direxio-deployer 0.1.7 → 0.1.9

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 P2P-IM
+Copyright (c) 2026 Direxio
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -69,9 +69,10 @@ The CLI is implemented in Node and uses native paths for the host it runs on. On
 
 ## Minimal Command
 
-Import and verify an AWS deployment profile from an AWS CSV. A temporary
-`DirexioDeployer` IAM user is recommended, but root access keys are allowed
-when the operator explicitly chooses them:
+Import and verify an AWS deployment profile from an AWS CSV. Root access keys
+are the fastest first-deploy path but are highly privileged; save the CSV
+securely and rotate or delete the key after deployment. A temporary
+`DirexioDeployer` IAM user is safer but takes more AWS console steps:
 
 ```bash
 bash scripts/aws-credentials.sh import-csv /path/to/accessKeys.csv direxio-deployer us-east-1
@@ -111,16 +112,15 @@ $env:MESSAGE_SERVER_IMAGE = "direxio/message-server:latest"
 .\scripts\orchestrate.ps1
 ```
 
-Recommendation-only local bridge wiring:
+Recommendation-only local bridge and MCP wiring:
 
 ```bash
 DIREXIO_AGENT_INSTALL=recommend bash scripts/orchestrate.sh
 ```
 
-Automatic local bridge install:
+Automatic local bridge and MCP install is the default. Set runtime selectors only when auto-detection is ambiguous:
 
 ```bash
-DIREXIO_AGENT_INSTALL=auto \
 DIREXIO_AGENT_PLATFORM=auto \
 DIREXIO_CC_CONNECT_AGENT=claudecode \
 DIREXIO_AGENT_INSTALL_MODE=recommended \
@@ -158,16 +158,23 @@ Update an existing node without deleting data:
 
 ```bash
 DOMAIN=<domain> MESSAGE_SERVER_IMAGE=direxio/message-server:latest bash scripts/update.sh
-P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
 ```
 
+Image refresh restarts the remote service only. It leaves local credentials,
+`direxio-connect`, MCP artifacts, user confirmations, and runtime checks intact.
+
 Reset application data while preserving EC2, DNS, fixed IP, and Caddy TLS:
 
 ```bash
 DIREXIO_RESET_APP_DATA_CONFIRM=1 DOMAIN=<domain> bash scripts/reset-app-data.sh
-P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
+DIREXIO_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
 ```
 
+Application data reset clears server-side app volumes, so the follow-up
+orchestrate run regenerates local credentials/MCP artifacts and automatically
+reinstalls/restarts `direxio-connect` plus `direxio-mcp` unless explicitly
+overridden with `DIREXIO_AGENT_INSTALL=recommend` or `skip`.
+
 ## Local Bridge
 
 S6 writes these service-scoped files under `~/.direxio/nodes/<service_id>/`:
@@ -193,7 +200,8 @@ direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect
 direxio-connect daemon status --service-name <service_id>
 ```
 
-MCP install and check:
+MCP is installed automatically during S6 when `DIREXIO_AGENT_INSTALL=auto`.
+Manual recovery command:
 
 ```bash
 npm install -g direxio-mcp@latest

package/README_zh.md

@@ -67,8 +67,9 @@ direxio-deployer skill update --agent codex
 
 ## 最小命令
 
-从 AWS CSV 导入并验证一个部署 profile。推荐使用临时 `DirexioDeployer` IAM
-用户；如果操作者明确选择 root access key，也允许继续：
+从 AWS CSV 导入并验证一个部署 profile。root access key 是首次部署最快路径，
+但权限极高；请安全保存 CSV，部署后轮换或删除密钥。临时
+`DirexioDeployer` IAM 用户更安全，但 AWS 控制台步骤更多：
 
 ```bash
 bash scripts/aws-credentials.sh import-csv /path/to/accessKeys.csv direxio-deployer us-east-1
@@ -108,16 +109,15 @@ $env:MESSAGE_SERVER_IMAGE = "direxio/message-server:latest"
 .\scripts\orchestrate.ps1
 ```
 
-仅写入并推荐本地 bridge：
+仅写入并推荐本地 bridge 和 MCP：
 
 ```bash
 DIREXIO_AGENT_INSTALL=recommend bash scripts/orchestrate.sh
 ```
 
-自动安装本地 bridge：
+默认会自动安装本地 bridge 和 MCP。只有自动检测不明确时才需要显式设置 runtime：
 
 ```bash
-DIREXIO_AGENT_INSTALL=auto \
 DIREXIO_AGENT_PLATFORM=auto \
 DIREXIO_CC_CONNECT_AGENT=claudecode \
 DIREXIO_AGENT_INSTALL_MODE=recommended \
@@ -155,16 +155,22 @@ service 目录。
 
 ```bash
 DOMAIN=<domain> MESSAGE_SERVER_IMAGE=direxio/message-server:latest bash scripts/update.sh
-P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
 ```
 
+镜像刷新只重启远端服务，不重置本地 credentials、`direxio-connect`、MCP
+配置、用户确认和 runtime checks。
+
 重置应用数据但保留 EC2、DNS、固定 IP 和 Caddy TLS：
 
 ```bash
 DIREXIO_RESET_APP_DATA_CONFIRM=1 DOMAIN=<domain> bash scripts/reset-app-data.sh
-P2P_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
+DIREXIO_EXISTING_STATE_ACTION=continue DOMAIN=<domain> bash scripts/orchestrate.sh
 ```
 
