chore: publish r17 Spark CLI installer

Author: vibeforge1111

docs/AGENTS.md

@@ -129,7 +129,7 @@ Spark Swarm network submission and hosted workspace review are upcoming private
 
 ## Current Installer Pins
 
-- Spark CLI commit: `f2ae90330b07db135cafb913e37c20c4bd960831`
+- Spark CLI commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/install-safety.md

@@ -23,8 +23,8 @@ If you are non-technical, ask your coding assistant to open this page, run the d
 ## Current Hashes
 
 ```text
-b1c156a62fa76146d57caa3881a807f1612a22d77798d256f71773527f1ba04a  install.sh
-67ead15caa6cebbedaeed68cacc73d85db53c2b1b948b9b89b430973dbc5be0d  install.ps1
+e8056c6eb553e1268cb14c51d2a64d1296822669fde8f3a46c5a9ffd6f5d6c52  install.sh
+75d590d596144f36d0d8b351dabdace4c304ed1f53af3131973520f53129f9a9  install.ps1
 ```
 
 ## Safe Procedure
@@ -113,7 +113,7 @@ Users can change this later in Telegram with `/access 1`, `/access 2`, `/access
 
 ## Pinned Parts
 
-- Spark CLI commit: `f2ae90330b07db135cafb913e37c20c4bd960831`
+- Spark CLI commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/llms-full.txt

@@ -139,7 +139,7 @@ Do not send Telegram tokens or LLM keys to websites.
 
 ## Current Installer Pins
 
-- Spark CLI commit: `f2ae90330b07db135cafb913e37c20c4bd960831`
+- Spark CLI commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
 - Node: `22.18.0`
 - Python: `3.11`
 - uv: `0.11.7`

docs/pages/index.md

@@ -70,8 +70,8 @@ The installer has checksums, a release manifest, pinned managed runtimes, immuta
 
 Current public installer state:
 
-- Release: `spark-cli-public-installer-2026-05-29-r16`
-- Installed Spark CLI runtime commit: `f2ae90330b07db135cafb913e37c20c4bd960831`
+- Release: `spark-cli-public-installer-2026-05-29-r17`
+- Installed Spark CLI runtime commit: `c4b9a909402ff1a14d810529b5625802a4d47f28`
 - Local installer hashes match the committed release manifest.
 - Hosted installer verification passed after deploy.
 - Windows and WSL sandbox install checks are part of the release gate.

docs/pages/install-safety.md

@@ -50,8 +50,8 @@ Only then run the real install.
 ## Current Hashes
 
 ```text
-b1c156a62fa76146d57caa3881a807f1612a22d77798d256f71773527f1ba04a  install.sh
-67ead15caa6cebbedaeed68cacc73d85db53c2b1b948b9b89b430973dbc5be0d  install.ps1
+e8056c6eb553e1268cb14c51d2a64d1296822669fde8f3a46c5a9ffd6f5d6c52  install.sh
+75d590d596144f36d0d8b351dabdace4c304ed1f53af3131973520f53129f9a9  install.ps1
 ```
 
 ## Safe Human Procedure

docs/updates.md

@@ -6,7 +6,7 @@ This update publishes the safe public surfaces we can share now, without making
 
 ## Included
 
-- May 29 Spark CLI installer pin with hosted checksums, release manifest, command metadata, attestations, voice-safe setup defaults, stale Windows shim cleanup, and production smoke checks.
+- May 29 Spark CLI r17 installer pin with hosted checksums, release manifest, command metadata, attestations, voice-safe setup defaults, stale Windows shim cleanup, production smoke checks, and a softer upgrade-refresh pause when existing secrets need a secure backend before rewrite.
 - Telegram recursive loops now have a local-only public path for Builder chip loops: `/recursive start <chipKey> rounds <n>`, `/recursive sessions`, `/recursive report`, and `/recursive trace` work from local status files without Spark Swarm.
 - `spark-domain-chip-labs` as the public creator lab for domain chips, benchmark packs, specialization paths, autoloop policies, tool integrations, and publish packet standards.
 - `spark-character` as the public character and voice-consistency layer.
@@ -40,6 +40,6 @@ spark verify --installers --hosted-installers
 The expected Spark CLI release is:
 
 ```text
-spark-cli-public-installer-2026-05-29-r16
-f2ae90330b07db135cafb913e37c20c4bd960831
+spark-cli-public-installer-2026-05-29-r17
+c4b9a909402ff1a14d810529b5625802a4d47f28
 ```

