@ours.network/install 0.17.0-nightly.9 → 0.17.1

package/install.mjs

@@ -2,16 +2,9 @@
 // ours.network — the unified `ours-install` experience (the real UX behind install.sh's thin
 // bootstrap, and the `ours-install` command once the stack is on the machine).
 //
-// ONE installer for the WHOLE stack — the shared ours daemon + the harness plugins (Claude Code /
-// Codex / Hermes) + ours-fleet + the Telegram connector + Rooms (ours-cowork) — for someone who
-// ALREADY has Claude, Codex, and/or Hermes.
-//
-// TOPOLOGY. Step 1 installs and configures ONE shared daemon and the user picks its listen port
-// there; every consumer below is wired to that endpoint. The Telegram connector may instead be
-// given its OWN daemon — its own port, state directory and boot unit — chosen independently, and
-// defaulting to the shared one so Enter and non-interactive runs keep the historical topology.
-// Rooms answers the same question, plus a third answer the connector has no use for: keeping
-// cowork's own EMBEDDED daemon, which is what every pre-PR#9 cowork install runs (see step 5).
+// ONE installer for the WHOLE stack — ours core (the daemon) + the harness plugins (Claude Code /
+// Codex / Hermes) + ours-fleet + the Telegram connector — for someone who ALREADY has Claude,
+// Codex, and/or Hermes.
 // Its whole job: install the stack cleanly, then hand back ONE copy-paste prompt the user drops
 // into their agent to finish remaining configuration conversationally. Voice API credentials are
 // the one guided secret flow: interactive, masked, optional, and written atomically with mode 0600.
@@ -27,46 +20,43 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { readFileSync, existsSync } from 'node:fs';
 import { homedir, userInfo, platform as osPlatform, release as osRelease } from 'node:os';
-import { join, resolve } from 'node:path';
+import { join } from 'node:path';
 import { banner, heading, ok, info, warn, c, box, withSpinner, openTty, makeWriter, closeSync } from './lib/ui.mjs';
 import { askLine, askYesNo, isCancel } from './lib/prompt.mjs';
 import {
   suggestPort, parsePort, validateBroker, mergeConfig, parseVersion, parseStatus,
   detectPlatform, classifyHarnessProbe, buildHandoffPrompt,
-  voiceSetupStatus, resolveSharedBroker, tgConfigPath, planTgDaemonConfig, daemonEndpoint,
+  voiceSetupStatus,
   DEFAULT_PORT, resolveChannel, pkgSpec,
-  validateDaemonPort, planPorts, dedicatedDaemonPaths, DEDICATED_INSTANCES,
-  coworkConfigPath, planCoworkConfig, COWORK_DEFAULT_PORT, coworkDaemonMode,
-  coworkSupportsExternalDaemon, COWORK_EXTERNAL_MIN_VERSION,
 } from './lib/logic.mjs';
 import { atomicWriteConfig } from './lib/config.mjs';
-import { realEffects } from './lib/effects.mjs';
-import { runInstall as runInstallV3 } from './lib/orchestrate.mjs';
+import {
+  buildClaudeMarketplace, buildCodexMarketplace, marketplaceJson, marketplacePaths,
+  parseNpmVersion, validateChannelVersion,
+} from './lib/marketplace.mjs';
 
 const NPM = process.env.OURS_NPM || 'npm';
-// Release channel: OURS_CHANNEL=nightly installs each package's PRERELEASE dist-tag —
-// @nightly for mcp/tg-connector/fleet/the plugin launchers, and @latest for cowork,
-// and @next for cowork, whose repo has always called its prerelease line `next`
-// (see PKG_CHANNEL_TAGS in lib/logic.mjs). With no explicit
-// selection the installer follows its OWN channel, so a nightly installer builds a
-// nightly stack instead of silently mixing tags across an architecture boundary.
-const CHANNEL = resolveChannel(process.env.OURS_CHANNEL || process.env.OURS_INSTALL_CHANNEL, pkgVersion());
+// A published installer selects its OWN channel when the environment is silent:
+// X.Y.Z-nightly.N follows @nightly; a clean X.Y.Z follows @latest. Explicit legacy
+// channel overrides still win in both directions.
+const CHANNEL = resolveChannel(
+  process.env.OURS_CHANNEL || process.env.OURS_INSTALL_CHANNEL,
+  pkgVersion(),
+);
 const spec = (pkgKey) => pkgSpec(pkgKey, CHANNEL); // → "@ours.network/<key>@<tag>"
 let DRY = !!process.env.OURS_INSTALL_DRY_RUN;
 const SELFHOST_URL = 'ours.network';
-const CLAUDE_MARKET = 'adapt-toolkit/ours-claude-marketplace';
-const CODEX_MARKET = 'adapt-toolkit/ours-codex-marketplace';
+const MARKETPLACE_PATHS = marketplacePaths(homedir());
 
 const sink = (s) => process.stdout.write(s);
 const line = (s = '') => sink(`${s}\n`);
 const say = (s) => sink(`ours: ${s}\n`);
 
 // --- external command helpers (never throw; the installer degrades, it doesn't crash) ----------
-function run(bin, args, { capture = false, timeout, env } = {}) {
+function run(bin, args, { capture = false, timeout } = {}) {
   const r = spawnSync(bin, args, {
     encoding: 'utf8',
     timeout,
-    env: env ? { ...process.env, ...env } : process.env,
     stdio: capture ? ['ignore', 'pipe', 'pipe'] : 'inherit',
   });
   const timedOut = !!(r.error && (r.error.code === 'ETIMEDOUT' || r.signal === 'SIGTERM'));
@@ -104,33 +94,120 @@ async function actSpin(label, desc, fn) {
 
 // --- daemon probes (always safe to run — read-only) --------------------------------------------
 const daemonVersionLine = () => (run('ours-mcp', ['--version'], { capture: true }).out.split('\n')[0] || '').trim();
-const daemonStatusText = (env) => run('ours-mcp', ['status'], { capture: true, ...(env ? { env } : {}) }).out;
+const daemonStatusText = () => run('ours-mcp', ['status'], { capture: true }).out;
 function daemonLifecycleState() {
   const status = run('ours-mcp', ['status'], { capture: true });
   if (!status.ok) return 'stopped';
   return /^\s*pid:\s*\d+/m.test(status.out) ? 'managed' : 'external';
 }
 const daemonRunning = () => daemonLifecycleState() !== 'stopped';
-// LISTENING, not merely alive — and the difference is not academic. `ours-mcp start`
-// exits 0 when it only FINDS a live pid in the state directory (core cmdStart: it
-// checks `isAlive(pid)` and nothing else, so a pid file left by a previous boot whose
-// number now belongs to any other process reads as "already running"). `ours-mcp
-// status` then exits 0 for that same pid while printing "(port not answering!)" —
-// core cmdStatus only sets a non-zero exit for the no-pid case. So neither exit code
-// proves a daemon is there, and a readiness line built from one can tell the user
-// "ready — no problems" about a port nothing is bound to. The status line the daemon
-// prints only when the port actually answered is the honest signal, so use it.
-const daemonReachable = (env) => /\(reachable\)/.test(daemonStatusText(env));
-// The installed version of a global package, INCLUDING any prerelease suffix. The
-// suffix is not cosmetic here: the Rooms daemon guard compares against an exact
-// `0.4.1-nightly.<date>.<sha>` floor, and truncating at the dash would make every
-// 0.4.1 nightly look alike — including ones published before the mode existed.
 const globalVersion = (pkg) => {
   const ls = run(NPM, ['ls', '-g', pkg], { capture: true }).out;
-  const m = ls.match(new RegExp(pkg.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&') + '@(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)'));
+  const m = ls.match(new RegExp(pkg.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&') + '@([0-9][0-9.]*)'));
   return m ? m[1] : '';
 };
 
