@ours.network/install 1.2.1-nightly.23 → 1.2.1-nightly.25

package/README.md

@@ -1,3 +1,17 @@
+## Install first, connect the App afterwards
+
+```sh
+ours-install --username alex --name Alex --surname Taylor --disable-fleet-agents-setup
+```
+
+This permanent command contains no tunnel credentials or enrollment expiry. On a terminal it asks for the remaining installation choices, including Docker, Podman or native packages. The username is local and has no global uniqueness check. A fresh root is named `<username>@<hostname>`; the optional `--hostname` defaults to the machine name. Messenger stores Name and Surname through its supported profile API. Retried setup retains root identities and existing Messenger profiles.
+
+`--disable-fleet-agents-setup` installs the Fleet CLI and saves the choice without opening its agent/model wizard or rewriting existing Fleet configuration. Configure agents in the App after device linking. Complete presets still work unattended; partial presets require a terminal and cannot use `OURS_ASSUME_YES`.
+
+The separate `ours-fleet setup-tunnel --file /private/setup-payload` step requires the matching Fleet follow-up release. Its private App payload remains scoped, signed-root-bound and expiring. Then run `ours-fleet link-device` and paste its private single-use code into the App. Do not put the expiring tunnel payload in the permanent installer command.
+
+Native packages currently provide server-only installation; full Fleet/App onboarding requires the supported gateway (Docker or Podman). The installer refuses unsupported native full-stack setup before changing anything. This PR does not add a native gateway or release unpublished Fleet commands.
+
 See [one-connection setup, localhost:4050 and systemd migration](GATEWAY_SETUP.md) for the gateway-only client workflow.
 
 # @ours.network/install — one installer for the whole stack
@@ -577,4 +591,4 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.31` with its recorded registry integrity. This release includes the packaged `/fleet` browser entry and persists the available Fleet loopback port used by the workspace tunnel. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.32` with its recorded registry integrity. This release includes the packaged `/fleet` browser entry, separate `ours-fleet setup-tunnel` and `ours-fleet link-device` commands, and persists the available Fleet loopback port used by the workspace tunnel. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.

package/assets/Dockerfile

@@ -23,6 +23,7 @@ COPY --chmod=644 scripts/runtime/runtime-common.mjs /opt/ours/docker/runtime-com
 COPY --chmod=644 scripts/runtime/check-client.mjs /opt/ours/docker/check-client.mjs
 COPY --chmod=644 scripts/runtime/check-start.mjs /opt/ours/docker/check-start.mjs
 COPY --chmod=644 scripts/runtime/client-setup.mjs /opt/ours/docker/client-setup.mjs
+COPY --chmod=644 scripts/runtime/diagnostics.mjs /opt/ours/docker/diagnostics.mjs
 COPY --chmod=644 scripts/runtime/legacy-import.mjs /opt/ours/docker/legacy-import.mjs
 COPY --chmod=644 scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
 COPY --chmod=644 scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs

package/assets/release-lock.json

@@ -13,7 +13,7 @@
         "@ours.network/codex": "1.2.0-nightly.10",
         "@ours.network/cowork": "1.3.3-nightly.20261001.6d49d3a",
         "@ours.network/daemon": "3.8.1-nightly.7",
-        "@ours.network/fleet": "1.2.0-nightly.31",
+        "@ours.network/fleet": "1.2.0-nightly.32",
         "@ours.network/mcp": "1.2.0-nightly.10",
         "@ours.network/messenger-server": "1.0.31-nightly.13",
         "@ours.network/sdk": "3.8.1-nightly.15",
@@ -1085,9 +1085,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.31",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.31.tgz",
-      "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA==",
+      "version": "1.2.0-nightly.32",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.32.tgz",
+      "integrity": "sha512-FZRE+G25dc2qgDYbM3Dx76lw1Sws5OTF5KHPaMGTL5oun2SgYcNMhVKvwULZWSOlyrpggdMc3IFmp4eZSZTahg==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.23",
+  "installerVersion": "1.2.1-nightly.25",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.15",
@@ -24,8 +24,8 @@
       "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.31",
-      "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA=="
+      "version": "1.2.0-nightly.32",
+      "integrity": "sha512-FZRE+G25dc2qgDYbM3Dx76lw1Sws5OTF5KHPaMGTL5oun2SgYcNMhVKvwULZWSOlyrpggdMc3IFmp4eZSZTahg=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.10",

package/assets/scripts/runtime/client-setup.mjs

@@ -1,4 +1,5 @@
 import { readBuildRecords, initializeBuildMarker } from '../maintenance/build-context.mjs';
+import { redactDiagnostic } from './diagnostics.mjs';
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import {
@@ -12,6 +13,7 @@ const DELIVERY_FILES = [
   '/credentials/messenger/daemon-token',
 ];
 const fail = (message) => { throw new Error(message); };
+let diagnosticStage = 'validation';
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 function privatePath(path, directory, exact = directory ? 0o700 : 0o600) {
@@ -128,10 +130,13 @@ function prepare() {
 
 function finishDaemonSetup() {
   const state = '/var/lib/ours';
+  diagnosticStage = 'daemon-provenance';
   initializeBuildMarker(`${state}/.ours-provenance`, readBuildRecords('/opt/ours'));
+  diagnosticStage = 'mcp-directory';
   privatePath('/var/lib/ours-mcp', true);
   const mcpProfile = { endpoint: 'http://127.0.0.1:3050', expectedInstanceId: process.env.OURS_DAEMON_ID, credentialPath: `${state}/daemon-token` };
   const mcpPath = '/var/lib/ours-mcp/profile.json';
+  diagnosticStage = 'mcp-profile';
   if (!existingPrivate(mcpPath, false)) atomicJson(mcpPath, mcpProfile);
   else if (JSON.stringify(jsonObject(mcpPath)) !== JSON.stringify(mcpProfile)) fail('Existing MCP profile differs from the selected daemon');
 }
@@ -155,10 +160,19 @@ async function telegramInput() {
 }
 
 function cliJson(args) {
+  diagnosticStage = 'official-cli';
   const result = spawnSync(process.execPath, [existsSync('/opt/ours/node_modules/@ours.network/daemon/dist/cli.js') ? '/opt/ours/node_modules/@ours.network/daemon/dist/cli.js' : '/opt/ours/node_modules/@ours.network/cli/dist/cli.js', ...args], {
     encoding: 'utf8', timeout: 60_000, maxBuffer: 1024 * 1024,
   });
-  if (result.status !== 0) fail('Official OURS CLI operation failed');
+  if (result.error || result.status !== 0) {
+    // --json writes failures on stderr. Successful credential stdout is never
+    // forwarded, even if a later operation exits unsuccessfully.
+    let reason = 'CLI supplied no structured error reason';
+    for (const line of String(result.stderr ?? '').split('\n').reverse()) {
+      try { const value = JSON.parse(line); if (typeof value?.error?.message === 'string') { reason = value.error.message; break; } } catch {}
+    }
+    fail(`Official OURS CLI operation failed (${args[1]}; exit=${result.status ?? 'none'}; signal=${result.signal ?? 'none'}; system=${result.error?.code ?? 'none'}): ${reason}`);
+  }
   try { return JSON.parse(result.stdout); }
   catch { fail('Official OURS CLI returned malformed JSON'); }
 }
@@ -192,6 +206,10 @@ try {
   else if (['access-init', 'access-issue', 'access-replace'].includes(operation)) access(operation, process.argv[3]);
   else fail('usage: client-setup.mjs prepare | telegram-input | access-init | access-issue [OUTPUT] | access-replace');
 } catch (error) {
-  console.error(`OURS client setup refused: ${error.message}`);
+  // Structured stderr retains the failing stage across sensitive Compose
+  // capture. The installer redacts secrets before exposing this envelope.
+  const message = redactDiagnostic(error.message);
+  console.error(JSON.stringify({ oursInstallerError: { stage: diagnosticStage, message } }));
+  console.error(`OURS client setup refused: ${message}`);
   process.exit(1);
 }

