@ours.network/install 0.17.0-nightly.8 → 0.17.0

package/lib/nightly-uninstall.mjs

@@ -1,373 +0,0 @@
-import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { heading, c } from './ui.mjs';
-import { askLine, checkboxSelect } from './prompt.mjs';
-import { canonHarnesses, coworkConfigPath, daemonEndpoint, tgConfigPath } from './logic.mjs';
-import {
-  atomicWriteConfig, restoreConfig, snapshotConfig, transactionalConfigUpdate,
-} from './config.mjs';
-import {
-  readRegistry, profilesPath, removeHarnessAssociation, reverseApplicationIndex,
-  validateRegistry, writeRegistry,
-} from './profiles.mjs';
-
-const YAML_START = '# >>> ours.network plugin (managed block)';
-const YAML_END = '# <<< ours.network plugin';
-const MD_START = '<!-- >>> ours.network plugin (managed block) -->';
-const MD_END = '<!-- <<< ours.network plugin -->';
-const line = (text = '') => process.stdout.write(`${text}\n`);
-const say = (text) => line(`ours: ${text}`);
-
-function readObject(path) {
-  if (!existsSync(path)) return {};
-  try {
-    const value = JSON.parse(readFileSync(path, 'utf8'));
-    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('expected a JSON object');
-    return value;
-  } catch (error) { throw new Error(`${path} is corrupt or unsafe to inspect: ${error.message}`); }
-}
-
-function stripBlock(file, start, end) {
-  if (!existsSync(file)) return false;
-  const text = readFileSync(file, 'utf8');
-  if (!text.includes(start)) return false;
-  const lines = text.split('\n');
-  const out = [];
-  let skipping = false;
-  for (const value of lines) {
-    if (!skipping && value.includes(start)) { skipping = true; continue; }
-    if (skipping) { if (value.includes(end)) skipping = false; continue; }
-    out.push(value);
-  }
-  writeFileSync(file, out.join('\n'));
-  return true;
-}
-
-export function planNightlyUninstall(
-  registry,
-  {
-    removeHarnesses = [], profileId, forgetProfile = false, removeDaemon = false,
-    deleteData = false, connectorActions = {},
-  } = {},
-  connectorConfigs = {},
-) {
-  let next = validateRegistry(registry);
-  const removedAssociations = [];
-  for (const application of removeHarnesses) {
-    const result = removeHarnessAssociation(next, application);
-    next = result.registry;
-    if (result.changed) removedAssociations.push({ application, profileId: result.previous });
-  }
-  const index = reverseApplicationIndex(next, connectorConfigs);
-  const profile = profileId ? next.profiles[profileId] : undefined;
-  if (profileId && !profile) throw new Error(`unknown daemon profile ${JSON.stringify(profileId)}`);
-  const originalDependencies = profileId ? (index[profileId] || []) : [];
-  const connectorPlans = [];
-  const releasedConnectors = new Set();
-  if (forgetProfile || removeDaemon) {
-    for (const connector of ['telegram', 'rooms']) {
-      if (!originalDependencies.includes(connector)) continue;
-      const requested = connectorActions[connector];
-      if (!requested) continue;
-      const mode = requested.action;
-      if (!['detach', 'uninstall', 'reassign'].includes(mode)) {
-        throw new Error(`unknown ${connector} lifecycle action ${JSON.stringify(mode)}`);
-      }
-      let target;
-      if (mode === 'reassign') {
-        const toProfileId = requested.profileId;
-        target = next.profiles[toProfileId];
-        if (!target || toProfileId === profileId) {
-          throw new Error(`${connector} reassignment requires a different retained profile`);
-        }
-        connectorPlans.push({
-          type: 'connector-lifecycle', connector, mode, fromProfileId: profileId,
-          toProfileId, profile: target,
-        });
-      } else {
-        connectorPlans.push({ type: 'connector-lifecycle', connector, mode, fromProfileId: profileId });
