@rubytech/create-realagent 1.0.682 → 1.0.684

package/dist/index.js

@@ -726,21 +726,11 @@ function ensureNeo4jPassword() {
             console.log("  Stored password doesn't match dedicated Neo4j instance.");
         }
         else {
-            console.log("  Stored password doesn't match Neo4j. Checking other brands...");
+            console.log("  Stored password doesn't match Neo4j. Resetting auth.");
         }
     }
-    // 2. Cross-brand check: only for shared instances. Dedicated instances have
-    //    independent auth — another brand's password is irrelevant.
-    if (!NEO4J_DEDICATED) {
-        const crossBrandPassword = findWorkingNeo4jPassword();
-        if (crossBrandPassword) {
-            writeFileSync(passwordFile, crossBrandPassword.password, { mode: 0o600 });
-            mkdirSync(persistDir, { recursive: true });
-            writeFileSync(persistentPasswordFile, crossBrandPassword.password, { mode: 0o600 });
-            return;
-        }
-    }
-    // 3. Fresh install: no working password found. Generate and set a new one.
+    // 2. Fresh install or recovery: no working same-brand password. Generate and set a new one.
+    //    Brand isolation (Task 659): never read another brand's .neo4j-password.
     if (!existsSync(passwordFile)) {
         console.log("  No Neo4j password file found. Setting initial password...");
     }
@@ -766,42 +756,6 @@ function neo4jPasswordWorks(password, port = DEFAULT_NEO4J_PORT) {
     ], { stdio: "pipe", timeout: 10000 });
     return check.status === 0;
 }
-/** Scan $HOME dotdirs for a .neo4j-password file with a working password.
- *  Returns the password and source dir name, or null if none found. */
-function findWorkingNeo4jPassword() {
-    const home = process.env.HOME ?? "/root";
-    let entries;
-    try {
-        entries = readdirSync(home);
-    }
-    catch {
-        logFile("  Neo4j cross-brand scan: could not read $HOME");
-        return null;
-    }
-    for (const entry of entries) {
-        // Only check dotdirs that aren't our own configDir
-        if (!entry.startsWith(".") || entry === BRAND.configDir)
-            continue;
-        const candidate = join(home, entry, ".neo4j-password");
-        try {
-            if (!existsSync(candidate))
-                continue;
-            const password = readFileSync(candidate, "utf-8").trim();
-            if (!password)
-                continue;
-            if (neo4jPasswordWorks(password)) {
-                console.log(`  Neo4j password: reused from ~/${entry}`);
-                logFile(`  Neo4j password: reused from ~/${entry}`);
-                return { password, source: entry };
-            }
-        }
-        catch {
-            // Unreadable file or other FS error — skip this candidate
-            continue;
-        }
-    }
-    return null;
-}
 function installNeo4j() {
     if (commandExists("neo4j")) {
         log("4", TOTAL, "Neo4j already installed.");
@@ -1175,90 +1129,10 @@ function deployPayload() {
         cpSync(oldUsersFile, persistentUsersFile);
         console.log("  Migrated users.json to persistent storage.");
     }
-    // Migrate secrets from ~/.maxy/ to brand-specific config dir.
-    // Pre-fix code (before Task 262) hardcoded ~/.maxy/ for all brands.
-    // On branded builds (configDir != .maxy), secrets may exist at ~/.maxy/ but not
-    // at the brand-specific location. Copy them over so they survive the path fix.
-    if (BRAND.configDir !== ".maxy") {
-        const legacyDir = resolve(process.env.HOME ?? "/root", ".maxy");
-        const MIGRATABLE_SECRETS = [".anthropic-api-key", ".admin-pin", ".remote-password"];
-        for (const secret of MIGRATABLE_SECRETS) {
-            const legacyFile = join(legacyDir, secret);
-            const brandFile = join(persistentDir, secret);
-            if (existsSync(legacyFile) && !existsSync(brandFile)) {
-                mkdirSync(persistentDir, { recursive: true });
-                cpSync(legacyFile, brandFile);
-                console.log(`  Migrated ${secret} from ~/.maxy/ to ~/${BRAND.configDir}/`);
-            }
-        }
-    }
-    // Migrate cloudflared state from ~/.cloudflared/ to ~/{configDir}/cloudflared/.
