instar 1.3.1141 → 1.3.1143

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141",
+  "packageVersion": "1.3.1143",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "adce98bd928dd093c27e5fc91bcc6e5d9591b5214386ae330a7df922818f24db",
+  "sha256": "c72f4bfcc850a6eac1406c3592cf3eb5d8bfbdad13c090be45803c4b2277ed15",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1143"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1143"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1141",
+  "version": "1.3.1143",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-no-unfunneled-credential-write.js

@@ -86,6 +86,83 @@ const PATTERNS = [
 // services) are never false-positived.
 const RAW_KEYCHAIN_WRITE = /add-generic-password/;
 
+// ── Evasion-resistant detection (2026-08-14) ─────────────────────────────
+// A peer-agent audit classified this check DEFEATABLE by ordinary renaming,
+// and three bypasses were then reproduced against it:
+//
+//   const SVC = 'Claude Code' + '-credentials';         // concatenated service
+//   execFileSync('security', ['add-generic-password', '-s', SVC]);
+//   const store = defaultCredentialStore; store.write(p);  // re-bound receiver
+//   provider['writeCredentials'](p);                       // computed access
+//
+// The first is the sharpest: the raw-keychain rule is GATED on the literal
+// service string appearing in the file, so splitting it across a concatenation
+// switches the whole rule off. That gate exists to avoid false-positiving the
+// other, distinct-service vaults, so it is narrowed rather than removed.
+
+/** Collapse simple adjacent string concatenation so `'A' + 'B'` reads as `AB`. */
+export function collapseConcatenation(content) {
+  // `'A' + 'B'` / "A" + "B" / mixed quotes → `AB`. Repeated to fold chains.
+  let out = content;
+  for (let i = 0; i < 5; i++) {
+    const next = out.replace(/(['"])\s*\+\s*(['"])/g, '');
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+/** Local names bound to `defaultCredentialStore`, resolved to a fixpoint. */
+export function credentialStoreBindings(content) {
+  const names = new Set(['defaultCredentialStore']);
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const known of [...names]) {
+      const re = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*${known}\\s*[;,\\n]`, 'g');
+      for (const m of content.matchAll(re)) names.add(m[1]);
+    }
+    if (names.size === before) break;
+  }
+  return [...names];
+}
+
+/**
+ * Violations in `content`, as { line, msg }. Exported so the rules can be
+ * driven with fixtures rather than only end-to-end over the tree.
+ */
+export function findCredentialWriteViolations(content) {
+  const hits = [];
+  // Concatenation-tolerant: a split service literal no longer disarms the rule.
+  const targetsGuardedService = collapseConcatenation(content).includes(GUARDED_SERVICE);
+  const storeNames = credentialStoreBindings(content);
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (isCommentLine(line)) continue;
+    // Re-bound receiver + computed access on the store write.
+    for (const n of storeNames) {
+      if (new RegExp(`\\b${n}\\s*\\.\\s*write\\s*\\(`).test(line)
+        || new RegExp(`\\b${n}\\s*\\[\\s*['"\`]write['"\`]\\s*\\]\\s*\\(`).test(line)) {
+        hits.push({ line: i + 1, msg: PATTERNS[0].msg });
+        break;
+      }
+    }
+    // `.writeCredentials(` and its computed form.
+    if (/\.writeCredentials\s*\(/.test(line)
+      || /\[\s*['"`]writeCredentials['"`]\s*\]\s*\(/.test(line)) {
+      hits.push({ line: i + 1, msg: PATTERNS[1].msg });
+    }
+    if (targetsGuardedService && RAW_KEYCHAIN_WRITE.test(line)) {
+      hits.push({
+        line: i + 1,
+        msg: `raw 'add-generic-password' to the ${GUARDED_SERVICE} service outside the funnel. `
+          + `Route the write through CredentialWriteFunnel.withSlotLock, or add an allowlist entry here with a justification.`,
+      });
+    }
+  }
+  return hits;
+}
+
 function isCommentLine(line) {
   const t = line.trim();
   return t.startsWith('//') || t.startsWith('*') || t.startsWith('/*') || t.startsWith('#');
@@ -118,6 +195,15 @@ function listFiles() {
   return files;
 }
 
