@ours.network/install 1.2.0-nightly.2 → 1.2.1-nightly.10

package/lib/orchestrate.mjs

@@ -1,3 +1,4 @@
+import { executeLegacyMigration } from './legacy-migration.mjs';
 // ours-install v3 — the orchestrator.
 //
 // This is the part that cannot be pure: it walks the flow, renders the screens
@@ -25,7 +26,7 @@
 
 import { basename, dirname, join, resolve } from 'node:path';
 import { parseNetworkArgs, validateHostProfile, parseInstallArgs, resolveTarget, resolveProfileSelection, profileEnv, InstallUsageError } from './target.mjs';
-import { selectSourcePackages, validateInstallation, SERVER_SERVICES, planDaemonConfig, planServiceInstall, serviceInstallCommand } from './plan.mjs';
+import { clientPackageNames, selectSourcePackages, validateInstallation, SERVER_SERVICES, planDaemonConfig, planServiceInstall, serviceInstallCommand } from './plan.mjs';
 import {
   COMPONENTS,
   planComponentSelection, planMcpAttachment, planTgAttachment, planCoworkAttachment,
@@ -85,6 +86,41 @@ async function perform(effects, dryRun, label, thunk) {
 
 const reason = (error) => (error instanceof Error ? error.message : String(error));
 
+function clientDiagnostic(error) {
+  return reason(error)
+    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/\bBearer\s+[^\s,;]+/gi, 'Bearer [redacted]')
+    .replace(/((?:api[_-]?key|api[_-]?token|access[_-]?token|refresh[_-]?token|token|password|secret|authorization|credential)\s*["']?\s*[:=]\s*["']?)[^\s"',;]+/gi, '$1[redacted]')
+    .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gi, '$1[redacted]@')
+    .replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 700);
+}
+
+function clientRetry(effects, imported, integrations) {
+  effects.out(info(`Saved server connection: ${imported.configPath}.`));
+  if (integrations.includes('fleet') && !imported.settings.fleetSettingsPath) {
+    effects.out(info('Saved profile and settings retained. Run ours-install, choose Connect to an existing server, and reuse the saved profile to finish the interactive Fleet configuration.'));
+    return;
+  }
+  const args = ['client', 'install', '--config', imported.configPath, '--integrations', integrations.join(',') || 'none', '--sources', imported.settings.sourcesPath];
+  if (imported.settings.fleetSettingsPath) args.push('--fleet-settings', imported.settings.fleetSettingsPath);
+  const command = `ours-install client install ${args.slice(2).map((value, i) => i % 2 === 0 ? value : shellQuote(value)).join(' ')}`;
+  effects.out(info(`Saved profile and settings retained; re-run ${command}`));
+}
+
+function explainClientFailure(effects, name, row) {
+  const label = { codex: 'Codex', 'claude-code': 'Claude Code', fleet: 'Fleet' }[name];
+  const command = name === 'claude-code' ? 'claude' : name;
+  if (row?.note === 'not installed') {
+    effects.out(warn(`${label}: executable not found on PATH. Install ${label} or make its executable available in this shell, then check ${command} --version before retrying.`));
+  } else if (row?.manual) {
+    effects.out(warn(`${label}: cannot register the plugin automatically — ${clientDiagnostic(row.note)}. Use the real executable (check ${command} --version), or register the displayed local marketplace manually.`));
+  } else {
+    effects.out(warn(`${label}: ${row?.failedStep ?? 'integration setup'} failed. ${clientDiagnostic(row?.detail ?? row?.note ?? 'The integration did not report successful completion. Review the messages above.')} Fix the reported command error before retrying.`));
+    if (row?.failedCommand) effects.out(info(`Failed command: ${row.failedCommand.map(shellQuote).join(' ')}`));
+  }
+}
+
+
 function semverMajor(version) {
   const match = /^(?:[~^<>= ]*)(\d+)\./.exec(String(version ?? '').trim());
   return match ? Number(match[1]) : null;
@@ -109,6 +145,7 @@ function incompatibleUpgrade(target, cliDependencies) {
 async function prepareIncompatibleUpgrade(args, effects, target, cliPkg, mismatch) {
   const dir = target.stateDir;
   const configPath = join(dir, 'config.json');
+  const owner = effects.readJson(join(dir, 'ours-cli-daemon.json'))?.owner === '@ours.network/daemon' ? ['ours-daemon'] : ['ours', 'daemon'];
   if (mismatch.unknown) {
     effects.out(warn(`ours: cannot verify whether ${cliPkg} can restore daemon v${mismatch.runningVersion}. Nothing was changed.`));
     effects.out(info('Check npm registry access and re-run; compatibility checks fail closed.'));
@@ -152,13 +189,13 @@ async function prepareIncompatibleUpgrade(args, effects, target, cliPkg, mismatc
   }
 
