@openpalm/ui 0.11.2 → 0.11.3-rc.1

package/build/server/chunks/{src-b3nBkyhY.js → src-DkGZ5D6n.js}

@@ -12263,975 +12263,975 @@ function removeTaskFile(stashDir, name) {
 function isSetupComplete(stackDir) {
 	return parseEnvFile(stackEnvPathFromStackDir(stackDir)).OP_SETUP_COMPLETE === "true";
 }
-//#endregion
-//#region ../lib/src/control-plane/channels.ts
+/** Execute docker with an argument array — no shell interpolation. */
+function run$1(args, cwd, timeoutMs = 12e4, envOverrides) {
+	return new Promise((resolve) => {
+		execFile("docker", args, {
+			cwd,
+			timeout: timeoutMs,
+			env: {
+				...process.env,
+				...envOverrides
+			}
+		}, (error, stdout, stderr) => {
+			resolve({
+				ok: !error,
+				stdout: stdout?.toString() ?? "",
+				stderr: stderr?.toString() ?? "",
+				code: error?.code ? Number(error.code) : 0
+			});
+		});
+	});
+}
 /**
-* Channel validation, discovery, and allowlist checks for the OpenPalm control plane.
+* Resolve the Docker Compose project name.
+* Honors OP_PROJECT_NAME first for OpenPalm stacks, then COMPOSE_PROJECT_NAME.
 */
-function addonComposePaths(homeDir) {
-	const paths = [];
-	for (const name of [
-		"channels.compose.yml",
-		"services.compose.yml",
-		"custom.compose.yml"
-	]) {
-		const composePath = `${homeDir}/config/stack/${name}`;
-		if (existsSync(composePath)) paths.push(composePath);
-	}
-	return paths;
+function resolveComposeProjectName(envOverrides = {}) {
+	return envOverrides.OP_PROJECT_NAME?.trim() || envOverrides.COMPOSE_PROJECT_NAME?.trim() || process.env.OP_PROJECT_NAME?.trim() || process.env.COMPOSE_PROJECT_NAME?.trim() || "openpalm";
 }
 /**
-* Check if a service name is allowed. Core services are always allowed.
-* Addon services are allowed if they appear as a compose service defined in
-* any active addon compose file. This is compose-derived: the actual compose
-* content is checked, not directory naming conventions.
+* Decide whether a running compose project (identified by its
+* `com.docker.compose.project.working_dir` label) is OURS — i.e. was launched
+* from this install's working dir. An empty/unknown label can't prove foreign,
+* so it counts as ours (reconcile rather than wrongly refuse a redeploy).
+*
+* Pure decision split out from detectExistingProject so the ours-vs-foreign
+* rule is unit-testable without a Docker daemon.
 */
-function isAllowedService(value, configDir) {
-	if (!value || !value.trim() || value !== value.toLowerCase()) return false;
-	if (CORE_SERVICES.includes(value)) return true;
-	if (configDir) {
-		const homeDir = dirname(configDir);
-		for (const composePath of addonComposePaths(homeDir)) try {
-			const doc = (0, import_dist.parse)(readFileSync(composePath, "utf-8"));
-			if (typeof doc === "object" && doc !== null) {
-				const services = doc.services;
-				if (typeof services === "object" && services !== null && value in services) return true;
-			}
-		} catch {
-			continue;
-		}
-	}
-	return false;
+function isProjectOurs(workingDirLabel, expectedWorkingDir) {
+	const label = workingDirLabel.trim();
+	return label === "" || label === expectedWorkingDir;
 }
-//#endregion
-//#region ../lib/src/control-plane/provider-models.ts
 /**
-* Provider model discovery and API key resolution.
+* Probe the Docker daemon for a running compose project that shares
+* `projectName`. Decides ours-vs-foreign by comparing the project's
+* `com.docker.compose.project.working_dir` label against `expectedWorkingDir`
+* (the install's OP_HOME / compose context).
 *
-* Used by the admin capabilities test endpoint and the CLI setup wizard
-* to enumerate the models a configured provider exposes.
+* Returns `{ exists:false }` on any docker error (daemon down, no permission) —
+* detection is best-effort and never blocks the caller; a real failure surfaces
+* later through composeUp.
 */
-/** Static model list for Anthropic (no listing API available). */
-var ANTHROPIC_MODELS = [
-	"claude-opus-4-6",
-	"claude-sonnet-4-6",
-	"claude-opus-4-20250514",
-	"claude-sonnet-4-20250514",
-	"claude-haiku-4-5-20251001",
-	"claude-3-5-sonnet-20241022",
-	"claude-3-5-haiku-20241022"
-];
+function detectExistingProject(opts) {
+	const none = {
+		exists: false,
+		isOurs: false,
+		workingDir: ""
+	};
+	return new Promise((resolve) => {
+		execFile("docker", [
+			"ps",
+			"-q",
+			"--filter",
+			`label=com.docker.compose.project=${opts.projectName}`
+		], { timeout: 1e4 }, (err, stdout) => {
+			if (err) return resolve(none);
+			const ids = stdout.toString().trim().split(/\s+/).filter(Boolean);
+			if (ids.length === 0) return resolve(none);
+			execFile("docker", [
+				"inspect",
+				"--format",
+				"{{ index .Config.Labels \"com.docker.compose.project.working_dir\" }}",
+				ids[0]
+			], { timeout: 1e4 }, (err2, stdout2) => {
+				if (err2) return resolve({
+					exists: true,
+					isOurs: false,
+					workingDir: ""
+				});
+				const workingDir = stdout2.toString().trim();
+				resolve({
+					exists: true,
+					isOurs: isProjectOurs(workingDir, opts.expectedWorkingDir),
+					workingDir
+				});
+			});
+		});
+	});
+}
+/** Check if Docker is available */
+async function checkDocker() {
+	return new Promise((resolve) => {
+		execFile("docker", [
+			"info",
+			"--format",
+			"{{.ServerVersion}}"
+		], (error, stdout, stderr) => {
+			const stdoutStr = stdout?.toString().trim() ?? "";
+			const stderrStr = stderr?.toString() ?? "";
+			resolve({
+				ok: stdoutStr.length > 0 || !error,
+				stdout: stdoutStr,
+				stderr: stderrStr,
+				code: error?.code ? Number(error.code) : 0
+			});
+		});
+	});
+}
+/** Check if docker compose is available */
+async function checkDockerCompose() {
+	return new Promise((resolve) => {
+		execFile("docker", ["compose", "version"], (error, stdout, stderr) => {
+			resolve({
+				ok: !error,
+				stdout: stdout?.toString() ?? "",
+				stderr: stderr?.toString() ?? "",
+				code: error?.code ? Number(error.code) : 0
+			});
+		});
+	});
+}
+/** Build common prefix: compose -f ... --project-name ... --env-file ... --profile ... */
+function buildComposeArgs(options) {
+	const envOverrides = collectEnvOverrides(options.envFiles);
+	const args = [
+		"compose",
+		...options.files.flatMap((f) => ["-f", f]),
+		"--project-name",
+		resolveComposeProjectName(envOverrides)
+	];
+	for (const ef of options.envFiles ?? []) if (existsSync(ef)) args.push("--env-file", ef);
+	for (const p of options.profiles ?? []) args.push("--profile", p);
+	return args;
+}
+/** Merge all env files into a single overrides object for process env. */
+function collectEnvOverrides(envFiles) {
+	const overrides = {};
+	for (const ef of envFiles ?? []) Object.assign(overrides, parseEnvFile(ef));
+	return overrides;
+}
 /**
-* Resolve an API key reference.
-*
-* - Empty input → empty string.
-* - `env:NAME` form → looks up `NAME` in `process.env` first, then falls back
-*   to `knowledge/secrets/<NAME>` resolved against `stackDir`.
-* - Anything else → returned verbatim (treated as a literal key value).
+* Run `docker compose config` to validate compose file merge and variable substitution.
+* Must be called before any lifecycle mutation (install/apply/update).
 */
-function resolveApiKey(apiKeyRef, stackDir) {
-	if (!apiKeyRef) return "";
-	if (!apiKeyRef.startsWith("env:")) return apiKeyRef;
-	const varName = apiKeyRef.slice(4);
-	if (process.env[varName]) return process.env[varName];
-	return readStackRuntimeEnv(stackDir)[varName] ?? "";
+async function composePreflight(options) {
+	const args = buildComposeArgs(options);
+	args.push("config", "--quiet");
+	return run$1(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
 }
-var HTTP_STATUS_LABELS = {
-	401: "Invalid or missing API key",
-	403: "Access denied — check API key permissions",
-	404: "Endpoint not found — verify the base URL",
-	429: "Rate limited — try again shortly",
-	500: "Provider internal error",
-	502: "Provider returned a bad gateway error",
-	503: "Provider is temporarily unavailable"
-};
 /**
-* Enumerate available models for a provider. Returns an `ok` result with a
-* sorted model list when the provider responds successfully, or a
-* `recoverable_error` with a structured reason otherwise. Network and timeout
-* failures are caught and mapped to a result rather than thrown.
+* Run compose config preflight validation before any mutation.
+* Skipped when OP_SKIP_COMPOSE_PREFLIGHT is set (tests, CI).
