npm · instar1.3.535

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js performs an undisclosed HTTP POST to /internal/prompt-recall without documenting this network side effect in the tool's description or metadata. Add a `sideEffects` field to the tool's MCP resource definition (or update the description comment) to explicitly declare: `"sideEffects": ["network: POST to /internal/prompt-recall"]`. This transparency ensures operators and auditors know the tool makes external network calls. Verify by checking that the tool's JSON schema or documentation now lists the network side effect before deployment.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

 * Per OpenClaw import T2.2: a bounded pre-reply memory recall pass. Reads the

 * user's prompt from stdin, POSTs to instar's /internal/prompt-recall, and

 * echoes the resulting context block to stdout (which Claude Code injects

 * as additional context for the upcoming turn).

 *

 * The hook is synchronous from Claude Code's perspective — Claude Code waits

 * for stdout before continuing. The server's Prompt

RemediationAI

The problem is that before-prompt-recall.js receives arbitrary `contextText` from the remote /internal/prompt-recall endpoint and echoes it directly to stdout without validating the source, integrity, or content, allowing injection of malicious context into Claude's reasoning. Wrap the received `contextText` in a provenance header (e.g., `<!-- RECALL_SOURCE: /internal/prompt-recall --> ${contextText}`) and add a Content-Security-Policy-like validation: check the response's `X-Content-Hash` header against a pinned allowlist or require a cryptographic signature before echoing. Verify by testing that unsigned or tampered responses are rejected and logged.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js fetches remote context on every call and injects it into the LLM's reasoning without the operator's explicit per-request consent, allowing the remote server to steer model behavior. Disable automatic context injection by default and require an explicit `--enable-recall` flag or environment variable (`INSTAR_RECALL_ENABLED=true`) that the operator must set before the tool activates. Verify by confirming that without the flag set, the tool exits cleanly without making the POST request.

Evidence

throw new Error(`${filePath}: missing YAML frontmatter delimited by --- on lines 1 and N`);

  }

  const [, frontmatterRaw, body] = match;

  const frontmatter = yaml.load(frontmatterRaw, { schema: yaml.FAILSAFE_SCHEMA });

  if (!frontmatter || typeof frontmatter !== 'object' || Array.isArray(frontmatter)) {

    throw new Error(`${filePath}: frontmatter must parse to an object`);

  }

RemediationAI

The problem is that the code uses `yaml.load(frontmatterRaw, { schema: yaml.FAILSAFE_SCHEMA })` which, while safer than the default, can still deserialize arbitrary JavaScript objects in some YAML parsers. Replace `yaml.load()` with `yaml.load(..., { schema: yaml.JSON_SCHEMA })` or use a strict parsing library like `js-yaml` with `{ schema: 'safe' }` to ensure only primitive types and plain objects are deserialized. Verify by attempting to inject a YAML constructor payload (e.g., `!!js/object:Function`) and confirming it is rejected or parsed as a string.

Evidence

} catch {

    base = execSync('git rev-parse HEAD~1', { encoding: 'utf-8' }).trim();

  }

  const out = execSync(`git diff --name-only ${base} HEAD`, { encoding: 'utf-8' });

  changed = out.split('\n').map(s => s.trim()).filter(Boolean);

} catch (err) {

  console.warn(`pre-push-e2e-scope: could not compute changed files (${err instanceof Error ? err.message : err}) — skipping (CI still runs e2e).`);

RemediationAI

The problem is that `execSync('git diff --name-only ${base} HEAD', ...)` interpolates the `base` variable directly into a shell command string, allowing an attacker who controls `base` to inject arbitrary shell commands. Replace the template string with an array of arguments: `execSync(['git', 'diff', '--name-only', base, 'HEAD'], { encoding: 'utf-8' })` (using Node's `spawnSync` or a wrapper that supports list-form arguments). Verify by setting `base` to a value like `HEAD; rm -rf /` and confirming the command fails or is safely escaped.

