@ours.network/install 1.2.1-nightly.1 → 1.2.1-nightly.3

package/README.md

@@ -1,141 +1,98 @@
-# @ours.network/install — `ours-install`
+# @ours.network/install — one installer for the whole stack
 
-The all-in-one installer for the ours.network stack. One run installs and
-configures the shared daemon, MCP adapter, cowork, Telegram connector, Fleet,
-and plugins for every safely detected agent harness.
+Requires Node.js 22+ and npm. Install the selected release channel:
 
 ```sh
-npm install --global @ours.network/install
+npm install -g @ours.network/install@nightly
 ours-install
 ```
 
-### Stable and nightly channels
-
-Installing `@ours.network/install@latest` selects the stable channel; installing
-`@ours.network/install@nightly` selects the nightly channel. Before changing the
-machine, the installer resolves `@ours.network/mcp`,
-`@ours.network/claude-code`, and `@ours.network/codex`, verifies that their
-selected dist-tags expose one exact lockstep version, and fails closed if they
-do not. MCP and the Codex launcher are installed by exact version, and local
-Claude Code and Codex marketplace manifests pin the corresponding plugin
-packages to that same version.
-
-`OURS_CHANNEL=latest|nightly` (or the legacy `OURS_INSTALL_CHANNEL`) remains an
-explicit override. Without an override, the installed package's own version
-selects the channel.
-
-The normal flow uses one daemon at `~/.ours` on port 3050, shows an eight-stage
-progress bar, and asks only for information it cannot safely infer (normally the
-Human identity's display name). Existing daemon conflicts and moving a Telegram
-connector from another daemon still require explicit confirmation.
-
-## What the installer does
-
-- Installs `@ours.network/cli`, `@ours.network/mcp`,
-  `@ours.network/tg-connector`, `@ours.network/cowork`, and
-  `@ours.network/fleet` on one release channel.
-- Configures, starts, and enables the single shared daemon with a CLI-managed
-  user systemd service on Linux or LaunchAgent on macOS.
-- Creates the daemon's Human identity (historically called the root identity),
-  or preserves the existing one on a re-run.
-- Installs the ours plugin into safely detected Claude Code, Codex, and Hermes
-  installations.
-- Configures and starts cowork as a durable shim over the shared daemon.
-- Configures and starts Telegram as a durable shim over the same daemon.
-- Runs Fleet's native initialization through prepared settings or its interactive wizard. Fleet owns and
-  publishes its v2 configuration, including subscriptions, models, roles,
-  templates, and permissions. The installer does not start Fleet roles.
-
-The operator CLI owns daemon configuration, lifecycle, and boot persistence.
-The MCP package is only the stdio adapter spawned by agent harnesses; the
-installer never asks `ours-mcp` to start a daemon.
-
-Daemon state is temporarily scoped to its package major version. On a same-major
-update, the installer refreshes the packages and runs `ours daemon restart`; the
-CLI streams structured startup phases until restore is complete instead of
-appearing to hang. A different-major update is detected before package
-replacement. The installer explains the incompatibility and, only in an
-interactive run, offers to stop the CLI-managed daemon, copy the complete state
-directory to a timestamped directory under `~/.ours-backups/`, remove the
-managed service and old state, then initialize the new major. The default answer is no, and
-`OURS_ASSUME_YES` never authorizes this purge.
-
-## What remains stopped
-
-Only Fleet is intentionally not started. Review and activate it when ready:
+With no arguments, the wizard explains each step and offers keyboard choices.
+Use arrow keys and Enter to choose, and Space to select integrations. Recommended
+settings keep advanced ports and package overrides out of the usual flow. Text
+input is used for your name and explicitly customized paths or ports. Linux x64
+recommends native mode; macOS and Windows recommend Docker. On Windows run the
+installer inside WSL with Docker Desktop integration. This recommendation concerns
+packaging and isolation, not a guarantee that emulated x64 is faster on ARM Macs.
 
