSES.map((cls) => new RegExp(`\\bnew\\s+${cls}\\s*\\(`));
+//
+// ALIAS + NAMESPACE AWARE (2026-08-14). The original matched the class NAME as
+// literal text, so two ordinary import styles walked straight past a SAFETY
+// floor — the spawn cap added after the 2026-06-20 OOM fork-bomb:
+//
+//   import { ClaudeCliIntelligenceProvider as Provider } from '...';
+//   new Provider(...)                       // real uncapped construction, invisible
+//
+//   import * as mod from '...';
+//   new mod.ClaudeCliIntelligenceProvider(...)   // also invisible: `\bnew\s+Cls`
+//                                                // cannot match across `mod.`
+//
+// Found by a peer-agent audit for checks defeatable by renaming. Resolve the
+// local bindings FIRST, then match constructions under any of them.
+
+/** Every local name a provider class is bound to in this file, plus namespace forms. */
+export function localProviderBindings(content, cls) {
+  const names = new Set([cls]);
+  // `import { Cls as Alias }` and `const { Cls: Alias } = await import(...)`
+  for (const m of content.matchAll(new RegExp(`\\b${cls}\\s+as\\s+([A-Za-z_$][\\w$]*)`, 'g'))) names.add(m[1]);
+  for (const m of content.matchAll(new RegExp(`\\b${cls}\\s*:\\s*([A-Za-z_$][\\w$]*)`, 'g'))) names.add(m[1]);
+  return [...names];
+}
+
+/**
+ * Line numbers (1-based) in `content` that construct a spawn-capable provider,
+ * under ANY local binding or namespace qualifier. Comment-only lines excluded.
+ */
+export function findProviderConstructions(content, classes = PROVIDER_CLASSES) {
+  const hits = [];
+  const lines = content.split('\n');
+  const perClass = classes.map((cls) => ({
+    cls,
+    names: localProviderBindings(content, cls),
+  }));
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trimStart();
+    if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) continue;
+    for (const { cls, names } of perClass) {
+      const bare = names.some((n) => new RegExp(`\\bnew\\s+${n}\\s*\\(`).test(lines[i]));
+      // `new <ns>.<Cls>(` — a namespace import the bare form cannot see.
+      const viaNs = new RegExp(`\\bnew\\s+[A-Za-z_$][\\w$]*\\.${cls}\\s*\\(`).test(lines[i]);
+      if (bare || viaNs) { hits.push({ line: i + 1, cls }); break; }
+    }
+  }
+  return hits;
+}
 
 function listFiles() {
   const staged = process.argv.includes('--staged');
@@ -96,6 +142,15 @@ function listFiles() {
   return files;
 }
 
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so the exported detector above can be imported by tests WITHOUT
+// running the scan — this module calls process.exit(1) on a violation, so an
+// unguarded import would kill any test run the moment the repo had one.
+// Same pattern as scripts/eli16-pr-description-check.mjs.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
 let violations = 0;
 for (const rel of listFiles()) {
   const normalized = rel.split(path.sep).join('/');
@@ -111,21 +166,13 @@ for (const rel of listFiles()) {
   } catch {
     continue;
   }
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    // Comment-only mentions are documentation, not a construction.
-    const trimmed = lines[i].trimStart();
-    if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) continue;
-    for (const pattern of PATTERNS) {
-      if (pattern.test(lines[i])) {
-        console.error(
-          `${normalized}:${i + 1} — direct LLM-CLI provider construction outside the spawn-cap funnel. ` +
-          `Build it through buildIntelligenceProvider() (which installs the host-wide spawn cap + circuit breaker), ` +
-          `or add an allowlist entry here with a spawn-bounding justification.`,
-        );
-        violations++;
-      }
-    }
+  for (const hit of findProviderConstructions(content)) {
+    console.error(
+      `${normalized}:${hit.line} — direct LLM-CLI provider construction outside the spawn-cap funnel. ` +
+      `Build it through buildIntelligenceProvider() (which installs the host-wide spawn cap + circuit breaker), ` +
+      `or add an allowlist entry here with a spawn-bounding justification.`,
+    );
+    violations++;
   }
 }
 
@@ -135,3 +182,4 @@ if (violations > 0) {
   process.exit(1);
 }
 console.log('lint-no-unbounded-llm-spawn: clean');
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T18:20:02.541Z",
-  "instarVersion": "1.3.1139",
+  "generatedAt": "2026-08-14T19:14:01.581Z",
+  "instarVersion": "1.3.1140",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139",
+  "packageVersion": "1.3.1140",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "422eccbf1f686ac1baca812ee72a9dc62bad75bb662ab2482fa66457e9caedc4",
+  "sha256": "15c9d6c3753ee5491f6774991e683e3b99cc67f05376ab66dcbd63ebd26a9f38",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1140"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1140"
 }

package/upgrades/1.3.1140.md

@@ -0,0 +1,30 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The check that stops an uncapped AI process being created outside its safety limit could be walked past by renaming an import.
+
+- **It matched the class by its name as literal text.** Two ordinary import styles defeat that: rename it on import and use the new name, or import the whole module and reach the class through it. Either is a real, uncapped construction that the check could not see.
+- **It now works out every local name the class is bound to** in a file before looking for constructions, and separately recognises the module-qualified form.
+- **The detection is now a separate importable function**, so it can be tested with small fixtures rather than only by running the whole check over the whole codebase.
+- **Importing it no longer runs it.** The command body stops the process when it finds a violation, so importing the detector in a test would have killed the test run the moment the codebase had one.
+- **No new rule and no new work.** The same constructions are forbidden as before; more of them are visible. The codebase passes cleanly both before and after.
+
+## What to Tell Your User
+
+In June this system created somewhere between two and three hundred AI processes at once and ran the machine out of memory. The fix was a hard ceiling, plus a check that refuses any code creating one of those processes outside the ceilinged path.
+
+That check looked for the thing by name, and renaming something on import is completely ordinary — so a real violation could sit there in plain sight and the check would report everything fine. Nothing was actually wrong today; the hole was in the guard, not the code it guards.
+
+It now recognises the renamed and module-qualified forms. This was chosen first out of twenty-five checks with the same weakness, because it guards a safety limit rather than a convention, and because the failure it prevents has already happened once.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see. No new command, route, setting, or rule, and no new violations are introduced.
+
+## Evidence
+
+The blindness was confirmed in the check's own source before any change: it built a pattern from the class name and tested it line by line, which cannot match across a module qualifier and matches nothing at all once the name is replaced by an alias. Proven in both directions — restricted back to name-only matching, five tests fail and six still pass, those six being the plain case and four deliberate opposite-direction controls: an import alone is not a construction, a comment mentioning the class is not, a differently-named class is not flagged, and a plain variable sharing the name is not. Without those, something that flagged everything would pass every test about catching bypasses and be useless on a healthy codebase. The real codebase passes cleanly before and after, so no false positives were introduced. Import-safety verified in both modes. Source restored byte-identical after the check.