instar 1.3.823 → 1.3.825
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/init.d.ts.map +1 -1
- package/dist/commands/init.js +31 -39
- package/dist/commands/init.js.map +1 -1
- package/dist/core/PostUpdateMigrator.d.ts +18 -0
- package/dist/core/PostUpdateMigrator.d.ts.map +1 -1
- package/dist/core/PostUpdateMigrator.js +87 -1
- package/dist/core/PostUpdateMigrator.js.map +1 -1
- package/dist/data/builtinSkillContent.d.ts +9 -0
- package/dist/data/builtinSkillContent.d.ts.map +1 -0
- package/dist/data/builtinSkillContent.js +45 -0
- package/dist/data/builtinSkillContent.js.map +1 -0
- package/dist/monitoring/greenPrAutomergeWiring.d.ts.map +1 -1
- package/dist/monitoring/greenPrAutomergeWiring.js +11 -0
- package/dist/monitoring/greenPrAutomergeWiring.js.map +1 -1
- package/dist/scaffold/templates.d.ts.map +1 -1
- package/dist/scaffold/templates.js +2 -1
- package/dist/scaffold/templates.js.map +1 -1
- package/package.json +1 -1
- package/scripts/audit-secret-patterns.mjs +48 -0
- package/scripts/instar-dev-precommit.js +70 -0
- package/scripts/lint-no-direct-destructive.js +12 -0
- package/scripts/write-audit-convergence.mjs +466 -0
- package/skills/iterative-converging-audit/SKILL.md +6 -4
- package/src/data/builtin-manifest.json +19 -19
- package/src/data/builtinSkillContent.ts +45 -0
- package/src/scaffold/templates.ts +2 -1
- package/upgrades/1.3.824.md +24 -0
- package/upgrades/1.3.825.md +23 -0
- package/upgrades/eli16/dangerous-command-sql-shape.md +6 -0
- package/upgrades/side-effects/audit-convergence-enforcement.md +58 -0
- package/upgrades/side-effects/dangerous-command-sql-shape.md +78 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA0CH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA0CH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAWjC;;;;;;GAMG;AACH,wBAAgB,wCAAwC,IAAI,MAAM,CAQjE;AAED,wBAAgB,iCAAiC,IAAI,MAAM,CAO1D;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASlE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUvE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED,wBAAgB,4CAA4C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcjF;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQtE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUnE;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzE;AAED;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOxE;AAED;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ1E;AA+BD,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUnF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUjG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQ/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAU9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6CAA6C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUtG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAa7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAWvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAOtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yCAAyC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAyBlG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAgBjG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAahG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwB3F;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB5F;AA0BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoB5F;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQvG;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAqE1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gCAAgC;IA8ExC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IA4E1C,OAAO,CAAC,gCAAgC;IAwCxC,OAAO,CAAC,8BAA8B;IAkFtC,OAAO,CAAC,6BAA6B;IA4DrC,OAAO,CAAC,yCAAyC;IAqDjD,OAAO,CAAC,0CAA0C;IA8ClD,OAAO,CAAC,kCAAkC;IAqC1C,OAAO,CAAC,iCAAiC;IAkDzC,OAAO,CAAC,8CAA8C;IAoDtD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAmE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IAqC/C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH;;;;;;;;OAQG;IACH,OAAO,CAAC,oCAAoC;IAmB5C,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,2CAA2C;IA0BnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IA+L3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IA8RpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IAuElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA81GvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAqR1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAyMtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IA6ZvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IA+SrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAqH7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,MAAM;IA0BxiB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IA6jB3B,OAAO,CAAC,wBAAwB;IA0LhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAqKnC,OAAO,CAAC,qBAAqB;IA2Y7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,+BAA+B;IAkFvC,OAAO,CAAC,iCAAiC;IAkFzC,OAAO,CAAC,uBAAuB;IA0F/B,OAAO,CAAC,uBAAuB;IAgL/B,OAAO,CAAC,4BAA4B;IAuNpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CAsD1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IAyV7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
|
|
@@ -52,6 +52,7 @@ import { DegradationReporter } from '../monitoring/DegradationReporter.js';
|
|
|
52
52
|
import { MigratorStepEngine, } from './MigratorStepEngine.js';
|
|
53
53
|
import { matchTestIdentity, verifyAllowTestIdentity, loadTestIdentityKey, } from '../users/testIdentityMarkers.js';
|
|
54
54
|
import { readRegistryHighWater, setRegistryHighWater } from './registryHighWater.js';
|
|
55
|
+
import { ITERATIVE_CONVERGING_AUDIT_SKILL_CONTENT } from '../data/builtinSkillContent.js';
|
|
55
56
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
56
57
|
/**
|
|
57
58
|
* The "Playwright Profile Registry" CLAUDE.md awareness section. SHARED by
|
|
@@ -211,6 +212,21 @@ export function SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION(port) {
|
|
|
211
212
|
- **When to use** (PROACTIVE — these are the triggers): user asks "why do I see duplicate sessions across my machines?" → read \`pool.duplicateTopics\` first — an EMPTY array means there is no genuine duplicate (matching job names per machine are each machine's own scheduled copy; finished records are excluded by default). "Where did the finished runs go?" → \`?include=all\` (bounded retention prunes older ones). Do NOT count sessions from an \`include=all\` listing when answering "what is running?" — the default view IS the running view.
