@pleri/olam-cli 0.1.114 → 0.1.116

package/dist/index.js

@@ -487,8 +487,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path55, errorMaps, issueData } = params;
-      const fullPath = [...path55, ...issueData.path || []];
+      const { data, path: path56, errorMaps, issueData } = params;
+      const fullPath = [...path56, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -796,11 +796,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path55, key) {
+      constructor(parent, value, path56, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path55;
+        this._path = path56;
         this._key = key;
       }
       get path() {
@@ -4281,7 +4281,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path55, ctx, rejectSource) {
+function refineForbiddenKeys(value, path56, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4289,12 +4289,12 @@ function refineForbiddenKeys(value, path55, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path55, key],
+        path: [...path56, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path55.length === 0 && key === "source") {
+    if (rejectSource && path56.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4302,21 +4302,21 @@ function refineForbiddenKeys(value, path55, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path55, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path56, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path55, rejectSource) {
+function rejectForbiddenKeys(value, path56, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path55}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path56}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path55}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path56}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path55}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path56}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5309,8 +5309,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path55, body, attempt = 0) {
-        const url = `${this.baseUrl}${path55}`;
+      async request(method, path56, body, attempt = 0) {
+        const url = `${this.baseUrl}${path56}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5328,7 +5328,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path55, body, attempt + 1);
+            return this.request(method, path56, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -6984,8 +6984,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path55, method, body) {
-        const url = `${this.config.workerUrl}${path55}`;
+      async request(path56, method, body) {
+        const url = `${this.config.workerUrl}${path56}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -8275,11 +8275,202 @@ var init_env_setup = __esm({
   }
 });
 
-// ../core/dist/world/baseline-diff.js
+// ../core/dist/world/workspace-name.js
+function validateWorkspaceName(name) {
+  if (typeof name !== "string" || name.length === 0) {
+    throw new InvalidWorkspaceNameError(String(name), "must be a non-empty string");
+  }
+  if (!WORKSPACE_NAME_RE.test(name)) {
+    throw new InvalidWorkspaceNameError(name, "must match ^[a-z0-9][a-z0-9_-]*$ (lowercase letters, digits, hyphens, underscores; must start with letter or digit)");
+  }
+}
+var InvalidWorkspaceNameError, WORKSPACE_NAME_RE;
+var init_workspace_name = __esm({
+  "../core/dist/world/workspace-name.js"() {
+    "use strict";
+    InvalidWorkspaceNameError = class extends Error {
+      constructor(name, reason) {
+        super(`invalid workspace name ${JSON.stringify(name)}: ${reason}`);
+        this.name = "InvalidWorkspaceNameError";
+      }
+    };
+    WORKSPACE_NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
+  }
+});
+
+// ../core/dist/kg/storage-paths.js
+import { homedir as homedir9 } from "node:os";
+import { join as join16, resolve as resolve4 } from "node:path";
+function olamHome() {
+  return process.env.OLAM_HOME ?? join16(homedir9(), ".olam");
+}
+function kgRoot() {
+  return join16(olamHome(), "kg");
+}
+function worldsRoot() {
+  return join16(olamHome(), "worlds");
+}
+function assertWithinPrefix(path56, prefix, label) {
+  if (!path56.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path56} not under ${prefix}/`);
+  }
+}
+function kgPristinePath(workspace) {
+  validateWorkspaceName(workspace);
+  const root = kgRoot();
+  const path56 = resolve4(join16(root, workspace));
+  assertWithinPrefix(path56, root, "kgPristinePath");
+  return path56;
+}
+var KG_PATHS_INTERNALS;
+var init_storage_paths = __esm({
+  "../core/dist/kg/storage-paths.js"() {
+    "use strict";
+    init_workspace_name();
+    KG_PATHS_INTERNALS = Object.freeze({
+      olamHome,
+      kgRoot,
+      worldsRoot
+    });
+  }
+});
+
+// ../core/dist/world/kg-overlay.js
 import { execFileSync as execFileSync3 } from "node:child_process";
 import * as fs14 from "node:fs";
-import * as os9 from "node:os";
 import * as path15 from "node:path";
+function ensureGitignoreEntry(worldClonePath) {
+  const gitignorePath = path15.join(worldClonePath, ".gitignore");
+  if (!fs14.existsSync(gitignorePath))
+    return "no-gitignore";
+  const content = fs14.readFileSync(gitignorePath, "utf-8");
+  const lines = content.split("\n").map((l) => l.trim());
+  const recognised = /* @__PURE__ */ new Set([
+    "graphify-out",
+    "graphify-out/",
+    "/graphify-out",
+    "/graphify-out/",
+    "**/graphify-out",
+    "**/graphify-out/"
+  ]);
+  if (lines.some((l) => recognised.has(l)))
+    return "present";
+  const eol = content.includes("\r\n") ? "\r\n" : "\n";
+  const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
+  const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
+  fs14.appendFileSync(gitignorePath, block, "utf-8");
+  return "appended";
+}
+function createWorldOverlay(opts) {
+  const pristineRoot = kgPristinePath(opts.workspace);
+  const pristinePath = path15.join(pristineRoot, "graphify-out");
+  if (!fs14.existsSync(pristinePath)) {
+    throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
+  }
+  if (!path15.isAbsolute(opts.worldClonePath)) {
+    throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
+  }
+  if (!fs14.existsSync(opts.worldClonePath)) {
+    throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
+  }
+  const overlayPath = path15.join(opts.worldClonePath, "graphify-out");
+  if (fs14.existsSync(overlayPath)) {
+    fs14.rmSync(overlayPath, { recursive: true, force: true });
+  }
+  const useReflink = process.platform === "darwin";
+  let strategy;
+  let reflinkError;
+  if (useReflink) {
+    try {
+      execFileSync3("cp", ["-c", "-r", pristinePath, opts.worldClonePath], {
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      strategy = "cp-c-r-reflink";
+    } catch (err) {
+      reflinkError = err;
+      strategy = "cp-r";
+    }
+  } else {
+    strategy = "cp-r";
+  }
+  if (strategy === "cp-r" || !fs14.existsSync(overlayPath)) {
+    try {
+      execFileSync3("cp", ["-r", pristinePath, opts.worldClonePath], {
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      strategy = "cp-r";
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const reflinkMsg = reflinkError instanceof Error ? ` (reflink also failed: ${reflinkError.message})` : "";
+      throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
+    }
+  }
+  if (!fs14.existsSync(overlayPath)) {
+    throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
+  }
+  const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
+  return {
+    pristinePath,
+    overlayPath,
+    strategy,
+    gitignoreAction
+  };
+}
+var KgOverlayError;
+var init_kg_overlay = __esm({
+  "../core/dist/world/kg-overlay.js"() {
+    "use strict";
+    init_storage_paths();
+    KgOverlayError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "KgOverlayError";
+      }
+    };
+  }
+});
+
+// ../core/dist/world/kg-install-hook.js
+import { execFileSync as execFileSync4 } from "node:child_process";
+function installGraphifyHookInWorld(opts) {
+  const timeout = opts.timeoutMs ?? 3e4;
+  try {
+    execFileSync4("docker", [
+      "exec",
+      "-u",
+      "olam",
+      "-w",
+      `/home/olam/workspace/${opts.repoName}`,
+      opts.containerName,
+      "graphify",
+      "claude",
+      "install",
+      "--platform",
+      "claude"
+    ], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8", timeout });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new KgHookInstallError(`graphify claude install failed in ${opts.containerName} (repo=${opts.repoName}): ${msg}`);
+  }
+}
+var KgHookInstallError;
+var init_kg_install_hook = __esm({
+  "../core/dist/world/kg-install-hook.js"() {
+    "use strict";
+    KgHookInstallError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "KgHookInstallError";
+      }
+    };
+  }
+});
+
+// ../core/dist/world/baseline-diff.js
+import { execFileSync as execFileSync5 } from "node:child_process";
+import * as fs15 from "node:fs";
+import * as os9 from "node:os";
+import * as path16 from "node:path";
 function expandHome(p, homedir30) {
   return p.replace(/^~(?=$|\/|\\)/, homedir30());
 }
@@ -8303,11 +8494,11 @@ ${stderr}`;
   return /unknown revision|bad revision|does not have any commits|HEAD'?: ambiguous|Needed a single revision/.test(blob);
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync5(cmd, args, opts));
   const homedir30 = deps.homedir ?? (() => os9.homedir());
-  const baselineDir = path15.join(workspacePath, ".olam", "baseline");
+  const baselineDir = path16.join(workspacePath, ".olam", "baseline");
   try {
-    fs14.mkdirSync(baselineDir, { recursive: true });
+    fs15.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -8319,9 +8510,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path15.join(baselineDir, filename);
+    const outPath = path16.join(baselineDir, filename);
     const repoPath = expandHome(repo.path, homedir30);
-    if (!fs14.existsSync(repoPath)) {
+    if (!fs15.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -8388,7 +8579,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs14.writeFileSync(outPath, content);
+    fs15.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -8396,11 +8587,11 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path15.join(workspacePath, repo.name);
-    if (!fs14.existsSync(worktreePath))
+    const worktreePath = path16.join(workspacePath, repo.name);
+    if (!fs15.existsSync(worktreePath))
       continue;
     try {
-      execFileSync3("git", ["checkout", "--", "."], {
+      execFileSync5("git", ["checkout", "--", "."], {
         cwd: worktreePath,
         stdio: "pipe"
       });
@@ -8434,13 +8625,13 @@ var init_baseline_diff = __esm({
 });
 
 // ../core/dist/world/context-injection.js
-import * as fs15 from "node:fs";
-import * as path16 from "node:path";
+import * as fs16 from "node:fs";
+import * as path17 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function injectWorldContext(opts) {
   const { world, task, linearTicketId, claudeMdExtra, taskContext, services, pleriPlaneUrl } = opts;
-  const claudeDir = path16.join(world.workspacePath, ".claude");
-  fs15.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir = path17.join(world.workspacePath, ".claude");
+  fs16.mkdirSync(claudeDir, { recursive: true });
   const sections = [];
   sections.push(`# Olam World: ${world.name}`);
   sections.push("");
@@ -8541,16 +8732,16 @@ function injectWorldContext(opts) {
     sections.push("");
   }
   const content = sections.join("\n");
-  fs15.writeFileSync(path16.join(claudeDir, "CLAUDE.md"), content);
+  fs16.writeFileSync(path17.join(claudeDir, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path16.join(workspacePath, ".olam", "docs");
-  fs15.mkdirSync(docsDir, { recursive: true });
+  const docsDir = path17.join(workspacePath, ".olam", "docs");
+  fs16.mkdirSync(docsDir, { recursive: true });
   for (const filename of ["lane-orchestration.md", "gh-pr-create.md"]) {
-    const src = path16.join(TEMPLATES_DIR, filename);
-    const dest = path16.join(docsDir, filename);
-    fs15.copyFileSync(src, dest);
+    const src = path17.join(TEMPLATES_DIR, filename);
+    const dest = path17.join(docsDir, filename);
+    fs16.copyFileSync(src, dest);
   }
 }
 function formatTaskSource(ctx) {
@@ -8565,9 +8756,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path16.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path17.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs15.existsSync(plansDir) && fs15.readdirSync(plansDir).length > 0;
+    return fs16.existsSync(plansDir) && fs16.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -9163,35 +9354,35 @@ ${stderr}`);
 
 // ../core/dist/world/snapshot.js
 import * as crypto4 from "node:crypto";
-import * as fs16 from "node:fs";
+import * as fs17 from "node:fs";
 import * as os10 from "node:os";
-import * as path17 from "node:path";
-import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_process";
+import * as path18 from "node:path";
+import { execFileSync as execFileSync6, spawn as spawn2 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path17.join(os10.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path18.join(os10.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDir(worldId, kind) {
-  return path17.join(snapshotsDir(), worldId, kind);
+  return path18.join(snapshotsDir(), worldId, kind);
 }
 function snapshotKindDirByWorkspace(workspace, arch2, kind) {
-  return path17.join(snapshotsDir(), "by-workspace", workspace, arch2, kind);
+  return path18.join(snapshotsDir(), "by-workspace", workspace, arch2, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path17.join(snapshotsDir(), worldId);
+  const legacyDir = path18.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs16.existsSync(legacyDir))
+  if (!fs17.existsSync(legacyDir))
     return;
   try {
-    fs16.rmSync(legacyDir, { recursive: true, force: true });
+    fs17.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
 function snapshotTarPath(worldId, kind, repoName, hash, arch2) {
   const archSuffix = arch2 && (kind === "gems" || kind === "node") ? `-${arch2}` : "";
   const base = repoName ? `${repoName}${archSuffix}-${hash}` : hash;
-  return path17.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
+  return path18.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
 }
 function manifestPath(tarPath) {
   return tarPath.replace(/\.tar\.gz$/, ".manifest.json");
@@ -9208,11 +9399,11 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path17.join(repoDir, "Gemfile.lock");
-  if (!fs16.existsSync(lockfile))
+  const lockfile = path18.join(repoDir, "Gemfile.lock");
+  if (!fs17.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs16.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs17.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -9222,10 +9413,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path17.join(repoDir, name);
-    if (fs16.existsSync(lockfile)) {
+    const lockfile = path18.join(repoDir, name);
+    if (fs17.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs16.readFileSync(lockfile) }
+        { path: name, content: fs17.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -9240,27 +9431,27 @@ function computePgFingerprint(repoDirs) {
   const entries = [];
   for (const repoDir of repoDirs) {
     for (const pattern of patterns) {
-      const filePath = path17.join(repoDir, pattern);
-      if (fs16.existsSync(filePath)) {
-        entries.push({ path: filePath, content: fs16.readFileSync(filePath) });
+      const filePath = path18.join(repoDir, pattern);
+      if (fs17.existsSync(filePath)) {
+        entries.push({ path: filePath, content: fs17.readFileSync(filePath) });
       }
     }
   }
   return entries.length > 0 ? hashBuffers(entries) : null;
 }
 function packTarball(srcDir, destPath, opts = {}) {
-  fs16.mkdirSync(path17.dirname(destPath), { recursive: true });
+  fs17.mkdirSync(path18.dirname(destPath), { recursive: true });
   const tmp = `${destPath}.tmp`;
   const args = [];
   if (opts.followSymlinks)
     args.push("-h");
   args.push("-czf", tmp, "-C", srcDir, ".");
   try {
-    execFileSync4("tar", args, { stdio: "pipe" });
-    fs16.renameSync(tmp, destPath);
+    execFileSync6("tar", args, { stdio: "pipe" });
+    fs17.renameSync(tmp, destPath);
   } catch (err) {
     try {
-      fs16.rmSync(tmp, { force: true });
+      fs17.rmSync(tmp, { force: true });
     } catch {
     }
     throw err;
@@ -9275,18 +9466,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path17.dirname(destDir);
-  fs16.mkdirSync(parent, { recursive: true });
+  const parent = path18.dirname(destDir);
+  fs17.mkdirSync(parent, { recursive: true });
   const tmpSuffix = `.tmp-${process.pid}-${crypto4.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs16.mkdirSync(tmpDir, { recursive: true });
-    execFileSync4("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs16.renameSync(tmpDir, destDir);
+    fs17.mkdirSync(tmpDir, { recursive: true });
+    execFileSync6("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
+    fs17.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs16.rmSync(tmpDir, { recursive: true, force: true });
+      fs17.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -9297,12 +9488,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path17.resolve(base, target);
-  const baseResolved = path17.resolve(base);
-  const rel = path17.relative(baseResolved, resolved);
+  const resolved = path18.resolve(base, target);
+  const baseResolved = path18.resolve(base);
+  const rel = path18.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path17.isAbsolute(rel);
+  return !rel.startsWith("..") && !path18.isAbsolute(rel);
 }
 function parseTarListLine(line) {
   const trimmed = line.trimEnd();
@@ -9345,7 +9536,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs16.readFileSync(tarPath));
+    raw = gunzipSync(fs17.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -9360,7 +9551,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path17.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path18.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -9378,7 +9569,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
 function enumerateAndValidateTarballEntries(tarPath, targetDir) {
   let raw;
   try {
-    raw = execFileSync4("tar", ["-tvf", tarPath], {
+    raw = execFileSync6("tar", ["-tvf", tarPath], {
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
       encoding: "utf-8",
@@ -9398,7 +9589,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path17.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path18.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -9406,8 +9597,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path17.join(targetDir, path17.dirname(entry.name));
-      if (path17.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path17.join(path17.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path18.join(targetDir, path18.dirname(entry.name));
+      if (path18.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path18.join(path18.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -9417,7 +9608,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path17.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path18.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -9446,8 +9637,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path17.join(archDir, tarFilename);
-      if (!fs16.existsSync(tarPath)) {
+      const tarPath = path18.join(archDir, tarFilename);
+      if (!fs17.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -9462,9 +9653,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path17.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path18.join(repo.worktreeDir, targetSubpath);
       try {
-        fs16.rmSync(targetDir, { recursive: true, force: true });
+        fs17.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -9477,8 +9668,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs16.rmSync(tarPath, { force: true });
-          fs16.rmSync(manifestPath(tarPath), { force: true });
+          fs17.rmSync(tarPath, { force: true });
+          fs17.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -9493,37 +9684,37 @@ function restoreSnapshotsForRepos(input) {
   return { restored, outcomes };
 }
 function writeManifest(manifest, tarPath) {
-  fs16.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
+  fs17.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs16.existsSync(mPath))
+  if (!fs17.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs16.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs17.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
 }
 function listSnapshots(worldIdFilter) {
   const root = snapshotsDir();
-  if (!fs16.existsSync(root))
+  if (!fs17.existsSync(root))
     return [];
   const now = Date.now();
   const results = [];
-  const worlds = worldIdFilter ? [worldIdFilter] : fs16.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  const worlds = worldIdFilter ? [worldIdFilter] : fs17.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   for (const worldId of worlds) {
-    const worldDir = path17.join(root, worldId);
-    if (!fs16.existsSync(worldDir) || !fs16.statSync(worldDir).isDirectory())
+    const worldDir = path18.join(root, worldId);
+    if (!fs17.existsSync(worldDir) || !fs17.statSync(worldDir).isDirectory())
       continue;
     for (const kind of ["gems", "node", "pg"]) {
-      const kindDir = path17.join(worldDir, kind);
-      if (!fs16.existsSync(kindDir))
+      const kindDir = path18.join(worldDir, kind);
+      if (!fs17.existsSync(kindDir))
         continue;
-      const tarballs = fs16.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
+      const tarballs = fs17.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
       for (const tarFile of tarballs) {
-        const tarPath = path17.join(kindDir, tarFile);
-        const stat = fs16.statSync(tarPath);
+        const tarPath = path18.join(kindDir, tarFile);
+        const stat = fs17.statSync(tarPath);
         const manifest = readManifest(tarPath);
         if (!manifest)
           continue;
@@ -9542,17 +9733,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs16.mkdirSync(dir, { recursive: true });
-  const lockPath = path17.join(dir, EVICT_LOCK_FILENAME);
+  fs17.mkdirSync(dir, { recursive: true });
+  const lockPath = path18.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs16.openSync(lockPath, fs16.constants.O_WRONLY | fs16.constants.O_CREAT | fs16.constants.O_EXCL, 384);
+    fd = fs17.openSync(lockPath, fs17.constants.O_WRONLY | fs17.constants.O_CREAT | fs17.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs16.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs17.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -9560,23 +9751,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs16.unlinkSync(lockPath);
-      fd = fs16.openSync(lockPath, fs16.constants.O_WRONLY | fs16.constants.O_CREAT | fs16.constants.O_EXCL, 384);
+      fs17.unlinkSync(lockPath);
+      fd = fs17.openSync(lockPath, fs17.constants.O_WRONLY | fs17.constants.O_CREAT | fs17.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs16.writeSync(fd, `${process.pid}
+    fs17.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs16.closeSync(fd);
+    fs17.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs16.unlinkSync(lockPath);
+      fs17.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -9609,16 +9800,16 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs16.existsSync(dir))
+  if (!fs17.existsSync(dir))
     return 0;
   const allTars = [];
   const walk2 = (d) => {
-    for (const entry of fs16.readdirSync(d, { withFileTypes: true })) {
-      const full = path17.join(d, entry.name);
+    for (const entry of fs17.readdirSync(d, { withFileTypes: true })) {
+      const full = path18.join(d, entry.name);
       if (entry.isDirectory()) {
         walk2(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat = fs16.statSync(full);
+        const stat = fs17.statSync(full);
         allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
       }
     }
@@ -9633,8 +9824,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs16.rmSync(tar.path, { force: true });
-    fs16.rmSync(manifestPath(tar.path), { force: true });
+    fs17.rmSync(tar.path, { force: true });
+    fs17.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -9774,14 +9965,14 @@ var init_secrets_fetcher = __esm({
 });
 
