openmates 0.27.0-alpha.23 → 0.27.0-alpha.25

package/dist/{chunk-NQP5QUVR.js → chunk-D476Y5AI.js}

@@ -194,8 +194,8 @@ import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, ren
 import { join } from "path";
 var digest = (value) => createHash("sha256").update(value).digest("hex");
 var shortenTaskText = (value, length) => {
-  const text6 = value.replace(/\s+/g, " ").trim();
-  return text6.length <= length ? text6 : `${text6.slice(0, length - 1)}\u2026`;
+  const text7 = value.replace(/\s+/g, " ").trim();
+  return text7.length <= length ? text7 : `${text7.slice(0, length - 1)}\u2026`;
 };
 function atomicPrivateFile(path2, content) {
   const temporary = `${path2}.${randomUUID()}.tmp`;
@@ -403,7 +403,7 @@ async function lockTaskDeliveryRecord(directory, id) {
 }
 
 // src/taskMutationDelivery.ts
-var digest2 = (text6) => createHash3("sha256").update(text6).digest("hex");
+var digest2 = (text7) => createHash3("sha256").update(text7).digest("hex");
 var stable = (value) => JSON.stringify(value, (_key, item) => item && !Array.isArray(item) && typeof item === "object" ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b))) : item);
 function reconcileMutation(mutation, current) {
   if (mutation.kind === "delete") {
@@ -692,7 +692,7 @@ async function readCodexThread(threadId, socketPath) {
   codexResumeArguments({ provider: "codex", id: threadId });
   const socket = socketPath ?? await daemonSocket();
   if (!isAbsolute(socket) || socket.includes(":")) throw new Error("Codex requires an absolute local socket path.");
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const ws = new WebSocket(`ws+unix://${socket}:/`, {
       perMessageDeflate: false,
       handshakeTimeout: CONNECTION_TIMEOUT_MS,
@@ -706,7 +706,7 @@ async function readCodexThread(threadId, socketPath) {
       if (ws.readyState === WebSocket.OPEN) ws.close();
       else if (ws.readyState !== WebSocket.CLOSED) ws.terminate();
       if (error) reject(error);
-      else resolve17(value);
+      else resolve18(value);
     };
     const timer = setTimeout(() => finish(new Error("Codex connection timed out.")), CONNECTION_TIMEOUT_MS);
     ws.on("error", () => finish(new Error("Could not connect to the local Codex daemon.")));
@@ -747,10 +747,10 @@ async function resumeCodexTask(context) {
   const args = codexResumeArguments(context);
   if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Task resume requires an interactive terminal; status and connect never launch work.");
   await readCodexThread(context.id);
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const child = spawn("codex", args, { stdio: "inherit" });
     child.once("error", () => reject(new Error("Could not open the installed Codex CLI.")));
-    child.once("exit", (code) => code === 0 ? resolve17() : reject(new Error(`Codex resume exited with status ${code ?? "interrupted"}.`)));
+    child.once("exit", (code) => code === 0 ? resolve18() : reject(new Error(`Codex resume exited with status ${code ?? "interrupted"}.`)));
   });
 }
 function taskOwnerConflict(owner) {
@@ -766,10 +766,10 @@ function assertCodexClaimCaller(threadId, currentThread = process.env.CODEX_THRE
 }
 
 // ../secret-scanner/src/identifierRanges.ts
-function codingIdentifierRanges(text6) {
+function codingIdentifierRanges(text7) {
   const ranges = [];
   const identifiers2 = /\b[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}\b|\b[\da-f]{40,64}\b|\[[A-Z][A-Z\d_]*\]/gi;
-  for (const match of Array.from(text6.matchAll(identifiers2))) {
+  for (const match of Array.from(text7.matchAll(identifiers2))) {
     ranges.push({ start: match.index, end: match.index + match[0].length });
   }
   return ranges;
@@ -1247,16 +1247,16 @@ var PII_TYPE_TO_CATEGORY = {
   USER_AT_HOSTNAME: "user_at_hostname",
   MAC_ADDRESS: "mac_addresses"
 };
-function detectPII(text6, excludedIdsOrOptions = /* @__PURE__ */ new Set()) {
+function detectPII(text7, excludedIdsOrOptions = /* @__PURE__ */ new Set()) {
   const options = excludedIdsOrOptions instanceof Set ? { excludedIds: excludedIdsOrOptions } : excludedIdsOrOptions;
   const excludedIds = options.excludedIds ?? /* @__PURE__ */ new Set();
   const disabledCategories = options.disabledCategories ?? /* @__PURE__ */ new Set();
   const personalEntries = options.personalDataEntries ?? [];
-  if (!text6 || text6.length < MIN_PII_TEXT_LENGTH && personalEntries.length === 0)
+  if (!text7 || text7.length < MIN_PII_TEXT_LENGTH && personalEntries.length === 0)
     return [];
   const matches2 = [];
   const coveredRanges = [];
-  const identifierRanges = codingIdentifierRanges(text6);
+  const identifierRanges = codingIdentifierRanges(text7);
   const typeCounts = {};
   const hasExclusions = excludedIds.size > 0;
   const hasDisabledCategories = disabledCategories.size > 0;
@@ -1264,14 +1264,14 @@ function detectPII(text6, excludedIdsOrOptions = /* @__PURE__ */ new Set()) {
   const urlExclusionZones = [];
   URL_EXCLUSION_REGEX.lastIndex = 0;
   let urlMatch;
-  while ((urlMatch = URL_EXCLUSION_REGEX.exec(text6)) !== null) {
+  while ((urlMatch = URL_EXCLUSION_REGEX.exec(text7)) !== null) {
     urlExclusionZones.push({
       start: urlMatch.index,
       end: urlMatch.index + urlMatch[0].length
     });
   }
   const hasUrlExclusions = urlExclusionZones.length > 0;
-  if (text6.length >= MIN_PII_TEXT_LENGTH) {
+  if (text7.length >= MIN_PII_TEXT_LENGTH) {
     for (const pattern of PII_PATTERNS) {
       if (hasDisabledCategories) {
         const category = PII_TYPE_TO_CATEGORY[pattern.type];
@@ -1279,7 +1279,7 @@ function detectPII(text6, excludedIdsOrOptions = /* @__PURE__ */ new Set()) {
       }
       pattern.regex.lastIndex = 0;
       let regexMatch;
-      while ((regexMatch = pattern.regex.exec(text6)) !== null) {
+      while ((regexMatch = pattern.regex.exec(text7)) !== null) {
         const matchText = regexMatch[0];
         const startIndex = regexMatch.index;
         const endIndex = startIndex + matchText.length;
@@ -1325,7 +1325,7 @@ function detectPII(text6, excludedIdsOrOptions = /* @__PURE__ */ new Set()) {
       }
     }
     for (const searchText of textsToSearch) {
-      const lowerText = text6.toLowerCase();
+      const lowerText = text7.toLowerCase();
       const lowerSearch = searchText.toLowerCase();
       let searchFrom = 0;
       while (searchFrom < lowerText.length) {
@@ -1337,7 +1337,7 @@ function detectPII(text6, excludedIdsOrOptions = /* @__PURE__ */ new Set()) {
           (range) => startIndex >= range.start && startIndex < range.end || endIndex > range.start && endIndex <= range.end || startIndex <= range.start && endIndex >= range.end
         );
         if (!overlaps) {
-          const matchText = text6.substring(startIndex, endIndex);
+          const matchText = text7.substring(startIndex, endIndex);
           const matchId = `pii-PERSONAL_DATA-${entry.id}-${startIndex}`;
           if (!hasExclusions || !excludedIds.has(matchId)) {
             const placeholder = entry.replaceWith.startsWith("[") ? entry.replaceWith : `[${entry.replaceWith}]`;
@@ -1438,8 +1438,8 @@ var ProjectFilePrivacy = class {
     }
     if (this.values.size + this.conflicts.length > 1e4) fail("pii_mapping_limit");
   }
-  restoreText(text6) {
-    return text6.replace(TOKEN, (token) => {
+  restoreText(text7) {
+    return text7.replace(TOKEN, (token) => {
       if (this.ambiguous.has(token)) fail("pii_mapping_ambiguous");
       const mapping = this.values.get(token);
       const customToken = this.options.detection?.personalDataEntries?.some((entry) => (entry.replaceWith.startsWith("[") ? entry.replaceWith : `[${entry.replaceWith}]`) === token);
@@ -1477,28 +1477,28 @@ var ProjectFilePrivacy = class {
     this.addMappings([{ placeholder, original, type }]);
     return placeholder;
   }
-  redactText(text6, enhanced = []) {
+  redactText(text7, enhanced = []) {
     const ranges = [];
-    const tokens = Array.from(text6.matchAll(TOKEN)).map((match) => ({ start: match.index, end: match.index + match[0].length }));
+    const tokens = Array.from(text7.matchAll(TOKEN)).map((match) => ({ start: match.index, end: match.index + match[0].length }));
     for (const range of tokens) {
-      const literal = text6.slice(range.start, range.end);
+      const literal = text7.slice(range.start, range.end);
       if (!(this.options.preserveMappedTokens && this.values.has(literal)) && (this.values.has(literal) || GENERATED_TOKEN.test(literal) || legacyToken(literal))) ranges.push(range);
     }
     const overlaps = (start, end) => [...tokens, ...ranges].some((r) => start < r.end && end > r.start);
     for (const mapping of Array.from(this.values.values()).sort((a, b) => b.original.length - a.original.length)) {
-      let start = text6.indexOf(mapping.original);
+      let start = text7.indexOf(mapping.original);
       while (start !== -1) {
         const end = start + mapping.original.length;
         if (!overlaps(start, end)) ranges.push({ start, end, type: mapping.type });
-        start = text6.indexOf(mapping.original, end);
+        start = text7.indexOf(mapping.original, end);
       }
     }
     if (this.options.enabled !== false) {
-      for (const match of detectPII(text6, this.options.detection)) {
+      for (const match of detectPII(text7, this.options.detection)) {
         if (!overlaps(match.startIndex, match.endIndex)) ranges.push({ start: match.startIndex, end: match.endIndex, type: match.type });
       }
       for (const range of enhanced) {
-        if (!Number.isInteger(range.start) || !Number.isInteger(range.end) || range.start < 0 || range.end <= range.start || range.end > text6.length) fail("pii_invalid_semantic_range");
+        if (!Number.isInteger(range.start) || !Number.isInteger(range.end) || range.start < 0 || range.end <= range.start || range.end > text7.length) fail("pii_invalid_semantic_range");
         let fragments = [{ ...range }];
         for (const shield of [...tokens, ...ranges]) fragments = fragments.flatMap((part) => {
           if (part.start >= shield.end || part.end <= shield.start) return [part];
@@ -1513,11 +1513,11 @@ var ProjectFilePrivacy = class {
     let cursor = 0;
     let result = "";
     for (const range of ranges.sort((a, b) => a.start - b.start)) {
-      result += text6.slice(cursor, range.start);
-      result += text6.slice(range.start, range.end).split(/(\r?\n)/).map((part) => !part || /^(?:\r?\n)$/.test(part) ? part : this.token(part, range.type)).join("");
+      result += text7.slice(cursor, range.start);
+      result += text7.slice(range.start, range.end).split(/(\r?\n)/).map((part) => !part || /^(?:\r?\n)$/.test(part) ? part : this.token(part, range.type)).join("");
       cursor = range.end;
     }
-    return result + text6.slice(cursor);
+    return result + text7.slice(cursor);
   }
   async redactResult(value) {
     const visit2 = async (item) => {
@@ -1556,26 +1556,26 @@ var LABELS = {
   private_date: { type: "OTHER", category: "birthdays" },
   private_url: { type: "OTHER", category: "private_urls" }
 };
-function convertNativePrivacyRanges(text6, spans, disabled = /* @__PURE__ */ new Set()) {
+function convertNativePrivacyRanges(text7, spans, disabled = /* @__PURE__ */ new Set()) {
   const offsets = /* @__PURE__ */ new Map([[0, 0]]);
   let bytes2 = 0;
   let units = 0;
-  for (const character of text6) {
+  for (const character of text7) {
     if (character.length === 1 && /[\uD800-\uDFFF]/.test(character)) throw privacyError("privacy_invalid_unicode");
     bytes2 += Buffer.byteLength(character);
     units += character.length;
     offsets.set(bytes2, units);
   }
-  const protectedRanges = codingIdentifierRanges(text6);
+  const protectedRanges = codingIdentifierRanges(text7);
   const result = [];
   for (const span of spans) {
     const label3 = LABELS[span.label];
     const start = offsets.get(span.start), end = offsets.get(span.end);
     if (!label3 || !Number.isInteger(span.start) || !Number.isInteger(span.end) || start === void 0 || end === void 0 || end <= start) throw privacyError("privacy_invalid_semantic_range");
     if (disabled.has(label3.category) || span.label === "secret" && disabled.has("api_keys")) continue;
-    const context = text6.slice(Math.max(0, start - 60), Math.min(text6.length, end + 60));
+    const context = text7.slice(Math.max(0, start - 60), Math.min(text7.length, end + 60));
     const explicitSecret = /\b(?:password|secret|credential|api[_ -]?key|token)\b/i.test(context);
-    if (protectedRanges.some((r) => start < r.end && end > r.start) && !(span.label === "secret" && explicitSecret && !text6.slice(start, end).startsWith("["))) continue;
+    if (protectedRanges.some((r) => start < r.end && end > r.start) && !(span.label === "secret" && explicitSecret && !text7.slice(start, end).startsWith("["))) continue;
     if ((span.label === "private_date" || span.label === "account_number") && /\b(?:commit|sha|hash|build|release|branch|timestamp|version)\b/i.test(context) && !/\b(?:birth|birthday|born|dob|account|iban)\b/i.test(context)) continue;
     result.push({ start, end, type: label3.type });
   }
@@ -1591,30 +1591,30 @@ function privacyDetectionOptions(memories) {
     })
   } };
 }
-async function scanEnhancedText(text6, scope2, disabled = /* @__PURE__ */ new Set(), progress) {
+async function scanEnhancedText(text7, scope2, disabled = /* @__PURE__ */ new Set(), progress) {
   const preferences = await readPrivacyPreferences();
-  if (!text6 || !enhancedScopeEnabled(preferences, scope2)) return [];
+  if (!text7 || !enhancedScopeEnabled(preferences, scope2)) return [];
   try {
     await ensurePrivacyDaemon();
     const ranges = [];
-    for (let start = 0; start < text6.length; start += 8192) {
-      let from = Math.max(0, start - 1024), end = Math.min(text6.length, start + 9216);
-      if (from > 0 && /[\uDC00-\uDFFF]/.test(text6[from])) from--;
-      if (end < text6.length && /[\uDC00-\uDFFF]/.test(text6[end])) end++;
-      progress?.(start, text6.length);
-      const window = text6.slice(from, end);
+    for (let start = 0; start < text7.length; start += 8192) {
+      let from = Math.max(0, start - 1024), end = Math.min(text7.length, start + 9216);
+      if (from > 0 && /[\uDC00-\uDFFF]/.test(text7[from])) from--;
+      if (end < text7.length && /[\uDC00-\uDFFF]/.test(text7[end])) end++;
+      progress?.(start, text7.length);
+      const window = text7.slice(from, end);
       const result = await privacyRpc({ op: "scan", text: window, scope: privacyProfile(), idleSeconds: preferences.idleSeconds });
       if (!Array.isArray(result.spans)) throw privacyError("privacy_worker_protocol_failed");
       ranges.push(...convertNativePrivacyRanges(window, result.spans, disabled).map((r) => ({ ...r, start: r.start + from, end: r.end + from })));
     }
-    progress?.(text6.length, text6.length);
+    progress?.(text7.length, text7.length);
     return ranges;
   } catch (error) {
     await stopPrivacyDaemon();
     throw error;
   }
 }
-async function prepareCliMessagePrivacy(text6, memories, existing = [], scope2 = { kind: "message" }, progress) {
+async function prepareCliMessagePrivacy(text7, memories, existing = [], scope2 = { kind: "message" }, progress) {
   const options = privacyDetectionOptions(memories);
   let mappings = existing;
   const privacy = new ProjectFilePrivacy({
@@ -1626,7 +1626,7 @@ async function prepareCliMessagePrivacy(text6, memories, existing = [], scope2 =
     },
     detectEnhanced: (value) => scanEnhancedText(value, scope2, options.detection.disabledCategories, progress)
   });
-  const message = await privacy.redactResult(text6);
+  const message = await privacy.redactResult(text7);
   return { message, mappings: mappings.map((mapping) => ({ ...mapping, type: mapping.type ?? "OTHER" })) };
 }
 
