npm · instar1.3.535

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js performs an undisclosed HTTP POST to /internal/prompt-recall without documenting this network side effect in the tool's description or metadata. Add a `sideEffects` field to the tool's MCP manifest (e.g., in tool.json or the tool definition) explicitly listing 'network: POST /internal/prompt-recall' and update the description to state 'This tool makes an outbound HTTP request to fetch recall context.' This ensures callers and auditors can see the network behavior upfront. Verify by checking that `mcp inspect` or your tool registry now displays the side effect in the tool's metadata.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

 * Per OpenClaw import T2.2: a bounded pre-reply memory recall pass. Reads the

 * user's prompt from stdin, POSTs to instar's /internal/prompt-recall, and

 * echoes the resulting context block to stdout (which Claude Code injects

 * as additional context for the upcoming turn).

 *

 * The hook is synchronous from Claude Code's perspective — Claude Code waits

 * for stdout before continuing. The server's Prompt

RemediationAI

The problem is that before-prompt-recall.js receives arbitrary `contextText` from the /internal/prompt-recall endpoint and echoes it directly to stdout without validation, allowing injection of malicious content into Claude's context. Wrap the received contextText in a clearly marked provenance block (e.g., `<!-- RECALL SOURCE: /internal/prompt-recall -->[content]<!-- END RECALL -->`) and validate that the response is valid JSON with expected schema before echoing. This makes the injected content's origin transparent and prevents unmarked context injection. Test by sending a malformed or hostile response from the endpoint and verify it is either rejected or clearly marked as external.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js fetches remote context on every call and injects it into the LLM's reasoning without the user's explicit awareness, allowing remote steering of model behavior. Require explicit user opt-in via a command-line flag or config file (e.g., `--enable-recall` or `INSTAR_RECALL_ENABLED=true`) and log each recall fetch with source and timestamp to stderr. This ensures the user controls whether remote context injection is active. Verify by checking that the tool refuses to fetch recall data unless the flag is set, and that each fetch is logged.

Evidence

throw new Error(`${filePath}: missing YAML frontmatter delimited by --- on lines 1 and N`);

  }

  const [, frontmatterRaw, body] = match;

  const frontmatter = yaml.load(frontmatterRaw, { schema: yaml.FAILSAFE_SCHEMA });

  if (!frontmatter || typeof frontmatter !== 'object' || Array.isArray(frontmatter)) {

    throw new Error(`${filePath}: frontmatter must parse to an object`);

  }

RemediationAI

The problem is that the code uses `yaml.load(frontmatterRaw, { schema: yaml.FAILSAFE_SCHEMA })` which is safe, but the finding suggests unsafe deserialization elsewhere in the codebase (Python pickle/marshal/shelve). Audit all YAML parsing to ensure `yaml.FAILSAFE_SCHEMA` is used consistently, and replace any `yaml.load()` without an explicit safe schema with `yaml.safe_load()`. For Python code, replace `pickle.load()` with `json.load()`, `yaml.load()` with `yaml.safe_load()`, and remove `shelve.open()` calls; if binary serialization is required, use `msgpack` with `strict_map_key=False`. Test by attempting to deserialize a payload containing Python object constructors and confirming it raises an error rather than executing code.

Evidence

} catch {

    base = execSync('git rev-parse HEAD~1', { encoding: 'utf-8' }).trim();

  }

  const out = execSync(`git diff --name-only ${base} HEAD`, { encoding: 'utf-8' });

  changed = out.split('\n').map(s => s.trim()).filter(Boolean);

} catch (err) {

  console.warn(`pre-push-e2e-scope: could not compute changed files (${err instanceof Error ? err.message : err}) — skipping (CI still runs e2e).`);

RemediationAI

The problem is that `execSync('git diff --name-only ${base} HEAD', ...)` interpolates the `base` variable directly into a shell command string, allowing command injection if `base` is attacker-controlled. Replace the template string with an array of arguments: `execSync(['git', 'diff', '--name-only', base, 'HEAD'], { encoding: 'utf-8' })` (or use `spawnSync` with `shell: false`). This prevents shell interpretation of special characters in `base`. Verify by setting `base` to a value like `HEAD; rm -rf /` and confirming the command fails or treats it as a literal ref name.