+function resolveExactPackage(pkgKey) {
+  const packageName = `@ours.network/${pkgKey}`;
+  const tag = CHANNEL === 'nightly' ? 'nightly' : 'latest';
+  const viewed = run(NPM, ['view', `${packageName}@${tag}`, 'version', '--json'], { capture: true, timeout: 15000 });
+  if (!viewed.ok) {
+    return { ok: false, packageName, tag, reason: `npm could not resolve ${packageName}@${tag}` };
+  }
+  const checked = validateChannelVersion(parseNpmVersion(viewed.out), CHANNEL);
+  if (!checked.ok) return { ...checked, packageName, tag };
+  return { ok: true, packageName, tag, version: checked.version };
+}
+
+function resolveExactSuite() {
+  const packages = {};
+  for (const key of ['mcp', 'claude-code', 'codex']) {
+    const resolved = resolveExactPackage(key);
+    if (!resolved.ok) return resolved;
+    packages[key] = resolved;
+  }
+  const versions = new Set(Object.values(packages).map((entry) => entry.version));
+  if (versions.size !== 1) {
+    const detail = Object.values(packages).map((entry) => `${entry.packageName}=${entry.version}`).join(', ');
+    return {
+      ok: false,
+      packageName: '@ours.network/{mcp,claude-code,codex}',
+      tag: CHANNEL,
+      reason: `the ${CHANNEL} dist-tags are not lockstep (${detail})`,
+    };
+  }
+  return { ok: true, channel: CHANNEL, version: versions.values().next().value, packages };
+}
+
+async function prepareExactMarketplace(pkgKey, resolved) {
+  const claude = pkgKey === 'claude-code';
+  const root = claude ? MARKETPLACE_PATHS.claudeRoot : MARKETPLACE_PATHS.codexRoot;
+  const manifest = claude ? MARKETPLACE_PATHS.claudeManifest : MARKETPLACE_PATHS.codexManifest;
+  const value = claude
+    ? buildClaudeMarketplace(resolved.version, CHANNEL)
+    : buildCodexMarketplace(resolved.version, CHANNEL);
+  const written = await act(
+    `write exact ${pkgKey} marketplace (${resolved.packageName}@${resolved.version}) to ${manifest}`,
+    async () => {
+      try {
+        atomicWriteConfig(manifest, marketplaceJson(value));
+        return { ok: true };
+      } catch (error) {
+        return { ok: false, error };
+      }
+    },
+  );
+  if (!written.ok) {
+    return { ...resolved, ok: false, reason: `could not write the exact marketplace at ${manifest}` };
+  }
+  return { ...resolved, root, manifest };
+}
+
+function exactResolutionFailure(label, result) {
+  line(warn(`Couldn't safely resolve ${label} on the ${CHANNEL} channel to an exact version.`));
+  line(info(`${result.reason || 'The npm registry returned an invalid version.'} Existing plugin setup was left unchanged.`));
+  line(info(`Check '${c.cyan(`npm view ${result.packageName}@${result.tag} version`)}', then re-run ours-install.`));
+}
+
+function configuredCodexMarketplace() {
+  const listed = run('codex', ['plugin', 'marketplace', 'list', '--json'], { capture: true, timeout: 6000 });
+  if (!listed.ok) return null;
+  try {
+    const parsed = JSON.parse(listed.out);
+    return parsed?.marketplaces?.find((marketplace) => marketplace?.name === 'ours-codex-marketplace') || null;
+  } catch {
+    return null;
+  }
+}
+
+function hasClaudePlugin(pluginId = 'ours@ours.network') {
+  const listed = run('claude', ['plugin', 'list', '--json'], { capture: true, timeout: 6000 });
+  if (!listed.ok) return false;
+  try {
+    const parsed = JSON.parse(listed.out);
+    return Array.isArray(parsed) && parsed.some((plugin) => plugin?.id === pluginId);
+  } catch {
+    return false;
+  }
+}
+
+async function addExactCodexMarketplace(exact) {
+  const current = configuredCodexMarketplace();
+  const source = current?.marketplaceSource;
+  const alreadyExact = source?.sourceType === 'local' && source?.source === exact.root;
+  if (current && !alreadyExact) {
+    const removed = await act(
+      'codex plugin marketplace remove ours-codex-marketplace (replace moving source with exact local source)',
+      async () => run('codex', ['plugin', 'marketplace', 'remove', 'ours-codex-marketplace'], { capture: true }),
+    );
+    if (!removed.ok) return removed;
+  }
+  return act(
+    `codex plugin marketplace add ${exact.root} (${exact.packageName}@${exact.version})`,
+    async () => run('codex', ['plugin', 'marketplace', 'add', exact.root], { capture: true }),
+  );
+}
+
 // --- config file (fixed home location; mirrors core/config.ts) ---------------------------------
 function configPath() { return process.env.OURS_CONFIG || join(homedir(), '.ours', 'config.json'); }
 function readConfigObject() { try { return JSON.parse(readFileSync(configPath(), 'utf8')); } catch { return {}; } }
@@ -140,18 +217,6 @@ function writeConfigPatch(patch) {
   return p;
 }
 
-// The daemon's state directory, resolved exactly the way packages/core/src/config.ts
-// resolves it (env > config file > ~/.ours). The Telegram connector needs the ABSOLUTE
-// path: the SDK reads the daemon's API token from it and refuses to send that token to
-// a separately-chosen endpoint unless the state dir was chosen just as deliberately.
-function daemonStateDir() {
-  const fromEnv = process.env.OURS_STATE_DIR?.trim();
-  if (fromEnv) return resolve(fromEnv);
-  const fromFile = readConfigObject().stateDir;
-  if (typeof fromFile === 'string' && fromFile.trim()) return resolve(fromFile.trim());
-  return join(homedir(), '.ours');
-}
-
 function daemonVoiceCapability() {
   const r = run('ours-mcp', ['voice-status', '--json'], { capture: true, timeout: 6000 });
   if (!r.ok) return null;
@@ -222,46 +287,22 @@ const USAGE = `ours-install — the unified ours.network stack installer.
 
   ours-install [--dry-run] [--help] [--version]
 
-Guided ~3-minute setup for the whole stack: the shared ours daemon (you pick its
-port), the harness plugins (Claude Code + Codex + Hermes), ours-fleet, the Telegram
-connector, and Rooms (ours-cowork) — then one copy-paste hand-off prompt. You approve
-each step; re-run any time to add a piece or update.
-
-Telegram can share the daemon from step 1 or be given its own (its own port, state
-directory and boot service); Enter keeps the shared one.
+Guided ~3-minute setup for the whole stack: ours core (the daemon), the harness
+plugins (Claude Code + Codex + Hermes), ours-fleet, and the Telegram connector — then one
+copy-paste hand-off prompt. You approve each step; re-run any time to add a piece
+or update.
 
   --dry-run    walk the whole flow and print what it WOULD do — install/change nothing
   --help       show this help and exit
   --version    print the installer version and exit
 
 Env: OURS_ASSUME_YES=1 (accept defaults, no prompts) · OURS_INSTALL_DRY_RUN=1 ·
-     OURS_NPM · OURS_CONFIG (default ~/.ours/config.json). Docs: https://ours.network`;
+     OURS_CHANNEL=latest|nightly (optional override) · OURS_NPM ·
+     OURS_CONFIG (default ~/.ours/config.json). Docs: https://ours.network`;
 
