@openpalm/ui 0.11.0 → 0.11.2-rc.1

package/build/server/chunks/{src-D9YnoOnU.js → src-DJv-Q_k2.js}

@@ -1,5 +1,5 @@
 import { _ as __commonJSMin, b as __require } from './chunk-CLZ62Ad-.js';
-import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, readdirSync, writeFileSync, renameSync, rmSync, statSync, cpSync, lstatSync, openSync, constants, writeSync, closeSync, realpathSync } from 'node:fs';
+import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, readdirSync, writeFileSync, renameSync, rmSync, statSync, cpSync, lstatSync, openSync, constants, writeSync, closeSync, chownSync, realpathSync } from 'node:fs';
 import or, { basename, dirname, resolve, join, win32, posix } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import { homedir, tmpdir } from 'node:os';
@@ -6864,7 +6864,7 @@ function ensureHomeDirs() {
 * On any unexpected error (permissions, ENOSPC, etc.) we return null so the
 * caller surfaces "install_in_progress" rather than silently fake-acquiring.
 */
-var logger$8 = createLogger("install-lock");
+var logger$10 = createLogger("install-lock");
 var STALE_AFTER_MS = 1800 * 1e3;
 function isProcessAlive(pid) {
 	try {
@@ -6931,7 +6931,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		mkdirSync(dataDir, { recursive: true });
 	} catch (err) {
-		logger$8.warn("failed to ensure data dir for install lock", {
+		logger$10.warn("failed to ensure data dir for install lock", {
 			dataDir,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -6941,18 +6941,18 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$8.warn("unexpected error acquiring install lock", {
+		logger$10.warn("unexpected error acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
 		return null;
 	}
 	if (!isStale(path)) return null;
-	logger$8.info("removing stale install lock and retrying acquire", { path });
+	logger$10.info("removing stale install lock and retrying acquire", { path });
 	try {
 		rmSync(path, { force: true });
 	} catch (err) {
-		logger$8.warn("failed to remove stale install lock", {
+		logger$10.warn("failed to remove stale install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -6961,7 +6961,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$8.warn("unexpected error re-acquiring install lock", {
+		logger$10.warn("unexpected error re-acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -6974,7 +6974,7 @@ function releaseInstallLock(handle) {
 	try {
 		rmSync(handle.path, { force: true });
 	} catch (err) {
-		logger$8.warn("failed to release install lock", {
+		logger$10.warn("failed to release install lock", {
 			path: handle.path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -10665,7 +10665,7 @@ var yo = (s) => {
 *   4. null → remote download (the UI build from the @openpalm/ui npm registry
 *      tarball; the .openpalm skeleton from the GitHub repo tarball)
 */
-var logger$7 = createLogger("lib:ui-assets");
+var logger$9 = createLogger("lib:ui-assets");
 async function fetchWithRetry(url, retries = 3) {
 	for (let i = 0; i < retries; i++) try {
 		const res = await fetch(url, { signal: AbortSignal.timeout(6e4) });
@@ -10761,7 +10761,7 @@ async function downloadNpmUiBundle(manifest, uiDir, dataDir) {
 	const data = new Uint8Array(await res.arrayBuffer());
 	if (!manifest.integrity) throw new Error(`npm manifest for ${UI_PACKAGE}@${manifest.version} has no integrity hash — refusing to install unverified`);
 	verifyNpmIntegrity(data, manifest.integrity);
-	logger$7.debug("UI bundle integrity verified", { version: manifest.version });
+	logger$9.debug("UI bundle integrity verified", { version: manifest.version });
 	const tmpTar = join(dataDir, ".ui-build.tgz.tmp");
 	const staging = join(dataDir, ".ui-build.staging");
 	try {
@@ -10804,7 +10804,7 @@ async function seedUiBuild(repoRef, dataDir, options) {
 	const uiDir = join(dataDir, "ui");
 	mkdirSync(uiDir, { recursive: true });
 	const manifest = await fetchNpmUiManifest(toNpmVersion(repoRef));
-	logger$7.debug("downloading UI build from npm", { version: manifest.version });
+	logger$9.debug("downloading UI build from npm", { version: manifest.version });
 	await downloadNpmUiBundle(manifest, uiDir, dataDir);
 }
 //#endregion
@@ -10925,7 +10925,7 @@ function removeSecretFile(stackDir, name) {
 //#region ../lib/src/control-plane/secrets.ts
 /** Secrets and capability key management. */
 var OPENCODE_STARTER_CONFIG = JSON.stringify({ $schema: "https://opencode.ai/config.json" }, null, 2) + "\n";
-var logger$6 = createLogger("secrets");
+var logger$8 = createLogger("secrets");
 var VAULT_DIR_MODE = 448;
 var VAULT_FILE_MODE = 384;
 var SECRET_ENV_KEY_RE = /(?:^OP_UI_LOGIN_PASSWORD$|^OP_OPENCODE_PASSWORD$|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$)/;
@@ -10945,7 +10945,7 @@ function enforceVaultDirMode(vaultDir) {
 	try {
 		chmodSync(vaultDir, VAULT_DIR_MODE);
 	} catch (error) {
-		logger$6.warn("failed to enforce vault directory permissions", {
+		logger$8.warn("failed to enforce vault directory permissions", {
 			vaultDir,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -10956,7 +10956,7 @@ function writeVaultFile(path, content) {
 	try {
 		chmodSync(path, VAULT_FILE_MODE);
 	} catch (error) {
-		logger$6.warn("failed to enforce vault file permissions", {
+		logger$8.warn("failed to enforce vault file permissions", {
 			path,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -11021,7 +11021,7 @@ function ensureAuthJson(state) {
 			return;
 		}
 	} catch (error) {
-		logger$6.warn("failed to repair auth.json path", {
+		logger$8.warn("failed to repair auth.json path", {
 			path: authJsonPath$1,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -11064,12 +11064,12 @@ function writeAuthJsonProviderKeys(state, providerKeys) {
 		const corruptPath = `${authJsonPath$2}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
 		try {
 			renameSync(authJsonPath$2, corruptPath);
-			logger$6.warn("corrupt auth.json renamed for recovery", {
+			logger$8.warn("corrupt auth.json renamed for recovery", {
 				original: authJsonPath$2,
 				renamed: corruptPath
 			});
 		} catch (renameErr) {
-			logger$6.warn("could not rename corrupt auth.json; starting fresh", {
+			logger$8.warn("could not rename corrupt auth.json; starting fresh", {
 				path: authJsonPath$2,
 				error: renameErr instanceof Error ? renameErr.message : String(renameErr)
 			});
@@ -11301,6 +11301,7 @@ async function refreshCoreAssets(version) {
 * the rollback module (snapshot to OP_HOME/data/rollback/).
