@ours.network/install 1.2.1-nightly.38 → 1.2.1-nightly.39

package/README.md

@@ -637,7 +637,7 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.50` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.52` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
 
 ### App tunnel setup prerelease sequencing
 
@@ -654,7 +654,7 @@ connection code automatically; the App checks readiness and opens the code field
 Private `--file`/`--stdin` transports remain optional and are the only transports
 for legacy v1 payloads with long-lived credentials.
 
-The nightly installer release manifest selects published Fleet `1.2.0-nightly.50`
+The nightly installer release manifest selects published Fleet `1.2.0-nightly.52`
 and its actual registry integrity through the normal release manifest/source-policy
 generators. This release includes v2 argument and private-input support. The former
 nightly.41 selection predates this capability. Merge and publish the repinned
@@ -668,3 +668,60 @@ conversation using the credential's fixed user/source scope. Browser inbox
 `/api/v1/delete` continues to require the user credential. The notification
 service must support the scoped lifecycle route; this change does not repin or
 publish an installer release.
+
+## Boot and failure recovery
+
+Docker long-running daemon, Telegram, Cowork, Messenger/Notifications and gateway
+containers use `unless-stopped`. They resume when the selected Docker Engine
+starts, and Docker restarts a failed container with its built-in backoff. A manual
+`docker stop`, `ours-install server stop`, or uninstall stays stopped across
+Engine restarts. Administrative/maintenance jobs have no automatic restart.
+Docker health status alone does not restart a container.
+
+The four application containers also supervise their locked entrypoints. After
+90 seconds of startup grace, probes run every 5 seconds with a 15-second timeout.
+Three consecutive local health failures or a child exit stop its entire process
+group (TERM, then KILL within 20 seconds) before restarting. Cowork's detached
+workers carry an explicit supervisor-PID marker; recovery also kills those
+owned groups and waits for them to stop before launching a replacement. Each container start
+allows three automatic child recovery attempts. Exhaustion leaves the container
+running but unhealthy, with its children stopped and a diagnostic in its logs.
+Correct the cause and use `ours-install server restart --state-dir PATH` to
+reset that circuit; `server start` alone does not reset a running circuit holder.
+Consumers wait for authenticated readiness of their pinned daemon instance and
+do not spend their recovery budget on a daemon outage. The gateway uses Docker
+process recovery only; a gateway hang requires operator restart.
+
+Re-run `server install` to deliver recovery to an existing installation without
+changing its retained exact packages, identity, credentials, volumes or config.
+This explicit install starts its selected services, as before. `server update`
+with reviewed storage compatibility delivers the new selected release and
+restores only previously running services. Retained runtime scripts are refreshed
+and rebuilt on install; an interrupted refresh retains a rebuild marker. The
+restart policy overlay also covers retained Compose files. Reconciliation updates
+only this project's recorded long-running containers and does not start or
+recreate a deliberately stopped container. `server start` can reconcile policies
+but does not retrofit health supervision into an old image: run install/update.
+Backup, migration and update still stop writers before maintenance, and a failed
+maintenance operation keeps them stopped. `server uninstall` (also `ours-uninstall --state-dir PATH` for a managed
+schema-2 installation) stops and removes managed services, retaining volumes,
+identity and credentials. It refuses unfinished transitions and data purge.
+Recovery introduces no host watchdog or service.
+
+Host boot is a separate prerequisite. On Linux, enable the selected Docker
+Engine system service; rootless Docker additionally needs its user service and
+user linger. The installer reports read-only boot diagnostics and does not enable
+or restart host services. A reachable remote Engine or Docker Desktop context
+cannot prove boot recovery on this machine. A custom Unix socket also has an
+unverified boot-service binding; a host unit cannot establish its startup. On macOS/Windows with WSL, enable Docker
+Desktop startup at sign-in; this does not provide pre-login startup. Rootless
+Podman's existing enabled socket/restart-service and linger preflight remains.
+Native package mode retains its package-owned systemd user/launchd services:
+Linux needs user linger for pre-login startup, macOS needs a GUI login session,
+and native hung-process recovery is not supplied by this Docker supervisor.
+Fleet stays on the host with Fleet-owned lifecycle and crash protection. Installing
+the exact Fleet nightly binary does not upgrade or restart an existing supervisor.
+The published no-policy core delivery is a verified recovery omission that
+reproduces the reported symptom. The original incident cause remains unconfirmed:
+actual host Engine availability, installed policies and pre-reboot stopped state
+still require Owner confirmation.

