@ours.network/install 0.18.0-nightly.1 → 0.18.0-nightly.3

package/README.md

@@ -1,27 +1,64 @@
 # @ours.network/install — `ours-install`
 
-The guided installer for the ours shared daemon, MCP adapter, harness plugins,
-ours-fleet, and optional connectors.
+The all-in-one installer for the ours.network stack. One run installs and
+configures the shared daemon, MCP adapter, cowork, Telegram connector, Fleet,
+and plugins for every safely detected agent harness.
 
 ```sh
 npm install --global @ours.network/install
 ours-install
 ```
 
-The installer treats the operator CLI and the MCP adapter as separate packages:
+The normal flow uses one daemon at `~/.ours` on port 3050, shows an eight-stage
+progress bar, and asks only for information it cannot safely infer (normally the
+Human identity's display name). Existing daemon conflicts and moving a Telegram
+connector from another daemon still require explicit confirmation.
+
+## What the installer does
+
+- Installs `@ours.network/cli`, `@ours.network/mcp`,
+  `@ours.network/tg-connector`, `@ours.network/cowork`, and
+  `@ours.network/fleet` on one release channel.
+- Configures, starts, and enables the single shared daemon.
+- Creates the daemon's Human identity (historically called the root identity),
+  or preserves the existing one on a re-run.
+- Installs the ours plugin into safely detected Claude Code, Codex, and Hermes
+  installations.
+- Configures and starts cowork against the shared daemon.
+- Configures Telegram against the same daemon, but does **not** start it.
+- Runs Fleet's host initialization and, when `~/fleet.yaml` is absent, writes a
+  conservative stopped starter with `FleetCoordinator`, a `fleet-health`
+  watchdog, and a ten-minute `coordinator_health` loop. An existing
+  `~/fleet.yaml` is never overwritten.
+
+The operator CLI owns daemon configuration, lifecycle, and boot persistence.
+The MCP package is only the stdio adapter spawned by agent harnesses; the
+installer never asks `ours-mcp` to start a daemon.
+
+The external-history storage epoch is a clean breaking reset. The daemon refuses
+old packet state without modifying it, and this installer never migrates, purges,
+or silently replaces identities, contacts, invites, pending payloads, or history.
+Back up any wanted old state and remove it explicitly before starting the new epoch.
+
+## What remains stopped
+
+Telegram and Fleet are installed but intentionally not started. Review and
+activate them when ready:
 
-- `@ours.network/cli` owns daemon configuration, lifecycle, and boot services.
-- `@ours.network/mcp` is the stdio MCP adapter spawned by agent harnesses.
-
-It configures a selected state directory, installs both packages, starts the
-daemon with `ours daemon start`, installs its service with
-`ours daemon install-service`, and uses `ours identity create-root` for the Human
-identity. It never asks ours-mcp to boot or configure a daemon.
+```sh
+# After configuring a Telegram bot and route locally:
+ours-tg-connector install-service
+
+# After reviewing ~/fleet.yaml:
+ours-fleet doctor
+ours-fleet config
+ours-fleet up
+ours-fleet ls
+```
 
-The default is one shared daemon at `~/.ours` on port 3050. A non-default daemon
-must be selected coherently with a config file or matching port and state
-directory. Harnesses receive that selection through `OURS_CONFIG`; there is no
-separate per-harness daemon registry.
+The final installer screen repeats these commands and provides a copy-paste
+prompt for Claude Code, Codex, or Hermes. The agent should guide local bot-token
+entry without asking the user to paste the secret into chat.
 
 ## Preview and automation
 
@@ -32,8 +69,13 @@ ours-install --state-dir /absolute/path --port 3070
 ```
 
 Dry-run walks the real plan without writing files, installing packages, starting
-processes, or changing services. Non-interactive runs accept defaults but never
-bypass selection conflicts or destructive safeguards.
+processes, or changing services. `OURS_ASSUME_YES=1` uses the OS username for a
+new Human identity and asks no ordinary setup questions, but it never bypasses
+selection conflicts, connector moves, or destructive safeguards.
+
+A non-default daemon must be selected coherently with a config file or matching
+port and state directory. Harnesses and the generated Fleet role receive that
+selection through `OURS_CONFIG`; there is no per-application daemon.
 
 ## Uninstall
 
@@ -53,7 +95,7 @@ dist-tags. Without an override, the installer's own version selects the channel.
 
 ## Environment
 
-- `OURS_ASSUME_YES=1`: accept defaults without prompting.
+- `OURS_ASSUME_YES=1`: accept safe defaults without prompting.