   await perform(effects, false, 'stop the incompatible daemon', () => effects.run(
-    'ours', ['daemon', 'stop', '--state-dir', dir, '--config', configPath], { stream: true },
+    owner[0], [...owner.slice(1), 'stop', '--state-dir', dir, '--config', configPath], { stream: true },
   ));
   try {
     await perform(effects, false, `back up complete daemon state to ${backupPath}`, () => effects.copyDir(dir, backupPath));
   } catch (error) {
     try {
-      await effects.run('ours', ['daemon', 'start', '--state-dir', dir, '--config', configPath], { stream: true });
+      await effects.run(owner[0], [...owner.slice(1), 'start', '--state-dir', dir, '--config', configPath], { stream: true });
       effects.out(ok('backup failed, but the old daemon was started again'));
     } catch {
       effects.out(warn(`backup failed and the old daemon did not restart; its state is still untouched at ${dir}`));
@@ -167,11 +204,11 @@ async function prepareIncompatibleUpgrade(args, effects, target, cliPkg, mismatc
   }
   try {
     await perform(effects, false, 'remove the incompatible daemon boot service', () => effects.run(
-      'ours', ['daemon', 'uninstall-service', '--yes', '--state-dir', dir, '--config', configPath], { stream: true },
+      owner[0], [...owner.slice(1), 'uninstall-service', '--yes', '--state-dir', dir, '--config', configPath], { stream: true },
     ));
   } catch (error) {
     try {
-      await effects.run('ours', ['daemon', 'start', '--state-dir', dir, '--config', configPath], { stream: true });
+      await effects.run(owner[0], [...owner.slice(1), 'start', '--state-dir', dir, '--config', configPath], { stream: true });
       effects.out(ok(`service removal failed, but the old daemon was started again; backup retained at ${backupPath}`));
     } catch {
       effects.out(warn(`service removal failed and the old daemon did not restart; state remains at ${dir} and the backup is at ${backupPath}`));
@@ -192,11 +229,11 @@ async function prepareIncompatibleUpgrade(args, effects, target, cliPkg, mismatc
  * rather than one harness. So a failure here is one honest line plus whatever
  * the caller wants to say about retrying, and the walk continues.
  */
-async function attempt(effects, dryRun, label, thunk) {
+async function attempt(effects, dryRun, label, thunk, formatReason = reason) {
   try {
     return { ok: true, ...(await perform(effects, dryRun, label, thunk)) };
   } catch (error) {
-    effects.out(warn(`${label} — did not complete: ${reason(error)}`));
+    effects.out(warn(`${label} — did not complete: ${formatReason(error)}`));
     return { ok: false, error };
   }
 }
@@ -332,14 +369,13 @@ export async function runDaemonPhase(args, effects, exactSuite = null) {
   const mcpPkg = exactSuite?.packages?.mcp
     ? `@ours.network/mcp@${exactSuite.packages.mcp}`
     : componentSpec(componentByKey('mcp'), args.channel);
-  // The CLI intentionally publishes only `latest`; unlike the lockstep MCP and
-  // connector packages it has no nightly dist-tag. Keep this untagged on every
-  // installer channel, and inspect that package's SDK dependency for the gate.
-  const cliPkg = '@ours.network/cli';
+  // Inspect the runtime package SDK compatibility before replacing the owner.
+  const cliPkg = args.channel === 'nightly' ? '@ours.network/cli@nightly' : '@ours.network/cli';
+  const daemonPkg = args.channel === 'nightly' ? '@ours.network/daemon@nightly' : '@ours.network/daemon';
   if (!creating && target.daemonVersion) {
-    const mismatch = incompatibleUpgrade(target, effects.packageDependencies(cliPkg));
+    const mismatch = incompatibleUpgrade(target, effects.packageDependencies(daemonPkg));
     if (mismatch) {
-      const prepared = await prepareIncompatibleUpgrade(args, effects, target, cliPkg, mismatch);
+      const prepared = await prepareIncompatibleUpgrade(args, effects, target, daemonPkg, mismatch);
       if (prepared.refused) return { target, refused: prepared.refused, steps };
       creating = prepared.purged === true;
       target.backupPath = prepared.backupPath;
@@ -348,6 +384,18 @@ export async function runDaemonPhase(args, effects, exactSuite = null) {
   }
   await perform(effects, args.dryRun, `MCP server installed (npm i -g ${mcpPkg})`, () => effects.run('npm', ['i', '-g', mcpPkg]));
   steps.push({ id: 'mcp-package', changed: true, packageRefresh: true });
+  await perform(effects, args.dryRun, 'daemon runtime installed', () => effects.run('npm', ['i', '-g', daemonPkg]));
+  // A retained global unit still points into the old CLI package. Rewrite and
+  // activate that owned unit before npm replaces its executable with thin CLI.
+  let migratedService;
+  if (!creating) {
+    const retained = planServiceInstall({ stateDir: dir, home: effects.home, readText: effects.readText, platform: effects.platform?.platform });
+    if (retained.unitPath && effects.readText(retained.unitPath) !== null) {
+      try { migratedService = await runServicePhase(args, effects, dir, target.port); }
+      catch (error) { await recoverDaemon(args, effects, dir, join(dir, 'config.json'), target.port); throw error; }
+      if (migratedService.refused) return { target, refused: migratedService.refused, steps };
+    }
+  }
   await perform(effects, args.dryRun, `ours CLI installed (npm i -g ${cliPkg})`, () => effects.run('npm', ['i', '-g', cliPkg]));
   steps.push({ id: 'cli', changed: true, packageRefresh: true });
 