-```sh
-# After completing Fleet's wizard and reviewing ~/fleet.yaml:
-ours-fleet doctor
-ours-fleet config
-ours-fleet up
-ours-fleet ls
-```
-
-The final installer screen repeats these commands and provides a copy-paste
-prompt for Claude Code, Codex, or Hermes. The agent should guide local bot-token
-entry without asking the user to paste the secret into chat.
-
-## Preview and automation
+The same installer accepts complete CLI presets. It reports missing answers before
+changing the machine and never opens hidden prompts when arguments are supplied.
+Both forms show the same preparation, identity, update and readiness progress.
 
 ```sh
-ours-install --dry-run
-OURS_ASSUME_YES=1 ours-install
-ours-install --state-dir /absolute/path --port 3070
+# Whole stack, with prepared Fleet settings and no interactive prompts:
+ours-install --mode docker --state-dir "$HOME/ours-docker" \
+  --identity-name "Your Name" --integrations codex,fleet \
+  --fleet-settings "$HOME/fleet-settings.json"
+
+# Native server only; native and packages mean the same mode:
+ours-install server --mode native --state-dir "$HOME/ours-native" \
+  --identity-name "Your Name"
+
+# Clients connected to an existing server:
+ours-install client --config /private/client/profile.json \
+  --integrations codex,fleet --fleet-settings /private/fleet-settings.json
+
+# Update a retained complete installation and its clients:
+ours-install all update --mode docker --state-dir "$HOME/ours-docker" \
+  --identity-name "Your Name" --integrations codex,fleet \
+  --fleet-settings "$HOME/fleet-settings.json" --compatible
 ```
 
-Dry-run walks the real plan without writing files, installing packages, starting
-processes, or changing services. `OURS_ASSUME_YES=1` uses the OS username for a
-new Human identity and asks no ordinary setup questions, but it never bypasses
-selection conflicts, connector moves, or destructive safeguards.
-
-A non-default daemon must be selected coherently with a config file or matching
-port and state directory. Hermes and the generated Fleet role persist that
-selection through `OURS_CONFIG`. Claude Code and Codex plugin registrations
-cannot store an environment value; for those harnesses the installer prints the
-exact `export OURS_CONFIG=...` line that must be added to the shell profile
-before starting the harness. There is no per-application daemon.
-
-`OURS_CONFIG` may also name a prepared private host profile containing the
-complete `endpoint`, `expectedInstanceId`, and absolute `credentialPath` tuple.
-The profile and credential must already be regular current-user files with
-private permissions. In this mode the installer verifies `/selection` before
-sending the credential to `/version`, installs only MCP, detected Claude/Codex
-plugins, and Fleet client support, and never creates, starts, stops, or services
-a host daemon. Telegram, cowork, messenger, daemon voice, and daemon state stay
-Compose-owned. If `OURS_CONFIG` is unset, the same profile is discovered at
-`~/.ours/config.json`; a legacy config there keeps the existing local behavior.
-
-## Uninstall
+`server` and `client` are presets of the same flow, not separate interactive
+installers. `--integrations none` explicitly skips client integrations. Use
+`--dry-run` with a complete preset to preview it, and `--help` for all options.
+Fleet's own wizard is available only in interactive setup; CLI Fleet setup requires
+its JSON settings file. Fleet stays stopped until you review and activate it.
 
-```sh
-ours-uninstall --state-dir "$HOME/.ours"
-ours-uninstall --state-dir "$HOME/.ours" --purge
-```
-
-The uninstaller delegates service and daemon removal to the `ours` CLI. Identity
-state is retained by default. Purging requires the existing destructive gates and
-targets only the explicit state directory.
+The server installs the daemon/SDK/CLI, main MCP, Telegram, Cowork and Messenger.
+It starts the daemon, preserves the existing Human identity (or creates it once),
+then starts its applications. Full-stack setup issues a separate local client
+credential and configures the selected Codex, Claude Code and Fleet integrations.
+Existing identity keys and names are retained on update. An update's storage
+compatibility must be reviewed before supplying `--compatible`.
 
