@ours.network/install 1.2.1-nightly.42 → 1.2.1-nightly.44

package/assets/scripts/maintenance/docker-layout-conversion.mjs

@@ -101,11 +101,21 @@ export function bindDockerLayout(staging, options) {
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
 }
 
+/** The installation's applications: all four, or the daemon alone for collaboration tools. */
+export function selectedComponents(env = process.env) {
+  const raw = env.OURS_SERVER_APPLICATIONS;
+  if (raw === undefined || raw === '') return COMPONENTS;
+  const selected = raw.split(',');
+  if (selected[0] !== 'daemon' || new Set(selected).size !== selected.length || selected.some(name => !COMPONENTS.includes(name))) throw new Error('invalid OURS_SERVER_APPLICATIONS selection');
+  return selected;
+}
+
 /** Offline validation also covers components intentionally left stopped. */
 export function validateDockerLayout(tree, options) {
+  const components = options.components ?? COMPONENTS;
   validateBuildRecordSet(options.provenance);
   scanSource(tree, options);
-  for (const component of COMPONENTS) {
+  for (const component of components) {
     if (fs.readdirSync(join(tree, component, '.ours-provenance')).sort().join() !== recordNames(options.provenance).sort().join()) throw new Error('Mixed component provenance');
     for (const name of recordNames(options.provenance)) {
       if (!privateBytes(join(tree, component, '.ours-provenance', name), options).equals(options.provenance[name])) {
@@ -123,11 +133,11 @@ export function validateDockerLayout(tree, options) {
   if (daemon.stateDir !== DAEMON_STATE || daemon.port !== 3050
     || (daemon.networkMcp !== undefined && (daemon.networkMcp?.applicationConfigPath !== join(MCP_STATE, 'config.json')
       || JSON.stringify(daemon.networkMcp?.profile) !== JSON.stringify(profile)))
-    || objectAt(join(tree, 'cowork/config.json'), options).stateDir !== '/var/lib/ours-cowork') {
+    || (components.includes('cowork') && objectAt(join(tree, 'cowork/config.json'), options).stateDir !== '/var/lib/ours-cowork')) {
     throw new Error('Converted Docker deployment configuration is inconsistent');
   }
   if (fs.existsSync(join(tree, 'mcp/config.json'))) objectAt(join(tree, 'mcp/config.json'), options);
-  for (const path of ['daemon/daemon-token', ...COMPONENTS.filter(name => name !== 'daemon').map(name => `credentials/${name}/daemon-token`)]) {
+  for (const path of ['daemon/daemon-token', ...components.filter(name => name !== 'daemon').map(name => `credentials/${name}/daemon-token`)]) {
     if (!privateBytes(join(tree, path), options).length) throw new Error('Converted managed credential is empty');
   }
 }
@@ -214,13 +224,14 @@ export async function runDockerLayoutCommand(argv, env = process.env) {
     cli: daemonOwner({ OURS_DAEMON_BIN_DIR: '/opt/ours/node_modules/.bin', ...env }),
     configPath: env.OURS_DAEMON_CONFIG || '/var/lib/ours/config.json',
     provenance: readBuildRecords(build),
+    components: selectedComponents(env),
   };
   if (!options.uid || !options.gid) throw new Error('Conversion requires a non-root owner');
   if (operation === 'cleanup') {
     console.log(JSON.stringify({ emptyVolumes: cleanupDockerSource(source, options) }));
     return;
   }
-  try {
+  if (options.components.includes('cowork')) try {
     execFileSync(env.OURS_COWORK_CLI_PATH || '/opt/ours/node_modules/.bin/ours-cowork', ['--json', 'prepare-backup'], {
       env: { ...env, OURS_COWORK_CONFIG: env.OURS_COWORK_CONFIG || '/var/lib/ours-cowork/config.json',
         OURS_COWORK_STATE_DIR: env.OURS_COWORK_STATE_DIR || '/var/lib/ours-cowork' },

package/assets/scripts/maintenance/state-operation.mjs

@@ -13,6 +13,14 @@ import { daemonOwner } from './daemon-owner.mjs';
 