 */
 var DEFAULT_IMAGE_TAG = "latest";
+var logger$7 = createLogger("config-persistence");
 /**
 * Return the env files used for docker compose --env-file args.
 *
@@ -11437,6 +11438,7 @@ function ensureChannelSecret(stackDir, addon) {
 function ensureComposeVolumeTargets(state) {
 	const composeFiles = discoverStackOverlays(state.stackDir, state.homeDir);
 	if (composeFiles.length === 0) return;
+	const operatorIds = resolveOperatorIds(state.homeDir);
 	const envVars = {
 		...process.env,
 		...parseEnvFile(`${state.stashDir}/env/stack.env`)
@@ -11464,13 +11466,36 @@ function ensureComposeVolumeTargets(state) {
 				if (!resolvedHostPath.startsWith(`${homeRoot}/`) && resolvedHostPath !== homeRoot) continue;
 				if (existsSync(resolvedHostPath)) continue;
 				if ((resolvedHostPath.split("/").pop() ?? "").includes(".")) {
-					mkdirSync(dirname(resolvedHostPath), { recursive: true });
+					const parent = dirname(resolvedHostPath);
+					mkdirSync(parent, { recursive: true });
 					writeFileSync(resolvedHostPath, "");
-				} else mkdirSync(resolvedHostPath, { recursive: true });
+					chownVolumeTarget(parent, operatorIds);
+					chownVolumeTarget(resolvedHostPath, operatorIds);
+				} else {
+					mkdirSync(resolvedHostPath, { recursive: true });
+					chownVolumeTarget(resolvedHostPath, operatorIds);
+				}
 			}
 		}
 	}
 }
+/**
+* chown a just-created bind-mount target to the operator UID/GID so the
+* non-root container (`user: ${OP_UID}:${OP_GID}`) can write to it.
+*
+* No-op on Windows (chown is meaningless there) or when no operator can be
+* resolved. A failure (e.g. not the owner) is logged and swallowed — the
+* mkdir already succeeded and Docker Desktop's gRPC-FUSE masks ownership
+* anyway, so a chown failure must not abort the install.
+*/
+function chownVolumeTarget(path, operatorIds) {
+	if (process.platform === "win32" || !operatorIds) return;
+	try {
+		chownSync(path, operatorIds.uid, operatorIds.gid);
+	} catch (error) {
+		logger$7.warn(`Could not chown volume target ${path} to ${operatorIds.uid}:${operatorIds.gid}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
 function writeRuntimeFiles(state) {
 	mkdirSync(state.stackDir, { recursive: true });
 	const composePath = `${state.stackDir}/core.compose.yml`;
@@ -11527,7 +11552,7 @@ function canonicalAddonProfileSelection(addon, profile) {
 * the runtime source of truth.
 */
 var VALID_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
-var logger$5 = createLogger("registry");
+var logger$6 = createLogger("registry");
 var BUILTIN_ADDONS = [
 	"api",
 	"chat",
@@ -11728,7 +11753,7 @@ function readAddonServiceNamesFromContent(composeContent, composePath, addonName
 			return Array.isArray(profiles) && profiles.some((p) => typeof p === "string" && p.startsWith(`addon.${addonName}`));
 		}).map(([serviceName]) => serviceName);
 	} catch (error) {
-		logger$5.warn("failed to parse addon compose services", {
+		logger$6.warn("failed to parse addon compose services", {
 			composePath,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -11895,7 +11920,7 @@ function readAddonProfilesFromContent(composeContent, composePath) {
 	try {
 		parsed = (0, import_dist.parse)(composeContent);
 	} catch (error) {
-		logger$5.warn("failed to parse addon compose profiles", {
+		logger$6.warn("failed to parse addon compose profiles", {
 			composePath,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -12059,6 +12084,7 @@ function setAddonEnabled(homeDir, stackDir, name, enabled, state) {
 			"discord",
 			"slack"
 		]) ensureChannelSecret(stackDir, channel);
+		if (state) ensureComposeVolumeTargets(state);
 	}
 	return {
 		ok: true,
@@ -12594,7 +12620,7 @@ function importHostProfiles(state, hostConfigPath) {
 * We never write into the user's personal ~/.config/akm here. (Letting the host
 * akm see OpenPalm's knowledge is a future, explicit opt-in.)