-    // Pre-Task-441 code hardcoded ~/.cloudflared/ for all brands. On upgrade, existing
-    // tunnel.state and cert.pem may exist at the legacy path. Runs for ALL brands
-    // (including default .maxy) since the legacy path was ~/.cloudflared/ regardless of brand.
-    //
-    // tunnel.state: COPY (not move). cloudflared's `tunnel run` reads state from
-    // ~/.cloudflared/ when no --config is passed — emptying that path risks tunnel-startup regression.
-    //
-    // cert.pem: MOVE (copy + remove). Maxy's code always passes --origincert pointing
-    // at the brand path, so the legacy copy is unreferenced post-migration. Leaving it
-    // in place lets `tunnel-login force=true` look like a reset but silently re-import
-    // the stale cert on the next read (Task 531). Removing the legacy file makes the
-    // recovery path Task 529's pre-flight error recommends actually work.
-    const legacyCloudflaredDir = resolve(process.env.HOME ?? "/root", ".cloudflared");
-    const brandCloudflaredDir = join(persistentDir, "cloudflared");
-    const CLOUDFLARED_MIGRATIONS = [
-        { file: "tunnel.state", removeLegacy: false },
-        { file: "cert.pem", removeLegacy: true },
-    ];
-    for (const { file, removeLegacy } of CLOUDFLARED_MIGRATIONS) {
-        const legacyFile = join(legacyCloudflaredDir, file);
-        const brandFile = join(brandCloudflaredDir, file);
-        if (existsSync(legacyFile) && !existsSync(brandFile)) {
-            mkdirSync(brandCloudflaredDir, { recursive: true });
-            cpSync(legacyFile, brandFile);
-            if (removeLegacy) {
-                // Explicit try/catch instead of rmSync({force:true}): force swallows
-                // EACCES/EBUSY as well as ENOENT, which would silently leave a
-                // root-owned legacy cert.pem in place while logging success — the
-                // exact silent-failure class Task 531 exists to close. Surface the
-                // error so the operator knows the migration is incomplete.
-                try {
-                    rmSync(legacyFile);
-                    console.log(`  Migrated ${file} from ~/.cloudflared/ to ~/${BRAND.configDir}/cloudflared/ (and removed legacy copy)`);
-                }
-                catch (err) {
-                    const code = err.code;
-                    if (code === "ENOENT") {
-                        // Legacy file vanished between existsSync and rmSync — benign
-                        console.log(`  Migrated ${file} from ~/.cloudflared/ to ~/${BRAND.configDir}/cloudflared/ (legacy copy already gone)`);
-                    }
-                    else {
-                        console.log(`  Migrated ${file} from ~/.cloudflared/ to ~/${BRAND.configDir}/cloudflared/ — WARNING: could not remove legacy ${legacyFile}: ${err}`);
-                        console.log(`    Remove manually with: sudo rm ${legacyFile}`);
-                    }
-                }
-            }
-            else {
-                console.log(`  Migrated ${file} from ~/.cloudflared/ to ~/${BRAND.configDir}/cloudflared/`);
-            }
-        }
-    }
-    // Migrate Cloudflare API token from ~/.cloudflare/ to ~/{configDir}/cloudflare/.
-    // Pre-Task-441 code stored the API token at ~/.cloudflare/api-token (hardcoded).
-    // Post-Task-441 code reads from ~/{configDir}/cloudflare/api-token (brand-aware).
-    // Without this migration, tunnel-status reports hasToken=false on upgraded Pis
-    // even though the token file exists at the legacy path.
-    const legacyCloudflareDir = resolve(process.env.HOME ?? "/root", ".cloudflare");
-    const brandCloudflareDir = join(persistentDir, "cloudflare");
-    const legacyTokenFile = join(legacyCloudflareDir, "api-token");
-    const brandTokenFile = join(brandCloudflareDir, "api-token");
-    if (existsSync(legacyTokenFile) && !existsSync(brandTokenFile)) {
-        mkdirSync(brandCloudflareDir, { recursive: true });
-        cpSync(legacyTokenFile, brandTokenFile);
-        chmodSync(brandTokenFile, 0o600);
-        console.log(`  Migrated api-token from ~/.cloudflare/ to ~/${BRAND.configDir}/cloudflare/`);
-    }
+    // Brand isolation: installer does not read ~/.maxy/, ~/.cloudflared/, or
+    // ~/.cloudflare/ on non-default brands. These are peer-brand or shared-singleton
+    // paths (Task 659). Pre-Task-659 installs that need to recover legacy state
+    // follow the manual recovery paragraph in .docs/deployment.md.
