instar 1.3.27 → 1.3.28

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAoCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAoB5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAwC1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAsElC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAkElC,OAAO,CAAC,oBAAoB;IA4G5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IA0C3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAoOpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAiEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAiHhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA43BvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAkG1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6ItB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAwRvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAsBpc,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC,OAAO,CAAC,mBAAmB;IAoY3B,OAAO,CAAC,wBAAwB;IA8EhC,OAAO,CAAC,2BAA2B;IAoEnC,OAAO,CAAC,yBAAyB;IAuGjC,OAAO,CAAC,2BAA2B;IAqInC,OAAO,CAAC,qBAAqB;IAqP7B,OAAO,CAAC,uBAAuB;IAqJ/B,OAAO,CAAC,qBAAqB;IAsH7B,OAAO,CAAC,2BAA2B;IA8GnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA4LpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA4B1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IA4B/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IAoHtC,OAAO,CAAC,+BAA+B;IA+JvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IA4N7B,OAAO,CAAC,qBAAqB;IA4H7B,OAAO,CAAC,qBAAqB;IA0K7B,OAAO,CAAC,6BAA6B;IAyKrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAoCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAoB5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAwC1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAsElC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAkElC,OAAO,CAAC,oBAAoB;IA4G5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IA0C3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAoOpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAiEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAiHhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA43BvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAkG1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6ItB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAwRvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAsBpc,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC,OAAO,CAAC,mBAAmB;IAoY3B,OAAO,CAAC,wBAAwB;IA8EhC,OAAO,CAAC,2BAA2B;IAoEnC,OAAO,CAAC,yBAAyB;IAuGjC,OAAO,CAAC,2BAA2B;IAqInC,OAAO,CAAC,qBAAqB;IAqP7B,OAAO,CAAC,uBAAuB;IAqJ/B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA4LpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA4B1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IA4B/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAwKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAqI7B,OAAO,CAAC,qBAAqB;IAuL7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -5459,56 +5459,64 @@ process.stdin.on('end', () => {
 // spike (gsd-executor Rule 3 exclusion: package installs are NOT
 // auto-fixable because a failed/typo'd install may be a slopsquat).
 // Signal-only — decision: approve + additionalContext. The agent decides.
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. Bare top-level \`require(...)\` throws
+// in ESM scope when the host package.json has "type":"module" — silently
+// killed this PreToolUse guard on every tool call. See hook-event-reporter.js.
+
+(async () => {
+  const fs = await import('node:fs');
+  const path = await import('node:path');
+
+  // Install-command patterns → capture the args portion after the verb.
+  const INSTALL_PATTERNS = [
+    { re: /\\bnpm\\s+(?:i|install|add)\\s+([^&|;]+)/i, mgr: 'npm' },
+    { re: /\\bpnpm\\s+(?:i|install|add)\\s+([^&|;]+)/i, mgr: 'pnpm' },
+    { re: /\\byarn\\s+add\\s+([^&|;]+)/i, mgr: 'yarn' },
+    { re: /\\bpip3?\\s+install\\s+([^&|;]+)/i, mgr: 'pip' },
+    { re: /\\bcargo\\s+add\\s+([^&|;]+)/i, mgr: 'cargo' },
+  ];
+
+  // Flags to strip when extracting package names.
+  const FLAG_RE = /^-/;
+
+  function parsePackages(argStr) {
+    return argStr
+      .trim()
+      .split(/\\s+/)
+      .filter(tok => tok && !FLAG_RE.test(tok))
+      // Strip version specifiers: pkg@1.2.3, pkg==1.2.3, pkg~=1.0
+      .map(tok => tok.replace(/[@=~<>!].*$/, '').replace(/\\[.*$/, ''))
+      .filter(Boolean);
+  }
 