@@ -2246,7 +2246,7 @@ async function parseOpenCodeImportBuffer(payload, sourceName = "opencode-session
     if (role !== "user" && role !== "assistant") continue;
     const parts = Array.isArray(message.parts) ? message.parts.filter((part) => Boolean(part && typeof part === "object")) : [];
     const textParts = parts.filter((part) => part.type === "text" && part.ignored !== true && typeof part.text === "string");
-    const content = textParts.map((part) => String(part.text)).filter((text6) => text6.trim()).join("\n");
+    const content = textParts.map((part) => String(part.text)).filter((text7) => text7.trim()).join("\n");
     if (content.trim()) {
       const time2 = messageInfo.time && typeof messageInfo.time === "object" ? messageInfo.time : {};
       messages.push({
@@ -2994,12 +2994,12 @@ function createProjectFileJobExecutor(options) {
         mutation = validateProjectFileMutation({ ...job.arguments, operation: job.operation, operation_id: job.operation_id });
         if (context.privacy) mutation = context.privacy.restoreMutation(mutation);
         if (!context.writeMode) throw Object.assign(new Error(), { code: "write_policy_required" });
-        const digest3 = await projectFileMutationDigest(context.projectKey, job.project_id, job.chat_id, mutation);
-        proposalCommitment = digest3;
-        if (context.writeMode === "always_ask" && approved.get(job.operation_id) !== digest3) {
+        const digest4 = await projectFileMutationDigest(context.projectKey, job.project_id, job.chat_id, mutation);
+        proposalCommitment = digest4;
+        if (context.writeMode === "always_ask" && approved.get(job.operation_id) !== digest4) {
           const approvalRequest = { projectId: job.project_id, chatId: job.chat_id, mutation };
           const proposal = context.privacy ? await context.privacy.redactResult(mutation) : mutation;
-          await result("awaiting_approval", { proposal_commitment: digest3, proposal });
+          await result("awaiting_approval", { proposal_commitment: digest4, proposal });
           leaseReleased = true;
           options.onWaitingForUser?.(approvalRequest);
           if (!options.requestApproval) return;
@@ -3009,8 +3009,8 @@ function createProjectFileJobExecutor(options) {
             await options.send("project_file_operation_reject", scope(job));
             return;
           }
-          await options.approve(approvalRequest, digest3);
-          approved.set(job.operation_id, digest3);
+          await options.approve(approvalRequest, digest4);
+          approved.set(job.operation_id, digest4);
           processing.delete(job.operation_id);
           await options.send("project_file_operation_claim", scope(job));
           return;
@@ -3401,10 +3401,10 @@ async function projectFileContentHash(content) {
 async function hostedProjectFileIdentity(projectKey, path2, kind) {
   const normalized = normalizeHostedProjectPath(path2);
   const key = await crypto.subtle.importKey("raw", new Uint8Array(projectKey).buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const digest3 = new Uint8Array(await crypto.subtle.sign("HMAC", key, bytes(JSON.stringify(["openmates-hosted-file-v1", kind, normalized])))).slice(0, 16);
-  digest3[6] = digest3[6] & 15 | 80;
-  digest3[8] = digest3[8] & 63 | 128;
-  const hex = Array.from(digest3, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  const digest4 = new Uint8Array(await crypto.subtle.sign("HMAC", key, bytes(JSON.stringify(["openmates-hosted-file-v1", kind, normalized])))).slice(0, 16);
+  digest4[6] = digest4[6] & 15 | 80;
+  digest4[8] = digest4[8] & 63 | 128;
+  const hex = Array.from(digest4, (byte) => byte.toString(16).padStart(2, "0")).join("");
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 function textContent(head) {
@@ -3623,8 +3623,8 @@ async function executeHostedProjectFileJob(adapter, job, mutation) {
   if (!mutation) failure("invalid_file_mutation");
   const creating = mutation.operation === "create_file";
   const embedId = found[0]?.embedId ?? await hostedProjectFileIdentity(adapter.projectKey, path2, "embed");
-  const digest3 = await projectFileMutationDigest(adapter.projectKey, adapter.projectId, job.chat_id, mutation);
-  const receipt = await adapter.receipt(embedId, job, digest3);
+  const digest4 = await projectFileMutationDigest(adapter.projectKey, adapter.projectId, job.chat_id, mutation);
+  const receipt = await adapter.receipt(embedId, job, digest4);
   if (receipt?.status === "committed") return { path: path2, operation_id: job.operation_id, revision: receipt.current_revision, idempotent: true };
   if (creating && found[0]) failure("file_exists");
   if (!creating && !found[0]) failure("file_not_found");
@@ -3662,7 +3662,7 @@ async function executeHostedProjectFileJob(adapter, job, mutation) {
     embed_id: embedId,
     project_id: adapter.projectId,
     chat_id: job.chat_id,
-    proposal_digest: digest3,
+    proposal_digest: digest4,
     expected_revision: current?.revision ?? 0,
     ...adapter.teamId ? { team_id: adapter.teamId } : {},
     head: { encrypted_content: await adapter.encrypt(await adapter.encodeContent(contentObject), embedKey), encrypted_text_preview: await adapter.encrypt(`${path2} (${content.split("\n").length} lines)`, embedKey), status: "finished", updated_at: now },
@@ -3913,8 +3913,8 @@ async function activateCliProjectFocus(client2, projectId, chatId, teamId, activ
   const key = await client2.decryptProjectKey(detail.project, context);
   if (!settings.encrypted_settings || settings.selection_required) throw new Error("Choose this Project's write policy in Project settings before starting work.");
   if (isCurrent && !isCurrent()) return;
-  const text6 = await decryptWithAesGcmCombined(settings.encrypted_settings, key);
-  const focus = text6 ? JSON.parse(text6).default_focus : void 0;
+  const text7 = await decryptWithAesGcmCombined(settings.encrypted_settings, key);
+  const focus = text7 ? JSON.parse(text7).default_focus : void 0;
   if (!focus?.focus_id || typeof focus.instructions !== "string") throw new Error("The Project's default focus is unavailable.");
   if (isCurrent && !isCurrent()) return;
   await client2.activateProjectFocus(projectId, {
@@ -3956,10 +3956,10 @@ function registerCliProjectFileExecutor(options) {
     send: (event, payload) => options.ws.sendAsync(event, payload),
     requestApproval: options.requestApproval,
     requestReadApproval: options.requestReadApproval,
-    approve: async (request, digest3) => {
+    approve: async (request, digest4) => {
       const focus = await options.client.getActiveProjectFocus(request.chatId);
       if (focus?.project_id !== request.projectId) throw Object.assign(new Error(), { code: "project_focus_required" });
-      await options.client.approveProjectWrite(request.projectId, { chat_id: request.chatId, operation_id: request.mutation.operation_id, proposal_digest: digest3 }, { teamId: focus.team_id, personal: !focus.team_id });
+      await options.client.approveProjectWrite(request.projectId, { chat_id: request.chatId, operation_id: request.mutation.operation_id, proposal_digest: digest4 }, { teamId: focus.team_id, personal: !focus.team_id });
     },
     resolve: async (job) => {
       const focus = await options.client.getActiveProjectFocus(job.chat_id);
@@ -3979,7 +3979,7 @@ function registerCliProjectFileExecutor(options) {
             key: options.chatKey,
             mappings: [...history.messages.flatMap((message) => message.piiMappings ?? []), ...options.piiMappings ?? []],
             ...detection,
-            detectEnhanced: (text6) => scanEnhancedText(text6, { kind: "project", projectId: job.project_id }, detection.detection.disabledCategories),
+            detectEnhanced: (text7) => scanEnhancedText(text7, { kind: "project", projectId: job.project_id }, detection.detection.disabledCategories),
             read: async () => {
               try {
                 return await readFile(path2, "utf8");
@@ -4062,7 +4062,7 @@ function registerCliProjectFileExecutor(options) {
               return files;
             },
             readHead: (embedId) => options.client.readEncryptedProjectFile(job.project_id, embedId, projectKey, context),
-            receipt: (embedId, receiptJob, digest3) => options.client.getProjectFileRevisionReceipt(job.project_id, embedId, receiptJob.operation_id, receiptJob.chat_id, digest3, context),
+            receipt: (embedId, receiptJob, digest4) => options.client.getProjectFileRevisionReceipt(job.project_id, embedId, receiptJob.operation_id, receiptJob.chat_id, digest4, context),
             commit: async (payload) => {
               const requestId = randomUUID5();
               const pending = options.ws.waitForMessage("commit_embed_revision_result", (value) => value.request_id === requestId, 3e4);
@@ -4174,11 +4174,11 @@ function matchEnabledRemoteCommandPreset(options) {
   for (const preset of options.config.presets) {
     if (options.presetId && preset.id !== options.presetId) continue;
     if (!preset.commands.some((command) => stableJson(command) === stableJson(options.policy))) continue;
-    const digest3 = remoteCommandPresetDigest(options.config, preset.id);
+    const digest4 = remoteCommandPresetDigest(options.config, preset.id);
     const active = options.activeGrants.some(
-      (grant) => grant.enabled === true && grant.project_id === options.projectId && grant.preset_id === preset.id && grant.definition_digest === digest3
+      (grant) => grant.enabled === true && grant.project_id === options.projectId && grant.preset_id === preset.id && grant.definition_digest === digest4
     );
-    if (active) return { presetId: preset.id, definitionDigest: digest3 };
+    if (active) return { presetId: preset.id, definitionDigest: digest4 };
   }
   return null;
 }
@@ -4432,13 +4432,13 @@ var RemoteCommandOutputAccumulator = class {
       return { text: this.#text, coverage: "full", sequence_gap: false, upstream_truncated: false, omitted_chars: 0 };
     }
     const half = Math.max(0, Math.floor((MAX_COMPLETION_CHARS - OMISSION_MARKER.length) / 2));
-    const text6 = this.#text.length <= MAX_COMPLETION_CHARS ? this.#text : `${this.#text.slice(0, half)}${OMISSION_MARKER}${this.#text.slice(-half)}`;
+    const text7 = this.#text.length <= MAX_COMPLETION_CHARS ? this.#text : `${this.#text.slice(0, half)}${OMISSION_MARKER}${this.#text.slice(-half)}`;
     return {
-      text: text6,
+      text: text7,
       coverage: "selected_excerpt",
       sequence_gap: this.#sequenceGap,
       upstream_truncated: true,
-      omitted_chars: Math.max(0, this.#inputChars - text6.length + (text6.includes(OMISSION_MARKER) ? OMISSION_MARKER.length : 0))
+      omitted_chars: Math.max(0, this.#inputChars - text7.length + (text7.includes(OMISSION_MARKER) ? OMISSION_MARKER.length : 0))
     };
   }
 };
@@ -4700,8 +4700,8 @@ async function remoteCommandPortableRequestDigest(projectKey, request) {
   assertProjectKey(projectKey);
   const identity2 = JSON.stringify(["openmates-remote-command-request-v1", canonicalPortableRemoteCommandRequest(request)]);
   const key = await cryptoApi2.subtle.importKey("raw", new Uint8Array(projectKey).buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const digest3 = await cryptoApi2.subtle.sign("HMAC", key, new TextEncoder().encode(identity2));
-  return Buffer.from(digest3).toString("base64url");
+  const digest4 = await cryptoApi2.subtle.sign("HMAC", key, new TextEncoder().encode(identity2));
+  return Buffer.from(digest4).toString("base64url");
 }
 function validateApproval(value) {
   if (value.kind === "one_run") return;
@@ -4996,14 +4996,14 @@ var OpenMatesWsClient = class {
     });
   }
   async open(timeoutMs = 1e4) {
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve18, reject) => {
       const timeout = setTimeout(
         () => reject(new Error("WebSocket open timeout")),
         timeoutMs
       );
       this.socket.once("open", () => {
         clearTimeout(timeout);
-        resolve17();
+        resolve18();
       });
       this.socket.once("error", (error) => {
         clearTimeout(timeout);
@@ -5068,10 +5068,10 @@ var OpenMatesWsClient = class {
     }
   }
   sendAsync(type, payload) {
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       this.socket.send(JSON.stringify({ type, payload }), (error) => {
         if (error) reject(error);
-        else resolve17();
+        else resolve18();
       });
     });
   }
@@ -5139,9 +5139,9 @@ var OpenMatesWsClient = class {
     return () => this.socket.off("message", onMessage);
   }
   waitForClose() {
-    return new Promise((resolve17) => {
+    return new Promise((resolve18) => {
       this.socket.once("close", (code, reason) => {
-        resolve17({ code, reason: reason.toString("utf-8") });
+        resolve18({ code, reason: reason.toString("utf-8") });
       });
     });
   }
@@ -5236,7 +5236,7 @@ var OpenMatesWsClient = class {
     if (this.recoveryOutputDiscoveryError) throw this.recoveryOutputDiscoveryError;
   }
   waitForMessage(expectedType, predicate, timeoutMs = 2e4) {
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const seenTypes = /* @__PURE__ */ new Set();
       let predicateMisses = 0;
       const onMessage = (rawData) => {
@@ -5258,7 +5258,7 @@ var OpenMatesWsClient = class {
             return;
           }
           cleanup();
-          resolve17(parsed);
+          resolve18(parsed);
         } catch {
         }
       };
@@ -5296,7 +5296,7 @@ var OpenMatesWsClient = class {
    * Used by ensureSynced to consume the full phased-sync event stream.
    */
   collectMessages(terminatorType, timeoutMs = 9e4) {
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const collected = [];
       const onMessage = (rawData) => {
         try {
@@ -5309,7 +5309,7 @@ var OpenMatesWsClient = class {
           }
           if (parsed.type === terminatorType) {
             cleanup();
-            resolve17(collected);
+            resolve18(collected);
             return;
           }
           collected.push(parsed);
@@ -5322,7 +5322,7 @@ var OpenMatesWsClient = class {
       };
       const onClose = () => {
         cleanup();
-        resolve17(collected);
+        resolve18(collected);
       };
       const timeout = setTimeout(() => {
         cleanup();
@@ -5360,7 +5360,7 @@ var OpenMatesWsClient = class {
     const timeoutMs = options?.timeoutMs ?? 9e4;
     const onStream = options?.onStream;
     const asyncEmbedWaitMs = options?.asyncEmbedWaitMs ?? DEFAULT_ASYNC_EMBED_WAIT_MS;
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       let latestContent = "";
       let messageId = null;
       let taskId = null;
@@ -5454,8 +5454,8 @@ var OpenMatesWsClient = class {
         if (!content || typeof content !== "object") return "";
         try {
           const root = content;
-          const text6 = root.content?.[0]?.content?.[0]?.text;
-          return typeof text6 === "string" ? text6 : "";
+          const text7 = root.content?.[0]?.content?.[0]?.text;
+          return typeof text7 === "string" ? text7 : "";
         } catch {
           return "";
         }
@@ -5469,7 +5469,7 @@ var OpenMatesWsClient = class {
         if (waitingForUserPayload) {
           if (pendingSubChatHandlers.size > 0) return;
           cleanup();
-          resolve17({
+          resolve18({
             status: "waiting_for_user",
             messageId,
             taskId,
@@ -5506,7 +5506,7 @@ var OpenMatesWsClient = class {
         if (processingEmbedIds.size > 0 && !asyncEmbedTimer) {
           asyncEmbedTimer = setTimeout(() => {
             cleanup();
-            resolve17({
+            resolve18({
               status: "completed",
               messageId,
               taskId,
@@ -5538,7 +5538,7 @@ var OpenMatesWsClient = class {
         }
         if (processingEmbedIds.size > 0) return;
         cleanup();
-        resolve17({
+        resolve18({
           status: "completed",
           messageId,
           taskId,
@@ -5955,7 +5955,7 @@ var OpenMatesWsClient = class {
       const onClose = () => {
         if (aiResponseDone && pendingProjectOperations.size === 0 && !awaitingUnidentifiedAsyncContinuation) {
           cleanup();
-          resolve17({
+          resolve18({
             status: "completed",
             messageId,
             taskId,
@@ -6010,29 +6010,55 @@ var OpenMatesWsClient = class {
   }
 };
 