     // Stop the running service before wiping directories (upgrade path).
     // The server holds open files in platform/ — rmSync fails with ENOTEMPTY if it's running.
     // systemctl stop returns when the main process exits, but ExecStopPost (e.g. VNC cleanup)
@@ -1554,14 +1428,17 @@ function setupAccount() {
 // the symlink the agent's first SKILL-compliant invocation fails with exit
 // 127 — the discipline-violation loop Task 555 exists to close.
 //
-// Collision discipline:
+// Collision discipline (Task 659 — last-writer-wins across brands):
 //   - absent path                   → create
+//   - regular file                  → exit 1 (operator-owned file, do not clobber)
 //   - symlink → same target         → no-op
-//   - symlink → different path inside INSTALL_DIR → replace (idempotent upgrade)
-//   - symlink → dangling            → repair + log
-//   - symlink → live target outside INSTALL_DIR → exit 1 (cross-brand collision)
-//   - regular file                  → exit 1
-//   - unreadable symlink            → exit 1
+//   - symlink → any other target    → overwrite (unlink + symlink)
+//                                     covers stale-same-brand, dangling,
+//                                     unreadable, and peer-brand cases.
+//                                     setup-tunnel.sh takes <brand> as argv
+//                                     so the script still operates on the
+//                                     correct brand regardless of who owns
+//                                     the shortcut symlink.
 // ---------------------------------------------------------------------------
 function createTunnelSymlink(linkPath, target) {
     const targetAbs = resolve(target);
@@ -1589,48 +1466,27 @@ function createTunnelSymlink(linkPath, target) {
         console.error(`  Remove the file and re-run: npx -y @rubytech/create-maxy`);
         process.exit(1);
     }
-    let resolvedTarget;
-    try {
-        const raw = readlinkSync(linkPath);
-        resolvedTarget = resolve(dirname(linkPath), raw);
-    }
-    catch (err) {
-        console.error(`Setup failed: ${linkPath} symlink unreadable: ${err.message}`);
-        console.error(`[create-maxy:collision] ${linkPath} symlink unreadable: ${err.message}`);
-        console.error(`  Remove the file and re-run: npx -y @rubytech/create-maxy`);
-        process.exit(1);
-    }
+    // Brand isolation (Task 659): a symlink at this path is either stale-same-brand,
+    // dangling, unreadable, or pointing at another brand. All four cases are resolved
+    // by last-writer-wins overwrite — setup-tunnel.sh takes <brand> as argv, so
+    // whichever brand's installer ran last owns the shortcut.
+    const resolvedTarget = (() => {
+        try {
+            return resolve(dirname(linkPath), readlinkSync(linkPath));
+        }
+        catch {
+            return "<unreadable>";
+        }
+    })();
     if (resolvedTarget === targetAbs) {
         console.log(`  [create-maxy] symlink ${linkPath} already points to ${targetAbs}`);
         logFile(`  symlink unchanged: ${linkPath} → ${targetAbs}`);
         return;
     }
-    const insideInstallDir = resolvedTarget === INSTALL_DIR || resolvedTarget.startsWith(INSTALL_DIR + "/");
-    let targetExists = false;
-    try {
-        lstatSync(resolvedTarget);
-        targetExists = true;
-    }
-    catch { /* resolvedTarget absent → dangling */ }
-    if (insideInstallDir) {
-        unlinkSync(linkPath);
-        symlinkSync(targetAbs, linkPath);
-        console.log(`  [create-maxy] symlink replaced: ${linkPath} → ${targetAbs}`);
-        logFile(`  symlink replaced (stale same-brand): ${linkPath} was ${resolvedTarget}, now ${targetAbs}`);
-        return;
-    }
-    if (!targetExists) {
-        unlinkSync(linkPath);
-        symlinkSync(targetAbs, linkPath);
-        console.log(`  [create-maxy] symlink repair: dangling ${linkPath} replaced (→ ${targetAbs})`);
-        logFile(`  symlink repaired (dangling): ${linkPath} was ${resolvedTarget}, now ${targetAbs}`);
-        return;
-    }
-    console.error(`Setup failed: ${linkPath} collision (symlink to ${resolvedTarget})`);
-    console.error(`[create-maxy:collision] ${linkPath} already exists target=${resolvedTarget}`);
-    console.error(`  This symlink was created by a different install (not within ${INSTALL_DIR}).`);
-    console.error(`  Remove or relocate it, then re-run: npx -y @rubytech/create-maxy`);
-    process.exit(1);
+    unlinkSync(linkPath);
+    symlinkSync(targetAbs, linkPath);
+    console.log(`  [create-maxy] symlink replaced: ${linkPath} → ${targetAbs}`);
+    logFile(`  symlink replaced: ${linkPath} was ${resolvedTarget}, now ${targetAbs}`);
 }
 function installTunnelScripts() {
     const setupSrc = join(INSTALL_DIR, "platform/plugins/cloudflare/scripts/setup-tunnel.sh");
@@ -2411,17 +2267,17 @@ else {
     catch { /* non-critical */ }
 }
 // ---------------------------------------------------------------------------
-// Neo4j port — install-time flag for multi-brand data isolation.
