instar 1.3.102 → 1.3.104

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-29T23:18:48.200Z",
-  "instarVersion": "1.3.102",
+  "generatedAt": "2026-05-30T00:17:16.098Z",
+  "instarVersion": "1.3.104",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -65,7 +65,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -74,7 +74,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -83,7 +83,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -101,7 +101,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -110,7 +110,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -128,7 +128,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1009,7 +1009,7 @@
       "type": "template",
       "domain": "safety",
       "sourcePath": "src/templates/hooks/compaction-recovery.sh",
-      "contentHash": "ca6a2a5c2ee03839654c9708912292bc03d81c61281dffbbb958d4877ee1dc91",
+      "contentHash": "f65f4731a5142981cf021e948afa5b064dcc35ceadf6efd5354d749f2d85569f",
       "since": "2025-01-01"
     },
     "template:dangerous-command-guard.sh": {
@@ -1049,7 +1049,7 @@
       "type": "template",
       "domain": "safety",
       "sourcePath": "src/templates/hooks/session-start.sh",
-      "contentHash": "4d98736d3ee30fe8639f0851e5e492416ad05f4ae49f84e8695723faa4b9398e",
+      "contentHash": "d8b20ab9e46aecc400171bde09a5a64f5a1eeb53e09017564cebc65e67fca062",
       "since": "2025-01-01"
     },
     "template:settings-template.json": {
@@ -1073,7 +1073,7 @@
       "type": "template",
       "domain": "safety",
       "sourcePath": "src/templates/hooks/slack-channel-context.sh",
-      "contentHash": "da9c34225af5d0a1f202d51263d864ac2ac8facf7f4e4b4d736e2b2b9b54d70a",
+      "contentHash": "ebb2a74ce3819a148b1cfaace3d3467d317ed8cccd98db5cd7ffe0df3a2e9784",
       "since": "2025-01-01"
     },
     "template:telegram-topic-context.sh": {
@@ -1081,7 +1081,7 @@
       "type": "template",
       "domain": "safety",
       "sourcePath": "src/templates/hooks/telegram-topic-context.sh",
-      "contentHash": "57cfb744bbffcd21f6290c5f38726b105b93258bf09cc539c24d66aebed9c40e",
+      "contentHash": "317b11084547271dab3f333be8bdf5e536a5af7239f50d51030c62990b4b7e59",
       "since": "2025-01-01"
     },
     "template:convergence-check.sh": {
@@ -1113,7 +1113,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/imessage-reply.sh",
-      "contentHash": "aa34955027f094d5a78973762ac30c92816cc73399108b1ad0fb427e3ae70f1c",
+      "contentHash": "e4ecc66feaaea92c5f65f008e5b82b1022c7fd61ee9e4f1ed1346106b4a63d6c",
       "since": "2025-01-01"
     },
     "template:instar-watchdog.sh": {
@@ -1121,7 +1121,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/instar-watchdog.sh",
-      "contentHash": "d81ed54264fbb6091f2b29365c6dd318f491f2acfabbbb5ff20582336867f53d",
+      "contentHash": "1f462b267e6724bea21692e617bd61a6b7cd4def7187321871cdc1fc178d1d1b",
       "since": "2025-01-01"
     },
     "template:instar-worktree-create.sh": {
@@ -1137,7 +1137,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/secret-drop-retrieve.mjs",
-      "contentHash": "2acc881ce53c879047f0e98b9afd5c66f293c48046c62fff8587123078145c98",
+      "contentHash": "3c99a8d8898868e31e88c4b729b57968c14cb723c9ffb6f903d36a1e18841156",
       "since": "2025-01-01"
     },
     "template:serendipity-capture.sh": {
@@ -1145,7 +1145,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/serendipity-capture.sh",
-      "contentHash": "2e905386fd889bfc9246a44a3b2c58a6cb68f02e703aded8900107ab5188570b",
+      "contentHash": "317bc0bbb09bf03c9755ab25ca0b8da940eccb8a74886fac60045163c6bdd091",
       "since": "2025-01-01"
     },
     "template:slack-reply.sh": {
@@ -1153,7 +1153,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/slack-reply.sh",
-      "contentHash": "1813442032e435e4ecbf01467510e39a33c3feb3acb1407307c5569a65f30305",
+      "contentHash": "ea698ef54e0e48233d82225c6cfcf886f58c7939101d966cfafc5e85edcac6a4",
       "since": "2025-01-01"
     },
     "template:smart-fetch.py": {
@@ -1169,7 +1169,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/telegram-reply.sh",
-      "contentHash": "371d7e8f4f72146bf8bd07115873bdbbaaf32e851ac6e1318ba5b8929cd06e68",
+      "contentHash": "0f6d27a522b123551871e6081774f8c89d1ad0ce248597af7dd60d8522871069",
       "since": "2025-01-01"
     },
     "template:whatsapp-reply.sh": {
@@ -1177,7 +1177,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/whatsapp-reply.sh",
-      "contentHash": "a226d76025036d6b0f11ffcded50a748ff8d2102f2dbb06ce86599001b62ec23",
+      "contentHash": "942712aa272235bca9f14ab6baa23bbe5ae0a8bf20f76edf87c963b181a7764c",
       "since": "2025-01-01"
     },
     "playbook-script:atomic_write.py": {
@@ -1489,7 +1489,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "7a002d7b539b987c142ef77985ff086a370571c1c6922a1a6e9b7119a3d652c3",
+      "contentHash": "a2f7941039c9bb8bfe6777412d3fee869077eb9a3d6e359c8f5efe52b3a693bb",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/templates/hooks/compaction-recovery.sh

