@getmarrow/install 0.1.19 → 0.1.21

package/README.md

@@ -11,66 +11,22 @@ npx @getmarrow/install --repair
 npx @getmarrow/install doctor
 ```
 
-## What's New in v0.1.19
+## What's New in v0.1.21
 
-v0.1.19 makes Marrow doctor and release smoke stricter, so agents know exactly why logging is degraded.
+v0.1.21 makes token value proof part of the default install path.
 
-- `npx @getmarrow/install doctor --self-test` now validates: key found, key valid, account active, agent identity accepted, harmless write test created, and outcome closed.
-- Doctor reports exact failure reasons such as `missing_key`, `invalid_key`, `wrong_agent_id`, `network_blocked`, and `proof_required`.
-- Doctor warns when local `@getmarrow/install`, `@getmarrow/sdk`, or `@getmarrow/mcp` versions are behind the current release.
-- New `scripts/fresh-install-smoke.sh` verifies a clean temp install can load `.marrow/env`, run doctor, write a test event, and close the outcome.
-- Full keys are still never printed in diagnostics. Keep `.marrow/env` out of git and set file permissions to owner-only when possible.
+- Generated passive runtimes enable compact model-usage capture by default with `captureModelUsage`.
+- First-run self-test calls `/v1/agent/value/proof` and prints a `Token value proof` block.
+- Fresh accounts show token capture as active and warming up; accounts with observed model calls show calls, tokens, estimated savings, confidence, and next action.
+- Provider usage capture stores compact metadata only: provider, model, token counts, latency, cost estimate, workflow/decision linkage, and Marrow intervention type.
+- Marrow does not store prompts, completions, tool stdout/stderr, plaintext API keys, or raw model output for this feature.
+- Disable only when required with `MARROW_PASSIVE_TOKEN_USAGE=false`.
 
-## What's New in v0.1.17
+Business value: new users should see from day one whether Marrow is capturing the signals needed to prove token/time savings over workflows, tasks, and builds.
 
-v0.1.17 expands the Govern TUI harness addon coverage while preserving adaptive mode recommendations.
+## Governed Runner
 
-- `npx @getmarrow/install govern` now shows first-class rows for Codex, Claude Code, Cursor, Cline, Gemini CLI, Grok CLI, DeepSeek CLI, Minimax CLI, Kimi CLI, Hermes, GLM CLI, Qwen CLI, OpenCode, OpenClaw, MCP-compatible clients, CI scripts, and custom commands.
-- Marrow remains a thin governance layer. It does not replace your model or harness; it wraps the command your agent already runs with pre-action risk gates, proof requirements, and automatic outcome closure.
-- Detection stays recommendation-first. Marrow uses local config, instruction, CI, and MCP markers to suggest the safest path, then the user or owner accepts, overrides, or saves a policy profile.
-- Cursor is treated as a development workflow surface. Marrow can govern Cursor-backed code review, edits, tests, deploys, and release steps through MCP setup, project rules, or the governed command wrapper.
-- If a harness is not detected yet, use **Custom command** or `npx @getmarrow/install run -- <your-agent-command>` to govern it immediately.
-
-Business value: teams can add Marrow to the agent stack they already use instead of migrating to a new agent host. Codex, Claude Code, Cursor, Cline, Gemini, Grok, DeepSeek, Minimax, Kimi/Moonshot, Hermes, GLM, Qwen, OpenClaw, OpenCode, MCP clients, and CI scripts can all be brought under the same governance loop.
-
-## What's New in v0.1.14
-
-v0.1.14 adds adaptive governance mode recommendations without silent auto-switching.
-
-- `npx @getmarrow/install govern` now detects project signals such as `package.json`, deploy/publish scripts, platform config files, GitHub workflows, migrations, Cursor/Codex/Claude files, and MCP config.
-- When `MARROW_API_KEY` is present, the TUI asks Marrow for a recommended mode: `passive`, `pilot`, or `enforce`.
-- The TUI shows the exact reasons, confidence, and selected command before the user applies anything.
-- User choice is explicit. Marrow logs whether the recommendation was accepted or overridden, but it does not silently switch modes.
-- Policy profiles are supported by the backend/SDK/MCP so businesses can define rules like local=passive, staging=pilot, production deploys=enforce.
-
-Example recommendation:
-
-```text
-Recommended mode: pilot
-Reason:
-- Node project detected
-- Edge service detected
-- GitHub workflow detected
-- No owner approval policy configured yet
-```
-
-## What's New in v0.1.13
-
-v0.1.13 turns `npx @getmarrow/install govern` into an interactive terminal setup flow when run in a real TTY.
-
-- Select Codex, Claude Code, Cursor, OpenCode, OpenClaw, CI scripts, or a custom command with arrow keys.
-- Choose passive setup, governed pilot mode, or governed enforce mode.
-- Run passive setup + self-test from the TUI after explicit confirmation.
-- Check Marrow status and test the before-action gate from the same screen.
-- Print the exact command for the selected harness/mode so users know what to run next.
-- Exit cleanly with `q`, `Esc`, or `Ctrl+C`.
-- CI/non-TTY usage remains stable with `npx @getmarrow/install govern --no-interactive`.
-
-This keeps Marrow passive-first: install once, verify Marrow is active, then let agents use the runtime/gate path automatically for risky work.
-
-## What's New in v0.1.12
-
-v0.1.12 adds the Marrow governed runner for businesses that want agent governance without replacing their existing harness.
+The Marrow governed runner is for businesses that want agent governance without replacing their existing harness.
 
 - `npx @getmarrow/install govern` prints a setup panel for detected harnesses and recommended protected commands.
 - `npx @getmarrow/install run --agent <agent-id> -- <command>` wraps existing agent, deploy, merge, publish, migration, and verification commands with Marrow's pre-action runtime gate.
@@ -89,12 +45,6 @@ Preview the detected harnesses and protected command examples:
 npx @getmarrow/install govern
 ```
 
