@openpalm/ui 0.13.0-beta.6 → 0.13.0-beta.8

package/build/server/chunks/{src-DbArH65P.js → src-B2wHibme.js}

@@ -1,5 +1,5 @@
 import { _ as __commonJSMin, b as __require, c as __toESM } from './chunk-DOvWTNp_.js';
-import { G as GUARDIAN_INGRESS_ADDON_IDS, B as BUILTIN_ADDON_IDS, P as PORTAL_SECRET_ADDON_IDS, v as validateNetworkPresetEnv, r as resolveNetworkPreset, b as PROVIDER_DEFAULT_URLS, i as isLoopback, c as PROVIDER_KEY_MAP, g as isNetworkAccessPreset } from './network-preset-CJ1RRnki.js';
+import { G as GUARDIAN_INGRESS_ADDON_IDS, B as BUILTIN_ADDON_IDS, P as PORTAL_SECRET_ADDON_IDS, v as validateNetworkPresetEnv, r as resolveNetworkPreset, b as PROVIDER_DEFAULT_URLS, i as isLoopback, c as PROVIDER_KEY_MAP, g as isNetworkAccessPreset } from './network-preset-BvVAoagy.js';
 import { r as require_dist } from './dist-DtzrgNJ1.js';
 import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, readdirSync, writeFileSync, renameSync, statSync, rmSync, openSync, constants, writeSync, closeSync, lstatSync, chownSync, realpathSync } from 'node:fs';
 import { execFile, execFileSync } from 'node:child_process';
@@ -1431,7 +1431,7 @@ function ensureHomeDirs() {
 	for (const file of [`${home}/data/assistant/.local/share/opencode/auth.json`, `${home}/data/guardian/.local/share/opencode/auth.json`]) if (!existsSync(file)) writeFileSync(file, "");
 }
 var package_default = {
-	version: "0.13.0-beta.6"};
+	version: "0.13.0-beta.8"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -1570,7 +1570,7 @@ function randomHex$1(bytes) {
 * Env validation has moved to `akm vault` + the in-house redactor — the
 * historical `.env.schema` files (varlock format) were retired in #391.
 */
-var logger$8$1 = createLogger("core-assets");
+var logger$8 = createLogger("core-assets");
 var _require$1 = createRequire(import.meta.url);
 function bundledAssetPath(relPath) {
 	try {
@@ -1594,7 +1594,7 @@ function readBundledStackAsset(name) {
 	try {
 		return readFileSync(bundledAssetPath(`system/stack/${name}`), "utf-8");
 	} catch (err) {
-		logger$8$1.warn("bundled stack asset unavailable (returning empty)", {
+		logger$8.warn("bundled stack asset unavailable (returning empty)", {
 			name,
 			error: errMessage(err)
 		});
@@ -1610,7 +1610,7 @@ function readBundledCustomCompose() {
 	try {
 		return readFileSync(bundledAssetPath("config/stack/custom.compose.yml"), "utf-8");
 	} catch (err) {
-		logger$8$1.warn("bundled custom.compose.yml unavailable (returning empty)", { error: errMessage(err) });
+		logger$8.warn("bundled custom.compose.yml unavailable (returning empty)", { error: errMessage(err) });
 		return "";
 	}
 }
@@ -6606,11 +6606,27 @@ function disableAddonByName(homeDir, name) {
 	}
 }
 /**
-* Env keys that only a now-removed built-in addon ever wrote. Stripped alongside
-* the addon id so upgraded installs don't carry the stale value forever.
-* `ssh` (OPENCODE_ENABLE_SSH) is the only removed addon that shipped an env key.
-*/
-var REMOVED_ADDON_ENV_KEYS = ["OPENCODE_ENABLE_SSH"];
+* Retired env keys stripped from both env files on every reconcile so upgraded
+* installs don't carry stale values forever:
+*  - OPENCODE_ENABLE_SSH — written by the removed `ssh` addon.
+*  - OP_TTS_* / OP_STT_* — the pre-split host-side voice provider config
+*    (written by the retired writeVoiceVars / admin Voice tab). TTS/STT
+*    provider choice is a client-owned browser setting now; nothing reads
+*    these keys anymore.
+*/
+var RETIRED_ENV_KEYS = [
+	"OPENCODE_ENABLE_SSH",
+	"OP_TTS_ENGINE",
+	"OP_TTS_PROVIDER",
+	"OP_TTS_BASE_URL",
+	"OP_TTS_MODEL",
+	"OP_TTS_VOICE",
+	"OP_STT_ENGINE",
+	"OP_STT_PROVIDER",
+	"OP_STT_BASE_URL",
+	"OP_STT_MODEL",
+	"OP_STT_LANGUAGE"
+];
 /** Remove a key from an env file if present. Returns whether the file changed. */
 function removeEnvKeyFromFile(path, key) {
 	if (!existsSync(path)) return false;
@@ -6620,18 +6636,39 @@ function removeEnvKeyFromFile(path, key) {
 	writeFileSync(path, after.endsWith("\n") || after.length === 0 ? after : `${after}\n`, { mode: 384 });
 	return true;
 }
-/** Strip every removed-addon env key from both env files. Returns the keys removed. */
-function removeRemovedAddonEnvKeys(homeDir) {
+/**
+* Section-header comment lines that only retired keys ever lived under. Once
+* their keys are gone the header would advertise a section that no longer
+* exists, so the prune drops the exact line too (exact match keeps this
+* idempotent and unable to touch operator-authored comments).
