@beeos-ai/cli 1.0.15 → 1.0.17

package/dist/index.js

@@ -1206,12 +1206,25 @@ function agentBinCommandAndArgs(bin) {
   return { cmd: process.execPath, args: [bin.script] };
 }
 async function ensureDeviceAgent(progress) {
-  const ts = await findExistingTs();
-  if (ts) {
-    describeFound(ts, progress);
-    return ts;
+  const found = await findExistingTs();
+  if (found) {
+    describeFound(found, progress);
+    return found;
   }
-  throw new Error(tsNotFoundHint());
+  progress.onStatus("device-agent not found \u2014 installing @beeos-ai/device-agent + @beeos-ai/device-mcp-server (one-time, ~20MB)...");
+  const outcome = await upgradeBeeosSuite({
+    packages: [NPM_PKGS.DEVICE_AGENT, NPM_PKGS.DEVICE_MCP_SERVER],
+    progress
+  });
+  if (outcome.anyFailed) {
+    throw new Error(autoInstallFailedHint(outcome));
+  }
+  const after = await findExistingTs();
+  if (!after) {
+    throw new Error(tsNotFoundHint());
+  }
+  describeFound(after, progress);
+  return after;
 }
 function describeFound(bin, progress) {
   if (bin.type === "executable") {
@@ -1286,7 +1299,11 @@ async function pathDeviceAgent() {
   return null;
 }
 function tsNotFoundHint() {
-  return "device-agent (TS) not found.\n\nPick one:\n  \u2022 dev (recommended): cd agents/device-agent && pnpm install && pnpm -r build\n  \u2022 global:            npm i -g @beeos-ai/device-agent\n  \u2022 explicit:          export BEEOS_DEVICE_AGENT_BIN=/abs/path/to/device-agent[.js]";
+  return "device-agent (TS) not found after auto-install.\n\nThis usually means npm install -g succeeded but the binary is on a\ndifferent PATH than this shell sees (common with nvm/fnm).\n\nPick one:\n  \u2022 dev (recommended): cd agents/device-agent && pnpm install && pnpm -r build\n  \u2022 global re-install: npm i -g @beeos-ai/device-agent @beeos-ai/device-mcp-server\n  \u2022 explicit override: export BEEOS_DEVICE_AGENT_BIN=/abs/path/to/device-agent[.js]";
+}
+function autoInstallFailedHint(outcome) {
+  const failed = outcome.packages.filter((p) => p.failed).map((p) => `  \u2022 ${p.pkg}: ${p.failed}`).join("\n");
+  return "Auto-install of the device-agent suite failed.\n\nFailed packages:\n" + failed + "\n\nManual fix (run, then retry `beeos device attach`):\n  npm i -g @beeos-ai/device-agent @beeos-ai/device-mcp-server\n\nPin a specific version by exporting before retry:\n  export BEEOS_DEVICE_AGENT_VERSION=<semver>\n  export BEEOS_MCP_SERVER_VERSION=<semver>";
 }
 var init_device_setup = __esm({
   "../core/dist/device-setup.js"() {
@@ -1529,22 +1546,36 @@ var init_device = __esm({
         const lines = result.stdout.split("\n").slice(1);
         for (const line of lines) {
           const parts = line.trim().split(/\s+/);
-          if (parts.length >= 2 && parts[1] === "device") {
-            devices.push({ serial: parts[0] });
-          }
+          if (parts.length < 2)
+            continue;
+          const serial = parts[0];
+          const rawStatus = parts[1];
+          let status2;
+          if (rawStatus === "device")
+            status2 = "device";
+          else if (rawStatus === "unauthorized")
+            status2 = "unauthorized";
+          else
+            status2 = "offline";
+          devices.push({ serial, status: status2, rawStatus });
         }
         return devices;
       },
       async detectSingleDevice() {
-        const devices = await this.listAdbDevices();
-        if (devices.length === 0) {
+        const all = await this.listAdbDevices();
+        const ready = all.filter((d) => d.status === "device");
+        if (ready.length === 0) {
+          if (all.length > 0) {
+            const issues = all.map((d) => `${d.serial}=${d.rawStatus}`).join(", ");
+            throw new Error(`No ADB devices ready (only: ${issues}). Accept the USB prompt on the phone or check the cable.`);
+          }
           throw new Error("No ADB devices found. Connect a device and try again.");
         }
-        if (devices.length > 1) {
-          const serials = devices.map((d) => d.serial).join(", ");
+        if (ready.length > 1) {
+          const serials = ready.map((d) => d.serial).join(", ");
           throw new Error(`Multiple ADB devices found: ${serials}. Use --serial to specify one.`);
         }
-        return devices[0].serial;
+        return ready[0].serial;
       },
       async spawnForDevice(serial, agentBin, bridgeUrl, httpEnabled, httpPort, agentGatewayUrl) {
         const p = getPlatformAdapter();
@@ -3330,13 +3361,13 @@ function inferInitChoices(state) {
   if (state.hasIdentity && state.binding) {
     return {
       defaultDecision: "upgrade",
-      options: ["upgrade", "rebind-new-key", "skip"]
+      options: ["upgrade", "rebind", "reset-all", "skip"]
     };
   }
   if (state.hasIdentity) {
     return {
       defaultDecision: "upgrade",
-      options: ["upgrade", "rebind-new-key", "skip"]
+      options: ["upgrade", "reset-all", "skip"]
     };
   }
   return { defaultDecision: "fresh", options: ["fresh", "skip"] };
@@ -3347,8 +3378,10 @@ function initDecisionLabel(decision) {
       return "Install + bind";
     case "upgrade":
       return "Upgrade CLI & agents (keep binding & key)";
-    case "rebind-new-key":
-      return "Re-bind (rotate Ed25519 key)";
+    case "rebind":
+      return "Re-bind (keep key, refresh binding \u2014 same instance)";
+    case "reset-all":
+      return "Reset everything (NEW key, NEW instance \u2014 for compromised key)";
     case "skip":
       return "Skip (do nothing)";
   }
@@ -5092,6 +5125,20 @@ var init_fallback_banner = __esm({
   }
 });
 
+// src/json-envelope.ts
+function jsonOk(data) {
+  return { ok: true, data };
+}
+function emitJsonEnvelope(env) {
+  console.log(JSON.stringify(env, null, 2));
+}
+var init_json_envelope = __esm({
+  "src/json-envelope.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
 // src/commands/device/fleet-notify.ts
 async function notifyFleetReloadBestEffort(baseUrl = FLEET_STATUS_BASE_URL) {
   try {
@@ -5228,6 +5275,207 @@ var init_upgrade2 = __esm({
   }
 });
 