 - `OURS_INSTALL_DRY_RUN=1`: preview without mutation.
 - `OURS_NPM`: npm executable.
 - `OURS_CONFIG`: explicit daemon configuration file.

package/lib/components.mjs

@@ -6,8 +6,8 @@
 // contents and the installed versions, and every function returns a plan.
 //
 // The three components are the MCP server, the Telegram connector and cowork.
-// None of them IS the daemon; all three attach to one. The messenger is out of
-// scope here, and ours-fleet sits on top and is not installed here.
+// None of them IS the daemon; all three attach to one. A normal install carries
+// the complete stack, while the messenger remains deliberately out of scope.
 
 import { join, resolve } from 'node:path';
 import { pkgSpec, resolveChannel } from './logic.mjs';
@@ -29,8 +29,8 @@ import { pkgSpec, resolveChannel } from './logic.mjs';
 // has to be impossible rather than discouraged.
 export const COMPONENTS = [
   { key: 'mcp', label: 'MCP server for your harness', pkg: '@ours.network/mcp', specKey: 'mcp', default: true, required: true },
-  { key: 'tg', label: 'Telegram connector', pkg: '@ours.network/tg-connector', specKey: 'tg-connector', default: false },
-  { key: 'cowork', label: 'cowork', pkg: '@ours.network/cowork', specKey: 'cowork', default: false },
+  { key: 'tg', label: 'Telegram connector', pkg: '@ours.network/tg-connector', specKey: 'tg-connector', default: true },
+  { key: 'cowork', label: 'cowork', pkg: '@ours.network/cowork', specKey: 'cowork', default: true },
 ];
 
 /**
@@ -105,10 +105,10 @@ export const coworkConfigPath = (home, env = {}) => env.OURS_COWORK_CONFIG ?? jo
 // -----------------------------------------------------------------------------
 
 /**
- * Which components this run installs. Defaults are MCP server yes, connector no,
- * cowork no — the same answers a non-interactive run takes, so
- * `OURS_ASSUME_YES=1 ours-install` produces a daemon plus the MCP server and
- * nothing else (spec §9).
+ * Which components this run installs. The default is the complete stack: MCP,
+ * Telegram and cowork all attach to the same daemon. Explicit programmatic
+ * answers are retained for compatibility, but the public installer no longer
+ * asks the user to assemble the product one package at a time.
  *
  * `installed` marks a component already present so the question reads "keep it?"
  * — and DECLINING AN ALREADY-INSTALLED COMPONENT NEVER UNINSTALLS IT. Removal is
@@ -203,10 +203,11 @@ export function planTgAttachment({ existing, endpoint, stateDir, brokerUrl, assu
     changed: changes.length > 0,
     changes,
     config: merged,
-    // Written BEFORE the service: `ours-tg-connector install-service` bakes the
-    // resolved values into the unit as environment, and environment outranks the
-    // config file afterwards.
-    service: ['ours-tg-connector', 'install-service'],
+    // Telegram is intentionally staged but stopped. Its CLI currently couples
+    // service installation with `enable --now`, so calling it here would violate
+    // the installer's promise not to launch Telegram before a bot is configured.
+    // The end screen gives this exact command as the explicit opt-in start step.
+    service: null,
     untouched: [...TG_REGISTRY_FILES, ...TG_ROUTE_FILES],
   };
   if (!pointsElsewhere) return { ...plan, action: plan.changed ? 'attach' : 'unchanged' };

package/lib/extras.mjs

@@ -10,7 +10,7 @@
 // terminal. Every function takes what was observed and returns a plan; the
 // orchestrator (a later PR) is what performs it.
 
-import { join, resolve } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { pkgSpec } from './logic.mjs';
 
 const cfgPath = (stateDir) => join(resolve(stateDir), 'config.json');
@@ -213,28 +213,63 @@ export function restartHints(summary = []) {
 }
 
 // -----------------------------------------------------------------------------
-// ours-fleet — the one that needs zero code
+// ours-fleet — installed and staged, never started implicitly
 // -----------------------------------------------------------------------------
 
-/**
- * ours-fleet needs NO change in either repo, and the installer configures
- * nothing in it.
- *
- * `ours-fleet init` takes no daemon argument of any kind and never reads a
- * daemon config: it makes its directories, installs its own units and prints a
- * next step. Fleet resolves the ours daemon the same way the MCP client does —
- * OURS_CONFIG ?? ~/.ours/config.json, then OURS_PORT / OURS_STATE_DIR /
- * OURS_API_TOKEN — and it does so PER ROLE, through
- * resolveEndpoint({ ...process.env, ...role.env }). Different roles can already
- * target different daemons. Temp supervisors inherit the same four names.