+// Neo4j port — multi-brand data isolation.
 //
-// Default: 7687 (shared system Neo4j instance). When a different port is
-// specified, the installer creates a dedicated Neo4j instance for this brand
-// with its own config, data directory, systemd service, and password.
+// Default Maxy brand: 7687 (shared system Neo4j instance). Branded builds ship
+// a dedicated port in brand.json (e.g. Real Agent = 7688) so installing a
+// second brand on the same device gets its own database by default — Task 659.
 //
-// Priority: --neo4j-port flag > .env NEO4J_URI detection (upgrade) > default 7687.
+// Priority: --neo4j-port flag > .env NEO4J_URI (upgrade preserve) > BRAND.neo4jPort > 7687.
 // ---------------------------------------------------------------------------
 const DEFAULT_NEO4J_PORT = 7687;
-let NEO4J_PORT = DEFAULT_NEO4J_PORT;
-let NEO4J_PORT_SOURCE = "default";
+let NEO4J_PORT = BRAND.neo4jPort ?? DEFAULT_NEO4J_PORT;
+let NEO4J_PORT_SOURCE = BRAND.neo4jPort ? "brand.json" : "default";
 const neo4jPortIdx = _args.indexOf("--neo4j-port");
 if (neo4jPortIdx !== -1) {
     const raw = _args[neo4jPortIdx + 1];
@@ -2435,7 +2291,8 @@ if (neo4jPortIdx !== -1) {
     NEO4J_PORT_SOURCE = "--neo4j-port flag";
 }
 else {
-    // Upgrade detection: check .env for NEO4J_URI=bolt://localhost:{port}
+    // Upgrade detection: check .env for NEO4J_URI=bolt://localhost:{port}.
+    // Preserves an existing install's port even if brand.json now says different.
     const persistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
     const envPath = join(persistDir, ".env");
     try {

package/dist/uninstall.js

@@ -1,5 +1,5 @@
 import { spawnSync, execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, rmSync, appendFileSync, cpSync, lstatSync, readlinkSync, unlinkSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, appendFileSync, cpSync, lstatSync, readlinkSync, unlinkSync } from "node:fs";
 import { resolve, join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline";
@@ -79,6 +79,25 @@ function commandExists(cmd) {
 export function isMaxyInstalled() {
     return existsSync(INSTALL_DIR);
 }
+/** Detect whether another brand is installed on this device.
+ *  Task 659: device-wide steps (apt package purge, Ollama binary removal, apt
+ *  repo cleanup, ~/.claude / ~/.ollama wipes) must skip when a peer brand is
+ *  present — its runtime still depends on those singletons.
+ *
+ *  Detection: any `.service` file in `~/.config/systemd/user/` whose name is
+ *  not this brand's `BRAND.serviceName`. This mirrors the install-time check
+ *  at index.ts:489 which uses the same signal for apt/hostname behavior. */
+function peerBrandPresent() {
+    const systemdUserDir = resolve(HOME, ".config/systemd/user");
+    if (!existsSync(systemdUserDir))
+        return false;
+    try {
+        return readdirSync(systemdUserDir).some((f) => f.endsWith(".service") && f !== BRAND.serviceName && !f.startsWith("maxy-edge") && !f.startsWith("maxy-ttyd"));
+    }
+    catch {
+        return false;
+    }
+}
 // ---------------------------------------------------------------------------
 // Step 1: Stop services
 // ---------------------------------------------------------------------------
@@ -101,21 +120,28 @@ function stopServices() {
     catch {
         console.log("  maxy-edge not running");
     }
-    // Stop Neo4j
+    // Stop Neo4j — dedicated branded instance if this brand uses one, else shared.