 const PROVENANCE = '.ours-provenance';
 const APPLICATIONS = ['daemon', 'telegram', 'cowork', 'messenger'];
+/** The installation's applications; plugin-only installations select only the daemon. */
+export function selectedApplications(env = process.env) {
+  const raw = env.OURS_SERVER_APPLICATIONS;
+  if (raw === undefined || raw === '') return APPLICATIONS;
+  const selected = raw.split(',');
+  if (selected[0] !== 'daemon' || new Set(selected).size !== selected.length || selected.some(name => !APPLICATIONS.includes(name))) fail('invalid OURS_SERVER_APPLICATIONS selection');
+  return selected;
+}
 const exists = path => { try { fs.lstatSync(path); return true; } catch (e) { if (e.code === 'ENOENT') return false; throw e; } };
 const canonical = path => exists(path) ? fs.realpathSync(path) : join(canonical(dirname(path)), basename(path));
 const sameRecords = (a, b) => recordNames(a).length === recordNames(b).length && recordNames(a).every(name => a[name].equals(b[name]));
@@ -26,11 +34,13 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
     if (!value || resolve(value) !== value || canonical(value) !== value) fail(`${name} must select an absolute canonical path`);
     return value;
   };
+  const applications = selectedApplications(env);
   const state = selected('OURS_STATE_ROOT'), live = selected('OURS_LIVE_ROOT'), build = selected('OURS_BUILD_ROOT');
   if ([state, build].some(path => path === live || path.startsWith(live + '/'))) fail('maintenance and build records must be outside live application state');
   const backups = join(state, 'backups'), maintenance = join(state, '.maintenance');
   const domain = argv[1];
   if (![...APPLICATIONS, 'server'].includes(domain)) fail('select server, daemon, telegram, cowork or messenger');
+  if (domain !== 'server' && !applications.includes(domain)) fail(`${domain} is not part of this installation`);
   if (Object.hasOwn(env, 'OURS_STATE_DOMAIN') && env.OURS_STATE_DOMAIN !== domain) fail('selected volume domain does not match operation');
   const compatible = argv.at(-1) === '--compatible';
   if (compatible) argv = argv.slice(0, -1);
@@ -76,6 +86,7 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
   }
   function prepare() {
     if (!['server', 'cowork'].includes(domain) && !paired) return;
+    if (!applications.includes('cowork')) return;
     if (!env.OURS_COWORK_CLI_PATH || !env.OURS_COWORK_CONFIG) fail('Cowork maintenance requires its selected executable and configuration');
     owner([env.OURS_COWORK_CLI_PATH, '--json', 'prepare-backup'], { OURS_COWORK_CONFIG: env.OURS_COWORK_CONFIG });
   }
@@ -88,7 +99,7 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
     } catch (e) { fs.closeSync(fd); throw e; }
   }
   function validateTree(tree, records) {
-    const roots = domain === 'server' ? APPLICATIONS.map(name => join(tree, name)) : [tree];
+    const roots = domain === 'server' ? applications.map(name => join(tree, name)) : [tree];
     // Notifications shares Messenger's service, but owns a separate state directory.
     // Older installations/backups may contain only its empty mount placeholder.
     // Include every retained notification generation in full-server maintenance.
@@ -152,7 +163,7 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
         fs.chmodSync(path, 0o600);
       }
     }
-    if (['server', 'cowork'].includes(domain)) bindConfig(join(tree, domain === 'server' ? 'cowork/config.json' : 'config.json'), env.OURS_COWORK_CONFIG, ['version', 'stateDir', 'rest']);
+    if (['server', 'cowork'].includes(domain) && applications.includes('cowork')) bindConfig(join(tree, domain === 'server' ? 'cowork/config.json' : 'config.json'), env.OURS_COWORK_CONFIG, ['version', 'stateDir', 'rest']);
   }
   function retainAuthority(staging) {
     if (!['daemon', 'server'].includes(domain)) return;
@@ -161,7 +172,7 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
     owner([daemonOwner(env), 'config', 'access-retain', '--config', env.OURS_DAEMON_CONFIG, '--target-state-dir', daemon, '--json']);
     if (!commonTree) return;
     const credentials = join(live, 'credentials'), destination = join(staging, 'credentials');
-    for (const name of ['telegram', 'cowork', 'messenger']) if (!privateStat(join(credentials, name, 'daemon-token'), false, 0o600).size) fail('current managed credential is empty');
+    for (const name of applications.filter(name => name !== 'daemon')) if (!privateStat(join(credentials, name, 'daemon-token'), false, 0o600).size) fail('current managed credential is empty');
     fs.rmSync(destination, { recursive: true }); copyTree(credentials, destination);
   }
   function replace(staging) {
@@ -191,7 +202,7 @@ export async function runStateOperation(argv, env = process.env, checkpoints = {
       const previous = readRecords(selected('OURS_PREVIOUS_BUILD_ROOT'), false);
       const expected = readRecords(selected('OURS_EXPECTED_BUILD_ROOT'), false);
       if (!sameRecords(target, expected)) fail('recovery runtime differs from the retained candidate');
-      const core = APPLICATIONS.map(name => readRecords(join(live, name, PROVENANCE)));
+      const core = applications.map(name => readRecords(join(live, name, PROVENANCE)));
       const oldCore = core.every(records => sameRecords(records, previous));
       const newCore = core.every(records => sameRecords(records, target));
       if (!newCore && !(env.OURS_RECOVERY_PHASE === 'prepared' && oldCore)) fail('recovery core provenance differs from the retained candidate');