- *
- * So for a non-default state directory the installer's ONLY job is to say the
- * one fleet.yaml line that points a role at the daemon this run created. Saying
- * it is the whole feature; anything more would be configuring a tool that is
- * already correct.
- */
-export function planFleet({ stateDir, isDefaultStateDir, wanted = true, channel = 'latest' } = {}) {
+export const fleetConfigPath = (home) => join(resolve(home), 'fleet.yaml');
+
+const yamlString = (value) => JSON.stringify(String(value));
+
+/** A conservative, useful first fleet: one coordinator, one watchdog, one loop. */
+export function defaultFleetConfig({ home, stateDir, isDefaultStateDir } = {}) {
+  const cwd = resolve(home);
   const config = stateDir ? cfgPath(stateDir) : null;
+  const roleEnv = isDefaultStateDir || !config
+    ? ''
+    : `\n    env:\n      OURS_CONFIG: ${yamlString(config)}`;
+  return `# Generated by ours-install. Review this file before starting Fleet.\n`
+    + `defaults:\n`
+    + `  harness: codex\n`
+    + `  session: acp\n`
+    + `  permissions:\n`
+    + `    approval: allow\n`
+    + `    filesystem: workspace\n`
+    + `    unattended: wait\n`
+    + `  monitor:\n`
+    + `    mode: fleet\n\n`
+    + `roles:\n`
+    + `  FleetCoordinator:\n`
+    + `    identity: FleetCoordinator\n`
+    + `    cwd: ${yamlString(cwd)}\n`
+    + `    mission: Coordinate durable agent work, delegate bounded tasks, and report material outcomes.\n`
+    + `    bio: Fleet coordinator for this host; engage it to assign work or check agent status.\n`
+    + `    persona: |\n`
+    + `      Keep a concise durable worklog. Preserve user state, verify delegated results,\n`
+    + `      and escalate decisions that require new authority. Report material progress only.${roleEnv}\n\n`
+    + `watchdogs:\n`
+    + `  fleet-health:\n`
+    + `    coordinator: FleetCoordinator\n`
+    + `    watch: [FleetCoordinator]\n`
+    + `    harness: codex\n`
+    + `    session: acp\n`
+    + `    interval: 10m\n`
+    + `    timeout: 8m\n\n`
+    + `loops:\n`
+    + `  coordinator_health:\n`
+    + `    roles: [FleetCoordinator]\n`
+    + `    interval: 10m\n`
+    + `    initial_delay: 10m\n`
+    + `    enabled: true\n`
+    + `    prompt: |\n`
+    + `      Perform one bounded fleet health pass. Reconcile active work, specialist state,\n`
+    + `      declared blockers, and CI. Unstick only safe in-scope work. If nothing material\n`
+    + `      changed, complete silently.\n`;
+}
+
+export function planFleet({ home, stateDir, isDefaultStateDir, wanted = true, channel = 'latest' } = {}) {
+  const config = stateDir ? cfgPath(stateDir) : null;
+  const resolvedHome = home ?? (stateDir ? dirname(resolve(stateDir)) : null);
+  const path = resolvedHome ? fleetConfigPath(resolvedHome) : null;
   const plan = {
     key: 'fleet',
     label: 'ours-fleet',
@@ -251,12 +286,13 @@ export function planFleet({ stateDir, isDefaultStateDir, wanted = true, channel
     // this defers to it rather than restating it.
     install: ['npm', 'i', '-g', pkgSpec('fleet', channel)],
     init: ['ours-fleet', 'init'],
-    // Stated as data so a test can pin it: this feature writes no fleet config.
-    writes: [],
+    configPath: path,
+    config: resolvedHome ? defaultFleetConfig({ home: resolvedHome, stateDir, isDefaultStateDir }) : null,
+    writes: path ? [path] : [],
     roleEnv: isDefaultStateDir ? {} : { OURS_CONFIG: config },
     instruction: isDefaultStateDir
-      ? null
-      : `fleet roles that should use this daemon need one line in fleet.yaml:\n    env: { OURS_CONFIG: ${config} }`,
+      ? `review ${path}, then run ours-fleet doctor and ours-fleet up when you are ready`
+      : `review ${path}; its coordinator is pinned to this daemon with OURS_CONFIG=${config}`,
   };
   return wanted ? { ...plan, action: 'install' } : { ...plan, action: 'skip', offerOnRerun: true };
 }
@@ -266,14 +302,9 @@ export function planFleet({ stateDir, isDefaultStateDir, wanted = true, channel
 // -----------------------------------------------------------------------------
 
 /**
- * buildHandoffPrompt is already pure, already renumbers and already drops steps
- * for components that were not installed. Re-pointing it is one preamble.