 // ===============================================================================================
 async function main() {
   const argv = process.argv.slice(2);
-
-  // ─── THE CHANNEL FORK ───────────────────────────────────────────────────────
-  // Nightly is the v3 installer, end to end. Owner ruling 2026-08-17: v3 SUBSUMES
-  // the nightly flow rather than being hosted by it, so this hands the whole run
-  // over — arguments, screens, refusals and exit code — and never returns.
-  //
-  // FIRST IN main(), BEFORE --help/--version, ON PURPOSE. Those used to be
-  // answered by the v2 body above, which would have printed v2's usage describing
-  // v2's flags for a run that is about to be v3's. Whatever prints the help must
-  // be whatever runs.
-  //
-  // The latest/stable body below is untouched and still serves that channel byte
-  // for byte; nothing a stable user does changes.
-  if (CHANNEL === 'nightly') {
-    const ttyFd = openTty();
-    const code = await runInstallV3(argv, realEffects({
-      write: makeWriter(ttyFd), ttyFd, env: process.env, version: pkgVersion(),
-    }));
-    finish(ttyFd);
-    process.exit(code);
-  }
-
   if (argv.includes('--help') || argv.includes('-h')) { process.stdout.write(USAGE + '\n'); return; }
   if (argv.includes('--version') || argv.includes('-V')) { process.stdout.write(`ours-install v${pkgVersion()}\n`); return; }
   if (argv.includes('--dry-run')) DRY = true;
@@ -340,6 +381,18 @@ async function main() {
     finish(ttyFd); return;
   }
 
+  // Resolve the release boundary before making any change. The install package is
+  // published last in the lockstep suite, so its selected channel must already expose
+  // one identical exact MCP/Claude/Codex version. Partial or malformed registry state
+  // fails closed instead of creating a mixed installation.
+  const exactSuite = resolveExactSuite();
+  if (!exactSuite.ok) {
+    line('');
+    exactResolutionFailure('ours.network suite', exactSuite);
+    finish(ttyFd); return;
+  }
+  line(ok(`Release channel: ${exactSuite.channel} → exact lockstep suite v${exactSuite.version}`));
+
   // Daemon state up front (decides first-install vs update, and whether Step 0 runs at all).
   const versionBefore = daemonVersionLine();
   const daemonInstalled = !!versionBefore;
@@ -349,44 +402,56 @@ async function main() {
   line('');
   cont();
 
+  // ============================================================================================
+  // STEP 0 — the two config questions (asked ONCE, up front). SKIPPED entirely when a daemon is
+  // already configured (update path reuses its port/broker; delta #1859).
+  // ============================================================================================
   const status0 = parseStatus(daemonStatusText());
   let chosenBroker;     // undefined = keep default / existing
   let chosenPort = status0.port || DEFAULT_PORT;
   const configFirst = !daemonInstalled;
 
-  // Every port this run has committed to, so a later daemon can't be handed one an
-  // earlier daemon claimed. A live bind probe cannot see these — nothing is
-  // listening on them yet — which is exactly why they're tracked by hand.
-  const claimedPorts = [];
-  // The finished topology, for the end-of-run cross-check. Each entry is one thing that
-  // will try to BIND a port, named so a collision can be reported in the user's terms.
-  const topology = [];
-  const claimPort = (port, label) => {
-    if (!Number.isInteger(port)) return;
-    if (!claimedPorts.includes(port)) claimedPorts.push(port);
-    if (label) topology.push({ label, port });
-  };
+  if (configFirst) {
+    line(heading('A couple of quick settings'));
+    // 0a — broker (owner edit #1: SECURE wording; owner edit #2: self-host → website only).
+    line(info('Your agents connect through a "broker" — a shared meeting point that lets them find'));
+    line(info("each other. It's secure: your messages are end-to-end encrypted, so the broker never"));
+    line(info('sees what they say. Almost everyone uses the standard one — just press Enter.'));
+    const custom = yes('  Use a custom broker address?', false);
+    if (custom) {
+      line(info(`(Only needed if you run your own broker. More at ${SELFHOST_URL}.)`));
+      const entered = ask('  Enter the broker address: ', '');
+      const v = validateBroker(entered);
+      if (entered && v.ok && !v.empty) {
+        // Undo safety net: a mistaken custom entry is one keystroke back to the standard broker.
+        const keep = yes(`  Use "${v.value}"?  (No = go back to the standard broker)`, true);
+        if (keep) { chosenBroker = v.value; line(ok(`broker set to ${chosenBroker}.`)); }
+        else line(ok('using the standard broker.'));
+      } else {
+        if (entered) line(warn(`"${entered}" doesn't look like a ws:// address — using the standard broker.`));
+        else line(ok('using the standard broker.'));
+      }
+    } else {
+      line(ok('using the standard broker.'));
+    }
 
-  // Ask for ONE daemon's port, validate it, and keep asking until the answer is
-  // usable. Enter (and every non-interactive run) takes `def` unchanged — that is
-  // what keeps the historical behaviour and scripted installs identical.
-  const askDaemonPort = (prompt, def) => {
-    let candidate = def;
-    for (let attempt = 0; attempt < 3; attempt++) {
-      const raw = ask(`  ${prompt}  ${c.gray(`[Enter for ${candidate}]`)}: `, String(candidate));
-      const v = validateDaemonPort(raw, { fallback: candidate, isTaken: portTakenSync, taken: claimedPorts });
-      if (v.ok) return v.port;
-      line(warn(`${v.reason}.`));
-      if (!interactive) break;   // no one to re-ask; fall through to a suggestion
-      candidate = suggestPort(v.port + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-      line(info(`Suggesting ${candidate} instead.`));
+    // 0b — port: probe 3050; only ask if busy. Minimize the concept.
+    if (!portTakenSync(DEFAULT_PORT)) {
+      chosenPort = DEFAULT_PORT;
+      line(ok(`Using local port ${DEFAULT_PORT}.`));
+    } else {
+      line(info(`The standard local port (${DEFAULT_PORT}) is already in use on your machine.`));
+      let candidate = suggestPort(DEFAULT_PORT + 1, portTakenSync);
+      const raw = ask(`  Pick another number for the ours daemon?  ${c.gray(`[Enter for ${candidate}]`)}: `, String(candidate));
+      const parsed = parsePort(raw, candidate);
+      candidate = suggestPort(parsed.ok ? parsed.port : candidate, portTakenSync);
+      chosenPort = candidate;
+      line(ok(`Using local port ${chosenPort}.`));
     }
-    // Out of attempts (or headless): take the first genuinely free port rather
-    // than persisting one we know is unusable.
-    const fallback = suggestPort(candidate, (p) => claimedPorts.includes(p) || portTakenSync(p));
-    line(ok(`Using port ${fallback}.`));
-    return fallback;
-  };
+    line('');
+    line(ok(`Config ready — broker: ${chosenBroker ? 'custom' : 'standard'}, port: ${chosenPort}.`));
+    cont();
+  }
 
   // Track outcomes for the summary + hand-off.
   const summary = [];
@@ -473,57 +538,13 @@ async function main() {
   };
 
   // ============================================================================================
-  // STEP 1 / 5 — the SHARED ours daemon. Its own visible step, and it owns its own configuration
-  // (broker + listen port) rather than a nameless "quick settings" preamble: every consumer below
-  // is wired to the endpoint chosen HERE, so the choice belongs to the step that makes it.
-  // Config-first within the step: choose → write config → optional voice → start ONCE.
+  // STEP 1 / 4 — ours core (the daemon). Config-first: write config → optional voice → start ONCE.
   // ============================================================================================
-  line(heading('1/5 — the shared ours daemon'));
-  line(info('This is the piece that lets your agents talk to each other securely. The harness'));
-  line(info('plugins, ours-fleet and the Telegram connector all connect to it — Telegram can be'));
-  line(info('given its own instead, later — and so can Rooms.'));
+  line(heading('1/4 — ours core (the daemon)'));
+  line(info('This is the piece that lets your agents talk to each other securely. Everything else'));
+  line(info('needs it.'));
   const before = parseVersion(versionBefore);
 
