@ours.network/install 1.2.1-nightly.24 → 1.2.1-nightly.26

package/README.md

@@ -591,4 +591,4 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.31` with its recorded registry integrity. This release includes the packaged `/fleet` browser entry and persists the available Fleet loopback port used by the workspace tunnel. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.33` with its recorded registry integrity. This release includes the packaged `/fleet` browser entry, separate `ours-fleet setup-tunnel` and `ours-fleet link-device` commands, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. Existing installation identities and configured ports remain retained; a retained-port collision fails safely.

package/assets/Dockerfile

@@ -23,6 +23,7 @@ COPY --chmod=644 scripts/runtime/runtime-common.mjs /opt/ours/docker/runtime-com
 COPY --chmod=644 scripts/runtime/check-client.mjs /opt/ours/docker/check-client.mjs
 COPY --chmod=644 scripts/runtime/check-start.mjs /opt/ours/docker/check-start.mjs
 COPY --chmod=644 scripts/runtime/client-setup.mjs /opt/ours/docker/client-setup.mjs
+COPY --chmod=644 scripts/runtime/diagnostics.mjs /opt/ours/docker/diagnostics.mjs
 COPY --chmod=644 scripts/runtime/legacy-import.mjs /opt/ours/docker/legacy-import.mjs
 COPY --chmod=644 scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
 COPY --chmod=644 scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs

package/assets/release-lock.json

@@ -13,7 +13,7 @@
         "@ours.network/codex": "1.2.0-nightly.10",
         "@ours.network/cowork": "1.3.3-nightly.20261001.6d49d3a",
         "@ours.network/daemon": "3.8.1-nightly.7",
-        "@ours.network/fleet": "1.2.0-nightly.31",
+        "@ours.network/fleet": "1.2.0-nightly.33",
         "@ours.network/mcp": "1.2.0-nightly.10",
         "@ours.network/messenger-server": "1.0.31-nightly.13",
         "@ours.network/sdk": "3.8.1-nightly.15",
@@ -440,9 +440,9 @@
       }
     },
     "node_modules/@agentclientprotocol/sdk": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-1.6.0.tgz",
-      "integrity": "sha512-XxXrmX7aZkDgOB0Rg9cu+ZFyiUUc5lF2n9seO3Gc4OR+MTdfZOwIqF6m3LvsmmM8K3qgPmXkDH8/IFM2u9vdcQ==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-1.6.1.tgz",
+      "integrity": "sha512-ziLAZzqrAyW3bkK24c2DSTzLw48fUSKtgG3MTe2pqZgmsvepxXZFlUh9y8UZ2eYOnQ3qBgdcl879YrdWiTu6HQ==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "zod": "^3.25.0 || ^4.0.0"
@@ -1085,9 +1085,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.31",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.31.tgz",
-      "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA==",
+      "version": "1.2.0-nightly.33",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.33.tgz",
+      "integrity": "sha512-2z1Q01LeLRnq1HOcBeYJ67WnH5hI/tC/YdTkA4/K2LFdFtbff0j7M2l4SZDpKQaL8zgLjL8NREMSlOufdULJaA==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.24",
+  "installerVersion": "1.2.1-nightly.26",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.15",
@@ -24,8 +24,8 @@
       "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.31",
-      "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA=="
+      "version": "1.2.0-nightly.33",
+      "integrity": "sha512-2z1Q01LeLRnq1HOcBeYJ67WnH5hI/tC/YdTkA4/K2LFdFtbff0j7M2l4SZDpKQaL8zgLjL8NREMSlOufdULJaA=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.10",

package/assets/scripts/runtime/client-setup.mjs

@@ -1,4 +1,5 @@
 import { readBuildRecords, initializeBuildMarker } from '../maintenance/build-context.mjs';
+import { redactDiagnostic } from './diagnostics.mjs';
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import {
@@ -12,6 +13,7 @@ const DELIVERY_FILES = [
   '/credentials/messenger/daemon-token',
 ];
 const fail = (message) => { throw new Error(message); };
+let diagnosticStage = 'validation';
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 function privatePath(path, directory, exact = directory ? 0o700 : 0o600) {
@@ -128,10 +130,13 @@ function prepare() {
 