 // ../core/dist/world/olam-yaml.js
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path18.join(workspacePath, repo.name);
+    const repoDir = path19.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -9802,8 +9993,8 @@ var init_olam_yaml = __esm({
 });
 
 // ../core/dist/policies/loader.js
-import * as fs17 from "node:fs";
-import * as path19 from "node:path";
+import * as fs18 from "node:fs";
+import * as path20 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function parseFrontmatter(content) {
   const match2 = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -9823,20 +10014,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path19.join(workspaceRoot, ".olam", "policies");
-  if (!fs17.existsSync(policiesDir))
+  const policiesDir = path20.join(workspaceRoot, ".olam", "policies");
+  if (!fs18.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs17.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs18.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path19.join(policiesDir, file);
+    const filePath = path20.join(policiesDir, file);
     try {
-      const content = fs17.readFileSync(filePath, "utf8");
+      const content = fs18.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -9972,23 +10163,23 @@ var init_schema3 = __esm({
 });
 
 // ../core/dist/global-config/store.js
-import * as fs18 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os11 from "node:os";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 function globalConfigPath() {
   const override = process.env["OLAM_GLOBAL_CONFIG_PATH"];
   if (override && override.length > 0)
     return override;
-  return path20.join(os11.homedir(), ".olam", "config.json");
+  return path21.join(os11.homedir(), ".olam", "config.json");
 }
 function readGlobalConfig() {
   const configPath = globalConfigPath();
-  if (!fs18.existsSync(configPath)) {
+  if (!fs19.existsSync(configPath)) {
     return { ...DEFAULT_GLOBAL_CONFIG };
   }
   let raw;
   try {
-    raw = fs18.readFileSync(configPath, "utf-8");
+    raw = fs19.readFileSync(configPath, "utf-8");
   } catch (err) {
     throw new GlobalConfigReadError(configPath, err);
   }
@@ -10007,11 +10198,11 @@ function readGlobalConfig() {
 function writeGlobalConfig(config) {
   const configPath = globalConfigPath();
   const validated = GlobalConfigSchema.parse(config);
-  const dir = path20.dirname(configPath);
-  fs18.mkdirSync(dir, { recursive: true });
+  const dir = path21.dirname(configPath);
+  fs19.mkdirSync(dir, { recursive: true });
   const tmp = `${configPath}.tmp-${process.pid}`;
-  fs18.writeFileSync(tmp, JSON.stringify(validated, null, 2) + "\n", { mode: 420 });
-  fs18.renameSync(tmp, configPath);
+  fs19.writeFileSync(tmp, JSON.stringify(validated, null, 2) + "\n", { mode: 420 });
+  fs19.renameSync(tmp, configPath);
 }
 var GlobalConfigReadError;
 var init_store2 = __esm({
@@ -10121,7 +10312,7 @@ var init_runbooks = __esm({
 });
 
 // ../core/dist/global-config/bridge.js
-import * as fs19 from "node:fs";
+import * as fs20 from "node:fs";
 function repoEntryToRepoConfig(entry) {
   if (!entry.url) {
     throw new Error(`Repo "${entry.name}" has no url. Re-register:
@@ -10129,7 +10320,7 @@ function repoEntryToRepoConfig(entry) {
   olam repos add ${entry.name} --path ${entry.path}`);
   }
   const repoPath = resolveTildePath(entry.path);
-  if (!fs19.existsSync(repoPath)) {
+  if (!fs20.existsSync(repoPath)) {
     throw new Error(`Repo "${entry.name}" path "${repoPath}" no longer exists. Run: olam repos update ${entry.name} --path <new-path>`);
   }
   let manifest = null;
@@ -10160,12 +10351,12 @@ var init_bridge = __esm({
 });
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs20 from "node:fs";
+import * as fs21 from "node:fs";
 import * as os12 from "node:os";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path21.join(os12.homedir(), p.slice(1));
+    return path22.join(os12.homedir(), p.slice(1));
   }
   return p;
 }
@@ -10177,7 +10368,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs20.existsSync(resolvedPath)) {
+    if (!fs21.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -10277,19 +10468,19 @@ var init_port_validator = __esm({
 });
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs21 from "node:fs";
-import * as path22 from "node:path";
+import * as fs22 from "node:fs";
+import * as path23 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path22.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path22.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path22.dirname(destAbs);
-    fs21.mkdirSync(destDir, { recursive: true });
-    fs21.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path23.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path23.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path23.dirname(destAbs);
+    fs22.mkdirSync(destDir, { recursive: true });
+    fs22.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -10477,9 +10668,9 @@ __export(manager_exports, {
 });
 import * as crypto5 from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
-import * as fs22 from "node:fs";
+import * as fs23 from "node:fs";
 import * as os13 from "node:os";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 import YAML3 from "yaml";
 function getTokenScopes(ghToken, _exec = execSync5) {
   try {
@@ -10905,6 +11096,8 @@ var init_manager = __esm({
     init_devbox_image();
     init_worktree();
     init_env_setup();
+    init_kg_overlay();
+    init_kg_install_hook();
     init_baseline_diff();
     init_context_injection();
     init_stack_detect();
@@ -10999,7 +11192,7 @@ ${detail}`);
           runbookSeeds = resolved.seeds;
         }
         const worldId = generateWorldId();
-        const workspacePath = path23.join(os13.homedir(), ".olam", "worlds", worldId);
+        const workspacePath = path24.join(os13.homedir(), ".olam", "worlds", worldId);
         const portOffset = this.registry.getNextPortOffset();
         const branch = opts.branchName ?? `olam/${worldId}`;
         const repos = this.resolveReposWithWorkspace(opts);
@@ -11069,37 +11262,37 @@ ${detail}`);
           if (!repo.path)
             continue;
           const sourceRoot = repo.path.replace(/^~/, os13.homedir());
-          const worktreeRoot = path23.join(workspacePath, repo.name);
-          if (!fs22.existsSync(sourceRoot) || !fs22.existsSync(worktreeRoot))
+          const worktreeRoot = path24.join(workspacePath, repo.name);
+          if (!fs23.existsSync(sourceRoot) || !fs23.existsSync(worktreeRoot))
             continue;
           let copied = 0;
           for (const pattern of RUNTIME_FILE_PATTERNS) {
             const matches2 = [];
             if (pattern.includes("*")) {
-              const [dir, glob] = [path23.dirname(pattern), path23.basename(pattern)];
-              const sourceDir = path23.join(sourceRoot, dir);
-              if (fs22.existsSync(sourceDir)) {
+              const [dir, glob] = [path24.dirname(pattern), path24.basename(pattern)];
+              const sourceDir = path24.join(sourceRoot, dir);
+              if (fs23.existsSync(sourceDir)) {
                 const ext2 = glob.replace(/^\*+/, "");
                 try {
-                  for (const entry of fs22.readdirSync(sourceDir)) {
+                  for (const entry of fs23.readdirSync(sourceDir)) {
                     if (ext2 === "" || entry.endsWith(ext2))
-                      matches2.push(path23.join(dir, entry));
+                      matches2.push(path24.join(dir, entry));
                   }
                 } catch {
                 }
               }
-            } else if (fs22.existsSync(path23.join(sourceRoot, pattern))) {
+            } else if (fs23.existsSync(path24.join(sourceRoot, pattern))) {
               matches2.push(pattern);
             }
             for (const rel of matches2) {
-              const src = path23.join(sourceRoot, rel);
-              const dst = path23.join(worktreeRoot, rel);
+              const src = path24.join(sourceRoot, rel);
+              const dst = path24.join(worktreeRoot, rel);
               try {
-                const st = fs22.statSync(src);
+                const st = fs23.statSync(src);
                 if (!st.isFile())
                   continue;
-                fs22.mkdirSync(path23.dirname(dst), { recursive: true });
-                fs22.copyFileSync(src, dst);
+                fs23.mkdirSync(path24.dirname(dst), { recursive: true });
+                fs23.copyFileSync(src, dst);
                 copied++;
               } catch {
               }
@@ -11183,6 +11376,24 @@ ${detail}`);
             console.warn(`[WorldManager] context injection failed: ${msg}`);
           }
         }
+        const overlayAttachments = [];
+        for (const repo of repos) {
+          const worldClonePath = path24.join(workspacePath, repo.name);
+          try {
+            const result = createWorldOverlay({
+              workspace: repo.name,
+              worldClonePath
+            });
+            overlayAttachments.push({ repo: repo.name, overlayPath: result.overlayPath });
+            console.log(`[WorldManager] KG overlay attached for ${repo.name}: ${result.strategy} (.gitignore: ${result.gitignoreAction})`);
+          } catch (err) {
+            if (err instanceof KgOverlayError && /pristine.*not found|MISSING/i.test(err.message)) {
+              continue;
+            }
+            const msg = err instanceof Error ? err.message : String(err);
+            console.warn(`[WorldManager] KG overlay attach failed for ${repo.name}: ${msg}`);
+          }
+        }
         if (opts.planFile) {
           try {
             this.transportPlanFile(opts.planFile, workspacePath, repos.map((r) => r.name));
@@ -11199,7 +11410,7 @@ ${detail}`);
           try {
             const hostExec = makeHostExecFn();
             for (const repo of repos) {
-              const repoDir = path23.join(workspacePath, repo.name);
+              const repoDir = path24.join(workspacePath, repo.name);
               if (repo.stack && Object.keys(repo.stack).length > 0) {
                 preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
               } else {
@@ -11265,10 +11476,10 @@ ${detail}`);
           const worldEnv = {};
           if (opts.task)
             worldEnv.OLAM_TASK = opts.task;
-          const r2CredsPath = path23.join(os13.homedir(), ".olam", "r2-credentials.json");
-          if (fs22.existsSync(r2CredsPath)) {
+          const r2CredsPath = path24.join(os13.homedir(), ".olam", "r2-credentials.json");
+          if (fs23.existsSync(r2CredsPath)) {
             try {
-              const r2Raw = fs22.readFileSync(r2CredsPath, "utf-8").trim();
+              const r2Raw = fs23.readFileSync(r2CredsPath, "utf-8").trim();
               if (r2Raw.length > 0) {
                 const r2 = JSON.parse(r2Raw);
                 if (typeof r2.account_id === "string")
@@ -11285,10 +11496,10 @@ ${detail}`);
             } catch {
             }
           }
-          const keysYamlPath = path23.join(os13.homedir(), ".olam", "keys.yaml");
-          if (fs22.existsSync(keysYamlPath)) {
+          const keysYamlPath = path24.join(os13.homedir(), ".olam", "keys.yaml");
+          if (fs23.existsSync(keysYamlPath)) {
             try {
-              const keysRaw = fs22.readFileSync(keysYamlPath, "utf-8").trim();
+              const keysRaw = fs23.readFileSync(keysYamlPath, "utf-8").trim();
               if (keysRaw.length > 0) {
                 const parsed = YAML3.parse(keysRaw);
                 if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -11347,10 +11558,10 @@ ${detail}`);
                 worldEnv[k] = v;
             }
             for (const { repoName, relativePath, content } of fileWrites) {
-              const absPath = path23.join(workspacePath, repoName, relativePath);
+              const absPath = path24.join(workspacePath, repoName, relativePath);
               try {
-                fs22.mkdirSync(path23.dirname(absPath), { recursive: true });
-                fs22.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+                fs23.mkdirSync(path24.dirname(absPath), { recursive: true });
+                fs23.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
                   mode: 384
                 });
                 console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -11401,6 +11612,15 @@ ${detail}`);
           await copyClaudeConfigIntoContainer(containerName);
         } catch {
         }
+        for (const { repo: repoName } of overlayAttachments) {
+          try {
+            installGraphifyHookInWorld({ containerName, repoName });
+            console.log(`[WorldManager] KG hook installed for ${repoName}`);
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.warn(`[WorldManager] KG hook install failed for ${repoName}: ${msg}`);
+          }
+        }
         const credentialsInjected = { claude: !opts.noAuth, codex: false };
         try {
           await setupContainerGit(containerName, repos, branch);
@@ -11465,7 +11685,7 @@ ${detail}`);
             imageDigest: void 0,
             repos: enrichedRepos.map((r) => ({
               name: r.name,
-              worktreeDir: path23.join(workspacePath, r.name)
+              worktreeDir: path24.join(workspacePath, r.name)
             }))
           });
           for (const out of restoreResult.outcomes) {
@@ -11578,7 +11798,7 @@ ${detail}`);
             let taskWithPolicies = opts.task;
             try {
               const allPolicies = repos.flatMap((repo) => {
-                const repoWorktree = path23.join(workspacePath, repo.name);
+                const repoWorktree = path24.join(workspacePath, repo.name);
                 return loadPolicies(repoWorktree);
               });
               const seen = /* @__PURE__ */ new Set();
@@ -11594,8 +11814,8 @@ ${detail}`);
 ${opts.task}`;
                 execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
                 for (const repo of repos) {
-                  const policiesDir = path23.join(workspacePath, repo.name, ".olam", "policies");
-                  if (fs22.existsSync(policiesDir)) {
+                  const policiesDir = path24.join(workspacePath, repo.name, ".olam", "policies");
+                  if (fs23.existsSync(policiesDir)) {
                     execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
                   }
                 }
@@ -11695,8 +11915,8 @@ ${opts.task}`;
         } catch {
         }
         try {
-          fs22.rmSync(world.workspacePath, { recursive: true, force: true });
-          if (fs22.existsSync(world.workspacePath)) {
+          fs23.rmSync(world.workspacePath, { recursive: true, force: true });
+          if (fs23.existsSync(world.workspacePath)) {
             console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
           }
         } catch (err) {
@@ -11805,14 +12025,14 @@ ${opts.task}`;
         }).filter((r) => r !== void 0);
       }
       transportPlanFile(planFilePath, workspacePath, repoNames) {
-        const planContent = fs22.readFileSync(planFilePath, "utf-8");
-        const planFileName = path23.basename(planFilePath);
+        const planContent = fs23.readFileSync(planFilePath, "utf-8");
+        const planFileName = path24.basename(planFilePath);
         const targetRepo = repoNames[0];
         if (!targetRepo)
           return;
-        const plansDir = path23.join(workspacePath, targetRepo, "docs", "plans");
-        fs22.mkdirSync(plansDir, { recursive: true });
-        fs22.writeFileSync(path23.join(plansDir, planFileName), planContent);
+        const plansDir = path24.join(workspacePath, targetRepo, "docs", "plans");
+        fs23.mkdirSync(plansDir, { recursive: true });
+        fs23.writeFileSync(path24.join(plansDir, planFileName), planContent);
       }
       resolveServices(repos) {
         const services = [];
@@ -11905,9 +12125,9 @@ var init_tracker = __esm({
 });
 
