@openpalm/ui 0.12.0-rc.2 → 0.12.0-rc.4

package/build/server/chunks/{src-BEj0DuSB.js → src-kpR902Zr.js}

@@ -1,7 +1,7 @@
 import { _ as __commonJSMin, b as __require } from './chunk-CLZ62Ad-.js';
 import { P as PROVIDER_DEFAULT_URLS, a as PROVIDER_KEY_MAP } from './provider-constants-DPrj3yBX.js';
 import { r as require_dist } from './dist-DOFcG0Zp.js';
-import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, writeFileSync, renameSync, statSync, cpSync, openSync, constants, writeSync, closeSync, chownSync, realpathSync } from 'node:fs';
+import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, writeFileSync, renameSync, statSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, chownSync, realpathSync } from 'node:fs';
 import or, { join, basename, dirname, resolve, win32, posix } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import I from 'fs';
@@ -96,6 +96,84 @@ function timestampDirName(now = /* @__PURE__ */ new Date()) {
 	return now.toISOString().replace(/[:.]/g, "-");
 }
 /**
+* Recursively sum the apparent size (in bytes) of every file under `path`,
+* excluding the existing backups directory (we never back up backups).
+*
+* Cheap enough for a pre-backup estimate; errors on individual entries are
+* skipped (a transient unreadable file should not block the safety copy).
+*/
+function estimateHomeBackupBytes(homeDir) {
+	if (!existsSync(homeDir)) return 0;
+	const backupsDir = join(homeDir, "data", "backups");
+	let total = 0;
+	const walk = (dir) => {
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const full = join(dir, entry.name);
+			if (full === backupsDir) continue;
+			if (entry.isDirectory()) walk(full);
+			else if (entry.isFile()) try {
+				total += statSync(full).size;
+			} catch {}
+		}
+	};
+	walk(homeDir);
+	return total;
+}
+/**
+* Estimate whether a full-home backup would fit safely on disk.
+*
+* Returns a structured result; the caller decides whether to warn, block, or
+* (with explicit confirmation) proceed. This NEVER deletes anything — it only
+* measures. `threshold` is the fraction of currently-free space the backup may
+* consume before it is flagged `insufficient` (default 80%).
+*/
+function checkBackupFreeSpace(homeDir, threshold = .8) {
+	const estimatedBytes = estimateHomeBackupBytes(homeDir);
+	let freeBytes = Number.POSITIVE_INFINITY;
+	try {
+		const stat = statfsSync(homeDir);
+		freeBytes = stat.bavail * stat.bsize;
+	} catch {}
+	const ratio = freeBytes > 0 ? estimatedBytes / freeBytes : Number.POSITIVE_INFINITY;
+	return {
+		estimatedBytes,
+		freeBytes,
+		ratio,
+		insufficient: estimatedBytes > freeBytes * threshold,
+		threshold
+	};
+}
+function formatBytes(bytes) {
+	if (!Number.isFinite(bytes)) return "unknown";
+	const units = [
+		"B",
+		"KB",
+		"MB",
+		"GB",
+		"TB"
+	];
+	let value = bytes;
+	let i = 0;
+	while (value >= 1024 && i < units.length - 1) {
+		value /= 1024;
+		i += 1;
+	}
+	return `${value.toFixed(value >= 10 || i === 0 ? 0 : 1)} ${units[i]}`;
+}
+/**
+* Human-readable, plain-language explanation of a low-free-space situation,
+* suitable for a CLI warning or a UI notice.
+*/
+function describeBackupSpaceShortfall(check) {
+	return `The safety backup is estimated at ${formatBytes(check.estimatedBytes)}, but only ${formatBytes(check.freeBytes)} is free on this disk. Backing up could fill the disk. Free up space (your old backups are under data/backups/ — review them with \`openpalm backups list\`), or re-run with confirmation to proceed anyway. Nothing was changed or deleted.`;
+}
+/**
 * Create a durable backup snapshot of the current OP_HOME contents.
 *
 * The backup is written under OP_HOME/data/backups/<timestamp>/ and excludes
@@ -123,6 +201,62 @@ function backupOpenPalmHome(homeDir) {
 	}
 	return copiedAny ? backupDir : null;
 }
+function listBackupDirs(homeDir) {
+	const backupsDir = join(homeDir, "data", "backups");
+	if (!existsSync(backupsDir)) return [];
+	return readdirSync(backupsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join(backupsDir, entry.name)).sort((a, b) => b.localeCompare(a));
+}
+function dirSizeBytes(dir) {
+	let total = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return 0;
+	}
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) total += dirSizeBytes(full);
+		else if (entry.isFile()) try {
+			total += statSync(full).size;
+		} catch {}
+	}
+	return total;
+}
+/**
+* Summarize the upgrade backup snapshots for UI visibility (count, total size,
+* last-backup time, per-backup sizes). Read-only — never deletes anything.
