@getmarrow/install 0.1.43 → 0.1.44

package/README.md

@@ -91,14 +91,23 @@ npx @getmarrow/install controller stop
 
 Persistent controller lifecycle is currently Linux-only. On macOS or Windows, activation still installs and verifies the supported hooks without starting or signaling a background process; run `npx @getmarrow/install sidecar` under an owner-managed service and pass `--no-controller`. The controller does not silently upgrade packages, change governance policy, rotate credentials, or modify unrelated project configuration.
 
-## What's New in v0.1.43
+## What's New in v0.1.44
+
+v0.1.44 restores exact package-chain detection and current MCP setup truth:
+
+- exact declared, locked, and installed SDK `3.7.56` dependencies are recognized using the live public registry integrity;
+- generated MCP setup, launch, and certified hook commands pin current MCP `3.9.61`;
+- the installer exposes the certified MCP source SHA and public registry integrity in its programmatic adapter provenance without changing credentials, policy, or unrelated configuration;
+- regression coverage rejects stale SDK lock integrity and treats MCP versions older than `3.9.61` as stale.
+
+## Previous: v0.1.43
 
 v0.1.43 hardens the MCP control path and makes stale client recovery explicit:
 
 - `doctor` detects active and configured stale, mixed, or version-unknown Marrow MCP clients without exposing command lines, file paths, configuration contents, or credentials;
 - every generated MCP launch and hook uses the package-explicit `npx --package ... marrow-mcp` form so npm can resolve the executable reliably;
 - when repair is needed, `doctor` reports the pinned setup command, the separate owning-harness restart requirement, and a self-test verification command; it does not terminate harness processes itself;
-- certified hooks pin MCP `3.9.59` and SDK `3.7.56` so the installed runtime matches the advertised control contract;
+- certified hooks pinned MCP `3.9.59` and SDK `3.7.56` so the installed runtime matched that release's advertised control contract;
 - existing harnesses retain their honest coverage level: native hooks where supported, MCP calls where available, and governed wrappers or event contracts elsewhere;
 - package upgrades remain operator-approved and never rotate keys or rewrite unrelated configuration.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.43",
+  "version": "0.1.44",
   "description": "Universal installer and governed runner for Marrow agent fleets.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/installer.js

@@ -8,11 +8,26 @@ const { controllerStatus, controllerSupportedPlatform, ensureGovernanceControlle
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
-const MCP_ADAPTER_VERSION = '3.9.59';
+const MCP_ADAPTER_VERSION = '3.9.61';
+const MCP_ADAPTER_SOURCE_SHA = 'ebe06a5c78895e70ceea7b7383ac31d5aaacbd41';
+const MCP_ADAPTER_INTEGRITY = 'sha512-6ojhKztiJp8/mZecuSnt+kiEe41COPBOjrka9j+r+yFacNl4uapW9quq/wEVo5SxuDmxolFIBaqkX6xIdaD2rA==';
 const SDK_ADAPTER_VERSION = '3.7.56';
-const SDK_ADAPTER_INTEGRITY = 'sha512-5htliY4wfn8a1mbLT9N4OWXqhp9fWzMHuAQgUetc3RUKjOes5mWB3t91/leRKFRRIgCnEczJN6jHXg7Aw489Mw==';
+const SDK_ADAPTER_INTEGRITY = 'sha512-mllohsI4DHpcVuEL58303kpGwS/pl/HMZ99mGNo3swYLomZwwfVzcner9Bn+p0b72989NOpS1l2frY/vra1gfQ==';
 const SDK_ADAPTER_TARBALL = `https://registry.npmjs.org/@getmarrow/sdk/-/sdk-${SDK_ADAPTER_VERSION}.tgz`;
 const MCP_PACKAGE_SPEC = `@getmarrow/mcp@${MCP_ADAPTER_VERSION}`;
+const ADAPTER_PROVENANCE = Object.freeze({
+  mcp: Object.freeze({
+    package: '@getmarrow/mcp',
+    version: MCP_ADAPTER_VERSION,
+    source_sha: MCP_ADAPTER_SOURCE_SHA,
+    integrity: MCP_ADAPTER_INTEGRITY,
+  }),
+  sdk: Object.freeze({
+    package: '@getmarrow/sdk',
+    version: SDK_ADAPTER_VERSION,
+    integrity: SDK_ADAPTER_INTEGRITY,
+  }),
+});
 const MCP_CONTEXT_HOOK_COMMAND = `npx -y --package=${MCP_PACKAGE_SPEC} marrow-mcp context-hook`;
 const MCP_PRE_ACTION_HOOK_COMMAND = `npx -y --package=${MCP_PACKAGE_SPEC} marrow-mcp pre-action-hook`;
 const MCP_ACTION_RESULT_HOOK_COMMAND = `npx -y --package=${MCP_PACKAGE_SPEC} marrow-mcp hook`;
@@ -1833,6 +1848,7 @@ async function install(options) {
 
   return {
     root: detection.root,
+    adapterProvenance: ADAPTER_PROVENANCE,
     mode: plan.mode,
     writeMode,
     detected: {
@@ -1919,5 +1935,6 @@ module.exports = {
   activationProfile,
   claudeNativeHookFingerprint,
   printReport,
+  ADAPTER_PROVENANCE,
   HARNESS_CAPABILITY_REGISTRY,
 };