@pleri/olam-cli 0.1.115 → 0.1.117

package/dist/mcp-server.js

@@ -2986,7 +2986,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve8.call(this, root, ref);
+      let _sch = resolve9.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3013,7 +3013,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve8(root, ref) {
+    function resolve9(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3228,8 +3228,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path27) {
-      let input = path27;
+    function removeDotSegments(path28) {
+      let input = path28;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3428,8 +3428,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path27, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path27 && path27 !== "/" ? path27 : void 0;
+        const [path28, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path28 && path28 !== "/" ? path28 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -3588,7 +3588,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve8(baseURI, relativeURI, options) {
+    function resolve9(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -3815,7 +3815,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve8,
+      resolve: resolve9,
       resolveComponent,
       equal,
       serialize,
@@ -6791,12 +6791,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs24, exportName) {
+    function addFormats(ajv, list, fs25, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs24[f]);
+        ajv.addFormat(f, fs25[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -7002,10 +7002,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path27) {
-  if (!path27)
+function getElementAtPath(obj, path28) {
+  if (!path28)
     return obj;
-  return path27.reduce((acc, key) => acc?.[key], obj);
+  return path28.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -7325,11 +7325,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path27, issues) {
+function prefixIssues(path28, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path27);
+    iss.path.unshift(path28);
     return iss;
   });
 }
@@ -12914,12 +12914,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve8();
+        resolve9();
       } else {
-        this._stdout.once("drain", resolve8);
+        this._stdout.once("drain", resolve9);
       }
     });
   }
@@ -13403,8 +13403,8 @@ function getErrorMap() {
 
 // ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path27, errorMaps, issueData } = params;
-  const fullPath = [...path27, ...issueData.path || []];
+  const { data, path: path28, errorMaps, issueData } = params;
+  const fullPath = [...path28, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -13520,11 +13520,11 @@ var errorUtil;
 
 // ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path27, key) {
+  constructor(parent, value, path28, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path27;
+    this._path = path28;
     this._key = key;
   }
   get path() {
@@ -18987,7 +18987,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+        await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -19004,7 +19004,7 @@ var Protocol = class {
    */
   request(request2, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve8, reject2) => {
+    return new Promise((resolve9, reject2) => {
       const earlyReject = (error2) => {
         reject2(error2);
       };
@@ -19082,7 +19082,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject2(parseResult.error);
           } else {
-            resolve8(parseResult.data);
+            resolve9(parseResult.data);
           }
         } catch (error2) {
           reject2(error2);
@@ -19343,12 +19343,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve8, reject2) => {
+    return new Promise((resolve9, reject2) => {
       if (signal.aborted) {
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve8, interval);
+      const timeoutId = setTimeout(resolve9, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -20448,7 +20448,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+      await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -21365,8 +21365,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path27, body, attempt = 0) {
-    const url = `${this.baseUrl}${path27}`;
+  async request(method, path28, body, attempt = 0) {
+    const url = `${this.baseUrl}${path28}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -21384,7 +21384,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path27, body, attempt + 1);
+        return this.request(method, path28, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -21411,7 +21411,7 @@ async function safeText(res) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 
 // ../core/dist/auth/container.js
@@ -21543,7 +21543,7 @@ function resolveAuthServicePath() {
   return path3.join(pkgsDir, "auth-service");
 }
 function sleep2(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 
 // ../core/dist/auth/preflight.js
@@ -22212,12 +22212,12 @@ function register3(server, _ctx, _initError) {
         registry2.close();
       }
       try {
-        const { default: fs24 } = await import("node:fs");
+        const { default: fs25 } = await import("node:fs");
         const { default: os15 } = await import("node:os");
-        const { default: path27 } = await import("node:path");
-        const tokenPath = path27.join(os15.homedir(), ".olam", "host-cp.token");
-        if (fs24.existsSync(tokenPath)) {
-          const token = fs24.readFileSync(tokenPath, "utf-8").trim();
+        const { default: path28 } = await import("node:path");
+        const tokenPath = path28.join(os15.homedir(), ".olam", "host-cp.token");
+        if (fs25.existsSync(tokenPath)) {
+          const token = fs25.readFileSync(tokenPath, "utf-8").trim();
           await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -22412,7 +22412,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "deploy"
 ]);
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function refineForbiddenKeys(value, path27, ctx, rejectSource) {
+function refineForbiddenKeys(value, path28, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -22420,12 +22420,12 @@ function refineForbiddenKeys(value, path27, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path27, key],
+        path: [...path28, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path27.length === 0 && key === "source") {
+    if (rejectSource && path28.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -22433,21 +22433,21 @@ function refineForbiddenKeys(value, path27, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path27, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path28, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path27, rejectSource) {
+function rejectForbiddenKeys(value, path28, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path27}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path28}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path27}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path28}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path27}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path28}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -22885,10 +22885,10 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path27) {
-  if (!existsSync6(path27)) return null;
+function readOptional(path28) {
+  if (!existsSync6(path28)) return null;
   try {
-    return readFileSync5(path27, "utf8");
