@ours.network/install 1.2.1-nightly.41 → 1.2.1-nightly.43

package/lib/docker-recovery.mjs

@@ -2,6 +2,7 @@ import { readFileSync, lstatSync, realpathSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { atomicWriteConfig } from './config.mjs';
 import { engineName, runContainer } from './container-engine.mjs';
+import { isPluginOnly } from './product.mjs';
 
 const assets = new URL('../assets/', import.meta.url);
 const files = ['scripts/runtime/recover.mjs', 'scripts/runtime/dependency-ready.mjs',
@@ -23,11 +24,15 @@ export function refreshDockerRecovery(record) {
     atomicWriteConfig(marker, 'required\n'); changed = true;
     atomicWriteConfig(path, bytes.toString());
   };
-  for (const name of files) replace(name, readFileSync(new URL(name, assets)));
+  // Plugin-only daemons also serve the client prefix from the image.
+  const selected = isPluginOnly(record) ? [...files, 'scripts/runtime/daemon-client-prefix.mjs'] : files;
+  for (const name of selected) replace(name, readFileSync(new URL(name, assets)));
   const dockerfile = join(record.workDir, 'Dockerfile'); owned(dockerfile);
   const text = readFileSync(dockerfile, 'utf8');
   const line = 'COPY --chmod=644 scripts/runtime/recover.mjs scripts/runtime/dependency-ready.mjs /opt/ours/docker/';
   if (!text.includes('scripts/runtime/recover.mjs')) replace('Dockerfile', Buffer.from(text.replace('FROM node:24 AS maintenance', `${line}\nFROM node:24 AS maintenance`)));
+  const prefixLine = 'COPY --chmod=644 scripts/runtime/daemon-client-prefix.mjs /opt/ours/docker/daemon-client-prefix.mjs';
+  if (isPluginOnly(record) && !readFileSync(dockerfile, 'utf8').includes(prefixLine)) replace('Dockerfile', Buffer.from(readFileSync(dockerfile, 'utf8').replace('FROM node:24 AS maintenance', `${prefixLine}\nFROM node:24 AS maintenance`)));
   return changed || existsSync(marker);
 }
 

package/lib/effects.mjs

@@ -17,15 +17,16 @@ import { engineName, bindPodman, runContainer, nativeBuildCommands } from './con
 import { publishClientCli } from './client-cli.mjs';
 import { commandFailure } from './diagnostics.mjs';
 import { spawnSync, execFileSync } from 'node:child_process';
-import { chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, mkdirSync, mkdtempSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, userInfo, platform as osPlatform, release as osRelease, arch as osArch } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { randomUUID, createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
+import { connect as netConnect } from 'node:net';
 import { clientPackageNames, maintenanceServices, installationPaths, validateInstallation, consumerServiceState, unitNameForStateDir, launchdLabelForStateDir, messengerServicePlan, selectSourcePackages, resolveSourcePolicy, SERVER_SERVICES } from './plan.mjs';
 import { validateHostProfile, validateGatewayClientProfile } from './target.mjs';
 import { serverBase, validateGatewayDiscovery, gatewayCompose, gatewayNginx, gatewayAddress } from './gateway.mjs';
-import { createServerOnboarding } from './server-onboarding.mjs';
+import { createServerOnboarding, retainedCredentialRefused } from './server-onboarding.mjs';
 import { atomicWriteConfig, snapshotConfig, restoreConfig } from './config.mjs';
 import { select as selectOnTty, multiselect as multiselectOnTty, askLine as askLineOnTty } from './prompt.mjs';
 import { classifyHarnessProbe } from './logic.mjs';
@@ -33,10 +34,24 @@ import { qualifyDockerRuntime, refreshDockerPolicyCopy } from './docker-runtime-
 import { refreshDockerRecovery, recoveryCompose, reconcileDockerRecovery } from './docker-recovery.mjs';
 import { reportBootReadiness } from './boot-readiness.mjs';
 import { classifyStateDir } from './detect.mjs';
+import { isPluginOnly, serverRole, pluginOnlyCompose, PLUGIN_ONLY_COMPOSE } from './product.mjs';
+import { OWNERS_FILE, OWNED_IMAGES_FILE, addOwner, ownedImagesRecord, changedImages } from './ownership.mjs';
+import { IMAGE_TARGETS } from './removal-plan.mjs';
 import { BASE_RECORDS, CONTEXT, readBuildRecords, equalBuildRecords, initializeBuildMarker } from '../assets/scripts/maintenance/build-context.mjs';
 import { hostCliPolicy, releaseBinding, verifyReleaseGraph, verifyRuntimeRelease } from '../assets/scripts/maintenance/release-graph.mjs';
 
