@getmarrow/install 0.1.43 → 0.1.45

package/README.md

@@ -91,14 +91,34 @@ npx @getmarrow/install controller stop
 
 Persistent controller lifecycle is currently Linux-only. On macOS or Windows, activation still installs and verifies the supported hooks without starting or signaling a background process; run `npx @getmarrow/install sidecar` under an owner-managed service and pass `--no-controller`. The controller does not silently upgrade packages, change governance policy, rotate credentials, or modify unrelated project configuration.
 
-## What's New in v0.1.43
+## What's New in v0.1.45
+
+v0.1.45 pins the one-command setup path to the published receipt-safe MCP release:
+
+- generated MCP setup, launch, and certified hook commands pin current MCP `3.9.62`;
+- adapter provenance records exact MCP source `c025d720af8fe9b16702ba764ff85c822adc2a26` and the live public registry integrity;
+- MCP versions older than `3.9.62` are treated as stale so new installs receive the fail-closed runtime authorization contract;
+- `npx @getmarrow/install@latest update` is the owner-approved one-command refresh of certified install/SDK/MCP pins; doctor and status print an owner notice so agents can tell the user to update;
+- self-test and governed-runner requests report install, SDK, and MCP versions together so the API can notify on any stale package;
+- SDK `3.7.56` detection and operator-approved upgrade rules are unchanged.
+
+## Previous: v0.1.44
+
+v0.1.44 restores exact package-chain detection and current MCP setup truth:
+
+- exact declared, locked, and installed SDK `3.7.56` dependencies are recognized using the live public registry integrity;
+- generated MCP setup, launch, and certified hook commands pin current MCP `3.9.61`;
+- the installer exposes the certified MCP source SHA and public registry integrity in its programmatic adapter provenance without changing credentials, policy, or unrelated configuration;
+- regression coverage rejects stale SDK lock integrity and treats MCP versions older than `3.9.61` as stale.
+
+## Previous: v0.1.43
 
 v0.1.43 hardens the MCP control path and makes stale client recovery explicit:
 
 - `doctor` detects active and configured stale, mixed, or version-unknown Marrow MCP clients without exposing command lines, file paths, configuration contents, or credentials;
 - every generated MCP launch and hook uses the package-explicit `npx --package ... marrow-mcp` form so npm can resolve the executable reliably;
 - when repair is needed, `doctor` reports the pinned setup command, the separate owning-harness restart requirement, and a self-test verification command; it does not terminate harness processes itself;
-- certified hooks pin MCP `3.9.59` and SDK `3.7.56` so the installed runtime matches the advertised control contract;
+- certified hooks pinned MCP `3.9.59` and SDK `3.7.56` so the installed runtime matched that release's advertised control contract;
 - existing harnesses retain their honest coverage level: native hooks where supported, MCP calls where available, and governed wrappers or event contracts elsewhere;
 - package upgrades remain operator-approved and never rotate keys or rewrite unrelated configuration.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "description": "Universal installer and governed runner for Marrow agent fleets.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/governed-runner.js

@@ -21,6 +21,7 @@ const {
   stopGovernanceController,
 } = require('./controller-manager');
 const {
+  ADAPTER_PROVENANCE,
   HARNESS_CAPABILITY_REGISTRY,
   applyPlan,
   buildPlan,
@@ -482,6 +483,9 @@ function headers(options) {
     'X-Marrow-Client': sourceClient(options.client),
     'X-Marrow-Package': '@getmarrow/install',
     'X-Marrow-Package-Version': INSTALLER_PACKAGE_VERSION,
+    'X-Marrow-Install-Version': INSTALLER_PACKAGE_VERSION,
+    'X-Marrow-SDK-Version': ADAPTER_PROVENANCE.sdk.version,
+    'X-Marrow-MCP-Version': ADAPTER_PROVENANCE.mcp.version,
     'User-Agent': '@getmarrow/install governed-runner',
   };
   return h;
@@ -1006,7 +1010,11 @@ function statusPanel(status = {}) {
   if (update && (update.update_available === true || update.version_status === 'unknown' || notification === 'unknown' || notification === 'version_unknown' || priority === 'security_required')) {
     lines.push(`Client update: ${displayText(priority, 32)}; installed=${displayText(update.installed_version || update.current_version || 'unknown', 32)}; latest=${displayText(update.latest_version || 'unknown', 32)}`);
     lines.push('Automatic notification: yes; automatic local mutation: no; operator policy applies.');
-    if (update.update_command || update.exact_update_command) lines.push(`Update: ${displayText(update.update_command || update.exact_update_command, 240)}`);
+    if (update.owner_notice) lines.push(`Tell owner: ${displayText(update.owner_notice, 240)}`);
+    if (update.agent_instruction) lines.push(`Agent instruction: ${displayText(update.agent_instruction, 240)}`);
+    if (update.auto_update_command || update.update_command || update.exact_update_command) {
+      lines.push(`Update: ${displayText(update.auto_update_command || update.update_command || update.exact_update_command, 240)}`);
+    }
     if (update.verification_command || update.exact_verification_command) lines.push(`Verify: ${displayText(update.verification_command || update.exact_verification_command, 240)}`);
   } else {
     lines.push('Client update: current or unavailable.');