+    // Brand isolation (Task 659): never stop `neo4j.service` when this brand runs
+    // a dedicated `neo4j-<hostname>.service` — stopping the shared instance would
+    // break every other brand on the device.
+    const neo4jPortForStop = readNeo4jPortFromEnv();
+    const neo4jService = neo4jPortForStop !== undefined && neo4jPortForStop !== 7687
+        ? `neo4j-${BRAND.hostname}`
+        : "neo4j";
     try {
-        spawnSync("sudo", ["systemctl", "stop", "neo4j"], { stdio: "pipe", timeout: 15_000 });
-        console.log("  Stopped Neo4j");
+        spawnSync("sudo", ["systemctl", "stop", neo4jService], { stdio: "pipe", timeout: 15_000 });
+        console.log(`  Stopped ${neo4jService}`);
     }
     catch {
-        console.log("  Neo4j not running");
+        console.log(`  ${neo4jService} not running`);
     }
-    // Kill cloudflared (read PID from tunnel.state — check brand path first, legacy fallback)
+    // Kill cloudflared (read PID from this brand's tunnel.state only — Task 659).
+    // Never read ~/.cloudflared/ — that path is shared with every brand installed
+    // on this device plus cloudflared's own runtime-generated files.
     const brandStateFile = join(CONFIG_DIR, "cloudflared/tunnel.state");
-    const legacyStateFile = resolve(HOME, ".cloudflared/tunnel.state");
-    const stateFile = existsSync(brandStateFile) ? brandStateFile : legacyStateFile;
-    if (existsSync(stateFile)) {
+    if (existsSync(brandStateFile)) {
         try {
-            const state = JSON.parse(readFileSync(stateFile, "utf-8"));
+            const state = JSON.parse(readFileSync(brandStateFile, "utf-8"));
             if (state.pid) {
                 spawnSync("kill", [String(state.pid)], { stdio: "pipe" });
                 console.log(`  Killed cloudflared (PID ${state.pid})`);
@@ -125,6 +151,14 @@ function stopServices() {
             console.log("  cloudflared not running");
         }
     }
+    // Brand isolation (Task 659): the VNC stack and Ollama daemon are
+    // device-wide singletons. Killing them during uninstall would interrupt
+    // any peer brand still serving requests through them. Skip when a peer
+    // is present.
+    if (peerBrandPresent()) {
+        console.log("  Peer brand present — leaving VNC/Chromium and Ollama running.");
+        return;
+    }
     // Kill VNC processes (Xtigervnc, websockify, Chromium)
     for (const proc of ["Xtigervnc", "websockify", "chromium"]) {
         try {
@@ -153,21 +187,21 @@ function deleteCloudflareTunnel() {
         console.log("  cloudflared not installed — skipping tunnel deletion.");
         return;
     }
-    // Check brand path first, legacy fallback — post-Task-441 state lives under ~/{configDir}/cloudflared/
-    const brandState = join(CONFIG_DIR, "cloudflared/tunnel.state");
-    const legacyState = resolve(HOME, ".cloudflared/tunnel.state");
-    const stateFile = existsSync(brandState) ? brandState : legacyState;
-    const brandCert = join(CONFIG_DIR, "cloudflared/cert.pem");
-    const legacyCert = resolve(HOME, ".cloudflared/cert.pem");
-    const certFile = existsSync(brandCert) ? brandCert : legacyCert;
-    // Read tunnel info for actionable error messages
+    // Read only this brand's state/cert (Task 659 — no cross-brand reads).
+    const stateFile = join(CONFIG_DIR, "cloudflared/tunnel.state");
+    const certFile = join(CONFIG_DIR, "cloudflared/cert.pem");
+    // Brand isolation (Task 659): read the tunnel id + domain from THIS brand's
+    // state file and scope `cloudflared` invocations to THIS brand's cert via
+    // --origincert. Without --origincert, cloudflared reads the device-wide
+    // ~/.cloudflared/cert.pem and would list (and delete) every tunnel in
+    // whichever Cloudflare account last logged in on this device.