 function finishDaemonSetup() {
   const state = '/var/lib/ours';
+  diagnosticStage = 'daemon-provenance';
   initializeBuildMarker(`${state}/.ours-provenance`, readBuildRecords('/opt/ours'));
+  diagnosticStage = 'mcp-directory';
   privatePath('/var/lib/ours-mcp', true);
   const mcpProfile = { endpoint: 'http://127.0.0.1:3050', expectedInstanceId: process.env.OURS_DAEMON_ID, credentialPath: `${state}/daemon-token` };
   const mcpPath = '/var/lib/ours-mcp/profile.json';
+  diagnosticStage = 'mcp-profile';
   if (!existingPrivate(mcpPath, false)) atomicJson(mcpPath, mcpProfile);
   else if (JSON.stringify(jsonObject(mcpPath)) !== JSON.stringify(mcpProfile)) fail('Existing MCP profile differs from the selected daemon');
 }
@@ -155,10 +160,19 @@ async function telegramInput() {
 }
 
 function cliJson(args) {
+  diagnosticStage = 'official-cli';
   const result = spawnSync(process.execPath, [existsSync('/opt/ours/node_modules/@ours.network/daemon/dist/cli.js') ? '/opt/ours/node_modules/@ours.network/daemon/dist/cli.js' : '/opt/ours/node_modules/@ours.network/cli/dist/cli.js', ...args], {
     encoding: 'utf8', timeout: 60_000, maxBuffer: 1024 * 1024,
   });
-  if (result.status !== 0) fail('Official OURS CLI operation failed');
+  if (result.error || result.status !== 0) {
+    // --json writes failures on stderr. Successful credential stdout is never
+    // forwarded, even if a later operation exits unsuccessfully.
+    let reason = 'CLI supplied no structured error reason';
+    for (const line of String(result.stderr ?? '').split('\n').reverse()) {
+      try { const value = JSON.parse(line); if (typeof value?.error?.message === 'string') { reason = value.error.message; break; } } catch {}
+    }
+    fail(`Official OURS CLI operation failed (${args[1]}; exit=${result.status ?? 'none'}; signal=${result.signal ?? 'none'}; system=${result.error?.code ?? 'none'}): ${reason}`);
+  }
   try { return JSON.parse(result.stdout); }
   catch { fail('Official OURS CLI returned malformed JSON'); }
 }
@@ -192,6 +206,10 @@ try {
   else if (['access-init', 'access-issue', 'access-replace'].includes(operation)) access(operation, process.argv[3]);
   else fail('usage: client-setup.mjs prepare | telegram-input | access-init | access-issue [OUTPUT] | access-replace');
 } catch (error) {
-  console.error(`OURS client setup refused: ${error.message}`);
+  // Structured stderr retains the failing stage across sensitive Compose
+  // capture. The installer redacts secrets before exposing this envelope.
+  const message = redactDiagnostic(error.message);
+  console.error(JSON.stringify({ oursInstallerError: { stage: diagnosticStage, message } }));
+  console.error(`OURS client setup refused: ${message}`);
   process.exit(1);
 }

