@ours.network/install 1.2.1-nightly.43 → 1.2.1-nightly.44

package/README.md

@@ -739,7 +739,7 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.54` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.57` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
 
 ### App tunnel setup prerelease sequencing
 
@@ -756,7 +756,7 @@ connection code automatically; the App checks readiness and opens the code field
 Private `--file`/`--stdin` transports remain optional and are the only transports
 for legacy v1 payloads with long-lived credentials.
 
-The nightly installer release manifest selects published Fleet `1.2.0-nightly.54`
+The nightly installer release manifest selects published Fleet `1.2.0-nightly.57`
 and its actual registry integrity through the normal release manifest/source-policy
 generators. This release includes v2 argument and private-input support. The former
 nightly.41 selection predates this capability. Merge and publish the repinned
@@ -813,7 +813,14 @@ Recovery introduces no host watchdog or service.
 Host boot is a separate prerequisite. On Linux, enable the selected Docker
 Engine system service; rootless Docker additionally needs its user service and
 user linger. The installer reports read-only boot diagnostics and does not enable
-or restart host services. A reachable remote Engine or Docker Desktop context
+or restart host services. It reads the persistent `docker.service` unit-file
+state, not whether Docker is running now: when Docker is running but not enabled,
+it says that ours components depending on Docker will not start automatically
+after a reboot and prints the optional command (`sudo systemctl enable
+docker.service`, or `systemctl --user enable docker.service` plus
+`sudo loginctl enable-linger USER` for rootless Docker). A masked unit, or a host
+not booted with systemd or with no `docker.service` (WSL with Docker Desktop integration, snap,
+OpenRC and similar), gets the same warning without a systemctl command. A reachable remote Engine or Docker Desktop context
 cannot prove boot recovery on this machine. A custom Unix socket also has an
 unverified boot-service binding; a host unit cannot establish its startup. On macOS/Windows with WSL, enable Docker
 Desktop startup at sign-in; this does not provide pre-login startup. Rootless

package/assets/release-lock.json

@@ -13,10 +13,10 @@
         "@ours.network/codex": "1.2.0-nightly.13",
         "@ours.network/cowork": "1.3.3-nightly.20261005.f549477",
         "@ours.network/daemon": "3.8.1-nightly.9",
-        "@ours.network/fleet": "1.2.0-nightly.54",
+        "@ours.network/fleet": "1.2.0-nightly.57",
         "@ours.network/mcp": "1.2.0-nightly.13",
         "@ours.network/messenger-server": "1.0.31-nightly.17",
-        "@ours.network/notifications": "0.3.1-nightly.2",
+        "@ours.network/notifications": "0.3.1-nightly.3",
         "@ours.network/sdk": "3.8.1-nightly.17",
         "@ours.network/tg-connector": "1.0.1-nightly.11"
       }
@@ -585,9 +585,9 @@
       }
     },
     "node_modules/@fastify/ajv-compiler": {
-      "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-4.0.6.tgz",
-      "integrity": "sha512-NtuzM0SfaMJbGlnjr9LWQUN5LzgSrbB8tf/wRZNas+4E1O/Nmzl53e7ruT61HDZyRCJGC6FxIogmNZO1c5ETBA==",
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-4.0.7.tgz",
+      "integrity": "sha512-VP0yIfwlc1ohj733keYDqyHm1VWeP9VQxYomunhr90jkC4aNNibbkrRiaNgPgqj1ORxUenILR4qzA/ppYBNAtQ==",
       "funding": [
         {
           "type": "github",
@@ -606,9 +606,9 @@
       }
     },