-const fs = require('fs');
-const path = require('path');
-
-// Install-command patterns → capture the args portion after the verb.
-const INSTALL_PATTERNS = [
-  { re: /\\bnpm\\s+(?:i|install|add)\\s+([^&|;]+)/i, mgr: 'npm' },
-  { re: /\\bpnpm\\s+(?:i|install|add)\\s+([^&|;]+)/i, mgr: 'pnpm' },
-  { re: /\\byarn\\s+add\\s+([^&|;]+)/i, mgr: 'yarn' },
-  { re: /\\bpip3?\\s+install\\s+([^&|;]+)/i, mgr: 'pip' },
-  { re: /\\bcargo\\s+add\\s+([^&|;]+)/i, mgr: 'cargo' },
-];
-
-// Flags to strip when extracting package names.
-const FLAG_RE = /^-/;
-
-function parsePackages(argStr) {
-  return argStr
-    .trim()
-    .split(/\\s+/)
-    .filter(tok => tok && !FLAG_RE.test(tok))
-    // Strip version specifiers: pkg@1.2.3, pkg==1.2.3, pkg~=1.0
-    .map(tok => tok.replace(/[@=~<>!].*$/, '').replace(/\\[.*$/, ''))
-    .filter(Boolean);
-}
-
-// Returns the set of package names already known to the project from
-// any manifest/lockfile present in the project dir.
-function knownPackages(projectDir) {
-  const known = new Set();
-  const add = (name) => { if (name && typeof name === 'string') known.add(name.toLowerCase()); };
+  // Returns the set of package names already known to the project from
+  // any manifest/lockfile present in the project dir.
+  function knownPackages(projectDir) {
+    const known = new Set();
+    const add = (name) => { if (name && typeof name === 'string') known.add(name.toLowerCase()); };
 
-  // package.json deps + devDeps + lock
-  try {
-    const pkg = JSON.parse(fs.readFileSync(path.join(projectDir, 'package.json'), 'utf-8'));
-    for (const k of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
-      if (pkg[k]) Object.keys(pkg[k]).forEach(add);
+    // package.json deps + devDeps + lock
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(projectDir, 'package.json'), 'utf-8'));
+      for (const k of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+        if (pkg[k]) Object.keys(pkg[k]).forEach(add);
+      }
+    } catch { /* no package.json */ }
+    // package-lock.json — names appear as keys; cheap substring presence check via raw read
+    let lockRaw = '';
+    for (const lf of ['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'requirements.txt', 'Cargo.toml', 'Cargo.lock', 'Pipfile', 'pyproject.toml']) {
+      try { lockRaw += '\\n' + fs.readFileSync(path.join(projectDir, lf), 'utf-8'); } catch { /* absent */ }
     }
-  } catch { /* no package.json */ }
-  // package-lock.json — names appear as keys; cheap substring presence check via raw read
-  let lockRaw = '';
-  for (const lf of ['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'requirements.txt', 'Cargo.toml', 'Cargo.lock', 'Pipfile', 'pyproject.toml']) {
-    try { lockRaw += '\\n' + fs.readFileSync(path.join(projectDir, lf), 'utf-8'); } catch { /* absent */ }
+    return { known, lockRaw: lockRaw.toLowerCase() };
   }
-  return { known, lockRaw: lockRaw.toLowerCase() };
-}
 
-let data = '';
-process.stdin.on('data', chunk => data += chunk);
-process.stdin.on('end', () => {
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch { process.exit(0); }
+
   try {
     const input = JSON.parse(data);
     if (input.tool_name !== 'Bash') process.exit(0);
@@ -5559,7 +5567,7 @@ process.stdin.on('end', () => {
     process.stdout.write(JSON.stringify({ decision: 'approve', additionalContext: checklist.join('\\n') }));
   } catch { /* never block on errors */ }
   process.exit(0);
-});
+})();
 `;
     }
     getPostActionReflectionHook() {
@@ -5571,13 +5579,19 @@ process.stdin.on('end', () => {
 //
 // "Every action is an opportunity to learn. Most of that learning is lost
 // because nobody paused to ask: what did this teach me?"
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. See hook-event-reporter.js header.
 
-const fs = require('node:fs');
-const pathMod = require('node:path');
+(async () => {
+  const fs = await import('node:fs');
+  const pathMod = await import('node:path');
+
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch { process.exit(0); }
 
-let data = '';
-process.stdin.on('data', chunk => data += chunk);
-process.stdin.on('end', () => {
   try {
     const input = JSON.parse(data);
     if (input.tool_name !== 'Bash') process.exit(0);
@@ -5668,7 +5682,7 @@ process.stdin.on('end', () => {
     process.stdout.write(JSON.stringify({ decision: 'approve', additionalContext: reminder }));
   } catch { /* don't break on errors */ }
   process.exit(0);
-});
+})();
 `;
     }
     getExternalCommunicationGuardHook() {
@@ -6187,9 +6201,15 @@ echo "[\$(date -Iseconds)] Server restart initiated"
 // State persists in .instar/state/scope-coherence.json via the server API.
 
