@ours.network/install 0.16.0 → 0.17.0-nightly.2

package/README.md

@@ -64,8 +64,8 @@ dependency on the things it installs): an ASCII banner, tasteful colour (degrade
      prints the exact manual commands and continues — it **never dead-ends**.
    - **3/4 ours-fleet** — makes your harnesses persistent, always-online agent teams that survive
      a reboot; runs `ours-fleet init`. Default **Yes**.
-   - **4/4 Telegram connector** — install-only (no bot tokens here), then optionally as a
-     boot service.
+   - **4/4 Telegram connector** — install-only (no bot tokens here), **pointed at the daemon
+     step 1 just built**, then optionally as a boot service.
 4. **Summary + hand-off** — a recap (skipped/failed rows call out the fix), then a **literal
    copy-paste prompt** (root identity + fleet + Telegram) with the steps for any skipped/failed
    component dropped out. Copied to the clipboard where supported.
@@ -74,6 +74,48 @@ The human identity is created idempotently after the daemon becomes reachable. B
 `curl … | bash` gives the script its input over the pipe, every prompt is read from the
 controlling terminal (`/dev/tty`), so the flow still works piped.
 
+## One daemon, and everything pointed at it
+
+A clean deployment installs, configures and starts **one** ours daemon first, then wires every
+client to that same daemon. What that takes differs per client:
+
+- **The harness plugins** need nothing extra: each is `ours-mcp proxy`, which reads the daemon's
+  own config (`OURS_CONFIG`, else `~/.ours/config.json`). `autoStart` is off by default, so a proxy
+  whose daemon is down reports it rather than quietly starting a second one.
+- **The Telegram connector keeps its own config file** and never inherits the daemon's, so the
+  installer writes `~/.ours-telegram/config.json` (honouring `OURS_TG_CONFIG`) **before** the
+  connector is started or installed as a service — `install-service` bakes whatever it resolves
+  into the service unit as environment variables, and those outrank the file from then on.
+  Three keys are written, so whichever connector generation is installed finds what it reads:
+  - `daemonUrl` + `daemonStateDir` — for `>=0.3.3-nightly.1`, which attaches to the running daemon
+    over `/api/v1`. **Both** are required: with neither, its SDK never reads `~/.ours/config.json`
+    and falls back to the built-in `127.0.0.1:3050`, missing a daemon on any other port; with the
+    endpoint alone it refuses outright (`INCOHERENT_SELECTION` — the daemon's API token belongs to
+    a state directory, so selecting an endpoint without one would disclose that token).
+  - `brokerUrl` — for `<=0.3.2`, which hosts its own ADAPT wrapper and meets the daemon at a broker
+    instead. It must match the daemon's or the two can never see each other.
+
+  A re-run that changes nothing rewrites nothing, and keys the installer does not own are preserved.
+
+If `ours-mcp install-service` fails (no systemd user bus, no linger, a container, WSL without
+systemd) it has already **stopped** the daemon it was about to supervise. The installer restarts it
+and says plainly that the boot service is missing — a clean deployment never ends with no daemon
+while the summary claims success.
+
+## Release channel
+
+`OURS_CHANNEL=nightly` (or `OURS_INSTALL_CHANNEL`) installs the `nightly` dist-tag for the packages
+that publish one — `mcp`, `tg-connector`, and the `claude-code` / `codex` / `hermes` launchers —
+while `@ours.network/fleet` stays `@latest` always (it publishes no nightly).
+
+**With no explicit selection the installer follows its own version.** A published nightly build
+carries the `-nightly.N` suffix the release bump stamps, so `npm i -g @ours.network/install@nightly`
+builds a nightly stack, and a stable installer can never consume a nightly. This is load-bearing
+rather than cosmetic: across `tg-connector` 0.3.2 → 0.3.3-nightly.1 the connector stopped hosting
+its own ADAPT wrapper and became a client of the shared daemon, so mixing tags across that boundary
+pairs a connector that needs `/api/v1` with a daemon that does not serve it. `OURS_CHANNEL` still
+overrides in both directions.
+
 ## Non-interactive / CI / safe dry-run
 
 ```sh
@@ -96,6 +138,9 @@ is reported and left unchanged.
 | `OURS_INSTALL_DRY_RUN` | walk the flow without installing or changing anything |
 | `OURS_NPM` | npm binary to use (default `npm`) |
 | `OURS_CONFIG` | daemon config file location (default `~/.ours/config.json`) |
+| `OURS_STATE_DIR` | daemon state directory (default `~/.ours`) — also what the Telegram connector is told to expect |
+| `OURS_TG_CONFIG` | Telegram connector config file location (default `~/.ours-telegram/config.json`) |
+| `OURS_CHANNEL` | `nightly` or `latest`; unset follows the installer's own version |
 
 ## Uninstall
 
@@ -142,5 +187,6 @@ OURS_UNINSTALL_DAEMON=yes \
   published components.
