@pleri/olam-cli 0.1.125 → 0.1.127

package/dist/index.js

@@ -4474,7 +4474,32 @@ var init_repo_manifest = __esm({
       // later in the seam. Statements are NOT exposed to operator-controlled
       // env variables — only the two whitelisted placeholders above. No shell
       // expansion, no DOLLAR-name expansion.
-      post_clone_sql: external_exports.record(external_exports.string().min(1), external_exports.array(external_exports.string().min(1))).optional()
+      post_clone_sql: external_exports.record(external_exports.string().min(1), external_exports.array(external_exports.string().min(1))).optional(),
+      // olam-hybrid-shared-postgres Phase B: per-seed env-var-name override.
+      //
+      // Phase A's F-6 derives the DB-name env var from the seed name using a
+      // POSTGRESQL_<PURPOSE>_DATABASE convention (atlas_common_seed →
+      // POSTGRESQL_COMMON_DATABASE). That works for atlas-core which uses
+      // POSTGRESQL_*-prefixed env vars throughout.
+      //
+      // Atlas-pay (and other future repos) use different env var names —
+      // e.g. ATLAS_PAY_DATABASE, not POSTGRESQL_PAY_DATABASE. This map lets
+      // a manifest declare the override explicitly:
+      //
+      //   services:
+      //     postgres:
+      //       seed_template:
+      //         - atlas_common_seed
+      //         - atlas_pay_seed
+      //       db_env_override:
+      //         atlas_pay_seed: ATLAS_PAY_DATABASE
+      //         # atlas_common_seed keeps F-6's default POSTGRESQL_COMMON_DATABASE
+      //
+      // Schema: Record<seed_template_name, env_var_name>. The env var name
+      // must be uppercase letters/digits/underscores ([A-Z][A-Z0-9_]*) — same
+      // shape as conventional shell env vars. F-6 honors the override when
+      // present; falls back to the derived default otherwise.
+      db_env_override: external_exports.record(external_exports.string().min(1), external_exports.string().regex(/^[A-Z][A-Z0-9_]*$/)).optional()
     }).passthrough();
     deploySchema = external_exports.object({
       tags: external_exports.array(external_exports.string()).optional()
@@ -5870,6 +5895,17 @@ function readHostCpToken() {
     return "";
   }
 }
+function readMemorySecret() {
+  const fromEnv = process.env["OLAM_MEMORY_SECRET"];
+  if (fromEnv && fromEnv.length > 0)
+    return fromEnv;
+  const file = path11.join(os6.homedir(), ".olam", "memory-secret");
+  try {
+    return fs10.readFileSync(file, "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
 function sanitizeContainerName(name) {
   return name.replace(/[^a-zA-Z0-9_.-]/g, "-");
 }
@@ -5917,7 +5953,7 @@ async function auditPortsForZombies(docker2, hostPorts) {
     }
   }
 }
-var realPullImage, serviceContainerName, worldContainerName, miseCacheVolumeName, PACKAGE_MANAGER_CACHE_DIRS, createServiceContainer, DEFAULT_IMAGE2, CONTROL_PLANE_PORT, HOST_CONTROL_PLANE_BASE, HOST_APP_PORT_BASE_DELTA, DEFAULT_MEMORY_BYTES, PortHeldByZombieError, createWorldContainer, stopAndRemove;
+var realPullImage, AGENTMEMORY_HOST_INTERNAL_URL, serviceContainerName, worldContainerName, miseCacheVolumeName, PACKAGE_MANAGER_CACHE_DIRS, createServiceContainer, DEFAULT_IMAGE2, CONTROL_PLANE_PORT, HOST_CONTROL_PLANE_BASE, HOST_APP_PORT_BASE_DELTA, DEFAULT_MEMORY_BYTES, PortHeldByZombieError, createWorldContainer, stopAndRemove;
 var init_container2 = __esm({
   "../adapters/dist/docker/container.js"() {
     "use strict";
@@ -5925,6 +5961,7 @@ var init_container2 = __esm({
     init_pull();
     init_volume();
     realPullImage = (imageRef, platform) => pullImageWithRetry(imageRef, void 0, platform ? { perAttemptTimeoutMs: 18e4, retryOnce: true, platform } : { perAttemptTimeoutMs: 18e4, retryOnce: true });
+    AGENTMEMORY_HOST_INTERNAL_URL = "http://host.docker.internal:3111";
     serviceContainerName = (worldId, serviceName) => `olam-${sanitizeContainerName(worldId)}-${sanitizeContainerName(serviceName)}`;
     worldContainerName = (worldId) => `olam-${sanitizeContainerName(worldId)}-devbox`;
     miseCacheVolumeName = (arch2 = process.arch) => `olam-mise-cache-${arch2}`;
@@ -6007,6 +6044,7 @@ var init_container2 = __esm({
       const labels = olamLabels(worldId, worldName);
       const authSecret = readAuthSecret();
       const hostCpToken = readHostCpToken();
+      const memorySecret = readMemorySecret();
       const worldEnv = {
         OLAM_WORLD_ID: worldId,
         OLAM_WORLD_NAME: worldName,
@@ -6023,6 +6061,14 @@ var init_container2 = __esm({
         OLAM_HOST_CP_URL: "http://host.docker.internal:19000",
         ...authSecret ? { OLAM_AUTH_SECRET: authSecret } : {},
         ...hostCpToken ? { OLAM_HOST_CP_TOKEN: hostCpToken } : {},
+        // Phase B1 — agent-memory wiring. Both vars are injected together
+        // (or neither): without a secret the URL is useless. The in-world
+        // @agentmemory/mcp shim (Phase B2/B3) reads these env vars to find
+        // the host's REST endpoint.
+        ...memorySecret ? {
+          AGENTMEMORY_URL: AGENTMEMORY_HOST_INTERNAL_URL,
+          AGENTMEMORY_SECRET: memorySecret
+        } : {},
         ...env
       };
       const envList = Object.entries(worldEnv).map(([k, v]) => `${k}=${v}`);
@@ -11221,6 +11267,7 @@ function applyPostgresNetworkOverrides(worldEnv, enrichedRepos, worldId) {
     if (worldId !== void 0) {
       assertSafeWorldId(worldId);
       const seedTemplates = /* @__PURE__ */ new Set();
+      const dbEnvOverride = {};
       for (const repo of enrichedRepos) {
         const pg = repo.manifest?.services?.["postgres"];
         const raw = pg?.seed_template;
@@ -11231,12 +11278,23 @@ function applyPostgresNetworkOverrides(worldEnv, enrichedRepos, worldId) {
             if (typeof s === "string")
               seedTemplates.add(s);
         }
+        if (pg?.db_env_override && typeof pg.db_env_override === "object") {
+          for (const [seedKey, envName] of Object.entries(pg.db_env_override)) {
+            if (typeof envName === "string" && envName.length > 0) {
+              dbEnvOverride[seedKey] = envName;
+            }
+          }
+        }
       }
       for (const seed of seedTemplates) {
-        const match2 = seed.match(/^atlas_([a-z][a-z0-9_]*?)_seed$/i);
-        if (match2 && match2[1] !== void 0) {
-          const purpose = match2[1].toUpperCase();
-          const envKey = `POSTGRESQL_${purpose}_DATABASE`;
+        let envKey = dbEnvOverride[seed];
+        if (envKey === void 0) {
+          const match2 = seed.match(/^atlas_([a-z][a-z0-9_]*?)_seed$/i);
+          if (match2 && match2[1] !== void 0) {
+            envKey = `POSTGRESQL_${match2[1].toUpperCase()}_DATABASE`;
+          }
+        }
+        if (envKey !== void 0) {
           worldEnv[envKey] = deriveWorldDbName(seed, worldId);
         }
       }
@@ -16888,9 +16946,9 @@ ${pc9.dim("Next: olam create --name my-world")}`);
 
