@ours.network/install 1.2.1-nightly.3 → 1.2.1-nightly.30

package/assets/release.json

@@ -1,43 +1,57 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.3",
+  "installerVersion": "1.2.1-nightly.30",
   "packages": {
     "@ours.network/sdk": {
-      "version": "3.8.1-nightly.3",
-      "integrity": "sha512-iUVCs+jryoeR2Ip/uHzpkJwbpoJeLDASUaE3lC+eYDj8dbI1MBwTpeOXFemUK052O6lA4ZWrhyRgE9pJU3a+Kw=="
+      "version": "3.8.1-nightly.15",
+      "integrity": "sha512-ynKaKmKtINBqYk3kNovsgEO/3TiFY1CC9FgZzrOH+H6onnM3J//Q8cBb9sun8dl9mhB4mKZYgvneSiOejYwZUw=="
     },
     "@ours.network/cli": {
-      "version": "2.8.1-nightly.1",
-      "integrity": "sha512-1Rmbqlr790FhqQW/wQ//YEL7b0Q2KVSCA2TlpjaLRkj9Xh55rOoazBJjFuW/fUpTz3Z1B3MUPK9LWiYd+A0kNA=="
+      "version": "2.8.1-nightly.13",
+      "integrity": "sha512-1BeAG12vh4ruBOeJ54l60qWUhLzPLRNKnGtRiJpQmSXkamNQglrPQeXa9xW3taAM4Vg5uYgEhsz6+ieM+1TUSA=="
     },
     "@ours.network/tg-connector": {
-      "version": "1.0.1-nightly.1",
-      "integrity": "sha512-/Do7EfINknDks3yYndOi9aLc1alxB50qk+WKv8DRuZpDB89DDMQ+DoSGQerdvsMp32nQ3LICL8TPjcdFMZfx8Q=="
+      "version": "1.0.1-nightly.9",
+      "integrity": "sha512-wm0V8c97aIg7p26L9My36I3BE9Cy2Xc5W7WgHg6Vo+hmPvE+jXmen86yA4+DxIu9VYxoVSMtpBbu76485eCeNw=="
     },
     "@ours.network/cowork": {
-      "version": "1.3.2-nightly.20260918.4d9242e",
-      "integrity": "sha512-04D2lJ97SrTrkVRRbdTZ0y+KvQdG/bpnmFFjsyUqQTij+5zEkNizTG/xhcCL8m7Mb0XvVFL8WzJ62Xgh5ahlRw=="
+      "version": "1.3.3-nightly.20261001.6d49d3a",
+      "integrity": "sha512-tqoLOWc4O8CGwLdO1j6ukm6Vn57EE0zbuxKo4BWd0QVwu9ObKgHCEMOKPgW2mXHeESXSv9m7edcIrnK8I5gD+w=="
     },
     "@ours.network/messenger-server": {
-      "version": "1.0.31-nightly.1",
-      "integrity": "sha512-XB6N+Ppd4txmI0+2ZVFMWJxXi4DtMIDlFSHOzszNM5hopFebpw1Df+KKCK4Cgd/LZUkoOOYWGEYpib9m3RbHWw=="
+      "version": "1.0.31-nightly.14",
+      "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.1",
-      "integrity": "sha512-vioCobVbosmp9BgYo2XccjpPoVQd1wwV+Mt64Bm41/Vxtro2j85PUdy4AWcsY9jEFnJmj/UQfc5E5AxvlpPnrw=="
+      "version": "1.2.0-nightly.38",
+      "integrity": "sha512-glCDY/WfILgTJfG7G3ao5iEtCyWtyPOzl/o+D1EVphUuKQYZIW7Xk8sxyT2/D8FADRqvJSBbebWseWbgmlU6Ow=="
     },
     "@ours.network/mcp": {
-      "version": "1.2.0-nightly.3",
-      "integrity": "sha512-z0N5jn1jj9iwGRqU1d3AM2RX9mCr4T/WhASEKr+Vh52yNDMzhVjFlx0U0v8aS+GTfOQaPZTfL3TGMc17ETjh3g=="
+      "version": "1.2.0-nightly.10",
+      "integrity": "sha512-59sxJOcQagNRR+43Z5ScFlqFDBIlZSMQi8iz9mpxp5Jjl38B0dmCFsv5e+srbEYrV3xaOg9ZBsT17OUABFAseQ=="
     },
     "@ours.network/codex": {
-      "version": "1.2.0-nightly.3",
-      "integrity": "sha512-dIWDqbo6hJzujegHRO6x1SsBnh5p1c6gRGj/WkPha/hcN7s/27P4jqBnJ7czQyVGiNVFZ1aAxj4c9+CDLzHENw=="
+      "version": "1.2.0-nightly.10",
+      "integrity": "sha512-7hV4R0w8tiQ/JKFU5MxtM7fihd33tzWDgT+Bn8cidasxI5zmTLqDEIv6om5LM/xk7UqcPw5gDN2kcJYiybnP9Q=="
     },
     "@ours.network/claude-code": {
-      "version": "1.2.0-nightly.3",
-      "integrity": "sha512-7ta6KnvoHB2i/yoaykhXvzKFQTIOPtDHeTzG1PRwHjdTJ4vcGEh4jWYMd2c1jjj73lC3q9qW3LYSRutIJovtQg=="
+      "version": "1.2.0-nightly.10",
+      "integrity": "sha512-C3+H/vXespanVj9E1uQAWno9RFrI5KlK2SHSc7dnmRRuFVyRsoVcbvlpVI3nZ8snFaKVzbetebZr7vxd73AWSg=="
+    },
+    "@ours.network/daemon": {
+      "version": "3.8.1-nightly.7",
+      "integrity": "sha512-dDFDm+xERplzu4yXKvLjKGNaIdr9u4ku5/4jiI4g8do3qOX9VS0tF1+O67uSu4jqkypg860UdZRdn9Zce72H/A=="
+    }
+  },
+  "hostCli": {
+    "@ours.network/sdk": {
+      "version": "3.8.1-nightly.15",
+      "integrity": "sha512-ynKaKmKtINBqYk3kNovsgEO/3TiFY1CC9FgZzrOH+H6onnM3J//Q8cBb9sun8dl9mhB4mKZYgvneSiOejYwZUw=="
+    },
+    "@ours.network/cli": {
+      "version": "2.8.1-nightly.13",
+      "integrity": "sha512-1BeAG12vh4ruBOeJ54l60qWUhLzPLRNKnGtRiJpQmSXkamNQglrPQeXa9xW3taAM4Vg5uYgEhsz6+ieM+1TUSA=="
     }
   }
 }

