@openpalm/ui 0.12.34 → 0.12.36

package/build/server/chunks/{src-BunIUeZg.js → src-2DECZjwE.js}

@@ -2,8 +2,8 @@ import { _ as __commonJSMin, b as __require } from './chunk-CLZ62Ad-.js';
 import { P as PROVIDER_DEFAULT_URLS, a as PROVIDER_KEY_MAP } from './provider-constants-DPrj3yBX.js';
 import { r as require_dist } from './dist-DOFcG0Zp.js';
 import { createRequire } from 'node:module';
-import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, renameSync, writeFileSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, statSync, chownSync } from 'node:fs';
-import or, { join, basename, dirname, resolve, win32, posix } from 'node:path';
+import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, rmSync, readdirSync, renameSync, writeFileSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, statSync, lstatSync, chownSync } from 'node:fs';
+import or, { join, basename, dirname, resolve, relative, win32, posix } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import I from 'fs';
 import Xs, { parse, dirname as dirname$1 } from 'path';
@@ -362,6 +362,13 @@ function acquireInstallLock(dataDir) {
 		});
 		return null;
 	}
+	try {
+		const { pid } = parseLockContent(readFileSync(path, "utf-8"));
+		if (pid === process.pid) return {
+			path,
+			reentrant: true
+		};
+	} catch {}
 	if (!isStale(path)) return null;
 	logger$13.info("removing stale install lock and retrying acquire", { path });
 	try {
@@ -459,6 +466,7 @@ function unlockInstallLock(dataDir) {
 }
 function releaseInstallLock(handle) {
 	if (!handle) return;
+	if (handle.reentrant) return;
 	try {
 		rmSync(handle.path, { force: true });
 	} catch (err) {
@@ -738,7 +746,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.34"};
+	version: "0.12.36"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -823,14 +831,6 @@ function formatForDocker(version) {
 	return bare ? `v${bare}` : "";
 }
 /**
-* True when `version` carries a semver pre-release segment (`0.12.0-rc.1`).
-* Build metadata (`+build.5`) is NOT a pre-release. Non-semver → false.
-*/
-function isPrerelease(version) {
-	if (!isComparableSemver(version)) return false;
-	return parseComparableVersion(version).prerelease !== null;
-}
-/**
 * User-facing presentation form: drop the leading `v` so the UI shows one
 * canonical spelling regardless of whether the value arrived as a Docker tag or
 * an npm version. Non-semver values are returned trimmed but otherwise untouched
@@ -5250,8 +5250,7 @@ function randomHex(bytes) {
 * Core runtime asset management for the OpenPalm control plane.
 *
 * Manages source-of-truth files for the ~/.openpalm/ layout:
-*   stack/              — compose runtime assets (core.compose.yml)
-*   config/guardian/    — guardian OpenCode config (skip-if-user-modified)
+*   config/stack/       — system-owned compose files, refreshed every reconcile
 *
 * This module manages runtime-owned core files only.
 * Addon compose bundle generation and registry catalog refresh are handled
@@ -5260,7 +5259,6 @@ function randomHex(bytes) {
 * historical `.env.schema` files (varlock format) were retired in #391.
 */
 var logger$12 = createLogger("core-assets");
-var GITHUB_ASSET_TIMEOUT_MS = 1e4;
 var _require$1 = createRequire(import.meta.url);
 function bundledAssetPath(relPath) {
 	try {
@@ -5294,58 +5292,11 @@ function readBundledStackAsset(name) {
 function ensureOpenCodeSystemConfig() {
 	mkdirSync(`${resolveDataDir()}/assistant`, { recursive: true });
 }
-var SHIPPED_DEFAULT_HASHES = { "config/guardian/instructions/moderation.md": ["dfa770d433bef9954e58e29cfb337679eb27ed3c9de61ddd2c4106d3add9a628"] };
-/** Assets under config/guardian/ that are managed (refreshable) but respect user edits. */
-var GUARDIAN_MANAGED_ASSETS = [{
-	relPath: "config/guardian/instructions/moderation.md",
-	githubFilename: ".openpalm/config/guardian/instructions/moderation.md"
-}];
-/**
-* Returns true when the on-disk content is still byte-identical to one of the
-* previously shipped defaults for the given relPath (i.e. the user has not
-* edited it and it is safe to overwrite on refresh).