 // ../core/dist/world-paths.js
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 function getWorldDbPath(workspacePath) {
-  return path24.join(workspacePath, WORLD_DB_FILENAME);
+  return path25.join(workspacePath, WORLD_DB_FILENAME);
 }
 var WORLD_DB_FILENAME;
 var init_world_paths = __esm({
@@ -12525,8 +12745,8 @@ var init_session_aggregator = __esm({
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs23 from "node:fs";
-import * as path25 from "node:path";
+import * as fs24 from "node:fs";
+import * as path26 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function jsonResponse(res, data, status = 200) {
   res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
@@ -12537,7 +12757,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs23.existsSync(dbPath))
+  if (!fs24.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -12708,13 +12928,13 @@ function findSessionInWorld(registry, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port, registry } = opts;
-  const thisDir = path25.dirname(fileURLToPath4(import.meta.url));
-  const defaultPublicDir = path25.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path26.dirname(fileURLToPath4(import.meta.url));
+  const defaultPublicDir = path26.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs23.existsSync(publicDir);
+  let hasPublicDir = fs24.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs23.existsSync(publicDir);
+      hasPublicDir = fs24.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port}`;
     const url = new URL(req.url ?? "/", `http://${host}`);
@@ -12988,22 +13208,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path25.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path26.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs23.existsSync(filePath) && fs23.statSync(filePath).isFile()) {
-      const ext2 = path25.extname(filePath);
+    if (fs24.existsSync(filePath) && fs24.statSync(filePath).isFile()) {
+      const ext2 = path26.extname(filePath);
       const contentType = MIME[ext2] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs23.createReadStream(filePath).pipe(res);
+      fs24.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path25.join(publicDir, "index.html");
-    if (fs23.existsSync(filePath)) {
+    filePath = path26.join(publicDir, "index.html");
+    if (fs24.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs23.createReadStream(filePath).pipe(res);
+      fs24.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -13034,16 +13254,16 @@ var init_server = __esm({
 });
 
 // ../core/dist/dashboard/state.js
-import * as fs24 from "node:fs";
+import * as fs25 from "node:fs";
 import * as os14 from "node:os";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 function saveDashboardState(state) {
-  fs24.mkdirSync(path26.dirname(STATE_PATH), { recursive: true });
-  fs24.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs25.mkdirSync(path27.dirname(STATE_PATH), { recursive: true });
+  fs25.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs24.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs25.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -13051,7 +13271,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs24.unlinkSync(STATE_PATH);
+    fs25.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -13071,7 +13291,7 @@ var STATE_PATH;
 var init_state2 = __esm({
   "../core/dist/dashboard/state.js"() {
     "use strict";
-    STATE_PATH = path26.join(os14.homedir(), ".olam", "dashboard.json");
+    STATE_PATH = path27.join(os14.homedir(), ".olam", "dashboard.json");
   }
 });
 
@@ -13466,50 +13686,50 @@ __export(host_cp_exports, {
   writeToken: () => writeToken
 });
 import * as crypto6 from "node:crypto";
-import * as fs25 from "node:fs";
+import * as fs26 from "node:fs";
 import * as os15 from "node:os";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import Dockerode2 from "dockerode";
 function findComposeFile() {
   const candidates = [
     // Bundled path: dist/index.js lives at <pkg>/dist/; host-cp/ is a sibling of dist/
-    path27.resolve(path27.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
+    path28.resolve(path28.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
     // Source-mode: cwd is monorepo root
-    path27.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
+    path28.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
     // Source-mode: cwd is one level inside the monorepo
-    path27.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
+    path28.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
   ];
   for (const c of candidates) {
-    if (fs25.existsSync(c)) return c;
+    if (fs26.existsSync(c)) return c;
   }
-  return path27.resolve(process.cwd(), "packages/host-cp/compose.yaml");
+  return path28.resolve(process.cwd(), "packages/host-cp/compose.yaml");
 }
-function olamHome() {
-  return process.env.OLAM_HOME ?? path27.join(os15.homedir(), ".olam");
+function olamHome2() {
+  return process.env.OLAM_HOME ?? path28.join(os15.homedir(), ".olam");
 }
 function tokenPath() {
-  return path27.join(olamHome(), "host-cp.token");
+  return path28.join(olamHome2(), "host-cp.token");
 }
 function pidPath() {
-  return path27.join(olamHome(), "host-cp.pid");
+  return path28.join(olamHome2(), "host-cp.pid");
 }
 function authSecretPath() {
-  return path27.join(olamHome(), "auth-secret");
+  return path28.join(olamHome2(), "auth-secret");
 }
 function readAuthSecret2() {
   const filePath = authSecretPath();
-  if (!fs25.existsSync(filePath)) return null;
-  const raw = fs25.readFileSync(filePath, "utf-8").trim();
+  if (!fs26.existsSync(filePath)) return null;
+  const raw = fs26.readFileSync(filePath, "utf-8").trim();
   return raw.length > 0 ? raw : null;
 }
 function r2CredentialsPath() {
-  return path27.join(olamHome(), "r2-credentials.json");
+  return path28.join(olamHome2(), "r2-credentials.json");
 }
 function readR2Credentials() {
   const filePath = r2CredentialsPath();
-  if (!fs25.existsSync(filePath)) return null;
-  const raw = fs25.readFileSync(filePath, "utf-8").trim();
+  if (!fs26.existsSync(filePath)) return null;
+  const raw = fs26.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = JSON.parse(raw);
@@ -13532,37 +13752,37 @@ function readR2Credentials() {
 function writeToken() {
   const token = crypto6.randomBytes(32).toString("hex");
   const filePath = tokenPath();
-  fs25.mkdirSync(path27.dirname(filePath), { recursive: true });
-  fs25.writeFileSync(filePath, token, { mode: 384 });
+  fs26.mkdirSync(path28.dirname(filePath), { recursive: true });
+  fs26.writeFileSync(filePath, token, { mode: 384 });
   return token;
 }
 function readToken() {
   const filePath = tokenPath();
-  if (!fs25.existsSync(filePath)) return null;
-  return fs25.readFileSync(filePath, "utf-8").trim();
+  if (!fs26.existsSync(filePath)) return null;
+  return fs26.readFileSync(filePath, "utf-8").trim();
 }
 function removeToken() {
   const filePath = tokenPath();
-  if (!fs25.existsSync(filePath)) return false;
-  fs25.unlinkSync(filePath);
+  if (!fs26.existsSync(filePath)) return false;
+  fs26.unlinkSync(filePath);
   return true;
 }
 function writePid(pid) {
   const filePath = pidPath();
-  fs25.mkdirSync(path27.dirname(filePath), { recursive: true });
-  fs25.writeFileSync(filePath, String(pid), { mode: 420 });
+  fs26.mkdirSync(path28.dirname(filePath), { recursive: true });
+  fs26.writeFileSync(filePath, String(pid), { mode: 420 });
 }
 function readPid() {
   const filePath = pidPath();
-  if (!fs25.existsSync(filePath)) return null;
-  const raw = fs25.readFileSync(filePath, "utf-8").trim();
+  if (!fs26.existsSync(filePath)) return null;
+  const raw = fs26.readFileSync(filePath, "utf-8").trim();
   const n = parseInt(raw, 10);
   return Number.isFinite(n) ? n : null;
 }
 function removePid() {
   const filePath = pidPath();
-  if (!fs25.existsSync(filePath)) return false;
-  fs25.unlinkSync(filePath);
+  if (!fs26.existsSync(filePath)) return false;
+  fs26.unlinkSync(filePath);
   return true;
 }
 async function findHostCpContainer() {
@@ -13725,7 +13945,7 @@ async function handleStart(opts) {
   }
   const token = writeToken();
   const composeFile = findComposeFile();
-  if (!fs25.existsSync(composeFile)) {
+  if (!fs26.existsSync(composeFile)) {
     printError(`compose.yaml not found at ${composeFile}. Run from the olam project root.`);
     removeToken();
     process.exitCode = 1;
@@ -13807,7 +14027,7 @@ async function stopHostCp() {
 }
 async function handleStop() {
   const composeFile = findComposeFile();
-  if (!fs25.existsSync(composeFile)) {
+  if (!fs26.existsSync(composeFile)) {
     printWarning(`compose.yaml not found at ${composeFile}. Cleaning up token + PID anyway.`);
     removeToken();
     removePid();
@@ -13835,13 +14055,13 @@ async function buildStatusReport() {
   const container = await findHostCpContainer();
   const health = await probeHealth();
   const tokenFile = tokenPath();
-  const tokenPresent = fs25.existsSync(tokenFile);
+  const tokenPresent = fs26.existsSync(tokenFile);
   let tokenModeOk = false;
   if (tokenPresent) {
-    const mode = fs25.statSync(tokenFile).mode & 511;
+    const mode = fs26.statSync(tokenFile).mode & 511;
     tokenModeOk = mode === 384;
   }
-  const pidPresent = fs25.existsSync(pidPath());
+  const pidPresent = fs26.existsSync(pidPath());
   let stack;
   if (!container) {
     stack = "not_started";
@@ -13929,13 +14149,13 @@ async function discoverWorldPort(worldId) {
 }
 async function readHostCpToken2() {
   const tp = tokenPath();
-  if (!fs25.existsSync(tp)) return null;
-  return fs25.readFileSync(tp, "utf-8").trim();
+  if (!fs26.existsSync(tp)) return null;
+  return fs26.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path55, body) {
+async function callHostCpProxy(method, worldId, path56, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path55}`;
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path56}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -14061,25 +14281,25 @@ __export(install_root_exports, {
   isDevMode: () => isDevMode,
   resolveBuildScript: () => resolveBuildScript
 });
-import { existsSync as existsSync23 } from "node:fs";
-import { dirname as dirname17, join as join28, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { dirname as dirname17, join as join30, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function installRoot(metaUrl = import.meta.url) {
   const here2 = fileURLToPath5(metaUrl);
-  return resolve8(dirname17(here2), "..");
+  return resolve9(dirname17(here2), "..");
 }
 function isDevMode(env = process.env, installRootDir = installRoot()) {
   if (env.OLAM_DEV !== "1") return false;
-  const repoRoot = resolve8(installRootDir, "..", "..");
-  return existsSync23(join28(repoRoot, "packages")) && existsSync23(join28(repoRoot, "package.json"));
+  const repoRoot = resolve9(installRootDir, "..", "..");
+  return existsSync24(join30(repoRoot, "packages")) && existsSync24(join30(repoRoot, "package.json"));
 }
 function resolveBuildScript(input) {
   const { scriptRelPath, env = process.env, installRootDir = installRoot() } = input;
   if (!isDevMode(env, installRootDir)) {
     throw new MissingBuildScriptError(scriptRelPath);
   }
-  const repoRoot = resolve8(installRootDir, "..", "..");
-  return join28(repoRoot, scriptRelPath);
+  const repoRoot = resolve9(installRootDir, "..", "..");
+  return join30(repoRoot, scriptRelPath);
 }
 var MissingBuildScriptError;
 var init_install_root = __esm({
@@ -14250,20 +14470,20 @@ var init_registry_allowlist = __esm({
 });
 
 // ../core/dist/world/world-yaml.js
-import * as fs27 from "node:fs";
-import * as path29 from "node:path";
+import * as fs28 from "node:fs";
+import * as path30 from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
 function writeWorldYaml(worldPath, data) {
-  const olamDir = path29.join(worldPath, ".olam");
-  fs27.mkdirSync(olamDir, { recursive: true });
-  fs27.writeFileSync(path29.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
+  const olamDir = path30.join(worldPath, ".olam");
+  fs28.mkdirSync(olamDir, { recursive: true });
+  fs28.writeFileSync(path30.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
 }
 function readWorldYaml(worldPath) {
-  const yamlPath = path29.join(worldPath, ".olam", "world.yaml");
-  if (!fs27.existsSync(yamlPath))
+  const yamlPath = path30.join(worldPath, ".olam", "world.yaml");
+  if (!fs28.existsSync(yamlPath))
     return null;
   try {
-    const raw = fs27.readFileSync(yamlPath, "utf-8");
+    const raw = fs28.readFileSync(yamlPath, "utf-8");
     const parsed = parseYaml4(raw);
     return WorldYamlSchema.parse(parsed);
   } catch {
@@ -14394,16 +14614,16 @@ __export(machine_schema_exports, {
   readMachineConfig: () => readMachineConfig,
   writeMachineConfig: () => writeMachineConfig
 });
-import * as fs41 from "node:fs";
-import * as path47 from "node:path";
+import * as fs42 from "node:fs";
+import * as path48 from "node:path";
 import * as os24 from "node:os";
 import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
 function readMachineConfig(configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  if (!fs41.existsSync(p))
+  if (!fs42.existsSync(p))
     return null;
   try {
-    const raw = fs41.readFileSync(p, "utf-8");
+    const raw = fs42.readFileSync(p, "utf-8");
     const parsed = parseYaml5(raw);
     return MachineConfigSchema.parse(parsed);
   } catch {
@@ -14412,8 +14632,8 @@ function readMachineConfig(configPath) {
 }
 function writeMachineConfig(config, configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  fs41.mkdirSync(path47.dirname(p), { recursive: true });
-  fs41.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
+  fs42.mkdirSync(path48.dirname(p), { recursive: true });
+  fs42.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
 }
 function initMachineConfig(opts = {}) {
   const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
@@ -14436,9 +14656,9 @@ var init_machine_schema = __esm({
       channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
       auto_update: external_exports.boolean().default(true),
       telemetry: external_exports.boolean().default(true),
-      worlds_dir: external_exports.string().default(() => path47.join(os24.homedir(), ".olam", "worlds"))
+      worlds_dir: external_exports.string().default(() => path48.join(os24.homedir(), ".olam", "worlds"))
     });
-    DEFAULT_CONFIG_PATH = path47.join(os24.homedir(), ".olam", "config.yaml");
+    DEFAULT_CONFIG_PATH = path48.join(os24.homedir(), ".olam", "config.yaml");
   }
 });
 