+*/
+var RETIRED_ENV_SECTION_HEADERS = ["# ── Voice Channel (TTS/STT) ──────────────────────────────────────────"];
+/** Remove an exact comment line from an env file if present. Returns whether the file changed. */
+function removeEnvCommentLineFromFile(path, commentLine) {
+	if (!existsSync(path)) return false;
+	const lines = readFileSync(path, "utf-8").split("\n");
+	const out = lines.filter((line) => line.trim() !== commentLine);
+	if (out.length === lines.length) return false;
+	while (out.length > 1 && out[out.length - 1] === "" && out[out.length - 2] === "") out.pop();
+	const after = out.join("\n");
+	writeFileSync(path, after.endsWith("\n") || after.length === 0 ? after : `${after}\n`, { mode: 384 });
+	return true;
+}
+/** Strip every retired env key (and orphaned section header) from both env files. Returns the keys removed. */
+function removeRetiredEnvKeys(homeDir) {
 	const removed = /* @__PURE__ */ new Set();
-	for (const path of [stateEnvFile(homeDir), legacyStackEnvFile(homeDir)]) for (const key of REMOVED_ADDON_ENV_KEYS) if (removeEnvKeyFromFile(path, key)) removed.add(key);
+	for (const path of [stateEnvFile(homeDir), legacyStackEnvFile(homeDir)]) {
+		for (const key of RETIRED_ENV_KEYS) if (removeEnvKeyFromFile(path, key)) removed.add(key);
+		for (const header of RETIRED_ENV_SECTION_HEADERS) removeEnvCommentLineFromFile(path, header);
+	}
 	return [...removed];
 }
 /**
 * One-time cleanup of addon state left behind by addons that were removed from
 * BUILTIN_ADDON_IDS (currently `ssh`). On an upgraded install OP_ENABLED_ADDONS
 * can still list a removed addon — `resolveActiveProfiles` then emits its stale
-* `--profile addon.<id>` on every compose call — and a prior `openpalm addon
-* enable ssh` may have left OPENCODE_ENABLE_SSH in the env.
+* `--profile addon.<id>` on every compose call — plus retired env keys (see
+* RETIRED_ENV_KEYS) left by older releases.
 *
 * Idempotent and skip-if-absent: strips any OP_ENABLED_ADDONS entry that is no
 * longer built in and drops the removed-addon env keys. A no-op that writes
@@ -6642,7 +6679,7 @@ function pruneRemovedAddonState(homeDir) {
 	const builtin = new Set(BUILTIN_ADDON_IDS);
 	const removedAddons = parseEnabledAddons(readStackEnv(homeDir).OP_ENABLED_ADDONS).filter((id) => !builtin.has(id));
 	if (removedAddons.length > 0) setEnabledAddonState(homeDir, removedAddons, false);
-	const removedEnvKeys = removeRemovedAddonEnvKeys(homeDir);
+	const removedEnvKeys = removeRetiredEnvKeys(homeDir);
 	return {
 		changed: removedAddons.length > 0 || removedEnvKeys.length > 0,
 		removedAddons,
@@ -6706,7 +6743,7 @@ function setAddonEnabled(homeDir, name, enabled, state) {
 			services: []
 		};
 		setEnabledAddonState(homeDir, name, false);
-		removeRemovedAddonEnvKeys(homeDir);
+		removeRetiredEnvKeys(homeDir);
 		return {
 			ok: true,
 			enabled: false,
@@ -7211,8 +7248,8 @@ async function teardownRenamedProject(state, deps) {
 		warning: null,
 		blocked: false
 	};
-	const docker = await import('./docker2-BYFlumV1.js');
-	const { buildComposeOptions } = await import('./compose-args2-BFOGDQne.js');
+	const docker = await import('./docker2-DGq6J3Kp.js');
+	const { buildComposeOptions } = await import('./compose-args2-C9sLS6QR.js');
 	const resolvedDeps = {
 		detectExistingProject: docker.detectExistingProject,
 		composeDownProject: docker.composeDownProject
@@ -7368,7 +7405,7 @@ function checkCustomComposeChannelLan(homeDir) {
 * On any unexpected error (permissions, ENOSPC, etc.) we return null so the
 * caller surfaces "install_in_progress" rather than silently fake-acquiring.
