@ours.network/install 0.17.0-nightly.9 → 0.18.0-nightly.1

package/lib/plan.mjs

@@ -94,10 +94,9 @@ export function classifyUnit(text) {
  *                                                  informational line naming it
  *   { action: 'refuse', exitCode: 2, … }         — unknown unit, or unusable state dir
  *
- * Adoption of a legacy unit is SILENT by the owner's decision: no prompt, no
- * question, so an upgrading user has no manual step. The one line of output
- * exists so the replacement is not literally invisible; it does not block and it
- * is not a warning.
+ * Adoption of a legacy unit is SILENT: no prompt, no question, so an upgrading
+ * user has no manual step. The one line of output exists so the replacement is not
+ * literally invisible; it does not block and it is not a warning.
  *
  * BECAUSE THERE IS NO PROMPT, `classifyUnit`'s `legacy` match is now the ENTIRE
  * safety boundary between a stranger's file and a silent rewrite. It must stay
@@ -110,7 +109,40 @@ export function classifyUnit(text) {
  * without a question in front of it — it is what keeps --force from becoming a
  * default that spreads to the other cases.
  */
-export function planServiceInstall({ stateDir, home, readText }) {
+export function planServiceInstall({ stateDir, home, readText, platform = 'linux' }) {
+  // THE BOOT SERVICE IS LINUX-ONLY, AND NOT BECAUSE THIS FILE SAYS SO.
+  //
+  // `ours daemon install-service` in @ours.network/cli builds its adapter with
+  // `createLinuxUserSystemdAdapter()` and no platform branch at all, and that
+  // factory's FIRST line is
+  //   if (deps.platform !== 'linux') throw new Error('service management is not
+  //   supported on <platform>; use an external launcher for `ours daemon serve`')
+  // — verified by reading the published 0.4.1 tarball, which contains zero
+  // occurrences of launchd, LaunchAgents or plist.
+  //
+  // So calling it on macOS does not degrade, it THROWS. Before this, a Mac user
+  // was told their platform was supported, watched the CLI install, the config
+  // write and the daemon start, and then got an exception and a rolled-back
+  // config. Skipping the step leaves them a working daemon and one true sentence
+  // instead — which is the whole of this change.
+  //
+  // A real launchd adapter belongs in the SDK CLI, not here. Nothing in this
+  // package can install a launchd agent, and pretending otherwise by writing a
+  // plist ourselves would put a second service implementation in a second repo.
+  // `ours daemon install-service` supports Linux/systemd only: its adapter throws
+  // for any other platform, so calling it would fail the run rather than degrade.
+  // Skip it and say so; the daemon itself is unaffected.
+  if (platform && platform !== 'linux') {
+    return {
+      action: 'unsupported',
+      platform,
+      reason: 'no-service-manager',
+      message: platform === 'darwin'
+        ? 'installing a boot service is not available on macOS — the ours CLI can only manage a Linux user systemd service'
+        : `installing a boot service is not available on ${platform} — the ours CLI can only manage a Linux user systemd service`,
+      manual: ['ours', 'daemon', 'serve', '--config'],
+    };
+  }
   const derived = unitPathForStateDir(stateDir, home);
   if (!derived.ok) {
     return { action: 'refuse', exitCode: 2, reason: 'unusable-state-dir', message: derived.reason };
@@ -180,10 +212,10 @@ export function serviceInstallCommand({ stateDir, adoptLegacyUnit = false }) {
   // --json so the caller can read back whether the unit actually CHANGED. The
   // CLI owns that byte-comparison, and an installer that guessed at it would
   // report "nothing changed" on a run that rewrote a unit.
+  // --json so the caller can read back whether the unit actually CHANGED rather
+  // than assuming it did. --force is reachable only through the explicit argument
+  // above, and the CLI refuses to overwrite a unit it did not write.
   const cmd = ['ours', 'daemon', 'install-service', '--yes', '--json', '--state-dir', dir, '--config', join(dir, 'config.json')];
-  // --force is reachable ONLY through this explicit argument, which the
-  // orchestrator passes only after the user answered yes to legacyReplacePrompt.
-  // It is never a default and never appears in a plan.
   if (adoptLegacyUnit) cmd.push('--force');
   return cmd;
 }

