openmates 0.27.0-alpha.23 → 0.27.0-alpha.24

package/dist/{chunk-NQP5QUVR.js → chunk-U5L7EZHI.js}

@@ -692,7 +692,7 @@ async function readCodexThread(threadId, socketPath) {
   codexResumeArguments({ provider: "codex", id: threadId });
   const socket = socketPath ?? await daemonSocket();
   if (!isAbsolute(socket) || socket.includes(":")) throw new Error("Codex requires an absolute local socket path.");
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const ws = new WebSocket(`ws+unix://${socket}:/`, {
       perMessageDeflate: false,
       handshakeTimeout: CONNECTION_TIMEOUT_MS,
@@ -706,7 +706,7 @@ async function readCodexThread(threadId, socketPath) {
       if (ws.readyState === WebSocket.OPEN) ws.close();
       else if (ws.readyState !== WebSocket.CLOSED) ws.terminate();
       if (error) reject(error);
-      else resolve17(value);
+      else resolve18(value);
     };
     const timer = setTimeout(() => finish(new Error("Codex connection timed out.")), CONNECTION_TIMEOUT_MS);
     ws.on("error", () => finish(new Error("Could not connect to the local Codex daemon.")));
@@ -747,10 +747,10 @@ async function resumeCodexTask(context) {
   const args = codexResumeArguments(context);
   if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Task resume requires an interactive terminal; status and connect never launch work.");
   await readCodexThread(context.id);
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const child = spawn("codex", args, { stdio: "inherit" });
     child.once("error", () => reject(new Error("Could not open the installed Codex CLI.")));
-    child.once("exit", (code) => code === 0 ? resolve17() : reject(new Error(`Codex resume exited with status ${code ?? "interrupted"}.`)));
+    child.once("exit", (code) => code === 0 ? resolve18() : reject(new Error(`Codex resume exited with status ${code ?? "interrupted"}.`)));
   });
 }
 function taskOwnerConflict(owner) {
@@ -4996,14 +4996,14 @@ var OpenMatesWsClient = class {
     });
   }
   async open(timeoutMs = 1e4) {
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve18, reject) => {
       const timeout = setTimeout(
         () => reject(new Error("WebSocket open timeout")),
         timeoutMs
       );
       this.socket.once("open", () => {
         clearTimeout(timeout);
-        resolve17();
+        resolve18();
       });
       this.socket.once("error", (error) => {
         clearTimeout(timeout);
@@ -5068,10 +5068,10 @@ var OpenMatesWsClient = class {
     }
   }
   sendAsync(type, payload) {
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       this.socket.send(JSON.stringify({ type, payload }), (error) => {
         if (error) reject(error);
-        else resolve17();
+        else resolve18();
       });
     });
   }
@@ -5139,9 +5139,9 @@ var OpenMatesWsClient = class {
     return () => this.socket.off("message", onMessage);
   }
   waitForClose() {
-    return new Promise((resolve17) => {
+    return new Promise((resolve18) => {
       this.socket.once("close", (code, reason) => {
-        resolve17({ code, reason: reason.toString("utf-8") });
+        resolve18({ code, reason: reason.toString("utf-8") });
       });
     });
   }
@@ -5236,7 +5236,7 @@ var OpenMatesWsClient = class {
     if (this.recoveryOutputDiscoveryError) throw this.recoveryOutputDiscoveryError;
   }
   waitForMessage(expectedType, predicate, timeoutMs = 2e4) {
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const seenTypes = /* @__PURE__ */ new Set();
       let predicateMisses = 0;
       const onMessage = (rawData) => {
@@ -5258,7 +5258,7 @@ var OpenMatesWsClient = class {
             return;
           }
           cleanup();
-          resolve17(parsed);
+          resolve18(parsed);
         } catch {
         }
       };
@@ -5296,7 +5296,7 @@ var OpenMatesWsClient = class {
    * Used by ensureSynced to consume the full phased-sync event stream.
    */
   collectMessages(terminatorType, timeoutMs = 9e4) {
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const collected = [];
       const onMessage = (rawData) => {
         try {
@@ -5309,7 +5309,7 @@ var OpenMatesWsClient = class {
           }
           if (parsed.type === terminatorType) {
             cleanup();
-            resolve17(collected);
+            resolve18(collected);
             return;
           }
           collected.push(parsed);
@@ -5322,7 +5322,7 @@ var OpenMatesWsClient = class {
       };
       const onClose = () => {
         cleanup();
-        resolve17(collected);
+        resolve18(collected);
       };
       const timeout = setTimeout(() => {
         cleanup();
@@ -5360,7 +5360,7 @@ var OpenMatesWsClient = class {
     const timeoutMs = options?.timeoutMs ?? 9e4;
     const onStream = options?.onStream;
     const asyncEmbedWaitMs = options?.asyncEmbedWaitMs ?? DEFAULT_ASYNC_EMBED_WAIT_MS;
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       let latestContent = "";
       let messageId = null;
       let taskId = null;
@@ -5469,7 +5469,7 @@ var OpenMatesWsClient = class {
         if (waitingForUserPayload) {
           if (pendingSubChatHandlers.size > 0) return;
           cleanup();
-          resolve17({
+          resolve18({
             status: "waiting_for_user",
             messageId,
             taskId,
@@ -5506,7 +5506,7 @@ var OpenMatesWsClient = class {
         if (processingEmbedIds.size > 0 && !asyncEmbedTimer) {
           asyncEmbedTimer = setTimeout(() => {
             cleanup();
-            resolve17({
+            resolve18({
               status: "completed",
               messageId,
               taskId,
@@ -5538,7 +5538,7 @@ var OpenMatesWsClient = class {
         }
         if (processingEmbedIds.size > 0) return;
         cleanup();
-        resolve17({
+        resolve18({
           status: "completed",
           messageId,
           taskId,
@@ -5955,7 +5955,7 @@ var OpenMatesWsClient = class {
       const onClose = () => {
         if (aiResponseDone && pendingProjectOperations.size === 0 && !awaitingUnidentifiedAsyncContinuation) {
           cleanup();
-          resolve17({
+          resolve18({
             status: "completed",
             messageId,
             taskId,
@@ -6493,8 +6493,8 @@ function registerProjectFocusCountdown(options) {
     const projectId = focusId.slice("project-".length);
     let finish = () => {
     };
-    const done = new Promise((resolve17) => {
-      finish = resolve17;
+    const done = new Promise((resolve18) => {
+      finish = resolve18;
     });
     const entry = { requestId, timer: null, cancelled: false, done, finish };
     current = entry;
@@ -8420,7 +8420,7 @@ function validateProtonBridgeCredentials(credentials) {
 }
 async function validateProtonBridgeImap(credentials, timeoutMs = DEFAULT_IMAP_TIMEOUT_MS) {
   validateProtonBridgeCredentials(credentials);
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const socket = connectTcp({ host: credentials.imapHost, port: credentials.imapPort });
     const timer = setTimeout(() => {
       socket.destroy();
@@ -8429,7 +8429,7 @@ async function validateProtonBridgeImap(credentials, timeoutMs = DEFAULT_IMAP_TI
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.end();
-      resolve17();
+      resolve18();
     });
     socket.once("error", (error) => {
       clearTimeout(timer);
@@ -8606,8 +8606,8 @@ async function localConnectorRequestLoop(client2, params) {
   const ws = await client2.openLocalConnectorWebSocket();
   const sendQueue = new ProtonDelayedSendQueue();
   let resolveOnce = null;
-  const onceHandled = new Promise((resolve17) => {
-    resolveOnce = resolve17;
+  const onceHandled = new Promise((resolve18) => {
+    resolveOnce = resolve18;
   });
   const removeListener = ws.onLocalConnectorRequest((request) => {
     void handleLocalConnectorRequest(client2, request, params, sendQueue).finally(() => {
@@ -8675,8 +8675,8 @@ async function handleLocalConnectorRequest(client2, request, params, sendQueue)
 }
 async function waitForAbort(signal) {
   if (signal.aborted) return;
-  await new Promise((resolve17) => {
-    signal.addEventListener("abort", () => resolve17(), { once: true });
+  await new Promise((resolve18) => {
+    signal.addEventListener("abort", () => resolve18(), { once: true });
   });
 }
 async function searchProtonBridgeImap(credentials, arguments_) {
@@ -8838,14 +8838,14 @@ async function openTextSocket(host, port, timeoutMs) {
   socket.on("data", (chunk) => {
     buffer += String(chunk);
   });
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const timer = setTimeout(() => {
       socket.destroy();
       reject(new Error(`Timed out connecting to ${host}:${port}.`));
     }, timeoutMs);
     socket.once("connect", () => {
       clearTimeout(timer);
-      resolve17();
+      resolve18();
     });
     socket.once("error", (error) => {
       clearTimeout(timer);
@@ -8885,11 +8885,11 @@ async function openTextSocket(host, port, timeoutMs) {
   };
 }
 async function waitForSocketText(socket, getBuffer, done, timeoutMs) {
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     const timer = setTimeout(() => cleanup(() => reject(new Error("Timed out waiting for local mail server response."))), timeoutMs);
     const check = () => {
       const text6 = getBuffer();
-      if (done(text6)) cleanup(() => resolve17(text6));
+      if (done(text6)) cleanup(() => resolve18(text6));
     };
     const onData = () => check();
     const onError = (error) => cleanup(() => reject(error));
@@ -8914,7 +8914,7 @@ function startProtonBridgeProcess(command, args) {
       if (child.exitCode !== null || child.killed) return;
       child.kill("SIGTERM");
       await Promise.race([
-        new Promise((resolve17) => child.once("exit", () => resolve17())),
+        new Promise((resolve18) => child.once("exit", () => resolve18())),
         sleep(2e3).then(() => {
           if (child.exitCode === null && !child.killed) child.kill("SIGKILL");
         })
@@ -9013,7 +9013,7 @@ async function captureOrPromptBridgeCredentials(command, args) {
   }
 }
 async function captureProtonBridgeInfo(command, args) {
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     const child = spawn2(command, args, { stdio: "pipe" });
     let output = "";
     let errorOutput = "";
@@ -9033,7 +9033,7 @@ async function captureProtonBridgeInfo(command, args) {
     });
     child.once("exit", () => {
       clearTimeout(timer);
-      if (output.trim()) resolve17(output);
+      if (output.trim()) resolve18(output);
       else reject(new Error(redactProtonBridgeSecrets(errorOutput || "Proton Bridge info produced no output.")));
     });
     child.stdin.write("info\nquit\n");
@@ -9063,7 +9063,7 @@ async function promptHidden(prompt) {
   const wasRaw = stdin.isRaw === true;
   stdin.setRawMode(true);
   stdin.resume();
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     let value = "";
     const onData = (chunk) => {
       const text6 = chunk.toString("utf8");
@@ -9076,7 +9076,7 @@ async function promptHidden(prompt) {
         if (char === "\r" || char === "\n") {
           cleanup();
           stderr.write("\n");
-          resolve17(value);
+          resolve18(value);
           return;
         }
         if (char === "\x7F" || char === "\b") {
@@ -13496,7 +13496,7 @@ var OpenMatesClient = class _OpenMatesClient {
   }
   async requestAssistantSpeechMessage(ws, chatId, messageId, segments2) {
     const timeoutMs = 10 * 60 * 1e3;
-    return await new Promise((resolve17, reject) => {
+    return await new Promise((resolve18, reject) => {
       const expected = /* @__PURE__ */ new Set();
       const queued = /* @__PURE__ */ new Set();
       const terminal = /* @__PURE__ */ new Map();