@@ -382,14 +430,14 @@ export async function runDaemonPhase(args, effects, exactSuite = null) {
 
   try {
     if (creating) {
-      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours', ['daemon', 'start', '--config', configPath], { stream: true }));
+      await perform(effects, args.dryRun, `start the daemon on port ${target.port}`, () => effects.run('ours-daemon', [ 'start', '--config', configPath], { stream: true }));
       steps.push({ id: 'start', changed: true });
     } else {
-      await perform(effects, args.dryRun, `restart the daemon on port ${target.port}`, () => effects.run('ours', ['daemon', 'restart', '--config', configPath], { stream: true }));
+      await perform(effects, args.dryRun, `restart the daemon on port ${target.port}`, () => effects.run('ours-daemon', [ 'restart', '--config', configPath], { stream: true }));
       steps.push({ id: 'restart', changed: true });
     }
 
-    const service = await runServicePhase(args, effects, dir, target.port);
+    const service = migratedService ?? await runServicePhase(args, effects, dir, target.port);
     if (service.unsupported) serviceUnsupported = service.unsupported;
     if (service.refused) {
       // A REFUSAL IS A FAILURE TO REACH THE STATE, not a special case. An unknown
@@ -419,7 +467,7 @@ export async function runDaemonPhase(args, effects, exactSuite = null) {
       effects.out(recovery.recovered
         ? ok('your daemon is running again — nothing was committed, and the service is unchanged')
         : warn('and the daemon did NOT come back up — start it yourself before anything else: '
-          + `ours daemon start --config ${configPath}`));
+          + `ours-daemon start --config ${configPath}`));
     }
     throw error;
   }
@@ -442,7 +490,7 @@ export async function runDaemonPhase(args, effects, exactSuite = null) {
 async function recoverDaemon(args, effects, dir, configPath, port) {
   if (args.dryRun) return null;
   try {
-    await effects.run('ours', ['daemon', 'start', '--config', configPath]);
+    await effects.run('ours-daemon', [ 'start', '--config', configPath]);
     return { recovered: true };
   } catch (recoveryError) {
     return { recovered: false, reason: reason(recoveryError) };
@@ -793,7 +841,7 @@ export async function runIdentityPhase(args, effects, { target, mcpReady }) {
     }
     if (/not running|not reachable|ECONNREFUSED|connect/i.test(text)) {
       effects.out(warn("The daemon isn't reachable yet — couldn't create your human identity."));
-      effects.out(info(`Fix: run 'ours daemon start --config ${env.OURS_CONFIG}', then 'ours identity create-root --config ${env.OURS_CONFIG} --name "${name}"'.`));
+      effects.out(info(`Fix: run 'ours-daemon start --config ${env.OURS_CONFIG}', then 'ours identity create-root --config ${env.OURS_CONFIG} --name "${name}"'.`));
       return { key: 'identity', label: 'Human identity', state: 'failed', note: 'daemon not reachable' };
     }
     effects.out(warn(`Couldn't create your human identity: ${text.split('\n')[0]}`));
@@ -816,6 +864,9 @@ export async function runIdentityPhase(args, effects, { target, mcpReady }) {
 export async function runHarnessPhase(args, effects, { target, isDefaultStateDir, exactSuite = null }) {
   effects.out(heading('Harness plugins'));
   const detected = (await effects.detectHarnesses()).filter(h => !args.clientIntegrations || args.clientIntegrations.includes(h.name));
+  for (const name of args.clientIntegrations ?? []) {
+    if (name !== 'fleet' && !detected.some(h => h.name === name)) detected.push({ name, status: 'absent' });
+  }
   for (const h of detected) {
     if (h.status === 'ok') effects.out(ok(`'${h.command ?? h.name}'  → ${h.detail ?? 'real program'} (its plugin can be installed)`));
     else if (h.status === 'alias') effects.out(warn(`'${h.command ?? h.name}'  → ${h.detail} (I won't call it — manual steps below)`));
@@ -825,7 +876,7 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
   if (detected.every((h) => h.status === 'absent')) {
     effects.out(info('No Claude Code, Codex or Hermes found — install one and re-run to wire it up.'));
     effects.out(info('Your daemon is unaffected; nothing else in this run depends on a harness.'));
-    return [];
+    return args.clientIntegrations ? detected.map(h => ({ key: h.name, state: 'skipped', note: 'not installed' })) : [];
   }
 
