@getmarrow/install 0.1.5 → 0.1.7

package/README.md

@@ -11,13 +11,29 @@ npx @getmarrow/install --repair
 npx @getmarrow/install doctor
 ```
 
-## What's New in v0.1.4
+## What's New in v0.1.6
 
-- Installer self-test now finishes with a first-value summary: Marrow active state, captured surfaces, first useful lesson, value proof, and exact next action.
-- Generated SDK passive runtime enables one-call agent runtime checks by default with `MARROW_AGENT_RUNTIME=true`.
-- Self-test now verifies the runtime endpoint in addition to creating a harmless decision and committing its outcome.
-- `--repair` keeps dry-run behavior safe when `--dry-run` is present and reports whether one-call runtime was verified.
-- Doctor/repair output still gives exact safe setup and repair commands without printing credential values.
+- Installer doctor/repair now detects npm token/config path mismatches like `~/.openclaw/.env` versus `~/.npmrc` without printing token values.
+- `--repair` can sync the active npm token into `~/.npmrc` when a mismatch is detected, preserving a local backup.
+- Generated SDK passive runtime now requires outcome closure by default with `MARROW_REQUIRE_OUTCOME_CLOSURE=true`.
+- Self-test still creates a harmless decision, commits the outcome, checks status, calls the one-call runtime, and prints first-value proof.
+- Doctor/repair output gives exact safe setup and repair commands without exposing credentials.
+
+## Agent Value Proof Quickstart
+
+One command should prove Marrow is active and useful:
+
+```bash
+MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install --yes
+```
+
+Expected result:
+
+- Marrow writes the safest detected MCP/SDK/agent config.
+- A harmless setup decision is created and its outcome is committed.
+- `/v1/agent/status` confirms capture health and missing hooks.
+- `/v1/agent/runtime` returns the first "before you act" lesson or exact next action.
+- The installer prints first-value proof such as captured surfaces, reused lessons, prevented risky actions, or estimated time/token savings when enough history exists.
 
 ## What It Detects
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Universal installer for Marrow passive agent setup.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/installer.js

@@ -1,6 +1,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
+const crypto = require('node:crypto');
 
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
@@ -160,6 +161,120 @@ function findLikelyEnvFiles(detection, env = process.env) {
   });
 }
 
+function stripQuotes(value) {
+  const trimmed = String(value || '').trim();
+  if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+
+function readEnvVar(filePath, name) {
+  if (!exists(filePath)) return '';
+  const raw = safeRead(filePath);
+  const pattern = new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=\\s*([^\\n#]+)`, 'm');
+  const match = raw.match(pattern);
+  return match ? stripQuotes(match[1]) : '';
+}
+
+function readFirstLineSecret(filePath) {
+  if (!exists(filePath)) return '';
+  return safeRead(filePath).split(/\r?\n/).map((line) => line.trim()).find(Boolean) || '';
+}
+
+function readNpmrcToken(filePath) {
+  if (!exists(filePath)) return '';
+  const raw = safeRead(filePath);
+  const match = raw.match(/\/\/registry\.npmjs\.org\/:_authToken\s*=\s*([^\s]+)/);
