@openpalm/ui 0.12.28 → 0.12.30

package/build/server/chunks/{src-CUQ7IJUr.js → src-D4Gm5mXv.js}

@@ -279,7 +279,7 @@ var import_dist = require_dist();
 * On any unexpected error (permissions, ENOSPC, etc.) we return null so the
 * caller surfaces "install_in_progress" rather than silently fake-acquiring.
 */
-var logger$12 = createLogger("install-lock");
+var logger$13 = createLogger("install-lock");
 var STALE_AFTER_MS = 1800 * 1e3;
 function isProcessAlive(pid) {
 	try {
@@ -346,7 +346,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		mkdirSync(dataDir, { recursive: true });
 	} catch (err) {
-		logger$12.warn("failed to ensure data dir for install lock", {
+		logger$13.warn("failed to ensure data dir for install lock", {
 			dataDir,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -356,18 +356,18 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$12.warn("unexpected error acquiring install lock", {
+		logger$13.warn("unexpected error acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
 		return null;
 	}
 	if (!isStale(path)) return null;
-	logger$12.info("removing stale install lock and retrying acquire", { path });
+	logger$13.info("removing stale install lock and retrying acquire", { path });
 	try {
 		rmSync(path, { force: true });
 	} catch (err) {
-		logger$12.warn("failed to remove stale install lock", {
+		logger$13.warn("failed to remove stale install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -376,7 +376,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$12.warn("unexpected error re-acquiring install lock", {
+		logger$13.warn("unexpected error re-acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -443,9 +443,9 @@ function unlockInstallLock(dataDir) {
 	};
 	try {
 		rmSync(status.path, { force: true });
-		logger$12.info("removed stale install lock via unlock", { path: status.path });
+		logger$13.info("removed stale install lock via unlock", { path: status.path });
 	} catch (err) {
-		logger$12.warn("failed to remove stale install lock during unlock", {
+		logger$13.warn("failed to remove stale install lock during unlock", {
 			path: status.path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -462,7 +462,7 @@ function releaseInstallLock(handle) {
 	try {
 		rmSync(handle.path, { force: true });
 	} catch (err) {
-		logger$12.warn("failed to release install lock", {
+		logger$13.warn("failed to release install lock", {
 			path: handle.path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -738,7 +738,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.28"};
+	version: "0.12.30"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -5257,7 +5257,7 @@ function randomHex(bytes) {
 * Env validation has moved to `akm vault` + the in-house redactor — the
 * historical `.env.schema` files (varlock format) were retired in #391.
 */
-var logger$11 = createLogger("core-assets");
+var logger$12 = createLogger("core-assets");
 var GITHUB_ASSET_TIMEOUT_MS = 1e4;
 var _require$1 = createRequire(import.meta.url);
 function bundledAssetPath(relPath) {
@@ -5282,7 +5282,7 @@ function readBundledStackAsset(name) {
 	try {
 		return readFileSync(bundledAssetPath(`config/stack/${name}`), "utf-8");
 	} catch (err) {
-		logger$11.warn("bundled stack asset unavailable (returning empty)", {
+		logger$12.warn("bundled stack asset unavailable (returning empty)", {
 			name,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -5380,7 +5380,7 @@ function refreshCoreAssetsFromSource(sourceRoot, homeDir = resolveOpenPalmHome()
 			const currentContent = readFileSync(targetPath, "utf-8");
 			if (sha256(currentContent) === sha256(freshContent)) continue;
 			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$11.info("guardian managed asset kept (user-modified); new default available", {
+				logger$12.info("guardian managed asset kept (user-modified); new default available", {
 					path: asset.relPath,
 					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
 				});
@@ -5430,7 +5430,7 @@ async function refreshCoreAssets(version) {
 			const currentContent = readFileSync(targetPath, "utf-8");
 			if (sha256(currentContent) === sha256(freshContent)) continue;
 			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$11.info("guardian managed asset kept (user-modified); new default available", {
