create-workframe 0.1.3 → 0.1.5

package/README.md

@@ -3,7 +3,7 @@
 Published on npm as **create-workframe**.
 
 ```bash
-npx create-workframe@0.1.3 MyProject
+npx create-workframe@0.1.5 MyProject
 ```
 
 Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-workframe",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Scaffold a Workframe + Hermes workspace with guided onboarding",
   "type": "module",
   "bin": {

package/scripts/bundle-workframe-ui.mjs

@@ -31,18 +31,24 @@ function copyTree(src, dst) {
   }
 }
 
+const skipBuild = process.argv.includes('--skip-build');
+
 if (!fs.existsSync(UI_SRC)) {
   console.error(`apps/web source not found: ${UI_SRC}`);
   process.exit(1);
 }
 
-console.log('Building @workframe/web...');
-const build = spawnSync(npmCmd(), ['run', 'build'], {
-  cwd: UI_SRC,
-  stdio: 'inherit',
-  shell: process.platform === 'win32',
-});
-if (build.status !== 0) process.exit(build.status ?? 1);
+if (!skipBuild) {
+  console.log('Building @workframe/web...');
+  const build = spawnSync(npmCmd(), ['run', 'build'], {
+    cwd: UI_SRC,
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+  });
+  if (build.status !== 0) process.exit(build.status ?? 1);
+} else {
+  console.log('Skipping @workframe/web build (--skip-build)');
+}
 
 const dist = path.join(UI_SRC, 'dist');
 if (!fs.existsSync(path.join(dist, 'index.html'))) {

package/workframe-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workframe/workframe-api",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": true,
   "type": "module",
   "scripts": {

package/workframe-api/server.py

@@ -551,12 +551,26 @@ def _admin_write_allowed(handler: BaseHTTPRequestHandler) -> bool:
 
 
 def _apply_stack_update(target: str) -> dict[str, Any]:
+    workframe_version = ""
+    if target in {"workframe", "all"}:
+        try:
+            workframe_version = str(
+                stack_updates.updates_available().get("workframe", {}).get("latest") or ""
+            ).strip()
+        except Exception:  # noqa: BLE001
+            workframe_version = ""
     try:
         return stack_updates.apply_update(target)
     except ValueError as exc:
-        if str(exc) != "docker_unavailable" or not _supervisor_ready():
+        err = str(exc)
+        if not _supervisor_ready():
+            raise
+        if err not in ("docker_unavailable", "admin_updates_disabled"):
             raise
-        status, data = _supervisor_request("POST", "/v1/stack.apply", {"target": target}, timeout=900.0)
+        body: dict[str, Any] = {"target": target}
+        if workframe_version:
+            body["workframe_version"] = workframe_version
+        status, data = _supervisor_request("POST", "/v1/stack.apply", body, timeout=900.0)
         if status >= 300 or not isinstance(data, dict) or not data.get("ok"):
             raise ValueError(str((data or {}).get("error") or "supervisor_apply_failed"))
         return data
@@ -2641,6 +2655,24 @@ def _spawn_hermes_device_oauth(user_id: str, hermes_auth_id: str, log_container:
     """Start long-running `hermes auth add` detached in gateway (survives exec return)."""
     home = _hermes_user_home_container(user_id)
     _user_hermes_home(user_id).mkdir(parents=True, exist_ok=True)
+    if SECURE_MODE and _supervisor_ready():
+        status, data = _supervisor_request(
+            "POST",
+            "/v1/hermes.device_oauth_start",
+            {"home": home, "hermes_auth_id": hermes_auth_id, "log_path": log_container},
+            timeout=30.0,
+        )
+        if status >= 300:
+            err = data.get("error") if isinstance(data, dict) else str(data)
+            raise ValueError(err or "device_oauth_start_failed")
+        if not isinstance(data, dict):
+            raise ValueError("device_oauth_start_invalid")
+        exit_code = data.get("exit_code")
+        try:
+            code = int(exit_code if exit_code is not None else 1)
+        except (TypeError, ValueError):
+            code = 1
+        return code, str(data.get("output") or "")
     auth_cmd = " ".join(shlex.quote(part) for part in ["auth", "add", hermes_auth_id])
     shell = (
         f"mkdir -p {shlex.quote(home)}; "
@@ -12402,7 +12434,9 @@ def _overlay_chat_llm_env(
     user = str(user_id or "").strip()
     if not user:
         return False
-    prov = _llm_billing_provider(hermes_prof, provider)
+    prov = _llm_billing_provider(hermes_prof, provider, user_id=user, workspace_id=workspace_id)
+    if not _profile_llm_proxy_matches_billing(hermes_prof, prov):
+        _ensure_profile_llm_proxy(hermes_prof, prov)
     slug = safe_profile_slug(hermes_prof)
     turn_run = str(uuid.uuid4())
     ready = _try_overlay_turn_provider_env(hermes_prof, user, workspace_id, prov, turn_run)
@@ -12481,21 +12515,91 @@ def _augment_model_suggestions(
     return extra + suggestions
 
