@hybridlabor-api/aos 4.4.1 → 4.4.2-beta.1

package/installer.js

@@ -493,7 +493,13 @@ function adoptFileIntoManifest(manifest, targetPath, sourceHash) {
 // payload (used to identify files we recognise even before manifest entry).
 function resolveFileConflict(sourcePath, targetPath, manifest, knownSourceHashes) {
     const sourceHash = computeFileHash(sourcePath);
-    if (!sourceHash) return 'skipped'; // unreadable source – skip
+    if (!sourceHash) {
+        // Every other branch of this function reports what it did; this one
+        // used to return silently, so a file that failed to install left no
+        // trace behind the enclosing "Synced BDB skills" success line.
+        log.warn(`[manifest] Could not read ${sourcePath} from the payload — ${path.basename(targetPath)} not installed.`);
+        return 'skipped';
+    }
 
     const manifestEntry = manifest[targetPath];
     const diskExists = fs.existsSync(targetPath);
@@ -524,7 +530,7 @@ function resolveFileConflict(sourcePath, targetPath, manifest, knownSourceHashes
     // not in refusing to write. A genuine local edit is recoverable from .bak
     // rather than silently outvoting the shipped version forever.
     if (!manifestEntry && !knownSourceHashes.has(diskHash)) {
-        const bakPath = `${targetPath}.bak`;
+        const bakPath = `${targetPath}.${timestamp}.bak`;
         try { fs.copyFileSync(targetPath, bakPath); } catch (e) {
             log.warn(`[manifest] Could not create backup ${bakPath}: ${e.message}`);
         }
@@ -549,7 +555,7 @@ function resolveFileConflict(sourcePath, targetPath, manifest, knownSourceHashes
 
     // Case: ours + user-edited (manifest recorded our hash, but disk now differs).
     if (manifestEntry && diskHash !== manifestEntry.sha256) {
-        const bakPath = `${targetPath}.bak`;
+        const bakPath = `${targetPath}.${timestamp}.bak`;
         try { fs.copyFileSync(targetPath, bakPath); } catch (e) {
             log.warn(`[manifest] Could not create backup ${bakPath}: ${e.message}`);
         }
@@ -602,6 +608,88 @@ function initSessionManifest(existingManifest, sourceDirs) {
     _sessionHashes = buildKnownSourceHashes(sourceDirs);
 }
 
+// Skills that left the package in 4.4.2 (Plan 02: migrated to the private
+// aos-internal repo, per ~/dev/_plans/aos-2026-09-14/), by their flattened
+// directory name at a sync destination.
+//
+// This is deliberately a fixed list, not a diff against what the current
+// payload ships. A generic "anything on disk that is not in skills/ right
+// now" pass was tried first and swept up two unrelated things: skill folders
+// that MCP servers bundle inside their own package tree (e.g.
+// mcps/tdmcp/.agents/skills/...), which happen to share the literal path
+// segment "skills" but belong to a different install entirely; and skills
+// under skills/workspace_agents/, which syncSkillsToGlobalHarnesses already
+// deliberately excludes from the six global destinations, so a stray global
+// copy of one says nothing about whether it is safe to delete. Both are real
+// cleanup opportunities, but they are a separate investigation, not a side
+// effect of this migration's beta test.
+const SKILLS_REMOVED_IN_4_4_2 = new Set([
+    'bdbsaastraining', 'bdb-dev-os-skill', 'bdbsaashost', 'bdb-ecosystem-health', 'bdbsaas-ops',
+]);
+
+// The exact roots syncSkillsToGlobalHarnesses and the Gemini/Antigravity
+// config-skills path write into. Pruning only touches a manifest entry whose
+// path starts under one of these -- never one that merely contains a
+// "skills" segment somewhere deeper, which is what let the MCP-bundle and
+// workspace_agents cases above leak in during testing.
+function globalSkillDestRoots() {
+    return [
+        path.join(homeDir, '.agents', 'skills'),
+        path.join(homeDir, '.claude', 'skills'),
+        path.join(homeDir, '.codex', 'skills'),
+        path.join(homeDir, '.cursor', 'skills'),
+        path.join(homeDir, '.roo', 'skills'),
+        path.join(geminiDir, 'config', 'skills'),
+    ];
+}
+
+// syncSkillsToGlobalHarnesses (and its sibling copy loops) only ever add or
+// update -- nothing in that path ever deletes a skill that the current
+// payload no longer ships. That is fine for new skills and updated ones, but
+// it means a skill removed from a release stays on every user's disk
+// forever, through every future update, because nothing after the removal
+// ever looks at what is on disk that no longer has a source. This walks the
+// install manifest -- which already has one entry per file this installer
+// has ever placed -- for the specific skills 4.4.2 removed, under the six
+// known global skill roots, and deletes them. A user-modified file is backed
+// up first, the same way resolveFileConflict backs up a user edit it is
+// about to overwrite, rather than silently deleting local changes.
+function pruneRemovedSkills(manifest) {
+    if (!manifest) return;
+    const roots = globalSkillDestRoots();
+
+    const staleDirs = new Set();
+    let removedFiles = 0;
+    for (const targetPath of Object.keys(manifest)) {
+        const root = roots.find((r) => targetPath.startsWith(r + path.sep));
+        if (!root) continue;
+        const skillDirName = targetPath.slice(root.length + 1).split(path.sep)[0];
+        if (!SKILLS_REMOVED_IN_4_4_2.has(skillDirName)) continue;
+
+        if (fs.existsSync(targetPath)) {
+            const diskHash = computeFileHash(targetPath);
+            const manifestEntry = manifest[targetPath];
+            if (diskHash !== null && manifestEntry && diskHash !== manifestEntry.sha256) {
+                const bakPath = `${targetPath}.${timestamp}.bak`;
+                try { fs.copyFileSync(targetPath, bakPath); } catch (e) { logDebug(e, 'prune-removed-skill backup'); }
+                log.warn(`[manifest] Retired skill left a user-edited file, backed up to ${bakPath} instead of deleting it.`);
+            } else {
+                try { fs.unlinkSync(targetPath); removedFiles++; } catch (e) { logDebug(e, 'prune-removed-skill unlink'); }
+            }
+            staleDirs.add(path.join(root, skillDirName));
+        }
+        delete manifest[targetPath];
+    }
+
+    for (const dir of staleDirs) {
+        try { fs.rmSync(dir, { recursive: true, force: true }); } catch (e) { logDebug(e, 'prune-removed-skill rmdir'); }
+    }
+
+    if (staleDirs.size > 0) {
+        log.step(`Removed ${removedFiles} file(s) from ${staleDirs.size} retired skill install(s) no longer shipped.`);
+    }
+}
+
 function flushSessionManifest() {
     if (_sessionManifest) saveInstallManifest(_sessionManifest);
 }
@@ -637,66 +725,123 @@ function resolveMcpsArg(availableMcps) {
     return matched;
 }
 
