openmates 0.18.0-alpha.1 → 0.18.0-alpha.3

package/dist/{chunk-RLOO6QKC.js → chunk-65ZA6VF2.js}

@@ -20131,12 +20131,12 @@ var ACCOUNT_EXPORT_FORBIDDEN_VALUE_PATTERNS = [
 ];
 async function writeAccountExportArchive(bundle, flags = {}) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join11, dirname: dirname10 } = await import("path");
+  const { join: join12, dirname: dirname11 } = await import("path");
   const exportId = safeArchiveSegment(String(bundle.export.export_id ?? `export-${Date.now()}`));
   const archiveFormat = flags.format === "directory" ? "directory" : "zip";
   const password = typeof flags.password === "string" && flags.password.length > 0 ? flags.password : null;
   if (password && archiveFormat !== "zip") throw new Error("Password-protected account export is only supported for zip format.");
-  const outputPath = typeof flags.output === "string" ? flags.output : join11(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
+  const outputPath = typeof flags.output === "string" ? flags.output : join12(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
   const zip = archiveFormat === "zip" ? new JSZip3() : null;
   const writtenFiles = [];
   async function writeArchiveText(relativePath, content) {
@@ -20147,8 +20147,8 @@ async function writeAccountExportArchive(bundle, flags = {}) {
       return;
     }
     const stagingDir = outputPath;
-    const fullPath = join11(stagingDir, relativePath);
-    await mkdir2(dirname10(fullPath), { recursive: true });
+    const fullPath = join12(stagingDir, relativePath);
+    await mkdir2(dirname11(fullPath), { recursive: true });
     await writeFile2(fullPath, content, "utf-8");
     writtenFiles.push(relativePath);
   }
@@ -20165,7 +20165,7 @@ async function writeAccountExportArchive(bundle, flags = {}) {
   }
   await writeAccountExportChatFiles(domainPayloads.chats ?? [], writeArchiveText);
   if (archiveFormat === "directory") return { output: outputPath, format: "directory", files: writtenFiles.length };
-  await mkdir2(dirname10(outputPath), { recursive: true });
+  await mkdir2(dirname11(outputPath), { recursive: true });
   const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
   await writeFile2(outputPath, password ? encryptZipBuffer(zipBuffer, password) : zipBuffer);
   return { output: outputPath, format: "zip", files: writtenFiles.length, ...password ? { encrypted: true } : {} };
@@ -24298,10 +24298,10 @@ var OpenMatesBenchmark = class {
 // src/cli.ts
 import { createInterface as createInterface5 } from "readline/promises";
 import { stdin as stdin3, stdout as stdout2 } from "process";
-import { existsSync as existsSync13, readFileSync as readFileSync12, realpathSync as realpathSync2, writeFileSync as writeFileSync9 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { basename as basename3, dirname as dirname9 } from "path";
-import { createHash as createHash14, randomBytes as randomBytes9, randomUUID as randomUUID14 } from "crypto";
+import { existsSync as existsSync13, readFileSync as readFileSync12, realpathSync as realpathSync2, writeFileSync as writeFileSync10 } from "fs";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { basename as basename4, dirname as dirname10 } from "path";
+import { createHash as createHash14, randomBytes as randomBytes9, randomUUID as randomUUID15 } from "crypto";
 import { arch as arch2, platform as platform3 } from "os";
 import { parse as parseYaml } from "yaml";
 import WebSocket2 from "ws";
@@ -26479,9 +26479,9 @@ function formatTs(ts) {
 }
 
 // src/server.ts
-import { execFileSync as execFileSync3, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes8, randomUUID as randomUUID10 } from "crypto";
-import { appendFileSync, chmodSync as chmodSync4, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync9, mkdirSync as mkdirSync6, mkdtempSync, openSync as openSync2, readFileSync as readFileSync7, readSync, readdirSync as readdirSync3, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import { execFileSync as execFileSync4, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
+import { createHash as createHash12, randomBytes as randomBytes8, randomUUID as randomUUID11 } from "crypto";
+import { appendFileSync, chmodSync as chmodSync5, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync9, mkdirSync as mkdirSync6, mkdtempSync, openSync as openSync2, readFileSync as readFileSync7, readSync, readdirSync as readdirSync4, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
 import { createInterface as createInterface3 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
 import { homedir as homedir6 } from "os";
@@ -26955,12 +26955,11 @@ function planUpdate(input) {
 function planBackup(input) {
   const role = parseServerRole(input.role);
   const contentsByRole = {
-    core: ["postgres-dump", "directus-uploads", "directus-extensions", "vault-data", "vault-setup-data", "runtime-env", "runtime-config", "manifest", "checksums"],
-    upload: ["vault-data", "vault-setup-data", "runtime-env", "runtime-config", "manifest", "checksums"],
-    preview: ["runtime-env", "runtime-config", "preview-cache", "manifest", "checksums"]
+    core: ["postgres-dump", "runtime-env", "runtime-config", "manifest", "checksums"],
+    upload: ["runtime-env", "runtime-config", "manifest", "checksums"],
+    preview: ["runtime-env", "runtime-config", "manifest", "checksums"]
   };
   const contents = [...contentsByRole[role]];
-  if (input.includeObservability) contents.push("openobserve-data", "prometheus-data");
   return { role, contents, fileMode: 384 };
 }
 function planRestore(input) {
@@ -27193,9 +27192,38 @@ function shouldAutoInstallRuntimeMonitoringServices(env) {
   return env.OPENMATES_SKIP_RUNTIME_MONITORING !== "1";
 }
 
+// src/serverBackupArchive.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { chmodSync as chmodSync3, lstatSync, readdirSync as readdirSync3, renameSync, rmSync as rmSync4 } from "fs";
+import { randomUUID as randomUUID8 } from "crypto";
+function assertRegularBackupTree(path2) {
+  const stat2 = lstatSync(path2);
+  if (stat2.isDirectory()) {
+    for (const entry of readdirSync3(path2)) assertRegularBackupTree(`${path2}/${entry}`);
+    return;
+  }
+  if (!stat2.isFile() || stat2.nlink !== 1) {
+    throw new Error(`Backup archive refused unsafe entry: ${path2}`);
+  }
+}
+function publishServerBackupArchive(sourceDir, archivePath, options = {}) {
+  assertRegularBackupTree(sourceDir);
+  const temporaryArchivePath = `${archivePath}.tmp-${randomUUID8()}`;
+  const previousUmask = process.umask(63);
+  try {
+    execFileSync3(options.tarCommand ?? "tar", ["-czf", temporaryArchivePath, "-C", sourceDir, "."], { stdio: "pipe" });
+    chmodSync3(temporaryArchivePath, 384);
+    renameSync(temporaryArchivePath, archivePath);
+    chmodSync3(archivePath, 384);
+  } finally {
+    process.umask(previousUmask);
+    rmSync4(temporaryArchivePath, { force: true });
+  }
+}
+
 // src/serverHealth.ts
 import dnsModule, { promises as dns } from "dns";
-import { createHmac as createHmac4, randomUUID as randomUUID8 } from "crypto";
+import { createHmac as createHmac4, randomUUID as randomUUID9 } from "crypto";
 import { promises as fs } from "fs";
 import { isIP } from "net";
 import { request as httpsRequest } from "https";
@@ -27578,7 +27606,7 @@ async function resolveGenericWebhookTarget(rawUrl, allowLocalDevelopmentFixture
 async function sendGenericWebhook(target, secret, payload, allowLocalDevelopmentFixture = false) {
   const { url, addresses } = await resolveGenericWebhookTarget(target, allowLocalDevelopmentFixture);
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const eventId = randomUUID8();
+  const eventId = randomUUID9();
   const signed = signRuntimeWebhookPayload(payload, secret, timestamp, eventId);
   const selected = addresses[0];
   await new Promise((resolve11, reject) => {
@@ -27787,7 +27815,7 @@ function signRuntimeWebhookPayload(payload, secret, timestamp, eventId) {
 