+// src/lib/instance-picker.ts
+import readline from "readline";
+function resolveIO(ctx) {
+  return {
+    input: ctx.input ?? process.stdin,
+    output: ctx.output ?? process.stdout
+  };
+}
+function isTTY(ctx, io) {
+  if (ctx.isTTY !== void 0) return ctx.isTTY;
+  return Boolean(io.input.isTTY);
+}
+function ask(io, question) {
+  const rl = readline.createInterface({ input: io.input, output: io.output });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+function statusBlurb(status2) {
+  switch (status2) {
+    case "device":
+      return "device";
+    case "unauthorized":
+      return "unauthorized \u2014 accept the USB prompt on the phone";
+    case "offline":
+      return "offline \u2014 check the USB cable / `adb kill-server`";
+  }
+}
+async function pickInstanceInteractive(candidates, ctx) {
+  const io = resolveIO(ctx);
+  if (!isTTY(ctx, io)) {
+    return { kind: "skip" };
+  }
+  const frameworks = candidates.filter(
+    (c) => c.kind === "framework"
+  );
+  const devices = candidates.filter(
+    (c) => c.kind === "device"
+  );
+  if (ctx.caller === "init") {
+    if (frameworks.length === 1 && devices.length === 0) {
+      return { kind: "framework", id: frameworks[0].id };
+    }
+    return renderMixedMenu(frameworks, devices, io);
+  }
+  if (devices.length === 0) {
+    if (ctx.caller === "discover") {
+      io.output.write("No ADB devices found. Connect a device and try again.\n");
+    }
+    return { kind: "skip" };
+  }
+  if (devices.length === 1) {
+    return askYesNoSingleDevice(devices[0], io);
+  }
+  return renderDeviceMenu(devices, io);
+}
+async function renderMixedMenu(frameworks, devices, io) {
+  const items = [];
+  let idx = 1;
+  for (const fw of frameworks) {
+    items.push({
+      idx: idx++,
+      kind: "framework",
+      id: fw.id,
+      label: fw.label,
+      isDefault: fw.isDefault === true
+    });
+  }
+  for (const d of devices) {
+    items.push({
+      idx: idx++,
+      kind: "device",
+      serial: d.serial,
+      status: d.status,
+      selectable: d.status === "device"
+    });
+  }
+  const defaultItem = items.find((i) => i.kind === "framework" && i.isDefault) ?? items[0];
+  io.output.write("\n");
+  io.output.write("What would you like to bind on this machine?\n");
+  io.output.write("\n");
+  if (frameworks.length > 0) {
+    io.output.write("  Local agent:\n");
+    for (const it of items) {
+      if (it.kind !== "framework") continue;
+      const def = it.isDefault ? "  (default)" : "";
+      io.output.write(`    [${it.idx}] ${it.label}${def}
+`);
+    }
+    io.output.write("\n");
+  }
+  if (devices.length > 0) {
+    io.output.write(`  ADB devices (${devices.length} found):
+`);
+    for (const it of items) {
+      if (it.kind !== "device") continue;
+      const tag = statusBlurb(it.status);
+      io.output.write(`    [${it.idx}] ${it.serial.padEnd(20)} ${tag}
+`);
+    }
+    io.output.write("\n");
+  }
+  io.output.write("  [s] Skip\n");
+  io.output.write("\n");
+  return promptForChoice(items, defaultItem.idx, io);
+}
+async function renderDeviceMenu(devices, io) {
+  const items = devices.map((d, i) => ({
+    idx: i + 1,
+    kind: "device",
+    serial: d.serial,
+    status: d.status,
+    selectable: d.status === "device"
+  }));
+  io.output.write("\n");
+  io.output.write(`Detected ${devices.length} ADB devices:
+`);
+  for (const it of items) {
+    io.output.write(`  [${it.idx}] ${it.serial.padEnd(20)} ${statusBlurb(it.status)}
+`);
+  }
+  io.output.write("\n");
+  return promptForChoice(
+    items,
+    /* defaultIdx */
+    -1,
+    io
+  );
+}
+async function askYesNoSingleDevice(device, io) {
+  if (device.status !== "device") {
+    io.output.write(
+      `Found 1 ADB device (serial=${device.serial}) but its status is ${statusBlurb(device.status)}.
+Skipping. Fix the device state and re-run.
+`
+    );
+    return { kind: "skip" };
+  }
+  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+    const answer = (await ask(io, `Found 1 ADB device (serial=${device.serial}). Attach now? [Y/n]: `)).trim().toLowerCase();
+    if (answer === "" || answer === "y" || answer === "yes") {
+      return { kind: "device", serial: device.serial };
+    }
+    if (answer === "n" || answer === "no" || answer === "s" || answer === "skip") {
+      return { kind: "skip" };
+    }
+    io.output.write(`  invalid input '${answer}'. Please answer Y or n.
+`);
+  }
+  io.output.write("  too many invalid inputs \u2014 skipping.\n");
+  return { kind: "skip" };
+}
+async function promptForChoice(items, defaultIdx, io) {
+  const range = `1-${items.length}`;
+  const defaultHint = defaultIdx > 0 ? `default ${defaultIdx}` : "default skip";
+  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+    const raw = await ask(io, `Choose [${range} / s] (${defaultHint}): `);
+    const trimmed = raw.trim().toLowerCase();
+    if (trimmed === "" && defaultIdx > 0) {
+      return itemToSelection(items[defaultIdx - 1], io);
+    }
+    if (trimmed === "" || trimmed === "s" || trimmed === "skip") {
+      return { kind: "skip" };
+    }
+    const n = Number.parseInt(trimmed, 10);
+    if (!Number.isFinite(n) || n < 1 || n > items.length) {
+      io.output.write(`  invalid input '${raw.trim()}'. Please pick a number in ${range} or 's'.
+`);
+      continue;
+    }
+    const picked = items[n - 1];
+    if (picked.kind === "device" && !picked.selectable) {
+      io.output.write(
+        `  device ${picked.serial} is ${statusBlurb(picked.status)} and cannot be attached yet.
+  Fix the device state on the phone and re-run.
+`
+      );
+      continue;
+    }
+    return itemToSelection(picked, io);
+  }
+  io.output.write("  too many invalid inputs \u2014 skipping.\n");
+  return { kind: "skip" };
+}
+function itemToSelection(item, _io) {
+  if (item.kind === "framework") {
+    return { kind: "framework", id: item.id };
+  }
+  return { kind: "device", serial: item.serial };
+}
+var MAX_RETRIES;
+var init_instance_picker = __esm({
+  "src/lib/instance-picker.ts"() {
+    "use strict";
+    MAX_RETRIES = 3;
+  }
+});
+
 // src/commands/device/state.ts
 import lockfile from "proper-lockfile";
 function deviceAgentTargetId(serial) {
@@ -5293,7 +5541,7 @@ var init_state2 = __esm({
 
