direxio-deployer 0.1.0

package/AGENTS.md

@@ -0,0 +1,92 @@
+# AGENTS.md
+
+`direxio-deployer` is a cross-platform deployment product and agent skill, not a Linux-only script collection. Maintain it as a portable orchestration layer that can be driven from Windows PowerShell, Git Bash/MSYS2, Linux, and macOS while deploying a Linux-based Direxio server.
+
+## Product Scope
+
+- Deploy, resume, verify, destroy, and locally wire a production Direxio message server.
+- Treat `SKILL.md` as the agent-facing runbook and `scripts/` as implementation details behind stable entrypoints.
+- The supported local conversation bridge is `direxio-connect` from `direxio-connent` or `YingSuiAI/direxio-connect`.
+- Supported local agent targets are the connent/connect agent providers, treated as peers: `acp`, `antigravity`, `claudecode`, `codex`, `copilot`, `cursor`, `devin`, `gemini`, `iflow`, `kimi`, `opencode`, `pi`, `qoder`, `reasonix`, and `tmux`.
+- Do not reintroduce legacy local MCP/plugin/gateway installation flows or third-party chat platform wiring.
+- Do not hard-code one developer's home directory, shell, agent executable path, AWS region, domain, node id, token, or password.
+
+## Platform Law
+
+Every deployer change must classify paths and commands by the platform that will consume them:
+
+- **Remote server paths** are Linux paths inside EC2/cloud-init/Docker, such as `/opt/p2p` and `/var/direxio-message-server`.
+- **Deployer execution paths** are used by the orchestration engine. Bash phase scripts can use POSIX paths, but PowerShell entrypoints must convert Windows paths before invoking Bash.
+- **Local bridge paths** are consumed by `direxio-connect` and the local agent process. On Windows they must be Windows-compatible paths, not `/mnt/c/...` or Git Bash-only `/c/...` paths.
+- **Documentation paths** must be portable examples using `$HOME`, `%USERPROFILE%`, `$env:USERPROFILE`, `<service_id>`, or `<domain>`, not machine-specific absolute paths.
+
+If a change writes a path into `state.json`, `credentials.json`, `env`, `cc-connect/config.toml`, docs, or printed commands, verify which process will read that path and format it for that process.
+
+## Entrypoints
+
+- POSIX users run `bash scripts/orchestrate.sh`.
+- Windows users run `.\scripts\orchestrate.ps1` from PowerShell. The wrapper may use Git Bash internally for existing Bash phases, but it must set Windows-local wiring variables such as `DIREXIO_LOCAL_PATH_STYLE=windows`.
+- Do not tell Windows users to run WSL unless the user explicitly chooses WSL as the host runtime. WSL and Windows are different local runtimes with different home directories, PATH lookup, daemon process control, and agent executable paths.
+- Keep `scripts/orchestrate.sh` and `scripts/orchestrate.ps1` behaviorally aligned for status, deploy/resume, and local bridge wiring.
+
+## Script Architecture
+
+- Keep the state-machine phases idempotent and resumable. A phase should be safe to rerun after token refresh, DNS wait, or partial local wiring.
+- Shell phase files should expose `run_phase` and use `state_get`, `state_set`, and `phase_set` instead of ad hoc state edits.
+- Prefer small helpers for platform conversion, command discovery, and output formatting. Do not scatter OS-specific path rewrites across phase bodies.
+- Remote server commands may assume Linux because the EC2 host is Linux. Local commands must not assume Linux.
+- Use PowerShell for Windows-native process and path behavior when the consumer is Windows-local, especially `direxio-connect.exe`, local agent executables, Windows user profile paths, or npm global binaries.
+- When adding a new local runtime or agent executable, support explicit override env vars before detection. For connect this includes `DIREXIO_CC_CONNECT_AGENT`, `DIREXIO_CC_CONNECT_AGENT_CMD`, and runtime-specific aliases such as `DIREXIO_CODEX_COMMAND`, `DIREXIO_GEMINI_COMMAND`, or `DIREXIO_CLAUDE_CODE_COMMAND`.
+- Do not make Codex, Claude, Gemini, Cursor, or any other provider the semantic default for an unknown runtime. Unknown or ambiguous detection should require an explicit `DIREXIO_CC_CONNECT_AGENT`.
+
+## Direxio Connect Wiring
+
+- S5/S6 must fail closed when `agent_room_id` is missing or uses a legacy pseudo id such as `!agent:<domain>`.
