@ours.network/install 1.2.0-nightly.2 → 1.2.1-nightly.2

package/assets/release.json

@@ -0,0 +1,43 @@
+{
+  "schema": 1,
+  "channel": "nightly",
+  "installerVersion": "1.2.1-nightly.2",
+  "packages": {
+    "@ours.network/sdk": {
+      "version": "3.8.1-nightly.3",
+      "integrity": "sha512-iUVCs+jryoeR2Ip/uHzpkJwbpoJeLDASUaE3lC+eYDj8dbI1MBwTpeOXFemUK052O6lA4ZWrhyRgE9pJU3a+Kw=="
+    },
+    "@ours.network/cli": {
+      "version": "2.8.1-nightly.1",
+      "integrity": "sha512-1Rmbqlr790FhqQW/wQ//YEL7b0Q2KVSCA2TlpjaLRkj9Xh55rOoazBJjFuW/fUpTz3Z1B3MUPK9LWiYd+A0kNA=="
+    },
+    "@ours.network/tg-connector": {
+      "version": "1.0.1-nightly.1",
+      "integrity": "sha512-/Do7EfINknDks3yYndOi9aLc1alxB50qk+WKv8DRuZpDB89DDMQ+DoSGQerdvsMp32nQ3LICL8TPjcdFMZfx8Q=="
+    },
+    "@ours.network/cowork": {
+      "version": "1.3.2-nightly.20260918.4d9242e",
+      "integrity": "sha512-04D2lJ97SrTrkVRRbdTZ0y+KvQdG/bpnmFFjsyUqQTij+5zEkNizTG/xhcCL8m7Mb0XvVFL8WzJ62Xgh5ahlRw=="
+    },
+    "@ours.network/messenger-server": {
+      "version": "1.0.31-nightly.1",
+      "integrity": "sha512-XB6N+Ppd4txmI0+2ZVFMWJxXi4DtMIDlFSHOzszNM5hopFebpw1Df+KKCK4Cgd/LZUkoOOYWGEYpib9m3RbHWw=="
+    },
+    "@ours.network/fleet": {
+      "version": "1.2.0-nightly.1",
+      "integrity": "sha512-vioCobVbosmp9BgYo2XccjpPoVQd1wwV+Mt64Bm41/Vxtro2j85PUdy4AWcsY9jEFnJmj/UQfc5E5AxvlpPnrw=="
+    },
+    "@ours.network/mcp": {
+      "version": "1.2.0-nightly.3",
+      "integrity": "sha512-z0N5jn1jj9iwGRqU1d3AM2RX9mCr4T/WhASEKr+Vh52yNDMzhVjFlx0U0v8aS+GTfOQaPZTfL3TGMc17ETjh3g=="
+    },
+    "@ours.network/codex": {
+      "version": "1.2.0-nightly.3",
+      "integrity": "sha512-dIWDqbo6hJzujegHRO6x1SsBnh5p1c6gRGj/WkPha/hcN7s/27P4jqBnJ7czQyVGiNVFZ1aAxj4c9+CDLzHENw=="
+    },
+    "@ours.network/claude-code": {
+      "version": "1.2.0-nightly.3",
+      "integrity": "sha512-7ta6KnvoHB2i/yoaykhXvzKFQTIOPtDHeTzG1PRwHjdTJ4vcGEh4jWYMd2c1jjj73lC3q9qW3LYSRutIJovtQg=="
+    }
+  }
+}

package/assets/scripts/build/record-build.mjs

@@ -4,6 +4,7 @@ import { join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { createBuildContext, CONTEXT } from '../maintenance/build-context.mjs';
+import { verifyRuntimeRelease } from '../maintenance/release-graph.mjs';
 export function finalizeBuild(root) {
   if (fs.realpathSync(root) !== root) throw new Error('Build root must be canonical');
   try { fs.lstatSync(join(root, CONTEXT)); throw new Error('Existing context cannot be regenerated'); }
@@ -20,6 +21,7 @@ export function finalizeBuild(root) {
     if (typeof spec !== 'string' || !/^file:docker\/vendor\/ours\.network-[a-z-]+\.tgz$/.test(spec)) throw new Error('Unexpected installer vendor reference');
     protect(join(root, spec.slice(5)));
   }
+  verifyRuntimeRelease(root);
   const tree = execFileSync('npm', ['ls', '--omit=dev', '--all', '--json'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
   JSON.parse(tree);
   const path = join(root, 'dependency-tree.json');