-      }
-      releasedConnectors.add(connector);
-    }
-  }
-  const dependencies = originalDependencies.filter((application) => !releasedConnectors.has(application));
-  if ((forgetProfile || removeDaemon) && dependencies.length) {
-    throw new Error(`profile ${profileId} is still required by: ${dependencies.join(', ')}`);
-  }
-  if (deleteData && !removeDaemon) throw new Error('data deletion requires selecting daemon removal');
-  if (forgetProfile && removeDaemon) throw new Error('choose either metadata-only forgetting or daemon removal, not both');
-  if (deleteData && !profile?.ownership.state) throw new Error(`profile ${profileId} state is external; the installer will not delete it`);
-  const actions = [...connectorPlans];
-  if (removeDaemon) {
-    if (profile.ownership.service) actions.push({ type: 'uninstall-service', profileId, profile });
-    else actions.push({ type: 'external-service-kept', profileId, profile });
-    if (deleteData) actions.push({ type: 'delete-state', profileId, path: profile.stateDir });
-    const profiles = { ...next.profiles };
-    delete profiles[profileId];
-    next = { ...next, profiles };
-  } else if (forgetProfile) {
-    actions.push({ type: 'forget-metadata', profileId, profile });
-    const profiles = { ...next.profiles };
-    delete profiles[profileId];
-    next = { ...next, profiles };
-  }
-  const remainingIndex = reverseApplicationIndex(next, connectorConfigs);
-  const retainedApplications = Object.values(remainingIndex).flat()
-    .filter((application) => !releasedConnectors.has(application));
-  const removeGlobalMcp = Object.keys(next.profiles).length === 0 && retainedApplications.length === 0;
-  return { registry: next, removedAssociations, dependencies, actions, removeGlobalMcp };
-}
-
-const commandOk = (result) => result?.ok === true || result?.status === 0;
-
-function parseConnectorLifecycle(raw, connector) {
-  const value = String(raw || '').trim();
-  if (!value) return null;
-  if (/^detach$/i.test(value)) return { action: 'detach' };
-  if (/^(?:uninstall|remove)$/i.test(value)) return { action: 'uninstall' };
-  const reassign = value.match(/^(?:reassign|profile|move)(?::|\s+)([A-Za-z0-9][A-Za-z0-9_-]{0,31})$/i);
-  if (reassign) return { action: 'reassign', profileId: reassign[1] };
-  throw new Error(`${connector} action must be detach, uninstall, or reassign:<profile-id>`);
-}
-
-function connectorRuntime(connector, home) {
-  return connector === 'telegram'
-    ? { path: tgConfigPath(process.env, home), bin: 'ours-tg-connector', pkg: '@ours.network/tg-connector' }
-    : { path: coworkConfigPath(process.env, home), bin: 'ours-cowork', pkg: '@ours.network/cowork' };
-}
-
-function connectorConfigText(connector, current, action) {
-  const next = { ...current };
-  if (action.mode === 'reassign') {
-    if (connector === 'telegram') {
-      next.daemonUrl = daemonEndpoint(action.profile.port);
-      next.daemonStateDir = action.profile.stateDir;
-    } else {
-      next.daemon = {
-        ...(current.daemon && typeof current.daemon === 'object' ? current.daemon : {}),
-        mode: 'external', endpoint: daemonEndpoint(action.profile.port), stateDir: action.profile.stateDir,
-      };
-    }
-  } else if (connector === 'telegram') {
-    delete next.daemonUrl;
-    delete next.daemonStateDir;
-  } else {
-    delete next.daemon;
-  }
-  return `${JSON.stringify(next, null, 2)}\n`;
-}
-
-function rollbackConnectorLifecycles(applied, run) {
-  let ok = true;
-  for (const item of [...applied].reverse()) {
-    try { restoreConfig(item.runtime.path, item.before); }
-    catch { ok = false; continue; }
-    const restored = commandOk(run(item.runtime.bin, ['install-service']));