package/lib/target.mjs

@@ -31,6 +31,33 @@ export const INSTALL_RESERVED_PORTS = [3051, 3052];
 // The CLI-owned PID record that proves a daemon belongs to a state directory
 // even when nothing is recorded in its config (spec §1).
 export const CLI_PID_RECORD = 'ours-cli-daemon.json';
+// The SAME record, written by a different daemon. `ours daemon start` writes
+// ours-cli-daemon.json; prerelease ours-mcp wrote daemon.pid (packages/core
+// cli.ts PID_PATH). BOTH are read, and neither replaces the other: a machine
+// installed yesterday has the first and a machine installed today has the
+// second, and detection that goes blind on either one concludes "no daemon
+// here" and creates a SECOND daemon on a state directory that already has one.
+// Two writers on one state_data.bin is the corruption case this lookup exists
+// to prevent, so the lookup has to know both spellings.
+export const MCP_PID_RECORD = 'daemon.pid';
+export const PID_RECORDS = [CLI_PID_RECORD, MCP_PID_RECORD];
+
+/**
+ * The port a PID record names, whichever daemon wrote it.
+ *
+ * ours-cli-daemon.json is JSON with a `port`. daemon.pid is a bare pid — no
+ * port — so it proves a daemon EXISTS for this state directory without saying
+ * where. That distinction is the whole reason this returns both fields.
+ */
+export function readPidRecords(target, readJson, readText) {
+  const record = readJson(join(target, CLI_PID_RECORD));
+  const port = record && typeof record.port === 'number' && Number.isFinite(record.port) ? record.port : null;
+  const rawPid = typeof readText === 'function' ? readText(join(target, MCP_PID_RECORD)) : null;
+  const pid = rawPid !== null && rawPid !== undefined && /^\s*\d+\s*$/.test(String(rawPid))
+    ? Number.parseInt(String(rawPid).trim(), 10)
+    : null;
+  return { port, pid };
+}
 export const DAEMON_CONFIG = 'config.json';
 
 export class InstallUsageError extends Error {
@@ -192,7 +219,7 @@ export function classifyProbe(probe, targetStateDir) {
  * is still no I/O here, and `await` on a non-promise is the same value back, so
  * every existing fake keeps working unchanged.
  */
-export async function findDaemon({ stateDir, probe, readJson }) {
+export async function findDaemon({ stateDir, probe, readJson, readText }) {
   const target = resolve(stateDir);
   const config = readJson(join(target, DAEMON_CONFIG));
   const recordedPort = config && typeof config.port === 'number' && Number.isFinite(config.port) ? config.port : null;
@@ -204,8 +231,8 @@ export async function findDaemon({ stateDir, probe, readJson }) {
   if (byConfig.kind === 'present') return { ...byConfig, port: first, via: 'config', config };
   if (byConfig.kind === 'foreign' && !guessed) return { ...byConfig, port: first, via: 'config', config };
 
-  const record = readJson(join(target, CLI_PID_RECORD));
-  const recorded = record && typeof record.port === 'number' && Number.isFinite(record.port) ? record.port : null;
+  const records = readPidRecords(target, readJson, readText);
+  const recorded = records.port;
   if (recorded !== null && recorded !== first) {
     const byRecord = classifyProbe(await probe(recorded), target);
     if (byRecord.kind === 'present') return { ...byRecord, port: recorded, via: 'pid-record', config };
@@ -229,6 +256,12 @@ export async function findDaemon({ stateDir, probe, readJson }) {
   // daemon owns THIS directory. A foreign answer on a port the directory
   // actually RECORDED still refuses, because there the operator's own file said
   // the daemon was there and something else is.
+  // A bare pid record with no port still says a daemon OWNS this directory. It
+  // cannot say where, so this is not "present" — but it is a reason to report a
+  // stale record rather than silently create a second daemon beside it.
+  if (records.pid !== null && byConfig.kind !== 'present') {
+    return { kind: 'absent', reason: 'a daemon pid record exists but nothing answers', stalePidRecord: first, port: first, via: 'config', config };
+  }
   if (byConfig.kind === 'foreign') {
     return {
       kind: 'absent',
@@ -265,9 +298,9 @@ export async function findDaemon({ stateDir, probe, readJson }) {
  * if it is occupied that is a refusal, not a reason to shift. Only a derived port
  * is searched, from 3050 upward, skipping the reserved defaults.
  */
-export async function resolveTarget({ stateDir, port = null, portExplicit = false, probe, readJson, isTaken }) {
+export async function resolveTarget({ stateDir, port = null, portExplicit = false, probe, readJson, readText, isTaken }) {
   const target = resolve(stateDir);
-  const found = await findDaemon({ stateDir: target, probe, readJson });
+  const found = await findDaemon({ stateDir: target, probe, readJson, readText });
 