package/assets/scripts/runtime/client-setup.mjs

@@ -7,12 +7,18 @@ import {
   realpathSync, renameSync, unlinkSync, writeFileSync, readdirSync, chmodSync, chownSync,
 } from 'node:fs';
 
-const DELIVERY_FILES = [
-  '/credentials/telegram/daemon-token',
-  '/credentials/cowork/daemon-token',
-  '/credentials/messenger/daemon-token',
-];
 const fail = (message) => { throw new Error(message); };
+/** Applications of this installation; plugin-only installations have only the daemon. */
+const APPLICATIONS = (() => {
+  const all = ['daemon', 'telegram', 'cowork', 'messenger'];
+  const raw = process.env.OURS_SERVER_APPLICATIONS;
+  if (raw === undefined || raw === '') return all;
+  const selected = raw.split(',');
+  if (selected[0] !== 'daemon' || new Set(selected).size !== selected.length || selected.some(name => !all.includes(name))) fail('Invalid OURS_SERVER_APPLICATIONS selection');
+  return selected;
+})();
+const CONSUMERS = APPLICATIONS.filter(name => name !== 'daemon');
+const DELIVERY_FILES = CONSUMERS.map(name => `/credentials/${name}/daemon-token`);
 let diagnosticStage = 'validation';
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
@@ -153,11 +159,11 @@ function prepare() {
   process.umask(0o077);
   validateCommon();
   for (const path of ['/storage/state', '/storage/state/mcp', '/storage/state/credentials',
-    ...['telegram', 'cowork', 'messenger'].map(name => `/storage/state/credentials/${name}`),
+    ...CONSUMERS.map(name => `/storage/state/credentials/${name}`),
     '/storage/backups', '/storage/.maintenance']) ensureDirectory(path);
   const coworkPort = Number(process.env.OURS_COWORK_REST_PORT);
   if (!Number.isSafeInteger(coworkPort) || coworkPort < 1 || coworkPort > 65535) fail('Configure a valid cowork REST port');
-  for (const domain of ['daemon', 'telegram', 'cowork', 'messenger']) {
+  for (const domain of APPLICATIONS) {
     const data = `/storage/state/${domain}`;
     ensureDirectory(data);
     // access-init owns the fresh-state check; no installer files enter daemon
@@ -173,14 +179,16 @@ function prepare() {
       fail('Existing daemon configuration differs; use the supported maintenance workflow');
     }
   } else atomicJson(path, expected);
-  const coworkPath = '/storage/state/cowork/config.json';
-  const cowork = composeConfig('cowork');
-  if (!existingPrivate(coworkPath, false)) atomicJson(coworkPath, cowork);
-  else {
-    const config = jsonObject(coworkPath);
-    if (config.version !== 1 || config.stateDir !== cowork.stateDir || config.rest?.enabled !== true || config.rest?.host !== '0.0.0.0') fail('Existing cowork configuration conflicts with Compose');
+  if (APPLICATIONS.includes('cowork')) {
+    const coworkPath = '/storage/state/cowork/config.json';
+    const cowork = composeConfig('cowork');
+    if (!existingPrivate(coworkPath, false)) atomicJson(coworkPath, cowork);
+    else {
+      const config = jsonObject(coworkPath);
+      if (config.version !== 1 || config.stateDir !== cowork.stateDir || config.rest?.enabled !== true || config.rest?.host !== '0.0.0.0') fail('Existing cowork configuration conflicts with Compose');
+    }
   }
-  prepareNotifications();
+  if (APPLICATIONS.includes('messenger')) prepareNotifications();
   console.log('OURS persistent volumes are ready');
 }
 
