@m8t-stack/cli 0.2.30 → 0.2.32

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.30";
+var CLI_VERSION = "0.2.32";
 
 // src/lib/render-error.ts
 init_errors();
@@ -10645,9 +10645,9 @@ var Webhooks = class extends APIResource {
     __classPrivateFieldGet(this, _Webhooks_instances, "m", _Webhooks_validateSecret).call(this, secret);
     const headersObj = buildHeaders([headers]).values;
     const signatureHeader = __classPrivateFieldGet(this, _Webhooks_instances, "m", _Webhooks_getRequiredHeader).call(this, headersObj, "webhook-signature");
-    const timestamp = __classPrivateFieldGet(this, _Webhooks_instances, "m", _Webhooks_getRequiredHeader).call(this, headersObj, "webhook-timestamp");
+    const timestamp2 = __classPrivateFieldGet(this, _Webhooks_instances, "m", _Webhooks_getRequiredHeader).call(this, headersObj, "webhook-timestamp");
     const webhookId = __classPrivateFieldGet(this, _Webhooks_instances, "m", _Webhooks_getRequiredHeader).call(this, headersObj, "webhook-id");
-    const timestampSeconds = parseInt(timestamp, 10);
+    const timestampSeconds = parseInt(timestamp2, 10);
     if (isNaN(timestampSeconds)) {
       throw new InvalidWebhookSignatureError("Invalid webhook timestamp format");
     }
@@ -10660,7 +10660,7 @@ var Webhooks = class extends APIResource {
     }
     const signatures = signatureHeader.split(" ").map((part) => part.startsWith("v1,") ? part.substring(3) : part);
     const decodedSecret = secret.startsWith("whsec_") ? Buffer.from(secret.replace("whsec_", ""), "base64") : Buffer.from(secret, "utf-8");
-    const signedPayload = webhookId ? `${webhookId}.${timestamp}.${payload}` : `${timestamp}.${payload}`;
+    const signedPayload = webhookId ? `${webhookId}.${timestamp2}.${payload}` : `${timestamp2}.${payload}`;
     const key2 = await crypto.subtle.importKey("raw", decodedSecret, { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
     for (const signature of signatures) {
       try {
@@ -17000,7 +17000,7 @@ var SIZE_PRESETS = {
 };
 var DEFAULT_REGISTRY = "ghcr.io/m8t-labs";
 var DEFAULT_IMAGE = "m8t-coding-agent";
-var DEFAULT_TAG = "v0.1.0";
+var DEFAULT_TAG = "v0.1.2";
 var DEFAULT_MODEL = "gpt-4.1-mini";
 var NAME_RE = /^[a-z0-9-]+$/;
 var CoderDeployCommand = class extends M8tCommand {
@@ -18088,9 +18088,7 @@ function extractTarGz(tgz, into) {
 }
 
 // src/lib/platform-stamp.ts
-import { TableClient, AzureNamedKeyCredential } from "@azure/data-tables";
-init_errors();
-init_rbac();
+import { TableClient as TableClient2 } from "@azure/data-tables";
 
 // src/lib/platform-storage-discovery.ts
 init_http();
@@ -18118,7 +18116,19 @@ async function discoverStampStorage(opts) {
   return { tableEndpoint, accountResourceId: chosen.id, accountName: chosen.name };
 }
 
-// src/lib/platform-stamp.ts
+// src/lib/metadata-table-write.ts
+import { TableClient, AzureNamedKeyCredential } from "@azure/data-tables";
+init_errors();
+init_rbac();
+function is403(e) {
+  return e.statusCode === 403;
+}
+function is404(e) {
+  return e.statusCode === 404;
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
 async function makeSharedKeyClient(opts) {
   const rg = /\/resourceGroups\/([^/]+)\//i.exec(opts.accountResourceId)?.[1];
   if (!rg) return null;
@@ -18126,22 +18136,29 @@ async function makeSharedKeyClient(opts) {
   if (!key2) return null;
   return new TableClient(opts.tableEndpoint, TABLE, new AzureNamedKeyCredential(opts.accountName, key2));
 }
-async function writeStamp(opts) {
-  const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
-  const entity = stampToEntity(opts.stamp);
-  const aad = new TableClient(tableEndpoint, TABLE, opts.credential);
+async function upsertMetadataEntity(opts) {
+  const discover = opts.discoverImpl ?? discoverStampStorage;
+  const makeAad = opts.aadClientImpl ?? ((endpoint, credential2) => new TableClient(endpoint, TABLE, credential2));
+  const makeShared = opts.sharedClientImpl ?? makeSharedKeyClient;
+  const nap = opts.sleepImpl ?? sleep2;
+  const { tableEndpoint, accountResourceId, accountName } = await discover({
+    credential: opts.credential,
+    subscriptionId: opts.subscriptionId,
+    resourceGroup: opts.resourceGroup
+  });
+  const aad = makeAad(tableEndpoint, opts.credential);
   await aad.createTable().catch(() => void 0);
   try {
-    await aad.upsertEntity(entity, "Replace");
+    await aad.upsertEntity(opts.entity, "Replace");
     return;
   } catch (e) {
     if (!is403(e)) throw e;
   }
-  opts.onProgress?.("writing the platform stamp with the account key \u2014 your identity lacks the Storage Table data role.");
-  const shared = await makeSharedKeyClient({ tableEndpoint, accountResourceId, accountName });
+  opts.onProgress?.(`writing the ${opts.label} with the account key \u2014 your identity lacks the Storage Table data role.`);
+  const shared = await makeShared({ tableEndpoint, accountResourceId, accountName });
   if (shared) {
     await shared.createTable().catch(() => void 0);
-    await shared.upsertEntity(entity, "Replace");
+    await shared.upsertEntity(opts.entity, "Replace");
     return;
   }
   opts.onProgress?.("shared-key access is disabled \u2014 granting Storage Table Data Contributor to your identity (one-time)\u2026");
@@ -18155,30 +18172,45 @@ async function writeStamp(opts) {
     });
   } catch (e) {
     throw new LocalCliError({
-      code: "PLATFORM_STAMP_NO_ACCESS",
-      message: `Cannot write the platform stamp: AAD lacks the Storage Table data role for ${accountName}, shared-key access is disabled, and self-granting the role failed.`,
+      code: opts.errorCode,
+      message: `Cannot write the ${opts.label}: AAD lacks the Storage Table data role for ${accountName}, shared-key access is disabled, and self-granting the role failed.`,
       hint: "Grant yourself 'Storage Table Data Contributor' on the storage account and retry.",
       cause: e
     });
   }
   for (let i = 0; i < 6; i++) {
-    await sleep2(1e4);
+    await nap(1e4);
     try {
-      await aad.upsertEntity(entity, "Replace");
+      await aad.upsertEntity(opts.entity, "Replace");
       return;
     } catch (e) {
       if (!is403(e)) throw e;
     }
   }
   throw new LocalCliError({
-    code: "PLATFORM_STAMP_NO_ACCESS",
-    message: `Cannot write the platform stamp: granted 'Storage Table Data Contributor' on ${accountName}, but the data-plane role has not propagated yet.`,
-    hint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes."