-When `OURS_CONFIG` selects a host profile, uninstall removes only selected
-client attachments. The operator-owned profile and shared credential are kept
-even with `--purge`, and no Compose daemon, service, or state is touched.
+The installer embeds exact component versions and SHA-512 values for its release.
+An existing server's retained release selects matching local clients. Secrets are
+read from protected files, and client setup never copies the daemon API master.
 
-## Release channel
+## Migrate an existing global installation
 
-`OURS_CHANNEL=nightly` (or `OURS_INSTALL_CHANNEL`) selects the packages' nightly
-dist-tags. Without an override, the installer's own version selects the channel.
-The operator CLI intentionally has no nightly dist-tag and remains untagged on
-both channels.
+The wizard detects the old `~/.ours/config.json` and offers to keep its identities,
+messages, keys and settings in the new installation. It follows the configured
+state directory, including a custom location. An equivalent unattended preset is:
 
-## Environment
+```sh
+ours-install all --mode docker --state-dir "$HOME/ours-docker" \
+  --migrate-from "$HOME/.ours/config.json" --compatible --integrations codex
+```
 
-- `OURS_ASSUME_YES=1`: accept safe defaults without prompting.
-- `OURS_INSTALL_DRY_RUN=1`: preview without mutation.
-- `OURS_NPM`: npm executable.
-- `OURS_CONFIG`: explicit legacy daemon config or prepared private host profile.
-- `OURS_STATE_DIR`: explicit daemon state directory.
-- `OURS_CHANNEL`: `latest` or `nightly`.
+Run the old daemon before the first migration so the installer can record and
+verify its identities. The new runtime is downloaded/built first. Then the old
+boot service and daemon stop, and the complete daemon state is copied while its
+writer lock is held. Docker migration imports that copy into its named storage
+volume. Existing Human/role names and CIDs must match before applications start;
+migration never creates a replacement Human.
+
+The original state/configuration remain unchanged. A private `legacy-backup`
+directory stores the original config/service definition, and
+`legacy-client/profile.json` is a prepared connection profile for the new server.
+Selected integrations are configured by the usual client setup. The global `ours` command is switched to a launcher for the managed installation
+only after verifying ownership of its existing npm entry; foreign or read-only
+commands are refused before migration. Ordinary `ours identity list` is checked
+after cutover. Lifecycle commands manage the new installation, and selection
+overrides cannot accidentally return to the old daemon. The old configuration is
+not reinterpreted as a client profile. Do not start the old state alongside the
+migrated daemon. Reinstalling the global CLI with npm can replace the launcher;
+repeat the same migration command to verify and repair that routing.
+
+Repeat the same command after an interruption. Once the destination has started,
+retries repair it in place instead of replacing it with an older source snapshot.
+The source is kept stopped after an activation failure to avoid diverging identity
+sessions. Migration requires local Linux/macOS (or WSL) with `node:sqlite` support,
+a verifiable old CLI/service, and a separate target directory. External PostgreSQL
+history or unsupported external MCP/token-delivery paths are refused before
+shutdown. Unrelated application data outside the daemon tree is not copied.
 
 ## Selected network installations (2.0)
 
@@ -145,15 +102,15 @@ SHA-512 values. Acquisition validates the ours dependency graph before activatio
 A development override without a release binding is not a qualified product release.
 
 ```sh
-ours-install server install --mode docker --state-dir /private/ours-install
-ours-install server install --mode packages --state-dir /private/ours-install
+ours-install server install --mode docker --state-dir /private/ours-install --identity-name "Your Name"
+ours-install server install --mode packages --state-dir /private/ours-install --identity-name "Your Name"
 ours-install server status --state-dir /private/ours-install
 ours-install server stop --state-dir /private/ours-install
 ours-install server start --state-dir /private/ours-install
 ours-install server restart --state-dir /private/ours-install
 ```
 