+				logger$12.info("guardian managed asset kept (user-modified); new default available", {
 					path: asset.relPath,
 					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
 				});
@@ -5478,7 +5478,7 @@ async function refreshCoreAssets(version) {
 *   5. null → remote download (from the @openpalm/ui npm registry tarball)
 */
 var _require = createRequire(import.meta.url);
-var logger$10 = createLogger("lib:ui-assets");
+var logger$11 = createLogger("lib:ui-assets");
 async function fetchWithRetry(url, retries = 3) {
 	for (let i = 0; i < retries; i++) try {
 		const res = await fetch(url, { signal: AbortSignal.timeout(6e4) });
@@ -5581,7 +5581,7 @@ async function downloadNpmUiBundle(manifest, uiDir, dataDir) {
 	const data = new Uint8Array(await res.arrayBuffer());
 	if (!manifest.integrity) throw new Error(`npm manifest for ${UI_PACKAGE}@${manifest.version} has no integrity hash — refusing to install unverified`);
 	verifyNpmIntegrity(data, manifest.integrity);
-	logger$10.debug("UI bundle integrity verified", { version: manifest.version });
+	logger$11.debug("UI bundle integrity verified", { version: manifest.version });
 	const tmpTar = join(dataDir, ".ui-build.tgz.tmp");
 	const staging = join(dataDir, ".ui-build.staging");
 	try {
@@ -5624,7 +5624,7 @@ async function seedUiBuild(repoRef, dataDir, options) {
 	const uiDir = join(dataDir, "ui");
 	mkdirSync(uiDir, { recursive: true });
 	const manifest = await fetchNpmUiManifest(normalizeVersion(repoRef));
-	logger$10.debug("downloading UI build from npm", { version: manifest.version });
+	logger$11.debug("downloading UI build from npm", { version: manifest.version });
 	await downloadNpmUiBundle(manifest, uiDir, dataDir);
 }
 //#endregion
@@ -5746,7 +5746,7 @@ function removeSecretFile(stackDir, name) {
 //#region ../lib/src/control-plane/secrets.ts
 /** Secrets and capability key management. */
 var OPENCODE_STARTER_CONFIG = JSON.stringify({ $schema: "https://opencode.ai/config.json" }, null, 2) + "\n";
-var logger$9 = createLogger("secrets");
+var logger$10 = createLogger("secrets");
 var VAULT_DIR_MODE = 448;
 var VAULT_FILE_MODE = 384;
 var SECRET_ENV_KEY_RE = /(?:^OP_UI_LOGIN_PASSWORD$|^OP_OPENCODE_PASSWORD$|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$)/;
@@ -5779,7 +5779,7 @@ function enforceVaultDirMode(vaultDir) {
 	try {
 		chmodSync(vaultDir, VAULT_DIR_MODE);
 	} catch (error) {
-		logger$9.warn("failed to enforce vault directory permissions", {
+		logger$10.warn("failed to enforce vault directory permissions", {
 			vaultDir,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -5790,7 +5790,7 @@ function writeVaultFile(path, content) {
 	try {
 		chmodSync(path, VAULT_FILE_MODE);
 	} catch (error) {
-		logger$9.warn("failed to enforce vault file permissions", {
+		logger$10.warn("failed to enforce vault file permissions", {
 			path,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -5857,7 +5857,7 @@ function ensureAuthJson(state) {
 			return;
 		}
 	} catch (error) {
-		logger$9.warn("failed to repair auth.json path", {
+		logger$10.warn("failed to repair auth.json path", {
 			path: authJsonPath$1,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -5900,12 +5900,12 @@ function writeAuthJsonProviderKeys(state, providerKeys) {
 		const corruptPath = `${authJsonPath$2}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
 		try {
 			renameSync(authJsonPath$2, corruptPath);
-			logger$9.warn("corrupt auth.json renamed for recovery", {
+			logger$10.warn("corrupt auth.json renamed for recovery", {
 				original: authJsonPath$2,
 				renamed: corruptPath
 			});
 		} catch (renameErr) {
-			logger$9.warn("could not rename corrupt auth.json; starting fresh", {
+			logger$10.warn("could not rename corrupt auth.json; starting fresh", {
 				path: authJsonPath$2,
 				error: renameErr instanceof Error ? renameErr.message : String(renameErr)
 			});
@@ -6152,7 +6152,7 @@ function writeVersions(state, updates) {
 * Files are validated in-place before writing; rollback is handled by
 * the rollback module (snapshot to OP_HOME/data/rollback/).
 */
-var logger$8 = createLogger("config-persistence");
+var logger$9 = createLogger("config-persistence");
 /**
 * Return the env files used for docker compose --env-file args.