 */
-async function fetchProviderModels(provider, apiKeyRef, baseUrl, stackDir) {
-	try {
-		if (provider === "anthropic") return {
-			models: [...ANTHROPIC_MODELS],
-			status: "ok",
-			reason: "provider_static"
-		};
-		const resolvedKey = resolveApiKey(apiKeyRef, stackDir);
-		if (provider === "ollama") {
-			const url = `${(baseUrl?.trim() || PROVIDER_DEFAULT_URLS.ollama).replace(/\/+$/, "")}/api/tags`;
-			const res = await fetch(url, { signal: AbortSignal.timeout(5e3) });
-			if (!res.ok) return {
-				models: [],
-				status: "recoverable_error",
-				reason: "provider_http",
-				error: `Ollama API returned ${res.status}: ${HTTP_STATUS_LABELS[res.status] ?? `HTTP ${res.status}`}`
-			};
-			return {
-				models: ((await res.json()).models ?? []).map((m) => m.name).sort(),
-				status: "ok",
-				reason: "none"
-			};
-		}
-		const base = baseUrl?.trim() || PROVIDER_DEFAULT_URLS[provider] || "";
-		if (!base) return {
-			models: [],
-			status: "recoverable_error",
-			reason: "missing_base_url",
-			error: `No base URL configured for provider "${provider}"`
-		};
-		const url = `${base.replace(/\/+$/, "")}/v1/models`;
-		const headers = {};
-		if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-		const res = await fetch(url, {
-			headers,
-			signal: AbortSignal.timeout(5e3)
-		});
-		if (!res.ok) {
-			let detail = "";
-			try {
-				const json = JSON.parse(await res.text());
-				const errObj = json.error;
-				detail = typeof errObj === "object" && errObj !== null && typeof errObj.message === "string" ? errObj.message : typeof errObj === "string" ? errObj : typeof json.message === "string" ? json.message : typeof json.detail === "string" ? json.detail : "";
-			} catch {}
-			return {
-				models: [],
-				status: "recoverable_error",
-				reason: "provider_http",
-				error: detail ? `Provider API returned ${res.status}: ${detail}` : `Provider API returned ${res.status}: ${HTTP_STATUS_LABELS[res.status] ?? `HTTP ${res.status}`}`
-			};
-		}
-		return {
-			models: ((await res.json()).data ?? []).map((m) => m.id).sort(),
-			status: "ok",
-			reason: "none"
-		};
-	} catch (err) {
-		const message = err instanceof Error && err.name === "TimeoutError" ? "Request timed out after 5s" : String(err);
-		return {
-			models: [],
-			status: "recoverable_error",
-			reason: err instanceof Error && err.name === "TimeoutError" ? "timeout" : "network",
-			error: message
-		};
+async function runPreflight(options) {
+	if (options.files.length === 0 || process.env.OP_SKIP_COMPOSE_PREFLIGHT) return;
+	const result = await composePreflight(options);
+	if (!result.ok) {
+		const project = resolveComposeProjectName(collectEnvOverrides(options.envFiles));
+		const fileArgs = options.files.map((f) => `-f ${f}`).join(" ");
+		const envArgs = (options.envFiles ?? []).map((f) => `--env-file ${f}`).join(" ");
+		const profileArgs = (options.profiles ?? []).map((p) => `--profile ${p}`).join(" ");
+		throw new Error(`Compose preflight failed: ${result.stderr}\nResolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} ${profileArgs} config --quiet`);
 	}
 }
-//#endregion
-//#region ../lib/src/control-plane/fs-atomic.ts
+async function composeConfigServices(options) {
+	const args = buildComposeArgs(options);
+	args.push("config", "--services");
+	const result = await run$1(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
+	if (!result.ok) return {
+		ok: false,
+		services: []
+	};
+	return {
+		ok: true,
+		services: result.stdout.split("\n").map((s) => s.trim()).filter(Boolean)
+	};
+}
 /**
-* Write a file atomically: write to `${path}.tmp` then rename over the target.
-* The rename is atomic on the same filesystem, so readers never observe a
-* partially written file. `mode` (e.g. 0o600) is applied on creation.
-*
-* Shared by all control-plane writers (setup, akm-sources, …) so config and
-* secret files are written through one audited path — never hand-rolled.
+* Run `docker compose up -d` with the generated compose file(s).
+* Pass `files` to merge multiple compose overlays (e.g. core + addon files).
 */
-function writeFileAtomic(path, content, mode) {
-	const tmp = `${path}.tmp`;
-	writeFileSync(tmp, content, { mode } );
-	renameSync(tmp, path);
+async function composeUp(options) {
+	await runPreflight(options);
+	if (!existsSync(options.files[0])) return {
+		ok: false,
+		stdout: "",
+		stderr: "Compose file not found",
+		code: 1
+	};
+	const args = buildComposeArgs(options);
+	args.push("up", "-d");
+	if (options.forceRecreate) args.push("--force-recreate");
+	if (options.removeOrphans) args.push("--remove-orphans");
+	if (options.services?.length) args.push(...options.services);
+	return run$1(args, void 0, composeUpTimeoutMs(), collectEnvOverrides(options.envFiles));
 }
-//#endregion
-//#region ../lib/src/control-plane/akm-sources.ts
 /**
-* Host ↔ Assistant AKM source wiring (control-plane logic — lives in lib).
-*
-* Implements the "symmetric writable secondary" design
-* (docs/technical/akm-host-assistant-integration-proposal.md §8).
-*
-* Each akm instance keeps its OWN primary stash, data dir, and cache. Sharing
-* is done purely by adding the other instance's stash as a *secondary* source
-* in `config.sources[]`:
-*   - The OpenPalm/container config gains a `host-akm` source → /host-stash
-*     (the user's personal ~/akm, bind-mounted by the host-akm.compose.yml overlay).
-*   - The personal config gains an `openpalm` source → OP_HOME/knowledge.
-*
-* VERIFIED against akm 0.8.0 (rc.13 → stable; schema unchanged):
-*  - `SourceConfigEntrySchema` (config-schema.ts:259) accepts
-*    { type, path?, url?, name?, enabled?, writable?, primary?, options?, wikiName? }.
-*  - The indexer's `resolveSourceEntries` (search-source.ts:56) ALWAYS injects the
-*    env-resolved primary stash (AKM_STASH_DIR) as sources[0], then appends
-*    config.sources[] deduped by path. So a secondary entry can never strand or
-*    displace the primary — provided we NEVER set `primary:true` and NEVER set
-*    `config.stashDir`.
-*  - Writes resolve to the primary unless an explicit `--target` is given
-*    (write-source.ts) and `defaultWriteTarget` is left unset, so a writable
-*    secondary is safe by construction.
-*
-* Invariants (enforced + unit-tested):
-*  - Only ever appends/updates a NAMED source (idempotent upsert by name).
-*  - NEVER sets `primary`, NEVER sets `defaultWriteTarget`, NEVER sets `stashDir`.
-*  - Atomic 0600 writes.
-*  - The OpenPalm config is parse-tolerant (we own it: corrupt → start from {}).
-*  - The PERSONAL config FAILS CLOSED (corrupt/unreadable → throw, never overwrite
-*    the user's file). This asymmetry is the host-data-loss guard.
+* Timeout budget for `compose up`. A first install extracts multi-GB images
+* (voice CUDA ~7.6 GB) onto slow disks; the previous hard 5-minute cap
+* SIGTERM-killed the start mid-extraction and surfaced as an empty/opaque
+* error. Default 30 min, override with OP_COMPOSE_UP_TIMEOUT_MS. Kept bounded
+* (never removed) so a genuinely hung start still eventually fails.
 */
-/** Source entry name added to the OpenPalm/container config (points at /host-stash). */
-var HOST_SOURCE_NAME = "host-akm";
-function readConfigTolerant(configPath) {
-	if (!existsSync(configPath)) return {};
-	try {
-		const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
-		return parsed && typeof parsed === "object" ? parsed : {};
-	} catch {
-		return {};
-	}
-}
-function readConfigFailClosed(configPath) {
-	if (!existsSync(configPath)) throw new Error(`Personal akm config not found at ${configPath}; refusing to create it. Run \`akm init\`/\`akm setup\` first, then enable host AKM sharing.`);
-	let text;
-	try {
-		text = readFileSync(configPath, "utf-8");
-	} catch (err) {
-		throw new Error(`Unable to read personal akm config at ${configPath}: ${err.message}`);
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch {
-		throw new Error(`Personal akm config at ${configPath} is not valid JSON; refusing to overwrite it. Fix the file by hand, then retry.`);
-	}
-	if (!parsed || typeof parsed !== "object") throw new Error(`Personal akm config at ${configPath} is not a JSON object; refusing to overwrite it.`);
-	return parsed;
+function composeUpTimeoutMs() {
+	const raw = process.env.OP_COMPOSE_UP_TIMEOUT_MS?.trim();
+	const parsed = raw ? Number(raw) : NaN;
+	if (Number.isFinite(parsed) && parsed > 0) return parsed;
+	return 30 * 6e4;
 }
 /**
-* Upsert a named filesystem source into `config.sources[]` by name. Idempotent.
-* NEVER touches `primary`, `defaultWriteTarget`, or `stashDir`.
+* Run `docker compose down` to stop and remove containers.
