@ours.network/install 1.2.1-nightly.30 → 1.2.1-nightly.31

package/README.md

@@ -384,6 +384,39 @@ when proxying. A compatible release must contain these capabilities:
 `telegram.gateway-listener-v1`. Older releases are rejected without enabling the
 new listener; no package version is silently substituted.
 
+### Notifications
+
+When the selected release includes `@ours.network/notifications`, gateway
+installations run it inside the Messenger container, under one supervisor with
+Messenger: a signal stops both, and either one exiting stops the container so
+its normal restart recovers both. It publishes no host port. The gateway routes
+`<serverUrl>/notifications/` to it after the same daemon credential check as
+Telegram, and the service's adapter checks that credential again before acting
+as the installation owner. Browser cookies, origins and fetch metadata are
+removed. Messenger produces message notifications over loopback.
+
+`prepare` creates the private configuration once in
+`storage/state/notifications/config.json`: the owner token, separate Fleet and
+Messenger producer tokens, and VAPID keys. Later runs only validate it; rotating
+the owner token or VAPID keys would orphan every browser subscription, so a
+differing configuration is refused rather than rewritten. Back it up with the
+rest of the server state. A local client setup binds the Fleet producer token
+to this server in `~/.ours-client/notifications-producer.json`; Fleet then sends
+agent completions through `<serverUrl>/notifications/`. Remote clients and
+native installations do not produce notifications. The gateway discovery
+document is unchanged, so existing clients keep accepting the server. A
+retained source policy without the package keeps working without notifications.
+
+An existing complete installation gains them with its normal update, which
+prepares the credentials after activating the new runtime and hands the Fleet
+producer credential to the local client, then a web-only Fleet restart (agents
+keep running):
+
+```sh
+ours-install all update --mode docker --state-dir /private/ours --identity-name "Your Name" --integrations codex,fleet --fleet-settings /private/fleet.json --compatible
+ours-fleet web restart
+```
+
 ### Authenticated external entry
 
 Messenger has no application authentication. Loopback access trusts local users;
@@ -591,4 +624,4 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.38` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, separate `ours-fleet setup-tunnel` and `ours-fleet link-device` commands, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.39` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, separate `ours-fleet setup-tunnel` and `ours-fleet link-device` commands, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.

package/assets/Dockerfile

@@ -27,7 +27,7 @@ COPY --chmod=644 scripts/runtime/diagnostics.mjs /opt/ours/docker/diagnostics.mj
 COPY --chmod=644 scripts/runtime/legacy-import.mjs /opt/ours/docker/legacy-import.mjs
 COPY --chmod=644 scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
 COPY --chmod=644 scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs
-COPY --chmod=644 scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs /opt/ours/docker/
+COPY --chmod=644 scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs scripts/runtime/notifications-gateway.mjs scripts/runtime/supervise.mjs /opt/ours/docker/
 RUN chmod 755 /opt/ours/maintenance /opt/ours/docker
 FROM node:24 AS maintenance
 LABEL network.ours.build-context="1"

package/assets/docker-compose.yaml

@@ -164,8 +164,11 @@ services:
       OURS_MESSENGER_PORT: "8420"
       OURS_MESSENGER_PUBLIC_ORIGIN: "http://127.0.0.1:${OURS_MESSENGER_PORT:-8420}"
       OURS_MESSENGER_STATE_DIR: /var/lib/ours-messenger
+      # Started beside Messenger when the runtime ships @ours.network/notifications.
+      OURS_NOTIFICATIONS_CONFIG: /var/lib/ours-notifications/config.json
     volumes:
       - {type: volume, source: server-storage, target: /var/lib/ours-messenger, volume: {nocopy: true, subpath: state/messenger}}
+      - {type: volume, source: server-storage, target: /var/lib/ours-notifications, volume: {nocopy: true, subpath: state/notifications}}
       - {type: volume, source: server-storage, target: /credentials/messenger, read_only: true, volume: {nocopy: true, subpath: state/credentials/messenger}}
     ports:
       - {target: 8420, published: "${OURS_MESSENGER_PORT:-8420}", host_ip: 127.0.0.1}

