direxio-deployer 0.1.7 → 0.1.9

package/references/deployment-workflow.md

@@ -31,15 +31,19 @@ DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh status
 If state has resources, require one:
 
 ```bash
-P2P_EXISTING_STATE_ACTION=continue
-P2P_EXISTING_STATE_ACTION=destroy
+DIREXIO_EXISTING_STATE_ACTION=continue
+DIREXIO_EXISTING_STATE_ACTION=destroy
 DOMAIN=<different-domain>
 ```
 
-For first-time credentials, import the selected AWS access-key CSV and verify
-the identity before provisioning. A temporary `DirexioDeployer` IAM user is the
-recommended routine path, but root access keys are allowed when the operator
-explicitly chose them:
+For first-time credentials, offer the operator two paths before provisioning:
+root access key or dedicated IAM deployment user. The root path is the fastest
+because it uses the account owner identity directly, but it is highly
+privileged; tell the operator to save the CSV securely, never paste or commit
+it, and rotate or delete the root key after deployment. The dedicated
+`DirexioDeployer` IAM user path is safer because it avoids root keys, but it
+requires more AWS console steps. Import the selected AWS access-key CSV and
+verify the identity before provisioning:
 
 ```bash
 bash scripts/aws-credentials.sh import-csv /path/to/accessKeys.csv direxio-deployer <region>
@@ -98,14 +102,14 @@ Destroy allows root AWS access-key identity when the operator explicitly chose
 root credentials. Use the same deployment profile for teardown that was used
 for provisioning.
 
-Use `P2P_KEEP_WORKDIR=1 DOMAIN=__DOMAIN__ bash scripts/destroy.sh` on POSIX, or set `$env:P2P_KEEP_WORKDIR = "1"` before `.\scripts\destroy.ps1` on Windows, only when preserving local state files for debugging; if used, report that the service directory still exists.
+Use `DIREXIO_KEEP_WORKDIR=1 DOMAIN=__DOMAIN__ bash scripts/destroy.sh` on POSIX, or set `$env:DIREXIO_KEEP_WORKDIR = "1"` before `.\scripts\destroy.ps1` on Windows, only when preserving local state files for debugging; if used, report that the service directory still exists.
 
 ## Run
 
 From the repository root:
 
 ```bash
-AWS_PROFILE=p2p-matrix \
+AWS_PROFILE=direxio-deployer \
 AWS_DEFAULT_REGION=us-east-1 \
 DOMAIN=__DOMAIN__ \
 DOMAIN_MODE=user \
@@ -149,19 +153,22 @@ reminders, `billing.cost_estimate`, destroy read-back evidence under
 contain the initialization code, AWS secrets, access tokens, agent tokens, or
 Matrix session tokens. User/runtime evidence is also scrubbed for
 eight-or-more digit numeric strings because users may paste initialization
-codes into confirmation notes. After update/reset, the report must show
+codes into confirmation notes. After reset/redeploy, the report must show
 `credentials.status=refresh_pending`, `connect.install_status=refresh_pending`,
 and `mcp.status=refresh_pending` until S5/S6/S7 and runtime checks refresh
-local evidence.
+local evidence. Image-only update does not clear local credentials,
+confirmations, runtime checks, cc-connect state, or MCP artifacts.
 
 When the user or runtime evidence confirms a manual product gate, write it back
 to state before regenerating the report. Connect daemon status is a
 service-scoped local bridge check, MCP doctor is a non-polluting runtime check,
 MCP tools is stdio `tools/list` discovery, and MCP smoke is a read-only backend
-call. In the default `DIREXIO_AGENT_INSTALL=recommend` path, `verify runtime`
-records `connect_daemon=manual_pending` instead of failing the aggregate,
-because daemon installation is an explicit operator action. These checks are
-not the full runtime product gate:
+call. In the `DIREXIO_AGENT_INSTALL=recommend` path, `verify runtime` records
+`connect_daemon=manual_pending` instead of failing the aggregate, because
+daemon installation is an explicit operator action. The default
+`DIREXIO_AGENT_INSTALL=auto` path expects cc-connect and direxio-mcp to be
+installed automatically during S6. These checks are not the full runtime
+product gate:
 
 ```bash
 DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh verify runtime
@@ -201,7 +208,7 @@ data:
 
 ```bash
 DOMAIN=__DOMAIN__ MESSAGE_SERVER_IMAGE=direxio/message-server:latest bash scripts/update.sh
-P2P_EXISTING_STATE_ACTION=continue DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh
+DIREXIO_EXISTING_STATE_ACTION=continue DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh
 ```
 
 `update.sh` SSHes to the recorded EC2 instance, runs Docker Compose pull/up,
@@ -218,7 +225,7 @@ TLS volumes:
 