package/assets/scripts/build/build-common.mjs

@@ -7,7 +7,7 @@ export const ROOT = resolve(process.env.OURS_BUILD_ROOT || '/opt/ours');
 export const SOURCE_ROOT = resolve(process.env.OURS_SOURCE_ROOT || '/src');
 export const OUT = join(ROOT, 'docker/vendor');
 export const CONFIG = JSON.parse(readFileSync(join(ROOT, 'sources.json'), 'utf8'));
-export const SELECTED = new Set((process.env.OURS_BUILD_PACKAGES || 'sdk,cli,mcp,tg-connector,cowork,messenger-server').split(',').map(name => '@ours.network/' + name));
+export const SELECTED = new Set((process.env.OURS_BUILD_PACKAGES || 'sdk,cli,daemon,tg-connector,cowork,messenger-server').split(',').map(name => '@ours.network/' + name));
 export const inheritedLock = process.env.OURS_INSTALLER_LOCK_FD === '3' ? [3] : [];
 export const run = (args, cwd) => execFileSync(args[0], args.slice(1), { cwd, stdio: ['inherit', 'inherit', 'inherit', ...inheritedLock] });
 export const capture = (args, cwd, env = process.env) => execFileSync(args[0], args.slice(1), { cwd, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit', ...inheritedLock] });

package/assets/scripts/build/build-sdk.mjs

@@ -2,8 +2,13 @@ import { join } from 'node:path';
 import { SOURCE_ROOT, SELECTED, pack, run } from './build-common.mjs';
 const source = join(SOURCE_ROOT, 'sdk');
 run(['npm', 'ci', '--no-audit', '--no-fund'], source);
-run(['bash', 'scripts/compile-mufl.sh'], source);
+if (SELECTED.has('@ours.network/daemon')) run(['bash', 'scripts/compile-mufl.sh'], source);
 run(['npm', 'run', 'build'], source);
 if (SELECTED.has('@ours.network/cli')) run(['npm', 'run', 'build:cli'], source);
 pack(source, '@ours.network/sdk', 'sdk');
 pack(join(source, 'packages/cli'), '@ours.network/cli', 'sdk');
+
+if (SELECTED.has('@ours.network/daemon')) {
+  run(['npm', 'run', 'build:daemon'], source);
+  pack(join(source, 'packages/daemon'), '@ours.network/daemon', 'sdk');
+}

package/assets/scripts/maintenance/build-context.mjs

@@ -8,7 +8,7 @@ import { semanticRecordEqual } from './provenance-compare.mjs';
 export const BASE_RECORDS = ['package-lock.json', 'dependency-tree.json'];
 export const CONTEXT = 'build-context.json';
 const admitted = new WeakMap();
-const packages = new Set(['sdk', 'cli', 'mcp', 'tg-connector', 'cowork', 'messenger-server', 'fleet', 'codex', 'claude-code', 'install'].map(n => '@ours.network/' + n));
+const packages = new Set(['sdk', 'cli', 'daemon', 'mcp', 'tg-connector', 'cowork', 'messenger-server', 'fleet', 'codex', 'claude-code', 'install'].map(n => '@ours.network/' + n));
 const digest = (bytes, algorithm = 'sha256', encoding = 'hex') => createHash(algorithm).update(bytes).digest(encoding);
 const fail = text => { throw new Error(`Build context: ${text}`); };
 const keys = (v, expected) => v && !Array.isArray(v) && typeof v === 'object' && Object.keys(v).sort().join('\0') === [...expected].sort().join('\0');

