@ours.network/install 0.17.0-nightly.3 → 0.17.0-nightly.5

package/README.md

@@ -87,6 +87,56 @@ The human identity is created idempotently after the daemon becomes reachable. B
 `curl … | bash` gives the script its input over the pipe, every prompt is read from the
 controlling terminal (`/dev/tty`), so the flow still works piped.
 
+## Nightly-only profile flow
+
+The `nightly` channel uses a topology-first flow. This is a hard release boundary: `latest`
+keeps the five-step behavior, prompts, package tags, files, service names, and uninstall output
+described above and never reads the profile registry.
+
+Nightly first discovers only configured local candidates: the registry, the historical default
+config, known `~/.ours-tg` / `~/.ours-rooms` configs, Telegram and Rooms daemon blocks, known ours
+systemd/launchd definitions, and an exact manual entry. It never scans a port range. Hosts are
+limited to `localhost` / `127.0.0.1` (stored as `127.0.0.1`); remote names, URLs, credentials,
+`0.0.0.0`, IPv6 loopback, and HTTPS are rejected. A candidate is deduplicated only when both its
+endpoint and canonical state directory agree. Port, state, service, or config collisions stop the
+plan before mutation.
+
+The durable registry is `~/.ours/installer-profiles.json` (schema v1, atomic mode `0600`):
+
+```json
+{
+  "version": 1,
+  "profiles": {
+    "default": {
+      "label": "Default ours daemon",
+      "host": "127.0.0.1",
+      "port": 3050,
+      "configPath": "/home/me/.ours/config.json",
+      "stateDir": "/home/me/.ours",
+      "serviceName": "",
+      "ownership": { "config": true, "service": true, "state": true }
+    }
+  },
+  "harnessAssociations": { "codex": "default" }
+}
+```
+
+It stores topology and explicit installer ownership only—never tokens, token sources, status,
+PIDs, versions, or running state. `OURS_INSTALL_PROFILES` is a test/operator override. Telegram
+and Rooms remain authoritative in their own configs; their associations are reverse-indexed from
+those real daemon blocks rather than copied into the registry.
+
+After selecting or creating one profile, Nightly selects Claude Code, Codex/`ours-codex`, Hermes,
+Telegram, and Rooms for that exact daemon, shows one review, and confirms once. A harness already
+associated elsewhere requires explicit reassignment. The global `@ours.network/mcp@nightly`
+package is installed/updated at most once; only the selected installer-owned daemon is restarted.
+Snapshotted connector/registry config bytes roll back if validation or service apply fails. Npm changes and
+new identity state are intentionally not destroyed during rollback.
+
+`OURS_ASSUME_YES=1` selects or creates only the historical `3050` / `~/.ours` default, preserves
+existing harness assignments, assigns otherwise-unassociated detected harnesses to it, keeps the
+current harness/fleet defaults, and skips Telegram and Rooms.
+
 ## Daemon topology
 
 A clean deployment installs, configures and starts **one shared** ours daemon first, then wires
@@ -244,6 +294,17 @@ directory (`~/.ours`), and the `ours-mcp` daemon. It removes **only** what the i
 created, and guards the two destructive items — the data directory and the daemon — behind
 an explicit typed `yes`.
 
