@ours.network/install 1.2.1-nightly.3 → 1.2.1-nightly.31

package/assets/release.json

@@ -1,43 +1,61 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.3",
+  "installerVersion": "1.2.1-nightly.31",
   "packages": {
     "@ours.network/sdk": {
-      "version": "3.8.1-nightly.3",
-      "integrity": "sha512-iUVCs+jryoeR2Ip/uHzpkJwbpoJeLDASUaE3lC+eYDj8dbI1MBwTpeOXFemUK052O6lA4ZWrhyRgE9pJU3a+Kw=="
+      "version": "3.8.1-nightly.15",
+      "integrity": "sha512-ynKaKmKtINBqYk3kNovsgEO/3TiFY1CC9FgZzrOH+H6onnM3J//Q8cBb9sun8dl9mhB4mKZYgvneSiOejYwZUw=="
     },
     "@ours.network/cli": {
-      "version": "2.8.1-nightly.1",
-      "integrity": "sha512-1Rmbqlr790FhqQW/wQ//YEL7b0Q2KVSCA2TlpjaLRkj9Xh55rOoazBJjFuW/fUpTz3Z1B3MUPK9LWiYd+A0kNA=="
+      "version": "2.8.1-nightly.13",
+      "integrity": "sha512-1BeAG12vh4ruBOeJ54l60qWUhLzPLRNKnGtRiJpQmSXkamNQglrPQeXa9xW3taAM4Vg5uYgEhsz6+ieM+1TUSA=="
     },
     "@ours.network/tg-connector": {
-      "version": "1.0.1-nightly.1",
-      "integrity": "sha512-/Do7EfINknDks3yYndOi9aLc1alxB50qk+WKv8DRuZpDB89DDMQ+DoSGQerdvsMp32nQ3LICL8TPjcdFMZfx8Q=="
+      "version": "1.0.1-nightly.9",
+      "integrity": "sha512-wm0V8c97aIg7p26L9My36I3BE9Cy2Xc5W7WgHg6Vo+hmPvE+jXmen86yA4+DxIu9VYxoVSMtpBbu76485eCeNw=="
     },
     "@ours.network/cowork": {
-      "version": "1.3.2-nightly.20260918.4d9242e",
-      "integrity": "sha512-04D2lJ97SrTrkVRRbdTZ0y+KvQdG/bpnmFFjsyUqQTij+5zEkNizTG/xhcCL8m7Mb0XvVFL8WzJ62Xgh5ahlRw=="
+      "version": "1.3.3-nightly.20261001.6d49d3a",
+      "integrity": "sha512-tqoLOWc4O8CGwLdO1j6ukm6Vn57EE0zbuxKo4BWd0QVwu9ObKgHCEMOKPgW2mXHeESXSv9m7edcIrnK8I5gD+w=="
     },
     "@ours.network/messenger-server": {
-      "version": "1.0.31-nightly.1",
-      "integrity": "sha512-XB6N+Ppd4txmI0+2ZVFMWJxXi4DtMIDlFSHOzszNM5hopFebpw1Df+KKCK4Cgd/LZUkoOOYWGEYpib9m3RbHWw=="
+      "version": "1.0.31-nightly.14",
+      "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg=="
+    },
+    "@ours.network/notifications": {
+      "version": "0.3.1-nightly.1",
+      "integrity": "sha512-rIkrtixoHqBfgCKDDCEYFl4W2Zzh0hOw3axX2+GppQ9gYkujKrk9M2KLGoYhu8RwwTMRl497jgMcTBe7UAHCgA=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.1",
-      "integrity": "sha512-vioCobVbosmp9BgYo2XccjpPoVQd1wwV+Mt64Bm41/Vxtro2j85PUdy4AWcsY9jEFnJmj/UQfc5E5AxvlpPnrw=="
+      "version": "1.2.0-nightly.39",
+      "integrity": "sha512-ixcky/b22x2slW+NmPz2BVQVLFV+jkTFzRGFKpDLug2mugk6xIJiVyY50o8G5c+JXAjB+EN9pzIIrTH21Y48BA=="
     },
     "@ours.network/mcp": {
-      "version": "1.2.0-nightly.3",
-      "integrity": "sha512-z0N5jn1jj9iwGRqU1d3AM2RX9mCr4T/WhASEKr+Vh52yNDMzhVjFlx0U0v8aS+GTfOQaPZTfL3TGMc17ETjh3g=="
+      "version": "1.2.0-nightly.10",
+      "integrity": "sha512-59sxJOcQagNRR+43Z5ScFlqFDBIlZSMQi8iz9mpxp5Jjl38B0dmCFsv5e+srbEYrV3xaOg9ZBsT17OUABFAseQ=="
     },
     "@ours.network/codex": {
-      "version": "1.2.0-nightly.3",
-      "integrity": "sha512-dIWDqbo6hJzujegHRO6x1SsBnh5p1c6gRGj/WkPha/hcN7s/27P4jqBnJ7czQyVGiNVFZ1aAxj4c9+CDLzHENw=="
+      "version": "1.2.0-nightly.10",
+      "integrity": "sha512-7hV4R0w8tiQ/JKFU5MxtM7fihd33tzWDgT+Bn8cidasxI5zmTLqDEIv6om5LM/xk7UqcPw5gDN2kcJYiybnP9Q=="
     },
     "@ours.network/claude-code": {
-      "version": "1.2.0-nightly.3",
-      "integrity": "sha512-7ta6KnvoHB2i/yoaykhXvzKFQTIOPtDHeTzG1PRwHjdTJ4vcGEh4jWYMd2c1jjj73lC3q9qW3LYSRutIJovtQg=="
+      "version": "1.2.0-nightly.10",
+      "integrity": "sha512-C3+H/vXespanVj9E1uQAWno9RFrI5KlK2SHSc7dnmRRuFVyRsoVcbvlpVI3nZ8snFaKVzbetebZr7vxd73AWSg=="
+    },
+    "@ours.network/daemon": {
+      "version": "3.8.1-nightly.7",
+      "integrity": "sha512-dDFDm+xERplzu4yXKvLjKGNaIdr9u4ku5/4jiI4g8do3qOX9VS0tF1+O67uSu4jqkypg860UdZRdn9Zce72H/A=="
+    }
+  },
+  "hostCli": {
+    "@ours.network/sdk": {
+      "version": "3.8.1-nightly.15",
+      "integrity": "sha512-ynKaKmKtINBqYk3kNovsgEO/3TiFY1CC9FgZzrOH+H6onnM3J//Q8cBb9sun8dl9mhB4mKZYgvneSiOejYwZUw=="
+    },
+    "@ours.network/cli": {
+      "version": "2.8.1-nightly.13",
+      "integrity": "sha512-1BeAG12vh4ruBOeJ54l60qWUhLzPLRNKnGtRiJpQmSXkamNQglrPQeXa9xW3taAM4Vg5uYgEhsz6+ieM+1TUSA=="
     }
   }
 }