@@ -14820,9 +15040,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path55) {
-    super(`Archetype inheritance cycle detected: ${path55.join(" \u2192 ")} \u2192 ${path55[0] ?? "?"}`);
-    this.path = path55;
+  constructor(path56) {
+    super(`Archetype inheritance cycle detected: ${path56.join(" \u2192 ")} \u2192 ${path56[0] ?? "?"}`);
+    this.path = path56;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -15034,8 +15254,8 @@ var LOCAL_DATA_DIR = path10.join(os5.homedir(), ".olam", "auth-data");
 init_output();
 init_host_cp();
 init_auth();
-import * as fs26 from "node:fs";
-import * as path28 from "node:path";
+import * as fs27 from "node:fs";
+import * as path29 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 import ora2 from "ora";
 import pc7 from "picocolors";
@@ -15047,20 +15267,20 @@ init_exit_codes();
 init_protocol_version();
 init_output();
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync24, readFileSync as readFileSync18 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync19 } from "node:fs";
+import { join as join31 } from "node:path";
 import ora from "ora";
 import pc6 from "picocolors";
 function loadImageDigests(installRootDir = installRoot()) {
-  const digestsPath = join29(installRootDir, "dist", "image-digests.json");
-  if (!existsSync24(digestsPath)) {
+  const digestsPath = join31(installRootDir, "dist", "image-digests.json");
+  if (!existsSync25(digestsPath)) {
     throw new Error(
       `image-digests.json missing at ${digestsPath}. Re-run \`npm install -g @pleri/olam-cli@<version>\` to refresh the tarball.`
     );
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync18(digestsPath, "utf8"));
+    parsed = JSON.parse(readFileSync19(digestsPath, "utf8"));
   } catch (err) {
     throw new Error(`image-digests.json is not valid JSON: ${err.message}`);
   }
@@ -15316,8 +15536,8 @@ function parseAuthUpgradeOpts(raw) {
   };
 }
 function validateAuthRepoRoot(cwd) {
-  const marker = path28.join(cwd, "packages/auth-service/Dockerfile");
-  if (!fs26.existsSync(marker)) {
+  const marker = path29.join(cwd, "packages/auth-service/Dockerfile");
+  if (!fs27.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -15687,7 +15907,7 @@ function registerAuthUpgrade(auth) {
 // src/commands/services.ts
 init_auth();
 init_output();
-import { execFileSync as execFileSync5, spawnSync as spawnSync8 } from "node:child_process";
+import { execFileSync as execFileSync7, spawnSync as spawnSync8 } from "node:child_process";
 import pc8 from "picocolors";
 var MCP_AUTH_PORT = 9998;
 var MCP_AUTH_VOLUME = "olam-mcp-auth-data";
@@ -15721,7 +15941,7 @@ var McpAuthContainerController = class {
     const current = this.status();
     if (current.state === "running") return;
     if (current.state === "stopped") {
-      execFileSync5("docker", ["start", MCP_AUTH_CONTAINER], { stdio: "pipe" });
+      execFileSync7("docker", ["start", MCP_AUTH_CONTAINER], { stdio: "pipe" });
       return;
     }
     if (!this.imageExists()) {
@@ -15733,7 +15953,7 @@ var McpAuthContainerController = class {
         );
       }
     }
-    execFileSync5(
+    execFileSync7(
       "docker",
       [
         "run",
@@ -15754,7 +15974,7 @@ var McpAuthContainerController = class {
   stop() {
     const current = this.status();
     if (current.state !== "running") return;
-    execFileSync5("docker", ["stop", MCP_AUTH_CONTAINER], { stdio: "pipe" });
+    execFileSync7("docker", ["stop", MCP_AUTH_CONTAINER], { stdio: "pipe" });
   }
   remove() {
     spawnSync8("docker", ["rm", "-f", MCP_AUTH_CONTAINER], { stdio: "pipe" });
@@ -16051,15 +16271,15 @@ ${pc9.dim("Next: olam create --name my-world")}`);
 // src/commands/create.ts
 init_manager();
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { existsSync as existsSync27 } from "node:fs";
-import { dirname as dirname18, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync28 } from "node:fs";
+import { dirname as dirname18, resolve as resolve10 } from "node:path";
 import ora3 from "ora";
 import pc10 from "picocolors";
 
 // ../core/dist/world/devbox-freshness.js
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync26, statSync as statSync6 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync27, statSync as statSync6 } from "node:fs";
+import { join as join33 } from "node:path";
 var DEFAULT_DEVBOX_IMAGE = "olam-devbox:base";
 var DEVBOX_BAKED_SOURCES = [
   "packages/adapters/src/docker/devbox.base.Dockerfile",
@@ -16096,7 +16316,7 @@ function getDevboxFreshness(deps) {
   }
   const newerSources = [];
   for (const relPath of DEVBOX_BAKED_SOURCES) {
-    const absPath = join31(deps.repoRoot, relPath);
+    const absPath = join33(deps.repoRoot, relPath);
     const mtimeMs = statMtime(absPath);
     if (mtimeMs === null)
       continue;
@@ -16128,9 +16348,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path55, mtimeMs } of result.newerSources) {
+  for (const { path: path56, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path55}  (modified ${when})`);
+    lines.push(`  \u2022 ${path56}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -16149,7 +16369,7 @@ function defaultDockerInspect(image) {
 }
 function defaultStatMtime(absPath) {
   try {
-    if (!existsSync26(absPath))
+    if (!existsSync27(absPath))
       return null;
     return statSync6(absPath).mtimeMs;
   } catch {
@@ -16289,15 +16509,15 @@ init_host_cp();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs50 } = await import("node:fs");
+    const { default: fs51 } = await import("node:fs");
     const { default: os28 } = await import("node:os");
-    const { default: path55 } = await import("node:path");
-    const tp = path55.join(
-      process.env.OLAM_HOME ?? path55.join(os28.homedir(), ".olam"),
+    const { default: path56 } = await import("node:path");
+    const tp = path56.join(
+      process.env.OLAM_HOME ?? path56.join(os28.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs50.existsSync(tp)) return null;
-    return fs50.readFileSync(tp, "utf-8").trim();
+    if (!fs51.existsSync(tp)) return null;
+    return fs51.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -16646,7 +16866,7 @@ ${pc10.cyan("Host CP UI:")} ${worldUrl}`);
 function resolveRepoRoot(start) {
   let cur = start;
   while (true) {
-    if (existsSync27(resolve9(cur, "packages")) && existsSync27(resolve9(cur, "package.json"))) {
+    if (existsSync28(resolve10(cur, "packages")) && existsSync28(resolve10(cur, "package.json"))) {
       return cur;
     }
     const parent = dirname18(cur);
@@ -16660,12 +16880,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs50 } = await import("node:fs");
+    const { default: fs51 } = await import("node:fs");
     const { default: os28 } = await import("node:os");
-    const { default: path55 } = await import("node:path");
-    const tp = path55.join(os28.homedir(), ".olam", "host-cp.token");
-    if (!fs50.existsSync(tp)) return null;
-    const raw = fs50.readFileSync(tp, "utf-8").trim();
+    const { default: path56 } = await import("node:path");
+    const tp = path56.join(os28.homedir(), ".olam", "host-cp.token");
+    if (!fs51.existsSync(tp)) return null;
+    const raw = fs51.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -16877,9 +17097,9 @@ function registerList(program2) {
 
 // src/commands/status.ts
 init_output();
-import * as fs28 from "node:fs";
+import * as fs29 from "node:fs";
 import * as os16 from "node:os";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 var CLI_VERSION2 = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
 var HOST_CP_PORT2 = 19e3;
 async function getMachineStatus(_probe, _loadCtx, _readToken) {
@@ -16909,14 +17129,14 @@ async function getMachineStatus(_probe, _loadCtx, _readToken) {
     }
   } catch {
   }
-  const manifestPath2 = path30.join(os16.homedir(), ".olam", "cache", "manifest.json");
+  const manifestPath2 = path31.join(os16.homedir(), ".olam", "cache", "manifest.json");
   let updateAvailable = null;
   let lastUpdateCheck = null;
-  if (fs28.existsSync(manifestPath2)) {
-    const mtime = fs28.statSync(manifestPath2).mtime;
+  if (fs29.existsSync(manifestPath2)) {
+    const mtime = fs29.statSync(manifestPath2).mtime;
     lastUpdateCheck = mtime.toISOString();
     try {
-      const manifest = JSON.parse(fs28.readFileSync(manifestPath2, "utf-8"));
+      const manifest = JSON.parse(fs29.readFileSync(manifestPath2, "utf-8"));
       const latest = manifest["version"];
       updateAvailable = latest !== void 0 && latest !== CLI_VERSION2;
     } catch {
@@ -17039,10 +17259,10 @@ function registerDestroy(program2) {
 // src/commands/clean.ts
 init_context();
 init_output();
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 import os17 from "node:os";
-import path31 from "node:path";
-import { execFileSync as execFileSync6 } from "node:child_process";
+import path32 from "node:path";
+import { execFileSync as execFileSync8 } from "node:child_process";
 function registerClean(program2) {
   program2.command("clean").description("Reap orphan world filesystem state under ~/.olam/worlds/").option("--apply", "Actually delete the orphans (default is dry-run)", false).option(
     "--include-dirty",
@@ -17065,8 +17285,8 @@ async function runClean(opts) {
     printError(error?.message ?? "Olam is not configured. Run `olam init` first.");
     return 1;
   }
-  const worldsDir = path31.join(os17.homedir(), ".olam", "worlds");
-  if (!fs29.existsSync(worldsDir)) {
+  const worldsDir = path32.join(os17.homedir(), ".olam", "worlds");
+  if (!fs30.existsSync(worldsDir)) {
     if (opts.json) {
       process.stdout.write(`${JSON.stringify({ worldsDir, entries: [] })}
 `);
@@ -17081,8 +17301,8 @@ async function runClean(opts) {
   }
   const worktreeMap = collectWorktrees(worldsDir);
   const entries = [];
-  for (const id of fs29.readdirSync(worldsDir).sort()) {
-    const fullPath = path31.join(worldsDir, id);
+  for (const id of fs30.readdirSync(worldsDir).sort()) {
+    const fullPath = path32.join(worldsDir, id);
     const stat = safeStat(fullPath);
     if (!stat || !stat.isDirectory()) continue;
     entries.push(classifyWorld({ id, fullPath, liveIds, worktreeMap }));
@@ -17148,7 +17368,7 @@ function classifyWorld(args) {
   if (liveIds.has(id)) {
     return { id, path: fullPath, bytes, category: "active", note: "in registry" };
   }
-  const worktreeChild = path31.join(fullPath, "olam");
+  const worktreeChild = path32.join(fullPath, "olam");
   const worktreeInfo = worktreeMap.get(worktreeChild);
   if (worktreeInfo) {
     if (worktreeInfo.dirty > 0 || worktreeInfo.unpushed > 0) {
@@ -17185,7 +17405,7 @@ function reapEntry(entry) {
     try {
       const gitDir = resolveGitDirForWorktree(entry.worktreePath);
       if (gitDir) {
-        execFileSync6("git", ["worktree", "remove", "--force", entry.worktreePath], {
+        execFileSync8("git", ["worktree", "remove", "--force", entry.worktreePath], {
           cwd: gitDir,
           stdio: "pipe"
         });
@@ -17194,20 +17414,20 @@ function reapEntry(entry) {
     }
   }
   try {
-    fs29.rmSync(entry.path, { recursive: true, force: true });
+    fs30.rmSync(entry.path, { recursive: true, force: true });
   } catch (err) {
     process.stderr.write(`  ! rm ${entry.path}: ${err instanceof Error ? err.message : String(err)}
 `);
     return false;
   }
-  return !fs29.existsSync(entry.path);
+  return !fs30.existsSync(entry.path);
 }
 function collectWorktrees(worldsDir) {
   const out = /* @__PURE__ */ new Map();
-  for (const id of fs29.readdirSync(worldsDir)) {
-    const child = path31.join(worldsDir, id, "olam");
-    const gitMarker = path31.join(child, ".git");
-    if (!fs29.existsSync(gitMarker)) continue;
+  for (const id of fs30.readdirSync(worldsDir)) {
+    const child = path32.join(worldsDir, id, "olam");
+    const gitMarker = path32.join(child, ".git");
+    if (!fs30.existsSync(gitMarker)) continue;
     const gitDir = resolveGitDirForWorktree(child);
     if (!gitDir) continue;
     const branch = readBranch(child);
@@ -17218,21 +17438,21 @@ function collectWorktrees(worldsDir) {
   return out;
 }
 function resolveGitDirForWorktree(worktreePath) {
-  const gitMarker = path31.join(worktreePath, ".git");
+  const gitMarker = path32.join(worktreePath, ".git");
   try {
-    const top = execFileSync6("git", ["rev-parse", "--show-toplevel"], {
+    const top = execFileSync8("git", ["rev-parse", "--show-toplevel"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
     }).trim();
     if (!top) return null;
-    const common = execFileSync6("git", ["rev-parse", "--git-common-dir"], {
+    const common = execFileSync8("git", ["rev-parse", "--git-common-dir"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
     }).trim();
     if (!common) return top;
-    return path31.dirname(path31.resolve(worktreePath, common));
+    return path32.dirname(path32.resolve(worktreePath, common));
   } catch {
     return null;
   }
@@ -17240,7 +17460,7 @@ function resolveGitDirForWorktree(worktreePath) {
 }
 function readBranch(worktreePath) {
   try {
-    return execFileSync6("git", ["branch", "--show-current"], {
+    return execFileSync8("git", ["branch", "--show-current"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
@@ -17251,7 +17471,7 @@ function readBranch(worktreePath) {
 }
 function countDirty(worktreePath) {
   try {
-    const out = execFileSync6("git", ["status", "--porcelain"], {
+    const out = execFileSync8("git", ["status", "--porcelain"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
@@ -17263,7 +17483,7 @@ function countDirty(worktreePath) {
 }
 function countUnpushed(worktreePath) {
   try {
-    const out = execFileSync6("git", ["log", "@{u}..HEAD", "--oneline"], {
+    const out = execFileSync8("git", ["log", "@{u}..HEAD", "--oneline"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
@@ -17275,7 +17495,7 @@ function countUnpushed(worktreePath) {
 }
 function safeStat(p) {
   try {
-    return fs29.statSync(p);
+    return fs30.statSync(p);
   } catch {
     return null;
   }
@@ -17287,7 +17507,7 @@ function computeBytes(p) {
     const cur = stack.pop();
     let st;
     try {
-      st = fs29.lstatSync(cur);
+      st = fs30.lstatSync(cur);
     } catch {
       continue;
     }
@@ -17295,11 +17515,11 @@ function computeBytes(p) {
     if (st.isDirectory()) {
       let entries;
       try {
-        entries = fs29.readdirSync(cur);
+        entries = fs30.readdirSync(cur);
       } catch {
         continue;
       }
-      for (const name of entries) stack.push(path31.join(cur, name));
+      for (const name of entries) stack.push(path32.join(cur, name));
     } else {
       total += st.size;
     }
@@ -17350,16 +17570,16 @@ async function confirmInteractive() {
 