+    code: opts.errorCode,
+    message: `Cannot write the ${opts.label}: granted 'Storage Table Data Contributor' on ${accountName}, but the data-plane role has not propagated yet.`,
+    hint: opts.retryHint
+  });
+}
+
+// src/lib/platform-stamp.ts
+async function writeStamp(opts) {
+  const entity = stampToEntity(opts.stamp);
+  await upsertMetadataEntity({
+    credential: opts.credential,
+    subscriptionId: opts.subscriptionId,
+    resourceGroup: opts.resourceGroup,
+    entity,
+    label: "platform stamp",
+    errorCode: "PLATFORM_STAMP_NO_ACCESS",
+    retryHint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes.",
+    ...opts.onProgress ? { onProgress: opts.onProgress } : {}
   });
 }
 async function readStamp(opts) {
   const { tableEndpoint, accountResourceId, accountName } = await discoverStampStorage(opts);
-  const aad = new TableClient(tableEndpoint, TABLE, opts.credential);
+  const aad = new TableClient2(tableEndpoint, TABLE, opts.credential);
   try {
     const row = await aad.getEntity(PK, RK);
     return entityToStamp(row);
@@ -18195,15 +18227,6 @@ async function readStamp(opts) {
     return null;
   }
 }
-function is403(e) {
-  return e.statusCode === 403;
-}
-function is404(e) {
-  return e.statusCode === 404;
-}
-function sleep2(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
 
 // src/lib/platform-converge.ts
 import * as fs22 from "fs";
@@ -18245,6 +18268,7 @@ function buildBicepParams(p) {
   if (p.installerImage !== void 0) params.push(`installerImage=${p.installerImage}`);
   if (p.updateCron !== void 0) params.push(`updateCron=${p.updateCron}`);
   if (p.channelUrl !== void 0) params.push(`channelUrl=${p.channelUrl}`);
+  if (p.voiceInternalSecret) params.push(`voiceInternalSecret=${p.voiceInternalSecret}`);
   if (p.gatewayCpu) params.push(`gatewayCpu=${p.gatewayCpu}`);
   if (p.gatewayMemory) params.push(`gatewayMemory=${p.gatewayMemory}`);
   if (p.refereeEnabled) params.push(`refereeEnabled=${p.refereeEnabled}`);
@@ -18664,7 +18688,7 @@ async function resolveBicepParamsForConverge(ctx, opts = {}) {
       hint: "Pass --suffix <existing-suffix> (from the deployed resource names) to avoid provisioning duplicate resources."
     });
   }
-  const location = (await runAz(["resource", "list", "-g", ctx.resourceGroup, "--query", "[0].location", "-o", "tsv"])).trim();
+  const location = opts.location ?? (await runAz(["resource", "list", "-g", ctx.resourceGroup, "--query", "[0].location", "-o", "tsv"])).trim();
   const foundryResourceId = await resolveFoundryResourceId(opts.foundryEndpoint ?? "", opts.foundryResourceId);
   const acrPullIdentityResourceId = resolveAcrPullIdentity({ explicit: opts.acrPullIdentity });
   const imageRef = `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`;
@@ -18680,7 +18704,9 @@ async function resolveBicepParamsForConverge(ctx, opts = {}) {
     acrPullIdentityResourceId,
     acrResourceId,
     foundryTracingMode: opts.foundryTracingMode,
-    ...opts.assignSubscriptionRoles !== void 0 ? { assignSubscriptionRoles: opts.assignSubscriptionRoles } : {}
+    ...opts.assignSubscriptionRoles !== void 0 ? { assignSubscriptionRoles: opts.assignSubscriptionRoles } : {},
+    ...opts.voiceInternalSecret ? { voiceInternalSecret: opts.voiceInternalSecret } : {},
+    ...opts.channelUrl ? { channelUrl: opts.channelUrl } : {}
   };
 }
 function swapHostedImage(def, newImage) {
@@ -18949,10 +18975,10 @@ import { DefaultAzureCredential as DefaultAzureCredential17 } from "@azure/ident
 import * as path25 from "path";
 
 // src/lib/platform-infra-params.ts
-import { TableClient as TableClient2 } from "@azure/data-tables";
+import { TableClient as TableClient3 } from "@azure/data-tables";
 async function openInfraParamsTable(opts) {
   const { tableEndpoint } = await discoverStampStorage(opts);
-  return new TableClient2(tableEndpoint, "Metadata", opts.credential);
+  return new TableClient3(tableEndpoint, "Metadata", opts.credential);
 }
 async function readInfraParams(client) {
   try {
@@ -18961,8 +18987,17 @@ async function readInfraParams(client) {
     return null;
   }
 }
-async function writeInfraParams(client, p) {
-  await client.upsertEntity(infraParamsToEntity(p), "Replace");
+async function writeInfraParams(ctx, p) {
+  await upsertMetadataEntity({
+    credential: ctx.credential,
+    subscriptionId: ctx.subscriptionId,
+    resourceGroup: ctx.resourceGroup,
+    entity: infraParamsToEntity(p),
+    label: "infra-params row",
+    errorCode: "PLATFORM_INFRA_PARAMS_NO_ACCESS",
+    retryHint: ctx.retryHint,
+    ...ctx.onProgress ? { onProgress: ctx.onProgress } : {}
+  });
 }
 async function deriveSuffixVerified(opts) {
   const list = JSON.parse(
@@ -18999,6 +19034,24 @@ async function deriveSuffixVerified(opts) {
   return cae.length === 1 ? suffix : null;
 }
 
+// src/lib/gateway-live-params.ts
+async function readLiveGatewayEnvVar(opts) {
+  const args = ["containerapp", "show", "-n", opts.gatewayName, "-g", opts.resourceGroup];
+  if (opts.subscriptionId) args.push("--subscription", opts.subscriptionId);
+  args.push("--query", `properties.template.containers[0].env[?name=='${opts.name}'].value | [0]`, "-o", "tsv");
+  let raw;
+  try {
+    raw = await runAz(args);
+  } catch {
+    return "";
+  }
+  const v = raw.trim();
+  return v === "None" ? "" : v;
+}
+function readLiveVoiceInternalSecret(opts) {
+  return readLiveGatewayEnvVar({ ...opts, name: "M8T_INTERNAL_SECRET" });
+}
+
 // src/lib/platform-converge-cli.ts
 init_errors();
 
@@ -19412,6 +19465,17 @@ async function buildConvergeDeps(args) {
       const infraTable = await openInfraParamsTable({ credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup });
       const stamped = (await readInfraParams(infraTable))?.bicep;
       args.onProgress?.("subscription-scoped modules skipped: updater is RG-scoped; sub-level changes require a founder-run CLI converge.");
+      const gatewayName = args.suffix ? `m8t-gateway-${args.suffix}` : void 0;
+      const voiceInternalSecret = gatewayName ? await readLiveVoiceInternalSecret({
+        gatewayName,
+        resourceGroup: args.resourceGroup,
+        subscriptionId: args.subscriptionId
+      }) : "";
+      if (gatewayName && !voiceInternalSecret) {
+        args.onProgress?.(
+          `could not read the live voice-relay secret (M8T_INTERNAL_SECRET) off gateway '${gatewayName}' \u2014 the read failed or the variable is missing. This infra converge will re-mint the secret, rolling BOTH the gateway and the voice relay.`
+        );
+      }
       const opts = {
         suffix: args.suffix,
         assignSubscriptionRoles: false,
@@ -19422,8 +19486,11 @@ async function buildConvergeDeps(args) {
           foundryResourceId: stamped.foundryResourceId,
           acrPullIdentity: stamped.acrPullIdentityResourceId,
           acrResourceId: stamped.acrResourceId,
-          ...stamped.foundryTracingMode ? { foundryTracingMode: stamped.foundryTracingMode } : {}
-        } : {}
+          ...stamped.foundryTracingMode ? { foundryTracingMode: stamped.foundryTracingMode } : {},
+          ...stamped.channelUrl ? { channelUrl: stamped.channelUrl } : {},
+          ...stamped.location ? { location: stamped.location } : {}
+        } : {},
+        ...voiceInternalSecret ? { voiceInternalSecret } : {}
       };
       return applyInfraDeploy(a, ctx, target, opts);
     },
@@ -19471,17 +19538,26 @@ async function buildConvergeDeps(args) {
       const table = await openInfraParamsTable({ credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup });
       const existing = await readInfraParams(table);
       if (!existing) {
-        warn("infra-params re-stamp skipped: no existing row to refresh (deploy/enable-auto-update writes the authoritative row).");
+        warn("infra-params re-stamp skipped: no existing row to refresh (enable-auto-update writes the authoritative row).");
         return;
       }
-      await writeInfraParams(table, {