 // src/serverUpdateState.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { chmodSync as chmodSync3, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync4, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname5, join as join6 } from "path";
 function serverUpdateStatusFile(installPath, role) {
   return join6(installPath, ".openmates", `${role}-update-status.json`);
@@ -27811,8 +27839,8 @@ function writeServerUpdateStatus(installPath, role, status) {
   const temporaryPath = `${filePath}.${process.pid}.${randomBytes7(4).toString("hex")}.tmp`;
   writeFileSync4(temporaryPath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
 `, { mode: 384 });
-  renameSync(temporaryPath, filePath);
-  chmodSync3(filePath, 384);
+  renameSync2(temporaryPath, filePath);
+  chmodSync4(filePath, 384);
 }
 function acquireServerUpdateLock(installPath) {
   const stateDir2 = join6(installPath, ".openmates");
@@ -27839,13 +27867,13 @@ function acquireServerUpdateLock(installPath) {
   return () => {
     closeSync(descriptor);
     if (existsSync8(lockPath) && readFileSync6(lockPath, "utf8").trim() === ownershipToken) {
-      rmSync4(lockPath);
+      rmSync5(lockPath);
     }
   };
 }
 
 // src/serverQuickTest.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var QUICK_TEST_RESPONSE_TIMEOUT_MS = 12e4;
 var QUICK_TEST_WEB_QUERY = "site:openmates.org OpenMates";
 var QUICK_TEST_EXPECTED_RESPONSE = "server quick test passed";
@@ -27911,7 +27939,7 @@ function decideQuickServerTestAction(input) {
 async function runQuickServerTest(client, options = {}) {
   const now = options.now ?? Date.now;
   const checks = [];
-  const chatId = randomUUID9();
+  const chatId = randomUUID10();
   let chatMayExist = false;
   checks.push({ id: "account.session", status: "passed", duration_ms: 0 });
   const createStarted = now();
@@ -28042,6 +28070,7 @@ var HEALTH_REQUEST_TIMEOUT_MS = 5e3;
 var CHECKSUM_BUFFER_BYTES = 1024 * 1024;
 var ENV_BACKUP_PREFIX = ".env.openmates-backup-";
 var ENV_BACKUP_RETENTION_COUNT = 5;
+var BACKUP_FORMAT_VERSION = 2;
 var IMAGE_CHANNEL_TAGS = {
   stable: MAIN_BRANCH,
   main: MAIN_BRANCH,
@@ -28268,7 +28297,7 @@ function beginEngineeringRuntimeOperation(installPath, operationType, services)
     "dev-stack"
   ];
   for (const service of services) args.push("--service", service);
-  const output = execFileSync3("python3", args, {
+  const output = execFileSync4("python3", args, {
     cwd: installPath,
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -28279,7 +28308,7 @@ function beginEngineeringRuntimeOperation(installPath, operationType, services)
 }
 function finishEngineeringRuntimeOperation(installPath, operationKey, status) {
   const manager = join7(installPath, "scripts", "engineering_control_plane.py");
-  execFileSync3(
+  execFileSync4(
     "python3",
     [manager, "operation", "update", "--operation-key", operationKey, "--status", status],
     { cwd: installPath, stdio: ["ignore", "ignore", "pipe"] }
@@ -28939,13 +28968,13 @@ function targetSourceLinks(imageTag, templateRef) {
   };
 }
 function installedImageMetadata(input) {
-  const containerId = execFileSync3(
+  const containerId = execFileSync4(
     "docker",
     [...composeArgs(input.installPath, input.withOverrides, "image", input.role), "ps", "-q", ROLE_PROVENANCE_SERVICE[input.role]],
     { cwd: input.installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
   ).trim();
   if (!containerId) throw new Error("updated_container_unavailable");
-  const labels = JSON.parse(execFileSync3(
+  const labels = JSON.parse(execFileSync4(
     "docker",
     ["inspect", "--format", "{{json .Config.Labels}}", containerId],
     { cwd: input.installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
@@ -29012,9 +29041,9 @@ function readEnvContent(installPath) {
   return existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "";
 }
 function pruneEnvBackups(installPath) {
-  const backups = readdirSync3(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
+  const backups = readdirSync4(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
   for (const backup of backups.slice(0, Math.max(0, backups.length - ENV_BACKUP_RETENTION_COUNT))) {
-    rmSync5(join7(installPath, backup), { force: true });
+    rmSync6(join7(installPath, backup), { force: true });
   }
 }
 function backupEnvFile(installPath) {
@@ -29022,7 +29051,7 @@ function backupEnvFile(installPath) {
   if (!existsSync9(envPath)) return null;
   const backupPath = join7(installPath, `${ENV_BACKUP_PREFIX}${nowStamp()}`);
   copyFileSync2(envPath, backupPath);
-  chmodSync4(backupPath, 384);
+  chmodSync5(backupPath, 384);
   pruneEnvBackups(installPath);
   return backupPath;
 }
@@ -29030,7 +29059,7 @@ function writeEnvContent(installPath, content) {
   const envPath = envPathForInstall(installPath);
   mkdirSync6(dirname6(envPath), { recursive: true });
   writeFileSync5(envPath, content, { mode: 384 });
-  chmodSync4(envPath, 384);
+  chmodSync5(envPath, 384);
 }
 function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
   let content = readEnvContent(installPath);
@@ -29203,7 +29232,7 @@ for item in checks:
 print(json.dumps({"ok": True, "presence": presence}))
 `;
   try {
-    const output = execFileSync3(
+    const output = execFileSync4(
       "docker",
       ["exec", "-e", `OPENMATES_SECRET_CHECKS=${JSON.stringify(checks)}`, container, "python", "-c", script],
       { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
@@ -29258,7 +29287,7 @@ function hashFile(path2) {
 function writeChecksums(rootDir) {
   const lines = [];
   const walk = (dir) => {
-    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
       const path2 = join7(dir, entry.name);
       if (entry.isDirectory()) {
         walk(path2);
@@ -29296,19 +29325,20 @@ function createServerBackup(installPath, role, options = {}) {
   const backupDir = roleBackupDir(installPath, role);
   mkdirSync6(backupDir, { recursive: true, mode: 448 });
   const archivePath = options.output ? resolve6(options.output) : join7(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
+  mkdirSync6(dirname6(archivePath), { recursive: true, mode: 448 });
   const tempDir = mkdtempSync(join7(backupDir, ".tmp-"));
   const env = readEnvMap(installPath);
   const manifest = {
     role,
+    backup_format_version: BACKUP_FORMAT_VERSION,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     cli_version: getPackageVersion(),
     image_tag: getEnvVar(existsSync9(join7(installPath, ".env")) ? readFileSync7(join7(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
-    include_observability: options.includeObservability === true,
-    contents: plan.contents
+    recovery_scope: role === "core" ? "database-and-runtime-only" : "runtime-only",
+    include_observability: false,
+    contents: plan.contents.filter((content) => content !== "runtime-env" || existsSync9(join7(installPath, ".env"))).filter((content) => content !== "runtime-config" || existsSync9(join7(installPath, "config")))
   };
   try {
