@openpalm/ui 0.12.18 → 0.12.23

package/build/server/chunks/{src-B3g4Ry1X.js → src-BN-m14sE.js}

@@ -738,7 +738,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.18"};
+	version: "0.12.23"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -806,15 +806,6 @@ function compareComparableVersions(a, b) {
 	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
 	return 0;
 }
-function majorVersionOf(version) {
-	if (!isComparableSemver(version)) return null;
-	return parseComparableVersion(version).major;
-}
-function isSameMajorVersion(a, b) {
-	const aMajor = majorVersionOf(a);
-	const bMajor = majorVersionOf(b);
-	return aMajor !== null && bMajor !== null && aMajor === bMajor;
-}
 /**
 * npm/display form: strip a single leading `v` and trim. `v0.12.0` → `0.12.0`.
 * Pass-through for an already-bare version. Empty/whitespace → ''.
@@ -1087,82 +1078,6 @@ function nonSensitiveAddonEnvKeys() {
 	return keys;
 }
 //#endregion
-//#region ../lib/src/control-plane/image-tags.ts
-var PLATFORM_IMAGE_TAG_KEYS = [
-	"OP_ASSISTANT_IMAGE_TAG",
-	"OP_GUARDIAN_IMAGE_TAG",
-	"OP_PORTAL_IMAGE_TAG"
-];
-var PINNABLE_PLATFORM_IMAGE_SET = new Set(["guardian", "portal"]);
-function parsePinnedImages(value) {
-	if (!value) return [];
-	return [...new Set(value.split(",").map((entry) => entry.trim().toLowerCase()).filter((entry) => PINNABLE_PLATFORM_IMAGE_SET.has(entry)))].sort();
-}
-function platformImageTagKeyFor(image) {
-	switch (image) {
-		case "guardian": return "OP_GUARDIAN_IMAGE_TAG";
-		case "portal": return "OP_PORTAL_IMAGE_TAG";
-	}
-}
-function resolveEffectivePlatformImageTag(env, image) {
-	const primary = env[platformImageTagKeyFor(image)]?.trim();
-	if (primary) return primary;
-	if (image === "portal") {
-		const legacy = env.OP_CHANNEL_IMAGE_TAG?.trim();
-		if (legacy) return legacy;
-	}
-	return env.OP_IMAGE_TAG?.trim() || "latest";
-}
-function buildPinnedImageTagEnv(env, pinnedImages) {
-	const updates = {};
-	for (const image of pinnedImages) updates[platformImageTagKeyFor(image)] = resolveEffectivePlatformImageTag(env, image);
-	return updates;
-}
-var DEPLOYABLE_UNITS = [
-	"assistant",
-	"guardian",
-	"portals",
-	"voice"
-];
-var DEPLOYABLE_UNIT_IMAGE_NAMES = {
-	assistant: "assistant",
-	guardian: "guardian",
-	portals: "portal",
-	voice: "voice"
-};
-var DEPLOYABLE_UNIT_IMAGE_TAG_KEYS = {
-	assistant: "OP_ASSISTANT_IMAGE_TAG",
-	guardian: "OP_GUARDIAN_IMAGE_TAG",
-	portals: "OP_PORTAL_IMAGE_TAG",
-	voice: "OP_VOICE_IMAGE_TAG"
-};
-function isDeployableUnit(value) {
-	return DEPLOYABLE_UNITS.includes(value);
-}
-function deployableUnitImageName(unit) {
-	return DEPLOYABLE_UNIT_IMAGE_NAMES[unit];
-}
-function deployableUnitImageTagKey(unit) {
-	return DEPLOYABLE_UNIT_IMAGE_TAG_KEYS[unit];
-}
-/**
-* Build the stack.env image-tag entries for a platform release.
-*
-* `tag` is the platform version-of-record (the assistant tag). Per-image
-* overrides let guardian/portal ride an older published tag when a release
-* shipped only a subset of images (#477). OP_IMAGE_TAG stays as the compose
-* fallback for pre-per-image installs.
-*/
-function buildPlatformImageTagEnv(tag, perImage, pinnedImages = []) {
-	const pinned = new Set(pinnedImages);
-	return {
-		OP_IMAGE_TAG: tag,
-		OP_ASSISTANT_IMAGE_TAG: perImage?.OP_ASSISTANT_IMAGE_TAG ?? tag,
-		...pinned.has("guardian") ? {} : { OP_GUARDIAN_IMAGE_TAG: perImage?.OP_GUARDIAN_IMAGE_TAG ?? tag },
-		...pinned.has("portal") ? {} : { OP_PORTAL_IMAGE_TAG: perImage?.OP_PORTAL_IMAGE_TAG ?? perImage?.OP_CHANNEL_IMAGE_TAG ?? tag }
-	};
-}
-//#endregion
 //#region ../lib/src/control-plane/addon-ids.ts
 /**
 * Canonical list of built-in addon IDs.
@@ -1380,9 +1295,6 @@ function stampReleaseVersion(stashDir, version) {
 	writeFileSync(envPath, next);
 	return true;
 }
-function upsertMany(content, values) {
-	return Object.entries(values).reduce((next, [key, value]) => upsertEnvValue(next, key, value), content);
-}
 function ensureDir(ctx, dir) {
 	if (ctx.dryRun) {
 		ctx.log(`[dry-run] mkdir ${rel(ctx, dir)}`);
@@ -1424,23 +1336,7 @@ function writeFile600(ctx, path, content) {
 		chmodSync(path, 384);
 	} catch {}
 }
-function seedPerImageTagVars(ctx) {
-	const envPath = stackEnvFile(ctx.stashDir);
-	if (!existsSync(envPath)) return;
-	const current = readFileSync(envPath, "utf-8");
-	const imageTag = current.match(/^OP_IMAGE_TAG=(.+)$/m)?.[1]?.trim();
-	if (!imageTag) return;
-	if (PLATFORM_IMAGE_TAG_KEYS.filter((key) => !new RegExp(`^${key}=`, "m").test(current)).length === 0) return;
-	if (ctx.dryRun) {
-		ctx.log(`[dry-run] seed per-image tag vars from OP_IMAGE_TAG=${imageTag}`);
-		return;
-	}
-	let next = upsertMany(current, buildPlatformImageTagEnv(imageTag));
-	const legacyPortalTag = readStackEnvValue(ctx.stashDir, "OP_CHANNEL_IMAGE_TAG");
-	if (legacyPortalTag && !/^OP_PORTAL_IMAGE_TAG=/m.test(next)) next = upsertEnvValue(next, "OP_PORTAL_IMAGE_TAG", legacyPortalTag);
-	writeFile600(ctx, envPath, next);
-	ctx.log(`seeded per-image tag vars from OP_IMAGE_TAG=${imageTag}`);
-}
+function seedPerImageTagVars(_ctx) {}
 /**
 * Keys that are sensitive and must stay as compose secret files.
 * Matches the @sensitive annotation in BUILTIN_ADDON_ENV_SCHEMAS.
@@ -1958,19 +1854,73 @@ function patchPortalsComposeForThinHost(ctx) {
 	writeFileSync(path, patched);
 	ctx.log("patched portals.compose.yml: added OP_GUARDIAN_VERSION and PLATFORM_VERSION to guardian service env");
 }
+/**
+* Legacy image-tag keys removed by the version-system redesign. The single
+* whole-stack OP_IMAGE_TAG and the per-unit OP_*_IMAGE_TAG escape-hatch keys are
+* replaced by one explicit OP_*_VERSION var per image (no compose cascade).
