@webority/ensemble 0.5.10 → 0.5.12

package/lib/core.js

@@ -14,8 +14,9 @@ const DEFAULT_API = process.env.ENSEMBLE_API || 'https://api.ensemble.host';
 // Public host for the prebuilt binaries (runner + bus). Branded CDN in front of the blob
 // (Cloudflare Worker → ensembledl blob; the raw blob URL still works as a fallback). Overridable.
 const DL_BASE = process.env.ENSEMBLE_DL_BASE || 'https://storage.ensemble.host/cli';
-// RIDs we currently publish a prebuilt runner + bus for on DL_BASE. Expand as more are uploaded
-// (osx-x64 for Intel Macs, linux-arm64, win-arm64). Keep in sync with what the build pipeline ships.
+// RIDs we publish a prebuilt runner + runtime for (npm platform packages + the DL_BASE fallback).
+// Keep in sync with the build pipeline (publish-cli.yml). win-arm64 is not built yet — ARM Windows
+// runs the win-x64 build under emulation, since platform() maps every win32 host to win-x64.
 const SUPPORTED_PLATFORMS = ['win-x64', 'osx-arm64', 'osx-x64', 'linux-x64', 'linux-arm64'];
 
 function log(msg) { process.stdout.write(msg + '\n'); }
@@ -171,8 +172,13 @@ function restartRunner(pf, runnerPath) {
     if (pf.os === 'windows') {
       spawnSync('taskkill', ['/IM', 'Ensemble.Runner.exe', '/F'], { stdio: 'ignore' });
       startRunner(runnerPath);
+    } else if (pf.os === 'mac') {
+      installAutostart(runnerPath); // launchctl unload+load kills + respawns onto the new binary
     } else {
-      installAutostart(runnerPath); // unload+load (launchd) / enable --now (systemd) → picks up new binary
+      // systemd: `enable --now` is a no-op on an already-running unit, so the old process keeps its
+      // old inode after the binary is swapped — force an explicit restart onto the new build.
+      installAutostart(runnerPath);
+      spawnSync('systemctl', ['--user', 'restart', 'ensemble-runner.service'], { stdio: 'ignore' });
     }
   } catch (e) { /* best-effort — the new binary is on disk and runs on next launch */ }
 }
@@ -317,9 +323,24 @@ async function ensureBinaries(opts) {
     if (pf.os !== 'windows') {
       fs.chmodSync(t.dest, 0o755);
       // macOS requires at least an ad-hoc signature to run an unsigned binary.
-      if (pf.os === 'mac') spawnSync('codesign', ['-s', '-', '-f', t.dest], { stdio: 'ignore' });
+      if (pf.os === 'mac') {
+        const sign = spawnSync('codesign', ['-s', '-', '-f', t.dest], { stdio: 'ignore' });
+        if (sign.status !== 0) {
+          warn('codesign failed for ' + path.basename(t.dest) + ' — macOS may refuse to run it (' +
+            (sign.error ? sign.error.message : 'exit ' + sign.status) + '). Install Xcode Command Line Tools.');
+        }
+      }
     }
   }
+  // A ≥1MB size check (isUsableBinary) does NOT prove the runtime matches this CPU — a wrong-arch copy
+  // passes it and then every hook silently dies with "bad CPU type". Prove it actually executes before