-  if (configFirst) {
-    // Broker (owner edit #1: SECURE wording; owner edit #2: self-host → website only).
-    line('');
-    line(info('Your agents connect through a "broker" — a shared meeting point that lets them find'));
-    line(info("each other. It's secure: your messages are end-to-end encrypted, so the broker never"));
-    line(info('sees what they say. Almost everyone uses the standard one — just press Enter.'));
-    const custom = yes('  Use a custom broker address?', false);
-    if (custom) {
-      line(info(`(Only needed if you run your own broker. More at ${SELFHOST_URL}.)`));
-      const entered = ask('  Enter the broker address: ', '');
-      const v = validateBroker(entered);
-      if (entered && v.ok && !v.empty) {
-        // Undo safety net: a mistaken custom entry is one keystroke back to the standard broker.
-        const keep = yes(`  Use "${v.value}"?  (No = go back to the standard broker)`, true);
-        if (keep) { chosenBroker = v.value; line(ok(`broker set to ${chosenBroker}.`)); }
-        else line(ok('using the standard broker.'));
-      } else {
-        if (entered) line(warn(`"${entered}" doesn't look like a ws:// address — using the standard broker.`));
-        else line(ok('using the standard broker.'));
-      }
-    } else {
-      line(ok('using the standard broker.'));
-    }
-
-    // Listen port. ALWAYS asked now, so the shared daemon's endpoint is a decision the
-    // user makes rather than one they only hear about when 3050 happens to be busy.
-    // The default is still 3050 (the next free port when it is taken), so Enter and
-    // every non-interactive run land exactly where they always did.
-    line('');
-    line(info('The daemon listens on a local port. Everything else in this install is pointed at it.'));
-    const portDefault = portTakenSync(DEFAULT_PORT) ? suggestPort(DEFAULT_PORT + 1, portTakenSync) : DEFAULT_PORT;
-    if (portDefault !== DEFAULT_PORT) line(info(`The standard port (${DEFAULT_PORT}) is already in use on your machine.`));
-    chosenPort = askDaemonPort('Which local port should the shared daemon use?', portDefault);
-    line(ok(`Shared daemon: port ${chosenPort}, broker ${chosenBroker ? 'custom' : 'standard'}.`));
-    line('');
-  } else {
-    line(ok(`Shared daemon already configured — port ${chosenPort}. Keeping it.`));
-  }
-  claimPort(chosenPort, 'the shared ours daemon');
-
   if (!daemonInstalled) {
     const goCore = yes('  Install and start it?', true);
     if (!goCore) {
@@ -532,31 +553,18 @@ async function main() {
       // Without a daemon the rest is moot; go straight to the summary.
       return endScreen({ ttyFd, summary, chosenPort, chosenBroker });
     }
-    await actSpin(`ensuring ${spec('mcp')}…`, `npm i -g ${spec('mcp')}`, () => runAsync(NPM, ['i', '-g', spec('mcp')]));
+    const exactMcp = `${exactSuite.packages.mcp.packageName}@${exactSuite.packages.mcp.version}`;
+    await actSpin(`ensuring ${exactMcp}…`, `npm i -g ${exactMcp}`, () => runAsync(NPM, ['i', '-g', exactMcp]));
     const patch = { port: chosenPort };
     if (chosenBroker) patch.brokerUrl = chosenBroker;
     await act(`write config (${configPath()}) with port ${chosenPort}${chosenBroker ? ' + custom broker' : ''}`, async () => { writeConfigPatch(patch); return { ok: true }; });
     const voice = offerVoiceSetup({ readinessAfterStart: true });
     const started = await act(`ours-mcp start (port ${chosenPort})`, async () => run('ours-mcp', ['start']));
     const svc = await act('ours-mcp install-service (survives reboot)', async () => run('ours-mcp', ['install-service']));
-    // `ours-mcp install-service` STOPS the daemon before it writes the unit (core's
-    // cmdInstallService), then exits non-zero if `systemctl --user enable --now` fails —
-    // no linger, no user bus, a container, WSL without systemd. Left alone that turns a
-    // WORKING daemon into no daemon at all, while the line below still said "ready": the
-    // human identity and every MCP client then fail against a port nothing is listening
-    // on. Put the one shared daemon back up and report what is actually true.
-    // `started.ok` is the exit code of `ours-mcp start`, which is not evidence that
-    // anything is listening (see daemonReachable). Ask the daemon instead.
-    let running = DRY ? started.ok : daemonReachable();
-    if (!DRY && !svc.ok && !running) {
-      line(info('the boot-service step stopped the daemon before it failed — restarting it.'));
-      run('ours-mcp', ['start']);
-      running = daemonReachable();
-    }
-    if (running) line(ok(`ours core ready — running on port ${chosenPort}. No problems.`));
+    if (started.ok) line(ok(`ours core ready — running on port ${chosenPort}. No problems.`));
     else line(warn(`could not auto-start — run '${c.cyan('ours-mcp start')}' to bring it up.`));
     if (!svc.ok && !svc.dry) line(warn(`boot-service not installed — retry '${c.cyan('ours-mcp install-service')}' later.`));
-    if (voice.setupRan && !DRY && running) {
+    if (voice.setupRan && !DRY && started.ok) {
       const verified = daemonVoiceCapability();
       if (verified?.ready) {
         line(ok(`Voice transcription readiness confirmed (${verified.provider}) after the first start.`));
@@ -569,13 +577,7 @@ async function main() {
         }
       }
     }
-    record({
-      key: 'core',
-      label: 'ours core (daemon)',
-      state: running ? 'installed' : 'failed',
-      version: parseVersion(daemonVersionLine()),
-      note: svc.ok ? 'starts on boot' : 'running; no boot service',
-    });
+    record({ key: 'core', label: 'ours core (daemon)', state: started.ok ? 'installed' : 'failed', version: parseVersion(daemonVersionLine()), note: 'starts on boot' });
   } else {
     // Installed: offer an update; never re-ask config; reuse the running port everywhere.
     const daemonState = daemonLifecycleState();
@@ -584,7 +586,8 @@ async function main() {
     let pendingUpdateRestart = false;
     let after = before;
     if (upd) {
-      await actSpin(`updating ${spec('mcp')}…`, `npm i -g ${spec('mcp')}`, () => runAsync(NPM, ['i', '-g', spec('mcp')]));
+      const exactMcp = `${exactSuite.packages.mcp.packageName}@${exactSuite.packages.mcp.version}`;
+      await actSpin(`updating ${exactMcp}…`, `npm i -g ${exactMcp}`, () => runAsync(NPM, ['i', '-g', exactMcp]));
       after = parseVersion(daemonVersionLine());
       pendingUpdateRestart = !!(before && after && before !== after);
     }
@@ -632,11 +635,9 @@ async function main() {
       line(ok(`Your human identity "${name}" is created.`));
       record({ key: 'identity', label: 'Human identity', state: 'installed', note: name });
     } else {
-      // A freshly-started daemon may need a moment to BIND ITS PORT before create-root
-      // can reach it — which is the one thing a liveness check cannot see, so this
-      // waits on the port answering rather than on a process existing.
-      let reachable = daemonReachable();
-      for (let i = 0; i < 6 && !reachable; i++) { sleepMs(400); reachable = daemonReachable(); }
+      // A freshly-started daemon may need a moment to bind its port before create-root can reach it.
+      let reachable = daemonRunning();
+      for (let i = 0; i < 6 && !reachable; i++) { sleepMs(400); reachable = daemonRunning(); }
       const r = reachable ? run('ours-mcp', ['create-root', name], { capture: true }) : { ok: false, out: '', err: 'daemon not running' };
       const outText = `${r.out} ${r.err}`;
       const existing = outText.match(/already exists \("([^"]+)"\)/);
@@ -664,23 +665,39 @@ async function main() {
   // NEVER dead-end (owner edit #3): plain reason + manual path, always. Each returns whether it
   // ACTED (so a plain user-No skip shows no Continue pause).
   async function installClaude(h) {
-    if (h.status !== 'ok') { manualClaude(h); record({ key: 'claude', label: 'Claude Code plugin', state: 'skipped', note: h.status === 'alias' ? 'installed as an alias' : 'not drivable' }); return true; }
-    const go = yes('  Install the ours plugin into Claude Code?', true);
-    if (!go) { line(info('skipped — re-run ours-install to add it.')); record({ key: 'claude', label: 'Claude Code plugin', state: 'skipped' }); return false; }
-    const add = await act(`claude plugin marketplace add ${CLAUDE_MARKET}`, async () => run('claude', ['plugin', 'marketplace', 'add', CLAUDE_MARKET], { capture: true }));
-    const inst = add.ok ? await act('claude plugin install ours@ours.network', async () => run('claude', ['plugin', 'install', 'ours@ours.network'], { capture: true })) : add;
+    if (h.status === 'ok') {
+      const go = yes('  Install the ours plugin into Claude Code?', true);
+      if (!go) { line(info('skipped — re-run ours-install to add it.')); record({ key: 'claude', label: 'Claude Code plugin', state: 'skipped' }); return false; }
+    }
+    const exact = await prepareExactMarketplace('claude-code', exactSuite.packages['claude-code']);
+    if (!exact.ok) { exactResolutionFailure('Claude Code', exact); record({ key: 'claude', label: 'Claude Code plugin', state: 'failed', note: 'exact version resolution failed' }); return true; }
+    line(info(`Claude Code plugin channel: ${exact.tag} → exact ${exact.version}.`));
+    if (h.status !== 'ok') { manualClaude(h, exact); record({ key: 'claude', label: 'Claude Code plugin', state: 'skipped', note: h.status === 'alias' ? 'installed as an alias' : 'not drivable' }); return true; }
+    const add = await act(`claude plugin marketplace add ${exact.root}`, async () => run('claude', ['plugin', 'marketplace', 'add', exact.root], { capture: true }));
+    // Claude's `plugin install` reports success without changing an already-installed
+    // plugin. Use its explicit update command on reruns/channel switches so the newly
+    // written exact marketplace version is actually applied.
+    const claudeInstalled = add.ok && hasClaudePlugin();
+    const verb = claudeInstalled ? 'update' : 'install';
+    const inst = add.ok ? await act(`claude plugin ${verb} ours@ours.network`, async () => run('claude', ['plugin', verb, 'ours@ours.network'], { capture: true })) : add;
     if (inst.ok) { line(ok(`Claude Code plugin installed — pointed at port ${chosenPort}. No problems.`)); line(info('(restart Claude Code to load it.)')); record({ key: 'claude', label: 'Claude Code plugin', state: 'installed', note: 'restart Claude Code' }); }
-    else { failClaude(); record({ key: 'claude', label: 'Claude Code plugin', state: 'failed', note: 'marketplace/install step failed' }); }
+    else { failClaude(exact); record({ key: 'claude', label: 'Claude Code plugin', state: 'failed', note: 'marketplace/install step failed' }); }
     return true;
   }
   async function installCodex(h) {
-    if (h.status !== 'ok') { manualCodex(h); record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'skipped', note: h.status === 'alias' ? 'installed as an alias' : 'not drivable' }); return true; }
-    const go = yes('  Install the ours plugin into Codex?', true);
-    if (!go) { line(info('skipped — re-run ours-install to add it.')); record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'skipped' }); return false; }
-    const add = await act(`codex plugin marketplace add ${CODEX_MARKET}`, async () => run('codex', ['plugin', 'marketplace', 'add', CODEX_MARKET], { capture: true }));
+    if (h.status === 'ok') {
+      const go = yes('  Install the ours plugin into Codex?', true);
+      if (!go) { line(info('skipped — re-run ours-install to add it.')); record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'skipped' }); return false; }
+    }
+    const exact = await prepareExactMarketplace('codex', exactSuite.packages.codex);
+    if (!exact.ok) { exactResolutionFailure('Codex', exact); record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'failed', note: 'exact version resolution failed' }); return true; }
+    line(info(`Codex plugin channel: ${exact.tag} → exact ${exact.version}.`));
+    if (h.status !== 'ok') { manualCodex(h, exact); record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'skipped', note: h.status === 'alias' ? 'installed as an alias' : 'not drivable' }); return true; }
+    const add = await addExactCodexMarketplace(exact);
     const inst = add.ok ? await act('codex plugin add ours@ours-codex-marketplace', async () => run('codex', ['plugin', 'add', 'ours@ours-codex-marketplace'], { capture: true })) : add;
     // Owner-mandated: choosing the Codex plugin ALSO installs the ours-codex live launcher, same step.
-    const wrap = inst.ok ? await actSpin('installing the ours-codex live launcher…', `npm i -g ${spec('codex')} (provides ours-codex)`, () => runAsync(NPM, ['i', '-g', spec('codex')])) : inst;
+    const exactSpec = `${exact.packageName}@${exact.version}`;
+    const wrap = inst.ok ? await actSpin('installing the ours-codex live launcher…', `npm i -g ${exactSpec} (provides ours-codex)`, () => runAsync(NPM, ['i', '-g', exactSpec])) : inst;
     if (inst.ok && wrap.ok) {
       line(ok(`Codex plugin + ours-codex live launcher installed — pointed at port ${chosenPort}. No problems.`));
       // Plain-language: what ours-codex is and why you'd use it (background wake vs blocking).
@@ -691,7 +708,7 @@ async function main() {
       line(info('    app server to watch for new mail in the BACKGROUND while you keep typing, so a'));
       line(info("    reply wakes it without interrupting you. Use 'ours-codex' for hands-off replies."));
       record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'installed', note: 'new Codex thread' });
-    } else { failCodex(); record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'failed', note: 'marketplace/install step failed' }); }
+    } else { failCodex(exact); record({ key: 'codex', label: 'Codex plugin + ours-codex', state: 'failed', note: 'marketplace/install step failed' }); }
     return true;
   }
   // Hermes: NOT a driven CLI. Its plugin install is `npm i -g @ours.network/hermes@<channel>` then
@@ -715,10 +732,10 @@ async function main() {
   }
 