 *
@@ -6190,7 +6190,7 @@ function writeSystemEnv(state) {
 	const { content: strippedBase, removed } = stripSecretLikeEnvKeys(base);
 	base = strippedBase;
 	if (removed.length > 0) {
-		logger$8.warn("Removed secret-looking keys from stack.env (they belong in Connections/secrets)", {
+		logger$9.warn("Removed secret-looking keys from stack.env (they belong in Connections/secrets)", {
 			removedKeys: removed,
 			stackEnvPath: systemEnvPath
 		});
@@ -6241,7 +6241,7 @@ function recordSecretStripNotice(state, newlyRemoved) {
 		mkdirSync(state.dataDir, { recursive: true });
 		writeFileSync(path, JSON.stringify(notice, null, 2));
 	} catch (e) {
-		logger$8.warn("Could not persist secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+		logger$9.warn("Could not persist secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
 	}
 }
 /** Read the pending secret-strip notice, or null when there is none. */
@@ -6263,7 +6263,7 @@ function dismissSecretStripNotice(state) {
 	if (existsSync(path)) try {
 		rmSync(path);
 	} catch (e) {
-		logger$8.warn("Could not dismiss secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+		logger$9.warn("Could not dismiss secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
 	}
 }
 function generateFallbackSystemEnv(state) {
@@ -6413,7 +6413,7 @@ function chownVolumeTarget(path, operatorIds) {
 	try {
 		chownSync(path, operatorIds.uid, operatorIds.gid);
 	} catch (error) {
-		logger$8.warn(`Could not chown volume target ${path} to ${operatorIds.uid}:${operatorIds.gid}: ${error instanceof Error ? error.message : String(error)}`);
+		logger$9.warn(`Could not chown volume target ${path} to ${operatorIds.uid}:${operatorIds.gid}: ${error instanceof Error ? error.message : String(error)}`);
 	}
 }
 function writeRuntimeFiles(state) {
@@ -6472,7 +6472,7 @@ function canonicalAddonProfileSelection(addon, profile) {
 * the runtime source of truth.
 */
 var VALID_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
-var logger$7 = createLogger("registry");
+var logger$8 = createLogger("registry");
 function getRegistryAutomation(name) {
 	if (!VALID_NAME_RE.test(name)) return null;
 	const localOpenpalmDir = resolveLocalOpenpalmDir();
@@ -6519,7 +6519,7 @@ function readAddonServiceNamesFromContent(composeContent, composePath, addonName
 			return Array.isArray(profiles) && profiles.some((p) => typeof p === "string" && p.startsWith(`addon.${addonName}`));
 		}).map(([serviceName]) => serviceName);
 	} catch (error) {
-		logger$7.warn("failed to parse addon compose services", {
+		logger$8.warn("failed to parse addon compose services", {
 			composePath,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -6687,7 +6687,7 @@ function readAddonProfilesFromContent(composeContent, composePath) {
 	try {
 		parsed = (0, import_dist.parse)(composeContent);
 	} catch (error) {
-		logger$7.warn("failed to parse addon compose profiles", {
+		logger$8.warn("failed to parse addon compose profiles", {
 			composePath,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -7146,7 +7146,7 @@ function isSetupComplete(stackDir) {
 //#endregion
 //#region ../lib/src/control-plane/docker.ts
 /** Docker integration — executes docker compose commands via execFile (no shell). */
-var logger$6 = createLogger("lib:docker");
+var logger$7 = createLogger("lib:docker");
 /** Execute docker with an argument array — no shell interpolation. */
 function run$1(args, cwd, timeoutMs = 12e4, envOverrides) {
 	return new Promise((resolve) => {
@@ -7505,7 +7505,7 @@ async function repairRootOwnedBindMounts(homeDir) {
 	if (!ids) return;
 	const volumeArgs = rootOwned.flatMap((dir, i) => ["-v", `${dir}:/chown_target_${i}`]);
 	const targets = rootOwned.map((_, i) => `/chown_target_${i}`).join(" ");
-	logger$6.info(`Repairing root-owned bind mounts: ${rootOwned.map((d) => d.split("/").slice(-2).join("/")).join(", ")}`);
+	logger$7.info(`Repairing root-owned bind mounts: ${rootOwned.map((d) => d.split("/").slice(-2).join("/")).join(", ")}`);
 	const result = await run$1([
 		"run",
 		"--rm",
@@ -7515,7 +7515,7 @@ async function repairRootOwnedBindMounts(homeDir) {
 		"-c",
 		`chown -R ${ids.uid}:${ids.gid} ${targets}`
 	], void 0, 3e4);
-	if (!result.ok) logger$6.warn(`Could not repair root-owned bind mounts: ${result.stderr.trim()}`);
+	if (!result.ok) logger$7.warn(`Could not repair root-owned bind mounts: ${result.stderr.trim()}`);
 }
 //#endregion
 //#region ../lib/src/control-plane/launch-status.ts
@@ -8633,36 +8633,19 @@ function buildAkmEndpoint(provider, baseUrl, suffix) {
 /**
 * Host ↔ Assistant AKM source wiring (control-plane logic — lives in lib).