+    return readFileSync5(path28, "utf8");
   } catch {
     return null;
   }
@@ -23012,7 +23012,7 @@ var realDocker = {
   }
 };
 function spawnAsync(cmd, args, opts = {}) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn(cmd, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       signal: opts.signal
@@ -23026,10 +23026,10 @@ function spawnAsync(cmd, args, opts = {}) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve8({ exitCode: -1, stdout, stderr: stderr + err.message });
+      resolve9({ exitCode: -1, stdout, stderr: stderr + err.message });
     });
     child.on("close", (code) => {
-      resolve8({ exitCode: code ?? -1, stdout, stderr });
+      resolve9({ exitCode: code ?? -1, stdout, stderr });
     });
   });
 }
@@ -23362,7 +23362,7 @@ var stopAndRemove = async (container) => {
 
 // ../adapters/dist/docker/exec.js
 import { PassThrough } from "node:stream";
-var demuxStream = (stream) => new Promise((resolve8, reject2) => {
+var demuxStream = (stream) => new Promise((resolve9, reject2) => {
   const stdoutChunks = [];
   const stderrChunks = [];
   const stdout = new PassThrough();
@@ -23376,7 +23376,7 @@ var demuxStream = (stream) => new Promise((resolve8, reject2) => {
     stream.pipe(stdout);
   }
   stream.on("end", () => {
-    resolve8({
+    resolve9({
       stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
       stderr: Buffer.concat(stderrChunks).toString("utf-8")
     });
@@ -23721,7 +23721,7 @@ var SSHConnectionPool = class {
   // -----------------------------------------------------------------------
   async exec(host, command) {
     const client = await this.getConnection(host);
-    return new Promise((resolve8, reject2) => {
+    return new Promise((resolve9, reject2) => {
       client.exec(command, (err, stream) => {
         if (err) {
           reject2(new Error(`SSH exec failed on ${host}: ${err.message}`));
@@ -23736,7 +23736,7 @@ var SSHConnectionPool = class {
           stderr += data.toString();
         });
         stream.on("close", (code) => {
-          resolve8({
+          resolve9({
             exitCode: code ?? 0,
             stdout: stdout.trimEnd(),
             stderr: stderr.trimEnd()
@@ -23767,10 +23767,10 @@ var SSHConnectionPool = class {
       throw new Error(`No SSH configuration found for host: ${host}`);
     }
     const client = new SSHClient();
-    return new Promise((resolve8, reject2) => {
+    return new Promise((resolve9, reject2) => {
       client.on("ready", () => {
         this.connections.set(host, client);
-        resolve8(client);
+        resolve9(client);
       }).on("error", (err) => {
         this.connections.delete(host);
         reject2(new Error(`SSH connection to ${host} failed: ${err.message}`));
@@ -24187,8 +24187,8 @@ var CloudflareProvider = class extends ComputeProvider {
   // -----------------------------------------------------------------------
   // Internal fetch helper
   // -----------------------------------------------------------------------
-  async request(path27, method, body) {
-    const url = `${this.config.workerUrl}${path27}`;
+  async request(path28, method, body) {
+    const url = `${this.config.workerUrl}${path28}`;
     const bearer = await this.config.mintToken();
     const headers = {
       Authorization: `Bearer ${bearer}`
@@ -24750,7 +24750,7 @@ function register6(server, ctx, initError) {
                 }
               } catch {
               }
-              await new Promise((resolve8) => setTimeout(resolve8, POLL_INTERVAL_MS));
+              await new Promise((resolve9) => setTimeout(resolve9, POLL_INTERVAL_MS));
             }
           }
           if (authenticated) {
@@ -26627,10 +26627,10 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path27 = join12(args.outDir, "manifest.json");
-  await writeFile(path27, `${JSON.stringify(manifest, null, 2)}
+  const path28 = join12(args.outDir, "manifest.json");
+  await writeFile(path28, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path27, manifest };
+  return { path: path28, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
@@ -26884,9 +26884,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path27 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path27))) {
-        return httpReject(403, "outside_allow_list", { path: path27 });
+      const path28 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path28))) {
+        return httpReject(403, "outside_allow_list", { path: path28 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -26990,15 +26990,15 @@ ${JSON.stringify({ error: reason })}`
       unlinkSync2(udsPath);
     } catch {
     }
-    await new Promise((resolve8, reject2) => {
-      server.listen(udsPath, () => resolve8());
+    await new Promise((resolve9, reject2) => {
+      server.listen(udsPath, () => resolve9());
       server.once("error", reject2);
     });
     chmodSync3(udsPath, 384);
     port = 0;
   } else {
-    await new Promise((resolve8, reject2) => {
-      server.listen(opts.port ?? 0, "127.0.0.1", () => resolve8());
+    await new Promise((resolve9, reject2) => {
+      server.listen(opts.port ?? 0, "127.0.0.1", () => resolve9());
       server.once("error", reject2);
     });
     const addr = server.address();
@@ -27014,10 +27014,10 @@ ${JSON.stringify({ error: reason })}`
     } catch {
     }
     await Promise.race([
-      new Promise((resolve8, reject2) => {
-        server.close((err) => err ? reject2(err) : resolve8());
+      new Promise((resolve9, reject2) => {
+        server.close((err) => err ? reject2(err) : resolve9());
       }),
-      new Promise((resolve8) => setTimeout(resolve8, 5e3))
+      new Promise((resolve9) => setTimeout(resolve9, 5e3))
     ]);
     if (udsPath) {
       try {
@@ -27349,10 +27349,10 @@ async function acquireLaunchSlot() {
     _inFlightLaunches++;
     return releaseLaunchSlot;
   }
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     _launchQueue.push(() => {
       _inFlightLaunches++;
-      resolve8(releaseLaunchSlot);
+      resolve9(releaseLaunchSlot);
     });
   });
 }
@@ -27665,14 +27665,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path27 = join13(outDir, `${shot.name}.${ext}`);
+    const path28 = join13(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path27,
+      path: path28,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path27, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path28, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -28115,12 +28115,12 @@ function openUrl(url) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs24 } = await import("node:fs");
+    const { default: fs25 } = await import("node:fs");
     const { default: os15 } = await import("node:os");
-    const { default: path27 } = await import("node:path");
-    const tp = path27.join(os15.homedir(), ".olam", "host-cp.token");
-    if (!fs24.existsSync(tp)) return { token: null };
-    return { token: fs24.readFileSync(tp, "utf-8").trim() };
+    const { default: path28 } = await import("node:path");
+    const tp = path28.join(os15.homedir(), ".olam", "host-cp.token");
+    if (!fs25.existsSync(tp)) return { token: null };
+    return { token: fs25.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -28762,9 +28762,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("Optional human-readable description."),
       defaultBranch: external_exports.string().optional().describe("Default branch name (e.g. main).")