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so the exported detector can be imported by tests WITHOUT running the
+// scan: this module calls process.exit(1) on a violation, so an unguarded
+// import would kill any test run the moment the repo had one. Same pattern as
+// scripts/eli16-pr-description-check.mjs and lint-no-unbounded-llm-spawn.js.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
 let violations = 0;
 for (const rel of listFiles()) {
   const normalized = rel.split(path.sep).join('/');
@@ -130,25 +216,9 @@ for (const rel of listFiles()) {
   } catch {
     continue;
   }
-  const fileTargetsGuardedService = content.includes(GUARDED_SERVICE);
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (isCommentLine(line)) continue;
-    for (const { re, msg } of PATTERNS) {
-      if (re.test(line)) {
-        console.error(`${normalized}:${i + 1} — ${msg}`);
-        violations++;
-      }
-    }
-    if (fileTargetsGuardedService && RAW_KEYCHAIN_WRITE.test(line)) {
-      console.error(
-        `${normalized}:${i + 1} — raw 'add-generic-password' to the ${GUARDED_SERVICE} service outside ` +
-        `the funnel. Route the write through CredentialWriteFunnel.withSlotLock, or add an allowlist entry ` +
-        `here with a justification.`,
-      );
-      violations++;
-    }
+  for (const hit of findCredentialWriteViolations(content)) {
+    console.error(`${normalized}:${hit.line} — ${hit.msg}`);
+    violations++;
   }
 }
 
@@ -160,3 +230,4 @@ if (violations > 0) {
   process.exit(1);
 }
 console.log('lint-no-unfunneled-credential-write: clean');
+}

package/scripts/lint-telegram-egress-boundary.mjs

@@ -23,8 +23,10 @@
  * WHAT IT DOES NOT PROVE, stated because the previous version's claims outran its analysis:
  *   - It resolves a URL through a LOCAL declaration or a local helper only. A Bot API URL assembled
  *     in another module and imported would not be recognised.
- *   - It does not follow a `fetch` reference stored in a variable and called indirectly.
- *   Both are narrower than the gaps they replace, and both are named here rather than discovered.
+ *   - It follows a `fetch` stored in a LOCAL variable declaration (added 2026-08-14), but NOT one
+ *     re-assigned after declaration, arriving as a function parameter, or imported as a wrapper from
+ *     another module.
+ *   All are narrower than the gaps they replace, and all are named here rather than discovered.
  *
  * WHERE THIS ENDS AND THE TESTS BEGIN — established by sabotage, not by assumption. Breaking the
  * door's OWN url-to-method recogniser (so it silently skips the check on every send) leaves this lint
@@ -109,18 +111,25 @@ function denotesBotApiUrl(node, sf) {
  * invisible to a lint whose headline claim is "exactly one file". A property access whose final name
  * is `fetch` counts too.
  *
- * Still NOT covered, said plainly rather than left for the next reading to find: a fetch bound to a
- * DIFFERENT name (`const send = fetch; send(url)`) or reached through a computed member. Catching
- * those needs alias resolution this does not do. The claim below is written to match this scope.
+ * Alias resolution ADDED 2026-08-14 (a peer-agent audit ranked this check #2 of 25 defeatable by
+ * renaming, and this header had honestly named its own gap): a fetch bound to a DIFFERENT name
+ * (`const send = fetch; send(url)`) is now caught, resolved on the AST via collectFetchAliases and
+ * followed to a fixpoint so `const a = fetch; const b = a;` closes too. A computed member on a
+ * string literal (`x['fetch']`) was already covered.
+ *
+ * Still NOT covered, said plainly rather than left for the next reading to find: re-assignment after
+ * declaration, a fetch arriving as a function PARAMETER, and a wrapper imported from another module.
+ * Those need flow and cross-module analysis this does not do. The claim below is written to match
+ * this scope.
  */
-function isFetchCall(n) {
+function isFetchCall(n, aliases = EMPTY_ALIASES) {
   if (!ts.isCallExpression(n)) return false;
   const e = n.expression;
-  if (ts.isIdentifier(e)) return e.text === 'fetch';
+  if (ts.isIdentifier(e)) return e.text === 'fetch' || aliases.has(e.text);
   if (ts.isPropertyAccessExpression(e)) {
     // `fetch.call(...)` / `fetch.apply(...)` are direct invocations of fetch, and `x['fetch']` is a
     // property access spelled differently (pass 40 F3).
-    if (e.name.text === 'call' || e.name.text === 'apply') return isFetchTarget(e.expression);
+    if (e.name.text === 'call' || e.name.text === 'apply') return isFetchTarget(e.expression, aliases);
     return e.name.text === 'fetch';
   }
   if (ts.isElementAccessExpression(e)) {
@@ -131,12 +140,57 @@ function isFetchCall(n) {
 }
 