 // src/commands/create.ts
 init_manager();
-import { spawnSync as spawnSync11 } from "node:child_process";
-import { existsSync as existsSync28 } from "node:fs";
-import { dirname as dirname18, resolve as resolve12 } from "node:path";
+import { spawnSync as spawnSync12 } from "node:child_process";
+import { existsSync as existsSync29 } from "node:fs";
+import { dirname as dirname19, resolve as resolve12 } from "node:path";
 import ora3 from "ora";
 import pc10 from "picocolors";
 
@@ -17124,6 +17182,132 @@ function decideWorkspaceMatch(input) {
 init_context();
 init_output();
 init_host_cp();
+
+// src/lib/memory-secret.ts
+import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync20, statSync as statSync7, writeFileSync as writeFileSync13, renameSync as renameSync4, chmodSync as chmodSync3 } from "node:fs";
+import { homedir as homedir17 } from "node:os";
+import { join as join34, dirname as dirname18 } from "node:path";
+import { randomBytes as randomBytes6 } from "node:crypto";
+var MEMORY_SECRET_PATH = join34(homedir17(), ".olam", "memory-secret");
+var SECRET_LEN_BYTES = 32;
+function generateSecret() {
+  return randomBytes6(SECRET_LEN_BYTES).toString("hex");
+}
+function writeSecretAtPath(path56, value) {
+  mkdirSync17(dirname18(path56), { recursive: true });
+  const tmp = `${path56}.tmp.${process.pid}`;
+  writeFileSync13(tmp, value, { mode: 384 });
+  chmodSync3(tmp, 384);
+  renameSync4(tmp, path56);
+}
+function readSecretAtPathOrNull(path56) {
+  if (!existsSync28(path56)) return null;
+  const mode = statSync7(path56).mode & 511;
+  if (mode !== 384) {
+    process.stderr.write(
+      `warn: ${path56} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
+`
+    );
+  }
+  return readFileSync20(path56, "utf8").trim();
+}
+function readSecretAtPath(path56) {
+  const v = readSecretAtPathOrNull(path56);
+  if (v === null) {
+    throw new Error(
+      `Secret not found at ${path56}. Run 'olam memory start' to generate it.`
+    );
+  }
+  return v;
+}
+function ensureMemorySecret(path56 = MEMORY_SECRET_PATH) {
+  const existing = readSecretAtPathOrNull(path56);
+  if (existing) return existing;
+  const fresh = generateSecret();
+  writeSecretAtPath(path56, fresh);
+  return fresh;
+}
+function readMemorySecretOrNull(path56 = MEMORY_SECRET_PATH) {
+  return readSecretAtPathOrNull(path56);
+}
+function readMemorySecret2(path56 = MEMORY_SECRET_PATH) {
+  return readSecretAtPath(path56);
+}
+function rotateMemorySecret(path56 = MEMORY_SECRET_PATH) {
+  const fresh = generateSecret();
+  writeSecretAtPath(path56, fresh);
+  return fresh;
+}
+function hasMemorySecret(path56 = MEMORY_SECRET_PATH) {
+  return existsSync28(path56);
+}
+
+// src/lib/world-mcp-register.ts
+import { spawnSync as spawnSync11 } from "node:child_process";
+var DEFAULT_DOCKER_EXEC_DEPS = {
+  spawn: spawnSync11,
+  log: (msg) => console.log(msg)
+};
+var MCP_NAME = "agentmemory";
+var MCP_BIN = "agentmemory-mcp";
+function probeMcpListed(containerName, deps) {
+  const result = deps.spawn(
+    "docker",
+    ["exec", containerName, "claude", "mcp", "list"],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
+  );
+  if (result.status !== 0) return "unknown";
+  const combined = `${result.stdout ?? ""}
+${result.stderr ?? ""}`;
+  return new RegExp(`^\\s*${MCP_NAME}\\b`, "m").test(combined) ? "present" : "absent";
+}
+function registerAgentMemoryMcp(opts, deps = DEFAULT_DOCKER_EXEC_DEPS) {
+  if (!opts.agentmemorySecret || opts.agentmemorySecret.length === 0) {
+    return {
+      outcome: "skipped-no-env",
+      reason: "world has no AGENTMEMORY_SECRET (memory service was absent or --skip-memory active at spawn time)"
+    };
+  }
+  const probe2 = probeMcpListed(opts.containerName, deps);
+  if (probe2 === "present") {
+    return { outcome: "already-registered", scope: "user" };
+  }
+  const args = [
+    "exec",
+    opts.containerName,
+    "claude",
+    "mcp",
+    "add",
+    MCP_NAME,
+    "--scope",
+    "user",
+    "--env",
+    `AGENTMEMORY_URL=${opts.agentmemoryUrl}`,
+    "--env",
+    `AGENTMEMORY_SECRET=${opts.agentmemorySecret}`,