+// ../ui/src/utils/loadedMemoryReceipt.ts
+var digest3 = /^[a-f0-9]{64}$/;
+var text3 = (value, max) => typeof value === "string" && !!value.trim() && value.length <= max;
+function parseMemoriesLoadedEvent(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const event = value;
+  if (event.type !== "memories_loaded" || typeof event.set_key !== "string" || !digest3.test(event.set_key) || !Array.isArray(event.memories) || !event.memories.length || event.memories.length > 24 || event.count !== event.memories.length) return null;
+  const ids = /* @__PURE__ */ new Set();
+  let size = 0;
+  for (const entry of event.memories) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return null;
+    const m = entry;
+    if (!text3(m.id, 240) || ids.has(m.id) || !text3(m.title, 180) || !text3(m.body, 2e4) || typeof m.revision !== "string" || !digest3.test(m.revision)) return null;
+    if (m.source === "app") {
+      if (!text3(m.app_id, 64) || !/^[a-z][a-z0-9_]*$/.test(m.app_id) || !m.id.startsWith(`app:${m.app_id}:`) || m.project_id != null) return null;
+    } else if (m.source === "project") {
+      if (!text3(m.project_id, 240) || m.app_id != null) return null;
+    } else return null;
+    ids.add(m.id);
+    size += m.body.length;
+    if (size > 32e3) return null;
+  }
+  return event;
+}
+
 // src/chatContextEvents.ts
 var DIRECTION_CORRECTION_NOTICE = "Chat is drifting too far away from the goals. Correction instruction was sent.";
-function text3(value, limit) {
+function text4(value, limit) {
   return typeof value === "string" && value.length > 0 && value.length <= limit;
 }
 function parseChatContextEvent(value, chatId) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const event = value;
-  if (!text3(event.event_id, 128) || !Number.isSafeInteger(event.created_at) || Number(event.created_at) < 0 || chatId && event.chat_id !== void 0 && event.chat_id !== chatId) return null;
+  if (!text4(event.event_id, 128) || !Number.isSafeInteger(event.created_at) || Number(event.created_at) < 0 || chatId && event.chat_id !== void 0 && event.chat_id !== chatId) return null;
+  if (event.type === "memories_loaded") return parseMemoriesLoadedEvent(event);
   if (event.type === "rules_loaded") {
-    if (!text3(event.set_key, 128) || !Array.isArray(event.rules) || !event.rules.length || event.rules.length > 24 || event.count !== event.rules.length) return null;
+    if (!text4(event.set_key, 128) || !Array.isArray(event.rules) || !event.rules.length || event.rules.length > 24 || event.count !== event.rules.length) return null;
     const ids = /* @__PURE__ */ new Set();
     let bodyChars = 0;
     for (const rule of event.rules) {
-      if (!rule || typeof rule !== "object" || !text3(rule.id, 128) || ids.has(rule.id) || !text3(rule.title, 200) || !["app", "personal", "project"].includes(rule.source) || !text3(rule.revision, 128) || !text3(rule.body, 32e3)) return null;
+      if (!rule || typeof rule !== "object" || !text4(rule.id, 128) || ids.has(rule.id) || !text4(rule.title, 200) || !["app", "personal", "project"].includes(rule.source) || !text4(rule.revision, 128) || !text4(rule.body, 32e3)) return null;
       ids.add(rule.id);
       bodyChars += rule.body.length;
     }
     if (bodyChars > 32e3) return null;
   } else if (event.type === "chat_direction_correction") {
-    if (event.notice !== DIRECTION_CORRECTION_NOTICE || !text3(event.instruction, 8500) || !text3(event.delivery_id, 128)) return null;
+    if (event.notice !== DIRECTION_CORRECTION_NOTICE || !text4(event.instruction, 8500) || !text4(event.delivery_id, 128)) return null;
   } else if (event.type === "project_authoring_recommendation") {
-    if (!text3(event.recommendation_id, 128) || !text3(event.project_id, 128) || !["focus", "workflow"].includes(String(event.kind)) || !["create", "update"].includes(String(event.action)) || event.action === "update" && (!text3(event.target_id, 128) || !text3(event.expected_revision, 128)) || event.action === "create" && event.kind !== "focus") return null;
+    if (!text4(event.recommendation_id, 128) || !text4(event.project_id, 128) || !["focus", "workflow"].includes(String(event.kind)) || !["create", "update"].includes(String(event.action)) || event.action === "update" && (!text4(event.target_id, 128) || !text4(event.expected_revision, 128)) || event.action === "create" && event.kind !== "focus") return null;
   } else return null;
   return event;
 }
@@ -6044,12 +6070,12 @@ function parseChatContextContent(content) {
   }
 }
 function chatContextSummary(event) {
-  if (event.type === "rules_loaded") return `Loaded ${event.count} rules`;
+  if (event.type === "memories_loaded" || event.type === "rules_loaded") return `Loaded ${event.count} memories`;
   if (event.type === "chat_direction_correction") return DIRECTION_CORRECTION_NOTICE;
   return `${event.action === "create" ? "Create" : "Update"} Project ${event.kind === "focus" ? "Focus" : "Workflow"}${event.title ? `: ${event.title}` : ""}`;
 }
 function chatContextDetails(event) {
-  if (event.type === "rules_loaded") return event.rules.flatMap((rule) => [
+  if (event.type === "memories_loaded" || event.type === "rules_loaded") return (event.type === "memories_loaded" ? event.memories : event.rules).flatMap((rule) => [
     rule.title,
     `${rule.source}${rule.project_id ? ` \xB7 Project ${rule.project_id}` : rule.app_id ? ` \xB7 ${rule.app_id}` : ""} \xB7 revision ${rule.revision}`,
     "",
@@ -6072,7 +6098,7 @@ function registerChatContextEvents(options) {
   const persist = (event) => {
     if (seen.has(event.event_id)) return;
     seen.add(event.event_id);
-    if (event.type === "rules_loaded") {
+    if (event.type === "memories_loaded" || event.type === "rules_loaded") {
       if (event.set_key === previousRulesSetKey) return;
       previousRulesSetKey = event.set_key;
     }
@@ -6120,12 +6146,12 @@ function object(value) {
 function keys(value, allowed) {
   if (Object.keys(value).some((key) => !allowed.includes(key))) invalid();
 }
-function text4(value, limit) {
+function text5(value, limit) {
   if (typeof value !== "string" || !value.trim() || value.length > limit) return invalid();
   return value;
 }
 function identifier3(value, canonical) {
-  const result = text4(value, canonical ? 64 : 80);
+  const result = text5(value, canonical ? 64 : 80);
   if (!(canonical ? /^[a-z][a-z0-9_-]{0,63}$/ : /^[a-zA-Z0-9_-]{1,80}$/).test(result)) invalid();
   return result;
 }
@@ -6139,10 +6165,10 @@ function projectFocusDocumentFromMetadata(metadata, body) {
   const hints = [header2.when_to_use, header2.preprocessor_hint, header2["preprocessor-hint"]].filter((value) => value !== void 0);
   if (names.length !== 1 || hints.length !== 1) invalid();
   const common = {
-    name: text4(names[0], 200),
-    description: text4(header2.description, 2e3),
-    when_to_use: text4(hints[0], 2e3),
-    instructions: text4(body.trim(), 64e3)
+    name: text5(names[0], 200),
+    description: text5(header2.description, 2e3),
+    when_to_use: text5(hints[0], 2e3),
+    instructions: text5(body.trim(), 64e3)
   };
   const phases = header2.phases === void 0 ? [] : header2.phases;
   if (!Array.isArray(phases) || phases.length > 16) invalid();
@@ -6159,15 +6185,15 @@ function projectFocusDocumentFromMetadata(metadata, body) {
         if (requirement.type !== void 0 && (typeof requirement.type !== "string" || !["semantic", "user_confirmation"].includes(requirement.type))) invalid();
         return {
           id: identifier3(requirement.id, true),
-          text: text4(requirement.text, 4e3),
+          text: text5(requirement.text, 4e3),
           ...requirement.type === void 0 ? {} : { type: requirement.type }
         };
       });
       unique(gates.map((gate) => gate.id));
       return {
         id: identifier3(phase.id, true),
-        title: text4(phase.title, 200),
-        instructions: text4(phase.instructions, 16e3),
+        title: text5(phase.title, 200),
+        instructions: text5(phase.instructions, 16e3),
         requirements: gates
       };
     });
@@ -6177,7 +6203,7 @@ function projectFocusDocumentFromMetadata(metadata, body) {
   const legacy = phases.map((raw) => {
     const phase = object(raw);
     keys(phase, ["id", "name", "instructions"]);
-    return { id: identifier3(phase.id, false), name: text4(phase.name, 120), instructions: text4(phase.instructions, 16e3) };
+    return { id: identifier3(phase.id, false), name: text5(phase.name, 120), instructions: text5(phase.instructions, 16e3) };
   });
   unique(legacy.map((phase) => phase.id));
   return { ...common, phases: legacy };
@@ -6216,7 +6242,7 @@ async function discoverCliProjectCandidates(client2, options) {
   }));
   return entries.filter((entry) => entry !== null);
 }
-async function loadActiveCliProjectContext(client2, chatId, text6) {
+async function loadActiveCliProjectContext(client2, chatId, text7) {
   const active = await client2.getActiveProjectFocus(chatId);
   if (!active) return {};
   const options = { teamId: active.team_id, personal: !active.team_id };
@@ -6238,9 +6264,9 @@ async function loadActiveCliProjectContext(client2, chatId, text6) {
     const metadataText = await decryptWithAesGcmCombined(item.encrypted_metadata, key);
     const metadata = metadataText ? JSON.parse(metadataText) : {};
     const path2 = typeof (metadata.path ?? metadata.display_path) === "string" ? String(metadata.path ?? metadata.display_path) : "";
-    const match = /^\.openmates\/(rules|focuses|specs|facts)\/[^\0]+(?:\.md|\/SKILL\.md)$/.exec(path2);
+    const match = /^\.openmates\/(memories|rules|focuses|specs|facts)\/[^\0]+(?:\.md|\/SKILL\.md)$/.exec(path2);
     if (!match || path2.split("/").some((part) => part === ".." || part === "." || !part)) continue;
-    const kind = { rules: "rule", focuses: "focus", specs: "spec", facts: "fact" }[match[1]];
+    const kind = { memories: "memory", rules: "rule", focuses: "focus", specs: "spec", facts: "memory" }[match[1]];
     const title = metadata.focus_title ?? metadata.title ?? metadata.name;
     const description = metadata.focus_description ?? metadata.summary ?? metadata.description;
     const currentRevision = revision(item);
@@ -6272,9 +6298,9 @@ async function loadActiveCliProjectContext(client2, chatId, text6) {
     if (title && description) candidates.push({ kind: "folder", id: folder.folder_id, title: title.slice(0, 200), description: description.slice(0, 640), when_to_use: "", revision: revision(folder) });
   }
   let selected = [];
-  if (text6?.trim() && candidates.length) selected = await client2.selectProjectContext(
+  if (text7?.trim() && candidates.length) selected = await client2.selectProjectContext(
     active.project_id,
-    { chat_id: chatId, text: text6.slice(0, 8e3), candidates: candidates.slice(0, 24) },
+    { chat_id: chatId, text: text7.slice(0, 8e3), candidates: candidates.slice(0, 24) },
     options
   );
   const specialistId = active.specialist_focus_id?.startsWith(`project-focus:${active.project_id}:`) ? active.specialist_focus_id.split(":")[2] : active.specialist_focus_id;
@@ -6302,7 +6328,7 @@ async function loadActiveCliProjectContext(client2, chatId, text6) {
     if (typeof document !== "string" || document.length > (candidate.kind === "focus" ? 6e4 : 24e3) || totalChars + document.length > 64e3) continue;
     totalChars += document.length;
     if (candidate.kind === "focus") result.project_focus_documents.push({ item_id: candidate.id, document, revision: candidate.revision });
-    else if (candidate.kind === "rule") result.custom_rule_documents.push({ id: candidate.id, source: "project", project_id: active.project_id, document });
+    else if (candidate.kind === "rule") result.custom_rule_documents.push({ id: candidate.id, source: "project", project_id: active.project_id, document, item_revision: candidate.revision });
     else result.project_context_documents.push({ item_id: candidate.id, kind: candidate.kind, title: candidate.title, description: candidate.description, document, revision: candidate.revision });
   }
   const [fresh, latest] = await Promise.all([client2.getActiveProjectFocus(chatId), client2.getProject(active.project_id, options)]);
@@ -6419,25 +6445,20 @@ async function collectRelatedCliTaskContext(client2, chatId, options, records, n
   }
   return candidates;
 }
-async function prepareCliJevContext(client2, chatId, options, supplied = {}, text6) {
+async function prepareCliJevContext(client2, chatId, options, supplied = {}, text7) {
   let candidates = [];
   let active = {};
   let tasks = [];
   let ownedTaskRecords = [];
-  let personalRules = [];
   await Promise.all([
     discoverCliProjectCandidates(client2, options).then((value) => {
       candidates = value;
     }).catch(() => {
     }),
-    loadActiveCliProjectContext(client2, chatId, text6).then((value) => {
+    loadActiveCliProjectContext(client2, chatId, text7).then((value) => {
       active = value;
     }).catch(() => {
     }),
-    client2.getCustomRuleDocuments().then((value) => {
-      personalRules = value;
-    }).catch(() => {
-    }),
     (async () => {
       const records = await client2.listUserTasks({ ...options, limit: 500 });
       ownedTaskRecords = records;
@@ -6457,9 +6478,9 @@ async function prepareCliJevContext(client2, chatId, options, supplied = {}, tex
   const customDocuments = [];
   let documentChars = 0;
   const documentIds = /* @__PURE__ */ new Set();
-  for (const rule of [...personalRules, ...loaded.custom_rule_documents ?? [], ...supplied.custom_rule_documents ?? []]) {
+  for (const rule of [...loaded.custom_rule_documents ?? [], ...supplied.custom_memory_documents ?? supplied.custom_rule_documents ?? []]) {
     const identity2 = `${rule.source}:${rule.project_id ?? ""}:${rule.id}`;
-    if (rule.source === "project" && rule.project_id !== current?.project_id || typeof rule.document !== "string" || rule.document.length > 24e3 || documentChars + rule.document.length > 64e3 || documentIds.has(identity2) || customDocuments.length >= 24) continue;
+    if (rule.source !== "project" || rule.project_id !== current?.project_id || typeof rule.document !== "string" || rule.document.length > 24e3 || documentChars + rule.document.length > 64e3 || documentIds.has(identity2) || customDocuments.length >= 24) continue;
     documentChars += rule.document.length;
     documentIds.add(identity2);
     customDocuments.push(rule);
@@ -6468,7 +6489,7 @@ async function prepareCliJevContext(client2, chatId, options, supplied = {}, tex
     accepted_plan_context: acceptedPlan,
     project_focus_candidates: (supplied.project_focus_candidates ?? candidates).slice(0, 40),
     related_task_candidates: (supplied.related_task_candidates ?? tasks).slice(0, 24),
-    custom_rule_documents: customDocuments,
+    custom_memory_documents: customDocuments,
     project_focus_catalog: current ? (supplied.project_focus_catalog ?? loaded.project_focus_catalog ?? []).slice(0, 20) : [],
     project_focus_documents: current ? (supplied.project_focus_documents ?? loaded.project_focus_documents ?? []).slice(0, 20) : [],
     project_context_documents: current ? (supplied.project_context_documents ?? loaded.project_context_documents ?? []).slice(0, 20) : []
@@ -6493,8 +6514,8 @@ function registerProjectFocusCountdown(options) {
     const projectId = focusId.slice("project-".length);
     let finish = () => {
     };
-    const done = new Promise((resolve17) => {
-      finish = resolve17;
+    const done = new Promise((resolve18) => {
+      finish = resolve18;
     });
     const entry = { requestId, timer: null, cancelled: false, done, finish };
     current = entry;
@@ -6635,8 +6656,8 @@ async function startCliProjectAuthoring(client2, recommendation, history) {
     const key = await client2.decryptProjectKey(detail.project, options);
     for (const item of detail.items.filter((item2) => item2.item_type === "workflow" && !item2.deleted_target_state)) {
       if (await decryptWithAesGcmCombined(item.target_id_encrypted, key) !== recommendation.target_id) continue;
-      const text6 = item.encrypted_metadata ? await decryptWithAesGcmCombined(item.encrypted_metadata, key) : null;
-      const metadata = text6 ? JSON.parse(text6) : {};
+      const text7 = item.encrypted_metadata ? await decryptWithAesGcmCombined(item.encrypted_metadata, key) : null;
+      const metadata = text7 ? JSON.parse(text7) : {};
       if (metadata.remote_workflow_file && typeof metadata.remote_workflow_file === "object") remoteBinding = metadata.remote_workflow_file;
       break;
     }
@@ -7310,8 +7331,8 @@ function parseDelimitedLine(line, delimiter) {
   cells2.push(current);
   return cells2;
 }
-function delimitedTextToMarkdownTable(text6, delimiter) {
-  const rows2 = text6.split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.length > 0).map((line) => parseDelimitedLine(line, delimiter));
+function delimitedTextToMarkdownTable(text7, delimiter) {
+  const rows2 = text7.split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.length > 0).map((line) => parseDelimitedLine(line, delimiter));
   if (rows2.length === 0) return "";
   const maxCols = Math.max(...rows2.map((row) => row.length));
   const normalized = rows2.map((row) => {
@@ -7358,7 +7379,7 @@ async function docxBufferToHtml(buffer) {
   const zip = await JSZip2.loadAsync(buffer);
   const documentXml = await zip.file("word/document.xml")?.async("string");
   if (!documentXml) return "";
-  const paragraphs = getXmlBlocks(documentXml, "p").map(getTextFromDocxParagraph).map((text6) => text6.trim()).filter(Boolean);
+  const paragraphs = getXmlBlocks(documentXml, "p").map(getTextFromDocxParagraph).map((text7) => text7.trim()).filter(Boolean);
   return paragraphs.map((paragraph) => `<p>${escapeHtml(paragraph)}</p>`).join("\n");
 }
 function columnLettersToIndex(letters) {
@@ -8197,8 +8218,8 @@ function splitLongParagraph(paragraph) {
   if (remainder) chunks.push(remainder);
   return chunks;
 }
-function fallback(text6, language) {
-  if (!language.toLowerCase().startsWith("de")) return text6;
+function fallback(text7, language) {
+  if (!language.toLowerCase().startsWith("de")) return text7;
   const german = {
     "Search results are available.": "Suchergebnisse sind verf\xFCgbar.",
     "I used the News Search skill.": "Ich habe die News-Suche verwendet.",
@@ -8207,7 +8228,7 @@ function fallback(text6, language) {
     "A code example is available.": "Ein Codebeispiel ist verf\xFCgbar.",
     "A table is available.": "Eine Tabelle ist verf\xFCgbar."
   };
-  return german[text6] ?? text6;
+  return german[text7] ?? text7;
 }
 function projectFence(markdown, language) {
   const body = markdown.replace(/^```[^\n]*\n|\n?```$/g, "").trim();
@@ -8289,8 +8310,8 @@ function rejectProtonCredentialFlags(argsOrFlags) {
     throw new Error(`${rejected.split("=")[0]} is not allowed. Bridge credentials must be read privately from Proton Bridge or a hidden prompt.`);
   }
 }
-function redactProtonBridgeSecrets(text6) {
-  return text6.replace(CREDENTIAL_VALUE_RE, "$1<redacted>");
+function redactProtonBridgeSecrets(text7) {
+  return text7.replace(CREDENTIAL_VALUE_RE, "$1<redacted>");
 }
 function containsCredentialLikeField(value) {
   return containsCredentialLikeKey(value);
@@ -8420,7 +8441,7 @@ function validateProtonBridgeCredentials(credentials) {
 }
 async function validateProtonBridgeImap(credentials, timeoutMs = DEFAULT_IMAP_TIMEOUT_MS) {
   validateProtonBridgeCredentials(credentials);
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const socket = connectTcp({ host: credentials.imapHost, port: credentials.imapPort });
     const timer = setTimeout(() => {
       socket.destroy();
@@ -8429,7 +8450,7 @@ async function validateProtonBridgeImap(credentials, timeoutMs = DEFAULT_IMAP_TI
     socket.once("connect", () => {
       clearTimeout(timer);
       socket.end();
-      resolve17();
+      resolve18();
     });
     socket.once("error", (error) => {
       clearTimeout(timer);
@@ -8606,8 +8627,8 @@ async function localConnectorRequestLoop(client2, params) {
   const ws = await client2.openLocalConnectorWebSocket();
   const sendQueue = new ProtonDelayedSendQueue();
   let resolveOnce = null;
-  const onceHandled = new Promise((resolve17) => {
-    resolveOnce = resolve17;
+  const onceHandled = new Promise((resolve18) => {
+    resolveOnce = resolve18;
   });
   const removeListener = ws.onLocalConnectorRequest((request) => {
     void handleLocalConnectorRequest(client2, request, params, sendQueue).finally(() => {
@@ -8675,8 +8696,8 @@ async function handleLocalConnectorRequest(client2, request, params, sendQueue)
 }
 async function waitForAbort(signal) {
   if (signal.aborted) return;
-  await new Promise((resolve17) => {
-    signal.addEventListener("abort", () => resolve17(), { once: true });
+  await new Promise((resolve18) => {
+    signal.addEventListener("abort", () => resolve18(), { once: true });
   });
 }
 async function searchProtonBridgeImap(credentials, arguments_) {
@@ -8687,7 +8708,7 @@ async function searchProtonBridgeImap(credentials, arguments_) {
   const limit = clampLimit(arguments_.limit);
   const imap = await openTextSocket(credentials.imapHost, credentials.imapPort, IMAP_COMMAND_TIMEOUT_MS);
   try {
-    await imap.readUntil((text6) => /^\* OK/im.test(text6));
+    await imap.readUntil((text7) => /^\* OK/im.test(text7));
     await imap.command(`LOGIN ${quoteImap(credentials.imapUsername)} ${quoteImap(credentials.imapPassword)}`);
     await imap.command(`SELECT ${quoteImap(mailbox)}`);
     const searchResponse = await imap.command(buildImapSearchCommand({ query, startDate, endDate }));
@@ -8735,22 +8756,22 @@ async function sendProtonBridgeSmtp(credentials, payload) {
   const messageId = `<om-${randomUUID7()}@local.openmates>`;
   const smtp = await openTextSocket(credentials.smtpHost, credentials.smtpPort, SMTP_COMMAND_TIMEOUT_MS);
   try {
-    await smtp.readUntil((text6) => /^220[ -]/m.test(text6));
-    await smtp.rawCommand("EHLO openmates.local", (text6) => /^250\s/m.test(text6), /^250[ -]/m);
+    await smtp.readUntil((text7) => /^220[ -]/m.test(text7));
+    await smtp.rawCommand("EHLO openmates.local", (text7) => /^250\s/m.test(text7), /^250[ -]/m);
     const auth = Buffer.from(`\0${credentials.smtpUsername || credentials.imapUsername}\0${credentials.smtpPassword || credentials.imapPassword}`).toString("base64");
     try {
-      await smtp.rawCommand(`AUTH PLAIN ${auth}`, (text6) => /^235[ -]/m.test(text6), /^235[ -]/m);
+      await smtp.rawCommand(`AUTH PLAIN ${auth}`, (text7) => /^235[ -]/m.test(text7), /^235[ -]/m);
     } catch {
       throw new Error("Local SMTP authentication failed.");
     }
-    await smtp.rawCommand(`MAIL FROM:<${from}>`, (text6) => /^250[ -]/m.test(text6), /^250[ -]/m);
+    await smtp.rawCommand(`MAIL FROM:<${from}>`, (text7) => /^250[ -]/m.test(text7), /^250[ -]/m);
     for (const recipient of to) {
-      await smtp.rawCommand(`RCPT TO:<${recipient}>`, (text6) => /^250[ -]/m.test(text6), /^250[ -]/m);
+      await smtp.rawCommand(`RCPT TO:<${recipient}>`, (text7) => /^250[ -]/m.test(text7), /^250[ -]/m);
     }
-    await smtp.rawCommand("DATA", (text6) => /^354[ -]/m.test(text6), /^354[ -]/m);
+    await smtp.rawCommand("DATA", (text7) => /^354[ -]/m.test(text7), /^354[ -]/m);
     await smtp.rawCommand(`${buildSmtpMessage({ from, to, subject, bodyText, messageId })}\r
-.`, (text6) => /^250[ -]/m.test(text6), /^250[ -]/m);
-    await smtp.rawCommand("QUIT", (text6) => /^221[ -]/m.test(text6), /^221[ -]/m).catch(() => void 0);
+.`, (text7) => /^250[ -]/m.test(text7), /^250[ -]/m);
+    await smtp.rawCommand("QUIT", (text7) => /^221[ -]/m.test(text7), /^221[ -]/m).catch(() => void 0);
     return { provider: PROTON_BRIDGE_PROVIDER_ID, message_id: messageId, delivered: true };
   } finally {
     smtp.close();
@@ -8838,14 +8859,14 @@ async function openTextSocket(host, port, timeoutMs) {
   socket.on("data", (chunk) => {
     buffer += String(chunk);
   });
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const timer = setTimeout(() => {
       socket.destroy();
       reject(new Error(`Timed out connecting to ${host}:${port}.`));
     }, timeoutMs);
     socket.once("connect", () => {
       clearTimeout(timer);
-      resolve17();
+      resolve18();
     });
     socket.once("error", (error) => {
       clearTimeout(timer);
@@ -8862,7 +8883,7 @@ async function openTextSocket(host, port, timeoutMs) {
       buffer = "";
       socket.write(`${tag} ${command}\r
 `);
-      const response = await waitForSocketText(socket, () => buffer, (text6) => marker.test(text6), timeoutMs);
+      const response = await waitForSocketText(socket, () => buffer, (text7) => marker.test(text7), timeoutMs);
       if (expected && !expected.test(response)) {
         throw new Error(`Local mail command failed: ${redactProtonBridgeSecrets(response.split(/\r?\n/).slice(-2).join(" "))}`);
       }
@@ -8885,11 +8906,11 @@ async function openTextSocket(host, port, timeoutMs) {
   };
 }
 async function waitForSocketText(socket, getBuffer, done, timeoutMs) {
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     const timer = setTimeout(() => cleanup(() => reject(new Error("Timed out waiting for local mail server response."))), timeoutMs);
     const check = () => {
-      const text6 = getBuffer();
-      if (done(text6)) cleanup(() => resolve17(text6));
+      const text7 = getBuffer();
+      if (done(text7)) cleanup(() => resolve18(text7));
     };
     const onData = () => check();
     const onError = (error) => cleanup(() => reject(error));
@@ -8914,7 +8935,7 @@ function startProtonBridgeProcess(command, args) {
       if (child.exitCode !== null || child.killed) return;
       child.kill("SIGTERM");
       await Promise.race([
-        new Promise((resolve17) => child.once("exit", () => resolve17())),
+        new Promise((resolve18) => child.once("exit", () => resolve18())),
         sleep(2e3).then(() => {
           if (child.exitCode === null && !child.killed) child.kill("SIGKILL");
         })
@@ -9013,7 +9034,7 @@ async function captureOrPromptBridgeCredentials(command, args) {
   }
 }
 async function captureProtonBridgeInfo(command, args) {
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     const child = spawn2(command, args, { stdio: "pipe" });
     let output = "";
     let errorOutput = "";
@@ -9033,7 +9054,7 @@ async function captureProtonBridgeInfo(command, args) {
     });
     child.once("exit", () => {
       clearTimeout(timer);
-      if (output.trim()) resolve17(output);
+      if (output.trim()) resolve18(output);
       else reject(new Error(redactProtonBridgeSecrets(errorOutput || "Proton Bridge info produced no output.")));
     });
     child.stdin.write("info\nquit\n");
@@ -9063,11 +9084,11 @@ async function promptHidden(prompt) {
   const wasRaw = stdin.isRaw === true;
   stdin.setRawMode(true);
   stdin.resume();
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     let value = "";
     const onData = (chunk) => {
-      const text6 = chunk.toString("utf8");
-      for (const char of text6) {
+      const text7 = chunk.toString("utf8");
+      for (const char of text7) {