package/assets/scripts/build/build-common.mjs

@@ -7,7 +7,8 @@ export const ROOT = resolve(process.env.OURS_BUILD_ROOT || '/opt/ours');
 export const SOURCE_ROOT = resolve(process.env.OURS_SOURCE_ROOT || '/src');
 export const OUT = join(ROOT, 'docker/vendor');
 export const CONFIG = JSON.parse(readFileSync(join(ROOT, 'sources.json'), 'utf8'));
-export const SELECTED = new Set((process.env.OURS_BUILD_PACKAGES || 'sdk,cli,mcp,tg-connector,cowork,messenger-server').split(',').map(name => '@ours.network/' + name));
+// Notifications joined the server set later; retained selections without it still build.
+export const SELECTED = new Set((process.env.OURS_BUILD_PACKAGES || ['sdk,cli,daemon,tg-connector,cowork,messenger-server', ...(CONFIG.packages?.['@ours.network/notifications'] ? ['notifications'] : [])].join(',')).split(',').map(name => '@ours.network/' + name));
 export const inheritedLock = process.env.OURS_INSTALLER_LOCK_FD === '3' ? [3] : [];
 export const run = (args, cwd) => execFileSync(args[0], args.slice(1), { cwd, stdio: ['inherit', 'inherit', 'inherit', ...inheritedLock] });
 export const capture = (args, cwd, env = process.env) => execFileSync(args[0], args.slice(1), { cwd, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit', ...inheritedLock] });

package/assets/scripts/build/build-sdk.mjs

@@ -2,8 +2,13 @@ import { join } from 'node:path';
 import { SOURCE_ROOT, SELECTED, pack, run } from './build-common.mjs';
 const source = join(SOURCE_ROOT, 'sdk');
 run(['npm', 'ci', '--no-audit', '--no-fund'], source);
-run(['bash', 'scripts/compile-mufl.sh'], source);
+if (SELECTED.has('@ours.network/daemon')) run(['bash', 'scripts/compile-mufl.sh'], source);
 run(['npm', 'run', 'build'], source);
 if (SELECTED.has('@ours.network/cli')) run(['npm', 'run', 'build:cli'], source);
 pack(source, '@ours.network/sdk', 'sdk');
 pack(join(source, 'packages/cli'), '@ours.network/cli', 'sdk');
+
+if (SELECTED.has('@ours.network/daemon')) {
+  run(['npm', 'run', 'build:daemon'], source);
+  pack(join(source, 'packages/daemon'), '@ours.network/daemon', 'sdk');
+}

package/assets/scripts/maintenance/build-context.mjs

@@ -8,7 +8,7 @@ import { semanticRecordEqual } from './provenance-compare.mjs';
 export const BASE_RECORDS = ['package-lock.json', 'dependency-tree.json'];
 export const CONTEXT = 'build-context.json';
 const admitted = new WeakMap();
-const packages = new Set(['sdk', 'cli', 'mcp', 'tg-connector', 'cowork', 'messenger-server', 'fleet', 'codex', 'claude-code', 'install'].map(n => '@ours.network/' + n));
+const packages = new Set(['sdk', 'cli', 'daemon', 'mcp', 'tg-connector', 'cowork', 'messenger-server', 'notifications', 'fleet', 'codex', 'claude-code', 'install'].map(n => '@ours.network/' + n));
 const digest = (bytes, algorithm = 'sha256', encoding = 'hex') => createHash(algorithm).update(bytes).digest(encoding);
 const fail = text => { throw new Error(`Build context: ${text}`); };
 const keys = (v, expected) => v && !Array.isArray(v) && typeof v === 'object' && Object.keys(v).sort().join('\0') === [...expected].sort().join('\0');