 */
-var logger$4 = createLogger("host-akm-sharing");
+var logger$5 = createLogger("host-akm-sharing");
 var ENV_KEY = "OP_HOST_AKM_STASH";
 function userHome() {
 	return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
@@ -12636,7 +12662,7 @@ function enableHostAkmSharing(state, opts = {}) {
 	addHostStashToOpenpalmConfig(state, opts.writable ?? true);
 	let profilesImported = [];
 	if (opts.importProfiles) profilesImported = importHostProfiles(state, hostAkmConfigPath()).imported;
-	logger$4.info("host akm sharing enabled", {
+	logger$5.info("host akm sharing enabled", {
 		hostStashPath: hostAkmStashPath(),
 		profilesImported
 	});
@@ -12649,7 +12675,7 @@ function enableHostAkmSharing(state, opts = {}) {
 */
 function disableHostAkmSharing(state) {
 	removeHostAkmSource(state);
-	logger$4.info("host akm sharing disabled");
+	logger$5.info("host akm sharing disabled");
 }
 /** Report availability + whether the host-akm source is currently configured. */
 function getHostAkmSharingStatus(state) {
@@ -12870,7 +12896,7 @@ async function validateProposedState(state) {
 	};
 }
 /** Execute docker with an argument array — no shell interpolation. */
-function run(args, cwd, timeoutMs = 12e4, envOverrides) {
+function run$1(args, cwd, timeoutMs = 12e4, envOverrides) {
 	return new Promise((resolve) => {
 		execFile("docker", args, {
 			cwd,
@@ -12896,6 +12922,66 @@ function run(args, cwd, timeoutMs = 12e4, envOverrides) {
 function resolveComposeProjectName(envOverrides = {}) {
 	return envOverrides.OP_PROJECT_NAME?.trim() || envOverrides.COMPOSE_PROJECT_NAME?.trim() || process.env.OP_PROJECT_NAME?.trim() || process.env.COMPOSE_PROJECT_NAME?.trim() || "openpalm";
 }
+/**
+* Decide whether a running compose project (identified by its
+* `com.docker.compose.project.working_dir` label) is OURS — i.e. was launched
+* from this install's working dir. An empty/unknown label can't prove foreign,
+* so it counts as ours (reconcile rather than wrongly refuse a redeploy).
+*
+* Pure decision split out from detectExistingProject so the ours-vs-foreign
+* rule is unit-testable without a Docker daemon.
+*/
+function isProjectOurs(workingDirLabel, expectedWorkingDir) {
+	const label = workingDirLabel.trim();
+	return label === "" || label === expectedWorkingDir;
+}
+/**
+* Probe the Docker daemon for a running compose project that shares
+* `projectName`. Decides ours-vs-foreign by comparing the project's
+* `com.docker.compose.project.working_dir` label against `expectedWorkingDir`
+* (the install's OP_HOME / compose context).
+*
+* Returns `{ exists:false }` on any docker error (daemon down, no permission) —
+* detection is best-effort and never blocks the caller; a real failure surfaces
+* later through composeUp.
+*/
+function detectExistingProject(opts) {
+	const none = {
+		exists: false,
+		isOurs: false,
+		workingDir: ""
+	};
+	return new Promise((resolve) => {
+		execFile("docker", [
+			"ps",
+			"-q",
+			"--filter",
+			`label=com.docker.compose.project=${opts.projectName}`
+		], { timeout: 1e4 }, (err, stdout) => {
+			if (err) return resolve(none);
+			const ids = stdout.toString().trim().split(/\s+/).filter(Boolean);
+			if (ids.length === 0) return resolve(none);
+			execFile("docker", [
+				"inspect",
+				"--format",
+				"{{ index .Config.Labels \"com.docker.compose.project.working_dir\" }}",
+				ids[0]
+			], { timeout: 1e4 }, (err2, stdout2) => {
+				if (err2) return resolve({
+					exists: true,
+					isOurs: false,
+					workingDir: ""
+				});
+				const workingDir = stdout2.toString().trim();
+				resolve({
+					exists: true,
+					isOurs: isProjectOurs(workingDir, opts.expectedWorkingDir),
+					workingDir
+				});
+			});
+		});
+	});
+}
 /** Check if Docker is available */
 async function checkDocker() {
 	return new Promise((resolve) => {
@@ -12954,7 +13040,7 @@ function collectEnvOverrides(envFiles) {
 async function composePreflight(options) {
 	const args = buildComposeArgs(options);
 	args.push("config", "--quiet");
-	return run(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
+	return run$1(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
 }
 /**
 * Run compose config preflight validation before any mutation.
