instar 1.3.1139 → 1.3.1141

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139",
+  "packageVersion": "1.3.1141",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "422eccbf1f686ac1baca812ee72a9dc62bad75bb662ab2482fa66457e9caedc4",
+  "sha256": "adce98bd928dd093c27e5fc91bcc6e5d9591b5214386ae330a7df922818f24db",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1141"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1141"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1139",
+  "version": "1.3.1141",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-no-unbounded-llm-spawn.js

@@ -66,7 +66,74 @@ const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs']);
 // `new <ProviderClass>(` — the construction. An IMPORT of the class is fine
 // (the factory imports them); only a direct `new …(` outside the funnel is a
 // bypass.
-const PATTERNS = PROVIDER_CLASSES.map((cls) => new RegExp(`\\bnew\\s+${cls}\\s*\\(`));
+//
+// ALIAS + NAMESPACE AWARE (2026-08-14). The original matched the class NAME as
+// literal text, so two ordinary import styles walked straight past a SAFETY
+// floor — the spawn cap added after the 2026-06-20 OOM fork-bomb:
+//
+//   import { ClaudeCliIntelligenceProvider as Provider } from '...';
+//   new Provider(...)                       // real uncapped construction, invisible
+//
+//   import * as mod from '...';
+//   new mod.ClaudeCliIntelligenceProvider(...)   // also invisible: `\bnew\s+Cls`
+//                                                // cannot match across `mod.`
+//
+// Found by a peer-agent audit for checks defeatable by renaming. Resolve the
+// local bindings FIRST, then match constructions under any of them.
+
+/** Every local name a provider class is bound to in this file, plus namespace forms.
+ *
+ *  Widened 2026-08-14 after a peer-agent SABOTAGE pass against the first version
+ *  found two SAME-FILE evasions the alias resolution missed:
+ *    const C = ClaudeCliIntelligenceProvider; new C({});   // plain re-binding
+ *    new Providers['ClaudeCliIntelligenceProvider']({});    // computed access
+ *  The first is probably the easiest bypass of all to write. Re-binding is
+ *  resolved to a FIXPOINT so chains (`const C = Cls; const D = C;`) close too. */
+export function localProviderBindings(content, cls) {
+  const names = new Set([cls]);
+  // `import { Cls as Alias }` and `const { Cls: Alias } = await import(...)`
+  for (const m of content.matchAll(new RegExp(`\\b${cls}\\s+as\\s+([A-Za-z_$][\\w$]*)`, 'g'))) names.add(m[1]);
+  for (const m of content.matchAll(new RegExp(`\\b${cls}\\s*:\\s*([A-Za-z_$][\\w$]*)`, 'g'))) names.add(m[1]);
+  // `const|let|var Alias = <knownName>;` — plain re-binding, resolved to a
+  // fixpoint so a chain of re-bindings cannot walk out of the set.
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const known of [...names]) {
+      const re = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*${known}\\s*[;,\\n]`, 'g');
+      for (const m of content.matchAll(re)) names.add(m[1]);
+    }
+    if (names.size === before) break;
+  }
+  return [...names];
+}
+
+/**
+ * Line numbers (1-based) in `content` that construct a spawn-capable provider,
+ * under ANY local binding or namespace qualifier. Comment-only lines excluded.
+ */
+export function findProviderConstructions(content, classes = PROVIDER_CLASSES) {
+  const hits = [];
+  const lines = content.split('\n');
+  const perClass = classes.map((cls) => ({
+    cls,
+    names: localProviderBindings(content, cls),
+  }));
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trimStart();
+    if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) continue;
+    for (const { cls, names } of perClass) {
+      const bare = names.some((n) => new RegExp(`\\bnew\\s+${n}\\s*\\(`).test(lines[i]));
+      // `new <ns>.<Cls>(` — a namespace import the bare form cannot see.
+      const viaNs = new RegExp(`\\bnew\\s+[A-Za-z_$][\\w$]*\\.${cls}\\s*\\(`).test(lines[i]);
+      // `new <ns>['<Cls>'](` — computed access; found by sabotage 2026-08-14.
+      const viaComputed = new RegExp(
+        `\\bnew\\s+[A-Za-z_$][\\w$]*\\s*\\[\\s*['"\`]${cls}['"\`]\\s*\\]\\s*\\(`,
+      ).test(lines[i]);
+      if (bare || viaNs || viaComputed) { hits.push({ line: i + 1, cls }); break; }
+    }
+  }
+  return hits;
+}
 
 function listFiles() {
   const staged = process.argv.includes('--staged');
@@ -96,6 +163,15 @@ function listFiles() {
   return files;
 }
 
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so the exported detector above can be imported by tests WITHOUT
+// running the scan — this module calls process.exit(1) on a violation, so an
+// unguarded import would kill any test run the moment the repo had one.
+// Same pattern as scripts/eli16-pr-description-check.mjs.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
 let violations = 0;
 for (const rel of listFiles()) {
   const normalized = rel.split(path.sep).join('/');
@@ -111,21 +187,13 @@ for (const rel of listFiles()) {
   } catch {
     continue;
   }
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    // Comment-only mentions are documentation, not a construction.
-    const trimmed = lines[i].trimStart();
-    if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) continue;
-    for (const pattern of PATTERNS) {
-      if (pattern.test(lines[i])) {
-        console.error(
-          `${normalized}:${i + 1} — direct LLM-CLI provider construction outside the spawn-cap funnel. ` +
-          `Build it through buildIntelligenceProvider() (which installs the host-wide spawn cap + circuit breaker), ` +
-          `or add an allowlist entry here with a spawn-bounding justification.`,
-        );
-        violations++;
-      }
-    }
+  for (const hit of findProviderConstructions(content)) {
+    console.error(
+      `${normalized}:${hit.line} — direct LLM-CLI provider construction outside the spawn-cap funnel. ` +
+      `Build it through buildIntelligenceProvider() (which installs the host-wide spawn cap + circuit breaker), ` +
+      `or add an allowlist entry here with a spawn-bounding justification.`,
+    );
+    violations++;
   }
 }
 