-        ...existing,
-        bicep: {
-          ...existing.bicep,
-          imageRef: `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`
+      await writeInfraParams(
+        {
+          credential: args.credential,
+          subscriptionId: args.subscriptionId,
+          resourceGroup: args.resourceGroup,
+          retryHint: "The role assignment persists \u2014 retry 'm8t platform update' in a few minutes.",
+          onProgress: args.onProgress
         },
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
+        {
+          ...existing,
+          bicep: {
+            ...existing.bicep,
+            imageRef: `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`
+          },
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      );
     },
     async applySeedRefresh(_a3, ctx) {
       let kvUri;
@@ -19718,10 +19794,10 @@ function resolveHeadlessContextFromEnv(env) {
 }
 
 // src/lib/apply-request-store.ts
-import { TableClient as TableClient3 } from "@azure/data-tables";
+import { TableClient as TableClient4 } from "@azure/data-tables";
 async function openApplyTable(opts) {
   const { tableEndpoint } = await discoverStampStorage(opts);
-  return new TableClient3(tableEndpoint, "Metadata", opts.credential);
+  return new TableClient4(tableEndpoint, "Metadata", opts.credential);
 }
 function hasStatus(e, n) {
   return e.statusCode === n;
@@ -20111,10 +20187,11 @@ var PlatformConvergeCommand = class extends M8tCommand {
   }
   /**
    * Recover the real bicep suffix WITHOUT guessing: prefer the stamped
-   * `system/infra-params` row (written by deploy + every full converge), and
-   * fall back to deriving it from the live gateway container-app name — but only
-   * when that derivation VERIFIES (exactly one gateway + a matching CAE). If
-   * both fail, throw rather than provision a duplicate stack.
+   * `system/infra-params` row (written by enable-auto-update, and re-stamped
+   * by every full converge), and fall back to deriving it from the live
+   * gateway container-app name — but only when that derivation VERIFIES
+   * (exactly one gateway + a matching CAE). If both fail, throw rather than
+   * provision a duplicate stack.
    */
   async recoverSuffix(ctx) {
     const infraTable = await openInfraParamsTable({
@@ -20510,6 +20587,12 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   channelUrl = Option33.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
+  location = Option33.String("--location", {
+    description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
+  });
+  foundryTracing = Option33.String("--foundry-tracing", {
+    description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
+  });
   endpoint = Option33.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
@@ -20574,7 +20657,12 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
         message: `Could not read the live image for gateway '${gatewayName}' in resource group ${resourceGroup}.`
       });
     }
-    const location = (await runAz(["resource", "list", "-g", resourceGroup, "--subscription", subscriptionId, "--query", "[0].location", "-o", "tsv"])).trim();
+    const voiceInternalSecret = await readLiveVoiceInternalSecret({
+      gatewayName,
+      resourceGroup,
+      subscriptionId
+    });
+    const location = typeof this.location === "string" && this.location.length > 0 ? this.location : (await runAz(["resource", "list", "-g", resourceGroup, "--subscription", subscriptionId, "--query", "[0].location", "-o", "tsv"])).trim();
     if (!location) {
       throw new LocalCliError({
         code: "PLATFORM_ENABLE_AUTO_UPDATE_NO_LOCATION",
@@ -20593,7 +20681,9 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       foundryResourceId,
       foundryProjectEndpoint: project.endpoint,
       acrPullIdentityResourceId,
-      acrResourceId
+      acrResourceId,
+      ...parseFoundryTracingMode(this.foundryTracing) ? { foundryTracingMode: parseFoundryTracingMode(this.foundryTracing) } : {},
+      ...typeof this.channelUrl === "string" && this.channelUrl.length > 0 ? { channelUrl: this.channelUrl } : {}
     };
     onProgress("running Bicep deployment to provision the updater (~2-4 min)\u2026");
     const repoRoot = await resolveRepoRoot2();
@@ -20604,18 +20694,27 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
         ...recoveredParams,
         provisionUpdater: true,
         installerImage: this.installerImage,
-        ...typeof this.updateCron === "string" ? { updateCron: this.updateCron } : {},
-        ...typeof this.channelUrl === "string" ? { channelUrl: this.channelUrl } : {}
+        ...voiceInternalSecret ? { voiceInternalSecret } : {},
+        ...typeof this.updateCron === "string" ? { updateCron: this.updateCron } : {}
       }),
       deploymentName: `m8t-enable-auto-update-${suffix.slice(0, 12)}`
     });
     onProgress("backfilling system/infra-params\u2026");
-    await writeInfraParams(infraTable, {
-      schemaVersion: 1,
-      suffix,
-      bicep: recoveredParams,
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
+    await writeInfraParams(
+      {
+        credential: credential2,
+        subscriptionId,
+        resourceGroup,
+        retryHint: "The role assignment persists \u2014 retry 'm8t platform enable-auto-update' in a few minutes.",
+        onProgress
+      },
+      {
+        schemaVersion: 1,
+        suffix,
+        bicep: recoveredParams,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    );
     if (mode === "json") {
       this.context.stdout.write(renderJson({ suffix, resourceGroup, installerImage: this.installerImage, enabled: true }) + "\n");
       return 0;
@@ -22589,7 +22688,7 @@ var OpenCommand = class extends M8tCommand {
 // src/commands/dream/run.ts
 import { Command as Command46, Option as Option43 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
-import { TableClient as TableClient5 } from "@azure/data-tables";
+import { TableClient as TableClient6 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
 import { LogsQueryClient as LogsQueryClient3, LogsQueryResultStatus as LogsQueryResultStatus3 } from "@azure/monitor-query";
 
@@ -22898,7 +22997,7 @@ var ConvFetchError = class extends Error {
 };
 
 // ../../packages/brain/engine/dist/esm/cursor.js
-import { TableClient as TableClient4 } from "@azure/data-tables";
+import { TableClient as TableClient5 } from "@azure/data-tables";
 
 // ../../packages/agent-ledger/dist/esm/row-key.js
 var MAX_MS = 864e13;
@@ -23038,7 +23137,7 @@ async function commitCursorAdvance(plan, cursor) {
 }
 var CURSOR_TABLE_NAME = "BrainDreamCursor";
 function makeTableCursor(credential2, tableEndpoint) {
-  const client = new TableClient4(tableEndpoint, CURSOR_TABLE_NAME, credential2);
+  const client = new TableClient5(tableEndpoint, CURSOR_TABLE_NAME, credential2);
   return new TableCursor(client);
 }
 function formatCursorPreview(cursor) {
@@ -25022,7 +25121,7 @@ AppDependencies
   };
 }
 function buildLiveSources(context, credential2) {
-  const ledgerClient = new TableClient5(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
+  const ledgerClient = new TableClient6(context.ledgerTableEndpoint, LEDGER_TABLE_NAME, credential2);
   const ledger = makeLedgerSource(
     async (pk, sinceTs) => fetchLedgerRows(
       { workers: [pk], source: "all", from: sinceTs, to: "9999-12-31T23:59:59.999Z" },
@@ -25818,10 +25917,16 @@ function buildAciCreateArgs(s) {
     `RESOURCE_GROUP=${s.resourceGroup}`,
     `LOCATION=${s.location}`,
     `MI_CLIENT_ID=${s.miClientId}`,
-    `APP_REG_CLIENT_ID=${s.appRegClientId}`
+    `APP_REG_CLIENT_ID=${s.appRegClientId}`,
+    // The installer's own image ref, so the install can provision the updater job
+    // to run THIS engine. Derived from the launched image rather than threaded
+    // separately, so the two can never disagree — and never read from the release
+    // pin, which can name an installer several versions behind the running one.