+清理应用数据卷后，后续 orchestrate 会重新生成本地 credentials/MCP 配置，
+并默认自动重新安装/重启 `direxio-connect` 和 `direxio-mcp`；如需只写文件，
+显式设置 `DIREXIO_AGENT_INSTALL=recommend` 或 `skip`。
+
 ## 本地 Bridge
 
 S6 会在 `~/.direxio/nodes/<service_id>/` 下写入：
@@ -190,10 +196,10 @@ direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect
 direxio-connect daemon status --service-name <service_id>
 ```
 
-MCP 安装和检查：
+默认 `DIREXIO_AGENT_INSTALL=auto` 时，S6 会自动安装 MCP。手动恢复命令：
 
 ```bash
-npm install -g direxio-mcp
+npm install -g direxio-mcp@latest
 DIREXIO_CREDENTIALS_FILE=~/.direxio/nodes/<service_id>/credentials.json direxio-mcp doctor --json
 ```
 

package/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: direxio-deployer
-description: Deploy, resume, verify, destroy, and locally wire a production P2P-IM Matrix server on AWS for any connent/connect-supported local agent runtime. Use when installing or updating this skill itself; install the versioned npm package `direxio-deployer` and use its CLI to place the skill in the runtime-specific global path from references/agent-targets.md unless the user explicitly asks for a project-local installation.
+description: Deploy, resume, verify, destroy, and locally wire a production Direxio message server on AWS for any connent/connect-supported local agent runtime. Use when installing or updating this skill itself; install the versioned npm package `direxio-deployer` and use its CLI to place the skill in the runtime-specific global path from references/agent-targets.md unless the user explicitly asks for a project-local installation.
 ---
 
 # Direxio Deployer
@@ -49,7 +49,7 @@ when it is safe and does not overwrite local edits. If the clone has local
 changes, do not discard them; report the divergence and continue from the local
 copy unless the user approves a specific update action.
 
-Do not fall back to older P2P-IM skill repositories or unmanaged copied skill bundles unless the user explicitly asks for one of those repositories. Never print or commit AWS credentials, initialization codes, agent tokens, or local credential files while refreshing the Skill.
+Do not fall back to older pre-Direxio skill repositories or unmanaged copied skill bundles unless the user explicitly asks for one of those repositories. Never print or commit AWS credentials, initialization codes, agent tokens, or local credential files while refreshing the Skill.
 
 ## Cloud Account And Domain Onboarding
 
@@ -100,17 +100,28 @@ Step-by-step onboarding flow:
      deployment?"
    - If yes, ask only for the local CSV path or profile name, then verify it
      with `aws sts get-caller-identity`.
-   - If no, default to a temporary IAM administrator user for MVP deployment.
-     Explain in one sentence: "This temporary user lets the deployment tool
-     create and later destroy this Direxio node; delete or disable it after
-     deployment."
-   - Root access keys are allowed when the operator explicitly chooses them.
-     Prefer a temporary `DirexioDeployer` IAM user for routine deployments, but
-     do not block deployment only because `aws sts get-caller-identity` returns
-     an ARN ending in `:root`. Warn once that root credentials are highly
-     privileged and should be rotated or removed when no longer needed, then
-     continue if the user accepts that risk.
-   - Guide only one or two clicks at a time:
+   - If no, offer two credential paths and ask the user to choose:
+     1. **Root access key (default fastest path):** simpler to create for a
+        first deployment because it uses the account owner identity directly.
+        Explain that it is highly privileged, must be saved securely, must
+        never be pasted into chat or committed, and should be rotated or
+        deleted after deployment.
+     2. **Dedicated IAM deployment user:** safer because it avoids root keys,
+        but requires more AWS console steps. Explain in one sentence: "This
+        temporary user lets the deployment tool create and later destroy this
+        Direxio node; delete or disable it after deployment."
+   - If the user chooses the root path, guide only one or two clicks at a time:
+     1. Sign in to AWS as the root account owner.
+     2. Open the root user's **Security credentials** page.
+     3. In **Access keys**, choose **Create access key**.
+     4. Select **Command Line Interface (CLI)**, acknowledge AWS's root-key
+        warning, and create the key.
+     5. Download the `.csv` file, store it securely, and provide only the local
+        CSV path to the agent.
+     6. After deployment, rotate or delete the root access key unless the user
+        has a deliberate reason to keep it.
+   - If the user chooses the dedicated IAM deployment user path, guide only one
+     or two clicks at a time:
      1. Open `https://console.aws.amazon.com/iam/home#/users/create`.
      2. Create a user named `DirexioDeployer-YYYYMMDD` or `DirexioDeployer`.
      3. Attach the AWS managed policy `AdministratorAccess`. State plainly
@@ -122,6 +133,10 @@ Step-by-step onboarding flow:
         continue.
      7. Choose `Create access key`, download the `.csv` file, and provide only
         the local file path.
+   - Root access keys are allowed when the operator explicitly chooses them.
+     Do not block deployment only because `aws sts get-caller-identity` returns
+     an ARN ending in `:root`; report `root=true`, repeat the security warning
+     once, and continue if the user accepts that risk.
    - After credentials are configured, run `aws sts get-caller-identity`,
      report only the account, whether the identity is root, and the redacted
      ARN.
@@ -342,7 +357,7 @@ Use a Git clone only for development or local patching of this deployer, not as
 
 ## Agent Recognition
 
-Use this skill when the user asks to deploy, resume, verify, destroy, repair, or wire a P2P-IM Matrix server. The instructions are runtime-neutral and can be followed by any agent that can run shell commands and read files. The local bridge target must be one of the connent/connect agents unless the user explicitly supplies compatible custom TOML. OpenClaw and Hermes are host runtimes that S6 wires through the generic connent/connect `acp` agent.
+Use this skill when the user asks to deploy, resume, verify, destroy, repair, or wire a Direxio message server. The instructions are runtime-neutral and can be followed by any agent that can run shell commands and read files. The local bridge target must be one of the connent/connect agents unless the user explicitly supplies compatible custom TOML. OpenClaw and Hermes are host runtimes that S6 wires through the generic connent/connect `acp` agent.
 
 For local agent integration after deployment, S6 writes service-specific credentials and environment files under `~/.direxio/nodes/<service_id>/`, where `service_id` is derived from the deployed domain. It also writes MCP client snippets under `~/.direxio/nodes/<service_id>/mcp/` for MCP-capable hosts such as Codex, OpenClaw, and Hermes. It does not write root-level compatibility credentials, shell profiles, Windows user environment variables, or mutate each host's global MCP config.
 
@@ -361,19 +376,19 @@ DIREXIO_CC_CONNECT_AGENT=<optional connect agent>
 DIREXIO_OPENCLAW_ACP_URL=<optional explicit OpenClaw gateway URL>
 DIREXIO_OPENCLAW_ACP_TOKEN_FILE=<optional explicit OpenClaw gateway token file>
 DIREXIO_OPENCLAW_ACP_SESSION=<optional OpenClaw ACP session; defaults to agent:main:main>
-DIREXIO_AGENT_INSTALL=recommend
+DIREXIO_AGENT_INSTALL=auto
 DIREXIO_AGENT_INSTALL_MODE=recommended
 ```
 