-In a real terminal, this opens the interactive setup flow. In CI or scripts, use:
-
-```bash
-npx @getmarrow/install govern --no-interactive
-```
-
 Run a harmless command through Marrow:
 
 ```bash
@@ -104,7 +54,7 @@ MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run --agent codex-prod --prof
 Gate a production action before the agent executes it:
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install gate "deploy production service after tests pass"
+MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install gate "deploy production worker after tests pass"
 ```
 
 Wrap a real deploy, publish, merge, or migration command only after the agent has the required proof:
@@ -115,20 +65,11 @@ MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run \
   --type deploy \
   --profile production \
   --policy enforce \
-  -- npm run deploy
+  -- wrangler deploy
 ```
 
 Use `--policy warn` for pilot mode and `--fail-open` only for non-production local workflows where Marrow should never block execution.
 
-## What's New in v0.1.10
-
-- First-run output now explains the value in agent/user language: your agent is no longer starting from zero.
-- Self-test prints first proof: setup decision captured, outcome closed, runtime gate active, and risky work now gets a pre-action brief.
-- Fresh accounts get a guided prompt to try immediately: "I am about to deploy to production. What should I check first?"
-- Existing accounts/fleets show stronger proof when available: avoided mistakes, reused winning decisions, prevented risky actions, and token/time savings.
-- Generated SDK passive runtime now fails soft if `@getmarrow/sdk` is missing and the installer prints the exact dependency fix.
-- Docs now make the universal installer the default path; SDK and MCP are advanced/manual integration paths.
-
 ## Which Install Path Should I Use?
 
 Start here unless you already know you need a lower-level integration:
@@ -161,7 +102,9 @@ Expected result:
 - `/v1/agent/status` confirms capture health and missing hooks.
 - `/v1/agent/runtime` verifies the one-call runtime gate and returns the before-action intervention contract.
 - `/v1/agent/first-value` returns the five-minute proof payload used by installer, SDK, and MCP clients.
+- `/v1/agent/value/proof` returns token value proof from passive model-usage capture.
 - The installer prints: "Your agent is no longer starting from zero."
+- The installer prints: "Token value proof" with capture status, observed model calls, token totals, estimated savings, confidence, and exact next action.
 - Fresh accounts get a first useful action to try immediately.
 - Accounts with history get proof such as avoided mistakes, reused winning decisions, prevented risky actions, or estimated time/token savings.
 
@@ -181,18 +124,10 @@ Marrow should answer with `proceed`, `warn`, `block`, or `owner_approval_require
 - Codex/agent instruction files such as `AGENTS.md`
 - Claude Code settings and hooks
 - Cursor project folders
-- Gemini, Grok, DeepSeek, Minimax, Kimi/Moonshot, Hermes, GLM, and Qwen project marker files when present
 - MCP config files
-- CI workflow/script markers
 - Node projects
 - Python projects
 
-The detector is intentionally conservative. If Marrow cannot identify the harness from local files, it still supports the workflow through the custom command path:
-
-```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run --agent research-agent -- <your-agent-command>
-```
-
 ## Install Modes
 