+    "--",
+    MCP_BIN
+  ];
+  const redacted = args.map(
+    (a) => a.startsWith("AGENTMEMORY_SECRET=") ? "AGENTMEMORY_SECRET=<redacted>" : a
+  );
+  deps.log?.(`Wiring agent-memory MCP in ${opts.containerName}: docker ${redacted.join(" ")}`);
+  const result = deps.spawn("docker", args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.status === 0) {
+    return { outcome: "registered", scope: "user" };
+  }
+  const detail = (result.stderr?.trim() || result.stdout?.trim() || "(no output)").replace(
+    /AGENTMEMORY_SECRET=\S+/g,
+    "AGENTMEMORY_SECRET=<redacted>"
+  );
+  return { outcome: "failed", rc: result.status ?? 1, detail };
+}
+
+// src/commands/create.ts
+var AGENTMEMORY_LOCAL_URL = "http://host.docker.internal:3111";
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
@@ -17160,7 +17344,7 @@ function registerCreate(program2) {
       if (decision.stderrLine) {
         process.stderr.write(decision.stderrLine + "\n");
       }
-      spawnSync11("docker", ["pull", overrideRef], { stdio: "pipe" });
+      spawnSync12("docker", ["pull", overrideRef], { stdio: "pipe" });
       const { inspectImageProtocolVersions: inspectImageProtocolVersions2, checkProtocolOverlap: checkProtocolOverlap2 } = await Promise.resolve().then(() => (init_protocol_version(), protocol_version_exports));
       const inspect = inspectImageProtocolVersions2(overrideRef);
       if (inspect.inspectFailed) {
@@ -17277,7 +17461,7 @@ function registerCreate(program2) {
             throw err;
           }
           const spinner2 = ora3("Rebuilding olam-devbox:latest\u2026").start();
-          const rebuild = spawnSync11(
+          const rebuild = spawnSync12(
             "bash",
             [buildScript],
             { cwd: repoRoot, stdio: "inherit" }
@@ -17314,6 +17498,34 @@ function registerCreate(program2) {
         ...opts.runbook ? { runbookName: opts.runbook } : {}
       });
       spinner.succeed("World created");
+      try {
+        const memorySecret = readMemorySecretOrNull() ?? "";
+        const containerName = `olam-${world.id}-devbox`;
+        const result = registerAgentMemoryMcp({
+          containerName,
+          agentmemoryUrl: AGENTMEMORY_LOCAL_URL,
+          agentmemorySecret: memorySecret
+        });
+        switch (result.outcome) {
+          case "registered":
+            printInfo("Agent memory", `MCP registered in-world (--scope ${result.scope})`);
+            break;
+          case "already-registered":
+            printInfo("Agent memory", `MCP already registered (idempotent skip)`);
+            break;
+          case "skipped-no-env":
+            break;
+          case "failed":
+            printWarning(
+              `Agent memory MCP registration failed (rc=${result.rc}): ${result.detail}. World is still usable; the in-world @agentmemory/mcp shim falls back to local InMemoryKV.`
+            );
+            break;
+        }
+      } catch (err) {
+        printWarning(
+          `Agent memory MCP registration threw: ${err instanceof Error ? err.message : String(err)}. World is still usable.`
+        );
+      }
       if (opts.keepAfterMerge) {
         const { WorldRegistry: WorldRegistry2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
         const reg2 = new WorldRegistry2();
@@ -17484,10 +17696,10 @@ ${pc10.cyan("Host CP UI:")} ${worldUrl}`);
 function resolveRepoRoot(start) {
   let cur = start;
   while (true) {
-    if (existsSync28(resolve12(cur, "packages")) && existsSync28(resolve12(cur, "package.json"))) {
+    if (existsSync29(resolve12(cur, "packages")) && existsSync29(resolve12(cur, "package.json"))) {
       return cur;
     }
-    const parent = dirname18(cur);
+    const parent = dirname19(cur);
     if (parent === cur) return start;
     cur = parent;
   }
@@ -20951,7 +21163,7 @@ function registerPolicyCheck(program2) {
 }
 
 // src/commands/worldspec/compile.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync18, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync19, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 import YAML5 from "yaml";
 
