@tiens.nguyen/gu-cli 1.0.789 → 1.0.791

package/client-expert-run.mjs

@@ -13,7 +13,7 @@
  * paired, so writing it before the API is proven usable leaves a terminal aimed at something
  * that does not work — and that state is much harder to get out of than an unfinished setup.
  */
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { readFile, writeFile, mkdir, rm, rename } from "node:fs/promises";
 import { writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -283,8 +283,9 @@ export async function probeDockerForMongo(name = MONGO_DOCKER_NAME) {
  * macOS: make a native MongoDB answer on 27017 (task #304). → { ok, explained }.
  * `explained` = it printed its own guidance, so the caller adds none.
  */
-export async function ensureNativeMongoMac(ask, mongo, { log = (l) => console.log(l) } = {}) {
+export async function ensureNativeMongoMac(ask, mongo, { log = (l) => console.log(l), brewHasTrust = null } = {}) {
   const mn = await import("./mongo-native.mjs");
+  brewHasTrust ??= mn.brewHasTrust;
   const brew = mn.findBrew();
   const { action, holder } = mn.macMongoAction({
     state: mongo.silentPort ? "silent" : "closed",
@@ -299,22 +300,23 @@ export async function ensureNativeMongoMac(ask, mongo, { log = (l) => console.lo
   }
   if (action === "no-brew") {
     log("");
-    for (const l of mn.noBrewLines()) log(dim("  " + l));
+    for (const l of mn.noBrewLines()) log("  " + (l.startsWith("  ") ? l : dim(l)));
     return { ok: false, explained: true };
   }
   const installing = action === "brew-install";
-  const yes = await ask(
-    installing
-      ? "  Install MongoDB Community with Homebrew now? [Y/n]: "
-      : "  MongoDB is installed but not running. Start it now (brew services)? [Y/n]: "
-  );
+  const steps = installing ? mn.brewInstallSteps({ trust: await brewHasTrust(brew) }) : mn.BREW_START_STEPS;
+  // THE COMMANDS FIRST, THEN THE QUESTION (task #329): "install now?" with nothing shown asks for
+  // a yes to something unseen. These are exactly the lines a yes runs.
+  log(dim(installing ? "\n  It is not installed here. This installs it (Homebrew):\n" : "\n  It is installed but not running. This starts it:\n"));
+  for (const s of steps) log(`    brew ${s.join(" ")}`);
+  log("");
+  const yes = await ask(installing ? "  Install MongoDB now? [Y/n]: " : "  Start MongoDB now? [Y/n]: ");
   if (String(yes ?? "").trim().toLowerCase().startsWith("n")) {
-    log(dim("\n  Not installed. To do it yourself:"));
-    for (const s of installing ? mn.BREW_INSTALL_STEPS : mn.BREW_START_STEPS) log(dim(`    brew ${s.join(" ")}`));
+    log(dim(`\n  Not ${installing ? "installed" : "started"} — run the commands above yourself.`));
     return { ok: false, explained: true };
   }
   log("\n  " + bold(installing ? "Installing MongoDB Community" : "Starting MongoDB") + dim("   Homebrew, a minute or two"));
-  const done = await mn.runBrewSteps(brew, installing ? mn.BREW_INSTALL_STEPS : mn.BREW_START_STEPS, {
+  const done = await mn.runBrewSteps(brew, steps, {
     onLine: (l) => l.length < 200 && log(dim("    " + l)),
   });
   if (!done) {
@@ -331,6 +333,241 @@ export async function ensureNativeMongoMac(ask, mongo, { log = (l) => console.lo
   return { ok: true, explained: true };
 }
 
+/** /etc/os-release → { id, codename, versionId }, or null where there is none (not Linux). */
+export function readOsRelease({ read = (f) => readFileSync(f, "utf8") } = {}) {
+  let text = "";
+  try {
+    text = read("/etc/os-release");
+  } catch {
+    return null;
+  }
+  const kv = {};
+  for (const line of String(text).split(/\r?\n/)) {
+    const m = /^([A-Z_]+)=(.*)$/.exec(line.trim());
+    if (m) kv[m[1]] = m[2].replace(/^["']|["']$/g, "");
+  }
+  return {
+    id: String(kv.ID ?? "").toLowerCase(),
+    codename: String(kv.VERSION_CODENAME ?? kv.UBUNTU_CODENAME ?? "").toLowerCase(),
+    versionId: String(kv.VERSION_ID ?? ""),
+  };
+}
+
+/**
+ * Run one install command with THE TERMINAL ITSELF as its input and output. → exit code, or null
+ * when it could not start.