package/assets/scripts/maintenance/daemon-owner.mjs

@@ -0,0 +1,15 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Native callers provide an exact selected executable. Compose mounts the
+// selected runtime and supplies its bin directory, including retained releases.
+export function daemonOwner(env = process.env) {
+  if (env.OURS_CLI_PATH) return env.OURS_CLI_PATH;
+  const bin = env.OURS_DAEMON_BIN_DIR;
+  if (!bin) throw new Error('daemon maintenance requires its selected executable or bin directory');
+  const daemon = join(bin, 'ours-daemon');
+  if (existsSync(daemon)) return daemon;
+  const legacy = join(bin, 'ours');
+  if (existsSync(legacy)) return legacy;
+  throw new Error('selected runtime contains no daemon administrator');
+}

package/assets/scripts/maintenance/docker-layout-conversion.mjs

@@ -6,6 +6,8 @@ import { pathToFileURL } from 'node:url';
 import { copyPrivateTree, scanSource, createArchive, validateArchive } from './state-archive.mjs';
 import { publishNoReplace } from './state-native.mjs';
 
+import { daemonOwner } from './daemon-owner.mjs';
+
 const COMPONENTS = ['daemon', 'telegram', 'cowork', 'messenger'];
 import { recordNames, readBuildRecords, validateBuildRecordSet } from './build-context.mjs';
 const DAEMON_STATE = '/var/lib/ours';
@@ -113,12 +115,14 @@ export function validateDockerLayout(tree, options) {
     const config = join(tree, component, 'config.json');
     if (fs.existsSync(config)) objectAt(config, options);
   }
+  // Fresh managed installs keep the MCP profile separately until configured.
+  // Retained embedded configuration, when present, must still match exactly.
   const daemon = objectAt(join(tree, 'daemon/config.json'), options);
   const profile = objectAt(join(tree, 'mcp/profile.json'), options);
   validateProfile(profile, options.instanceId);
   if (daemon.stateDir !== DAEMON_STATE || daemon.port !== 3050
-    || daemon.networkMcp?.applicationConfigPath !== join(MCP_STATE, 'config.json')
-    || JSON.stringify(daemon.networkMcp.profile) !== JSON.stringify(profile)
+    || (daemon.networkMcp !== undefined && (daemon.networkMcp?.applicationConfigPath !== join(MCP_STATE, 'config.json')
+      || JSON.stringify(daemon.networkMcp?.profile) !== JSON.stringify(profile)))
     || objectAt(join(tree, 'cowork/config.json'), options).stateDir !== '/var/lib/ours-cowork') {
     throw new Error('Converted Docker deployment configuration is inconsistent');
   }
@@ -207,7 +211,7 @@ export async function runDockerLayoutCommand(argv, env = process.env) {
   const build = env.OURS_BUILD_ROOT || '/opt/ours';
   const options = {
     uid: process.getuid(), gid: process.getgid(), instanceId: env.OURS_DAEMON_ID,
-    cli: env.OURS_CLI_PATH || '/opt/ours/node_modules/.bin/ours',
+    cli: daemonOwner({ OURS_DAEMON_BIN_DIR: '/opt/ours/node_modules/.bin', ...env }),
     configPath: env.OURS_DAEMON_CONFIG || '/var/lib/ours/config.json',
     provenance: readBuildRecords(build),
   };

