@pleri/olam-cli 0.1.143 → 0.1.145

package/dist/index.js

@@ -492,8 +492,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path60, errorMaps, issueData } = params;
-      const fullPath = [...path60, ...issueData.path || []];
+      const { data, path: path66, errorMaps, issueData } = params;
+      const fullPath = [...path66, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -801,11 +801,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path60, key) {
+      constructor(parent, value, path66, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path60;
+        this._path = path66;
         this._key = key;
       }
       get path() {
@@ -4286,7 +4286,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path60, ctx, rejectSource) {
+function refineForbiddenKeys(value, path66, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4294,12 +4294,12 @@ function refineForbiddenKeys(value, path60, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path60, key],
+        path: [...path66, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path60.length === 0 && key === "source") {
+    if (rejectSource && path66.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4307,21 +4307,21 @@ function refineForbiddenKeys(value, path60, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path60, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path66, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path60, rejectSource) {
+function rejectForbiddenKeys(value, path66, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path60}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path66}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path60}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path66}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path60}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path66}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5500,8 +5500,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path60, body, attempt = 0) {
-        const url2 = `${this.baseUrl}${path60}`;
+      async request(method, path66, body, attempt = 0) {
+        const url2 = `${this.baseUrl}${path66}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5519,7 +5519,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path60, body, attempt + 1);
+            return this.request(method, path66, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -7292,8 +7292,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path60, method, body) {
-        const url2 = `${this.config.workerUrl}${path60}`;
+      async request(path66, method, body) {
+        const url2 = `${this.config.workerUrl}${path66}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -8640,17 +8640,17 @@ function kgRoot() {
 function worldsRoot() {
   return join16(olamHome(), "worlds");
 }
-function assertWithinPrefix(path60, prefix, label) {
-  if (!path60.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path60} not under ${prefix}/`);
+function assertWithinPrefix(path66, prefix, label) {
+  if (!path66.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path66} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path60 = resolve5(join16(root, workspace));
-  assertWithinPrefix(path60, root, "kgPristinePath");
-  return path60;
+  const path66 = resolve5(join16(root, workspace));
+  assertWithinPrefix(path66, root, "kgPristinePath");
+  return path66;
 }
 var KG_PATHS_INTERNALS;
 var init_storage_paths = __esm({
@@ -8765,8 +8765,8 @@ import { execFileSync as execFileSync4 } from "node:child_process";
 import * as fs15 from "node:fs";
 import * as os9 from "node:os";
 import * as path16 from "node:path";
-function expandHome2(p, homedir36) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir36());
+function expandHome2(p, homedir40) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir40());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -8789,7 +8789,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir36 = deps.homedir ?? (() => os9.homedir());
+  const homedir40 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path16.join(workspacePath, ".olam", "baseline");
   try {
     fs15.mkdirSync(baselineDir, { recursive: true });
@@ -8805,7 +8805,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path16.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir36);
+    const repoPath = expandHome2(repo.path, homedir40);