+ *
+ * `sudo` and winget ask their own questions (a password, a licence), so they get the real
+ * terminal rather than a pipe. gu's own reader is PAUSED for the duration: two readers on one
+ * terminal split the keystrokes between them, and half a sudo password typed into gu is both a
+ * failed install and a password in the wrong place.
+ */
+export function runInTerminal(cmd, { platform = process.platform, spawnFn = spawn, stdin = process.stdin } = {}) {
+  return new Promise((resolve) => {
+    const wasRaw = Boolean(stdin.isTTY && stdin.isRaw);
+    const wasPaused = typeof stdin.isPaused === "function" ? stdin.isPaused() : true;
+    try {
+      if (wasRaw) stdin.setRawMode(false);
+      stdin.pause?.();
+    } catch { /* not a terminal — nothing to hand over */ }
+    const restore = (code) => {
+      try {
+        if (wasRaw) stdin.setRawMode(true);
+        if (!wasPaused) stdin.resume?.();
+      } catch { /* same */ }
+      resolve(code);
+    };
+    let child;
+    try {
+      child = platform === "win32"
+        ? spawnFn("cmd.exe", ["/d", "/s", "/c", cmd], { stdio: "inherit", windowsVerbatimArguments: true })
+        : spawnFn("sh", ["-c", cmd], { stdio: "inherit" });
+    } catch {
+      restore(null);
+      return;
+    }
+    child.on("error", () => restore(null));
+    child.on("close", (code) => restore(code));
+  });
+}
+
+/**
+ * Make a native MongoDB answer on this machine — SHOW the commands, ASK, then run them (#329).
+ * → { ok, explained }. macOS goes through Homebrew (ensureNativeMongoMac); Ubuntu through
+ * MongoDB's apt repo; Windows 11 through winget.
+ *
+ * WHY IT ASKS NOW. This step used to print the commands and stop — a deliberate choice, after an
+ * earlier "Install MongoDB now?" whose yes and no did the same thing. The answer to a question
+ * that changes nothing is to make it change something, not to stop asking: a first install that
+ * ends in "go and run these five lines, then come back" loses the people it was written for.
+ * So yes RUNS them, in the user's own terminal where sudo can ask for its password, and no
+ * leaves the same lines on screen to run by hand.
+ */
+export async function ensureNativeMongo(ask, mongo, {
+  platform = process.platform,
+  log = (l) => console.log(l),
+  os = platform === "linux" ? readOsRelease() : null,
+  isRoot = typeof process.getuid === "function" && process.getuid() === 0,
+  runCmd = runInTerminal,
+  waitFor = null,
+  ensureMac = ensureNativeMongoMac,
+} = {}) {
+  if (platform === "darwin") return ensureMac(ask, mongo, { log });
+  if (mongo.silentPort) {
+    const mn = await import("./mongo-native.mjs");
+    log("");
+    for (const l of mn.silentPortLines({ action: mn.isDockerHolder(mongo.holder) ? "docker-stuck" : "port-silent", holder: mongo.holder })) {
+      log("  " + (l.startsWith("  ") ? l : dim(l)));
+    }
+    return { ok: false, explained: true };
+  }
+  const plan = mongoInstallPlan(platform, { os, isRoot });
+  if (!plan) return { ok: false, explained: false };
+  const installing = !mongo.installed;
+  const commands = installing ? plan.commands : [plan.start];
+  if (!commands.length) {
+    // A Linux that is not Ubuntu: its package manager is not ours to guess at.