package/assets/scripts/maintenance/release-graph.mjs

@@ -0,0 +1,94 @@
+/** Enforce the selected ours artifacts; this is not third-party lock replay. */
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { join, resolve, relative, isAbsolute } from 'node:path';
+import { createHash } from 'node:crypto';
+
+const names = ['sdk', 'cli', 'tg-connector', 'cowork', 'messenger-server', 'fleet', 'mcp', 'codex', 'claude-code'].map(name => '@ours.network/' + name);
+const stable = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+const nightly = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-nightly\.(0|[1-9]\d*)(?:\.[0-9a-f]{7,40})?$/;
+const fail = message => { throw new Error(`Release graph refused: ${message}`); };
+function file(path) {
+  if (!lstatSync(path).isFile() || realpathSync(path) !== path) fail(`non-regular or linked file: ${path}`);
+  return readFileSync(path);
+}
+const json = path => JSON.parse(file(path));
+
+export function releaseBinding(policy) {
+  // Only an absent binding denotes explicit development/retained legacy inputs.
+  if (!Object.hasOwn(policy ?? {}, 'release')) return null;
+  const release = policy.release;
+  if (release?.schema !== 1 || !['stable', 'nightly'].includes(release.channel)) fail('invalid release binding');
+  const pattern = release.channel === 'nightly' ? nightly : stable;
+  if (typeof release.installerVersion !== 'string' || !pattern.test(release.installerVersion)) fail('invalid installer version/channel');
+  if (!release.packages || JSON.stringify(Object.keys(release.packages).sort()) !== JSON.stringify([...names].sort())) fail('release must select exactly nine ours packages');
+  for (const [name, entry] of Object.entries(release.packages)) {
+    if (typeof entry?.version !== 'string' || !pattern.test(entry.version) || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity ?? '')) fail(`invalid release artifact: ${name}`);
+  }
+  if (!policy.packages || !Object.keys(policy.packages).length) fail('missing release source selection');
+  for (const [name, entry] of Object.entries(policy.packages)) {
+    if (entry?.type !== 'npm' || entry.version !== release.packages[name]?.version || Object.keys(entry).sort().join(',') !== 'type,version') fail(`source selection differs from release: ${name}`);
+  }
+  return release;
+}
+
+export function verifyReleaseGraph(root, policy, { requiredPackages = Object.keys(policy?.packages ?? {}) } = {}) {
+  const release = releaseBinding(policy);
+  if (!release) return { verified: false, reason: 'development or retained legacy source selection' };
+  root = resolve(root);
+  if (realpathSync(root) !== root) fail('build root is not canonical');
+  const manifest = json(join(root, 'package.json'));
+  if (manifest.name?.startsWith('@ours.network/') && manifest.version !== release.packages[manifest.name]?.version) fail(`root package differs from release: ${manifest.name}`);
+  const locks = ['package-lock.json', 'node_modules/.package-lock.json'].map(path => {
+    const lock = json(join(root, path));
+    if (lock.lockfileVersion !== 3 || !lock.packages || Array.isArray(lock.packages)) fail(`invalid lock: ${path}`);
+    const entries = new Map();
+    for (const [location, entry] of Object.entries(lock.packages)) {
+      const match = location.match(/(?:^|\/)node_modules\/(@ours\.network\/[^/]+)$/);
+      if (!match) continue;
+      const name = match[1], expected = release.packages[name];
+      if (!expected || entry?.link || entry.version !== expected.version || entry.integrity !== expected.integrity) fail(`version/integrity mismatch: ${path}:${location}`);
+      const installed = resolve(root, location), rel = relative(root, installed);
+      if (!rel || rel.startsWith('..') || isAbsolute(rel)) fail(`escaping lock location: ${location}`);
+      if (typeof entry.resolved !== 'string') fail(`missing artifact location: ${location}`);
+      if (entry.resolved.startsWith('file:')) {
+        const archive = resolve(root, entry.resolved.slice(5));
+        const archiveRel = relative(root, archive);
+        if (archiveRel.startsWith('..') || isAbsolute(archiveRel) || !archive.endsWith('.tgz')) fail(`unbound local artifact: ${location}`);
+        const integrity = 'sha512-' + createHash('sha512').update(file(archive)).digest('base64');
+        if (integrity !== expected.integrity) fail(`vendor bytes differ from release: ${location}`);
+      } else if (!entry.resolved.startsWith(`https://registry.npmjs.org/${name}/-/`)) fail(`non-official artifact: ${location}`);
+      entries.set(location, { name, entry, installed });
+    }
+    return entries;
+  });
+  const [declared, installed] = locks;
+  const direct = Object.entries(manifest.dependencies ?? {}).filter(([name]) => name.startsWith('@ours.network/'));
+  if (!manifest.name?.startsWith('@ours.network/') && JSON.stringify(direct.map(([name]) => name).sort()) !== JSON.stringify([...requiredPackages].sort())) fail('direct package set differs from release source selection');
+  for (const [name, spec] of direct) {
+    const expected = release.packages[name], locked = declared.get(`node_modules/${name}`)?.entry;
+    if (!expected || (spec !== expected.version && !(typeof spec === 'string' && spec.startsWith('file:') && spec === locked?.resolved))) fail(`direct package spec differs from release: ${name}`);
+  }
+  for (const name of Object.keys(manifest.dependencies ?? {}).filter(name => name.startsWith('@ours.network/'))) {
+    if (!declared.has(`node_modules/${name}`) || !installed.has(`node_modules/${name}`)) fail(`missing direct release package: ${name}`);
+  }
+  for (const [location, value] of declared) {
+    // npm's root lock retains dev-only entries omitted from a production install.
+    if (!installed.has(location) && !value.entry.dev && !value.entry.optional) fail(`installed release entry missing: ${location}`);
+  }
+  for (const [location, value] of installed) {
+    const expected = declared.get(location);
+    if (!expected || expected.entry.version !== value.entry.version || expected.entry.integrity !== value.entry.integrity || expected.entry.resolved !== value.entry.resolved) fail(`installed/root lock mismatch: ${location}`);
+    if (!lstatSync(value.installed).isDirectory() || realpathSync(value.installed) !== value.installed) fail(`linked installed package: ${location}`);
+    const actual = json(join(value.installed, 'package.json'));
+    if (actual.name !== value.name || actual.version !== value.entry.version) fail(`installed package differs from release: ${location}`);
+  }
+  return { verified: true, packages: installed.size };
+}
+
+export function verifyRuntimeRelease(root) {
+  const path = join(resolve(root), 'sources.json');
+  // Historic installations predate sources/release bindings; their existing
+  // provenance and conversion checks remain authoritative until explicit update.
+  if (!existsSync(path)) return { verified: false, reason: 'legacy runtime without sources' };
+  return verifyReleaseGraph(root, json(path));
+}

