instar 1.3.465 → 1.3.467

package/dist/core/ensureInteractiveReady.d.ts

@@ -0,0 +1,58 @@
+/**
+ * ensureInteractiveReady — onboarding-safe config homes for the subscription
+ * pool (2026-06-09 incident, topic 20905).
+ *
+ * Pool-account config homes are created via `claude auth login`, which stores
+ * OAuth tokens but is HEADLESS-ONLY: it never sets the interactive first-launch
+ * onboarding flags. Relaunching an INTERACTIVE Claude Code session into such a
+ * home (session pinning, proactive/reactive account swap) re-runs first-launch
+ * onboarding — the OAuth-authorize URL + the "Bypass Permissions mode" accept
+ * screen — and the session wedges. The tokens were present; the onboarding
+ * FLAGS were the missing piece (~8 live sessions wedged, browser-tab spam,
+ * a manual operator login to recover).
+ *
+ * This util makes pin/swap onboarding-safe by construction: idempotently seed
+ * the three local trust-acknowledgement flags in `<configHome>/.claude.json`,
+ * preserving every other key byte-for-byte.
+ *
+ * Structural invariants:
+ *   - NEVER touches `oauthAccount` or any token/credential field — only the
+ *     three onboarding flags are ever written, onto the parsed existing object.
+ *   - NEVER rewrites a file it cannot parse — an unparseable `.claude.json`
+ *     may still hold the account's credentials in a salvageable form, so we
+ *     refuse and report rather than clobber.
+ *   - Fail-safe: never throws into the caller. A launch must not crash on
+ *     this; the worst case is the pre-fix behavior (onboarding wedge), not a
+ *     dead spawn path. All failures return `{ patched: false, reason }`.
+ *   - Idempotent + cheap (one stat/read; a write only when a flag is missing),
+ *     so calling it defensively on every pinned/swapped launch is fine.
+ */
+/**
+ * The interactive first-launch flags `claude auth login` (headless) never
+ * sets. All three are LOCAL trust acknowledgements — seeding them to `true`
+ * asserts nothing about credentials, only that first-launch onboarding and
+ * the bypass-permissions/trust dialogs are accepted for this home.
+ */
+export declare const INTERACTIVE_ONBOARDING_FLAGS: readonly ["hasCompletedOnboarding", "bypassPermissionsModeAccepted", "hasTrustDialogAccepted"];
+export interface EnsureInteractiveReadyResult {
+    /** True when this call wrote one or more missing flags. */
+    patched: boolean;
+    /** Why nothing was written (or which flags were seeded when patched). */
+    reason: string;
+}
+export interface EnsureInteractiveReadyOptions {
+    /**
+     * When true, a config home whose directory does not exist is left alone
+     * (`patched: false`) instead of being created. Used by the one-time
+     * migration sweep so a stale pool entry never litters $HOME with empty
+     * credential-less homes; launch paths keep the default (create/merge —
+     * the account was just selected, so its home is expected to exist).
+     */
+    requireExistingHome?: boolean;
+}
+/**
+ * Idempotently mark `<configHome>/.claude.json` interactive-ready. Returns
+ * `{ patched: true }` only when a missing flag was actually written.
+ */
+export declare function ensureInteractiveReady(configHome: string, opts?: EnsureInteractiveReadyOptions): EnsureInteractiveReadyResult;
+//# sourceMappingURL=ensureInteractiveReady.d.ts.map

package/dist/core/ensureInteractiveReady.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureInteractiveReady.d.ts","sourceRoot":"","sources":["../../src/core/ensureInteractiveReady.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,gGAI/B,CAAC;AAEX,MAAM,WAAW,4BAA4B;IAC3C,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,6BAA6B;IAC5C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,6BAA6B,GACnC,4BAA4B,CA+D9B"}

package/dist/core/ensureInteractiveReady.js

@@ -0,0 +1,114 @@
+/**
+ * ensureInteractiveReady — onboarding-safe config homes for the subscription
+ * pool (2026-06-09 incident, topic 20905).
