instar 1.3.1140 → 1.3.1142

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1140",
+  "packageVersion": "1.3.1142",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "15c9d6c3753ee5491f6774991e683e3b99cc67f05376ab66dcbd63ebd26a9f38",
+  "sha256": "588004e7496311e759c00e2ee9419b8385e05ca9cedff117ec3e44c9f78d73e2",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1140"
+  "packageVersion": "1.3.1142"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1140"
+  "packageVersion": "1.3.1142"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1140",
+  "version": "1.3.1142",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-no-unbounded-llm-spawn.js

@@ -81,12 +81,29 @@ const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs']);
 // Found by a peer-agent audit for checks defeatable by renaming. Resolve the
 // local bindings FIRST, then match constructions under any of them.
 
-/** Every local name a provider class is bound to in this file, plus namespace forms. */
+/** Every local name a provider class is bound to in this file, plus namespace forms.
+ *
+ *  Widened 2026-08-14 after a peer-agent SABOTAGE pass against the first version
+ *  found two SAME-FILE evasions the alias resolution missed:
+ *    const C = ClaudeCliIntelligenceProvider; new C({});   // plain re-binding
+ *    new Providers['ClaudeCliIntelligenceProvider']({});    // computed access
+ *  The first is probably the easiest bypass of all to write. Re-binding is
+ *  resolved to a FIXPOINT so chains (`const C = Cls; const D = C;`) close too. */
 export function localProviderBindings(content, cls) {
   const names = new Set([cls]);
   // `import { Cls as Alias }` and `const { Cls: Alias } = await import(...)`
   for (const m of content.matchAll(new RegExp(`\\b${cls}\\s+as\\s+([A-Za-z_$][\\w$]*)`, 'g'))) names.add(m[1]);
   for (const m of content.matchAll(new RegExp(`\\b${cls}\\s*:\\s*([A-Za-z_$][\\w$]*)`, 'g'))) names.add(m[1]);
+  // `const|let|var Alias = <knownName>;` — plain re-binding, resolved to a
+  // fixpoint so a chain of re-bindings cannot walk out of the set.
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const known of [...names]) {
+      const re = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*${known}\\s*[;,\\n]`, 'g');
+      for (const m of content.matchAll(re)) names.add(m[1]);
+    }
+    if (names.size === before) break;
+  }
   return [...names];
 }
 
@@ -108,7 +125,11 @@ export function findProviderConstructions(content, classes = PROVIDER_CLASSES) {
       const bare = names.some((n) => new RegExp(`\\bnew\\s+${n}\\s*\\(`).test(lines[i]));
       // `new <ns>.<Cls>(` — a namespace import the bare form cannot see.
       const viaNs = new RegExp(`\\bnew\\s+[A-Za-z_$][\\w$]*\\.${cls}\\s*\\(`).test(lines[i]);
-      if (bare || viaNs) { hits.push({ line: i + 1, cls }); break; }
+      // `new <ns>['<Cls>'](` — computed access; found by sabotage 2026-08-14.
+      const viaComputed = new RegExp(
+        `\\bnew\\s+[A-Za-z_$][\\w$]*\\s*\\[\\s*['"\`]${cls}['"\`]\\s*\\]\\s*\\(`,
+      ).test(lines[i]);
+      if (bare || viaNs || viaComputed) { hits.push({ line: i + 1, cls }); break; }
     }
   }
   return hits;

package/scripts/lint-no-unfunneled-credential-write.js

@@ -86,6 +86,83 @@ const PATTERNS = [
 // services) are never false-positived.
 const RAW_KEYCHAIN_WRITE = /add-generic-password/;
 