@@ -21754,13 +21966,13 @@ function registerWorldspecCompile(parent) {
     const sourcePolicies = [];
     for (const p of paths) {
       const abs = resolvePath(process.cwd(), p);
-      if (!existsSync33(abs)) {
+      if (!existsSync34(abs)) {
         printError(`worldspec not found at ${abs}`);
         process.exit(EXIT_WORLDSPEC_FILE_NOT_FOUND);
       }
       let yaml;
       try {
-        yaml = YAML5.parse(readFileSync22(abs, "utf8"));
+        yaml = YAML5.parse(readFileSync23(abs, "utf8"));
       } catch (err) {
         printError(
           `${p}: YAML parse error: ${err.message}`
@@ -21816,13 +22028,13 @@ Resolutions:
     if (opts.out) {
       const outDir = resolvePath(process.cwd(), opts.out);
       try {
-        mkdirSync18(outDir, { recursive: true });
-        writeFileSync14(
+        mkdirSync19(outDir, { recursive: true });
+        writeFileSync15(
           resolvePath(outDir, "execution-graph.json"),
           graphJson,
           "utf8"
         );
-        writeFileSync14(
+        writeFileSync15(
           resolvePath(outDir, "lockfile.json"),
           lockfileJson,
           "utf8"
@@ -21845,7 +22057,7 @@ function getPkgVersion() {
 // src/commands/worldspec/init.ts
 init_exit_codes();
 init_output();
-import { existsSync as existsSync34, mkdirSync as mkdirSync19, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync20, readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "node:fs";
 import { execSync as execSync10 } from "node:child_process";
 import { basename as basename3, resolve as resolvePath2 } from "node:path";
 function registerWorldspecInit(parent) {
@@ -21863,7 +22075,7 @@ function registerWorldspecInit(parent) {
     const cwd = process.cwd();
     const targetDir = resolvePath2(cwd, ".olam/worldspecs");
     const targetFile = resolvePath2(targetDir, "default.yaml");
-    if (existsSync34(targetFile) && !opts.force) {
+    if (existsSync35(targetFile) && !opts.force) {
       printError(
         `${targetFile} already exists; pass --force to overwrite`
       );
@@ -21878,8 +22090,8 @@ function registerWorldspecInit(parent) {
     const shape = detectProjectShape(cwd, opts.fromAdbYaml);
     const yaml = renderWorldspecYaml(shape);
     try {
-      mkdirSync19(targetDir, { recursive: true });
-      writeFileSync15(targetFile, yaml, {
+      mkdirSync20(targetDir, { recursive: true });
+      writeFileSync16(targetFile, yaml, {
         encoding: "utf8",
         flag: opts.force ? "w" : "wx"
       });
@@ -21897,14 +22109,14 @@ function registerWorldspecInit(parent) {
   });
 }
 function detectProjectShape(root, useAdbYaml) {
-  const hasGemfile = existsSync34(resolvePath2(root, "Gemfile"));
-  const hasNodePackageJson = existsSync34(resolvePath2(root, "package.json"));
-  const hasAdbYaml = existsSync34(resolvePath2(root, ".adb.yaml"));
+  const hasGemfile = existsSync35(resolvePath2(root, "Gemfile"));
+  const hasNodePackageJson = existsSync35(resolvePath2(root, "package.json"));
+  const hasAdbYaml = existsSync35(resolvePath2(root, ".adb.yaml"));
   let rubyVersion = null;
   const rubyVersionPath = resolvePath2(root, ".ruby-version");
-  if (existsSync34(rubyVersionPath)) {
+  if (existsSync35(rubyVersionPath)) {
     try {
-      const raw = readFileSync23(rubyVersionPath, "utf8").trim();
+      const raw = readFileSync24(rubyVersionPath, "utf8").trim();
       const match2 = raw.match(/(\d+\.\d+\.\d+)/);
       if (match2) rubyVersion = match2[1] ?? null;
     } catch {
@@ -21976,7 +22188,7 @@ function relativeFromCwd(absPath, cwd) {
 }
 
 // src/commands/worldspec/schema.ts
-import { writeFileSync as writeFileSync16 } from "node:fs";
+import { writeFileSync as writeFileSync17 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 
 // ../../node_modules/zod-to-json-schema/dist/esm/Options.js
@@ -23291,7 +23503,7 @@ function registerWorldspecSchema(parent) {
     if (opts.out) {
       const absPath = resolvePath3(process.cwd(), opts.out);
       try {
-        writeFileSync16(absPath, json + "\n", "utf8");
+        writeFileSync17(absPath, json + "\n", "utf8");
       } catch (err) {
         printError(
           `failed to write ${absPath}: ${err.message}`
@@ -23307,7 +23519,7 @@ function registerWorldspecSchema(parent) {
 }
 
 // src/commands/worldspec/validate.ts
-import { existsSync as existsSync35, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync36, readFileSync as readFileSync25 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 init_exit_codes();
 init_output();
@@ -23324,13 +23536,13 @@ function registerWorldspecValidate(parent) {
     "human"
   ).action(async (pathArg, opts) => {
     const absPath = resolvePath4(process.cwd(), pathArg);
-    if (!existsSync35(absPath)) {
+    if (!existsSync36(absPath)) {
       printError(`worldspec not found at ${absPath}`);
       process.exit(EXIT_WORLDSPEC_FILE_NOT_FOUND);
     }
     let yamlSource;
     try {
-      yamlSource = readFileSync24(absPath, "utf8");
+      yamlSource = readFileSync25(absPath, "utf8");
     } catch (err) {
       printError(
         `failed to read ${absPath}: ${err.message}`
@@ -23378,7 +23590,7 @@ init_output();
 init_host_cp();
 import * as fs35 from "node:fs";
 import * as path38 from "node:path";
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 import ora7 from "ora";
 import pc18 from "picocolors";
 
