@huynle/hub 0.8.6 → 0.8.7

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.8.7
+
+The one-liner now installs OpenCode on Windows when a machine does not have it yet (the reviewed OpenCode 2.2.0 pin for
+windows-x64 is in the signed release manifest). No migration is needed.
+
+### Machine setup
+- **hubctl installs OpenCode on Windows** too: the reviewed pin for OpenCode 2.2.0 `windows-x64`
+  (`opencode-windows-x64-baseline.zip`) is in the signed release manifest, so a Windows machine without OpenCode gets
+  it from the one-liner, like macOS and Linux.
+
 ## 0.8.6
 
 A Windows fix release: OpenCode with the hub plugin no longer flashes a console window every few seconds on Windows,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Hub: a harness-agnostic central hub your AI agent harnesses connect to (OpenCode first). Follow, steer and stop sessions from your phone or browser, with notifications, optional hands-free Voice and a self-hostable server.",
   "license": "MIT",
   "author": "Huy Le",

package/packages/claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-claude-code",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "The Claude Code hooks spoke: per-user daemon, hook bridge, plugin dir, `hub claude` wrapper and daemon-backed MCP server (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/cli/dist/hub-cli.js

@@ -7,7 +7,7 @@ import { createInterface } from "readline";
 // packages/cli/package.json
 var package_default = {
   name: "@huynle/hub-cli",
-  version: "0.8.6",
+  version: "0.8.7",
   private: true,
   description: "The hub CLI (`hub` / `hubctl`) for agents and scripts (internal; bundled into @huynle/hub, not published on its own).",
   license: "MIT",
@@ -8945,7 +8945,7 @@ import { arch as osArch, platform as osPlatform } from "node:os";
 // packages/node/package.json
 var package_default2 = {
   name: "@huynle/hub-node",
-  version: "0.8.6",
+  version: "0.8.7",
   private: true,
   description: "`hub node`: the per-machine daemon that prepares, collects and cleans up launch workspaces (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -10037,7 +10037,7 @@ import path14 from "node:path";
 // packages/runtime-openshell/package.json
 var package_default3 = {
   name: "@huynle/hub-runtime-openshell",
-  version: "0.8.6",
+  version: "0.8.7",
   private: true,
   description: "The `openshell` runtime of `hub node`: launches in NVIDIA OpenShell sandboxes, driven through the openshell CLI (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -13721,7 +13721,7 @@ import path23 from "node:path";
 // packages/claude-code/package.json
 var package_default4 = {
   name: "@huynle/hub-claude-code",
-  version: "0.8.6",
+  version: "0.8.7",
   private: true,
   description: "The Claude Code hooks spoke: per-user daemon, hook bridge, plugin dir, `hub claude` wrapper and daemon-backed MCP server (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -14010,7 +14010,7 @@ import path26 from "node:path";
 // packages/preset/package.json
 var package_default5 = {
   name: "@huynle/hub-preset",
-  version: "0.8.6",
+  version: "0.8.7",
   private: true,
   description: "The preset spoke: drives a harness without a spoke of its own through a terminal pane (tmux), described by a data-only preset; official presets in presets/ (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -14535,7 +14535,7 @@ import { openSync as openSync6, closeSync as closeSync6, readFileSync as readFil
 // packages/codex/package.json
 var package_default6 = {
   name: "@huynle/hub-codex",
-  version: "0.8.6",
+  version: "0.8.7",
   private: true,
   description: "The Codex app-server spoke: attaches to Codex's app-server (its own over stdio, and the shared daemon's socket when present), and the `hub codex` wrapper (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-cli",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "The hub CLI (`hub` / `hubctl`) for agents and scripts (internal; bundled into @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/cli/src/bootstrap/adapters/opencode/README.md

