@ours.network/install 0.17.0-nightly.8 → 0.17.0-nightly.9

package/install.mjs

@@ -40,7 +40,8 @@ import {
   coworkSupportsExternalDaemon, COWORK_EXTERNAL_MIN_VERSION,
 } from './lib/logic.mjs';
 import { atomicWriteConfig } from './lib/config.mjs';
-import { runNightlyInstaller } from './lib/nightly-install.mjs';
+import { realEffects } from './lib/effects.mjs';
+import { runInstall as runInstallV3 } from './lib/orchestrate.mjs';
 
 const NPM = process.env.OURS_NPM || 'npm';
 // Release channel: OURS_CHANNEL=nightly installs each package's PRERELEASE dist-tag —
@@ -239,6 +240,28 @@ Env: OURS_ASSUME_YES=1 (accept defaults, no prompts) · OURS_INSTALL_DRY_RUN=1
 // ===============================================================================================
 async function main() {
   const argv = process.argv.slice(2);
+
+  // ─── THE CHANNEL FORK ───────────────────────────────────────────────────────
+  // Nightly is the v3 installer, end to end. Owner ruling 2026-08-17: v3 SUBSUMES
+  // the nightly flow rather than being hosted by it, so this hands the whole run
+  // over — arguments, screens, refusals and exit code — and never returns.
+  //
+  // FIRST IN main(), BEFORE --help/--version, ON PURPOSE. Those used to be
+  // answered by the v2 body above, which would have printed v2's usage describing
+  // v2's flags for a run that is about to be v3's. Whatever prints the help must
+  // be whatever runs.
+  //
+  // The latest/stable body below is untouched and still serves that channel byte
+  // for byte; nothing a stable user does changes.
+  if (CHANNEL === 'nightly') {
+    const ttyFd = openTty();
+    const code = await runInstallV3(argv, realEffects({
+      write: makeWriter(ttyFd), ttyFd, env: process.env, version: pkgVersion(),
+    }));
+    finish(ttyFd);
+    process.exit(code);
+  }
+
   if (argv.includes('--help') || argv.includes('-h')) { process.stdout.write(USAGE + '\n'); return; }
   if (argv.includes('--version') || argv.includes('-V')) { process.stdout.write(`ours-install v${pkgVersion()}\n`); return; }
   if (argv.includes('--dry-run')) DRY = true;
@@ -317,16 +340,6 @@ async function main() {
     finish(ttyFd); return;
   }
 
-  // HARD RELEASE BOUNDARY. Nightly owns the topology-first profile flow. The
-  // latest/stable consumer-first implementation below remains untouched and
-  // never reads or writes installer-profiles.json or emits --application.
-  if (CHANNEL === 'nightly') {
-    return runNightlyInstaller({
-      harnesses, ttyFd, interactive, write, yes, ask, cont, dry: DRY,
-      npm: NPM, run, runAsync, act, actSpin, finish,
-    });
-  }
-
   // Daemon state up front (decides first-install vs update, and whether Step 0 runs at all).
   const versionBefore = daemonVersionLine();
   const daemonInstalled = !!versionBefore;