package/assets/scripts/runtime/diagnostics.mjs

@@ -0,0 +1,72 @@
+/** Retain actionable failure details without emitting credential output. */
+export function redactDiagnostic(value, env = process.env) {
+  let text = String(value ?? '').replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, '').replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
+  for (const [key, secret] of Object.entries(env)) {
+    if (/(?:token|password|secret|api.?key|private.?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)/i.test(key) && typeof secret === 'string' && secret)
+      text = text.split(secret).join('[redacted]');
+  }
+  return text
+    .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, '[redacted private key]')
+    .replace(/(Bearer\s+)[^\s"',;]+/gi, '$1[redacted]')
+    .replace(/((?:["']?(?:api[-_]?token|token|password|secret|api[-_]?key|private[-_]?key|invitation|enrollment|authorization|credential|access.?token|refresh.?token)["']?)\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;}]+)/gi, '$1[redacted]')
+    .replace(/(--(?:setup-workspace|password|token|secret|api-key|private-key|invitation|enrollment)(?:=|\s+))\S+/gi, '$1[redacted]')
+    .replace(/(https?:\/\/)[^\s/@:]+:[^\s/@]+@/g, '$1[redacted]@')
+    .replace(/\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, '[redacted credential]')
+    .replace(/[A-Za-z0-9_+/=-]{43,}/g, '[redacted opaque value]');
+}
+
+const bounded = text => text.length <= 65536 ? text : text.slice(0, 65536) + '\n[Diagnostic output exceeds 64 KiB; remainder omitted.]';
+function credentialFailure(stderr) {
+  // Credential stdout can be a successful issuance followed by failure: never
+  // include it. Only a structured error envelope or shipped helper refusal is
+  // accepted from stderr; arbitrary lines/warnings remain private.
+  const lines = String(stderr ?? '').split('\n').reverse();
+  for (const line of lines) {
+    try {
+      const value = JSON.parse(line);
+      if (typeof value?.oursInstallerError?.message === 'string') {
+        const detail = value.oursInstallerError;
+        const stage = /^[a-z][a-z-]{0,40}$/.test(detail.stage ?? '') ? detail.stage : 'credential-operation';
+        return `Stage: ${stage}\nReason: ${detail.message}`;
+      }
+      if (typeof value?.error?.message === 'string') return `Reason: ${value.error.message}`;
+    } catch {}
+  }
+  const prefix = 'OURS client setup refused: ';
+  const legacy = lines.find(line => line.startsWith(prefix));
+  if (legacy) return `Reason: ${legacy.slice(prefix.length)}`;
+  return 'The credential operation provided no structured reason. Its raw output was withheld because it can contain credentials.';
+}
+
+export function commandFailure(command, args, result, { sensitive = false, cwd, env = process.env } = {}) {
+  const visibleArgs = [...args];
+  if (sensitive) {
+    for (let i = 0; i < visibleArgs.length - 1; i++) if (['-e', '--eval'].includes(visibleArgs[i])) visibleArgs[i + 1] = '[captured installer helper]';
+  }
+  const details = [`Command: ${command} ${visibleArgs.join(' ')}${result.status != null ? ` exited ${result.status}` : ''}`];
+  if (cwd) details.push(`Working directory: ${cwd}`);
+  if (result.status !== null && result.status !== undefined) details.push(`Exit code: ${result.status}`);
+  if (result.signal) details.push(`Signal: ${result.signal}`);
+  if (result.error?.code) details.push(`System error: ${result.error.code}`);
+  if (result.error?.code === 'ETIMEDOUT') details.push('Reason: command timed out.');
+  if (sensitive) details.push(credentialFailure(result.stderr));
+  else {
+    const stderr = String(result.stderr ?? '').trim(), stdout = String(result.stdout ?? '').trim();
+    if (stderr) details.push(`Standard error:\n${stderr}`);
+    if (stdout) details.push(`Standard output:\n${stdout}`);
+    if (!stderr && !stdout) details.push('No captured command output. Streaming commands print their output above.');
+  }
+  details.push('Keep installation data intact. Include this error and the preceding installation stage when requesting help.');
+  return new Error(bounded(redactDiagnostic(details.join('\n'), env)), result.error ? { cause: result.error } : undefined);
+}
+
+export function installerFailure(error, env = process.env) {
+  const details = []; const seen = new Set();
+  for (let cause = error; cause && !seen.has(cause) && seen.size < 8; cause = cause.cause) {
+    seen.add(cause);
+    const message = cause instanceof Error ? cause.message : String(cause);
+    if (!details.includes(message)) details.push(message);
+    if (typeof cause.code === 'string' && /^[A-Z_0-9]+$/.test(cause.code)) details.push(`System error: ${cause.code}`);
+  }
+  return bounded(redactDiagnostic(details.join('\nCaused by: '), env));
+}

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.24",
+    "installerVersion": "1.2.1-nightly.26",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.15",
@@ -25,8 +25,8 @@
         "integrity": "sha512-hDosXHgQ+vyzPdSxqTz6vCaOCn0LMTmOL4TJiWplkJhzyw2c586RckXJbqNJsTa0mmodvLxW0ewZyQ/xJVIeXA=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.31",
-        "integrity": "sha512-45oIV09WCsK5yEZF8IKU8LEJjC4Hk26XG/OeA+BqxSFvQWEXoHhMhLeabP5Jc9QcDcEmtH5AeYKXRvCXTeb+YA=="
+        "version": "1.2.0-nightly.33",
+        "integrity": "sha512-2z1Q01LeLRnq1HOcBeYJ67WnH5hI/tC/YdTkA4/K2LFdFtbff0j7M2l4SZDpKQaL8zgLjL8NREMSlOufdULJaA=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.10",
@@ -79,7 +79,7 @@
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.31"
+      "version": "1.2.0-nightly.33"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/install.mjs