@@ -13505,7 +13505,7 @@ var OpenMatesClient = class _OpenMatesClient {
         if (!accepted || expected.size === 0 || terminal.size !== expected.size) return;
         cleanup();
         const statuses = [...terminal.values()];
-        resolve17({
+        resolve18({
           generated: statuses.filter((status) => status.status === "ready" && queued.has(String(status.segment_id))).length,
           reused: statuses.filter((status) => status.status === "ready" && !queued.has(String(status.segment_id))).length,
           failed: statuses.filter((status) => status.status === "error").length,
@@ -15007,8 +15007,8 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     let dispatchHandlersReady = () => {
     };
-    const handlersReady = new Promise((resolve17) => {
-      dispatchHandlersReady = resolve17;
+    const handlersReady = new Promise((resolve18) => {
+      dispatchHandlersReady = resolve18;
     });
     let precollectedResponse = params.precollectResponse && params.incognito && shouldWaitForAi ? ws.collectAiResponse(messageId, chatId, { onStream: params.onStream, timeoutMs: params.responseTimeoutMs }) : null;
     if (!params.incognito && chatKeyBytes && encryptedChatKey) {
@@ -15597,7 +15597,7 @@ var OpenMatesClient = class _OpenMatesClient {
               );
               const remainingMs = claimRetryDeadline - Date.now();
               if (remainingMs <= claimRetryDelayMs) throw error;
-              await new Promise((resolve17) => setTimeout(resolve17, claimRetryDelayMs));
+              await new Promise((resolve18) => setTimeout(resolve18, claimRetryDelayMs));
               claimRetryDelayMs = Math.min(claimRetryDelayMs * 2, 2e3);
             } finally {
               stopWatchingErrors();
@@ -16452,13 +16452,13 @@ var OpenMatesClient = class _OpenMatesClient {
         );
       } catch (error) {
         lastTransientError = error instanceof Error ? error.message : String(error);
-        await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS));
+        await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS));
         continue;
       }
       if (!response.ok) {
         if (response.status >= SKILL_TASK_POLL_TRANSIENT_ERROR_STATUS) {
           lastTransientError = `HTTP ${response.status}`;
-          await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS));
+          await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS));
           continue;
         }
         throw new Error(`Task ${taskId} polling failed with HTTP ${response.status}. Generation was not retried; retain this task ID for recovery.`);
@@ -16470,7 +16470,7 @@ var OpenMatesClient = class _OpenMatesClient {
       if (response.data.status === "failed") {
         throw new Error(response.data.error ?? "Task failed");
       }
-      await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS));
+      await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS));
     }
     if (lastTransientError) {
       throw new Error(
@@ -18592,7 +18592,7 @@ var OpenMatesClient = class _OpenMatesClient {
         `Rate limited by settings API; retrying in ${Math.ceil(SETTINGS_GET_RATE_LIMIT_RETRY_MS / 1e3)}s...
 `
       );
-      await new Promise((resolve17) => setTimeout(resolve17, SETTINGS_GET_RATE_LIMIT_RETRY_MS));
+      await new Promise((resolve18) => setTimeout(resolve18, SETTINGS_GET_RATE_LIMIT_RETRY_MS));
       response = await this.http.get(normalizedPath, headers);
     }
     if (!response.ok) {
@@ -20831,7 +20831,7 @@ function filenameFromContentDisposition(header2) {
   return plain?.trim() ?? null;
 }
 function sleep2(ms) {
-  return new Promise((resolve17) => setTimeout(resolve17, ms));
+  return new Promise((resolve18) => setTimeout(resolve18, ms));
 }
 function printLogo() {
   const W = "\x1B[1;37m";
@@ -27925,13 +27925,13 @@ var OpenMates = class {
         });
       } catch (error) {
         lastTransientError = error instanceof Error ? error.message : String(error);
-        await new Promise((resolve17) => setTimeout(resolve17, CODE_RUN_POLL_INTERVAL_MS));
+        await new Promise((resolve18) => setTimeout(resolve18, CODE_RUN_POLL_INTERVAL_MS));
         continue;
       }
       if (!response.ok) {
         if (response.status >= SKILL_TASK_POLL_TRANSIENT_ERROR_STATUS2) {
           lastTransientError = `HTTP ${response.status}`;
-          await new Promise((resolve17) => setTimeout(resolve17, CODE_RUN_POLL_INTERVAL_MS));
+          await new Promise((resolve18) => setTimeout(resolve18, CODE_RUN_POLL_INTERVAL_MS));
           continue;
         }
         throw new OpenMatesApiError(response.status, await this.safeJson(response));
@@ -27940,7 +27940,7 @@ var OpenMates = class {
       const status = await this.parseResponse(response);
       const value = typeof status.status === "string" ? status.status : "";
       if (CODE_RUN_TERMINAL_STATUSES.has(value)) return status;
-      await new Promise((resolve17) => setTimeout(resolve17, CODE_RUN_POLL_INTERVAL_MS));
+      await new Promise((resolve18) => setTimeout(resolve18, CODE_RUN_POLL_INTERVAL_MS));
     }
     if (lastTransientError) {
       throw new Error(`Code Run did not complete within ${CODE_RUN_POLL_TIMEOUT_MS / 1e3}s; last polling error: ${lastTransientError}`);
@@ -27965,13 +27965,13 @@ var OpenMates = class {
         });
       } catch (error) {
         lastTransientError = error instanceof Error ? error.message : String(error);
-        await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS2));
+        await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS2));
         continue;
       }
       if (!response.ok) {
         if (response.status >= SKILL_TASK_POLL_TRANSIENT_ERROR_STATUS2) {
           lastTransientError = `HTTP ${response.status}`;
-          await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS2));
+          await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS2));
           continue;
         }
         throw new OpenMatesApiError(response.status, await this.safeJson(response));
@@ -27980,7 +27980,7 @@ var OpenMates = class {
       const task = await this.parseResponse(response);
       if (task.status === "completed") return task;
       if (task.status === "failed") throw new Error(task.error ?? "Task failed");
-      await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS2));
+      await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS2));
     }
     if (lastTransientError) {
       throw new Error(`Task ${taskId} did not complete within ${SKILL_TASK_POLL_TIMEOUT_MS2 / 1e3}s; last polling error: ${lastTransientError}`);
@@ -29057,7 +29057,7 @@ var OpenMatesChats = class {
       }
       const remainingMs = deadline - Date.now();
       if (remainingMs <= 0) break;
-      await new Promise((resolve17) => setTimeout(resolve17, Math.min(pollIntervalMs, remainingMs)));
+      await new Promise((resolve18) => setTimeout(resolve18, Math.min(pollIntervalMs, remainingMs)));
     }
     throw new OpenMatesConfigError("Timed out waiting for saved chat recovery");
   }
@@ -30345,7 +30345,7 @@ function isTaskVersionConflict(error) {
   return error instanceof OpenMatesApiError && error.status === 409 && String(JSON.stringify(error.data)).includes("TASK_VERSION_CONFLICT");
 }
 function delay(ms) {
-  return new Promise((resolve17) => setTimeout(resolve17, ms));
+  return new Promise((resolve18) => setTimeout(resolve18, ms));
 }
 var OpenMatesPlans = class {
   client;
@@ -31304,7 +31304,7 @@ var OpenMatesEmbedPreview = class {
       if (["running", "failed", "timeout", "cancelled", "stopped"].includes(status.status)) {
         return status;
       }
-      await new Promise((resolve17) => setTimeout(resolve17, 1e3));
+      await new Promise((resolve18) => setTimeout(resolve18, 1e3));
     }
     throw new OpenMatesApiError(408, { detail: "Application preview did not reach running state before timeout" });
   }
@@ -33350,8 +33350,8 @@ async function renderRemotionShareLink(embedId, client2, ln) {
   }
 }
 function generateQr(value) {
-  return new Promise((resolve17) => {
-    qrcode2.generate(value, { small: true }, (qr) => resolve17(qr));
+  return new Promise((resolve18) => {
+    qrcode2.generate(value, { small: true }, (qr) => resolve18(qr));
   });
 }
 function remotionMeta(c) {
@@ -34248,7 +34248,7 @@ import { appendFileSync, chmodSync as chmodSync7, closeSync as closeSync4, copyF
 import { createInterface as createInterface4 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
 import { homedir as homedir4, tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, join as join15, resolve as resolve6 } from "path";
+import { dirname as dirname9, join as join15, resolve as resolve7 } from "path";
 
 // src/branding.ts
 var OPENMATES_WORDMARK = "OPENMATES";
@@ -35074,8 +35074,42 @@ import { execFileSync as execFileSync3 } from "child_process";
 import { createHash as createHash16 } from "crypto";
 import { accessSync, constants as constants2, existsSync as existsSync9, mkdirSync as mkdirSync9, mkdtempSync, readFileSync as readFileSync10, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname7, join as join12 } from "path";
+import { dirname as dirname7, join as join12, isAbsolute as isAbsolute3, resolve as resolve6 } from "path";
 var hash2 = (text6) => createHash16("sha256").update(text6).digest("hex");
+function caddyConfigFromArgs(args, cwd) {
+  const index = args.indexOf("--config");
+  const value = index >= 0 ? args[index + 1] : args.find((arg) => arg.startsWith("--config="))?.slice(9);
+  if (!value || value.startsWith("--")) return void 0;
+  if (!isAbsolute3(value) && !cwd) throw new Error("caddy_relative_config_requires_explicit_path");
+  return resolve6(cwd ?? "/", value);
+}
+function detectCaddyConfigPath(explicit) {
+  if (explicit) return resolve6(explicit);
+  let pid;
+  try {
+    pid = execFileSync3("systemctl", ["show", "caddy", "--property=MainPID", "--value"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+  }
+  if (pid && /^[1-9]\d*$/.test(pid)) {
+    try {
+      const args = readFileSync10(`/proc/${pid}/cmdline`, "utf8").split("\0").filter(Boolean);
+      const config = caddyConfigFromArgs(args);
+      if (config) return config;
+    } catch {
+      throw new Error("caddy_running_config_requires_explicit_path");
+    }
+    throw new Error("caddy_running_config_requires_explicit_path");
+  }
+  return existsSync9("/etc/caddy/Caddyfile") ? "/etc/caddy/Caddyfile" : void 0;
+}
+function caddyUpdateRetryCommand(input) {
+  const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+  return `sudo -v && openmates server caddy update --path ${quote(input.installPath)} --role ${quote(input.role)} --caddy-config ${quote(input.configPath)}` + (input.profile === "official-upload" ? " --caddy-profile official-upload" : "");
+}
 function resolveCaddyProfile(role, explicit, previous) {
   if (explicit === void 0) return previous ?? "self-host";
   if (role !== "upload" || explicit !== "official-upload") throw new Error("caddy_profile_unsupported");
@@ -35286,7 +35320,17 @@ var HOST_TRANSACTION = String.raw`
 const fs = require('node:fs'), cp = require('node:child_process'), crypto = require('node:crypto'), path = require('node:path');
 const input = JSON.parse(fs.readFileSync(0, 'utf8'));
 const digest = text => crypto.createHash('sha256').update(text).digest('hex');
-function run(command, args) { cp.execFileSync(command, args, {stdio: ['ignore','pipe','pipe'], timeout: 20000}); }
+function run(command, args) {
+  const options = {stdio: ['ignore','pipe','pipe'], timeout: 20000};
+  try { cp.execFileSync(command, args, options); }
+  catch (error) {
+    // A user-owned Caddyfile can still belong to a root-managed service.