package/lib/components.mjs

@@ -248,7 +248,48 @@ export function atLeastVersion(actual, floor) {
  * alone; only `daemon.stateDir` is the ours daemon's. Confusing the two fails
  * closed at boot, which is why they are never touched in the same write.
  */
-export function planCoworkAttachment({ existing, endpoint, stateDir, installedVersion, channel = 'latest' }) {
+/**
+ * cowork's own defaults, seeded ONLY into a config that does not have them.
+ *
+ * WHY THIS IS NOT "CONFIGURING SOMEBODY ELSE'S TOOL". On a first install cowork's
+ * config file does not exist, so v3 wrote it with a `daemon` block and nothing
+ * else — no version, no broker, no REST port. The nightly installer seeds all
+ * three (`planCoworkConfig`, lib/logic.mjs), and the broker in particular is a
+ * value the INSTALLER knows and cowork cannot guess: it is the one the operator
+ * chose in this run, and a cowork pointed at a different broker cannot reach the
+ * agents it was installed to talk to.
+ *
+ * SEEDED ONLY INTO A FILE THAT DOES NOT EXIST YET. An existing cowork config is
+ * copied through untouched — every key, including ones we would have defaulted.
+ * That line is deliberate and narrower than "write any key that is absent": a
+ * config the operator already has is theirs, and adding keys to it on a re-run
+ * would rewrite a file for no reason the operator asked for. A file this run is
+ * CREATING is a different thing, and it is the only case seeded here.
+ *
+ * NOT VERIFIED, and stated rather than assumed: whether cowork boots happily on a
+ * daemon block alone. Its own defaults may well cover all three. Seeding what the
+ * installer already knows is the safe direction either way, and it is what the
+ * flow being replaced does.
+ */
+export const COWORK_DEFAULT_REST_PORT = 3052;
+
+export function seedCoworkDefaults(base, { brokerUrl, home }) {
+  const seeded = { ...base };
+  const added = [];
+  if (seeded.version === undefined) { seeded.version = 1; added.push('version'); }
+  if (typeof seeded.brokerUrl !== 'string' && brokerUrl) { seeded.brokerUrl = brokerUrl; added.push('brokerUrl'); }
+  // cowork's OWN state directory, never the daemon's. Confusing the two fails
+  // closed at boot, which is why they are never written in the same expression.
+  if (typeof seeded.stateDir !== 'string' && home) { seeded.stateDir = join(home, '.ours-cowork'); added.push('stateDir'); }
+  const rest = seeded.rest && typeof seeded.rest === 'object' && !Array.isArray(seeded.rest) ? seeded.rest : null;
+  if (!rest || !Number.isInteger(rest.port)) {
+    seeded.rest = { enabled: rest?.enabled ?? true, ...(rest ?? {}), port: rest?.port ?? COWORK_DEFAULT_REST_PORT };
+    added.push('rest.port');
+  }
+  return { config: seeded, added };
+}
+
+export function planCoworkAttachment({ existing, endpoint, stateDir, installedVersion, channel = 'latest', brokerUrl, home }) {
   const dir = resolve(stateDir);
   if (!endpoint || !stateDir) {
     return { key: 'cowork', action: 'refuse', reason: 'half-formed-block', message: 'a cowork daemon block needs both an endpoint and a state directory; refusing to write half of one' };
@@ -264,18 +305,28 @@ export function planCoworkAttachment({ existing, endpoint, stateDir, installedVe
   }
   const base = existing && typeof existing === 'object' && !Array.isArray(existing) ? existing : {};
   const daemon = { mode: 'external', endpoint, stateDir: dir };
-  const unchanged = base.daemon
+  const daemonUnchanged = base.daemon
     && base.daemon.mode === 'external'
     && base.daemon.endpoint === endpoint
     && typeof base.daemon.stateDir === 'string'
     && resolve(base.daemon.stateDir) === dir;
+  // Seeded only where the key is ABSENT, so an existing config is still copied
+  // through untouched — which was already the right behaviour and is not changed.
+  const creating = existing === null || existing === undefined;
+  const { config: seeded, added } = creating
+    ? seedCoworkDefaults(base, { brokerUrl, home })
+    : { config: base, added: [] };
+  const unchanged = daemonUnchanged && added.length === 0;
   return {
     key: 'cowork',
     action: unchanged ? 'unchanged' : 'attach',
     install: ['npm', 'i', '-g', componentSpec(componentByKey('cowork'), channel)],
     changed: !unchanged,
-    // The top-level stateDir is cowork's own; it is copied through untouched.
-    config: { ...base, daemon },
+    seeded: added,
+    // The top-level stateDir is cowork's own; an existing one is copied through
+    // untouched and only an ABSENT one is seeded. Confusing it with the daemon's
+    // fails closed at boot, which is why they are never written together.
+    config: { ...seeded, daemon },
     service: ['ours-cowork', 'install-service'],
   };
 }