@@ -23386,7 +23598,7 @@ import pc18 from "picocolors";
 import * as fs33 from "node:fs";
 import * as os19 from "node:os";
 import * as path36 from "node:path";
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 var LOCK_FILE_PATH = path36.join(os19.homedir(), ".olam", ".upgrade.lock");
 var STALE_LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 function readLockFile(lockPath) {
@@ -23411,7 +23623,7 @@ function isPidAlive2(pid) {
 }
 var PS_UNAVAILABLE = "__ps_unavailable__";
 function getPidCommand(pid) {
-  const result = spawnSync12("ps", ["-p", String(pid), "-o", "comm="], {
+  const result = spawnSync13("ps", ["-p", String(pid), "-o", "comm="], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "ignore"]
   });
@@ -23670,7 +23882,7 @@ function extractBundleHash(indexHtml) {
 function runStep2(label, cmd, args, opts = {}) {
   const start = Date.now();
   process.stdout.write(`  ${pc18.dim(label.padEnd(34))}`);
-  const result = spawnSync13(cmd, [...args], {
+  const result = spawnSync14(cmd, [...args], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd: opts.cwd ?? process.cwd(),
@@ -23689,7 +23901,7 @@ function runStep2(label, cmd, args, opts = {}) {
   };
 }
 function isGitDirty(cwd) {
-  const result = spawnSync13("git", ["status", "--porcelain"], {
+  const result = spawnSync14("git", ["status", "--porcelain"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -23697,7 +23909,7 @@ function isGitDirty(cwd) {
   return (result.stdout ?? "").trim().length > 0;
 }
 function hasGitUpstream(cwd) {
-  const result = spawnSync13("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
+  const result = spawnSync14("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -23705,7 +23917,7 @@ function hasGitUpstream(cwd) {
   return result.status === 0;
 }
 function captureHeadSha(cwd) {
-  const result = spawnSync13("git", ["rev-parse", "HEAD"], {
+  const result = spawnSync14("git", ["rev-parse", "HEAD"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -23720,7 +23932,7 @@ function abbreviateSha(sha) {
 }
 function imageExists(tag) {
   try {
-    const result = spawnSync13("docker", ["image", "inspect", "--format", "{{.Id}}", tag], {
+    const result = spawnSync14("docker", ["image", "inspect", "--format", "{{.Id}}", tag], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -23736,7 +23948,7 @@ function checkRollbackSetExists(plan) {
 }
 var SMOKE_DOCKER_TIMEOUT_MS = 3e4;
 function smokeImage(image, targetSha) {
-  const createResult = spawnSync13("docker", ["create", "--name", `olam-smoke-${Date.now()}`, image], {
+  const createResult = spawnSync14("docker", ["create", "--name", `olam-smoke-${Date.now()}`, image], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: SMOKE_DOCKER_TIMEOUT_MS
@@ -23750,7 +23962,7 @@ function smokeImage(image, targetSha) {
     };
   }
   const containerId = (createResult.stdout ?? "").trim();
-  const inspectResult = spawnSync13(
+  const inspectResult = spawnSync14(
     "docker",
     ["inspect", "--format", '{{index .Config.Labels "olam.build.sha"}}', image],
     {
@@ -23760,7 +23972,7 @@ function smokeImage(image, targetSha) {
     }
   );
   if (containerId.length > 0) {
-    spawnSync13("docker", ["rm", "-f", containerId], {
+    spawnSync14("docker", ["rm", "-f", containerId], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"],
       timeout: SMOKE_DOCKER_TIMEOUT_MS
@@ -23800,7 +24012,7 @@ var PRODUCTION_SWAP_PLAN = [
 ];
 function dockerTag(source, dest) {
   try {
-    const result = spawnSync13("docker", ["tag", source, dest], {
+    const result = spawnSync14("docker", ["tag", source, dest], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -23964,11 +24176,11 @@ async function waitForAuthHealthLocal(timeoutMs = AUTH_HEALTH_TIMEOUT_MS) {
 async function recreateAuthService() {
   const start = Date.now();
   try {
-    spawnSync13("docker", ["stop", "olam-auth"], {
+    spawnSync14("docker", ["stop", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
-    spawnSync13("docker", ["rm", "olam-auth"], {
+    spawnSync14("docker", ["rm", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -24227,11 +24439,11 @@ async function defaultRecreateMcpAuthForUpgrade() {
 }
 async function defaultRecreateAuthForUpgrade() {
   try {
-    spawnSync13("docker", ["stop", "olam-auth"], {
+    spawnSync14("docker", ["stop", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
-    spawnSync13("docker", ["rm", "olam-auth"], {
+    spawnSync14("docker", ["rm", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -24577,7 +24789,7 @@ ${spaResult.stderr}`);
       process.stdout.write(`  ${pc18.dim(step.label.padEnd(34))}
 `);
       const start = Date.now();
-      const result = spawnSync13("bash", [scriptPath], {
+      const result = spawnSync14("bash", [scriptPath], {
         stdio: "inherit",
         cwd,
         env: { ...process.env, ...olamTagEnv }
@@ -24926,7 +25138,7 @@ function registerLogs(program2) {
 init_context();
 init_output();
 import pc20 from "picocolors";
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 var SAFE_IDENT4 = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function parseDockerTop(stdout) {
   const trimmed = stdout.trim();
@@ -25026,7 +25238,7 @@ function registerPs(program2) {
     const containerName = `olam-${worldId}-devbox`;
     let watchInterval;
     function fetchAndPrint() {
-      const result = spawnSync14(
+      const result = spawnSync15(
         "docker",
         ["top", containerName, "pid", "user", "pcpu", "pmem", "stime", "stat", "cmd"],
         { encoding: "utf-8", timeout: 3e3 }
@@ -25519,7 +25731,7 @@ init_output();
 import * as fs39 from "node:fs";
 import * as os22 from "node:os";
 import * as path42 from "node:path";
-import { spawnSync as spawnSync15 } from "node:child_process";
+import { spawnSync as spawnSync16 } from "node:child_process";
 import ora8 from "ora";
 
