@ours.network/install 0.17.0-nightly.16 → 0.17.0-nightly.17

package/lib/components.mjs

@@ -22,12 +22,13 @@ import { pkgSpec, resolveChannel } from './logic.mjs';
 // effects.installedVersion('@ours.network/mcp@nightly') return null forever,
 // which fails the cowork version floor CLOSED and blanks the version column —
 // a silent regression that looks like "cowork is too old".
-// `required` is not a stronger default — it is the absence of a choice. The MCP
-// package IS the daemon now (the daemon phase installs and starts it), so an
-// operator who declined it would have no daemon at all, which is not a decision
-// anyone means to make. Declining has to be impossible rather than discouraged.
+// `required` is not a stronger default — it is the absence of a choice. The
+// daemon is the ours-sdk CLI and this package is the MCP server every harness
+// speaks to it through, so an operator who declined it would have a daemon no
+// harness can reach — which is not a decision anyone means to make. Declining
+// has to be impossible rather than discouraged.
 export const COMPONENTS = [
-  { key: 'mcp', label: 'ours daemon + MCP server', pkg: '@ours.network/mcp', specKey: 'mcp', default: true, required: true },
+  { key: 'mcp', label: 'MCP server for your harness', pkg: '@ours.network/mcp', specKey: 'mcp', default: true, required: true },
   { key: 'tg', label: 'Telegram connector', pkg: '@ours.network/tg-connector', specKey: 'tg-connector', default: false },
   { key: 'cowork', label: 'cowork', pkg: '@ours.network/cowork', specKey: 'cowork', default: false },
 ];

package/lib/journal.mjs

@@ -71,7 +71,10 @@ export function configJournal(effects, { dryRun = false } = {}) {
       for (const entry of entries.slice().reverse()) {
         try {
           effects.restore(entry.path, entry.snapshot);
-          restored.push({ path: entry.path, existed: entry.snapshot?.exists !== false });
+          // A write that RETURNED is not a file that HOLDS. Read the bytes back.
+          const mismatch = verifyRestored(effects, entry);
+          if (mismatch) failed.push({ path: entry.path, reason: mismatch });
+          else restored.push({ path: entry.path, existed: entry.snapshot?.exists !== false });
         } catch (error) {
           failed.push({ path: entry.path, reason: error instanceof Error ? error.message : String(error) });
         }
@@ -82,6 +85,48 @@ export function configJournal(effects, { dryRun = false } = {}) {
   };
 }
 
+/**
+ * Did the restore actually take? Returns null when it did, or the reason it did not.
+ *
+ * WHY THIS EXISTS. `restore` returning is evidence that a call completed, not that
+ * a file holds the bytes it was given. A full disk, a read-only mount, a rename
+ * that lands somewhere else, an editor holding the inode — each of those can let
+ * the write return and leave the old contents in place. Reporting on the call
+ * rather than on the state is how a rollback comes to LIE, and a rollback that
+ * lies is worse than one that admits it failed: the operator is told the machine
+ * is back where it was and stops looking.
+ *
+ * The read-back seam is `effects.snapshot`, the same one used to record the bytes
+ * in the first place — it already returns exactly the shape being compared, so
+ * this needs no second seam and no second notion of what a file's state is.
+ *
+ * Its own failure is a mismatch, not an exception: if the file cannot be read
+ * after being written, that is precisely the case this check exists to catch.
+ */
+function verifyRestored(effects, entry) {
+  const expected = entry.snapshot;
+  let actual;
+  try {
+    actual = effects.snapshot(entry.path);
+  } catch (error) {
+    return `restored, but the file could not be read back to confirm it (${error instanceof Error ? error.message : String(error)})`;
+  }
+  const shouldExist = expected?.exists !== false;
+  if (!shouldExist) {
+    return actual?.exists ? 'this run created it and the removal did not take — the file is still there' : null;
+  }
+  if (!actual?.exists) return 'the restore reported success but the file is not there';
+  if (actual.text !== expected.text) return 'the restore reported success but the bytes on disk are not the previous ones';
+  // Bytes first, permissions second: the contents are back either way, so this
+  // must not be reported as "could not restore the config".
+  if (expected.mode !== undefined && actual.mode !== undefined && actual.mode !== expected.mode) {
+    return `contents restored, but the permissions are ${fmtMode(actual.mode)} and were ${fmtMode(expected.mode)} — check them before re-running`;
+  }
+  return null;
+}
+
+const fmtMode = (mode) => `0${(mode & 0o777).toString(8).padStart(3, '0')}`;
+
 /**
  * The report, and it is half the feature.
  *

package/lib/orchestrate-uninstall.mjs

@@ -330,6 +330,9 @@ export async function runPluginPhase(plugins, { args, effects, selection = null
         effects.out(warn(`${block.path}: ${stripped.reason}. Remove it by hand.`));
         continue;
       }
+      // Deliberately NOT journalled: this write IS the state its bytes describe, so
+      // nothing behind it can fail and leave them untrue. Adding one would undo a
+      // completed removal.
       await perform(effects, args.dryRun, `remove the ours managed block from ${block.path} (file kept)`, () => effects.writeText(block.path, stripped.text));
     }
     for (const dir of harness.dirs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "0.17.0-nightly.16",
+  "version": "0.17.0-nightly.17",
   "private": false,
   "description": "The unified ours.network stack installer (ours-install): one guided ~3-minute flow for ours core (the daemon) + the harness plugins (Claude Code / Codex) + ours-fleet + the Telegram connector, then a single copy-paste hand-off prompt. Self-contained (Node built-ins only); run as `ours-install` or via curl|bash (install.sh).",
   "type": "module",