 // src/commands/device/attach.ts
 import { spawn as spawn2 } from "child_process";
-import readline from "readline";
+import readline2 from "readline";
 function resolvePerDeviceAgentGatewayUrl(cfg, override) {
   if (override === void 0) return resolveAgentGatewayUrl(cfg);
   const trimmed = override.trim();
@@ -5325,6 +5573,24 @@ function resolvePerDeviceAgentGatewayUrl(cfg, override) {
   }
   return trimmed;
 }
+async function pickAttachSerial() {
+  const devices = await deviceRuntime.listAdbDevices();
+  const ready = devices.filter((d) => d.status === "device");
+  if (ready.length <= 1) {
+    return deviceRuntime.detectSingleDevice();
+  }
+  if (!process.stdin.isTTY) {
+    return deviceRuntime.detectSingleDevice();
+  }
+  const candidates = devices.map((d) => ({
+    kind: "device",
+    serial: d.serial,
+    status: d.status
+  }));
+  const sel = await pickInstanceInteractive(candidates, { caller: "attach" });
+  if (sel.kind === "device") return sel.serial;
+  return deviceRuntime.detectSingleDevice();
+}
 async function attach(options) {
   const cfg = await loadOrCreateConfig();
   const reporter = new CliReporter();
@@ -5336,7 +5602,7 @@ async function attach(options) {
   if (options.all) {
     return attachAll(cfg, reporter, withVideo, options);
   }
-  const serial = options.serial ?? await deviceRuntime.detectSingleDevice();
+  const serial = options.serial ?? await pickAttachSerial();
   const name = options.name ?? serial;
   await deviceRuntime.ensureAgent(reporter);
   reporter.stop();
@@ -5451,11 +5717,26 @@ async function attach(options) {
   await maybeNotifyFleetWithHint(cfg);
 }
 async function attachAll(cfg, reporter, withVideo, options) {
-  const devices = await deviceRuntime.listAdbDevices();
+  const all = await deviceRuntime.listAdbDevices();
+  const devices = all.filter((d) => d.status === "device");
+  const skipped = all.filter((d) => d.status !== "device");
   if (devices.length === 0) {
-    console.log("No ADB devices detected");
+    if (skipped.length > 0) {
+      console.log("No ADB devices ready to attach. Issues:");
+      for (const d of skipped) {
+        console.log(`  ${d.serial}: ${d.rawStatus}`);
+      }
+    } else {
+      console.log("No ADB devices detected");
+    }
     return;
   }
+  if (skipped.length > 0) {
+    console.log(`Skipping ${skipped.length} device(s) not in 'device' state:`);
+    for (const d of skipped) {
+      console.log(`  ${d.serial}: ${d.rawStatus}`);
+    }
+  }
   console.log(`Discovered ${devices.length} device(s) via adb.`);
   await deviceRuntime.ensureAgent(reporter);
   reporter.stop();
@@ -5695,7 +5976,7 @@ async function maybeNotifyFleetWithHint(cfg) {
   console.log("it, the device is recorded in ~/.beeos/devices.json but");
   console.log("no process is supervising the per-device agent.");
   console.log("");
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const answer = await new Promise((resolve) => {
     rl.question("Enable fleet now (registers a launchd service)? [Y/n]: ", (a) => {
       rl.close();
@@ -5869,7 +6150,7 @@ Android SDK Platform-Tools (adb) is licensed under the Android SDK License Agree
 Set BEEOS_ACCEPT_ADB_LICENSE=1 in your environment to skip this prompt next time.
 `
   );
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const ans = await new Promise((resolve) => {
     rl.question("Agree to the Android SDK license and download platform-tools? [Y/n]: ", (a) => {
       rl.close();
@@ -5883,6 +6164,7 @@ var init_attach = __esm({
     "use strict";
     init_dist();
     init_progress2();
+    init_instance_picker();
     init_fallback_banner();
     init_fleet_notify();
     init_state2();
@@ -6119,11 +6401,65 @@ var init_refresh_config = __esm({
   }
 });
 
+// src/commands/device/discover.ts
+async function run6(options = {}) {
+  const reporter = new CliReporter();
+  await ensureAdb(reporter, { autoInstall: false });
+  reporter.stop();
+  let devices;
+  try {
+    devices = await deviceRuntime.listAdbDevices();
+  } catch (e) {
+    if (options.json) {
+      emitJsonEnvelope(jsonOk({ devices: [], selected: null, action: "skip" }));
+      return;
+    }
+    console.log("ADB is not available \u2014 install Android platform-tools or run `beeos device attach` once to auto-install.");
+    console.log(`  (${e instanceof Error ? e.message : String(e)})`);
+    return;
+  }
+  if (options.json) {
+    emitJsonEnvelope(
+      jsonOk({
+        devices: devices.map((d) => ({
+          serial: d.serial,
+          status: d.status,
+          rawStatus: d.rawStatus
+        })),
+        selected: null,
+        action: "list"
+      })
+    );
+    return;
+  }
+  const candidates = devices.map((d) => ({
+    kind: "device",
+    serial: d.serial,
+    status: d.status
+  }));
+  const sel = await pickInstanceInteractive(candidates, { caller: "discover" });
+  if (sel.kind === "skip") return;
+  if (sel.kind === "device") {
+    await attach({ serial: sel.serial });
+  }
+}
+var init_discover = __esm({
+  "src/commands/device/discover.ts"() {
+    "use strict";
+    init_dist();
+    init_progress2();
+    init_json_envelope();
+    init_instance_picker();
+    init_attach();
+  }
+});
+
 // src/commands/device/index.ts
 var device_exports = {};
 __export(device_exports, {
   attach: () => attach,
   detach: () => detach,
+  discover: () => run6,
   exec: () => exec,
   list: () => list,
   nextHttpPort: () => nextHttpPort,
@@ -6139,6 +6475,7 @@ var init_device2 = __esm({
     init_exec();
     init_upgrade2();
     init_refresh_config();
+    init_discover();
     init_state2();
   }
 });
@@ -6362,18 +6699,8 @@ var NodePlatformAdapter = class {
 init_dist();
 init_progress2();
 init_fallback_banner();
+init_json_envelope();
 import os6 from "os";
-
-// src/json-envelope.ts
-init_dist();
-function jsonOk(data) {
-  return { ok: true, data };
-}
-function emitJsonEnvelope(env) {
-  console.log(JSON.stringify(env, null, 2));
-}
-
-// src/commands/start.ts
 async function run(agentFramework, options) {
   const p = getPlatformAdapter();
   await ensureDirs();
@@ -6564,6 +6891,7 @@ async function run2(agentFramework) {
 
 // src/commands/status.ts
 init_dist();
+init_json_envelope();
 async function run3(options = {}) {
   const home = beeoHome();
   const cfg = await loadOrCreateConfig();
@@ -6629,6 +6957,7 @@ function formatService(s) {
 
 // src/commands/update.ts
 init_dist();
+init_json_envelope();
 init_upgrade2();
 async function run4(agentFramework, options = {}) {
   if (agentFramework === "device") {
@@ -6669,6 +6998,7 @@ async function run4(agentFramework, options = {}) {
 
 // src/commands/bind-status.ts
 init_dist();
+init_json_envelope();
 async function run5(bindId, options) {
   const cfg = await loadOrCreateConfig();
   const resp = await getBindStatus(cfg.platform.api_url, bindId);
@@ -6732,14 +7062,15 @@ init_device2();
 
 // src/commands/init.ts
 init_dist();
-import readline2 from "readline";
+import readline3 from "readline";
 
 // src/commands/doctor.ts
 init_dist();
+init_json_envelope();
 import fs9 from "fs/promises";
 import path9 from "path";
 var LOG_SIZE_WARN_BYTES = 50 * 1024 * 1024;
-async function run6(options) {
+async function run7(options) {
   const state = await detectExistingInstall();
   const cfg = await loadOrCreateConfig();
   const p = getPlatformAdapter();
@@ -6754,7 +7085,8 @@ async function run6(options) {
   const resolvedAgentGatewayUrl = resolveAgentGatewayUrl(cfg);
   const agentGatewayHealth = await probeAgentGateway(resolvedAgentGatewayUrl);
   const tools = await collectToolStatus();
-  const shimReport = await collectShimReport();
+  const hasBoundDevices = state.devices.entries.length > 0;
+  const shimReport = await collectShimReport(hasBoundDevices);
   const warnings = [];
   const hints = [];
   if (!state.hasIdentity) {
@@ -6820,7 +7152,7 @@ async function run6(options) {
       );
     } else if (e.outcome === "missing") {
       warnings.push(`${e.pkg}: not installed globally \u2014 run 'beeos init' to install.`);
-    } else if (e.outcome === "error") {
+    } else if (e.outcome === "error" || e.outcome === "not_installed_yet") {
     }
   }
   if (shimReport.entries.some((e) => e.outcome === "outdated" || e.outcome === "missing")) {
@@ -6921,8 +7253,12 @@ async function collectToolStatus() {
     vncBridge: { path: vncPath }
   };
 }
-async function collectShimReport() {
+async function collectShimReport(hasBoundDevices) {
   const sources = readPinSourcesFromEnv();
+  const deviceSuite = /* @__PURE__ */ new Set([
+    NPM_PKGS.DEVICE_AGENT,
+    NPM_PKGS.DEVICE_MCP_SERVER
+  ]);
   const entries = await Promise.all(
     ALL_BEEOS_PKGS.map(async (pkg) => {
       const spec = resolveInstallSpec(pkg, sources);
@@ -6932,8 +7268,9 @@ async function collectShimReport() {
       ]);
       let outcome;
       if (latest === null) outcome = "error";
-      else if (installed === null) outcome = "missing";
-      else if (installed === latest) outcome = "ok";
+      else if (installed === null) {
+        outcome = deviceSuite.has(pkg) && !hasBoundDevices ? "not_installed_yet" : "missing";
+      } else if (installed === latest) outcome = "ok";
       else outcome = "outdated";
       if (pkg === NPM_PKGS.CLI && installed === null) {
         outcome = "missing";
@@ -6951,6 +7288,8 @@ function shimMarker(outcome) {
       return "\u2191";
     case "missing":
       return "\u2717";
+    case "not_installed_yet":
+      return "\xB7";
     case "error":
       return "?";
   }
@@ -7037,9 +7376,11 @@ function formatAgentGatewayStatus(h) {
 }
 