 /** GET http://127.0.0.1:<port>/state-dir — the unauthenticated identity probe. */
+/** Whether anything accepts TCP connections on a loopback port: 'refused', 'open', or 'unknown' (timeout or other error). */
+function portState(port, { timeoutMs = 1500 } = {}) {
+  return new Promise(done => {
+    const socket = netConnect({ host: '127.0.0.1', port });
+    const finish = state => { socket.destroy(); done(state); };
+    socket.setTimeout(timeoutMs, () => finish('unknown'));
+    socket.once('connect', () => finish('open'));
+    socket.once('error', error => finish(error?.code === 'ECONNREFUSED' ? 'refused' : 'unknown'));
+  });
+}
+
 async function probePort(port, { timeoutMs = 1500 } = {}) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -338,6 +353,40 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
         closeSync(fd);
       }
     },
+    /**
+     * Removal holds the installation lock of every root it removes for the
+     * whole run, so no installer operation can start inside a root being deleted.
+     */
+    async holdInstallationLocks(roots) {
+      const { tryLock } = await import('../assets/scripts/maintenance/state-native.mjs');
+      const held = [];
+      try {
+        for (const root of roots) {
+          if (!existsSync(root)) continue;
+          privateDirectory(root);
+          const path = join(root, '.operation.lock');
+          const fd = openSync(path, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+          held.push(fd);
+          const stat = fstatSync(fd);
+          if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 0o077) || stat.nlink !== 1) throw new Error(`Unsafe installation lock in ${root}`);
+          if (!tryLock(fd)) throw new Error(`Another installer operation is active in ${root}; try again when it has finished`);
+        }
+      } catch (error) {
+        for (const fd of held) closeSync(fd);
+        throw error;
+      }
+      return () => { for (const fd of held) { try { closeSync(fd); } catch { /* released */ } } };
+    },
+    /** lstat as a plain record; null when absent. Never follows a link. */
+    stat: (path) => {
+      try {
+        const st = lstatSync(path, { bigint: true });
+        return { type: st.isSymbolicLink() ? 'symlink' : st.isDirectory() ? 'dir' : st.isFile() ? 'file' : 'other', uid: Number(st.uid), mode: Number(st.mode & 0o7777n), nlink: Number(st.nlink), size: Number(st.size), id: `${st.dev}:${st.ino}` };
+      } catch (error) { if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return null; throw error; }
+    },
+    realpath: (path) => { try { return realpathSync(path); } catch { return null; } },
+    list: (path) => { try { return readdirSync(path); } catch { return null; } },
+    uid: process.getuid?.() ?? -1,
     home,
     env,
     version,
@@ -352,6 +401,9 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
     // pure planner already gated four ways, and this deletes exactly that.
     removeDir: (path) => { rmSync(resolve(path), { recursive: true, force: true }); },
     removeFile: (path) => { rmSync(resolve(path), { force: true }); },
+    removeEmptyDir: (path) => { rmdirSync(resolve(path)); },
+    renamePath: (from, to) => { renameSync(resolve(from), resolve(to)); },
+    sleep: (ms) => new Promise(done => setTimeout(done, ms)),
     copyDir: (source, destination) => {
       mkdirSync(dirname(resolve(destination)), { recursive: true, mode: 0o700 });
       cpSync(resolve(source), resolve(destination), {
@@ -386,6 +438,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
     brokerUrl: env.OURS_BROKER_URL ?? 'wss://broker1.ours.network',
     now: () => Date.now(),
     probe: (port) => probePort(port),
+    portState: (port) => portState(port),
     isTaken: (port) => portTakenSync(port),
     readJson: readJsonFile,
     readProfile: readHostProfileFile,
@@ -463,7 +516,7 @@ export function realEffects({ write, ttyFd, env = process.env, home = homedir(),
   return Object.assign(effects, networkEffects(effects));
 }
 
-export const __testables = { probePort, portTakenSync, readJsonFile, readTextFile, readHostProfileFile, verifyHostProfile, installedVersionOf, packageDependenciesOf, resolvePackageVersion, codexMarketplace, hasClaudePlugin, knownStateDirsIn };
+export const __testables = { probePort, portState, portTakenSync, readJsonFile, readTextFile, readHostProfileFile, verifyHostProfile, installedVersionOf, packageDependenciesOf, resolvePackageVersion, codexMarketplace, hasClaudePlugin, knownStateDirsIn };
 