-function detectPlatforms() {
-    const detections = [];
-
-    if (fs.existsSync(geminiDir)) {
-        detections.push({ name: "Google Antigravity", path: geminiDir, key: "antigravity" });
-    }
-
-    const codexDir = path.join(homeDir, '.codex');
-    if (fs.existsSync(codexDir) || fs.existsSync(path.join(codexDir, 'config.toml'))) {
-        detections.push({ name: "ChatGPT Codex CLI", path: codexDir, key: "codex" });
-    }
-
-    const claudeCodeConfig = path.join(homeDir, '.claude.json');
-    const claudeCodeDir = path.join(homeDir, '.claude');
-    if (fs.existsSync(claudeCodeConfig) || fs.existsSync(claudeCodeDir)) {
-        detections.push({ name: "Claude Code CLI", path: claudeCodeDir, key: "claudecode" });
-    }
-
-    const claudePath = process.platform === 'win32'
-        ? path.join(process.env.APPDATA || homeDir, 'Claude')
-        : path.join(homeDir, 'Library', 'Application Support', 'Claude');
-    if (fs.existsSync(claudePath)) {
-        detections.push({ name: "Claude Desktop", path: claudePath, key: "claudedesktop" });
-    }
+// Platforms the user explicitly asked for, by detection key. A harness the
+// user names is installed as far as we are concerned, whether or not we can
+// find its binary -- they know their machine better than a PATH lookup does.
+const explicitPlatformKeys = new Set();
+const PLATFORM_KEYS_BY_OPTION = {
+    '1': 'antigravity',
+    '2': ['claudecode', 'claudedesktop'],
+    '3': 'cursor',
+    '5': 'codex',
+    '6': 'windsurf',
+    '7': 'vscode',
+    '8': 'aider',
+};
 
-    const cursorPath = process.platform === 'win32'
-        ? path.join(process.env.APPDATA || homeDir, 'Cursor')
-        : path.join(homeDir, 'Library', 'Application Support', 'Cursor');
-    if (fs.existsSync(cursorPath)) {
-        detections.push({ name: "Cursor IDE", path: cursorPath, key: "cursor" });
+function markPlatformsExplicit(optionValues) {
+    for (const v of optionValues || []) {
+        const keys = PLATFORM_KEYS_BY_OPTION[v];
+        if (!keys) continue;
+        for (const k of [].concat(keys)) explicitPlatformKeys.add(k);
     }
+}
 
-    const windsurfPath = process.platform === 'win32'
-        ? path.join(process.env.APPDATA || homeDir, 'Windsurf')
-        : path.join(homeDir, 'Library', 'Application Support', 'Windsurf');
-    if (fs.existsSync(windsurfPath)) {
-        detections.push({ name: "Windsurf IDE", path: windsurfPath, key: "windsurf" });
-    }
+// Where an application itself lives, per OS. Presence of the app is proof;
+// presence of a dot-directory is not.
+function appBundle(name) {
+    if (process.platform === 'darwin') return [`/Applications/${name}.app`, path.join(homeDir, 'Applications', `${name}.app`)];
+    if (process.platform === 'win32') return [path.join(process.env.LOCALAPPDATA || homeDir, 'Programs', name)];
+    return [`/usr/share/${name.toLowerCase()}`, `/opt/${name.toLowerCase()}`];
+}
 
-    const vscodePath = process.platform === 'win32'
-        ? path.join(process.env.APPDATA || homeDir, 'Code')
-        : path.join(homeDir, 'Library', 'Application Support', 'Code');
-    const rooPath = path.join(homeDir, '.roo');
-    const clinePath = path.join(homeDir, '.cline');
-    if (fs.existsSync(vscodePath) || fs.existsSync(rooPath) || fs.existsSync(clinePath)) {
-        detections.push({ name: "Roo Code / Cline / VS Code", path: vscodePath, key: "vscode" });
-    }
+const anyExists = (paths) => paths.some((p) => fs.existsSync(p));
+const globExists = (dir, re) => {
+    try { return fs.readdirSync(dir).some((e) => re.test(e)); } catch { return false; }
+};
 
-    const aiderConf = path.join(homeDir, '.aider.conf.yml');
-    if (fs.existsSync(aiderConf) || fs.existsSync(path.join(homeDir, '.aider'))) {
-        detections.push({ name: "Aider CLI", path: homeDir, key: "aider" });
-    }
+// Detect installed agent harnesses.
+//
+// This used to test for a config *directory* and nothing else, which was
+// circular: syncSkillsToGlobalHarnesses() creates ~/.claude, ~/.codex,
+// ~/.cursor and ~/.roo unconditionally, so after one install the detector
+// found evidence the installer had planted itself. A machine with neither
+// Cursor nor VS Code nor Aider still reported all three, and skills were
+// written into directories nothing would ever read.
+//
+// Evidence now means the application itself and nothing else: a binary on
+// PATH, an installed app bundle, or an editor extension. Config files are
+// deliberately NOT evidence -- the installer writes ~/.claude.json,
+// ~/.cursor/mcp.json, ~/.roo/mcp_settings.json and the rest of them, so
+// trusting those reintroduces the same circularity one level down. (Written
+// after exactly that: an early cut of this fix still "found" Cursor and
+// Windsurf on a machine with neither, via files AOS had planted.)
+// The user's explicit choice counts too -- see markPlatformsExplicit().
+function detectPlatforms() {
+    const candidates = [
+        {
+            key: 'antigravity', name: 'Google Antigravity', path: geminiDir,
+            evidence: () => hasExecutable('agy') || anyExists(appBundle('Antigravity')),
+        },
+        {
+            key: 'codex', name: 'ChatGPT Codex CLI', path: path.join(homeDir, '.codex'),
+            evidence: () => hasExecutable('codex'),
+        },
+        {
+            key: 'claudecode', name: 'Claude Code CLI', path: path.join(homeDir, '.claude'),
+            evidence: () => hasExecutable('claude'),
+        },
+        {
+            key: 'claudedesktop', name: 'Claude Desktop',
+            path: process.platform === 'win32'
+                ? path.join(process.env.APPDATA || homeDir, 'Claude')
+                : path.join(homeDir, 'Library', 'Application Support', 'Claude'),
+            evidence: () => anyExists(appBundle('Claude')),
+        },
+        {
+            key: 'cursor', name: 'Cursor IDE',
+            path: process.platform === 'win32'
+                ? path.join(process.env.APPDATA || homeDir, 'Cursor')
+                : path.join(homeDir, 'Library', 'Application Support', 'Cursor'),
+            evidence: () => anyExists(appBundle('Cursor')) || hasExecutable('cursor'),
+        },
+        {
+            key: 'windsurf', name: 'Windsurf IDE',
+            path: process.platform === 'win32'
+                ? path.join(process.env.APPDATA || homeDir, 'Windsurf')
+                : path.join(homeDir, 'Library', 'Application Support', 'Windsurf'),
+            evidence: () => anyExists(appBundle('Windsurf')) || hasExecutable('windsurf'),
+        },
+        {
+            key: 'vscode', name: 'Roo Code / Cline / VS Code',
+            path: process.platform === 'win32'
+                ? path.join(process.env.APPDATA || homeDir, 'Code')
+                : path.join(homeDir, 'Library', 'Application Support', 'Code'),
+            evidence: () => anyExists(appBundle('Visual Studio Code'))
+                || hasExecutable('code')
+                || globExists(path.join(homeDir, '.vscode', 'extensions'), /roo|cline/i),
+        },
+        {
+            key: 'aider', name: 'Aider CLI', path: homeDir,
+            evidence: () => hasExecutable('aider'),
+        },
+        {
+            key: 'opencode', name: 'OpenCode CLI',
+            path: process.platform === 'win32'
+                ? path.join(process.env.APPDATA || homeDir, 'opencode')
+                : path.join(homeDir, '.config', 'opencode'),
+            evidence: () => hasExecutable('opencode'),
+        },
+    ];
 
