CoreUpgrade: re-pin the Interceptor extension after a deploy that clears its skill

The payload ships skills/Interceptor but not its built Extension/ -- a local pin
produced by the skill's own Tools/Pin.sh. A wholesale clear of that skill removes
the extension with no payload replacement, and the loss is quiet: Chrome keeps an
already-loaded unpacked extension running from memory after its directory is
gone, so browser verification keeps working until the next Chrome restart.

Adds planRepin (pure decision) + runRepin (isolated execFile), announced in the
dry-run plan and run after the rollback-guarded block so a failed re-pin can
never roll back a good upgrade. It acts only when that skill was actually
cleared, Pin.sh survived the deploy, and the operator's local build exists;
otherwise it names the missing precondition and the manual command.

Documents the one deliberate exception this creates to the payload-distrust
stance in the header: the step executes a payload-shipped script.

5 new tests (32 total, all green).

Author: asdf8675309

LifeOS/install/skills/CoreUpgrade/Tools/LifeosUpgrade.test.ts

@@ -5,7 +5,7 @@ import { tmpdir } from "node:os";
 import {
   isPreserved, computeClearList, planUpgrade, copyMissing, preflight, payloadHas,
   parseArgs, safeRemove, scopedBackup, rollback, snapshotDeployTargets, extractCustomizations,
-  planClaudeSplit, applyClaudeSplit, undoClaudeSplit,
+  planClaudeSplit, applyClaudeSplit, undoClaudeSplit, planRepin,
 } from "./LifeosUpgrade";
 
 // TR6: every tmp root is tracked and removed after the suite — no orphaned temp trees.
@@ -372,3 +372,55 @@ test("split + rollback compose: deploy failure restores CLAUDE.md, removes GLOBA
   expect(existsSync(join(root, "LIFEOS/TOOLS/new.ts"))).toBe(false);                      // deploy remnant gone
   rmSync(bak, { recursive: true, force: true });
 });
+
+// ── planRepin: the Interceptor extension is a payload-shipped skill's UNSHIPPED artifact ──
+// Regression guard: a wholesale clear of skills/Interceptor removes its pinned
+// Extension/ build, which the payload does not ship and cannot restore.
+
+function repinTree(opts: { pin?: boolean; src?: boolean }) {
+  const root = tmp("lu-rp-"), srcRoot = tmp("lu-rps-");
+  if (opts.pin) {
+    mkdirSync(join(root, "skills/Interceptor/Tools"), { recursive: true });
+    writeFileSync(join(root, "skills/Interceptor/Tools/Pin.sh"), "#!/usr/bin/env bash\ntrue\n");
+  }
+  if (opts.src) mkdirSync(join(srcRoot, "extension/dist"), { recursive: true });
+  return { root, srcRoot };
+}
+
+test("planRepin: acts only when Interceptor was cleared AND both Pin.sh and the build exist", () => {
+  const { root, srcRoot } = repinTree({ pin: true, src: true });
+  const p = planRepin(root, ["LIFEOS/TOOLS", "skills/Interceptor"], srcRoot);
+  expect(p.act).toBe(true);
+  expect(p.script).toBe(join(root, "skills/Interceptor/Tools/Pin.sh"));
+  expect(p.src).toBe(join(srcRoot, "extension/dist"));
+});
+
+test("planRepin: no-ops when Interceptor is not in the clear list (nothing was deleted)", () => {
+  const { root, srcRoot } = repinTree({ pin: true, src: true });
+  const p = planRepin(root, ["LIFEOS/TOOLS"], srcRoot);
+  expect(p.act).toBe(false);
+  expect(p.reason).toContain("not being replaced");
+});
+
+test("planRepin: declines with actionable reason when the local build dir is absent", () => {
+  const { root, srcRoot } = repinTree({ pin: true, src: false });
+  const p = planRepin(root, ["skills/Interceptor"], srcRoot);
+  expect(p.act).toBe(false);
+  expect(p.reason).toContain("INTERCEPTOR_SRC");
+});
+
+test("planRepin: declines when the payload stopped shipping Pin.sh", () => {
+  const { root, srcRoot } = repinTree({ pin: false, src: true });
+  const p = planRepin(root, ["skills/Interceptor"], srcRoot);
+  expect(p.act).toBe(false);
+  expect(p.reason).toContain("Pin.sh absent");
+});
+
+test("planRepin: is pure — it never creates or mutates anything on disk", () => {
+  const { root, srcRoot } = repinTree({ pin: true, src: true });
+  const before = readdirSync(root).sort();
+  planRepin(root, ["skills/Interceptor"], srcRoot);
+  planRepin(root, [], srcRoot);
+  expect(readdirSync(root).sort()).toEqual(before);
+  expect(existsSync(join(root, "skills/Interceptor/Extension"))).toBe(false);
+});