 // -----------------------------------------------------------------------------
 // THE PAIR
@@ -560,6 +613,7 @@ export function networkEffects(effects) {
     ...(record.gateway ? ['--file', join(record.workDir, 'docker-compose.gateway.yaml')] : []),
     ...(existsSync(join(record.workDir, 'compose.recovery.json')) ? ['--file', join(record.workDir, 'compose.recovery.json')] : []),
     ...(engineName(record) === 'podman' ? ['--file', join(record.workDir, 'compose.podman.json')] : []),
+    ...(isPluginOnly(record) ? ['--file', join(record.workDir, PLUGIN_ONLY_COMPOSE)] : []),
     '--project-name', record.project, ...args,
   ];
   const container = (record, args, options = {}) => runContainer(effects, record, args, options);
@@ -647,6 +701,7 @@ export function networkEffects(effects) {
     }
   };
   return {
+    credentialRefused: profile => retainedCredentialRefused(profile),
     ...createServerOnboarding(effects, { compose, localEnv, bin }),
     sourcePolicyHash(path) {
       return createHash('sha256').update(readFileSync(path)).digest('hex');
@@ -673,7 +728,7 @@ export function networkEffects(effects) {
         return version;
       });
     },
-    newInstallation(root, mode, { containerEngine } = {}) {
+    newInstallation(root, mode, { containerEngine, product } = {}) {
       if (existsSync(root)) {
         privateDirectory(root);
         if (readdirSync(root).some(name => name !== '.operation.lock')) throw new Error('Installation root is not empty and has no selection record');
@@ -681,7 +736,10 @@ export function networkEffects(effects) {
       const instanceId = env.OURS_DAEMON_ID || randomUUID();
       if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(instanceId)) throw new Error('OURS_DAEMON_ID must be a lowercase UUID');
       const project = `ours-${createHash('sha256').update(root).digest('hex').slice(0, 16)}`;
-      return { schema: 2, root, mode, ...(containerEngine ? { containerEngine } : {}), instanceId, project, workDir: join(root, 'runtime'), configPath: installationPaths({ schema: 2, root }).config, sourcesPath: join(root, 'sources.json'), services: [...SERVER_SERVICES, ...(mode === 'docker' ? ['gateway'] : [])], ...(mode === 'docker' ? { gateway: { version: 1 } } : {}), port: 3050, coworkPort: 3052, messengerPort: 8420, messengerIdentity: env.OURS_MESSENGER_IDENTITY || null, uid: 1000, gid: 1000 };
+      if (isPluginOnly(product ?? 'workspace') && mode !== 'docker') throw new Error('Collaboration tools for existing agent apps run in Docker or Podman');
+      const services = isPluginOnly(product ?? 'workspace') ? ['daemon'] : [...SERVER_SERVICES, ...(mode === 'docker' ? ['gateway'] : [])];
+      const gateway = mode === 'docker' && !isPluginOnly(product ?? 'workspace');
+      return { schema: 2, root, mode, ...(isPluginOnly(product ?? 'workspace') ? { product } : {}), ...(containerEngine ? { containerEngine } : {}), instanceId, project, workDir: join(root, 'runtime'), configPath: installationPaths({ schema: 2, root }).config, sourcesPath: join(root, 'sources.json'), services, ...(gateway ? { gateway: { version: 1 } } : {}), port: 3050, coworkPort: 3052, messengerPort: 8420, messengerIdentity: env.OURS_MESSENGER_IDENTITY || null, uid: 1000, gid: 1000 };
     },
     async serverPreflight(record, operation, { existing, sourcePath = record.sourcesPath, sourceManifest, identityName, explicitPorts } = {}) {
       if (!existing && operation === 'install' && Number.isInteger(record.port)) selectServerPorts(record, portTakenSync, explicitPorts, effects.out);
@@ -748,7 +806,7 @@ export function networkEffects(effects) {
         await effects.run(effects.platform.platform === 'linux' ? 'systemctl' : 'launchctl', effects.platform.platform === 'linux' ? ['--user', 'show-environment'] : ['print', `gui/${process.getuid()}`]);
         if (operation === 'install') {
           for (const command of ['node', 'npm']) await effects.run(command, ['--version']);
-          const packages = selectSourcePackages(sourceManifest ?? effects.readJson(existing ? record.sourcesPath : sourcePath), 'server');
+          const packages = selectSourcePackages(sourceManifest ?? effects.readJson(existing ? record.sourcesPath : sourcePath), serverRole(record));
           if (Object.values(packages).some(selection => selection.source)) {
             // Native dependencies in source builds still use their own toolchains.
             for (const command of ['python3', 'git', 'make', 'cc']) await effects.run(command, ['--version']);
@@ -768,7 +826,7 @@ export function networkEffects(effects) {
     },
     async initializeSelection(record, manifest, { retainConfig = false } = {}) {
       if (typeof manifest === 'string') manifest = JSON.parse(readFileSync(manifest, 'utf8'));
