openmates 0.11.0-alpha.2 → 0.11.0-alpha.21

package/dist/{chunk-N6QY7K6L.js → chunk-JQ5CPV6P.js}

@@ -1,5 +1,10 @@
+import {
+  transcribeUploadedAudio,
+  uploadFile
+} from "./chunk-AXNRPVLE.js";
+
 // src/client.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { platform as platform2, release } from "os";
 import { createInterface } from "readline/promises";
 import { stdin, stdout } from "process";
@@ -87,6 +92,16 @@ async function decryptWithAesGcmCombined(encryptedWithIvB64, rawKeyBytes) {
     return null;
   }
 }
+async function deriveEmailEncryptionKeyB64(email, emailSaltB64) {
+  const encoder = new TextEncoder();
+  const emailBytes = encoder.encode(email);
+  const saltBytes = base64ToBytes(emailSaltB64);
+  const combined = new Uint8Array(emailBytes.length + saltBytes.length);
+  combined.set(emailBytes);
+  combined.set(saltBytes, emailBytes.length);
+  const hashBuffer = await cryptoApi.subtle.digest("SHA-256", toArrayBuffer(combined));
+  return bytesToBase64(new Uint8Array(hashBuffer));
+}
 async function decryptBytesWithAesGcm(encryptedWithIvB64, rawKeyBytes) {
   try {
     const combined = base64ToBytes(encryptedWithIvB64);
@@ -180,12 +195,66 @@ var OpenMatesHttpClient = class {
   async post(path, body, headers = {}) {
     return this.request("POST", path, body, headers);
   }
-  async delete(path, headers = {}) {
-    return this.request("DELETE", path, void 0, headers);
+  async delete(path, body, headers = {}) {
+    return this.request("DELETE", path, body, headers);
   }
   async patch(path, body, headers = {}) {
     return this.request("PATCH", path, body, headers);
   }
+  async getBinary(path, headers = {}) {
+    const url = `${this.apiUrl}${path.startsWith("/") ? path : `/${path}`}`;
+    const requestHeaders = {
+      Accept: "application/pdf,application/octet-stream",
+      ...headers
+    };
+    const cookieHeader = this.formatCookieHeader();
+    if (cookieHeader) requestHeaders.Cookie = cookieHeader;
+    const response = await fetch(url, { method: "GET", headers: requestHeaders });
+    this.captureCookies(response);
+    return {
+      ok: response.ok,
+      status: response.status,
+      data: new Uint8Array(await response.arrayBuffer()),
+      headers: response.headers
+    };
+  }
+  async *streamSse(path, headers = {}) {
+    const url = `${this.apiUrl}${path.startsWith("/") ? path : `/${path}`}`;
+    const requestHeaders = {
+      Accept: "text/event-stream",
+      ...headers
+    };
+    const cookieHeader = this.formatCookieHeader();
+    if (cookieHeader) requestHeaders.Cookie = cookieHeader;
+    const response = await fetch(url, { method: "GET", headers: requestHeaders });
+    this.captureCookies(response);
+    if (!response.ok) {
+      throw new Error(`SSE request failed with HTTP ${response.status}`);
+    }
+    if (!response.body) {
+      throw new Error("SSE response body is not readable");
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true });
+        let separatorIndex = buffer.indexOf("\n\n");
+        while (separatorIndex >= 0) {
+          const rawEvent = buffer.slice(0, separatorIndex);
+          buffer = buffer.slice(separatorIndex + 2);
+          const message = parseSseMessage(rawEvent);
+          if (message) yield message;
+          separatorIndex = buffer.indexOf("\n\n");
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+  }
   async request(method, path, body, headers = {}) {
     const url = `${this.apiUrl}${path.startsWith("/") ? path : `/${path}`}`;
     const requestHeaders = {
@@ -252,6 +321,19 @@ var OpenMatesHttpClient = class {
     return single ? [single] : [];
   }
 };
+function parseSseMessage(rawEvent) {
+  const message = { data: "" };
+  for (const line of rawEvent.split("\n")) {
+    if (!line || line.startsWith(":")) continue;
+    const separator = line.indexOf(":");
+    const field = separator >= 0 ? line.slice(0, separator) : line;
+    const value = separator >= 0 ? line.slice(separator + 1).replace(/^ /, "") : "";
+    if (field === "id") message.id = value;
+    if (field === "event") message.event = value;
+    if (field === "data") message.data += `${message.data ? "\n" : ""}${value}`;
+  }
+  return message.data ? message : null;
+}
 
 // src/storage.ts
 import {
@@ -533,6 +615,18 @@ function saveSession(session) {
   } else if (result.type === "plaintext") {
     onDisk.masterKeyExportedB64 = session.masterKeyExportedB64;
   }
+  if (session.emailEncryptionKeyB64) {
+    const emailKeyResult = storeMasterKey(
+      session.emailEncryptionKeyB64,
+      `${session.hashedEmail}:email`
+    );
+    onDisk.emailEncryptionKeyStorage = emailKeyResult.type;
+    if (emailKeyResult.type === "encrypted") {
+      onDisk.emailEncryptionKeyEncrypted = emailKeyResult.encryptedData;
+    } else if (emailKeyResult.type === "plaintext") {
+      onDisk.emailEncryptionKeyB64 = session.emailEncryptionKeyB64;
+    }
+  }
   writeJsonFile(filePath, onDisk);
   if (result.type !== "plaintext") {
     process.stderr.write("Decrypting data...\n");
@@ -543,17 +637,19 @@ function loadSession() {
   const onDisk = readJsonFile(filePath);
   if (!onDisk) return null;
   let masterKey = null;
+  let emailEncryptionKey = null;
   if (!onDisk.masterKeyStorage) {
     masterKey = onDisk.masterKeyExportedB64 ?? null;
     if (masterKey) {
-      const session = buildSession(onDisk, masterKey);
+      emailEncryptionKey = getEmailEncryptionKeyFromDisk(onDisk);
+      const session = buildSession(onDisk, masterKey, emailEncryptionKey);
       try {
         saveSession(session);
         process.stderr.write("Decrypting data...\n");
       } catch {
       }
     }
-    return masterKey ? buildSession(onDisk, masterKey) : null;
+    return masterKey ? buildSession(onDisk, masterKey, getEmailEncryptionKeyFromDisk(onDisk)) : null;
   }
   switch (onDisk.masterKeyStorage) {
     case "keychain":
@@ -577,7 +673,7 @@ function loadSession() {
     );
     return null;
   }
-  return buildSession(onDisk, masterKey);
+  return buildSession(onDisk, masterKey, getEmailEncryptionKeyFromDisk(onDisk));
 }
 function clearSession() {
   const filePath = join(ensureStateDir(), "session.json");
@@ -585,17 +681,36 @@ function clearSession() {
   if (onDisk?.masterKeyStorage) {
     deleteMasterKey(onDisk.masterKeyStorage, onDisk.hashedEmail);
   }
+  if (onDisk?.emailEncryptionKeyStorage) {
+    deleteMasterKey(onDisk.emailEncryptionKeyStorage, `${onDisk.hashedEmail}:email`);
+  }
   if (existsSync2(filePath)) {
     rmSync(filePath);
   }
 }
-function buildSession(onDisk, masterKey) {
+function getEmailEncryptionKeyFromDisk(onDisk) {
+  if (!onDisk.emailEncryptionKeyStorage) return onDisk.emailEncryptionKeyB64 ?? null;
+  switch (onDisk.emailEncryptionKeyStorage) {
+    case "keychain":
+      return retrieveMasterKey("keychain", `${onDisk.hashedEmail}:email`);
+    case "encrypted":
+      return retrieveMasterKey(
+        "encrypted",
+        `${onDisk.hashedEmail}:email`,
+        onDisk.emailEncryptionKeyEncrypted
+      );
+    case "plaintext":
+      return onDisk.emailEncryptionKeyB64 ?? null;
+  }
+}
+function buildSession(onDisk, masterKey, emailEncryptionKey) {
   return {
     apiUrl: onDisk.apiUrl,
     sessionId: onDisk.sessionId,
     wsToken: onDisk.wsToken,
     cookies: onDisk.cookies,
     masterKeyExportedB64: masterKey,
+    emailEncryptionKeyB64: emailEncryptionKey,
     hashedEmail: onDisk.hashedEmail,
     userEmailSalt: onDisk.userEmailSalt,
     createdAt: onDisk.createdAt,
@@ -603,18 +718,6 @@ function buildSession(onDisk, masterKey) {
     autoLogoutMinutes: onDisk.autoLogoutMinutes
   };
 }
-function loadIncognitoHistory() {
-  const filePath = join(ensureStateDir(), "incognito.json");
-  return readJsonFile(filePath) ?? [];
-}
-function saveIncognitoHistory(items) {
-  const filePath = join(ensureStateDir(), "incognito.json");
-  writeJsonFile(filePath, items);
-}
-function clearIncognitoHistory() {
-  const filePath = join(ensureStateDir(), "incognito.json");
-  writeJsonFile(filePath, []);
-}
 var SYNC_CACHE_FILE = "sync_cache.json";
 function saveSyncCache(cache) {
   const filePath = join(ensureStateDir(), SYNC_CACHE_FILE);
@@ -624,6 +727,12 @@ function loadSyncCache() {
   const filePath = join(ensureStateDir(), SYNC_CACHE_FILE);
   return readJsonFile(filePath);
 }
+function clearSyncCache() {
+  const filePath = join(ensureStateDir(), SYNC_CACHE_FILE);
+  if (existsSync2(filePath)) {
+    rmSync(filePath);
+  }
+}
 function isSyncCacheFresh(maxAgeMs = 3e5) {
   const cache = loadSyncCache();
   if (!cache) return false;
@@ -631,7 +740,20 @@ function isSyncCacheFresh(maxAgeMs = 3e5) {
 }
 
 // src/ws.ts
-import WebSocket from "ws";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var WebSocket = require2("ws");
+var SUB_CHAT_EVENT_TYPES = /* @__PURE__ */ new Set([
+  "spawn_sub_chats",
+  "sub_chat_progress",
+  "sub_chat_confirmation_required",
+  "sub_chat_confirmation_resolved",
+  "awaiting_sub_chats_completion",
+  "sub_chat_completed",
+  "awaiting_user_input"
+]);
+var SUB_CHAT_PARENT_STATUS_MESSAGE = "I've started the sub-chats and will continue once they finish.";
+var SUB_CHAT_COMPLETION_TIMEOUT_MS = 10 * 6e4;
 var OpenMatesWsClient = class {
   socket;
   constructor(options) {
@@ -691,6 +813,14 @@ var OpenMatesWsClient = class {
   send(type, payload) {
     this.socket.send(JSON.stringify({ type, payload }));
   }
+  sendAsync(type, payload) {
+    return new Promise((resolve4, reject) => {
+      this.socket.send(JSON.stringify({ type, payload }), (error) => {
+        if (error) reject(error);
+        else resolve4();
+      });
+    });
+  }
   waitForMessage(expectedType, predicate, timeoutMs = 2e4) {
     return new Promise((resolve4, reject) => {
       const onMessage = (rawData) => {
@@ -793,35 +923,119 @@ var OpenMatesWsClient = class {
   collectAiResponse(userMessageId, chatId, options) {
     const timeoutMs = options?.timeoutMs ?? 9e4;
     const onStream = options?.onStream;
+    const asyncEmbedWaitMs = options?.asyncEmbedWaitMs ?? 12e4;
     return new Promise((resolve4, reject) => {
       let latestContent = "";
+      let messageId = null;
+      let taskId = null;
       let category = null;
       let modelName = null;
       let followUpSuggestions = [];
+      const subChatEvents = [];
+      const pendingSubChatHandlers = /* @__PURE__ */ new Set();
+      const embeds = /* @__PURE__ */ new Map();
+      const processingEmbedIds = /* @__PURE__ */ new Set();
       let aiResponseDone = false;
+      let postProcessingDone = false;
       const POST_PROCESSING_WINDOW_MS = 12e3;
       let postProcessingTimer = null;
-      const timeout = setTimeout(() => {
+      let asyncEmbedTimer = null;
+      const startTimeout = (ms) => setTimeout(() => {
         cleanup();
         reject(new Error("Timed out waiting for AI response"));
-      }, timeoutMs);
+      }, ms);
+      let timeout = startTimeout(timeoutMs);
+      let awaitingSubChatsCompletion = false;
+      const resetTimeout = (ms) => {
+        clearTimeout(timeout);
+        timeout = startTimeout(ms);
+      };
       const capture = (p) => {
+        if (typeof p.message_id === "string" && p.message_id)
+          messageId = p.message_id;
+        if (typeof p.task_id === "string" && p.task_id) taskId = p.task_id;
         if (typeof p.category === "string" && p.category) category = p.category;
         if (typeof p.model_name === "string" && p.model_name)
           modelName = p.model_name;
       };
+      const extractMessageContent = (message) => {
+        if (typeof message.content === "string") return message.content;
+        const content = message.content;
+        if (!content || typeof content !== "object") return "";
+        try {
+          const root = content;
+          const text = root.content?.[0]?.content?.[0]?.text;
+          return typeof text === "string" ? text : "";
+        } catch {
+          return "";
+        }
+      };
+      const finishPostProcessingWait = () => {
+        postProcessingDone = true;
+        maybeResolve();
+      };
+      const maybeResolve = () => {
+        if (!aiResponseDone || !postProcessingDone) return;
+        if (pendingSubChatHandlers.size > 0) return;
+        if (processingEmbedIds.size > 0 && !asyncEmbedTimer) {
+          asyncEmbedTimer = setTimeout(() => {
+            cleanup();
+            resolve4({
+              messageId,
+              taskId,
+              content: latestContent,
+              category,
+              modelName,
+              followUpSuggestions,
+              embeds: [...embeds.values()],
+              subChatEvents
+            });
+          }, asyncEmbedWaitMs);
+          return;
+        }
+        if (processingEmbedIds.size > 0) return;
+        cleanup();
+        resolve4({
+          messageId,
+          taskId,
+          content: latestContent,
+          category,
+          modelName,
+          followUpSuggestions,
+          embeds: [...embeds.values()],
+          subChatEvents
+        });
+      };
+      const handleSubChatEvent = (type, p) => {
+        const eventChatId = typeof p.chat_id === "string" ? p.chat_id : typeof p.parent_id === "string" ? p.parent_id : null;
+        if (eventChatId && eventChatId !== chatId) return;
+        const event = { type, payload: p };
+        subChatEvents.push(event);
+        if (type === "awaiting_sub_chats_completion") {
+          awaitingSubChatsCompletion = true;
+          resetTimeout(SUB_CHAT_COMPLETION_TIMEOUT_MS);
+        }
+        const handler = options?.onSubChatEvent;
+        if (!handler) return;
+        const pending = Promise.resolve(handler(event));
+        pendingSubChatHandlers.add(pending);
+        pending.catch((error) => {
+          cleanup();
+          reject(error instanceof Error ? error : new Error(String(error)));
+        }).finally(() => {
+          pendingSubChatHandlers.delete(pending);
+          maybeResolve();
+        });
+      };
       const scheduleResolve = (content) => {
+        if (awaitingSubChatsCompletion && content.trim() === SUB_CHAT_PARENT_STATUS_MESSAGE) {
+          latestContent = "";
+          return;
+        }
         aiResponseDone = true;
         latestContent = content;
-        postProcessingTimer = setTimeout(() => {
-          cleanup();
-          resolve4({
-            content: latestContent,
-            category,
-            modelName,
-            followUpSuggestions
-          });
-        }, POST_PROCESSING_WINDOW_MS);
+        clearTimeout(timeout);
+        postProcessingTimer = setTimeout(finishPostProcessingWait, POST_PROCESSING_WINDOW_MS);
       };
       const onMessage = (rawData) => {
         try {
@@ -837,9 +1051,31 @@ var OpenMatesWsClient = class {
             );
             return;
           }
+          if (SUB_CHAT_EVENT_TYPES.has(type)) {
+            handleSubChatEvent(type, p);
+            return;
+          }
+          if (type === "send_embed_data") {
+            const embedPayload = p.payload && typeof p.payload === "object" ? p.payload : p;
+            if (typeof embedPayload.chat_id === "string" && embedPayload.chat_id !== chatId) {
+              return;
+            }
+            const embedId = embedPayload.embed_id;
+            if (typeof embedId === "string" && embedId) {
+              const status = typeof embedPayload.status === "string" ? embedPayload.status : "finished";
+              embeds.set(embedId, embedPayload);
+              if (status === "processing") {
+                processingEmbedIds.add(embedId);
+              } else {
+                processingEmbedIds.delete(embedId);
+              }
+              maybeResolve();
+            }
+            return;
+          }
           if (type === "ai_message_update") {
             const msgId = p.user_message_id ?? p.userMessageId;
-            if (msgId !== userMessageId) return;
+            if (msgId !== userMessageId && p.chat_id !== chatId) return;
             capture(p);
             if (typeof p.full_content_so_far === "string") {
               latestContent = p.full_content_so_far;
@@ -864,7 +1100,7 @@ var OpenMatesWsClient = class {
           }
           if (type === "ai_background_response_completed") {
             const msgId = p.user_message_id ?? p.userMessageId;
-            if (msgId && msgId !== userMessageId) return;
+            if (msgId && msgId !== userMessageId && p.chat_id !== chatId) return;
             if (!msgId && p.chat_id !== chatId) return;
             capture(p);
             const content = typeof p.full_content === "string" ? p.full_content : latestContent;
@@ -872,6 +1108,25 @@ var OpenMatesWsClient = class {
             scheduleResolve(content);
             return;
           }
+          if (type === "chat_message_added") {
+            if (p.chat_id !== chatId) return;
+            const rawMessage = p.message;
+            if (!rawMessage || typeof rawMessage !== "object") return;
+            const message = rawMessage;
+            if (message.role !== "assistant") return;
+            const content = extractMessageContent(message);
+            if (!content) return;
+            capture(message);
+            if (typeof message.category === "string" && message.category) {
+              category = message.category;
+            }
+            if (typeof message.model_name === "string" && message.model_name) {
+              modelName = message.model_name;
+            }
+            onStream?.({ kind: "done", content, category, modelName });
+            scheduleResolve(content);
+            return;
+          }
           if (type === "ai_typing_started") {
             capture(p);
             onStream?.({
@@ -895,13 +1150,7 @@ var OpenMatesWsClient = class {
                 clearTimeout(postProcessingTimer);
                 postProcessingTimer = null;
               }
-              cleanup();
-              resolve4({
-                content: latestContent,
-                category,
-                modelName,
-                followUpSuggestions
-              });
+              finishPostProcessingWait();
             }
             return;
           }
@@ -916,10 +1165,14 @@ var OpenMatesWsClient = class {
         if (aiResponseDone) {
           cleanup();
           resolve4({
+            messageId,
+            taskId,
             content: latestContent,
             category,
             modelName,
-            followUpSuggestions
+            followUpSuggestions,
+            embeds: [...embeds.values()],
+            subChatEvents
           });
           return;
         }
@@ -932,6 +1185,10 @@ var OpenMatesWsClient = class {
           clearTimeout(postProcessingTimer);
           postProcessingTimer = null;
         }
+        if (asyncEmbedTimer) {
+          clearTimeout(asyncEmbedTimer);
+          asyncEmbedTimer = null;
+        }
         this.socket.off("message", onMessage);
         this.socket.off("error", onError);
         this.socket.off("close", onClose);
@@ -955,6 +1212,7 @@ var CHAT_MODELS = [
   { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5" },
   { id: "gpt-5.4", name: "GPT-5.4" },
   { id: "gpt-oss-120b", name: "GPT-OSS-120b" },
+  { id: "gpt-oss-20b", name: "GPT-OSS-20b" },
   { id: "gemini-3-flash-preview", name: "Gemini 3 Flash" },
   { id: "gemini-3-pro-image-preview", name: "Gemini 3 Pro" },
   { id: "gemini-3.1-pro-preview", name: "Gemini 3.1 Pro" },
@@ -1242,9 +1500,139 @@ function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// src/embedCreator.ts
+import { randomUUID, createHash as createHash3, randomBytes, webcrypto as webcrypto3 } from "crypto";
+import { encode as toonEncode } from "@toon-format/toon";
+var cryptoApi3 = webcrypto3;
+var AES_GCM_IV_LENGTH3 = 12;
+function bytesToBase642(input) {
+  return Buffer.from(input).toString("base64");
+}
+function toArrayBuffer2(input) {
+  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
+}
+async function encryptAesGcm(plaintext, rawKeyBytes) {
+  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
+  const key = await cryptoApi3.subtle.importKey(
+    "raw",
+    toArrayBuffer2(rawKeyBytes),
+    { name: "AES-GCM" },
+    false,
+    ["encrypt"]
+  );
+  const encrypted = await cryptoApi3.subtle.encrypt(
+    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
+    key,
+    new TextEncoder().encode(plaintext)
+  );
+  const cipherBytes = new Uint8Array(encrypted);
+  const combined = new Uint8Array(iv.length + cipherBytes.length);
+  combined.set(iv);
+  combined.set(cipherBytes, iv.length);
+  return bytesToBase642(combined);
+}
+async function wrapKey(embedKey, wrappingKey) {
+  const cryptoKey = await cryptoApi3.subtle.importKey(
+    "raw",
+    toArrayBuffer2(wrappingKey),
+    { name: "AES-GCM" },
+    false,
+    ["encrypt"]
+  );
+  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
+  const encrypted = await cryptoApi3.subtle.encrypt(
+    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
+    cryptoKey,
+    toArrayBuffer2(embedKey)
+  );
+  const cipherBytes = new Uint8Array(encrypted);
+  const combined = new Uint8Array(iv.length + cipherBytes.length);
+  combined.set(iv);
+  combined.set(cipherBytes, iv.length);
+  return bytesToBase642(combined);
+}
+function generateEmbedKey() {
+  return new Uint8Array(randomBytes(32));
+}
+function computeSHA256(content) {
+  return createHash3("sha256").update(content).digest("hex");
+}
+function toonEncodeContent(data) {
+  try {
+    return toonEncode(data);
+  } catch {
+    return JSON.stringify(data);
+  }
+}
+function generateEmbedId() {
+  return randomUUID();
+}
+function createEmbedReferenceBlock(type, embedId, url) {
+  const data = { type, embed_id: embedId };
+  if (url) data.url = url;
+  const ref = JSON.stringify(data, null, 2);
+  return "```json\n" + ref + "\n```";
+}
+async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId) {
+  try {
+    const embedKey = generateEmbedKey();
+    const encryptedContent = await encryptAesGcm(embed.content, embedKey);
+    const encryptedType = await encryptAesGcm(embed.type, embedKey);
+    const encryptedTextPreview = await encryptAesGcm(embed.textPreview, embedKey);
+    const hashedEmbedId = computeSHA256(embed.embedId);
+    const hashedChatId = computeSHA256(chatId);
+    const hashedMessageId = computeSHA256(messageId);
+    const hashedUserId = computeSHA256(userId);
+    const wrappedWithMaster = await wrapKey(embedKey, masterKey);
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const embedKeys = [
+      {
+        hashed_embed_id: hashedEmbedId,
+        key_type: "master",
+        hashed_chat_id: null,
+        encrypted_embed_key: wrappedWithMaster,
+        hashed_user_id: hashedUserId,
+        created_at: nowSeconds
+      }
+    ];
+    if (chatKey) {
+      const wrappedWithChat = await wrapKey(embedKey, chatKey);
+      embedKeys.push({
+        hashed_embed_id: hashedEmbedId,
+        key_type: "chat",
+        hashed_chat_id: hashedChatId,
+        encrypted_embed_key: wrappedWithChat,
+        hashed_user_id: hashedUserId,
+        created_at: nowSeconds
+      });
+    }
+    return {
+      embed_id: embed.embedId,
+      encrypted_type: encryptedType,
+      encrypted_content: encryptedContent,
+      encrypted_text_preview: encryptedTextPreview,
+      status: embed.status,
+      hashed_chat_id: hashedChatId,
+      hashed_message_id: hashedMessageId,
+      hashed_user_id: hashedUserId,
+      file_path: embed.filePath,
+      content_hash: embed.contentHash,
+      text_length_chars: embed.textLengthChars,
+      created_at: nowSeconds,
+      updated_at: nowSeconds,
+      embed_keys: embedKeys
+    };
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`\x1B[31mError:\x1B[0m Failed to encrypt embed: ${msg}
+`);
+    return null;
+  }
+}
+
 // src/shareEncryption.ts
-import { webcrypto as webcrypto3 } from "crypto";
-var crypto = webcrypto3;
+import { webcrypto as webcrypto4 } from "crypto";
+var crypto = webcrypto4;
 function base64UrlEncode(data) {
   return Buffer.from(data).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -1356,6 +1744,48 @@ function buildEmbedShareUrl(origin, embedId, blob) {
 }
 