+  return match ? stripQuotes(match[1]) : '';
+}
+
+function fingerprint(value) {
+  const secret = String(value || '').trim();
+  if (!secret) return null;
+  return crypto.createHash('sha256').update(secret).digest('hex').slice(0, 12);
+}
+
+function npmTokenPaths(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || os.homedir();
+  return {
+    openclawEnv: path.join(home, '.openclaw', '.env'),
+    credentialFile: path.join(home, '.openclaw', 'credentials', 'npm-getmarrow-token.txt'),
+    npmrc: path.join(home, '.npmrc'),
+  };
+}
+
+function inspectNpmTokenConfig(env = process.env) {
+  const paths = npmTokenPaths(env);
+  const openclawToken = readEnvVar(paths.openclawEnv, 'NPM_TOKEN');
+  const credentialToken = readFirstLineSecret(paths.credentialFile);
+  const npmrcToken = readNpmrcToken(paths.npmrc);
+  const sourceToken = openclawToken || credentialToken;
+  const mismatch = Boolean(sourceToken && npmrcToken && fingerprint(sourceToken) !== fingerprint(npmrcToken));
+  const missingNpmrcToken = Boolean(sourceToken && !npmrcToken);
+
+  return {
+    safe: {
+      npm_token: {
+        checked: true,
+        repairable: Boolean(sourceToken && (mismatch || missingNpmrcToken)),
+        mismatch,
+        missing_npmrc_token: missingNpmrcToken,
+        sources: {
+          openclaw_env: { path: paths.openclawEnv, present: Boolean(openclawToken), fingerprint: fingerprint(openclawToken) },
+          credential_file: { path: paths.credentialFile, present: Boolean(credentialToken), fingerprint: fingerprint(credentialToken) },
+          npmrc: { path: paths.npmrc, present: Boolean(npmrcToken), fingerprint: fingerprint(npmrcToken) },
+        },
+        recommended_fix: mismatch || missingNpmrcToken
+          ? 'Run npx @getmarrow/install --repair to sync ~/.npmrc from the active OpenClaw/getmarrow npm token source.'
+          : null,
+      },
+    },
+    raw: { paths, sourceToken, npmrcToken },
+  };
+}
+
+function upsertNpmrcToken(filePath, token) {
+  const before = safeRead(filePath);
+  const tokenLine = `//registry.npmjs.org/:_authToken=${token}`;
+  let after;
+  if (/\/\/registry\.npmjs\.org\/:_authToken\s*=/.test(before)) {
+    after = before.replace(/\/\/registry\.npmjs\.org\/:_authToken\s*=\s*[^\n\r]+/, tokenLine);
+  } else {
+    const separator = before && !before.endsWith('\n') ? '\n' : '';
+    after = `${before}${separator}${tokenLine}\n`;
+  }
+  if (before !== after) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    if (before) {
+      const backupPath = `${filePath}.marrow-backup`;
+      fs.writeFileSync(backupPath, before, { mode: 0o600 });
+      fs.chmodSync(backupPath, 0o600);
+    }
+    fs.writeFileSync(filePath, after, { mode: 0o600 });
+    fs.chmodSync(filePath, 0o600);
+  }
+  return before !== after;
+}
+
+function repairConfigDiagnostics(diagnostics, env = process.env) {
+  const inspection = inspectNpmTokenConfig(env);
+  const npm = diagnostics.npm_token;
+  const repairs = [];
+  if (npm?.repairable && inspection.raw.sourceToken) {
+    const changed = upsertNpmrcToken(inspection.raw.paths.npmrc, inspection.raw.sourceToken);
+    repairs.push({
+      type: 'npm_token_npmrc_sync',
+      changed,
+      path: inspection.raw.paths.npmrc,
+      message: changed
+        ? 'Synced ~/.npmrc npm token from active OpenClaw/getmarrow token source.'