package/lib/detect.mjs

@@ -0,0 +1,182 @@
+// ours-install v3 — which daemons are already on this machine, and which one this
+// run is for.
+//
+// OWNER RULING (C1, 2026-08-17), and the whole shape of this file follows from it:
+// never ask the user to TYPE a state directory or a port — that is what spec §2
+// forbids and it stands — but when several daemons are DETECTED, show them and let
+// the user pick. Selection from what was found is not prompting for a path.
+//
+// Pure, like target.mjs and plan.mjs: the caller injects the directory listing and
+// the file reads, so the whole decision is testable without a filesystem.
+//
+// DETECTION, NOT A REGISTRY. Coordinator ruling: build this from what is actually
+// on disk rather than from a persisted ~/.ours/installer-profiles.json. A stored
+// list is a second source of truth that goes stale against the daemons that really
+// exist, and staleness in exactly that file is how an installer ends up
+// confidently offering a daemon that is gone.
+
+import { basename, join, resolve } from 'node:path';
+
+// Artefacts ONLY a daemon writes. A directory carrying any of these is a daemon's
+// state directory, whatever else is in it.
+export const DAEMON_ARTEFACTS = ['daemon-token', 'ours-cli-daemon.json', 'root.json'];
+
+/**
+ * CONFIG.JSON IS THE ONE PIECE OF EVIDENCE THAT IS AMBIGUOUS, SO IT CANNOT BE THE
+ * TEST. This is the trap this function exists to avoid, and it is worth stating
+ * plainly because the obvious implementation walks straight into it:
+ *
+ * `~/.ours-telegram/config.json` and `~/.ours-cowork/config.json` both exist on a
+ * normal machine, both match a `~/.ours*` scan, and NEITHER is a daemon — they are
+ * the connectors' own configs. A selection screen built on "has a config.json"
+ * shows three daemons on a machine with one, and choosing the Telegram connector's
+ * directory would have the installer create a daemon inside it.
+ *
+ * So a config.json counts only when its SHAPE is a daemon's: it records a `port`
+ * or a `stateDir`, and it carries none of the keys that identify it as somebody
+ * else's. `daemonUrl`/`daemonStateDir` are the Telegram connector's; a `daemon`
+ * block is cowork's; `botToken` is the connector's too.
+ */
+export function looksLikeDaemonConfig(config) {
+  if (!config || typeof config !== 'object' || Array.isArray(config)) return false;
+  if (typeof config.daemonUrl === 'string' || typeof config.daemonStateDir === 'string') return false;
+  if (config.daemon !== undefined) return false;
+  if (typeof config.botToken === 'string') return false;
+  return typeof config.port === 'number' || typeof config.stateDir === 'string';
+}
+
+/**
+ * Is this directory a daemon's state directory? Returns the evidence, so a screen
+ * or a test can say WHY rather than just yes.
+ */
+export function classifyStateDir(dir, { exists, readJson }) {
+  const target = resolve(dir);
+  const artefact = DAEMON_ARTEFACTS.find((name) => exists(join(target, name)));
+  if (artefact) return { isDaemon: true, evidence: artefact, config: readJson(join(target, 'config.json')) };
+  const config = readJson(join(target, 'config.json'));
+  if (looksLikeDaemonConfig(config)) return { isDaemon: true, evidence: 'config.json', config };
+  return { isDaemon: false, evidence: null, config: null };
+}
+
+/**
+ * Every daemon state directory this machine can be seen to have.
+ *
+ * KNOWN LIMIT, inherited from effects.knownStateDirs and stated rather than
+ * implied: only `~/.ours` and its `~/.ours*` siblings are looked at. A state
+ * directory somewhere else entirely is not found, and the failure is that it is not
+ * offered — never that the wrong one is chosen, because `--state-dir` still names
+ * anything and overrides all of this.
+ */
+export function detectDaemons({ candidates = [], exists, readJson }) {
+  const found = [];
+  for (const dir of candidates) {
+    const target = resolve(dir);
+    if (found.some((d) => d.stateDir === target)) continue;
+    const verdict = classifyStateDir(target, { exists, readJson });
+    if (!verdict.isDaemon) continue;
+    found.push({
+      stateDir: target,
+      port: typeof verdict.config?.port === 'number' ? verdict.config.port : null,
+      evidence: verdict.evidence,
+      label: basename(target),
+    });
+  }
+  // Deterministic, and the default daemon first when it is one of them — it is the
+  // one an operator means by "my daemon".
+  return found.sort((a, b) => {
+    if (basename(a.stateDir) === '.ours') return -1;
+    if (basename(b.stateDir) === '.ours') return 1;
+    return a.stateDir.localeCompare(b.stateDir);
+  });
+}
+
+/**
+ * A state directory for a daemon this run would CREATE, derived and never typed.
+ *
+ * Spec §2 forbids asking for a path, and the C1 ruling did not change that — it
+ * added "pick from what was found". So "create a new one" has to derive somewhere
+ * to put it: `~/.ours` when free, else the first free `~/.ours-2`, `~/.ours-3`…
+ * An operator who wants a specific path still has `--state-dir`, which bypasses
+ * this screen entirely.
+ */
+export function deriveNewStateDir(home, taken = [], { limit = 64 } = {}) {
+  const used = new Set(taken.map((d) => resolve(d)));
+  const first = resolve(join(home, '.ours'));
+  if (!used.has(first)) return first;
+  for (let n = 2; n < limit; n += 1) {
+    const candidate = resolve(join(home, `.ours-${n}`));
+    if (!used.has(candidate)) return candidate;
+  }
+  return null;
+}
+
+export const SELECT_CREATE = '__create__';
+
+// The nightly flow kept a registry of daemon profiles here. v3 does not read it —
+// detection replaced it (coordinator ruling) — so anyone who used that flow has a
+// file describing daemons that nothing consults any more.
+//
+// It is NOT deleted. Quietly removing a file that describes someone's daemons is
+// not an installer's business, and the file is harmless. But leaving it looking
+// live is worse than saying it is not, so the run says so once.
+export const LEGACY_PROFILE_REGISTRY = 'installer-profiles.json';
+export const legacyRegistryPath = (home) => join(resolve(home), '.ours', LEGACY_PROFILE_REGISTRY);
+
+/**
+ * What this run should do about choosing a daemon (C1's five rules, in one place
+ * so they can be read together and tested without a terminal):
+ *
+ *   flags given          → no screen at all. `--state-dir` or `--port` is an
+ *                          explicit target and outranks anything detected.
+ *   non-interactive      → no screen. Flags only, and every existing refusal still
+ *                          applies — OURS_ASSUME_YES suppresses questions, never a
+ *                          refusal.
+ *   none detected        → create, exactly as before.
+ *   exactly one detected → no prompt, use it, and SAY which one. A question with
+ *                          one answer is not a choice, it is a keystroke tax.
+ *   several detected     → show them and pick, with "create a new one" as the last
+ *                          option.
+ */
+export function planDaemonSelection({
+  candidates = [],
+  stateDirExplicit = false,
+  portExplicit = false,
+  assumeYes = false,
+  home,
+} = {}) {
+  if (stateDirExplicit || portExplicit) {
+    return { action: 'flags', reason: stateDirExplicit ? '--state-dir names the target' : '--port names the target' };
+  }
+  if (assumeYes) return { action: 'flags', reason: 'non-interactive: flags only, no screen' };
+  if (candidates.length === 0) return { action: 'create', stateDir: deriveNewStateDir(home, []) };
+  if (candidates.length === 1) {
+    return { action: 'use', stateDir: candidates[0].stateDir, only: candidates[0], announce: true };
+  }
+  return {
+    action: 'choose',
+    candidates,
+    createOption: { id: SELECT_CREATE, stateDir: deriveNewStateDir(home, candidates.map((c) => c.stateDir)) },
+  };
+}
+
+/**
+ * Resolve a typed answer against the offered list.
+ *
+ * Deliberately strict: an answer that is not a number in range, or the create
+ * option, is NOT a state directory to be interpreted. Accepting free text here
+ * would be exactly the "type a path" prompt spec §2 forbids, arriving through the
+ * back door.
+ */
+export function resolveSelection(answer, { candidates = [], createOption = null } = {}) {
+  const value = String(answer ?? '').trim().toLowerCase();
+  if (!value) return { action: 'invalid', reason: 'no answer' };
+  if (value === 'n' || value === 'new' || value === String(candidates.length + 1)) {
+    return createOption?.stateDir
+      ? { action: 'create', stateDir: createOption.stateDir }
+      : { action: 'invalid', reason: 'no free state directory could be derived' };
+  }
+  if (!/^\d+$/.test(value)) return { action: 'invalid', reason: 'that is not one of the numbers offered' };
+  const index = Number(value) - 1;
+  if (!Number.isInteger(index) || !candidates[index]) return { action: 'invalid', reason: 'that is not one of the numbers offered' };
+  return { action: 'use', stateDir: candidates[index].stateDir };
+}