+    `INSTALLER_IMAGE_REF=${s.image}`
   ];
   if (s.gatewayImageRef) env.push(`GATEWAY_IMAGE_REF=${s.gatewayImageRef}`);
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
+  if (s.updateChannelUrl) env.push(`M8T_UPDATE_CHANNEL_URL=${s.updateChannelUrl}`);
   if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
   if (s.githubApp) {
     const g = s.githubApp;
@@ -25973,7 +26078,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.36";
+var DEFAULT_INSTALLER_TAG = "v0.1.38";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -26090,7 +26195,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp,
-      enrollContactEmail: account.upn
+      enrollContactEmail: account.upn,
+      ...process.env.M8T_UPDATE_CHANNEL_URL ? { updateChannelUrl: process.env.M8T_UPDATE_CHANNEL_URL } : {}
     });
     this.context.stdout.write(
       `${colors.success("\u2713")} installer launched in ${colors.field(resourceGroup)} (${location}).
@@ -26423,42 +26529,301 @@ var DEFAULT_MEMORY_INDEX_HEADER = [
   `> Your memories, newest first. The summary on each line is usually enough to answer \u2014 open the linked file only when you need full detail. Each path is repo-root; copy it verbatim, never invent one.`,
   ``
 ].join("\n");
-function parseOnboardingBlock(text) {
-  const candidates = [
-    ...[...text.matchAll(/```(?:json)?\s*([\s\S]*?)```/g)].map((m) => m[1]),
-    text
-  ].reverse();
-  for (const c of candidates) {
+var ONBOARDING_BLOCK_KEYS = [
+  "schema_version",
+  "company_stage",
+  "icp",
+  "industry",
+  "team_size",
+  "context",
+  "founder_name",
+  "founder_email",
+  "advisor_name",
+  "advisor_email"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasValidUniqueJsonKeys(source) {
+  let offset = 0;
+  const skipWhitespace = () => {
+    while (/\s/.test(source[offset] ?? "")) offset += 1;
+  };
+  const parseString = () => {
+    if (source[offset] !== '"') return null;
+    const start = offset;
+    offset += 1;
+    let escaped = false;
+    while (offset < source.length) {
+      const char = source[offset];
+      if (escaped) {
+        escaped = false;
+        offset += 1;
+        continue;
+      }
+      if (char === "\\") {
+        escaped = true;
+        offset += 1;
+        continue;
+      }
+      if (char === '"') {
+        offset += 1;
+        try {
+          const parsed = JSON.parse(source.slice(start, offset));
+          return typeof parsed === "string" ? parsed : null;
+        } catch {
+          return null;
+        }
+      }
+      offset += 1;
+    }
+    return null;
+  };
+  const parseValue = (depth) => {
+    if (depth > 32) return false;
+    skipWhitespace();
+    const char = source[offset];
+    if (char === '"') return parseString() !== null;
+    if (char === "{") {
+      offset += 1;
+      skipWhitespace();
+      const keys = /* @__PURE__ */ new Set();
+      if (source[offset] === "}") {
+        offset += 1;
+        return true;
+      }
+      for (; ; ) {
+        skipWhitespace();
+        const key2 = parseString();
+        if (key2 === null) return false;
+        if (keys.has(key2)) return false;
+        keys.add(key2);
+        skipWhitespace();
+        if (source[offset] !== ":") return false;
+        offset += 1;
+        if (!parseValue(depth + 1)) return false;
+        skipWhitespace();
+        if (source[offset] === "}") {
+          offset += 1;
+          return true;
+        }
+        if (source[offset] !== ",") return false;
+        offset += 1;
+      }
+    }
+    if (char === "[") {
+      offset += 1;
+      skipWhitespace();
+      if (source[offset] === "]") {
+        offset += 1;
+        return true;
+      }
+      for (; ; ) {
+        if (!parseValue(depth + 1)) return false;
+        skipWhitespace();
+        if (source[offset] === "]") {
+          offset += 1;
+          return true;
+        }
+        if (source[offset] !== ",") return false;
+        offset += 1;
+      }
+    }
+    const primitiveStart = offset;
+    while (offset < source.length && !/[\s,}\]]/.test(source[offset] ?? "")) offset += 1;
+    return offset > primitiveStart;
+  };
+  if (!parseValue(0)) return false;
+  skipWhitespace();
+  if (offset !== source.length) return false;
+  try {
+    JSON.parse(source);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function canonicalBlock(value) {
+  if (!isRecord(value)) return null;
+  const keys = Object.keys(value).sort();
+  const expected = [...ONBOARDING_BLOCK_KEYS].sort();
+  if (keys.length !== expected.length || keys.some((key2, index) => key2 !== expected[index])) return null;
+  if (value.schema_version !== "2") return null;
+  for (const key2 of ONBOARDING_BLOCK_KEYS) {
+    if (typeof value[key2] !== "string") return null;
+  }
+  return value;
+}
+function parseOnboardingArtifact(machineText) {
+  const fencePattern = /^```([^\r\n]*)\r?\n([\s\S]*?)^```[ \t]*(?=\r?$)/gm;
+  const fences = [...machineText.matchAll(fencePattern)];
+  const jsonFenceStarts = [...machineText.matchAll(/^```[ \t]*json[ \t]*\r?$/gm)];
+  const matchedJsonFences = fences.filter((match) => match[1].trim() === "json");
+  if (jsonFenceStarts.length !== matchedJsonFences.length) return null;
+  if (fences.some((match) => match[1].trim() !== "json" && /"m8t_onboarding"\s*:/.test(match[2]))) return null;
+  let outsideFences = "";
+  let previousEnd = 0;
+  for (const fence of fences) {
+    const start = fence.index;
+    outsideFences += machineText.slice(previousEnd, start);
+    previousEnd = start + fence[0].length;
+  }
+  outsideFences += machineText.slice(previousEnd);
+  if (/"m8t_onboarding"\s*:/.test(outsideFences)) return null;
+  const artifacts = [];
+  for (const fence of matchedJsonFences) {
+    const json = fence[2].trim();
+    let parsed;
+    if (!hasValidUniqueJsonKeys(json)) {
+      if (json.includes("m8t_onboarding")) return null;
+      continue;
+    }
+    try {
+      parsed = JSON.parse(json);
+    } catch {
+      if (json.includes("m8t_onboarding")) return null;
+      continue;
+    }
+    if (!isRecord(parsed) || !Object.hasOwn(parsed, "m8t_onboarding")) continue;
+    if (Object.keys(parsed).length !== 1) return null;
+    const block = canonicalBlock(parsed.m8t_onboarding);
+    if (!block) return null;
+    const start = fence.index;
+    artifacts.push({ block, start, end: start + fence[0].length });
+  }
+  if (artifacts.length !== 1) return null;
+  const artifact = artifacts[0];
+  const before = machineText.slice(0, artifact.start).trimEnd();