   const plans = planHarnessPlugins({
@@ -850,7 +901,7 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
     if (plan.action === 'manual' && exactSuite?.localPackages?.[plan.name]) {
       const root = await effects.prepareClientMarketplace(plan.name, exactSuite.localPackages[plan.name]);
       effects.out(warn(`${plan.label} requires manual registration of exact local marketplace ${root}; ${target.managed ? 'the saved client default is retained' : `keep OURS_CONFIG=${target.configPath}`}.`));
-      rows.push({ ...row, state: 'failed', note: 'native executable unavailable' });
+      rows.push({ ...row, state: 'failed', note: plan.reason, manual: true });
       continue;
     }
     if (plan.action === 'manual') {
@@ -872,7 +923,7 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
       effects.out(warn(`${plan.label} — ${plan.reason}; install it yourself with:`));
       for (const step of manual) effects.out(info(`  ${step}`));
       if (plan.envLine) effects.out(info(`Before later native launches, set:  ${plan.envLine}`));
-      rows.push({ ...row, state: 'skipped', note: plan.reason });
+      rows.push({ ...row, state: 'skipped', note: plan.reason, manual: true });
       continue;
     }
 
@@ -883,13 +934,16 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
       const steps = plan.name === 'codex'
         ? [['codex', 'plugin', 'marketplace', 'add', registration], ['codex', 'plugin', 'add', 'ours@ours-codex-marketplace']]
         : [['claude', 'plugin', 'marketplace', 'add', registration], ['claude', 'plugin', await effects.hasClaudePlugin() ? 'update' : 'install', 'ours@ours.network']];
-      let failed = false;
+      let failure = null;
       for (const step of steps) {
-        const outcome = await attempt(effects, false, step.join(' '), () => effects.run(step[0], step.slice(1), { env: profileEnv(target) }));
-        if (!outcome.ok) { failed = true; break; }
+        const outcome = await attempt(effects, false, step.join(' '), () => effects.run(step[0], step.slice(1), { env: profileEnv(target) }), clientDiagnostic);
+        if (!outcome.ok) {
+          failure = { failedCommand: step, failedStep: step[2] === 'marketplace' ? `Register ${plan.label} marketplace` : `Install ${plan.label} plugin`, detail: clientDiagnostic(outcome.error) };
+          break;
+        }
       }
       effects.out(info(target.managed ? `Native ${plan.name} launches use the saved client default.` : `Native ${plan.name} launches must retain OURS_CONFIG=${target.configPath}.`));
-      rows.push({ ...row, state: failed ? 'failed' : 'installed' });
+      rows.push({ ...row, state: failure ? 'failed' : 'installed', ...(failure ?? {}) });
       continue;
     }
 
@@ -1250,7 +1304,9 @@ export async function runInstall(argv, effects) {
 
 export async function runServerCommand(args, effects) {
   if (args.operation === 'status') return executeServerCommand(args, effects);
-  return effects.withInstallationLock(args.stateDir, () => executeServerCommand(args, effects));
+  return effects.withInstallationLock(args.stateDir, () => args.migrateFrom
+    ? executeLegacyMigration(args, effects, executeServerCommand)
+    : executeServerCommand(args, effects));
 }
 