package/assets/release-lock.json

@@ -13,9 +13,10 @@
         "@ours.network/codex": "1.2.0-nightly.10",
         "@ours.network/cowork": "1.3.3-nightly.20261001.6d49d3a",
         "@ours.network/daemon": "3.8.1-nightly.7",
-        "@ours.network/fleet": "1.2.0-nightly.38",
+        "@ours.network/fleet": "1.2.0-nightly.39",
         "@ours.network/mcp": "1.2.0-nightly.10",
         "@ours.network/messenger-server": "1.0.31-nightly.14",
+        "@ours.network/notifications": "0.3.1-nightly.1",
         "@ours.network/sdk": "3.8.1-nightly.15",
         "@ours.network/tg-connector": "1.0.1-nightly.9"
       }
@@ -1000,9 +1001,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.38",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.38.tgz",
-      "integrity": "sha512-glCDY/WfILgTJfG7G3ao5iEtCyWtyPOzl/o+D1EVphUuKQYZIW7Xk8sxyT2/D8FADRqvJSBbebWseWbgmlU6Ow==",
+      "version": "1.2.0-nightly.39",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.39.tgz",
+      "integrity": "sha512-ixcky/b22x2slW+NmPz2BVQVLFV+jkTFzRGFKpDLug2mugk6xIJiVyY50o8G5c+JXAjB+EN9pzIIrTH21Y48BA==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",
@@ -1064,6 +1065,22 @@
         "node": ">=22"
       }
     },
+    "node_modules/@ours.network/notifications": {
+      "version": "0.3.1-nightly.1",
+      "resolved": "https://registry.npmjs.org/@ours.network/notifications/-/notifications-0.3.1-nightly.1.tgz",
+      "integrity": "sha512-rIkrtixoHqBfgCKDDCEYFl4W2Zzh0hOw3axX2+GppQ9gYkujKrk9M2KLGoYhu8RwwTMRl497jgMcTBe7UAHCgA==",
+      "license": "FSL-1.1-Apache-2.0",
+      "dependencies": {
+        "web-push": "3.6.7",
+        "ws": "8.22.0"
+      },
+      "bin": {
+        "ours-notifications": "dist/cli.js"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
     "node_modules/@ours.network/sdk": {
       "version": "3.8.1-nightly.15",
       "resolved": "https://registry.npmjs.org/@ours.network/sdk/-/sdk-3.8.1-nightly.15.tgz",

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.30",
+  "installerVersion": "1.2.1-nightly.31",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.15",
@@ -23,9 +23,13 @@
       "version": "1.0.31-nightly.14",
       "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg=="
     },
+    "@ours.network/notifications": {
+      "version": "0.3.1-nightly.1",
+      "integrity": "sha512-rIkrtixoHqBfgCKDDCEYFl4W2Zzh0hOw3axX2+GppQ9gYkujKrk9M2KLGoYhu8RwwTMRl497jgMcTBe7UAHCgA=="
+    },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.38",
-      "integrity": "sha512-glCDY/WfILgTJfG7G3ao5iEtCyWtyPOzl/o+D1EVphUuKQYZIW7Xk8sxyT2/D8FADRqvJSBbebWseWbgmlU6Ow=="
+      "version": "1.2.0-nightly.39",
+      "integrity": "sha512-ixcky/b22x2slW+NmPz2BVQVLFV+jkTFzRGFKpDLug2mugk6xIJiVyY50o8G5c+JXAjB+EN9pzIIrTH21Y48BA=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.10",

package/assets/scripts/build/build-common.mjs

@@ -7,7 +7,8 @@ export const ROOT = resolve(process.env.OURS_BUILD_ROOT || '/opt/ours');
 export const SOURCE_ROOT = resolve(process.env.OURS_SOURCE_ROOT || '/src');
 export const OUT = join(ROOT, 'docker/vendor');
 export const CONFIG = JSON.parse(readFileSync(join(ROOT, 'sources.json'), 'utf8'));
-export const SELECTED = new Set((process.env.OURS_BUILD_PACKAGES || 'sdk,cli,daemon,tg-connector,cowork,messenger-server').split(',').map(name => '@ours.network/' + name));
+// Notifications joined the server set later; retained selections without it still build.
+export const SELECTED = new Set((process.env.OURS_BUILD_PACKAGES || ['sdk,cli,daemon,tg-connector,cowork,messenger-server', ...(CONFIG.packages?.['@ours.network/notifications'] ? ['notifications'] : [])].join(',')).split(',').map(name => '@ours.network/' + name));
 export const inheritedLock = process.env.OURS_INSTALLER_LOCK_FD === '3' ? [3] : [];
 export const run = (args, cwd) => execFileSync(args[0], args.slice(1), { cwd, stdio: ['inherit', 'inherit', 'inherit', ...inheritedLock] });
 export const capture = (args, cwd, env = process.env) => execFileSync(args[0], args.slice(1), { cwd, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit', ...inheritedLock] });

package/assets/scripts/maintenance/build-context.mjs

@@ -8,7 +8,7 @@ import { semanticRecordEqual } from './provenance-compare.mjs';
 export const BASE_RECORDS = ['package-lock.json', 'dependency-tree.json'];
 export const CONTEXT = 'build-context.json';
 const admitted = new WeakMap();
-const packages = new Set(['sdk', 'cli', 'daemon', 'mcp', 'tg-connector', 'cowork', 'messenger-server', 'fleet', 'codex', 'claude-code', 'install'].map(n => '@ours.network/' + n));
+const packages = new Set(['sdk', 'cli', 'daemon', 'mcp', 'tg-connector', 'cowork', 'messenger-server', 'notifications', 'fleet', 'codex', 'claude-code', 'install'].map(n => '@ours.network/' + n));
 const digest = (bytes, algorithm = 'sha256', encoding = 'hex') => createHash(algorithm).update(bytes).digest(encoding);
 const fail = text => { throw new Error(`Build context: ${text}`); };
 const keys = (v, expected) => v && !Array.isArray(v) && typeof v === 'object' && Object.keys(v).sort().join('\0') === [...expected].sort().join('\0');

