@getmarrow/install 0.1.56 → 0.1.57

package/README.md

@@ -101,7 +101,11 @@ npx @getmarrow/install controller stop
 
 Persistent controller lifecycle is currently Linux-only. On macOS or Windows, activation still writes supported configuration and verifies one server-side install self-test without certifying that hooks continuously ran; run `npx @getmarrow/install sidecar` under an owner-managed service and pass `--no-controller`. The controller does not silently upgrade packages, change governance policy, rotate credentials, or modify unrelated project configuration.
 
-## What's New in v0.1.56
+## What's New in v0.1.57
+
+v0.1.57 pins the npm-verified MCP `3.9.88` and SDK `3.7.63` packages. Doctor now recognizes an installed and lockfile-verified SDK `3.7.63` instead of suggesting `3.7.62`. If a workspace has a newer stable SDK version, doctor preserves it and asks for official registry verification before replacement. The generated MCP setup, hooks, and update instructions target `3.9.88`; restart the owning harness and run `npx @getmarrow/install@latest doctor --self-test` after activation.
+
+## Previous: v0.1.56
 
 v0.1.56 pins the officially verified MCP `3.9.80` release from source `ee1eda3f201965a6530256accbdf175660dd8ad6` with registry integrity `sha512-uou3X18pESV39EMmddDrYN7yd6MrZzosrnQ1eRtvK5j3yuBLAlupj5kQVrrKEWAL6xwuLebXq2isivK2O/2WrA==`; SDK remains `3.7.62`. Doctor now directs stale, mixed, or version-unknown MCP installations through one `npx -y @getmarrow/install@latest update`, followed by one owning-harness restart and one `doctor --self-test` verification. The update resolves one official target and applies it consistently across detected Marrow-managed instructions, MCP launch configuration, and supported native hooks without claiming that already-running processes changed.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.56",
+  "version": "0.1.57",
   "description": "Universal installer and governed runner for Marrow agent fleets.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/installer.js

@@ -10,11 +10,11 @@ const { evidence: localControlEvidence } = require('./control-state');
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
-const MCP_ADAPTER_VERSION = '3.9.80';
-const MCP_ADAPTER_SOURCE_SHA = 'ee1eda3f201965a6530256accbdf175660dd8ad6';
-const MCP_ADAPTER_INTEGRITY = 'sha512-uou3X18pESV39EMmddDrYN7yd6MrZzosrnQ1eRtvK5j3yuBLAlupj5kQVrrKEWAL6xwuLebXq2isivK2O/2WrA==';
-const SDK_ADAPTER_VERSION = '3.7.62';
-const SDK_ADAPTER_INTEGRITY = 'sha512-n1i6Be09TpAQ9BPNRKY7aCvA2iSUPpJfw8djw2MELwpNbBCtKiZ29Jji77BK/6EFLUpSIcTW/Gmdf/ccf0JRYQ==';
+const MCP_ADAPTER_VERSION = '3.9.88';
+const MCP_ADAPTER_SOURCE_SHA = '2385f0554dd9455e6a7d2c0396058710ab56611a';
+const MCP_ADAPTER_INTEGRITY = 'sha512-1WQtVU8oT1XLGFa9aINm9Ypn/xhNh/mPLpK2bziPIxRURsAGrs8TAfb23JL7HXDcmpXFgMLd8R6gmltVbBbHIg==';
+const SDK_ADAPTER_VERSION = '3.7.63';
+const SDK_ADAPTER_INTEGRITY = 'sha512-5BiV1P0J1NMVdgjqxqULfM+zGrTjHBuWm1amKZWba4yW6C3t10VlhIlj/A+4YKbKqvyZe8gXgUwW+VrYDbVQrQ==';
 const SDK_ADAPTER_TARBALL = `https://registry.npmjs.org/@getmarrow/sdk/-/sdk-${SDK_ADAPTER_VERSION}.tgz`;
 const MCP_PACKAGE_SPEC = `@getmarrow/mcp@${MCP_ADAPTER_VERSION}`;
 const ADAPTER_PROVENANCE = Object.freeze({
@@ -23,7 +23,7 @@ const ADAPTER_PROVENANCE = Object.freeze({
     version: MCP_ADAPTER_VERSION,
     source_sha: MCP_ADAPTER_SOURCE_SHA,
     integrity: MCP_ADAPTER_INTEGRITY,
-    integrity_state: 'sealed_local_candidate',
+    integrity_state: 'verified_npm_registry_metadata',
   }),
   sdk: Object.freeze({
     package: '@getmarrow/sdk',
@@ -68,6 +68,13 @@ function compareMcpVersions(left, right) {
   return 0;
 }
 