+*/
+var LEGACY_IMAGE_TAG_KEYS = [
+	"OP_IMAGE_TAG",
+	"OP_ASSISTANT_IMAGE_TAG",
+	"OP_GUARDIAN_IMAGE_TAG",
+	"OP_PORTAL_IMAGE_TAG",
+	"OP_CHANNEL_IMAGE_TAG"
+];
+/**
+* Map an existing install's legacy image-tag vars onto the new per-image
+* OP_*_VERSION vars, then strip the legacy keys.
+*
+* Each new var is seeded from the most specific legacy source: the per-unit
+* OP_<UNIT>_IMAGE_TAG when set, else the whole-stack OP_IMAGE_TAG, else "latest"
+* (the moving default). Voice never had a managed tag var, so it defaults to
+* "latest". The legacy keys are then removed (they are SYSTEM-managed compose
+* config, not user data — and the layout migration path takes a full-home backup
+* first; here ensureReleaseMigrated takes a targeted stack.env backup).
+*
+* Idempotent: once the legacy keys are gone and the new vars are present, a
+* second run is a no-op (mapped values already exist; nothing to strip).
+*/
+function migrateImageTagsToVersionVars(ctx) {
+	const envPath = stackEnvFile(ctx.stashDir);
+	if (!existsSync(envPath)) return;
+	let content = readFileSync(envPath, "utf-8");
+	const read = (key) => {
+		const m = content.match(new RegExp(`^${key}=(.*)$`, "m"));
+		return m ? m[1].trim() : void 0;
+	};
+	const has = (key) => new RegExp(`^${key}=`, "m").test(content);
+	const imageTag = read("OP_IMAGE_TAG");
+	const fallback = imageTag && imageTag.length > 0 ? imageTag : "latest";
+	const mapped = {
+		OP_ASSISTANT_VERSION: read("OP_ASSISTANT_IMAGE_TAG") ?? fallback,
+		OP_GUARDIAN_VERSION: read("OP_GUARDIAN_IMAGE_TAG") ?? fallback,
+		OP_PORTAL_VERSION: read("OP_PORTAL_IMAGE_TAG") ?? fallback,
+		OP_VOICE_VERSION: "latest"
+	};
+	const hasLegacy = LEGACY_IMAGE_TAG_KEYS.some(has);
+	const missingNew = Object.keys(mapped).some((k) => !has(k));
+	if (!hasLegacy && !missingNew) return;
+	if (ctx.dryRun) {
+		ctx.log(`[dry-run] would set ${Object.entries(mapped).map(([k, v]) => `${k}=${v}`).join(", ")}`);
+		if (hasLegacy) ctx.log(`[dry-run] would remove legacy image-tag keys: ${LEGACY_IMAGE_TAG_KEYS.filter(has).join(", ")}`);
+		return;
+	}
+	for (const [key, value] of Object.entries(mapped)) if (!has(key)) {
+		content = upsertEnvValue(content, key, value);
+		ctx.log(`set ${key}=${value}`);
+	}
+	for (const key of LEGACY_IMAGE_TAG_KEYS) if (has(key)) {
+		content = removeEnvKey(content, key);
+		ctx.log(`removed legacy image-tag key: ${key}`);
+	}
+	writeFile600(ctx, envPath, content);
+}
 var RELEASE_MIGRATIONS = [
 	{
 		version: "v0.11.5-rc.1",
-		describe: "seed per-image platform tags from OP_IMAGE_TAG",
+		describe: "seed per-image platform tags from OP_IMAGE_TAG (no-op: compose now resolves every service from OP_IMAGE_TAG)",
 		apply: seedPerImageTagVars,
-		verify(ctx) {
-			if (ctx.dryRun) return;
-			const envPath = stackEnvFile(ctx.stashDir);
-			if (!existsSync(envPath)) return;
-			const content = readFileSync(envPath, "utf-8");
-			if (!/^OP_IMAGE_TAG=/m.test(content)) return;
-			for (const key of PLATFORM_IMAGE_TAG_KEYS) if (!new RegExp(`^${key}=`, "m").test(content)) throw new Error(`post-migration check failed: ${key} is missing`);
-		}
+		verify() {}
 	},
 	{
 		version: "v0.12.0-rc.1",
@@ -2016,6 +1966,24 @@ var RELEASE_MIGRATIONS = [
 			if (!content.includes("OP_GUARDIAN_VERSION:")) throw new Error("post-migration check failed: OP_GUARDIAN_VERSION still missing from portals.compose.yml");
 			if (!content.includes("      OP_ASSISTANT_URL: http://assistant:4096")) throw new Error("post-migration check failed: portals.compose.yml is missing the expected anchor line (OP_ASSISTANT_URL: http://assistant:4096). The file may be structurally corrupt.");
 		}
+	},
+	{
+		version: "v0.12.19-rc.1",
+		describe: "map OP_IMAGE_TAG / OP_*_IMAGE_TAG -> OP_*_VERSION and remove legacy image-tag keys",
+		apply: migrateImageTagsToVersionVars,
+		verify(ctx) {
+			if (ctx.dryRun) return;
+			const envPath = stackEnvFile(ctx.stashDir);
+			if (!existsSync(envPath)) return;
+			const content = readFileSync(envPath, "utf-8");
+			for (const key of LEGACY_IMAGE_TAG_KEYS) if (new RegExp(`^${key}=`, "m").test(content)) throw new Error(`post-migration check failed: legacy image-tag key '${key}' still present in stack.env`);
+			for (const key of [
+				"OP_ASSISTANT_VERSION",
+				"OP_GUARDIAN_VERSION",
+				"OP_PORTAL_VERSION",
+				"OP_VOICE_VERSION"
+			]) if (!new RegExp(`^${key}=`, "m").test(content)) throw new Error(`post-migration check failed: ${key} missing from stack.env after version migration`);
+		}
 	}
 ];
 var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. If something went wrong, run `openpalm rollback` to restore your previous state, or restore the backup manually (see docs/operations/backup-restore.md). You can also run `openpalm migrate --dry-run` to preview the current copy-only migration. Full guide: docs/operations/upgrade-0.10-to-0.11.md";
@@ -5560,7 +5528,7 @@ function resolveLocalOpenpalmDir() {
 * aware — unlike `releases/latest`, which silently excludes prereleases),
 * immutable versions, and a sha512 integrity we verify fail-closed.
 */
-var NPM_REGISTRY$1 = "https://registry.npmjs.org";
+var NPM_REGISTRY = "https://registry.npmjs.org";
 var UI_PACKAGE = "@openpalm/ui";
 /**
 * Resolve the npm manifest for `@openpalm/ui` by exact version OR dist-tag.
@@ -5568,7 +5536,7 @@ var UI_PACKAGE = "@openpalm/ui";
 * manifest (version + dist.tarball + dist.integrity). Throws on non-OK.
 */
 async function fetchNpmUiManifest(versionOrTag) {
-	const res = await fetchWithRetry(`${NPM_REGISTRY$1}/${UI_PACKAGE}/${versionOrTag}`);
+	const res = await fetchWithRetry(`${NPM_REGISTRY}/${UI_PACKAGE}/${versionOrTag}`);
 	if (!res.ok) throw new Error(`npm registry returned HTTP ${res.status} for ${UI_PACKAGE}@${versionOrTag}`);
 	const m = await res.json();
 	if (!m.version || !m.dist?.tarball) throw new Error(`npm manifest for ${UI_PACKAGE}@${versionOrTag} is missing version/dist.tarball`);
@@ -6065,6 +6033,88 @@ var STACK_DEFAULTS = {
 		assistant: 3800,
 		hostUi: 3880}};
 //#endregion
+//#region ../lib/src/control-plane/versions.ts
+/**
+* Version variable management for the OpenPalm control plane.
