@ours.network/install 0.17.0-nightly.12 → 0.17.0-nightly.13

package/lib/components.mjs

@@ -23,8 +23,12 @@ import { pkgSpec, resolveChannel } from './logic.mjs';
 // effects.installedVersion('@ours.network/mcp@nightly') return null forever,
 // which fails the cowork version floor CLOSED and blanks the version column —
 // a silent regression that looks like "cowork is too old".
+// `required` is not a stronger default — it is the absence of a choice. The MCP
+// package IS the daemon now (the daemon phase installs and starts it), so an
+// operator who declined it would have no daemon at all, which is not a decision
+// anyone means to make. Declining has to be impossible rather than discouraged.
 export const COMPONENTS = [
-  { key: 'mcp', label: 'MCP server', pkg: '@ours.network/mcp', specKey: 'mcp', default: true },
+  { key: 'mcp', label: 'ours daemon + MCP server', pkg: '@ours.network/mcp', specKey: 'mcp', default: true, required: true },
   { key: 'tg', label: 'Telegram connector', pkg: '@ours.network/tg-connector', specKey: 'tg-connector', default: false },
   { key: 'cowork', label: 'cowork', pkg: '@ours.network/cowork', specKey: 'cowork', default: false },
 ];
@@ -114,7 +118,12 @@ export function planComponentSelection({ answers = {}, installed = {}, assumeYes
   return COMPONENTS.map((component) => {
     const already = installed[component.key] === true;
     const answer = assumeYes ? component.default : answers[component.key];
-    const wanted = answer === undefined ? (already || component.default) : answer === true;
+    // A required component ignores the answer entirely, including an explicit no.
+    // The daemon phase has already installed and started it by the time this runs;
+    // "skip" here would only produce a screen that contradicts the machine.
+    const wanted = component.required
+      ? true
+      : (answer === undefined ? (already || component.default) : answer === true);
     return {
       ...component,
       already,

package/lib/extras.mjs

@@ -333,10 +333,19 @@ export function planVoice({
     // The beat. Only owed when the config actually changed: an unchanged config
     // is not a reason to bounce a daemon somebody else may be using.
     restartOwed: Boolean(configChanged),
-    restart: configChanged && config ? ['ours', 'daemon', 'restart', '--config', config] : null,
+    // ours-mcp's restart, because ours-mcp is the daemon now. NOTE FOR WHOEVER
+    // TOUCHES THIS NEXT — the reason the installer owns this beat at all may have
+    // just evaporated: cmdVoiceSetup computes `managed = runningPid() !== null`
+    // from ours-mcp's OWN pid record, and an ours-mcp daemon HAS one. Under the
+    // SDK-CLI daemon it never did, which is why the restart had no owner and the
+    // installer took it. If voice-setup now classifies the daemon as managed it
+    // will run its own restart protocol, and this becomes a second restart rather
+    // than the only one. Not changed here: that is a behaviour question for
+    // packages/core, not a rename.
+    restart: configChanged && config ? ['ours-mcp', 'restart'] : null,
     // Never rolls the daemon back: voice-setup leaves the prior config intact on
     // its own failure path, so the recovery is a retry, not an undo.
-    retryHint: config ? `ours daemon restart --config ${config}` : null,
+    retryHint: config ? `OURS_CONFIG=${config} ours-mcp restart` : null,
     port: Number.isInteger(port) ? port : null,
   };
 }