package/assets/Dockerfile

@@ -27,7 +27,7 @@ COPY --chmod=644 scripts/runtime/diagnostics.mjs /opt/ours/docker/diagnostics.mj
 COPY --chmod=644 scripts/runtime/legacy-import.mjs /opt/ours/docker/legacy-import.mjs
 COPY --chmod=644 scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
 COPY --chmod=644 scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs
-COPY --chmod=644 scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs scripts/runtime/notifications-gateway.mjs scripts/runtime/supervise.mjs /opt/ours/docker/
+COPY --chmod=644 scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs scripts/runtime/notifications-gateway.mjs scripts/runtime/supervise.mjs scripts/runtime/recover.mjs scripts/runtime/dependency-ready.mjs /opt/ours/docker/
 RUN chmod 755 /opt/ours/maintenance /opt/ours/docker
 FROM node:24 AS maintenance
 LABEL network.ours.build-context="1"

package/assets/docker-compose.yaml

@@ -83,6 +83,7 @@ services:
 
   daemon:
     <<: *runtime
+    restart: unless-stopped
     environment: *owner-environment
     volumes:
       - {type: volume, source: server-storage, target: /var/lib/ours, volume: {nocopy: true, subpath: state/daemon}}
@@ -107,6 +108,7 @@ services:
 
   telegram:
     <<: *runtime
+    restart: unless-stopped
     entrypoint: [/bin/sh, -e, /opt/ours/docker/start-telegram.sh]
     environment:
       HOME: /tmp
@@ -129,6 +131,7 @@ services:
 
   cowork:
     <<: *runtime
+    restart: unless-stopped
     entrypoint: [/bin/sh, -e, /opt/ours/docker/start-cowork.sh]
     environment:
       HOME: /tmp
@@ -153,6 +156,7 @@ services:
 
   messenger:
     <<: *runtime
+    restart: unless-stopped
     entrypoint: [/bin/sh, -e, /opt/ours/docker/start-messenger.sh]
     environment:
       HOME: /tmp

package/assets/release-lock.json

@@ -13,7 +13,7 @@
         "@ours.network/codex": "1.2.0-nightly.12",
         "@ours.network/cowork": "1.3.3-nightly.20261005.f549477",
         "@ours.network/daemon": "3.8.1-nightly.9",
-        "@ours.network/fleet": "1.2.0-nightly.50",
+        "@ours.network/fleet": "1.2.0-nightly.52",
         "@ours.network/mcp": "1.2.0-nightly.12",
         "@ours.network/messenger-server": "1.0.31-nightly.17",
         "@ours.network/notifications": "0.3.1-nightly.2",
@@ -542,9 +542,9 @@
       ]
     },
     "node_modules/@anthropic-ai/sdk": {
-      "version": "0.131.0",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.131.0.tgz",
-      "integrity": "sha512-9+PepoU7qVMmM70jSahdnfcMHAvAnzhMOLv2W9WjRLO+OG/MAiBETkwKZqv7KIJ1Cj5h8eZ019bHzZaq+Mbepw==",
+      "version": "0.132.0",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.132.0.tgz",
+      "integrity": "sha512-hsKXmb+GjIgGpaJRF7rf2yKFa1SPyVJPQhZLNPDYA4J5YRrcVh4jn/aozLRKHWXGCGM9MPw16S+ry+zKIKCr7Q==",
       "license": "MIT",
       "optional": true,
       "peer": true,
@@ -565,9 +565,9 @@
       }
     },
     "node_modules/@babel/runtime": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
-      "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
+      "version": "7.29.10",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.10.tgz",
+      "integrity": "sha512-NpugTzbKgGrNe45Ui32cN8vCFFMxVtP/9rtfwv0nP5FRDAjvYBxJcLVpYA9mr1jxP6cnIT7x9LUzuDTbWYYNRA==",
       "license": "MIT",
       "optional": true,
       "peer": true,
@@ -1002,9 +1002,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.50",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.50.tgz",
-      "integrity": "sha512-5hotA7c/I29Fj6KM3jjDxwmtlt1H5nKCCOWir4G37CqHcYIvMDuTwJKiL7RHR0OYjCdoS3zHj2hEKlwA+06M+A==",
+      "version": "1.2.0-nightly.52",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.52.tgz",
+      "integrity": "sha512-nIwGknps0FBDhdtivXAFalRbZ67XHAdNcs6AiTBE0ULYeLcohdfqoFqyAS0iZQPUeEUhxkPTKfVuESKeQKP/ow==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.38",
+  "installerVersion": "1.2.1-nightly.39",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.17",
@@ -28,8 +28,8 @@
       "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.50",
-      "integrity": "sha512-5hotA7c/I29Fj6KM3jjDxwmtlt1H5nKCCOWir4G37CqHcYIvMDuTwJKiL7RHR0OYjCdoS3zHj2hEKlwA+06M+A=="
+      "version": "1.2.0-nightly.52",
+      "integrity": "sha512-nIwGknps0FBDhdtivXAFalRbZ67XHAdNcs6AiTBE0ULYeLcohdfqoFqyAS0iZQPUeEUhxkPTKfVuESKeQKP/ow=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.12",

package/assets/scripts/runtime/README.md

@@ -22,3 +22,10 @@ mode. Docker uses one named `server-storage` volume: `state/daemon`, `state/mcp`
 Preparation mounts the storage root; running applications mount only their own
 state children and selected credentials. Backups and maintenance staging are
 outside `state/`. The owner-lock volume contains transient runtime locks.
+
+`recover.mjs` supervises the locked entrypoints with timed health probes and three
+automatic recovery attempts per container start. It kills the entire child group
+and waits for lock release before a new generation. Exhaustion holds unhealthy
+until explicit restart. `dependency-ready.mjs` waits for the authenticated pinned
+daemon without consuming the consumer's failure circuit. Host boot still depends
+on an independently configured Docker Engine or Desktop startup.