+*
+* The stack carries two kinds of version pins in knowledge/env/stack.env:
+*
+*  - SERVICE versions (`OP_*_VERSION`) are Docker image tags. They take an exact
+*    tag ("v0.12.18"), the moving "latest" / "next" refs, or empty (compose
+*    falls back to "latest"). They are NEVER semver ranges — Docker image tags
+*    are concrete refs, not range expressions.
+*  - NPM versions (`OP_*_NPM_VERSION` / `OP_TOOL_*_VERSION`) pin npm packages
+*    installed at container boot (guardian thin-host, assistant CLI tools). These
+*    accept semver ranges ("^1.17.0", "~0.8.14") because npm resolves them.
+*
+* Compose reads every SERVICE_VERSION_KEY directly via
+* `${OP_*_VERSION:-latest}` — there is no cascade fallback to a single platform
+* tag anymore. Each image rides its own var.
+*/
+/** Docker image tag pins — one per deployable image. Exact tag / "latest" / "next". */
+var SERVICE_VERSION_KEYS = [
+	"OP_ASSISTANT_VERSION",
+	"OP_GUARDIAN_VERSION",
+	"OP_PORTAL_VERSION",
+	"OP_VOICE_VERSION"
+];
+/** npm package pins installed at container boot. Semver ranges allowed. */
+var NPM_VERSION_KEYS = [
+	"OP_GUARDIAN_NPM_VERSION",
+	"OP_TOOL_OPENCODE_VERSION",
+	"OP_TOOL_AKM_VERSION",
+	"OP_TOOL_CLAUDE_CODE_VERSION",
+	"OP_TOOL_CODEX_VERSION"
+];
+/** Every version key the control plane reads/writes in stack.env. */
+var ALL_VERSION_KEYS = [...SERVICE_VERSION_KEYS, ...NPM_VERSION_KEYS];
+var VERSION_KEY_SET = new Set(ALL_VERSION_KEYS);
+/** Default values seeded into a fresh stack.env (and returned for unset keys). */
+var VERSION_DEFAULTS = {
+	OP_ASSISTANT_VERSION: "latest",
+	OP_GUARDIAN_VERSION: "latest",
+	OP_PORTAL_VERSION: "latest",
+	OP_VOICE_VERSION: "latest",
+	OP_GUARDIAN_NPM_VERSION: "",
+	OP_TOOL_OPENCODE_VERSION: "^1.17.0",
+	OP_TOOL_AKM_VERSION: "^0.8.14",
+	OP_TOOL_CLAUDE_CODE_VERSION: "^1.5.0",
+	OP_TOOL_CODEX_VERSION: "^0.1.0"
+};
+function isVersionKey(key) {
+	return VERSION_KEY_SET.has(key);
+}
+function stackEnvPath$1(state) {
+	return `${state.stashDir}/env/stack.env`;
+}
+/**
+* Read every version key from stack.env. Keys that are absent fall back to their
+* documented default (so callers always get the full ALL_VERSION_KEYS set).
+*/
+function readVersions(state) {
+	const path = stackEnvPath$1(state);
+	const parsed = existsSync(path) ? parseEnvFile(path) : {};
+	const out = {};
+	for (const key of ALL_VERSION_KEYS) out[key] = parsed[key] ?? VERSION_DEFAULTS[key];
+	return out;
+}
+/**
+* Write validated version keys into stack.env. Only keys in the
+* ALL_VERSION_KEYS allowlist are written; anything else is rejected so a typo or
+* a hostile caller can't smuggle arbitrary env into the stack config. Uses
+* mergeEnvContent so existing non-version keys (and comments) are preserved.
+*/
+function writeVersions(state, updates) {
+	const accepted = {};
+	for (const [key, value] of Object.entries(updates)) {
+		if (!isVersionKey(key)) throw new Error(`Refusing to write unknown version key: ${key}`);
+		accepted[key] = (value ?? "").trim();
+	}
+	if (Object.keys(accepted).length === 0) return;
+	const path = stackEnvPath$1(state);
+	writeFileSync(path, mergeEnvContent(existsSync(path) ? readFileSync(path, "utf-8") : "", accepted), { mode: 384 });
+}
+//#endregion
 //#region ../lib/src/control-plane/config-persistence.ts
 /**
 * Runtime file resolution and persistence for the OpenPalm control plane.
@@ -6073,7 +6123,6 @@ var STACK_DEFAULTS = {
 * Files are validated in-place before writing; rollback is handled by
 * the rollback module (snapshot to OP_HOME/data/rollback/).
 */
-var DEFAULT_IMAGE_TAG = "latest";
 var logger$8 = createLogger("config-persistence");
 /**
 * Return the env files used for docker compose --env-file args.
@@ -6201,7 +6250,12 @@ function generateFallbackSystemEnv(state) {
 		"",
 		"# ── Images ──────────────────────────────────────────────────────────",
 		`OP_IMAGE_NAMESPACE=${process.env.OP_IMAGE_NAMESPACE ?? "openpalm"}`,
-		...Object.entries(buildPlatformImageTagEnv(DEFAULT_IMAGE_TAG)).map(([key, value]) => `${key}=${value}`),
+		"# Docker image tags (exact tag, \"latest\", or \"next\" — no semver ranges).",
+		...SERVICE_VERSION_KEYS.map((key) => `${key}=${VERSION_DEFAULTS[key]}`),
+		"",
+		"# ── npm package versions (semver ranges supported) ──────────────────",
+		"# OP_GUARDIAN_NPM_VERSION empty ⇒ use the GUARDIAN_VERSION baked into the image.",
+		...NPM_VERSION_KEYS.map((key) => `${key}=${VERSION_DEFAULTS[key]}`),
 		"",
 		"# ── Layout (on-disk schema version; managed by the migration harness) ──",
 		`OP_LAYOUT_VERSION=2`,
@@ -6488,17 +6542,18 @@ function execFileNoThrow(cmd, args, timeoutMs) {
 /**
 * Compute the openpalm/voice image ref for a given GPU variant, matching
 * the substitution chain in the addon compose file:
-*   ${OP_IMAGE_NAMESPACE:-openpalm}/voice:${OP_VOICE_IMAGE_TAG:-latest-<variant>}
+*   ${OP_IMAGE_NAMESPACE:-openpalm}/voice:${OP_VOICE_VERSION:-latest-<variant>}
 *
 * Voice images are published OUT OF BAND (publish-voice.yml), decoupled from the
-* platform OP_IMAGE_TAG — they are heavy and rarely change. So the default is
-* the moving `latest-<variant>` voice tag; operators pin a specific build by
-* setting OP_VOICE_IMAGE_TAG (e.g. `v1.0.0-cpu`).
+* other service images — they are heavy and rarely change. So the default is the
+* moving `latest-<variant>` voice tag; operators pin a specific build by setting
+* OP_VOICE_VERSION (e.g. `v1.0.0-cpu`). A bare `latest` (the seeded default) is
+* treated as "unset" so the GPU-variant default still applies.
