@ours.network/install 0.17.0-nightly.8 → 0.17.0

package/install.mjs

@@ -2,16 +2,9 @@
 // ours.network — the unified `ours-install` experience (the real UX behind install.sh's thin
 // bootstrap, and the `ours-install` command once the stack is on the machine).
 //
-// ONE installer for the WHOLE stack — the shared ours daemon + the harness plugins (Claude Code /
-// Codex / Hermes) + ours-fleet + the Telegram connector + Rooms (ours-cowork) — for someone who
-// ALREADY has Claude, Codex, and/or Hermes.
-//
-// TOPOLOGY. Step 1 installs and configures ONE shared daemon and the user picks its listen port
-// there; every consumer below is wired to that endpoint. The Telegram connector may instead be
-// given its OWN daemon — its own port, state directory and boot unit — chosen independently, and
-// defaulting to the shared one so Enter and non-interactive runs keep the historical topology.
-// Rooms answers the same question, plus a third answer the connector has no use for: keeping
-// cowork's own EMBEDDED daemon, which is what every pre-PR#9 cowork install runs (see step 5).
+// ONE installer for the WHOLE stack — ours core (the daemon) + the harness plugins (Claude Code /
+// Codex / Hermes) + ours-fleet + the Telegram connector — for someone who ALREADY has Claude,
+// Codex, and/or Hermes.
 // Its whole job: install the stack cleanly, then hand back ONE copy-paste prompt the user drops
 // into their agent to finish remaining configuration conversationally. Voice API credentials are
 // the one guided secret flow: interactive, masked, optional, and written atomically with mode 0600.
@@ -27,29 +20,21 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { readFileSync, existsSync } from 'node:fs';
 import { homedir, userInfo, platform as osPlatform, release as osRelease } from 'node:os';
-import { join, resolve } from 'node:path';
+import { join } from 'node:path';
 import { banner, heading, ok, info, warn, c, box, withSpinner, openTty, makeWriter, closeSync } from './lib/ui.mjs';
 import { askLine, askYesNo, isCancel } from './lib/prompt.mjs';
 import {
   suggestPort, parsePort, validateBroker, mergeConfig, parseVersion, parseStatus,
   detectPlatform, classifyHarnessProbe, buildHandoffPrompt,
-  voiceSetupStatus, resolveSharedBroker, tgConfigPath, planTgDaemonConfig, daemonEndpoint,
+  voiceSetupStatus,
   DEFAULT_PORT, resolveChannel, pkgSpec,
-  validateDaemonPort, planPorts, dedicatedDaemonPaths, DEDICATED_INSTANCES,
-  coworkConfigPath, planCoworkConfig, COWORK_DEFAULT_PORT, coworkDaemonMode,
-  coworkSupportsExternalDaemon, COWORK_EXTERNAL_MIN_VERSION,
 } from './lib/logic.mjs';
 import { atomicWriteConfig } from './lib/config.mjs';
-import { runNightlyInstaller } from './lib/nightly-install.mjs';
 
 const NPM = process.env.OURS_NPM || 'npm';
-// Release channel: OURS_CHANNEL=nightly installs each package's PRERELEASE dist-tag —
-// @nightly for mcp/tg-connector/fleet/the plugin launchers, and @latest for cowork,
-// and @next for cowork, whose repo has always called its prerelease line `next`
-// (see PKG_CHANNEL_TAGS in lib/logic.mjs). With no explicit
-// selection the installer follows its OWN channel, so a nightly installer builds a
-// nightly stack instead of silently mixing tags across an architecture boundary.
-const CHANNEL = resolveChannel(process.env.OURS_CHANNEL || process.env.OURS_INSTALL_CHANNEL, pkgVersion());
+// Release channel: OURS_CHANNEL=nightly installs @nightly for mcp/tg-connector/plugin
+// launchers but keeps @ours.network/fleet at @latest (fleet has no nightly). Default: latest.
+const CHANNEL = resolveChannel(process.env.OURS_CHANNEL || process.env.OURS_INSTALL_CHANNEL);
 const spec = (pkgKey) => pkgSpec(pkgKey, CHANNEL); // → "@ours.network/<key>@<tag>"
 let DRY = !!process.env.OURS_INSTALL_DRY_RUN;
 const SELFHOST_URL = 'ours.network';
@@ -61,11 +46,10 @@ const line = (s = '') => sink(`${s}\n`);
 const say = (s) => sink(`ours: ${s}\n`);
 
 // --- external command helpers (never throw; the installer degrades, it doesn't crash) ----------
-function run(bin, args, { capture = false, timeout, env } = {}) {
+function run(bin, args, { capture = false, timeout } = {}) {
   const r = spawnSync(bin, args, {
     encoding: 'utf8',
     timeout,
-    env: env ? { ...process.env, ...env } : process.env,
     stdio: capture ? ['ignore', 'pipe', 'pipe'] : 'inherit',
   });
   const timedOut = !!(r.error && (r.error.code === 'ETIMEDOUT' || r.signal === 'SIGTERM'));
@@ -103,30 +87,16 @@ async function actSpin(label, desc, fn) {
 