package/assets/scripts/runtime/runtime-common.mjs

@@ -1,4 +1,5 @@
 import { readBuildRecords, initializeBuildMarker } from '../maintenance/build-context.mjs';
+import { verifyRuntimeRelease } from '../maintenance/release-graph.mjs';
 import { accessSync, constants, lstatSync, readFileSync } from 'node:fs';
 
 export function privatePath(path, directory = false, writable = false) {
@@ -43,5 +44,6 @@ export function checkCredential(path) {
 // Called with the startup state-directory lock held. These are build records,
 // not a storage schema or a declaration that arbitrary upgrades are compatible.
 export function recordBuild(state) {
+  verifyRuntimeRelease('/opt/ours');
   initializeBuildMarker(`${state}/.ours-provenance`, readBuildRecords('/opt/ours'));
 }

package/assets/sources.json

@@ -1,21 +1,83 @@
 {
-  "sources": {
-    "sdk": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-sdk.git", "commit": "9cb51add34888e6ae2cc3b554c97362bb1ca2d33" },
-    "telegram": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-tg-connector.git", "commit": "81798b836b15ac4ba9b32ac180f94fb258a54a41" },
-    "cowork": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-cowork.git", "commit": "1e17f7666c1682a858101c98a8f371aac7b737e3" },
-    "messenger": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-messenger-server.git", "commit": "fc852e49eb3b43c077f59cf4919536be6f6d03b1" },
-    "fleet": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-fleet.git", "commit": "b8444a7aac2eb6148a3ab534e90308bfc76447d7" },
-    "mcp": { "type": "git", "url": "https://github.com/adapt-toolkit/ours-mcp.git", "commit": "3d970d0cb7baf52351d5cd44dd59d4a2f705207b" }
+  "release": {
+    "schema": 1,
+    "channel": "nightly",
+    "installerVersion": "1.2.1-nightly.2",
+    "packages": {
+      "@ours.network/sdk": {
+        "version": "3.8.1-nightly.3",
+        "integrity": "sha512-iUVCs+jryoeR2Ip/uHzpkJwbpoJeLDASUaE3lC+eYDj8dbI1MBwTpeOXFemUK052O6lA4ZWrhyRgE9pJU3a+Kw=="
+      },
+      "@ours.network/cli": {
+        "version": "2.8.1-nightly.1",
+        "integrity": "sha512-1Rmbqlr790FhqQW/wQ//YEL7b0Q2KVSCA2TlpjaLRkj9Xh55rOoazBJjFuW/fUpTz3Z1B3MUPK9LWiYd+A0kNA=="
+      },
+      "@ours.network/tg-connector": {
+        "version": "1.0.1-nightly.1",
+        "integrity": "sha512-/Do7EfINknDks3yYndOi9aLc1alxB50qk+WKv8DRuZpDB89DDMQ+DoSGQerdvsMp32nQ3LICL8TPjcdFMZfx8Q=="
+      },
+      "@ours.network/cowork": {
+        "version": "1.3.2-nightly.20260918.4d9242e",
+        "integrity": "sha512-04D2lJ97SrTrkVRRbdTZ0y+KvQdG/bpnmFFjsyUqQTij+5zEkNizTG/xhcCL8m7Mb0XvVFL8WzJ62Xgh5ahlRw=="
+      },
+      "@ours.network/messenger-server": {