Evidence

execSync(`curl -L -f -o "${tmpFile}" "${url}"`, { stdio: 'pipe', timeout: 30000 });

    if (fs.existsSync(buildDir)) fs.rmSync(buildDir, { recursive: true });

    execSync(`tar xzf "${tmpFile}" -C "${pkgDir}"`, { stdio: 'pipe' });

    return true;

  } catch (err) {

    console.warn(`[fix-better-sqlite3] prebuild download/extract failed: ${err.message}`);

RemediationAI

The problem is that `execSync(\`curl -L -f -o "${tmpFile}" "${url}"`...` and `execSync(\`tar xzf "${tmpFile}" -C "${pkgDir}"`...` interpolate `tmpFile`, `url`, and `pkgDir` into shell strings, risking command injection. Replace both with array-based calls: `execSync(['curl', '-L', '-f', '-o', tmpFile, url], ...)` and `execSync(['tar', 'xzf', tmpFile, '-C', pkgDir], ...)` using `shell: false`. This prevents shell metacharacter interpretation. Verify by setting `tmpFile` or `url` to a value containing `; echo pwned` and confirming no injection occurs.

Evidence

// PR's own changes (merge-base of main and HEAD is the branch point).

  const pickRef = (cands) => {

    for (const r of cands) {

      try { execSync(`git rev-parse --verify --quiet ${r}`, { stdio: 'pipe', encoding: 'utf-8' }); return r; }

      catch { /* ref not present in this clone */ }

    }

    return null;

RemediationAI

The problem is that `execSync(\`git rev-parse --verify --quiet ${r}\`, ...)` interpolates the ref name `r` into a shell command, allowing injection. Replace with `execSync(['git', 'rev-parse', '--verify', '--quiet', r], { stdio: 'pipe', encoding: 'utf-8', shell: false })` using an array argument list. This treats `r` as a literal argument rather than shell code. Verify by passing a ref like `HEAD; malicious-command` and confirming it is rejected as an invalid ref.

Evidence

try {

    console.log(`[fix-better-sqlite3] Downloading ${url}`);

    execSync(`curl -L -f -o "${tmpFile}" "${url}"`, { stdio: 'pipe', timeout: 30000 });

    if (fs.existsSync(buildDir)) fs.rmSync(buildDir, { recursive: true });

    execSync(`tar xzf "${tmpFile}" -C "${pkgDir}"`, { stdio: 'pipe' });

RemediationAI

The problem is that both `curl` and `tar` commands interpolate file paths and URLs into shell strings without escaping. Replace `execSync(\`curl -L -f -o "${tmpFile}" "${url}"`...)` with `execSync(['curl', '-L', '-f', '-o', tmpFile, url], { shell: false })` and `execSync(\`tar xzf "${tmpFile}" -C "${pkgDir}"`...)` with `execSync(['tar', 'xzf', tmpFile, '-C', pkgDir], { shell: false })`. This prevents shell interpretation of special characters in paths and URLs. Verify by injecting a path like `/tmp/file; rm -rf /` and confirming the command treats it as a literal path.

Evidence

function getStagedContent(filepath) {

  try {

    return execSync(`git show :"${filepath}"`, { encoding: 'utf-8' });

  } catch {

    // File staged for deletion or unreadable — skip.

    return null;

RemediationAI

The problem is that `execSync(\`git show :"${filepath}"`...)` interpolates the filepath into a shell command, allowing injection. Replace with `execSync(['git', 'show', `:${filepath}`], { encoding: 'utf-8', shell: false })` using an array argument list. This treats `filepath` as a literal argument. Verify by passing a filepath like `HEAD; malicious-command` and confirming it is rejected as an invalid git reference.

Evidence

const { entryPath, entryData } = pendingAuditEntry;

    entryData.verdict = code === 0 ? 'pass' : 'blocked';

    fs.writeFileSync(entryPath, JSON.stringify(entryData, null, 2) + '\n');

    execSync(`git add ${JSON.stringify(path.relative(ROOT, entryPath))}`, { cwd: ROOT });

  } catch { /* best-effort — 'pending' is still more truthful than no verdict */ }

});

const WINDOW_MS = 60 * 60 * 1000; // 60 minutes

RemediationAI

The problem is that `execSync(\`git add ${JSON.stringify(path.relative(ROOT, entryPath))}\`, ...)` interpolates a path into a shell command, which can be exploited if the path contains shell metacharacters. Replace with `execSync(['git', 'add', path.relative(ROOT, entryPath)], { cwd: ROOT, shell: false })` using an array argument list. This prevents shell interpretation. Verify by creating a file with a name like `file; rm -rf` and confirming it is added safely.