 // --- daemon probes (always safe to run — read-only) --------------------------------------------
 const daemonVersionLine = () => (run('ours-mcp', ['--version'], { capture: true }).out.split('\n')[0] || '').trim();
-const daemonStatusText = (env) => run('ours-mcp', ['status'], { capture: true, ...(env ? { env } : {}) }).out;
+const daemonStatusText = () => run('ours-mcp', ['status'], { capture: true }).out;
 function daemonLifecycleState() {
   const status = run('ours-mcp', ['status'], { capture: true });
   if (!status.ok) return 'stopped';
   return /^\s*pid:\s*\d+/m.test(status.out) ? 'managed' : 'external';
 }
 const daemonRunning = () => daemonLifecycleState() !== 'stopped';
-// LISTENING, not merely alive — and the difference is not academic. `ours-mcp start`
-// exits 0 when it only FINDS a live pid in the state directory (core cmdStart: it
-// checks `isAlive(pid)` and nothing else, so a pid file left by a previous boot whose
-// number now belongs to any other process reads as "already running"). `ours-mcp
-// status` then exits 0 for that same pid while printing "(port not answering!)" —
-// core cmdStatus only sets a non-zero exit for the no-pid case. So neither exit code
-// proves a daemon is there, and a readiness line built from one can tell the user
-// "ready — no problems" about a port nothing is bound to. The status line the daemon
-// prints only when the port actually answered is the honest signal, so use it.
-const daemonReachable = (env) => /\(reachable\)/.test(daemonStatusText(env));
-// The installed version of a global package, INCLUDING any prerelease suffix. The
-// suffix is not cosmetic here: the Rooms daemon guard compares against an exact
-// `0.4.1-nightly.<date>.<sha>` floor, and truncating at the dash would make every
-// 0.4.1 nightly look alike — including ones published before the mode existed.
 const globalVersion = (pkg) => {
   const ls = run(NPM, ['ls', '-g', pkg], { capture: true }).out;
-  const m = ls.match(new RegExp(pkg.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&') + '@(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)'));
+  const m = ls.match(new RegExp(pkg.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&') + '@([0-9][0-9.]*)'));
   return m ? m[1] : '';
 };
 
@@ -139,18 +109,6 @@ function writeConfigPatch(patch) {
   return p;
 }
 
-// The daemon's state directory, resolved exactly the way packages/core/src/config.ts
-// resolves it (env > config file > ~/.ours). The Telegram connector needs the ABSOLUTE
-// path: the SDK reads the daemon's API token from it and refuses to send that token to
-// a separately-chosen endpoint unless the state dir was chosen just as deliberately.
-function daemonStateDir() {
-  const fromEnv = process.env.OURS_STATE_DIR?.trim();
-  if (fromEnv) return resolve(fromEnv);
-  const fromFile = readConfigObject().stateDir;
-  if (typeof fromFile === 'string' && fromFile.trim()) return resolve(fromFile.trim());
-  return join(homedir(), '.ours');
-}
-
 function daemonVoiceCapability() {
   const r = run('ours-mcp', ['voice-status', '--json'], { capture: true, timeout: 6000 });
   if (!r.ok) return null;
@@ -221,13 +179,10 @@ const USAGE = `ours-install — the unified ours.network stack installer.
 
   ours-install [--dry-run] [--help] [--version]
 
-Guided ~3-minute setup for the whole stack: the shared ours daemon (you pick its
-port), the harness plugins (Claude Code + Codex + Hermes), ours-fleet, the Telegram
-connector, and Rooms (ours-cowork) — then one copy-paste hand-off prompt. You approve
-each step; re-run any time to add a piece or update.
-
-Telegram can share the daemon from step 1 or be given its own (its own port, state
-directory and boot service); Enter keeps the shared one.
+Guided ~3-minute setup for the whole stack: ours core (the daemon), the harness
+plugins (Claude Code + Codex + Hermes), ours-fleet, and the Telegram connector — then one
+copy-paste hand-off prompt. You approve each step; re-run any time to add a piece
+or update.
 
   --dry-run    walk the whole flow and print what it WOULD do — install/change nothing
   --help       show this help and exit
@@ -317,16 +272,6 @@ async function main() {
     finish(ttyFd); return;
   }
 
-  // HARD RELEASE BOUNDARY. Nightly owns the topology-first profile flow. The
-  // latest/stable consumer-first implementation below remains untouched and
-  // never reads or writes installer-profiles.json or emits --application.
-  if (CHANNEL === 'nightly') {
-    return runNightlyInstaller({
-      harnesses, ttyFd, interactive, write, yes, ask, cont, dry: DRY,
-      npm: NPM, run, runAsync, act, actSpin, finish,
-    });
-  }
-
   // Daemon state up front (decides first-install vs update, and whether Step 0 runs at all).
   const versionBefore = daemonVersionLine();
   const daemonInstalled = !!versionBefore;
@@ -336,44 +281,56 @@ async function main() {
   line('');
   cont();
 
+  // ============================================================================================
+  // STEP 0 — the two config questions (asked ONCE, up front). SKIPPED entirely when a daemon is
+  // already configured (update path reuses its port/broker; delta #1859).
+  // ============================================================================================
   const status0 = parseStatus(daemonStatusText());
   let chosenBroker;     // undefined = keep default / existing
   let chosenPort = status0.port || DEFAULT_PORT;
   const configFirst = !daemonInstalled;
 