package/assets/scripts/runtime/diagnostics.mjs

@@ -0,0 +1,72 @@
+/** Retain actionable failure details without emitting credential output. */
+export function redactDiagnostic(value, env = process.env) {
+  let text = String(value ?? '').replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, '').replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
+  for (const [key, secret] of Object.entries(env)) {
+    if (/(?:token|password|secret|api.?key|private.?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)/i.test(key) && typeof secret === 'string' && secret)
+      text = text.split(secret).join('[redacted]');
+  }
+  return text
+    .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, '[redacted private key]')
+    .replace(/(Bearer\s+)[^\s"',;]+/gi, '$1[redacted]')
+    .replace(/((?:["']?(?:api[-_]?token|token|password|secret|api[-_]?key|private[-_]?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)["']?)\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;}]+)/gi, '$1[redacted]')
+    .replace(/(--(?:setup-workspace|password|token|secret|api-key|private-key|invitation|enrollment)(?:=|\s+))\S+/gi, '$1[redacted]')
+    .replace(/(https?:\/\/)[^\s/@:]+:[^\s/@]+@/g, '$1[redacted]@')
+    .replace(/\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, '[redacted credential]')
+    .replace(/[A-Za-z0-9_+/=-]{43,}/g, '[redacted opaque value]');
+}
+
+const bounded = text => text.length <= 65536 ? text : text.slice(0, 65536) + '\n[Diagnostic output exceeds 64 KiB; remainder omitted.]';
+function credentialFailure(stderr) {
+  // Credential stdout can be a successful issuance followed by failure: never
+  // include it. Only a structured error envelope or shipped helper refusal is
+  // accepted from stderr; arbitrary lines/warnings remain private.
+  const lines = String(stderr ?? '').split('\n').reverse();
+  for (const line of lines) {
+    try {
+      const value = JSON.parse(line);
+      if (typeof value?.oursInstallerError?.message === 'string') {
+        const detail = value.oursInstallerError;
+        const stage = /^[a-z][a-z-]{0,40}$/.test(detail.stage ?? '') ? detail.stage : 'credential-operation';
+        return `Stage: ${stage}\nReason: ${detail.message}`;
+      }
+      if (typeof value?.error?.message === 'string') return `Reason: ${value.error.message}`;
+    } catch {}
+  }
+  const prefix = 'OURS client setup refused: ';
+  const legacy = lines.find(line => line.startsWith(prefix));
+  if (legacy) return `Reason: ${legacy.slice(prefix.length)}`;
+  return 'The credential operation provided no structured reason. Its raw output was withheld because it can contain credentials.';
+}
+
+export function commandFailure(command, args, result, { sensitive = false, cwd, env = process.env } = {}) {
+  const visibleArgs = [...args];
+  if (sensitive) {
+    for (let i = 0; i < visibleArgs.length - 1; i++) if (['-e', '--eval'].includes(visibleArgs[i])) visibleArgs[i + 1] = '[captured installer helper]';
+  }
+  const details = [`Command: ${command} ${visibleArgs.join(' ')}${result.status != null ? ` exited ${result.status}` : ''}`];
+  if (cwd) details.push(`Working directory: ${cwd}`);
+  if (result.status !== null && result.status !== undefined) details.push(`Exit code: ${result.status}`);
+  if (result.signal) details.push(`Signal: ${result.signal}`);
+  if (result.error?.code) details.push(`System error: ${result.error.code}`);
+  if (result.error?.code === 'ETIMEDOUT') details.push('Reason: command timed out.');
+  if (sensitive) details.push(credentialFailure(result.stderr));
+  else {
+    const stderr = String(result.stderr ?? '').trim(), stdout = String(result.stdout ?? '').trim();
+    if (stderr) details.push(`Standard error:\n${stderr}`);
+    if (stdout) details.push(`Standard output:\n${stdout}`);
+    if (!stderr && !stdout) details.push('No captured command output. Streaming commands print their output above.');
+  }
+  details.push('Keep installation data intact. Include this error and the preceding installation stage when requesting help.');
+  return new Error(bounded(redactDiagnostic(details.join('\n'), env)), result.error ? { cause: result.error } : undefined);
+}
+
+export function installerFailure(error, env = process.env) {
+  const details = []; const seen = new Set();
+  for (let cause = error; cause && !seen.has(cause) && seen.size < 8; cause = cause.cause) {
+    seen.add(cause);
+    const message = cause instanceof Error ? cause.message : String(cause);
+    if (!details.includes(message)) details.push(message);
+    if (typeof cause.code === 'string' && /^[A-Z_0-9]+$/.test(cause.code)) details.push(`System error: ${cause.code}`);
+  }
+  return bounded(redactDiagnostic(details.join('\nCaused by: '), env));
+}

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.23",
+    "installerVersion": "1.2.1-nightly.25",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.15",
@@ -25,8 +25,8 @@
         "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.31",
-        "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA=="
+        "version": "1.2.0-nightly.32",
+        "integrity": "sha512-FZRE+G25dc2qgDYbM3Dx76lw1Sws5OTF5KHPaMGTL5oun2SgYcNMhVKvwULZWSOlyrpggdMc3IFmp4eZSZTahg=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.10",
@@ -79,7 +79,7 @@
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.31"
+      "version": "1.2.0-nightly.32"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/install.mjs