 // src/commands/init.ts
+init_attach();
 init_progress2();
 init_fallback_banner();
-async function run7(options) {
+init_instance_picker();
+async function run8(options) {
   await ensureDirs();
   if (options.device) {
     const { attach: attach2 } = await Promise.resolve().then(() => (init_device2(), device_exports));
@@ -7048,7 +7389,7 @@ async function run7(options) {
   }
   const state = await detectExistingInstall();
   if (options.json) {
-    await run6({ json: true });
+    await run7({ json: true });
   } else {
     printBanner();
     for (const line of summarizeExistingInstall(state)) {
@@ -7074,10 +7415,45 @@ async function run7(options) {
     }
     console.log("Ensuring OpenClaw is running...\n");
   }
-  if (decision === "rebind-new-key") {
+  if (decision === "rebind") {
+    await removeBindingInfo();
+  }
+  if (decision === "reset-all") {
     await rotateIdentity();
     await removeBindingInfo();
   }
+  if (decision === "fresh" && !options.framework && !options.yes && !options.json && process.stdin.isTTY) {
+    const sel = await pickFreshInstance(options);
+    if (sel.kind === "skip") {
+      console.log("Skipped. Re-run `beeos init` or `beeos device attach` whenever ready.");
+      return;
+    }
+    if (sel.kind === "device") {
+      await attach({ serial: sel.serial });
+      return;
+    }
+    const descriptor2 = frameworkById(sel.id);
+    if (!descriptor2 || descriptor2.status !== "available") {
+      throw new BeeosError({
+        code: "framework_unavailable",
+        message: `Agent framework '${sel.id}' is not available.`,
+        hint: "Pick a different framework or reinstall the CLI.",
+        details: { requested: sel.id, available: availableFrameworks().map((f) => f.id) }
+      });
+    }
+    await run(descriptor2.id, {
+      force: true,
+      json: options.json,
+      browser: options.browser !== false
+    });
+    if (!options.json && !options.skipServicePrompt) {
+      await maybePromptServiceInstall();
+    }
+    if (!options.json) {
+      printNextSteps();
+    }
+    return;
+  }
   const frameworkId = await decideFramework(state, decision, options);
   const descriptor = frameworkById(frameworkId);
   if (!descriptor || descriptor.status !== "available") {
@@ -7176,6 +7552,32 @@ async function decideFramework(state, decision, options) {
   }
   return picked.id;
 }
+async function safeListAdbDevices() {
+  const adbPath = await findAdb().catch(() => null);
+  if (!adbPath) return [];
+  try {
+    return await deviceRuntime.listAdbDevices();
+  } catch {
+    return [];
+  }
+}
+async function pickFreshInstance(_opts) {
+  const frameworks = availableFrameworks().map((f) => ({
+    kind: "framework",
+    id: f.id,
+    label: f.displayName,
+    description: f.description,
+    isDefault: f.id === defaultFrameworkId()
+  }));
+  const devices = (await safeListAdbDevices()).map((d) => ({
+    kind: "device",
+    serial: d.serial,
+    status: d.status
+  }));
+  return pickInstanceInteractive([...frameworks, ...devices], {
+    caller: "init"
+  });
+}
 async function maybePromptServiceInstall() {
   try {
     const mgr = await getServiceManager();
@@ -7227,7 +7629,7 @@ function printNextSteps() {
   console.log("");
 }
 function prompt(question) {
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (answer) => {
       rl.close();
@@ -7244,19 +7646,22 @@ async function upgradeAndMaybeExit(options) {
   if (options.json) {
     return false;
   }
-  console.log("Checking for newer @beeos-ai/cli + agents on npm...");
+  const packages = await pickInstalledPackages();
+  console.log("Checking for newer @beeos-ai/cli on npm...");
   const reporter = new CliReporter();
   let outcome;
   try {
     outcome = await upgradeBeeosSuite({
-      packages: ALL_BEEOS_PKGS,
+      packages,
       progress: reporter
     });
   } catch (e) {
     reporter.stop();
     console.log(
       `  (upgrade skipped \u2014 ${e instanceof Error ? e.message : String(e)})
-  Tip: re-run \`npm install -g @beeos-ai/cli @beeos-ai/device-agent @beeos-ai/device-mcp-server\` manually.`
+  Tip: re-run \`npm install -g @beeos-ai/cli\` manually. The device
+  suite (device-agent + device-mcp-server) will be auto-installed
+  on the next \`beeos device attach\`.`
     );
     return false;
   }
@@ -7265,7 +7670,7 @@ async function upgradeAndMaybeExit(options) {
     const failed = outcome.packages.find((p) => p.failed)?.failed ?? "unknown error";
     console.log(`  \u26A0 npm install failed: ${failed}`);
     console.log(
-      "    Manual fix:\n      npm i -g @beeos-ai/cli @beeos-ai/device-agent @beeos-ai/device-mcp-server\n"
+      "    Manual fix:\n      npm i -g @beeos-ai/cli\n    (the device suite is auto-installed on `beeos device attach`)\n"
     );
     return false;
   }
@@ -7289,9 +7694,18 @@ async function upgradeAndMaybeExit(options) {
   console.log("  Agents updated. Continuing init...\n");
   return false;
 }
+async function pickInstalledPackages() {
+  const packages = [NPM_PKGS.CLI];
+  for (const pkg of [NPM_PKGS.DEVICE_AGENT, NPM_PKGS.DEVICE_MCP_SERVER]) {
+    const installed = await npmGlobalVersion(pkg).catch(() => null);
+    if (installed !== null) packages.push(pkg);
+  }
+  return packages;
+}
 
 // src/commands/service.ts
 init_dist();
+init_json_envelope();
 async function install(options) {
   const mgr = await getServiceManager();
   const check = await mgr.selfCheck();
@@ -7376,7 +7790,8 @@ async function status(options) {
 
 // src/commands/migrate.ts
 init_dist();
-async function run8(options) {
+init_json_envelope();
+async function run9(options) {
   await ensureDirs();
   const mgr = await getServiceManager();
   const mig = await migrateLegacySupervisor(mgr);
@@ -7413,6 +7828,7 @@ async function run8(options) {
 