-  // Every port this run has committed to, so a later daemon can't be handed one an
-  // earlier daemon claimed. A live bind probe cannot see these — nothing is
-  // listening on them yet — which is exactly why they're tracked by hand.
-  const claimedPorts = [];
-  // The finished topology, for the end-of-run cross-check. Each entry is one thing that
-  // will try to BIND a port, named so a collision can be reported in the user's terms.
-  const topology = [];
-  const claimPort = (port, label) => {
-    if (!Number.isInteger(port)) return;
-    if (!claimedPorts.includes(port)) claimedPorts.push(port);
-    if (label) topology.push({ label, port });
-  };
+  if (configFirst) {
+    line(heading('A couple of quick settings'));
+    // 0a — broker (owner edit #1: SECURE wording; owner edit #2: self-host → website only).
+    line(info('Your agents connect through a "broker" — a shared meeting point that lets them find'));
+    line(info("each other. It's secure: your messages are end-to-end encrypted, so the broker never"));
+    line(info('sees what they say. Almost everyone uses the standard one — just press Enter.'));
+    const custom = yes('  Use a custom broker address?', false);
+    if (custom) {
+      line(info(`(Only needed if you run your own broker. More at ${SELFHOST_URL}.)`));
+      const entered = ask('  Enter the broker address: ', '');
+      const v = validateBroker(entered);
+      if (entered && v.ok && !v.empty) {
+        // Undo safety net: a mistaken custom entry is one keystroke back to the standard broker.
+        const keep = yes(`  Use "${v.value}"?  (No = go back to the standard broker)`, true);
+        if (keep) { chosenBroker = v.value; line(ok(`broker set to ${chosenBroker}.`)); }
+        else line(ok('using the standard broker.'));
+      } else {
+        if (entered) line(warn(`"${entered}" doesn't look like a ws:// address — using the standard broker.`));
+        else line(ok('using the standard broker.'));
+      }
+    } else {
+      line(ok('using the standard broker.'));
+    }
 
-  // Ask for ONE daemon's port, validate it, and keep asking until the answer is
-  // usable. Enter (and every non-interactive run) takes `def` unchanged — that is
-  // what keeps the historical behaviour and scripted installs identical.
-  const askDaemonPort = (prompt, def) => {
-    let candidate = def;
-    for (let attempt = 0; attempt < 3; attempt++) {
-      const raw = ask(`  ${prompt}  ${c.gray(`[Enter for ${candidate}]`)}: `, String(candidate));
-      const v = validateDaemonPort(raw, { fallback: candidate, isTaken: portTakenSync, taken: claimedPorts });
-      if (v.ok) return v.port;
-      line(warn(`${v.reason}.`));
-      if (!interactive) break;   // no one to re-ask; fall through to a suggestion
-      candidate = suggestPort(v.port + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-      line(info(`Suggesting ${candidate} instead.`));
+    // 0b — port: probe 3050; only ask if busy. Minimize the concept.
+    if (!portTakenSync(DEFAULT_PORT)) {
+      chosenPort = DEFAULT_PORT;
+      line(ok(`Using local port ${DEFAULT_PORT}.`));
+    } else {
+      line(info(`The standard local port (${DEFAULT_PORT}) is already in use on your machine.`));
+      let candidate = suggestPort(DEFAULT_PORT + 1, portTakenSync);
+      const raw = ask(`  Pick another number for the ours daemon?  ${c.gray(`[Enter for ${candidate}]`)}: `, String(candidate));
+      const parsed = parsePort(raw, candidate);
+      candidate = suggestPort(parsed.ok ? parsed.port : candidate, portTakenSync);
+      chosenPort = candidate;
+      line(ok(`Using local port ${chosenPort}.`));
     }
-    // Out of attempts (or headless): take the first genuinely free port rather
-    // than persisting one we know is unusable.
-    const fallback = suggestPort(candidate, (p) => claimedPorts.includes(p) || portTakenSync(p));
-    line(ok(`Using port ${fallback}.`));
-    return fallback;
-  };
+    line('');
+    line(ok(`Config ready — broker: ${chosenBroker ? 'custom' : 'standard'}, port: ${chosenPort}.`));
+    cont();
+  }
 
   // Track outcomes for the summary + hand-off.
   const summary = [];
@@ -460,57 +417,13 @@ async function main() {
   };
 
   // ============================================================================================
-  // STEP 1 / 5 — the SHARED ours daemon. Its own visible step, and it owns its own configuration
-  // (broker + listen port) rather than a nameless "quick settings" preamble: every consumer below
-  // is wired to the endpoint chosen HERE, so the choice belongs to the step that makes it.
-  // Config-first within the step: choose → write config → optional voice → start ONCE.
+  // STEP 1 / 4 — ours core (the daemon). Config-first: write config → optional voice → start ONCE.
   // ============================================================================================
-  line(heading('1/5 — the shared ours daemon'));
-  line(info('This is the piece that lets your agents talk to each other securely. The harness'));
-  line(info('plugins, ours-fleet and the Telegram connector all connect to it — Telegram can be'));
-  line(info('given its own instead, later — and so can Rooms.'));
+  line(heading('1/4 — ours core (the daemon)'));
+  line(info('This is the piece that lets your agents talk to each other securely. Everything else'));
+  line(info('needs it.'));
   const before = parseVersion(versionBefore);
 