     if (!fs15.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -8925,21 +8925,21 @@ function extractStderr(err) {
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir36 = deps.homedir ?? (() => os9.homedir());
-  const existsSync64 = deps.existsSync ?? ((p) => fs15.existsSync(p));
-  const copyFileSync8 = deps.copyFileSync ?? ((src, dest) => fs15.copyFileSync(src, dest));
-  const mkdirSync36 = deps.mkdirSync ?? ((dirPath, opts) => {
+  const homedir40 = deps.homedir ?? (() => os9.homedir());
+  const existsSync71 = deps.existsSync ?? ((p) => fs15.existsSync(p));
+  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs15.copyFileSync(src, dest));
+  const mkdirSync39 = deps.mkdirSync ?? ((dirPath, opts) => {
     fs15.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir36);
+    const repoPath = expandHome2(repo.path, homedir40);
     const worktreePath = path16.join(workspacePath, repo.name);
-    if (!existsSync64(repoPath))
+    if (!existsSync71(repoPath))
       continue;
-    if (!existsSync64(worktreePath)) {
+    if (!existsSync71(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -8999,11 +8999,11 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
     for (const rel of plan.diff.untracked) {
       const src = path16.join(plan.repoPath, rel);
       const dest = path16.join(plan.worktreePath, rel);
-      if (!existsSync64(src))
+      if (!existsSync71(src))
         continue;
       try {
-        mkdirSync36(path16.dirname(dest), { recursive: true });
-        copyFileSync8(src, dest);
+        mkdirSync39(path16.dirname(dest), { recursive: true });
+        copyFileSync9(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         console.warn(`[carry] ${plan.name}: copy untracked ${rel} failed: ${msg}`);
@@ -9066,10 +9066,10 @@ import * as fs16 from "node:fs";
 import * as path17 from "node:path";
 function injectWorldContext(opts) {
   const { world } = opts;
-  const claudeDir = path17.join(world.workspacePath, ".claude");
-  fs16.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir2 = path17.join(world.workspacePath, ".claude");
+  fs16.mkdirSync(claudeDir2, { recursive: true });
   const content = WORLD_CLAUDE_MD.replace("{{worldName}}", world.name).replace("{{worldId}}", world.id).replace("{{branch}}", world.branch).replace("{{taskBlock}}", buildTaskBlock(opts)).replace("{{reposList}}", buildReposList(world)).replace("{{servicesLine}}", buildServicesLine(opts.services)).replace("{{pleriPlaneLine}}", buildPleriPlaneLine(opts.pleriPlaneUrl)).replace("{{planFileBlock}}", buildPlanFileBlock(world)).replace("{{extraContextBlock}}", buildExtraContextBlock(opts.claudeMdExtra));
-  fs16.writeFileSync(path17.join(claudeDir, "CLAUDE.md"), content);
+  fs16.writeFileSync(path17.join(claudeDir2, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function buildTaskBlock(opts) {
@@ -10589,6 +10589,26 @@ var init_auto_dispatch_task = __esm({
   }
 });
 
+// ../core/dist/skill-sources/schema.js
+var SKILL_SOURCE_ID_LENGTH, NAME_PATTERN, URL_PATTERN, SkillSourceSchema;
+var init_schema3 = __esm({
+  "../core/dist/skill-sources/schema.js"() {
+    "use strict";
+    init_v3();
+    SKILL_SOURCE_ID_LENGTH = 12;
+    NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+    URL_PATTERN = /^(?:https?:\/\/|git@|ssh:\/\/|file:\/\/|\/).+/;
+    SkillSourceSchema = external_exports.object({
+      id: external_exports.string().length(SKILL_SOURCE_ID_LENGTH, `skill-source id must be exactly ${SKILL_SOURCE_ID_LENGTH} chars (sha256-of-url prefix)`).regex(/^[a-f0-9]+$/, "skill-source id must be lowercase hex"),
+      name: external_exports.string().regex(NAME_PATTERN, "skill-source name must be ASCII lowercase + digits + dash (1-64 chars, no leading/trailing dash)"),
+      gitUrl: external_exports.string().min(1, "gitUrl must not be empty").regex(URL_PATTERN, "gitUrl must look like a git URL (https://, git@, ssh://, file://, or absolute path)"),
+      branch: external_exports.string().min(1, "branch must not be empty").default("main"),
+      addedAt: external_exports.number().int().nonnegative(),
+      lastPulledSha: external_exports.string().regex(/^[a-f0-9]{40}$/, "lastPulledSha must be a 40-char lowercase hex git SHA").optional()
+    });
+  }
+});
+
 // ../core/dist/global-config/schema.js
 function isAbsoluteOrTilde(p) {
   return p.startsWith("/") || p === "~" || p.startsWith("~/");
@@ -10597,11 +10617,12 @@ function hasNoTraversalComponents(p) {