 ```bash
@@ -215,7 +150,7 @@ npx @getmarrow/install --md --dry-run
 
 ## Self-Test
 
-When `MARROW_API_KEY` is present, the installer creates a harmless test decision, commits the outcome, reads `/v1/agent/status`, calls the one-call runtime, and prints the first useful Marrow signal.
+When `MARROW_API_KEY` is present, the installer creates a harmless test decision, commits the outcome, reads `/v1/agent/status`, calls the one-call runtime, reads `/v1/agent/value/proof`, and prints the first useful Marrow signal plus token value proof.
 
 ```bash
 MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install --yes
@@ -233,14 +168,6 @@ Doctor check:
 MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install doctor
 ```
 
-Deep doctor with harmless write/outcome verification:
-
-```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install doctor --self-test
-```
-
-Expected healthy output includes `key valid: yes`, `write test event: passed`, and `outcome closed: passed`.
-
 Repair missing hooks/config:
 
 ```bash
@@ -257,6 +184,34 @@ npm install @getmarrow/sdk
 
 The generated runtime now fails soft with an explicit warning if the SDK package is missing, so onboarding does not crash a user process.
 
+## Passive Token Value Proof
+
+Token value proof is default-on when the installer writes `.marrow/passive-runtime.mjs`.
+
+In supported Node/TypeScript agents, the SDK passive runtime wraps outbound model-provider `fetch` responses and captures compact `usage` blocks when providers return them. MCP and harness integrations can also attach `model_usage` to `marrow_commit` or call `marrow_model_usage` when the harness exposes usage metadata.
+
+Captured fields are intentionally narrow:
+
+- provider and model
+- input, output, cached, and total token counts
+- optional cost and latency estimates
+- agent, workflow, session, and decision linkage
+- Marrow intervention type, such as `runtime_gate`, `proof_pack`, or `before_you_act`
+
+Marrow does not capture prompt text, completion text, raw tool output, command output, full environment values, or plaintext secrets for token value proof.
+
+Disable capture only when a project requires it:
+
+```bash
+MARROW_PASSIVE_TOKEN_USAGE=false
+```
+
+Day-one behavior:
+
+- Fresh install: `Token usage capture is ready; no model calls have been reported yet.`
+- After observed usage: Marrow reports model calls, total tokens, estimated tokens saved, confidence, trend, and next action.
+- After workflows complete: agents should show the returned `token_value_signal` or value proof in owner updates so users see savings without opening a dashboard.
+
 
 ## Trust and Data Boundaries
 

package/bin/marrow-install.js

@@ -4,7 +4,7 @@ const installer = require('../src/installer');
 const governedRunner = require('../src/governed-runner');
 
 const argv = process.argv.slice(2);
-const governedCommands = new Set(['run', 'gate', 'proof', 'status', 'govern']);
+const governedCommands = new Set(['run', 'gate', 'proof', 'status', 'govern', 'fleet']);
 const runCli = governedCommands.has(argv[0]) ? governedRunner.runCli : installer.runCli;
 
 runCli(argv).catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Universal installer for Marrow passive agent setup.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"
@@ -15,8 +15,6 @@
     "marrow",
     "mcp",
     "installer",
-    "governance",
-    "runner",
     "passive-runtime"
   ],
   "repository": {