|
|
212
213
|
`;
|
|
213
214
|
}
|
|
215
|
+
/**
|
|
216
|
+
* CLAUDE.md awareness block for the audit-convergence default route
|
|
217
|
+
* (audit-convergence-enforcement §4). Proportionate (lessons-aware m6): a trigger
|
|
218
|
+
* + a pointer to the skill for the loop mechanics — NOT the whole loop inline.
|
|
219
|
+
* The unique heading substring `Audits run to convergence` is the content-sniff
|
|
220
|
+
* marker for migrateClaudeMd + the feature-delivery-completeness guard.
|
|
221
|
+
*/
|
|
222
|
+
export function AUDIT_CONVERGENCE_CLAUDEMD_SECTION(_port) {
|
|
223
|
+
return `\n### Audits run to convergence (the default route)
|
|
224
|
+
|
|
225
|
+
Any **audit-shaped** task — a SWEEP over a surface (find-all-X, a security/safety sweep, a compliance/coverage check, "review everything of kind K") — runs as the **converging loop**, not a single pass: audit → fix/classify each finding → RE-audit the FULL surface → repeat until a clean re-sweep finds **zero new**. A single-pass audit is INCOMPLETE by definition and must be reported as such — never dressed up as thorough. (A single-artifact review — one PR, one doc, one function — is NOT an audit and pays no convergence cost.)
|
|
226
|
+
- **The mechanics live in the \`/iterative-converging-audit\` skill** — engage it whenever thoroughness matters. The durable ledger IS a canonical report at \`docs/audits/<slug>.md\`; in a repo carrying \`scripts/write-audit-convergence.mjs\` the \`converged\` claim is machine-EARNED (the validator refuses an unearned stamp; the commit gate + CI re-check it), never asserted.
|
|
227
|
+
- **When to use** (PROACTIVE — this is the trigger): the moment you catch yourself about to say "I checked, looks clean" after ONE pass, or a task says "find all / audit / sweep / make sure we got everything" → run the converging loop, not the pass. Constitution: "Iterative Audit to Convergence" (\`docs/STANDARDS-REGISTRY.md\`).
|
|
228
|
+
`;
|
|
229
|
+
}
|
|
214
230
|
/**
|
|
215
231
|
* CLAUDE.md awareness block for the ownership-gated spawn seam + duplicate
|
|
216
232
|
* reconciler + owner-dark notices + judgment provenance (ownership-gated-
|
|
@@ -988,6 +1004,7 @@ export class PostUpdateMigrator {
|
|
|
988
1004
|
this.migrateBuildSkillMethodology(result);
|
|
989
1005
|
this.migrateTestAsSelfSkill(result);
|
|
990
1006
|
this.migrateInstarDevBuildLocationRegrounding(result);
|
|
1007
|
+
this.migrateIterativeConvergingAuditSkill(result);
|
|
991
1008
|
this.migrateInstarDevInternalOnlyReleaseNoteLane(result);
|
|
992
1009
|
this.migrateClassClosureTemplateSelfActionClause(result);
|
|
993
1010
|
this.migrateSpecConvergeFoundationAudit(result);
|
|
@@ -3232,6 +3249,36 @@ export class PostUpdateMigrator {
|
|
|
3232
3249
|
* installed copy (a) lacks the build-location marker AND (b) still matches
|
|
3233
3250
|
* the stock instar-dev fingerprint. A customized skill is left untouched.
|
|
3234
3251
|
*/
|
|
3252
|
+
/**
|
|
3253
|
+
* Deliver the updated iterative-converging-audit skill to EXISTING agents
|
|
3254
|
+
* (audit-convergence-enforcement §4 / Integration-R2 M3). The installed copy
|
|
3255
|
+
* came from init.ts's INLINE template, so this migration writes the SAME shared
|
|
3256
|
+
* constant (`ITERATIVE_CONVERGING_AUDIT_SKILL_CONTENT`) that init.ts now consumes
|
|
3257
|
+
* — single-source, so the two paths cannot drift. Idempotent (skip when the
|
|
3258
|
+
* canonical-report marker is already present) + conservative (skip a customized
|
|
3259
|
+
* copy that no longer looks like the stock skill).