 */
-function upsertSource(config, entry) {
-	const sources = Array.isArray(config.sources) ? [...config.sources] : [];
-	const idx = sources.findIndex((s) => s && typeof s === "object" && s.name === entry.name);
-	if (idx >= 0) sources[idx] = {
-		...sources[idx],
-		...entry
-	};
-	else sources.push(entry);
-	return {
-		...config,
-		sources
+async function composeDown(options) {
+	await runPreflight(options);
+	if (!existsSync(options.files[0])) return {
+		ok: false,
+		stdout: "",
+		stderr: "Compose file not found",
+		code: 1
 	};
+	const args = buildComposeArgs(options);
+	args.push("down");
+	if (options.removeVolumes) args.push("-v");
+	if (options.removeOrphans) args.push("--remove-orphans");
+	return run$1(args, void 0);
 }
-function removeSource(config, name) {
-	if (!Array.isArray(config.sources)) return config;
-	const sources = config.sources.filter((s) => !(s && typeof s === "object" && s.name === name));
-	return {
-		...config,
-		sources
+/**
+* Restart specific services.
+*/
+async function composeRestart(services, options) {
+	await runPreflight(options);
+	const primaryFile = options.files[0];
+	if (!existsSync(primaryFile)) return {
+		ok: false,
+		stdout: "",
+		stderr: "Compose file not found",
+		code: 1
 	};
+	const args = buildComposeArgs(options);
+	args.push("restart", ...services);
+	return run$1(args, void 0);
 }
-function assertNoPrimaryEscalation(entry) {
-	if (entry.primary !== void 0) throw new Error("akm-sources: refusing to write a source entry carrying `primary`.");
-}
-function openpalmConfigPath(state) {
-	return join(state.configDir, "akm", "config.json");
+/**
+* Stop specific services.
+*/
+async function composeStop(services, options) {
+	await runPreflight(options);
+	const args = buildComposeArgs(options);
+	args.push("stop", ...services);
+	return run$1(args, void 0);
 }
 /**
-* Container/OpenPalm side: add the personal stash (mounted at /host-stash) as a
-* secondary source. Parse-tolerant (we own this config). Writable by default so
-* the assistant can contribute back via an explicit `--target host-akm`.
+* Start specific services (must already be created).
 */
-function addHostStashToOpenpalmConfig(state, writable = true) {
-	const configPath = openpalmConfigPath(state);
-	const entry = {
-		type: "filesystem",
-		path: "/host-stash",
-		name: HOST_SOURCE_NAME,
-		writable,
-		enabled: true
-	};
-	assertNoPrimaryEscalation(entry);
-	const updated = upsertSource(readConfigTolerant(configPath), entry);
-	writeFileAtomic(configPath, JSON.stringify(updated, null, 2), 384);
+async function composeStart(services, options) {
+	await runPreflight(options);
+	const args = buildComposeArgs(options);
+	args.push("up", "-d", ...services);
+	return run$1(args, void 0);
 }
 /**
-* Remove the `host-akm` secondary source from the assistant config (disable
-* sharing). Parse-tolerant; never touches the user's personal config (D1 —
-* host sharing is assistant-reads-host only). Idempotent.
+* Get the status of all containers in the project.
 */
-function removeHostAkmSource(state) {
-	const opPath = openpalmConfigPath(state);
-	const opConfig = readConfigTolerant(opPath);
-	writeFileAtomic(opPath, JSON.stringify(removeSource(opConfig, HOST_SOURCE_NAME), null, 2), 384);
+async function composePs(options) {
+	const primaryFile = options.files[0];
+	if (!existsSync(primaryFile)) return run$1([
+		"ps",
+		"--filter",
+		`label=com.docker.compose.project=${resolveComposeProjectName()}`,
+		"--format",
+		"json"
+	], void 0);
+	const args = buildComposeArgs(options);
+	args.push("ps", "--format", "json");
+	return run$1(args, void 0);
 }
 /**
-* Read-only snapshot import of the host's reusable akm config into the OpenPalm
-* config. Reads the personal config READ-ONLY; never writes back to the host.
-*
-* ADDITIVE MERGE: existing OpenPalm values ALWAYS win — the host only fills gaps.
-* A profile name, default selection, or embedding field that OpenPalm already has
-* is never overwritten; host-only profiles/fields are added. Covers the
-* LLM/agent/improve PROFILES (+ their `defaults.*`) and the top-level `embedding`
-* connection. Returns which sections actually gained values.
-*
-* Writes the canonical akm 0.8.0 shape (profiles.* + defaults.* + embedding) —
-* never the legacy top-level `llm` (see I-3). NEVER touches `sources`, `stashDir`,
-* `registries`, or `installed`.
+* Get logs for specific services or all services.
 */
-function importHostProfiles(state, hostConfigPath) {
-	const host = readConfigFailClosed(hostConfigPath);
-	const hostProfiles = host.profiles ?? {};
-	const hostDefaults = host.defaults ?? {};
-	const opPath = openpalmConfigPath(state);
-	const op = readConfigTolerant(opPath);
-	const opProfiles = op.profiles ?? {};
-	const opDefaults = op.defaults ?? {};
-	const imported = [];
-	const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-	for (const ns of [
-		"llm",
-		"agent",
-		"improve"
-	]) {
-		if (isObj(hostProfiles[ns])) {
-			const existing = isObj(opProfiles[ns]) ? opProfiles[ns] : {};
-			const merged = {
-				...hostProfiles[ns],
-				...existing
-			};
-			const added = Object.keys(merged).length - Object.keys(existing).length;
-			opProfiles[ns] = merged;
-			if (added > 0) imported.push(`profiles.${ns}`);
-		}
-		if (typeof hostDefaults[ns] === "string" && typeof opDefaults[ns] !== "string") {
-			opDefaults[ns] = hostDefaults[ns];
-			imported.push(`defaults.${ns}`);
-		}
-	}
-	let embedding;
-	if (isObj(host.embedding)) {
-		const existing = isObj(op.embedding) ? op.embedding : {};
-		const merged = {
-			...host.embedding,
-			...existing
-		};
-		if (Object.keys(merged).length > Object.keys(existing).length) {
-			embedding = merged;
-			imported.push("embedding");
-		}
-	}
-	if (imported.length === 0) return { imported };
-	const updated = {
-		...op,
-		profiles: opProfiles,
-		defaults: opDefaults
-	};
-	if (embedding !== void 0) updated.embedding = embedding;
-	delete updated.llm;
-	writeFileAtomic(opPath, JSON.stringify(updated, null, 2), 384);
-	return { imported };
+async function composeLogs(services, tail, options) {
+	const args = buildComposeArgs(options);
+	args.push("logs", "--tail", String(tail));
+	if (options.since) args.push("--since", options.since);
+	if (services && services.length > 0) args.push(...services);
+	return run$1(args, void 0);
+}
+var PULL_TIMEOUT_MS = 60 * 6e4;
+async function composePull(options) {
+	await runPreflight(options);
+	const args = buildComposeArgs(options);
+	args.push("pull");
+	return run$1(args, void 0, PULL_TIMEOUT_MS, collectEnvOverrides(options.envFiles));
 }
-//#endregion
-//#region ../lib/src/control-plane/host-akm-sharing.ts
 /**
-* Host AKM sharing (control-plane logic — lives in lib).
-*
-* Simplified model (no compose overlay, no file-presence gating):
-*
-*  - The assistant ALWAYS mounts `/host-stash` (core.compose.yml). When the host
-*    has AKM, OP_HOST_AKM_STASH points at the user's personal stash (~/akm);
-*    otherwise it is unset and compose falls back to an always-present empty dir.
-*  - "Sharing" is purely a writable SECONDARY source entry named `host-akm` →
-*    /host-stash in the assistant's config/akm/config.json. Adding it = enabled;
-*    removing it = disabled. akm resolves writes to the primary unless an explicit
-*    --target is given, and silently skips a source whose dir is empty/missing —
-*    so a mounted-but-unconfigured /host-stash is harmless.
-*  - Host availability is detected from the presence of the user's personal akm
-*    CONFIG (~/.config/akm/config.json) — the real signal that akm is initialized.
-*
-* Decision D1 (2026-06-03): host sharing is assistant-reads-host ONLY by default.
-* We never write into the user's personal ~/.config/akm here. (Letting the host
-* akm see OpenPalm's knowledge is a future, explicit opt-in.)
+* Get resource usage stats for all containers in the project.
 */
-var logger$5 = createLogger("host-akm-sharing");
-var ENV_KEY = "OP_HOST_AKM_STASH";
-function userHome() {
-	return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
-}
-/** The user's personal akm stash dir (mounted into the assistant at /host-stash). */
-function hostAkmStashPath() {
-	return `${userHome()}/akm`;
-}
-/** The user's personal akm config file — its existence is our availability signal. */
-function hostAkmConfigPath() {
-	return `${userHome()}/.config/akm/config.json`;
-}
-/** True when AKM is initialized on the host (personal config exists). */
-function isHostAkmAvailable() {
-	return existsSync(hostAkmConfigPath());
-}
-function stackEnvPath(state) {
-	return `${state.stashDir}/env/stack.env`;
+async function composeStats(options) {
+	const args = buildComposeArgs(options);
+	args.push("stats", "--no-stream", "--format", "json");
+	return run$1(args, void 0);
 }
 /**
-* Point OP_HOST_AKM_STASH at the host stash when AKM is available, else unset it
-* (compose then uses the empty-dir fallback). Pure infrastructure — does NOT
-* change the source list. Idempotent; safe to call on setup and on deploy.
+* Get recent Docker events for the compose project.