 // src/commands/implode.ts
 init_output();
-import { execFileSync as execFileSync7 } from "node:child_process";
-import * as fs30 from "node:fs";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import * as fs31 from "node:fs";
 import * as os18 from "node:os";
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 import pc14 from "picocolors";
 var NPM_PACKAGE = "@pleri/olam-cli";
 var realExec = (cmd, args) => {
   try {
-    const stdout = execFileSync7(cmd, [...args], {
+    const stdout = execFileSync9(cmd, [...args], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -17375,7 +17595,7 @@ var realExec = (cmd, args) => {
 };
 function surveyOlam(opts = {}) {
   const exec = opts.exec ?? realExec;
-  const home = opts.olamHome ?? path32.join(os18.homedir(), ".olam");
+  const home = opts.olamHome ?? path33.join(os18.homedir(), ".olam");
   const containers = listDocker(exec, ["ps", "-a", "--format", "{{.Names}}"]).filter(
     (n) => n.startsWith("olam-")
   );
@@ -17389,20 +17609,20 @@ function surveyOlam(opts = {}) {
     (n) => n.startsWith("olam-") && n !== "olam-host-cp-internal-default"
   );
   const worlds = [];
-  const worldsDir = path32.join(home, "worlds");
-  if (fs30.existsSync(worldsDir)) {
-    for (const entry of fs30.readdirSync(worldsDir, { withFileTypes: true })) {
+  const worldsDir = path33.join(home, "worlds");
+  if (fs31.existsSync(worldsDir)) {
+    for (const entry of fs31.readdirSync(worldsDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const wPath = path32.join(worldsDir, entry.name);
+      const wPath = path33.join(worldsDir, entry.name);
       const bytes = dirSize(wPath);
       const { dirty, note } = inspectWorldGitState(wPath);
       worlds.push({ id: entry.name, bytes, dirty, note, path: wPath });
     }
   }
-  const homeBytesNonWorld = fs30.existsSync(home) ? Math.max(0, dirSize(home) - worlds.reduce((acc, w) => acc + w.bytes, 0)) : 0;
+  const homeBytesNonWorld = fs31.existsSync(home) ? Math.max(0, dirSize(home) - worlds.reduce((acc, w) => acc + w.bytes, 0)) : 0;
   const npmRoot = exec("npm", ["root", "-g"]);
   const npmGlobalRoot = npmRoot.exitCode === 0 ? npmRoot.stdout.trim() : null;
-  const npmInstalled = npmGlobalRoot !== null && fs30.existsSync(path32.join(npmGlobalRoot, NPM_PACKAGE));
+  const npmInstalled = npmGlobalRoot !== null && fs31.existsSync(path33.join(npmGlobalRoot, NPM_PACKAGE));
   return {
     containers,
     images,
@@ -17427,15 +17647,15 @@ function dirSize(p) {
       const cur = stack.pop();
       let entries;
       try {
-        entries = fs30.readdirSync(cur, { withFileTypes: true });
+        entries = fs31.readdirSync(cur, { withFileTypes: true });
       } catch {
         continue;
       }
       for (const e of entries) {
-        const full = path32.join(cur, e.name);
+        const full = path33.join(cur, e.name);
         try {
           if (e.isDirectory()) stack.push(full);
-          else if (e.isFile()) total += fs30.statSync(full).size;
+          else if (e.isFile()) total += fs31.statSync(full).size;
         } catch {
         }
       }
@@ -17448,13 +17668,13 @@ function inspectWorldGitState(worldPath) {
   const repoNotes = [];
   let dirty = false;
   try {
-    for (const entry of fs30.readdirSync(worldPath, { withFileTypes: true })) {
+    for (const entry of fs31.readdirSync(worldPath, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const repo = path32.join(worldPath, entry.name);
-      const gitDir = path32.join(repo, ".git");
-      if (!fs30.existsSync(gitDir)) continue;
+      const repo = path33.join(worldPath, entry.name);
+      const gitDir = path33.join(repo, ".git");
+      if (!fs31.existsSync(gitDir)) continue;
       try {
-        const status = execFileSync7("git", ["status", "--porcelain"], {
+        const status = execFileSync9("git", ["status", "--porcelain"], {
           cwd: repo,
           encoding: "utf-8",
           stdio: ["ignore", "pipe", "ignore"]
@@ -17468,7 +17688,7 @@ function inspectWorldGitState(worldPath) {
         continue;
       }
       try {
-        const ahead = execFileSync7(
+        const ahead = execFileSync9(
           "git",
           ["rev-list", "--count", "@{upstream}..HEAD"],
           { cwd: repo, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
@@ -17545,7 +17765,7 @@ function formatBytes2(n) {
 }
 async function executeImplode(survey, opts) {
   const exec = opts.exec ?? realExec;
-  const home = opts.olamHome ?? path32.join(os18.homedir(), ".olam");
+  const home = opts.olamHome ?? path33.join(os18.homedir(), ".olam");
   const removed = [];
   const skipped = [];
   const errors = [];
@@ -17602,16 +17822,16 @@ async function executeImplode(survey, opts) {
   } else {
     for (const n of survey.networks) skipped.push(`network:${n}`);
   }
-  if (fs30.existsSync(home)) {
+  if (fs31.existsSync(home)) {
     if (opts.keepVault) {
-      for (const entry of fs30.readdirSync(home, { withFileTypes: true })) {
+      for (const entry of fs31.readdirSync(home, { withFileTypes: true })) {
         if (entry.name === "auth-data") {
           skipped.push(`fs:~/.olam/auth-data (--keep-vault)`);
           continue;
         }
-        const target = path32.join(home, entry.name);
+        const target = path33.join(home, entry.name);
         try {
-          fs30.rmSync(target, { recursive: true, force: true });
+          fs31.rmSync(target, { recursive: true, force: true });
           removed.push(`fs:${target}`);
         } catch (err) {
           errors.push(`fs:${target}: ${err.message}`);
@@ -17619,7 +17839,7 @@ async function executeImplode(survey, opts) {
       }
     } else {
       try {
-        fs30.rmSync(home, { recursive: true, force: true });
+        fs31.rmSync(home, { recursive: true, force: true });
         removed.push(`fs:${home}`);
       } catch (err) {
         errors.push(`fs:${home}: ${err.message}`);
@@ -17877,7 +18097,7 @@ init_context();
 init_output();
 init_exit_codes();
 init_world_paths();
-import * as fs31 from "node:fs";
+import * as fs32 from "node:fs";
 import "node:path";
 import ora6 from "ora";
 function registerCrystallize(program2, options = {}) {
@@ -17909,7 +18129,7 @@ function registerCrystallize(program2, options = {}) {
       return;
     }
     const thoughtDbPath = getWorldDbPath(world.workspacePath);
-    if (!fs31.existsSync(thoughtDbPath)) {
+    if (!fs32.existsSync(thoughtDbPath)) {
       printError(`No thoughts captured yet for "${worldId}". Run a dispatch first.`);
       process.exitCode = EXIT_GENERIC_ERROR;
       return;
@@ -19283,11 +19503,11 @@ var qmarksTestNoExtDot = ([$0]) => {
   return (f) => f.length === len && f !== "." && f !== "..";
 };
 var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path34 = {
+var path35 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep = defaultPlatform === "win32" ? path34.win32.sep : path34.posix.sep;
+var sep = defaultPlatform === "win32" ? path35.win32.sep : path35.posix.sep;
 minimatch.sep = sep;
 var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
@@ -20113,7 +20333,7 @@ function registerPolicyCheck(program2) {
 }
 
 // src/commands/worldspec/compile.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync18, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync18, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 import YAML5 from "yaml";
 
@@ -20396,11 +20616,11 @@ function zodIssueToError(issue, doc, lineCounter) {
     suggestion: deriveSuggestion(issue)
   };
 }
-function formatJsonPath(path55) {
-  if (path55.length === 0)
+function formatJsonPath(path56) {
+  if (path56.length === 0)
     return "<root>";
   let out = "";
-  for (const seg of path55) {
+  for (const seg of path56) {
     if (typeof seg === "number") {
       out += `[${seg}]`;
     } else {
@@ -20409,11 +20629,11 @@ function formatJsonPath(path55) {
   }
   return out;
 }
-function resolveYamlLocation(path55, doc, lineCounter) {
+function resolveYamlLocation(path56, doc, lineCounter) {
   let bestLine = 0;
   let bestColumn = 0;
-  for (let depth = path55.length; depth >= 0; depth -= 1) {
-    const segment = path55.slice(0, depth);
+  for (let depth = path56.length; depth >= 0; depth -= 1) {
+    const segment = path56.slice(0, depth);
     try {
       const node = doc.getIn(segment, true);
       if (node && typeof node === "object" && "range" in node) {
@@ -20631,11 +20851,11 @@ function topoSort(nodes) {
 }
 function traceCycle(start, byId) {
   const seen = /* @__PURE__ */ new Set();
-  const path55 = [];
+  const path56 = [];
   let current = start;
   while (current && !seen.has(current)) {
     seen.add(current);
-    path55.push(current);
+    path56.push(current);
     const node = byId.get(current);
     const next = node?.dependsOn[0];
     if (next === void 0)
@@ -20643,10 +20863,10 @@ function traceCycle(start, byId) {
     current = next;
   }
   if (current && seen.has(current)) {
-    const idx = path55.indexOf(current);
-    return [...path55.slice(idx), current];
+    const idx = path56.indexOf(current);
+    return [...path56.slice(idx), current];
   }
-  return path55;
+  return path56;
 }
 
 // ../core/dist/executor/types.js
@@ -20870,11 +21090,11 @@ async function resolveDigests(lockfile, resolver) {
 }
 
 // ../core/dist/worldspec/image-digest.js
-import { execFileSync as execFileSync8 } from "node:child_process";
+import { execFileSync as execFileSync10 } from "node:child_process";
 var DOCKER_SUBPROCESS_TIMEOUT_MS = 3e4;
 var dockerDigestResolver = async (image, source) => {
   if (source === "local") {
-    const out = execFileSync8("docker", ["inspect", image, "--format", "{{.Id}}"], {
+    const out = execFileSync10("docker", ["inspect", image, "--format", "{{.Id}}"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: DOCKER_SUBPROCESS_TIMEOUT_MS,
@@ -20885,7 +21105,7 @@ var dockerDigestResolver = async (image, source) => {
     }
     return out;
   }
-  const raw = execFileSync8("docker", ["buildx", "imagetools", "inspect", image], {
+  const raw = execFileSync10("docker", ["buildx", "imagetools", "inspect", image], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: DOCKER_SUBPROCESS_TIMEOUT_MS,
@@ -20916,13 +21136,13 @@ function registerWorldspecCompile(parent) {
     const sourcePolicies = [];
     for (const p of paths) {
       const abs = resolvePath(process.cwd(), p);
-      if (!existsSync32(abs)) {
+      if (!existsSync33(abs)) {
         printError(`worldspec not found at ${abs}`);
         process.exit(EXIT_WORLDSPEC_FILE_NOT_FOUND);
       }
       let yaml;
       try {
-        yaml = YAML5.parse(readFileSync21(abs, "utf8"));
+        yaml = YAML5.parse(readFileSync22(abs, "utf8"));
       } catch (err) {
         printError(
           `${p}: YAML parse error: ${err.message}`
@@ -21007,7 +21227,7 @@ function getPkgVersion() {
 // src/commands/worldspec/init.ts
 init_exit_codes();
 init_output();
-import { existsSync as existsSync33, mkdirSync as mkdirSync19, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync19, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
 import { execSync as execSync10 } from "node:child_process";
 import { basename as basename3, resolve as resolvePath2 } from "node:path";
 function registerWorldspecInit(parent) {
@@ -21025,7 +21245,7 @@ function registerWorldspecInit(parent) {
     const cwd = process.cwd();
     const targetDir = resolvePath2(cwd, ".olam/worldspecs");
     const targetFile = resolvePath2(targetDir, "default.yaml");
-    if (existsSync33(targetFile) && !opts.force) {
+    if (existsSync34(targetFile) && !opts.force) {
       printError(
         `${targetFile} already exists; pass --force to overwrite`
       );
@@ -21059,14 +21279,14 @@ function registerWorldspecInit(parent) {
   });
 }
 function detectProjectShape(root, useAdbYaml) {
-  const hasGemfile = existsSync33(resolvePath2(root, "Gemfile"));
-  const hasNodePackageJson = existsSync33(resolvePath2(root, "package.json"));
-  const hasAdbYaml = existsSync33(resolvePath2(root, ".adb.yaml"));
+  const hasGemfile = existsSync34(resolvePath2(root, "Gemfile"));
+  const hasNodePackageJson = existsSync34(resolvePath2(root, "package.json"));
+  const hasAdbYaml = existsSync34(resolvePath2(root, ".adb.yaml"));
   let rubyVersion = null;
   const rubyVersionPath = resolvePath2(root, ".ruby-version");
-  if (existsSync33(rubyVersionPath)) {
+  if (existsSync34(rubyVersionPath)) {
     try {
-      const raw = readFileSync22(rubyVersionPath, "utf8").trim();
+      const raw = readFileSync23(rubyVersionPath, "utf8").trim();
       const match2 = raw.match(/(\d+\.\d+\.\d+)/);
       if (match2) rubyVersion = match2[1] ?? null;
     } catch {
@@ -22469,7 +22689,7 @@ function registerWorldspecSchema(parent) {
 }
 
 // src/commands/worldspec/validate.ts
-import { existsSync as existsSync34, readFileSync as readFileSync23 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync24 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 init_exit_codes();
 init_output();
@@ -22486,13 +22706,13 @@ function registerWorldspecValidate(parent) {
     "human"
   ).action(async (pathArg, opts) => {
     const absPath = resolvePath4(process.cwd(), pathArg);
-    if (!existsSync34(absPath)) {
+    if (!existsSync35(absPath)) {
       printError(`worldspec not found at ${absPath}`);
       process.exit(EXIT_WORLDSPEC_FILE_NOT_FOUND);
     }
     let yamlSource;
     try {
-      yamlSource = readFileSync23(absPath, "utf8");
+      yamlSource = readFileSync24(absPath, "utf8");
     } catch (err) {
       printError(
         `failed to read ${absPath}: ${err.message}`
@@ -22538,23 +22758,23 @@ function registerWorldspec(program2) {
 // src/commands/upgrade.ts
 init_output();
 init_host_cp();
-import * as fs34 from "node:fs";
-import * as path37 from "node:path";
+import * as fs35 from "node:fs";
+import * as path38 from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 import ora7 from "ora";
 import pc18 from "picocolors";
 
 // src/commands/upgrade-lock.ts
-import * as fs32 from "node:fs";
+import * as fs33 from "node:fs";
 import * as os19 from "node:os";
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
-var LOCK_FILE_PATH = path35.join(os19.homedir(), ".olam", ".upgrade.lock");
+var LOCK_FILE_PATH = path36.join(os19.homedir(), ".olam", ".upgrade.lock");
 var STALE_LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 function readLockFile(lockPath) {
   try {
-    if (!fs32.existsSync(lockPath)) return null;
-    const raw = fs32.readFileSync(lockPath, "utf-8").trim();
+    if (!fs33.existsSync(lockPath)) return null;
+    const raw = fs33.readFileSync(lockPath, "utf-8").trim();
     if (raw.length === 0) return null;
     const parsed = JSON.parse(raw);
     if (typeof parsed.pid !== "number" || typeof parsed.startTs !== "number") return null;
@@ -22599,16 +22819,16 @@ function isStaleLock(content, nowMs = Date.now()) {
   return false;
 }
 function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
-  const dir = path35.dirname(lockPath);
-  fs32.mkdirSync(dir, { recursive: true });
+  const dir = path36.dirname(lockPath);
+  fs33.mkdirSync(dir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = fs32.openSync(lockPath, "wx", 420);
+      const fd = fs33.openSync(lockPath, "wx", 420);
       try {
         const content = { pid: process.pid, startTs: nowMs };
-        fs32.writeSync(fd, JSON.stringify(content));
+        fs33.writeSync(fd, JSON.stringify(content));
       } finally {
-        fs32.closeSync(fd);
+        fs33.closeSync(fd);
       }
       return { acquired: true, lockPath };
     } catch (err) {
@@ -22617,7 +22837,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
       const existing2 = readLockFile(lockPath);
       if (isStaleLock(existing2, nowMs)) {
         try {
-          fs32.unlinkSync(lockPath);
+          fs33.unlinkSync(lockPath);
         } catch (unlinkErr) {
           const ucode = unlinkErr.code;
           if (ucode !== "ENOENT") throw unlinkErr;
@@ -22642,7 +22862,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
 }
 function releaseLock(lockPath = LOCK_FILE_PATH) {
   try {
-    fs32.unlinkSync(lockPath);
+    fs33.unlinkSync(lockPath);
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") throw err;
@@ -22660,19 +22880,19 @@ function formatRefusalMessage(result, lockPath = LOCK_FILE_PATH) {
 }
 
 // src/commands/upgrade-log.ts
-import * as fs33 from "node:fs";
+import * as fs34 from "node:fs";
 import * as os20 from "node:os";
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 function getUpgradeLogPath() {
   const home = process.env["HOME"] ?? os20.homedir();
-  return path36.join(home, ".olam", "upgrade.log");
+  return path37.join(home, ".olam", "upgrade.log");
 }
 var UPGRADE_LOG_PATH = getUpgradeLogPath();
 function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   try {
-    fs33.mkdirSync(path36.dirname(logPath), { recursive: true });
+    fs34.mkdirSync(path37.dirname(logPath), { recursive: true });
     const line = JSON.stringify(row) + "\n";
-    fs33.appendFileSync(logPath, line, { mode: 420 });
+    fs34.appendFileSync(logPath, line, { mode: 420 });
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to append: ${err instanceof Error ? err.message : String(err)}
@@ -22681,10 +22901,10 @@ function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   }
 }
 function readUpgradeLog(limit = 10, logPath = getUpgradeLogPath()) {
-  if (!fs33.existsSync(logPath)) return [];
+  if (!fs34.existsSync(logPath)) return [];
   let raw;
   try {
-    raw = fs33.readFileSync(logPath, "utf-8");
+    raw = fs34.readFileSync(logPath, "utf-8");
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to read: ${err instanceof Error ? err.message : String(err)}
@@ -22777,12 +22997,12 @@ init_protocol_version();
 init_install_root();
 var AUTH_HEALTH_URL2 = "http://127.0.0.1:9999/health";
 function isNodeModulesInSync(cwd) {
-  const lockPath = path37.join(cwd, "package-lock.json");
-  const markerPath = path37.join(cwd, "node_modules", ".package-lock.json");
-  if (!fs34.existsSync(lockPath) || !fs34.existsSync(markerPath)) return false;
+  const lockPath = path38.join(cwd, "package-lock.json");
+  const markerPath = path38.join(cwd, "node_modules", ".package-lock.json");
+  if (!fs35.existsSync(lockPath) || !fs35.existsSync(markerPath)) return false;
   try {
-    const lockStat = fs34.statSync(lockPath);
-    const markerStat = fs34.statSync(markerPath);
+    const lockStat = fs35.statSync(lockPath);
+    const markerStat = fs35.statSync(markerPath);
     return markerStat.mtimeMs >= lockStat.mtimeMs;
   } catch {
     return false;
@@ -22798,8 +23018,8 @@ function shouldSkipInstall(opts, cwd) {
   return { skip: false };
 }
 function validateRepoRoot(cwd) {
-  const marker = path37.join(cwd, "packages/host-cp/compose.yaml");
-  if (!fs34.existsSync(marker)) {
+  const marker = path38.join(cwd, "packages/host-cp/compose.yaml");
+  if (!fs35.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -23155,9 +23375,9 @@ async function recreateAuthService() {
   }
 }
 function readBundleHash(cwd) {
-  const indexPath = path37.join(cwd, "packages/control-plane/public/index.html");
-  if (!fs34.existsSync(indexPath)) return null;
-  return extractBundleHash(fs34.readFileSync(indexPath, "utf-8"));
+  const indexPath = path38.join(cwd, "packages/control-plane/public/index.html");
+  if (!fs35.existsSync(indexPath)) return null;
+  return extractBundleHash(fs35.readFileSync(indexPath, "utf-8"));
 }
 async function runUpgradePullByDigest(deps = {}) {
   const docker2 = deps.docker ?? realDocker;
@@ -23691,7 +23911,7 @@ ${buildResult.stderr}`);
     return;
   }
   const authSecret = readAuthSecret2();
-  const spaDir = path37.join(cwd, "packages/control-plane/app");
+  const spaDir = path38.join(cwd, "packages/control-plane/app");
   const spaResult = runStep2(
     "vite build (SPA)",
     "npx",
@@ -24225,20 +24445,20 @@ ${pc20.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
 