package/lib/extras.mjs

@@ -173,6 +173,49 @@ export function planHarnessPlugins({
   });
 }
 
+// -----------------------------------------------------------------------------
+// §5 — what the operator has to do BEFORE any of this works
+// -----------------------------------------------------------------------------
+
+/**
+ * The restart each harness needs before its new plugin is live.
+ *
+ * A CORRECTNESS PROBLEM WEARING A COSMETIC COSTUME. The ours MCP server is spawned
+ * BY the harness, once per session (`ours-mcp proxy` over stdio), so a harness that
+ * was already running when its plugin was installed has no ours tools and will not
+ * get them until it restarts. v3 said nothing at all about this: the screen read
+ * "Everything installed cleanly", the user went back to a running Claude Code,
+ * found no ours tools, and concluded the install had failed. The nightly installer
+ * prints these hints and v3 dropped them.
+ *
+ * Derived from what THIS RUN installed rather than from a registry — v3 already
+ * knows, and its own summary is a better source than a persisted file that can go
+ * stale against reality.
+ *
+ * The connectors are deliberately absent. The installer runs their
+ * `install-service` itself, so their new configuration is already applied; telling
+ * someone to restart something that was just restarted for them is noise, and noise
+ * in this list is what stops the real lines being read.
+ */
+export const HARNESS_RESTART = {
+  'claude-code': 'restart Claude Code',
+  codex: 'start a new Codex session (or `ours-codex`)',
+  hermes: 'run /reload-mcp in Hermes',
+};
+
+export function restartHints(summary = []) {
+  const live = (row) => row && (row.state === 'installed' || row.state === 'current');
+  const hints = [];
+  for (const [name, action] of Object.entries(HARNESS_RESTART)) {
+    const row = summary.find((r) => r.key === name);
+    if (live(row)) hints.push({ key: name, action });
+  }
+  // Nothing to restart if no harness got a plugin this run. The MCP server on its
+  // own changes nothing a running harness can see, so an "install the MCP server
+  // and restart everything" line would be advice with no reason behind it.
+  return hints;
+}
+
 // -----------------------------------------------------------------------------
 // ours-fleet — the one that needs zero code
 // -----------------------------------------------------------------------------

package/lib/nightly-install.mjs

@@ -1,3 +1,26 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// NO LONGER REACHED BY ANY CODE PATH, DELIBERATELY AND TEMPORARILY.
+//
+// The nightly channel now runs the v3 installer end to end (owner ruling
+// 2026-08-17: v3 SUBSUMES the nightly flow), so the two dispatch sites that led
+// here — install.mjs and uninstall.mjs — were removed. This file is retained on
+// purpose rather than deleted in the same commit.
+//
+// WHY IT IS STILL HERE. The behaviour inventory
+// (/home/fleet/work/dev1-installer-notes/NIGHTLY-BEHAVIOUR-INVENTORY.md) lists
+// what this flow does that v3 does not, and that list is not finished being
+// carried across. Deleting the implementation and its tests before the one-for-one
+// replacement exists is how a test that was covering something real gets removed
+// alongside the ones that were not. Its tests still run and still pass, because
+// they exercise this module directly.
+//
+// The retirement — removing this file and retiring each of its tests against a
+// named v3 equivalent — is its own piece of work. Until then this is ORPHANED AND
+// SAID SO, which is the opposite of the failure the staging existed to prevent:
+// seven commits of feature reachable by no code path, with git reporting no
+// conflict and nothing saying it had happened.
+// ─────────────────────────────────────────────────────────────────────────────
+
 import { existsSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
 import { homedir, userInfo } from 'node:os';
 import { join, resolve } from 'node:path';