-    const opencodeDir = process.platform === 'win32'
-        ? path.join(process.env.APPDATA || homeDir, 'opencode')
-        : path.join(homeDir, '.config', 'opencode');
-    if (fs.existsSync(opencodeDir) || fs.existsSync(path.join(homeDir, '.opencode'))) {
-        detections.push({ name: "OpenCode CLI", path: fs.existsSync(opencodeDir) ? opencodeDir : path.join(homeDir, '.opencode'), key: "opencode" });
+    const detections = [];
+    for (const c of candidates) {
+        let present = false;
+        try { present = c.evidence(); } catch (e) { logDebug(e, `detect ${c.key}`); }
+        if (present || explicitPlatformKeys.has(c.key)) {
+            detections.push({ name: c.name, path: c.path, key: c.key, chosen: !present });
+        }
     }
-
     return detections;
 }
 
@@ -751,10 +896,9 @@ function detectInstallState() {
         { id: 'synapse', dir: path.join(basePath, 'bdb-synapse') },
         { id: 'memb', dir: path.join(basePath, 'memB') },
         { id: 'remote', dir: path.join(basePath, 'bdb-os-remote') },
-        // bdb-os-agent-workspace: temporarily disabled -- see the comment in
-        // promptOptionalModules() below for why. Not re-detected as a fresh
-        // install; existing installs are still skipped explicitly in the
-        // update loop further down.
+        { id: 'ao', dir: path.join(basePath, 'bdb-agent-orchestrator') },
+        // The archived predecessor is deliberately NOT detected: a copy of it
+        // should be removed, not carried forward into another install.
         { id: 'creator', dir: path.join(basePath, 'bdb-dev-creator-extension') },
         { id: 'installer', dir: path.join(basePath, 'bdb-dev-tool-installer') }
     ];
@@ -952,9 +1096,9 @@ function copyDirRecursiveSync(source, target, excludeList = [], manifest = null,
 // root-level leaf skill dumps into the same flat target, so each subsequent
 // one silently overwrites the previous one's SKILL.md -- found by tracing
 // why skills/bdbrainstorm/ and skills/global_config/bdbrainstorm/ both
-// existed with different content; the root-level one (and 5 siblings:
-// bdbsaastraining, github-repo, memb-ingest, bdb-dev-os-skill,
-// synapse-integration-skill) never survived a global sync intact.
+// existed with different content; the root-level one (and 3 siblings:
+// github-repo, memb-ingest, synapse-integration-skill) never survived a
+// global sync intact.
 function syncSkillEntry(fullPath, dirName, targetSkillDir, excludeSkills) {
     const isLeafSkill = fs.existsSync(path.join(fullPath, 'SKILL.md'));
     if (isLeafSkill) {
@@ -985,15 +1129,20 @@ function syncSkillsToGlobalHarnesses(excludeSkills = []) {
     const skillsBase = path.join(srcDir, 'skills');
     if (!fs.existsSync(skillsBase)) return;
 
+    // Mirror only into harnesses that are actually present. This list used to
+    // be unconditional, which both wrote skills nobody would read and planted
+    // the very directories detectPlatforms() then read back as proof the
+    // harness existed. ~/.agents is ours and always written.
+    const detectedKeys = new Set(detectPlatforms().map((d) => d.key));
     const extraSkillDestinations = [
-        path.join(homeDir, '.claude', 'skills'),
-        path.join(homeDir, '.agents', 'skills'),
-        path.join(homeDir, '.codex', 'skills'),
-        path.join(homeDir, '.cursor', 'skills'),
-        path.join(homeDir, '.roo', 'skills')
-    ];
-
-    for (const dest of extraSkillDestinations) {
+        { dir: path.join(homeDir, '.agents', 'skills'), key: null },
+        { dir: path.join(homeDir, '.claude', 'skills'), key: 'claudecode' },
+        { dir: path.join(homeDir, '.codex', 'skills'), key: 'codex' },
+        { dir: path.join(homeDir, '.cursor', 'skills'), key: 'cursor' },
+        { dir: path.join(homeDir, '.roo', 'skills'), key: 'vscode' },
+    ].filter((d) => d.key === null || detectedKeys.has(d.key) || fs.existsSync(d.dir));
+
+    for (const { dir: dest } of extraSkillDestinations) {
         try {
             fs.mkdirSync(dest, { recursive: true });
             const rawDirs = fs.readdirSync(skillsBase);
@@ -1414,23 +1563,34 @@ function checkModuleUpdate(pkgName, targetDir) {
     try {
         const localVer = JSON.parse(fs.readFileSync(modulePkgPath, 'utf8')).version;
         let remoteVer = null;
+        let checkFailed = false;
         try {
             remoteVer = execSync(`npm view ${pkgName} version`, { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8', timeout: 4000 }).trim();
-        } catch (e) { logDebug(e, 'operation'); }
+        } catch (e) {
+            // Offline, a proxy, or a misconfigured registry. Swallowing this
+            // made every module report "up to date" forever on such a machine,
+            // indistinguishable from a real answer -- so say which one it is.
+            checkFailed = true;
+            logDebug(e, `npm view ${pkgName}`);
+        }
 
         if (remoteVer && localVer !== remoteVer) {
-            return { installed: true, updateAvailable: true, localVer, remoteVer };
+            return { installed: true, updateAvailable: true, localVer, remoteVer, checkFailed };
         }
-        return { installed: true, updateAvailable: false, localVer, remoteVer };
+        return { installed: true, updateAvailable: false, localVer, remoteVer, checkFailed };
     } catch (e) {
-        return { installed: true, updateAvailable: false, localVer: null, remoteVer: null };
+        return { installed: true, updateAvailable: false, localVer: null, remoteVer: null, checkFailed: true };
     }
 }
 
 function downloadOrUpdateModule(pkgName, targetDir, displayName) {
     const status = checkModuleUpdate(pkgName, targetDir);
     if (status.installed && !status.updateAvailable) {
-        log.step(`${displayName} is up to date (v${status.localVer})`);
+        if (status.checkFailed) {
+            log.warn(`${displayName}: could not reach the npm registry — keeping the installed v${status.localVer}, which may be stale.`);
+        } else {
+            log.step(`${displayName} is up to date (v${status.localVer})`);
+        }
         return true;
     }
 