 - **Idempotent + safe to re-run.** A re-run adds a skipped piece, re-points the plugins, or (only
   when you say yes) updates a component; an already-current daemon is left untouched, its running
-  port and complete voice setup are reused everywhere. Bot tokens and fleet roles remain in the
+  port and complete voice setup are reused everywhere — and the Telegram connector's daemon
+  selection is rewritten only if it actually changed. Bot tokens and fleet roles remain in the
   copy-paste hand-off; provider keys never enter that prompt or agent chat.

package/install.mjs

@@ -20,21 +20,24 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { readFileSync, existsSync } from 'node:fs';
 import { homedir, userInfo, platform as osPlatform, release as osRelease } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { banner, heading, ok, info, warn, c, box, withSpinner, openTty, makeWriter, closeSync } from './lib/ui.mjs';
 import { askLine, askYesNo, isCancel } from './lib/prompt.mjs';
 import {
   suggestPort, parsePort, validateBroker, mergeConfig, parseVersion, parseStatus,
   detectPlatform, classifyHarnessProbe, buildHandoffPrompt,
-  voiceSetupStatus,
+  voiceSetupStatus, resolveSharedBroker, tgConfigPath, planTgDaemonConfig, daemonEndpoint,
   DEFAULT_PORT, resolveChannel, pkgSpec,
 } from './lib/logic.mjs';
 import { atomicWriteConfig } from './lib/config.mjs';
 
 const NPM = process.env.OURS_NPM || 'npm';
 // Release channel: OURS_CHANNEL=nightly installs @nightly for mcp/tg-connector/plugin
-// launchers but keeps @ours.network/fleet at @latest (fleet has no nightly). Default: latest.
-const CHANNEL = resolveChannel(process.env.OURS_CHANNEL || process.env.OURS_INSTALL_CHANNEL);
+// launchers but keeps @ours.network/fleet at @latest (fleet has no nightly). With no
+// explicit selection the installer follows its OWN channel, so a nightly installer
+// builds a nightly stack instead of silently mixing tags across the connector's
+// architecture boundary (see resolveChannel).
+const CHANNEL = resolveChannel(process.env.OURS_CHANNEL || process.env.OURS_INSTALL_CHANNEL, pkgVersion());
 const spec = (pkgKey) => pkgSpec(pkgKey, CHANNEL); // → "@ours.network/<key>@<tag>"
 let DRY = !!process.env.OURS_INSTALL_DRY_RUN;
 const SELFHOST_URL = 'ours.network';
@@ -109,6 +112,18 @@ function writeConfigPatch(patch) {
   return p;
 }
 
+// The daemon's state directory, resolved exactly the way packages/core/src/config.ts
+// resolves it (env > config file > ~/.ours). The Telegram connector needs the ABSOLUTE
+// path: the SDK reads the daemon's API token from it and refuses to send that token to
+// a separately-chosen endpoint unless the state dir was chosen just as deliberately.
+function daemonStateDir() {
+  const fromEnv = process.env.OURS_STATE_DIR?.trim();
+  if (fromEnv) return resolve(fromEnv);
+  const fromFile = readConfigObject().stateDir;
+  if (typeof fromFile === 'string' && fromFile.trim()) return resolve(fromFile.trim());
+  return join(homedir(), '.ours');
+}
+
 function daemonVoiceCapability() {
   const r = run('ours-mcp', ['voice-status', '--json'], { capture: true, timeout: 6000 });
   if (!r.ok) return null;
@@ -439,10 +454,24 @@ async function main() {
     const voice = offerVoiceSetup({ readinessAfterStart: true });
     const started = await act(`ours-mcp start (port ${chosenPort})`, async () => run('ours-mcp', ['start']));
     const svc = await act('ours-mcp install-service (survives reboot)', async () => run('ours-mcp', ['install-service']));
-    if (started.ok) line(ok(`ours core ready — running on port ${chosenPort}. No problems.`));
+    // `ours-mcp install-service` STOPS the daemon before it writes the unit (core's
+    // cmdInstallService), then exits non-zero if `systemctl --user enable --now` fails —
+    // no linger, no user bus, a container, WSL without systemd. Left alone that turns a
+    // WORKING daemon into no daemon at all, while the line below still said "ready": the
+    // human identity and every MCP client then fail against a port nothing is listening
+    // on. Put the one shared daemon back up and report what is actually true.