 /** Is this expression the `fetch` function itself (for `.call`/`.apply` forms)? */
-function isFetchTarget(e) {
-  if (ts.isIdentifier(e)) return e.text === 'fetch';
+function isFetchTarget(e, aliases = EMPTY_ALIASES) {
+  if (ts.isIdentifier(e)) return e.text === 'fetch' || aliases.has(e.text);
   if (ts.isPropertyAccessExpression(e)) return e.name.text === 'fetch';
   return false;
 }
 
+const EMPTY_ALIASES = new Set();
+
+/**
+ * Local names bound to `fetch` in this file, resolved to a fixpoint so a chain
+ * (`const a = fetch; const b = a;`) closes too.
+ *
+ * This closes the gap the header above named plainly and left open: a fetch
+ * bound to a DIFFERENT name. Done on the AST rather than by text, because the
+ * file is already parsed — a variable declaration whose initialiser IS the
+ * fetch function is unambiguous, where a regex over `= fetch` would also match
+ * a property called fetch on an unrelated object.
+ *
+ * Deliberately NOT resolved: re-assignment after declaration, parameters, and
+ * imports of a wrapper from another module. Those need flow/cross-module
+ * analysis; the claim stays scoped to what is actually checked.
+ */
+export function collectFetchAliases(sf) {
+  const names = new Set();
+  const decls = [];
+  const walkNode = (n) => {
+    if (ts.isVariableDeclaration(n) && n.initializer && ts.isIdentifier(n.name)) {
+      decls.push([n.name.text, n.initializer]);
+    }
+    ts.forEachChild(n, walkNode);
+  };
+  walkNode(sf);
+  for (let pass = 0; pass < 10; pass++) {
+    const before = names.size;
+    for (const [name, init] of decls) {
+      if (isFetchTarget(init, names)) names.add(name);
+    }
+    if (names.size === before) break;
+  }
+  return names;
+}
+
+// ── CLI body ─────────────────────────────────────────────────────────────
+// Guarded so collectFetchAliases can be imported by tests WITHOUT running the
+// scan: this module has four process.exit(1) paths, so an unguarded import
+// would kill any test run the moment the repo had a violation. Same pattern as
+// scripts/eli16-pr-description-check.mjs.
+const invokedDirectly =
+  process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href;
+
+if (invokedDirectly) {
 const violations = [];
 let doorSeen = false;
 
@@ -147,9 +201,10 @@ for (const file of walk(SRC)) {
   if (!text.toLowerCase().includes('api.telegram.org')) continue;
   const sf = parse(file, text);
   const isDoor = path.resolve(file) === DOOR;
+  const aliases = collectFetchAliases(sf);
 
   const visit = (n) => {
-    if (isFetchCall(n) && ts.isCallExpression(n)) {
+    if (isFetchCall(n, aliases) && ts.isCallExpression(n)) {
       if (denotesBotApiUrl(n.arguments[0], sf)) {
         if (isDoor) doorSeen = true;
         else {
@@ -254,3 +309,5 @@ console.log(
   'lint-telegram-egress-boundary: clean — Telegram Bot API egress is confined to '
   + 'src/messaging/telegram-egress.ts, which checks the serialised body before sending.',
 );
+
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T19:38:02.081Z",
-  "instarVersion": "1.3.1141",
+  "generatedAt": "2026-08-14T20:31:20.547Z",
+  "instarVersion": "1.3.1143",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141",
+  "packageVersion": "1.3.1143",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "adce98bd928dd093c27e5fc91bcc6e5d9591b5214386ae330a7df922818f24db",
+  "sha256": "c72f4bfcc850a6eac1406c3592cf3eb5d8bfbdad13c090be45803c4b2277ed15",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1143"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1141"
+  "packageVersion": "1.3.1143"
 }