@@ -135,3 +203,4 @@ if (violations > 0) {
   process.exit(1);
 }
 console.log('lint-no-unbounded-llm-spawn: clean');
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T18:20:02.541Z",
-  "instarVersion": "1.3.1139",
+  "generatedAt": "2026-08-14T19:38:02.081Z",
+  "instarVersion": "1.3.1141",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139",
+  "packageVersion": "1.3.1141",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "422eccbf1f686ac1baca812ee72a9dc62bad75bb662ab2482fa66457e9caedc4",
+  "sha256": "adce98bd928dd093c27e5fc91bcc6e5d9591b5214386ae330a7df922818f24db",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1141"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1139"
+  "packageVersion": "1.3.1141"
 }

package/upgrades/1.3.1140.md

@@ -0,0 +1,30 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The check that stops an uncapped AI process being created outside its safety limit could be walked past by renaming an import.
+
+- **It matched the class by its name as literal text.** Two ordinary import styles defeat that: rename it on import and use the new name, or import the whole module and reach the class through it. Either is a real, uncapped construction that the check could not see.
+- **It now works out every local name the class is bound to** in a file before looking for constructions, and separately recognises the module-qualified form.
+- **The detection is now a separate importable function**, so it can be tested with small fixtures rather than only by running the whole check over the whole codebase.
+- **Importing it no longer runs it.** The command body stops the process when it finds a violation, so importing the detector in a test would have killed the test run the moment the codebase had one.
+- **No new rule and no new work.** The same constructions are forbidden as before; more of them are visible. The codebase passes cleanly both before and after.
+
+## What to Tell Your User
+
+In June this system created somewhere between two and three hundred AI processes at once and ran the machine out of memory. The fix was a hard ceiling, plus a check that refuses any code creating one of those processes outside the ceilinged path.
+
+That check looked for the thing by name, and renaming something on import is completely ordinary — so a real violation could sit there in plain sight and the check would report everything fine. Nothing was actually wrong today; the hole was in the guard, not the code it guards.
+
+It now recognises the renamed and module-qualified forms. This was chosen first out of twenty-five checks with the same weakness, because it guards a safety limit rather than a convention, and because the failure it prevents has already happened once.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see. No new command, route, setting, or rule, and no new violations are introduced.
+
+## Evidence
+
+The blindness was confirmed in the check's own source before any change: it built a pattern from the class name and tested it line by line, which cannot match across a module qualifier and matches nothing at all once the name is replaced by an alias. Proven in both directions — restricted back to name-only matching, five tests fail and six still pass, those six being the plain case and four deliberate opposite-direction controls: an import alone is not a construction, a comment mentioning the class is not, a differently-named class is not flagged, and a plain variable sharing the name is not. Without those, something that flagged everything would pass every test about catching bypasses and be useless on a healthy codebase. The real codebase passes cleanly before and after, so no false positives were introduced. Import-safety verified in both modes. Source restored byte-identical after the check.

package/upgrades/1.3.1141.md

@@ -0,0 +1,30 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+After hardening the runaway-process guard against renamed imports this morning, a second agent was asked to break it — and got past it twice more.
+
+- **Assigning the class to a variable and building from the variable** slipped through. That is probably the simplest bypass anyone could write, and it was not anticipated.
+- **Reaching the class out of a module with bracket notation** instead of a dot also slipped through.
+- **Both are now recognised.** Variable assignments are followed to a fixed point, so passing the class along several times cannot walk out of the set.
+- **The written statement of what the guard still misses has been corrected.** It named one kind of gap; there were three. Two of them were inside the ground the earlier fix implied was covered, so leaving that statement unchanged would have left a claim on record narrower than the truth.
+- **No new work.** The same constructions are forbidden as before, the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+This morning's fix made the guard understand renamed imports. It was then attacked on purpose, and two more ways past turned up — both of them ordinary code, both inside a single file, which is exactly what that fix claimed to have handled.
+
+Those are closed. Three ways past remain, all involving a class passed onward through several modules; closing those needs the check to follow symbols across files, which it does not do. That limit is now written down and pinned by a test, so nobody later mistakes it for an oversight.
+
+Worth noting how this was found: not by re-reading the fix, but by asking someone else to break it and telling them plainly that finding a hole would be more useful than a clean report. A review that can only confirm is not a review.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see and corrects a written claim about its limits. No new command, route, setting, or rule.
+
+## Evidence
+
+The two bypasses are the reviewer's own snippets, reproduced verbatim as tests. Proven in both directions: reverting both additions fails four tests while thirteen still pass — those thirteen including all six deliberate opposite-direction controls and a test that pins the remaining cross-module gap as still open. Among the controls is a new one specifically for this change: assigning an unrelated symbol to a variable and building from it is not flagged, because a rule that treated every variable as suspicious would pass every bypass test and fail on ordinary code. The real codebase passes cleanly before and after; source restored byte-identical after the check.