@ours.network/install 1.2.1-nightly.4 → 1.2.1-nightly.40

package/assets/scripts/runtime/recover.mjs

@@ -0,0 +1,165 @@
+import { spawn } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { pathToFileURL } from 'node:url';
+import { readdirSync, readFileSync } from 'node:fs';
+
+// The container owns recovery; no Docker socket, host service or stored state is
+// accessed. Every launch re-enters the locked, provenance-checking entrypoint.
+export async function runRecovery({ command, health, dependency, graceMs = 90_000,
+  intervalMs = 5_000, probeTimeoutMs = 15_000,
+  killAfterMs = 20_000, retries = 3, failures = 3, ownerPidEnvironment, log = console.error }) {
+  let stopping = false, active;
+  const probes = new Set();
+  const controller = new AbortController();
+  const pause = ms => sleep(ms, undefined, { signal: controller.signal }).catch(() => {});
+  const processFields = id => {
+    try {
+      const stat = readFileSync(`/proc/${id}/stat`, 'utf8');
+      return stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+    } catch { return null; }
+  };
+  const groups = child => {
+    if (!child?.pid) return [];
+    child.groups ??= new Set([child.pid]);
+    // Cowork's serve supervisor explicitly marks a detached worker with its
+    // owner PID. The marker survives owner death, unlike PPID ancestry. No
+    // unrelated process or unmarked group is selected, including Docker exec.
+    if (ownerPidEnvironment && !child.probe) for (const id of readdirSync('/proc')) {
+      if (!/^\d+$/.test(id)) continue;
+      try {
+        const env = readFileSync(`/proc/${id}/environ`, 'utf8').split('\0');
+        if (!env.includes(`${ownerPidEnvironment}=${child.pid}`)) continue;
+        const fields = processFields(id);
+        if (fields && !['Z', 'X'].includes(fields[0])) child.groups.add(Number(fields[2]));
+      } catch { /* foreign or exited process */ }
+    }
+    return [...child.groups].filter(pid => Number.isInteger(pid) && pid > 1 && pid !== process.pid);
+  };
+  const signalGroup = (child, signal, all = true) => {
+    const selected = all ? groups(child) : child?.pid ? [child.pid] : [];
+    for (const pid of selected) try { process.kill(-pid, signal); }
+    catch (error) { if (error.code !== 'ESRCH') throw error; }
+  };
+  const launch = (args, probe = false) => {
+    const child = spawn(args[0], args.slice(1), { detached: true,
+      stdio: probe ? 'ignore' : 'inherit', env: { ...process.env, OURS_RECOVERY_CHILD: '1' } });
+    child.probe = probe;
+    child.done = new Promise(resolve => {
+      child.once('error', () => resolve(1));
+      child.once('exit', (code) => resolve(code ?? 1));
+    });
+    return child;
+  };
+  const groupAlive = child => {
+    const selected = groups(child);
+    return readdirSync('/proc').some(id => {
+      if (!/^\d+$/.test(id)) return false;
+      const fields = processFields(id);
+      return fields && selected.includes(Number(fields[2])) && !['Z', 'X'].includes(fields[0]);
+    });
+  };
+  const terminate = async child => {
+    groups(child);
+    // Graceful shutdown reaches only the owning entrypoint; Cowork retains
+    // exclusive IPC control of its worker until the force-kill boundary.
+    signalGroup(child, 'SIGTERM', false);
+    let timer;
+    await Promise.race([child.done, new Promise(resolve => { timer = setTimeout(() => {
+      signalGroup(child, 'SIGKILL'); resolve();
+    }, killAfterMs); })]);
+    clearTimeout(timer);
+    // A leader may exit before a stubborn grandchild. Kill the remaining group
+    // even when child.done won the race, then await kernel lock release.
+    signalGroup(child, 'SIGKILL');
+    await child.done;
+    const deadline = Date.now() + killAfterMs;
+    while (groupAlive(child)) {
+      if (Date.now() >= deadline) throw new Error('Recovery refused: child process group did not stop');
+      await sleep(25);
+    }