 */
-var logger = createLogger("install-lock");
+var logger$9 = createLogger("install-lock");
 var STALE_AFTER_MS = 1800 * 1e3;
 function isProcessAlive(pid) {
 	try {
@@ -7431,7 +7468,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		mkdirSync(dataDir, { recursive: true });
 	} catch (err) {
-		logger.warn("failed to ensure data dir for install lock", {
+		logger$9.warn("failed to ensure data dir for install lock", {
 			dataDir,
 			error: errMessage(err)
 		});
@@ -7441,18 +7478,18 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger.warn("unexpected error acquiring install lock", {
+		logger$9.warn("unexpected error acquiring install lock", {
 			path,
 			error: errMessage(err)
 		});
 		return null;
 	}
 	if (!isStale(path)) return null;
-	logger.info("removing stale install lock and retrying acquire", { path });
+	logger$9.info("removing stale install lock and retrying acquire", { path });
 	try {
 		rmSync(path, { force: true });
 	} catch (err) {
-		logger.warn("failed to remove stale install lock", {
+		logger$9.warn("failed to remove stale install lock", {
 			path,
 			error: errMessage(err)
 		});
@@ -7461,7 +7498,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger.warn("unexpected error re-acquiring install lock", {
+		logger$9.warn("unexpected error re-acquiring install lock", {
 			path,
 			error: errMessage(err)
 		});
@@ -7536,9 +7573,9 @@ function unlockInstallLock(dataDir, opts) {
 	const forced = !status.stale && opts?.force === true;
 	try {
 		rmSync(status.path, { force: true });
-		logger.info(forced ? "force-removed a live install lock via unlock" : "removed stale install lock via unlock", { path: status.path });
+		logger$9.info(forced ? "force-removed a live install lock via unlock" : "removed stale install lock via unlock", { path: status.path });
 	} catch (err) {
-		logger.warn("failed to remove stale install lock during unlock", {
+		logger$9.warn("failed to remove stale install lock during unlock", {
 			path: status.path,
 			error: errMessage(err)
 		});
@@ -7555,7 +7592,7 @@ function releaseInstallLock(handle) {
 	try {
 		rmSync(handle.path, { force: true });
 	} catch (err) {
-		logger.warn("failed to release install lock", {
+		logger$9.warn("failed to release install lock", {
 			path: handle.path,
 			error: errMessage(err)
 		});
@@ -8101,9 +8138,10 @@ function createOpenCodeClient(opts) {
 * and orchestrating the guardian admin-API mint both live here so a future
 * `openpalm pair` CLI command never has to duplicate them (core-principles
 * §Shared control-plane library). `packages/ui`'s pairing route is a thin
-* transport wrapper over `mintDirectPrincipalPairingCode`; `packages/client`
-* carries a hand-maintained twin decoder (`parsePairingCode`) because the
-* client artifact never imports `@openpalm/lib` (purity gate).
+* transport wrapper over `mintDirectPrincipalPairingCode`, and its browser
+* decoder (`connections/pairing.ts` `parsePairingCode`) is a hand-maintained
+* twin of `decodePairingCode` here — the browser bundle never imports
+* `@openpalm/lib`.
 *
 * The pairing code itself is a self-contained, signed-nothing payload (D3):
 * `openpalm-pair:` + base64url(JSON). It is never persisted host-side — the
@@ -8191,7 +8229,7 @@ async function mintDirectPrincipalPairingCode(options) {
 		ok: true,
 		code: encodePairingCode({
 			v: 1,
-			kind: "openpalm-client-api",
+			kind: "openpalm-connection",
 			url,
 			label,
 			username: principalId,
@@ -8288,7 +8326,7 @@ function isPortalService(name, service) {
 function allowedSecretForService(serviceName, service, secretName) {
 	const serviceId = normalizedSecretName(serviceName.replace(/^portal[-_]/i, ""));
 	const secretId = normalizedSecretName(secretName);
-	if (serviceName === "assistant") return /^(assistant|opencode|provider|llm|embedding|akm|user)_/.test(secretId);
+	if (serviceName === "assistant") return /^(assistant|opencode|provider|llm|embedding|akm|user)_/.test(secretId) || secretId === "ui_login_password";
 	if (serviceName === "guardian") return secretId.startsWith("guardian_") || secretId.startsWith("portal_") || secretId.startsWith("op_guardian_") || secretId === "op_api_key" || secretId === "opencode_server_password";
 	if (serviceName === "admin") return /^(admin|ui|openpalm)_/.test(secretId);
 	if (isPortalService(serviceName, service)) return secretId.startsWith(`portal_${serviceId}_`) || secretId.startsWith(`${serviceId}_`);
@@ -9096,7 +9134,7 @@ function buildAkmEndpoint(provider, baseUrl, suffix) {
 *  - Atomic 0600 writes.
 *  - The OpenPalm config is parse-tolerant (we own it: corrupt → start from {}).
 */
-var logger$8 = createLogger("akm-sources");
+var logger$7 = createLogger("akm-sources");
 /** Source entry name added to the OpenPalm/container config (points at /host-stash). */
 var HOST_SOURCE_NAME = "host-akm";
 function readConfigTolerant(configPath) {
@@ -9114,7 +9152,7 @@ function readHostConfigBestEffort(configPath) {
 		const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
 		return parsed && typeof parsed === "object" ? parsed : null;
 	} catch {
-		logger$8.warn("host akm config is not valid JSON — skipping profile import", { configPath });
+		logger$7.warn("host akm config is not valid JSON — skipping profile import", { configPath });
 		return null;
 	}
 }
@@ -9240,7 +9278,7 @@ function importHostProfiles(state, hostConfigPath) {
 *    If no host akm config exists the import is silently skipped — it is never
 *    a blocking condition.
