@openpalm/ui 0.11.5-rc.3 → 0.11.5-rc.7

package/build/server/chunks/{src-CyeWH4Df.js → src-efp8mb8-.js}

@@ -181,6 +181,8 @@ function backupOpenPalmHome(homeDir) {
 	}
 	return copiedAny ? backupDir : null;
 }
+var package_default = {
+	version: "0.11.5-rc.5"};
 //#endregion
 //#region ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js
 var require_identity = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -7378,6 +7380,87 @@ function mergeEnvContent(content, updates, options = {}) {
 	return lines.join("\n");
 }
 //#endregion
+//#region ../lib/src/control-plane/image-tags.ts
+var PLATFORM_IMAGE_TAG_KEYS = [
+	"OP_ASSISTANT_IMAGE_TAG",
+	"OP_GUARDIAN_IMAGE_TAG",
+	"OP_CHANNEL_IMAGE_TAG"
+];
+/**
+* Build the stack.env image-tag entries for a platform release.
+*
+* `tag` is the platform version-of-record (the assistant tag). Per-image
+* overrides let guardian/channel ride an older published tag when a release
+* shipped only a subset of images (#477). OP_IMAGE_TAG stays as the compose
+* fallback for pre-per-image installs.
+*/
+function buildPlatformImageTagEnv(tag, perImage) {
+	return {
+		OP_IMAGE_TAG: tag,
+		OP_ASSISTANT_IMAGE_TAG: perImage?.OP_ASSISTANT_IMAGE_TAG ?? tag,
+		OP_GUARDIAN_IMAGE_TAG: perImage?.OP_GUARDIAN_IMAGE_TAG ?? tag,
+		OP_CHANNEL_IMAGE_TAG: perImage?.OP_CHANNEL_IMAGE_TAG ?? tag
+	};
+}
+//#endregion
+//#region ../lib/src/control-plane/versioning.ts
+var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
+function isComparableSemver(version) {
+	return !!version && SEMVER_RE.test(version.trim());
+}
+function parseComparableVersion(version) {
+	const clean = version.trim().replace(/^v/, "").split("+")[0];
+	const dashIdx = clean.indexOf("-");
+	const main = dashIdx === -1 ? clean : clean.slice(0, dashIdx);
+	const prerelease = dashIdx === -1 ? null : clean.slice(dashIdx + 1);
+	const [major = 0, minor = 0, patch = 0] = main.split(".").map(Number);
+	return {
+		major,
+		minor,
+		patch,
+		prerelease
+	};
+}
+function comparePrerelease(a, b) {
+	const aParts = a.split(".");
+	const bParts = b.split(".");
+	for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
+		if (i >= aParts.length) return -1;
+		if (i >= bParts.length) return 1;
+		const aNum = Number(aParts[i]);
+		const bNum = Number(bParts[i]);
+		const aIsNum = !Number.isNaN(aNum);
+		const bIsNum = !Number.isNaN(bNum);
+		if (aIsNum && bIsNum) {
+			if (aNum !== bNum) return aNum > bNum ? 1 : -1;
+			continue;
+		}
+		if (aIsNum !== bIsNum) return aIsNum ? -1 : 1;
+		if (aParts[i] !== bParts[i]) return aParts[i] > bParts[i] ? 1 : -1;
+	}
+	return 0;
+}
+function compareComparableVersions(a, b) {
+	const aParsed = parseComparableVersion(a);
+	const bParsed = parseComparableVersion(b);
+	if (aParsed.major !== bParsed.major) return aParsed.major > bParsed.major ? 1 : -1;
+	if (aParsed.minor !== bParsed.minor) return aParsed.minor > bParsed.minor ? 1 : -1;
+	if (aParsed.patch !== bParsed.patch) return aParsed.patch > bParsed.patch ? 1 : -1;
+	if (aParsed.prerelease === null && bParsed.prerelease !== null) return 1;
+	if (aParsed.prerelease !== null && bParsed.prerelease === null) return -1;
+	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
+	return 0;
+}
+function majorVersionOf(version) {
+	if (!isComparableSemver(version)) return null;
+	return parseComparableVersion(version).major;
+}
+function isSameMajorVersion(a, b) {
+	const aMajor = majorVersionOf(a);
+	const bMajor = majorVersionOf(b);
+	return aMajor !== null && bMajor !== null && aMajor === bMajor;
+}
+//#endregion
 //#region ../lib/src/control-plane/migrations.ts
 /**
 * On-disk layout migration harness.