package/assets/scripts/maintenance/release-graph.mjs

@@ -20,10 +20,19 @@ export function releaseBinding(policy) {
   if (release?.schema !== 1 || !['stable', 'nightly'].includes(release.channel)) fail('invalid release binding');
   const pattern = release.channel === 'nightly' ? nightly : stable;
   if (typeof release.installerVersion !== 'string' || !pattern.test(release.installerVersion)) fail('invalid installer version/channel');
-  if (!release.packages || JSON.stringify(Object.keys(release.packages).sort()) !== JSON.stringify([...names].sort())) fail('release must select exactly nine ours packages');
+  if (release.scope !== undefined && release.scope !== 'host-cli') fail('invalid release scope');
+  const required = release.scope === 'host-cli' ? ['@ours.network/cli', '@ours.network/sdk'] : [...names, ...(release.packages?.['@ours.network/daemon'] ? ['@ours.network/daemon'] : [])];
+  if (!release.packages || JSON.stringify(Object.keys(release.packages).sort()) !== JSON.stringify([...required].sort())) fail('release must select exactly the required ours packages');
+  if (release.scope === 'host-cli' && Object.hasOwn(release, 'hostCli')) fail('nested host CLI selection');
   for (const [name, entry] of Object.entries(release.packages)) {
     if (typeof entry?.version !== 'string' || !pattern.test(entry.version) || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity ?? '')) fail(`invalid release artifact: ${name}`);
   }
+  if (Object.hasOwn(release, 'hostCli')) {
+    if (!release.hostCli || Object.keys(release.hostCli).sort().join(',') !== '@ours.network/cli,@ours.network/sdk') fail('host CLI must select exactly CLI and SDK');
+    for (const [name, entry] of Object.entries(release.hostCli)) {
+      if (typeof entry?.version !== 'string' || !pattern.test(entry.version) || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity ?? '')) fail(`invalid host CLI artifact: ${name}`);
+    }
+  }
   if (!policy.packages || !Object.keys(policy.packages).length) fail('missing release source selection');
   for (const [name, entry] of Object.entries(policy.packages)) {
     if (entry?.type !== 'npm' || entry.version !== release.packages[name]?.version || Object.keys(entry).sort().join(',') !== 'type,version') fail(`source selection differs from release: ${name}`);
@@ -92,3 +101,11 @@ export function verifyRuntimeRelease(root) {
   if (!existsSync(path)) return { verified: false, reason: 'legacy runtime without sources' };
   return verifyReleaseGraph(root, json(path));
 }
+
+/** The client command has its own exact dependency selection, never a graph bypass. */
+export function hostCliPolicy(policy) {
+  const release = releaseBinding(policy);
+  if (!release?.hostCli) return null;
+  const { hostCli, ...base } = release;
+  return { release: { ...base, scope: 'host-cli', packages: hostCli }, packages: Object.fromEntries(Object.entries(hostCli).map(([name, p]) => [name, { type: 'npm', version: p.version }])) };
+}

package/assets/scripts/maintenance/state-operation.mjs

@@ -9,6 +9,8 @@ import { createArchive, extractArchive, validateArchive, scanSource, copyPrivate
 import { exchange, tryLock, setMtimeNs } from './state-native.mjs';
 import { recordNames, readBuildRecords, equalBuildRecords, initializeBuildMarker } from './build-context.mjs';
 
+import { daemonOwner } from './daemon-owner.mjs';
+
 const PROVENANCE = '.ours-provenance';
 const APPLICATIONS = ['daemon', 'telegram', 'cowork', 'messenger'];
 const exists = path => { try { fs.lstatSync(path); return true; } catch (e) { if (e.code === 'ENOENT') return false; throw e; } };
@@ -145,9 +147,9 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
   }
   function retainAuthority(staging) {
     if (!['daemon', 'server'].includes(domain)) return;
-    if (!env.OURS_CLI_PATH || !env.OURS_DAEMON_CONFIG) fail('daemon maintenance requires its selected executable and configuration');
+    if (!env.OURS_DAEMON_CONFIG) fail('daemon maintenance requires its selected executable and configuration');
     const daemon = commonTree ? join(staging, 'daemon') : staging;
-    owner([env.OURS_CLI_PATH, 'config', 'access-retain', '--config', env.OURS_DAEMON_CONFIG, '--target-state-dir', daemon, '--json']);
+    owner([daemonOwner(env), 'config', 'access-retain', '--config', env.OURS_DAEMON_CONFIG, '--target-state-dir', daemon, '--json']);
     if (!commonTree) return;
     const credentials = join(live, 'credentials'), destination = join(staging, 'credentials');
     for (const name of ['telegram', 'cowork', 'messenger']) if (!privateStat(join(credentials, name, 'daemon-token'), false, 0o600).size) fail('current managed credential is empty');

package/assets/scripts/runtime/client-setup.mjs

@@ -1,8 +1,9 @@
 import { readBuildRecords, initializeBuildMarker } from '../maintenance/build-context.mjs';
+import { redactDiagnostic } from './diagnostics.mjs';
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import {
-  closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync,
+  existsSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync,
   realpathSync, renameSync, unlinkSync, writeFileSync, readdirSync, chmodSync, chownSync,
 } from 'node:fs';
 