   return !p.split("/").some((seg) => seg === "..");
 }
 var RepoEntrySchema, PortMapSchema, SeedSqlFileSchema, SeedCommandSchema, SeedFixtureCopySchema, SeedSchema, RunbookSchema, GlobalConfigSchema, DEFAULT_GLOBAL_CONFIG;
-var init_schema3 = __esm({
+var init_schema4 = __esm({
   "../core/dist/global-config/schema.js"() {
     "use strict";
     init_v3();
     init_schema();
+    init_schema3();
     RepoEntrySchema = external_exports.object({
       name: external_exports.string().regex(REPO_NAME_PATTERN, "repo name must be ASCII lowercase + digits + dash (1-64 chars, no leading/trailing dash)"),
       path: external_exports.string().min(1, "path must not be empty").refine(isAbsoluteOrTilde, {
@@ -10648,7 +10669,8 @@ var init_schema3 = __esm({
     GlobalConfigSchema = external_exports.object({
       schemaVersion: external_exports.literal(1),
       repos: external_exports.array(RepoEntrySchema).optional().default([]),
-      runbooks: external_exports.array(RunbookSchema).optional().default([])
+      runbooks: external_exports.array(RunbookSchema).optional().default([]),
+      skillSources: external_exports.array(SkillSourceSchema).optional().default([])
     }).strip().superRefine((val, ctx) => {
       const repoNames = val.repos.map((r) => r.name);
       const repoDupes = repoNames.filter((n, i) => repoNames.indexOf(n) !== i);
@@ -10660,11 +10682,22 @@ var init_schema3 = __esm({
       for (const d of rbDupes) {
         ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate runbook name: "${d}"`, path: ["runbooks"] });
       }
+      const skillIds = val.skillSources.map((s) => s.id);
+      const skillIdDupes = skillIds.filter((n, i) => skillIds.indexOf(n) !== i);
+      for (const d of skillIdDupes) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate skill-source id: "${d}"`, path: ["skillSources"] });
+      }
+      const skillNames = val.skillSources.map((s) => s.name);
+      const skillNameDupes = skillNames.filter((n, i) => skillNames.indexOf(n) !== i);
+      for (const d of skillNameDupes) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate skill-source name: "${d}"`, path: ["skillSources"] });
+      }
     });
     DEFAULT_GLOBAL_CONFIG = {
       schemaVersion: 1,
       repos: [],
-      runbooks: []
+      runbooks: [],
+      skillSources: []
     };
   }
 });
@@ -10715,7 +10748,7 @@ var GlobalConfigReadError;
 var init_store2 = __esm({
   "../core/dist/global-config/store.js"() {
     "use strict";
-    init_schema3();
+    init_schema4();
     GlobalConfigReadError = class extends Error {
       constructor(configPath, cause) {
         const msg = cause instanceof Error ? cause.message : String(cause);
@@ -11701,7 +11734,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
   if (seedTemplates.length === 0) {
     return { worldDbNames: [] };
   }
-  const spawn11 = options.spawn ?? spawnSync4;
+  const spawn12 = options.spawn ?? spawnSync4;
   const seedToWorldDb = /* @__PURE__ */ new Map();
   for (const seed of seedTemplates) {
     seedToWorldDb.set(seed, deriveWorldDbName(seed, worldId));
@@ -11709,7 +11742,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
   const created = [];
   for (const seed of seedTemplates) {
     const worldDb = seedToWorldDb.get(seed);
-    const exists = spawn11("docker", [
+    const exists = spawn12("docker", [
       "exec",
       container,
       "psql",
@@ -11721,7 +11754,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
     const dbAlreadyExists = exists.status === 0 && (exists.stdout || "").trim() === "1";
     if (!dbAlreadyExists) {
       const sql = `CREATE DATABASE "${worldDb}" TEMPLATE "${seed}"`;
-      const create = spawn11("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
+      const create = spawn12("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
       if (create.status !== 0) {
         throw new Error(`failed to CREATE DATABASE "${worldDb}" TEMPLATE "${seed}": ${(create.stderr || "").trim()}`);
       }
@@ -11731,7 +11764,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
     if (stmts !== void 0 && stmts.length > 0) {
       for (const rawStmt of stmts) {
         const stmt = interpolatePostCloneSql(rawStmt, worldId, seedToWorldDb);
-        const fixup = spawn11("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", stmt], { encoding: "utf-8" });
