# Upgrade Guide — v0.10.4

<!-- bump: patch -->

## What Changed

Added a `PreToolUse` hook that structurally blocks `AskUserQuestion` when the question asks for free-text input (passwords, emails, tokens, API keys, 2FA codes). The hook uses Python-based pattern detection to distinguish between:

- **Free-text prompts** (blocked): "What's your password?", "Enter your API key", "Provide your email"
- **Multi-choice decisions** (allowed): "Which backend would you prefer?", "Should I install Telegram?"

When blocked, Claude receives a clear message telling it to use plain text output instead and wait for the user's next message. This enforces the "no AskUserQuestion for passwords" rule that prompt instructions alone could not reliably enforce.

The hook is installed in two places:
1. `.claude/settings.json` + `.claude/hooks/free-text-guard.sh` in the Instar package root (active during setup wizard)
2. `settings-template.json` + `PostUpdateMigrator` (installed in all agent projects on init/update)

## What to Tell Your User

- **Cleaner setup experience**: "Password and credential prompts during setup are smoother now — no more confusing multi-choice menus when you just need to type something."

## Summary of New Capabilities

| Capability | How to Use |
|-----------|-----------|
| Free-text input guard hook | Automatic — blocks AskUserQuestion misuse for credentials |