 *
-* Implements the "symmetric writable secondary" design
-* (docs/technical/akm-host-assistant-integration-proposal.md §8).
-*
-* Each akm instance keeps its OWN primary stash, data dir, and cache. Sharing
-* is done purely by adding the other instance's stash as a *secondary* source
-* in `config.sources[]`:
-*   - The OpenPalm/container config gains a `host-akm` source → /host-stash
-*     (the user's personal ~/akm, bind-mounted by the host-akm.compose.yml overlay).
-*   - The personal config gains an `openpalm` source → OP_HOME/knowledge.
-*
-* VERIFIED against akm 0.8.0 (rc.13 → stable; schema unchanged):
-*  - `SourceConfigEntrySchema` (config-schema.ts:259) accepts
-*    { type, path?, url?, name?, enabled?, writable?, primary?, options?, wikiName? }.
-*  - The indexer's `resolveSourceEntries` (search-source.ts:56) ALWAYS injects the
-*    env-resolved primary stash (AKM_STASH_DIR) as sources[0], then appends
-*    config.sources[] deduped by path. So a secondary entry can never strand or
-*    displace the primary — provided we NEVER set `primary:true` and NEVER set
-*    `config.stashDir`.
-*  - Writes resolve to the primary unless an explicit `--target` is given
-*    (write-source.ts) and `defaultWriteTarget` is left unset, so a writable
-*    secondary is safe by construction.
+* The assistant config ALWAYS has a `host-akm` secondary source pointing at
+* /host-stash (written once at install, never removed). The compose bind-mount
+* controls what actually lands at /host-stash: the real ~/akm when sharing is
+* enabled, an empty dir when disabled. Profile import is best-effort — missing
+* or corrupt host config is logged and skipped, never an error.
 *
 * Invariants (enforced + unit-tested):
 *  - Only ever appends/updates a NAMED source (idempotent upsert by name).
 *  - NEVER sets `primary`, NEVER sets `defaultWriteTarget`, NEVER sets `stashDir`.
 *  - Atomic 0600 writes.
 *  - The OpenPalm config is parse-tolerant (we own it: corrupt → start from {}).
-*  - The PERSONAL config FAILS CLOSED (corrupt/unreadable → throw, never overwrite
-*    the user's file). This asymmetry is the host-data-loss guard.
 */
+var logger$6 = createLogger("akm-sources");
 /** Source entry name added to the OpenPalm/container config (points at /host-stash). */
 var HOST_SOURCE_NAME = "host-akm";
 function readConfigTolerant(configPath) {
@@ -8674,22 +8657,15 @@ function readConfigTolerant(configPath) {
 		return {};
 	}
 }
-function readConfigFailClosed(configPath) {
-	if (!existsSync(configPath)) throw new Error(`Personal akm config not found at ${configPath}; refusing to create it. Run \`akm init\`/\`akm setup\` first, then enable host AKM sharing.`);
-	let text;
-	try {
-		text = readFileSync(configPath, "utf-8");
-	} catch (err) {
-		throw new Error(`Unable to read personal akm config at ${configPath}: ${err.message}`);
-	}
-	let parsed;
+function readHostConfigBestEffort(configPath) {
+	if (!existsSync(configPath)) return null;
 	try {
-		parsed = JSON.parse(text);
+		const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+		return parsed && typeof parsed === "object" ? parsed : null;
 	} catch {
-		throw new Error(`Personal akm config at ${configPath} is not valid JSON; refusing to overwrite it. Fix the file by hand, then retry.`);
+		logger$6.warn("host akm config is not valid JSON — skipping profile import", { configPath });
+		return null;
 	}
-	if (!parsed || typeof parsed !== "object") throw new Error(`Personal akm config at ${configPath} is not a JSON object; refusing to overwrite it.`);
-	return parsed;
 }
 /**
 * Upsert a named filesystem source into `config.sources[]` by name. Idempotent.