 // src/client.ts
+function normalizeUnixSeconds(value, fallback) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    return fallback;
+  }
+  return value > 1e10 ? Math.floor(value / 1e3) : Math.floor(value);
+}
+function buildSubChatConfirmationPayload(params) {
+  return {
+    chat_id: params.chatId,
+    task_id: params.taskId,
+    action: params.approved ? "approve" : "cancel",
+    approve_count: params.approved ? params.approveCount ?? null : null
+  };
+}
+async function buildSubChatEncryptedMetadataPayloads(params) {
+  const createdAt = params.createdAt ?? Math.floor(Date.now() / 1e3);
+  const payloads = [];
+  for (const subChat of params.subChats) {
+    const chatId = subChat.id || subChat.chat_id;
+    const messageId = subChat.user_message_id || subChat.message_id;
+    const prompt = subChat.prompt || "";
+    if (!chatId || !messageId) continue;
+    const title = prompt.substring(0, 30);
+    payloads.push({
+      chat_id: chatId,
+      parent_id: params.parentChatId,
+      is_sub_chat: true,
+      message_id: messageId,
+      encrypted_content: await encryptWithAesGcmCombined(prompt, params.parentChatKey),
+      encrypted_sender_name: await encryptWithAesGcmCombined("User", params.parentChatKey),
+      encrypted_title: await encryptWithAesGcmCombined(title, params.parentChatKey),
+      created_at: createdAt,
+      encrypted_chat_key: params.encryptedParentChatKey,
+      versions: {
+        messages_v: 1,
+        title_v: 0,
+        last_edited_overall_timestamp: createdAt
+      }
+    });
+  }
+  return payloads;
+}
 var MEMORY_TYPE_REGISTRY = {
   "ai/communication_style": {
     appId: "ai",
@@ -1717,15 +2147,19 @@ var BLOCKED_SETTINGS_MUTATE_PATHS = /* @__PURE__ */ new Set([
   "/v1/auth/setup_password",
   "/v1/auth/2fa/setup/initiate",
   "/v1/auth/2fa/setup/provider",
-  "/v1/auth/2fa/setup/verify-signup"
+  "/v1/auth/2fa/setup/verify-signup",
+  "/v1/settings/delete-account",
+  "/v1/settings/request-action-verification",
+  "/v1/settings/verify-action-code",
+  "/v1/settings/user/disable-2fa"
 ]);
 var OpenMatesClient = class _OpenMatesClient {
   apiUrl;
   session;
   http;
   constructor(options = {}) {
-    this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
     const diskSession = options.session ?? this.getValidSessionFromDisk();
+    this.apiUrl = (options.apiUrl ?? process.env.OPENMATES_API_URL ?? diskSession?.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
     this.session = diskSession;
     this.http = new OpenMatesHttpClient({
       apiUrl: this.apiUrl,
@@ -1785,7 +2219,7 @@ var OpenMatesClient = class _OpenMatesClient {
       pin: pin.trim().toUpperCase(),
       token
     });
-    const sessionId = randomUUID();
+    const sessionId = randomUUID2();
     const login = await this.http.post(
       "/v1/auth/login",
       {
@@ -1814,6 +2248,7 @@ var OpenMatesClient = class _OpenMatesClient {
       authorizerDeviceName: complete.data.authorizer_device_name ?? null,
       autoLogoutMinutes: complete.data.auto_logout_minutes ?? null
     };
+    await this.hydrateEmailEncryptionKey(session);
     saveSession(session);
   }
   async whoAmI() {
@@ -1826,6 +2261,11 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!response.ok || !response.data.success) {
       throw new Error("Session is invalid. Please run `openmates login`.");
     }
+    if (response.data.ws_token) {
+      session.wsToken = response.data.ws_token;
+    }
+    session.cookies = this.http.getCookieMap();
+    saveSession(session);
     return response.data.user ?? {};
   }
   async logout() {
@@ -1833,7 +2273,6 @@ var OpenMatesClient = class _OpenMatesClient {
       await this.http.post("/v1/auth/logout", {}, this.getCliRequestHeaders()).catch(() => void 0);
     }
     clearSession();
-    clearIncognitoHistory();
   }
   // -------------------------------------------------------------------------
   // Chats
@@ -2280,7 +2719,7 @@ var OpenMatesClient = class _OpenMatesClient {
   async sendMessage(params) {
     let chatId;
     if (!params.chatId) {
-      chatId = randomUUID();
+      chatId = randomUUID2();
     } else if (params.chatId.length < 36) {
       const resolved = await this.resolveFullChatId(params.chatId);
       if (!resolved) {
@@ -2293,7 +2732,7 @@ var OpenMatesClient = class _OpenMatesClient {
       chatId = params.chatId;
     }
     const { ws, session } = await this.openWsClient();
-    const messageId = randomUUID();
+    const messageId = randomUUID2();
     const createdAt = Math.floor(Date.now() / 1e3);
     const isNewChat = !params.chatId;
     ws.send("set_active_chat", { chat_id: chatId });
@@ -2313,6 +2752,7 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     let chatKeyBytes = null;
     let encryptedChatKey = null;
+    let baselineMessagesV = 0;
     if (!params.incognito) {
       const masterKey = this.getMasterKeyBytes();
       if (isNewChat) {
@@ -2332,6 +2772,7 @@ var OpenMatesClient = class _OpenMatesClient {
           (c) => String(c.details.id ?? "") === chatId || String(c.details.id ?? "").startsWith(chatId)
         );
         if (chat) {
+          baselineMessagesV = typeof chat.details.messages_v === "number" ? chat.details.messages_v : 0;
           const encKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
           if (encKey) {
             chatKeyBytes = await decryptBytesWithAesGcm(encKey, masterKey);
@@ -2340,8 +2781,32 @@ var OpenMatesClient = class _OpenMatesClient {
         }
       }
     }
-    if (params.encryptedEmbeds && params.encryptedEmbeds.length > 0) {
-      messagePayload.encrypted_embeds = params.encryptedEmbeds;
+    if (params.preparedEmbeds && params.preparedEmbeds.length > 0) {
+      messagePayload.embeds = params.preparedEmbeds.map((embed) => ({
+        embed_id: embed.embedId,
+        type: embed.type,
+        content: embed.content,
+        status: embed.status,
+        text_preview: embed.textPreview
+      }));
+    }
+    const encryptedEmbeds = [...params.encryptedEmbeds ?? []];
+    if (!params.incognito && params.preparedEmbeds && params.preparedEmbeds.length > 0) {
+      const masterKey = this.getMasterKeyBytes();
+      for (const embed of params.preparedEmbeds) {
+        const encrypted = await encryptEmbed(
+          embed,
+          masterKey,
+          chatKeyBytes,
+          chatId,
+          messageId,
+          session.hashedEmail
+        );
+        if (encrypted) encryptedEmbeds.push(encrypted);
+      }
+    }
+    if (encryptedEmbeds.length > 0) {
+      messagePayload.encrypted_embeds = encryptedEmbeds;
     }
     ws.send("chat_message_added", messagePayload);
     if (!params.incognito && chatKeyBytes) {
@@ -2369,38 +2834,139 @@ var OpenMatesClient = class _OpenMatesClient {
       ws.send("encrypted_chat_metadata", metadataPayload);
     }
     let assistant = "";
+    let assistantMessageId = null;
     let category = null;
     let modelName = null;
     let followUpSuggestions = [];
-    const streamOpts = { onStream: params.onStream };
-    if (params.incognito) {
-      const history = loadIncognitoHistory();
-      history.push({
-        role: "user",
-        content: params.message,
-        createdAt: Date.now()
-      });
-      try {
-        const resp = await ws.collectAiResponse(messageId, chatId, streamOpts);
-        assistant = resp.content;
-        category = resp.category;
-        modelName = resp.modelName;
-      } finally {
-        ws.close();
+    let subChatEvents = [];
+    const numberOrNull = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+    const isApprovalWithinServerLimits = (request) => {
+      const count = request.subChats.length;
+      if (count === 0) return false;
+      if (request.remainingSubChats !== null && count > request.remainingSubChats) {
+        return false;
+      }
+      if (request.maxDirectSubChats !== null && request.existingSubChats !== null && request.existingSubChats + count > request.maxDirectSubChats) {
+        return false;
+      }
+      return true;
+    };
+    const isAutoApprovalWithinServerLimits = (request) => {
+      if (!isApprovalWithinServerLimits(request)) return false;
+      return request.maxAutoSubChats === null || request.subChats.length <= request.maxAutoSubChats;
+    };
+    const handleSubChatEvent = async (event) => {
+      params.onSubChatEvent?.(event);
+      if (event.type === "spawn_sub_chats") {
+        if (params.incognito || !chatKeyBytes) return;
+        const rawSubChats = event.payload.sub_chats;
+        if (!Array.isArray(rawSubChats)) return;
+        const metadataPayloads = await buildSubChatEncryptedMetadataPayloads({
+          parentChatId: chatId,
+          parentChatKey: chatKeyBytes,
+          encryptedParentChatKey: encryptedChatKey,
+          subChats: rawSubChats
+        });
+        for (const metadataPayload of metadataPayloads) {
+          await ws.sendAsync("encrypted_chat_metadata", metadataPayload);
+        }
+        return;
+      }
+      if (event.type !== "sub_chat_confirmation_required") return;
+      const payload = event.payload;
+      const confirmationChatId = typeof payload.chat_id === "string" ? payload.chat_id : chatId;
+      const taskId = typeof payload.task_id === "string" ? payload.task_id : null;
+      const subChats = Array.isArray(payload.sub_chats) ? payload.sub_chats : [];
+      if (!taskId) return;
+      const request = {
+        chatId: confirmationChatId,
+        taskId,
+        subChats,
+        maxAutoSubChats: numberOrNull(payload.max_auto_sub_chats),
+        maxDirectSubChats: numberOrNull(payload.max_direct_sub_chats),
+        existingSubChats: numberOrNull(payload.existing_sub_chats),
+        remainingSubChats: numberOrNull(payload.remaining_sub_chats)
+      };
+      const withinLimits = isApprovalWithinServerLimits(request);
+      const approved = params.autoApproveSubChats ? isAutoApprovalWithinServerLimits(request) : withinLimits && params.onSubChatApprovalRequest ? await params.onSubChatApprovalRequest(request) : false;
+      await ws.sendAsync(
+        "sub_chat_confirmation",
+        buildSubChatConfirmationPayload({
+          chatId: request.chatId,
+          taskId: request.taskId,
+          approved,
+          approveCount: approved ? request.subChats.length : void 0
+        })
+      );
+    };
+    const streamOpts = {
+      onStream: params.onStream,
+      onSubChatEvent: handleSubChatEvent
+    };
+    if (params.incognito) {
+      try {
+        const resp = await ws.collectAiResponse(messageId, chatId, streamOpts);
+        assistantMessageId = resp.messageId;
+        assistant = resp.content;
+        category = resp.category;
+        modelName = resp.modelName;
+        subChatEvents = resp.subChatEvents;
+      } finally {
+        ws.close();
       }
-      history.push({
-        role: "assistant",
-        content: assistant,
-        createdAt: Date.now()
-      });
-      saveIncognitoHistory(history);
     } else {
       try {
         const resp = await ws.collectAiResponse(messageId, chatId, streamOpts);
+        assistantMessageId = resp.messageId;
         assistant = resp.content;
         category = resp.category;
         modelName = resp.modelName;
         followUpSuggestions = resp.followUpSuggestions;
+        subChatEvents = resp.subChatEvents;
+        if (chatKeyBytes && assistant) {
+          const completedAt = Math.floor(Date.now() / 1e3);
+          const encryptedAssistantContent = await encryptWithAesGcmCombined(
+            assistant,
+            chatKeyBytes
+          );
+          const encryptedCategory = category ? await encryptWithAesGcmCombined(category, chatKeyBytes) : void 0;
+          const encryptedModelName = modelName ? await encryptWithAesGcmCombined(modelName, chatKeyBytes) : void 0;
+          const persistedAssistantMessageId = assistantMessageId ?? randomUUID2();
+          ws.send("ai_response_completed", {
+            chat_id: chatId,
+            message: {
+              message_id: persistedAssistantMessageId,
+              chat_id: chatId,
+              role: "assistant",
+              created_at: completedAt,
+              status: "synced",
+              user_message_id: messageId,
+              encrypted_content: encryptedAssistantContent,
+              encrypted_category: encryptedCategory,
+              encrypted_model_name: encryptedModelName
+            },
+            versions: {
+              messages_v: baselineMessagesV + 2,
+              last_edited_overall_timestamp: completedAt
+            }
+          });
+          await ws.waitForMessage(
+            "ai_response_storage_confirmed",
+            (payload) => {
+              const p = payload;
+              return p.message_id === persistedAssistantMessageId;
+            },
+            2e4
+          );
+          await this.persistStreamedEmbeds({
+            ws,
+            embeds: resp.embeds,
+            chatId,
+            chatKeyBytes,
+            fallbackMessageId: persistedAssistantMessageId
+          });
+          clearSyncCache();
+        }
       } finally {
         ws.close();
       }
@@ -2412,14 +2978,113 @@ var OpenMatesClient = class _OpenMatesClient {
       category,
       modelName,
       mateName,
-      followUpSuggestions
+      followUpSuggestions,
+      subChatEvents
     };
   }
-  getIncognitoHistory() {
-    return loadIncognitoHistory();
-  }
-  clearIncognitoHistory() {
-    clearIncognitoHistory();
+  async persistStreamedEmbeds(params) {
+    const finalized = new Map(
+      params.embeds.filter((embed) => {
+        const status = embed.status ?? "finished";
+        return embed.embed_id && embed.content && status !== "processing" && status !== "error" && status !== "cancelled";
+      }).map((embed) => [embed.embed_id, embed])
+    );
+    if (finalized.size === 0) return;
+    const session = this.requireSession();
+    const masterKey = this.getMasterKeyBytes();
+    const parentKeys = /* @__PURE__ */ new Map();
+    const processed = /* @__PURE__ */ new Set();
+    const makeKey = () => {
+      const key = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(key);
+      return key;
+    };
+    const persistOne = async (embed, embedKey, isChild) => {
+      const now = Math.floor(Date.now() / 1e3);
+      const createdAt = normalizeUnixSeconds(embed.createdAt, now);
+      const updatedAt = normalizeUnixSeconds(embed.updatedAt, now);
+      const messageId = embed.message_id || params.fallbackMessageId;
+      const userId = embed.user_id || session.hashedEmail;
+      const hashedChatId = computeSHA256(params.chatId);
+      const hashedMessageId = computeSHA256(messageId);
+      const hashedUserId = computeSHA256(userId);
+      const hashedEmbedId = computeSHA256(embed.embed_id);
+      const encryptedContent = await encryptWithAesGcmCombined(
+        embed.content ?? "",
+        embedKey
+      );
+      const encryptedType = await encryptWithAesGcmCombined(
+        embed.type || "app_skill_use",
+        embedKey
+      );
+      const encryptedTextPreview = embed.text_preview ? await encryptWithAesGcmCombined(embed.text_preview, embedKey) : void 0;
+      await params.ws.sendAsync("store_embed", {
+        embed_id: embed.embed_id,
+        encrypted_type: encryptedType,
+        encrypted_content: encryptedContent,
+        encrypted_text_preview: encryptedTextPreview,
+        status: embed.status || "finished",
+        hashed_chat_id: hashedChatId,
+        hashed_message_id: hashedMessageId,
+        hashed_task_id: embed.task_id ? computeSHA256(embed.task_id) : void 0,
+        hashed_user_id: hashedUserId,
+        embed_ids: embed.embed_ids,
+        parent_embed_id: embed.parent_embed_id || void 0,
+        version_number: embed.version_number,
+        file_path: embed.file_path,
+        content_hash: embed.content_hash,
+        text_length_chars: embed.text_length_chars,
+        is_private: embed.is_private ?? false,
+        is_shared: embed.is_shared ?? false,
+        created_at: createdAt,
+        updated_at: updatedAt
+      });
+      if (!isChild) {
+        const keys = [
+          {
+            hashed_embed_id: hashedEmbedId,
+            key_type: "master",
+            hashed_chat_id: null,
+            encrypted_embed_key: await encryptBytesWithAesGcm(embedKey, masterKey),
+            hashed_user_id: hashedUserId,
+            created_at: now
+          },
+          {
+            hashed_embed_id: hashedEmbedId,
+            key_type: "chat",
+            hashed_chat_id: hashedChatId,
+            encrypted_embed_key: await encryptBytesWithAesGcm(
+              embedKey,
+              params.chatKeyBytes
+            ),
+            hashed_user_id: hashedUserId,
+            created_at: now
+          }
+        ];
+        await params.ws.sendAsync("store_embed_keys", { keys });
+        parentKeys.set(embed.embed_id, embedKey);
+      }
+    };
+    let madeProgress = true;
+    while (processed.size < finalized.size && madeProgress) {
+      madeProgress = false;
+      for (const embed of finalized.values()) {
+        if (processed.has(embed.embed_id)) continue;
+        const parentId = embed.parent_embed_id || null;
+        if (parentId && finalized.has(parentId) && !parentKeys.has(parentId)) {
+          continue;
+        }
+        const parentKey = parentId ? parentKeys.get(parentId) : void 0;
+        await persistOne(embed, parentKey ?? makeKey(), Boolean(parentKey));
+        processed.add(embed.embed_id);
+        madeProgress = true;
+      }
+    }
+    for (const embed of finalized.values()) {
+      if (processed.has(embed.embed_id)) continue;
+      await persistOne(embed, makeKey(), false);
+      processed.add(embed.embed_id);
+    }
   }
   /**
    * Delete a chat by ID.
@@ -2733,7 +3398,7 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data;
   }
-  async settingsDelete(path) {
+  async settingsDelete(path, body) {
     this.requireSession();
     const normalizedPath = this.normalizePath(path);
     if (BLOCKED_SETTINGS_MUTATE_PATHS.has(normalizedPath)) {
@@ -2741,6 +3406,7 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     const response = await this.http.delete(
       normalizedPath,
+      body,
       this.getCliRequestHeaders()
     );
     if (!response.ok) {
@@ -2792,6 +3458,149 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data;
   }
+  async listInvoices() {
+    this.requireSession();
+    const response = await this.http.get(
+      "/v1/payments/invoices",
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to fetch invoices (HTTP ${response.status})`);
+    }
+    return { invoices: response.data.invoices ?? [] };
+  }
+  async downloadInvoice(invoiceId) {
+    return this.downloadPaymentPdf(
+      `/v1/payments/invoices/${encodeURIComponent(invoiceId)}/download`,
+      `Invoice_${invoiceId}.pdf`
+    );
+  }
+  async downloadCreditNote(invoiceId) {
+    return this.downloadPaymentPdf(
+      `/v1/payments/invoices/${encodeURIComponent(invoiceId)}/credit-note/download`,
+      `CreditNote_${invoiceId}.pdf`
+    );
+  }
+  async requestRefund(invoiceId) {
+    const session = this.requireSession();
+    const emailEncryptionKey = await this.ensureEmailEncryptionKey(session);
+    const response = await this.http.post(
+      "/v1/payments/refund",
+      { invoice_id: invoiceId, email_encryption_key: emailEncryptionKey },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Refund request failed (HTTP ${response.status})`);
+    }
+    return response.data;
+  }
+  async updateUsername(username) {
+    return this.settingsPost("user/username", { username });
+  }
+  async updateProfileImage(filePath) {
+    const { uploadProfileImage } = await import("./uploadService-S464XJRA.js");
+    const result = await uploadProfileImage(filePath, this.requireSession());
+    if (result.status === "rejected") {
+      throw new Error(result.detail ?? "Profile image rejected by content safety checks.");
+    }
+    if (result.status === "account_deleted") {
+      throw new Error("Account deleted due to repeated profile image policy violations.");
+    }
+    if (result.status !== "ok") {
+      throw new Error(result.detail ?? `Profile image upload failed with status '${result.status}'.`);
+    }
+    return result;
+  }
+  async getNewsletterCategories() {
+    this.requireSession();
+    const response = await this.http.get(
+      "/v1/newsletter/categories",
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to fetch newsletter categories (HTTP ${response.status})`);
+    }
+    return response.data;
+  }
+  async updateNewsletterCategories(categories) {
+    this.requireSession();
+    const response = await this.http.patch(
+      "/v1/newsletter/categories",
+      { categories },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to update newsletter categories (HTTP ${response.status})`);
+    }
+    return response.data;
+  }
+  async subscribeNewsletter(email, language = "en", darkmode = false) {
+    const response = await this.http.post(
+      "/v1/newsletter/subscribe",
+      { email, language, darkmode },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Newsletter subscribe failed (HTTP ${response.status})`);
+    }
+    return response.data;
+  }
+  async confirmNewsletter(token) {
+    const response = await this.http.get(
+      `/v1/newsletter/confirm/${encodeURIComponent(token)}`,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Newsletter confirmation failed (HTTP ${response.status})`);
+    }
+    return response.data;
+  }
+  async unsubscribeNewsletter(token) {
+    const response = await this.http.get(
+      `/v1/newsletter/unsubscribe/${encodeURIComponent(token)}`,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Newsletter unsubscribe failed (HTTP ${response.status})`);
+    }
+    return response.data;
+  }
+  async updateEmailNotificationSettings(payload) {
+    const { ws } = await this.openWsClient();
+    try {
+      const ackPromise = ws.waitForMessage("email_notification_settings_ack");
+      ws.send("email_notification_settings", payload);
+      const ack = await ackPromise;
+      return ack.payload;
+    } finally {
+      ws.close();
+    }
+  }
+  async listNotifications(limit = 50) {
+    this.requireSession();
+    const response = await this.http.get(
+      `/v1/notifications?limit=${encodeURIComponent(String(limit))}`,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to fetch notifications (HTTP ${response.status})`);
+    }
+    return response.data;
+  }
+  async *streamNotifications() {
+    this.requireSession();
+    for await (const message of this.http.streamSse(
+      "/v1/notifications/stream",
+      this.getCliRequestHeaders()
+    )) {
+      if (message.event && message.event !== "notification") continue;
+      try {
+        yield JSON.parse(message.data);
+      } catch {
+        yield { event: message.event ?? "message", data: message.data };
+      }
+    }
+  }
   // -------------------------------------------------------------------------
   // Daily Inspirations
   // -------------------------------------------------------------------------
@@ -3051,7 +3860,7 @@ Required: ${schema.required.join(", ")}`
         );
       }
     }
-    const entryId = params.entryId ?? randomUUID();
+    const entryId = params.entryId ?? randomUUID2();
     const now = Math.floor(Date.now() / 1e3);
     const hashedKey = hashItemKey(params.appId, params.itemType);
     const plaintextPayload = {
@@ -3256,6 +4065,45 @@ Required: ${schema.required.join(", ")}`
     if (path.startsWith("/")) return path;
     return `/v1/settings/${path}`;
   }
+  async downloadPaymentPdf(path, fallbackFilename) {
+    this.requireSession();
+    const response = await this.http.getBinary(path, this.getCliRequestHeaders());
+    if (!response.ok) {
+      throw new Error(`Download failed (HTTP ${response.status})`);
+    }
+    return {
+      filename: filenameFromContentDisposition(response.headers.get("content-disposition")) ?? fallbackFilename,
+      data: response.data
+    };
+  }
+  async ensureEmailEncryptionKey(session) {
+    if (session.emailEncryptionKeyB64) return session.emailEncryptionKeyB64;
+    await this.hydrateEmailEncryptionKey(session);
+    if (session.emailEncryptionKeyB64) return session.emailEncryptionKeyB64;
+    throw new Error(
+      "Email encryption key is missing. Run `openmates login` again to refresh your local encryption keys."
+    );
+  }
+  async hydrateEmailEncryptionKey(session) {
+    const response = await this.http.post(
+      "/v1/auth/session",
+      { session_id: session.sessionId },
+      this.getCliRequestHeaders()
+    );
+    const encryptedEmail = response.data.user?.encrypted_email_with_master_key;
+    if (!response.ok || !response.data.success || typeof encryptedEmail !== "string") {
+      return;
+    }
+    const email = await decryptWithAesGcmCombined(
+      encryptedEmail,
+      base64ToBytes(session.masterKeyExportedB64)
+    );
+    if (!email) return;
+    session.emailEncryptionKeyB64 = await deriveEmailEncryptionKeyB64(
+      email,
+      session.userEmailSalt
+    );
+  }
   requireSession() {
     if (!this.session) {
       throw new Error("Not logged in. Run `openmates login`.");
@@ -3284,7 +4132,7 @@ Required: ${schema.required.join(", ")}`
   makeWsClient(session) {
     return new OpenMatesWsClient({
       apiUrl: session.apiUrl,
-      sessionId: randomUUID(),
+      sessionId: randomUUID2(),
       wsToken: session.wsToken,
       refreshToken: session.cookies.auth_refresh_token ?? null,
       // Same User-Agent as login so OS-based device fingerprint hash matches.
@@ -3631,6 +4479,15 @@ function parseNewChatSuggestionText(text) {
   const skillId = raw.slice(dashIdx + 1);
   return { body, appId, skillId };
 }
+function filenameFromContentDisposition(header2) {
+  if (!header2) return null;
+  const encoded = /filename\*=UTF-8''([^;]+)/i.exec(header2)?.[1];
+  if (encoded) return decodeURIComponent(encoded);
+  const quoted = /filename="([^"]+)"/i.exec(header2)?.[1];
+  if (quoted) return quoted;
+  const plain = /filename=([^;]+)/i.exec(header2)?.[1];
+  return plain?.trim() ?? null;
+}
 function sleep(ms) {
   return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
@@ -3646,8 +4503,11 @@ function printLogo() {
   stdout.write(lines.join("\n") + "\n");
 }
 