 // src/commands/logs.ts
 init_dist();
+init_json_envelope();
 function resolveLogTarget(input, services) {
   const exact = services.find((s) => s.id === input);
   if (exact) {
@@ -7434,7 +7850,7 @@ function resolveLogTarget(input, services) {
     matchedFrom: "fallback"
   };
 }
-async function run9(idArg, options) {
+async function run10(idArg, options) {
   const mgr = await getServiceManager();
   let services = [];
   try {
@@ -7508,12 +7924,12 @@ setPlatformAdapter(new NodePlatformAdapter());
 var program = new Command();
 var cliVersion = getCliVersion(import.meta.url, resolveActiveDistTag());
 program.name("beeos").version(cliVersion.display).description("BeeOS \u2014 run AI agents from your desktop");
-program.command("init").description("One-shot install + bind flow (default entry from the curl installer)").option("--framework <name>", "Agent framework to install (default: openclaw)").option("--yes", "Non-interactive \u2014 accept the default action", false).option("--json", "Output machine-readable JSON (implies --yes)", false).option("--no-browser", "Don't auto-open a browser for bind confirmation").option("--headless", "Never open a browser (use terminal QR only)", false).option("--skip-service-prompt", "Skip the system-service install prompt", false).option("--device", "Jump straight into `beeos device attach` instead", false).action((opts) => run7(opts));
-program.command("doctor").description("Inspect local BeeOS state (install, binding, services, warnings)").option("--json", "Output machine-readable JSON", false).action((opts) => run6(opts));
-program.command("migrate").description("Migrate legacy Node supervisor state to OS-native services (one-shot)").option("--json", "Output machine-readable JSON", false).action((opts) => run8(opts));
+program.command("init").description("One-shot install + bind flow (default entry from the curl installer)").option("--framework <name>", "Agent framework to install (default: openclaw)").option("--yes", "Non-interactive \u2014 accept the default action", false).option("--json", "Output machine-readable JSON (implies --yes)", false).option("--no-browser", "Don't auto-open a browser for bind confirmation").option("--headless", "Never open a browser (use terminal QR only)", false).option("--skip-service-prompt", "Skip the system-service install prompt", false).option("--device", "Jump straight into `beeos device attach` instead", false).action((opts) => run8(opts));
+program.command("doctor").description("Inspect local BeeOS state (install, binding, services, warnings)").option("--json", "Output machine-readable JSON", false).action((opts) => run7(opts));
+program.command("migrate").description("Migrate legacy Node supervisor state to OS-native services (one-shot)").option("--json", "Output machine-readable JSON", false).action((opts) => run9(opts));
 program.command("logs").description(
   "Tail logs for a BeeOS service. Pass an ADB serial or service id; omit to list every registered service's log file path."
-).argument("[id]", "Service id (e.g. `device-agent-<serial>`) or raw ADB serial").option("-f, --follow", "Stream new log lines (Ctrl-C to exit)", false).option("-n, --lines <n>", "Initial trailing lines to print (default 50)", (v) => Number(v)).option("--json", "Output machine-readable JSON (resolves the path; does not stream)", false).action((id, opts) => run9(id, opts));
+).argument("[id]", "Service id (e.g. `device-agent-<serial>`) or raw ADB serial").option("-f, --follow", "Stream new log lines (Ctrl-C to exit)", false).option("-n, --lines <n>", "Initial trailing lines to print (default 50)", (v) => Number(v)).option("--json", "Output machine-readable JSON (resolves the path; does not stream)", false).action((id, opts) => run10(id, opts));
 var serviceCmd = program.command("service").description("Inspect and manage the OS-native service manager (launchd / systemd --user / Task Scheduler)");
 serviceCmd.command("install").description("Verify the OS service manager is available (per-target services install automatically)").option("--json", "Output machine-readable JSON", false).action((opts) => install(opts));
 serviceCmd.command("uninstall").description("Uninstall every BeeOS-managed OS service").option("--json", "Output machine-readable JSON", false).action((opts) => uninstall(opts));
@@ -7541,6 +7957,9 @@ deviceCmd.command("upgrade").description("Upgrade the device-agent (and scrcpy/v
 deviceCmd.command("refresh-config").description(
   "Re-fetch this device's VLM/ARouter config from Agent Gateway and rewrite ~/.beeos/<instance_id>.config.json (use after dashboard changes)."
 ).option("--serial <serial>", "ADB device serial number").option("--all", "Refresh every attached device", false).action(refreshConfig);
+deviceCmd.command("discover").description(
+  "List ADB devices and pick one to attach (interactive). Use this when you've plugged in a phone after `beeos init` and want to attach it without remembering --serial."
+).option("--json", "Output machine-readable JSON envelope ({ok,data})", false).action((opts) => run6(opts));
 program.parseAsync(process.argv).catch((err) => {
   const wantsJson = process.argv.includes("--json");
   if (isBeeosError(err)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beeos-ai/cli",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "type": "module",
   "description": "BeeOS CLI — run AI agents from your desktop",
   "bin": {

package/scripts/_existing_install_actions.json

@@ -7,7 +7,7 @@
     "",
     "  1. web/packages/cli/scripts/install.sh   (bash, pre-Node)",
     "  2. web/packages/cli/scripts/install.ps1  (PowerShell, pre-Node)",
-    "  3. web/packages/cli/src/commands/init.ts (TS, post-Node)",
+    "  3. web/packages/core/src/detect.ts        (TS, post-Node, used by init.ts)",
     "",
     "Pre-Node sites can't import TypeScript constants, so we anchor the",
     "wording with this manifest plus a vitest grep lint",
@@ -15,7 +15,23 @@
     "If you change a label in any of the three files, update the",
     "matching `keywords` here so the lint stays representative; if you",
     "add a new action altogether, add a new entry below + render it",
-    "in all three sites."
+    "in all three sites.",
+    "",
+    "## Note on the 1.0.17 rebind split (P2 of the install-link review)",
+    "",
+    "detect.ts now exposes TWO rebind variants in addition to the three",
+    "actions enforced here:",
+    "",
+    "  - 'rebind'    — soft rebind, keeps Ed25519 key, refreshes binding;",
+    "                  same instance_id (platform Bind handler returns",
+    "                  the existing instance for a known pubkey).",
+    "  - 'reset-all' — rotates the key AND wipes binding; NEW instance.",
+    "",
+    "These are NOT enforced across all 3 call sites because the",
+    "pre-Node bash/PowerShell installers have only [Reinstall][Re-run][Skip]",
+    "buttons — the rebind variants live exclusively inside `beeos init`'s",
+    "interactive menu. The 'rerun' keyword 'Re-bind' below incidentally",
+    "covers detect.ts's soft-rebind label, which keeps this lint passing."
   ],
   "actions": {
     "upgrade": {
@@ -23,7 +39,7 @@
       "keywords": ["Reinstall", "Upgrade"]
     },
     "rerun": {
-      "$comment": "Reuse the existing install (no npm i -g). install.sh/install.ps1 say 'Re-run beeos init', init.ts shows the 'Re-bind' wording for the same conceptual action.",
+      "$comment": "Reuse the existing install (no npm i -g). install.sh/install.ps1 say 'Re-run beeos init'. detect.ts's soft-rebind label includes 'Re-bind' which is intentionally captured here too — see the 1.0.17 split note in $comment above.",
       "keywords": ["Re-run", "Re-bind", "Reusing"]
     },
     "skip": {
@@ -36,5 +52,18 @@
     "packages/cli/scripts/install.sh",
     "packages/cli/scripts/install.ps1",
     "packages/core/src/detect.ts"
-  ]
+  ],
+  "$advisory_comment": "Strings below are advisory — not enforced by the lint, but checked by `existing-install-actions.test.ts` to make sure detect.ts's two rebind variants stay distinguishable from each other.",
+  "advisory": {
+    "rebind_soft": {
+      "$comment": "1.0.17+ : detect.ts must include this exact phrase so users see the soft-rebind keeps the same instance_id.",
+      "must_appear_in": ["packages/core/src/detect.ts"],
+      "keywords": ["keep key, refresh binding", "same instance"]
+    },
+    "rebind_destructive": {
+      "$comment": "1.0.17+ : detect.ts must include this phrase so the destructive rebind is unmistakable.",
+      "must_appear_in": ["packages/core/src/detect.ts"],
+      "keywords": ["NEW key", "NEW instance"]
+    }
+  }
 }

package/scripts/install.Tests.ps1

@@ -23,18 +23,24 @@
 
 # ── Parse-time checks ────────────────────────────────────────
 
-$scriptPath = Join-Path $PSScriptRoot "install.ps1"
+# Pester 5 runs file-level code in the discovery phase but does NOT
+# propagate vars defined there into It blocks at run phase. Compute
+# the path inside each test (or via BeforeAll) so $scriptPath is
+# always non-null when the assertions execute.
+BeforeAll {
+    $script:ScriptPath = Join-Path $PSScriptRoot "install.ps1"
+}
 