package/assets/scripts/runtime/dependency-ready.mjs

@@ -0,0 +1,13 @@
+import { attachOursClient } from '@ours.network/sdk/client';
+let client;
+try {
+  const service = process.argv[2];
+  if (!['telegram', 'cowork', 'messenger'].includes(service)) throw new Error('Unknown dependency');
+  client = await attachOursClient({ endpoint: 'http://daemon:3050',
+    expectedInstanceId: process.env[service === 'telegram' ? 'OURS_TG_DAEMON_ID' : 'OURS_DAEMON_ID'],
+    credentialPath: `/credentials/${service}/daemon-token`,
+    requiredCapabilities: ['external-sessions-v1'], sessionMode: 'external',
+    leaseToken: `container-dependency-${service}`, env: {} });
+  await client.listIdentities();
+} catch { process.exitCode = 1; }
+finally { await client?.close(); }

package/assets/scripts/runtime/entrypoint.sh

@@ -1,4 +1,8 @@
 #!/bin/sh
+# Re-enter this entrypoint for every recovery, including its locks and checks.
+if [ "${OURS_RECOVERY_CHILD:-}" != 1 ]; then
+  exec node "${OURS_RUNTIME_ROOT:-/opt/ours}/docker/recover.mjs" daemon
+fi
 set -eu
 umask 077
 exec 3</var/lib/ours