 The only supported local conversation bridge is `direxio-connect`, installed from `direxio-connent@latest` by default or built from `https://github.com/YingSuiAI/direxio-connect.git`. S6 creates a Matrix session for `@agent:<server>`, writes `~/.direxio/nodes/<service_id>/cc-connect/config.toml`, and restricts the bridge to the real `agent_room_id`.
 
-The local MCP tool surface is `direxio-mcp`, installed from `direxio-mcp@latest` by default. S6 writes `mcp/codex.toml`, `mcp/openclaw.md`, `mcp/openclaw-server.json`, `mcp/hermes.mcp.json`, `mcp/mcp-servers.json`, and `mcp/env`; these artifacts point to `credentials.json` by `DIREXIO_CREDENTIALS_FILE`. OpenClaw must be configured through the generated `openclaw mcp set` command in `mcp/openclaw.md`; do not paste MCP JSON into `~/.openclaw/openclaw.json`. Keep this separate from cc-connect: cc-connect must use its direct Matrix config and must not use `DIREXIO_CREDENTIALS_FILE`.
+The local MCP tool surface is `direxio-mcp`, installed from `direxio-mcp@latest` by default when `DIREXIO_AGENT_INSTALL=auto`. S6 writes `mcp/codex.toml`, `mcp/openclaw.md`, `mcp/openclaw-server.json`, `mcp/hermes.mcp.json`, `mcp/mcp-servers.json`, and `mcp/env`; these artifacts point to `credentials.json` by `DIREXIO_CREDENTIALS_FILE`. OpenClaw must be configured through the generated `openclaw mcp set` command in `mcp/openclaw.md`; do not paste MCP JSON into `~/.openclaw/openclaw.json`. Keep this separate from cc-connect: cc-connect must use its direct Matrix config and must not use `DIREXIO_CREDENTIALS_FILE`.
 
 `DIREXIO_CC_CONNECT_AGENT` is the preferred explicit selector. Supported values match connent/connect: `acp`, `antigravity`, `claudecode`, `codex`, `copilot`, `cursor`, `devin`, `gemini`, `iflow`, `kimi`, `opencode`, `pi`, `qoder`, `reasonix`, and `tmux`. Detected OpenClaw and Hermes runtimes map to `cc_connect_agent=acp`; they are not native connect agent types. OpenClaw uses `cmd = "openclaw"` with args `["acp", "--session", "agent:main:main"]` by default, letting `openclaw acp` auto-discover the Gateway from `~/.openclaw/openclaw.json`. If the operator needs to force explicit Gateway settings, S6 requires all three real values from the current OpenClaw runtime after pairing: `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION`; do not guess these values or reuse old chat output. Hermes uses `cmd = "direxio-connect"` with `args = ["hermes-acp-adapter", "--", "hermes", "acp"]` so the Direxio compatibility layer can suppress Hermes reasoning text before it reaches the Matrix room. Use `DIREXIO_CC_CONNECT_AGENT_CMD`, `DIREXIO_<AGENT>_COMMAND`, and when needed `DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML` for agent-specific launch details. OpenClaw and Hermes also accept `DIREXIO_OPENCLAW_COMMAND`, `DIREXIO_HERMES_COMMAND`, `DIREXIO_HERMES_ACP_ADAPTER_COMMAND`, `DIREXIO_OPENCLAW_ACP_ARGS_TOML`, and `DIREXIO_HERMES_ACP_ARGS_TOML`; Hermes custom args are child Hermes args and S6 prefixes the adapter wrapper automatically.
 
 `DIREXIO_AGENT_PLATFORM` describes the host runtime following the skill, while `DIREXIO_CC_CONNECT_AGENT` describes the local agent backend that `direxio-connect` should launch. Host runtimes such as Hermes or OpenClaw are not native cc-connect backend types; S6 maps them to the generic ACP backend by default and records `cc_connect_agent=acp`. Override `DIREXIO_CC_CONNECT_AGENT` only when the operator intentionally wants a different local backend.
 