@@ -12,6 +13,7 @@ const DELIVERY_FILES = [
   '/credentials/messenger/daemon-token',
 ];
 const fail = (message) => { throw new Error(message); };
+let diagnosticStage = 'validation';
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 function privatePath(path, directory, exact = directory ? 0o700 : 0o600) {
@@ -67,7 +69,7 @@ function validateCommon(idName = 'OURS_DAEMON_ID') {
 
 function composeConfig(domain) {
   if (domain === 'daemon') {
-    const value = { stateDir: '/var/lib/ours', port: 3050, apiVisibility: 'owner', networkMcp: { profile: { endpoint: 'http://127.0.0.1:3050', expectedInstanceId: process.env.OURS_DAEMON_ID, credentialPath: '/var/lib/ours/daemon-token' }, applicationConfigPath: '/var/lib/ours-mcp/config.json' } };
+    const value = { stateDir: '/var/lib/ours', port: 3050, apiVisibility: 'owner' };
     if (process.env.OURS_BROKER_URL) value.brokerUrl = process.env.OURS_BROKER_URL;
     return value;
   }
@@ -128,10 +130,13 @@ function prepare() {
 
 function finishDaemonSetup() {
   const state = '/var/lib/ours';
+  diagnosticStage = 'daemon-provenance';
   initializeBuildMarker(`${state}/.ours-provenance`, readBuildRecords('/opt/ours'));
+  diagnosticStage = 'mcp-directory';
   privatePath('/var/lib/ours-mcp', true);
   const mcpProfile = { endpoint: 'http://127.0.0.1:3050', expectedInstanceId: process.env.OURS_DAEMON_ID, credentialPath: `${state}/daemon-token` };
   const mcpPath = '/var/lib/ours-mcp/profile.json';
+  diagnosticStage = 'mcp-profile';
   if (!existingPrivate(mcpPath, false)) atomicJson(mcpPath, mcpProfile);
   else if (JSON.stringify(jsonObject(mcpPath)) !== JSON.stringify(mcpProfile)) fail('Existing MCP profile differs from the selected daemon');
 }
@@ -155,10 +160,19 @@ async function telegramInput() {
 }
 
 function cliJson(args) {
-  const result = spawnSync(process.execPath, ['/opt/ours/node_modules/@ours.network/cli/dist/cli.js', ...args], {
+  diagnosticStage = 'official-cli';
+  const result = spawnSync(process.execPath, [existsSync('/opt/ours/node_modules/@ours.network/daemon/dist/cli.js') ? '/opt/ours/node_modules/@ours.network/daemon/dist/cli.js' : '/opt/ours/node_modules/@ours.network/cli/dist/cli.js', ...args], {
     encoding: 'utf8', timeout: 60_000, maxBuffer: 1024 * 1024,
   });
-  if (result.status !== 0) fail('Official OURS CLI operation failed');
+  if (result.error || result.status !== 0) {
+    // --json writes failures on stderr. Successful credential stdout is never
+    // forwarded, even if a later operation exits unsuccessfully.
+    let reason = 'CLI supplied no structured error reason';
+    for (const line of String(result.stderr ?? '').split('\n').reverse()) {
+      try { const value = JSON.parse(line); if (typeof value?.error?.message === 'string') { reason = value.error.message; break; } } catch {}
+    }
+    fail(`Official OURS CLI operation failed (${args[1]}; exit=${result.status ?? 'none'}; signal=${result.signal ?? 'none'}; system=${result.error?.code ?? 'none'}): ${reason}`);
+  }
   try { return JSON.parse(result.stdout); }
   catch { fail('Official OURS CLI returned malformed JSON'); }
 }
@@ -192,6 +206,10 @@ try {
   else if (['access-init', 'access-issue', 'access-replace'].includes(operation)) access(operation, process.argv[3]);
   else fail('usage: client-setup.mjs prepare | telegram-input | access-init | access-issue [OUTPUT] | access-replace');
 } catch (error) {
-  console.error(`OURS client setup refused: ${error.message}`);
+  // Structured stderr retains the failing stage across sensitive Compose
+  // capture. The installer redacts secrets before exposing this envelope.
+  const message = redactDiagnostic(error.message);
+  console.error(JSON.stringify({ oursInstallerError: { stage: diagnosticStage, message } }));
+  console.error(`OURS client setup refused: ${message}`);
   process.exit(1);
 }

