@ours.network/install 1.2.1-nightly.3 → 1.2.1-nightly.31

package/lib/setup.mjs

@@ -1,17 +1,19 @@
+import { validateGatewayClientProfile } from './target.mjs';
+import { gatewayAddress } from './gateway.mjs';
 import { inspectLegacyMigration } from './legacy-migration.mjs';
 import { join } from 'node:path';
 import { parseSetupArgs, collectSetupOptions, validateSetupOptions } from './setup-options.mjs';
 import { parseNetworkArgs, validateHostProfile, InstallUsageError } from './target.mjs';
-import { validateInstallation } from './plan.mjs';
+import { clientPackageNames, validateInstallation } from './plan.mjs';
 import { runServerCommand, runClientCommand } from './orchestrate.mjs';
 import { banner, heading, info, ok, warn, progress } from './ui.mjs';
 import { isCancel } from './prompt.mjs';
 import { USAGE } from './usage.mjs';
 import { validateIdentityName } from './server-onboarding.mjs';
 import { validateFleetSettings } from './fleet-settings.mjs';
+import { installerFailure } from './diagnostics.mjs';
 
-const maintenance = new Set(['status', 'start', 'stop', 'restart', 'rebuild', 'access-issue', 'access-replace', 'backup', 'restore', 'reset']);
-const clientPackages = integrations => [...new Set(['sdk', ...(integrations.includes('fleet') ? ['cli'] : []), ...integrations])];
+const maintenance = new Set(['status', 'start', 'stop', 'restart', 'rebuild', 'gateway-enable', 'access-issue', 'access-replace', 'backup', 'restore', 'reset']);
 