-    writeFileSync5(join7(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
-`);
     copyIfExists(join7(installPath, ".env"), join7(tempDir, "runtime", ".env"));
     copyIfExists(join7(installPath, "config"), join7(tempDir, "runtime", "config"));
     if (role === "core") {
@@ -29329,19 +29359,13 @@ function createServerBackup(installPath, role, options = {}) {
         closeSync2(dumpFile);
       }
     }
-    for (const item of [
-      [join7(installPath, "backend", "core", "uploads"), join7(tempDir, "directus-uploads")],
-      [join7(installPath, "backend", "core", "extensions"), join7(tempDir, "directus-extensions")],
-      [join7(installPath, "backend", role, "vault"), join7(tempDir, `${role}-vault-config`)]
-    ]) {
-      copyIfExists(item[0], item[1]);
-    }
+    writeFileSync5(join7(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, { mode: 384 });
     writeChecksums(tempDir);
-    execSync(`tar -czf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)} .`, { stdio: "pipe" });
-    chmodSync4(archivePath, plan.fileMode);
+    publishServerBackupArchive(tempDir, archivePath);
     return archivePath;
   } finally {
-    rmSync5(tempDir, { recursive: true, force: true });
+    rmSync6(tempDir, { recursive: true, force: true });
   }
 }
 function restoreServerBackup(installPath, role, file) {
@@ -29357,19 +29381,30 @@ function restoreServerBackup(installPath, role, file) {
     if (!existsSync9(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
     const manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
     if (manifest.role !== role) throw new Error(`Backup role '${manifest.role}' does not match requested role '${role}'.`);
+    if (role === "core" && manifest.backup_format_version === BACKUP_FORMAT_VERSION && manifest.recovery_scope !== "full-core") {
+      throw new Error("This backup records database and runtime state only; refusing unsafe full core restore.");
+    }
     copyIfExists(join7(tempDir, "runtime", ".env"), join7(installPath, ".env"));
     copyIfExists(join7(tempDir, "runtime", "config"), join7(installPath, "config"));
     const postgresDump = join7(tempDir, "postgres.sql");
     if (role === "core" && existsSync9(postgresDump)) {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
-      execSync(`docker exec -i cms-database psql -v ON_ERROR_STOP=1 -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`, {
-        input: readFileSync7(postgresDump),
-        stdio: ["pipe", "pipe", "pipe"]
-      });
+      const dumpFile = openSync2(postgresDump, "r");
+      try {
+        const result = spawnSync(
+          "docker",
+          ["exec", "-i", "cms-database", "psql", "-v", "ON_ERROR_STOP=1", "-U", databaseUser, databaseName],
+          { encoding: "utf-8", stdio: [dumpFile, "pipe", "pipe"] }
+        );
+        if (result.error) throw result.error;
+        if (result.status !== 0) throw new Error(result.stderr || `psql exited with status ${result.status}`);
+      } finally {
+        closeSync2(dumpFile);
+      }
     }
   } finally {
-    rmSync5(tempDir, { recursive: true, force: true });
+    rmSync6(tempDir, { recursive: true, force: true });
   }
 }
 function restoreStopServices(installPath, withOverrides, installMode, role) {
@@ -29992,7 +30027,7 @@ async function runUpdateCompletionEmailGate(input) {
       deliveryId: deliveryPlan.deliveryId
     };
   }
-  const deliveryId = deliveryPlan.deliveryId ?? randomUUID10();
+  const deliveryId = deliveryPlan.deliveryId ?? randomUUID11();
   const deliveryPendingAt = deliveryPlan.pendingAt ?? completedAt;
   const previousAttempts = deliveryPlan.previousAttempts ?? 0;
   const { role: _role, updated_at: _updatedAt, ...currentStatus } = readServerUpdateStatus(input.installPath, input.role);
@@ -30131,18 +30166,18 @@ async function installRuntimeMonitoringServices(installPath, role) {
     const installedOperationalUnits = operationalUnitNames.filter((name) => existsSync9(join7("/etc", "systemd", "system", name)));
     const installedOperationalTimers = installedOperationalUnits.filter((name) => name.endsWith(".timer"));
     if (installedOperationalTimers.length) {
-      execFileSync3("systemctl", ["disable", "--now", ...installedOperationalTimers], { stdio: "pipe" });
+      execFileSync4("systemctl", ["disable", "--now", ...installedOperationalTimers], { stdio: "pipe" });
     }
-    for (const name of installedOperationalUnits) rmSync5(join7("/etc", "systemd", "system", name));
+    for (const name of installedOperationalUnits) rmSync6(join7("/etc", "systemd", "system", name));
     for (const path2 of [reportStatePath, startedMetricPath, successMetricPath]) {
-      if (existsSync9(path2)) rmSync5(path2);
+      if (existsSync9(path2)) rmSync6(path2);
     }
   }
   for (const [name, content] of files) writeFileSync5(join7("/etc", "systemd", "system", name), content, { mode: 420 });
   execSync("systemctl daemon-reload", { stdio: "pipe" });
   const timers = files.filter(([name]) => name.endsWith(".timer")).map(([name]) => name);
   execSync(`systemctl enable --now ${timers.map(shellQuote).join(" ")}`, { stdio: "pipe" });
-  for (const timer of timers) execFileSync3("systemctl", ["is-active", "--quiet", timer], { stdio: "pipe" });
+  for (const timer of timers) execFileSync4("systemctl", ["is-active", "--quiet", timer], { stdio: "pipe" });
 }
 async function autoInstallRuntimeMonitoringServices(installPath, role) {
   if (!shouldAutoInstallRuntimeMonitoringServices(process.env)) {
@@ -31145,7 +31180,7 @@ async function serverBackup(rest, flags) {
   const role = getServerRole(flags, config);
   if (action === "list") {
     const dir = roleBackupDir(installPath, role);
-    const files = existsSync9(dir) ? readdirSync3(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
+    const files = existsSync9(dir) ? readdirSync4(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
     if (flags.json === true) {
       printJson({ role, backupDir: dir, files });
       return;
@@ -31240,7 +31275,7 @@ async function serverUninstall(flags) {
   } catch {
   }
   try {
-    rmSync5(installPath, { recursive: true, force: true });
+    rmSync6(installPath, { recursive: true, force: true });
     console.error(`  Removed installation directory: ${installPath}`);
   } catch (e) {
     console.error(`  Could not remove ${installPath}: ${e instanceof Error ? e.message : e}`);
@@ -48913,9 +48948,9 @@ function basenameFromUrl(url) {
   return withoutQuery.split("/").pop()?.replace(/[^a-zA-Z0-9._-]/g, "_") ?? "";
 }
 function extensionFromUrl(url) {
-  const basename4 = basenameFromUrl(url);
-  const dotIndex = basename4.lastIndexOf(".");
-  return dotIndex > 0 ? basename4.slice(dotIndex + 1).toLowerCase() : "";
+  const basename5 = basenameFromUrl(url);
+  const dotIndex = basename5.lastIndexOf(".");
+  return dotIndex > 0 ? basename5.slice(dotIndex + 1).toLowerCase() : "";
 }
 function extensionFromLanguage(language) {
   const normalized = language.toLowerCase();
@@ -70488,8 +70523,8 @@ function buildAssistantFeedbackDecision(rating) {
 }
 