-*/
-function isUnmodifiedDefault(relPath, currentContent) {
-	const known = SHIPPED_DEFAULT_HASHES[relPath];
-	if (!known || known.length === 0) return false;
-	const h = sha256(currentContent);
-	return known.includes(h);
-}
-var REPO = "itlackey/openpalm";
-function normalizeAssetRef(version) {
-	const v = version.trim();
-	if (!v) throw new Error("Cannot download OpenPalm stack assets: no version provided. The caller must pass the target release tag (e.g. \"v0.11.0-rc.6\").");
-	return /^\d/.test(v) ? `v${v}` : v;
-}
 var MANAGED_ASSETS = [
-	{
-		relPath: "config/stack/core.compose.yml",
-		githubFilename: ".openpalm/config/stack/core.compose.yml"
-	},
-	{
-		relPath: "config/stack/services.compose.yml",
-		githubFilename: ".openpalm/config/stack/services.compose.yml"
-	},
-	{
-		relPath: "config/stack/portals.compose.yml",
-		githubFilename: ".openpalm/config/stack/portals.compose.yml"
-	}
+	{ relPath: "config/stack/core.compose.yml" },
+	{ relPath: "config/stack/services.compose.yml" },
+	{ relPath: "config/stack/portals.compose.yml" }
 ];
-var SEEDED_ASSETS = [{
-	relPath: "config/assistant/opencode.jsonc",
-	githubFilename: ".openpalm/config/assistant/opencode.jsonc"
-}, {
-	relPath: "config/stack/custom.compose.yml",
-	githubFilename: ".openpalm/config/stack/custom.compose.yml"
-}];
-async function downloadAsset(filename, version) {
-	const rawUrl = `https://raw.githubusercontent.com/${REPO}/${version}/${filename}`;
-	try {
-		const res = await fetch(rawUrl, { signal: AbortSignal.timeout(GITHUB_ASSET_TIMEOUT_MS) });
-		if (res.ok) return await res.text();
-	} catch {}
-	throw new Error(`Failed to download ${filename} from GitHub (ref "${version}" not found or network error)`);
-}
 function ensureBackupDir(backupDir, suffix = "") {
 	if (backupDir) return backupDir;
 	return join(resolveBackupsDir(), `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}${suffix}`);
@@ -5359,7 +5310,6 @@ function backupExistingFile(targetPath, assetRelPath, backupDir, suffix = "") {
 }
 function refreshCoreAssetsFromSource(sourceRoot, homeDir = resolveOpenPalmHome()) {
 	const updated = [];
-	const kept = [];
 	let backupDir = null;
 	for (const asset of MANAGED_ASSETS) {
 		const sourcePath = join(sourceRoot, asset.relPath);
@@ -5373,89 +5323,9 @@ function refreshCoreAssetsFromSource(sourceRoot, homeDir = resolveOpenPalmHome()
 		writeFileSync(targetPath, freshContent);
 		updated.push(asset.relPath);
 	}
-	for (const asset of GUARDIAN_MANAGED_ASSETS) {
-		const sourcePath = join(sourceRoot, asset.relPath);
-		const targetPath = join(homeDir, asset.relPath);
-		if (!existsSync(sourcePath)) continue;
-		const freshContent = readFileSync(sourcePath, "utf-8");
-		if (existsSync(targetPath)) {
-			const currentContent = readFileSync(targetPath, "utf-8");
-			if (sha256(currentContent) === sha256(freshContent)) continue;
-			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$12.info("guardian managed asset kept (user-modified); new default available", {
-					path: asset.relPath,
-					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
-				});
-				kept.push(asset.relPath);
-				continue;
-			}
-		}
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
-	for (const asset of SEEDED_ASSETS) {
-		const sourcePath = join(sourceRoot, asset.relPath);
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) continue;
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, readFileSync(sourcePath, "utf-8"));
-		updated.push(asset.relPath);
-	}
-	return {
-		backupDir,
-		updated,
-		kept
-	};
-}
-async function refreshCoreAssets(version) {
-	const ref = normalizeAssetRef(version);
-	const homeDir = resolveOpenPalmHome();
-	const updated = [];
-	const kept = [];
-	let backupDir = null;
-	for (const asset of MANAGED_ASSETS) {
-		const freshContent = await downloadAsset(asset.githubFilename, ref);
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) {