-    ok &&= restored;
-  }
-  return ok;
-}
-
-function applyConnectorLifecycle(action, current, { home, run }) {
-  const runtime = connectorRuntime(action.connector, home);
-  const before = snapshotConfig(runtime.path);
-  const text = connectorConfigText(action.connector, current, action);
-  if (action.mode === 'reassign') {
-    const applied = transactionalConfigUpdate(runtime.path, text, () => ({
-      ok: commandOk(run(runtime.bin, ['install-service'])),
-    }));
-    return applied.ok
-      ? { ok: true, runtime, before }
-      : { ok: false, error: `${action.connector} reassignment failed during ${applied.stage}` };
-  }
-  const stopped = run(runtime.bin, ['uninstall-service']);
-  if (!commandOk(stopped)) return { ok: false, error: `${action.connector} service detach failed` };
-  try { atomicWriteConfig(runtime.path, text); }
-  catch (error) {
-    run(runtime.bin, ['install-service']);
-    return { ok: false, error: `${action.connector} config detach failed: ${error.message}` };
-  }
-  return { ok: true, runtime, before };
-}
-
-function removeHarnessArtifacts(application, { run, npm, home }) {
-  if (application === 'claude-code') {
-    const plugin = run('claude', ['plugin', 'uninstall', 'ours@ours.network']);
-    if (!commandOk(plugin)) return false;
-    const market = run('claude', ['plugin', 'marketplace', 'remove', 'ours.network']);
-    return commandOk(market);
-  }
-  if (application === 'codex') {
-    const plugin = run('codex', ['plugin', 'remove', 'ours@ours-codex-marketplace']);
-    if (!commandOk(plugin)) return false;
-    const market = run('codex', ['plugin', 'marketplace', 'remove', 'ours-codex-marketplace']);
-    if (!commandOk(market)) return false;
-    const codex = process.env.CODEX_DIR || join(home, '.codex');
-    const skills = process.env.SKILLS_DIR || join(home, '.agents', 'skills');
-    stripBlock(join(codex, 'config.toml'), YAML_START, YAML_END);
-    stripBlock(join(codex, 'AGENTS.md'), MD_START, MD_END);
-    for (const path of [join(skills, 'ours'), join(skills, 'writing-agent-bios')]) {
-      if (existsSync(path)) rmSync(path, { recursive: true, force: true });
-    }
-    return commandOk(run(npm, ['rm', '-g', '@ours.network/codex']));
-  }
-  if (application === 'hermes') {
-    const hermes = process.env.HERMES_DIR || join(home, '.hermes');
-    stripBlock(join(hermes, 'config.yaml'), YAML_START, YAML_END);
-    for (const path of [
-      join(hermes, 'skills', 'communication', 'ours'),
-      join(hermes, 'skills', 'communication', 'writing-agent-bios'),
-    ]) if (existsSync(path)) rmSync(path, { recursive: true, force: true });
-    return commandOk(run(npm, ['rm', '-g', '@ours.network/hermes']));
-  }
-  return false;
-}
-
-function exactServiceEnv(profile) {
-  return {
-    OURS_CONFIG: profile.configPath,
-    OURS_PORT: String(profile.port),
-    OURS_STATE_DIR: profile.stateDir,
-    ...(profile.serviceName ? { OURS_SERVICE_NAME: profile.serviceName } : {}),
-  };
-}
-
-export function runNightlyUninstaller({ ttyFd, write, run, npm, assumeYes, finish }) {
-  const home = process.env.HOME || homedir();
-  const registryFile = profilesPath(process.env, home);
-  let registry;
-  try { registry = readRegistry(registryFile, { allowMissing: false }); }
-  catch (error) { say(`Nightly profile registry is unavailable: ${error.message}`); finish(ttyFd); return; }
-  let telegramConfig;
-  let roomsConfig;
-  try {
-    telegramConfig = readObject(tgConfigPath(process.env, home));
-    roomsConfig = readObject(coworkConfigPath(process.env, home));
-  } catch (error) {
-    say(`Refusing Nightly uninstall: ${error.message}`);
-    finish(ttyFd); return;
-  }
-  line(heading('Nightly profile-aware uninstall'));