 // src/benchmark.ts
-import { createHash as createHash13, randomUUID as randomUUID11 } from "crypto";
-import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { createHash as createHash13, randomUUID as randomUUID12 } from "crypto";
+import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, readdirSync as readdirSync5, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir } from "os";
 import { dirname as dirname7, join as join8, resolve as resolve8 } from "path";
 import { fileURLToPath } from "url";
@@ -70904,7 +70939,7 @@ async function handleBenchmark(client, subcommand, rest, flags) {
   const caseIds = parseCaseIds(flags.case);
   const dryRun = flags["dry-run"] === true;
   const output = typeof flags.output === "string" ? flags.output : void 0;
-  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID11();
+  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID12();
   const imagePath = typeof flags.image === "string" ? resolve8(flags.image) : defaultImageFixturePath();
   if (!dryRun && flags["confirm-spend-credits"] !== true) {
     throw new Error(
@@ -71006,7 +71041,7 @@ async function handlePromptBudgetBenchmark(client, rest, flags) {
   if (resumeArtifact) {
     validatePromptBudgetResumeArtifact(resumeArtifact, { phase, targetModel, judgeModel });
   }
-  const runId = stringFlag(flags["run-id"]) ?? resumeArtifact?.runId ?? randomUUID11();
+  const runId = stringFlag(flags["run-id"]) ?? resumeArtifact?.runId ?? randomUUID12();
   const result = makePromptBudgetBaseResult({
     phase,
     runId,
@@ -71567,7 +71602,7 @@ function buildLongContextHistory() {
 }
 function appendHistory(history, role, content) {
   history.push({
-    message_id: randomUUID11(),
+    message_id: randomUUID12(),
     role,
     sender_name: role === "user" ? "User" : "Assistant",
     content,
@@ -71657,7 +71692,7 @@ function loadProviderPricing() {
   const providersDir = findProvidersDir();
   const pricing = /* @__PURE__ */ new Map();
   if (!providersDir) return pricing;
-  for (const fileName of readdirSync4(providersDir)) {
+  for (const fileName of readdirSync5(providersDir)) {
     if (!fileName.endsWith(".yml")) continue;
     const filePath = join8(providersDir, fileName);
     const text = readFileSync8(filePath, "utf-8");
@@ -73434,7 +73469,7 @@ function clamp(value, min, max) {
 // src/remoteAccess.ts
 import { homedir as homedir7 } from "os";
 import {
-  chmodSync as chmodSync5,
+  chmodSync as chmodSync6,
   closeSync as closeSync3,
   constants,
   existsSync as existsSync11,
@@ -73442,7 +73477,7 @@ import {
   mkdirSync as mkdirSync7,
   openSync as openSync3,
   readFileSync as readFileSync9,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync6,
   readSync as readSync2,
   realpathSync,
   statSync as statSync2,
@@ -73586,7 +73621,7 @@ function discoverRemoteAccessRepositories(roots) {
   const visit = (directory, approvedRoot) => {
     let entries;
     try {
-      entries = readdirSync5(directory, { withFileTypes: true });
+      entries = readdirSync6(directory, { withFileTypes: true });
     } catch (error) {
       const code = error.code;
       if (code === "EACCES" || code === "EPERM") {
@@ -73624,7 +73659,7 @@ function listRemoteAccessDirectory(options) {
   const entries = [];
   let omitted = 0;
   let excluded = 0;
-  for (const entry of readdirSync5(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of readdirSync6(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     const entryPath = relative2(root, join9(directory, entry.name)).replace(/\\/g, "/");
     if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, entryPath) || classifyProjectFileRisk(entryPath, options.userProtectedPatterns ?? []).isHighRisk || entry.isFile() && isBinaryFile(join9(directory, entry.name))) {
       excluded += 1;
@@ -73972,7 +74007,7 @@ function searchRemoteSourceWithoutRg(query, sourceRoot, maxResults, userProtecte
     const directory = directories.pop();
     let entries;
     try {
-      entries = readdirSync5(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+      entries = readdirSync6(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
     } catch {
       excluded += 1;
       continue;
@@ -74185,10 +74220,10 @@ function saveRemoteAccessSources(sources, homeDirectory) {
   const filePath = remoteAccessStorePath(homeDirectory);
   const stateDir2 = join9(homeDirectory, ".openmates");
   mkdirSync7(stateDir2, { recursive: true, mode: 448 });
-  chmodSync5(stateDir2, 448);
+  chmodSync6(stateDir2, 448);
   writeFileSync7(filePath, `${JSON.stringify({ sources }, null, 2)}
 `, { mode: 384 });
-  chmodSync5(filePath, 384);
+  chmodSync6(filePath, 384);
 }
 function assertRemoteAccessSourceRecord(value, index) {
   if (typeof value !== "object" || value === null) {
@@ -74206,7 +74241,7 @@ function assertRemoteAccessSourceRecord(value, index) {
 }
 
 // src/projectRequester.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var REMOTE_PROTOCOL_TIMEOUT_MS = 45e3;
 var REMOTE_POLL_INTERVAL_MS = 250;
 var MAX_REMOTE_RESULT_BYTES = 200 * 1024;
@@ -74232,8 +74267,8 @@ async function requestProjectRemoteOperation(options) {
     keyEpoch = discovery.keyEpoch;
     routingIdentity = discovery.routingIdentity;
   }
-  const requestingClientId = randomUUID12();
-  const requestId = randomUUID12();
+  const requestingClientId = randomUUID13();
+  const requestId = randomUUID13();
   const identity = await buildIdentity(
     options.client,
     options.projectId,
@@ -74294,9 +74329,9 @@ async function requestProjectRemoteOperation(options) {
   return response.result;
 }
 async function discoverRouting(options, timeoutMs) {
-  const requestId = randomUUID12();
-  const requestingClientId = randomUUID12();
-  const nonce = randomUUID12();
+  const requestId = randomUUID13();
+  const requestingClientId = randomUUID13();
+  const nonce = randomUUID13();
   const encryptedEnvelope = await encryptWithAesGcmCombined(JSON.stringify({
     type: "routing_discovery",
     requesting_client_id: requestingClientId,
@@ -74394,9 +74429,64 @@ function remoteErrorMessage(code) {
 