-`DIREXIO_AGENT_INSTALL` may be `skip`, `recommend`, or `auto`. Only `auto` attempts to run `npm install -g direxio-connent@latest` and `direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force`; the default `recommend` records and prints the command without mutating local daemon state. An automatic install is reported as installed only when `direxio-connect daemon status --service-name <service_id>` returns `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise S6 records `agent_install_status=install_failed`. S6 calls `agent.matrix_session.create` with `agent_token` and retries transient HTTP 000/404/408/409/425/429/5xx responses before failing, because the Matrix action can become reachable after `/healthz`; defaults are 12 attempts with exponential backoff capped by `DIREXIO_MATRIX_SESSION_RETRY_MAX_INTERVAL`.
+`DIREXIO_AGENT_INSTALL` may be `skip`, `recommend`, or `auto`; the default is `auto`. `auto` attempts to run `npm install -g direxio-connent@latest`, `direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force`, and `npm install -g direxio-mcp@latest`. `recommend` records and prints commands without mutating local daemon/package state. A cc-connect automatic install is reported as installed only when `direxio-connect daemon status --service-name <service_id>` returns `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise S6 records `agent_install_status=install_failed`. MCP automatic install records `mcp_install_status=installed` only when npm succeeds. S6 calls `agent.matrix_session.create` with `agent_token` and retries transient HTTP 000/404/408/409/425/429/5xx responses before failing, because the Matrix action can become reachable after `/healthz`; defaults are 12 attempts with exponential backoff capped by `DIREXIO_MATRIX_SESSION_RETRY_MAX_INTERVAL`.
 
 Voice input is supported through `direxio-connect` speech-to-text. When `DIREXIO_SPEECH_API_KEY` or a provider-specific key such as `DIREXIO_SPEECH_QWEN_API_KEY`, `OPENAI_API_KEY`, `GROQ_API_KEY`, `DASHSCOPE_API_KEY`, `GEMINI_API_KEY`, or `GOOGLE_API_KEY` is present, S6 writes `[speech] enabled = true` into the generated config. Without an STT key, do not claim voice input is enabled.
 
@@ -573,10 +588,10 @@ for the current service before giving advice. The status output includes a
   and may still be billing.
 - Resume safety: whether rerunning the same command is safe, or whether the
   operator must preserve `state.json` and continue with
-  `P2P_EXISTING_STATE_ACTION=continue`.
-- Local refresh: if `agent_install_status=refresh_pending`, update/reset
-  cleared old credentials, user confirmations, runtime checks, and bridge
-  install proof; the next action is to rerun the deployment workflow to refresh S4-S7, local credentials, MCP snippets, and runtime checks.
+  `DIREXIO_EXISTING_STATE_ACTION=continue`.
+- Local refresh: if `agent_install_status=refresh_pending`, reset/redeploy
+  cleared old credentials, user confirmations, runtime checks, bridge install
+  proof, and MCP install proof; the next action is to rerun the deployment workflow to refresh S4-S7, local credentials, MCP snippets, automatic installs, and runtime checks.
 - Next action: the concrete diagnostic or user action for the current phase.
 - Stop-loss: whether no cloud destroy is needed yet, or how to ask the agent to
   run destroy / run `scripts/destroy.sh` on POSIX or `.\scripts\destroy.ps1` on
@@ -623,8 +638,10 @@ reminders, `billing.cost_estimate`, destroy read-back evidence when applicable,
 `billing.destroy_cleanup_status`, `billing.possible_remaining_billable_resources`,
 and secret-redaction evidence. It also records local refresh state:
 `credentials.status`, `connect.install_status`, and `mcp.status` must show
-`refresh_pending` after update/reset until S5/S6/S7 and runtime verification
-write fresh evidence. User confirmation evidence is redacted before it is
+`refresh_pending` after reset/redeploy until S5/S6/S7 and runtime verification
+write fresh evidence. Image-only update keeps existing local refresh state and
+does not clear credentials, confirmations, runtime checks, or local install
+evidence. User confirmation evidence is redacted before it is
 written to the operation report, so initialization codes and tokens are not
 copied into handoff artifacts.
 If a destroy report lists possible remaining billable resources, tell the user
@@ -637,12 +654,39 @@ do next.
 
 Use `scripts/destroy.sh` for teardown on POSIX shells and `.\scripts\destroy.ps1` from PowerShell on Windows. The Windows wrapper selects Git for Windows Bash for the Bash state machine, sets Windows-compatible local path mode, and converts explicit Windows state paths before invoking `scripts/destroy.sh`. Destroy first checks `direxio-connect daemon status --service-name <service_id>` and stops plus uninstalls only that named daemon when the reported `WorkDir` matches the current service directory, `~/.direxio/nodes/<service_id>/cc-connect`. After AWS resources are terminated and released, destroy reads AWS back and records `destroy.evidence` before removing the corresponding local service directory under `~/.direxio/nodes/<service_id>`. This prevents stale state, credentials, bridge files, and stale local service registrations from blocking or misleading the next deployment while still preserving a reportable AWS cleanup audit trail. It leaves unrelated node credential directories intact.
 
