instar 1.3.425 → 1.3.427

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.425",
+  "version": "1.3.427",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-08T05:05:20.727Z",
-  "instarVersion": "1.3.425",
+  "generatedAt": "2026-06-08T05:54:27.957Z",
+  "instarVersion": "1.3.427",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1050,7 +1050,7 @@
       "type": "template",
       "domain": "safety",
       "sourcePath": "src/templates/hooks/dangerous-command-guard.sh",
-      "contentHash": "0a067d28b516e3da7a25682586aad59ddc47819cbc867a422cc809017967df3f",
+      "contentHash": "9c44b35ead12cf015b055b4a63d5d395257dc4479de2d83b280513c7cf214f28",
       "since": "2025-01-01"
     },
     "template:free-text-guard.sh": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "6462f37482e82b16ab0d525e4924c9ad41b908ac148d48fe8d8aee705b3993ec",
+      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/templates/hooks/dangerous-command-guard.sh

@@ -84,8 +84,15 @@ RISKY_PATTERNS=(
 # main carries remote branch protection that rejects a force-push regardless.
 FORCE_WITH_LEASE_OWN_BRANCH=0
 if echo "$INPUT" | grep -qiE 'git +push[^|;&]*--force-with-lease'; then
-  if echo "$INPUT" | grep -qiE '(^|[[:space:]:/])(main|master|develop|release[A-Za-z0-9._/-]*)([[:space:]]|:|$)'; then
-    FORCE_WITH_LEASE_OWN_BRANCH=0   # explicit protected target — keep blocking
+  # Scan ONLY the `git push …` invocation for a protected branch — NOT the whole
+  # $INPUT. The previous whole-$INPUT scan false-positived on any unrelated text in the
+  # command (e.g. a heredoc status message mentioning "release cadence" or "main"),
+  # blocking a legitimate PR-branch force-with-lease update — the recurring friction
+  # the carve-out exists to remove (2026-06-07, topic 19437). Isolating to the push
+  # invocation keeps the main/master/release block precise.
+  PUSH_INVOCATION=$(echo "$INPUT" | grep -oiE 'git +push[^|;&]*' | head -1)
+  if echo "$PUSH_INVOCATION" | grep -qiE '(^|[[:space:]:/])(main|master|develop|release[A-Za-z0-9._/-]*)([[:space:]]|:|$)'; then
+    FORCE_WITH_LEASE_OWN_BRANCH=0   # explicit protected target in the push command — keep blocking
   else
     FORCE_WITH_LEASE_OWN_BRANCH=1   # safe: force-with-lease to a non-protected branch
   fi

package/upgrades/1.3.426.md

@@ -0,0 +1,20 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixed a false-positive in the `dangerous-command-guard` safety hook. The hook allows the safe `git push --force-with-lease` to your own feature/PR branch while still blocking a force-push to a protected branch (main, master, develop, release*). It was deciding "is this a protected branch?" by scanning the entire command line for those words — so unrelated text in the command (a chained status message, a log path, anything mentioning "release" or "main") could wrongly trip the block and refuse a perfectly safe branch update. The check now reads only the extracted `git push …` portion of the command, keeping the protected-branch block precise while removing the false-positive. The same one-line fix is applied to all three places the guard is written (the shipped template, the update-migration writer, and the fresh-install writer), so deployed agents pick it up on their next update.
+
+## What to Tell Your User
+
+I fixed a case where my safety check for force-pushes was a little too eager — if a command happened to mention a word like "release" or "main" anywhere in it, I'd block a safe update to my own branch by mistake. Now I only look at the actual push command, so safe updates go through while real force-pushes to protected branches are still stopped. Existing agents get this automatically on their next update.
+
+## Summary of New Capabilities
+
+No new capability — this is a precision fix to an existing safety hook. The force-with-lease carve-out now scans only the push command, eliminating false-positives from unrelated command text while leaving the protected-branch block fully intact.
+
+## Evidence
+
+Reproduced live on 2026-06-07 (topic 19437): a `git push --force-with-lease` to a feature branch was blocked because the surrounding command text mentioned "release cadence". Before: the guard's protected-branch regex matched the word "release" anywhere in the command input and returned a block. After: the guard extracts only the `git push …` invocation and finds no protected-branch token there, so the push is allowed. A regression test pins the exact case — `git push --force-with-lease origin echo/provider-swap && echo "advancing the release cadence on main"` now exits 0 (allowed) — alongside the existing tests that still confirm force-with-lease to `main`/`master` is blocked and plain `--force`/`-f` is blocked. All 11 guard tests pass; the two sibling guard test suites (gh-pr-merge gate, codex dangerous-command block) also stay green.