+  };
+  const probe = async args => {
+    const child = launch(args, true);
+    probes.add(child);
+    let timer;
+    const code = await Promise.race([child.done, new Promise(resolve => {
+      timer = setTimeout(() => { signalGroup(child, 'SIGKILL'); resolve(1); }, probeTimeoutMs);
+    })]);
+    clearTimeout(timer);
+    await terminate(child);
+    probes.delete(child);
+    return code === 0;
+  };
+  const stop = () => { stopping = true; controller.abort(); signalGroup(active, 'SIGTERM', false); for (const child of probes) signalGroup(child, 'SIGKILL'); };
+  process.on('SIGTERM', stop); process.on('SIGINT', stop);
+  try {
+    let recoveries = 0;
+    while (!stopping) {
+      if (recoveries > retries) {
+        log(`OURS recovery exhausted (${retries} automatic attempts); children stopped. Inspect logs and use server restart after correcting the cause.`);
+        while (!stopping) await pause(60_000);
+        break;
+      }
+      // A dependency outage is a wait, not a local failure. Never spend a
+      // consumer's circuit on daemon boot order, restart or unavailability.
+      if (dependency) {
+        let waiting = false;
+        while (!stopping && !await probe(dependency)) {
+          if (!waiting) log('OURS waiting for the authenticated daemon; recovery budget retained');
+          waiting = true;
+          await pause(intervalMs);
+        }
+      }
+      if (stopping) break;
+      if (recoveries) log(`OURS recovery attempt ${recoveries}/${retries}`);
+      active = launch(command);
+      let exited = false, monitoring = true;
+      const generation = new AbortController();
+      const wait = ms => sleep(ms, undefined, { signal: generation.signal }).catch(() => {});
+      const cancel = () => generation.abort();
+      controller.signal.addEventListener('abort', cancel, { once: true });
+      active.done.then(() => { exited = true; generation.abort(); });
+      const watch = async () => {
+        await wait(graceMs);
+        let failed = 0;
+        while (monitoring && !stopping && !exited) {
+          const healthy = await probe(health);
+          if (!monitoring || stopping || exited) break;
+          if (!healthy && dependency && !await probe(dependency)) failed = 0;
+          else failed = healthy ? 0 : failed + 1;
+          if (failed >= failures) { log('OURS service health failed repeatedly; stopping children before recovery'); return; }
+          await wait(intervalMs);
+        }
+      };
+      const watching = watch();
+      await Promise.race([active.done, watching]);
+      monitoring = false; generation.abort();
+      await terminate(active);
+      await watching;
+      controller.signal.removeEventListener('abort', cancel);
+      active = undefined;
+      if (!stopping) {
+        if (!dependency || await probe(dependency)) recoveries++;
+        await pause(intervalMs);
+      }
+    }
+  } finally {
+    if (active) await terminate(active);
+    process.off('SIGTERM', stop); process.off('SIGINT', stop);
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const service = process.argv[2], runtime = process.env.OURS_RUNTIME_ROOT ?? '/opt/ours';
+  const health = {
+    daemon: ['node', `${runtime}/docker/healthcheck.mjs`],
+    telegram: ['/bin/sh', `${runtime}/docker/health-telegram.sh`],
+    cowork: ['/bin/sh', `${runtime}/docker/health-cowork.sh`],
+    messenger: ['node', `${runtime}/docker/health-messenger.mjs`],
+  }[service];
+  if (!health) throw new Error('Unknown recovery service');
+  const entry = service === 'daemon' ? 'entrypoint.sh' : `start-${service}.sh`;
+  await runRecovery({ command: ['/bin/sh', '-e', `${runtime}/docker/${entry}`], health,
+    ...(service === 'cowork' ? { ownerPidEnvironment: 'OURS_COWORK_SUPERVISOR_PID' } : {}),
+    ...(service !== 'daemon' ? { dependency: ['node', `${runtime}/docker/dependency-ready.mjs`, service] } : {}) });
+}