 Describe "install.ps1 parse-time integrity" {
     It "exists at the expected path" {
-        Test-Path $scriptPath | Should -Be $true
+        Test-Path $script:ScriptPath | Should -Be $true
     }
 
     It "parses without syntax errors (AST round-trip)" {
         $tokens = $null
         $errors = $null
         [System.Management.Automation.Language.Parser]::ParseFile(
-            $scriptPath,
+            $script:ScriptPath,
             [ref]$tokens,
             [ref]$errors
         ) | Out-Null
@@ -45,7 +51,7 @@ Describe "install.ps1 parse-time integrity" {
         $tokens = $null
         $errors = $null
         $ast = [System.Management.Automation.Language.Parser]::ParseFile(
-            $scriptPath,
+            $script:ScriptPath,
             [ref]$tokens,
             [ref]$errors
         )
@@ -55,6 +61,9 @@ Describe "install.ps1 parse-time integrity" {
             $node -is [System.Management.Automation.Language.FunctionDefinitionAst]
         }, $true) | ForEach-Object { $_.Name }
 
+        # CLI >= 1.0.16: Install-DeviceAgentSuite has been removed —
+        # the device suite installs lazily on the first
+        # `beeos device attach` (see core/device-setup.ts).
         $expected = @(
             "Write-BeeInfo",
             "Write-BeeOk",
@@ -66,7 +75,6 @@ Describe "install.ps1 parse-time integrity" {
             "Show-InstallHints",
             "Send-Telemetry",
             "Read-ExistingInstallAction",
-            "Install-DeviceAgentSuite",
             "Invoke-BeeosCli",
             # P2-8: PSCore + RunAs auto-elevation helpers.
             "Test-IsAdministrator",
@@ -83,7 +91,7 @@ Describe "install.ps1 parse-time integrity" {
 
 Describe "install.ps1 platform guard (P2-8)" {
     It "contains the non-Windows early-exit branch" {
-        $content = Get-Content -Raw -Path $scriptPath
+        $content = Get-Content -Raw -Path $script:ScriptPath
         # Look for the marker comment AND the exit branch so a
         # superficial rename of the variable still trips the test.
         $content | Should -Match "This installer is Windows-only"
@@ -91,12 +99,12 @@ Describe "install.ps1 platform guard (P2-8)" {
     }
 
     It "contains a UAC auto-elevation branch" {
-        $content = Get-Content -Raw -Path $scriptPath
+        $content = Get-Content -Raw -Path $script:ScriptPath
         $content | Should -Match "Start-Process .* -Verb RunAs"
     }
 
     It "honours BEEOS_NO_AUTO_ELEVATE=1 as an opt-out" {
-        $content = Get-Content -Raw -Path $scriptPath
+        $content = Get-Content -Raw -Path $script:ScriptPath
         $content | Should -Match "BEEOS_NO_AUTO_ELEVATE"
     }
 }
@@ -106,13 +114,16 @@ Describe "install.ps1 stdin / TTY handover (P1-J)" {
     # prompts read from the exhausted pipe and silently take defaults.
     # Mirrors install.sh's `</dev/tty` reattachment.
     It "detects [Console]::IsInputRedirected" {
-        $content = Get-Content -Raw -Path $scriptPath
+        $content = Get-Content -Raw -Path $script:ScriptPath
         $content | Should -Match "\[Console\]::IsInputRedirected"
     }
 
     It "uses Start-Process with -NoNewWindow when stdin is redirected" {
-        $content = Get-Content -Raw -Path $scriptPath
-        $content | Should -Match "Start-Process .* -NoNewWindow"
+        $content = Get-Content -Raw -Path $script:ScriptPath
+        # The Start-Process invocation in install.ps1 uses backtick line
+        # continuation, so `-NoNewWindow` lives on a separate line from
+        # `Start-Process`. `(?s)` enables dotall so `.` matches newlines.
+        $content | Should -Match "(?s)Start-Process .*?-NoNewWindow"
     }
 }
 
@@ -121,25 +132,29 @@ Describe "install.ps1 stderr log file (P1-I)" {
     # MUST land in a forensic file instead of `2>$null`. The lint
     # below is structural — assert the variable + the redirect appear.
     It "declares a `$BeeosInstallLog` variable" {
-        $content = Get-Content -Raw -Path $scriptPath
+        $content = Get-Content -Raw -Path $script:ScriptPath
         $content | Should -Match "BeeosInstallLog"
     }
 
     It "redirects winget stderr to the install log" {
-        $content = Get-Content -Raw -Path $scriptPath
+        $content = Get-Content -Raw -Path $script:ScriptPath
         # `2>>$BeeosInstallLog` is the canonical append-redirect syntax;
         # `2>$null` here would be a regression to the silent
         # behaviour the review called out.
-        $content | Should -Match "winget install [^`r`n]+2>>\$BeeosInstallLog"
+        # Use a single-quoted string so `$BeeosInstallLog` is NOT
+        # subject to PowerShell variable interpolation; the .NET regex
+        # engine still treats `\r` / `\n` as CR / LF and `\$` as a
+        # literal `$`.
+        $content | Should -Match 'winget install [^\r\n]+2>>\$BeeosInstallLog'
     }
 
     It "redirects choco stderr to the install log" {
-        $content = Get-Content -Raw -Path $scriptPath
-        $content | Should -Match "choco install [^`r`n]+2>>\$BeeosInstallLog"
+        $content = Get-Content -Raw -Path $script:ScriptPath
+        $content | Should -Match 'choco install [^\r\n]+2>>\$BeeosInstallLog'
     }
 
     It "Show-InstallHints surfaces the log path on failure" {
-        $content = Get-Content -Raw -Path $scriptPath
+        $content = Get-Content -Raw -Path $script:ScriptPath
         $content | Should -Match "Installer log:"
     }
 }
@@ -164,6 +179,6 @@ Describe "install.ps1 dry-run hook" {
         # Dot-source so we exercise the param-block + helper definitions
         # without invoking the main install body. The dry-run hook
         # `return`s before any state-changing call.
-        { . $scriptPath } | Should -Not -Throw
+        { . $script:ScriptPath } | Should -Not -Throw
     }
 }

package/scripts/install.ps1

@@ -23,16 +23,24 @@
                                        bootstrap requests).
       $env:BEEOS_DASHBOARD_URL        Dashboard base (OAuth + bind redirect).
       $env:BEEOS_DEVICE_AGENT_VERSION Pin @beeos-ai/device-agent semver.
-      $env:BEEOS_MCP_SERVER_VERSION   Pin @beeos-ai/device-mcp-server semver.
+                                       NOT consumed by this script
+                                       (CLI >= 1.0.16 lazy-installs the
+                                       device suite on the first
+                                       `beeos device attach`); export it
+                                       in the shell that runs `beeos
+                                       device attach` instead.
+      $env:BEEOS_MCP_SERVER_VERSION   Same, for @beeos-ai/device-mcp-server.
       $env:BEEOS_USE_NPX = "1"        Power-user escape hatch: use `npx`
                                        for a throwaway install. `beeos`
                                        will NOT persist on PATH after
                                        the script exits. Default
                                        behaviour (since CLI 1.0.11) is
                                        always `npm install -g` so the
-                                       CLI plus the device-agent suite
-                                       are both globally available for
-                                       follow-up commands.
+                                       CLI is globally available for
+                                       follow-up commands. The device
+                                       suite is NOT eagerly installed
+                                       (CLI >= 1.0.16); see
+                                       web/packages/core/src/device-setup.ts.
 
