instar 1.3.1672 → 1.3.1674

package/dist/core/credentialShapes.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The key shapes the agent recognises, in one list. The outbound policy layer blocks on them; the phone's
+ * file text blanks them. Every quantifier that could rescan a long string is bounded.
+ */
+export declare const CREDENTIAL_SHAPES: Array<{
+    name: string;
+    pattern: RegExp;
+}>;
+//# sourceMappingURL=credentialShapes.d.ts.map

package/dist/core/credentialShapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialShapes.d.ts","sourceRoot":"","sources":["../../src/core/credentialShapes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAiCtE,CAAC"}

package/dist/core/credentialShapes.js

@@ -0,0 +1,39 @@
+/**
+ * The key shapes the agent recognises, in one list. The outbound policy layer blocks on them; the phone's
+ * file text blanks them. Every quantifier that could rescan a long string is bounded.
+ */
+export const CREDENTIAL_SHAPES = [
+    { name: 'OpenAI API key', pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/ },
+    { name: 'GitHub personal access token', pattern: /\bghp_[A-Za-z0-9]{36,}\b/ },
+    { name: 'GitHub OAuth token', pattern: /\bgho_[A-Za-z0-9]{36,}\b/ },
+    { name: 'GitHub user-to-server token', pattern: /\bghu_[A-Za-z0-9]{36,}\b/ },
+    { name: 'GitHub server-to-server token', pattern: /\bghs_[A-Za-z0-9]{36,}\b/ },
+    { name: 'GitHub refresh token', pattern: /\bghr_[A-Za-z0-9]{36,}\b/ },
+    { name: 'GitHub fine-grained token', pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+    { name: 'Slack bot token', pattern: /\bxoxb-[0-9]{10,}-[A-Za-z0-9-]+\b/ },
+    { name: 'Slack user token', pattern: /\bxoxp-[0-9]{10,}-[A-Za-z0-9-]+\b/ },
+    { name: 'AWS access key', pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+    { name: 'Stripe secret key', pattern: /\bsk_live_[A-Za-z0-9]{24,}/ },
+    { name: 'Stripe restricted key', pattern: /\brk_live_[A-Za-z0-9]{24,}/ },
+    { name: 'Stripe test key', pattern: /\bsk_test_[A-Za-z0-9]{24,}/ },
+    { name: 'Stripe webhook secret', pattern: /\bwhsec_[A-Za-z0-9]{16,}/ },
+    // No leading word boundary: a key can sit straight after a word character.
+    { name: 'Anthropic API key', pattern: /sk-ant-[A-Za-z0-9_-]{20,}/ },
+    { name: 'Google API key', pattern: /\bAIza[0-9A-Za-z_-]{30,}/ },
+    { name: 'Google OAuth token', pattern: /\bya29\.[A-Za-z0-9_-]{20,}/ },
+    { name: 'SendGrid key', pattern: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/ },
+    { name: 'PyPI token', pattern: /\bpypi-[A-Za-z0-9_-]{20,}/ },
+    { name: 'npm token', pattern: /\bnpm_[A-Za-z0-9]{30,}/ },
+    { name: 'GitLab token', pattern: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+    { name: 'Hugging Face token', pattern: /\bhf_[A-Za-z0-9]{30,}/ },
+    { name: 'age secret key', pattern: /\bAGE-SECRET-KEY-[A-Z0-9]{20,}/ },
+    { name: 'Groq key', pattern: /\bgsk_[A-Za-z0-9]{20,}/ },
+    { name: 'xAI key', pattern: /\bxai-[A-Za-z0-9]{20,}/ },
+    { name: 'DigitalOcean token', pattern: /\bdop_v1_[a-f0-9]{20,}/ },
+    { name: 'Password in a URL', pattern: /\b[a-z][a-z0-9+.-]{0,30}:\/\/[^\s/@:]{1,256}:[^\s/@]{1,256}@/i },
+    { name: 'Token in a URL', pattern: /\bhttps?:\/\/[A-Za-z0-9_-]{16,256}@/i },
+    { name: 'Generic bearer token', pattern: /Bearer\s+[A-Za-z0-9_\-.]{20,}/ },
+    { name: 'Password assignment', pattern: /(?:password|passwd|pwd)\s*[:=]\s*["']?[^\s"']{8,}/i },
+    { name: 'Private key block', pattern: /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/ },
+];
+//# sourceMappingURL=credentialShapes.js.map

package/dist/core/credentialShapes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialShapes.js","sourceRoot":"","sources":["../../src/core/credentialShapes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAChE,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC7E,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACnE,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC5E,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC9E,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACrE,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAChF,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACzE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,mCAAmC,EAAE;IAC1E,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC3D,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACpE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACxE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAClE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACtE,2EAA2E;IAC3E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACnE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC/D,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACrE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACjF,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,2BAA2B,EAAE;IAC5D,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACxD,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC/D,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAChE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACrE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACvD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACtD,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACjE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACvG,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE;IAC3E,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAC1E,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,oDAAoD,EAAE;IAC9F,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0CAA0C,EAAE;CACnF,CAAC"}

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "f91273af3f6f22eb6bb3161c35b109469d8457f1f93b2ec90eec9e58f62ead53",
-  "packageVersion": "1.3.1672",
+  "packageVersion": "1.3.1674",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "87217248e98b42c6073412abe406257b9b9fa492db116f09552e8a701bf6560f",
+  "sha256": "eec6d32b0b706afb3e68f2c8dfe22dbe3f7969f5b1c2397a2aed56f129af6516",
   "registrySha256": "f91273af3f6f22eb6bb3161c35b109469d8457f1f93b2ec90eec9e58f62ead53",
-  "packageVersion": "1.3.1672"
+  "packageVersion": "1.3.1674"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "f91273af3f6f22eb6bb3161c35b109469d8457f1f93b2ec90eec9e58f62ead53",
   "articleCount": 95,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1672"
+  "packageVersion": "1.3.1674"
 }

package/dist/scheduler/JobScheduler.js

@@ -2855,7 +2855,7 @@ export class JobScheduler {
         const failed = session.status === 'failed' || session.status === 'killed' || declaredFailure !== null;
         const failureError = !failed ? undefined
             : session.status === 'failed' || session.status === 'killed'
-                ? `Session ${session.status} (${session.name})${declaredFailure ? ` — declared failure: ${declaredFailure}` : ''}`
+                ? `Session ${session.status} (${session.name})${session.endedReason === 'codex-rate-limited' ? ' — Codex 429 Too Many Requests' : ''}${declaredFailure ? ` — declared failure: ${declaredFailure}` : ''}`
                 : `Declared failure: ${declaredFailure}`;
         // Capture session output FIRST — needed for both history and notifications
         let output = '';