package/assets/scripts/maintenance/release-graph.mjs

@@ -21,7 +21,7 @@ export function releaseBinding(policy) {
   const pattern = release.channel === 'nightly' ? nightly : stable;
   if (typeof release.installerVersion !== 'string' || !pattern.test(release.installerVersion)) fail('invalid installer version/channel');
   if (release.scope !== undefined && release.scope !== 'host-cli') fail('invalid release scope');
-  const required = release.scope === 'host-cli' ? ['@ours.network/cli', '@ours.network/sdk'] : [...names, ...(release.packages?.['@ours.network/daemon'] ? ['@ours.network/daemon'] : [])];
+  const required = release.scope === 'host-cli' ? ['@ours.network/cli', '@ours.network/sdk'] : [...names, ...['@ours.network/daemon', '@ours.network/notifications'].filter(name => release.packages?.[name])];
   if (!release.packages || JSON.stringify(Object.keys(release.packages).sort()) !== JSON.stringify([...required].sort())) fail('release must select exactly the required ours packages');
   if (release.scope === 'host-cli' && Object.hasOwn(release, 'hostCli')) fail('nested host CLI selection');
   for (const [name, entry] of Object.entries(release.packages)) {

package/assets/scripts/runtime/client-setup.mjs

@@ -1,7 +1,7 @@
 import { readBuildRecords, initializeBuildMarker } from '../maintenance/build-context.mjs';
 import { redactDiagnostic } from './diagnostics.mjs';
 import { spawnSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
+import { generateKeyPairSync, randomBytes } from 'node:crypto';
 import {
   existsSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync,
   realpathSync, renameSync, unlinkSync, writeFileSync, readdirSync, chmodSync, chownSync,
@@ -81,6 +81,61 @@ function composeConfig(domain) {
   return null;
 }
 
+const NOTIFICATIONS_PORT = 49677;
+const NOTIFICATION_FILES = {
+  config: '/storage/state/notifications/config.json',
+  messenger: '/storage/state/credentials/messenger/notifications-producer',
+  // Read through the Messenger service by local client setup.
+  fleet: '/storage/state/notifications/fleet-producer',
+};
+
+function privateText(path, value) {
+  if (existingPrivate(path, false) && readFileSync(path, 'utf8') === value) return;
+  const temp = `${path}.setup-${randomBytes(8).toString('hex')}`;
+  try { writeFileSync(temp, value, { encoding: 'utf8', mode: 0o600, flag: 'wx' }); renameSync(temp, path); }
+  finally { try { unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+}
+
+function notificationConfig() {
+  const token = () => randomBytes(32).toString('base64url');
+  const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const pub = publicKey.export({ format: 'jwk' }), key = privateKey.export({ format: 'jwk' });
+  const raw = Buffer.concat([Buffer.from([4]), Buffer.from(pub.x, 'base64url'), Buffer.from(pub.y, 'base64url')]);
+  return {
+    host: '0.0.0.0', port: NOTIFICATIONS_PORT, stateFile: '/var/lib/ours-notifications/state.json',
+    users: [{ userId: 'owner', token: token() }],
+    producers: [{ userId: 'owner', source: 'fleet', token: token() }, { userId: 'owner', source: 'messenger', token: token() }],
+    vapid: { subject: 'https://ours.network', publicKey: raw.toString('base64url'), privateKey: key.d },
+  };
+}
+
+/** Exact retained shape; any other content is operator state the installer will not rewrite. */
+function validNotificationConfig(config) {
+  const tokens = [...(config.users ?? []), ...(config.producers ?? [])].map(entry => entry?.token);
+  return config.host === '0.0.0.0' && config.port === NOTIFICATIONS_PORT && config.stateFile === '/var/lib/ours-notifications/state.json'
+    && Array.isArray(config.users) && config.users.length === 1 && config.users[0].userId === 'owner'
+    && Array.isArray(config.producers) && config.producers.length === 2
+    && ['fleet', 'messenger'].every(source => config.producers.some(p => p?.source === source && p.userId === 'owner'))
+    && tokens.every(t => typeof t === 'string' && t.length >= 32) && new Set(tokens).size === tokens.length
+    && typeof config.vapid?.subject === 'string' && /^[A-Za-z0-9_-]{87}$/.test(config.vapid.publicKey ?? '') && /^[A-Za-z0-9_-]{43}$/.test(config.vapid.privateKey ?? '');
+}
+
+/**
+ * Notification secrets are created once and then only validated: rotating the
+ * owner token or VAPID keys would orphan every browser subscription. Producer
+ * delivery files are derived from the retained configuration on every run.
+ */
+function prepareNotifications() {
+  // Messenger mounts this directory whether or not this runtime ships the service.
+  ensureDirectory('/storage/state/notifications');
+  if (!existsSync('/opt/ours/node_modules/@ours.network/notifications/package.json')) return;
+  initializeBuildMarker('/storage/state/notifications/.ours-provenance', readBuildRecords('/opt/ours'));
+  if (!existingPrivate(NOTIFICATION_FILES.config, false)) atomicJson(NOTIFICATION_FILES.config, notificationConfig());
+  const config = jsonObject(NOTIFICATION_FILES.config);
+  if (!validNotificationConfig(config)) fail('Existing notification configuration differs; use the supported maintenance workflow');
+  for (const source of ['messenger', 'fleet']) privateText(NOTIFICATION_FILES[source], config.producers.find(p => p.source === source).token);
+}
+
 function prepare() {
   const uid = Number(process.env.OURS_UID), gid = Number(process.env.OURS_GID);
   if (![uid, gid].every((n) => Number.isSafeInteger(n) && n > 0)) fail('Configure non-root numeric OURS_UID and OURS_GID');
@@ -125,6 +180,7 @@ function prepare() {
     const config = jsonObject(coworkPath);
     if (config.version !== 1 || config.stateDir !== cowork.stateDir || config.rest?.enabled !== true || config.rest?.host !== '0.0.0.0') fail('Existing cowork configuration conflicts with Compose');
   }
+  prepareNotifications();
   console.log('OURS persistent volumes are ready');
 }
 