+  const after = machineText.slice(artifact.end).trimStart();
+  return {
+    block: artifact.block,
+    machineText,
+    speechText: [before, after].filter((part) => part.length > 0).join("\n").trim()
+  };
+}
+var EMPTY_PROFILE_RESULT = {
+  hadIntake: false,
+  block: null,
+  machineText: null,
+  speechText: null
+};
+async function readCursorPages(args) {
+  const all = [];
+  const cursors = /* @__PURE__ */ new Set();
+  let url = args.url;
+  for (let pageNumber = 0; pageNumber < 100; pageNumber += 1) {
+    let response;
+    try {
+      response = await args.fetchImpl(url, { headers: args.headers });
+    } catch {
+      return null;
+    }
+    if (!response.ok) return null;
+    let body;
     try {
-      const o = JSON.parse(c.trim()).m8t_onboarding;
-      if (o?.company_stage && o.context) return o;
+      body = JSON.parse(await response.text());
     } catch {
+      return null;
+    }
+    if (!isRecord(body) || !Array.isArray(body.data)) return null;
+    const page = body;
+    all.push(...page.data);
+    if (page.has_more !== true) {
+      if (page.has_more === void 0 || page.has_more === false) return all;
+      return null;
     }
+    if (typeof page.last_id !== "string" || page.last_id.trim().length === 0) return null;
+    if (cursors.has(page.last_id)) return null;
+    cursors.add(page.last_id);
+    const next = new URL(url);
+    next.searchParams.set("after", page.last_id);
+    url = next.toString();
   }
   return null;
 }
-async function safeJson(res) {
+function decodeFoundryUser(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0) || !/^[A-Za-z0-9_-]+$/.test(parts[1] ?? "")) return null;
   try {
-    const t = await res.text();
-    return t ? JSON.parse(t) : null;
+    const payload = JSON.parse(Buffer.from(parts[1] ?? "", "base64url").toString("utf8"));
+    if (!isRecord(payload)) return null;
+    const claim = payload.upn ?? payload.preferred_username ?? payload.email;
+    return typeof claim === "string" && claim.trim().length > 0 ? claim : null;
   } catch {
     return null;
   }
 }
+function timestamp(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value < 1e12 ? value * 1e3 : value;
+  if (typeof value === "string") {
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : Number.NEGATIVE_INFINITY;
+  }
+  return Number.NEGATIVE_INFINITY;
+}
+function orderNewest(values) {
+  if (!values.every((value) => Number.isFinite(value.createdAt))) return values;
+  return values.sort((a, b) => b.createdAt - a.createdAt || a.ordinal - b.ordinal || b.id.localeCompare(a.id));
+}
 async function findOnboardingProfile(args) {
+  const userId = decodeFoundryUser(args.token);
+  if (!userId) return { ...EMPTY_PROFILE_RESULT };
   const doFetch = args.fetchImpl ?? fetch;
   const H = { Authorization: `Bearer ${args.token}` };
-  const listRes = await doFetch(`${args.endpoint}/conversations?api-version=v1&order=desc&limit=20`, { headers: H });
-  const list = await safeJson(listRes);
-  const convs = (list?.data ?? []).filter((c) => c.metadata?.agent === "stacey-intake");
-  for (const conv of convs) {
-    const itemsRes = await doFetch(`${args.endpoint}/conversations/${conv.id}/items?api-version=v1`, { headers: H });
-    const items = await safeJson(itemsRes);
-    const text = (items?.data ?? []).flatMap((m) => (m.content ?? []).map((c) => c.text ?? "")).join("\n");
-    const block = parseOnboardingBlock(text);
-    if (block) return { hadIntake: true, block };
-  }
-  return { hadIntake: convs.length > 0, block: null };
+  const base = args.endpoint.replace(/\/+$/, "");
+  const listed = await readCursorPages({
+    url: `${base}/openai/v1/conversations?order=desc&limit=100`,
+    headers: H,
+    fetchImpl: doFetch
+  });
+  if (!listed) return { ...EMPTY_PROFILE_RESULT };
+  const conversations = orderNewest(listed.flatMap((value, ordinal) => {
+    if (!isRecord(value) || typeof value.id !== "string" || value.id.length === 0 || !isRecord(value.metadata)) return [];
+    const metadata = value.metadata;
+    if (metadata.app !== "m8t-webapp" || metadata.agent !== "stacey-intake" || metadata.userId !== userId) return [];
+    return [{
+      id: value.id,
+      createdAt: timestamp(value.created_at) !== Number.NEGATIVE_INFINITY ? timestamp(value.created_at) : timestamp(metadata.createdAt),
+      ordinal
+    }];
+  }));
+  const conversation = conversations.at(0);
+  if (conversation === void 0) return { ...EMPTY_PROFILE_RESULT };
+  const items = await readCursorPages({
+    url: `${base}/openai/v1/conversations/${encodeURIComponent(conversation.id)}/items?order=desc&limit=100`,
+    headers: H,
+    fetchImpl: doFetch
+  });
+  if (!items) return { hadIntake: true, block: null, machineText: null, speechText: null };
+  const assistantItems = orderNewest(items.flatMap((value, ordinal) => {
+    if (!isRecord(value) || value.type !== "message" || value.role !== "assistant" || !Array.isArray(value.content)) return [];
+    const id = typeof value.id === "string" ? value.id : "";
+    return [{ value, id, createdAt: timestamp(value.created_at), ordinal }];
+  }));
+  const artifacts = [];
+  let malformedArtifact = false;
+  for (const item of assistantItems) {
+    const content = item.value.content;
+    const machineText = content.flatMap((part) => {
+      if (!isRecord(part)) return [];
+      if (typeof part.text === "string" && part.text.length > 0) return [part.text];
+      if (typeof part.transcript === "string") return [part.transcript];
+      return [];
+    }).join("\n");
+    const artifact2 = parseOnboardingArtifact(machineText);
+    if (artifact2) artifacts.push(artifact2);
+    else if (machineText.includes("m8t_onboarding")) malformedArtifact = true;
+  }
+  if (malformedArtifact || artifacts.length !== 1) {
+    return { hadIntake: true, block: null, machineText: null, speechText: null };
+  }
+  const artifact = artifacts[0];
+  return {
+    hadIntake: true,
+    block: artifact.block,
+    machineText: artifact.machineText,
+    speechText: artifact.speechText
+  };
 }
 function renderCompanyProfile(block, now = (/* @__PURE__ */ new Date()).toISOString()) {
   const dash = (v) => v?.trim() ? v.trim() : "\u2014";
@@ -26490,24 +26855,6 @@ function renderCompanyProfile(block, now = (/* @__PURE__ */ new Date()).toISOStr
   const memoryIndexLine = `- \`${COMPANY_PROFILE_PATH}\` \u2014 **Company profile**: ${bits}. (seeded from onboarding)`;
   return { profileMd, memoryIndexLine };
 }