@@ -174,9 +174,12 @@ echo ""
 # Resolves Open Question #5 from the Consent & Discovery Framework spec:
 # lastSurfacedAt timestamps persist in SQLite regardless of context state.
 if [ -f "$CONFIG_FILE" ]; then
-  PORT=$(grep -o '"port":[0-9]*' "$CONFIG_FILE" | head -1 | cut -d':' -f2)
+  PORT=$(grep -oE '"port"[[:space:]]*:[[:space:]]*[0-9]+' "$CONFIG_FILE" | head -1 | grep -oE '[0-9]+' | head -1)
   if [ -n "$PORT" ]; then
-    AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('authToken',''))" 2>/dev/null)
+    AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+    if [ -z "$AUTH_TOKEN" ]; then
+      AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('$CONFIG_FILE')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+    fi
     FEATURES_JSON=$(curl -s -H "Authorization: Bearer ${AUTH_TOKEN}" \
       "http://localhost:${PORT}/features/summary" 2>/dev/null)
     if [ -n "$FEATURES_JSON" ]; then
@@ -235,7 +238,7 @@ fi
 # Server health reminder + recent Telegram context
 CONFIG_FILE="$INSTAR_DIR/config.json"
 if [ -f "$CONFIG_FILE" ]; then
-  PORT=$(grep -o '"port":[0-9]*' "$CONFIG_FILE" | head -1 | cut -d':' -f2)
+  PORT=$(grep -oE '"port"[[:space:]]*:[[:space:]]*[0-9]+' "$CONFIG_FILE" | head -1 | grep -oE '[0-9]+' | head -1)
   if [ -n "$PORT" ]; then
     echo "Server: curl http://localhost:${PORT}/health | Capabilities: curl http://localhost:${PORT}/capabilities"
 
@@ -247,7 +250,10 @@ if [ -f "$CONFIG_FILE" ]; then
       # Slack channel context — if INSTAR_SLACK_CHANNEL is set, this is a Slack session
       SLACK_CHANNEL="${INSTAR_SLACK_CHANNEL:-}"
       if [ -n "$SLACK_CHANNEL" ]; then
-        AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('authToken',''))" 2>/dev/null)
+        AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+    if [ -z "$AUTH_TOKEN" ]; then
+      AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('$CONFIG_FILE')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+    fi
         SLACK_MSGS=$(curl -s \
           -H "Authorization: Bearer ${AUTH_TOKEN}" \
           "http://localhost:${PORT}/slack/channels/${SLACK_CHANNEL}/messages?limit=20" 2>/dev/null)
@@ -346,7 +352,10 @@ except Exception:
       fi
 