@@ -3,6 +3,7 @@
 import { readFileSync } from 'node:fs';
 
 import { realEffects } from './lib/effects.mjs';
+import { installerFailure } from './lib/diagnostics.mjs';
 import { runWorkspaceSetup } from './lib/workspace-setup.mjs';
 import { runSetup } from './lib/setup.mjs';
 import { closeSync, makeWriter, openTty } from './lib/ui.mjs';
@@ -22,7 +23,7 @@ try {
   }));
   process.exitCode = code;
 } catch (error) {
-  process.stderr.write(`ours-install: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.stderr.write(`ours-install: ${installerFailure(error)}\n`);
   process.exitCode = 1;
 } finally {
   if (ttyFd != null) {

package/lib/client-cli.mjs

@@ -88,7 +88,7 @@ export async function publishClientCli(effects, packagePath, { policy = {}, isol
     if (sdk.name !== '@ours.network/sdk' || sdk.version !== policy.release.packages['@ours.network/sdk'].version) throw new Error('Private CLI SDK differs from selection');
     mkdirSync(dirname(entry), { recursive: true });
     const binDir = lstatSync(dirname(entry));
-    if (!binDir.isDirectory() || binDir.uid !== process.getuid() || (binDir.mode & 0o022)) throw new Error('CLI bin directory must be owned and not writable by others');
+    if (!binDir.isDirectory() || binDir.uid !== process.getuid() || (binDir.mode & 0o022)) throw new Error(`CLI bin directory ${dirname(entry)} must be owned by you and not writable by group or others; run chmod go-w on it, or point npm's global prefix at a directory you own`);
     const current = stat(entry);
     if (before ? !current || current.dev !== before.dev || current.ino !== before.ino : current) throw new Error('CLI entry changed during publication');
     const staged = entry + '.' + randomUUID();

package/lib/diagnostics.mjs

@@ -0,0 +1 @@
+export { redactDiagnostic, commandFailure, installerFailure } from '../assets/scripts/runtime/diagnostics.mjs';