     },
-    async ({ name, path: path27, description, defaultBranch }) => {
+    async ({ name, path: path28, description, defaultBranch }) => {
       try {
-        const entry = addRepo({ name, path: path27, description, defaultBranch });
+        const entry = addRepo({ name, path: path28, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -28805,9 +28805,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("New description."),
       defaultBranch: external_exports.string().optional().describe("New default branch.")
     },
-    async ({ name, path: path27, description, defaultBranch }) => {
+    async ({ name, path: path28, description, defaultBranch }) => {
       try {
-        const entry = updateRepo(name, { path: path27, description, defaultBranch });
+        const entry = updateRepo(name, { path: path28, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -29638,9 +29638,9 @@ function loadConfig(startDir) {
 // ../core/dist/world/manager.js
 import * as crypto5 from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
-import * as fs21 from "node:fs";
+import * as fs22 from "node:fs";
 import * as os13 from "node:os";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -29857,14 +29857,183 @@ function removeBranch(repo, branch) {
   return { branch, action: "kept-local-commits", localCommitCount };
 }
 
-// ../core/dist/world/baseline-diff.js
+// ../core/dist/world/kg-overlay.js
 import { execFileSync as execFileSync3 } from "node:child_process";
 import * as fs15 from "node:fs";
-import * as os10 from "node:os";
 import * as path17 from "node:path";
+
+// ../core/dist/kg/storage-paths.js
+import { homedir as homedir10 } from "node:os";
+import { join as join18, resolve as resolve4 } from "node:path";
+
+// ../core/dist/world/workspace-name.js
+var InvalidWorkspaceNameError = class extends Error {
+  constructor(name, reason) {
+    super(`invalid workspace name ${JSON.stringify(name)}: ${reason}`);
+    this.name = "InvalidWorkspaceNameError";
+  }
+};
+var WORKSPACE_NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
+function validateWorkspaceName(name) {
+  if (typeof name !== "string" || name.length === 0) {
+    throw new InvalidWorkspaceNameError(String(name), "must be a non-empty string");
+  }
+  if (!WORKSPACE_NAME_RE.test(name)) {
+    throw new InvalidWorkspaceNameError(name, "must match ^[a-z0-9][a-z0-9_-]*$ (lowercase letters, digits, hyphens, underscores; must start with letter or digit)");
+  }
+}
+
+// ../core/dist/kg/storage-paths.js
+function olamHome() {
+  return process.env.OLAM_HOME ?? join18(homedir10(), ".olam");
+}
+function kgRoot() {
+  return join18(olamHome(), "kg");
+}
+function worldsRoot() {
+  return join18(olamHome(), "worlds");
+}
+function assertWithinPrefix(path28, prefix, label) {
+  if (!path28.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path28} not under ${prefix}/`);
+  }
+}
+function kgPristinePath(workspace) {
+  validateWorkspaceName(workspace);
+  const root = kgRoot();
+  const path28 = resolve4(join18(root, workspace));
+  assertWithinPrefix(path28, root, "kgPristinePath");
+  return path28;
+}
+var KG_PATHS_INTERNALS = Object.freeze({
+  olamHome,
+  kgRoot,
+  worldsRoot
+});
+
+// ../core/dist/world/kg-overlay.js
+var KgOverlayError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "KgOverlayError";
+  }
+};
+function ensureGitignoreEntry(worldClonePath) {
+  const gitignorePath = path17.join(worldClonePath, ".gitignore");
+  if (!fs15.existsSync(gitignorePath))
+    return "no-gitignore";
+  const content = fs15.readFileSync(gitignorePath, "utf-8");
+  const lines = content.split("\n").map((l) => l.trim());
+  const recognised = /* @__PURE__ */ new Set([
+    "graphify-out",
+    "graphify-out/",
+    "/graphify-out",
+    "/graphify-out/",
+    "**/graphify-out",
+    "**/graphify-out/"
+  ]);
+  if (lines.some((l) => recognised.has(l)))
+    return "present";
+  const eol = content.includes("\r\n") ? "\r\n" : "\n";
+  const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
+  const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
+  fs15.appendFileSync(gitignorePath, block, "utf-8");
+  return "appended";
+}
+function createWorldOverlay(opts) {
+  const pristineRoot = kgPristinePath(opts.workspace);
+  const pristinePath = path17.join(pristineRoot, "graphify-out");
+  if (!fs15.existsSync(pristinePath)) {
+    throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
+  }
+  if (!path17.isAbsolute(opts.worldClonePath)) {
+    throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
+  }
+  if (!fs15.existsSync(opts.worldClonePath)) {
+    throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
+  }
+  const overlayPath = path17.join(opts.worldClonePath, "graphify-out");
+  if (fs15.existsSync(overlayPath)) {
+    fs15.rmSync(overlayPath, { recursive: true, force: true });
+  }
+  const useReflink = process.platform === "darwin";
+  let strategy;
+  let reflinkError;
+  if (useReflink) {
+    try {
+      execFileSync3("cp", ["-c", "-r", pristinePath, opts.worldClonePath], {
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      strategy = "cp-c-r-reflink";
+    } catch (err) {
+      reflinkError = err;
+      strategy = "cp-r";
+    }
+  } else {
+    strategy = "cp-r";
+  }
+  if (strategy === "cp-r" || !fs15.existsSync(overlayPath)) {
+    try {
+      execFileSync3("cp", ["-r", pristinePath, opts.worldClonePath], {
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      strategy = "cp-r";
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const reflinkMsg = reflinkError instanceof Error ? ` (reflink also failed: ${reflinkError.message})` : "";
+      throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
+    }
+  }
+  if (!fs15.existsSync(overlayPath)) {
+    throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
+  }
+  const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
+  return {
+    pristinePath,
+    overlayPath,
+    strategy,
+    gitignoreAction
+  };
+}
+