@@ -258,7 +266,10 @@ function exactKeys(value, allowed, label) {
 try {
   const operation = process.argv[2];
   if (operation === 'prepare') prepare();
-  else if (operation === 'telegram-input') { prepare(); await telegramInput(); }
+  else if (operation === 'telegram-input') {
+    if (!APPLICATIONS.includes('telegram')) fail('This installation has no Telegram connector');
+    prepare(); await telegramInput();
+  }
   else if (['access-init', 'access-issue', 'access-replace'].includes(operation)) access(operation, process.argv[3]);
   else fail('usage: client-setup.mjs prepare | telegram-input | access-init | access-issue [OUTPUT] | access-replace');
 } catch (error) {

package/assets/scripts/runtime/daemon-client-prefix.mjs

@@ -0,0 +1,115 @@
+import { spawn } from 'node:child_process';
+import { createServer, request } from 'node:http';
+import { connect } from 'node:net';
+import { pathToFileURL } from 'node:url';
+
+/**
+ * Plugin-only installations run no gateway container. Current client releases
+ * still address the daemon as <serverUrl>/daemon, so the daemon container itself
+ * serves that one prefix. Requests and responses pass through unchanged, including
+ * the client's own credential and instance checks; nothing is added or injected.
+ * Any other path, method form or host-absolute target is refused.
+ */
+export const PREFIX = '/daemon';
+export const CAPABILITY = 'ours.daemon-prefix-v1';
+const HOP = ['connection', 'keep-alive', 'proxy-connection', 'transfer-encoding', 'te', 'trailer', 'upgrade'];
+
+/** Only origin-form targets under the prefix; the remainder is the daemon path. */
+export function daemonPath(target) {
+  if (typeof target !== 'string' || !target.startsWith(PREFIX + '/') || /[\s\\]/.test(target)) return null;
+  const rest = target.slice(PREFIX.length);
+  // A dot segment could step out of the prefix once normalized by the daemon.
+  for (const segment of rest.split('?')[0].split('/')) {
+    let decoded;
+    try { decoded = decodeURIComponent(segment); } catch { return null; }
+    if (decoded === '.' || decoded === '..' || decoded.includes('/')) return null;
+  }
+  return rest;
+}
+
+export function discovery(instanceId) {
+  return { schema: 1, instanceId, services: { daemon: PREFIX }, capabilities: [CAPABILITY] };
+}
+
+/** Headers as received, minus hop-by-hop ones; repeated headers keep every value. */
+function headersFor(raw) {
+  const headers = {};
+  for (let i = 0; i < raw.length; i += 2) {
+    const name = raw[i].toLowerCase();
+    if (HOP.includes(name)) continue;
+    if (!Object.hasOwn(headers, name)) headers[name] = raw[i + 1];
+    else if (name === 'set-cookie') headers[name] = [].concat(headers[name], raw[i + 1]);
+    else headers[name] = `${headers[name]}, ${raw[i + 1]}`;
+  }
+  return headers;
+}
+
+export function createPrefixServer({ upstreamPort = 3050, upstreamHost = '127.0.0.1', instanceId }) {
+  const reply = (res, status, body) => {
+    res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(body));
+  };
+  const server = createServer((req, res) => {
+    if (req.url === '/.well-known/ours' && req.method === 'GET') return reply(res, 200, discovery(instanceId));
+    if (req.url === PREFIX) { res.writeHead(308, { location: PREFIX + '/' }); res.end(); return; }
+    const path = daemonPath(req.url);
+    if (path === null) return reply(res, 404, { error: 'not found' });
+    const upstream = request({ host: upstreamHost, port: upstreamPort, method: req.method, path, headers: headersFor(req.rawHeaders) }, response => {
+      res.writeHead(response.statusCode ?? 502, headersFor(response.rawHeaders));
+      response.pipe(res);
+      response.on('error', () => res.destroy());
+    });
+    upstream.on('error', () => { if (!res.headersSent) reply(res, 502, { error: 'daemon unavailable' }); else res.destroy(); });
+    // A client that goes away cancels its long poll or stream at the daemon too.
+    res.on('close', () => { if (!res.writableFinished) upstream.destroy(); });
+    req.pipe(upstream);
+  });
+  server.on('upgrade', (req, socket, head) => {
+    const path = daemonPath(req.url);
+    if (path === null) { socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n'); return; }
+    const upstream = connect(upstreamPort, upstreamHost, () => {
+      const lines = [`${req.method} ${path} HTTP/1.1`];
+      for (let i = 0; i < req.rawHeaders.length; i += 2) lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+      upstream.write(lines.join('\r\n') + '\r\n\r\n');
+      if (head?.length) upstream.write(head);
+      upstream.pipe(socket); socket.pipe(upstream);
+    });
+    const close = () => { upstream.destroy(); socket.destroy(); };
+    upstream.on('error', close); socket.on('error', close);
+    upstream.on('close', () => socket.destroy()); socket.on('close', () => upstream.destroy());
+  });
+  // Absolute-form ("GET http://host/...") and CONNECT never reach the daemon.
+  server.on('connect', (req, socket) => socket.end('HTTP/1.1 405 Method Not Allowed\r\nConnection: close\r\nContent-Length: 0\r\n\r\n'));
+  return server;
+}
+
+/**
+ * Run the daemon's own locked, recovering entrypoint as the single child and
+ * serve the prefix beside it. Either one ending stops the other, so the
+ * container exits and its restart policy recovers both together.
+ */
+async function main() {
+  const port = Number(process.env.OURS_DAEMON_CLIENT_PREFIX_PORT);
+  const instanceId = process.env.OURS_DAEMON_ID ?? '';
+  if (!Number.isInteger(port) || port < 1 || port > 65535 || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(instanceId)) {
+    console.error('OURS daemon client prefix requires a port and the daemon UUID'); process.exit(2);
+  }
+  const runtime = process.env.OURS_RUNTIME_ROOT ?? '/opt/ours';
+  const child = spawn('/bin/sh', ['-e', `${runtime}/docker/entrypoint.sh`], { stdio: 'inherit' });
+  const server = createPrefixServer({ instanceId });
+  let stopping = false;
+  const stop = (signal, code) => {
+    if (stopping) return;
+    stopping = true;
+    server.close();
+    if (child.exitCode === null && child.signalCode === null) child.kill(signal);
+    else process.exit(code);
+  };
+  child.on('exit', (code, signal) => { server.close(); process.exit(code ?? (signal ? 1 : 0)); });
+  child.on('error', () => { server.close(); process.exit(1); });
+  server.on('error', error => { console.error(`OURS daemon client prefix stopped: ${error.code ?? error.message}`); stop('SIGTERM', 1); });
+  for (const signal of ['SIGTERM', 'SIGINT']) process.on(signal, () => stop(signal, 0));
+  server.listen(port, '0.0.0.0', () => console.error(`OURS daemon client prefix ready on ${PREFIX}`));
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) await main();