   // ============================================================================================
-  // STEP 2 / 5 — harness plugins (Claude Code + Codex + Hermes). The installer drives the plugin
+  // STEP 2 / 4 — harness plugins (Claude Code + Codex + Hermes). The installer drives the plugin
   // CLIs for Claude/Codex; Hermes installs via npm + ours-hermes-install (no CLI driving).
   // ============================================================================================
-  line(heading('2/5 — harness plugins'));
+  line(heading('2/4 — harness plugins'));
   line(info('These teach Claude Code, Codex, and Hermes the ours skills, so you can just talk to your'));
   line(info("agent to message people and set things up. I'll install them for you — no commands to type."));
   for (const h of harnesses) {
@@ -731,21 +748,16 @@ async function main() {
   }
 
   // ============================================================================================
-  // STEP 3 / 5 — ours-fleet. Appealing wording (owner edit #4); default YES.
+  // STEP 3 / 4 — ours-fleet. Appealing wording (owner edit #4); default YES.
   // ============================================================================================
-  line(heading('3/5 — ours-fleet (your always-online agent team)'));
+  line(heading('3/4 — ours-fleet (your always-online agent team)'));
   line(info('This makes your harnesses PERSISTENT: Claude Code and Codex stop being just a terminal'));
   line(info('session and become always-online daemons that survive a reboot. Stand up your own team'));
   line(info('of always-online developers, combine harnesses, run several Claude Codes, and link them'));
   line(info('over Telegram so they talk to each other — and it all configures maximally easily.'));
   const goFleet = yes('  Install it?', true);
   if (goFleet) {
-    // ours-fleet FOLLOWS the channel, like everything else here: it publishes its own
-    // nightly dist-tag from adapt-toolkit/ours-fleet, and lib/logic.mjs maps it
-    // accordingly. (This comment used to claim the opposite — that fleet had no nightly
-    // tag and was pinned to @latest even under OURS_CHANNEL=nightly — which stopped
-    // being true when the map gained its `fleet` entry. The code always followed the
-    // map; only the comment was stale, which is the more dangerous of the two.)
+    // ours-fleet is ALWAYS @latest — it has no nightly tag (pkgSpec pins it even under OURS_CHANNEL=nightly).
     await actSpin(`installing ${spec('fleet')}…`, `npm i -g ${spec('fleet')}`, () => runAsync(NPM, ['i', '-g', spec('fleet')]));
     const init = await act('ours-fleet init (one-time host setup: units, dirs, linger)', async () => run('ours-fleet', ['init']));
     if (!init.ok) line(warn(`ours-fleet host setup didn't finish — retry '${c.cyan('ours-fleet init')}'.`));
@@ -766,147 +778,24 @@ async function main() {
   }
   cont(goFleet);
 