+- S6 must create a Matrix session through `agent.matrix_session.create` and require `@agent:<server>` for the bridge. Returning `@owner:<server>` is a server-side compatibility failure.
+- The generated cc-connect config must contain one Matrix platform and must restrict sync/replies to the real `agent_room_id`.
+- The generated agent config must preserve the selected connect agent type and optional agent-specific TOML. Some providers require more than `cmd`; for example `reasonix` needs `serve_url`, `tmux` needs `session`, and generic `acp` may need command/args.
+- `DIREXIO_AGENT_INSTALL=auto` may install/start `direxio-connect`; `recommend` must only write files and print commands.
+- `direxio-connent` publishing and GitHub release assets are part of the install contract. Do not claim npm install works until the package and matching `direxio-connect` assets exist.
+
+## Secrets And State
+
+- Never print, commit, or paste AWS secrets, IM passwords, Matrix access tokens, `agent_token`, private keys, or full credential files.
+- When verifying credentials, print booleans or identities only, such as `has_access_token=true`, `user_id`, `device_id`, and `homeserver`.
+- `credentials.json`, Matrix session files, SSH keys, and generated env files must stay outside the repository and should be written with restrictive permissions when the platform supports it.
+- Do not silently reuse stale `DIREXIO_AGENT_NODE_ID` across domains. Node ids must be scoped to the current deployment unless the operator explicitly forces an override.
+
+## Documentation Rules
+
+- Keep `README.md`, `README_zh.md`, `SKILL.md`, and `references/*` synchronized when changing deployment contracts, local bridge behavior, install commands, or platform support.
+- Keep user-facing docs focused on operating the deployer. Put implementation details and edge cases in `references/`.
+- Document Windows and POSIX examples separately when commands differ.
+- Avoid saying "run bash" as the universal answer. Say which host runtime is intended and why.
+
+## Validation
+
+Run focused checks after every change:
+
+```bash
+bash tests/skill_structure_test.sh
+bash tests/s6_wire_local_test.sh
+bash tests/render_userdata_remote_nodes_test.sh
+find scripts -name '*.sh' -print0 | xargs -0 -n1 bash -n
+git diff --check
+```
+
+On Windows-specific changes, also run or inspect:
+
+```powershell
+.\scripts\orchestrate.ps1 status
+powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\orchestrate.ps1 status
+```
+
+If a validation cannot be run on the current host, record the reason and run the closest targeted static check.
+
+## Change Discipline
+
+- Prefer portable helpers over one-off fixes.
+- When fixing a platform bug, search for the same assumption elsewhere before stopping.
+- Keep unrelated deployment behavior untouched unless the same abstraction owns it.
+- Self-review diffs before committing.
+- Commit finished work on the active branch with a focused message. Do not stage generated credentials, local state, binaries, logs, `.codegraph/`, or machine-specific test artifacts.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 P2P-IM
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,221 @@
+# Direxio Deployer
+
+[简体中文](README_zh.md)
+
+`direxio-deployer` deploys a production Direxio message server and wires the local agent room through Direxio's Matrix bridge. The supported local bridge is `direxio-connect`, installed from the npm package `direxio-connent@latest` by default or built from `YingSuiAI/direxio-connect`. S6 also writes service-scoped MCP snippets for MCP-capable hosts such as Codex, OpenClaw, and Hermes.
+
+## Contents
+
+- `SKILL.md`: Agent entrypoint, confirmation rules, deployment/destroy flow, and delivery format.
+- `scripts/`: State machine, AWS/EC2/DNS/cloud-init/verification/destroy scripts.
+- `references/`: Tooling, deployment resume flow, cc-connect wiring, state machine, architecture, troubleshooting, and recovery notes.
+- `agents/`: Runtime metadata and recognition notes for agent hosts.
+
+## Before Deployment
+
+- Prepare an AWS account, an AWS access key CSV or profile, and a real long-lived domain or subdomain.
+- AWS resources created by this deployer can bill until they are destroyed.
+- Use `SKILL.md` as the agent-facing runbook. It contains the detailed deployment rules, confirmation gates, runtime wiring behavior, and recovery procedures.
+
+## Skill Installation And Updates
+
+Install the deployer skill from npm, then place it into the current agent runtime's skill directory. Project-local installs are preferred because they keep the deployment skill scoped to the workspace that uses it.