package/lib/nightly-uninstall.mjs

@@ -1,3 +1,26 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// NO LONGER REACHED BY ANY CODE PATH, DELIBERATELY AND TEMPORARILY.
+//
+// The nightly channel now runs the v3 installer end to end (owner ruling
+// 2026-08-17: v3 SUBSUMES the nightly flow), so the two dispatch sites that led
+// here — install.mjs and uninstall.mjs — were removed. This file is retained on
+// purpose rather than deleted in the same commit.
+//
+// WHY IT IS STILL HERE. The behaviour inventory
+// (/home/fleet/work/dev1-installer-notes/NIGHTLY-BEHAVIOUR-INVENTORY.md) lists
+// what this flow does that v3 does not, and that list is not finished being
+// carried across. Deleting the implementation and its tests before the one-for-one
+// replacement exists is how a test that was covering something real gets removed
+// alongside the ones that were not. Its tests still run and still pass, because
+// they exercise this module directly.
+//
+// The retirement — removing this file and retiring each of its tests against a
+// named v3 equivalent — is its own piece of work. Until then this is ORPHANED AND
+// SAID SO, which is the opposite of the failure the staging existed to prevent:
+// seven commits of feature reachable by no code path, with git reporting no
+// conflict and nothing saying it had happened.
+// ─────────────────────────────────────────────────────────────────────────────
+
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';

package/lib/orchestrate.mjs

@@ -31,9 +31,10 @@ import {
   planComponentSelection, planMcpAttachment, planTgAttachment, planCoworkAttachment,
   tgConfigPath, coworkConfigPath, summarizeComponentRun, componentSpec,
 } from './components.mjs';
-import { planHarnessPlugins, planFleet, planVoice, buildHandoffPromptV3 } from './extras.mjs';
+import { planHarnessPlugins, planFleet, planVoice, buildHandoffPromptV3, restartHints } from './extras.mjs';
 import { summarizeRun } from './rerun.mjs';
 import { configJournal, reportRollback } from './journal.mjs';
+import { detectDaemons, planDaemonSelection, resolveSelection, legacyRegistryPath } from './detect.mjs';
 import { detectPlatform, resolveChannel, validateBroker } from './logic.mjs';
 import { daemonEnv } from './effects.mjs';
 import { USAGE } from './usage.mjs';
@@ -98,6 +99,72 @@ function pairFor(plan, target) {
     : undefined;
 }
 
+/**
+ * Which daemon is this run for? (C1, owner ruling 2026-08-17.)
+ *
+ * Never asks for a PATH — spec §2 stands — but when several daemons are DETECTED
+ * it shows them and lets the operator pick, because choosing from what was found
+ * is not prompting for a state directory.
+ *
+ * Runs BEFORE the daemon phase and only changes `args.stateDir`. Everything
+ * downstream — resolveTarget, the refusals, the journal — is untouched and does
+ * not know a screen happened, which is what keeps the flags path byte-identical.
+ */
+export async function runSelectionPhase(args, effects) {
+  // Said once, and only when the file is actually there: a file that looks live is
+  // worse than a file that says it is not. Never deleted — quietly removing
+  // something that describes an operator's daemons is not this installer's
+  // business.
+  const legacy = legacyRegistryPath(effects.home);
+  if (effects.exists(legacy)) {
+    effects.out(info(`${legacy} is left over from the older nightly installer and is no longer read — this run detects daemons directly. It is left alone; you can delete it.`));
+  }
+  const detected = detectDaemons({
+    candidates: effects.knownStateDirs(),
+    exists: effects.exists,
+    readJson: effects.readJson,
+  });
+  const plan = planDaemonSelection({
+    candidates: detected,
+    stateDirExplicit: args.stateDirExplicit,
+    portExplicit: args.portExplicit,
+    assumeYes: args.assumeYes,
+    home: effects.home,
+  });
+
+  if (plan.action === 'flags' || plan.action === 'create') return { ...plan, detected };
+  if (plan.action === 'use') {
+    // A question with one answer is not a choice, it is a keystroke tax — but the
+    // operator still has to be TOLD which daemon this run is about.
+    effects.out(info(`using the ours daemon at ${plan.stateDir}${plan.only.port ? ` (port ${plan.only.port})` : ''} — the only one found`));
+    args.stateDir = plan.stateDir;
+    return { ...plan, detected };
+  }
+
+  effects.out(heading('Which ours daemon is this for?'));
+  plan.candidates.forEach((candidate, index) => {
+    effects.out(`  ${index + 1}) ${candidate.stateDir}${candidate.port ? `   port ${candidate.port}` : ''}`);
+  });
+  if (plan.createOption.stateDir) {
+    effects.out(`  ${plan.candidates.length + 1}) create a new one at ${plan.createOption.stateDir}`);
+  }
+  const answer = await effects.askLine(`Choose 1-${plan.candidates.length + (plan.createOption.stateDir ? 1 : 0)}: `, '1');
+  const chosen = resolveSelection(answer, plan);
+  if (chosen.action === 'invalid') {
+    // Refused rather than guessed. Interpreting an unrecognised answer as a path
+    // would be the "type a state directory" prompt spec §2 forbids, arriving
+    // through the back door.
+    effects.out(warn(`ours: ${chosen.reason}. Nothing was changed.`));
+    effects.out(info('Re-run and pick one of the numbers, or name a daemon directly with --state-dir.'));
+    return { action: 'refuse', exitCode: EXIT_REFUSED, detected };
+  }
+  args.stateDir = chosen.stateDir;
+  effects.out(ok(chosen.action === 'create'
+    ? `creating a new daemon at ${chosen.stateDir}`
+    : `using the ours daemon at ${chosen.stateDir}`));
+  return { ...chosen, detected };
+}
+
 /**
  * The daemon half of a run: §§2-4. Returns the target decision plus the step
  * outcomes, or a refusal.
@@ -198,15 +265,53 @@ export async function runDaemonPhase(args, effects) {
     }
     steps.push(service.step);
   } catch (error) {
+    // THE DAEMON MAY BE DOWN, AND NOT BECAUSE ANYTHING ASKED IT TO BE.
+    //
+    // `install-service` can STOP a running daemon before it fails — it installs a
+    // unit that will own the process, and a failure after that point leaves nothing
+    // running. v3 simply ended the run there, so a person who typed ours-install
+    // and got an error was also, silently, left without the daemon they had before.
+    // The nightly flow re-runs `start` and, crucially, tells the two outcomes
+    // apart: "the service failed but the daemon is back" is a bad evening, and "the
+    // service failed AND it will not come back" is the one that needs a human now.
+    const recovery = error?.servicePlan ? await recoverDaemon(args, effects, dir, configPath) : null;
     rollBack(effects, journal, args, 'the daemon did not reach the state its config describes — putting the config back', {
       replacedUnit: error?.servicePlan?.action === 'adopt' ? error.servicePlan.unitPath : null,
     });
+    if (recovery) {
+      effects.out(recovery.recovered
+        ? ok('your daemon is running again — nothing was committed, and the service is unchanged')
+        : warn('and the daemon did NOT come back up — start it yourself before anything else: '
+          + `ours daemon start --config ${configPath}`));
+    }
     throw error;
   }
 