 export function completeReleasePolicy(retained, supplied) {
   if (retained?.release) {
@@ -32,7 +34,9 @@ export async function prepareSetupPlan(options, effects) {
   options = validateSetupOptions(options, { interactive: options.interactive });
   if (effects.platform?.platform === 'win32') throw new InstallUsageError('Run ours-install inside WSL with Docker Desktop integration on Windows. Direct Windows Node installations are not supported.');
   const plan = { ...options };
-  if (options.scope !== 'server' && options.integrations.length) {
+  if (options.scope === 'all' && options.mode === 'packages' && options.integrations?.length)
+    throw new InstallUsageError('Gateway-only clients require a gateway. Use Docker full-stack setup, or install the native server separately and provision an HTTP gateway before client setup; nothing was changed.');
+  if (options.scope !== 'server') {
     for (const name of ['OURS_API_TOKEN', 'OURS_PORT', 'OURS_STATE_DIR', 'OURS_DAEMON_ID']) {
       if (effects.env?.[name]?.trim()) throw new InstallUsageError(`${name} conflicts with the selected client profile. Clear this override before full-stack/client setup; nothing was changed.`);
     }
@@ -54,6 +58,7 @@ export async function prepareSetupPlan(options, effects) {
     const value = effects.readJson(join(options.stateDir, 'installation.json'));
     if (value) {
       plan.existing = validateInstallation(value, options.stateDir);
+      if (options.containerEngine && options.containerEngine !== (plan.existing.containerEngine ?? 'docker')) throw new InstallUsageError('Container engine conflicts with retained installation');
       if (options.mode !== plan.existing.mode) throw new InstallUsageError('The selected mode conflicts with the retained installation; choose its existing mode or a separate empty directory');
       for (const key of ['port', 'coworkPort', 'messengerPort']) {
         if (options.explicitPorts?.includes(key) && options[key] !== plan.existing[key]) throw new InstallUsageError(`${key} conflicts with the retained installation`);
@@ -61,33 +66,33 @@ export async function prepareSetupPlan(options, effects) {
       }
       if (options.operation === 'install' && !options.migrateFrom) {
         const retained = readObject(effects, plan.existing.sourcesPath, 'Retained source policy');
-        plan.sourcePolicy = options.scope === 'server' || !options.integrations?.length ? retained : completeReleasePolicy(retained, options.sources ? policy : null);
+        plan.sourcePolicy = options.scope === 'server' ? retained : completeReleasePolicy(retained, options.sources ? policy : null);
       }
     } else if (options.operation === 'update') {
       throw new InstallUsageError('Update requires an existing installation.json; choose install for a new installation');
     }
     // Reject a local client already attached to another server before changing the server.
-    const saved = options.scope === 'all' && options.integrations.length ? effects.readManagedClientProfile() : null;
-    if (saved && (!plan.existing || saved.expectedInstanceId !== plan.existing.instanceId || saved.endpoint !== `http://127.0.0.1:${plan.port}`)) {
+    const saved = options.scope === 'all' ? effects.readManagedClientProfile() : null;
+    if (saved && (!plan.existing || saved.expectedInstanceId !== plan.existing.instanceId || saved.endpoint !== (plan.existing?.gateway ? gatewayAddress(plan.existing).base + '/daemon' : `http://127.0.0.1:${plan.port}`))) {
       throw new InstallUsageError('This user already has clients attached to a different server; their saved connection was not changed');
     }
   } else {
-    const profile = validateHostProfile(readObject(effects, options.config, 'Client profile'));
+    const profile = validateGatewayClientProfile(readObject(effects, options.config, 'Client profile'));
     if (!profile) throw new InstallUsageError('Client profile must contain endpoint, expectedInstanceId and credentialPath');
     if (!effects.readText(profile.credentialPath)?.trim()) throw new InstallUsageError('Client credential file is missing or empty');
     plan.profile = profile;
     const saved = effects.readManagedClientProfile();
-    if (saved && (saved.endpoint !== profile.endpoint || saved.expectedInstanceId !== profile.expectedInstanceId)) throw new InstallUsageError('Managed clients already select another server; existing connection was not changed');
+    if (saved && saved.expectedInstanceId !== profile.expectedInstanceId) throw new InstallUsageError('Managed clients already select another server; existing connection was not changed');
     if (saved && options.operation === 'install' && !options.sources) plan.sourcePolicy = readObject(effects, saved.installer.sourcesPath, 'Retained client source policy');
   }
   // Dry-run never spawns a resolver or acquires an installation lock.
   if (!options.dryRun) {
-    if (options.scope === 'all' && options.operation === 'update' && options.integrations.length) {
+    if (options.scope === 'all' && options.operation === 'update') {
       const running = await effects.serverLifecycle(plan.existing, 'status', ['daemon']);
       if (!running.includes('daemon')) throw new InstallUsageError('Full-stack update requires the selected daemon to be running for client verification. Start it first, or use server update to preserve its stopped state.');
     }
     if (options.scope !== 'client') await effects.resolveSourcePolicy(plan.sourcePolicy, 'server');
-    if (options.scope !== 'server' && options.integrations.length) await effects.resolveSourcePolicy(plan.sourcePolicy, 'client', clientPackages(options.integrations));
+    if (options.scope !== 'server') await effects.resolveSourcePolicy(plan.sourcePolicy, 'client', clientPackageNames(options.integrations));
   }
   return plan;
 }
@@ -100,7 +105,7 @@ export async function executeSetupPlan(plan, effects, { server = runServerComman
   if (plan.dryRun) {
     effects.out(info('Preview only. No packages, identities, credentials or services will be changed.'));
     if (plan.scope !== 'client') effects.out(info('Server: prerequisites → runtime preparation/update → retained identity/state restoration → readiness.'));
-    if (plan.scope !== 'server' && plan.integrations.length) effects.out(info('Clients: private connection → exact packages → selected integrations → Fleet settings when selected.'));
+    if (plan.scope !== 'server') effects.out(info('Clients: private connection → exact packages → selected integrations → Fleet settings when selected.'));
     return 0;
   }
   let clientConfig = plan.config;
@@ -110,6 +115,9 @@ export async function executeSetupPlan(plan, effects, { server = runServerComman
     const result = await server({ ...plan, role: 'server', operation: plan.operation, sourcePolicy: plan.sourcePolicy }, effects);
     if (result !== 0) return result;
     const record = validateInstallation(effects.readJson(join(plan.stateDir, 'installation.json')), plan.stateDir);
+    if (plan.name && plan.surname && plan.operation === 'install') {
+      await effects.serverEnsureHumanProfile(record, { name: plan.name, surname: plan.surname });
+    }
     if (plan.operation === 'update') {
       effects.out(progress(0, 1, 'Retained identities', 'Verify the Human identity after state restoration; existing names and keys are retained.'));
       const running = await effects.serverLifecycle(record, 'status', ['daemon']);
@@ -118,21 +126,22 @@ export async function executeSetupPlan(plan, effects, { server = runServerComman
         effects.out(ok('Retained identities verified.'));
       } else effects.out(info('Daemon remains stopped; stored identities are retained and will restore on the next start.'));
     }
-    if (plan.scope === 'all' && plan.integrations.length) {
+    if (plan.scope === 'all') {
       clientPolicy = completeReleasePolicy(readObject(effects, record.sourcesPath, 'Server source policy'), plan.sourcePolicy);
       effects.out(heading('Connect local clients'));
       const handoff = await effects.prepareLocalClient(record, plan.integrations, plan.fleetSettingsPath);
       clientConfig = handoff.configPath;
     }
   }
-  if (plan.scope !== 'server' && plan.integrations.length) {
+  if (plan.scope !== 'server') {
     const result = await client({ role: 'client', operation: 'install', config: clientConfig,
       integrations: plan.integrations, fleetSettingsPath: plan.fleetSettingsPath, sourcePolicy: clientPolicy,
-      preset: true, nonInteractive: !plan.interactive }, effects);
+      disableFleetAgentsSetup: plan.disableFleetAgentsSetup, preset: true, nonInteractive: !plan.interactive }, effects);
     if (result !== 0) return result;
   }
+  if (plan.disableFleetAgentsSetup && plan.integrations?.includes('fleet')) effects.out(info('Fleet is installed. Run ours-fleet setup-tunnel with the private expiring App setup file, then ours-fleet link-device. Configure agents and models in the App after linking.'));
   effects.out(ok(`Requested ${plan.operation} completed. Existing identities were retained.`));
-  if (plan.integrations?.includes('fleet')) effects.out(info('Fleet is configured but stopped. Review its settings, then run ours-fleet doctor, ours-fleet config and ours-fleet up.'));
+  if (plan.integrations?.includes('fleet') && !plan.disableFleetAgentsSetup) effects.out(info('Fleet is configured but stopped. Review its settings, then run ours-fleet doctor, ours-fleet config and ours-fleet up.'));
   return 0;
 }
 