package/assets/scripts/runtime/health-messenger.mjs

@@ -1,6 +1,7 @@
-try {
-  const response = await fetch('http://127.0.0.1:8420/api/healthz', {
-    signal: AbortSignal.timeout(3000), redirect: 'error',
-  });
-  process.exitCode = response.ok ? 0 : 1;
-} catch { process.exitCode = 1; }
+import { existsSync } from 'node:fs';
+
+const healthy = async url => {
+  try { return (await fetch(url, { signal: AbortSignal.timeout(3000), redirect: 'error' })).ok; } catch { return false; }
+};
+const notifications = process.env.OURS_NOTIFICATIONS_CONFIG && existsSync('/opt/ours/node_modules/@ours.network/notifications/package.json') && existsSync(process.env.OURS_NOTIFICATIONS_CONFIG);
+process.exitCode = await healthy('http://127.0.0.1:8420/api/healthz') && (!notifications || await healthy('http://127.0.0.1:49677/healthz')) ? 0 : 1;

package/assets/scripts/runtime/notifications-gateway.mjs

@@ -0,0 +1,82 @@
+import { createServer, request } from 'node:http';
+import { pathToFileURL } from 'node:url';
+import { readFileSync, statSync } from 'node:fs';
+
+/** Browser context has no authority at the notification service. */
+const BROWSER = ['cookie', 'origin', 'sec-fetch-site', 'sec-fetch-mode', 'sec-fetch-dest', 'sec-fetch-user'];
+const SERVER_CREDENTIAL = 'x-ours-api-token', PRODUCER = 'x-ours-notifications-producer';
+
+/** Ask the daemon, exactly like the gateway's auth_request, whether a server API credential is valid. */
+export function daemonCredentialCheck(daemonUrl) {
+  return token => new Promise(resolve => {
+    const req = request(new URL('/identities', daemonUrl), { method: 'GET', headers: { [SERVER_CREDENTIAL]: token }, timeout: 5000 }, res => {
+      res.resume(); resolve(res.statusCode >= 200 && res.statusCode < 300);
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', () => resolve(false));
+    req.end();
+  });
+}
+
+/**
+ * Front the notification service with the server's own authentication.
+ * A request carrying a server API credential is checked with the daemon; only then
+ * does it act as this installation's owner (or, for /api/v1/send, as the named
+ * producer). A request without one keeps its own Authorization, which the service
+ * checks against its scoped tokens. Nothing is injected for an unauthenticated caller.
+ */
+export function createNotificationsAdapter({ service, userToken, verifyServerCredential }) {
+  const authorize = async (req) => {
+    for (const name of BROWSER) delete req.headers[name];
+    const credential = req.headers[SERVER_CREDENTIAL], producer = req.headers[PRODUCER];
+    delete req.headers[SERVER_CREDENTIAL]; delete req.headers[PRODUCER];
+    if (credential === undefined) return producer === undefined;
+    if (typeof credential !== 'string' || !credential || !await verifyServerCredential(credential)) return false;
+    const path = new URL(req.url ?? '/', 'http://localhost').pathname;
+    if (producer !== undefined && !(req.method === 'POST' && path === '/api/v1/send')) return false;
+    req.headers.authorization = `Bearer ${producer ?? userToken}`;
+    return true;
+  };
+  const server = createServer(async (req, res) => {
+    if (req.url === '/healthz' && req.method === 'GET') { res.writeHead(200, { 'content-type': 'application/json' }); res.end('{"ok":true}'); return; }
+    if (!await authorize(req)) { res.writeHead(401, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end('{"error":"authentication required"}'); return; }
+    service.server.emit('request', req, res);
+  });
+  // Upgraded connections leave the HTTP server's connection tracking, so shutdown ends them itself.
+  const upgraded = new Set();
+  server.on('upgrade', async (req, socket, head) => {
+    upgraded.add(socket); socket.once('close', () => upgraded.delete(socket));
+    if (!await authorize(req)) { socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\nContent-Length: 0\r\n\r\n'); return; }
+    service.server.emit('upgrade', req, socket, head);
+  });
+  return { server, async close() {
+    // Stop accepting first; the service then ends its presence sockets and saves state.
+    const listening = new Promise(resolve => server.close(() => resolve()));
+    server.closeAllConnections();
+    await service.close();
+    for (const socket of upgraded) socket.destroy();
+    await listening;
+  } };
+}
+
+/** The installer-generated private configuration also names the owner token this adapter injects. */
+export function readPrivateConfig(path) {
+  const stat = statSync(path);
+  if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid()) throw new Error('Notification configuration must be a private owner file');
+  const config = JSON.parse(readFileSync(path, 'utf8'));
+  if (!Array.isArray(config.users) || config.users.length !== 1 || typeof config.users[0]?.token !== 'string') throw new Error('Notification configuration must select one owner');
+  return config;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  const config = readPrivateConfig(process.env.OURS_NOTIFICATIONS_CONFIG ?? '/var/lib/ours-notifications/config.json');
+  const { createNotificationService } = await import('/opt/ours/node_modules/@ours.network/notifications/dist/server.js');
+  const adapter = createNotificationsAdapter({
+    service: createNotificationService(config),
+    userToken: config.users[0].token,
+    verifyServerCredential: daemonCredentialCheck(process.env.OURS_DAEMON_URL ?? 'http://daemon:3050'),
+  });
+  await new Promise((resolve, reject) => { adapter.server.once('error', reject); adapter.server.listen(config.port, config.host, resolve); });
+  console.log('Notification service ready');
+  for (const signal of ['SIGTERM', 'SIGINT']) process.once(signal, async () => { await adapter.close(); process.exit(0); });
+}