+    let running = started.ok;
+    if (!DRY && !svc.ok) {
+      running = daemonRunning();
+      if (!running) {
+        line(info('the boot-service step stopped the daemon before it failed — restarting it.'));
+        running = run('ours-mcp', ['start']).ok || daemonRunning();
+      }
+    }
+    if (running) line(ok(`ours core ready — running on port ${chosenPort}. No problems.`));
     else line(warn(`could not auto-start — run '${c.cyan('ours-mcp start')}' to bring it up.`));
     if (!svc.ok && !svc.dry) line(warn(`boot-service not installed — retry '${c.cyan('ours-mcp install-service')}' later.`));
-    if (voice.setupRan && !DRY && started.ok) {
+    if (voice.setupRan && !DRY && running) {
       const verified = daemonVoiceCapability();
       if (verified?.ready) {
         line(ok(`Voice transcription readiness confirmed (${verified.provider}) after the first start.`));
@@ -455,7 +484,13 @@ async function main() {
         }
       }
     }
-    record({ key: 'core', label: 'ours core (daemon)', state: started.ok ? 'installed' : 'failed', version: parseVersion(daemonVersionLine()), note: 'starts on boot' });
+    record({
+      key: 'core',
+      label: 'ours core (daemon)',
+      state: running ? 'installed' : 'failed',
+      version: parseVersion(daemonVersionLine()),
+      note: svc.ok ? 'starts on boot' : 'running; no boot service',
+    });
   } else {
     // Installed: offer an update; never re-ask config; reuse the running port everywhere.
     const daemonState = daemonLifecycleState();
@@ -639,6 +674,39 @@ async function main() {
   }
   cont(goFleet);
 
+  // Give the Telegram connector the ONE daemon this install just built: its loopback
+  // endpoint, the state directory that endpoint's API token belongs to, and — for a
+  // pre-0.3.3 connector that still meets the daemon at a broker instead — that broker.
+  // Idempotent: an unchanged selection writes nothing. Returns { changed, hadPrevious }
+  // so the caller can warn about a service unit that froze an older selection.
+  async function writeTgDaemonConfig({ chosenPort, chosenBroker, status0 }) {
+    const path = tgConfigPath(process.env, homedir());
+    const stateDir = daemonStateDir();
+    const desired = {
+      daemonUrl: daemonEndpoint(chosenPort),
+      daemonStateDir: stateDir,
+      brokerUrl: resolveSharedBroker({
+        chosenBroker,
+        statusBroker: status0.broker,
+        configBroker: readConfigObject().brokerUrl,
+      }),
+    };
+    let existing = {};
+    try { existing = JSON.parse(readFileSync(path, 'utf8')); } catch { /* absent or unreadable */ }
+    const plan = planTgDaemonConfig(existing, desired);
+    const hadPrevious = !!(plan.previous.daemonUrl || plan.previous.brokerUrl);
+    if (!plan.changed) {
+      line(ok(`Telegram connector already points at this daemon (${desired.daemonUrl}) — no change.`));
+      return { changed: false, hadPrevious };
+    }
+    await act(`write ${path} (daemon ${desired.daemonUrl}, state ${stateDir})`, async () => {
+      atomicWriteConfig(path, plan.text);
+      return { ok: true };
+    });
+    line(ok(`Telegram connector configured to use this daemon (${desired.daemonUrl}).`));
+    return { changed: true, hadPrevious };
+  }
+
   // ============================================================================================
   // STEP 4 / 4 — Telegram connector. Install-only (no bot tokens here). Then: run as a service?
   // ============================================================================================
@@ -648,15 +716,28 @@ async function main() {
   const goTg = yes('  Install it?', false);
   if (goTg) {
     await actSpin(`installing ${spec('tg-connector')}…`, `npm i -g ${spec('tg-connector')}`, () => runAsync(NPM, ['i', '-g', spec('tg-connector')]));
+    // POINT IT AT THE ONE DAEMON — BEFORE it is started or installed as a service.
+    // The connector never inherits ~/.ours/config.json (its SDK reports configPath:
+    // null unless told otherwise), and `install-service` bakes whatever it resolves
+    // into the unit as environment variables that outrank the file from then on. So
+    // the daemon's identity has to be in its config BEFORE either happens. See
+    // planTgDaemonConfig for why all three keys are written.