Evidence

verdict: 'pending',

    };

    fs.writeFileSync(entryPath, JSON.stringify(entryData, null, 2) + '\n');

    execSync(`git add ${JSON.stringify(path.relative(ROOT, entryPath))}`, { cwd: ROOT });

    pendingAuditEntry = { entryPath, entryData };

    return entryPath;

  } catch {

RemediationAI

The problem is that `execSync(\`git add ${JSON.stringify(path.relative(ROOT, entryPath))}\`, ...)` interpolates a path into a shell command. Replace with `execSync(['git', 'add', path.relative(ROOT, entryPath)], { cwd: ROOT, shell: false })` using an array argument list. This treats the path as a literal argument, preventing shell injection. Verify by creating a file with shell metacharacters in its name and confirming it is staged without command injection.

Evidence

};

  const remoteBranch = pickRef(['JKHeadley/main', 'origin/main', 'upstream/main', 'main'])

    || execSync('git rev-parse --abbrev-ref @{u} 2>/dev/null || echo origin/main', { encoding: 'utf-8' }).trim();

  const changedFiles = execSync(`git diff --name-only ${remoteBranch}...HEAD 2>/dev/null || git diff --name-only HEAD~1 2>/dev/null`, { encoding: 'utf-8' })

    .trim()

    .split('\n')

    .filter(Boolean);

RemediationAI

The problem is that `execSync(\`git diff --name-only ${remoteBranch}...HEAD 2>/dev/null || ...\`, ...)` interpolates `remoteBranch` into a shell command, allowing injection. Replace with `execSync(['git', 'diff', '--name-only', `${remoteBranch}...HEAD`], { encoding: 'utf-8', shell: false })` using an array argument list. This prevents shell interpretation of `remoteBranch`. Verify by setting `remoteBranch` to a value like `origin/main; malicious-command` and confirming it is treated as a literal ref.

Evidence

function stagedContent(file) {

  try {

    return execSync(`git show :${file}`, { encoding: 'utf-8' });

  } catch {

    return '';

  }

RemediationAI

The problem is that `execSync(\`git show :${file}\`, ...)` interpolates the filename into a shell command without quoting, allowing injection. Replace with `execSync(['git', 'show', `:${file}`], { encoding: 'utf-8', shell: false })` using an array argument list. This treats `file` as a literal argument. Verify by passing a filename like `HEAD; malicious-command` and confirming it is rejected as an invalid git reference.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

 * Per OpenClaw import T2.2: a bounded pre-reply memory recall pass. Reads the

 * user's prompt from stdin, POSTs to instar's /internal/prompt-recall, and

 * echoes the resulting context block to stdout (which Claude Code injects

 * as additional context for the upcoming turn).

 *

 * The hook is synchronous from Claude Code's perspective — Claude Code waits

 * for stdout before continuing. The server's Prompt

RemediationAI

The problem is that before-prompt-recall.js reads sensitive user prompts from stdin and POSTs them to an external server (INSTAR_SERVER_URL) controlled by environment variables, with no guarantee the destination is trusted. Require the operator to explicitly whitelist the recall server endpoint in a config file or environment variable with a checksum/signature, and log all outbound requests with destination and payload size to stderr. Add a `--dry-run` flag to preview what will be sent before transmission. This ensures the operator controls where user data is sent. Verify by checking that the tool refuses to POST unless the destination is whitelisted and that a dry-run shows the intended recipient.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js uses a global `INSTAR_AUTH_TOKEN` from `process.env` to authenticate all requests, regardless of the caller's identity or permissions. Replace the global token with a per-request authentication mechanism: read the caller's credentials from a secure context (e.g., a signed JWT in the MCP request metadata or a local keychain) and use those credentials to authenticate the recall request. This ensures each caller's identity is preserved. Verify by running the tool with different caller identities and confirming each uses its own credentials.

Evidence

#!/usr/bin/env node

/**

 * before-prompt-recall — Claude Code UserPromptSubmit hook.

 *

RemediationAI

The problem is that before-prompt-recall.js returns the untrusted `contextText` from /internal/prompt-recall verbatim to stdout without any source attribution or delimiter, making it indistinguishable from legitimate context. Wrap the returned context in a clearly marked block (e.g., `<!-- INSTAR RECALL [timestamp] -->[content]<!-- END INSTAR RECALL -->`) and include metadata (source URL, fetch timestamp, content hash). This makes the external origin transparent. Verify by inspecting the stdout output and confirming the recall context is clearly marked as external.