 // CJS imports — this is a standalone hook script, not an ESM module
-const _r = require;
-const fs = _r('fs');
-const path = _r('path');
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. Bare top-level \`require(...)\` throws in
+// ESM scope when the host has "type":"module" — silently killed this hook on
+// every fire. See hook-event-reporter.js header for the documented pattern.
+
+(async () => {
+  const fs = await import('node:fs');
+  const path = await import('node:path');
 
 const STATE_FILE = path.join('.instar', 'state', 'scope-coherence.json');
 const SCOPE_DOC_PATTERNS = [
@@ -6237,9 +6257,11 @@ function saveState(state) {
   } catch {}
 }
 
-let data = '';
-process.stdin.on('data', chunk => data += chunk);
-process.stdin.on('end', () => {
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch { process.exit(0); }
+
   try {
     const input = JSON.parse(data);
     const toolName = input.tool_name || '';
@@ -6288,7 +6310,8 @@ process.stdin.on('end', () => {
   } catch {}
   process.stdout.write(JSON.stringify({ decision: 'approve' }));
   process.exit(0);
-});
+})();
+
 `;
     }
     getScopeCoherenceCheckpointHook() {
@@ -6304,10 +6327,16 @@ process.stdin.on('end', () => {
 // Calls the Instar server for active job context to make the checkpoint actionable.
 
 // CJS imports — this is a standalone hook script, not an ESM module
-const _r = require;
-const fs = _r('fs');
-const path = _r('path');
-const http = _r('http');
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. Bare top-level \`require(...)\` throws in
+// ESM scope when the host has "type":"module" — silently killed this hook on
+// every fire. See hook-event-reporter.js header for the documented pattern.
+
+(async () => {
+  const fs = await import('node:fs');
+  const path = await import('node:path');
+  const http = await import('node:http');
 
 const STATE_FILE = path.join('.instar', 'state', 'scope-coherence.json');
 const DEPTH_THRESHOLD = 20;
@@ -6343,9 +6372,11 @@ function fetchActiveJob() {
   });
 }
 
-let data = '';
-process.stdin.on('data', chunk => data += chunk);
-process.stdin.on('end', async () => {
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch { process.exit(0); }
+
   try {
     // Re-entry guard: if this Stop is a correction continuation (stop_hook_active),
     // approve immediately — never re-block a continuation. Without this, a block →
@@ -6446,7 +6477,8 @@ process.stdin.on('end', async () => {
     process.stdout.write(JSON.stringify({ decision: 'approve' }));
   }
   process.exit(0);
-});
+})();
+
 `;
     }
     getFreeTextGuardHook() {
@@ -6477,9 +6509,15 @@ process.stdin.on('end', async () => {
 //   - Only checks topically relevant output (skip pure code, grep, cat)
 //   - Rate-limited to prevent latency stacking
 
-const _r = require;
-const fs = _r('fs');
-const path = _r('path');
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. Bare top-level \`require(...)\` throws in
+// ESM scope when the host has "type":"module" — silently killed this hook on
+// every fire. See hook-event-reporter.js header for the documented pattern.
+
+(async () => {
+  const fs = await import('node:fs');
+  const path = await import('node:path');
 
 const STATE_DIR = path.join('.instar', 'state');
 const RATE_FILE = path.join(STATE_DIR, '.claim-intercept-last.tmp');
@@ -6607,9 +6645,11 @@ function findContradictions(text, state) {
 
 // ── Main ───────────────────────────────────────────────────────
 
-let data = '';
-process.stdin.on('data', chunk => data += chunk);
-process.stdin.on('end', () => {
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch { process.exit(0); }
+
   try {
     const input = JSON.parse(data);
     const toolName = input.tool_name || '';
@@ -6674,7 +6714,8 @@ process.stdin.on('end', () => {
     process.stdout.write(JSON.stringify({ decision: 'approve', additionalContext: warning }));
   } catch {}
   process.exit(0);
-});
+})();
+
 `;
     }
     getResponseReviewHook() {
@@ -6689,10 +6730,16 @@ process.stdin.on('end', () => {
 // The CoherenceGate handles retry tracking and exhaustion internally.
 // The hook always passes the stopHookActive flag so the server can decide.
 