 */
-function ensureHostStashEnv(state) {
-	const path = stackEnvPath(state);
-	const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
-	const updated = isHostAkmAvailable() ? mergeEnvContent(existing, { [ENV_KEY]: hostAkmStashPath() }) : removeEnvKey(existing, ENV_KEY);
-	if (updated !== existing) writeFileAtomic(path, updated, 384);
+async function getDockerEvents(projectName, since = "1h") {
+	return run$1([
+		"events",
+		"--filter",
+		`label=com.docker.compose.project=${projectName}`,
+		"--since",
+		since,
+		"--until",
+		"now",
+		"--format",
+		"json"
+	], void 0, 15e3);
 }
+//#endregion
+//#region ../lib/src/control-plane/channels.ts
 /**
-* Enable host AKM sharing: ensure OP_HOST_AKM_STASH points at ~/akm and add the
-* writable `host-akm` secondary source to the assistant config. Optionally import
-* host LLM/agent profiles (read-only). Throws if host AKM is not available.
+* Channel validation, discovery, and allowlist checks for the OpenPalm control plane.
 */
-function enableHostAkmSharing(state, opts = {}) {
-	if (!isHostAkmAvailable()) throw new Error(`Host AKM is not available (no ${hostAkmConfigPath()}). Run \`akm init\` on the host first.`);
-	ensureHostStashEnv(state);
-	addHostStashToOpenpalmConfig(state, opts.writable ?? true);
-	let profilesImported = [];
-	if (opts.importProfiles) profilesImported = importHostProfiles(state, hostAkmConfigPath()).imported;
-	logger$5.info("host akm sharing enabled", {
-		hostStashPath: hostAkmStashPath(),
-		profilesImported
-	});
-	return { profilesImported };
+function addonComposePaths(homeDir) {
+	const paths = [];
+	for (const name of [
+		"channels.compose.yml",
+		"services.compose.yml",
+		"custom.compose.yml"
+	]) {
+		const composePath = `${homeDir}/config/stack/${name}`;
+		if (existsSync(composePath)) paths.push(composePath);
+	}
+	return paths;
 }
 /**
-* Disable host AKM sharing: remove the `host-akm` secondary source from the
-* assistant config. Leaves the (harmless) mount and env in place; never deletes
-* any stash content.
+* Check if a service name is allowed. Core services are always allowed.
+* Addon services are allowed if they appear as a compose service defined in
+* any active addon compose file. This is compose-derived: the actual compose
+* content is checked, not directory naming conventions.
 */
-function disableHostAkmSharing(state) {
-	removeHostAkmSource(state);
-	logger$5.info("host akm sharing disabled");
-}
-/** Report availability + whether the host-akm source is currently configured. */
-function getHostAkmSharingStatus(state) {
-	const available = isHostAkmAvailable();
-	return {
-		available,
-		enabled: openpalmHasHostSource(state),
-		hostStashPath: available ? hostAkmStashPath() : null
-	};
-}
-function openpalmHasHostSource(state) {
-	const path = `${state.configDir}/akm/config.json`;
-	if (!existsSync(path)) return false;
-	try {
-		const cfg = JSON.parse(readFileSync(path, "utf-8"));
-		return Array.isArray(cfg.sources) && cfg.sources.some((s) => s?.name === "host-akm");
-	} catch {
-		return false;
+function isAllowedService(value, configDir) {
+	if (!value || !value.trim() || value !== value.toLowerCase()) return false;
+	if (CORE_SERVICES.includes(value)) return true;
+	if (configDir) {
+		const homeDir = dirname(configDir);
+		for (const composePath of addonComposePaths(homeDir)) try {
+			const doc = (0, import_dist.parse)(readFileSync(composePath, "utf-8"));
+			if (typeof doc === "object" && doc !== null) {
+				const services = doc.services;
+				if (typeof services === "object" && services !== null && value in services) return true;
+			}
+		} catch {
+			continue;
+		}
 	}
+	return false;
 }
 //#endregion
-//#region ../lib/src/control-plane/rollback.ts
+//#region ../lib/src/control-plane/provider-models.ts
 /**
-* Snapshot-based rollback for the OpenPalm control plane.
+* Provider model discovery and API key resolution.
 *
-* Before writing validated changes to live paths, the current state
-* is snapshotted to OP_HOME/data/rollback/. On deploy failure
-* (or manual `openpalm rollback`), the snapshot is restored.
+* Used by the admin capabilities test endpoint and the CLI setup wizard
+* to enumerate the models a configured provider exposes.
 */
-/** Files that are tracked for rollback (relative to homeDir).
-*  Only config/ system files are included — user-editable config files
-*  are never overwritten by lifecycle operations. */
-var SNAPSHOT_FILES = [
-	"knowledge/env/stack.env",
-	"config/stack/services.compose.yml",
-	"config/stack/channels.compose.yml",
-	"config/stack/custom.compose.yml",
-	"knowledge/secrets/auth.json"
+/** Static model list for Anthropic (no listing API available). */
+var ANTHROPIC_MODELS = [
+	"claude-opus-4-6",
+	"claude-sonnet-4-6",
+	"claude-opus-4-20250514",
+	"claude-sonnet-4-20250514",
+	"claude-haiku-4-5-20251001",
+	"claude-3-5-sonnet-20241022",
+	"claude-3-5-haiku-20241022"
 ];
 /**
-* Copy a file if it exists, creating parent directories as needed.
+* Resolve an API key reference.
+*
+* - Empty input → empty string.
+* - `env:NAME` form → looks up `NAME` in `process.env` first, then falls back
+*   to `knowledge/secrets/<NAME>` resolved against `stackDir`.
+* - Anything else → returned verbatim (treated as a literal key value).
 */
-function safeCopy(src, dest) {
-	if (!existsSync(src)) return;
-	mkdirSync(dirname(dest), { recursive: true });
-	copyFileSync(src, dest);
+function resolveApiKey(apiKeyRef, stackDir) {
+	if (!apiKeyRef) return "";
+	if (!apiKeyRef.startsWith("env:")) return apiKeyRef;
+	const varName = apiKeyRef.slice(4);
+	if (process.env[varName]) return process.env[varName];
+	return readStackRuntimeEnv(stackDir)[varName] ?? "";
 }
+var HTTP_STATUS_LABELS = {
+	401: "Invalid or missing API key",
+	403: "Access denied — check API key permissions",
+	404: "Endpoint not found — verify the base URL",
+	429: "Rate limited — try again shortly",
+	500: "Provider internal error",
+	502: "Provider returned a bad gateway error",
+	503: "Provider is temporarily unavailable"
+};
 /**
-* Save the current live configuration files to the rollback directory.
-* Also snapshots stack/core.compose.yml.
+* Enumerate available models for a provider. Returns an `ok` result with a
+* sorted model list when the provider responds successfully, or a
+* `recoverable_error` with a structured reason otherwise. Network and timeout
+* failures are caught and mapped to a result rather than thrown.