+*/
+function summarizeBackups(homeDir) {
+	const backups = listBackupDirs(homeDir).map((path) => {
+		let createdAt = "";
+		try {
+			createdAt = statSync(path).mtime.toISOString();
+		} catch {}
+		return {
+			path,
+			name: path.slice(path.lastIndexOf("/") + 1),
+			sizeBytes: dirSizeBytes(path),
+			createdAt
+		};
+	});
+	const totalBytes = backups.reduce((sum, b) => sum + b.sizeBytes, 0);
+	return {
+		count: backups.length,
+		totalBytes,
+		lastBackupAt: backups[0]?.createdAt || null,
+		backups
+	};
+}
+function pruneBackupDirs(homeDir, keep) {
+	if (!Number.isInteger(keep) || keep < 0) throw new Error("keep must be a non-negative integer");
+	const toDelete = listBackupDirs(homeDir).slice(keep);
+	for (const backupDir of toDelete) rmSync(backupDir, {
+		recursive: true,
+		force: true
+	});
+	return toDelete;
+}
 //#endregion
 //#region ../lib/src/control-plane/install-lock.ts
 var import_dist = require_dist();
@@ -249,6 +383,79 @@ function acquireInstallLock(dataDir) {
 	}
 	return null;
 }
+var INSTALL_LOCK_STALE_AFTER_MS = STALE_AFTER_MS;
+/**
+* Inspect the install lock under `dataDir` without modifying it. Used by the
+* `openpalm unlock` command and the UI "operation stuck?" affordance to decide
+* whether a removal is safe.
+*/
+function inspectInstallLock(dataDir) {
+	const path = join(dataDir, ".install.lock");
+	let content;
+	try {
+		content = readFileSync(path, "utf-8");
+	} catch (err) {
+		if (err.code === "ENOENT") return {
+			present: false,
+			path
+		};
+		let ageMs = null;
+		try {
+			ageMs = Date.now() - statSync(path).mtimeMs;
+		} catch {}
+		return {
+			present: true,
+			path,
+			pid: null,
+			timestamp: null,
+			ageMs,
+			stale: isStale(path)
+		};
+	}
+	const { pid, timestamp } = parseLockContent(content);
+	return {
+		present: true,
+		path,
+		pid,
+		timestamp,
+		ageMs: timestamp !== null ? Date.now() - timestamp : null,
+		stale: isStale(path)
+	};
+}
+/**
+* Remove the install lock ONLY if it is stale (dead holder PID or older than
+* the 30-minute staleness window). Never blind-removes a lock held by a live,
+* recent install. Returns `{ ok: false, reason: "live" }` when the lock is
+* still active so the caller can surface a clear message instead of forcing.
+*/
+function unlockInstallLock(dataDir) {
+	const status = inspectInstallLock(dataDir);
+	if (!status.present) return {
+		ok: true,
+		removed: false,
+		status
+	};
+	if (!status.stale) return {
+		ok: false,
+		reason: "live",
+		status
+	};
+	try {
+		rmSync(status.path, { force: true });
+		logger$11.info("removed stale install lock via unlock", { path: status.path });
+	} catch (err) {
+		logger$11.warn("failed to remove stale install lock during unlock", {
+			path: status.path,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		throw err;
+	}
+	return {
+		ok: true,
+		removed: true,
+		status
+	};
+}
 function releaseInstallLock(handle) {
 	if (!handle) return;
 	try {
@@ -530,7 +737,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.0-rc.2"};
+	version: "0.12.0-rc.4"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -739,6 +946,146 @@ function mergeEnvContent(content, updates, options = {}) {
 	return lines.join("\n");
 }
 //#endregion
+//#region ../lib/src/control-plane/addon-env-schemas.ts
+/**
+* Built-in addon env-config SCHEMAS — a LEAF module (no imports) so it can be
+* shared by both `addons.ts` (which has a heavy import graph) and the migration
+* harness without creating an import cycle (lifecycle → migrations → addons → …).
+*
+* Each schema is an env-file-shaped string: `KEY=default` lines annotated with
+* `# @required` / `# @sensitive` comment lines directly above the key.
+*/
+var BUILTIN_ADDON_ENV_SCHEMAS = {
+	api: `# API Gateway portal configuration
+# ---
+`,
+	chat: `# Web Chat portal configuration
+# ---
+`,
+	discord: `# Discord bot configuration
+# ---
+
+# Discord credentials
+# ---
+
+# Application ID from the Discord Developer Portal.
+# https://discord.com/developers/applications
+# @required
+DISCORD_APPLICATION_ID=
+
+# Bot token from the Discord Developer Portal (Bot → Token).
+# @required @sensitive
+DISCORD_BOT_TOKEN=
+
+# ---
+# Access control
+# ---
+
+# Comma-separated allowed guild (server) IDs. Empty = all joined guilds.
+DISCORD_ALLOWED_GUILDS=
+
+# Comma-separated allowed role IDs.
+DISCORD_ALLOWED_ROLES=
+
+# Comma-separated allowed user IDs.
+DISCORD_ALLOWED_USERS=
+
+# Comma-separated blocked user IDs (denied even if otherwise allowed).
+DISCORD_BLOCKED_USERS=
+
+# ---
+# Behavior
+# ---
+
+# Register slash commands on startup.