Evidence

execSync(`curl -L -f -o "${tmpFile}" "${url}"`, { stdio: 'pipe', timeout: 30000 });

    if (fs.existsSync(buildDir)) fs.rmSync(buildDir, { recursive: true });

    execSync(`tar xzf "${tmpFile}" -C "${pkgDir}"`, { stdio: 'pipe' });

    return true;

  } catch (err) {

    console.warn(`[fix-better-sqlite3] prebuild download/extract failed: ${err.message}`);

RemediationAI

The problem is that `execSync('curl -L -f -o "${tmpFile}" "${url}"', ...)` and `execSync('tar xzf "${tmpFile}" -C "${pkgDir}"', ...)` interpolate `tmpFile`, `url`, and `pkgDir` into shell strings, allowing command injection if these variables are attacker-controlled. Replace both calls with array-form commands: `execSync(['curl', '-L', '-f', '-o', tmpFile, url], ...)` and `execSync(['tar', 'xzf', tmpFile, '-C', pkgDir], ...)` using `spawnSync` or a library that supports list arguments. Verify by injecting shell metacharacters (e.g., `; echo pwned`) into `url` and confirming the command fails safely.

Evidence

// PR's own changes (merge-base of main and HEAD is the branch point).

  const pickRef = (cands) => {

    for (const r of cands) {

      try { execSync(`git rev-parse --verify --quiet ${r}`, { stdio: 'pipe', encoding: 'utf-8' }); return r; }

      catch { /* ref not present in this clone */ }

    }

    return null;

RemediationAI

The problem is that `execSync('git rev-parse --verify --quiet ${r}', ...)` interpolates the ref variable `r` directly into a shell command, allowing injection if `r` contains shell metacharacters. Replace with array-form: `execSync(['git', 'rev-parse', '--verify', '--quiet', r], { stdio: 'pipe', encoding: 'utf-8' })` using `spawnSync` or a wrapper supporting list arguments. Verify by testing with a ref value like `HEAD; echo pwned` and confirming it is safely escaped or rejected.

Evidence

try {

    console.log(`[fix-better-sqlite3] Downloading ${url}`);

    execSync(`curl -L -f -o "${tmpFile}" "${url}"`, { stdio: 'pipe', timeout: 30000 });

    if (fs.existsSync(buildDir)) fs.rmSync(buildDir, { recursive: true });

    execSync(`tar xzf "${tmpFile}" -C "${pkgDir}"`, { stdio: 'pipe' });

RemediationAI

The problem is that both `curl` and `tar` commands interpolate `tmpFile`, `url`, and `pkgDir` into shell strings without proper escaping, enabling command injection. Refactor to use array-form `spawnSync`: `spawnSync('curl', ['-L', '-f', '-o', tmpFile, url], { stdio: 'pipe', timeout: 30000 })` and `spawnSync('tar', ['xzf', tmpFile, '-C', pkgDir], { stdio: 'pipe' })`. Verify by injecting shell metacharacters into `url` or `pkgDir` and confirming safe handling.

Evidence

function getStagedContent(filepath) {

  try {

    return execSync(`git show :"${filepath}"`, { encoding: 'utf-8' });

  } catch {

    // File staged for deletion or unreadable — skip.

    return null;

RemediationAI

The problem is that `execSync('git show :"${filepath}"', ...)` interpolates the filepath directly into a shell command, allowing injection if the filepath contains shell metacharacters or quotes. Replace with array-form: `execSync(['git', 'show', `:${filepath}`], { encoding: 'utf-8' })` using `spawnSync` or a wrapper supporting list arguments. Verify by testing with a filepath like `file"; echo pwned #` and confirming safe escaping.

Evidence

const { entryPath, entryData } = pendingAuditEntry;

    entryData.verdict = code === 0 ? 'pass' : 'blocked';

    fs.writeFileSync(entryPath, JSON.stringify(entryData, null, 2) + '\n');

    execSync(`git add ${JSON.stringify(path.relative(ROOT, entryPath))}`, { cwd: ROOT });

  } catch { /* best-effort — 'pending' is still more truthful than no verdict */ }

});

const WINDOW_MS = 60 * 60 * 1000; // 60 minutes

RemediationAI

The problem is that `execSync('git add ${JSON.stringify(path.relative(ROOT, entryPath))}', ...)` relies on `JSON.stringify()` for escaping, which is insufficient for shell contexts and can be bypassed with certain payloads. Replace with array-form: `execSync(['git', 'add', path.relative(ROOT, entryPath)], { cwd: ROOT })` using `spawnSync` or a wrapper supporting list arguments. Verify by testing with a path containing shell metacharacters and confirming safe handling.