@@ -144,12 +153,20 @@ export async function runSetup(argv, effects) {
     if (argv[0] === 'server' && maintenance.has(argv[1])) return await runServerCommand(parseNetworkArgs(argv), effects);
     if (!argv.length && effects.env?.OURS_ASSUME_YES) throw new InstallUsageError('OURS_ASSUME_YES cannot fill an interactive setup plan. Supply complete CLI presets for unattended installation.');
     if (!argv.length) { effects.out(banner()); effects.out(heading('Interactive setup')); }
-    const options = argv.length ? parseSetupArgs(argv, { home: effects.home }) : await collectSetupOptions(effects);
+    let options;
+    if (argv.length) {
+      const presets = parseSetupArgs(argv, { home: effects.home, validate: false });
+      try { options = validateSetupOptions(presets, { interactive: false }); }
+      catch (error) {
+        if (!effects.interactive || effects.env?.OURS_ASSUME_YES || !/^Missing (required setup options|human profile option):/.test(error.message)) throw error;
+        options = await collectSetupOptions(effects, presets);
+      }
+    } else options = await collectSetupOptions(effects);
     const plan = await prepareSetupPlan(options, effects);
     return await executeSetupPlan(plan, effects);
   } catch (error) {
     if (isCancel(error)) { effects.out(warn('Installation cancelled.')); return 130; }
-    effects.out(warn(`ours-install: ${error.message}`));
+    effects.out(warn(`ours-install: ${installerFailure(error, effects.env)}`));
     return 2;
   }
 }