-			if (sha256(readFileSync(targetPath, "utf-8")) === sha256(freshContent)) continue;
-			backupDir = backupExistingFile(targetPath, asset.relPath, backupDir);
-		}
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
-	for (const asset of GUARDIAN_MANAGED_ASSETS) {
-		const freshContent = await downloadAsset(asset.githubFilename, ref);
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) {
-			const currentContent = readFileSync(targetPath, "utf-8");
-			if (sha256(currentContent) === sha256(freshContent)) continue;
-			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$12.info("guardian managed asset kept (user-modified); new default available", {
-					path: asset.relPath,
-					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
-				});
-				kept.push(asset.relPath);
-				continue;
-			}
-		}
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
-	for (const asset of SEEDED_ASSETS) {
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) continue;
-		const freshContent = await downloadAsset(asset.githubFilename, ref);
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
 	return {
 		backupDir,
-		updated,
-		kept
+		updated
 	};
 }
 //#endregion
@@ -5492,6 +5362,21 @@ async function fetchWithRetry(url, retries = 3) {
 	}
 	throw new Error(`Failed to fetch ${url} after ${retries} attempts`);
 }
+function copyTree(src, dest, opts) {
+	if (!existsSync(src)) return;
+	const entries = readdirSync(src, {
+		recursive: true,
+		withFileTypes: true
+	});
+	for (const entry of entries) {
+		if (!entry.isFile()) continue;
+		const srcFile = join(entry.parentPath ?? entry.path, entry.name);
+		const destFile = join(dest, relative(src, srcFile));
+		if (existsSync(destFile)) continue;
+		mkdirSync(dirname(destFile), { recursive: true });
+		copyFileSync(srcFile, destFile);
+	}
+}
 /** Resolve a candidate path using three strategies, returning the first that exists. */
 function resolveLocalCandidate(...strategies) {
 	for (const strategy of strategies) try {
@@ -5520,6 +5405,81 @@ function resolveLocalOpenpalmDir() {
 	}, () => null);
 }
 /**
+* Seed OP_HOME from the .openpalm/ skeleton.
+*
+* Existing files are never overwritten (user edits win).
+* Falls back to downloading the repo tarball from GitHub when no local
+* skeleton is found (production binary, packaged Electron app).
+*/
+/** Version stamp recording which skeleton version OP_HOME was last seeded from. */
+var SKELETON_VERSION_STAMP = ".skeleton-version";
+/** The skeleton version OP_HOME was last seeded from, or null when unstamped. */
+function readSkeletonVersion(homeDir) {
+	try {
+		const p = join(homeDir, SKELETON_VERSION_STAMP);
+		return existsSync(p) ? readFileSync(p, "utf-8").trim() : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* True when this home was seeded by a DIFFERENT platform version than the one
+* now running — i.e. the binary was updated but its assets/secrets/migrations
+* have not been applied to OP_HOME yet. The launch flow uses this to land the
+* user on /splash with an "apply updates" button instead of silently
+* self-healing on every request. An unstamped home (null) is NOT stale — that's
+* a fresh/not-installed home handled by the setup flow.
+*/
+function isSkeletonStale(homeDir) {
+	const stamped = readSkeletonVersion(homeDir);
+	return stamped !== null && stamped !== PLATFORM_VERSION.trim();
+}
+/**
+* Seed the bundled `.openpalm/` skeleton into OP_HOME — ONCE PER VERSION.
+*
+* Electron calls this on every launch; without a guard it re-copied the entire
+* skeleton tree each time (wasteful, and it re-materialized files a user/process
+* had deliberately removed). We stamp OP_HOME/.skeleton-version with `repoRef`
+* after a successful seed and skip the copy when it already matches — so a given
+* version seeds once and an upgrade re-seeds (skipExisting still preserves any
+* user edits). To force a re-seed, delete the stamp.