@@ -7412,6 +7495,17 @@ var MigrationError = class extends Error {
 		this.name = "MigrationError";
 	}
 };
+var RELEASE_VERSION_KEY = "OP_RELEASE_VERSION";
+var CURRENT_RELEASE_VERSION = `v${package_default.version}`;
+function selectPendingReleaseMigrations(releaseFrom, targetVersion) {
+	if (!isComparableSemver(targetVersion)) return [];
+	return RELEASE_MIGRATIONS.filter((migration) => {
+		if (!isComparableSemver(migration.version)) return false;
+		if (compareComparableVersions(migration.version, targetVersion) > 0) return false;
+		if (releaseFrom === null || !isComparableSemver(releaseFrom)) return true;
+		return compareComparableVersions(migration.version, releaseFrom) > 0;
+	}).sort((a, b) => compareComparableVersions(a.version, b.version));
+}
 function stackEnvFile(stashDir) {
 	return join(stashDir, "env", "stack.env");
 }
@@ -7435,6 +7529,26 @@ function stampLayoutVersion(stashDir, version) {
 	if (!existsSync(envPath)) return;
 	writeFileSync(envPath, upsertEnvValue(readFileSync(envPath, "utf-8"), LAYOUT_VERSION_KEY, String(version)));
 }
+function readReleaseVersion(stashDir) {
+	const envPath = stackEnvFile(stashDir);
+	if (!existsSync(envPath)) return null;
+	let imageTagFallback = null;
+	for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+		const releaseMatch = line.match(/^OP_RELEASE_VERSION=(.+)\s*$/);
+		if (releaseMatch) return releaseMatch[1].trim();
+		const imageTagMatch = line.match(/^OP_IMAGE_TAG=(.+)\s*$/);
+		if (imageTagMatch && !imageTagFallback) imageTagFallback = imageTagMatch[1].trim();
+	}
+	return imageTagFallback;
+}
+function stampReleaseVersion(stashDir, version) {
+	const envPath = stackEnvFile(stashDir);
+	if (!existsSync(envPath)) return;
+	writeFileSync(envPath, upsertEnvValue(readFileSync(envPath, "utf-8"), RELEASE_VERSION_KEY, version));
+}
+function upsertMany(content, values) {
+	return Object.entries(values).reduce((next, [key, value]) => upsertEnvValue(next, key, value), content);
+}
 function ensureDir(ctx, dir) {
 	if (ctx.dryRun) {
 		ctx.log(`[dry-run] mkdir ${rel(ctx, dir)}`);
@@ -7476,6 +7590,20 @@ function writeFile600(ctx, path, content) {
 		chmodSync(path, 384);
 	} catch {}
 }
+function seedPerImageTagVars(ctx) {
+	const envPath = stackEnvFile(ctx.stashDir);
+	if (!existsSync(envPath)) return;
+	const current = readFileSync(envPath, "utf-8");
+	const imageTag = current.match(/^OP_IMAGE_TAG=(.+)$/m)?.[1]?.trim();
+	if (!imageTag) return;
+	if (PLATFORM_IMAGE_TAG_KEYS.filter((key) => !new RegExp(`^${key}=`, "m").test(current)).length === 0) return;
+	if (ctx.dryRun) {
+		ctx.log(`[dry-run] seed per-image tag vars from OP_IMAGE_TAG=${imageTag}`);
+		return;
+	}
+	writeFile600(ctx, envPath, upsertMany(current, buildPlatformImageTagEnv(imageTag)));
+	ctx.log(`seeded per-image tag vars from OP_IMAGE_TAG=${imageTag}`);
+}
 var SECRET_KEY_RE = /(_API_KEY|_TOKEN|_SECRET|_PASSWORD)$/;
 var CONFIG_KEY_RE = /^(OP_CAP_|SYSTEM_LLM_|EMBEDDING_)/;
 function migrate010to011(ctx) {
@@ -7631,6 +7759,19 @@ var MIGRATIONS = [{
 		if (!existsSync(stackEnvFile(ctx.stashDir))) throw new Error("post-migration check failed: knowledge/env/stack.env is missing");
 	}
 }];
+var RELEASE_MIGRATIONS = [{
+	version: "v0.11.5-rc.1",
+	describe: "seed per-image platform tags from OP_IMAGE_TAG",
+	apply: seedPerImageTagVars,
+	verify(ctx) {
+		if (ctx.dryRun) return;
+		const envPath = stackEnvFile(ctx.stashDir);
+		if (!existsSync(envPath)) return;
+		const content = readFileSync(envPath, "utf-8");
+		if (!/^OP_IMAGE_TAG=/m.test(content)) return;
+		for (const key of PLATFORM_IMAGE_TAG_KEYS) if (!new RegExp(`^${key}=`, "m").test(content)) throw new Error(`post-migration check failed: ${key} is missing`);
+	}
+}];
 var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. To recover, restore the backup (see docs/operations/backup-restore.md) or run the standalone migrator with --dry-run (scripts/migrate-0.10-to-0.11.sh / .ps1). Full guide: docs/operations/upgrade-0.10-to-0.11.md";
 /**
 * Ensure the home directory is migrated to the current layout. Safe to call at
@@ -7653,24 +7794,25 @@ function ensureMigrated(opts = {}) {
 		notes: []
 	};
 	const from = readLayoutVersion(ctxBase);
+	const releaseFrom = readReleaseVersion(stashDir);
 	const empty = {
 		migrated: false,
 		from,
 		to: from,
 		applied: [],
 		backupDir: null,
-		notes: []
+		notes: [],
+		releaseFrom,
+		releaseTo: CURRENT_RELEASE_VERSION,
+		releaseApplied: []
 	};
-	if (from >= 1) {
-		if (!dryRun) stampLayoutVersion(stashDir, 1);