package/assets/scripts/runtime/start-cowork.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
+set -e
+# Re-enter this entrypoint for every recovery, including its locks and checks.
+if [ "${OURS_RECOVERY_CHILD:-}" != 1 ]; then
+  exec node "${OURS_RUNTIME_ROOT:-/opt/ours}/docker/recover.mjs" cowork
+fi
 umask 077
 exec 3</var/lib/ours-cowork
 flock -n 3

package/assets/scripts/runtime/start-messenger.sh

@@ -1,6 +1,31 @@
 #!/bin/sh
+# Re-enter this entrypoint for every recovery, including its locks and checks.
+if [ "${OURS_RECOVERY_CHILD:-}" != 1 ]; then
+  exec node "${OURS_RUNTIME_ROOT:-/opt/ours}/docker/recover.mjs" messenger
+fi
+set -e
 umask 077
-exec 3</var/lib/ours-messenger
-flock -n 3
-node /opt/ours/docker/check-client.mjs messenger
-exec node /opt/ours/node_modules/@ours.network/messenger-server/dist/cli.js serve
+runtime="${OURS_RUNTIME_ROOT:-/opt/ours}"
+state="${OURS_MESSENGER_STATE_DIR:-/var/lib/ours-messenger}"
+exec 3<"$state"
+flock -n 3 || { echo "OURS Messenger state is in use by another writer" >&2; exit 1; }
+node "$runtime/docker/check-client.mjs" messenger
+messenger="[\"node\",\"$runtime/node_modules/@ours.network/messenger-server/dist/cli.js\",\"serve\"]"
+# Notifications run beside Messenger when this runtime ships the service and
+# its private configuration was prepared. Messenger's producer reaches it on loopback.
+config="${OURS_NOTIFICATIONS_CONFIG:-}"
+if [ -n "$config" ] && [ -f "$runtime/node_modules/@ours.network/notifications/package.json" ] && [ -f "$config" ]; then
+  notifications="$(dirname "$config")"
+  exec 4<"$notifications"
+  # Every writer of this state starts here and holds lock 4 for its lifetime;
+  # the kernel releases it when the process dies, even on SIGKILL. Holding it
+  # proves no other writer is alive, so a lock file left by an abrupt stop is stale.
+  flock -n 4 || { echo "OURS notification state is in use by another writer" >&2; exit 1; }
+  rm -f "$notifications/state.json.lock"
+  OURS_NOTIFICATIONS_ORIGIN="http://127.0.0.1:49677"
+  OURS_NOTIFICATIONS_PRODUCER_TOKEN="$(cat "${OURS_NOTIFICATIONS_PRODUCER_FILE:-/credentials/messenger/notifications-producer}")"
+  export OURS_NOTIFICATIONS_ORIGIN OURS_NOTIFICATIONS_PRODUCER_TOKEN
+  # Only Messenger receives its producer credential.
+  exec node "$runtime/docker/supervise.mjs" "[$messenger,[\"env\",\"-u\",\"OURS_NOTIFICATIONS_PRODUCER_TOKEN\",\"node\",\"$runtime/docker/notifications-gateway.mjs\"]]"
+fi
+exec node "$runtime/node_modules/@ours.network/messenger-server/dist/cli.js" serve

package/assets/scripts/runtime/start-telegram.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
+set -e
+# Re-enter this entrypoint for every recovery, including its locks and checks.
+if [ "${OURS_RECOVERY_CHILD:-}" != 1 ]; then
+  exec node "${OURS_RUNTIME_ROOT:-/opt/ours}/docker/recover.mjs" telegram
+fi
 umask 077
 exec 3</var/lib/ours-telegram
 flock -n 3

package/assets/scripts/runtime/supervise.mjs

@@ -0,0 +1,35 @@
+import { spawn } from 'node:child_process';
+
+/**
+ * Run the given commands as one unit: signals reach every child, and when any
+ * child exits (or cannot start) the others are stopped and the container exits
+ * with its status, so a failure is visible and recovers through the container's
+ * own restart. A child ignoring SIGTERM is killed after a bounded grace period,
+ * within Compose's stop grace period.
+ */
+const commands = JSON.parse(process.argv[2] ?? '[]');
+if (!Array.isArray(commands) || !commands.length || !commands.every(c => Array.isArray(c) && c.length && c.every(a => typeof a === 'string'))) {
+  console.error('usage: supervise.mjs JSON-ARRAY-OF-COMMANDS'); process.exit(2);
+}
+const killAfter = Number(process.env.OURS_SUPERVISE_KILL_AFTER_MS ?? 20_000);
+let stopping = false, status = 0, remaining = commands.length;
+const children = [];
+const running = child => child.exitCode === null && child.signalCode === null && !child.failed;
+const stop = signal => {
+  for (const child of children) if (running(child)) child.kill(signal);
+  if (signal !== 'SIGKILL') setTimeout(() => stop('SIGKILL'), killAfter);
+};
+const finished = (child, code, reason) => {
+  if (child.done) return;
+  child.done = true;
+  if (!stopping) { stopping = true; status = code; console.error(`Supervised process ${child.spawnfile} ${reason}; stopping the others`); stop('SIGTERM'); }
+  if (--remaining === 0) process.exit(status);
+};
+for (const signal of ['SIGTERM', 'SIGINT']) process.on(signal, () => { if (!stopping) { stopping = true; stop(signal); } });
+// Inherited descriptors 3 and 4 are the state-directory locks; every child holds them too.
+for (const [file, ...args] of commands) {
+  const child = spawn(file, args, { stdio: ['inherit', 'inherit', 'inherit', 'inherit', 'inherit'] });
+  children.push(child);
+  child.on('error', error => { child.failed = true; finished(child, 1, `could not start (${error.code ?? 'error'})`); });
+  child.on('exit', (code, signal) => finished(child, code ?? 1, `exited (${signal ?? code})`));
+}