+  // we trust it, so a bad download / wrong platform package / stale CDN blob fails the install loudly.
+  const smoke = spawnSync(runtimePath, ['--help'], { stdio: 'ignore', timeout: 5000 });
+  if (smoke.error || smoke.status == null) {
+    throw new Error('the Ensemble runtime at ' + runtimePath + ' does not run on this machine (' + pf.key +
+      ') — likely a wrong-arch or corrupt binary' + (smoke.error ? ': ' + smoke.error.message : '') +
+      '. Delete ~/.ensemble/bin and re-run `ensemble install`.');
+  }
   removeLegacyBusArtifacts();
   writeInstalledVersion();
   // A replaced runner binary only takes effect once the daemon restarts onto it.
@@ -346,9 +367,16 @@ function writeRunnerConfig(api, machineToken) {
     Logging: { LogLevel: { Default: 'Information', 'Microsoft.Hosting.Lifetime': 'Information' } },
     Ensemble: { HubUrl: hubUrl, MachineToken: machineToken },
   };
-  fs.writeFileSync(path.join(RUNNER_DIR, 'appsettings.json'), JSON.stringify(cfg, null, 2));
+  // appsettings.json embeds the plaintext machine token (cfg.Ensemble.MachineToken) — write it 0600,
+  // same as the dotfile below; a default-umask write left it world-readable on shared machines.
+  const appsettingsPath = path.join(RUNNER_DIR, 'appsettings.json');
+  fs.writeFileSync(appsettingsPath, JSON.stringify(cfg, null, 2), { mode: 0o600 });
   // ensemble-runtime reads ENSEMBLE_MACHINE_TOKEN from env — persist it to the shell rc + a dotfile.
-  fs.writeFileSync(path.join(ENSEMBLE_DIR, 'machine-token'), machineToken, { mode: 0o600 });
+  const tokenPath = path.join(ENSEMBLE_DIR, 'machine-token');
+  fs.writeFileSync(tokenPath, machineToken, { mode: 0o600 });
+  // `mode` only takes effect when the file is newly created — re-tighten on every enroll so a file an
+  // older build left at 0644 (or a manual edit widened) can't keep leaking the token.
+  try { fs.chmodSync(appsettingsPath, 0o600); fs.chmodSync(tokenPath, 0o600); } catch (e) { /* best-effort (Windows) */ }
   const pf = platform();
   if (pf.os === 'windows') {
     spawnSync('setx', ['ENSEMBLE_MACHINE_TOKEN', machineToken], { stdio: 'ignore' });
@@ -356,7 +384,7 @@ function writeRunnerConfig(api, machineToken) {
   const rc = path.join(HOME, pf.os === 'mac' ? '.zshrc' : '.bashrc');
   try {
     let cur = fs.existsSync(rc) ? fs.readFileSync(rc, 'utf8') : '';
-    cur = cur.replace(/\nexport ENSEMBLE_MACHINE_TOKEN=.*\n?/g, '\n');
+    cur = cur.replace(/(^|\n)export ENSEMBLE_MACHINE_TOKEN=.*\n?/g, '\n');
     if (!cur.endsWith('\n')) cur += '\n';
     cur += `export ENSEMBLE_MACHINE_TOKEN="${machineToken}"\n`;
     if (!/\.ensemble\/bin/.test(cur)) cur += `export PATH="$HOME/.ensemble/bin:$PATH"\n`;
@@ -364,6 +392,36 @@ function writeRunnerConfig(api, machineToken) {
   } catch (e) { /* best-effort */ }
 }
 