+// src/cli.ts
+import { createInterface as createInterface3 } from "readline/promises";
+
 // ../secret-scanner/src/registry.ts
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 
 // ../secret-scanner/src/types.ts
 var SECRET_ENV_PATTERNS = [
@@ -3781,8 +4641,8 @@ var SECRET_PATTERNS = [
 ];
 
 // ../secret-scanner/src/registry.ts
-var require2 = createRequire(import.meta.url);
-var AhoCorasick = require2("ahocorasick");
+var require3 = createRequire2(import.meta.url);
+var AhoCorasick = require3("ahocorasick");
 var MIN_SECRET_LENGTH = 8;
 var SecretRegistry = class {
   /** Map from plaintext value → registry entry */
@@ -3920,8 +4780,8 @@ var SecretRegistry = class {
     const sortedResults = [];
     for (const result of results) {
       const endIdx = result[0];
-      const matches = result[1];
-      for (const match of matches) {
+      const matches2 = result[1];
+      for (const match of matches2) {
         sortedResults.push({ endIndex: endIdx, match });
       }
     }
@@ -4324,228 +5184,108 @@ import { readFileSync as readFileSync3, statSync, existsSync as existsSync3 } fr
 import { basename, extname, resolve } from "path";
 import { homedir as homedir3 } from "os";
 import { createHash as createHash4 } from "crypto";
-
-// src/embedCreator.ts
-import { randomUUID as randomUUID2, createHash as createHash3, randomBytes, webcrypto as webcrypto4 } from "crypto";
-import { encode as toonEncode } from "@toon-format/toon";
-var cryptoApi3 = webcrypto4;
-var AES_GCM_IV_LENGTH3 = 12;
-function bytesToBase643(input) {
-  return Buffer.from(input).toString("base64");
-}
-function toArrayBuffer2(input) {
-  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
-}
-async function encryptAesGcm(plaintext, rawKeyBytes) {
-  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
-  const key = await cryptoApi3.subtle.importKey(
-    "raw",
-    toArrayBuffer2(rawKeyBytes),
-    { name: "AES-GCM" },
-    false,
-    ["encrypt"]
-  );
-  const encrypted = await cryptoApi3.subtle.encrypt(
-    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
-    key,
-    new TextEncoder().encode(plaintext)
-  );
-  const cipherBytes = new Uint8Array(encrypted);
-  const combined = new Uint8Array(iv.length + cipherBytes.length);
-  combined.set(iv);
-  combined.set(cipherBytes, iv.length);
-  return bytesToBase643(combined);
-}
-async function wrapKey(embedKey, wrappingKey) {
-  const cryptoKey = await cryptoApi3.subtle.importKey(
-    "raw",
-    toArrayBuffer2(wrappingKey),
-    { name: "AES-GCM" },
-    false,
-    ["encrypt"]
-  );
-  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
-  const encrypted = await cryptoApi3.subtle.encrypt(
-    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
-    cryptoKey,
-    toArrayBuffer2(embedKey)
-  );
-  const cipherBytes = new Uint8Array(encrypted);
-  const combined = new Uint8Array(iv.length + cipherBytes.length);
-  combined.set(iv);
-  combined.set(cipherBytes, iv.length);
-  return bytesToBase643(combined);
-}
-function generateEmbedKey() {
-  return new Uint8Array(randomBytes(32));
-}
-function computeSHA256(content) {
-  return createHash3("sha256").update(content).digest("hex");
-}
-function toonEncodeContent(data) {
-  try {
-    return toonEncode(data);
-  } catch {
-    return JSON.stringify(data);
-  }
-}
-function generateEmbedId() {
-  return randomUUID2();
-}
-function createEmbedReferenceBlock(type, embedId) {
-  const ref = JSON.stringify({ type, embed_id: embedId }, null, 2);
-  return "```json\n" + ref + "\n```";
-}
-async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId) {
-  try {
-    const embedKey = generateEmbedKey();
-    const encryptedContent = await encryptAesGcm(embed.content, embedKey);
-    const encryptedType = await encryptAesGcm(embed.type, embedKey);
-    const encryptedTextPreview = await encryptAesGcm(embed.textPreview, embedKey);
-    const hashedEmbedId = computeSHA256(embed.embedId);
-    const hashedChatId = computeSHA256(chatId);
-    const hashedMessageId = computeSHA256(messageId);
-    const hashedUserId = computeSHA256(userId);
-    const wrappedWithMaster = await wrapKey(embedKey, masterKey);
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const embedKeys = [
-      {
-        hashed_embed_id: hashedEmbedId,
-        key_type: "master",
-        hashed_chat_id: null,
-        encrypted_embed_key: wrappedWithMaster,
-        hashed_user_id: hashedUserId,
-        created_at: nowSeconds
-      }
-    ];
-    if (chatKey) {
-      const wrappedWithChat = await wrapKey(embedKey, chatKey);
-      embedKeys.push({
-        hashed_embed_id: hashedEmbedId,
-        key_type: "chat",
-        hashed_chat_id: hashedChatId,
-        encrypted_embed_key: wrappedWithChat,
-        hashed_user_id: hashedUserId,
-        created_at: nowSeconds
-      });
-    }
-    return {
-      embed_id: embed.embedId,
-      encrypted_type: encryptedType,
-      encrypted_content: encryptedContent,
-      encrypted_text_preview: encryptedTextPreview,
-      status: embed.status,
-      hashed_chat_id: hashedChatId,
-      hashed_message_id: hashedMessageId,
-      hashed_user_id: hashedUserId,
-      file_path: embed.filePath,
-      content_hash: embed.contentHash,
-      text_length_chars: embed.textLengthChars,
-      created_at: nowSeconds,
-      updated_at: nowSeconds,
-      embed_keys: embedKeys
-    };
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`\x1B[31mError:\x1B[0m Failed to encrypt embed: ${msg}
-`);
-    return null;
-  }
-}
-
-// src/fileEmbed.ts
-var MAX_PER_FILE_SIZE = 100 * 1024 * 1024;
-var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".pem",
-  ".key",
-  ".p12",
-  ".pfx",
-  ".keystore",
-  ".kdbx",
-  ".credentials"
-]);
-var BLOCKED_NAMES = /* @__PURE__ */ new Set([
-  "id_rsa",
-  "id_ed25519",
-  "id_dsa",
-  "id_ecdsa",
-  "authorized_keys",
-  "known_hosts",
-  ".git-credentials",
-  ".netrc",
-  ".pgpass",
-  ".my.cnf"
-]);
-var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
-  "py",
-  "js",
-  "ts",
-  "html",
-  "css",
-  "json",
-  "svelte",
-  "java",
-  "cpp",
-  "c",
-  "h",
-  "hpp",
-  "rs",
-  "go",
-  "rb",
-  "php",
-  "swift",
-  "kt",
-  "txt",
-  "md",
-  "xml",
-  "yaml",
-  "yml",
-  "sh",
-  "bash",
-  "sql",
-  "vue",
-  "jsx",
-  "tsx",
-  "scss",
-  "less",
-  "sass",
-  "dockerfile",
-  "toml",
-  "ini",
-  "cfg",
-  "conf",
-  "env",
-  "envrc",
-  "graphql",
-  "gql",
-  "r",
-  "m",
-  "pl",
-  "lua",
-  "ex",
-  "exs",
-  "erl",
-  "hs",
-  "scala",
-  "dart",
-  "tf"
-]);
-var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
-  "jpg",
-  "jpeg",
-  "png",
-  "webp",
-  "gif",
-  "heic",
-  "heif",
-  "bmp",
-  "tiff",
-  "tif",
-  "svg"
-]);
-function isEnvFile(filename) {
-  const lower = filename.toLowerCase();
-  return lower === ".env" || lower.startsWith(".env.") || lower === ".envrc";
+var MAX_PER_FILE_SIZE = 100 * 1024 * 1024;
+var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".keystore",
+  ".kdbx",
+  ".credentials"
+]);
+var BLOCKED_NAMES = /* @__PURE__ */ new Set([
+  "id_rsa",
+  "id_ed25519",
+  "id_dsa",
+  "id_ecdsa",
+  "authorized_keys",
+  "known_hosts",
+  ".git-credentials",
+  ".netrc",
+  ".pgpass",
+  ".my.cnf"
+]);
+var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
+  "py",
+  "js",
+  "ts",
+  "html",
+  "css",
+  "json",
+  "svelte",
+  "java",
+  "cpp",
+  "c",
+  "h",
+  "hpp",
+  "rs",
+  "go",
+  "rb",
+  "php",
+  "swift",
+  "kt",
+  "txt",
+  "md",
+  "xml",
+  "yaml",
+  "yml",
+  "sh",
+  "bash",
+  "sql",
+  "vue",
+  "jsx",
+  "tsx",
+  "scss",
+  "less",
+  "sass",
+  "dockerfile",
+  "toml",
+  "ini",
+  "cfg",
+  "conf",
+  "env",
+  "envrc",
+  "graphql",
+  "gql",
+  "r",
+  "m",
+  "pl",
+  "lua",
+  "ex",
+  "exs",
+  "erl",
+  "hs",
+  "scala",
+  "dart",
+  "tf"
+]);
+var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
+  "jpg",
+  "jpeg",
+  "png",
+  "webp",
+  "gif",
+  "heic",
+  "heif",
+  "bmp",
+  "tiff",
+  "tif",
+  "svg"
+]);
+var AUDIO_EXTENSIONS = /* @__PURE__ */ new Set([
+  "mp3",
+  "m4a",
+  "mp4",
+  "wav",
+  "webm",
+  "ogg",
+  "oga",
+  "aac"
+]);
+function isEnvFile(filename) {
+  const lower = filename.toLowerCase();
+  return lower === ".env" || lower.startsWith(".env.") || lower === ".envrc";
 }
 function getExt(filename) {
   const ext = extname(filename).toLowerCase();
@@ -4563,6 +5303,9 @@ function isImageFile(filename) {
 function isPDFFile(filename) {
   return getExt(filename) === "pdf";
 }
+function isAudioFile(filename) {
+  return AUDIO_EXTENSIONS.has(getExt(filename));
+}
 var LANGUAGE_MAP = {
   ts: "typescript",
   tsx: "typescript",
@@ -4707,10 +5450,14 @@ function processFiles(filePaths, redactor) {
       const result = processPDFFile(resolvedPath, filename);
       if (result) embeds.push(result);
       else errors.push({ path: rawPath, error: "Failed to process PDF" });
+    } else if (isAudioFile(filename)) {
+      const result = processAudioFile(resolvedPath, filename);
+      if (result) embeds.push(result);
+      else errors.push({ path: rawPath, error: "Failed to process audio" });
     } else {
       errors.push({
         path: rawPath,
-        error: `Unsupported file type: .${ext}. Supported: code/text, images, PDFs.`
+        error: `Unsupported file type: .${ext}. Supported: code/text, images, PDFs, audio.`
       });
     }
   }
@@ -4839,87 +5586,107 @@ function processPDFFile(filePath, filename) {
     return null;
   }
 }
+function processAudioFile(filePath, filename) {
+  try {
+    const embedId = generateEmbedId();
+    const embedContent = toonEncodeContent({
+      app_id: "audio",
+      skill_id: "transcribe",
+      type: "audio-recording",
+      status: "uploading",
+      filename
+    });
+    const embed = {
+      embedId,
+      type: "audio-recording",
+      content: embedContent,
+      textPreview: filename,
+      status: "processing"
+    };
+    return {
+      embed,
+      referenceBlock: createEmbedReferenceBlock("audio-recording", embedId),
+      displayName: filename,
+      secretsRedacted: false,
+      zeroKnowledge: false,
+      requiresUpload: true,
+      localPath: filePath
+    };
+  } catch (e) {
+    process.stderr.write(
+      `\x1B[31mError:\x1B[0m Failed to process ${filename}: ${e instanceof Error ? e.message : String(e)}
+`
+    );
+    return null;
+  }
+}
 function formatEmbedsForMessage(embeds) {
   if (embeds.length === 0) return "";
   return "\n" + embeds.map((e) => e.referenceBlock).join("\n");
 }
 
