@ours.network/install 1.1.1 → 1.2.0-nightly.1

package/assets/sources.json

@@ -0,0 +1,21 @@
+{
+  "sources": {
+    "sdk": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-sdk.git", "commit": "9cb51add34888e6ae2cc3b554c97362bb1ca2d33" },
+    "telegram": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-tg-connector.git", "commit": "81798b836b15ac4ba9b32ac180f94fb258a54a41" },
+    "cowork": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-cowork.git", "commit": "1e17f7666c1682a858101c98a8f371aac7b737e3" },
+    "messenger": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-messenger-server.git", "commit": "fc852e49eb3b43c077f59cf4919536be6f6d03b1" },
+    "fleet": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-fleet.git", "commit": "b8444a7aac2eb6148a3ab534e90308bfc76447d7" },
+    "mcp": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-mcp.git", "commit": "3d970d0cb7baf52351d5cd44dd59d4a2f705207b" }
+  },
+  "packages": {
+    "@ours.network/sdk": { "source": "sdk" },
+    "@ours.network/cli": { "source": "sdk" },
+    "@ours.network/tg-connector": { "source": "telegram" },
+    "@ours.network/cowork": { "source": "cowork" },
+    "@ours.network/messenger-server": { "source": "messenger" },
+    "@ours.network/fleet": { "source": "fleet" },
+    "@ours.network/mcp": { "source": "mcp" },
+    "@ours.network/codex": { "source": "mcp" },
+    "@ours.network/claude-code": { "source": "mcp" }
+  }
+}

package/install.sh

@@ -30,7 +30,8 @@
 #   OURS_INSTALL_DRY_RUN=1                   walk the whole flow WITHOUT installing/changing anything
 #                                            (prints exactly what it WOULD do — safe on any machine)
 #   OURS_NPM="npm"                           npm binary to use
-#   OURS_CONFIG=/path/config.json            daemon config file (default ~/.ours/config.json)
+#   OURS_CONFIG=/path/config.json            legacy daemon config or prepared private host profile;
+#                                            a complete host profile performs client-only setup
 #   OURS_INSTALLER_MJS=/path/install.mjs     run this Node installer directly (dev/testing)
 #   OURS_INSTALL_PKG=@ours.network/install   the package to install for the command (override for dev)
 set -euo pipefail

package/lib/build-transition.mjs

@@ -0,0 +1,56 @@
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { validateInstallation } from './plan.mjs';
+
+/** The caller holds the installation lock; installation.json owns retry state. */
+export async function serverBuildTransition(record, args, effects) {
+  validateInstallation(record, record.root);
+  const path = join(record.root, 'installation.json');
+  const save = transition => {
+    record = { ...record, buildTransition: transition };
+    validateInstallation(record, record.root);
+    effects.writeJson(path, JSON.stringify(record, null, 2) + '\n');
+  };
+  let transition = record.buildTransition;
+  if (!transition) {
+    const candidate = await effects.prepareServerBuild(record, args);
+    try {
+      await effects.checkServerBuild(record, candidate, !!args.compatible, args.operation);
+      transition = { operation: args.operation, candidate, compatible: !!args.compatible,
+        ...(args.sources ? { sourcePolicyHash: createHash('sha256').update(readFileSync(args.sources)).digest('hex') } : {}),
+        runningServices: await effects.serverLifecycle(record, 'status'), phase: 'prepared' };
+      save(transition);
+    } catch (error) {
+      await effects.discardServerBuild(candidate);
+      throw error;
+    }
+  } else {
+    const suppliedHash = args.sources ? createHash('sha256').update(readFileSync(args.sources)).digest('hex') : null;
+    if (args.operation !== transition.operation || (args.sources && suppliedHash !== transition.sourcePolicyHash)) {
+      throw new Error('Resume the retained server update/rebuild without substituting sources');
+    }
+  }
+  const { candidate, runningServices } = transition;
+  // A failed readiness check can leave some new services running. Every retry
+  // excludes those writers again and retains the original requested running set.
+  await effects.retireServerBuildRuntime(record);
+  if (transition.phase === 'prepared') {
+    await effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation);
+    transition = { ...transition, phase: 'state-updated' };
+    save(transition);
+  }
+  if (transition.phase === 'state-updated') {
+    await effects.publishServerBuild(record, candidate);
+    transition = { ...transition, phase: 'runtime-activated' };
+    save(transition);
+  }
+  await effects.validateServerBuildState(record);
+  await effects.serverLifecycle(record, 'start', runningServices);
+  const completed = { ...record, sourcePolicyHash: candidate.sourcePolicyHash };
+  delete completed.buildTransition;
+  effects.writeJson(path, JSON.stringify(completed, null, 2) + '\n');
+  try { await effects.discardServerBuild(candidate); }
+  catch { effects.out('Server update completed; temporary build artifacts could not be removed.'); }
+  return completed;
+}