 
-def _llm_billing_provider(profile: str, provider_hint: str = "") -> str:
-    """Map Hermes routing provider (often custom for proxy) to vault/billing provider id."""
-    hint = str(provider_hint or "").strip().lower()
-    if hint and hint not in {"custom", "auto"}:
-        return hint
-    cfg_provider, model = _read_model_from_config(profile)
-    cfg_provider = str(cfg_provider or "").strip().lower()
-    if cfg_provider and cfg_provider not in {"custom", "auto"}:
-        return cfg_provider
-    model_id = str(model or "").strip()
-    if "/" in model_id:
-        return model_id.split("/", 1)[0].strip().lower() or "openrouter"
+_INTERNAL_LLM_PROXY_RE = re.compile(r"/internal/llm/([a-z0-9_-]+)/v1", re.I)
+
+
+def _billing_provider_from_block(base_url: str, cfg_provider: str, hint: str) -> str:
+    """Pure resolver: the billing provider is the proxy URL segment (the stored fact).
+
+    Order: explicit hint > proxy URL segment > cfg_provider > "openrouter".
+    The model-id prefix (e.g. ``google/`` in ``google/gemini-2.5-flash``) is an
+    OpenRouter vendor namespace, NOT a billing provider, so it is never used here.
+    ponytail: removing model-prefix inference is the root-cause fix for the
+    "provider not recognized" bug where an OpenRouter-only user was billed to google.
+    """
+    h = str(hint or "").strip().lower()
+    if h and h not in {"custom", "auto"}:
+        return h
+    m = _INTERNAL_LLM_PROXY_RE.search(str(base_url or ""))
+    if m:
+        return m.group(1).lower()
+    cfg = str(cfg_provider or "").strip().lower()
+    if cfg and cfg not in {"custom", "auto"}:
+        return cfg
     return "openrouter"
 
 
+def _llm_billing_provider(
+    profile: str,
+    provider_hint: str = "",
+    *,
+    user_id: str = "",
+    workspace_id: str = "",
+) -> str:
+    """Map Hermes routing provider (often custom for proxy) to vault/billing provider id."""
+    prof = resolve_hermes_profile(profile)
+    block = _read_model_block(prof)
+    cfg_provider = str(block.get("provider") or "").strip().lower()
+    if not cfg_provider:
+        cfg_provider = str(_read_model_from_config(prof)[0] or "").strip().lower()
+    candidate = _billing_provider_from_block(
+        str(block.get("base_url") or ""), cfg_provider, provider_hint,
+    )
+    user = str(user_id or "").strip()
+    ws = str(workspace_id or "").strip()
+    if user and not _user_can_use_llm(user, ws, candidate):
+        connected = sorted(_user_llm_providers_for_picker(user))
+        if connected:
+            return connected[0]
+    return candidate or "openrouter"
+
+
+def _profile_llm_proxy_matches_billing(profile: str, billing_provider: str) -> bool:
+    prof = resolve_hermes_profile(profile)
+    base = str(_read_model_block(prof).get("base_url") or "").strip()
+    return bool(base) and base == _llm_proxy_base_url(billing_provider)
+
+
+def _reconcile_profile_llm_for_user(
+    profile: str,
+    user_id: str,
+    workspace_id: str,
+    *,
+    prefer_provider: str = "",
+) -> bool:
+    """Point proxy + MVP model at a provider the acting user can bill."""
+    user = str(user_id or "").strip()
+    if not user:
+        return False
+    prof = resolve_hermes_profile(profile)
+    billing = _llm_billing_provider(prof, user_id=user, workspace_id=workspace_id)
+    prefer = str(prefer_provider or "").strip().lower()
+    if prefer and _user_can_use_llm(user, workspace_id, prefer):
+        billing = prefer
+    elif not _user_can_use_llm(user, workspace_id, billing):
+        connected = sorted(_user_llm_providers_for_picker(user))
+        if not connected:
+            return False
+        billing = connected[0]
+    if _user_can_use_llm(user, workspace_id, billing) and _profile_llm_proxy_matches_billing(prof, billing):
+        return False
+    changed = _apply_mvp_model_for_provider(prof, billing)
+    block = _read_model_block(prof)
+    if _is_runtime_profile_slug(prof) or str(block.get("provider") or "").strip().lower() == "custom":
+        _ensure_profile_llm_proxy(prof, billing)
+    return changed
+
+
 def _bootstrap_profile_providers(profile: str, user_id: str = "", workspace_id: str = "") -> bool:
     """Seed profile auth + MVP model config from user, workspace, or primary stack."""
     prof = resolve_hermes_profile(profile)
@@ -12724,7 +12828,9 @@ def profile_chat_session(profile: str, payload: dict[str, Any], user_id: str = "
             profile, user_id, "", workspace_id,
         )
     payer = user_id
-    llm_provider = _llm_billing_provider(hermes_prof)
+    if payer:
+        _reconcile_profile_llm_for_user(hermes_prof, payer, workspace_id)
+    llm_provider = _llm_billing_provider(hermes_prof, user_id=payer, workspace_id=workspace_id)
     lifecycle = ensure_profile_api(hermes_prof, user_id, workspace_id)
     llm_ready = _user_can_use_llm(payer, workspace_id, llm_provider) if payer else False
     session_extra = {"llm_ready": llm_ready, "has_llm_provider": llm_ready}
@@ -13032,7 +13138,9 @@ def profile_chat_activate_room_session(
         gateway_sid,
     )
 
