@ours.network/install 0.18.0-nightly.4 → 0.18.0-nightly.5

package/README.md

@@ -24,8 +24,8 @@ connector from another daemon still require explicit confirmation.
   or preserves the existing one on a re-run.
 - Installs the ours plugin into safely detected Claude Code, Codex, and Hermes
   installations.
-- Configures and starts cowork against the shared daemon.
-- Configures Telegram against the same daemon, but does **not** start it.
+- Configures and starts cowork as a durable shim over the shared daemon.
+- Configures and starts Telegram as a durable shim over the same daemon.
 - Runs Fleet's host initialization and, when `~/fleet.yaml` is absent, writes a
   conservative stopped starter with `FleetCoordinator`, a `fleet-health`
   watchdog, and a ten-minute `coordinator_health` loop. An existing
@@ -35,20 +35,21 @@ The operator CLI owns daemon configuration, lifecycle, and boot persistence.
 The MCP package is only the stdio adapter spawned by agent harnesses; the
 installer never asks `ours-mcp` to start a daemon.
 
-The external-history storage epoch is a clean breaking reset. The daemon refuses
-old packet state without modifying it, and this installer never migrates, purges,
-or silently replaces identities, contacts, invites, pending payloads, or history.
-Back up any wanted old state and remove it explicitly before starting the new epoch.
+Daemon state is temporarily scoped to its package major version. On a same-major
+update, the installer refreshes the packages and runs `ours daemon restart`; the
+CLI streams structured startup phases until restore is complete instead of
+appearing to hang. A different-major update is detected before package
+replacement. The installer explains the incompatibility and, only in an
+interactive run, offers to stop the CLI-managed daemon, copy the complete state
+directory to a timestamped directory under `~/.ours-backups/`, remove the
+managed service and old state, then initialize the new major. The default answer is no, and
+`OURS_ASSUME_YES` never authorizes this purge.
 
 ## What remains stopped
 
-Telegram and Fleet are installed but intentionally not started. Review and
-activate them when ready:
+Only Fleet is intentionally not started. Review and activate it when ready:
 
 ```sh
-# After configuring a Telegram bot and route locally:
-ours-tg-connector install-service
-
 # After reviewing ~/fleet.yaml:
 ours-fleet doctor
 ours-fleet config
@@ -92,6 +93,8 @@ targets only the explicit state directory.
 
 `OURS_CHANNEL=nightly` (or `OURS_INSTALL_CHANNEL`) selects the packages' nightly
 dist-tags. Without an override, the installer's own version selects the channel.
+The operator CLI intentionally has no nightly dist-tag and remains untagged on
+both channels.
 
 ## Environment
 

package/lib/components.mjs

@@ -203,11 +203,10 @@ export function planTgAttachment({ existing, endpoint, stateDir, brokerUrl, assu
     changed: changes.length > 0,
     changes,
     config: merged,
-    // Telegram is intentionally staged but stopped. Its CLI currently couples
-    // service installation with `enable --now`, so calling it here would violate
-    // the installer's promise not to launch Telegram before a bot is configured.
-    // The end screen gives this exact command as the explicit opt-in start step.
-    service: null,
+    // The connector is a durable shim over the shared daemon. Its service command
+    // owns the platform-specific unit and `enable --now`; the installer invokes
+    // it after committing the coherent daemon selection below.
+    service: ['ours-tg-connector', 'install-service'],
     untouched: [...TG_REGISTRY_FILES, ...TG_ROUTE_FILES],
   };
   if (!pointsElsewhere) return { ...plan, action: plan.changed ? 'attach' : 'unchanged' };

package/lib/effects.mjs

@@ -12,7 +12,7 @@
 // unit file or the service manager directly.
 
 import { spawnSync, execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, mkdirSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { cpSync, existsSync, readFileSync, mkdirSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, userInfo, platform as osPlatform, release as osRelease } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { atomicWriteConfig, snapshotConfig, restoreConfig } from './config.mjs';
@@ -29,7 +29,12 @@ async function probePort(port, { timeoutMs = 1500 } = {}) {
     if (!res.ok) return { ok: false, reason: `HTTP ${res.status}` };
     const body = await res.json();
     if (typeof body?.stateDir !== 'string') return { ok: false, reason: 'no stateDir in reply' };
-    return { ok: true, stateDir: body.stateDir };
+    return {
+      ok: true,
+      stateDir: body.stateDir,
+      version: typeof body.version === 'string' ? body.version : null,
+      compat: Number.isInteger(body.compat) ? body.compat : null,
+    };
   } catch (error) {
     return { ok: false, reason: error?.name === 'AbortError' ? 'timed out' : String(error?.message ?? error) };
   } finally {
@@ -74,6 +79,17 @@ function installedVersionOf(pkg) {
   }
 }
 
+function packageDependenciesOf(pkgSpec) {
+  const probe = capture('npm', ['view', pkgSpec, 'dependencies', '--json'], { timeout: 15_000 });
+  if (!probe.ok) return null;
+  try {
+    const parsed = JSON.parse(probe.stdout);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * A read-only command probe that NEVER throws and NEVER inherits stdio.