package/upgrades/1.3.427.md

@@ -0,0 +1,20 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added the forward-ratchet enforcement for the "No Silent Degradation to Brittle Fallback" safety standard: `tests/unit/no-silent-llm-fallback.test.ts`. It enumerates every file that calls an LLM (`IntelligenceProvider.evaluate()`) and requires each to either carry a safety marker (degradation is reported, or the call is marked gating so it swaps providers and fails closed) or be listed as reviewed-advisory with a reason. A new LLM call that ships a silent brittle fallback in a gating path now fails CI instead of slipping through. Also recorded the round-2 convergence audit in the standard's spec: 44 callsites swept, zero dangerous fail-open gates remaining (the two that existed were fixed earlier), 23 classified as benign-advisory.
+
+## What to Tell Your User
+
+I added a guard that makes it impossible to quietly ship a safety check that silently falls back to dumb logic when its AI is unavailable — any new one has to either switch to a backup provider, refuse safely, or be explicitly reviewed. I also finished a full sweep and confirmed there are no remaining dangerous spots.
+
+## Summary of New Capabilities
+
+- A CI ratchet over every LLM call site that prevents new silent LLM-to-heuristic fallbacks in gating paths, backed by a documented, staleness-checked classification of every existing call site.
+
+## Evidence
+
+The audit that prompted this standard found two safety gates that returned a permissive verdict when their LLM was rate-limited — failing open exactly when they mattered. Those were fixed (fail-closed) and the provider-swap was added. This lint is the structural guard that stops a new one from being introduced: before it, a fresh gate with a silent heuristic fallback would pass CI unnoticed; now it fails the ratchet until the author swaps, fails closed, reports the degradation, or explicitly classifies the call as advisory. Verified by running the test against current main — it discovers 44 callsites and passes only because all are marked or reviewed; adding an unmarked gating callsite makes it fail with the offending file named.

package/upgrades/guard-forcepush-precise.eli16.md

@@ -0,0 +1,29 @@
+# Guard force-with-lease check — scope it to the actual push command
+
+> The one-line version: the safety hook that blocks force-pushes was reading the *whole* command line — including unrelated status text — so it sometimes blocked a perfectly safe branch update by mistake; now it reads only the `git push` part.
+
+## The problem in one breath
+
+Instar has a safety hook (`dangerous-command-guard`) that stops dangerous git commands. It deliberately *allows* one safe case: `git push --force-with-lease` to your own feature/PR branch (the normal way to update a rebased branch), while still blocking a force-push that targets a protected branch like `main`, `master`, `develop`, or anything starting with `release`. The trouble was *how* it decided "is this targeting a protected branch": it scanned the entire command string for those words. So if the command happened to contain unrelated text — for example a chained status message or log line that mentioned "release cadence" or "main menu" — the guard saw the word "release"/"main" and wrongly concluded you were force-pushing a protected branch. It blocked a legitimate update to a feature branch.
+
+## What already exists
+
+- **`dangerous-command-guard` hook** — a PreToolUse shell hook that inspects every shell command an agent runs and blocks catastrophic or destructive ones (`rm -rf /`, `git push --force`, etc.). It already had the force-with-lease carve-out; only the protected-branch test inside it was too broad.
+- **The carve-out itself** — the logic that says "force-with-lease to a non-protected branch is fine, force-with-lease to main is not." That intent is correct and unchanged.
+- **Three writers of the guard** — the same guard script is produced in three places: the shipped template (`src/templates/hooks/dangerous-command-guard.sh`), the migration writer that updates existing agents (`PostUpdateMigrator`), and the fresh-install writer (`init.ts`). All three carried the identical bug.
+
+## What this adds
+
+The fix narrows the protected-branch check so it looks **only at the extracted `git push …` invocation**, not the whole command. Concretely: pull out just the `git push ...` portion of the command, and check *that* for a protected-branch token. Unrelated text elsewhere in the command can no longer flip the decision. The main/master/develop/release block stays exactly as precise as before for the part that actually matters — the push command — so nothing is loosened; force-with-lease to `main` is still blocked.
+
+The same one-line change is applied to all three writers, so existing agents get it on their next update and new agents get it at install. A regression test pins the exact false-positive (a force-with-lease to a feature branch with the word "release" in trailing text must be allowed).
+
+## The safeguards
+
+**Prevents the false-positive without widening the guard.** The check is now scoped to the push invocation, so it is *narrower*, not broader. A force-push to a protected branch is still blocked; plain `--force` / `-f` (no lease) is still blocked; everything the guard caught before, it still catches.
+
+**Prevents drift between the three writers.** All three copies are fixed together, and existing tests already assert all three writers contain the carve-out, so a future edit that fixes only one copy would be caught.
+
+## What ships when
+
+One PR, one release. The migration writer means deployed agents pick the fix up automatically on their next update; no action required from anyone.