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.42",
+    "installerVersion": "1.2.1-nightly.44",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.17",
@@ -25,12 +25,12 @@
         "integrity": "sha512-03qDDGRgN9pBGsBsCcvArhPuYfMblqsaXS9HinxAzOSiI3PaoNOh+4MxIAOoHXoE/12xxCDf7kbMdEAR0CPIfg=="
       },
       "@ours.network/notifications": {
-        "version": "0.3.1-nightly.2",
-        "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
+        "version": "0.3.1-nightly.3",
+        "integrity": "sha512-mt69E2LLkfwBMOJm7IP49wLIO9KtugBqh6nQpfrfbRuTlenjyrmZqcAuhW1CyI2R1H518B0Evxagnx9/V9fIig=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.54",
-        "integrity": "sha512-Sh3t8iRGBoYzbyslS+IKuqQ573Zn+M0GVhR0cGepy/hlyNMAwXD2TBM+j7d8QiA1+ALugkMhKnanivE97JBmhQ=="
+        "version": "1.2.0-nightly.57",
+        "integrity": "sha512-FAgN3L5yOlWQgGFJ4g0x1jpCqpAtYvRnol+ZBrgR8vCl+Ex1Ebct6GiSTIdkPtvYth4lidUgSkBpJqwiSTkx3Q=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.13",
@@ -83,11 +83,11 @@
     },
     "@ours.network/notifications": {
       "type": "npm",
-      "version": "0.3.1-nightly.2"
+      "version": "0.3.1-nightly.3"
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.54"
+      "version": "1.2.0-nightly.57"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/lib/boot-readiness.mjs

