@getmarrow/install 0.1.62 → 0.1.64

package/README.md

@@ -101,7 +101,15 @@ npx @getmarrow/install controller stop
 
 Persistent controller lifecycle is currently Linux-only. On macOS or Windows, activation still writes supported configuration and verifies one server-side install self-test without certifying that hooks continuously ran; run `npx @getmarrow/install sidecar` under an owner-managed service and pass `--no-controller`. The controller does not silently upgrade packages, change governance policy, rotate credentials, or modify unrelated project configuration.
 
-## What's New in v0.1.62
+## What's New in v0.1.64
+
+v0.1.64 pins MCP `3.9.96` (source `031c944936271fd6e8768ad2619ee0430b68e2c7`, packed integrity `sha512-kuBpuWaWAvusS+FbXXFw1fOEGja4T8ahj/vkmXTd/CWjz0t6teT6g9c1HfJhAK6KLzesZtcvUdZLn6pBErKP9Q==`) while keeping SDK `3.7.64` unchanged. The embedded MCP pin requires this installer patch to deliver the native pre-action hook permit fix: protected actions are no longer denied after an allowing runtime gate, and unprotected actions stop at the gate without creating a decision or permit. Policy decisions, proof requirements and fail-closed behavior are unchanged. `activate` and `doctor --self-test` now resend the identical self-test decision and commit with a stable `Idempotency-Key` after a transient 429/502/503/504 or a durable pending acknowledgement (at most three attempts, about one second apart), instead of failing with "self-test did not return decision_id"; client errors still fail immediately, and a final failure names the last state. Restart the owning harness, review hook trust and run `doctor --self-test` after updating. Package publication and registry integrity verification must precede claiming these candidate pins are publicly available.
+
+### Previous release: v0.1.63
+
+v0.1.63 pins MCP `3.9.95` (source `967b17735b26534b7dc0536ec93c481a5dc07297`, packed integrity `sha512-Sw8RIyxHkjxllwwh+9za5ItoM9X0NwN4R8+Qdd7nvOuU6qAm9LotIC09GOJDim3o9jc9m8yTqxKciroRTS12EQ==`) while keeping SDK `3.7.64` unchanged. The embedded MCP pin requires this installer patch to deliver the stdin usage-loss correction and safe bounded native Codex capture. Supported transcript schema is Codex `0.157.1`; capture covers only the latest proven model-call delta. Unknown versions, missing model/turn or billing metadata, unsafe paths and unproven subagent bindings remain incomplete or unpriced. Capture does not prove a baseline, complete overhead or savings. Restart the owning harness and run `doctor --self-test` after updating. Package publication and registry integrity verification must precede claiming these candidate pins are publicly available.
+
+### Previous release: v0.1.62
 
 v0.1.62 delivers the model-cost capture corrections in MCP `3.9.94` (source `9456bc63de4cc92f16726d996695516be9395f26`, packed integrity `sha512-gEQejUWkcuKd1p930TLsWCSMM4rjmr/Wzz0++qa69B6hj/e64lMdT9xO+jZP8+yl4WLKgcfo0raHANllUe96/A==`) and SDK `3.7.64` (source `40b68dee609e9351fa6c79aee629fc88869a3b4f`, packed integrity `sha512-8qJj/8ouHEz1NnZkmujtFxUm/fWldqR/rHv62/sqabaxT0H90xCCHxodLOkV0SVxDscAtnahioZakqkeGNUwyA==`). Published installer0.1.61 pins older bytes and cannot deliver these fixes. Only observed usage with sufficient host, model, token and pricing evidence becomes calculated cost; unobservable host usage, unsupported streams and mixed cache TTL writes stay incomplete. No baseline or net savings is invented. Update once, restart the owning harness and run `doctor --self-test` to verify actual active versions.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.62",
+  "version": "0.1.64",
   "description": "Universal installer and governed runner for Marrow agent fleets.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/installer.js

@@ -11,9 +11,9 @@ const { evidence: localControlEvidence } = require('./control-state');
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
-const MCP_ADAPTER_VERSION = '3.9.94';
-const MCP_ADAPTER_SOURCE_SHA = '9456bc63de4cc92f16726d996695516be9395f26';
-const MCP_ADAPTER_INTEGRITY = 'sha512-gEQejUWkcuKd1p930TLsWCSMM4rjmr/Wzz0++qa69B6hj/e64lMdT9xO+jZP8+yl4WLKgcfo0raHANllUe96/A==';
+const MCP_ADAPTER_VERSION = '3.9.96';
+const MCP_ADAPTER_SOURCE_SHA = '031c944936271fd6e8768ad2619ee0430b68e2c7';
+const MCP_ADAPTER_INTEGRITY = 'sha512-kuBpuWaWAvusS+FbXXFw1fOEGja4T8ahj/vkmXTd/CWjz0t6teT6g9c1HfJhAK6KLzesZtcvUdZLn6pBErKP9Q==';
 const SDK_ADAPTER_VERSION = '3.7.64';
 const SDK_ADAPTER_INTEGRITY = 'sha512-8qJj/8ouHEz1NnZkmujtFxUm/fWldqR/rHv62/sqabaxT0H90xCCHxodLOkV0SVxDscAtnahioZakqkeGNUwyA==';
 const SDK_ADAPTER_TARBALL = `https://registry.npmjs.org/@getmarrow/sdk/-/sdk-${SDK_ADAPTER_VERSION}.tgz`;
@@ -2684,6 +2684,60 @@ async function requestJson(url, options) {
   return json.data || json;
 }
 