package/lib/docker-conversion-runtime.mjs

@@ -0,0 +1,96 @@
+import * as fs from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { atomicWriteConfig } from './config.mjs';
+
+/** Update installer assets while retaining the selected application build. */
+export async function prepareDockerConversionRuntime(record, effects, assets) {
+  if (record.schema !== 1 || record.mode !== 'docker' || !/^ours-[a-z0-9]+$/.test(record.project)) {
+    throw new Error('Select the legacy Docker runtime for conversion');
+  }
+  const compose = join(record.workDir, 'docker-compose.yaml');
+  const legacy = join(record.workDir, 'docker-compose.legacy.yaml');
+  if (!fs.existsSync(legacy)) {
+    atomicWriteConfig(legacy, fs.readFileSync(compose));
+  }
+  const context = fs.mkdtempSync(join(record.root, '.conversion-build-'));
+  try {
+    fs.cpSync(join(assets, 'scripts/runtime'), join(context, 'runtime'), { recursive: true });
+    fs.cpSync(join(assets, 'scripts/maintenance'), join(context, 'maintenance'), { recursive: true });
+    const { dependencies } = JSON.parse(fs.readFileSync(new URL('../package.json', import.meta.url)));
+    fs.writeFileSync(join(context, 'package.json'), JSON.stringify({ private: true, type: 'module', dependencies }));
+    fs.writeFileSync(join(context, 'Dockerfile'), `# syntax=docker/dockerfile:1
+FROM ${record.project}:runtime AS runtime
+COPY --chmod=644 runtime/ /opt/ours/docker/
+FROM runtime AS maintenance
+USER 0:0
+COPY --chmod=644 maintenance/ /opt/ours/docker/
+COPY --chmod=644 package.json /opt/ours/docker/package.json
+RUN npm install --prefix /opt/ours/docker --omit=dev --ignore-scripts --no-audit --no-fund
+USER 1000:1000
+ENTRYPOINT ["node", "/opt/ours/docker/state-operation.mjs"]
+`);
+    // Build maintenance first: both targets inherit the same retained runtime.
+    for (const target of ['maintenance', 'runtime']) {
+      await effects.run('docker', ['build', '--platform', 'linux/amd64', '--target', target,
+        '--tag', `${record.project}:${target}`, context]);
+    }
+    atomicWriteConfig(compose, fs.readFileSync(join(assets, 'docker-compose.yaml')));
+  } finally {
+    fs.rmSync(context, { recursive: true, force: true });
+  }
+}
+
+/** Run the existing maintenance service with the volumes selected by the installer. */
+export async function runDockerConversion(record, selected, operation, label, effects) {
+  if (!['prepare', 'validate', 'cleanup'].includes(operation)) throw new Error('Unsupported Docker conversion operation');
+  const volumes = { storage: { external: true, name: selected.target } };
+  const mounts = [{ type: 'volume', source: 'storage', target: '/storage', volume: { nocopy: true } }];
+  const addMount = (source, target, subpath, readOnly) => mounts.push({
+    type: 'volume', source, target, read_only: readOnly,
+    volume: { nocopy: true, ...(subpath ? { subpath } : {}) },
+  });
+  if (operation !== 'validate') {
+    for (const [alias, name] of Object.entries(selected.sources)) {
+      const source = `source-${alias}`;
+      volumes[source] = { external: true, name };
+      addMount(source, `/source/${alias}`, undefined, operation === 'prepare' && alias !== 'cowork');
+    }
+    if (operation === 'prepare') {
+      addMount('source-daemon', '/var/lib/ours', 'data', true);
+      addMount('source-cowork', '/var/lib/ours-cowork', 'data', false);
+    }
+  } else {
+    addMount('storage', '/var/lib/ours', 'state/daemon', true);
+    addMount('storage', '/var/lib/ours-cowork', 'state/cowork', false);
+  }
+  const definition = {
+    services: {
+      'state-operation': {
+        image: `${record.project}:maintenance`, platform: 'linux/amd64',
+        user: `${record.uid ?? 1000}:${record.gid ?? 1000}`,
+        network_mode: 'none', read_only: true, cap_drop: ['ALL'],
+        security_opt: ['no-new-privileges:true'], tmpfs: ['/tmp:rw,nosuid,nodev,noexec,size=64m,mode=1777'],
+        entrypoint: ['node', '/opt/ours/docker/docker-layout-conversion.mjs'],
+        environment: { HOME: '/tmp', OURS_DAEMON_ID: record.instanceId },
+        volumes: mounts,
+      },
+    },
+    volumes,
+  };
+  const path = join(record.root, `.conversion-compose-${randomUUID()}.json`);
+  try {
+    fs.writeFileSync(path, JSON.stringify(definition), { mode: 0o600, flag: 'wx' });
+    const result = await effects.run('docker', ['compose', '--file', path, '--project-name', record.project,
+      'run', '--rm', '--no-deps', '-T', 'state-operation', operation, ...(label ? [label] : [])]);
+    if (operation === 'cleanup') {
+      const summary = JSON.parse(result.stdout);
+      if (!Array.isArray(summary.emptyVolumes) || summary.emptyVolumes.some(alias => !Object.hasOwn(selected.sources, alias))) {
+        throw new Error('Invalid retired-volume cleanup result');
+      }
+      return summary;
+    }
+  } finally {
+    fs.rmSync(path, { force: true });
+  }
+}