+    log(dim(`\n  It is not installed here, and gu only knows the install commands for Ubuntu`));
+    log(dim(`  (this is ${plan.distro || "another Linux"}). MongoDB's own instructions:`));
+    log("    " + plan.docs);
+    return { ok: false, explained: true };
+  }
+  log(dim(installing ? "\n  It is not installed here. This installs it:\n" : "\n  It is installed but not running. This starts it:\n"));
+  for (const c of commands) log("    " + c);
+  log("");
+  const needs = platform === "win32"
+    ? "Windows may ask for administrator permission"
+    : isRoot ? "" : "sudo will ask for your password";
+  const yes = await ask(`  ${installing ? "Install" : "Start"} MongoDB now?${needs ? ` (${needs})` : ""} [Y/n]: `);
+  if (String(yes ?? "").trim().toLowerCase().startsWith("n")) {
+    log(dim(`\n  Not ${installing ? "installed" : "started"} — run the commands above yourself.`));
+    return { ok: false, explained: true };
+  }
+  log("\n  " + bold(installing ? "Installing MongoDB" : "Starting MongoDB") + dim(installing ? "   a few minutes" : ""));
+  for (const c of commands) {
+    log(dim(`  $ ${c}`));
+    const code = await runCmd(c, { platform });
+    if (code !== 0) {
+      log("\n  " + red("✗ ") + (code === null ? "that command could not be started" : `that command failed (exit ${code})`) + " — the lines above say why.");
+      if (platform === "win32" && code === null) log(dim(`  No winget here? Download the installer: ${plan.docs}`));
+      log(dim("  Fix it, or run the remaining commands yourself."));
+      return { ok: false, explained: true };
+    }
+  }
+  const { host, port } = mongoHostPort(LOCAL_MONGO_URI);
+  const wait = waitFor ?? (await import("./mongo-native.mjs")).waitForMongo;
+  if (!(await wait(host, port, { timeoutMs: 60000 }))) {
+    log("\n  " + red("✗ ") + `MongoDB was ${installing ? "installed" : "started"} but is not answering at ${host}:${port} yet.`);
+    log(dim(platform === "win32"
+      ? "  Check the service:  sc query MongoDB   — then run gu again."
+      : "  Check the service:  systemctl status mongod   — then run gu again."));
+    return { ok: false, explained: true };
+  }
+  log("  " + cyan("✓ MongoDB is running") + dim(` at ${host}:${port} (a system service — it starts with the machine)`));
+  return { ok: true, explained: true };
+}
+
+/**
+ * "" when the database at `uri` answers a MongoDB handshake, else the "host:port" that does not.
+ * mongodb+srv names a cluster rather than a host:port, so it is never reported down from here.
+ */
+export async function localMongoDown(uri = LOCAL_MONGO_URI, { check = null } = {}) {
+  if (/^mongodb\+srv:/i.test(String(uri))) return "";
+  const { host, port } = mongoHostPort(uri);
+  const answers = check ?? (await import("./mongo-native.mjs")).mongoAnswers;
+  return (await answers(host, port)) === "answers" ? "" : `${host}:${port}`;
+}
+
+/**
+ * A FINISHED Local-mode machine whose MongoDB has stopped answering (task #329).
+ * → { ok, fixed, installed }: ok = it answers now; installed = it had to be INSTALLED, so the
+ * database is new and empty.
+ *
+ * Setup only looks at MongoDB while setup is running. Once every step is "done" nothing looked
+ * again, and the API's /api/health answers "up, mongo, persistence on" without touching the
+ * database — so a machine whose mongod was gone (seen 2026-10-02: Homebrew reinstalled, MongoDB
+ * with it) got "(cannot access local mongodb…)", then a 15s wait, then "the API is running and
+ * stuck — is mongod running?". The question it asked the reader is one it can answer itself, in
+ * milliseconds, with the same handshake setup uses.
+ */
+export async function preflightLocalMongo({
+  ask,
+  isTty = false,
+  platform = process.platform,
+  uri = LOCAL_MONGO_URI,
+  check = null,
+  probe = probeMongo,
+  ensure = ensureNativeMongo,
+  brewHasTrust = async (brew) => (await import("./mongo-native.mjs")).brewHasTrust(brew),
+  os = platform === "linux" ? readOsRelease() : null,
+  isRoot = typeof process.getuid === "function" && process.getuid() === 0,
+  log = (l) => console.log(l),
+} = {}) {
+  if (!(await localMongoDown(uri, { check }))) return { ok: true, fixed: false, installed: false };
+  const { host, port } = mongoHostPort(uri);
+
+  const local = /^(127\.|localhost$|\[?::1\]?$)/i.test(host);
+  const mongo = local ? await probe() : { running: false, installed: false };
+  // The cheap handshake can lose a race with a mongod that is still starting; the full probe
+  // (mongosh ping, then the socket again) is the second opinion before anything is said.