+ *
+ * Pool-account config homes are created via `claude auth login`, which stores
+ * OAuth tokens but is HEADLESS-ONLY: it never sets the interactive first-launch
+ * onboarding flags. Relaunching an INTERACTIVE Claude Code session into such a
+ * home (session pinning, proactive/reactive account swap) re-runs first-launch
+ * onboarding — the OAuth-authorize URL + the "Bypass Permissions mode" accept
+ * screen — and the session wedges. The tokens were present; the onboarding
+ * FLAGS were the missing piece (~8 live sessions wedged, browser-tab spam,
+ * a manual operator login to recover).
+ *
+ * This util makes pin/swap onboarding-safe by construction: idempotently seed
+ * the three local trust-acknowledgement flags in `<configHome>/.claude.json`,
+ * preserving every other key byte-for-byte.
+ *
+ * Structural invariants:
+ *   - NEVER touches `oauthAccount` or any token/credential field — only the
+ *     three onboarding flags are ever written, onto the parsed existing object.
+ *   - NEVER rewrites a file it cannot parse — an unparseable `.claude.json`
+ *     may still hold the account's credentials in a salvageable form, so we
+ *     refuse and report rather than clobber.
+ *   - Fail-safe: never throws into the caller. A launch must not crash on
+ *     this; the worst case is the pre-fix behavior (onboarding wedge), not a
+ *     dead spawn path. All failures return `{ patched: false, reason }`.
+ *   - Idempotent + cheap (one stat/read; a write only when a flag is missing),
+ *     so calling it defensively on every pinned/swapped launch is fine.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * The interactive first-launch flags `claude auth login` (headless) never
+ * sets. All three are LOCAL trust acknowledgements — seeding them to `true`
+ * asserts nothing about credentials, only that first-launch onboarding and
+ * the bypass-permissions/trust dialogs are accepted for this home.
+ */
+export const INTERACTIVE_ONBOARDING_FLAGS = [
+    'hasCompletedOnboarding',
+    'bypassPermissionsModeAccepted',
+    'hasTrustDialogAccepted',
+];
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Idempotently mark `<configHome>/.claude.json` interactive-ready. Returns
+ * `{ patched: true }` only when a missing flag was actually written.
+ */
+export function ensureInteractiveReady(configHome, opts) {
+    try {
+        const trimmed = (configHome ?? '').trim();
+        if (!trimmed)
+            return { patched: false, reason: 'empty configHome' };
+        // Expand a `~` prefix the same way the swap-continuity path does — pool
+        // entries are operator-entered and may be tilde-relative.
+        const home = trimmed.startsWith('~')
+            ? path.join(process.env.HOME ?? '', trimmed.slice(1))
+            : trimmed;
+        const filePath = path.join(home, '.claude.json');
+        if (opts?.requireExistingHome && !fs.existsSync(home)) {
+            return { patched: false, reason: `config home ${home} does not exist` };
+        }
+        let existing = {};
+        if (fs.existsSync(filePath)) {
+            let raw;
+            try {
+                raw = fs.readFileSync(filePath, 'utf-8');
+            }
+            catch (err) {
+                return { patched: false, reason: `unreadable ${filePath}: ${errMsg(err)}` };
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch (err) {
+                // Refuse to rewrite what we can't parse — the file may still hold the
+                // account's oauthAccount/credentials in a recoverable form.
+                return {
+                    patched: false,
+                    reason: `unparseable ${filePath} — refusing to rewrite: ${errMsg(err)}`,
+                };
+            }
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                return {
+                    patched: false,
+                    reason: `${filePath} is not a JSON object — refusing to rewrite`,
+                };
+            }
+            existing = parsed;
+        }
+        const missing = INTERACTIVE_ONBOARDING_FLAGS.filter((f) => existing[f] !== true);
+        if (missing.length === 0) {
+            return { patched: false, reason: 'already interactive-ready' };
+        }
+        for (const f of missing)
+            existing[f] = true;
+        // Atomic tmp+rename write (the repo's durable-registry idiom) so a crash
+        // mid-write can never leave a half-written `.claude.json` — that file
+        // also carries the account's oauthAccount, which we must never corrupt.
+        fs.mkdirSync(home, { recursive: true });
+        const tmpPath = `${filePath}.${process.pid}.interactive-ready.tmp`;
+        fs.writeFileSync(tmpPath, JSON.stringify(existing, null, 2) + '\n');
+        fs.renameSync(tmpPath, filePath);
+        return { patched: true, reason: `seeded ${missing.join(', ')}` };
+    }
+    catch (err) {
+        // @silent-fallback-ok: fail-safe by contract — a launch path must never
+        // crash on readiness seeding; the caller logs the reason.
