Say "CoreDesktop is installed." at the end of every install

When configure had nothing left to do, install.sh ended on the kernel check
and the firewall's warnings just above it, so a successful run could be taken
for a failure. Move the end of install.sh to system/finish-install.sh, which
now says the install worked before the reboot advice and configure offer, and
test it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

install.sh

@@ -292,29 +292,5 @@ fi
 echo "Running migrations..."
 run_migrations
 
-CONFIGURE_HINT="configure connects to your Federated Core, sets up backups and signs you in to the AI agents."
+# Say the install worked, whether to reboot, and offer configure
-
+bash ~/.local/share/coredesktop/system/finish-install.sh
-# If the running kernel's modules are gone, a newer kernel was installed during
-# this run. configure waits for the reboot: until then, modules it needs, such
-# as Tailscale's tun and davfs2's fuse, can't be loaded.
-if [ ! -d "/usr/lib/modules/$(uname -r)" ]; then
-  echo "A newer kernel has been installed. Reboot, then run: configure"
-  echo "$CONFIGURE_HINT"
-  exit 0
-fi
-echo "Kernel is up to date, no reboot needed. You may want to consider a reboot if other significant software was updated or installed."
-
-# Offer configure only if something is still to do, as refresh runs this too.
-# This script is usually piped into bash, so ask on the terminal, not stdin.
-if ~/.local/bin/configure --list | grep -q '^to do'; then
-  echo
-  echo "$CONFIGURE_HINT"
-  if { : < /dev/tty; } 2> /dev/null && read -rp "Run configure now? [Y/n] " answer < /dev/tty \
-      && [[ "$answer" != [nN]* ]]; then
-    # Straight to the terminal, outside the log: sign-ins need a terminal, and
-    # their codes and links don't belong in a log
-    ~/.local/bin/configure < /dev/tty > /dev/tty 2>&1 || true
-  else
-    echo "To do it later, run: configure"
-  fi
-fi

system/finish-install.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+#
+# Purpose : The end of install.sh: say the install worked, say whether to
+#           reboot, and offer configure if something is still to do. refresh
+#           runs install.sh too, so it may all be done already; the install
+#           still ends by saying it worked, so it can't be taken for a failure.
+
+# install.sh is usually piped into bash, so ask on the terminal
+TTY="${COREDESKTOP_TTY:-/dev/tty}"
+CONFIGURE="$HOME/.local/bin/configure"
+CONFIGURE_HINT="configure connects to your Federated Core, sets up backups and signs you in to the AI agents."
+
+echo
+echo -e "\e[32mCoreDesktop is installed.\e[0m"
+
+# If the running kernel's modules are gone, a newer kernel was installed during
+# this run. configure waits for the reboot: until then, modules it needs, such
+# as Tailscale's tun and davfs2's fuse, can't be loaded.
+if [ ! -d "/usr/lib/modules/$(uname -r)" ]; then
+  echo "A newer kernel has been installed. Reboot, then run: configure"
+  echo "$CONFIGURE_HINT"
+  exit 0
+fi
+echo "Kernel is up to date, no reboot needed. You may want to consider a reboot if other significant software was updated or installed."
+
+if "$CONFIGURE" --list | grep -q '^to do'; then
+  echo
+  echo "$CONFIGURE_HINT"
+  if { : < "$TTY"; } 2> /dev/null && read -rp "Run configure now? [Y/n] " answer < "$TTY" \
+      && [[ "$answer" != [nN]* ]]; then
+    # Straight to the terminal, outside the log: sign-ins need a terminal, and
+    # their codes and links don't belong in a log
+    "$CONFIGURE" < "$TTY" > "$TTY" 2>&1 || true
+  else
+    echo "To do it later, run: configure"
+  fi
+fi

tests/finish-install.bats

@@ -0,0 +1,71 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+# system/finish-install.sh with a fake uname and configure. The kernel is up to
+# date unless a test says otherwise: uname reports a kernel whose modules exist.
+
+setup() {
+  common_setup
+  KERNEL="$(ls /usr/lib/modules 2> /dev/null | head -n 1)"
+  export KERNEL
+  stub uname 'echo "$KERNEL"'
+  # configure --list prints $ITEMS; configure itself logs that it ran
+  export ITEMS="done   core           Federated Core"
+  mkdir -p "$HOME/.local/bin"
+  cat > "$HOME/.local/bin/configure" << 'STUB'
+#!/bin/bash
+echo "configure${*:+ $*}" >> "$STUB_LOG"
+[ "$1" = --list ] && printf '%s\n' "$ITEMS"
+exit 0
+STUB
+  chmod +x "$HOME/.local/bin/configure"
+  # No terminal unless a test gives answers
+  export COREDESKTOP_TTY="$BATS_TEST_TMPDIR/no-tty/tty"
+}
+
+needs_modules() {
+  [ -n "$KERNEL" ] || skip "needs a kernel in /usr/lib/modules"
+}
+
+answer() {
+  export COREDESKTOP_TTY="$BATS_TEST_TMPDIR/answer"
+  echo "$1" > "$COREDESKTOP_TTY"
+}
+
+@test "finish-install says the install worked when nothing is left to do" {
+  needs_modules
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."* ]]
+  [[ "$output" == *"no reboot needed"* ]]
+  [[ "$output" != *"configure connects"* ]]
+  uncalled configure
+}
+
+@test "finish-install says the install worked, then asks for a reboot after a new kernel" {
+  KERNEL=0.0.0-not-installed
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."*"Reboot, then run: configure"* ]]
+  not_called configure
+}
+
+@test "finish-install says the install worked before offering configure" {
+  needs_modules
+  ITEMS="to do  core           Federated Core"
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."*"configure connects"*"To do it later, run: configure"* ]]
+  uncalled configure
+}
+
+@test "finish-install runs configure when asked" {
+  needs_modules
+  ITEMS="to do  core           Federated Core"
+  answer y
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."* ]]
+  called configure
+}