-  const envHarnesses = process.env.OURS_UNINSTALL;
-  let removeHarnesses;
-  if (envHarnesses != null) removeHarnesses = canonHarnesses(envHarnesses).names;
-  else if (ttyFd != null) removeHarnesses = checkboxSelect(write, ttyFd, [
-    { name: 'claude-code', label: 'Claude Code plugin + its profile association' },
-    { name: 'codex', label: 'Codex plugin + its profile association' },
-    { name: 'hermes', label: 'Hermes plugin + its profile association' },
-  ], { title: 'Choose harness plugins to remove' });
-  else removeHarnesses = [];
-
-  const ids = Object.keys(registry.profiles);
-  let profileId = process.env.OURS_UNINSTALL_PROFILE || '';
-  if (!profileId && ttyFd != null && ids.length) {
-    line('  Profiles: ' + ids.map((id, index) => `${index + 1}) ${id}`).join(' · '));
-    const choice = askLine(write, ttyFd, '  Profile to forget/remove (Enter keeps all): ', '');
-    if (/^\d+$/.test(choice)) profileId = ids[Number(choice) - 1] || '';
-    else profileId = choice;
-  }
-  const forgetProfile = !!profileId && (process.env.OURS_UNINSTALL_FORGET_PROFILE === 'yes' || (!assumeYes && ttyFd != null && askLine(write, ttyFd, `  Type 'forget ${profileId}' to remove metadata only: `, '') === `forget ${profileId}`));
-  const removeDaemon = !!profileId && (process.env.OURS_UNINSTALL_DAEMON === 'yes' || (!assumeYes && ttyFd != null && askLine(write, ttyFd, `  Type 'remove ${profileId}' to remove its installer-owned service: `, '') === `remove ${profileId}`));
-  let deleteData = false;
-  if (removeDaemon && process.env.OURS_UNINSTALL_DATA === 'yes') deleteData = true;
-  else if (removeDaemon && ttyFd != null) {
-    const path = registry.profiles[profileId]?.stateDir;
-    if (path) {
-      line(c.red(`  Data deletion permanently destroys identities and private keys at ${path}.`));
-      deleteData = askLine(write, ttyFd, `  Type the exact path ${path} to confirm key loss, or Enter to keep data: `, '') === path;
-    }
-  }
-
-  const connectorActions = {};
-  if (profileId && (forgetProfile || removeDaemon)) {
-    const dependencies = reverseApplicationIndex(registry, { telegramConfig, roomsConfig })[profileId] || [];
-    for (const connector of ['telegram', 'rooms']) {
-      if (!dependencies.includes(connector)) continue;
-      const envName = connector === 'telegram' ? 'OURS_UNINSTALL_TELEGRAM' : 'OURS_UNINSTALL_ROOMS';
-      let raw = process.env[envName] || '';
-      if (!raw && !assumeYes && ttyFd != null) {
-        raw = askLine(
-          write, ttyFd,
-          `  ${connector} uses ${profileId}. Type detach, uninstall, or reassign:<retained-profile-id>: `,
-          '',
-        );
-      }
-      try {
-        const parsed = parseConnectorLifecycle(raw, connector);
-        if (parsed) connectorActions[connector] = parsed;
-      } catch (error) {
-        say(`Refusing Nightly uninstall: ${error.message}`); finish(ttyFd); return;
-      }
-    }
-  }
-
-  let plan;
-  try {
-    plan = planNightlyUninstall(registry, {
-      removeHarnesses, profileId: profileId || undefined, forgetProfile, removeDaemon,
-      deleteData, connectorActions,
-    }, { telegramConfig, roomsConfig });
-  } catch (error) { say(`Refusing uninstall plan: ${error.message}`); finish(ttyFd); return; }
-
-  for (const application of removeHarnesses) {
-    if (!removeHarnessArtifacts(application, { run, npm, home })) {
-      say(`Could not remove ${application} artifacts; its registry association was left unchanged.`);
-      finish(ttyFd); return;
-    }
-  }
-  const connectorConfigs = { telegram: telegramConfig, rooms: roomsConfig };
-  const appliedConnectors = [];
-  for (const action of plan.actions) {
-    if (action.type !== 'connector-lifecycle') continue;