 ```bash
 DIREXIO_RESET_APP_DATA_CONFIRM=1 DOMAIN=__DOMAIN__ bash scripts/reset-app-data.sh
-P2P_EXISTING_STATE_ACTION=continue DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh
+DIREXIO_EXISTING_STATE_ACTION=continue DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh
 ```
 
 `reset-app-data.sh` removes only `postgres-data`, `message-config`, and
@@ -254,9 +261,9 @@ If rate-limited, the log shows `retry after <timestamp> UTC`.
    ```
    Once the endpoint returns 200, re-run orchestrate.sh to complete:
    ```bash
-   P2P_EXISTING_STATE_ACTION=continue \
+   DIREXIO_EXISTING_STATE_ACTION=continue \
    DNS_READY=1 \
-   AWS_PROFILE=p2p-matrix \
+   AWS_PROFILE=direxio-deployer \
    AWS_DEFAULT_REGION=us-east-1 \
    DOMAIN=<DOMAIN> \
    DOMAIN_MODE=route53 \
@@ -291,7 +298,7 @@ that the old IP is safe to replace:
 
 ```bash
 DIREXIO_CONFIRM_DNS_OVERWRITE=1 \
-P2P_EXISTING_STATE_ACTION=continue \
+DIREXIO_EXISTING_STATE_ACTION=continue \
 DOMAIN=__DOMAIN__ \
 DOMAIN_MODE=route53 \
 CONFIRM_DOMAIN_BINDING=1 \
@@ -308,7 +315,7 @@ node scripts/json.mjs get ~/.direxio/nodes/<service_id>/state.json resources
 After authoritative DNS returns the new IP, continue with the same state:
 
 ```bash
-P2P_EXISTING_STATE_ACTION=continue \
+DIREXIO_EXISTING_STATE_ACTION=continue \
 DOMAIN=__DOMAIN__ \
 DOMAIN_MODE=route53 \
 CONFIRM_DOMAIN_BINDING=1 \
@@ -334,14 +341,14 @@ After authoritative DNS returns the new IP:
 