@@ -12974,7 +13060,7 @@ async function runPreflight(options) {
 async function composeConfigServices(options) {
 	const args = buildComposeArgs(options);
 	args.push("config", "--services");
-	const result = await run(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
+	const result = await run$1(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
 	if (!result.ok) return {
 		ok: false,
 		services: []
@@ -13001,7 +13087,20 @@ async function composeUp(options) {
 	if (options.forceRecreate) args.push("--force-recreate");
 	if (options.removeOrphans) args.push("--remove-orphans");
 	if (options.services?.length) args.push(...options.services);
-	return run(args, void 0, 3e5, collectEnvOverrides(options.envFiles));
+	return run$1(args, void 0, composeUpTimeoutMs(), collectEnvOverrides(options.envFiles));
+}
+/**
+* Timeout budget for `compose up`. A first install extracts multi-GB images
+* (voice CUDA ~7.6 GB) onto slow disks; the previous hard 5-minute cap
+* SIGTERM-killed the start mid-extraction and surfaced as an empty/opaque
+* error. Default 30 min, override with OP_COMPOSE_UP_TIMEOUT_MS. Kept bounded
+* (never removed) so a genuinely hung start still eventually fails.
+*/
+function composeUpTimeoutMs() {
+	const raw = process.env.OP_COMPOSE_UP_TIMEOUT_MS?.trim();
+	const parsed = raw ? Number(raw) : NaN;
+	if (Number.isFinite(parsed) && parsed > 0) return parsed;
+	return 30 * 6e4;
 }
 /**
 * Run `docker compose down` to stop and remove containers.
@@ -13017,7 +13116,7 @@ async function composeDown(options) {
 	const args = buildComposeArgs(options);
 	args.push("down");
 	if (options.removeVolumes) args.push("-v");
-	return run(args, void 0);
+	return run$1(args, void 0);
 }
 /**
 * Restart specific services.
@@ -13033,7 +13132,7 @@ async function composeRestart(services, options) {
 	};
 	const args = buildComposeArgs(options);
 	args.push("restart", ...services);
-	return run(args, void 0);
+	return run$1(args, void 0);
 }
 /**
 * Stop specific services.
@@ -13042,7 +13141,7 @@ async function composeStop(services, options) {
 	await runPreflight(options);
 	const args = buildComposeArgs(options);
 	args.push("stop", ...services);
-	return run(args, void 0);
+	return run$1(args, void 0);
 }
 /**
 * Start specific services (must already be created).
@@ -13051,14 +13150,14 @@ async function composeStart(services, options) {
 	await runPreflight(options);
 	const args = buildComposeArgs(options);
 	args.push("up", "-d", ...services);
-	return run(args, void 0);
+	return run$1(args, void 0);
 }
 /**
 * Get the status of all containers in the project.
 */
 async function composePs(options) {
 	const primaryFile = options.files[0];
-	if (!existsSync(primaryFile)) return run([
+	if (!existsSync(primaryFile)) return run$1([
 		"ps",
 		"--filter",
 		`label=com.docker.compose.project=${resolveComposeProjectName()}`,
@@ -13067,7 +13166,7 @@ async function composePs(options) {
 	], void 0);
 	const args = buildComposeArgs(options);
 	args.push("ps", "--format", "json");
-	return run(args, void 0);
+	return run$1(args, void 0);
 }
 /**
 * Get logs for specific services or all services.
@@ -13077,14 +13176,14 @@ async function composeLogs(services, tail, options) {
 	args.push("logs", "--tail", String(tail));
 	if (options.since) args.push("--since", options.since);
 	if (services && services.length > 0) args.push(...services);
-	return run(args, void 0);
+	return run$1(args, void 0);
 }
 var PULL_TIMEOUT_MS = 60 * 6e4;
 async function composePull(options) {
 	await runPreflight(options);
 	const args = buildComposeArgs(options);
 	args.push("pull");
-	return run(args, void 0, PULL_TIMEOUT_MS, collectEnvOverrides(options.envFiles));
+	return run$1(args, void 0, PULL_TIMEOUT_MS, collectEnvOverrides(options.envFiles));
 }
 /**
 * Get resource usage stats for all containers in the project.
@@ -13092,13 +13191,13 @@ async function composePull(options) {
 async function composeStats(options) {
 	const args = buildComposeArgs(options);
 	args.push("stats", "--no-stream", "--format", "json");
-	return run(args, void 0);
+	return run$1(args, void 0);
 }
 /**
 * Get recent Docker events for the compose project.
 */
 async function getDockerEvents(projectName, since = "1h") {
-	return run([
+	return run$1([
 		"events",
 		"--filter",
 		`label=com.docker.compose.project=${projectName}`,
@@ -13249,10 +13348,23 @@ function resolveNewestDockerTag(payload) {
 	}
 	return fallback;
 }
-async function updateStackEnvToLatestImageTag(state) {
-	const systemEnvPath = `${state.stashDir}/env/stack.env`;
-	const namespace = (parseEnvFile(systemEnvPath).OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim().toLowerCase();
+function resolveImageNamespace(state) {
+	const namespace = (parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim().toLowerCase();
 	if (!IMAGE_NAMESPACE_RE.test(namespace)) throw new Error(`Invalid image namespace in system.env: ${namespace}`);
+	return namespace;
+}
+/**
+* Resolve the newest published platform tag from the Docker registry.
+*
+* `assistant` is the version-of-record image: all platform images
+* (assistant, guardian, channel, voice) are published in lockstep under the
+* same OP_IMAGE_TAG, so its newest tag is the canonical platform version.