@@ -88,8 +88,10 @@ See `../../PHASE2-CONTRACT.md` for the shared rules. For this adapter:
 - **Release assets (v2.2.0).** `opencode-windows-x64.zip` (118 610 002 bytes, needs AVX2),
   `opencode-windows-x64-baseline.zip` (118 610 005 bytes) and `opencode-windows-arm64.zip`. All three are listed in
   the release's `SHA256SUMS` and in the API's `assets[].digest`.
-- **Pin.** The windows-x64 pin is prepared, not reviewed, in `../../release/harness-pins.pending.json`. Only the dev
-  release includes it (`../../release/README.md`).
+- **Pin.** The windows-x64 pin (`opencode-windows-x64-baseline.zip`) is reviewed in `../../release/harness-pins.json`
+  since 2026-11-06 (checks re-run on a Windows host: release by github-actions[bot], fresh download size and sha256
+  equal to `SHA256SUMS` and `assets[].digest`, one member `opencode.exe`; `evidence: []`, the release's only
+  attestation is an in-toto release record, not a signature hub checks).
 - **MCP authority.** `user-bin:hubctl.exe`, the real executable (`authorityFor`). The `hub` alias is a cmd shim
   (`user-bin:hub.cmd`) on Windows, and a `.cmd` cannot be the MCP command because OpenCode starts it without a
   shell. So `authority: user-bin:hub` is refused on Windows. `.exe` names are refused on POSIX targets.

package/packages/cli/src/bootstrap/release/harness-pins.json

@@ -89,6 +89,28 @@
           "evidence-listed"
         ]
       }
+    },
+    {
+      "pin": {
+        "harness": "opencode",
+        "version": "2.2.0",
+        "target": "windows-x64",
+        "url": "https://github.com/anomalyco/opencode/releases/download/v2.2.0/opencode-windows-x64-baseline.zip",
+        "file": "opencode-windows-x64-baseline.zip",
+        "size": 118610005,
+        "sha256": "sha256:810fe13f6d85c6121e8ab0dd09933ababa2d52dccce9f3bc9ec70de5a9ae126e",
+        "evidence": [],
+        "minimumVersion": "2.0.0"
+      },
+      "review": {
+        "by": "huynle",
+        "on": "2026-11-06",
+        "checked": [
+          "upstream-release",
+          "digest-redownloaded",
+          "evidence-listed"
+        ]
+      }
     }
   ]
 }

package/packages/cli/src/bootstrap/release/harness-pins.pending.json

@@ -1,24 +1,5 @@
 {
   "schema": "hub.harness-pin-pending",
   "version": 1,
-  "pins": [
-    {
-      "pin": {
-        "harness": "opencode",
-        "version": "2.2.0",
-        "target": "windows-x64",
-        "url": "https://github.com/anomalyco/opencode/releases/download/v2.2.0/opencode-windows-x64-baseline.zip",
-        "file": "opencode-windows-x64-baseline.zip",
-        "size": 118610005,
-        "sha256": "sha256:810fe13f6d85c6121e8ab0dd09933ababa2d52dccce9f3bc9ec70de5a9ae126e",
-        "evidence": [],
-        "minimumVersion": "2.0.0"
-      },
-      "prepared": {
-        "by": "agent (Phase 2 release workstream; NOT a review)",
-        "on": "2026-11-05",
-        "note": "UNREVIEWED. The author downloaded the asset (curl -fsSL), measured 118610005 bytes and sha256 810fe13f…126e, which equal the release's SHA256SUMS line and the GitHub API assets[].digest for tag v2.2.0 (published 2026-10-27 by github-actions[bot] from dev). unzip -Zl lists exactly one member, opencode.exe (253303688 bytes, deflate, FAT host). The owner must redo every check of release/README.md themselves and move this entry into harness-pins.json with their own review record; until then only the dev release includes it."
-      }
-    }
-  ]
+  "pins": []
 }

package/packages/codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-codex",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "The Codex app-server spoke: attaches to Codex's app-server (its own over stdio, and the shared daemon's socket when present), and the `hub codex` wrapper (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-node",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "`hub node`: the per-machine daemon that prepares, collects and cleans up launch workspaces (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/preset/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-preset",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "The preset spoke: drives a harness without a spoke of its own through a terminal pane (tmux), described by a data-only preset; official presets in presets/ (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-protocol",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "Hub ↔ spoke wire protocol (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/runtime-openshell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-runtime-openshell",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "The `openshell` runtime of `hub node`: launches in NVIDIA OpenShell sandboxes, driven through the openshell CLI (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/runtime-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-runtime-sdk",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "The Runtime interface `hub node` runtimes implement (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-sdk",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "Typed client for the hub's /api/agent (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",

package/packages/spoke-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-spoke-sdk",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": true,
   "description": "Harness-neutral spoke building blocks: hub connection, enrollment, tokens, idempotent deliver, prompt references, HarnessSpoke (internal; shipped inside @huynle/hub, not published on its own).",
   "license": "MIT",