+function declaredStableSdkLowerBound(spec) {
+  if (typeof spec !== 'string') return null;
+  const match = spec.trim().match(/^(v|\^|~|>=|>)?(\d{1,6}\.\d{1,6}\.\d{1,9})$/);
+  if (!match || !parsedStableMcpVersion(match[2])) return null;
+  return { version: match[2], exclusive: match[1] === '>' };
+}
+
 function compatibleMcpTargetVersion(value) {
   const candidate = parsedStableMcpVersion(value);
   const sealed = parsedStableMcpVersion(MCP_ADAPTER_VERSION);
@@ -2031,7 +2038,9 @@ function activationProfile(detection, plan, changes, client) {
       ? 'Restart Grok, inspect the installed global hooks with /hooks, and confirm they are enabled. Configuration remains client-self-reported and does not verify observed coverage.'
       : null
     : capabilityLevel === 'sdk_passive_runtime' && !sdkDependency.present
-    ? `${sdkDependency.install_command} && npx @getmarrow/install --repair`
+    ? sdkDependency.install_command
+      ? `${sdkDependency.install_command} && npx @getmarrow/install --repair`
+      : sdkDependency.warning
     : capabilityLevel === 'governed_wrapper'
     ? `npx @getmarrow/install run --agent <agent-id> -- ${client}`
     : client === 'cline' && clineConflicts.length > 0
@@ -2150,10 +2159,12 @@ function inspectSdkDependency(detection) {
     || objectTargetsSdk(packageJson.resolutions)
     || objectTargetsSdk(packageJson.pnpm?.overrides);
   let lockVerified = false;
+  let lockedVersion = null;
   try {
     const lock = JSON.parse(safeRead(path.join(detection.root, 'package-lock.json')) || '{}');
     const rootLock = lock?.packages?.[''];
     const lockedSdk = lock?.packages?.['node_modules/@getmarrow/sdk'];
+    lockedVersion = typeof lockedSdk?.version === 'string' ? lockedSdk.version : null;
     const lockedDeclaration = [
       rootLock?.dependencies,
       rootLock?.devDependencies,
@@ -2183,9 +2194,16 @@ function inspectSdkDependency(detection) {
     installedVersion = null;
     installedName = null;
   }
-  const declarationTrusted = typeof declaredSpec === 'string'
-    && declaredSpec.trim().length > 0
-    && /^[v0-9xX*<>=~^|.\s-]+$/.test(declaredSpec.trim());
+  const declaredLowerBound = declaredStableSdkLowerBound(declaredSpec);
+  const declarationTrusted = declaredLowerBound !== null;
+  const unsupportedDeclaration = declaredSpec !== null && !declarationTrusted;
+  const declaredComparison = declaredLowerBound
+    ? compareMcpVersions(declaredLowerBound.version, SDK_ADAPTER_VERSION) : null;
+  const declaredAhead = declaredComparison !== null
+    && (declaredComparison > 0 || (declaredLowerBound.exclusive && declaredComparison === 0));
+  const aheadVersions = [installedVersion, lockedVersion]
+    .filter((version) => compareMcpVersions(version, SDK_ADAPTER_VERSION) > 0);
+  const aheadUnverified = aheadVersions.length > 0 || declaredAhead;
   const present = declarationTrusted
     && !overrideDetected
     && lockVerified
@@ -2201,8 +2219,15 @@ function inspectSdkDependency(detection) {
     lock_verified: lockVerified,
     installed_name: installedName,
     installed_version: installedVersion,
+    ahead_unverified: aheadUnverified,
     expected_version: SDK_ADAPTER_VERSION,
-    install_command: present ? null : `npm install @getmarrow/sdk@${SDK_ADAPTER_VERSION}`,
+    install_command: present || aheadUnverified || unsupportedDeclaration
+      ? null : `npm install @getmarrow/sdk@${SDK_ADAPTER_VERSION}`,
+    ...(aheadUnverified ? {
+      warning: 'A newer SDK version is configured or installed. Preserve it and verify its exact version and integrity against the official npm registry before changing it.',
+    } : unsupportedDeclaration ? {
+      warning: 'The configured SDK version range is unsupported or ambiguous. Preserve it and verify the intended version against the official npm registry before changing it.',
+    } : {}),
   };
 }
 
@@ -3145,7 +3170,7 @@ function printReport(report) {
 
   if (report.sdkDependency?.required) {
     process.stdout.write('\nSDK dependency:\n');
-    process.stdout.write(`- @getmarrow/sdk: ${report.sdkDependency.present ? 'present' : 'missing'}\n`);
+    process.stdout.write(`- @getmarrow/sdk: ${report.sdkDependency.present ? 'present' : report.sdkDependency.ahead_unverified ? 'newer version requires verification' : 'missing'}\n`);
     if (report.sdkDependency.install_command) process.stdout.write(`- exact fix: ${report.sdkDependency.install_command}\n`);
     if (report.sdkDependency.warning) process.stdout.write(`- warning: ${report.sdkDependency.warning}\n`);
   }