package/assets/scripts/maintenance/daemon-owner.mjs

@@ -0,0 +1,15 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Native callers provide an exact selected executable. Compose mounts the
+// selected runtime and supplies its bin directory, including retained releases.
+export function daemonOwner(env = process.env) {
+  if (env.OURS_CLI_PATH) return env.OURS_CLI_PATH;
+  const bin = env.OURS_DAEMON_BIN_DIR;
+  if (!bin) throw new Error('daemon maintenance requires its selected executable or bin directory');
+  const daemon = join(bin, 'ours-daemon');
+  if (existsSync(daemon)) return daemon;
+  const legacy = join(bin, 'ours');
+  if (existsSync(legacy)) return legacy;
+  throw new Error('selected runtime contains no daemon administrator');
+}

package/assets/scripts/maintenance/docker-layout-conversion.mjs

@@ -6,6 +6,8 @@ import { pathToFileURL } from 'node:url';
 import { copyPrivateTree, scanSource, createArchive, validateArchive } from './state-archive.mjs';
 import { publishNoReplace } from './state-native.mjs';
 
+import { daemonOwner } from './daemon-owner.mjs';
+
 const COMPONENTS = ['daemon', 'telegram', 'cowork', 'messenger'];
 import { recordNames, readBuildRecords, validateBuildRecordSet } from './build-context.mjs';
 const DAEMON_STATE = '/var/lib/ours';
@@ -113,12 +115,14 @@ export function validateDockerLayout(tree, options) {
     const config = join(tree, component, 'config.json');
     if (fs.existsSync(config)) objectAt(config, options);
   }
+  // Fresh managed installs keep the MCP profile separately until configured.
+  // Retained embedded configuration, when present, must still match exactly.
   const daemon = objectAt(join(tree, 'daemon/config.json'), options);
   const profile = objectAt(join(tree, 'mcp/profile.json'), options);
   validateProfile(profile, options.instanceId);
   if (daemon.stateDir !== DAEMON_STATE || daemon.port !== 3050
-    || daemon.networkMcp?.applicationConfigPath !== join(MCP_STATE, 'config.json')
-    || JSON.stringify(daemon.networkMcp.profile) !== JSON.stringify(profile)
+    || (daemon.networkMcp !== undefined && (daemon.networkMcp?.applicationConfigPath !== join(MCP_STATE, 'config.json')
+      || JSON.stringify(daemon.networkMcp?.profile) !== JSON.stringify(profile)))
     || objectAt(join(tree, 'cowork/config.json'), options).stateDir !== '/var/lib/ours-cowork') {
     throw new Error('Converted Docker deployment configuration is inconsistent');
   }
@@ -207,7 +211,7 @@ export async function runDockerLayoutCommand(argv, env = process.env) {
   const build = env.OURS_BUILD_ROOT || '/opt/ours';
   const options = {
     uid: process.getuid(), gid: process.getgid(), instanceId: env.OURS_DAEMON_ID,
-    cli: env.OURS_CLI_PATH || '/opt/ours/node_modules/.bin/ours',
+    cli: daemonOwner({ OURS_DAEMON_BIN_DIR: '/opt/ours/node_modules/.bin', ...env }),
     configPath: env.OURS_DAEMON_CONFIG || '/var/lib/ours/config.json',
     provenance: readBuildRecords(build),
   };

package/assets/scripts/maintenance/release-graph.mjs

@@ -20,10 +20,19 @@ export function releaseBinding(policy) {
   if (release?.schema !== 1 || !['stable', 'nightly'].includes(release.channel)) fail('invalid release binding');
   const pattern = release.channel === 'nightly' ? nightly : stable;
   if (typeof release.installerVersion !== 'string' || !pattern.test(release.installerVersion)) fail('invalid installer version/channel');
-  if (!release.packages || JSON.stringify(Object.keys(release.packages).sort()) !== JSON.stringify([...names].sort())) fail('release must select exactly nine ours packages');
+  if (release.scope !== undefined && release.scope !== 'host-cli') fail('invalid release scope');
+  const required = release.scope === 'host-cli' ? ['@ours.network/cli', '@ours.network/sdk'] : [...names, ...['@ours.network/daemon', '@ours.network/notifications'].filter(name => release.packages?.[name])];
+  if (!release.packages || JSON.stringify(Object.keys(release.packages).sort()) !== JSON.stringify([...required].sort())) fail('release must select exactly the required ours packages');
+  if (release.scope === 'host-cli' && Object.hasOwn(release, 'hostCli')) fail('nested host CLI selection');
   for (const [name, entry] of Object.entries(release.packages)) {
     if (typeof entry?.version !== 'string' || !pattern.test(entry.version) || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity ?? '')) fail(`invalid release artifact: ${name}`);
   }
+  if (Object.hasOwn(release, 'hostCli')) {
+    if (!release.hostCli || Object.keys(release.hostCli).sort().join(',') !== '@ours.network/cli,@ours.network/sdk') fail('host CLI must select exactly CLI and SDK');
+    for (const [name, entry] of Object.entries(release.hostCli)) {
+      if (typeof entry?.version !== 'string' || !pattern.test(entry.version) || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity ?? '')) fail(`invalid host CLI artifact: ${name}`);
+    }
+  }
   if (!policy.packages || !Object.keys(policy.packages).length) fail('missing release source selection');
   for (const [name, entry] of Object.entries(policy.packages)) {
     if (entry?.type !== 'npm' || entry.version !== release.packages[name]?.version || Object.keys(entry).sort().join(',') !== 'type,version') fail(`source selection differs from release: ${name}`);
@@ -92,3 +101,11 @@ export function verifyRuntimeRelease(root) {
   if (!existsSync(path)) return { verified: false, reason: 'legacy runtime without sources' };
   return verifyReleaseGraph(root, json(path));
 }
+
+/** The client command has its own exact dependency selection, never a graph bypass. */
+export function hostCliPolicy(policy) {
+  const release = releaseBinding(policy);
+  if (!release?.hostCli) return null;
+  const { hostCli, ...base } = release;
+  return { release: { ...base, scope: 'host-cli', packages: hostCli }, packages: Object.fromEntries(Object.entries(hostCli).map(([name, p]) => [name, { type: 'npm', version: p.version }])) };
+}