-      selectSourcePackages(manifest, 'server');
+      selectSourcePackages(manifest, serverRole(record));
       const bytes = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`);
       ensurePrivateDirectory(record.root);
       if (record.schema === 2) {
@@ -841,6 +899,9 @@ export function networkEffects(effects) {
       if (!existsSync(materialized)) writePrivateNew(materialized, retained);
       else if (!readFileSync(materialized).equals(retained)) throw new Error('Materialized sources differ from retained selection');
       if (record.mode === 'docker') {
+        // Image IDs before this run builds anything: only what it creates or changes becomes proof.
+        const imagesBefore = runtimeOnly ? null : await effects.imageIds(record);
+        if (isPluginOnly(record)) atomicWriteConfig(join(record.workDir, PLUGIN_ONLY_COMPOSE), pluginOnlyCompose());
         if (engineName(record) === 'podman') atomicWriteConfig(join(record.workDir, 'compose.podman.json'), JSON.stringify({ services: Object.fromEntries(record.services.map(name => [name, { restart: 'unless-stopped' }])) }));
         const rebuildPrivateScripts = refreshDockerPolicyCopy(record);
         const rebuildRecovery = refreshDockerRecovery(record);
@@ -864,6 +925,9 @@ export function networkEffects(effects) {
         }
         if (runtimeOnly) return;
         await effects.prepareServerVolumes(record);
+        // Volume preparation may build the maintenance image; record after it.
+        const imagesAfter = await effects.imageIds(record);
+        await effects.recordOwnedImages(record, changedImages(imagesBefore, imagesAfter));
       } else {
         if (!existsSync(join(record.workDir, '.packages-ready'))) {
           const sourceRoot = join(record.root, `build-${randomUUID()}`);
@@ -903,7 +967,7 @@ export function networkEffects(effects) {
           ? Buffer.from(`${JSON.stringify(args.resolvedSources, null, 2)}\n`)
           : readFileSync(args.sources))
         : readFileSync(record.sourcesPath);
-      selectSourcePackages(JSON.parse(sources), 'server');
+      selectSourcePackages(JSON.parse(sources), serverRole(record));
       privateDirectory(record.root);
       const root = mkdtempSync(join(record.root, '.build-'));
       const candidate = { ...record, root, workDir: join(root, 'runtime'), sourcesPath: join(root, 'sources.json'),
@@ -915,6 +979,9 @@ export function networkEffects(effects) {
         await effects.prepareInstallation(candidate, { runtimeOnly: true });
         if (candidate.mode === 'docker') {
           await compose(candidate, ['build', 'state-operation']);
+          // The candidate's project name is new for this build: every image under it was
+          // built now. Record them with the installation so removal can prove them.
+          await effects.recordOwnedImages(record, await effects.imageIds(candidate));
           await effects.copyDockerBuildRecords(candidate, candidate.workDir);
         }
         // npm emits readable build records; maintenance consumes private copies.
@@ -941,6 +1008,15 @@ export function networkEffects(effects) {
       const stage = mkdtempSync(join(directory, '.records-'));
       const name = `${record.project}-records`;
       let created = false;
+      // An interrupted earlier run can leave its stopped helper behind; clear only that.
+      const stale = await container(record, ['container', 'inspect', name], { allowCodes: [1] });
+      const [value] = stale.code === 0 ? (() => { try { return JSON.parse(stale.stdout); } catch { return []; } })() : [];
+      if (value) {
+        const helper = value?.State?.Running === false && JSON.stringify(value?.Config?.Entrypoint) === JSON.stringify(['/bin/true'])
+          && value?.Config?.Image === `${record.project}:runtime`;
+        if (!helper) throw new Error(`A container named ${name} exists and is not this installer's stopped build-record helper; remove or rename it, then run the installer again`);
+        await container(record, ['rm', name]);
+      }
       try {
         await container(record, ['create', '--name', name, '--entrypoint', '/bin/true', `${record.project}:runtime`]);
         created = true;
@@ -1037,7 +1113,10 @@ export function networkEffects(effects) {
     },
     async publishServerBuild(record, candidate) {
       const previous = join(candidate.root, 'previous-runtime');
+      const built = {};
       if (record.mode === 'docker') {
+        const proven = effects.ownedImages(record);
+        const before = await effects.imageIds(record);
         for (const target of ['runtime', 'maintenance', ...(record.gateway ? ['gateway'] : [])]) {
           const retained = `${candidate.project}:previous-${target}`;