-// src/uploadService.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { basename as basename2 } from "path";
-var UPLOAD_MAX_ATTEMPTS = 3;
-var UPLOAD_RETRY_DELAY_MS = 2e3;
-function getUploadUrl(apiUrl) {
-  try {
-    const url = new URL(apiUrl);
-    if (url.hostname === "localhost") return "http://localhost:8001";
-  } catch {
-  }
-  return "https://upload.openmates.org";
+// src/urlEmbed.ts
+var URL_PATTERN = /\bhttps?:\/\/[^\s<>()`"']+/gi;
+var FENCED_BLOCK_PATTERN = /(```[\s\S]*?```)/g;
+var TRAILING_URL_PUNCTUATION = /[.,!?;:]+$/;
+function trimTrailingUrlPunctuation(rawUrl) {
+  let url = rawUrl;
+  let suffix = "";
+  const punctuation = url.match(TRAILING_URL_PUNCTUATION)?.[0] ?? "";
+  if (punctuation) {
+    url = url.slice(0, -punctuation.length);
+    suffix = punctuation + suffix;
+  }
+  while (url.endsWith(")")) {
+    const openCount = (url.match(/\(/g) ?? []).length;
+    const closeCount = (url.match(/\)/g) ?? []).length;
+    if (closeCount <= openCount) break;
+    url = url.slice(0, -1);
+    suffix = `)${suffix}`;
+  }
+  return { url, suffix };
+}
+function createWebsiteEmbed(url) {
+  const embedId = generateEmbedId();
+  const content = toonEncodeContent({
+    url,
+    title: null,
+    description: null,
+    favicon: null,
+    image: null,
+    site_name: null,
+    fetched_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return {
+    embedId,
+    type: "web-website",
+    content,
+    textPreview: url,
+    status: "finished"
+  };
 }
-async function uploadFile(filePath, session) {
-  const filename = basename2(filePath);
-  const fileBytes = readFileSync4(filePath);
-  const uploadUrl = `${getUploadUrl(session.apiUrl)}/v1/upload/file`;
-  const cookies = [];
-  if (session.cookies?.auth_refresh_token) {
-    cookies.push(`auth_refresh_token=${session.cookies.auth_refresh_token}`);
-  }
-  let response;
-  let lastError;
-  for (let attempt = 1; attempt <= UPLOAD_MAX_ATTEMPTS; attempt++) {
+function replaceUrlsInText(text, embeds) {
+  return text.replace(URL_PATTERN, (rawUrl) => {
+    const { url, suffix } = trimTrailingUrlPunctuation(rawUrl);
+    if (!url) return rawUrl;
     try {
-      const blob = new Blob([fileBytes]);
-      const formData = new FormData();
-      formData.append("file", blob, filename);
-      response = await fetch(uploadUrl, {
-        method: "POST",
-        body: formData,
-        headers: {
-          ...cookies.length > 0 ? { Cookie: cookies.join("; ") } : {}
-        },
-        signal: AbortSignal.timeout(10 * 60 * 1e3)
-        // 10-minute timeout
-      });
-      break;
-    } catch (error) {
-      lastError = error;
-      if (attempt === UPLOAD_MAX_ATTEMPTS) break;
-      await new Promise((resolve4) => setTimeout(resolve4, UPLOAD_RETRY_DELAY_MS));
+      new URL(url);
+    } catch {
+      return rawUrl;
     }
-  }
-  if (!response) {
-    const message = lastError instanceof Error ? lastError.message : String(lastError);
-    throw new Error(message || "Upload request failed.");
-  }
-  if (!response.ok) {
-    const status = response.status;
-    let errorMessage;
-    switch (status) {
-      case 401:
-        errorMessage = "Authentication failed. Run `openmates login` to re-authenticate.";
-        break;
-      case 413:
-        errorMessage = "File too large (maximum 100 MB).";
-        break;
-      case 415:
-        errorMessage = "Unsupported file type.";
-        break;
-      case 422: {
-        const body = await response.text().catch(() => "");
-        errorMessage = body.includes("malware") ? "File rejected: malware detected." : body.includes("content_safety") ? "File rejected: content safety violation." : `Upload validation failed: ${body}`;
-        break;
-      }
-      case 429:
-        errorMessage = "Upload rate limit exceeded. Try again in a minute.";
-        break;
-      default:
-        errorMessage = `Upload failed (HTTP ${status}).`;
-    }
-    throw new Error(errorMessage);
-  }
-  const data = await response.json();
-  return data;
+    const embed = createWebsiteEmbed(url);
+    embeds.push(embed);
+    return `${createEmbedReferenceBlock("website", embed.embedId, url)}${suffix}`;
+  });
+}
+function prepareUrlEmbeds(message) {
+  const embeds = [];
+  const parts = message.split(FENCED_BLOCK_PATTERN);
+  const processed = parts.map((part, index) => {
+    const isFence = index % 2 === 1 && part.startsWith("```");
+    return isFence ? part : replaceUrlsInText(part, embeds);
+  }).join("");
+  return { message: processed, embeds };
 }
 
 // src/embedRenderers.ts
@@ -5971,13 +6738,14 @@ function formatTs(ts) {
 
 // src/server.ts
 import { execSync, spawn as nodeSpawn } from "child_process";
-import { copyFileSync, existsSync as existsSync5, readFileSync as readFileSync6, rmSync as rmSync3 } from "fs";
+import { randomBytes as randomBytes2 } from "crypto";
+import { copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
 import { createInterface as createInterface2 } from "readline";
 import { homedir as homedir5 } from "os";
 import { join as join3, resolve as resolve3 } from "path";
 
 // src/serverConfig.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join2, resolve as resolve2 } from "path";
 var STATE_DIR = join2(homedir4(), ".openmates");
@@ -5998,7 +6766,7 @@ function loadServerConfig() {
   const filePath = join2(STATE_DIR, CONFIG_FILE);
   if (!existsSync4(filePath)) return null;
   try {
-    return JSON.parse(readFileSync5(filePath, "utf-8"));
+    return JSON.parse(readFileSync4(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -6009,16 +6777,17 @@ function removeServerConfig() {
     rmSync2(filePath);
   }
 }
-var COMPOSE_MARKER = join2("backend", "core", "docker-compose.yml");
+var SOURCE_COMPOSE_MARKER = join2("backend", "core", "docker-compose.yml");
+var IMAGE_COMPOSE_MARKER = join2("backend", "core", "docker-compose.selfhost.yml");
 function isOpenMatesDir(dir) {
-  return existsSync4(join2(dir, COMPOSE_MARKER));
+  return existsSync4(join2(dir, SOURCE_COMPOSE_MARKER)) || existsSync4(join2(dir, IMAGE_COMPOSE_MARKER));
 }
 function resolveServerPath(flags) {
   if (typeof flags.path === "string" && flags.path) {
     const explicit = resolve2(flags.path);
     if (!isOpenMatesDir(explicit)) {
       throw new Error(
-        `${explicit} does not appear to be an OpenMates installation (missing ${COMPOSE_MARKER}).`
+        `${explicit} does not appear to be an OpenMates installation (missing ${SOURCE_COMPOSE_MARKER} or ${IMAGE_COMPOSE_MARKER}).`
       );
     }
     return explicit;
@@ -6037,10 +6806,78 @@ function resolveServerPath(flags) {
 }
 