+    // Honor a cached sudo session for reload without elevating file access.
+    if (command !== 'systemctl') throw error;
+    try { cp.execFileSync('sudo', ['-n', command, ...args], options); }
+    catch { throw error; }
+  }
+}
 function replace(content, metadata) {
   const temp = input.configPath + '.openmates-' + crypto.randomUUID();
   let fd;
@@ -35346,7 +35390,7 @@ try {
 function caddyHostOperation(input) {
   let privileged = false;
   try {
-    accessSync(dirname7(input.configPath), constants2.W_OK);
+    accessSync(input.action === "read" ? input.configPath : dirname7(input.configPath), input.action === "read" ? constants2.R_OK : constants2.W_OK);
   } catch {
     privileged = true;
   }
@@ -35390,6 +35434,12 @@ async function verifyCaddyCoreRoutes(apiUrl, origin) {
     redirect: "error",
     signal: AbortSignal.timeout(5e3)
   });
+  const embedPreflight = await request("/v1/embeds/chats/00000000-0000-4000-8000-000000000000/references/availability", { method: "OPTIONS", headers: {
+    Origin: origin,
+    "Access-Control-Request-Method": "POST",
+    "Access-Control-Request-Headers": "content-type"
+  } });
+  if (!embedPreflight.ok || embedPreflight.headers.get("access-control-allow-origin") !== origin || embedPreflight.headers.get("access-control-allow-credentials") !== "true") throw new Error("caddy_embed_reference_cors_failed");
   const availability = await request("/v1/features/availability");
   if (!availability.ok) throw new Error("caddy_availability_route_failed");
   const features = await availability.json();
@@ -35682,7 +35732,7 @@ function isBrevoAcceptedResponse(pathName, method, status, responseBody) {
 }
 async function requestBrevo(pathName, method, apiKey, payload) {
   const body = payload ? JSON.stringify(payload) : void 0;
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const request = httpsRequest(buildBrevoRequestOptions(pathName, method, apiKey, body), (response) => {
       let responseBytes = 0;
       const chunks = [];
@@ -35694,8 +35744,8 @@ async function requestBrevo(pathName, method, apiKey, payload) {
       response.on("end", () => {
         const status = response.statusCode ?? 0;
         const responseBody = Buffer.concat(chunks).toString("utf8");
-        if (isBrevoAcceptedResponse(pathName, method, status, responseBody)) resolve17();
-        else if (isBrevoIdempotencyDuplicate(status, responseBody, payload)) resolve17();
+        if (isBrevoAcceptedResponse(pathName, method, status, responseBody)) resolve18();
+        else if (isBrevoIdempotencyDuplicate(status, responseBody, payload)) resolve18();
         else reject(new Error(`brevo_delivery_failed:${status}`));
       });
     });
@@ -35863,7 +35913,7 @@ async function sendGenericWebhook(target, secret, payload, allowLocalDevelopment
   const eventId = randomUUID12();
   const signed = signRuntimeWebhookPayload(payload, secret, timestamp, eventId);
   const selected = addresses[0];
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const requestFunction = url.protocol === "https:" ? httpsRequest : httpRequest;
     const request = requestFunction({
       protocol: url.protocol,
@@ -35883,7 +35933,7 @@ async function sendGenericWebhook(target, secret, payload, allowLocalDevelopment
       });
       response.on("end", () => {
         const status = response.statusCode ?? 0;
-        if (status >= 200 && status < 300) resolve17();
+        if (status >= 200 && status < 300) resolve18();
         else reject(new Error(`webhook_delivery_failed:${status}`));
       });
     });
@@ -35964,7 +36014,7 @@ async function deliverWithRetries(channel, send) {
       await send();
       return { channel, status: "delivered", attempts: attempt };
     } catch {
-      if (attempt < 3) await new Promise((resolve17) => setTimeout(resolve17, 250 * 2 ** (attempt - 1)));
+      if (attempt < 3) await new Promise((resolve18) => setTimeout(resolve18, 250 * 2 ** (attempt - 1)));
     }
   }
   return { channel, status: "exhausted", attempts: 3, sanitizedReason: "delivery_failed" };
@@ -35977,7 +36027,7 @@ async function deliverUpdateCompletionEmail(config, payload, send = sendUpdateCo
       await send(config, payload);
       return { status: "accepted", attempts };
     } catch {
-      if (attempts < 3) await new Promise((resolve17) => setTimeout(resolve17, 250 * 2 ** (attempts - 1)));
+      if (attempts < 3) await new Promise((resolve18) => setTimeout(resolve18, 250 * 2 ** (attempts - 1)));
     }
   }
   return { status: "failed", attempts: Math.max(previousAttempts, 3), sanitizedReason: "delivery_failed" };
@@ -36608,9 +36658,9 @@ function exec(cmd, cwd) {
   return execSync(cmd, { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
 }
 function runInteractive(cmd, args, cwd) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const child = nodeSpawn(cmd, args, { cwd, stdio: "inherit", shell: false });
-    child.on("close", (code) => resolve17(code ?? 1));
+    child.on("close", (code) => resolve18(code ?? 1));
     child.on("error", reject);
   });
 }
@@ -36703,7 +36753,7 @@ function getInstallDeploymentMode(installPath, config) {
 function getOpenMatesCloudOverlayPath(flags, config) {
   const explicit = flags["openmatescloud-path"] ?? flags["openmates-cloud-path"];
   if (explicit === true) throw new Error("Provide an OpenMatesCloud path: --openmatescloud-path <dir>.");
-  if (typeof explicit === "string") return resolve6(explicit);
+  if (typeof explicit === "string") return resolve7(explicit);
   return config?.openMatesCloudOverlayPath;
 }
 function hasServiceFilter(flags) {
@@ -37095,7 +37145,7 @@ function fileHash(path2) {
 async function loadSelfHostComposeTemplate(templateRef, role, imageTag, packageVersion = getPackageVersion()) {
   const templateDir = process.env.OPENMATES_SELFHOST_TEMPLATE_DIR;
   if (templateDir) {
-    return readFileSync12(join15(resolve6(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
+    return readFileSync12(join15(resolve7(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
   }
   const packaged = packagedTemplatePath(role);
   const source = resolveTemplateSource({
@@ -37236,10 +37286,10 @@ function warnIfMissingLlmCredentials(installPath) {
 }
 async function confirmDestructive(phrase) {
   const rl = createInterface4({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     rl.question(`Type "${phrase}" to confirm: `, (answer) => {
       rl.close();
-      resolve17(answer.trim() === phrase);
+      resolve18(answer.trim() === phrase);
     });
   });
 }
@@ -37628,7 +37678,7 @@ function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
     writeEnvContent(installPath, content);
     return { overlayPath: null };
   }
-  const resolvedOverlayPath = resolve6(overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath));
+  const resolvedOverlayPath = resolve7(overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath));
   const overlayComposeFile = defaultOpenMatesCloudComposeFile(resolvedOverlayPath);
   if (!existsSync11(resolvedOverlayPath) || !existsSync11(overlayComposeFile)) {
     throw new Error(
@@ -37739,7 +37789,7 @@ function printServerCommandStart(subcommand, rest, flags) {
   console.log(renderOpenMatesAsciiLogo());
   console.log("");
   console.log(`Running OpenMates ${command}...`);
-  if (typeof flags.path === "string") console.log(`Path: ${resolve6(flags.path)}`);
+  if (typeof flags.path === "string") console.log(`Path: ${resolve7(flags.path)}`);
   if (typeof flags.role === "string") console.log(`Role: ${flags.role}`);
   console.log("");
 }
@@ -37881,7 +37931,7 @@ function createServerBackup(installPath, role, options = {}) {
   const plan = planBackup({ role, includeObservability: options.includeObservability });
   const backupDir = roleBackupDir(installPath, role);
   mkdirSync12(backupDir, { recursive: true, mode: 448 });
-  const archivePath = options.output ? resolve6(options.output) : join15(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
+  const archivePath = options.output ? resolve7(options.output) : join15(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
   mkdirSync12(dirname9(archivePath), { recursive: true, mode: 448 });
   const tempDir = mkdtempSync2(join15(backupDir, ".tmp-"));
   const env = readEnvMap(installPath);
@@ -37936,7 +37986,7 @@ function validateExtractedServerBackup(tempDir, role) {
   }
 }
 function withValidatedServerBackup(installPath, role, file, useBackup, tempRoot = roleBackupDir(installPath, role)) {
-  const archivePath = resolve6(file);
+  const archivePath = resolve7(file);
   if (!existsSync11(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
   mkdirSync12(tempRoot, { recursive: true, mode: 448 });
   const tempDir = mkdtempSync2(join15(tempRoot, ".restore-"));
@@ -38291,12 +38341,12 @@ async function serverRegister(flags) {
   if (!existsSync11(envPath)) {
     throw new Error(`Runtime env file not found: ${envPath}`);
   }
-  const gitRoot = resolve6(exec("git rev-parse --show-toplevel", installPath));
+  const gitRoot = resolve7(exec("git rev-parse --show-toplevel", installPath));
   if (gitRoot !== installPath) {
     throw new Error(`--path must point to the OpenMates Git checkout root (${gitRoot}).`);
   }