+DISCORD_REGISTER_COMMANDS=true
+
+# Hours before a conversation thread expires.
+DISCORD_THREAD_TTL_HOURS=24
+
+# Milliseconds to wait before forwarding a message (0 = immediate).
+DISCORD_FORWARD_TIMEOUT_MS=0
+`,
+	slack: `# Slack bot configuration
+# ---
+
+# Slack credentials
+# ---
+
+# Bot User OAuth Token (OAuth & Permissions → Bot User OAuth Token).
+# @required @sensitive
+SLACK_BOT_TOKEN=
+
+# App-Level Token with connections:write (Basic Information → App-Level Tokens).
+# @required @sensitive
+SLACK_APP_TOKEN=
+
+# ---
+# Access control
+# ---
+
+# Comma-separated allowed channel IDs. Empty = all channels the bot is in.
+SLACK_ALLOWED_CHANNELS=
+
+# Comma-separated allowed user IDs.
+SLACK_ALLOWED_USERS=
+
+# Comma-separated blocked user IDs.
+SLACK_BLOCKED_USERS=
+
+`,
+	gateway: "",
+	ollama: "",
+	voice: `# OpenPalm Voice (Kokoro TTS + Whisper STT) configuration
+# ---
+# Local inference server — no upstream API or key. Values are optional; the
+# compose overlay supplies safe defaults.
+
+# faster-whisper model id. Default base.en is baked into the image.
+# @required
+OP_VOICE_WHISPER_MODEL=base.en
+
+# Default Kokoro voice id (54 bundled voices, e.g. af_heart, am_michael).
+OP_VOICE_KOKORO_VOICE=bf_isabella
+
+# Python logging level: debug, info, warning, error.
+OP_VOICE_LOG_LEVEL=info
+`
+};
+/**
+* The set of NON-sensitive addon env keys declared in BUILTIN_ADDON_ENV_SCHEMAS
+* — a `KEY=` line whose annotation comment block does NOT carry `@sensitive`.
+*
+* This is the ALLOWLIST for the C4 `knowledge/secrets/` → `stack.env` migration:
+* it must only ever promote real, declared, non-sensitive addon config. The
+* secrets dir is a GENERAL secret store (ssh keys, github/OAuth creds, akm
+* secrets, per-portal verification secrets) — a file must never be copied into
+* the non-secret stack.env just because its name lacks a `_TOKEN/_SECRET/...`
+* suffix.
+*/
+function nonSensitiveAddonEnvKeys() {
+	const keys = /* @__PURE__ */ new Set();
+	const KEY_RE = /^([A-Z][A-Z0-9_]*)=/;
+	for (const schema of Object.values(BUILTIN_ADDON_ENV_SCHEMAS)) {
+		let sensitive = false;
+		for (const raw of schema.split("\n")) {
+			const trimmed = raw.trim();
+			if (trimmed.startsWith("#")) {
+				if (/@sensitive\b/.test(trimmed)) sensitive = true;
+				continue;
+			}
+			const m = raw.match(KEY_RE);
+			if (m) {
+				if (!sensitive) keys.add(m[1]);
+				sensitive = false;
+				continue;
+			}
+			if (trimmed === "") sensitive = false;
+		}
+	}
+	return keys;
+}
+//#endregion
 //#region ../lib/src/control-plane/image-tags.ts
 var PLATFORM_IMAGE_TAG_KEYS = [
 	"OP_ASSISTANT_IMAGE_TAG",
@@ -803,8 +1150,11 @@ function buildPlatformImageTagEnv(tag, perImage, pinnedImages = []) {
 *   - Otherwise: acquire the install lock, take a FULL-HOME backup first, and
 *     abort the whole upgrade if the backup fails (never migrate without a
 *     verified safety copy).
-*   - Migrations are COPY-ONLY / additive (never delete the old layout), so a
-*     mid-run failure leaves the home fully recoverable.
+*   - Migrations are additive for USER data (never delete/overwrite user files;
+*     relocate, don't drop). They MAY remove SYSTEM-managed inert files (e.g. a
+*     compose overlay the control plane no longer loads) via an explicit
+*     allowlist — but only because the FULL-HOME backup above runs first, so the
+*     home stays fully recoverable. Never a heuristic sweep, never user data.
 *   - The OP_LAYOUT_VERSION bump is the LAST step (the commit point); a crash
 *     before it just re-runs next time (idempotent).
 *   - On failure, throw MigrationError carrying the backup path + recovery
@@ -822,6 +1172,22 @@ var MigrationError = class extends Error {
 		this.name = "MigrationError";
 	}
 };
+/**
+* Thrown when the pre-backup free-space check estimates the safety backup would
+* exceed a safe fraction of free disk. Surfaced so callers (CLI/UI) can present
+* a plain-language warning and re-run with explicit confirmation. NOTHING is
+* deleted — the migration aborts cleanly with no changes made.