 // src/selfUpdate.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8, renameSync as renameSync3 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname8, basename as basename3, join as join10 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_NAME = "openmates";
-var DEFAULT_TARGET = "latest";
+function channelFile() {
+  return join10(homedir8(), ".openmates", "updates.json");
+}
+function parseChannel(value) {
+  if (value === "dev") return "dev";
+  if (value === "stable" || value === "main") return "stable";
+  throw new Error("--channel must be dev, stable, or main (alias for stable)");
+}
+function savedChannel() {
+  try {
+    return parseChannel(JSON.parse(readFileSync10(channelFile(), "utf8")).channel);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return getCliPackageVersion().includes("-") ? "dev" : "stable";
+    }
+    throw error;
+  }
+}
+function persistSelfUpdateChannel(plan) {
+  if (plan.dryRun || !plan.persistChannel) return;
+  const path2 = channelFile();
+  mkdirSync8(dirname8(path2), { recursive: true, mode: 448 });
+  const temporary = `${path2}.${process.pid}.tmp`;
+  writeFileSync8(temporary, JSON.stringify({ channel: plan.channel }) + "\n", { mode: 384 });
+  renameSync3(temporary, path2);
+}
+function installedNpmPrefix(moduleUrl = import.meta.url, platform4 = process.platform) {
+  const packageRoot = dirname8(dirname8(fileURLToPath2(moduleUrl)));
+  const modules = dirname8(packageRoot);
+  if (basename3(packageRoot) !== PACKAGE_NAME || basename3(modules) !== "node_modules") return null;
+  if (platform4 === "win32") return dirname8(modules);
+  return basename3(dirname8(modules)) === "lib" ? dirname8(dirname8(modules)) : null;
+}
+function compareVersions(left, right) {
+  const parse = (value) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+    if (!match) throw new Error(`Cannot compare CLI version '${value}'`);
+    return { core: match.slice(1, 4).map(BigInt), pre: match[4]?.split(".") };
+  };
+  const a = parse(left), b = parse(right);
+  for (let i = 0; i < 3; i++) if (a.core[i] !== b.core[i]) return a.core[i] > b.core[i] ? 1 : -1;
+  if (!a.pre || !b.pre) return a.pre ? -1 : b.pre ? 1 : 0;
+  for (let i = 0; i < Math.max(a.pre.length, b.pre.length); i++) {
+    const x = a.pre[i], y = b.pre[i];
+    if (x === y) continue;
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    const nx = /^\d+$/.test(x), ny = /^\d+$/.test(y);
+    if (nx && ny) return BigInt(x) > BigInt(y) ? 1 : BigInt(x) < BigInt(y) ? -1 : 0;
+    if (nx !== ny) return nx ? -1 : 1;
+    return x > y ? 1 : -1;
+  }
+  return 0;
+}
 var SAFE_TARGET_RE = /^[a-zA-Z0-9._@+~:-]+$/;
 function getCliPackageVersion() {
   try {
@@ -74408,10 +74498,14 @@ function getCliPackageVersion() {
 }
 function buildSelfUpdatePlan(flags) {
   const packageManager = parsePackageManager(flags["package-manager"]);
-  const target = parseTarget(flags.version);
+  const channel = flags.channel === void 0 ? savedChannel() : parseChannel(flags.channel);
+  const target = parseTarget(flags.version ?? (channel === "dev" ? "alpha" : "latest"));
   const packageSpec = `${PACKAGE_NAME}@${target}`;
   const { command, args } = commandForPackageManager(packageManager, packageSpec);
   return {
+    channel,
+    persistChannel: flags.channel !== void 0,
+    allowDowngrade: flags["allow-downgrade"] === true,
     packageManager,
     command,
     args,
@@ -74434,7 +74528,7 @@ function checkSelfUpdateStatus(plan) {
   return {
     currentVersion: plan.currentVersion,
     latestVersion: latest.version,
-    updateAvailable: plan.currentVersion !== latest.version,
+    updateAvailable: compareVersions(latest.version, plan.currentVersion) > 0 || plan.allowDowngrade && compareVersions(latest.version, plan.currentVersion) !== 0,
     checkError: null
   };
 }
@@ -74464,7 +74558,8 @@ function resolveTargetVersion(target) {
   }
   const result = spawnSync3(commandName("npm"), ["view", `${PACKAGE_NAME}@${target}`, "version"], {
     encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 3e4
   });
   if (result.error) return { version: null, error: result.error.message };
   if (result.status !== 0) {
@@ -74480,7 +74575,7 @@ function parsePackageManager(value) {
   throw new Error("--package-manager must be one of npm, pnpm, yarn, or bun");
 }
 function parseTarget(value) {
-  if (value === void 0) return DEFAULT_TARGET;
+  if (value === void 0) return "latest";
   if (typeof value !== "string" || value.length === 0) {
     throw new Error("--version requires a version or npm dist-tag");
   }
@@ -74500,15 +74595,16 @@ function commandForPackageManager(packageManager, packageSpec) {
   if (packageManager === "pnpm") return { command: commandName("pnpm"), args: ["add", "-g", packageSpec] };
   if (packageManager === "yarn") return { command: commandName("yarn"), args: ["global", "add", packageSpec] };
   if (packageManager === "bun") return { command: commandName("bun"), args: ["install", "-g", packageSpec] };
-  return { command: commandName("npm"), args: ["install", "-g", packageSpec] };
+  const prefix = installedNpmPrefix();
+  return { command: commandName("npm"), args: ["install", "-g", packageSpec, ...prefix ? ["--prefix", prefix] : []] };
 }
 function commandName(name) {
   return process.platform === "win32" ? `${name}.cmd` : name;
 }
 
 // src/workRecovery.ts
-import { mkdirSync as mkdirSync8, renameSync as renameSync2, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8 } from "path";
+import { mkdirSync as mkdirSync9, renameSync as renameSync4, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9 } from "path";
 import { stringify } from "yaml";
 async function projectPlanAssumption(plan, masterKey, assumption) {
   const key = await planKeyFromRecord(plan.encrypted, masterKey);
@@ -74687,18 +74783,18 @@ function collectMismatchPaths(left, right, path2, mismatches) {
 }
 function writeWorkRecoveryAtomically(path2, document) {
   validateWorkRecoveryDocument(document);
-  mkdirSync8(dirname8(path2), { recursive: true, mode: 448 });
+  mkdirSync9(dirname9(path2), { recursive: true, mode: 448 });
   const temporaryPath = `${path2}.tmp`;
-  writeFileSync8(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
-  renameSync2(temporaryPath, path2);
+  writeFileSync9(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
+  renameSync4(temporaryPath, path2);
 }
 