package/lib/target.mjs

@@ -1,3 +1,4 @@
+import { serverBase } from './gateway.mjs';
 // ours-install v3 — argument handling and daemon detection.
 //
 // Pure argument handling and daemon-target selection. The orchestrator
@@ -85,17 +86,30 @@ export function validateHostProfile(value) {
   const mixed = LEGACY_PROFILE_KEYS.filter((key) => Object.hasOwn(value, key));
   if (mixed.length) throw profileError(`legacy selection keys cannot be mixed with a host profile (${mixed.join(', ')}).`);
   const { endpoint, expectedInstanceId, credentialPath } = value;
-  if (typeof endpoint !== 'string' || endpoint.trim() !== endpoint || endpoint === '') throw profileError('endpoint must be a non-empty HTTP origin.');
+  if (typeof endpoint !== 'string' || endpoint.trim() !== endpoint || endpoint === '') throw profileError('endpoint must be a non-empty HTTP or HTTPS base URL.');
   if (typeof expectedInstanceId !== 'string' || !PROFILE_UUID.test(expectedInstanceId)) throw profileError('expectedInstanceId must be a lowercase UUID.');
   if (typeof credentialPath !== 'string' || credentialPath === '' || !credentialPath.startsWith('/') || resolve(credentialPath) !== credentialPath) {
     throw profileError('credentialPath must be a normalized absolute path.');
   }
   let url;
-  try { url = new URL(endpoint); } catch { throw profileError('endpoint must be an HTTP origin.'); }
-  if (url.protocol !== 'http:' || url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
-    throw profileError('endpoint must be an HTTP origin without credentials, path, query, or fragment.');
+  try { url = new URL(endpoint); } catch { throw profileError('endpoint must be an HTTP or HTTPS base URL.'); }
+  if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password || url.search || url.hash) {
+    throw profileError('endpoint must be an HTTP or HTTPS base URL without credentials, query, or fragment.');
   }
-  return { endpoint: url.origin, expectedInstanceId, credentialPath };
+  const endpointBase = serverBase(endpoint);
+  if (value.serverUrl !== undefined) {
+    const serverUrl = serverBase(value.serverUrl);
+    if (endpointBase !== serverUrl + '/daemon') throw profileError('endpoint must select serverUrl/daemon.');
+    return { serverUrl, endpoint: endpointBase, expectedInstanceId, credentialPath };
+  }
+  return { endpoint: endpointBase, expectedInstanceId, credentialPath };
+}
+
+/** Client installs require the single gateway even when a legacy server profile exists. */
+export function validateGatewayClientProfile(value) {
+  if (!value || typeof value.serverUrl !== 'string') throw profileError('serverUrl is required; enable the server gateway and import its client profile. Direct daemon endpoints are not client routes.');
+  const serverUrl = serverBase(value.serverUrl);
+  return validateHostProfile({ ...value, endpoint: value.endpoint ?? serverUrl + '/daemon' });
 }
 
