instar 1.3.852 → 1.3.853

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "instar",
3
- "version": "1.3.852",
3
+ "version": "1.3.853",
4
4
  "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "$schema": "./builtin-manifest.schema.json",
3
3
  "schemaVersion": 1,
4
- "generatedAt": "2026-07-17T00:52:23.030Z",
5
- "instarVersion": "1.3.852",
4
+ "generatedAt": "2026-07-17T00:56:18.214Z",
5
+ "instarVersion": "1.3.853",
6
6
  "entryCount": 202,
7
7
  "entries": {
8
8
  "hook:session-start": {
@@ -9,13 +9,23 @@ Playwright MCP calls now acquire a short, host-wide lease for the logged-in brow
9
9
  they run. Calls from the same drive renew the lease; a competing drive receives a clear busy result
10
10
  until the current drive goes quiet and the lease expires.
11
11
 
12
+ The pool-view proxy security test now uses a distinctive high-entropy PIN fixture instead of the short string `1234`.
13
+
12
14
  ## What to Tell Your User
13
15
 
14
16
  Two active agent drives no longer fight over the same logged-in browser tab. The second drive waits
15
17
  instead of clicking into a page the first drive is controlling.
16
18
 
19
+ The test can no longer pass or fail accidentally because an unrelated value happens to contain the common sequence 1234.
20
+
17
21
  ## Summary of New Capabilities
18
22
 
19
23
  - Host-wide coordination works across separate agent homes on the same machine.
20
24
  - The lease covers snapshots and reads as well as clicks, preventing page-state interleaving.
21
25
  - A ten-minute expiry automatically recovers the seat after a crashed or abandoned drive.
26
+
27
+ No runtime capability changes; this makes the existing raw-PIN boundary proof more precise.
28
+
29
+ ## Evidence
30
+
31
+ The focused eight-test pool-view proxy integration suite passes.
@@ -0,0 +1,3 @@
1
+ # ELI16
2
+
3
+ The security test used to search for a very common four-digit pattern. It now searches for a distinctive secret-shaped test value, so finding it really means the PIN leaked.
@@ -0,0 +1,7 @@
1
+ # Side-effects review
2
+
3
+ - Runtime behavior is unchanged; only an integration-test fixture and its matching assertion changed.
4
+ - The PIN remains deterministic so failures are reproducible.
5
+ - The higher-entropy value sharply reduces accidental substring collisions in serialized envelopes.
6
+ - The PIN-gated view coverage continues to use the same fixture through the shared constant.
7
+ - Second pass: focused suite green; no additional seams identified.