+    let tunnelId;
     let tunnelDomain;
-    let tunnelConfigPath;
     if (existsSync(stateFile)) {
         try {
             const state = JSON.parse(readFileSync(stateFile, "utf-8"));
+            tunnelId = state.tunnelId ?? state.id;
             tunnelDomain = state.domain;
-            tunnelConfigPath = state.configPath;
         }
         catch { /* corrupt state file */ }
     }
@@ -179,45 +213,24 @@ function deleteCloudflareTunnel() {
         }
         return;
     }
-    // List tunnels to find the one to delete
-    const listResult = spawnSync("cloudflared", ["tunnel", "list", "--output", "json"], {
+    if (!tunnelId) {
+        console.log("  tunnel.state has no tunnel id — skipping delete.");
+        console.log("  If a tunnel exists for this brand on Cloudflare's edge, delete it manually.");
+        return;
+    }
+    console.log(`  Deleting tunnel id ${tunnelId} (${tunnelDomain ?? "no domain"})...`);
+    const deleteResult = spawnSync("cloudflared", ["--origincert", certFile, "tunnel", "delete", "-f", tunnelId], {
         stdio: "pipe",
         encoding: "utf-8",
         timeout: 30_000,
     });
-    if (listResult.status !== 0) {
-        console.log("  Could not list tunnels — network may be unreachable.");
-        if (tunnelDomain) {
-            console.log(`  The tunnel for ${tunnelDomain} may still exist.`);
-            console.log("  Delete it manually at https://one.dash.cloudflare.com → Networks → Tunnels");
-        }
-        return;
+    if (deleteResult.status === 0) {
+        console.log(`  Deleted tunnel ${tunnelId} and its DNS records.`);
     }
-    let tunnels = [];
-    try {
-        tunnels = JSON.parse(listResult.stdout || "[]");
-    }
-    catch { /* malformed response */ }
-    if (tunnels.length === 0) {
-        console.log("  No tunnels found — nothing to delete.");
-        return;
-    }
-    // Delete each tunnel (typically just one)
-    for (const tunnel of tunnels) {
-        console.log(`  Deleting tunnel: ${tunnel.name} (${tunnel.id})...`);
-        const deleteResult = spawnSync("cloudflared", ["tunnel", "delete", "-f", tunnel.id], {
-            stdio: "pipe",
-            encoding: "utf-8",
-            timeout: 30_000,
-        });
-        if (deleteResult.status === 0) {
-            console.log(`  Deleted tunnel ${tunnel.name} and its DNS records.`);
-        }
-        else {
-            console.log(`  Failed to delete tunnel ${tunnel.name}: ${(deleteResult.stderr || "").trim()}`);
-            if (tunnelDomain) {
-                console.log(`  Delete it manually at https://one.dash.cloudflare.com → Networks → Tunnels`);
-            }
+    else {
+        console.log(`  Failed to delete tunnel ${tunnelId}: ${(deleteResult.stderr || "").trim()}`);
+        if (tunnelDomain) {
+            console.log(`  Delete it manually at https://one.dash.cloudflare.com → Networks → Tunnels`);
         }
     }
 }
@@ -331,14 +344,24 @@ function removeTunnelSymlinks() {
 // ---------------------------------------------------------------------------
 function removeAppDirs() {
     log("4", "Removing application directories...");
+    // Brand isolation (Task 659): ~/.cloudflare and ~/.cloudflared are
+    // device-wide singletons (shared across every brand and used by
+    // cloudflared's own runtime); per-brand tunnel state lives at
+    // ~/{configDir}/cloudflared/ and is removed via CONFIG_DIR. ~/.claude
+    // (Claude CLI OAuth state) and ~/.ollama (shared model cache) are also
+    // device-wide — skip both when a peer brand is still installed.