docs/updates/index.html

@@ -45,7 +45,7 @@ <h1>Public labs are open. Spark Swarm stays private for now.</h1>
     <section class="doc-section">
       <h2>What changed.</h2>
       <div class="doc-grid doc-grid-3">
-        <div class="doc-card"><span class="doc-kicker">Installer</span><h3>May 29 pin</h3><p>The hosted installer now points at <code>spark-cli-public-installer-2026-05-29-r16</code> with matching checksums, manifest, command metadata, attestations, voice-safe defaults, stale Windows shim cleanup, and production smoke.</p></div>
+        <div class="doc-card"><span class="doc-kicker">Installer</span><h3>May 29 r17 pin</h3><p>The hosted installer now points at <code>spark-cli-public-installer-2026-05-29-r17</code> with matching checksums, manifest, command metadata, attestations, voice-safe defaults, stale Windows shim cleanup, production smoke, and a softer upgrade-refresh pause when existing secrets need a secure backend before rewrite.</p></div>
         <div class="doc-card"><span class="doc-kicker">Creator Lab</span><h3>Domain Chip Labs</h3><p>Public standards for domain chips, benchmarks, specialization paths, autoloop policies, tool integrations, and publish packet drafts.</p></div>
         <div class="doc-card"><span class="doc-kicker">Telegram</span><h3>Local recursive loops</h3><p>Builder chip loops can now start and report from Telegram using local status files, without depending on Spark Swarm workspace APIs.</p></div>
         <div class="doc-card"><span class="doc-kicker">Identity</span><h3>Character And Personality</h3><p>Spark Character is public, and Personality Chip Labs is public for modular profile experiments.</p></div>
@@ -66,7 +66,7 @@ <h3>Spark Swarm comes later</h3>
     <section class="doc-section">
       <h2>Verify the release.</h2>
       <pre class="docs-code">spark verify --installers --hosted-installers</pre>
-      <p>Expected release: <code>spark-cli-public-installer-2026-05-29-r16</code> at <code>f2ae90330b07db135cafb913e37c20c4bd960831</code>.</p>
+      <p>Expected release: <code>spark-cli-public-installer-2026-05-29-r17</code> at <code>c4b9a909402ff1a14d810529b5625802a4d47f28</code>.</p>
     </section>
   </article>
 </main>

install.ps1

@@ -1,7 +1,7 @@
 param(
     [string]$Prefix = "$HOME\.spark",
     [string]$Source = "https://github.com/vibeforge1111/spark-cli",
-    [string]$Ref = "f2ae90330b07db135cafb913e37c20c4bd960831",
+    [string]$Ref = "c4b9a909402ff1a14d810529b5625802a4d47f28",
     [string]$NodeVersion = "22.18.0",
     [string]$PythonVersion = "3.11",
     [string]$UvVersion = "0.11.7",
@@ -30,7 +30,7 @@ param(
 )
 
 $ErrorActionPreference = "Stop"
-$SparkCliReleaseName = "spark-cli-public-installer-2026-05-29-r16"
+$SparkCliReleaseName = "spark-cli-public-installer-2026-05-29-r17"
 $RefWasProvided = $PSBoundParameters.ContainsKey("Ref")
 $Script:InstallLockDir = ""
 $Script:PythonExe = ""
@@ -607,8 +607,9 @@ function Install-CliVenv {
     & $Script:PythonExe -m venv $venvDir
     Write-SparkLog "Upgrading pip in Spark CLI virtualenv"
     & (Join-Path $venvDir "Scripts\python.exe") -m pip install --upgrade pip | Out-Null
-    Write-SparkLog "Installing Spark CLI package"
-    & (Join-Path $venvDir "Scripts\python.exe") -m pip install -e $CliDir | Out-Null
+    Write-SparkLog "Installing Spark CLI package with browser-use support"
+    & (Join-Path $venvDir "Scripts\python.exe") -m pip install -e "$CliDir[browser-use]" | Out-Null
+    & (Join-Path $venvDir "Scripts\browser-use.exe") install | Out-Null
     return $venvDir
 }
 