     "node_modules/@fastify/ajv-compiler/node_modules/fast-uri": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz",
-      "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==",
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.2.tgz",
+      "integrity": "sha512-EwVpUMzLVNOmcWW0zi5G3JJwkopB6XXjnVvNBGfqrMMsVew2hkQWl5e/pe/CfYUeS6jt4cIO2MnamEW7v/7wPw==",
       "funding": [
         {
           "type": "github",
@@ -621,10 +621,26 @@
       ],
       "license": "BSD-3-Clause"
     },
+    "node_modules/@fastify/deepmerge": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@fastify/deepmerge/-/deepmerge-3.2.2.tgz",
+      "integrity": "sha512-155eqA/WMQdN6gUD4RrhS2K0Pcz2Ou9pQ86L0sipOpP9ONbTA6oYw/hW4VdBjR4egcDHqmWUK9x80oUX7S1mDQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@fastify/error": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@fastify/error/-/error-4.2.0.tgz",
-      "integrity": "sha512-RSo3sVDXfHskiBZKBPRgnQTtIqpi/7zhJOEmAxCiBcM7d0uwdGdxLlsCaLzGs8v8NnxIRlfG0N51p5yFaOentQ==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@fastify/error/-/error-4.2.1.tgz",
+      "integrity": "sha512-MYBumuIwP+5MIpXSyKm6/o1Eigcoij186lWUssX3LH5U8KWqU0ktZhzC4CErIX9EJeQeRGI+zJZQWakBlFbUcg==",
       "funding": [
         {
           "type": "github",
@@ -638,9 +654,9 @@
       "license": "MIT"
     },
     "node_modules/@fastify/fast-json-stringify-compiler": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@fastify/fast-json-stringify-compiler/-/fast-json-stringify-compiler-5.1.0.tgz",
-      "integrity": "sha512-PxcYtKLbQ8Z+yApiqjK8FwxIwvEj38k2OiLc17u8dkJSlmfi2wHHPaSnaoqBPQqtvF8YVsDgDpP2snDCfFrpfw==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/fast-json-stringify-compiler/-/fast-json-stringify-compiler-5.1.1.tgz",
+      "integrity": "sha512-pyxRKk7UpUnnrztP9pF4+ZYxusEQ4LifTyzRdiXmyql1QezNHxO02D25MVU2o4kMeAMYWAjG6RKRlojgkbiDAw==",
       "funding": [
         {
           "type": "github",
@@ -657,9 +673,9 @@
       }
     },
     "node_modules/@fastify/forwarded": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@fastify/forwarded/-/forwarded-3.0.2.tgz",
-      "integrity": "sha512-NE8HgKLgYejV9lDpqkEFaDKMLYelJBVfHekhB0UKvX0ghagXRJqg68feg8er1NPXxG4N9i6vPxzt8E+3wHfcmA==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/forwarded/-/forwarded-3.1.1.tgz",
+      "integrity": "sha512-XfDtW2Icvhqi6DP1YHFK4q/E8WpNd3+raBdzAyVZxmTInbFTtnEEKvEAMMOVdFuRyv+ynYipaA9D8FvjPqACkw==",
       "funding": [
         {
           "type": "github",
@@ -673,9 +689,9 @@
       "license": "MIT"
     },
     "node_modules/@fastify/merge-json-schemas": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@fastify/merge-json-schemas/-/merge-json-schemas-0.2.1.tgz",
-      "integrity": "sha512-OA3KGBCy6KtIvLf8DINC5880o5iBlDX4SxzLQS8HorJAbqluzLRn80UXU0bxZn7UOFhFgpRJDasfwn9nG4FG4A==",
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/@fastify/merge-json-schemas/-/merge-json-schemas-0.2.2.tgz",
+      "integrity": "sha512-d/gx9sRbUCVgGRGzma46wLcwiY8noTqO2Nmjg/vbTARxHRE5bdh5PIL8s97Lt1X7ScRWRW52eVYxwIoPwIdVUA==",
       "funding": [
         {
           "type": "github",
@@ -692,9 +708,9 @@
       }
     },
     "node_modules/@fastify/proxy-addr": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.1.tgz",
-      "integrity": "sha512-zv07Y9GEuDsJPegZoDFd4SDWaZOW8N2pa0GSrYmKpId/tjt1Hgo3BjZBVjdVpfVrHaA+Qv5jawtS2O50J5xM9g==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.2.tgz",
+      "integrity": "sha512-uqB4QsgVoro0XDC+DIftIMGXHdBPn+lK6Ek3xXAIxPMCJfqxnbtyEoMCm2KPUVOuIosd7Cyw9HawEqMFM/UA+g==",
       "funding": [
         {
           "type": "github",