LifeOS/install/skills/CoreUpgrade/Tools/LifeosUpgrade.ts

@@ -20,6 +20,15 @@
  *    delete path), then reports the ACTUAL rollback outcome (partial failures named).
  *  - all deletes go through safeRemove (isPreserved + path-escape, case-insensitive).
  *
+ * ONE DELIBERATE EXCEPTION to the payload-distrust stance above: the post-deploy
+ * re-pin step EXECUTES a payload-shipped script (skills/Interceptor/Tools/Pin.sh,
+ * which after deploy is the payload's copy). This is not a new trust boundary in
+ * practice — an upgraded install is about to run the payload's hooks, tools, and
+ * skills anyway — but it IS script execution, so it is opt-out by construction:
+ * it runs only when that skill was actually replaced AND the operator's local
+ * interceptor build exists, is announced in the dry-run plan before --apply, and
+ * sits outside the rollback-guarded block so it can never trigger a rollback.
+ *
  * Known limitations (documented, low-risk): safeRemove's path-escape guard is
  * lexical (does not resolve a symlinked config-root ancestor); "backup precedes
  * delete" is enforced by main()'s call order, not an invariant inside safeRemove.
@@ -34,6 +43,7 @@
 import { existsSync, readdirSync, lstatSync, rmSync, mkdirSync, copyFileSync, cpSync, readFileSync, writeFileSync } from "node:fs";
 import { join, sep, resolve, dirname } from "node:path";
 import { homedir } from "node:os";
+import { execFileSync } from "node:child_process";
 
 const ensureParentDir = (p: string) => mkdirSync(dirname(p), { recursive: true });
 const errCode = (e: unknown): string | undefined => (e as { code?: string })?.code;
@@ -151,6 +161,42 @@ export function planUpgrade(configRoot: string, payloadRoot: string): Plan {
   return { configRoot, payloadRoot, clear, deployRoots, warnings };
 }
 
+// ── Post-deploy: re-pin the Interceptor browser extension ────────────────────
+// The payload ships skills/Interceptor but NOT its built Extension/ — a ~15MB
+// local pin of ~/Projects/interceptor/extension/dist produced by the skill's own
+// Tools/Pin.sh. Clearing that skill wholesale therefore deletes the extension
+// with no payload replacement, and the loss is quiet: Chrome keeps an already-
+// loaded unpacked extension running from memory after its directory disappears,
+// so browser verification keeps working until the next Chrome restart and then
+// fails as an unrelated-looking runner error. Pin.sh re-derives the pin from the
+// operator's local build, so recovery is deterministic when that build exists.
+//
+// Decision is pure (planRepin) and the side effect is isolated (runRepin) so the
+// interesting half is testable without shelling out.
+export type RepinPlan = { act: boolean; reason: string; script: string; src: string };
+
+export function planRepin(configRoot: string, clear: string[], interceptorSrc?: string): RepinPlan {
+  const script = join(configRoot, "skills", "Interceptor", "Tools", "Pin.sh");
+  const src = join(interceptorSrc || join(homedir(), "Projects", "interceptor"), "extension", "dist");
+  const p = (act: boolean, reason: string) => ({ act, reason, script, src });
+  if (!clear.includes("skills/Interceptor")) return p(false, "skills/Interceptor not being replaced — extension untouched");
+  if (!existsSync(script)) return p(false, `Pin.sh absent (${script}) — payload no longer ships it; re-pin by hand`);
+  if (!existsSync(src)) return p(false, `interceptor build dir absent (${src}) — set INTERCEPTOR_SRC or rebuild, then run Pin.sh by hand`);
+  return p(true, "extension was cleared with the skill — re-pinning from the local build");
+}
+
+/** Runs Pin.sh via execFile (argument array, never a shell string). Never throws: a
+ *  failed re-pin must not fail an otherwise-successful upgrade — it is reported instead. */
+export function runRepin(plan: RepinPlan): { ok: boolean; output: string } {
+  try {
+    const out = execFileSync("/bin/bash", [plan.script], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return { ok: true, output: String(out).trim() };
+  } catch (e) {
+    const err = e as { stderr?: unknown; message?: string };
+    return { ok: false, output: String(err?.stderr || err?.message || e).trim() };
+  }
+}
+
 // ── Preflight ────────────────────────────────────────────────────────────────
 export function preflight(configRoot: string, payloadRoot: string, backupDir?: string): string[] {
   const errs: string[] = [];
@@ -473,6 +519,9 @@ function main() {
   console.log(`\nPRESERVED (never touched): USER, MEMORY, ARBOL, .env*, CLAUDE.md, settings*.json, private skills/_*, harness dirs, and any entry the payload does NOT ship.`);
   console.log(`\nWARNINGS:`); plan.warnings.forEach((w) => console.log("  ⚠ " + w));
 
+  const repin = planRepin(configRoot, plan.clear, process.env.INTERCEPTOR_SRC);
+  console.log(`\nPOST-DEPLOY re-pin (Interceptor extension): ${repin.act ? "WILL RUN" : "skip"} — ${repin.reason}`);
+
   let splitPlan: SplitPlan | undefined;
   if (splitClaudeMd) {
     splitPlan = planClaudeSplit(configRoot, payloadRoot);
@@ -521,6 +570,16 @@ function main() {
     process.exit(1);
   }
 
+  // Post-deploy re-pin. Deliberately AFTER the rollback-guarded block: a re-pin
+  // failure is not an upgrade failure, so it must not reach that catch.
+  if (repin.act) {
+    console.log(`[post] re-pinning Interceptor extension from ${repin.src}…`);
+    const r = runRepin(repin);
+    console.log(r.ok ? `      ${r.output}` : `      ⚠ re-pin FAILED (upgrade itself is fine): ${r.output}\n      → run ${repin.script} by hand, then Load Unpacked in chrome://extensions/.`);
+  } else if (plan.clear.includes("skills/Interceptor")) {
+    console.log(`[post] ⚠ Interceptor extension NOT re-pinned — ${repin.reason}`);
+  }
+
   console.log(`\nDONE. Backup: ${backupDir}`);
   if (splitClaudeMd && splitPlan?.willSplit)
     console.log(`⚠ NEXT (REQUIRED): the new CLAUDE.md ships with ALL @-imports COMMENTED — your identity/TELOS/GLOBAL context is DORMANT until you run the payload's ActivateImports.ts. Run it FIRST, then reconcile settings + run InstallHooks.ts.`);