       if [ -n "$TOPIC_FOR_CONTEXT" ]; then
-        AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('authToken',''))" 2>/dev/null)
+        AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+    if [ -z "$AUTH_TOKEN" ]; then
+      AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('$CONFIG_FILE')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+    fi
         if [ -n "$AUTH_TOKEN" ]; then
           RECENT_MSGS=$(curl -s \
             -H "Authorization: Bearer ${AUTH_TOKEN}" \
@@ -418,9 +427,12 @@ fi
 # This surfaces what you already know that's relevant to the current context,
 # preventing you from re-deriving knowledge you've already accumulated.
 if [ -f "$CONFIG_FILE" ]; then
-  PORT=$(grep -o '"port":[0-9]*' "$CONFIG_FILE" | head -1 | cut -d':' -f2)
+  PORT=$(grep -oE '"port"[[:space:]]*:[[:space:]]*[0-9]+' "$CONFIG_FILE" | head -1 | grep -oE '[0-9]+' | head -1)
   if [ -n "$PORT" ]; then
-    AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('authToken',''))" 2>/dev/null)
+    AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+    if [ -z "$AUTH_TOKEN" ]; then
+      AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('$CONFIG_FILE')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+    fi
     WORKING_MEM=$(curl -s -H "Authorization: Bearer ${AUTH_TOKEN}" \
       "http://localhost:${PORT}/context/working-memory?prompt=compaction-recovery&limit=5" 2>/dev/null)
     if [ -n "$WORKING_MEM" ]; then
@@ -452,10 +464,13 @@ fi
 # so it gives us a guaranteed signal. The server will check for unanswered user
 # messages and re-inject them shortly after this hook completes.
 if [ -f "$CONFIG_FILE" ] && command -v tmux >/dev/null 2>&1; then
-  PORT=$(grep -o '"port":[0-9]*' "$CONFIG_FILE" | head -1 | cut -d':' -f2)
+  PORT=$(grep -oE '"port"[[:space:]]*:[[:space:]]*[0-9]+' "$CONFIG_FILE" | head -1 | grep -oE '[0-9]+' | head -1)
   TMUX_SESSION=$(tmux display-message -p '#S' 2>/dev/null)
   if [ -n "$PORT" ] && [ -n "$TMUX_SESSION" ]; then
-    AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('authToken',''))" 2>/dev/null)
+    AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+    if [ -z "$AUTH_TOKEN" ]; then
+      AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('$CONFIG_FILE')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+    fi
     curl -s -m 2 -X POST \
       -H "Authorization: Bearer ${AUTH_TOKEN}" \
       -H "Content-Type: application/json" \

package/src/templates/hooks/session-start.sh

@@ -21,12 +21,19 @@ if [ ! -f "$CONFIG_FILE" ]; then
   exit 0
 fi
 
-PORT=$(grep -o '"port":[0-9]*' "$CONFIG_FILE" | head -1 | cut -d':' -f2)
+PORT=$(grep -oE '"port"[[:space:]]*:[[:space:]]*[0-9]+' "$CONFIG_FILE" | head -1 | grep -oE '[0-9]+' | head -1)
 if [ -z "$PORT" ]; then
   exit 0
 fi
 
-AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('authToken',''))" 2>/dev/null)
+# Resolve auth token: INSTAR_AUTH_TOKEN env first (SessionManager injects it per
+# spawned session — survives secret-externalization), legacy plaintext-config
+# fallback with string-type guard so the { "secret": true } placeholder produced
+# by SecretMigrator cannot leak through as a bogus Bearer.
+AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+if [ -z "$AUTH_TOKEN" ]; then
+  AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('$CONFIG_FILE')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+fi
 