-const _r = require;
-const fs = _r('fs');
-const path = _r('path');
-const http = _r('http');
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. Bare top-level \`require(...)\` throws in
+// ESM scope when the host has "type":"module" — silently killed this hook on
+// every fire. See hook-event-reporter.js header for the documented pattern.
+
+(async () => {
+  const fs = await import('node:fs');
+  const path = await import('node:path');
+  const http = await import('node:http');
 
 // Read config for port and auth token
 let serverPort = ${port};
@@ -6718,9 +6765,11 @@ if (!reviewEnabled) {
   process.exit(0);
 }
 
-let data = '';
-process.stdin.on('data', chunk => data += chunk);
-process.stdin.on('end', async () => {
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch { process.exit(0); }
+
   try {
     const input = JSON.parse(data);
     const message = input.last_assistant_message || '';
@@ -6797,7 +6846,8 @@ process.stdin.on('end', async () => {
     // JSON parse error on stdin — fail open
     process.exit(0);
   }
-});
+})();
+
 `;
     }
     getStopGateRouterHook() {
@@ -6809,122 +6859,135 @@ process.stdin.on('end', async () => {
 // for hot-path state, and in shadow/enforce mode submits trusted evidence
 // metadata to /internal/stop-gate/evaluate. Shadow mode only records telemetry;
 // enforce mode blocks only on a server-side "continue" decision.
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. A bare top-level \`require(...)\` throws
+// "require is not defined in ES module scope" when the host package.json has
+// "type":"module" (which silently killed this gate — the gate meant to PREVENT
+// unjustified silent stalls). A bare top-level \`import\` is a syntax error in
+// CJS scope; dynamic import works in BOTH. See hook-event-reporter.js header.
+
+(async () => {
+  const fs = await import('node:fs');
+  const path = await import('node:path');
+  const childProcess = await import('node:child_process');
+
+  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const configPath = path.join(projectDir, '.instar', 'config.json');
+  let serverPort = ${port};
+  let authToken = '';
+  try {
+    const cfg = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+    serverPort = cfg.port || ${port};
+    authToken = cfg.authToken || '';
+  } catch {}
 
-const _r = require;
-const fs = _r('fs');
-const path = _r('path');
-const childProcess = _r('child_process');
-
-const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const configPath = path.join(projectDir, '.instar', 'config.json');
-let serverPort = ${port};
-let authToken = '';
-try {
-  const cfg = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-  serverPort = cfg.port || ${port};
-  authToken = cfg.authToken || '';
-} catch {}
-
-function postJson(urlPath, payload, timeoutMs) {
-  const controller = new AbortController();
-  const timer = setTimeout(function () { controller.abort(); }, timeoutMs);
-  return fetch('http://127.0.0.1:' + serverPort + urlPath, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'Authorization': 'Bearer ' + authToken,
-    },
-    body: JSON.stringify(payload),
-    signal: controller.signal,
-  }).then(async function (res) {
-    clearTimeout(timer);
-    if (!res.ok) throw new Error('http ' + res.status);
-    return res.json();
-  }, function (err) {
-    clearTimeout(timer);
-    throw err;
-  });
-}
+  function postJson(urlPath, payload, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(function () { controller.abort(); }, timeoutMs);
+    return fetch('http://127.0.0.1:' + serverPort + urlPath, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': 'Bearer ' + authToken,
+      },
+      body: JSON.stringify(payload),
+      signal: controller.signal,
+    }).then(async function (res) {
+      clearTimeout(timer);
+      if (!res.ok) throw new Error('http ' + res.status);
+      return res.json();
+    }, function (err) {
+      clearTimeout(timer);
+      throw err;
+    });
+  }
 