package/lib/orchestrate-uninstall.mjs

@@ -139,9 +139,13 @@ export async function runUninstall(argv, effects) {
     readJson: effects.readJson,
     readText: effects.readText,
     exists: effects.exists,
-    cliStartedIt: effects.readJson(join(dir, 'ours-cli-daemon.json')) !== null,
+    // EITHER record proves a managed daemon: ours-cli-daemon.json is what
+    // `ours daemon start` wrote yesterday, daemon.pid is what `ours-mcp start`
+    // writes today. Reading only one makes an uninstall on the other kind decline
+    // to stop a daemon it could have stopped.
+    cliStartedIt: effects.readJson(join(dir, 'ours-cli-daemon.json')) !== null
+      || effects.readText(join(dir, 'daemon.pid')) !== null,
     otherStateDirsWithConfig: effects.knownStateDirs(),
-    platform: effects.platform?.platform,
     typedConfirmation: null,
     explicitHarnessSelection: contract.engaged,
   });
@@ -160,7 +164,6 @@ export async function runUninstall(argv, effects) {
   // removal makes that true. If step 3 or 4 fails, the operator is left with a
   // stopped, detached connector NEXT TO A DAEMON THAT IS STILL THERE — a world the
   // bytes no longer describe.
-  let unsupportedService = null;
   const journal = configJournal(effects, { dryRun: args.dryRun });
   const detached = [];
   for (const component of plan.detach) {
@@ -180,13 +183,6 @@ export async function runUninstall(argv, effects) {
   // 3-4. The boot service, then the daemon. Both delegate their refusals.
   try {
     for (const step of plan.daemon) {
-      if (step.id === 'service-unsupported') {
-        // Said, not skipped silently: the operator is entitled to know that the
-        // thing they may have expected to be removed was never installed.
-        effects.out(warn(`ours: ${step.note}`));
-        unsupportedService = step;
-        continue;
-      }
       if (step.command === null) {
         effects.out(info(`${step.note} — nothing signalled`));
         continue;
@@ -213,7 +209,6 @@ export async function runUninstall(argv, effects) {
   const packages = planGlobalPackages({
     stateDir: dir,
     otherStateDirsWithConfig: effects.knownStateDirs(),
-    platform: effects.platform?.platform,
     pluginPackages: pluginOutcome.packages,
     // The plugin packages are recomputed; the CONNECTOR packages are not. They
     // are decided by what the operator confirmed detaching, which the plugin
@@ -229,15 +224,6 @@ export async function runUninstall(argv, effects) {
       await perform(effects, args.dryRun, `npm rm -g ${pkg}`, () => effects.run('npm', ['rm', '-g', pkg]));
     }
   }
-  // SAID AT THE END, where a closing screen is actually read, and not only in the
-  // line it scrolled past during the run. The same rule as the install side: an
-  // uninstall that quietly did less than the operator believes is the thing to
-  // avoid, and "nothing of ours was there to remove" is only reassuring if it is
-  // stated.
-  if (unsupportedService) {
-    effects.out(warn(`Boot service: NOT removed — ${unsupportedService.note}.`));
-    effects.out(info('If you start the daemon yourself at login, remove that arrangement by hand.'));
-  }
   return EXIT_OK;
 }
 

package/lib/orchestrate.mjs

@@ -29,7 +29,7 @@ import { planDaemonConfig, planServiceInstall, serviceInstallCommand } from './p
 import {
   COMPONENTS,
   planComponentSelection, planMcpAttachment, planTgAttachment, planCoworkAttachment,
-  tgConfigPath, coworkConfigPath, summarizeComponentRun, componentSpec,
+  tgConfigPath, coworkConfigPath, summarizeComponentRun, componentSpec, componentByKey,
 } from './components.mjs';
 import { planHarnessPlugins, planFleet, planVoice, buildHandoffPromptV3, restartHints } from './extras.mjs';
 import { summarizeRun } from './rerun.mjs';
@@ -176,6 +176,7 @@ export async function runDaemonPhase(args, effects) {
     portExplicit: args.portExplicit,
     probe: effects.probe,
     readJson: effects.readJson,
+    readText: effects.readText,
     isTaken: effects.isTaken,
   });
 
@@ -216,8 +217,22 @@ export async function runDaemonPhase(args, effects) {
 
   const steps = [];
 
-  await perform(effects, args.dryRun, 'ours CLI installed (npm i -g @ours.network/cli)', () => effects.run('npm', ['i', '-g', '@ours.network/cli']));
-  steps.push({ id: 'cli', changed: true, packageRefresh: true });
+  // THE DAEMON IS ours-mcp, SO ITS PACKAGE COMES FIRST.
+  //
+  // This used to install @ours.network/cli, because the daemon used to be
+  // `ours daemon serve`. That daemon does not mount /mcp — the SDK serves that
+  // route only when a host supplies an `mcp` option, and @ours.network/cli calls
+  // startDaemon() with no arguments — so every MCP client, including every harness
+  // session through `ours-mcp proxy`, got the daemon's own 404. The one
+  // MCP-capable daemon in the stack is ours-mcp's, which supplies the server
+  // factory, the transport constructor and the notification sink
+  // (packages/core/src/serve.ts).
+  //
+  // The order therefore inverts: the MCP package was a COMPONENT installed after
+  // this phase, and it is now the thing this phase starts.
+  const daemonPkg = componentSpec(componentByKey('mcp'), args.channel);
+  await perform(effects, args.dryRun, `ours daemon installed (npm i -g ${daemonPkg})`, () => effects.run('npm', ['i', '-g', daemonPkg]));
+  steps.push({ id: 'daemon-package', changed: true, packageRefresh: true });
 