package/assets/scripts/runtime/diagnostics.mjs

@@ -0,0 +1,72 @@
+/** Retain actionable failure details without emitting credential output. */
+export function redactDiagnostic(value, env = process.env) {
+  let text = String(value ?? '').replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, '').replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
+  for (const [key, secret] of Object.entries(env)) {
+    if (/(?:token|password|secret|api.?key|private.?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)/i.test(key) && typeof secret === 'string' && secret)
+      text = text.split(secret).join('[redacted]');
+  }
+  return text
+    .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, '[redacted private key]')
+    .replace(/(Bearer\s+)[^\s"',;]+/gi, '$1[redacted]')
+    .replace(/((?:["']?(?:api[-_]?token|token|password|secret|api[-_]?key|private[-_]?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)["']?)\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;}]+)/gi, '$1[redacted]')
+    .replace(/(--(?:setup-workspace|password|token|secret|api-key|private-key|invitation|enrollment)(?:=|\s+))\S+/gi, '$1[redacted]')
+    .replace(/(https?:\/\/)[^\s/@:]+:[^\s/@]+@/g, '$1[redacted]@')
+    .replace(/\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, '[redacted credential]')
+    .replace(/[A-Za-z0-9_+/=-]{43,}/g, '[redacted opaque value]');
+}
+
+const bounded = text => text.length <= 65536 ? text : text.slice(0, 65536) + '\n[Diagnostic output exceeds 64 KiB; remainder omitted.]';
+function credentialFailure(stderr) {
+  // Credential stdout can be a successful issuance followed by failure: never
+  // include it. Only a structured error envelope or shipped helper refusal is
+  // accepted from stderr; arbitrary lines/warnings remain private.
+  const lines = String(stderr ?? '').split('\n').reverse();
+  for (const line of lines) {
+    try {
+      const value = JSON.parse(line);
+      if (typeof value?.oursInstallerError?.message === 'string') {
+        const detail = value.oursInstallerError;
+        const stage = /^[a-z][a-z-]{0,40}$/.test(detail.stage ?? '') ? detail.stage : 'credential-operation';
+        return `Stage: ${stage}\nReason: ${detail.message}`;
+      }
+      if (typeof value?.error?.message === 'string') return `Reason: ${value.error.message}`;
+    } catch {}
+  }
+  const prefix = 'OURS client setup refused: ';
+  const legacy = lines.find(line => line.startsWith(prefix));
+  if (legacy) return `Reason: ${legacy.slice(prefix.length)}`;
+  return 'The credential operation provided no structured reason. Its raw output was withheld because it can contain credentials.';
+}
+
+export function commandFailure(command, args, result, { sensitive = false, cwd, env = process.env } = {}) {
+  const visibleArgs = [...args];
+  if (sensitive) {
+    for (let i = 0; i < visibleArgs.length - 1; i++) if (['-e', '--eval'].includes(visibleArgs[i])) visibleArgs[i + 1] = '[captured installer helper]';
+  }
+  const details = [`Command: ${command} ${visibleArgs.join(' ')}${result.status != null ? ` exited ${result.status}` : ''}`];
+  if (cwd) details.push(`Working directory: ${cwd}`);
+  if (result.status !== null && result.status !== undefined) details.push(`Exit code: ${result.status}`);
+  if (result.signal) details.push(`Signal: ${result.signal}`);
+  if (result.error?.code) details.push(`System error: ${result.error.code}`);
+  if (result.error?.code === 'ETIMEDOUT') details.push('Reason: command timed out.');
+  if (sensitive) details.push(credentialFailure(result.stderr));
+  else {
+    const stderr = String(result.stderr ?? '').trim(), stdout = String(result.stdout ?? '').trim();
+    if (stderr) details.push(`Standard error:\n${stderr}`);
+    if (stdout) details.push(`Standard output:\n${stdout}`);
+    if (!stderr && !stdout) details.push('No captured command output. Streaming commands print their output above.');
+  }
+  details.push('Keep installation data intact. Include this error and the preceding installation stage when requesting help.');
+  return new Error(bounded(redactDiagnostic(details.join('\n'), env)), result.error ? { cause: result.error } : undefined);
+}
+
+export function installerFailure(error, env = process.env) {
+  const details = []; const seen = new Set();
+  for (let cause = error; cause && !seen.has(cause) && seen.size < 8; cause = cause.cause) {
+    seen.add(cause);
+    const message = cause instanceof Error ? cause.message : String(cause);
+    if (!details.includes(message)) details.push(message);
+    if (typeof cause.code === 'string' && /^[A-Z_0-9]+$/.test(cause.code)) details.push(`System error: ${cause.code}`);
+  }
+  return bounded(redactDiagnostic(details.join('\nCaused by: '), env));
+}

package/assets/scripts/runtime/entrypoint.sh

@@ -10,4 +10,4 @@ else
   exit "$status"
 fi
 node /opt/ours/docker/check-start.mjs
-exec node /opt/ours/node_modules/@ours.network/cli/dist/cli.js daemon serve
+exec node /opt/ours/node_modules/@ours.network/daemon/dist/cli.js serve