package/lib/docker-layout-installation.mjs

@@ -0,0 +1,62 @@
+import * as fs from 'node:fs';
+import { join, basename } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { installationPaths, validateInstallation, SERVER_SERVICES } from './plan.mjs';
+
+/** The installation lock is held by the caller; installation.json selects the live side. */
+export async function convertDockerInstallation(record, operation, effects) {
+  validateInstallation(record, record.root);
+  if (record.mode !== 'docker' || (record.schema !== 1 && !record.layoutConversion)) {
+    throw new Error('Select a legacy or pending Docker installation');
+  }
+  const source = record.layoutConversion?.sourceRecord ?? record;
+  const published = record.schema === 2;
+  const writeSelection = value => effects.writeJson(join(record.root, 'installation.json'), JSON.stringify(value, null, 2) + '\n');
+  const volumes = await effects.selectConversionVolumes(
+    { ...source, layoutConversion: record.layoutConversion }, { allowMissingSources: published });
+  if (published && !volumes.targetExists) throw new Error('Published Docker state volume is missing');
+
+  if (!published) {
+    await effects.prepareDockerConversionRuntime(source);
+    if (!record.layoutConversion) {
+      record = { ...source, layoutConversion: {
+        version: 1, sourceRecord: source,
+        runningServices: await effects.serverLifecycle(source, 'status'),
+        backupPath: join(source.root, 'storage/backups', `before-layout-2-${randomUUID()}`),
+      } };
+      writeSelection(record);
+    }
+    // The full tree includes all four component volumes, even when a component
+    // is not selected for restart. Exclude every former managed writer.
+    await effects.retireLegacyServices({ ...source, services: [...SERVER_SERVICES] });
+    const target = { ...source, schema: 2 };
+    target.configPath = installationPaths(target).config;
+    // Preparation initializes only owned storage; it does not issue authority.
+    await effects.prepareInstallation(target);
+    await effects.runDockerConversion(source, volumes, 'prepare', basename(record.layoutConversion.backupPath));
+    record = { ...target, layoutConversion: record.layoutConversion };
+    writeSelection(record);
+  } else {
+    await effects.serverLifecycle(record, 'stop');
+    await effects.confirmDockerWritersStopped(record);
+  }
+
+  await effects.runDockerConversion(record, volumes, 'validate');
+  const running = ['install', 'start'].includes(operation) ? record.services : record.layoutConversion.runningServices;
+  await effects.serverLifecycle(record, 'start', running);
+  const cleanup = await effects.runDockerConversion(record, volumes, 'cleanup');
+  if (cleanup.emptyVolumes.length) {
+    await effects.run('docker', ['volume', 'rm', ...cleanup.emptyVolumes.map(alias => volumes.sources[alias])]);
+  }
+  try {
+    const stat = fs.lstatSync(source.configPath);
+    // Private host files may inherit a directory's group on macOS.
+    if (!stat.isFile() || stat.uid !== process.getuid()
+      || (stat.mode & 0o7777) !== 0o600) throw new Error('Unsafe former installer configuration');
+    fs.unlinkSync(source.configPath);
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  const finished = { ...record };
+  delete finished.layoutConversion;
+  writeSelection(finished);
+  return finished;
+}