   if (found.kind === 'foreign') {
     return {

package/lib/uninstall.mjs

@@ -17,6 +17,7 @@
 import { join, resolve } from 'node:path';
 import { unitNameForStateDir } from './plan.mjs';
 import { tgConfigPath, coworkConfigPath } from './components.mjs';
+import { canonHarnesses } from './logic.mjs';
 
 /**
  * Does this directory even look like an ours state directory?
@@ -170,15 +171,16 @@ export function planComponentDetach(key, existing) {
 export function planDaemonRemoval({ stateDir, cliStartedIt }) {
   const dir = resolve(stateDir);
   const unit = unitNameForStateDir(dir);
+  const service = {
+    id: 'service',
+    unit: unit.ok ? unit.unit : null,
+    command: ['ours', 'daemon', 'uninstall-service', '--yes', '--state-dir', dir, '--config', join(dir, 'config.json')],
+    note: 'removes the unit managed by the ours CLI',
+  };
   return [
-    {
-      id: 'service',
-      unit: unit.ok ? unit.unit : null,
-      command: ['ours', 'daemon', 'uninstall-service', '--yes', '--state-dir', dir],
-      note: 'refuses a unit not marked as CLI-managed',
-    },
+    service,
     cliStartedIt
-      ? { id: 'stop', command: ['ours', 'daemon', 'stop', '--config', join(dir, 'config.json')] }
+      ? { id: 'stop', command: ['ours', 'daemon', 'stop', '--state-dir', dir, '--config', join(dir, 'config.json')] }
       : { id: 'stop-external', command: null, continues: true, note: 'this daemon was not started by the CLI; naming its launcher and continuing' },
   ];
 }
@@ -306,6 +308,13 @@ export function stripManagedBlock(text, markers) {
   return { action: 'strip', text: out.join('\n') };
 }
 
+/**
+ * The three harnesses this uninstaller knows, in the order they are offered.
+ * Same names and same order as the nightly picker and as `canonHarnesses`, so a
+ * selection written for one is a selection for the other.
+ */
+export const HARNESS_ORDER = ['claude-code', 'codex', 'hermes'];
+
 /**
  * What the harness-plugin half of an uninstall removes.
  *
@@ -313,6 +322,14 @@ export function stripManagedBlock(text, markers) {
  * rather than recomputed: while another daemon is still on this machine its
  * harnesses still need their plugins, so nothing here is touched at all.
  *
+ * `explicitSelection` OVERRIDES that keep, and only that. The keep is a guess
+ * made on the operator's behalf — "another daemon is here, so you probably still
+ * want these". When the operator has named the harnesses themselves (the picker,
+ * or OURS_UNINSTALL), the guess has been answered and must not outrank the
+ * answer. Nothing else about the plan changes: WHICH of the discovered harnesses
+ * are then acted on is decided by the caller, not here, so this stays the single
+ * description of what exists on disk.
+ *
  * Claude Code is deliberately manual-only. Its plugin lives in the in-app
  * marketplace, and there is no file on disk we own — so this prints the two
  * commands and claims nothing, which is the same never-dead-end contract the
@@ -321,7 +338,7 @@ export function stripManagedBlock(text, markers) {
  * Every path is EXACT — the precise file or directory the plugin installer
  * writes. Nothing here is a glob, and nothing walks a tree looking for matches.
  */
-export function planPluginRemoval({ home, env = {}, exists = () => false, lastDaemon = true } = {}) {
+export function planPluginRemoval({ home, env = {}, exists = () => false, lastDaemon = true, explicitSelection = false } = {}) {
   const hermesDir = env.HERMES_DIR || join(home, '.hermes');
   const codexDir = env.CODEX_DIR || join(home, '.codex');
   const skillsDir = env.SKILLS_DIR || join(home, '.agents', 'skills');
@@ -333,7 +350,7 @@ export function planPluginRemoval({ home, env = {}, exists = () => false, lastDa
     reason: "its plugin lives in Claude Code's in-app marketplace, so nothing on disk is ours to remove",
     steps: ['/plugin uninstall ours', '/plugin marketplace remove adapt-toolkit/ours-claude-marketplace'],
   };
-  if (!lastDaemon) {
+  if (!lastDaemon && !explicitSelection) {
     return {
       action: 'keep',
       reason: 'another daemon on this machine still uses these plugins',
@@ -379,14 +396,89 @@ export function planPluginRemoval({ home, env = {}, exists = () => false, lastDa
   };
 }
 