+function ensureWindowsRuntimePath() {
+  const pathKey = Object.keys(process.env).find((key) => key.toLowerCase() === 'path') || 'Path';
+  const currentProcessPath = process.env[pathKey] || '';
+  const normalize = (value) => value.replace(/[\\/]+$/, '').toLowerCase();
+  if (!currentProcessPath.split(';').some((entry) => normalize(entry) === normalize(BIN_DIR))) {
+    process.env[pathKey] = [currentProcessPath, BIN_DIR].filter(Boolean).join(';');
+  }
+
+  const script =
+    "$ErrorActionPreference = 'Stop'; " +
+    '$target = $env:ENSEMBLE_BIN_TO_ADD; ' +
+    "$current = [Environment]::GetEnvironmentVariable('Path', 'User'); " +
+    "$entries = @($current -split ';' | Where-Object { $_ }); " +
+    "if (-not ($entries | Where-Object { [string]::Equals($_.TrimEnd('\\'), $target.TrimEnd('\\'), " +
+    "[StringComparison]::OrdinalIgnoreCase) })) { " +
+    "[Environment]::SetEnvironmentVariable('Path', (($entries + $target) -join ';'), 'User') }";
+  const result = spawnSync(
+    'powershell.exe',
+    ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script],
+    {
+      encoding: 'utf8',
+      env: { ...process.env, ENSEMBLE_BIN_TO_ADD: BIN_DIR },
+    },
+  );
+  if (result.status !== 0) {
+    throw new Error('could not add ' + BIN_DIR + ' to the Windows user PATH: ' +
+      ((result.stderr || result.error || 'unknown error').toString().trim()));
+  }
+}
+
 // --- wire ensemble-runtime into each installed harness (hooks + MCP) ---
 // Fleet engines: Claude, Codex, Grok, OpenCode, OMP (oh-my-pi), Gemini, Antigravity (when present).
 // Hooks = mail at turn boundaries. MCP = who/send/read/reply tools every turn.
@@ -399,7 +457,11 @@ function wireHooks() {
     if (mergeClaudeHooks(path.join(HOME, '.claude', 'settings.json'), runtimeInvoke)) report.push('claude:hooks');
   }
   if (enginePresent('codex')) {
-    if (writeEngineHooks(path.join(HOME, '.codex', 'hooks.json'), runtimeInvoke, 'codex')) report.push('codex:hooks');
+    const windowsRuntime = pf.os === 'windows' ? path.basename(runtimeExe) : null;
+    if (windowsRuntime) ensureWindowsRuntimePath();
+    if (writeEngineHooks(path.join(HOME, '.codex', 'hooks.json'), runtimeInvoke, 'codex', windowsRuntime)) {
+      report.push('codex:hooks');
+    }
   }
   if (enginePresent('grok')) {
     if (writeEngineHooks(path.join(HOME, '.grok', 'hooks', 'agent-bus.json'), runtimeInvoke, 'grok')) report.push('grok:hooks');
@@ -704,8 +766,9 @@ function isEnsembleHook(h) {
 // only MCP worked). MERGE-preserving: keep other events + the user's own groups on our events, dedup
 // our entry so re-runs don't stack, and migrate away the legacy lowercase keys. [BUG-06673-hooks]
 // Returns true when written, false when skipped (malformed JSON left untouched).
-function writeEngineHooks(file, runtimeInvoke, engine) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
+function writeEngineHooks(file, runtimeInvoke, engine, windowsRuntime) {
+  try { fs.mkdirSync(path.dirname(file), { recursive: true }); }
+  catch (e) { warn('could not create ' + engine + ' hooks dir for ' + file + ': ' + (e.message || e)); return false; }
   let existing = {};
   if (fs.existsSync(file)) {
     try { existing = JSON.parse(fs.readFileSync(file, 'utf8')); }
@@ -729,7 +792,8 @@ function writeEngineHooks(file, runtimeInvoke, engine) {
   // command directly and the hook handler is already silent-safe on failure.
   const events = { SessionStart: 'session-start', UserPromptSubmit: 'user-prompt', Stop: 'stop', SessionEnd: 'session-end' };
   for (const [evt, ev] of Object.entries(events)) {
-    const command = `"${runtimeInvoke}" hook ${ev} --engine ${engine}`;
+    const runtimeCommand = windowsRuntime || `"${runtimeInvoke}"`;
+    const command = `${runtimeCommand} hook ${ev} --engine ${engine}`;
     const groups = Array.isArray(hooks[evt]) ? hooks[evt] : (hooks[evt] == null ? [] : [hooks[evt]]);
     const kept = groups
       .filter((g) => g && typeof g === 'object' && !Array.isArray(g))
@@ -739,13 +803,19 @@ function writeEngineHooks(file, runtimeInvoke, engine) {
     hooks[evt] = kept;
   }
   existing.hooks = hooks;
-  fs.writeFileSync(file, JSON.stringify(existing, null, 2) + '\n');
-  return true;
+  try {
+    fs.writeFileSync(file, JSON.stringify(existing, null, 2) + '\n');
+    return true;
+  } catch (e) {
+    warn('could not write ' + engine + ' hooks config ' + file + ': ' + (e.message || e));
+    return false;
+  }
 }
 