 */
-function snapshotCurrentState(state) {
-	const rollbackDir = resolveRollbackDir();
-	mkdirSync(rollbackDir, { recursive: true });
-	for (const rel of SNAPSHOT_FILES) safeCopy(join(state.homeDir, rel), join(rollbackDir, rel));
-	safeCopy(join(state.homeDir, "config/stack/core.compose.yml"), join(rollbackDir, "config/stack/core.compose.yml"));
-	writeFileSync(join(rollbackDir, ".snapshot-ts"), (/* @__PURE__ */ new Date()).toISOString() + "\n");
-}
-//#endregion
-//#region ../lib/src/control-plane/secret-mappings.ts
-var STATIC_CORE_MAPPINGS = [
-	{
-		secretKey: "openpalm/ui-login-password",
-		envKey: "OP_UI_LOGIN_PASSWORD",
-		scope: "system"
-	},
-	{
-		secretKey: "openpalm/opencode/server-password",
-		envKey: "OP_OPENCODE_PASSWORD",
-		scope: "system"
-	},
-	{
-		secretKey: "openpalm/openai/api-key",
-		envKey: "OPENAI_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/anthropic/api-key",
-		envKey: "ANTHROPIC_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/groq/api-key",
-		envKey: "GROQ_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/mistral/api-key",
-		envKey: "MISTRAL_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/google/api-key",
-		envKey: "GOOGLE_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/together/api-key",
-		envKey: "TOGETHER_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/deepseek/api-key",
-		envKey: "DEEPSEEK_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/xai/api-key",
-		envKey: "XAI_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/huggingface/token",
-		envKey: "HF_TOKEN",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/mcp/api-key",
-		envKey: "MCP_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/embedding/api-key",
-		envKey: "EMBEDDING_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/lmstudio/api-key",
-		envKey: "LMSTUDIO_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/discord/bot-token",
-		envKey: "DISCORD_BOT_TOKEN",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/slack/bot-token",
-		envKey: "SLACK_BOT_TOKEN",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/slack/app-token",
-		envKey: "SLACK_APP_TOKEN",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/voice/stt-api-key",
-		envKey: "STT_API_KEY",
-		scope: "user"
-	},
-	{
-		secretKey: "openpalm/voice/tts-api-key",
-		envKey: "TTS_API_KEY",
-		scope: "user"
-	}
-];
-function getCoreSecretMappings(systemEnv) {
-	const dynamicMappings = [];
-	for (const envKey of Object.keys(systemEnv)) {
-		const match = envKey.match(/^CHANNEL_([A-Z0-9_]+)_SECRET$/);
-		if (!match?.[1]) continue;
-		dynamicMappings.push({
-			secretKey: `openpalm/channel/${match[1].toLowerCase()}/secret`,
-			envKey,
-			scope: "system"
+async function fetchProviderModels(provider, apiKeyRef, baseUrl, stackDir) {
+	try {
+		if (provider === "anthropic") return {
+			models: [...ANTHROPIC_MODELS],
+			status: "ok",
+			reason: "provider_static"
+		};
+		const resolvedKey = resolveApiKey(apiKeyRef, stackDir);
+		if (provider === "ollama") {
+			const url = `${(baseUrl?.trim() || PROVIDER_DEFAULT_URLS.ollama).replace(/\/+$/, "")}/api/tags`;
+			const res = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+			if (!res.ok) return {
+				models: [],
+				status: "recoverable_error",
+				reason: "provider_http",
+				error: `Ollama API returned ${res.status}: ${HTTP_STATUS_LABELS[res.status] ?? `HTTP ${res.status}`}`
+			};
+			return {
+				models: ((await res.json()).models ?? []).map((m) => m.name).sort(),
+				status: "ok",
+				reason: "none"
+			};
+		}
+		const base = baseUrl?.trim() || PROVIDER_DEFAULT_URLS[provider] || "";
+		if (!base) return {
+			models: [],
+			status: "recoverable_error",
+			reason: "missing_base_url",
+			error: `No base URL configured for provider "${provider}"`
+		};
+		const url = `${base.replace(/\/+$/, "")}/v1/models`;
+		const headers = {};
+		if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
+		const res = await fetch(url, {
+			headers,
+			signal: AbortSignal.timeout(5e3)
 		});
+		if (!res.ok) {
+			let detail = "";
+			try {
+				const json = JSON.parse(await res.text());
+				const errObj = json.error;
+				detail = typeof errObj === "object" && errObj !== null && typeof errObj.message === "string" ? errObj.message : typeof errObj === "string" ? errObj : typeof json.message === "string" ? json.message : typeof json.detail === "string" ? json.detail : "";
+			} catch {}
+			return {
+				models: [],
+				status: "recoverable_error",
+				reason: "provider_http",
+				error: detail ? `Provider API returned ${res.status}: ${detail}` : `Provider API returned ${res.status}: ${HTTP_STATUS_LABELS[res.status] ?? `HTTP ${res.status}`}`
+			};
+		}
+		return {
+			models: ((await res.json()).data ?? []).map((m) => m.id).sort(),
+			status: "ok",
+			reason: "none"
+		};
+	} catch (err) {
+		const message = err instanceof Error && err.name === "TimeoutError" ? "Request timed out after 5s" : String(err);
+		return {
+			models: [],
+			status: "recoverable_error",
+			reason: err instanceof Error && err.name === "TimeoutError" ? "timeout" : "network",
+			error: message
+		};
 	}
-	return [...STATIC_CORE_MAPPINGS, ...dynamicMappings];
 }
 //#endregion
-//#region ../lib/src/control-plane/validate.ts
+//#region ../lib/src/control-plane/fs-atomic.ts
 /**
-* Runtime configuration validation for the OpenPalm control plane.
+* Write a file atomically: write to `${path}.tmp` then rename over the target.
+* The rename is atomic on the same filesystem, so readers never observe a
+* partially written file. `mode` (e.g. 0o600) is applied on creation.
 *
-* Validation is a presence check on the canonical env keys we expect in
-* the live config/stack files. The
-* historical schema files and external validation binary were retired in
-* #391; everything advisory is surfaced as a non-blocking warning. The
-* function never shells out and never reads schemas.
+* Shared by all control-plane writers (setup, akm-sources, …) so config and
+* secret files are written through one audited path — never hand-rolled.
 */
-var REQUIRED_SECRET_KEYS = ["OP_UI_LOGIN_PASSWORD"];
+function writeFileAtomic(path, content, mode) {
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, content, { mode } );
+	renameSync(tmp, path);
+}
+//#endregion
+//#region ../lib/src/control-plane/akm-sources.ts
 /**
-* Validate the live configuration files.
+* Host ↔ Assistant AKM source wiring (control-plane logic — lives in lib).
 *
-* Checks:
-* 1. knowledge/env/stack.env exists and carries every required key with a
-*    non-empty value.
-* 2. Every secret env key in getCoreSecretMappings() is present (key only
-*    — blank values are warned about, never erred on, because operators
-*    may opt out of providers they don't use).
+* Implements the "symmetric writable secondary" design
+* (docs/technical/akm-host-assistant-integration-proposal.md §8).
 *
-* Errors fail the result. Warnings do not. The function never reads
-* schema files and never spawns subprocesses.
+* Each akm instance keeps its OWN primary stash, data dir, and cache. Sharing
+* is done purely by adding the other instance's stash as a *secondary* source
+* in `config.sources[]`:
+*   - The OpenPalm/container config gains a `host-akm` source → /host-stash
+*     (the user's personal ~/akm, bind-mounted by the host-akm.compose.yml overlay).
+*   - The personal config gains an `openpalm` source → OP_HOME/knowledge.
+*
+* VERIFIED against akm 0.8.0 (rc.13 → stable; schema unchanged):
+*  - `SourceConfigEntrySchema` (config-schema.ts:259) accepts
+*    { type, path?, url?, name?, enabled?, writable?, primary?, options?, wikiName? }.
+*  - The indexer's `resolveSourceEntries` (search-source.ts:56) ALWAYS injects the
+*    env-resolved primary stash (AKM_STASH_DIR) as sources[0], then appends
+*    config.sources[] deduped by path. So a secondary entry can never strand or
+*    displace the primary — provided we NEVER set `primary:true` and NEVER set
+*    `config.stashDir`.
+*  - Writes resolve to the primary unless an explicit `--target` is given
+*    (write-source.ts) and `defaultWriteTarget` is left unset, so a writable
+*    secondary is safe by construction.
+*
+* Invariants (enforced + unit-tested):
+*  - Only ever appends/updates a NAMED source (idempotent upsert by name).
+*  - NEVER sets `primary`, NEVER sets `defaultWriteTarget`, NEVER sets `stashDir`.
+*  - Atomic 0600 writes.
+*  - The OpenPalm config is parse-tolerant (we own it: corrupt → start from {}).
+*  - The PERSONAL config FAILS CLOSED (corrupt/unreadable → throw, never overwrite
+*    the user's file). This asymmetry is the host-data-loss guard.
 */
-async function validateProposedState(state) {
-	const errors = [];
-	const warnings = [];
-	const stackEnvPath = `${state.stashDir}/env/stack.env`;
-	if (!existsSync(stackEnvPath)) {
-		errors.push(`ERROR: stack env file missing at ${stackEnvPath}`);
-		return {
-			ok: false,
-			errors,
-			warnings
-		};
-	}
-	const runtimeEnv = readStackRuntimeEnv(state.stackDir);
-	for (const key of REQUIRED_SECRET_KEYS) {
-		const value = runtimeEnv[key];
-		if (!value || value.trim().length === 0) errors.push(`ERROR: required secret ${key} is missing or empty in knowledge/secrets/${key.toLowerCase()}`);
+/** Source entry name added to the OpenPalm/container config (points at /host-stash). */
+var HOST_SOURCE_NAME = "host-akm";
+function readConfigTolerant(configPath) {
+	if (!existsSync(configPath)) return {};
+	try {
+		const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+		return parsed && typeof parsed === "object" ? parsed : {};
+	} catch {
+		return {};
 	}
-	for (const mapping of getCoreSecretMappings(runtimeEnv)) if (!Object.prototype.hasOwnProperty.call(runtimeEnv, mapping.envKey)) warnings.push(`WARN: ${mapping.envKey} (akm ${mapping.secretKey}) is not declared in knowledge/secrets/${mapping.envKey.toLowerCase()}`);
-	return {
-		ok: errors.length === 0,
-		errors,
-		warnings
-	};
-}
-/** Execute docker with an argument array — no shell interpolation. */
-function run$1(args, cwd, timeoutMs = 12e4, envOverrides) {
-	return new Promise((resolve) => {
-		execFile("docker", args, {
-			cwd,
-			timeout: timeoutMs,
-			env: {
-				...process.env,
-				...envOverrides
-			}
-		}, (error, stdout, stderr) => {
-			resolve({
-				ok: !error,
-				stdout: stdout?.toString() ?? "",
-				stderr: stderr?.toString() ?? "",
-				code: error?.code ? Number(error.code) : 0
-			});
-		});
-	});
-}
-/**
-* Resolve the Docker Compose project name.
-* Honors OP_PROJECT_NAME first for OpenPalm stacks, then COMPOSE_PROJECT_NAME.
-*/
-function resolveComposeProjectName(envOverrides = {}) {
-	return envOverrides.OP_PROJECT_NAME?.trim() || envOverrides.COMPOSE_PROJECT_NAME?.trim() || process.env.OP_PROJECT_NAME?.trim() || process.env.COMPOSE_PROJECT_NAME?.trim() || "openpalm";
 }
-/**
-* Decide whether a running compose project (identified by its
-* `com.docker.compose.project.working_dir` label) is OURS — i.e. was launched
-* from this install's working dir. An empty/unknown label can't prove foreign,
-* so it counts as ours (reconcile rather than wrongly refuse a redeploy).
-*
-* Pure decision split out from detectExistingProject so the ours-vs-foreign
-* rule is unit-testable without a Docker daemon.