+Before running destroy, warn the user that this is not merely "turning off the
+server." Destroy removes the recorded cloud node and its application data. The
+current app account, friends, channels, messages, Agent room/session, and login
+state will no longer be usable. If the user later deploys again, even with the
+same domain, treat it as a new Direxio node that needs a fresh app
+initialization code, new account setup, new friends, and new channels.
+
+For ordinary users, distinguish the available destructive levels before asking
+for confirmation:
+
+- Update deployment: keep accounts, friends, channels, messages, DNS, TLS, and
+  cloud resources; only refresh the service image and local credentials.
+- Reset app data: keep EC2, public IP, DNS, and TLS storage, but delete app
+  accounts, friends, channels, messages, and Agent room state.
+- Destroy resources: delete the recorded EC2/EBS/EIP/security group/key pair,
+  remove the deployer-managed DNS A record, stop the local bridge, and make the
+  current app data unavailable.
+
+Require an explicit destructive confirmation before destroy when the user has
+not already clearly confirmed this data loss. A suitable confirmation is:
+
+```text
+I confirm destroying this Direxio node and understand the current account,
+friends, channels, messages, and Agent conversation will be lost; redeploying
+later will create a new node/account.
+```
+
 Destroy uses the same AWS identity boundary as deployment: root AWS access-key
 identity is allowed when the operator explicitly chose root credentials. Prefer
 using the same temporary `DirexioDeployer` IAM user/profile for teardown when
 that was used for provisioning.
 
-If an operator needs to preserve local state files for debugging, run destroy with `P2P_KEEP_WORKDIR=1` and explicitly report that the stale service directory remains.
+If an operator needs to preserve local state files for debugging, run destroy with `DIREXIO_KEEP_WORKDIR=1` and explicitly report that the stale service directory remains.
 
 ### Full reset / "treat me as a brand new user"
 
@@ -657,15 +701,15 @@ When the user asks for a complete fresh start — "destroy everything", "start o
 
 ## Image Refresh And Data Reset
 
-When the user only asks to pull a newer image on an existing EC2 instance, do not destroy cloud resources and do not delete application or TLS storage. Run `scripts/update.sh` against the current state. It SSHes to the existing node, optionally updates `MESSAGE_SERVER_IMAGE`, runs Docker Compose pull/up, reruns `/opt/p2p/init-tokens.sh`, clears stale local secret fields, clears old user-confirmation/runtime-check evidence, marks `agent_install_status=refresh_pending`, stops only the matching service-scoped direxio-connect daemon when its `WorkDir` matches this service, marks S4-S7 pending, and writes a redacted `operation-report.json`.
+When the user only asks to pull a newer image on an existing EC2 instance, do not destroy cloud resources and do not delete application or TLS storage. Run `scripts/update.sh` against the current state. It SSHes to the existing node, optionally updates `MESSAGE_SERVER_IMAGE`, runs Docker Compose pull/up, reruns `/opt/p2p/init-tokens.sh` only when current bootstrap credentials are missing, leaves local credentials, user-confirmation/runtime-check evidence, cc-connect daemon state, MCP artifacts, and S4-S7 phase state unchanged, and writes a redacted `operation-report.json`.
 
-When the user asks to reset application data on an existing EC2 instance, do not destroy EC2, public IPv4/EIP, DNS, or Caddy TLS storage. Run `scripts/reset-app-data.sh` only after explicit destructive confirmation with `DIREXIO_RESET_APP_DATA_CONFIRM=1`. It clears only the application volumes (`postgres-data`, `message-config`, `message-data`), generates a new backend password/init-code field, restarts the stack, reruns `/opt/p2p/init-tokens.sh`, clears stale local secret fields, clears old user-confirmation/runtime-check evidence, marks `agent_install_status=refresh_pending`, stops only the matching service-scoped direxio-connect daemon when its `WorkDir` matches this service, marks S4-S7 pending, and writes a redacted `operation-report.json`.
+When the user asks to reset application data on an existing EC2 instance, do not destroy EC2, public IPv4/EIP, DNS, or Caddy TLS storage. Run `scripts/reset-app-data.sh` only after explicit destructive confirmation with `DIREXIO_RESET_APP_DATA_CONFIRM=1`. It clears only the application volumes (`postgres-data`, `message-config`, `message-data`), generates a new backend password/init-code field, restarts the stack, reruns `/opt/p2p/init-tokens.sh`, clears stale local secret fields, clears old user-confirmation/runtime-check evidence, marks `agent_install_status=refresh_pending` and `mcp_install_status=refresh_pending`, stops only the matching service-scoped direxio-connect daemon when its `WorkDir` matches this service, marks S4-S7 pending, and writes a redacted `operation-report.json`. The follow-up orchestrate run regenerates local credentials/MCP artifacts and, by default, reinstalls/restarts cc-connect plus direxio-mcp.
 
 Current message-server images require `P2P_PORTAL_PASSWORD` and an explicit `portal.bootstrap`; `init-tokens.sh` owns that cloud-side bootstrap and creates a real Matrix `agent_room_id` when the backend credentials file does not already include one.
 
 Do not delete caddy-data or caddy-config during an image-only refresh. Removing Caddy's ACME storage loses the existing production certificate and can trigger CA duplicate-certificate rate limits. Preserve `caddy-data` and `caddy-config`; clear only `postgres-data message-config message-data` when the requested reset needs a clean homeserver/database.
 
-For repeated test refreshes, rerun `scripts/orchestrate.sh` normally after update/reset. S4-S7 will re-run from state, and S6 only rewrites local credentials and environment files unless `DIREXIO_AGENT_INSTALL=auto` is explicitly set.
+For repeated data-reset refreshes, rerun `scripts/orchestrate.sh` normally after reset. S4-S7 will re-run from state, and S6 regenerates local credentials/MCP artifacts and automatically installs/restarts local packages unless `DIREXIO_AGENT_INSTALL=recommend` or `skip` is explicitly set. Image-only update does not require an orchestrate follow-up unless verification shows the service actually regenerated credentials.
 