 // src/commands/refresh-helpers.ts
@@ -25563,7 +25775,7 @@ var RESTART_TIMEOUT_S = 30;
 var HEALTH_POLL_MS = 500;
 var HEALTH_TIMEOUT_MS = 3e4;
 function docker(args) {
-  const result = spawnSync15("docker", args, {
+  const result = spawnSync16("docker", args, {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -25911,9 +26123,9 @@ function registerDiagnose(program2) {
 }
 
 // src/lib/health-probes.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
-import { existsSync as existsSync44, readdirSync as readdirSync11, readFileSync as readFileSync31, statSync as statSync13 } from "node:fs";
-import { homedir as homedir23 } from "node:os";
+import { spawnSync as spawnSync17 } from "node:child_process";
+import { existsSync as existsSync45, readdirSync as readdirSync11, readFileSync as readFileSync32, statSync as statSync14 } from "node:fs";
+import { homedir as homedir24 } from "node:os";
 import path44 from "node:path";
 
 // src/lib/kg-caps.ts
@@ -25923,7 +26135,7 @@ var HARD_CAP_BYTES = 5e9;
 // src/lib/health-probes.ts
 var HEALTH_TIMEOUT_MS2 = 5e3;
 var defaultDockerExec2 = (cmd, args) => {
-  const r = spawnSync16(cmd, [...args], {
+  const r = spawnSync17(cmd, [...args], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -26009,7 +26221,7 @@ function isHostCpHealthEnvelope(body) {
 }
 async function probeAuthVault(olamHomeOverride) {
   const vaultPath = resolveAccountsPath(olamHomeOverride);
-  if (!existsSync44(vaultPath)) {
+  if (!existsSync45(vaultPath)) {
     return {
       ok: false,
       message: `auth vault missing at ${vaultPath}`,
@@ -26018,7 +26230,7 @@ async function probeAuthVault(olamHomeOverride) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync31(vaultPath, "utf-8"));
+    parsed = JSON.parse(readFileSync32(vaultPath, "utf-8"));
   } catch (err) {
     return {
       ok: false,
@@ -26048,7 +26260,7 @@ async function probeAuthVault(olamHomeOverride) {
 function resolveAccountsPath(olamHomeOverride) {
   const explicit = process.env.OLAM_AUTH_DATA_PATH;
   if (explicit) return explicit;
-  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path44.join(homedir23(), ".olam");
+  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path44.join(homedir24(), ".olam");
   return path44.join(olamHome5, "auth-data", "accounts.json");
 }
 function effectiveState2(account, now) {
@@ -26062,7 +26274,7 @@ function effectiveState2(account, now) {
   return persisted;
 }
 async function probeKgStorage(olamHomeOverride) {
-  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path44.join(homedir23(), ".olam");
+  const olamHome5 = olamHomeOverride ?? process.env.OLAM_HOME ?? path44.join(homedir24(), ".olam");
   const kgRoot3 = path44.join(olamHome5, "kg");
   const worldsRoot3 = path44.join(olamHome5, "worlds");
   const kgBytes = enumerateGraphifyOut(kgRoot3, "pristine");
@@ -26084,7 +26296,7 @@ async function probeKgStorage(olamHomeOverride) {
   return { ok: true, message: `KG storage ${formatBytes4(totalBytes)} (under cap)` };
 }
 function enumerateGraphifyOut(root, layout) {
-  if (!existsSync44(root)) return 0;
+  if (!existsSync45(root)) return 0;
   let total = 0;
   let entries;
   try {
@@ -26113,7 +26325,7 @@ function enumerateGraphifyOut(root, layout) {
   return total;
 }
 function dirSizeBytes(dir) {
-  if (!existsSync44(dir)) return 0;
+  if (!existsSync45(dir)) return 0;
   let total = 0;
   const stack = [dir];
   while (stack.length > 0) {
@@ -26132,7 +26344,7 @@ function dirSizeBytes(dir) {
         continue;
       }
       try {
-        total += statSync13(full).size;
+        total += statSync14(full).size;
       } catch {
       }
     }
@@ -26369,20 +26581,20 @@ function registerCompletion(program2) {
 // src/commands/setup.ts
 init_cli_version();
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync46 } from "node:fs";
-import { homedir as homedir24 } from "node:os";
+import { existsSync as existsSync47 } from "node:fs";
+import { homedir as homedir25 } from "node:os";
 import path46 from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // src/lib/shell-rc.ts
-import { copyFileSync as copyFileSync5, existsSync as existsSync45, readFileSync as readFileSync32, renameSync as renameSync4, writeFileSync as writeFileSync20 } from "node:fs";
+import { copyFileSync as copyFileSync5, existsSync as existsSync46, readFileSync as readFileSync33, renameSync as renameSync5, writeFileSync as writeFileSync21 } from "node:fs";
 import path45 from "node:path";
 function appendIdempotent(opts) {
   const { rcPath, marker, contentLine, clock = () => /* @__PURE__ */ new Date() } = opts;
-  if (!existsSync45(rcPath)) {
+  if (!existsSync46(rcPath)) {
     return { status: "no-rc-file", backupPath: null };
   }
-  const content = readFileSync32(rcPath, "utf-8");
+  const content = readFileSync33(rcPath, "utf-8");
   if (content.includes(marker)) {
     return { status: "already-present", backupPath: null };
   }
@@ -26393,8 +26605,8 @@ function appendIdempotent(opts) {
   const trailing = contentLine.endsWith("\n") ? "" : "\n";
   const nextContent = `${content}${separator}${contentLine}${trailing}`;
   const tmpPath = `${rcPath}.olam-tmp.${process.pid}`;
-  writeFileSync20(tmpPath, nextContent, { encoding: "utf-8" });
-  renameSync4(tmpPath, rcPath);
+  writeFileSync21(tmpPath, nextContent, { encoding: "utf-8" });
+  renameSync5(tmpPath, rcPath);
   return { status: "appended", backupPath };
 }
 function resolveShellRc(home, shellEnv) {
@@ -26503,7 +26715,7 @@ async function phase4ShellInit(opts, deps) {
   if (opts.skipShellInit) {
     return { ok: true, skipped: true, message: "skipped via --skip-shell-init" };
   }
-  const home = deps.home ?? homedir24();
+  const home = deps.home ?? homedir25();
   const shellEnv = deps.shellEnv ?? process.env.SHELL;
   const rcPath = resolveShellRc(home, shellEnv);
   if (rcPath === null) {
@@ -26540,7 +26752,7 @@ async function phase5InitProject(opts, deps) {
   const cwd = deps.cwd ?? process.cwd();
   const projectRoot = findProjectRoot(cwd);
   const configPath = path46.join(projectRoot, ".olam", "config.yaml");
-  if (existsSync46(configPath)) {
+  if (existsSync47(configPath)) {
     return { ok: true, message: `${configPath} present (no change)` };
   }
   const promptFn = deps.prompt ?? defaultPrompt;
@@ -27406,17 +27618,17 @@ function registerWorldUpgrade(program2) {
 