-		return {
-			...empty,
-			to: 1
-		};
-	}
-	const pending = MIGRATIONS.filter((m) => m.from >= from && m.to <= 1).sort((a, b) => a.from - b.from);
-	if (pending.length === 0) {
-		if (!dryRun) stampLayoutVersion(stashDir, 1);
+	const pending = MIGRATIONS.filter((m) => m.from >= from && m.from < 1).sort((a, b) => a.from - b.from);
+	const pendingRelease = selectPendingReleaseMigrations(releaseFrom, CURRENT_RELEASE_VERSION);
+	if (pending.length === 0 && pendingRelease.length === 0) {
+		if (!dryRun) {
+			stampLayoutVersion(stashDir, 1);
+			stampReleaseVersion(stashDir, CURRENT_RELEASE_VERSION);
+		}
 		return {
 			...empty,
 			to: 1
@@ -7697,6 +7839,7 @@ function ensureMigrated(opts = {}) {
 			log(`Backup: ${backupDir}`);
 		}
 		const applied = [];
+		const releaseApplied = [];
 		const notes = [];
 		for (const m of pending) {
 			const ctx = {
@@ -7708,13 +7851,107 @@ function ensureMigrated(opts = {}) {
 			m.verify(ctx);
 			applied.push(`${m.from}->${m.to}`);
 		}
-		if (!dryRun) stampLayoutVersion(stashDir, 1);
+		for (const migration of pendingRelease) {
+			const ctx = {
+				...ctxBase,
+				notes
+			};
+			log(`Migrating release ${releaseFrom ?? "unknown"} → ${migration.version}: ${migration.describe}`);
+			migration.apply(ctx);
+			migration.verify(ctx);
+			releaseApplied.push(migration.version);
+		}
+		if (!dryRun) {
+			stampLayoutVersion(stashDir, 1);
+			stampReleaseVersion(stashDir, CURRENT_RELEASE_VERSION);
+		}
 		return {
 			migrated: true,
 			from,
 			to: 1,
 			applied,
 			backupDir,
+			notes,
+			releaseFrom,
+			releaseTo: CURRENT_RELEASE_VERSION,
+			releaseApplied
+		};
+	} catch (e) {
+		if (e instanceof MigrationError) throw e;
+		throw new MigrationError(`Migration failed: ${e instanceof Error ? e.message : String(e)}`, RECOVERY_GUIDANCE, backupDir);
+	} finally {
+		releaseInstallLock(lock);
+	}
+}
+function ensureReleaseMigrated(opts) {
+	const homeDir = opts.homeDir ?? resolveOpenPalmHome();
+	const dryRun = opts.dryRun ?? false;
+	const log = opts.log ?? (() => {});
+	const stashDir = resolveStashDir();
+	const targetVersion = opts.targetVersion.trim();
+	const releaseFrom = readReleaseVersion(stashDir);
+	const pendingRelease = selectPendingReleaseMigrations(releaseFrom, targetVersion);
+	const empty = {
+		migrated: false,
+		from: releaseFrom,
+		to: targetVersion,
+		applied: [],
+		backupDir: null,
+		notes: []
+	};
+	if (pendingRelease.length === 0) {
+		if (!dryRun && releaseFrom !== targetVersion) stampReleaseVersion(stashDir, targetVersion);
+		return empty;
+	}
+	const ctxBase = {
+		homeDir,
+		dataDir: resolveDataDir(),
+		stackDir: resolveStackDir(),
+		stashDir,
+		configDir: resolveConfigDir(),
+		dryRun,
+		log,
+		notes: []
+	};
+	let lock = null;
+	let backupDir = null;
+	try {
+		if (!dryRun) {
+			try {
+				mkdirSync(ctxBase.dataDir, { recursive: true });
+			} catch (e) {
+				throw new MigrationError(`Could not prepare the data directory: ${e instanceof Error ? e.message : String(e)}`, RECOVERY_GUIDANCE, null);
+			}
+			lock = acquireInstallLock(ctxBase.dataDir);
+			if (!lock) throw new MigrationError("Another install/upgrade is in progress.", RECOVERY_GUIDANCE, null);
+			log("Taking a full backup before migrating…");
+			try {
+				backupDir = backupOpenPalmHome(homeDir);
+			} catch (e) {
+				throw new MigrationError(`Could not create a safety backup; upgrade aborted (no changes made): ${e instanceof Error ? e.message : String(e)}`, RECOVERY_GUIDANCE, null);
+			}
+			if (!backupDir) throw new MigrationError("Could not create a safety backup; upgrade aborted (no changes made).", RECOVERY_GUIDANCE, null);
+			log(`Backup: ${backupDir}`);
+		}
+		const applied = [];
+		const notes = [];
+		for (const migration of pendingRelease) {
+			const ctx = {
+				...ctxBase,
+				notes
+			};
+			log(`Migrating release ${releaseFrom ?? "unknown"} → ${migration.version}: ${migration.describe}`);
+			migration.apply(ctx);
+			migration.verify(ctx);
+			applied.push(migration.version);
+		}
+		if (!dryRun) stampReleaseVersion(stashDir, targetVersion);
+		return {
+			migrated: true,
+			from: releaseFrom,
+			to: targetVersion,
+			applied,
+			backupDir,
 			notes
 		};
 	} catch (e) {
@@ -11419,7 +11656,7 @@ function generateFallbackSystemEnv(state) {
 		"",
 		"# ── Images ──────────────────────────────────────────────────────────",
 		`OP_IMAGE_NAMESPACE=${process.env.OP_IMAGE_NAMESPACE ?? "openpalm"}`,
-		`OP_IMAGE_TAG=${DEFAULT_IMAGE_TAG}`,