+// ── Evasion-resistant detection (2026-08-14) ─────────────────────────────
+// A peer-agent audit classified this check DEFEATABLE by ordinary renaming,
+// and three bypasses were then reproduced against it:
+//
+//   const SVC = 'Claude Code' + '-credentials';         // concatenated service
+//   execFileSync('security', ['add-generic-password', '-s', SVC]);
+//   const store = defaultCredentialStore; store.write(p);  // re-bound receiver
+//   provider['writeCredentials'](p);                       // computed access
+//
+// The first is the sharpest: the raw-keychain rule is GATED on the literal
+// service string appearing in the file, so splitting it across a concatenation
+// switches the whole rule off. That gate exists to avoid false-positiving the
+// other, distinct-service vaults, so it is narrowed rather than removed.
+
+/** Collapse simple adjacent string concatenation so `'A' + 'B'` reads as `AB`. */
+export function collapseConcatenation(content) {
+  // `'A' + 'B'` / "A" + "B" / mixed quotes → `AB`. Repeated to fold chains.
+  let out = content;
+  for (let i = 0; i < 5; i++) {
+    const next = out.replace(/(['"])\s*\+\s*(['"])/g, '');
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+/** Local names bound to `defaultCredentialStore`, resolved to a fixpoint. */
+export function credentialStoreBindings(content) {
+  const names = new Set(['defaultCredentialStore']);
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const known of [...names]) {
+      const re = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*${known}\\s*[;,\\n]`, 'g');
+      for (const m of content.matchAll(re)) names.add(m[1]);
+    }
+    if (names.size === before) break;
+  }
+  return [...names];
+}
+
+/**
+ * Violations in `content`, as { line, msg }. Exported so the rules can be
+ * driven with fixtures rather than only end-to-end over the tree.
+ */
+export function findCredentialWriteViolations(content) {
+  const hits = [];
+  // Concatenation-tolerant: a split service literal no longer disarms the rule.
+  const targetsGuardedService = collapseConcatenation(content).includes(GUARDED_SERVICE);
+  const storeNames = credentialStoreBindings(content);
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (isCommentLine(line)) continue;
+    // Re-bound receiver + computed access on the store write.
+    for (const n of storeNames) {
+      if (new RegExp(`\\b${n}\\s*\\.\\s*write\\s*\\(`).test(line)
+        || new RegExp(`\\b${n}\\s*\\[\\s*['"\`]write['"\`]\\s*\\]\\s*\\(`).test(line)) {
+        hits.push({ line: i + 1, msg: PATTERNS[0].msg });
+        break;
+      }
+    }
+    // `.writeCredentials(` and its computed form.
+    if (/\.writeCredentials\s*\(/.test(line)
+      || /\[\s*['"`]writeCredentials['"`]\s*\]\s*\(/.test(line)) {
+      hits.push({ line: i + 1, msg: PATTERNS[1].msg });
+    }
+    if (targetsGuardedService && RAW_KEYCHAIN_WRITE.test(line)) {
+      hits.push({
+        line: i + 1,
+        msg: `raw 'add-generic-password' to the ${GUARDED_SERVICE} service outside the funnel. `
+          + `Route the write through CredentialWriteFunnel.withSlotLock, or add an allowlist entry here with a justification.`,
+      });
+    }
+  }
+  return hits;
+}
+
 function isCommentLine(line) {
   const t = line.trim();
   return t.startsWith('//') || t.startsWith('*') || t.startsWith('/*') || t.startsWith('#');
@@ -118,6 +195,15 @@ function listFiles() {
   return files;
 }
 
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so the exported detector can be imported by tests WITHOUT running the
+// scan: this module calls process.exit(1) on a violation, so an unguarded
+// import would kill any test run the moment the repo had one. Same pattern as
+// scripts/eli16-pr-description-check.mjs and lint-no-unbounded-llm-spawn.js.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
 let violations = 0;
 for (const rel of listFiles()) {
   const normalized = rel.split(path.sep).join('/');
@@ -130,25 +216,9 @@ for (const rel of listFiles()) {
   } catch {
     continue;
   }
-  const fileTargetsGuardedService = content.includes(GUARDED_SERVICE);
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (isCommentLine(line)) continue;
-    for (const { re, msg } of PATTERNS) {
-      if (re.test(line)) {
-        console.error(`${normalized}:${i + 1} — ${msg}`);
-        violations++;
-      }
-    }
-    if (fileTargetsGuardedService && RAW_KEYCHAIN_WRITE.test(line)) {
-      console.error(
-        `${normalized}:${i + 1} — raw 'add-generic-password' to the ${GUARDED_SERVICE} service outside ` +
-        `the funnel. Route the write through CredentialWriteFunnel.withSlotLock, or add an allowlist entry ` +
-        `here with a justification.`,
-      );
-      violations++;
-    }
+  for (const hit of findCredentialWriteViolations(content)) {
+    console.error(`${normalized}:${hit.line} — ${hit.msg}`);
+    violations++;
   }
 }
 