package/assets/sources.json

@@ -2,82 +2,108 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.4",
+    "installerVersion": "1.2.1-nightly.40",
     "packages": {
       "@ours.network/sdk": {
-        "version": "3.8.1-nightly.3",
-        "integrity": "sha512-iUVCs+jryoeR2Ip/uHzpkJwbpoJeLDASUaE3lC+eYDj8dbI1MBwTpeOXFemUK052O6lA4ZWrhyRgE9pJU3a+Kw=="
+        "version": "3.8.1-nightly.17",
+        "integrity": "sha512-GCPbGzh0IxFJluyRk4y1O+9419kZcnHapnr42FQKs4u2kKU7EcDRLBlINqSYgF0YUCZyZUDv/9Rk1//GKs/6oQ=="
       },
       "@ours.network/cli": {
-        "version": "2.8.1-nightly.1",
-        "integrity": "sha512-1Rmbqlr790FhqQW/wQ//YEL7b0Q2KVSCA2TlpjaLRkj9Xh55rOoazBJjFuW/fUpTz3Z1B3MUPK9LWiYd+A0kNA=="
+        "version": "2.8.1-nightly.15",
+        "integrity": "sha512-ht96LfYH7Du19YWeht+5eRsZxuF1Fobfj6sPSH+aFgWD9hYdrWTeG/5rrCTAClQflnl49Qaskk4n/TclkWrkRw=="
       },
       "@ours.network/tg-connector": {
-        "version": "1.0.1-nightly.1",
-        "integrity": "sha512-/Do7EfINknDks3yYndOi9aLc1alxB50qk+WKv8DRuZpDB89DDMQ+DoSGQerdvsMp32nQ3LICL8TPjcdFMZfx8Q=="
+        "version": "1.0.1-nightly.11",
+        "integrity": "sha512-ZT/51g+YgjCpPoYKF+6zuWhn/rAUa49Qq/mChOHZmZf2WJR16VLPGCc31LDA26kRE+kQtdkWiuGf2v0XOa7CXg=="
       },
       "@ours.network/cowork": {
-        "version": "1.3.2-nightly.20260918.4d9242e",
-        "integrity": "sha512-04D2lJ97SrTrkVRRbdTZ0y+KvQdG/bpnmFFjsyUqQTij+5zEkNizTG/xhcCL8m7Mb0XvVFL8WzJ62Xgh5ahlRw=="
+        "version": "1.3.3-nightly.20261005.f549477",
+        "integrity": "sha512-9RYvgAPrsKtzAOUSYsNLws3zhse3BvKu4Z2xC5vUYniWhyU8s2RiHO6bH7oBrjcRyjpCiFwnNpOE6oobi1Vllg=="
       },
       "@ours.network/messenger-server": {
-        "version": "1.0.31-nightly.1",
-        "integrity": "sha512-XB6N+Ppd4txmI0+2ZVFMWJxXi4DtMIDlFSHOzszNM5hopFebpw1Df+KKCK4Cgd/LZUkoOOYWGEYpib9m3RbHWw=="
+        "version": "1.0.31-nightly.17",
+        "integrity": "sha512-03qDDGRgN9pBGsBsCcvArhPuYfMblqsaXS9HinxAzOSiI3PaoNOh+4MxIAOoHXoE/12xxCDf7kbMdEAR0CPIfg=="
+      },
+      "@ours.network/notifications": {
+        "version": "0.3.1-nightly.2",
+        "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.1",
-        "integrity": "sha512-vioCobVbosmp9BgYo2XccjpPoVQd1wwV+Mt64Bm41/Vxtro2j85PUdy4AWcsY9jEFnJmj/UQfc5E5AxvlpPnrw=="
+        "version": "1.2.0-nightly.52",
+        "integrity": "sha512-nIwGknps0FBDhdtivXAFalRbZ67XHAdNcs6AiTBE0ULYeLcohdfqoFqyAS0iZQPUeEUhxkPTKfVuESKeQKP/ow=="
       },
       "@ours.network/mcp": {
-        "version": "1.2.0-nightly.3",
-        "integrity": "sha512-z0N5jn1jj9iwGRqU1d3AM2RX9mCr4T/WhASEKr+Vh52yNDMzhVjFlx0U0v8aS+GTfOQaPZTfL3TGMc17ETjh3g=="
+        "version": "1.2.0-nightly.12",
+        "integrity": "sha512-ZvwCaIgMaMcUrLhWNaWWOErIHwtvQyOZHfophf+rrjnlG0eBpBwmwQPuABS7jPuQvi69pBIT4jUWN3CArgxzRQ=="