           const found = await container(record, ['image', 'inspect', retained], { allowCodes: [1] });
@@ -1045,7 +1124,14 @@ export function networkEffects(effects) {
             const current = await container(record, ['image', 'inspect', `${record.project}:${target}`], { allowCodes: [1] });
             if (current.code === 0) await container(record, ['tag', `${record.project}:${target}`, retained]);
           }
+          // A retained copy is proven only when the image it copies already was.
+          const tag = `${record.project}:${target}`;
+          if (before[tag] && proven[tag] === before[tag]) built[retained] = before[tag];
         }
+        // The candidate project name is a random per-build name kept in the private
+        // record; its images were built by this update.
+        Object.assign(built, Object.fromEntries(Object.entries(await effects.imageIds(candidate, ['runtime', 'maintenance', ...(record.gateway ? ['gateway'] : [])]))
+          .map(([tag, id]) => [`${record.project}:${tag.slice(candidate.project.length + 1)}`, id])));
       }
       if (!existsSync(previous)) {
         privateDirectory(record.workDir);
@@ -1064,6 +1150,27 @@ export function networkEffects(effects) {
         }
       }
       atomicWriteConfig(record.sourcesPath, readFileSync(candidate.sourcesPath));
+      if (record.mode === 'docker') await effects.recordOwnedImages(record, built);
+    },
+    /** Current image IDs of this project's tags (only those that exist). */
+    async imageIds(record, targets = IMAGE_TARGETS) {
+      const images = {};
+      for (const target of targets) {
+        const tag = `${record.project}:${target}`;
+        const found = await container(record, ['image', 'inspect', '--format', '{{.Id}}', tag], { allowCodes: [1] });
+        if (found.code === 0 && /^sha256:[0-9a-f]{64}$/.test(found.stdout.trim())) images[tag] = found.stdout.trim();
+      }
+      return images;
+    },
+    ownedImages(record) {
+      const path = join(record.root, OWNED_IMAGES_FILE);
+      try { const value = JSON.parse(readFileSync(path, 'utf8')); return value?.schema === 1 && value.images && typeof value.images === 'object' ? value.images : {}; } catch { return {}; }
+    },
+    /** Add the IDs of images this run built; never adopts a tag it did not produce. */
+    async recordOwnedImages(record, built) {
+      const path = join(record.root, OWNED_IMAGES_FILE);
+      const next = ownedImagesRecord(existsSync(path) ? readFileSync(path, 'utf8') : null, built);
+      if (next) atomicWriteConfig(path, next);
     },
     async validateServerBuildState(record) {
       if (record.mode === 'docker') {
@@ -1299,6 +1406,19 @@ export function networkEffects(effects) {
       } else await nativeLifecycle(record, 'retire', record.services, { effects, localEnv, ownerCommand, bin });
       effects.out('Managed services removed; installation selection, stored identities, credentials and volumes retained.');
     },
+    /**
+     * Stop a managed installation's services before its complete removal.
+     * Docker writers stop through Compose; containers are removed by project
+     * label afterwards. Native services are retired through their owners, which
+     * also removes their boot registrations.
+     */
+    async serverStopForRemoval(record) {
+      if (record.mode === 'docker') {
+        if (existsSync(record.workDir)) await effects.serverLifecycle(record, 'stop');
+        return;
+      }
+      await nativeLifecycle(record, 'retire', record.services, { effects, localEnv, ownerCommand, bin });
+    },
     async serverLifecycle(record, operation, selected = record.services) {
       record = buildRuntime(record);
       if (record.mode === 'docker') {
@@ -1436,6 +1556,14 @@ export function networkEffects(effects) {
       // This directory retains active executables, not disposable download cache.
       ensurePrivateDirectory(join(home, '.ours-client-install'));
       ensurePrivateDirectory(root);
+      // Record which installation this acquisition serves, for complete removal.
+      let owner = null;
+      try { owner = readHostProfileFile(configPath)?.expectedInstanceId ?? null; } catch { /* not yet imported */ }
+      const ownersPath = join(root, OWNERS_FILE);
+      try {
+        const ownerRecord = owner ? addOwner(existsSync(ownersPath) ? readFileSync(ownersPath, 'utf8') : null, owner) : null;
+        if (ownerRecord) atomicWriteConfig(ownersPath, ownerRecord);
+      } catch (error) { effects.out?.(`! ${error.message}; complete removal will leave ${root} in place and say so.`); }
       const retained = join(root, 'sources.json');
       const bytes = readFileSync(sourcesPath);
       if (!existsSync(retained)) writePrivateNew(retained, bytes);