 ## Minimal Invocation
 
@@ -679,7 +723,7 @@ MESSAGE_SERVER_IMAGE=direxio/message-server:latest \
 bash scripts/orchestrate.sh
 ```
 
-Use an `AWS_PROFILE` or temporary `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` for the selected AWS identity. Root access keys are allowed when the operator explicitly chooses them; a temporary `DirexioDeployer` IAM user remains the recommended routine path. Do not write AWS secrets, initialization codes, or agent tokens into skill files or the repository.
+Use an `AWS_PROFILE` or temporary `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` for the selected AWS identity. Root access keys are allowed when the operator explicitly chooses them; they are the fastest first-deploy path but highly privileged and must be saved securely, never pasted, and rotated or deleted after deployment. A temporary `DirexioDeployer` IAM user is the safer path but takes more setup steps. Do not write AWS secrets, initialization codes, or agent tokens into skill files or the repository.
 
 On Windows, prefer `.\scripts\orchestrate.ps1` and `.\scripts\destroy.ps1` from PowerShell. These wrappers select Git for Windows Bash for the Bash phases and write Windows-compatible local `direxio-connect` paths.
 
@@ -739,7 +783,7 @@ security     : delete or disable any temporary DirexioDeployer access key after
 report       : <operation-report.json path>
 ```
 
-Mention that AWS resources keep billing until destroyed. User-managed DNS and purchased domains are not removed by destroy. After destroy, report which `~/.direxio/nodes/<service_id>` service directory was removed or, if `P2P_KEEP_WORKDIR=1` was used, which local directory remains.
+Mention that AWS resources keep billing until destroyed. User-managed DNS and purchased domains are not removed by destroy. After destroy, report which `~/.direxio/nodes/<service_id>` service directory was removed or, if `DIREXIO_KEEP_WORKDIR=1` was used, which local directory remains.
 
 If `DIREXIO_AGENT_INSTALL=auto` was not used, or if it recorded `install_failed`, give the manual command:
 

package/agents/README.md

@@ -10,12 +10,12 @@ When an agent runtime supports skill metadata, point it at `SKILL.md` and use `s
 
 Recognition keywords:
 
-- deploy P2P-IM Matrix
-- resume P2P Matrix deployment
-- verify P2P Matrix server
-- destroy P2P Matrix AWS resources
+- deploy Direxio
+- resume Direxio deployment
+- verify Direxio message server
+- destroy Direxio AWS resources
 - wire Direxio MCP/plugin
-- refresh P2P agent token
+- refresh Direxio agent token
 
 Required capabilities:
 

package/agents/openai.yaml

@@ -1,12 +1,12 @@
 display_name: Direxio Deployer
-short_description: Deploy, resume, verify, destroy, and wire Direxio MCP/plugin access for a production P2P-IM Matrix server on AWS.
-default_prompt: Deploy a P2P-IM Matrix server using my production domain, following SKILL.md and scripts/orchestrate.sh.
+short_description: Deploy, resume, verify, destroy, and wire Direxio MCP/plugin access for a production Direxio message server on AWS.
+default_prompt: Deploy a Direxio message server using my production domain, following SKILL.md and scripts/orchestrate.sh.
 entrypoint: ../SKILL.md
 runtime_notes:
   - Read SKILL.md before running deployment commands.
   - When installing or updating this skill itself, read references/agent-targets.md and use the runtime-specific project-local Git clone path before any global fallback.
   - Use scripts/orchestrate.sh from the repository root.
   - Use scripts/destroy.sh for teardown.
-  - S6 writes DIREXIO_DOMAIN, DIREXIO_AGENT_TOKEN, and DIREXIO_AGENT_ROOM_ID, then records runtime-specific skill and MCP/config targets for direxio-mcp and P2P-IM/direxio-agent-plugins.
+  - S6 writes DIREXIO_DOMAIN, DIREXIO_AGENT_TOKEN, and DIREXIO_AGENT_ROOM_ID, then records runtime-specific skill and MCP/config targets for direxio-mcp and Direxio agent plugins.
   - Ask before mutating the current agent runtime's plugin or MCP configuration.
   - The instructions are compatible with Claude, Codex/OpenAI, Gemini, Cursor, Copilot, OpenClaw, Hermes, and other shell-capable agent runtimes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "direxio-deployer",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Versioned Direxio deployer agent skill and portable deployment orchestration tools.",
   "type": "module",
   "bin": {

package/references/agent-targets.md

@@ -127,7 +127,7 @@ Use `mcp/codex.toml` for Codex and `mcp/hermes.mcp.json` for Hermes. For OpenCla
 
 - `DIREXIO_AGENT_INSTALL=skip`: write credentials/env and cc-connect config only.
 - `DIREXIO_AGENT_INSTALL=recommend`: write files, record state, and print the install command.
-- `DIREXIO_AGENT_INSTALL=auto`: run `npm install -g direxio-connent@latest` and then `direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force`. S6 records this as installed only after `direxio-connect daemon status --service-name <service_id>` reports `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise it records `agent_install_status=install_failed`.
+- `DIREXIO_AGENT_INSTALL=auto` (default): run `npm install -g direxio-connent@latest`, `direxio-connect daemon install --config ~/.direxio/nodes/<service_id>/cc-connect/config.toml --service-name <service_id> --force`, and `npm install -g direxio-mcp@latest`. S6 records cc-connect as installed only after `direxio-connect daemon status --service-name <service_id>` reports `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise it records `agent_install_status=install_failed`. MCP records `mcp_install_status=installed` only when npm succeeds.
 