@@ -8708,14 +8684,6 @@ function upsertSource(config, entry) {
 		sources
 	};
 }
-function removeSource(config, name) {
-	if (!Array.isArray(config.sources)) return config;
-	const sources = config.sources.filter((s) => !(s && typeof s === "object" && s.name === name));
-	return {
-		...config,
-		sources
-	};
-}
 function assertNoPrimaryEscalation(entry) {
 	if (entry.primary !== void 0) throw new Error("akm-sources: refusing to write a source entry carrying `primary`.");
 }
@@ -8741,31 +8709,19 @@ function addHostStashToOpenpalmConfig(state, writable = true) {
 	writeFileAtomic(configPath, JSON.stringify(updated, null, 2), 384);
 }
 /**
-* Remove the `host-akm` secondary source from the assistant config (disable
-* sharing). Parse-tolerant; never touches the user's personal config (D1 —
-* host sharing is assistant-reads-host only). Idempotent.
-*/
-function removeHostAkmSource(state) {
-	const opPath = openpalmConfigPath(state);
-	const opConfig = readConfigTolerant(opPath);
-	writeFileAtomic(opPath, JSON.stringify(removeSource(opConfig, HOST_SOURCE_NAME), null, 2), 384);
-}
-/**
-* Read-only snapshot import of the host's reusable akm config into the OpenPalm
-* config. Reads the personal config READ-ONLY; never writes back to the host.
+* Best-effort import of the host's LLM/agent profiles into the OpenPalm akm config.
+* Reads the personal host config READ-ONLY; never writes back to the host.
 *
 * ADDITIVE MERGE: existing OpenPalm values ALWAYS win — the host only fills gaps.
-* A profile name, default selection, or embedding field that OpenPalm already has
-* is never overwritten; host-only profiles/fields are added. Covers the
-* LLM/agent/improve PROFILES (+ their `defaults.*`) and the top-level `embedding`
-* connection. Returns which sections actually gained values.
+* Returns `{ imported: [] }` when the host config is absent or unreadable (never
+* throws — profile import is always optional).
 *
-* Writes the canonical akm 0.8.0 shape (profiles.* + defaults.* + embedding) —
-* never the legacy top-level `llm` (see I-3). NEVER touches `sources`, `stashDir`,
-* `registries`, or `installed`.
+* Writes the canonical akm shape (profiles.* + defaults.* + embedding).
+* NEVER touches `sources`, `stashDir`, `registries`, or `installed`.
 */
 function importHostProfiles(state, hostConfigPath) {
-	const host = readConfigFailClosed(hostConfigPath);
+	const host = readHostConfigBestEffort(hostConfigPath);
+	if (!host) return { imported: [] };
 	const hostProfiles = host.profiles ?? {};
 	const hostDefaults = host.defaults ?? {};
 	const opPath = openpalmConfigPath(state);
@@ -8822,22 +8778,16 @@ function importHostProfiles(state, hostConfigPath) {
 /**
 * Host AKM sharing (control-plane logic — lives in lib).
 *
-* Simplified model (no compose overlay, no file-presence gating):
-*
-*  - The assistant ALWAYS mounts `/host-stash` (core.compose.yml). When the host
-*    has AKM, OP_HOST_AKM_STASH points at the user's personal stash (~/akm);
-*    otherwise it is unset and compose falls back to an always-present empty dir.
-*  - "Sharing" is purely a writable SECONDARY source entry named `host-akm` →
-*    /host-stash in the assistant's config/akm/config.json. Adding it = enabled;
-*    removing it = disabled. akm resolves writes to the primary unless an explicit
-*    --target is given, and silently skips a source whose dir is empty/missing —
-*    so a mounted-but-unconfigured /host-stash is harmless.
-*  - Host availability is detected from the presence of the user's personal akm
-*    CONFIG (~/.config/akm/config.json) — the real signal that akm is initialized.
-*
-* Decision D1 (2026-06-03): host sharing is assistant-reads-host ONLY by default.
-* We never write into the user's personal ~/.config/akm here. (Letting the host
-* akm see OpenPalm's knowledge is a future, explicit opt-in.)
+* Model:
+*  - The assistant ALWAYS has `/host-stash` as a secondary akm source (written
+*    once at install by addHostStashToOpenpalmConfig, never removed).
