@getmarrow/install 0.1.45 → 0.1.47

package/README.md

@@ -91,7 +91,28 @@ npx @getmarrow/install controller stop
 
 Persistent controller lifecycle is currently Linux-only. On macOS or Windows, activation still installs and verifies the supported hooks without starting or signaling a background process; run `npx @getmarrow/install sidecar` under an owner-managed service and pass `--no-controller`. The controller does not silently upgrade packages, change governance policy, rotate credentials, or modify unrelated project configuration.
 
-## What's New in v0.1.45
+## What's New in v0.1.47
+
+v0.1.47 makes activate honest about reload and the first capture path:
+
+- after writing MCP or hooks, activate reports that this process is not live until harness restart and `doctor --self-test`;
+- first capture is Claude native hooks, Cursor on-demand `marrow_agent_runtime`, or the Codex/Grok governed runner;
+- generated MCP setup, launch, and certified hook commands pin current MCP `3.9.65` from source `a314794b606c30cd750f01c672eab9b2c42e9862`;
+- SDK detection and operator-approved upgrade rules pin exact public `3.7.60`;
+- empty token savings stay zero until observed model usage lands.
+
+## Previous: v0.1.46
+
+v0.1.46 makes default install cover every workspace honestly:
+
+- auto mode now writes MCP plus agent instructions in every project, and the SDK passive runtime whenever Node is present;
+- Claude native hooks still install only when `.claude` is present; detected Cursor workspaces also get `.cursor/mcp.json`;
+- Hermes, OpenClaw, and custom hosts stay event-contract only and are not claimed as native interception;
+- generated MCP setup, launch, and certified hook commands pin current MCP `3.9.64` from source `ed8293165247e89161045c7fbf68aeee4d51c6da`;
+- SDK detection and operator-approved upgrade rules pin exact public `3.7.59`;
+- empty token savings stay zero until observed model usage lands.
+
+## Previous: v0.1.45
 
 v0.1.45 pins the one-command setup path to the published receipt-safe MCP release:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "Universal installer and governed runner for Marrow agent fleets.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/first-hour.js

@@ -0,0 +1,73 @@
+function wroteHarnessConfig(changes = []) {
+  return (changes || []).some((change) => {
+    if (!change || !(change.applied || change.changed)) return false;
+    return /MCP|hook|Claude|Cursor|Agent instructions|SDK passive/i.test(String(change.label || ''));
+  });
+}
+
+function harnessReloadPlan(detection = {}, changes = []) {
+  const clients = [];
+  if (detection.claudeCode) {
+    clients.push({
+      client: 'claude-code',
+      restart: 'Restart Claude Code so native hooks and MCP load.',
+    });
+  }
+  if (detection.cursor) {
+    clients.push({
+      client: 'cursor',
+      restart: 'Restart Cursor so project MCP loads.',
+    });
+  }
+  if (detection.codex) {
+    clients.push({
+      client: 'codex',
+      restart: 'Start a new Codex or Grok session so AGENTS.md and MCP config load.',
+    });
+  }
+  if (clients.length === 0) {
+    clients.push({
+      client: 'mcp',
+      restart: 'Restart the owning MCP host so marrow-mcp loads.',
+    });
+  }
+  const required = wroteHarnessConfig(changes);
+  return {
+    required,
+    live_in_this_process: !required,
+    prove_command: 'npx @getmarrow/install@latest doctor --self-test',
+    clients,
+    instruction: clients.map((entry) => entry.restart).join(' '),
+  };
+}
+
+function firstCapturePath(detection = {}, agentId) {
+  const id = String(agentId || '').trim() || '<agent-id>';
+  if (detection.claudeCode) {
+    return {
+      client: 'claude-code',
+      capability_level: 'native_hooks',
+      command: null,
+      instruction: 'After restart, Claude native hooks capture the next prompt, tool, and session-end automatically.',
+    };
+  }
+  if (detection.cursor) {
+    return {
+      client: 'cursor',
+      capability_level: 'mcp',
+      command: 'marrow_agent_runtime',
+      instruction: 'After restart, call marrow_agent_runtime before the next deploy, merge, or publish. Before the session ends, call marrow_session_end. Cursor MCP tools are on demand.',
+    };
+  }
+  return {
+    client: detection.codex ? 'codex' : 'governed_wrapper',
+    capability_level: 'governed_wrapper',
+    command: `npx @getmarrow/install run --agent ${id} -- -- <command>`,
+    instruction: 'Wrap the next deploy, merge, or publish with the governed runner. Codex and Grok do not intercept tools natively. Before the session ends, call marrow_session_end or marrow_commit. Do not invent token counts.',
+  };
+}
+
+module.exports = {
+  harnessReloadPlan,
+  firstCapturePath,
+};

package/src/installer.js

@@ -4,15 +4,16 @@ const os = require('node:os');
 const crypto = require('node:crypto');
 const { version: INSTALLER_ADAPTER_VERSION } = require('../package.json');
 const { controllerStatus, controllerSupportedPlatform, ensureGovernanceController } = require('./controller-manager');
+const { firstCapturePath, harnessReloadPlan } = require('./first-hour');
 