+// ../core/dist/world/kg-install-hook.js
+import { execFileSync as execFileSync4 } from "node:child_process";
+var KgHookInstallError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "KgHookInstallError";
+  }
+};
+function installGraphifyHookInWorld(opts) {
+  const timeout = opts.timeoutMs ?? 3e4;
+  try {
+    execFileSync4("docker", [
+      "exec",
+      "-u",
+      "olam",
+      "-w",
+      `/home/olam/workspace/${opts.repoName}`,
+      opts.containerName,
+      "graphify",
+      "claude",
+      "install",
+      "--platform",
+      "claude"
+    ], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8", timeout });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new KgHookInstallError(`graphify claude install failed in ${opts.containerName} (repo=${opts.repoName}): ${msg}`);
+  }
+}
+
+// ../core/dist/world/baseline-diff.js
+import { execFileSync as execFileSync5 } from "node:child_process";
+import * as fs16 from "node:fs";
+import * as os10 from "node:os";
+import * as path18 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
-function expandHome(p, homedir15) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir15());
+function expandHome(p, homedir16) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir16());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -29886,11 +30055,11 @@ ${stderr}`;
   return /unknown revision|bad revision|does not have any commits|HEAD'?: ambiguous|Needed a single revision/.test(blob);
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
-  const homedir15 = deps.homedir ?? (() => os10.homedir());
-  const baselineDir = path17.join(workspacePath, ".olam", "baseline");
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync5(cmd, args, opts));
+  const homedir16 = deps.homedir ?? (() => os10.homedir());
+  const baselineDir = path18.join(workspacePath, ".olam", "baseline");
   try {
-    fs15.mkdirSync(baselineDir, { recursive: true });
+    fs16.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -29902,9 +30071,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path17.join(baselineDir, filename);
-    const repoPath = expandHome(repo.path, homedir15);
-    if (!fs15.existsSync(repoPath)) {
+    const outPath = path18.join(baselineDir, filename);
+    const repoPath = expandHome(repo.path, homedir16);
+    if (!fs16.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -29971,7 +30140,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs15.writeFileSync(outPath, content);
+    fs16.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -29979,11 +30148,11 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path17.join(workspacePath, repo.name);
-    if (!fs15.existsSync(worktreePath))
+    const worktreePath = path18.join(workspacePath, repo.name);
+    if (!fs16.existsSync(worktreePath))
       continue;
     try {
-      execFileSync3("git", ["checkout", "--", "."], {
+      execFileSync5("git", ["checkout", "--", "."], {
         cwd: worktreePath,
         stdio: "pipe"
       });
@@ -30010,14 +30179,14 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs16 from "node:fs";
-import * as path18 from "node:path";
+import * as fs17 from "node:fs";
+import * as path19 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var TEMPLATES_DIR = fileURLToPath2(new URL("./templates", import.meta.url));
 function injectWorldContext(opts) {
   const { world, task, linearTicketId, claudeMdExtra, taskContext, services, pleriPlaneUrl } = opts;
-  const claudeDir = path18.join(world.workspacePath, ".claude");
-  fs16.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir = path19.join(world.workspacePath, ".claude");
+  fs17.mkdirSync(claudeDir, { recursive: true });
   const sections = [];
   sections.push(`# Olam World: ${world.name}`);
   sections.push("");
@@ -30118,16 +30287,16 @@ function injectWorldContext(opts) {
     sections.push("");
   }
   const content = sections.join("\n");
-  fs16.writeFileSync(path18.join(claudeDir, "CLAUDE.md"), content);
+  fs17.writeFileSync(path19.join(claudeDir, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path18.join(workspacePath, ".olam", "docs");
-  fs16.mkdirSync(docsDir, { recursive: true });
+  const docsDir = path19.join(workspacePath, ".olam", "docs");
+  fs17.mkdirSync(docsDir, { recursive: true });
   for (const filename of ["lane-orchestration.md", "gh-pr-create.md"]) {
-    const src = path18.join(TEMPLATES_DIR, filename);
-    const dest = path18.join(docsDir, filename);
-    fs16.copyFileSync(src, dest);
+    const src = path19.join(TEMPLATES_DIR, filename);
+    const dest = path19.join(docsDir, filename);
+    fs17.copyFileSync(src, dest);
   }
 }
 function formatTaskSource(ctx) {
@@ -30142,9 +30311,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path18.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path19.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs16.existsSync(plansDir) && fs16.readdirSync(plansDir).length > 0;
+    return fs17.existsSync(plansDir) && fs17.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -30706,25 +30875,25 @@ function shellQuote(s) {
 
 // ../core/dist/world/snapshot.js
 import * as crypto4 from "node:crypto";
-import * as fs17 from "node:fs";
+import * as fs18 from "node:fs";
 import * as os11 from "node:os";
-import * as path19 from "node:path";
-import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_process";
+import * as path20 from "node:path";
+import { execFileSync as execFileSync6, spawn as spawn2 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path19.join(os11.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path20.join(os11.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDirByWorkspace(workspace, arch, kind) {
-  return path19.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
+  return path20.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path19.join(snapshotsDir(), worldId);
+  const legacyDir = path20.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs17.existsSync(legacyDir))