+/**
+ * §8 — WHICH harnesses to detach (inventory item 9.5).
+ *
+ * The nightly uninstaller let the operator choose: a `checkboxSelect` picker on a
+ * terminal, `OURS_UNINSTALL` without one, and NOTHING removed when it had
+ * neither. v3 had no choice at all — it removed every plugin artefact it found
+ * whenever this was the last daemon. A user who wanted to detach one harness had
+ * no way to say so, and an unattended run removed plugins that leaving
+ * `OURS_UNINSTALL` unset used to protect.
+ *
+ * This decides the three cases; the orchestrator only does the asking, so the
+ * rule and the terminal I/O stay apart.
+ *
+ *   explicit — a selection was given (OURS_UNINSTALL, or the answers to the
+ *              per-harness questions). Exactly those, intersected with what is
+ *              actually there. A name for a harness that is not installed is
+ *              reported as `ignored`, not silently dropped.
+ *   keep     — unattended with no selection. Nothing is removed, and the caller
+ *              says how to select. This is the conservative side: an uninstall
+ *              nobody is watching does not decide on its own that a harness
+ *              should lose its plugin.
+ *   ask      — a terminal and no selection. One question per harness, DEFAULTING
+ *              TO YES, because the daemon these plugins talk to is going away
+ *              and a plugin left behind advertises tools that no longer resolve.
+ *              An operator who just presses Enter gets exactly what v3 does
+ *              today; the only new thing is that they can now say no.
+ *
+ * A checkbox picker would match nightly's chrome more closely, but the effects
+ * contract this uninstaller runs on has `ask`, not `checkboxSelect` — and the
+ * question here is which harnesses, not which widget.
+ */
+export function planHarnessSelection(plugins, { selection = null, assumeYes = false } = {}) {
+  const offered = [...(plugins.manual ?? []), ...(plugins.harnesses ?? [])]
+    .map((h) => ({ key: h.key, label: h.label }))
+    .sort((a, b) => HARNESS_ORDER.indexOf(a.key) - HARNESS_ORDER.indexOf(b.key));
+  if (selection !== null) {
+    const keys = offered.map((o) => o.key);
+    return {
+      mode: 'explicit',
+      offered,
+      chosen: keys.filter((k) => selection.includes(k)),
+      ignored: selection.filter((k) => !keys.includes(k)),
+    };
+  }
+  if (assumeYes) {
+    return {
+      mode: 'keep',
+      offered,
+      chosen: [],
+      ignored: [],
+      reason: 'no OURS_UNINSTALL was set and there is nobody to ask',
+      hint: `set OURS_UNINSTALL="${HARNESS_ORDER.join(' ')}" (or a subset, or "all") to remove harness plugins unattended`,
+    };
+  }
+  return { mode: 'ask', offered, chosen: null, ignored: [] };
+}
+
+/**
+ * Narrow a plugin plan to the chosen harnesses. Pure, so the orchestrator never
+ * decides what "chosen" means to a plan — it only supplies the answers.
+ *
+ * `packages` follows the harnesses it narrows to: a plugin package belongs to
+ * the harness that was removed, so a harness that was kept keeps its package.
+ */
+export function selectHarnesses(plugins, chosen) {
+  const keep = (h) => chosen.includes(h.key);
+  const harnesses = (plugins.harnesses ?? []).filter(keep);
+  return {
+    ...plugins,
+    harnesses,
+    manual: (plugins.manual ?? []).filter(keep),
+    packages: harnesses.map((h) => h.pkg),
+  };
+}
+
 /**
  * The whole §8 order, refusing at step 1 rather than starting and stopping
  * half-way.
  */
-export function planUninstall({ home, env = {}, endpoint, stateDir, purge = false, assumeYes = false, confirmedComponents = [], readJson, readText, exists = () => true, cliStartedIt = true, otherStateDirsWithConfig = [], typedConfirmation = null }) {
+export function planUninstall({ home, env = {}, endpoint, stateDir, purge = false, assumeYes = false, confirmedComponents = [], readJson, readText, exists = () => true, cliStartedIt = true, otherStateDirsWithConfig = [], typedConfirmation = null, explicitHarnessSelection = false, platform = 'linux' }) {
   const dir = resolve(stateDir);
   const lastDaemon = otherStateDirsWithConfig.map((d) => resolve(d)).filter((d) => d !== dir).length === 0;
-  const plugins = planPluginRemoval({ home, env, exists, lastDaemon });
+  const plugins = planPluginRemoval({ home, env, exists, lastDaemon, explicitSelection: explicitHarnessSelection });
 
