instar 1.3.1145 → 1.3.1146

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1145",
+  "packageVersion": "1.3.1146",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "4a5b88caa62ae256f4868735dc66735c52ae30604a8272c977ca1f4564086e43",
+  "sha256": "675498ac7f3b9a5fd07a57a530eba5cc8645d84aede82b6f03348f7f502edb8a",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1145"
+  "packageVersion": "1.3.1146"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1145"
+  "packageVersion": "1.3.1146"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1145",
+  "version": "1.3.1146",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/lint-no-direct-llm-http.js

@@ -98,6 +98,162 @@ const FORBIDDEN_PATTERNS = [
 
 const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs']);
 
+function lineForOffset(text, offset) {
+  let line = 1;
+  for (let i = 0; i < offset; i++) {
+    if (text[i] === '\n') line++;
+  }
+  return line;
+}
+
+function stripCommentsPreserveLayout(text) {
+  let out = '';
+  let i = 0;
+  let quote = null;
+  let escaped = false;
+
+  while (i < text.length) {
+    const ch = text[i];
+    const next = text[i + 1];
+
+    if (quote) {
+      out += ch;
+      if (escaped) {
+        escaped = false;
+      } else if (ch === '\\') {
+        escaped = true;
+      } else if (ch === quote) {
+        quote = null;
+      }
+      i++;
+      continue;
+    }
+
+    if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch;
+      out += ch;
+      i++;
+      continue;
+    }
+
+    if (ch === '/' && next === '/') {
+      out += '  ';
+      i += 2;
+      while (i < text.length && text[i] !== '\n') {
+        out += ' ';
+        i++;
+      }
+      continue;
+    }
+
+    if (ch === '/' && next === '*') {
+      out += '  ';
+      i += 2;
+      while (i < text.length) {
+        if (text[i] === '*' && text[i + 1] === '/') {
+          out += '  ';
+          i += 2;
+          break;
+        }
+        out += text[i] === '\n' ? '\n' : ' ';
+        i++;
+      }
+      continue;
+    }
+
+    out += ch;
+    i++;
+  }
+
+  return out;
+}
+
+function skipWhitespace(text, index) {
+  while (index < text.length && /\s/.test(text[index])) index++;
+  return index;
+}
+
+function readStringLiteral(text, start) {
+  const quote = text[start];
+  if (quote !== '"' && quote !== "'" && quote !== '`') return null;
+
+  let value = '';
+  let i = start + 1;
+  let escaped = false;
+  while (i < text.length) {
+    const ch = text[i];
+    if (escaped) {
+      value += ch;
+      escaped = false;
+      i++;
+      continue;
+    }
+    if (ch === '\\') {
+      escaped = true;
+      i++;
+      continue;
+    }
+    if (quote === '`' && ch === '$' && text[i + 1] === '{') {
+      return null;
+    }
+    if (ch === quote) {
+      return { value, end: i + 1 };
+    }
+    value += ch;
+    i++;
+  }
+
+  return null;
+}
+
+function findFoldedStringViolations(text, rel) {
+  const stripped = stripCommentsPreserveLayout(text);
+  const violations = [];
+
+  for (let i = 0; i < stripped.length; i++) {
+    const first = readStringLiteral(stripped, i);
+    if (!first) continue;
+
+    let cursor = skipWhitespace(stripped, first.end);
+    if (stripped[cursor] !== '+') {
+      i = first.end - 1;
+      continue;
+    }
+
+    const parts = [first.value];
+    let end = first.end;
+    let literalCount = 1;
+    while (stripped[cursor] === '+') {
+      const nextStart = skipWhitespace(stripped, cursor + 1);
+      const nextString = readStringLiteral(stripped, nextStart);
+      if (!nextString) break;
+      parts.push(nextString.value);
+      literalCount++;
+      end = nextString.end;
+      cursor = skipWhitespace(stripped, nextString.end);
+    }
+
+    if (literalCount > 1) {
+      const folded = parts.join('');
+      const line = lineForOffset(stripped, i);
+      for (const pat of FORBIDDEN_PATTERNS) {
+        if (folded.includes(pat)) {
+          violations.push({
+            file: rel,
+            line,
+            pattern: pat,
+            text: folded.slice(0, 200),
+            folded: true,
+          });
+        }
+      }
+      i = end - 1;
+    }
+  }
+
+  return violations;
+}
+
 function readGitignoreDirs() {
   // Skip node_modules, dist, .instar/worktrees, etc.
   return new Set(['node_modules', 'dist', 'build', '.instar', '.git', '.next', 'coverage']);
@@ -168,6 +324,7 @@ function checkFile(file) {
       }
     }
   }
+  violations.push(...findFoldedStringViolations(text, rel));
   return violations;
 }
 