package/assets/scripts/maintenance/state-operation.mjs

@@ -9,6 +9,8 @@ import { createArchive, extractArchive, validateArchive, scanSource, copyPrivate
 import { exchange, tryLock, setMtimeNs } from './state-native.mjs';
 import { recordNames, readBuildRecords, equalBuildRecords, initializeBuildMarker } from './build-context.mjs';
 
+import { daemonOwner } from './daemon-owner.mjs';
+
 const PROVENANCE = '.ours-provenance';
 const APPLICATIONS = ['daemon', 'telegram', 'cowork', 'messenger'];
 const exists = path => { try { fs.lstatSync(path); return true; } catch (e) { if (e.code === 'ENOENT') return false; throw e; } };
@@ -145,9 +147,9 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
   }
   function retainAuthority(staging) {
     if (!['daemon', 'server'].includes(domain)) return;
-    if (!env.OURS_CLI_PATH || !env.OURS_DAEMON_CONFIG) fail('daemon maintenance requires its selected executable and configuration');
+    if (!env.OURS_DAEMON_CONFIG) fail('daemon maintenance requires its selected executable and configuration');
     const daemon = commonTree ? join(staging, 'daemon') : staging;
-    owner([env.OURS_CLI_PATH, 'config', 'access-retain', '--config', env.OURS_DAEMON_CONFIG, '--target-state-dir', daemon, '--json']);
+    owner([daemonOwner(env), 'config', 'access-retain', '--config', env.OURS_DAEMON_CONFIG, '--target-state-dir', daemon, '--json']);
     if (!commonTree) return;
     const credentials = join(live, 'credentials'), destination = join(staging, 'credentials');
     for (const name of ['telegram', 'cowork', 'messenger']) if (!privateStat(join(credentials, name, 'daemon-token'), false, 0o600).size) fail('current managed credential is empty');

package/assets/scripts/runtime/client-setup.mjs

@@ -1,8 +1,9 @@
 import { readBuildRecords, initializeBuildMarker } from '../maintenance/build-context.mjs';
+import { redactDiagnostic } from './diagnostics.mjs';
 import { spawnSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
+import { generateKeyPairSync, randomBytes } from 'node:crypto';
 import {
-  closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync,
+  existsSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync,
   realpathSync, renameSync, unlinkSync, writeFileSync, readdirSync, chmodSync, chownSync,
 } from 'node:fs';
 
@@ -12,6 +13,7 @@ const DELIVERY_FILES = [
   '/credentials/messenger/daemon-token',
 ];
 const fail = (message) => { throw new Error(message); };
+let diagnosticStage = 'validation';
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 function privatePath(path, directory, exact = directory ? 0o700 : 0o600) {
@@ -67,7 +69,7 @@ function validateCommon(idName = 'OURS_DAEMON_ID') {
 
 function composeConfig(domain) {
   if (domain === 'daemon') {
-    const value = { stateDir: '/var/lib/ours', port: 3050, apiVisibility: 'owner', networkMcp: { profile: { endpoint: 'http://127.0.0.1:3050', expectedInstanceId: process.env.OURS_DAEMON_ID, credentialPath: '/var/lib/ours/daemon-token' }, applicationConfigPath: '/var/lib/ours-mcp/config.json' } };
+    const value = { stateDir: '/var/lib/ours', port: 3050, apiVisibility: 'owner' };
     if (process.env.OURS_BROKER_URL) value.brokerUrl = process.env.OURS_BROKER_URL;
     return value;
   }
@@ -79,6 +81,61 @@ function composeConfig(domain) {
   return null;
 }
 
