instar 1.3.1141 → 1.3.1142

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141",
+  "packageVersion": "1.3.1142",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "adce98bd928dd093c27e5fc91bcc6e5d9591b5214386ae330a7df922818f24db",
+  "sha256": "588004e7496311e759c00e2ee9419b8385e05ca9cedff117ec3e44c9f78d73e2",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1142"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1142"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1141",
+  "version": "1.3.1142",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-no-unfunneled-credential-write.js

@@ -86,6 +86,83 @@ const PATTERNS = [
 // services) are never false-positived.
 const RAW_KEYCHAIN_WRITE = /add-generic-password/;
 
+// ── Evasion-resistant detection (2026-08-14) ─────────────────────────────
+// A peer-agent audit classified this check DEFEATABLE by ordinary renaming,
+// and three bypasses were then reproduced against it:
+//
+//   const SVC = 'Claude Code' + '-credentials';         // concatenated service
+//   execFileSync('security', ['add-generic-password', '-s', SVC]);
+//   const store = defaultCredentialStore; store.write(p);  // re-bound receiver
+//   provider['writeCredentials'](p);                       // computed access
+//
+// The first is the sharpest: the raw-keychain rule is GATED on the literal
+// service string appearing in the file, so splitting it across a concatenation
+// switches the whole rule off. That gate exists to avoid false-positiving the
+// other, distinct-service vaults, so it is narrowed rather than removed.
+
+/** Collapse simple adjacent string concatenation so `'A' + 'B'` reads as `AB`. */
+export function collapseConcatenation(content) {
+  // `'A' + 'B'` / "A" + "B" / mixed quotes → `AB`. Repeated to fold chains.
+  let out = content;
+  for (let i = 0; i < 5; i++) {
+    const next = out.replace(/(['"])\s*\+\s*(['"])/g, '');
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+/** Local names bound to `defaultCredentialStore`, resolved to a fixpoint. */
+export function credentialStoreBindings(content) {
+  const names = new Set(['defaultCredentialStore']);
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const known of [...names]) {
+      const re = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*${known}\\s*[;,\\n]`, 'g');
+      for (const m of content.matchAll(re)) names.add(m[1]);
+    }
+    if (names.size === before) break;
+  }
+  return [...names];
+}
+
+/**
+ * Violations in `content`, as { line, msg }. Exported so the rules can be
+ * driven with fixtures rather than only end-to-end over the tree.
+ */
+export function findCredentialWriteViolations(content) {
+  const hits = [];
+  // Concatenation-tolerant: a split service literal no longer disarms the rule.
+  const targetsGuardedService = collapseConcatenation(content).includes(GUARDED_SERVICE);
+  const storeNames = credentialStoreBindings(content);
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (isCommentLine(line)) continue;
+    // Re-bound receiver + computed access on the store write.
+    for (const n of storeNames) {
+      if (new RegExp(`\\b${n}\\s*\\.\\s*write\\s*\\(`).test(line)
+        || new RegExp(`\\b${n}\\s*\\[\\s*['"\`]write['"\`]\\s*\\]\\s*\\(`).test(line)) {
+        hits.push({ line: i + 1, msg: PATTERNS[0].msg });
+        break;
+      }
+    }
+    // `.writeCredentials(` and its computed form.
+    if (/\.writeCredentials\s*\(/.test(line)
+      || /\[\s*['"`]writeCredentials['"`]\s*\]\s*\(/.test(line)) {
+      hits.push({ line: i + 1, msg: PATTERNS[1].msg });
+    }
+    if (targetsGuardedService && RAW_KEYCHAIN_WRITE.test(line)) {
+      hits.push({
+        line: i + 1,
+        msg: `raw 'add-generic-password' to the ${GUARDED_SERVICE} service outside the funnel. `
+          + `Route the write through CredentialWriteFunnel.withSlotLock, or add an allowlist entry here with a justification.`,
+      });
+    }
+  }
+  return hits;
+}
+
 function isCommentLine(line) {
   const t = line.trim();
   return t.startsWith('//') || t.startsWith('*') || t.startsWith('/*') || t.startsWith('#');
@@ -118,6 +195,15 @@ function listFiles() {
   return files;
 }
 