+
+POSIX shells:
+
+```bash
+npm install -g direxio-deployer@latest
+direxio-deployer skill install --agent codex --scope project --project .
+```
+
+Windows PowerShell:
+
+```powershell
+npm install -g direxio-deployer@latest
+direxio-deployer skill install --agent codex --scope project --project .
+```
+
+Update the installed skill with the same host runtime:
+
+```bash
+npm install -g direxio-deployer@latest
+direxio-deployer skill update --agent codex --scope project --project .
+```
+
+Use the matching agent name for your runtime: `codex`, `claudecode`, `gemini`, `cursor`, `copilot`, `openclaw`, `hermes`, `opencode`, `qoder`, `reasonix`, or another target listed in `references/agent-targets.md`. Use `--scope global` only when you intentionally want a host-level skill install:
+
+```bash
+direxio-deployer skill install --agent codex --scope global
+```
+
+The installer writes `.direxio-skill-install.json` into the target directory and refuses to overwrite unmanaged existing content unless `--force` is provided. To pin a version, install that package version first:
+
+```bash
+npm install -g direxio-deployer@0.1.0
+direxio-deployer skill update --agent codex --scope project --project .
+```
+
+The CLI is implemented in Node and uses native paths for the host it runs on. On Windows it writes Windows-compatible paths; on Linux, macOS, Git Bash, or WSL it writes paths for that runtime.
+
+## Minimal Command
+
+Import and verify an AWS deployment profile from an AWS CSV. A temporary
+`DirexioDeployer` IAM user is recommended, but root access keys are allowed
+when the operator explicitly chooses them:
+
+```bash
+bash scripts/aws-credentials.sh import-csv /path/to/accessKeys.csv direxio-deployer us-east-1
+export AWS_PROFILE=direxio-deployer
+bash scripts/aws-credentials.sh verify direxio-deployer
+```
+
+Run from the repository root:
+
+```bash
+bash scripts/pricing-estimate.sh \
+  --region us-east-1 \
+  --instance-type t3.small \
+  --disk-gb 8 \
+  --domain-mode user
+```
+
+```bash
+AWS_DEFAULT_REGION=us-east-1 \
+DOMAIN=__DOMAIN__ \
+DOMAIN_MODE=user \
+CONFIRM_DOMAIN_BINDING=1 \
+INSTANCE_TYPE=t3.small \
+MESSAGE_SERVER_IMAGE=direxio/message-server:latest \
+bash scripts/orchestrate.sh
+```
+
+On Windows, use the PowerShell entrypoint so the deployer selects Git Bash for the cloud phases while writing Windows-compatible local `direxio-connect` paths:
+
+```powershell
+$env:AWS_DEFAULT_REGION = "us-east-1"
+$env:DOMAIN = "__DOMAIN__"
+$env:DOMAIN_MODE = "user"
+$env:CONFIRM_DOMAIN_BINDING = "1"
+$env:INSTANCE_TYPE = "t3.small"
+$env:MESSAGE_SERVER_IMAGE = "direxio/message-server:latest"
+.\scripts\orchestrate.ps1
+```
+
+Recommendation-only local bridge wiring:
+
+```bash
+DIREXIO_AGENT_INSTALL=recommend bash scripts/orchestrate.sh
+```
+
+Automatic local bridge install:
+
+```bash
+DIREXIO_AGENT_INSTALL=auto \
+DIREXIO_AGENT_PLATFORM=auto \
+DIREXIO_CC_CONNECT_AGENT=claudecode \
+DIREXIO_AGENT_INSTALL_MODE=recommended \
+bash scripts/orchestrate.sh
+```
+
+Supported install modes: `recommended` and `cc-connect`.
+If `DIREXIO_AGENT_PLATFORM=auto` cannot identify a single supported runtime, set `DIREXIO_CC_CONNECT_AGENT` explicitly. For OpenClaw or Hermes defaults, force the host runtime with `DIREXIO_AGENT_PLATFORM=openclaw` or `DIREXIO_AGENT_PLATFORM=hermes`; setting only `DIREXIO_CC_CONNECT_AGENT=acp` selects generic ACP and requires manual options. For OpenClaw Gateway ACP, set `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION` from the current OpenClaw runtime after pairing. Use `DIREXIO_OPENCLAW_ACP_ARGS_TOML` only when you need to provide the complete OpenClaw ACP args array yourself. Use `DIREXIO_HERMES_ACP_ARGS_TOML` for the child Hermes args; S6 prefixes the `hermes-acp-adapter -- <hermes-command>` wrapper automatically.