 # Check if server is alive
 HEALTH=$(curl -s -o /dev/null -w "%{http_code}" \

package/src/templates/hooks/slack-channel-context.sh

@@ -29,7 +29,14 @@ if [ -f ".instar/config.json" ]; then
     CONFIG_PORT=$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('port',''))" 2>/dev/null)
     [ -n "$CONFIG_PORT" ] && PORT="$CONFIG_PORT"
   fi
-  AUTH=$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null)
+  # Auth resolution: INSTAR_AUTH_TOKEN env first (SessionManager injects it per
+  # spawned session — survives secret-externalization), legacy plaintext-config
+  # fallback with string-type guard so the { "secret": true } placeholder
+  # produced by SecretMigrator cannot leak through as a bogus Bearer.
+  AUTH="${INSTAR_AUTH_TOKEN:-}"
+  if [ -z "$AUTH" ]; then
+    AUTH=$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+  fi
 fi
 
 PORT="${PORT:-4042}"

package/src/templates/hooks/telegram-topic-context.sh

@@ -43,7 +43,7 @@ if [ ! -f "$CONFIG_FILE" ]; then
   exit 0
 fi
 
-PORT=$(grep -o '"port":[0-9]*' "$CONFIG_FILE" | head -1 | cut -d':' -f2)
+PORT=$(grep -oE '"port"[[:space:]]*:[[:space:]]*[0-9]+' "$CONFIG_FILE" | head -1 | grep -oE '[0-9]+' | head -1)
 if [ -z "$PORT" ]; then
   exit 0
 fi
@@ -54,8 +54,20 @@ if [ "$HEALTH" != "200" ]; then
   exit 0
 fi
 
+# Resolve the auth token. INSTAR_AUTH_TOKEN env first — SessionManager injects
+# this into every spawned Claude Code session, so hooks running inside a session
+# always have it; survives the secret-externalization refactor that moved authToken
+# out of config.json into the encrypted store. Legacy fallback reads config.json
+# with a string-type guard: after externalization the value is the literal
+# placeholder { "secret": true } — the guard rejects it and yields empty so we
+# never send the placeholder as a Bearer token (which the server rejects with 403,
+# silently breaking history injection — the 2026-05-29 incident this fix is for).
+AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+if [ -z "$AUTH_TOKEN" ] && [ -f "$CONFIG_FILE" ]; then
+  AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('$CONFIG_FILE')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+fi
+
 # Fetch recent messages for this topic
-AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('$CONFIG_FILE')).get('authToken',''))" 2>/dev/null)
 if [ -n "$AUTH_TOKEN" ]; then
   RECENT_MSGS=$(curl -s \
     -H "Authorization: Bearer ${AUTH_TOKEN}" \

package/src/templates/scripts/imessage-reply.sh

@@ -42,9 +42,13 @@ fi
 
 PORT="${INSTAR_PORT:-4042}"
 
-AUTH_TOKEN=""
-if [ -f ".instar/config.json" ]; then
-  AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null)
+# Auth: env first (SessionManager injects it per spawned session and it
+# survives secret-externalization), legacy plaintext-config fallback with
+# string-type guard so the { "secret": true } placeholder produced by
+# SecretMigrator cannot leak through as a bogus Bearer.
+AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+if [ -z "$AUTH_TOKEN" ] && [ -f ".instar/config.json" ]; then
+  AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
 fi
 
 # Escape message for JSON

package/src/templates/scripts/instar-watchdog.sh

@@ -324,7 +324,11 @@ escalate_via_peer() {
     node_bin=$(resolve_node || true)
     [ -z "$node_bin" ] && continue
     local peer_meta
-    peer_meta=$("$node_bin" -e "const c=JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'));process.stdout.write((c.port||'')+'\t'+(c.authToken||''))" "$peer_dir/.instar/config.json" 2>/dev/null || true)
+    # The string-type guard on authToken protects against the { secret: true }
+    # placeholder that SecretMigrator writes after externalizing the auth token:
+    # `c.authToken || ''` would otherwise return the object itself (truthy)
+    # which serializes to "[object Object]" — never a valid Bearer.
+    peer_meta=$("$node_bin" -e "const c=JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'));const t=typeof c.authToken==='string'?c.authToken:'';process.stdout.write((c.port||'')+'\t'+t)" "$peer_dir/.instar/config.json" 2>/dev/null || true)
     peer_port="${peer_meta%%	*}"
     peer_auth="${peer_meta##*	}"
     [ -z "$peer_port" ] && continue
@@ -434,11 +438,16 @@ probe_server_identity() {
   node_bin=$(resolve_node || true)
   [ -z "$node_bin" ] && return 0
 