 // src/revolutBusinessCertificate.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { createSign, randomUUID as randomUUID13 } from "crypto";
-import { chmodSync as chmodSync6, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync11 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join10, resolve as resolve10 } from "path";
+import { execFileSync as execFileSync5 } from "child_process";
+import { createSign, randomUUID as randomUUID14 } from "crypto";
+import { chmodSync as chmodSync7, existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync11 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join11, resolve as resolve10 } from "path";
 var REVOLUT_BUSINESS_CERTIFICATE_DOCS_URL = "https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request#generate-a-private-and-a-public-certificate";
 var REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI = "https://app.dev.openmates.org/oauth/revolut-business/callback";
 var REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI = "https://openmates.org/oauth/revolut-business/callback";
@@ -74708,7 +74804,7 @@ var REVOLUT_BUSINESS_AUDIENCE = "https://revolut.com";
 var CERTIFICATE_DAYS = "1825";
 var RSA_BITS = "2048";
 function defaultRevolutBusinessCertificateDir(environment) {
-  return join10(homedir8(), ".openmates", "revolut-business", environment);
+  return join11(homedir9(), ".openmates", "revolut-business", environment);
 }
 function defaultRevolutBusinessRedirectUri(environment) {
   return environment === "sandbox" ? REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI : REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI;
@@ -74731,7 +74827,7 @@ async function exchangeRevolutBusinessAuthorizationCode(options) {
   if (!clientId) throw new Error("Missing Revolut Business client ID.");
   const code = extractRevolutBusinessAuthorizationCode(options.codeOrRedirectUrl);
   if (!code) throw new Error("Missing Revolut Business authorization code.");
-  const privateKeyPem = options.privateKeyPem ?? readFileSync11(options.privateKeyPath ?? join10(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
+  const privateKeyPem = options.privateKeyPem ?? readFileSync11(options.privateKeyPath ?? join11(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   const clientAssertion = generateRevolutBusinessClientAssertion({ clientId, privateKeyPem, redirectUri });
   const response = await fetch(environment === "sandbox" ? "https://sandbox-b2b.revolut.com/api/1.0/auth/token" : "https://b2b.revolut.com/api/1.0/auth/token", {
@@ -74769,7 +74865,7 @@ function generateRevolutBusinessClientAssertion(options) {
     aud: REVOLUT_BUSINESS_AUDIENCE,
     exp: now + 3600,
     iat: now,
-    jti: randomUUID13()
+    jti: randomUUID14()
   });
   const unsigned = `${header2}.${payload}`;
   const signer = createSign("RSA-SHA256");
@@ -74784,17 +74880,17 @@ function generateRevolutBusinessCertificate(options = {}) {
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   if (!title) throw new Error("Revolut certificate title must not be empty.");
   if (!redirectUri.startsWith("https://")) throw new Error("Revolut OAuth redirect URI must start with https://.");
-  mkdirSync9(outputDir, { recursive: true, mode: 448 });
-  chmodSync6(outputDir, 448);
-  const privateKeyPath = join10(outputDir, "privatecert.pem");
-  const publicCertificatePath = join10(outputDir, "publiccert.cer");
+  mkdirSync10(outputDir, { recursive: true, mode: 448 });
+  chmodSync7(outputDir, 448);
+  const privateKeyPath = join11(outputDir, "privatecert.pem");
+  const publicCertificatePath = join11(outputDir, "publiccert.cer");
   if (!options.overwrite && (existsSync12(privateKeyPath) || existsSync12(publicCertificatePath))) {
     throw new Error(`Revolut certificate files already exist in ${outputDir}. Re-run with --overwrite to replace them.`);
   }
   try {
-    execFileSync4("openssl", ["genrsa", "-out", privateKeyPath, RSA_BITS], { stdio: "ignore" });
-    chmodSync6(privateKeyPath, 384);
-    execFileSync4(
+    execFileSync5("openssl", ["genrsa", "-out", privateKeyPath, RSA_BITS], { stdio: "ignore" });
+    chmodSync7(privateKeyPath, 384);
+    execFileSync5(
       "openssl",
       [
         "req",
@@ -75252,11 +75348,14 @@ function handleSupport(flags) {
 function handleSelfUpdate(command, flags) {
   const plan = buildSelfUpdatePlan(flags);
   const status = checkSelfUpdateStatus(plan);
-  const shouldInstall = status.updateAvailable !== false;
+  if (status.checkError) throw new Error(`Update check failed: ${status.checkError}`);
+  const shouldInstall = status.updateAvailable === true;
   if (flags.json === true) {
     if (!plan.dryRun && shouldInstall) runSelfUpdate(plan, { verbose: flags.verbose === true });
+    persistSelfUpdateChannel(plan);
     printJson2({
       command,
+      channel: plan.channel,
       status: status.updateAvailable === false ? "up_to_date" : plan.dryRun ? "planned" : "success",
       current_version: plan.currentVersion,
       latest_version: status.latestVersion,
@@ -75273,6 +75372,7 @@ function handleSelfUpdate(command, flags) {
   console.log("");
   console.log("Checking for updates...");
   console.log("");
+  console.log(`Release channel: ${plan.channel}`);
   console.log(`Current version: ${plan.currentVersion}`);
   console.log(`Latest version:  ${status.latestVersion ?? "unknown"}`);
   if (status.checkError) {
@@ -75288,11 +75388,13 @@ function handleSelfUpdate(command, flags) {
     return;
   }
   if (status.updateAvailable === false) {
+    persistSelfUpdateChannel(plan);
     console.log("OpenMates CLI is already up to date.");
     return;
   }
   console.log(`Updating OpenMates CLI with ${plan.packageManager}...`);
   runSelfUpdate(plan, { verbose: flags.verbose === true });
+  persistSelfUpdateChannel(plan);
   console.log(`Installed OpenMates CLI ${status.latestVersion ?? plan.target}.`);
   console.log("");
   console.log("OpenMates is up to date.");
@@ -75305,6 +75407,7 @@ function handleCliVersion(flags) {
   if (flags.json === true) {
     printJson2({
       command: "version",
+      channel: plan.channel,
       current_version: status.currentVersion,
       latest_version: status.latestVersion,
       update_available: status.updateAvailable,
@@ -75314,6 +75417,7 @@ function handleCliVersion(flags) {
     return;
   }
   console.log(`OpenMates CLI ${status.currentVersion}`);
+  console.log(`Release channel: ${plan.channel}`);
   if (status.checkError) {
     console.log(`Update check failed: ${status.checkError}`);
     return;
@@ -76081,7 +76185,7 @@ async function resolveAddToProjectStorageChoice(client, project, flags, objectTy
 async function createEncryptedProjectItem(client, project, input) {
   const timestamp = nowSeconds3();
   return client.createProjectItem(project.projectId, {
-    project_item_id: randomUUID14(),
+    project_item_id: randomUUID15(),
     folder_id: input.folderId ?? null,
     item_type: input.itemType,
     target_id: input.targetId,
@@ -76275,7 +76379,7 @@ async function handlePlans(client, subcommand, rest, flags, redactor) {
     const encryptedSources = proof.length ? await encryptPlanAssumptionSources(plan, masterKey, proof) : void 0;
     if (action === "create" || action === "add") {
       const assumption = await client.createPlanAssumption(plan.planId, {
-        assumption_id: typeof flags.id === "string" ? flags.id : randomUUID14(),
+        assumption_id: typeof flags.id === "string" ? flags.id : randomUUID15(),
         encrypted_text: await encryptPlanAssumptionSources(plan, masterKey, requiredStringFlag(flags.text ?? rest.slice(2).join(" "), "--text <assumption>")),
         status: typeof flags.status === "string" ? flags.status : void 0,
         linked_sub_chat_id: typeof flags["sub-chat"] === "string" ? flags["sub-chat"] : void 0,
@@ -77200,7 +77304,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
     const name = requiredStringFlag(rest[0] ?? flags.name, "project name");
     const projectKey = randomBytes9(32);
     const wrapping = await client.projectWrappingKey(context);
-    const projectId = randomUUID14();
+    const projectId = randomUUID15();
     const timestamp = nowSeconds3();
     const slugMetadata = await buildEncryptedObjectSlugMetadata({
       value: typeof flags.slug === "string" ? flags.slug : name,
@@ -77308,7 +77412,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
     const proposal = isShortWorkspaceAsk(instruction) ? { name: instruction, description: "", icon: "folder", color: "default" } : extractRecord(await client.planProjectAsk({ instruction }), "proposed_project");
     const projectKey = randomBytes9(32);
     const timestamp = Math.floor(Date.now() / 1e3);
-    const projectId = randomUUID14();
+    const projectId = randomUUID15();
     const name = requiredString(proposal, "name", instruction);
     const slugMetadata = await buildEncryptedObjectSlugMetadata({
       value: typeof flags.slug === "string" ? flags.slug : name,
@@ -77705,7 +77809,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     if (action === "get") {
       const output = requiredStringFlag(flags.output ?? flags.file ?? rest[2], "--output <path>");
       const image = await client.getTeamProfileImage(teamId);
-      writeFileSync9(output, image.data, { mode: 384 });
+      writeFileSync10(output, image.data, { mode: 384 });
       if (flags.json === true) printJson2({ output, content_type: image.contentType, size_bytes: image.data.byteLength });
       else console.log(`Team profile image written: ${output}`);
       return;
@@ -77864,7 +77968,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     const output = requiredStringFlag(flags.output, "--output <path>");
     const result = await client.exportTeamData(teamId);
     const artifact = result.artifact && typeof result.artifact === "object" ? result.artifact : result;
-    writeFileSync9(output, `${JSON.stringify(artifact, null, 2)}
+    writeFileSync10(output, `${JSON.stringify(artifact, null, 2)}
 `, { encoding: "utf-8", mode: 384 });
     if (flags.json === true) printJson2({ ...result, output });
     else console.log(`Team export written: ${output}`);
@@ -78207,7 +78311,7 @@ async function handleRemoteAccess(client, subcommand, rest, flags) {
     const projects = await loadProjects(client, masterKey, hostingFlags, hostingContext);
     const bindings = await resolveRemoteAccessBindings(client, masterKey, projects, candidateRoots, hostingFlags, hostingContext);
     if (bindings.length === 0) throw new Error("No Project folders were approved for remote access.");
-    const sourceSessionId = randomUUID14();
+    const sourceSessionId = randomUUID15();
     const controller = new AbortController();
     const stop = () => controller.abort();
     process.once("SIGINT", stop);
@@ -78314,8 +78418,8 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