@@ -3,6 +3,7 @@
 import { readFileSync } from 'node:fs';
 
 import { realEffects } from './lib/effects.mjs';
+import { installerFailure } from './lib/diagnostics.mjs';
 import { runWorkspaceSetup } from './lib/workspace-setup.mjs';
 import { runSetup } from './lib/setup.mjs';
 import { closeSync, makeWriter, openTty } from './lib/ui.mjs';
@@ -22,7 +23,7 @@ try {
   }));
   process.exitCode = code;
 } catch (error) {
-  process.stderr.write(`ours-install: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.stderr.write(`ours-install: ${installerFailure(error)}\n`);
   process.exitCode = 1;
 } finally {
   if (ttyFd != null) {

package/lib/diagnostics.mjs

@@ -0,0 +1 @@
+export { redactDiagnostic, commandFailure, installerFailure } from '../assets/scripts/runtime/diagnostics.mjs';

package/lib/docker-runtime-repair.mjs

@@ -1,4 +1,4 @@
-import { runContainer } from './container-engine.mjs';
+import { engineName, runContainer } from './container-engine.mjs';
 /** Qualify cached images before reuse; repair only the known root-owned 0600 policy. */
 import { existsSync, readdirSync, lstatSync, readFileSync, writeFileSync, mkdtempSync, rmSync, realpathSync, openSync, closeSync, fstatSync, fchmodSync, constants } from 'node:fs';
 import { join } from 'node:path';
@@ -112,16 +112,24 @@ export async function qualifyDockerRuntime(record, effects) {
     }
   };
   const policy = readFileSync(record.sourcesPath), expectedHash = digest(policy);
-  const check = (report, mode) => {
-    if (!report || report.mode !== mode || report.uid !== 0 || report.gid !== 0 || !report.regular || report.links !== 1 || report.policyHash !== expectedHash) fail('image policy differs from retained selection or expected permissions');
+  const check = (report, mode, stage) => {
+    const expected = { mode, uid: 0, gid: 0, regular: true, links: 1, policyHash: expectedHash };
+    const mismatched = Object.keys(expected).filter(key => report?.[key] !== expected[key]);
+    if (mismatched.length) {
+      // Only fixed field names, a bounded numeric mode and a comparison boolean
+      // enter diagnostics. Never disclose policy content, hashes or probe output.
+      const observedMode = Number.isInteger(report?.mode) && report.mode >= 0 && report.mode <= 0o7777
+        ? report.mode.toString(8).padStart(4, '0') : 'invalid';
+      fail(`image policy verification failed (stage=${stage}; engine=${engineName(record)}; mismatched=${mismatched.join(',')}; mode=${observedMode}; expectedMode=${mode.toString(8).padStart(4, '0')}; policyMatch=${report?.policyHash === expectedHash})`);
+    }
   };
   const original = await inspect(tag);
   const ordinary = await probe(original.Id, `${uid}:${gid}`);
-  if (ordinary.code === 0) { check(ordinary.report, 0o644); return; }
+  if (ordinary.code === 0) { check(ordinary.report, 0o644, 'ordinary'); return; }
   if (ordinary.code !== 74) fail('cached image is unusable; automatic repair only supports the known source-policy permission defect');
   const privileged = await probe(original.Id, '0:0');
   if (privileged.code !== 0) fail('original release graph could not be verified');
-  check(privileged.report, 0o600);
+  check(privileged.report, 0o600, 'privileged');
   effects.out?.('Repairing cached Docker image permissions; keeping the selected packages and stored data.');
   const directory = mkdtempSync(join(record.root, '.image-permissions-'));
   const name = `ours-permission-repair-${randomUUID()}`, baseTag = `${name}:base`, candidateTag = `${name}:candidate`;
@@ -138,7 +146,7 @@ export async function qualifyDockerRuntime(record, effects) {
         || candidate.RootFS.Layers.length !== original.RootFS.Layers.length + 1) fail('repair changed image execution settings or ancestry');
     const verified = await probe(candidate.Id, `${uid}:${gid}`);
     if (verified.code !== 0) fail('repaired image did not pass runtime verification');
-    check(verified.report, 0o644);
+    check(verified.report, 0o644, 'repaired');
     if (!isDeepStrictEqual(verified.report.records, privileged.report.records)) fail('repair changed build provenance');
     if ((await inspect(tag)).Id !== original.Id) fail('selected image changed during repair; retry setup');
     await runContainer(effects, record, ['image', 'tag', candidate.Id, tag]);

package/lib/effects.mjs

@@ -15,6 +15,7 @@ import { engineName, bindPodman, runContainer, nativeBuildCommands } from './con
 // unit file or the service manager directly.
 
 import { publishClientCli } from './client-cli.mjs';
+import { commandFailure } from './diagnostics.mjs';
 import { spawnSync, execFileSync } from 'node:child_process';
 import { chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, userInfo, platform as osPlatform, release as osRelease, arch as osArch } from 'node:os';
@@ -422,13 +423,12 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
         env: childEnv,
       });
       if (r.error) {
-        const error = new Error(`${executable} could not start (${r.error.code ?? 'launch error'})`, { cause: r.error });
+        const error = commandFailure(executable, args, r, { sensitive, cwd, env: childEnv });
         error.code = r.error.code;
         throw error;
       }
       if (r.status !== 0 && !allowCodes.includes(r.status)) {
-        const detail = sensitive ? '' : (r.stderr || r.stdout || '').trim().split('\n').slice(-3).join('; ');
-        throw new Error(`${executable} ${args.join(' ')} exited ${r.status}${detail ? `: ${detail}` : ''}`);
+        throw commandFailure(executable, args, r, { sensitive, cwd, env: childEnv });
       }
       return { ok: true, code: r.status, stdout: r.stdout ?? '' };
     },
@@ -442,7 +442,8 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
       delete childEnv.OURS_INSTALLER_LOCK_FD;
       if (installationLockFd !== null) childEnv.OURS_INSTALLER_LOCK_FD = '3';
       const r = spawnSync(cmd, args, { stdio: ['inherit', 'inherit', 'inherit', ...(installationLockFd === null ? [] : [installationLockFd])], env: childEnv });
-      return { ok: !r.error && r.status === 0, code: r.status ?? -1 };
+      if (r.error || r.status !== 0) throw commandFailure(cmd, args, r, { env: childEnv });
+      return { ok: true, code: r.status };
     },
     installedVersion: (pkg) => installedVersionOf(pkg, npmBin),
     packageDependencies: (spec) => packageDependenciesOf(spec, npmBin),
@@ -1040,7 +1041,15 @@ export function networkEffects(effects) {
     },
     async serverAccess(record, operation, { output, migrate = false } = {}) {
       if (record.mode === 'docker') {
-        if (!output) return compose(record, ['run', '--rm', '--no-deps', '-T', 'access', operation], { sensitive: true, env: { OURS_ACCESS_MIGRATE: migrate ? '1' : '0' } });
+        // Retained images contain the old helper that discarded CLI errors.
+        // Execute the shipped installer helper against the SAME selected image
+        // and Compose volume/user/environment contract, without retag/rebuild.
+        const diagnosticsUrl = `data:text/javascript;base64,${readFileSync(join(INSTALLER_ASSETS, 'scripts/runtime/diagnostics.mjs')).toString('base64')}`;
+        const helper = `process.argv.splice(1, 0, '/opt/ours/docker/client-setup.mjs');\n` + readFileSync(join(INSTALLER_ASSETS, 'scripts/runtime/client-setup.mjs'), 'utf8')
+          .replace("'../maintenance/build-context.mjs'", "'/opt/ours/maintenance/build-context.mjs'")
+          .replace("'./diagnostics.mjs'", JSON.stringify(diagnosticsUrl));
+        const accessArgs = (...args) => ['--entrypoint', 'node', 'access', '--input-type=module', '-e', helper, '--', ...args];
+        if (!output) return compose(record, ['run', '--rm', '--no-deps', '-T', ...accessArgs(operation)], { sensitive: true, env: { OURS_ACCESS_MIGRATE: migrate ? '1' : '0' } });
         privateDirectory(dirname(output));
         if (existsSync(output)) throw new Error('Credential output already exists');
         const name = `${record.project}-issue-${randomUUID()}`;
@@ -1048,7 +1057,7 @@ export function networkEffects(effects) {
         const staging = join(dirname(output), `.ours-issued-${randomUUID()}`);
         ensurePrivateDirectory(staging);
         try {
-          await compose(record, ['run', '--name', name, '--no-deps', '-T', 'access', 'access-issue', issuedPath], { sensitive: true });
+          await compose(record, ['run', '--name', name, '--no-deps', '-T', ...accessArgs('access-issue', issuedPath)], { sensitive: true });
           const file = join(staging, 'credential');
           await container(record, ['cp', `${name}:${issuedPath}`, file], { sensitive: true });
           assertPrivateRegularFile(file, 'issued credential');
@@ -1288,7 +1297,7 @@ export function networkEffects(effects) {
       if (discovery.ok) return validateGatewayDiscovery(base, await discovery.json(), resolve(credentialPath));
       throw new Error(`Gateway discovery answered HTTP ${discovery.status}; enable the gateway. Direct daemon fallback is not supported.`);
     },
-    importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, refresh = false }) {
+    importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, disableFleetAgentsSetup = false, refresh = false }) {
       profile = validateGatewayClientProfile(profile);
       const root = join(home, '.ours-client');
       const configPath = join(root, 'profile.json');
@@ -1314,7 +1323,7 @@ export function networkEffects(effects) {
           atomicWriteConfig(configPath, JSON.stringify(saved, null, 2) + '\n');
         return { configPath, profile: validateGatewayClientProfile(saved), settings: current.installer };
       }
-      const settings = { sourcesPath: join(root, 'sources.json'), integrations };
+      const settings = { sourcesPath: join(root, 'sources.json'), integrations, ...(disableFleetAgentsSetup ? { disableFleetAgentsSetup: true } : {}) };
       if (fleetSettings) settings.fleetSettingsPath = join(root, 'fleet-settings.json');
       // Publish the profile last: clients cannot select incomplete imported inputs.
       atomicWriteConfig(settings.sourcesPath, sources);