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
-const MCP_ADAPTER_VERSION = '3.9.62';
-const MCP_ADAPTER_SOURCE_SHA = 'c025d720af8fe9b16702ba764ff85c822adc2a26';
-const MCP_ADAPTER_INTEGRITY = 'sha512-XwvwptwMHnH2cchrt242iQGng8t8OVDHGYORHmD04cfSn2NQoH1Y3bPoxkvlf/j/ujPtqSPpT+uZGEFNRpecZQ==';
-const SDK_ADAPTER_VERSION = '3.7.56';
-const SDK_ADAPTER_INTEGRITY = 'sha512-mllohsI4DHpcVuEL58303kpGwS/pl/HMZ99mGNo3swYLomZwwfVzcner9Bn+p0b72989NOpS1l2frY/vra1gfQ==';
+const MCP_ADAPTER_VERSION = '3.9.65';
+const MCP_ADAPTER_SOURCE_SHA = 'a314794b606c30cd750f01c672eab9b2c42e9862';
+const MCP_ADAPTER_INTEGRITY = 'sha512-OMsuv8qY7S3PHSEl1kJOPPAQuiCKYPtHng6Dzhq8U7FzY3eICPQgHsYwMtoBjHA+/BIBoNoLyLof7qU2sC1qOQ==';
+const SDK_ADAPTER_VERSION = '3.7.60';
+const SDK_ADAPTER_INTEGRITY = 'sha512-w6QeazGjfDXzw55IBMs85vb0LoMvm1JZLfDeilNm8NEq0081XN6MX574aFo10ZBiMd82GYRMY4vMdJ9FuxtXnQ==';
 const SDK_ADAPTER_TARBALL = `https://registry.npmjs.org/@getmarrow/sdk/-/sdk-${SDK_ADAPTER_VERSION}.tgz`;
 const MCP_PACKAGE_SPEC = `@getmarrow/mcp@${MCP_ADAPTER_VERSION}`;
 const ADAPTER_PROVENANCE = Object.freeze({
@@ -619,10 +620,15 @@ function passiveInstructions() {
 
 Marrow should run passively after install:
 
-- Use MCP hooks when available: \`npx -y --package=@getmarrow/mcp@latest marrow-mcp setup\`.
+- Use MCP plus these instructions in every workspace: \`npx -y --package=@getmarrow/mcp@latest marrow-mcp setup\`.
 - Use SDK passive runtime in owned Node processes: \`createPassiveRuntime().install()\`.
-- Keep passive token/model usage proof enabled so Marrow can show token, cost, latency, and workflow savings after real work completes.
+- Native Claude hooks install only when \`.claude\` is present. Cursor, Composer, Cline, and Windsurf get MCP tools on demand. Codex, Grok, Gemini, and similar CLI harnesses use the governed wrapper. Hermes, OpenClaw, and custom hosts need a bounded event adapter.
+- Keep passive token/model usage proof enabled. Empty savings stay zero until observed model usage lands. Do not invent token, cost, or time savings.
 - Before risky work, use Marrow's decision brief or passive prompt hook.
+- After activate writes MCP or hooks, restart this harness, then run \`npx @getmarrow/install@latest doctor --self-test\`. Do not claim Marrow is live in a process that has not reloaded.
+- First turn: tell the owner the gate is live and empty savings are honest. The next deploy, merge, or publish must go through Marrow.
+- Cursor, Composer, Cline, and Windsurf: call \`marrow_agent_runtime\` before those actions. Codex, Grok, Gemini, and similar CLIs: wrap them with \`npx @getmarrow/install run --agent <agent-id> -- -- <command>\`.
+- Before the session ends, close open work with session-end auto-commit or \`marrow_commit\`. Record model usage only when the host response includes counts.
 - After meaningful work, record the outcome so future agents learn from it.
 - After Marrow blocks, warns, or requires review, use the decision trace receipt to tell the operator what changed and which recorded workflow or proof is required. Stay quiet for routine low-risk work.
 - Check health with \`marrow_agent_status\` or \`GET /v1/agent/status\`.
@@ -1051,13 +1057,36 @@ function inspectSdkDependency(detection) {
   };
 }
 