package/assets/scripts/runtime/recover.mjs

@@ -0,0 +1,165 @@
+import { spawn } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { pathToFileURL } from 'node:url';
+import { readdirSync, readFileSync } from 'node:fs';
+
+// The container owns recovery; no Docker socket, host service or stored state is
+// accessed. Every launch re-enters the locked, provenance-checking entrypoint.
+export async function runRecovery({ command, health, dependency, graceMs = 90_000,
+  intervalMs = 5_000, probeTimeoutMs = 15_000,
+  killAfterMs = 20_000, retries = 3, failures = 3, ownerPidEnvironment, log = console.error }) {
+  let stopping = false, active;
+  const probes = new Set();
+  const controller = new AbortController();
+  const pause = ms => sleep(ms, undefined, { signal: controller.signal }).catch(() => {});
+  const processFields = id => {
+    try {
+      const stat = readFileSync(`/proc/${id}/stat`, 'utf8');
+      return stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+    } catch { return null; }
+  };
+  const groups = child => {
+    if (!child?.pid) return [];
+    child.groups ??= new Set([child.pid]);
+    // Cowork's serve supervisor explicitly marks a detached worker with its
+    // owner PID. The marker survives owner death, unlike PPID ancestry. No
+    // unrelated process or unmarked group is selected, including Docker exec.
+    if (ownerPidEnvironment && !child.probe) for (const id of readdirSync('/proc')) {
+      if (!/^\d+$/.test(id)) continue;
+      try {
+        const env = readFileSync(`/proc/${id}/environ`, 'utf8').split('\0');
+        if (!env.includes(`${ownerPidEnvironment}=${child.pid}`)) continue;
+        const fields = processFields(id);
+        if (fields && !['Z', 'X'].includes(fields[0])) child.groups.add(Number(fields[2]));
+      } catch { /* foreign or exited process */ }
+    }
+    return [...child.groups].filter(pid => Number.isInteger(pid) && pid > 1 && pid !== process.pid);
+  };
+  const signalGroup = (child, signal, all = true) => {
+    const selected = all ? groups(child) : child?.pid ? [child.pid] : [];
+    for (const pid of selected) try { process.kill(-pid, signal); }
+    catch (error) { if (error.code !== 'ESRCH') throw error; }
+  };
+  const launch = (args, probe = false) => {
+    const child = spawn(args[0], args.slice(1), { detached: true,
+      stdio: probe ? 'ignore' : 'inherit', env: { ...process.env, OURS_RECOVERY_CHILD: '1' } });
+    child.probe = probe;
+    child.done = new Promise(resolve => {
+      child.once('error', () => resolve(1));
+      child.once('exit', (code) => resolve(code ?? 1));
+    });
+    return child;
+  };
+  const groupAlive = child => {
+    const selected = groups(child);
+    return readdirSync('/proc').some(id => {
+      if (!/^\d+$/.test(id)) return false;
+      const fields = processFields(id);
+      return fields && selected.includes(Number(fields[2])) && !['Z', 'X'].includes(fields[0]);
+    });
+  };
+  const terminate = async child => {
+    groups(child);
+    // Graceful shutdown reaches only the owning entrypoint; Cowork retains
+    // exclusive IPC control of its worker until the force-kill boundary.
+    signalGroup(child, 'SIGTERM', false);
+    let timer;
+    await Promise.race([child.done, new Promise(resolve => { timer = setTimeout(() => {
+      signalGroup(child, 'SIGKILL'); resolve();
+    }, killAfterMs); })]);
+    clearTimeout(timer);
+    // A leader may exit before a stubborn grandchild. Kill the remaining group
+    // even when child.done won the race, then await kernel lock release.
+    signalGroup(child, 'SIGKILL');
+    await child.done;
+    const deadline = Date.now() + killAfterMs;
+    while (groupAlive(child)) {
+      if (Date.now() >= deadline) throw new Error('Recovery refused: child process group did not stop');
+      await sleep(25);
+    }
+  };
+  const probe = async args => {
+    const child = launch(args, true);
+    probes.add(child);
+    let timer;
+    const code = await Promise.race([child.done, new Promise(resolve => {
+      timer = setTimeout(() => { signalGroup(child, 'SIGKILL'); resolve(1); }, probeTimeoutMs);
+    })]);
+    clearTimeout(timer);
+    await terminate(child);
+    probes.delete(child);
+    return code === 0;
+  };
+  const stop = () => { stopping = true; controller.abort(); signalGroup(active, 'SIGTERM', false); for (const child of probes) signalGroup(child, 'SIGKILL'); };
+  process.on('SIGTERM', stop); process.on('SIGINT', stop);
+  try {
+    let recoveries = 0;
+    while (!stopping) {
+      if (recoveries > retries) {
+        log(`OURS recovery exhausted (${retries} automatic attempts); children stopped. Inspect logs and use server restart after correcting the cause.`);
+        while (!stopping) await pause(60_000);
+        break;
+      }
+      // A dependency outage is a wait, not a local failure. Never spend a
+      // consumer's circuit on daemon boot order, restart or unavailability.
+      if (dependency) {
+        let waiting = false;
+        while (!stopping && !await probe(dependency)) {
+          if (!waiting) log('OURS waiting for the authenticated daemon; recovery budget retained');
+          waiting = true;
+          await pause(intervalMs);
+        }
+      }
+      if (stopping) break;
+      if (recoveries) log(`OURS recovery attempt ${recoveries}/${retries}`);
+      active = launch(command);
+      let exited = false, monitoring = true;
+      const generation = new AbortController();
+      const wait = ms => sleep(ms, undefined, { signal: generation.signal }).catch(() => {});
+      const cancel = () => generation.abort();
+      controller.signal.addEventListener('abort', cancel, { once: true });
+      active.done.then(() => { exited = true; generation.abort(); });
+      const watch = async () => {
+        await wait(graceMs);
+        let failed = 0;
+        while (monitoring && !stopping && !exited) {
+          const healthy = await probe(health);
+          if (!monitoring || stopping || exited) break;
+          if (!healthy && dependency && !await probe(dependency)) failed = 0;
+          else failed = healthy ? 0 : failed + 1;
+          if (failed >= failures) { log('OURS service health failed repeatedly; stopping children before recovery'); return; }
+          await wait(intervalMs);
+        }
+      };
+      const watching = watch();
+      await Promise.race([active.done, watching]);
+      monitoring = false; generation.abort();
+      await terminate(active);
+      await watching;
+      controller.signal.removeEventListener('abort', cancel);
+      active = undefined;
+      if (!stopping) {
+        if (!dependency || await probe(dependency)) recoveries++;
+        await pause(intervalMs);
+      }
+    }
+  } finally {
+    if (active) await terminate(active);
+    process.off('SIGTERM', stop); process.off('SIGINT', stop);
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const service = process.argv[2], runtime = process.env.OURS_RUNTIME_ROOT ?? '/opt/ours';
+  const health = {
+    daemon: ['node', `${runtime}/docker/healthcheck.mjs`],
+    telegram: ['/bin/sh', `${runtime}/docker/health-telegram.sh`],
+    cowork: ['/bin/sh', `${runtime}/docker/health-cowork.sh`],
+    messenger: ['node', `${runtime}/docker/health-messenger.mjs`],
+  }[service];
+  if (!health) throw new Error('Unknown recovery service');
+  const entry = service === 'daemon' ? 'entrypoint.sh' : `start-${service}.sh`;
+  await runRecovery({ command: ['/bin/sh', '-e', `${runtime}/docker/${entry}`], health,
+    ...(service === 'cowork' ? { ownerPidEnvironment: 'OURS_COWORK_SUPERVISOR_PID' } : {}),
+    ...(service !== 'daemon' ? { dependency: ['node', `${runtime}/docker/dependency-ready.mjs`, service] } : {}) });
+}

package/assets/scripts/runtime/start-cowork.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
+set -e
+# Re-enter this entrypoint for every recovery, including its locks and checks.
+if [ "${OURS_RECOVERY_CHILD:-}" != 1 ]; then
+  exec node "${OURS_RUNTIME_ROOT:-/opt/ours}/docker/recover.mjs" cowork
+fi
 umask 077
 exec 3</var/lib/ours-cowork
 flock -n 3