Evidence

// Save private key to a known transitional location for the user to register

  // via `instar worktree register-keypair --private <path>` (which prompts for keychain).

  const privPath = path.join(STATE_DIR, 'trailer-private-key.pem.NEW');

  fs.writeFileSync(privPath, privateKey, { mode: 0o600 });

  logStep(`Private key written to ${privPath} (chmod 0600)`);

  logStep('  → Next: run `instar worktree register-keypair --private ' + privPath + '` to move into keychain.');

  logStep('  → After succ

RemediationAI

The problem is that the variable `privateKey` is named like a secret and written to a file without redaction in logs or output. Rename the variable to `privateKeyPem` (if the naming is accurate) or, if it is genuinely sensitive, wrap the file write with a redaction helper: use a logging library that redacts secrets (e.g., `winston` with a redaction plugin) and avoid logging the path or key content. Add a comment `// Contains sensitive key material — do not log` above the write. Verify by checking logs and console output to confirm the private key content is never printed.

Evidence

if command -v python3 &>/dev/null; then

    python3 - "$plist" 2>/dev/null <<'PYEOF' || true

import sys, xml.etree.ElementTree as ET

d = ET.parse(sys.argv[1]).getroot().find('dict')

els = list(d)

for i, el in enumerate(els):

    if el.tag == 'key' and el.text == 'WorkingDirectory' and i + 1 < len(els):

RemediationAI

The problem is that the Python XML parser `xml.etree.ElementTree` is used without disabling entity expansion, allowing XXE attacks to read local files or cause SSRF. Replace the parse call with `ET.parse(sys.argv[1], ET.XMLParser(resolve_entities=False)).getroot()` or use `defusedxml.ElementTree.parse()` instead. This disables external entity resolution. Verify by attempting to parse an XML file with an external entity reference (e.g., `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>`) and confirming it is rejected or the entity is not resolved.

Evidence

Restart Claude Code, then run a command that would expose a credential:

```bash

echo "sk-ant-api03-test1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrst"

```

The hook should block the response and show a masked version of the detected key.

RemediationAI

The problem is that the documentation in SKILL.md contains a hardcoded example Anthropic API key (`sk-ant-api03-test1234567890...`). Remove the full key from the file and replace it with a placeholder like `sk-ant-api03-[REDACTED]` or `sk-ant-api03-YOUR_KEY_HERE`. If this key was ever committed to the repository, rotate it immediately in the Anthropic console. Verify by running a secret scanner (e.g., `truffleHog` or `git-secrets`) on the repository and confirming no valid API keys are found.

Evidence

|---------|--------------|

| OpenAI API keys | `sk-proj-abc123...` |

| Anthropic API keys | `sk-ant-api03-...` |

| AWS access keys | `AKIA1234567890ABCDEF` |

| GitHub tokens (classic) | `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` |

| GitHub fine-grained PATs | `github_pat_xxxxxx...` |

| Stripe secret keys | `sk_live_xxxx...xxxx` |

RemediationAI

The problem is that the documentation lists example API keys (OpenAI, Anthropic, AWS, GitHub, Stripe) in a table, which could be mistaken for real credentials or used as a reference for attackers. Replace all example keys with clearly marked placeholders (e.g., `sk-proj-[REDACTED]`, `AKIA[REDACTED]`, `ghp_[REDACTED]`) and add a note stating 'These are examples only; never commit real credentials.' Verify by scanning the file with a secret detector and confirming no valid credentials are detected.

Evidence

| OpenAI API keys | `sk-proj-abc123...` |

| Anthropic API keys | `sk-ant-api03-...` |

| AWS access keys | `AKIA1234567890ABCDEF` |

| GitHub tokens (classic) | `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` |

| GitHub fine-grained PATs | `github_pat_xxxxxx...` |

| Stripe secret keys | `sk_live_xxxx...xxxx` |

| PEM private keys | `-----BEGIN RSA PRIVATE KEY-----` |

RemediationAI

The problem is that the documentation contains example API key formats (OpenAI, Anthropic, AWS, GitHub, Stripe) that could be mistaken for real credentials. Replace all example keys with clearly marked placeholders (e.g., `sk-proj-[REDACTED]`, `sk-ant-api03-[REDACTED]`, `AKIA[REDACTED]`, `ghp_[REDACTED]`, `sk_live_[REDACTED]`) and add a warning: 'These are examples only; never commit real credentials to source control.' Verify by running a secret scanner on the file and confirming no valid credentials are detected.