-  if (configFirst) {
-    // Broker (owner edit #1: SECURE wording; owner edit #2: self-host → website only).
-    line('');
-    line(info('Your agents connect through a "broker" — a shared meeting point that lets them find'));
-    line(info("each other. It's secure: your messages are end-to-end encrypted, so the broker never"));
-    line(info('sees what they say. Almost everyone uses the standard one — just press Enter.'));
-    const custom = yes('  Use a custom broker address?', false);
-    if (custom) {
-      line(info(`(Only needed if you run your own broker. More at ${SELFHOST_URL}.)`));
-      const entered = ask('  Enter the broker address: ', '');
-      const v = validateBroker(entered);
-      if (entered && v.ok && !v.empty) {
-        // Undo safety net: a mistaken custom entry is one keystroke back to the standard broker.
-        const keep = yes(`  Use "${v.value}"?  (No = go back to the standard broker)`, true);
-        if (keep) { chosenBroker = v.value; line(ok(`broker set to ${chosenBroker}.`)); }
-        else line(ok('using the standard broker.'));
-      } else {
-        if (entered) line(warn(`"${entered}" doesn't look like a ws:// address — using the standard broker.`));
-        else line(ok('using the standard broker.'));
-      }
-    } else {
-      line(ok('using the standard broker.'));
-    }
-
-    // Listen port. ALWAYS asked now, so the shared daemon's endpoint is a decision the
-    // user makes rather than one they only hear about when 3050 happens to be busy.
-    // The default is still 3050 (the next free port when it is taken), so Enter and
-    // every non-interactive run land exactly where they always did.
-    line('');
-    line(info('The daemon listens on a local port. Everything else in this install is pointed at it.'));
-    const portDefault = portTakenSync(DEFAULT_PORT) ? suggestPort(DEFAULT_PORT + 1, portTakenSync) : DEFAULT_PORT;
-    if (portDefault !== DEFAULT_PORT) line(info(`The standard port (${DEFAULT_PORT}) is already in use on your machine.`));
-    chosenPort = askDaemonPort('Which local port should the shared daemon use?', portDefault);
-    line(ok(`Shared daemon: port ${chosenPort}, broker ${chosenBroker ? 'custom' : 'standard'}.`));
-    line('');
-  } else {
-    line(ok(`Shared daemon already configured — port ${chosenPort}. Keeping it.`));
-  }
-  claimPort(chosenPort, 'the shared ours daemon');
-
   if (!daemonInstalled) {
     const goCore = yes('  Install and start it?', true);
     if (!goCore) {
@@ -526,24 +439,10 @@ async function main() {
     const voice = offerVoiceSetup({ readinessAfterStart: true });
     const started = await act(`ours-mcp start (port ${chosenPort})`, async () => run('ours-mcp', ['start']));
     const svc = await act('ours-mcp install-service (survives reboot)', async () => run('ours-mcp', ['install-service']));
-    // `ours-mcp install-service` STOPS the daemon before it writes the unit (core's
-    // cmdInstallService), then exits non-zero if `systemctl --user enable --now` fails —
-    // no linger, no user bus, a container, WSL without systemd. Left alone that turns a
-    // WORKING daemon into no daemon at all, while the line below still said "ready": the
-    // human identity and every MCP client then fail against a port nothing is listening
-    // on. Put the one shared daemon back up and report what is actually true.
-    // `started.ok` is the exit code of `ours-mcp start`, which is not evidence that
-    // anything is listening (see daemonReachable). Ask the daemon instead.
-    let running = DRY ? started.ok : daemonReachable();
-    if (!DRY && !svc.ok && !running) {
-      line(info('the boot-service step stopped the daemon before it failed — restarting it.'));
-      run('ours-mcp', ['start']);
-      running = daemonReachable();
-    }
-    if (running) line(ok(`ours core ready — running on port ${chosenPort}. No problems.`));
+    if (started.ok) line(ok(`ours core ready — running on port ${chosenPort}. No problems.`));
     else line(warn(`could not auto-start — run '${c.cyan('ours-mcp start')}' to bring it up.`));
     if (!svc.ok && !svc.dry) line(warn(`boot-service not installed — retry '${c.cyan('ours-mcp install-service')}' later.`));
-    if (voice.setupRan && !DRY && running) {
+    if (voice.setupRan && !DRY && started.ok) {
       const verified = daemonVoiceCapability();
       if (verified?.ready) {
         line(ok(`Voice transcription readiness confirmed (${verified.provider}) after the first start.`));
@@ -556,13 +455,7 @@ async function main() {
         }
       }
     }
-    record({
-      key: 'core',
-      label: 'ours core (daemon)',
-      state: running ? 'installed' : 'failed',
-      version: parseVersion(daemonVersionLine()),
-      note: svc.ok ? 'starts on boot' : 'running; no boot service',
-    });
+    record({ key: 'core', label: 'ours core (daemon)', state: started.ok ? 'installed' : 'failed', version: parseVersion(daemonVersionLine()), note: 'starts on boot' });
   } else {
     // Installed: offer an update; never re-ask config; reuse the running port everywhere.
     const daemonState = daemonLifecycleState();
@@ -619,11 +512,9 @@ async function main() {
       line(ok(`Your human identity "${name}" is created.`));
       record({ key: 'identity', label: 'Human identity', state: 'installed', note: name });
     } else {
-      // A freshly-started daemon may need a moment to BIND ITS PORT before create-root
-      // can reach it — which is the one thing a liveness check cannot see, so this
-      // waits on the port answering rather than on a process existing.
-      let reachable = daemonReachable();
-      for (let i = 0; i < 6 && !reachable; i++) { sleepMs(400); reachable = daemonReachable(); }
+      // A freshly-started daemon may need a moment to bind its port before create-root can reach it.
+      let reachable = daemonRunning();
+      for (let i = 0; i < 6 && !reachable; i++) { sleepMs(400); reachable = daemonRunning(); }
       const r = reachable ? run('ours-mcp', ['create-root', name], { capture: true }) : { ok: false, out: '', err: 'daemon not running' };
       const outText = `${r.out} ${r.err}`;
       const existing = outText.match(/already exists \("([^"]+)"\)/);
@@ -702,10 +593,10 @@ async function main() {
   }
 