 .EXAMPLE
     # One-liner (PowerShell 5+):
@@ -47,12 +55,10 @@
     .\install.ps1 -Device
 
 .EXAMPLE
-    # Bare-metal one-shot staging install (CLI >= 1.0.11):
+    # Bare-metal one-shot staging install (CLI >= 1.0.16):
     $env:BEEOS_API_URL              = "https://public-api-staging.beeos.ai"
     $env:BEEOS_AGENT_GATEWAY_URL    = "https://agent-gw-staging.beeos.ai"
     $env:BEEOS_DASHBOARD_URL        = "https://beeos-staging-web.vercel.app"
-    $env:BEEOS_DEVICE_AGENT_VERSION = "0.4.2"
-    $env:BEEOS_MCP_SERVER_VERSION   = "0.2.3"
     irm https://beeos.ai/install.ps1 | iex
 #>
 param(
@@ -102,18 +108,11 @@ if (-not $script:IsWindowsHost) {
 
 $CliPackage = if ($Version -eq "latest") { "@beeos-ai/cli@latest" } else { "@beeos-ai/cli@$Version" }
 
-# Sibling packages installed alongside the CLI so that `beeos device attach`
-# works on a clean machine without further `npm i -g` steps (a.k.a. the
-# "fleet ready" install strategy — see agents/device-agent/ARCHITECTURE.md
-# for the 0.2.0+ sibling-pair topology between device-agent and
-# device-mcp-server). Versions are independent of `-Version` (which only
-# pins the CLI) — both packages follow their own semver. Override via
-# $env:BEEOS_DEVICE_AGENT_VERSION / $env:BEEOS_MCP_SERVER_VERSION when you
-# need to pin a specific build (e.g. for a staging smoke test).
-$DeviceAgentVersion = if ($env:BEEOS_DEVICE_AGENT_VERSION) { $env:BEEOS_DEVICE_AGENT_VERSION } else { "latest" }
-$McpServerVersion   = if ($env:BEEOS_MCP_SERVER_VERSION)   { $env:BEEOS_MCP_SERVER_VERSION   } else { "latest" }
-$DeviceAgentPackage = "@beeos-ai/device-agent@$DeviceAgentVersion"
-$McpServerPackage   = "@beeos-ai/device-mcp-server@$McpServerVersion"
+# `@beeos-ai/device-agent` + `@beeos-ai/device-mcp-server` are NOT
+# installed here. CLI >= 1.0.16 installs them lazily on the first
+# `beeos device attach` via `ensureDeviceAgent` in
+# `web/packages/core/src/device-setup.ts`. OpenClaw-only users never
+# download the device suite at all.
 
 # Telemetry endpoint (override with $env:BEEOS_API_URL for staging).
 if (-not $env:BEEOS_API_URL -or $env:BEEOS_API_URL.Length -eq 0) {
@@ -479,39 +478,6 @@ function Read-ExistingInstallAction {
     }
 }
 
-# ── Device-agent sibling suite installer ─────────────────────
-#
-# Installs `@beeos-ai/device-agent` + `@beeos-ai/device-mcp-server` globally
-# so the very first `beeos device attach` on a clean machine does not need
-# to fetch them separately. `@beeos-ai/device-common` is pulled
-# transitively as a `dependencies` entry of both — no separate install
-# needed.
-#
-# Failure here is NEVER fatal: the CLI itself was already installed
-# successfully, and `beeos device attach` will prompt to install missing
-# pieces via ensureDeviceAgent on first use. We just emit a WARN with the
-# manual recovery command.
-function Install-DeviceAgentSuite {
-    $npmPath = Get-Command npm -ErrorAction SilentlyContinue
-    if (-not $npmPath) {
-        Write-BeeWarn "npm not available — skipping device-agent suite install."
-        Write-BeeWarn "Manual fix: install Node + run ``npm i -g $DeviceAgentPackage $McpServerPackage``."
-        return
-    }
-
-    Write-BeeInfo "Installing device-agent suite ($DeviceAgentPackage, $McpServerPackage)..."
-    & npm install -g $DeviceAgentPackage $McpServerPackage
-    if ($LASTEXITCODE -eq 0) {
-        Write-BeeOk "device-agent suite installed."
-    } else {
-        Write-BeeWarn "Failed to install device-agent suite — ``beeos device attach`` will prompt for it on first use."
-        Write-BeeWarn "Manual fix: npm i -g $DeviceAgentPackage $McpServerPackage"
-        # Reset $LASTEXITCODE so subsequent `if ($LASTEXITCODE -ne 0)` checks
-        # in callers don't trip on this non-fatal failure.
-        $global:LASTEXITCODE = 0
-    }
-}
-
 # ── Run CLI ──────────────────────────────────────────────────
 
 function Invoke-BeeosCli {
@@ -547,9 +513,7 @@ function Invoke-BeeosCli {
     if ($LASTEXITCODE -ne 0) {
         # P0-A of the install-link review: fail-after-bootstrap signal.
         # The `install.bootstrap.cli_installed` event is only emitted
-        # AFTER npm + the device-agent suite report success, so npm
-        # failures are recorded as a distinct outcome (not as silent
-        # post-success).
+        # AFTER npm reports success.
         Send-Telemetry -Event "install.bootstrap.npm_fail" -ErrorCode "npm_install_cli_failed" -Success $false
         Write-BeeError "npm install -g $CliPackage failed."
         Write-BeeError ""
@@ -559,7 +523,10 @@ function Invoke-BeeosCli {
         Write-BeeError "  - EACCES / permission error: run PowerShell as Administrator"
         exit 1
     }
-    Install-DeviceAgentSuite
+    # Device-agent suite is intentionally NOT installed here; `beeos
+    # device attach` will auto-install it on first use via
+    # `ensureDeviceAgent` (see `web/packages/core/src/device-setup.ts`).
+    # OpenClaw-only users never download those ~20MB.
     Send-Telemetry -Event "install.bootstrap.cli_installed"
 
     # P1-J of the install-link review: when the user invokes the
@@ -662,7 +629,10 @@ if ($beeosCmd) {
                 Write-BeeError "  - EACCES / permission error: run PowerShell as Administrator"
                 exit 1
             }
-            Install-DeviceAgentSuite
+            # Device suite is NOT upgraded here. `beeos device upgrade`
+            # is the canonical refresh path (it also restarts the
+            # running fleet); the install-script upgrade prompt only
+            # refreshes the CLI itself.
         }
         "rerun" {
             Write-BeeInfo "Reusing existing install."