+const NOTIFICATIONS_PORT = 49677;
+const NOTIFICATION_FILES = {
+  config: '/storage/state/notifications/config.json',
+  messenger: '/storage/state/credentials/messenger/notifications-producer',
+  // Read through the Messenger service by local client setup.
+  fleet: '/storage/state/notifications/fleet-producer',
+};
+
+function privateText(path, value) {
+  if (existingPrivate(path, false) && readFileSync(path, 'utf8') === value) return;
+  const temp = `${path}.setup-${randomBytes(8).toString('hex')}`;
+  try { writeFileSync(temp, value, { encoding: 'utf8', mode: 0o600, flag: 'wx' }); renameSync(temp, path); }
+  finally { try { unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+}
+
+function notificationConfig() {
+  const token = () => randomBytes(32).toString('base64url');
+  const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const pub = publicKey.export({ format: 'jwk' }), key = privateKey.export({ format: 'jwk' });
+  const raw = Buffer.concat([Buffer.from([4]), Buffer.from(pub.x, 'base64url'), Buffer.from(pub.y, 'base64url')]);
+  return {
+    host: '0.0.0.0', port: NOTIFICATIONS_PORT, stateFile: '/var/lib/ours-notifications/state.json',
+    users: [{ userId: 'owner', token: token() }],
+    producers: [{ userId: 'owner', source: 'fleet', token: token() }, { userId: 'owner', source: 'messenger', token: token() }],
+    vapid: { subject: 'https://ours.network', publicKey: raw.toString('base64url'), privateKey: key.d },
+  };
+}
+
+/** Exact retained shape; any other content is operator state the installer will not rewrite. */
+function validNotificationConfig(config) {
+  const tokens = [...(config.users ?? []), ...(config.producers ?? [])].map(entry => entry?.token);
+  return config.host === '0.0.0.0' && config.port === NOTIFICATIONS_PORT && config.stateFile === '/var/lib/ours-notifications/state.json'
+    && Array.isArray(config.users) && config.users.length === 1 && config.users[0].userId === 'owner'
+    && Array.isArray(config.producers) && config.producers.length === 2
+    && ['fleet', 'messenger'].every(source => config.producers.some(p => p?.source === source && p.userId === 'owner'))
+    && tokens.every(t => typeof t === 'string' && t.length >= 32) && new Set(tokens).size === tokens.length
+    && typeof config.vapid?.subject === 'string' && /^[A-Za-z0-9_-]{87}$/.test(config.vapid.publicKey ?? '') && /^[A-Za-z0-9_-]{43}$/.test(config.vapid.privateKey ?? '');
+}
+
+/**
+ * Notification secrets are created once and then only validated: rotating the
+ * owner token or VAPID keys would orphan every browser subscription. Producer
+ * delivery files are derived from the retained configuration on every run.
+ */
+function prepareNotifications() {
+  // Messenger mounts this directory whether or not this runtime ships the service.
+  ensureDirectory('/storage/state/notifications');
+  if (!existsSync('/opt/ours/node_modules/@ours.network/notifications/package.json')) return;
+  initializeBuildMarker('/storage/state/notifications/.ours-provenance', readBuildRecords('/opt/ours'));
+  if (!existingPrivate(NOTIFICATION_FILES.config, false)) atomicJson(NOTIFICATION_FILES.config, notificationConfig());
+  const config = jsonObject(NOTIFICATION_FILES.config);
+  if (!validNotificationConfig(config)) fail('Existing notification configuration differs; use the supported maintenance workflow');
+  for (const source of ['messenger', 'fleet']) privateText(NOTIFICATION_FILES[source], config.producers.find(p => p.source === source).token);
+}
+
 function prepare() {
   const uid = Number(process.env.OURS_UID), gid = Number(process.env.OURS_GID);
   if (![uid, gid].every((n) => Number.isSafeInteger(n) && n > 0)) fail('Configure non-root numeric OURS_UID and OURS_GID');
@@ -123,15 +180,19 @@ function prepare() {
     const config = jsonObject(coworkPath);
     if (config.version !== 1 || config.stateDir !== cowork.stateDir || config.rest?.enabled !== true || config.rest?.host !== '0.0.0.0') fail('Existing cowork configuration conflicts with Compose');
   }
+  prepareNotifications();
   console.log('OURS persistent volumes are ready');
 }
 
 function finishDaemonSetup() {
   const state = '/var/lib/ours';
+  diagnosticStage = 'daemon-provenance';
   initializeBuildMarker(`${state}/.ours-provenance`, readBuildRecords('/opt/ours'));
+  diagnosticStage = 'mcp-directory';
   privatePath('/var/lib/ours-mcp', true);
   const mcpProfile = { endpoint: 'http://127.0.0.1:3050', expectedInstanceId: process.env.OURS_DAEMON_ID, credentialPath: `${state}/daemon-token` };
   const mcpPath = '/var/lib/ours-mcp/profile.json';
+  diagnosticStage = 'mcp-profile';
   if (!existingPrivate(mcpPath, false)) atomicJson(mcpPath, mcpProfile);
   else if (JSON.stringify(jsonObject(mcpPath)) !== JSON.stringify(mcpProfile)) fail('Existing MCP profile differs from the selected daemon');
 }
@@ -155,10 +216,19 @@ async function telegramInput() {
 }
 
 function cliJson(args) {
-  const result = spawnSync(process.execPath, ['/opt/ours/node_modules/@ours.network/cli/dist/cli.js', ...args], {
+  diagnosticStage = 'official-cli';
+  const result = spawnSync(process.execPath, [existsSync('/opt/ours/node_modules/@ours.network/daemon/dist/cli.js') ? '/opt/ours/node_modules/@ours.network/daemon/dist/cli.js' : '/opt/ours/node_modules/@ours.network/cli/dist/cli.js', ...args], {
     encoding: 'utf8', timeout: 60_000, maxBuffer: 1024 * 1024,
   });
-  if (result.status !== 0) fail('Official OURS CLI operation failed');
+  if (result.error || result.status !== 0) {
+    // --json writes failures on stderr. Successful credential stdout is never
+    // forwarded, even if a later operation exits unsuccessfully.
+    let reason = 'CLI supplied no structured error reason';
+    for (const line of String(result.stderr ?? '').split('\n').reverse()) {
+      try { const value = JSON.parse(line); if (typeof value?.error?.message === 'string') { reason = value.error.message; break; } } catch {}
+    }
+    fail(`Official OURS CLI operation failed (${args[1]}; exit=${result.status ?? 'none'}; signal=${result.signal ?? 'none'}; system=${result.error?.code ?? 'none'}): ${reason}`);
+  }
   try { return JSON.parse(result.stdout); }
   catch { fail('Official OURS CLI returned malformed JSON'); }
 }
@@ -192,6 +262,10 @@ try {
   else if (['access-init', 'access-issue', 'access-replace'].includes(operation)) access(operation, process.argv[3]);
   else fail('usage: client-setup.mjs prepare | telegram-input | access-init | access-issue [OUTPUT] | access-replace');
 } catch (error) {
-  console.error(`OURS client setup refused: ${error.message}`);
+  // Structured stderr retains the failing stage across sensitive Compose
+  // capture. The installer redacts secrets before exposing this envelope.
+  const message = redactDiagnostic(error.message);
+  console.error(JSON.stringify({ oursInstallerError: { stage: diagnosticStage, message } }));
+  console.error(`OURS client setup refused: ${message}`);
   process.exit(1);
 }