package/assets/sources.json

@@ -2,82 +2,100 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.3",
+    "installerVersion": "1.2.1-nightly.30",
     "packages": {
       "@ours.network/sdk": {
-        "version": "3.8.1-nightly.3",
-        "integrity": "sha512-iUVCs+jryoeR2Ip/uHzpkJwbpoJeLDASUaE3lC+eYDj8dbI1MBwTpeOXFemUK052O6lA4ZWrhyRgE9pJU3a+Kw=="
+        "version": "3.8.1-nightly.15",
+        "integrity": "sha512-ynKaKmKtINBqYk3kNovsgEO/3TiFY1CC9FgZzrOH+H6onnM3J//Q8cBb9sun8dl9mhB4mKZYgvneSiOejYwZUw=="
       },
       "@ours.network/cli": {
-        "version": "2.8.1-nightly.1",
-        "integrity": "sha512-1Rmbqlr790FhqQW/wQ//YEL7b0Q2KVSCA2TlpjaLRkj9Xh55rOoazBJjFuW/fUpTz3Z1B3MUPK9LWiYd+A0kNA=="
+        "version": "2.8.1-nightly.13",
+        "integrity": "sha512-1BeAG12vh4ruBOeJ54l60qWUhLzPLRNKnGtRiJpQmSXkamNQglrPQeXa9xW3taAM4Vg5uYgEhsz6+ieM+1TUSA=="
       },
       "@ours.network/tg-connector": {
-        "version": "1.0.1-nightly.1",
-        "integrity": "sha512-/Do7EfINknDks3yYndOi9aLc1alxB50qk+WKv8DRuZpDB89DDMQ+DoSGQerdvsMp32nQ3LICL8TPjcdFMZfx8Q=="
+        "version": "1.0.1-nightly.9",
+        "integrity": "sha512-wm0V8c97aIg7p26L9My36I3BE9Cy2Xc5W7WgHg6Vo+hmPvE+jXmen86yA4+DxIu9VYxoVSMtpBbu76485eCeNw=="
       },
       "@ours.network/cowork": {
-        "version": "1.3.2-nightly.20260918.4d9242e",
-        "integrity": "sha512-04D2lJ97SrTrkVRRbdTZ0y+KvQdG/bpnmFFjsyUqQTij+5zEkNizTG/xhcCL8m7Mb0XvVFL8WzJ62Xgh5ahlRw=="
+        "version": "1.3.3-nightly.20261001.6d49d3a",
+        "integrity": "sha512-tqoLOWc4O8CGwLdO1j6ukm6Vn57EE0zbuxKo4BWd0QVwu9ObKgHCEMOKPgW2mXHeESXSv9m7edcIrnK8I5gD+w=="
       },
       "@ours.network/messenger-server": {
-        "version": "1.0.31-nightly.1",
-        "integrity": "sha512-XB6N+Ppd4txmI0+2ZVFMWJxXi4DtMIDlFSHOzszNM5hopFebpw1Df+KKCK4Cgd/LZUkoOOYWGEYpib9m3RbHWw=="
+        "version": "1.0.31-nightly.14",
+        "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.1",
-        "integrity": "sha512-vioCobVbosmp9BgYo2XccjpPoVQd1wwV+Mt64Bm41/Vxtro2j85PUdy4AWcsY9jEFnJmj/UQfc5E5AxvlpPnrw=="
+        "version": "1.2.0-nightly.38",
+        "integrity": "sha512-glCDY/WfILgTJfG7G3ao5iEtCyWtyPOzl/o+D1EVphUuKQYZIW7Xk8sxyT2/D8FADRqvJSBbebWseWbgmlU6Ow=="
       },
       "@ours.network/mcp": {
-        "version": "1.2.0-nightly.3",
-        "integrity": "sha512-z0N5jn1jj9iwGRqU1d3AM2RX9mCr4T/WhASEKr+Vh52yNDMzhVjFlx0U0v8aS+GTfOQaPZTfL3TGMc17ETjh3g=="
+        "version": "1.2.0-nightly.10",
+        "integrity": "sha512-59sxJOcQagNRR+43Z5ScFlqFDBIlZSMQi8iz9mpxp5Jjl38B0dmCFsv5e+srbEYrV3xaOg9ZBsT17OUABFAseQ=="
       },
       "@ours.network/codex": {
-        "version": "1.2.0-nightly.3",
-        "integrity": "sha512-dIWDqbo6hJzujegHRO6x1SsBnh5p1c6gRGj/WkPha/hcN7s/27P4jqBnJ7czQyVGiNVFZ1aAxj4c9+CDLzHENw=="
+        "version": "1.2.0-nightly.10",
+        "integrity": "sha512-7hV4R0w8tiQ/JKFU5MxtM7fihd33tzWDgT+Bn8cidasxI5zmTLqDEIv6om5LM/xk7UqcPw5gDN2kcJYiybnP9Q=="
       },
       "@ours.network/claude-code": {
-        "version": "1.2.0-nightly.3",
-        "integrity": "sha512-7ta6KnvoHB2i/yoaykhXvzKFQTIOPtDHeTzG1PRwHjdTJ4vcGEh4jWYMd2c1jjj73lC3q9qW3LYSRutIJovtQg=="
+        "version": "1.2.0-nightly.10",
+        "integrity": "sha512-C3+H/vXespanVj9E1uQAWno9RFrI5KlK2SHSc7dnmRRuFVyRsoVcbvlpVI3nZ8snFaKVzbetebZr7vxd73AWSg=="
+      },
+      "@ours.network/daemon": {
+        "version": "3.8.1-nightly.7",
+        "integrity": "sha512-dDFDm+xERplzu4yXKvLjKGNaIdr9u4ku5/4jiI4g8do3qOX9VS0tF1+O67uSu4jqkypg860UdZRdn9Zce72H/A=="
+      }
+    },
+    "hostCli": {
+      "@ours.network/sdk": {
+        "version": "3.8.1-nightly.15",
+        "integrity": "sha512-ynKaKmKtINBqYk3kNovsgEO/3TiFY1CC9FgZzrOH+H6onnM3J//Q8cBb9sun8dl9mhB4mKZYgvneSiOejYwZUw=="
+      },
+      "@ours.network/cli": {
+        "version": "2.8.1-nightly.13",
+        "integrity": "sha512-1BeAG12vh4ruBOeJ54l60qWUhLzPLRNKnGtRiJpQmSXkamNQglrPQeXa9xW3taAM4Vg5uYgEhsz6+ieM+1TUSA=="
       }
     }
   },
   "packages": {
     "@ours.network/sdk": {
       "type": "npm",
-      "version": "3.8.1-nightly.3"
+      "version": "3.8.1-nightly.15"
     },
     "@ours.network/cli": {
       "type": "npm",
-      "version": "2.8.1-nightly.1"
+      "version": "2.8.1-nightly.13"
     },
     "@ours.network/tg-connector": {
       "type": "npm",
-      "version": "1.0.1-nightly.1"
+      "version": "1.0.1-nightly.9"
     },
     "@ours.network/cowork": {
       "type": "npm",
-      "version": "1.3.2-nightly.20260918.4d9242e"
+      "version": "1.3.3-nightly.20261001.6d49d3a"
     },
     "@ours.network/messenger-server": {
       "type": "npm",
-      "version": "1.0.31-nightly.1"
+      "version": "1.0.31-nightly.14"
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.1"
+      "version": "1.2.0-nightly.38"
     },
     "@ours.network/mcp": {
       "type": "npm",
-      "version": "1.2.0-nightly.3"
+      "version": "1.2.0-nightly.10"
     },
     "@ours.network/codex": {
       "type": "npm",
-      "version": "1.2.0-nightly.3"
+      "version": "1.2.0-nightly.10"
     },
     "@ours.network/claude-code": {
       "type": "npm",
-      "version": "1.2.0-nightly.3"
+      "version": "1.2.0-nightly.10"
+    },
+    "@ours.network/daemon": {
+      "type": "npm",
+      "version": "3.8.1-nightly.7"
     }
   }
 }