+  if (!fs18.existsSync(legacyDir))
     return;
   try {
-    fs17.rmSync(legacyDir, { recursive: true, force: true });
+    fs18.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -30743,11 +30912,11 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path19.join(repoDir, "Gemfile.lock");
-  if (!fs17.existsSync(lockfile))
+  const lockfile = path20.join(repoDir, "Gemfile.lock");
+  if (!fs18.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs17.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs18.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -30757,10 +30926,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path19.join(repoDir, name);
-    if (fs17.existsSync(lockfile)) {
+    const lockfile = path20.join(repoDir, name);
+    if (fs18.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs17.readFileSync(lockfile) }
+        { path: name, content: fs18.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -30779,18 +30948,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path19.dirname(destDir);
-  fs17.mkdirSync(parent, { recursive: true });
+  const parent = path20.dirname(destDir);
+  fs18.mkdirSync(parent, { recursive: true });
   const tmpSuffix = `.tmp-${process.pid}-${crypto4.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs17.mkdirSync(tmpDir, { recursive: true });
-    execFileSync4("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs17.renameSync(tmpDir, destDir);
+    fs18.mkdirSync(tmpDir, { recursive: true });
+    execFileSync6("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
+    fs18.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs17.rmSync(tmpDir, { recursive: true, force: true });
+      fs18.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -30801,12 +30970,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path19.resolve(base, target);
-  const baseResolved = path19.resolve(base);
-  const rel = path19.relative(baseResolved, resolved);
+  const resolved = path20.resolve(base, target);
+  const baseResolved = path20.resolve(base);
+  const rel = path20.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path19.isAbsolute(rel);
+  return !rel.startsWith("..") && !path20.isAbsolute(rel);
 }
 var TYPE_CHAR_TO_TYPE = {
   "-": "file",
@@ -30856,7 +31025,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs17.readFileSync(tarPath));
+    raw = gunzipSync(fs18.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -30871,7 +31040,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path19.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path20.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -30889,7 +31058,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
 function enumerateAndValidateTarballEntries(tarPath, targetDir) {
   let raw;
   try {
-    raw = execFileSync4("tar", ["-tvf", tarPath], {
+    raw = execFileSync6("tar", ["-tvf", tarPath], {
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
       encoding: "utf-8",
@@ -30909,7 +31078,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path19.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path20.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -30917,8 +31086,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path19.join(targetDir, path19.dirname(entry.name));
-      if (path19.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path19.join(path19.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path20.join(targetDir, path20.dirname(entry.name));
+      if (path20.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path20.join(path20.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -30928,7 +31097,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path19.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path20.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -30961,8 +31130,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path19.join(archDir, tarFilename);
-      if (!fs17.existsSync(tarPath)) {
+      const tarPath = path20.join(archDir, tarFilename);
+      if (!fs18.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -30977,9 +31146,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path19.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path20.join(repo.worktreeDir, targetSubpath);
       try {
-        fs17.rmSync(targetDir, { recursive: true, force: true });
+        fs18.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -30992,8 +31161,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs17.rmSync(tarPath, { force: true });
-          fs17.rmSync(manifestPath(tarPath), { force: true });
+          fs18.rmSync(tarPath, { force: true });
+          fs18.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -31009,10 +31178,10 @@ function restoreSnapshotsForRepos(input) {
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs17.existsSync(mPath))
+  if (!fs18.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs17.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs18.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
@@ -31027,17 +31196,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs17.mkdirSync(dir, { recursive: true });
-  const lockPath = path19.join(dir, EVICT_LOCK_FILENAME);
+  fs18.mkdirSync(dir, { recursive: true });
+  const lockPath = path20.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs17.openSync(lockPath, fs17.constants.O_WRONLY | fs17.constants.O_CREAT | fs17.constants.O_EXCL, 384);
+    fd = fs18.openSync(lockPath, fs18.constants.O_WRONLY | fs18.constants.O_CREAT | fs18.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs17.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs18.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -31045,23 +31214,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs17.unlinkSync(lockPath);
-      fd = fs17.openSync(lockPath, fs17.constants.O_WRONLY | fs17.constants.O_CREAT | fs17.constants.O_EXCL, 384);
+      fs18.unlinkSync(lockPath);
+      fd = fs18.openSync(lockPath, fs18.constants.O_WRONLY | fs18.constants.O_CREAT | fs18.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs17.writeSync(fd, `${process.pid}
