Ship update_source=http://cm.xiapi.com with the internal read account so a fresh install is preconfigured (seeded into ~/.cmbot on first run). Plaintext credentials are acceptable for internal LAN use per project decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>