package/lib/docker-runtime-repair.mjs

@@ -1,4 +1,4 @@
-import { runContainer } from './container-engine.mjs';
+import { engineName, runContainer } from './container-engine.mjs';
 /** Qualify cached images before reuse; repair only the known root-owned 0600 policy. */
 import { existsSync, readdirSync, lstatSync, readFileSync, writeFileSync, mkdtempSync, rmSync, realpathSync, openSync, closeSync, fstatSync, fchmodSync, constants } from 'node:fs';
 import { join } from 'node:path';
@@ -112,16 +112,24 @@ export async function qualifyDockerRuntime(record, effects) {
     }
   };
   const policy = readFileSync(record.sourcesPath), expectedHash = digest(policy);
-  const check = (report, mode) => {
-    if (!report || report.mode !== mode || report.uid !== 0 || report.gid !== 0 || !report.regular || report.links !== 1 || report.policyHash !== expectedHash) fail('image policy differs from retained selection or expected permissions');
+  const check = (report, mode, stage) => {
+    const expected = { mode, uid: 0, gid: 0, regular: true, links: 1, policyHash: expectedHash };
+    const mismatched = Object.keys(expected).filter(key => report?.[key] !== expected[key]);
+    if (mismatched.length) {
+      // Only fixed field names, a bounded numeric mode and a comparison boolean
+      // enter diagnostics. Never disclose policy content, hashes or probe output.
+      const observedMode = Number.isInteger(report?.mode) && report.mode >= 0 && report.mode <= 0o7777
+        ? report.mode.toString(8).padStart(4, '0') : 'invalid';
+      fail(`image policy verification failed (stage=${stage}; engine=${engineName(record)}; mismatched=${mismatched.join(',')}; mode=${observedMode}; expectedMode=${mode.toString(8).padStart(4, '0')}; policyMatch=${report?.policyHash === expectedHash})`);
+    }
   };
   const original = await inspect(tag);
   const ordinary = await probe(original.Id, `${uid}:${gid}`);
-  if (ordinary.code === 0) { check(ordinary.report, 0o644); return; }
+  if (ordinary.code === 0) { check(ordinary.report, 0o644, 'ordinary'); return; }
   if (ordinary.code !== 74) fail('cached image is unusable; automatic repair only supports the known source-policy permission defect');
   const privileged = await probe(original.Id, '0:0');
   if (privileged.code !== 0) fail('original release graph could not be verified');
-  check(privileged.report, 0o600);
+  check(privileged.report, 0o600, 'privileged');
   effects.out?.('Repairing cached Docker image permissions; keeping the selected packages and stored data.');
   const directory = mkdtempSync(join(record.root, '.image-permissions-'));
   const name = `ours-permission-repair-${randomUUID()}`, baseTag = `${name}:base`, candidateTag = `${name}:candidate`;
@@ -138,7 +146,7 @@ export async function qualifyDockerRuntime(record, effects) {
         || candidate.RootFS.Layers.length !== original.RootFS.Layers.length + 1) fail('repair changed image execution settings or ancestry');
     const verified = await probe(candidate.Id, `${uid}:${gid}`);
     if (verified.code !== 0) fail('repaired image did not pass runtime verification');
-    check(verified.report, 0o644);
+    check(verified.report, 0o644, 'repaired');
     if (!isDeepStrictEqual(verified.report.records, privileged.report.records)) fail('repair changed build provenance');
     if ((await inspect(tag)).Id !== original.Id) fail('selected image changed during repair; retry setup');
     await runContainer(effects, record, ['image', 'tag', candidate.Id, tag]);

package/lib/effects.mjs

@@ -15,6 +15,7 @@ import { engineName, bindPodman, runContainer, nativeBuildCommands } from './con
 // unit file or the service manager directly.
 