+*/
+var BackupSpaceError = class extends MigrationError {
+	estimatedBytes;
+	freeBytes;
+	constructor(message, guidance, estimatedBytes, freeBytes) {
+		super(message, guidance, null);
+		this.estimatedBytes = estimatedBytes;
+		this.freeBytes = freeBytes;
+		this.name = "BackupSpaceError";
+	}
+};
 var RELEASE_VERSION_KEY = "OP_RELEASE_VERSION";
 function resolveMigrationPaths(homeDir) {
 	return {
@@ -866,7 +1232,7 @@ function readLayoutVersion(ctx) {
 		if (m) return Number(m[1]);
 	}
 	if (existsSync(join(ctx.homeDir, "vault"))) return 0;
-	return 1;
+	return 2;
 }
 function readStampedLayoutVersion(stashDir) {
 	const raw = readStackEnvValue(stashDir, LAYOUT_VERSION_KEY);
@@ -980,9 +1346,11 @@ function migrateAddonConfigToStackEnv(ctx) {
 	if (!existsSync(secretsDir)) return;
 	const stackContent = readFileSync(envPath, "utf-8");
 	const additions = {};
+	const allowedKeys = nonSensitiveAddonEnvKeys();
 	for (const filename of readdirSync(secretsDir)) {
 		if (filename.includes(".") || filename.includes("/")) continue;
 		const envKey = filename.toUpperCase();
+		if (!allowedKeys.has(envKey)) continue;
 		if (ADDON_SENSITIVE_KEY_RE.test(envKey)) continue;
 		if (new RegExp(`^${envKey}=`, "m").test(stackContent)) {
 			ctx.log(`skip (exists in stack.env): ${envKey}`);
@@ -1230,6 +1598,32 @@ function readLegacyStackYmlAddons(ctx) {
 	}
 	return [];
 }
+/**
+* SYSTEM-managed files the 0.12.0 control plane no longer materializes or reads.
+* Removed so OP_HOME holds only the current managed asset set. This is an explicit
+* ALLOWLIST of system files — NEVER user data, NEVER a heuristic sweep:
+*   - config/stack/channels.compose.yml — renamed to portals.compose.yml in 0.12.0;
+*     the control plane loads an explicit overlay list (not a glob), so it is inert.
+*   - config/stack/stack.yml — the StackSpec was removed in 0.11.0 (addons live in
+*     OP_ENABLED_ADDONS; the 0→1 migration already extracts any legacy addons[]).
+* Removal is safe because the layout-migration path takes a FULL OP_HOME backup
+* first and aborts if it fails (see ensureMigrated), so a stamped layout bump is
+* always recoverable. User data is never removed; if a future inert path actually
+* holds user data it must be MOVED to its proper location here, not deleted.
+*/
+var INERT_LAYOUT_V2_FILES = [join("config", "stack", "channels.compose.yml"), join("config", "stack", "stack.yml")];
+function migrate1to2(ctx) {
+	for (const rel of INERT_LAYOUT_V2_FILES) {
+		const full = join(ctx.homeDir, rel);
+		if (!existsSync(full)) continue;
+		if (ctx.dryRun) {
+			ctx.log(`[dry-run] remove inert system file: ${rel}`);
+			continue;
+		}
+		rmSync(full, { force: true });
+		ctx.log(`removed inert pre-0.12.0 system file: ${rel}`);
+	}
+}
 var MIGRATIONS = [{
 	from: 0,
 	to: 1,
@@ -1239,6 +1633,15 @@ var MIGRATIONS = [{
 		if (ctx.dryRun) return;
 		if (!existsSync(stackEnvFile(ctx.stashDir))) throw new Error("post-migration check failed: knowledge/env/stack.env is missing");
 	}
+}, {
+	from: 1,
+	to: 2,
+	describe: "drop inert pre-0.12.0 system files (channels.compose.yml, stack.yml)",
+	apply: migrate1to2,
+	verify(ctx) {
+		if (ctx.dryRun) return;
+		for (const rel of INERT_LAYOUT_V2_FILES) if (existsSync(join(ctx.homeDir, rel))) throw new Error(`post-migration check failed: inert ${rel} still present`);
+	}
 }];
 var RELEASE_MIGRATIONS = [
 	{
@@ -1273,7 +1676,7 @@ var RELEASE_MIGRATIONS = [
 		verify(ctx) {}
 	}
 ];
-var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. To recover, restore the backup (see docs/operations/backup-restore.md) or run `openpalm migrate --dry-run` to preview the current copy-only migration. Full guide: docs/operations/upgrade-0.10-to-0.11.md";
+var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. If something went wrong, run `openpalm rollback` to restore your previous state, or restore the backup manually (see docs/operations/backup-restore.md). You can also run `openpalm migrate --dry-run` to preview the current copy-only migration. Full guide: docs/operations/upgrade-0.10-to-0.11.md";
 function resolveComparableReleaseTarget(rawVersion) {
 	if (!rawVersion) return null;
 	return isComparableSemver(rawVersion) ? rawVersion : null;
@@ -1311,6 +1714,7 @@ function runReleaseMigrations(ctxBase, releaseFrom, targetVersion) {
 function ensureMigrated(opts = {}) {