package/scripts/install.sh

@@ -29,24 +29,30 @@
 #                              bootstrap requests).
 #   BEEOS_DASHBOARD_URL        Dashboard base (OAuth + bind redirect).
 #   BEEOS_DEVICE_AGENT_VERSION Pin @beeos-ai/device-agent semver.
-#   BEEOS_MCP_SERVER_VERSION   Pin @beeos-ai/device-mcp-server semver.
+#                              NOT consumed by this script (CLI ≥ 1.0.16
+#                              installs the device suite lazily on the
+#                              first `beeos device attach`); export it
+#                              in the shell that runs `beeos device
+#                              attach` instead.
+#   BEEOS_MCP_SERVER_VERSION   Same as above, for @beeos-ai/device-mcp-server.
 #   BEEOS_USE_NPX=1            (Power-user escape hatch) Use `npx` for a
 #                              throwaway install. `beeos` will NOT
 #                              persist on PATH after the script exits.
 #                              Default behaviour (since CLI 1.0.11) is
-#                              always `npm install -g` so the CLI plus
-#                              the device-agent suite are both globally
-#                              available for follow-up commands.
+#                              always `npm install -g` so the CLI is
+#                              globally available for follow-up commands.
+#                              The device-agent suite is no longer
+#                              eagerly installed (CLI ≥ 1.0.16); see
+#                              `web/packages/core/src/device-setup.ts`.
 #
-# Example: bare-metal one-shot staging install, including device-agent
-# version pin and OAuth landing on the staging dashboard:
+# Example: bare-metal one-shot staging install (no device-agent pin —
+# add `BEEOS_DEVICE_AGENT_VERSION=...` to the shell when you later run
+# `beeos device attach` if you need to pin a specific build):
 #
 #   BEEOS_API_URL=https://public-api-staging.beeos.ai \
 #   BEEOS_AGENT_GATEWAY_URL=https://agent-gw-staging.beeos.ai \
 #   BEEOS_DASHBOARD_URL=https://beeos-staging-web.vercel.app \
-#   BEEOS_DEVICE_AGENT_VERSION=0.4.2 \
-#   BEEOS_MCP_SERVER_VERSION=0.2.3 \
-#     curl -fsSL https://beeos.ai/install | bash -s -- --version 1.0.11
+#     curl -fsSL https://beeos.ai/install | bash -s -- --version 1.0.16
 
 set -euo pipefail
 
@@ -59,16 +65,11 @@ RED="\033[31m"
 CYAN="\033[36m"
 
 CLI_PACKAGE="@beeos-ai/cli@latest"
-# Sibling packages installed alongside the CLI so that `beeos device attach`
-# works on a clean machine without further `npm i -g` steps (a.k.a. the
-# "fleet ready" install strategy — see agents/device-agent/ARCHITECTURE.md
-# for the 0.2.0+ sibling-pair topology between device-agent and
-# device-mcp-server). Their versions are independent of `--version` (which
-# only pins the CLI) — both packages follow their own semver. Override via
-# BEEOS_DEVICE_AGENT_VERSION / BEEOS_MCP_SERVER_VERSION when you need to
-# pin a specific build (e.g. for a staging smoke test).
-DEVICE_AGENT_PACKAGE="@beeos-ai/device-agent@${BEEOS_DEVICE_AGENT_VERSION:-latest}"
-MCP_SERVER_PACKAGE="@beeos-ai/device-mcp-server@${BEEOS_MCP_SERVER_VERSION:-latest}"
+# `@beeos-ai/device-agent` + `@beeos-ai/device-mcp-server` are NOT
+# installed here. CLI ≥ 1.0.16 installs them lazily on the first
+# `beeos device attach` via `ensureDeviceAgent` in
+# `web/packages/core/src/device-setup.ts`. OpenClaw-only users never
+# download the device suite at all.
 MIN_NODE_VERSION=18
 NVM_VERSION="v0.40.1"
 FNM_INSTALL_URL="https://fnm.vercel.app/install"
@@ -479,35 +480,6 @@ prompt_existing_install_action() {
   esac
 }
 
-# ── Device-agent sibling suite installer ─────────────────────
-#
-# Installs `@beeos-ai/device-agent` + `@beeos-ai/device-mcp-server` globally
-# so the very first `beeos device attach` on a clean machine does not need
-# to fetch them separately. `@beeos-ai/device-common` is pulled
-# transitively as a `dependencies` entry of both — no separate install
-# needed.
-#
-# Failure here is NEVER fatal: the CLI itself was already installed
-# successfully, and `beeos device attach` will prompt to install missing
-# pieces via ensureDeviceAgent on first use. We just emit a WARN with the
-# manual recovery command.
-install_device_agent_suite() {
-  if ! command -v npm &>/dev/null; then
-    warn "npm not available — skipping device-agent suite install."
-    warn "Manual fix: install Node + run \`npm i -g ${DEVICE_AGENT_PACKAGE} ${MCP_SERVER_PACKAGE}\`."
-    return 0
-  fi
-
-  info "Installing device-agent suite (${DEVICE_AGENT_PACKAGE}, ${MCP_SERVER_PACKAGE})..."
-  if npm install -g "$DEVICE_AGENT_PACKAGE" "$MCP_SERVER_PACKAGE"; then
-    success "device-agent suite installed."
-  else
-    warn "Failed to install device-agent suite — \`beeos device attach\` will prompt for it on first use."
-    warn "Manual fix: npm i -g ${DEVICE_AGENT_PACKAGE} ${MCP_SERVER_PACKAGE}"
-  fi
-  return 0
-}
-
 # ── Main ─────────────────────────────────────────────────────
 
 run_cli() {
@@ -528,16 +500,11 @@ run_cli() {
 
   # ALWAYS install globally. We previously branched to `npx --yes` when
   # available so curl|bash users got a throwaway install, but that
-  # silently broke the post-install UX:
-  #   - `beeos` was not on PATH after the script exited, so the user's
-  #     next step (`beeos device attach`) failed with `command not found`
-  #     and the obvious recovery (re-run the one-liner) hit the
-  #     "existing install" prompt because some state in ~/.beeos
-  #     persisted, leaving the user stuck.
-  #   - The device-agent suite was deliberately skipped on the npx
-  #     branch, so even if the user re-ran via `npm i -g`, the very
-  #     next `beeos device attach` had to bootstrap device-agent
-  #     itself.
+  # silently broke the post-install UX: `beeos` was not on PATH after
+  # the script exited, so the user's next step (`beeos device attach`)
+  # failed with `command not found` and the obvious recovery (re-run
+  # the one-liner) hit the "existing install" prompt because some
+  # state in ~/.beeos persisted, leaving the user stuck.
   # Power users who explicitly want the old throwaway behaviour can set
   # `BEEOS_USE_NPX=1`. Default is global install.
   if [[ "${BEEOS_USE_NPX:-}" == "1" ]] && command -v npx &>/dev/null; then
@@ -567,10 +534,13 @@ run_cli() {
     error "      use a node version manager (nvm / fnm) or sudo"
     exit 1
   fi
-  install_device_agent_suite
-  # NPM succeeded AND device-agent suite either installed or skipped
-  # with a warning. Fire the "CLI is reachable on PATH" event before
-  # exec — exec replaces our process so this is the last chance.
+  # NPM succeeded — CLI is now on PATH. The device-agent suite is
+  # deliberately NOT installed here; `beeos device attach` will
+  # auto-install it on first use via `ensureDeviceAgent` (see
+  # `web/packages/core/src/device-setup.ts`). OpenClaw-only users
+  # never download those ~20MB. Fire the "CLI is reachable on PATH"
+  # event before exec — exec replaces our process so this is the
+  # last chance.
   send_telemetry "install.bootstrap.cli_installed"
   exec beeos "$subcmd" "$@" <"$stdin_src"
 }
@@ -634,7 +604,10 @@ main() {
             error "      use a node version manager (nvm / fnm) or sudo"
             exit 1
           fi
-          install_device_agent_suite
+          # Device-agent suite is intentionally NOT upgraded here.
+          # `beeos device upgrade` is the canonical refresh path (it
+          # also restarts the running fleet); the install-script
+          # upgrade prompt only refreshes the CLI itself.
         fi
         ;;
       rerun)