package/install.mjs

@@ -3,6 +3,8 @@
 import { readFileSync } from 'node:fs';
 
 import { realEffects } from './lib/effects.mjs';
+import { installerFailure } from './lib/diagnostics.mjs';
+import { runWorkspaceSetup } from './lib/workspace-setup.mjs';
 import { runSetup } from './lib/setup.mjs';
 import { closeSync, makeWriter, openTty } from './lib/ui.mjs';
 
@@ -10,7 +12,10 @@ const version = JSON.parse(readFileSync(new URL('./package.json', import.meta.ur
 const ttyFd = openTty();
 
 try {
-  const code = await runSetup(process.argv.slice(2), realEffects({
+  const args=process.argv.slice(2);
+  const workspace=args.some(v=>v==='--setup-workspace' || v.startsWith('--setup-workspace=') || v==='--setup-workspace-file' || v.startsWith('--setup-workspace-file='));
+  const execute=workspace ? (args,effects)=>runWorkspaceSetup(args,effects,runSetup) : runSetup;
+  const code = await execute(args, realEffects({
     write: makeWriter(ttyFd),
     ttyFd,
     env: process.env,
@@ -18,7 +23,7 @@ try {
   }));
   process.exitCode = code;
 } catch (error) {
-  process.stderr.write(`ours-install: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.stderr.write(`ours-install: ${installerFailure(error)}\n`);
   process.exitCode = 1;
 } finally {
   if (ttyFd != null) {

package/lib/build-transition.mjs

@@ -53,6 +53,7 @@ export async function serverBuildTransition(record, args, effects) {
   }
   await stage('Verify retained state and identities', () => effects.validateServerBuildState(record));
   await stage('Restore previously running services and check readiness', () => effects.serverLifecycle(record, 'start', runningServices));
+  if (record.gateway && ['daemon', 'cowork', 'gateway'].every(name => runningServices.includes(name))) await stage('Verify authenticated gateway management', () => effects.verifyGateway(record));
   const completed = { ...record, sourcePolicyHash: candidate.sourcePolicyHash };
   delete completed.buildTransition;
   effects.writeJson(path, JSON.stringify(completed, null, 2) + '\n');