@@ -1002,9 +1018,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.54",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.54.tgz",
-      "integrity": "sha512-Sh3t8iRGBoYzbyslS+IKuqQ573Zn+M0GVhR0cGepy/hlyNMAwXD2TBM+j7d8QiA1+ALugkMhKnanivE97JBmhQ==",
+      "version": "1.2.0-nightly.57",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.57.tgz",
+      "integrity": "sha512-FAgN3L5yOlWQgGFJ4g0x1jpCqpAtYvRnol+ZBrgR8vCl+Ex1Ebct6GiSTIdkPtvYth4lidUgSkBpJqwiSTkx3Q==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",
@@ -1067,9 +1083,9 @@
       }
     },
     "node_modules/@ours.network/notifications": {
-      "version": "0.3.1-nightly.2",
-      "resolved": "https://registry.npmjs.org/@ours.network/notifications/-/notifications-0.3.1-nightly.2.tgz",
-      "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A==",
+      "version": "0.3.1-nightly.3",
+      "resolved": "https://registry.npmjs.org/@ours.network/notifications/-/notifications-0.3.1-nightly.3.tgz",
+      "integrity": "sha512-mt69E2LLkfwBMOJm7IP49wLIO9KtugBqh6nQpfrfbRuTlenjyrmZqcAuhW1CyI2R1H518B0Evxagnx9/V9fIig==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "web-push": "3.6.7",
@@ -1244,9 +1260,9 @@
       }
     },
     "node_modules/avvio": {
-      "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/avvio/-/avvio-9.3.0.tgz",
-      "integrity": "sha512-g2tQ7LE7oOSqDfwEm3M+ZCMTJc7KiZCdJ4UwyZJb5ckTKyYu50OYmvv0mCFXPuYXoM4zkSt8zM9XQ9KCvxA74A==",
+      "version": "9.3.1",
+      "resolved": "https://registry.npmjs.org/avvio/-/avvio-9.3.1.tgz",
+      "integrity": "sha512-QyTKW61/qlba+cUQBm/sT9X8lri4UdomqSDwCnrnj1IvLVDRRiXRkz4CgBRWB+/cmfC7SK5WQc8T1vSdGvaUcQ==",
       "funding": [
         {
           "type": "github",
@@ -1840,9 +1856,9 @@
       "license": "MIT"
     },
     "node_modules/fast-json-stringify": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fast-json-stringify/-/fast-json-stringify-7.0.1.tgz",
-      "integrity": "sha512-eRSayARSbbwlBjpP4vnTTIRD5QPcIrmihPxDeN1DtKnHPg66UuJLx+8hlK1kaFdjvzyQ/dzALoi4vwAQ+T+iZA==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stringify/-/fast-json-stringify-7.1.0.tgz",
+      "integrity": "sha512-wAhAQ+es0aH+x5OofdCHlZZFdqwtiM6lpEosaRIwfg271WYeEQ/tPcXdu5vpzlqZpbJ4WNqaW4QR5UjfG4Dc2w==",
       "funding": [
         {
           "type": "github",
@@ -1864,9 +1880,9 @@
       }
     },
     "node_modules/fast-json-stringify/node_modules/fast-uri": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz",
-      "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==",
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.2.tgz",
+      "integrity": "sha512-EwVpUMzLVNOmcWW0zi5G3JJwkopB6XXjnVvNBGfqrMMsVew2hkQWl5e/pe/CfYUeS6jt4cIO2MnamEW7v/7wPw==",
       "funding": [
         {
           "type": "github",
@@ -1946,9 +1962,9 @@
       }
     },
     "node_modules/fastify-plugin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
-      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.1.tgz",
+      "integrity": "sha512-4wW4RxSmvPXLrh5mgQEiu43qU3bw44N2ss4FTkTkQIbprUhE+/s43QX0j/ttcztdWK7PEkHqVthdc5GdEGDvjA==",
       "funding": [
         {
           "type": "github",
@@ -1992,9 +2008,9 @@
       }
     },
     "node_modules/find-my-way": {
-      "version": "9.9.0",
-      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.9.0.tgz",
-      "integrity": "sha512-sJsgZ1sQH2UDuowPuMKg8az7Qc8F0jnj+SKkFWU/+T0xcFlgV5skgXOGUqmQzOdmW6ALA7AhJINWx3qFBkbLHA==",
+      "version": "9.10.0",
+      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.10.0.tgz",