- *
- * DEFAULT STATE DIRECTORY → THE TEXT IS UNCHANGED, BYTE FOR BYTE. That is the
- * overwhelming majority case and it is pinned by a test, because the agent on
- * the other end of this prompt configures fleet roles and harness environments,
- * and a stray line about a state directory the user never chose is a worse
- * outcome than no line at all.
+ * buildHandoffPrompt is pure, renumbers automatically, and drops steps for
+ * components that were not installed. The default path needs no daemon preamble;
+ * a non-default path names the exact config so the assistant cannot guess.
  */
 export function buildHandoffPromptV3({
   identity = false,
@@ -291,16 +322,16 @@ export function buildHandoffPromptV3({
   }
   if (fleet) {
     steps.push(
-      'Set up my ours-fleet: ask me what agents I want in my fleet for\n'
-      + '   PERMANENT use (a name + role/purpose for each), then create and\n'
-      + '   configure those permanent fleet agents for me.',
+      'Review ~/fleet.yaml with me. It already contains a stopped FleetCoordinator,\n'
+      + '   a fleet-health watchdog, and a 10-minute coordinator health loop. Ask\n'
+      + '   before changing permissions or starting the fleet.',
     );
   }
   if (telegram) {
     steps.push(
-      'Set up my Telegram bot: ask me for my bot\'s name and its token from\n'
-      + '   @BotFather, register the bot, create a chat↔agent connection, and\n'
-      + '   give me the invite link to send.',
+      'Finish my Telegram setup without exposing secrets: ask me for the bot name\n'
+      + '   and guide me through entering the @BotFather token locally. Register the\n'
+      + '   route, then start the connector only after I approve.',
     );
   }
   if (steps.length === 0) return { text: '', empty: true };

package/lib/orchestrate.mjs

@@ -35,10 +35,10 @@ import { planHarnessPlugins, planFleet, buildHandoffPromptV3, restartHints } fro
 import { summarizeRun } from './rerun.mjs';
 import { configJournal, reportRollback } from './journal.mjs';
 import { detectDaemons, planDaemonSelection, resolveSelection } from './detect.mjs';
-import { detectPlatform, resolveChannel, validateBroker } from './logic.mjs';
+import { detectPlatform, resolveChannel } from './logic.mjs';
 import { daemonEnv } from './effects.mjs';
 import { USAGE } from './usage.mjs';
-import { ok, info, warn, heading, banner, box, c } from './ui.mjs';
+import { ok, info, warn, heading, banner, box, c, progress } from './ui.mjs';
 
 export const EXIT_OK = 0;
 export const EXIT_REFUSED = 2;
@@ -418,42 +418,15 @@ function readChanged(stdout) {
 /**
  * THE QUESTION NOBODY WAS ASKING.
  *
- * `planComponentSelection` has always read an `answers` map — and NOTHING EVER
- * POPULATED IT. `args.answers` is not produced by parseInstallArgs and is not
- * written by any phase, so it was permanently `{}`, every optional component fell
- * to its own default, and tg and cowork (both default false) were skipped in
- * silence. The screen then printed "cowork — not installed" as though that had
- * been a decision.
- *
- * This was the ONE phase with no question. Harness plugins ask, ours-fleet asks,
- * voice asks, the broker asks. Components did not.
- *
- * IT IS NOT A COWORK BUG, and fixing only the component that got reported would
- * have left the identical defect live under a different label: the Telegram
- * connector is unreachable by exactly the same route, and nobody noticed only
- * because tg is usually configured somewhere else.
- *
- * A REQUIRED component is never asked — since #74 the MCP package IS the daemon,
- * the daemon phase has already installed it, and a question whose only honest
- * answer is yes is not a question. Non-interactive runs are unchanged: assumeYes
- * takes each component's own default, which is what NON_INTERACTIVE_ANSWERS
- * documents (mcp yes, tg no, cowork no), so nothing about the unattended contract
- * moves.
+ * The public installer has one product, not a package-selection questionnaire:
+ * MCP, Telegram, and cowork are all installed. Explicit injected answers remain
+ * only as a compatibility/test seam for callers that deliberately omit a piece.