@@ -184,7 +341,8 @@ function main() {
   console.error('src/core/ClaudeCliIntelligenceProvider.ts so the burn-detection system can');
   console.error('attribute it. See docs/specs/token-burn-detection-and-self-heal.md Phase 1.\n');
   for (const v of all) {
-    console.error(`  ${v.file}:${v.line} — contains "${v.pattern}"`);
+    const reason = v.folded ? `folds to "${v.pattern}"` : `contains "${v.pattern}"`;
+    console.error(`  ${v.file}:${v.line} — ${reason}`);
     console.error(`    ${v.text}`);
   }
   process.exit(1);

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-14T22:33:19.830Z",
-  "instarVersion": "1.3.1145",
+  "generatedAt": "2026-08-14T22:54:06.076Z",
+  "instarVersion": "1.3.1146",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1145",
+  "packageVersion": "1.3.1146",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "4a5b88caa62ae256f4868735dc66735c52ae30604a8272c977ca1f4564086e43",
+  "sha256": "675498ac7f3b9a5fd07a57a530eba5cc8645d84aede82b6f03348f7f502edb8a",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1145"
+  "packageVersion": "1.3.1146"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1145"
+  "packageVersion": "1.3.1146"
 }

package/upgrades/1.3.1146.md

@@ -0,0 +1,22 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`scripts/lint-no-direct-llm-http.js` now folds adjacent constant string and no-expression template literals before checking for direct LLM provider hosts. A raw provider URL split as `'https://api.' + 'anthropic.com/v1/messages'` now fails the same build lint as the unsplit host.
+
+The scope is deliberately narrow: literal-plus-literal URL construction only. Dynamic URL construction is not guessed at, and the existing file-level distinction for OAuth/profile/usage metadata endpoints remains unchanged.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+Negative control against the shipped lint: the focused unit file failed 2 tests, both new split-host rejection cases. After the fix, `tests/unit/burn-detection-phase-1.test.ts` passes 20/20, and `node scripts/lint-no-direct-llm-http.js` exits clean against the real tree.