 import { publishClientCli } from './client-cli.mjs';
+import { commandFailure } from './diagnostics.mjs';
 import { spawnSync, execFileSync } from 'node:child_process';
 import { chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, userInfo, platform as osPlatform, release as osRelease, arch as osArch } from 'node:os';
@@ -422,13 +423,12 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
         env: childEnv,
       });
       if (r.error) {
-        const error = new Error(`${executable} could not start (${r.error.code ?? 'launch error'})`, { cause: r.error });
+        const error = commandFailure(executable, args, r, { sensitive, cwd, env: childEnv });
         error.code = r.error.code;
         throw error;
       }
       if (r.status !== 0 && !allowCodes.includes(r.status)) {
-        const detail = sensitive ? '' : (r.stderr || r.stdout || '').trim().split('\n').slice(-3).join('; ');
-        throw new Error(`${executable} ${args.join(' ')} exited ${r.status}${detail ? `: ${detail}` : ''}`);
+        throw commandFailure(executable, args, r, { sensitive, cwd, env: childEnv });
       }
       return { ok: true, code: r.status, stdout: r.stdout ?? '' };
     },
@@ -442,7 +442,8 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
       delete childEnv.OURS_INSTALLER_LOCK_FD;
       if (installationLockFd !== null) childEnv.OURS_INSTALLER_LOCK_FD = '3';
       const r = spawnSync(cmd, args, { stdio: ['inherit', 'inherit', 'inherit', ...(installationLockFd === null ? [] : [installationLockFd])], env: childEnv });
-      return { ok: !r.error && r.status === 0, code: r.status ?? -1 };
+      if (r.error || r.status !== 0) throw commandFailure(cmd, args, r, { env: childEnv });
+      return { ok: true, code: r.status };
     },
     installedVersion: (pkg) => installedVersionOf(pkg, npmBin),
     packageDependencies: (spec) => packageDependenciesOf(spec, npmBin),
@@ -1040,7 +1041,15 @@ export function networkEffects(effects) {
     },
     async serverAccess(record, operation, { output, migrate = false } = {}) {
       if (record.mode === 'docker') {
-        if (!output) return compose(record, ['run', '--rm', '--no-deps', '-T', 'access', operation], { sensitive: true, env: { OURS_ACCESS_MIGRATE: migrate ? '1' : '0' } });
+        // Retained images contain the old helper that discarded CLI errors.
+        // Execute the shipped installer helper against the SAME selected image
+        // and Compose volume/user/environment contract, without retag/rebuild.
+        const diagnosticsUrl = `data:text/javascript;base64,${readFileSync(join(INSTALLER_ASSETS, 'scripts/runtime/diagnostics.mjs')).toString('base64')}`;
+        const helper = `process.argv.splice(1, 0, '/opt/ours/docker/client-setup.mjs');\n` + readFileSync(join(INSTALLER_ASSETS, 'scripts/runtime/client-setup.mjs'), 'utf8')
+          .replace("'../maintenance/build-context.mjs'", "'/opt/ours/maintenance/build-context.mjs'")
+          .replace("'./diagnostics.mjs'", JSON.stringify(diagnosticsUrl));
+        const accessArgs = (...args) => ['--entrypoint', 'node', 'access', '--input-type=module', '-e', helper, '--', ...args];
+        if (!output) return compose(record, ['run', '--rm', '--no-deps', '-T', ...accessArgs(operation)], { sensitive: true, env: { OURS_ACCESS_MIGRATE: migrate ? '1' : '0' } });
         privateDirectory(dirname(output));
         if (existsSync(output)) throw new Error('Credential output already exists');
         const name = `${record.project}-issue-${randomUUID()}`;
@@ -1048,7 +1057,7 @@ export function networkEffects(effects) {
         const staging = join(dirname(output), `.ours-issued-${randomUUID()}`);
         ensurePrivateDirectory(staging);
         try {
-          await compose(record, ['run', '--name', name, '--no-deps', '-T', 'access', 'access-issue', issuedPath], { sensitive: true });
+          await compose(record, ['run', '--name', name, '--no-deps', '-T', ...accessArgs('access-issue', issuedPath)], { sensitive: true });
           const file = join(staging, 'credential');
           await container(record, ['cp', `${name}:${issuedPath}`, file], { sensitive: true });
           assertPrivateRegularFile(file, 'issued credential');

package/lib/orchestrate.mjs

@@ -45,6 +45,7 @@ import {
   validateChannelVersion,
 } from './marketplace.mjs';
 import { USAGE } from './usage.mjs';
+import { installerFailure } from './diagnostics.mjs';
 import { ok, info, warn, heading, banner, box, c, progress } from './ui.mjs';
 
 export const EXIT_OK = 0;
@@ -89,12 +90,7 @@ async function perform(effects, dryRun, label, thunk) {
 const reason = (error) => (error instanceof Error ? error.message : String(error));
 
 function clientDiagnostic(error) {
-  return reason(error)
-    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '')
-    .replace(/\bBearer\s+[^\s,;]+/gi, 'Bearer [redacted]')
-    .replace(/((?:api[_-]?key|api[_-]?token|access[_-]?token|refresh[_-]?token|token|password|secret|authorization|credential)\s*["']?\s*[:=]\s*["']?)[^\s"',;]+/gi, '$1[redacted]')
-    .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gi, '$1[redacted]@')
-    .replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 700);
+  return installerFailure(error);
 }
 
 function clientRetry(effects, imported, integrations) {

package/lib/server-onboarding.mjs

@@ -136,7 +136,8 @@ else { await request('identity/profile', selection.human); process.stdout.write(
 `;
       const docker = record.mode === 'docker';
       const selection = { base: `http://127.0.0.1:${docker ? 8420 : record.messengerPort}`,
-        origin: `http://127.0.0.1:${record.messengerPort}`,
+        // Behind the gateway Messenger accepts mutations only from the gateway origin.
+        origin: record.gateway ? gatewayAddress(record).origin : `http://127.0.0.1:${record.messengerPort}`,
         credentialPath: docker ? '/credentials/messenger/daemon-token' : installationPaths(record).credentials.messenger,
         human: { name: human.name, surname: human.surname } };
       const args = ['--input-type=module', '-e', script, JSON.stringify(selection)];
@@ -169,7 +170,7 @@ else { await request('identity/profile', selection.human); process.stdout.write(
         if (!current) {
           effects.out?.('Issuing a separate local client credential with the retained server authority.');
           try { await effects.serverAccess(record, 'access-issue', { output: credential }); }
-          catch { throw new Error('Client credential issuance failed; existing profiles were retained'); }
+          catch (cause) { throw new Error('Client credential issuance failed; existing profiles were retained', { cause }); }
         }
         const retainedCredential = current?.credentialPath ?? credential;
         const stat = privatePath(retainedCredential);