+*
+* Used both to auto-detect during "Update now" and to resolve a requested
+* `latest` selection into a concrete release tag before fetching stack assets
+* (GitHub has no asset tree at a `latest` ref).
+*/
+async function resolveLatestPlatformTag(namespace) {
 	let response;
 	try {
 		response = await fetch(`https://registry.hub.docker.com/v2/repositories/${namespace}/assistant/tags?page_size=25&ordering=last_updated`, { headers: { Accept: "application/json" } });
@@ -13262,6 +13374,12 @@ async function updateStackEnvToLatestImageTag(state) {
 	if (!response.ok) throw new Error(`Docker tag lookup failed (${response.status})`);
 	const latestTag = resolveNewestDockerTag(await response.json());
 	if (!latestTag) throw new Error("No usable Docker image tag found");
+	return latestTag;
+}
+async function updateStackEnvToLatestImageTag(state) {
+	const systemEnvPath = `${state.stashDir}/env/stack.env`;
+	const namespace = resolveImageNamespace(state);
+	const latestTag = await resolveLatestPlatformTag(namespace);
 	writeFileSync(systemEnvPath, mergeEnvContent(existsSync(systemEnvPath) ? readFileSync(systemEnvPath, "utf-8") : "", { OP_IMAGE_TAG: latestTag }, { uncomment: true }));
 	return {
 		namespace,
@@ -13315,6 +13433,7 @@ async function performUpgrade(state) {
 	const upResult = await composeUp({
 		...composeOpts,
 		services,
+		forceRecreate: true,
 		removeOrphans: true
 	});
 	if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
@@ -13331,12 +13450,21 @@ async function performUpgrade(state) {
 * Used by the admin "set version" action — skips the auto-detect step in performUpgrade.
 */
 async function applyTagChange(state, tag) {
+	const namespace = resolveImageNamespace(state);
+	const requested = tag.trim();
+	let resolvedTag = requested;
+	if (requested === "" || requested.toLowerCase() === "latest") try {
+		resolvedTag = await resolveLatestPlatformTag(namespace);
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
+	}
 	const stackEnvPath = `${state.stashDir}/env/stack.env`;
-	writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", { OP_IMAGE_TAG: tag }, { uncomment: true }));
-	const upgradeResult = await applyUpgrade(state, tag);
+	writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", { OP_IMAGE_TAG: resolvedTag }, { uncomment: true }));
+	const upgradeResult = await applyUpgrade(state, resolvedTag);
 	return {
-		imageTag: tag,
-		namespace: "openpalm",
+		imageTag: resolvedTag,
+		namespace,
 		backupDir: upgradeResult.backupDir,
 		assetsUpdated: upgradeResult.updated,
 		restarted: upgradeResult.restarted
@@ -13347,13 +13475,16 @@ function buildComposeFileList(state) {
 }
 async function buildManagedServices(state) {
 	const composeOpts = buildComposeOptions(state);
+	const services = new Set(CORE_SERVICES);
 	if (composeOpts.files.length > 0 && !process.env.OP_SKIP_COMPOSE_PREFLIGHT) {
 		const result = await composeConfigServices(composeOpts);
-		if (result.ok && result.services.length > 0) return result.services;
+		if (result.ok && result.services.length > 0) {
+			for (const s of result.services) services.add(s);
+			return [...services];
+		}
 	}
-	const services = [...CORE_SERVICES];
-	for (const addon of listEnabledAddonIds(state.homeDir)) services.push(...getAddonServiceNames(state.homeDir, addon));
-	return services;
+	for (const addon of listEnabledAddonIds(state.homeDir)) for (const s of getAddonServiceNames(state.homeDir, addon)) services.add(s);
+	return [...services];
 }
 //#endregion
 //#region ../lib/src/control-plane/markdown-task.ts
@@ -13365,14 +13496,14 @@ async function buildManagedServices(state) {
 *   prompt   — `prompt: <text>` inline prompt text
 *   workflow — `workflow: workflow:<ref>` + optional `params` map
 */
-var logger$3 = createLogger("task-file");
+var logger$4 = createLogger("task-file");
 function parseMarkdownTask(filePath) {
 	const id = basename(filePath).replace(/\.(?:ya?ml|md)$/, "");
 	let raw;
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		logger$3.warn("failed to read task file", {
+		logger$4.warn("failed to read task file", {
 			filePath,
 			error: String(err)
 		});
@@ -13383,12 +13514,12 @@ function parseMarkdownTask(filePath) {
 	try {
 		const parsed = (0, import_dist.parse)(frontmatter);
 		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-			logger$3.warn("task YAML is not an object", { filePath });
+			logger$4.warn("task YAML is not an object", { filePath });
 			return null;
 		}
 		fm = parsed;
 	} catch (err) {
-		logger$3.warn("failed to parse task YAML", {
+		logger$4.warn("failed to parse task YAML", {
 			filePath,
 			error: String(err)
 		});
@@ -13396,14 +13527,14 @@ function parseMarkdownTask(filePath) {
 	}
 	const schedule = fm.schedule;
 	if (typeof schedule !== "string" || !schedule.trim()) {
-		logger$3.warn("task missing or empty 'schedule'", { filePath });
+		logger$4.warn("task missing or empty 'schedule'", { filePath });
 		return null;
 	}
 	let target;
 	if (fm.command !== void 0) {
 		const cmd = Array.isArray(fm.command) ? fm.command.map(String) : typeof fm.command === "string" ? [fm.command] : null;