+        return { patched: false, reason: `ensureInteractiveReady failed: ${errMsg(err)}` };
+    }
+}
+//# sourceMappingURL=ensureInteractiveReady.js.map

package/dist/core/ensureInteractiveReady.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureInteractiveReady.js","sourceRoot":"","sources":["../../src/core/ensureInteractiveReady.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,wBAAwB;IACxB,+BAA+B;IAC/B,wBAAwB;CAChB,CAAC;AAoBX,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,IAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAEpE,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC,CAAC,OAAO,CAAC;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEjD,IAAI,IAAI,EAAE,mBAAmB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,IAAI,iBAAiB,EAAE,CAAC;QAC1E,CAAC;QAED,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,4DAA4D;gBAC5D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,eAAe,QAAQ,2BAA2B,MAAM,CAAC,GAAG,CAAC,EAAE;iBACxE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,GAAG,QAAQ,6CAA6C;iBACjE,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,MAAiC,CAAC;QAC/C,CAAC;QAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAE5C,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,wBAAwB,CAAC;QACnE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACpE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,0DAA0D;QAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.465",
+  "version": "1.3.467",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-10T05:59:49.891Z",
-  "instarVersion": "1.3.465",
+  "generatedAt": "2026-06-10T07:26:55.306Z",
+  "instarVersion": "1.3.467",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1514,7 +1514,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "1b58893e54317eed379d38d736a6c001ba407607c115d84a79795a5439a479f5",
+      "contentHash": "9e1bc7df09921b4ecdd6252c8616ac33b195380a678de7a4c1a616312ca3cae1",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "2c7a661c1d1133c9267caab9e6fb082211549373fac0fbe0d2ca8003783648dd",
+      "contentHash": "9f5d958c0cc5a68d7c4d078e10441756637da7dca7139ed48c276079654a5a3e",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.466.md

@@ -0,0 +1,97 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Extends the `deferral-detector` hook (the signal-only PreToolUse guard that scans outbound messages) with a fifth category: **merge-deferral**. It now flags an agent handing the merge of a PR *it authored* back to the operator — both the explicit form ("the merge call is yours", "your call to merge", "leave the merge to you", "merge is your call to make") and the permission-seeking form ("want me to merge?", "should I merge?", "ready to merge?"). Two design points: (1) these patterns are **deliberately NOT exempted by the infrastructure-backed anti-trigger** — having tracked the PR as a commitment does not legitimize handing its merge back; it just launders the deferral; (2) the injected checklist tells the agent to **merge a self-authored green PR itself** (`scripts/safe-merge.mjs … --squash --admin` in the instar repo, or `gh pr merge`), states the operator directed this must never be a blocker, and names the only legitimate non-merges (CI genuinely red on this change, or someone else's PR). Source-of-truth is `getDeferralDetectorHook()` in PostUpdateMigrator.ts (the existing always-overwrite migration redeploys it to every agent on update). Still SIGNAL ONLY — never blocks. Complements instar-dev Phase 7 (Auto-merge on green) at a different layer: Phase 7 governs the build flow; this catches a handed-back merge in *any* outbound message.
+
+## What to Tell Your User
+
+If I ever finish a PR I authored, watch it go green, and then ask you "want me to merge?" or call it "your decision" — there's now a structural guard that catches that framing before the message sends and reminds me that merging my own green PR is mine to do, never a blocker I hand to you. This came directly from your correction that the merge call should never be yours for PRs I authored, and that the fix had to be permanent and in code, not another promise.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Deferral-detector flags handing a self-authored PR's merge back to the operator | automatic (signal-only hook); fires on outbound messages, not exempted by "tracked" work |
+
+## Evidence
+
+Reproduction (live, 2026-06-09, topic 2169): the agent built PR #1040 (the session auto-heal ladder), watched CI, and presented it as "CI is running now … it's core monitoring code, so the merge call is yours." The operator corrected: "the merge call should never be mine, at least not for PRs you authored. Please change this permanently moving forward so it is never a blocker." The existing deferral-detector did not catch it — it had no merge-deferral patterns.