+*  - Enable/disable = flip OP_HOST_AKM_STASH in stack.env between the real
+*    ~/akm path (enabled) and an empty string / removal (disabled). Compose
+*    reads OP_HOST_AKM_STASH and mounts the real stash or the always-present
+*    empty-dir fallback accordingly.
+*  - Enabling also imports host LLM/agent profiles (best-effort, additive merge).
+*    If no host akm config exists the import is silently skipped — it is never
+*    a blocking condition.
 */
 var logger$5 = createLogger("host-akm-sharing");
 var ENV_KEY = "OP_HOST_AKM_STASH";
@@ -8848,39 +8798,28 @@ function userHome() {
 function hostAkmStashPath() {
 	return `${userHome()}/akm`;
 }
-/** The user's personal akm config file — its existence is our availability signal. */
 function hostAkmConfigPath() {
 	return `${userHome()}/.config/akm/config.json`;
 }
-/** True when AKM is initialized on the host (personal config exists). */
-function isHostAkmAvailable() {
-	return existsSync(hostAkmConfigPath());
-}
 function stackEnvPath(state) {
 	return `${state.stashDir}/env/stack.env`;
 }
-/**
-* Point OP_HOST_AKM_STASH at the host stash when AKM is available, else unset it
-* (compose then uses the empty-dir fallback). Pure infrastructure — does NOT
-* change the source list. Idempotent; safe to call on setup and on deploy.
-*/
-function ensureHostStashEnv(state) {
+/** Read enabled status from stack.env. */
+function getHostAkmSharingStatus(state) {
 	const path = stackEnvPath(state);
-	const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
-	const updated = isHostAkmAvailable() ? mergeEnvContent(existing, { [ENV_KEY]: hostAkmStashPath() }) : removeEnvKey(existing, ENV_KEY);
-	if (updated !== existing) writeFileAtomic(path, updated, 384);
+	return {
+		enabled: ((existsSync(path) ? parseEnvFile(path) : {})[ENV_KEY] ?? "").trim().length > 0,
+		hostStashPath: hostAkmStashPath()
+	};
 }
 /**
-* Enable host AKM sharing: ensure OP_HOST_AKM_STASH points at ~/akm and add the
-* writable `host-akm` secondary source to the assistant config. Optionally import
-* host LLM/agent profiles (read-only). Throws if host AKM is not available.
+* Enable host AKM sharing: point OP_HOST_AKM_STASH at ~/akm and import host
+* LLM/agent profiles (best-effort — skipped if host akm config is absent).
 */
-function enableHostAkmSharing(state, opts = {}) {
-	if (!isHostAkmAvailable()) throw new Error(`Host AKM is not available (no ${hostAkmConfigPath()}). Run \`akm init\` on the host first.`);
-	ensureHostStashEnv(state);
-	addHostStashToOpenpalmConfig(state, opts.writable ?? true);
-	let profilesImported = [];
-	if (opts.importProfiles) profilesImported = importHostProfiles(state, hostAkmConfigPath()).imported;
+function enableHostAkmSharing(state) {
+	const envPath = stackEnvPath(state);
+	writeFileAtomic(envPath, mergeEnvContent(existsSync(envPath) ? readFileSync(envPath, "utf-8") : "", { [ENV_KEY]: hostAkmStashPath() }), 384);
+	const { imported: profilesImported } = importHostProfiles(state, hostAkmConfigPath());
 	logger$5.info("host akm sharing enabled", {
 		hostStashPath: hostAkmStashPath(),
 		profilesImported
@@ -8888,33 +8827,15 @@ function enableHostAkmSharing(state, opts = {}) {
 	return { profilesImported };
 }
 /**
-* Disable host AKM sharing: remove the `host-akm` secondary source from the
-* assistant config. Leaves the (harmless) mount and env in place; never deletes
-* any stash content.
+* Disable host AKM sharing: remove OP_HOST_AKM_STASH from stack.env so compose
+* falls back to the empty-dir mount. Never removes the /host-stash source entry
+* from the akm config — the source is always present (just points at an empty dir).