package/assets/scripts/runtime/start-messenger.sh

@@ -1,6 +1,27 @@
 #!/bin/sh
+set -e
 umask 077
-exec 3</var/lib/ours-messenger
-flock -n 3
-node /opt/ours/docker/check-client.mjs messenger
-exec node /opt/ours/node_modules/@ours.network/messenger-server/dist/cli.js serve
+runtime="${OURS_RUNTIME_ROOT:-/opt/ours}"
+state="${OURS_MESSENGER_STATE_DIR:-/var/lib/ours-messenger}"
+exec 3<"$state"
+flock -n 3 || { echo "OURS Messenger state is in use by another writer" >&2; exit 1; }
+node "$runtime/docker/check-client.mjs" messenger
+messenger="[\"node\",\"$runtime/node_modules/@ours.network/messenger-server/dist/cli.js\",\"serve\"]"
+# Notifications run beside Messenger when this runtime ships the service and
+# its private configuration was prepared. Messenger's producer reaches it on loopback.
+config="${OURS_NOTIFICATIONS_CONFIG:-}"
+if [ -n "$config" ] && [ -f "$runtime/node_modules/@ours.network/notifications/package.json" ] && [ -f "$config" ]; then
+  notifications="$(dirname "$config")"
+  exec 4<"$notifications"
+  # Every writer of this state starts here and holds lock 4 for its lifetime;
+  # the kernel releases it when the process dies, even on SIGKILL. Holding it
+  # proves no other writer is alive, so a lock file left by an abrupt stop is stale.
+  flock -n 4 || { echo "OURS notification state is in use by another writer" >&2; exit 1; }
+  rm -f "$notifications/state.json.lock"
+  OURS_NOTIFICATIONS_ORIGIN="http://127.0.0.1:49677"
+  OURS_NOTIFICATIONS_PRODUCER_TOKEN="$(cat "${OURS_NOTIFICATIONS_PRODUCER_FILE:-/credentials/messenger/notifications-producer}")"
+  export OURS_NOTIFICATIONS_ORIGIN OURS_NOTIFICATIONS_PRODUCER_TOKEN
+  # Only Messenger receives its producer credential.
+  exec node "$runtime/docker/supervise.mjs" "[$messenger,[\"env\",\"-u\",\"OURS_NOTIFICATIONS_PRODUCER_TOKEN\",\"node\",\"$runtime/docker/notifications-gateway.mjs\"]]"
+fi
+exec node "$runtime/node_modules/@ours.network/messenger-server/dist/cli.js" serve

package/assets/scripts/runtime/supervise.mjs

@@ -0,0 +1,35 @@
+import { spawn } from 'node:child_process';
+
+/**
+ * Run the given commands as one unit: signals reach every child, and when any
+ * child exits (or cannot start) the others are stopped and the container exits
+ * with its status, so a failure is visible and recovers through the container's
+ * own restart. A child ignoring SIGTERM is killed after a bounded grace period,
+ * within Compose's stop grace period.
+ */
+const commands = JSON.parse(process.argv[2] ?? '[]');
+if (!Array.isArray(commands) || !commands.length || !commands.every(c => Array.isArray(c) && c.length && c.every(a => typeof a === 'string'))) {
+  console.error('usage: supervise.mjs JSON-ARRAY-OF-COMMANDS'); process.exit(2);
+}
+const killAfter = Number(process.env.OURS_SUPERVISE_KILL_AFTER_MS ?? 20_000);
+let stopping = false, status = 0, remaining = commands.length;
+const children = [];
+const running = child => child.exitCode === null && child.signalCode === null && !child.failed;
+const stop = signal => {
+  for (const child of children) if (running(child)) child.kill(signal);
+  if (signal !== 'SIGKILL') setTimeout(() => stop('SIGKILL'), killAfter);
+};
+const finished = (child, code, reason) => {
+  if (child.done) return;
+  child.done = true;
+  if (!stopping) { stopping = true; status = code; console.error(`Supervised process ${child.spawnfile} ${reason}; stopping the others`); stop('SIGTERM'); }
+  if (--remaining === 0) process.exit(status);
+};
+for (const signal of ['SIGTERM', 'SIGINT']) process.on(signal, () => { if (!stopping) { stopping = true; stop(signal); } });
+// Inherited descriptors 3 and 4 are the state-directory locks; every child holds them too.
+for (const [file, ...args] of commands) {
+  const child = spawn(file, args, { stdio: ['inherit', 'inherit', 'inherit', 'inherit', 'inherit'] });
+  children.push(child);
+  child.on('error', error => { child.failed = true; finished(child, 1, `could not start (${error.code ?? 'error'})`); });
+  child.on('exit', (code, signal) => finished(child, code ?? 1, `exited (${signal ?? code})`));
+}