+      "integrity": "sha512-eru+uCPQ2g+nLBkf84MHP/KyNNMar0BDy0j+i8Fb72GF9/YHBZ58q7FODUtfVV7XU9nfRUHXSmaM8NmZcIbZ4Q==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -2334,9 +2350,9 @@
       "license": "MIT"
     },
     "node_modules/json-schema-ref-resolver": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-ref-resolver/-/json-schema-ref-resolver-3.0.0.tgz",
-      "integrity": "sha512-hOrZIVL5jyYFjzk7+y7n5JDzGlU8rfWDuYyHwGa2WA8/pcmMHezp2xsVwxrebD/Q9t8Nc5DboieySDpCp4WG4A==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/json-schema-ref-resolver/-/json-schema-ref-resolver-3.0.1.tgz",
+      "integrity": "sha512-w+HwgljXpVwZ3IidoUR1qPZxSOQ+NRQWuVe6a5pe8XbHsNZE4UAwVPUvzZagn7yBKbJtt6UJnRFYbNTRPZI45Q==",
       "funding": [
         {
           "type": "github",
@@ -2401,9 +2417,9 @@
       }
     },
     "node_modules/light-my-request": {
-      "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/light-my-request/-/light-my-request-6.6.0.tgz",
-      "integrity": "sha512-CHYbu8RtboSIoVsHZ6Ye4cj4Aw/yg2oAFimlF7mNvfDV192LR7nDiKtSIfCuLT7KokPSTn/9kfVLm5OGN0A28A==",
+      "version": "6.8.0",
+      "resolved": "https://registry.npmjs.org/light-my-request/-/light-my-request-6.8.0.tgz",
+      "integrity": "sha512-5Q8PjoSEdtGIB8fikZsTem5vgRo4F2mR6vUKTDW/H1g6MtAt8e3duQbg/QxL5yzg6BZhor2KOUm3hhWMWLTZwg==",
       "funding": [
         {
           "type": "github",
@@ -2416,40 +2432,25 @@
       ],
       "license": "BSD-3-Clause",
       "dependencies": {
-        "cookie": "^1.0.1",
-        "process-warning": "^4.0.0",
-        "set-cookie-parser": "^2.6.0"
+        "@fastify/deepmerge": "^3.1.0",
+        "cookie": "^2.0.0",
+        "process-warning": "^5.0.0",
+        "set-cookie-parser": "^3.0.1"
       }
     },
     "node_modules/light-my-request/node_modules/cookie": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
-      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-2.0.1.tgz",
+      "integrity": "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==",
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">=22"
       },
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/light-my-request/node_modules/process-warning": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-4.0.1.tgz",
-      "integrity": "sha512-3c2LzQ3rY9d0hc1emcsHhfT9Jwz0cChib/QN89oME2R451w5fy3f0afAhERFZAwrbDU43wk12d0ORBpDVME50Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/locate-path": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
@@ -2967,9 +2968,9 @@
       }
     },
     "node_modules/process-warning": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.1.0.tgz",
-      "integrity": "sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.1.1.tgz",
+      "integrity": "sha512-oCkNVj4OKnKEcocVBcDfiIugN1/cE6rgfT3nCtzeqZPA8+rIxMaQ0xXzIkGP8Gj2qUaP1UR7uhJ1VD8lUCpzCg==",
       "funding": [
         {
           "type": "github",
@@ -3219,9 +3220,9 @@
       "license": "MIT"
     },
     "node_modules/safe-regex2": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/safe-regex2/-/safe-regex2-5.1.1.tgz",
-      "integrity": "sha512-mOSBvHGDZMuIEZMdOz/aCEYDCv0E7nfcNsIhUF+/P+xC7Hyf3FkvymqgPbg9D1EdSGu+uKbJgy09K/RKKc7kJA==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-regex2/-/safe-regex2-5.1.2.tgz",
+      "integrity": "sha512-tAtCGFPPP02VroDVzp4daGi6bC7jWG+41D47GKf18FeH/ubvKQHT9VmhAkvtjNOmJwqtApzWeUpEhkyEYULvmw==",
       "funding": [
         {
           "type": "github",
@@ -3265,9 +3266,9 @@
       }
     },
     "node_modules/secure-json-parse": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-4.1.0.tgz",