-    const result = applyConnectorLifecycle(action, connectorConfigs[action.connector], { home, run });
-    if (!result.ok) {
-      const recovered = rollbackConnectorLifecycles(appliedConnectors, run);
-      say(`${result.error}; daemon/profile registry left unchanged.${recovered ? '' : ' Earlier connector rollback also failed; inspect those services.'}`);
-      finish(ttyFd); return;
-    }
-    appliedConnectors.push({ ...result, action });
-  }
-  const removedServices = [];
-  for (const action of plan.actions) {
-    if (action.type === 'uninstall-service') {
-      const result = run('ours-mcp', ['uninstall-service'], { env: exactServiceEnv(action.profile) });
-      if (!commandOk(result)) {
-        const recovered = rollbackConnectorLifecycles(appliedConnectors, run);
-        say(`Could not uninstall the exact service for ${action.profileId}; registry left unchanged.${recovered ? '' : ' Connector rollback also failed; inspect those services.'}`);
-        finish(ttyFd); return;
-      }
-      removedServices.push(action);
-    }
-    if (action.type === 'external-service-kept') say(`Profile ${action.profileId} is external; its service/config/state were left untouched.`);
-  }
-  try { writeRegistry(registryFile, plan.registry); }
-  catch (error) {
-    let recovered = true;
-    for (const action of removedServices.reverse()) {
-      const restored = commandOk(run('ours-mcp', ['install-service'], { env: exactServiceEnv(action.profile) }));
-      recovered &&= restored;
-    }
-    const connectorsRecovered = rollbackConnectorLifecycles(appliedConnectors, run);
-    recovered &&= connectorsRecovered;
-    say(`Registry commit failed: ${error.message}. ${recovered ? 'Removed services/connectors were restored.' : 'Service recovery also failed; inspect the exact profile and connector services.'}`);
-    finish(ttyFd); return;
-  }
-  for (const action of plan.actions) {
-    if (action.type === 'delete-state') {
-      if (existsSync(action.path)) rmSync(action.path, { recursive: true, force: true });
-      say(`Permanently removed ${action.path}; identities/keys there are not recoverable.`);
-    }
-    if (action.type === 'forget-metadata') say(`Forgot external profile ${action.profileId}; no daemon artifacts were changed.`);
-    if (action.type === 'connector-lifecycle' && action.mode === 'uninstall') {
-      const runtime = connectorRuntime(action.connector, home);
-      if (!commandOk(run(npm, ['rm', '-g', runtime.pkg]))) {
-        say(`${action.connector} was safely detached, but its global package could not be removed.`);
-      }
-    }
-  }
-  if (plan.removeGlobalMcp && (removeDaemon || forgetProfile)) run(npm, ['rm', '-g', '@ours.network/mcp']);
-  else say('Kept the global @ours.network/mcp package because retained profiles/applications still need it.');
-  say('Nightly uninstall complete.');
-  finish(ttyFd);
-}

package/lib/orchestrate-uninstall.mjs

@@ -1,293 +0,0 @@
-// ours-uninstall v3 — the orchestrator.
-//
-//   ours-uninstall [--state-dir PATH] [--purge] [--dry-run]
-//
-// Same shape as lib/orchestrate.mjs: every side effect arrives through one
-// injected `effects` object, every DECISION comes from lib/uninstall.mjs, which
-// is pure and separately tested.
-//
-// This file removes things, so two properties matter more here than anywhere
-// else in the installer:
-//
-//   NOTHING IS REMOVED AFTER A REFUSAL. Step 1 refuses before the first
-//   mutation, so a run that stops leaves the daemon exactly as it was rather
-//   than half-dismantled.
-//
-//   THE DESTRUCTIVE STEP IS LAST AND SEPARATELY GATED. --purge runs after
-//   everything else has succeeded, needs four gates open, and is the only step
-//   here that cannot be undone by re-running the installer.