 Prefer `DIREXIO_CC_CONNECT_AGENT=<agent>` to choose the local agent that `direxio-connect` should run. Keep `DIREXIO_AGENT_PLATFORM=<runtime>` for auto-detection overrides and legacy host-runtime naming. Use `DIREXIO_AGENT_INSTALL_MODE=cc-connect` only when overriding the default `recommended` mapping explicitly.
 Use `DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML` for agent-specific options that cannot be represented by `work_dir` or `cmd`; for example `reasonix` requires `serve_url`, `tmux` requires `session`, and generic `acp` requires a command when `DIREXIO_CC_CONNECT_AGENT_CMD` is not enough.

package/references/architecture.md

@@ -17,7 +17,7 @@ coturn         -> TURN 3478 + 49160-49200/udp
 ```
 
 - **message-server**: `direxio/message-server:latest`，同时承载 Matrix homeserver 和 `/_p2p/query`/`/_p2p/command`。
-- **PostgreSQL 18**: Matrix 与 P2P 业务表共库持久化，compose 使用 `/var/lib/postgresql`。
+- **PostgreSQL 18**: Matrix 与 Direxio 业务表共库持久化，compose 使用 `/var/lib/postgresql`。
 - **Caddy**: 唯一 HTTP/TLS 入口，自动签发 Let's Encrypt。
 - **coturn**: WebRTC TURN relay，Direxio message-server 通过 shared-secret 动态签发 TURN 凭证。
 
@@ -25,17 +25,17 @@ coturn         -> TURN 3478 + 49160-49200/udp
 
 1. `postgres` healthy。
 2. `message-init` 生成 `/etc/direxio-message-server/message-server.yaml` 和 signing key，并写入 TURN 配置。
-3. `message-server` 启动，加载 Matrix + P2P 业务，读取 `P2P_PORTAL_PASSWORD` 和 `P2P_PORTAL_CREDENTIALS_FILE`。
+3. `message-server` 启动，加载 Matrix + Direxio 业务，读取 `P2P_PORTAL_PASSWORD` 和 `P2P_PORTAL_CREDENTIALS_FILE`。
 4. `init-tokens.sh` 调用 `portal.bootstrap`，从容器复制凭据到宿主 `/opt/p2p/bootstrap.json`。如果最新服务端没有写入 `agent_room_id`，脚本会通过 Matrix Client API 创建真实 agent room、邀请并加入 `@agent:<server>`，再把 `agent_room_id` 回写到宿主和容器凭据文件。
 5. `init-tokens.sh` 生成 `/opt/p2p/wellknown/owner.json`。
-6. `caddy` 对外服务 Matrix、P2P API 和 well-known。
+6. `caddy` 对外服务 Matrix、Direxio API 和 well-known。
 
 ## 凭据模型
 
 `/opt/p2p/bootstrap.json` 会包含:
 
 - `password`: 后端字段名；对用户展示时是八位 App 初始化码。
-- `access_token`: 当前用户的统一 bearer token，可用于 Matrix `/_matrix/client/*` 和需要用户身份的 P2P 调用。
+- `access_token`: 当前用户的统一 bearer token，可用于 Matrix `/_matrix/client/*` 和需要用户身份的 Direxio 调用。
 - `agent_token`: 本地服务凭据中的 agent bearer token；`direxio-connect` 对话桥接使用 S6 创建的 `@agent:<server>` Matrix session。
 - `agent_room_id`: 真实 Matrix 房间 ID。部署脚本拒绝旧式 `!agent:<domain>` 伪房间。
 

package/references/bug-history.md

@@ -3,12 +3,12 @@
 部署链路上所有真实踩过的坑。**已全部修进 `scripts/` 下的部署文件**,新部署不会再撞;
 列在这里是为了:① 理解每个设计决策的来由;② 若有人改坏了哪处,能快速定位回退点。
 
-## p2p-matrix-as 仓库
+## Legacy pre-Direxio message-server 仓库
 
 ### AS PR #4 — 镜像多架构
 - **症状**:ARM 架构 EC2(t4g 系列)`docker pull` 后 `exec format error`。
 - **根因**:镜像只 build 了 amd64。
-- **修复**:CI 用 buildx 出 `amd64+arm64` 多架构镜像。`xuyanzu01/p2p-im-as:latest` 已是多架构。
+- **修复**:CI 用 buildx 出 `amd64+arm64` 多架构镜像。legacy pre-Direxio AS 镜像已是多架构。
 
 ### AS PR #5 — 容器化体验
 - **卷权限**:命名卷默认 root:700,AS 降权到 asd(UID 10001)后打不开 sqlite → `SQLITE_CANTOPEN`。

package/references/deployment-lessons.md

@@ -15,7 +15,7 @@ S5_INIT_TOKENS failed: read bootstrap.json timed out
 
 Cause:
 
-Current `p2p-matrix-as` builds initialize on service startup and write
+Current Direxio message-server builds initialize on service startup and write
 `/opt/p2p/bootstrap.json` with the login `password`, `agent_token`, and owner
 metadata. Calling the old bootstrap HTTP endpoint or scraping logs is no longer
 part of the deploy path.
@@ -80,7 +80,7 @@ Fix now in ops:
   the local `timeout` command is available.
 - If a deployment was interrupted, inspect `scripts/orchestrate.sh status`,
   stop only leftover local `orchestrate.sh`/`curl`/`ssh` children for that run,
-  and resume with `P2P_EXISTING_STATE_ACTION=continue`.
+  and resume with `DIREXIO_EXISTING_STATE_ACTION=continue`.
 - If SSH to the instance is blocked but AWS access still works, attach a
   temporary SSM role and use SSM Run Command to read `/opt/p2p/bootstrap.json`
   without printing secrets. Remove or audit the temporary role after recovery.
@@ -94,7 +94,7 @@ resolves correctly. This avoids Caddy and Let's Encrypt racing DNS propagation.
 When rerunning after a resource was created, set:
 