  *
@@ -221,6 +237,15 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
     // pure planner already gated four ways, and this deletes exactly that.
     removeDir: (path) => { rmSync(resolve(path), { recursive: true, force: true }); },
     removeFile: (path) => { rmSync(resolve(path), { force: true }); },
+    copyDir: (source, destination) => {
+      mkdirSync(dirname(resolve(destination)), { recursive: true, mode: 0o700 });
+      cpSync(resolve(source), resolve(destination), {
+        recursive: true,
+        errorOnExist: true,
+        force: false,
+        preserveTimestamps: true,
+      });
+    },
     // Rewrites a config file we do NOT own, so it keeps the file's own mode
     // rather than imposing 0600: tightening the permissions of somebody else's
     // ~/.codex/config.toml is a side effect nobody asked this to have.
@@ -266,13 +291,17 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
     // invocation only and never to the installer's own process: a state
     // directory selected by one run must not leak into anything the operator
     // starts afterwards.
-    run: async (cmd, args, { env: extraEnv = null } = {}) => {
+    run: async (cmd, args, { env: extraEnv = null, stream = false } = {}) => {
       // Always built from this layer's OWN env rather than left to spawnSync's
       // implicit inheritance, so what a child receives is a property of the
       // effects object a caller constructed and not of whatever ambient shell
       // the installer happened to start in.
       const childEnv = { ...env, ...(extraEnv ?? {}) };
-      const r = spawnSync(cmd, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], env: childEnv });
+      const r = spawnSync(cmd, args, {
+        encoding: 'utf8',
+        stdio: stream ? ['ignore', 'inherit', 'inherit'] : ['ignore', 'pipe', 'pipe'],
+        env: childEnv,
+      });
       if (r.status !== 0) {
         const detail = (r.stderr || r.stdout || '').trim().split('\n').slice(-3).join('; ');
         throw new Error(`${cmd} ${args.join(' ')} exited ${r.status}${detail ? `: ${detail}` : ''}`);
@@ -289,6 +318,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
       return { ok: !r.error && r.status === 0, code: r.status ?? -1 };
     },
     installedVersion: installedVersionOf,
+    packageDependencies: packageDependenciesOf,
     out: out ?? ((line) => process.stdout.write(`${line}\n`)),
     // Never called when assumeYes: the orchestrator takes the default itself.
     ask: async (prompt, def = false) => (ttyFd == null ? def : askYesNo(write, ttyFd, `  ${prompt}  `, def)),
@@ -296,7 +326,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
   };
 }
 
-export const __testables = { probePort, portTakenSync, readJsonFile, readTextFile, installedVersionOf, knownStateDirsIn };
+export const __testables = { probePort, portTakenSync, readJsonFile, readTextFile, installedVersionOf, packageDependenciesOf, knownStateDirsIn };
 
 // -----------------------------------------------------------------------------
 // THE PAIR

package/lib/extras.mjs

@@ -331,7 +331,7 @@ export function buildHandoffPromptV3({
     steps.push(
       'Finish my Telegram setup without exposing secrets: ask me for the bot name\n'
       + '   and guide me through entering the @BotFather token locally. Register the\n'
-      + '   route, then start the connector only after I approve.',
+      + '   route in the connector service that ours-install already started.',
     );
   }
   if (steps.length === 0) return { text: '', empty: true };

package/lib/orchestrate.mjs

@@ -23,7 +23,7 @@
 //   ask(prompt, default)   -> boolean       (never called when assumeYes)
 //   now()                  -> number
 
-import { join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { parseInstallArgs, resolveTarget, InstallUsageError } from './target.mjs';
 import { planDaemonConfig, planServiceInstall, serviceInstallCommand } from './plan.mjs';
 import {
@@ -66,6 +66,104 @@ async function perform(effects, dryRun, label, thunk) {
 
 const reason = (error) => (error instanceof Error ? error.message : String(error));
 
+function semverMajor(version) {
+  const match = /^(?:[~^<>= ]*)(\d+)\./.exec(String(version ?? '').trim());
+  return match ? Number(match[1]) : null;
+}
+
+function incompatibleUpgrade(target, cliDependencies) {
+  if (target.action !== 'update' || !target.daemonVersion) return null;
+  const runningMajor = semverMajor(target.daemonVersion);
+  const targetRange = cliDependencies?.['@ours.network/sdk'];
+  const targetMajor = semverMajor(targetRange);
+  if (runningMajor === null) {
+    return { unknown: true, runningMajor: null, runningVersion: target.daemonVersion };