+const SELF_TEST_WRITE_ATTEMPTS = 3;
+const SELF_TEST_RETRY_DELAY_MS = 1_000;
+const SELF_TEST_MAX_RETRY_DELAY_MS = 2_000;
+const SELF_TEST_TRANSIENT_STATUSES = new Set([429, 502, 503, 504]);
+
+function selfTestRetryDelayMs(response, data, override) {
+  if (Number.isFinite(override) && override >= 0) return override;
+  const hinted = Number(data?.retry_after_ms);
+  const header = Number(response?.headers?.get?.('retry-after')) * 1000;
+  const delay = hinted > 0 ? hinted : header > 0 ? header : SELF_TEST_RETRY_DELAY_MS;
+  return Math.min(delay, SELF_TEST_MAX_RETRY_DELAY_MS);
+}
+
+// A first write can meet a transient 5xx, or a durable "pending" acknowledgement
+// that has no decision id yet. Marrow's contract is to resend the identical request
+// with the same Idempotency-Key, so a retry can never create a second record.
+async function selfTestWrite(url, options, { idempotencyKey, complete, retryDelayMs }) {
+  let lastState = 'no response';
+  for (let attempt = 1; attempt <= SELF_TEST_WRITE_ATTEMPTS; attempt += 1) {
+    const res = await fetch(url, { ...options, headers: { ...options.headers, 'idempotency-key': idempotencyKey } });
+    const text = await res.text();
+    let json = {};
+    try {
+      json = text ? JSON.parse(text) : {};
+    } catch {
+      json = { raw: text.slice(0, 500) };
+    }
+    const data = json.data || json;
+    if (res.ok) {
+      const result = complete(data);
+      if (result !== undefined) return result;
+      const pending = data?.retryable === true && data?.committed === false && data?.idempotency_key === idempotencyKey;
+      if (!pending) return undefined;
+      lastState = 'pending';
+    } else if (SELF_TEST_TRANSIENT_STATUSES.has(res.status)) {
+      const reason = String(json.error || json.message || '').slice(0, 200);
+      lastState = reason ? `HTTP ${res.status}: ${reason}` : `HTTP ${res.status}`;
+    } else {
+      throw new Error(String(json.error || json.message || `HTTP ${res.status}`));
+    }
+    if (attempt < SELF_TEST_WRITE_ATTEMPTS) {
+      await new Promise((resolve) => setTimeout(resolve, selfTestRetryDelayMs(res, data, retryDelayMs)));
+    }
+  }
+  return { failed: lastState };
+}
+
+function selfTestDecisionId(data) {
+  const decisionId = data?.decision_id || data?.decisionId;
+  if (typeof decisionId !== 'string' || !decisionId) return undefined;
+  const pending = data.retryable === true && data.committed === false;
+  return !pending || data.decision_state === 'created' ? decisionId : undefined;
+}
+
 function runLoopGuardSelfTest(options = {}) {
   const target = executableMcpTarget(options);
   const isolatedHome = fs.mkdtempSync(path.join(os.tmpdir(), 'marrow-install-loop-guard-'));
@@ -2782,7 +2836,8 @@ async function runSelfTest(options) {
   if (options.agentId) headers['x-marrow-agent-id'] = options.agentId;
 
   const baseUrl = options.baseUrl.replace(/\/+$/, '');
-  const think = await requestJson(`${baseUrl}/v1/agent/think`, {
+  const selfTestKey = `install-self-test:${crypto.randomUUID()}`;
+  const think = await selfTestWrite(`${baseUrl}/v1/agent/think`, {
     method: 'POST',
     headers,
     body: JSON.stringify({
@@ -2794,12 +2849,18 @@ async function runSelfTest(options) {
         user_intent: 'operate',
       },
     }),
+  }, {
+    idempotencyKey: `${selfTestKey}:think`,
+    complete: (data) => selfTestDecisionId(data),
+    retryDelayMs: options.selfTestRetryDelayMs,
   });
 
-  const decisionId = think.decision_id || think.decisionId;
-  if (!decisionId) throw new Error('self-test did not return decision_id');
+  const decisionId = typeof think === 'string' ? think : undefined;
+  if (!decisionId) {
+    throw new Error(`self-test did not return decision_id${think?.failed ? ` after ${SELF_TEST_WRITE_ATTEMPTS} attempts (last: ${think.failed})` : ''}`);
+  }
 
-  await requestJson(`${baseUrl}/v1/agent/commit`, {
+  const commit = await selfTestWrite(`${baseUrl}/v1/agent/commit`, {
     method: 'POST',
     headers,
     body: JSON.stringify({
@@ -2807,7 +2868,14 @@ async function runSelfTest(options) {
       success: true,
       outcome: 'Marrow passive installer self-test completed successfully',
     }),
+  }, {
+    idempotencyKey: `${selfTestKey}:commit`,
+    complete: (data) => (data?.retryable === true && data?.committed === false ? undefined : data),
+    retryDelayMs: options.selfTestRetryDelayMs,
   });
+  if (commit?.failed) {
+    throw new Error(`self-test commit did not complete after ${SELF_TEST_WRITE_ATTEMPTS} attempts (last: ${commit.failed})`);
+  }
 
   const status = await requestJson(`${baseUrl}/v1/agent/status`, { headers });
   const context = await requestJson(`${baseUrl}/v1/agent/context`, { headers })