   const existing = loadServerConfig();
-  if (existing?.installPath && resolve6(existing.installPath) !== installPath && flags.yes !== true) {
+  if (existing?.installPath && resolve7(existing.installPath) !== installPath && flags.yes !== true) {
     throw new Error(
       `Another server is registered at ${existing.installPath}. Rerun with --yes to replace the local CLI registration; no server data will be changed.`
     );
@@ -38346,8 +38396,8 @@ async function serverRegister(flags) {
   }
 }
 async function serverInstall(flags) {
-  const installPath = typeof flags.path === "string" ? resolve6(flags.path) : DEFAULT_INSTALL_PATH;
-  const sourcePath = typeof flags["source-path"] === "string" ? resolve6(flags["source-path"]) : null;
+  const installPath = typeof flags.path === "string" ? resolve7(flags.path) : DEFAULT_INSTALL_PATH;
+  const sourcePath = typeof flags["source-path"] === "string" ? resolve7(flags["source-path"]) : null;
   const fromSource = flags["from-source"] === true || sourcePath !== null;
   const role = getServerRole(flags, null);
   const profile = getCoreProfile(flags, null);
@@ -38372,7 +38422,7 @@ async function serverInstall(flags) {
     mkdirSync12(installPath, { recursive: true });
     ensureRuntimeMetricsDirectory(installPath);
     if (typeof flags["env-path"] === "string") {
-      const envSource = resolve6(flags["env-path"]);
+      const envSource = resolve7(flags["env-path"]);
       if (!existsSync11(envSource)) {
         throw new Error(`Env file not found: ${envSource}`);
       }
@@ -38450,7 +38500,7 @@ CLI default API: ${cliUrls2.apiUrl}`);
   }
   ensureRuntimeMetricsDirectory(installPath);
   if (typeof flags["env-path"] === "string") {
-    const envSource = resolve6(flags["env-path"]);
+    const envSource = resolve7(flags["env-path"]);
     if (!existsSync11(envSource)) {
       throw new Error(`Env file not found: ${envSource}`);
     }
@@ -38727,7 +38777,7 @@ async function persistRuntimeResult(installPath, role, output) {
   return deliveries.flat();
 }
 async function installRuntimeMonitoringServices(installPath, role) {
-  const executablePath = resolve6(process.argv[1] ?? "/usr/local/bin/openmates");
+  const executablePath = resolve7(process.argv[1] ?? "/usr/local/bin/openmates");
   const plan = planRuntimeMonitoringServices({ role, installPath, executablePath });
   const notificationConfig = runtimeNotificationConfig(installPath);
   const emailServiceAvailable = notificationConfig.email ? await probeRuntimeEmailService(notificationConfig.email) : false;
@@ -38814,7 +38864,9 @@ async function autoInstallRuntimeMonitoringServices(installPath, role) {
 }
 function caddyUpdatePlan(installPath, role, config, flags) {
   if (flags["caddy-config"] === true) throw new Error("Provide --caddy-config <file>.");
-  const configPath = resolve6(typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : "/etc/caddy/Caddyfile");
+  const explicit = typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : void 0;
+  const configPath = detectCaddyConfigPath(explicit) ?? "/etc/caddy/Caddyfile";
+  if (explicit && !existsSync11(configPath)) throw new Error("caddy_explicit_config_missing");
   const required2 = role === "core" && getInstallDeploymentMode(installPath, config) === "official_cloud";
   if (!existsSync11(configPath) && required2) throw new Error("Managed cloud Caddyfile is missing; update cannot proceed.");
   const prior = role === "upload" ? readCaddyUpdateState(join15(installPath, ".openmates", "caddy", `${role}.json`), configPath, null) : void 0;
@@ -38896,7 +38948,69 @@ async function runCaddyUpdateStep(input) {
   } catch (error) {
     const reason = error instanceof Error && /^caddy_[a-z_:-]+$/.test(error.message) ? error.message : "caddy_update_failed";
     writeServerUpdateStatus(input.installPath, input.role, { status: "degraded", step: "caddy-update", caddy: { status: "failed", sanitizedReason: reason } });
-    throw new Error(`Caddy update failed (${reason}); update is degraded. Updated containers remain running.`);
+    const command = caddyRetryForInstall(input.installPath, input.role, input.flags, reason);
+    throw new Error(`Caddy update failed (${reason}); update is degraded. Updated containers remain running.
+After resolving the reported problem, run:
+${command}`);
+  }
+}
+function caddyRetryForInstall(installPath, role, flags, reason) {
+  const explicit = typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : void 0;
+  let configPath = explicit ?? "/path/to/active/Caddyfile";
+  try {
+    configPath = detectCaddyConfigPath(explicit) ?? "/etc/caddy/Caddyfile";
+  } catch {
+  }
+  return caddyUpdateRetryCommand({
+    installPath,
+    role,
+    configPath,
+    profile: flags["caddy-profile"] === "official-upload" || reason === "caddy_profile_required_official_upload" ? "official-upload" : void 0
+  });
+}
+async function updateCaddyOnly(installPath, role, config, flags) {
+  const release2 = acquireServerUpdateLock(installPath);
+  let result;
+  try {
+    await withEngineeringRuntimeOperation(installPath, "caddy-update", ["caddy"], async () => {
+      result = await updateServerCaddy({ installPath, role, config, flags, mode: getInstallMode(installPath, config), withOverrides: flags["with-overrides"] === true || config?.composeProfile === "full" });
+    });
+    return result;
+  } finally {
+    release2();
+  }
+}
+async function updateCaddyAfterCliUpgrade(flags) {
+  let installPath;
+  try {
+    installPath = resolveServerPath(flags);
+  } catch (error) {
+    if (flags.path !== void 0) throw error;
+    return void 0;
+  }
+  const config = loadConfigForInstallPath(installPath);
+  const role = getServerRole(flags, config);
+  let configPath;
+  try {
+    configPath = detectCaddyConfigPath(typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : void 0);
+  } catch {
+    return { status: "pending", reason: "caddy_running_config_requires_explicit_path", retryCommand: caddyUpdateRetryCommand({ installPath, role, configPath: "/path/to/active/Caddyfile" }) };
+  }
+  if (!configPath) return void 0;
+  const retryCommand = caddyUpdateRetryCommand({
+    installPath,
+    role,
+    configPath,
+    profile: flags["caddy-profile"] === "official-upload" ? "official-upload" : void 0
+  });
+  if (flags["dry-run"] === true || !config && typeof flags.path !== "string") {
+    return { status: flags["dry-run"] === true ? "planned" : "pending", retryCommand };
+  }
+  try {
+    return await updateCaddyOnly(installPath, role, config, { ...flags, "caddy-config": configPath });
+  } catch (error) {
+    const reason = error instanceof Error && /^caddy_[a-z_:-]+$/.test(error.message) ? error.message : "caddy_update_failed";
+    return { status: "pending", retryCommand: reason === "caddy_profile_required_official_upload" ? caddyUpdateRetryCommand({ installPath, role, configPath, profile: "official-upload" }) : retryCommand, reason };
   }
 }
 async function serverUpdate(client2, rest, flags) {
@@ -39515,7 +39629,7 @@ async function serverMonitoring(rest, flags) {
   const config = loadConfigForInstallPath(installPath);
   const role = getServerRole(flags, config);
   if (rest[0] === "install-service") {
-    const plan = planRuntimeMonitoringServices({ role, installPath, executablePath: resolve6(process.argv[1] ?? "/usr/local/bin/openmates") });
+    const plan = planRuntimeMonitoringServices({ role, installPath, executablePath: resolve7(process.argv[1] ?? "/usr/local/bin/openmates") });
     const files = [
       [plan.serviceName, plan.unit],
       [plan.timerName, plan.timer],
@@ -40212,9 +40326,35 @@ async function serverPreflight(flags) {
   console.log(`  Caddy steps:   ${caddyPlan.steps.join(" -> ")}`);
 }
 async function serverCaddy(rest, flags) {
+  if (rest[0] === "update") {
+    if (flags["caddy-config"] === true) throw new Error("Provide --caddy-config <file>.");
+    const installPath = resolveServerPath(flags);
+    const config2 = loadConfigForInstallPath(installPath);
+    const role2 = getServerRole(flags, config2);
+    try {
+      const plan2 = caddyUpdatePlan(installPath, role2, config2, flags);
+      const retryCommand = caddyUpdateRetryCommand({ installPath, role: role2, configPath: plan2.configPath, profile: plan2.profile });
+      if (flags["dry-run"] === true) {
+        if (flags.json === true) printJson({ command: "caddy update", ...plan2, role: role2, path: installPath, mode: getInstallMode(installPath, config2), retryCommand });
+        else console.log(`Caddy release update: ${plan2.status}
+Run: ${retryCommand}`);
+        return;
+      }
+      const result = plan2.status === "not_installed" ? { status: "not_installed" } : await updateCaddyOnly(installPath, role2, config2, { ...flags, "caddy-config": plan2.configPath });
+      if (flags.json === true) printJson({ command: "caddy update", role: role2, ...result });
+      else console.log(`Caddy: ${result.status}`);
+    } catch (error) {
+      const reason = error instanceof Error && /^caddy_[a-z_:-]+$/.test(error.message) ? error.message : "caddy_update_failed";
+      const retryCommand = caddyRetryForInstall(installPath, role2, flags, reason);
+      throw new Error(`Caddy update failed (${reason}).