Evidence

sys.exit(1)

        content = sys.stdin.buffer.read()

        checksum = atomic_write(sys.argv[2], content)

        print(f"Written: {sys.argv[2]} (sha256:{checksum})")

    elif cmd == "verify":

        if len(sys.argv) < 3:

RemediationAI

The problem is that `sys.argv[2]` (a user-controlled filename) is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences to hide or rewrite output. Sanitize the filename before printing by removing or escaping ANSI escape sequences: use `filename.replace('\x1b', '').replace('\033', '')` or a library like `blessed.sequences.strip_ansi()`. Replace `print(f"Written: {sys.argv[2]} ...")` with `print(f"Written: {sanitize_ansi(sys.argv[2])} ...")`. Verify by passing a filename containing ANSI sequences (e.g., `file\x1b[2J.txt`) and confirming the output is not corrupted.

Evidence

const target = path.join(TEMPLATES_DIR, `${job.slug}.md`);

    fs.writeFileSync(target, renderTemplate(job), 'utf-8');

    written.add(`${job.slug}.md`);

    console.log(`  wrote ${job.slug}.md (${job.execute.value.length} body bytes)`);

  }

  // Prune templates that no longer correspond to a default. The spec moves

RemediationAI

The problem is that `job.slug` is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the slug before printing: replace `console.log(\` wrote ${job.slug}.md ...\`)` with `console.log(\` wrote ${stripAnsi(job.slug)}.md ...\`)` using a library like `strip-ansi`. Verify by creating a job with a slug containing ANSI sequences (e.g., `job\x1b[2J`) and confirming the output is not corrupted.

Evidence

import sys

from urllib.parse import urlparse

try:

    print((urlparse(sys.argv[1]).hostname or '').lower())

except Exception:

    print('')

PY

RemediationAI

The problem is that `sys.argv[1]` (a user-controlled URL) is passed to `urlparse()` and the result is printed without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the hostname before printing: replace `print((urlparse(sys.argv[1]).hostname or '').lower())` with `hostname = (urlparse(sys.argv[1]).hostname or '').lower(); print(hostname.replace('\x1b', '').replace('\033', ''))` or use a library like `re.sub(r'\x1b\[[0-9;]*m', '', hostname)`. Verify by passing a URL with ANSI sequences in the hostname and confirming the output is sanitized.

Evidence

if len(sys.argv) < 3:

            print("Usage: playbook-hmac.py sign <file>", file=sys.stderr)

            sys.exit(1)

        print(sign_file(sys.argv[2]))

    elif cmd == "verify":

        if len(sys.argv) < 4:

RemediationAI

The problem is that `sys.argv[2]` (a user-controlled file path) is passed to `sign_file()` and the result is printed without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the output before printing: replace `print(sign_file(sys.argv[2]))` with `result = sign_file(sys.argv[2]); print(result.replace('\x1b', '').replace('\033', ''))` or use a library like `re.sub(r'\x1b\[[0-9;]*m', '', result)`. Verify by passing a file path with ANSI sequences and confirming the printed signature is sanitized.

Evidence

for (const reply of received) {

      if (reply) {

        const name = [echo, dan, dude].find(a => a.agentId === reply.from)?.name || 'unknown';

        console.log(`     💬 ${name}: "${decodePayload(reply.payload).substring(0, 70)}..."`);

      }

    }

  } catch (e) {

RemediationAI

The problem is that `decodePayload(reply.payload).substring(0, 70)` (user-controlled message content) is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the message before printing: replace `console.log(\` 💬 ${name}: "${decodePayload(reply.payload).substring(0, 70)}...\`)` with `const msg = stripAnsi(decodePayload(reply.payload).substring(0, 70)); console.log(\` 💬 ${name}: "${msg}...\`)` using a library like `strip-ansi`. Verify by sending a message with ANSI sequences and confirming the output is not corrupted.