   return { target, steps };
 }
 
+/**
+ * Put the daemon back after a failed boot-service install.
+ *
+ * Only attempted when the failure came from the SERVICE step (`error.servicePlan`
+ * is what says so) — a daemon that never started has nothing to recover, and
+ * running `start` after a failed `start` would just fail again with a second, less
+ * useful error on top of the first.
+ *
+ * A dry run recovers nothing because it stopped nothing. The recovery's own failure
+ * is REPORTED, never thrown: the caller is already carrying the real error, and
+ * losing it to a second one would hide what actually went wrong.
+ */
+async function recoverDaemon(args, effects, dir, configPath) {
+  if (args.dryRun) return null;
+  try {
+    await effects.run('ours', ['daemon', 'start', '--config', configPath]);
+    return { recovered: true };
+  } catch (recoveryError) {
+    return { recovered: false, reason: reason(recoveryError) };
+  }
+}
+
 /**
  * One rollback, one report, one function — because a rollback whose report is
  * missing reads to the operator exactly like a run that quietly did nothing, and
@@ -396,6 +501,11 @@ async function attachComponent(component, { args, effects, dir, endpoint, isDefa
     stateDir: dir,
     installedVersion: effects.installedVersion(component.pkg),
     channel: args.channel,
+    // The broker is a value the INSTALLER knows and cowork cannot guess — the one
+    // the operator chose in this run. `home` is for cowork's OWN state directory,
+    // never the daemon's.
+    brokerUrl: args.brokerUrl,
+    home: effects.home,
   });
   if (plan.action === 'refuse' || plan.action === 'leave-embedded') {
     effects.out(warn(`cowork: ${plan.message}`));
@@ -654,8 +764,31 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
     return { key: 'fleet', label: plan.label, state: 'skipped' };
   }
   const install = await attempt(effects, args.dryRun, plan.install.join(' '), () => effects.run(plan.install[0], plan.install.slice(1)));
+  // THE PAIR IS PASSED AS DELIBERATE INSURANCE AGAINST AN UNRESOLVED
+  // CONTRADICTION, not because the question was settled.
+  //
+  // Two written analyses disagree, and NEITHER was verified — ours-fleet is not in
+  // this repo:
+  //   lib/nightly-install.mjs:611 says fleet resolves its daemon from
+  //     OURS_CONFIG / OURS_PORT / OURS_STATE_DIR and has no concept of a registry,
+  //     so an `init` run without the pair points every role at the historical
+  //     default daemon — which, when the selected daemon is not the default, may
+  //     be one the user does not even have.
+  //   lib/extras.mjs:180 says `init` takes no daemon argument of any kind, reads no
+  //     daemon config, and resolves per role through
+  //     resolveEndpoint({ ...process.env, ...role.env }) — so the pair is
+  //     unnecessary here.
+  // Passing it is harmless if extras.mjs is right and load-bearing if
+  // nightly-install.mjs is. When the cheap action is safe under both readings and
+  // the expensive one is only safe under one, take the cheap one. (Coordinator
+  // ruling, 2026-08-17.)
+  //
+  // Passed for EVERY state directory, not only a non-default one, exactly as the
+  // nightly flow does: `init` is a one-time host setup and the pair is what names
+  // the daemon it was set up beside.
+  const initEnv = daemonEnv(target.stateDir, target.port);
   const init = install.ok
-    ? await attempt(effects, args.dryRun, `${plan.init.join(' ')} (one-time host setup: units, dirs, linger)`, () => effects.run(plan.init[0], plan.init.slice(1)))
+    ? await attempt(effects, args.dryRun, `${plan.init.join(' ')} (one-time host setup: units, dirs, linger)`, () => effects.run(plan.init[0], plan.init.slice(1), { env: initEnv }))
     : install;
   if (!init.ok) {
     effects.out(info(`retry manually: ${plan.init.join(' ')}`));
@@ -773,6 +906,19 @@ export async function endScreen(args, effects, { summary, target, isDefaultState
     ? `  ${c.yellow('Some pieces need a hand — see the notes above; re-run ours-install after fixing.')}`
     : `  ${c.green('Everything installed cleanly. No problems.')}`);
 