+After resolving the reported problem, run:
+${retryCommand}`);
+    }
+    return;
+  }
   const action = rest[0] ?? "status";
   if (!["check", "status", "diff", "apply"].includes(action)) {
-    throw new Error("Usage: openmates server caddy check|status|diff|apply [--role core|upload|preview]");
+    throw new Error("Usage: openmates server caddy check|status|diff|apply|update [--role core|upload|preview]");
   }
   const config = loadServerConfig();
   const role = getServerRole(flags, config);
@@ -40503,6 +40643,8 @@ Command Options:
 
   caddy:
     openmates server caddy check|status|diff|apply [--role core|upload|preview] [--config /etc/caddy/Caddyfile]
+    openmates server caddy update [--path <installation>] [--role core|upload|preview] [--caddy-config <file>] [--dry-run]
+      Merge the installed server release's configuration, preserve host edits, validate and reload.
 
   reset:
     --delete-user-data-only   Only delete database and cache (preserve config)
@@ -40605,7 +40747,7 @@ async function handleServer(client2, subcommand, rest, flags) {
 
 // src/codeRunInput.ts
 import { readdir, readFile as readFile2, stat as stat2 } from "fs/promises";
-import { basename as basename3, relative as relative2, resolve as resolve7 } from "path";
+import { basename as basename3, relative as relative2, resolve as resolve8 } from "path";
 var CODE_RUN_MAX_FILES = 50;
 var CODE_RUN_MAX_FILE_BYTES = 1e6;
 var CODE_RUN_MAX_TOTAL_BYTES = 1e7;
@@ -40649,7 +40791,7 @@ async function buildCodeRunRequestsFromFlags(flags) {
     }, buffer.byteLength);
   }
   for (const filePath of toList(flags.file)) {
-    const absolute = resolve7(filePath);
+    const absolute = resolve8(filePath);
     const buffer = await readFile2(absolute);
     const sandboxPath = normalizeCodeRunPath(basename3(filePath));
     addFile({
@@ -40661,7 +40803,7 @@ async function buildCodeRunRequestsFromFlags(flags) {
     }, buffer.byteLength);
   }
   for (const dirPath of toList(flags.dir)) {
-    const root = resolve7(dirPath);
+    const root = resolve8(dirPath);
     const dirFiles = await collectDirectoryFiles(root, flags.include, flags.exclude);
     for (const absolute of dirFiles) {
       const sandboxPath = normalizeCodeRunPath(relative2(root, absolute).replace(/\\/g, "/"));
@@ -40758,7 +40900,7 @@ async function collectDirectoryFiles(root, include, exclude) {
   const files = [];
   async function walk(directory) {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
-      const absolute = resolve7(directory, entry.name);
+      const absolute = resolve8(directory, entry.name);
       const rel = relative2(root, absolute).replace(/\\/g, "/");
       if (matchesAny(rel, excludes) || matchesAny(entry.name, excludes)) continue;
       if (entry.isDirectory()) {
@@ -84150,7 +84292,7 @@ function buildAssistantFeedbackDecision(rating) {
 import { createHash as createHash18, randomUUID as randomUUID15 } from "crypto";
 import { existsSync as existsSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync13, readdirSync as readdirSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, join as join16, resolve as resolve8 } from "path";
+import { dirname as dirname10, join as join16, resolve as resolve9 } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_JUDGE_MODEL = "google/gemini-3-flash-preview";
 var DEFAULT_PROMPT_BUDGET_MODEL = "google/gemini-3.5-flash";
@@ -84564,7 +84706,7 @@ async function handleBenchmark(client2, subcommand, rest, flags) {
   const dryRun = flags["dry-run"] === true;
   const output = typeof flags.output === "string" ? flags.output : void 0;
   const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID15();
-  const imagePath = typeof flags.image === "string" ? resolve8(flags.image) : defaultImageFixturePath();
+  const imagePath = typeof flags.image === "string" ? resolve9(flags.image) : defaultImageFixturePath();
   if (!dryRun && flags["confirm-spend-credits"] !== true) {
     throw new Error(
       "Benchmark runs spend real credits from the logged-in account. Rerun with --confirm-spend-credits, or use --dry-run to preview the plan."
@@ -85376,7 +85518,7 @@ function findProvidersDir() {
     const candidate = join16(current, "backend", "providers");
     if (existsSync12(candidate)) return candidate;
     const parentCandidate = join16(current, "..", "..", "backend", "providers");
-    if (existsSync12(parentCandidate)) return resolve8(parentCandidate);
+    if (existsSync12(parentCandidate)) return resolve9(parentCandidate);
     const next = dirname10(current);
     if (next === current) break;
     current = next;
@@ -89768,8 +89910,8 @@ function watchTuiAuthoring(context, event, jobId) {
   control.watching = true;
   void (async () => {
     for (let attempt = 0; attempt < 40 && context.state.chatContextAuthoringControls[event.event_id] === control; attempt++) {
-      await new Promise((resolve17) => {
-        const timer = setTimeout(resolve17, 3e3);
+      await new Promise((resolve18) => {
+        const timer = setTimeout(resolve18, 3e3);
         timer.unref();
       });
       if (context.state.chatContextAuthoringControls[event.event_id] !== control) return;
@@ -89822,16 +89964,16 @@ async function openTuiAuthoringExecutor(context, event) {
     ws,
     chatId: event.chat_id,
     chatKey: key,
-    requestApproval: (request) => new Promise((resolve17) => {
+    requestApproval: (request) => new Promise((resolve18) => {
       if (approval) {
-        resolve17(false);
+        resolve18(false);
         return;
       }
-      approval = resolve17;
+      approval = resolve18;
       control.approve = () => {
         approval = void 0;
         control.approve = void 0;
-        resolve17(true);
+        resolve18(true);
       };
       const entry = context.state.chatContextAuthoringJobs[event.event_id];
       if (entry) entry.status = "needs_write_approval";
@@ -91055,8 +91197,8 @@ async function runTui(client2, terminal = new TuiTerminal()) {
     }).catch(() => {
     });
   }
-  return new Promise((resolve17) => {
-    resolveResult = resolve17;
+  return new Promise((resolve18) => {
+    resolveResult = resolve18;
   });
 }
 async function handleKey(params) {
@@ -91894,17 +92036,17 @@ function clamp(value, min, max) {
 import { createHash as createHash21 } from "crypto";
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync13, readFileSync as readFileSync14, readdirSync as readdirSync7 } from "fs";
-import { isAbsolute as isAbsolute3, join as join17, resolve as resolve9 } from "path";
+import { isAbsolute as isAbsolute4, join as join17, resolve as resolve10 } from "path";
 import lockfile4 from "proper-lockfile";
 function startCodexTaskBridges(roots, snapshots, stateRoot, notice) {
   const configPath = join17(stateRoot, "codex-adapter.json");
   const children = [];
   if (existsSync13(configPath)) {
     const config = JSON.parse(readFileSync14(configPath, "utf8"));
-    for (const root of new Set(roots.map((path2) => resolve9(path2)))) {
+    for (const root of new Set(roots.map((path2) => resolve10(path2)))) {
       const entry = config.repositories?.[root];
-      if (!entry?.enabled || !entry.events_enabled || !entry.runtime || !isAbsolute3(entry.runtime) || !existsSync13(entry.runtime)) continue;
-      if (!entry.snapshots?.length || !entry.snapshots.every((path2) => snapshots.includes(resolve9(path2)))) continue;
+      if (!entry?.enabled || !entry.events_enabled || !entry.runtime || !isAbsolute4(entry.runtime) || !existsSync13(entry.runtime)) continue;
+      if (!entry.snapshots?.length || !entry.snapshots.every((path2) => snapshots.includes(resolve10(path2)))) continue;
       const child = spawn3("python3", [entry.runtime, "serve", "--repository", root], {
         cwd: root,
         env: { ...process.env, OPENMATES_STATE_DIR: stateRoot },
@@ -92086,11 +92228,11 @@ import {
 } from "fs";
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash28 } from "crypto";
-import { extname as extname4, join as join25, resolve as resolve15, relative as relative11 } from "path";
+import { extname as extname4, join as join25, resolve as resolve16, relative as relative11 } from "path";
 
 // src/projectSourceRootPolicy.ts
 import { existsSync as existsSync15, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
-import { basename as basename4, dirname as dirname11, relative as relative3, resolve as resolve10 } from "path";
+import { basename as basename4, dirname as dirname11, relative as relative3, resolve as resolve11 } from "path";
 function canonicalProjectSourceRoot(sourceRoot, options = {}) {
   const root = realpathSync2(sourceRoot);
   if (!statSync2(root).isDirectory()) throw new Error("Project source root is not a directory");
@@ -92104,15 +92246,15 @@ function canonicalOpenMatesStateDirectory(stateDirectory = resolveStateDir()) {
   return canonicalizePotentialPath(stateDirectory);
 }
 function canonicalizePotentialPath(value) {
-  let existing = resolve10(value);
+  let existing = resolve11(value);
   const suffix = [];
   while (!existsSync15(existing)) {
     const parent = dirname11(existing);
-    if (parent === existing) return resolve10(value);
+    if (parent === existing) return resolve11(value);
     suffix.unshift(basename4(existing));
     existing = parent;
   }
-  return resolve10(realpathSync2(existing), ...suffix);
+  return resolve11(realpathSync2(existing), ...suffix);
 }
 function isEqualOrInside(parent, candidate) {
   const path2 = relative3(parent, candidate);
@@ -92140,7 +92282,7 @@ import {
   unlinkSync,
   writeSync