+		...Object.entries(buildPlatformImageTagEnv(DEFAULT_IMAGE_TAG)).map(([key, value]) => `${key}=${value}`),
 		"",
 		"# ── Layout (on-disk schema version; managed by the migration harness) ──",
 		`OP_LAYOUT_VERSION=1`,
@@ -12804,7 +13041,7 @@ function buildAkmEndpoint(provider, baseUrl, suffix) {
 */
 function writeFileAtomic(path, content, mode) {
 	const tmp = `${path}.tmp`;
-	writeFileSync(tmp, content, { mode } );
+	writeFileSync(tmp, content, mode !== void 0 ? { mode } : {});
 	renameSync(tmp, path);
 }
 //#endregion
@@ -13343,6 +13580,11 @@ function buildComposeOptions(state) {
 /** Lifecycle helpers — state factory, apply transitions, compose file list. */
 var IMAGE_NAMESPACE_RE = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
 var SEMVER_TAG_RE = /^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+var PLATFORM_IMAGE_NAMES = [
+	"assistant",
+	"guardian",
+	"channel"
+];
 function createState() {
 	const homeDir = resolveOpenPalmHome();
 	const configDir = resolveConfigDir();
@@ -13442,39 +13684,122 @@ function resolveNewestDockerTag(payload) {
 	}
 	return fallback;
 }
+function resolvePlatformVersionPolicyBaseTag(state) {
+	const configured = parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_TAG?.trim();
+	if (isComparableSemver(configured)) return configured;
+	return `v${package_default.version}`;
+}
+function resolveNewestDockerTagForCurrentMajor(payload, currentTag) {
+	const results = payload?.results;
+	if (!Array.isArray(results)) return null;
+	let best = null;
+	for (const entry of results) {
+		const name = typeof entry?.name === "string" ? entry.name.trim() : "";
+		if (!isComparableSemver(name) || !isSameMajorVersion(name, currentTag)) continue;
+		if (!best || compareComparableVersions(name, best) > 0) best = name;
+	}
+	return best;
+}
 function resolveImageNamespace(state) {
 	const namespace = (parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim().toLowerCase();
 	if (!IMAGE_NAMESPACE_RE.test(namespace)) throw new Error(`Invalid image namespace in system.env: ${namespace}`);
 	return namespace;
 }
+function resolveRequiredPlatformImages(state) {
+	const required = new Set(["assistant"]);
+	if (hasEnabledChannel(listEnabledAddonIds(state.homeDir))) {
+		required.add("guardian");
+		required.add("channel");
+	}
+	return PLATFORM_IMAGE_NAMES.filter((name) => required.has(name));
+}
+async function isDockerImageTagPublished(namespace, imageName, tag) {
+	let response;
+	try {
+		response = await fetch(`https://registry.hub.docker.com/v2/repositories/${namespace}/${imageName}/tags/${tag}`, { headers: { Accept: "application/json" } });
+	} catch (e) {
+		throw new Error(`Failed to verify Docker image tag ${namespace}/${imageName}:${tag}: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (response.status === 404) return false;
+	if (!response.ok) throw new Error(`Docker tag verification failed for ${namespace}/${imageName}:${tag} (${response.status})`);
+	return true;
+}
+async function fetchDockerTagsPayload(namespace, imageName) {
+	let response;
+	try {
+		response = await fetch(`https://registry.hub.docker.com/v2/repositories/${namespace}/${imageName}/tags?page_size=25&ordering=last_updated`, { headers: { Accept: "application/json" } });
+	} catch (e) {
+		throw new Error(`Failed to query Docker tags: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (!response.ok) throw new Error(`Docker tag lookup failed (${response.status})`);
+	return response.json();
+}
+/** Newest comparable semver tag for an image that is <= ceilingTag in the same major. */
+function resolveNewestDockerTagAtOrBelow(payload, ceilingTag) {
+	const results = payload?.results;
+	if (!Array.isArray(results)) return null;
+	let best = null;
+	for (const entry of results) {
+		const name = typeof entry?.name === "string" ? entry.name.trim() : "";
+		if (!isComparableSemver(name) || !isSameMajorVersion(name, ceilingTag)) continue;
+		if (compareComparableVersions(name, ceilingTag) > 0) continue;
+		if (!best || compareComparableVersions(name, best) > 0) best = name;
+	}
+	return best;
+}
+/**
+* Resolve the per-image tag env for a target platform tag (#477).
+*
+* `assistant` is the version-of-record image and must be published at the
+* platform tag. Guardian/channel may lag: a release that ships only a subset
+* of images leaves them at an older tag, so each falls back to its newest
+* published tag <= the platform tag in the same major. Fail closed only when
+* a REQUIRED image (guardian/channel with a channel addon enabled) has no
+* usable tag at all.