   // The config file — merged, never rewritten, and untouched when it already
   // matches. No provenance marker is written: the owner ruled that --purge works
@@ -239,7 +254,6 @@ export async function runDaemonPhase(args, effects) {
   // lookup exists to prevent; this is what stops the installer from setting up the
   // conditions for it.
   const journal = configJournal(effects, { dryRun: args.dryRun });
-  let serviceUnsupported = null;
   if (merged.changed) {
     journal.snapshot(configPath);
     await perform(effects, args.dryRun, `write ${configPath} (port ${target.port})`, () => effects.writeJson(configPath, merged.text));
@@ -250,12 +264,18 @@ export async function runDaemonPhase(args, effects) {
 
   try {
     if (creating) {
-      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours', ['daemon', 'start', '--config', configPath]));
+      // `start`, not `serve`: start backgrounds the daemon and polls until the port
+      // is open, which is the same observable readiness the old path had. `serve`
+      // runs in the foreground and would never return.
+      //
+      // Selected by ENVIRONMENT rather than flags — ours-mcp reads OURS_CONFIG /
+      // OURS_PORT / OURS_STATE_DIR — and daemonEnv is the one place that pair is
+      // built, so the daemon this run created is the daemon that starts.
+      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours-mcp', ['start'], { env: daemonEnv(dir, target.port) }));
       steps.push({ id: 'start', changed: true });
     }
 
-    const service = await runServicePhase(args, effects, dir);
-    if (service.unsupported) serviceUnsupported = service.unsupported;
+    const service = await runServicePhase(args, effects, dir, target.port);
     if (service.refused) {
       // A REFUSAL IS A FAILURE TO REACH THE STATE, not a special case. An unknown
       // unit file stops the run just as a failed start does, and it stops it with
@@ -276,7 +296,7 @@ export async function runDaemonPhase(args, effects) {
     // The nightly flow re-runs `start` and, crucially, tells the two outcomes
     // apart: "the service failed but the daemon is back" is a bad evening, and "the
     // service failed AND it will not come back" is the one that needs a human now.
-    const recovery = error?.servicePlan ? await recoverDaemon(args, effects, dir, configPath) : null;
+    const recovery = error?.servicePlan ? await recoverDaemon(args, effects, dir, configPath, target.port) : null;
     rollBack(effects, journal, args, 'the daemon did not reach the state its config describes — putting the config back', {
       replacedUnit: error?.servicePlan?.action === 'adopt' ? error.servicePlan.unitPath : null,
     });
@@ -284,12 +304,12 @@ export async function runDaemonPhase(args, effects) {
       effects.out(recovery.recovered
         ? ok('your daemon is running again — nothing was committed, and the service is unchanged')
         : warn('and the daemon did NOT come back up — start it yourself before anything else: '
-          + `ours daemon start --config ${configPath}`));
+          + `OURS_CONFIG=${configPath} ours-mcp start`));
     }
     throw error;
   }
 