@@ -1,3 +1,26 @@
+import { warn } from './ui.mjs';
+
+const NO_AUTOSTART = 'ours components that depend on Docker will not start automatically after a reboot until Docker is started';
+const OPTIONAL = 'The installer does not change this for you.';
+
+/** Persistent unit-file state only: `is-active`/a reachable Engine says nothing about the next boot. */
+async function unitFileState(effects, scope) {
+  // `is-enabled` reads unit files offline, so it answers even where systemd is not the init
+  // system and its answer decides nothing. /run/systemd/system is sd_booted(3)'s own test.
+  if (!effects.exists('/run/systemd/system')) return 'unavailable';
+  try {
+    if (scope.length) await effects.run('systemctl', [...scope, 'show-environment']); // a user manager must be running
+    // 1 = disabled/masked, 4 = no such unit (older systemd reports that as 1 with empty output).
+    const state = (await effects.run('systemctl', [...scope, 'is-enabled', 'docker.service'], { allowCodes: [1, 4] })).stdout.trim().split('\n')[0];
+    if (state === 'enabled') return 'enabled';
+    // enabled-runtime lives in /run and is gone after the reboot it is supposed to cover.
+    if (state === 'disabled' || state === 'enabled-runtime') return 'disabled';
+    if (state === 'masked' || state === 'masked-runtime') return 'masked';
+    if (state === '' || state === 'not-found') return 'unavailable';
+    return 'unknown';
+  } catch { return 'unavailable'; } // no systemctl, or the host/session is not running systemd
+}
+
 /** Diagnose availability separately from boot enablement. Never alter host services. */
 export async function reportBootReadiness(effects, record) {
   const platform = effects.platform.platform;
@@ -16,28 +39,58 @@ export async function reportBootReadiness(effects, record) {
     effects.out('Container recovery requires Docker Desktop to start at sign-in. Enable its startup setting; this installer does not arrange pre-login host boot on this platform.');
     return;
   }
+  let endpoint, rootless;
   try {
     const context = JSON.parse((await effects.run('docker', ['context', 'inspect'])).stdout);
-    const endpoint = effects.env.DOCKER_HOST ?? context[0]?.Endpoints?.docker?.Host;
-    if (effects.env.DOCKER_CONTEXT || !endpoint?.startsWith('unix://') || endpoint.includes('/.docker/desktop/')) {
+    // The CLI runs with this same environment and reports the endpoint it resolved from
+    // DOCKER_HOST/DOCKER_CONTEXT; their precedence differs between its documentation and releases.
+    endpoint = context[0]?.Endpoints?.docker?.Host;
+    if (!endpoint?.startsWith('unix://') || endpoint.includes('/.docker/desktop/')) {
       effects.out('Container recovery requires the selected remote/Desktop Docker Engine to start independently; local systemd boot cannot be verified for this context.');
       return;
     }
     const info = JSON.parse((await effects.run('docker', ['info', '--format', '{{json .SecurityOptions}}'])).stdout);
-    const rootless = info.some(option => option.startsWith('name=rootless'));
-    const sockets = rootless ? [`unix:///run/user/${process.getuid()}/docker.sock`] : ['unix:///var/run/docker.sock', 'unix:///run/docker.sock'];
-    if (!sockets.includes(endpoint)) {
-      effects.out('The selected custom Docker socket is reachable, but its boot service binding is unverified; enable and verify the service owning that Engine.');
+    rootless = info.some(option => option.startsWith('name=rootless'));
+  } catch {
+    effects.out(warn(`Docker's start-at-boot setting could not be checked because the selected Docker Engine did not answer. If Docker is not set to start at boot, ${NO_AUTOSTART}.`));
+    return;
+  }
+  const sockets = rootless ? [`unix:///run/user/${process.getuid()}/docker.sock`] : ['unix:///var/run/docker.sock', 'unix:///run/docker.sock'];
+  if (!sockets.includes(endpoint)) {