 */
-var logger$7 = createLogger("host-akm-sharing");
+var logger$6 = createLogger("host-akm-sharing");
 var ENV_KEY = "OP_HOST_AKM_STASH";
 function userHome() {
 	return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
@@ -9268,7 +9306,7 @@ function enableHostAkmSharing(state) {
 	const envPath = stackEnvPath(state);
 	writeFileAtomic(envPath, mergeEnvContent(existsSync(envPath) ? readFileSync(envPath, "utf-8") : "", { [ENV_KEY]: hostAkmStashPath() }), 384);
 	const { imported: profilesImported } = importHostProfiles(state, hostAkmConfigPath());
-	logger$7.info("host akm sharing enabled", {
+	logger$6.info("host akm sharing enabled", {
 		hostStashPath: hostAkmStashPath(),
 		profilesImported
 	});
@@ -9282,7 +9320,7 @@ function enableHostAkmSharing(state) {
 function disableHostAkmSharing(state) {
 	const envPath = stackEnvPath(state);
 	writeFileAtomic(envPath, removeEnvKey(existsSync(envPath) ? readFileSync(envPath, "utf-8") : "", ENV_KEY), 384);
-	logger$7.info("host akm sharing disabled");
+	logger$6.info("host akm sharing disabled");
 }
 //#endregion
 //#region ../lib/src/control-plane/markdown-task.ts
@@ -9294,14 +9332,14 @@ function disableHostAkmSharing(state) {
 *   prompt   — `prompt: <text>` inline prompt text
 *   workflow — `workflow: workflow:<ref>` + optional `params` map
 */
-var logger$6 = createLogger("task-file");
+var logger$5 = createLogger("task-file");
 function parseMarkdownTask(filePath) {
 	const id = basename(filePath).replace(/\.(?:ya?ml|md)$/, "");
 	let raw;
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		logger$6.warn("failed to read task file", {
+		logger$5.warn("failed to read task file", {
 			filePath,
 			error: String(err)
 		});
@@ -9312,12 +9350,12 @@ function parseMarkdownTask(filePath) {
 	try {
 		const parsed = (0, import_dist.parse)(frontmatter);
 		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-			logger$6.warn("task YAML is not an object", { filePath });
+			logger$5.warn("task YAML is not an object", { filePath });
 			return null;
 		}
 		fm = parsed;
 	} catch (err) {
-		logger$6.warn("failed to parse task YAML", {
+		logger$5.warn("failed to parse task YAML", {
 			filePath,
 			error: String(err)
 		});
@@ -9325,14 +9363,14 @@ function parseMarkdownTask(filePath) {
 	}
 	const schedule = fm.schedule;
 	if (typeof schedule !== "string" || !schedule.trim()) {
-		logger$6.warn("task missing or empty 'schedule'", { filePath });
+		logger$5.warn("task missing or empty 'schedule'", { filePath });
 		return null;
 	}
 	let target;
 	if (fm.command !== void 0) {
 		const cmd = Array.isArray(fm.command) ? fm.command.map(String) : typeof fm.command === "string" ? [fm.command] : null;
 		if (!cmd || cmd.length === 0) {
-			logger$6.warn("task 'command' must be a non-empty array", { filePath });
+			logger$5.warn("task 'command' must be a non-empty array", { filePath });
 			return null;
 		}
 		target = {
@@ -9341,12 +9379,12 @@ function parseMarkdownTask(filePath) {
 		};
 	} else if (fm.prompt !== void 0) {
 		if (typeof fm.prompt !== "string" || !fm.prompt.trim()) {
-			logger$6.warn("task 'prompt' must be a non-empty string", { filePath });
+			logger$5.warn("task 'prompt' must be a non-empty string", { filePath });
 			return null;
 		}
 		const promptBody = fm.prompt.trim() === "inline" ? body.trim() : fm.prompt.trim();
 		if (!promptBody) {
-			logger$6.warn("task prompt body is empty", { filePath });
+			logger$5.warn("task prompt body is empty", { filePath });
 			return null;
 		}
 		target = {
@@ -9356,7 +9394,7 @@ function parseMarkdownTask(filePath) {
 		};
 	} else if (fm.workflow !== void 0) {
 		if (typeof fm.workflow !== "string") {
-			logger$6.warn("task 'workflow' must be a string ref", { filePath });
+			logger$5.warn("task 'workflow' must be a string ref", { filePath });
 			return null;
 		}
 		target = {
@@ -9365,7 +9403,7 @@ function parseMarkdownTask(filePath) {
 			params: fm.params && typeof fm.params === "object" && !Array.isArray(fm.params) ? fm.params : {}
 		};
 	} else {
-		logger$6.warn("task must have one of: command, prompt, workflow", { filePath });
+		logger$5.warn("task must have one of: command, prompt, workflow", { filePath });
 		return null;
 	}
 	return {
@@ -9582,7 +9620,7 @@ function readUserEnvFile(envPath) {
 * Scheduling is handled by the OS cron daemon (via `akm tasks sync`).
 * Execution is handled by `akm tasks run <id>`.
 */
-var logger$5 = createLogger("scheduler");
+var logger$4 = createLogger("scheduler");
 function loadAutomations(stashDir) {
 	return loadMarkdownTasks(stashDir).map(taskToAutomationConfig);
 }
@@ -9600,7 +9638,7 @@ async function executeAutomation(id, akmEnv) {
 		} }, (error, _stdout, stderr) => {
 			if (error) {
 				const msg = stderr?.trim() || error.message;
-				logger$5.warn("akm tasks run failed", {
+				logger$4.warn("akm tasks run failed", {
 					id: taskId,
 					error: msg
 				});
@@ -9640,7 +9678,7 @@ function readAutomationLogs(id, dataDir, limit = 50) {
 *
 * Probes well-known endpoints for Docker Model Runner, Ollama, and LM Studio.