  */
 export async function askComponents(args, effects) {
-  const answers = { ...(args.answers ?? {}) };
-  if (args.assumeYes) return answers;
-  const optional = COMPONENTS.filter((c) => !c.required && answers[c.key] === undefined);
-  if (optional.length === 0) return answers;
-  effects.out(heading('What else should this daemon carry?'));
-  for (const component of optional) {
-    const already = (args.installed ?? {})[component.key] === true;
-    answers[component.key] = await effects.ask(
-      already ? `Keep ${component.label}?` : `Install ${component.label}?`,
-      already || component.default,
-    );
-  }
-  return answers;
+  // The product is the complete stack. Asking the operator to reconstruct that
+  // product from package names was choice theatre and made unattended installs
+  // incomplete. Explicit injected answers remain a test/compatibility seam.
+  return { ...(args.answers ?? {}) };
 }
 
 /**
@@ -529,29 +502,14 @@ async function attachComponent(component, { args, effects, dir, endpoint, isDefa
       }
     }
     await perform(effects, args.dryRun, `install ${plan.install[3]}`, () => effects.run(plan.install[0], plan.install.slice(1)));
-    // ONE UNIT OF WORK: these bytes and the service that reads them. If the
-    // service does not come up, the connector's config names this daemon while its
-    // unit still carries the OLD environment — and the phase's own catch would
-    // report one failed line and let the run print "install complete".
-    const journal = configJournal(effects, { dryRun: args.dryRun });
     if (plan.changed) {
-      // Written BEFORE the service: install-service bakes these values into the
-      // unit as environment, and environment outranks the config file after.
-      journal.snapshot(path);
       await perform(effects, args.dryRun, `write ${path}`, () => effects.writeJson(path, `${JSON.stringify(plan.config, null, 2)}\n`));
     } else {
       effects.out(ok(`${path} already points here — not touched`));
     }
-    try {
-      await perform(effects, args.dryRun, 'Telegram connector service installed', () => effects.run(plan.service[0], plan.service.slice(1)));
-    } catch (error) {
-      // Scoped to THIS component: the daemon came up correctly and is not undone
-      // by a connector that did not. That is the rule this journal's per-unit scope
-      // exists to keep.
-      rollBack(effects, journal, args, 'the Telegram connector service did not come up — putting its config back');
-      throw error;
-    }
-    return { key: 'tg', state: 'installed' };
+    effects.out(ok('Telegram connector installed and configured, but not started.'));
+    effects.out(info('After adding a bot, start it explicitly with: ours-tg-connector install-service'));
+    return { key: 'tg', state: 'installed', note: 'configured; stopped' };
   }
 
   const path = coworkConfigPath(effects.home, effects.env);
@@ -608,27 +566,11 @@ async function attachComponent(component, { args, effects, dir, endpoint, isDefa
  */
 export async function askBroker(args, effects) {
   const standard = args.brokerUrl;
-  if (args.assumeYes) return standard;
-  effects.out(heading('Your broker'));
-  effects.out(info('Your agents connect through a "broker" — a shared meeting point that lets them find'));
-  effects.out(info("each other. It's secure: your messages are end-to-end encrypted, so the broker never"));
-  effects.out(info('sees what they say. Almost everyone uses the standard one — just press Enter.'));
-  if (!(await effects.ask('Use a custom broker address?', false))) {
-    effects.out(ok('using the standard broker.'));
-    return standard;
-  }
-  const entered = String(await effects.askLine('Enter the broker address: ', '')).trim();
-  const checked = validateBroker(entered);
-  if (!entered || !checked.ok || checked.empty) {
-    if (entered) effects.out(warn(`"${entered}" doesn't look like a ws:// address — using the standard broker.`));
-    else effects.out(ok('using the standard broker.'));
-    return standard;
-  }
-  if (await effects.ask(`Use "${checked.value}"?  (No = go back to the standard broker)`, true)) {
-    effects.out(ok(`broker set to ${checked.value}.`));
-    return checked.value;
-  }
-  effects.out(ok('using the standard broker.'));
+  // Custom deployments remain available through OURS_BROKER_URL. The ordinary
+  // install is intentionally linear and explains the standard safe default.
+  effects.out(info(effects.env.OURS_BROKER_URL
+    ? 'All services use the end-to-end encrypted broker configured in OURS_BROKER_URL.'
+    : 'All services use the standard end-to-end encrypted ours broker.'));
   return standard;
 }
 
@@ -748,24 +690,13 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
     return [];
   }
 
-  // Asked BEFORE planning, because the plan's `wanted` is the answer. Only a
-  // harness we can actually drive is worth a question — the others are going to
-  // print manual steps whatever the operator says.