+    effects.out('The selected custom Docker socket is reachable, but its boot service binding is unverified; enable and verify the service owning that Engine.');
+    return;
+  }
+  const scope = rootless ? ['--user'] : [];
+  const enable = `${rootless ? '' : 'sudo '}systemctl ${rootless ? '--user ' : ''}enable docker.service`;
+  const state = await unitFileState(effects, scope);
+  if (state === 'unavailable') {
+    // WSL with Docker Desktop integration, snap, OpenRC/runit and similar: a systemctl command would be wrong here.
+    effects.out(warn(`Docker is running now, but no running systemd${rootless ? ' user' : ''} manager with a docker.service was found, so its start-at-boot setting cannot be checked. If Docker is not set to start at boot, ${NO_AUTOSTART}. To start them automatically, enable start-at-boot in whatever manages this Docker Engine (Docker Desktop, snap, or your init system). ${OPTIONAL}`));
+    return;
+  }
+  if (state === 'unknown') {
+    effects.out(warn(`Docker is running now, but its systemd${rootless ? ' user' : ''} docker.service is neither plainly enabled nor disabled, so start at boot is not verified. If Docker does not start at boot, ${NO_AUTOSTART}. Check it with: systemctl ${rootless ? '--user ' : ''}status docker.service`));
+    return;
+  }
+  if (state === 'masked') {
+    effects.out(warn(`Docker is running now, but its systemd${rootless ? ' user' : ''} docker.service is masked, so it cannot start at boot: ${NO_AUTOSTART}. An administrator masked it deliberately; it must be unmasked before it can be enabled. ${OPTIONAL}`));
+    return;
+  }
+  if (state === 'disabled') {
+    effects.out(warn(`Docker is running now, but it is not enabled to start at boot: ${NO_AUTOSTART}. If you want them to start automatically, run: ${enable}${rootless ? ` (and, for startup before you log in, sudo loginctl enable-linger ${effects.username()})` : ''}. ${OPTIONAL}`));
+    return;
+  }
+  if (rootless) {
+    let linger = '';
+    try { linger = (await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value'])).stdout.trim(); } catch {}
+    if (linger === 'no') {
+      effects.out(warn(`Rootless Docker's user service is enabled, but user linger is off, so Docker starts only when you log in: ours components that depend on Docker will not start automatically after a reboot until then. If you want them to start at boot, run: sudo loginctl enable-linger ${effects.username()}. ${OPTIONAL}`));
       return;
     }
-    const enabled = await effects.run('systemctl', [...(rootless ? ['--user'] : []), 'is-enabled', 'docker.service']);
-    if (enabled.stdout.trim() !== 'enabled') throw new Error('persistent Docker service enablement is unverified');
-    if (rootless) {
-      const linger = await effects.run('loginctl', ['show-user', String(process.getuid()), '--property=Linger', '--value']);
-      if (linger.stdout.trim() !== 'yes') throw new Error('rootless user linger is disabled');
+    if (linger !== 'yes') {
+      effects.out(warn(`Rootless Docker's user service is enabled, but user linger could not be checked. If linger is off, Docker starts only when you log in and ours components that depend on Docker will not start automatically after a reboot until then. Check it with: loginctl show-user ${effects.username()} --property=Linger`));
+      return;
     }
-    effects.out(`Docker boot service is enabled${rootless ? ' with user linger' : ''}; managed containers recover when that Engine starts.`);
-  } catch {
-    effects.out('Docker is reachable, but automatic host boot is not verified. Ask the operator to enable the selected Docker Engine boot service (and user linger for rootless Docker); container restart policy cannot start an unavailable Engine.');
   }
+  effects.out(`Docker boot service is enabled${rootless ? ' with user linger' : ''}; managed containers recover when that Engine starts.`);
 }