 ```bash
 DNS_READY=1 \
-AWS_PROFILE=p2p-matrix \
+AWS_PROFILE=direxio-deployer \
 AWS_DEFAULT_REGION=us-east-1 \
 DOMAIN=__DOMAIN__ \
 DOMAIN_MODE=user \
 CONFIRM_DOMAIN_BINDING=1 \
 INSTANCE_TYPE=t3.small \
 MESSAGE_SERVER_IMAGE=direxio/message-server:latest \
-P2P_EXISTING_STATE_ACTION=continue \
+DIREXIO_EXISTING_STATE_ACTION=continue \
 bash scripts/orchestrate.sh
 ```
 

package/references/iam-policy.json

@@ -1,6 +1,6 @@
 {
   "Version": "2012-10-17",
-  "Comment": "p2p-matrix 一键部署所需的最小 IAM 权限。用户建 IAM 用户时附加此策略,再为其生成 AK/SK 交给 agent。比给 AdministratorAccess 安全得多。",
+  "Comment": "Direxio 一键部署所需的最小 IAM 权限。用户建 IAM 用户时附加此策略,再为其生成 AK/SK 交给 agent。比给 AdministratorAccess 安全得多。",
   "Statement": [
     {
       "Sid": "Preflight",

package/references/runtime-wiring.md

@@ -137,8 +137,8 @@ Defaults:
 - `DIREXIO_CC_CONNECT_AGENT_OPTIONS_TOML` appends agent-specific options under `[projects.agent.options]`; use it for agents with required non-command options such as `reasonix` (`serve_url`) or `tmux` (`session`).
 - OpenClaw Gateway ACP auto-detects the Gateway from `~/.openclaw/openclaw.json` when `DIREXIO_OPENCLAW_ACP_URL` and `DIREXIO_OPENCLAW_ACP_TOKEN_FILE` are unset. It uses `DIREXIO_OPENCLAW_ACP_SESSION` when provided, otherwise `agent:main:main`. To force explicit Gateway settings, complete OpenClaw pairing first and set all three real values: `DIREXIO_OPENCLAW_ACP_URL`, `DIREXIO_OPENCLAW_ACP_TOKEN_FILE`, and `DIREXIO_OPENCLAW_ACP_SESSION`.
 - `DIREXIO_OPENCLAW_ACP_ARGS_TOML` replaces the generated OpenClaw ACP args array, for example `["acp", "--url", "wss://gateway.example.test:18789", "--token-file", "$HOME/.openclaw/gateway.token", "--session", "agent:main:main"]`. `DIREXIO_HERMES_ACP_ARGS_TOML` supplies the child Hermes args; S6 prefixes `["hermes-acp-adapter", "--", "<hermes-command>"]` automatically.
-- `DIREXIO_AGENT_INSTALL=recommend` prints and records the command only. `verify runtime` records the daemon check as `manual_pending` in this mode and still verifies MCP doctor/tools/smoke.
-- `DIREXIO_AGENT_INSTALL=auto` runs `npm install -g direxio-connent@latest` and then installs the `direxio-connect` daemon with the generated config and `--service-name <service_id>`. It is recorded as installed only when `direxio-connect daemon status --service-name <service_id>` reports `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise S6 records `agent_install_status=install_failed`.
+- `DIREXIO_AGENT_INSTALL=auto` is the default. It runs `npm install -g direxio-connent@latest`, installs the `direxio-connect` daemon with the generated config and `--service-name <service_id>`, and runs `npm install -g direxio-mcp@latest`. cc-connect is recorded as installed only when `direxio-connect daemon status --service-name <service_id>` reports `Status: Running` and recent daemon logs do not show ACP session initialization failure; otherwise S6 records `agent_install_status=install_failed`. MCP records `mcp_install_status=installed` only when npm succeeds.
+- `DIREXIO_AGENT_INSTALL=recommend` prints and records commands only. `verify runtime` records the daemon check as `manual_pending` in this mode and still verifies MCP doctor/tools/smoke when the MCP command is available.
 - `DIREXIO_AGENT_INSTALL_MODE=recommended` maps every supported local runtime to `cc-connect`.
 - Speech defaults to `DIREXIO_SPEECH_PROVIDER=openai` and `DIREXIO_SPEECH_LANGUAGE=zh`. Provider-specific keys are also accepted: `DIREXIO_SPEECH_OPENAI_API_KEY` or `OPENAI_API_KEY`, `DIREXIO_SPEECH_GROQ_API_KEY` or `GROQ_API_KEY`, `DIREXIO_SPEECH_QWEN_API_KEY` or `DASHSCOPE_API_KEY`, and `DIREXIO_SPEECH_GEMINI_API_KEY`, `GEMINI_API_KEY`, or `GOOGLE_API_KEY`. Set `DIREXIO_SPEECH_ENABLED=false` to suppress speech config generation even when a key exists.
 

package/references/state-machine.md

@@ -17,7 +17,7 @@
 
 - `postgres`: PostgreSQL 18，数据卷 `/var/lib/postgresql`。
 - `message-init`: 生成 Direxio message-server 配置和 TURN 配置。
-- `message-server`: 运行 Matrix + P2P 统一后端，公开容器内 8008。
+- `message-server`: 运行 Matrix + Direxio 统一后端，公开容器内 8008。
 - `caddy`: 对外 80/443，反代 `/_matrix/*` 和 `/_p2p/*`。
 - `coturn`: TURN relay。
 

package/references/token-refresh.md

@@ -4,7 +4,9 @@
 
 从服务端同步过来的 `password` 和 owner `access_token` 必须按一次性/易失凭据处理。`password` 是后端字段名，对用户展示时必须叫八位 App 初始化码。用户完成初始化或 token exchange 后，服务端可能立刻重置这些值；任何需要再次获取初始化码，或需要用 `access_token` 调 owner 身份 API/Matrix Client API，或需要用 `agent_token` 调 `agent.matrix_session.create` 的操作，都必须先重新从服务器拉取最新 `/opt/p2p/bootstrap.json`，再更新本地 `credentials.json`。不要复用聊天记录、旧 `state.json`、旧 `credentials.json` 或历史部署输出里的 password/access token。
 
-现有节点执行 `scripts/update.sh` 或 `scripts/reset-app-data.sh` 后，本地旧证据也必须作废。脚本会清掉旧 `password`、`access_token`、`agent_token`、`agent_room_id`、`user_confirmations` 和 `runtime_checks`，把 `agent_install_status` 标成 `refresh_pending`，并只在 `WorkDir` 匹配当前 service 时停止对应的本地 bridge（stops only the matching service-scoped direxio-connect daemon），再把 S4-S7 标回 pending。这样旧的用户确认、MCP discovery、Agent runtime probe 或旧 bridge 安装状态不会被误用到更新/重置后的节点。`status` 会显示 `Local refresh:`，提醒 update/reset 已经清掉旧 credentials、user confirmations、runtime checks 和 bridge install proof；下一步必须 rerun the deployment workflow to refresh S4-S7, local credentials, MCP snippets, and runtime checks。后续必须续跑 `scripts/orchestrate.sh`，让 S5/S6/S7 和 `verify runtime` 重新写入当前证据。
+现有节点执行 `scripts/update.sh` 只做镜像刷新和远端服务重启，不清理应用卷，也不重置本地 `password`、`access_token`、`agent_token`、`agent_room_id`、`user_confirmations`、`runtime_checks`、cc-connect daemon 状态或 MCP artifacts。除非验证发现远端确实重新生成了 bootstrap credentials，否则 update 后不要强制续跑 S4-S7。
+
+执行 `scripts/reset-app-data.sh`、清理应用挂载卷或重新部署服务后，本地旧证据必须作废。脚本会清掉旧 `password`、`access_token`、`agent_token`、`agent_room_id`、`user_confirmations` 和 `runtime_checks`，把 `agent_install_status` 和 `mcp_install_status` 标成 `refresh_pending`，并只在 `WorkDir` 匹配当前 service 时停止对应的本地 bridge（stops only the matching service-scoped direxio-connect daemon），再把 S4-S7 标回 pending。这样旧的用户确认、MCP discovery、Agent runtime probe、旧 bridge 安装状态或 MCP 安装状态不会被误用到重置后的节点。后续必须续跑 `scripts/orchestrate.sh`，让 S5/S6/S7 重新生成本地 credentials/MCP snippets，并默认自动重新安装/重启 cc-connect 和 direxio-mcp，再通过 `verify runtime` 写入当前证据。
 
 ## 远端凭据
 

package/references/tooling.md

@@ -82,7 +82,10 @@ If distro packages are too old or missing, ask before using the official AWS CLI
 
 ## Credentials
 
-Prefer a temporary `DirexioDeployer` IAM user or role. If the user provides an
+For first-time setup, offer a root access key as the fastest path and a
+temporary `DirexioDeployer` IAM user or role as the safer path. Root keys are
+highly privileged; the operator must save the CSV securely, never paste or
+commit it, and rotate or delete it after deployment. If the user provides an
 AWS access-key CSV, import it through the repository helper so command output
 stays redacted and the identity is marked as `root=true|false`:
 
@@ -96,8 +99,8 @@ Existing profiles can still be used, including root profiles when the operator
 explicitly chooses root credentials:
 