@@ -1458,14 +1618,42 @@ function downloadOrUpdateModule(pkgName, targetDir, displayName) {
         const ok = runNpmWithRetry(`npm pack ${pkgName}@latest`, { stdio: 'ignore', cwd: targetDir }, `${displayName} download`);
         cleanNpmCacheOnWindows();
         const tarball = ok ? fs.readdirSync(targetDir).find(f => f.endsWith('.tgz')) : null;
-        if (tarball) {
-            execSync(`tar -xzf "${tarball}" --strip-components=1`, { stdio: 'ignore', cwd: targetDir });
-            fs.unlinkSync(path.join(targetDir, tarball));
-            s.stop(`${displayName} ready (v${status.remoteVer || 'latest'})`);
-            return true;
-        } else {
-            throw new Error("NPM pack returned no archive.");
+        if (!tarball) throw new Error("NPM pack returned no archive.");
+
+        // Unpacking straight over targetDir made an update a MERGE: a file the
+        // new version dropped stayed on disk forever, while package.json said
+        // the module was current. Unpack beside it and swap, so the tree that
+        // ends up installed is exactly the published one. The previous tree is
+        // kept until the swap succeeds, and restored if it does not.
+        const stagingDir = `${targetDir}.incoming-${timestamp}`;
+        const retiredDir = `${targetDir}.previous-${timestamp}`;
+        fs.rmSync(stagingDir, { recursive: true, force: true });
+        fs.mkdirSync(stagingDir, { recursive: true });
+        execSync(`tar -xzf "${path.join(targetDir, tarball)}" --strip-components=1 -C "${stagingDir}"`, { stdio: 'ignore' });
+        fs.unlinkSync(path.join(targetDir, tarball));
+
+        // Anything the module generated in place -- venvs, caches, local state
+        // -- is not in the tarball and must survive the swap.
+        const PRESERVE = ['.venv', 'venv', 'node_modules', '.env', 'data', 'logs'];
+        for (const keep of PRESERVE) {
+            const from = path.join(targetDir, keep);
+            if (fs.existsSync(from) && !fs.existsSync(path.join(stagingDir, keep))) {
+                fs.renameSync(from, path.join(stagingDir, keep));
+            }
         }
+
+        try {
+            fs.renameSync(targetDir, retiredDir);
+            fs.renameSync(stagingDir, targetDir);
+        } catch (swapError) {
+            if (fs.existsSync(retiredDir) && !fs.existsSync(targetDir)) fs.renameSync(retiredDir, targetDir);
+            fs.rmSync(stagingDir, { recursive: true, force: true });
+            throw swapError;
+        }
+        fs.rmSync(retiredDir, { recursive: true, force: true });
+
+        s.stop(`${displayName} ready (v${status.remoteVer || 'latest'})`);
+        return true;
     } catch (e) {
         s.stop(`Failed downloading ${displayName}: ${e.message}`);
         return false;
@@ -1485,7 +1673,14 @@ async function installMemB(interactive) {
         }));
     }
     const membDir = path.join(moduleBasePath(), 'memB');
-    downloadOrUpdateModule('@hybridlabor-api/memb', membDir, 'memB Vector Engine');
+    // A failed download used to fall through into venv setup and daemon
+    // registration, each of which then failed on its own terms or, worse,
+    // "succeeded" against a stale tree -- and the run still ended in a success
+    // banner. Stop at the module that could not be fetched.
+    if (!downloadOrUpdateModule('@hybridlabor-api/memb', membDir, 'memB Vector Engine')) {
+        log.warn('Skipping memB setup: the module could not be downloaded.');
+        return;
+    }
     if (DRY_RUN) {
         log.step('[dry-run] would bootstrap memB venv + pip requirements');
         return;
@@ -1597,7 +1792,10 @@ async function installMemB(interactive) {
 
 async function installSynapse() {
     const synapseDir = path.join(moduleBasePath(), 'bdb-synapse');
-    downloadOrUpdateModule('@hybridlabor-api/bdb-synapse', synapseDir, 'BDB Synapse');
+    if (!downloadOrUpdateModule('@hybridlabor-api/bdb-synapse', synapseDir, 'BDB Synapse')) {
+        log.warn('Skipping Synapse setup: the module could not be downloaded.');
+        return;
+    }
     if (DRY_RUN) {
         log.step('[dry-run] would link synapse binary into ~/.local/bin/synapse + setup background daemon');
         return;
@@ -1711,7 +1909,10 @@ async function installSynapse() {
 
 async function installCreatorExtension() {
     const creatorDir = path.join(moduleBasePath(), 'bdb-dev-creator-extension');
-    downloadOrUpdateModule('@hybridlabor-api/bdb-dev-creator-extension', creatorDir, 'BDB Creator Extension');
+    if (!downloadOrUpdateModule('@hybridlabor-api/bdb-dev-creator-extension', creatorDir, 'BDB Creator Extension')) {
+        log.warn('Skipping Creator Extension setup: the module could not be downloaded.');
+        return;
+    }
     if (DRY_RUN) {
         log.step('[dry-run] would run BDB Creator Extension setup');
         return;
@@ -1729,138 +1930,101 @@ async function installCreatorExtension() {
 
 async function installOSRemoteGateway() {
     const remoteDir = path.join(moduleBasePath(), 'bdb-os-remote');
-    downloadOrUpdateModule('@hybridlabor-api/bdb-os-remote', remoteDir, 'BDB OS Remote Gateway');
+    if (!downloadOrUpdateModule('@hybridlabor-api/bdb-os-remote', remoteDir, 'BDB OS Remote Gateway')) {
+        log.warn('Skipping OS Remote Gateway setup: the module could not be downloaded.');
+        return;
+    }
 }
 
 async function installDevToolInstaller() {
     const toolInstallerDir = path.join(moduleBasePath(), 'bdb-dev-tool-installer');
-    downloadOrUpdateModule('@hybridlabor-api/bdb-dev-tool-installer', toolInstallerDir, 'BDB Dev Tool Installer');
+    if (!downloadOrUpdateModule('@hybridlabor-api/bdb-dev-tool-installer', toolInstallerDir, 'BDB Dev Tool Installer')) {
+        log.warn('Skipping Dev Tool Installer setup: the module could not be downloaded.');
+        return;
+    }
 }
 
-async function installOSAgentWorkspace() {
-    const osAgentDir = path.join(moduleBasePath(), 'bdb-os-agent-workspace');
-    const localBinDir = path.join(homeDir, '.local', 'bin');
-    const binTarget = path.join(localBinDir, 'ao');
-
-    fs.mkdirSync(localBinDir, { recursive: true });
-    fs.mkdirSync(path.join(homeDir, '.ao', 'data'), { recursive: true });
-    fs.mkdirSync(path.join(homeDir, '.ao', 'logs'), { recursive: true });
+// AO ships one prebuilt binary: backend/ao-daemon, Mach-O arm64. The package
+// carries Windows and Linux sources but nothing built for them, and its CLI
+// shim picks the first candidate path that EXISTS without checking whether it
+// can run — so on any other platform it hands spawn a Mach-O file and fails
+// with an exec-format error instead of the "go build" hint it means to give.
+// Installing it there would be installing something known not to work.
+function aoSupportedHere() {
+    return process.platform === 'darwin' && process.arch === 'arm64';
+}
 