package/upgrades/1.3.1142.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The rule that stops secrets being written outside the approved path could be switched off by writing one name in two halves.
+
+- **The raw-keychain part of the check only arms itself when it sees a particular service name written out in full.** That narrowing is deliberate — it keeps the other, unrelated keychain stores from being flagged — but it means splitting the name across a join turned the entire rule off.
+- **Two smaller ways past existed too**: assign the credential store to a variable and write through the variable, or reach the write method with bracket notation instead of a dot.
+- **All three were confirmed getting past the check before this change**, with a known-caught example passing in the same run to prove the probe worked.
+- **All three are now closed.** Split strings are joined before the check decides whether to arm, variables holding the store are followed to a fixed point, and bracket access is recognised.
+- **Nothing new is forbidden.** The same writes are disallowed as before; more of them are visible, and the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+Every write of the stored Claude credential is meant to go through a single controlled path, and a check enforces it. To avoid complaining about unrelated keychain entries, part of that check only switched on when it recognised a specific name spelled out in full — so spelling it in two pieces made the check ignore the file completely.
+
+Nothing was actually being written unsafely; the hole was in the guard. It is closed, along with two smaller ones.
+
+The care here went into the opposite risk. Widening a rule that blocks work can flood people with false complaints about correct code, and the quickest way to silence a noisy check is to switch it off. So five deliberate tests confirm the things that must *not* be flagged still are not, and the whole codebase passes cleanly before and after.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see. No new command, route, setting, or rule.
+
+## Evidence
+
+The three bypasses were reproduced against the shipped check before any change, alongside a known-caught example in the same run to prove the probe could detect anything at all. Proven in both directions: restored to the old behaviour, seven tests fail and seven pass — and the seven that pass are exactly the five opposite-direction controls plus the plain cases, which is what makes them guards rather than echoes. Those controls check that a different keychain service is not flagged, that a raw keychain write with no reference to the guarded service is not flagged, that an unrelated store's write is not flagged, that an unrelated variable assignment is not absorbed, and that comments are not violations. The real codebase passes cleanly before and after, and the source was restored byte-identical after the check.
+
+Remaining gaps are named rather than implied: a service name built through a template with a variable in it, or imported as a constant from another file, still disarms the rule — both need value resolution this check does not do.

package/upgrades/1.3.1143.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The check that proves only one file can talk to Telegram had already admitted, in its own header, that renaming the network call would defeat it. That gap is now closed.
+
+- **Assigning the network call to a variable and calling the variable** was not recognised. The check's own documentation said so plainly and scoped its stated claim to match — honest, and still a hole in a door that carries the credential for the whole messaging channel.
+- **It is now recognised**, followed through chains of assignment to a fixed point.
+- **Done on the parsed structure of the file, not by matching text.** The file is already parsed, and a declaration whose value *is* the network call is unambiguous — searching for the text would also match a property with that name on an unrelated object.
+- **The header's statement of limits is corrected.** It named this gap as open; three narrower ones are named in its place. Leaving the old wording would have left a false statement in the one place a reader looks to learn what the check is worth.
+- **Nothing new is forbidden**, and the codebase passes cleanly before and after.
+
+## What to Tell Your User
+
+Everything sent to Telegram has to go through one file, which looks at the message before it goes out. A check proves nothing else can reach the network on a Telegram address.
+
+It recognised that call written several ways, but not the simplest disguise: put it in a variable first. The check said so about itself, which is better than pretending otherwise, but it was still a way around a door that holds the messaging credential. It is closed now, and the three narrower ways still open are written down where the next reader will find them.
+
+## Summary of New Capabilities
+
+None. This widens what an existing check can see and corrects its written description of its own limits. No new command, route, setting, or rule.
+
+## Evidence
+
+The gap was not discovered by anyone — the check declared it, in two separate places, and both are corrected here rather than left stating something now false. Proven in both directions: with the resolution removed, three tests fail and six pass, and those six are exactly the four deliberate opposite-direction controls plus two tests that pin the remaining gaps as still open. Those controls matter more than usual because this check blocks work: an unrelated assignment is not absorbed, a property whose name merely differs is not absorbed, a file with no reference yields nothing, and the word itself as a piece of text is not a binding. The real codebase passes cleanly before and after, source restored byte-identical after the check, and the module is now safe to import — it previously had four exit paths and no guard, so importing it in a test would have stopped the test run the moment the codebase had a violation.