-  return { target, steps, serviceUnsupported };
+  return { target, steps };
 }
 
 /**
@@ -304,10 +324,10 @@ export async function runDaemonPhase(args, effects) {
  * is REPORTED, never thrown: the caller is already carrying the real error, and
  * losing it to a second one would hide what actually went wrong.
  */
-async function recoverDaemon(args, effects, dir, configPath) {
+async function recoverDaemon(args, effects, dir, configPath, port) {
   if (args.dryRun) return null;
   try {
-    await effects.run('ours', ['daemon', 'start', '--config', configPath]);
+    await effects.run('ours-mcp', ['start'], { env: daemonEnv(dir, port) });
     return { recovered: true };
   } catch (recoveryError) {
     return { recovered: false, reason: reason(recoveryError) };
@@ -350,20 +370,8 @@ function rollBack(effects, journal, args, why, { packagesInstalled = true, repla
  * the file — the owner's decision. `--force` is passed ONLY here, only for a unit
  * positively identified as ours-mcp's, and never for one we cannot identify.
  */
-export async function runServicePhase(args, effects, dir) {
-  const plan = planServiceInstall({
-    stateDir: dir, home: effects.home, readText: effects.readText, platform: effects.platform?.platform,
-  });
-  // NOT a refusal and NOT a failure: the daemon is running and correct, and only
-  // the boot service could not be installed. So the run CONTINUES — but it says
-  // so, and the summary marks it, because the person this hurts is the one who
-  // reboots in a fortnight and finds nothing listening.
-  if (plan.action === 'unsupported') {
-    effects.out(warn(`ours: ${plan.message}`));
-    effects.out(info(`Your daemon is installed and running now. To start it after a reboot, run:  ${plan.manual.join(' ')} ${join(dir, 'config.json')}`));
-    effects.out(info('Nothing else in this run depends on the boot service.'));
-    return { step: { id: 'service', changed: false, reason: 'not available on this platform' }, plan, unsupported: plan };
-  }
+export async function runServicePhase(args, effects, dir, port) {
+  const plan = planServiceInstall({ stateDir: dir, home: effects.home, readText: effects.readText });
   if (plan.action === 'refuse') {
     effects.out(warn(`ours: refusing to continue — ${plan.message}`));
     return { refused: plan };
@@ -371,6 +379,14 @@ export async function runServicePhase(args, effects, dir) {
   const adopting = plan.action === 'adopt';
   if (adopting) effects.out(info(plan.notice));
   const command = serviceInstallCommand({ stateDir: dir, adoptLegacyUnit: adopting });
+  // The unit's bytes BEFORE, so "did it change?" survives the loss of --json.
+  // `ours daemon install-service --json` used to answer that itself; ours-mcp's
+  // takes no flags and reports nothing machine-readable. Assuming `changed: true`
+  // would make every re-run claim it rewrote the unit, which turns the honest
+  // "everything already correct" line into one that never appears — a screen that
+  // is wrong in the reassuring direction. So the installer does the comparison it
+  // used to delegate: it already reads this file to classify it.
+  const unitBefore = plan.unitPath ? effects.readText(plan.unitPath) : null;
   let outcome;
   try {
     outcome = await perform(effects, args.dryRun, `boot service ${plan.unit} installed and enabled`, () => effects.run(command[0], command.slice(1)));
@@ -382,11 +398,16 @@ export async function runServicePhase(args, effects, dir) {
     error.servicePlan = plan;
     throw error;
   }
-  // Whether the unit actually changed is the CLI's answer, not ours: it does the
-  // byte comparison and returns `changed` in its --json plan. Guessing here would
-  // let a run that rewrote a unit report "nothing changed". Unreadable output is
-  // treated as "changed", which is the safe direction for a summary line.
-  const changed = readChanged(outcome.stdout);
+  // Ours now, by the same byte comparison the CLI used to do. A dry run changed
+  // nothing by definition; an unreadable file either side is treated as "changed",
+  // which is the safe direction for a summary line.
+  const changed = args.dryRun
+    ? false
+    : (() => {
+      const after = plan.unitPath ? effects.readText(plan.unitPath) : null;
+      if (unitBefore === null || after === null) return true;
+      return unitBefore !== after;
+    })();
   return { step: { id: 'service', changed, reason: changed ? undefined : 'unit unchanged' }, plan };
 }
 
