@ours.network/install 1.2.1-nightly.25 → 1.2.1-nightly.26

package/README.md

@@ -591,4 +591,4 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.32` with its recorded registry integrity. This release includes the packaged `/fleet` browser entry, separate `ours-fleet setup-tunnel` and `ours-fleet link-device` commands, and persists the available Fleet loopback port used by the workspace tunnel. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.33` with its recorded registry integrity. This release includes the packaged `/fleet` browser entry, separate `ours-fleet setup-tunnel` and `ours-fleet link-device` commands, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.

package/assets/release-lock.json

@@ -13,7 +13,7 @@
         "@ours.network/codex": "1.2.0-nightly.10",
         "@ours.network/cowork": "1.3.3-nightly.20261001.6d49d3a",
         "@ours.network/daemon": "3.8.1-nightly.7",
-        "@ours.network/fleet": "1.2.0-nightly.32",
+        "@ours.network/fleet": "1.2.0-nightly.33",
         "@ours.network/mcp": "1.2.0-nightly.10",
         "@ours.network/messenger-server": "1.0.31-nightly.13",
         "@ours.network/sdk": "3.8.1-nightly.15",
@@ -440,9 +440,9 @@
       }
     },
     "node_modules/@agentclientprotocol/sdk": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-1.6.0.tgz",
-      "integrity": "sha512-XxXrmX7aZkDgOB0Rg9cu+ZFyiUUc5lF2n9seO3Gc4OR+MTdfZOwIqF6m3LvsmmM8K3qgPmXkDH8/IFM2u9vdcQ==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-1.6.1.tgz",
+      "integrity": "sha512-ziLAZzqrAyW3bkK24c2DSTzLw48fUSKtgG3MTe2pqZgmsvepxXZFlUh9y8UZ2eYOnQ3qBgdcl879YrdWiTu6HQ==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "zod": "^3.25.0 || ^4.0.0"
@@ -1085,9 +1085,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.32",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.32.tgz",
-      "integrity": "sha512-FZRE+G25dc2qgDYbM3Dx76lw1Sws5OTF5KHPaMGTL5oun2SgYcNMhVKvwULZWSOlyrpggdMc3IFmp4eZSZTahg==",
+      "version": "1.2.0-nightly.33",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.33.tgz",
+      "integrity": "sha512-2z1Q01LeLRnq1HOcBeYJ67WnH5hI/tC/YdTkA4/K2LFdFtbff0j7M2l4SZDpKQaL8zgLjL8NREMSlOufdULJaA==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.25",
+  "installerVersion": "1.2.1-nightly.26",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.15",
@@ -24,8 +24,8 @@
       "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.32",
-      "integrity": "sha512-FZRE+G25dc2qgDYbM3Dx76lw1Sws5OTF5KHPaMGTL5oun2SgYcNMhVKvwULZWSOlyrpggdMc3IFmp4eZSZTahg=="
+      "version": "1.2.0-nightly.33",
+      "integrity": "sha512-2z1Q01LeLRnq1HOcBeYJ67WnH5hI/tC/YdTkA4/K2LFdFtbff0j7M2l4SZDpKQaL8zgLjL8NREMSlOufdULJaA=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.10",

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.25",
+    "installerVersion": "1.2.1-nightly.26",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.15",
@@ -25,8 +25,8 @@
         "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.32",
-        "integrity": "sha512-FZRE+G25dc2qgDYbM3Dx76lw1Sws5OTF5KHPaMGTL5oun2SgYcNMhVKvwULZWSOlyrpggdMc3IFmp4eZSZTahg=="
+        "version": "1.2.0-nightly.33",
+        "integrity": "sha512-2z1Q01LeLRnq1HOcBeYJ67WnH5hI/tC/YdTkA4/K2LFdFtbff0j7M2l4SZDpKQaL8zgLjL8NREMSlOufdULJaA=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.10",
@@ -79,7 +79,7 @@
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.32"
+      "version": "1.2.0-nightly.33"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/lib/client-cli.mjs