 async function executeServerCommand(args, effects) {
@@ -1266,6 +1322,7 @@ async function executeServerCommand(args, effects) {
   } else {
     if (args.operation !== 'install' || !args.mode) throw new Error('First server install requires --mode');
     record = effects.newInstallation(args.stateDir, args.mode);
+    for (const key of ['port', 'coworkPort', 'messengerPort']) if (args[key] !== undefined) record[key] = args[key];
   }
   if (record.layoutConversion && !['install', 'start', 'stop', 'status'].includes(args.operation)) {
     throw new Error('Layout conversion is incomplete; resume with server install or server start before changing state or authority');
@@ -1273,14 +1330,32 @@ async function executeServerCommand(args, effects) {
   if (record.buildTransition && !['stop', 'status', record.buildTransition.operation].includes(args.operation)) {
     throw new Error(`Server build activation is incomplete; repeat server ${record.buildTransition.operation} before other mutations`);
   }
+  const showInstallProgress = args.operation === 'install' && !(existing && (record.schema === 1 || record.layoutConversion));
+  const installStageCount = (existing ? 7 : 9) + (args.identityName ? 2 : 0);
+  let completedInstallStages = 0;
+  const installStage = async (label, explanation, action) => {
+    if (!showInstallProgress) return action();
+    effects.out(progress(completedInstallStages, installStageCount, label, explanation));
+    try {
+      const result = await action();
+      completedInstallStages += 1;
+      effects.out(ok(`${label} complete`));
+      return result;
+    } catch (error) {
+      effects.out(warn(`Server installation stopped during ${label.toLowerCase()}.`));
+      throw error;
+    }
+  };
   if ((!existing || args.operation === 'update') && !record.buildTransition) {
-    const policy = args.sources ? effects.readJson(args.sources) : effects.packagedSourcePolicy();
-    args.resolvedSources = await effects.resolveSourcePolicy(policy, 'server');
+    args.resolvedSources = await installStage('Package selection', 'Resolve the selected server packages before installation.', async () => {
+      const policy = args.sourcePolicy ?? (args.sources ? effects.readJson(args.sources) : effects.packagedSourcePolicy());
+      return effects.resolveSourcePolicy(policy, 'server');
+    });
   }
   if (!existing && args.sources) record.sourcePolicyHash = effects.sourcePolicyHash(args.sources);
-  await effects.serverPreflight(record, args.operation, {
-    existing, sourcePath: args.sources ?? record.sourcesPath, sourceManifest: args.resolvedSources,
-  });
+  await installStage('Prerequisite checks', record.mode === 'docker' ? 'Check Docker Engine and Docker Compose.' : 'Check native tools and the user service manager.', () => effects.serverPreflight(record, args.operation, {
+    existing, sourcePath: args.sources ?? record.sourcesPath, sourceManifest: args.resolvedSources, identityName: args.identityName,
+  }));
   if (existing && (record.schema === 1 || record.layoutConversion)
     && ['install', 'start', 'restart', 'update', 'rebuild'].includes(args.operation)) {
     record = record.mode === 'docker'
@@ -1295,16 +1370,27 @@ async function executeServerCommand(args, effects) {
     await effects.stopPendingConversion(record);
   } else if (args.operation === 'install') {
     if (!existing) {
-      await effects.initializeSelection(record, args.resolvedSources);
-      effects.writeJson(recordPath, JSON.stringify(record, null, 2) + '\n');
+      await installStage('Installation setup', 'Save the selected packages and installation settings.', async () => {
+        await effects.initializeSelection(record, args.resolvedSources);
+        effects.writeJson(recordPath, JSON.stringify(record, null, 2) + '\n');
+      });
     }
-    await effects.prepareInstallation(record);
+    await installStage('Runtime preparation', record.mode === 'docker' ? 'Prepare the Docker runtime. Downloads and builds may take several minutes.' : 'Download and prepare the native runtime packages. This may take several minutes.', () => effects.prepareInstallation(record));
     // A repeated setup repairs delivery with the retained master and exact packages.
-    await effects.serverLifecycle(record, 'stop');
-    await effects.serverAccess(record, 'access-init', { migrate: !!args.migrate });
-    await effects.serverAccess(record, 'access-issue');
-    await effects.recordInstallationBuild(record);
-    await effects.serverLifecycle(record, 'start');
+    await installStage('Service shutdown', 'Stop managed services before configuring access.', () => effects.serverLifecycle(record, 'stop'));
+    await installStage('Credential initialization', 'Initialize or retain the installation credentials.', () => effects.serverAccess(record, 'access-init', { migrate: !!args.migrate }));
+    await installStage('Credential delivery', 'Prepare access for the selected services.', () => effects.serverAccess(record, 'access-issue'));
+    await installStage('Build verification', 'Record the installed runtime and selected package versions.', () => effects.recordInstallationBuild(record));
+    if (args.identityName) {
+      await installStage('Daemon startup', 'Start the daemon and restore its retained identities.', () => effects.serverLifecycle(record, 'start', ['daemon']));
+      const identity = await installStage('Human identity', 'Keep the existing Human identity, or create it on a fresh daemon.', () => effects.serverEnsureIdentity(record, args.identityName));
+      record.messengerIdentity = identity.name;
+      effects.writeJson(recordPath, JSON.stringify(record, null, 2) + '\n');
+      await installStage('Application startup', 'Start the selected applications and check readiness.', () => effects.serverLifecycle(record, 'start', record.services.filter(name => name !== 'daemon')));
+    } else {
+      await installStage('Service startup', 'Start the daemon and selected services, then check readiness.', () => effects.serverLifecycle(record, 'start'));
+    }
+    if (showInstallProgress) effects.out(progress(installStageCount, installStageCount, 'Installation complete', 'The selected services are ready.'));
   } else if (['backup', 'restore', 'reset'].includes(args.operation)) {
     await effects.serverMaintenance(record, args);
   } else if (['update', 'rebuild'].includes(args.operation)) {
@@ -1336,24 +1422,25 @@ async function executeServerCommand(args, effects) {
         layoutConversion: record.schema === 1 ? 'preparation-pending' : 'activation-pending',
       } : {}),
     }));
+    if (args.operation === 'status') return EXIT_OK;
   }
   effects.out(ok(`Server ${args.operation} completed for ${record.root}`));
   return EXIT_OK;
 }
 