-  // The broker the WHOLE deployment shares, whichever daemon a consumer talks to.
-  const sharedBroker = () => resolveSharedBroker({
-    chosenBroker,
-    statusBroker: status0.broker,
-    configBroker: readConfigObject().brokerUrl,
-  });
-
-  // Provision a daemon that belongs to ONE consumer: its own config file, its own
-  // state directory, its own port, and — via core's OURS_SERVICE_NAME — its own boot
-  // unit, so `install-service` cannot overwrite the shared daemon's. Returns the
-  // endpoint + state dir to wire that consumer to, and whether it came up.
-  async function provisionDedicatedDaemon({ instance, port, label }) {
-    const { stateDir, configPath: cfgPath, serviceName } = dedicatedDaemonPaths(homedir(), instance);
-    const env = { OURS_CONFIG: cfgPath, OURS_STATE_DIR: stateDir, OURS_SERVICE_NAME: serviceName };
-    // The dedicated daemon has to exist as a package before it can be started; on a
-    // fresh machine step 1 already installed it, but a re-run that skipped core has not.
-    await actSpin(`ensuring ${spec('mcp')}…`, `npm i -g ${spec('mcp')}`, () => runAsync(NPM, ['i', '-g', spec('mcp')]));
-    const desired = { port, stateDir, serviceName };
-    const broker = sharedBroker();
-    if (broker) desired.brokerUrl = broker;
-    let existing = {};
-    try { existing = JSON.parse(readFileSync(cfgPath, 'utf8')); } catch { /* absent or unreadable */ }
-    const sameAlready = existing.port === port && existing.stateDir === stateDir && existing.serviceName === serviceName;
-    if (sameAlready) {
-      line(ok(`The ${label} daemon is already configured on port ${port} — no change.`));
-      // Nothing to change AND it is already up: do not touch it. `install-service` STOPS
-      // the daemon before rewriting the unit, so re-running it here would bounce a healthy
-      // daemon for no reason.
-      if (!DRY && daemonReachable(env)) {
-        line(ok(`Dedicated ${label} daemon already running on port ${port} — left alone.`));
-        return { endpoint: daemonEndpoint(port), stateDir, serviceName, configPath: cfgPath, running: true, port };
-      }
-    } else {
-      await act(`write ${cfgPath} (dedicated ${label} daemon, port ${port}, state ${stateDir})`, async () => {
-        atomicWriteConfig(cfgPath, mergeConfig(existing, desired));
-        return { ok: true };
-      });
-    }
-    const started = await act(`ours-mcp start (dedicated ${label} daemon, port ${port})`, async () => run('ours-mcp', ['start'], { env }));
-    const svc = await act(`ours-mcp install-service (dedicated ${label} daemon, unit ours-${serviceName})`, async () => run('ours-mcp', ['install-service'], { env }));
-    // Same recovery as the shared daemon: install-service STOPS the daemon before it
-    // writes the unit, so a failure there leaves nothing listening on this port.
-    // Same rule as the shared daemon: an exit code is not evidence of a bound port.
-    let running = DRY ? started.ok : daemonReachable(env);
-    if (!DRY && !svc.ok) {
-      if (!running) {
-        line(info(`the boot-service step stopped the ${label} daemon before it failed — restarting it.`));
-        run('ours-mcp', ['start'], { env });
-        running = daemonReachable(env);
-      }
-      line(warn(`the ${label} daemon has no boot service — retry '${c.cyan(`OURS_CONFIG=${cfgPath} OURS_SERVICE_NAME=${serviceName} ours-mcp install-service`)}'.`));
-    }
-    if (running || DRY) line(ok(`Dedicated ${label} daemon ready on port ${port} (state ${stateDir}, unit ours-${serviceName}).`));
-    else line(warn(`could not start the dedicated ${label} daemon — run '${c.cyan(`OURS_CONFIG=${cfgPath} ours-mcp start`)}'.`));
-    return { endpoint: daemonEndpoint(port), stateDir, serviceName, configPath: cfgPath, running: running || DRY, port };
-  }
-
-  // Ask one consumer whether it uses the COMMON daemon or gets its own. Enter and
-  // every non-interactive run answer "common" — the historical topology.
-  const askDaemonMode = (what) => {
-    line(info(`${what} can share the daemon from step 1, or run against its own isolated one.`));
-    line(info('Sharing is right for almost everyone — press Enter. A dedicated daemon gets its own'));
-    line(info('port, state directory and boot service, and does not see the shared daemon\'s identities.'));
-    return yes(`  Give ${what} its OWN dedicated daemon?`, false) ? 'dedicated' : 'common';
-  };
-
-  // Give the Telegram connector the daemon it was assigned: that daemon's loopback
-  // endpoint, the state directory that endpoint's API token belongs to, and — for a
-  // pre-0.3.3 connector that still meets the daemon at a broker instead — that broker.
-  // Idempotent: an unchanged selection writes nothing. Returns { changed, hadPrevious }
-  // so the caller can warn about a service unit that froze an older selection.
-  async function writeTgDaemonConfig({ endpoint, stateDir }) {
-    const path = tgConfigPath(process.env, homedir());
-    const desired = {
-      daemonUrl: endpoint,
-      daemonStateDir: stateDir,
-      brokerUrl: sharedBroker(),
-    };
-    let existing = {};
-    try { existing = JSON.parse(readFileSync(path, 'utf8')); } catch { /* absent or unreadable */ }
-    const plan = planTgDaemonConfig(existing, desired);
-    const hadPrevious = !!(plan.previous.daemonUrl || plan.previous.brokerUrl);
-    if (!plan.changed) {
-      line(ok(`Telegram connector already points at this daemon (${desired.daemonUrl}) — no change.`));
-      return { changed: false, hadPrevious };
-    }
-    await act(`write ${path} (daemon ${desired.daemonUrl}, state ${stateDir})`, async () => {
-      atomicWriteConfig(path, plan.text);
-      return { ok: true };
-    });
-    line(ok(`Telegram connector configured to use this daemon (${desired.daemonUrl}).`));
-    return { changed: true, hadPrevious };
-  }
-
   // ============================================================================================
-  // STEP 4 / 5 — Telegram connector. Install-only (no bot tokens here). Then: run as a service?
+  // STEP 4 / 4 — Telegram connector. Install-only (no bot tokens here). Then: run as a service?
   // ============================================================================================
-  line(heading('4/5 — Telegram connector'));
+  line(heading('4/4 — Telegram connector'));
   line(info('This bridges a Telegram bot to your Ours node, so you can talk to your agent from'));
   line(info("Telegram. (You'll set up the actual bot later, with your agent — not here.)"));
   const goTg = yes('  Install it?', false);
   if (goTg) {
     await actSpin(`installing ${spec('tg-connector')}…`, `npm i -g ${spec('tg-connector')}`, () => runAsync(NPM, ['i', '-g', spec('tg-connector')]));
-    // WHICH daemon — asked independently of every other consumer, and answered
-    // "common" by Enter / non-interactive so the historical topology is the default.
-    line('');
-    const tgMode = askDaemonMode('the Telegram connector');
-    let tgDaemon = { endpoint: daemonEndpoint(chosenPort), stateDir: daemonStateDir(), port: chosenPort, mode: 'common' };
-    if (tgMode === 'dedicated') {
-      const instance = DEDICATED_INSTANCES.telegram;
-      const suggested = suggestPort(chosenPort + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-      const port = askDaemonPort('Which local port should the Telegram daemon use?', suggested);
-      claimPort(port, 'the dedicated Telegram daemon');
-      const provisioned = await provisionDedicatedDaemon({ instance, port, label: 'Telegram' });
-      tgDaemon = { ...provisioned, mode: 'dedicated' };
-    } else {
-      line(ok(`Telegram will use the shared daemon on port ${chosenPort}.`));
-    }
-    // POINT IT AT THAT DAEMON — BEFORE it is started or installed as a service.
-    // The connector never inherits ~/.ours/config.json (its SDK reports configPath:
-    // null unless told otherwise), and `install-service` bakes whatever it resolves
-    // into the unit as environment variables that outrank the file from then on. So
-    // the daemon's identity has to be in its config BEFORE either happens. See
-    // planTgDaemonConfig for why all three keys are written.
-    const tgConfigured = await writeTgDaemonConfig(tgDaemon);
-    const where = tgDaemon.mode === 'dedicated' ? `its own daemon on port ${tgDaemon.port}` : `the shared daemon on port ${tgDaemon.port}`;
     const asService = yes('  Keep it running in the background so it starts automatically on boot?', true);
     if (asService) {
       const svc = await act('ours-tg-connector install-service (starts on boot)', async () => run('ours-tg-connector', ['install-service']));
-      if (svc.ok) line(ok(`Telegram connector installed and running as a service (starts on boot), pointed at ${where}. No problems.`));
+      if (svc.ok) line(ok('Telegram connector installed and running as a service (starts on boot). No problems.'));
       else line(warn(`connector installed, but the service didn't start — retry '${c.cyan('ours-tg-connector install-service')}'.`));
-      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: `service (boot) · ${tgDaemon.mode} daemon ${tgDaemon.port}` });
+      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: 'service (boot)' });
     } else {
-      line(ok(`Telegram connector installed, pointed at ${where}. Start it any time with '${c.cyan('ours-tg-connector start')}'. No problems.`));
-      // A connector already installed as a service froze its OLD daemon selection into
-      // the unit's environment, which outranks the file we just wrote. Config alone
-      // cannot repair that — say so plainly rather than let it look fixed.
-      if (tgConfigured.changed && tgConfigured.hadPrevious) {
-        line(warn(`if you previously ran '${c.cyan('ours-tg-connector install-service')}', re-run it — the old service froze the previous daemon selection in its unit.`));
-      }
-      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: `start on demand · ${tgDaemon.mode} daemon ${tgDaemon.port}` });
+      line(ok(`Telegram connector installed. Start it any time with '${c.cyan('ours-tg-connector start')}'. No problems.`));
+      record({ key: 'telegram', label: 'Telegram connector', state: 'installed', version: globalVersion('@ours.network/tg-connector'), note: 'start on demand' });
     }
   } else {
     line(info('skipped cleanly.'));
@@ -914,151 +803,11 @@ async function main() {
   }
   cont(goTg);
 