 */
-var logger$4 = createLogger("local-providers");
+var logger$3 = createLogger("local-providers");
 /** Ollama's root endpoint returns "Ollama is running" — use this to distinguish from other services on :11434. */
 async function validateOllamaResponse(res) {
 	try {
@@ -9818,7 +9856,7 @@ async function detectLocalProviders() {
 						try {
 							bodySnippet = (await resForValidate.text()).slice(0, 500);
 						} catch {}
-						logger$4.debug("provider probe response failed validation", {
+						logger$3.debug("provider probe response failed validation", {
 							provider,
 							url: probeUrl,
 							bodySnippet
@@ -9826,7 +9864,7 @@ async function detectLocalProviders() {
 						continue;
 					}
 				}
-				logger$4.debug("detected local provider", {
+				logger$3.debug("detected local provider", {
 					provider,
 					url: baseUrl
 				});
@@ -9846,7 +9884,7 @@ async function detectLocalProviders() {
 }
 //#endregion
 //#region ../lib/src/control-plane/hardware-detect.ts
-var logger$3 = createLogger("hardware-detect");
+var logger$2 = createLogger("hardware-detect");
 /** Parse `nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits`. */
 function parseNvidiaSmi(stdout) {
 	return stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
@@ -9953,7 +9991,7 @@ async function detectGpu() {
 		try {
 			found.push(...probe.parse(stdout));
 		} catch (error) {
-			logger$3.debug("gpu probe parse failed", {
+			logger$2.debug("gpu probe parse failed", {
 				vendor: probe.vendor,
 				error: String(error)
 			});
@@ -10018,54 +10056,6 @@ function recommendSetup(input) {
 	};
 }
 //#endregion
-//#region ../lib/src/control-plane/voice-env.ts
-var OPENPALM_VOICE_TTS_MODEL = "kokoro";
-var OPENPALM_VOICE_STT_MODEL = "whisper-1";
-var OPENPALM_VOICE_DEFAULT_VOICE = "bf_isabella";
-function openpalmVoiceBaseURL() {
-	const raw = (process.env.OP_VOICE_PORT_HOST ?? "").trim();
-	const n = raw ? Number(raw) : NaN;
-	return `http://127.0.0.1:${Number.isFinite(n) && n > 0 ? n : 8880}`;
-}
-function applyOpenPalmVoicePreset(section, kind) {
-	if (section.engine !== "openpalm-voice") return;
-	if (!section.baseURL?.trim()) section.baseURL = openpalmVoiceBaseURL();
-	if (!section.model?.trim()) section.model = kind === "tts" ? OPENPALM_VOICE_TTS_MODEL : OPENPALM_VOICE_STT_MODEL;
-	if (kind === "tts" && !section.voice?.trim()) section.voice = OPENPALM_VOICE_DEFAULT_VOICE;
-}
-function writeVoiceVars(config, homeDir) {
-	const stackEnvPath = legacyStackEnvFile(homeDir);
-	const base = existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "";
-	const vars = {};
-	const tts = config.tts ? { ...config.tts } : void 0;
-	const stt = config.stt ? { ...config.stt } : void 0;
-	if (tts) applyOpenPalmVoicePreset(tts, "tts");
-	if (stt) applyOpenPalmVoicePreset(stt, "stt");
-	if (tts?.enabled !== false) {
-		if (tts?.engine) vars.OP_TTS_ENGINE = tts.engine;
-		if (tts?.provider) vars.OP_TTS_PROVIDER = tts.provider;
-		if (tts?.baseURL) vars.OP_TTS_BASE_URL = tts.baseURL;
-		if (tts?.model) vars.OP_TTS_MODEL = tts.model;
-		if (tts?.voice) vars.OP_TTS_VOICE = tts.voice;
-	}
-	if (stt?.enabled !== false) {
-		if (stt?.engine) vars.OP_STT_ENGINE = stt.engine;
-		if (stt?.provider) vars.OP_STT_PROVIDER = stt.provider;
-		if (stt?.baseURL) vars.OP_STT_BASE_URL = stt.baseURL;
-		if (stt?.model) vars.OP_STT_MODEL = stt.model;
-		if (stt?.language) vars.OP_STT_LANGUAGE = stt.language;
-	}
-	if (Object.keys(vars).length === 0) return;
-	assertNoSecretLikeStackEnvKeys(vars);
-	let content = mergeEnvContent(base, vars, { sectionHeader: "# ── Voice Channel (TTS/STT) ──────────────────────────────────────────" });
-	if (!content.endsWith("\n")) content += "\n";
-	mkdirSync(dirname(stackEnvPath), {
-		recursive: true,
-		mode: 448
-	});
-	writeFileSync(stackEnvPath, content, { mode: 384 });
-}
-//#endregion
 //#region ../lib/src/control-plane/setup-validation.ts
 /**
 * Validation logic for SetupSpec inputs.
@@ -10180,7 +10170,7 @@ function validateConnectionsArray(connections, errors) {
 * This module does NOT include Docker operations (compose up, image pull, etc.)