 // src/server.ts
-var COMPOSE_FILE = join3("backend", "core", "docker-compose.yml");
+var SOURCE_COMPOSE_FILE = join3("backend", "core", "docker-compose.yml");
+var IMAGE_COMPOSE_FILE = join3("backend", "core", "docker-compose.selfhost.yml");
 var COMPOSE_OVERRIDE = join3("backend", "core", "docker-compose.override.yml");
 var DEFAULT_INSTALL_PATH = join3(homedir5(), "openmates");
 var REPO_URL = "https://github.com/glowingkitty/OpenMates.git";
+var DEV_BRANCH = "dev";
+var DEFAULT_IMAGE_REGISTRY = "ghcr.io/glowingkitty";
+var MINIMAL_ENV_TEMPLATE = `# OpenMates self-host image-mode environment
+SECRET__MISTRAL_AI__API_KEY=
+SECRET__CEREBRAS__API_KEY=
+SECRET__GROQ__API_KEY=
+SECRET__OPENAI__API_KEY=
+SECRET__ANTHROPIC__API_KEY=
+SECRET__GOOGLE_AI_STUDIO__API_KEY=
+SECRET__OPENROUTER__API_KEY=
+SECRET__TOGETHER__API_KEY=
+SECRET__BRAVE__API_KEY=
+SECRET__FIRECRAWL__API_KEY=
+SECRET__CONTEXT7__API_KEY=
+DATABASE_ADMIN_EMAIL=admin@example.com
+DATABASE_ADMIN_PASSWORD=
+DATABASE_NAME=directus
+DATABASE_USERNAME=directus
+DATABASE_PASSWORD=
+DIRECTUS_TOKEN=
+DIRECTUS_SECRET=
+DRAGONFLY_PASSWORD=
+OPENOBSERVE_ROOT_EMAIL=admin@openmates.internal
+OPENOBSERVE_ROOT_PASSWORD=
+INTERNAL_API_SHARED_TOKEN=
+TUNNEL_TRIGGER_SECRET=<PLACEHOLDER>
+SERVER_ENVIRONMENT=production
+FRONTEND_URLS="http://localhost:5173"
+PRODUCTION_URL="http://localhost:5173"
+TRUSTED_PROXY_IPS="172.16.0.0/12"
+CORE_SIDECAR_URL=http://admin-sidecar:8001
+CLEAR_CACHE_ON_UPDATE=true
+SIGNUP_LIMIT=20
+SELF_HOST_SIGNUP_MODE=invite_only
+SELF_HOST_SIGNUP_ALLOWED_DOMAINS=
+SELF_HOST_FIRST_INVITE_CODE=
+APPLICATION_PREVIEW_ORIGIN=
+OPENMATES_IMAGE_REGISTRY=${DEFAULT_IMAGE_REGISTRY}
+OPENMATES_IMAGE_TAG=
+GIT_WORK_DIR=
+DOCKER_GID=999
+`;
+var VAULT_CONFIG_TEMPLATE = `# Minimal Vault configuration
+listener "tcp" {
+  address = "0.0.0.0:8200"
+  tls_disable = true
+}
+
+storage "file" {
+  path = "/vault/file"
+}
+
+api_addr = "http://0.0.0.0:8200"
+ui = false
+disable_mlock = true
+log_level = "info"
+`;
+var LLM_PROVIDER_ENV_KEYS = /* @__PURE__ */ new Set([
+  "SECRET__MISTRAL_AI__API_KEY",
+  "SECRET__CEREBRAS__API_KEY",
+  "SECRET__GROQ__API_KEY",
+  "SECRET__OPENAI__API_KEY",
+  "SECRET__ANTHROPIC__API_KEY",
+  "SECRET__GOOGLE_AI_STUDIO__API_KEY",
+  "SECRET__OPENROUTER__API_KEY",
+  "SECRET__TOGETHER__API_KEY"
+]);
 function exec(cmd, cwd) {
   return execSync(cmd, { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
 }
@@ -6051,12 +6888,40 @@ function runInteractive(cmd, args, cwd) {
     child.on("error", reject);
   });
 }
-function composeArgs(installPath, withOverrides) {
-  const args = ["compose", "--env-file", ".env", "-f", COMPOSE_FILE];
+function loadConfigForInstallPath(installPath) {
+  const config = loadServerConfig();
+  return config?.installPath === installPath ? config : null;
+}
+function getInstallMode(installPath, config = loadConfigForInstallPath(installPath)) {
+  if (config?.installMode) return config.installMode;
+  if (existsSync5(join3(installPath, IMAGE_COMPOSE_FILE))) return "image";
+  return "source";
+}
+function shouldPullImages() {
+  return process.env.OPENMATES_SKIP_IMAGE_PULL !== "1";
+}
+function composeArgs(installPath, withOverrides, installMode = getInstallMode(installPath)) {
+  const composeFile = installMode === "image" ? IMAGE_COMPOSE_FILE : SOURCE_COMPOSE_FILE;
+  const args = ["compose", "--env-file", ".env", "-f", composeFile];
   if (withOverrides && existsSync5(join3(installPath, COMPOSE_OVERRIDE))) {
     args.push("-f", COMPOSE_OVERRIDE);
   }
-  return args;
+  return args;
+}
+function ensureGitWorkDirEnv(installPath) {
+  const envPath = join3(installPath, ".env");
+  if (!existsSync5(envPath)) return;
+  const content = readFileSync5(envPath, "utf-8");
+  const lineRegex = /^GIT_WORK_DIR=.*$/m;
+  const value = `GIT_WORK_DIR=${installPath}`;
+  if (lineRegex.test(content)) {
+    const next = content.replace(lineRegex, value);
+    if (next !== content) writeFileSync3(envPath, next);
+    return;
+  }
+  const separator = content.endsWith("\n") ? "" : "\n";
+  writeFileSync3(envPath, `${content}${separator}${value}
+`);
 }
 function requireDocker() {
   try {
@@ -6074,9 +6939,94 @@ function requireGit() {
     throw new Error("git is not installed. Install it first: https://git-scm.com/downloads");
   }
 }
+function getPackageVersion() {
+  try {
+    const packageJson = JSON.parse(readFileSync5(new URL("../package.json", import.meta.url), "utf-8"));
+    return packageJson.version ?? "";
+  } catch {
+    return "";
+  }
+}
+function getDefaultImageTag() {
+  const version = getPackageVersion();
+  return version ? `v${version}` : "dev";
+}
+function defaultTemplateRefForVersion(version) {
+  return /-(alpha|beta|rc)(\.|\d|$)/.test(version) ? DEV_BRANCH : `v${version}`;
+}
+function randomHex(bytes) {
+  return randomBytes2(bytes).toString("hex");
+}
+function generateInviteCode() {
+  const digits = Array.from(randomBytes2(12), (byte) => String(byte % 10)).join("");
+  return `${digits.slice(0, 4)}-${digits.slice(4, 8)}-${digits.slice(8, 12)}`;
+}
+function getEnvVar(content, name) {
+  const match = content.match(new RegExp(`^${name}=(.*)$`, "m"));
+  return match?.[1]?.replace(/^"|"$/g, "") ?? "";
+}
+function setEnvVar(content, name, value) {
+  const line = `${name}=${value}`;
+  const pattern = new RegExp(`^${name}=.*$`, "m");
+  if (pattern.test(content)) {
+    return content.replace(pattern, line);
+  }
+  const separator = content.endsWith("\n") ? "" : "\n";
+  return `${content}${separator}${line}
+`;
+}
+function setEnvIfEmpty(content, name, value) {
+  return getEnvVar(content, name) ? content : setEnvVar(content, name, value);
+}
+async function fetchText(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download ${url}: HTTP ${response.status}`);
+  }
+  return response.text();
+}
+async function loadSelfHostComposeTemplate(version) {
+  const templateDir = process.env.OPENMATES_SELFHOST_TEMPLATE_DIR;
+  if (templateDir) {
+    return readFileSync5(join3(resolve3(templateDir), IMAGE_COMPOSE_FILE), "utf-8");
+  }
+  const overrideUrl = process.env.OPENMATES_SELFHOST_COMPOSE_URL;
+  if (overrideUrl) {
+    return fetchText(overrideUrl);
+  }
+  const ref = defaultTemplateRefForVersion(version);
+  return fetchText(
+    `https://raw.githubusercontent.com/glowingkitty/OpenMates/${ref}/backend/core/docker-compose.selfhost.yml`
+  );
+}
+async function writeImageModeRuntimeFiles(installPath, imageTag) {
+  const coreDir = join3(installPath, "backend", "core");
+  const vaultConfigDir = join3(coreDir, "vault", "config");
+  mkdirSync3(vaultConfigDir, { recursive: true });
+  writeFileSync3(join3(coreDir, "docker-compose.selfhost.yml"), await loadSelfHostComposeTemplate(getPackageVersion()));
+  writeFileSync3(join3(vaultConfigDir, "vault.hcl"), VAULT_CONFIG_TEMPLATE);
+  const envPath = join3(installPath, ".env");
+  let envContent = existsSync5(envPath) ? readFileSync5(envPath, "utf-8") : MINIMAL_ENV_TEMPLATE;
+  envContent = setEnvIfEmpty(envContent, "DATABASE_ADMIN_PASSWORD", randomHex(12));
+  envContent = setEnvIfEmpty(envContent, "DATABASE_PASSWORD", randomHex(12));
+  envContent = setEnvIfEmpty(envContent, "DIRECTUS_TOKEN", randomHex(32));
+  envContent = setEnvIfEmpty(envContent, "DIRECTUS_SECRET", randomHex(32));
+  envContent = setEnvIfEmpty(envContent, "DRAGONFLY_PASSWORD", randomHex(12));
+  envContent = setEnvIfEmpty(envContent, "OPENOBSERVE_ROOT_PASSWORD", randomHex(32));
+  envContent = setEnvIfEmpty(envContent, "INTERNAL_API_SHARED_TOKEN", randomHex(32));
+  envContent = setEnvIfEmpty(envContent, "SELF_HOST_FIRST_INVITE_CODE", generateInviteCode());
+  envContent = setEnvVar(envContent, "OPENMATES_IMAGE_TAG", imageTag);
+  envContent = setEnvVar(envContent, "OPENMATES_IMAGE_REGISTRY", DEFAULT_IMAGE_REGISTRY);
+  envContent = setEnvVar(envContent, "GIT_WORK_DIR", installPath);
+  writeFileSync3(envPath, envContent.endsWith("\n") ? envContent : `${envContent}
+`);
+}
+function defaultCloneBranchForVersion(version) {
+  return /-(alpha|beta|rc)(\.|\d|$)/.test(version) ? DEV_BRANCH : null;
+}
 function hasLlmCredentials(envPath) {
   if (!existsSync5(envPath)) return false;
-  const content = readFileSync6(envPath, "utf-8");
+  const content = readFileSync5(envPath, "utf-8");
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
     if (trimmed.startsWith("#") || !trimmed) continue;
@@ -6084,22 +7034,23 @@ function hasLlmCredentials(envPath) {
     if (eqIdx === -1) continue;
     const key = trimmed.slice(0, eqIdx);
     const value = trimmed.slice(eqIdx + 1).trim();
-    if (/^SECRET__\w+__API_KEY$/.test(key) && value && value !== "IMPORTED_TO_VAULT") {
+    if (LLM_PROVIDER_ENV_KEYS.has(key) && value && value !== "IMPORTED_TO_VAULT") {
       return true;
     }
   }
   return false;
 }
-function requireLlmCredentials(installPath) {
+function warnIfMissingLlmCredentials(installPath) {
   const envPath = join3(installPath, ".env");
   if (!existsSync5(envPath)) {
-    throw new Error(
+    console.error(
       "No .env file found. Run 'openmates server install' first, or create .env from .env.example."
     );
+    return;
   }
   if (!hasLlmCredentials(envPath)) {
-    throw new Error(
-      "No LLM provider API key found in .env.\nAt least one AI provider API key is required to start the server.\n\nAdd at least one of these to your .env file:\n  SECRET__OPENAI__API_KEY=sk-...\n  SECRET__ANTHROPIC__API_KEY=sk-ant-...\n  SECRET__GOOGLE__API_KEY=...\n\nThen run 'openmates server start' again."
+    console.error(
+      "No LLM provider API key found in .env.\nOpenMates will start, but AI chat/model processing will stay unavailable until you add one.\n\nAdd at least one of these to your .env file:\n  SECRET__OPENAI__API_KEY=sk-...\n  SECRET__ANTHROPIC__API_KEY=sk-ant-...\n  SECRET__GOOGLE_AI_STUDIO__API_KEY=...\n\nAfter updating .env, run 'openmates server restart'."
     );
   }
 }
@@ -6118,9 +7069,10 @@ function printJson(data) {
 async function serverStatus(flags) {
   requireDocker();
   const installPath = resolveServerPath(flags);
-  const config = loadServerConfig();
+  ensureGitWorkDirEnv(installPath);
+  const config = loadConfigForInstallPath(installPath);
   const withOverrides = config?.composeProfile === "full";
-  const args = [...composeArgs(installPath, withOverrides), "ps"];
+  const args = [...composeArgs(installPath, withOverrides, getInstallMode(installPath, config)), "ps"];
   if (flags.json === true) {
     args.push("--format", "json");
   }
@@ -6130,20 +7082,30 @@ async function serverStatus(flags) {
 async function serverStart(flags) {
   requireDocker();
   const installPath = resolveServerPath(flags);
-  requireLlmCredentials(installPath);
+  ensureGitWorkDirEnv(installPath);
+  warnIfMissingLlmCredentials(installPath);
   const withOverrides = flags["with-overrides"] === true;
-  const args = [...composeArgs(installPath, withOverrides), "up", "-d"];
-  const config = loadServerConfig();
+  const config = loadConfigForInstallPath(installPath);
+  const installMode = getInstallMode(installPath, config);
+  const pullArgs = [...composeArgs(installPath, withOverrides, installMode), "pull"];
+  const args = [...composeArgs(installPath, withOverrides, installMode), "up", "-d"];
   if (config && withOverrides && config.composeProfile !== "full") {
     saveServerConfig({ ...config, composeProfile: "full" });
   }
   console.error("Starting OpenMates server...");
-  const code = await runInteractive("docker", args, installPath);
+  let code = 0;
+  if (installMode === "image" && shouldPullImages()) {
+    code = await runInteractive("docker", pullArgs, installPath);
+    if (code !== 0) process.exit(code);
+  }
+  code = await runInteractive("docker", args, installPath);
   if (code !== 0) process.exit(code);
   if (flags.json === true) {
     printJson({ command: "start", status: "success", path: installPath });
   } else {
-    console.log("\nServer started. API available at http://localhost:8000");
+    console.log("\nServer started.");
+    console.log("Web app: http://localhost:5173");
+    console.log("API:     http://localhost:8000");
     if (withOverrides) {
       console.log("Directus CMS: http://localhost:8055");
       console.log("Grafana:      http://localhost:3000");
@@ -6153,9 +7115,10 @@ async function serverStart(flags) {
 async function serverStop(flags) {
   requireDocker();
   const installPath = resolveServerPath(flags);
-  const config = loadServerConfig();
+  ensureGitWorkDirEnv(installPath);
+  const config = loadConfigForInstallPath(installPath);
   const withOverrides = config?.composeProfile === "full";
-  const args = [...composeArgs(installPath, withOverrides), "down"];
+  const args = [...composeArgs(installPath, withOverrides, getInstallMode(installPath, config)), "down"];
   console.error("Stopping OpenMates server...");
   const code = await runInteractive("docker", args, installPath);
   if (code !== 0) process.exit(code);
@@ -6168,26 +7131,33 @@ async function serverStop(flags) {
 async function serverRestart(flags) {
   requireDocker();
   const installPath = resolveServerPath(flags);
-  const config = loadServerConfig();
+  ensureGitWorkDirEnv(installPath);
+  const config = loadConfigForInstallPath(installPath);
   const withOverrides = config?.composeProfile === "full";
+  const installMode = getInstallMode(installPath, config);
   if (flags.rebuild === true) {
+    if (installMode === "image") {
+      throw new Error(
+        "Image-mode installs use prebuilt images and cannot rebuild locally. Run 'openmates server update' to pull newer images, or reinstall with --from-source to build from source."
+      );
+    }
     console.error("Rebuilding OpenMates server (this may take a few minutes)...");
-    const downArgs = [...composeArgs(installPath, withOverrides), "down"];
+    const downArgs = [...composeArgs(installPath, withOverrides, installMode), "down"];
     let code = await runInteractive("docker", downArgs, installPath);
     if (code !== 0) process.exit(code);
     try {
       exec("docker volume rm openmates-cache-data", installPath);
     } catch {
     }
-    const buildArgs = [...composeArgs(installPath, withOverrides), "build"];
+    const buildArgs = [...composeArgs(installPath, withOverrides, installMode), "build"];
     code = await runInteractive("docker", buildArgs, installPath);
     if (code !== 0) process.exit(code);
-    const upArgs = [...composeArgs(installPath, withOverrides), "up", "-d"];
+    const upArgs = [...composeArgs(installPath, withOverrides, installMode), "up", "-d"];
     code = await runInteractive("docker", upArgs, installPath);
     if (code !== 0) process.exit(code);
   } else {
     console.error("Restarting OpenMates server...");
-    const args = [...composeArgs(installPath, withOverrides), "restart"];
+    const args = [...composeArgs(installPath, withOverrides, installMode), "restart"];
     const code = await runInteractive("docker", args, installPath);
     if (code !== 0) process.exit(code);
   }
@@ -6200,9 +7170,10 @@ async function serverRestart(flags) {
 async function serverLogs(flags) {
   requireDocker();
   const installPath = resolveServerPath(flags);
-  const config = loadServerConfig();
+  ensureGitWorkDirEnv(installPath);
+  const config = loadConfigForInstallPath(installPath);
   const withOverrides = config?.composeProfile === "full";
-  const args = [...composeArgs(installPath, withOverrides), "logs"];
+  const args = [...composeArgs(installPath, withOverrides, getInstallMode(installPath, config)), "logs"];
   if (flags.follow === true || flags.f === true) {
     args.push("--follow");
   }
@@ -6220,17 +7191,70 @@ async function serverLogs(flags) {
   if (code !== 0) process.exit(code);
 }
 async function serverInstall(flags) {
-  requireGit();
   const installPath = typeof flags.path === "string" ? resolve3(flags.path) : DEFAULT_INSTALL_PATH;
-  if (existsSync5(join3(installPath, "setup.sh"))) {
+  const sourcePath = typeof flags["source-path"] === "string" ? resolve3(flags["source-path"]) : null;
+  const fromSource = flags["from-source"] === true || sourcePath !== null;
+  if (existsSync5(join3(installPath, SOURCE_COMPOSE_FILE)) || existsSync5(join3(installPath, IMAGE_COMPOSE_FILE))) {
     console.error(`OpenMates already exists at ${installPath}.`);
     console.error("Use 'openmates server update' to update, or choose a different --path.");
     process.exit(1);
   }
-  console.error(`Cloning OpenMates to ${installPath}...`);
+  if (!fromSource) {
+    requireDocker();
+    mkdirSync3(installPath, { recursive: true });
+    if (typeof flags["env-path"] === "string") {
+      const envSource = resolve3(flags["env-path"]);
+      if (!existsSync5(envSource)) {
+        throw new Error(`Env file not found: ${envSource}`);
+      }
+      copyFileSync(envSource, join3(installPath, ".env"));
+      console.error(`Copied ${envSource} to ${installPath}/.env`);
+    }
+    const imageTag = typeof flags["image-tag"] === "string" ? flags["image-tag"] : getDefaultImageTag();
+    console.error(`Preparing OpenMates image-mode install at ${installPath}...`);
+    await writeImageModeRuntimeFiles(installPath, imageTag);
+    try {
+      exec("docker network create openmates", installPath);
+    } catch {
+    }
+    saveServerConfig({
+      installPath,
+      installedAt: Date.now(),
+      composeProfile: "core",
+      installMode: "image",
+      imageTag
+    });
+    if (flags.json === true) {
+      printJson({ command: "install", status: "success", path: installPath, mode: "image", imageTag });
+    } else {
+      const firstInvite = getEnvVar(readFileSync5(join3(installPath, ".env"), "utf-8"), "SELF_HOST_FIRST_INVITE_CODE");
+      console.log(`
+OpenMates installed at ${installPath}`);
+      console.log(`Mode: image (${DEFAULT_IMAGE_REGISTRY}, tag ${imageTag})`);
+      console.log("\nNext steps:");
+      console.log("  1. Run: openmates server start");
+      console.log("  2. Open http://localhost:5173");
+      if (firstInvite) console.log(`  3. Sign up with invite code: ${firstInvite}`);
+      console.log("  4. After signup, make yourself admin: openmates server make-admin your@email.com");
+      console.log("\nOptional: edit .env first to add LLM provider API keys. Source builds are available with --from-source.");
+    }
+    return;
+  }
+  requireGit();
+  const cloneSource = sourcePath ?? REPO_URL;
+  const cloneBranch = sourcePath ? null : defaultCloneBranchForVersion(getPackageVersion());
+  const cloneArgs = ["clone"];
+  if (cloneBranch) {
+    cloneArgs.push("--branch", cloneBranch);
+  }
+  cloneArgs.push(cloneSource, installPath);
+  console.error(`Cloning OpenMates from ${cloneSource} to ${installPath}...`);
+  if (cloneBranch) {
+    console.error(`Using ${cloneBranch} branch for this prerelease CLI.`);
+  }
   const cloneCode = await runInteractive(
     "git",
-    ["clone", REPO_URL, installPath],
+    cloneArgs,
     process.cwd()
   );
   if (cloneCode !== 0) {
@@ -6257,26 +7281,45 @@ async function serverInstall(flags) {
   saveServerConfig({
     installPath,
     installedAt: Date.now(),
-    composeProfile: "core"
+    composeProfile: "core",
+    installMode: "source"
   });
   if (flags.json === true) {
-    printJson({ command: "install", status: "success", path: installPath });
+    printJson({ command: "install", status: "success", path: installPath, mode: "source" });
   } else {
     console.log(`
 OpenMates installed at ${installPath}`);
     console.log("\nNext steps:");
-    console.log("  1. Edit .env to add your LLM provider API key(s)");
-    console.log("  2. Run: openmates server start");
-    console.log("  3. Find your invite code: openmates server logs --container cms-setup --tail 50");
-    console.log("  4. Open http://localhost:5173 and sign up");
-    console.log("  5. Make yourself admin: openmates server make-admin your@email.com");
+    console.log("  1. Run: openmates server start");
+    console.log("  2. Open http://localhost:5173");
+    console.log("  3. After signup, make yourself admin: openmates server make-admin your@email.com");
+    console.log("\nOptional: edit .env first to add LLM provider API keys. Without keys, the web app and backend still start, but AI model processing is unavailable.");
   }
 }
 async function serverUpdate(flags) {
-  requireGit();
   requireDocker();
   const installPath = resolveServerPath(flags);
+  ensureGitWorkDirEnv(installPath);
   console.error("Updating OpenMates...");
+  const config = loadConfigForInstallPath(installPath);
+  const withOverrides = config?.composeProfile === "full";
+  const installMode = getInstallMode(installPath, config);
+  if (installMode === "image") {
+    const pullArgs = [...composeArgs(installPath, withOverrides, installMode), "pull"];
+    console.error("Pulling prebuilt images...");
+    let code2 = await runInteractive("docker", pullArgs, installPath);
+    if (code2 !== 0) process.exit(code2);
+    const upArgs2 = [...composeArgs(installPath, withOverrides, installMode), "up", "-d"];
+    code2 = await runInteractive("docker", upArgs2, installPath);
+    if (code2 !== 0) process.exit(code2);
+    if (flags.json === true) {
+      printJson({ command: "update", status: "success", path: installPath, mode: "image" });
+    } else {
+      console.log("Server images pulled and containers restarted.");
+    }
+    return;
+  }
+  requireGit();
   if (flags.force === true) {
     console.error("Stashing local changes...");
     try {
@@ -6304,13 +7347,11 @@ async function serverUpdate(flags) {
     } catch {
     }
   }
-  const config = loadServerConfig();
-  const withOverrides = config?.composeProfile === "full";
-  const buildArgs = [...composeArgs(installPath, withOverrides), "build"];
+  const buildArgs = [...composeArgs(installPath, withOverrides, installMode), "build"];
   console.error("Rebuilding containers...");
   let code = await runInteractive("docker", buildArgs, installPath);
   if (code !== 0) process.exit(code);
-  const upArgs = [...composeArgs(installPath, withOverrides), "up", "-d"];
+  const upArgs = [...composeArgs(installPath, withOverrides, installMode), "up", "-d"];
   code = await runInteractive("docker", upArgs, installPath);
   if (code !== 0) process.exit(code);
   if (flags.json === true) {
@@ -6322,8 +7363,10 @@ async function serverUpdate(flags) {
 async function serverReset(flags) {
   requireDocker();
   const installPath = resolveServerPath(flags);
-  const config = loadServerConfig();
+  ensureGitWorkDirEnv(installPath);
+  const config = loadConfigForInstallPath(installPath);
   const withOverrides = config?.composeProfile === "full";
+  const installMode = getInstallMode(installPath, config);
   const userDataOnly = flags["delete-user-data-only"] === true;
   if (userDataOnly) {
     console.error("\nWARNING: This will delete all user data (database and cache).");
@@ -6343,24 +7386,26 @@ async function serverReset(flags) {
   }
   console.error("Resetting server...");
   if (userDataOnly) {
-    const downArgs = [...composeArgs(installPath, withOverrides), "down"];
+    const downArgs = [...composeArgs(installPath, withOverrides, installMode), "down"];
     let code = await runInteractive("docker", downArgs, installPath);
     if (code !== 0) process.exit(code);
-    for (const vol of ["openmates-cache-data", "openmates-cms-database-data"]) {
+    for (const vol of ["openmates-cache-data", "openmates-postgres-data", "openmates-cms-database-data"]) {
       try {
         exec(`docker volume rm ${vol}`, installPath);
         console.error(`  Removed volume: ${vol}`);
       } catch {
       }
     }
-    const buildArgs = [...composeArgs(installPath, withOverrides), "build"];
-    code = await runInteractive("docker", buildArgs, installPath);
-    if (code !== 0) process.exit(code);
-    const upArgs = [...composeArgs(installPath, withOverrides), "up", "-d"];
+    if (installMode === "source") {
+      const buildArgs = [...composeArgs(installPath, withOverrides, installMode), "build"];
+      code = await runInteractive("docker", buildArgs, installPath);
+      if (code !== 0) process.exit(code);
+    }
+    const upArgs = [...composeArgs(installPath, withOverrides, installMode), "up", "-d"];
     code = await runInteractive("docker", upArgs, installPath);
     if (code !== 0) process.exit(code);
   } else {
-    const args = [...composeArgs(installPath, withOverrides), "down", "-v"];
+    const args = [...composeArgs(installPath, withOverrides, installMode), "down", "-v"];
     const code = await runInteractive("docker", args, installPath);
     if (code !== 0) process.exit(code);
   }
@@ -6402,7 +7447,8 @@ async function serverMakeAdmin(rest, flags) {
 async function serverUninstall(flags) {
   requireDocker();
   const installPath = resolveServerPath(flags);
-  const config = loadServerConfig();
+  ensureGitWorkDirEnv(installPath);
+  const config = loadConfigForInstallPath(installPath);
   const withOverrides = config?.composeProfile === "full";
   const keepData = flags["keep-data"] === true;
   console.error("\nWARNING: This will completely uninstall OpenMates:");
@@ -6424,7 +7470,7 @@ async function serverUninstall(flags) {
     }
   }
   console.error("Uninstalling OpenMates...");
-  const downArgs = [...composeArgs(installPath, withOverrides), "down", "--rmi", "local"];
+  const downArgs = [...composeArgs(installPath, withOverrides, getInstallMode(installPath, config)), "down", "--rmi", "local"];
   if (!keepData) {
     downArgs.push("-v");
   }
@@ -6457,13 +7503,13 @@ OpenMates Server Management
 Usage: openmates server <command> [options]
 
 Commands:
-  install         Install OpenMates server (clone repo + run setup)
+  install         Install OpenMates server (prebuilt GHCR images by default)
   start           Start the server
   stop            Stop the server
   restart         Restart the server
   status          Show server status (container health)
   logs            Display server logs
-  update          Update to latest version (git pull + rebuild)
+  update          Update to latest version (pull images, or git pull + rebuild for source installs)
   make-admin      Grant admin privileges to a user
   reset           Reset server data (requires confirmation)
   uninstall       Completely remove OpenMates (requires confirmation)
@@ -6477,6 +7523,9 @@ Command Options:
   install:
     --path <dir>        Install directory (default: ~/openmates)
     --env-path <file>   Copy a pre-existing .env file during install
+    --image-tag <tag>   Prebuilt image tag (default: CLI version tag)
+    --from-source       Clone/build from source instead of using prebuilt GHCR images
+    --source-path <dir> Clone from a local checkout instead of GitHub (implies --from-source)
 