+        const fixup = spawn12("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", stmt], { encoding: "utf-8" });
         if (fixup.status !== 0) {
           throw new Error(`post_clone_sql against "${worldDb}" failed (statement: ${truncate(stmt, 120)}): ${(fixup.stderr || "").trim()}`);
         }
@@ -11759,11 +11792,11 @@ function applyPostgresTestTemplateClone(worldId, enrichedRepos, options = {}) {
   if (testTemplates.length === 0) {
     return { worldTestDbNames: [] };
   }
-  const spawn11 = options.spawn ?? spawnSync4;
+  const spawn12 = options.spawn ?? spawnSync4;
   const created = [];
   for (const seed of testTemplates) {
     const worldDb = deriveWorldDbName(seed, worldId);
-    const exists = spawn11("docker", [
+    const exists = spawn12("docker", [
       "exec",
       container,
       "psql",
@@ -11775,7 +11808,7 @@ function applyPostgresTestTemplateClone(worldId, enrichedRepos, options = {}) {
     const dbAlreadyExists = exists.status === 0 && (exists.stdout || "").trim() === "1";
     if (!dbAlreadyExists) {
       const sql = `CREATE DATABASE "${worldDb}" TEMPLATE "${seed}"`;
-      const create = spawn11("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
+      const create = spawn12("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
       if (create.status !== 0) {
         throw new Error(`failed to CREATE DATABASE "${worldDb}" TEMPLATE "${seed}": ${(create.stderr || "").trim()}`);
       }
@@ -11816,13 +11849,13 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
   if (worldDbNames.length === 0) {
     throw new Error(`applyPostgresWorldRole called with empty worldDbNames for "${worldId}" \u2014 should only run when applyPostgresTemplateClone produced clones`);
   }
-  const spawn11 = options.spawn ?? spawnSync4;
+  const spawn12 = options.spawn ?? spawnSync4;
   const container = options.singletonContainer ?? "olam-postgres";
   const user = options.postgresUser ?? "development";
   const genPassword = options.generatePassword ?? defaultPasswordGenerator;
   const worldRoleName = deriveWorldRoleName(worldId);
   const password = genPassword();
-  const exists = spawn11("docker", [
+  const exists = spawn12("docker", [
     "exec",
     container,
     "psql",
@@ -11834,12 +11867,12 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
   const roleExists = exists.status === 0 && (exists.stdout || "").trim() === "1";
   const escapedPassword = escapeSqlLiteral(password);
   const roleDdl = roleExists ? `ALTER ROLE "${worldRoleName}" WITH LOGIN PASSWORD '${escapedPassword}' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION` : `CREATE ROLE "${worldRoleName}" WITH LOGIN PASSWORD '${escapedPassword}' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION`;
-  const dml = spawn11("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", roleDdl], { encoding: "utf-8" });
+  const dml = spawn12("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", roleDdl], { encoding: "utf-8" });
   if (dml.status !== 0) {
     throw new Error(`failed to ${roleExists ? "ALTER" : "CREATE"} ROLE "${worldRoleName}": ` + redactCreateRolePassword((dml.stderr || "").trim()));
   }
   for (const worldDb of worldDbNames) {
-    const grantConnect = spawn11("docker", [
+    const grantConnect = spawn12("docker", [
       "exec",
       container,
       "psql",
@@ -11864,7 +11897,7 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
       `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO "${worldRoleName}"`,
       `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO "${worldRoleName}"`
     ].join("; ");
-    const grantResult = spawn11("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", perDbGrants], { encoding: "utf-8" });
+    const grantResult = spawn12("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", perDbGrants], { encoding: "utf-8" });
     if (grantResult.status !== 0) {
       throw new Error(`failed to GRANT privileges on "${worldDb}" to "${worldRoleName}": ${(grantResult.stderr || "").trim()}`);
     }
@@ -11884,11 +11917,11 @@ function dropPostgresWorldDbs(worldId, worldDbNames, options = {}) {
   if (worldDbNames.length === 0)
     return;
   assertSafeWorldId(worldId);
-  const spawn11 = options.spawn ?? spawnSync4;
+  const spawn12 = options.spawn ?? spawnSync4;
   const container = options.container ?? "olam-postgres";
   const user = options.user ?? "development";
   for (const db of worldDbNames) {