package/upgrades/side-effects/guard-forcepush-precise.md

@@ -0,0 +1,38 @@
+# Side-Effects Review — scope force-with-lease protected-branch check to the push invocation
+
+**Version / slug:** `guard-forcepush-precise`
+**Date:** `2026-06-07`
+**Author:** `echo`
+**Second-pass reviewer:** `self-review under the Tier-1 lite lane; the does-this-widen-the-guard question addressed below`
+
+## Summary of the change
+
+The `dangerous-command-guard` carve-out that permits `git push --force-with-lease` to a non-protected branch previously decided "is this a protected branch?" by scanning the WHOLE command input (`$INPUT`) for `(main|master|develop|release*)`. Any unrelated text in the command — a chained heredoc status message, a redirect path, a log line mentioning "release cadence" or "main" — false-positived and blocked a legitimate PR-branch force-with-lease update (observed live 2026-06-07, topic 19437: a force-push whose accompanying report text mentioned "release cadence" was blocked). The fix extracts only the `git push …` invocation (`grep -oiE 'git +push[^|;&]*' | head -1`) and scans THAT for the protected-branch token. Applied identically to all three writers (template, PostUpdateMigrator, init.ts) plus a regression test.
+
+## Decision-point inventory
+
+- Protected-branch scan target — modified — `$INPUT` (whole command) → `$PUSH_INVOCATION` (extracted `git push …` segment only). No change to the regex itself.
+- Carve-out semantics — unchanged — force-with-lease to a non-protected branch allowed; to main/master/develop/release* blocked; plain `--force`/`-f` blocked.
+- Writers touched — all three (template `.sh`, `PostUpdateMigrator.getDangerousCommandGuard`, `init.ts` inline copy) — kept byte-consistent.
+
+## 1. Direction-of-failure analysis
+
+- **Old failure (live):** the guard blocked a SAFE force-with-lease to a feature branch whenever unrelated command text contained a protected-branch word → recurring friction; the agent could not update its own PR branch and resorted to workarounds.
+- **New behavior:** the scan is confined to the push command. `git push --force-with-lease origin echo/feature && echo "release cadence on main"` is now ALLOWED (push targets a feature branch); `git push --force-with-lease origin main` is still BLOCKED. Both pinned by tests.
+- **Trust surface NOT widened:** the change makes the protected-branch check NARROWER (fewer inputs match), never broader. A force-push to a protected branch, and plain `--force`/`-f`, remain blocked exactly as before — verified by the existing "BLOCKS force-with-lease that explicitly targets main/master" and "BLOCKS plain git push --force" tests, which still pass.
+
+## 2. Over-permit
+
+None. The only behavioral delta is that unrelated text outside the `git push` segment no longer triggers the protected-branch block. No new verbs, no wildcarding, no relaxation of the protected-branch set.
+
+## 3. Scope deliberately NOT taken
+
+- The broader text-scanning class (a `git commit` whose *message* mentions `git push --force` trips the risky-pattern loop) is a real but separate limitation of the deploy/risky-pattern scan; fixing it requires command-verb parsing across the whole guard and is out of scope for this targeted carve-out fix. Noted for a follow-up.
+
+## 4. Migration parity
+
+Covered. The migration writer (`PostUpdateMigrator.getDangerousCommandGuard`) is fixed, so existing agents receive the corrected guard on their next update (built-in `instar/` hooks are always-overwritten on migration). New agents get it via `init.ts`. The shipped template is fixed for completeness.
+
+## 5. Token/cost impact
+
+None.