+*/
+async function resolvePlatformImageTags(state, namespace, platformTag) {
+	if (namespace !== "openpalm") return buildPlatformImageTagEnv(platformTag);
+	if (!await isDockerImageTagPublished(namespace, "assistant", platformTag)) throw new Error(`Refusing to update to ${namespace}/assistant:${platformTag}: tag is not published. stack.env was left unchanged.`);
+	const required = new Set(resolveRequiredPlatformImages(state));
+	const perImage = {};
+	for (const imageName of ["guardian", "channel"]) {
+		if (await isDockerImageTagPublished(namespace, imageName, platformTag)) continue;
+		const fallbackTag = resolveNewestDockerTagAtOrBelow(await fetchDockerTagsPayload(namespace, imageName), platformTag);
+		if (fallbackTag) {
+			perImage[`OP_${imageName.toUpperCase()}_IMAGE_TAG`] = fallbackTag;
+			continue;
+		}
+		if (required.has(imageName)) throw new Error(`Refusing to update to ${namespace}/*:${platformTag}: no published tag found for ${imageName} at or below ${platformTag}. This release is incomplete for the enabled services; stack.env was left unchanged.`);
+	}
+	return buildPlatformImageTagEnv(platformTag, perImage);
+}
 /**
 * Resolve the newest published platform tag from the Docker registry.
 *
-* `assistant` is the version-of-record image: all platform images
-* (assistant, guardian, channel, voice) are published in lockstep under the
-* same OP_IMAGE_TAG, so its newest tag is the canonical platform version.
+* `assistant` is the version-of-record image: its newest tag is the canonical
+* platform version. Guardian/channel may lag behind it when a release shipped
+* only a subset of images — see resolvePlatformImageTags.
 *
 * Used both to auto-detect during "Update now" and to resolve a requested
 * `latest` selection into a concrete release tag before fetching stack assets
 * (GitHub has no asset tree at a `latest` ref).
 */
 async function resolveLatestPlatformTag(namespace) {
-	let response;
-	try {
-		response = await fetch(`https://registry.hub.docker.com/v2/repositories/${namespace}/assistant/tags?page_size=25&ordering=last_updated`, { headers: { Accept: "application/json" } });
-	} catch (e) {
-		throw new Error(`Failed to query Docker tags: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	if (!response.ok) throw new Error(`Docker tag lookup failed (${response.status})`);
-	const latestTag = resolveNewestDockerTag(await response.json());
+	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, "assistant"));
 	if (!latestTag) throw new Error("No usable Docker image tag found");
 	return latestTag;
 }
-async function updateStackEnvToLatestImageTag(state) {
+async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag) {
+	const latestTag = resolveNewestDockerTagForCurrentMajor(await fetchDockerTagsPayload(namespace, "assistant"), currentTag);
+	if (!latestTag) throw new Error(`No usable Docker image tag found in major ${currentTag.replace(/^v/, "").split(".")[0]}`);
+	return latestTag;
+}
+async function updateStackEnvToLatestImageTag(state, resolvedTag) {
 	const systemEnvPath = `${state.stashDir}/env/stack.env`;
 	const namespace = resolveImageNamespace(state);
-	const latestTag = await resolveLatestPlatformTag(namespace);
-	writeFileSync(systemEnvPath, mergeEnvContent(existsSync(systemEnvPath) ? readFileSync(systemEnvPath, "utf-8") : "", { OP_IMAGE_TAG: latestTag }, { uncomment: true }));
+	const latestTag = resolvedTag ?? await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state));
+	const imageTagEnv = await resolvePlatformImageTags(state, namespace, latestTag);
+	writeFileSync(systemEnvPath, mergeEnvContent(existsSync(systemEnvPath) ? readFileSync(systemEnvPath, "utf-8") : "", imageTagEnv, { uncomment: true }));
 	return {
 		namespace,
 		tag: latestTag
@@ -13494,75 +13819,88 @@ async function applyUpgrade(state, version) {
 		releaseInstallLock(lock);
 	}
 }
-/**
-* Full upgrade: resolve latest image tag, refresh assets, pull images,
-* and recreate containers. Used by both the admin endpoint and CLI.
-*
-* Callers handle their own audit logging and admin self-recreation.
-*/
-async function performUpgrade(state) {
-	const composeOpts = buildComposeOptions(state);
+async function withStackEnvRollback(state, run) {
 	const stackEnvPath = `${state.stashDir}/env/stack.env`;
 	let originalStackEnv = null;
 	try {
 		originalStackEnv = readFileSync(stackEnvPath, "utf-8");
 	} catch {}
-	let imageTag;
-	let namespace;
-	let upgradeResult;
 	try {
-		const tagResult = await updateStackEnvToLatestImageTag(state);
-		imageTag = tagResult.tag;
-		namespace = tagResult.namespace;
-		upgradeResult = await applyUpgrade(state, imageTag);
+		return await run();
 	} catch (e) {
 		if (originalStackEnv !== null) try {
 			writeFileSync(stackEnvPath, originalStackEnv);
 		} catch {}
 		throw e;
 	}
-	const pullResult = await composePull(composeOpts);
-	if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
-	const services = await buildManagedServices(state);
-	const upResult = await composeUp({
-		...composeOpts,
-		services,
-		forceRecreate: true,
-		removeOrphans: true
+}
+/**
+* Full upgrade: resolve latest image tag, refresh assets, pull images,
+* and recreate containers. Used by both the admin endpoint and CLI.