+
+Check status:
+
+```bash
+bash scripts/orchestrate.sh status
+DOMAIN=<domain> bash scripts/orchestrate.sh status
+```
+
+Destroy recorded resources:
+
+```bash
+DOMAIN=<domain> bash scripts/destroy.sh
+```
+
+On Windows, use the PowerShell destroy entrypoint:
+
+```powershell
+$env:DOMAIN = "<domain>"
+.\scripts\destroy.ps1
+```
+
+Destroy stops and uninstalls the local `direxio-connect` daemon only when its reported `WorkDir`
+matches the current service's `~/.direxio/nodes/<service_id>/cc-connect`
+directory, then removes that service directory.
+
+Update an existing node without deleting data:
+
+```bash
+DOMAIN=<domain> MESSAGE_SERVER_IMAGE=direxio/message-server:latest bash scripts/update.sh
+P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
+```
+
+Reset application data while preserving EC2, DNS, fixed IP, and Caddy TLS:
+
+```bash
+DIREXIO_RESET_APP_DATA_CONFIRM=1 DOMAIN=<domain> bash scripts/reset-app-data.sh
+P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
+```
+
+## Local Bridge
+
+S6 writes these service-scoped files under `~/.direxio/nodes/<service_id>/`:
+
+```text
+credentials.json
+env
+cc-connect/config.toml
+cc-connect/data/
+cc-connect/matrix-session.json
+mcp/codex.toml
+mcp/openclaw.md
+mcp/openclaw-server.json
+mcp/hermes.mcp.json
+mcp/mcp-servers.json
+```
+
+Manual install:
+
+```bash
+npm install -g direxio-connent@latest
+direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force
+direxio-connect daemon status --service-name <service_id>
+```
+
+MCP install and check:
+
+```bash
+npm install -g direxio-mcp@latest
+DIREXIO_CREDENTIALS_FILE=~/.direxio/nodes/<service_id>/credentials.json direxio-mcp doctor --json
+```
+
+Use `mcp/codex.toml` for Codex and `mcp/hermes.mcp.json` for Hermes. For OpenClaw, read `mcp/openclaw.md` and run the generated `openclaw mcp set` command against `mcp/openclaw-server.json`; do not paste MCP JSON into `~/.openclaw/openclaw.json`.
+
+Voice input is supported when an STT provider key is available. Set `DIREXIO_SPEECH_API_KEY` or provider-specific variables such as `DIREXIO_SPEECH_QWEN_API_KEY`; S6 will then write `[speech] enabled = true` into `cc-connect/config.toml`.
+
+Homebrew documentation should use:
+
+```bash
+brew install direxio-connect
+```
+
+Source builds use:
+
+```bash
+git clone https://github.com/YingSuiAI/direxio-connect.git
+cd connect
+make build AGENTS=<cc-connect-agent> PLATFORMS_INCLUDE=matrix
+```
+
+## Validation
+
+```bash
+bash tests/skill_structure_test.sh
+bash tests/default_paths_test.sh
+bash tests/s6_wire_local_test.sh
+bash tests/destroy_local_bridge_test.sh
+bash tests/render_userdata_remote_nodes_test.sh
+find scripts -name '*.sh' -print0 | xargs -0 -n1 bash -n
+git diff --check
+```

package/README_zh.md

@@ -0,0 +1,218 @@
+# Direxio Deployer
+
+`direxio-deployer` 是用于部署生产 Direxio message server 的通用 Agent Skill，并通过 Direxio 专用 Matrix 桥接把本地 agent room 接到当前 agent。当前本地桥接只支持 `direxio-connect`，安装包是 `direxio-connent`，源码仓库是 `YingSuiAI/direxio-connect`。S6 也会给 Codex、OpenClaw、Hermes 这类支持 MCP 的宿主写入服务级 MCP 配置片段。
+
+## 内容
+
+- `SKILL.md`: 智能体主入口、确认规则、部署/销毁流程和交付格式。
+- `scripts/`: 状态机、AWS/EC2/DNS/cloud-init/验证/销毁脚本。
+- `references/`: 工具准备、部署续跑、cc-connect wiring、状态机、架构、排障和恢复说明。
+- `agents/`: 面向不同智能体运行时的展示元数据和识别说明。
+
+## 部署前准备
+
+- 准备 AWS 账号、AWS access key CSV 或 profile，以及真实长期域名或子域名。
+- deployer 创建的 AWS 资源在销毁前可能持续计费。
+- `SKILL.md` 是给智能体看的运行手册，详细部署规则、确认门禁、运行时 wiring 和恢复流程都放在那里。
+
+## Skill 安装和更新
+
+通过 npm 安装 deployer skill，再把它写入当前智能体运行时的 skill 目录。默认推荐 project-local 安装，让部署 skill 跟随当前 workspace。
+
+POSIX shell：
+
+```bash
+npm install -g direxio-deployer@latest
+direxio-deployer skill install --agent codex --scope project --project .