+    const tgConfigured = await writeTgDaemonConfig({ chosenPort, chosenBroker, status0 });
     const asService = yes('  Keep it running in the background so it starts automatically on boot?', true);
     if (asService) {
       const svc = await act('ours-tg-connector install-service (starts on boot)', async () => run('ours-tg-connector', ['install-service']));
-      if (svc.ok) line(ok('Telegram connector installed and running as a service (starts on boot). No problems.'));
+      if (svc.ok) line(ok(`Telegram connector installed and running as a service (starts on boot), pointed at the daemon on port ${chosenPort}. No problems.`));
       else line(warn(`connector installed, but the service didn't start — retry '${c.cyan('ours-tg-connector install-service')}'.`));
-      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: 'service (boot)' });
+      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: `service (boot) · daemon ${chosenPort}` });
     } else {
-      line(ok(`Telegram connector installed. Start it any time with '${c.cyan('ours-tg-connector start')}'. No problems.`));
-      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: 'start on demand' });
+      line(ok(`Telegram connector installed, pointed at the daemon on port ${chosenPort}. Start it any time with '${c.cyan('ours-tg-connector start')}'. No problems.`));
+      // A connector already installed as a service froze its OLD daemon selection into
+      // the unit's environment, which outranks the file we just wrote. Config alone
+      // cannot repair that — say so plainly rather than let it look fixed.
+      if (tgConfigured.changed && tgConfigured.hadPrevious) {
+        line(warn(`if you previously ran '${c.cyan('ours-tg-connector install-service')}', re-run it — the old service froze the previous daemon selection in its unit.`));
+      }
+      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: `start on demand · daemon ${chosenPort}` });
     }
   } else {
     line(info('skipped cleanly.'));

package/lib/logic.mjs

@@ -42,11 +42,29 @@ const CHANNEL_TRACKING_PKGS = new Set(['mcp', 'tg-connector', 'claude-code', 'co
 const STABLE_ONLY_PKGS = new Set(['fleet']);
 
 // Normalize a raw channel selection to 'latest' | 'nightly'. Anything unrecognized
-// (incl. undefined/'') falls back to the safe default 'latest' — never guesses a tag.
-export function resolveChannel(raw) {
+// (incl. undefined/'') falls back to the installer's OWN channel — never guesses a tag.
+//
+// WHY THE INSTALLER'S OWN VERSION IS A CHANNEL SIGNAL. `@ours.network/install` is
+// published on both dist-tags from the same lockstep bump (.github/workflows/scripts/
+// bump-versions.sh), so a nightly build carries a `-nightly.N` version and a stable
+// build does not. Without this, `npm i -g @ours.network/install@nightly && ours-install`
+// installed the nightly INSTALLER but @latest for everything it installs — which since
+// tg-connector 0.3.3-nightly.1 is not merely older but a DIFFERENT ARCHITECTURE (0.3.2
+// hosts its own ADAPT wrapper; the nightly attaches to the shared daemon over /api/v1,
+// which only the SDK-based daemon serves). Mixing the two tags across that boundary is
+// exactly the split-brain deployment this must not produce. A stable installer stays on
+// @latest and can never consume a nightly; an explicit OURS_CHANNEL always wins over both.
+export function resolveChannel(raw, selfVersion = '') {
   const v = String(raw || '').trim().toLowerCase();
   if (v === 'nightly' || v === 'prerelease' || v === 'next') return 'nightly';
-  return DEFAULT_CHANNEL; // 'latest' and everything else
+  if (v === 'latest' || v === 'stable') return DEFAULT_CHANNEL;
+  if (v) return DEFAULT_CHANNEL; // unrecognized: never guess, never inherit
+  return isNightlyVersion(selfVersion) ? 'nightly' : DEFAULT_CHANNEL;
+}
+
+// A published nightly carries the `-nightly.N` prerelease suffix the bump script writes.
+export function isNightlyVersion(version) {
+  return /-nightly\.\d+/.test(String(version || ''));
 }
 
 // The npm dist-tag to install for one package key under a channel. fleet is ALWAYS
@@ -70,6 +88,79 @@ export const RESERVED_PORTS = [3051];
 export const DEFAULT_PORT = 3050;
 export const DEFAULT_BROKER = 'wss://broker1.ours.network';
 
+// ── Handing the Telegram connector the ONE shared daemon ───────────────────────
+// The connector has its OWN config file and never inherits the daemon's. Two
+// generations of it are in the wild and the installer must satisfy BOTH, because
+// which one gets installed is a channel decision (see pkgTag):
+//
+//   @nightly (>=0.3.3-nightly.1) — SDK-based. It ATTACHES to an already-running
+//     ours daemon over /api/v1 and has NO broker at all. It selects the daemon
+//     through @ours.network/sdk's resolveDaemonConfig, whose behaviour we verified
+//     against the published SDK 0.1.2 (the version the nightly pins):
+//       · with no overrides it reports configPath: null — the daemon's
+//         ~/.ours/config.json is NEVER read implicitly, so a daemon on any port
+//         other than the built-in 3050 is simply MISSED.