 */
 function voiceImageRef(variant) {
 	const namespace = process.env.OP_IMAGE_NAMESPACE?.trim() || "openpalm";
-	const explicit = process.env.OP_VOICE_IMAGE_TAG?.trim();
-	if (explicit) return `${namespace}/voice:${explicit}`;
+	const explicit = process.env.OP_VOICE_VERSION?.trim();
+	if (explicit && explicit !== "latest") return `${namespace}/voice:${explicit}`;
 	return `${namespace}/voice:latest-${variant}`;
 }
 /**
@@ -7611,13 +7666,6 @@ function hasArmedSnapshot() {
 //#region ../lib/src/control-plane/lifecycle.ts
 /** Lifecycle helpers — state factory, apply transitions, compose file list. */
 var IMAGE_NAMESPACE_RE = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
-var SEMVER_TAG_RE = /^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
-var PLATFORM_IMAGE_NAMES = [
-	"assistant",
-	"guardian",
-	"portal"
-];
-var AUTH_TRANSITION_BOUNDARY_TAG = "v0.12.0";
 function createState() {
 	const homeDir = resolveOpenPalmHome();
 	const configDir = resolveConfigDir();
@@ -7712,317 +7760,11 @@ async function applyUninstall(state, opts) {
 		releaseLifecycleLock(lock, opts);
 	}
 }
-var DOCKER_REGISTRY_TIMEOUT_MS = 1e4;
-/**
-* Resolve the best Docker image tag from a registry tags payload.
-*
-* Constraints (all optional):
-* - `sameMajorAs`    — only consider tags whose major component matches this tag.
-* - `atOrBelow`      — only consider tags whose version is <= this tag.
-* - `skipPrerelease` — ignore prerelease tags (`-rc`, `-beta`, …). Used so a
-*                      STABLE base never auto-jumps onto a prerelease (#494),
-*                      mirroring the UI card's channel gate.
-*
-* With no constraints: returns the first semver tag found, or the first
-* non-"latest" tag as a fallback (mirrors the original resolveNewestDockerTag).
-* With constraints: returns the highest semver tag satisfying all constraints.
-*/
-function resolveNewestDockerTag(payload, constraints = {}) {
-	const results = payload?.results;
-	if (!Array.isArray(results)) return null;
-	const { sameMajorAs, atOrBelow, skipPrerelease } = constraints;
-	if (!(sameMajorAs !== void 0 || atOrBelow !== void 0 || skipPrerelease === true)) {
-		let fallback = null;
-		for (const entry of results) {
-			const name = typeof entry?.name === "string" ? entry.name.trim() : "";
-			if (!name || name === "latest") continue;
-			if (SEMVER_TAG_RE.test(name)) return name;
-			if (!fallback) fallback = name;
-		}
-		return fallback;
-	}
-	let best = null;
-	for (const entry of results) {
-		const name = typeof entry?.name === "string" ? entry.name.trim() : "";
-		if (!isComparableSemver(name)) continue;
-		if (skipPrerelease && isPrerelease(name)) continue;
-		if (sameMajorAs !== void 0 && !isSameMajorVersion(name, sameMajorAs)) continue;
-		if (atOrBelow !== void 0 && compareComparableVersions(name, atOrBelow) > 0) continue;
-		if (!best || compareComparableVersions(name, best) > 0) best = name;
-	}
-	return best;
-}
-function resolvePlatformVersionPolicyBaseTag(state) {
-	const configured = parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_TAG?.trim();
-	if (isComparableSemver(configured)) return configured;
-	return PLATFORM_VERSION;
-}
-/**
-* Host-vs-target guard (#492), keyed on the RUNNING control-plane version.
-*
-* The migrations a release needs live inside the @openpalm/lib that is actually
-* executing — i.e. PLATFORM_VERSION (the version of the running data/ui build, or
-* the compiled-in CLI lib). If a user points the stack at a tag NEWER than the
-* control plane they're running, `ensureReleaseMigrated` runs an OLD migration
-* array that doesn't contain that release's migrations → the new images come up
-* against half-migrated files. There is no safe recovery, so this is a HARD block
-* (not a warning): nothing is written before it throws.
-*
-* The thin-harness design (§6.5) makes this satisfiable: the supervisor self-
-* updates data/ui to the current platform BEFORE the UI serves the upgrade
-* request, so "target ≤ running platform" only fails when the user genuinely
-* picks a tag the running control plane cannot migrate to — at which point the
-* fix is to update the app / control plane first, not to proceed.
-*
-* Non-semver targets (a moving `latest`/`dev` tag) are not comparable and are
-* left to the resolver paths that turn them into a concrete release first.
-*/
-/**
-* Downgrade-needs-confirmation signal (#501).
-*
-* Release migrations are forward-only (copy-only, additive); they do NOT run
-* backward. Pointing the stack at an OLDER tag than the one currently running is
-* therefore a data-safety event, not a routine version change: the older images
-* may not understand files the newer release already migrated. We don't block it
-* (a user may legitimately need to roll back), but we require an explicit
-* confirmation so it can't happen by a stray dropdown selection. The UI catches
-* this by `code` and shows a plain warning + confirm; the CLI surfaces the
-* message and a `--confirm`/`--yes` path.
-*/
-var DowngradeConfirmationRequired = class extends Error {
-	code = "downgrade_confirmation_required";
-	currentVersion;
-	targetVersion;
-	constructor(currentVersion, targetVersion) {
-		super(`Version ${formatForDisplay(targetVersion)} is older than the version you're running (${formatForDisplay(currentVersion)}). This is a downgrade. Release migrations don't run backward; your data may not be compatible — restore from backup if needed. Re-run with confirmation to proceed. Nothing was changed.`);
-		this.name = "DowngradeConfirmationRequired";
-		this.currentVersion = currentVersion;
-		this.targetVersion = targetVersion;
-	}
-};
-/**
-* Throw {@link DowngradeConfirmationRequired} when `targetTag` is strictly older
-* than the version currently configured in stack.env, unless the caller passed
-* an explicit confirmation. Non-semver tags (a moving `latest`/`dev` ref, or a
-* first install with no current tag) are not comparable and pass through — the
-* resolver paths turn `latest` into a concrete release before this runs.
-*/
-function assertNotUnconfirmedDowngrade(state, targetTag, confirmDowngrade) {
-	if (confirmDowngrade) return;
-	const currentTag = resolvePlatformVersionPolicyBaseTag(state);
-	if (!isComparableSemver(targetTag) || !isComparableSemver(currentTag)) return;
-	if (compareComparableVersions(targetTag, currentTag) >= 0) return;
-	throw new DowngradeConfirmationRequired(currentTag, targetTag);
-}
-/**
-* Convert a release git tag to a Docker image tag.
-*
-* The new per-unit release scheme uses prefixed git tags (platform-X.Y.Z,
-* portals-X.Y.Z, etc.) while Docker images always use the v-prefixed form
-* (v0.12.5). This function strips the unit prefix so applyTagChange can
-* resolve the correct Docker image tag from a GitHub release tag.