 	const homeDir = opts.homeDir ? resolve(opts.homeDir) : process.env.OP_HOME ? resolve(process.env.OP_HOME) : resolve(process.env.HOME ?? "", ".openpalm");
 	const dryRun = opts.dryRun ?? false;
+	const confirmLowSpace = opts.confirmLowSpace ?? false;
 	const log = opts.log ?? (() => {});
 	const ctxBase = {
 		...resolveMigrationPaths(homeDir),
@@ -1324,7 +1728,7 @@ function ensureMigrated(opts = {}) {
 	const layoutStamp = readStampedLayoutVersion(ctxBase.stashDir);
 	const releaseTargetRaw = releaseStamp ?? readImageTag(ctxBase.stashDir);
 	const comparableReleaseTarget = resolveComparableReleaseTarget(releaseTargetRaw);
-	const needsLayoutStamp = layoutStamp !== 1;
+	const needsLayoutStamp = layoutStamp !== 2;
 	const needsReleaseStamp = comparableReleaseTarget !== null && releaseStamp !== comparableReleaseTarget;
 	const empty = {
 		migrated: false,
@@ -1337,11 +1741,11 @@ function ensureMigrated(opts = {}) {
 		releaseTo: comparableReleaseTarget ?? releaseFrom ?? "",
 		releaseApplied: []
 	};
-	const pending = MIGRATIONS.filter((m) => m.from >= from && m.from < 1).sort((a, b) => a.from - b.from);
+	const pending = MIGRATIONS.filter((m) => m.from >= from && m.from < 2).sort((a, b) => a.from - b.from);
 	const pendingRelease = comparableReleaseTarget ? selectPendingReleaseMigrations(releaseFrom, comparableReleaseTarget) : [];
 	if (pending.length === 0 && pendingRelease.length === 0 && !needsLayoutStamp && !needsReleaseStamp) return {
 		...empty,
-		to: 1
+		to: 2
 	};
 	let lock = null;
 	let backupDir = null;
@@ -1354,6 +1758,8 @@ function ensureMigrated(opts = {}) {
 			}
 			lock = acquireInstallLock(ctxBase.dataDir);
 			if (!lock) throw new MigrationError("Another install/upgrade is in progress.", RECOVERY_GUIDANCE, null);
+			const spaceCheck = checkBackupFreeSpace(homeDir);
+			if (spaceCheck.insufficient && !confirmLowSpace) throw new BackupSpaceError(describeBackupSpaceShortfall(spaceCheck), RECOVERY_GUIDANCE, spaceCheck.estimatedBytes, spaceCheck.freeBytes);
 			log("Taking a full backup before migrating…");
 			try {
 				backupDir = backupOpenPalmHome(homeDir);
@@ -1381,13 +1787,13 @@ function ensureMigrated(opts = {}) {
 		}, releaseFrom, releaseTargetRaw);
 		if (!dryRun && releaseTargetRaw && comparableReleaseTarget === null) logSkippedNonComparableReleaseStamp(log, notes, releaseTargetRaw);
 		if (!dryRun) {
-			stampLayoutVersion(ctxBase.stashDir, 1);
+			stampLayoutVersion(ctxBase.stashDir, 2);
 			if (comparableReleaseTarget) stampReleaseVersion(ctxBase.stashDir, comparableReleaseTarget);
 		}
 		return {
 			migrated: true,
 			from,
-			to: 1,
+			to: 2,
 			applied,
 			backupDir,
 			notes,
@@ -5336,20 +5742,84 @@ function writeSystemEnv(state) {
 		if (!hasUsableOperatorId(parsed, "OP_GID")) adminManaged.OP_GID = String(ids.gid);
 	}
 	if (!parsed.OP_HOME) adminManaged.OP_HOME = state.homeDir;
-	base = stripSecretLikeEnvKeys(base);
+	const { content: strippedBase, removed } = stripSecretLikeEnvKeys(base);
+	base = strippedBase;
+	if (removed.length > 0) {
+		logger$7.warn("Removed secret-looking keys from stack.env (they belong in Connections/secrets)", {
+			removedKeys: removed,
+			stackEnvPath: systemEnvPath
+		});
+		recordSecretStripNotice(state, removed);
+	}
 	assertNoSecretLikeStackEnvKeys(parseEnvContent(base));
 	assertNoSecretLikeStackEnvKeys(adminManaged);
 	writeFileSync(systemEnvPath, mergeEnvContent(base, adminManaged, { sectionHeader: "# ── Admin-managed ──────────────────────────────────────────────────" }), { mode: 384 });
 	chmodSync(systemEnvPath, 384);
 }
 function stripSecretLikeEnvKeys(content) {
-	return content.split("\n").filter((line) => {
-		let trimmed = line.trim();
-		if (trimmed.startsWith("export ")) trimmed = trimmed.slice(7).trimStart();
-		const eq = trimmed.indexOf("=");
-		if (eq <= 0) return true;
-		return !isSecretLikeStackEnvKey(trimmed.slice(0, eq).trim());
-	}).join("\n");
+	const removed = [];
+	return {
+		content: content.split("\n").filter((line) => {
+			let trimmed = line.trim();
+			if (trimmed.startsWith("export ")) trimmed = trimmed.slice(7).trimStart();
+			const eq = trimmed.indexOf("=");
+			if (eq <= 0) return true;
+			const key = trimmed.slice(0, eq).trim();
+			if (isSecretLikeStackEnvKey(key)) {
+				removed.push(key);
+				return false;
+			}
+			return true;
+		}).join("\n"),
+		removed
+	};
+}
+/**
+* Path of the one-time "secret-looking values were removed from stack.env"
+* notice the UI reads and dismisses.