|
|
3260
|
+
*/
|
|
3261
|
+
migrateIterativeConvergingAuditSkill(result) {
|
|
3262
|
+
try {
|
|
3263
|
+
const skillFile = path.join(this.config.projectDir, '.claude', 'skills', 'iterative-converging-audit', 'SKILL.md');
|
|
3264
|
+
if (!fs.existsSync(skillFile))
|
|
3265
|
+
return; // installBuiltinSkills handles fresh installs
|
|
3266
|
+
const current = fs.readFileSync(skillFile, 'utf8');
|
|
3267
|
+
const MARKER = 'docs/audits/<slug>.md';
|
|
3268
|
+
if (current.includes(MARKER))
|
|
3269
|
+
return; // already updated — idempotent
|
|
3270
|
+
// conservative stock fingerprint: the inline skill's stable header + loop
|
|
3271
|
+
if (!current.includes('# /iterative-converging-audit') || !current.includes('## The loop')) {
|
|
3272
|
+
result.skipped.push('skills/iterative-converging-audit/SKILL.md: customized — left untouched (no audit-convergence update)');
|
|
3273
|
+
return;
|
|
3274
|
+
}
|
|
3275
|
+
fs.writeFileSync(skillFile, ITERATIVE_CONVERGING_AUDIT_SKILL_CONTENT);
|
|
3276
|
+
result.upgraded.push('skills/iterative-converging-audit/SKILL.md (canonical docs/audits report + validator-earned convergence stamp)');
|
|
3277
|
+
}
|
|
3278
|
+
catch (err) {
|
|
3279
|
+
result.errors.push(`skills/iterative-converging-audit/SKILL.md migration: ${err instanceof Error ? err.message : String(err)}`);
|
|
3280
|
+
}
|
|
3281
|
+
}
|
|
3235
3282
|
migrateInstarDevBuildLocationRegrounding(result) {
|
|
3236
3283
|
try {
|
|
3237
3284
|
const skillFile = path.join(this.config.projectDir, '.claude', 'skills', 'instar-dev', 'SKILL.md');
|
|
@@ -4814,6 +4861,16 @@ setTimeout(() => process.exit(0), 2000);
|
|
|
4814
4861
|
patched = true;
|
|
4815
4862
|
result.upgraded.push('CLAUDE.md: added Session Listing Hygiene section');
|
|
4816
4863
|
}
|
|
4864
|
+
// Audits run to convergence (audit-convergence-enforcement §4) — Agent
|
|
4865
|
+
// Awareness + Migration Parity item 3: existing agents learn the default-route
|
|
4866
|
+
// rule (audit-shaped work runs as the converging loop; single-pass = incomplete)
|
|
4867
|
+
// and that the canonical report at docs/audits/<slug>.md carries a machine-earned
|
|
4868
|
+
// stamp. Same text as generateClaudeMd; content-sniffed on the heading.
|
|
4869
|
+
if (!content.includes('Audits run to convergence')) {
|
|
4870
|
+
content += AUDIT_CONVERGENCE_CLAUDEMD_SECTION(port);
|
|
4871
|
+
patched = true;
|
|
4872
|
+
result.upgraded.push('CLAUDE.md: added Audits-run-to-convergence default-route section');
|
|
4873
|
+
}
|
|
4817
4874
|
// Duplicate-Session Prevention & Auto-Heal (ownership-gated-spawn §3.6) —
|
|
4818
4875
|
// Agent Awareness Standard + Migration Parity item 3: existing agents learn
|
|
4819
4876
|
// the spawn checkpoint, the reconciler + its one status surface, the
|
|
@@ -10716,7 +10773,7 @@ if echo "$INPUT" | grep -qiE 'git +push[^|;&]*--force-with-lease'; then
|
|
|
10716
10773
|
fi
|
|
10717
10774
|
|
|
10718
10775
|
# Risky commands — behavior depends on safety level
|
|
10719
|
-
for pattern in "rm -rf \\." "git push --force" "git push -f" "git reset --hard" "git clean -fd"
|
|
10776
|
+
for pattern in "rm -rf \\." "git push --force" "git push -f" "git reset --hard" "git clean -fd"; do
|
|
10720
10777
|
if echo "$INPUT" | grep -qi "$pattern"; then
|
|
10721
10778
|
if [ "$FORCE_WITH_LEASE_OWN_BRANCH" -eq 1 ] && echo "$pattern" | grep -qiE 'git push (--force|-f)'; then
|
|
10722
10779
|
continue
|
|
@@ -10737,6 +10794,35 @@ for pattern in "rm -rf \\." "git push --force" "git push -f" "git reset --hard"