 // Returns true when the settings were written, false when skipped (malformed JSON left untouched).
 function mergeClaudeHooks(file, runtimeInvoke) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
+  try { fs.mkdirSync(path.dirname(file), { recursive: true }); }
+  catch (e) { warn('could not create Claude settings dir for ' + file + ': ' + (e.message || e)); return false; }
   let s = {};
   if (fs.existsSync(file)) {
     try { s = JSON.parse(fs.readFileSync(file, 'utf8')); }
@@ -765,8 +835,13 @@ function mergeClaudeHooks(file, runtimeInvoke) {
     kept.push({ hooks: [{ type: 'command', command }] });
     s.hooks[evt] = kept;
   }
-  fs.writeFileSync(file, JSON.stringify(s, null, 2) + '\n');
-  return true;
+  try {
+    fs.writeFileSync(file, JSON.stringify(s, null, 2) + '\n');
+    return true;
+  } catch (e) {
+    warn('could not write Claude settings ' + file + ': ' + (e.message || e));
+    return false;
+  }
 }
 
 // --- per-user auto-start of the runner (per OS), plus start it now ---
@@ -795,7 +870,11 @@ function installAutostart(runnerPath) {
   <key>StandardErrorPath</key><string>${path.join(RUNNER_DIR, 'runner.log')}</string>
 </dict></plist>`);
     spawnSync('launchctl', ['unload', plist], { stdio: 'ignore' });
-    spawnSync('launchctl', ['load', plist], { stdio: 'ignore' });
+    const load = spawnSync('launchctl', ['load', plist], { stdio: 'ignore' });
+    if (load.error || load.status !== 0) {
+      warn('could not load the launchd runner agent (' +
+        (load.error ? load.error.message : 'exit ' + load.status) + ') — autostart may not be active.');
+    }
   } else {
     const unitDir = path.join(HOME, '.config', 'systemd', 'user');
     fs.mkdirSync(unitDir, { recursive: true });
@@ -811,7 +890,12 @@ RestartSec=5
 [Install]
 WantedBy=default.target`);
     spawnSync('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' });
-    spawnSync('systemctl', ['--user', 'enable', '--now', 'ensemble-runner.service'], { stdio: 'ignore' });
+    const enable = spawnSync('systemctl', ['--user', 'enable', '--now', 'ensemble-runner.service'], { stdio: 'ignore' });
+    if (enable.error || enable.status !== 0) {
+      warn('could not enable the systemd --user runner service (' +
+        (enable.error ? enable.error.message : 'exit ' + enable.status) +
+        ') — no systemd --user session? Autostart may not be active.');
+    }
     spawnSync('loginctl', ['enable-linger', os.userInfo().username], { stdio: 'ignore' });
   }
 }

package/package.json

@@ -1,19 +1,22 @@
 {
   "name": "@webority/ensemble",
-  "version": "0.5.10",
+  "version": "0.5.12",
   "description": "Connect this machine to Ensemble — runs the local agent runner and wires the ensemble session bus so your coding sessions talk (per-org, isolated).",
   "bin": {
     "ensemble": "bin/ensemble.js"
   },
+  "scripts": {
+    "test": "node --test"
+  },
   "engines": {
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@webority/ensemble-darwin-arm64": "0.5.10",
-    "@webority/ensemble-darwin-x64": "0.5.10",
-    "@webority/ensemble-linux-arm64": "0.5.10",
-    "@webority/ensemble-linux-x64": "0.5.10",
-    "@webority/ensemble-win-x64": "0.5.10"
+    "@webority/ensemble-darwin-arm64": "0.5.12",
+    "@webority/ensemble-darwin-x64": "0.5.12",
+    "@webority/ensemble-linux-arm64": "0.5.12",
+    "@webority/ensemble-linux-x64": "0.5.12",
+    "@webority/ensemble-win-x64": "0.5.12"
   },
   "files": [
     "bin",