+*/
+function secretStripNoticePath(state) {
+	return `${state.dataDir}/secret-strip-notice.json`;
+}
+function recordSecretStripNotice(state, newlyRemoved) {
+	const path = secretStripNoticePath(state);
+	let keys = new Set(newlyRemoved);
+	if (existsSync(path)) try {
+		const prior = JSON.parse(readFileSync(path, "utf-8"));
+		if (Array.isArray(prior.keys)) keys = new Set([...prior.keys, ...newlyRemoved]);
+	} catch {}
+	const notice = {
+		keys: [...keys].sort(),
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	try {
+		mkdirSync(state.dataDir, { recursive: true });
+		writeFileSync(path, JSON.stringify(notice, null, 2));
+	} catch (e) {
+		logger$7.warn("Could not persist secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+	}
+}
+/** Read the pending secret-strip notice, or null when there is none. */
+function readSecretStripNotice(state) {
+	const path = secretStripNoticePath(state);
+	if (!existsSync(path)) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8"));
+		if (Array.isArray(parsed.keys) && parsed.keys.length > 0 && typeof parsed.at === "string") return {
+			keys: parsed.keys,
+			at: parsed.at
+		};
+	} catch {}
+	return null;
+}
+/** Dismiss (delete) the pending secret-strip notice. */
+function dismissSecretStripNotice(state) {
+	const path = secretStripNoticePath(state);
+	if (existsSync(path)) try {
+		rmSync(path);
+	} catch (e) {
+		logger$7.warn("Could not dismiss secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+	}
 }
 function generateFallbackSystemEnv(state) {
 	const ids = resolveOperatorIds(state.homeDir);
@@ -5367,7 +5837,7 @@ function generateFallbackSystemEnv(state) {
 		...Object.entries(buildPlatformImageTagEnv(DEFAULT_IMAGE_TAG)).map(([key, value]) => `${key}=${value}`),
 		"",
 		"# ── Layout (on-disk schema version; managed by the migration harness) ──",
-		`OP_LAYOUT_VERSION=1`,
+		`OP_LAYOUT_VERSION=2`,
 		"",
 		"# ── Enabled addons (comma-separated; managed via the Add-ons UI / CLI) ──",
 		"OP_ENABLED_ADDONS=",
@@ -5563,103 +6033,6 @@ var BUILTIN_ADDONS = [
 	"ssh",
 	"voice"
 ];
-var BUILTIN_ADDON_ENV_SCHEMAS = {
-	api: `# API Gateway portal configuration
-# ---
-`,
-	chat: `# Web Chat portal configuration
-# ---
-`,
-	discord: `# Discord bot configuration
-# ---
-
-# Discord credentials
-# ---
-
-# Application ID from the Discord Developer Portal.
-# https://discord.com/developers/applications
-# @required
-DISCORD_APPLICATION_ID=
-
-# Bot token from the Discord Developer Portal (Bot → Token).
-# @required @sensitive
-DISCORD_BOT_TOKEN=
-
-# ---
-# Access control
-# ---
-
-# Comma-separated allowed guild (server) IDs. Empty = all joined guilds.
-DISCORD_ALLOWED_GUILDS=
-
-# Comma-separated allowed role IDs.
-DISCORD_ALLOWED_ROLES=
-
-# Comma-separated allowed user IDs.
-DISCORD_ALLOWED_USERS=
-
-# Comma-separated blocked user IDs (denied even if otherwise allowed).
-DISCORD_BLOCKED_USERS=
-
-# ---
-# Behavior
-# ---
-
-# Register slash commands on startup.
-DISCORD_REGISTER_COMMANDS=true
-
-# Hours before a conversation thread expires.
-DISCORD_THREAD_TTL_HOURS=24
-
-# Milliseconds to wait before forwarding a message (0 = immediate).
-DISCORD_FORWARD_TIMEOUT_MS=0
-`,
-	slack: `# Slack bot configuration
-# ---
-
-# Slack credentials
-# ---
-
-# Bot User OAuth Token (OAuth & Permissions → Bot User OAuth Token).
-# @required @sensitive
-SLACK_BOT_TOKEN=
-
-# App-Level Token with connections:write (Basic Information → App-Level Tokens).
-# @required @sensitive
-SLACK_APP_TOKEN=
-
-# ---
-# Access control
-# ---
-
-# Comma-separated allowed channel IDs. Empty = all channels the bot is in.
-SLACK_ALLOWED_CHANNELS=
-
-# Comma-separated allowed user IDs.
-SLACK_ALLOWED_USERS=
-
-# Comma-separated blocked user IDs.