-async function runClientCommand(command, effects) {
+export async function runClientCommand(command, effects) {
   const managedPath = join(effects.home, '.ours-client', 'profile.json');
   const saved = effects.readManagedClientProfile();
   let configPath = command.config;
   if (!configPath && saved) {
-    if (effects.interactive && !await effects.ask(`Reuse saved client server ${saved.endpoint}?`, true))
+    if (!command.preset && effects.interactive && !await effects.ask(`Reuse saved client server ${saved.endpoint}?`, true))
       throw new InstallUsageError('Saved client default retained; use an explicit prepared profile to validate replacement input');
     configPath = managedPath;
   }
   let profile;
   if (configPath) profile = validateHostProfile(effects.readProfile(configPath));
-  else if (effects.interactive) {
-    const endpoint = await effects.askLine('Server HTTP endpoint: ', 'http://127.0.0.1:3050');
+  else if (!command.preset && effects.interactive) {
+    const endpoint = await effects.askLine('Server HTTP or HTTPS endpoint: ', 'http://127.0.0.1:3050');
     const credentialPath = await effects.askLine('Private issued-token file: ', '');
     if (!credentialPath) throw new InstallUsageError('Client setup requires an issued-token file');
     profile = await effects.discoverClientProfile(endpoint, credentialPath);
@@ -1366,46 +1453,63 @@ async function runClientCommand(command, effects) {
   }
   effects.out(info(`Selected server ${profile.endpoint} (instance ${profile.expectedInstanceId}).`));
   await effects.verifyHostProfile(configPath || profile);
-  await effects.verifyPackagedMcp(configPath || profile);
   const settings = saved?.installer ?? (configPath ? effects.readJson(configPath)?.installer : undefined);
   const settingsBase = saved ? dirname(managedPath) : configPath ? dirname(configPath) : process.cwd();
-  let integrations = settings?.integrations;
-  if (!integrations && effects.interactive) {
+  let integrations = command.integrations ?? settings?.integrations;
+  if (!integrations && !command.preset && effects.interactive) {
     integrations = [];
     for (const name of ['codex', 'claude-code', 'fleet']) if (await effects.ask(`Install ${name}?`, name !== 'fleet')) integrations.push(name);
   }
-  if (!Array.isArray(integrations) || !integrations.length || integrations.some(name => !['codex', 'claude-code', 'fleet'].includes(name)) || new Set(integrations).size !== integrations.length) throw new InstallUsageError('installer.integrations must select codex, claude-code and/or fleet');
-  let fleetSettingsPath = settings?.fleetSettingsPath;
+  if (!Array.isArray(integrations) || integrations.some(name => !['codex', 'claude-code', 'fleet'].includes(name)) || new Set(integrations).size !== integrations.length) throw new InstallUsageError('installer.integrations must be an array of codex, claude-code and/or fleet; use an empty array for CLI only');
+  let fleetSettingsPath = command.preset ? command.fleetSettingsPath : settings?.fleetSettingsPath;
+  if (command.nonInteractive && integrations.includes('fleet') && !fleetSettingsPath) throw new InstallUsageError('Fleet in CLI mode requires --fleet-settings; no interactive wizard will be opened');
   if (fleetSettingsPath !== undefined && (typeof fleetSettingsPath !== 'string' || !fleetSettingsPath))
     throw new InstallUsageError('installer.fleetSettingsPath must be a non-empty path when supplied');
   if (fleetSettingsPath) fleetSettingsPath = resolve(settingsBase, fleetSettingsPath);
-  const selectedClients = [...new Set(['sdk', ...(integrations.includes('fleet') ? ['cli'] : []), ...integrations])];
+  const selectedClients = clientPackageNames(integrations);
   let sourcesPath = settings?.sourcesPath;
   let resolvedSources;
-  if (saved) sourcesPath = resolve(settingsBase, sourcesPath);
+  if (command.sourcePolicy) {
+    resolvedSources = await effects.resolveSourcePolicy(command.sourcePolicy, 'client', selectedClients);
+    sourcesPath = undefined;
+  } else if (saved) sourcesPath = resolve(settingsBase, sourcesPath);
   else {
     if (sourcesPath) sourcesPath = resolve(settingsBase, sourcesPath);
     const policy = sourcesPath ? effects.readJson(sourcesPath) : effects.packagedSourcePolicy();
     resolvedSources = await effects.resolveSourcePolicy(policy, 'client', selectedClients);
   }
-  const imported = effects.importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath });
+  effects.out(progress(0, 4, 'Client configuration', 'Prepare the selected integrations and private connection profile.'));
+  const imported = effects.importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, refresh: !!command.preset });
+  let phase = 'Validate saved server connection';
   try {
     await effects.verifyHostProfile(imported.configPath);
-    const exactSuite = await effects.acquireClientPackages(imported.configPath, imported.settings.sourcesPath, integrations);
+    effects.out(progress(1, 4, 'Client packages', 'Acquire and verify the selected client package versions.'));
+    phase = 'Acquire client packages';
+    const exactSuite = await effects.acquireClientPackages(imported.configPath, imported.settings.sourcesPath, integrations, { refresh: !!command.preset });
     const args = { assumeYes: true, dryRun: false, channel: 'latest', clientIntegrations: integrations,
       acquiredFleet: exactSuite.fleetBin, fleetSettingsPath: imported.settings.fleetSettingsPath };
     const target = { mode: 'host-profile', managed: true, configPath: imported.configPath, profile: imported.profile, endpoint: imported.profile.endpoint };
+    effects.out(progress(2, 4, 'Client integrations', 'Register the selected agent integrations.'));
+    phase = 'Register client integrations';
     const summary = await runHarnessPhase(args, effects, { target, isDefaultStateDir: false, exactSuite });
-    if (integrations.includes('fleet')) summary.push(await runFleetPhase(args, effects, { target, isDefaultStateDir: false }));
+    if (integrations.includes('fleet')) {
+      effects.out(progress(3, 4, 'Fleet configuration', 'Apply prepared settings or open the selected Fleet wizard.'));
+      phase = 'Configure Fleet';
+      summary.push(await runFleetPhase(args, effects, { target, isDefaultStateDir: false }));
+    }
     const incomplete = integrations.filter(name => !summary.some(row => row.key === name && row.state === 'installed'));
     if (effects.env.OURS_CONFIG && resolve(effects.env.OURS_CONFIG) !== imported.configPath)
       effects.out(warn('This shell has an explicit OURS_CONFIG override. Unset it for new clients to use the saved default; installer did not edit your shell.'));
-    effects.out(incomplete.length
-      ? warn(`Client setup incomplete (${incomplete.join(', ')}); saved profile and settings retained. Re-run ours-install client install.`)
-      : ok(`Client setup complete. New clients discover ${imported.configPath}; no OURS_CONFIG export is required.`));
+    if (incomplete.length) {
+      effects.out(warn(`Client setup incomplete (${incomplete.join(', ')}). The selected client integrations need attention:`));
+      for (const name of incomplete) explainClientFailure(effects, name, summary.find(row => row.key === name));
+      clientRetry(effects, imported, integrations);
+    } else effects.out(ok(`Client setup complete. New clients discover ${imported.configPath}; no OURS_CONFIG export is required.`));
+    if (!incomplete.length) effects.out(progress(4, 4, 'Client setup complete', 'All selected integrations are configured.'));
     return incomplete.length ? EXIT_REFUSED : EXIT_OK;
   } catch (error) {
-    effects.out(warn(`Client setup incomplete: ${reason(error)}. Saved profile and settings retained; re-run ours-install client install.`));
+    effects.out(warn(`Client setup incomplete: ${phase} failed — ${clientDiagnostic(error)}. Fix this error before retrying.`));
+    clientRetry(effects, imported, integrations);
     return EXIT_REFUSED;
   }
 }