 */
 function disableHostAkmSharing(state) {
-	removeHostAkmSource(state);
+	const envPath = stackEnvPath(state);
+	writeFileAtomic(envPath, removeEnvKey(existsSync(envPath) ? readFileSync(envPath, "utf-8") : "", ENV_KEY), 384);
 	logger$5.info("host akm sharing disabled");
 }
-/** Report availability + whether the host-akm source is currently configured. */
-function getHostAkmSharingStatus(state) {
-	const available = isHostAkmAvailable();
-	return {
-		available,
-		enabled: openpalmHasHostSource(state),
-		hostStashPath: available ? hostAkmStashPath() : null
-	};
-}
-function openpalmHasHostSource(state) {
-	const path = `${state.configDir}/akm/config.json`;
-	if (!existsSync(path)) return false;
-	try {
-		const cfg = JSON.parse(readFileSync(path, "utf-8"));
-		return Array.isArray(cfg.sources) && cfg.sources.some((s) => s?.name === "host-akm");
-	} catch {
-		return false;
-	}
-}
 //#endregion
 //#region ../lib/src/control-plane/secret-mappings.ts
 var STATIC_CORE_MAPPINGS = [
@@ -10080,16 +10001,11 @@ async function performSetup(input, opts) {
 				updated.stashDir = "/stash";
 				writeFileAtomic(akmConfigPath, JSON.stringify(updated, null, 2), 384);
 			}
-			ensureHostStashEnv(state);
-			if (hostAkm !== false && isHostAkmAvailable()) try {
-				const { profilesImported } = enableHostAkmSharing(state, {
-					writable: true,
-					importProfiles: !llm
-				});
-				logger.info("host akm sharing auto-enabled during setup", { profilesImported });
-			} catch (err) {
-				logger.warn("host akm sharing could not be enabled", { error: err.message });
-			}
+			addHostStashToOpenpalmConfig(state);
+			if (hostAkm !== false) {
+				const { profilesImported } = enableHostAkmSharing(state);
+				logger.info("host akm sharing enabled during setup", { profilesImported });
+			} else disableHostAkmSharing(state);
 			if (tts || stt) writeVoiceVars({
 				tts,
 				stt
@@ -10499,5 +10415,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { ensureMigrated as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeStats as E, composeStop as F, composeUp as G, createLogger as H, INSTALL_LOCK_STALE_AFTER_MS as I, createOpenCodeClient as J, createState as K, deleteUserEnvKey as L, MigrationError as M, NPM_PACKAGE_NAMES as N, deriveLaunchStatus as O, PLATFORM_VERSION as P, deriveLocalStackState as Q, detectGpu as R, SERVICE_VERSION_KEYS as S, detectHostOpenCode as T, detectLocalProviders as U, detectRuntime as V, disableHostAkmSharing as W, dismissSecretStripNotice as X, enableHostAkmSharing as Y, ensureAkmUserEnv as Z, ensureHomeDirs as _, ALL_VERSION_KEYS as a, summarizeComposeStderr as a$, ensureOpenCodeConfig as a0, ensureOpenCodeSystemConfig as a1, ensureReleaseMigrated as a2, ensureSecrets as a3, executeAutomation as a4, fetchProviderModels as a5, formatForDisplay as a6, getAddonProfileAvailability as a7, getAddonProfileSelection as a8, getAddonProfiles as a9, performUpgrade as aA, pruneBackupDirs as aB, readAutomationLogs as aC, readDeployJournal as aD, readSecret as aE, readSecretFile as aF, readSecretStripNotice as aG, readStackEnv as aH, readStackRuntimeEnv as aI, readStackSecretEnv as aJ, readTaskFile as aK, readUserEnvFile as aL, readVersions as aM, recommendSetup as aN, removeSecretFile as aO, removeTaskFile as aP, resolveComposeProjectName as aQ, resolveDataDir as aR, resolveDeployJournalPath as aS, resolveRuntimeFiles as aT, resolveStackDir as aU, runAssistantAkmCommand as aV, runDeploy as aW, seedUiBuild as aX, setAddonEnabled as aY, setAddonProfileSelection as aZ, summarizeBackups as a_, getAddonServiceNames as aa, getAkmStats as ab, getDockerEvents as ac, getHostAkmSharingStatus as ad, getRegistryAddonConfig as ae, hostAkmStashPath as af, importHostOpenCode as ag, initializeStateSecrets as ah, inspectInstallLock as ai, isAllowedService as aj, isHostAkmAvailable as ak, isPrerelease as al, isSetupComplete as am, listAssistantCliTools as an, listAvailableAddonIds as ao, listBackupDirs as ap, listEnabledAddonIds