-SLACK_BLOCKED_USERS=
-
-`,
-	gateway: "",
-	ollama: "",
-	voice: `# OpenPalm Voice (Kokoro TTS + Whisper STT) configuration
-# ---
-# Local inference server — no upstream API or key. Values are optional; the
-# compose overlay supplies safe defaults.
-
-# faster-whisper model id. Default base.en is baked into the image.
-# @required
-OP_VOICE_WHISPER_MODEL=base.en
-
-# Default Kokoro voice id (54 bundled voices, e.g. af_heart, am_michael).
-OP_VOICE_KOKORO_VOICE=bf_isabella
-
-# Python logging level: debug, info, warning, error.
-OP_VOICE_LOG_LEVEL=info
-`
-};
 function getRegistryAutomation(name) {
 	if (!VALID_NAME_RE.test(name)) return null;
 	const localOpenpalmDir = resolveLocalOpenpalmDir();
@@ -6991,6 +7364,43 @@ function resolvePlatformVersionPolicyBaseTag(state) {
 * Non-semver targets (a moving `latest`/`dev` tag) are not comparable and are
 * left to the resolver paths that turn them into a concrete release first.
 */
+/**
+* Downgrade-needs-confirmation signal (#501).
+*
+* Release migrations are forward-only (copy-only, additive); they do NOT run
+* backward. Pointing the stack at an OLDER tag than the one currently running is
+* therefore a data-safety event, not a routine version change: the older images
+* may not understand files the newer release already migrated. We don't block it
+* (a user may legitimately need to roll back), but we require an explicit
+* confirmation so it can't happen by a stray dropdown selection. The UI catches
+* this by `code` and shows a plain warning + confirm; the CLI surfaces the
+* message and a `--confirm`/`--yes` path.
+*/
+var DowngradeConfirmationRequired = class extends Error {
+	code = "downgrade_confirmation_required";
+	currentVersion;
+	targetVersion;
+	constructor(currentVersion, targetVersion) {
+		super(`Version ${formatForDisplay(targetVersion)} is older than the version you're running (${formatForDisplay(currentVersion)}). This is a downgrade. Release migrations don't run backward; your data may not be compatible — restore from backup if needed. Re-run with confirmation to proceed. Nothing was changed.`);
+		this.name = "DowngradeConfirmationRequired";
+		this.currentVersion = currentVersion;
+		this.targetVersion = targetVersion;
+	}
+};
+/**
+* Throw {@link DowngradeConfirmationRequired} when `targetTag` is strictly older
+* than the version currently configured in stack.env, unless the caller passed
+* an explicit confirmation. Non-semver tags (a moving `latest`/`dev` ref, or a
+* first install with no current tag) are not comparable and pass through — the
+* resolver paths turn `latest` into a concrete release before this runs.
+*/
+function assertNotUnconfirmedDowngrade(state, targetTag, confirmDowngrade) {
+	if (confirmDowngrade) return;
+	const currentTag = resolvePlatformVersionPolicyBaseTag(state);
+	if (!isComparableSemver(targetTag) || !isComparableSemver(currentTag)) return;
+	if (compareComparableVersions(targetTag, currentTag) >= 0) return;
+	throw new DowngradeConfirmationRequired(currentTag, targetTag);
+}
 function assertTargetNotNewerThanPlatform(targetTag) {
 	if (!isComparableSemver(targetTag) || !isComparableSemver(PLATFORM_VERSION)) return;
 	if (compareComparableVersions(targetTag, PLATFORM_VERSION) <= 0) return;
@@ -7098,6 +7508,15 @@ async function resolveLatestPlatformTag(namespace) {
 	if (!latestTag) throw new Error("No usable Docker image tag found");
 	return latestTag;
 }
+/**
+* Resolve the default target version for `openpalm migrate --dry-run`: the
+* newest published platform tag in the current major. Mirrors the resolver the
+* upgrade path uses (same namespace, same base tag, same prerelease policy) so a
+* dry-run preview reflects the exact version `openpalm update` would move to.
+*/
+async function resolveDefaultMigrateTarget(state, opts = {}) {
+	return resolveLatestPlatformTagForCurrentMajor(resolveImageNamespace(state), resolvePlatformVersionPolicyBaseTag(state), { allowPrerelease: opts.allowPrerelease });
+}
 async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag, opts = {}) {
 	const skipPrerelease = !opts.allowPrerelease && !isPrerelease(currentTag);
 	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, "assistant"), {
@@ -7198,7 +7617,7 @@ async function performUpgrade(state, opts = {}) {
 * Set a specific image tag in stack.env then pull images and restart containers.
 * Used by the admin "set version" action — skips the auto-detect step in performUpgrade.