Evidence

verdict: 'pending',

    };

    fs.writeFileSync(entryPath, JSON.stringify(entryData, null, 2) + '\n');

    execSync(`git add ${JSON.stringify(path.relative(ROOT, entryPath))}`, { cwd: ROOT });

    pendingAuditEntry = { entryPath, entryData };

    return entryPath;

  } catch {

RemediationAI

The problem is that `execSync('git add ${JSON.stringify(path.relative(ROOT, entryPath))}', ...)` uses `JSON.stringify()` for shell escaping, which is not shell-safe and can be bypassed. Replace with array-form: `execSync(['git', 'add', path.relative(ROOT, entryPath)], { cwd: ROOT })` using `spawnSync` or a wrapper supporting list arguments. Verify by injecting shell metacharacters into the path and confirming safe handling.

Evidence

};

  const remoteBranch = pickRef(['JKHeadley/main', 'origin/main', 'upstream/main', 'main'])

    || execSync('git rev-parse --abbrev-ref @{u} 2>/dev/null || echo origin/main', { encoding: 'utf-8' }).trim();

  const changedFiles = execSync(`git diff --name-only ${remoteBranch}...HEAD 2>/dev/null || git diff --name-only HEAD~1 2>/dev/null`, { encoding: 'utf-8' })

    .trim()

    .split('\n')

    .filter(Boolean);

RemediationAI

The problem is that `execSync('git diff --name-only ${remoteBranch}...HEAD 2>/dev/null || ...')` interpolates `remoteBranch` directly into a shell command, allowing injection. Replace with array-form: `execSync(['git', 'diff', '--name-only', `${remoteBranch}...HEAD`], { encoding: 'utf-8' })` using `spawnSync` or a wrapper supporting list arguments. Verify by setting `remoteBranch` to a value like `origin/main; echo pwned` and confirming safe escaping.

Evidence

function stagedContent(file) {

  try {

    return execSync(`git show :${file}`, { encoding: 'utf-8' });

  } catch {

    return '';

  }

RemediationAI

The problem is that `execSync('git show :${file}', ...)` interpolates the file variable directly into a shell command without proper escaping, enabling injection. Replace with array-form: `execSync(['git', 'show', `:${file}`], { encoding: 'utf-8' })` using `spawnSync` or a wrapper supporting list arguments. Verify by testing with a filename like `file"; echo pwned #` and confirming safe handling.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

 * Per OpenClaw import T2.2: a bounded pre-reply memory recall pass. Reads the

 * user's prompt from stdin, POSTs to instar's /internal/prompt-recall, and

 * echoes the resulting context block to stdout (which Claude Code injects

 * as additional context for the upcoming turn).

 *

 * The hook is synchronous from Claude Code's perspective — Claude Code waits

 * for stdout before continuing. The server's Prompt

RemediationAI

The problem is that before-prompt-recall.js reads sensitive user prompts from stdin and POSTs them to an external server (INSTAR_SERVER_URL) controlled by environment variables, without the operator's explicit per-request consent or knowledge of the destination. Add a configuration file (e.g., `~/.instar/config.json`) that the operator must explicitly create and approve, containing the allowed server URL and authentication token, rather than relying on environment variables alone. Verify by confirming that the tool fails with a clear error if the config file is missing or if the destination URL differs from the approved value.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js uses a global `process.env.INSTAR_AUTH_TOKEN` to authenticate all requests to /internal/prompt-recall without verifying the caller's identity or checking if the token is still valid. Replace the global token with a per-request identity check: require the caller to pass a request-scoped credential or session token (e.g., via stdin or a callback) and validate it before making the POST. Verify by confirming that requests without a valid per-request credential are rejected.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js returns the `contextText` from /internal/prompt-recall verbatim to stdout with no provenance marker, source attribution, or delimiter, making it indistinguishable from the user's original prompt. Wrap the returned context in a clearly marked block: `<!-- INSTAR_RECALL_START --> ${contextText} <!-- INSTAR_RECALL_END -->` so Claude and the operator can identify injected content. Verify by checking that the output now includes the provenance delimiters and that Claude's context window shows the source attribution.