-
-import { join } from 'node:path';
-import { parseInstallArgs, InstallUsageError } from './target.mjs';
-import { planUninstall, planComponentDetach, planStatePurge, stripManagedBlock } from './uninstall.mjs';
-import { tgConfigPath, coworkConfigPath } from './components.mjs';
-import { configJournal, reportRollback } from './journal.mjs';
-import { UNINSTALL_USAGE } from './usage.mjs';
-import { ok, info, warn, heading } from './ui.mjs';
-
-export const EXIT_OK = 0;
-export const EXIT_REFUSED = 2;
-
-async function perform(effects, dryRun, label, thunk) {
-  if (dryRun) {
-    effects.out(info(`[dry-run] would: ${label}`));
-    return { performed: false };
-  }
-  await thunk();
-  effects.out(ok(label));
-  return { performed: true };
-}
-
-/**
- * Which components are being removed alongside this daemon. Asked once, before
- * anything is touched, so the §8 step 1 refusal can be resolved in the same run
- * rather than sending the operator away and back.
- *
- * Non-interactively the answer is NO — assume-yes never consents to removing
- * something on the operator's behalf, and step 1 then refuses, which is the
- * correct outcome for an unattended run pointed at a daemon still in use.
- */
-export async function confirmComponentRemoval(pointing, { assumeYes, effects }) {
-  if (pointing.length === 0 || assumeYes) return [];
-  const confirmed = [];
-  for (const component of pointing) {
-    const answer = await effects.ask(
-      `${component.key} points at this daemon (${component.config}). Remove its attachment too?`,
-      false,
-    );
-    if (answer) confirmed.push(component.key);
-  }
-  return confirmed;
-}
-
-export async function runUninstall(argv, effects) {
-  let args;
-  try {
-    args = parseInstallArgs(argv.filter((a) => a !== '--purge'), effects.env, { home: effects.home });
-  } catch (error) {
-    if (error instanceof InstallUsageError) {
-      effects.out(warn(`ours: ${error.message}`));
-      return EXIT_REFUSED;
-    }
-    throw error;
-  }
-  if (args.help) { effects.out(UNINSTALL_USAGE); return EXIT_OK; }
-  if (args.version) { effects.out(`ours-uninstall v${effects.version ?? '?'}`); return EXIT_OK; }
-  const purge = argv.includes('--purge');
-  const dir = args.stateDir;
-  const config = effects.readJson(join(dir, 'config.json'));
-  const endpoint = `http://127.0.0.1:${typeof config?.port === 'number' ? config.port : 3050}`;
-
-  effects.out(heading(`ours-uninstall --state-dir ${dir}`));
-  if (args.dryRun) effects.out(info('dry-run: nothing will be removed or stopped'));
-
-  // Ask first, mutate second. The question is about resolving the step-1
-  // refusal, so it has to come before the plan that would refuse.
-  // `readText` is passed alongside `readJson` so the planner can tell an ABSENT
-  // component config from a CORRUPT one. Without it, effects.readJson's null
-  // stands for both, and a file that will not parse reads as "no connector points
-  // here" — which removes the daemon out from under a live connector.
-  const probe = planUninstall({ home: effects.home, env: effects.env, endpoint, stateDir: dir, readJson: effects.readJson, readText: effects.readText });
-  if (probe.action === 'refuse' && probe.reason === 'component-config-unreadable') {
-    effects.out(warn(`ours: ${probe.message}`));
-    return EXIT_REFUSED;
-  }
-  const pointing = probe.action === 'refuse' ? probe.components : [];
-  const confirmedComponents = await confirmComponentRemoval(pointing, { assumeYes: args.assumeYes, effects });
-
-  const plan = planUninstall({
-    home: effects.home,
-    env: effects.env,
-    endpoint,
-    stateDir: dir,
-    purge,
-    assumeYes: args.assumeYes,
-    confirmedComponents,
-    readJson: effects.readJson,
-    readText: effects.readText,
-    exists: effects.exists,
-    cliStartedIt: effects.readJson(join(dir, 'ours-cli-daemon.json')) !== null,
-    otherStateDirsWithConfig: effects.knownStateDirs(),
-    typedConfirmation: null,
-  });
-
-  if (plan.action === 'refuse') {
-    effects.out(warn(`ours: ${plan.message}`));
-    return EXIT_REFUSED;
-  }
-
-  // 2. Component services and configs. The FILE is kept — it also holds the
-  //    operator's bot token and settings, which were never ours.