package/lib/orchestrate.mjs

@@ -45,6 +45,7 @@ import {
   validateChannelVersion,
 } from './marketplace.mjs';
 import { USAGE } from './usage.mjs';
+import { installerFailure } from './diagnostics.mjs';
 import { ok, info, warn, heading, banner, box, c, progress } from './ui.mjs';
 
 export const EXIT_OK = 0;
@@ -89,21 +90,17 @@ async function perform(effects, dryRun, label, thunk) {
 const reason = (error) => (error instanceof Error ? error.message : String(error));
 
 function clientDiagnostic(error) {
-  return reason(error)
-    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '')
-    .replace(/\bBearer\s+[^\s,;]+/gi, 'Bearer [redacted]')
-    .replace(/((?:api[_-]?key|api[_-]?token|access[_-]?token|refresh[_-]?token|token|password|secret|authorization|credential)\s*["']?\s*[:=]\s*["']?)[^\s"',;]+/gi, '$1[redacted]')
-    .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gi, '$1[redacted]@')
-    .replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 700);
+  return installerFailure(error);
 }
 
 function clientRetry(effects, imported, integrations) {
   effects.out(info(`Saved server connection: ${imported.configPath}.`));
-  if (integrations.includes('fleet') && !imported.settings.fleetSettingsPath) {
+  if (integrations.includes('fleet') && !imported.settings.disableFleetAgentsSetup && !imported.settings.fleetSettingsPath) {
     effects.out(info('Saved profile and settings retained. Run ours-install, choose Connect to an existing server, and reuse the saved profile to finish the interactive Fleet configuration.'));
     return;
   }
   const args = ['client', 'install', '--config', imported.configPath, '--integrations', integrations.join(',') || 'none', '--sources', imported.settings.sourcesPath];
+  if (imported.settings.disableFleetAgentsSetup) args.push('--disable-fleet-agents-setup');
   if (imported.settings.fleetSettingsPath) args.push('--fleet-settings', imported.settings.fleetSettingsPath);
   const command = `ours-install client install ${args.slice(2).map((value, i) => i % 2 === 0 ? value : shellQuote(value)).join(' ')}`;
   effects.out(info(`Saved profile and settings retained; re-run ${command}`));
@@ -1011,6 +1008,11 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
     return { key: 'fleet', label: plan.label, state: 'skipped' };
   }
   const install = args.acquiredFleet ? { ok: true } : await attempt(effects, args.dryRun, plan.install.join(' '), () => effects.run(plan.install[0], plan.install.slice(1)));
+  if (args.disableFleetAgentsSetup) {
+    if (!install.ok) return { key: 'fleet', label: plan.label, state: 'failed', note: 'Fleet installation failed' };
+    effects.out(ok('Fleet CLI installed; agent and model setup deferred to the App. Existing Fleet configuration was retained.'));
+    return { key: 'fleet', label: plan.label, state: 'installed', note: 'agents setup deferred' };
+  }
   // Fleet owns its v2 manifest, roles, models and permissions. With no prepared
   // settings, its wizard keeps the user's terminal while this invocation carries
   // the selected daemon; --settings makes the same call strictly noninteractive.
@@ -1474,7 +1476,8 @@ export async function runClientCommand(command, effects) {
   }
   if (!Array.isArray(integrations) || integrations.some(name => !['codex', 'claude-code', 'fleet'].includes(name)) || new Set(integrations).size !== integrations.length) throw new InstallUsageError('installer.integrations must be an array of codex, claude-code and/or fleet; use an empty array for CLI only');
   let fleetSettingsPath = command.preset ? command.fleetSettingsPath : settings?.fleetSettingsPath;
-  if (command.nonInteractive && integrations.includes('fleet') && !fleetSettingsPath) throw new InstallUsageError('Fleet in CLI mode requires --fleet-settings; no interactive wizard will be opened');
+  const disableFleetAgentsSetup = command.disableFleetAgentsSetup ?? settings?.disableFleetAgentsSetup ?? false;
+  if (command.nonInteractive && !disableFleetAgentsSetup && integrations.includes('fleet') && !fleetSettingsPath) throw new InstallUsageError('Fleet in CLI mode requires --fleet-settings; no interactive wizard will be opened');
   if (fleetSettingsPath !== undefined && (typeof fleetSettingsPath !== 'string' || !fleetSettingsPath))
     throw new InstallUsageError('installer.fleetSettingsPath must be a non-empty path when supplied');
   if (fleetSettingsPath) fleetSettingsPath = resolve(settingsBase, fleetSettingsPath);
@@ -1492,7 +1495,7 @@ export async function runClientCommand(command, effects) {
   }
   effects.out(progress(0, 4, 'Client configuration', 'Prepare the selected integrations and private connection profile.'));
   if (profile.serverUrl && integrations.includes('fleet')) await effects.qualifyGatewayClient({ profile, sourcesPath, sources: resolvedSources, integrations, refresh: !!command.preset });
-  const imported = effects.importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, refresh: !!command.preset });
+  const imported = effects.importClientProfile({ profile, sourcesPath, sources: resolvedSources, integrations, fleetSettingsPath, disableFleetAgentsSetup, refresh: !!command.preset });
   let phase = 'Validate saved server connection';
   try {
     await effects.verifyHostProfile(imported.configPath);
@@ -1500,7 +1503,7 @@ export async function runClientCommand(command, effects) {
     phase = 'Acquire client packages';
     const exactSuite = await effects.acquireClientPackages(imported.configPath, imported.settings.sourcesPath, integrations, { refresh: !!command.preset });
     const args = { assumeYes: true, dryRun: false, channel: 'latest', clientIntegrations: integrations,
-      acquiredFleet: exactSuite.fleetBin, fleetSettingsPath: imported.settings.fleetSettingsPath };
+      acquiredFleet: exactSuite.fleetBin, fleetSettingsPath: imported.settings.fleetSettingsPath, disableFleetAgentsSetup: imported.settings.disableFleetAgentsSetup };
     const target = { mode: 'host-profile', managed: true, configPath: imported.configPath, profile: imported.profile, endpoint: imported.profile.endpoint };
     effects.out(progress(2, 4, 'Client integrations', 'Register the selected agent integrations.'));
     phase = 'Register client integrations';