package/assets/scripts/runtime/start-messenger.sh

@@ -1,4 +1,8 @@
 #!/bin/sh
+# Re-enter this entrypoint for every recovery, including its locks and checks.
+if [ "${OURS_RECOVERY_CHILD:-}" != 1 ]; then
+  exec node "${OURS_RUNTIME_ROOT:-/opt/ours}/docker/recover.mjs" messenger
+fi
 set -e
 umask 077
 runtime="${OURS_RUNTIME_ROOT:-/opt/ours}"

package/assets/scripts/runtime/start-telegram.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
+set -e
+# Re-enter this entrypoint for every recovery, including its locks and checks.
+if [ "${OURS_RECOVERY_CHILD:-}" != 1 ]; then
+  exec node "${OURS_RUNTIME_ROOT:-/opt/ours}/docker/recover.mjs" telegram
+fi
 umask 077
 exec 3</var/lib/ours-telegram
 flock -n 3

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.38",
+    "installerVersion": "1.2.1-nightly.39",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.17",
@@ -29,8 +29,8 @@
         "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.50",
-        "integrity": "sha512-5hotA7c/I29Fj6KM3jjDxwmtlt1H5nKCCOWir4G37CqHcYIvMDuTwJKiL7RHR0OYjCdoS3zHj2hEKlwA+06M+A=="
+        "version": "1.2.0-nightly.52",
+        "integrity": "sha512-nIwGknps0FBDhdtivXAFalRbZ67XHAdNcs6AiTBE0ULYeLcohdfqoFqyAS0iZQPUeEUhxkPTKfVuESKeQKP/ow=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.12",
@@ -87,7 +87,7 @@
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.50"
+      "version": "1.2.0-nightly.52"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/lib/boot-readiness.mjs

@@ -0,0 +1,43 @@
+/** Diagnose availability separately from boot enablement. Never alter host services. */
+export async function reportBootReadiness(effects, record) {
+  const platform = effects.platform.platform;
+  if (record.mode === 'packages') {
+    if (platform === 'linux') {
+      try {
+        const linger = await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value']);
+        if (linger.stdout.trim() !== 'yes') throw new Error('linger disabled');
+        effects.out('Native user-service boot requires enabled package-owned units; user linger is enabled.');
+      } catch { effects.out('Native user services require a login session; pre-login host boot is not verified. Ask the operator to enable user linger.'); }
+    } else effects.out('Native launchd services start in the macOS GUI login session; pre-login boot and hung-process recovery are not supplied.');
+    return;
+  }
+  if (record.mode !== 'docker' || (record.containerEngine ?? 'docker') !== 'docker') return;
+  if (platform !== 'linux') {
+    effects.out('Container recovery requires Docker Desktop to start at sign-in. Enable its startup setting; this installer does not arrange pre-login host boot on this platform.');
+    return;
+  }
+  try {
+    const context = JSON.parse((await effects.run('docker', ['context', 'inspect'])).stdout);
+    const endpoint = effects.env.DOCKER_HOST ?? context[0]?.Endpoints?.docker?.Host;
+    if (effects.env.DOCKER_CONTEXT || !endpoint?.startsWith('unix://') || endpoint.includes('/.docker/desktop/')) {
+      effects.out('Container recovery requires the selected remote/Desktop Docker Engine to start independently; local systemd boot cannot be verified for this context.');
+      return;
+    }
+    const info = JSON.parse((await effects.run('docker', ['info', '--format', '{{json .SecurityOptions}}'])).stdout);
+    const rootless = info.some(option => option.startsWith('name=rootless'));
+    const sockets = rootless ? [`unix:///run/user/${process.getuid()}/docker.sock`] : ['unix:///var/run/docker.sock', 'unix:///run/docker.sock'];
+    if (!sockets.includes(endpoint)) {
+      effects.out('The selected custom Docker socket is reachable, but its boot service binding is unverified; enable and verify the service owning that Engine.');
+      return;
+    }
+    const enabled = await effects.run('systemctl', [...(rootless ? ['--user'] : []), 'is-enabled', 'docker.service']);
+    if (enabled.stdout.trim() !== 'enabled') throw new Error('persistent Docker service enablement is unverified');
+    if (rootless) {
+      const linger = await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value']);
+      if (linger.stdout.trim() !== 'yes') throw new Error('rootless user linger is disabled');
+    }
+    effects.out(`Docker boot service is enabled${rootless ? ' with user linger' : ''}; managed containers recover when that Engine starts.`);
+  } catch {
+    effects.out('Docker is reachable, but automatic host boot is not verified. Ask the operator to enable the selected Docker Engine boot service (and user linger for rootless Docker); container restart policy cannot start an unavailable Engine.');
+  }
+}