-  //
-  // THE UNIT OF WORK HERE SPANS STEPS 2 THROUGH 4, and that is what makes it
-  // different from the install-side journals. A detached connector's stripped
-  // config says "no longer attached to this daemon", and only the daemon's actual
-  // removal makes that true. If step 3 or 4 fails, the operator is left with a
-  // stopped, detached connector NEXT TO A DAEMON THAT IS STILL THERE — a world the
-  // bytes no longer describe.
-  const journal = configJournal(effects, { dryRun: args.dryRun });
-  const detached = [];
-  for (const component of plan.detach) {
-    const path = component.key === 'tg' ? tgConfigPath(effects.home, effects.env) : coworkConfigPath(effects.home, effects.env);
-    const detach = planComponentDetach(component.key, effects.readJson(path));
-    if (detach.behaviourChange) effects.out(warn(`${component.key}: ${detach.behaviourChange}`));
-    await perform(effects, args.dryRun, `${component.service.join(' ')}`, () => effects.run(component.service[0], component.service.slice(1)));
-    // Recorded whether or not its config changed: the SERVICE was stopped either
-    // way, so a rollback owes it a re-apply either way.
-    detached.push({ key: component.key, path, service: [component.service[0], 'install-service'] });
-    if (detach.removed.length > 0) {
-      journal.snapshot(path);
-      await perform(effects, args.dryRun, `remove ${detach.removed.join(', ')} from ${path} (file kept)`, () => effects.writeJson(path, `${JSON.stringify(detach.config, null, 2)}\n`));
-    }
-  }
-
-  // 3-4. The boot service, then the daemon. Both delegate their refusals.
-  try {
-    for (const step of plan.daemon) {
-      if (step.command === null) {
-        effects.out(info(`${step.note} — nothing signalled`));
-        continue;
-      }
-      await perform(effects, args.dryRun, step.command.join(' '), () => effects.run(step.command[0], step.command.slice(1)));
-    }
-  } catch (error) {
-    await rollBackDetach(effects, journal, detached, args);
-    throw error;
-  }
-
-  // 5. The harness plugins the installer wrote.
-  await runPluginPhase(plan.plugins, { args, effects });
-
-  // 6. State. Last, because it is the only irreversible thing here.
-  await runPurgePhase({ dir, purge, args, effects });
-
-  // 7. Global packages, only when this was the last daemon.
-  if (plan.packages.action === 'keep') {
-    effects.out(info(`@ours.network/cli kept — ${plan.packages.reason}`));
-  } else {
-    for (const pkg of plan.packages.packages) {
-      await perform(effects, args.dryRun, `npm rm -g ${pkg}`, () => effects.run('npm', ['rm', '-g', pkg]));
-    }
-  }
-  return EXIT_OK;
-}
-
-/**
- * Undo a detach when the daemon it was detaching FROM did not go away.
- *
- * THIS ONE NEEDS A COMMAND, NOT JUST BYTES, and that is the whole reason it is a
- * separate function from the install side's rollback. The detach stopped the
- * connector's service before stripping its config, so restoring the bytes under a
- * stopped service is a HALF rollback — and half-states are exactly what this
- * feature exists to eliminate. The config goes back and then `install-service` is
- * re-applied, which is what the nightly uninstaller does
- * (lib/nightly-uninstall.mjs `rollbackConnectorLifecycles`), rather than a second
- * approach invented here.
- *
- * Every failure inside the recovery is REPORTED and none is thrown: the caller is
- * already on a failure path, and a recovery failure must never be what the
- * operator sees instead of the real fault. The original error is what propagates.
- */
-export async function rollBackDetach(effects, journal, detached, args) {
-  if (args.dryRun || detached.length === 0) return { restored: [], reapplied: [], failed: [] };
-  effects.out(warn('the daemon was not removed, so the connectors are still attached to it — putting them back'));
-  const outcome = journal.restoreAll();
-  const reapplied = [];
-  const failed = [];
-  for (const component of detached.slice().reverse()) {
-    try {
-      await effects.run(component.service[0], component.service.slice(1));
-      effects.out(ok(`${component.service.join(' ')} — ${component.key} is attached and running again`));
-      reapplied.push(component.key);
-    } catch (error) {
-      failed.push(component.key);
-      effects.out(warn(`could NOT re-apply ${component.key}'s service: ${error instanceof Error ? error.message : String(error)} — its config is back but the service is down; run '${component.service.join(' ')}' yourself`));
-    }
-  }
-  reportRollback(effects, outcome, { packagesInstalled: false });
-  return { ...outcome, reapplied, failed };
-}
-
-/**
- * The harness plugins: the managed config blocks, the ours skills directories,
- * and the plugin launchers on npm.