   start:
     --with-overrides    Include admin UIs (Directus CMS, Grafana)
@@ -6710,7 +7759,8 @@ async function handleChats(client, subcommand, rest, flags, redactor) {
         message,
         chatId: void 0,
         incognito: false,
-        json: flags.json === true
+        json: flags.json === true,
+        autoApproveSubChats: flags["auto-approve"] === true
       },
       redactor
     );
@@ -6781,7 +7831,8 @@ Run 'openmates chats show ` + chatId + "' to check if suggestions have been save
         message,
         chatId,
         incognito: flags.incognito === true,
-        json: flags.json === true
+        json: flags.json === true,
+        autoApproveSubChats: flags["auto-approve"] === true
       },
       redactor
     );
@@ -6799,7 +7850,8 @@ Run 'openmates chats show ` + chatId + "' to check if suggestions have been save
       {
         message,
         incognito: true,
-        json: flags.json === true
+        json: flags.json === true,
+        autoApproveSubChats: flags["auto-approve"] === true
       },
       redactor
     );
@@ -6807,17 +7859,11 @@ Run 'openmates chats show ` + chatId + "' to check if suggestions have been save
     return;
   }
   if (subcommand === "incognito-history") {
-    const history = client.getIncognitoHistory();
-    if (flags.json === true) {
-      printJson2(history);
-    } else {
-      printIncognitoHistory(history);
-    }
+    printIncognitoNoHistoryNotice(flags.json === true);
     return;
   }
   if (subcommand === "incognito-clear") {
-    client.clearIncognitoHistory();
-    console.log("Incognito history cleared.");
+    printIncognitoNoHistoryNotice(flags.json === true);
     return;
   }
   if (subcommand === "show") {
@@ -7594,216 +8640,780 @@ function levenshtein(a, b) {
       dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
     }
   }
-  return dp[m][n];
-}
-function findClosestMatch(input, candidates) {
-  let best = null;
-  let bestDist = 4;
-  for (const candidate of candidates) {
-    const dist = levenshtein(input.toLowerCase(), candidate.toLowerCase());
-    if (dist < bestDist) {
-      bestDist = dist;
-      best = candidate;
-    }
+  return dp[m][n];
+}
+function findClosestMatch(input, candidates) {
+  let best = null;
+  let bestDist = 4;
+  for (const candidate of candidates) {
+    const dist = levenshtein(input.toLowerCase(), candidate.toLowerCase());
+    if (dist < bestDist) {
+      bestDist = dist;
+      best = candidate;
+    }
+  }
+  return best;
+}
+async function handleEmbeds(client, subcommand, rest, flags) {
+  if (!subcommand || subcommand === "help" || flags.help === true) {
+    printEmbedsHelp();
+    return;
+  }
+  if (subcommand === "show") {
+    const embedId = rest[0];
+    if (!embedId) {
+      console.error("Missing embed ID.\n");
+      printEmbedsHelp();
+      process.exit(1);
+    }
+    const embed = await client.getEmbed(embedId);
+    if (flags.json === true) {
+      printJson2(embed);
+    } else {
+      await renderEmbedFullscreen(embed, client);
+    }
+    return;
+  }
+  if (subcommand === "share") {
+    const id = rest[0];
+    if (!id) {
+      console.error(
+        "Missing embed ID. Usage: openmates embeds share <embed-id>"
+      );
+      process.exit(1);
+    }
+    const durationSeconds = typeof flags.expires === "string" ? parseInt(flags.expires, 10) : 0;
+    const password = typeof flags.password === "string" ? flags.password : void 0;
+    if (password && password.length > 10) {
+      console.error("Password must be at most 10 characters.");
+      process.exit(1);
+    }
+    try {
+      const url = await client.createEmbedShareLink(
+        id,
+        durationSeconds,
+        password
+      );
+      if (flags.json === true) {
+        printJson2({
+          url,
+          embed_id: id,
+          expires: durationSeconds,
+          password_protected: !!password
+        });
+      } else {
+        process.stdout.write(`
+\x1B[1mEmbed share link\x1B[0m
+`);
+        process.stdout.write(`${url}
+
+`);
+        if (durationSeconds > 0) {
+          process.stdout.write(
+            `\x1B[2mExpires in ${humanizeDuration(durationSeconds)}\x1B[0m
+`
+          );
+        }
+        if (password) {
+          process.stdout.write(`\x1B[2mPassword protected\x1B[0m
+`);
+        }
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`Share link error: ${msg}`);
+      process.exit(1);
+    }
+    return;
+  }
+  console.error(`Unknown embeds subcommand '${subcommand}'.
+`);
+  printEmbedsHelp();
+  process.exit(1);
+}
+var SETTINGS_EXECUTABLE_COMMANDS = [
+  { path: ["account", "info"], description: "Show account info", examples: ["openmates settings account info --json"] },
+  { path: ["account", "timezone", "set"], description: "Set account timezone", examples: ["openmates settings account timezone set Europe/Berlin"] },
+  { path: ["account", "export", "manifest"], description: "Show account export manifest", examples: ["openmates settings account export manifest --json"] },
+  { path: ["account", "export", "data"], description: "Fetch account export data", examples: ["openmates settings account export data --json"] },
+  { path: ["account", "import-chat"], description: "Import a CLI chat export file", examples: ["openmates settings account import-chat ./chat.yml", "openmates settings account import-chat ./payload.json"] },
+  { path: ["account", "username", "set"], description: "Change account username", examples: ["openmates settings account username set alice_123"] },
+  { path: ["account", "profile-picture", "set"], description: "Upload a profile picture", examples: ["openmates settings account profile-picture set ./avatar.jpg"] },
+  { path: ["account", "chats", "stats"], description: "Show chat statistics", examples: ["openmates settings account chats stats"] },
+  { path: ["account", "delete", "preview"], description: "Preview account deletion impact", examples: ["openmates settings account delete preview"] },
+  { path: ["account", "storage", "overview"], description: "Show storage overview", examples: ["openmates settings account storage overview"] },
+  { path: ["account", "storage", "files"], description: "List stored files", examples: ["openmates settings account storage files --category images"] },
+  { path: ["account", "storage", "delete"], description: "Delete one stored file by file ID", examples: ["openmates settings account storage delete <file-id> --yes"] },
+  { path: ["interface", "language", "set"], description: "Set interface language", examples: ["openmates settings interface language set en"] },
+  { path: ["interface", "dark-mode", "set"], description: "Set dark mode on or off", examples: ["openmates settings interface dark-mode set on"] },
+  { path: ["interface", "font", "set"], description: "Set interface font", examples: ["openmates settings interface font set lexend"] },
+  { path: ["ai", "models", "set-defaults"], description: "Set default AI models", examples: ["openmates settings ai models set-defaults --simple mistral/mistral-small-2506", "openmates settings ai models set-defaults --simple auto"] },
+  { path: ["privacy", "auto-delete", "chats", "set"], description: "Set chat auto-deletion period", examples: ["openmates settings privacy auto-delete chats set 90d"] },
+  { path: ["privacy", "debug-logs", "share"], description: "Create a debug log sharing session", examples: ["openmates settings privacy debug-logs share --duration 1h --confirm"] },
+  { path: ["billing", "overview"], description: "Show billing overview", examples: ["openmates settings billing overview"] },
+  { path: ["billing", "usage"], description: "Show usage history", examples: ["openmates settings billing usage --json"] },
+  { path: ["billing", "usage", "summaries"], description: "Show usage summaries", examples: ["openmates settings billing usage summaries"] },
+  { path: ["billing", "usage", "daily"], description: "Show daily usage overview", examples: ["openmates settings billing usage daily"] },
+  { path: ["billing", "usage", "export"], description: "Export usage data", examples: ["openmates settings billing usage export --json"] },
+  { path: ["billing", "invoices", "list"], description: "List invoices", examples: ["openmates settings billing invoices list --json"] },
+  { path: ["billing", "invoices", "download"], description: "Download an invoice PDF", examples: ["openmates settings billing invoices download <invoice-id> --output ./invoices"] },
+  { path: ["billing", "invoices", "credit-note"], description: "Download a credit note PDF", examples: ["openmates settings billing invoices credit-note <invoice-id> --output ./invoices"] },
+  { path: ["billing", "invoices", "refund"], description: "Request a refund for an invoice", examples: ["openmates settings billing invoices refund <invoice-id> --yes"] },
+  { path: ["billing", "gift-card", "redeem"], description: "Redeem a gift card", examples: ["openmates settings billing gift-card redeem ABCD-1234"] },
+  { path: ["billing", "gift-card", "list"], description: "List redeemed gift cards", examples: ["openmates settings billing gift-card list"] },
+  { path: ["billing", "auto-topup", "low-balance", "set"], description: "Configure low-balance auto top-up", examples: ["openmates settings billing auto-topup low-balance set --enabled true --amount 1000 --currency eur --email you@example.com"] },
+  { path: ["notifications", "status"], description: "Show notification settings", examples: ["openmates settings notifications status --json"] },
+  { path: ["notifications", "list"], description: "List recent notification events", examples: ["openmates settings notifications list --limit 20 --json"] },
+  { path: ["notifications", "stream"], description: "Stream notification events with SSE", examples: ["openmates settings notifications stream", "openmates settings notifications stream --count 1 --json"] },
+  { path: ["notifications", "email", "set"], description: "Configure email notifications", examples: ["openmates settings notifications email set --enabled true --email you@example.com --ai-responses true --backup-reminder true --webhook-chats true"] },
+  { path: ["notifications", "backup", "set"], description: "Configure backup reminder emails", examples: ["openmates settings notifications backup set --enabled true --interval 30 --email you@example.com"] },
+  { path: ["reminders", "list"], description: "List active reminders", examples: ["openmates settings reminders list"] },
+  { path: ["reminders", "update"], description: "Update a reminder", examples: ["openmates settings reminders update <id> --enabled false"] },
+  { path: ["reminders", "delete"], description: "Delete a reminder", examples: ["openmates settings reminders delete <id> --yes"] },
+  { path: ["developers", "api-keys", "list"], description: "List API keys", examples: ["openmates settings developers api-keys list"] },
+  { path: ["developers", "api-keys", "revoke"], description: "Revoke an API key", examples: ["openmates settings developers api-keys revoke <key-id> --yes"] },
+  { path: ["report-issue", "create"], description: "Report an issue", examples: ['openmates settings report-issue create --title "Bug" --body "What happened"'] },
+  { path: ["report-issue", "status"], description: "Show issue status", examples: ["openmates settings report-issue status <issue-id>"] },
+  { path: ["mates", "list"], description: "List available mates", examples: ["openmates settings mates list"] },
+  { path: ["mates", "info"], description: "Show mate details", examples: ["openmates settings mates info software_development"] },
+  { path: ["mates", "consent"], description: "Record mate settings consent", examples: ["openmates settings mates consent --yes"] },
+  { path: ["newsletter", "categories"], description: "Show newsletter category preferences", examples: ["openmates settings newsletter categories"] },
+  { path: ["newsletter", "categories", "set"], description: "Set newsletter category preferences", examples: ["openmates settings newsletter categories set --updates true --tips true --daily false"] },
+  { path: ["newsletter", "subscribe"], description: "Subscribe an email to the newsletter", examples: ["openmates settings newsletter subscribe you@example.com --language en"] },
+  { path: ["newsletter", "confirm"], description: "Confirm newsletter subscription token", examples: ["openmates settings newsletter confirm <token>"] },
+  { path: ["newsletter", "unsubscribe"], description: "Unsubscribe with newsletter token", examples: ["openmates settings newsletter unsubscribe <token>"] },
+  { path: ["memories"], description: "Manage encrypted memories", examples: ["openmates settings memories list", `openmates settings memories create --app-id code --item-type projects --data '{"name":"OpenMates"}'`] }
+];
+var SETTINGS_INFO_COMMANDS = [
+  { path: ["account", "email"], description: "Email changes are web-only", webPath: "account/email", reason: "Email changes require a guided identity verification flow.", examples: ["openmates settings account email"] },
+  { path: ["account", "delete"], description: "Account deletion is web-only", webPath: "account/delete", reason: "Account deletion requires browser-based reauthentication and explicit confirmation.", examples: ["openmates settings account delete"] },
+  { path: ["security"], description: "Security settings are web-only", webPath: "account/security", reason: "Security settings require browser APIs or high-risk reauthentication.", examples: ["openmates settings security"] },
+  { path: ["security", "passkeys"], description: "Passkeys are web-only", webPath: "account/security/passkeys", reason: "Passkeys require WebAuthn browser APIs.", examples: ["openmates settings security passkeys"] },
+  { path: ["security", "password"], description: "Password changes are web-only", webPath: "account/security/password", reason: "The CLI never asks for account credentials.", examples: ["openmates settings security password"] },
+  { path: ["security", "2fa"], description: "2FA setup and changes are web-only", webPath: "account/security/2fa", reason: "2FA setup requires a guided browser verification flow.", examples: ["openmates settings security 2fa"] },
+  { path: ["security", "recovery-key"], description: "Recovery key settings are web-only", webPath: "account/security/recovery-key", reason: "Recovery keys are a high-risk account recovery surface.", examples: ["openmates settings security recovery-key"] },
+  { path: ["security", "sessions"], description: "Session management is web-only", webPath: "account/security/sessions", reason: "The CLI is a paired restricted session; approval and revocation stay in the browser.", examples: ["openmates settings security sessions"] },
+  { path: ["billing", "buy-credits"], description: "Credit purchase is web-only", webPath: "billing/buy-credits", reason: "Payment checkout must use the browser/payment provider UI.", examples: ["openmates settings billing buy-credits"] },
+  { path: ["billing", "gift-card", "buy"], description: "Gift card purchase is web-only", webPath: "billing/gift-cards/buy", reason: "Payment checkout must use the browser/payment provider UI.", examples: ["openmates settings billing gift-card buy"] },
+  { path: ["billing", "auto-topup", "monthly"], description: "Monthly auto top-up is web-only for now", webPath: "billing/auto-topup/monthly", reason: "Recurring payment setup needs a payment-flow audit before CLI support.", examples: ["openmates settings billing auto-topup monthly"] },
+  { path: ["privacy", "personal-data"], description: "Personal data management is not CLI-ready yet", webPath: "privacy/hide-personal-data", reason: "The CLI needs a dedicated encrypted personal-data UX before exposing writes.", examples: ["openmates settings privacy personal-data"] },
+  { path: ["shared", "tip"], description: "Tips are web-only", webPath: "shared/tip", reason: "Payment checkout must use the browser/payment provider UI.", examples: ["openmates settings shared tip"] },
+  { path: ["developers", "api-keys", "create"], description: "API key creation is web-only", webPath: "developers/api-keys", reason: "API key secrets are shown once and need the browser approval flow.", examples: ["openmates settings developers api-keys create"] },
+  { path: ["developers", "devices"], description: "Developer devices are web-only", webPath: "developers/devices", reason: "Device approvals and revocations are sensitive.", examples: ["openmates settings developers devices"] },
+  { path: ["developers", "webhooks"], description: "Developer webhooks are not CLI-ready yet", webPath: "developers/webhooks", reason: "Webhook CRUD needs a backend/API audit before CLI support.", examples: ["openmates settings developers webhooks"] },
+  { path: ["support"], description: "Support payments are web-only", webPath: "support", reason: "Payment flows must use the browser/payment provider UI.", examples: ["openmates settings support"] },
+  { path: ["incognito", "info"], description: "Explain incognito mode", reason: "Incognito chats are sent without saving chat history. The CLI stores no incognito transcript.", examples: ['openmates chats incognito "Private question"'] },
+  { path: ["server"], description: "Server admin settings are web/admin-only", webPath: "server", reason: "Use `openmates server --help` for self-hosted terminal server management.", examples: ["openmates server status"] }
+];
+function matches(actual, expected) {
+  return expected.every((part, index) => actual[index] === part);
+}
+function findSettingsInfoCommand(tokens) {
+  const all = [...SETTINGS_INFO_COMMANDS, ...SETTINGS_EXECUTABLE_COMMANDS];
+  return all.sort((a, b) => b.path.length - a.path.length).find((command) => matches(tokens, command.path)) ?? null;
+}
+async function printSettingsResult(resultPromise, flags) {
+  const result = await resultPromise;
+  flags.json === true ? printJson2(result) : printGenericObject(result);
+}
+async function printSettingsMutationResult(resultPromise, flags) {
+  const result = await resultPromise;
+  if (flags.json === true) {
+    printJson2(result);
+    return;
+  }
+  process.stdout.write("\x1B[32m\u2713\x1B[0m Settings updated\n");
+  if (result && typeof result === "object") printGenericObject(result);
+}
+function addQueryParam(params, key, value) {
+  if (typeof value === "string" && value.length > 0) params.set(key, value);
+}
+function parseOnOff(value, label) {
+  if (value === "on" || value === "true" || value === "1") return true;
+  if (value === "off" || value === "false" || value === "0") return false;
+  throw new Error(`Invalid ${label} value '${value ?? ""}'. Use on/off or true/false.`);
+}
+function parseModelDefaultFlag(value, flag) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`Missing value for ${flag}. Use a provider/model-id or auto.`);
+  }
+  if (value === "auto" || value === "null") return null;
+  return value;
+}
+function parseRequiredNumber(value, flag) {
+  if (typeof value !== "string") throw new Error(`Missing ${flag}.`);
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) throw new Error(`Invalid ${flag}: ${value}`);
+  return parsed;
+}
+function parseOptionalNumber(value, fallback, flag) {
+  if (value === void 0) return fallback;
+  return parseRequiredNumber(value, flag);
+}
+function parseOptionalBoolean(value, fallback, label) {
+  if (value === void 0) return fallback;
+  if (typeof value === "boolean") return value;
+  return parseOnOff(value, label);
+}
+function parseDataOrFlags(flags, booleanFlags) {
+  if (typeof flags.data === "string") return JSON.parse(flags.data);
+  const body = {};
+  for (const key of booleanFlags) {
+    if (flags[key] !== void 0) body[key] = parseOnOff(String(flags[key]), key);
+  }
+  if (Object.keys(body).length === 0) throw new Error("Provide --data '<json>' or a supported flag.");
+  return body;
+}
+function parseChatImportPayload(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) throw new Error("Import file is empty.");
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    const parsed = JSON.parse(trimmed);
+    if (Array.isArray(parsed)) return { chats: parsed };
+    if (parsed && typeof parsed === "object" && Array.isArray(parsed.chats)) {
+      return parsed;
+    }
+    if (parsed && typeof parsed === "object") {
+      const object = parsed;
+      if (object.chat || object.messages) return { chats: [normalizeImportedChat(object)] };
+    }
+    throw new Error("JSON import must contain a chats array, a chat object, or messages.");
+  }
+  return { chats: [parseCliExportYaml(trimmed)] };
+}
+function normalizeImportedChat(source) {
+  const chat = source.chat && typeof source.chat === "object" ? source.chat : source;
+  const messages = Array.isArray(source.messages) ? source.messages : [];
+  return {
+    title: chat.title ?? null,
+    draft: chat.draft ?? null,
+    summary: chat.summary ?? null,
+    messages: messages.map((message) => normalizeImportedMessage(message))
+  };
+}
+function normalizeImportedMessage(message) {
+  return {
+    role: message.role,
+    content: message.content,
+    completed_at: message.completed_at ?? message.timestamp ?? null,
+    assistant_category: message.assistant_category ?? null,
+    thinking: message.thinking ?? null,
+    has_thinking: message.has_thinking ?? null,
+    thinking_tokens: message.thinking_tokens ?? null
+  };
+}
+function parseCliExportYaml(raw) {
+  const chat = {};
+  const messages = [];
+  const lines = raw.split("\n");
+  let section = null;
+  let currentMessage = null;
+  const multilineState = { current: null };
+  const setValue = (target, key, value, indent) => {
+    if (value === "|") {
+      target[key] = "";
+      multilineState.current = { target, key, indent: indent + 2 };
+      return;
+    }
+    target[key] = parseYamlScalar(value);
+  };
+  for (const line of lines) {
+    const indent = line.match(/^ */)?.[0].length ?? 0;
+    const trimmed = line.trimEnd();
+    if (!trimmed.trim()) continue;
+    if (multilineState.current) {
+      if (indent >= multilineState.current.indent) {
+        const previous = String(multilineState.current.target[multilineState.current.key] ?? "");
+        const nextLine = line.slice(multilineState.current.indent);
+        multilineState.current.target[multilineState.current.key] = previous ? `${previous}
+${nextLine}` : nextLine;
+        continue;
+      }
+      multilineState.current = null;
+    }
+    if (trimmed === "chat:") {
+      section = "chat";
+      currentMessage = null;
+      continue;
+    }
+    if (trimmed === "messages:") {
+      section = "messages";
+      currentMessage = null;
+      continue;
+    }
+    if (section === "messages" && trimmed.trim() === "-") {
+      currentMessage = {};
+      messages.push(currentMessage);
+      continue;
+    }
+    const match = /^\s*([\w-]+):\s*(.*)$/.exec(line);
+    if (!match) continue;
+    const [, key, value] = match;
+    if (section === "chat") setValue(chat, key, value, indent);
+    if (section === "messages" && currentMessage) setValue(currentMessage, key, value, indent);
+  }
+  if (messages.length === 0) throw new Error("Import YAML did not contain any messages.");
+  return normalizeImportedChat({ chat, messages });
+}
+function parseYamlScalar(value) {
+  const trimmed = value.trim();
+  if (trimmed === "null") return null;
+  if (trimmed === "true") return true;
+  if (trimmed === "false") return false;
+  if (trimmed !== "" && Number.isFinite(Number(trimmed))) return Number(trimmed);
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    return trimmed.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+  }
+  return trimmed;
+}
+async function saveDownloadedDocument(document, output) {
+  const { mkdir, writeFile } = await import("fs/promises");
+  const { join: join4, basename: basename2, dirname } = await import("path");
+  const target = typeof output === "string" ? output : ".";
+  const filename = basename2(document.filename || "document.pdf");
+  const filePath = target.endsWith(".pdf") ? target : join4(target, filename);
+  await mkdir(dirname(filePath), { recursive: true });
+  await writeFile(filePath, document.data);
+  return filePath;
+}
+function printMates(json) {
+  const mates = Object.entries(MATE_NAMES).map(([id, name]) => ({ id, name, mention: `@mate:${id}` }));
+  if (json) {
+    printJson2(mates);
+    return;
+  }
+  header("Mates");
+  for (const mate of mates) console.log(`${mate.id.padEnd(28)} ${mate.name.padEnd(10)} ${mate.mention}`);
+}
+function printMateInfo(mateId, json) {
+  const name = MATE_NAMES[mateId];
+  if (!name) throw new Error(`Unknown mate '${mateId}'. Run 'openmates settings mates list'.`);
+  const data = { id: mateId, name, mention: `@mate:${mateId}` };
+  if (json) {
+    printJson2(data);
+    return;
+  }
+  header(`${name} (${mateId})`);
+  console.log(`Mention: ${data.mention}`);
+  console.log(`Use: openmates chats send "${data.mention} <message>"`);
+}
+async function confirmOrExit(question) {
+  const rl = await import("readline");
+  const iface = rl.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((resolve4) => iface.question(question, resolve4));
+  iface.close();
+  if (answer.trim().toLowerCase() !== "y") {
+    console.log("Aborted.");
+    process.exit(0);
+  }
+}
+function printSettingsInfoCommand(client, command, json) {
+  const appUrl = deriveAppUrl(client.apiUrl);
+  const webUrl = command.webPath ? `${appUrl}/#settings/${command.webPath}` : null;
+  if (json) {
+    printJson2({
+      command: `openmates settings ${command.path.join(" ")}`,
+      supported_in_cli: false,
+      description: command.description,
+      reason: command.reason ?? null,
+      web_url: webUrl,
+      examples: command.examples
+    });
+    return;
+  }
+  header(command.description);
+  if (command.reason) console.log(command.reason);
+  if (webUrl) console.log(`
+Open in web app:
+  ${webUrl}`);
+  if (command.examples.length > 0) {
+    console.log("\nExamples:");
+    for (const example of command.examples) console.log(`  ${example}`);
+  }
+}
+async function handleSettings(client, subcommand, rest, flags) {
+  if (!subcommand || subcommand === "help") {
+    printSettingsHelp(client, subcommand ? [] : void 0);
+    return;
+  }
+  const tokens = [subcommand, ...rest].filter((token) => token !== "help");
+  if (rest.includes("help") || Boolean(flags.help)) {
+    printSettingsHelp(client, tokens);
+    return;
+  }
+  if (["get", "post", "patch", "delete"].includes(subcommand)) {
+    console.error(
+      "Raw settings passthrough is no longer supported. Use a predefined settings command.\n"
+    );
+    printSettingsHelp(client);
+    process.exit(1);
+  }
+  if (matches(tokens, ["account", "info"])) {
+    const user = await client.whoAmI();
+    flags.json === true ? printJson2(user) : printWhoAmI(user);
+    return;
+  }
+  if (matches(tokens, ["account", "timezone", "set"])) {
+    const timezone = rest[2];
+    if (!timezone) throw new Error("Missing timezone. Example: openmates settings account timezone set Europe/Berlin");
+    await printSettingsMutationResult(
+      client.settingsPost("user/timezone", { timezone }),
+      flags
+    );
+    return;
+  }
+  if (matches(tokens, ["account", "export", "manifest"])) {
+    await printSettingsResult(client.settingsGet("export-account-manifest"), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "export", "data"])) {
+    await printSettingsResult(client.settingsGet("export-account-data"), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "import-chat"])) {
+    const file = rest[1];
+    if (!file) throw new Error("Missing import file. Example: openmates settings account import-chat ./chat.yml");
+    const { readFile } = await import("fs/promises");
+    const content = await readFile(file, "utf-8");
+    await printSettingsMutationResult(
+      client.settingsPost("import-chat", parseChatImportPayload(content)),
+      flags
+    );
+    return;
+  }
+  if (matches(tokens, ["account", "username", "set"])) {
+    const username = rest[2];
+    if (!username) throw new Error("Missing username. Example: openmates settings account username set alice_123");
+    await printSettingsMutationResult(client.updateUsername(username), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "profile-picture", "set"])) {
+    const file = rest[2];
+    if (!file) throw new Error("Missing image file. Example: openmates settings account profile-picture set ./avatar.jpg");
+    await printSettingsMutationResult(client.updateProfileImage(file), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "chats", "stats"])) {
+    await printSettingsResult(client.settingsGet("chats"), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "delete", "preview"])) {
+    await printSettingsResult(client.settingsGet("delete-account-preview"), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "storage", "overview"])) {
+    await printSettingsResult(client.settingsGet("storage"), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "storage", "files"])) {
+    const params = new URLSearchParams();
+    addQueryParam(params, "category", flags.category ?? flags.type);
+    const query = params.toString();
+    await printSettingsResult(client.settingsGet(`storage/files${query ? `?${query}` : ""}`), flags);
+    return;
+  }
+  if (matches(tokens, ["account", "storage", "delete"])) {
+    const fileId = rest[3];
+    const category = typeof flags.category === "string" ? flags.category : void 0;
+    const scope = flags.all === true ? "all" : category ? "category" : "single";
+    if (scope === "single" && !fileId) throw new Error("Missing file ID.");
+    if (flags.yes !== true) await confirmOrExit(`Delete stored file data (${scope})? This cannot be undone. [y/N] `);
+    await printSettingsMutationResult(
+      client.settingsDelete("storage/files", { scope, file_id: fileId, category }),
+      flags
+    );
+    return;
+  }
+  if (matches(tokens, ["interface", "language", "set"])) {