-    llm_provider = _llm_billing_provider(hermes_prof)
+    if payer:
+        _reconcile_profile_llm_for_user(hermes_prof, payer, workspace_id)
+    llm_provider = _llm_billing_provider(hermes_prof, user_id=payer, workspace_id=workspace_id)
     llm_ready = _overlay_chat_llm_env(hermes_prof, user_id, workspace_id, llm_provider)
 
     history = chat_messages(hermes_prof, session_id)
@@ -13245,7 +13353,9 @@ def profile_chat_message(profile: str, payload: dict[str, Any]) -> dict[str, Any
     hermes_prof, _template_prof = _resolve_bind_profile_arg(
         profile, payer, room_id, workspace_id,
     )
-    llm_provider = _llm_billing_provider(hermes_prof)
+    if payer:
+        _reconcile_profile_llm_for_user(hermes_prof, payer, workspace_id)
+    llm_provider = _llm_billing_provider(hermes_prof, user_id=payer, workspace_id=workspace_id)
     lifecycle = ensure_profile_api(
         hermes_prof,
         payer,
@@ -13400,7 +13510,9 @@ def stream_profile_chat(handler: BaseHTTPRequestHandler, profile: str, payload:
         raise ValueError("session_id required")
     if not text:
         raise ValueError("text required")
-    llm_provider = _llm_billing_provider(prof)
+    if _triggering_user:
+        _reconcile_profile_llm_for_user(prof, _triggering_user, _workspace_id)
+    llm_provider = _llm_billing_provider(prof, user_id=_triggering_user, workspace_id=_workspace_id)
     llm_ready = bool(
         _triggering_user
         and _user_can_use_llm(_triggering_user, _workspace_id, llm_provider)
@@ -14399,17 +14511,23 @@ def _bootstrap_model_after_llm_connect(
     if not spec or str(spec.get("category") or "") != "llm":
         return
     provider_key = str(provider or "").strip().lower()
+    user = str(user_id or "").strip()
+    ws = str(workspace_id or "").strip()
     primary = _primary_profile()
     if primary:
         _, model = _read_model_from_config(primary)
         if not str(model or "").strip():
             _apply_mvp_model_for_provider(primary, provider_key)
+        elif user:
+            _reconcile_profile_llm_for_user(primary, user, ws, prefer_provider=provider_key)
     template = primary or "workframe-agent"
     runtime = _runtime_profile_slug(user_id, template)
     if _runtime_profile_on_disk(runtime):
         _, model = _read_model_from_config(runtime)
         if not str(model or "").strip():
             _apply_mvp_model_for_provider(runtime, provider_key)
+        elif user:
+            _reconcile_profile_llm_for_user(runtime, user, ws, prefer_provider=provider_key)
 