-  # Read port + authToken in one node invocation. The authToken is required
-  # because /health gates the `project` field behind authentication — without
-  # it the probe can't verify identity and would silently fail-open.
+  # Read port + authToken in one node invocation. The authToken is needed
+  # because /health gates the `project` field behind authentication; without
+  # it the probe can still hit /health for a basic alive check but loses the
+  # identity disambiguation. INSTAR_AUTH_TOKEN env is preferred when set
+  # (preserves cross-version compatibility). The string-type guard rejects the
+  # { secret: true } placeholder SecretMigrator writes after externalizing the
+  # auth token — `String(c.authToken || '')` would otherwise yield
+  # "[object Object]" and the Bearer would be invalid.
   local meta
-  meta=$("$node_bin" -e "const c=JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'));process.stdout.write(String(c.port||'')+'\t'+String(c.authToken||''))" "$config_file" 2>/dev/null || true)
+  meta=$("$node_bin" -e "const c=JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'));const t=process.env.INSTAR_AUTH_TOKEN||(typeof c.authToken==='string'?c.authToken:'');process.stdout.write(String(c.port||'')+'\t'+t)" "$config_file" 2>/dev/null || true)
   port="${meta%%	*}"
   auth_token="${meta##*	}"
   # Lifeline-only agents have no port; treat as healthy from probe POV.

package/src/templates/scripts/secret-drop-retrieve.mjs

@@ -47,15 +47,23 @@ if (!token || !mode || mode === '--consume') {
   process.exit(2);
 }
 
-let authToken;
+// Auth-token resolution: INSTAR_AUTH_TOKEN env first (SessionManager and
+// JobScheduler inject it for every spawned context; survives the
+// secret-externalization refactor that moved authToken out of config.json into
+// the encrypted store), legacy plaintext-config fallback with a string-type
+// guard so the { "secret": true } placeholder produced by SecretMigrator
+// cannot leak through as a bogus Bearer.
+let authToken = process.env.INSTAR_AUTH_TOKEN || '';
 let port;
 try {
   const config = JSON.parse(fs.readFileSync('.instar/config.json', 'utf-8'));
-  authToken = config.authToken;
+  if (!authToken && typeof config.authToken === 'string') authToken = config.authToken;
   port = config.port;
 } catch (e) {
-  process.stderr.write('cannot read .instar/config.json: ' + e.message + '\n');
-  process.exit(2);
+  if (!authToken) {
+    process.stderr.write('cannot read .instar/config.json: ' + e.message + '\n');
+    process.exit(2);
+  }
 }
 
 // Port resolution: env > config. Mirrors the telegram-reply.sh precedence

package/src/templates/scripts/serendipity-capture.sh

@@ -294,15 +294,21 @@ if patch_file or artifact_type:
 # Key derivation: HMAC-SHA256(authToken, "serendipity-v1:" + sessionId)
 signing_key = os.environ.get("SERENDIPITY_SIGNING_KEY", "")
 if not signing_key:
-    # Derive from auth token + session
-    config_path = os.environ.get("CONFIG_FILE", "")
-    auth_token = ""
-    if config_path and os.path.exists(config_path):
-        try:
-            cfg = json.load(open(config_path))
-            auth_token = cfg.get("authToken", "")
-        except:
-            pass
+    # Derive from auth token + session. Token: INSTAR_AUTH_TOKEN env first
+    # (SessionManager injects it; survives secret-externalization), legacy
+    # plaintext-config fallback with a string-type guard so the
+    # { "secret": true } placeholder produced by SecretMigrator cannot leak.
+    auth_token = os.environ.get("INSTAR_AUTH_TOKEN", "")
+    if not auth_token:
+        config_path = os.environ.get("CONFIG_FILE", "")
+        if config_path and os.path.exists(config_path):
+            try:
+                cfg = json.load(open(config_path))
+                v = cfg.get("authToken", "")
+                if isinstance(v, str):
+                    auth_token = v
+            except:
+                pass
     session_id = finding["source"]["sessionId"]
     key_material = f"serendipity-v1:{session_id}"
     signing_key = hmac.new(