-      "integrity": "sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-4.1.1.tgz",
+      "integrity": "sha512-lnd81MQEZKjhW/Gd2TQqdd4XP6QYNdDW/EP+I7nTrFHP9y2LmaGPIHk9xsnzcOiEr1c39c/e84xFgGviQKBTRw==",
       "funding": [
         {
           "type": "github",
@@ -3344,9 +3345,9 @@
       "license": "ISC"
     },
     "node_modules/set-cookie-parser": {
-      "version": "2.7.2",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
-      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.1.3.tgz",
+      "integrity": "sha512-xletSdAI5efyVJjsatBbzDkXl3M/Zmad3xfnQe7ZXuBB0yNwW7C2WFsNGjdRNfZunmNHQuX79xs/ACMTLCdcew==",
       "license": "MIT"
     },
     "node_modules/setprototypeof": {

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.43",
+  "installerVersion": "1.2.1-nightly.44",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.17",
@@ -24,12 +24,12 @@
       "integrity": "sha512-03qDDGRgN9pBGsBsCcvArhPuYfMblqsaXS9HinxAzOSiI3PaoNOh+4MxIAOoHXoE/12xxCDf7kbMdEAR0CPIfg=="
     },
     "@ours.network/notifications": {
-      "version": "0.3.1-nightly.2",
-      "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
+      "version": "0.3.1-nightly.3",
+      "integrity": "sha512-mt69E2LLkfwBMOJm7IP49wLIO9KtugBqh6nQpfrfbRuTlenjyrmZqcAuhW1CyI2R1H518B0Evxagnx9/V9fIig=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.54",
-      "integrity": "sha512-Sh3t8iRGBoYzbyslS+IKuqQ573Zn+M0GVhR0cGepy/hlyNMAwXD2TBM+j7d8QiA1+ALugkMhKnanivE97JBmhQ=="
+      "version": "1.2.0-nightly.57",
+      "integrity": "sha512-FAgN3L5yOlWQgGFJ4g0x1jpCqpAtYvRnol+ZBrgR8vCl+Ex1Ebct6GiSTIdkPtvYth4lidUgSkBpJqwiSTkx3Q=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.13",

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.43",
+    "installerVersion": "1.2.1-nightly.44",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.17",
@@ -25,12 +25,12 @@
         "integrity": "sha512-03qDDGRgN9pBGsBsCcvArhPuYfMblqsaXS9HinxAzOSiI3PaoNOh+4MxIAOoHXoE/12xxCDf7kbMdEAR0CPIfg=="
       },
       "@ours.network/notifications": {
-        "version": "0.3.1-nightly.2",
-        "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
+        "version": "0.3.1-nightly.3",
+        "integrity": "sha512-mt69E2LLkfwBMOJm7IP49wLIO9KtugBqh6nQpfrfbRuTlenjyrmZqcAuhW1CyI2R1H518B0Evxagnx9/V9fIig=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.54",
-        "integrity": "sha512-Sh3t8iRGBoYzbyslS+IKuqQ573Zn+M0GVhR0cGepy/hlyNMAwXD2TBM+j7d8QiA1+ALugkMhKnanivE97JBmhQ=="
+        "version": "1.2.0-nightly.57",
+        "integrity": "sha512-FAgN3L5yOlWQgGFJ4g0x1jpCqpAtYvRnol+ZBrgR8vCl+Ex1Ebct6GiSTIdkPtvYth4lidUgSkBpJqwiSTkx3Q=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.13",
@@ -83,11 +83,11 @@
     },
     "@ours.network/notifications": {
       "type": "npm",
-      "version": "0.3.1-nightly.2"
+      "version": "0.3.1-nightly.3"
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.54"
+      "version": "1.2.0-nightly.57"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/lib/boot-readiness.mjs

@@ -1,3 +1,26 @@
+import { warn } from './ui.mjs';
+
+const NO_AUTOSTART = 'ours components that depend on Docker will not start automatically after a reboot until Docker is started';
+const OPTIONAL = 'The installer does not change this for you.';
+
+/** Persistent unit-file state only: `is-active`/a reachable Engine says nothing about the next boot. */
+async function unitFileState(effects, scope) {
+  // `is-enabled` reads unit files offline, so it answers even where systemd is not the init
+  // system and its answer decides nothing. /run/systemd/system is sd_booted(3)'s own test.