 // src/commands/mcp/serve.ts
 init_output();
-import { existsSync as existsSync51 } from "node:fs";
-import { dirname as dirname25, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync52 } from "node:fs";
+import { dirname as dirname26, resolve as resolve13 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
-var here = dirname25(fileURLToPath6(import.meta.url));
+var here = dirname26(fileURLToPath6(import.meta.url));
 var BUNDLE_PATH_CANDIDATES = [
   // bundled (`dist/index.js` after bundle-cli.mjs) — sibling
   resolve13(here, "mcp-server.js"),
   // dev / tsc-only (`dist/commands/mcp/serve.js`) — up two levels
   resolve13(here, "..", "..", "mcp-server.js")
 ];
-function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync51) {
+function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync52) {
   return candidates2.find(exists) ?? null;
 }
 var MISSING_BUNDLE_REMEDY = "olam mcp server bundle missing. Searched: " + BUNDLE_PATH_CANDIDATES.join(", ") + ". For local dev, run: node packages/cli/scripts/bundle-mcp-server.mjs. A fresh `npm install -g @pleri/olam-cli@latest` should always include the bundle (see prepublishOnly in packages/cli/package.json); file an issue if it does not.";
@@ -27438,9 +27650,9 @@ function registerMcpServe(cmd) {
 init_output();
 
 // src/commands/mcp/install-shared.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 var DEFAULT_CLAUDE_SHELL_DEPS = {
-  spawn: spawnSync17,
+  spawn: spawnSync18,
   log: (msg) => console.log(msg)
 };
 function isOnPath(deps, bin) {
@@ -28159,65 +28371,6 @@ import { spawn as spawn8 } from "node:child_process";
 import { existsSync as existsSync54, mkdirSync as mkdirSync30, openSync as openSync3, readFileSync as readFileSync38, writeFileSync as writeFileSync24 } from "node:fs";
 import { join as join52 } from "node:path";
 
-// src/lib/memory-secret.ts
-import { existsSync as existsSync53, mkdirSync as mkdirSync29, readFileSync as readFileSync37, statSync as statSync14, writeFileSync as writeFileSync23, renameSync as renameSync5, chmodSync as chmodSync4 } from "node:fs";
-import { homedir as homedir29 } from "node:os";
-import { join as join50, dirname as dirname26 } from "node:path";
-import { randomBytes as randomBytes6 } from "node:crypto";
-var MEMORY_SECRET_PATH = join50(homedir29(), ".olam", "memory-secret");
-var SECRET_LEN_BYTES = 32;
-function generateSecret() {
-  return randomBytes6(SECRET_LEN_BYTES).toString("hex");
-}
-function writeSecretAtPath(path56, value) {
-  mkdirSync29(dirname26(path56), { recursive: true });
-  const tmp = `${path56}.tmp.${process.pid}`;
-  writeFileSync23(tmp, value, { mode: 384 });
-  chmodSync4(tmp, 384);
-  renameSync5(tmp, path56);
-}
-function readSecretAtPathOrNull(path56) {
-  if (!existsSync53(path56)) return null;
-  const mode = statSync14(path56).mode & 511;
-  if (mode !== 384) {
-    process.stderr.write(
-      `warn: ${path56} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
-`
-    );
-  }
-  return readFileSync37(path56, "utf8").trim();
-}
-function readSecretAtPath(path56) {
-  const v = readSecretAtPathOrNull(path56);
-  if (v === null) {
-    throw new Error(
-      `Secret not found at ${path56}. Run 'olam memory start' to generate it.`
-    );
-  }
-  return v;
-}
-function ensureMemorySecret(path56 = MEMORY_SECRET_PATH) {
-  const existing = readSecretAtPathOrNull(path56);
-  if (existing) return existing;
-  const fresh = generateSecret();
-  writeSecretAtPath(path56, fresh);
-  return fresh;
-}
-function readMemorySecretOrNull(path56 = MEMORY_SECRET_PATH) {
-  return readSecretAtPathOrNull(path56);
-}
-function readMemorySecret(path56 = MEMORY_SECRET_PATH) {
-  return readSecretAtPath(path56);
-}
-function rotateMemorySecret(path56 = MEMORY_SECRET_PATH) {
-  const fresh = generateSecret();
-  writeSecretAtPath(path56, fresh);
-  return fresh;
-}
-function hasMemorySecret(path56 = MEMORY_SECRET_PATH) {
-  return existsSync53(path56);
-}
-
 // src/commands/memory/_paths.ts
 import { homedir as homedir30 } from "node:os";
 import { join as join51, dirname as dirname27 } from "node:path";
@@ -28550,7 +28703,7 @@ async function runMemorySecretShow() {
     );
     return 1;
   }
-  process.stdout.write(`${readMemorySecret()}
+  process.stdout.write(`${readMemorySecret2()}
 `);
   return 0;
 }
@@ -28602,7 +28755,7 @@ function registerMemorySecret(cmd) {
 
