instar 1.3.745 → 1.3.747

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAu/CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAijBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAohlBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAu/CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAijBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2jlBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -13479,10 +13479,51 @@ export async function startServer(options) {
             },
         });
         retryManager.start();
+        // Durable-Output Hygiene Standard §2 (Layer B) — the config-gated scrubber
+        // that redacts credential SPANS from LLM-derived summary fields BEFORE they
+        // persist. Dark-first: `enabled` resolves via the developmentAgent gate (LIVE
+        // on a dev agent, DARK on the fleet) and `dryRun` defaults true (the canary —
+        // computes + records would-redact metrics but stores the ORIGINAL text). A
+        // real redaction flip (dryRun:false) is the operator's endpoint decision.
+        const { DurableOutputScrubber } = await import('../monitoring/DurableOutputScrubber.js');
+        const durableScrubCfg = config.monitoring?.durableOutputScrub;
+        const durableOutputScrubber = new DurableOutputScrubber({
+            enabled: resolveDevAgentGate(durableScrubCfg?.enabled, config),
+            dryRun: durableScrubCfg?.dryRun, // undefined → fail-safe default true inside the scrubber
+            metrics: {
+                // Feature key `durable-output-scrub` — COUNTS/kind only (the ledger row
+                // never carries the matched bytes; the floor's metadata is offset/kind).
+                recordEvent: (feature, outcome) => {
+                    try {
+                        getFeatureMetricsRecorder()?.record({ feature, kind: 'event', outcome });
+                    }
+                    catch { /* @silent-fallback-ok — observability must never throw into the persist path; the store write still completes */ }
+                },
+            },
+            onPoisoningSuspected: (signal) => {
+                // One deduped attention item per store (spec §2 poisoning visibility);
+                // the AttentionTopicGuard flood ceiling backstops further.
+                try {
+                    void telegram?.createAttentionItem({
+                        id: `durable-output-poisoning:${signal.store}`,
+                        title: 'Possible durable-memory poisoning (credential-shaped plant burst)',
+                        summary: `${signal.count} credential-shaped redactions on "${signal.store}" within ${Math.round(signal.windowMs / 60_000)} min`,
+                        description: `The durable-output scrub redacted ${signal.count} credential-shaped spans (kinds: ${signal.kinds.join(', ')}) ` +
+                            `on the "${signal.store}" store in a short window — a possible deliberate memory-degradation attempt. ` +
+                            `No records were dropped; each altered entry carries its provenance marker.`,
+                        category: 'security',
+                        priority: 'NORMAL',
+                        sourceContext: 'durable-output-scrub-poisoning',
+                    });
+                }
+                catch { /* @silent-fallback-ok — escalation is best-effort signal-only; a throw here must never break the persist path */ }
+            },
+        });
         // Session summary sentinel for intelligent routing (Phase 2)
         const { SessionSummarySentinel } = await import('../messaging/SessionSummarySentinel.js');
         const summarySentinel = new SessionSummarySentinel({
             stateDir: config.stateDir,
+            scrubber: durableOutputScrubber,
             getActiveSessions: () => sessionManager.listRunningSessions(),
             captureOutput: (tmuxSession) => {
                 // RULE 3: EXEMPT — this is raw byte capture (the whole pane), not state parsing.