package/upgrades/side-effects/llm-http-constant-folding.md

@@ -0,0 +1,82 @@
+# Side-Effects Review — LLM HTTP lint constant folding
+
+**Version / slug:** `llm-http-constant-folding`
+**Date:** `2026-08-14`
+**Author:** `Instar-codey`
+**Tier:** 1 (one lint script plus focused unit coverage; no runtime code, route, config, migration, or persistence change)
+**Second-pass reviewer:** `not required — CI/pre-commit lint hardening only; no runtime outbound message or session lifecycle decision`
+
+## Summary of the change
+
+`scripts/lint-no-direct-llm-http.js` now folds adjacent constant string and no-expression template literals joined by `+` before checking for known LLM provider hosts. This closes the reproduced split-host bypass (`'api.' + 'anthropic.com/v1/messages'`) while keeping scope at literal URL construction only. `tests/unit/burn-detection-phase-1.test.ts` adds red/green coverage for split Anthropic, OpenAI, and Google host literals plus a non-folded dynamic construction control.
+
+Build location re-grounding: work was built in fresh worktree `/Users/justin_instar_1/.instar/agents/instar-codey/.worktrees/agent-llm-http-constant-folding` from current `JKHeadley/main` (`4731ec6a90356ed319454a996b4eb72edcf38ab2`), created through `npx -y instar@1.3.1144 worktree create ... --base origin/main` after the local wrapper lacked an installed package. Remote verified as `origin https://github.com/JKHeadley/instar.git`; package version verified as `1.3.1144`.
+
+## Decision-point inventory
+
+- `scripts/lint-no-direct-llm-http.js` — modify — build-time block/allow decision for direct provider HTTP references outside the provider chokepoint and named metadata exceptions.
+
+## 1. Over-block
+
+The new over-block risk is a benign constant string in production source that names a provider host across literal pieces without making a call. That is the same policy as the existing unsplit-host lint: production source outside the allowlist should not carry raw provider host literals because they become copyable direct-call paths. The real-tree scan after the fix was clean.
+
+OAuth/profile/usage metadata readers keep their existing allowlist/grandfather treatment; this change did not add endpoint-level bans that would collapse metadata reads into inference calls.
+
+## 2. Under-block
+
+The lint still misses dynamic construction, such as `'https://api.' + providerHost + '/v1/messages'`, computed arrays joined into a host, decoded strings, or runtime config that points at a provider endpoint. That is intentional for this PR: automatic discovery/dataflow was the high-false-positive direction. The closure here is constant URL literals, not semantic HTTP-call proof.
+
+## 3. Level-of-abstraction fit
+
+Correct layer: this is a deterministic CI lint in the existing `lint-no-*` family. The protected invariant is "new production raw LLM provider host literals outside the chokepoint require review." The lower-level primitive is a string-literal scanner, not an authority over runtime user intent.
+
+## 4. Signal vs authority compliance
+
+Reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md).
+
+This change holds blocking authority with brittle logic, but it is a build-time hard invariant/safety guard, not a conversational judgment point. The lint blocks source code containing direct provider endpoint literals outside reviewed locations, analogous to a safety guard on data egress and spend attribution. It does not decide whether a user message is appropriate or whether an agent action should proceed at runtime.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The input is source text and an enumerated provider-host list; there are no live competing signals such as urgency, recency, ownership, or liveness.
+
+## 5. Interactions
+
+- **Shadowing:** It runs inside the existing `npm run lint` chain. It may fail before later lints, as before; no downstream lint depends on side effects from this script.
+- **Double-fire:** `lint-llm-attribution.js` and other provider-path checks may catch related defects, but this one reports direct HTTP host literals specifically. Duplicate CI failures are acceptable because they point at the same source change.
+- **Races:** No shared state. It reads files and exits.
+- **Feedback loops:** None.
+
+## 6. External surfaces
+
+No runtime external surface changes. Other agents and users only see this as a stricter build/pre-commit/CI failure when source contains a newly-recognized split provider URL. No Telegram, Slack, GitHub API, dashboard, database, ledger, or generated URL behavior changes. No operator-facing action is added.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture
+
+Machine-local by design: this is a repository lint run independently in each checkout/CI runner. It emits no user-facing notices, holds no durable state, and generates no URLs. Multi-machine consistency comes from the shared git commit containing the lint and tests.
+
+## 8. Rollback cost
+
+Pure code/test/docs change. Rollback is a hot-fix revert of the lint folding helper and tests. No data migration, no agent state repair, and no user-visible runtime regression while rollback propagates.
+
+## Conclusion
+
+The real-tree scan stayed clean and the negative control failed for the intended old-lint cases, so the scoped constant-folding fix is clear to ship. No broader automatic actuator discovery or dynamic URL dataflow was added.
+
+## Second-pass review
+
+Not required.
+
+## Evidence pointers
+
+- Old-lint focused run: `npx vitest run tests/unit/burn-detection-phase-1.test.ts` failed 2 of 20 tests, specifically the two new split-host rejection tests.
+- Fixed targeted run: `npx vitest run tests/unit/burn-detection-phase-1.test.ts` passed 20/20.
+- Fixed real-tree scan: `node scripts/lint-no-direct-llm-http.js` exited 0.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect — not applicable.