 ```bash
-P2P_EXISTING_STATE_ACTION=continue
+DIREXIO_EXISTING_STATE_ACTION=continue
 ```
 
 This is deliberate. It prevents accidental duplicate EC2/EIP creation or unsafe
@@ -102,10 +102,11 @@ reuse of an old deployment state.
 
 ## Credential Safety
 
-Prefer a temporary `DirexioDeployer` IAM user or dedicated IAM role for routine
-deployment. Root access keys are allowed when the operator explicitly chooses
-them; report that the identity is root and remind the operator to rotate or
-remove the key when it is no longer needed.
+Offer two credential paths for first-time deployment. Root access keys are the
+fastest path but are highly privileged; report that the identity is root,
+remind the operator to save the CSV securely, and rotate or remove the key when
+it is no longer needed. A temporary `DirexioDeployer` IAM user or dedicated IAM
+role is safer but requires more AWS console steps.
 
 Do not store AWS AK/SK in skill files, docs, or committed repo files. Treat
 `state.json`, `outputs.json`, and `~/.direxio/nodes/<service_id>/credentials.json` as local
@@ -135,7 +136,7 @@ Fix procedure:
 2. Delegate those NS servers at the current registrar, or use the provider API
    if credentials are available.
 3. Wait for authoritative NS and A-record propagation.
-4. Re-run `scripts/orchestrate.sh` with `P2P_EXISTING_STATE_ACTION=continue`.
+4. Re-run `scripts/orchestrate.sh` with `DIREXIO_EXISTING_STATE_ACTION=continue`.
 
 DNS propagation of new NS records can take minutes to hours. After the user
 confirms the change, verify with `nslookup -type=NS <DOMAIN>` or
@@ -185,7 +186,7 @@ Workaround (use when the health check is the only blocker and the rate limit is
 
 4. Resume orchestrate.sh with:
    ```bash
-   P2P_EXISTING_STATE_ACTION=continue bash scripts/orchestrate.sh
+   DIREXIO_EXISTING_STATE_ACTION=continue bash scripts/orchestrate.sh
    ```
 
 5. **After deployment completes**, restore the original Caddyfile (remove `tls internal`) and restart Caddy. Caddy will retry the production Let's Encrypt cert when the rate limit resets. The self-signed cert is a temporary bridge; HTTPS will show a browser warning until the production cert is obtained.

package/references/deployment-optimization-audit.md

@@ -30,9 +30,10 @@ Current best plan is the stricter plan now encoded in this branch:
    whether to send a real message in the Agent chat box.
 6. Keep update/reset/destroy as separate operations with separate receipts;
    update/reset are now first-class scripts, not runbook-only manual actions.
-7. Treat update/reset follow-up as a Local refresh state: update/reset cleared
-   old credentials, user confirmations, runtime checks, and bridge install
-   proof, so the next action is to rerun S4-S7 and runtime checks.
+7. Treat reset/redeploy follow-up as a Local refresh state: reset/redeploy
+   clears old credentials, user confirmations, runtime checks, bridge install
+   proof, and MCP install proof, so the next action is to rerun S4-S7 and
+   runtime checks. Image-only update keeps local state intact.
 8. Keep Lightsail out of the current user-facing path. Lightsail remains
    deferred until it has an independent resource model, pricing, state,
    destroy, and test matrix.
@@ -132,14 +133,17 @@ Status: Deployer-side implemented.
 
 Current evidence:
 - `scripts/aws-credentials.sh import-csv|verify` imports local CSV credentials,
-  tightens file permissions, blocks root identity, and redacts identity output.
-- `SKILL.md` documents the temporary `DirexioDeployer` IAM user path with
+  tightens file permissions, allows root identity only with explicit operator
+  choice, and redacts identity output.
+- `SKILL.md` documents both the fast root access-key path with security
+  warnings and the safer temporary `DirexioDeployer` IAM user path with
   temporary `AdministratorAccess`, then cleanup.
 - Reports and tests assert secrets are redacted and not written to reports.
 
 Difference from the checklist:
-- The current branch chooses the practical MVP path: temporary IAM admin user,
-  no root access keys, and cleanup guidance after deployment.
+- The current branch chooses the practical MVP path: let the operator choose
+  fast root credentials or a safer temporary IAM admin user, with cleanup
+  guidance after deployment.
 
 Remaining evidence:
 - Long-term least-privilege IAM generation is still a future hardening task.
@@ -226,11 +230,11 @@ Current evidence:
 - S5 refreshes bootstrap credentials from the server.
 - S6 rewrites service-scoped `credentials.json`, `env`, cc-connect config, and
   MCP snippets.
-- Update/reset mark S4-S7 pending and report refresh-pending status.
-- Update/reset stops only the matching service-scoped direxio-connect daemon
+- Reset/redeploy mark S4-S7 pending and report refresh-pending status.
+- Reset/redeploy stops only the matching service-scoped direxio-connect daemon
   when its `WorkDir` matches the current service, so stale local bridge
   processes do not keep using old credentials.
-- `status` reports Local refresh when update/reset cleared old credentials, user confirmations, runtime checks, and bridge install proof.
+- `status` reports Local refresh when reset/redeploy cleared old credentials, user confirmations, runtime checks, bridge install proof, and MCP install proof.
 - Runtime checks fail closed when a stale service directory or wrong WorkDir is
   detected.