-*/
-function extractDockerTagFromReleaseTag(tag) {
-	const unitPrefixMatch = tag.match(/^(?:platform|portals|assistant|guardian)-(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]*)?)$/);
-	if (unitPrefixMatch) return formatForDocker(unitPrefixMatch[1]);
-	return formatForDocker(tag);
-}
 function resolveImageNamespace(state) {
 	const namespace = (parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim().toLowerCase();
 	if (!IMAGE_NAMESPACE_RE.test(namespace)) throw new Error(`Invalid image namespace in system.env: ${namespace}`);
 	return namespace;
 }
-function resolveRequiredPlatformImages(state) {
-	const required = new Set(["assistant"]);
-	if (hasEnabledPortal(listEnabledAddonIds(state.homeDir))) {
-		required.add("guardian");
-		required.add("portal");
-	}
-	return PLATFORM_IMAGE_NAMES.filter((name) => required.has(name));
-}
-async function isDockerImageTagPublished(namespace, imageName, tag) {
-	let response;
-	try {
-		response = await fetch(`https://registry.hub.docker.com/v2/repositories/${namespace}/${imageName}/tags/${tag}`, {
-			headers: { Accept: "application/json" },
-			signal: AbortSignal.timeout(DOCKER_REGISTRY_TIMEOUT_MS)
-		});
-	} catch (e) {
-		throw new Error(`Failed to verify Docker image tag ${namespace}/${imageName}:${tag}: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	if (response.status === 404) return false;
-	if (!response.ok) throw new Error(`Docker tag verification failed for ${namespace}/${imageName}:${tag} (${response.status})`);
-	return true;
-}
-async function fetchDockerTagsPayload(namespace, imageName) {
-	let response;
-	try {
-		response = await fetch(`https://registry.hub.docker.com/v2/repositories/${namespace}/${imageName}/tags?page_size=25&ordering=last_updated`, {
-			headers: { Accept: "application/json" },
-			signal: AbortSignal.timeout(DOCKER_REGISTRY_TIMEOUT_MS)
-		});
-	} catch (e) {
-		throw new Error(`Failed to query Docker tags: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	if (!response.ok) throw new Error(`Docker tag lookup failed (${response.status})`);
-	return response.json();
-}
-/**
-* Resolve the per-image tag env for a target platform tag (#477).
-*
-* `assistant` is the version-of-record image and must be published at the
-* platform tag. Guardian/portal may lag: a release that ships only a subset
-* of images leaves them at an older tag, so each falls back to its newest
-* published tag <= the platform tag in the same major. Fail closed only when
-* a required image (guardian/portal with a portal addon enabled) has no
-* usable tag at all.
-*/
-async function resolvePlatformImageTags(state, namespace, platformTag, pinnedImages) {
-	if (namespace !== "openpalm") return buildPlatformImageTagEnv(platformTag, void 0, pinnedImages);
-	if (!await isDockerImageTagPublished(namespace, "assistant", platformTag)) throw new Error(`Refusing to update to ${namespace}/assistant:${platformTag}: tag is not published. stack.env was left unchanged.`);
-	const required = new Set(resolveRequiredPlatformImages(state));
-	const perImage = {};
-	for (const imageName of ["guardian", "portal"]) {
-		if (pinnedImages.includes(imageName)) continue;
-		if (await isDockerImageTagPublished(namespace, imageName, platformTag)) continue;
-		const fallbackTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, imageName), {
-			sameMajorAs: platformTag,
-			atOrBelow: platformTag
-		});
-		if (fallbackTag) {
-			perImage[`OP_${imageName.toUpperCase()}_IMAGE_TAG`] = fallbackTag;
-			continue;
-		}
-		if (required.has(imageName)) throw new Error(`Refusing to update to ${namespace}/*:${platformTag}: no published tag found for ${imageName} at or below ${platformTag}. This release is incomplete for the enabled services; stack.env was left unchanged.`);
-	}
-	return buildPlatformImageTagEnv(platformTag, perImage, pinnedImages);
-}
-function collectPinnedImageWarnings(currentEnv, pinnedImages, platformTag) {
-	if (!isComparableSemver(platformTag) || compareComparableVersions(platformTag, AUTH_TRANSITION_BOUNDARY_TAG) < 0) return [];
-	const warnings = [];
-	for (const image of pinnedImages) {
-		const pinnedTag = resolveEffectivePlatformImageTag(currentEnv, image);
-		if (!isComparableSemver(pinnedTag) || compareComparableVersions(pinnedTag, AUTH_TRANSITION_BOUNDARY_TAG) >= 0) continue;
-		warnings.push(JSON.stringify({
-			event: "unsupported-cross-boundary-pin",
-			service: image,
-			pinnedTag,
-			platformTag,
-			message: `Pinned ${image} image ${pinnedTag} is older than ${AUTH_TRANSITION_BOUNDARY_TAG} while the platform tag is ${platformTag}. Mixed-auth pinning across the 0.12 boundary is unsupported.`
-		}));
-	}
-	return warnings;
-}
-/**
-* Resolve the newest published tag for a SPECIFIC image on Docker Hub.
-*
-* `assistant` is the version-of-record image, but with independently versioned
-* units each image (guardian, portal, voice) has its own release line. This
-* resolves the newest semver tag for the given image name so a per-unit update
-* check compares against the unit's own latest, not the assistant's.
-*
-* Used both to auto-detect during "Update now" and to resolve a requested
-* `latest` selection into a concrete release tag before fetching stack assets
-* (GitHub has no asset tree at a `latest` ref).
-*/
-async function resolveLatestImageTag(namespace, imageName) {
-	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, imageName), {});
-	if (!latestTag) throw new Error(`No usable Docker image tag found for ${namespace}/${imageName}`);
-	return latestTag;
-}
-/**
-* Resolve the newest published tag for a SPECIFIC image, scoped to the current
-* major version of `currentTag`. Mirrors {@link resolveLatestImageTag} with the
-* same major-scoping + prerelease policy as the platform resolver.
-*/
-async function resolveLatestImageTagForCurrentMajor(namespace, imageName, currentTag, opts = {}) {
-	const skipPrerelease = !opts.allowPrerelease && !isPrerelease(currentTag);
-	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, imageName), {
-		sameMajorAs: currentTag,
-		skipPrerelease
-	});
-	if (!latestTag) throw new Error(`No usable Docker image tag found for ${namespace}/${imageName} in major ${majorVersionOf(currentTag) ?? currentTag}`);
-	return latestTag;
-}
-/**
-* List published Docker image tags for a SPECIFIC image, filtered + sorted.
-*
-* Mirrors {@link resolveLatestImageTag} / {@link resolveLatestImageTagForCurrentMajor}
-* but returns ALL matching tags (not just the newest), sorted newest (highest
-* semver) first. Used by the admin UI's per-unit version picker dropdowns so the
-* user can pin/rollback to any published tag — Docker Hub is the authoritative
-* source for what's available to deploy, per unit.
-*
-* Constraints (all optional):
-* - `sameMajorAs`    — only tags whose major component matches this tag.
-* - `skipPrerelease` — ignore prerelease tags (`-rc`, `-beta`, …). Default false
-*                      so the picker shows every tag on the line, including rcs.
-* - `max`            — cap the returned list (default 20).
-*
-* Tags are returned in Docker-canonical form (`v`-prefixed, as Docker Hub returns
-* them). The UI strips the `v` for display via `formatForDisplay`.