package/lib/docker-recovery.mjs

@@ -0,0 +1,55 @@
+import { readFileSync, lstatSync, realpathSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { atomicWriteConfig } from './config.mjs';
+import { engineName, runContainer } from './container-engine.mjs';
+
+const assets = new URL('../assets/', import.meta.url);
+const files = ['scripts/runtime/recover.mjs', 'scripts/runtime/dependency-ready.mjs',
+  ...['entrypoint.sh', 'start-telegram.sh', 'start-cowork.sh', 'start-messenger.sh'].map(f => `scripts/runtime/${f}`)];
+const owned = (path, directory = false) => {
+  const s = lstatSync(path);
+  if (!(directory ? s.isDirectory() : s.isFile()) || s.uid !== process.getuid() || (!directory && s.nlink !== 1)
+    || realpathSync(path) !== path || (s.mode & 0o7000)) throw new Error('Unsafe retained recovery delivery');
+};
+/** Refresh installer-owned runtime scripts without changing source selection or state. */
+export function refreshDockerRecovery(record) {
+  for (const dir of [record.root, record.workDir, join(record.workDir, 'scripts'), join(record.workDir, 'scripts/runtime')]) owned(dir, true);
+  const marker = join(record.workDir, '.recovery-rebuild');
+  let changed = false;
+  const replace = (name, bytes) => {
+    const path = join(record.workDir, name);
+    if (existsSync(path)) { owned(path); if (readFileSync(path).equals(bytes)) return; }
+    // Persist before edits, so interruption cannot reuse an image lacking recovery.
+    atomicWriteConfig(marker, 'required\n'); changed = true;
+    atomicWriteConfig(path, bytes.toString());
+  };
+  for (const name of files) replace(name, readFileSync(new URL(name, assets)));
+  const dockerfile = join(record.workDir, 'Dockerfile'); owned(dockerfile);
+  const text = readFileSync(dockerfile, 'utf8');
+  const line = 'COPY --chmod=644 scripts/runtime/recover.mjs scripts/runtime/dependency-ready.mjs /opt/ours/docker/';
+  if (!text.includes('scripts/runtime/recover.mjs')) replace('Dockerfile', Buffer.from(text.replace('FROM node:24 AS maintenance', `${line}\nFROM node:24 AS maintenance`)));
+  return changed || existsSync(marker);
+}
+
+/** An overlay also applies to retained Compose files, with one-shot jobs untouched. */
+export function recoveryCompose(record) {
+  return { services: Object.fromEntries(record.services.map(name => [name, { restart: 'unless-stopped' }])) };
+}
+
+/** Change only exact project-owned long-running containers; never start/recreate. */
+export async function reconcileDockerRecovery(record, effects) {
+  if (engineName(record) !== 'docker') return;
+  const query = await runContainer(effects, record, ['ps', '-aq', '--no-trunc', '--filter', `label=com.docker.compose.project=${record.project}`]);
+  const ids = query.stdout.split(/\s+/).filter(Boolean);
+  if (!ids.length) return;
+  const inspected = JSON.parse((await runContainer(effects, record, ['inspect', ...ids])).stdout);
+  const selected = [];
+  for (const c of inspected) {
+    const labels = c.Config?.Labels;
+    if (labels?.['com.docker.compose.project'] !== record.project) throw new Error('Recovery container project ownership differs');
+    if (!record.services.includes(labels['com.docker.compose.service']) || labels['com.docker.compose.oneoff']?.toLowerCase() !== 'false') continue;
+    if (!ids.includes(c.Id)) throw new Error('Recovery container identity differs');
+    if (c.HostConfig?.RestartPolicy?.Name !== 'unless-stopped') selected.push(c.Id);
+  }
+  if (selected.length) await runContainer(effects, record, ['update', '--restart', 'unless-stopped', ...selected]);
+}