+    fs18.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs17.closeSync(fd);
+    fs18.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs17.unlinkSync(lockPath);
+      fs18.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -31094,16 +31263,16 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs17.existsSync(dir))
+  if (!fs18.existsSync(dir))
     return 0;
   const allTars = [];
   const walk = (d) => {
-    for (const entry of fs17.readdirSync(d, { withFileTypes: true })) {
-      const full = path19.join(d, entry.name);
+    for (const entry of fs18.readdirSync(d, { withFileTypes: true })) {
+      const full = path20.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat = fs17.statSync(full);
+        const stat = fs18.statSync(full);
         allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
       }
     }
@@ -31118,8 +31287,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs17.rmSync(tar.path, { force: true });
-    fs17.rmSync(manifestPath(tar.path), { force: true });
+    fs18.rmSync(tar.path, { force: true });
+    fs18.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -31235,14 +31404,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 }
 
 // ../core/dist/world/olam-yaml.js
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path20.join(workspacePath, repo.name);
+    const repoDir = path21.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -31257,8 +31426,8 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs18 from "node:fs";
-import * as path21 from "node:path";
+import * as fs19 from "node:fs";
+import * as path22 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function parseFrontmatter(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -31278,20 +31447,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path21.join(workspaceRoot, ".olam", "policies");
-  if (!fs18.existsSync(policiesDir))
+  const policiesDir = path22.join(workspaceRoot, ".olam", "policies");
+  if (!fs19.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs18.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs19.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path21.join(policiesDir, file);
+    const filePath = path22.join(policiesDir, file);
     try {
-      const content = fs18.readFileSync(filePath, "utf8");
+      const content = fs19.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -31342,12 +31511,12 @@ function formatPoliciesBrief(policies) {
 }
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs19 from "node:fs";
+import * as fs20 from "node:fs";
 import * as os12 from "node:os";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path22.join(os12.homedir(), p.slice(1));
+    return path23.join(os12.homedir(), p.slice(1));
   }
   return p;
 }
@@ -31359,7 +31528,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs19.existsSync(resolvedPath)) {
+    if (!fs20.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -31372,19 +31541,19 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
 }
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs20 from "node:fs";
-import * as path23 from "node:path";
+import * as fs21 from "node:fs";
+import * as path24 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path23.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path23.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path23.dirname(destAbs);
-    fs20.mkdirSync(destDir, { recursive: true });
-    fs20.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path24.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path24.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path24.dirname(destAbs);
+    fs21.mkdirSync(destDir, { recursive: true });
+    fs21.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -32021,7 +32190,7 @@ ${detail}`);
       runbookSeeds = resolved.seeds;
     }
     const worldId = generateWorldId();
-    const workspacePath = path24.join(os13.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path25.join(os13.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = this.resolveReposWithWorkspace(opts);
@@ -32091,37 +32260,37 @@ ${detail}`);
       if (!repo.path)
         continue;
       const sourceRoot = repo.path.replace(/^~/, os13.homedir());
-      const worktreeRoot = path24.join(workspacePath, repo.name);
-      if (!fs21.existsSync(sourceRoot) || !fs21.existsSync(worktreeRoot))
+      const worktreeRoot = path25.join(workspacePath, repo.name);
+      if (!fs22.existsSync(sourceRoot) || !fs22.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path24.dirname(pattern), path24.basename(pattern)];
-          const sourceDir = path24.join(sourceRoot, dir);
-          if (fs21.existsSync(sourceDir)) {
+          const [dir, glob] = [path25.dirname(pattern), path25.basename(pattern)];
+          const sourceDir = path25.join(sourceRoot, dir);
+          if (fs22.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs21.readdirSync(sourceDir)) {
+              for (const entry of fs22.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path24.join(dir, entry));
+                  matches2.push(path25.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs21.existsSync(path24.join(sourceRoot, pattern))) {
+        } else if (fs22.existsSync(path25.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path24.join(sourceRoot, rel);
-          const dst = path24.join(worktreeRoot, rel);
+          const src = path25.join(sourceRoot, rel);
+          const dst = path25.join(worktreeRoot, rel);
           try {
-            const st = fs21.statSync(src);
+            const st = fs22.statSync(src);
             if (!st.isFile())
               continue;
-            fs21.mkdirSync(path24.dirname(dst), { recursive: true });
-            fs21.copyFileSync(src, dst);
+            fs22.mkdirSync(path25.dirname(dst), { recursive: true });
+            fs22.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -32205,6 +32374,24 @@ ${detail}`);