+  if (mongo.running) return { ok: true, fixed: false, installed: false };
+
+  log("\n  " + red("gu: MongoDB is not answering") + dim(` at ${host}:${port}`) +
+    red(mongo.installed || mongo.silentPort || !local ? "." : " — it is not installed on this machine."));
+  log(dim("  Local mode keeps your conversations, models and keys in that database, so"));
+  log(dim("  nothing can start without it. The API on :4100 is fine — it is waiting on this."));
+  if (!local) {
+    log(dim(`\n  That database is on another machine (${host}). Start it there, then run gu again.\n`));
+    return { ok: false, fixed: false, installed: false };
+  }
+  if (isTty && ask) {
+    const r = await ensure(ask, mongo, { platform, log, os, isRoot });
+    if (r.ok || r.explained) {
+      if (!r.ok) log("\n  " + dim("Then run `gu` again.") + "\n");
+      return { ok: r.ok, fixed: r.ok, installed: r.ok && !mongo.installed };
+    }
+  }
+  // NOBODY TO ASK (a pipe, CI): the same commands, printed, and nothing is run.
+  const plan = mongoInstallPlan(platform, { os, isRoot });
+  if (mongo.silentPort) {
+    const mn = await import("./mongo-native.mjs");
+    log("");
+    for (const l of mn.silentPortLines({ action: mn.isDockerHolder(mongo.holder) ? "docker-stuck" : "port-silent", holder: mongo.holder, port })) {
+      log("  " + (l.startsWith("  ") ? l : dim(l)));
+    }
+  } else if (mongo.installed && plan?.start) {
+    log(dim("\n  It is installed but not running. Start it with:\n"));
+    log("    " + plan.start);
+  } else if (plan?.commands.length) {
+    log(dim("\n  Install it with:\n"));
+    let commands = plan.commands;
+    if (platform === "darwin") {
+      // The same steps a yes would run — including `brew trust`, where this Homebrew needs it.
+      const mn = await import("./mongo-native.mjs");
+      commands = mn.brewInstallSteps({ trust: await brewHasTrust(mn.findBrew()) }).map((s) => `brew ${s.join(" ")}`);
+    }
+    for (const c of commands) log("    " + c);
+  } else {
+    log(dim("\n  Install it — MongoDB's own instructions:\n"));
+    log("    " + (plan?.docs ?? "https://www.mongodb.com/docs/manual/installation/"));
+  }
+  log("\n  " + dim("Then run `gu` again.") + "\n");
+  return { ok: false, fixed: false, installed: false };
+}
+
+/**
+ * A newly INSTALLED MongoDB is empty: the user, the worker key and the model settings this
+ * machine's setup wrote are not in it. Re-open exactly those steps, so the next thing `gu` does
+ * is its ordinary resume — which seeds the database under the SAME identity (seedDatabase reuses
+ * localUserId / localWorkerKey) and asks for the models again. Pure.
+ */
+export function reopenAfterEmptyDatabase(state) {
+  const why = "MongoDB was reinstalled — its database is new and empty";
+  let next = recordStep(state, "database", "interrupted", { reason: why });
+  next = recordStep(next, "models", "interrupted", { reason: why });
+  return next;
+}
+
 /**
  * Start MongoDB in a container and wait for it to answer. → true when it is up.
  *
@@ -734,53 +971,43 @@ export async function runClientExpertSetup({
   }
 
   if (plan.next === "mongo") {
-    // WE ONLY CHECK. Installing a database is a system-wide change needing sudo, a package
-    // manager and a working repo for this architecture — none of which a terminal should take
-    // on unasked, and all of which the user can do better themselves. An earlier version asked
-    // "Install MongoDB now? [y/N]", which was a question this code could not honour: it prints
-    // commands either way, so "yes" and "no" did the same thing. A choice that changes nothing
-    // is worse than no choice.
-    console.log("\n  " + bold("MongoDB is not running on this machine."));
+    // SHOW THE COMMANDS, ASK, THEN RUN THEM (task #329) — on macOS, Ubuntu and Windows 11 alike.
+    //
+    // This used to only check: "installing a database is a system-wide change needing sudo… the
+    // user can do better themselves", written after an earlier "Install MongoDB now? [y/N]" that
+    // printed the same commands whichever way it was answered. That was the right verdict on a
+    // question that changed nothing and the wrong fix for it — a first install that ends in "run
+    // these five lines and come back" is where people stop. So the question is back and a yes is
+    // honoured: the commands run in the user's own terminal, where sudo asks for its password.