 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute4, join as join19, relative as relative4, resolve as resolve11 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute5, join as join19, relative as relative4, resolve as resolve12 } from "path";
 var DEFAULT_MAX_IGNORE_FILES = 128;
 var DEFAULT_MAX_IGNORE_BYTES = 1024 * 1024;
 var MAX_POLICY_ENTRIES = 5e4;
@@ -92266,7 +92408,7 @@ function collectIgnoreFiles(policyRoot, sourceRoot, limits) {
   for (const directory of chain.reverse()) add(join19(directory, ".gitignore"));
   for (const target of limits.targetPaths) {
     const normalized = target === "." ? "" : normalizeSourceRelativePath(target);
-    const absolute = normalized ? resolve11(sourceRoot, normalized) : sourceRoot;
+    const absolute = normalized ? resolve12(sourceRoot, normalized) : sourceRoot;
     if (!isInside2(sourceRoot, absolute)) throw new Error("Project policy target escapes its source root");
     const targetIsDirectory = existsSync16(absolute) && lstatSync4(absolute).isDirectory();
     let directory = targetIsDirectory ? absolute : dirname12(absolute);
@@ -92306,7 +92448,7 @@ function collectIgnoreFiles(policyRoot, sourceRoot, limits) {
   return files;
 }
 function updateStickyPrivatePaths(sourceRoot, additions, stateDirectory) {
-  const stateRoot = resolve11(stateDirectory, POLICY_STATE_DIRECTORY);
+  const stateRoot = resolve12(stateDirectory, POLICY_STATE_DIRECTORY);
   if (isInside2(sourceRoot, stateRoot) || isInside2(stateRoot, sourceRoot)) {
     throw new Error("Project path policy state must stay outside the source root");
   }
@@ -92380,7 +92522,7 @@ function preparePrivateDirectory(path2) {
   if (!statSync3(path2).isDirectory()) throw new Error("Project path policy state is not a directory");
 }
 function normalizeSourceRelativePath(value) {
-  if (typeof value !== "string" || !value || value.includes("\\") || isAbsolute4(value) || value.split("/").some((part) => !part || part === "." || part === "..") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+  if (typeof value !== "string" || !value || value.includes("\\") || isAbsolute5(value) || value.split("/").some((part) => !part || part === "." || part === "..") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
     throw new ProjectPathPolicyError(`Project path is invalid: ${String(value)}`);
   }
   return value;
@@ -92388,7 +92530,7 @@ function normalizeSourceRelativePath(value) {
 function normalizeRelative(root, target) {
   const result = relative4(root, target).split("\\").join("/");
   if (!result || result === ".") return "";
-  if (result.startsWith("../") || result === ".." || isAbsolute4(result)) throw new Error("Project policy path escapes its root");
+  if (result.startsWith("../") || result === ".." || isAbsolute5(result)) throw new Error("Project policy path escapes its root");
   return result;
 }
 function boundedInteger(value, fallback2, label3) {
@@ -92397,8 +92539,8 @@ function boundedInteger(value, fallback2, label3) {
   return result;
 }
 function isInside2(root, candidate) {
-  const relation = relative4(resolve11(root), resolve11(candidate));
-  return relation === "" || !relation.startsWith("..") && !isAbsolute4(relation);
+  const relation = relative4(resolve12(root), resolve12(candidate));
+  return relation === "" || !relation.startsWith("..") && !isAbsolute5(relation);
 }
 function sha2562(value) {
   return createHash23("sha256").update(value).digest("hex");
@@ -92431,7 +92573,7 @@ import {
   writeFileSync as writeFileSync9
 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
-import { basename as basename5, dirname as dirname13, isAbsolute as isAbsolute5, join as join21, relative as relative5, resolve as resolve12 } from "path";
+import { basename as basename5, dirname as dirname13, isAbsolute as isAbsolute6, join as join21, relative as relative5, resolve as resolve13 } from "path";
 import lockfile6 from "proper-lockfile";
 
 // src/projectFileRisk.ts
@@ -92791,7 +92933,7 @@ function validateMutation(input) {
   return { ...parsed, path: validateRelativePath(parsed.path) };
 }
 function validateRelativePath(value) {
-  if (typeof value !== "string" || value.length === 0 || value.length > 4096 || isAbsolute5(value) || value.includes("\\") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || value.split("/").some((part) => !part || part === "." || part === "..")) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 4096 || isAbsolute6(value) || value.includes("\\") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || value.split("/").some((part) => !part || part === "." || part === "..")) {
     throw new RemoteFileMutationError("invalid_path", "Project file path must be a strict root-relative POSIX path");
   }
   return value;
@@ -93084,7 +93226,7 @@ function temporaryName() {
 }
 function isInside3(root, candidate) {
   const relation = relative5(root, candidate);
-  return relation === "" || !relation.startsWith("..") && !isAbsolute5(relation) && resolve12(root, relation) === resolve12(candidate);
+  return relation === "" || !relation.startsWith("..") && !isAbsolute6(relation) && resolve13(root, relation) === resolve13(candidate);
 }
 
 // src/remoteFileTransfers.ts
@@ -93361,19 +93503,19 @@ async function executeRemoteFileTransfer(input) {
 
 // src/remoteCommandSource.ts
 import { existsSync as existsSync21, realpathSync as realpathSync10, statSync as statSync9 } from "fs";
-import { basename as basename7, dirname as dirname14, relative as relative10, resolve as resolve14 } from "path";
+import { basename as basename7, dirname as dirname14, relative as relative10, resolve as resolve15 } from "path";
 
 // src/remoteCommandRuntime.ts
 import { createHash as createHash26, randomUUID as randomUUID21 } from "crypto";
 import { spawn as spawn6, spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync19, lstatSync as lstatSync9, readdirSync as readdirSync11, realpathSync as realpathSync7, statSync as statSync6 } from "fs";
-import { isAbsolute as isAbsolute7, join as join22, relative as relative7, resolve as resolve13, sep } from "path";
+import { isAbsolute as isAbsolute8, join as join22, relative as relative7, resolve as resolve14, sep } from "path";
 
 // src/remoteCommandAppArmor.ts
 import { createHash as createHash25 } from "crypto";
 import { spawn as spawn5 } from "child_process";
 import { lstatSync as lstatSync8, readFileSync as readFileSync17, realpathSync as realpathSync6, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute6, relative as relative6 } from "path";
+import { isAbsolute as isAbsolute7, relative as relative6 } from "path";
 var REMOTE_COMMAND_APPARMOR_BROKER = "/usr/libexec/openmates-command-apparmor";
 var REMOTE_COMMAND_APPARMOR_EXEC = "/usr/bin/aa-exec";
 var REMOTE_COMMAND_BWRAP = "/usr/libexec/openmates-bwrap";
@@ -93555,7 +93697,7 @@ function validatePolicyGlob(value, context) {
   return normalized;
 }
 function validateProjectPath(value, context) {
-  if (typeof value !== "string" || !value || Buffer.byteLength(value) > MAX_POLICY_PATH_BYTES || isAbsolute6(value) || value.includes("\\") || value.includes("*") || value.includes("?") || value.split("/").some((part) => !part || part === "." || part === "..") || hasControl2(value)) {
+  if (typeof value !== "string" || !value || Buffer.byteLength(value) > MAX_POLICY_PATH_BYTES || isAbsolute7(value) || value.includes("\\") || value.includes("*") || value.includes("?") || value.split("/").some((part) => !part || part === "." || part === "..") || hasControl2(value)) {
     throw new Error(`Invalid AppArmor ${context} path`);
   }
   return value;
@@ -93578,7 +93720,7 @@ function brokerIdentifier(value, context, pattern) {
 }
 function isInside4(root, candidate) {
   const path2 = relative6(root, candidate);
-  return path2 === "" || !path2.startsWith("..") && !isAbsolute6(path2);
+  return path2 === "" || !path2.startsWith("..") && !isAbsolute7(path2);
 }
 function hasControl2(value) {
   return [...value].some((character) => {
@@ -93831,7 +93973,7 @@ var RemoteCommandRuntime = class {
     }
     if (prepared.sandbox_command) {
       const command = prepared.sandbox_command;
-      if (!isAbsolute7(command.executable) || command.executable.includes("\0") || !Array.isArray(command.args) || command.args.some((argument) => typeof argument !== "string" || argument.includes("\0"))) {
+      if (!isAbsolute8(command.executable) || command.executable.includes("\0") || !Array.isArray(command.args) || command.args.some((argument) => typeof argument !== "string" || argument.includes("\0"))) {
         throw new RemoteCommandError("network_profile_unavailable", "Network transport returned an invalid sandbox bridge command");
       }
     }
@@ -94155,7 +94297,7 @@ function prepareSandboxLaunch(preflight, authority, capability, network, appArmo
     }
   }
   const appArmorEnvironment = appArmor.sandbox_environment;
-  if (!appArmorEnvironment || Object.keys(appArmorEnvironment).length !== 1 || typeof appArmorEnvironment.LD_PRELOAD !== "string" || !isAbsolute7(appArmorEnvironment.LD_PRELOAD) || appArmorEnvironment.LD_PRELOAD.includes("\0")) {
+  if (!appArmorEnvironment || Object.keys(appArmorEnvironment).length !== 1 || typeof appArmorEnvironment.LD_PRELOAD !== "string" || !isAbsolute8(appArmorEnvironment.LD_PRELOAD) || appArmorEnvironment.LD_PRELOAD.includes("\0")) {
     throw new RemoteCommandError("confinement_unavailable", "AppArmor confinement returned an invalid Git config compatibility library");
   }
   const environment = { ...SAFE_ENVIRONMENT, ...networkEnvironment, ...appArmorEnvironment };
@@ -94239,7 +94381,7 @@ function validatePolicy2(policy) {
   if (policy.source_access !== "read_only" && policy.source_access !== "read_write") throw new RemoteCommandError("invalid_request", "Invalid source access");