package/assets/scripts/runtime/diagnostics.mjs

@@ -0,0 +1,72 @@
+/** Retain actionable failure details without emitting credential output. */
+export function redactDiagnostic(value, env = process.env) {
+  let text = String(value ?? '').replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, '').replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
+  for (const [key, secret] of Object.entries(env)) {
+    if (/(?:token|password|secret|api.?key|private.?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)/i.test(key) && typeof secret === 'string' && secret)
+      text = text.split(secret).join('[redacted]');
+  }
+  return text
+    .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, '[redacted private key]')
+    .replace(/(Bearer\s+)[^\s"',;]+/gi, '$1[redacted]')
+    .replace(/((?:["']?(?:api[-_]?token|token|password|secret|api[-_]?key|private[-_]?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)["']?)\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;}]+)/gi, '$1[redacted]')
+    .replace(/(--(?:setup-workspace|password|token|secret|api-key|private-key|invitation|enrollment)(?:=|\s+))\S+/gi, '$1[redacted]')
+    .replace(/(https?:\/\/)[^\s/@:]+:[^\s/@]+@/g, '$1[redacted]@')
+    .replace(/\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, '[redacted credential]')
+    .replace(/[A-Za-z0-9_+/=-]{43,}/g, '[redacted opaque value]');
+}
+
+const bounded = text => text.length <= 65536 ? text : text.slice(0, 65536) + '\n[Diagnostic output exceeds 64 KiB; remainder omitted.]';
+function credentialFailure(stderr) {
+  // Credential stdout can be a successful issuance followed by failure: never
+  // include it. Only a structured error envelope or shipped helper refusal is
+  // accepted from stderr; arbitrary lines/warnings remain private.
+  const lines = String(stderr ?? '').split('\n').reverse();
+  for (const line of lines) {
+    try {
+      const value = JSON.parse(line);
+      if (typeof value?.oursInstallerError?.message === 'string') {
+        const detail = value.oursInstallerError;
+        const stage = /^[a-z][a-z-]{0,40}$/.test(detail.stage ?? '') ? detail.stage : 'credential-operation';
+        return `Stage: ${stage}\nReason: ${detail.message}`;
+      }
+      if (typeof value?.error?.message === 'string') return `Reason: ${value.error.message}`;
+    } catch {}
+  }
+  const prefix = 'OURS client setup refused: ';
+  const legacy = lines.find(line => line.startsWith(prefix));
+  if (legacy) return `Reason: ${legacy.slice(prefix.length)}`;
+  return 'The credential operation provided no structured reason. Its raw output was withheld because it can contain credentials.';
+}
+
+export function commandFailure(command, args, result, { sensitive = false, cwd, env = process.env } = {}) {
+  const visibleArgs = [...args];
+  if (sensitive) {
+    for (let i = 0; i < visibleArgs.length - 1; i++) if (['-e', '--eval'].includes(visibleArgs[i])) visibleArgs[i + 1] = '[captured installer helper]';
+  }
+  const details = [`Command: ${command} ${visibleArgs.join(' ')}${result.status != null ? ` exited ${result.status}` : ''}`];
+  if (cwd) details.push(`Working directory: ${cwd}`);
+  if (result.status !== null && result.status !== undefined) details.push(`Exit code: ${result.status}`);
+  if (result.signal) details.push(`Signal: ${result.signal}`);
+  if (result.error?.code) details.push(`System error: ${result.error.code}`);
+  if (result.error?.code === 'ETIMEDOUT') details.push('Reason: command timed out.');
+  if (sensitive) details.push(credentialFailure(result.stderr));
+  else {
+    const stderr = String(result.stderr ?? '').trim(), stdout = String(result.stdout ?? '').trim();
+    if (stderr) details.push(`Standard error:\n${stderr}`);
+    if (stdout) details.push(`Standard output:\n${stdout}`);
+    if (!stderr && !stdout) details.push('No captured command output. Streaming commands print their output above.');
+  }
+  details.push('Keep installation data intact. Include this error and the preceding installation stage when requesting help.');
+  return new Error(bounded(redactDiagnostic(details.join('\n'), env)), result.error ? { cause: result.error } : undefined);
+}
+
+export function installerFailure(error, env = process.env) {
+  const details = []; const seen = new Set();
+  for (let cause = error; cause && !seen.has(cause) && seen.size < 8; cause = cause.cause) {
+    seen.add(cause);
+    const message = cause instanceof Error ? cause.message : String(cause);
+    if (!details.includes(message)) details.push(message);
+    if (typeof cause.code === 'string' && /^[A-Z_0-9]+$/.test(cause.code)) details.push(`System error: ${cause.code}`);
+  }
+  return bounded(redactDiagnostic(details.join('\nCaused by: '), env));
+}