+    console.log("\n  " + bold(mongo.installed ? "MongoDB is not running on this machine." : "MongoDB is not installed on this machine."));
     console.log(dim("  Local mode keeps every conversation and token count in a database"));
     console.log(dim("  on THIS machine, so it needs one before setup can go further."));
     // A MAC GETS NATIVE MONGODB, NOT DOCKER (task #304): Homebrew's mongodb-community as a brew
     // service. Docker on a Mac puts every call through its VM, and a stuck Docker Desktop keeps
-    // 27017 open while nothing answers — the failure that stopped this project's own Mac. The
-    // Docker branch below stays for Linux and Windows.
+    // 27017 open while nothing answers — the failure that stopped this project's own Mac.
+    //
+    // ELSEWHERE, DOCKER IS OFFERED ONLY WHERE IT ALREADY ANSWERS — one container, no system
+    // service — and declining it, or not having it, leads to the native install rather than to
+    // "Docker is not available here": a machine without Docker is the ordinary case on a server
+    // and on Windows, not an error to open with.
     let explained = false;
-    if (machine.platform === "darwin") {
-      const r = await ensureNativeMongoMac(ask, mongo);
+    if (machine.platform !== "darwin" && !mongo.silentPort && (await probeDockerForMongo()).usable) {
+      if (await startMongoInDocker(ask)) {
+        mongo.running = true;
+        probe.mongoRunning = true;
+      }
+    }
+    if (!probe.mongoRunning) {
+      const r = await ensureNativeMongo(ask, mongo, { platform: machine.platform });
       if (r.ok) {
         mongo.running = true;
         probe.mongoRunning = true;
       }
       explained = r.explained;
-    } else
-    // DOCKER FIRST, WHERE IT EXISTS. This is the one branch here that can actually finish the
-    // job rather than print homework: one container, no tap, no system service, and the same
-    // mongo:8 the project's own end-to-end tests run against. Only offered when `docker ps`
-    // answers, so a machine with Docker installed-but-not-running is not sent down a dead end.
-    // On success setup CONTINUES in this same run instead of asking the user to start over.
-    if (await startMongoInDocker(ask)) {
-      mongo.running = true;
-      probe.mongoRunning = true;
     }
-    if (probe.mongoRunning || explained) {
-      // fall through — running, or the Mac branch has already said what to do.
-    } else if (mongo.installed) {
-      console.log(dim("\n  It looks installed but is not answering. Start it with:\n"));
-      console.log(
-        "    " + (machine.platform === "darwin"
-          ? "brew services start mongodb-community"
-          : machine.platform === "win32"
-            ? "net start MongoDB"
-            : "sudo systemctl enable --now mongod")
-      );
-    } else {
-      const install = mongoInstallPlan(machine.platform);
-      console.log(dim("\n  Install it however you prefer — for reference, the usual way here is:\n"));
-      for (const c of install.commands) console.log(dim("    " + c));
-      console.log("\n  " + dim(`then check it answers:  ${install.verify}`));
+    if (!probe.mongoRunning && !explained) {
+      // A platform with no plan at all — unreachable past the gate, kept so it is never silent.
+      console.log(dim("\n  Install MongoDB Community, then run gu again: https://www.mongodb.com/docs/manual/installation/"));
     }
     // STOP ONLY IF IT IS STILL NOT RUNNING. When Docker started one above there is nothing to
     // wait for, so setup carries straight on in this run — sending someone away to re-run

package/client-expert-setup.mjs

@@ -446,7 +446,39 @@ export function mongoDockerPlan({ exists = false, port = 27017 } = {}) {
 }
 
 /** The install commands for a platform, or null when we do not support it. */
-export function mongoInstallPlan(platform) {
+/**
+ * Which MongoDB apt repo an Ubuntu release uses → "focal" | "jammy" | "noble" | "" (no repo).
+ *
+ * THE CODENAME IS PART OF THE COMMAND (task #329). The plan used to say `jammy/mongodb-org/7.0`
+ * to every Linux machine, and that repo does not exist for Ubuntu 24.04 (noble has no 7.0 —
+ * checked: HTTP 404), so on the commonest server release `apt-get update` failed on the line
+ * setup had just printed. 8.0 is published for focal, jammy and noble. A release between two
+ * LTSes takes the LTS below it, which is what MongoDB's own instructions say to do.