+    const language = rest[2];
+    if (!language) throw new Error("Missing language code. Example: openmates settings interface language set en");
+    await printSettingsMutationResult(client.settingsPost("user/language", { language }), flags);
+    return;
   }
-  return best;
-}
-async function handleEmbeds(client, subcommand, rest, flags) {
-  if (!subcommand || subcommand === "help" || flags.help === true) {
-    printEmbedsHelp();
+  if (matches(tokens, ["interface", "dark-mode", "set"])) {
+    const value = parseOnOff(rest[2], "dark mode");
+    await printSettingsMutationResult(client.settingsPost("user/darkmode", { dark_mode: value }), flags);
     return;
   }
-  if (subcommand === "show") {
-    const embedId = rest[0];
-    if (!embedId) {
-      console.error("Missing embed ID.\n");
-      printEmbedsHelp();
-      process.exit(1);
-    }
-    const embed = await client.getEmbed(embedId);
-    if (flags.json === true) {
-      printJson2(embed);
-    } else {
-      await renderEmbedFullscreen(embed, client);
-    }
+  if (matches(tokens, ["interface", "font", "set"])) {
+    const font = rest[2];
+    if (!font) throw new Error("Missing font. Example: openmates settings interface font set lexend");
+    await printSettingsMutationResult(client.settingsPost("user/ui-font", { ui_font: font }), flags);
     return;
   }
-  if (subcommand === "share") {
-    const id = rest[0];
-    if (!id) {
-      console.error(
-        "Missing embed ID. Usage: openmates embeds share <embed-id>"
-      );
-      process.exit(1);
+  if (matches(tokens, ["ai", "models", "set-defaults"])) {
+    const body = {};
+    if (flags.simple !== void 0) {
+      body.default_ai_model_simple = parseModelDefaultFlag(flags.simple, "--simple");
     }
-    const durationSeconds = typeof flags.expires === "string" ? parseInt(flags.expires, 10) : 0;
-    const password = typeof flags.password === "string" ? flags.password : void 0;
-    if (password && password.length > 10) {
-      console.error("Password must be at most 10 characters.");
-      process.exit(1);
+    if (flags.complex !== void 0) {
+      body.default_ai_model_complex = parseModelDefaultFlag(flags.complex, "--complex");
     }
-    try {
-      const url = await client.createEmbedShareLink(
-        id,
-        durationSeconds,
-        password
-      );
-      if (flags.json === true) {
-        printJson2({
-          url,
-          embed_id: id,
-          expires: durationSeconds,
-          password_protected: !!password
-        });
-      } else {
-        process.stdout.write(`
-\x1B[1mEmbed share link\x1B[0m
-`);
-        process.stdout.write(`${url}
-
-`);
-        if (durationSeconds > 0) {
-          process.stdout.write(
-            `\x1B[2mExpires in ${humanizeDuration(durationSeconds)}\x1B[0m
-`
-          );
-        }
-        if (password) {
-          process.stdout.write(`\x1B[2mPassword protected\x1B[0m
-`);
-        }
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`Share link error: ${msg}`);
-      process.exit(1);
+    if (Object.keys(body).length === 0) {
+      throw new Error("Provide --simple <model-id|auto> and/or --complex <model-id|auto>.");
     }
+    await printSettingsMutationResult(client.settingsPost("ai-model-defaults", body), flags);
     return;
   }
-  console.error(`Unknown embeds subcommand '${subcommand}'.
-`);
-  printEmbedsHelp();
-  process.exit(1);
-}
-async function handleSettings(client, subcommand, rest, flags) {
-  if (!subcommand || subcommand === "help" || flags.help === true) {
-    printSettingsHelp(client);
+  if (matches(tokens, ["privacy", "auto-delete", "chats", "set"])) {
+    const period = rest[3];
+    if (!period) throw new Error("Missing period. Example: openmates settings privacy auto-delete chats set 90d");
+    await printSettingsMutationResult(client.settingsPost("auto-delete-chats", { period }), flags);
     return;
   }
-  if (subcommand === "get") {
-    const path = rest[0];
-    if (!path) {
-      console.error("Missing path.\n");
-      printSettingsHelp();
-      process.exit(1);
-    }
-    const result = await client.settingsGet(path);
-    if (flags.json === true) {
-      printJson2(result);
-    } else {
-      printGenericObject(result);
+  if (matches(tokens, ["privacy", "debug-logs", "share"])) {
+    if (flags.yes !== true && flags.confirm !== true) {
+      await confirmOrExit("Share debug logs with OpenMates support? [y/N] ");
     }
+    const duration = typeof flags.duration === "string" ? flags.duration : "1h";
+    await printSettingsMutationResult(client.settingsPost("debug-session", { duration }), flags);
     return;
   }
-  if (subcommand === "post") {
-    const path = rest[0];
-    if (!path) {
-      console.error("Missing path.\n");
-      printSettingsHelp();
-      process.exit(1);
-    }
-    const dataRaw = typeof flags.data === "string" ? flags.data : "{}";
-    const data = JSON.parse(dataRaw);
-    const result = await client.settingsPost(path, data);
-    if (flags.json === true) {
-      printJson2(result);
-    } else {
-      printGenericObject(result);
-    }
+  if (matches(tokens, ["billing", "overview"])) {
+    await printSettingsResult(client.settingsGet("billing"), flags);
     return;
   }
-  if (subcommand === "delete") {
-    const path = rest[0];
-    if (!path) {
-      console.error("Missing path.\n");
-      printSettingsHelp();
-      process.exit(1);
-    }
-    const result = await client.settingsDelete(path);
-    if (flags.json === true) {
-      printJson2(result);
-    } else {
-      printGenericObject(result);
-    }
+  if (matches(tokens, ["billing", "usage", "summaries"])) {
+    await printSettingsResult(client.settingsGet("usage/summaries"), flags);
     return;
   }
-  if (subcommand === "patch") {
-    const path = rest[0];
-    if (!path) {
-      console.error("Missing path.\n");
-      printSettingsHelp();
-      process.exit(1);
-    }
-    const dataRaw = typeof flags.data === "string" ? flags.data : "{}";
-    const data = JSON.parse(dataRaw);
-    const result = await client.settingsPatch(path, data);
+  if (matches(tokens, ["billing", "usage", "daily"])) {
+    await printSettingsResult(client.settingsGet("usage/daily-overview"), flags);
+    return;
+  }
+  if (matches(tokens, ["billing", "usage", "export"])) {
+    await printSettingsResult(client.settingsGet("usage/export"), flags);
+    return;
+  }
+  if (matches(tokens, ["billing", "usage"])) {
+    await printSettingsResult(client.settingsGet("usage"), flags);
+    return;
+  }
+  if (matches(tokens, ["billing", "invoices", "list"])) {
+    await printSettingsResult(client.listInvoices(), flags);
+    return;
+  }
+  if (matches(tokens, ["billing", "invoices", "download"])) {
+    const invoiceId = rest[2];
+    if (!invoiceId) throw new Error("Missing invoice ID.");
+    const document = await client.downloadInvoice(invoiceId);
+    const filePath = await saveDownloadedDocument(document, flags.output);
+    if (flags.json === true) printJson2({ path: filePath, filename: document.filename });
+    else console.log(`\x1B[32m\u2713\x1B[0m Invoice saved to ${filePath}`);
+    return;
+  }
+  if (matches(tokens, ["billing", "invoices", "credit-note"])) {
+    const invoiceId = rest[2];
+    if (!invoiceId) throw new Error("Missing invoice ID.");
+    const document = await client.downloadCreditNote(invoiceId);
+    const filePath = await saveDownloadedDocument(document, flags.output);
+    if (flags.json === true) printJson2({ path: filePath, filename: document.filename });
+    else console.log(`\x1B[32m\u2713\x1B[0m Credit note saved to ${filePath}`);
+    return;
+  }
+  if (matches(tokens, ["billing", "invoices", "refund"])) {
+    const invoiceId = rest[2];
+    if (!invoiceId) throw new Error("Missing invoice ID.");
+    if (flags.yes !== true) await confirmOrExit(`Request refund for invoice ${invoiceId}? [y/N] `);
+    await printSettingsMutationResult(client.requestRefund(invoiceId), flags);
+    return;
+  }
+  if (matches(tokens, ["billing", "gift-card", "redeem"]) || subcommand === "gift-card" && rest[0] === "redeem") {
+    const code = matches(tokens, ["billing", "gift-card", "redeem"]) ? rest[2] : rest[1];
+    if (!code) throw new Error("Missing gift card code.");
+    const result = await client.redeemGiftCard(code);
     if (flags.json === true) {
       printJson2(result);
+    } else if (result.success) {
+      process.stdout.write(`\x1B[32m\u2713\x1B[0m Gift card redeemed! +${result.credits_added} credits
+`);
+      process.stdout.write(`  Balance: ${result.current_credits} credits
+`);
     } else {
-      printGenericObject(result);
+      process.stdout.write(`\x1B[31m\u2717\x1B[0m ${result.message}
+`);
     }
     return;
   }
-  if (subcommand === "memories") {
-    await handleMemories(client, rest, flags);
+  if (matches(tokens, ["billing", "gift-card", "list"]) || subcommand === "gift-card" && rest[0] === "list") {
+    await printSettingsResult(client.listRedeemedGiftCards(), flags);
     return;
   }
-  if (subcommand === "gift-card") {
-    const action = rest[0];
-    if (action === "redeem") {
-      const code = rest[1];
-      if (!code) {
-        console.error("Missing gift card code.\n");
-        console.log("Usage: openmates settings gift-card redeem <CODE>");
-        process.exit(1);
-      }
-      const result = await client.redeemGiftCard(code);
-      if (flags.json === true) {
-        printJson2(result);
-      } else {
-        if (result.success) {
-          process.stdout.write(
-            `\x1B[32m\u2713\x1B[0m Gift card redeemed! +${result.credits_added} credits
-`
-          );
-          process.stdout.write(
-            `  Balance: ${result.current_credits} credits
-`
-          );
-        } else {
-          process.stdout.write(`\x1B[31m\u2717\x1B[0m ${result.message}
-`);
-        }
-      }
-      return;
-    }
-    if (action === "list") {
-      const result = await client.listRedeemedGiftCards();
+  if (matches(tokens, ["billing", "auto-topup", "low-balance", "set"])) {
+    const enabled = parseOnOff(String(flags.enabled ?? ""), "low-balance auto top-up");
+    const amount = parseRequiredNumber(flags.amount, "--amount");
+    const currency = typeof flags.currency === "string" ? flags.currency : "eur";
+    const email = typeof flags.email === "string" ? flags.email : void 0;
+    if (enabled && !email) throw new Error("Provide --email when enabling low-balance auto top-up.");
+    await printSettingsMutationResult(
+      client.settingsPost("auto-topup/low-balance", { enabled, threshold: 100, amount, currency, email }),
+      flags
+    );
+    return;
+  }
+  if (matches(tokens, ["notifications", "status"])) {
+    const user = await client.whoAmI();
+    const status = {
+      enabled: user.email_notifications_enabled ?? false,
+      preferences: user.email_notification_preferences ?? {},
+      backup_reminder_interval_days: user.backup_reminder_interval_days ?? null,
+      encrypted_notification_email_configured: Boolean(user.encrypted_notification_email)
+    };
+    flags.json === true ? printJson2(status) : printGenericObject(status);
+    return;
+  }
+  if (matches(tokens, ["notifications", "list"])) {
+    const limit = parseOptionalNumber(flags.limit, 50, "--limit");
+    await printSettingsResult(client.listNotifications(limit), flags);
+    return;
+  }
+  if (matches(tokens, ["notifications", "stream"])) {
+    const count = flags.count === void 0 ? null : parseRequiredNumber(flags.count, "--count");
+    let received = 0;
+    for await (const event of client.streamNotifications()) {
       if (flags.json === true) {
-        printJson2(result);
+        printJson2(event);
       } else {
-        printGenericObject(result);
+        printGenericObject(event);
       }
-      return;
+      received += 1;
+      if (count !== null && received >= count) break;
     }
-    console.log(`Gift card commands:
-  openmates settings gift-card redeem <CODE>    Redeem a gift card
-  openmates settings gift-card list             List redeemed gift cards`);
     return;
   }
-  console.error(`Unknown settings subcommand '${subcommand}'.
+  if (matches(tokens, ["notifications", "email", "set"])) {
+    const enabled = parseOnOff(String(flags.enabled ?? ""), "email notifications");
+    const email = typeof flags.email === "string" ? flags.email : null;
+    if (enabled && !email) throw new Error("Provide --email when enabling email notifications.");
+    const preferences = {
+      aiResponses: parseOptionalBoolean(flags["ai-responses"], true, "AI response notifications"),
+      backupReminder: parseOptionalBoolean(flags["backup-reminder"], false, "backup reminder notifications"),
+      webhookChats: parseOptionalBoolean(flags["webhook-chats"], false, "webhook chat notifications")
+    };
+    await printSettingsMutationResult(
+      client.updateEmailNotificationSettings({ enabled, email, preferences }),
+      flags
+    );
+    return;
+  }
+  if (matches(tokens, ["notifications", "backup", "set"])) {
+    const enabled = parseOnOff(String(flags.enabled ?? ""), "backup reminders");
+    const email = typeof flags.email === "string" ? flags.email : null;
+    const interval = parseRequiredNumber(flags.interval, "--interval");
+    if (enabled && !email) throw new Error("Provide --email when enabling backup reminders.");
+    await printSettingsMutationResult(
+      client.updateEmailNotificationSettings({
+        enabled,
+        email,
+        preferences: { aiResponses: false, backupReminder: enabled },
+        backup_reminder_interval_days: interval
+      }),
+      flags
+    );
+    return;
+  }
+  if (matches(tokens, ["reminders", "list"])) {
+    await printSettingsResult(client.settingsGet("reminders"), flags);
+    return;
+  }
+  if (matches(tokens, ["reminders", "update"])) {
+    const id = rest[1];
+    if (!id) throw new Error("Missing reminder ID.");
+    const body = parseDataOrFlags(flags, ["enabled"]);
+    await printSettingsMutationResult(client.settingsPatch(`reminders/${id}`, body), flags);
+    return;
+  }
+  if (matches(tokens, ["reminders", "delete"])) {
+    const id = rest[1];
+    if (!id) throw new Error("Missing reminder ID.");
+    if (flags.yes !== true) await confirmOrExit(`Delete reminder ${id}? [y/N] `);
+    await printSettingsMutationResult(client.settingsDelete(`reminders/${id}`), flags);
+    return;
+  }
+  if (matches(tokens, ["developers", "api-keys", "list"])) {
+    await printSettingsResult(client.settingsGet("api-keys"), flags);
+    return;
+  }
+  if (matches(tokens, ["developers", "api-keys", "revoke"])) {
+    const id = rest[2];
+    if (!id) throw new Error("Missing API key ID.");
+    if (flags.yes !== true) await confirmOrExit(`Revoke API key ${id}? [y/N] `);
+    await printSettingsMutationResult(client.settingsDelete(`api-keys/${id}`), flags);
+    return;
+  }
+  if (matches(tokens, ["report-issue", "create"])) {
+    const title = typeof flags.title === "string" ? flags.title : void 0;
+    const body = typeof flags.body === "string" ? flags.body : void 0;
+    if (!title || !body) throw new Error("Provide --title and --body.");
+    await printSettingsMutationResult(client.settingsPost("issues", { title, description: body }), flags);
+    return;
+  }
+  if (matches(tokens, ["report-issue", "status"])) {
+    const id = rest[1];
+    if (!id) throw new Error("Missing issue ID.");
+    await printSettingsResult(client.settingsGet(`issues/${id}/status`), flags);
+    return;
+  }
+  if (matches(tokens, ["mates", "list"])) {
+    printMates(flags.json === true);
+    return;
+  }
+  if (matches(tokens, ["mates", "info"])) {
+    const mateId = rest[1];
+    if (!mateId) throw new Error("Missing mate ID. Example: openmates settings mates info software_development");
+    printMateInfo(mateId, flags.json === true);
+    return;
+  }
+  if (matches(tokens, ["mates", "consent"])) {
+    if (flags.yes !== true) await confirmOrExit("Record consent for mate settings? [y/N] ");
+    await printSettingsMutationResult(client.settingsPost("user/consent/mates", { consent: true }), flags);
+    return;
+  }
+  if (matches(tokens, ["newsletter", "categories"]) && tokens.length === 2) {
+    await printSettingsResult(client.getNewsletterCategories(), flags);
+    return;
+  }
+  if (matches(tokens, ["newsletter", "categories", "set"])) {
+    const categories = {
+      updates_and_announcements: parseOptionalBoolean(flags.updates, true, "updates newsletter"),
+      tips_and_tricks: parseOptionalBoolean(flags.tips, true, "tips newsletter"),
+      daily_inspirations: parseOptionalBoolean(flags.daily, true, "daily inspirations newsletter")
+    };
+    await printSettingsMutationResult(client.updateNewsletterCategories(categories), flags);
+    return;
+  }
+  if (matches(tokens, ["newsletter", "subscribe"])) {
+    const email = rest[1];
+    if (!email) throw new Error("Missing email. Example: openmates settings newsletter subscribe you@example.com");
+    const language = typeof flags.language === "string" ? flags.language : "en";
+    const darkmode = parseOptionalBoolean(flags.darkmode, false, "newsletter dark mode");
+    await printSettingsMutationResult(client.subscribeNewsletter(email, language, darkmode), flags);
+    return;
+  }
+  if (matches(tokens, ["newsletter", "confirm"])) {
+    const token = rest[1];
+    if (!token) throw new Error("Missing confirmation token.");
+    await printSettingsMutationResult(client.confirmNewsletter(token), flags);
+    return;
+  }
+  if (matches(tokens, ["newsletter", "unsubscribe"])) {
+    const token = rest[1];
+    if (!token) throw new Error("Missing unsubscribe token.");
+    await printSettingsMutationResult(client.unsubscribeNewsletter(token), flags);
+    return;
+  }
+  if (subcommand === "memories") {
+    await handleMemories(client, rest, flags);
+    return;
+  }
+  const webOnly = findSettingsInfoCommand(tokens);
+  if (webOnly) {
+    printSettingsInfoCommand(client, webOnly, flags.json === true);
+    return;
+  }
+  console.error(`Unknown settings command '${tokens.join(" ")}'.
 `);
-  printSettingsHelp();
+  printSettingsHelp(client, [subcommand]);
   process.exit(1);
 }
 async function handleMemories(client, rest, flags) {
@@ -8132,7 +9742,57 @@ async function sendMessageStreaming(client, params, redactor) {
       processedRawLength = raw.length;
     }
   };
-  const encryptedEmbeds = [];
+  const onSubChatEvent = (event) => {
+    if (params.json) return;
+    clearTyping();
+    const payload = event.payload;
+    if (event.type === "spawn_sub_chats") {
+      const count = Array.isArray(payload.sub_chats) ? payload.sub_chats.length : 0;
+      process.stderr.write(
+        `\x1B[2mStarting ${count} sub-chat${count === 1 ? "" : "s"} for parallel research...\x1B[0m
+`
+      );
+      return;
+    }
+    if (event.type === "sub_chat_progress") {
+      const completed = typeof payload.completed === "number" ? payload.completed : null;
+      const total = typeof payload.total === "number" ? payload.total : null;
+      const status = typeof payload.status === "string" ? payload.status : "running";
+      const progress = completed !== null && total !== null ? `${completed}/${total}` : status;
+      process.stderr.write(`\x1B[2mSub-chats: ${progress} ${status}\x1B[0m
+`);
+      return;
+    }
+    if (event.type === "sub_chat_confirmation_resolved") {
+      const status = typeof payload.status === "string" ? payload.status : "resolved";
+      process.stderr.write(`\x1B[2mSub-chat approval ${status}.\x1B[0m
+`);
+      return;
+    }
+    if (event.type === "awaiting_user_input") {
+      process.stderr.write(
+        "\x1B[33mA sub-chat needs additional user input. Continue this chat in the web app if the parent cannot finish.\x1B[0m\n"
+      );
+    }
+  };
+  const onSubChatApprovalRequest = async (request) => {
+    if (params.autoApproveSubChats) return true;
+    clearTyping();
+    const count = request.subChats.length;
+    const remaining = request.remainingSubChats === null ? "" : ` (${request.remainingSubChats} remaining for this parent chat)`;
+    process.stderr.write(
+      `\x1B[33mDeep research wants to start ${count} additional sub-chat${count === 1 ? "" : "s"}${remaining}.\x1B[0m
+`
+    );
+    const rl = createInterface3({ input: process.stdin, output: process.stderr });
+    try {
+      const answer = await rl.question("Approve? [y/N] ");
+      return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+    } finally {
+      rl.close();
+    }
+  };
+  const preparedEmbeds = [];
   let finalMessage = params.message;
   if (params.message.includes("@")) {
     try {
@@ -8192,8 +9852,44 @@ async function sendMessageStreaming(client, params, redactor) {
             try {
               const session = client.getSession();
               const uploadResult = await uploadFile(fe.localPath, session);
-              fe.embed.content = toonEncodeContent({
-                type: fe.embed.type === "pdf" ? "pdf" : "image",
+              const embedType = fe.embed.type;
+              const audioTranscription = embedType === "audio-recording" ? await transcribeUploadedAudio(
+                uploadResult,
+                fe.displayName,
+                session,
+                { chatId: params.chatId, requestId: uploadResult.embed_id }
+              ) : null;
+              const uploadedContent = embedType === "audio-recording" ? {
+                app_id: "audio",
+                skill_id: "transcribe",
+                type: "audio-recording",
+                status: "finished",
+                filename: fe.displayName,
+                mime_type: uploadResult.content_type,
+                transcript: audioTranscription?.transcript ?? null,
+                transcript_original: audioTranscription?.transcript_original ?? null,
+                transcript_corrected: audioTranscription?.transcript_corrected ?? null,
+                use_corrected: audioTranscription?.use_corrected ?? null,
+                correction_model: audioTranscription?.correction_model ?? null,
+                model: audioTranscription?.model ?? null,
+                s3_base_url: uploadResult.s3_base_url,
+                files: uploadResult.files,
+                aes_key: uploadResult.aes_key,
+                aes_nonce: uploadResult.aes_nonce,
+                vault_wrapped_aes_key: uploadResult.vault_wrapped_aes_key
+              } : embedType === "pdf" ? {
+                type: "pdf",
+                status: "processing",
+                filename: fe.displayName,
+                page_count: uploadResult.page_count ?? null,
+                content_hash: uploadResult.content_hash,
+                s3_base_url: uploadResult.s3_base_url,
+                files: uploadResult.files,
+                aes_key: uploadResult.aes_key,
+                aes_nonce: uploadResult.aes_nonce,
+                vault_wrapped_aes_key: uploadResult.vault_wrapped_aes_key
+              } : {
+                type: "image",
                 app_id: "images",
                 skill_id: "upload",
                 status: "finished",
@@ -8205,10 +9901,15 @@ async function sendMessageStreaming(client, params, redactor) {
                 aes_nonce: uploadResult.aes_nonce,
                 vault_wrapped_aes_key: uploadResult.vault_wrapped_aes_key,
                 ai_detection: uploadResult.ai_detection
-              });
-              fe.embed.status = fe.embed.type === "pdf" ? "processing" : "finished";
+              };
+              fe.embed.content = toonEncodeContent(uploadedContent);
+              fe.embed.status = embedType === "pdf" ? "processing" : "finished";
               fe.embed.contentHash = uploadResult.content_hash;
               fe.embed.embedId = uploadResult.embed_id;
+              fe.referenceBlock = createEmbedReferenceBlock(
+                embedType,
+                uploadResult.embed_id
+              );
               if (!params.json) {
                 process.stderr.write(
                   `\x1B[32m  \u2713\x1B[0m \x1B[2m${fe.displayName} uploaded\x1B[0m
@@ -8239,31 +9940,7 @@ async function sendMessageStreaming(client, params, redactor) {
         if (embedRefs) {
           finalMessage += embedRefs;
         }
-        try {
-          const { masterKey, userId } = client.getEmbedEncryptionKeys();
-          for (const fe of fileResult.embeds) {
-            const encrypted = await encryptEmbed(
-              fe.embed,
-              masterKey,
-              null,
-              // chatKey — not available in CLI yet for new chats
-              params.chatId || "new",
-              // will be replaced by server
-              "pending",
-              // messageId set during send
-              userId
-            );
-            if (encrypted) {
-              encryptedEmbeds.push(encrypted);
-            }
-          }
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          process.stderr.write(
-            `\x1B[33mWarning:\x1B[0m Embed encryption failed: ${msg}. Files sent without encryption.
-`
-          );
-        }
+        preparedEmbeds.push(...fileResult.embeds.map((fileEmbed) => fileEmbed.embed));
       }
       if (parsed.resolved.length > 0 && !params.json) {
         clearTyping();
@@ -8278,12 +9955,18 @@ async function sendMessageStreaming(client, params, redactor) {
     } catch {
     }
   }
+  const urlResult = prepareUrlEmbeds(finalMessage);
+  finalMessage = urlResult.message;
+  preparedEmbeds.push(...urlResult.embeds);
   const result = await client.sendMessage({
     message: finalMessage,
     chatId: params.chatId,
     incognito: params.incognito,
     onStream,
-    encryptedEmbeds: encryptedEmbeds.length > 0 ? encryptedEmbeds : void 0
+    onSubChatEvent,
+    onSubChatApprovalRequest,
+    autoApproveSubChats: params.autoApproveSubChats,
+    preparedEmbeds: preparedEmbeds.length > 0 ? preparedEmbeds : void 0
   });
   clearTyping();
   if (!params.json) {
@@ -8356,21 +10039,13 @@ async function sendMessageStreaming(client, params, redactor) {
   }
   return result;
 }
-function printIncognitoHistory(history) {
-  if (history.length === 0) {
-    console.log("No incognito history.");
+function printIncognitoNoHistoryNotice(json) {
+  const message = "Incognito chats are not stored. There is no incognito history to show or clear.";
+  if (json) {
+    printJson2({ history: [], stored: false, message });
     return;
   }
-  header(`Incognito history  (${history.length} messages)`);
-  console.log();
-  for (const msg of history) {
-    const ts = formatTimestamp(Math.floor(msg.createdAt / 1e3));
-    const roleLabel = msg.role === "user" ? "\x1B[1mYou\x1B[0m" : "\x1B[36mAssistant\x1B[0m";
-    process.stdout.write(`${roleLabel}  \x1B[2m${ts}\x1B[0m
-`);
-    console.log(msg.content);
-    console.log();
-  }
+  console.log(message);
 }
 var SEP = `\x1B[2m${"\u2500".repeat(60)}\x1B[0m`;
 function parseMessageSegments(content) {
@@ -9337,23 +11012,23 @@ async function handleMentions(client, subcommand, _rest, flags) {
     const context = await client.buildMentionContext();
     const allOptions = listMentionOptions(context);
     const normalizedQuery = query.toLowerCase().replace(/[\s_-]+/g, "");
-    const matches = allOptions.filter((opt) => {
+    const matches2 = allOptions.filter((opt) => {
       const normalizedName = opt.displayName.toLowerCase().replace(/[@\s_-]+/g, "");
       const normalizedDesc = opt.description.toLowerCase().replace(/[\s_-]+/g, "");
       return normalizedName.includes(normalizedQuery) || normalizedDesc.includes(normalizedQuery);
     }).slice(0, 15);
     if (flags.json === true) {
-      console.log(JSON.stringify(matches, null, 2));
+      console.log(JSON.stringify(matches2, null, 2));
       return;
     }
-    if (matches.length === 0) {
+    if (matches2.length === 0) {
       console.log(`No mentions matching '${query}'.`);
       return;
     }
     process.stdout.write(`
 \x1B[1mMatches for '${query}':\x1B[0m
 `);
-    for (const m of matches) {
+    for (const m of matches2) {
       const typeLabel = m.type.replace("_", " ");
       process.stdout.write(
         `  \x1B[36m${m.displayName.padEnd(35)}\x1B[0m \x1B[2m${m.description} (${typeLabel})\x1B[0m
@@ -9498,7 +11173,7 @@ Commands:
   openmates apps [--help]                    App skill commands (list, run, ...)
   openmates mentions [--help]                List available @mentions
   openmates embeds [--help]                  Embed commands (show)
-  openmates settings [--help]                Memories
+  openmates settings [--help]                Predefined settings commands
   openmates inspirations [--lang <code>] [--json]   Daily inspirations
   openmates newchatsuggestions [--limit <n>] [--json]   Personalized new chat suggestions
   openmates server [--help]                   Server management (install, start, stop, ...)
@@ -9516,15 +11191,15 @@ function printChatsHelp() {
   openmates chats show <chat-id> [--raw] [--json]
   openmates chats open [<n>] [--json]
   openmates chats search <query> [--json]
-  openmates chats new <message> [--json]
-  openmates chats send [--chat <id>] [--incognito] <message> [--json]
-  openmates chats send --chat <id> --followup <n> [--json]
+  openmates chats new <message> [--json] [--auto-approve]
+  openmates chats send [--chat <id>] [--incognito] <message> [--json] [--auto-approve]
+  openmates chats send --chat <id> --followup <n> [--json] [--auto-approve]
   openmates chats download <chat-id> [--output <path>] [--zip] [--json]
   openmates chats delete <id1> [id2] [id3] ... [--yes]
   openmates chats share [<chat-id>] [--expires <seconds>] [--password <pwd>] [--json]
   openmates chats incognito <message> [--json]
-  openmates chats incognito-history [--json]
-  openmates chats incognito-clear
+  openmates chats incognito-history [--json]      Deprecated: incognito stores no history
+  openmates chats incognito-clear                 Deprecated: incognito stores no history
 