-    downloadOrUpdateModule('@hybridlabor-api/bdb-os-agent-workspace', osAgentDir, 'BDB OS Agent Workspace');
+async function installOSAgentWorkspace() {
+    if (!aoSupportedHere()) {
+        log.warn(`AO ships only a macOS arm64 binary — skipping on ${process.platform}/${process.arch}.`);
+        log.warn('Build it from source instead: github.com/hybridlabor-api/bdb-agent-orchestrator');
+        return;
+    }
 
+    const osAgentDir = path.join(moduleBasePath(), 'bdb-agent-orchestrator');
+    if (!downloadOrUpdateModule('@hybridlabor-api/bdb-agent-orchestrator', osAgentDir, 'BDB Agent Orchestrator')) {
+        log.warn('Skipping AO setup: the module could not be downloaded.');
+        return;
+    }
     if (DRY_RUN) {
-        log.step('[dry-run] would link ao binary + register LaunchAgent + Desktop App');
+        log.step('[dry-run] would link ~/.local/bin/ao and run `ao service install`');
         return;
     }
 
+    const localBinDir = path.join(homeDir, '.local', 'bin');
+    const binTarget = path.join(localBinDir, 'ao');
     const daemonBin = path.join(osAgentDir, 'backend', 'ao-daemon');
-    if (fs.existsSync(daemonBin)) {
-        try {
-            fs.copyFileSync(daemonBin, binTarget);
-            fs.chmodSync(binTarget, '755');
-        } catch (e) { logDebug(e, 'operation'); }
+
+    if (!fs.existsSync(daemonBin)) {
+        log.warn(`AO binary missing at ${daemonBin} — package layout changed?`);
+        return;
     }
 
-    if (process.platform === 'darwin') {
-        const plistPath = path.join(homeDir, 'Library', 'LaunchAgents', 'com.bdb.agent-workspace.plist');
-        const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>com.bdb.agent-workspace</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>${binTarget}</string>
-    </array>
-    <key>EnvironmentVariables</key>
-    <dict>
-        <key>AO_PORT</key>
-        <string>3101</string>
-        <key>AO_DATA_DIR</key>
-        <string>${path.join(homeDir, '.ao', 'data')}</string>
-        <key>PATH</key>
-        <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:${localBinDir}</string>
-    </dict>
-    <key>RunAtLoad</key>
-    <true/>
-    <key>KeepAlive</key>
-    <true/>
-    <key>StandardOutPath</key>
-    <string>${path.join(homeDir, '.ao', 'logs', 'daemon.stdout.log')}</string>
-    <key>StandardErrorPath</key>
-    <string>${path.join(homeDir, '.ao', 'logs', 'daemon.stderr.log')}</string>
-</dict>
-</plist>`;
-        try {
-            fs.writeFileSync(plistPath, plistContent);
-            execSync(`launchctl unload "${plistPath}" 2>/dev/null || true`, { stdio: 'ignore' });
-            execSync(`launchctl load -w "${plistPath}" 2>/dev/null || true`, { stdio: 'ignore' });
-            const isListening = await verifyDaemonListening(3101, 'Agent Workspace');
-            if (isListening) {
-                log.success('Agent Workspace LaunchAgent active (Port 3101)');
-            } else {
-                log.warn('Agent Workspace daemon did not respond on Port 3101 within timeout. You may need to start it manually or check for port conflicts.');
-            }
-        } catch (e) { logDebug(e, 'operation'); }
+    installStep('place the ao binary', () => {
+        fs.mkdirSync(localBinDir, { recursive: true });
+        // copyFileSync preserves bytes, so the package's ad-hoc signature
+        // survives. That matters: an unsigned binary at this path is SIGKILLed
+        // by AMFI on launch (exit 137) and reads as a daemon that simply will
+        // not start, with nothing in the log to say why.
+        fs.copyFileSync(daemonBin, binTarget);
+        fs.chmodSync(binTarget, 0o755);
+        log.step(`Installed ao to ${binTarget}`);
+    }, 'AO cannot be started without its binary.');
 