@@ -608,12 +629,6 @@ export function runPreflight(effects) {
     return { ok: false, platform: plat };
   }
   effects.out(ok(`Platform: ${plat.label} (supported)`));
-  // Supported is still true — the daemon runs here. What is NOT available is the
-  // boot service, and saying "supported" without that qualification is what let a
-  // Mac user walk into a run that could not finish.
-  if (effects.platform?.platform && effects.platform.platform !== 'linux') {
-    effects.out(info(`On ${plat.label} the daemon runs, but installing a BOOT SERVICE is not available yet — you will start it yourself after a reboot.`));
-  }
   const version = String(effects.nodeVersion ?? '0');
   if (Number.parseInt(version.split('.')[0], 10) < 20) {
     effects.out(warn(`Node.js ${version} — ours needs v20 or newer. Update Node and re-run.`));
@@ -651,6 +666,19 @@ export async function runIdentityPhase(args, effects, { target, mcpReady }) {
     effects.out(info(wouldPrefix(`ours-mcp create-root "${name}"`)));
     return { key: 'identity', label: 'Human identity', state: 'installed', note: name };
   }
+  // `ours-mcp create-root` — and it works BECAUSE the daemon is ours-mcp.
+  //
+  // It opens an MCP streamable-HTTP session to http://127.0.0.1:<port>/mcp. A
+  // daemon started by `ours daemon serve` does not mount that route (the SDK
+  // serves /mcp only when an `mcp` option is supplied, and @ours.network/cli calls
+  // startDaemon() with no arguments), which is why this exact command returned the
+  // daemon's own 404 body — "Not found" — on the first real install. An ours-mcp
+  // daemon supplies that option (packages/core/src/serve.ts), so the route exists
+  // and the command succeeds.
+  //
+  // Calling the SDK CLI's `ours identity create-root` instead would work too, over
+  // /api/v1/ — but it would mean installing and driving a second client purely to
+  // create an identity, on a daemon that already speaks the first one.
   try {
     const result = await effects.run('ours-mcp', ['create-root', name], { env });
     const existing = String(result?.stdout ?? '').match(/already exists \("([^"]+)"\)/);
@@ -668,11 +696,16 @@ export async function runIdentityPhase(args, effects, { target, mcpReady }) {
     }
     if (/not running|not reachable|ECONNREFUSED|connect/i.test(text)) {
       effects.out(warn("The daemon isn't reachable yet — couldn't create your human identity."));
-      effects.out(info(`Fix: run 'ours daemon start --config ${env.OURS_CONFIG}', then 'ours-mcp create-root "${name}"'.`));
+      // The hint NAMES THIS DAEMON, and it has to keep doing that through the
+      // mechanism change. `ours daemon start` took --config; ours-mcp is selected
+      // by environment instead, so the pair travels as an env prefix rather than a
+      // flag. A retry command that omits it would start the DEFAULT daemon — which
+      // is how someone ends up with an identity on a daemon they did not choose.
+      effects.out(info(`Fix: run 'OURS_CONFIG=${env.OURS_CONFIG} ours-mcp start', then 'OURS_CONFIG=${env.OURS_CONFIG} ours-mcp create-root "${name}"'.`));
       return { key: 'identity', label: 'Human identity', state: 'failed', note: 'daemon not reachable' };
     }
     effects.out(warn(`Couldn't create your human identity: ${text.split('\n')[0]}`));
-    effects.out(info(`Retry any time: 'ours-mcp create-root "${name}"'.`));
+    effects.out(info(`Retry any time: 'OURS_CONFIG=${env.OURS_CONFIG} ours-mcp create-root "${name}"'.`));
     return { key: 'identity', label: 'Human identity', state: 'failed', note: 'create-root failed' };
   }
 }
@@ -1023,19 +1056,6 @@ export async function runInstall(argv, effects) {
     state: target.action === 'create' ? 'installed' : 'current',
     note: `port ${target.port}`,
   }];
-  // THE SKIP MUST NOT READ AS SUCCESS. A line that scrolls past is not a warning
-  // — the summary is where someone looks, so an uninstallable boot service gets
-  // the same "needs attention" mark a failed component gets. If this screen read
-  // clean on macOS we would have replaced a failed install with a quieter lie.
-  if (daemon.serviceUnsupported) {
-    summary.push({
-      key: 'service',
-      label: 'Boot service',
-      state: 'failed',
-      note: `not available on ${daemon.serviceUnsupported.platform === 'darwin' ? 'macOS' : daemon.serviceUnsupported.platform} yet — start the daemon yourself after a reboot`,
-    });
-  }
-
   const components = await runComponentPhase(args, effects, target);
   for (const component of COMPONENTS) {
     const state = components.installed.includes(component.key) ? 'installed'