 Options for 'list':
   --limit <n>   Number of chats per page (default: 10)
@@ -9545,6 +11220,10 @@ Options for 'send':
                    typing the full message (requires --chat)
   --incognito      Send without saving to chat history
 
+Options for 'new', 'send', and 'incognito':
+  --auto-approve   Automatically approve server-requested sub-chat batches.
+                   Without this, the CLI prompts in the terminal like the web app.
+
 Options for 'download':
   --output <path>  Target directory (default: current directory)
   --zip            Create a .zip archive instead of a folder
@@ -9648,72 +11327,33 @@ Examples:
   openmates inspirations --lang de
   openmates inspirations --json`);
 }
-function printSettingsHelp(client) {
+function printSettingsHelp(client, filter) {
+  const commands = [...SETTINGS_EXECUTABLE_COMMANDS, ...SETTINGS_INFO_COMMANDS].filter((command) => {
+    if (!filter || filter.length === 0) return true;
+    return filter.every((part, index) => command.path[index] === part);
+  }).sort((a, b) => a.path.join(" ").localeCompare(b.path.join(" ")));
   const appUrl = client ? deriveAppUrl(client.apiUrl) : "https://openmates.org";
-  const s = (path) => `${appUrl}/#settings/${path}`;
-  const h = (title) => `
-  \x1B[1m${title}\x1B[0m`;
-  console.log(`\x1B[1mSettings\x1B[0m
-${h("Account")}
-    openmates settings post user/username --data '{"encrypted_username":"..."}'
-    openmates settings post user/timezone --data '{"timezone":"Europe/Berlin"}'
-    openmates settings get export-account-manifest      GDPR data export manifest
-    openmates settings get export-account-data          GDPR data export
-    openmates settings post import-chat --data '<json>' Import a chat
-    openmates settings get storage [--json]             Storage overview
-    openmates settings get chats [--json]               Chat statistics
-    openmates settings get delete-account-preview       Preview account deletion
-    \x1B[2mSecurity (passkeys, password, 2FA, sessions): ${s("account/security")}\x1B[0m
-    \x1B[2mDelete account: ${s("account/delete")}\x1B[0m
-${h("Billing")}
-    openmates settings get billing [--json]             Balance & billing overview
-    openmates settings post auto-topup/low-balance --data '{"enabled":true,"amount":1000,"currency":"eur"}'
-    openmates settings get usage [--json]               Full usage history
-    openmates settings get usage/summaries [--json]     Usage summaries by type
-    openmates settings get usage/daily-overview [--json]
-    openmates settings get usage/export [--json]        Export usage as CSV
-    openmates settings gift-card redeem <CODE>          Redeem a gift card
-    openmates settings gift-card list                   List redeemed gift cards
-    \x1B[2mBuy credits: ${s("billing/buy-credits")}\x1B[0m
-    \x1B[2mMonthly auto top-up: ${s("billing/auto-topup/monthly")}\x1B[0m
-    \x1B[2mInvoices: ${s("billing/invoices")}\x1B[0m
-    \x1B[2mGift cards (buy/manage): ${s("billing/gift-cards")}\x1B[0m
-${h("Privacy")}
-    openmates settings post auto-delete-chats --data '{"period":"90d"}'
-    \x1B[2mHide personal data / anonymization: ${s("privacy/hide-personal-data")}\x1B[0m
-${h("Notifications")}
-    openmates settings get reminders [--json]           Active reminders
-    \x1B[2mChat notifications: ${s("notifications/chat")}\x1B[0m
-    \x1B[2mBackup reminders: ${s("notifications/backup")}\x1B[0m
-${h("Interface")}
-    openmates settings post user/language --data '{"language":"en"}'
-    openmates settings post user/darkmode --data '{"dark_mode":true}'
-    openmates settings post ai-model-defaults --data '{"simple":"...","complex":"..."}'
-${h("Apps")}
-    openmates apps list                                 Same as Apps
-    openmates apps <app-id>                             App details
-    \x1B[2mWeb: ${s("app_store")}\x1B[0m
-${h("Mates")}
-    \x1B[2m${s("mates")}\x1B[0m
-${h("Memories & app settings")}
-    openmates settings memories list [--app-id <id>] [--item-type <type>] [--json]
-    openmates settings memories types [--app-id <id>] [--json]
-    openmates settings memories create --app-id <id> --item-type <type> --data '<json>'
-    openmates settings memories update --id <id> --app-id <id> --item-type <type> --data '<json>'
-    openmates settings memories delete --id <entry-id>
-${h("Developers")}
-    openmates settings get api-keys [--json]            List API keys
-    openmates settings delete api-keys/<key-id>         Revoke API key
-    \x1B[2mCreate API key (shows secret once): ${s("developers/api-keys")}\x1B[0m
-    \x1B[2mManage devices: ${s("developers/devices")}\x1B[0m
-${h("Support")}
-    openmates settings post issues --data '<json>'      Report an issue
-
-\x1B[2mWeb app only (security \u2014 manage in browser):\x1B[0m
-  \x1B[2mPasskeys:   ${s("account/security/passkeys")}\x1B[0m
-  \x1B[2mPassword:   ${s("account/security/password")}\x1B[0m
-  \x1B[2m2FA:        ${s("account/security/2fa")}\x1B[0m
-  \x1B[2mSessions:   ${s("account/security/sessions")}\x1B[0m`);
+  const title = filter && filter.length > 0 ? `Settings: ${filter.join(" ")}` : "Settings";
+  header(title);
+  console.log("Predefined commands only. Raw settings get/post/patch/delete is not supported.\n");
+  if (commands.length === 0) {
+    console.log("No matching settings commands.");
+    return;
+  }
+  for (const command of commands) {
+    const isInfoOnly = SETTINGS_INFO_COMMANDS.includes(command);
+    const label = `openmates settings ${command.path.join(" ")}`;
+    process.stdout.write(`  ${label.padEnd(58)} ${command.description}`);
+    if (isInfoOnly) process.stdout.write(" \x1B[2m(info/web-only)\x1B[0m");
+    process.stdout.write("\n");
+    if (filter && filter.length > 0) {
+      for (const example of command.examples) process.stdout.write(`      e.g. ${example}
+`);
+      if (command.webPath) process.stdout.write(`      web: ${appUrl}/#settings/${command.webPath}
+`);
+    }
+  }
+  console.log("\nUse --help after a group for examples, e.g. openmates settings billing --help");
 }
 function printNewChatSuggestionsHelp() {
   console.log(`New chat suggestions command:
@@ -9889,6 +11529,7 @@ export {
   deriveAppUrl,
   OpenMatesClient,
   parseNewChatSuggestionText,
+  defaultCloneBranchForVersion,
   serializeToYaml,
   getExtForLang
 };