-        let appDir = '/Applications/BDB Agent Workspace.app';
-        try {
-            fs.accessSync('/Applications', fs.constants.W_OK);
-        } catch (e) {
-            logDebug(e, 'write-access probe on /Applications');
-            appDir = path.join(homeDir, 'Applications', 'BDB Agent Workspace.app');
-            log.step('/Applications is not writable - falling back to ~/Applications');
-        }
+    try {
+        execSync(`codesign -v "${binTarget}"`, { stdio: 'ignore' });
+    } catch {
+        log.warn('The ao binary is not code-signed — AMFI will kill it at launch.');
         try {
-            fs.mkdirSync(path.join(appDir, 'Contents', 'MacOS'), { recursive: true });
-            fs.mkdirSync(path.join(appDir, 'Contents', 'Resources'), { recursive: true });
-            const iconSrc = path.join(osAgentDir, 'frontend', 'assets', 'icon.icns');
-            if (fs.existsSync(iconSrc)) {
-                fs.copyFileSync(iconSrc, path.join(appDir, 'Contents', 'Resources', 'AppIcon.icns'));
-            }
-            const launcherScript = `#!/usr/bin/env bash
-export PATH="/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:${localBinDir}:$PATH"
-if ! curl -s http://127.0.0.1:3101/healthz >/dev/null 2>&1; then
-    launchctl start com.bdb.agent-workspace 2>/dev/null || "${binTarget}" &
-    sleep 0.5
-fi
-if [ -d "/Applications/Google Chrome.app" ]; then
-    open -na "/Applications/Google Chrome.app" --args --app="http://127.0.0.1:3101" --user-data-dir="$HOME/.ao/chrome-app-profile"
-elif [ -d "/Applications/Brave Browser.app" ]; then
-    open -na "/Applications/Brave Browser.app" --args --app="http://127.0.0.1:3101" --user-data-dir="$HOME/.ao/brave-app-profile"
-else
-    open "http://127.0.0.1:3101"
-fi`;
-            const launcherPath = path.join(appDir, 'Contents', 'MacOS', 'app_launcher');
-            fs.writeFileSync(launcherPath, launcherScript);
-            fs.chmodSync(launcherPath, '755');
-            log.success(`Desktop App available under ${appDir}`);
-        } catch (e) { logDebug(e, 'operation'); }
-    } else if (process.platform === 'win32') {
-        const startupDir = path.join(process.env.APPDATA || path.join(homeDir, 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup');
-        fs.mkdirSync(startupDir, { recursive: true });
-        const vbsPath = path.join(startupDir, 'com.bdb.agent-workspace.vbs');
-        const daemonBin = path.join(osAgentDir, 'backend', 'ao-daemon.exe');
-        const runBin = fs.existsSync(daemonBin) ? daemonBin : path.join(osAgentDir, 'backend', 'ao.exe');
-        if (fs.existsSync(runBin)) {
-            const vbsContent = `Set WshShell = CreateObject("WScript.Shell")\r\nWshShell.CurrentDirectory = "${osAgentDir}"\r\nWshShell.Run """${runBin}""", 0, False\r\n`;
-            try {
-                fs.writeFileSync(vbsPath, vbsContent, 'utf-8');
-                spawn('wscript.exe', [vbsPath], { detached: true, stdio: 'ignore' }).unref();
-                const isListening = await verifyDaemonListening(3101, 'Agent Workspace');
-                if (isListening) {
-                    log.success('Agent Workspace Windows Background Service registered & started (Port 3101)');
-                } else {
-                    log.warn('Agent Workspace Windows daemon did not respond on Port 3101 within timeout. You may need to start it manually or check for port conflicts.');
-                }
-            } catch (e) { logDebug(e, 'windows workspace daemon setup'); }
-        }
+            execSync(`codesign -s - -f "${binTarget}"`, { stdio: 'ignore' });
+            log.step('Signed it ad-hoc.');
+        } catch (e) { log.warn(`Could not sign it: ${e.message}`); }
+    }
+
+    // AO installs its own service, and does it for macOS, Windows and Linux.
+    // AOS used to hand-write a LaunchAgent instead, labelled
+    // com.bdb.agent-workspace, whose ProgramArguments were just the binary with
+    // NO subcommand -- so launchd started `ao`, which prints help and exits,
+    // and with KeepAlive kept restarting it. The daemon never ran, on any
+    // machine that installed AO through AOS. Delegating to the tool removes
+    // both the wrong label and the wrong arguments, and keeps working when the
+    // service definition changes upstream.
+    const legacyPlist = path.join(homeDir, 'Library', 'LaunchAgents', 'com.bdb.agent-workspace.plist');
+    if (fs.existsSync(legacyPlist)) {
+        try { execSync(`launchctl unload "${legacyPlist}" 2>/dev/null`, { stdio: 'ignore' }); } catch (e) { logDebug(e, 'unload legacy ao agent'); }
+        try { fs.unlinkSync(legacyPlist); log.step('Removed the old com.bdb.agent-workspace service.'); } catch (e) { logDebug(e, 'remove legacy plist'); }
+    }
+
+    installStep('register the AO service', () => {
+        execSync(`"${binTarget}" service install`, { stdio: 'ignore' });
+    }, 'Start it by hand with: ao service install');
+
+    if (await verifyDaemonListening(3101, 'AO Orchestrator', 8000)) {
+        log.success('AO Orchestrator running on http://localhost:3101');
+    } else {
+        log.warn('AO did not answer on :3101 — check `ao service status` and `ao service logs`.');
     }
-
-    log.step('BDB Agent Workspace WebUI: http://localhost:3101');
 }
-
 async function promptMemBIngestion(mcpCodeTarget) {
     if (isAutoYes || DRY_RUN) return;
 
@@ -1903,30 +2067,16 @@ async function promptMemBIngestion(mcpCodeTarget) {
     }
 }
 
-async function promptEcosystemHealthScheduler() {
-    if (isAutoYes) return;
-    const doSchedule = pick(await askConfirm({
-        message: 'Enable automated Health Audit Cron Job (2x daily at 01:00 and 12:00)?',
-        initialValue: true
-    }));
-    if (doSchedule) {
-        log.success(`Health Audit Scheduler configured for 01:00 & 12:00. Script: ${path.join(srcDir, 'scripts', 'ecosystem-health-audit.js')}`);
-    }
-}
-
 function verifyEcosystemInstallation() {
     const modules = [
         { name: '1. bdb-synapse', pkg: '@hybridlabor-api/bdb-synapse', paths: [path.join(moduleBasePath(), 'bdb-synapse')] },
         { name: '2. memB', pkg: '@hybridlabor-api/memb', paths: [path.join(moduleBasePath(), 'memB'), path.join(geminiDir, 'config', 'mcps', 'memb-mcp')] },
         { name: '3. heimdall-token-saver', pkg: '@hybridlabor-api/heimdall-token-saver', paths: [path.join(moduleBasePath(), 'heimdall-token-saver'), path.join(srcDir, 'vendor', 'token-saver')] },
-        // bdb-os-agent-workspace: temporarily disabled -- its main branch (both local
-        // and on GitHub) is frozen while the real work sits on unmerged WIP branches,
-        // so its published npm version doesn't reliably reflect what "latest" means
-        // right now. Re-add here once that's resolved.
-        { name: '4. bdb-dev-creator-extension', pkg: '@hybridlabor-api/bdb-dev-creator-extension', paths: [path.join(moduleBasePath(), 'bdb-dev-creator-extension')] },
-        { name: '5. bdb-os-remote', pkg: '@hybridlabor-api/bdb-os-remote', paths: [path.join(moduleBasePath(), 'bdb-os-remote')] },
-        { name: '6. bdb-dev-tool-installer', pkg: '@hybridlabor-api/bdb-dev-tool-installer', paths: [path.join(moduleBasePath(), 'bdb-dev-tool-installer')] },
-        { name: '7. aos (bdb agent os)', pkg: '@hybridlabor-api/aos', paths: [srcDir] }
+        { name: '4. AO Agent Orchestrator', pkg: '@hybridlabor-api/bdb-agent-orchestrator', paths: [path.join(moduleBasePath(), 'bdb-agent-orchestrator')] },
+        { name: '5. bdb-dev-creator-extension', pkg: '@hybridlabor-api/bdb-dev-creator-extension', paths: [path.join(moduleBasePath(), 'bdb-dev-creator-extension')] },
+        { name: '6. bdb-os-remote', pkg: '@hybridlabor-api/bdb-os-remote', paths: [path.join(moduleBasePath(), 'bdb-os-remote')] },
+        { name: '7. bdb-dev-tool-installer', pkg: '@hybridlabor-api/bdb-dev-tool-installer', paths: [path.join(moduleBasePath(), 'bdb-dev-tool-installer')] },
+        { name: '8. aos (bdb agent os)', pkg: '@hybridlabor-api/aos', paths: [srcDir] }
     ];
 