 // src/commands/keys.ts
 init_output();
-import * as fs35 from "node:fs";
+import * as fs36 from "node:fs";
 import * as os21 from "node:os";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 import YAML6 from "yaml";
-function olamHome2() {
-  return process.env.OLAM_HOME ?? path38.join(os21.homedir(), ".olam");
+function olamHome3() {
+  return process.env.OLAM_HOME ?? path39.join(os21.homedir(), ".olam");
 }
 function keysFilePath() {
-  return path38.join(olamHome2(), "keys.yaml");
+  return path39.join(olamHome3(), "keys.yaml");
 }
 function readKeysFile() {
   const filePath = keysFilePath();
-  if (!fs35.existsSync(filePath)) return null;
-  const raw = fs35.readFileSync(filePath, "utf-8").trim();
+  if (!fs36.existsSync(filePath)) return null;
+  const raw = fs36.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = YAML6.parse(raw);
@@ -24253,14 +24473,14 @@ function readKeysFile() {
   }
 }
 function writeKeysFile(keys) {
-  const dir = olamHome2();
-  if (!fs35.existsSync(dir)) {
-    fs35.mkdirSync(dir, { recursive: true });
+  const dir = olamHome3();
+  if (!fs36.existsSync(dir)) {
+    fs36.mkdirSync(dir, { recursive: true });
   }
   const filePath = keysFilePath();
   const content = YAML6.stringify(keys);
-  fs35.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
-  fs35.chmodSync(filePath, 384);
+  fs36.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
+  fs36.chmodSync(filePath, 384);
 }
 function redact(value) {
   if (value.length <= 8) return value + "...";
@@ -24303,7 +24523,7 @@ function registerKeys(program2) {
       }
       const { [key]: _removed, ...rest } = existing;
       if (Object.keys(rest).length === 0) {
-        fs35.unlinkSync(keysFilePath());
+        fs36.unlinkSync(keysFilePath());
       } else {
         writeKeysFile(rest);
       }
@@ -24328,8 +24548,8 @@ function registerKeys(program2) {
 // src/commands/world-snapshot.ts
 init_snapshot();
 init_output();
-import * as fs36 from "node:fs";
-import * as path39 from "node:path";
+import * as fs37 from "node:fs";
+import * as path40 from "node:path";
 import { execSync as execSync11 } from "node:child_process";
 import pc21 from "picocolors";
 
@@ -24352,16 +24572,16 @@ function emitDeprecationWarning(subcommand) {
 }
 function bumpDeprecationCounter() {
   if (process.env[INTERNAL_SENTINEL_ENV] === "1") return;
-  const counterPath = path39.join(snapshotsDir(), ".deprecation-counter");
+  const counterPath = path40.join(snapshotsDir(), ".deprecation-counter");
   try {
-    fs36.mkdirSync(path39.dirname(counterPath), { recursive: true });
+    fs37.mkdirSync(path40.dirname(counterPath), { recursive: true });
     let current = 0;
-    if (fs36.existsSync(counterPath)) {
-      const raw = fs36.readFileSync(counterPath, "utf-8").trim();
+    if (fs37.existsSync(counterPath)) {
+      const raw = fs37.readFileSync(counterPath, "utf-8").trim();
       const parsed = parseInt(raw, 10);
       if (Number.isInteger(parsed) && parsed >= 0) current = parsed;
     }
-    fs36.writeFileSync(counterPath, String(current + 1), { mode: 384 });
+    fs37.writeFileSync(counterPath, String(current + 1), { mode: 384 });
   } catch {
   }
 }
@@ -24437,17 +24657,17 @@ function resolveKinds(arg) {
   return [];
 }
 async function captureGems(worldId, workspacePath, repo) {
-  const repoDir = path39.join(workspacePath, repo);
+  const repoDir = path40.join(workspacePath, repo);
   const fingerprint = computeGemsFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock \u2014 layer does not apply" };
   }
   const tarPath = snapshotTarPath(worldId, "gems", repo, fingerprint);
-  const vendorBundle = path39.join(repoDir, "vendor", "bundle");
-  if (fs36.existsSync(vendorBundle)) {
+  const vendorBundle = path40.join(repoDir, "vendor", "bundle");
+  if (fs37.existsSync(vendorBundle)) {
     try {
       packTarball(vendorBundle, tarPath);
-      const stat = fs36.statSync(tarPath);
+      const stat = fs37.statSync(tarPath);
       const manifest = {
         kind: "gems",
         worldId,
@@ -24480,10 +24700,10 @@ async function captureGems(worldId, workspacePath, repo) {
       `docker exec ${containerName} sh -c 'mkdir -p "$(dirname ${tmpTar})" && tar -czf ${tmpTar}.tmp -C ${bundlePath} . && mv ${tmpTar}.tmp ${tmpTar}'`,
       { stdio: "pipe", timeout: 12e4 }
     );
-    fs36.mkdirSync(path39.dirname(tarPath), { recursive: true });
+    fs37.mkdirSync(path40.dirname(tarPath), { recursive: true });
     execSync11(`docker cp ${containerName}:${tmpTar} "${tarPath}"`, { stdio: "pipe", timeout: 12e4 });
     execSync11(`docker exec ${containerName} rm -f ${tmpTar}`, { stdio: "pipe" });
-    const stat = fs36.statSync(tarPath);
+    const stat = fs37.statSync(tarPath);
     const manifest = {
       kind: "gems",
       worldId,
@@ -24500,19 +24720,19 @@ async function captureGems(worldId, workspacePath, repo) {
   }
 }
 async function captureNode(worldId, workspacePath, repo) {
-  const repoDir = path39.join(workspacePath, repo);
+  const repoDir = path40.join(workspacePath, repo);
   const fingerprint = computeNodeFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no lockfile \u2014 layer does not apply" };
   }
-  const nodeModules = path39.join(repoDir, "node_modules");
-  if (!fs36.existsSync(nodeModules)) {
+  const nodeModules = path40.join(repoDir, "node_modules");
+  if (!fs37.existsSync(nodeModules)) {
     return { ok: false, tarPath: "", msg: "node_modules not installed yet" };
   }
   const tarPath = snapshotTarPath(worldId, "node", repo, fingerprint);
   try {
     packTarball(nodeModules, tarPath);
-    const stat = fs36.statSync(tarPath);
+    const stat = fs37.statSync(tarPath);
     const manifest = {
       kind: "node",
       worldId,
@@ -24529,7 +24749,7 @@ async function captureNode(worldId, workspacePath, repo) {
   }
 }
 async function capturePg(worldId, workspacePath, repoNames) {
-  const repoDirs = repoNames.map((r) => path39.join(workspacePath, r));
+  const repoDirs = repoNames.map((r) => path40.join(workspacePath, r));
   const fingerprint = computePgFingerprint(repoDirs);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock / schema.rb \u2014 layer does not apply" };
@@ -24544,13 +24764,13 @@ async function capturePg(worldId, workspacePath, repoNames) {
   }
   try {
     execSync11(`docker stop ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    fs36.mkdirSync(path39.dirname(tarPath), { recursive: true });
+    fs37.mkdirSync(path40.dirname(tarPath), { recursive: true });
     execSync11(
-      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path39.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path39.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path39.basename(tarPath)}.tmp /dest/${path39.basename(tarPath)}'`,
+      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path40.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path40.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path40.basename(tarPath)}.tmp /dest/${path40.basename(tarPath)}'`,
       { stdio: "pipe", timeout: 18e4 }
     );
     execSync11(`docker start ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    const stat = fs36.statSync(tarPath);
+    const stat = fs37.statSync(tarPath);
     const manifest = {
       kind: "pg",
       worldId,
@@ -24574,18 +24794,18 @@ async function handleEvict(opts) {
   const maxBytes = Number.isInteger(cap) && cap > 0 ? cap : 5 * 1024 * 1024 * 1024;
   if (opts.dryRun) {
     const root = snapshotsDir();
-    if (!fs36.existsSync(root)) {
+    if (!fs37.existsSync(root)) {
       console.log(pc21.dim("No snapshot dir; nothing to evict."));
       return;
     }
     const allTars = [];
     const walk2 = (d) => {
-      for (const entry of fs36.readdirSync(d, { withFileTypes: true })) {
-        const full = path39.join(d, entry.name);
+      for (const entry of fs37.readdirSync(d, { withFileTypes: true })) {
+        const full = path40.join(d, entry.name);
         if (entry.isDirectory()) {
           walk2(full);
         } else if (entry.name.endsWith(".tar.gz")) {
-          const stat = fs36.statSync(full);
+          const stat = fs37.statSync(full);
           allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
         }
       }
@@ -24678,35 +24898,35 @@ function formatAge2(ms) {
 // src/commands/refresh.ts
 init_context();
 init_output();
-import * as fs38 from "node:fs";
+import * as fs39 from "node:fs";
 import * as os22 from "node:os";
-import * as path41 from "node:path";
+import * as path42 from "node:path";
 import { spawnSync as spawnSync13 } from "node:child_process";
 import ora8 from "ora";
 
 // src/commands/refresh-helpers.ts
-import * as fs37 from "node:fs";
-import * as path40 from "node:path";
+import * as fs38 from "node:fs";
+import * as path41 from "node:path";
 function collectCpSourceFiles(standaloneDir) {
-  if (!fs37.existsSync(standaloneDir)) {
+  if (!fs38.existsSync(standaloneDir)) {
     throw new Error(`CP standalone dir not found: ${standaloneDir}`);
   }
   const entries = [];
-  const topLevel = fs37.readdirSync(standaloneDir).filter((f) => {
-    const stat = fs37.statSync(path40.join(standaloneDir, f));
+  const topLevel = fs38.readdirSync(standaloneDir).filter((f) => {
+    const stat = fs38.statSync(path41.join(standaloneDir, f));
     return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
   }).sort();
   for (const f of topLevel) {
-    entries.push({ srcPath: path40.join(standaloneDir, f), destRelPath: f });
+    entries.push({ srcPath: path41.join(standaloneDir, f), destRelPath: f });
   }
-  const libDir = path40.join(standaloneDir, "lib");
-  if (fs37.existsSync(libDir) && fs37.statSync(libDir).isDirectory()) {
-    const libFiles = fs37.readdirSync(libDir).filter((f) => {
-      const stat = fs37.statSync(path40.join(libDir, f));
+  const libDir = path41.join(standaloneDir, "lib");
+  if (fs38.existsSync(libDir) && fs38.statSync(libDir).isDirectory()) {
+    const libFiles = fs38.readdirSync(libDir).filter((f) => {
+      const stat = fs38.statSync(path41.join(libDir, f));
       return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
     }).sort();
     for (const f of libFiles) {
-      entries.push({ srcPath: path40.join(libDir, f), destRelPath: `lib/${f}` });
+      entries.push({ srcPath: path41.join(libDir, f), destRelPath: `lib/${f}` });
     }
   }
   return entries;
@@ -24764,16 +24984,16 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  const stagingDir = fs38.mkdtempSync(
-    path41.join(os22.tmpdir(), `olam-refresh-${worldId}-`)
+  const stagingDir = fs39.mkdtempSync(
+    path42.join(os22.tmpdir(), `olam-refresh-${worldId}-`)
   );
   try {
     const hasLib = entries.some((e) => e.destRelPath.startsWith("lib/"));
     if (hasLib) {
-      fs38.mkdirSync(path41.join(stagingDir, "lib"), { recursive: true });
+      fs39.mkdirSync(path42.join(stagingDir, "lib"), { recursive: true });
     }
     for (const { srcPath, destRelPath } of entries) {
-      fs38.copyFileSync(srcPath, path41.join(stagingDir, destRelPath));
+      fs39.copyFileSync(srcPath, path42.join(stagingDir, destRelPath));
     }
     const cpResult = docker([
       "cp",
@@ -24788,7 +25008,7 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       };
     }
   } finally {
-    fs38.rmSync(stagingDir, { recursive: true, force: true });
+    fs39.rmSync(stagingDir, { recursive: true, force: true });
   }
   if (opts.restart) {
     const restartResult = docker([
@@ -24825,11 +25045,11 @@ function registerRefresh(program2) {
       process.exitCode = 1;
       return;
     }
-    const standaloneDir = path41.join(
+    const standaloneDir = path42.join(
       process.cwd(),
       "packages/control-plane/standalone"
     );
-    if (!fs38.existsSync(standaloneDir)) {
+    if (!fs39.existsSync(standaloneDir)) {
       printError(
         `CP standalone source not found at ${standaloneDir}.
 Run \`olam refresh\` from the olam repo root.`
@@ -24908,10 +25128,10 @@ Run \`olam refresh\` from the olam repo root.`
 }
 
 // src/commands/diagnose.ts
-import * as fs39 from "node:fs";
+import * as fs40 from "node:fs";
 import * as os23 from "node:os";
-import * as path42 from "node:path";
-import { execFileSync as execFileSync9, execSync as execSync12 } from "node:child_process";
+import * as path43 from "node:path";
+import { execFileSync as execFileSync11, execSync as execSync12 } from "node:child_process";
 import pc22 from "picocolors";
 
 // ../core/dist/diagnose/secret-stripper.js
@@ -24945,9 +25165,9 @@ function stripSecrets(input) {
 }
 
 // src/commands/diagnose.ts
-var DIAGNOSTICS_DIR = path42.join(os23.homedir(), ".olam", "diagnostics");
-var LOG_DIR = path42.join(os23.homedir(), ".olam", "log");
-var CACHE_DIR = path42.join(os23.homedir(), ".olam", "cache");
+var DIAGNOSTICS_DIR = path43.join(os23.homedir(), ".olam", "diagnostics");
+var LOG_DIR = path43.join(os23.homedir(), ".olam", "log");
+var CACHE_DIR = path43.join(os23.homedir(), ".olam", "cache");
 var LOG_TAIL_LINES = 200;
 function safeExec(cmd) {
   try {
@@ -24957,14 +25177,14 @@ function safeExec(cmd) {
   }
 }
 function defaultZip(zipPath, files) {
-  execFileSync9("zip", ["-j", zipPath, ...files]);
+  execFileSync11("zip", ["-j", zipPath, ...files]);
 }
 async function buildDiagnosticsZip(_exec = (cmd) => safeExec(cmd), _outDir = DIAGNOSTICS_DIR, _logDir = LOG_DIR, _zip = defaultZip) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 23);
-  const zipPath = path42.join(_outDir, `olam-diag-${ts}.zip`);
-  const tmpDir = fs39.mkdtempSync(path42.join(os23.tmpdir(), "olam-diag-"));
+  const zipPath = path43.join(_outDir, `olam-diag-${ts}.zip`);
+  const tmpDir = fs40.mkdtempSync(path43.join(os23.tmpdir(), "olam-diag-"));
   try {
-    fs39.mkdirSync(_outDir, { recursive: true });
+    fs40.mkdirSync(_outDir, { recursive: true });
     const entries = [];
     const version = process.env["OLAM_CLI_VERSION"] ?? "unknown";
     const nodeVersion = process.version;
@@ -24980,14 +25200,14 @@ platform: ${platform}
       `uptime: ${os23.uptime()}s`
     ].join("\n") + "\n";
     _writeEntry(tmpDir, "os-info.txt", stripSecrets(osContent), entries);
-    const depsFile = path42.join(CACHE_DIR, "deps.json");
-    if (fs39.existsSync(depsFile)) {
-      const deps = fs39.readFileSync(depsFile, "utf-8");
+    const depsFile = path43.join(CACHE_DIR, "deps.json");
+    if (fs40.existsSync(depsFile)) {
+      const deps = fs40.readFileSync(depsFile, "utf-8");
       _writeEntry(tmpDir, "deps.json", stripSecrets(deps), entries);
     }
     const latestLog = _latestLog(_logDir);
     if (latestLog) {
-      const lines = fs39.readFileSync(latestLog, "utf-8").split("\n");
+      const lines = fs40.readFileSync(latestLog, "utf-8").split("\n");
       const tail = lines.slice(-LOG_TAIL_LINES).join("\n");
       _writeEntry(tmpDir, "log-tail.txt", stripSecrets(tail), entries);
     }
@@ -24999,38 +25219,38 @@ platform: ${platform}
     if (authAudit) {
       _writeEntry(tmpDir, "audit-auth-callers.txt", stripSecrets(authAudit), entries);
     }
-    const fileArgs = entries.map((e) => path42.join(tmpDir, e));
+    const fileArgs = entries.map((e) => path43.join(tmpDir, e));
     try {
       _zip(zipPath, fileArgs);
     } catch (err) {
       throw new Error(`zip command produced no output file. zip stderr: ${err.message}`);
     }
-    if (!fs39.existsSync(zipPath)) {
+    if (!fs40.existsSync(zipPath)) {
       throw new Error("zip command produced no output file.");
     }
     return { zipPath, entries };
   } finally {
     try {
-      fs39.rmSync(tmpDir, { recursive: true, force: true });
+      fs40.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
 }
 function _writeEntry(dir, name, content, entries) {
-  fs39.writeFileSync(path42.join(dir, name), content, { mode: 420 });
+  fs40.writeFileSync(path43.join(dir, name), content, { mode: 420 });
   entries.push(name);
 }
 function _latestLog(logDir) {
-  if (!fs39.existsSync(logDir)) return null;
-  const files = fs39.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
-  return files.length > 0 ? path42.join(logDir, files[0]) : null;
+  if (!fs40.existsSync(logDir)) return null;
+  const files = fs40.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
+  return files.length > 0 ? path43.join(logDir, files[0]) : null;
 }
 async function buildTelemetryPayload() {
   const channel = "stable";
-  const manifestFile = path42.join(CACHE_DIR, "manifest.json");
+  const manifestFile = path43.join(CACHE_DIR, "manifest.json");
   let manifestAgeHours = null;
-  if (fs39.existsSync(manifestFile)) {
-    const mtime = fs39.statSync(manifestFile).mtime.getTime();
+  if (fs40.existsSync(manifestFile)) {
+    const mtime = fs40.statSync(manifestFile).mtime.getTime();
     manifestAgeHours = Math.round((Date.now() - mtime) / 36e5);
   }
   return {
@@ -25074,9 +25294,9 @@ function registerDiagnose(program2) {
 