 export function resolveProfileSelection({ args, env = {}, home = homedir(), exists, readProfile }) {
@@ -454,10 +468,11 @@ export function searchFreePort(isTaken, { floor = FREE_PORT_FLOOR, reserved = IN
 export function parseNetworkArgs(argv) {
   if (!['server', 'client'].includes(argv[0])) return null;
   const [role, operation] = argv;
-  const operations = role === 'client' ? ['install'] : ['install', 'status', 'start', 'stop', 'restart', 'access-issue', 'access-replace', 'backup', 'restore', 'reset', 'update', 'rebuild'];
+  const operations = role === 'client' ? ['install'] : ['install', 'status', 'start', 'stop', 'restart', 'access-issue', 'access-replace', 'backup', 'restore', 'reset', 'update', 'rebuild', 'gateway-enable'];
   if (!operations.includes(operation)) throw new InstallUsageError(`Unsupported ${role} operation: ${operation ?? '(missing)'}`);
   const allowed = role === 'client' ? ['config'] : ['state-dir'];
-  if (role === 'server' && operation === 'install') allowed.push('mode', 'sources', 'migrate');
+  if (role === 'server' && operation === 'install') allowed.push('mode', 'sources', 'migrate', 'container-engine');
+  if (role === 'server' && ['install', 'gateway-enable'].includes(operation)) allowed.push('server-url');
   if (operation === 'access-issue') allowed.push('output');
   if (['access-replace', 'reset'].includes(operation)) allowed.push('confirm');
   if (['restore', 'update'].includes(operation)) allowed.push('compatible');
@@ -486,13 +501,14 @@ export function parseNetworkArgs(argv) {
     } else {
       const value = inline ?? argv[++i];
       if (!value || value.startsWith('--')) throw new InstallUsageError(`--${name} requires a value`);
-      result[key] = name === 'mode' ? value : resolve(value);
+      result[key] = ['mode', 'container-engine'].includes(name) ? value : name === 'server-url' ? serverBase(value) : resolve(value);
     }
   }
   const required = role === 'client' ? [] : ['stateDir'];
   if (operation === 'access-issue') required.push('output');
   if (['access-replace', 'reset'].includes(operation)) required.push('confirm');
   for (const key of required) if (!result[key]) throw new InstallUsageError(`${operation} requires --${key.replace(/[A-Z]/g, c => '-' + c.toLowerCase())}`);
+  if (result.containerEngine !== undefined && (result.mode !== 'docker' || !['docker', 'podman'].includes(result.containerEngine))) throw new InstallUsageError('--container-engine docker|podman requires --mode docker');
   if (result.mode && !['packages', 'docker'].includes(result.mode)) throw new InstallUsageError('--mode must be packages or docker');
   return result;
 }

package/lib/uninstall.mjs

@@ -174,13 +174,13 @@ export function planDaemonRemoval({ stateDir, cliStartedIt }) {
   const service = {
     id: 'service',
     unit: unit.ok ? unit.unit : null,
-    command: ['ours', 'daemon', 'uninstall-service', '--yes', '--state-dir', dir, '--config', join(dir, 'config.json')],
+    command: ['ours-daemon', 'uninstall-service', '--yes', '--state-dir', dir, '--config', join(dir, 'config.json')],
     note: 'removes the unit managed by the ours CLI',
   };
   return [
     service,
     cliStartedIt
-      ? { id: 'stop', command: ['ours', 'daemon', 'stop', '--state-dir', dir, '--config', join(dir, 'config.json')] }
+      ? { id: 'stop', command: ['ours-daemon', 'stop', '--state-dir', dir, '--config', join(dir, 'config.json')] }
       : { id: 'stop-external', command: null, continues: true, note: 'this daemon was not started by the CLI; naming its launcher and continuing' },
   ];
 }

package/lib/usage.mjs

@@ -1,10 +1,15 @@
 // Public setup and maintenance commands.
-export const USAGE = `ours-install — interactive setup or complete CLI presets.
+export const USAGE = `ours-install — interactive setup with optional CLI presets.
 
   ours-install
     Opens the console form. Choose all (server + clients), server, or client;
     runtime, installation directory, identity, integrations and Fleet settings.
-    Linux x64 recommends native; macOS/Windows recommend Docker. Windows uses WSL.
+    Full setup runs the server in Docker or Podman, which provide the gateway local clients need.
+    Native mode is offered for server-only setup. Windows uses WSL.
+
+  Install now, configure Fleet agents in the App after linking:
+    ours-install --username alex --name Alex --surname Taylor --disable-fleet-agents-setup
+    Remaining installation choices are prompted on a terminal. No enrollment credentials or expiry.
 