+function defaultHarnessInstallMatrix(detection = detectEnvironment(process.cwd())) {
+  const node = Boolean(detection.node);
+  return HARNESS_CAPABILITY_REGISTRY.map((entry) => {
+    const detected = detectedClient(detection) === entry.client
+      || (entry.client === 'claude-code' && detection.claudeCode)
+      || (entry.client === 'cursor' && detection.cursor)
+      || (entry.client === 'codex' && detection.codex);
+    return {
+      client: entry.client,
+      capability_level: entry.capability_level,
+      automatic: entry.automatic,
+      install_surface: entry.install_surface,
+      default_install: {
+        mcp: true,
+        instructions: true,
+        sdk_passive_runtime: node,
+        native_hooks: entry.capability_level === 'native_hooks' && Boolean(detection.claudeCode),
+        governed_wrapper: entry.capability_level === 'governed_wrapper',
+      },
+      verified_passive: detected && entry.automatic.length > 0,
+      unsupported_claim: entry.capability_level === 'event_contract'
+        ? 'Needs a bounded event adapter. MCP tools remain on demand.'
+        : null,
+    };
+  });
+}
+
 function buildPlan(detection, options) {
   const mode = options.mode === 'auto'
-    ? detection.node && (detection.claudeCode || detection.cursor || detection.codex || detection.openclaw)
-      ? 'both'
-      : detection.node
-      ? 'sdk'
-      : 'mcp'
+    ? detection.node ? 'both' : 'mcp'
     : options.mode;
   const writes = [];
 
@@ -1092,6 +1121,14 @@ function buildPlan(detection, options) {
       label: 'Project MCP server config',
       transform: upsertMcpServerConfig,
     });
+    if (detection.cursor) {
+      writes.push({
+        type: 'json-transform',
+        path: detection.paths.cursorMcp,
+        label: 'Cursor MCP server config',
+        transform: upsertMcpServerConfig,
+      });
+    }
   }
 
   if (mode === 'md' || mode === 'both' || mode === 'mcp') {
@@ -1675,6 +1712,21 @@ function printReport(report) {
     }
   }
 
+  if (report.harnessReload) {
+    process.stdout.write('\nHarness reload:\n');
+    process.stdout.write(`- required: ${report.harnessReload.required ? 'yes' : 'no'}\n`);
+    process.stdout.write(`- live in this process: ${report.harnessReload.live_in_this_process ? 'yes' : 'no'}\n`);
+    if (report.harnessReload.instruction) process.stdout.write(`- restart: ${report.harnessReload.instruction}\n`);
+    if (report.harnessReload.prove_command) process.stdout.write(`- prove after restart: ${report.harnessReload.prove_command}\n`);
+  }
+  if (report.firstCapture) {
+    process.stdout.write('\nFirst capture:\n');
+    process.stdout.write(`- client: ${report.firstCapture.client}\n`);
+    process.stdout.write(`- capability: ${report.firstCapture.capability_level}\n`);
+    if (report.firstCapture.command) process.stdout.write(`- command: ${report.firstCapture.command}\n`);
+    process.stdout.write(`- ${report.firstCapture.instruction}\n`);
+  }
+
   if (report.remediation) {
     process.stdout.write('\nRemediation:\n');
     process.stdout.write(`- attempted: ${report.remediation.attempted ? 'yes' : 'no'}\n`);
@@ -1712,8 +1764,14 @@ function printReport(report) {
   if (report.controller?.exact_fix) process.stdout.write(`- exact fix: ${report.controller.exact_fix}\n`);
 
   if (report.writeMode === 'doctor') {
+    const liveHere = !report.harnessReload?.required;
+    const activeLabel = report.doctor.active && liveHere
+      ? 'yes'
+      : report.doctor.active
+        ? 'server confirmed, restart required'
+        : 'no';
     process.stdout.write('\nDoctor:\n');
-    process.stdout.write(`- Marrow active: ${report.doctor.active ? 'yes' : 'no'}\n`);
+    process.stdout.write(`- Marrow active: ${activeLabel}\n`);
     process.stdout.write(`- missing env: ${report.doctor.missingEnv.length ? report.doctor.missingEnv.join(', ') : 'none'}\n`);
     if (report.doctor.envHints.length) process.stdout.write(`- possible env files: ${report.doctor.envHints.join(', ')}\n`);
     process.stdout.write(`- missing hooks/config: ${report.doctor.missingHooks.length ? report.doctor.missingHooks.join('; ') : 'none'}\n`);
@@ -1877,6 +1935,8 @@ async function install(options) {
       receipt: selfTest.activation_receipt || null,
       profile,
     },
+    harnessReload: harnessReloadPlan(detection, changes),
+    firstCapture: firstCapturePath(detection, options.agentId),
     changes,
     doctor: {
       active: Boolean(!selfTest.skipped && selfTest.active),
@@ -1947,4 +2007,7 @@ module.exports = {
   printReport,
   ADAPTER_PROVENANCE,
   HARNESS_CAPABILITY_REGISTRY,
+  defaultHarnessInstallMatrix,
+  harnessReloadPlan,
+  firstCapturePath,
 };