package/lib/orchestrate-uninstall.mjs

@@ -91,7 +91,12 @@ export async function runUninstall(argv, effects) {
       effects.out(warn('Managed server uninstall does not support legacy component/profile selections. Nothing was changed; use an explicit server uninstall with those selectors cleared.'));
       return EXIT_REFUSED;
     }
-    if (purge) { effects.out(warn('Managed server uninstall retains identities and volumes; --purge is not supported.')); return EXIT_REFUSED; }
+    // Complete removal, including identities and volumes, is the separate,
+    // confirmed `ours-install remove`; --purge selects exactly that for this root.
+    if (purge) {
+      const { runRemoval } = await import('./removal.mjs');
+      return runRemoval(['--state-dir', dir, ...(args.dryRun ? ['--dry-run'] : [])], effects);
+    }
     if (args.dryRun) { effects.out(info('[dry-run] would stop and remove managed server services, retaining all stored data.')); return EXIT_OK; }
     const { runServerCommand } = await import('./orchestrate.mjs');
     return runServerCommand({ role: 'server', operation: 'uninstall', stateDir: dir }, effects);

package/lib/orchestrate.mjs

@@ -41,6 +41,7 @@ import { configJournal, reportRollback } from './journal.mjs';
 import { detectDaemons, planDaemonSelection, resolveSelection } from './detect.mjs';
 import { detectPlatform, resolveChannel } from './logic.mjs';
 import { daemonEnv } from './effects.mjs';
+import { productOf, serverRole, PRODUCT_LABELS } from './product.mjs';
 import {
   buildClaudeMarketplace, buildCodexMarketplace, marketplaceJson, marketplacePaths,
   validateChannelVersion,
@@ -931,6 +932,29 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
     let manual = plan.manual;
     if (exactSuite?.localPackages?.[plan.name]) {
       const registration = await effects.prepareClientMarketplace(plan.name, exactSuite.localPackages[plan.name]);
+      // Codex refuses to re-add a marketplace name from a new folder. An update
+      // moves it to a new download folder: replace only a registration that
+      // points into an earlier download folder of this installer.
+      if (plan.name === 'codex') {
+        const current = await effects.codexMarketplace?.();
+        const source = current?.marketplaceSource;
+        if (current && !(source?.sourceType === 'local' && source?.source === registration)) {
+          const earlier = source?.sourceType === 'local' && typeof source.source === 'string'
+            && /^[0-9a-f]{16}\/marketplaces\/codex$/.test(source.source.slice(join(effects.home, '.ours-client-install').length + 1))
+            && source.source.startsWith(join(effects.home, '.ours-client-install') + '/');
+          if (!earlier) {
+            const where = source?.source ?? 'another source';
+            effects.out(warn(`Codex already has a plugin source named ours-codex-marketplace from ${where}, which this installer did not create. It was left unchanged. Remove it with: codex plugin marketplace remove ours-codex-marketplace, then run the installer again.`));
+            rows.push({ ...row, state: 'failed', failedCommand: ['codex', 'plugin', 'marketplace', 'add', registration], failedStep: `Register ${plan.label} marketplace`, detail: `a different ours-codex-marketplace source (${where}) is registered` });
+            continue;
+          }
+          const moved = await attempt(effects, false, 'codex plugin marketplace remove ours-codex-marketplace (earlier download folder)', () => effects.run('codex', ['plugin', 'marketplace', 'remove', 'ours-codex-marketplace'], { env: profileEnv(target) }), clientDiagnostic);
+          if (!moved.ok) {
+            rows.push({ ...row, state: 'failed', failedCommand: ['codex', 'plugin', 'marketplace', 'remove', 'ours-codex-marketplace'], failedStep: `Move ${plan.label} marketplace`, detail: clientDiagnostic(moved.error) });
+            continue;
+          }
+        }
+      }
       const steps = plan.name === 'codex'
         ? [['codex', 'plugin', 'marketplace', 'add', registration], ['codex', 'plugin', 'add', 'ours@ours-codex-marketplace']]
         : [['claude', 'plugin', 'marketplace', 'add', registration], ['claude', 'plugin', await effects.hasClaudePlugin() ? 'update' : 'install', 'ours@ours.network']];
@@ -1377,6 +1401,7 @@ async function executeServerCommand(args, effects) {
     record = validateInstallation(record, args.stateDir);
     if (args.containerEngine && args.containerEngine !== (record.containerEngine ?? 'docker')) throw new Error('Conflicting container engine; explicit migration is required');
     if (args.mode && args.mode !== record.mode) throw new Error('Conflicting runtime mode; retained installation was not changed');
+    if (args.product && args.product !== productOf(record)) throw new Error(`This installation is ${PRODUCT_LABELS[productOf(record)].toLowerCase()}; it is kept as it is. Use a separate empty directory for the other kind of installation.`);
     if (args.operation !== 'update' && args.sources && (record.sourcePolicyHash
       ? effects.sourcePolicyHash(args.sources) !== record.sourcePolicyHash
       : effects.readText(args.sources) !== effects.readText(record.sourcesPath))) throw new Error('Conflicting source selection; use explicit server update');
@@ -1417,7 +1442,7 @@ async function executeServerCommand(args, effects) {
   if ((!existing || args.operation === 'update') && !record.buildTransition) {
     args.resolvedSources = await installStage('Package selection', 'Resolve the selected server packages before installation.', async () => {
       const policy = args.sourcePolicy ?? (args.sources ? effects.readJson(args.sources) : effects.packagedSourcePolicy());
-      return effects.resolveSourcePolicy(policy, 'server');
+      return effects.resolveSourcePolicy(policy, serverRole(record));
     });
   }
   if (!existing && args.sources) record.sourcePolicyHash = effects.sourcePolicyHash(args.sources);