+  }
+  if (targetMajor === null) {
+    return { unknown: true, runningMajor, runningVersion: target.daemonVersion };
+  }
+  return runningMajor !== targetMajor
+    ? { unknown: false, runningMajor, runningVersion: target.daemonVersion, targetMajor, targetRange }
+    : null;
+}
+
+async function prepareIncompatibleUpgrade(args, effects, target, cliPkg, mismatch) {
+  const dir = target.stateDir;
+  const configPath = join(dir, 'config.json');
+  if (mismatch.unknown) {
+    effects.out(warn(`ours: cannot verify whether ${cliPkg} can restore daemon v${mismatch.runningVersion}. Nothing was changed.`));
+    effects.out(info('Check npm registry access and re-run; compatibility checks fail closed.'));
+    return { refused: { reason: 'compatibility-unknown', exitCode: EXIT_REFUSED } };
+  }
+
+  effects.out(warn(
+    `ours: daemon v${mismatch.runningVersion} cannot be restored by the requested major v${mismatch.targetMajor}; major upgrades are intentionally incompatible.`,
+  ));
+  if (resolve(dir) === resolve(effects.home) || dirname(resolve(dir)) === resolve(dir)) {
+    effects.out(info(`Automatic purge is not available for the broad state path ${dir}. Back it up and remove it manually.`));
+    return { refused: { reason: 'incompatible-major-broad-path', exitCode: EXIT_REFUSED } };
+  }
+  // Backups live one directory below a non-daemon container. Putting a copied
+  // state beside ~/.ours under another `.ours*` name makes daemon discovery see
+  // the backup as a second live target on the next installer run.
+  const backupPath = join(
+    dirname(dir),
+    '.ours-backups',
+    `${basename(dir)}-before-v${mismatch.targetMajor}-${effects.now()}`,
+  );
+  if (args.dryRun) {
+    effects.out(info(`[dry-run] would ask to stop the old daemon, copy its complete state to ${backupPath}, remove its service/state, and initialize v${mismatch.targetMajor}.`));
+    return { refused: { reason: 'incompatible-major-dry-run', exitCode: EXIT_REFUSED } };
+  }
+  if (args.assumeYes) {
+    effects.out(info('This purge is never accepted through OURS_ASSUME_YES. Re-run interactively to confirm the backup and reset.'));
+    return { refused: { reason: 'incompatible-major-unattended', exitCode: EXIT_REFUSED } };
+  }
+  if (effects.readJson(join(dir, 'ours-cli-daemon.json')) === null) {
+    effects.out(info('The daemon is not CLI-managed. Stop its external launcher, back up and remove its state/service, then re-run the installer.'));
+    return { refused: { reason: 'incompatible-major-external', exitCode: EXIT_REFUSED } };
+  }
+  const confirmed = await effects.ask(
+    `Back up all daemon state to ${backupPath}, purge the incompatible daemon and service, and install v${mismatch.targetMajor}?`,
+    false,
+  );
+  if (!confirmed) {
+    effects.out(info(`Nothing was changed. Back up ${dir}, remove the old daemon service/state, and re-run when ready.`));
+    return { refused: { reason: 'incompatible-major-declined', exitCode: EXIT_REFUSED } };
+  }
+
+  await perform(effects, false, 'stop the incompatible daemon', () => effects.run(
+    'ours', ['daemon', 'stop', '--state-dir', dir, '--config', configPath], { stream: true },
+  ));
+  try {
+    await perform(effects, false, `back up complete daemon state to ${backupPath}`, () => effects.copyDir(dir, backupPath));
+  } catch (error) {
+    try {
+      await effects.run('ours', ['daemon', 'start', '--state-dir', dir, '--config', configPath], { stream: true });
+      effects.out(ok('backup failed, but the old daemon was started again'));
+    } catch {
+      effects.out(warn(`backup failed and the old daemon did not restart; its state is still untouched at ${dir}`));
+    }
+    throw error;
+  }
+  try {
+    await perform(effects, false, 'remove the incompatible daemon boot service', () => effects.run(
+      'ours', ['daemon', 'uninstall-service', '--yes', '--state-dir', dir, '--config', configPath], { stream: true },
+    ));
+  } catch (error) {
+    try {
+      await effects.run('ours', ['daemon', 'start', '--state-dir', dir, '--config', configPath], { stream: true });
+      effects.out(ok(`service removal failed, but the old daemon was started again; backup retained at ${backupPath}`));
+    } catch {
+      effects.out(warn(`service removal failed and the old daemon did not restart; state remains at ${dir} and the backup is at ${backupPath}`));
+    }
+    throw error;
+  }
+  await perform(effects, false, `remove incompatible state at ${dir}`, () => effects.removeDir(dir));
+  effects.out(ok(`backup retained at ${backupPath}`));
+  return { purged: true, backupPath };
+}
+
 /**
  * A step that is allowed to fail without ending the run.