+  // Said BEFORE the hand-off prompt, because it is the only thing here the
+  // operator must do himself for any of the rest to work. A harness that was
+  // running when its plugin landed spawns no ours MCP server until it restarts,
+  // and someone who goes back to that harness, finds no ours tools and reads a
+  // successful install as a failed one is the exact outcome this prevents.
+  const restarts = restartHints(summary);
+  if (restarts.length > 0) {
+    effects.out('');
+    effects.out(`  ${c.bold('Before this works:')} your harness spawns the ours MCP server when it starts, so`);
+    effects.out('  a harness that was already open has not picked it up yet.');
+    for (const hint of restarts) effects.out(`  ${c.green('→')} ${hint.action}`);
+  }
+
   const has = (key) => summary.some((r) => r.key === key && (r.state === 'installed' || r.state === 'current'));
   const { text, empty } = buildHandoffPromptV3({
     identity: !has('identity'),
@@ -841,6 +987,11 @@ export async function runInstall(argv, effects) {
   // that wrapped the old installer keeps its meaning.
   if (!runPreflight(effects).ok) return EXIT_OK;
 
+  // Which daemon, before anything is decided about it. Only args.stateDir can
+  // change here; every refusal downstream is unaffected.
+  const selection = await runSelectionPhase(args, effects);
+  if (selection.action === 'refuse') return EXIT_REFUSED;
+
   const daemon = await runDaemonPhase(args, effects);
   if (daemon.refused) return EXIT_REFUSED;
   const target = daemon.target;

package/lib/profiles.mjs

@@ -1,3 +1,26 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// NO LONGER REACHED BY ANY CODE PATH, DELIBERATELY AND TEMPORARILY.
+//
+// The nightly channel now runs the v3 installer end to end (owner ruling
+// 2026-08-17: v3 SUBSUMES the nightly flow), so the two dispatch sites that led
+// here — install.mjs and uninstall.mjs — were removed. This file is retained on
+// purpose rather than deleted in the same commit.
+//
+// WHY IT IS STILL HERE. The behaviour inventory
+// (/home/fleet/work/dev1-installer-notes/NIGHTLY-BEHAVIOUR-INVENTORY.md) lists
+// what this flow does that v3 does not, and that list is not finished being
+// carried across. Deleting the implementation and its tests before the one-for-one
+// replacement exists is how a test that was covering something real gets removed
+// alongside the ones that were not. Its tests still run and still pass, because
+// they exercise this module directly.
+//
+// The retirement — removing this file and retiring each of its tests against a
+// named v3 equivalent — is its own piece of work. Until then this is ORPHANED AND
+// SAID SO, which is the opposite of the failure the staging existed to prevent:
+// seven commits of feature reachable by no code path, with git reporting no
+// conflict and nothing saying it had happened.
+// ─────────────────────────────────────────────────────────────────────────────
+
 import {
   chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync,
   unlinkSync, writeFileSync,

package/lib/target.mjs

@@ -73,6 +73,10 @@ export function parseInstallArgs(argv = [], env = {}, { home = homedir() } = {})
   const out = {
     stateDir: null,
     port: null,
+    // `stateDir` is always populated (it defaults to ~/.ours), so "was it given?"
+    // needs its own flag — the selection screen has to tell an explicit target from
+    // a defaulted one, and a defaulted value looks identical to a chosen one.
+    stateDirExplicit: false,
     portExplicit: false,
     dryRun: env.OURS_INSTALL_DRY_RUN === '1',
     assumeYes: env.OURS_ASSUME_YES === '1',
@@ -98,7 +102,7 @@ export function parseInstallArgs(argv = [], env = {}, { home = homedir() } = {})
     seen.add(name);
     const value = equal >= 0 ? raw.slice(equal + 1) : argv[++i];
     if (value === undefined || value === '') throw new InstallUsageError(`${name} requires a value`);
-    if (name === '--state-dir') out.stateDir = resolve(String(value));
+    if (name === '--state-dir') { out.stateDir = resolve(String(value)); out.stateDirExplicit = true; }
     if (name === '--port') {
       if (!/^[0-9]+$/.test(String(value).trim())) throw new InstallUsageError('--port must be an integer');
       const n = Number.parseInt(String(value).trim(), 10);