   // BEFORE the pointing question, and not resolvable by confirming anything: a
   // component config that will not parse cannot be proven not to name this
@@ -442,11 +534,16 @@ export function planUninstall({ home, env = {}, endpoint, stateDir, purge = fals
 /**
  * What each question answers to under OURS_ASSUME_YES.
  *
- * The two `false` entries are the point of the table: assume-yes never turns a
- * component on that was off, never MOVES one that already exists, and never
- * deletes state. It suppresses questions; it does not consent on the operator's
- * behalf to anything irreversible or to anything that changes where an existing
- * component is pointing.
+ * The `false` entries are the point of the table: assume-yes never turns a
+ * component on that was off, never MOVES one that already exists, never removes
+ * a harness's plugin, and never deletes state. It suppresses questions; it does
+ * not consent on the operator's behalf to anything irreversible or to anything
+ * that changes where an existing component is pointing.
+ *
+ * `plugins: false` is the one that answers a question this uninstaller used to
+ * answer the other way. A harness plugin is not this daemon's to give away
+ * unasked, and the operator has a way to ask for it by name — OURS_UNINSTALL —
+ * which is precisely the interface an unattended run should have to go through.
  */
 export const NON_INTERACTIVE_ANSWERS = {
   daemon: true,
@@ -454,6 +551,7 @@ export const NON_INTERACTIVE_ANSWERS = {
   tg: false,
   cowork: false,
   repointExistingConnector: false,
+  plugins: false,
   purge: false,
 };
 
