instar 1.3.89 → 1.3.90

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/commands/init.js +1 -1
  2. package/dist/commands/init.js.map +1 -1
  3. package/dist/core/PostUpdateMigrator.d.ts.map +1 -1
  4. package/dist/core/PostUpdateMigrator.js +8 -1
  5. package/dist/core/PostUpdateMigrator.js.map +1 -1
  6. package/package.json +1 -1
  7. package/src/data/builtin-manifest.json +18 -18
  8. package/upgrades/1.3.90.md +35 -0
  9. package/upgrades/side-effects/capabilities-auth-self-discovery.md +31 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "instar",
3
- "version": "1.3.89",
3
+ "version": "1.3.90",
4
4
  "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
package/src/data/builtin-manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "$schema": "./builtin-manifest.schema.json",
3
3
  "schemaVersion": 1,
4
- "generatedAt": "2026-05-29T13:36:49.002Z",
5
- "instarVersion": "1.3.89",
4
+ "generatedAt": "2026-05-29T14:01:29.929Z",
5
+ "instarVersion": "1.3.90",
6
6
  "entryCount": 193,
7
7
  "entries": {
8
8
  "hook:session-start": {
@@ -11,7 +11,7 @@
11
11
  "domain": "identity",
12
12
  "sourcePath": "src/core/PostUpdateMigrator.ts",
13
13
  "installedPath": ".instar/hooks/instar/session-start.sh",
14
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
14
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
15
15
  "since": "2025-01-01"
16
16
  },
17
17
  "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
20
20
  "domain": "safety",
21
21
  "sourcePath": "src/core/PostUpdateMigrator.ts",
22
22
  "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
23
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
23
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
24
24
  "since": "2025-01-01"
25
25
  },
26
26
  "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
29
29
  "domain": "safety",
30
30
  "sourcePath": "src/core/PostUpdateMigrator.ts",
31
31
  "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
32
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
32
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
33
33
  "since": "2025-01-01"
34
34
  },
35
35
  "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
38
38
  "domain": "identity",
39
39
  "sourcePath": "src/core/PostUpdateMigrator.ts",
40
40
  "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
41
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
41
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
42
42
  "since": "2025-01-01"
43
43
  },
44
44
  "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
47
47
  "domain": "safety",
48
48
  "sourcePath": "src/core/PostUpdateMigrator.ts",
49
49
  "installedPath": ".instar/hooks/instar/external-operation-gate.js",
50
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
50
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
51
51
  "since": "2025-01-01"
52
52
  },
53
53
  "hook:deferral-detector": {
@@ -56,7 +56,7 @@
56
56
  "domain": "safety",
57
57
  "sourcePath": "src/core/PostUpdateMigrator.ts",
58
58
  "installedPath": ".instar/hooks/instar/deferral-detector.js",
59
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
59
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
60
60
  "since": "2025-01-01"
61
61
  },
62
62
  "hook:post-action-reflection": {
@@ -65,7 +65,7 @@
65
65
  "domain": "evolution",
66
66
  "sourcePath": "src/core/PostUpdateMigrator.ts",
67
67
  "installedPath": ".instar/hooks/instar/post-action-reflection.js",
68
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
68
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
69
69
  "since": "2025-01-01"
70
70
  },
71
71
  "hook:external-communication-guard": {
@@ -74,7 +74,7 @@
74
74
  "domain": "safety",
75
75
  "sourcePath": "src/core/PostUpdateMigrator.ts",
76
76
  "installedPath": ".instar/hooks/instar/external-communication-guard.js",
77
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
77
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
78
78
  "since": "2025-01-01"
79
79
  },
80
80
  "hook:scope-coherence-collector": {
@@ -83,7 +83,7 @@
83
83
  "domain": "coherence",
84
84
  "sourcePath": "src/core/PostUpdateMigrator.ts",
85
85
  "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
86
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
86
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
87
87
  "since": "2025-01-01"
88
88
  },
89
89
  "hook:scope-coherence-checkpoint": {
@@ -92,7 +92,7 @@
92
92
  "domain": "coherence",
93
93
  "sourcePath": "src/core/PostUpdateMigrator.ts",
94
94
  "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
95
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
95
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
96
96
  "since": "2025-01-01"
97
97
  },
98
98
  "hook:free-text-guard": {
@@ -101,7 +101,7 @@
101
101
  "domain": "safety",
102
102
  "sourcePath": "src/core/PostUpdateMigrator.ts",
103
103
  "installedPath": ".instar/hooks/instar/free-text-guard.sh",
104
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