  *
@@ -184,7 +282,7 @@ export async function runDaemonPhase(args, effects) {
   }
 
   const dir = target.stateDir;
-  const creating = target.action === 'create';
+  let creating = target.action === 'create';
   effects.out(heading(creating ? `target ${dir} — creating a daemon here` : `target ${dir} — daemon found on port ${target.port}`));
   if (target.stalePidRecord) {
     effects.out(info(`a PID record names port ${target.stalePidRecord} but nothing answers there; treating it as stale`));
@@ -213,9 +311,23 @@ export async function runDaemonPhase(args, effects) {
   // adapter each harness spawns. Both are required, but only `ours daemon`
   // participates in lifecycle or service management.
   const mcpPkg = componentSpec(componentByKey('mcp'), args.channel);
+  // The CLI intentionally publishes only `latest`; unlike the lockstep MCP and
+  // connector packages it has no nightly dist-tag. Keep this untagged on every
+  // installer channel, and inspect that package's SDK dependency for the gate.
+  const cliPkg = '@ours.network/cli';
+  if (!creating && target.daemonVersion) {
+    const mismatch = incompatibleUpgrade(target, effects.packageDependencies(cliPkg));
+    if (mismatch) {
+      const prepared = await prepareIncompatibleUpgrade(args, effects, target, cliPkg, mismatch);
+      if (prepared.refused) return { target, refused: prepared.refused, steps };
+      creating = prepared.purged === true;
+      target.backupPath = prepared.backupPath;
+      target.action = 'create';
+    }
+  }
   await perform(effects, args.dryRun, `MCP server installed (npm i -g ${mcpPkg})`, () => effects.run('npm', ['i', '-g', mcpPkg]));
   steps.push({ id: 'mcp-package', changed: true, packageRefresh: true });
-  await perform(effects, args.dryRun, 'ours CLI installed (npm i -g @ours.network/cli)', () => effects.run('npm', ['i', '-g', '@ours.network/cli']));
+  await perform(effects, args.dryRun, `ours CLI installed (npm i -g ${cliPkg})`, () => effects.run('npm', ['i', '-g', cliPkg]));
   steps.push({ id: 'cli', changed: true, packageRefresh: true });
 
   // The config file — merged, never rewritten, and untouched when it already
@@ -249,8 +361,11 @@ export async function runDaemonPhase(args, effects) {
 
   try {
     if (creating) {
-      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours', ['daemon', 'start', '--config', configPath]));
+      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours', ['daemon', 'start', '--config', configPath], { stream: true }));
       steps.push({ id: 'start', changed: true });
+    } else {
+      await perform(effects, args.dryRun, `restart the daemon on port ${target.port}`, () => effects.run('ours', ['daemon', 'restart', '--config', configPath], { stream: true }));
+      steps.push({ id: 'restart', changed: true });
     }
 
     const service = await runServicePhase(args, effects, dir, target.port);
@@ -502,14 +617,21 @@ async function attachComponent(component, { args, effects, dir, endpoint, isDefa
       }
     }
     await perform(effects, args.dryRun, `install ${plan.install[3]}`, () => effects.run(plan.install[0], plan.install.slice(1)));
+    const journal = configJournal(effects, { dryRun: args.dryRun });
     if (plan.changed) {
+      journal.snapshot(path);
       await perform(effects, args.dryRun, `write ${path}`, () => effects.writeJson(path, `${JSON.stringify(plan.config, null, 2)}\n`));
     } else {
       effects.out(ok(`${path} already points here — not touched`));
     }
-    effects.out(ok('Telegram connector installed and configured, but not started.'));
-    effects.out(info('After adding a bot, start it explicitly with: ours-tg-connector install-service'));
-    return { key: 'tg', state: 'installed', note: 'configured; stopped' };
+    try {
+      await perform(effects, args.dryRun, 'Telegram connector service installed', () => effects.run(plan.service[0], plan.service.slice(1)));
+    } catch (error) {
+      rollBack(effects, journal, args, 'the Telegram connector service did not come up — putting its daemon selection back');
+      throw error;
+    }
+    effects.out(ok('Telegram connector installed as a durable service on the shared daemon.'));