     for (const mod of modules) {
@@ -1969,7 +2119,21 @@ function verifyEcosystemInstallation() {
                 console.log(`  • ${colors.bold}${mod.name.padEnd(35)}${colors.reset} ➔ ${colors.green}✅ Installed${colors.reset}`);
             }
         } else if (mod.name.includes('token-saver') && fs.existsSync(path.join(srcDir, 'vendor', 'token-saver'))) {
-            console.log(`  • ${colors.bold}${mod.name.padEnd(35)}${colors.reset} ➔ ${colors.green}✅ v2.6.3 (Integrated)${colors.reset}`);
+            // Was a hardcoded "v2.6.3", which stopped being true the moment the
+            // vendored copy moved. Read it, and say so when it cannot be read.
+            let vendored = null;
+            for (const f of ['package.json', 'pyproject.toml', 'VERSION']) {
+                const vp = path.join(srcDir, 'vendor', 'token-saver', f);
+                if (!fs.existsSync(vp)) continue;
+                try {
+                    const raw = fs.readFileSync(vp, 'utf8');
+                    vendored = f === 'package.json'
+                        ? JSON.parse(raw).version
+                        : (raw.match(/^\s*version\s*=\s*["']?([\w.\-+]+)/m) || [])[1] || raw.trim().split('\n')[0];
+                } catch (e) { logDebug(e, `token-saver version from ${f}`); }
+                if (vendored) break;
+            }
+            console.log(`  • ${colors.bold}${mod.name.padEnd(35)}${colors.reset} ➔ ${colors.green}✅ ${vendored ? `v${vendored} ` : ''}(Integrated)${colors.reset}`);
         } else {
             console.log(`  • ${colors.bold}${mod.name.padEnd(35)}${colors.reset} ➔ ${colors.dim}⚪ Optional / Not downloaded${colors.reset}`);
         }
@@ -2135,7 +2299,13 @@ async function installMcpsForTarget(paths, ctx) {
     if (selectedMcps.includes(CORE_MCP)) {
         const membMcpTarget = path.join(mcpCodeTarget, CORE_MCP);
         installStep(`download/update ${CORE_MCP} from npm`, () => {
-            downloadOrUpdateModule('@hybridlabor-api/memb', membMcpTarget, 'memB MCP');
+            // installStep only catches a throw, and downloadOrUpdateModule
+            // reports failure by returning false -- so without this the hint
+            // below never printed and the MCP config was written pointing at a
+            // path that had not been populated.
+            if (!downloadOrUpdateModule('@hybridlabor-api/memb', membMcpTarget, 'memB MCP')) {
+                throw new Error('npm pack did not produce the memb-mcp payload');
+            }
         }, 'memb-mcp installation skipped; MCP config may reference a missing path.');
     }
     log.step(`Installed selected MCP servers to ${mcpCodeTarget}`);
@@ -2148,7 +2318,11 @@ async function installMcpsForTarget(paths, ctx) {
             const ok = runNpmWithRetry('npm install --no-audit --no-fund', { cwd: targetFolder }, `npm install for ${mcpFolder}`);
             if (ok && (fs.existsSync(path.join(targetFolder, 'tsconfig.json')) || fs.existsSync(path.join(targetFolder, 'tsconfig.build.json')))) {
                 log.step(`Compiling TypeScript for ${mcpFolder}...`);
-                runNpmWithRetry('npm run build', { cwd: targetFolder }, `npm run build for ${mcpFolder}`);
+                const built = runNpmWithRetry('npm run build', { cwd: targetFolder }, `npm run build for ${mcpFolder}`);
+                // runNpmWithRetry already warned with the failure detail; this
+                // just makes the consequence visible now instead of only later,
+                // when the config-entry check below finds the missing dist file.
+                if (!built) log.warn(`${mcpFolder}: build failed -- its MCP config entry will be dropped if the expected output is missing.`);
             }
         }
     }
@@ -2180,7 +2354,11 @@ async function installMcpsForTarget(paths, ctx) {
                     ? path.join(membMcpFolder, '.venv', 'Scripts', 'python.exe')
                     : path.join(membMcpFolder, '.venv', 'bin', 'python');
 
-                if (!fs.existsSync(venvPython)) {
+                // The fs.* writes are covered by the global dry-run patch, but
+                // child processes are not -- these two would really create a venv.
+                if (DRY_RUN) {
+                    log.step(`[dry-run] would create the memb-mcp venv in ${membMcpFolder}`);
+                } else if (!fs.existsSync(venvPython)) {
                     try {
                         execSync(`uv venv --seed .venv`, { cwd: membMcpFolder, stdio: 'ignore' });
                     } catch (e1) {
@@ -2198,12 +2376,12 @@ async function installMcpsForTarget(paths, ctx) {
     }
 
     const pythonMcps = [
-        { folder: 'golem-rhino-mcp', args: ['-m', 'mcp_server', '--help'] },
-        { folder: 'davinci-mcp-professional', args: ['main.py', '--help'] },
+        { folder: 'golem-rhino-mcp', args: ['-m', 'mcp_server', '--help'], uvArgs: true },
+        { folder: 'davinci-mcp-professional', args: ['main.py', '--help'], uvArgs: true },
         { folder: 'davinci-resolve-mcp-free', args: ['-r', 'requirements.txt', 'src/resolve_mcp_bridge.py', '--help'], uvArgs: true },
-        { folder: 'blender-mcp', args: ['-m', 'blender_mcp.server', '--help'] },
+        { folder: 'blender-mcp', args: ['-m', 'blender_mcp.server', '--help'], uvArgs: true },
         { folder: 'vectorworks-mcp', args: ['-r', 'requirements.txt', 'app/mcp_server.py', '--help'], uvArgs: true },
-        { folder: 'windows-computer-use-mcp', args: ['run_server.py', '--help'] }
+        { folder: 'windows-computer-use-mcp', args: ['run_server.py', '--help'], uvArgs: true }
     ];
     for (const mcp of pythonMcps.filter(m => selectedMcps.includes(m.folder))) {
         const targetFolder = path.join(mcpCodeTarget, mcp.folder);
@@ -2213,7 +2391,18 @@ async function installMcpsForTarget(paths, ctx) {
                 log.step(`[dry-run] would pre-warm Python deps for ${mcp.folder}`);
                 continue;
             }
-            spawnSync('uv', prewarmArgs, { cwd: targetFolder, stdio: 'ignore' });
+            const result = spawnSync('uv', prewarmArgs, { cwd: targetFolder, stdio: 'ignore' });
+            if (result.error) {
+                // uv itself is missing or unrunnable. That is one machine-level
+                // fact, not six per-MCP failures — say it once and stop trying.
+                log.warn(`uv could not be run (${result.error.message}) — skipping the Python prewarm for the remaining MCPs.`);
+                break;
+            }
+            if (result.status === 0) {
+                log.step(`Pre-warmed Python deps for ${mcp.folder}`);
+            } else {
+                log.warn(`Prewarm failed for ${mcp.folder}: uv exited ${result.status}. The MCP is configured but its dependencies may not resolve.`);
+            }
         }
     }
 