-*/
-async function listDockerImageTags(namespace, imageName, opts = {}) {
-	const { sameMajorAs, skipPrerelease = false, max = 20 } = opts;
-	const results = (await fetchDockerTagsPayload(namespace, imageName))?.results;
-	if (!Array.isArray(results)) return [];
-	const tags = [];
-	for (const entry of results) {
-		const name = typeof entry?.name === "string" ? entry.name.trim() : "";
-		if (!name || name === "latest") continue;
-		if (!isComparableSemver(name)) continue;
-		if (skipPrerelease && isPrerelease(name)) continue;
-		if (sameMajorAs !== void 0 && !isSameMajorVersion(name, sameMajorAs)) continue;
-		tags.push(name);
-	}
-	tags.sort((a, b) => compareComparableVersions(b, a));
-	return tags.slice(0, max);
-}
-/**
-* Resolve the newest published platform tag from the Docker registry.
-*
-* `assistant` is the version-of-record image: its newest tag is the canonical
-* platform version. Guardian/portal may lag behind it when a release shipped
-* only a subset of images — see resolvePlatformImageTags.
-*
-* Used both to auto-detect during "Update now" and to resolve a requested
-* `latest` selection into a concrete release tag before fetching stack assets
-* (GitHub has no asset tree at a `latest` ref).
-*/
-async function resolveLatestPlatformTag(namespace) {
-	return resolveLatestImageTag(namespace, "assistant");
-}
-/**
-* Resolve the default target version for `openpalm migrate --dry-run`: the
-* newest published platform tag in the current major. Mirrors the resolver the
-* upgrade path uses (same namespace, same base tag, same prerelease policy) so a
-* dry-run preview reflects the exact version `openpalm update` would move to.
-*/
-async function resolveDefaultMigrateTarget(state, opts = {}) {
-	return resolveLatestPlatformTagForCurrentMajor(resolveImageNamespace(state), resolvePlatformVersionPolicyBaseTag(state), { allowPrerelease: opts.allowPrerelease });
-}
-async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag, opts = {}) {
-	return resolveLatestImageTagForCurrentMajor(namespace, "assistant", currentTag, opts);
-}
-async function updateStackEnvToLatestImageTag(state, resolvedTag) {
-	const systemEnvPath = `${state.stashDir}/env/stack.env`;
-	const currentEnv = parseEnvFile(systemEnvPath);
-	const pinnedImages = parsePinnedImages(currentEnv.OP_PINNED_IMAGES);
-	const namespace = resolveImageNamespace(state);
-	const latestTag = resolvedTag ?? await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state));
-	const imageTagEnv = await resolvePlatformImageTags(state, namespace, latestTag, pinnedImages);
-	const pinnedImageEnv = buildPinnedImageTagEnv(currentEnv, pinnedImages);
-	const warnings = collectPinnedImageWarnings(currentEnv, pinnedImages, latestTag);
-	writeFileSync(systemEnvPath, mergeEnvContent(existsSync(systemEnvPath) ? readFileSync(systemEnvPath, "utf-8") : "", {
-		...pinnedImageEnv,
-		...imageTagEnv
-	}));
-	return {
-		namespace,
-		tag: latestTag,
-		warnings
-	};
-}
 async function applyUpgrade(state, version, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
@@ -8071,22 +7813,25 @@ async function withStackEnvRollback(state, run) {
 	}
 }
 /**
-* Full upgrade: resolve latest image tag, refresh assets, pull images,
-* and recreate containers. Used by both the admin endpoint and CLI.
+* Update the stack to the running control-plane version: run forward release
+* migrations, refresh core stack assets (compose/config) for PLATFORM_VERSION,
+* then pull images and recreate containers honoring the per-image OP_*_VERSION
+* pins already written in stack.env.
 *
-* Callers handle their own audit logging and admin self-recreation.
+* There are NO Docker Hub calls: image versions are user-managed in stack.env
+* (PATCH /admin/versions), and the platform asset version is the running lib's
+* PLATFORM_VERSION — never resolved from a remote registry.
 */
-async function performUpgrade(state, opts = {}) {
+async function performUpgrade(state, _opts = {}) {
 	return withStackEnvRollback(state, async () => {
 		const composeOpts = buildComposeOptions(state);
 		const namespace = resolveImageNamespace(state);
-		const imageTag = await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state), { allowPrerelease: opts.allowPrerelease });
+		const releaseTag = "platform-" + normalizeVersion(PLATFORM_VERSION);
 		ensureReleaseMigrated({
 			homeDir: state.homeDir,
-			targetVersion: imageTag
+			targetVersion: PLATFORM_VERSION
 		});
-		const { tag: confirmedImageTag, warnings } = await updateStackEnvToLatestImageTag(state, imageTag);
-		const upgradeResult = await applyUpgrade(state, "platform-" + normalizeVersion(confirmedImageTag));
+		const upgradeResult = await applyUpgrade(state, releaseTag);
 		const pullResult = await composePull(composeOpts);
 		if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
 		const services = await buildManagedServices(state);
@@ -8098,134 +7843,11 @@ async function performUpgrade(state, opts = {}) {
 		});
 		if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
 		return {
-			imageTag: confirmedImageTag,
-			namespace,
-			backupDir: upgradeResult.backupDir,
-			assetsUpdated: upgradeResult.updated,
-			restarted: upgradeResult.restarted,
-			warnings
-		};
-	});
-}
-/**
-* Set a specific image tag in stack.env then pull images and restart containers.
-* Used by the admin "set version" action — skips the auto-detect step in performUpgrade.
-*/
-async function applyTagChange(state, tag, opts = {}) {
-	return withStackEnvRollback(state, async () => {
-		const namespace = resolveImageNamespace(state);
-		const requested = tag.trim();
-		let resolvedTag = requested;
-		if (requested === "" || requested.toLowerCase() === "latest") try {
-			resolvedTag = await resolveLatestPlatformTag(namespace);
-		} catch (e) {
-			const msg = e instanceof Error ? e.message : String(e);
-			throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
-		}
-		assertNotUnconfirmedDowngrade(state, resolvedTag, opts.confirmDowngrade ?? false);
-		const dockerTag = extractDockerTagFromReleaseTag(resolvedTag);
-		const stackEnvPath = `${state.stashDir}/env/stack.env`;
-		const currentEnv = parseEnvFile(stackEnvPath);
-		const pinnedImages = parsePinnedImages(currentEnv.OP_PINNED_IMAGES);
-		const imageTagEnv = await resolvePlatformImageTags(state, namespace, dockerTag, pinnedImages);
-		const pinnedImageEnv = buildPinnedImageTagEnv(currentEnv, pinnedImages);
-		const warnings = collectPinnedImageWarnings(currentEnv, pinnedImages, dockerTag);
-		ensureReleaseMigrated({
-			homeDir: state.homeDir,
-			targetVersion: resolvedTag
-		});
-		writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", {
-			...pinnedImageEnv,
-			...imageTagEnv
-		}));
-		const upgradeResult = await applyUpgrade(state, resolvedTag);
-		return {
-			imageTag: dockerTag,
+			imageTag: PLATFORM_VERSION,
 			namespace,
 			backupDir: upgradeResult.backupDir,
 			assetsUpdated: upgradeResult.updated,
 			restarted: upgradeResult.restarted,
-			warnings
-		};
-	});
-}
-/**
-* Read the currently-configured image tag for a single deployable unit from
-* stack.env. Falls back to OP_IMAGE_TAG (the compose substitution fallback) and
-* finally PLATFORM_VERSION, mirroring the compose `${OP_*_IMAGE_TAG:-…}` chain.
