@nanobpm/nano-workforce 0.151.1 → 0.153.0

package/.github/workflows/ci.yml

@@ -92,6 +92,29 @@ jobs:
   # blocker, and a self-proving canary asserts the oracle's red path genuinely fires so the gate can
   # never rot into a vacuous green while the corpus is parked. Hermetic (in-process wasm engine, no
   # sockets), so it runs on every PR/push as its own job.
+  # install.sh onboarding script (issues #576 + #583): POSIX-sh cleanliness + a
+  # hermetic smoke test asserting the emitted command sequence (phase 1) and the
+  # phase-2 console call flow (dry-run + a stubbed-console live run). The script
+  # is served from `main` for `curl … | sh`, so a broken change is live the
+  # instant it merges — this gate keeps that surface honest.
+  install-script:
+    name: install.sh (shellcheck + dry-run smoke)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: shellcheck (POSIX sh)
+        run: shellcheck -s sh install.sh test/install-smoke.sh
+
+      - name: Smoke test (dry-run sequence + stubbed-console phase 2)
+        run: sh test/install-smoke.sh
+
   derivation-parity:
     name: derivation parity (nwf corpus regression guard)
     runs-on: ubuntu-latest

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [0.153.0](https://github.com/nanobpm/nano-workforce/compare/v0.152.0...v0.153.0) (2026-08-29)
+
+### Features
+
+* **onboarding:** install-script phase 2 — install, scaffold, configure & run the Workforce app ([#598](https://github.com/nanobpm/nano-workforce/issues/598)) ([e86f9ca](https://github.com/nanobpm/nano-workforce/commit/e86f9ca292998481e1fd194859832e9040bf0b51)), closes [nanobpm/nano-workforce#583](https://github.com/nanobpm/nano-workforce/issues/583) [Magikcraft/nano-bpm#1036](https://github.com/Magikcraft/nano-bpm/issues/1036) [#583](https://github.com/nanobpm/nano-workforce/issues/583)
+
+## [0.152.0](https://github.com/nanobpm/nano-workforce/compare/v0.151.1...v0.152.0) (2026-08-28)
+
+### Features
+
+* **onboarding:** one-command install script — hire your coding harnesses and bring up a Nano workforce ([#597](https://github.com/nanobpm/nano-workforce/issues/597)) ([73b840b](https://github.com/nanobpm/nano-workforce/commit/73b840bbb3c602e83d4cac6990e69d0b77ed0344)), closes [jwulf/c8ctl-plugin-nano#117](https://github.com/jwulf/c8ctl-plugin-nano/issues/117) [#576](https://github.com/nanobpm/nano-workforce/issues/576)
+
 ## [0.151.1](https://github.com/nanobpm/nano-workforce/compare/v0.151.0...v0.151.1) (2026-08-28)
 
 ### Bug Fixes

package/README.md

@@ -79,6 +79,62 @@ You can also run Nano Workforce directly, outside Studio, against a running Nano
 engine. This is the second-class path — no left-rail integration or update UI — but
 it's the same app and the same behaviour.
 
+### Install with one command
+
+If you already have one or more coding-agent CLIs installed (`kimi`, `qwen`,
+`copilot`, `claude`, `pi`), one command takes you from there to a **running Nano
+Workforce**: engine, a supervised workforce of hired agents, **and the Nano
+Workforce app itself, installed, configured, and running**:
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/nanobpm/nano-workforce/main/install.sh | sh
+```
+
+**Phase 1 — engine + workforce.** It installs `@camunda8/cli` and the
+`c8ctl-plugin-nano` plugin, installs shell completion, detects which of your
+harnesses are installed, lets you multi-select which to hire (with a model and an
+instance count each), hires each with `--rank senior --protocol acp --permission
+yolo`, composes a declarative **workforce manifest** (`c8 nano workforce add`),
+and brings it up (`c8 nano start` then `c8 nano workforce start`).
+
+**Phase 2 — the app.** It then talks to the nano console the engine brought up to
+install the `@nanobpm/nano-workforce` extension, scaffold a **Workforce** project
+from the `nano-workforce` template, write its `ProjectConfig.env` (including
+`NANO_WORKFORCE_BASE_URL` set to the console origin + `/console/app-view/Workforce`
+so the fleet's hooks resolve through the proxy — see [Fleet
+networking](#fleet-networking-remote-workers)), and run it. It confirms readiness
+by polling the app's own `GET /app/api/version` through the proxy, then prints the
+cockpit URL, the Tasks inbox, the Delivery Graphs page, and the `/app/api/agent` +
+`/app/mcp` pointers. Pass `--skip-app` to stop after phase 1.
+
+> ⚠️ The hired agents run **unattended** with `--permission yolo` — full tool
+> access (shell, file writes, network) as your user on this host. The script shows
+> a confirmation summary before it hires anything (and before it installs the app);
+> pass `--yes` to skip both.
+
+Prompts read from `/dev/tty`, so the `curl … | sh` pipe works interactively. It is
+also fully scriptable and safe to re-run (it converges rather than duplicating — an
+existing project is configured and run, never re-scaffolded):
+
+```sh
+# Non-interactive (CI / re-provisioning); repeatable --harness <name>[:<model>][:<instances>]
+curl -fsSL https://raw.githubusercontent.com/nanobpm/nano-workforce/main/install.sh | sh -s -- --harness copilot:gpt-5.4:5 --harness claude:opus:1 --yes
+
+# Name the app's project, or stop after phase 1 (engine + workforce only)
+curl -fsSL .../install.sh | sh -s -- --harness copilot:gpt-5.4:5 --yes --project-name Workforce
+curl -fsSL .../install.sh | sh -s -- --harness copilot:gpt-5.4:5 --yes --skip-app
+
+# Preview every command (including the console API calls) without changing anything
+curl -fsSL https://raw.githubusercontent.com/nanobpm/nano-workforce/main/install.sh | sh -s -- --harness copilot:gpt-5.4:1 --dry-run
+```
+
+`qwen` must always be given an explicit model (it stalls without one). With no
+controlling terminal and no `--harness`, the script exits with usage rather than
+hanging. Phase 2 needs the engine's console reachable (the default `c8 nano start`
+`studio` mode); an unreachable console is reported as an early failure that changes
+nothing. Because it is served from `main`, a merged change to `install.sh` is live
+immediately.
+
 ### Prerequisites
 
 - A running **Nano gateway/engine** (default `http://localhost:8080`) — what the app