@@ -465,3 +563,174 @@ export const NON_INTERACTIVE_ANSWERS = {
 export function refusalSurvivesAssumeYes(refusal) {
   return refusal && refusal.action === 'refuse' ? { ...refusal, exitCode: 2 } : refusal;
 }
+
+// -----------------------------------------------------------------------------
+// §9 — the OURS_UNINSTALL_* contract (inventory item 10.9)
+// -----------------------------------------------------------------------------
+
+/**
+ * The seven variables. THIS IS A DOCUMENTED PUBLIC INTERFACE, not an internal
+ * detail: all seven are in packages/installer/README.md, two of them are in
+ * uninstall.sh's header as well, and somebody's unattended uninstall script is
+ * written against them. v3 honoured none of them and said nothing, which is the
+ * worst of the three available behaviours — a documented variable that quietly
+ * does nothing is worse than one that errors, because the operator believes it
+ * worked.
+ *
+ * Each is in exactly one of two categories, and which one is not a matter of
+ * taste. A variable is HONOURED when v3 can deliver what it documents. A
+ * variable is REFUSED — exit 2, nothing removed, naming the variable and naming
+ * the replacement — when what it documents depends on something v3 does not
+ * have. Nothing is silently ignored and nothing is silently obeyed.
+ *
+ * HONOURED
+ *   OURS_UNINSTALL          which harness plugins to remove. Parsed by the same
+ *                           canonHarnesses the nightly picker used, so names,
+ *                           numbers, "all" and "none" all still mean what they
+ *                           meant. Feeds item 9.5's selection.
+ *   OURS_UNINSTALL_DAEMON   whether the daemon goes. See below — this is the one
+ *                           that matters most.
+ *   OURS_UNINSTALL_TELEGRAM
+ *   OURS_UNINSTALL_ROOMS    at the value `detach`, which is exactly the
+ *                           confirmation §8 step 1 asks a human for and which an
+ *                           unattended run otherwise cannot give, so today the
+ *                           run refuses instead of detaching.
+ *
+ * REFUSED
+ *   OURS_UNINSTALL_DATA=yes         v3 never deletes state without a human
+ *                                   present (§9), and that rule protects private
+ *                                   keys that exist nowhere else.
+ *   OURS_UNINSTALL_PROFILE          names an entry in the daemon registry. v3
+ *                                   has no registry; the selector is --state-dir.
+ *   OURS_UNINSTALL_FORGET_PROFILE   asks to forget a daemon as metadata while it
+ *                                   keeps running. v3 has no metadata to forget.
+ *   OURS_UNINSTALL_TELEGRAM/_ROOMS  at `uninstall` (v3 detaches, it does not
+ *                                   remove connector packages) or
+ *                                   `reassign:<profile-id>` (again the registry).
+ *
+ * WHY THE WHOLE CONTRACT ENGAGES OR NONE OF IT DOES. v2 gated on
+ * `OURS_UNINSTALL != null || OURS_UNINSTALL_DATA || OURS_UNINSTALL_DAEMON` and
+ * then asked nothing at all. That gate is kept exactly: with none of the seven
+ * set, `ours-uninstall` behaves precisely as it does today, so the blast radius
+ * of this whole change is "an operator who set one of the documented variables".
+ *
+ * AND THE ESCALATION THIS CLOSES. Before this, `OURS_UNINSTALL="hermes"` — a
+ * script that asked for ONE HARNESS PLUGIN to be removed — reached v3, which
+ * read none of it, and removed THE DAEMON: its service, its process, and the
+ * global packages. Honouring OURS_UNINSTALL_DAEMON is what makes a request to
+ * detach a plugin stay a request to detach a plugin.
+ */
+export const UNINSTALL_ENV_VARS = [
+  'OURS_UNINSTALL',
+  'OURS_UNINSTALL_PROFILE',
+  'OURS_UNINSTALL_FORGET_PROFILE',
+  'OURS_UNINSTALL_DAEMON',
+  'OURS_UNINSTALL_DATA',
+  'OURS_UNINSTALL_TELEGRAM',
+  'OURS_UNINSTALL_ROOMS',
+];
+
+/**
+ * Is the contract engaged at all? PRESENCE, not truth — `OURS_UNINSTALL=""` is a
+ * deliberate "no harnesses", exactly as v2's `!= null` read it, and is not the
+ * same as never having set it.
+ */
+export function uninstallEnvEngaged(env = {}) {
+  return UNINSTALL_ENV_VARS.some((name) => env[name] !== undefined && env[name] !== null);
+}
+
+const CONNECTOR_VARS = [
+  { name: 'OURS_UNINSTALL_TELEGRAM', key: 'tg', pkg: '@ours.network/tg-connector' },
+  { name: 'OURS_UNINSTALL_ROOMS', key: 'cowork', pkg: '@ours.network/cowork' },
+];
+
+function connectorRefusal(name, value, pkg) {
+  if (value === 'uninstall') {
+    return `${name}=uninstall asks for the connector's global package to be removed as well; this uninstaller detaches a connector, it does not uninstall one. Use ${name}=detach, then 'npm rm -g ${pkg}' yourself.`;