         console.warn(`[WorldManager] context injection failed: ${msg}`);
       }
     }
+    const overlayAttachments = [];
+    for (const repo of repos) {
+      const worldClonePath = path25.join(workspacePath, repo.name);
+      try {
+        const result = createWorldOverlay({
+          workspace: repo.name,
+          worldClonePath
+        });
+        overlayAttachments.push({ repo: repo.name, overlayPath: result.overlayPath });
+        console.log(`[WorldManager] KG overlay attached for ${repo.name}: ${result.strategy} (.gitignore: ${result.gitignoreAction})`);
+      } catch (err) {
+        if (err instanceof KgOverlayError && /pristine.*not found|MISSING/i.test(err.message)) {
+          continue;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        console.warn(`[WorldManager] KG overlay attach failed for ${repo.name}: ${msg}`);
+      }
+    }
     if (opts.planFile) {
       try {
         this.transportPlanFile(opts.planFile, workspacePath, repos.map((r) => r.name));
@@ -32221,7 +32408,7 @@ ${detail}`);
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path24.join(workspacePath, repo.name);
+          const repoDir = path25.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -32287,10 +32474,10 @@ ${detail}`);
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path24.join(os13.homedir(), ".olam", "r2-credentials.json");
-      if (fs21.existsSync(r2CredsPath)) {
+      const r2CredsPath = path25.join(os13.homedir(), ".olam", "r2-credentials.json");
+      if (fs22.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs21.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs22.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -32307,10 +32494,10 @@ ${detail}`);
         } catch {
         }
       }
-      const keysYamlPath = path24.join(os13.homedir(), ".olam", "keys.yaml");
-      if (fs21.existsSync(keysYamlPath)) {
+      const keysYamlPath = path25.join(os13.homedir(), ".olam", "keys.yaml");
+      if (fs22.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs21.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs22.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const parsed = YAML3.parse(keysRaw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -32369,10 +32556,10 @@ ${detail}`);
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path24.join(workspacePath, repoName, relativePath);
+          const absPath = path25.join(workspacePath, repoName, relativePath);
           try {
-            fs21.mkdirSync(path24.dirname(absPath), { recursive: true });
-            fs21.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs22.mkdirSync(path25.dirname(absPath), { recursive: true });
+            fs22.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -32423,6 +32610,15 @@ ${detail}`);
       await copyClaudeConfigIntoContainer(containerName);
     } catch {
     }
+    for (const { repo: repoName } of overlayAttachments) {
+      try {
+        installGraphifyHookInWorld({ containerName, repoName });
+        console.log(`[WorldManager] KG hook installed for ${repoName}`);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.warn(`[WorldManager] KG hook install failed for ${repoName}: ${msg}`);
+      }
+    }
     const credentialsInjected = { claude: !opts.noAuth, codex: false };
     try {
       await setupContainerGit(containerName, repos, branch);
@@ -32487,7 +32683,7 @@ ${detail}`);
         imageDigest: void 0,
         repos: enrichedRepos.map((r) => ({
           name: r.name,
-          worktreeDir: path24.join(workspacePath, r.name)
+          worktreeDir: path25.join(workspacePath, r.name)
         }))
       });
       for (const out of restoreResult.outcomes) {
@@ -32600,7 +32796,7 @@ ${detail}`);
         let taskWithPolicies = opts.task;
         try {
           const allPolicies = repos.flatMap((repo) => {
-            const repoWorktree = path24.join(workspacePath, repo.name);
+            const repoWorktree = path25.join(workspacePath, repo.name);
             return loadPolicies(repoWorktree);
           });
           const seen = /* @__PURE__ */ new Set();
@@ -32616,8 +32812,8 @@ ${detail}`);
 ${opts.task}`;
             execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
             for (const repo of repos) {
-              const policiesDir = path24.join(workspacePath, repo.name, ".olam", "policies");
-              if (fs21.existsSync(policiesDir)) {
+              const policiesDir = path25.join(workspacePath, repo.name, ".olam", "policies");
+              if (fs22.existsSync(policiesDir)) {
                 execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
               }
             }
@@ -32717,8 +32913,8 @@ ${opts.task}`;
     } catch {
     }
     try {
-      fs21.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs21.existsSync(world.workspacePath)) {
+      fs22.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs22.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -32827,14 +33023,14 @@ ${opts.task}`;
     }).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs21.readFileSync(planFilePath, "utf-8");
-    const planFileName = path24.basename(planFilePath);
+    const planContent = fs22.readFileSync(planFilePath, "utf-8");
+    const planFileName = path25.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path24.join(workspacePath, targetRepo, "docs", "plans");
-    fs21.mkdirSync(plansDir, { recursive: true });
-    fs21.writeFileSync(path24.join(plansDir, planFileName), planContent);
+    const plansDir = path25.join(workspacePath, targetRepo, "docs", "plans");
+    fs22.mkdirSync(plansDir, { recursive: true });
+    fs22.writeFileSync(path25.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -32930,8 +33126,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs22 from "node:fs";
-import * as path25 from "node:path";
+import * as fs23 from "node:fs";
+import * as path26 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -33266,7 +33462,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs22.existsSync(dbPath))