package/lib/server-onboarding.mjs

@@ -115,6 +115,36 @@ try {
       effects.out?.(`Human identity ${after.root.name} is ready.`);
       return { name: after.root.name, cid: after.root.cid, created: true };
     },
+    async serverEnsureHumanProfile(record, human) {
+      validateRecord(record);
+      for (const key of ['name', 'surname']) if (typeof human[key] !== 'string' || !human[key].trim() || human[key].length > 100 || /[\x00-\x1f\x7f]/.test(human[key])) throw new Error('Invalid Messenger human profile');
+      // Messenger owns the profile lifecycle. Never rename the daemon root or
+      // overwrite a profile already present on a retained installation.
+      const script = `
+import { readFileSync } from 'node:fs';
+const selection = JSON.parse(process.argv[1]);
+const token = readFileSync(selection.credentialPath, 'utf8').trim();
+const base = selection.base;
+async function request(path, value) {
+ const response = await fetch(base + '/api/' + path, { method: value === undefined ? 'GET' : 'POST', redirect: 'error', signal: AbortSignal.timeout(15000), headers: { 'X-Ours-Api-Token': token, ...(value === undefined ? {} : { 'Content-Type': 'application/json', Origin: selection.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }) });
+ if (!response.ok) { await response.body?.cancel(); throw new Error('Messenger human profile operation failed (HTTP ' + response.status + ')'); }
+ return response.json();
+}
+const identity = await request('identity');
+if (identity.humanProfile) process.stdout.write('Retained Messenger Name and Surname.');
+else { await request('identity/profile', selection.human); process.stdout.write('Messenger Name and Surname initialized.'); }
+`;
+      const docker = record.mode === 'docker';
+      const selection = { base: `http://127.0.0.1:${docker ? 8420 : record.messengerPort}`,
+        origin: `http://127.0.0.1:${record.messengerPort}`,
+        credentialPath: docker ? '/credentials/messenger/daemon-token' : installationPaths(record).credentials.messenger,
+        human: { name: human.name, surname: human.surname } };
+      const args = ['--input-type=module', '-e', script, JSON.stringify(selection)];
+      const result = docker ? await compose(record, ['exec', '-T', 'messenger', 'node', ...args])
+        : await effects.run(process.execPath, args, { env: localEnv(record), sensitive: true });
+      if (result.code !== undefined && result.code !== 0) throw new Error('Messenger human profile initialization failed');
+      effects.out?.(result.stdout);
+    },
     async prepareLocalClient(record, integrations, fleetSettingsPath) {
       validateRecord(record);
       if (!Array.isArray(integrations) || new Set(integrations).size !== integrations.length
@@ -139,7 +169,7 @@ try {
         if (!current) {
           effects.out?.('Issuing a separate local client credential with the retained server authority.');
           try { await effects.serverAccess(record, 'access-issue', { output: credential }); }
-          catch { throw new Error('Client credential issuance failed; existing profiles were retained'); }
+          catch (cause) { throw new Error('Client credential issuance failed; existing profiles were retained', { cause }); }
         }
         const retainedCredential = current?.credentialPath ?? credential;
         const stat = privatePath(retainedCredential);

package/lib/setup-options.mjs

@@ -1,3 +1,4 @@
+import { hostname } from 'node:os';
 import { serverBase } from './gateway.mjs';
 import { join, resolve, isAbsolute, dirname } from 'node:path';
 