package/lib/plan.mjs

@@ -6,6 +6,7 @@
 
 import { join, resolve, basename, dirname } from 'node:path';
 import { valid, validRange, satisfies } from 'semver';
+import { releaseBinding } from '../assets/scripts/maintenance/release-graph.mjs';
 
 export const CLI_UNIT_MARKER = '# Managed by @ours.network/cli';
 export const SYSTEMD_USER_DIR = ['.config', 'systemd', 'user'];
@@ -96,7 +97,7 @@ export function launchdLabelForStateDir(stateDir) {
 export function classifyUnit(text) {
   if (text === null || text === undefined) return { kind: 'absent' };
   const s = String(text);
-  if (s.startsWith(CLI_UNIT_MARKER)) return { kind: 'cli-managed' };
+  if ((s.startsWith(CLI_UNIT_MARKER) || s.startsWith('# Managed by @ours.network/daemon'))) return { kind: 'cli-managed' };
   const looksLikeOursMcp = /ExecStart=.*\bours-mcp\b/.test(s)
     || /^Description=ours MCP daemon\b/m.test(s)
     || (/^Environment=OURS_STATE_DIR=/m.test(s) && /^Environment=OURS_TRANSPORT=http$/m.test(s));
@@ -137,7 +138,7 @@ export function planServiceInstall({ stateDir, home, readText, platform = 'linux
       platform,
       reason: 'no-service-manager',
       message: `installing a boot service is not available on ${platform} — the ours CLI supports Linux user systemd and macOS launchd`,
-      manual: ['ours', 'daemon', 'serve', '--config'],
+      manual: ['ours-daemon', 'serve', '--config'],
     };
   }
 