+```
+
+Windows PowerShell：
+
+```powershell
+npm install -g direxio-deployer@latest
+direxio-deployer skill install --agent codex --scope project --project .
+```
+
+在同一个宿主运行时中更新已安装 skill：
+
+```bash
+npm install -g direxio-deployer@latest
+direxio-deployer skill update --agent codex --scope project --project .
+```
+
+根据当前运行时替换 agent 名称：`codex`、`claudecode`、`gemini`、`cursor`、`copilot`、`openclaw`、`hermes`、`opencode`、`qoder`、`reasonix`，或使用 `references/agent-targets.md` 中列出的其他目标。只有明确想安装到宿主级目录时才使用 `--scope global`：
+
+```bash
+direxio-deployer skill install --agent codex --scope global
+```
+
+安装器会在目标目录写入 `.direxio-skill-install.json`，并拒绝覆盖没有该 manifest 的既有目录，除非显式传入 `--force`。如需固定版本，先安装指定 npm 版本：
+
+```bash
+npm install -g direxio-deployer@0.1.0
+direxio-deployer skill update --agent codex --scope project --project .
+```
+
+这个 CLI 由 Node 实现，并使用当前宿主的原生路径。Windows 下写入 Windows 路径；Linux、macOS、Git Bash 或 WSL 下写入对应运行时能读取的路径。
+
+## 最小命令
+
+从 AWS CSV 导入并验证一个部署 profile。推荐使用临时 `DirexioDeployer` IAM
+用户；如果操作者明确选择 root access key，也允许继续：
+
+```bash
+bash scripts/aws-credentials.sh import-csv /path/to/accessKeys.csv direxio-deployer us-east-1
+export AWS_PROFILE=direxio-deployer
+bash scripts/aws-credentials.sh verify direxio-deployer
+```
+
+在仓库根目录运行：
+
+```bash
+bash scripts/pricing-estimate.sh \
+  --region us-east-1 \
+  --instance-type t3.small \
+  --disk-gb 8 \
+  --domain-mode user
+```
+
+```bash
+AWS_DEFAULT_REGION=us-east-1 \
+DOMAIN=__DOMAIN__ \
+DOMAIN_MODE=user \
+CONFIRM_DOMAIN_BINDING=1 \
+INSTANCE_TYPE=t3.small \
+MESSAGE_SERVER_IMAGE=direxio/message-server:latest \
+bash scripts/orchestrate.sh
+```
+
+Windows 用户使用 PowerShell 入口。它会选择 Git Bash 执行云端 phase，同时给本地 `direxio-connect` 写入 Windows 可直接使用的路径：
+
+```powershell
+$env:AWS_DEFAULT_REGION = "us-east-1"
+$env:DOMAIN = "__DOMAIN__"
+$env:DOMAIN_MODE = "user"
+$env:CONFIRM_DOMAIN_BINDING = "1"
+$env:INSTANCE_TYPE = "t3.small"
+$env:MESSAGE_SERVER_IMAGE = "direxio/message-server:latest"
+.\scripts\orchestrate.ps1
+```
+
+仅写入并推荐本地 bridge：
+
+```bash
+DIREXIO_AGENT_INSTALL=recommend bash scripts/orchestrate.sh
+```
+
+自动安装本地 bridge：
+
+```bash
+DIREXIO_AGENT_INSTALL=auto \
+DIREXIO_AGENT_PLATFORM=auto \
+DIREXIO_CC_CONNECT_AGENT=claudecode \
+DIREXIO_AGENT_INSTALL_MODE=recommended \
+bash scripts/orchestrate.sh
+```
+
+可选安装模式：`recommended`、`cc-connect`。