 		if (!cmd || cmd.length === 0) {
-			logger$3.warn("task 'command' must be a non-empty array", { filePath });
+			logger$4.warn("task 'command' must be a non-empty array", { filePath });
 			return null;
 		}
 		target = {
@@ -13412,12 +13543,12 @@ function parseMarkdownTask(filePath) {
 		};
 	} else if (fm.prompt !== void 0) {
 		if (typeof fm.prompt !== "string" || !fm.prompt.trim()) {
-			logger$3.warn("task 'prompt' must be a non-empty string", { filePath });
+			logger$4.warn("task 'prompt' must be a non-empty string", { filePath });
 			return null;
 		}
 		const promptBody = fm.prompt.trim() === "inline" ? body.trim() : fm.prompt.trim();
 		if (!promptBody) {
-			logger$3.warn("task prompt body is empty", { filePath });
+			logger$4.warn("task prompt body is empty", { filePath });
 			return null;
 		}
 		target = {
@@ -13427,7 +13558,7 @@ function parseMarkdownTask(filePath) {
 		};
 	} else if (fm.workflow !== void 0) {
 		if (typeof fm.workflow !== "string") {
-			logger$3.warn("task 'workflow' must be a string ref", { filePath });
+			logger$4.warn("task 'workflow' must be a string ref", { filePath });
 			return null;
 		}
 		target = {
@@ -13436,7 +13567,7 @@ function parseMarkdownTask(filePath) {
 			params: fm.params && typeof fm.params === "object" && !Array.isArray(fm.params) ? fm.params : {}
 		};
 	} else {
-		logger$3.warn("task must have one of: command, prompt, workflow", { filePath });
+		logger$4.warn("task must have one of: command, prompt, workflow", { filePath });
 		return null;
 	}
 	return {
@@ -13653,7 +13784,7 @@ function readUserEnvFile(envPath) {
 * Scheduling is handled by the OS cron daemon (via `akm tasks sync`).
 * Execution is handled by `akm tasks run <id>`.
 */
-var logger$2 = createLogger("scheduler");
+var logger$3 = createLogger("scheduler");
 function loadAutomations(stashDir) {
 	return loadMarkdownTasks(stashDir).map(taskToAutomationConfig);
 }
@@ -13671,7 +13802,7 @@ async function executeAutomation(id, akmEnv) {
 		} }, (error, _stdout, stderr) => {
 			if (error) {
 				const msg = stderr?.trim() || error.message;
-				logger$2.warn("akm tasks run failed", {
+				logger$3.warn("akm tasks run failed", {
 					id: taskId,
 					error: msg
 				});
@@ -13711,7 +13842,7 @@ function readAutomationLogs(id, dataDir, limit = 50) {
 *
 * Probes well-known endpoints for Docker Model Runner, Ollama, and LM Studio.
 */
-var logger$1 = createLogger("local-providers");
+var logger$2 = createLogger("local-providers");
 /** Ollama's root endpoint returns "Ollama is running" — use this to distinguish from other services on :11434. */
 async function validateOllamaResponse(res) {
 	try {
@@ -13784,13 +13915,13 @@ async function detectLocalProviders() {
 			const res = await fetch(probeUrl, { signal: AbortSignal.timeout(3e3) });
 			if (res.ok) {
 				if (validate && !await validate(res)) {
-					logger$1.debug("provider probe response failed validation", {
+					logger$2.debug("provider probe response failed validation", {
 						provider,
 						url: baseUrl
 					});
 					continue;
 				}
-				logger$1.debug("detected local provider", {
+				logger$2.debug("detected local provider", {
 					provider,
 					url: baseUrl
 				});
@@ -13809,6 +13940,173 @@ async function detectLocalProviders() {
 	}));
 }
 //#endregion
+//#region ../lib/src/control-plane/hardware-detect.ts
+var logger$1 = createLogger("hardware-detect");
+/** Parse `nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits`. */
+function parseNvidiaSmi(stdout) {
+	return stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
+		const idx = line.lastIndexOf(",");
+		if (idx === -1) return null;
+		const name = line.slice(0, idx).trim();
+		const vramMb = Number.parseInt(line.slice(idx + 1).trim(), 10);
+		if (!name || !Number.isFinite(vramMb)) return null;
+		return {
+			vendor: "nvidia",
+			name,
+			vramMb
+		};
+	}).filter((g) => g !== null);
+}
+/** Parse `rocm-smi --showmeminfo vram --showproductname --json`. */
+function parseRocmSmi(stdout) {
+	let doc;
+	try {
+		doc = JSON.parse(stdout);
+	} catch {
+		return [];
+	}
+	const out = [];
+	for (const card of Object.values(doc)) {
+		if (!card || typeof card !== "object") continue;
+		const vramKey = Object.keys(card).find((k) => /vram total memory/i.test(k));
+		const nameKey = Object.keys(card).find((k) => /product name|card series|gfx/i.test(k));
+		const bytes = vramKey ? Number.parseInt(String(card[vramKey]).trim(), 10) : NaN;
+		const vramMb = Number.isFinite(bytes) ? Math.round(bytes / (1024 * 1024)) : 0;
+		out.push({
+			vendor: "amd",
+			name: nameKey ? String(card[nameKey]).trim() : "AMD GPU",
+			vramMb
+		});
+	}
+	return out;
+}
+/**
+* Parse `sysctl -n hw.memsize hw.model` (two lines: total bytes, then model id)
+* into an Apple-Silicon GpuInfo. `hw.memsize` is UNIFIED memory shared between
+* CPU and GPU, carried here as vramMb for informational display only — callers
+* must NOT treat it like discrete VRAM (see setup-recommendation). Pure; never throws.