 * — those happen separately in the caller after setup completes.
 */
-var logger$2 = createLogger("setup");
+var logger$1 = createLogger("setup");
 /**
 * Build the non-secret stack.env update payload from a setup spec.
 * Extracts owner name/email into OP_OWNER_* env vars.
@@ -10317,8 +10307,8 @@ function seedDefaultAutomation(state) {
 	const akmImproveTask = getRegistryAutomation("akm-improve");
 	if (akmImproveTask) {
 		writeFileSync(akmImproveDest, akmImproveTask);
-		logger$2.info("seeded default automation", { name: "akm-improve" });
-	} else logger$2.warn("default automation missing from registry; skipping seed", { name: "akm-improve" });
+		logger$1.info("seeded default automation", { name: "akm-improve" });
+	} else logger$1.warn("default automation missing from registry; skipping seed", { name: "akm-improve" });
 }
 async function performSetup(input, opts) {
 	const validation = validateSetupSpec(input);
@@ -10333,7 +10323,7 @@ async function performSetup(input, opts) {
 			error: envCheck.errors.join("; ")
 		};
 	}
-	const { llm, embedding, tts, stt, security, owner, connections, portalCredentials, addons, voiceProfile, ollamaProfile, imageTag, hostAkm, network } = input;
+	const { llm, embedding, security, owner, connections, portalCredentials, addons, voiceProfile, ollamaProfile, imageTag, hostAkm, network } = input;
 	const state = createState();
 	initializeStateSecrets(state);
 	const lockHandle = acquireInstallLock(state.dataDir);
@@ -10341,7 +10331,7 @@ async function performSetup(input, opts) {
 		ok: false,
 		error: "install_in_progress: Another install is in progress. Wait for it to finish (the lock clears itself automatically after 30 minutes). If you're sure nothing is running, run 'openpalm unlock' to clear a stale lock."
 	};
-	logger$2.info("performing setup", { connectionCount: connections.length });
+	logger$1.info("performing setup", { connectionCount: connections.length });
 	const updates = buildOwnerEnvFromSetup(owner);
 	const providerKeys = buildAuthJsonFromSetup(connections);
 	try {
@@ -10362,7 +10352,7 @@ async function performSetup(input, opts) {
 			writeAuthJsonProviderKeys(state, providerKeys);
 		} catch (err) {
 			const message = errMessage(err);
-			logger$2.error("failed to persist setup outputs", { error: message });
+			logger$1.error("failed to persist setup outputs", { error: message });
 			return {
 				ok: false,
 				error: `Failed to persist setup outputs: ${message}`
@@ -10380,17 +10370,13 @@ async function performSetup(input, opts) {
 			addHostStashToOpenpalmConfig(state);
 			if (hostAkm !== false) {
 				const { profilesImported } = enableHostAkmSharing(state);
-				logger$2.info("host akm sharing enabled during setup", { profilesImported });
+				logger$1.info("host akm sharing enabled during setup", { profilesImported });
 			} else disableHostAkmSharing(state);
-			if (tts || stt) writeVoiceVars({
-				tts,
-				stt
-			}, state.homeDir);
 			if (addons) for (const [name, enabled] of Object.entries(addons)) setAddonEnabled(state.homeDir, name, enabled === true, state);
 			if (network?.preset === "shared-guardian") {
 				if (![...Object.entries(addons ?? {}).filter(([, on]) => on).map(([name]) => name), ...listEnabledAddonIds(state.homeDir)].some((a) => GUARDIAN_INGRESS_ADDON_IDS.includes(a))) {
 					setAddonEnabled(state.homeDir, "chat", true, state);
-					logger$2.info("shared-guardian preset auto-enabled the chat portal", { reason: "guardian ingress required for the protected front door" });
+					logger$1.info("shared-guardian preset auto-enabled the chat portal", { reason: "guardian ingress required for the protected front door" });
 				}
 			}
 			if (voiceProfile?.trim()) setAddonProfileSelection(state.homeDir, "voice", voiceProfile.trim());
@@ -10399,13 +10385,13 @@ async function performSetup(input, opts) {
 			seedDefaultAutomation(state);
 		} catch (err) {
 			const message = errMessage(err);
-			logger$2.error("failed to complete setup persistence", { error: message });
+			logger$1.error("failed to complete setup persistence", { error: message });
 			return {
 				ok: false,
 				error: `Setup persistence failed: ${message}`
 			};
 		}
-		logger$2.info("setup complete", { connectionCount: connections.length });
+		logger$1.info("setup complete", { connectionCount: connections.length });
 		return { ok: true };
 	} finally {
 		releaseInstallLock(lockHandle);
@@ -10445,14 +10431,6 @@ function hostConfigJsonPath() {
 function hostAuthJsonPath() {
 	return `${xdgDataHome()}/opencode/auth.json`;
 }
-/** Keys that are safe to import from host opencode.json into OP_HOME config. */
-var ALLOWED_CONFIG_KEYS = new Set([
-	"$schema",
-	"provider",
-	"model",
-	"small_model",
-	"disabled_providers"
-]);
