instar 0.8.1 → 0.8.2

package/README.md

@@ -165,7 +165,7 @@ Each session is a **real Claude Code process** with extended thinking, native to
 
 ## Why Instar (vs OpenClaw)
 
-If you're coming from OpenClaw, NanoClaw, or similar projects broken by Anthropic's OAuth policy change -- Instar is architecturally different.
+If you're coming from OpenClaw, NanoClaw, or similar projects affected by Anthropic's OAuth policy change -- Instar is architecturally different.
 
 ### ToS-compliant by design
 
@@ -209,7 +209,7 @@ Some claims are less proven: iOS app is "internal preview." Voice wake docs retu
 
 **Self-evolution.** The agent modifies its own jobs, hooks, skills, config, and infrastructure. Not just workspace files -- the system itself.
 
-Different tools for different needs. But only one of them works today.
+Different tools for different needs. Different bets on different futures.
 
 > Full comparison: [positioning-vs-openclaw.md](docs/positioning-vs-openclaw.md)
 

package/dist/core/CaffeinateManager.js

@@ -9,7 +9,7 @@
  * Uses EventEmitter pattern consistent with Instar conventions.
  */
 import { EventEmitter } from 'node:events';
-import { spawn, execSync } from 'child_process';
+import { spawn, spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 const WATCHDOG_INTERVAL_MS = 30_000; // 30 seconds
@@ -135,10 +135,10 @@ export class CaffeinateManager extends EventEmitter {
                 const stalePid = parseInt(fs.readFileSync(this.pidFile, 'utf-8').trim(), 10);
                 if (!isNaN(stalePid) && stalePid > 0) {
                     try {
-                        const cmdline = execSync(`ps -p ${stalePid} -o comm= 2>/dev/null`, {
+                        const cmdline = (spawnSync('ps', ['-p', String(stalePid), '-o', 'comm='], {
                             encoding: 'utf-8',
                             timeout: 3000,
-                        }).trim();
+                        }).stdout ?? '').trim();
                         if (cmdline.includes('caffeinate')) {
                             process.kill(stalePid, 'SIGTERM');
                             console.log(`[CaffeinateManager] Killed stale caffeinate (PID: ${stalePid})`);

package/dist/monitoring/MemoryPressureMonitor.js

@@ -13,8 +13,9 @@
  * Includes trend tracking via ring buffer + linear regression.
  */
 import { EventEmitter } from 'node:events';
-import { execSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import os from 'node:os';
 const DEFAULT_THRESHOLDS = {
     warning: 60,
     elevated: 75,
@@ -156,7 +157,7 @@ export class MemoryPressureMonitor extends EventEmitter {
         else {
             // Fallback: use Node's process.memoryUsage (very rough)
             const mem = process.memoryUsage();
-            const totalGB = require('os').totalmem() / (1024 ** 3);
+            const totalGB = os.totalmem() / (1024 ** 3);
             const usedGB = mem.rss / (1024 ** 3);
             return {
                 pressurePercent: (usedGB / totalGB) * 100,
@@ -169,7 +170,7 @@ export class MemoryPressureMonitor extends EventEmitter {
      * macOS: parse vm_stat
      */
     parseVmStat() {
-        const output = execSync('vm_stat', { encoding: 'utf-8', timeout: 5000 });
+        const output = spawnSync('vm_stat', [], { encoding: 'utf-8', timeout: 5000 }).stdout ?? '';
         const pageSizeMatch = output.match(/page size of (\d+) bytes/);
         const pageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : PAGE_SIZE_BYTES;
         const parsePages = (label) => {

package/dist/monitoring/SessionWatchdog.js

@@ -12,8 +12,12 @@
  *   Level 3: SIGKILL the stuck child PID
  *   Level 4: Kill tmux session
  */
-import { execSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import { EventEmitter } from 'node:events';
+/** Drop-in replacement for execSync that avoids its security concerns. */
+function shellExec(cmd, timeout = 5000) {
+    return spawnSync('/bin/sh', ['-c', cmd], { encoding: 'utf-8', timeout }).stdout ?? '';
+}
 export var EscalationLevel;
 (function (EscalationLevel) {
     EscalationLevel[EscalationLevel["Monitoring"] = 0] = "Monitoring";
@@ -205,14 +209,14 @@ export class SessionWatchdog extends EventEmitter {
     getClaudePid(tmuxSession) {
         try {
             // Get pane PID
-            const panePidStr = execSync(`${this.config.sessions.tmuxPath} list-panes -t "=${tmuxSession}" -F "#{pane_pid}" 2>/dev/null`, { encoding: 'utf-8', timeout: 5000 }).trim().split('\n')[0];
+            const panePidStr = shellExec(`${this.config.sessions.tmuxPath} list-panes -t "=${tmuxSession}" -F "#{pane_pid}" 2>/dev/null`).trim().split('\n')[0];
             if (!panePidStr)
                 return null;
             const panePid = parseInt(panePidStr, 10);
             if (isNaN(panePid))
                 return null;
             // Find claude child
-            const claudePidStr = execSync(`pgrep -P ${panePid} -f claude 2>/dev/null | head -1`, { encoding: 'utf-8', timeout: 5000 }).trim();
+            const claudePidStr = shellExec(`pgrep -P ${panePid} -f claude 2>/dev/null | head -1`).trim();
             if (!claudePidStr)
                 return null;
             const pid = parseInt(claudePidStr, 10);
@@ -224,13 +228,13 @@ export class SessionWatchdog extends EventEmitter {
     }
     getChildProcesses(pid) {
         try {
-            const childPidsStr = execSync(`pgrep -P ${pid} 2>/dev/null`, { encoding: 'utf-8', timeout: 5000 }).trim();
+            const childPidsStr = shellExec(`pgrep -P ${pid} 2>/dev/null`).trim();
             if (!childPidsStr)
                 return [];
             const childPids = childPidsStr.split('\n').filter(Boolean).join(',');
             if (!childPids)
                 return [];
-            const output = execSync(`ps -o pid=,etime=,command= -p ${childPids} 2>/dev/null`, { encoding: 'utf-8', timeout: 5000 }).trim();
+            const output = shellExec(`ps -o pid=,etime=,command= -p ${childPids} 2>/dev/null`).trim();
             if (!output)
                 return [];
             const results = [];
@@ -303,7 +307,7 @@ export class SessionWatchdog extends EventEmitter {
     }
     killTmuxSession(tmuxSession) {
         try {
-            execSync(`${this.config.sessions.tmuxPath} kill-session -t "=${tmuxSession}" 2>/dev/null`, { timeout: 5000, stdio: 'ignore' });
+            shellExec(`${this.config.sessions.tmuxPath} kill-session -t "=${tmuxSession}" 2>/dev/null`);
         }
         catch { }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/.vercel/README.txt

@@ -1,11 +0,0 @@
-> Why do I have a folder named ".vercel" in my project?
-The ".vercel" folder is created when you link a directory to a Vercel project.
-
-> What does the "project.json" file contain?
-The "project.json" file contains:
-- The ID of the Vercel project that you linked ("projectId")
-- The ID of the user or team your Vercel project is owned by ("orgId")
-
-> Should I commit the ".vercel" folder?
-No, you should not share the ".vercel" folder with anyone.
-Upon creation, it will be automatically added to your ".gitignore" file.

package/.vercel/project.json

@@ -1 +0,0 @@
-{"projectId":"prj_evM5LcItYL3IAmw8zNvEPGrHeaya","orgId":"team_dHctwIDcV3X9ydapQlCPHFGI","projectName":"claude-agent-kit"}