@@ -223,7 +224,7 @@ export function serviceInstallCommand({ stateDir, adoptLegacyUnit = false }) {
   // --json so the caller can read back whether the unit actually CHANGED rather
   // than assuming it did. --force is reachable only through the explicit argument
   // above, and the CLI refuses to overwrite a unit it did not write.
-  const cmd = ['ours', 'daemon', 'install-service', '--yes', '--json', '--state-dir', dir, '--config', join(dir, 'config.json')];
+  const cmd = ['ours-daemon', 'install-service', '--yes', '--json', '--state-dir', dir, '--config', join(dir, 'config.json')];
   if (adoptLegacyUnit) cmd.push('--force');
   return cmd;
 }
@@ -264,20 +265,20 @@ export function planDaemonSteps(target, { cliVersionChanged = false, cliStartedI
   const steps = [{ id: 'cli', label: 'install the ours-sdk CLI', command: ['npm', 'i', '-g', '@ours.network/cli'] }];
   steps.push({ id: 'config', label: `write ${join(dir, 'config.json')}`, port: target.port });
   if (target.action === 'create') {
-    steps.push({ id: 'start', label: `start the daemon on port ${target.port}`, command: ['ours', 'daemon', 'start', '--config', join(dir, 'config.json')] });
+    steps.push({ id: 'start', label: `start the daemon on port ${target.port}`, command: ['ours-daemon', 'start', '--config', join(dir, 'config.json')] });
   } else if (cliVersionChanged) {
     // `ours daemon stop` refuses to signal a daemon it did not start, so a
     // daemon under another launcher is left running and the caller says which
     // launcher must be restarted instead.
     steps.push(cliStartedIt
-      ? { id: 'restart', label: 'restart the daemon (package version changed)', command: ['ours', 'daemon', 'restart', '--config', join(dir, 'config.json')] }
+      ? { id: 'restart', label: 'restart the daemon (package version changed)', command: ['ours-daemon', 'restart', '--config', join(dir, 'config.json')] }
       : { id: 'restart-external', label: 'daemon was not started by the CLI — restart it with its own launcher', command: null });
   }
   steps.push({ id: 'service', label: 'install the boot service', command: serviceInstallCommand({ stateDir: dir }) });
   return steps;
 }
 
-export const SERVER_PACKAGES = ['sdk', 'cli', 'mcp', 'tg-connector', 'cowork', 'messenger-server'].map(n => `@ours.network/${n}`);
+export const SERVER_PACKAGES = ['sdk', 'cli', 'daemon', 'tg-connector', 'cowork', 'messenger-server'].map(n => `@ours.network/${n}`);
 export const SERVER_DEPENDENCIES = {
   daemon: [], telegram: ['daemon'], cowork: ['daemon'], messenger: ['daemon'],
 };
@@ -310,6 +311,7 @@ export function selectSourcePackages(manifest, role, clients = []) {
 
 /** Resolve a packaged compatibility policy into a role-filtered exact selection. */
 export async function resolveSourcePolicy(manifest, role, clients = [], resolveNpm) {
+  const release = releaseBinding(manifest);
   const names = role === 'server' ? SERVER_PACKAGES : clients.map(name => `@ours.network/${name}`);
   const packages = {};
   const sourceNames = new Set();
@@ -332,7 +334,7 @@ export async function resolveSourcePolicy(manifest, role, clients = [], resolveN
     } else throw new Error(`Missing source policy for ${name}`);
   }
   const sources = Object.fromEntries([...sourceNames].map(name => [name, manifest.sources[name]]));
-  const exact = { ...(sourceNames.size ? { sources } : {}), packages };
+  const exact = { ...(sourceNames.size ? { sources } : {}), packages, ...(release ? { release } : {}) };
   selectSourcePackages(exact, role, clients);
   return exact;
 }
@@ -468,3 +470,7 @@ export function consumerServiceState(text, service, platform) {
   }
   return matches === 1 ? selected : undefined;
 }
+
+export function clientPackageNames(integrations) {
+  return [...new Set(['sdk', 'cli', ...(integrations.some(name => ['codex', 'claude-code'].includes(name)) ? ['mcp'] : []), ...integrations])];
+}