+*/
+function parseAppleSilicon(stdout) {
+	const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+	if (lines.length === 0) return [];
+	const bytes = Number.parseInt(lines[0] ?? "", 10);
+	if (!Number.isFinite(bytes) || bytes <= 0) return [];
+	const vramMb = Math.round(bytes / (1024 * 1024));
+	return [{
+		vendor: "apple",
+		name: `Apple Silicon (${lines[1] && lines[1].length > 0 ? lines[1] : "arm64"})`,
+		vramMb
+	}];
+}
+var GPU_PROBES = [
+	{
+		vendor: "nvidia",
+		command: "nvidia-smi",
+		args: ["--query-gpu=name,memory.total", "--format=csv,noheader,nounits"],
+		parse: parseNvidiaSmi
+	},
+	{
+		vendor: "amd",
+		command: "rocm-smi",
+		args: [
+			"--showmeminfo",
+			"vram",
+			"--showproductname",
+			"--json"
+		],
+		parse: parseRocmSmi
+	},
+	{
+		vendor: "apple",
+		command: "sysctl",
+		args: [
+			"-n",
+			"hw.memsize",
+			"hw.model"
+		],
+		parse: parseAppleSilicon,
+		enabled: process.platform === "darwin" && process.arch === "arm64"
+	}
+];
+function run(command, args, timeoutMs = 3e3) {
+	return new Promise((resolve) => {
+		execFile(command, args, { timeout: timeoutMs }, (err, stdout) => {
+			resolve(err ? null : stdout?.toString() ?? "");
+		});
+	});
+}
+/**
+* Detect the host's best GPU. Returns the highest-VRAM adapter across all probes,
+* or null when none is found. Never throws.
+*/
+async function detectGpu() {
+	const found = [];
+	await Promise.all(GPU_PROBES.map(async (probe) => {
+		if (probe.enabled === false) return;
+		const stdout = await run(probe.command, probe.args);
+		if (stdout === null) return;
+		try {
+			found.push(...probe.parse(stdout));
+		} catch (error) {
+			logger$1.debug("gpu probe parse failed", {
+				vendor: probe.vendor,
+				error: String(error)
+			});
+		}
+	}));
+	if (found.length === 0) return null;
+	return found.reduce((best, g) => g.vramMb > best.vramMb ? g : best);
+}
+/** Ollama hardware-profile variant chosen per GPU vendor. Extend per new vendor. */
+var VENDOR_PROFILE_VARIANT = {
+	nvidia: "cuda",
+	amd: "rocm",
+	apple: "cpu",
+	unknown: "cpu"
+};
+function gpuToProfileVariant(gpu) {
+	return VENDOR_PROFILE_VARIANT[gpu.vendor] ?? "cpu";
+}
+var fmtGb = (mb) => (mb / 1024).toFixed(mb % 1024 === 0 ? 0 : 1);
+var labelHostProviders = (h) => h.map((p) => p.provider).join(" and ");
+/**
+* Decide what setup should do, given detected providers + hardware.
+*
+* Order (first match wins):
+*  1. cloud provider connected      -> use it.
+*  2. host-local provider running   -> add it, proceed.
+*  3. darwin + apple GPU            -> guide to HOST Ollama (Metal); never in-stack.
+*  4. capable GPU (>= threshold)    -> enable in-stack Ollama.
+*  5. otherwise                     -> ask the user to connect a provider.
+*/
+function recommendSetup(input) {
+	const { cloudProviders, hostProviders, gpu } = input;
+	const platform = input.platform ?? process.platform;
+	if (cloudProviders.length > 0) return {
+		action: "use-cloud",
+		cloudProviders
+	};
+	if (hostProviders.length > 0) return {
+		action: "use-host-providers",
+		hostProviders,
+		alert: `No cloud AI provider was detected, but ${labelHostProviders(hostProviders)} ${hostProviders.length > 1 ? "are" : "is"} running on your computer — added automatically. Pick your models on the next step.`
+	};
+	if (platform === "darwin" && gpu && gpu.vendor === "apple") return {
+		action: "connect-manually",
+		alert: "No AI provider was detected. On macOS, fast local models need Ollama running natively (it uses your Apple Silicon / Metal GPU) — the bundled in-stack Ollama runs in Linux and cannot reach Metal. Install Ollama for macOS (https://ollama.com/download), or connect a provider on the next step."
+	};
+	if (gpu && gpu.vramMb >= 8192) return {
+		action: "enable-ollama",
+		profileVariant: gpuToProfileVariant(gpu),
+		gpu,
+		alert: `No AI provider was detected, but a capable GPU was found (${gpu.name}, ${fmtGb(gpu.vramMb)} GB). Local models via Ollama have been enabled for you.`
+	};
+	return {
+		action: "connect-manually",
+		alert: "No AI provider was detected and no GPU with enough memory for local models was found. Connect a provider to continue — sign in to a provider on the next step, or add a custom OpenAI-compatible endpoint and key."