       },
       "@ours.network/codex": {
-        "version": "1.2.0-nightly.3",
-        "integrity": "sha512-dIWDqbo6hJzujegHRO6x1SsBnh5p1c6gRGj/WkPha/hcN7s/27P4jqBnJ7czQyVGiNVFZ1aAxj4c9+CDLzHENw=="
+        "version": "1.2.0-nightly.12",
+        "integrity": "sha512-O3emBbe4KXfD9nDsgjN3Z8J11aSMz4KAdiZo4EPZIqEypOXCaRnbZqpuJpd14FZpFHSHGEfel6KgP0mZYFYtRA=="
       },
       "@ours.network/claude-code": {
-        "version": "1.2.0-nightly.3",
-        "integrity": "sha512-7ta6KnvoHB2i/yoaykhXvzKFQTIOPtDHeTzG1PRwHjdTJ4vcGEh4jWYMd2c1jjj73lC3q9qW3LYSRutIJovtQg=="
+        "version": "1.2.0-nightly.12",
+        "integrity": "sha512-122cnztQqVkXvXy4y4zJQAVVD5gBTqdj5gkf2dTVnR/g0Nzw5uBxdch0xkhyluqmjN74MHuklv2YRr9Gs8vbbQ=="
+      },
+      "@ours.network/daemon": {
+        "version": "3.8.1-nightly.9",
+        "integrity": "sha512-KQUAmd/Ae97DcaxKFinsVuyQiREUuXp6uiv0FeOsU59patpFKUcw7gYpmifBeywnvsDVrS+XX33CubYYkpMacw=="
+      }
+    },
+    "hostCli": {
+      "@ours.network/sdk": {
+        "version": "3.8.1-nightly.17",
+        "integrity": "sha512-GCPbGzh0IxFJluyRk4y1O+9419kZcnHapnr42FQKs4u2kKU7EcDRLBlINqSYgF0YUCZyZUDv/9Rk1//GKs/6oQ=="
+      },
+      "@ours.network/cli": {
+        "version": "2.8.1-nightly.15",
+        "integrity": "sha512-ht96LfYH7Du19YWeht+5eRsZxuF1Fobfj6sPSH+aFgWD9hYdrWTeG/5rrCTAClQflnl49Qaskk4n/TclkWrkRw=="
       }
     }
   },
   "packages": {
     "@ours.network/sdk": {
       "type": "npm",
-      "version": "3.8.1-nightly.3"
+      "version": "3.8.1-nightly.17"
     },
     "@ours.network/cli": {
       "type": "npm",
-      "version": "2.8.1-nightly.1"
+      "version": "2.8.1-nightly.15"
     },
     "@ours.network/tg-connector": {
       "type": "npm",
-      "version": "1.0.1-nightly.1"
+      "version": "1.0.1-nightly.11"
     },
     "@ours.network/cowork": {
       "type": "npm",
-      "version": "1.3.2-nightly.20260918.4d9242e"
+      "version": "1.3.3-nightly.20261005.f549477"
     },
     "@ours.network/messenger-server": {
       "type": "npm",
-      "version": "1.0.31-nightly.1"
+      "version": "1.0.31-nightly.17"
+    },
+    "@ours.network/notifications": {
+      "type": "npm",
+      "version": "0.3.1-nightly.2"
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.1"
+      "version": "1.2.0-nightly.52"
     },
     "@ours.network/mcp": {
       "type": "npm",
-      "version": "1.2.0-nightly.3"
+      "version": "1.2.0-nightly.12"
     },
     "@ours.network/codex": {
       "type": "npm",
-      "version": "1.2.0-nightly.3"
+      "version": "1.2.0-nightly.12"
     },
     "@ours.network/claude-code": {
       "type": "npm",
-      "version": "1.2.0-nightly.3"
+      "version": "1.2.0-nightly.12"
+    },
+    "@ours.network/daemon": {
+      "type": "npm",
+      "version": "3.8.1-nightly.9"
     }
   }
 }