 function readJsonFileSafe(path) {
 	try {
 		return JSON.parse(readFileSync(path, "utf-8"));
@@ -10467,7 +10445,7 @@ function stripDisallowedKeys(obj) {
 	if (typeof obj.model === "string") next.model = obj.model;
 	if (typeof obj.small_model === "string") next.small_model = obj.small_model;
 	if (Array.isArray(obj.disabled_providers) && obj.disabled_providers.every((entry) => typeof entry === "string")) next.disabled_providers = obj.disabled_providers;
-	return Object.fromEntries(Object.entries(next).filter(([k]) => ALLOWED_CONFIG_KEYS.has(k)));
+	return next;
 }
 function countProviders(obj) {
 	const provider = obj.provider;
@@ -12708,7 +12686,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return family === 4 || family === "IPv4";
 	}
 })))());
-var logger$1 = createLogger("mdns");
+var logger = createLogger("mdns");
 var MDNS_PORT = 5353;
 var TTL = 120;
 var HTTP_SERVICE = "_http._tcp.local";
@@ -12935,7 +12913,7 @@ function createResponder(adverts, deps = {}) {
 	try {
 		mdns = factory();
 	} catch (err) {
-		logger$1.warn("mdns: failed to create socket", {
+		logger.warn("mdns: failed to create socket", {
 			error: String(err),
 			names
 		});
@@ -12949,7 +12927,7 @@ function createResponder(adverts, deps = {}) {
 		try {
 			mdns.respond({ answers });
 		} catch (err) {
-			logger$1.warn("mdns: send failed", {
+			logger.warn("mdns: send failed", {
 				error: String(err),
 				names
 			});
@@ -12964,22 +12942,22 @@ function createResponder(adverts, deps = {}) {
 				const legacy = rinfo.port !== MDNS_PORT;
 				mdns.respond(res, legacy ? rinfo : void 0);
 			} catch (err) {
-				logger$1.warn("mdns: message handling failed", {
+				logger.warn("mdns: message handling failed", {
 					error: String(err),
 					names
 				});
 			}
 		});
-		mdns.on("error", (err) => logger$1.warn("mdns: socket error", {
+		mdns.on("error", (err) => logger.warn("mdns: socket error", {
 			error: err.message,
 			names
 		}));
-		mdns.on("warning", (err) => logger$1.warn("mdns: warning", {
+		mdns.on("warning", (err) => logger.warn("mdns: warning", {
 			error: err.message,
 			names
 		}));
 	} catch (err) {
-		logger$1.warn("mdns: listener setup failed", {
+		logger.warn("mdns: listener setup failed", {
 			error: String(err),
 			names
 		});
@@ -12992,7 +12970,7 @@ function createResponder(adverts, deps = {}) {
 		try {
 			mdns.destroy();
 		} catch (err) {
-			logger$1.warn("mdns: close failed", {
+			logger.warn("mdns: close failed", {
 				error: String(err),
 				names
 			});
@@ -13011,7 +12989,7 @@ function createResponder(adverts, deps = {}) {
 				const answers = goodbyeAnswers(adverts);
 				if (answers.length > 0) mdns.respond({ answers });
 			} catch (err) {
-				logger$1.warn("mdns: goodbye failed", {
+				logger.warn("mdns: goodbye failed", {
 					error: String(err),
 					names
 				});
@@ -13035,7 +13013,7 @@ function reconcileMdnsResponder(homeDir, deps = {}) {
 	try {
 		env = deps.env ?? readStackEnv(homeDir);
 	} catch (err) {
-		logger$1.warn("mdns: reading stack.env failed", { error: String(err) });
+		logger.warn("mdns: reading stack.env failed", { error: String(err) });
 		env = {};
 	}
 	const effectiveEnv = isMdnsOffToken((deps.processEnv ?? process.env).OP_MDNS) ? {
@@ -13050,7 +13028,7 @@ function reconcileMdnsResponder(homeDir, deps = {}) {
 			try {
 				active.handle.stop();
 			} catch (err) {
-				logger$1.warn("mdns: stop failed during reconcile", { error: String(err) });
+				logger.warn("mdns: stop failed during reconcile", { error: String(err) });
 			}
 			active = null;
 		}
@@ -13062,13 +13040,10 @@ function reconcileMdnsResponder(homeDir, deps = {}) {
 			};
 		}
 	} catch (err) {
-		logger$1.warn("mdns: reconcile failed", { error: String(err) });
+		logger.warn("mdns: reconcile failed", { error: String(err) });
 	}
 	return resolveMdnsStatus(effectiveEnv);
 }
-function resolveClientAppPort(env = process.env) {
-	return Number(env.OP_HOST_CLIENT_PORT) || 3890;
-}
 //#endregion
 //#region ../lib/src/control-plane/ui-supervisor.ts
 /**
@@ -13126,5 +13101,5 @@ function restoreUiBackup(dataDir, uiBackupDir, deps = {}) {
 	}
 }
 