package/assets/scripts/runtime/entrypoint.sh

@@ -10,4 +10,4 @@ else
   exit "$status"
 fi
 node /opt/ours/docker/check-start.mjs
-exec node /opt/ours/node_modules/@ours.network/cli/dist/cli.js daemon serve
+exec node /opt/ours/node_modules/@ours.network/daemon/dist/cli.js serve

package/assets/scripts/runtime/health-messenger.mjs

@@ -1,6 +1,7 @@
-try {
-  const response = await fetch('http://127.0.0.1:8420/api/healthz', {
-    signal: AbortSignal.timeout(3000), redirect: 'error',
-  });
-  process.exitCode = response.ok ? 0 : 1;
-} catch { process.exitCode = 1; }
+import { existsSync } from 'node:fs';
+
+const healthy = async url => {
+  try { return (await fetch(url, { signal: AbortSignal.timeout(3000), redirect: 'error' })).ok; } catch { return false; }
+};
+const notifications = process.env.OURS_NOTIFICATIONS_CONFIG && existsSync('/opt/ours/node_modules/@ours.network/notifications/package.json') && existsSync(process.env.OURS_NOTIFICATIONS_CONFIG);
+process.exitCode = await healthy('http://127.0.0.1:8420/api/healthz') && (!notifications || await healthy('http://127.0.0.1:49677/healthz')) ? 0 : 1;

package/assets/scripts/runtime/notifications-gateway.mjs

@@ -0,0 +1,82 @@
+import { createServer, request } from 'node:http';
+import { pathToFileURL } from 'node:url';
+import { readFileSync, statSync } from 'node:fs';
+
+/** Browser context has no authority at the notification service. */
+const BROWSER = ['cookie', 'origin', 'sec-fetch-site', 'sec-fetch-mode', 'sec-fetch-dest', 'sec-fetch-user'];
+const SERVER_CREDENTIAL = 'x-ours-api-token', PRODUCER = 'x-ours-notifications-producer';
+
+/** Ask the daemon, exactly like the gateway's auth_request, whether a server API credential is valid. */
+export function daemonCredentialCheck(daemonUrl) {
+  return token => new Promise(resolve => {
+    const req = request(new URL('/identities', daemonUrl), { method: 'GET', headers: { [SERVER_CREDENTIAL]: token }, timeout: 5000 }, res => {
+      res.resume(); resolve(res.statusCode >= 200 && res.statusCode < 300);
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', () => resolve(false));
+    req.end();
+  });
+}
+
+/**
+ * Front the notification service with the server's own authentication.
+ * A request carrying a server API credential is checked with the daemon; only then
+ * does it act as this installation's owner (or, for /api/v1/send, as the named
+ * producer). A request without one keeps its own Authorization, which the service
+ * checks against its scoped tokens. Nothing is injected for an unauthenticated caller.
+ */
+export function createNotificationsAdapter({ service, userToken, verifyServerCredential }) {
+  const authorize = async (req) => {
+    for (const name of BROWSER) delete req.headers[name];
+    const credential = req.headers[SERVER_CREDENTIAL], producer = req.headers[PRODUCER];
+    delete req.headers[SERVER_CREDENTIAL]; delete req.headers[PRODUCER];
+    if (credential === undefined) return producer === undefined;
+    if (typeof credential !== 'string' || !credential || !await verifyServerCredential(credential)) return false;
+    const path = new URL(req.url ?? '/', 'http://localhost').pathname;
+    if (producer !== undefined && !(req.method === 'POST' && path === '/api/v1/send')) return false;
+    req.headers.authorization = `Bearer ${producer ?? userToken}`;
+    return true;
+  };
+  const server = createServer(async (req, res) => {
+    if (req.url === '/healthz' && req.method === 'GET') { res.writeHead(200, { 'content-type': 'application/json' }); res.end('{"ok":true}'); return; }
+    if (!await authorize(req)) { res.writeHead(401, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end('{"error":"authentication required"}'); return; }
+    service.server.emit('request', req, res);
+  });
+  // Upgraded connections leave the HTTP server's connection tracking, so shutdown ends them itself.
+  const upgraded = new Set();
+  server.on('upgrade', async (req, socket, head) => {
+    upgraded.add(socket); socket.once('close', () => upgraded.delete(socket));
+    if (!await authorize(req)) { socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\nContent-Length: 0\r\n\r\n'); return; }
+    service.server.emit('upgrade', req, socket, head);
+  });
+  return { server, async close() {
+    // Stop accepting first; the service then ends its presence sockets and saves state.
+    const listening = new Promise(resolve => server.close(() => resolve()));
+    server.closeAllConnections();
+    await service.close();
+    for (const socket of upgraded) socket.destroy();
+    await listening;
+  } };
+}
+
+/** The installer-generated private configuration also names the owner token this adapter injects. */
+export function readPrivateConfig(path) {
+  const stat = statSync(path);
+  if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid()) throw new Error('Notification configuration must be a private owner file');
+  const config = JSON.parse(readFileSync(path, 'utf8'));
+  if (!Array.isArray(config.users) || config.users.length !== 1 || typeof config.users[0]?.token !== 'string') throw new Error('Notification configuration must select one owner');
+  return config;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  const config = readPrivateConfig(process.env.OURS_NOTIFICATIONS_CONFIG ?? '/var/lib/ours-notifications/config.json');
+  const { createNotificationService } = await import('/opt/ours/node_modules/@ours.network/notifications/dist/server.js');
+  const adapter = createNotificationsAdapter({
+    service: createNotificationService(config),
+    userToken: config.users[0].token,
+    verifyServerCredential: daemonCredentialCheck(process.env.OURS_DAEMON_URL ?? 'http://daemon:3050'),
+  });
+  await new Promise((resolve, reject) => { adapter.server.once('error', reject); adapter.server.listen(config.port, config.host, resolve); });
+  console.log('Notification service ready');
+  for (const signal of ['SIGTERM', 'SIGINT']) process.once(signal, async () => { await adapter.close(); process.exit(0); });
+}