package/lib/plan.mjs

@@ -130,19 +130,18 @@ export function planServiceInstall({ stateDir, home, readText, platform = 'linux
   // A real launchd adapter belongs in the SDK CLI, not here. Nothing in this
   // package can install a launchd agent, and pretending otherwise by writing a
   // plist ourselves would put a second service implementation in a second repo.
-  if (platform && platform !== 'linux') {
-    return {
-      action: 'unsupported',
-      platform,
-      reason: 'no-service-manager',
-      message: platform === 'darwin'
-        ? 'installing a boot service is not available on macOS yet — the ours CLI can only manage a Linux user systemd service'
-        : `installing a boot service is not available on ${platform} — the ours CLI can only manage a Linux user systemd service`,
-      // What the operator can do INSTEAD, which is the difference between a gap
-      // and a dead end.
-      manual: ['ours', 'daemon', 'serve', '--config'],
-    };
-  }
+  // THE macOS SKIP IS GONE, AND THAT IS A CONSEQUENCE OF THE DAEMON CHANGE.
+  //
+  // It existed because `ours daemon install-service` refuses on any non-linux
+  // platform — createLinuxUserSystemdAdapter() throws on its first line, and the
+  // whole @ours.network/cli package contains no launchd support. That was true and
+  // is no longer the relevant question: the unit is now installed by ours-mcp's
+  // own install-service, which handles systemd AND launchd
+  // (packages/core/src/cli.ts writes ~/Library/LaunchAgents and runs launchctl
+  // bootstrap). So macOS gets a real boot service rather than a named gap.
+  //
+  // A gap list that warns about something already fixed is as misleading as one
+  // that hides something broken, which is why the warning goes with the skip.
   const derived = unitPathForStateDir(stateDir, home);
   if (!derived.ok) {
     return { action: 'refuse', exitCode: 2, reason: 'unusable-state-dir', message: derived.reason };
@@ -212,12 +211,35 @@ export function serviceInstallCommand({ stateDir, adoptLegacyUnit = false }) {
   // --json so the caller can read back whether the unit actually CHANGED. The
   // CLI owns that byte-comparison, and an installer that guessed at it would
   // report "nothing changed" on a run that rewrote a unit.
-  const cmd = ['ours', 'daemon', 'install-service', '--yes', '--json', '--state-dir', dir, '--config', join(dir, 'config.json')];
-  // --force is reachable ONLY through this explicit argument, which the
-  // orchestrator passes only after the user answered yes to legacyReplacePrompt.
-  // It is never a default and never appears in a plan.
-  if (adoptLegacyUnit) cmd.push('--force');
-  return cmd;
+  // ours-mcp's install-service, NOT the SDK CLI's, and the difference is not
+  // cosmetic. `ours daemon install-service` writes a unit whose ExecStart runs
+  // `ours daemon serve` — a daemon that does not mount /mcp — so the boot service
+  // would resurrect exactly the daemon the /mcp 404 came from. ours-mcp's writes
+  // ExecStart=<node> <ours-mcp> serve (packages/core/src/service-instance.ts:106),
+  // and it handles launchd as well as systemd.
+  //
+  // It takes no arguments: like `start`, it is selected by OURS_CONFIG /
+  // OURS_PORT / OURS_STATE_DIR, and it BAKES those resolved values into the unit.
+  // The caller passes the pair as an environment, which is why this returns a bare
+  // command and the orchestrator supplies daemonEnv.
+  //
+  // WHAT IS LOST, stated rather than discovered later. ours-mcp's install-service
+  // takes NO flags:
+  //
+  //   · no --json, so the caller cannot read back whether the unit actually
+  //     changed. `changed` is now assumed true, which is the safe direction for a
+  //     summary line but is an assumption where it used to be an answer.
+  //   · no --force, and no marker check either: it writes the unit file
+  //     unconditionally. The SDK CLI refused to overwrite a unit it had not
+  //     marked, and that refusal was the backstop behind classifyUnit. It is gone.
+  //     classifyUnit's `foreign` refusal is now the ONLY thing standing between a
+  //     stranger's unit file and an overwrite, so `adoptLegacyUnit` no longer
+  //     changes the COMMAND — it records that the caller already decided, and the
+  //     decision is enforced entirely by refusing to get here at all.
+  //
+  // That is a real reduction in defence in depth and it belongs in the PR, not in
+  // a comment nobody reads.
+  return ['ours-mcp', 'install-service'];
 }
 