- *
- * Without this, a v3 uninstall is a capability REGRESSION against the v2 one —
- * it would remove the daemon and leave every harness still advertising ours
- * tools that no longer resolve.
- *
- * Two rules, both inherited rather than invented. A config file is edited only
- * when both our sentinels are found, and an unterminated block is REPORTED and
- * left alone rather than truncated to end-of-file (which is what v2 did, and it
- * would take everything the user wrote after our block with it). And the whole
- * phase is skipped while another daemon is still on this machine, because its
- * harnesses still need these plugins — the same condition that keeps the global
- * packages, decided once.
- */
-export async function runPluginPhase(plugins, { args, effects }) {
-  effects.out(heading('Harness plugins'));
-  for (const step of plugins.manual) {
-    // Never a dead end, and never a claim: Claude Code's plugin is not ours to
-    // remove, so the run says so and prints the two commands that do it.
-    effects.out(info(`${step.label} — ${step.reason}. Inside Claude Code, run:`));
-    for (const command of step.steps) effects.out(info(`  ${command}`));
-  }
-  if (plugins.action === 'keep') {
-    effects.out(info(`harness plugins kept — ${plugins.reason}`));
-    return;
-  }
-  if (plugins.harnesses.length === 0) {
-    effects.out(info('no Hermes or Codex plugin files found — nothing of ours to remove'));
-    return;
-  }
-
-  for (const harness of plugins.harnesses) {
-    for (const block of harness.blocks) {
-      const before = effects.readText(block.path);
-      if (before === null) continue;
-      const stripped = stripManagedBlock(before, block.markers);
-      if (stripped.action === 'absent') {
-        effects.out(info(`${block.path} carries no ours block — left untouched`));
-        continue;
-      }
-      if (stripped.action === 'refuse') {
-        effects.out(warn(`${block.path}: ${stripped.reason}. Remove it by hand.`));
-        continue;
-      }
-      await perform(effects, args.dryRun, `remove the ours managed block from ${block.path} (file kept)`, () => effects.writeText(block.path, stripped.text));
-    }
-    for (const dir of harness.dirs) {
-      if (!effects.exists(dir)) continue;
-      await perform(effects, args.dryRun, `remove ${dir}`, () => effects.removeDir(dir));
-    }
-    for (const file of harness.files) {
-      if (!effects.exists(file)) continue;
-      await perform(effects, args.dryRun, `remove ${file}`, () => effects.removeFile(file));
-    }
-  }
-}
-
-/**
- * --purge, gated four ways and asked for by typing the full path.
- *
- * The typed answer is compared by the pure planner, not here, so the comparison
- * cannot drift from the one the tests pin. A wrong or empty answer keeps the
- * state directory — there is no retry loop, because a second chance at deleting
- * identity keys is not a kindness.
- */
-export async function runPurgePhase({ dir, purge, args, effects }) {
-  const asked = planStatePurge({ stateDir: dir, purge, assumeYes: args.assumeYes, exists: effects.exists });
-  if (asked.action === 'keep') {
-    effects.out(info(`state ${dir} kept — ${asked.reason}`));
-    if (!purge) effects.out(info(asked.hint));
-    return { purged: false };
-  }
-  const typed = await effects.askLine(asked.prompt);
-  const decided = planStatePurge({ stateDir: dir, purge, assumeYes: args.assumeYes, exists: effects.exists, typedConfirmation: typed });
-  if (decided.action !== 'purge') {
-    effects.out(info(`state ${dir} kept — the typed path did not match`));
-    return { purged: false };
-  }
-  await perform(effects, args.dryRun, `delete ${dir} and everything in it`, () => effects.removeDir(dir));
-  return { purged: !args.dryRun };
-}