+    return { key: 'tg', state: 'installed', note: 'configured; service running' };
   }
 
   const path = coworkConfigPath(effects.home, effects.env);
@@ -823,13 +945,9 @@ export async function endScreen(args, effects, { summary, target, isDefaultState
   }
 
   const has = (key) => summary.some((r) => r.key === key && (r.state === 'installed' || r.state === 'current'));
-  if (has('tg') || has('fleet')) {
+  if (has('fleet')) {
     effects.out('');
     effects.out(`  ${c.bold('Installed but intentionally stopped')}`);
-    if (has('tg')) {
-      effects.out(`  ${c.gray('• Telegram: add a bot/route first, then run')}`);
-      effects.out(`    ${c.cyan('ours-tg-connector install-service')}`);
-    }
     if (has('fleet')) {
       effects.out(`  ${c.gray('• Fleet: review the generated coordinator/watchdog config, then run')}`);
       effects.out(`    ${c.cyan('ours-fleet doctor && ours-fleet config && ours-fleet up')}`);
@@ -946,7 +1064,7 @@ export async function runInstall(argv, effects) {
     });
   }
 
-  effects.out(progress(4, 8, 'Install the complete stack', 'Attach MCP, Telegram, and cowork to the same daemon; Telegram stays stopped.'));
+  effects.out(progress(4, 8, 'Install the complete stack', 'Attach MCP, Telegram, and cowork to the same daemon; run both shims as durable services.'));
   const components = await runComponentPhase(args, effects, target);
   for (const component of COMPONENTS) {
     const state = components.installed.includes(component.key) ? 'installed'
@@ -957,7 +1075,7 @@ export async function runInstall(argv, effects) {
       state,
       version: state === 'installed' && !args.dryRun ? (effects.installedVersion(component.pkg) ?? '') : '',
       note: components.failed.find((f) => f.key === component.key)?.reason
-        ?? (state === 'installed' && component.key === 'tg' ? 'configured; stopped'
+        ?? (state === 'installed' && component.key === 'tg' ? 'configured; service running'
           : state === 'installed' && component.key === 'cowork' ? 'configured; service running' : undefined),
     });
   }

package/lib/target.mjs

@@ -176,7 +176,11 @@ export function classifyProbe(probe, targetStateDir) {
   if (!samePath(probe.stateDir, targetStateDir)) {
     return { kind: 'foreign', reason: 'daemon owns a different state directory', stateDir: resolve(probe.stateDir) };
   }
-  return { kind: 'present', stateDir: resolve(probe.stateDir) };
+  return {
+    kind: 'present',
+    stateDir: resolve(probe.stateDir),
+    daemonVersion: typeof probe.version === 'string' ? probe.version : null,
+  };
 }
 
 /**
@@ -327,7 +331,13 @@ export async function resolveTarget({ stateDir, port = null, portExplicit = fals
         message: `--port ${port} disagrees with port ${found.port}, where the daemon for ${target} is actually running`,
       };
     }
-    return { action: 'update', port: found.port, stateDir: target, config: found.config };
+    return {
+      action: 'update',
+      port: found.port,
+      stateDir: target,
+      config: found.config,
+      daemonVersion: found.daemonVersion ?? null,
+    };
   }
 
   // Creating. Only now is a port chosen.

package/lib/usage.mjs

@@ -13,8 +13,9 @@ export const USAGE = `ours-install — the unified ours.network stack installer.
 
 Progress-driven setup for the whole stack: one shared daemon, MCP, Telegram,
 cowork, detected harness plugins (Claude Code / Codex / Hermes), a Human
-identity, and ours-fleet. The daemon and cowork start; Telegram and Fleet are
-staged but stopped. The installer asks only for information it cannot infer and
+identity, and ours-fleet. The daemon, Telegram connector, and cowork shim start
+as durable services; only Fleet is staged but stopped. The installer asks only
+for information it cannot infer and
 ends with exact next commands plus a copy-paste agent hand-off prompt.
 
   --state-dir  the daemon's STATE DIRECTORY, which is what identifies a daemon

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "0.18.0-nightly.4",
+  "version": "0.18.0-nightly.5",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet, harness plugins, Human identity, stopped Fleet starter, progress UI, and guided next steps.",
   "type": "module",