+	};
+}
+//#endregion
 //#region ../lib/src/control-plane/compose-errors.ts
 /**
 * Lines we recognise as per-service failure indicators. The compose CLI
@@ -14433,5 +14731,5 @@ function importHostOpenCode(state, options = {}) {
 	};
 }
 
-export { isHostAkmAvailable as $, AKM_USER_ENV_REF as A, createState as B, CORE_SERVICES as C, deleteUserEnvKey as D, detectHostOpenCode as E, detectLocalProviders as F, disableHostAkmSharing as G, enableHostAkmSharing as H, ensureAkmUserEnv as I, ensureHomeDirs as J, ensureMigrated as K, ensureOpenCodeConfig as L, MigrationError as M, ensureOpenCodeSystemConfig as N, ensureSecrets as O, executeAutomation as P, fetchProviderModels as Q, getAddonProfileAvailability as R, getAddonProfileSelection as S, getAddonProfiles as T, getAddonServiceNames as U, getDockerEvents as V, getHostAkmSharingStatus as W, getRegistryAddonConfig as X, hostAkmStashPath as Y, importHostOpenCode as Z, isAllowedService as _, addonProfileId as a, isSetupComplete as a0, listAvailableAddonIds as a1, listEnabledAddonIds as a2, listSecretFiles as a3, loadAutomations as a4, parseComposeStderr as a5, parseEnvFile as a6, performSetup as a7, performUpgrade as a8, readAutomationLogs as a9, readSecret as aa, readSecretFile as ab, readStackEnv as ac, readStackRuntimeEnv as ad, readStackSecretEnv as ae, readTaskFile as af, readUserEnvFile as ag, removeSecretFile as ah, removeTaskFile as ai, resolveComposeProjectName as aj, resolveDataDir as ak, resolveRuntimeFiles as al, resolveStackDir as am, seedUiBuild as an, setAddonEnabled as ao, setAddonProfileSelection as ap, summarizeComposeStderr as aq, validateProposedState as ar, writeFileAtomic as as, writeRuntimeFiles as at, writeSecretFile as au, writeStackSecretEnv as av, writeTaskFile as aw, writeUserEnvKey as ax, writeVoiceVars as ay, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEnv as j, buildComposeOptions as k, buildManagedServices as l, checkDocker as m, checkDockerCompose as n, composeDown as o, composeLogs as p, composePreflight as q, composePs as r, composePull as s, composeRestart as t, composeStart as u, composeStats as v, composeStop as w, composeUp as x, createLogger as y, createOpenCodeClient as z };
-//# sourceMappingURL=src-D9YnoOnU.js.map
+export { hostAkmStashPath as $, AKM_USER_ENV_REF as A, createState as B, CORE_SERVICES as C, deleteUserEnvKey as D, detectExistingProject as E, detectGpu as F, detectHostOpenCode as G, detectLocalProviders as H, disableHostAkmSharing as I, enableHostAkmSharing as J, ensureAkmUserEnv as K, ensureHomeDirs as L, MigrationError as M, ensureMigrated as N, ensureOpenCodeConfig as O, PROVIDER_KEY_MAP as P, ensureOpenCodeSystemConfig as Q, ensureSecrets as R, executeAutomation as S, fetchProviderModels as T, getAddonProfileAvailability as U, getAddonProfileSelection as V, getAddonProfiles as W, getAddonServiceNames as X, getDockerEvents as Y, getHostAkmSharingStatus as Z, getRegistryAddonConfig as _, addonProfileId as a, importHostOpenCode as a0, isAllowedService as a1, isHostAkmAvailable as a2, isSetupComplete as a3, listAvailableAddonIds as a4, listEnabledAddonIds as a5, listSecretFiles as a6, loadAutomations as a7, parseComposeStderr as a8, parseEnvFile as a9, writeTaskFile as aA, writeUserEnvKey as aB, writeVoiceVars as aC, performSetup as aa, performUpgrade as ab, readAutomationLogs as ac, readSecret as ad, readSecretFile as ae, readStackEnv as af, readStackRuntimeEnv as ag, readStackSecretEnv as ah, readTaskFile as ai, readUserEnvFile as aj, recommendSetup as ak, removeSecretFile as al, removeTaskFile as am, resolveComposeProjectName as an, resolveDataDir as ao, resolveRuntimeFiles as ap, resolveStackDir as aq, seedUiBuild as ar, setAddonEnabled as as, setAddonProfileSelection as at, summarizeComposeStderr as au, validateProposedState as av, writeFileAtomic as aw, writeRuntimeFiles as ax, writeSecretFile as ay, writeStackSecretEnv as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEnv as j, buildComposeOptions as k, buildManagedServices as l, checkDocker as m, checkDockerCompose as n, composeDown as o, composeLogs as p, composePreflight as q, composePs as r, composePull as s, composeRestart as t, composeStart as u, composeStats as v, composeStop as w, composeUp as x, createLogger as y, createOpenCodeClient as z };
+//# sourceMappingURL=src-DJv-Q_k2.js.map