Evidence

if (out.tier === 1) {

    if (!out.sideEffectsPath) out.sideEffectsPath = out.artifact;

    if (!out.eli16Path) {

      console.error('A Tier-1 trace requires --eli16-path (the request ELI16 overview).');

      process.exit(1);

    }

  }

RemediationAI

The problem is that error messages and paths are printed to stderr without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize all user-controlled values before printing: replace `console.error('A Tier-1 trace requires --eli16-path (the request ELI16 overview).')` with `console.error(stripAnsi('A Tier-1 trace requires --eli16-path (the request ELI16 overview).'))` and similarly for any path variables. Use a library like `strip-ansi`. Verify by passing arguments with ANSI sequences and confirming error output is sanitized.

Evidence

idx = sys.argv.index("--source-action")

            kwargs["source_action"] = sys.argv[idx + 1]

        data = add_strategy(sys.argv[2], sys.argv[3], sys.argv[4], **kwargs)

        print(f"Added strategy in {sys.argv[3]} domain. Total: {len(data['strategies_discovered'])}")

    elif cmd == "add-failure":

        if len(sys.argv) < 5:

RemediationAI

The problem is that `sys.argv[3]` (a user-controlled domain name) is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the domain before printing: replace `print(f"Added strategy in {sys.argv[3]} domain. Total: {len(data['strategies_discovered'])}")` with `domain = sys.argv[3].replace('\x1b', '').replace('\033', ''); print(f"Added strategy in {domain} domain. Total: {len(data['strategies_discovered'])}")` or use `re.sub(r'\x1b\[[0-9;]*m', '', sys.argv[3])`. Verify by passing a domain with ANSI sequences and confirming the output is sanitized.

Evidence

print(f"# X-Markdown-Tokens: {result['token_hint']}")

                print(f"# Estimated tokens: {tokens}")

                print("---")

            print(result['body'])

            if tokens > max_tokens:

                log(f"[smart-fetch] WARNING: Content exceeds {max_tokens} token limit")

RemediationAI

The problem is that `result['body']` (potentially user-controlled content) is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the body before printing: replace `print(result['body'])` with `body = result['body'].replace('\x1b', '').replace('\033', ''); print(body)` or use `re.sub(r'\x1b\[[0-9;]*m', '', result['body'])`. Verify by fetching content with ANSI sequences and confirming the output is sanitized.

Evidence

if len(sys.argv) < 4:

            print("Usage: playbook-hmac.py chain-sign <json_str> <prev_hmac>", file=sys.stderr)

            sys.exit(1)

        print(chain_sign(sys.argv[2], sys.argv[3]))

    elif cmd == "chain-verify":

        if len(sys.argv) < 5:

RemediationAI

The problem is that `sys.argv[3]` (a user-controlled HMAC value) is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the HMAC before printing: replace `print(chain_sign(sys.argv[2], sys.argv[3]))` with `result = chain_sign(sys.argv[2], sys.argv[3]); print(result.replace('\x1b', '').replace('\033', ''))` or use `re.sub(r'\x1b\[[0-9;]*m', '', result)`. Verify by passing an HMAC with ANSI sequences and confirming the output is sanitized.

Evidence

if cmd == "append":

        if len(sys.argv) < 5:

            print("Usage: playbook-history.py append <operation> <item_id> <source_session> [--payload '{}']", file=sys.stderr)

            sys.exit(1)

        operation = sys.argv[2]

        item_id = sys.argv[3]

RemediationAI

The problem is that `sys.argv[2]` (a user-controlled operation name) is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the operation before printing: replace `print(f"Usage: playbook-history.py append <operation> <item_id> <source_session> [--payload '{{}}']" ...)` with `operation = sys.argv[2].replace('\x1b', '').replace('\033', ''); print(f"Usage: playbook-history.py append {operation} ...")` or use `re.sub(r'\x1b\[[0-9;]*m', '', sys.argv[2])`. Verify by passing an operation with ANSI sequences and confirming the output is sanitized.

Evidence

if len(sys.argv) < 3:

            print("Usage: playbook-scratchpad.py summary <session_id>", file=sys.stderr)

            sys.exit(1)

        print(summary(sys.argv[2]))

    else:

        print(f"Unknown command: {cmd}", file=sys.stderr)

RemediationAI

The problem is that `sys.argv[2]` (a user-controlled session ID) is printed directly to stdout without ANSI escape sanitization, allowing injection of cursor-control sequences. Sanitize the session ID before printing: replace `print(summary(sys.argv[2]))` with `result = summary(sys.argv[2]); print(result.replace('\x1b', '').replace('\033', ''))` or use `re.sub(r'\x1b\[[0-9;]*m', '', result)`. Verify by passing a session ID with ANSI sequences and confirming the output is sanitized.