-*/
-function isProjectOurs(workingDirLabel, expectedWorkingDir) {
-	const label = workingDirLabel.trim();
-	return label === "" || label === expectedWorkingDir;
+function readConfigFailClosed(configPath) {
+	if (!existsSync(configPath)) throw new Error(`Personal akm config not found at ${configPath}; refusing to create it. Run \`akm init\`/\`akm setup\` first, then enable host AKM sharing.`);
+	let text;
+	try {
+		text = readFileSync(configPath, "utf-8");
+	} catch (err) {
+		throw new Error(`Unable to read personal akm config at ${configPath}: ${err.message}`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error(`Personal akm config at ${configPath} is not valid JSON; refusing to overwrite it. Fix the file by hand, then retry.`);
+	}
+	if (!parsed || typeof parsed !== "object") throw new Error(`Personal akm config at ${configPath} is not a JSON object; refusing to overwrite it.`);
+	return parsed;
 }
 /**
-* Probe the Docker daemon for a running compose project that shares
-* `projectName`. Decides ours-vs-foreign by comparing the project's
-* `com.docker.compose.project.working_dir` label against `expectedWorkingDir`
-* (the install's OP_HOME / compose context).
-*
-* Returns `{ exists:false }` on any docker error (daemon down, no permission) —
-* detection is best-effort and never blocks the caller; a real failure surfaces
-* later through composeUp.
+* Upsert a named filesystem source into `config.sources[]` by name. Idempotent.
+* NEVER touches `primary`, `defaultWriteTarget`, or `stashDir`.
 */
-function detectExistingProject(opts) {
-	const none = {
-		exists: false,
-		isOurs: false,
-		workingDir: ""
+function upsertSource(config, entry) {
+	const sources = Array.isArray(config.sources) ? [...config.sources] : [];
+	const idx = sources.findIndex((s) => s && typeof s === "object" && s.name === entry.name);
+	if (idx >= 0) sources[idx] = {
+		...sources[idx],
+		...entry
+	};
+	else sources.push(entry);
+	return {
+		...config,
+		sources
 	};
-	return new Promise((resolve) => {
-		execFile("docker", [
-			"ps",
-			"-q",
-			"--filter",
-			`label=com.docker.compose.project=${opts.projectName}`
-		], { timeout: 1e4 }, (err, stdout) => {
-			if (err) return resolve(none);
-			const ids = stdout.toString().trim().split(/\s+/).filter(Boolean);
-			if (ids.length === 0) return resolve(none);
-			execFile("docker", [
-				"inspect",
-				"--format",
-				"{{ index .Config.Labels \"com.docker.compose.project.working_dir\" }}",
-				ids[0]
-			], { timeout: 1e4 }, (err2, stdout2) => {
-				if (err2) return resolve({
-					exists: true,
-					isOurs: false,
-					workingDir: ""
-				});
-				const workingDir = stdout2.toString().trim();
-				resolve({
-					exists: true,
-					isOurs: isProjectOurs(workingDir, opts.expectedWorkingDir),
-					workingDir
-				});
-			});
-		});
-	});
-}
-/** Check if Docker is available */
-async function checkDocker() {
-	return new Promise((resolve) => {
-		execFile("docker", [
-			"info",
-			"--format",
-			"{{.ServerVersion}}"
-		], (error, stdout, stderr) => {
-			const stdoutStr = stdout?.toString().trim() ?? "";
-			const stderrStr = stderr?.toString() ?? "";
-			resolve({
-				ok: stdoutStr.length > 0 || !error,
-				stdout: stdoutStr,
-				stderr: stderrStr,
-				code: error?.code ? Number(error.code) : 0
-			});
-		});
-	});
-}
-/** Check if docker compose is available */
-async function checkDockerCompose() {
-	return new Promise((resolve) => {
-		execFile("docker", ["compose", "version"], (error, stdout, stderr) => {
-			resolve({
-				ok: !error,
-				stdout: stdout?.toString() ?? "",
-				stderr: stderr?.toString() ?? "",
-				code: error?.code ? Number(error.code) : 0
-			});
-		});
-	});
 }
-/** Build common prefix: compose -f ... --project-name ... --env-file ... --profile ... */
-function buildComposeArgs(options) {
-	const envOverrides = collectEnvOverrides(options.envFiles);
-	const args = [
-		"compose",
-		...options.files.flatMap((f) => ["-f", f]),
-		"--project-name",
-		resolveComposeProjectName(envOverrides)
-	];
-	for (const ef of options.envFiles ?? []) if (existsSync(ef)) args.push("--env-file", ef);
-	for (const p of options.profiles ?? []) args.push("--profile", p);
-	return args;
+function removeSource(config, name) {
+	if (!Array.isArray(config.sources)) return config;
+	const sources = config.sources.filter((s) => !(s && typeof s === "object" && s.name === name));
+	return {
+		...config,
+		sources
+	};
 }
-/** Merge all env files into a single overrides object for process env. */
-function collectEnvOverrides(envFiles) {
-	const overrides = {};
-	for (const ef of envFiles ?? []) Object.assign(overrides, parseEnvFile(ef));
-	return overrides;
+function assertNoPrimaryEscalation(entry) {
+	if (entry.primary !== void 0) throw new Error("akm-sources: refusing to write a source entry carrying `primary`.");
+}
+function openpalmConfigPath(state) {
+	return join(state.configDir, "akm", "config.json");
 }
 /**
-* Run `docker compose config` to validate compose file merge and variable substitution.
-* Must be called before any lifecycle mutation (install/apply/update).
+* Container/OpenPalm side: add the personal stash (mounted at /host-stash) as a
+* secondary source. Parse-tolerant (we own this config). Writable by default so
+* the assistant can contribute back via an explicit `--target host-akm`.
 */
-async function composePreflight(options) {
-	const args = buildComposeArgs(options);
-	args.push("config", "--quiet");
-	return run$1(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
+function addHostStashToOpenpalmConfig(state, writable = true) {
+	const configPath = openpalmConfigPath(state);
+	const entry = {
+		type: "filesystem",
+		path: "/host-stash",
+		name: HOST_SOURCE_NAME,
+		writable,
+		enabled: true
+	};
+	assertNoPrimaryEscalation(entry);
+	const updated = upsertSource(readConfigTolerant(configPath), entry);
+	writeFileAtomic(configPath, JSON.stringify(updated, null, 2), 384);
 }
 /**
-* Run compose config preflight validation before any mutation.
-* Skipped when OP_SKIP_COMPOSE_PREFLIGHT is set (tests, CI).
+* Remove the `host-akm` secondary source from the assistant config (disable
+* sharing). Parse-tolerant; never touches the user's personal config (D1 —
+* host sharing is assistant-reads-host only). Idempotent.
 */
-async function runPreflight(options) {
-	if (options.files.length === 0 || process.env.OP_SKIP_COMPOSE_PREFLIGHT) return;
-	const result = await composePreflight(options);
-	if (!result.ok) {
-		const project = resolveComposeProjectName(collectEnvOverrides(options.envFiles));
-		const fileArgs = options.files.map((f) => `-f ${f}`).join(" ");
-		const envArgs = (options.envFiles ?? []).map((f) => `--env-file ${f}`).join(" ");
-		const profileArgs = (options.profiles ?? []).map((p) => `--profile ${p}`).join(" ");
-		throw new Error(`Compose preflight failed: ${result.stderr}\nResolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} ${profileArgs} config --quiet`);
-	}
+function removeHostAkmSource(state) {
+	const opPath = openpalmConfigPath(state);
+	const opConfig = readConfigTolerant(opPath);
+	writeFileAtomic(opPath, JSON.stringify(removeSource(opConfig, HOST_SOURCE_NAME), null, 2), 384);
 }
-async function composeConfigServices(options) {
-	const args = buildComposeArgs(options);
-	args.push("config", "--services");
-	const result = await run$1(args, void 0, 3e4, collectEnvOverrides(options.envFiles));
-	if (!result.ok) return {
-		ok: false,
-		services: []
-	};
-	return {
-		ok: true,
-		services: result.stdout.split("\n").map((s) => s.trim()).filter(Boolean)
+/**
+* Read-only snapshot import of the host's reusable akm config into the OpenPalm
+* config. Reads the personal config READ-ONLY; never writes back to the host.
+*
+* ADDITIVE MERGE: existing OpenPalm values ALWAYS win — the host only fills gaps.
+* A profile name, default selection, or embedding field that OpenPalm already has
+* is never overwritten; host-only profiles/fields are added. Covers the
+* LLM/agent/improve PROFILES (+ their `defaults.*`) and the top-level `embedding`
+* connection. Returns which sections actually gained values.
+*
+* Writes the canonical akm 0.8.0 shape (profiles.* + defaults.* + embedding) —
+* never the legacy top-level `llm` (see I-3). NEVER touches `sources`, `stashDir`,
+* `registries`, or `installed`.