-  const answers = {};
-  if (!args.assumeYes) {
-    for (const h of detected) {
-      if (h.status !== 'ok') continue;
-      answers[h.name] = await effects.ask(`Install the ours plugin into ${h.label ?? h.name}?`, true);
-    }
-  }
-
   const plans = planHarnessPlugins({
     harnesses: detected.map((h) => ({ name: h.name, status: h.status })),
     stateDir: target.stateDir,
     isDefaultStateDir,
     channel: args.channel,
-    assumeYes: args.assumeYes,
-    answers,
+    assumeYes: true,
+    answers: {},
   });
 
   const rows = [];
@@ -808,48 +739,21 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
   return rows;
 }
 
-/**
- * ours-fleet. The feature that needed zero code anywhere.
- *
- * `ours-fleet init` takes no daemon argument and reads no daemon config; fleet
- * resolves a daemon per role, from the role's own env. So the installer installs
- * it, runs its one-time host setup, and — for a non-default state directory —
- * SAYS the one fleet.yaml line. Saying it is the whole feature.
- */
+/** Install Fleet, initialize its host support, and stage a stopped starter config. */
 export async function runFleetPhase(args, effects, { target, isDefaultStateDir }) {
   effects.out(heading('ours-fleet (your always-online agent team)'));
   effects.out(info('This makes your harnesses PERSISTENT: they stop being just a terminal session and'));
   effects.out(info('become always-online agents that survive a reboot.'));
-  const wanted = args.assumeYes ? true : await effects.ask('Install it?', true);
   const plan = planFleet({
-    stateDir: target.stateDir, isDefaultStateDir, wanted, channel: args.channel,
+    home: effects.home, stateDir: target.stateDir, isDefaultStateDir, wanted: true, channel: args.channel,
   });
   if (plan.action === 'skip') {
     effects.out(info('skipped cleanly — re-run ours-install any time to add it.'));
     return { key: 'fleet', label: plan.label, state: 'skipped' };
   }
   const install = await attempt(effects, args.dryRun, plan.install.join(' '), () => effects.run(plan.install[0], plan.install.slice(1)));
-  // THE PAIR IS PASSED AS DELIBERATE INSURANCE AGAINST AN UNRESOLVED
-  // CONTRADICTION, not because the question was settled.
-  //
-  // Two written analyses disagree, and NEITHER was verified — ours-fleet is not in
-  // this repo:
-  //   lib/nightly-install.mjs:611 says fleet resolves its daemon from
-  //     OURS_CONFIG / OURS_PORT / OURS_STATE_DIR and has no concept of a registry,
-  //     so an `init` run without the pair points every role at the historical
-  //     default daemon — which, when the selected daemon is not the default, may
-  //     be one the user does not even have.
-  //   lib/extras.mjs:180 says `init` takes no daemon argument of any kind, reads no
-  //     daemon config, and resolves per role through
-  //     resolveEndpoint({ ...process.env, ...role.env }) — so the pair is
-  //     unnecessary here.
-  // Passing it is harmless if extras.mjs is right and load-bearing if
-  // nightly-install.mjs is. When the cheap action is safe under both readings and
-  // the expensive one is only safe under one, take the cheap one. (Coordinator
-  //
-  // Passed for EVERY state directory, not only a non-default one, exactly as the
-  // nightly flow does: `init` is a one-time host setup and the pair is what names
-  // the daemon it was set up beside.
+  // Pass the complete daemon tuple to host initialization. The generated role
+  // also carries OURS_CONFIG when the chosen daemon is non-default.