+*
+* Callers handle their own audit logging and admin self-recreation.
+*/
+async function performUpgrade(state) {
+	return withStackEnvRollback(state, async () => {
+		const composeOpts = buildComposeOptions(state);
+		const namespace = resolveImageNamespace(state);
+		const imageTag = await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state));
+		ensureReleaseMigrated({
+			homeDir: state.homeDir,
+			targetVersion: imageTag
+		});
+		const { tag: confirmedImageTag } = await updateStackEnvToLatestImageTag(state, imageTag);
+		const upgradeResult = await applyUpgrade(state, confirmedImageTag);
+		const pullResult = await composePull(composeOpts);
+		if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
+		const services = await buildManagedServices(state);
+		const upResult = await composeUp({
+			...composeOpts,
+			services,
+			forceRecreate: true,
+			removeOrphans: true
+		});
+		if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
+		return {
+			imageTag: confirmedImageTag,
+			namespace,
+			backupDir: upgradeResult.backupDir,
+			assetsUpdated: upgradeResult.updated,
+			restarted: upgradeResult.restarted
+		};
 	});
-	if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
-	return {
-		imageTag,
-		namespace,
-		backupDir: upgradeResult.backupDir,
-		assetsUpdated: upgradeResult.updated,
-		restarted: upgradeResult.restarted
-	};
 }
 /**
 * Set a specific image tag in stack.env then pull images and restart containers.
 * Used by the admin "set version" action — skips the auto-detect step in performUpgrade.
 */
 async function applyTagChange(state, tag) {
-	const namespace = resolveImageNamespace(state);
-	const requested = tag.trim();
-	let resolvedTag = requested;
-	if (requested === "" || requested.toLowerCase() === "latest") try {
-		resolvedTag = await resolveLatestPlatformTag(namespace);
-	} catch (e) {
-		const msg = e instanceof Error ? e.message : String(e);
-		throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
-	}
-	const stackEnvPath = `${state.stashDir}/env/stack.env`;
-	writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", { OP_IMAGE_TAG: resolvedTag }, { uncomment: true }));
-	const upgradeResult = await applyUpgrade(state, resolvedTag);
-	return {
-		imageTag: resolvedTag,
-		namespace,
-		backupDir: upgradeResult.backupDir,
-		assetsUpdated: upgradeResult.updated,
-		restarted: upgradeResult.restarted
-	};
+	return withStackEnvRollback(state, async () => {
+		const namespace = resolveImageNamespace(state);
+		const requested = tag.trim();
+		let resolvedTag = requested;
+		if (requested === "" || requested.toLowerCase() === "latest") try {
+			resolvedTag = await resolveLatestPlatformTag(namespace);
+		} catch (e) {
+			const msg = e instanceof Error ? e.message : String(e);
+			throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
+		}
+		const imageTagEnv = await resolvePlatformImageTags(state, namespace, resolvedTag);
+		ensureReleaseMigrated({
+			homeDir: state.homeDir,
+			targetVersion: resolvedTag
+		});
+		const stackEnvPath = `${state.stashDir}/env/stack.env`;
+		writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", imageTagEnv, { uncomment: true }));
+		const upgradeResult = await applyUpgrade(state, resolvedTag);
+		return {
+			imageTag: resolvedTag,
+			namespace,
+			backupDir: upgradeResult.backupDir,
+			assetsUpdated: upgradeResult.updated,
+			restarted: upgradeResult.restarted
+		};
+	});
 }
 function buildComposeFileList(state) {
 	return discoverStackOverlays(state.stackDir, state.homeDir);
@@ -14692,7 +15030,7 @@ async function performSetup(input, opts) {
 		try {
 			const systemEnvForAkm = existsSync(`${state.stashDir}/env/stack.env`) ? readFileSync(`${state.stashDir}/env/stack.env`, "utf-8") : "";
 			const akmUpdates = {};
-			akmUpdates.OP_IMAGE_TAG = imageTag && imageTag.trim() ? imageTag.trim() : DEFAULT_IMAGE_TAG;
+			Object.assign(akmUpdates, buildPlatformImageTagEnv(imageTag && imageTag.trim() ? imageTag.trim() : DEFAULT_IMAGE_TAG));
 			if (Object.keys(akmUpdates).length > 0) writeFileAtomic(`${state.stashDir}/env/stack.env`, mergeEnvContent(systemEnvForAkm, akmUpdates), 384);
 			if (llm || embedding) {
 				const akmConfigDir = join(state.configDir, "akm");
@@ -14953,6 +15291,154 @@ function importHostOpenCode(state, options = {}) {
 		conflicts
 	};
 }
+//#endregion
+//#region ../lib/src/control-plane/akm-stats.ts
+function asRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asArray(value) {