+        "version": "1.0.31-nightly.1",
+        "integrity": "sha512-XB6N+Ppd4txmI0+2ZVFMWJxXi4DtMIDlFSHOzszNM5hopFebpw1Df+KKCK4Cgd/LZUkoOOYWGEYpib9m3RbHWw=="
+      },
+      "@ours.network/fleet": {
+        "version": "1.2.0-nightly.1",
+        "integrity": "sha512-vioCobVbosmp9BgYo2XccjpPoVQd1wwV+Mt64Bm41/Vxtro2j85PUdy4AWcsY9jEFnJmj/UQfc5E5AxvlpPnrw=="
+      },
+      "@ours.network/mcp": {
+        "version": "1.2.0-nightly.3",
+        "integrity": "sha512-z0N5jn1jj9iwGRqU1d3AM2RX9mCr4T/WhASEKr+Vh52yNDMzhVjFlx0U0v8aS+GTfOQaPZTfL3TGMc17ETjh3g=="
+      },
+      "@ours.network/codex": {
+        "version": "1.2.0-nightly.3",
+        "integrity": "sha512-dIWDqbo6hJzujegHRO6x1SsBnh5p1c6gRGj/WkPha/hcN7s/27P4jqBnJ7czQyVGiNVFZ1aAxj4c9+CDLzHENw=="
+      },
+      "@ours.network/claude-code": {
+        "version": "1.2.0-nightly.3",
+        "integrity": "sha512-7ta6KnvoHB2i/yoaykhXvzKFQTIOPtDHeTzG1PRwHjdTJ4vcGEh4jWYMd2c1jjj73lC3q9qW3LYSRutIJovtQg=="
+      }
+    }
   },
   "packages": {
-    "@ours.network/sdk": { "source": "sdk" },
-    "@ours.network/cli": { "source": "sdk" },
-    "@ours.network/tg-connector": { "source": "telegram" },
-    "@ours.network/cowork": { "source": "cowork" },
-    "@ours.network/messenger-server": { "source": "messenger" },
-    "@ours.network/fleet": { "source": "fleet" },
-    "@ours.network/mcp": { "source": "mcp" },
-    "@ours.network/codex": { "source": "mcp" },
-    "@ours.network/claude-code": { "source": "mcp" }
+    "@ours.network/sdk": {
+      "type": "npm",
+      "version": "3.8.1-nightly.3"
+    },
+    "@ours.network/cli": {
+      "type": "npm",
+      "version": "2.8.1-nightly.1"
+    },
+    "@ours.network/tg-connector": {
+      "type": "npm",
+      "version": "1.0.1-nightly.1"
+    },
+    "@ours.network/cowork": {
+      "type": "npm",
+      "version": "1.3.2-nightly.20260918.4d9242e"
+    },
+    "@ours.network/messenger-server": {
+      "type": "npm",
+      "version": "1.0.31-nightly.1"
+    },
+    "@ours.network/fleet": {
+      "type": "npm",
+      "version": "1.2.0-nightly.1"
+    },
+    "@ours.network/mcp": {
+      "type": "npm",
+      "version": "1.2.0-nightly.3"
+    },
+    "@ours.network/codex": {
+      "type": "npm",
+      "version": "1.2.0-nightly.3"
+    },
+    "@ours.network/claude-code": {
+      "type": "npm",
+      "version": "1.2.0-nightly.3"
+    }
   }
 }

package/install.mjs

@@ -3,14 +3,14 @@
 import { readFileSync } from 'node:fs';
 
 import { realEffects } from './lib/effects.mjs';
-import { runInstall } from './lib/orchestrate.mjs';
+import { runSetup } from './lib/setup.mjs';
 import { closeSync, makeWriter, openTty } from './lib/ui.mjs';
 