+
+After the fix: `tests/unit/deferral-detector-orphan-todo.test.ts` gains a `merge-deferral` describe block (11 cases) including the exact incident phrasing, the permission-seeking variants ("want me to merge?", "should I merge?", "ready to merge"), the key "tracked PR still fires" laundering case, and the must-NOT-fire cases ("I merged it myself", "I'll merge on green", "merging now"). The deployed hook was verified end-to-end to emit `MERGE-DEFERRAL DETECTED` while staying signal-only. 35/35 deferral-detector tests pass; tsc clean; generated-hook node syntax check passed.
+
+## The problem
+
+I built a PR (#1040 — the thing that auto-heals a stalled session), watched the
+CI go all-green, and then told the operator: "it's core monitoring code, so the
+merge call is yours." He pushed back, hard and clearly: **"the merge call should
+never be mine, at least not for PRs you authored. Please change this permanently
+moving forward so it is never a blocker."**
+
+He's right. A PR I wrote, that passed every gate and went green, is *mine* to
+merge. Handing that decision back to him does nothing but stall the work and make
+him a bottleneck on my own output. It's a polite-looking version of not finishing
+the job.
+
+And the deeper point, which he's made before about other habits: he keeps catching
+me doing this and I keep answering with "understood, I'll do better." A promise is
+willpower. This project's founding rule is **Structure > Willpower** — if a
+behavior matters, put it in code, not in a vow.
+
+## What already exists
+
+I already have a `deferral-detector` hook. It scans messages I'm about to send and,
+if it sees me punting work ("queue for next session", "it's late, I'll wrap up",
+"needs a human"), it injects a checklist that re-grounds me before the message goes
+out. It already has four categories: can't-do-it claims, orphan TODOs, false
+"needs a human" blockers, and (added earlier today) time/fatigue deferral.
+
+There's also a rule in my instar-dev build skill — Phase 7, "Auto-merge on green" —
+that says when my PR is green I merge it and don't ask. But that rule only governs
+the formal build flow. It didn't stop me from *typing* "the merge call is yours"
+in a normal chat message. That gap is exactly what bit here.
+
+## What's new
+
+I added a fifth thing the detector looks for: **merge-deferral** — handing the
+merge of a PR I authored back to the operator. It catches two shapes:
+
+- **Explicitly giving him the call:** "the merge call is yours", "your call to
+  merge", "leave the merge to you", "merge is your decision".
+- **Asking permission to merge my own PR:** "want me to merge?", "should I merge
+  it?", "ready to merge?".
+
+When it sees that, it injects a sharp reminder before the message sends:
+
+- If it's my PR and CI is green, **merge it myself now** — green CI means
+  mergeable. (It even names the command: `safe-merge.mjs … --squash --admin`, or
+  `gh pr merge`.)
+- Asking to merge my own green PR is redundant ceremony that stalls delivery, and
+  the operator directed it must **never** be a blocker handed to him.
+- Having *tracked* the PR does **not** make handing its merge back okay — so this
+  check is **not** silenced by the "I tracked it" escape hatch, same as the
+  time/fatigue check.
+- The only real reasons not to merge: CI is genuinely **red on this change** (fix
+  it and re-run), or it's **someone else's** PR (then asking is fine).
+
+## The safeguards in plain terms
+
+- **Signal, not a block.** Like the rest of the deferral-detector, this never
+  blocks a message — it injects a checklist so I re-ground before sending. A
+  brittle keyword check shouldn't have the power to hard-block; that stays with
+  the smart gates. So a false positive (like me asking about *your* PR) just adds
+  a reminder I can disregard, never eats a message.
+- **Ships to every agent.** The hook's source lives in one place and re-deploys to
+  every agent on update, so this isn't a me-only patch.
+- **Additive.** It only adds a new detection; it can't reduce the existing four.
+
+## What you need to decide
+
+Nothing — it's a signal-only hook extension that ships as a normal patch. The
+point is simply that the next time I finish my own PR, watch it go green, and
+reach for "want me to merge?", the structure catches it and reminds me to just
+merge it — instead of relying on me to remember the lesson and making you the
+bottleneck on my own work.