         if (char === "") {
           cleanup();
           reject(new Error("Bridge credential prompt cancelled."));
@@ -9076,7 +9097,7 @@ async function promptHidden(prompt) {
         if (char === "\r" || char === "\n") {
           cleanup();
           stderr.write("\n");
-          resolve17(value);
+          resolve18(value);
           return;
         }
         if (char === "\x7F" || char === "\b") {
@@ -9646,8 +9667,8 @@ function parseUserFlows(value) {
 }
 function deriveShortId(record8) {
   const source = record8.plan_id || `${record8.created_at ?? ""}-${record8.updated_at ?? ""}`;
-  const digest3 = createHash12("sha256").update(source).digest("hex").slice(0, 6).toUpperCase();
-  return `${DEFAULT_PLAN_PREFIX}-${digest3}`;
+  const digest4 = createHash12("sha256").update(source).digest("hex").slice(0, 6).toUpperCase();
+  return `${DEFAULT_PLAN_PREFIX}-${digest4}`;
 }
 function nowSeconds() {
   return Math.floor(Date.now() / 1e3);
@@ -9781,8 +9802,8 @@ async function hashPairSecret(secret) {
   const bytes2 = decodeBase64url(secret, 32);
   if (bytes2.length !== 32) throw new Error("Invalid pairing secret");
   try {
-    const digest3 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer(bytes2)));
-    return [...digest3].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+    const digest4 = new Uint8Array(await crypto.subtle.digest("SHA-256", ownedBuffer(bytes2)));
+    return [...digest4].map((byte) => byte.toString(16).padStart(2, "0")).join("");
   } finally {
     bytes2.fill(0);
   }
@@ -10360,6 +10381,13 @@ async function buildSubChatEncryptedMetadataPayloads(params) {
   return payloads;
 }
 var MEMORY_TYPE_REGISTRY = {
+  "openmates/memories": {
+    appId: "openmates",
+    itemType: "memories",
+    entryType: "list",
+    required: ["title", "document"],
+    properties: { title: { type: "string" }, document: { type: "string" } }
+  },
   "books/favorite_books": {
     appId: "books",
     itemType: "favorite_books",
@@ -10769,8 +10797,8 @@ var MATE_NAMES = {
   general_knowledge: "George",
   onboarding_support: "Suki"
 };
-function stripLegacySuggestionPrefix(text6) {
-  return text6.replace(/^\s*\[[^\]]+\]\s*/, "").trim();
+function stripLegacySuggestionPrefix(text7) {
+  return text7.replace(/^\s*\[[^\]]+\]\s*/, "").trim();
 }
 var CLOUD_API_URL = "https://api.openmates.org";
 var DEFAULT_API_URL = process.env.OPENMATES_API_URL ?? CLOUD_API_URL;
@@ -13496,7 +13524,7 @@ var OpenMatesClient = class _OpenMatesClient {
   }
   async requestAssistantSpeechMessage(ws, chatId, messageId, segments2) {
     const timeoutMs = 10 * 60 * 1e3;
-    return await new Promise((resolve17, reject) => {
+    return await new Promise((resolve18, reject) => {
       const expected = /* @__PURE__ */ new Set();
       const queued = /* @__PURE__ */ new Set();
       const terminal = /* @__PURE__ */ new Map();
@@ -13505,7 +13533,7 @@ var OpenMatesClient = class _OpenMatesClient {
         if (!accepted || expected.size === 0 || terminal.size !== expected.size) return;
         cleanup();
         const statuses = [...terminal.values()];
-        resolve17({
+        resolve18({
           generated: statuses.filter((status) => status.status === "ready" && queued.has(String(status.segment_id))).length,
           reused: statuses.filter((status) => status.status === "ready" && !queued.has(String(status.segment_id))).length,
           failed: statuses.filter((status) => status.status === "error").length,
@@ -15007,8 +15035,8 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     let dispatchHandlersReady = () => {
     };
-    const handlersReady = new Promise((resolve17) => {
-      dispatchHandlersReady = resolve17;
+    const handlersReady = new Promise((resolve18) => {
+      dispatchHandlersReady = resolve18;
     });
     let precollectedResponse = params.precollectResponse && params.incognito && shouldWaitForAi ? ws.collectAiResponse(messageId, chatId, { onStream: params.onStream, timeoutMs: params.responseTimeoutMs }) : null;
     if (!params.incognito && chatKeyBytes && encryptedChatKey) {
@@ -15597,7 +15625,7 @@ var OpenMatesClient = class _OpenMatesClient {
               );
               const remainingMs = claimRetryDeadline - Date.now();
               if (remainingMs <= claimRetryDelayMs) throw error;
-              await new Promise((resolve17) => setTimeout(resolve17, claimRetryDelayMs));
+              await new Promise((resolve18) => setTimeout(resolve18, claimRetryDelayMs));
               claimRetryDelayMs = Math.min(claimRetryDelayMs * 2, 2e3);
             } finally {
               stopWatchingErrors();
@@ -16452,13 +16480,13 @@ var OpenMatesClient = class _OpenMatesClient {
         );
       } catch (error) {
         lastTransientError = error instanceof Error ? error.message : String(error);
-        await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS));
+        await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS));
         continue;
       }
       if (!response.ok) {
         if (response.status >= SKILL_TASK_POLL_TRANSIENT_ERROR_STATUS) {
           lastTransientError = `HTTP ${response.status}`;
-          await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS));
+          await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS));
           continue;
         }
         throw new Error(`Task ${taskId} polling failed with HTTP ${response.status}. Generation was not retried; retain this task ID for recovery.`);
@@ -16470,7 +16498,7 @@ var OpenMatesClient = class _OpenMatesClient {
       if (response.data.status === "failed") {
         throw new Error(response.data.error ?? "Task failed");
       }
-      await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS));
+      await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS));
     }
     if (lastTransientError) {
       throw new Error(
@@ -17297,11 +17325,11 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data.events ?? [];
   }
-  async followUpWorkflowInput(sessionId, text6) {
+  async followUpWorkflowInput(sessionId, text7) {
     this.requireSession();
     const response = await this.http.post(
       `/v1/workflows/input/${encodeURIComponent(sessionId)}/follow-up`,
-      { text: text6 },
+      { text: text7 },
       this.getCliRequestHeaders()
     );
     if (!response.ok || !response.data.session) {
@@ -17456,11 +17484,13 @@ var OpenMatesClient = class _OpenMatesClient {
   async getCustomRuleDocuments() {
     const user = await this.whoAmI();
     const settings = await this.decryptSettingsRecord(user.encrypted_settings);
-    if (!Array.isArray(settings.rule_documents)) return [];
+    const legacy = Array.isArray(settings.rule_documents) ? settings.rule_documents : [];
+    const canonical = Array.isArray(settings.memory_documents) ? settings.memory_documents : [];
+    const byId = new Map([...legacy, ...canonical].filter((value) => value && typeof value.id === "string").map((value) => [value.id, value]));
     let chars = 0;
     const documents = [];
-    for (const value of settings.rule_documents.slice(0, 24)) {
-      if (!value || typeof value !== "object" || value.source !== void 0 && value.source !== "personal" || typeof value.id !== "string" || !value.id || value.id.length > 128 || typeof value.document !== "string" || value.document.length > 24e3) continue;
+    for (const value of [...byId.values()].slice(0, 24)) {
+      if (!value || typeof value !== "object" || value.source !== void 0 && value.source !== "personal" || typeof value.id !== "string" || !value.id || value.id.length > 240 || typeof value.document !== "string" || value.document.length > 24e3) continue;
       if (chars + value.document.length > 64e3) continue;
       chars += value.document.length;
       documents.push({ id: value.id, source: "personal", document: value.document });
@@ -18592,7 +18622,7 @@ var OpenMatesClient = class _OpenMatesClient {
         `Rate limited by settings API; retrying in ${Math.ceil(SETTINGS_GET_RATE_LIMIT_RETRY_MS / 1e3)}s...
 `
       );
-      await new Promise((resolve17) => setTimeout(resolve17, SETTINGS_GET_RATE_LIMIT_RETRY_MS));
+      await new Promise((resolve18) => setTimeout(resolve18, SETTINGS_GET_RATE_LIMIT_RETRY_MS));
       response = await this.http.get(normalizedPath, headers);
     }
     if (!response.ok) {
@@ -19283,6 +19313,26 @@ var OpenMatesClient = class _OpenMatesClient {
         data: parsed
       });
     }
+    if (!teamId) {
+      let accountDocuments = [];
+      try {
+        accountDocuments = await this.getCustomRuleDocuments();
+      } catch {
+      }
+      for (const memory of accountDocuments) {
+        const title = /^title:\s*(.+)$/m.exec(memory.document)?.[1]?.replace(/^['"]|['"]$/g, "") ?? "Memory";
+        results.push({
+          id: `account-memory-${memory.id.replace(/^personal:/, "")}`,
+          app_id: "openmates",
+          item_type: "memories",
+          item_key_hash: "",
+          data: { title, document: memory.document },
+          created_at: 0,
+          updated_at: 0,
+          item_version: 1
+        });
+      }
+    }
     return results;
   }
   /**
@@ -19310,6 +19360,13 @@ var OpenMatesClient = class _OpenMatesClient {
    * @param currentVersion - The entry's current item_version from listMemories()
    */
   async updateMemory(params) {
+    if (params.entryId.startsWith("account-memory-")) {
+      if (params.appId !== "openmates" || params.itemType !== "memories" || this.resolveTeamContext(params)) {
+        throw new Error("Account Memories belong to the personal OpenMates category.");
+      }
+      await this.mutateAccountMemory(params.entryId, params.itemValue);
+      return { success: true, id: params.entryId };
+    }
     return this.upsertMemory({
       appId: params.appId,
       itemType: params.itemType,
@@ -19325,6 +19382,11 @@ var OpenMatesClient = class _OpenMatesClient {
    * WebSocket. The server deletes from Directus and broadcasts to all devices.
    */
   async deleteMemory(entryId, options = {}) {
+    if (entryId.startsWith("account-memory-")) {
+      if (this.resolveTeamContext(options)) throw new Error("Account Memories belong to the personal OpenMates category.");
+      await this.mutateAccountMemory(entryId);
+      return { success: true };
+    }
     const { ws } = await this.openWsClient();
     try {
       const teamId = this.resolveTeamContext(options);
@@ -19345,6 +19407,34 @@ var OpenMatesClient = class _OpenMatesClient {
   // -------------------------------------------------------------------------
   // Private helpers
   // -------------------------------------------------------------------------
+  /** Edit legacy account guides in their encrypted owner store, never as public app data. */
+  async mutateAccountMemory(entryId, value) {
+    const sessionId = this.requireSession().sessionId;
+    const user = await this.whoAmI();
+    const settings = await this.decryptSettingsRecord(user.encrypted_settings);
+    const legacy = Array.isArray(settings.rule_documents) ? settings.rule_documents : [];
+    const canonical = Array.isArray(settings.memory_documents) ? settings.memory_documents : [];
+    const documents = new Map([...legacy, ...canonical].filter((document) => document && typeof document.id === "string").map((document) => [document.id, document]));
+    const original = [...documents.values()].find((document) => `account-memory-${document.id.replace(/^personal:/, "")}` === entryId);
+    if (!original || typeof original.document !== "string") throw new Error("Account Memory is unavailable.");
+    if (value) {
+      if (typeof value.title !== "string" || typeof value.document !== "string") throw new Error("Memory title and document are required.");
+      const { parseRuleDocument, serializeRuleDocument } = await import("./ruleDocuments-6VMP2CV5.js");
+      const document = serializeRuleDocument({ ...parseRuleDocument(value.document), title: value.title });
+      documents.set(original.id, { id: original.id, document });
+      settings.memory_documents = [...documents.values()].map(({ id, document: document2 }) => ({ id, document: document2 }));
+    } else {
+      for (const name of ["rule_documents", "memory_documents"]) {
+        if (Array.isArray(settings[name])) settings[name] = settings[name].filter((document) => document.id !== original.id);
+      }
+    }
+    const ciphertext = await encryptWithAesGcmCombined(JSON.stringify(settings), this.getMasterKeyBytes());
+    const current = await this.whoAmI();
+    if (this.requireSession().sessionId !== sessionId || current.encrypted_settings !== user.encrypted_settings || (current.id ?? current.user_id) !== (user.id ?? user.user_id)) {
+      throw new Error("Account settings changed. Reload before editing the Memory.");
+    }
+    await this.settingsPost("/v1/settings/encrypted-account", { encrypted_settings: ciphertext });
+  }
   /**
    * Validate memory item_value against the registered schema and
    * encrypt + send over WebSocket.
@@ -20831,7 +20921,7 @@ function filenameFromContentDisposition(header2) {
   return plain?.trim() ?? null;
 }
 function sleep2(ms) {
-  return new Promise((resolve17) => setTimeout(resolve17, ms));
+  return new Promise((resolve18) => setTimeout(resolve18, ms));
 }
 function printLogo() {
   const W = "\x1B[1;37m";
@@ -27925,13 +28015,13 @@ var OpenMates = class {
         });
       } catch (error) {
         lastTransientError = error instanceof Error ? error.message : String(error);
-        await new Promise((resolve17) => setTimeout(resolve17, CODE_RUN_POLL_INTERVAL_MS));
+        await new Promise((resolve18) => setTimeout(resolve18, CODE_RUN_POLL_INTERVAL_MS));
         continue;
       }
       if (!response.ok) {
         if (response.status >= SKILL_TASK_POLL_TRANSIENT_ERROR_STATUS2) {
           lastTransientError = `HTTP ${response.status}`;
-          await new Promise((resolve17) => setTimeout(resolve17, CODE_RUN_POLL_INTERVAL_MS));
+          await new Promise((resolve18) => setTimeout(resolve18, CODE_RUN_POLL_INTERVAL_MS));
           continue;
         }
         throw new OpenMatesApiError(response.status, await this.safeJson(response));
@@ -27940,7 +28030,7 @@ var OpenMates = class {
       const status = await this.parseResponse(response);
       const value = typeof status.status === "string" ? status.status : "";
       if (CODE_RUN_TERMINAL_STATUSES.has(value)) return status;
-      await new Promise((resolve17) => setTimeout(resolve17, CODE_RUN_POLL_INTERVAL_MS));
+      await new Promise((resolve18) => setTimeout(resolve18, CODE_RUN_POLL_INTERVAL_MS));
     }
     if (lastTransientError) {
       throw new Error(`Code Run did not complete within ${CODE_RUN_POLL_TIMEOUT_MS / 1e3}s; last polling error: ${lastTransientError}`);
@@ -27965,13 +28055,13 @@ var OpenMates = class {
         });
       } catch (error) {
         lastTransientError = error instanceof Error ? error.message : String(error);
-        await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS2));
+        await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS2));
         continue;
       }
       if (!response.ok) {
         if (response.status >= SKILL_TASK_POLL_TRANSIENT_ERROR_STATUS2) {
           lastTransientError = `HTTP ${response.status}`;
-          await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS2));
+          await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS2));
           continue;
         }
         throw new OpenMatesApiError(response.status, await this.safeJson(response));
@@ -27980,7 +28070,7 @@ var OpenMates = class {
       const task = await this.parseResponse(response);
       if (task.status === "completed") return task;
       if (task.status === "failed") throw new Error(task.error ?? "Task failed");
-      await new Promise((resolve17) => setTimeout(resolve17, SKILL_TASK_POLL_INTERVAL_MS2));
+      await new Promise((resolve18) => setTimeout(resolve18, SKILL_TASK_POLL_INTERVAL_MS2));
     }
     if (lastTransientError) {
       throw new Error(`Task ${taskId} did not complete within ${SKILL_TASK_POLL_TIMEOUT_MS2 / 1e3}s; last polling error: ${lastTransientError}`);
@@ -29057,7 +29147,7 @@ var OpenMatesChats = class {
       }
       const remainingMs = deadline - Date.now();
       if (remainingMs <= 0) break;
-      await new Promise((resolve17) => setTimeout(resolve17, Math.min(pollIntervalMs, remainingMs)));
+      await new Promise((resolve18) => setTimeout(resolve18, Math.min(pollIntervalMs, remainingMs)));
     }
     throw new OpenMatesConfigError("Timed out waiting for saved chat recovery");
   }
@@ -29770,6 +29860,19 @@ var OpenMatesMemories = class {
   constructor(client2) {
     this.client = client2;
   }
+  /** Reviewed, read-only app guidance; independent of private encrypted entries. */
+  async published(options = {}) {
+    if (options.appId) {
+      const app = await this.client.getPublic(
+        `/v1/apps/${encodeURIComponent(options.appId)}/metadata?include_unavailable=true`
+      );
+      return { memories: app.memories ?? [] };
+    }
+    const metadata = await this.client.getPublic(
+      "/v1/apps/metadata?include_unavailable=true"
+    );
+    return { memories: Object.values(metadata.apps).flatMap((app) => app.memories ?? []) };
+  }
   async list(options = {}) {
     const data = await this.client.get(withQuery("/v1/sdk/memories", options.query));
     const memories = await Promise.all((data.memories ?? []).map(async (memory) => {
@@ -30345,7 +30448,7 @@ function isTaskVersionConflict(error) {
   return error instanceof OpenMatesApiError && error.status === 409 && String(JSON.stringify(error.data)).includes("TASK_VERSION_CONFLICT");
 }
 function delay(ms) {
-  return new Promise((resolve17) => setTimeout(resolve17, ms));
+  return new Promise((resolve18) => setTimeout(resolve18, ms));
 }
 var OpenMatesPlans = class {
   client;
@@ -30929,8 +31032,8 @@ var OpenMatesWorkflows = class {
     const response = await this.client.get(`/v1/workflows/input/${encodeURIComponent(sessionId)}/events?after_event_id=${encodeURIComponent(String(afterEventId))}`);
     return response.events ?? [];
   }
-  async followUpInput(sessionId, text6) {
-    const response = await this.client.request(`/v1/workflows/input/${encodeURIComponent(sessionId)}/follow-up`, { text: text6 });
+  async followUpInput(sessionId, text7) {
+    const response = await this.client.request(`/v1/workflows/input/${encodeURIComponent(sessionId)}/follow-up`, { text: text7 });
     if (!response.session) throw new OpenMatesApiError(500, { detail: "Workflow input response missing session" });
     return response.session;
   }
@@ -31304,7 +31407,7 @@ var OpenMatesEmbedPreview = class {
       if (["running", "failed", "timeout", "cancelled", "stopped"].includes(status.status)) {
         return status;
       }
-      await new Promise((resolve17) => setTimeout(resolve17, 1e3));
+      await new Promise((resolve18) => setTimeout(resolve18, 1e3));
     }
     throw new OpenMatesApiError(408, { detail: "Application preview did not reach running state before timeout" });
   }
@@ -32200,27 +32303,27 @@ var SecretRegistry = class {
       textsToAdd.push(entry.textToHide);
     }
     if (entry.additionalTexts) {
-      for (const text6 of entry.additionalTexts) {
-        if (text6 && text6.trim().length > 0) {
-          textsToAdd.push(text6);
+      for (const text7 of entry.additionalTexts) {
+        if (text7 && text7.trim().length > 0) {
+          textsToAdd.push(text7);
         }
       }
     }
-    for (const text6 of textsToAdd) {
+    for (const text7 of textsToAdd) {
       const placeholder = entry.replaceWith.startsWith("[") ? entry.replaceWith : `[${entry.replaceWith}]`;
       const regEntry = {
-        value: text6,
+        value: text7,
         token: placeholder,
         source: "settings",
         name: entry.id,
         type: "PERSONAL_DATA",
-        length: text6.length
+        length: text7.length
       };
-      this.entries.set(text6, regEntry);
-      this.usedPlaceholders.set(placeholder, text6);
-      const lower = text6.toLowerCase();
-      if (lower !== text6) {
-        this.variantToOriginal.set(lower, text6);
+      this.entries.set(text7, regEntry);
+      this.usedPlaceholders.set(placeholder, text7);
+      const lower = text7.toLowerCase();
+      if (lower !== text7) {
+        this.variantToOriginal.set(lower, text7);
       }
     }
     this.automaton = null;
@@ -32274,12 +32377,12 @@ var SecretRegistry = class {
    * @param text Text to scan
    * @returns Array of secret mappings for all matches found
    */
-  findAll(text6) {
+  findAll(text7) {
     if (this.entries.size === 0) return [];
     if (!this.automaton) {
       this.buildAutomaton();
     }
-    const results = this.automaton.search(text6);
+    const results = this.automaton.search(text7);
     const mappings = [];
     const coveredRanges = [];
     const sortedResults = [];
@@ -32484,17 +32587,17 @@ var SecretScanner = class {
    * @param text Text to scan and redact
    * @returns Object with redacted text and mappings for restoration
    */
-  redact(text6) {
-    if (!text6) return { redacted: text6, mappings: [] };
+  redact(text7) {
+    if (!text7) return { redacted: text7, mappings: [] };
     const allMappings = [];
     const coveredRanges = [];
-    const urlExclusionZones = getUrlExclusionZones(text6);
-    const identifierRanges = codingIdentifierRanges(text6);
+    const urlExclusionZones = getUrlExclusionZones(text7);
+    const identifierRanges = codingIdentifierRanges(text7);
     if (this.options.enableRegistryDetection && this.registry.size > 0) {
-      const registryMappings = this.registry.findAll(text6);
+      const registryMappings = this.registry.findAll(text7);
       for (const mapping of registryMappings) {
         let searchFrom = 0;
-        const searchText = text6.toLowerCase();
+        const searchText = text7.toLowerCase();
         const matchLower = mapping.original.toLowerCase();
         while (searchFrom < searchText.length) {
           const idx = searchText.indexOf(matchLower, searchFrom);
@@ -32510,7 +32613,7 @@ var SecretScanner = class {
       for (const pattern of [...SECRET_PATTERNS, ...GENERAL_PII_PATTERNS]) {
         pattern.regex.lastIndex = 0;
         let match;
-        while ((match = pattern.regex.exec(text6)) !== null) {
+        while ((match = pattern.regex.exec(text7)) !== null) {
           const matchText = match[0];
           const startIndex = match.index;
           const endIndex = startIndex + matchText.length;
@@ -32541,7 +32644,7 @@ var SecretScanner = class {
         }
       }
     }
-    let redacted = text6;
+    let redacted = text7;
     const sortedMappings = [...allMappings].sort(
       (a, b) => b.original.length - a.original.length
     );
@@ -32570,9 +32673,9 @@ var SecretScanner = class {
    * @param mappings Mappings from a previous redact() call
    * @returns Text with placeholders replaced by original values
    */
-  restore(text6, mappings) {
-    if (!text6 || !mappings || mappings.length === 0) return text6;
-    let result = text6;
+  restore(text7, mappings) {
+    if (!text7 || !mappings || mappings.length === 0) return text7;
+    let result = text7;
     for (const mapping of mappings) {
       result = result.split(mapping.placeholder).join(mapping.original);
     }
@@ -32591,11 +32694,11 @@ var SecretScanner = class {
 function escapeRegExp2(string3) {
   return string3.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function getUrlExclusionZones(text6) {
+function getUrlExclusionZones(text7) {
   const urlExclusionRegex = /https?:\/\/[^\s]+/g;
   const zones = [];
   let match;
-  while ((match = urlExclusionRegex.exec(text6)) !== null) {
+  while ((match = urlExclusionRegex.exec(text7)) !== null) {
     zones.push({ start: match.index, end: match.index + match[0].length });
   }
   return zones;
@@ -32672,18 +32775,18 @@ var OutputRedactor = class {
    * @param text Text to scan
    * @returns Redacted text with placeholders
    */
-  redact(text6) {
-    return this.redactWithMappings(text6).redacted;
+  redact(text7) {
+    return this.redactWithMappings(text7).redacted;
   }
   /**
    * Redact and return both redacted text and mappings.
    * Used when we need to store mappings alongside message data.
    */
-  redactWithMappings(text6) {
-    if (!text6 || !this.initialized || !this.privacyEnabled) {
-      return { redacted: text6, mappings: [] };
+  redactWithMappings(text7) {
+    if (!text7 || !this.initialized || !this.privacyEnabled) {
+      return { redacted: text7, mappings: [] };
     }
-    const result = this.scanner.redact(text6);
+    const result = this.scanner.redact(text7);
     const excluded = result.mappings.filter((m) => this.disabledCategories.has(PII_TYPE_TO_CATEGORY[m.type] ?? ""));
     if (excluded.length) {
       result.redacted = this.scanner.restore(result.redacted, excluded);
@@ -32698,9 +32801,9 @@ var OutputRedactor = class {
    * Restore placeholders back to original values.
    * Only uses mappings from this session (never from external sources).
    */
-  restore(text6) {
-    if (!text6 || this.sessionMappings.size === 0) return text6;
-    return this.scanner.restore(text6, Array.from(this.sessionMappings.values()));
+  restore(text7) {
+    if (!text7 || this.sessionMappings.size === 0) return text7;
+    return this.scanner.restore(text7, Array.from(this.sessionMappings.values()));
   }
   /** Mappings accumulated while preparing attachments and this message. */
   getMappings() {
@@ -32759,8 +32862,8 @@ function createWebsiteEmbed(url) {
     status: "finished"
   };
 }
-function replaceUrlsInText(text6, embeds) {
-  return text6.replace(URL_PATTERN, (rawUrl) => {
+function replaceUrlsInText(text7, embeds) {
+  return text7.replace(URL_PATTERN, (rawUrl) => {
     const { url, suffix } = trimTrailingUrlPunctuation(rawUrl);
     if (!url) return rawUrl;
     try {
@@ -33350,8 +33453,8 @@ async function renderRemotionShareLink(embedId, client2, ln) {
   }
 }
 function generateQr(value) {
-  return new Promise((resolve17) => {
-    qrcode2.generate(value, { small: true }, (qr) => resolve17(qr));
+  return new Promise((resolve18) => {
+    qrcode2.generate(value, { small: true }, (qr) => resolve18(qr));
   });
 }
 function remotionMeta(c) {
@@ -33760,12 +33863,12 @@ function renderAudioTranscribePreview(c, ln) {
   const language = str(c.language) ?? "";
   if (duration) ln(`\x1B[2mDuration: ${duration}\x1B[0m`);
   if (language) ln(`\x1B[2mLanguage: ${language}\x1B[0m`);
-  const text6 = str(c.text) ?? str(c.transcript) ?? "";
-  if (text6) ln(trunc(text6, 60));
+  const text7 = str(c.text) ?? str(c.transcript) ?? "";
+  if (text7) ln(trunc(text7, 60));
 }
 function renderAudioTranscribeFullscreen(c) {
-  const text6 = str(c.text) ?? str(c.transcript) ?? "";
-  if (text6) console.log(text6);
+  const text7 = str(c.text) ?? str(c.transcript) ?? "";
+  if (text7) console.log(text7);
   else console.log("No transcript available.");
 }
 function renderByDirectType(embed, c, ln) {
@@ -33998,8 +34101,8 @@ function renderDirectTypeFullscreen(embed, c) {
 