+ */
+export function ubuntuMongoRepo({ codename = "", versionId = "" } = {}) {
+  const c = String(codename).trim().toLowerCase();
+  if (MONGO_APT_CODENAMES.includes(c)) return c;
+  const v = parseFloat(String(versionId));
+  if (!Number.isFinite(v)) return "";
+  if (v >= 24.04) return "noble";
+  if (v >= 22.04) return "jammy";
+  if (v >= 20.04) return "focal";
+  return "";
+}
+export const MONGO_APT_CODENAMES = ["focal", "jammy", "noble"];
+export const MONGO_APT_SERIES = "8.0";
+export const MONGO_LINUX_DOCS = "https://www.mongodb.com/docs/manual/administration/install-on-linux/";
+
+/**
+ * The commands that install MongoDB here, the one that starts an installed one, and how to check.
+ *
+ * `os` is /etc/os-release on Linux ({ id, codename, versionId }) and `isRoot` drops `sudo` — a
+ * root shell on a server often has no sudo at all, and a pasted `sudo …` then fails on the word.
+ * With no `os` given the Linux commands read the codename from the machine themselves, so they
+ * are still right when copied. A Linux that is not Ubuntu gets no commands, only `docs`: its
+ * package manager is not one this plan can speak for.
+ */
+export function mongoInstallPlan(platform, { os = null, isRoot = false } = {}) {
   if (platform === "darwin") {
     return {
       platform,
@@ -455,6 +487,7 @@ export function mongoInstallPlan(platform) {
         "brew install mongodb-community",
         "brew services start mongodb-community",
       ],
+      start: "brew services start mongodb-community",
       verify: "mongosh --eval 'db.runCommand({ ping: 1 })'",
     };
   }
@@ -467,20 +500,36 @@ export function mongoInstallPlan(platform) {
         "winget install --id MongoDB.Server --accept-package-agreements --accept-source-agreements",
         "winget install --id MongoDB.Shell --accept-package-agreements --accept-source-agreements",
       ],
+      start: "net start MongoDB",
+      docs: "https://www.mongodb.com/try/download/community",
       verify: "mongosh --eval \"db.runCommand({ ping: 1 })\"",
     };
   }
   if (platform === "linux") {
+    const verify = "mongosh --eval 'db.runCommand({ ping: 1 })'";
+    const sudo = isRoot ? "" : "sudo ";
+    const start = `${sudo}systemctl enable --now mongod`;
+    const id = String(os?.id ?? "").trim().toLowerCase();
+    if (os && id && id !== "ubuntu") {
+      return { platform, commands: [], start, docs: MONGO_LINUX_DOCS, verify, distro: id };
+    }
+    const repo = os ? ubuntuMongoRepo(os) : '$(. /etc/os-release && echo "$VERSION_CODENAME")';
+    if (!repo) return { platform, commands: [], start, docs: MONGO_LINUX_DOCS, verify, distro: id || "ubuntu" };
+    const v = MONGO_APT_SERIES;
+    const key = `/usr/share/keyrings/mongodb-server-${v}.gpg`;
     return {
       platform,
       commands: [
-        "sudo apt-get install -y gnupg curl",
-        "curl -fsSL https://pgp.mongodb.com/server-7.0.asc | sudo gpg --dearmor -o /usr/share/keyrings/mongodb-server-7.0.gpg",
-        'echo "deb [signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list',
-        "sudo apt-get update && sudo apt-get install -y mongodb-org",
-        "sudo systemctl enable --now mongod",
+        `${sudo}apt-get install -y gnupg curl`,
+        // --yes: a second run must overwrite the key, not stop to ask whether it may.
+        `curl -fsSL https://pgp.mongodb.com/server-${v}.asc | ${sudo}gpg --dearmor --yes -o ${key}`,
+        `echo "deb [ arch=amd64,arm64 signed-by=${key} ] https://repo.mongodb.org/apt/ubuntu ${repo}/mongodb-org/${v} multiverse" | ${sudo}tee /etc/apt/sources.list.d/mongodb-org-${v}.list`,
+        `${sudo}apt-get update && ${sudo}apt-get install -y mongodb-org`,
+        start,
       ],
-      verify: "mongosh --eval 'db.runCommand({ ping: 1 })'",
+      start,
+      docs: MONGO_LINUX_DOCS,
+      verify,
     };
   }
   return null;