-function getJson(urlPath, timeoutMs) {
-  const controller = new AbortController();
-  const timer = setTimeout(function () { controller.abort(); }, timeoutMs);
-  return fetch('http://127.0.0.1:' + serverPort + urlPath, {
-    headers: { 'Authorization': 'Bearer ' + authToken },
-    signal: controller.signal,
-  }).then(async function (res) {
-    clearTimeout(timer);
-    if (!res.ok) throw new Error('http ' + res.status);
-    return res.json();
-  }, function (err) {
-    clearTimeout(timer);
-    throw err;
-  });
-}
+  function getJson(urlPath, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(function () { controller.abort(); }, timeoutMs);
+    return fetch('http://127.0.0.1:' + serverPort + urlPath, {
+      headers: { 'Authorization': 'Bearer ' + authToken },
+      signal: controller.signal,
+    }).then(async function (res) {
+      clearTimeout(timer);
+      if (!res.ok) throw new Error('http ' + res.status);
+      return res.json();
+    }, function (err) {
+      clearTimeout(timer);
+      throw err;
+    });
+  }
 
-function git(args) {
-  try {
-    return childProcess.execFileSync('git', ['-C', projectDir].concat(args), {
-      encoding: 'utf-8',
-      timeout: 800,
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-  } catch {
-    return '';
+  function git(args) {
+    try {
+      return childProcess.execFileSync('git', ['-C', projectDir].concat(args), {
+        encoding: 'utf-8',
+        timeout: 800,
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
+    } catch {
+      return '';
+    }
   }
-}
 
-function firstLine(value) {
-  return String(value || '').split(/\\r?\\n/).filter(Boolean)[0] || null;
-}
+  function firstLine(value) {
+    return String(value || '').split(/\\r?\\n/).filter(Boolean)[0] || null;
+  }
 
-function listEvidenceArtifacts(sessionStartTs) {
-  const out = git(['ls-files']);
-  if (!out) return [];
-  const files = out.split(/\\r?\\n/).filter(function (file) {
-    if (!file) return false;
-    if (!/\\.(md|markdown|json|jsonl|txt)$/i.test(file)) return false;
-    return /(^|\\/)(docs\\/specs|specs|plans?|tasks?|upgrades|MEMORY\\.md|AGENTS\\.md)|spec|plan|handoff|todo|next|round/i.test(file);
-  }).slice(0, 30);
-  return files.map(function (file) {
-    const introducingCommit = firstLine(git(['log', '--follow', '--format=%H', '--reverse', '--', file]));
-    const latestCommit = firstLine(git(['log', '--format=%H', '-1', '--', file]));
-    let createdThisSession = false;
-    let modifiedThisSession = false;
-    if (sessionStartTs && latestCommit) {
-      const ts = Number(firstLine(git(['show', '-s', '--format=%ct', latestCommit])) || '0') * 1000;
-      modifiedThisSession = ts >= sessionStartTs;
-      if (introducingCommit) {
-        const createdTs = Number(firstLine(git(['show', '-s', '--format=%ct', introducingCommit])) || '0') * 1000;
-        createdThisSession = createdTs >= sessionStartTs;
+  function listEvidenceArtifacts(sessionStartTs) {
+    const out = git(['ls-files']);
+    if (!out) return [];
+    const files = out.split(/\\r?\\n/).filter(function (file) {
+      if (!file) return false;
+      if (!/\\.(md|markdown|json|jsonl|txt)$/i.test(file)) return false;
+      return /(^|\\/)(docs\\/specs|specs|plans?|tasks?|upgrades|MEMORY\\.md|AGENTS\\.md)|spec|plan|handoff|todo|next|round/i.test(file);
+    }).slice(0, 30);
+    return files.map(function (file) {
+      const introducingCommit = firstLine(git(['log', '--follow', '--format=%H', '--reverse', '--', file]));
+      const latestCommit = firstLine(git(['log', '--format=%H', '-1', '--', file]));
+      let createdThisSession = false;
+      let modifiedThisSession = false;
+      if (sessionStartTs && latestCommit) {
+        const ts = Number(firstLine(git(['show', '-s', '--format=%ct', latestCommit])) || '0') * 1000;
+        modifiedThisSession = ts >= sessionStartTs;
+        if (introducingCommit) {
+          const createdTs = Number(firstLine(git(['show', '-s', '--format=%ct', introducingCommit])) || '0') * 1000;
+          createdThisSession = createdTs >= sessionStartTs;
+        }
       }
-    }
+      return {
+        path: file,
+        introducingCommit: introducingCommit,
+        latestCommit: latestCommit,
+        createdThisSession: createdThisSession,
+        modifiedThisSession: modifiedThisSession,
+      };
+    });
+  }
+
+  function buildSignals(stopReason, message) {
+    const text = String(stopReason || '') + '\\n' + String(message || '');
     return {
-      path: file,
-      introducingCommit: introducingCommit,
-      latestCommit: latestCommit,
-      createdThisSession: createdThisSession,
-      modifiedThisSession: modifiedThisSession,
+      mentionsContextLimit: /context|window|token|compact/i.test(text),
+      mentionsFreshSession: /fresh session|new session|restart|continue in a new/i.test(text),
+      claimsShouldStopForContext: /stop|pause|wrap up|hand off/i.test(text) && /context|fresh|compact/i.test(text),
     };
-  });
-}
+  }
 