+    const peer = peerBrandPresent();
     const dirs = [
         { path: INSTALL_DIR, label: `~/${BRAND.installDir}` },
         { path: CONFIG_DIR, label: `~/${BRAND.configDir}` },
-        { path: resolve(HOME, ".cloudflare"), label: "~/.cloudflare" },
-        { path: resolve(HOME, ".cloudflared"), label: "~/.cloudflared" },
-        { path: resolve(HOME, ".claude"), label: "~/.claude" },
-        { path: resolve(HOME, ".ollama"), label: "~/.ollama" },
+        ...(peer ? [] : [
+            { path: resolve(HOME, ".claude"), label: "~/.claude" },
+            { path: resolve(HOME, ".ollama"), label: "~/.ollama" },
+        ]),
     ];
+    if (peer) {
+        console.log("  Peer brand still installed — leaving ~/.claude and ~/.ollama in place.");
+    }
     for (const { path, label } of dirs) {
         if (existsSync(path)) {
             try {
@@ -359,10 +382,25 @@ function removeAppDirs() {
 // ---------------------------------------------------------------------------
 function removeNeo4jData() {
     log("5", "Removing Neo4j data...");
-    const paths = [
-        "/var/lib/neo4j/data",
-        "/var/lib/neo4j/logs",
-    ];
+    // Brand isolation (Task 659): remove only THIS brand's Neo4j data. Shared
+    // 7687 data is skipped entirely when a peer brand is present. Dedicated
+    // branded instances live at /var/lib/neo4j-<hostname>/ and are always
+    // this-brand-owned by construction.
+    const envPort = readNeo4jPortFromEnv();
+    const isDedicated = envPort !== undefined && envPort !== 7687;
+    const dataDir = isDedicated ? `/var/lib/neo4j-${BRAND.hostname}` : "/var/lib/neo4j";
+    if (!isDedicated && peerBrandPresent()) {
+        console.log(`  Shared Neo4j instance on 7687 — peer brand present, skipping data wipe.`);
+        return;
+    }
+    const paths = [`${dataDir}/data`, `${dataDir}/logs`];
+    if (isDedicated) {
+        // Also clean up the dedicated config dir and systemd unit — install-time
+        // code creates both at /etc/neo4j-<hostname>/ and /etc/systemd/system/
+        // neo4j-<hostname>.service. Shared instance owns neither.
+        paths.push(`/etc/neo4j-${BRAND.hostname}`);
+        paths.push(`/etc/systemd/system/neo4j-${BRAND.hostname}.service`);
+    }
     for (const p of paths) {
         if (existsSync(p)) {
             try {
@@ -374,6 +412,29 @@ function removeNeo4jData() {
             }
         }
     }
+    if (isDedicated) {
+        try {
+            spawnSync("sudo", ["systemctl", "daemon-reload"], { stdio: "pipe" });
+        }
+        catch { /* ignore */ }
+    }
+}
+/** Read NEO4J_URI port from this brand's .env. Returns undefined when the
+ *  file is missing or malformed — caller treats that as "assume shared 7687". */
+function readNeo4jPortFromEnv() {
+    const envPath = join(CONFIG_DIR, ".env");
+    if (!existsSync(envPath))
+        return undefined;
+    try {
+        const match = readFileSync(envPath, "utf-8").match(/^NEO4J_URI=bolt:\/\/localhost:(\d+)$/m);
+        if (!match)
+            return undefined;
+        const port = parseInt(match[1], 10);
+        return isNaN(port) ? undefined : port;
+    }
+    catch {
+        return undefined;
+    }
 }
 // ---------------------------------------------------------------------------
 // Step 6: Purge system packages
@@ -384,6 +445,15 @@ function purgeSystemPackages() {
         console.log("  Not Linux — skipping package removal.");
         return;
     }
+    // Brand isolation (Task 659): every package in the list below is shared
+    // device-wide (neo4j, openjdk, tigervnc, websockify, novnc, cloudflared) —
+    // purging them when a peer brand is still installed breaks the peer's
+    // runtime. Leave packages in place; the operator can purge manually after
+    // uninstalling the last brand on the device.
+    if (peerBrandPresent()) {
+        console.log("  Peer brand still installed — skipping shared package purge.");
+        return;
+    }
     const packages = [
         "neo4j",
         "openjdk-17-jre-headless",
@@ -426,12 +496,22 @@ function removeSystemConfig() {
         console.log("  Not Linux — skipping.");
         return;
     }
+    // Brand isolation (Task 659): the Neo4j apt repo and GPG key are device-wide
+    // prerequisites for installing/updating Neo4j packages — leaving them when a
+    // peer brand is still installed is the correct posture. Avahi service and
+    // NetworkManager config are brand-specific (filenames keyed on BRAND.hostname).