 ```bash
-aws configure --profile p2p-matrix
-export AWS_PROFILE=p2p-matrix
+aws configure --profile direxio-deployer
+export AWS_PROFILE=direxio-deployer
 export AWS_DEFAULT_REGION=us-east-1
 aws sts get-caller-identity
 ```

package/references/user-journey.md

@@ -36,7 +36,7 @@ bash -lc 'echo ok; command -v node; command -v aws; command -v ssh; command -v s
 ## Minimal Command
 
 ```bash
-AWS_PROFILE=p2p-matrix \
+AWS_PROFILE=direxio-deployer \
 AWS_DEFAULT_REGION=us-east-1 \
 DOMAIN=__DOMAIN__ \
 DOMAIN_MODE=user \

package/references/verification-recovery.md

@@ -47,7 +47,7 @@ Rerun the same command after fixing the blocker; state resumes from the first un
 
 After S3, do not reset or delete state just to silence an error. If EC2, public
 IPv4/EIP, or other AWS resources are recorded, preserve `state.json`, repair the
-blocker, and rerun with `P2P_EXISTING_STATE_ACTION=continue`; or destroy first
+blocker, and rerun with `DIREXIO_EXISTING_STATE_ACTION=continue`; or destroy first
 if the user wants to stop billing.
 
 ## Destroy
@@ -72,13 +72,19 @@ remain outside automatic destroy scope.
 
 ## Update / Reset Follow-Up
 
-After `scripts/update.sh` or `scripts/reset-app-data.sh`, rerun:
+After `scripts/reset-app-data.sh`, rerun:
 
 ```bash
-P2P_EXISTING_STATE_ACTION=continue DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh
+DIREXIO_EXISTING_STATE_ACTION=continue DOMAIN=__DOMAIN__ bash scripts/orchestrate.sh
 ```
 
-The scripts intentionally mark S4-S7 pending and clear stale local secret
+The reset script intentionally marks S4-S7 pending and clears stale local secret
 fields. Do not copy old initialization codes or tokens from chat history,
 `state.json`, or `credentials.json`; S5 must fetch fresh bootstrap data and S6
-must rewrite service-scoped local credentials/MCP snippets.
+must rewrite service-scoped local credentials/MCP snippets and reinstall local
+packages by default.
+
+After `scripts/update.sh`, do not rerun S4-S7 just because the service was
+restarted. Image-only update preserves local credentials, cc-connect daemon
+state, MCP artifacts, confirmations, and runtime checks unless a separate
+verification shows the server regenerated bootstrap credentials.