   Full stack, with every required answer preset (no prompts):
     ours-install --mode docker --state-dir /private/ours --identity-name "Your Name" --integrations codex,fleet --fleet-settings /private/fleet.json
@@ -22,13 +27,20 @@ export const USAGE = `ours-install — interactive setup or complete CLI presets
   --scope all|server|client   preset which parts to configure (default all)
   --action install|update    equivalent to the positional operation
   --mode docker|native      packages is also accepted for native mode
+  --container-engine docker|podman  server container backend (default Docker); retained for maintenance
   --state-dir PATH          installation root; required for all/server
+  --username USERNAME       local username; no global uniqueness check
+  --name NAME               Messenger given name
+  --surname SURNAME         Messenger family name
+  --hostname NAME           optional host/workspace name; defaults to this machine
+  --disable-fleet-agents-setup  install Fleet CLI without its roles/model wizard
   --identity-name NAME      desired Human name for a fresh server; existing root is retained
   --integrations LIST       codex,claude-code,fleet; use none to skip clients explicitly
-  --fleet-settings PATH     JSON settings for Fleet; mandatory for CLI presets selecting Fleet
+  --fleet-settings PATH     JSON settings for Fleet; required unless Fleet agents setup is disabled
   --config PATH             complete connection profile for client-only setup
   --sources PATH            explicit full development source policy override
-  --port N                  daemon port (default 3050 on a fresh installation)
+  --port N                  public gateway port for Docker (default 3050; e.g. 4050)
+  --server-url URL          external gateway URL (Docker install; configure authenticated entry separately)
   --cowork-port N           cowork port (default 3052)
   --messenger-port N        messenger port (default 8420)
   --compatible              required for server updates and legacy state migration
@@ -39,13 +51,14 @@ export const USAGE = `ours-install — interactive setup or complete CLI presets
   --help, -h                show help
   --version, -V             print installer version
 
-CLI presets must be complete and never open the interactive form or a Fleet wizard.
-Missing answers are reported before installation. Both input modes run the same
+Partial CLI presets on a terminal ask for the remaining choices. Without a terminal,
+or with OURS_ASSUME_YES, supply complete CLI presets; missing answers fail before installation. Both input modes run the same
 installer with preparation, identity restoration, update and readiness progress.
 Fleet is configured but left stopped for operator review.
 
 Scoped maintenance:
   ours-install server status|start|stop|restart|rebuild --state-dir PATH
+  ours-install server gateway-enable --state-dir PATH [--server-url URL]
   ours-install server access-issue --state-dir PATH --output PATH
   ours-install server access-replace --state-dir PATH --confirm
   ours-install server backup|restore server|daemon|telegram|cowork|messenger LABEL --state-dir PATH