package/lib/uninstall.mjs

@@ -221,7 +221,9 @@ export function planStatePurge({ stateDir, purge = false, assumeYes = false, exi
  * directory on this machine still has a daemon config; otherwise keep them and
  * say which daemon still needs them.
  */
-export function planGlobalPackages({ stateDir, otherStateDirsWithConfig = [], pluginPackages = [] }) {
+export const CONNECTOR_PACKAGES = { tg: '@ours.network/tg-connector', cowork: '@ours.network/cowork' };
+
+export function planGlobalPackages({ stateDir, otherStateDirsWithConfig = [], pluginPackages = [], detachedComponents = [] }) {
   const dir = resolve(stateDir);
   const others = otherStateDirsWithConfig.map((d) => resolve(d)).filter((d) => d !== dir);
   if (others.length > 0) {
@@ -230,7 +232,26 @@ export function planGlobalPackages({ stateDir, otherStateDirsWithConfig = [], pl
   // The harness-plugin launchers follow the SAME rule, not a second one: they
   // speak to a daemon through ours-mcp, so a second daemon still on the machine
   // still needs them, and the one condition above already decides that.
-  return { action: 'remove', packages: ['@ours.network/cli', '@ours.network/mcp', ...pluginPackages], stillNeededBy: [] };
+  // A connector's package goes only when BOTH conditions hold: the operator
+  // confirmed removing its attachment in THIS run, and this was the last daemon —
+  // the same condition already decided once above.
+  //
+  // WHY NOT NIGHTLY'S THREE-WAY CHOICE. The nightly uninstaller asks per connector
+  // for detach / uninstall / reassign:<profile> and removes the package only on
+  // `uninstall`. v3 has no such lifecycle question and inventing one here would be
+  // deciding scope in a patch. What v3 DOES have is the operator's explicit yes to
+  // "remove its attachment too", which is a narrower thing than nightly's
+  // `uninstall` — so this stays behind the last-daemon condition rather than
+  // standing on the confirmation alone. A connector detached while another daemon
+  // survives keeps its package, because that daemon may still be using it.
+  const connectors = detachedComponents
+    .map((key) => CONNECTOR_PACKAGES[key])
+    .filter(Boolean);
+  return {
+    action: 'remove',
+    packages: ['@ours.network/cli', '@ours.network/mcp', ...pluginPackages, ...connectors],
+    stillNeededBy: [],
+  };
 }
 
 // -----------------------------------------------------------------------------
@@ -403,7 +424,14 @@ export function planUninstall({ home, env = {}, endpoint, stateDir, purge = fals
     daemon: planDaemonRemoval({ stateDir: dir, cliStartedIt }),
     state: planStatePurge({ stateDir: dir, purge, assumeYes, exists, typedConfirmation }),
     plugins,
-    packages: planGlobalPackages({ stateDir: dir, otherStateDirsWithConfig, pluginPackages: plugins.packages }),
+    packages: planGlobalPackages({
+      stateDir: dir,
+      otherStateDirsWithConfig,
+      pluginPackages: plugins.packages,
+      // Only the components the operator explicitly confirmed removing — never
+      // every component that merely happens to point here.
+      detachedComponents: pointing.map((p) => p.key).filter((key) => confirmedComponents.includes(key)),
+    }),
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "0.17.0-nightly.8",
+  "version": "0.17.0-nightly.9",
   "private": false,
   "description": "The unified ours.network stack installer (ours-install): one guided ~3-minute flow for ours core (the daemon) + the harness plugins (Claude Code / Codex) + ours-fleet + the Telegram connector, then a single copy-paste hand-off prompt. Self-contained (Node built-ins only); run as `ours-install` or via curl|bash (install.sh).",
   "type": "module",

package/uninstall.mjs

@@ -20,7 +20,8 @@ import { join } from 'node:path';
 import { banner, heading, c, openTty, makeWriter, closeSync } from './lib/ui.mjs';
 import { askLine, checkboxSelect } from './lib/prompt.mjs';
 import { canonHarnesses, resolveChannel } from './lib/logic.mjs';
-import { runNightlyUninstaller } from './lib/nightly-uninstall.mjs';
+import { realEffects } from './lib/effects.mjs';
+import { runUninstall as runUninstallV3 } from './lib/orchestrate-uninstall.mjs';
 
 const NPM = process.env.OURS_NPM || 'npm';
 const HOME = homedir();
@@ -116,18 +117,30 @@ function confirmDestructive(write, fd, what) {
 }
 
 // ===============================================================================================
-function main() {
+async function main() {
   const ttyFd = openTty();
   const write = makeWriter(ttyFd);
 
+  // ─── THE CHANNEL FORK ───────────────────────────────────────────────────────
+  // The partner to install.mjs's, and it has to move in the SAME commit. v3
+  // installing while this body uninstalls would run the old flow against state it
+  // no longer understands — the kind of half-state that only surfaces when someone
+  // tries to undo something.
+  //
+  // Before the banner, so the screen the operator sees is the one belonging to the
+  // flow that is about to run.
+  if (CHANNEL === 'nightly') {
+    const code = await runUninstallV3(process.argv.slice(2), realEffects({
+      write, ttyFd, env: process.env, version: packageVersion,
+    }));
+    finish(ttyFd);
+    process.exit(code);
+  }
+
   line(banner());
   line(c.bold('  ours.network uninstaller'));
   say('Removes only what the ours installers created. Nothing is removed until you confirm.');
 
-  if (CHANNEL === 'nightly') {
-    return runNightlyUninstaller({ ttyFd, write, run, npm: NPM, assumeYes: ASSUME_YES, finish });
-  }
-
   // --- 1) choose what to remove ----------------------------------------------------------------
   let selected = [];
   let wantData = false;
@@ -208,4 +221,10 @@ function main() {
 
 function finish(ttyFd) { if (ttyFd != null) { try { closeSync(ttyFd); } catch { /* ignore */ } } }
 
-main();
+// `main` became async when the nightly fork moved in: the v3 uninstaller is async
+// all the way down. An unhandled rejection here would exit 0 with no output, so the
+// failure is caught and reported like the installer's.
+main().catch((error) => {
+  say(`unexpected error: ${String(error)}`);
+  process.exitCode = 1;
+});