   // ============================================================================================
-  // STEP 2 / 5 — harness plugins (Claude Code + Codex + Hermes). The installer drives the plugin
+  // STEP 2 / 4 — harness plugins (Claude Code + Codex + Hermes). The installer drives the plugin
   // CLIs for Claude/Codex; Hermes installs via npm + ours-hermes-install (no CLI driving).
   // ============================================================================================
-  line(heading('2/5 — harness plugins'));
+  line(heading('2/4 — harness plugins'));
   line(info('These teach Claude Code, Codex, and Hermes the ours skills, so you can just talk to your'));
   line(info("agent to message people and set things up. I'll install them for you — no commands to type."));
   for (const h of harnesses) {
@@ -718,21 +609,16 @@ async function main() {
   }
 
   // ============================================================================================
-  // STEP 3 / 5 — ours-fleet. Appealing wording (owner edit #4); default YES.
+  // STEP 3 / 4 — ours-fleet. Appealing wording (owner edit #4); default YES.
   // ============================================================================================
-  line(heading('3/5 — ours-fleet (your always-online agent team)'));
+  line(heading('3/4 — ours-fleet (your always-online agent team)'));
   line(info('This makes your harnesses PERSISTENT: Claude Code and Codex stop being just a terminal'));
   line(info('session and become always-online daemons that survive a reboot. Stand up your own team'));
   line(info('of always-online developers, combine harnesses, run several Claude Codes, and link them'));
   line(info('over Telegram so they talk to each other — and it all configures maximally easily.'));
   const goFleet = yes('  Install it?', true);
   if (goFleet) {
-    // ours-fleet FOLLOWS the channel, like everything else here: it publishes its own
-    // nightly dist-tag from adapt-toolkit/ours-fleet, and lib/logic.mjs maps it
-    // accordingly. (This comment used to claim the opposite — that fleet had no nightly
-    // tag and was pinned to @latest even under OURS_CHANNEL=nightly — which stopped
-    // being true when the map gained its `fleet` entry. The code always followed the
-    // map; only the comment was stale, which is the more dangerous of the two.)
+    // ours-fleet is ALWAYS @latest — it has no nightly tag (pkgSpec pins it even under OURS_CHANNEL=nightly).
     await actSpin(`installing ${spec('fleet')}…`, `npm i -g ${spec('fleet')}`, () => runAsync(NPM, ['i', '-g', spec('fleet')]));
     const init = await act('ours-fleet init (one-time host setup: units, dirs, linger)', async () => run('ours-fleet', ['init']));
     if (!init.ok) line(warn(`ours-fleet host setup didn't finish — retry '${c.cyan('ours-fleet init')}'.`));
@@ -753,147 +639,24 @@ async function main() {
   }
   cont(goFleet);
 