+On Nightly, uninstall is profile-aware. Removing a harness removes only its one association and
+managed plugin artifacts. A daemon/profile cannot be forgotten or removed while any harness,
+Telegram, or Rooms still depends on it. A dependent connector can be explicitly detached (stop its
+service and remove only its daemon target), uninstalled, or reassigned to a different retained
+profile; connector secrets and unrelated settings are preserved. These connector changes roll back
+if exact daemon removal or the registry commit fails. Only a profile with `ownership.service: true`
+may have its exact named service uninstalled; external profiles are forgotten as metadata only.
+Data removal is a separate confirmation that requires typing the exact state path and explicitly
+warns about identity/key loss. The global MCP package is retained while any profile/application
+still needs it.
+
 Headless (no terminal), drive it with environment variables:
 
 ```sh
@@ -258,6 +319,10 @@ OURS_UNINSTALL_DAEMON=yes \
 | `OURS_UNINSTALL` | harnesses to remove (space/comma list of `claude-code codex hermes`, or `all`) |
 | `OURS_UNINSTALL_DATA` | `yes` — remove the ours data directory (`~/.ours`) |
 | `OURS_UNINSTALL_DAEMON` | `yes` — remove the `ours-mcp` daemon |
+| `OURS_UNINSTALL_PROFILE` | Nightly profile id to forget/remove |
+| `OURS_UNINSTALL_FORGET_PROFILE` | Nightly `yes` — forget external/profile metadata only |
+| `OURS_UNINSTALL_TELEGRAM` | Nightly dependency action: `detach`, `uninstall`, or `reassign:<profile-id>` |
+| `OURS_UNINSTALL_ROOMS` | Nightly dependency action: `detach`, `uninstall`, or `reassign:<profile-id>` |
 
 ## Notes
 

package/install.mjs

@@ -40,6 +40,7 @@ import {
   coworkSupportsExternalDaemon, COWORK_EXTERNAL_MIN_VERSION,
 } from './lib/logic.mjs';
 import { atomicWriteConfig } from './lib/config.mjs';
+import { runNightlyInstaller } from './lib/nightly-install.mjs';
 
 const NPM = process.env.OURS_NPM || 'npm';
 // Release channel: OURS_CHANNEL=nightly installs each package's PRERELEASE dist-tag —
@@ -102,13 +103,23 @@ async function actSpin(label, desc, fn) {
 
 // --- daemon probes (always safe to run — read-only) --------------------------------------------
 const daemonVersionLine = () => (run('ours-mcp', ['--version'], { capture: true }).out.split('\n')[0] || '').trim();
-const daemonStatusText = () => run('ours-mcp', ['status'], { capture: true }).out;
+const daemonStatusText = (env) => run('ours-mcp', ['status'], { capture: true, ...(env ? { env } : {}) }).out;
 function daemonLifecycleState() {
   const status = run('ours-mcp', ['status'], { capture: true });
   if (!status.ok) return 'stopped';
   return /^\s*pid:\s*\d+/m.test(status.out) ? 'managed' : 'external';
 }
 const daemonRunning = () => daemonLifecycleState() !== 'stopped';
+// LISTENING, not merely alive — and the difference is not academic. `ours-mcp start`
+// exits 0 when it only FINDS a live pid in the state directory (core cmdStart: it
+// checks `isAlive(pid)` and nothing else, so a pid file left by a previous boot whose
+// number now belongs to any other process reads as "already running"). `ours-mcp
+// status` then exits 0 for that same pid while printing "(port not answering!)" —
+// core cmdStatus only sets a non-zero exit for the no-pid case. So neither exit code
+// proves a daemon is there, and a readiness line built from one can tell the user
+// "ready — no problems" about a port nothing is bound to. The status line the daemon
+// prints only when the port actually answered is the honest signal, so use it.
+const daemonReachable = (env) => /\(reachable\)/.test(daemonStatusText(env));
 // The installed version of a global package, INCLUDING any prerelease suffix. The
 // suffix is not cosmetic here: the Rooms daemon guard compares against an exact
 // `0.4.1-nightly.<date>.<sha>` floor, and truncating at the dash would make every
@@ -306,6 +317,16 @@ async function main() {
     finish(ttyFd); return;
   }
 
+  // HARD RELEASE BOUNDARY. Nightly owns the topology-first profile flow. The
+  // latest/stable consumer-first implementation below remains untouched and
+  // never reads or writes installer-profiles.json or emits --application.
+  if (CHANNEL === 'nightly') {
+    return runNightlyInstaller({
+      harnesses, ttyFd, interactive, write, yes, ask, cont, dry: DRY,
+      npm: NPM, run, runAsync, act, actSpin, finish,
+    });
+  }
+
   // Daemon state up front (decides first-install vs update, and whether Step 0 runs at all).
   const versionBefore = daemonVersionLine();
   const daemonInstalled = !!versionBefore;
@@ -511,13 +532,13 @@ async function main() {
     // WORKING daemon into no daemon at all, while the line below still said "ready": the
     // human identity and every MCP client then fail against a port nothing is listening
     // on. Put the one shared daemon back up and report what is actually true.