package/assets/scripts/runtime/start-messenger.sh

@@ -1,6 +1,27 @@
 #!/bin/sh
+set -e
 umask 077
-exec 3</var/lib/ours-messenger
-flock -n 3
-node /opt/ours/docker/check-client.mjs messenger
-exec node /opt/ours/node_modules/@ours.network/messenger-server/dist/cli.js serve
+runtime="${OURS_RUNTIME_ROOT:-/opt/ours}"
+state="${OURS_MESSENGER_STATE_DIR:-/var/lib/ours-messenger}"
+exec 3<"$state"
+flock -n 3 || { echo "OURS Messenger state is in use by another writer" >&2; exit 1; }
+node "$runtime/docker/check-client.mjs" messenger
+messenger="[\"node\",\"$runtime/node_modules/@ours.network/messenger-server/dist/cli.js\",\"serve\"]"
+# Notifications run beside Messenger when this runtime ships the service and
+# its private configuration was prepared. Messenger's producer reaches it on loopback.
+config="${OURS_NOTIFICATIONS_CONFIG:-}"
+if [ -n "$config" ] && [ -f "$runtime/node_modules/@ours.network/notifications/package.json" ] && [ -f "$config" ]; then
+  notifications="$(dirname "$config")"
+  exec 4<"$notifications"
+  # Every writer of this state starts here and holds lock 4 for its lifetime;
+  # the kernel releases it when the process dies, even on SIGKILL. Holding it
+  # proves no other writer is alive, so a lock file left by an abrupt stop is stale.
+  flock -n 4 || { echo "OURS notification state is in use by another writer" >&2; exit 1; }
+  rm -f "$notifications/state.json.lock"
+  OURS_NOTIFICATIONS_ORIGIN="http://127.0.0.1:49677"
+  OURS_NOTIFICATIONS_PRODUCER_TOKEN="$(cat "${OURS_NOTIFICATIONS_PRODUCER_FILE:-/credentials/messenger/notifications-producer}")"
+  export OURS_NOTIFICATIONS_ORIGIN OURS_NOTIFICATIONS_PRODUCER_TOKEN
+  # Only Messenger receives its producer credential.
+  exec node "$runtime/docker/supervise.mjs" "[$messenger,[\"env\",\"-u\",\"OURS_NOTIFICATIONS_PRODUCER_TOKEN\",\"node\",\"$runtime/docker/notifications-gateway.mjs\"]]"
+fi
+exec node "$runtime/node_modules/@ours.network/messenger-server/dist/cli.js" serve

package/assets/scripts/runtime/supervise.mjs

@@ -0,0 +1,35 @@
+import { spawn } from 'node:child_process';
+
+/**
+ * Run the given commands as one unit: signals reach every child, and when any
+ * child exits (or cannot start) the others are stopped and the container exits
+ * with its status, so a failure is visible and recovers through the container's
+ * own restart. A child ignoring SIGTERM is killed after a bounded grace period,
+ * within Compose's stop grace period.
+ */
+const commands = JSON.parse(process.argv[2] ?? '[]');
+if (!Array.isArray(commands) || !commands.length || !commands.every(c => Array.isArray(c) && c.length && c.every(a => typeof a === 'string'))) {
+  console.error('usage: supervise.mjs JSON-ARRAY-OF-COMMANDS'); process.exit(2);
+}
+const killAfter = Number(process.env.OURS_SUPERVISE_KILL_AFTER_MS ?? 20_000);
+let stopping = false, status = 0, remaining = commands.length;
+const children = [];
+const running = child => child.exitCode === null && child.signalCode === null && !child.failed;
+const stop = signal => {
+  for (const child of children) if (running(child)) child.kill(signal);
+  if (signal !== 'SIGKILL') setTimeout(() => stop('SIGKILL'), killAfter);
+};
+const finished = (child, code, reason) => {
+  if (child.done) return;
+  child.done = true;
+  if (!stopping) { stopping = true; status = code; console.error(`Supervised process ${child.spawnfile} ${reason}; stopping the others`); stop('SIGTERM'); }
+  if (--remaining === 0) process.exit(status);
+};
+for (const signal of ['SIGTERM', 'SIGINT']) process.on(signal, () => { if (!stopping) { stopping = true; stop(signal); } });
+// Inherited descriptors 3 and 4 are the state-directory locks; every child holds them too.
+for (const [file, ...args] of commands) {
+  const child = spawn(file, args, { stdio: ['inherit', 'inherit', 'inherit', 'inherit', 'inherit'] });
+  children.push(child);
+  child.on('error', error => { child.failed = true; finished(child, 1, `could not start (${error.code ?? 'error'})`); });
+  child.on('exit', (code, signal) => finished(child, code ?? 1, `exited (${signal ?? code})`));
+}