 
 # Curated snapshot of commonly-used models per provider. Surfaced in the
@@ -14472,9 +14590,6 @@ HERMES_MODEL_CATALOG: list[dict[str, str]] = [
     {"provider": "OpenRouter", "model": "openrouter/nvidia/llama-3.1-nemotron-70b-instruct",
      "label": "Nemotron 70B Instruct",
      "description": "NVIDIA Nemotron via OpenRouter."},
-    {"provider": "OpenRouter", "model": "openrouter/anthropic/claude-sonnet-4-5",
-     "label": "Claude Sonnet 4.5 (via OR)",
-     "description": "Sonnet through OpenRouter."},
     {"provider": "OpenRouter", "model": "openrouter/openai/gpt-4o",
      "label": "GPT-4o (via OR)",
      "description": "GPT-4o through OpenRouter."},
@@ -14857,6 +14972,15 @@ def hermes_models(profile: str = "", user_id: str = "", workspace_id: str = "")
                 for row in live
                 if str(row.get("model") or "") not in seen
             ] + suggestions
+    seen_models: set[str] = set()
+    deduped: list[dict[str, str]] = []
+    for row in suggestions:
+        mid = str(row.get("model") or "").strip()
+        if not mid or mid in seen_models:
+            continue
+        seen_models.add(mid)
+        deduped.append(row)
+    suggestions = deduped
     return {
         "ok": True,
         "profile": primary_profile,

package/workframe-api/test_billing_provider.py

@@ -0,0 +1,24 @@
+"""ponytail self-check: billing provider source of truth = proxy URL, never model-id prefix.
+
+Run: python services/workframe-api/test_billing_provider.py
+No framework, no fixtures. Fails fast if the inference regression returns.
+"""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402  (module import is side-effect-free; main() is guarded)
+
+# The bug case: profile model is google/gemini-2.5-flash but proxy routes via openrouter.
+# The model-id prefix MUST NOT leak as the billing provider.
+assert server._billing_provider_from_block("/internal/llm/openrouter/v1", "custom", "") == "openrouter", \
+    "proxy URL segment must win over model-id prefix"
+# Explicit hint honored.
+assert server._billing_provider_from_block("", "", "anthropic") == "anthropic", "hint honored"
+# Empty block defaults to openrouter (no inference).
+assert server._billing_provider_from_block("", "", "") == "openrouter", "empty-block default"
+# cfg_provider honored only when no proxy URL is set.
+assert server._billing_provider_from_block("", "openai", "") == "openai", "cfg_provider honored without proxy"
+
+print("billing provider self-check ok")

package/workframe-api/updates.py

@@ -190,6 +190,38 @@ def _host_compose_ready() -> bool:
     return compose.joinpath("docker-compose.yml").is_file()
 
 
+def _supervisor_configured() -> bool:
+    return bool(os.environ.get("WORKFRAME_SUPERVISOR_URL", "").strip()) and bool(
+        os.environ.get("WORKFRAME_SUPERVISOR_TOKEN", "").strip()
+    )
+
+
+def _supervisor_gateway_image_digest() -> tuple[str, str]:
+    """Read gateway image digest via workframe-supervisor (SECURE_MODE API has no docker.sock)."""
+    base = str(os.environ.get("WORKFRAME_SUPERVISOR_URL", "")).rstrip("/")
+    token = str(os.environ.get("WORKFRAME_SUPERVISOR_TOKEN", "")).strip()
+    if not base or not token:
+        return "", ""
+    req = urllib.request.Request(
+        f"{base}/v1/gateway.image",
+        headers={"Authorization": f"Bearer {token}", "Accept": "application/json", "User-Agent": "workframe-api"},
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=15.0) as resp:
+            data = json.loads(resp.read().decode("utf-8"))
+    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError, OSError):
+        return "", ""
+    if not isinstance(data, dict) or not data.get("ok"):
+        return "", ""
+    return str(data.get("digest") or "").strip(), str(data.get("ref") or "").strip()
+
+
+def _admin_stack_updates_enabled() -> bool:
+    if os.environ.get("WORKFRAME_ENABLE_ADMIN_UPDATES") == "1":
+        return True
+    return _supervisor_configured()
+
+
 def _docker_apply_ready() -> tuple[bool, str | None]:
     if not Path(DOCKER_SOCK).exists():
         return False, "Docker socket is not available to the API container."
@@ -202,6 +234,29 @@ def _docker_apply_ready() -> tuple[bool, str | None]:
     return True, None
 