package/src/templates/scripts/slack-reply.sh

@@ -44,7 +44,14 @@ if [ -f ".instar/config.json" ]; then
     CONFIG_PORT=$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('port',''))" 2>/dev/null)
     [ -n "$CONFIG_PORT" ] && PORT="$CONFIG_PORT"
   fi
-  AUTH=$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null)
+  # Auth: env first (SessionManager injects it into spawned sessions; survives
+  # secret-externalization), legacy plaintext-config fallback with string-type
+  # guard so the { "secret": true } placeholder produced by SecretMigrator
+  # cannot leak as a bogus Bearer.
+  AUTH="${INSTAR_AUTH_TOKEN:-}"
+  if [ -z "$AUTH" ]; then
+    AUTH=$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
+  fi
 fi
 
 PORT="${PORT:-4042}"

package/src/templates/scripts/telegram-reply.sh

@@ -75,9 +75,13 @@ if [ -z "$MSG" ]; then
 fi
 
 # Resolve config-derived values from .instar/config.json (single python3
-# invocation). Env > config > 4040-warn for port; config-only for authToken
-# and agentId.
-AUTH_TOKEN=""
+# invocation). Env > config > 4040-warn for port. Auth: INSTAR_AUTH_TOKEN env
+# first (SessionManager injects it per spawned session; survives the
+# secret-externalization refactor that moved authToken out of config.json into
+# the encrypted store), legacy plaintext-config fallback with a string-type
+# guard so the { "secret": true } placeholder produced by SecretMigrator
+# cannot leak through as a bogus Bearer.
+AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
 AGENT_ID=""
 CONFIG_PORT=""
 if [ -f ".instar/config.json" ]; then
@@ -87,11 +91,13 @@ try:
     c = json.load(open('.instar/config.json'))
 except Exception:
     sys.exit(0)
-print(c.get('authToken', ''))
+v = c.get('authToken', '')
+print(v if isinstance(v, str) else '')
 print(c.get('projectName', ''))
 print(c.get('port', ''))
 " 2>/dev/null)
-  AUTH_TOKEN=$(printf '%s\n' "$CONFIG_VALUES" | sed -n '1p')
+  CONFIG_AUTH=$(printf '%s\n' "$CONFIG_VALUES" | sed -n '1p')
+  [ -z "$AUTH_TOKEN" ] && AUTH_TOKEN="$CONFIG_AUTH"
   AGENT_ID=$(printf '%s\n' "$CONFIG_VALUES" | sed -n '2p')
   CONFIG_PORT=$(printf '%s\n' "$CONFIG_VALUES" | sed -n '3p')
 fi

package/src/templates/scripts/whatsapp-reply.sh

@@ -33,10 +33,13 @@ fi
 
 PORT="${INSTAR_PORT:-4040}"
 
-# Read auth token from config (if present)
-AUTH_TOKEN=""
-if [ -f ".instar/config.json" ]; then
-  AUTH_TOKEN=$(python3 -c "import json; print(json.load(open('.instar/config.json')).get('authToken',''))" 2>/dev/null)
+# Read auth token: env first (SessionManager injects it per spawned session and
+# it survives secret-externalization), legacy plaintext-config fallback with
+# string-type guard so the { "secret": true } placeholder produced by
+# SecretMigrator cannot leak through as a bogus Bearer.
+AUTH_TOKEN="${INSTAR_AUTH_TOKEN:-}"
+if [ -z "$AUTH_TOKEN" ] && [ -f ".instar/config.json" ]; then
+  AUTH_TOKEN=$(python3 -c "import json; v=json.load(open('.instar/config.json')).get('authToken',''); print(v if isinstance(v, str) else '')" 2>/dev/null)
 fi
 
 # Escape for JSON