+	return Array.isArray(value) ? value : [];
+}
+function asString(value) {
+	return typeof value === "string" && value.trim() ? value : null;
+}
+function asNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function asBoolean(value) {
+	return typeof value === "boolean" ? value : null;
+}
+function parseJsonObject(stdout) {
+	try {
+		return asRecord(JSON.parse(stdout));
+	} catch {
+		return null;
+	}
+}
+function runAkmJsonCommand(state, args, timeoutMs, options = {}) {
+	const akmEnv = buildAkmEnv(state);
+	assertAkmEnvComplete(akmEnv);
+	return new Promise((resolve) => {
+		execFile("akm", [
+			...args,
+			"--format",
+			"json",
+			"--quiet"
+		], {
+			env: {
+				...process.env,
+				...akmEnv
+			},
+			timeout: timeoutMs,
+			maxBuffer: 4 * 1024 * 1024
+		}, (error, stdout, stderr) => {
+			const execError = error;
+			const exitCode = typeof execError?.code === "number" ? execError.code : null;
+			const errorCode = typeof execError?.code === "string" ? execError.code : null;
+			const allowed = exitCode !== null && (options.allowExitCodes ?? []).includes(exitCode);
+			resolve({
+				ok: !error || allowed,
+				stdout: stdout?.toString() ?? "",
+				stderr: stderr?.toString() ?? "",
+				exitCode,
+				errorCode
+			});
+		});
+	});
+}
+function readAssetCount(info, type) {
+	if (!info) return null;
+	const candidates = [
+		asRecord(info.assetCounts),
+		asRecord(info.assetTypeCounts),
+		asRecord(info.assetsByType),
+		asRecord(info.counts)
+	];
+	for (const candidate of candidates) {
+		const value = asNumber(candidate?.[type]);
+		if (value !== null) return value;
+	}
+	return null;
+}
+function advisoryMessage(value) {
+	if (typeof value === "string" && value.trim()) return value.trim();
+	const record = asRecord(value);
+	if (!record) return null;
+	return asString(record.message) ?? asString(record.name);
+}
+function parseAkmStats(healthStdout, infoStdout, proposalsStdout) {
+	const health = parseJsonObject(healthStdout);
+	const info = parseJsonObject(infoStdout);
+	const proposalsPayload = parseJsonObject(proposalsStdout);
+	if (!health && !info) return {
+		available: false,
+		reason: "AKM stats unavailable on this host."
+	};
+	const indexStats = asRecord(info?.indexStats);
+	const improve = asRecord(health?.improve);
+	const reflect = asRecord(improve?.reflect);
+	const consolidation = asRecord(improve?.consolidation);
+	const proposals = asArray(proposalsPayload?.proposals).map((entry) => asRecord(entry)).filter((entry) => entry !== null).map((entry) => ({
+		ref: asString(entry.ref),
+		generator: asString(entry.generator) ?? asString(entry.source),
+		createdAt: asString(entry.createdAt),
+		status: asString(entry.status)
+	}));
+	const rawStatus = asString(health?.status)?.toLowerCase();
+	const status = rawStatus === "pass" || rawStatus === "ok" ? "pass" : rawStatus === "warn" ? "warn" : "unknown";
+	return {
+		available: true,
+		version: asString(info?.version),
+		health: {
+			status,
+			advisories: asArray(health?.advisories).map((entry) => advisoryMessage(entry)).filter((entry) => entry !== null)
+		},
+		index: {
+			entryCount: asNumber(indexStats?.entryCount),
+			lastBuiltAt: asString(indexStats?.lastBuiltAt),
+			hasEmbeddings: asBoolean(indexStats?.hasEmbeddings),
+			vecAvailable: asBoolean(indexStats?.vecAvailable)
+		},
+		assetCounts: {
+			memory: readAssetCount(info, "memory"),
+			skill: readAssetCount(info, "skill"),
+			lesson: readAssetCount(info, "lesson")
+		},
+		improve: {
+			invoked: asNumber(improve?.invoked),
+			completed: asNumber(improve?.completed),
+			skipped: asNumber(improve?.skipped),
+			reflectOk: asNumber(reflect?.ok),
+			reflectCooldown: asNumber(reflect?.cooldown),
+			consolidation: {
+				promoted: asNumber(consolidation?.promoted),
+				merged: asNumber(consolidation?.merged),
+				deleted: asNumber(consolidation?.deleted)
+			}
+		},
+		proposals: {
+			pending: proposals.length,
+			items: proposals
+		}
+	};
+}
+async function getAkmStats(state) {
+	const [healthResult, infoResult, proposalsResult] = await Promise.all([
+		runAkmJsonCommand(state, ["health"], 8e3, { allowExitCodes: [4] }),
+		runAkmJsonCommand(state, ["info"], 8e3),
+		runAkmJsonCommand(state, [
+			"proposal",
+			"list",
+			"--status",
+			"pending"
+		], 12e3)
+	]);
+	if (healthResult.errorCode === "ENOENT" || infoResult.errorCode === "ENOENT") return {
+		available: false,
+		reason: "The akm CLI is not installed on this host."