@@ -5,10 +6,11 @@ const scopes = ['all', 'server', 'client'];
 const integrations = ['codex', 'claude-code', 'fleet'];
 const valueFlags = new Map(Object.entries({
   '--container-engine': 'containerEngine', '--server-url': 'serverUrl', '--scope': 'scope', '--action': 'operation', '--mode': 'mode', '--state-dir': 'stateDir',
+  '--username': 'localUsername', '--name': 'name', '--surname': 'surname', '--hostname': 'hostname',
   '--identity-name': 'identityName', '--integrations': 'integrations', '--fleet-settings': 'fleetSettingsPath',
   '--config': 'config', '--sources': 'sources', '--migrate-from': 'migrateFrom', '--port': 'port', '--cowork-port': 'coworkPort', '--messenger-port': 'messengerPort',
 }));
-const boolFlags = new Map([['--compatible', 'compatible'], ['--dry-run', 'dryRun'], ['--migrate', 'migrate']]);
+const boolFlags = new Map([['--compatible', 'compatible'], ['--dry-run', 'dryRun'], ['--migrate', 'migrate'], ['--disable-fleet-agents-setup', 'disableFleetAgentsSetup']]);
 const allowed = new Set([...valueFlags.values(), ...boolFlags.values(), 'interactive', 'explicitPorts']);
 const defaults = { port: 3050, coworkPort: 3052, messengerPort: 8420 };
 const paths = ['stateDir', 'config', 'sources', 'fleetSettingsPath', 'migrateFrom'];
@@ -32,12 +34,28 @@ export function validateSetupOptions(input, { interactive = input?.interactive =
   const client = options.scope !== 'server';
   if (options.migrateFrom !== undefined && (!server || options.operation !== 'install')) throw new Error('--migrate-from requires server or all scope and operation install');
   if (options.migrateFrom !== undefined && (!nonempty(options.migrateFrom) || !isAbsolute(options.migrateFrom))) throw new Error('--migrate-from requires an absolute daemon config path');
+  const suppliedHuman = ['localUsername', 'name', 'surname'].some(key => options[key] !== undefined);
+  if (suppliedHuman) {
+    for (const key of ['localUsername', 'name', 'surname']) if (!nonempty(options[key])) throw new Error(`Missing human profile option: ${key}`);
+    if (!/^[a-z0-9][a-z0-9-]{0,29}$/.test(options.localUsername)) throw new Error('Local username must contain 1–30 lowercase letters, digits or hyphens');
+    for (const key of ['name', 'surname']) {
+      if (options[key].trim().length > 100) throw new Error(`${key} must contain at most 100 characters`);
+      options[key] = options[key].trim();
+    }
+    options.hostname = options.hostname?.trim() || defaultHostname();
+    if (!/^[a-z0-9][a-z0-9-]{0,29}$/.test(options.hostname)) throw new Error('Hostname must contain 1–30 lowercase letters, digits or hyphens');
+    const identity = `${options.localUsername}@${options.hostname}`;
+    if (options.migrateFrom === undefined && options.identityName !== undefined && options.identityName !== identity) throw new Error('--identity-name conflicts with username and hostname');
+    if (options.migrateFrom === undefined) options.identityName = identity;
+  } else if (options.hostname !== undefined) throw new Error('--hostname requires username, name and surname');
+  if (options.disableFleetAgentsSetup !== undefined && typeof options.disableFleetAgentsSetup !== 'boolean') throw new Error('disableFleetAgentsSetup must be a boolean');
+  if (options.disableFleetAgentsSetup && options.fleetSettingsPath) throw new Error('--disable-fleet-agents-setup conflicts with --fleet-settings');
   const missing = [];
   if (server) for (const [key, flag] of [['mode', '--mode'], ['stateDir', '--state-dir'], ...(options.migrateFrom === undefined ? [['identityName', '--identity-name']] : [])]) if (!nonempty(options[key])) missing.push(flag);
   if (client && options.integrations === undefined) missing.push('--integrations (use none to skip)');
   if (!server && !nonempty(options.config)) missing.push('--config');
   if (server && (options.operation === 'update' || options.migrateFrom !== undefined) && options.compatible !== true) missing.push('--compatible');
-  if (Array.isArray(options.integrations) && options.integrations.includes('fleet') && !interactive && !nonempty(options.fleetSettingsPath)) missing.push('--fleet-settings');
+  if (Array.isArray(options.integrations) && options.integrations.includes('fleet') && !interactive && !options.disableFleetAgentsSetup && !nonempty(options.fleetSettingsPath)) missing.push('--fleet-settings');
   if (missing.length) throw new Error(`Missing required setup options: ${missing.join(', ')}`);
   if (options.mode === 'native') options.mode = 'packages';
   if (server && !['packages', 'docker'].includes(options.mode)) throw new Error('Mode must be packages (or native) or docker');
@@ -47,7 +65,7 @@ export function validateSetupOptions(input, { interactive = input?.interactive =
     options.serverUrl = serverBase(options.serverUrl);
   }
   if (server && options.config !== undefined) throw new Error('--config is only valid for client scope');
-  if (!server) for (const key of ['mode', 'stateDir', 'identityName', ...Object.keys(defaults), 'compatible', 'migrate']) {
+  if (!server) for (const key of ['mode', 'stateDir', 'identityName', 'localUsername', 'name', 'surname', 'hostname', ...Object.keys(defaults), 'compatible', 'migrate']) {
     if (options[key] !== undefined) throw new Error(`${key} is only valid for server or all scope`);
   }
   if (!client && (options.integrations !== undefined || options.fleetSettingsPath !== undefined)) throw new Error('--integrations and --fleet-settings require all or client scope');
@@ -124,27 +142,31 @@ export function parseSetupArgs(argv, { home, validate = true } = {}) {
   return validate ? validateSetupOptions(expandPaths(options, home), { interactive: false }) : expandPaths(options, home);
 }
 