-Choose one mode for a private installation root. The private `installation.json`
+Choose one mode and a folder for its programs and data. The private `installation.json`
 records mode, instance selection, configuration/source paths and service selection;
 it never records master bytes or an issued-token registry. The selected policy
 is resolved to an exact, role-filtered `sources.json` before acquisition.
@@ -169,6 +126,17 @@ Linux/WSL or a launchd GUI user domain on macOS. Source builds also require Git,
 Python 3, a C/C++ toolchain, make, and the selected repositories' own prerequisites.
 Docker mode requires a working Docker engine and Compose 2.35+; its build image
 contains the source-build prerequisites. No bind or Docker socket mounts are used.
+Docker is recommended for macOS and Windows. Install and start Docker Desktop
+on those hosts; on Linux, install Docker Engine and the Compose plugin. If Docker
+is unavailable, the installer explains how to install/start it or use
+`server install --mode packages --state-dir <new-empty-directory>` instead.
+Native Windows installations require WSL with a working systemd user manager.
+The installer never switches an existing installation's mode automatically.
+Server installation shows each stage before it starts, streams Docker builds and
+native package acquisition, and reports completion only after service readiness.
+If a Docker service fails, the error includes its last 50 log lines (bounded in
+size) and a command to inspect the logs. A failed daemon prevents consumers from
+starting; a failed consumer does not prevent checks of unrelated consumers.
 Server runtime installation selects SDK/CLI, main MCP, Telegram, Cowork and
 Messenger. Main MCP is injected into the daemon, not started as a second daemon.
 The daemon starts first; consumers are checked through their owning readiness
@@ -219,7 +187,7 @@ client-owned installer settings:
 ```
 
 ```sh
-ours-install client install --config /private/client/profile.json
+ours-install client install --config /private/client/profile.json --integrations codex,claude-code
 ```
 
 Optional `sourcesPath` and `fleetSettingsPath` values are absolute or resolved
@@ -269,7 +237,7 @@ For a managed server, maintenance runs on the server machine through the install
 ours-install server backup server snapshot --state-dir /path/to/installation
 ours-install server restore server snapshot --state-dir /path/to/installation
 ours-install server rebuild --state-dir /path/to/installation
-ours-install server update --state-dir /path/to/installation --compatible
+ours-install server update --mode docker --state-dir /path/to/installation --identity-name "Your Name" --compatible
 ```
 
 Backup and restore support the full server or an individual `daemon`, `telegram`,

package/assets/Dockerfile

@@ -21,6 +21,7 @@ COPY scripts/runtime/runtime-common.mjs /opt/ours/docker/runtime-common.mjs
 COPY scripts/runtime/check-client.mjs /opt/ours/docker/check-client.mjs
 COPY scripts/runtime/check-start.mjs /opt/ours/docker/check-start.mjs
 COPY scripts/runtime/client-setup.mjs /opt/ours/docker/client-setup.mjs
+COPY scripts/runtime/legacy-import.mjs /opt/ours/docker/legacy-import.mjs
 COPY scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
 COPY scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs
 COPY scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs /opt/ours/docker/

package/assets/docker-compose.yaml

@@ -177,6 +177,26 @@ services:
       start_period: 30s
       retries: 12
 
+  legacy-import:
+    profiles: [maintenance]
+    build:
+      <<: *source-build
+      target: maintenance
+    platform: linux/amd64
+    image: "${OURS_MAINTENANCE_IMAGE:-ours-compose-2-maintenance:local}"
+    user: "0:0"
+    network_mode: none
+    read_only: true
+    cap_drop: [ALL]
+    cap_add: [CHOWN, DAC_OVERRIDE]
+    security_opt: [no-new-privileges:true]
+    entrypoint: [node, /opt/ours/docker/legacy-import.mjs]
+    environment:
+      OURS_UID: "${OURS_UID:-1000}"
+      OURS_GID: "${OURS_GID:-1000}"
+    volumes:
+      - {type: volume, source: server-storage, target: /storage, volume: {nocopy: true}}
+
   state-operation:
     profiles: [maintenance]
     build:

package/assets/release-lock.json

@@ -565,9 +565,9 @@
       ]
     },
     "node_modules/@anthropic-ai/sdk": {
-      "version": "0.126.0",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.126.0.tgz",
-      "integrity": "sha512-VhiZl6rA/8uC+MgDaOhEcAWaIZ2tPnIY885jlZqxrGrutUW2nqCtophBtlsX0tk5kChBUjV/1NVjL3y0M4OwUg==",
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.127.0.tgz",
+      "integrity": "sha512-OKiVbG9LHCxjn4fBJZJFy/Bz3hqE1RYpwaeSEDNheQnvz0XNKmGT/Lhkz2Sf1a27Ldt3vVv+BkU81I0U/8EpoQ==",
       "license": "MIT",
       "optional": true,
       "peer": true,
@@ -811,9 +811,9 @@
       }
     },
     "node_modules/@fastify/websocket": {
-      "version": "11.3.0",
-      "resolved": "https://registry.npmjs.org/@fastify/websocket/-/websocket-11.3.0.tgz",
-      "integrity": "sha512-g89ag4BCcD9YP5wBZXixzoLnuf5j89p/sXFcfpCiv2pdEkYYukBEoK3heVzqsp0EAtszVDc2BBZG0KZqeAShIA==",
+      "version": "11.3.1",
+      "resolved": "https://registry.npmjs.org/@fastify/websocket/-/websocket-11.3.1.tgz",
+      "integrity": "sha512-3117Fteg0MC9zRl0ilNAQelRb+PNDvNuWe0yJ+jnLthaPPZnlml+GraGpesNUEQvLl8+3C+W4aKZz10XmQ10Mg==",
       "funding": [
         {
           "type": "github",

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.1",
+  "installerVersion": "1.2.1-nightly.3",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.3",