Evidence

// Save private key to a known transitional location for the user to register

  // via `instar worktree register-keypair --private <path>` (which prompts for keychain).

  const privPath = path.join(STATE_DIR, 'trailer-private-key.pem.NEW');

  fs.writeFileSync(privPath, privateKey, { mode: 0o600 });

  logStep(`Private key written to ${privPath} (chmod 0600)`);

  logStep('  → Next: run `instar worktree register-keypair --private ' + privPath + '` to move into keychain.');

  logStep('  → After succ

RemediationAI

The problem is that the variable `privateKey` is written to a file and the path is printed to stdout/logs without redaction, potentially exposing the secret's location or value if logs are captured. Rename the variable to `privateKeyPath` (if it contains only the path) or wrap the output with a redaction helper: `console.log(`Private key saved to: ${redact(privPath)}`)` where `redact()` masks sensitive paths. Verify by checking logs and stdout to confirm the path is masked or that the variable name no longer suggests it contains a secret.

Evidence

if command -v python3 &>/dev/null; then

    python3 - "$plist" 2>/dev/null <<'PYEOF' || true

import sys, xml.etree.ElementTree as ET

d = ET.parse(sys.argv[1]).getroot().find('dict')

els = list(d)

for i, el in enumerate(els):

    if el.tag == 'key' and el.text == 'WorkingDirectory' and i + 1 < len(els):

RemediationAI

The problem is that the Python XML parser `xml.etree.ElementTree.parse()` is used without disabling external entity expansion, allowing XXE attacks to read local files or cause SSRF. Replace the parser call with: `parser = ET.XMLParser(); parser.entity = {}; ET.parse(sys.argv[1], parser=parser).getroot()` or use `defusedxml.ElementTree.parse()` which disables entity expansion by default. Verify by attempting to inject an XXE payload (e.g., `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>`) and confirming it is rejected or safely handled.

Evidence

Restart Claude Code, then run a command that would expose a credential:

```bash

echo "sk-ant-api03-test1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrst"

```

The hook should block the response and show a masked version of the detected key.

RemediationAI

The problem is that the SKILL.md file contains a hardcoded example API key (`sk-ant-api03-test1234567890...`) in plaintext, which if committed to a public repository grants anyone access to the Anthropic API. Remove the hardcoded key from the file and replace it with a placeholder: `sk-ant-api03-[REDACTED]` or `sk-ant-api03-YOUR_KEY_HERE`. Verify by running `git log -p` to confirm the old key is not in history, and rotate the actual API key in the Anthropic console.

Evidence

|---------|--------------|

| OpenAI API keys | `sk-proj-abc123...` |

| Anthropic API keys | `sk-ant-api03-...` |

| AWS access keys | `AKIA1234567890ABCDEF` |

| GitHub tokens (classic) | `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` |

| GitHub fine-grained PATs | `github_pat_xxxxxx...` |

| Stripe secret keys | `sk_live_xxxx...xxxx` |

RemediationAI

The problem is that the SKILL.md file contains hardcoded example API key patterns (OpenAI, Anthropic, AWS, GitHub, Stripe) in plaintext, which could be mistaken for real credentials or used as templates for attacks. Replace all example keys with clearly marked placeholders: `sk-proj-[REDACTED]`, `AKIA[REDACTED]`, `ghp_[REDACTED]`, etc., and add a comment: `<!-- Example keys are redacted; use your own credentials -->`. Verify by confirming that no real-looking credentials remain in the file and that the examples are clearly marked as placeholders.