-export async function collectSetupOptions(effects) {
+export function defaultHostname() {
+  return hostname().toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/^[^a-z0-9]+/, '').slice(0, 30) || 'workspace';
+}
+
+export async function collectSetupOptions(effects, presets = {}) {
   if (effects.interactive !== true) throw new Error('Interactive setup requires a TTY; provide the complete CLI options instead');
-  const options = { interactive: true, explicitPorts: [] };
+  const options = { ...presets, interactive: true, explicitPorts: presets.explicitPorts ?? [] };
   const scopeChoices = [
     { value: 'all', label: 'Everything on this computer' },
     { value: 'server', label: 'Server only' },
     { value: 'client', label: 'Connect this computer to an existing server' },
   ];
   effects.out('Choose what this computer should do. Everything runs the server here and connects your selected apps; client-only uses a server you already have.');
-  options.scope = await effects.select('What would you like to set up?', scopeChoices, 'all');
+  options.scope ??= await effects.select('What would you like to set up?', scopeChoices, 'all');
   if (!scopes.includes(options.scope)) throw new Error('Scope must be all, server, or client');
   let existing;
   let pendingMigration;
   if (options.scope !== 'client') {
     const recommendedRoot = join(effects.home, '.ours-install');
     effects.out(`Stores the server programs and data, including identities and messages. The recommended folder is ${recommendedRoot}; choose another only if you want to manage its location yourself.`);
-    const location = await effects.select('Where should server programs and data be stored?', [
+    const location = options.stateDir ? 'preset' : await effects.select('Where should server programs and data be stored?', [
       { value: 'recommended', label: `Use the recommended folder (${recommendedRoot})` },
       { value: 'custom', label: 'Choose another folder' },
     ], 'recommended');
-    options.stateDir = location === 'recommended' ? recommendedRoot : await effects.askLine('Folder for server programs and data: ', recommendedRoot);
+    options.stateDir ??= location === 'recommended' ? recommendedRoot : await effects.askLine('Folder for server programs and data: ', recommendedRoot);
     options.stateDir = expandPaths({ stateDir: options.stateDir }, effects.home).stateDir;
     existing = effects.readJson(join(options.stateDir, 'installation.json'));
     const migrationJournal = existing?.legacyMigrationSource ? effects.readJson(join(options.stateDir, 'legacy-migration.json')) : null;
@@ -156,7 +178,7 @@ export async function collectSetupOptions(effects) {
     ? 'This folder already contains an installation. Update selects this installer’s release while retaining state; repair reinstalls the retained package selection.'
     : options.scope === 'client' ? 'Install connects your selected apps. Update refreshes their packages while keeping the server connection.'
       : 'Install creates a managed installation in the selected folder. Update requires an installation already recorded there.');
-  options.operation = !existing && options.scope !== 'client' ? 'install' : await effects.select('What should happen?', [
+  options.operation ??= !existing && options.scope !== 'client' ? 'install' : await effects.select('What should happen?', [
     { value: 'install', label: pendingMigration ? 'Resume the unfinished migration' : existing ? 'Repair this installation' : 'Install and configure' },
     { value: 'update', label: 'Update an existing installation' },
   ], existing && !pendingMigration ? 'update' : 'install');
@@ -166,7 +188,8 @@ export async function collectSetupOptions(effects) {
     const legacyState = nonempty(legacy?.stateDir) ? legacy.stateDir
       : legacy && legacy.stateDir === undefined && nonempty(effects.readJson(join(effects.home, '.ours', 'root.json'))?.name)
         ? join(effects.home, '.ours') : null;
-    if (pendingMigration) options.migrateFrom = pendingMigration;
+    if (options.migrateFrom) { /* Explicit selection is validated below. */ }
+    else if (pendingMigration) options.migrateFrom = pendingMigration;
     else if (legacyState) {
       effects.out(`Found an existing ours installation at ${legacyState}. Upgrade it to keep its identities, messages and settings. The old server will stop; its original state is kept as a recovery copy.`);
       if (await effects.ask('Upgrade this existing ours installation and keep its data?', true)) options.migrateFrom = defaultConfig;
@@ -190,41 +213,61 @@ export async function collectSetupOptions(effects) {
       if (!nonempty(root?.name)) throw new Error('Cannot read the existing Human identity name; choose the configuration file for a complete existing installation');
       options.identityName = root.name;
       effects.out(`Your existing Human identity, ${root.name}, will be retained; no replacement identity will be created. Migration keeps the original state, but compatibility with an older release cannot be guaranteed automatically.`);
-      options.compatible = await effects.ask('Proceed with this release and keep the original state as a recovery copy?', false);
+      options.compatible ??= await effects.ask('Proceed with this release and keep the original state as a recovery copy?', false);
       if (!options.compatible) throw new Error('Migration requires explicit compatibility confirmation (--compatible)');
     }
   }
   if (options.scope !== 'client') {
     const recommendation = recommendedMode({ ...effects.platform, arch: effects.platform?.arch ?? process.arch });
     effects.out(`${recommendation.reason} Native runs directly on this computer; Docker runs in containers and needs Docker installed and running. An existing installation must keep its current mode.`);
-    options.mode = await effects.select('How should the server run?', [
-      { value: 'packages', label: 'Native packages' }, { value: 'docker', label: 'Docker' },
-    ], existing?.mode ?? recommendation.mode);
+    const runtime = options.mode ?? await effects.select('How should the server run?', [
+      { value: 'packages', label: 'Native packages' }, { value: 'docker', label: 'Docker' }, { value: 'podman', label: 'Podman' },
+    ], existing?.mode === 'docker' && existing?.containerEngine === 'podman' ? 'podman' : existing?.mode ?? recommendation.mode);
+    options.mode = runtime === 'podman' ? 'docker' : runtime;
+    if (runtime === 'podman') options.containerEngine = 'podman';
     if (!options.migrateFrom) {
-      effects.out(existing ? 'Existing identities and names are retained. This name is used only if a Human identity needs to be created.' : 'Choose the name other people and agents should see for your Human identity.');
-      options.identityName = await effects.askLine('What name should others see? ', existing?.messengerIdentity ?? effects.username?.() ?? 'me');
+      if (existing?.messengerIdentity) {
+        effects.out(`Existing Human identity ${existing.messengerIdentity} and Messenger profile will be retained.`);
+        // Supplied profile inputs never rename a retained root.
+        if (!['localUsername', 'name', 'surname'].some(key => options[key] !== undefined)) options.identityName ??= existing.messengerIdentity;
+      } else if (options.identityName === undefined || options.localUsername !== undefined) {
+        effects.out('Choose a local username (no global uniqueness check). Name and Surname appear in Messenger; the optional host name identifies this workspace.');
+        options.localUsername ??= await effects.askLine('Local username: ', (effects.username?.() ?? 'me').toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 30));
+        options.name ??= await effects.askLine('Name: ', '');
+        options.surname ??= await effects.askLine('Surname: ', '');
+        options.hostname ??= await effects.askLine('Host / machine name (optional): ', '');
+      }
+    }
+    if (['localUsername', 'name', 'surname'].some(key => options[key] !== undefined)) {
+      // Partial profile presets still collect missing fields on retained and
+      // migration paths; these inputs never replace their authoritative root.
+      effects.out('Name and Surname initialize a missing Messenger profile; an existing profile is retained.');
+      options.localUsername ??= await effects.askLine('Local username: ', (effects.username?.() ?? 'me').toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 30));
+      options.name ??= await effects.askLine('Name: ', '');
+      options.surname ??= await effects.askLine('Surname: ', '');
+      options.hostname ??= await effects.askLine('Host / machine name (optional): ', '');
     }
-    for (const [key, fallback] of Object.entries(defaults)) options[key] = existing?.[key] ?? fallback;
+    for (const [key, fallback] of Object.entries(defaults)) options[key] ??= existing?.[key] ?? fallback;
     if (options.operation === 'update') {
       effects.out('The update retains identities and messages and creates a recovery backup before changing stored state. Proceed only if you accept this release for your existing data; compatibility is not automatically guaranteed.');
-      options.compatible = await effects.ask('Proceed with this update and keep a recovery backup?', false);
+      options.compatible ??= await effects.ask('Proceed with this update and keep a recovery backup?', false);
     }
   } else {
     const savedProfile = join(effects.home, '.ours-client', 'profile.json');
     effects.out('A connection profile identifies the server and its private access credential. Reuse your saved connection or select a profile supplied by the server owner.');
-    const connection = await effects.select('Which server connection should this computer use?', [
+    const connection = options.config ? 'preset' : await effects.select('Which server connection should this computer use?', [
       { value: 'saved', label: 'Use the saved server connection' }, { value: 'file', label: 'Choose a connection profile file' },
     ], effects.readJson(savedProfile) ? 'saved' : 'file');
-    options.config = connection === 'saved' ? savedProfile : await effects.askLine('Connection profile file: ', savedProfile);
+    options.config ??= connection === 'saved' ? savedProfile : await effects.askLine('Connection profile file: ', savedProfile);
   }
   if (options.scope !== 'server') {
     const detected = typeof effects.detectHarnesses === 'function' ? await effects.detectHarnesses() : [];
     const selected = integrations.filter(name => name === 'fleet' || detected.some(item => item.name === name && item.status === 'ok'));
     effects.out('Choose the apps to connect. Detected agent apps are selected by default; Fleet configures persistent agents but leaves them stopped. Use Space to toggle choices, then Enter to continue. You can select none.');
-    options.integrations = await effects.multiselect('Which integrations should be configured?', [
+    options.integrations ??= await effects.multiselect('Which integrations should be configured?', [
       { value: 'codex', label: 'Codex' }, { value: 'claude-code', label: 'Claude Code' }, { value: 'fleet', label: 'Fleet — persistent agents' },
     ], selected);
-    if (options.integrations.includes('fleet')) {
+    if (options.integrations.includes('fleet') && !options.disableFleetAgentsSetup && !options.fleetSettingsPath) {
       effects.out('Fleet needs model and agent settings. Its guided setup asks for these later; a prepared settings file applies your existing choices. Fleet roles will not start automatically.');
       const fleetMode = await effects.select('How should Fleet be configured?', [
         { value: 'wizard', label: 'Configure interactively with Fleet' }, { value: 'file', label: 'Use a prepared settings file' },

package/lib/setup.mjs

@@ -11,6 +11,7 @@ import { isCancel } from './prompt.mjs';
 import { USAGE } from './usage.mjs';
 import { validateIdentityName } from './server-onboarding.mjs';
 import { validateFleetSettings } from './fleet-settings.mjs';
+import { installerFailure } from './diagnostics.mjs';
 
 const maintenance = new Set(['status', 'start', 'stop', 'restart', 'rebuild', 'gateway-enable', 'access-issue', 'access-replace', 'backup', 'restore', 'reset']);
 