@@ -2236,6 +2425,28 @@ async function installMcpsForTarget(paths, ctx) {
         const parsedMcpConfig = JSON.parse(mcpConfigStr);
         const finalMcpServers = {};
         const availableFolders = fs.readdirSync(mcpSrcDir);
+
+        // A node MCP's build can fail (see above) or simply never run for a
+        // dist-based server that was skipped -- either way an entry pointing
+        // at a file that was never produced fails at MCP launch, far from the
+        // real cause. Derive the check from each entry's own args (node's
+        // first arg is always its entry script) instead of a hardcoded list of
+        // MCP names, so a fifth dist-based entry added later is covered too.
+        if (!DRY_RUN) {
+            for (const [key, val] of Object.entries(parsedMcpConfig.mcpServers)) {
+                if (val.command !== 'node' || !Array.isArray(val.args) || !val.args[0]) continue;
+                const entryArg = val.args[0];
+                if (!entryArg.startsWith('__MCPS_DIR__/')) continue;
+                const relPath = entryArg.slice('__MCPS_DIR__/'.length);
+                const mcpFolder = relPath.split('/')[0];
+                if (!selectedMcps.includes(mcpFolder)) continue; // not installed at all, already handled below
+                if (!fs.existsSync(path.join(mcpCodeTarget, relPath))) {
+                    log.warn(`${mcpFolder}: build produced no ${relPath.slice(mcpFolder.length + 1)} -- not registering ${key}`);
+                    skippedMcpConfigKeys.push(key);
+                }
+            }
+        }
+
         for (const [key, val] of Object.entries(parsedMcpConfig.mcpServers)) {
             let keep = !skippedMcpConfigKeys.includes(key);
             for (const available of availableFolders) {
@@ -2960,10 +3171,13 @@ async function promptOptionalModules(installedModules) {
         { id: 'synapse', name: 'BDB Synapse (3D Codebase Visualizer)', fn: installSynapse },
         { id: 'memb', name: 'memB Vector Engine (Local Semantic Memory)', fn: () => installMemB(true) },
         { id: 'remote', name: 'BDB OS Remote Gateway (Zero-Trust Tailscale Multiplexer)', fn: installOSRemoteGateway },
-        // bdb-os-agent-workspace: temporarily disabled -- its main branch (both local
-        // and on GitHub) is frozen while the real work sits on unmerged WIP branches,
-        // so its published npm version doesn't reliably reflect what "latest" means
-        // right now. Re-add here once that's resolved.
+        // Offered only where it can actually run -- see aoSupportedHere(). The
+        // predecessor, @hybridlabor-api/bdb-os-agent-workspace, must never come
+        // back: its repository is archived and its last release predates the
+        // archiving, so it hands out the build with the CDC loop defect.
+        ...(aoSupportedHere()
+            ? [{ id: 'ao', name: 'AO Agent Orchestrator (Session telemetry & WebUI)', fn: installOSAgentWorkspace }]
+            : []),
         { id: 'creator', name: 'BDB Creator Extension (Generative 3D, Video & ComfyUI)', fn: installCreatorExtension },
         { id: 'installer', name: 'BDB Dev Tool Installer (Interactive Hub & CLI Launcher)', fn: installDevToolInstaller }
     ];
@@ -3332,11 +3546,19 @@ async function runQuickUpdate(installState) {
         }
     }
     syncSkillsToGlobalHarnesses(excludeSkills);
+    pruneRemovedSkills(_sessionManifest);
     s.stop('Skills refreshed');
 
-    installStep('refresh gate + memory hooks', () => {
-        installGlobalHooks();
-    }, 'Hooks keep whatever version this machine already had.');
+    // Everything injectHarnessRules() delivers -- GEMINI.md, the dispatcher
+    // workflows the skills point at, the compiled subagent definitions, the
+    // harness rule files and the gate + memory hooks -- used to be
+    // fresh-install-only. v4.4.1 split just the hooks out of it for Quick
+    // Update; the rest stayed behind, so a machine that only ever quick-updates
+    // kept running first-install agent definitions and dispatcher scripts
+    // forever. Same defect as the hook, one layer up. Run the whole thing.
+    installStep('refresh harness rules, workflows, agents and hooks', () => {
+        injectHarnessRules();
+    }, 'Harness files keep whatever version this machine already had.');
 
     // OpenWiki setup only ever ran on a brand-new install (main()'s fresh-install
     // branch below) -- an existing install running Quick Update never got offered
@@ -3357,7 +3579,7 @@ async function runQuickUpdate(installState) {
         if (subId === 'synapse') await installSynapse();
         else if (subId === 'memb') await installMemB(false);
         else if (subId === 'remote') await installOSRemoteGateway();
-        // 'ao' (bdb-os-agent-workspace) intentionally skipped here even for
+        // 'ao' intentionally skipped here even for
         // existing installs -- see promptOptionalModules() for why.
         else if (subId === 'creator') await installCreatorExtension();
         else if (subId === 'installer') await installDevToolInstaller();
@@ -3398,7 +3620,10 @@ async function main() {
     console.log(buildTelemetryCard({ installState, detections, daemonStatus }));
 
     if (DRY_RUN) {
-        log.warn('DRY-RUN MODE active - no files will be modified, no commands executed.');
+        // Precise on purpose: version comparison still queries the registry, and
+        // npm writes its own cache and logs under ~/.npm doing so. Nothing AOS
+        // owns is touched -- but claiming "no commands executed" was not true.
+        log.warn('DRY-RUN MODE active - nothing AOS owns is written. Read-only registry lookups still run (npm caches under ~/.npm).');
     }
     if (isAutoYes) {
         log.warn('Non-interactive/auto mode (-y): all defaults are accepted automatically.');
@@ -3490,6 +3715,8 @@ async function main() {
     let wantsUniversal = true;
     let specificPlatforms = ['1'];
 
+    markPlatformsExplicit(PLATFORMS_ARG || []);
+
     if (PLATFORMS_ARG) {
         // Explicit targets win over both the menu and the auto-yes default.
         // '0' means universal; anything else means exactly those targets, so
@@ -3529,6 +3756,9 @@ async function main() {
             });
             if (sel === BACK) return 'back';
             ctx.selectedPlatforms = sel;
+            // A harness the user names counts as present even when no binary
+            // or app bundle turns up for it.
+            markPlatformsExplicit(sel);
         };
 
         const stepMode = async () => {
@@ -3721,6 +3951,7 @@ async function main() {
     }
 
     syncSkillsToGlobalHarnesses(excludeSkills);
+    pruneRemovedSkills(_sessionManifest);
     s.stop('Skills installed.');
 
     injectHarnessRules();
@@ -3742,7 +3973,6 @@ async function main() {
     const justInstalled = await promptOptionalModules(installedModulesForPrompt) || [];
 
     await promptMemBIngestion(path.join(primaryTarget.targetMcpDir, 'mcps'));
-    await promptEcosystemHealthScheduler();
 
     const alreadyHandled = justInstalled.map(id => MODULE_ID_TO_DAEMON_NAME[id]).filter(Boolean);
     await reloadDaemons(alreadyHandled);
@@ -3767,6 +3997,10 @@ if (require.main === module) {
 
 // Exported for tests -- requiring installer.js must not launch the TUI.
 module.exports = {
+    installOSAgentWorkspace,
+    downloadOrUpdateModule,
+    detectPlatforms,
+    markPlatformsExplicit,
     mergeBdbSettingsHooks,
     installGlobalHooks,
     installProjectHarness,