 // src/commands/memory/install.ts
 init_output();
-var MCP_NAME = "agentmemory";
+var MCP_NAME2 = "agentmemory";
 var NPM_PACKAGE_NAME2 = "@agentmemory/mcp";
 var DEFAULT_SECRET_READER = () => readMemorySecretOrNull();
 function buildClaudeMcpAddArgs2(scope, agentmemoryUrl, secret) {
@@ -28611,7 +28764,7 @@ function buildClaudeMcpAddArgs2(scope, agentmemoryUrl, secret) {
     args: [
       "mcp",
       "add",
-      MCP_NAME,
+      MCP_NAME2,
       "--scope",
       scope,
       "--env",
@@ -28681,11 +28834,11 @@ function registerMemoryInstall(cmd) {
 
 // src/commands/memory/uninstall.ts
 init_output();
-var MCP_NAME2 = "agentmemory";
+var MCP_NAME3 = "agentmemory";
 function buildClaudeMcpRemoveArgs2(scope) {
   return {
     command: "claude",
-    args: ["mcp", "remove", MCP_NAME2, "--scope", scope]
+    args: ["mcp", "remove", MCP_NAME3, "--scope", scope]
   };
 }
 async function runUninstall2(opts, deps = DEFAULT_CLAUDE_SHELL_DEPS) {
@@ -28753,7 +28906,7 @@ function registerMemory(program2) {
 init_storage_paths();
 init_workspace_name();
 init_output();
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 import fs49 from "node:fs";
 import path54 from "node:path";
 
@@ -29151,13 +29304,13 @@ function resolveWorkspace(arg) {
 }
 function copyWorkspaceToScratch(source, scratch) {
   if (process.platform === "darwin") {
-    const r2 = spawnSync18("cp", ["-c", "-r", source + "/.", scratch], {
+    const r2 = spawnSync19("cp", ["-c", "-r", source + "/.", scratch], {
       stdio: ["ignore", "ignore", "pipe"],
       encoding: "utf-8"
     });
     if (r2.status === 0) return "cp-c-r-reflink";
   }
-  const r = spawnSync18("cp", ["-r", source + "/.", scratch], {
+  const r = spawnSync19("cp", ["-r", source + "/.", scratch], {
     stdio: ["ignore", "ignore", "pipe"],
     encoding: "utf-8"
   });
@@ -29178,7 +29331,7 @@ function parseNodeCount(graphifyOutDir) {
   }
 }
 function readGraphifyVersion(image) {
-  const r = spawnSync18(
+  const r = spawnSync19(
     "docker",
     [
       "run",
@@ -29230,7 +29383,7 @@ async function runKgBuild(workspaceArg, options = {}) {
       "update",
       "."
     ];
-    const r = human ? spawnSync18("docker", dockerArgs, { stdio: "inherit" }) : spawnSync18("docker", dockerArgs, { stdio: ["ignore", "ignore", "pipe"] });
+    const r = human ? spawnSync19("docker", dockerArgs, { stdio: "inherit" }) : spawnSync19("docker", dockerArgs, { stdio: ["ignore", "ignore", "pipe"] });
     if (r.status !== 0) {
       printError(`graphify update failed (exit ${r.status})`);
       return { exitCode: r.status ?? 1 };
@@ -29288,7 +29441,7 @@ function registerKg(program2) {
 
 // src/commands/seed.ts
 init_output();
-import { spawnSync as spawnSync19, spawn as spawnAsync2 } from "node:child_process";
+import { spawnSync as spawnSync20, spawn as spawnAsync2 } from "node:child_process";
 var DEFAULT_SINGLETON_CONTAINER = "olam-postgres";
 var DEFAULT_SINGLETON_USER = "development";
 function assertValidSeedName(name) {
@@ -29299,7 +29452,7 @@ function assertValidSeedName(name) {
   }
 }
 function singletonDocker(container, user, args, stdin) {
-  return spawnSync19(
+  return spawnSync20(
     "docker",
     ["exec", "-i", container, "psql", "-U", user, ...args],
     { encoding: "utf-8", input: stdin }
@@ -29354,7 +29507,7 @@ async function handleBake(opts) {
   if (sources.length > 1) {
     throw new Error("multiple sources specified \u2014 pass exactly one of --source-container, --source-url, --source-local");
   }
-  const ping = spawnSync19("docker", ["inspect", "--format", "{{.State.Status}}", singleton], { encoding: "utf-8" });
+  const ping = spawnSync20("docker", ["inspect", "--format", "{{.State.Status}}", singleton], { encoding: "utf-8" });
   if (ping.status !== 0 || (ping.stdout || "").trim() !== "running") {
     throw new Error(`singleton container "${singleton}" not running \u2014 run \`olam bootstrap\` first`);
   }