package/references/voip-turn-runbook.md

@@ -58,7 +58,7 @@ skill 不部署 coturn,只把服务商给的 `uris + username/password` 写进 D
   # DOMAIN/PUBLIC_IP/TURN_SECRET 由 .env 注入(user-data 写)。
   coturn:
     image: coturn/coturn:latest
-    network_mode: host          # relay 必须;不要放进 p2p-net 桥接网络
+    network_mode: host          # relay 必须;不要放进 direxio-net 桥接网络
     restart: unless-stopped
     command:
       - -n
@@ -74,7 +74,7 @@ skill 不部署 coturn,只把服务商给的 `uris + username/password` 写进 D
       - --no-tls
       - --no-dtls
 ```
-> 注:`network_mode: host` 与现有 `networks: [p2p-net]` 不兼容,coturn 单独用 host 网络。
+> 注:`network_mode: host` 与现有 `networks: [direxio-net]` 不兼容,coturn 单独用 host 网络。
 > 其余服务不变。
 
 ### 2. `phases/s3_provision.sh` — 安全组加 TURN 端口

package/scripts/cloud-init/docker-compose.yml

@@ -1,11 +1,11 @@
 # docker-compose.yml - cloud-side Direxio message-server stack.
 #
-# Layers: Caddy (public 443/TLS) -> Direxio message-server (Matrix + P2P API).
-# PostgreSQL 18 persists Matrix and P2P business tables. The local agent bridge
+# Layers: Caddy (public 443/TLS) -> Direxio message-server (Matrix + Direxio API).
+# PostgreSQL 18 persists Matrix and Direxio business tables. The local agent bridge
 # process is not started in the cloud by default.
 
 networks:
-  p2p-net:
+  direxio-net:
 
 volumes:
   postgres-data:
@@ -17,7 +17,7 @@ volumes:
 services:
   postgres:
     image: postgres:18-alpine
-    networks: [p2p-net]
+    networks: [direxio-net]
     environment:
       POSTGRES_USER: direxio_message_server
       POSTGRES_PASSWORD: direxio_message_server
@@ -33,7 +33,7 @@ services:
 
   message-init:
     image: ${MESSAGE_SERVER_IMAGE}
-    networks: [p2p-net]
+    networks: [direxio-net]
     depends_on:
       postgres:
         condition: service_healthy
@@ -58,7 +58,7 @@ services:
 
   message-server:
     image: ${MESSAGE_SERVER_IMAGE}
-    networks: [p2p-net]
+    networks: [direxio-net]
     depends_on:
       postgres:
         condition: service_healthy
@@ -86,7 +86,7 @@ services:
 
   caddy:
     image: caddy:2
-    networks: [p2p-net]
+    networks: [direxio-net]
     depends_on:
       message-server:
         condition: service_healthy

package/scripts/cloud-init/init-tokens.sh

@@ -2,8 +2,8 @@
 # init-tokens.sh - wait for message-server bootstrap credentials after compose is up.
 set -euo pipefail
 
-P2P_DIR=${P2P_DIR:-/opt/p2p}
-COMPOSE="docker compose -f ${P2P_DIR}/docker-compose.yml --env-file ${P2P_DIR}/.env"
+DIREXIO_DIR=${DIREXIO_DIR:-/opt/p2p}
+COMPOSE="docker compose -f ${DIREXIO_DIR}/docker-compose.yml --env-file ${DIREXIO_DIR}/.env"
 DOMAIN=${DOMAIN:?DOMAIN is required (e.g. __DOMAIN__)}
 CONTAINER_BOOTSTRAP_FILE=${CONTAINER_BOOTSTRAP_FILE:-/var/direxio-message-server/p2p/bootstrap.json}
 BOOTSTRAP_FILE=${BOOTSTRAP_FILE:-/opt/p2p/bootstrap.json}
@@ -13,7 +13,7 @@ log() { echo "[init-tokens] $*" >&2; }
 
 env_string() {
   local key=$1
-  grep -E "^${key}=" "${P2P_DIR}/.env" 2>/dev/null \
+  grep -E "^${key}=" "${DIREXIO_DIR}/.env" 2>/dev/null \
     | tail -1 \
     | cut -d= -f2- \
     || true
@@ -94,7 +94,7 @@ bootstrap_portal() {
   password=${P2P_PORTAL_PASSWORD:-}
   [ -n "$password" ] || password=$(env_string P2P_PORTAL_PASSWORD)
   if [ -z "$password" ]; then
-    log "FATAL: P2P_PORTAL_PASSWORD is missing from environment and ${P2P_DIR}/.env"
+    log "FATAL: P2P_PORTAL_PASSWORD is missing from environment and ${DIREXIO_DIR}/.env"
     return 1
   fi
   tmp=$(mktemp)

package/scripts/destroy.ps1

@@ -35,9 +35,9 @@ $env:DIREXIO_WINDOWS_HOME = $windowsDirexioHome
 $env:DIREXIO_HOME = ConvertTo-GitBashPath $windowsDirexioHome
 $env:DIREXIO_LOCAL_PATH_STYLE = 'windows'
 
-if ($env:P2P_WORKDIR) {
-  $env:P2P_WORKDIR_WINDOWS = $env:P2P_WORKDIR
-  $env:P2P_WORKDIR = ConvertTo-GitBashPath $env:P2P_WORKDIR
+if ($env:DIREXIO_WORKDIR) {
+  $env:DIREXIO_WORKDIR_WINDOWS = $env:DIREXIO_WORKDIR
+  $env:DIREXIO_WORKDIR = ConvertTo-GitBashPath $env:DIREXIO_WORKDIR
 }
 
 $repoRootForBash = ConvertTo-GitBashPath $RepoRoot

package/scripts/destroy.sh

@@ -2,7 +2,7 @@
 # destroy.sh - remove AWS resources recorded by deployment state.
 #
 # Source:
-#   1. $P2P_WORKDIR/state.json written by orchestrate.sh; by default