-*/
-function resolveUnitCurrentTag(state, unit) {
-	const envVars = parseEnvFile(`${state.stashDir}/env/stack.env`);
-	const tag = envVars[deployableUnitImageTagKey(unit)]?.trim() || envVars.OP_IMAGE_TAG?.trim();
-	if (isComparableSemver(tag)) return tag;
-	return PLATFORM_VERSION;
-}
-/**
-* Per-unit downgrade gate (#501). A target OLDER than the unit's CURRENT tag is
-* a downgrade — forward-only release migrations don't run backward, so require
-* explicit confirmation. Compared against the unit's own tag (not the platform
-* OP_IMAGE_TAG) so pinning guardian back a patch doesn't trip on the assistant
-* version.
-*/
-function assertNotUnconfirmedUnitDowngrade(state, unit, targetTag, confirmDowngrade) {
-	if (confirmDowngrade) return;
-	const currentTag = resolveUnitCurrentTag(state, unit);
-	if (!isComparableSemver(targetTag) || !isComparableSemver(currentTag)) return;
-	if (compareComparableVersions(targetTag, currentTag) >= 0) return;
-	throw new DowngradeConfirmationRequired(currentTag, targetTag);
-}
-/**
-* Pin a SINGLE deployable unit's image tag in stack.env, then pull + recreate.
-*
-* Unlike {@link applyTagChange} (a full platform upgrade), this writes only the
-* one `OP_*_IMAGE_TAG` env var for the named unit and does NOT run release
-* migrations or refresh stack compose assets — those are platform-level and run
-* on `performUpgrade` / `applyTagChange`. Per-unit pinning is for rolling one
-* image back to a known-good release or pinning it to a tested build without
-* moving the rest of the stack.
-*
-* Non-destructive: the write uses `mergeEnvContent` so existing user keys
-* (including commented-out ones) are preserved.
-*/
-async function applyUnitImageTagChange(state, unit, tag, opts = {}) {
-	if (!isDeployableUnit(unit)) throw new Error(`Unknown deployable unit: ${unit}`);
-	const typedUnit = unit;
-	return withStackEnvRollback(state, async () => {
-		const namespace = resolveImageNamespace(state);
-		const imageName = deployableUnitImageName(typedUnit);
-		const envKey = deployableUnitImageTagKey(typedUnit);
-		const requested = tag.trim();
-		let resolvedTag = requested;
-		if (requested === "" || requested.toLowerCase() === "latest") try {
-			resolvedTag = await resolveLatestImageTag(namespace, imageName);
-		} catch (e) {
-			const msg = e instanceof Error ? e.message : String(e);
-			throw new Error(`Cannot resolve "latest" to a concrete release for ${typedUnit}: ${msg}. Check your network connection or select a specific version.`);
-		}
-		assertNotUnconfirmedUnitDowngrade(state, typedUnit, resolvedTag, opts.confirmDowngrade ?? false);
-		const dockerTag = extractDockerTagFromReleaseTag(resolvedTag);
-		if (namespace === "openpalm") {
-			if (!await isDockerImageTagPublished(namespace, imageName, dockerTag)) throw new Error(`Refusing to pin ${namespace}/${imageName}:${dockerTag}: tag is not published. stack.env was left unchanged.`);
-		}
-		const stackEnvPath = `${state.stashDir}/env/stack.env`;
-		writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", { [envKey]: dockerTag }));
-		const composeOpts = buildComposeOptions(state);
-		const pullResult = await composePull(composeOpts);
-		if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
-		const services = await buildManagedServices(state);
-		const upResult = await composeUp({
-			...composeOpts,
-			services,
-			forceRecreate: true,
-			removeOrphans: true
-		});
-		if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
-		return {
-			imageTag: dockerTag,
-			namespace,
-			backupDir: null,
-			assetsUpdated: [],
-			restarted: services,
 			warnings: []
 		};
 	});
@@ -8536,7 +8158,8 @@ function parseComposePsOutput(stdout) {
 	return results;
 }
 function resolveImageTag(state) {
-	return parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_TAG ?? "";
+	const env = parseEnvFile(`${state.stashDir}/env/stack.env`);
+	return env.OP_ASSISTANT_VERSION ?? env.OP_IMAGE_TAG ?? "";
 }
 async function missingServiceImages(composeOpts, services) {
 	if (services.length === 0) return [];
@@ -9412,71 +9035,6 @@ async function validateProposedState(state) {
 	};
 }
 //#endregion
-//#region ../lib/src/control-plane/npm-registry.ts
-/**
-* npm registry lookups — latest version + version list for any npm package.
-*
-* The admin UI's "Admin interface" picker (@openpalm/ui) and the platform
-* latest-version check (@openpalm/lib) both read from the npm registry. Keeping
-* these helpers in lib (not duplicated in the UI) follows the shared control-
-* plane library rule: both CLI and admin import portable lookups from
-* `@openpalm/lib`.
-*
-* Uses the Web Platform `fetch` built-in — no third-party deps.
-*/
-var NPM_REGISTRY = "https://registry.npmjs.org";
-var NPM_TIMEOUT_MS = 8e3;
-async function fetchNpmPackument(packageName) {
-	let response;
-	try {
-		response = await fetch(`${NPM_REGISTRY}/${packageName}`, {
-			headers: {
-				"User-Agent": "openpalm-admin/1.0",
-				Accept: "application/json"
-			},
-			signal: AbortSignal.timeout(NPM_TIMEOUT_MS)
-		});
-	} catch (e) {
-		throw new Error(`Failed to query npm registry: ${e instanceof Error ? e.message : String(e)}`);
-	}
-	if (response.status === 404) return {};
-	if (!response.ok) throw new Error(`npm registry lookup failed (${response.status})`);
-	return await response.json();
-}
-/**
-* Resolve the latest published version of an npm package from its dist-tags.
-*
-* `distTag` defaults to `'latest'`; pass `{ allowPrerelease: true }` (or
-* `{ distTag: 'next' }`) to read the prerelease channel. Returns `null` when the
-* package exists but the requested dist-tag is absent.
-*/
-async function resolveLatestNpmVersion(packageName, opts = {}) {
-	const distTag = opts.distTag ?? (opts.allowPrerelease ? "next" : "latest");
-	const version = ((await fetchNpmPackument(packageName))["dist-tags"] ?? {})[distTag];
-	return typeof version === "string" ? version : null;
-}
-/**
-* List published npm versions for a package, newest-first by publish time.
-*
-* Mirrors the shape the admin UI's `@openpalm/ui` picker expects. Returns at
-* most `max` entries (default 20). A 404 (package not yet published) yields an
-* empty list.
-*/
-async function listNpmVersions(packageName, opts = {}) {
-	const { max = 20 } = opts;
-	const packument = await fetchNpmPackument(packageName);
-	const distTags = packument["dist-tags"] ?? {};
-	const versionToTag = /* @__PURE__ */ new Map();
-	for (const [tag, version] of Object.entries(distTags)) versionToTag.set(version, tag);
-	const time = packument.time ?? {};
-	return Object.keys(packument.versions ?? {}).map((version) => ({
-		version,
-		prerelease: version.includes("-"),
-		publishedAt: time[version] ?? null,
-		distTag: versionToTag.get(version) ?? null
-	})).sort((a, b) => (b.publishedAt ?? "").localeCompare(a.publishedAt ?? "")).slice(0, max);
-}
-//#endregion
 //#region ../lib/src/control-plane/markdown-task.ts
 /**
 * AKM task parser.