+  if (!effects.exists('/run/systemd/system')) return 'unavailable';
+  try {
+    if (scope.length) await effects.run('systemctl', [...scope, 'show-environment']); // a user manager must be running
+    // 1 = disabled/masked, 4 = no such unit (older systemd reports that as 1 with empty output).
+    const state = (await effects.run('systemctl', [...scope, 'is-enabled', 'docker.service'], { allowCodes: [1, 4] })).stdout.trim().split('\n')[0];
+    if (state === 'enabled') return 'enabled';
+    // enabled-runtime lives in /run and is gone after the reboot it is supposed to cover.
+    if (state === 'disabled' || state === 'enabled-runtime') return 'disabled';
+    if (state === 'masked' || state === 'masked-runtime') return 'masked';
+    if (state === '' || state === 'not-found') return 'unavailable';
+    return 'unknown';
+  } catch { return 'unavailable'; } // no systemctl, or the host/session is not running systemd
+}
+
 /** Diagnose availability separately from boot enablement. Never alter host services. */
 export async function reportBootReadiness(effects, record) {
   const platform = effects.platform.platform;
@@ -16,28 +39,58 @@ export async function reportBootReadiness(effects, record) {
     effects.out('Container recovery requires Docker Desktop to start at sign-in. Enable its startup setting; this installer does not arrange pre-login host boot on this platform.');
     return;
   }
+  let endpoint, rootless;
   try {
     const context = JSON.parse((await effects.run('docker', ['context', 'inspect'])).stdout);
-    const endpoint = effects.env.DOCKER_HOST ?? context[0]?.Endpoints?.docker?.Host;
-    if (effects.env.DOCKER_CONTEXT || !endpoint?.startsWith('unix://') || endpoint.includes('/.docker/desktop/')) {
+    // The CLI runs with this same environment and reports the endpoint it resolved from
+    // DOCKER_HOST/DOCKER_CONTEXT; their precedence differs between its documentation and releases.
+    endpoint = context[0]?.Endpoints?.docker?.Host;
+    if (!endpoint?.startsWith('unix://') || endpoint.includes('/.docker/desktop/')) {
       effects.out('Container recovery requires the selected remote/Desktop Docker Engine to start independently; local systemd boot cannot be verified for this context.');
       return;
     }
     const info = JSON.parse((await effects.run('docker', ['info', '--format', '{{json .SecurityOptions}}'])).stdout);
-    const rootless = info.some(option => option.startsWith('name=rootless'));
-    const sockets = rootless ? [`unix:///run/user/${process.getuid()}/docker.sock`] : ['unix:///var/run/docker.sock', 'unix:///run/docker.sock'];
-    if (!sockets.includes(endpoint)) {
-      effects.out('The selected custom Docker socket is reachable, but its boot service binding is unverified; enable and verify the service owning that Engine.');
+    rootless = info.some(option => option.startsWith('name=rootless'));
+  } catch {
+    effects.out(warn(`Docker's start-at-boot setting could not be checked because the selected Docker Engine did not answer. If Docker is not set to start at boot, ${NO_AUTOSTART}.`));
+    return;
+  }
+  const sockets = rootless ? [`unix:///run/user/${process.getuid()}/docker.sock`] : ['unix:///var/run/docker.sock', 'unix:///run/docker.sock'];
+  if (!sockets.includes(endpoint)) {
+    effects.out('The selected custom Docker socket is reachable, but its boot service binding is unverified; enable and verify the service owning that Engine.');
+    return;
+  }
+  const scope = rootless ? ['--user'] : [];
+  const enable = `${rootless ? '' : 'sudo '}systemctl ${rootless ? '--user ' : ''}enable docker.service`;
+  const state = await unitFileState(effects, scope);
+  if (state === 'unavailable') {
+    // WSL with Docker Desktop integration, snap, OpenRC/runit and similar: a systemctl command would be wrong here.