+//       · pointing OURS_CONFIG at that file, or passing an endpoint alone, throws
+//         INCOHERENT_SELECTION: "the endpoint was selected … but the state
+//         directory is the built-in default" — a deliberate credential-disclosure
+//         guard that refuses BEFORE any token is read.
+//       · endpoint AND state dir together resolve cleanly.
+//     So the ONLY correct contract is to give it BOTH daemonUrl and daemonStateDir.
+//
+//   @latest (<=0.3.2) — the older self-hosting ADAPT wrapper. It ignores
+//     daemonUrl/daemonStateDir and meets the daemon at a BROKER instead, so its
+//     brokerUrl must match the daemon's or the two can never see each other.
+//
+// Writing all three keys satisfies whichever generation is installed: each reads
+// only the keys it understands and ignores the rest. This matters at INSTALL time
+// specifically, because `ours-tg-connector install-service` BAKES its resolved
+// values into the service unit as environment variables, and env outranks the
+// config file forever after — a divergence created here can never be repaired by
+// editing that file.
+
+// The daemon's loopback endpoint. The daemon always binds 127.0.0.1 (never a
+// hostname), so this is the address the connector must be given.
+export function daemonEndpoint(port) {
+  return `http://127.0.0.1:${port}`;
+}
+
+// The broker the whole deployment shares, for a <=0.3.2 connector.
+// Precedence: what the user chose in THIS run > what the running daemon actually
+// resolved (`ours-mcp status`, which already accounts for OURS_BROKER_URL) > what
+// the daemon's config file says > the built-in default (identical to the daemon's
+// DEFAULT_CONFIG.brokerUrl, so "no answer anywhere" still agrees).
+export function resolveSharedBroker({ chosenBroker, statusBroker, configBroker } = {}) {
+  for (const candidate of [chosenBroker, statusBroker, configBroker]) {
+    const v = validateBroker(candidate ?? '');
+    if (!v.empty && v.ok) return v.value;
+  }
+  return DEFAULT_BROKER;
+}
+
+// The Telegram connector's own config file (mirrors its src/config.ts: OURS_TG_CONFIG,
+// else <home>/.ours-telegram/config.json — a FIXED location, independent of its stateDir).
+export function tgConfigPath(env = {}, home = '') {
+  return env.OURS_TG_CONFIG || `${home}/.ours-telegram/config.json`;
+}
+
+// Decide whether the connector's config needs a write, and what to write. Returns
+// { changed, text, previous } — `changed` is false when the file already names this
+// exact daemon and broker, so an idempotent re-run touches nothing. Unrelated keys
+// the user or the connector added (bot tokens, STT settings) are preserved.
+export function planTgDaemonConfig(existing, { daemonUrl, daemonStateDir, brokerUrl } = {}) {
+  const base = existing && typeof existing === 'object' ? existing : {};
+  const str = (v) => (typeof v === 'string' ? v : '');
+  const previous = {
+    daemonUrl: str(base.daemonUrl),
+    daemonStateDir: str(base.daemonStateDir),
+    brokerUrl: str(base.brokerUrl),
+  };
+  const next = { daemonUrl, daemonStateDir, brokerUrl };
+  const changed = Object.entries(next).some(([k, v]) => v !== undefined && previous[k] !== v);
+  if (!changed) return { changed: false, text: '', previous };
+  return { changed: true, text: mergeConfig(base, next), previous };
+}
+
 // suggestPort: pick a usable HTTP port. If `desired` is free and not reserved, keep it. Otherwise
 // scan upward from 3060 (the brief's suggested alternate band) for the first free, non-reserved
 // port. `isTaken(port)` is injected so this stays pure and testable (real caller probes a bind).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "0.16.0",
+  "version": "0.17.0-nightly.2",
   "private": false,
   "description": "The unified ours.network stack installer (ours-install): one guided ~3-minute flow for ours core (the daemon) + the harness plugins (Claude Code / Codex) + ours-fleet + the Telegram connector, then a single copy-paste hand-off prompt. Self-contained (Node built-ins only); run as `ours-install` or via curl|bash (install.sh).",
   "type": "module",