package/lib/workspace-setup.mjs

@@ -0,0 +1,83 @@
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join,resolve } from 'node:path';
+import {parseSetupArgs} from './setup-options.mjs';
+/** Base64 is transport, not encryption. Broad provider credentials are never accepted. */
+export function decodeWorkspacePayload(encoded,now=Date.now()) {
+  if(typeof encoded!=='string' || encoded.length>32768 || !/^[A-Za-z0-9_-]+$/.test(encoded.trim()))throw Error('Invalid private workspace payload');
+  let p;try{p=JSON.parse(Buffer.from(encoded.trim(),'base64url'));}catch{throw Error('Invalid private workspace payload');}
+  const allowed=['version','appOrigin','hostname','rootName','name','surname','connectorToken','invitation','serverCid','challenge'];
+  if(!p || Object.keys(p).some(k=>!allowed.includes(k)) || p.version!==1 || !['https://app.ours.network','https://app.ours-tunnel.com'].includes(p.appOrigin) || !/^[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid))throw Error('Invalid workspace payload boundary');
+  for(const key of ['name','surname','connectorToken','invitation'])if(typeof p[key]!=='string' || !p[key].trim() || p[key].length>8192 || /[\x00-\x1f\x7f]/.test(p[key]))throw Error('Invalid private workspace payload');
+  if(!p.challenge || !['nonce','accountId','workspaceId'].every(k=>/^[\w-]{43}$/.test(p.challenge[k])) || !Number.isFinite(p.challenge.expiresAt) || p.challenge.expiresAt<=now || p.challenge.expiresAt>now+16*60000)throw Error('Workspace challenge expired or invalid');
+  return p;
+}
+export function extractWorkspaceArgs(args){
+  const flags=['--setup-workspace','--setup-workspace-file','--workspace-fleet-bin','--fleet-settings'];const values={},rest=[];
+  for(let i=0;i<args.length;i++){const at=args[i].indexOf('='),flag=at<0?args[i]:args[i].slice(0,at);if(!flags.includes(flag)){rest.push(args[i]);continue;}if(values[flag]!==undefined)throw Error('Duplicate workspace flag');const value=at<0?args[++i]:args[i].slice(at+1);if(!value || value.startsWith('--'))throw Error('Workspace flag requires a value');values[flag]=value;}
+  if(values['--setup-workspace'] && values['--setup-workspace-file'])throw Error('Choose one private payload transport');
+  return {values,rest};
+}
+export async function runWorkspaceSetup(args,effects,runSetup){
+  const migrateAppOrigin=args.includes('--workspace-migrate-app-origin');
+  if(args.filter(arg=>arg==='--workspace-migrate-app-origin').length>1)throw Error('Duplicate workspace migration flag');
+  const {values,rest}=extractWorkspaceArgs(args.filter(arg=>arg!=='--workspace-migrate-app-origin'));let encoded;
+  if(values['--setup-workspace-file']){const path=resolve(values['--setup-workspace-file']),stat=lstatSync(path);if(!stat.isFile() || stat.isSymbolicLink() || stat.nlink!==1 || stat.uid!==process.getuid?.() || stat.size>32768 || (stat.mode&0o077)!==0)throw Error('Setup file must be owned and private (chmod 600)');encoded=readFileSync(path,'utf8').trim();}
+  else if(values['--setup-workspace']==='-'){const chunks=[];let bytes=0;for await(const chunk of process.stdin){bytes+=chunk.length;if(bytes>32768)throw Error('Private payload too large');chunks.push(chunk);}encoded=Buffer.concat(chunks).toString().trim();}
+  else encoded=values['--setup-workspace'];
+  const p=decodeWorkspacePayload(encoded),fleetBin=values['--workspace-fleet-bin'] || 'ours-fleet';
+  const parsed=parseSetupArgs(rest,{home:effects.home,validate:false});
+  if(parsed.scope==='server')throw Error('Workspace setup requires all or client scope');
+  if(parsed.identityName!==undefined || parsed.integrations!==undefined)throw Error('Workspace setup supplies identity and client integration selection');
+  // Check feature availability before changing an installation. Task acceptance uses
+  // an exact task-built binary; @latest cannot contain an unmerged feature.
+  const root=parsed.stateDir || join(effects.home,'.ours-network','workspace'),fleetSettings=values['--fleet-settings'];
+  // The saved gateway profile selects the actual host, including non-default server state.
+  // Reuse it directly: server/client reinstall would also rewrite or downgrade retained setup.
+  const managed=effects.readManagedClientProfile?.();
+  const managedPath=join(effects.home,'.ours-client','profile.json');
+  const existingProfile=parsed.config || effects.env?.OURS_CONFIG || (managed?managedPath:undefined);
+  const existing=Boolean(existingProfile);
+  const marker=join(effects.home,'.ours-client','workspace-setup-pending.json');
+  let pending;
+  if(existsSync(marker)){
+    const stat=lstatSync(marker);