-  // The broker the WHOLE deployment shares, whichever daemon a consumer talks to.
-  const sharedBroker = () => resolveSharedBroker({
-    chosenBroker,
-    statusBroker: status0.broker,
-    configBroker: readConfigObject().brokerUrl,
-  });
-
-  // Provision a daemon that belongs to ONE consumer: its own config file, its own
-  // state directory, its own port, and — via core's OURS_SERVICE_NAME — its own boot
-  // unit, so `install-service` cannot overwrite the shared daemon's. Returns the
-  // endpoint + state dir to wire that consumer to, and whether it came up.
-  async function provisionDedicatedDaemon({ instance, port, label }) {
-    const { stateDir, configPath: cfgPath, serviceName } = dedicatedDaemonPaths(homedir(), instance);
-    const env = { OURS_CONFIG: cfgPath, OURS_STATE_DIR: stateDir, OURS_SERVICE_NAME: serviceName };
-    // The dedicated daemon has to exist as a package before it can be started; on a
-    // fresh machine step 1 already installed it, but a re-run that skipped core has not.
-    await actSpin(`ensuring ${spec('mcp')}…`, `npm i -g ${spec('mcp')}`, () => runAsync(NPM, ['i', '-g', spec('mcp')]));
-    const desired = { port, stateDir, serviceName };
-    const broker = sharedBroker();
-    if (broker) desired.brokerUrl = broker;
-    let existing = {};
-    try { existing = JSON.parse(readFileSync(cfgPath, 'utf8')); } catch { /* absent or unreadable */ }
-    const sameAlready = existing.port === port && existing.stateDir === stateDir && existing.serviceName === serviceName;
-    if (sameAlready) {
-      line(ok(`The ${label} daemon is already configured on port ${port} — no change.`));
-      // Nothing to change AND it is already up: do not touch it. `install-service` STOPS
-      // the daemon before rewriting the unit, so re-running it here would bounce a healthy
-      // daemon for no reason.
-      if (!DRY && daemonReachable(env)) {
-        line(ok(`Dedicated ${label} daemon already running on port ${port} — left alone.`));
-        return { endpoint: daemonEndpoint(port), stateDir, serviceName, configPath: cfgPath, running: true, port };
-      }
-    } else {
-      await act(`write ${cfgPath} (dedicated ${label} daemon, port ${port}, state ${stateDir})`, async () => {
-        atomicWriteConfig(cfgPath, mergeConfig(existing, desired));
-        return { ok: true };
-      });
-    }
-    const started = await act(`ours-mcp start (dedicated ${label} daemon, port ${port})`, async () => run('ours-mcp', ['start'], { env }));
-    const svc = await act(`ours-mcp install-service (dedicated ${label} daemon, unit ours-${serviceName})`, async () => run('ours-mcp', ['install-service'], { env }));
-    // Same recovery as the shared daemon: install-service STOPS the daemon before it
-    // writes the unit, so a failure there leaves nothing listening on this port.
-    // Same rule as the shared daemon: an exit code is not evidence of a bound port.
-    let running = DRY ? started.ok : daemonReachable(env);
-    if (!DRY && !svc.ok) {
-      if (!running) {
-        line(info(`the boot-service step stopped the ${label} daemon before it failed — restarting it.`));
-        run('ours-mcp', ['start'], { env });
-        running = daemonReachable(env);
-      }
-      line(warn(`the ${label} daemon has no boot service — retry '${c.cyan(`OURS_CONFIG=${cfgPath} OURS_SERVICE_NAME=${serviceName} ours-mcp install-service`)}'.`));
-    }
-    if (running || DRY) line(ok(`Dedicated ${label} daemon ready on port ${port} (state ${stateDir}, unit ours-${serviceName}).`));
-    else line(warn(`could not start the dedicated ${label} daemon — run '${c.cyan(`OURS_CONFIG=${cfgPath} ours-mcp start`)}'.`));
-    return { endpoint: daemonEndpoint(port), stateDir, serviceName, configPath: cfgPath, running: running || DRY, port };
-  }
-
-  // Ask one consumer whether it uses the COMMON daemon or gets its own. Enter and
-  // every non-interactive run answer "common" — the historical topology.
-  const askDaemonMode = (what) => {
-    line(info(`${what} can share the daemon from step 1, or run against its own isolated one.`));
-    line(info('Sharing is right for almost everyone — press Enter. A dedicated daemon gets its own'));
-    line(info('port, state directory and boot service, and does not see the shared daemon\'s identities.'));
-    return yes(`  Give ${what} its OWN dedicated daemon?`, false) ? 'dedicated' : 'common';
-  };
-
-  // Give the Telegram connector the daemon it was assigned: that daemon's loopback
-  // endpoint, the state directory that endpoint's API token belongs to, and — for a
-  // pre-0.3.3 connector that still meets the daemon at a broker instead — that broker.
-  // Idempotent: an unchanged selection writes nothing. Returns { changed, hadPrevious }
-  // so the caller can warn about a service unit that froze an older selection.
-  async function writeTgDaemonConfig({ endpoint, stateDir }) {
-    const path = tgConfigPath(process.env, homedir());
-    const desired = {
-      daemonUrl: endpoint,
-      daemonStateDir: stateDir,
-      brokerUrl: sharedBroker(),
-    };
-    let existing = {};
-    try { existing = JSON.parse(readFileSync(path, 'utf8')); } catch { /* absent or unreadable */ }