Evidence

| OpenAI API keys | `sk-proj-abc123...` |

| Anthropic API keys | `sk-ant-api03-...` |

| AWS access keys | `AKIA1234567890ABCDEF` |

| GitHub tokens (classic) | `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` |

| GitHub fine-grained PATs | `github_pat_xxxxxx...` |

| Stripe secret keys | `sk_live_xxxx...xxxx` |

| PEM private keys | `-----BEGIN RSA PRIVATE KEY-----` |

RemediationAI

The problem is that the SKILL.md file contains hardcoded example API key patterns (OpenAI, Anthropic, AWS, GitHub, Stripe) in plaintext, which could be mistaken for real credentials or used as templates for attacks. Replace all example keys with clearly marked placeholders: `sk-proj-[REDACTED]`, `AKIA[REDACTED]`, `ghp_[REDACTED]`, etc., and add a comment: `<!-- Example keys are redacted; use your own credentials -->`. Verify by confirming that no real-looking credentials remain in the file and that the examples are clearly marked as placeholders.

Evidence

sys.exit(1)

        content = sys.stdin.buffer.read()

        checksum = atomic_write(sys.argv[2], content)

        print(f"Written: {sys.argv[2]} (sha256:{checksum})")

    elif cmd == "verify":

        if len(sys.argv) < 3:

RemediationAI

The problem is that `print(f"Written: {sys.argv[2]} (sha256:{checksum})")` outputs user-controlled file paths without ANSI escape sanitization, allowing injection of cursor-control sequences that can rewrite terminal output or hide commands. Sanitize the output by stripping ANSI escape sequences: `import re; safe_path = re.sub(r'\x1b\[[0-9;]*m', '', sys.argv[2]); print(f"Written: {safe_path} (sha256:{checksum})")`. Verify by passing a filename with ANSI codes (e.g., `\x1b[2J`) and confirming the output is sanitized.

Evidence

const target = path.join(TEMPLATES_DIR, `${job.slug}.md`);

    fs.writeFileSync(target, renderTemplate(job), 'utf-8');

    written.add(`${job.slug}.md`);

    console.log(`  wrote ${job.slug}.md (${job.execute.value.length} body bytes)`);

  }

  // Prune templates that no longer correspond to a default. The spec moves

RemediationAI

The problem is that `console.log(' wrote ${job.slug}.md (${job.execute.value.length} body bytes)')` outputs user-controlled job slugs without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `const safeSlug = job.slug.replace(/\x1b\[[0-9;]*m/g, ''); console.log(' wrote ${safeSlug}.md (${job.execute.value.length} body bytes)')`. Verify by passing a slug with ANSI codes and confirming the output is sanitized.

Evidence

import sys

from urllib.parse import urlparse

try:

    print((urlparse(sys.argv[1]).hostname or '').lower())

except Exception:

    print('')

PY

RemediationAI

The problem is that `print((urlparse(sys.argv[1]).hostname or '').lower())` outputs user-controlled hostnames without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `import re; safe_host = re.sub(r'\x1b\[[0-9;]*m', '', (urlparse(sys.argv[1]).hostname or '').lower()); print(safe_host)`. Verify by passing a URL with ANSI codes in the hostname and confirming the output is sanitized.

Evidence

if len(sys.argv) < 3:

            print("Usage: playbook-hmac.py sign <file>", file=sys.stderr)

            sys.exit(1)

        print(sign_file(sys.argv[2]))

    elif cmd == "verify":

        if len(sys.argv) < 4:

RemediationAI

The problem is that `print(sign_file(sys.argv[2]))` outputs the result of signing a user-controlled file without ANSI escape sanitization, allowing injection of cursor-control sequences in the output. Sanitize the output: `import re; safe_sig = re.sub(r'\x1b\[[0-9;]*m', '', sign_file(sys.argv[2])); print(safe_sig)`. Verify by passing a file with ANSI codes in its content and confirming the output is sanitized.

Evidence

for (const reply of received) {

      if (reply) {

        const name = [echo, dan, dude].find(a => a.agentId === reply.from)?.name || 'unknown';

        console.log(`     💬 ${name}: "${decodePayload(reply.payload).substring(0, 70)}..."`);

      }

    }

  } catch (e) {

RemediationAI

The problem is that `console.log(' 💬 ${name}: "${decodePayload(reply.payload).substring(0, 70)}..."')` outputs user-controlled message content without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `const safeMsg = decodePayload(reply.payload).substring(0, 70).replace(/\x1b\[[0-9;]*m/g, ''); console.log(' 💬 ${name}: "${safeMsg}..."')`. Verify by passing a message with ANSI codes and confirming the output is sanitized.