package/assets/scripts/runtime/legacy-import.mjs

@@ -0,0 +1,103 @@
+/** Import a stopped, read-only host migration stage into the managed Docker volume. */
+import * as fs from 'node:fs';
+import { dirname, join, resolve, isAbsolute } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+// Repository layout and the maintenance image intentionally place this binding differently.
+const nativeModule = new URL('../maintenance/state-native.mjs', import.meta.url);
+const { publishNoReplace } = await import(fs.existsSync(nativeModule) ? nativeModule.href : new URL('./state-native.mjs', import.meta.url).href);
+
+const MARKER = '.ours-legacy-import.json';
+const COMPONENTS = ['mcp', 'daemon'];
+const fail = message => { throw Error(`Legacy volume import: ${message}`); };
+function canonical(path) {
+  if (typeof path !== 'string' || !isAbsolute(path) || resolve(path) !== path) fail('paths must be normalized absolute paths');
+  if (fs.realpathSync(path) !== path) fail('symlink paths are not supported');
+}
+function privateEntry(path, uid, gid, directory) {
+  const stat = fs.lstatSync(path);
+  if (!(directory ? stat.isDirectory() : stat.isFile()) || stat.isSymbolicLink()
+    || stat.uid !== uid || stat.gid !== gid
+    || (directory ? (stat.mode & 0o7777) !== 0o700 : ((stat.mode & 0o7077) !== 0 || !(stat.mode & 0o400)))
+    || (!directory && stat.nlink !== 1)) fail('unsafe ownership, permissions, or linked state entry');
+  return stat;
+}
+function scan(root, uid, gid) {
+  const entries = [];
+  function visit(path, relative) {
+    const stat = fs.lstatSync(path), directory = stat.isDirectory();
+    privateEntry(path, uid, gid, directory); entries.push({ relative, directory, mode: stat.mode & 0o700 });
+    if (directory) for (const name of fs.readdirSync(path).sort()) visit(join(path, name), relative ? join(relative, name) : name);
+  }
+  canonical(root); visit(root, ''); return entries;
+}
+function readReceipt(root, uid, gid, targetRoot) {
+  privateEntry(join(root, MARKER), uid, gid, false);
+  const value = JSON.parse(fs.readFileSync(join(root, MARKER), 'utf8'));
+  const keys = ['sourceStateDir', 'sourceConfigPath', 'targetRoot', 'rootName'];
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('\0') !== [...keys].sort().join('\0')
+    || keys.some(key => typeof value[key] !== 'string' || !value[key])
+    || value.targetRoot !== targetRoot
+    || ['sourceStateDir', 'sourceConfigPath', 'targetRoot'].some(key => !isAbsolute(value[key]) || resolve(value[key]) !== value[key])) fail('invalid or mismatched migration receipt');
+  return Object.fromEntries(keys.map(key => [key, value[key]]));
+}
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+function existingDestination(path, expected, uid, gid, targetRoot) {
+  if (!fs.existsSync(path)) return false;
+  canonical(path); privateEntry(path, uid, gid, true);
+  if (!fs.readdirSync(path).length) return false;
+  if (!fs.existsSync(join(path, MARKER)) || !same(readReceipt(path, uid, gid, targetRoot), expected)) fail('nonmatching existing destination');
+  return true;
+}
+function makeDirectory(path, uid, gid) {
+  if (!fs.existsSync(path)) { fs.mkdirSync(path, { mode: 0o700 }); fs.chownSync(path, uid, gid); }
+  canonical(path); privateEntry(path, uid, gid, true);
+}
+
+/** Caller holds installation exclusion and has stopped all destination writers. */
+export function importLegacyVolume({ sourceRoot = '/legacy-import', storageRoot = '/storage', targetRoot, uid, gid }) {
+  if (![uid, gid].every(value => Number.isSafeInteger(value) && value >= 0)) fail('numeric target UID/GID required');
+  if (typeof targetRoot !== 'string' || !isAbsolute(targetRoot) || resolve(targetRoot) !== targetRoot) fail('expected target root required');
+  canonical(sourceRoot); canonical(storageRoot);
+  const sourceOwner = fs.lstatSync(sourceRoot);
+  privateEntry(sourceRoot, sourceOwner.uid, sourceOwner.gid, true);
+  const sources = COMPONENTS.map(component => {
+    const path = join(sourceRoot, component);
+    const entries = scan(path, sourceOwner.uid, sourceOwner.gid);
+    return { component, path, entries, receipt: readReceipt(path, sourceOwner.uid, sourceOwner.gid, targetRoot) };
+  });
+  if (!same(sources[0].receipt, sources[1].receipt)) fail('source daemon and MCP receipts differ');
+  const rootStat = fs.lstatSync(storageRoot);
+  const freshRoot = rootStat.isDirectory() && rootStat.uid === 0 && rootStat.gid === 0 && fs.readdirSync(storageRoot).length === 0;
+  if (!freshRoot) privateEntry(storageRoot, uid, gid, true);
+  const state = join(storageRoot, 'state');
+  if (fs.existsSync(state)) { canonical(state); privateEntry(state, uid, gid, true); }
+  // Validate every existing destination before changing even an empty volume.
+  for (const source of sources) source.reused = existingDestination(join(state, source.component), source.receipt, uid, gid, targetRoot);
+  if (freshRoot) { fs.chmodSync(storageRoot, 0o700); fs.chownSync(storageRoot, uid, gid); }
+  makeDirectory(state, uid, gid);
+  for (const source of sources) {
+    if (source.reused) continue;
+    const destination = join(state, source.component), staging = join(state, `.legacy-import-${randomUUID()}`);
+    try {
+      fs.cpSync(source.path, staging, { recursive: true, errorOnExist: true, force: false });
+      for (const entry of [...source.entries].reverse()) {
+        const path = entry.relative ? join(staging, entry.relative) : staging;
+        fs.chmodSync(path, entry.mode); fs.chownSync(path, uid, gid);
+      }
+      scan(staging, uid, gid);
+      if (!same(readReceipt(staging, uid, gid, targetRoot), source.receipt)) fail('copied receipt changed');
+      if (fs.existsSync(destination)) fs.rmdirSync(destination); // empty skeleton only
+      publishNoReplace(staging, destination);
+    } finally { fs.rmSync(staging, { recursive: true, force: true }); }
+  }
+  return { imported: sources.filter(source => !source.reused).map(source => source.component), retained: sources.filter(source => source.reused).map(source => source.component) };
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    importLegacyVolume({ targetRoot: process.env.OURS_LEGACY_TARGET_ROOT, uid: Number(process.env.OURS_UID), gid: Number(process.env.OURS_GID) });
+    console.log('Legacy daemon and MCP state imported into the selected volume.');
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.1",
+    "installerVersion": "1.2.1-nightly.3",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.3",