104
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
105
105
  "since": "2025-01-01"
106
106
  },
107
107
  "hook:claim-intercept": {
@@ -110,7 +110,7 @@
110
110
  "domain": "coherence",
111
111
  "sourcePath": "src/core/PostUpdateMigrator.ts",
112
112
  "installedPath": ".instar/hooks/instar/claim-intercept.js",
113
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
113
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
114
114
  "since": "2025-01-01"
115
115
  },
116
116
  "hook:claim-intercept-response": {
@@ -119,7 +119,7 @@
119
119
  "domain": "coherence",
120
120
  "sourcePath": "src/core/PostUpdateMigrator.ts",
121
121
  "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
122
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
122
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
123
123
  "since": "2025-01-01"
124
124
  },
125
125
  "hook:stop-gate-router": {
@@ -128,7 +128,7 @@
128
128
  "domain": "safety",
129
129
  "sourcePath": "src/core/PostUpdateMigrator.ts",
130
130
  "installedPath": ".instar/hooks/instar/stop-gate-router.js",
131
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
131
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
132
132
  "since": "2025-01-01"
133
133
  },
134
134
  "hook:auto-approve-permissions": {
@@ -137,7 +137,7 @@
137
137
  "domain": "safety",
138
138
  "sourcePath": "src/core/PostUpdateMigrator.ts",
139
139
  "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
140
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
140
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
141
141
  "since": "2025-01-01"
142
142
  },
143
143
  "job:health-check": {
@@ -1489,7 +1489,7 @@
1489
1489
  "type": "subsystem",
1490
1490
  "domain": "updates",
1491
1491
  "sourcePath": "src/core/PostUpdateMigrator.ts",
1492
- "contentHash": "1fd1742471085a3b4ea20557d99aee966ea8bc4d92582b51cf18791ce76429d3",
1492
+ "contentHash": "02e081441560e8b3a82c3cd7ed647ff0cb8f7042b166a4ab1241a86d8c113883",
1493
1493
  "since": "2025-01-01"
1494
1494
  },
1495
1495
  "subsystem:scheduler": {
package/upgrades/1.3.90.md ADDED
@@ -0,0 +1,35 @@
1
+ # Upgrade Guide — vNEXT
2
+
3
+ <!-- bump: patch -->
4
+
5
+ ## What Changed
6
+
7
+ The self-discovery guidance for capability checks now matches the authenticated
8
+ server contract. Existing instructions told agents to call the capabilities
9
+ endpoint without an authorization header, but the endpoint requires the agent's
10
+ Bearer token. Agents following the documented "know before you claim" step could
11
+ therefore get a 401 instead of the capability matrix.
12
+
13
+ Fresh initialization now renders the authenticated capabilities command, and the
14
+ post-update migrator both adds the authenticated form for stale files missing the
15
+ section and rewrites legacy unauthenticated capability-check commands in
16
+ existing CLAUDE.md files.
17
+
18
+ ## What to Tell Your User
19
+
20
+ - **Self-discovery now uses the working authenticated request**: "When I check
21
+ what I can actually do, my local instructions now use the same authenticated
22
+ capabilities call the server expects, so the documented verification step no
23
+ longer fails before it can answer."
24
+
25
+ ## Summary of New Capabilities
26
+
27
+ | Capability | How to Use |
28
+ |-----------|------------|
29
+ | Authenticated self-discovery guidance | Existing agents receive the corrected capability-check instruction on update; new agents get it during initialization |
30
+
31
+ ## Evidence
32
+
33
+ Unit coverage verifies the post-update migrator rewrites legacy unauthenticated
34
+ capabilities checks and adds the self-discovery section with the authenticated
35
+ form when it is missing.
package/upgrades/side-effects/capabilities-auth-self-discovery.md ADDED
@@ -0,0 +1,31 @@
1
+ # Side Effects Review — capabilities auth self-discovery
2
+
3
+ ## Change
4
+
5
+ Align agent-facing self-discovery instructions with the runtime server contract:
6
+ capability checks require the configured Bearer token.
7
+
8
+ ## Surfaces Touched
9
+
10
+ - Fresh init CLAUDE.md generation.
11
+ - Post-update CLAUDE.md migration for existing agents.
12
+ - Built-in manifest regeneration for changed source templates.
13
+
14
+ ## Expected Effects
15
+
16
+ - Agents following "know before you claim" get the capability matrix instead of
17
+ an authentication error.
18
+ - Existing stale CLAUDE.md files are corrected during update without requiring a
19
+ full re-init.
20
+
21
+ ## Risk Review
22
+
23
+ - The change does not relax API auth or expose capability data publicly.
24
+ - The migrator rewrite targets only unauthenticated localhost capabilities curl
25
+ commands and replaces them with the authenticated form for the configured
26
+ server port.
27
+ - Existing already-authenticated commands are left unchanged.
28
+
29
+ ## Validation
30
+
31
+ - Focused unit coverage covers both rewrite and missing-section insertion.