-  // ============================================================================================
-  // STEP 5 / 5 — Rooms (ours-cowork). Two independent things get configured here.
-  //
-  // ITS OWN SURFACE — the deployment broker, its private state directory, and its loopback
-  // console/REST port. Those it has always had.
-  //
-  // WHICH DAEMON — ours-cowork used to host its own, always. It now supports an EXTERNAL ours
-  // daemon (cowork PR #9), so Rooms answers the same common-vs-dedicated question the Telegram
-  // connector does, plus a third state the connector does not have: EMBEDDED, cowork's own.
-  // Contract (see logic.mjs): the `daemon` block is optional; absent means embedded; external is
-  // { mode:'external', endpoint, stateDir } and REQUIRES both halves, because cowork holds no
-  // token and its SDK reads <stateDir>/daemon-token.
-  //
-  // Boot is FAIL-CLOSED on an unreachable endpoint, a non-ours daemon, or a mismatched state
-  // directory — there is no embedded fallback. So an install that is ALREADY running embedded is
-  // never migrated behind the user's back: non-interactively it is left exactly as it is, and
-  // interactively the question is asked plainly before anything is written.
-  // ============================================================================================
-  line(heading('5/5 — Rooms (ours-cowork)'));
-  line(info('Durable mission rooms: a room keeps its own ordered history, and people and agents'));
-  line(info('join it as seats. It serves a local web console, and reaches everyone through the'));
-  line(info('same broker as the rest of your install.'));
-  const goRooms = yes('  Install it?', false);
-  if (goRooms) {
-    await actSpin(`installing ${spec('cowork')}…`, `npm i -g ${spec('cowork')}`, () => runAsync(NPM, ['i', '-g', spec('cowork')]));
-    const roomsStateDir = join(homedir(), '.ours-cowork');
-    const cfgPath = coworkConfigPath(process.env, homedir());
-    let existingRooms = {};
-    try { existingRooms = JSON.parse(readFileSync(cfgPath, 'utf8')); } catch { /* absent or unreadable */ }
-    const restDefault = Number.isInteger(existingRooms.rest?.port) ? existingRooms.rest.port : COWORK_DEFAULT_PORT;
-    line('');
-    line(info('Rooms serves a console on a loopback port — 127.0.0.1 only, never exposed.'));
-    // COWORK_DEFAULT_PORT is in RESERVED_PORTS (so no ours daemon can be handed it),
-    // so validate this one against the daemon ports only.
-    const roomsPort = (() => {
-      let candidate = restDefault;
-      for (let attempt = 0; attempt < 3; attempt++) {
-        const raw = ask(`  Which local port should the Rooms console use?  ${c.gray(`[Enter for ${candidate}]`)}: `, String(candidate));
-        const v = validateDaemonPort(raw, {
-          fallback: candidate, isTaken: (p) => (p === restDefault ? false : portTakenSync(p)),
-          taken: claimedPorts, reserved: [],
-        });
-        if (v.ok) return v.port;
-        line(warn(`${v.reason}.`));
-        if (!interactive) break;
-        candidate = suggestPort(v.port + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-        line(info(`Suggesting ${candidate} instead.`));
-      }
-      return candidate;
-    })();
-    claimPort(roomsPort, 'the Rooms console');
-
-    // WHICH DAEMON. `undefined` means "leave whatever is there alone" — the answer for an
-    // existing embedded install nobody asked to migrate.
-    const wasEmbedded = coworkDaemonMode(existingRooms) === 'embedded';
-    const hadConfig = existsSync(cfgPath);
-    // Ask the BUILD, not the channel: this runs after the install above, so the version
-    // read here is the one actually on the machine.
-    const coworkVersion = globalVersion('@ours.network/cowork');
-    const externalSupported = coworkSupportsExternalDaemon(coworkVersion);
-    let roomsDaemon;
-    let roomsDaemonLabel;
-    if (!externalSupported) {
-      // The build we just installed predates cowork's external-daemon mode. Its config
-      // is a strict document and its boot fails closed, so writing a selection it cannot
-      // honour would break Rooms rather than degrade it.
-      line(info(`This Rooms build${coworkVersion ? ` (${coworkVersion})` : ''} hosts its own daemon; pointing it at the shared`));
-      line(info(`one needs ${COWORK_EXTERNAL_MIN_VERSION} or newer. Re-run with ${c.cyan('OURS_CHANNEL=nightly')} to get it.`));
-      roomsDaemonLabel = 'embedded';
-    } else if (hadConfig && wasEmbedded && !interactive) {
-      // Fail-closed boot makes this migration a real risk; never do it unasked.
-      line(info('Rooms already runs its own embedded daemon — leaving that alone.'));
-      line(info(`To point it at this install's daemon, re-run ${c.cyan('ours-install')} in a terminal.`));
-      roomsDaemonLabel = 'embedded (unchanged)';
-    } else {
-      line('');
-      const roomsMode = askDaemonMode('Rooms');
-      if (roomsMode === 'dedicated') {
-        const instance = DEDICATED_INSTANCES.rooms;
-        const suggested = suggestPort(chosenPort + 1, (p) => claimedPorts.includes(p) || portTakenSync(p));
-        const port = askDaemonPort('Which local port should the Rooms daemon use?', suggested);
-        claimPort(port, 'the dedicated Rooms daemon');
-        const provisioned = await provisionDedicatedDaemon({ instance, port, label: 'Rooms' });
-        roomsDaemon = { endpoint: provisioned.endpoint, stateDir: provisioned.stateDir };
-        roomsDaemonLabel = `dedicated daemon ${port}`;
-      } else {
-        roomsDaemon = { endpoint: daemonEndpoint(chosenPort), stateDir: daemonStateDir() };
-        roomsDaemonLabel = `common daemon ${chosenPort}`;
-        line(ok(`Rooms will use the shared daemon on port ${chosenPort}.`));
-      }
-    }
-
-    const roomsPlan = planCoworkConfig(existingRooms, {
-      brokerUrl: sharedBroker(),
-      stateDir: roomsStateDir,
-      restPort: roomsPort,
-      daemon: roomsDaemon,
-    });
-    if (roomsPlan.error) {
-      // Only reachable if a daemon selection lost half of itself; a half-written block
-      // would fail closed at cowork's boot, so refuse rather than write it.
-      line(warn(`not changing the Rooms daemon selection — ${roomsPlan.error}.`));
-    } else if (roomsPlan.changed) {
-      await act(`write ${cfgPath} (console port ${roomsPort}, state ${roomsStateDir}${roomsDaemon ? `, daemon ${roomsDaemon.endpoint}` : ''})`, async () => {
-        atomicWriteConfig(cfgPath, roomsPlan.text);
-        return { ok: true };
-      });
-      if (roomsDaemon) line(ok(`Rooms configured to use ${roomsDaemonLabel} (${roomsDaemon.endpoint}, state ${roomsDaemon.stateDir}).`));
-    } else {
-      line(ok(`Rooms is already configured for this deployment (console port ${roomsPort}) — no change.`));
-    }
-    const svc = await act('ours-cowork install-service (starts on boot)', async () => run('ours-cowork', ['install-service']));
-    if (svc.ok) {
-      line(ok(`Rooms ready — console at ${c.cyan(`http://127.0.0.1:${roomsPort}/`)}, sharing your broker. No problems.`));
-    } else {
-      line(warn(`Rooms installed, but its service didn't start — retry '${c.cyan('ours-cowork install-service')}'.`));
-      line(info(`You can also run it in the foreground: '${c.cyan('ours-cowork web')}'.`));
-    }
-    record({
-      key: 'rooms',
-      label: 'Rooms (ours-cowork)',
-      state: svc.ok ? 'installed' : 'failed',
-      version: coworkVersion,
-      note: svc.ok ? `console ${roomsPort} · ${roomsDaemonLabel}` : 'ours-cowork install-service failed',
-    });
-  } else {
-    line(info('skipped cleanly — re-run ours-install any time to add it.'));
-    record({ key: 'rooms', label: 'Rooms (ours-cowork)', state: 'skipped' });
-  }
-  cont(goRooms);
-
-  // Last guard on the whole topology: no two daemons in this install may share a port.
-  // Each answer was validated as it was given, but only the finished plan proves the set.
-  const portPlan = planPorts(topology);
-  if (!portPlan.ok) {
-    for (const d of portPlan.duplicates) {
-      line(warn(`port ${d.port} ended up claimed by both ${d.labels[0]} and ${d.labels[1]} — one of them will fail to bind.`));
-    }
-  }
-
   return endScreen({ ttyFd, summary, chosenPort, chosenBroker });
 }
 