package/upgrades/1.3.467.md

@@ -0,0 +1,80 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixes the 2026-06-09 incident where subscription-pool **pinning** and **account
+swap** relaunched interactive sessions into pool-account config homes that were
+enrolled via headless `claude auth login` — homes with valid OAuth tokens but
+WITHOUT the interactive first-launch onboarding flags. Every relaunched session
+wedged on Claude Code's onboarding screens (OAuth-authorize browser-tab spam +
+the Bypass-Permissions accept screen); ~8 live sessions froze at once until the
+operator logged in manually.
+
+New util `ensureInteractiveReady(configHome)` idempotently seeds the three
+local trust-acknowledgement flags (`hasCompletedOnboarding`,
+`bypassPermissionsModeAccepted`, `hasTrustDialogAccepted`) in
+`<configHome>/.claude.json`, preserving every other key and **never touching
+`oauthAccount`/tokens** (an unparseable file is refused, not rewritten; writes
+are atomic). It is fail-safe by contract — a launch can never crash on it.
+
+Called everywhere a session can enter a pool home, so the wedge is impossible
+by construction:
+
+1. **Enrollment** — `EnrollmentWizard.complete()` seeds a freshly-enrolled
+   claude-code home immediately.
+2. **Pinned launches** — both SessionManager pin lanes (headless +
+   interactive-reroute) and the interactive account-swap lane seed before
+   setting `CLAUDE_CONFIG_DIR`.
+3. **Swaps** — `SessionRefresh` seeds the target home BEFORE the kill+respawn.
+4. **Existing homes** — a `PostUpdateMigrator` sweep seeds every claude-code
+   pool account's existing home once on update (stale entries skipped, never
+   created).
+
+## What to Tell Your User
+
+If I run on a pool of Claude accounts, moving my sessions between accounts
+(when one hits its weekly limit) used to be able to freeze them on Claude's
+"first launch" welcome screens — the account was logged in, but nobody had
+ever clicked through the one-time setup dialogs for that account's config
+folder. That's fixed at every layer now: new accounts are made
+interactive-ready the moment they're enrolled, every launch double-checks, and
+existing accounts get fixed automatically on this update. Account swaps should
+now be invisible — same conversation, different account, no frozen sessions
+and no browser-tab spam.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Pool config homes are onboarding-safe by construction (enrollment + every pinned/swapped launch) | automatic — no config |
+| Existing pool homes seeded once on update | automatic — PostUpdateMigrator sweep |
+| `ensureInteractiveReady(configHome)` util for any future launch lane | `src/core/ensureInteractiveReady.ts` |
+
+## Evidence
+
+Live state at the incident (this machine): `sagemind-justin` and `sagemind-dawn`
+homes were fully headless (no flags), `justin-gmail` had onboarded=true but
+bypass=false — exactly the homes whose sessions wedged; the two complete homes'
+sessions were unaffected. The OAuth tokens were present in every case.
+
+After the change:
+- `tests/unit/ensure-interactive-ready.test.ts` — 14 cases: missing-file
+  create, partial merge, flag-false reseed, idempotency (mtime-stable second
+  call), oauthAccount/token preservation, tilde expansion, unparseable/
+  non-object refusal with bytes preserved, unreadable fail-safe,
+  requireExistingHome both sides.
+- `tests/unit/PostUpdateMigrator-subscriptionPoolInteractiveReady.test.ts` — 8
+  cases incl. one-bad-home-never-aborts-the-sweep and full-migrate() wiring.
+- `tests/unit/SessionRefresh.test.ts` — flags land BEFORE the respawner fires
+  (ordering pinned), fresh swaps too, no-swap untouched, fail-safe.
+- `tests/integration/subscription-pin-sessions.test.ts` — both launch lanes
+  land the flags on disk through the real SessionManager.
+- `tests/integration/subscription-enrollment-interactive-ready.test.ts` +
+  `tests/e2e/subscription-enrollment-lifecycle.test.ts` — full HTTP
+  enroll→complete leaves the home interactive-ready, credentials
+  byte-identical.
+- `npm run lint` (tsc + all custom lints) clean; subscription/quota regression
+  suites green.