+*/
+function importHostProfiles(state, hostConfigPath) {
+	const host = readConfigFailClosed(hostConfigPath);
+	const hostProfiles = host.profiles ?? {};
+	const hostDefaults = host.defaults ?? {};
+	const opPath = openpalmConfigPath(state);
+	const op = readConfigTolerant(opPath);
+	const opProfiles = op.profiles ?? {};
+	const opDefaults = op.defaults ?? {};
+	const imported = [];
+	const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+	for (const ns of [
+		"llm",
+		"agent",
+		"improve"
+	]) {
+		if (isObj(hostProfiles[ns])) {
+			const existing = isObj(opProfiles[ns]) ? opProfiles[ns] : {};
+			const merged = {
+				...hostProfiles[ns],
+				...existing
+			};
+			const added = Object.keys(merged).length - Object.keys(existing).length;
+			opProfiles[ns] = merged;
+			if (added > 0) imported.push(`profiles.${ns}`);
+		}
+		if (typeof hostDefaults[ns] === "string" && typeof opDefaults[ns] !== "string") {
+			opDefaults[ns] = hostDefaults[ns];
+			imported.push(`defaults.${ns}`);
+		}
+	}
+	let embedding;
+	if (isObj(host.embedding)) {
+		const existing = isObj(op.embedding) ? op.embedding : {};
+		const merged = {
+			...host.embedding,
+			...existing
+		};
+		if (Object.keys(merged).length > Object.keys(existing).length) {
+			embedding = merged;
+			imported.push("embedding");
+		}
+	}
+	if (imported.length === 0) return { imported };
+	const updated = {
+		...op,
+		profiles: opProfiles,
+		defaults: opDefaults
 	};
+	if (embedding !== void 0) updated.embedding = embedding;
+	delete updated.llm;
+	writeFileAtomic(opPath, JSON.stringify(updated, null, 2), 384);
+	return { imported };
 }
+//#endregion
+//#region ../lib/src/control-plane/host-akm-sharing.ts
 /**
-* Run `docker compose up -d` with the generated compose file(s).
-* Pass `files` to merge multiple compose overlays (e.g. core + addon files).
+* Host AKM sharing (control-plane logic — lives in lib).
+*
+* Simplified model (no compose overlay, no file-presence gating):
+*
+*  - The assistant ALWAYS mounts `/host-stash` (core.compose.yml). When the host
+*    has AKM, OP_HOST_AKM_STASH points at the user's personal stash (~/akm);
+*    otherwise it is unset and compose falls back to an always-present empty dir.
+*  - "Sharing" is purely a writable SECONDARY source entry named `host-akm` →
+*    /host-stash in the assistant's config/akm/config.json. Adding it = enabled;
+*    removing it = disabled. akm resolves writes to the primary unless an explicit
+*    --target is given, and silently skips a source whose dir is empty/missing —
+*    so a mounted-but-unconfigured /host-stash is harmless.
+*  - Host availability is detected from the presence of the user's personal akm
+*    CONFIG (~/.config/akm/config.json) — the real signal that akm is initialized.
+*
+* Decision D1 (2026-06-03): host sharing is assistant-reads-host ONLY by default.
+* We never write into the user's personal ~/.config/akm here. (Letting the host
+* akm see OpenPalm's knowledge is a future, explicit opt-in.)
 */
-async function composeUp(options) {
-	await runPreflight(options);
-	if (!existsSync(options.files[0])) return {
-		ok: false,
-		stdout: "",
-		stderr: "Compose file not found",
-		code: 1
-	};
-	const args = buildComposeArgs(options);
-	args.push("up", "-d");
-	if (options.forceRecreate) args.push("--force-recreate");
-	if (options.removeOrphans) args.push("--remove-orphans");
-	if (options.services?.length) args.push(...options.services);
-	return run$1(args, void 0, composeUpTimeoutMs(), collectEnvOverrides(options.envFiles));
+var logger$5 = createLogger("host-akm-sharing");
+var ENV_KEY = "OP_HOST_AKM_STASH";
+function userHome() {
+	return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
+}
+/** The user's personal akm stash dir (mounted into the assistant at /host-stash). */
+function hostAkmStashPath() {
+	return `${userHome()}/akm`;
+}
+/** The user's personal akm config file — its existence is our availability signal. */
+function hostAkmConfigPath() {
+	return `${userHome()}/.config/akm/config.json`;
+}
+/** True when AKM is initialized on the host (personal config exists). */
+function isHostAkmAvailable() {
+	return existsSync(hostAkmConfigPath());
+}
+function stackEnvPath(state) {
+	return `${state.stashDir}/env/stack.env`;
 }
 /**
-* Timeout budget for `compose up`. A first install extracts multi-GB images
-* (voice CUDA ~7.6 GB) onto slow disks; the previous hard 5-minute cap
-* SIGTERM-killed the start mid-extraction and surfaced as an empty/opaque
-* error. Default 30 min, override with OP_COMPOSE_UP_TIMEOUT_MS. Kept bounded
-* (never removed) so a genuinely hung start still eventually fails.
+* Point OP_HOST_AKM_STASH at the host stash when AKM is available, else unset it
+* (compose then uses the empty-dir fallback). Pure infrastructure — does NOT
+* change the source list. Idempotent; safe to call on setup and on deploy.
 */
-function composeUpTimeoutMs() {
-	const raw = process.env.OP_COMPOSE_UP_TIMEOUT_MS?.trim();
-	const parsed = raw ? Number(raw) : NaN;
-	if (Number.isFinite(parsed) && parsed > 0) return parsed;
-	return 30 * 6e4;
+function ensureHostStashEnv(state) {
+	const path = stackEnvPath(state);
+	const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
+	const updated = isHostAkmAvailable() ? mergeEnvContent(existing, { [ENV_KEY]: hostAkmStashPath() }) : removeEnvKey(existing, ENV_KEY);
+	if (updated !== existing) writeFileAtomic(path, updated, 384);
 }
 /**
-* Run `docker compose down` to stop and remove containers.
+* Enable host AKM sharing: ensure OP_HOST_AKM_STASH points at ~/akm and add the
+* writable `host-akm` secondary source to the assistant config. Optionally import
+* host LLM/agent profiles (read-only). Throws if host AKM is not available.
 */
-async function composeDown(options) {
-	await runPreflight(options);
-	if (!existsSync(options.files[0])) return {
-		ok: false,
-		stdout: "",
-		stderr: "Compose file not found",
-		code: 1
-	};
-	const args = buildComposeArgs(options);
-	args.push("down");
-	if (options.removeVolumes) args.push("-v");
-	if (options.removeOrphans) args.push("--remove-orphans");
-	return run$1(args, void 0);
+function enableHostAkmSharing(state, opts = {}) {
+	if (!isHostAkmAvailable()) throw new Error(`Host AKM is not available (no ${hostAkmConfigPath()}). Run \`akm init\` on the host first.`);
+	ensureHostStashEnv(state);
+	addHostStashToOpenpalmConfig(state, opts.writable ?? true);
+	let profilesImported = [];
+	if (opts.importProfiles) profilesImported = importHostProfiles(state, hostAkmConfigPath()).imported;
+	logger$5.info("host akm sharing enabled", {
+		hostStashPath: hostAkmStashPath(),
+		profilesImported
+	});
+	return { profilesImported };
 }
 /**
-* Restart specific services.
+* Disable host AKM sharing: remove the `host-akm` secondary source from the
+* assistant config. Leaves the (harmless) mount and env in place; never deletes
+* any stash content.
 */
-async function composeRestart(services, options) {
-	await runPreflight(options);
-	const primaryFile = options.files[0];
-	if (!existsSync(primaryFile)) return {
-		ok: false,
-		stdout: "",
-		stderr: "Compose file not found",
-		code: 1
-	};
-	const args = buildComposeArgs(options);
-	args.push("restart", ...services);
-	return run$1(args, void 0);
+function disableHostAkmSharing(state) {
+	removeHostAkmSource(state);
+	logger$5.info("host akm sharing disabled");
+}
+/** Report availability + whether the host-akm source is currently configured. */
+function getHostAkmSharingStatus(state) {
+	const available = isHostAkmAvailable();
+	return {
+		available,
+		enabled: openpalmHasHostSource(state),
+		hostStashPath: available ? hostAkmStashPath() : null
+	};
 }
-/**
-* Stop specific services.
-*/
-async function composeStop(services, options) {
-	await runPreflight(options);
-	const args = buildComposeArgs(options);
-	args.push("stop", ...services);
-	return run$1(args, void 0);
+function openpalmHasHostSource(state) {
+	const path = `${state.configDir}/akm/config.json`;
+	if (!existsSync(path)) return false;
+	try {
+		const cfg = JSON.parse(readFileSync(path, "utf-8"));
+		return Array.isArray(cfg.sources) && cfg.sources.some((s) => s?.name === "host-akm");
+	} catch {
+		return false;
+	}
 }
+//#endregion
+//#region ../lib/src/control-plane/rollback.ts
 /**
-* Start specific services (must already be created).
+* Snapshot-based rollback for the OpenPalm control plane.
+*
+* Before writing validated changes to live paths, the current state
+* is snapshotted to OP_HOME/data/rollback/. On deploy failure
+* (or manual `openpalm rollback`), the snapshot is restored.
 */
-async function composeStart(services, options) {
-	await runPreflight(options);
-	const args = buildComposeArgs(options);
-	args.push("up", "-d", ...services);
-	return run$1(args, void 0);
-}
+/** Files that are tracked for rollback (relative to homeDir).
+*  Only config/ system files are included — user-editable config files
+*  are never overwritten by lifecycle operations. */
+var SNAPSHOT_FILES = [
+	"knowledge/env/stack.env",
+	"config/stack/services.compose.yml",
+	"config/stack/channels.compose.yml",
+	"config/stack/custom.compose.yml",
+	"knowledge/secrets/auth.json"
+];
 /**
-* Get the status of all containers in the project.
+* Copy a file if it exists, creating parent directories as needed.