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.30",
+    "installerVersion": "1.2.1-nightly.31",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.15",
@@ -24,9 +24,13 @@
         "version": "1.0.31-nightly.14",
         "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg=="
       },
+      "@ours.network/notifications": {
+        "version": "0.3.1-nightly.1",
+        "integrity": "sha512-rIkrtixoHqBfgCKDDCEYFl4W2Zzh0hOw3axX2+GppQ9gYkujKrk9M2KLGoYhu8RwwTMRl497jgMcTBe7UAHCgA=="
+      },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.38",
-        "integrity": "sha512-glCDY/WfILgTJfG7G3ao5iEtCyWtyPOzl/o+D1EVphUuKQYZIW7Xk8sxyT2/D8FADRqvJSBbebWseWbgmlU6Ow=="
+        "version": "1.2.0-nightly.39",
+        "integrity": "sha512-ixcky/b22x2slW+NmPz2BVQVLFV+jkTFzRGFKpDLug2mugk6xIJiVyY50o8G5c+JXAjB+EN9pzIIrTH21Y48BA=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.10",
@@ -77,9 +81,13 @@
       "type": "npm",
       "version": "1.0.31-nightly.14"
     },
+    "@ours.network/notifications": {
+      "type": "npm",
+      "version": "0.3.1-nightly.1"
+    },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.38"
+      "version": "1.2.0-nightly.39"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/lib/build-transition.mjs

@@ -52,6 +52,8 @@ export async function serverBuildTransition(record, args, effects) {
     save(transition);
   }
   await stage('Verify retained state and identities', () => effects.validateServerBuildState(record));
+  // Repeatable: an updated runtime may need volume state it introduced, such as notification credentials.
+  if (record.gateway) await stage('Prepare stored state for the updated runtime', () => effects.prepareServerVolumes(record));
   await stage('Restore previously running services and check readiness', () => effects.serverLifecycle(record, 'start', runningServices));
   if (record.gateway && ['daemon', 'cowork', 'gateway'].every(name => runningServices.includes(name))) await stage('Verify authenticated gateway management', () => effects.verifyGateway(record));
   const completed = { ...record, sourcePolicyHash: candidate.sourcePolicyHash };