+#   1. $DIREXIO_WORKDIR/state.json written by orchestrate.sh; by default
 #      DOMAIN=__DOMAIN__ maps to ~/.direxio/nodes/<service_id>/state.json.
 #   2. explicit argument: bash destroy.sh /path/to/state.json
 #
@@ -18,7 +18,7 @@ source "$HERE/lib/paths.sh"
 source "$HERE/lib/aws.sh"
 # shellcheck disable=SC1090
 source "$HERE/lib/operation_report.sh"
-P2P_WORKDIR=$(direxio_default_workdir)
+DIREXIO_WORKDIR=$(direxio_default_workdir)
 
 log() { echo -e "\033[33m[destroy]\033[0m $*"; }
 
@@ -162,12 +162,12 @@ verify_key_pair_deleted() {
 # Resolve source and load INSTANCE_ID/EIP_ID/SG_ID/KEY_NAME/KEY_FILE/REGION.
 SRC=${1:-}
 if [ -z "$SRC" ]; then
-  if   [ -f "$P2P_WORKDIR/state.json" ]; then SRC="$P2P_WORKDIR/state.json"
-  else echo "state.json not found; set DOMAIN=<service domain> or P2P_WORKDIR=<service dir> to destroy a specific deployment."; exit 1
+  if   [ -f "$DIREXIO_WORKDIR/state.json" ]; then SRC="$DIREXIO_WORKDIR/state.json"
+  else echo "state.json not found; set DOMAIN=<service domain> or DIREXIO_WORKDIR=<service dir> to destroy a specific deployment."; exit 1
   fi
 fi
 [ -f "$SRC" ] || { echo "$SRC not found."; exit 1; }
-P2P_ROOT=$(cd "${DIREXIO_HOME:-$HOME/.direxio}" 2>/dev/null && pwd -P || printf '%s' "${DIREXIO_HOME:-$HOME/.direxio}")
+DIREXIO_ROOT=$(cd "${DIREXIO_HOME:-$HOME/.direxio}" 2>/dev/null && pwd -P || printf '%s' "${DIREXIO_HOME:-$HOME/.direxio}")
 
 REGION=$(json_get "$SRC" region)
 INSTANCE_ID=$(json_get "$SRC" resources.instance_id)
@@ -245,7 +245,7 @@ delete_route53_record() {
   change_file=$(mktemp)
   cat > "$change_file" <<EOF
 {
-  "Comment": "p2p-matrix destroy",
+  "Comment": "Direxio destroy",
   "Changes": [
     {
       "Action": "DELETE",
@@ -470,8 +470,8 @@ stop_current_cc_connect_daemon() {
 cleanup_local_service_dir() {
   local service_dir=$1 root=$2 nodes_root src_real nodes_real src_norm nodes_norm name
 
-  if [ "${P2P_KEEP_WORKDIR:-0}" = "1" ]; then
-    log "keeping local service dir because P2P_KEEP_WORKDIR=1: $service_dir"
+  if [ "${DIREXIO_KEEP_WORKDIR:-0}" = "1" ]; then
+    log "keeping local service dir because DIREXIO_KEEP_WORKDIR=1: $service_dir"
     return 0
   fi
 
@@ -567,4 +567,4 @@ if REPORT_PATH=$(operation_report_write destroy destroy_processed "$SRC" 2>/dev/
 else
   log "operation report was not written; keep destroy logs for audit"
 fi
-cleanup_local_service_dir "$CURRENT_SERVICE_DIR" "$P2P_ROOT"
+cleanup_local_service_dir "$CURRENT_SERVICE_DIR" "$DIREXIO_ROOT"

package/scripts/json.mjs

@@ -373,6 +373,7 @@ function cmdMutate(args) {
         delete data[key];
       }
       data.agent_install_status = "refresh_pending";
+      data.mcp_install_status = "refresh_pending";
       data.phase = startPhase;
       if (!isObject(data.phases)) data.phases = {};
       if (startPhase === "S4_BOOTSTRAP_STACK") {
@@ -513,6 +514,7 @@ function buildOperationReport(operation, status, stateFile, generatedAt, st) {
     },
     mcp: {
       status: localRefreshStatus,
+      install_status: st.mcp_install_status || "",
       package: st.mcp_npm_package || "direxio-mcp@latest",
       server_name: st.mcp_server_name || "",
       config_dir: st.mcp_config_dir || "",

package/scripts/lib/paths.sh

@@ -23,9 +23,7 @@ direxio_service_dir() {
 }
 
 direxio_default_workdir() {
-  if [ -n "${P2P_WORKDIR:-}" ]; then
-    printf '%s\n' "$P2P_WORKDIR"
-  elif [ -n "${DIREXIO_WORKDIR:-}" ]; then
+  if [ -n "${DIREXIO_WORKDIR:-}" ]; then
     printf '%s\n' "$DIREXIO_WORKDIR"
   elif [ -n "${DOMAIN:-}" ]; then
     direxio_service_dir "$DOMAIN"

package/scripts/lib/state.sh

@@ -4,7 +4,7 @@
 # Sourced by orchestrate.sh and phases/*.sh. All state.json reads/writes go
 # through this file to keep structure and fields consistent. Requires Node.js.
 #
-# state.json path: $P2P_WORKDIR/state.json.
+# state.json path: $DIREXIO_WORKDIR/state.json.
 # By default, DOMAIN=__DOMAIN__ maps to ~/.direxio/nodes/<service_id>/state.json.
 #
 # PHASES order is the state-machine execution order.
@@ -28,17 +28,17 @@ PHASES=(
 )
 
 # Paths.
-P2P_WORKDIR=$(direxio_default_workdir)
-STATE_JSON="$P2P_WORKDIR/state.json"