 `);
       if (html) {
-        const text6 = html.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
-        console.log(text6);
+        const text7 = html.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+        console.log(text7);
       }
       break;
     }
@@ -34010,8 +34113,8 @@ function renderDirectTypeFullscreen(embed, c) {
 
 `);
       if (html) {
-        const text6 = html.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
-        console.log(text6);
+        const text7 = html.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+        console.log(text7);
       }
       break;
     }
@@ -34248,7 +34351,7 @@ import { appendFileSync, chmodSync as chmodSync7, closeSync as closeSync4, copyF
 import { createInterface as createInterface4 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
 import { homedir as homedir4, tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, join as join15, resolve as resolve6 } from "path";
+import { dirname as dirname9, join as join15, resolve as resolve7 } from "path";
 
 // src/branding.ts
 var OPENMATES_WORDMARK = "OPENMATES";
@@ -35074,8 +35177,42 @@ import { execFileSync as execFileSync3 } from "child_process";
 import { createHash as createHash16 } from "crypto";
 import { accessSync, constants as constants2, existsSync as existsSync9, mkdirSync as mkdirSync9, mkdtempSync, readFileSync as readFileSync10, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname7, join as join12 } from "path";
-var hash2 = (text6) => createHash16("sha256").update(text6).digest("hex");
+import { dirname as dirname7, join as join12, isAbsolute as isAbsolute3, resolve as resolve6 } from "path";
+var hash2 = (text7) => createHash16("sha256").update(text7).digest("hex");
+function caddyConfigFromArgs(args, cwd) {
+  const index = args.indexOf("--config");
+  const value = index >= 0 ? args[index + 1] : args.find((arg) => arg.startsWith("--config="))?.slice(9);
+  if (!value || value.startsWith("--")) return void 0;
+  if (!isAbsolute3(value) && !cwd) throw new Error("caddy_relative_config_requires_explicit_path");
+  return resolve6(cwd ?? "/", value);
+}
+function detectCaddyConfigPath(explicit) {
+  if (explicit) return resolve6(explicit);
+  let pid;
+  try {
+    pid = execFileSync3("systemctl", ["show", "caddy", "--property=MainPID", "--value"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+  }
+  if (pid && /^[1-9]\d*$/.test(pid)) {
+    try {
+      const args = readFileSync10(`/proc/${pid}/cmdline`, "utf8").split("\0").filter(Boolean);
+      const config = caddyConfigFromArgs(args);
+      if (config) return config;
+    } catch {
+      throw new Error("caddy_running_config_requires_explicit_path");
+    }
+    throw new Error("caddy_running_config_requires_explicit_path");
+  }
+  return existsSync9("/etc/caddy/Caddyfile") ? "/etc/caddy/Caddyfile" : void 0;
+}
+function caddyUpdateRetryCommand(input) {
+  const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+  return `sudo -v && openmates server caddy update --path ${quote(input.installPath)} --role ${quote(input.role)} --caddy-config ${quote(input.configPath)}` + (input.profile === "official-upload" ? " --caddy-profile official-upload" : "");
+}
 function resolveCaddyProfile(role, explicit, previous) {
   if (explicit === void 0) return previous ?? "self-host";
   if (role !== "upload" || explicit !== "official-upload") throw new Error("caddy_profile_unsupported");
@@ -35286,7 +35423,17 @@ var HOST_TRANSACTION = String.raw`
 const fs = require('node:fs'), cp = require('node:child_process'), crypto = require('node:crypto'), path = require('node:path');
 const input = JSON.parse(fs.readFileSync(0, 'utf8'));
 const digest = text => crypto.createHash('sha256').update(text).digest('hex');
-function run(command, args) { cp.execFileSync(command, args, {stdio: ['ignore','pipe','pipe'], timeout: 20000}); }
+function run(command, args) {
+  const options = {stdio: ['ignore','pipe','pipe'], timeout: 20000};
+  try { cp.execFileSync(command, args, options); }
+  catch (error) {
+    // A user-owned Caddyfile can still belong to a root-managed service.
+    // Honor a cached sudo session for reload without elevating file access.
+    if (command !== 'systemctl') throw error;
+    try { cp.execFileSync('sudo', ['-n', command, ...args], options); }
+    catch { throw error; }
+  }
+}
 function replace(content, metadata) {
   const temp = input.configPath + '.openmates-' + crypto.randomUUID();
   let fd;
@@ -35346,7 +35493,7 @@ try {
 function caddyHostOperation(input) {
   let privileged = false;
   try {
-    accessSync(dirname7(input.configPath), constants2.W_OK);
+    accessSync(input.action === "read" ? input.configPath : dirname7(input.configPath), input.action === "read" ? constants2.R_OK : constants2.W_OK);
   } catch {
     privileged = true;
   }
@@ -35390,6 +35537,12 @@ async function verifyCaddyCoreRoutes(apiUrl, origin) {
     redirect: "error",
     signal: AbortSignal.timeout(5e3)
   });
+  const embedPreflight = await request("/v1/embeds/chats/00000000-0000-4000-8000-000000000000/references/availability", { method: "OPTIONS", headers: {
+    Origin: origin,
+    "Access-Control-Request-Method": "POST",
+    "Access-Control-Request-Headers": "content-type"
+  } });
+  if (!embedPreflight.ok || embedPreflight.headers.get("access-control-allow-origin") !== origin || embedPreflight.headers.get("access-control-allow-credentials") !== "true") throw new Error("caddy_embed_reference_cors_failed");
   const availability = await request("/v1/features/availability");
   if (!availability.ok) throw new Error("caddy_availability_route_failed");
   const features = await availability.json();
@@ -35682,7 +35835,7 @@ function isBrevoAcceptedResponse(pathName, method, status, responseBody) {
 }
 async function requestBrevo(pathName, method, apiKey, payload) {
   const body = payload ? JSON.stringify(payload) : void 0;
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const request = httpsRequest(buildBrevoRequestOptions(pathName, method, apiKey, body), (response) => {
       let responseBytes = 0;
       const chunks = [];
@@ -35694,8 +35847,8 @@ async function requestBrevo(pathName, method, apiKey, payload) {
       response.on("end", () => {
         const status = response.statusCode ?? 0;
         const responseBody = Buffer.concat(chunks).toString("utf8");
-        if (isBrevoAcceptedResponse(pathName, method, status, responseBody)) resolve17();
-        else if (isBrevoIdempotencyDuplicate(status, responseBody, payload)) resolve17();
+        if (isBrevoAcceptedResponse(pathName, method, status, responseBody)) resolve18();
+        else if (isBrevoIdempotencyDuplicate(status, responseBody, payload)) resolve18();
         else reject(new Error(`brevo_delivery_failed:${status}`));
       });
     });
@@ -35863,7 +36016,7 @@ async function sendGenericWebhook(target, secret, payload, allowLocalDevelopment
   const eventId = randomUUID12();
   const signed = signRuntimeWebhookPayload(payload, secret, timestamp, eventId);
   const selected = addresses[0];
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const requestFunction = url.protocol === "https:" ? httpsRequest : httpRequest;
     const request = requestFunction({
       protocol: url.protocol,
@@ -35883,7 +36036,7 @@ async function sendGenericWebhook(target, secret, payload, allowLocalDevelopment
       });
       response.on("end", () => {
         const status = response.statusCode ?? 0;
-        if (status >= 200 && status < 300) resolve17();
+        if (status >= 200 && status < 300) resolve18();
         else reject(new Error(`webhook_delivery_failed:${status}`));
       });
     });
@@ -35964,7 +36117,7 @@ async function deliverWithRetries(channel, send) {
       await send();
       return { channel, status: "delivered", attempts: attempt };
     } catch {
-      if (attempt < 3) await new Promise((resolve17) => setTimeout(resolve17, 250 * 2 ** (attempt - 1)));
+      if (attempt < 3) await new Promise((resolve18) => setTimeout(resolve18, 250 * 2 ** (attempt - 1)));
     }
   }
   return { channel, status: "exhausted", attempts: 3, sanitizedReason: "delivery_failed" };
@@ -35977,7 +36130,7 @@ async function deliverUpdateCompletionEmail(config, payload, send = sendUpdateCo
       await send(config, payload);
       return { status: "accepted", attempts };
     } catch {
-      if (attempts < 3) await new Promise((resolve17) => setTimeout(resolve17, 250 * 2 ** (attempts - 1)));
+      if (attempts < 3) await new Promise((resolve18) => setTimeout(resolve18, 250 * 2 ** (attempts - 1)));
     }
   }
   return { status: "failed", attempts: Math.max(previousAttempts, 3), sanitizedReason: "delivery_failed" };
@@ -36608,9 +36761,9 @@ function exec(cmd, cwd) {
   return execSync(cmd, { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
 }
 function runInteractive(cmd, args, cwd) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const child = nodeSpawn(cmd, args, { cwd, stdio: "inherit", shell: false });
-    child.on("close", (code) => resolve17(code ?? 1));
+    child.on("close", (code) => resolve18(code ?? 1));
     child.on("error", reject);
   });
 }
@@ -36703,7 +36856,7 @@ function getInstallDeploymentMode(installPath, config) {
 function getOpenMatesCloudOverlayPath(flags, config) {
   const explicit = flags["openmatescloud-path"] ?? flags["openmates-cloud-path"];
   if (explicit === true) throw new Error("Provide an OpenMatesCloud path: --openmatescloud-path <dir>.");
-  if (typeof explicit === "string") return resolve6(explicit);
+  if (typeof explicit === "string") return resolve7(explicit);
   return config?.openMatesCloudOverlayPath;
 }
 function hasServiceFilter(flags) {
@@ -37095,7 +37248,7 @@ function fileHash(path2) {
 async function loadSelfHostComposeTemplate(templateRef, role, imageTag, packageVersion = getPackageVersion()) {
   const templateDir = process.env.OPENMATES_SELFHOST_TEMPLATE_DIR;
   if (templateDir) {
-    return readFileSync12(join15(resolve6(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
+    return readFileSync12(join15(resolve7(templateDir), ROLE_TEMPLATE_FILES[role]), "utf-8");
   }
   const packaged = packagedTemplatePath(role);
   const source = resolveTemplateSource({
@@ -37236,10 +37389,10 @@ function warnIfMissingLlmCredentials(installPath) {
 }
 async function confirmDestructive(phrase) {
   const rl = createInterface4({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     rl.question(`Type "${phrase}" to confirm: `, (answer) => {
       rl.close();
-      resolve17(answer.trim() === phrase);
+      resolve18(answer.trim() === phrase);
     });
   });
 }
@@ -37628,7 +37781,7 @@ function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
     writeEnvContent(installPath, content);
     return { overlayPath: null };
   }
-  const resolvedOverlayPath = resolve6(overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath));
+  const resolvedOverlayPath = resolve7(overlayPath ?? defaultOpenMatesCloudOverlayPath(installPath));
   const overlayComposeFile = defaultOpenMatesCloudComposeFile(resolvedOverlayPath);
   if (!existsSync11(resolvedOverlayPath) || !existsSync11(overlayComposeFile)) {
     throw new Error(
@@ -37739,7 +37892,7 @@ function printServerCommandStart(subcommand, rest, flags) {
   console.log(renderOpenMatesAsciiLogo());
   console.log("");
   console.log(`Running OpenMates ${command}...`);
-  if (typeof flags.path === "string") console.log(`Path: ${resolve6(flags.path)}`);
+  if (typeof flags.path === "string") console.log(`Path: ${resolve7(flags.path)}`);
   if (typeof flags.role === "string") console.log(`Role: ${flags.role}`);
   console.log("");
 }
@@ -37881,7 +38034,7 @@ function createServerBackup(installPath, role, options = {}) {
   const plan = planBackup({ role, includeObservability: options.includeObservability });
   const backupDir = roleBackupDir(installPath, role);
   mkdirSync12(backupDir, { recursive: true, mode: 448 });
-  const archivePath = options.output ? resolve6(options.output) : join15(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
+  const archivePath = options.output ? resolve7(options.output) : join15(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
   mkdirSync12(dirname9(archivePath), { recursive: true, mode: 448 });
   const tempDir = mkdtempSync2(join15(backupDir, ".tmp-"));
   const env = readEnvMap(installPath);
@@ -37936,7 +38089,7 @@ function validateExtractedServerBackup(tempDir, role) {
   }
 }
 function withValidatedServerBackup(installPath, role, file, useBackup, tempRoot = roleBackupDir(installPath, role)) {
-  const archivePath = resolve6(file);
+  const archivePath = resolve7(file);
   if (!existsSync11(archivePath)) throw new Error(`Backup file not found: ${archivePath}`);
   mkdirSync12(tempRoot, { recursive: true, mode: 448 });
   const tempDir = mkdtempSync2(join15(tempRoot, ".restore-"));
@@ -38291,12 +38444,12 @@ async function serverRegister(flags) {
   if (!existsSync11(envPath)) {
     throw new Error(`Runtime env file not found: ${envPath}`);
   }
-  const gitRoot = resolve6(exec("git rev-parse --show-toplevel", installPath));
+  const gitRoot = resolve7(exec("git rev-parse --show-toplevel", installPath));
   if (gitRoot !== installPath) {
     throw new Error(`--path must point to the OpenMates Git checkout root (${gitRoot}).`);
   }
   const existing = loadServerConfig();
-  if (existing?.installPath && resolve6(existing.installPath) !== installPath && flags.yes !== true) {
+  if (existing?.installPath && resolve7(existing.installPath) !== installPath && flags.yes !== true) {
     throw new Error(
       `Another server is registered at ${existing.installPath}. Rerun with --yes to replace the local CLI registration; no server data will be changed.`
     );
@@ -38346,8 +38499,8 @@ async function serverRegister(flags) {
   }
 }
 async function serverInstall(flags) {
-  const installPath = typeof flags.path === "string" ? resolve6(flags.path) : DEFAULT_INSTALL_PATH;
-  const sourcePath = typeof flags["source-path"] === "string" ? resolve6(flags["source-path"]) : null;
+  const installPath = typeof flags.path === "string" ? resolve7(flags.path) : DEFAULT_INSTALL_PATH;
+  const sourcePath = typeof flags["source-path"] === "string" ? resolve7(flags["source-path"]) : null;
   const fromSource = flags["from-source"] === true || sourcePath !== null;
   const role = getServerRole(flags, null);
   const profile = getCoreProfile(flags, null);
@@ -38372,7 +38525,7 @@ async function serverInstall(flags) {
     mkdirSync12(installPath, { recursive: true });
     ensureRuntimeMetricsDirectory(installPath);
     if (typeof flags["env-path"] === "string") {
-      const envSource = resolve6(flags["env-path"]);
+      const envSource = resolve7(flags["env-path"]);
       if (!existsSync11(envSource)) {
         throw new Error(`Env file not found: ${envSource}`);
       }
@@ -38450,7 +38603,7 @@ CLI default API: ${cliUrls2.apiUrl}`);
   }
   ensureRuntimeMetricsDirectory(installPath);
   if (typeof flags["env-path"] === "string") {
-    const envSource = resolve6(flags["env-path"]);
+    const envSource = resolve7(flags["env-path"]);
     if (!existsSync11(envSource)) {
       throw new Error(`Env file not found: ${envSource}`);
     }
@@ -38727,7 +38880,7 @@ async function persistRuntimeResult(installPath, role, output) {
   return deliveries.flat();
 }
 async function installRuntimeMonitoringServices(installPath, role) {
-  const executablePath = resolve6(process.argv[1] ?? "/usr/local/bin/openmates");
+  const executablePath = resolve7(process.argv[1] ?? "/usr/local/bin/openmates");
   const plan = planRuntimeMonitoringServices({ role, installPath, executablePath });
   const notificationConfig = runtimeNotificationConfig(installPath);
   const emailServiceAvailable = notificationConfig.email ? await probeRuntimeEmailService(notificationConfig.email) : false;
@@ -38814,7 +38967,9 @@ async function autoInstallRuntimeMonitoringServices(installPath, role) {
 }
 function caddyUpdatePlan(installPath, role, config, flags) {
   if (flags["caddy-config"] === true) throw new Error("Provide --caddy-config <file>.");
-  const configPath = resolve6(typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : "/etc/caddy/Caddyfile");
+  const explicit = typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : void 0;
+  const configPath = detectCaddyConfigPath(explicit) ?? "/etc/caddy/Caddyfile";
+  if (explicit && !existsSync11(configPath)) throw new Error("caddy_explicit_config_missing");
   const required2 = role === "core" && getInstallDeploymentMode(installPath, config) === "official_cloud";
   if (!existsSync11(configPath) && required2) throw new Error("Managed cloud Caddyfile is missing; update cannot proceed.");
   const prior = role === "upload" ? readCaddyUpdateState(join15(installPath, ".openmates", "caddy", `${role}.json`), configPath, null) : void 0;
@@ -38896,7 +39051,69 @@ async function runCaddyUpdateStep(input) {
   } catch (error) {
     const reason = error instanceof Error && /^caddy_[a-z_:-]+$/.test(error.message) ? error.message : "caddy_update_failed";
     writeServerUpdateStatus(input.installPath, input.role, { status: "degraded", step: "caddy-update", caddy: { status: "failed", sanitizedReason: reason } });
-    throw new Error(`Caddy update failed (${reason}); update is degraded. Updated containers remain running.`);
+    const command = caddyRetryForInstall(input.installPath, input.role, input.flags, reason);
+    throw new Error(`Caddy update failed (${reason}); update is degraded. Updated containers remain running.
+After resolving the reported problem, run:
+${command}`);
+  }
+}
+function caddyRetryForInstall(installPath, role, flags, reason) {
+  const explicit = typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : void 0;
+  let configPath = explicit ?? "/path/to/active/Caddyfile";
+  try {
+    configPath = detectCaddyConfigPath(explicit) ?? "/etc/caddy/Caddyfile";
+  } catch {
+  }
+  return caddyUpdateRetryCommand({
+    installPath,
+    role,
+    configPath,
+    profile: flags["caddy-profile"] === "official-upload" || reason === "caddy_profile_required_official_upload" ? "official-upload" : void 0
+  });
+}
+async function updateCaddyOnly(installPath, role, config, flags) {
+  const release2 = acquireServerUpdateLock(installPath);
+  let result;
+  try {
+    await withEngineeringRuntimeOperation(installPath, "caddy-update", ["caddy"], async () => {
+      result = await updateServerCaddy({ installPath, role, config, flags, mode: getInstallMode(installPath, config), withOverrides: flags["with-overrides"] === true || config?.composeProfile === "full" });
+    });
+    return result;
+  } finally {
+    release2();
+  }
+}
+async function updateCaddyAfterCliUpgrade(flags) {
+  let installPath;
+  try {
+    installPath = resolveServerPath(flags);
+  } catch (error) {
+    if (flags.path !== void 0) throw error;
+    return void 0;
+  }
+  const config = loadConfigForInstallPath(installPath);
+  const role = getServerRole(flags, config);
+  let configPath;
+  try {
+    configPath = detectCaddyConfigPath(typeof flags["caddy-config"] === "string" ? flags["caddy-config"] : void 0);
+  } catch {
+    return { status: "pending", reason: "caddy_running_config_requires_explicit_path", retryCommand: caddyUpdateRetryCommand({ installPath, role, configPath: "/path/to/active/Caddyfile" }) };
+  }
+  if (!configPath) return void 0;
+  const retryCommand = caddyUpdateRetryCommand({
+    installPath,
+    role,
+    configPath,
+    profile: flags["caddy-profile"] === "official-upload" ? "official-upload" : void 0
+  });
+  if (flags["dry-run"] === true || !config && typeof flags.path !== "string") {
+    return { status: flags["dry-run"] === true ? "planned" : "pending", retryCommand };
+  }
+  try {
+    return await updateCaddyOnly(installPath, role, config, { ...flags, "caddy-config": configPath });
+  } catch (error) {
+    const reason = error instanceof Error && /^caddy_[a-z_:-]+$/.test(error.message) ? error.message : "caddy_update_failed";
+    return { status: "pending", retryCommand: reason === "caddy_profile_required_official_upload" ? caddyUpdateRetryCommand({ installPath, role, configPath, profile: "official-upload" }) : retryCommand, reason };
   }
 }
 async function serverUpdate(client2, rest, flags) {
@@ -39515,7 +39732,7 @@ async function serverMonitoring(rest, flags) {
   const config = loadConfigForInstallPath(installPath);
   const role = getServerRole(flags, config);
   if (rest[0] === "install-service") {
-    const plan = planRuntimeMonitoringServices({ role, installPath, executablePath: resolve6(process.argv[1] ?? "/usr/local/bin/openmates") });
+    const plan = planRuntimeMonitoringServices({ role, installPath, executablePath: resolve7(process.argv[1] ?? "/usr/local/bin/openmates") });
     const files = [
       [plan.serviceName, plan.unit],
       [plan.timerName, plan.timer],
@@ -40212,9 +40429,35 @@ async function serverPreflight(flags) {
   console.log(`  Caddy steps:   ${caddyPlan.steps.join(" -> ")}`);
 }
 async function serverCaddy(rest, flags) {
+  if (rest[0] === "update") {
+    if (flags["caddy-config"] === true) throw new Error("Provide --caddy-config <file>.");
+    const installPath = resolveServerPath(flags);
+    const config2 = loadConfigForInstallPath(installPath);
+    const role2 = getServerRole(flags, config2);
+    try {
+      const plan2 = caddyUpdatePlan(installPath, role2, config2, flags);
+      const retryCommand = caddyUpdateRetryCommand({ installPath, role: role2, configPath: plan2.configPath, profile: plan2.profile });
+      if (flags["dry-run"] === true) {
+        if (flags.json === true) printJson({ command: "caddy update", ...plan2, role: role2, path: installPath, mode: getInstallMode(installPath, config2), retryCommand });
+        else console.log(`Caddy release update: ${plan2.status}
+Run: ${retryCommand}`);
+        return;
+      }
+      const result = plan2.status === "not_installed" ? { status: "not_installed" } : await updateCaddyOnly(installPath, role2, config2, { ...flags, "caddy-config": plan2.configPath });
+      if (flags.json === true) printJson({ command: "caddy update", role: role2, ...result });
+      else console.log(`Caddy: ${result.status}`);
+    } catch (error) {
+      const reason = error instanceof Error && /^caddy_[a-z_:-]+$/.test(error.message) ? error.message : "caddy_update_failed";
+      const retryCommand = caddyRetryForInstall(installPath, role2, flags, reason);
+      throw new Error(`Caddy update failed (${reason}).
+After resolving the reported problem, run:
+${retryCommand}`);
+    }
+    return;
+  }
   const action = rest[0] ?? "status";
   if (!["check", "status", "diff", "apply"].includes(action)) {
-    throw new Error("Usage: openmates server caddy check|status|diff|apply [--role core|upload|preview]");
+    throw new Error("Usage: openmates server caddy check|status|diff|apply|update [--role core|upload|preview]");
   }
   const config = loadServerConfig();
   const role = getServerRole(flags, config);
@@ -40503,6 +40746,8 @@ Command Options:
 
   caddy:
     openmates server caddy check|status|diff|apply [--role core|upload|preview] [--config /etc/caddy/Caddyfile]
+    openmates server caddy update [--path <installation>] [--role core|upload|preview] [--caddy-config <file>] [--dry-run]
+      Merge the installed server release's configuration, preserve host edits, validate and reload.
 
   reset:
     --delete-user-data-only   Only delete database and cache (preserve config)
@@ -40605,7 +40850,7 @@ async function handleServer(client2, subcommand, rest, flags) {
 