@@ -10455,7 +10013,8 @@ async function performSetup(input, opts) {
 		try {
 			const systemEnvForAkm = existsSync(`${state.stashDir}/env/stack.env`) ? readFileSync(`${state.stashDir}/env/stack.env`, "utf-8") : "";
 			const akmUpdates = {};
-			Object.assign(akmUpdates, buildPlatformImageTagEnv(imageTag && imageTag.trim() ? imageTag.trim() : DEFAULT_IMAGE_TAG));
+			const requestedTag = imageTag && imageTag.trim() ? imageTag.trim() : "latest";
+			for (const key of SERVICE_VERSION_KEYS) akmUpdates[key] = requestedTag;
 			if (Object.keys(akmUpdates).length > 0) writeFileAtomic(`${state.stashDir}/env/stack.env`, mergeEnvContent(systemEnvForAkm, akmUpdates), 384);
 			if (llm || embedding) {
 				const akmConfigDir = join(state.configDir, "akm");
@@ -10911,5 +10470,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { ensureOpenCodeSystemConfig as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStats as E, composeStop as F, composeUp as G, createLogger as H, INSTALL_LOCK_STALE_AFTER_MS as I, createOpenCodeClient as J, createState as K, deleteUserEnvKey as L, MigrationError as M, deriveLaunchStatus as N, deriveLocalStackState as O, PLATFORM_VERSION as P, detectGpu as Q, detectHostOpenCode as R, detectLocalProviders as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, enableHostAkmSharing as W, ensureAkmUserEnv as X, ensureHomeDirs as Y, ensureMigrated as Z, ensureOpenCodeConfig as _, addonProfileId as a, runDeploy as a$, ensureReleaseMigrated as a0, ensureSecrets as a1, executeAutomation as a2, fetchProviderModels as a3, formatForDisplay as a4, getAddonProfileAvailability as a5, getAddonProfileSelection as a6, getAddonProfiles as a7, getAddonServiceNames as a8, getAkmStats as a9, performSetup as aA, performUpgrade as aB, pruneBackupDirs as aC, readAutomationLogs as aD, readDeployJournal as aE, readSecret as aF, readSecretFile as aG, readSecretStripNotice as aH, readStackEnv as aI, readStackRuntimeEnv as aJ, readStackSecretEnv as aK, readTaskFile as aL, readUserEnvFile as aM, recommendSetup as aN, removeSecretFile as aO, removeTaskFile as aP, resolveComposeProjectName as aQ, resolveDataDir as aR, resolveDefaultMigrateTarget as aS, resolveDeployJournalPath as aT, resolveEffectivePlatformImageTag as aU, resolveLatestImageTag as aV, resolveLatestImageTagForCurrentMajor as aW, resolveLatestNpmVersion as aX, resolveRuntimeFiles as aY, resolveStackDir as aZ, runAssistantAkmCommand as a_, getDockerEvents as aa, getHostAkmSharingStatus as ab, getRegistryAddonConfig as ac, hostAkmStashPath as ad, importHostOpenCode as ae, initializeStateSecrets as af, inspectInstallLock as ag, isAllowedService as ah, isComparableSemver as ai, isDeployableUnit as aj, isHostAkmAvailable as ak, isPrerelease as al, isSetupComplete as am, listAssistantCliTools as an, listAvailableAddonIds as ao, listBackupDirs as ap, listDockerImageTags as aq, listEnabledAddonIds as ar, listNpmVersions as as, listSecretFiles as at, loadAutomations as au, mapDockerError as av, markSetupComplete as aw, parseComposeStderr as ax, parseEnvFile as ay, patchSecretsEnvFile as az, annotateAddonProfileAvailability as b, seedUiBuild as b0, setAddonEnabled as b1, setAddonProfileSelection as b2, summarizeBackups as b3, summarizeComposeStderr as b4, unlockInstallLock as b5, useExistingProviderForAssistantCli as b6, validateProposedState as b7, writeFileAtomic as b8, writeRuntimeFiles as b9, writeSecretFile as ba, writeStackSecretEnv as bb, writeTaskFile as bc, writeUserEnvKey as bd, writeVoiceVars as be, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUnitImageTagChange as f, applyUpdate as g, assertSafeSecretFilename as h, assertSafeTaskFilename as i, authJsonPath as j, backupSetupInputs as k, buildAkmEndpoint as l, buildAkmEnv as m, buildComposeOptions as n, buildManagedServices as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, collectBindAddressWarnings as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-B3g4Ry1X.js.map
+export { ensureSecrets as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, composeStop as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, INSTALL_LOCK_STALE_AFTER_MS as I, deleteUserEnvKey as J, deriveLaunchStatus as K, deriveLocalStackState as L, MigrationError as M, detectGpu as N, detectHostOpenCode as O, PLATFORM_VERSION as P, detectLocalProviders as Q, detectRuntime as R, disableHostAkmSharing as S, dismissSecretStripNotice as T, enableHostAkmSharing as U, ensureAkmUserEnv as V, ensureHomeDirs as W, ensureMigrated as X, ensureOpenCodeConfig as Y, ensureOpenCodeSystemConfig as Z, ensureReleaseMigrated as _, ALL_VERSION_KEYS as a, writeSecretFile as a$, executeAutomation as a0, fetchProviderModels as a1, formatForDisplay as a2, getAddonProfileAvailability as a3, getAddonProfileSelection as a4, getAddonProfiles as a5, getAddonServiceNames as a6, getAkmStats as a7, getDockerEvents as a8, getHostAkmSharingStatus as a9, readSecretStripNotice as aA, readStackEnv as aB, readStackRuntimeEnv as aC, readStackSecretEnv as aD, readTaskFile as aE, readUserEnvFile as aF, readVersions as aG, recommendSetup as aH, removeSecretFile as aI, removeTaskFile as aJ, resolveComposeProjectName as aK, resolveDataDir as aL, resolveDeployJournalPath as aM, resolveRuntimeFiles as aN, resolveStackDir as aO, runAssistantAkmCommand as aP, runDeploy as aQ, seedUiBuild as aR, setAddonEnabled as aS, setAddonProfileSelection as aT, summarizeBackups as aU, summarizeComposeStderr as aV, unlockInstallLock as aW, useExistingProviderForAssistantCli as aX, validateProposedState as aY, writeFileAtomic as aZ, writeRuntimeFiles as a_, getRegistryAddonConfig as aa, hostAkmStashPath as ab, importHostOpenCode as ac, initializeStateSecrets as ad, inspectInstallLock as ae, isAllowedService as af, isHostAkmAvailable as ag, isPrerelease as ah, isSetupComplete as ai, listAssistantCliTools as aj, listAvailableAddonIds as ak, listBackupDirs as al, listEnabledAddonIds as am, listSecretFiles as an, loadAutomations as ao, mapDockerError as ap, markSetupComplete as aq, parseComposeStderr as ar, patchSecretsEnvFile as as, performSetup as at, performUpgrade as au, pruneBackupDirs as av, readAutomationLogs as aw, readDeployJournal as ax, readSecret as ay, readSecretFile as az, addonProfileId as b, writeStackSecretEnv as b0, writeTaskFile as b1, writeUserEnvKey as b2, writeVersions as b3, writeVoiceVars as b4, annotateAddonProfileAvailability as c, applyInstall as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, composeDown as s, composeLogs as t, composePreflight as u, composePs as v, composePull as w, composeRestart as x, composeStart as y, composeStats as z };
+//# sourceMappingURL=src-BN-m14sE.js.map