@ours.network/install 0.17.0 → 0.18.0-nightly.2

package/README.md

@@ -1,146 +1,98 @@
 # @ours.network/install — `ours-install`
 
-The **unified ours.network stack installer**. ONE guided ~3-minute flow that installs the WHOLE
-stack for someone who already has Claude Code, Codex, and/or Hermes, safely offers optional
-voice-message transcription, then hands back a single copy-paste prompt for remaining setup.
-
-## Install
-
-**Recommended — a persistent, versioned, integrity-checked command on your PATH:**
+The all-in-one installer for the ours.network stack. One run installs and
+configures the shared daemon, MCP adapter, cowork, Telegram connector, Fleet,
+and plugins for every safely detected agent harness.
 
 ```sh
-npm i -g @ours.network/install && ours-install
+npm install --global @ours.network/install
+ours-install
 ```
 
-Re-run (or update / add a skipped piece) any time with just `ours-install`.
-
-**One-off, no global install:**
+The normal flow uses one daemon at `~/.ours` on port 3050, shows an eight-stage
+progress bar, and asks only for information it cannot safely infer (normally the
+Human identity's display name). Existing daemon conflicts and moving a Telegram
+connector from another daemon still require explicit confirmation.
+
+## What the installer does
+
+- Installs `@ours.network/cli`, `@ours.network/mcp`,
+  `@ours.network/tg-connector`, `@ours.network/cowork`, and
+  `@ours.network/fleet` on one release channel.
+- Configures, starts, and enables the single shared daemon.
+- Creates the daemon's Human identity (historically called the root identity),
+  or preserves the existing one on a re-run.
+- Installs the ours plugin into safely detected Claude Code, Codex, and Hermes
+  installations.
+- Configures and starts cowork against the shared daemon.
+- Configures Telegram against the same daemon, but does **not** start it.
+- Runs Fleet's host initialization and, when `~/fleet.yaml` is absent, writes a
+  conservative stopped starter with `FleetCoordinator`, a `fleet-health`
+  watchdog, and a ten-minute `coordinator_health` loop. An existing
+  `~/fleet.yaml` is never overwritten.
+
+The operator CLI owns daemon configuration, lifecycle, and boot persistence.
+The MCP package is only the stdio adapter spawned by agent harnesses; the
+installer never asks `ours-mcp` to start a daemon.
+
+## What remains stopped
+
+Telegram and Fleet are installed but intentionally not started. Review and
+activate them when ready:
 
 ```sh
-npx @ours.network/install
+# After configuring a Telegram bot and route locally:
+ours-tg-connector install-service
+
+# After reviewing ~/fleet.yaml:
+ours-fleet doctor
+ours-fleet config
+ours-fleet up
+ours-fleet ls
 ```
 
-**Fallback for machines without npm** (least secure — pipes a script straight into your shell):
+The final installer screen repeats these commands and provides a copy-paste
+prompt for Claude Code, Codex, or Hermes. The agent should guide local bot-token
+entry without asking the user to paste the secret into chat.
 
-```sh
-curl -fsSL https://raw.githubusercontent.com/adapt-toolkit/ours-mcp/main/packages/installer/install.sh | bash
-```
-
-The `curl … | bash` bootstrap simply gets Node.js/npm sorted, then does the `npm i -g
-@ours.network/install` and runs `ours-install` for you. `ours-install` is the single front door;
-`ours-codex-install` is kept as a **thin alias** that hands off to it (use
-`ours-codex-install --codex-only` for the legacy Codex-only path).
-
-The installer is a small **self-contained** Node package (Node built-ins only — no runtime
-dependency on the things it installs): an ASCII banner, tasteful colour (degrades under `NO_COLOR`
-/ no-tty), and plain-language **what + why** for every step.
-
-## The flow (what the user sees)
-
-1. **Pre-flight** — a short checklist, not a wall of logs: platform (Linux / macOS / WSL; native
-   Windows prints a WSL pointer and exits), Node.js, and **harness detection with alias-safety**.
-   Before ever calling `claude` / `codex`, it confirms each resolves to a **real executable** that
-   answers `--version` promptly. A shell alias / hanging wrapper is **never called** (that would
-   hang the run) — it's reported plainly with a fix, and a manual-install path is always offered.
-   If neither harness exists it says so and exits.
-2. **Config-first** (first install only) — the daemon's two base settings, up front:
-   the **broker** (end-to-end encrypted; the broker never sees message content — almost everyone
-   just presses Enter) and the **port** (probes `3050`; only asks if it's busy; never hands out
-   `3051`, reserved for the Telegram connector). Applied once, then the stack is built with it.
-3. **Four consent gates**, each paced with a clean `✓ … No problems.` line + an explicit
-   **Continue?** — never a start-twice-then-ask, never a silent failure:
-   - **1/4 ours core (the daemon)** — write config → optional voice setup → install/start ONCE
-     → boot service. On a re-run it reuses the running config (no re-ask) and only updates when
-     you say yes. Complete voice setup is kept without prompting. Missing/incomplete setup is
-     offered before the first start or pending update restart, then delegated to the canonical
-     `ours-mcp voice-setup` provider selector and hidden API-key prompt. Accepted setup owns the
-     one restart/readiness transaction; declining or already-ready setup preserves the normal
-     core lifecycle. The secret is written atomically to mode-`0600` config; a failed daemon
-     reload rolls back.
-   - **2/4 harness plugins** — the installer **drives the plugin CLIs itself**
-     (`claude plugin marketplace add …` + `claude plugin install ours@ours.network`;
-     `codex plugin marketplace add …` + `codex plugin add ours@ours-codex-marketplace`). Choosing
-     Codex also installs the `ours-codex` live launcher in the same step. Any failure / alias
-     prints the exact manual commands and continues — it **never dead-ends**.
-   - **3/4 ours-fleet** — makes your harnesses persistent, always-online agent teams that survive
-     a reboot; runs `ours-fleet init`. Default **Yes**.
-   - **4/4 Telegram connector** — install-only (no bot tokens here), then optionally as a
-     boot service.
-4. **Summary + hand-off** — a recap (skipped/failed rows call out the fix), then a **literal
-   copy-paste prompt** (root identity + fleet + Telegram) with the steps for any skipped/failed
-   component dropped out. Copied to the clipboard where supported.
-
-The human identity is created idempotently after the daemon becomes reachable. Because
-`curl … | bash` gives the script its input over the pipe, every prompt is read from the
-controlling terminal (`/dev/tty`), so the flow still works piped.
-
-## Non-interactive / CI / safe dry-run
+## Preview and automation
 
 ```sh
-OURS_ASSUME_YES=1 bash install.sh          # accept every default, no prompts
-OURS_INSTALL_DRY_RUN=1 bash install.sh     # walk the WHOLE flow, install/change NOTHING
+ours-install --dry-run
+OURS_ASSUME_YES=1 ours-install
+ours-install --state-dir /absolute/path --port 3070
 ```
 