package/lib/docker-conversion-runtime.mjs

@@ -1,4 +1,5 @@
 import { runContainer } from './container-engine.mjs';
+import { isPluginOnly } from './product.mjs';
 import * as fs from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -64,7 +65,8 @@ export async function runDockerConversion(record, selected, operation, label, ef
     }
   } else {
     addMount('storage', '/var/lib/ours', 'state/daemon', true);
-    addMount('storage', '/var/lib/ours-cowork', 'state/cowork', false);
+    // A collaboration-tools installation has no Cowork state to mount.
+    if (!isPluginOnly(record)) addMount('storage', '/var/lib/ours-cowork', 'state/cowork', false);
   }
   const definition = {
     services: {
@@ -74,7 +76,7 @@ export async function runDockerConversion(record, selected, operation, label, ef
         network_mode: 'none', read_only: true, cap_drop: ['ALL'],
         security_opt: ['no-new-privileges:true'], tmpfs: ['/tmp:rw,nosuid,nodev,noexec,size=64m,mode=1777'],
         entrypoint: ['node', '/opt/ours/docker/docker-layout-conversion.mjs'],
-        environment: { HOME: '/tmp', OURS_DAEMON_ID: record.instanceId },
+        environment: { HOME: '/tmp', OURS_DAEMON_ID: record.instanceId, OURS_SERVER_APPLICATIONS: isPluginOnly(record) ? 'daemon' : '' },
         volumes: mounts,
       },
     },

package/lib/docker-recovery.mjs

@@ -2,6 +2,7 @@ import { readFileSync, lstatSync, realpathSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { atomicWriteConfig } from './config.mjs';
 import { engineName, runContainer } from './container-engine.mjs';
+import { isPluginOnly } from './product.mjs';
 
 const assets = new URL('../assets/', import.meta.url);
 const files = ['scripts/runtime/recover.mjs', 'scripts/runtime/dependency-ready.mjs',
@@ -23,11 +24,15 @@ export function refreshDockerRecovery(record) {
     atomicWriteConfig(marker, 'required\n'); changed = true;
     atomicWriteConfig(path, bytes.toString());
   };
-  for (const name of files) replace(name, readFileSync(new URL(name, assets)));
+  // Plugin-only daemons also serve the client prefix from the image.
+  const selected = isPluginOnly(record) ? [...files, 'scripts/runtime/daemon-client-prefix.mjs'] : files;
+  for (const name of selected) replace(name, readFileSync(new URL(name, assets)));
   const dockerfile = join(record.workDir, 'Dockerfile'); owned(dockerfile);
   const text = readFileSync(dockerfile, 'utf8');
   const line = 'COPY --chmod=644 scripts/runtime/recover.mjs scripts/runtime/dependency-ready.mjs /opt/ours/docker/';
   if (!text.includes('scripts/runtime/recover.mjs')) replace('Dockerfile', Buffer.from(text.replace('FROM node:24 AS maintenance', `${line}\nFROM node:24 AS maintenance`)));
+  const prefixLine = 'COPY --chmod=644 scripts/runtime/daemon-client-prefix.mjs /opt/ours/docker/daemon-client-prefix.mjs';
+  if (isPluginOnly(record) && !readFileSync(dockerfile, 'utf8').includes(prefixLine)) replace('Dockerfile', Buffer.from(readFileSync(dockerfile, 'utf8').replace('FROM node:24 AS maintenance', `${prefixLine}\nFROM node:24 AS maintenance`)));
   return changed || existsSync(marker);
 }