package/lib/effects.mjs

@@ -30,6 +30,8 @@ import { atomicWriteConfig, snapshotConfig, restoreConfig } from './config.mjs';
 import { select as selectOnTty, multiselect as multiselectOnTty, askLine as askLineOnTty } from './prompt.mjs';
 import { classifyHarnessProbe } from './logic.mjs';
 import { qualifyDockerRuntime, refreshDockerPolicyCopy } from './docker-runtime-repair.mjs';
+import { refreshDockerRecovery, recoveryCompose, reconcileDockerRecovery } from './docker-recovery.mjs';
+import { reportBootReadiness } from './boot-readiness.mjs';
 import { classifyStateDir } from './detect.mjs';
 import { BASE_RECORDS, CONTEXT, readBuildRecords, equalBuildRecords, initializeBuildMarker } from '../assets/scripts/maintenance/build-context.mjs';
 import { hostCliPolicy, releaseBinding, verifyReleaseGraph, verifyRuntimeRelease } from '../assets/scripts/maintenance/release-graph.mjs';
@@ -555,6 +557,7 @@ export function networkEffects(effects) {
       record.schema === 1 && existsSync(join(record.workDir, 'docker-compose.legacy.yaml'))
         ? 'docker-compose.legacy.yaml' : 'docker-compose.yaml'),
     ...(record.gateway ? ['--file', join(record.workDir, 'docker-compose.gateway.yaml')] : []),
+    ...(existsSync(join(record.workDir, 'compose.recovery.json')) ? ['--file', join(record.workDir, 'compose.recovery.json')] : []),
     ...(engineName(record) === 'podman' ? ['--file', join(record.workDir, 'compose.podman.json')] : []),
     '--project-name', record.project, ...args,
   ];
@@ -824,6 +827,7 @@ export function networkEffects(effects) {
       }
     },
     async prepareInstallation(record, { runtimeOnly = false } = {}) {
+      if (!runtimeOnly) await reportBootReadiness(effects, record);
       let copied = false;
       if (!existsSync(record.workDir)) {
         cpSync(INSTALLER_ASSETS, record.workDir, { recursive: true, errorOnExist: true, force: false });
@@ -838,6 +842,8 @@ export function networkEffects(effects) {
       if (record.mode === 'docker') {
         if (engineName(record) === 'podman') atomicWriteConfig(join(record.workDir, 'compose.podman.json'), JSON.stringify({ services: Object.fromEntries(record.services.map(name => [name, { restart: 'unless-stopped' }])) }));
         const rebuildPrivateScripts = refreshDockerPolicyCopy(record);
+        const rebuildRecovery = refreshDockerRecovery(record);
+        atomicWriteConfig(join(record.workDir, 'compose.recovery.json'), JSON.stringify(recoveryCompose(record)));
         if (record.gateway) {
           atomicWriteConfig(join(record.workDir, 'docker-compose.gateway.yaml'), gatewayCompose(record));
           atomicWriteConfig(join(record.workDir, 'nginx.conf'), gatewayNginx(record));
@@ -847,9 +853,10 @@ export function networkEffects(effects) {
         const { dependencies } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
         writeFileSync(join(record.workDir, 'scripts/maintenance/package.json'), JSON.stringify({ private: true, type: 'module', dependencies }, null, 2) + '\n', { mode: 0o600 });
         const image = await container(record, ['image', 'inspect', `${record.project}:runtime`], { allowCodes: [1] });
-        if (image.code !== 0 || rebuildPrivateScripts) await compose(record, ['build', 'daemon'], { stream: true, env: { BUILDKIT_PROGRESS: 'plain' } });
+        if (image.code !== 0 || rebuildPrivateScripts || rebuildRecovery) await compose(record, ['build', 'daemon'], { stream: true, env: { BUILDKIT_PROGRESS: 'plain' } });
         await effects.qualifyDockerRuntime(record);
         if (rebuildPrivateScripts) rmSync(join(record.workDir, '.script-permissions-rebuild'));
+        if (rebuildRecovery) rmSync(join(record.workDir, '.recovery-rebuild'));
         if (record.gateway) {
           await effects.qualifyGatewayRuntime(record);
           await compose(record, ['build', 'gateway'], { stream: true, env: { BUILDKIT_PROGRESS: 'plain' } });
@@ -1250,6 +1257,15 @@ export function networkEffects(effects) {
       }
       await nativeLifecycle(record, 'retire', record.services, { effects, localEnv, ownerCommand, bin });
     },
+    async serverUninstall(record) {
+      if (record.schema !== 2 || record.layoutConversion || record.buildTransition) throw new Error('Complete retained installation transitions before uninstall');
+      if (record.mode === 'docker') {
+        await effects.serverLifecycle(record, 'stop');
+        await requireCleanContainerExit(record, record.services);
+        await compose(record, ['rm', '-f', ...record.services]);
+      } else await nativeLifecycle(record, 'retire', record.services, { effects, localEnv, ownerCommand, bin });
+      effects.out('Managed services removed; installation selection, stored identities, credentials and volumes retained.');
+    },
     async serverLifecycle(record, operation, selected = record.services) {
       record = buildRuntime(record);
       if (record.mode === 'docker') {
@@ -1266,6 +1282,8 @@ export function networkEffects(effects) {
           if ((await effects.serverLifecycle(record, 'status', selected)).length) throw new Error('Writers did not stop');
           return;
         }
+        if (existsSync(record.workDir)) atomicWriteConfig(join(record.workDir, 'compose.recovery.json'), JSON.stringify(recoveryCompose(record)));
+        await reconcileDockerRecovery(record, effects);
         const start = async service => {
           effects.out(`Starting ${service}; waiting for readiness...`);
           // Gateway has no persistent state. Recreate its network endpoint on each

package/lib/orchestrate-uninstall.mjs

@@ -75,12 +75,6 @@ export async function runUninstall(argv, effects) {
   if (args.version) { effects.out(`ours-uninstall v${effects.version ?? '?'}`); return EXIT_OK; }
   const purge = argv.includes('--purge');
   const dir = args.stateDir;
-  const config = effects.readJson(join(dir, 'config.json'));
-  const endpoint = `http://127.0.0.1:${typeof config?.port === 'number' ? config.port : 3050}`;
-
-  effects.out(heading(`ours-uninstall --state-dir ${dir}`));
-  if (args.dryRun) effects.out(info('dry-run: nothing will be removed or stopped'));
-
   // Read the documented OURS_UNINSTALL_* contract before any
   // file is opened. A variable this uninstaller cannot deliver stops the run
   // here, naming itself and naming the replacement, rather than being silently
@@ -91,6 +85,24 @@ export async function runUninstall(argv, effects) {
     return EXIT_REFUSED;
   }
 