+    if(!stat.isFile() || stat.isSymbolicLink() || stat.nlink!==1 || stat.uid!==process.getuid?.() || (stat.mode&0o077)!==0 || stat.size>4096)throw Error('Workspace retry marker must be owned and private');
+    pending=JSON.parse(readFileSync(marker,'utf8'));
+    if(pending.version!==1 || pending.accountId!==p.challenge.accountId || pending.workspaceId!==p.challenge.workspaceId || pending.appOrigin!==p.appOrigin)throw Error('Pending fresh installation belongs to another workspace; identity was not changed. Resume the original workspace, or back up the host and remove only ~/.ours-client/workspace-setup-pending.json to treat it as existing (preserving its profile)');
+  }
+  const preserveProfile=existing && !pending;
+  if(existing && parsed.scope && parsed.scope!=='client')throw Error('Existing workspace setup requires client scope; root identity was not changed');
+  if(!existing && !pending && (existsSync(join(root,'installation.json')) || existsSync(join(effects.home,'fleet.yaml'))))throw Error('Existing host requires its gateway client profile; no new root was created');
+  const options=[...rest];
+  if(!parsed.scope)options.push('--scope',existing?'client':'all');
+  if(existing && !parsed.config)options.push('--config',existingProfile);
+  if(!existing){if(!parsed.mode)options.push('--mode','docker');if(!parsed.stateDir)options.push('--state-dir',root);options.push('--identity-name',p.rootName);}
+  options.push('--integrations','none');
+  parseSetupArgs(options,{home:effects.home});
+  if(preserveProfile){
+    const version=await effects.run(fleetBin,['version','--json'],{sensitive:true});
+    let info;try{info=JSON.parse(version.stdout);}catch{}
+    if(!version.ok || !info?.capabilities?.includes('workspace.enroll.preserve-profile-v1'))throw Error('Existing-host setup requires a profile-preserving Fleet release; nothing was changed');
+  }
+  const help=await effects.run(fleetBin,['workspace-enroll','--help'],{sensitive:true});if(!help.ok)throw Error('Fleet workspace enrollment is unavailable');
+  const tunnel=await effects.run('cloudflared',['--version'],{sensitive:true});if(!tunnel.ok)throw Error('Tunnel connector is unavailable');
+  if(options.includes('--dry-run')){if(!existing)return runSetup(options,effects);return 0;}
+  if(!existing){
+    if(!pending){mkdirSync(join(effects.home,'.ours-client'),{recursive:true,mode:0o700});writeFileSync(marker,JSON.stringify({version:1,accountId:p.challenge.accountId,workspaceId:p.challenge.workspaceId,appOrigin:p.appOrigin})+'\n',{mode:0o600,flag:'wx'});}
+    const result=await runSetup(options,effects);if(result!==0)return result;
+  }
+  const selected=existingProfile || effects.readManagedClientProfile();if(!selected)throw Error('Workspace client profile was not installed');
+  const env={OURS_CONFIG:existingProfile || managedPath};
+  for(const key of ['OURS_PORT','OURS_STATE_DIR','OURS_API_TOKEN','OURS_DAEMON_ID','OURS_DAEMON_URL','OURS_DAEMON_CREDENTIAL_PATH'])env[key]=undefined;
+  const fleetHome=effects.env?.OURS_FLEET_HOME || effects.home,fleetConfig=join(fleetHome,'fleet.yaml');
+  if(!existsSync(fleetConfig)){
+    const initArgs=['init',...(fleetSettings?['--settings',fleetSettings]:[])];
+    const initialized=fleetSettings?await effects.run(fleetBin,initArgs,{env}):await effects.runInteractive(fleetBin,initArgs,{env});if(!initialized.ok)throw Error('Fleet configuration incomplete');
+  }
+  mkdirSync(root,{recursive:true,mode:0o700});const temporary=mkdtempSync(join(root,'.workspace-payload-'));chmodSync(temporary,0o700);
+  const payloadFile=join(temporary,'payload');writeFileSync(payloadFile,encoded,{mode:0o600,flag:'wx'});
+  try{const enrolled=await effects.run(fleetBin,['workspace-enroll','--file',payloadFile,...(preserveProfile?['--preserve-profile']:[]),...(migrateAppOrigin?['--migrate-app-origin']:[])],{env,stream:true,sensitive:true});if(!enrolled.ok)throw Error('Workspace enrollment incomplete; existing identity and profile were retained');}
+  finally{rmSync(temporary,{recursive:true,force:true});}
+  if(pending || !existing)rmSync(marker);
+  effects.out('Workspace proof submitted. Check verified binding/tunnel status in your account, then scan or paste the private device code.');return 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.3",
+  "version": "1.2.1-nightly.31",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",
@@ -15,7 +15,9 @@
     "uninstall.mjs",
     "uninstall.sh",
     "README.md",
-    "LICENSE"
+    "ROOTLESS_PODMAN_VALIDATION.md",
+    "LICENSE",
+    "GATEWAY_SETUP.md"
   ],
   "license": "FSL-1.1-Apache-2.0",
   "author": "Adapt Toolkit",