     const answer = (await promptLine2(`Create ${unresolved.length} missing Project${unresolved.length === 1 ? "" : "s"}? [y/N] `)).trim().toLowerCase();
     if (answer !== "y" && answer !== "yes") throw new Error("Remote access Project creation cancelled.");
     for (const rootPath of unresolved) {
-      const project = await createEncryptedRemoteAccessProject(client, masterKey, basename3(rootPath), context);
-      resolved.push({ rootPath, project, sourceId: randomUUID14() });
+      const project = await createEncryptedRemoteAccessProject(client, masterKey, basename4(rootPath), context);
+      resolved.push({ rootPath, project, sourceId: randomUUID15() });
     }
   }
   const bindings = [];
@@ -78326,7 +78430,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
       projectId: item.project.projectId,
       rootPath: item.rootPath,
       sourceType,
-      displayName: basename3(item.rootPath)
+      displayName: basename4(item.rootPath)
     });
     const remoteSources = await client.listProjectSources(item.project.projectId, context);
     const remoteSource = remoteSources.find((entry) => entry.source_id === source.sourceId);
@@ -78352,7 +78456,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
 }
 async function createEncryptedRemoteAccessProject(client, masterKey, name, context) {
   const projectKey = randomBytes9(32);
-  const projectId = randomUUID14();
+  const projectId = randomUUID15();
   const timestamp = Math.floor(Date.now() / 1e3);
   const wrapping = await client.projectWrappingKey(context);
   const payload = {
@@ -79169,16 +79273,16 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       }
     }
     const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-    const { join: join11 } = await import("path");
+    const { join: join12 } = await import("path");
     if (useZip) {
-      const tmpDir = join11(outputDir, `.${filenameBase}_tmp`);
+      const tmpDir = join12(outputDir, `.${filenameBase}_tmp`);
       await mkdir2(tmpDir, { recursive: true });
-      await writeFile2(join11(tmpDir, `${filenameBase}.yml`), yamlContent);
-      await writeFile2(join11(tmpDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join12(tmpDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join12(tmpDir, `${filenameBase}.md`), mdContent);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join11(tmpDir, "code", fpath);
+          const fullPath = join12(tmpDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79186,13 +79290,13 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join11(tmpDir, "transcripts");
+        const tDir = join12(tmpDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join11(tDir, te.filename), te.content);
+          await writeFile2(join12(tDir, te.filename), te.content);
         }
       }
-      const zipPath = join11(outputDir, `${filenameBase}.zip`);
+      const zipPath = join12(outputDir, `${filenameBase}.zip`);
       const { execSync: execSync2 } = await import("child_process");
       try {
         execSync2(`cd "${tmpDir}" && zip -r "${zipPath}" .`, { stdio: "pipe" });
@@ -79207,17 +79311,17 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         );
       }
     } else {
-      const chatDir = join11(outputDir, filenameBase);
+      const chatDir = join12(outputDir, filenameBase);
       await mkdir2(chatDir, { recursive: true });
       const written = [];
-      await writeFile2(join11(chatDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join12(chatDir, `${filenameBase}.yml`), yamlContent);
       written.push(`${filenameBase}.yml`);
-      await writeFile2(join11(chatDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join12(chatDir, `${filenameBase}.md`), mdContent);
       written.push(`${filenameBase}.md`);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join11(chatDir, "code", fpath);
+          const fullPath = join12(chatDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79226,10 +79330,10 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join11(chatDir, "transcripts");
+        const tDir = join12(chatDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join11(tDir, te.filename), te.content);
+          await writeFile2(join12(tDir, te.filename), te.content);
           written.push(`transcripts/${te.filename}`);
         }
       }
@@ -79265,7 +79369,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       printJson2({
         chat_id: chat.id,
         title: chat.title,
-        output_dir: useZip ? join11(outputDir, `${filenameBase}.zip`) : join11(outputDir, filenameBase),
+        output_dir: useZip ? join12(outputDir, `${filenameBase}.zip`) : join12(outputDir, filenameBase),
         files,
         code_embeds: codeEmbeds.length,
         transcript_embeds: transcriptEmbeds.length
@@ -80291,7 +80395,7 @@ function buildImagesAiDetectionSummary(uploadResult, filePath) {
   const classification = classifyImagesAiDetection(score);
   return {
     file: filePath,
-    filename: uploadResult.filename || basename3(filePath),
+    filename: uploadResult.filename || basename4(filePath),
     content_type: uploadResult.content_type,
     embed_id: uploadResult.embed_id,
     deduplicated: uploadResult.deduplicated,
@@ -81322,7 +81426,7 @@ async function handleEmbeds(client, subcommand, rest, flags) {
         throw new Error("Embed version content was not available after local reconstruction.");
       }
       if (typeof flags.output === "string") {
-        writeFileSync9(flags.output, result.content, "utf-8");
+        writeFileSync10(flags.output, result.content, "utf-8");
         if (flags.json === true) {
           printJson2({ ...result, output: flags.output });
         } else {
@@ -81606,12 +81710,12 @@ async function parseAccountImportFile(parserFormat, file, flags = {}) {
   const selectedSource = requestedSource;
   if (parserFormat === "generic") {
     if (selectedSource !== "gemini" && selectedSource !== "other") throw new Error("Generic account import requires --source gemini or --source other.");
-    return parseGenericImportBuffer(payload, basename3(file), selectedSource);
+    return parseGenericImportBuffer(payload, basename4(file), selectedSource);
   }
-  if (parserFormat === "claude") return parseClaudeImportBuffer(payload, basename3(file), selectedSource);
-  if (parserFormat === "chatgpt") return parseChatGPTImportBuffer(payload, basename3(file), selectedSource);
-  if (parserFormat === "opencode") return parseOpenCodeImportBuffer(payload, basename3(file), selectedSource);
-  return parseOpenMatesImportBuffer(payload, basename3(file), typeof flags.password === "string" ? flags.password : void 0, selectedSource);
+  if (parserFormat === "claude") return parseClaudeImportBuffer(payload, basename4(file), selectedSource);
+  if (parserFormat === "chatgpt") return parseChatGPTImportBuffer(payload, basename4(file), selectedSource);
+  if (parserFormat === "opencode") return parseOpenCodeImportBuffer(payload, basename4(file), selectedSource);
+  return parseOpenMatesImportBuffer(payload, basename4(file), typeof flags.password === "string" ? flags.password : void 0, selectedSource);
 }
 async function runAccountImport(client, parserFormat, file, flags) {
   if (parserFormat === "generic" && typeof flags.source !== "string") throw new Error("Generic account import requires --source gemini or --source other.");
@@ -81650,7 +81754,7 @@ async function runAccountImport(client, parserFormat, file, flags) {
   if (flags.yes !== true) {
     await confirmOrExit(`Import ${selectedCount} chat(s) into new encrypted OpenMates chats? [y/N] `);
   }
-  const importId = typeof preview.import_id === "string" ? preview.import_id : randomUUID14();
+  const importId = typeof preview.import_id === "string" ? preview.import_id : randomUUID15();
   const selectedChats = parsed.chats.slice(0, selectedCount);
   const selectedFingerprints = selectedChats.map((chat) => chat.source_fingerprint);
   const confirmation = await client.confirmAccountImport(importId, selectedFingerprints);
@@ -81981,11 +82085,11 @@ function parseYamlScalar(value) {
 }
 async function saveDownloadedDocument(document, output) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join11, basename: basename4, dirname: dirname10 } = await import("path");
+  const { join: join12, basename: basename5, dirname: dirname11 } = await import("path");
   const target = typeof output === "string" ? output : ".";
-  const filename = basename4(document.filename || "document.pdf");
-  const filePath = target.endsWith(".pdf") ? target : join11(target, filename);
-  await mkdir2(dirname10(filePath), { recursive: true });
+  const filename = basename5(document.filename || "document.pdf");
+  const filePath = target.endsWith(".pdf") ? target : join12(target, filename);
+  await mkdir2(dirname11(filePath), { recursive: true });
   await writeFile2(filePath, document.data);
   return filePath;
 }
@@ -82144,8 +82248,8 @@ async function handleFinance(client, subcommand, _rest, flags) {
         refresh_token_envelope: connectedAccount.refreshTokenBundle
       }
     ] : [],
-    chatId: `cli-finance-${randomUUID14()}`,
-    messageId: `cli-finance-message-${randomUUID14()}`,
+    chatId: `cli-finance-${randomUUID15()}`,
+    messageId: `cli-finance-message-${randomUUID15()}`,
     apiKey: resolveApiKey(flags) ?? void 0,
     promptInjectionProtection: false
   });
@@ -82157,7 +82261,7 @@ async function handleFinance(client, subcommand, _rest, flags) {
 }
 function readFinanceCsvStatements(flags) {
   const paths = parseCsvFlag(flags.csv) ?? [];
-  return paths.map((filePath) => ({ filename: basename3(filePath), content: readFileSync12(filePath, "utf8") }));
+  return paths.map((filePath) => ({ filename: basename4(filePath), content: readFileSync12(filePath, "utf8") }));
 }
 function buildFinanceCheckAccountsInput(flags, csvStatements, connectedAccount) {
   const input = {
@@ -82452,7 +82556,7 @@ async function promptPlainText(question) {
 }
 async function writeSecretFile(filePath, content, force = false) {
   const { mkdir: mkdir2, writeFile: writeFile2, stat: stat2 } = await import("fs/promises");
-  const { dirname: dirname10 } = await import("path");
+  const { dirname: dirname11 } = await import("path");
   try {
     await stat2(filePath);
     if (!force) throw new Error(`${filePath} already exists. Use --force to overwrite.`);
@@ -82462,7 +82566,7 @@ async function writeSecretFile(filePath, content, force = false) {
     }
     if (error instanceof Error && !("code" in error)) throw error;
   }
-  await mkdir2(dirname10(filePath), { recursive: true });
+  await mkdir2(dirname11(filePath), { recursive: true });
   await writeFile2(filePath, content, { mode: 384 });
   return filePath;
 }
@@ -85628,12 +85732,16 @@ function printSelfUpdateHelp() {
   openmates update [--version <version|tag>] [--package-manager <name>] [--dry-run] [--verbose] [--json]
   openmates upgrade [--version <version|tag>] [--package-manager <name>] [--dry-run] [--verbose] [--json]
 