+*/
+async function seedOpenPalmDir(repoRef, homeDir, _configDir, _dataDir) {
+	const stampPath = join(homeDir, SKELETON_VERSION_STAMP);
+	let alreadySeeded = false;
+	if (existsSync(stampPath)) try {
+		alreadySeeded = readFileSync(stampPath, "utf-8").trim() === repoRef.trim();
+	} catch {}
+	const stamp = () => {
+		try {
+			writeFileSync(stampPath, `${repoRef}\n`);
+		} catch {}
+	};
+	const local = resolveLocalOpenpalmDir();
+	if (local) {
+		const { updated, backupDir } = refreshCoreAssetsFromSource(local, homeDir);
+		if (updated.length) logger$11.debug("refreshed managed stack assets", { refreshed: updated });
+		if (alreadySeeded) {
+			logger$11.debug("skeleton already seeded for this version — managed assets refreshed, skipping full seed", { repoRef });
+			return {
+				updated,
+				backupDir
+			};
+		}
+		logger$11.debug("seeding .openpalm from local source", {
+			src: local,
+			repoRef
+		});
+		copyTree(local, homeDir);
+		stamp();
+		return {
+			updated,
+			backupDir
+		};
+	}
+	throw new Error("Cannot locate @openpalm/skeleton. Set OPENPALM_REPO_ROOT (dev) or install @openpalm/skeleton: npm install @openpalm/skeleton@" + (process.env.OP_SKELETON_VERSION ?? process.env.PLATFORM_VERSION ?? "<version>"));
+}
+/**
 * The UI ships as `@openpalm/ui` on npm — a self-contained `adapter-node`
 * bundle (only `build/` is published; no `node_modules` is needed at runtime,
 * because the build bundles every dependency). The desktop and host updaters
@@ -6062,7 +6022,7 @@ var SERVICE_VERSION_KEYS = [
 /**
 * Maps each service version key to its Docker Hub image name (without namespace).
 * Namespace defaults to "openpalm" (OP_IMAGE_NAMESPACE env var in compose).
-* Source: .openpalm/config/stack/core.compose.yml + services.compose.yml + portals.compose.yml.
+* Source: packages/skeleton/config/stack/core.compose.yml + services.compose.yml + portals.compose.yml.
 *
 * NOTE: voice tags carry a variant suffix in compose (e.g. "-cpu", "-cu121") that is
 * appended by the compose file itself. OP_VOICE_VERSION holds only the base semver part.
@@ -7663,7 +7623,6 @@ function hasArmedSnapshot() {
 //#endregion
 //#region ../lib/src/control-plane/lifecycle.ts
 /** Lifecycle helpers — state factory, apply transitions, compose file list. */
-var IMAGE_NAMESPACE_RE = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
 function createState() {
 	const homeDir = resolveOpenPalmHome();
 	const configDir = resolveConfigDir();
@@ -7717,11 +7676,73 @@ async function reconcileCore(state, opts) {
 			throw new Error(`Compose preflight failed: ${preflight.stderr}\nFiles: ${files.join(", ")}\nEnv files: ${envFiles.filter(existsSync).join(", ")}\nProfiles: ${profiles.join(", ") || "(none)"}\nProject: ${projectName}`);
 		}
 	}
-	if (!opts.skipSnapshot && !hasArmedSnapshot()) snapshotCurrentState(state);
 	state.artifacts = resolveRuntimeFiles();
 	writeRuntimeFiles(state);
 	return active;
 }
+/**
+* Idempotent OP_HOME asset reconciliation to the running platform version.
+*
+* This is the single place that brings an OP_HOME's *assets* (layout, skeleton
+* data/, managed compose, release transforms) up to PLATFORM_VERSION. It is
+* keyed entirely on PLATFORM_VERSION (the running control plane), NOT on the
+* per-image OP_*_VERSION pins in stack.env — those stay independent and drive
+* compose image resolution only.
+*
+* Every step is a cheap no-op when already current:
+*   • ensureMigrated        — forward-only layout migrations (skip-if-done)
+*   • ensureHomeDirs        — create the OP_HOME directory layout
+*   • seedOpenPalmDir       — skeleton data/ seed (stamp-gated, skip-existing) +
+*                             managed compose refresh from BUNDLED local source
+*   • ensureOpenCode*       — starter OpenCode config + data dir (seed-if-missing)
+*   • ensureReleaseMigrated — forward-only release transforms (copy-only, idempotent)
+*
+* This is the ONLY function that writes OP_HOME's layout/assets, so callers never
+* need to defensively re-ensure dirs or config themselves.
+*
+* Returns the assets it actually changed (the refreshed managed compose/config
+* files) and the backup directory a release migration created (if any), so
+* performUpgrade can surface them in UpgradeResult — the upgrade route logs the
+* asset list and shows the backup dir to the operator.