|
|
|
10737
10794
|
fi
|
|
10738
10795
|
done
|
|
10739
10796
|
|
|
10797
|
+
# SQL must look like a statement, not prose that merely names a keyword. Match
|
|
10798
|
+
# at input/statement start or immediately after a SQL-bearing quote/separator,
|
|
10799
|
+
# and require the following table/database identifier. Ambiguous statement
|
|
10800
|
+
# shapes still block; prose mentions in heredocs, echo text, JSON, or grep args
|
|
10801
|
+
# do not become destructive merely because the tool input contains the words.
|
|
10802
|
+
for sql_spec in \\
|
|
10803
|
+
"D""ROP TABLE|(^[[:space:]]*|[;\\"'=][[:space:]]*)[Dd][Rr][Oo][Pp][[:space:]]+[Tt][Aa][Bb][Ll][Ee]([[:space:]]+[Ii][Ff][[:space:]]+[Ee][Xx][Ii][Ss][Tt][Ss])?[[:space:]]+[^[:space:];]+" \\
|
|
10804
|
+
"D""ROP DATABASE|(^[[:space:]]*|[;\\"'=][[:space:]]*)[Dd][Rr][Oo][Pp][[:space:]]+[Dd][Aa][Tt][Aa][Bb][Aa][Ss][Ee]([[:space:]]+[Ii][Ff][[:space:]]+[Ee][Xx][Ii][Ss][Tt][Ss])?[[:space:]]+[^[:space:];]+" \\
|
|
10805
|
+
"T""RUNCATE|(^[[:space:]]*|[;\\"'=][[:space:]]*)[Tt][Rr][Uu][Nn][Cc][Aa][Tt][Ee][[:space:]]+([Tt][Aa][Bb][Ll][Ee][[:space:]]+)?[^[:space:];]+" \\
|
|
10806
|
+
"D""ELETE FROM|(^[[:space:]]*|[;\\"'=][[:space:]]*)[Dd][Ee][Ll][Ee][Tt][Ee][[:space:]]+[Ff][Rr][Oo][Mm][[:space:]]+[^[:space:];]+"; do
|
|
10807
|
+
pattern="\${sql_spec%%|*}"
|
|
10808
|
+
sql_pattern="\${sql_spec#*|}"
|
|
10809
|
+
if echo "\$INPUT" | grep -qE "\$sql_pattern"; then
|
|
10810
|
+
if [ "\$SAFETY_LEVEL" -eq 1 ]; then
|
|
10811
|
+
echo "BLOCKED: Potentially destructive command detected: \$pattern" >&2
|
|
10812
|
+
echo "Authorization required: Ask the user whether to proceed with this operation." >&2
|
|
10813
|
+
echo "Once they confirm, YOU execute the command — never ask the user to run it themselves." >&2
|
|
10814
|
+
exit 2
|
|
10815
|
+
else
|
|
10816
|
+
IDENTITY=""
|
|
10817
|
+
if [ -f "\$INSTAR_DIR/AGENT.md" ]; then
|
|
10818
|
+
IDENTITY=\$(head -20 "\$INSTAR_DIR/AGENT.md" | tr '\\n' ' ')
|
|
10819
|
+
fi
|
|
10820
|
+
echo "{\\"decision\\":\\"approve\\",\\"additionalContext\\":\\"=== SELF-VERIFICATION REQUIRED ===\\\\nDestructive command detected: \$pattern\\\\n\\\\n1. Is this necessary for the current task?\\\\n2. What are the consequences if this goes wrong?\\\\n3. Is there a safer alternative?\\\\n4. Does this align with your principles?\\\\n\\\\nIdentity: \$IDENTITY\\\\n\\\\nIf ALL checks pass, proceed. If ANY fails, stop.\\\\n=== END SELF-VERIFICATION ===\\"}"
|
|
10821
|
+
exit 0
|
|
10822
|
+
fi
|
|
10823
|
+
fi
|
|
10824
|
+
done
|
|
10825
|
+
+
|
|
10740
10826
|
# 'gh pr merge' watch-exit-merge gate — closes the PR #539 class.
|
|
10741
10827
|
# Justin merged #539 on 'gh run watch' exit code (= success), but 'watch'
|
|
10742
10828
|
# returns 0 on workflow COMPLETION regardless of conclusion; meanwhile the
|