 // -----------------------------------------------------------------------------

package/lib/target.mjs

@@ -31,6 +31,33 @@ export const INSTALL_RESERVED_PORTS = [3051, 3052];
 // The CLI-owned PID record that proves a daemon belongs to a state directory
 // even when nothing is recorded in its config (spec §1).
 export const CLI_PID_RECORD = 'ours-cli-daemon.json';
+// The SAME record, written by a different daemon. `ours daemon start` writes
+// ours-cli-daemon.json; `ours-mcp start` writes daemon.pid (packages/core
+// cli.ts PID_PATH). BOTH are read, and neither replaces the other: a machine
+// installed yesterday has the first and a machine installed today has the
+// second, and detection that goes blind on either one concludes "no daemon
+// here" and creates a SECOND daemon on a state directory that already has one.
+// Two writers on one state_data.bin is the corruption case this lookup exists
+// to prevent, so the lookup has to know both spellings.
+export const MCP_PID_RECORD = 'daemon.pid';
+export const PID_RECORDS = [CLI_PID_RECORD, MCP_PID_RECORD];
+
+/**
+ * The port a PID record names, whichever daemon wrote it.
+ *
+ * ours-cli-daemon.json is JSON with a `port`. daemon.pid is a bare pid — no
+ * port — so it proves a daemon EXISTS for this state directory without saying
+ * where. That distinction is the whole reason this returns both fields.
+ */
+export function readPidRecords(target, readJson, readText) {
+  const record = readJson(join(target, CLI_PID_RECORD));
+  const port = record && typeof record.port === 'number' && Number.isFinite(record.port) ? record.port : null;
+  const rawPid = typeof readText === 'function' ? readText(join(target, MCP_PID_RECORD)) : null;
+  const pid = rawPid !== null && rawPid !== undefined && /^\s*\d+\s*$/.test(String(rawPid))
+    ? Number.parseInt(String(rawPid).trim(), 10)
+    : null;
+  return { port, pid };
+}
 export const DAEMON_CONFIG = 'config.json';
 
 export class InstallUsageError extends Error {
@@ -192,7 +219,7 @@ export function classifyProbe(probe, targetStateDir) {
  * is still no I/O here, and `await` on a non-promise is the same value back, so
  * every existing fake keeps working unchanged.
  */
-export async function findDaemon({ stateDir, probe, readJson }) {
+export async function findDaemon({ stateDir, probe, readJson, readText }) {
   const target = resolve(stateDir);
   const config = readJson(join(target, DAEMON_CONFIG));
   const recordedPort = config && typeof config.port === 'number' && Number.isFinite(config.port) ? config.port : null;
@@ -204,8 +231,8 @@ export async function findDaemon({ stateDir, probe, readJson }) {
   if (byConfig.kind === 'present') return { ...byConfig, port: first, via: 'config', config };
   if (byConfig.kind === 'foreign' && !guessed) return { ...byConfig, port: first, via: 'config', config };
 
-  const record = readJson(join(target, CLI_PID_RECORD));
-  const recorded = record && typeof record.port === 'number' && Number.isFinite(record.port) ? record.port : null;
+  const records = readPidRecords(target, readJson, readText);
+  const recorded = records.port;
   if (recorded !== null && recorded !== first) {
     const byRecord = classifyProbe(await probe(recorded), target);
     if (byRecord.kind === 'present') return { ...byRecord, port: recorded, via: 'pid-record', config };
@@ -229,6 +256,12 @@ export async function findDaemon({ stateDir, probe, readJson }) {
   // daemon owns THIS directory. A foreign answer on a port the directory
   // actually RECORDED still refuses, because there the operator's own file said
   // the daemon was there and something else is.
+  // A bare pid record with no port still says a daemon OWNS this directory. It
+  // cannot say where, so this is not "present" — but it is a reason to report a
+  // stale record rather than silently create a second daemon beside it.
+  if (records.pid !== null && byConfig.kind !== 'present') {
+    return { kind: 'absent', reason: 'a daemon pid record exists but nothing answers', stalePidRecord: first, port: first, via: 'config', config };
+  }
   if (byConfig.kind === 'foreign') {
     return {
       kind: 'absent',
@@ -265,9 +298,9 @@ export async function findDaemon({ stateDir, probe, readJson }) {
  * if it is occupied that is a refusal, not a reason to shift. Only a derived port
  * is searched, from 3050 upward, skipping the reserved defaults.
  */
-export async function resolveTarget({ stateDir, port = null, portExplicit = false, probe, readJson, isTaken }) {
+export async function resolveTarget({ stateDir, port = null, portExplicit = false, probe, readJson, readText, isTaken }) {
   const target = resolve(stateDir);
-  const found = await findDaemon({ stateDir: target, probe, readJson });
+  const found = await findDaemon({ stateDir: target, probe, readJson, readText });
 