   if (policy.mode === "background" && policy.source_access !== "read_only") throw new RemoteCommandError("invalid_request", "Background commands must use read-only source access");
   if (!Number.isSafeInteger(policy.deadline_ms) || policy.deadline_ms < MIN_DEADLINE_MS2 || policy.deadline_ms > MAX_DEADLINE_MS2) throw new RemoteCommandError("invalid_request", "Invalid command deadline");
-  if (isAbsolute7(policy.cwd) || policy.cwd.includes("\0") || policy.cwd.split(/[\\/]/).includes("..")) throw new RemoteCommandError("invalid_request", "Command cwd must stay inside the Project");
+  if (isAbsolute8(policy.cwd) || policy.cwd.includes("\0") || policy.cwd.split(/[\\/]/).includes("..")) throw new RemoteCommandError("invalid_request", "Command cwd must stay inside the Project");
   for (const [name, value] of [["writable_profiles", policy.writable_profiles], ["credential_profiles", policy.credential_profiles]]) {
     if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(id))) throw new RemoteCommandError("invalid_request", `Invalid ${name}`);
     assertUnique2(value, name);
@@ -94344,7 +94486,7 @@ function assertCapability(capability) {
 }
 function canonicalDirectory(path2) {
   const canonical = realpath(path2);
-  if (canonical === resolve13("/")) throw new RemoteCommandError("invalid_request", "The host filesystem root cannot be mounted as a command resource");
+  if (canonical === resolve14("/")) throw new RemoteCommandError("invalid_request", "The host filesystem root cannot be mounted as a command resource");
   if (!statSync6(canonical).isDirectory()) throw new RemoteCommandError("invalid_request", `Command resource is not a directory: ${path2}`);
   return canonical;
 }
@@ -94413,7 +94555,7 @@ function assertUnique2(values, context) {
 }
 function isInside5(root, candidate) {
   const path2 = relative7(root, candidate);
-  return path2 === "" || !path2.startsWith("..") && !isAbsolute7(path2);
+  return path2 === "" || !path2.startsWith("..") && !isAbsolute8(path2);
 }
 function truncateUtf8(value, maximum) {
   const bytes2 = Buffer.from(value);
@@ -94443,7 +94585,7 @@ import { lookup as dnsLookup } from "dns/promises";
 import { chmodSync as chmodSync10, mkdtempSync as mkdtempSync4, realpathSync as realpathSync8, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync10 } from "fs";
 import { isIP as isIP2, createConnection, createServer } from "net";
 import { tmpdir as tmpdir6 } from "os";
-import { isAbsolute as isAbsolute8, join as join23, relative as relative8 } from "path";
+import { isAbsolute as isAbsolute9, join as join23, relative as relative8 } from "path";
 var DEFAULT_BRIDGE_PORT = 43117;
 var MAX_CONNECT_HEADER_BYTES = 8 * 1024;
 var CONNECT_HEADER_TIMEOUT_MS = 1e4;
@@ -94647,7 +94789,7 @@ function createPrivateControlDirectory(preflight, configuredRoots) {
   const roots = configuredRoots ?? [process.env.XDG_RUNTIME_DIR, tmpdir6()].filter((value) => Boolean(value));
   for (const candidate of roots) {
     try {
-      if (!isAbsolute8(candidate) || !statSync7(candidate).isDirectory()) continue;
+      if (!isAbsolute9(candidate) || !statSync7(candidate).isDirectory()) continue;
       const root = realpathSync8(candidate);
       const directory = mkdtempSync4(join23(root, "openmates-command-network-"));
       chmodSync10(directory, 448);
@@ -94684,7 +94826,7 @@ function ipv6Words(address) {
 }
 function isInside6(root, candidate) {
   const path2 = relative8(root, candidate);
-  return path2 === "" || !path2.startsWith("..") && !isAbsolute8(path2);
+  return path2 === "" || !path2.startsWith("..") && !isAbsolute9(path2);
 }
 function listenUnix(server2, path2) {
   return new Promise((resolvePromise, reject) => {
@@ -94708,7 +94850,7 @@ function capabilityError(message) {
 // src/remoteCommandResourceGrants.ts
 import { createHash as createHash27 } from "crypto";
 import { chmodSync as chmodSync11, existsSync as existsSync20, lstatSync as lstatSync10, mkdirSync as mkdirSync17, readFileSync as readFileSync18, realpathSync as realpathSync9, renameSync as renameSync8, statSync as statSync8, writeFileSync as writeFileSync11 } from "fs";
-import { isAbsolute as isAbsolute9, join as join24, relative as relative9 } from "path";
+import { isAbsolute as isAbsolute10, join as join24, relative as relative9 } from "path";
 var STORE_FILE = "remote-command-resource-grants.json";
 var ID = /^[a-z][a-z0-9-]{0,63}$/;
 var ENV = /^[A-Z_][A-Z0-9_]{0,127}$/;
@@ -94721,7 +94863,7 @@ function listRemoteCommandResourceGrants(projectId, sourceId) {
 function enableRemoteCommandWritableGrant(input) {
   const definition = input.permissions.resource_profiles.writable.find((item) => item.id === input.profileId);
   if (!definition) throw new Error(`Unknown writable profile: ${input.profileId}`);
-  if (!isAbsolute9(input.hostPath)) throw new Error("--host-path must be absolute");
+  if (!isAbsolute10(input.hostPath)) throw new Error("--host-path must be absolute");
   const root = realpathSync9(input.projectRoot);
   const hostPath = realpathSync9(input.hostPath);
   if (!statSync8(hostPath).isDirectory()) throw new Error("Writable profile host path must be a directory");
@@ -94834,7 +94976,7 @@ function validateIdentity(projectId, sourceId, profileId) {
 }
 function isInside7(parent, child) {
   const value = relative9(parent, child);
-  return value !== "" && !value.startsWith("..") && !isAbsolute9(value);
+  return value !== "" && !value.startsWith("..") && !isAbsolute10(value);
 }
 function pathsOverlap2(left, right) {
   return left === right || isInside7(left, right) || isInside7(right, left);
@@ -95675,14 +95817,14 @@ function canonicalStateDirectory() {
   const path2 = resolveStateDir();
   if (existsSync21(path2)) return realpathSync10(path2);
   const tail = [];
-  let parent = resolve14(path2);
+  let parent = resolve15(path2);
   while (!existsSync21(parent)) {
     const next = dirname14(parent);
     if (next === parent) break;
     tail.unshift(basename7(parent));
     parent = next;
   }
-  return resolve14(realpathSync10(parent), ...tail);
+  return resolve15(realpathSync10(parent), ...tail);
 }
 function pathsOverlap3(left, right) {
   return left === right || isInsideDirectory(left, right) || isInsideDirectory(right, left);
@@ -95775,7 +95917,7 @@ function resolveRemoteAccessRoots(pathFlag, cwd = process.cwd()) {
   }
   const roots = [];
   for (const value of requested) {
-    const candidate = resolve15(cwd, value);
+    const candidate = resolve16(cwd, value);
     if (!existsSync22(candidate) || !statSync10(candidate).isDirectory()) {
       throw new Error(`Remote source path does not exist or is not a directory: ${candidate}`);
     }
@@ -96547,7 +96689,7 @@ function resolveRemoteCachePath(sourceId, homeDirectory) {
 }
 function startRemoteAccessSource(input) {
   assertSafeSourceId(input.sourceId);
-  const requestedRootPath = resolve15(input.rootPath);
+  const requestedRootPath = resolve16(input.rootPath);
   if (!existsSync22(requestedRootPath) || !statSync10(requestedRootPath).isDirectory()) {
     throw new Error(`Remote source path does not exist or is not a directory: ${requestedRootPath}`);
   }
@@ -97067,9 +97209,9 @@ function minimalRgEnvironment() {
   return env;
 }
 function isPathInsideRoot(sourceRoot, relativePath2) {
-  const resolvedPath = resolve15(sourceRoot, relativePath2);
+  const resolvedPath = resolve16(sourceRoot, relativePath2);
   const relation = relative11(sourceRoot, resolvedPath);
-  return relation === "" || !relation.startsWith("..") && !resolve15(relation).startsWith("/..");
+  return relation === "" || !relation.startsWith("..") && !resolve16(relation).startsWith("/..");
 }
 function isBinaryPath(path2) {
   const lowerPath = path2.toLowerCase();
@@ -97108,7 +97250,7 @@ function hasControlCharacters3(value) {
 }
 function resolveApprovedPath(sourceRoot, relativePath2) {
   if (!relativePath2 || relativePath2.includes("\0")) throw new Error("Remote source path is invalid");
-  const lexical = resolve15(sourceRoot, relativePath2);
+  const lexical = resolve16(sourceRoot, relativePath2);
   assertInsideRoot(sourceRoot, lexical);
   const relation = relative11(sourceRoot, lexical);
   let current = sourceRoot;
@@ -97122,7 +97264,7 @@ function resolveApprovedPath(sourceRoot, relativePath2) {
 }
 function assertInsideRoot(sourceRoot, path2) {
   const relation = relative11(sourceRoot, path2);
-  if (relation.startsWith("..") || resolve15(sourceRoot, relation) !== resolve15(path2)) {
+  if (relation.startsWith("..") || resolve16(sourceRoot, relation) !== resolve16(path2)) {
     throw new Error("Remote source path escapes the approved source root");
   }
 }
@@ -97250,10 +97392,10 @@ async function ensureRemoteCommandSetup(options, dependencies = {}) {
   return { installed: true, capability: installed };
 }
 function inheritedInstaller(executable, args) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const child = spawn8(executable, args, { stdio: "inherit" });
     child.once("error", reject);
-    child.once("close", (code, signal) => resolve17({ code, signal }));
+    child.once("close", (code, signal) => resolve18({ code, signal }));
   });
 }
 
@@ -97635,7 +97777,7 @@ import { execFileSync as execFileSync5 } from "child_process";
 import { createSign, randomUUID as randomUUID22 } from "crypto";
 import { chmodSync as chmodSync13, existsSync as existsSync23, mkdirSync as mkdirSync21, readFileSync as readFileSync21 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join27, resolve as resolve16 } from "path";
+import { join as join27, resolve as resolve17 } from "path";