   const initEnv = daemonEnv(target.stateDir, target.port);
   const init = install.ok
     ? await attempt(effects, args.dryRun, `${plan.init.join(' ')} (one-time host setup: units, dirs, linger)`, () => effects.run(plan.init[0], plan.init.slice(1), { env: initEnv }))
@@ -858,9 +762,14 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
     effects.out(info(`retry manually: ${plan.init.join(' ')}`));
     return { key: 'fleet', label: plan.label, state: 'failed', note: 'ours-fleet init failed' };
   }
-  effects.out(ok('ours-fleet ready — the core ours plugin discovers every option through `ours-fleet docs`.'));
+  if (effects.readText(plan.configPath) === null) {
+    await perform(effects, args.dryRun, `write starter fleet config ${plan.configPath}`, () => effects.writeText(plan.configPath, plan.config));
+  } else {
+    effects.out(ok(`${plan.configPath} already exists — not touched`));
+  }
+  effects.out(ok('ours-fleet installed and initialized; no fleet roles were started.'));
   if (plan.instruction) effects.out(info(plan.instruction));
-  return { key: 'fleet', label: plan.label, state: 'installed', note: 'CLI + core-plugin discovery' };
+  return { key: 'fleet', label: plan.label, state: 'installed', note: `configured at ${plan.configPath}; stopped` };
 }
 
 /** Voice configuration belongs to the shared daemon, not the MCP adapter. */
@@ -914,6 +823,20 @@ export async function endScreen(args, effects, { summary, target, isDefaultState
   }
 
   const has = (key) => summary.some((r) => r.key === key && (r.state === 'installed' || r.state === 'current'));
+  if (has('tg') || has('fleet')) {
+    effects.out('');
+    effects.out(`  ${c.bold('Installed but intentionally stopped')}`);
+    if (has('tg')) {
+      effects.out(`  ${c.gray('• Telegram: add a bot/route first, then run')}`);
+      effects.out(`    ${c.cyan('ours-tg-connector install-service')}`);
+    }
+    if (has('fleet')) {
+      effects.out(`  ${c.gray('• Fleet: review the generated coordinator/watchdog config, then run')}`);
+      effects.out(`    ${c.cyan('ours-fleet doctor && ours-fleet config && ours-fleet up')}`);
+      effects.out(`    ${c.cyan('ours-fleet ls')}`);
+    }
+  }
+
   const { text, empty } = buildHandoffPromptV3({
     identity: !has('identity'),
     fleet: has('fleet'),
@@ -927,7 +850,7 @@ export async function endScreen(args, effects, { summary, target, isDefaultState
   } else {
     effects.out('');
     effects.out(`  ${c.gray('─'.repeat(64))}`);
-    effects.out(`  ${c.bold('ONE LAST STEP')} — copy the prompt below and paste it into your agent.`);
+    effects.out(`  ${c.bold('ONE LAST STEP')} — paste this prompt into Claude Code, Codex, or Hermes.`);
     effects.out(`  ${c.gray('─'.repeat(64))}`);
     effects.out('');
     effects.out(box(text.split('\n'), 'paste this into your agent'));
@@ -987,6 +910,7 @@ export async function runInstall(argv, effects) {
   effects.out(banner());
   effects.out(heading(`ours: target ${args.stateDir}${args.portExplicit ? `, port ${args.port}` : ''}`));
   if (args.dryRun) effects.out(info('dry-run: nothing will be installed or changed'));
+  effects.out(progress(1, 8, 'Check the host', 'Verify the platform and Node.js before changing anything.'));
 
   // An unsupported platform is not a refusal of an incoherent selection, it is a
   // machine this cannot run on. v2 exited 0 there and so does this, so a script
@@ -995,9 +919,11 @@ export async function runInstall(argv, effects) {
 
   // Which daemon, before anything is decided about it. Only args.stateDir can
   // change here; every refusal downstream is unaffected.
+  effects.out(progress(2, 8, 'Choose one daemon', 'Reuse the only detected daemon or create one coherent shared target.'));
   const selection = await runSelectionPhase(args, effects);
   if (selection.action === 'refuse') return EXIT_REFUSED;
 
+  effects.out(progress(3, 8, 'Prepare the shared daemon', 'Install the CLI, write config, start it, and enable boot persistence.'));
   const daemon = await runDaemonPhase(args, effects);
   if (daemon.refused) return EXIT_REFUSED;
   const target = daemon.target;
@@ -1020,6 +946,7 @@ export async function runInstall(argv, effects) {
     });
   }
 
+  effects.out(progress(4, 8, 'Install the complete stack', 'Attach MCP, Telegram, and cowork to the same daemon; Telegram stays stopped.'));
   const components = await runComponentPhase(args, effects, target);
   for (const component of COMPONENTS) {
     const state = components.installed.includes(component.key) ? 'installed'
@@ -1029,13 +956,18 @@ export async function runInstall(argv, effects) {
       label: component.label,
       state,
       version: state === 'installed' && !args.dryRun ? (effects.installedVersion(component.pkg) ?? '') : '',
-      note: components.failed.find((f) => f.key === component.key)?.reason,