+DIREXIO_WORKDIR=$(direxio_default_workdir)
+STATE_JSON="$DIREXIO_WORKDIR/state.json"
 
 # Timestamp helper.
 _now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
 
 # Shared logging helpers.
-log()  { echo -e "\033[36m[p2p]\033[0m $*" >&2; }
-ok()   { echo -e "\033[32m[p2p]\033[0m $*" >&2; }
-warn() { echo -e "\033[33m[p2p]\033[0m $*" >&2; }
-fail() { echo -e "\033[31m[p2p][FATAL]\033[0m $*" >&2; exit 1; }
+log()  { echo -e "\033[36m[direxio]\033[0m $*" >&2; }
+ok()   { echo -e "\033[32m[direxio]\033[0m $*" >&2; }
+warn() { echo -e "\033[33m[direxio]\033[0m $*" >&2; }
+fail() { echo -e "\033[31m[direxio][FATAL]\033[0m $*" >&2; exit 1; }
 is_yes() {
   case "$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')" in
     y|yes|true|1) return 0 ;;
@@ -88,8 +88,8 @@ _windows_current_user() {
 
 # Initialize state.json for a new deployment.
 state_init() {
-  mkdir -p "$P2P_WORKDIR"
-  local run_id=${RUN_ID:-p2p-$(date -u +%Y%m%d-%H%M%S)}
+  mkdir -p "$DIREXIO_WORKDIR"
+  local run_id=${RUN_ID:-direxio-$(date -u +%Y%m%d-%H%M%S)}
   : > "$STATE_JSON"
   json_mutate "$STATE_JSON" state-init "$run_id" "${AWS_DEFAULT_REGION:-${AWS_REGION:-}}" "$(_now)" "${PHASES[@]}"
   log "Initialized state.json -> $STATE_JSON (run_id=$run_id)"

package/scripts/orchestrate.ps1

@@ -75,9 +75,9 @@ if (-not $env:DIREXIO_AGENT_WORKSPACE) {
   $env:DIREXIO_AGENT_WORKSPACE_WINDOWS = (Get-Location).ProviderPath
 }
 
-if ($env:P2P_WORKDIR) {
-  $env:P2P_WORKDIR_WINDOWS = $env:P2P_WORKDIR
-  $env:P2P_WORKDIR = ConvertTo-GitBashPath $env:P2P_WORKDIR
+if ($env:DIREXIO_WORKDIR) {
+  $env:DIREXIO_WORKDIR_WINDOWS = $env:DIREXIO_WORKDIR
+  $env:DIREXIO_WORKDIR = ConvertTo-GitBashPath $env:DIREXIO_WORKDIR
 }
 
 if (-not $env:DIREXIO_CODEX_COMMAND) {

package/scripts/orchestrate.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
-# orchestrate.sh - p2p-matrix deployment state-machine engine.
+# orchestrate.sh - Direxio deployment state-machine engine.
 #
-# Turns "one AWS credential -> working IM server -> local direxio-connect bridge" into 8 phases
-# (S0..S7). State is persisted to $P2P_WORKDIR/state.json and supports:
+# Turns "one AWS credential -> working Direxio server -> local direxio-connect bridge" into 8 phases
+# (S0..S7). State is persisted to $DIREXIO_WORKDIR/state.json and supports:
 #   - resume: continue from the first unfinished phase
 #   - checkpoints: wait for user/AWS actions without losing progress
 #   - destroy: every AWS resource is recorded for destroy.sh
@@ -21,7 +21,7 @@
 set -uo pipefail
 
 HERE=$(cd "$(dirname "$0")" && pwd)
-P2P_INSTALL_SCRIPTS_DIR="$HERE"
+DIREXIO_INSTALL_SCRIPTS_DIR="$HERE"
 
 # Prefer workspace-local tools when present.
 REPO_ROOT=$(cd "$HERE/.." && pwd)
@@ -30,7 +30,6 @@ if [ -d "$REPO_ROOT/.tools/bin" ]; then
   export PATH
 fi
 
-P2P_WORKDIR_WAS_SET=${P2P_WORKDIR+x}
 DIREXIO_WORKDIR_WAS_SET=${DIREXIO_WORKDIR+x}
 
 source "$HERE/lib/state.sh"
@@ -67,8 +66,8 @@ check_deps() {
       warn "Install AWS CLI v2 and configure credentials first:"
       warn "  macOS: curl 'https://awscli.amazonaws.com/AWSCLIV2.pkg' -o AWSCLIV2.pkg && sudo installer -pkg ./AWSCLIV2.pkg -target /"
       warn "  Linux x86_64: curl 'https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip' -o awscliv2.zip && unzip awscliv2.zip && sudo ./aws/install"
-      warn "  Configure: aws configure --profile p2p-matrix"
-      warn "  Use: export AWS_PROFILE=p2p-matrix AWS_DEFAULT_REGION=<region>"
+      warn "  Configure: aws configure --profile direxio-deployer"
+      warn "  Use: export AWS_PROFILE=direxio-deployer AWS_DEFAULT_REGION=<region>"
       warn "See references/user-journey.md for the AWS CLI setup guide."
       ;;
   esac
@@ -184,7 +183,7 @@ status_resume_safety() {
   local current=$1 billable
   billable=$(recorded_billable_resources)
   if [ -n "$billable" ] || phase_at_or_after_s3 "$current"; then
-    echo "do not reset state; fix the issue and rerun with P2P_EXISTING_STATE_ACTION=continue"
+    echo "do not reset state; fix the issue and rerun with DIREXIO_EXISTING_STATE_ACTION=continue"
   else
     echo "safe to rerun the same command after the next action is complete"
   fi