+        : '~/.npmrc already matched the active OpenClaw/getmarrow token source.',
+    });
+  }
+  return repairs;
+}
+
 function passiveInstructions() {
   return `${MARROW_BLOCK_START}
 ## Marrow Passive Agent Memory
@@ -196,6 +311,7 @@ if (apiKey && !globalThis.__MARROW_PASSIVE_RUNTIME__) {
     valueReportPeriod: process.env.MARROW_VALUE_REPORT_PERIOD || '7d',
     useAgentRuntime: process.env.MARROW_AGENT_RUNTIME !== 'false',
     useWorkflowGate: process.env.MARROW_WORKFLOW_GATE !== 'false',
+    requireOutcomeClosure: process.env.MARROW_REQUIRE_OUTCOME_CLOSURE !== 'false',
   });
 
   runtime.install();
@@ -213,6 +329,7 @@ MARROW_PASSIVE_BRIEF=auto
 MARROW_PASSIVE_VALUE_REPORT=true
 MARROW_AGENT_RUNTIME=true
 MARROW_WORKFLOW_GATE=true
+MARROW_REQUIRE_OUTCOME_CLOSURE=true
 `;
 }
 
@@ -564,6 +681,22 @@ function printReport(report) {
     if (report.remediation.message) process.stdout.write(`- result: ${report.remediation.message}\n`);
   }
 
+  if (report.configDiagnostics?.npm_token?.mismatch || report.configDiagnostics?.npm_token?.missing_npmrc_token) {
+    const npm = report.configDiagnostics.npm_token;
+    process.stdout.write('\nConfig diagnostics:\n');
+    process.stdout.write(`- npm token mismatch: ${npm.mismatch ? 'yes' : 'no'}\n`);
+    process.stdout.write(`- npmrc token missing: ${npm.missing_npmrc_token ? 'yes' : 'no'}\n`);
+    process.stdout.write(`- repairable: ${npm.repairable ? 'yes' : 'no'}\n`);
+    if (npm.recommended_fix) process.stdout.write(`- exact fix: ${npm.recommended_fix}\n`);
+  }
+
+  if (report.configRepairs?.length) {
+    process.stdout.write('\nConfig repairs:\n');
+    for (const repair of report.configRepairs) {
+      process.stdout.write(`- ${repair.changed ? 'fixed' : 'checked'}: ${repair.message}\n`);
+    }
+  }
+
   if (report.writeMode === 'doctor') {
     process.stdout.write('\nDoctor:\n');
     process.stdout.write(`- Marrow active: ${report.doctor.active ? 'yes' : 'no'}\n`);
@@ -590,13 +723,18 @@ async function install(options) {
   const plan = buildPlan(detection, options);
   const writeMode = options.doctor ? 'doctor' : options.dryRun ? 'dry-run' : options.repair ? 'repair' : options.yes ? 'write' : 'dry-run';
   const changes = applyPlan(plan, options);
+  const configInspection = inspectNpmTokenConfig();
+  const configDiagnostics = configInspection.safe;
+  const configRepairs = options.repair && !options.dryRun && !options.doctor
+    ? repairConfigDiagnostics(configDiagnostics)
+    : [];
   const envHints = options.apiKey ? [] : findLikelyEnvFiles(detection);
   const selfTest = await runSelfTest(options).catch((error) => ({
     skipped: false,
     active: false,
     error: error instanceof Error ? error.message : String(error),
   }));
-  const changedConfig = changes.some((change) => change.changed);
+  const changedConfig = changes.some((change) => change.changed) || configRepairs.some((repair) => repair.changed);
   const selfTestPassed = Boolean(!selfTest.skipped && selfTest.active && !selfTest.error);
   const remediation = options.repair
     ? {
@@ -632,13 +770,15 @@ async function install(options) {
       missingEnv: options.apiKey ? [] : ['MARROW_API_KEY'],
       envHints,
       missingHooks: changes.filter((change) => change.changed).map((change) => change.label),
-      recommendedFix: selfTest.recommended_fix || (!options.apiKey
+      recommendedFix: configDiagnostics.npm_token.recommended_fix || selfTest.recommended_fix || (!options.apiKey
         ? envHints.length
           ? `MARROW_API_KEY was found in a likely env file at ${envHints[0]}. Load that key from trusted secret storage, export only MARROW_API_KEY, then run npx @getmarrow/install --repair.`
           : 'Set MARROW_API_KEY, then run npx @getmarrow/install --repair.'
         : null),
     },
     remediation,
+    configDiagnostics,
+    configRepairs,
     selfTest,
     warnings: options.keyFromArg
       ? ['Avoid --key in shared shells because command-line arguments can be visible in process listings. Prefer MARROW_API_KEY in your environment or secret manager.']
@@ -669,4 +809,5 @@ module.exports = {
   runSelfTest,
   runCli,
   passiveRuntimeSource,
+  inspectNpmTokenConfig,
 };