 */
-async function composePs(options) {
-	const primaryFile = options.files[0];
-	if (!existsSync(primaryFile)) return run$1([
-		"ps",
-		"--filter",
-		`label=com.docker.compose.project=${resolveComposeProjectName()}`,
-		"--format",
-		"json"
-	], void 0);
-	const args = buildComposeArgs(options);
-	args.push("ps", "--format", "json");
-	return run$1(args, void 0);
+function safeCopy(src, dest) {
+	if (!existsSync(src)) return;
+	mkdirSync(dirname(dest), { recursive: true });
+	copyFileSync(src, dest);
 }
 /**
-* Get logs for specific services or all services.
+* Save the current live configuration files to the rollback directory.
+* Also snapshots stack/core.compose.yml.
 */
-async function composeLogs(services, tail, options) {
-	const args = buildComposeArgs(options);
-	args.push("logs", "--tail", String(tail));
-	if (options.since) args.push("--since", options.since);
-	if (services && services.length > 0) args.push(...services);
-	return run$1(args, void 0);
+function snapshotCurrentState(state) {
+	const rollbackDir = resolveRollbackDir();
+	mkdirSync(rollbackDir, { recursive: true });
+	for (const rel of SNAPSHOT_FILES) safeCopy(join(state.homeDir, rel), join(rollbackDir, rel));
+	safeCopy(join(state.homeDir, "config/stack/core.compose.yml"), join(rollbackDir, "config/stack/core.compose.yml"));
+	writeFileSync(join(rollbackDir, ".snapshot-ts"), (/* @__PURE__ */ new Date()).toISOString() + "\n");
 }
-var PULL_TIMEOUT_MS = 60 * 6e4;
-async function composePull(options) {
-	await runPreflight(options);
-	const args = buildComposeArgs(options);
-	args.push("pull");
-	return run$1(args, void 0, PULL_TIMEOUT_MS, collectEnvOverrides(options.envFiles));
+//#endregion
+//#region ../lib/src/control-plane/secret-mappings.ts
+var STATIC_CORE_MAPPINGS = [
+	{
+		secretKey: "openpalm/ui-login-password",
+		envKey: "OP_UI_LOGIN_PASSWORD",
+		scope: "system"
+	},
+	{
+		secretKey: "openpalm/opencode/server-password",
+		envKey: "OP_OPENCODE_PASSWORD",
+		scope: "system"
+	},
+	{
+		secretKey: "openpalm/openai/api-key",
+		envKey: "OPENAI_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/anthropic/api-key",
+		envKey: "ANTHROPIC_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/groq/api-key",
+		envKey: "GROQ_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/mistral/api-key",
+		envKey: "MISTRAL_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/google/api-key",
+		envKey: "GOOGLE_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/together/api-key",
+		envKey: "TOGETHER_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/deepseek/api-key",
+		envKey: "DEEPSEEK_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/xai/api-key",
+		envKey: "XAI_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/huggingface/token",
+		envKey: "HF_TOKEN",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/mcp/api-key",
+		envKey: "MCP_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/embedding/api-key",
+		envKey: "EMBEDDING_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/lmstudio/api-key",
+		envKey: "LMSTUDIO_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/discord/bot-token",
+		envKey: "DISCORD_BOT_TOKEN",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/slack/bot-token",
+		envKey: "SLACK_BOT_TOKEN",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/slack/app-token",
+		envKey: "SLACK_APP_TOKEN",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/voice/stt-api-key",
+		envKey: "STT_API_KEY",
+		scope: "user"
+	},
+	{
+		secretKey: "openpalm/voice/tts-api-key",
+		envKey: "TTS_API_KEY",
+		scope: "user"
+	}
+];
+function getCoreSecretMappings(systemEnv) {
+	const dynamicMappings = [];
+	for (const envKey of Object.keys(systemEnv)) {
+		const match = envKey.match(/^CHANNEL_([A-Z0-9_]+)_SECRET$/);
+		if (!match?.[1]) continue;
+		dynamicMappings.push({
+			secretKey: `openpalm/channel/${match[1].toLowerCase()}/secret`,
+			envKey,
+			scope: "system"
+		});
+	}
+	return [...STATIC_CORE_MAPPINGS, ...dynamicMappings];
 }
+//#endregion
+//#region ../lib/src/control-plane/validate.ts
 /**
-* Get resource usage stats for all containers in the project.
+* Runtime configuration validation for the OpenPalm control plane.
+*
+* Validation is a presence check on the canonical env keys we expect in
+* the live config/stack files. The
+* historical schema files and external validation binary were retired in
+* #391; everything advisory is surfaced as a non-blocking warning. The
+* function never shells out and never reads schemas.
 */
-async function composeStats(options) {
-	const args = buildComposeArgs(options);
-	args.push("stats", "--no-stream", "--format", "json");
-	return run$1(args, void 0);
-}
+var REQUIRED_SECRET_KEYS = ["OP_UI_LOGIN_PASSWORD"];
 /**
-* Get recent Docker events for the compose project.
+* Validate the live configuration files.
+*
+* Checks:
+* 1. knowledge/env/stack.env exists and carries every required key with a
+*    non-empty value.
+* 2. Every secret env key in getCoreSecretMappings() is present (key only
+*    — blank values are warned about, never erred on, because operators
+*    may opt out of providers they don't use).
+*
+* Errors fail the result. Warnings do not. The function never reads
+* schema files and never spawns subprocesses.
 */
-async function getDockerEvents(projectName, since = "1h") {
-	return run$1([
-		"events",
-		"--filter",
-		`label=com.docker.compose.project=${projectName}`,
-		"--since",
-		since,
-		"--until",
-		"now",
-		"--format",
-		"json"
-	], void 0, 15e3);
+async function validateProposedState(state) {
+	const errors = [];
+	const warnings = [];
+	const stackEnvPath = `${state.stashDir}/env/stack.env`;
+	if (!existsSync(stackEnvPath)) {
+		errors.push(`ERROR: stack env file missing at ${stackEnvPath}`);
+		return {
+			ok: false,
+			errors,
+			warnings
+		};
+	}
+	const runtimeEnv = readStackRuntimeEnv(state.stackDir);
+	for (const key of REQUIRED_SECRET_KEYS) {
+		const value = runtimeEnv[key];
+		if (!value || value.trim().length === 0) errors.push(`ERROR: required secret ${key} is missing or empty in knowledge/secrets/${key.toLowerCase()}`);
+	}
+	for (const mapping of getCoreSecretMappings(runtimeEnv)) if (!Object.prototype.hasOwnProperty.call(runtimeEnv, mapping.envKey)) warnings.push(`WARN: ${mapping.envKey} (akm ${mapping.secretKey}) is not declared in knowledge/secrets/${mapping.envKey.toLowerCase()}`);
+	return {
+		ok: errors.length === 0,
+		errors,
+		warnings
+	};
 }
 //#endregion
 //#region ../lib/src/control-plane/compose-args.ts
@@ -14878,4 +14878,4 @@ function importHostOpenCode(state, options = {}) {
 }
 
 export { hostAkmStashPath as $, AKM_USER_ENV_REF as A, createState as B, CORE_SERVICES as C, deleteUserEnvKey as D, detectExistingProject as E, detectGpu as F, detectHostOpenCode as G, detectLocalProviders as H, disableHostAkmSharing as I, enableHostAkmSharing as J, ensureAkmUserEnv as K, ensureHomeDirs as L, MigrationError as M, ensureMigrated as N, ensureOpenCodeConfig as O, PROVIDER_KEY_MAP as P, ensureOpenCodeSystemConfig as Q, ensureSecrets as R, executeAutomation as S, fetchProviderModels as T, getAddonProfileAvailability as U, getAddonProfileSelection as V, getAddonProfiles as W, getAddonServiceNames as X, getDockerEvents as Y, getHostAkmSharingStatus as Z, getRegistryAddonConfig as _, addonProfileId as a, importHostOpenCode as a0, isAllowedService as a1, isHostAkmAvailable as a2, isSetupComplete as a3, listAvailableAddonIds as a4, listEnabledAddonIds as a5, listSecretFiles as a6, loadAutomations as a7, parseComposeStderr as a8, parseEnvFile as a9, writeTaskFile as aA, writeUserEnvKey as aB, writeVoiceVars as aC, performSetup as aa, performUpgrade as ab, readAutomationLogs as ac, readSecret as ad, readSecretFile as ae, readStackEnv as af, readStackRuntimeEnv as ag, readStackSecretEnv as ah, readTaskFile as ai, readUserEnvFile as aj, recommendSetup as ak, removeSecretFile as al, removeTaskFile as am, resolveComposeProjectName as an, resolveDataDir as ao, resolveRuntimeFiles as ap, resolveStackDir as aq, seedUiBuild as ar, setAddonEnabled as as, setAddonProfileSelection as at, summarizeComposeStderr as au, validateProposedState as av, writeFileAtomic as aw, writeRuntimeFiles as ax, writeSecretFile as ay, writeStackSecretEnv as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEnv as j, buildComposeOptions as k, buildManagedServices as l, checkDocker as m, checkDockerCompose as n, composeDown as o, composeLogs as p, composePreflight as q, composePs as r, composePull as s, composeRestart as t, composeStart as u, composeStats as v, composeStop as w, composeUp as x, createLogger as y, createOpenCodeClient as z };
-//# sourceMappingURL=src-b3nBkyhY.js.map
+//# sourceMappingURL=src-DkGZ5D6n.js.map