+    const peerPresent = peerBrandPresent();
     const files = [
         { path: `/etc/avahi/services/${BRAND.hostname}.service`, label: "Avahi mDNS service" },
         { path: `/etc/NetworkManager/conf.d/${BRAND.hostname}-no-powersave.conf`, label: "WiFi power save config" },
-        { path: "/etc/apt/sources.list.d/neo4j.list", label: "Neo4j apt repository" },
-        { path: "/usr/share/keyrings/neo4j.gpg", label: "Neo4j GPG key" },
+        ...(peerPresent ? [] : [
+            { path: "/etc/apt/sources.list.d/neo4j.list", label: "Neo4j apt repository" },
+            { path: "/usr/share/keyrings/neo4j.gpg", label: "Neo4j GPG key" },
+        ]),
     ];
+    if (peerPresent) {
+        console.log("  Peer brand still installed — leaving Neo4j apt repo + GPG key in place.");
+    }
     for (const { path, label } of files) {
         if (existsSync(path)) {
             try {
@@ -504,6 +584,14 @@ function removeSystemdService() {
 // ---------------------------------------------------------------------------
 function removeOllama() {
     log("9", "Removing Ollama...");
+    // Brand isolation (Task 659): the Ollama binary and systemd service are
+    // device-wide singletons — every brand on this device shares one Ollama
+    // process. Leave both in place when a peer brand is still installed;
+    // uninstalling Ollama would break the peer brand's embedding pipeline.
+    if (peerBrandPresent()) {
+        console.log("  Peer brand still installed — leaving Ollama binary and service in place.");
+        return;
+    }
     // Stop and disable the systemd service if it exists
     try {
         spawnSync("sudo", ["systemctl", "stop", "ollama"], { stdio: "pipe", timeout: 10_000 });
@@ -565,20 +653,32 @@ function restoreHostname() {
 // Summary display
 // ---------------------------------------------------------------------------
 function showRemovalSummary() {
+    const peer = peerBrandPresent();
     console.log("");
     console.log("The following will be removed:");
     console.log("");
-    console.log(`  Services:   ${BRAND.serviceName}, Neo4j, cloudflared, VNC, Ollama`);
-    console.log(`  App dirs:   ~/${BRAND.installDir}/, ~/${BRAND.configDir}/, ~/.claude/, ~/.cloudflare/, ~/.cloudflared/, ~/.ollama/`);
-    console.log("  Database:   Neo4j data and transaction logs");
-    console.log("  Packages:   neo4j, openjdk (17 or 21), tigervnc, websockify, novnc, cloudflared");
-    console.log("  Config:     avahi service, WiFi power save, apt repos, GPG keys");
+    console.log(`  Services:   ${BRAND.serviceName}${peer ? "" : ", Neo4j, cloudflared, VNC, Ollama"}`);
+    console.log(`  App dirs:   ~/${BRAND.installDir}/, ~/${BRAND.configDir}/${peer ? "" : ", ~/.claude/, ~/.ollama/"}`);
+    console.log(`  Database:   Neo4j data + logs for ${BRAND.productName}'s instance`);
+    if (!peer) {
+        console.log("  Packages:   neo4j, openjdk (17 or 21), tigervnc, websockify, novnc, cloudflared");
+        console.log("  Config:     avahi service, WiFi power save, apt repos, GPG keys");
+        console.log("  Ollama:     binary and models");
+    }
+    else {
+        console.log("  Config:     avahi service, WiFi power save (apt repo + GPG key left in place)");
+    }
     console.log(`  Systemd:    ${BRAND.serviceName} unit file, user lingering`);
-    console.log("  Ollama:     binary and models");
     console.log(`  Hostname:   restored from '${BRAND.hostname}' to 'raspberrypi'`);
-    console.log("  Cloudflare: tunnel and DNS records deleted from Cloudflare's edge");
+    console.log(`  Cloudflare: ${BRAND.productName}'s tunnel and DNS records deleted from Cloudflare's edge`);
     console.log("");
-    console.log("  Node.js and shared system utilities (curl, git, etc.) are NOT removed.");
+    if (peer) {
+        console.log("  Peer brand still installed — device-wide singletons (Ollama, cloudflared");
+        console.log("  binary, apt packages, ~/.claude, ~/.ollama) are left in place.");
+    }
+    else {
+        console.log("  Node.js and shared system utilities (curl, git, etc.) are NOT removed.");
+    }
     console.log("");
 }
 // ---------------------------------------------------------------------------