package/install.mjs

@@ -3,6 +3,8 @@
 import { readFileSync } from 'node:fs';
 
 import { realEffects } from './lib/effects.mjs';
+import { installerFailure } from './lib/diagnostics.mjs';
+import { runWorkspaceSetup } from './lib/workspace-setup.mjs';
 import { runSetup } from './lib/setup.mjs';
 import { closeSync, makeWriter, openTty } from './lib/ui.mjs';
 
@@ -10,7 +12,10 @@ const version = JSON.parse(readFileSync(new URL('./package.json', import.meta.ur
 const ttyFd = openTty();
 
 try {
-  const code = await runSetup(process.argv.slice(2), realEffects({
+  const args=process.argv.slice(2);
+  const workspace=args.some(v=>v==='--setup-workspace' || v.startsWith('--setup-workspace=') || v==='--setup-workspace-file' || v.startsWith('--setup-workspace-file='));
+  const execute=workspace ? (args,effects)=>runWorkspaceSetup(args,effects,runSetup) : runSetup;
+  const code = await execute(args, realEffects({
     write: makeWriter(ttyFd),
     ttyFd,
     env: process.env,
@@ -18,7 +23,7 @@ try {
   }));
   process.exitCode = code;
 } catch (error) {
-  process.stderr.write(`ours-install: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.stderr.write(`ours-install: ${installerFailure(error)}\n`);
   process.exitCode = 1;
 } finally {
   if (ttyFd != null) {

package/lib/boot-readiness.mjs

@@ -0,0 +1,43 @@
+/** Diagnose availability separately from boot enablement. Never alter host services. */
+export async function reportBootReadiness(effects, record) {
+  const platform = effects.platform.platform;
+  if (record.mode === 'packages') {
+    if (platform === 'linux') {
+      try {
+        const linger = await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value']);
+        if (linger.stdout.trim() !== 'yes') throw new Error('linger disabled');
+        effects.out('Native user-service boot requires enabled package-owned units; user linger is enabled.');
+      } catch { effects.out('Native user services require a login session; pre-login host boot is not verified. Ask the operator to enable user linger.'); }
+    } else effects.out('Native launchd services start in the macOS GUI login session; pre-login boot and hung-process recovery are not supplied.');
+    return;
+  }
+  if (record.mode !== 'docker' || (record.containerEngine ?? 'docker') !== 'docker') return;
+  if (platform !== 'linux') {
+    effects.out('Container recovery requires Docker Desktop to start at sign-in. Enable its startup setting; this installer does not arrange pre-login host boot on this platform.');
+    return;
+  }
+  try {
+    const context = JSON.parse((await effects.run('docker', ['context', 'inspect'])).stdout);
+    const endpoint = effects.env.DOCKER_HOST ?? context[0]?.Endpoints?.docker?.Host;
+    if (effects.env.DOCKER_CONTEXT || !endpoint?.startsWith('unix://') || endpoint.includes('/.docker/desktop/')) {
+      effects.out('Container recovery requires the selected remote/Desktop Docker Engine to start independently; local systemd boot cannot be verified for this context.');
+      return;
+    }
+    const info = JSON.parse((await effects.run('docker', ['info', '--format', '{{json .SecurityOptions}}'])).stdout);
+    const rootless = info.some(option => option.startsWith('name=rootless'));
+    const sockets = rootless ? [`unix:///run/user/${process.getuid()}/docker.sock`] : ['unix:///var/run/docker.sock', 'unix:///run/docker.sock'];
+    if (!sockets.includes(endpoint)) {
+      effects.out('The selected custom Docker socket is reachable, but its boot service binding is unverified; enable and verify the service owning that Engine.');
+      return;
+    }
+    const enabled = await effects.run('systemctl', [...(rootless ? ['--user'] : []), 'is-enabled', 'docker.service']);
+    if (enabled.stdout.trim() !== 'enabled') throw new Error('persistent Docker service enablement is unverified');
+    if (rootless) {
+      const linger = await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value']);
+      if (linger.stdout.trim() !== 'yes') throw new Error('rootless user linger is disabled');
+    }
+    effects.out(`Docker boot service is enabled${rootless ? ' with user linger' : ''}; managed containers recover when that Engine starts.`);
+  } catch {
+    effects.out('Docker is reachable, but automatic host boot is not verified. Ask the operator to enable the selected Docker Engine boot service (and user linger for rootless Docker); container restart policy cannot start an unavailable Engine.');
+  }
+}

package/lib/build-transition.mjs

@@ -52,7 +52,10 @@ export async function serverBuildTransition(record, args, effects) {
     save(transition);
   }
   await stage('Verify retained state and identities', () => effects.validateServerBuildState(record));
+  // Repeatable: an updated runtime may need volume state it introduced, such as notification credentials.
+  if (record.gateway) await stage('Prepare stored state for the updated runtime', () => effects.prepareServerVolumes(record));
   await stage('Restore previously running services and check readiness', () => effects.serverLifecycle(record, 'start', runningServices));
+  if (record.gateway && ['daemon', 'cowork', 'gateway'].every(name => runningServices.includes(name))) await stage('Verify authenticated gateway management', () => effects.verifyGateway(record));
   const completed = { ...record, sourcePolicyHash: candidate.sourcePolicyHash };
   delete completed.buildTransition;
   effects.writeJson(path, JSON.stringify(completed, null, 2) + '\n');