 // src/codeRunInput.ts
 import { readdir, readFile as readFile2, stat as stat2 } from "fs/promises";
-import { basename as basename3, relative as relative2, resolve as resolve7 } from "path";
+import { basename as basename3, relative as relative2, resolve as resolve8 } from "path";
 var CODE_RUN_MAX_FILES = 50;
 var CODE_RUN_MAX_FILE_BYTES = 1e6;
 var CODE_RUN_MAX_TOTAL_BYTES = 1e7;
@@ -40649,7 +40894,7 @@ async function buildCodeRunRequestsFromFlags(flags) {
     }, buffer.byteLength);
   }
   for (const filePath of toList(flags.file)) {
-    const absolute = resolve7(filePath);
+    const absolute = resolve8(filePath);
     const buffer = await readFile2(absolute);
     const sandboxPath = normalizeCodeRunPath(basename3(filePath));
     addFile({
@@ -40661,7 +40906,7 @@ async function buildCodeRunRequestsFromFlags(flags) {
     }, buffer.byteLength);
   }
   for (const dirPath of toList(flags.dir)) {
-    const root = resolve7(dirPath);
+    const root = resolve8(dirPath);
     const dirFiles = await collectDirectoryFiles(root, flags.include, flags.exclude);
     for (const absolute of dirFiles) {
       const sandboxPath = normalizeCodeRunPath(relative2(root, absolute).replace(/\\/g, "/"));
@@ -40678,10 +40923,10 @@ async function buildCodeRunRequestsFromFlags(flags) {
   for (const url of toList(flags.url)) {
     const response = await fetch(url);
     if (!response.ok) throw new Error(`Failed to download Code Run URL ${redactUrl(url)} (HTTP ${response.status})`);
-    const text6 = await response.text();
+    const text7 = await response.text();
     const urlPath = new URL(url).pathname;
     const sandboxPath = normalizeCodeRunPath(entry || basename3(urlPath) || "main.txt");
-    const buffer = Buffer.from(text6, "utf8");
+    const buffer = Buffer.from(text7, "utf8");
     addFile({
       path: sandboxPath,
       content_base64: buffer.toString("base64"),
@@ -40691,9 +40936,9 @@ async function buildCodeRunRequestsFromFlags(flags) {
     }, buffer.byteLength);
   }
   if (flags.repo) {
-    await addGithubRepoFiles(flags.repo, toList(flags.include), async (path2, text6) => {
+    await addGithubRepoFiles(flags.repo, toList(flags.include), async (path2, text7) => {
       const sandboxPath = normalizeCodeRunPath(path2);
-      const buffer = Buffer.from(text6, "utf8");
+      const buffer = Buffer.from(text7, "utf8");
       addFile({
         path: sandboxPath,
         content_base64: buffer.toString("base64"),
@@ -40758,7 +41003,7 @@ async function collectDirectoryFiles(root, include, exclude) {
   const files = [];
   async function walk(directory) {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
-      const absolute = resolve7(directory, entry.name);
+      const absolute = resolve8(directory, entry.name);
       const rel = relative2(root, absolute).replace(/\\/g, "/");
       if (matchesAny(rel, excludes) || matchesAny(entry.name, excludes)) continue;
       if (entry.isDirectory()) {
@@ -59413,6 +59658,14 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
         }
       }
     },
+    openmates: {
+      memories: {
+        text: "Memories",
+        description: {
+          text: "Your facts, preferences and reusable guidance. Shared with a mate only after permission or an explicit mention."
+        }
+      }
+    },
     plants: {
       my_plants: {
         text: "My Plants",
@@ -73458,6 +73711,152 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
       text: "Sophia"
     }
   },
+  memories: {
+    manage: {
+      text: "Memories"
+    },
+    guide_description: {
+      text: "Save facts, preferences or reusable guidance as a Memory. Focus modes guide your current work; Specifications define required outcomes."
+    },
+    scope: {
+      text: "Memory source"
+    },
+    source_app: {
+      text: "App-provided"
+    },
+    sources_help: {
+      text: "Public memories are provided by apps and load automatically when relevant. Private memories are encrypted. Personal memories are shared with your approval or an explicit mention; Project memories load with active Project access."
+    },
+    visibility_public: {
+      text: "Public"
+    },
+    visibility_private: {
+      text: "Private"
+    },
+    source_personal: {
+      text: "Personal"
+    },
+    source_project: {
+      text: "Project"
+    },
+    loaded: {
+      text: "Loaded {count} memories."
+    },
+    revision: {
+      text: "Revision"
+    },
+    project_storage: {
+      text: "Project Memories are encrypted Markdown files and load when relevant while this chat has active Project access."
+    },
+    activation_required: {
+      text: "Activate this Project in a chat before creating or editing its Memories."
+    },
+    title: {
+      text: "Title"
+    },
+    description: {
+      text: "Description"
+    },
+    when_to_use: {
+      text: "When to use"
+    },
+    practices: {
+      text: "Memory (Markdown)"
+    },
+    empty: {
+      text: "No Memories saved here yet."
+    },
+    new: {
+      text: "New Memory"
+    },
+    saved: {
+      text: "Memory saved."
+    },
+    invalid_document: {
+      text: "Add a title, description, applicability and practices within the field limits."
+    },
+    save_failed: {
+      text: "Could not load or save the Memories. Please try again."
+    },
+    authoring_suggestions: {
+      text: "Suggested Project improvements"
+    },
+    create_focus: {
+      text: "Create Focus"
+    },
+    update_focus: {
+      text: "Update Focus"
+    },
+    create_workflow: {
+      text: "Create Workflow"
+    },
+    update_workflow: {
+      text: "Update Workflow"
+    },
+    authoring_started: {
+      text: "Started"
+    },
+    authoring_failed: {
+      text: "Could not start this update. Please try again."
+    },
+    expanded: {
+      text: "Expanded"
+    },
+    collapsed: {
+      text: "Collapsed"
+    },
+    authoring_save_failed: {
+      text: "Could not save this draft. Please try again."
+    },
+    review_draft: {
+      text: "Review draft"
+    },
+    save_draft: {
+      text: "Save draft"
+    },
+    job_running: {
+      text: "Working on this improvement\u2026"
+    },
+    job_queued: {
+      text: "Waiting to start."
+    },
+    job_needs_input: {
+      text: "More information is needed."
+    },
+    job_needs_save: {
+      text: "Draft ready for review and saving."
+    },
+    job_needs_binding_save: {
+      text: "Save the remaining Project file connection."
+    },
+    job_pending_file: {
+      text: "Waiting for the connected file."
+    },
+    job_partial: {
+      text: "Some changes completed. The remaining changes need attention."
+    },
+    job_conflict: {
+      text: "The source changed. Review the conflict before continuing."
+    },
+    job_ready: {
+      text: "Project improvement saved."
+    },
+    job_failed: {
+      text: "This improvement could not be completed."
+    },
+    job_saved: {
+      text: "Saved."
+    },
+    job_cancelled: {
+      text: "Cancelled."
+    },
+    job_waiting: {
+      text: "Waiting for a job update."
+    },
+    app_loading: {
+      text: "Public \xB7 Provided by the app \xB7 Read-only \xB7 Loads automatically when relevant"
+    }
+  },
   metadata: {
     default: {
       title: {
@@ -84150,7 +84549,7 @@ function buildAssistantFeedbackDecision(rating) {
 import { createHash as createHash18, randomUUID as randomUUID15 } from "crypto";
 import { existsSync as existsSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync13, readdirSync as readdirSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, join as join16, resolve as resolve8 } from "path";
+import { dirname as dirname10, join as join16, resolve as resolve9 } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_JUDGE_MODEL = "google/gemini-3-flash-preview";
 var DEFAULT_PROMPT_BUDGET_MODEL = "google/gemini-3.5-flash";
@@ -84564,7 +84963,7 @@ async function handleBenchmark(client2, subcommand, rest, flags) {
   const dryRun = flags["dry-run"] === true;
   const output = typeof flags.output === "string" ? flags.output : void 0;
   const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID15();
-  const imagePath = typeof flags.image === "string" ? resolve8(flags.image) : defaultImageFixturePath();
+  const imagePath = typeof flags.image === "string" ? resolve9(flags.image) : defaultImageFixturePath();
   if (!dryRun && flags["confirm-spend-credits"] !== true) {
     throw new Error(
       "Benchmark runs spend real credits from the logged-in account. Rerun with --confirm-spend-credits, or use --dry-run to preview the plan."
@@ -85284,13 +85683,13 @@ function parseJudgment(answer) {
     return { score: null, reason: null };
   }
 }
-function extractJsonObject(text6) {
-  const fenced = text6.match(/```(?:json)?\s*([\s\S]*?)\s*```/i);
+function extractJsonObject(text7) {
+  const fenced = text7.match(/```(?:json)?\s*([\s\S]*?)\s*```/i);
   if (fenced) return fenced[1];
-  const start = text6.indexOf("{");
-  const end = text6.lastIndexOf("}");
+  const start = text7.indexOf("{");
+  const end = text7.lastIndexOf("}");
   if (start === -1 || end === -1 || end <= start) return null;
-  return text6.slice(start, end + 1);
+  return text7.slice(start, end + 1);
 }
 function loadPricingForModels(models) {
   const availablePricing = loadProviderPricing();
@@ -85319,21 +85718,21 @@ function loadProviderPricing() {
   for (const fileName of readdirSync6(providersDir)) {
     if (!fileName.endsWith(".yml")) continue;
     const filePath = join16(providersDir, fileName);
-    const text6 = readFileSync13(filePath, "utf-8");
-    const provider = parseProviderId(text6) ?? fileName.replace(/\.yml$/, "");
-    for (const modelPricing of parseModelPricing(text6, provider)) {
+    const text7 = readFileSync13(filePath, "utf-8");
+    const provider = parseProviderId(text7) ?? fileName.replace(/\.yml$/, "");
+    for (const modelPricing of parseModelPricing(text7, provider)) {
       pricing.set(`${modelPricing.provider}/${modelPricing.modelId}`, modelPricing);
       pricing.set(modelPricing.modelId, modelPricing);
     }
   }
   return pricing;
 }
-function parseProviderId(text6) {
-  const match = text6.match(/^provider_id:\s*["']?([^"'\n]+)["']?/m);
+function parseProviderId(text7) {
+  const match = text7.match(/^provider_id:\s*["']?([^"'\n]+)["']?/m);
   return match?.[1]?.trim() ?? null;
 }
-function parseModelPricing(text6, provider) {
-  const lines = text6.split("\n");
+function parseModelPricing(text7, provider) {
+  const lines = text7.split("\n");
   const results = [];
   let modelId = null;
   let inModel = false;
@@ -85376,7 +85775,7 @@ function findProvidersDir() {
     const candidate = join16(current, "backend", "providers");
     if (existsSync12(candidate)) return candidate;
     const parentCandidate = join16(current, "..", "..", "backend", "providers");
-    if (existsSync12(parentCandidate)) return resolve8(parentCandidate);
+    if (existsSync12(parentCandidate)) return resolve9(parentCandidate);
     const next = dirname10(current);
     if (next === current) break;
     current = next;
@@ -85895,10 +86294,10 @@ var TuiTerminal = class {
     const tail = rows2.length < this.height ? `\x1B[${rows2.length + 1};1H\x1B[J` : "";
     this.output.write(`\x1B[?2026h${body}${tail}\x1B[?2026l`);
   }
-  receiveInput(text6) {
+  receiveInput(text7) {
     if (this.inputTimer) clearTimeout(this.inputTimer);
     this.inputTimer = null;
-    this.pendingInput += text6;
+    this.pendingInput += text7;
     const marker = this.paste ? "\x1B[201~" : "\x1B[200~";
     const found = this.pendingInput.indexOf(marker);
     if (found >= 0) {
@@ -85926,10 +86325,10 @@ var TuiTerminal = class {
     }, 30);
   }
   /** Consume SGR mouse reports without letting clicks become composer text. */
-  dispatchInput(text6) {
+  dispatchInput(text7) {
     if (this.mouseTimer) clearTimeout(this.mouseTimer);
     this.mouseTimer = null;
-    const input = this.pendingMouse + text6;
+    const input = this.pendingMouse + text7;
     this.pendingMouse = "";
     let offset = 0;
     while (offset < input.length) {
@@ -86328,25 +86727,25 @@ function wrapCells(value, width) {
   width = Math.max(1, width);
   const result = [];
   for (const line of terminalText(value).split("\n")) {
-    let text6 = "", used = 0;
+    let text7 = "", used = 0;
     for (const { segment } of segments.segment(line)) {
       const size = graphemeWidth(segment);
       if (size > width) {
-        if (text6) result.push(text6);
+        if (text7) result.push(text7);
         result.push("?");
-        text6 = "";
+        text7 = "";
         used = 0;
         continue;
       }
       if (used + size > width) {
-        result.push(text6);
-        text6 = "";
+        result.push(text7);
+        text7 = "";
         used = 0;
       }
-      text6 += segment;
+      text7 += segment;
       used += size;
     }
-    result.push(text6);
+    result.push(text7);
   }
   return result;
 }
@@ -87000,8 +87399,8 @@ var NODE_FIELDS = {
   custom_code: ["code"]
 };
 function compact(value, max = 80) {
-  const text6 = typeof value === "string" ? value : Array.isArray(value) ? value.map((item) => compact(item, max)).join(", ") : value && typeof value === "object" ? Object.entries(value).map(([key, item]) => `${key.replaceAll("_", " ")}: ${compact(item, max)}`).join(" \xB7 ") : String(value);
-  const oneLine3 = text6.replace(/\s+/g, " ");
+  const text7 = typeof value === "string" ? value : Array.isArray(value) ? value.map((item) => compact(item, max)).join(", ") : value && typeof value === "object" ? Object.entries(value).map(([key, item]) => `${key.replaceAll("_", " ")}: ${compact(item, max)}`).join(" \xB7 ") : String(value);
+  const oneLine3 = text7.replace(/\s+/g, " ");
   return truncateCells(oneLine3, max);
 }
 function label2(node) {
@@ -87764,7 +88163,7 @@ function renderWorkspaceFrame(state, rawWidth, rawHeight, body, options = {}) {
   const title = state.activeChat?.title && state.workspace === "chats" ? ` \xB7 ${state.activeChat.title}` : "";
   const nav = contentWidth >= 90 ? `OpenMates  ${labels}${title}` : `OpenMates  [${titleCase(state.workspace)}]  ${state.sidebarOpen ? "Sidebar open" : "Ctrl+B sidebar"}${title}`;
   const inputWidth = Math.max(1, contentWidth - 6);
-  const inputLines = state.input.split("\n").flatMap((text6) => wrapCells(text6, inputWidth));
+  const inputLines = state.input.split("\n").flatMap((text7) => wrapCells(text7, inputWidth));
   const showComposer = state.workspace !== "apps" || state.focus === "composer" || Boolean(state.input);
   const composerRows = showComposer ? Math.min(3, Math.max(1, inputLines.length)) : 0;
   const bodyHeight = Math.max(1, height - 2 - (showComposer ? composerRows + 3 : 1));
@@ -87819,8 +88218,8 @@ function renderWorkspaceFrame(state, rawWidth, rawHeight, body, options = {}) {
         let remaining = span;
         rendered = "";
         for (const part of style.spans) {
-          const text6 = truncateCells(terminalText(part.text).replace(/\n/g, " "), remaining), size = cells(text6);
-          rendered += part.background ? backgroundLine(text6, size, part.background, mode, part.bold) : text6;
+          const text7 = truncateCells(terminalText(part.text).replace(/\n/g, " "), remaining), size = cells(text7);
+          rendered += part.background ? backgroundLine(text7, size, part.background, mode, part.bold) : text7;
           remaining -= size;
           if (!remaining) break;
         }
@@ -87837,12 +88236,12 @@ function renderWorkspaceFrame(state, rawWidth, rawHeight, body, options = {}) {
   const hintColor = state.focus === "composer" ? "#a0a0a0" : "#ff553b";
   const composer = [];
   if (showComposer) {
-    const inputRows = inputLines.slice(-composerRows).map((text6, i) => `${i ? "  " : "> "}${text6 || (!state.input ? placeholder : "")}`);
-    if (contentWidth < 6) composer.push(...inputRows.map((text6) => place(padCells(text6, contentWidth))), place(foreground(padCells(hint, contentWidth), hintColor, mode)), place(" ".repeat(contentWidth)), place(" ".repeat(contentWidth)));
+    const inputRows = inputLines.slice(-composerRows).map((text7, i) => `${i ? "  " : "> "}${text7 || (!state.input ? placeholder : "")}`);
+    if (contentWidth < 6) composer.push(...inputRows.map((text7) => place(padCells(text7, contentWidth))), place(foreground(padCells(hint, contentWidth), hintColor, mode)), place(" ".repeat(contentWidth)), place(" ".repeat(contentWidth)));
     else {
       const edge = (left, right) => place(foreground(left + line.repeat(contentWidth - 2) + right, "#6b6b6b", mode));
-      const inputRow = (text6, color) => place(foreground(vertical, "#6b6b6b", mode) + " " + foreground(padCells(text6, contentWidth - 4), color ?? "#e6e6e6", mode) + " " + foreground(vertical, "#6b6b6b", mode));
-      composer.push(edge(ascii ? "+" : "\u256D", ascii ? "+" : "\u256E"), ...inputRows.map((text6) => inputRow(text6)), inputRow(hint, hintColor), edge(ascii ? "+" : "\u2570", ascii ? "+" : "\u256F"));
+      const inputRow = (text7, color) => place(foreground(vertical, "#6b6b6b", mode) + " " + foreground(padCells(text7, contentWidth - 4), color ?? "#e6e6e6", mode) + " " + foreground(vertical, "#6b6b6b", mode));
+      composer.push(edge(ascii ? "+" : "\u256D", ascii ? "+" : "\u256E"), ...inputRows.map((text7) => inputRow(text7)), inputRow(hint, hintColor), edge(ascii ? "+" : "\u2570", ascii ? "+" : "\u256F"));
     }
   }
   const frame = [
@@ -87894,8 +88293,8 @@ function renderCardCarousel(cards, width, selectedIndex, focused) {
     return { text: spans.map((span) => span.text).join(""), spans };
   });
 }
-function centeredCarouselText(text6, width) {
-  const value = truncateCells(text6, width);
+function centeredCarouselText(text7, width) {
+  const value = truncateCells(text7, width);
   return " ".repeat(Math.max(0, Math.floor((width - cells(value)) / 2))) + value;
 }
 
@@ -88175,7 +88574,7 @@ function homeHeader(state, width, height) {
   const title = inspiration?.feature?.title || inspiration?.title || "Daily inspiration";
   const banner = [centered2(`DAILY INSPIRATION  ${state.focus === "inspiration" ? "\u2039  Enter open  \u203A" : "\u2039  Ctrl+O explore  \u203A"}`, width), "", ...parts.map((line) => centered2(line, width)), centered2(title, width)];
   while (banner.length < rows2) banner.push("");
-  banner.forEach((text6) => result.push({ text: text6, background: gradient.start }));
+  banner.forEach((text7) => result.push({ text: text7, background: gradient.start }));
   result.push("", { text: centered2(state.workspace === "apps" ? prompts.apps : state.username ? `Hey ${state.username}!` : "Hey there!", width), bold: true });
   if (state.workspace !== "chats" || !homeChatItems(state).length) result.push({ text: centered2(state.workspace === "apps" ? "Use your apps directly and return to saved results." : prompts[state.workspace], width), color: "#cfcfcf" });
   result.push("");
@@ -88397,7 +88796,15 @@ function parseApp(value, idHint = "") {
       }];
     }),
     focusModes: rows(value.focus_modes).map((entry) => ({ id: string2(entry.id), name: string2(entry.name), description: string2(entry.description) })),
-    settingsMemories: rows(value.settings_and_memories).map((entry) => ({ id: string2(entry.id), name: string2(entry.name), description: string2(entry.description) }))
+    settingsMemories: [
+      ...rows(value.settings_and_memories).map((entry) => ({ id: string2(entry.id), name: string2(entry.name), description: string2(entry.description) })),
+      ...rows(value.memories).map((entry) => ({
+        id: string2(entry.id),
+        name: string2(entry.title),
+        description: `App-provided \xB7 Read-only \xB7 Loads automatically when relevant. ${string2(entry.description)}`,
+        body: string2(entry.body)
+      }))
+    ]
   };
 }
 async function loadTuiApps(client2) {
@@ -88482,7 +88889,7 @@ function renderTuiAppIdentity(app, width) {
 }
 function renderTuiAppTabs(tab, width) {
   const tabs = ["skills", "focus_modes", "settings_memories", "embeds", "workflows"];
-  const labels = { skills: "Skills", focus_modes: "Focus modes", settings_memories: "Settings & memories", embeds: "Embeds", workflows: "Workflows" };
+  const labels = { skills: "Skills", focus_modes: "Focus modes", settings_memories: "Memories", embeds: "Embeds", workflows: "Workflows" };
   return outlinedTabs(tabs, labels, tab, width);
 }
 function renderTuiApp(app, options) {
@@ -88504,9 +88911,10 @@ function renderTuiApp(app, options) {
     if (!items.length) lines.push("Nothing in this section.");
     for (const item of items) {
       lines.push(truncateCells(`${item.id === options.selectedId ? ">" : " "} ${item.name}`, width));
-      if (item.description) lines.push(truncateCells(`  ${oneLine2(item.description)}`, width));
+      if (item.description) lines.push(...textLines(`  ${oneLine2(item.description)}`, width));
+      if ("body" in item && item.body && item.id === options.selectedId) lines.push(...textLines(item.body, width));
     }
-    lines.push("", "Manage these settings in the web app.");
+    lines.push("", "Manage private Memories in the web app.");
   } else if (options.tab === "embeds") lines.push("Saved results load from the encrypted Apps history. Use Enter to inspect a result.");
   else lines.push("Saved workflows for this app load from Workflows. Open a workflow there to inspect it.");
   return lines;
@@ -88864,8 +89272,8 @@ function readableFields(value, width) {
       lines.push(`${indent}${label3}`);
       for (const [key, entry] of Object.entries(item)) visit2(readableLabel(key), entry, `${indent}  `);
     } else {
-      const text6 = item === null ? "None" : typeof item === "boolean" ? item ? "Yes" : "No" : String(item);
-      const [first = "", ...rest] = text6.split("\n");
+      const text7 = item === null ? "None" : typeof item === "boolean" ? item ? "Yes" : "No" : String(item);
+      const [first = "", ...rest] = text7.split("\n");
       lines.push(`${indent}${label3} ${first}`);
       lines.push(...rest.map((line) => `${indent}  ${line}`));
     }
@@ -89065,7 +89473,7 @@ function renderTuiFrame(state, width, height, options = {}) {
   return renderWorkspaceFrame(state, width, height, renderBody(state, bodyWidth, height), { ...options, stickyRows, headerRows: state.screen === "chat" || state.screen === "example" ? renderChatHeader(state, bodyWidth).length : void 0 });
 }
 function coloredHero(lines, rows2, gradient = PRIMARY_GRADIENT) {
-  return lines.map((text6, index) => index < rows2 ? { text: text6, background: gradient.start } : text6);
+  return lines.map((text7, index) => index < rows2 ? { text: text7, background: gradient.start } : text7);
 }
 var blueHero = (lines, rows2) => coloredHero(lines, rows2);
 function homeCards(lines, width, gradients) {
@@ -89077,7 +89485,7 @@ function homeCards(lines, width, gradients) {
   }
   return groups.filter((group) => group.length).flatMap((group, index) => {
     const cardWidth = Math.min(width, Math.max(...group.map(cells))), inset = Math.max(0, Math.floor((width - cardWidth) / 2));
-    return [...group.map((text6) => ({ text: text6, background: (gradients[index] ?? PRIMARY_GRADIENT).start, inset })), ""];
+    return [...group.map((text7) => ({ text: text7, background: (gradients[index] ?? PRIMARY_GRADIENT).start, inset })), ""];
   });
 }
 function renderBody(state, width, height) {
@@ -89412,9 +89820,9 @@ import { randomUUID as randomUUID19 } from "crypto";
 var AuthoringSaveApprovalRequired = class extends Error {
   digest;
   mutation;
-  constructor(digest3, mutation) {
+  constructor(digest4, mutation) {
     super("Review the generated file, then choose Save to approve this exact write.");
-    this.digest = digest3;
+    this.digest = digest4;
     this.mutation = mutation;
   }
 };
@@ -89431,9 +89839,9 @@ function required(value) {
   return value;
 }
 function authoringReplacementPatch(path2, original, content) {
-  const lines = (text6, prefix) => {
-    if (!text6) return { count: 0, rows: [] };
-    const parts = text6.split("\n");
+  const lines = (text7, prefix) => {
+    if (!text7) return { count: 0, rows: [] };
+    const parts = text7.split("\n");
     const newline = parts.at(-1) === "";
     if (newline) parts.pop();
     const rows2 = parts.map((line) => prefix + line);
@@ -89511,18 +89919,18 @@ async function persistCliProjectAuthoringJob(client2, job, approvedDigest) {
     expected_base: await projectFileContentHash(original),
     patch: authoringReplacementPatch(path2, original, markdown)
   } : { operation: "create_file", operation_id: operationId, path: path2, expected_base: null, content: markdown };
-  const digest3 = await projectFileMutationDigest(projectKey, projectId, chatId, mutation);
+  const digest4 = await projectFileMutationDigest(projectKey, projectId, chatId, mutation);
   let receipt;
   try {
-    receipt = await client2.getProjectFileRevisionReceipt(projectId, embedId, operationId, chatId, digest3, options);
+    receipt = await client2.getProjectFileRevisionReceipt(projectId, embedId, operationId, chatId, digest4, options);
   } catch (error) {
     if (settings.write_mode !== "always_ask" || !error || typeof error !== "object" || !("code" in error) || error.code !== "PROJECT_WRITE_APPROVAL_REQUIRED" || !("status" in error) || error.status !== 409) throw error;
     receipt = null;
   }
   if (receipt?.status !== "committed" && settings.write_mode === "always_ask") {
-    if (approvedDigest !== digest3) throw new AuthoringSaveApprovalRequired(digest3, mutation);
+    if (approvedDigest !== digest4) throw new AuthoringSaveApprovalRequired(digest4, mutation);
     await fresh();
-    await client2.approveProjectWrite(projectId, { chat_id: chatId, operation_id: operationId, proposal_digest: digest3 }, options);
+    await client2.approveProjectWrite(projectId, { chat_id: chatId, operation_id: operationId, proposal_digest: digest4 }, options);
   }
   const focusMetadata = {
     ...metadata,
@@ -89538,8 +89946,8 @@ async function persistCliProjectAuthoringJob(client2, job, approvedDigest) {
   for (const row of detail.items) {
     if (!["embed", "upload"].includes(row.item_type) || row.deleted_target_state) continue;
     const target = await decryptWithAesGcmCombined(row.target_id_encrypted, projectKey);
-    const text6 = row.encrypted_metadata ? await decryptWithAesGcmCombined(row.encrypted_metadata, projectKey) : null;
-    const meta = text6 ? record6(JSON.parse(text6)) : {};
+    const text7 = row.encrypted_metadata ? await decryptWithAesGcmCombined(row.encrypted_metadata, projectKey) : null;
+    const meta = text7 ? record6(JSON.parse(text7)) : {};
     const filePath = meta.path ?? meta.file_path ?? meta.filename ?? meta.display_path;
     if (target && typeof filePath === "string") files.push({ embedId: target, path: filePath });
   }
@@ -89768,8 +90176,8 @@ function watchTuiAuthoring(context, event, jobId) {
   control.watching = true;
   void (async () => {
     for (let attempt = 0; attempt < 40 && context.state.chatContextAuthoringControls[event.event_id] === control; attempt++) {
-      await new Promise((resolve17) => {
-        const timer = setTimeout(resolve17, 3e3);
+      await new Promise((resolve18) => {
+        const timer = setTimeout(resolve18, 3e3);
         timer.unref();
       });
       if (context.state.chatContextAuthoringControls[event.event_id] !== control) return;
@@ -89822,16 +90230,16 @@ async function openTuiAuthoringExecutor(context, event) {
     ws,
     chatId: event.chat_id,
     chatKey: key,
-    requestApproval: (request) => new Promise((resolve17) => {
+    requestApproval: (request) => new Promise((resolve18) => {
       if (approval) {
-        resolve17(false);
+        resolve18(false);
         return;
       }
-      approval = resolve17;
+      approval = resolve18;
       control.approve = () => {
         approval = void 0;
         control.approve = void 0;
-        resolve17(true);
+        resolve18(true);
       };
       const entry = context.state.chatContextAuthoringJobs[event.event_id];
       if (entry) entry.status = "needs_write_approval";
@@ -90220,8 +90628,8 @@ async function handleWorkspaceCommand(context, command) {
         if (request !== state.routeVersion) return true;
         state.detailTitle = embed.textPreview || (embed.appId ? `${embed.appId}${embed.skillId ? `/${embed.skillId}` : ""}` : embed.type?.replaceAll("_", " ")) || "Embed";
         const body = embed.content;
-        const text6 = ["code", "markdown", "content", "text", "transcript"].map((key) => body?.[key]).find((value) => typeof value === "string");
-        state.detailLines = typeof text6 === "string" ? text6.split("\n") : formatEmbedPreviewLines(embed, 100);
+        const text7 = ["code", "markdown", "content", "text", "transcript"].map((key) => body?.[key]).find((value) => typeof value === "string");
+        state.detailLines = typeof text7 === "string" ? text7.split("\n") : formatEmbedPreviewLines(embed, 100);
       }
       render();
       return true;
@@ -90720,10 +91128,10 @@ async function handleWorkspaceKey(context, chunk, key) {
             state.filter = "";
           }
         } else if (file) {
-          const text6 = await readTuiProjectFile(context.client, project, file);
+          const text7 = await readTuiProjectFile(context.client, project, file);
           if (request === state.routeVersion && state.activeProject?.id === project.id) {
             state.detailTitle = file.name;
-            state.detailLines = text6.split("\n");
+            state.detailLines = text7.split("\n");
             state.screen = "embed";
             state.scrollOffset = 0;
           }
@@ -90808,9 +91216,9 @@ async function handleWorkspaceKey(context, chunk, key) {
       return true;
     }
     if (key.name === "return" && state.screen === "chats" && state.input.trim()) {
-      const text6 = state.input.trim();
+      const text7 = state.input.trim();
       newChat(state);
-      await context.send(text6);
+      await context.send(text7);
       return true;
     }
     const cursor = state.inputCursor ?? state.input.length;
@@ -90852,9 +91260,9 @@ async function handleWorkspaceKey(context, chunk, key) {
       return true;
     }
     if (key.name === "paste" || !key.ctrl && !key.meta && chunk && chunk >= " ") {
-      const text6 = terminalText(chunk);
-      state.input = state.input.slice(0, cursor) + text6 + state.input.slice(cursor);
-      state.inputCursor = cursor + text6.length;
+      const text7 = terminalText(chunk);
+      state.input = state.input.slice(0, cursor) + text7 + state.input.slice(cursor);
+      state.inputCursor = cursor + text7.length;
       rememberDraft(state);
       render();
       return true;
@@ -91055,8 +91463,8 @@ async function runTui(client2, terminal = new TuiTerminal()) {
     }).catch(() => {
     });
   }
-  return new Promise((resolve17) => {
-    resolveResult = resolve17;
+  return new Promise((resolve18) => {
+    resolveResult = resolve18;
   });
 }
 async function handleKey(params) {
@@ -91235,13 +91643,13 @@ async function handleEnter(params) {
     render();
     return;
   }
-  const text6 = state.input.trim();
-  if (!text6) return;
-  if (text6.startsWith("/")) {
-    await handleCommand({ command: text6, state, client: client2, terminal, render, finish });
+  const text7 = state.input.trim();
+  if (!text7) return;
+  if (text7.startsWith("/")) {
+    await handleCommand({ command: text7, state, client: client2, terminal, render, finish });
     return;
   }
-  await sendTuiMessage({ message: text6, state, client: client2, render });
+  await sendTuiMessage({ message: text7, state, client: client2, render });
 }
 async function handleCommand(params) {
   const { command, state, client: client2, terminal, render, finish } = params;
@@ -91894,17 +92302,17 @@ function clamp(value, min, max) {
 import { createHash as createHash21 } from "crypto";
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync13, readFileSync as readFileSync14, readdirSync as readdirSync7 } from "fs";
-import { isAbsolute as isAbsolute3, join as join17, resolve as resolve9 } from "path";
+import { isAbsolute as isAbsolute4, join as join17, resolve as resolve10 } from "path";
 import lockfile4 from "proper-lockfile";
 function startCodexTaskBridges(roots, snapshots, stateRoot, notice) {
   const configPath = join17(stateRoot, "codex-adapter.json");
   const children = [];
   if (existsSync13(configPath)) {
     const config = JSON.parse(readFileSync14(configPath, "utf8"));
-    for (const root of new Set(roots.map((path2) => resolve9(path2)))) {
+    for (const root of new Set(roots.map((path2) => resolve10(path2)))) {
       const entry = config.repositories?.[root];
-      if (!entry?.enabled || !entry.events_enabled || !entry.runtime || !isAbsolute3(entry.runtime) || !existsSync13(entry.runtime)) continue;
-      if (!entry.snapshots?.length || !entry.snapshots.every((path2) => snapshots.includes(resolve9(path2)))) continue;
+      if (!entry?.enabled || !entry.events_enabled || !entry.runtime || !isAbsolute4(entry.runtime) || !existsSync13(entry.runtime)) continue;
+      if (!entry.snapshots?.length || !entry.snapshots.every((path2) => snapshots.includes(resolve10(path2)))) continue;
       const child = spawn3("python3", [entry.runtime, "serve", "--repository", root], {
         cwd: root,
         env: { ...process.env, OPENMATES_STATE_DIR: stateRoot },
@@ -92086,11 +92494,11 @@ import {
 } from "fs";
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash28 } from "crypto";
-import { extname as extname4, join as join25, resolve as resolve15, relative as relative11 } from "path";
+import { extname as extname4, join as join25, resolve as resolve16, relative as relative11 } from "path";
 