+*/
+async function reconcileHome(state, opts = {}) {
+	const migration = ensureMigrated({
+		homeDir: state.homeDir,
+		confirmLowSpace: opts.confirmLowSpace
+	});
+	ensureHomeDirs();
+	ensureSecrets(state);
+	const seed = await seedOpenPalmDir(PLATFORM_VERSION, state.homeDir, state.configDir, state.dataDir);
+	ensureOpenCodeConfig();
+	ensureOpenCodeSystemConfig();
+	const release = ensureReleaseMigrated({
+		homeDir: state.homeDir,
+		targetVersion: PLATFORM_VERSION
+	});
+	return {
+		migration,
+		assetsUpdated: seed.updated,
+		backupDir: release.backupDir ?? seed.backupDir
+	};
+}
+/**
+* Bring OP_HOME up to date WITHOUT touching containers — the single primitive
+* behind the splash "apply updates" button. Runs the full home reconcile
+* (migrations + dirs + secrets + skeleton seed + OpenCode config) under the
+* install lock so it can't race a concurrent install/update, then returns the
+* migration report for the UI to display. This is the deliberate, user-clicked
+* replacement for the per-request self-healing we removed: serving the UI is a
+* pure read; THIS is where the home is mutated.
+*/
+async function applyHomeReconcile(state, opts = {}) {
+	const lock = resolveLifecycleLock(state);
+	if (!lock) throw new Error("Another install is already in progress");
+	try {
+		return await reconcileHome(state, opts);
+	} finally {
+		releaseLifecycleLock(lock);
+	}
+}
 function resolveLifecycleLock(state, opts) {
 	if (opts && "lock" in opts) return opts.lock ?? null;
 	return acquireInstallLock(state.dataDir);
@@ -7730,11 +7751,71 @@ function releaseLifecycleLock(lock, opts) {
 	if (opts && "lock" in opts) return;
 	releaseInstallLock(lock);
 }
+/**
+* The single idempotent stack reconcile. Every lifecycle entry point is a thin
+* flag variant of this:
+*   1. reconcileHome   — bring OP_HOME assets up to PLATFORM_VERSION (migrations,
+*                        bundled skeleton seed, release transforms). No GitHub.
+*   2. reconcileCore   — preflight, snapshot (rollback), write runtime files,
+*                        flip service state per activate/deactivate.
+*   3. composePull     — (compose+pull only) fetch images per OP_*_VERSION pins.
+*   4. composeUp       — (compose only) recreate the managed service set.
+*
+* The whole thing runs under withStackEnvRollback: stack.env + the portals/custom
+* compose files are snapshotted and restored if any step throws, and the
+* pre-reconcile state is armed for `openpalm rollback`. reconcileCore runs with
+* skipSnapshot:true so it never takes a second snapshot over that armed one.
+*
+* The `compose` flag is deliberately OFF for install/update/uninstall: those
+* consumers (runDeploy, the admin install/update/uninstall routes) already own a
+* bespoke compose phase — pulling images first, parsing per-service failures,
+* polling health, and emitting progress. Letting the wrapper composeUp too would
+* (a) double-recreate and (b) on a fresh install fatally `up` BEFORE images are
+* pulled. Only performUpgrade sets compose:true — its consumers (CLI update, the
+* admin upgrade route) have no separate compose phase and want the full
+* pull+recreate to happen inside the wrapper, with rollback on failure.
+*
+* Returns the services that were active (running) after the reconcile — the
+* "restarted" set for update/upgrade reporting — plus the OP_HOME assets it
+* changed and any backup dir a release migration created, for UpgradeResult.