+  }
+  if (value.startsWith('reassign:')) {
+    return `${name}=${value} asks for the connector to be pointed at another daemon by profile id. This uninstaller has no profile registry, so there is no id it could resolve. Point the connector at the daemon you want first — 'ours-install --state-dir <path>' — and then re-run this uninstall.`;
+  }
+  return `${name}=${value} is not a value this uninstaller understands. The only supported value is 'detach'.`;
+}
+
+/**
+ * Read the contract, or refuse it. Pure: the caller passes the environment in.
+ *
+ * A refusal is returned rather than thrown, in the same shape planUninstall uses
+ * for its own refusals, so the orchestrator has one thing to print and one exit
+ * code to return — and so a test can assert the whole set of refusals at once
+ * instead of catching them one at a time.
+ */
+export function parseUninstallEnv(env = {}) {
+  const engaged = uninstallEnvEngaged(env);
+  const value = (name) => (typeof env[name] === 'string' ? env[name].trim() : '');
+  const refusals = [];
+
+  if (value('OURS_UNINSTALL_DATA') === 'yes') {
+    refusals.push({
+      variable: 'OURS_UNINSTALL_DATA',
+      value: 'yes',
+      message: "OURS_UNINSTALL_DATA=yes asks this uninstaller to delete a state directory with nobody present. It will not: that directory holds identity private keys that exist nowhere else and that no peer can give back, and state is never deleted in an unattended run. To delete it, run 'ours-uninstall --state-dir <dir> --purge' from a terminal and type the full path when it asks.",
+    });
+  }
+  const profile = value('OURS_UNINSTALL_PROFILE');
+  if (profile) {
+    refusals.push({
+      variable: 'OURS_UNINSTALL_PROFILE',
+      value: profile,
+      message: `OURS_UNINSTALL_PROFILE=${profile} names an entry in the daemon profile registry, which this uninstaller does not have — there is no profile to select. Choose the daemon by its state directory instead: 'ours-uninstall --state-dir <path>'.`,
+    });
+  }
+  if (value('OURS_UNINSTALL_FORGET_PROFILE') === 'yes') {
+    refusals.push({
+      variable: 'OURS_UNINSTALL_FORGET_PROFILE',
+      value: 'yes',
+      message: 'OURS_UNINSTALL_FORGET_PROFILE=yes asks for a daemon to be forgotten as metadata while it keeps running. This uninstaller keeps no registry of daemons, so there is nothing to forget and nothing it could do that would match that request — a daemon it is not pointed at is already left entirely alone.',
+    });
+  }
+
+  const components = {};
+  for (const connector of CONNECTOR_VARS) {
+    const raw = value(connector.name);
+    if (!raw) continue;
+    if (raw === 'detach') { components[connector.key] = 'detach'; continue; }
+    refusals.push({
+      variable: connector.name,
+      value: raw,
+      message: connectorRefusal(connector.name, raw, connector.pkg),
+    });
+  }
+
+  const canon = engaged ? canonHarnesses(env.OURS_UNINSTALL ?? '') : null;
+  // A token we cannot map is a request we cannot deliver. The nightly picker
+  // reported these and carried on, which under an unattended run means
+  // OURS_UNINSTALL="hermez" removes nothing and says so into a log nobody reads.
+  // Same rule as the rest of this contract: name it, refuse, remove nothing.
+  for (const token of canon?.unknown ?? []) {
+    refusals.push({
+      variable: 'OURS_UNINSTALL',
+      value: token,
+      message: `OURS_UNINSTALL names "${token}", which is not a harness this uninstaller knows. Use ${HARNESS_ORDER.join(', ')}, or "all", or "none".`,
+    });
+  }
+
+  const contract = {
+    engaged,
+    // Not engaged means "decide this the way you always did": null selection, and
+    // the daemon removal that IS this command.
+    harnesses: canon ? canon.names : null,
+    unknownHarnessTokens: canon ? canon.unknown : [],
+    daemon: engaged ? value('OURS_UNINSTALL_DAEMON') === 'yes' : true,
+    confirmedComponents: Object.keys(components),
+  };
+  if (refusals.length === 0) return contract;
+  return {
+    ...contract,
+    action: 'refuse',
+    exitCode: 2,
+    reason: 'uninstall-env-unsupported',
+    refusals,
+    message: `${refusals.map((r) => r.message).join('\n')}\nNothing was removed.`,
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "0.17.0-nightly.9",
+  "version": "0.18.0-nightly.1",
   "private": false,
   "description": "The unified ours.network stack installer (ours-install): one guided ~3-minute flow for ours core (the daemon) + the harness plugins (Claude Code / Codex) + ours-fleet + the Telegram connector, then a single copy-paste hand-off prompt. Self-contained (Node built-ins only); run as `ours-install` or via curl|bash (install.sh).",
   "type": "module",