package/upgrades/side-effects/deferral-detector-merge-deferral.md

@@ -0,0 +1,72 @@
+# Side-Effects Review — deferral-detector merge-deferral category
+
+**Version / slug:** `deferral-detector-merge-deferral`
+**Date:** `2026-06-09`
+**Author:** `Instar Agent (echo)`
+**Second-pass reviewer:** `independent reviewer subagent — see below`
+
+## Summary of the change
+
+Adds a fifth detection category — **merge-deferral** — to the `deferral-detector` hook (source-of-truth: `getDeferralDetectorHook()` in `src/core/PostUpdateMigrator.ts`; deployed copy mirrors it via the existing always-overwrite hook migration). New `mergeDeferralPatterns` array (7 patterns) catches two shapes of handing the merge of a **self-authored** PR back to the operator: (a) explicitly assigning the call — "the merge call is yours", "your merge call", "your call to merge", "leave the merge to you", "up to you to merge", "merge is your call to make"; and (b) asking permission to merge one's own PR — "want me to merge?", "should I merge?", "ready to merge?". Like the time/fatigue category, `mergeDeferralMatches` is NOT gated by the `isInfrastructureBacked` anti-trigger — having tracked the PR does not legitimize handing its merge back. A new checklist section instructs the agent to merge a self-authored green PR itself (`scripts/safe-merge.mjs … --squash --admin` / `gh pr merge`), states the operator directed this must never be a blocker (2026-06-09), and carves out the only legitimate non-merges (CI genuinely red on this change; someone else's PR). Still signal-only (`decision: 'approve'`, additionalContext only — never blocks). Files: `src/core/PostUpdateMigrator.ts` (hook template), `tests/unit/deferral-detector-orphan-todo.test.ts` (+11 cases).
+
+## Decision-point inventory
+
+- `deferral-detector` hook outbound-message scan — **modify (additive)** — adds a new signal category. Does NOT change the existing inability/orphan/time-fatigue categories or the never-block contract.
+
+## 1. Over-block
+
+No block surface — the hook is signal-only (injects additionalContext, never blocks/denies). "Over-block" → over-FLAG. Two over-flag classes, both bounded:
+
+- **Permission-seeking on someone else's PR.** "want me to merge your PR?" about a PR the *user* authored is a legitimate question, but it still matches `merge_permission_seeking`. The hook can't see PR authorship from message text, so it flags and lets the agent decide — the checklist explicitly states "it is SOMEONE ELSE's PR (then asking is fine)", so the injected context tells the agent to disregard when that applies. Cost is one extra context block, never a withheld message.
+- **Discussing this very feature.** A message *about* merge-deferral (like this one) contains the trigger words and will self-flag — annoying but harmless (signal-only), identical in kind to the orphan/time-fatigue categories self-flagging when discussed.
+
+Patterns are scoped to the comm-command gate (only telegram-reply/send-message/etc. are scanned), bounding noise to outbound human messages.
+
+## 2. Under-block
+
+Pattern set is finite regex; it will miss novel phrasings ("I'll let you make the merge decision on this", "the green light to merge is yours"). Acceptable for a signal layer — patterns cover the observed incident shape ("the merge call is yours") plus the common permission-seeking variants the operator's directive named. Residual (stated, not deferred): the detector does not attempt to verify PR authorship or CI state — it is a framing detector, not a merge executor. The actual auto-merge-on-green behavior lives in instar-dev Phase 7 (the skill flow); this hook is the cross-cutting catch for when an outbound message hands the merge back regardless of flow.
+
+## 3. Level-of-abstraction fit
+
+Correct layer. This is a brittle keyword detector → it belongs as a SIGNAL (the deferral-detector is exactly that), not as blocking authority. It composes with the existing four categories in the same hook at the same altitude, reusing the comm-command gate, the JSON output contract, and the test harness. A complementary structural surface already exists at a different layer: instar-dev Phase 7 ("Auto-merge on green — never pause to ask") governs the build flow. This hook covers the gap Phase 7 doesn't: a self-authored-PR merge handed back in *any* outbound message, not only inside an instar-dev build. The two are layered (flow-level prescription + message-level detector), not parallel duplicates.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface; it produces a signal (additionalContext) consumed by the agent, exactly per the hook's "SIGNAL ONLY" contract.
+
+A brittle regex detector must NOT hold blocking authority; this addition stays signal-only. If hard enforcement is ever wanted, the right path is the instar-dev pre-commit/merge gates (which already exist) or feeding the smart gate (MessagingToneGate), never making this regex block. Compliant.