@@ -196,7 +195,7 @@ local_refresh_pending() {
 
 status_local_refresh() {
   if local_refresh_pending; then
-    echo "update/reset cleared old credentials, user confirmations, runtime checks, and bridge install proof"
+    echo "reset/redeploy cleared old credentials, user confirmations, runtime checks, bridge install proof, and MCP install proof"
   fi
 }
 
@@ -204,7 +203,7 @@ status_next_action() {
   if local_refresh_pending; then
     case "$1" in
       S4_BOOTSTRAP_STACK|S5_INIT_TOKENS|S6_WIRE_LOCAL|S7_VERIFY_E2E|DONE)
-        echo "rerun the deployment workflow to refresh S4-S7, local credentials, MCP snippets, and runtime checks"
+        echo "rerun the deployment workflow to refresh S4-S7, local credentials, MCP snippets, automatic installs, and runtime checks"
         return 0
         ;;
     esac
@@ -257,12 +256,12 @@ print_recovery_summary() {
 
 cmd_status() {
   if [ ! -f "$STATE_JSON" ]; then
-    if [ -z "${DOMAIN:-}" ] && [ -z "$P2P_WORKDIR_WAS_SET" ] && [ -z "$DIREXIO_WORKDIR_WAS_SET" ]; then
+    if [ -z "${DOMAIN:-}" ] && [ -z "$DIREXIO_WORKDIR_WAS_SET" ]; then
       cmd_status_inventory
       return 0
     fi
     warn "state.json not found: $STATE_JSON"
-    warn "Set DOMAIN=<service domain> or explicit P2P_WORKDIR=<service dir> to inspect a specific deployment."
+    warn "Set DOMAIN=<service domain> or explicit DIREXIO_WORKDIR=<service dir> to inspect a specific deployment."
     return 0
   fi
   echo "run_id     : $(state_get run_id)"
@@ -426,7 +425,7 @@ precheck_new_deploy_domain_env() {
     return 2
   fi
   if [ -z "$domain" ]; then
-    warn "Deployment blocked: DOMAIN is missing. P2P-IM requires a confirmed production Matrix server_name."
+    warn "Deployment blocked: DOMAIN is missing. Direxio requires a confirmed production Matrix server_name."
     warn "Use this skill to prepare domain/DNS, then rerun:"
     warn "  DOMAIN=__DOMAIN__ DOMAIN_MODE=user CONFIRM_DOMAIN_BINDING=1 bash $0"
     return 2
@@ -473,7 +472,7 @@ ensure_production_domain_selected() {
     return 2
   fi
   if [ -z "$domain" ]; then
-    warn "Deployment blocked: DOMAIN is missing. P2P-IM requires a confirmed production Matrix server_name."
+    warn "Deployment blocked: DOMAIN is missing. Direxio requires a confirmed production Matrix server_name."
     warn "Use this skill to prepare domain/DNS, then rerun:"
     warn "  DOMAIN=__DOMAIN__ DOMAIN_MODE=user CONFIRM_DOMAIN_BINDING=1 bash $0"
     return 2
@@ -501,14 +500,14 @@ guard_existing_state() {
   if [ "$(json_get "$STATE_JSON" domain_mode)" = "ec2" ]; then
     warn "Found legacy temporary-domain deployment state (domain_mode=ec2). Production deployment no longer supports resuming this mode."
     warn "Destroy and rebuild, or use a new service directory:"
-    warn "  P2P_EXISTING_STATE_ACTION=destroy bash $0"
+    warn "  DIREXIO_EXISTING_STATE_ACTION=destroy bash $0"
     warn "  DOMAIN=__DOMAIN__ DOMAIN_MODE=user CONFIRM_DOMAIN_BINDING=1 bash $0"
     return 2
   fi
   confirmed=$(json_get "$STATE_JSON" existing_state_confirmed false)
   [ "$confirmed" = "true" ] && return 0
 
-  action=${P2P_EXISTING_STATE_ACTION:-}
+  action=${DIREXIO_EXISTING_STATE_ACTION:-}
   if [ -z "$action" ] && [ -t 0 ]; then
     warn "Found existing deployment state with recorded AWS resources:"
     json_entries "$STATE_JSON" resources | sed 's/^/  /' >&2
@@ -529,12 +528,12 @@ guard_existing_state() {
       return 0 ;;
     ""|abort)
       warn "Existing service state must be handled explicitly to avoid accidental reuse or duplicate EC2 creation."
-      warn "Resume:  P2P_EXISTING_STATE_ACTION=continue bash $0"
-      warn "Rebuild: P2P_EXISTING_STATE_ACTION=destroy bash $0"
+      warn "Resume:  DIREXIO_EXISTING_STATE_ACTION=continue bash $0"
+      warn "Rebuild: DIREXIO_EXISTING_STATE_ACTION=destroy bash $0"
       warn "New service: DOMAIN=__DOMAIN__ DOMAIN_MODE=user CONFIRM_DOMAIN_BINDING=1 bash $0"
       return 2 ;;
     *)
-      warn "Unknown P2P_EXISTING_STATE_ACTION=$action (expected continue|destroy|abort)."
+      warn "Unknown DIREXIO_EXISTING_STATE_ACTION=$action (expected continue|destroy|abort)."
       return 2 ;;
   esac
 }