package/lib/setup-options.mjs

@@ -219,9 +219,17 @@ export async function collectSetupOptions(effects, presets = {}) {
   }
   if (options.scope !== 'client') {
     const recommendation = recommendedMode({ ...effects.platform, arch: effects.platform?.arch ?? process.arch });
-    effects.out(`${recommendation.reason} Native runs directly on this computer; Docker runs in containers and needs Docker installed and running. An existing installation must keep its current mode.`);
+    // Native runs the server only: local clients need the container gateway. A retained
+    // native installation keeps its mode, so a full setup of it cannot finish.
+    // (An unfinished migration is resumed in its recorded mode and is validated with the plan.)
+    if (options.scope === 'all' && existing?.mode === 'packages' && !options.migrateFrom)
+      throw new Error('This installation runs natively, which supports the server only. Choose the server-only setup to maintain it (ours-install server); local clients need an installation that runs in Docker or Podman. Nothing was changed.');
+    const nativeOffered = options.scope === 'server' || existing?.mode === 'packages';
+    effects.out(nativeOffered
+      ? `${recommendation.reason} Native runs directly on this computer; Docker runs in containers and needs Docker installed and running. An existing installation must keep its current mode.`
+      : 'The server runs in containers. Docker and Podman both work; the one you choose must be installed and running. An existing installation must keep its current mode.');
     const runtime = options.mode ?? await effects.select('How should the server run?', [
-      { value: 'packages', label: 'Native packages' }, { value: 'docker', label: 'Docker' }, { value: 'podman', label: 'Podman' },
+      ...(nativeOffered ? [{ value: 'packages', label: 'Native packages' }] : []), { value: 'docker', label: 'Docker' }, { value: 'podman', label: 'Podman' },
     ], existing?.mode === 'docker' && existing?.containerEngine === 'podman' ? 'podman' : existing?.mode ?? recommendation.mode);
     options.mode = runtime === 'podman' ? 'docker' : runtime;
     if (runtime === 'podman') options.containerEngine = 'podman';

package/lib/setup.mjs

@@ -11,6 +11,7 @@ import { isCancel } from './prompt.mjs';
 import { USAGE } from './usage.mjs';
 import { validateIdentityName } from './server-onboarding.mjs';
 import { validateFleetSettings } from './fleet-settings.mjs';
+import { installerFailure } from './diagnostics.mjs';
 
 const maintenance = new Set(['status', 'start', 'stop', 'restart', 'rebuild', 'gateway-enable', 'access-issue', 'access-replace', 'backup', 'restore', 'reset']);
 
@@ -165,7 +166,7 @@ export async function runSetup(argv, effects) {
     return await executeSetupPlan(plan, effects);
   } catch (error) {
     if (isCancel(error)) { effects.out(warn('Installation cancelled.')); return 130; }
-    effects.out(warn(`ours-install: ${error.message}`));
+    effects.out(warn(`ours-install: ${installerFailure(error, effects.env)}`));
     return 2;
   }
 }

package/lib/usage.mjs

@@ -4,7 +4,8 @@ export const USAGE = `ours-install — interactive setup with optional CLI prese
   ours-install
     Opens the console form. Choose all (server + clients), server, or client;
     runtime, installation directory, identity, integrations and Fleet settings.
-    Docker provides the full-stack gateway; native mode is server-only. Windows uses WSL.
+    Full setup runs the server in Docker or Podman, which provide the gateway local clients need.
+    Native mode is offered for server-only setup. Windows uses WSL.
 
   Install now, configure Fleet agents in the App after linking:
     ours-install --username alex --name Alex --surname Taylor --disable-fleet-agents-setup

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.24",
+  "version": "1.2.1-nightly.26",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",