# Host scripts

**Status:** S0b–S7 implemented.

All scripts wrap **`nemohermes` / `openshell` / Docker**. No parallel control API.

## Entrypoints

| Script | Role | Status |
|--------|------|--------|
| `bootstrap.sh` | Host prereqs; install Docker if missing | ✅ S0b |
| `install.sh` | Staged installer (S0b–S5) | ✅ S0b–S5 |
| `install/s1-env.sh` | S1: create/validate `.env` | ✅ S1 |
| `install/s2-models.sh` | S2: model + vision config + smoke | ✅ S2 |
| `install/s4-sandbox.sh` | S4: sandbox verify/onboard | ✅ S4 |
| `install/s5-policy-skills.sh` | S5: policy overlays + skills sync | ✅ S5 |
| `doctor.sh` | Health checks (Docker, CLIs, sandbox, policy, skills, inference) | ✅ S6 |
| `connect.sh` | S7: Operator connect dispatcher | ✅ S7 |
| `connect/connect-name.sh` | S7: Name / profile setup | ✅ S7 |
| `connect/connect-channels.sh` | S7: Messaging channels (WhatsApp/Email/Telegram) | ✅ S7 |
| `connect/connect-square.sh` | S7: Square (remote MCP) | ✅ S7 |
| `connect/connect-quickbooks.sh` | S7: QuickBooks Online (local MCP) | ✅ S7 |
| `connect/connect-vagaro.sh` | S7: Vagaro (REST + webhooks) | ✅ S7 |
| `upgrade.sh` | Snapshot, pull pins, migrate, re-apply policy, doctor | ⏳ Pending |

## Shared library

| File | Purpose |
|------|---------|
| `lib/common.sh` | Logging, CLI detection, env loading, repo root |
| `lib/env.sh` | `.env` validation and creation helpers |
| `lib/vision_smoke.sh` | Vision capability smoke test |
| `lib/connect_state.sh` | S7: Local capability state management |

## Usage

```bash
# Bootstrap (Docker if missing)
./scripts/bootstrap.sh

# Full install (S0b–S5)
./scripts/install.sh

# Individual stages
./scripts/install.sh --stage s1   # env only
./scripts/install.sh --stage s2   # models only
./scripts/install.sh --stage s4   # sandbox verify/onboard
./scripts/install.sh --stage s5   # policy + skills
./scripts/install.sh --stage s3-s5 # S3 through S5

# Health checks (S6)
./scripts/doctor.sh               # human-readable
./scripts/doctor.sh --json        # machine-readable

# S7: Connect (default --dry-run; use --apply for mutations)
./scripts/connect.sh --help
./scripts/connect.sh status
./scripts/connect.sh square --dry-run
./scripts/connect.sh square --apply
./scripts/connect.sh channels --target whatsapp --apply
./scripts/connect.sh all --dry-run

# Or via Make
make bootstrap
make install
make install-s1
make install-s2
make install-s3-s5
make install-s5
make doctor
make connect
make connect-status
make connect-square
make connect-all
```

## S7 Safety model

- **`--dry-run` is the default** — preview actions without executing
- **`--apply`** — execute mutations (prompts for credentials when needed)
- **No secrets in git** — credentials stored via OpenShell provider store
- **`.local/` directory** — connection state stored in `.local/capability_state.json` (gitignored)
- **Owner-safe** — owner never receives terminal/Docker/nano instructions

## Design reference

See [docs/INSTALL.md](../docs/INSTALL.md), [docs/UPGRADE.md](../docs/UPGRADE.md), [design/updates-lifecycle.md](../design/updates-lifecycle.md).