+      note: components.failed.find((f) => f.key === component.key)?.reason
+        ?? (state === 'installed' && component.key === 'tg' ? 'configured; stopped'
+          : state === 'installed' && component.key === 'cowork' ? 'configured; service running' : undefined),
     });
   }
   const mcpReady = components.installed.includes('mcp');
 
+  effects.out(progress(5, 8, 'Create the Human identity', 'Create the daemon root identity once, or keep the existing one.'));
   summary.push(await runIdentityPhase(args, effects, { target, mcpReady }));
+  effects.out(progress(6, 8, 'Wire detected harnesses', 'Install the ours plugin into each safe Claude Code, Codex, or Hermes installation.'));
   summary.push(...await runHarnessPhase(args, effects, { target, isDefaultStateDir }));
+  effects.out(progress(7, 8, 'Stage the fleet', 'Install Fleet and write a stopped coordinator + watchdog + health-loop starter config.'));
   summary.push(await runFleetPhase(args, effects, { target, isDefaultStateDir }));
   summary.push(await runVoicePhase(args, effects, { target, mcpReady }));
 
@@ -1046,6 +978,7 @@ export async function runInstall(argv, effects) {
   for (const failure of components.failed) {
     effects.out(warn(`${failure.key} did not install: ${failure.reason}`));
   }
+  effects.out(progress(8, 8, 'Finish', 'Summarize what is running, what is stopped, and the exact next commands.'));
   await endScreen(args, effects, { summary, target, isDefaultStateDir, brokerUrl: args.brokerUrl });
   return EXIT_OK;
 }

package/lib/ui.mjs

@@ -63,6 +63,21 @@ export const info = (s) => `  ${c.gray('•')} ${s}`;
 export const warn = (s) => `  ${c.yellow('!')} ${s}`;
 export const why = (s) => `    ${c.gray('why: ' + s)}`;
 
+// --- install progress --------------------------------------------------------------------------
+// A stable progress bar rather than cursor animation. It stays readable in CI/curl logs,
+// while a real terminal gets colour through the ordinary theme helpers. The explanatory
+// sentence is part of the progress event so a user always knows what the current stage does.
+export function progress(current, total, label, explanation = '') {
+  const count = Math.max(1, Number.parseInt(total, 10) || 1);
+  const position = Math.min(count, Math.max(0, Number.parseInt(current, 10) || 0));
+  const width = 24;
+  const filled = Math.round((position / count) * width);
+  const bar = c.cyan('█'.repeat(filled)) + c.gray('·'.repeat(width - filled));
+  const percent = String(Math.round((position / count) * 100)).padStart(3);
+  const detail = explanation ? `\n    ${c.gray(explanation)}` : '';
+  return `\n  ${bar}  ${c.bold(`${percent}%`)}  ${c.bold(label)}${detail}`;
+}
+
 // --- framed panel -------------------------------------------------------------------------------
 // A boxed block for the one moment that must stand out (the post-first-install next steps).
 // Content lines must be PLAIN strings (no ANSI) so the width math stays honest — only the frame

package/lib/usage.mjs

@@ -11,10 +11,11 @@ export const USAGE = `ours-install — the unified ours.network stack installer.
 
   ours-install [--state-dir PATH] [--port N] [--dry-run] [--help] [--version]
 
-Guided setup for the whole stack: the ours daemon, its components (the MCP
-server, the Telegram connector, cowork), your harness plugins (Claude Code /
-Codex / Hermes), ours-fleet and voice transcription — then one copy-paste
-hand-off prompt. You approve each step; re-run any time to add a piece or update.
+Progress-driven setup for the whole stack: one shared daemon, MCP, Telegram,
+cowork, detected harness plugins (Claude Code / Codex / Hermes), a Human
+identity, and ours-fleet. The daemon and cowork start; Telegram and Fleet are
+staged but stopped. The installer asks only for information it cannot infer and
+ends with exact next commands plus a copy-paste agent hand-off prompt.
 
   --state-dir  the daemon's STATE DIRECTORY, which is what identifies a daemon
                (default ~/.ours). A second state directory is a second daemon.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@ours.network/install",
-  "version": "0.18.0-nightly.1",
+  "version": "0.18.0-nightly.3",
   "private": false,
-  "description": "The unified ours.network stack installer (ours-install): one guided ~3-minute flow for ours core (the daemon) + the harness plugins (Claude Code / Codex) + ours-fleet + the Telegram connector, then a single copy-paste hand-off prompt. Self-contained (Node built-ins only); run as `ours-install` or via curl|bash (install.sh).",
+  "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet, harness plugins, Human identity, stopped Fleet starter, progress UI, and guided next steps.",
   "type": "module",
   "bin": {
     "ours-install": "install.mjs"