@ours.network/cowork 1.0.7 → 1.0.8

package/dist/cli.js

@@ -5719,7 +5719,11 @@ function serviceEnvironment(config) {
   };
 }
 function validateServiceConfiguration(config) {
-  const values = { cowork_cli: SELF, ...serviceEnvironment(config) };
+  const values = {
+    node_executable: process.execPath,
+    cowork_cli: SELF,
+    ...serviceEnvironment(config)
+  };
   for (const [label, value] of Object.entries(values)) {
     if (/[\x00-\x1f\x7f-\x9f]/.test(value)) {
       throw new CliError(EXIT.invalidState, "invalid_state", `${label} contains a control character unsafe for a service definition`);
@@ -5731,7 +5735,7 @@ function systemdValueQuote(value) {
 }
 function systemdExecutableQuote(value) {
   if (value.includes('"') || /[\0\n\r]/.test(value)) {
-    throw new CliError(EXIT.invalidState, "invalid_state", "cowork CLI path contains a character unsupported by systemd ExecStart");
+    throw new CliError(EXIT.invalidState, "invalid_state", "node_executable contains a character unsupported by systemd ExecStart");
   }
   return `"${value.replaceAll("\\", "\\\\").replaceAll("%", "%%")}"`;
 }
@@ -5761,7 +5765,7 @@ StartLimitIntervalSec=0
 
 [Service]
 Type=simple
-ExecStart=${systemdExecutableQuote(SELF)} serve
+ExecStart=${systemdExecutableQuote(process.execPath)} ${systemdValueQuote(SELF)} serve
 ${environment}
 Restart=on-failure
 RestartSec=5
@@ -5798,7 +5802,7 @@ function installLaunchd(config) {
 <plist version="1.0"><dict>
   <key>Label</key><string>${LAUNCHD_LABEL}</string>
   <key>ProgramArguments</key><array>
-    <string>${xml(SELF)}</string><string>serve</string>
+    <string>${xml(process.execPath)}</string><string>${xml(SELF)}</string><string>serve</string>
   </array>
   <key>EnvironmentVariables</key><dict>
 ${environment}

package/docs/09-service-management.md

@@ -7,8 +7,10 @@ ours-cowork install-service
 ours-cowork uninstall-service
 ```
 
-Linux uses `ours-cowork.service` under the systemd user directory. macOS uses the `network.ours.cowork` launchd agent. Both definitions execute the installed cowork CLI directly in `serve` mode and preserve the cowork state directory and optional REST port. They also preserve a non-secret SDK-standard `OURS_CONFIG`, `OURS_PORT`, or `OURS_STATE_DIR` selection present during installation. They never copy `OURS_API_TOKEN` or broker settings.
+Linux uses `ours-cowork.service` under the systemd user directory. macOS uses the `network.ours.cowork` launchd agent. Both definitions capture the installing process's absolute Node executable and the canonical installed cowork CLI path, then execute that pair in `serve` mode without relying on service-manager `PATH` lookup or the CLI's `#!/usr/bin/env node` shebang. They preserve the cowork state directory and optional REST port. They also preserve a non-secret SDK-standard `OURS_CONFIG`, `OURS_PORT`, or `OURS_STATE_DIR` selection present during installation. They never copy `OURS_API_TOKEN` or broker settings.
 
 Install and start the shared daemon's own service first with `ours daemon install-service --yes`. Cowork never manages that service. Both cowork definitions restart on failure and keep retrying at a fixed interval for as long as the failure lasts. The systemd unit sets `StartLimitIntervalSec=0` with `RestartSec=5`, so an unavailable shared daemon does not permanently exhaust the start limit. A clean cowork stop is still final. The launchd agent uses `KeepAlive` and retries on launchd's own interval.
 
 Installation rejects service values containing NUL, newline, carriage return, or other unsafe control characters before creating or replacing a definition. It then stops a manually detached cowork daemon through the authenticated control session before the service takes ownership. Uninstall first requires systemd to disable/stop the unit or launchd to unload the agent. If that operation fails, uninstall reports failure and retains the service definition for inspection or retry. After a successful unload, uninstall retains cowork configuration, room metadata and archives, and every identity in the shared daemon.
+
+Re-run `ours-cowork install-service` after relocating or replacing either the Node runtime or the installed package. Reinstallation replaces the managed definition with the current absolute paths and remains safe to repeat; an old definition cannot follow a removed version-manager runtime or package location by itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cowork",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Durable ours mission rooms on the shared ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",