Evidence

if (out.tier === 1) {

    if (!out.sideEffectsPath) out.sideEffectsPath = out.artifact;

    if (!out.eli16Path) {

      console.error('A Tier-1 trace requires --eli16-path (the request ELI16 overview).');

      process.exit(1);

    }

  }

RemediationAI

The problem is that `console.error('A Tier-1 trace requires --eli16-path (the request ELI16 overview).')` outputs user-controlled error messages without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `const safeMsg = 'A Tier-1 trace requires --eli16-path (the request ELI16 overview).'.replace(/\x1b\[[0-9;]*m/g, ''); console.error(safeMsg)`. Verify by passing input with ANSI codes and confirming the output is sanitized.

Evidence

idx = sys.argv.index("--source-action")

            kwargs["source_action"] = sys.argv[idx + 1]

        data = add_strategy(sys.argv[2], sys.argv[3], sys.argv[4], **kwargs)

        print(f"Added strategy in {sys.argv[3]} domain. Total: {len(data['strategies_discovered'])}")

    elif cmd == "add-failure":

        if len(sys.argv) < 5:

RemediationAI

The problem is that `print(f"Added strategy in {sys.argv[3]} domain. Total: {len(data['strategies_discovered'])}")` outputs user-controlled domain names without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `import re; safe_domain = re.sub(r'\x1b\[[0-9;]*m', '', sys.argv[3]); print(f"Added strategy in {safe_domain} domain. Total: {len(data['strategies_discovered'])}")`. Verify by passing a domain with ANSI codes and confirming the output is sanitized.

Evidence

print(f"# X-Markdown-Tokens: {result['token_hint']}")

                print(f"# Estimated tokens: {tokens}")

                print("---")

            print(result['body'])

            if tokens > max_tokens:

                log(f"[smart-fetch] WARNING: Content exceeds {max_tokens} token limit")

RemediationAI

The problem is that `print(result['body'])` outputs user-controlled content without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `import re; safe_body = re.sub(r'\x1b\[[0-9;]*m', '', result['body']); print(safe_body)`. Verify by passing content with ANSI codes and confirming the output is sanitized.

Evidence

if len(sys.argv) < 4:

            print("Usage: playbook-hmac.py chain-sign <json_str> <prev_hmac>", file=sys.stderr)

            sys.exit(1)

        print(chain_sign(sys.argv[2], sys.argv[3]))

    elif cmd == "chain-verify":

        if len(sys.argv) < 5:

RemediationAI

The problem is that `print(chain_sign(sys.argv[2], sys.argv[3]))` outputs the result of a chain-sign operation without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `import re; safe_sig = re.sub(r'\x1b\[[0-9;]*m', '', chain_sign(sys.argv[2], sys.argv[3])); print(safe_sig)`. Verify by passing input with ANSI codes and confirming the output is sanitized.

Evidence

if cmd == "append":

        if len(sys.argv) < 5:

            print("Usage: playbook-history.py append <operation> <item_id> <source_session> [--payload '{}']", file=sys.stderr)

            sys.exit(1)

        operation = sys.argv[2]

        item_id = sys.argv[3]

RemediationAI

The problem is that `print(summary(sys.argv[2]))` outputs user-controlled summary data without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `import re; safe_summary = re.sub(r'\x1b\[[0-9;]*m', '', summary(sys.argv[2])); print(safe_summary)`. Verify by passing a session ID with ANSI codes and confirming the output is sanitized.

Evidence

if len(sys.argv) < 3:

            print("Usage: playbook-scratchpad.py summary <session_id>", file=sys.stderr)

            sys.exit(1)

        print(summary(sys.argv[2]))

    else:

        print(f"Unknown command: {cmd}", file=sys.stderr)

RemediationAI

The problem is that `print(f"Unknown command: {cmd}", file=sys.stderr)` outputs user-controlled command names without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output: `import re; safe_cmd = re.sub(r'\x1b\[[0-9;]*m', '', cmd); print(f"Unknown command: {safe_cmd}", file=sys.stderr)`. Verify by passing a command with ANSI codes and confirming the output is sanitized.