@@ -160,3 +230,4 @@ if (violations > 0) {
   process.exit(1);
 }
 console.log('lint-no-unfunneled-credential-write: clean');
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T19:14:01.581Z",
-  "instarVersion": "1.3.1140",
+  "generatedAt": "2026-08-14T20:03:30.012Z",
+  "instarVersion": "1.3.1142",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1140",
+  "packageVersion": "1.3.1142",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "15c9d6c3753ee5491f6774991e683e3b99cc67f05376ab66dcbd63ebd26a9f38",
+  "sha256": "588004e7496311e759c00e2ee9419b8385e05ca9cedff117ec3e44c9f78d73e2",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1140"
+  "packageVersion": "1.3.1142"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1140"
+  "packageVersion": "1.3.1142"
 }

package/upgrades/1.3.1141.md

@@ -0,0 +1,30 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+After hardening the runaway-process guard against renamed imports this morning, a second agent was asked to break it — and got past it twice more.
+
+- **Assigning the class to a variable and building from the variable** slipped through. That is probably the simplest bypass anyone could write, and it was not anticipated.
+- **Reaching the class out of a module with bracket notation** instead of a dot also slipped through.
+- **Both are now recognised.** Variable assignments are followed to a fixed point, so passing the class along several times cannot walk out of the set.
+- **The written statement of what the guard still misses has been corrected.** It named one kind of gap; there were three. Two of them were inside the ground the earlier fix implied was covered, so leaving that statement unchanged would have left a claim on record narrower than the truth.
+- **No new work.** The same constructions are forbidden as before, the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+This morning's fix made the guard understand renamed imports. It was then attacked on purpose, and two more ways past turned up — both of them ordinary code, both inside a single file, which is exactly what that fix claimed to have handled.
+
+Those are closed. Three ways past remain, all involving a class passed onward through several modules; closing those needs the check to follow symbols across files, which it does not do. That limit is now written down and pinned by a test, so nobody later mistakes it for an oversight.
+
+Worth noting how this was found: not by re-reading the fix, but by asking someone else to break it and telling them plainly that finding a hole would be more useful than a clean report. A review that can only confirm is not a review.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see and corrects a written claim about its limits. No new command, route, setting, or rule.
+
+## Evidence
+
+The two bypasses are the reviewer's own snippets, reproduced verbatim as tests. Proven in both directions: reverting both additions fails four tests while thirteen still pass — those thirteen including all six deliberate opposite-direction controls and a test that pins the remaining cross-module gap as still open. Among the controls is a new one specifically for this change: assigning an unrelated symbol to a variable and building from it is not flagged, because a rule that treated every variable as suspicious would pass every bypass test and fail on ordinary code. The real codebase passes cleanly before and after; source restored byte-identical after the check.

package/upgrades/1.3.1142.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The rule that stops secrets being written outside the approved path could be switched off by writing one name in two halves.
+
+- **The raw-keychain part of the check only arms itself when it sees a particular service name written out in full.** That narrowing is deliberate — it keeps the other, unrelated keychain stores from being flagged — but it means splitting the name across a join turned the entire rule off.
+- **Two smaller ways past existed too**: assign the credential store to a variable and write through the variable, or reach the write method with bracket notation instead of a dot.
+- **All three were confirmed getting past the check before this change**, with a known-caught example passing in the same run to prove the probe worked.
+- **All three are now closed.** Split strings are joined before the check decides whether to arm, variables holding the store are followed to a fixed point, and bracket access is recognised.
+- **Nothing new is forbidden.** The same writes are disallowed as before; more of them are visible, and the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+Every write of the stored Claude credential is meant to go through a single controlled path, and a check enforces it. To avoid complaining about unrelated keychain entries, part of that check only switched on when it recognised a specific name spelled out in full — so spelling it in two pieces made the check ignore the file completely.
+
+Nothing was actually being written unsafely; the hole was in the guard. It is closed, along with two smaller ones.
+
+The care here went into the opposite risk. Widening a rule that blocks work can flood people with false complaints about correct code, and the quickest way to silence a noisy check is to switch it off. So five deliberate tests confirm the things that must *not* be flagged still are not, and the whole codebase passes cleanly before and after.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see. No new command, route, setting, or rule.
+
+## Evidence
+
+The three bypasses were reproduced against the shipped check before any change, alongside a known-caught example in the same run to prove the probe could detect anything at all. Proven in both directions: restored to the old behaviour, seven tests fail and seven pass — and the seven that pass are exactly the five opposite-direction controls plus the plain cases, which is what makes them guards rather than echoes. Those controls check that a different keychain service is not flagged, that a raw keychain write with no reference to the guarded service is not flagged, that an unrelated store's write is not flagged, that an unrelated variable assignment is not absorbed, and that comments are not violations. The real codebase passes cleanly before and after, and the source was restored byte-identical after the check.
+
+Remaining gaps are named rather than implied: a service name built through a template with a variable in it, or imported as a constant from another file, still disarms the rule — both need value resolution this check does not do.