 */
-async function applyTagChange(state, tag) {
+async function applyTagChange(state, tag, opts = {}) {
 	return withStackEnvRollback(state, async () => {
 		const namespace = resolveImageNamespace(state);
 		const requested = tag.trim();
@@ -7210,6 +7629,7 @@ async function applyTagChange(state, tag) {
 			throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
 		}
 		assertTargetNotNewerThanPlatform(resolvedTag);
+		assertNotUnconfirmedDowngrade(state, resolvedTag, opts.confirmDowngrade ?? false);
 		const stackEnvPath = `${state.stashDir}/env/stack.env`;
 		const currentEnv = parseEnvFile(stackEnvPath);
 		const pinnedImages = parsePinnedImages(currentEnv.OP_PINNED_IMAGES);
@@ -7695,7 +8115,7 @@ async function runDeploy(state, options = {}) {
 	const lock = acquireInstallLock(state.dataDir);
 	if (!lock) {
 		progress.deploying = false;
-		progress.deployError = "install_in_progress: A deploy is already running. Wait for it to finish.";
+		progress.deployError = "install_in_progress: A deploy is already running. Wait for it to finish (the lock clears itself automatically after 30 minutes). If you're sure nothing is running, run 'openpalm unlock' to clear a stale lock.";
 		emitProgress(options, progress);
 		return progress;
 	}
@@ -9369,7 +9789,7 @@ async function performSetup(input, opts) {
 	const lockHandle = acquireInstallLock(state.dataDir);
 	if (lockHandle === null) return {
 		ok: false,
-		error: "install_in_progress: Another install is in progress. Wait for it to finish, or remove state/.install.lock if you're sure no install is running."
+		error: "install_in_progress: Another install is in progress. Wait for it to finish (the lock clears itself automatically after 30 minutes). If you're sure nothing is running, run 'openpalm unlock' to clear a stale lock."
 	};
 	logger.info("performing setup", { connectionCount: connections.length });
 	const updates = buildOwnerEnvFromSetup(owner);
@@ -9855,5 +10275,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { formatForDisplay as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, composeStop as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, deleteUserEnvKey as I, deriveLaunchStatus as J, deriveLocalStackState as K, detectGpu as L, MigrationError as M, detectHostOpenCode as N, detectLocalProviders as O, PLATFORM_VERSION as P, detectRuntime as Q, disableHostAkmSharing as R, enableHostAkmSharing as S, ensureAkmUserEnv as T, ensureHomeDirs as U, ensureMigrated as V, ensureOpenCodeConfig as W, ensureOpenCodeSystemConfig as X, ensureSecrets as Y, executeAutomation as Z, fetchProviderModels as _, addonProfileId as a, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, recommendSetup as aA, removeSecretFile as aB, removeTaskFile as aC, resolveComposeProjectName as aD, resolveDataDir as aE, resolveDeployJournalPath as aF, resolveRuntimeFiles as aG, resolveStackDir as aH, runDeploy as aI, seedUiBuild as aJ, setAddonEnabled as aK, setAddonProfileSelection as aL, summarizeComposeStderr as aM, useExistingProviderForAssistantCli as aN, validateProposedState as aO, writeFileAtomic as aP, writeRuntimeFiles as aQ, writeSecretFile as aR, writeStackSecretEnv as aS, writeTaskFile as aT, writeUserEnvKey as aU, writeVoiceVars as aV, initializeStateSecrets as aa, isAllowedService as ab, isComparableSemver as ac, isHostAkmAvailable as ad, isSetupComplete as ae, listAssistantCliTools as af, listAvailableAddonIds as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, parseComposeStderr as am, parseEnvFile as an, patchSecretsEnvFile as ao, performSetup as ap, performUpgrade as aq, readAutomationLogs as ar, readDeployJournal as as, readSecret as at, readSecretFile as au, readStackEnv as av, readStackRuntimeEnv as aw, readStackSecretEnv as ax, readTaskFile as ay, readUserEnvFile as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-BEj0DuSB.js.map
+export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, writeRuntimeFiles as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readSecret as aA, readSecretFile as aB, readSecretStripNotice as aC, readStackEnv as aD, readStackRuntimeEnv as aE, readStackSecretEnv as aF, readTaskFile as aG, readUserEnvFile as aH, recommendSetup as aI, removeSecretFile as aJ, removeTaskFile as aK, resolveComposeProjectName as aL, resolveDataDir as aM, resolveDefaultMigrateTarget as aN, resolveDeployJournalPath as aO, resolveRuntimeFiles as aP, resolveStackDir as aQ, runDeploy as aR, seedUiBuild as aS, setAddonEnabled as aT, setAddonProfileSelection as aU, summarizeBackups as aV, summarizeComposeStderr as aW, unlockInstallLock as aX, useExistingProviderForAssistantCli as aY, validateProposedState as aZ, writeFileAtomic as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isSetupComplete as aj, listAssistantCliTools as ak, listAvailableAddonIds as al, listBackupDirs as am, listEnabledAddonIds as an, listSecretFiles as ao, loadAutomations as ap, mapDockerError as aq, markSetupComplete as ar, parseComposeStderr as as, parseEnvFile as at, patchSecretsEnvFile as au, performSetup as av, performUpgrade as aw, pruneBackupDirs as ax, readAutomationLogs as ay, readDeployJournal as az, annotateAddonProfileAvailability as b, writeSecretFile as b0, writeStackSecretEnv as b1, writeTaskFile as b2, writeUserEnvKey as b3, writeVoiceVars as b4, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-kpR902Zr.js.map