-Updates the globally installed openmates package. The default target is latest.
+Updates the globally installed openmates package using the saved release channel.
+Stable installations default to stable; prereleases default to dev.
+Channel changes persist only after a successful update or up-to-date check.
 
 Options:
-  --version <version|tag>       Install a specific npm version or dist-tag (default: latest)
+  --version <version|tag>       Install a specific npm version or dist-tag (one-time override)
   --package-manager <name>      npm, pnpm, yarn, or bun (default: detect, then npm)
   --dry-run                     Print the package-manager command without running it
+  --channel <dev|stable|main>    Save release channel (dev uses npm alpha; stable/main uses latest)
+  --allow-downgrade             Explicitly allow installing an older version
   --verbose                     Stream package-manager output during installation
   --json                        Output the update plan/result as JSON`);
 }
@@ -86440,7 +86548,7 @@ async function handleDocs(client, subcommand, rest, flags) {
   }
   if (subcommand === "download") {
     const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
-    const { join: join11, dirname: dirname10 } = await import("path");
+    const { join: join12, dirname: dirname11 } = await import("path");
     if (flags.all === true) {
       const outputDir = typeof flags.output === "string" ? flags.output : "./openmates-docs";
       const tree = await client.listDocs();
@@ -86449,8 +86557,8 @@ async function handleDocs(client, subcommand, rest, flags) {
       let count = 0;
       for (const slug2 of slugs) {
         const content2 = await client.getDoc(slug2);
-        const filePath = join11(outputDir, `${slug2}.md`);
-        await mkdir2(dirname10(filePath), { recursive: true });
+        const filePath = join12(outputDir, `${slug2}.md`);
+        await mkdir2(dirname11(filePath), { recursive: true });
         await writeFile2(filePath, content2, "utf-8");
         count++;
         process.stderr.write(`\r  Downloaded ${count}/${slugs.length}`);
@@ -86522,8 +86630,8 @@ function isCliEntrypoint() {
   if (!entrypoint) return false;
   try {
     const invokedPath = realpathSync2(entrypoint);
-    const modulePath = realpathSync2(fileURLToPath2(import.meta.url));
-    return invokedPath === modulePath || basename3(invokedPath) === "cli.js" && dirname9(invokedPath) === dirname9(modulePath);
+    const modulePath = realpathSync2(fileURLToPath3(import.meta.url));
+    return invokedPath === modulePath || basename4(invokedPath) === "cli.js" && dirname10(invokedPath) === dirname10(modulePath);
   } catch {
     return false;
   }

package/dist/cli.js

@@ -11,7 +11,7 @@ import {
   resolveProjectContext,
   serializeToYaml,
   shouldRequireTrustedAccountGuard
-} from "./chunk-RLOO6QKC.js";
+} from "./chunk-65ZA6VF2.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/dist/index.js

@@ -42,7 +42,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-RLOO6QKC.js";
+} from "./chunk-65ZA6VF2.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.18.0-alpha.1",
+  "version": "0.18.0-alpha.3",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",