 // src/projectSourceRootPolicy.ts
 import { existsSync as existsSync15, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
-import { basename as basename4, dirname as dirname11, relative as relative3, resolve as resolve10 } from "path";
+import { basename as basename4, dirname as dirname11, relative as relative3, resolve as resolve11 } from "path";
 function canonicalProjectSourceRoot(sourceRoot, options = {}) {
   const root = realpathSync2(sourceRoot);
   if (!statSync2(root).isDirectory()) throw new Error("Project source root is not a directory");
@@ -92104,15 +92512,15 @@ function canonicalOpenMatesStateDirectory(stateDirectory = resolveStateDir()) {
   return canonicalizePotentialPath(stateDirectory);
 }
 function canonicalizePotentialPath(value) {
-  let existing = resolve10(value);
+  let existing = resolve11(value);
   const suffix = [];
   while (!existsSync15(existing)) {
     const parent = dirname11(existing);
-    if (parent === existing) return resolve10(value);
+    if (parent === existing) return resolve11(value);
     suffix.unshift(basename4(existing));
     existing = parent;
   }
-  return resolve10(realpathSync2(existing), ...suffix);
+  return resolve11(realpathSync2(existing), ...suffix);
 }
 function isEqualOrInside(parent, candidate) {
   const path2 = relative3(parent, candidate);
@@ -92140,7 +92548,7 @@ import {
   unlinkSync,
   writeSync
 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute4, join as join19, relative as relative4, resolve as resolve11 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute5, join as join19, relative as relative4, resolve as resolve12 } from "path";
 var DEFAULT_MAX_IGNORE_FILES = 128;
 var DEFAULT_MAX_IGNORE_BYTES = 1024 * 1024;
 var MAX_POLICY_ENTRIES = 5e4;
@@ -92187,13 +92595,13 @@ function loadProjectPathPolicy(sourceRoot, options = {}) {
       builtin_private_paths: PROJECT_BUILTIN_PRIVATE_PATHS,
       private_paths: stickyPrivatePaths
     }));
-    const digest3 = sha2562(stableJson2({
+    const digest4 = sha2562(stableJson2({
       private_digest: privateDigest,
       ignore_files: ignoreFiles.map((file) => ({ path: file.path, digest: sha2562(file.content) }))
     }));
     const policy = {
       sourceRoot: root,
-      digest: digest3,
+      digest: digest4,
       privateDigest,
       isIgnored(path2, isDirectory = false) {
         const normalized = normalizeSourceRelativePath(path2);
@@ -92266,7 +92674,7 @@ function collectIgnoreFiles(policyRoot, sourceRoot, limits) {
   for (const directory of chain.reverse()) add(join19(directory, ".gitignore"));
   for (const target of limits.targetPaths) {
     const normalized = target === "." ? "" : normalizeSourceRelativePath(target);
-    const absolute = normalized ? resolve11(sourceRoot, normalized) : sourceRoot;
+    const absolute = normalized ? resolve12(sourceRoot, normalized) : sourceRoot;
     if (!isInside2(sourceRoot, absolute)) throw new Error("Project policy target escapes its source root");
     const targetIsDirectory = existsSync16(absolute) && lstatSync4(absolute).isDirectory();
     let directory = targetIsDirectory ? absolute : dirname12(absolute);
@@ -92306,7 +92714,7 @@ function collectIgnoreFiles(policyRoot, sourceRoot, limits) {
   return files;
 }
 function updateStickyPrivatePaths(sourceRoot, additions, stateDirectory) {
-  const stateRoot = resolve11(stateDirectory, POLICY_STATE_DIRECTORY);
+  const stateRoot = resolve12(stateDirectory, POLICY_STATE_DIRECTORY);
   if (isInside2(sourceRoot, stateRoot) || isInside2(stateRoot, sourceRoot)) {
     throw new Error("Project path policy state must stay outside the source root");
   }
@@ -92380,7 +92788,7 @@ function preparePrivateDirectory(path2) {
   if (!statSync3(path2).isDirectory()) throw new Error("Project path policy state is not a directory");
 }
 function normalizeSourceRelativePath(value) {
-  if (typeof value !== "string" || !value || value.includes("\\") || isAbsolute4(value) || value.split("/").some((part) => !part || part === "." || part === "..") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+  if (typeof value !== "string" || !value || value.includes("\\") || isAbsolute5(value) || value.split("/").some((part) => !part || part === "." || part === "..") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
     throw new ProjectPathPolicyError(`Project path is invalid: ${String(value)}`);
   }
   return value;
@@ -92388,7 +92796,7 @@ function normalizeSourceRelativePath(value) {
 function normalizeRelative(root, target) {
   const result = relative4(root, target).split("\\").join("/");
   if (!result || result === ".") return "";
-  if (result.startsWith("../") || result === ".." || isAbsolute4(result)) throw new Error("Project policy path escapes its root");
+  if (result.startsWith("../") || result === ".." || isAbsolute5(result)) throw new Error("Project policy path escapes its root");
   return result;
 }
 function boundedInteger(value, fallback2, label3) {
@@ -92397,8 +92805,8 @@ function boundedInteger(value, fallback2, label3) {
   return result;
 }
 function isInside2(root, candidate) {
-  const relation = relative4(resolve11(root), resolve11(candidate));
-  return relation === "" || !relation.startsWith("..") && !isAbsolute4(relation);
+  const relation = relative4(resolve12(root), resolve12(candidate));
+  return relation === "" || !relation.startsWith("..") && !isAbsolute5(relation);
 }
 function sha2562(value) {
   return createHash23("sha256").update(value).digest("hex");
@@ -92431,7 +92839,7 @@ import {
   writeFileSync as writeFileSync9
 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
-import { basename as basename5, dirname as dirname13, isAbsolute as isAbsolute5, join as join21, relative as relative5, resolve as resolve12 } from "path";
+import { basename as basename5, dirname as dirname13, isAbsolute as isAbsolute6, join as join21, relative as relative5, resolve as resolve13 } from "path";
 import lockfile6 from "proper-lockfile";
 
 // src/projectFileRisk.ts
@@ -92791,7 +93199,7 @@ function validateMutation(input) {
   return { ...parsed, path: validateRelativePath(parsed.path) };
 }
 function validateRelativePath(value) {
-  if (typeof value !== "string" || value.length === 0 || value.length > 4096 || isAbsolute5(value) || value.includes("\\") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || value.split("/").some((part) => !part || part === "." || part === "..")) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 4096 || isAbsolute6(value) || value.includes("\\") || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || value.split("/").some((part) => !part || part === "." || part === "..")) {
     throw new RemoteFileMutationError("invalid_path", "Project file path must be a strict root-relative POSIX path");
   }
   return value;
@@ -93084,7 +93492,7 @@ function temporaryName() {
 }
 function isInside3(root, candidate) {
   const relation = relative5(root, candidate);
-  return relation === "" || !relation.startsWith("..") && !isAbsolute5(relation) && resolve12(root, relation) === resolve12(candidate);
+  return relation === "" || !relation.startsWith("..") && !isAbsolute6(relation) && resolve13(root, relation) === resolve13(candidate);
 }
 
 // src/remoteFileTransfers.ts
@@ -93361,19 +93769,19 @@ async function executeRemoteFileTransfer(input) {
 
 // src/remoteCommandSource.ts
 import { existsSync as existsSync21, realpathSync as realpathSync10, statSync as statSync9 } from "fs";
-import { basename as basename7, dirname as dirname14, relative as relative10, resolve as resolve14 } from "path";
+import { basename as basename7, dirname as dirname14, relative as relative10, resolve as resolve15 } from "path";
 
 // src/remoteCommandRuntime.ts
 import { createHash as createHash26, randomUUID as randomUUID21 } from "crypto";
 import { spawn as spawn6, spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync19, lstatSync as lstatSync9, readdirSync as readdirSync11, realpathSync as realpathSync7, statSync as statSync6 } from "fs";
-import { isAbsolute as isAbsolute7, join as join22, relative as relative7, resolve as resolve13, sep } from "path";
+import { isAbsolute as isAbsolute8, join as join22, relative as relative7, resolve as resolve14, sep } from "path";
 
 // src/remoteCommandAppArmor.ts
 import { createHash as createHash25 } from "crypto";
 import { spawn as spawn5 } from "child_process";
 import { lstatSync as lstatSync8, readFileSync as readFileSync17, realpathSync as realpathSync6, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute6, relative as relative6 } from "path";
+import { isAbsolute as isAbsolute7, relative as relative6 } from "path";
 var REMOTE_COMMAND_APPARMOR_BROKER = "/usr/libexec/openmates-command-apparmor";
 var REMOTE_COMMAND_APPARMOR_EXEC = "/usr/bin/aa-exec";
 var REMOTE_COMMAND_BWRAP = "/usr/libexec/openmates-bwrap";
@@ -93555,7 +93963,7 @@ function validatePolicyGlob(value, context) {
   return normalized;
 }
 function validateProjectPath(value, context) {
-  if (typeof value !== "string" || !value || Buffer.byteLength(value) > MAX_POLICY_PATH_BYTES || isAbsolute6(value) || value.includes("\\") || value.includes("*") || value.includes("?") || value.split("/").some((part) => !part || part === "." || part === "..") || hasControl2(value)) {
+  if (typeof value !== "string" || !value || Buffer.byteLength(value) > MAX_POLICY_PATH_BYTES || isAbsolute7(value) || value.includes("\\") || value.includes("*") || value.includes("?") || value.split("/").some((part) => !part || part === "." || part === "..") || hasControl2(value)) {
     throw new Error(`Invalid AppArmor ${context} path`);
   }
   return value;
@@ -93578,7 +93986,7 @@ function brokerIdentifier(value, context, pattern) {
 }
 function isInside4(root, candidate) {
   const path2 = relative6(root, candidate);
-  return path2 === "" || !path2.startsWith("..") && !isAbsolute6(path2);
+  return path2 === "" || !path2.startsWith("..") && !isAbsolute7(path2);
 }
 function hasControl2(value) {
   return [...value].some((character) => {
@@ -93831,7 +94239,7 @@ var RemoteCommandRuntime = class {
     }
     if (prepared.sandbox_command) {
       const command = prepared.sandbox_command;
-      if (!isAbsolute7(command.executable) || command.executable.includes("\0") || !Array.isArray(command.args) || command.args.some((argument) => typeof argument !== "string" || argument.includes("\0"))) {
+      if (!isAbsolute8(command.executable) || command.executable.includes("\0") || !Array.isArray(command.args) || command.args.some((argument) => typeof argument !== "string" || argument.includes("\0"))) {
         throw new RemoteCommandError("network_profile_unavailable", "Network transport returned an invalid sandbox bridge command");
       }
     }
@@ -94155,7 +94563,7 @@ function prepareSandboxLaunch(preflight, authority, capability, network, appArmo
     }
   }
   const appArmorEnvironment = appArmor.sandbox_environment;
-  if (!appArmorEnvironment || Object.keys(appArmorEnvironment).length !== 1 || typeof appArmorEnvironment.LD_PRELOAD !== "string" || !isAbsolute7(appArmorEnvironment.LD_PRELOAD) || appArmorEnvironment.LD_PRELOAD.includes("\0")) {
+  if (!appArmorEnvironment || Object.keys(appArmorEnvironment).length !== 1 || typeof appArmorEnvironment.LD_PRELOAD !== "string" || !isAbsolute8(appArmorEnvironment.LD_PRELOAD) || appArmorEnvironment.LD_PRELOAD.includes("\0")) {
     throw new RemoteCommandError("confinement_unavailable", "AppArmor confinement returned an invalid Git config compatibility library");
   }
   const environment = { ...SAFE_ENVIRONMENT, ...networkEnvironment, ...appArmorEnvironment };
@@ -94239,7 +94647,7 @@ function validatePolicy2(policy) {
   if (policy.source_access !== "read_only" && policy.source_access !== "read_write") throw new RemoteCommandError("invalid_request", "Invalid source access");
   if (policy.mode === "background" && policy.source_access !== "read_only") throw new RemoteCommandError("invalid_request", "Background commands must use read-only source access");
   if (!Number.isSafeInteger(policy.deadline_ms) || policy.deadline_ms < MIN_DEADLINE_MS2 || policy.deadline_ms > MAX_DEADLINE_MS2) throw new RemoteCommandError("invalid_request", "Invalid command deadline");
-  if (isAbsolute7(policy.cwd) || policy.cwd.includes("\0") || policy.cwd.split(/[\\/]/).includes("..")) throw new RemoteCommandError("invalid_request", "Command cwd must stay inside the Project");
+  if (isAbsolute8(policy.cwd) || policy.cwd.includes("\0") || policy.cwd.split(/[\\/]/).includes("..")) throw new RemoteCommandError("invalid_request", "Command cwd must stay inside the Project");
   for (const [name, value] of [["writable_profiles", policy.writable_profiles], ["credential_profiles", policy.credential_profiles]]) {
     if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(id))) throw new RemoteCommandError("invalid_request", `Invalid ${name}`);
     assertUnique2(value, name);
@@ -94344,7 +94752,7 @@ function assertCapability(capability) {
 }
 function canonicalDirectory(path2) {
   const canonical = realpath(path2);
-  if (canonical === resolve13("/")) throw new RemoteCommandError("invalid_request", "The host filesystem root cannot be mounted as a command resource");
+  if (canonical === resolve14("/")) throw new RemoteCommandError("invalid_request", "The host filesystem root cannot be mounted as a command resource");
   if (!statSync6(canonical).isDirectory()) throw new RemoteCommandError("invalid_request", `Command resource is not a directory: ${path2}`);
   return canonical;
 }
@@ -94413,7 +94821,7 @@ function assertUnique2(values, context) {
 }
 function isInside5(root, candidate) {
   const path2 = relative7(root, candidate);
-  return path2 === "" || !path2.startsWith("..") && !isAbsolute7(path2);
+  return path2 === "" || !path2.startsWith("..") && !isAbsolute8(path2);
 }
 function truncateUtf8(value, maximum) {
   const bytes2 = Buffer.from(value);
@@ -94443,7 +94851,7 @@ import { lookup as dnsLookup } from "dns/promises";
 import { chmodSync as chmodSync10, mkdtempSync as mkdtempSync4, realpathSync as realpathSync8, rmSync as rmSync9, statSync as statSync7, writeFileSync as writeFileSync10 } from "fs";
 import { isIP as isIP2, createConnection, createServer } from "net";
 import { tmpdir as tmpdir6 } from "os";
-import { isAbsolute as isAbsolute8, join as join23, relative as relative8 } from "path";
+import { isAbsolute as isAbsolute9, join as join23, relative as relative8 } from "path";
 var DEFAULT_BRIDGE_PORT = 43117;
 var MAX_CONNECT_HEADER_BYTES = 8 * 1024;
 var CONNECT_HEADER_TIMEOUT_MS = 1e4;
@@ -94647,7 +95055,7 @@ function createPrivateControlDirectory(preflight, configuredRoots) {
   const roots = configuredRoots ?? [process.env.XDG_RUNTIME_DIR, tmpdir6()].filter((value) => Boolean(value));
   for (const candidate of roots) {
     try {
-      if (!isAbsolute8(candidate) || !statSync7(candidate).isDirectory()) continue;
+      if (!isAbsolute9(candidate) || !statSync7(candidate).isDirectory()) continue;
       const root = realpathSync8(candidate);
       const directory = mkdtempSync4(join23(root, "openmates-command-network-"));
       chmodSync10(directory, 448);
@@ -94684,7 +95092,7 @@ function ipv6Words(address) {
 }
 function isInside6(root, candidate) {
   const path2 = relative8(root, candidate);
-  return path2 === "" || !path2.startsWith("..") && !isAbsolute8(path2);
+  return path2 === "" || !path2.startsWith("..") && !isAbsolute9(path2);
 }
 function listenUnix(server2, path2) {
   return new Promise((resolvePromise, reject) => {
@@ -94708,7 +95116,7 @@ function capabilityError(message) {
 // src/remoteCommandResourceGrants.ts
 import { createHash as createHash27 } from "crypto";
 import { chmodSync as chmodSync11, existsSync as existsSync20, lstatSync as lstatSync10, mkdirSync as mkdirSync17, readFileSync as readFileSync18, realpathSync as realpathSync9, renameSync as renameSync8, statSync as statSync8, writeFileSync as writeFileSync11 } from "fs";
-import { isAbsolute as isAbsolute9, join as join24, relative as relative9 } from "path";
+import { isAbsolute as isAbsolute10, join as join24, relative as relative9 } from "path";
 var STORE_FILE = "remote-command-resource-grants.json";
 var ID = /^[a-z][a-z0-9-]{0,63}$/;
 var ENV = /^[A-Z_][A-Z0-9_]{0,127}$/;
@@ -94721,7 +95129,7 @@ function listRemoteCommandResourceGrants(projectId, sourceId) {
 function enableRemoteCommandWritableGrant(input) {
   const definition = input.permissions.resource_profiles.writable.find((item) => item.id === input.profileId);
   if (!definition) throw new Error(`Unknown writable profile: ${input.profileId}`);
-  if (!isAbsolute9(input.hostPath)) throw new Error("--host-path must be absolute");
+  if (!isAbsolute10(input.hostPath)) throw new Error("--host-path must be absolute");
   const root = realpathSync9(input.projectRoot);
   const hostPath = realpathSync9(input.hostPath);
   if (!statSync8(hostPath).isDirectory()) throw new Error("Writable profile host path must be a directory");
@@ -94834,7 +95242,7 @@ function validateIdentity(projectId, sourceId, profileId) {
 }
 function isInside7(parent, child) {
   const value = relative9(parent, child);
-  return value !== "" && !value.startsWith("..") && !isAbsolute9(value);
+  return value !== "" && !value.startsWith("..") && !isAbsolute10(value);
 }
 function pathsOverlap2(left, right) {
   return left === right || isInside7(left, right) || isInside7(right, left);
@@ -95097,8 +95505,8 @@ var RemoteCommandSourceController = class {
       if (!plaintext) throw new Error("Remote command request authentication failed");
       const portable = parsePortableRequest(plaintext);
       assertPortableBinding(portable, claimed);
-      const digest3 = await remoteCommandPortableRequestDigest(binding.projectKey, portable);
-      if (digest3 !== claimed.request_digest) throw new Error("Remote command request HMAC mismatch");
+      const digest4 = await remoteCommandPortableRequestDigest(binding.projectKey, portable);
+      if (digest4 !== claimed.request_digest) throw new Error("Remote command request HMAC mismatch");
       state.portable = portable;
       const request = await this.#buildRuntimeRequest(binding, portable.policy, portable.execution_id);
       const preflight = createRemoteCommandPreflight(request);
@@ -95493,7 +95901,7 @@ function validateSummary(value) {
     chat_id: identifier4(item.chat_id, "chat_id"),
     project_id: identifier4(item.project_id, "project_id"),
     source_id: identifier4(item.source_id, "source_id"),
-    state: text5(item.state, "state"),
+    state: text6(item.state, "state"),
     last_sequence: integer3(item.last_sequence ?? -1, "last_sequence", -1),
     lease_expires_at: integer3(item.lease_expires_at ?? 0, "lease_expires_at", 0)
   };
@@ -95509,12 +95917,12 @@ function validateClaimedRequest(value, summary, binding, sourceSessionId) {
     chat_id: identifier4(item.chat_id, "chat_id"),
     project_id: identifier4(item.project_id, "project_id"),
     source_id: identifier4(item.source_id, "source_id"),
-    state: text5(item.state, "state"),
-    encrypted_request: text5(item.encrypted_request, "encrypted_request"),
-    request_digest: text5(item.request_digest, "request_digest"),
+    state: text6(item.state, "state"),
+    encrypted_request: text6(item.encrypted_request, "encrypted_request"),
+    request_digest: text6(item.request_digest, "request_digest"),
     approval,
     key_epoch: integer3(item.key_epoch, "key_epoch", 1),
-    lease_token: text5(item.lease_token, "lease_token"),
+    lease_token: text6(item.lease_token, "lease_token"),
     lease_generation: integer3(item.lease_generation, "lease_generation", 1),
     lease_expires_at: integer3(item.lease_expires_at, "lease_expires_at", 1),
     last_sequence: integer3(item.last_sequence ?? -1, "last_sequence", -1),
@@ -95527,7 +95935,7 @@ function validateLeaseResponse(value, executionId) {
   return {
     ...item,
     execution_id: executionId,
-    lease_token: text5(item.lease_token, "lease_token"),
+    lease_token: text6(item.lease_token, "lease_token"),
     lease_generation: integer3(item.lease_generation, "lease_generation", 1),
     lease_expires_at: integer3(item.lease_expires_at, "lease_expires_at", 1),
     last_sequence: integer3(item.last_sequence ?? -1, "last_sequence", -1),
@@ -95571,12 +95979,12 @@ function parsePolicy(value) {
   if (!Array.isArray(policy.credential_profiles) || policy.credential_profiles.some((item) => typeof item !== "string")) throw new Error("Invalid credential profiles");
   return {
     argv: [...policy.argv],
-    cwd: text5(policy.cwd, "cwd"),
+    cwd: text6(policy.cwd, "cwd"),
     mode: oneOf3(policy.mode, ["foreground", "background"], "mode"),
     source_access: oneOf3(policy.source_access, ["read_only", "read_write"], "source_access"),
     deadline_ms: integer3(policy.deadline_ms, "deadline_ms", 100),
     writable_profiles: [...policy.writable_profiles],
-    network_profile: policy.network_profile === null ? null : text5(policy.network_profile, "network_profile"),
+    network_profile: policy.network_profile === null ? null : text6(policy.network_profile, "network_profile"),
     credential_profiles: [...policy.credential_profiles]
   };
 }
@@ -95606,7 +96014,7 @@ function validateTrustedGrants(value) {
   const result = {
     writable_targets: value.writable_targets.map((item) => ({
       profile_id: identifier4(item.profile_id, "writable profile"),
-      host_path: text5(item.host_path, "writable host path")
+      host_path: text6(item.host_path, "writable host path")
     })),
     network_profiles: value.network_profiles.map((item) => {
       if (!Array.isArray(item.destinations) || item.destinations.some((destination) => typeof destination !== "string")) {
@@ -95614,7 +96022,7 @@ function validateTrustedGrants(value) {
       }
       return {
         profile_id: identifier4(item.profile_id, "network profile"),
-        destinations: item.destinations.map((destination) => text5(destination, "network destination"))
+        destinations: item.destinations.map((destination) => text6(destination, "network destination"))
       };
     }),
     credential_profiles: value.credential_profiles.map((item) => {
@@ -95675,14 +96083,14 @@ function canonicalStateDirectory() {
   const path2 = resolveStateDir();
   if (existsSync21(path2)) return realpathSync10(path2);
   const tail = [];
-  let parent = resolve14(path2);
+  let parent = resolve15(path2);
   while (!existsSync21(parent)) {
     const next = dirname14(parent);
     if (next === parent) break;
     tail.unshift(basename7(parent));
     parent = next;
   }
-  return resolve14(realpathSync10(parent), ...tail);
+  return resolve15(realpathSync10(parent), ...tail);
 }
 function pathsOverlap3(left, right) {
   return left === right || isInsideDirectory(left, right) || isInsideDirectory(right, left);
@@ -95705,7 +96113,7 @@ function identifier4(value, context) {
   if (typeof value !== "string" || !IDENTIFIER3.test(value)) throw new Error(`Invalid ${context}`);
   return value;
 }
-function text5(value, context) {
+function text6(value, context) {
   if (typeof value !== "string" || !value || value.length > 1048576 || value.includes("\0")) throw new Error(`Invalid ${context}`);
   return value;
 }
@@ -95775,7 +96183,7 @@ function resolveRemoteAccessRoots(pathFlag, cwd = process.cwd()) {
   }
   const roots = [];
   for (const value of requested) {
-    const candidate = resolve15(cwd, value);
+    const candidate = resolve16(cwd, value);
     if (!existsSync22(candidate) || !statSync10(candidate).isDirectory()) {
       throw new Error(`Remote source path does not exist or is not a directory: ${candidate}`);
     }
@@ -96547,7 +96955,7 @@ function resolveRemoteCachePath(sourceId, homeDirectory) {
 }
 function startRemoteAccessSource(input) {
   assertSafeSourceId(input.sourceId);
-  const requestedRootPath = resolve15(input.rootPath);
+  const requestedRootPath = resolve16(input.rootPath);
   if (!existsSync22(requestedRootPath) || !statSync10(requestedRootPath).isDirectory()) {
     throw new Error(`Remote source path does not exist or is not a directory: ${requestedRootPath}`);
   }
@@ -97067,9 +97475,9 @@ function minimalRgEnvironment() {
   return env;
 }
 function isPathInsideRoot(sourceRoot, relativePath2) {
-  const resolvedPath = resolve15(sourceRoot, relativePath2);
+  const resolvedPath = resolve16(sourceRoot, relativePath2);
   const relation = relative11(sourceRoot, resolvedPath);
-  return relation === "" || !relation.startsWith("..") && !resolve15(relation).startsWith("/..");
+  return relation === "" || !relation.startsWith("..") && !resolve16(relation).startsWith("/..");
 }
 function isBinaryPath(path2) {
   const lowerPath = path2.toLowerCase();
@@ -97108,7 +97516,7 @@ function hasControlCharacters3(value) {
 }
 function resolveApprovedPath(sourceRoot, relativePath2) {
   if (!relativePath2 || relativePath2.includes("\0")) throw new Error("Remote source path is invalid");
-  const lexical = resolve15(sourceRoot, relativePath2);
+  const lexical = resolve16(sourceRoot, relativePath2);
   assertInsideRoot(sourceRoot, lexical);
   const relation = relative11(sourceRoot, lexical);
   let current = sourceRoot;
@@ -97122,7 +97530,7 @@ function resolveApprovedPath(sourceRoot, relativePath2) {
 }
 function assertInsideRoot(sourceRoot, path2) {
   const relation = relative11(sourceRoot, path2);
-  if (relation.startsWith("..") || resolve15(sourceRoot, relation) !== resolve15(path2)) {
+  if (relation.startsWith("..") || resolve16(sourceRoot, relation) !== resolve16(path2)) {
     throw new Error("Remote source path escapes the approved source root");
   }
 }
@@ -97250,10 +97658,10 @@ async function ensureRemoteCommandSetup(options, dependencies = {}) {
   return { installed: true, capability: installed };
 }
 function inheritedInstaller(executable, args) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const child = spawn8(executable, args, { stdio: "inherit" });
     child.once("error", reject);
-    child.once("close", (code, signal) => resolve17({ code, signal }));
+    child.once("close", (code, signal) => resolve18({ code, signal }));
   });
 }
 
