openpalm 0.2.0 → 0.2.7

package/dist/openpalm.js

@@ -0,0 +1,1847 @@
+#!/usr/bin/env bun
+#!/usr/bin/env bun
+// @bun
+
+// packages/cli/src/commands/install.ts
+import { join as join4 } from "path";
+import { chmod, writeFile, rm } from "fs/promises";
+
+// packages/lib/src/runtime.ts
+import { homedir } from "os";
+import { join } from "path";
+function detectOS() {
+  switch (process.platform) {
+    case "darwin":
+      return "macos";
+    case "linux":
+      return "linux";
+    case "win32":
+      return "windows";
+    default:
+      return "unknown";
+  }
+}
+function detectArch() {
+  switch (process.arch) {
+    case "x64":
+      return "amd64";
+    case "arm64":
+      return "arm64";
+    default:
+      return "amd64";
+  }
+}
+async function detectRuntime(os) {
+  if (os === "macos") {
+    const orbstackSocket = join(homedir(), ".orbstack", "run", "docker.sock");
+    const orbstackExists = await Bun.file(orbstackSocket).exists();
+    const dockerBin2 = await Bun.which("docker");
+    if (orbstackExists && dockerBin2) {
+      return "orbstack";
+    }
+  }
+  const dockerBin = await Bun.which("docker");
+  if (dockerBin) {
+    return "docker";
+  }
+  const podmanBin = await Bun.which("podman");
+  if (podmanBin) {
+    return "podman";
+  }
+  return null;
+}
+function resolveSocketPath(platform, os) {
+  switch (platform) {
+    case "docker":
+      if (os === "windows") {
+        return "//./pipe/docker_engine";
+      }
+      return "/var/run/docker.sock";
+    case "orbstack":
+      try {
+        return join(homedir(), ".orbstack", "run", "docker.sock");
+      } catch {
+        return "/var/run/docker.sock";
+      }
+    case "podman":
+      if (os === "linux") {
+        const uid = process.getuid?.() ?? 1000;
+        return `/run/user/${uid}/podman/podman.sock`;
+      }
+      if (os === "windows") {
+        return "//./pipe/podman-machine-default";
+      }
+      return "/var/run/docker.sock";
+  }
+}
+function resolveComposeBin(platform) {
+  switch (platform) {
+    case "docker":
+    case "orbstack":
+      return { bin: "docker", subcommand: "compose" };
+    case "podman":
+      return { bin: "podman", subcommand: "compose" };
+  }
+}
+function resolveSocketUri(platform, os) {
+  const socketPath = resolveSocketPath(platform, os);
+  if (os === "windows") {
+    return `npipe://${socketPath}`;
+  }
+  return `unix://${socketPath}`;
+}
+function resolveInContainerSocketPath(platform) {
+  if (platform === "podman") {
+    return "/var/run/docker.sock";
+  }
+  return "/var/run/docker.sock";
+}
+async function validateRuntime(bin, subcommand) {
+  try {
+    const proc = Bun.spawn([bin, subcommand, "version"], {
+      stdout: "ignore",
+      stderr: "ignore"
+    });
+    await proc.exited;
+    return proc.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+// packages/lib/src/paths.ts
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { mkdir } from "fs/promises";
+function resolveXDGPaths() {
+  const home = homedir2();
+  const isWindows = process.platform === "win32";
+  const localAppData = isWindows ? Bun.env.LOCALAPPDATA || join2(home, "AppData", "Local") : "";
+  const data = Bun.env.OPENPALM_DATA_HOME || (Bun.env.XDG_DATA_HOME ? join2(Bun.env.XDG_DATA_HOME, "openpalm") : undefined) || (isWindows ? join2(localAppData, "OpenPalm", "data") : join2(home, ".local", "share", "openpalm"));
+  const config = Bun.env.OPENPALM_CONFIG_HOME || (Bun.env.XDG_CONFIG_HOME ? join2(Bun.env.XDG_CONFIG_HOME, "openpalm") : undefined) || (isWindows ? join2(localAppData, "OpenPalm", "config") : join2(home, ".config", "openpalm"));
+  const state = Bun.env.OPENPALM_STATE_HOME || (Bun.env.XDG_STATE_HOME ? join2(Bun.env.XDG_STATE_HOME, "openpalm") : undefined) || (isWindows ? join2(localAppData, "OpenPalm", "state") : join2(home, ".local", "state", "openpalm"));
+  return { data, config, state };
+}
+async function createDirectoryTree(xdg) {
+  const dataDirs = ["postgres", "qdrant", "openmemory", "assistant", "admin"];
+  for (const dir of dataDirs)
+    await mkdir(join2(xdg.data, dir), { recursive: true });
+  await mkdir(xdg.config, { recursive: true });
+  const stateDirs = [
+    "admin",
+    "gateway",
+    "postgres",
+    "qdrant",
+    "openmemory",
+    "openmemory-ui",
+    "assistant",
+    "rendered",
+    "rendered/caddy",
+    "rendered/caddy/snippets",
+    "automations",
+    "caddy/config",
+    "caddy/data",
+    "logs",
+    "tmp"
+  ];
+  for (const dir of stateDirs)
+    await mkdir(join2(xdg.state, dir), { recursive: true });
+  await mkdir(resolveWorkHome(), { recursive: true });
+}
+function resolveWorkHome() {
+  return Bun.env.OPENPALM_WORK_HOME || join2(homedir2(), "openpalm");
+}
+
+// packages/lib/src/env.ts
+async function readEnvFile(path) {
+  const file = Bun.file(path);
+  const exists = await file.exists();
+  if (!exists) {
+    return {};
+  }
+  const content = await file.text();
+  const lines = content.split(`
+`);
+  const env = {};
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) {
+      continue;
+    }
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) {
+      continue;
+    }
+    const key = trimmed.substring(0, eqIndex).trim();
+    let value = trimmed.substring(eqIndex + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    env[key] = value;
+  }
+  return env;
+}
+async function upsertEnvVar(path, key, value) {
+  const file = Bun.file(path);
+  const exists = await file.exists();
+  if (!exists) {
+    await Bun.write(path, `${key}=${value}
+`);
+    return;
+  }
+  const content = await file.text();
+  const lines = content.split(`
+`);
+  let found = false;
+  const newLines = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith(`${key}=`)) {
+      newLines.push(`${key}=${value}`);
+      found = true;
+    } else {
+      newLines.push(line);
+    }
+  }
+  if (!found) {
+    while (newLines.length > 0 && newLines[newLines.length - 1].trim() === "") {
+      newLines.pop();
+    }
+    newLines.push(`${key}=${value}`);
+    newLines.push("");
+  }
+  await Bun.write(path, newLines.join(`
+`));
+}
+async function upsertEnvVars(filePath, entries) {
+  if (entries.length === 0) {
+    return;
+  }
+  const file = Bun.file(filePath);
+  const exists = await file.exists();
+  if (!exists) {
+    const content2 = entries.map(([k, v]) => `${k}=${v}`).join(`
+`) + `
+`;
+    await Bun.write(filePath, content2);
+    return;
+  }
+  const content = await file.text();
+  const lines = content.split(`
+`);
+  const updated = new Set;
+  const newLines = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const match = entries.find(([k]) => trimmed.startsWith(`${k}=`));
+    if (match) {
+      const [k, v] = match;
+      newLines.push(`${k}=${v}`);
+      updated.add(k);
+    } else {
+      newLines.push(line);
+    }
+  }
+  const toAppend = entries.filter(([k]) => !updated.has(k));
+  if (toAppend.length > 0) {
+    while (newLines.length > 0 && newLines[newLines.length - 1].trim() === "") {
+      newLines.pop();
+    }
+    for (const [k, v] of toAppend) {
+      newLines.push(`${k}=${v}`);
+    }
+    newLines.push("");
+  }
+  await Bun.write(filePath, newLines.join(`
+`));
+}
+
+// packages/lib/src/tokens.ts
+function generateToken(length = 64) {
+  const bytesNeeded = Math.ceil(length * 3 / 4);
+  const randomBytes = new Uint8Array(bytesNeeded);
+  crypto.getRandomValues(randomBytes);
+  let base64 = btoa(String.fromCharCode(...randomBytes));
+  const urlSafeBase64 = base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  return urlSafeBase64.slice(0, length);
+}
+
+// packages/lib/src/compose.ts
+function buildComposeArgs(config) {
+  return [
+    config.subcommand,
+    "--env-file",
+    config.envFile,
+    "-f",
+    config.composeFile
+  ];
+}
+async function composeExec(config, args, options) {
+  const fullArgs = [...buildComposeArgs(config), ...args];
+  const proc = Bun.spawn([config.bin, ...fullArgs], {
+    stdout: options?.stream ? "inherit" : "pipe",
+    stderr: options?.stream ? "inherit" : "pipe",
+    stdin: "inherit"
+  });
+  const timeoutMs = options?.timeout ?? (options?.stream ? 0 : 30000);
+  if (timeoutMs > 0) {
+    const result = await Promise.race([
+      proc.exited.then(() => "done"),
+      new Promise((r) => setTimeout(() => r("timeout"), timeoutMs))
+    ]);
+    if (result === "timeout") {
+      proc.kill();
+      return { exitCode: 1, stdout: "", stderr: `compose command timed out after ${timeoutMs}ms` };
+    }
+  } else {
+    await proc.exited;
+  }
+  const exitCode = proc.exitCode ?? 1;
+  const stdout = options?.stream ? "" : await new Response(proc.stdout).text();
+  const stderr = options?.stream ? "" : await new Response(proc.stderr).text();
+  return { exitCode, stdout, stderr };
+}
+async function composePull(config, services) {
+  const args = ["pull", ...services ?? []];
+  const result = await composeExec(config, args, { stream: true });
+  if (result.exitCode !== 0) {
+    throw new Error(`compose pull failed with exit code ${result.exitCode}`);
+  }
+}
+async function composeUp(config, services, options) {
+  const args = [];
+  if (options?.profiles) {
+    for (const profile of options.profiles) {
+      args.push("--profile", profile);
+    }
+  }
+  args.push("up");
+  const detach = options?.detach ?? true;
+  if (detach) {
+    args.push("-d");
+  }
+  if (options?.pull) {
+    args.push("--pull", options.pull);
+  }
+  if (services) {
+    args.push(...services);
+  }
+  const result = await composeExec(config, args, { stream: true });
+  if (result.exitCode !== 0) {
+    throw new Error(`compose up failed with exit code ${result.exitCode}`);
+  }
+}
+async function composeDown(config, options) {
+  const args = ["down"];
+  const removeOrphans = options?.removeOrphans ?? true;
+  if (removeOrphans) {
+    args.push("--remove-orphans");
+  }
+  if (options?.removeImages) {
+    args.push("--rmi", "all");
+  }
+  const result = await composeExec(config, args, { stream: true });
+  if (result.exitCode !== 0) {
+    throw new Error(`compose down failed with exit code ${result.exitCode}`);
+  }
+}
+async function composeRestart(config, services) {
+  const args = ["restart", ...services ?? []];
+  const result = await composeExec(config, args, { stream: true });
+  if (result.exitCode !== 0) {
+    throw new Error(`compose restart failed with exit code ${result.exitCode}`);
+  }
+}
+async function composeStop(config, services) {
+  const args = ["stop", ...services ?? []];
+  const result = await composeExec(config, args, { stream: true });
+  if (result.exitCode !== 0) {
+    throw new Error(`compose stop failed with exit code ${result.exitCode}`);
+  }
+}
+async function composeLogs(config, services, options) {
+  const args = ["logs"];
+  if (options?.follow) {
+    args.push("--follow");
+  }
+  if (options?.tail !== undefined) {
+    args.push("--tail", options.tail.toString());
+  }
+  if (services) {
+    args.push(...services);
+  }
+  const result = await composeExec(config, args, { stream: true });
+  if (result.exitCode !== 0) {
+    throw new Error(`compose logs failed with exit code ${result.exitCode}`);
+  }
+}
+async function composePs(config) {
+  const result = await composeExec(config, ["ps", "-a"]);
+  if (result.exitCode !== 0) {
+    throw new Error(`compose ps failed with exit code ${result.exitCode}`);
+  }
+  return result.stdout;
+}
+
+// packages/lib/src/assets.ts
+import { join as join3 } from "path";
+
+// packages/lib/assets/templates/openpalm.yaml
+var openpalm_default = `version: 3
+accessScope: lan
+channels:
+  chat:
+    enabled: true
+    exposure: lan
+    config:
+      CHAT_INBOUND_TOKEN: ""
+      CHANNEL_CHAT_SECRET: ""
+  discord:
+    enabled: true
+    exposure: lan
+    config:
+      DISCORD_BOT_TOKEN: ""
+      DISCORD_PUBLIC_KEY: ""
+      CHANNEL_DISCORD_SECRET: ""
+  voice:
+    enabled: true
+    exposure: lan
+    config:
+      CHANNEL_VOICE_SECRET: ""
+  telegram:
+    enabled: true
+    exposure: lan
+    config:
+      TELEGRAM_BOT_TOKEN: ""
+      TELEGRAM_WEBHOOK_SECRET: ""
+      CHANNEL_TELEGRAM_SECRET: ""
+services: {}
+automations: []
+`;
+
+// packages/lib/assets/templates/secrets.env
+var secrets_default = `# Manage secrets that should be available to assistant and openmemory in this file during install.
+# Installer copies this template to $OPENPALM_CONFIG_HOME/secrets.env and preserves your edits on future runs.
+
+# Required: API key for your AI assistant model (Anthropic Claude).
+# Get one from https://console.anthropic.com/
+ANTHROPIC_API_KEY=
+
+# Set an OpenAI-compatible endpoint/key for openmemory features that require model calls.
+# Leave OPENAI_BASE_URL empty to use the default OpenAI endpoint.
+OPENAI_BASE_URL=
+OPENAI_API_KEY=sk-REPLACE_WITH_ACTUAL_KEY
+
+# Optional: API key for the small/fast model used by OpenCode for lightweight tasks
+# (summaries, title generation). Set via the setup wizard or manually here.
+# Leave empty if the small model endpoint does not require authentication (e.g. local Ollama).
+OPENPALM_SMALL_MODEL_API_KEY=
+`;
+// packages/lib/assets/templates/index.ts
+var DEFAULT_OPENPALM_YAML = openpalm_default;
+var DEFAULT_SECRETS_ENV = secrets_default;
+
+// packages/lib/src/assets.ts
+async function seedConfigFiles(configHome) {
+  const yamlPath = join3(configHome, "openpalm.yaml");
+  const secretsPath = join3(configHome, "secrets.env");
+  if (!await Bun.file(yamlPath).exists())
+    await Bun.write(yamlPath, DEFAULT_OPENPALM_YAML);
+  if (!await Bun.file(secretsPath).exists())
+    await Bun.write(secretsPath, DEFAULT_SECRETS_ENV);
+}
+
+// packages/lib/src/preflight.ts
+import { homedir as homedir3 } from "os";
+async function checkDiskSpace() {
+  try {
+    const proc = Bun.spawn(["df", "-Pk", homedir3()], {
+      stdout: "pipe",
+      stderr: "ignore"
+    });
+    await proc.exited;
+    const output = await new Response(proc.stdout).text();
+    const lines = output.trim().split(`
+`);
+    if (lines.length < 2)
+      return null;
+    const parts = lines[1].split(/\s+/);
+    const availKB = parseInt(parts[3], 10);
+    if (isNaN(availKB))
+      return null;
+    if (availKB < 3000000) {
+      const availGB = (availKB / 1048576).toFixed(1);
+      return {
+        message: `Low disk space \u2014 only ~${availGB} GB available.`,
+        detail: "OpenPalm needs roughly 3 GB for container images and data."
+      };
+    }
+  } catch {}
+  return null;
+}
+async function checkPort80() {
+  try {
+    const lsof = Bun.spawn(["lsof", "-iTCP:80", "-sTCP:LISTEN", "-P", "-n"], {
+      stdout: "pipe",
+      stderr: "ignore"
+    });
+    await lsof.exited;
+    if (lsof.exitCode === 0) {
+      const output = await new Response(lsof.stdout).text();
+      const lines = output.trim().split(`
+`).slice(0, 3).join(`
+`);
+      return {
+        message: "Port 80 is already in use by another process.",
+        detail: `OpenPalm needs port 80 for its web interface.
+${lines}`
+      };
+    }
+  } catch {
+    try {
+      const ss = Bun.spawn(["ss", "-tln"], {
+        stdout: "pipe",
+        stderr: "ignore"
+      });
+      await ss.exited;
+      const output = await new Response(ss.stdout).text();
+      if (output.includes(":80 ")) {
+        return {
+          message: "Port 80 is already in use by another process.",
+          detail: "OpenPalm needs port 80 for its web interface."
+        };
+      }
+    } catch {}
+  }
+  return null;
+}
+async function checkDaemonRunning(bin, platform) {
+  if (platform === "podman")
+    return null;
+  try {
+    const proc = Bun.spawn([bin, "info"], {
+      stdout: "ignore",
+      stderr: "ignore"
+    });
+    await proc.exited;
+    if (proc.exitCode !== 0) {
+      return {
+        message: `${platform === "orbstack" ? "OrbStack" : "Docker"} is installed but the daemon is not running.`,
+        detail: process.platform === "darwin" ? "Open Docker Desktop (or OrbStack) and wait for it to start, then rerun." : `Start the Docker service:
+  sudo systemctl start docker`
+      };
+    }
+  } catch {
+    return {
+      message: `Could not verify that the ${bin} daemon is running.`
+    };
+  }
+  return null;
+}
+async function runPreflightChecks(bin, platform) {
+  const results = await Promise.all([
+    checkDiskSpace(),
+    checkPort80(),
+    checkDaemonRunning(bin, platform)
+  ]);
+  return results.filter((w) => w !== null);
+}
+function noRuntimeGuidance(os) {
+  const lines = [
+    "",
+    "No container runtime found.",
+    "",
+    "OpenPalm runs inside containers and needs Docker (recommended)",
+    "or Podman (experimental) installed first.",
+    ""
+  ];
+  switch (os) {
+    case "macos":
+      lines.push("For macOS, install ONE of:", "", "  Docker Desktop (free for personal use):", "    https://www.docker.com/products/docker-desktop/", "", "  OrbStack (lightweight, fast):", "    https://orbstack.dev/download", "", "  Or via Homebrew:", "    brew install --cask docker");
+      break;
+    case "linux":
+      lines.push("For Linux, install Docker Engine + Compose plugin:", "", "  Quick install (official script):", "    curl -fsSL https://get.docker.com | sh", "", "  Or follow the guide at:", "    https://docs.docker.com/engine/install/", "", "  After installing, make sure Docker is running:", "    sudo systemctl start docker");
+      break;
+    default:
+      lines.push("Download Docker Desktop (free for personal use):", "  https://www.docker.com/products/docker-desktop/", "", "Or install via winget:", "  winget install Docker.DockerDesktop");
+      break;
+  }
+  lines.push("", "After installing, rerun this installer.", "");
+  return lines.join(`
+`);
+}
+function noComposeGuidance(platform) {
+  if (platform === "podman") {
+    return [
+      "Compose support not available.",
+      "",
+      "Install podman-compose:",
+      "  pip install podman-compose",
+      "Or: https://github.com/containers/podman-compose"
+    ].join(`
+`);
+  }
+  return [
+    "Compose support not available.",
+    "",
+    "Docker Compose is included in Docker Desktop.",
+    "For Docker Engine on Linux, install the Compose plugin:",
+    "  sudo apt-get install docker-compose-plugin",
+    "Or: https://docs.docker.com/compose/install/"
+  ].join(`
+`);
+}
+
+// packages/lib/src/ui.ts
+var NO_COLOR = Bun.env.NO_COLOR !== undefined;
+var IS_TTY = process.stdout.isTTY;
+var COLORS_ENABLED = !NO_COLOR && IS_TTY;
+var ANSI = {
+  RESET: "\x1B[0m",
+  BOLD: "\x1B[1m",
+  DIM: "\x1B[2m",
+  GREEN: "\x1B[32m",
+  RED: "\x1B[31m",
+  YELLOW: "\x1B[33m",
+  CYAN: "\x1B[36m"
+};
+function bold(text) {
+  return COLORS_ENABLED ? `${ANSI.BOLD}${text}${ANSI.RESET}` : text;
+}
+function green(text) {
+  return COLORS_ENABLED ? `${ANSI.GREEN}${text}${ANSI.RESET}` : text;
+}
+function red(text) {
+  return COLORS_ENABLED ? `${ANSI.RED}${text}${ANSI.RESET}` : text;
+}
+function yellow(text) {
+  return COLORS_ENABLED ? `${ANSI.YELLOW}${text}${ANSI.RESET}` : text;
+}
+function cyan(text) {
+  return COLORS_ENABLED ? `${ANSI.CYAN}${text}${ANSI.RESET}` : text;
+}
+function dim(text) {
+  return COLORS_ENABLED ? `${ANSI.DIM}${text}${ANSI.RESET}` : text;
+}
+function log(msg) {
+  console.log(msg);
+}
+function info(msg) {
+  console.log(`${cyan("\u2139")} ${msg}`);
+}
+function warn(msg) {
+  console.log(`${yellow("\u26A0")} ${msg}`);
+}
+function error(msg) {
+  console.error(`${red("\u2716")} ${msg}`);
+}
+function spinner(msg) {
+  const frames = ["|", "/", "-", "\\"];
+  let frameIndex = 0;
+  let intervalId = null;
+  if (IS_TTY) {
+    intervalId = setInterval(() => {
+      const frame = frames[frameIndex];
+      frameIndex = (frameIndex + 1) % frames.length;
+      process.stdout.write(`\r${cyan(frame)} ${msg}`);
+    }, 80);
+  } else {
+    console.log(msg);
+  }
+  return {
+    stop(finalMsg) {
+      if (intervalId) {
+        clearInterval(intervalId);
+      }
+      if (IS_TTY) {
+        process.stdout.write("\r\x1B[K");
+      }
+      if (finalMsg) {
+        console.log(finalMsg);
+      }
+    }
+  };
+}
+async function confirm(prompt) {
+  process.stdout.write(`${prompt} ${dim("(y/N)")}: `);
+  const reader = Bun.stdin.stream().getReader();
+  const decoder = new TextDecoder;
+  let input = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done)
+      break;
+    input += decoder.decode(value, { stream: true });
+    if (input.includes(`
+`)) {
+      break;
+    }
+  }
+  reader.releaseLock();
+  const answer = input.trim().toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+
+// packages/cli/src/commands/install.ts
+async function install(options) {
+  log(bold(`
+OpenPalm Installation
+`));
+  const os = detectOS();
+  if (os === "unknown") {
+    error("Unable to detect operating system. Installation aborted.");
+    process.exit(1);
+  }
+  const arch = detectArch();
+  const platform = options.runtime ?? await detectRuntime(os);
+  if (!platform) {
+    error(noRuntimeGuidance(os));
+    process.exit(1);
+  }
+  const { bin, subcommand } = resolveComposeBin(platform);
+  const preflightWarnings = await runPreflightChecks(bin, platform);
+  for (const w of preflightWarnings) {
+    warn(w.message);
+    if (w.detail) {
+      for (const line of w.detail.split(`
+`)) {
+        info(`  ${line}`);
+      }
+    }
+    log("");
+  }
+  const daemonWarning = preflightWarnings.find((w) => w.message.includes("daemon is not running") || w.message.includes("daemon") || w.message.includes("Could not verify"));
+  if (daemonWarning) {
+    process.exit(1);
+  }
+  const isValid = await validateRuntime(bin, subcommand);
+  if (!isValid) {
+    error(noComposeGuidance(platform));
+    process.exit(1);
+  }
+  log(bold("Detected environment:"));
+  info(`  OS: ${cyan(os)}`);
+  info(`  Architecture: ${cyan(arch)}`);
+  info(`  Container runtime: ${cyan(platform)}${platform === "podman" ? yellow(" (experimental)") : ""}`);
+  info(`  Compose command: ${cyan(`${bin} ${subcommand}`)}
+`);
+  if (platform === "podman") {
+    warn("Podman support is experimental. Some features may not work as expected.");
+    info("  For the most reliable experience, we recommend Docker Desktop or Docker Engine.");
+    log("");
+  }
+  const xdg = resolveXDGPaths();
+  log(bold(`
+XDG paths:`));
+  info(`  Data: ${dim(xdg.data)}`);
+  info(`  Config: ${dim(xdg.config)}`);
+  info(`  State: ${dim(xdg.state)}
+`);
+  const stateComposeFile = join4(xdg.state, "docker-compose.yml");
+  const stateEnvFile = join4(xdg.state, ".env");
+  if (!options.force) {
+    try {
+      const existingCompose = await Bun.file(stateComposeFile).text();
+      if (existingCompose.includes("gateway:") && existingCompose.includes("assistant:")) {
+        warn("OpenPalm appears to already be installed.");
+        info("  The existing compose file contains a full stack configuration.");
+        info("");
+        info("  To update to the latest version, run:");
+        info(`    ${cyan("openpalm update")}`);
+        info("");
+        info("  To reinstall from scratch, run:");
+        info(`    ${cyan("openpalm install --force")}`);
+        log("");
+        const shouldContinue = await confirm("Continue anyway and overwrite the existing installation?");
+        if (!shouldContinue) {
+          log("Aborted.");
+          return;
+        }
+      }
+    } catch {}
+  }
+  const spin3 = spinner("Creating directory structure...");
+  await createDirectoryTree(xdg);
+  spin3.stop(green("Directory structure created"));
+  const cwdEnvPath = join4(process.cwd(), ".env");
+  const cwdEnvExists = await Bun.file(cwdEnvPath).exists();
+  const stateEnvExists = await Bun.file(stateEnvFile).exists();
+  let generatedAdminToken = "";
+  if (stateEnvExists) {
+    info("Using existing state .env file");
+  } else if (cwdEnvExists) {
+    info("Using existing .env file from current directory");
+    await Bun.write(stateEnvFile, Bun.file(cwdEnvPath));
+  } else {
+    const spin2 = spinner("Generating .env file...");
+    generatedAdminToken = generateToken();
+    const overrides = {
+      ADMIN_TOKEN: generatedAdminToken,
+      POSTGRES_PASSWORD: generateToken(),
+      CHANNEL_CHAT_SECRET: generateToken(),
+      CHANNEL_DISCORD_SECRET: generateToken(),
+      CHANNEL_VOICE_SECRET: generateToken(),
+      CHANNEL_TELEGRAM_SECRET: generateToken()
+    };
+    const envSeed = Object.entries(overrides).map(([key, value]) => `${key}=${value}`).join(`
+`) + `
+`;
+    await writeFile(stateEnvFile, envSeed, { encoding: "utf8", mode: 384 });
+    spin2.stop(green(".env file created"));
+  }
+  if (!generatedAdminToken) {
+    const existingEnv = await readEnvFile(stateEnvFile);
+    if (!existingEnv.ADMIN_TOKEN || existingEnv.ADMIN_TOKEN === "change-me-admin-token") {
+      generatedAdminToken = generateToken();
+      await upsertEnvVar(stateEnvFile, "ADMIN_TOKEN", generatedAdminToken);
+      warn("Insecure default admin token detected \u2014 regenerated with a secure token.");
+    }
+  }
+  if (generatedAdminToken) {
+    log("");
+    log(bold(green("  YOUR ADMIN PASSWORD (save this!)")));
+    log("");
+    log(`  ${yellow(generatedAdminToken)}`);
+    log("");
+    info("  You will need this password to log in to the admin dashboard.");
+    info(`  It is also saved in: ${dim(stateEnvFile)}`);
+    log("");
+  }
+  const socketPath = resolveSocketPath(platform, os);
+  const socketUri = resolveSocketUri(platform, os);
+  const inContainerSocket = resolveInContainerSocketPath(platform);
+  const normPath = (p) => p.replace(/\\/g, "/");
+  await upsertEnvVars(stateEnvFile, [
+    ["OPENPALM_DATA_HOME", normPath(xdg.data)],
+    ["OPENPALM_CONFIG_HOME", normPath(xdg.config)],
+    ["OPENPALM_STATE_HOME", normPath(xdg.state)],
+    ["OPENPALM_CONTAINER_PLATFORM", platform],
+    ["OPENPALM_COMPOSE_BIN", bin],
+    ["OPENPALM_COMPOSE_SUBCOMMAND", subcommand],
+    ["OPENPALM_CONTAINER_SOCKET_PATH", socketPath],
+    ["OPENPALM_CONTAINER_SOCKET_IN_CONTAINER", inContainerSocket],
+    ["OPENPALM_CONTAINER_SOCKET_URI", socketUri],
+    ["OPENPALM_IMAGE_NAMESPACE", "openpalm"],
+    ["OPENPALM_IMAGE_TAG", `latest-${arch}`],
+    ["OPENPALM_WORK_HOME", normPath(resolveWorkHome())],
+    ["OPENPALM_UID", String(process.getuid?.() ?? 1000)],
+    ["OPENPALM_GID", String(process.getgid?.() ?? 1000)],
+    ["OPENPALM_ENABLED_CHANNELS", ""]
+  ]);
+  await Bun.write(cwdEnvPath, Bun.file(stateEnvFile));
+  const spin4 = spinner("Seeding configuration files...");
+  await seedConfigFiles(xdg.config);
+  spin4.stop(green("Configuration files seeded"));
+  await rm(join4(xdg.data, "admin", "setup-state.json"), { force: true });
+  const uninstallDst = join4(xdg.state, "uninstall.sh");
+  await writeFile(uninstallDst, `#!/usr/bin/env bash
+openpalm uninstall
+`, "utf8");
+  try {
+    await chmod(uninstallDst, 493);
+  } catch {}
+  const systemEnvPath = join4(xdg.state, "system.env");
+  const systemEnvExists = await Bun.file(systemEnvPath).exists();
+  if (!systemEnvExists) {
+    await writeFile(systemEnvPath, `# Generated system env \u2014 populated on first stack apply
+`, "utf8");
+  }
+  const minimalCaddyJson = JSON.stringify({
+    admin: { disabled: true },
+    apps: {
+      http: {
+        servers: {
+          main: {
+            listen: [":80"],
+            routes: [
+              {
+                match: [{ path: ["/api*"] }],
+                handle: [{
+                  handler: "subroute",
+                  routes: [
+                    {
+                      handle: [
+                        { handler: "rewrite", strip_path_prefix: "/api" },
+                        { handler: "reverse_proxy", upstreams: [{ dial: "admin:8100" }] }
+                      ]
+                    }
+                  ]
+                }],
+                terminal: true
+              },
+              {
+                handle: [{
+                  handler: "reverse_proxy",
+                  upstreams: [{ dial: "admin:8100" }]
+                }]
+              }
+            ]
+          }
+        }
+      }
+    }
+  }, null, 2) + `
+`;
+  const caddyJsonPath = join4(xdg.state, "rendered", "caddy", "caddy.json");
+  await writeFile(caddyJsonPath, minimalCaddyJson, "utf8");
+  log(bold(`
+Downloading OpenPalm services (this may take a few minutes on first install)...
+`));
+  const minimalCompose = `services:
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "\${OPENPALM_INGRESS_BIND_ADDRESS:-127.0.0.1}:80:80"
+      - "\${OPENPALM_INGRESS_BIND_ADDRESS:-127.0.0.1}:443:443"
+    volumes:
+      - \${OPENPALM_STATE_HOME}/rendered/caddy/caddy.json:/etc/caddy/caddy.json:ro
+      - \${OPENPALM_STATE_HOME}/caddy/data:/data/caddy
+      - \${OPENPALM_STATE_HOME}/caddy/config:/config/caddy
+    command: caddy run --config /etc/caddy/caddy.json
+    networks: [assistant_net]
+
+  admin:
+    image: \${OPENPALM_IMAGE_NAMESPACE:-openpalm}/admin:\${OPENPALM_IMAGE_TAG:-latest}
+    restart: unless-stopped
+    env_file:
+      - \${OPENPALM_STATE_HOME}/system.env
+    environment:
+      - PORT=8100
+      - ADMIN_TOKEN=\${ADMIN_TOKEN:-change-me-admin-token}
+      - GATEWAY_URL=http://gateway:8080
+      - OPENCODE_CORE_URL=http://assistant:4096
+      - OPENPALM_COMPOSE_BIN=\${OPENPALM_COMPOSE_BIN:-docker}
+      - OPENPALM_COMPOSE_SUBCOMMAND=\${OPENPALM_COMPOSE_SUBCOMMAND:-compose}
+      - OPENPALM_CONTAINER_SOCKET_URI=\${OPENPALM_CONTAINER_SOCKET_URI:-unix:///var/run/docker.sock}
+      - COMPOSE_PROJECT_PATH=/state
+      - OPENPALM_COMPOSE_FILE=docker-compose.yml
+    volumes:
+      - \${OPENPALM_DATA_HOME}:/data
+      - \${OPENPALM_CONFIG_HOME}:/config
+      - \${OPENPALM_STATE_HOME}:/state
+      - \${OPENPALM_WORK_HOME:-\${HOME}/openpalm}:/work
+      - \${OPENPALM_CONTAINER_SOCKET_PATH:-/var/run/docker.sock}:\${OPENPALM_CONTAINER_SOCKET_IN_CONTAINER:-/var/run/docker.sock}
+    networks: [assistant_net]
+    healthcheck:
+      test: ["CMD", "curl", "-fs", "http://localhost:8100/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+networks:
+  channel_net:
+  assistant_net:
+`;
+  await writeFile(stateComposeFile, minimalCompose, "utf8");
+  const composeConfig = {
+    bin,
+    subcommand,
+    composeFile: stateComposeFile,
+    envFile: stateEnvFile
+  };
+  const coreServices = ["caddy", "admin"];
+  const spin6 = spinner("Pulling core service images...");
+  try {
+    await composePull(composeConfig, coreServices);
+    spin6.stop(green("Core images pulled"));
+  } catch (pullErr) {
+    spin6.stop(yellow("Failed to pull core images"));
+    warn("Image pull failed. This can happen due to network issues or rate limits.");
+    info("");
+    info("  To retry, run:");
+    info(`    ${cyan("openpalm install")}`);
+    info("");
+    info("  Or manually pull and then start:");
+    info(`    ${cyan(`${bin} ${subcommand} --env-file ${stateEnvFile} -f ${stateComposeFile} pull`)}`);
+    info(`    ${cyan(`${bin} ${subcommand} --env-file ${stateEnvFile} -f ${stateComposeFile} up -d`)}`);
+    log("");
+    process.exit(1);
+  }
+  const spin7 = spinner("Starting core services...");
+  await composeUp(composeConfig, coreServices, { detach: true });
+  spin7.stop(green("Core services started"));
+  const adminUrl = "http://localhost";
+  const healthUrl = `${adminUrl}/setup/status`;
+  const spin8 = spinner("Waiting for admin interface...");
+  let healthy = false;
+  let delay = 1000;
+  const maxDelay = 5000;
+  const deadline = Date.now() + 180000;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(healthUrl, { signal: AbortSignal.timeout(3000) });
+      if (response.ok) {
+        healthy = true;
+        break;
+      }
+    } catch {}
+    await Bun.sleep(delay);
+    delay = Math.min(delay * 1.5, maxDelay);
+  }
+  if (!healthy) {
+    spin8.stop(yellow("Admin interface did not become healthy in time"));
+  } else {
+    spin8.stop(green("Admin interface ready"));
+  }
+  if (!options.noOpen && healthy) {
+    try {
+      if (os === "macos") {
+        Bun.spawn(["open", adminUrl]);
+      } else if (os === "linux") {
+        Bun.spawn(["xdg-open", adminUrl]);
+      } else {
+        Bun.spawn(["cmd", "/c", "start", adminUrl]);
+      }
+    } catch {}
+  }
+  if (healthy) {
+    log("");
+    log(bold(green("  OpenPalm setup wizard is ready!")));
+    log("");
+    info(`  Setup wizard: ${cyan(adminUrl)}`);
+    log("");
+    if (generatedAdminToken) {
+      info(`  Admin password: ${yellow(generatedAdminToken)}`);
+      log("");
+    }
+    log(bold("  What happens next:"));
+    info("    1. The setup wizard opens in your browser");
+    info("    2. Enter your AI provider API key (e.g. from console.anthropic.com)");
+    info("    3. The wizard will download and start remaining services automatically");
+    info("    4. Pick which channels to enable (chat, Discord, etc.)");
+    info("    5. Done! Start chatting with your assistant");
+    log("");
+    if (!options.noOpen) {
+      info("  Opening setup wizard in your browser...");
+    } else {
+      info(`  Open this URL in your browser to continue: ${adminUrl}`);
+    }
+  } else {
+    log("");
+    log(bold(yellow("  Setup did not come online within 3 minutes")));
+    log("");
+    info("  This usually means containers are still starting. Try these steps:");
+    log("");
+    info(`  1. Wait a minute, then open: ${adminUrl}`);
+    log("");
+    info("  2. Check if containers are running:");
+    info("     openpalm status");
+    log("");
+    info("  3. Check logs for errors:");
+    info("     openpalm logs");
+    log("");
+    info("  4. Common fixes:");
+    info("     - Make sure port 80 is not used by another service");
+    info("     - Restart Docker/Podman and try again");
+    info("     - Check that you have internet access (images need to download)");
+  }
+  log("");
+  log(bold("  Useful commands:"));
+  info("    View logs:  openpalm logs");
+  info("    Stop:       openpalm stop");
+  info("    Uninstall:  openpalm uninstall");
+  log("");
+}
+
+// packages/cli/src/commands/uninstall.ts
+import { rm as rm2, unlink } from "fs/promises";
+import { join as join5, resolve } from "path";
+import { homedir as homedir4 } from "os";
+async function uninstall(options) {
+  const xdg = resolveXDGPaths();
+  let env = {};
+  const stateEnvPath = join5(xdg.state, ".env");
+  try {
+    env = await readEnvFile(stateEnvPath);
+  } catch {
+    try {
+      env = await readEnvFile(resolve(process.cwd(), ".env"));
+    } catch {}
+  }
+  let platform = null;
+  if (options.runtime) {
+    platform = options.runtime;
+  } else if (env.OPENPALM_CONTAINER_PLATFORM) {
+    platform = env.OPENPALM_CONTAINER_PLATFORM;
+  } else {
+    platform = await detectRuntime(detectOS());
+  }
+  let composeBin = null;
+  if (platform) {
+    composeBin = resolveComposeBin(platform);
+  }
+  log("");
+  log(bold("Uninstall Summary:"));
+  log(`Runtime platform: ${platform || "not detected"}`);
+  log("Stop/remove containers: yes");
+  log(`Remove images: ${options.removeImages ? "yes" : "no"}`);
+  log(`Remove all data/config/state: ${options.removeAll ? "yes" : "no"}`);
+  log(`Remove CLI binary: ${options.removeBinary ? "yes" : "no"}`);
+  log("");
+  log(`Data directory: ${xdg.data}`);
+  log(`Config directory: ${xdg.config}`);
+  log(`State directory: ${xdg.state}`);
+  log("");
+  if (!options.yes) {
+    const shouldContinue = await confirm("Continue?");
+    if (!shouldContinue) {
+      log("Aborted.");
+      return;
+    }
+  }
+  const composeFilePath = join5(xdg.state, "docker-compose.yml");
+  if (composeBin && platform) {
+    try {
+      await Bun.file(composeFilePath).text();
+      const config = {
+        bin: composeBin.bin,
+        subcommand: composeBin.subcommand,
+        envFile: stateEnvPath,
+        composeFile: composeFilePath
+      };
+      await composeDown(config, {
+        removeOrphans: true,
+        removeImages: options.removeImages
+      });
+    } catch {
+      warn("Compose runtime or file not found; skipping container shutdown.");
+    }
+  } else {
+    warn("Compose runtime or file not found; skipping container shutdown.");
+  }
+  if (options.removeAll) {
+    try {
+      await rm2(xdg.data, { recursive: true, force: true });
+    } catch {}
+    try {
+      await rm2(xdg.config, { recursive: true, force: true });
+    } catch {}
+    try {
+      await rm2(xdg.state, { recursive: true, force: true });
+    } catch {}
+    try {
+      await unlink(resolve(process.cwd(), ".env"));
+    } catch {}
+    info("Removed OpenPalm data/config/state and local .env.");
+  }
+  if (options.removeBinary) {
+    const os = detectOS();
+    let binaryPath;
+    if (os === "windows") {
+      const localAppData = Bun.env.LOCALAPPDATA || join5(homedir4(), "AppData", "Local");
+      binaryPath = join5(localAppData, "OpenPalm", "openpalm.exe");
+    } else {
+      binaryPath = join5(homedir4(), ".local", "bin", "openpalm");
+    }
+    try {
+      await unlink(binaryPath);
+      info(`Removed CLI binary: ${binaryPath}`);
+    } catch {
+      warn(`Could not remove binary at ${dim(binaryPath)} \u2014 it may have been installed elsewhere.`);
+    }
+    if (os === "windows") {
+      try {
+        const localAppData = Bun.env.LOCALAPPDATA || join5(homedir4(), "AppData", "Local");
+        const installDir = join5(localAppData, "OpenPalm");
+        const proc = Bun.spawn([
+          "powershell",
+          "-NoProfile",
+          "-Command",
+          `$p = [Environment]::GetEnvironmentVariable('Path','User'); ` + `$p = ($p.Split(';') | Where-Object { $_ -ne '${installDir.replace(/'/g, "''")}' }) -join ';'; ` + `[Environment]::SetEnvironmentVariable('Path', $p, 'User')`
+        ], { stdout: "ignore", stderr: "ignore" });
+        await proc.exited;
+        if (proc.exitCode === 0) {
+          info("Removed install directory from user PATH.");
+        }
+      } catch {}
+    }
+  }
+  const workDir = resolveWorkHome();
+  log("");
+  info(`Note: ${dim(workDir)} (assistant working directory) was not removed.`);
+  info("  Delete it manually if you no longer need it.");
+  info(green("Uninstall complete."));
+}
+
+// packages/lib/src/config.ts
+import { join as join6 } from "path";
+async function loadComposeConfig() {
+  const xdg = resolveXDGPaths();
+  const envPath = join6(xdg.state, ".env");
+  const env = await readEnvFile(envPath);
+  return {
+    bin: env.OPENPALM_COMPOSE_BIN ?? "docker",
+    subcommand: env.OPENPALM_COMPOSE_SUBCOMMAND ?? "compose",
+    envFile: envPath,
+    composeFile: join6(xdg.state, "docker-compose.yml")
+  };
+}
+
+// packages/cli/src/commands/update.ts
+async function update() {
+  const config = await loadComposeConfig();
+  info("Pulling latest images...");
+  await composePull(config);
+  info("Recreating containers with updated images...");
+  await composeUp(config, undefined, { pull: "always" });
+  info(green("Update complete."));
+}
+
+// packages/cli/src/commands/start.ts
+async function start(services) {
+  const config = await loadComposeConfig();
+  info("Starting services...");
+  await composeUp(config, services);
+  info(green("Services started."));
+}
+
+// packages/cli/src/commands/stop.ts
+async function stop(services) {
+  const config = await loadComposeConfig();
+  info("Stopping services...");
+  await composeStop(config, services);
+  info(green("Services stopped."));
+}
+
+// packages/cli/src/commands/restart.ts
+async function restart(services) {
+  const config = await loadComposeConfig();
+  info("Restarting services...");
+  await composeRestart(config, services);
+  info(green("Services restarted."));
+}
+
+// packages/cli/src/commands/logs.ts
+async function logs(services) {
+  const config = await loadComposeConfig();
+  await composeLogs(config, services?.length ? services : undefined, { follow: true, tail: 50 });
+}
+
+// packages/cli/src/commands/status.ts
+async function status() {
+  const config = await loadComposeConfig();
+  const output = await composePs(config);
+  log(output);
+}
+
+// packages/cli/src/commands/extensions.ts
+import { join as join7 } from "path";
+async function extensions(subcommand, args) {
+  function getArg(name) {
+    const index = args.indexOf(`--${name}`);
+    return index >= 0 && index + 1 < args.length ? args[index + 1] : undefined;
+  }
+  let adminToken = Bun.env.ADMIN_TOKEN;
+  if (!adminToken) {
+    try {
+      const stateEnvPath = join7(resolveXDGPaths().state, ".env");
+      const envVars = await readEnvFile(stateEnvPath);
+      adminToken = envVars.ADMIN_TOKEN;
+    } catch {}
+  }
+  if (!adminToken) {
+    error("ADMIN_TOKEN not found in environment or state .env file");
+    process.exit(1);
+  }
+  const base = Bun.env.ADMIN_APP_URL ?? Bun.env.GATEWAY_URL ?? "http://localhost";
+  const headers = {
+    "content-type": "application/json",
+    "x-admin-token": adminToken
+  };
+  function checkResponse(response, action) {
+    if (!response.ok) {
+      throw new Error(`${action} failed: HTTP ${response.status} ${response.statusText}`);
+    }
+  }
+  try {
+    switch (subcommand) {
+      case "install": {
+        const pluginId = getArg("plugin");
+        if (!pluginId) {
+          error("--plugin <id> is required for install");
+          info("Usage: openpalm extensions install --plugin <id>");
+          process.exit(1);
+        }
+        const response = await fetch(`${base}/plugins/install`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ pluginId })
+        });
+        checkResponse(response, "Extension install");
+        const text = await response.text();
+        info(text);
+        break;
+      }
+      case "uninstall": {
+        const pluginId = getArg("plugin");
+        if (!pluginId) {
+          error("--plugin <id> is required for uninstall");
+          info("Usage: openpalm extensions uninstall --plugin <id>");
+          process.exit(1);
+        }
+        const response = await fetch(`${base}/plugins/uninstall`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ pluginId })
+        });
+        checkResponse(response, "Extension uninstall");
+        const text = await response.text();
+        info(text);
+        break;
+      }
+      case "list": {
+        const response = await fetch(`${base}/installed`, {
+          method: "GET",
+          headers
+        });
+        checkResponse(response, "Extension list");
+        const text = await response.text();
+        info(text);
+        break;
+      }
+      default:
+        error(`Unknown subcommand: ${subcommand}`);
+        info("Usage: openpalm extensions <install|uninstall|list> [--plugin <id>]");
+        process.exit(1);
+    }
+  } catch (err) {
+    error(`Failed to execute extensions command: ${err}`);
+    process.exit(1);
+  }
+}
+
+// packages/cli/src/commands/preflight.ts
+import { statSync } from "fs";
+var devDir = ".dev";
+var envFile = ".env";
+var requiredDirs = [
+  "config",
+  "data/postgres",
+  "data/qdrant",
+  "data/openmemory",
+  "data/assistant",
+  "state/gateway",
+  "state/caddy",
+  "state/rendered/caddy"
+];
+function preflight() {
+  const issues = [];
+  try {
+    statSync(envFile);
+  } catch {
+    issues.push(`Missing ${envFile}. Run: bun run dev:setup`);
+  }
+  try {
+    statSync(devDir);
+  } catch {
+    issues.push(`Missing ${devDir}/ directory. Run: bun run dev:setup`);
+  }
+  if (issues.length === 0) {
+    for (const dir of requiredDirs) {
+      try {
+        statSync(`${devDir}/${dir}`);
+      } catch {
+        issues.push(`Missing ${devDir}/${dir}. Run: bun run dev:setup`);
+        break;
+      }
+    }
+  }
+  if (issues.length > 0) {
+    throw new Error(`Pre-flight check failed:
+
+${issues.map((issue) => `  - ${issue}`).join(`
+`)}
+
+Run 'bun run dev:setup' first, then try again.`);
+  }
+  info("Pre-flight check passed.");
+}
+
+// packages/cli/src/commands/create-channel.ts
+import { mkdirSync, writeFileSync, existsSync } from "fs";
+import { join as join8 } from "path";
+function usage() {
+  throw new Error("Usage: openpalm dev create-channel <channel-name> [--port <number>]");
+}
+function createChannel(args) {
+  const nameArg = args.find((arg) => !arg.startsWith("--"));
+  if (!nameArg)
+    usage();
+  const name = nameArg.toLowerCase();
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new Error(`Error: channel name must be lowercase alphanumeric with hyphens, got "${name}"`);
+  }
+  if (name.length > 32)
+    throw new Error("Error: channel name must be 32 characters or fewer");
+  const reserved = new Set(["chat", "discord", "voice", "telegram", "webhook"]);
+  if (reserved.has(name)) {
+    throw new Error(`Error: "${name}" is an existing built-in channel. Choose a different name.`);
+  }
+  const portIndex = args.indexOf("--port");
+  const defaultPort = portIndex !== -1 && args[portIndex + 1] ? Number(args[portIndex + 1]) : 8190;
+  if (Number.isNaN(defaultPort) || defaultPort < 1024 || defaultPort > 65535) {
+    throw new Error("Error: --port must be a number between 1024 and 65535");
+  }
+  const root = process.cwd();
+  const channelDir = join8(root, "channels", name);
+  if (existsSync(channelDir))
+    throw new Error(`Error: channels/${name}/ already exists.`);
+  const envPrefix = name.replace(/-/g, "_").toUpperCase();
+  const secretVar = `CHANNEL_${envPrefix}_SECRET`;
+  const inboundTokenVar = `${envPrefix}_INBOUND_TOKEN`;
+  const serviceName = `channel-${name}`;
+  const camel = name.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+  const pascal = camel.charAt(0).toUpperCase() + camel.slice(1);
+  const createFn = `create${pascal}Channel`;
+  const channelTs = `import type { ChannelAdapter, InboundResult } from "@openpalm/lib/channel.ts";
+
+const INBOUND_TOKEN = Bun.env.${inboundTokenVar} ?? "";
+
+export function ${createFn}(): ChannelAdapter {
+  return {
+    name: "${name}",
+    routes: [
+      {
+        method: "POST",
+        path: "/${name}/inbound",
+        handler: async (req: Request): Promise<InboundResult> => {
+          if (INBOUND_TOKEN && req.headers.get("x-${name}-token") !== INBOUND_TOKEN) {
+            return { ok: false, status: 401, body: { error: "unauthorized" } };
+          }
+
+          const body = (await req.json()) as {
+            userId?: string;
+            text?: string;
+            metadata?: Record<string, unknown>;
+          };
+
+          if (!body.text) {
+            return { ok: false, status: 400, body: { error: "text_required" } };
+          }
+
+          return {
+            ok: true,
+            payload: {
+              userId: body.userId ?? "${name}-user",
+              channel: "${name}",
+              text: body.text,
+              metadata: body.metadata ?? {},
+            },
+          };
+        },
+      },
+    ],
+
+    health: () => ({ ok: true, service: "${serviceName}" }),
+  };
+}
+`;
+  const serverTs = `import { createHmac } from "node:crypto";
+import { ${createFn} } from "./channel.ts";
+import type { ChannelAdapter } from "@openpalm/lib/channel.ts";
+
+const PORT = Number(Bun.env.PORT ?? ${defaultPort});
+const GATEWAY_URL = Bun.env.GATEWAY_URL ?? "http://gateway:8080";
+const SHARED_SECRET = Bun.env.${secretVar} ?? "";
+
+export function signPayload(secret: string, body: string) {
+  return createHmac("sha256", secret).update(body).digest("hex");
+}
+
+function json(status: number, data: unknown) {
+  return new Response(JSON.stringify(data, null, 2), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+export function createFetch(
+  adapter: ChannelAdapter,
+  gatewayUrl: string,
+  sharedSecret: string,
+  forwardFetch: typeof fetch = fetch,
+) {
+  const routeMap = new Map(adapter.routes.map((route) => [route.method + " " + route.path, route.handler]));
+
+  return async function handle(req: Request): Promise<Response> {
+    const url = new URL(req.url);
+    if (url.pathname === "/health") return json(200, adapter.health());
+
+    const handler = routeMap.get(req.method + " " + url.pathname);
+    if (!handler) return json(404, { error: "not_found" });
+
+    const result = await handler(req);
+    if (!result.ok) return json(result.status, result.body);
+
+    const gatewayPayload = {
+      ...result.payload,
+      nonce: crypto.randomUUID(),
+      timestamp: Date.now(),
+    };
+
+    const serialized = JSON.stringify(gatewayPayload);
+    const sig = signPayload(sharedSecret, serialized);
+
+    const resp = await forwardFetch(gatewayUrl + "/channel/inbound", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-channel-signature": sig,
+      },
+      body: serialized,
+    });
+
+    return new Response(await resp.text(), {
+      status: resp.status,
+      headers: { "content-type": "application/json" },
+    });
+  };
+}
+
+if (import.meta.main) {
+  const adapter = ${createFn}();
+  Bun.serve({ port: PORT, fetch: createFetch(adapter, GATEWAY_URL, SHARED_SECRET) });
+  console.log("${name} channel listening on " + PORT);
+}
+`;
+  const testTs = `import { describe, expect, it } from "bun:test";
+import { ${createFn} } from "./channel.ts";
+import { createFetch, signPayload } from "./server.ts";
+
+describe("${name} adapter", () => {
+  const adapter = ${createFn}();
+
+  it("returns health status", async () => {
+    const handler = createFetch(adapter, "http://gateway", "secret");
+    const resp = await handler(new Request("http://test/health"));
+    expect(resp.status).toBe(200);
+    const data = (await resp.json()) as { ok: boolean; service: string };
+    expect(data.ok).toBe(true);
+    expect(data.service).toBe("${serviceName}");
+  });
+
+  it("returns 404 for unknown routes", async () => {
+    const handler = createFetch(adapter, "http://gateway", "secret");
+    const resp = await handler(new Request("http://test/unknown"));
+    expect(resp.status).toBe(404);
+  });
+
+  it("returns 400 when text is missing", async () => {
+    const handler = createFetch(adapter, "http://gateway", "secret");
+    const resp = await handler(new Request("http://test/${name}/inbound", {
+      method: "POST",
+      body: JSON.stringify({ userId: "u1" }),
+      headers: { "content-type": "application/json" },
+    }));
+    expect(resp.status).toBe(400);
+  });
+
+  it("normalizes payload and forwards with valid HMAC", async () => {
+    let capturedUrl = "";
+    let capturedSig = "";
+    let capturedBody = "";
+
+    const mockFetch = async (input: RequestInfo | URL, init?: RequestInit) => {
+      capturedUrl = String(input);
+      capturedSig = String((init?.headers as Record<string, string>)["x-channel-signature"]);
+      capturedBody = String(init?.body);
+      return new Response(JSON.stringify({ ok: true }), { status: 200 });
+    };
+
+    const handler = createFetch(adapter, "http://gateway", "test-secret", mockFetch as typeof fetch);
+
+    const resp = await handler(new Request("http://test/${name}/inbound", {
+      method: "POST",
+      body: JSON.stringify({ userId: "u1", text: "hello" }),
+      headers: { "content-type": "application/json" },
+    }));
+
+    expect(resp.status).toBe(200);
+    expect(capturedUrl).toBe("http://gateway/channel/inbound");
+
+    const parsed = JSON.parse(capturedBody) as Record<string, unknown>;
+    expect(parsed.channel).toBe("${name}");
+    expect(parsed.text).toBe("hello");
+    expect(parsed.userId).toBe("u1");
+    expect(typeof parsed.nonce).toBe("string");
+    expect(typeof parsed.timestamp).toBe("number");
+    expect(capturedSig).toBe(signPayload("test-secret", capturedBody));
+  });
+});
+`;
+  const packageJson = `{
+  "name": "@openpalm/channel-${name}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "bun run server.ts",
+    "test": "bun test"
+  }
+}
+`;
+  const dockerfile = `FROM oven/bun:1.1.42
+WORKDIR /app
+COPY package.json ./
+COPY server.ts ./server.ts
+COPY channel.ts ./channel.ts
+RUN bun install --production
+CMD ["bun", "run", "server.ts"]
+`;
+  const envFile2 = `# Channel-specific overrides managed by admin UI
+${inboundTokenVar}=
+`;
+  mkdirSync(channelDir, { recursive: true });
+  const files = [
+    ["channel.ts", channelTs],
+    ["server.ts", serverTs],
+    ["server.test.ts", testTs],
+    ["package.json", packageJson],
+    ["Dockerfile", dockerfile]
+  ];
+  for (const [fileName, content] of files) {
+    writeFileSync(join8(channelDir, fileName), content, "utf8");
+  }
+  const channelEnvDir = join8(root, "assets", "config", "channels");
+  if (existsSync(channelEnvDir)) {
+    writeFileSync(join8(channelEnvDir, `${name}.env`), envFile2, "utf8");
+  }
+  console.log(`\u2714 Channel scaffolded: channels/${name}/`);
+}
+// packages/cli/package.json
+var package_default = {
+  name: "openpalm",
+  version: "0.2.7",
+  description: "CLI tool for installing and managing an OpenPalm stack",
+  type: "module",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "https://github.com/itlackey/openpalm.git",
+    directory: "packages/cli"
+  },
+  homepage: "https://github.com/itlackey/openpalm",
+  keywords: [
+    "openpalm",
+    "ai",
+    "cli",
+    "docker",
+    "installer"
+  ],
+  bin: {
+    openpalm: "./src/main.ts"
+  },
+  files: [
+    "src/**/*.ts"
+  ],
+  engines: {
+    bun: ">=1.2.0"
+  },
+  scripts: {
+    start: "bun run src/main.ts",
+    test: "bun test",
+    build: "bun build src/main.ts --compile --outfile dist/openpalm",
+    "build:linux-x64": "bun build src/main.ts --compile --target=bun-linux-x64 --outfile dist/openpalm-linux-x64",
+    "build:linux-arm64": "bun build src/main.ts --compile --target=bun-linux-arm64 --outfile dist/openpalm-linux-arm64",
+    "build:darwin-x64": "bun build src/main.ts --compile --target=bun-darwin-x64 --outfile dist/openpalm-darwin-x64",
+    "build:darwin-arm64": "bun build src/main.ts --compile --target=bun-darwin-arm64 --outfile dist/openpalm-darwin-arm64",
+    "build:windows-x64": "bun build src/main.ts --compile --target=bun-windows-x64 --outfile dist/openpalm-windows-x64.exe",
+    "build:windows-arm64": "bun build src/main.ts --compile --target=bun-windows-arm64 --outfile dist/openpalm-windows-arm64.exe"
+  },
+  dependencies: {
+    "@openpalm/lib": "workspace:*"
+  }
+};
+
+// packages/cli/src/main.ts
+var VERSION = package_default.version;
+function printHelp() {
+  log(bold("openpalm") + dim(` v${VERSION}`));
+  log("");
+  log(bold("Usage:"));
+  log("  openpalm <command> [options]");
+  log("");
+  log(bold("Commands:"));
+  log("  install        Install and start OpenPalm");
+  log("  uninstall      Stop and remove OpenPalm");
+  log("  update         Pull latest images and recreate containers");
+  log("  start          Start services");
+  log("  stop           Stop services");
+  log("  restart        Restart services");
+  log("  logs           View container logs");
+  log("  status         Show container status");
+  log("  extensions     Manage extensions (install, uninstall, list)");
+  log("  dev            Development helpers (preflight, create-channel)");
+  log("  version        Print version");
+  log("  help           Show this help");
+  log("");
+  log(bold("Install options:"));
+  log("  --runtime <docker|podman|orbstack>  Force container runtime");
+  log("  --no-open                           Don't auto-open browser");
+  log("  --ref <branch|tag>                  Git ref for asset download");
+  log("  --force                             Overwrite existing installation");
+  log("");
+  log(bold("Uninstall options:"));
+  log("  --runtime <docker|podman|orbstack>  Force container runtime");
+  log("  --remove-all                        Remove all data/config/state and CLI binary");
+  log("  --remove-images                     Remove container images");
+  log("  --remove-binary                     Remove the openpalm CLI binary");
+  log("  --yes                               Skip confirmation prompts");
+  log("");
+  log(bold("Management commands accept optional service names:"));
+  log("  openpalm start [service...]");
+  log("  openpalm stop [service...]");
+  log("  openpalm restart [service...]");
+  log("  openpalm logs [service...]");
+  log("");
+  log(bold("Extensions:"));
+  log("  openpalm extensions install --plugin <id>");
+  log("  openpalm extensions uninstall --plugin <id>");
+  log("  openpalm extensions list");
+}
+function parseArg(args, name) {
+  const index = args.indexOf(`--${name}`);
+  if (index >= 0 && index + 1 < args.length) {
+    return args[index + 1];
+  }
+  return;
+}
+function hasFlag(args, name) {
+  return args.includes(`--${name}`);
+}
+function getPositionalArgs(args) {
+  const result = [];
+  let i = 0;
+  while (i < args.length) {
+    if (args[i].startsWith("--")) {
+      const flagName = args[i].slice(2);
+      if (["runtime", "ref", "plugin"].includes(flagName)) {
+        i += 2;
+      } else {
+        i += 1;
+      }
+    } else {
+      result.push(args[i]);
+      i += 1;
+    }
+  }
+  return result;
+}
+var VALID_RUNTIMES = ["docker", "podman", "orbstack"];
+async function main() {
+  const [command, ...args] = process.argv.slice(2);
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    printHelp();
+    return;
+  }
+  if (command === "version" || command === "--version" || command === "-v") {
+    log(`openpalm v${VERSION}`);
+    return;
+  }
+  try {
+    switch (command) {
+      case "install": {
+        const runtimeArg = parseArg(args, "runtime");
+        if (runtimeArg && !VALID_RUNTIMES.includes(runtimeArg)) {
+          error(`Invalid runtime "${runtimeArg}". Must be one of: ${VALID_RUNTIMES.join(", ")}`);
+          process.exit(1);
+        }
+        const options = {
+          runtime: runtimeArg,
+          noOpen: hasFlag(args, "no-open"),
+          ref: parseArg(args, "ref"),
+          force: hasFlag(args, "force")
+        };
+        await install(options);
+        break;
+      }
+      case "uninstall": {
+        const uninstallRuntimeArg = parseArg(args, "runtime");
+        if (uninstallRuntimeArg && !VALID_RUNTIMES.includes(uninstallRuntimeArg)) {
+          error(`Invalid runtime "${uninstallRuntimeArg}". Must be one of: ${VALID_RUNTIMES.join(", ")}`);
+          process.exit(1);
+        }
+        const removeAll = hasFlag(args, "remove-all");
+        const options = {
+          runtime: uninstallRuntimeArg,
+          removeAll,
+          removeImages: hasFlag(args, "remove-images"),
+          removeBinary: removeAll || hasFlag(args, "remove-binary"),
+          yes: hasFlag(args, "yes")
+        };
+        await uninstall(options);
+        break;
+      }
+      case "update": {
+        await update();
+        break;
+      }
+      case "start": {
+        const services = getPositionalArgs(args);
+        await start(services.length > 0 ? services : undefined);
+        break;
+      }
+      case "stop": {
+        const services = getPositionalArgs(args);
+        await stop(services.length > 0 ? services : undefined);
+        break;
+      }
+      case "restart": {
+        const services = getPositionalArgs(args);
+        await restart(services.length > 0 ? services : undefined);
+        break;
+      }
+      case "logs": {
+        const services = getPositionalArgs(args);
+        await logs(services.length > 0 ? services : undefined);
+        break;
+      }
+      case "status":
+      case "ps": {
+        await status();
+        break;
+      }
+      case "extensions":
+      case "ext": {
+        const [subcommand, ...extArgs] = args;
+        if (!subcommand) {
+          error("Missing subcommand. Usage: openpalm extensions <install|uninstall|list>");
+          process.exit(1);
+        }
+        await extensions(subcommand, extArgs);
+        break;
+      }
+      case "dev": {
+        const [subcommand, ...devArgs] = args;
+        if (!subcommand) {
+          error("Missing subcommand. Usage: openpalm dev <preflight|create-channel>");
+          process.exit(1);
+        }
+        if (subcommand === "preflight") {
+          preflight();
+          break;
+        }
+        if (subcommand === "create-channel") {
+          createChannel(devArgs);
+          break;
+        }
+        error(`Unknown dev subcommand: ${subcommand}`);
+        process.exit(1);
+      }
+      default: {
+        error(`Unknown command: ${command}`);
+        log("Run 'openpalm help' for usage information.");
+        process.exit(1);
+      }
+    }
+  } catch (err) {
+    if (err instanceof Error) {
+      error(err.message);
+    } else {
+      error(String(err));
+    }
+    process.exit(1);
+  }
+}
+main();