package/install.mjs

@@ -3,14 +3,14 @@
 import { readFileSync } from 'node:fs';
 
 import { realEffects } from './lib/effects.mjs';
-import { runInstall } from './lib/orchestrate.mjs';
+import { runSetup } from './lib/setup.mjs';
 import { closeSync, makeWriter, openTty } from './lib/ui.mjs';
 
 const version = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version;
 const ttyFd = openTty();
 
 try {
-  const code = await runInstall(process.argv.slice(2), realEffects({
+  const code = await runSetup(process.argv.slice(2), realEffects({
     write: makeWriter(ttyFd),
     ttyFd,
     env: process.env,

package/lib/build-transition.mjs

@@ -2,10 +2,16 @@ import { readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { validateInstallation } from './plan.mjs';
+import { info, ok, warn } from './ui.mjs';
 
 /** The caller holds the installation lock; installation.json owns retry state. */
 export async function serverBuildTransition(record, args, effects) {
   validateInstallation(record, record.root);
+  const stage = async (label, action) => {
+    effects.out?.(info(label));
+    try { const result = await action(); effects.out?.(ok(`${label} complete`)); return result; }
+    catch (error) { effects.out?.(warn(`Server ${args.operation} stopped during ${label.toLowerCase()}.`)); throw error; }
+  };
   const path = join(record.root, 'installation.json');
   const save = transition => {
     record = { ...record, buildTransition: transition };
@@ -14,9 +20,9 @@ export async function serverBuildTransition(record, args, effects) {
   };
   let transition = record.buildTransition;
   if (!transition) {
-    const candidate = await effects.prepareServerBuild(record, args);
+    const candidate = await stage('Prepare the updated runtime', () => effects.prepareServerBuild(record, args));
     try {
-      await effects.checkServerBuild(record, candidate, !!args.compatible, args.operation);
+      await stage('Verify package and stored-state compatibility', () => effects.checkServerBuild(record, candidate, !!args.compatible, args.operation));
       transition = { operation: args.operation, candidate, compatible: !!args.compatible,
         ...(args.sources ? { sourcePolicyHash: createHash('sha256').update(readFileSync(args.sources)).digest('hex') } : {}),
         runningServices: await effects.serverLifecycle(record, 'status'), phase: 'prepared' };
@@ -34,19 +40,19 @@ export async function serverBuildTransition(record, args, effects) {
   const { candidate, runningServices } = transition;
   // A failed readiness check can leave some new services running. Every retry
   // excludes those writers again and retains the original requested running set.
-  await effects.retireServerBuildRuntime(record);
+  await stage('Stop services before updating stored state', () => effects.retireServerBuildRuntime(record));
   if (transition.phase === 'prepared') {
-    await effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation);
+    await stage('Update stored state while retaining identities and credentials', () => effects.updateServerBuildState(record, candidate, transition.compatible, transition.operation));
     transition = { ...transition, phase: 'state-updated' };
     save(transition);
   }
   if (transition.phase === 'state-updated') {
-    await effects.publishServerBuild(record, candidate);
+    await stage('Activate the prepared runtime', () => effects.publishServerBuild(record, candidate));
     transition = { ...transition, phase: 'runtime-activated' };
     save(transition);
   }
-  await effects.validateServerBuildState(record);
-  await effects.serverLifecycle(record, 'start', runningServices);
+  await stage('Verify retained state and identities', () => effects.validateServerBuildState(record));
+  await stage('Restore previously running services and check readiness', () => effects.serverLifecycle(record, 'start', runningServices));
   const completed = { ...record, sourcePolicyHash: candidate.sourcePolicyHash };
   delete completed.buildTransition;
   effects.writeJson(path, JSON.stringify(completed, null, 2) + '\n');