-function companyProfileBodyEquals(a, b) {
-  const strip = (s) => s.replace(/^(created|updated):.*$/gm, "").trim();
-  return strip(a) === strip(b);
-}
-function upsertMemoryIndex(existing, line2, targetPath2 = COMPANY_PROFILE_PATH) {
-  const lines = existing.split("\n");
-  const existingIdx = lines.findIndex((l) => l.includes(`\`${targetPath2}\``));
-  if (existingIdx >= 0) {
-    lines[existingIdx] = line2;
-    return lines.join("\n");
-  }
-  const firstItemIdx = lines.findIndex((l) => /^-\s+`memory\//.test(l));
-  if (firstItemIdx >= 0) {
-    lines.splice(firstItemIdx, 0, line2);
-    return lines.join("\n");
-  }
-  return existing.replace(/\s*$/, "\n\n") + line2 + "\n";
-}
 var FOUNDER_RECORD_PATH = "memory/founder.md";
 var NOT_CAPTURED = "_not captured yet \u2014 add it anytime (run `m8t bootstrap seed-profile`, or just tell me)_";
 function renderFounderRecord(block, inputs, now = (/* @__PURE__ */ new Date()).toISOString()) {
@@ -26545,10 +26892,6 @@ function renderFounderRecord(block, inputs, now = (/* @__PURE__ */ new Date()).t
   const memoryIndexLine = `- \`${FOUNDER_RECORD_PATH}\` \u2014 **Founder & install context**: ${founderName || "founder"} \xB7 advisor ${idxAdvisor} \xB7 sub ${idxSub}. (seeded from onboarding)`;
   return { founderMd, memoryIndexLine };
 }
-function founderRecordBodyEquals(a, b) {
-  const strip = (s) => s.replace(/^(created|updated):.*$/gm, "").trim();
-  return strip(a) === strip(b);
-}
 
 // src/lib/founder-identity.ts
 function deriveEmailCandidate(raw) {
@@ -26620,6 +26963,44 @@ async function resolveSeedContext(opts) {
   const brainRepos = opts.brainOverride ? [opts.brainOverride] : [`${appCreds.org}/stacey-brain`, `${appCreds.org}/azzy-brain`];
   return { endpoint, brainRepos, appCreds, subscriptionId };
 }
+var MEMORY_INDEX_PATH = "memory/MEMORY.md";
+function normalizeFrontmatterTimestamps(markdown) {
+  const lines = markdown.split("\n");
+  if (lines[0]?.replace(/\r$/, "") !== "---") return markdown;
+  const end = lines.findIndex((line2, index) => index > 0 && line2.replace(/\r$/, "") === "---");
+  if (end < 0) return markdown;
+  return lines.map((line2, index) => {
+    if (index <= 0 || index >= end) return line2;
+    return /^(created|updated):/.test(line2) ? line2.replace(/^(created|updated):.*$/, "$1: <generated>") : line2;
+  }).join("\n");
+}
+function seededDocumentMatches(actual, expected) {
+  return actual != null && normalizeFrontmatterTimestamps(actual) === normalizeFrontmatterTimestamps(expected);
+}
+function upsertMemoryIndexOnce(existing, line2, targetPath2) {
+  const lines = existing.split("\n");
+  const kept = [];
+  let insertionIndex;
+  for (const existingLine of lines) {
+    if (existingLine.includes(`\`${targetPath2}\``)) {
+      insertionIndex ??= kept.length;
+    } else {
+      kept.push(existingLine);
+    }
+  }
+  if (insertionIndex === void 0) {
+    const firstMemoryItem = kept.findIndex((existingLine) => /^-\s+`memory\//.test(existingLine));
+    if (firstMemoryItem >= 0) {
+      insertionIndex = firstMemoryItem;
+    } else {
+      const base = kept.join("\n").replace(/\s*$/, "\n\n");
+      return `${base}${line2}
+`;
+    }
+  }
+  kept.splice(insertionIndex, 0, line2);
+  return kept.join("\n");
+}
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
@@ -26633,29 +27014,84 @@ async function applyProfileToBrain(args) {
     { subscriptionId: args.subscriptionId, azIdentity: args.azIdentity },
     args.now
   );
-  const read = (p) => readRepoFileViaApp({ token, repo: args.brainRepo, path: p, fetchImpl: args.fetchImpl });
-  const existingProfile = await read(COMPANY_PROFILE_PATH);
-  const existingFounder = await read(FOUNDER_RECORD_PATH);
-  const existingIndex = await read("memory/MEMORY.md") ?? DEFAULT_MEMORY_INDEX_HEADER;
-  let nextIndex = upsertMemoryIndex(existingIndex, companyLine, COMPANY_PROFILE_PATH);
-  nextIndex = upsertMemoryIndex(nextIndex, founderLine, FOUNDER_RECORD_PATH);
-  const profileSame = existingProfile != null && companyProfileBodyEquals(existingProfile, profileMd);
-  const founderSame = existingFounder != null && founderRecordBodyEquals(existingFounder, founderMd);
-  if (profileSame && founderSame && nextIndex === existingIndex) {
-    return;
-  }
-  await commitFilesViaApp({
+  const read = (p) => readRepoFileViaApp({
     token,
     repo: args.brainRepo,
-    branch: args.branch,
-    message: "seed(brain): founder + company profile from onboarding",
-    files: [
-      { path: COMPANY_PROFILE_PATH, content: profileMd },
-      { path: FOUNDER_RECORD_PATH, content: founderMd },
-      { path: "memory/MEMORY.md", content: nextIndex }
-    ],
+    path: p,
+    ref: args.branch,
     fetchImpl: args.fetchImpl
   });
+  const existingProfile = await read(COMPANY_PROFILE_PATH);
+  const existingFounder = await read(FOUNDER_RECORD_PATH);
+  const existingIndex = await read(MEMORY_INDEX_PATH) ?? DEFAULT_MEMORY_INDEX_HEADER;
+  let nextIndex = upsertMemoryIndexOnce(existingIndex, companyLine, COMPANY_PROFILE_PATH);
+  nextIndex = upsertMemoryIndexOnce(nextIndex, founderLine, FOUNDER_RECORD_PATH);
+  const files = [
+    ...!seededDocumentMatches(existingProfile, profileMd) ? [{ path: COMPANY_PROFILE_PATH, content: profileMd }] : [],
+    ...!seededDocumentMatches(existingFounder, founderMd) ? [{ path: FOUNDER_RECORD_PATH, content: founderMd }] : [],
+    ...nextIndex !== existingIndex ? [{ path: MEMORY_INDEX_PATH, content: nextIndex }] : []
+  ];
+  if (files.length > 0) {
+    await commitFilesViaApp({
+      token,
+      repo: args.brainRepo,
+      branch: args.branch,
+      message: "seed(brain): founder + company profile from onboarding",
+      files,
+      fetchImpl: args.fetchImpl
+    });
+    const [verifiedProfile, verifiedFounder, verifiedIndex] = await Promise.all([
+      read(COMPANY_PROFILE_PATH),
+      read(FOUNDER_RECORD_PATH),
+      read(MEMORY_INDEX_PATH)
+    ]);
+    const mismatches = [
+      ...!seededDocumentMatches(verifiedProfile, profileMd) ? [COMPANY_PROFILE_PATH] : [],
+      ...!seededDocumentMatches(verifiedFounder, founderMd) ? [FOUNDER_RECORD_PATH] : [],
+      ...verifiedIndex !== nextIndex ? [MEMORY_INDEX_PATH] : []
+    ];
+    if (mismatches.length > 0) {
+      throw new LocalCliError({
+        code: "SEED_PROFILE_READBACK_FAILED",
+        message: `Profile write could not be verified in ${args.brainRepo}: ${mismatches.join(", ")}.`,
+        hint: "Re-run 'm8t bootstrap seed-profile'; verified files will be left unchanged."