@@ -710,13 +711,22 @@ function Run-Setup {
     if ($MiniMaxApiKey) { $setupArgs += @("--minimax-api-key", (New-SetupSecretRef $MiniMaxApiKey)) }
     $setupArgs += $SetupArg
     Write-SparkLog "Running spark setup $Bundle"
+    $previousSetupOptional = $env:SPARK_SETUP_OPTIONAL_ON_UPGRADE
     try {
+        if ($UpgradeExisting) {
+            $env:SPARK_SETUP_OPTIONAL_ON_UPGRADE = "1"
+        }
         $setupStartArgs = if ($NoAutostart) { @("--no-start-now", "--no-autostart") } else { @("--start-now", "--autostart") }
         & $sparkCmd setup $Bundle @setupStartArgs @setupArgs
         if ($LASTEXITCODE -ne 0) {
             throw "spark setup failed with exit code $LASTEXITCODE"
         }
     } finally {
+        if ($null -eq $previousSetupOptional) {
+            Remove-Item Env:\SPARK_SETUP_OPTIONAL_ON_UPGRADE -ErrorAction SilentlyContinue
+        } else {
+            $env:SPARK_SETUP_OPTIONAL_ON_UPGRADE = $previousSetupOptional
+        }
         foreach ($secretFile in $secretFiles) {
             Remove-Item -LiteralPath $secretFile -Force -ErrorAction SilentlyContinue
         }
@@ -730,6 +740,49 @@ function Run-Autostart {
     Write-SparkLog "Spark startup was handled by setup"
 }
 
+function Test-SetupRefreshPaused {
+    $pendingSetupPath = Join-Path $Script:SparkPrefix "state\setup.pending.json"
+    if (-not (Test-Path -LiteralPath $pendingSetupPath)) {
+        return $false
+    }
+    try {
+        return (Get-Content -LiteralPath $pendingSetupPath -Raw -ErrorAction Stop).Contains('"event": "setup_refresh_paused"')
+    } catch {
+        return $false
+    }
+}
+
+function Show-InstallOutcome {
+    $pendingSetupPath = Join-Path $Script:SparkPrefix "state\setup.pending.json"
+    if ($SkipSetup) {
+        $setupLine = "[SKIP] Setup: skipped by request"
+        $runtimeLine = "[MANUAL] Runtime: start after setup"
+        $telegramLine = "[VERIFY] Telegram: run spark verify --onboarding after setup"
+    } elseif (Test-SetupRefreshPaused) {
+        $setupLine = "[PAUSED] Setup refresh: secrets need a secure backend before Spark rewrites them"
+        $runtimeLine = "[OK] Existing runtime: can keep running with the current setup"
+        $telegramLine = "[VERIFY] Telegram: run spark verify --onboarding"
+    } elseif (Test-Path -LiteralPath $pendingSetupPath) {
+        $setupLine = "[PAUSED] Setup: run spark doctor"
+        $runtimeLine = "[MANUAL] Runtime: resume setup before changing secrets"
+        $telegramLine = "[VERIFY] Telegram: run spark verify --onboarding after setup resumes"
+    } else {
+        $setupLine = "[OK] Setup: configured"
+        if ($NoAutostart) {
+            $runtimeLine = "[MANUAL] Runtime: start after setup"
+        } else {
+            $runtimeLine = "[STARTED] Runtime: setup handled start/autostart"
+        }
+        $telegramLine = "[VERIFY] Telegram: run spark verify --onboarding"
+    }
+    Write-Host ""
+    Write-Host "Install outcome:"
+    Write-Host "  [OK] CLI upgrade: complete"
+    Write-Host "  $setupLine"
+    Write-Host "  $runtimeLine"
+    Write-Host "  $telegramLine"
+}
+
 function Invoke-Install {
     $Script:SparkPrefix = Resolve-FullPath $Prefix
     Apply-InstallDefaults
@@ -778,6 +831,7 @@ function Invoke-Install {
     Write-Host ""
     Write-Host "Install log:"
     Write-Host "  $Script:InstallLogPath"
+    Show-InstallOutcome
     Write-Host ""
     if ($SkipSetup) {
         Write-Host "Setup was skipped."