-    let running = started.ok;
-    if (!DRY && !svc.ok) {
-      running = daemonRunning();
-      if (!running) {
-        line(info('the boot-service step stopped the daemon before it failed — restarting it.'));
-        running = run('ours-mcp', ['start']).ok || daemonRunning();
-      }
+    // `started.ok` is the exit code of `ours-mcp start`, which is not evidence that
+    // anything is listening (see daemonReachable). Ask the daemon instead.
+    let running = DRY ? started.ok : daemonReachable();
+    if (!DRY && !svc.ok && !running) {
+      line(info('the boot-service step stopped the daemon before it failed — restarting it.'));
+      run('ours-mcp', ['start']);
+      running = daemonReachable();
     }
     if (running) line(ok(`ours core ready — running on port ${chosenPort}. No problems.`));
     else line(warn(`could not auto-start — run '${c.cyan('ours-mcp start')}' to bring it up.`));
@@ -598,9 +619,11 @@ async function main() {
       line(ok(`Your human identity "${name}" is created.`));
       record({ key: 'identity', label: 'Human identity', state: 'installed', note: name });
     } else {
-      // A freshly-started daemon may need a moment to bind its port before create-root can reach it.
-      let reachable = daemonRunning();
-      for (let i = 0; i < 6 && !reachable; i++) { sleepMs(400); reachable = daemonRunning(); }
+      // A freshly-started daemon may need a moment to BIND ITS PORT before create-root
+      // can reach it — which is the one thing a liveness check cannot see, so this
+      // waits on the port answering rather than on a process existing.
+      let reachable = daemonReachable();
+      for (let i = 0; i < 6 && !reachable; i++) { sleepMs(400); reachable = daemonReachable(); }
       const r = reachable ? run('ours-mcp', ['create-root', name], { capture: true }) : { ok: false, out: '', err: 'daemon not running' };
       const outText = `${r.out} ${r.err}`;
       const existing = outText.match(/already exists \("([^"]+)"\)/);
@@ -704,7 +727,12 @@ async function main() {
   line(info('over Telegram so they talk to each other — and it all configures maximally easily.'));
   const goFleet = yes('  Install it?', true);
   if (goFleet) {
-    // ours-fleet is ALWAYS @latest — it has no nightly tag (pkgSpec pins it even under OURS_CHANNEL=nightly).
+    // ours-fleet FOLLOWS the channel, like everything else here: it publishes its own
+    // nightly dist-tag from adapt-toolkit/ours-fleet, and lib/logic.mjs maps it
+    // accordingly. (This comment used to claim the opposite — that fleet had no nightly
+    // tag and was pinned to @latest even under OURS_CHANNEL=nightly — which stopped
+    // being true when the map gained its `fleet` entry. The code always followed the
+    // map; only the comment was stale, which is the more dangerous of the two.)
     await actSpin(`installing ${spec('fleet')}…`, `npm i -g ${spec('fleet')}`, () => runAsync(NPM, ['i', '-g', spec('fleet')]));
     const init = await act('ours-fleet init (one-time host setup: units, dirs, linger)', async () => run('ours-fleet', ['init']));
     if (!init.ok) line(warn(`ours-fleet host setup didn't finish — retry '${c.cyan('ours-fleet init')}'.`));
@@ -753,7 +781,7 @@ async function main() {
       // Nothing to change AND it is already up: do not touch it. `install-service` STOPS
       // the daemon before rewriting the unit, so re-running it here would bounce a healthy
       // daemon for no reason.
-      if (!DRY && run('ours-mcp', ['status'], { capture: true, env }).ok) {
+      if (!DRY && daemonReachable(env)) {
         line(ok(`Dedicated ${label} daemon already running on port ${port} — left alone.`));
         return { endpoint: daemonEndpoint(port), stateDir, serviceName, configPath: cfgPath, running: true, port };
       }
@@ -767,12 +795,13 @@ async function main() {
     const svc = await act(`ours-mcp install-service (dedicated ${label} daemon, unit ours-${serviceName})`, async () => run('ours-mcp', ['install-service'], { env }));
     // Same recovery as the shared daemon: install-service STOPS the daemon before it
     // writes the unit, so a failure there leaves nothing listening on this port.
-    let running = started.ok;
+    // Same rule as the shared daemon: an exit code is not evidence of a bound port.
+    let running = DRY ? started.ok : daemonReachable(env);
     if (!DRY && !svc.ok) {
-      running = run('ours-mcp', ['status'], { capture: true, env }).ok;
       if (!running) {
         line(info(`the boot-service step stopped the ${label} daemon before it failed — restarting it.`));
-        running = run('ours-mcp', ['start'], { env }).ok;
+        run('ours-mcp', ['start'], { env });
+        running = daemonReachable(env);
       }
       line(warn(`the ${label} daemon has no boot service — retry '${c.cyan(`OURS_CONFIG=${cfgPath} OURS_SERVICE_NAME=${serviceName} ours-mcp install-service`)}'.`));
     }