package/lib/effects.mjs

@@ -855,7 +855,7 @@ export function networkEffects(effects) {
           await compose(record, ['build', 'gateway'], { stream: true, env: { BUILDKIT_PROGRESS: 'plain' } });
         }
         if (runtimeOnly) return;
-        await compose(record, ['run', '--rm', '--no-deps', '-T', 'prepare', 'prepare']);
+        await effects.prepareServerVolumes(record);
       } else {
         if (!existsSync(join(record.workDir, '.packages-ready'))) {
           const sourceRoot = join(record.root, `build-${randomUUID()}`);
@@ -881,6 +881,10 @@ export function networkEffects(effects) {
         if (!existsSync(cowork)) writePrivateNew(cowork, JSON.stringify({ version: 1, stateDir: installationPaths(record).cowork, rest: { enabled: true, host: '127.0.0.1', port: record.coworkPort } }));
       }
     },
+    async prepareServerVolumes(record) {
+      if (record.mode !== 'docker') return;
+      await compose(record, ['run', '--rm', '--no-deps', '-T', 'prepare', 'prepare']);
+    },
     async prepareServerBuild(record, args) {
       validateInstallation(record, record.root);
       if (record.schema !== 2 || record.layoutConversion || !['update', 'rebuild'].includes(args.operation)) {
@@ -1297,7 +1301,7 @@ export function networkEffects(effects) {
       if (discovery.ok) return validateGatewayDiscovery(base, await discovery.json(), resolve(credentialPath));
       throw new Error(`Gateway discovery answered HTTP ${discovery.status}; enable the gateway. Direct daemon fallback is not supported.`);
     },
-    importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, disableFleetAgentsSetup = false, refresh = false }) {
+    importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, disableFleetAgentsSetup = false, refresh = false, notificationsProducerPath }) {
       profile = validateGatewayClientProfile(profile);
       const root = join(home, '.ours-client');
       const configPath = join(root, 'profile.json');
@@ -1314,14 +1318,28 @@ export function networkEffects(effects) {
         : readFileSync(sourcesPath);
       const fleetSettings = (!current || refresh) && fleetSettingsPath ? readFileSync(fleetSettingsPath) : null;
       if (fleetSettings) JSON.parse(fleetSettings.toString());
+      let producer = null;
+      if (notificationsProducerPath) {
+        assertPrivateRegularFile(notificationsProducerPath, 'notification producer credential');
+        producer = readFileSync(notificationsProducerPath, 'utf8');
+        let bound; try { bound = JSON.parse(producer); } catch { bound = null; }
+        if (bound?.schema !== 1 || bound.serverUrl !== profile.serverUrl || bound.expectedInstanceId !== profile.expectedInstanceId || !/^[A-Za-z0-9_-]{32,256}$/.test(bound.token ?? ''))
+          throw new Error('Notification producer credential does not match the selected server');
+      }
       ensurePrivateDirectory(root);
+      // Written before the profile it belongs to is published or changed.
+      let notificationsProducerChanged = false;
+      if (producer !== null) {
+        const producerPath = join(root, 'notifications-producer.json');
+        if (!existsSync(producerPath) || readFileSync(producerPath, 'utf8') !== producer) { atomicWriteConfig(producerPath, producer); notificationsProducerChanged = true; }
+      }
       if (current && !refresh) {
         assertPrivateRegularFile(credentialPath, 'managed credential');
         if (readFileSync(credentialPath, 'utf8') !== credential) atomicWriteConfig(credentialPath, credential);
         const saved = { ...current, ...profile, credentialPath };
         if (current.endpoint !== saved.endpoint || current.serverUrl !== saved.serverUrl)
           atomicWriteConfig(configPath, JSON.stringify(saved, null, 2) + '\n');
-        return { configPath, profile: validateGatewayClientProfile(saved), settings: current.installer };
+        return { configPath, profile: validateGatewayClientProfile(saved), settings: current.installer, notificationsProducerChanged };
       }
       const settings = { sourcesPath: join(root, 'sources.json'), integrations, ...(disableFleetAgentsSetup ? { disableFleetAgentsSetup: true } : {}) };
       if (fleetSettings) settings.fleetSettingsPath = join(root, 'fleet-settings.json');
@@ -1331,7 +1349,7 @@ export function networkEffects(effects) {
       atomicWriteConfig(credentialPath, credential);
       const saved = { ...profile, credentialPath, installer: settings };
       atomicWriteConfig(configPath, JSON.stringify(saved, null, 2) + '\n');
-      return { configPath, profile: validateHostProfile(saved), settings };
+      return { configPath, profile: validateHostProfile(saved), settings, notificationsProducerChanged };
     },
     async qualifyInstalledGatewayClient(profile) {
       if (!profile.installer?.integrations?.includes('fleet')) return;

package/lib/gateway.mjs

@@ -1,5 +1,7 @@
 /** One public URL; fixed same-origin service paths are never supplied by a peer. */
 export const GATEWAY_SERVICES = Object.freeze({daemon:'/daemon',cowork:'/cowork',telegram:'/tg-connector',messenger:'/messenger'});
+/** Notifications run inside the Messenger container when its runtime ships the service. */
+export const NOTIFICATIONS_PORT=49677;
 export function serverBase(value) {
   if(typeof value!=='string'||/[\s\\?#]/.test(value)||!/^https?:\/\//.test(value))throw new Error('Server URL must be an HTTP or HTTPS base URL');
   const url=new URL(value);
@@ -135,6 +137,20 @@ http {
       proxy_set_header X-Ours-Api-Token $http_x_ours_api_token;
     }
     ${route('messenger','/messenger')}
+    location = ${basePath}/notifications { return 308 ${basePath}/notifications/; }
+    # The service's own adapter authenticates again and holds the credential it injects.
+    location ${basePath}/notifications/ {
+      auth_request /_server_auth;
+      set $notifications http://messenger:${NOTIFICATIONS_PORT};
+      rewrite ^${basePath}/notifications/(.*)$ /$1 break;
+      proxy_pass $notifications;
+      proxy_set_header Host $http_host;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_http_version 1.1;
+      proxy_buffering off;
+      proxy_read_timeout 300s;
+    }
     location / { return 404; }
   }
 }

package/lib/orchestrate.mjs

@@ -28,6 +28,7 @@ import { executeLegacyMigration } from './legacy-migration.mjs';
 