 var REVOLUT_BUSINESS_CERTIFICATE_DOCS_URL = "https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request#generate-a-private-and-a-public-certificate";
 var REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI = "https://app.dev.openmates.org/oauth/revolut-business/callback";
 var REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI = "https://openmates.org/oauth/revolut-business/callback";
@@ -97716,7 +97858,7 @@ function generateRevolutBusinessClientAssertion(options) {
 }
 function generateRevolutBusinessCertificate(options = {}) {
   const environment = options.environment ?? "sandbox";
-  const outputDir = resolve16(options.outputDir ?? defaultRevolutBusinessCertificateDir(environment));
+  const outputDir = resolve17(options.outputDir ?? defaultRevolutBusinessCertificateDir(environment));
   const title = (options.title ?? REVOLUT_BUSINESS_DEFAULT_CERTIFICATE_TITLE).trim();
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   if (!title) throw new Error("Revolut certificate title must not be empty.");
@@ -98009,7 +98151,7 @@ async function main() {
     return;
   }
   if (command === "update" || command === "upgrade") {
-    handleSelfUpdate(command, parsed.flags);
+    await handleSelfUpdate(command, parsed.flags);
     return;
   }
   if (command === "login") {
@@ -98223,7 +98365,15 @@ function handleSupport(flags) {
   }
   console.log(renderSupportInfo());
 }
-function handleSelfUpdate(command, flags) {
+async function handleSelfUpdate(command, flags) {
+  if (flags["caddy-config"] === true) throw new Error("Provide --caddy-config <file>.");
+  const reportCaddy = async () => {
+    const caddy = await updateCaddyAfterCliUpgrade(flags);
+    if (caddy) {
+      console.log(`Caddy: ${caddy.status}`);
+      if ("retryCommand" in caddy) console.log(`Run: ${caddy.retryCommand}`);
+    }
+  };
   let plan = buildSelfUpdatePlan(flags);
   const status = checkSelfUpdateStatus(plan);
   if (status.checkError) throw new Error(`Update check failed: ${status.checkError}`);
@@ -98234,6 +98384,7 @@ function handleSelfUpdate(command, flags) {
   if (flags.json === true) {
     if (!plan.dryRun && shouldInstall) runSelfUpdate(plan, { verbose: flags.verbose === true });
     persistSelfUpdateChannel(plan);
+    const caddy = await updateCaddyAfterCliUpgrade(flags);
     printJson2({
       command,
       channel: plan.channel,
@@ -98245,7 +98396,8 @@ function handleSelfUpdate(command, flags) {
       package_manager: plan.packageManager,
       package: plan.packageSpec,
       run: [plan.command, ...plan.args],
-      dry_run: plan.dryRun
+      dry_run: plan.dryRun,
+      ...caddy ? { caddy } : {}
     });
     return;
   }
@@ -98263,22 +98415,26 @@ function handleSelfUpdate(command, flags) {
   if (plan.dryRun) {
     if (status.updateAvailable === false) {
       console.log("OpenMates CLI is already up to date.");
+      await reportCaddy();
       return;
     }
     console.log(`Would run: ${[plan.command, ...plan.args].join(" ")}`);
+    await reportCaddy();
     return;
   }
   if (status.updateAvailable === false) {
     persistSelfUpdateChannel(plan);
     console.log("OpenMates CLI is already up to date.");
+    await reportCaddy();
     return;
   }
   console.log(`Updating OpenMates CLI with ${plan.packageManager}...`);
   runSelfUpdate(plan, { verbose: flags.verbose === true });
   persistSelfUpdateChannel(plan);
   console.log(`Installed OpenMates CLI ${status.latestVersion ?? plan.target}.`);
+  await reportCaddy();
   console.log("");
-  console.log("OpenMates is up to date.");
+  console.log("OpenMates CLI is up to date.");
 }
 function handleCliVersion(flags) {
   const planFlags = { ...flags, "dry-run": true };
@@ -102541,10 +102697,10 @@ Run 'openmates chats show ` + chatId + "' to check if suggestions have been save
         input: process.stdin,
         output: process.stdout
       });
-      const answer = await new Promise((resolve17) => {
+      const answer = await new Promise((resolve18) => {
         iface.question(
           `Delete ${resolved.length} chat(s)? This cannot be undone. [y/N] `,
-          resolve17
+          resolve18
         );
       });
       iface.close();
@@ -103296,7 +103452,7 @@ async function waitForWorkflowRun(client2, workflowId, initialRun, options = {})
       clearTimeout(timer);
     }
   }
-  const pause = () => withinBudget(() => new Promise((resolve17) => setTimeout(resolve17, Math.min(options.pollIntervalMs ?? 2e3, deadline - Date.now()))));
+  const pause = () => withinBudget(() => new Promise((resolve18) => setTimeout(resolve18, Math.min(options.pollIntervalMs ?? 2e3, deadline - Date.now()))));
   const refresh = async () => {
     run = await withinBudget(() => client2.getWorkflowRun(workflowId, runId));
   };
@@ -104904,7 +105060,7 @@ async function handleCodeRun(client2, flags, apiKey) {
   }
 }
 async function streamCodeRunToTerminal(url, jsonMode) {
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     const ws = new WebSocket3(url);
     let lastStatus = {};
     ws.on("message", (data) => {
@@ -104923,7 +105079,7 @@ async function streamCodeRunToTerminal(url, jsonMode) {
           const status = String(payload.status ?? "");
           if (["finished", "failed", "timeout", "cancelled"].includes(status)) {
             ws.close();
-            resolve17(lastStatus);
+            resolve18(lastStatus);
           }
         }
       } catch (err) {
@@ -104933,7 +105089,7 @@ async function streamCodeRunToTerminal(url, jsonMode) {
     });
     ws.on("error", () => reject(new Error("Code Run stream failed.")));
     ws.on("close", () => {
-      if (Object.keys(lastStatus).length > 0) resolve17(lastStatus);
+      if (Object.keys(lastStatus).length > 0) resolve18(lastStatus);
     });
   });
 }
@@ -104944,7 +105100,7 @@ async function pollCodeRunStatus(client2, statusPath, apiKey, jsonMode) {
     if (!jsonMode && value) process.stderr.write(`Code Run status: ${value}
 `);
     if (["finished", "failed", "timeout", "cancelled"].includes(value)) return status;
-    await new Promise((resolve17) => setTimeout(resolve17, 1e3));
+    await new Promise((resolve18) => setTimeout(resolve18, 1e3));
   }
 }
 async function suggestAppOrSkill(client2, app, skill, apiKey) {
@@ -105226,7 +105382,7 @@ async function waitForApplicationPreview(client2, started, flags) {
   while (Date.now() < deadline) {
     const status = String(current.status ?? "");
     if (["running", "failed", "timeout", "cancelled", "stopped"].includes(status)) return current;
-    await new Promise((resolve17) => setTimeout(resolve17, 1e3));
+    await new Promise((resolve18) => setTimeout(resolve18, 1e3));
     current = await client2.getApplicationPreviewStatus(started.session_id);
   }
   throw new Error(`Application preview did not reach a terminal or running state within ${timeoutSeconds}s`);
@@ -105831,7 +105987,7 @@ function printMateInfo(mateId, json) {
 async function confirmOrExit(question) {
   const rl = await import("readline");
   const iface = rl.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await new Promise((resolve17) => iface.question(question, resolve17));
+  const answer = await new Promise((resolve18) => iface.question(question, resolve18));
   iface.close();
   if (answer.trim().toLowerCase() !== "y") {
     console.log("Aborted.");
@@ -105841,7 +105997,7 @@ async function confirmOrExit(question) {
 async function promptLine(question) {
   const rl = await import("readline");
   const iface = rl.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await new Promise((resolve17) => iface.question(question, resolve17));
+  const answer = await new Promise((resolve18) => iface.question(question, resolve18));
   iface.close();
   return answer.trim();
 }
@@ -105849,7 +106005,7 @@ async function promptSecret(question) {
   if (!process.stdin.isTTY) {
     return promptLine(question);
   }
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const stdin4 = process.stdin;
     const wasRaw = stdin4.isRaw;
     let value = "";
@@ -105862,7 +106018,7 @@ async function promptSecret(question) {
         stdin4.off("data", onData);
         stdin4.setRawMode(wasRaw);
         process.stdout.write("\n");
-        resolve17(value);
+        resolve18(value);
         return;
       }
       if (char === "") {
@@ -106302,7 +106458,7 @@ function decodeBase32(input) {
   }
   return Buffer.from(bytes2);
 }
-async function waitForSafeE2ETotpWindow(now = Date.now, sleep4 = (milliseconds) => new Promise((resolve17) => setTimeout(resolve17, milliseconds))) {
+async function waitForSafeE2ETotpWindow(now = Date.now, sleep4 = (milliseconds) => new Promise((resolve18) => setTimeout(resolve18, milliseconds))) {
   const millisecondsRemaining = 3e4 - now() % 3e4;
   if (millisecondsRemaining < 2e3) {
     await sleep4(millisecondsRemaining + 50);
@@ -109562,6 +109718,10 @@ Options:
   --channel <dev|stable|main>    Save release channel (dev uses npm alpha; stable/main uses latest)
   --allow-downgrade             Explicitly allow installing an older version
   --verbose                     Stream package-manager output during installation
+  --path <installation>         Also update this server's Caddy configuration from its installed release
+  --role <core|upload|preview>   Server role for the Caddy update (default: saved role or core)
+  --caddy-config <file>          Active host Caddyfile; otherwise detect the running service
+  --caddy-profile <name>         Use official-upload for the shared production/development upload host
   --json                        Output the update plan/result as JSON`);
 }
 function printRemoteAccessHelp() {