 // src/lib/health-probes.ts
 import { spawnSync as spawnSync14 } from "node:child_process";
-import { existsSync as existsSync43, readdirSync as readdirSync11, readFileSync as readFileSync30, statSync as statSync13 } from "node:fs";
-import { homedir as homedir22 } from "node:os";
-import path43 from "node:path";
+import { existsSync as existsSync44, readdirSync as readdirSync11, readFileSync as readFileSync31, statSync as statSync13 } from "node:fs";
+import { homedir as homedir23 } from "node:os";
+import path44 from "node:path";
 
 // src/lib/kg-caps.ts
 var SOFT_CAP_BYTES = 15e8;
@@ -25171,7 +25391,7 @@ function isHostCpHealthEnvelope(body) {
 }
 async function probeAuthVault(olamHomeOverride) {
   const vaultPath = resolveAccountsPath(olamHomeOverride);
-  if (!existsSync43(vaultPath)) {
+  if (!existsSync44(vaultPath)) {
     return {
       ok: false,
       message: `auth vault missing at ${vaultPath}`,
@@ -25180,7 +25400,7 @@ async function probeAuthVault(olamHomeOverride) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync30(vaultPath, "utf-8"));
+    parsed = JSON.parse(readFileSync31(vaultPath, "utf-8"));
   } catch (err) {
     return {
       ok: false,
@@ -25210,8 +25430,8 @@ async function probeAuthVault(olamHomeOverride) {
 function resolveAccountsPath(olamHomeOverride) {
   const explicit = process.env.OLAM_AUTH_DATA_PATH;
   if (explicit) return explicit;
-  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path43.join(homedir22(), ".olam");
-  return path43.join(olamHome5, "auth-data", "accounts.json");
+  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path44.join(homedir23(), ".olam");
+  return path44.join(olamHome5, "auth-data", "accounts.json");
 }
 function effectiveState2(account, now) {
   const persisted = account.state ?? (account.rateLimited ? "cooldown" : "active");
@@ -25224,9 +25444,9 @@ function effectiveState2(account, now) {
   return persisted;
 }
 async function probeKgStorage(olamHomeOverride) {
-  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path43.join(homedir22(), ".olam");
-  const kgRoot3 = path43.join(olamHome5, "kg");
-  const worldsRoot3 = path43.join(olamHome5, "worlds");
+  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path44.join(homedir23(), ".olam");
+  const kgRoot3 = path44.join(olamHome5, "kg");
+  const worldsRoot3 = path44.join(olamHome5, "worlds");
   const kgBytes = enumerateGraphifyOut(kgRoot3, "pristine");
   const overlayBytes = enumerateGraphifyOut(worldsRoot3, "overlay");
   const totalBytes = kgBytes + overlayBytes;
@@ -25246,7 +25466,7 @@ async function probeKgStorage(olamHomeOverride) {
   return { ok: true, message: `KG storage ${formatBytes4(totalBytes)} (under cap)` };
 }
 function enumerateGraphifyOut(root, layout) {
-  if (!existsSync43(root)) return 0;
+  if (!existsSync44(root)) return 0;
   let total = 0;
   let entries;
   try {
@@ -25257,9 +25477,9 @@ function enumerateGraphifyOut(root, layout) {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (layout === "pristine") {
-      total += dirSizeBytes(path43.join(root, entry.name, "graphify-out"));
+      total += dirSizeBytes(path44.join(root, entry.name, "graphify-out"));
     } else {
-      const worldDir = path43.join(root, entry.name);
+      const worldDir = path44.join(root, entry.name);
       let clones;
       try {
         clones = readdirSync11(worldDir, { withFileTypes: true });
@@ -25268,14 +25488,14 @@ function enumerateGraphifyOut(root, layout) {
       }
       for (const clone of clones) {
         if (!clone.isDirectory()) continue;
-        total += dirSizeBytes(path43.join(worldDir, clone.name, "graphify-out"));
+        total += dirSizeBytes(path44.join(worldDir, clone.name, "graphify-out"));
       }
     }
   }
   return total;
 }
 function dirSizeBytes(dir) {
-  if (!existsSync43(dir)) return 0;
+  if (!existsSync44(dir)) return 0;
   let total = 0;
   const stack = [dir];
   while (stack.length > 0) {
@@ -25287,7 +25507,7 @@ function dirSizeBytes(dir) {
       continue;
     }
     for (const entry of entries) {
-      const full = path43.join(cur, entry.name);
+      const full = path44.join(cur, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(full);
@@ -25531,20 +25751,20 @@ function registerCompletion(program2) {
 // src/commands/setup.ts
 init_cli_version();
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync45 } from "node:fs";
-import { homedir as homedir23 } from "node:os";
-import path45 from "node:path";
+import { existsSync as existsSync46 } from "node:fs";
+import { homedir as homedir24 } from "node:os";
+import path46 from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // src/lib/shell-rc.ts
-import { copyFileSync as copyFileSync5, existsSync as existsSync44, readFileSync as readFileSync31, renameSync as renameSync4, writeFileSync as writeFileSync20 } from "node:fs";
-import path44 from "node:path";
+import { copyFileSync as copyFileSync5, existsSync as existsSync45, readFileSync as readFileSync32, renameSync as renameSync4, writeFileSync as writeFileSync20 } from "node:fs";
+import path45 from "node:path";
 function appendIdempotent(opts) {
   const { rcPath, marker, contentLine, clock = () => /* @__PURE__ */ new Date() } = opts;
-  if (!existsSync44(rcPath)) {
+  if (!existsSync45(rcPath)) {
     return { status: "no-rc-file", backupPath: null };
   }
-  const content = readFileSync31(rcPath, "utf-8");
+  const content = readFileSync32(rcPath, "utf-8");
   if (content.includes(marker)) {
     return { status: "already-present", backupPath: null };
   }
@@ -25561,9 +25781,9 @@ function appendIdempotent(opts) {
 }
 function resolveShellRc(home, shellEnv) {
   if (!shellEnv) return null;
-  const basename6 = path44.basename(shellEnv);
-  if (basename6 === "zsh") return path44.join(home, ".zshrc");
-  if (basename6 === "bash") return path44.join(home, ".bashrc");
+  const basename6 = path45.basename(shellEnv);
+  if (basename6 === "zsh") return path45.join(home, ".zshrc");
+  if (basename6 === "bash") return path45.join(home, ".bashrc");
   return null;
 }
 
@@ -25665,7 +25885,7 @@ async function phase4ShellInit(opts, deps) {
   if (opts.skipShellInit) {
     return { ok: true, skipped: true, message: "skipped via --skip-shell-init" };
   }
-  const home = deps.home ?? homedir23();
+  const home = deps.home ?? homedir24();
   const shellEnv = deps.shellEnv ?? process.env.SHELL;
   const rcPath = resolveShellRc(home, shellEnv);
   if (rcPath === null) {
@@ -25675,7 +25895,7 @@ async function phase4ShellInit(opts, deps) {
       message: `unsupported $SHELL (${shellEnv ?? "unset"}); add \`eval "$(olam completion <shell>)"\` to your shell rc manually`
     };
   }
-  const shellBasename = path45.basename(shellEnv);
+  const shellBasename = path46.basename(shellEnv);
   const evalLine = `eval "$(olam completion ${shellBasename})"`;
   const result = appendIdempotent({
     rcPath,
@@ -25701,8 +25921,8 @@ async function phase4ShellInit(opts, deps) {
 async function phase5InitProject(opts, deps) {
   const cwd = deps.cwd ?? process.cwd();
   const projectRoot = findProjectRoot(cwd);
-  const configPath = path45.join(projectRoot, ".olam", "config.yaml");
-  if (existsSync45(configPath)) {
+  const configPath = path46.join(projectRoot, ".olam", "config.yaml");
+  if (existsSync46(configPath)) {
     return { ok: true, message: `${configPath} present (no change)` };
   }
   const promptFn = deps.prompt ?? defaultPrompt;
@@ -25831,24 +26051,24 @@ function registerSetup(program2) {
 }
 
 // src/commands/update.ts
-import * as fs42 from "node:fs";
+import * as fs43 from "node:fs";
 import * as os25 from "node:os";
-import * as path48 from "node:path";
+import * as path49 from "node:path";
 import { execSync as execSync13 } from "node:child_process";
 import pc23 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
-import * as fs40 from "node:fs";
-import * as path46 from "node:path";
+import * as fs41 from "node:fs";
+import * as path47 from "node:path";
 var realFs = {
-  readdirSync: (p) => fs40.readdirSync(p),
-  existsSync: (p) => fs40.existsSync(p),
-  lstatSync: (p) => fs40.lstatSync(p),
-  readlinkSync: (p) => fs40.readlinkSync(p),
-  symlinkSync: (t, l) => fs40.symlinkSync(t, l),
-  unlinkSync: (p) => fs40.unlinkSync(p),
+  readdirSync: (p) => fs41.readdirSync(p),
+  existsSync: (p) => fs41.existsSync(p),
+  lstatSync: (p) => fs41.lstatSync(p),
+  readlinkSync: (p) => fs41.readlinkSync(p),
+  symlinkSync: (t, l) => fs41.symlinkSync(t, l),
+  unlinkSync: (p) => fs41.unlinkSync(p),
   mkdirSync: (p, o) => {
-    fs40.mkdirSync(p, o);
+    fs41.mkdirSync(p, o);
   }
 };
 function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
@@ -25858,8 +26078,8 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   _fs.mkdirSync(claudeSkillsDir, { recursive: true });
   const sourceSkills = _fs.existsSync(npmSkillsDir) ? _fs.readdirSync(npmSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const skill of sourceSkills) {
-    const linkPath = path46.join(claudeSkillsDir, skill);
-    const target = path46.join(npmSkillsDir, skill);
+    const linkPath = path47.join(claudeSkillsDir, skill);
+    const target = path47.join(npmSkillsDir, skill);
     if (!_fs.existsSync(linkPath)) {
       try {
         _fs.symlinkSync(target, linkPath);
@@ -25872,7 +26092,7 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   }
   const deployedEntries = _fs.existsSync(claudeSkillsDir) ? _fs.readdirSync(claudeSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const entry of deployedEntries) {
-    const linkPath = path46.join(claudeSkillsDir, entry);
+    const linkPath = path47.join(claudeSkillsDir, entry);
     let isSymlink = false;
     try {
       isSymlink = _fs.lstatSync(linkPath).isSymbolicLink();
@@ -25897,9 +26117,9 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
 
 // src/commands/update.ts
 var PACKAGE_NAME = "@pleri/olam-cli";
-var CACHE_DIR2 = path48.join(os25.homedir(), ".olam", "cache");
-var LOG_DIR2 = path48.join(os25.homedir(), ".olam", "log");
-var LAST_STABLE_FILE = path48.join(CACHE_DIR2, "last-stable.txt");
+var CACHE_DIR2 = path49.join(os25.homedir(), ".olam", "cache");
+var LOG_DIR2 = path49.join(os25.homedir(), ".olam", "log");
+var LAST_STABLE_FILE = path49.join(CACHE_DIR2, "last-stable.txt");
 function defaultExec(cmd) {
   try {
     const stdout = execSync13(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
@@ -25921,22 +26141,22 @@ function getCurrentVersion(_exec = defaultExec) {
 }
 function readLastStable(file = LAST_STABLE_FILE) {
   try {
-    const v = fs42.readFileSync(file, "utf-8").trim();
+    const v = fs43.readFileSync(file, "utf-8").trim();
     return v || null;
   } catch {
     return null;
   }
 }
 function writeLastStable(version, file = LAST_STABLE_FILE) {
-  fs42.mkdirSync(path48.dirname(file), { recursive: true });
-  fs42.writeFileSync(file, version, { mode: 420 });
+  fs43.mkdirSync(path49.dirname(file), { recursive: true });
+  fs43.writeFileSync(file, version, { mode: 420 });
 }
 function logUpdateFailure(stderr) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const logFile = path48.join(LOG_DIR2, `update-${ts}.log`);
+  const logFile = path49.join(LOG_DIR2, `update-${ts}.log`);
   try {
-    fs42.mkdirSync(LOG_DIR2, { recursive: true });
-    fs42.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
+    fs43.mkdirSync(LOG_DIR2, { recursive: true });
+    fs43.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
 ${stderr}
 `, "utf-8");
   } catch {
@@ -26023,8 +26243,8 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
   let symlinkResult = { added: [], removed: [] };
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
-    const npmSkillsDir = path48.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
-    const claudeSkillsDir = path48.join(os25.homedir(), ".claude", "skills");
+    const npmSkillsDir = path49.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
+    const claudeSkillsDir = path49.join(os25.homedir(), ".claude", "skills");
     const rec = _reconcile(npmSkillsDir, claudeSkillsDir);
     symlinkResult = { added: rec.added, removed: rec.removed };
     if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
@@ -26070,8 +26290,8 @@ async function doRollback(_exec = defaultExec, _reconcile = reconcileSkillSymlin
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
     _reconcile(
-      path48.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
-      path48.join(os25.homedir(), ".claude", "skills")
+      path49.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
+      path49.join(os25.homedir(), ".claude", "skills")
     );
   }
   return { action: "rolled-back", restoredVersion: prev, exitCode: 0 };
@@ -26152,7 +26372,7 @@ function registerBegin(program2) {
 }
 
 // src/commands/config.ts
-import * as fs44 from "node:fs";
+import * as fs45 from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 
 // ../core/dist/global-config/index.js
@@ -26161,12 +26381,12 @@ init_store2();
 
 // ../core/dist/global-config/repos.js
 init_store2();
-import * as fs43 from "node:fs";
+import * as fs44 from "node:fs";
 import * as os26 from "node:os";
-import * as path49 from "node:path";
+import * as path50 from "node:path";
 function expandPath(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path49.join(os26.homedir(), p.slice(1));
+    return path50.join(os26.homedir(), p.slice(1));
   }
   return p;
 }
@@ -26179,7 +26399,7 @@ function addRepo(entry) {
     throw new Error(`repo "${entry.name}" already registered. Use "olam repos update" to change its path.`);
   }
   const resolvedPath = expandPath(entry.path);
-  if (!fs43.existsSync(resolvedPath)) {
+  if (!fs44.existsSync(resolvedPath)) {
     throw new Error(`path "${entry.path}" does not exist. Verify the path is correct.`);
   }
   const now = Date.now();
@@ -26208,7 +26428,7 @@ function updateRepo(name, updates) {
     throw new Error(`repo "${name}" is not registered. Run "olam repos list" to see registered repos.`);
   }
   const resolvedUpdatePath = updates.path !== void 0 ? expandPath(updates.path) : void 0;
-  if (resolvedUpdatePath !== void 0 && !fs43.existsSync(resolvedUpdatePath)) {
+  if (resolvedUpdatePath !== void 0 && !fs44.existsSync(resolvedUpdatePath)) {
     throw new Error(`path "${updates.path}" does not exist. Verify the path is correct.`);
   }
   const existing = config.repos[idx];
@@ -26238,14 +26458,14 @@ function registerConfig(program2) {
   const config = program2.command("config").description("Manage global olam configuration");
   config.command("validate [path]").description("Validate ~/.olam/config.json (or a custom path) against the schema").action((filePath) => {
     const resolvedPath = filePath ?? globalConfigPath();
-    if (!fs44.existsSync(resolvedPath)) {
+    if (!fs45.existsSync(resolvedPath)) {
       process.stderr.write(`config file not found: ${resolvedPath}
 `);
       process.exit(1);
     }
     let raw;
     try {
-      raw = fs44.readFileSync(resolvedPath, "utf-8");
+      raw = fs45.readFileSync(resolvedPath, "utf-8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`cannot read ${resolvedPath}: ${msg}
@@ -26568,17 +26788,17 @@ function registerWorldUpgrade(program2) {
 