package/lib/ownership.mjs

@@ -0,0 +1,63 @@
+// Ownership records written at installation time, read by complete removal.
+//
+// A client generation under ~/.ours-client-install can serve more than one
+// managed installation, and identical selections are not proof of who uses it.
+// Each acquisition therefore records the installation instances it was acquired
+// for. Server roots record the image IDs this installer built, so removal never
+// relies on an image name alone.
+import { join } from 'node:path';
+
+export const OWNERS_FILE = 'owners.json';
+export const OWNED_IMAGES_FILE = 'owned-images.json';
+const UUID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/;
+
+const IMAGE_ID = /^sha256:[0-9a-f]{64}$/;
+const IMAGE_TAG = /^ours-[a-z0-9]+:[a-z-]+$/;
+
+/** A generation's owner record: absent, invalid (damaged or unknown format) or the owner IDs. */
+export function readOwners(effects, generation) {
+  const text = effects.readText(join(generation, OWNERS_FILE));
+  if (text === null) return { state: 'absent' };
+  const instances = parseOwners(text);
+  return instances ? { state: 'valid', instances } : { state: 'invalid' };
+}
+
+function parseOwners(text) {
+  try {
+    const value = JSON.parse(text);
+    if (value?.schema !== 1 || !Array.isArray(value.instances) || value.instances.some(id => !UUID.test(id)) || Object.keys(value).length !== 2) return null;
+    return [...new Set(value.instances)];
+  } catch { return null; }
+}
+
+/**
+ * The next owner record for a generation, or null when nothing changes. A
+ * damaged record is never replaced: that would forget its earlier owners.
+ */
+export function addOwner(text, instanceId) {
+  if (!UUID.test(instanceId ?? '')) return null;
+  const instances = text === null || text === undefined ? [] : parseOwners(text);
+  if (instances === null) throw new Error('The owner record of the downloaded Ours programs is damaged; it was left unchanged');
+  if (instances.includes(instanceId)) return null;
+  return JSON.stringify({ schema: 1, instances: [...instances, instanceId] }, null, 2) + '\n';
+}
+
+/** The next owned-images record for a server root; a damaged record is left as it is. */
+export function ownedImagesRecord(text, images) {
+  let current = {};
+  if (text !== null && text !== undefined) {
+    let value;
+    try { value = JSON.parse(text); } catch { return null; }
+    if (value?.schema !== 1 || !value.images || typeof value.images !== 'object' || Array.isArray(value.images)
+      || Object.entries(value.images).some(([tag, id]) => !IMAGE_TAG.test(tag) || !IMAGE_ID.test(id))) return null;
+    current = value.images;
+  }
+  const added = Object.fromEntries(Object.entries(images ?? {}).filter(([tag, id]) => IMAGE_TAG.test(tag) && IMAGE_ID.test(id)));
+  const next = { ...current, ...added };
+  return JSON.stringify(current) === JSON.stringify(next) ? null : JSON.stringify({ schema: 1, images: next }, null, 2) + '\n';
+}
+
+/** Tags whose image this run created or replaced: a tag it found unchanged is never adopted. */
+export function changedImages(before, after) {
+  return Object.fromEntries(Object.entries(after ?? {}).filter(([tag, id]) => (before ?? {})[tag] !== id));
+}

package/lib/plan.mjs

@@ -1,5 +1,6 @@
 import { validateContainerEngine } from './container-engine.mjs';
 import { gatewayAddress } from './gateway.mjs';
+import { PRODUCTS } from './product.mjs';
 // ours-install v3 — daemon creation and boot-service installation.
 //
 // Pure planning code, like lib/target.mjs: the orchestrator
@@ -283,7 +284,11 @@ export function planDaemonSteps(target, { cliVersionChanged = false, cliStartedI
 export const SERVER_PACKAGES = ['sdk', 'cli', 'daemon', 'tg-connector', 'cowork', 'messenger-server'].map(n => `@ours.network/${n}`);
 /** Selected when the policy names it; retained policies from before it existed stay valid. */
 export const NOTIFICATIONS_PACKAGE = '@ours.network/notifications';
-const serverPackages = manifest => [...SERVER_PACKAGES, ...(manifest?.packages?.[NOTIFICATIONS_PACKAGE] ? [NOTIFICATIONS_PACKAGE] : [])];
+/** Plugin-only installations select only these; no application packages. */
+export const DAEMON_PACKAGES = ['sdk', 'cli', 'daemon'].map(n => `@ours.network/${n}`);
+const serverPackages = (manifest, role = 'server') => role === 'daemon' ? DAEMON_PACKAGES
+  : [...SERVER_PACKAGES, ...(manifest?.packages?.[NOTIFICATIONS_PACKAGE] ? [NOTIFICATIONS_PACKAGE] : [])];
+const serverRoles = ['server', 'daemon'];
 export const SERVER_DEPENDENCIES = {
   daemon: [], telegram: ['daemon'], cowork: ['daemon'], messenger: ['daemon'],
 };
@@ -299,7 +304,7 @@ export function maintenanceServices(record, domain) {
 
 /** Validate exact supplied selections, without rewriting the source authority. */
 export function selectSourcePackages(manifest, role, clients = []) {
-  const names = role === 'server' ? serverPackages(manifest) : clients.map(n => `@ours.network/${n}`);
+  const names = serverRoles.includes(role) ? serverPackages(manifest, role) : clients.map(n => `@ours.network/${n}`);
   const result = {};
   for (const name of names) {
     const selected = manifest?.packages?.[name];
@@ -317,7 +322,7 @@ export function selectSourcePackages(manifest, role, clients = []) {
 /** Resolve a packaged compatibility policy into a role-filtered exact selection. */
 export async function resolveSourcePolicy(manifest, role, clients = [], resolveNpm) {
   const release = releaseBinding(manifest);
-  const names = role === 'server' ? serverPackages(manifest) : clients.map(name => `@ours.network/${name}`);
+  const names = serverRoles.includes(role) ? serverPackages(manifest, role) : clients.map(name => `@ours.network/${name}`);
   const packages = {};
   const sourceNames = new Set();
   for (const name of names) {
@@ -371,6 +376,11 @@ export function validateInstallation(record, root) {
     || !Array.isArray(record.services) || record.services[0] !== 'daemon' || new Set(record.services).size !== record.services.length || record.services.some(s => !SERVER_SERVICES.includes(s) && !(s === 'gateway' && record.gateway?.version === 1))) {
     throw new Error('Invalid or conflicting installation selection');
   }
+  if (record.product !== undefined && (!PRODUCTS.includes(record.product) || record.product === 'workspace'
+    || record.schema !== 2 || record.mode !== 'docker' || record.gateway !== undefined
+    || JSON.stringify(record.services) !== JSON.stringify(['daemon']))) {
+    throw new Error('Invalid plugin-only installation selection');
+  }
   if (record.gateway !== undefined && (record.schema !== 2 || record.mode !== 'docker' || record.gateway?.version !== 1
     || Object.keys(record.gateway).some(key => !['version', 'serverUrl'].includes(key)) || record.services.at(-1) !== 'gateway')) {
     throw new Error('Invalid gateway installation selection');
@@ -414,7 +424,7 @@ export function validateInstallation(record, root) {
       throw new Error('Invalid server build transition');
     }
     validateInstallation(candidate, candidate.root);
-    for (const key of ['schema', 'mode', 'containerEngine', 'containerBinding', 'instanceId', 'services', 'gateway', 'port', 'coworkPort', 'messengerPort', 'messengerIdentity', 'uid', 'gid']) {
+    for (const key of ['schema', 'mode', 'product', 'containerEngine', 'containerBinding', 'instanceId', 'services', 'gateway', 'port', 'coworkPort', 'messengerPort', 'messengerIdentity', 'uid', 'gid']) {
       if (JSON.stringify(candidate[key]) !== JSON.stringify(record[key])) throw new Error('Conflicting server build candidate');
     }
   }

