instar 1.3.224 → 1.3.225

package/dist/core/uncaughtExceptionPolicy.d.ts

@@ -5,4 +5,7 @@
  * safe default).
  */
 export declare function isNonFatalUncaught(err: unknown): boolean;
+export declare function shouldLogStackForUncaught(err: unknown): boolean;
+/** Test-only: reset the dedup memory so each test starts from a clean slate. */
+export declare function __resetUncaughtStackDedupeForTests(): void;
 //# sourceMappingURL=uncaughtExceptionPolicy.d.ts.map

package/dist/core/uncaughtExceptionPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uncaughtExceptionPolicy.d.ts","sourceRoot":"","sources":["../../src/core/uncaughtExceptionPolicy.ts"],"names":[],"mappings":"AA2CA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIxD"}
+{"version":3,"file":"uncaughtExceptionPolicy.d.ts","sourceRoot":"","sources":["../../src/core/uncaughtExceptionPolicy.ts"],"names":[],"mappings":"AA2CA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIxD;AAyBD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAQ/D;AAED,gFAAgF;AAChF,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD"}

package/dist/core/uncaughtExceptionPolicy.js

@@ -52,4 +52,42 @@ export function isNonFatalUncaught(err) {
         return false;
     return NON_FATAL_UNCAUGHT_PATTERNS.some((p) => msg.includes(p));
 }
+/**
+ * Decides whether to attach the FULL stack trace when logging a suppressed
+ * non-fatal uncaught exception. These isolated races recur (the HTTP
+ * double-response one — "Cannot set headers after they are sent" — fires
+ * ~10-20x/hour), so logging the stack on EVERY occurrence would flood the log.
+ * Yet without ANY stack the offending call site is undiagnosable: the throw
+ * originates in node's http internals, so the suppressed message alone carries
+ * no location — the route that double-responded is invisible.
+ *
+ * The fix: log the full stack the FIRST time a given stack is seen, then
+ * message-only for repeats. That surfaces each distinct originating call path
+ * exactly once (enough to find + fix the real double-send) without the flood.
+ *
+ * Dedup key is the full `err.stack` (not just the top frames): the distinguishing
+ * frame for an HTTP double-response is the application route DEEP in the stack —
+ * the top frames are always the same node internals — so only the whole stack
+ * separates one origin from another. Process-local + bounded (cleared past
+ * MAX_TRACKED_STACKS so a pathological variety of stacks can't grow it without
+ * limit). Returns false for non-Error / stackless input.
+ */
+const seenUncaughtStacks = new Set();
+const MAX_TRACKED_STACKS = 200;
+export function shouldLogStackForUncaught(err) {
+    if (!(err instanceof Error) || !err.stack)
+        return false;
+    if (seenUncaughtStacks.has(err.stack))
+        return false;
+    // Bound memory: if a pathological variety of distinct stacks accumulates,
+    // reset rather than grow without limit (re-surfacing after the reset is fine).
+    if (seenUncaughtStacks.size >= MAX_TRACKED_STACKS)
+        seenUncaughtStacks.clear();
+    seenUncaughtStacks.add(err.stack);
+    return true;
+}
+/** Test-only: reset the dedup memory so each test starts from a clean slate. */
+export function __resetUncaughtStackDedupeForTests() {
+    seenUncaughtStacks.clear();
+}
 //# sourceMappingURL=uncaughtExceptionPolicy.js.map

package/dist/core/uncaughtExceptionPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"uncaughtExceptionPolicy.js","sourceRoot":"","sources":["../../src/core/uncaughtExceptionPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,2BAA2B,GAAG;IAClC,0EAA0E;IAC1E,8EAA8E;IAC9E,wCAAwC;IACxC,iBAAiB;IACjB,uBAAuB;IACvB,4BAA4B;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,uBAAuB;IACvB,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,yDAAyD;IACzD,2BAA2B;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"uncaughtExceptionPolicy.js","sourceRoot":"","sources":["../../src/core/uncaughtExceptionPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,2BAA2B,GAAG;IAClC,0EAA0E;IAC1E,8EAA8E;IAC9E,wCAAwC;IACxC,iBAAiB;IACjB,uBAAuB;IACvB,4BAA4B;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,uBAAuB;IACvB,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,yDAAyD;IACzD,2BAA2B;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC7C,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,kBAAkB,CAAC,IAAI,IAAI,kBAAkB;QAAE,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAC9E,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kCAAkC;IAChD,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.224",
+  "version": "1.3.225",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-03T14:11:31.808Z",
-  "instarVersion": "1.3.224",
+  "generatedAt": "2026-06-03T14:47:08.272Z",
+  "instarVersion": "1.3.225",
   "entryCount": 196,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.225.md