package/src/installer.js

@@ -8,11 +8,26 @@ const { controllerStatus, controllerSupportedPlatform, ensureGovernanceControlle
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
-const MCP_ADAPTER_VERSION = '3.9.59';
+const MCP_ADAPTER_VERSION = '3.9.62';
+const MCP_ADAPTER_SOURCE_SHA = 'c025d720af8fe9b16702ba764ff85c822adc2a26';
+const MCP_ADAPTER_INTEGRITY = 'sha512-XwvwptwMHnH2cchrt242iQGng8t8OVDHGYORHmD04cfSn2NQoH1Y3bPoxkvlf/j/ujPtqSPpT+uZGEFNRpecZQ==';
 const SDK_ADAPTER_VERSION = '3.7.56';
-const SDK_ADAPTER_INTEGRITY = 'sha512-5htliY4wfn8a1mbLT9N4OWXqhp9fWzMHuAQgUetc3RUKjOes5mWB3t91/leRKFRRIgCnEczJN6jHXg7Aw489Mw==';
+const SDK_ADAPTER_INTEGRITY = 'sha512-mllohsI4DHpcVuEL58303kpGwS/pl/HMZ99mGNo3swYLomZwwfVzcner9Bn+p0b72989NOpS1l2frY/vra1gfQ==';
 const SDK_ADAPTER_TARBALL = `https://registry.npmjs.org/@getmarrow/sdk/-/sdk-${SDK_ADAPTER_VERSION}.tgz`;
 const MCP_PACKAGE_SPEC = `@getmarrow/mcp@${MCP_ADAPTER_VERSION}`;
+const ADAPTER_PROVENANCE = Object.freeze({
+  mcp: Object.freeze({
+    package: '@getmarrow/mcp',
+    version: MCP_ADAPTER_VERSION,
+    source_sha: MCP_ADAPTER_SOURCE_SHA,
+    integrity: MCP_ADAPTER_INTEGRITY,
+  }),
+  sdk: Object.freeze({
+    package: '@getmarrow/sdk',
+    version: SDK_ADAPTER_VERSION,
+    integrity: SDK_ADAPTER_INTEGRITY,
+  }),
+});
 const MCP_CONTEXT_HOOK_COMMAND = `npx -y --package=${MCP_PACKAGE_SPEC} marrow-mcp context-hook`;
 const MCP_PRE_ACTION_HOOK_COMMAND = `npx -y --package=${MCP_PACKAGE_SPEC} marrow-mcp pre-action-hook`;
 const MCP_ACTION_RESULT_HOOK_COMMAND = `npx -y --package=${MCP_PACKAGE_SPEC} marrow-mcp hook`;
@@ -262,9 +277,10 @@ function parseArgs(argv) {
       options.selfTest = true;
     }
     else if (arg === '--yes' || arg === '-y') options.yes = true;
-    else if (arg === '--repair' || arg === 'repair') {
+    else if (arg === '--repair' || arg === 'repair' || arg === 'update' || arg === '--update') {
       options.repair = true;
       options.yes = true;
+      options.update = true;
     }
     else if (arg === '--dry-run') options.dryRun = true;
     else if (arg === '--doctor' || arg === 'doctor' || arg === 'check') options.doctor = true;
@@ -313,6 +329,7 @@ function usage() {
   npx @getmarrow/install activate
   npx @getmarrow/install --yes
   npx @getmarrow/install --repair
+  npx @getmarrow/install update
   npx @getmarrow/install doctor
   npx @getmarrow/install --mcp --yes
   npx @getmarrow/install --sdk --yes
@@ -322,6 +339,7 @@ Options:
   --dry-run          Print planned changes without writing
   --doctor           Check install health without writing
   --repair           Write missing hooks/config, then run self-test and status check
+  update             Same as --repair: refresh certified MCP/SDK/install pins after owner approval
   --yes, -y          Write detected config files
   --mode <mode>      auto, mcp, sdk, both, or md
   --key <key>        Marrow API key for self-test. Prefer MARROW_API_KEY because CLI args can appear in process listings.
@@ -1243,6 +1261,9 @@ async function runSelfTest(options) {
     'x-marrow-client': options.client || sourceClient(),
     'x-marrow-package': '@getmarrow/install',
     'x-marrow-package-version': INSTALLER_ADAPTER_VERSION,
+    'x-marrow-install-version': INSTALLER_ADAPTER_VERSION,
+    'x-marrow-sdk-version': SDK_ADAPTER_VERSION,
+    'x-marrow-mcp-version': MCP_ADAPTER_VERSION,
   };
   if (options.agentId) headers['x-marrow-agent-id'] = options.agentId;
 
@@ -1612,7 +1633,11 @@ function printReport(report) {
       process.stdout.write(`- latest: ${update.latest_version || 'unknown'}\n`);
       process.stdout.write('- automatic notification: yes\n');
       process.stdout.write('- automatic local mutation: no; operator policy applies\n');
-      if (update.update_command || update.exact_update_command) process.stdout.write(`- update: ${update.update_command || update.exact_update_command}\n`);
+      if (update.owner_notice) process.stdout.write(`- tell owner: ${update.owner_notice}\n`);
+      if (update.agent_instruction) process.stdout.write(`- agent instruction: ${update.agent_instruction}\n`);
+      if (update.update_command || update.exact_update_command || update.auto_update_command) {
+        process.stdout.write(`- update: ${update.auto_update_command || update.update_command || update.exact_update_command}\n`);
+      }
       if (update.verification_command || update.exact_verification_command) process.stdout.write(`- verify: ${update.verification_command || update.exact_verification_command}\n`);
     }
     if (report.selfTest.first_value_signal) {
@@ -1833,6 +1858,7 @@ async function install(options) {
 
   return {
     root: detection.root,
+    adapterProvenance: ADAPTER_PROVENANCE,
     mode: plan.mode,
     writeMode,
     detected: {
@@ -1919,5 +1945,6 @@ module.exports = {
   activationProfile,
   claudeNativeHookFingerprint,
   printReport,
+  ADAPTER_PROVENANCE,
   HARNESS_CAPABILITY_REGISTRY,
 };