-    const plan = planTgDaemonConfig(existing, desired);
-    const hadPrevious = !!(plan.previous.daemonUrl || plan.previous.brokerUrl);
-    if (!plan.changed) {
-      line(ok(`Telegram connector already points at this daemon (${desired.daemonUrl}) — no change.`));
-      return { changed: false, hadPrevious };
-    }
-    await act(`write ${path} (daemon ${desired.daemonUrl}, state ${stateDir})`, async () => {
-      atomicWriteConfig(path, plan.text);
-      return { ok: true };
-    });
-    line(ok(`Telegram connector configured to use this daemon (${desired.daemonUrl}).`));
-    return { changed: true, hadPrevious };
-  }
-
   // ============================================================================================
-  // STEP 4 / 5 — Telegram connector. Install-only (no bot tokens here). Then: run as a service?
+  // STEP 4 / 4 — Telegram connector. Install-only (no bot tokens here). Then: run as a service?
   // ============================================================================================
-  line(heading('4/5 — Telegram connector'));
+  line(heading('4/4 — Telegram connector'));
   line(info('This bridges a Telegram bot to your Ours node, so you can talk to your agent from'));
   line(info("Telegram. (You'll set up the actual bot later, with your agent — not here.)"));
   const goTg = yes('  Install it?', false);
   if (goTg) {
     await actSpin(`installing ${spec('tg-connector')}…`, `npm i -g ${spec('tg-connector')}`, () => runAsync(NPM, ['i', '-g', spec('tg-connector')]));
-    // WHICH daemon — asked independently of every other consumer, and answered
-    // "common" by Enter / non-interactive so the historical topology is the default.
-    line('');
-    const tgMode = askDaemonMode('the Telegram connector');
-    let tgDaemon = { endpoint: daemonEndpoint(chosenPort), stateDir: daemonStateDir(), port: chosenPort, mode: 'common' };
-    if (tgMode === 'dedicated') {
-      const instance = DEDICATED_INSTANCES.telegram;
-      const suggested = suggestPort(chosenPort + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-      const port = askDaemonPort('Which local port should the Telegram daemon use?', suggested);
-      claimPort(port, 'the dedicated Telegram daemon');
-      const provisioned = await provisionDedicatedDaemon({ instance, port, label: 'Telegram' });
-      tgDaemon = { ...provisioned, mode: 'dedicated' };
-    } else {
-      line(ok(`Telegram will use the shared daemon on port ${chosenPort}.`));
-    }
-    // POINT IT AT THAT DAEMON — BEFORE it is started or installed as a service.
-    // The connector never inherits ~/.ours/config.json (its SDK reports configPath:
-    // null unless told otherwise), and `install-service` bakes whatever it resolves
-    // into the unit as environment variables that outrank the file from then on. So
-    // the daemon's identity has to be in its config BEFORE either happens. See
-    // planTgDaemonConfig for why all three keys are written.
-    const tgConfigured = await writeTgDaemonConfig(tgDaemon);
-    const where = tgDaemon.mode === 'dedicated' ? `its own daemon on port ${tgDaemon.port}` : `the shared daemon on port ${tgDaemon.port}`;
     const asService = yes('  Keep it running in the background so it starts automatically on boot?', true);
     if (asService) {
       const svc = await act('ours-tg-connector install-service (starts on boot)', async () => run('ours-tg-connector', ['install-service']));
-      if (svc.ok) line(ok(`Telegram connector installed and running as a service (starts on boot), pointed at ${where}. No problems.`));
+      if (svc.ok) line(ok('Telegram connector installed and running as a service (starts on boot). No problems.'));
       else line(warn(`connector installed, but the service didn't start — retry '${c.cyan('ours-tg-connector install-service')}'.`));
-      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: `service (boot) · ${tgDaemon.mode} daemon ${tgDaemon.port}` });
+      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: 'service (boot)' });
     } else {
-      line(ok(`Telegram connector installed, pointed at ${where}. Start it any time with '${c.cyan('ours-tg-connector start')}'. No problems.`));
-      // A connector already installed as a service froze its OLD daemon selection into
-      // the unit's environment, which outranks the file we just wrote. Config alone
-      // cannot repair that — say so plainly rather than let it look fixed.
-      if (tgConfigured.changed && tgConfigured.hadPrevious) {
-        line(warn(`if you previously ran '${c.cyan('ours-tg-connector install-service')}', re-run it — the old service froze the previous daemon selection in its unit.`));
-      }
-      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: `start on demand · ${tgDaemon.mode} daemon ${tgDaemon.port}` });
+      line(ok(`Telegram connector installed. Start it any time with '${c.cyan('ours-tg-connector start')}'. No problems.`));
+      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: 'start on demand' });
     }
   } else {
     line(info('skipped cleanly.'));
@@ -901,146 +664,6 @@ async function main() {
   }
   cont(goTg);
 