   if (found.kind === 'foreign') {
     return {

package/lib/uninstall.mjs

@@ -168,37 +168,27 @@ export function planComponentDetach(key, existing) {
  * case the screen names the external launcher and the run CONTINUES — a daemon
  * someone else supervises is not a failure of this uninstall.
  */
-export function planDaemonRemoval({ stateDir, cliStartedIt, platform = 'linux' }) {
+export function planDaemonRemoval({ stateDir, cliStartedIt }) {
   const dir = resolve(stateDir);
   const unit = unitNameForStateDir(dir);
-  // THE MIRROR OF THE INSTALL SIDE, and half a fix here would be worse than none:
-  // a Mac user who installed successfully and then cannot UNINSTALL is stuck with
-  // something they were told worked.
+  // ours-mcp's own uninstall-service, for the same reason install-service is:
+  // the unit that exists was written by ours-mcp, and `ours daemon
+  // uninstall-service` refuses a unit it did not mark. It takes no flags and is
+  // selected by the environment, like every other ours-mcp lifecycle command.
   //
-  // `ours daemon uninstall-service` goes through the same
-  // createLinuxUserSystemdAdapter() that throws on the first line for any
-  // non-linux platform, so calling it on darwin fails the run rather than
-  // degrading it. There is also nothing there to remove: this package could never
-  // have installed a launchd agent in the first place.
-  const service = platform && platform !== 'linux'
-    ? {
-      id: 'service-unsupported',
-      unit: null,
-      command: null,
-      platform,
-      continues: true,
-      note: `no boot service was installed on ${platform === 'darwin' ? 'macOS' : platform} — the ours CLI can only manage a Linux user systemd service, so there is nothing of ours to remove here`,
-    }
-    : {
-      id: 'service',
-      unit: unit.ok ? unit.unit : null,
-      command: ['ours', 'daemon', 'uninstall-service', '--yes', '--state-dir', dir],
-      note: 'refuses a unit not marked as CLI-managed',
-    };
+  // The macOS skip that briefly lived here is gone with the daemon change:
+  // ours-mcp's uninstall-service handles launchd as well as systemd, so there is
+  // no platform on which this declines to try.
+  const service = {
+    id: 'service',
+    unit: unit.ok ? unit.unit : null,
+    command: ['ours-mcp', 'uninstall-service'],
+    note: 'removes the unit ours-mcp installed',
+  };
   return [
     service,
     cliStartedIt
-      ? { id: 'stop', command: ['ours', 'daemon', 'stop', '--config', join(dir, 'config.json')] }
+      ? { id: 'stop', command: ['ours-mcp', 'stop'] }
       : { id: 'stop-external', command: null, continues: true, note: 'this daemon was not started by the CLI; naming its launcher and continuing' },
   ];
 }
@@ -531,7 +521,7 @@ export function planUninstall({ home, env = {}, endpoint, stateDir, purge = fals
     action: 'uninstall',
     stateDir: dir,
     detach: pointing.map((p) => ({ key: p.key, service: [`ours-${p.key === 'tg' ? 'tg-connector' : 'cowork'}`, 'uninstall-service'] })),
-    daemon: planDaemonRemoval({ stateDir: dir, cliStartedIt, platform }),
+    daemon: planDaemonRemoval({ stateDir: dir, cliStartedIt }),
     state: planStatePurge({ stateDir: dir, purge, assumeYes, exists, typedConfirmation }),
     plugins,
     packages: planGlobalPackages({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "0.17.0-nightly.12",
+  "version": "0.17.0-nightly.13",
   "private": false,
   "description": "The unified ours.network stack installer (ours-install): one guided ~3-minute flow for ours core (the daemon) + the harness plugins (Claude Code / Codex) + ours-fleet + the Telegram connector, then a single copy-paste hand-off prompt. Self-contained (Node built-ins only); run as `ours-install` or via curl|bash (install.sh).",
   "type": "module",