Evidence

* Hardened replacement for the ad-hoc `curl + jq` / `curl + python` pattern

 * that historically leaked credentials in plaintext into the Bash tool

 * transcript. The lesson: when probing an unknown JSON shape, NEVER fall

 * back to `console.log(JSON.stringify(body))` — that's how plaintext

 * credentials end up in shell history, session transcripts, and downstream

 * LLM context.

 *

RemediationAI

The problem is that the comment mentions a risk of plaintext credential leakage via `console.log(JSON.stringify(body))`, which could print sensitive data without ANSI escape sanitization. Replace any such logging with a sanitized version: `console.log(stripAnsi(JSON.stringify(body)))` using a library like `strip-ansi`, and add a helper function to redact known secret fields before logging. Verify by attempting to log a JSON object with credentials and confirming they are redacted or sanitized.

Evidence

"stale": len(results["stale"]),

            "skipped": len(results["skipped"]),

        }

        atomic_append(VERIFY_LOG, json.dumps(log_entry, separators=(",", ":")))

    except Exception:

        pass

    return {

        "status": "complete",

RemediationAI

The problem is that the `except Exception: pass` clause silently swallows all exceptions, hiding failures from incident response and debugging. Replace with `except Exception as e: logging.error(f"playbook-semantic-verify: verification failed: {e}", exc_info=True)` to log the exception with full traceback. This ensures failures are visible in logs. Verify by triggering an exception (e.g., by corrupting the VERIFY_LOG file) and confirming it is logged with a traceback.

Evidence

for line in AUDIT_LOG.read_text().splitlines():

        if line.strip():

            try:

                entries.append(json.loads(line))

            except json.JSONDecodeError:

                pass

    return entries

RemediationAI

The problem is that the `except json.JSONDecodeError: pass` clause silently discards malformed JSON lines, hiding data corruption or parsing errors. Replace with `except json.JSONDecodeError as e: logging.warning(f"build-state: skipping malformed JSON line: {line[:50]}... ({e})")` to log the error. This ensures data quality issues are visible. Verify by adding a malformed JSON line to AUDIT_LOG and confirming it is logged as a warning.

Evidence

Per the 2026-05-29 pipeline post-mortem (PR #545), pattern #4 was

"silent failure caught only by user." The worst recent instance was the

**PromptGate $452 incident** — a bare `catch {}` in a 5-second hot-path

detection loop that swallowed every rate-limit failure for hours,

bypassing both QuotaTracker and LlmQueue spend guards. By the time it

surfaced, it had burned $452 of credits.

RemediationAI

The problem is that the documentation acknowledges silent error swallowing as a root cause of the PromptGate incident but does not provide a concrete fix. Replace all bare `catch {}` blocks with explicit error handling: `catch (err) { logger.warn('Context: error details', { error: err.message, stack: err.stack }); }` and ensure all errors are logged with context. Add a linting rule to reject empty catch blocks. Verify by running the linter on the codebase and confirming no empty catch blocks remain.

Evidence

["python3", os.path.join(SCRIPT_DIR, "telegram-reply.py"), "285"],

            input=message, text=True, timeout=10,

            capture_output=True,

        )

    except Exception:

        pass  # Non-critical — review items are persisted regardless

def _resolve_conflicts(deltas, manifest):

RemediationAI

The problem is that the `except Exception: pass` clause silently swallows exceptions from the telegram-reply subprocess call, hiding failures in the review notification system. Replace with `except Exception as e: logging.warning(f"playbook-lifecycle: failed to send telegram reply: {e}")` to log the error. This ensures notification failures are visible. Verify by simulating a subprocess failure (e.g., by making telegram-reply.py unavailable) and confirming it is logged.

Evidence

history = _import_history()

                history.append_entry(

                    "resurrect", item_id, session_id,

                    payload={"reason": reason})

            except Exception:

                pass

            log_entry = {

                "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),

RemediationAI

The problem is that the `except Exception: pass` clause silently swallows exceptions when appending to the history log, hiding data persistence failures. Replace with `except Exception as e: logging.error(f"playbook-retirement: failed to append history entry: {e}", exc_info=True)` to log the error with traceback. This ensures failures are visible for incident investigation. Verify by simulating a write failure (e.g., by making the history file read-only) and confirming it is logged with a traceback.