@@ -114,6 +115,9 @@ export async function executeSetupPlan(plan, effects, { server = runServerComman
     const result = await server({ ...plan, role: 'server', operation: plan.operation, sourcePolicy: plan.sourcePolicy }, effects);
     if (result !== 0) return result;
     const record = validateInstallation(effects.readJson(join(plan.stateDir, 'installation.json')), plan.stateDir);
+    if (plan.name && plan.surname && plan.operation === 'install') {
+      await effects.serverEnsureHumanProfile(record, { name: plan.name, surname: plan.surname });
+    }
     if (plan.operation === 'update') {
       effects.out(progress(0, 1, 'Retained identities', 'Verify the Human identity after state restoration; existing names and keys are retained.'));
       const running = await effects.serverLifecycle(record, 'status', ['daemon']);
@@ -132,11 +136,12 @@ export async function executeSetupPlan(plan, effects, { server = runServerComman
   if (plan.scope !== 'server') {
     const result = await client({ role: 'client', operation: 'install', config: clientConfig,
       integrations: plan.integrations, fleetSettingsPath: plan.fleetSettingsPath, sourcePolicy: clientPolicy,
-      preset: true, nonInteractive: !plan.interactive }, effects);
+      disableFleetAgentsSetup: plan.disableFleetAgentsSetup, preset: true, nonInteractive: !plan.interactive }, effects);
     if (result !== 0) return result;
   }
+  if (plan.disableFleetAgentsSetup && plan.integrations?.includes('fleet')) effects.out(info('Fleet is installed. Run ours-fleet setup-tunnel with the private expiring App setup file, then ours-fleet link-device. Configure agents and models in the App after linking.'));
   effects.out(ok(`Requested ${plan.operation} completed. Existing identities were retained.`));
-  if (plan.integrations?.includes('fleet')) effects.out(info('Fleet is configured but stopped. Review its settings, then run ours-fleet doctor, ours-fleet config and ours-fleet up.'));
+  if (plan.integrations?.includes('fleet') && !plan.disableFleetAgentsSetup) effects.out(info('Fleet is configured but stopped. Review its settings, then run ours-fleet doctor, ours-fleet config and ours-fleet up.'));
   return 0;
 }
 
@@ -148,12 +153,20 @@ export async function runSetup(argv, effects) {
     if (argv[0] === 'server' && maintenance.has(argv[1])) return await runServerCommand(parseNetworkArgs(argv), effects);
     if (!argv.length && effects.env?.OURS_ASSUME_YES) throw new InstallUsageError('OURS_ASSUME_YES cannot fill an interactive setup plan. Supply complete CLI presets for unattended installation.');
     if (!argv.length) { effects.out(banner()); effects.out(heading('Interactive setup')); }
-    const options = argv.length ? parseSetupArgs(argv, { home: effects.home }) : await collectSetupOptions(effects);
+    let options;
+    if (argv.length) {
+      const presets = parseSetupArgs(argv, { home: effects.home, validate: false });
+      try { options = validateSetupOptions(presets, { interactive: false }); }
+      catch (error) {
+        if (!effects.interactive || effects.env?.OURS_ASSUME_YES || !/^Missing (required setup options|human profile option):/.test(error.message)) throw error;
+        options = await collectSetupOptions(effects, presets);
+      }
+    } else options = await collectSetupOptions(effects);
     const plan = await prepareSetupPlan(options, effects);
     return await executeSetupPlan(plan, effects);
   } catch (error) {
     if (isCancel(error)) { effects.out(warn('Installation cancelled.')); return 130; }
-    effects.out(warn(`ours-install: ${error.message}`));
+    effects.out(warn(`ours-install: ${installerFailure(error, effects.env)}`));
     return 2;
   }
 }

package/lib/usage.mjs

@@ -1,11 +1,15 @@
 // Public setup and maintenance commands.
-export const USAGE = `ours-install — interactive setup or complete CLI presets.
+export const USAGE = `ours-install — interactive setup with optional CLI presets.
 
   ours-install
     Opens the console form. Choose all (server + clients), server, or client;
     runtime, installation directory, identity, integrations and Fleet settings.
     Docker provides the full-stack gateway; native mode is server-only. Windows uses WSL.
 
+  Install now, configure Fleet agents in the App after linking:
+    ours-install --username alex --name Alex --surname Taylor --disable-fleet-agents-setup
+    Remaining installation choices are prompted on a terminal. No enrollment credentials or expiry.
+
   Full stack, with every required answer preset (no prompts):
     ours-install --mode docker --state-dir /private/ours --identity-name "Your Name" --integrations codex,fleet --fleet-settings /private/fleet.json
 
@@ -24,9 +28,14 @@ export const USAGE = `ours-install — interactive setup or complete CLI presets
   --mode docker|native      packages is also accepted for native mode
   --container-engine docker|podman  server container backend (default Docker); retained for maintenance
   --state-dir PATH          installation root; required for all/server
+  --username USERNAME       local username; no global uniqueness check
+  --name NAME               Messenger given name
+  --surname SURNAME         Messenger family name
+  --hostname NAME           optional host/workspace name; defaults to this machine
+  --disable-fleet-agents-setup  install Fleet CLI without its roles/model wizard
   --identity-name NAME      desired Human name for a fresh server; existing root is retained
   --integrations LIST       codex,claude-code,fleet; use none to skip clients explicitly
-  --fleet-settings PATH     JSON settings for Fleet; mandatory for CLI presets selecting Fleet
+  --fleet-settings PATH     JSON settings for Fleet; required unless Fleet agents setup is disabled
   --config PATH             complete connection profile for client-only setup
   --sources PATH            explicit full development source policy override
   --port N                  public gateway port for Docker (default 3050; e.g. 4050)
@@ -41,8 +50,8 @@ export const USAGE = `ours-install — interactive setup or complete CLI presets
   --help, -h                show help
   --version, -V             print installer version
 
-CLI presets must be complete and never open the interactive form or a Fleet wizard.
-Missing answers are reported before installation. Both input modes run the same
+Partial CLI presets on a terminal ask for the remaining choices. Without a terminal,
+or with OURS_ASSUME_YES, supply complete CLI presets; missing answers fail before installation. Both input modes run the same
 installer with preparation, identity restoration, update and readiness progress.
 Fleet is configured but left stopped for operator review.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.23",
+  "version": "1.2.1-nightly.25",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",