-export { fetchProviderModels as $, AKM_USER_ENV_REF as A, composeStats as B, composeStop as C, createLogger as D, ELECTRON_ASSET_PATTERN as E, createOpenCodeClient as F, createState as G, HostSwapBlockedError as H, INSTALL_LOCK_STALE_AFTER_MS as I, deleteUserEnvKey as J, deriveLaunchStatus as K, deriveLocalStackState as L, detectExistingProject as M, detectGpu as N, detectHostOpenCode as O, PLATFORM_VERSION as P, detectLocalProviders as Q, detectRootlessDocker as R, SERVICE_VERSION_KEYS as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, dockerHasNvidiaRuntime as W, enableHostAkmSharing as X, ensureAkmUserEnv as Y, execFileNoThrow as Z, executeAutomation as _, acquireInstallLock as a, useExistingProviderForAssistantCli as a$, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, readTaskFile as aA, readUserEnvFile as aB, readVersions as aC, recommendSetup as aD, reconcileHostOwnership as aE, reconcileMdnsResponder as aF, recordPendingUiBackup as aG, recordProjectRename as aH, releaseInstallLock as aI, removeSecretFile as aJ, removeTaskFile as aK, resolveClientAppPort as aL, resolveComposeProjectName as aM, resolveDeployJournalPath as aN, resolveMdnsStatus as aO, resolveOpenPalmHome as aP, restoreSnapshot as aQ, restoreSnapshotAndApplyStack as aR, restoreUiBackup as aS, runAssistantAkmCommand as aT, runDeploy as aU, setAddonEnabled as aV, setAddonProfileSelection as aW, stackDirFor as aX, summarizeBackups as aY, teardownRenamedProject as aZ, unlockInstallLock as a_, inspectInstallLock as aa, isAllowedService as ab, isChannelPreference as ac, isSetupComplete as ad, listAssistantCliTools as ae, listAvailableAddonIds as af, listBackupDirs as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, mintDirectPrincipalPairingCode as am, patchSecretsEnvFile as an, performSetup as ao, performUpgrade as ap, pruneBackupDirs as aq, readAutomationLogs as ar, readChannelPreference as as, readDeployJournal as at, readSecret as au, readSecretFile as av, readSecretStripNotice as aw, readStackEnv as ax, readStackRuntimeEnv as ay, readStackSecretEnv as az, addonProfileId as b, validateProposedState as b0, writeChannelPreference as b1, writeFileAtomic as b2, writeSecretFile as b3, writeStackSecretEnv as b4, writeTaskFile as b5, writeUserEnvKey as b6, writeVersions as b7, writeVoiceVars as b8, annotateAddonProfileAvailability as c, applyInstall as d, applyStack as e, applyUninstall as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkAndUpdateUiBuild as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, composeConfigServices as s, composeDown as t, composeDownProject as u, composeLogs as v, composePreflight as w, composePs as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-DbArH65P.js.map
+export { fetchProviderModels as $, AKM_USER_ENV_REF as A, composeStats as B, composeStop as C, createLogger as D, ELECTRON_ASSET_PATTERN as E, createOpenCodeClient as F, createState as G, HostSwapBlockedError as H, INSTALL_LOCK_STALE_AFTER_MS as I, deleteUserEnvKey as J, deriveLaunchStatus as K, deriveLocalStackState as L, detectExistingProject as M, detectGpu as N, detectHostOpenCode as O, PLATFORM_VERSION as P, detectLocalProviders as Q, detectRootlessDocker as R, SERVICE_VERSION_KEYS as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, dockerHasNvidiaRuntime as W, enableHostAkmSharing as X, ensureAkmUserEnv as Y, execFileNoThrow as Z, executeAutomation as _, acquireInstallLock as a, validateProposedState as a$, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, readTaskFile as aA, readUserEnvFile as aB, readVersions as aC, recommendSetup as aD, reconcileHostOwnership as aE, reconcileMdnsResponder as aF, recordPendingUiBackup as aG, recordProjectRename as aH, releaseInstallLock as aI, removeSecretFile as aJ, removeTaskFile as aK, resolveComposeProjectName as aL, resolveDeployJournalPath as aM, resolveMdnsStatus as aN, resolveOpenPalmHome as aO, restoreSnapshot as aP, restoreSnapshotAndApplyStack as aQ, restoreUiBackup as aR, runAssistantAkmCommand as aS, runDeploy as aT, setAddonEnabled as aU, setAddonProfileSelection as aV, stackDirFor as aW, summarizeBackups as aX, teardownRenamedProject as aY, unlockInstallLock as aZ, useExistingProviderForAssistantCli as a_, inspectInstallLock as aa, isAllowedService as ab, isChannelPreference as ac, isSetupComplete as ad, listAssistantCliTools as ae, listAvailableAddonIds as af, listBackupDirs as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, mintDirectPrincipalPairingCode as am, patchSecretsEnvFile as an, performSetup as ao, performUpgrade as ap, pruneBackupDirs as aq, readAutomationLogs as ar, readChannelPreference as as, readDeployJournal as at, readSecret as au, readSecretFile as av, readSecretStripNotice as aw, readStackEnv as ax, readStackRuntimeEnv as ay, readStackSecretEnv as az, addonProfileId as b, writeChannelPreference as b0, writeFileAtomic as b1, writeSecretFile as b2, writeStackSecretEnv as b3, writeTaskFile as b4, writeUserEnvKey as b5, writeVersions as b6, annotateAddonProfileAvailability as c, applyInstall as d, applyStack as e, applyUninstall as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkAndUpdateUiBuild as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, composeConfigServices as s, composeDown as t, composeDownProject as u, composeLogs as v, composePreflight as w, composePs as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-B2wHibme.js.map