package/lib/client-cli.mjs

@@ -0,0 +1,127 @@
+import { lstatSync, readFileSync, writeFileSync, realpathSync, unlinkSync, chmodSync, symlinkSync, renameSync, mkdirSync } from 'node:fs';
+import { join, resolve, isAbsolute, dirname } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { buildManagedCli } from './managed-cli.mjs';
+
+import { createRequire } from 'node:module';
+import { releaseBinding, verifyReleaseGraph } from '../assets/scripts/maintenance/release-graph.mjs';
+
+const marker = '// ours-managed-cli-v1 ';
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+function stat(path) {
+  try { return lstatSync(path); } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+function privateAcquisition(home, root) {
+  for (const path of [join(home, '.ours-client-install'), root]) {
+    const value = lstatSync(path);
+    if (!value.isDirectory() || value.uid !== process.getuid() || (value.mode & 0o077) || realpathSync(path) !== path) throw new Error('Unsafe private CLI directory');
+  }
+}
+/** Publish the native client, retaining a verified migration launcher for rollback. */
+export async function publishClientCli(effects, packagePath, { policy = {}, isolated = false } = {}) {
+  const prefix = (await effects.run('npm', ['prefix', '--global'])).stdout.trim();
+  if (!isAbsolute(prefix) || resolve(prefix) !== prefix) throw new Error('npm global prefix must be an absolute normalized path');
+  const entry = join(prefix, 'bin', 'ours');
+  const before = stat(entry);
+  let previous;
+  if (before) {
+    if (before.uid !== process.getuid()) throw new Error('Refusing to replace a CLI owned by another user');
+    if (before.isSymbolicLink()) {
+      const resolved = realpathSync(entry);
+      const privateBase = join(effects.home, '.ours-client-install') + '/';
+      if (resolved.startsWith(privateBase)) {
+        const packageRoot = dirname(dirname(resolved));
+        const acquisitionRoot = dirname(dirname(dirname(packageRoot)));
+        privateAcquisition(effects.home, acquisitionRoot);
+        const retained = JSON.parse(readFileSync(join(acquisitionRoot, 'sources.json')));
+        const binding = releaseBinding(retained);
+        if (binding && binding.scope !== 'host-cli') throw new Error('Unrecognized private CLI entry');
+        verifyReleaseGraph(acquisitionRoot, retained);
+        if (!binding) {
+          // Development selections publish through npm's global package entry.
+          // Require that exact retained selection and global target on retry;
+          // integrity-bound private host CLI releases keep their stricter path.
+          const npmRoot = (await effects.run('npm', ['root', '--global'])).stdout.trim();
+          const selected = retained.packages?.['@ours.network/cli'];
+          const pkg = JSON.parse(readFileSync(join(packageRoot, 'package.json')));
+          if (!isAbsolute(npmRoot) || realpathSync(join(npmRoot, '@ours.network/cli')) !== packageRoot || selected?.type !== 'npm' || selected.version !== pkg.version) throw new Error('Unrecognized private CLI entry');
+        }
+        const pkg = JSON.parse(readFileSync(join(packageRoot, 'package.json')));
+        if (pkg.name !== '@ours.network/cli' || resolve(packageRoot, pkg.bin?.ours ?? '') !== resolved) throw new Error('Unrecognized private CLI target');
+      } else {
+        const npmRoot = (await effects.run('npm', ['root', '--global'])).stdout.trim();
+        if (!isAbsolute(npmRoot)) throw new Error('Invalid npm global package root');
+        const root = realpathSync(join(npmRoot, '@ours.network/cli'));
+        const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+        if (manifest.name !== '@ours.network/cli' || typeof manifest.bin?.ours !== 'string' || resolved !== realpathSync(resolve(root, manifest.bin.ours))) throw new Error('Refusing to replace an unrelated ours symlink');
+      }
+    } else {
+      if (!before.isFile() || before.nlink !== 1 || (before.mode & 0o022)) throw new Error('Refusing to replace an unsafe CLI entry');
+      previous = readFileSync(entry);
+      const line = previous.toString().split('\n')[1];
+      if (!line?.startsWith(marker)) throw new Error('Refusing to replace an unknown ours executable');
+      const binding = JSON.parse(line.slice(marker.length));
+      if (binding.schema !== 1 || previous.toString() !== buildManagedCli(binding.recordPath, binding.installerPath)) throw new Error('Managed CLI launcher was modified; no replacement performed');
+      const backup = join(effects.home, '.ours-client', `previous-cli-${hash(previous)}.cjs`);
+      const backupDir = lstatSync(join(effects.home, '.ours-client'));