@@ -0,0 +1,46 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Makes suppressed non-fatal uncaught exceptions **diagnosable** by logging their stack
+trace once per origin.
+
+**The problem.** The server's `uncaughtException` handler logs a small allowlist of
+isolated/recoverable errors and continues (instead of crashing) — chiefly the HTTP
+double-response race `Cannot set headers after they are sent`. But it logged only
+`err.message`, no stack. Observed live: echo (~34×/2h) and codey (~26×/2h) emit
+`[WARN] Non-fatal uncaught exception (suppressed): Cannot set headers after they are sent`
+with **no location** — and since that error is thrown deep in node's http internals, the
+message alone can't tell you which route double-responded. The real double-send bug is
+therefore un-findable from the logs.
+
+**The fix.** A new `shouldLogStackForUncaught(err)` in `uncaughtExceptionPolicy.ts`: the
+handler now attaches the **full stack the first time a given stack is seen**, then logs
+message-only for repeats. That surfaces each distinct offending call path exactly once —
+enough to find and fix the real double-send — without flooding the log (these races recur
+~10–20×/hour). The dedup key is the whole `err.stack` (the distinguishing route frame is
+deep, not at the top); the tracking set is bounded (cleared past 200 distinct stacks).
+
+This is a **diagnostic** change — it does not alter which exceptions are suppressed vs.
+fatal (`isNonFatalUncaught` is unchanged), only how the suppressed ones are logged.
+
+## What to Tell Your User
+
+Nothing required — internal observability (agent-only). The next time the harmless-but-noisy
+"Cannot set headers" race fires, the log will include the originating stack once, so the
+underlying double-respond can be located and fixed.
+
+## Summary of New Capabilities
+
+None — observability/diagnostic only. No new routes, config, or surfaces.
+
+## Evidence
+
+- Live: echo/codey `logs/server.log` — `[WARN] Non-fatal uncaught exception (suppressed):
+  Cannot set headers after they are sent` recurring with no stack.
+- `src/commands/server.ts` uncaughtException handler now calls `shouldLogStackForUncaught`.
+- Tests: `tests/unit/uncaughtExceptionPolicy.test.ts` — first-logs-then-suppresses,
+  distinct-origin-surfaced-once, non-Error/stackless → false, reset re-surfaces, cap bound.

package/upgrades/side-effects/uncaught-suppressed-stack-capture.md

@@ -0,0 +1,56 @@
+# Side-Effects Review — Suppressed-uncaught stack capture
+
+**Version / slug:** `uncaught-suppressed-stack-capture`
+**Date:** `2026-06-03`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (Tier-1 — additive diagnostic helper + one log-line change; no control-flow/decision change)`
+
+## Summary of the change
+
+The server's `uncaughtException` handler suppresses an allowlist of isolated errors
+(HTTP double-response, Slack reconnect, standby read-only write) and logs `err.message`.
+For the recurring `Cannot set headers after they are sent` race the message has no location
+(thrown in node internals), so the offending route is un-findable. Added
+`shouldLogStackForUncaught(err)` to `uncaughtExceptionPolicy.ts` — logs the full stack the
+first time a given stack is seen, message-only thereafter. The handler appends that stack
+when the helper returns true. `isNonFatalUncaught` (the suppress-vs-crash decision) is
+unchanged.
+
+## Decision-point inventory
+
+1. **Dedup key = full `err.stack` (not top-N frames).** For an HTTP double-response the
+   top frames are always node's http internals; only the deep application frame separates
+   one route from another, so the whole stack is the right key. Errs toward surfacing more
+   distinct origins (good for diagnosis), not fewer.
+2. **First-occurrence-only logging (vs. always / rate-limited count).** These races fire
+   ~10–20×/hour; logging the stack every time would flood. Once-per-origin gives the route
+   exactly once (sufficient to fix the real bug). Chosen over a time-window rate-limit
+   because the goal is "reveal each origin once," not "sample volume."
+3. **Bounded tracking (clear past 200).** A pathological variety of distinct stacks can't
+   grow the Set without limit; clearing re-surfaces stacks after the cap, which is benign
+   (a little extra logging) and far better than unbounded memory.
+
+## 1. Behavior / safety
+
+No change to which exceptions crash vs. continue — `isNonFatalUncaught` and the FATAL
+branch are untouched. The only effect is additional (bounded) log output on the
+already-suppressed path. Cannot introduce a crash (the helper is pure + guarded for
+non-Error/stackless input → returns false).
+
+## 2. Log volume
+
+Net REDUCES noise risk vs. a naive "always log stack": one stack per origin, then
+message-only. The first-occurrence stacks are a small, finite set (the handful of
+double-respond origins + the other allowlisted errors).
+
+## 3. Blast radius / reversibility
+
+One new pure function + one log-line edit in the handler. Fully reversible (revert both).
+No schema/config/route/external surface. Memory: one process-local bounded `Set<string>`.
+
+## 4. Tests
+
+`tests/unit/uncaughtExceptionPolicy.test.ts` (existing isNonFatalUncaught suite unchanged) +
+a new `shouldLogStackForUncaught` block covering: first-logs-then-suppresses, same-stack
+fresh-Error still deduped, distinct-origin each surfaced once, non-Error/stackless → false,
+reset re-surfaces, and the cap-bound clear path. 10 tests pass.

package/upgrades/uncaught-suppressed-stack-capture.eli16.md

@@ -0,0 +1,22 @@
+# Suppressed-crash stack capture (#72) — ELI16
+
+Viewable private artifact:
+https://echo.dawn-tunnel.dev/view/311d1657-692e-48ca-a112-04c82fa74dec?sig=6e66a9515e16c2e28156a94169f7737cb86dd0c661440267eed93dc730ebd632
+
+The agent server has a short list of harmless-but-annoying errors it deliberately swallows
+instead of crashing — the main one is an HTTP race called "Cannot set headers after they are
+sent" (two replies sent for one web request). Swallowing it is correct: the request is already
+handled, and crashing the whole agent would be far worse.
+
+The snag: it only logged the error MESSAGE, not WHERE it came from. And that error is thrown
+deep inside Node's plumbing, so the message alone never says which piece of code double-replied.
+It fires 10–20 times an hour on each agent, completely un-findable.
+
+This change logs the full stack trace the FIRST time each distinct origin appears, then goes
+quiet (message-only) for the repeats. So the offending code reveals itself once — enough to
+actually fix the real double-reply — without flooding the log. Nothing about what gets swallowed
+vs. crashed changes; only how the swallowed ones are logged.
+
+_Patch · branch `echo/double-send-stack-capture` · found by scanning live fleet logs (the
+see-what-breaks loop). Step 1 (make it findable); the real double-send fix follows once the next
+occurrence reveals the route._