 const version = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version;
 const ttyFd = openTty();
 
 try {
-  const code = await runInstall(process.argv.slice(2), realEffects({
+  const code = await runSetup(process.argv.slice(2), realEffects({
     write: makeWriter(ttyFd),
     ttyFd,
     env: process.env,

package/install.sh

@@ -9,7 +9,7 @@
 # pipes a script into your shell). It just gets Node.js/npm sorted, then does the same
 # `npm i -g @ours.network/install` and runs `ours-install`. Meant to be run as:
 #
-#     curl -fsSL https://raw.githubusercontent.com/adapt-toolkit/ours-mcp/main/packages/installer/install.sh | bash
+#     curl -fsSL https://raw.githubusercontent.com/adapt-toolkit/ours-network/main/install.sh | bash
 #
 # This file is a THIN bootstrap: it checks that Node.js + npm are present (and prints friendly,
 # per-OS guidance if not), then runs the real experience — the Node installer (install.mjs) that

package/lib/build-transition.mjs

@@ -2,10 +2,16 @@ import { readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { validateInstallation } from './plan.mjs';
+import { info, ok, warn } from './ui.mjs';
 
 /** The caller holds the installation lock; installation.json owns retry state. */
 export async function serverBuildTransition(record, args, effects) {
   validateInstallation(record, record.root);
+  const stage = async (label, action) => {
+    effects.out?.(info(label));
+    try { const result = await action(); effects.out?.(ok(`${label} complete`)); return result; }
+    catch (error) { effects.out?.(warn(`Server ${args.operation} stopped during ${label.toLowerCase()}.`)); throw error; }
+  };
   const path = join(record.root, 'installation.json');
   const save = transition => {
     record = { ...record, buildTransition: transition };
@@ -14,9 +20,9 @@ export async function serverBuildTransition(record, args, effects) {
   };
   let transition = record.buildTransition;
   if (!transition) {
-    const candidate = await effects.prepareServerBuild(record, args);
+    const candidate = await stage('Prepare the updated runtime', () => effects.prepareServerBuild(record, args));
     try {
-      await effects.checkServerBuild(record, candidate, !!args.compatible, args.operation);
+      await stage('Verify package and stored-state compatibility', () => effects.checkServerBuild(record, candidate, !!args.compatible, args.operation));
       transition = { operation: args.operation, candidate, compatible: !!args.compatible,
         ...(args.sources ? { sourcePolicyHash: createHash('sha256').update(readFileSync(args.sources)).digest('hex') } : {}),
         runningServices: await effects.serverLifecycle(record, 'status'), phase: 'prepared' };
@@ -34,19 +40,19 @@ export async function serverBuildTransition(record, args, effects) {
   const { candidate, runningServices } = transition;
   // A failed readiness check can leave some new services running. Every retry
   // excludes those writers again and retains the original requested running set.
-  await effects.retireServerBuildRuntime(record);
+  await stage('Stop services before updating stored state', () => effects.retireServerBuildRuntime(record));
   if (transition.phase === 'prepared') {
-    await effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation);
+    await stage('Update stored state while retaining identities and credentials', () => effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation));
     transition = { ...transition, phase: 'state-updated' };
     save(transition);
   }
   if (transition.phase === 'state-updated') {
-    await effects.publishServerBuild(record, candidate);
+    await stage('Activate the prepared runtime', () => effects.publishServerBuild(record, candidate));
     transition = { ...transition, phase: 'runtime-activated' };
     save(transition);
   }
-  await effects.validateServerBuildState(record);
-  await effects.serverLifecycle(record, 'start', runningServices);
+  await stage('Verify retained state and identities', () => effects.validateServerBuildState(record));
+  await stage('Restore previously running services and check readiness', () => effects.serverLifecycle(record, 'start', runningServices));
   const completed = { ...record, sourcePolicyHash: candidate.sourcePolicyHash };
   delete completed.buildTransition;
   effects.writeJson(path, JSON.stringify(completed, null, 2) + '\n');

package/lib/docker-conversion-runtime.mjs

@@ -22,6 +22,7 @@ export async function prepareDockerConversionRuntime(record, effects, assets) {
     fs.writeFileSync(join(context, 'Dockerfile'), `# syntax=docker/dockerfile:1
 FROM ${record.project}:runtime AS runtime
 COPY --chmod=644 runtime/ /opt/ours/docker/
+COPY --chmod=644 maintenance/release-graph.mjs /opt/ours/maintenance/release-graph.mjs
 FROM runtime AS maintenance
 USER 0:0
 COPY --chmod=644 maintenance/ /opt/ours/docker/