+  if (!fs23.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -33437,13 +33633,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port, registry: registry2 } = opts;
-  const thisDir = path25.dirname(fileURLToPath3(import.meta.url));
-  const defaultPublicDir = path25.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path26.dirname(fileURLToPath3(import.meta.url));
+  const defaultPublicDir = path26.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs22.existsSync(publicDir);
+  let hasPublicDir = fs23.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs22.existsSync(publicDir);
+      hasPublicDir = fs23.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port}`;
     const url = new URL(req.url ?? "/", `http://${host}`);
@@ -33717,22 +33913,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path25.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path26.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs22.existsSync(filePath) && fs22.statSync(filePath).isFile()) {
-      const ext = path25.extname(filePath);
+    if (fs23.existsSync(filePath) && fs23.statSync(filePath).isFile()) {
+      const ext = path26.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs22.createReadStream(filePath).pipe(res);
+      fs23.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path25.join(publicDir, "index.html");
-    if (fs22.existsSync(filePath)) {
+    filePath = path26.join(publicDir, "index.html");
+    if (fs23.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs22.createReadStream(filePath).pipe(res);
+      fs23.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -33742,17 +33938,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs23 from "node:fs";
+import * as fs24 from "node:fs";
 import * as os14 from "node:os";
-import * as path26 from "node:path";
-var STATE_PATH = path26.join(os14.homedir(), ".olam", "dashboard.json");
+import * as path27 from "node:path";
+var STATE_PATH = path27.join(os14.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs23.mkdirSync(path26.dirname(STATE_PATH), { recursive: true });
-  fs23.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs24.mkdirSync(path27.dirname(STATE_PATH), { recursive: true });
+  fs24.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs23.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs24.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -33760,7 +33956,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs23.unlinkSync(STATE_PATH);
+    fs24.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -33789,7 +33985,7 @@ function isCloudflaredAvailable() {
   }
 }
 function startTunnel(port) {
-  return new Promise((resolve8, reject2) => {
+  return new Promise((resolve9, reject2) => {
     const child = spawn3("cloudflared", ["tunnel", "--url", `http://localhost:${port}`], {
       stdio: ["ignore", "pipe", "pipe"],
       detached: false
@@ -33811,7 +34007,7 @@ function startTunnel(port) {
       if (match) {
         resolved = true;
         clearTimeout(timeout);
-        resolve8(match[0]);
+        resolve9(match[0]);
       }
     }
     child.stdout?.on("data", scan);
@@ -33879,8 +34075,8 @@ var DashboardManager = class {
       }
       throw err;
     }
-    await new Promise((resolve8, reject2) => {
-      this.server.on("listening", resolve8);
+    await new Promise((resolve9, reject2) => {
+      this.server.on("listening", resolve9);
       this.server.on("error", reject2);
     });
     this.info = { localUrl: `http://localhost:${port}` };
@@ -33926,8 +34122,8 @@ var DashboardManager = class {
   async stop() {
     stopTunnel();
     if (this.server) {
-      await new Promise((resolve8) => {
-        this.server.close(() => resolve8());
+      await new Promise((resolve9) => {
+        this.server.close(() => resolve9());
       });
       this.server = null;
     }
@@ -34040,8 +34236,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync16, existsSync as existsSync22, statSync as statSync7 } from "node:fs";
-import { join as join27, dirname as dirname15, resolve as resolve7 } from "node:path";
+import { readFileSync as readFileSync17, existsSync as existsSync23, statSync as statSync7 } from "node:fs";
+import { join as join29, dirname as dirname15, resolve as resolve8 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -34049,16 +34245,16 @@ var PROJECT_MARKERS = [
   "olam.yml"
 ];
 function findProjectRoot2(startDir) {
-  let dir = resolve7(startDir);
-  const root = resolve7("/");
+  let dir = resolve8(startDir);
+  const root = resolve8("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync22(join27(dir, marker))) return dir;
+      if (existsSync23(join29(dir, marker))) return dir;
     }
-    const pkg = join27(dir, "package.json");
-    if (existsSync22(pkg)) {
+    const pkg = join29(dir, "package.json");
+    if (existsSync23(pkg)) {
       try {
-        const json = JSON.parse(readFileSync16(pkg, "utf8"));
+        const json = JSON.parse(readFileSync17(pkg, "utf8"));
         const isOlamWorkspace = typeof json.name === "string" && json.name.startsWith("@olam/");
         const hasOlamDep = json.dependencies && Object.keys(json.dependencies).some((k) => k.startsWith("@olam/")) || json.devDependencies && Object.keys(json.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
@@ -34070,9 +34266,9 @@ function findProjectRoot2(startDir) {
     dir = parent;
   }
 }
-function parseEnvFile(path27) {
+function parseEnvFile(path28) {
   const out = {};
-  const raw = readFileSync16(path27, "utf8");
+  const raw = readFileSync17(path28, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -34095,8 +34291,8 @@ function loadProjectEnv(startDir = process.cwd()) {
   const filesRead = [];
   const merged = {};
   for (const name of [".env", ".env.local"]) {
-    const p = join27(root, name);
-    if (existsSync22(p) && statSync7(p).isFile()) {
+    const p = join29(root, name);
+    if (existsSync23(p) && statSync7(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }