@pleri/olam-cli 0.1.106 → 0.1.107

package/dist/index.js

@@ -487,8 +487,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path52, errorMaps, issueData } = params;
-      const fullPath = [...path52, ...issueData.path || []];
+      const { data, path: path53, errorMaps, issueData } = params;
+      const fullPath = [...path53, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -796,11 +796,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path52, key) {
+      constructor(parent, value, path53, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path52;
+        this._path = path53;
         this._key = key;
       }
       get path() {
@@ -4281,7 +4281,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path52, ctx, rejectSource) {
+function refineForbiddenKeys(value, path53, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4289,12 +4289,12 @@ function refineForbiddenKeys(value, path52, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path52, key],
+        path: [...path53, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path52.length === 0 && key === "source") {
+    if (rejectSource && path53.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4302,21 +4302,21 @@ function refineForbiddenKeys(value, path52, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path52, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path53, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path52, rejectSource) {
+function rejectForbiddenKeys(value, path53, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path52}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path53}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path52}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path53}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path52}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path53}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5309,8 +5309,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path52, body, attempt = 0) {
-        const url = `${this.baseUrl}${path52}`;
+      async request(method, path53, body, attempt = 0) {
+        const url = `${this.baseUrl}${path53}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5328,7 +5328,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path52, body, attempt + 1);
+            return this.request(method, path53, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -6877,8 +6877,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path52, method, body) {
-        const url = `${this.config.workerUrl}${path52}`;
+      async request(path53, method, body) {
+        const url = `${this.config.workerUrl}${path53}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -8170,8 +8170,8 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import * as fs14 from "node:fs";
 import * as os9 from "node:os";
 import * as path15 from "node:path";
-function expandHome(p, homedir28) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir28());
+function expandHome(p, homedir29) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir29());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -8194,7 +8194,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
-  const homedir28 = deps.homedir ?? (() => os9.homedir());
+  const homedir29 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path15.join(workspacePath, ".olam", "baseline");
   try {
     fs14.mkdirSync(baselineDir, { recursive: true });
@@ -8210,7 +8210,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path15.join(baselineDir, filename);
-    const repoPath = expandHome(repo.path, homedir28);
+    const repoPath = expandHome(repo.path, homedir29);
     if (!fs14.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -13822,10 +13822,10 @@ async function readHostCpToken2() {
   if (!fs25.existsSync(tp)) return null;
   return fs25.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path52, body) {
+async function callHostCpProxy(method, worldId, path53, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path52}`;
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path53}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -14285,7 +14285,7 @@ __export(machine_schema_exports, {
   writeMachineConfig: () => writeMachineConfig
 });
 import * as fs41 from "node:fs";
-import * as path44 from "node:path";
+import * as path45 from "node:path";
 import * as os24 from "node:os";
 import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
 function readMachineConfig(configPath) {
@@ -14302,7 +14302,7 @@ function readMachineConfig(configPath) {
 }
 function writeMachineConfig(config, configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  fs41.mkdirSync(path44.dirname(p), { recursive: true });
+  fs41.mkdirSync(path45.dirname(p), { recursive: true });
   fs41.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
 }
 function initMachineConfig(opts = {}) {
@@ -14326,9 +14326,9 @@ var init_machine_schema = __esm({
       channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
       auto_update: external_exports.boolean().default(true),
       telemetry: external_exports.boolean().default(true),
-      worlds_dir: external_exports.string().default(() => path44.join(os24.homedir(), ".olam", "worlds"))
+      worlds_dir: external_exports.string().default(() => path45.join(os24.homedir(), ".olam", "worlds"))
     });
-    DEFAULT_CONFIG_PATH = path44.join(os24.homedir(), ".olam", "config.yaml");
+    DEFAULT_CONFIG_PATH = path45.join(os24.homedir(), ".olam", "config.yaml");
   }
 });
 
@@ -14710,9 +14710,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path52) {
-    super(`Archetype inheritance cycle detected: ${path52.join(" \u2192 ")} \u2192 ${path52[0] ?? "?"}`);
-    this.path = path52;
+  constructor(path53) {
+    super(`Archetype inheritance cycle detected: ${path53.join(" \u2192 ")} \u2192 ${path53[0] ?? "?"}`);
+    this.path = path53;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -16093,9 +16093,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path52, mtimeMs } of result.newerSources) {
+  for (const { path: path53, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path52}  (modified ${when})`);
+    lines.push(`  \u2022 ${path53}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -16256,9 +16256,9 @@ async function readHostCpTokenForCreate() {
   try {
     const { default: fs50 } = await import("node:fs");
     const { default: os28 } = await import("node:os");
-    const { default: path52 } = await import("node:path");
-    const tp = path52.join(
-      process.env.OLAM_HOME ?? path52.join(os28.homedir(), ".olam"),
+    const { default: path53 } = await import("node:path");
+    const tp = path53.join(
+      process.env.OLAM_HOME ?? path53.join(os28.homedir(), ".olam"),
       "host-cp.token"
     );
     if (!fs50.existsSync(tp)) return null;
@@ -16627,8 +16627,8 @@ async function readHostCpToken3() {
   try {
     const { default: fs50 } = await import("node:fs");
     const { default: os28 } = await import("node:os");
-    const { default: path52 } = await import("node:path");
-    const tp = path52.join(os28.homedir(), ".olam", "host-cp.token");
+    const { default: path53 } = await import("node:path");
+    const tp = path53.join(os28.homedir(), ".olam", "host-cp.token");
     if (!fs50.existsSync(tp)) return null;
     const raw = fs50.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
@@ -20361,11 +20361,11 @@ function zodIssueToError(issue, doc, lineCounter) {
     suggestion: deriveSuggestion(issue)
   };
 }
-function formatJsonPath(path52) {
-  if (path52.length === 0)
+function formatJsonPath(path53) {
+  if (path53.length === 0)
     return "<root>";
   let out = "";
-  for (const seg of path52) {
+  for (const seg of path53) {
     if (typeof seg === "number") {
       out += `[${seg}]`;
     } else {
@@ -20374,11 +20374,11 @@ function formatJsonPath(path52) {
   }
   return out;
 }
-function resolveYamlLocation(path52, doc, lineCounter) {
+function resolveYamlLocation(path53, doc, lineCounter) {
   let bestLine = 0;
   let bestColumn = 0;
-  for (let depth = path52.length; depth >= 0; depth -= 1) {
-    const segment = path52.slice(0, depth);
+  for (let depth = path53.length; depth >= 0; depth -= 1) {
+    const segment = path53.slice(0, depth);
     try {
       const node = doc.getIn(segment, true);
       if (node && typeof node === "object" && "range" in node) {
@@ -20596,11 +20596,11 @@ function topoSort(nodes) {
 }
 function traceCycle(start, byId) {
   const seen = /* @__PURE__ */ new Set();
-  const path52 = [];
+  const path53 = [];
   let current = start;
   while (current && !seen.has(current)) {
     seen.add(current);
-    path52.push(current);
+    path53.push(current);
     const node = byId.get(current);
     const next = node?.dependsOn[0];
     if (next === void 0)
@@ -20608,10 +20608,10 @@ function traceCycle(start, byId) {
     current = next;
   }
   if (current && seen.has(current)) {
-    const idx = path52.indexOf(current);
-    return [...path52.slice(idx), current];
+    const idx = path53.indexOf(current);
+    return [...path53.slice(idx), current];
   }
-  return path52;
+  return path53;
 }
 
 // ../core/dist/executor/types.js
@@ -23987,7 +23987,7 @@ function registerLogs(program2) {
         resolveStream();
       }
     };
-    const emit = (line, service) => {
+    const emit2 = (line, service) => {
       process.stdout.write(formatLine(line, service, showService) + "\n");
       lineCount++;
       if (!opts.follow && lineCount >= tailLimit) {
@@ -24016,13 +24016,13 @@ function registerLogs(program2) {
           if (!ev) continue;
           if (ev.type === "replay") {
             for (const l of ev.lines) {
-              if (!emit(l, ev.service)) {
+              if (!emit2(l, ev.service)) {
                 req.destroy();
                 break;
               }
             }
           } else if (ev.type === "line") {
-            if (!emit(ev.line, ev.service)) req.destroy();
+            if (!emit2(ev.line, ev.service)) req.destroy();
           }
         }
       });
@@ -25037,16 +25037,348 @@ function registerDiagnose(program2) {
   });
 }
 
+// src/lib/health-probes.ts
+import { spawnSync as spawnSync14 } from "node:child_process";
+import { existsSync as existsSync43, readdirSync as readdirSync11, readFileSync as readFileSync30, statSync as statSync13 } from "node:fs";
+import { homedir as homedir22 } from "node:os";
+import path43 from "node:path";
+
+// src/lib/kg-caps.ts
+var SOFT_CAP_BYTES = 15e8;
+var HARD_CAP_BYTES = 5e9;
+
+// src/lib/health-probes.ts
+var HEALTH_TIMEOUT_MS2 = 5e3;
+var defaultDockerExec2 = (cmd, args) => {
+  const r = spawnSync14(cmd, [...args], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  return {
+    status: r.status,
+    stdout: r.stdout ?? "",
+    stderr: r.stderr ?? ""
+  };
+};
+var defaultFetch = (input, init) => fetch(input, init);
+async function probeDockerDaemon(dockerExec = defaultDockerExec2) {
+  const r = dockerExec("docker", ["info", "--format", "{{.ServerVersion}}"]);
+  if (r.status === 0 && r.stdout.trim().length > 0) {
+    return { ok: true, message: `docker ${r.stdout.trim()} reachable` };
+  }
+  return {
+    ok: false,
+    message: "docker daemon not reachable",
+    remedy: "Start Docker Desktop (or your docker daemon) and re-run."
+  };
+}
+async function probeImagePresence(refs, dockerExec = defaultDockerExec2) {
+  for (const ref of refs) {
+    const r = dockerExec("docker", ["image", "inspect", "--format", "{{.Id}}", ref]);
+    if (r.status !== 0) {
+      return {
+        ok: false,
+        message: `image ${ref} not present locally`,
+        remedy: "Run `olam bootstrap` to pull the published image, or build locally."
+      };
+    }
+  }
+  return { ok: true, message: `${refs.length} image(s) present` };
+}
+async function probeHostCpHealth(fetchImpl = defaultFetch) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), HEALTH_TIMEOUT_MS2);
+  try {
+    const res = await fetchImpl("http://127.0.0.1:19000/health", { signal: controller.signal });
+    const body = await res.text().catch(() => "");
+    if (res.status !== 200) {
+      return {
+        ok: false,
+        message: `host-cp /health returned ${res.status}`,
+        remedy: "Restart host-cp via `olam host-cp start`; verify port 19000 is bound to 127.0.0.1."
+      };
+    }
+    if (isHostCpHealthEnvelope(body)) {
+      return { ok: true, message: "host-cp /health returned 200" };
+    }
+    return {
+      ok: false,
+      message: "host-cp /health returned 200 but body did not match the host-cp envelope (possible port collision on :19000)",
+      remedy: "Check `lsof -iTCP:19000`; another process may have bound the port. Restart host-cp via `olam host-cp start`."
+    };
+  } catch (err) {
+    const e = err;
+    const reason = e.name === "AbortError" ? `timeout (${HEALTH_TIMEOUT_MS2}ms)` : e.message;
+    return {
+      ok: false,
+      message: `host-cp /health unreachable: ${reason}`,
+      remedy: "Restart host-cp via `olam host-cp start`; verify port 19000 is bound to 127.0.0.1."
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function isHostCpHealthEnvelope(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return false;
+  }
+  if (!parsed || typeof parsed !== "object") return false;
+  const obj = parsed;
+  if (typeof obj.phase !== "string") return false;
+  if (!obj.cache || typeof obj.cache !== "object") return false;
+  const mode = obj.mode;
+  if (!mode || typeof mode !== "object") return false;
+  if (typeof mode.deployment !== "string") return false;
+  return true;
+}
+async function probeAuthVault(olamHomeOverride) {
+  const vaultPath = resolveAccountsPath(olamHomeOverride);
+  if (!existsSync43(vaultPath)) {
+    return {
+      ok: false,
+      message: `auth vault missing at ${vaultPath}`,
+      remedy: "Run `olam auth up && olam auth login` to provision the vault."
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync30(vaultPath, "utf-8"));
+  } catch (err) {
+    return {
+      ok: false,
+      message: `auth vault malformed: ${err.message}`,
+      remedy: "Inspect the accounts.json file; restore from backup or re-run `olam auth up`."
+    };
+  }
+  if (!Array.isArray(parsed)) {
+    return {
+      ok: false,
+      message: "auth vault malformed: expected JSON array at top level",
+      remedy: "Restore the vault from backup or re-run `olam auth up && olam auth login`."
+    };
+  }
+  const accounts = parsed.filter((a) => a !== null && typeof a === "object");
+  const now = Date.now();
+  const activeClaude = accounts.filter((a) => a.provider === "claude" && effectiveState2(a, now) === "active");
+  if (activeClaude.length === 0) {
+    return {
+      ok: false,
+      message: `no active claude credentials (vault has ${accounts.length} account(s))`,
+      remedy: "Run `olam auth login` to add a credential, or wait for the next reset."
+    };
+  }
+  return { ok: true, message: `${activeClaude.length} active claude credential(s)` };
+}
+function resolveAccountsPath(olamHomeOverride) {
+  const explicit = process.env.OLAM_AUTH_DATA_PATH;
+  if (explicit) return explicit;
+  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path43.join(homedir22(), ".olam");
+  return path43.join(olamHome5, "auth-data", "accounts.json");
+}
+function effectiveState2(account, now) {
+  const persisted = account.state ?? (account.rateLimited ? "cooldown" : "active");
+  if (persisted === "disabled") return "disabled";
+  if (typeof account.expiresAt === "number" && account.expiresAt <= now) return "expired";
+  if (persisted === "cooldown") {
+    const reset = account.rateLimitResetsAt ? new Date(account.rateLimitResetsAt).getTime() : 0;
+    if (reset > 0 && reset <= now) return "active";
+  }
+  return persisted;
+}
+async function probeKgStorage(olamHomeOverride) {
+  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path43.join(homedir22(), ".olam");
+  const kgRoot3 = path43.join(olamHome5, "kg");
+  const worldsRoot3 = path43.join(olamHome5, "worlds");
+  const kgBytes = enumerateGraphifyOut(kgRoot3, "pristine");
+  const overlayBytes = enumerateGraphifyOut(worldsRoot3, "overlay");
+  const totalBytes = kgBytes + overlayBytes;
+  if (totalBytes >= HARD_CAP_BYTES) {
+    return {
+      ok: false,
+      message: `KG storage ${formatBytes4(totalBytes)} exceeds 5 GB hard cap`,
+      remedy: "Prune stale pristines: `rm -rf ~/.olam/kg/<workspace>` after operator review."
+    };
+  }
+  if (totalBytes >= SOFT_CAP_BYTES) {
+    return {
+      ok: true,
+      message: `KG storage ${formatBytes4(totalBytes)} (soft-warn \u2014 exceeds 1.5 GB; consider pruning)`
+    };
+  }
+  return { ok: true, message: `KG storage ${formatBytes4(totalBytes)} (under cap)` };
+}
+function enumerateGraphifyOut(root, layout) {
+  if (!existsSync43(root)) return 0;
+  let total = 0;
+  let entries;
+  try {
+    entries = readdirSync11(root, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (layout === "pristine") {
+      total += dirSizeBytes(path43.join(root, entry.name, "graphify-out"));
+    } else {
+      const worldDir = path43.join(root, entry.name);
+      let clones;
+      try {
+        clones = readdirSync11(worldDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const clone of clones) {
+        if (!clone.isDirectory()) continue;
+        total += dirSizeBytes(path43.join(worldDir, clone.name, "graphify-out"));
+      }
+    }
+  }
+  return total;
+}
+function dirSizeBytes(dir) {
+  if (!existsSync43(dir)) return 0;
+  let total = 0;
+  const stack = [dir];
+  while (stack.length > 0) {
+    const cur = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync11(cur, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const full = path43.join(cur, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        stack.push(full);
+        continue;
+      }
+      try {
+        total += statSync13(full).size;
+      } catch {
+      }
+    }
+  }
+  return total;
+}
+function formatBytes4(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  if (n < 1024 * 1024 * 1024) return `${(n / 1024 / 1024).toFixed(1)} MB`;
+  return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
+}
+
+// src/commands/doctor.ts
+init_output();
+var DEFAULT_REGISTRY = "ghcr.io/pleri";
+var REQUIRED_IMAGE_PAIRS = [
+  { bare: "olam-host-cp:latest", registryName: "olam-host-cp:latest" },
+  { bare: "olam-auth:local" },
+  { bare: "olam-devbox:base", registryName: "olam-devbox:base" },
+  { bare: "olam-mcp-auth:local" }
+];
+function buildRequiredImageRefs(registry) {
+  const refs = [];
+  for (const pair of REQUIRED_IMAGE_PAIRS) {
+    refs.push(pair.bare);
+    if (pair.registryName) refs.push(`${registry}/${pair.registryName}`);
+  }
+  return refs;
+}
+async function runDoctor(opts, deps = {}) {
+  const dockerExec = deps.dockerExec;
+  const fetchImpl = deps.fetchImpl;
+  const olamHomeOverride = deps.olamHomeOverride;
+  const registry = deps.registry ?? DEFAULT_REGISTRY;
+  const dockerResult = await probeDockerDaemon(dockerExec);
+  const rows = [{ name: "docker daemon", result: dockerResult }];
+  if (!dockerResult.ok) {
+    return emit({ rows, summary: "FAILED", failureCount: 1 }, opts);
+  }
+  const imageRefs = buildRequiredImageRefs(registry);
+  const [imageResult, hostCpResult, authResult, kgResult] = await Promise.all([
+    probeImagePresence(imageRefs, dockerExec),
+    probeHostCpHealth(fetchImpl),
+    probeAuthVault(olamHomeOverride),
+    probeKgStorage(olamHomeOverride)
+  ]);
+  rows.push(
+    { name: "images", result: imageResult },
+    { name: "host-cp /health", result: hostCpResult },
+    { name: "auth vault", result: authResult },
+    { name: "KG storage", result: kgResult }
+  );
+  const failureCount = rows.filter((r) => !r.result.ok).length;
+  const summary = failureCount === 0 ? "OK" : "FAILED";
+  return emit({ rows, summary, failureCount }, opts);
+}
+function emit(report, opts) {
+  if (opts.json) {
+    process.stdout.write(
+      JSON.stringify(
+        {
+          summary: report.summary,
+          failureCount: report.failureCount,
+          probes: report.rows.map((r) => ({
+            name: r.name,
+            ok: r.result.ok,
+            message: r.result.message,
+            ...r.result.ok ? {} : { remedy: r.result.remedy }
+          }))
+        },
+        null,
+        2
+      ) + "\n"
+    );
+  } else {
+    renderHuman(report);
+  }
+  const exitCode = report.summary === "OK" ? 0 : 1;
+  return { exitCode, report };
+}
+function renderHuman(report) {
+  printHeader("olam doctor");
+  const namePad = Math.max(...report.rows.map((r) => r.name.length));
+  for (const row of report.rows) {
+    const label = row.name.padEnd(namePad);
+    if (row.result.ok) {
+      printSuccess(`${label}  ${row.result.message}`);
+    } else {
+      printError(`${label}  ${row.result.message}`);
+      printWarning(`${"".padEnd(namePad)}  remedy: ${row.result.remedy}`);
+    }
+  }
+  process.stdout.write("\n");
+  if (report.summary === "OK") {
+    printSuccess(`OK \u2014 all ${report.rows.length} probes green`);
+  } else {
+    printError(`FAILED \u2014 ${report.failureCount} of ${report.rows.length} probes failed`);
+  }
+}
+function registerDoctor(program2) {
+  program2.command("doctor").description(
+    "Pass/fail host-health check. Exits 0 on a healthy host; 1 on any failed probe. Runs Docker daemon / image presence / host-cp /health / auth vault / KG storage probes."
+  ).option("--json", "emit the report as JSON instead of a human-readable table").action(async (opts) => {
+    const r = await runDoctor(opts);
+    if (r.exitCode !== 0) process.exitCode = r.exitCode;
+  });
+}
+
 // src/commands/update.ts
 import * as fs42 from "node:fs";
 import * as os25 from "node:os";
-import * as path45 from "node:path";
+import * as path46 from "node:path";
 import { execSync as execSync13 } from "node:child_process";
 import pc23 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
 import * as fs40 from "node:fs";
-import * as path43 from "node:path";
+import * as path44 from "node:path";
 var realFs = {
   readdirSync: (p) => fs40.readdirSync(p),
   existsSync: (p) => fs40.existsSync(p),
@@ -25065,8 +25397,8 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   _fs.mkdirSync(claudeSkillsDir, { recursive: true });
   const sourceSkills = _fs.existsSync(npmSkillsDir) ? _fs.readdirSync(npmSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const skill of sourceSkills) {
-    const linkPath = path43.join(claudeSkillsDir, skill);
-    const target = path43.join(npmSkillsDir, skill);
+    const linkPath = path44.join(claudeSkillsDir, skill);
+    const target = path44.join(npmSkillsDir, skill);
     if (!_fs.existsSync(linkPath)) {
       try {
         _fs.symlinkSync(target, linkPath);
@@ -25079,7 +25411,7 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   }
   const deployedEntries = _fs.existsSync(claudeSkillsDir) ? _fs.readdirSync(claudeSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const entry of deployedEntries) {
-    const linkPath = path43.join(claudeSkillsDir, entry);
+    const linkPath = path44.join(claudeSkillsDir, entry);
     let isSymlink = false;
     try {
       isSymlink = _fs.lstatSync(linkPath).isSymbolicLink();
@@ -25104,9 +25436,9 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
 
 // src/commands/update.ts
 var PACKAGE_NAME = "@pleri/olam-cli";
-var CACHE_DIR2 = path45.join(os25.homedir(), ".olam", "cache");
-var LOG_DIR2 = path45.join(os25.homedir(), ".olam", "log");
-var LAST_STABLE_FILE = path45.join(CACHE_DIR2, "last-stable.txt");
+var CACHE_DIR2 = path46.join(os25.homedir(), ".olam", "cache");
+var LOG_DIR2 = path46.join(os25.homedir(), ".olam", "log");
+var LAST_STABLE_FILE = path46.join(CACHE_DIR2, "last-stable.txt");
 function defaultExec(cmd) {
   try {
     const stdout = execSync13(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
@@ -25135,12 +25467,12 @@ function readLastStable(file = LAST_STABLE_FILE) {
   }
 }
 function writeLastStable(version, file = LAST_STABLE_FILE) {
-  fs42.mkdirSync(path45.dirname(file), { recursive: true });
+  fs42.mkdirSync(path46.dirname(file), { recursive: true });
   fs42.writeFileSync(file, version, { mode: 420 });
 }
 function logUpdateFailure(stderr) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const logFile = path45.join(LOG_DIR2, `update-${ts}.log`);
+  const logFile = path46.join(LOG_DIR2, `update-${ts}.log`);
   try {
     fs42.mkdirSync(LOG_DIR2, { recursive: true });
     fs42.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
@@ -25230,8 +25562,8 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
   let symlinkResult = { added: [], removed: [] };
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
-    const npmSkillsDir = path45.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
-    const claudeSkillsDir = path45.join(os25.homedir(), ".claude", "skills");
+    const npmSkillsDir = path46.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
+    const claudeSkillsDir = path46.join(os25.homedir(), ".claude", "skills");
     const rec = _reconcile(npmSkillsDir, claudeSkillsDir);
     symlinkResult = { added: rec.added, removed: rec.removed };
     if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
@@ -25277,8 +25609,8 @@ async function doRollback(_exec = defaultExec, _reconcile = reconcileSkillSymlin
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
     _reconcile(
-      path45.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
-      path45.join(os25.homedir(), ".claude", "skills")
+      path46.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
+      path46.join(os25.homedir(), ".claude", "skills")
     );
   }
   return { action: "rolled-back", restoredVersion: prev, exitCode: 0 };
@@ -25370,10 +25702,10 @@ init_store2();
 init_store2();
 import * as fs43 from "node:fs";
 import * as os26 from "node:os";
-import * as path46 from "node:path";
+import * as path47 from "node:path";
 function expandPath(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path46.join(os26.homedir(), p.slice(1));
+    return path47.join(os26.homedir(), p.slice(1));
   }
   return p;
 }
@@ -25782,8 +26114,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path52, init = {}) {
-  const res = await fetch(`${BASE_URL}${path52}`, {
+async function apiFetch(path53, init = {}) {
+  const res = await fetch(`${BASE_URL}${path53}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -26045,7 +26377,7 @@ import pc29 from "picocolors";
 // src/commands/mcp/import-discovery.ts
 import * as fs45 from "node:fs";
 import * as os27 from "node:os";
-import * as path47 from "node:path";
+import * as path48 from "node:path";
 function readJsonFile(filePath) {
   try {
     const raw = fs45.readFileSync(filePath, "utf-8");
@@ -26077,18 +26409,18 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path47.join(os27.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path48.join(os27.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path47.join(os27.homedir(), "AppData", "Roaming");
-    return path47.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path48.join(os27.homedir(), "AppData", "Roaming");
+    return path48.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path47.join(os27.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path48.join(os27.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path47.join(os27.homedir(), ".olam", "config.yaml"),
-    path47.join(process.cwd(), ".olam", "config.yaml")
+    path48.join(os27.homedir(), ".olam", "config.yaml"),
+    path48.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
@@ -26110,7 +26442,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path47.join(os27.homedir(), ".claude.json"),
+      path: path48.join(os27.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -26118,19 +26450,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path47.join(os27.homedir(), ".cursor", "mcp.json"),
+      path: path48.join(os27.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path47.join(os27.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path48.join(os27.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path47.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path47.basename(repoPath)})`
+      path: path48.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path48.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -26360,12 +26692,12 @@ function registerMcp(program2) {
 }
 
 // src/commands/kg-build.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 import fs48 from "node:fs";
-import path50 from "node:path";
+import path51 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
-import { homedir as homedir26 } from "node:os";
+import { homedir as homedir27 } from "node:os";
 import { join as join48, resolve as resolve10 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
@@ -26387,7 +26719,7 @@ function validateWorkspaceName(name) {
 
 // ../core/dist/kg/storage-paths.js
 function olamHome3() {
-  return process.env.OLAM_HOME ?? join48(homedir26(), ".olam");
+  return process.env.OLAM_HOME ?? join48(homedir27(), ".olam");
 }
 function kgRoot() {
   return join48(olamHome3(), "kg");
@@ -26395,17 +26727,17 @@ function kgRoot() {
 function worldsRoot() {
   return join48(olamHome3(), "worlds");
 }
-function assertWithinPrefix(path52, prefix, label) {
-  if (!path52.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path52} not under ${prefix}/`);
+function assertWithinPrefix(path53, prefix, label) {
+  if (!path53.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path53} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path52 = resolve10(join48(root, workspace));
-  assertWithinPrefix(path52, root, "kgPristinePath");
-  return path52;
+  const path53 = resolve10(join48(root, workspace));
+  assertWithinPrefix(path53, root, "kgPristinePath");
+  return path53;
 }
 var KG_PATHS_INTERNALS = Object.freeze({
   olamHome: olamHome3,
@@ -26418,21 +26750,19 @@ init_output();
 
 // src/commands/kg-status.ts
 import fs46 from "node:fs";
-import { homedir as homedir27 } from "node:os";
-import path48 from "node:path";
+import { homedir as homedir28 } from "node:os";
+import path49 from "node:path";
 init_output();
-var SOFT_CAP_BYTES = 15e8;
-var HARD_CAP_BYTES = 5e9;
 function olamHome4() {
-  return process.env.OLAM_HOME ?? path48.join(homedir27(), ".olam");
+  return process.env.OLAM_HOME ?? path49.join(homedir28(), ".olam");
 }
 function kgRoot2() {
-  return path48.join(olamHome4(), "kg");
+  return path49.join(olamHome4(), "kg");
 }
 function worldsRoot2() {
-  return path48.join(olamHome4(), "worlds");
+  return path49.join(olamHome4(), "worlds");
 }
-function dirSizeBytes(dir) {
+function dirSizeBytes2(dir) {
   if (!fs46.existsSync(dir)) return 0;
   let total = 0;
   const stack = [dir];
@@ -26445,7 +26775,7 @@ function dirSizeBytes(dir) {
       continue;
     }
     for (const entry of entries) {
-      const full = path48.join(cur, entry.name);
+      const full = path49.join(cur, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(full);
@@ -26459,14 +26789,14 @@ function dirSizeBytes(dir) {
   }
   return total;
 }
-function formatBytes4(n) {
+function formatBytes5(n) {
   if (n < 1024) return `${n} B`;
   if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
   if (n < 1024 * 1024 * 1024) return `${(n / 1024 / 1024).toFixed(1)} MB`;
   return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 function readFreshness(workspace) {
-  const file = path48.join(kgPristinePath(workspace), "freshness.json");
+  const file = path49.join(kgPristinePath(workspace), "freshness.json");
   if (!fs46.existsSync(file)) return null;
   try {
     const raw = JSON.parse(fs46.readFileSync(file, "utf-8"));
@@ -26477,7 +26807,7 @@ function readFreshness(workspace) {
   }
 }
 function readOverlayNodeCount(graphifyOutDir) {
-  const graphPath = path48.join(graphifyOutDir, "graph.json");
+  const graphPath = path49.join(graphifyOutDir, "graph.json");
   if (!fs46.existsSync(graphPath)) return null;
   try {
     const raw = JSON.parse(fs46.readFileSync(graphPath, "utf-8"));
@@ -26503,7 +26833,7 @@ function listOverlays() {
   for (const worldEntry of worldDirs) {
     if (!worldEntry.isDirectory()) continue;
     const worldId = worldEntry.name;
-    const worldDir = path48.join(root, worldId);
+    const worldDir = path49.join(root, worldId);
     let cloneDirs;
     try {
       cloneDirs = fs46.readdirSync(worldDir, { withFileTypes: true });
@@ -26512,13 +26842,13 @@ function listOverlays() {
     }
     for (const cloneEntry of cloneDirs) {
       if (!cloneEntry.isDirectory()) continue;
-      const graphifyOut = path48.join(worldDir, cloneEntry.name, "graphify-out");
+      const graphifyOut = path49.join(worldDir, cloneEntry.name, "graphify-out");
       if (!fs46.existsSync(graphifyOut)) continue;
       records.push({
         world_id: worldId,
         clone_dir: cloneEntry.name,
         graphify_out_path: graphifyOut,
-        graphify_out_size_bytes: dirSizeBytes(graphifyOut),
+        graphify_out_size_bytes: dirSizeBytes2(graphifyOut),
         node_count: readOverlayNodeCount(graphifyOut)
       });
     }
@@ -26544,8 +26874,8 @@ function listPristines(overlays) {
       continue;
     }
     const fresh = readFreshness(workspace);
-    const graphifyOut = path48.join(kgPristinePath(workspace), "graphify-out");
-    const size = dirSizeBytes(graphifyOut);
+    const graphifyOut = path49.join(kgPristinePath(workspace), "graphify-out");
+    const size = dirSizeBytes2(graphifyOut);
     const worldCount = overlays.filter((o) => o.clone_dir === workspace).length;
     records.push({
       workspace,
@@ -26577,7 +26907,7 @@ function buildReport(workspaceFilter) {
     cap_status: classifyCap(totalBytes)
   };
 }
-function renderHuman(report, workspaceFilter) {
+function renderHuman2(report, workspaceFilter) {
   const lines = [];
   if (report.pristines.length === 0 && report.overlays.length === 0) {
     if (workspaceFilter) {
@@ -26605,7 +26935,7 @@ function renderHuman(report, workspaceFilter) {
           p.workspace.padEnd(24),
           (p.built_at ?? "\u2014").padEnd(22),
           String(p.node_count ?? "\u2014").padStart(8),
-          formatBytes4(p.graphify_out_size_bytes).padStart(10),
+          formatBytes5(p.graphify_out_size_bytes).padStart(10),
           String(p.world_count).padStart(7)
         ].join("  ")
       );
@@ -26629,13 +26959,13 @@ function renderHuman(report, workspaceFilter) {
           o.world_id.padEnd(24),
           o.clone_dir.padEnd(20),
           String(o.node_count ?? "\u2014").padStart(8),
-          formatBytes4(o.graphify_out_size_bytes).padStart(10)
+          formatBytes5(o.graphify_out_size_bytes).padStart(10)
         ].join("  ")
       );
     }
     lines.push("");
   }
-  lines.push(`Total: ${formatBytes4(report.total_bytes)} (cap: ${report.cap_status})`);
+  lines.push(`Total: ${formatBytes5(report.total_bytes)} (cap: ${report.cap_status})`);
   return lines.join("\n");
 }
 async function runKgStatus(workspaceArg, opts) {
@@ -26652,15 +26982,15 @@ async function runKgStatus(workspaceArg, opts) {
   if (opts.json) {
     process.stdout.write(JSON.stringify(report, null, 2) + "\n");
   } else {
-    process.stdout.write(renderHuman(report, workspaceArg) + "\n");
+    process.stdout.write(renderHuman2(report, workspaceArg) + "\n");
   }
   if (report.cap_status === "soft-warn") {
     printWarning(
-      `KG storage at ${formatBytes4(report.total_bytes)} \u2014 exceeds 1.5GB soft cap. Consider pruning stale pristines via \`rm -rf ~/.olam/kg/<workspace>\` after operator review.`
+      `KG storage at ${formatBytes5(report.total_bytes)} \u2014 exceeds 1.5GB soft cap. Consider pruning stale pristines via \`rm -rf ~/.olam/kg/<workspace>\` after operator review.`
     );
   } else if (report.cap_status === "hard-critical") {
     printError(
-      `KG storage at ${formatBytes4(report.total_bytes)} \u2014 exceeds 5GB hard cap. Prune stale pristines or overlays before running \`olam kg build\` again.`
+      `KG storage at ${formatBytes5(report.total_bytes)} \u2014 exceeds 5GB hard cap. Prune stale pristines or overlays before running \`olam kg build\` again.`
     );
     return { exitCode: 1, report };
   }
@@ -26678,10 +27008,10 @@ function registerKgStatusCommand(kg) {
 // src/commands/kg-watch.ts
 import { spawn as spawn7 } from "node:child_process";
 import fs47 from "node:fs";
-import path49 from "node:path";
+import path50 from "node:path";
 init_output();
 function pidFilePath(workspace) {
-  return path49.join(kgPristinePath(workspace), ".watch.pid");
+  return path50.join(kgPristinePath(workspace), ".watch.pid");
 }
 function isPidAlive3(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -26715,7 +27045,7 @@ function readAndClassifyPid(workspace) {
 }
 function writePidFile(workspace, pid) {
   const file = pidFilePath(workspace);
-  const dir = path49.dirname(file);
+  const dir = path50.dirname(file);
   fs47.mkdirSync(dir, { recursive: true });
   fs47.writeFileSync(file, String(pid), { encoding: "utf-8" });
 }
@@ -26728,7 +27058,7 @@ function removePidFile(workspace) {
 }
 async function runKgWatch(workspaceArg, opts, deps = {}) {
   const cwd = deps.cwd ?? opts.cwd ?? process.cwd();
-  const name = workspaceArg ?? path49.basename(cwd).toLowerCase();
+  const name = workspaceArg ?? path50.basename(cwd).toLowerCase();
   try {
     validateWorkspaceName(name);
   } catch (err) {
@@ -26736,7 +27066,7 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
     return { exitCode: 1, pidWritten: false };
   }
   const pristinePath = kgPristinePath(name);
-  const graphPath = path49.join(pristinePath, "graphify-out", "graph.json");
+  const graphPath = path50.join(pristinePath, "graphify-out", "graph.json");
   const pidState = readAndClassifyPid(name);
   if (pidState.status === "active") {
     printError(
@@ -26802,19 +27132,19 @@ function registerKgWatchCommand(kg) {
 var DEFAULT_DEVBOX_IMAGE2 = "olam-devbox:latest";
 function resolveWorkspace(arg) {
   const cwd = process.cwd();
-  const name = arg ?? path50.basename(cwd).toLowerCase();
+  const name = arg ?? path51.basename(cwd).toLowerCase();
   validateWorkspaceName(name);
   return { name, sourcePath: cwd };
 }
 function copyWorkspaceToScratch(source, scratch) {
   if (process.platform === "darwin") {
-    const r2 = spawnSync14("cp", ["-c", "-r", source + "/.", scratch], {
+    const r2 = spawnSync15("cp", ["-c", "-r", source + "/.", scratch], {
       stdio: ["ignore", "ignore", "pipe"],
       encoding: "utf-8"
     });
     if (r2.status === 0) return "cp-c-r-reflink";
   }
-  const r = spawnSync14("cp", ["-r", source + "/.", scratch], {
+  const r = spawnSync15("cp", ["-r", source + "/.", scratch], {
     stdio: ["ignore", "ignore", "pipe"],
     encoding: "utf-8"
   });
@@ -26824,7 +27154,7 @@ function copyWorkspaceToScratch(source, scratch) {
   return "cp-r";
 }
 function parseNodeCount(graphifyOutDir) {
-  const graphPath = path50.join(graphifyOutDir, "graph.json");
+  const graphPath = path51.join(graphifyOutDir, "graph.json");
   if (!fs48.existsSync(graphPath)) return null;
   try {
     const content = fs48.readFileSync(graphPath, "utf-8");
@@ -26835,7 +27165,7 @@ function parseNodeCount(graphifyOutDir) {
   }
 }
 function readGraphifyVersion(image) {
-  const r = spawnSync14(
+  const r = spawnSync15(
     "docker",
     [
       "run",
@@ -26861,7 +27191,7 @@ async function runKgBuild(workspaceArg, options = {}) {
     return { exitCode: 2 };
   }
   const outDir = kgPristinePath(workspace.name);
-  const scratchDir = path50.join(outDir, "scratch");
+  const scratchDir = path51.join(outDir, "scratch");
   fs48.mkdirSync(outDir, { recursive: true });
   if (fs48.existsSync(scratchDir)) fs48.rmSync(scratchDir, { recursive: true, force: true });
   fs48.mkdirSync(scratchDir);
@@ -26887,13 +27217,13 @@ async function runKgBuild(workspaceArg, options = {}) {
       "update",
       "."
     ];
-    const r = human ? spawnSync14("docker", dockerArgs, { stdio: "inherit" }) : spawnSync14("docker", dockerArgs, { stdio: ["ignore", "ignore", "pipe"] });
+    const r = human ? spawnSync15("docker", dockerArgs, { stdio: "inherit" }) : spawnSync15("docker", dockerArgs, { stdio: ["ignore", "ignore", "pipe"] });
     if (r.status !== 0) {
       printError(`graphify update failed (exit ${r.status})`);
       return { exitCode: r.status ?? 1 };
     }
-    const scratchOut = path50.join(scratchDir, "graphify-out");
-    const finalOut = path50.join(outDir, "graphify-out");
+    const scratchOut = path51.join(scratchDir, "graphify-out");
+    const finalOut = path51.join(outDir, "graphify-out");
     if (!fs48.existsSync(scratchOut)) {
       printError(`graphify produced no graphify-out/ in scratch (${scratchOut})`);
       return { exitCode: 1 };
@@ -26912,7 +27242,7 @@ async function runKgBuild(workspaceArg, options = {}) {
       scratch_strategy: scratchStrategy
     };
     fs48.writeFileSync(
-      path50.join(outDir, "freshness.json"),
+      path51.join(outDir, "freshness.json"),
       JSON.stringify(freshness, null, 2) + "\n",
       "utf-8"
     );
@@ -26945,12 +27275,12 @@ function registerKg(program2) {
 
 // src/pleri-config.ts
 import * as fs49 from "node:fs";
-import * as path51 from "node:path";
+import * as path52 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path51.join(configDir, "config.yaml");
+  const configPath = path52.join(configDir, "config.yaml");
   if (!fs49.existsSync(configPath)) {
     return false;
   }
@@ -26992,6 +27322,7 @@ registerWorldSnapshot(program);
 registerRefresh(program);
 registerBootstrap(program);
 registerDiagnose(program);
+registerDoctor(program);
 registerUpdate(program);
 registerBegin(program);
 registerStop(program);