 
+def _update_apply_channel() -> tuple[str, bool, str | None]:
+    """Returns (channel, ready, reason). channel: api_docker | supervisor | none."""
+    api_docker = Path(DOCKER_SOCK).exists()
+    if api_docker:
+        ok, reason = _docker_apply_ready()
+        if ok:
+            return "api_docker", True, None
+        if not _supervisor_configured():
+            return "none", False, reason
+    if _supervisor_configured():
+        if _script_path("apply-update-workframe.sh") is None and _script_path("apply-update-hermes.sh") is None:
+            return "supervisor", False, "Stack update scripts are missing from this install."
+        return "supervisor", True, None
+    if api_docker:
+        _, reason = _docker_apply_ready()
+        return "none", False, reason
+    return (
+        "none",
+        False,
+        "In-place updates need workframe-supervisor or Docker on the stack host.",
+    )
+
+
 def _product_state(*, update_available: bool, can_update: bool) -> str:
     if update_available and can_update:
         return "available"
@@ -238,7 +293,9 @@ def _releases_manifest() -> dict[str, Any]:
 def updates_available(*, desktop_version: str = "", hermes_agent_version: str = "") -> dict[str, Any]:
     compose_dir = _compose_dir()
     project_root = _project_root()
-    docker_ok = Path(DOCKER_SOCK).exists()
+    api_docker = Path(DOCKER_SOCK).exists()
+    supervisor_ok = _supervisor_configured()
+    apply_channel, apply_ready, apply_reason = _update_apply_channel()
     installed = _read_installed_workframe_version(project_root)
 
     npm_latest = ""
@@ -254,15 +311,20 @@ def updates_available(*, desktop_version: str = "", hermes_agent_version: str =
     installed_pkg = installed.get("package") or installed.get("api") or ""
     workframe_update = bool(workframe_latest and _version_lt(installed_pkg, workframe_latest))
 
-    hermes_digest, hermes_ref = _container_image_digest(GATEWAY_CONTAINER)
+    hermes_digest, hermes_ref = ("", "")
+    if api_docker:
+        hermes_digest, hermes_ref = _container_image_digest(GATEWAY_CONTAINER)
+    elif supervisor_ok:
+        hermes_digest, hermes_ref = _supervisor_gateway_image_digest()
     hermes_tag = hermes_ref.rsplit(":", 1)[-1] if hermes_ref and ":" in hermes_ref else HERMES_TAG
     hermes_latest_digest = ""
     try:
         hermes_latest_digest = _docker_hub_digest(HERMES_IMAGE, HERMES_TAG)
     except (urllib.error.URLError, TimeoutError, json.JSONDecodeError, KeyError):
         pass
+    hermes_image_known = bool(api_docker or supervisor_ok)
     hermes_update = bool(
-        docker_ok
+        hermes_image_known
         and hermes_latest_digest
         and hermes_digest
         and hermes_digest != hermes_latest_digest,
@@ -275,15 +337,14 @@ def updates_available(*, desktop_version: str = "", hermes_agent_version: str =
     if len(digest_short) > 28:
         digest_short = digest_short[:28] + "…"
 
-    docker_apply_ok, docker_apply_reason = _docker_apply_ready()
     hermes_script_ok = _script_path("apply-update-hermes.sh") is not None
     workframe_script_ok = _script_path("apply-update-workframe.sh") is not None
-    hermes_can_update = bool(docker_apply_ok and hermes_script_ok)
-    workframe_can_update = bool(docker_apply_ok and workframe_script_ok)
-    hermes_reason = docker_apply_reason
+    hermes_can_update = bool(apply_ready and hermes_script_ok)
+    workframe_can_update = bool(apply_ready and workframe_script_ok)
+    hermes_reason = apply_reason
     if not hermes_reason and hermes_update and not hermes_script_ok:
         hermes_reason = "Hermes update script is missing from this install."
-    workframe_reason = docker_apply_reason
+    workframe_reason = apply_reason
     if not workframe_reason and workframe_update and not workframe_script_ok:
         workframe_reason = "Workframe update script is missing from this install."
     if not workframe_reason and workframe_update and not workframe_latest:
@@ -294,7 +355,11 @@ def updates_available(*, desktop_version: str = "", hermes_agent_version: str =
 