+      if (!backupDir.isDirectory() || backupDir.uid !== process.getuid() || (backupDir.mode & 0o7777) !== 0o700) throw new Error('Managed CLI backup requires a private owned directory');
+      const saved = stat(backup);
+      if (!saved) writeFileSync(backup, previous, { mode: 0o600, flag: 'wx' });
+      else if (!saved.isFile() || saved.nlink !== 1 || saved.uid !== process.getuid() || (saved.mode & 0o7777) !== 0o600 || saved.size !== previous.length || !readFileSync(backup).equals(previous)) throw new Error('Managed CLI backup is unsafe or differs');
+      const current = lstatSync(entry);
+      if (current.dev !== before.dev || current.ino !== before.ino || !readFileSync(entry).equals(previous)) throw new Error('CLI changed during publication');
+      if (!isolated) unlinkSync(entry);
+      effects.out(`Previous managed CLI saved at ${backup}; server maintenance remains available through ours-install server.`);
+    }
+  }
+  if (isolated) {
+    const root = dirname(dirname(dirname(packagePath)));
+    if (!realpathSync(root).startsWith(join(effects.home, '.ours-client-install') + '/') || releaseBinding(policy)?.scope !== 'host-cli') throw new Error('Invalid private CLI acquisition');
+    privateAcquisition(effects.home, root);
+    verifyReleaseGraph(root, policy);
+    const selected = JSON.parse(readFileSync(join(packagePath, 'package.json')));
+    const target = realpathSync(resolve(packagePath, selected.bin.ours));
+    if (!target.startsWith(realpathSync(packagePath) + '/')) throw new Error('CLI entry escapes selected package');
+    const sdkEntry = realpathSync(createRequire(target).resolve('@ours.network/sdk'));
+    if (!sdkEntry.startsWith(root + '/')) throw new Error('Private CLI SDK escaped verified acquisition');
+    const sdk = JSON.parse(readFileSync(join(dirname(dirname(sdkEntry)), 'package.json')));
+    if (sdk.name !== '@ours.network/sdk' || sdk.version !== policy.release.packages['@ours.network/sdk'].version) throw new Error('Private CLI SDK differs from selection');
+    mkdirSync(dirname(entry), { recursive: true });
+    const binDir = lstatSync(dirname(entry));
+    if (!binDir.isDirectory() || binDir.uid !== process.getuid() || (binDir.mode & 0o022)) throw new Error(`CLI bin directory ${dirname(entry)} must be owned by you and not writable by group or others; run chmod go-w on it, or point npm's global prefix at a directory you own`);
+    const current = stat(entry);
+    if (before ? !current || current.dev !== before.dev || current.ino !== before.ino : current) throw new Error('CLI entry changed during publication');
+    const staged = entry + '.' + randomUUID();
+    try {
+      symlinkSync(target, staged);
+      renameSync(staged, entry);
+    } catch (error) {
+      if (stat(staged)) unlinkSync(staged);
+      if (previous && !stat(entry)) writeFileSync(entry, previous, { mode: before.mode & 0o777, flag: 'wx' });
+      throw error;
+    }
+    if (realpathSync(entry) !== target) throw new Error('Private CLI entry changed during publication');
+    verifyReleaseGraph(root, policy);
+    return entry;
+  }
+  try {
+    await effects.run('npm', ['install', '--global', '--install-links=false', '--offline', '--ignore-scripts', '--no-audit', '--no-fund', packagePath]);
+  } catch (error) {
+    if (previous && !stat(entry)) {
+      writeFileSync(entry, previous, { mode: before.mode & 0o777, flag: 'wx' });
+      chmodSync(entry, before.mode & 0o777);
+    }
+    throw error;
+  }
+  const published = stat(entry);
+  if (!published?.isSymbolicLink() || published.uid !== process.getuid()) throw new Error('CLI publication did not create the expected owned npm entry');
+  const npmRoot = (await effects.run('npm', ['root', '--global'])).stdout.trim();
+  if (!isAbsolute(npmRoot) || resolve(npmRoot) !== npmRoot) throw new Error('Invalid npm global package root');
+  const root = realpathSync(join(npmRoot, '@ours.network/cli'));
+  const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const selected = JSON.parse(readFileSync(join(packagePath, 'package.json'), 'utf8'));
+  const target = typeof manifest.bin?.ours === 'string' ? resolve(root, manifest.bin.ours) : '';
+  if (manifest.name !== '@ours.network/cli' || manifest.version !== selected.version || !target.startsWith(root + '/') || realpathSync(entry) !== realpathSync(target) || !stat(target)?.isFile()) throw new Error('Published CLI does not match the selected package');
+  if (!readFileSync(target).equals(readFileSync(resolve(packagePath, selected.bin.ours)))) throw new Error('Published CLI entry differs from the selected artifact');
+  return entry;
+}