+
+## 5. Interactions
+
+- **Shadowing:** the new category is independent of inability/orphan/time-fatigue; `allMatches` concatenates all categories. The orphan category's infrastructure-backed suppression is unchanged; the new category intentionally bypasses it (documented, mirrors time/fatigue). No existing category is shadowed.
+- **Double-fire:** a message can now trigger multiple sections (e.g. permission-seeking inability + merge-deferral) — intended; each section is additive context. No double-send.
+- **Races:** none — pure stdin→stdout, no shared state.
+- **Migration parity:** `deferral-detector.js` is already in the always-overwrite migration set (`result.upgraded.push('hooks/instar/deferral-detector.js …')`), so the new content redeploys to every agent on update with no new migration entry needed.
+
+## 6. External surfaces
+
+- **Agents/users:** ships to the whole install base via the always-overwrite hook migration. Effect: more frequent (signal-only) checklists when an agent hands a self-authored merge back or asks permission to merge. No user-visible message change, no API change.
+- **Persistent state:** none.
+- **Timing/runtime:** depends only on the outbound message text (already available to the hook). No new external calls.
+
+## 7. Rollback cost
+
+Pure additive change to a signal hook template + tests. Back-out = revert the commit; on next update the prior hook content redeploys. No persistent state, no migration to unwind. An individual agent can also neutralize it locally by editing its deployed `.instar/hooks/instar/deferral-detector.js` (until next update). Low.
+
+## Conclusion
+
+An additive, signal-only change that closes a real, freshly-corrected behavior gap (handing a self-authored green PR's merge back to the operator — incident 2026-06-09, PR #1040 presented as "the merge call is yours") with code rather than willpower — directly per the Structure > Willpower standard, and reinforcing the operator directive that a self-authored merge must never be a blocker. No block surface added; signal-vs-authority compliant; layered with (not duplicating) instar-dev Phase 7. Because it modifies a behavioral guard hook, a Phase-5 second-pass review is requested before commit.
+
+## Second-pass review (if required)
+
+**Reviewer:** independent reviewer subagent (general-purpose)
+**Independent read of the artifact: concur**
+
+Concur — no must-fix bugs found. The reviewer independently rendered the deployed hook (`getHookContent('deferral-detector')` → `node -c` valid JS) and confirmed: (1) **escaping correct** — every `\\b` → `\b` in the deployed regex, both `\\'` → valid `\'` in the single-quoted checklist strings, no stray backtick / broken escape / silently-never-matching regex (all 7 patterns matched real inputs); (2) **the laundering invariant holds** — `mergeDeferralMatches` is computed by a plain `.filter()` OUTSIDE the `isInfrastructureBacked ? [] : …` gate, verified empirically that "tracked commitment + follow-up PR … but the merge call is yours" STILL fires; (3) **signal-only intact** — exactly one output path (`decision:'approve'`, additionalContext only), six `process.exit(0)`, no block/deny/ask path; (4) **no regression** — the only source deletion is the single `allMatches` line re-spread to append `...mergeDeferralMatches`; inability/orphan/time-fatigue arrays + gates + sections byte-for-byte unchanged; (5) **false-positive profile acceptable** — all must-NOT-fire cases ("I merged it myself", "I'll merge on green", "merging now", "Both fixes verified live") plus 10 more benign merge-mentioning messages produced zero firings; full file 35/35. Bounded over-fire noted (permission-seeking pattern (b) can fire on non-PR "safe to merge these branches?" uses) — over-FLAG not over-block, anticipated in §1, judged not-must-fix for a signal layer (anchoring it to own-PR context would risk under-firing the real incident shape). Under-fire on novel framings noted as expected residual.
+
+## Evidence pointers
+
+- Live incident: 2026-06-09, topic 2169 — the agent built PR #1040 (auto-heal ladder) and presented it as "CI is running now … the merge call is yours," prompting the operator's correction: "the merge call should never be mine, at least not for PRs you authored. Please change this permanently moving forward so it is never a blocker."
+- Tests: `tests/unit/deferral-detector-orphan-todo.test.ts` merge-deferral block (11 cases) incl. the exact incident phrasing, the permission-seeking variants, the "tracked PR still fires" laundering case, and the must-NOT-fire cases ("I merged it myself", "I'll merge on green", "merging now"). Generated-hook node syntax check passed; `tsc --noEmit` exit 0; 35/35 deferral-detector tests green.