+*/
+function reconcileStack(state, opts) {
+	return withStackEnvRollback(state, async () => {
+		const activating = !opts.deactivate;
+		if (activating && opts.compose) await repairRootOwnedBindMounts(state.homeDir);
+		const home = await reconcileHome(state);
+		const active = await reconcileCore(state, {
+			activateServices: opts.activate,
+			deactivateServices: opts.deactivate,
+			skipSnapshot: true
+		});
+		if (activating && opts.compose) {
+			const composeOpts = buildComposeOptions(state);
+			if (opts.pull) {
+				const pullResult = await composePull(composeOpts);
+				if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
+			}
+			const services = await buildManagedServices(state);
+			const upResult = await composeUp({
+				...composeOpts,
+				services,
+				forceRecreate: true,
+				removeOrphans: true
+			});
+			if (!upResult.ok) throw new Error(`Failed to recreate containers: ${upResult.stderr}`);
+		}
+		return {
+			active,
+			assetsUpdated: home.assetsUpdated,
+			backupDir: home.backupDir
+		};
+	});
+}
 async function applyInstall(state, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
 	try {
-		await reconcileCore(state, { activateServices: true });
+		await reconcileStack(state, { activate: true });
 		ensureComposeVolumeTargets(state);
 	} finally {
 		releaseLifecycleLock(lock, opts);
@@ -7744,7 +7825,8 @@ async function applyUpdate(state, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
 	try {
-		return { restarted: await reconcileCore(state, {}) };
+		const { active } = await reconcileStack(state, {});
+		return { restarted: active };
 	} finally {
 		releaseLifecycleLock(lock, opts);
 	}
@@ -7753,27 +7835,8 @@ async function applyUninstall(state, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
 	try {
-		return { stopped: await reconcileCore(state, { deactivateServices: true }) };
-	} finally {
-		releaseLifecycleLock(lock, opts);
-	}
-}
-function resolveImageNamespace(state) {
-	const namespace = (parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim().toLowerCase();
-	if (!IMAGE_NAMESPACE_RE.test(namespace)) throw new Error(`Invalid image namespace in system.env: ${namespace}`);
-	return namespace;
-}
-async function applyUpgrade(state, version, opts) {
-	const lock = resolveLifecycleLock(state, opts);
-	if (!lock) throw new Error("Another install is already in progress");
-	try {
-		await repairRootOwnedBindMounts(state.homeDir);
-		const { backupDir, updated } = await refreshCoreAssets(version);
-		return {
-			backupDir,
-			updated,
-			restarted: await reconcileCore(state, { skipSnapshot: true })
-		};
+		const { active } = await reconcileStack(state, { deactivate: true });
+		return { stopped: active };
 	} finally {
 		releaseLifecycleLock(lock, opts);
 	}
@@ -7794,7 +7857,7 @@ async function withStackEnvRollback(state, run) {
 	try {
 		originalCustomCompose = readFileSync(customComposePath, "utf-8");
 	} catch {}
-	snapshotCurrentState(state, { arm: true });
+	if (!hasArmedSnapshot()) snapshotCurrentState(state, { arm: true });
 	try {
 		return await run();
 	} catch (e) {
@@ -7810,46 +7873,6 @@ async function withStackEnvRollback(state, run) {
 		throw e;
 	}
 }
-/**
-* Update the stack to the running control-plane version: run forward release
-* migrations, refresh core stack assets (compose/config) for PLATFORM_VERSION,
-* then pull images and recreate containers honoring the per-image OP_*_VERSION
-* pins already written in stack.env.
-*
-* There are NO Docker Hub calls: image versions are user-managed in stack.env
-* (PATCH /admin/versions), and the platform asset version is the running lib's
-* PLATFORM_VERSION — never resolved from a remote registry.
-*/
-async function performUpgrade(state, _opts = {}) {
-	return withStackEnvRollback(state, async () => {
-		const composeOpts = buildComposeOptions(state);
-		const namespace = resolveImageNamespace(state);
-		const releaseTag = "platform-" + normalizeVersion(PLATFORM_VERSION);
-		ensureReleaseMigrated({
-			homeDir: state.homeDir,
-			targetVersion: PLATFORM_VERSION
-		});
-		const upgradeResult = await applyUpgrade(state, releaseTag);
-		const pullResult = await composePull(composeOpts);
-		if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
-		const services = await buildManagedServices(state);
-		const upResult = await composeUp({
-			...composeOpts,
-			services,
-			forceRecreate: true,
-			removeOrphans: true
-		});
-		if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
-		return {
-			imageTag: PLATFORM_VERSION,
-			namespace,
-			backupDir: upgradeResult.backupDir,
-			assetsUpdated: upgradeResult.updated,
-			restarted: upgradeResult.restarted,
-			warnings: []
-		};
-	});
-}
 function buildComposeFileList(state) {
 	return discoverStackOverlays(state.stackDir);
 }
@@ -9147,7 +9170,7 @@ var ENV_FILE_MODE = 384;
 /**
 * Build the env that points akm at the shared OpenPalm stash. We mirror the
 * layout that the assistant container uses (see
-* `.openpalm/config/stack/core.compose.yml`) so host-side and container-side
+* `packages/skeleton/config/stack/core.compose.yml`) so host-side and container-side
 * runs resolve to the same files.