+  const managed = effects.readJson(join(dir, 'installation.json'));
+  if (managed?.schema === 2 && ['docker', 'packages'].includes(managed.mode)) {
+    if (contract.engaged || args.config || effects.env.OURS_CONFIG) {
+      effects.out(warn('Managed server uninstall does not support legacy component/profile selections. Nothing was changed; use an explicit server uninstall with those selectors cleared.'));
+      return EXIT_REFUSED;
+    }
+    if (purge) { effects.out(warn('Managed server uninstall retains identities and volumes; --purge is not supported.')); return EXIT_REFUSED; }
+    if (args.dryRun) { effects.out(info('[dry-run] would stop and remove managed server services, retaining all stored data.')); return EXIT_OK; }
+    const { runServerCommand } = await import('./orchestrate.mjs');
+    return runServerCommand({ role: 'server', operation: 'uninstall', stateDir: dir }, effects);
+  }
+  const config = effects.readJson(join(dir, 'config.json'));
+  const endpoint = `http://127.0.0.1:${typeof config?.port === 'number' ? config.port : 3050}`;
+
+  effects.out(heading(`ours-uninstall --state-dir ${dir}`));
+  if (args.dryRun) effects.out(info('dry-run: nothing will be removed or stopped'));
+
+
   let profileSelection;
   try {
     profileSelection = resolveProfileSelection({

package/lib/orchestrate.mjs

@@ -1470,6 +1470,8 @@ async function executeServerCommand(args, effects) {
     }
     if (record.gateway) await effects.verifyGateway(record);
     if (showInstallProgress) effects.out(progress(installStageCount, installStageCount, 'Installation complete', 'The selected services are ready.'));
+  } else if (args.operation === 'uninstall') {
+    await effects.serverUninstall(record);
   } else if (args.operation === 'gateway-enable') {
     await enableGateway(record, args, effects);
   } else if (['backup', 'restore', 'reset'].includes(args.operation)) {

package/lib/setup.mjs

@@ -13,7 +13,7 @@ import { validateIdentityName } from './server-onboarding.mjs';
 import { validateFleetSettings } from './fleet-settings.mjs';
 import { installerFailure } from './diagnostics.mjs';
 
-const maintenance = new Set(['status', 'start', 'stop', 'restart', 'rebuild', 'gateway-enable', 'access-issue', 'access-replace', 'backup', 'restore', 'reset']);
+const maintenance = new Set(['status', 'start', 'stop', 'restart', 'uninstall', 'rebuild', 'gateway-enable', 'access-issue', 'access-replace', 'backup', 'restore', 'reset']);
 
 export function completeReleasePolicy(retained, supplied) {
   if (retained?.release) {

package/lib/target.mjs

@@ -468,7 +468,7 @@ export function searchFreePort(isTaken, { floor = FREE_PORT_FLOOR, reserved = IN
 export function parseNetworkArgs(argv) {
   if (!['server', 'client'].includes(argv[0])) return null;
   const [role, operation] = argv;
-  const operations = role === 'client' ? ['install'] : ['install', 'status', 'start', 'stop', 'restart', 'access-issue', 'access-replace', 'backup', 'restore', 'reset', 'update', 'rebuild', 'gateway-enable'];
+  const operations = role === 'client' ? ['install'] : ['install', 'status', 'start', 'stop', 'restart', 'uninstall', 'access-issue', 'access-replace', 'backup', 'restore', 'reset', 'update', 'rebuild', 'gateway-enable'];
   if (!operations.includes(operation)) throw new InstallUsageError(`Unsupported ${role} operation: ${operation ?? '(missing)'}`);
   const allowed = role === 'client' ? ['config'] : ['state-dir'];
   if (role === 'server' && operation === 'install') allowed.push('mode', 'sources', 'migrate', 'container-engine');

package/lib/usage.mjs

@@ -58,7 +58,7 @@ installer with preparation, identity restoration, update and readiness progress.
 Fleet is configured but left stopped for operator review.
 
 Scoped maintenance:
-  ours-install server status|start|stop|restart|rebuild --state-dir PATH
+  ours-install server status|start|stop|restart|rebuild|uninstall --state-dir PATH
   ours-install server gateway-enable --state-dir PATH [--server-url URL]
   ours-install server access-issue --state-dir PATH --output PATH
   ours-install server access-replace --state-dir PATH --confirm

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.38",
+  "version": "1.2.1-nightly.39",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",