 import { basename, dirname, join, resolve } from 'node:path';
 import { parseNetworkArgs, validateHostProfile, parseInstallArgs, resolveTarget, resolveProfileSelection, profileEnv, InstallUsageError } from './target.mjs';
+import { NOTIFICATIONS_PRODUCER_FILE } from './server-onboarding.mjs';
 import { clientPackageNames, selectSourcePackages, validateInstallation, SERVER_SERVICES, planDaemonConfig, planServiceInstall, serviceInstallCommand } from './plan.mjs';
 import {
   COMPONENTS,
@@ -1506,7 +1507,9 @@ export async function runClientCommand(command, effects) {
   }
   effects.out(progress(0, 4, 'Client configuration', 'Prepare the selected integrations and private connection profile.'));
   if (profile.serverUrl && integrations.includes('fleet')) await effects.qualifyGatewayClient({ profile, sourcesPath, sources: resolvedSources, integrations, refresh: !!command.preset });
-  const imported = effects.importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, disableFleetAgentsSetup, refresh: !!command.preset });
+  // A prepared local profile may carry the Fleet notification producer credential beside it.
+  const notificationsProducerPath = configPath && configPath !== managedPath && effects.exists?.(join(dirname(configPath), NOTIFICATIONS_PRODUCER_FILE)) ? join(dirname(configPath), NOTIFICATIONS_PRODUCER_FILE) : undefined;
+  const imported = effects.importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, disableFleetAgentsSetup, refresh: !!command.preset, notificationsProducerPath });
   let phase = 'Validate saved server connection';
   try {
     await effects.verifyHostProfile(imported.configPath);
@@ -1532,6 +1535,9 @@ export async function runClientCommand(command, effects) {
       for (const name of incomplete) explainClientFailure(effects, name, summary.find(row => row.key === name));
       clientRetry(effects, imported, integrations);
     } else effects.out(ok(`Client setup complete. New clients discover ${imported.configPath}; no OURS_CONFIG export is required.`));
+    // Fleet's web service reads its producer credential when it starts; agents keep running across a web restart.
+    if (imported.notificationsProducerChanged && integrations.includes('fleet'))
+      effects.out(info('Notifications are ready for Fleet. Run `ours-fleet web restart` so a running Fleet web console starts producing them.'));
     if (!incomplete.length) effects.out(progress(4, 4, 'Client setup complete', 'All selected integrations are configured.'));
     return incomplete.length ? EXIT_REFUSED : EXIT_OK;
   } catch (error) {

package/lib/plan.mjs

@@ -281,6 +281,9 @@ export function planDaemonSteps(target, { cliVersionChanged = false, cliStartedI
 }
 
 export const SERVER_PACKAGES = ['sdk', 'cli', 'daemon', 'tg-connector', 'cowork', 'messenger-server'].map(n => `@ours.network/${n}`);
+/** Selected when the policy names it; retained policies from before it existed stay valid. */
+export const NOTIFICATIONS_PACKAGE = '@ours.network/notifications';
+const serverPackages = manifest => [...SERVER_PACKAGES, ...(manifest?.packages?.[NOTIFICATIONS_PACKAGE] ? [NOTIFICATIONS_PACKAGE] : [])];
 export const SERVER_DEPENDENCIES = {
   daemon: [], telegram: ['daemon'], cowork: ['daemon'], messenger: ['daemon'],
 };
@@ -296,7 +299,7 @@ export function maintenanceServices(record, domain) {
 
 /** Validate exact supplied selections, without rewriting the source authority. */
 export function selectSourcePackages(manifest, role, clients = []) {
-  const names = role === 'server' ? SERVER_PACKAGES : clients.map(n => `@ours.network/${n}`);
+  const names = role === 'server' ? serverPackages(manifest) : clients.map(n => `@ours.network/${n}`);
   const result = {};
   for (const name of names) {
     const selected = manifest?.packages?.[name];
@@ -314,7 +317,7 @@ export function selectSourcePackages(manifest, role, clients = []) {
 /** Resolve a packaged compatibility policy into a role-filtered exact selection. */
 export async function resolveSourcePolicy(manifest, role, clients = [], resolveNpm) {
   const release = releaseBinding(manifest);
-  const names = role === 'server' ? SERVER_PACKAGES : clients.map(name => `@ours.network/${name}`);
+  const names = role === 'server' ? serverPackages(manifest) : clients.map(name => `@ours.network/${name}`);
   const packages = {};
   const sourceNames = new Set();
   for (const name of names) {

package/lib/server-onboarding.mjs

@@ -5,6 +5,8 @@ import { join, resolve, isAbsolute } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { installationPaths } from './plan.mjs';
 import { validateHostProfile } from './target.mjs';
+/** Read by Fleet beside the profile credential; bound to one server installation. */
+export const NOTIFICATIONS_PRODUCER_FILE = 'notifications-producer.json';
 
 export function validateIdentityName(name) {
   if (typeof name !== 'string' || [...name].length < 1 || [...name].length > 64 || name !== name.normalize('NFC')
@@ -241,6 +243,14 @@ else { await request('identity/profile', selection.human); process.stdout.write(
           installer: { integrations: [...integrations], ...(fleetSettingsPath !== undefined ? { fleetSettingsPath } : {}) },
         };
         writeFileSync(join(stage, 'profile.json'), JSON.stringify(profile, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+        // Fleet on this host produces agent notifications through the server gateway.
+        // A runtime without the notification service prepares no producer credential.
+        const issued = record.gateway ? await compose(record, ['run', '--rm', '--no-deps', '-T', '--entrypoint', 'cat', 'messenger', '/var/lib/ours-notifications/fleet-producer'], { sensitive: true, allowCodes: [1] }) : null;
+        if (issued && (issued.code ?? 0) === 0) {
+          const token = String(issued.stdout ?? '');
+          if (!/^[A-Za-z0-9_-]{32,256}$/.test(token)) throw new Error('Notification producer credential is invalid; repeat server install');
+          writeFileSync(join(stage, NOTIFICATIONS_PRODUCER_FILE), JSON.stringify({ schema: 1, serverUrl, expectedInstanceId: record.instanceId, token }) + '\n', { flag: 'wx', mode: 0o600 });
+        }
         // Publish the complete pair in one rename. Managed-default activation and
         // package/source selection remain the normal client installer's job.
         renameSync(stage, published);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.30",
+  "version": "1.2.1-nightly.31",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",