     return {
         "ok": True,
-        "docker_available": docker_ok,
+        "docker_available": apply_ready,
+        "docker_sock_on_api": api_docker,
+        "supervisor_configured": supervisor_ok,
+        "update_apply_channel": apply_channel if apply_ready else None,
+        "update_apply_ready": apply_ready,
         "compose_dir": str(compose_dir),
         "project_root": str(project_root),
         "workframe": {
@@ -323,7 +388,7 @@ def updates_available(*, desktop_version: str = "", hermes_agent_version: str =
             "reason": hermes_reason,
             "update_mode": "docker-compose-pull",
             "install_kind": "docker",
-            "can_restart_gateway": bool(docker_apply_ok and _script_path("restart-gateway-hermes.sh") is not None),
+            "can_restart_gateway": bool(apply_ready and _script_path("restart-gateway-hermes.sh") is not None),
         },
         "desktop": {
             "current": desktop_installed,
@@ -339,12 +404,33 @@ def updates_available(*, desktop_version: str = "", hermes_agent_version: str =
     }
 
 
+def _apply_env_for_target(target: str) -> dict[str, str]:
+    env = os.environ.copy()
+    env.setdefault("WORKFRAME_COMPOSE_DIR", str(_compose_dir()))
+    env.setdefault("WORKFRAME_PROJECT_ROOT", str(_project_root()))
+    if target in {"workframe", "all"}:
+        latest = ""
+        try:
+            latest = str(updates_available().get("workframe", {}).get("latest") or "").strip()
+        except Exception:  # noqa: BLE001
+            latest = ""
+        if latest:
+            env["WORKFRAME_UPDATE_ALLOW_NPM"] = "1"
+            env["WORKFRAME_UPDATE_VERSION"] = latest
+    return env
+
+
 def apply_update(target: str) -> dict[str, Any]:
-    if os.environ.get("WORKFRAME_ENABLE_ADMIN_UPDATES") != "1":
+    if not _admin_stack_updates_enabled():
         raise ValueError("admin_updates_disabled")
     target = str(target or "all").strip().lower()
     if target not in {"hermes", "workframe", "all"}:
         raise ValueError("invalid_update_target")
+    _, apply_ready, apply_reason = _update_apply_channel()
+    if not apply_ready:
+        if not Path(DOCKER_SOCK).exists():
+            raise ValueError("docker_unavailable")
+        raise ValueError(str(apply_reason or "docker_apply_unavailable"))
     if not Path(DOCKER_SOCK).exists():
         raise ValueError("docker_unavailable")
 
@@ -360,9 +446,7 @@ def apply_update(target: str) -> dict[str, Any]:
             raise ValueError("update_script_missing:workframe")
         scripts.append(str(script))
 
-    env = os.environ.copy()
-    env.setdefault("WORKFRAME_COMPOSE_DIR", str(_compose_dir()))
-    env.setdefault("WORKFRAME_PROJECT_ROOT", str(_project_root()))
+    env = _apply_env_for_target(target)
 
     logs: list[str] = []
     for script in scripts:
@@ -382,13 +466,15 @@ def apply_update(target: str) -> dict[str, Any]:
 
 
 def restart_gateway() -> dict[str, Any]:
-    if os.environ.get("WORKFRAME_ENABLE_ADMIN_UPDATES") != "1":
+    if not _admin_stack_updates_enabled():
         raise ValueError("admin_updates_disabled")
+    _, apply_ready, apply_reason = _update_apply_channel()
+    if not apply_ready:
+        if not Path(DOCKER_SOCK).exists():
+            raise ValueError("docker_unavailable")
+        raise ValueError(str(apply_reason or "docker_apply_unavailable"))
     if not Path(DOCKER_SOCK).exists():
         raise ValueError("docker_unavailable")
-    docker_apply_ok, docker_apply_reason = _docker_apply_ready()
-    if not docker_apply_ok:
-        raise ValueError(str(docker_apply_reason or "docker_apply_unavailable"))
     script = _script_path("restart-gateway-hermes.sh")
     if not script:
         raise ValueError("restart_script_missing:gateway")
@@ -414,4 +500,7 @@ if __name__ == "__main__":
     assert _version_lt("0.1.0", "0.1.1")
     assert not _version_lt("0.1.0", "0.1.0")
     assert parse_hermes_version_output("Hermes Agent v0.17.0 (2026.6.19)") == "0.17.0"
+    ch, ready, _ = _update_apply_channel()
+    assert ch in {"api_docker", "supervisor", "none"}
+    assert ready is False or ch != "none"
     print("updates module ok")