as aq, listSecretFiles as ar, loadAutomations as as, mapDockerError as at, markSetupComplete as au, mergeEnvContent as av, parseComposeStderr as aw, parseEnvFile as ax, patchSecretsEnvFile as ay, performSetup as az, NPM_VERSION_KEYS as b, unlockInstallLock as b0, useExistingProviderForAssistantCli as b1, validateProposedState as b2, writeFileAtomic as b3, writeRuntimeFiles as b4, writeSecretFile as b5, writeStackSecretEnv as b6, writeTaskFile as b7, writeUserEnvKey as b8, writeVersions as b9, writeVoiceVars as ba, addonProfileId as c, annotateAddonProfileAvailability as d, applyInstall as e, applyUninstall as f, applyUpdate as g, assertSafeSecretFilename as h, assertSafeTaskFilename as i, authJsonPath as j, backupSetupInputs as k, buildAkmEndpoint as l, buildAkmEnv as m, buildComposeOptions as n, buildManagedServices as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, collectBindAddressWarnings as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-CUQ7IJUr.js.map
+export { ensureMigrated as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeStats as E, composeStop as F, composeUp as G, createLogger as H, INSTALL_LOCK_STALE_AFTER_MS as I, createOpenCodeClient as J, createState as K, deleteUserEnvKey as L, MigrationError as M, NPM_PACKAGE_NAMES as N, deriveLaunchStatus as O, PLATFORM_VERSION as P, deriveLocalStackState as Q, detectGpu as R, SERVICE_VERSION_KEYS as S, detectHostOpenCode as T, detectLocalProviders as U, detectRuntime as V, disableHostAkmSharing as W, dismissSecretStripNotice as X, enableHostAkmSharing as Y, ensureAkmUserEnv as Z, ensureHomeDirs as _, ALL_VERSION_KEYS as a, unlockInstallLock as a$, ensureOpenCodeConfig as a0, ensureOpenCodeSystemConfig as a1, ensureReleaseMigrated as a2, ensureSecrets as a3, executeAutomation as a4, fetchProviderModels as a5, formatForDisplay as a6, getAddonProfileAvailability as a7, getAddonProfileSelection as a8, getAddonProfiles as a9, pruneBackupDirs as aA, readAutomationLogs as aB, readDeployJournal as aC, readSecret as aD, readSecretFile as aE, readSecretStripNotice as aF, readStackEnv as aG, readStackRuntimeEnv as aH, readStackSecretEnv as aI, readTaskFile as aJ, readUserEnvFile as aK, readVersions as aL, recommendSetup as aM, removeSecretFile as aN, removeTaskFile as aO, resolveComposeProjectName as aP, resolveDataDir as aQ, resolveDeployJournalPath as aR, resolveRuntimeFiles as aS, resolveStackDir as aT, runAssistantAkmCommand as aU, runDeploy as aV, seedUiBuild as aW, setAddonEnabled as aX, setAddonProfileSelection as aY, summarizeBackups as aZ, summarizeComposeStderr as a_, getAddonServiceNames as aa, getAkmStats as ab, getDockerEvents as ac, getHostAkmSharingStatus as ad, getRegistryAddonConfig as ae, hostAkmStashPath as af, importHostOpenCode as ag, initializeStateSecrets as ah, inspectInstallLock as ai, isAllowedService as aj, isPrerelease as ak, isSetupComplete as al, listAssistantCliTools as am, listAvailableAddonIds as an, listBackupDirs as ao, listEnabledAddonIds as ap, listSecretFiles as aq, loadAutomations as ar, mapDockerError as as, markSetupComplete as at, mergeEnvContent as au, parseComposeStderr as av, parseEnvFile as aw, patchSecretsEnvFile as ax, performSetup as ay, performUpgrade as az, NPM_VERSION_KEYS as b, useExistingProviderForAssistantCli as b0, validateProposedState as b1, writeFileAtomic as b2, writeRuntimeFiles as b3, writeSecretFile as b4, writeStackSecretEnv as b5, writeTaskFile as b6, writeUserEnvKey as b7, writeVersions as b8, writeVoiceVars as b9, addonProfileId as c, annotateAddonProfileAvailability as d, applyInstall as e, applyUninstall as f, applyUpdate as g, assertSafeSecretFilename as h, assertSafeTaskFilename as i, authJsonPath as j, backupSetupInputs as k, buildAkmEndpoint as l, buildAkmEnv as m, buildComposeOptions as n, buildManagedServices as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, collectBindAddressWarnings as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-D4Gm5mXv.js.map