 // --- never-dead-end messaging (owner edit #3) --------------------------------------------------
-function manualClaude(h) {
+function manualClaude(h, exact) {
   if (h.status === 'alias') {
     line(warn('Heads-up: on your machine, "claude" is installed as an alias, not the real command,'));
     line(info('so I can\'t drive it safely. To fix it: run  ' + c.cyan('type claude') + '  , remove/rename that'));
@@ -1067,17 +816,17 @@ function manualClaude(h) {
     line(warn('I couldn\'t safely drive the "claude" command on this machine.'));
   }
   line(info('You can still install the plugin yourself — inside Claude Code, run these two:'));
-  line('    ' + c.cyan(`/plugin marketplace add ${CLAUDE_MARKET}`));
-  line('    ' + c.cyan('/plugin install ours'));
+  line('    ' + c.cyan(`/plugin marketplace add ${exact.root}`));
+  line('    ' + c.cyan('/plugin install ours@ours.network'));
 }
-function failClaude() {
+function failClaude(exact) {
   line(warn('Couldn\'t install the Claude Code plugin automatically (network or plugin cache).'));
   line(info('Install it by hand — inside Claude Code, run these two, then re-run ours-install:'));
-  line('    ' + c.cyan(`/plugin marketplace add ${CLAUDE_MARKET}`));
-  line('    ' + c.cyan('/plugin install ours'));
+  line('    ' + c.cyan(`/plugin marketplace add ${exact.root}`));
+  line('    ' + c.cyan('/plugin install ours@ours.network'));
   line(info('Your daemon and other steps are intact. Continuing.'));
 }
-function manualCodex(h) {
+function manualCodex(h, exact) {
   if (h.status === 'alias') {
     line(warn('Heads-up: on your machine, "codex" is installed as an alias, not the real command,'));
     line(info('so I can\'t drive it safely. To fix it: run  ' + c.cyan('type codex') + '  , remove/rename that'));
@@ -1085,17 +834,19 @@ function manualCodex(h) {
   } else {
     line(warn('I couldn\'t safely drive the "codex" command on this machine.'));
   }
-  line(info('You can still install it yourself — run these three in your terminal:'));
-  line('    ' + c.cyan(`codex plugin marketplace add ${CODEX_MARKET}`));
+  line(info('You can still install it yourself — run these four in your terminal:'));
+  line('    ' + c.cyan('codex plugin marketplace remove ours-codex-marketplace') + c.gray('   (okay if absent)'));
+  line('    ' + c.cyan(`codex plugin marketplace add ${exact.root}`));
   line('    ' + c.cyan('codex plugin add ours@ours-codex-marketplace'));
-  line('    ' + c.cyan('npm i -g @ours.network/codex') + c.gray('   (adds the ours-codex live launcher)'));
+  line('    ' + c.cyan(`npm i -g ${exact.packageName}@${exact.version}`) + c.gray('   (adds the ours-codex live launcher)'));
 }
-function failCodex() {
+function failCodex(exact) {
   line(warn('Couldn\'t install the Codex plugin automatically (network or plugin cache).'));
-  line(info('Install it by hand — run these three, then re-run ours-install:'));
-  line('    ' + c.cyan(`codex plugin marketplace add ${CODEX_MARKET}`));
+  line(info('Install it by hand — run these four, then re-run ours-install:'));
+  line('    ' + c.cyan('codex plugin marketplace remove ours-codex-marketplace') + c.gray('   (okay if absent)'));
+  line('    ' + c.cyan(`codex plugin marketplace add ${exact.root}`));
   line('    ' + c.cyan('codex plugin add ours@ours-codex-marketplace'));
-  line('    ' + c.cyan('npm i -g @ours.network/codex'));
+  line('    ' + c.cyan(`npm i -g ${exact.packageName}@${exact.version}`));
   line(info('Your daemon and other steps are intact. Continuing.'));
 }
 function failHermes() {
@@ -1132,9 +883,7 @@ function endScreen({ ttyFd, summary, chosenPort, chosenBroker }) {
   const has = (k) => summary.some((r) => r.key === k && (r.state === 'installed' || r.state === 'current'));
   if (has('core')) {
     const identityDone = has('identity');
-    const { text, empty } = buildHandoffPrompt({
-      identity: !identityDone, fleet: has('fleet'), telegram: has('telegram'), rooms: has('rooms'),
-    });
+    const { text, empty } = buildHandoffPrompt({ identity: !identityDone, fleet: has('fleet'), telegram: has('telegram') });
     if (empty) {
       // Nothing left to finish (identity created in-install, no fleet/Telegram). Don't show an empty box.
       line('');