package/lib/product.mjs

@@ -0,0 +1,69 @@
+/**
+ * What a managed installation is for. Recorded once in installation.json and
+ * retained by every later repair, update and removal: neither choice is ever
+ * widened or narrowed implicitly.
+ *
+ *   workspace    the complete Ours workspace: daemon, Telegram, Cowork,
+ *                Messenger (with Notifications) and the one-URL gateway, plus
+ *                Fleet on the host. Records without a product are workspaces.
+ *   plugin-only  collaboration tools for existing agent apps: only the daemon
+ *                container, reached by Claude Code / Codex through the daemon's
+ *                own client prefix. No gateway, Cowork, Messenger, Telegram,
+ *                Notifications or Fleet.
+ */
+export const PRODUCTS = ['workspace', 'plugin-only'];
+export const PLUGIN_ONLY = 'plugin-only';
+export const PLUGIN_ONLY_INTEGRATIONS = ['claude-code', 'codex'];
+/** Container port of the daemon's client prefix; the raw daemon port stays internal. */
+export const CLIENT_PREFIX_PORT = 3049;
+
+export const productOf = record => record?.product ?? 'workspace';
+export const isPluginOnly = value => (typeof value === 'string' ? value : productOf(value)) === PLUGIN_ONLY;
+/** Package selection role: plugin-only selects only the SDK, CLI and daemon. */
+export const serverRole = value => isPluginOnly(value) ? 'daemon' : 'server';
+/** Applications whose state, credentials and services the installation owns. */
+export const applicationsOf = record => record.services.filter(service => service !== 'gateway');
+
+export const PRODUCT_LABELS = {
+  'plugin-only': 'Collaboration tools for my existing agent apps',
+  workspace: 'The complete Ours workspace',
+};
+
+/**
+ * Compose overlay for a plugin-only installation. The daemon container serves
+ * the client prefix itself and publishes only that port, on loopback; the raw
+ * daemon API is not published. Administrative jobs see only daemon state, so no
+ * application state, configuration or credential is created for services this
+ * installation does not run.
+ */
+export function pluginOnlyCompose() {
+  const volume = (target, subpath) => `      - {type: volume, source: server-storage, target: ${target}, volume: {nocopy: true${subpath ? `, subpath: ${subpath}` : ''}}}`;
+  const locks = '      - {type: volume, source: owner-locks, target: "/tmp/ours-${OURS_UID:-1000}", volume: {nocopy: true}}';
+  return `services:
+  prepare:
+    environment:
+      OURS_SERVER_APPLICATIONS: daemon
+  daemon:
+    entrypoint: [node, /opt/ours/docker/daemon-client-prefix.mjs]
+    environment:
+      OURS_SERVER_APPLICATIONS: daemon
+      OURS_DAEMON_CLIENT_PREFIX_PORT: "${CLIENT_PREFIX_PORT}"
+    ports: !override
+      - {target: ${CLIENT_PREFIX_PORT}, published: "\${OURS_HOST_PORT:-3050}", host_ip: 127.0.0.1}
+  access:
+    environment:
+      OURS_SERVER_APPLICATIONS: daemon
+    volumes: !override
+${volume('/var/lib/ours', 'state/daemon')}
+${volume('/var/lib/ours-mcp', 'state/mcp')}
+${locks}
+  state-operation:
+    environment:
+      OURS_SERVER_APPLICATIONS: daemon
+    volumes: !override
+${volume('/storage')}
+${volume('/var/lib/ours', 'state/daemon')}
+${volume('/var/lib/ours-mcp', 'state/mcp')}
+`;
+}
+export const PLUGIN_ONLY_COMPOSE = 'compose.plugin-only.yaml';