-`OURS_INSTALL_DRY_RUN=1` routes every side-effecting action through a print-only seam — it shows
-exactly the commands it *would* run (npm installs, `ours-mcp start`, plugin adds, `ours-fleet
-init`, service installs) without executing them. That is the safe way to preview the flow on a
-machine you don't want to touch, and how the integration tests drive it.
-
-Non-interactive runs never prompt for or synthesize voice credentials. Supply a complete
-`OURS_STT_*` environment configuration yourself, or rerun interactively later; missing setup
-is reported and left unchanged.
+Dry-run walks the real plan without writing files, installing packages, starting
+processes, or changing services. `OURS_ASSUME_YES=1` uses the OS username for a
+new Human identity and asks no ordinary setup questions, but it never bypasses
+selection conflicts, connector moves, or destructive safeguards.
 
-| var | meaning |
-|---|---|
-| `OURS_ASSUME_YES` | accept every default, never prompt (implies no tty needed) |
-| `OURS_INSTALL_DRY_RUN` | walk the flow without installing or changing anything |
-| `OURS_NPM` | npm binary to use (default `npm`) |
-| `OURS_CONFIG` | daemon config file location (default `~/.ours/config.json`) |
+A non-default daemon must be selected coherently with a config file or matching
+port and state directory. Harnesses and the generated Fleet role receive that
+selection through `OURS_CONFIG`; there is no per-application daemon.
 
 ## Uninstall
 
-The companion `uninstall.sh` reverses what the installers created — same thin-bootstrap +
-Node treatment (banner, colour, a clear explanation of what will be removed). Run it from a
-checkout:
-
 ```sh
-bash packages/installer/uninstall.sh
+ours-uninstall --state-dir "$HOME/.ours"
+ours-uninstall --state-dir "$HOME/.ours" --purge
 ```
 
-or over the same raw-URL pattern as `install.sh` (pointing at `uninstall.sh`):
-
-```sh
-curl -fsSL https://raw.githubusercontent.com/adapt-toolkit/ours-mcp/main/packages/installer/uninstall.sh | bash
-```
+The uninstaller delegates service and daemon removal to the `ours` CLI. Identity
+state is retained by default. Purging requires the existing destructive gates and
+targets only the explicit state directory.
 
-It uses the **same toggle UI** to pick what to remove — per-harness plugins, the ours data
-directory (`~/.ours`), and the `ours-mcp` daemon. It removes **only** what the installers
-created, and guards the two destructive items — the data directory and the daemon — behind
-an explicit typed `yes`.
+## Release channel
 
-Headless (no terminal), drive it with environment variables:
+`OURS_CHANNEL=nightly` (or `OURS_INSTALL_CHANNEL`) selects the packages' nightly
+dist-tags. Without an override, the installer's own version selects the channel.
 
-```sh
-OURS_UNINSTALL="hermes codex" \
-OURS_UNINSTALL_DATA=yes \
-OURS_UNINSTALL_DAEMON=yes \
-  bash uninstall.sh
-```
+## Environment
 
-| var | meaning |
-|---|---|
-| `OURS_UNINSTALL` | harnesses to remove (space/comma list of `claude-code codex hermes`, or `all`) |
-| `OURS_UNINSTALL_DATA` | `yes` — remove the ours data directory (`~/.ours`) |
-| `OURS_UNINSTALL_DAEMON` | `yes` — remove the `ours-mcp` daemon |
-
-## Notes
-
-- This package is **not published to npm** (`private: true`); it ships as the hosted
-  `install.sh` bootstrap plus the `install.mjs` Node installer (and its `lib/`), and exposes the
-  `ours-install` bin. The pieces it installs — the daemon (`@ours.network/mcp`), the harness
-  plugins via each marketplace, `@ours.network/fleet`, and `@ours.network/tg-connector` — are the
-  published components.
-- **Idempotent + safe to re-run.** A re-run adds a skipped piece, re-points the plugins, or (only
-  when you say yes) updates a component; an already-current daemon is left untouched, its running
-  port and complete voice setup are reused everywhere. Bot tokens and fleet roles remain in the
-  copy-paste hand-off; provider keys never enter that prompt or agent chat.
+- `OURS_ASSUME_YES=1`: accept safe defaults without prompting.
+- `OURS_INSTALL_DRY_RUN=1`: preview without mutation.
+- `OURS_NPM`: npm executable.
+- `OURS_CONFIG`: explicit daemon configuration file.
+- `OURS_STATE_DIR`: explicit daemon state directory.
+- `OURS_CHANNEL`: `latest` or `nightly`.