Evidence

* Hardened replacement for the ad-hoc `curl + jq` / `curl + python` pattern

 * that historically leaked credentials in plaintext into the Bash tool

 * transcript. The lesson: when probing an unknown JSON shape, NEVER fall

 * back to `console.log(JSON.stringify(body))` — that's how plaintext

 * credentials end up in shell history, session transcripts, and downstream

 * LLM context.

 *

RemediationAI

The problem is that the comment references a pattern of logging plaintext credentials via `console.log(JSON.stringify(body))`, which outputs user-controlled JSON without ANSI escape sanitization or credential redaction, allowing injection of cursor-control sequences and exposure of secrets. Replace any such logging with a sanitized, redacted version: `const safe = JSON.stringify(body).replace(/\x1b\[[0-9;]*m/g, '').replace(/"(password|token|key)":\s*"[^"]*"/g, '"$1": "[REDACTED]"'); console.log(safe)`. Verify by passing JSON with ANSI codes and credentials, and confirming both are sanitized.

Evidence

"stale": len(results["stale"]),

            "skipped": len(results["skipped"]),

        }

        atomic_append(VERIFY_LOG, json.dumps(log_entry, separators=(",", ":")))

    except Exception:

        pass

    return {

        "status": "complete",

RemediationAI

The problem is that the `except Exception: pass` block silently swallows all exceptions from the atomic_append call, hiding failures and preventing incident response. Replace with: `except Exception as e: logging.error(f"Failed to append verify log: {e}", exc_info=True)` and ensure a logger is configured to write to a file or monitoring system. Verify by triggering an exception (e.g., by making the log file read-only) and confirming the error is logged.

Evidence

for line in AUDIT_LOG.read_text().splitlines():

        if line.strip():

            try:

                entries.append(json.loads(line))

            except json.JSONDecodeError:

                pass

    return entries

RemediationAI

The problem is that the `except json.JSONDecodeError: pass` block silently discards malformed JSON lines, hiding data corruption or parsing failures. Replace with: `except json.JSONDecodeError as e: logging.warning(f"Skipping malformed JSON line: {line[:50]}... ({e})")` and ensure a logger is configured. Verify by adding a malformed JSON line to the audit log and confirming the warning is logged.

Evidence

Per the 2026-05-29 pipeline post-mortem (PR #545), pattern #4 was

"silent failure caught only by user." The worst recent instance was the

**PromptGate $452 incident** — a bare `catch {}` in a 5-second hot-path

detection loop that swallowed every rate-limit failure for hours,

bypassing both QuotaTracker and LlmQueue spend guards. By the time it

surfaced, it had burned $452 of credits.

RemediationAI

The problem is that the documentation references a bare `catch {}` in a hot-path detection loop that swallowed rate-limit failures for hours, causing the PromptGate $452 incident. Replace all bare `catch {}` blocks with: `catch (err) { logger.error('Caught exception in hot path:', err); metrics.increment('errors.hot_path'); }` and ensure errors are logged and metricated. Verify by triggering an exception in the hot path and confirming it is logged and metricated.

Evidence

["python3", os.path.join(SCRIPT_DIR, "telegram-reply.py"), "285"],

            input=message, text=True, timeout=10,

            capture_output=True,

        )

    except Exception:

        pass  # Non-critical — review items are persisted regardless

def _resolve_conflicts(deltas, manifest):

RemediationAI

The problem is that the `except Exception: pass` block silently swallows exceptions from the telegram-reply subprocess call, hiding failures in non-critical notification logic. Replace with: `except Exception as e: logging.warning(f"Failed to send telegram reply: {e}")` and ensure a logger is configured. Verify by making the telegram-reply script fail and confirming the warning is logged.

Evidence

history = _import_history()

                history.append_entry(

                    "resurrect", item_id, session_id,

                    payload={"reason": reason})

            except Exception:

                pass

            log_entry = {

                "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),

RemediationAI

The problem is that the `except Exception: pass` block silently swallows exceptions from the history.append_entry call, hiding failures in the resurrection logic. Replace with: `except Exception as e: logging.error(f"Failed to resurrect item {item_id}: {e}", exc_info=True)` and ensure a logger is configured. Verify by triggering an exception (e.g., by making the history file read-only) and confirming the error is logged.