+      });
+    }
+  }
+}
+async function applyProfileToBrains(args) {
+  const brainRepos = [...new Set(args.brainRepos)];
+  if (brainRepos.length === 0) {
+    throw new LocalCliError({
+      code: "SEED_PROFILE_INCOMPLETE",
+      message: "Profile seeding is incomplete: no brain repositories were resolved.",
+      hint: "Re-run 'm8t bootstrap seed-profile' after the Stacey and Azzy brains are provisioned."
+    });
+  }
+  const settled = await Promise.allSettled(brainRepos.map(async (brainRepo) => {
+    await applyProfileToBrain({ ...args, brainRepo });
+    return brainRepo;
+  }));
+  const verified = [];
+  const failed = [];
+  const causes = [];
+  settled.forEach((result, index) => {
+    const brainRepo = brainRepos[index];
+    if (result.status === "fulfilled") {
+      verified.push(brainRepo);
+    } else {
+      failed.push(brainRepo);
+      causes.push(result.reason);
+    }
+  });
+  if (failed.length > 0 || verified.length !== brainRepos.length) {
+    throw new LocalCliError({
+      code: "SEED_PROFILE_INCOMPLETE",
+      message: `Profile seeding is incomplete: verified ${verified.join(", ") || "none"}; failed ${failed.join(", ") || "none"}.`,
+      hint: "Re-run 'm8t bootstrap seed-profile'; verified brain files will be skipped and missing files repaired.",
+      cause: new AggregateError(causes, "One or more brain profile writes failed verification.")
+    });
+  }
 }
 function spawnDetachedSeedWatch() {
   const logPath = path33.join(os15.homedir(), ".m8t", "seed-profile.log");
@@ -26677,17 +27113,15 @@ async function reactiveSeedOnFinish(args) {
   const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token, fetchImpl: args.fetchImpl });
   if (block) {
     const azIdentity = args.azIdentity ?? await (args.getSignedInUserIdentityImpl ?? getSignedInUserIdentity)();
-    for (const brainRepo of ctx.brainRepos) {
-      await applyProfileToBrain({
-        block,
-        brainRepo,
-        branch: "main",
-        appCreds: ctx.appCreds,
-        subscriptionId: ctx.subscriptionId,
-        azIdentity,
-        fetchImpl: args.fetchImpl
-      });
-    }
+    await applyProfileToBrains({
+      block,
+      brainRepos: ctx.brainRepos,
+      branch: "main",
+      appCreds: ctx.appCreds,
+      subscriptionId: ctx.subscriptionId,
+      azIdentity,
+      fetchImpl: args.fetchImpl
+    });
     args.stdout(`${colors.success("\u2713")} Your advisors now know your company + how to reach you (seeded ${ctx.brainRepos.join(", ")}).
 `);
     return;
@@ -26854,6 +27288,7 @@ import * as fs32 from "fs";
 import * as net from "net";
 import * as os17 from "os";
 import * as path35 from "path";
+import { randomBytes as randomBytes3 } from "crypto";
 import { spawn as spawn7, spawnSync as spawnSync6 } from "child_process";
 init_errors();
 init_rbac();
@@ -27018,9 +27453,19 @@ async function ensureFounderFoundryRole(args) {
 }
 function writeWebEnvLocal(args) {
   const envPath = path35.join(args.repoRoot, "apps", "web", ".env.local");
+  let prior = "";
   if (fs32.existsSync(envPath)) {
+    prior = fs32.readFileSync(envPath, "utf8");
     fs32.copyFileSync(envPath, envPath + ".bak");
   }
+  const priorSecret = readValidInternalSecret(prior);
+  const internalSecret = priorSecret ?? (args.randomBytesImpl ?? randomBytes3)(32).toString("base64url");
+  if (!isValidInternalSecret(internalSecret)) {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_UI_INTERNAL_SECRET_GENERATION_FAILED",
+      message: "Could not generate a valid local internal service secret."
+    });
+  }
   const body = [
     "# Written by `m8t bootstrap ui` \u2014 onboarding chat-only run (Simple Stacey).",
     "# STORAGE unset \u2192 gateway boot skipped; the webapp forwards your MSAL token to Foundry.",
@@ -27029,14 +27474,47 @@ function writeWebEnvLocal(args) {
     `FOUNDRY_PROJECT_ENDPOINT=${args.foundryEndpoint}`,
     "VOICE_RELAY_PUBLIC_URL=ws://localhost:8790",
     "STORAGE_ACCOUNT_NAME=",
+    `M8T_INTERNAL_SECRET=${internalSecret}`,
+    "M8T_SINGLE_GATEWAY_PROCESS=1",
     "M8T_DISABLE_WORKER=1",
     "M8T_ONBOARDING=1",
     "NEXT_PUBLIC_M8T_ONBOARDING=1",
     ""
   ].join("\n");
-  fs32.writeFileSync(envPath, body, "utf8");
+  fs32.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
+  try {
+    fs32.chmodSync(envPath, 384);
+  } catch {
+  }
   return envPath;
 }
+function isValidInternalSecret(value) {
+  if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value)) return false;
+  const decoded = Buffer.from(value, "base64url");
+  return decoded.length === 32 && decoded.toString("base64url") === value;
+}
+function readValidInternalSecret(envText) {
+  const values = envText.split(/\r?\n/).filter((line2) => line2.startsWith("M8T_INTERNAL_SECRET=")).map((line2) => line2.slice("M8T_INTERNAL_SECRET=".length));
+  if (values.length !== 1) return void 0;
+  return isValidInternalSecret(values[0]) ? values[0] : void 0;
+}
+function readWebInternalSecret(repoRoot) {
+  const envPath = path35.join(repoRoot, "apps", "web", ".env.local");
+  let secret;
+  try {
+    secret = readValidInternalSecret(fs32.readFileSync(envPath, "utf8"));
+  } catch {
+    secret = void 0;
+  }
+  if (!secret) {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_UI_INTERNAL_SECRET_MISSING",
+      message: "The local web environment has no valid internal service secret.",
+      hint: "Re-run 'm8t bootstrap ui' so the web app and voice relay receive the same secret."