-function buildSignals(stopReason, message) {
-  const text = String(stopReason || '') + '\\n' + String(message || '');
-  return {
-    mentionsContextLimit: /context|window|token|compact/i.test(text),
-    mentionsFreshSession: /fresh session|new session|restart|continue in a new/i.test(text),
-    claimsShouldStopForContext: /stop|pause|wrap up|hand off/i.test(text) && /context|fresh|compact/i.test(text),
-  };
-}
+  function exitOpen() {
+    process.exit(0);
+  }
 
-function exitOpen() {
-  process.exit(0);
-}
+  // Read the Stop-hook JSON from stdin (works in both CJS + ESM).
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch {
+    exitOpen();
+    return;
+  }
 
-let data = '';
-process.stdin.on('data', function (chunk) { data += chunk; });
-process.stdin.on('end', async function () {
   let input;
   try {
     input = data ? JSON.parse(data) : {};
@@ -6933,12 +6996,12 @@ process.stdin.on('end', async function () {
     return;
   }
 
-  if (input.stop_hook_active) exitOpen();
+  if (input.stop_hook_active) { exitOpen(); return; }
   const sessionId = String(input.session_id || input.sessionId || process.env.INSTAR_SESSION_ID || 'unknown');
 
   try {
     const hot = await getJson('/internal/stop-gate/hot-path?session=' + encodeURIComponent(sessionId), 1500);
-    if (!hot || hot.killSwitch || hot.mode === 'off' || hot.compactionInFlight) exitOpen();
+    if (!hot || hot.killSwitch || hot.mode === 'off' || hot.compactionInFlight) { exitOpen(); return; }
 
     const message = String(input.last_assistant_message || '');
     const stopReason = String(input.stop_reason || input.reason || message || '');
@@ -6966,7 +7029,7 @@ process.stdin.on('end', async function () {
   } catch {
     exitOpen();
   }
-});
+})();
 `;
     }
     getClaimInterceptResponseHook() {
@@ -6986,9 +7049,15 @@ process.stdin.on('end', async function () {
 // Guard against infinite loops:
 //   If stop_hook_active is true, we're in a correction continuation — skip.
 
-const _r = require;
-const fs = _r('fs');
-const path = _r('path');
+//
+// ESM-SAFE: dynamic \`await import(...)\` inside an async IIFE so this runs in
+// both CJS and ESM host package types. Bare top-level \`require(...)\` throws in
+// ESM scope when the host has "type":"module" — silently killed this hook on
+// every fire. See hook-event-reporter.js header for the documented pattern.
+
+(async () => {
+  const fs = await import('node:fs');
+  const path = await import('node:path');
 
 const STATE_DIR = path.join('.instar', 'state');
 const RATE_FILE = path.join(STATE_DIR, '.claim-intercept-last.tmp');
@@ -7080,9 +7149,11 @@ function findContradictions(text, state) {
   return contradictions;
 }
 
-let data = '';
-process.stdin.on('data', chunk => data += chunk);
-process.stdin.on('end', () => {
+  let data = '';
+  try {
+    for await (const chunk of process.stdin) data += chunk;
+  } catch { process.exit(0); }
+
   try {
     const input = JSON.parse(data);
 
@@ -7134,7 +7205,8 @@ process.stdin.on('end', () => {
     process.exit(2);
   } catch {}
   process.exit(0);
-});
+})();
+
 `;
     }
     getSkillUsageTelemetryHook() {