@@ -97635,7 +98043,7 @@ import { execFileSync as execFileSync5 } from "child_process";
 import { createSign, randomUUID as randomUUID22 } from "crypto";
 import { chmodSync as chmodSync13, existsSync as existsSync23, mkdirSync as mkdirSync21, readFileSync as readFileSync21 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join27, resolve as resolve16 } from "path";
+import { join as join27, resolve as resolve17 } from "path";
 var REVOLUT_BUSINESS_CERTIFICATE_DOCS_URL = "https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request#generate-a-private-and-a-public-certificate";
 var REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI = "https://app.dev.openmates.org/oauth/revolut-business/callback";
 var REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI = "https://openmates.org/oauth/revolut-business/callback";
@@ -97716,7 +98124,7 @@ function generateRevolutBusinessClientAssertion(options) {
 }
 function generateRevolutBusinessCertificate(options = {}) {
   const environment = options.environment ?? "sandbox";
-  const outputDir = resolve16(options.outputDir ?? defaultRevolutBusinessCertificateDir(environment));
+  const outputDir = resolve17(options.outputDir ?? defaultRevolutBusinessCertificateDir(environment));
   const title = (options.title ?? REVOLUT_BUSINESS_DEFAULT_CERTIFICATE_TITLE).trim();
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   if (!title) throw new Error("Revolut certificate title must not be empty.");
@@ -98009,7 +98417,7 @@ async function main() {
     return;
   }
   if (command === "update" || command === "upgrade") {
-    handleSelfUpdate(command, parsed.flags);
+    await handleSelfUpdate(command, parsed.flags);
     return;
   }
   if (command === "login") {
@@ -98223,7 +98631,15 @@ function handleSupport(flags) {
   }
   console.log(renderSupportInfo());
 }
-function handleSelfUpdate(command, flags) {
+async function handleSelfUpdate(command, flags) {
+  if (flags["caddy-config"] === true) throw new Error("Provide --caddy-config <file>.");
+  const reportCaddy = async () => {
+    const caddy = await updateCaddyAfterCliUpgrade(flags);
+    if (caddy) {
+      console.log(`Caddy: ${caddy.status}`);
+      if ("retryCommand" in caddy) console.log(`Run: ${caddy.retryCommand}`);
+    }
+  };
   let plan = buildSelfUpdatePlan(flags);
   const status = checkSelfUpdateStatus(plan);
   if (status.checkError) throw new Error(`Update check failed: ${status.checkError}`);
@@ -98234,6 +98650,7 @@ function handleSelfUpdate(command, flags) {
   if (flags.json === true) {
     if (!plan.dryRun && shouldInstall) runSelfUpdate(plan, { verbose: flags.verbose === true });
     persistSelfUpdateChannel(plan);
+    const caddy = await updateCaddyAfterCliUpgrade(flags);
     printJson2({
       command,
       channel: plan.channel,
@@ -98245,7 +98662,8 @@ function handleSelfUpdate(command, flags) {
       package_manager: plan.packageManager,
       package: plan.packageSpec,
       run: [plan.command, ...plan.args],
-      dry_run: plan.dryRun
+      dry_run: plan.dryRun,
+      ...caddy ? { caddy } : {}
     });
     return;
   }
@@ -98263,22 +98681,26 @@ function handleSelfUpdate(command, flags) {
   if (plan.dryRun) {
     if (status.updateAvailable === false) {
       console.log("OpenMates CLI is already up to date.");
+      await reportCaddy();
       return;
     }
     console.log(`Would run: ${[plan.command, ...plan.args].join(" ")}`);
+    await reportCaddy();
     return;
   }
   if (status.updateAvailable === false) {
     persistSelfUpdateChannel(plan);
     console.log("OpenMates CLI is already up to date.");
+    await reportCaddy();
     return;
   }
   console.log(`Updating OpenMates CLI with ${plan.packageManager}...`);
   runSelfUpdate(plan, { verbose: flags.verbose === true });
   persistSelfUpdateChannel(plan);
   console.log(`Installed OpenMates CLI ${status.latestVersion ?? plan.target}.`);
+  await reportCaddy();
   console.log("");
-  console.log("OpenMates is up to date.");
+  console.log("OpenMates CLI is up to date.");
 }
 function handleCliVersion(flags) {
   const planFlags = { ...flags, "dry-run": true };
@@ -99715,10 +100137,10 @@ async function handlePlans(client2, subcommand, rest, flags, redactor) {
       else console.log(`Plan success criterion updated: ${updated.criterion_id}`);
       return;
     }
-    const text6 = requiredStringFlag(flags.text ?? rest.slice(2).join(" "), "--text <criterion>");
+    const text7 = requiredStringFlag(flags.text ?? rest.slice(2).join(" "), "--text <criterion>");
     const criterion = await buildCreatePlanCriterionInput(plan, masterKey, {
       criterionId: typeof flags.id === "string" ? flags.id : void 0,
-      text: text6,
+      text: text7,
       type: typeof flags.type === "string" ? flags.type : void 0,
       status: typeof flags.status === "string" ? flags.status : void 0,
       required: flags.required === true ? true : flags.optional === true ? false : void 0,
@@ -101891,11 +102313,11 @@ async function handleIdeaBucket(client2, subcommand, rest, flags) {
     return;
   }
   if (subcommand === "add") {
-    const text6 = rest.join(" ").trim();
-    if (!text6) throw new Error("Missing IdeaBucket text for add.");
+    const text7 = rest.join(" ").trim();
+    if (!text7) throw new Error("Missing IdeaBucket text for add.");
     const scheduledSendAt = typeof flags["scheduled-at"] === "string" ? parseUnixSecondsFlag(flags["scheduled-at"], "--scheduled-at") : void 0;
     printJson2(await client2.addIdeaBucketText({
-      text: text6,
+      text: text7,
       chatId: typeof flags.chat === "string" ? flags.chat : void 0,
       bucketId: typeof flags.bucket === "string" ? flags.bucket : void 0,
       scheduledSendAt,
@@ -101989,11 +102411,11 @@ function renderRemoteCommandEvent(event) {
   if (event.event_kind === "output") {
     const raw = typeof event.payload.text === "string" ? event.payload.text : "";
     const limit = 24e3;
-    const text6 = escapeTerminalControls(raw.slice(0, limit));
+    const text7 = escapeTerminalControls(raw.slice(0, limit));
     const omitted = raw.length > limit ? `
 [${raw.length - limit} characters omitted from this display]` : "";
     return `Unreviewed command output (inert) ${identity2}:
-${text6}${omitted}`;
+${text7}${omitted}`;
   }
   if (event.event_kind === "output_truncated") {
     return `Command output was truncated upstream (${identity2}); displayed output does not cover the full process transcript.`;
@@ -102541,10 +102963,10 @@ Run 'openmates chats show ` + chatId + "' to check if suggestions have been save
         input: process.stdin,
         output: process.stdout
       });
-      const answer = await new Promise((resolve17) => {
+      const answer = await new Promise((resolve18) => {
         iface.question(
           `Delete ${resolved.length} chat(s)? This cannot be undone. [y/N] `,
-          resolve17
+          resolve18
         );
       });
       iface.close();
@@ -102672,19 +103094,19 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         if (embed.type === "app_skill_use" && embed.appId === "videos" && (embed.skillId === "get_transcript" || embed.skillId === "get-transcript") && embed.content) {
           const results = embed.content.results ?? embed.content.data ?? [];
           if (Array.isArray(results) && results.length > 0) {
-            let text6 = "";
+            let text7 = "";
             for (const r of results) {
               const meta = r.metadata;
-              if (meta?.title) text6 += `# ${meta.title}
+              if (meta?.title) text7 += `# ${meta.title}
 
 `;
-              if (r.url) text6 += `Source: ${r.url}
+              if (r.url) text7 += `Source: ${r.url}
 
 `;
-              text6 += String(
+              text7 += String(
                 r.transcript ?? r.formatted_transcript ?? r.text ?? r.content ?? ""
               );
-              text6 += "\n\n---\n\n";
+              text7 += "\n\n---\n\n";
             }
             let fname = `${eid.slice(0, 8)}_transcript.md`;
             const firstMeta = results[0]?.metadata;
@@ -102694,7 +103116,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
             transcriptEmbeds.push({
               embedId: eid,
               filename: fname,
-              content: text6
+              content: text7
             });
           }
         }
@@ -103296,7 +103718,7 @@ async function waitForWorkflowRun(client2, workflowId, initialRun, options = {})
       clearTimeout(timer);
     }
   }
-  const pause = () => withinBudget(() => new Promise((resolve17) => setTimeout(resolve17, Math.min(options.pollIntervalMs ?? 2e3, deadline - Date.now()))));
+  const pause = () => withinBudget(() => new Promise((resolve18) => setTimeout(resolve18, Math.min(options.pollIntervalMs ?? 2e3, deadline - Date.now()))));
   const refresh = async () => {
     run = await withinBudget(() => client2.getWorkflowRun(workflowId, runId));
   };
@@ -103377,8 +103799,8 @@ async function syncCliBoundWorkflowFiles(client2, workflow, flags) {
     const contents = await client2.listProjectItems(project.projectId, context);
     for (const item of contents.items.filter((item2) => item2.item_type === "workflow")) {
       if (await decryptOptionalProjectField2(item.target_id_encrypted, project.projectKey) !== workflow.id) continue;
-      const text6 = await decryptOptionalProjectField2(item.encrypted_metadata, project.projectKey);
-      const metadata = text6 ? JSON.parse(text6) : {};
+      const text7 = await decryptOptionalProjectField2(item.encrypted_metadata, project.projectKey);
+      const metadata = text7 ? JSON.parse(text7) : {};
       const binding = metadata.remote_workflow_file;
       if (!binding) continue;
       const source = (await client2.listProjectSources(project.projectId, context)).find((item2) => item2.source_id === binding.source_id);
@@ -103668,10 +104090,10 @@ async function handleWorkflows(client2, subcommand, rest, flags, redactor) {
     return;
   }
   if (subcommand === "input") {
-    const text6 = typeof flags.text === "string" ? flags.text : rest.join(" ").trim();
-    if (!text6) throw new Error('Missing workflow input text. Example: openmates workflows ask "alert me if it rains"');
+    const text7 = typeof flags.text === "string" ? flags.text : rest.join(" ").trim();
+    if (!text7) throw new Error('Missing workflow input text. Example: openmates workflows ask "alert me if it rains"');
     const session = await client2.startWorkflowInput({
-      text: text6,
+      text: text7,
       selectedWorkflowId: typeof flags["workflow-id"] === "string" ? flags["workflow-id"] : void 0,
       selectedProjectId: typeof flags["project-id"] === "string" ? flags["project-id"] : void 0,
       timezone: typeof flags.timezone === "string" ? flags.timezone : Intl.DateTimeFormat().resolvedOptions().timeZone,
@@ -103718,9 +104140,9 @@ async function handleWorkflows(client2, subcommand, rest, flags, redactor) {
   }
   if (subcommand === "input-follow-up") {
     const sessionId = rest[0];
-    const text6 = typeof flags.text === "string" ? flags.text : rest.slice(1).join(" ").trim();
-    if (!sessionId || !text6) throw new Error('Missing session ID or text. Example: openmates workflows input-follow-up <session-id> "make it weekdays only"');
-    const session = await client2.followUpWorkflowInput(sessionId, text6);
+    const text7 = typeof flags.text === "string" ? flags.text : rest.slice(1).join(" ").trim();
+    if (!sessionId || !text7) throw new Error('Missing session ID or text. Example: openmates workflows input-follow-up <session-id> "make it weekdays only"');
+    const session = await client2.followUpWorkflowInput(sessionId, text7);
     if (flags.json === true) {
       printJson2(session);
     } else {
@@ -104904,7 +105326,7 @@ async function handleCodeRun(client2, flags, apiKey) {
   }
 }
 async function streamCodeRunToTerminal(url, jsonMode) {
-  return await new Promise((resolve17, reject) => {
+  return await new Promise((resolve18, reject) => {
     const ws = new WebSocket3(url);
     let lastStatus = {};
     ws.on("message", (data) => {
@@ -104913,17 +105335,17 @@ async function streamCodeRunToTerminal(url, jsonMode) {
         const payload = message.payload ?? {};
         if (message.type === "code_run_event") {
           const kind = String(payload.kind ?? "status");
-          const text6 = String(payload.text ?? "");
+          const text7 = String(payload.text ?? "");
           if (!jsonMode) {
-            if (kind === "stdout") process.stdout.write(text6);
-            else process.stderr.write(text6);
+            if (kind === "stdout") process.stdout.write(text7);
+            else process.stderr.write(text7);
           }
         } else if (message.type === "code_run_update") {
           lastStatus = { ...lastStatus, ...payload };
           const status = String(payload.status ?? "");
           if (["finished", "failed", "timeout", "cancelled"].includes(status)) {
             ws.close();
-            resolve17(lastStatus);
+            resolve18(lastStatus);
           }
         }
       } catch (err) {
@@ -104933,7 +105355,7 @@ async function streamCodeRunToTerminal(url, jsonMode) {
     });
     ws.on("error", () => reject(new Error("Code Run stream failed.")));
     ws.on("close", () => {
-      if (Object.keys(lastStatus).length > 0) resolve17(lastStatus);
+      if (Object.keys(lastStatus).length > 0) resolve18(lastStatus);
     });
   });
 }
@@ -104944,7 +105366,7 @@ async function pollCodeRunStatus(client2, statusPath, apiKey, jsonMode) {
     if (!jsonMode && value) process.stderr.write(`Code Run status: ${value}
 `);
     if (["finished", "failed", "timeout", "cancelled"].includes(value)) return status;
-    await new Promise((resolve17) => setTimeout(resolve17, 1e3));
+    await new Promise((resolve18) => setTimeout(resolve18, 1e3));
   }
 }
 async function suggestAppOrSkill(client2, app, skill, apiKey) {
@@ -105226,7 +105648,7 @@ async function waitForApplicationPreview(client2, started, flags) {
   while (Date.now() < deadline) {
     const status = String(current.status ?? "");
     if (["running", "failed", "timeout", "cancelled", "stopped"].includes(status)) return current;
-    await new Promise((resolve17) => setTimeout(resolve17, 1e3));
+    await new Promise((resolve18) => setTimeout(resolve18, 1e3));
     current = await client2.getApplicationPreviewStatus(started.session_id);
   }
   throw new Error(`Application preview did not reach a terminal or running state within ${timeoutSeconds}s`);
@@ -105831,7 +106253,7 @@ function printMateInfo(mateId, json) {
 async function confirmOrExit(question) {
   const rl = await import("readline");
   const iface = rl.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await new Promise((resolve17) => iface.question(question, resolve17));
+  const answer = await new Promise((resolve18) => iface.question(question, resolve18));
   iface.close();
   if (answer.trim().toLowerCase() !== "y") {
     console.log("Aborted.");
@@ -105841,7 +106263,7 @@ async function confirmOrExit(question) {
 async function promptLine(question) {
   const rl = await import("readline");
   const iface = rl.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await new Promise((resolve17) => iface.question(question, resolve17));
+  const answer = await new Promise((resolve18) => iface.question(question, resolve18));
   iface.close();
   return answer.trim();
 }
@@ -105849,7 +106271,7 @@ async function promptSecret(question) {
   if (!process.stdin.isTTY) {
     return promptLine(question);
   }
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     const stdin4 = process.stdin;
     const wasRaw = stdin4.isRaw;
     let value = "";
@@ -105862,7 +106284,7 @@ async function promptSecret(question) {
         stdin4.off("data", onData);
         stdin4.setRawMode(wasRaw);
         process.stdout.write("\n");
-        resolve17(value);
+        resolve18(value);
         return;
       }
       if (char === "") {
@@ -106302,7 +106724,7 @@ function decodeBase32(input) {
   }
   return Buffer.from(bytes2);
 }
-async function waitForSafeE2ETotpWindow(now = Date.now, sleep4 = (milliseconds) => new Promise((resolve17) => setTimeout(resolve17, milliseconds))) {
+async function waitForSafeE2ETotpWindow(now = Date.now, sleep4 = (milliseconds) => new Promise((resolve18) => setTimeout(resolve18, milliseconds))) {
   const millisecondsRemaining = 3e4 - now() % 3e4;
   if (millisecondsRemaining < 2e3) {
     await sleep4(millisecondsRemaining + 50);
@@ -107389,8 +107811,8 @@ function resolveApiKey(flags) {
 function printJson2(value) {
   console.log(JSON.stringify(value, null, 2));
 }
-function header(text6) {
-  process.stdout.write(`\x1B[1m${text6}\x1B[0m
+function header(text7) {
+  process.stdout.write(`\x1B[1m${text7}\x1B[0m
 `);
 }
 function kv(key, value, keyWidth = 16) {
@@ -108156,15 +108578,15 @@ async function acceptChatTaskProposals(client2, chatId, proposals, fallbackText)
   }
   return accepted;
 }
-function buildTaskProposalFallbackText(text6) {
+function buildTaskProposalFallbackText(text7) {
   const seen = /* @__PURE__ */ new Set();
-  const bulletLines = text6.split("\n").map((line) => line.trim()).filter((line) => /^[-*•]\s+/.test(line)).map((line) => line.replace(/^([-*•]\s*)\[[ xX]\]\s*/, "$1")).filter((line) => {
+  const bulletLines = text7.split("\n").map((line) => line.trim()).filter((line) => /^[-*•]\s+/.test(line)).map((line) => line.replace(/^([-*•]\s*)\[[ xX]\]\s*/, "$1")).filter((line) => {
     const key = line.replace(/^[-*•]\s+/, "").trim().toLowerCase();
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
   });
-  return bulletLines.length > 0 ? bulletLines.join("\n") : text6;
+  return bulletLines.length > 0 ? bulletLines.join("\n") : text7;
 }
 function printIncognitoNoHistoryNotice(json) {
   const message = "Incognito chats are not stored. There is no incognito history to show or clear.";
@@ -108198,8 +108620,8 @@ function renderEmbedFromMeta(embedId, meta) {
   process.stdout.write(`\x1B[2m\u2514\u2500 openmates embeds show ${shortId}\x1B[0m
 `);
 }
-async function renderMessageText(text6, embedRefIndex, client2) {
-  const lines = text6.split("\n");
+async function renderMessageText(text7, embedRefIndex, client2) {
+  const lines = text7.split("\n");
   const outputLines = [];
   for (const line of lines) {
     const blockMatch = line.match(/^\s*\[!?\]\(embed:([^)]+)\)\s*$/);
@@ -108456,6 +108878,12 @@ ${data.description}
     }
     console.log();
   }
+  if (data.memories?.length) {
+    console.log("Memories \xB7 App-provided \xB7 Read-only \xB7 Loaded automatically when relevant");
+    for (const memory of data.memories) console.log(`  ${memory.title} (${memory.id})
+    ${memory.description}`);
+    console.log();
+  }
   const focuses = data.focus_modes ?? [];
   if (focuses.length > 0) {
     process.stdout.write(`\x1B[1mFocus modes\x1B[0m
@@ -108623,8 +109051,8 @@ No example chats are linked to ${label3} yet.`);
     console.log(`All examples: openmates apps examples ${appId}${skillId ? ` ${skillId}` : ""}`);
   }
 }
-function wrapText(text6, width) {
-  const words = text6.split(" ");
+function wrapText(text7, width) {
+  const words = text7.split(" ");
   const lines = [];
   let current = "";
   for (const w of words) {
@@ -109562,6 +109990,10 @@ Options:
   --channel <dev|stable|main>    Save release channel (dev uses npm alpha; stable/main uses latest)
   --allow-downgrade             Explicitly allow installing an older version
   --verbose                     Stream package-manager output during installation
+  --path <installation>         Also update this server's Caddy configuration from its installed release
+  --role <core|upload|preview>   Server role for the Caddy update (default: saved role or core)
+  --caddy-config <file>          Active host Caddyfile; otherwise detect the running service
+  --caddy-profile <name>         Use official-upload for the shared production/development upload host
   --json                        Output the update plan/result as JSON`);
 }
 function printRemoteAccessHelp() {