+	};
+	return parseAkmStats(healthResult.stdout, infoResult.stdout, proposalsResult.stdout);
+}
 
-export { getRegistryAddonConfig as $, AKM_USER_ENV_REF as A, createOpenCodeClient as B, CORE_SERVICES as C, createState as D, deleteUserEnvKey as E, detectExistingProject as F, detectGpu as G, detectHostOpenCode as H, detectLocalProviders as I, disableHostAkmSharing as J, enableHostAkmSharing as K, ensureAkmUserEnv as L, MigrationError as M, ensureHomeDirs as N, ensureMigrated as O, PROVIDER_KEY_MAP as P, ensureOpenCodeConfig as Q, ensureOpenCodeSystemConfig as R, ensureSecrets as S, executeAutomation as T, fetchProviderModels as U, getAddonProfileAvailability as V, getAddonProfileSelection as W, getAddonProfiles as X, getAddonServiceNames as Y, getDockerEvents as Z, getHostAkmSharingStatus as _, addonProfileId as a, hostAkmStashPath as a0, importHostOpenCode as a1, isAllowedService as a2, isHostAkmAvailable as a3, isSetupComplete as a4, listAvailableAddonIds as a5, listEnabledAddonIds as a6, listSecretFiles as a7, loadAutomations as a8, lookupEmbeddingDims as a9, writeSecretFile as aA, writeStackSecretEnv as aB, writeTaskFile as aC, writeUserEnvKey as aD, writeVoiceVars as aE, parseComposeStderr as aa, parseEnvFile as ab, performSetup as ac, performUpgrade as ad, readAutomationLogs as ae, readSecret as af, readSecretFile as ag, readStackEnv as ah, readStackRuntimeEnv as ai, readStackSecretEnv as aj, readTaskFile as ak, readUserEnvFile as al, recommendSetup as am, removeSecretFile as an, removeTaskFile as ao, resolveComposeProjectName as ap, resolveDataDir as aq, resolveRuntimeFiles as ar, resolveStackDir as as, seedUiBuild as at, setAddonEnabled as au, setAddonProfileSelection as av, summarizeComposeStderr as aw, validateProposedState as ax, writeFileAtomic as ay, writeRuntimeFiles as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEndpoint as j, buildAkmEnv as k, buildComposeOptions as l, buildManagedServices as m, checkDocker as n, checkDockerCompose as o, composeDown as p, composeLogs as q, composePreflight as r, composePs as s, composePull as t, composeRestart as u, composeStart as v, composeStats as w, composeStop as x, composeUp as y, createLogger as z };
-//# sourceMappingURL=src-CyeWH4Df.js.map
+export { getHostAkmSharingStatus as $, AKM_USER_ENV_REF as A, createOpenCodeClient as B, CORE_SERVICES as C, createState as D, deleteUserEnvKey as E, detectExistingProject as F, detectGpu as G, detectHostOpenCode as H, detectLocalProviders as I, disableHostAkmSharing as J, enableHostAkmSharing as K, ensureAkmUserEnv as L, MigrationError as M, ensureHomeDirs as N, ensureMigrated as O, PROVIDER_KEY_MAP as P, ensureOpenCodeConfig as Q, ensureOpenCodeSystemConfig as R, ensureSecrets as S, executeAutomation as T, fetchProviderModels as U, getAddonProfileAvailability as V, getAddonProfileSelection as W, getAddonProfiles as X, getAddonServiceNames as Y, getAkmStats as Z, getDockerEvents as _, addonProfileId as a, getRegistryAddonConfig as a0, hostAkmStashPath as a1, importHostOpenCode as a2, isAllowedService as a3, isHostAkmAvailable as a4, isSetupComplete as a5, listAvailableAddonIds as a6, listEnabledAddonIds as a7, listSecretFiles as a8, loadAutomations as a9, writeFileAtomic as aA, writeRuntimeFiles as aB, writeSecretFile as aC, writeStackSecretEnv as aD, writeTaskFile as aE, writeUserEnvKey as aF, writeVoiceVars as aG, lookupEmbeddingDims as aa, parseComposeStderr as ab, parseEnvFile as ac, patchSecretsEnvFile as ad, performSetup as ae, performUpgrade as af, readAutomationLogs as ag, readSecret as ah, readSecretFile as ai, readStackEnv as aj, readStackRuntimeEnv as ak, readStackSecretEnv as al, readTaskFile as am, readUserEnvFile as an, recommendSetup as ao, removeSecretFile as ap, removeTaskFile as aq, resolveComposeProjectName as ar, resolveDataDir as as, resolveRuntimeFiles as at, resolveStackDir as au, seedUiBuild as av, setAddonEnabled as aw, setAddonProfileSelection as ax, summarizeComposeStderr as ay, validateProposedState as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEndpoint as j, buildAkmEnv as k, buildComposeOptions as l, buildManagedServices as m, checkDocker as n, checkDockerCompose as o, composeDown as p, composeLogs as q, composePreflight as r, composePs as s, composePull as t, composeRestart as u, composeStart as v, composeStats as w, composeStop as x, composeUp as y, createLogger as z };
+//# sourceMappingURL=src-efp8mb8-.js.map