 // src/commands/mcp/serve.ts
 init_output();
-import { existsSync as existsSync50 } from "node:fs";
-import { dirname as dirname25, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync51 } from "node:fs";
+import { dirname as dirname25, resolve as resolve11 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var here = dirname25(fileURLToPath6(import.meta.url));
-var BUNDLE_PATH = resolve10(here, "..", "..", "mcp-server.js");
+var BUNDLE_PATH = resolve11(here, "..", "..", "mcp-server.js");
 var MISSING_BUNDLE_REMEDY = "olam mcp server bundle missing at dist/mcp-server.js. For local dev, run: node packages/cli/scripts/bundle-mcp-server.mjs. Published @pleri/olam-cli tarballs always include this bundle (per prepublishOnly).";
 function registerMcpServe(cmd) {
   cmd.command("serve").description(
     "Run the olam MCP server (stdio transport). Claude Code wires this via `claude mcp add olam --scope user -- npx -y @pleri/olam-cli mcp serve`."
   ).action(async () => {
-    if (!existsSync50(BUNDLE_PATH)) {
+    if (!existsSync51(BUNDLE_PATH)) {
       printError(MISSING_BUNDLE_REMEDY);
       process.exitCode = 1;
       return;
@@ -26726,8 +26946,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path55, init = {}) {
-  const res = await fetch(`${BASE_URL}${path55}`, {
+async function apiFetch(path56, init = {}) {
+  const res = await fetch(`${BASE_URL}${path56}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -26987,12 +27207,12 @@ import * as readline3 from "node:readline";
 import pc29 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs45 from "node:fs";
+import * as fs46 from "node:fs";
 import * as os27 from "node:os";
-import * as path50 from "node:path";
+import * as path51 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs45.readFileSync(filePath, "utf-8");
+    const raw = fs46.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -27021,24 +27241,24 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path50.join(os27.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path51.join(os27.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path50.join(os27.homedir(), "AppData", "Roaming");
-    return path50.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path51.join(os27.homedir(), "AppData", "Roaming");
+    return path51.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path50.join(os27.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path51.join(os27.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path50.join(os27.homedir(), ".olam", "config.yaml"),
-    path50.join(process.cwd(), ".olam", "config.yaml")
+    path51.join(os27.homedir(), ".olam", "config.yaml"),
+    path51.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs45.existsSync(configPath)) continue;
+    if (!fs46.existsSync(configPath)) continue;
     try {
-      const raw = fs45.readFileSync(configPath, "utf-8");
+      const raw = fs46.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -27054,7 +27274,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path50.join(os27.homedir(), ".claude.json"),
+      path: path51.join(os27.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -27062,19 +27282,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path50.join(os27.homedir(), ".cursor", "mcp.json"),
+      path: path51.join(os27.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path50.join(os27.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path51.join(os27.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path50.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path50.basename(repoPath)})`
+      path: path51.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path51.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -27307,97 +27527,50 @@ function registerMcp(program2) {
 }
 
 // src/commands/kg-build.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
-import fs48 from "node:fs";
-import path53 from "node:path";
-
-// ../core/dist/kg/storage-paths.js
-import { homedir as homedir28 } from "node:os";
-import { join as join48, resolve as resolve11 } from "node:path";
-
-// ../core/dist/world/workspace-name.js
-var InvalidWorkspaceNameError = class extends Error {
-  constructor(name, reason) {
-    super(`invalid workspace name ${JSON.stringify(name)}: ${reason}`);
-    this.name = "InvalidWorkspaceNameError";
-  }
-};
-var WORKSPACE_NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
-function validateWorkspaceName(name) {
-  if (typeof name !== "string" || name.length === 0) {
-    throw new InvalidWorkspaceNameError(String(name), "must be a non-empty string");
-  }
-  if (!WORKSPACE_NAME_RE.test(name)) {
-    throw new InvalidWorkspaceNameError(name, "must match ^[a-z0-9][a-z0-9_-]*$ (lowercase letters, digits, hyphens, underscores; must start with letter or digit)");
-  }
-}
-
-// ../core/dist/kg/storage-paths.js
-function olamHome3() {
-  return process.env.OLAM_HOME ?? join48(homedir28(), ".olam");
-}
-function kgRoot() {
-  return join48(olamHome3(), "kg");
-}
-function worldsRoot() {
-  return join48(olamHome3(), "worlds");
-}
-function assertWithinPrefix(path55, prefix, label) {
-  if (!path55.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path55} not under ${prefix}/`);
-  }
-}
-function kgPristinePath(workspace) {
-  validateWorkspaceName(workspace);
-  const root = kgRoot();
-  const path55 = resolve11(join48(root, workspace));
-  assertWithinPrefix(path55, root, "kgPristinePath");
-  return path55;
-}
-var KG_PATHS_INTERNALS = Object.freeze({
-  olamHome: olamHome3,
-  kgRoot,
-  worldsRoot
-});
-
-// src/commands/kg-build.ts
+init_storage_paths();
+init_workspace_name();
 init_output();
+import { spawnSync as spawnSync16 } from "node:child_process";
+import fs49 from "node:fs";
+import path54 from "node:path";
 
 // src/commands/kg-status.ts
-import fs46 from "node:fs";
+init_storage_paths();
+init_workspace_name();
+import fs47 from "node:fs";
 import { homedir as homedir29 } from "node:os";
-import path51 from "node:path";
+import path52 from "node:path";
 init_output();
 function olamHome4() {
-  return process.env.OLAM_HOME ?? path51.join(homedir29(), ".olam");
+  return process.env.OLAM_HOME ?? path52.join(homedir29(), ".olam");
 }
 function kgRoot2() {
-  return path51.join(olamHome4(), "kg");
+  return path52.join(olamHome4(), "kg");
 }
 function worldsRoot2() {
-  return path51.join(olamHome4(), "worlds");
+  return path52.join(olamHome4(), "worlds");
 }
 function dirSizeBytes2(dir) {
-  if (!fs46.existsSync(dir)) return 0;
+  if (!fs47.existsSync(dir)) return 0;
   let total = 0;
   const stack = [dir];
   while (stack.length > 0) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs46.readdirSync(cur, { withFileTypes: true });
+      entries = fs47.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const full = path51.join(cur, entry.name);
+      const full = path52.join(cur, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
       }
       try {
-        total += fs46.statSync(full).size;
+        total += fs47.statSync(full).size;
       } catch {
       }
     }
@@ -27411,10 +27584,10 @@ function formatBytes5(n) {
   return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 function readFreshness(workspace) {
-  const file = path51.join(kgPristinePath(workspace), "freshness.json");
-  if (!fs46.existsSync(file)) return null;
+  const file = path52.join(kgPristinePath(workspace), "freshness.json");
+  if (!fs47.existsSync(file)) return null;
   try {
-    const raw = JSON.parse(fs46.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs47.readFileSync(file, "utf-8"));
     if (raw && typeof raw === "object") return raw;
     return null;
   } catch {
@@ -27422,10 +27595,10 @@ function readFreshness(workspace) {
   }
 }
 function readOverlayNodeCount(graphifyOutDir) {
-  const graphPath = path51.join(graphifyOutDir, "graph.json");
-  if (!fs46.existsSync(graphPath)) return null;
+  const graphPath = path52.join(graphifyOutDir, "graph.json");
+  if (!fs47.existsSync(graphPath)) return null;
   try {
-    const raw = JSON.parse(fs46.readFileSync(graphPath, "utf-8"));
+    const raw = JSON.parse(fs47.readFileSync(graphPath, "utf-8"));
     if (raw && typeof raw === "object") {
       const nodes = raw.nodes;
       if (Array.isArray(nodes)) return nodes.length;
@@ -27437,28 +27610,28 @@ function readOverlayNodeCount(graphifyOutDir) {
 }
 function listOverlays() {
   const root = worldsRoot2();
-  if (!fs46.existsSync(root)) return [];
+  if (!fs47.existsSync(root)) return [];
   const records = [];
   let worldDirs;
   try {
-    worldDirs = fs46.readdirSync(root, { withFileTypes: true });
+    worldDirs = fs47.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
   for (const worldEntry of worldDirs) {
     if (!worldEntry.isDirectory()) continue;
     const worldId = worldEntry.name;
-    const worldDir = path51.join(root, worldId);
+    const worldDir = path52.join(root, worldId);
     let cloneDirs;
     try {
-      cloneDirs = fs46.readdirSync(worldDir, { withFileTypes: true });
+      cloneDirs = fs47.readdirSync(worldDir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const cloneEntry of cloneDirs) {
       if (!cloneEntry.isDirectory()) continue;
-      const graphifyOut = path51.join(worldDir, cloneEntry.name, "graphify-out");
-      if (!fs46.existsSync(graphifyOut)) continue;
+      const graphifyOut = path52.join(worldDir, cloneEntry.name, "graphify-out");
+      if (!fs47.existsSync(graphifyOut)) continue;
       records.push({
         world_id: worldId,
         clone_dir: cloneEntry.name,
@@ -27472,11 +27645,11 @@ function listOverlays() {
 }
 function listPristines(overlays) {
   const root = kgRoot2();
-  if (!fs46.existsSync(root)) return [];
+  if (!fs47.existsSync(root)) return [];
   const records = [];
   let entries;
   try {
-    entries = fs46.readdirSync(root, { withFileTypes: true });
+    entries = fs47.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -27489,7 +27662,7 @@ function listPristines(overlays) {
       continue;
     }
     const fresh = readFreshness(workspace);
-    const graphifyOut = path51.join(kgPristinePath(workspace), "graphify-out");
+    const graphifyOut = path52.join(kgPristinePath(workspace), "graphify-out");
     const size = dirSizeBytes2(graphifyOut);
     const worldCount = overlays.filter((o) => o.clone_dir === workspace).length;
     records.push({
@@ -27621,12 +27794,14 @@ function registerKgStatusCommand(kg) {
 }
 
 // src/commands/kg-watch.ts
-import { spawn as spawn8 } from "node:child_process";
-import fs47 from "node:fs";
-import path52 from "node:path";
+init_storage_paths();
+init_workspace_name();
 init_output();
+import { spawn as spawn8 } from "node:child_process";
+import fs48 from "node:fs";
+import path53 from "node:path";
 function pidFilePath(workspace) {
-  return path52.join(kgPristinePath(workspace), ".watch.pid");
+  return path53.join(kgPristinePath(workspace), ".watch.pid");
 }
 function isPidAlive3(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -27641,39 +27816,39 @@ function isPidAlive3(pid) {
 }
 function readAndClassifyPid(workspace) {
   const file = pidFilePath(workspace);
-  if (!fs47.existsSync(file)) return { status: "no-pidfile", pid: null };
+  if (!fs48.existsSync(file)) return { status: "no-pidfile", pid: null };
   let pid;
   try {
-    const raw = fs47.readFileSync(file, "utf-8").trim();
+    const raw = fs48.readFileSync(file, "utf-8").trim();
     pid = Number.parseInt(raw, 10);
   } catch {
-    fs47.rmSync(file, { force: true });
+    fs48.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (!Number.isInteger(pid) || pid <= 0) {
-    fs47.rmSync(file, { force: true });
+    fs48.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (isPidAlive3(pid)) return { status: "active", pid };
-  fs47.rmSync(file, { force: true });
+  fs48.rmSync(file, { force: true });
   return { status: "stale-reclaimed", pid: null };
 }
 function writePidFile(workspace, pid) {
   const file = pidFilePath(workspace);
-  const dir = path52.dirname(file);
-  fs47.mkdirSync(dir, { recursive: true });
-  fs47.writeFileSync(file, String(pid), { encoding: "utf-8" });
+  const dir = path53.dirname(file);
+  fs48.mkdirSync(dir, { recursive: true });
+  fs48.writeFileSync(file, String(pid), { encoding: "utf-8" });
 }
 function removePidFile(workspace) {
   const file = pidFilePath(workspace);
   try {
-    fs47.rmSync(file, { force: true });
+    fs48.rmSync(file, { force: true });
   } catch {
   }
 }
 async function runKgWatch(workspaceArg, opts, deps = {}) {
   const cwd = deps.cwd ?? opts.cwd ?? process.cwd();
-  const name = workspaceArg ?? path52.basename(cwd).toLowerCase();
+  const name = workspaceArg ?? path53.basename(cwd).toLowerCase();
   try {
     validateWorkspaceName(name);
   } catch (err) {
@@ -27681,7 +27856,7 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
     return { exitCode: 1, pidWritten: false };
   }
   const pristinePath = kgPristinePath(name);
-  const graphPath = path52.join(pristinePath, "graphify-out", "graph.json");
+  const graphPath = path53.join(pristinePath, "graphify-out", "graph.json");
   const pidState = readAndClassifyPid(name);
   if (pidState.status === "active") {
     printError(
@@ -27747,7 +27922,7 @@ function registerKgWatchCommand(kg) {
 var DEFAULT_DEVBOX_IMAGE2 = "olam-devbox:latest";
 function resolveWorkspace(arg) {
   const cwd = process.cwd();
-  const name = arg ?? path53.basename(cwd).toLowerCase();
+  const name = arg ?? path54.basename(cwd).toLowerCase();
   validateWorkspaceName(name);
   return { name, sourcePath: cwd };
 }
@@ -27769,10 +27944,10 @@ function copyWorkspaceToScratch(source, scratch) {
   return "cp-r";
 }
 function parseNodeCount(graphifyOutDir) {
-  const graphPath = path53.join(graphifyOutDir, "graph.json");
-  if (!fs48.existsSync(graphPath)) return null;
+  const graphPath = path54.join(graphifyOutDir, "graph.json");
+  if (!fs49.existsSync(graphPath)) return null;
   try {
-    const content = fs48.readFileSync(graphPath, "utf-8");
+    const content = fs49.readFileSync(graphPath, "utf-8");
     const data = JSON.parse(content);
     return Array.isArray(data.nodes) ? data.nodes.length : null;
   } catch {
@@ -27806,10 +27981,10 @@ async function runKgBuild(workspaceArg, options = {}) {
     return { exitCode: 2 };
   }
   const outDir = kgPristinePath(workspace.name);
-  const scratchDir = path53.join(outDir, "scratch");
-  fs48.mkdirSync(outDir, { recursive: true });
-  if (fs48.existsSync(scratchDir)) fs48.rmSync(scratchDir, { recursive: true, force: true });
-  fs48.mkdirSync(scratchDir);
+  const scratchDir = path54.join(outDir, "scratch");
+  fs49.mkdirSync(outDir, { recursive: true });
+  if (fs49.existsSync(scratchDir)) fs49.rmSync(scratchDir, { recursive: true, force: true });
+  fs49.mkdirSync(scratchDir);
   const human = !options.json;
   if (human) {
     printInfo("kg build", `workspace=${workspace.name} source=${workspace.sourcePath}`);
@@ -27837,14 +28012,14 @@ async function runKgBuild(workspaceArg, options = {}) {
       printError(`graphify update failed (exit ${r.status})`);
       return { exitCode: r.status ?? 1 };
     }
-    const scratchOut = path53.join(scratchDir, "graphify-out");
-    const finalOut = path53.join(outDir, "graphify-out");
-    if (!fs48.existsSync(scratchOut)) {
+    const scratchOut = path54.join(scratchDir, "graphify-out");
+    const finalOut = path54.join(outDir, "graphify-out");
+    if (!fs49.existsSync(scratchOut)) {
       printError(`graphify produced no graphify-out/ in scratch (${scratchOut})`);
       return { exitCode: 1 };
     }
-    if (fs48.existsSync(finalOut)) fs48.rmSync(finalOut, { recursive: true, force: true });
-    fs48.renameSync(scratchOut, finalOut);
+    if (fs49.existsSync(finalOut)) fs49.rmSync(finalOut, { recursive: true, force: true });
+    fs49.renameSync(scratchOut, finalOut);
     const durationMs = Date.now() - started;
     const nodeCount = parseNodeCount(finalOut);
     const version = readGraphifyVersion(image);
@@ -27856,8 +28031,8 @@ async function runKgBuild(workspaceArg, options = {}) {
       workspace: workspace.name,
       scratch_strategy: scratchStrategy
     };
-    fs48.writeFileSync(
-      path53.join(outDir, "freshness.json"),
+    fs49.writeFileSync(
+      path54.join(outDir, "freshness.json"),
       JSON.stringify(freshness, null, 2) + "\n",
       "utf-8"
     );
@@ -27871,8 +28046,8 @@ async function runKgBuild(workspaceArg, options = {}) {
     }
     return { exitCode: 0, freshness, outputDir: finalOut };
   } finally {
-    if (fs48.existsSync(scratchDir)) {
-      fs48.rmSync(scratchDir, { recursive: true, force: true });
+    if (fs49.existsSync(scratchDir)) {
+      fs49.rmSync(scratchDir, { recursive: true, force: true });
     }
   }
 }
@@ -27889,18 +28064,18 @@ function registerKg(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs49 from "node:fs";
-import * as path54 from "node:path";
+import * as fs50 from "node:fs";
+import * as path55 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path54.join(configDir, "config.yaml");
-  if (!fs49.existsSync(configPath)) {
+  const configPath = path55.join(configDir, "config.yaml");
+  if (!fs50.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs49.readFileSync(configPath, "utf8");
+    const contents = fs50.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;