@ours.network/install 1.2.1-nightly.22 → 1.2.1-nightly.23

package/README.md

@@ -567,3 +567,14 @@ Workspace setup automatically reuses the saved managed gateway profile (or expli
 Fresh image builds explicitly make non-secret maintenance/runtime scripts readable by the container user even when the host build context was copied under umask077. Host scripts, selected source policy and state retain their private permissions.
 
 For a pending installation using an older image, run the corrected installer against the same pending workspace. It recognizes older shipped script COPY instructions combined with private host script modes, updates those image COPY modes and rebuilds the daemon image from the retained source selection. It leaves host data and enrollment state intact and qualifies the rebuilt image before preparing services. A private retry marker retains the rebuild requirement after interruption; it is removed only after verification succeeds. This rebuild resolves third-party transitive dependencies using the existing testing-delivery rules; selected Ours versions and integrity remain release-checked. It is not a byte-identical image permission-layer repair.
+
+Fresh server setup checks its loopback daemon, Cowork and Messenger ports before
+writing the installation configuration. Occupied implicit defaults advance to a
+free port, skipping reserved sibling ports; the selected values are saved in the
+installation record and used by native/container services, gateway and client
+profile generation. An explicitly requested occupied port fails with a diagnostic.
+Existing installation records keep their ports and identities. A listener acquired
+by another process after preflight still causes startup to fail safely; no foreign
+process is stopped and no retained installation is silently moved.
+
+Workspace setup pins Fleet `1.2.0-nightly.31` with its recorded registry integrity. This release includes the packaged `/fleet` browser entry and persists the available Fleet loopback port used by the workspace tunnel. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.

package/assets/release-lock.json

@@ -13,7 +13,7 @@
         "@ours.network/codex": "1.2.0-nightly.10",
         "@ours.network/cowork": "1.3.3-nightly.20261001.6d49d3a",
         "@ours.network/daemon": "3.8.1-nightly.7",
-        "@ours.network/fleet": "1.2.0-nightly.30",
+        "@ours.network/fleet": "1.2.0-nightly.31",
         "@ours.network/mcp": "1.2.0-nightly.10",
         "@ours.network/messenger-server": "1.0.31-nightly.13",
         "@ours.network/sdk": "3.8.1-nightly.15",
@@ -1085,9 +1085,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.30",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.30.tgz",
-      "integrity": "sha512-rZJqVpg2KSWOvDQxWs/nDlDwJ5VapZO7BK5RKFfv22FJgELArrO5/os03+J1sFazLlHv2qf93iBJ+Ht04h6B7Q==",
+      "version": "1.2.0-nightly.31",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.31.tgz",
+      "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",
@@ -2313,9 +2313,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.7.2",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
-      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
+      "version": "10.7.3",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz",
+      "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.22",
+  "installerVersion": "1.2.1-nightly.23",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.15",
@@ -24,8 +24,8 @@
       "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.30",
-      "integrity": "sha512-rZJqVpg2KSWOvDQxWs/nDlDwJ5VapZO7BK5RKFfv22FJgELArrO5/os03+J1sFazLlHv2qf93iBJ+Ht04h6B7Q=="
+      "version": "1.2.0-nightly.31",
+      "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.10",

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.22",
+    "installerVersion": "1.2.1-nightly.23",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.15",
@@ -25,8 +25,8 @@
         "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.30",
-        "integrity": "sha512-rZJqVpg2KSWOvDQxWs/nDlDwJ5VapZO7BK5RKFfv22FJgELArrO5/os03+J1sFazLlHv2qf93iBJ+Ht04h6B7Q=="
+        "version": "1.2.0-nightly.31",
+        "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.10",
@@ -79,7 +79,7 @@
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.30"
+      "version": "1.2.0-nightly.31"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/lib/effects.mjs

@@ -1,3 +1,4 @@
+import { selectServerPorts } from './server-ports.mjs';
 import { qualifyPodman } from './podman-preflight.mjs';
 import { engineName, bindPodman, runContainer, nativeBuildCommands } from './container-engine.mjs';
 // ours-install v3 — the real side effects.
@@ -677,7 +678,8 @@ export function networkEffects(effects) {
       const project = `ours-${createHash('sha256').update(root).digest('hex').slice(0, 16)}`;
       return { schema: 2, root, mode, ...(containerEngine ? { containerEngine } : {}), instanceId, project, workDir: join(root, 'runtime'), configPath: installationPaths({ schema: 2, root }).config, sourcesPath: join(root, 'sources.json'), services: [...SERVER_SERVICES, ...(mode === 'docker' ? ['gateway'] : [])], ...(mode === 'docker' ? { gateway: { version: 1 } } : {}), port: 3050, coworkPort: 3052, messengerPort: 8420, messengerIdentity: env.OURS_MESSENGER_IDENTITY || null, uid: 1000, gid: 1000 };
     },
-    async serverPreflight(record, operation, { existing, sourcePath = record.sourcesPath, sourceManifest, identityName } = {}) {
+    async serverPreflight(record, operation, { existing, sourcePath = record.sourcesPath, sourceManifest, identityName, explicitPorts } = {}) {
+      if (!existing && operation === 'install' && Number.isInteger(record.port)) selectServerPorts(record, portTakenSync, explicitPorts, effects.out);
       if (existing) {
         privateDirectory(record.root);
         assertPrivateRegularFile(join(record.root, 'installation.json'), 'selection');

package/lib/orchestrate.mjs

@@ -1363,7 +1363,7 @@ async function executeServerCommand(args, effects) {
   }
   if (!existing && args.sources) record.sourcePolicyHash = effects.sourcePolicyHash(args.sources);
   await installStage('Prerequisite checks', record.mode === 'docker' ? 'Check Docker Engine and Docker Compose.' : 'Check native tools and the user service manager.', () => effects.serverPreflight(record, args.operation, {
-    existing, sourcePath: args.sources ?? record.sourcesPath, sourceManifest: args.resolvedSources, identityName: args.identityName,
+    existing, sourcePath: args.sources ?? record.sourcesPath, sourceManifest: args.resolvedSources, identityName: args.identityName, explicitPorts: args.explicitPorts,
   }));
   if (existing && (record.schema === 1 || record.layoutConversion)
     && ['install', 'start', 'restart', 'update', 'rebuild'].includes(args.operation)) {

package/lib/server-ports.mjs

@@ -0,0 +1,17 @@
+/** Fresh selections only; retained installations keep their recorded addresses. */
+export function selectServerPorts(record, isTaken, explicitPorts = [], out = () => {}) {
+  const reserved = new Set([3051]);
+  for (const key of ['port', 'coworkPort', 'messengerPort']) {
+    const preferred = record[key];
+    let selected = preferred;
+    while (reserved.has(selected) || isTaken(selected)) {
+      if (explicitPorts.includes(key)) throw Error(`Requested ${key} ${preferred} is unavailable; select another explicit port`);
+      selected++;
+      if (selected > 65535) throw Error(`No free loopback port available for ${key}`);
+    }
+    reserved.add(selected);
+    record[key] = selected;
+    if (selected !== preferred) out(`${key}: ${preferred} is unavailable; selected loopback port ${selected}`);
+  }
+  return record;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.22",
+  "version": "1.2.1-nightly.23",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",