-  // ============================================================================================
-  // STEP 5 / 5 — Rooms (ours-cowork). Two independent things get configured here.
-  //
-  // ITS OWN SURFACE — the deployment broker, its private state directory, and its loopback
-  // console/REST port. Those it has always had.
-  //
-  // WHICH DAEMON — ours-cowork used to host its own, always. It now supports an EXTERNAL ours
-  // daemon (cowork PR #9), so Rooms answers the same common-vs-dedicated question the Telegram
-  // connector does, plus a third state the connector does not have: EMBEDDED, cowork's own.
-  // Contract (see logic.mjs): the `daemon` block is optional; absent means embedded; external is
-  // { mode:'external', endpoint, stateDir } and REQUIRES both halves, because cowork holds no
-  // token and its SDK reads <stateDir>/daemon-token.
-  //
-  // Boot is FAIL-CLOSED on an unreachable endpoint, a non-ours daemon, or a mismatched state
-  // directory — there is no embedded fallback. So an install that is ALREADY running embedded is
-  // never migrated behind the user's back: non-interactively it is left exactly as it is, and
-  // interactively the question is asked plainly before anything is written.
-  // ============================================================================================
-  line(heading('5/5 — Rooms (ours-cowork)'));
-  line(info('Durable mission rooms: a room keeps its own ordered history, and people and agents'));
-  line(info('join it as seats. It serves a local web console, and reaches everyone through the'));
-  line(info('same broker as the rest of your install.'));
-  const goRooms = yes('  Install it?', false);
-  if (goRooms) {
-    await actSpin(`installing ${spec('cowork')}…`, `npm i -g ${spec('cowork')}`, () => runAsync(NPM, ['i', '-g', spec('cowork')]));
-    const roomsStateDir = join(homedir(), '.ours-cowork');
-    const cfgPath = coworkConfigPath(process.env, homedir());
-    let existingRooms = {};
-    try { existingRooms = JSON.parse(readFileSync(cfgPath, 'utf8')); } catch { /* absent or unreadable */ }
-    const restDefault = Number.isInteger(existingRooms.rest?.port) ? existingRooms.rest.port : COWORK_DEFAULT_PORT;
-    line('');
-    line(info('Rooms serves a console on a loopback port — 127.0.0.1 only, never exposed.'));
-    // COWORK_DEFAULT_PORT is in RESERVED_PORTS (so no ours daemon can be handed it),
-    // so validate this one against the daemon ports only.
-    const roomsPort = (() => {
-      let candidate = restDefault;
-      for (let attempt = 0; attempt < 3; attempt++) {
-        const raw = ask(`  Which local port should the Rooms console use?  ${c.gray(`[Enter for ${candidate}]`)}: `, String(candidate));
-        const v = validateDaemonPort(raw, {
-          fallback: candidate, isTaken: (p) => (p === restDefault ? false : portTakenSync(p)),
-          taken: claimedPorts, reserved: [],
-        });
-        if (v.ok) return v.port;
-        line(warn(`${v.reason}.`));
-        if (!interactive) break;
-        candidate = suggestPort(v.port + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-        line(info(`Suggesting ${candidate} instead.`));
-      }
-      return candidate;
-    })();
-    claimPort(roomsPort, 'the Rooms console');
-
-    // WHICH DAEMON. `undefined` means "leave whatever is there alone" — the answer for an
-    // existing embedded install nobody asked to migrate.
-    const wasEmbedded = coworkDaemonMode(existingRooms) === 'embedded';
-    const hadConfig = existsSync(cfgPath);
-    // Ask the BUILD, not the channel: this runs after the install above, so the version
-    // read here is the one actually on the machine.
-    const coworkVersion = globalVersion('@ours.network/cowork');
-    const externalSupported = coworkSupportsExternalDaemon(coworkVersion);
-    let roomsDaemon;
-    let roomsDaemonLabel;
-    if (!externalSupported) {
-      // The build we just installed predates cowork's external-daemon mode. Its config
-      // is a strict document and its boot fails closed, so writing a selection it cannot
-      // honour would break Rooms rather than degrade it.
-      line(info(`This Rooms build${coworkVersion ? ` (${coworkVersion})` : ''} hosts its own daemon; pointing it at the shared`));
-      line(info(`one needs ${COWORK_EXTERNAL_MIN_VERSION} or newer. Re-run with ${c.cyan('OURS_CHANNEL=nightly')} to get it.`));
-      roomsDaemonLabel = 'embedded';
-    } else if (hadConfig && wasEmbedded && !interactive) {
-      // Fail-closed boot makes this migration a real risk; never do it unasked.
-      line(info('Rooms already runs its own embedded daemon — leaving that alone.'));
-      line(info(`To point it at this install's daemon, re-run ${c.cyan('ours-install')} in a terminal.`));
-      roomsDaemonLabel = 'embedded (unchanged)';
-    } else {
-      line('');
-      const roomsMode = askDaemonMode('Rooms');
-      if (roomsMode === 'dedicated') {
-        const instance = DEDICATED_INSTANCES.rooms;
-        const suggested = suggestPort(chosenPort + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-        const port = askDaemonPort('Which local port should the Rooms daemon use?', suggested);
-        claimPort(port, 'the dedicated Rooms daemon');
-        const provisioned = await provisionDedicatedDaemon({ instance, port, label: 'Rooms' });
-        roomsDaemon = { endpoint: provisioned.endpoint, stateDir: provisioned.stateDir };
-        roomsDaemonLabel = `dedicated daemon ${port}`;
-      } else {
-        roomsDaemon = { endpoint: daemonEndpoint(chosenPort), stateDir: daemonStateDir() };
-        roomsDaemonLabel = `common daemon ${chosenPort}`;
-        line(ok(`Rooms will use the shared daemon on port ${chosenPort}.`));
-      }
-    }
-
-    const roomsPlan = planCoworkConfig(existingRooms, {
-      brokerUrl: sharedBroker(),
-      stateDir: roomsStateDir,
-      restPort: roomsPort,
-      daemon: roomsDaemon,
-    });
-    if (roomsPlan.error) {
-      // Only reachable if a daemon selection lost half of itself; a half-written block
-      // would fail closed at cowork's boot, so refuse rather than write it.
-      line(warn(`not changing the Rooms daemon selection — ${roomsPlan.error}.`));
-    } else if (roomsPlan.changed) {
-      await act(`write ${cfgPath} (console port ${roomsPort}, state ${roomsStateDir}${roomsDaemon ? `, daemon ${roomsDaemon.endpoint}` : ''})`, async () => {
-        atomicWriteConfig(cfgPath, roomsPlan.text);
-        return { ok: true };
-      });
-      if (roomsDaemon) line(ok(`Rooms configured to use ${roomsDaemonLabel} (${roomsDaemon.endpoint}, state ${roomsDaemon.stateDir}).`));
-    } else {
-      line(ok(`Rooms is already configured for this deployment (console port ${roomsPort}) — no change.`));
-    }
-    const svc = await act('ours-cowork install-service (starts on boot)', async () => run('ours-cowork', ['install-service']));
-    if (svc.ok) {
-      line(ok(`Rooms ready — console at ${c.cyan(`http://127.0.0.1:${roomsPort}/`)}, sharing your broker. No problems.`));
-    } else {
-      line(warn(`Rooms installed, but its service didn't start — retry '${c.cyan('ours-cowork install-service')}'.`));
-      line(info(`You can also run it in the foreground: '${c.cyan('ours-cowork web')}'.`));
-    }
-    record({
-      key: 'rooms',
-      label: 'Rooms (ours-cowork)',
-      state: svc.ok ? 'installed' : 'failed',
-      version: coworkVersion,
-      note: svc.ok ? `console ${roomsPort} · ${roomsDaemonLabel}` : 'ours-cowork install-service failed',
-    });
-  } else {
-    line(info('skipped cleanly — re-run ours-install any time to add it.'));
-    record({ key: 'rooms', label: 'Rooms (ours-cowork)', state: 'skipped' });
-  }
-  cont(goRooms);
-
-  // Last guard on the whole topology: no two daemons in this install may share a port.
-  // Each answer was validated as it was given, but only the finished plan proves the set.
-  const portPlan = planPorts(topology);
-  if (!portPlan.ok) {
-    for (const d of portPlan.duplicates) {
-      line(warn(`port ${d.port} ended up claimed by both ${d.labels[0]} and ${d.labels[1]} — one of them will fail to bind.`));
-    }
-  }
-
   return endScreen({ ttyFd, summary, chosenPort, chosenBroker });
 }
 
@@ -1119,9 +742,7 @@ function endScreen({ ttyFd, summary, chosenPort, chosenBroker }) {
   const has = (k) => summary.some((r) => r.key === k && (r.state === 'installed' || r.state === 'current'));
   if (has('core')) {
     const identityDone = has('identity');
-    const { text, empty } = buildHandoffPrompt({
-      identity: !identityDone, fleet: has('fleet'), telegram: has('telegram'), rooms: has('rooms'),
-    });
+    const { text, empty } = buildHandoffPrompt({ identity: !identityDone, fleet: has('fleet'), telegram: has('telegram') });
     if (empty) {
       // Nothing left to finish (identity created in-install, no fleet/Telegram). Don't show an empty box.
       line('');