+    effects.out(warn(`Docker is running now, but no running systemd${rootless ? ' user' : ''} manager with a docker.service was found, so its start-at-boot setting cannot be checked. If Docker is not set to start at boot, ${NO_AUTOSTART}. To start them automatically, enable start-at-boot in whatever manages this Docker Engine (Docker Desktop, snap, or your init system). ${OPTIONAL}`));
+    return;
+  }
+  if (state === 'unknown') {
+    effects.out(warn(`Docker is running now, but its systemd${rootless ? ' user' : ''} docker.service is neither plainly enabled nor disabled, so start at boot is not verified. If Docker does not start at boot, ${NO_AUTOSTART}. Check it with: systemctl ${rootless ? '--user ' : ''}status docker.service`));
+    return;
+  }
+  if (state === 'masked') {
+    effects.out(warn(`Docker is running now, but its systemd${rootless ? ' user' : ''} docker.service is masked, so it cannot start at boot: ${NO_AUTOSTART}. An administrator masked it deliberately; it must be unmasked before it can be enabled. ${OPTIONAL}`));
+    return;
+  }
+  if (state === 'disabled') {
+    effects.out(warn(`Docker is running now, but it is not enabled to start at boot: ${NO_AUTOSTART}. If you want them to start automatically, run: ${enable}${rootless ? ` (and, for startup before you log in, sudo loginctl enable-linger ${effects.username()})` : ''}. ${OPTIONAL}`));
+    return;
+  }
+  if (rootless) {
+    let linger = '';
+    try { linger = (await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value'])).stdout.trim(); } catch {}
+    if (linger === 'no') {
+      effects.out(warn(`Rootless Docker's user service is enabled, but user linger is off, so Docker starts only when you log in: ours components that depend on Docker will not start automatically after a reboot until then. If you want them to start at boot, run: sudo loginctl enable-linger ${effects.username()}. ${OPTIONAL}`));
       return;
     }
-    const enabled = await effects.run('systemctl', [...(rootless ? ['--user'] : []), 'is-enabled', 'docker.service']);
-    if (enabled.stdout.trim() !== 'enabled') throw new Error('persistent Docker service enablement is unverified');
-    if (rootless) {
-      const linger = await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value']);
-      if (linger.stdout.trim() !== 'yes') throw new Error('rootless user linger is disabled');
+    if (linger !== 'yes') {
+      effects.out(warn(`Rootless Docker's user service is enabled, but user linger could not be checked. If linger is off, Docker starts only when you log in and ours components that depend on Docker will not start automatically after a reboot until then. Check it with: loginctl show-user ${effects.username()} --property=Linger`));
+      return;
     }
-    effects.out(`Docker boot service is enabled${rootless ? ' with user linger' : ''}; managed containers recover when that Engine starts.`);
-  } catch {
-    effects.out('Docker is reachable, but automatic host boot is not verified. Ask the operator to enable the selected Docker Engine boot service (and user linger for rootless Docker); container restart policy cannot start an unavailable Engine.');
   }
+  effects.out(`Docker boot service is enabled${rootless ? ' with user linger' : ''}; managed containers recover when that Engine starts.`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.43",
+  "version": "1.2.1-nightly.44",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",