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so the exported detector can be imported by tests WITHOUT running the
+// scan: this module calls process.exit(1) on a violation, so an unguarded
+// import would kill any test run the moment the repo had one. Same pattern as
+// scripts/eli16-pr-description-check.mjs and lint-no-unbounded-llm-spawn.js.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
 let violations = 0;
 for (const rel of listFiles()) {
   const normalized = rel.split(path.sep).join('/');
@@ -130,25 +216,9 @@ for (const rel of listFiles()) {
   } catch {
     continue;
   }
-  const fileTargetsGuardedService = content.includes(GUARDED_SERVICE);
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (isCommentLine(line)) continue;
-    for (const { re, msg } of PATTERNS) {
-      if (re.test(line)) {
-        console.error(`${normalized}:${i + 1} — ${msg}`);
-        violations++;
-      }
-    }
-    if (fileTargetsGuardedService && RAW_KEYCHAIN_WRITE.test(line)) {
-      console.error(
-        `${normalized}:${i + 1} — raw 'add-generic-password' to the ${GUARDED_SERVICE} service outside ` +
-        `the funnel. Route the write through CredentialWriteFunnel.withSlotLock, or add an allowlist entry ` +
-        `here with a justification.`,
-      );
-      violations++;
-    }
+  for (const hit of findCredentialWriteViolations(content)) {
+    console.error(`${normalized}:${hit.line} — ${hit.msg}`);
+    violations++;
   }
 }
 
@@ -160,3 +230,4 @@ if (violations > 0) {
   process.exit(1);
 }
 console.log('lint-no-unfunneled-credential-write: clean');
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T19:38:02.081Z",
-  "instarVersion": "1.3.1141",
+  "generatedAt": "2026-08-14T20:03:30.012Z",
+  "instarVersion": "1.3.1142",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141",
+  "packageVersion": "1.3.1142",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "adce98bd928dd093c27e5fc91bcc6e5d9591b5214386ae330a7df922818f24db",
+  "sha256": "588004e7496311e759c00e2ee9419b8385e05ca9cedff117ec3e44c9f78d73e2",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1142"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1142"
 }

package/upgrades/1.3.1142.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The rule that stops secrets being written outside the approved path could be switched off by writing one name in two halves.
+
+- **The raw-keychain part of the check only arms itself when it sees a particular service name written out in full.** That narrowing is deliberate — it keeps the other, unrelated keychain stores from being flagged — but it means splitting the name across a join turned the entire rule off.
+- **Two smaller ways past existed too**: assign the credential store to a variable and write through the variable, or reach the write method with bracket notation instead of a dot.
+- **All three were confirmed getting past the check before this change**, with a known-caught example passing in the same run to prove the probe worked.
+- **All three are now closed.** Split strings are joined before the check decides whether to arm, variables holding the store are followed to a fixed point, and bracket access is recognised.
+- **Nothing new is forbidden.** The same writes are disallowed as before; more of them are visible, and the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+Every write of the stored Claude credential is meant to go through a single controlled path, and a check enforces it. To avoid complaining about unrelated keychain entries, part of that check only switched on when it recognised a specific name spelled out in full — so spelling it in two pieces made the check ignore the file completely.
+
+Nothing was actually being written unsafely; the hole was in the guard. It is closed, along with two smaller ones.
+
+The care here went into the opposite risk. Widening a rule that blocks work can flood people with false complaints about correct code, and the quickest way to silence a noisy check is to switch it off. So five deliberate tests confirm the things that must *not* be flagged still are not, and the whole codebase passes cleanly before and after.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see. No new command, route, setting, or rule.
+
+## Evidence
+
+The three bypasses were reproduced against the shipped check before any change, alongside a known-caught example in the same run to prove the probe could detect anything at all. Proven in both directions: restored to the old behaviour, seven tests fail and seven pass — and the seven that pass are exactly the five opposite-direction controls plus the plain cases, which is what makes them guards rather than echoes. Those controls check that a different keychain service is not flagged, that a raw keychain write with no reference to the guarded service is not flagged, that an unrelated store's write is not flagged, that an unrelated variable assignment is not absorbed, and that comments are not violations. The real codebase passes cleanly before and after, and the source was restored byte-identical after the check.
+
+Remaining gaps are named rather than implied: a service name built through a template with a variable in it, or imported as a constant from another file, still disarms the rule — both need value resolution this check does not do.