 *
 * Host-side runs use the same explicit directories as the assistant container:
@@ -10384,5 +10407,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, INSTALL_LOCK_STALE_AFTER_MS as I, deleteUserEnvKey as J, deriveLaunchStatus as K, deriveLocalStackState as L, MigrationError as M, detectGpu as N, detectHostOpenCode as O, PLATFORM_VERSION as P, detectLocalProviders as Q, detectRuntime as R, SERVICE_VERSION_KEYS as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, writeFileAtomic as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readSecret as aA, readSecretFile as aB, readSecretStripNotice as aC, readStackEnv as aD, readStackRuntimeEnv as aE, readStackSecretEnv as aF, readTaskFile as aG, readUserEnvFile as aH, readVersions as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDeployJournalPath as aO, resolveRuntimeFiles as aP, resolveStackDir as aQ, runAssistantAkmCommand as aR, runDeploy as aS, seedUiBuild as aT, setAddonEnabled as aU, setAddonProfileSelection as aV, summarizeBackups as aW, summarizeComposeStderr as aX, unlockInstallLock as aY, useExistingProviderForAssistantCli as aZ, validateProposedState as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isPrerelease as ah, isSetupComplete as ai, listAssistantCliTools as aj, listAvailableAddonIds as ak, listBackupDirs as al, listEnabledAddonIds as am, listSecretFiles as an, loadAutomations as ao, mapDockerError as ap, markSetupComplete as aq, mergeEnvContent as ar, parseComposeStderr as as, parseEnvFile as at, patchSecretsEnvFile as au, performSetup as av, performUpgrade as aw, pruneBackupDirs as ax, readAutomationLogs as ay, readDeployJournal as az, annotateAddonProfileAvailability as b, writeRuntimeFiles as b0, writeSecretFile as b1, writeStackSecretEnv as b2, writeTaskFile as b3, writeUserEnvKey as b4, writeVersions as b5, writeVoiceVars as b6, applyInstall as c, applyUninstall as d, applyUpdate as e, assertSafeSecretFilename as f, assertSafeTaskFilename as g, authJsonPath as h, backupSetupInputs as i, buildAkmEndpoint as j, buildAkmEnv as k, buildComposeOptions as l, buildManagedServices as m, checkDocker as n, checkDockerCompose as o, classifyLocalInstall as p, collectBindAddressWarnings as q, composeDown as r, composeLogs as s, composePreflight as t, composePs as u, composePull as v, composeRestart as w, composeStart as x, composeStats as y, composeStop as z };
-//# sourceMappingURL=src-BunIUeZg.js.map
+export { formatForDisplay as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, SERVICE_VERSION_KEYS as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, enableHostAkmSharing as W, ensureAkmUserEnv as X, ensureMigrated as Y, executeAutomation as Z, fetchProviderModels as _, addonProfileId as a, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, readTaskFile as aA, readUserEnvFile as aB, readVersions as aC, recommendSetup as aD, removeSecretFile as aE, removeTaskFile as aF, resolveComposeProjectName as aG, resolveDataDir as aH, resolveDeployJournalPath as aI, resolveStackDir as aJ, runAssistantAkmCommand as aK, runDeploy as aL, seedUiBuild as aM, setAddonEnabled as aN, setAddonProfileSelection as aO, summarizeBackups as aP, summarizeComposeStderr as aQ, unlockInstallLock as aR, useExistingProviderForAssistantCli as aS, validateProposedState as aT, writeFileAtomic as aU, writeSecretFile as aV, writeStackSecretEnv as aW, writeTaskFile as aX, writeUserEnvKey as aY, writeVersions as aZ, writeVoiceVars as a_, inspectInstallLock as aa, isAllowedService as ab, isSetupComplete as ac, isSkeletonStale as ad, listAssistantCliTools as ae, listAvailableAddonIds as af, listBackupDirs as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, mergeEnvContent as am, parseComposeStderr as an, parseEnvFile as ao, patchSecretsEnvFile as ap, performSetup as aq, pruneBackupDirs as ar, readAutomationLogs as as, readDeployJournal as at, readSecret as au, readSecretFile as av, readSecretStripNotice as aw, readStackEnv as ax, readStackRuntimeEnv as ay, readStackSecretEnv as az, annotateAddonProfileAvailability as b, applyHomeReconcile as c, applyInstall as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, composeDown as s, composeLogs as t, composePreflight as u, composePs as v, composePull as w, composeRestart as x, composeStart as y, composeStats as z };
+//# sourceMappingURL=src-2DECZjwE.js.map