+    });
+  }
+  return secret;
+}
 function assertNodeVersion(versionString = process.version) {
   const major = Number(/^v?(\d+)\./.exec(versionString)?.[1] ?? "0");
   if (major < 20) {
@@ -27106,20 +27584,67 @@ function isLocalPortOpen(port) {
     });
   });
 }
+function removePidFile(pidPath) {
+  try {
+    fs32.unlinkSync(pidPath);
+  } catch {
+  }
+}
+function parseManagedPid(text) {
+  if (!/^[1-9]\d*$/.test(text)) return null;
+  const pid = Number(text);
+  if (!Number.isSafeInteger(pid) || pid < 2 || pid === process.pid || pid === process.ppid) return null;
+  return pid;
+}
+function readLiveManagedPid(pidPath) {
+  let text;
+  try {
+    text = fs32.readFileSync(pidPath, "utf8").trim();
+  } catch {
+    return null;
+  }
+  const pid = parseManagedPid(text);
+  if (pid == null) {
+    removePidFile(pidPath);
+    return null;
+  }
+  try {
+    process.kill(pid, 0);
+    return pid;
+  } catch (error) {
+    const code = error.code;
+    if (code === "ESRCH") {
+      removePidFile(pidPath);
+      return null;
+    }
+    if (code === "EPERM") return pid;
+    throw error;
+  }
+}
 async function serveOnboardingUiDetached(args) {
   const { logPath, pidPath } = onboardingUiPaths();
   const portNum = Number(args.port);
   const isPortOpen = () => isLocalPortOpen(portNum);
-  if (await isPortOpen()) {
+  const portOpen = await isPortOpen();
+  const managedPid = readLiveManagedPid(pidPath);
+  if (portOpen && managedPid != null) {
     return { alreadyRunning: true, logPath };
   }
+  if (portOpen) {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_UI_PORT_IN_USE",
+      message: `Port ${args.port} is occupied by a process not started by m8t bootstrap.`,
+      hint: `Stop the process using port ${args.port}, then re-run 'm8t bootstrap ui'.`
+    });
+  }
+  if (managedPid != null) return { alreadyRunning: true, logPath };
   fs32.mkdirSync(path35.dirname(logPath), { recursive: true });
   const fd = fs32.openSync(logPath, "a");
   const child = spawn7("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
     detached: true,
     stdio: ["ignore", fd, fd],
-    env: { ...process.env, PORT: args.port },
+    env: { ...process.env, PORT: args.port, M8T_SINGLE_GATEWAY_PROCESS: "1" },
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
   });
@@ -27144,9 +27669,26 @@ async function serveOnboardingUiDetached(args) {
 async function serveOnboardingRelayDetached(args) {
   const { logPath, pidPath } = onboardingRelayPaths();
   const portNum = 8790;
-  if (await isLocalPortOpen(portNum)) {
+  if (args.webInternalBaseUrl !== "http://localhost:3000") {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_UI_INTERNAL_BASE_URL_INVALID",
+      message: "The local voice relay internal base URL must be http://localhost:3000."
+    });
+  }
+  const internalSecret = readWebInternalSecret(args.repoRoot);
+  const portOpen = await isLocalPortOpen(portNum);
+  const managedPid = readLiveManagedPid(pidPath);
+  if (portOpen && managedPid != null) {
     return { alreadyRunning: true, logPath };
   }
+  if (portOpen) {
+    throw new LocalCliError({
+      code: "BOOTSTRAP_UI_RELAY_PORT_IN_USE",
+      message: "Port 8790 is occupied by a process not started by m8t bootstrap.",
+      hint: "Stop the process using port 8790, then re-run 'm8t bootstrap ui'."
+    });
+  }
+  if (managedPid != null) return { alreadyRunning: true, logPath };
   fs32.mkdirSync(path35.dirname(logPath), { recursive: true });
   const fd = fs32.openSync(logPath, "a");
   const child = spawn7("pnpm", ["--filter", "web", "exec", "tsx", "voice-relay-entry.ts"], {
@@ -27159,7 +27701,9 @@ async function serveOnboardingRelayDetached(args) {
       AZURE_TENANT_ID: args.tenantId,
       AZURE_CLIENT_ID: args.clientId,
       RELAY_ALLOWED_ORIGINS: "http://localhost:3000",
-      RELAY_PORT: "8790"
+      RELAY_PORT: "8790",
+      M8T_INTERNAL_SECRET: internalSecret,
+      WEB_INTERNAL_BASE_URL: args.webInternalBaseUrl
     },
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
@@ -27199,8 +27743,8 @@ function stopPidFile(pidPath) {
   } catch {
     return false;
   }
-  const pid = Number(pidStr);
-  if (!Number.isNaN(pid) && pid > 0) {
+  const pid = parseManagedPid(pidStr);
+  if (pid != null) {
     if (process.platform === "win32") {
       spawnSync6("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
     } else {
@@ -27353,7 +27897,8 @@ var BootstrapUiCommand = class extends M8tCommand {
         repoRoot,
         foundryEndpoint: endpoint,
         tenantId: account.tenantId,
-        clientId: state.appRegClientId
+        clientId: state.appRegClientId,
+        webInternalBaseUrl: "http://localhost:3000"
       });
       out("voice relay on :8790");
       const outcome2 = await deployOutcome;
@@ -27371,7 +27916,8 @@ var BootstrapUiCommand = class extends M8tCommand {
       repoRoot,
       foundryEndpoint: endpoint,
       tenantId: account.tenantId,
-      clientId: state.appRegClientId
+      clientId: state.appRegClientId,
+      webInternalBaseUrl: "http://localhost:3000"
     });
     out("voice relay on :8790");
     out("starting the webapp on :3000 in the background\u2026");
@@ -27438,9 +27984,14 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       const { hadIntake, block } = await findOnboardingProfile({ endpoint: ctx.endpoint, token });
       if (block) {
         const azIdentity = await getSignedInUserIdentity();
-        for (const brainRepo of ctx.brainRepos) {
-          await applyProfileToBrain({ block, brainRepo, branch: "main", appCreds: ctx.appCreds, subscriptionId: ctx.subscriptionId, azIdentity });
-        }
+        await applyProfileToBrains({
+          block,
+          brainRepos: ctx.brainRepos,
+          branch: "main",
+          appCreds: ctx.appCreds,
+          subscriptionId: ctx.subscriptionId,
+          azIdentity
+        });
         this.context.stdout.write(`${colors.success("\u2713")} seeded your advisors' brains (${ctx.brainRepos.join(", ")}) from your questionnaire.
 `);
         return 0;