+如果 `DIREXIO_AGENT_PLATFORM=auto` 无法唯一识别当前运行时，显式设置 `DIREXIO_CC_CONNECT_AGENT`。需要触发 OpenClaw 或 Hermes 默认配置时，设置 `DIREXIO_AGENT_PLATFORM=openclaw` 或 `DIREXIO_AGENT_PLATFORM=hermes`；只设置 `DIREXIO_CC_CONNECT_AGENT=acp` 会进入通用 ACP，需要手动提供 options。OpenClaw Gateway ACP 必须在完成 pairing 后，从当前 OpenClaw runtime 填写 `DIREXIO_OPENCLAW_ACP_URL`、`DIREXIO_OPENCLAW_ACP_TOKEN_FILE` 和 `DIREXIO_OPENCLAW_ACP_SESSION`。只有需要完整覆盖 OpenClaw ACP args 数组时才使用 `DIREXIO_OPENCLAW_ACP_ARGS_TOML`；Hermes 自定义参数用 `DIREXIO_HERMES_ACP_ARGS_TOML`，S6 会自动在前面加上 `hermes-acp-adapter -- <hermes-command>`。
+
+查看状态：
+
+```bash
+bash scripts/orchestrate.sh status
+DOMAIN=<domain> bash scripts/orchestrate.sh status
+```
+
+销毁已记录资源：
+
+```bash
+DOMAIN=<domain> bash scripts/destroy.sh
+```
+
+Windows 用户使用 PowerShell 销毁入口：
+
+```powershell
+$env:DOMAIN = "<domain>"
+.\scripts\destroy.ps1
+```
+
+销毁时只会在 `direxio-connect daemon status --service-name <service_id>` 返回的 `WorkDir` 等于当前服务的
+`~/.direxio/nodes/<service_id>/cc-connect` 目录时停止并卸载本地 daemon，然后删除该
+service 目录。
+
+更新现有节点但不删除数据：
+
+```bash
+DOMAIN=<domain> MESSAGE_SERVER_IMAGE=direxio/message-server:latest bash scripts/update.sh
+P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
+```
+
+重置应用数据但保留 EC2、DNS、固定 IP 和 Caddy TLS：
+
+```bash
+DIREXIO_RESET_APP_DATA_CONFIRM=1 DOMAIN=<domain> bash scripts/reset-app-data.sh
+P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
+```
+
+## 本地 Bridge
+
+S6 会在 `~/.direxio/nodes/<service_id>/` 下写入：
+
+```text
+credentials.json
+env
+cc-connect/config.toml
+cc-connect/data/
+cc-connect/matrix-session.json
+mcp/codex.toml
+mcp/openclaw.md
+mcp/openclaw-server.json
+mcp/hermes.mcp.json
+mcp/mcp-servers.json
+```
+
+手动安装：
+
+```bash
+npm install -g direxio-connent
+direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force
+direxio-connect daemon status --service-name <service_id>
+```
+
+MCP 安装和检查：
+
+```bash
+npm install -g direxio-mcp
+DIREXIO_CREDENTIALS_FILE=~/.direxio/nodes/<service_id>/credentials.json direxio-mcp doctor --json
+```
+
+Codex 使用 `mcp/codex.toml`，Hermes 使用 `mcp/hermes.mcp.json`。OpenClaw 使用 `mcp/openclaw.md` 中生成的 `openclaw mcp set` 命令读取 `mcp/openclaw-server.json`；不要把 MCP JSON 直接粘贴到 `~/.openclaw/openclaw.json`。
+
+语音输入在配置 STT provider key 后可用。设置 `DIREXIO_SPEECH_API_KEY` 或 `DIREXIO_SPEECH_QWEN_API_KEY` 等 provider 专用变量后，S6 会在 `cc-connect/config.toml` 写入 `[speech] enabled = true`。
+
+Homebrew 文档使用：
+
+```bash
+brew install direxio-connect
+```
+
+源码构建：
+
+```bash
+git clone https://github.com/YingSuiAI/direxio-connect.git
+cd connect
+make build AGENTS=<cc-connect-agent> PLATFORMS_INCLUDE=matrix
+```
+
+## 验证
+
+```bash
+bash tests/skill_structure_test.sh
+bash tests/default_paths_test.sh
+bash tests/s6_wire_local_test.sh
+bash tests/destroy_local_bridge_test.sh
+bash tests/render_userdata_remote_nodes_test.sh
+find scripts -name '*.sh' -print0 | xargs -0 -n1 bash -n
+git diff --check
+```