@@ -88,7 +88,7 @@ export async function publishClientCli(effects, packagePath, { policy = {}, isol
     if (sdk.name !== '@ours.network/sdk' || sdk.version !== policy.release.packages['@ours.network/sdk'].version) throw new Error('Private CLI SDK differs from selection');
     mkdirSync(dirname(entry), { recursive: true });
     const binDir = lstatSync(dirname(entry));
-    if (!binDir.isDirectory() || binDir.uid !== process.getuid() || (binDir.mode & 0o022)) throw new Error('CLI bin directory must be owned and not writable by others');
+    if (!binDir.isDirectory() || binDir.uid !== process.getuid() || (binDir.mode & 0o022)) throw new Error(`CLI bin directory ${dirname(entry)} must be owned by you and not writable by group or others; run chmod go-w on it, or point npm's global prefix at a directory you own`);
     const current = stat(entry);
     if (before ? !current || current.dev !== before.dev || current.ino !== before.ino : current) throw new Error('CLI entry changed during publication');
     const staged = entry + '.' + randomUUID();

package/lib/server-onboarding.mjs

@@ -136,7 +136,8 @@ else { await request('identity/profile', selection.human); process.stdout.write(
 `;
       const docker = record.mode === 'docker';
       const selection = { base: `http://127.0.0.1:${docker ? 8420 : record.messengerPort}`,
-        origin: `http://127.0.0.1:${record.messengerPort}`,
+        // Behind the gateway Messenger accepts mutations only from the gateway origin.
+        origin: record.gateway ? gatewayAddress(record).origin : `http://127.0.0.1:${record.messengerPort}`,
         credentialPath: docker ? '/credentials/messenger/daemon-token' : installationPaths(record).credentials.messenger,
         human: { name: human.name, surname: human.surname } };
       const args = ['--input-type=module', '-e', script, JSON.stringify(selection)];

package/lib/setup-options.mjs

@@ -219,9 +219,17 @@ export async function collectSetupOptions(effects, presets = {}) {
   }
   if (options.scope !== 'client') {
     const recommendation = recommendedMode({ ...effects.platform, arch: effects.platform?.arch ?? process.arch });
-    effects.out(`${recommendation.reason} Native runs directly on this computer; Docker runs in containers and needs Docker installed and running. An existing installation must keep its current mode.`);
+    // Native runs the server only: local clients need the container gateway. A retained
+    // native installation keeps its mode, so a full setup of it cannot finish.
+    // (An unfinished migration is resumed in its recorded mode and is validated with the plan.)
+    if (options.scope === 'all' && existing?.mode === 'packages' && !options.migrateFrom)
+      throw new Error('This installation runs natively, which supports the server only. Choose the server-only setup to maintain it (ours-install server); local clients need an installation that runs in Docker or Podman. Nothing was changed.');
+    const nativeOffered = options.scope === 'server' || existing?.mode === 'packages';
+    effects.out(nativeOffered
+      ? `${recommendation.reason} Native runs directly on this computer; Docker runs in containers and needs Docker installed and running. An existing installation must keep its current mode.`
+      : 'The server runs in containers. Docker and Podman both work; the one you choose must be installed and running. An existing installation must keep its current mode.');
     const runtime = options.mode ?? await effects.select('How should the server run?', [
-      { value: 'packages', label: 'Native packages' }, { value: 'docker', label: 'Docker' }, { value: 'podman', label: 'Podman' },
+      ...(nativeOffered ? [{ value: 'packages', label: 'Native packages' }] : []), { value: 'docker', label: 'Docker' }, { value: 'podman', label: 'Podman' },
     ], existing?.mode === 'docker' && existing?.containerEngine === 'podman' ? 'podman' : existing?.mode ?? recommendation.mode);
     options.mode = runtime === 'podman' ? 'docker' : runtime;
     if (runtime === 'podman') options.containerEngine = 'podman';

package/lib/usage.mjs

@@ -4,7 +4,8 @@ export const USAGE = `ours-install — interactive setup with optional CLI prese
   ours-install
     Opens the console form. Choose all (server + clients), server, or client;
     runtime, installation directory, identity, integrations and Fleet settings.
-    Docker provides the full-stack gateway; native mode is server-only. Windows uses WSL.
+    Full setup runs the server in Docker or Podman, which provide the gateway local clients need.
+    Native mode is offered for server-only setup. Windows uses WSL.
 
   Install now, configure Fleet agents in the App after linking:
     ours-install --username alex --name Alex --surname Taylor --disable-fleet-agents-setup

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.25",
+  "version": "1.2.1-nightly.26",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",