-    const drop = spawn11("docker", [
+    const drop = spawn12("docker", [
       "exec",
       container,
       "psql",
@@ -11908,10 +11941,10 @@ function dropPostgresWorldRole(worldId, worldRoleName, options = {}) {
   if (!worldRoleName)
     return;
   assertSafeWorldId(worldId);
-  const spawn11 = options.spawn ?? spawnSync4;
+  const spawn12 = options.spawn ?? spawnSync4;
   const container = options.container ?? "olam-postgres";
   const user = options.user ?? "development";
-  const cleanup = spawn11("docker", [
+  const cleanup = spawn12("docker", [
     "exec",
     container,
     "psql",
@@ -15062,10 +15095,10 @@ async function readHostCpToken2() {
   if (!fs26.existsSync(tp)) return null;
   return fs26.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path60, body) {
+async function callHostCpProxy(method, worldId, path66, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path60}`;
+  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path66}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -16102,9 +16135,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path60) {
-    super(`Archetype inheritance cycle detected: ${path60.join(" \u2192 ")} \u2192 ${path60[0] ?? "?"}`);
-    this.path = path60;
+  constructor(path66) {
+    super(`Archetype inheritance cycle detected: ${path66.join(" \u2192 ")} \u2192 ${path66[0] ?? "?"}`);
+    this.path = path66;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -17692,9 +17725,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path60, mtimeMs } of result.newerSources) {
+  for (const { path: path66, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path60}  (modified ${when})`);
+    lines.push(`  \u2022 ${path66}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -17862,56 +17895,56 @@ var SECRET_LEN_BYTES = 32;
 function generateSecret() {
   return randomBytes6(SECRET_LEN_BYTES).toString("hex");
 }
-function writeSecretAtPath(path60, value) {
-  mkdirSync18(dirname19(path60), { recursive: true });
-  const tmp = `${path60}.tmp.${process.pid}`;
+function writeSecretAtPath(path66, value) {
+  mkdirSync18(dirname19(path66), { recursive: true });
+  const tmp = `${path66}.tmp.${process.pid}`;
   writeFileSync13(tmp, value, { mode: 384 });
   chmodSync3(tmp, 384);
-  renameSync4(tmp, path60);
+  renameSync4(tmp, path66);
 }
-function readSecretAtPathOrNull(path60) {
-  if (!existsSync28(path60)) return null;
-  const mode = statSync7(path60).mode & 511;
+function readSecretAtPathOrNull(path66) {
+  if (!existsSync28(path66)) return null;
+  const mode = statSync7(path66).mode & 511;
   if (mode !== 384) {
     process.stderr.write(
-      `warn: ${path60} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
+      `warn: ${path66} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
 `
     );
   }
-  return readFileSync20(path60, "utf8").trim();
+  return readFileSync20(path66, "utf8").trim();
 }
-function readSecretAtPath(path60) {
-  const v = readSecretAtPathOrNull(path60);
+function readSecretAtPath(path66) {
+  const v = readSecretAtPathOrNull(path66);
   if (v === null) {
     throw new Error(
-      `Secret not found at ${path60}. Run 'olam memory start' to generate it.`
+      `Secret not found at ${path66}. Run 'olam memory start' to generate it.`
     );
   }
   return v;
 }
-function ensureMemorySecret(path60 = MEMORY_SECRET_PATH) {
-  const existing = readSecretAtPathOrNull(path60);
+function ensureMemorySecret(path66 = MEMORY_SECRET_PATH) {
+  const existing = readSecretAtPathOrNull(path66);
   if (existing) return existing;
   const fresh = generateSecret();
-  writeSecretAtPath(path60, fresh);
+  writeSecretAtPath(path66, fresh);
   return fresh;
 }
-function readMemorySecretOrNull(path60 = MEMORY_SECRET_PATH) {
-  return readSecretAtPathOrNull(path60);
+function readMemorySecretOrNull(path66 = MEMORY_SECRET_PATH) {
+  return readSecretAtPathOrNull(path66);
 }
-function readMemorySecret(path60 = MEMORY_SECRET_PATH) {
-  return readSecretAtPath(path60);
+function readMemorySecret(path66 = MEMORY_SECRET_PATH) {
+  return readSecretAtPath(path66);
 }
-function rotateMemorySecret(path60 = MEMORY_SECRET_PATH) {
+function rotateMemorySecret(path66 = MEMORY_SECRET_PATH) {
   const fresh = generateSecret();
-  writeSecretAtPath(path60, fresh);
+  writeSecretAtPath(path66, fresh);
   return fresh;
 }
-function hasMemorySecret(path60 = MEMORY_SECRET_PATH) {
-  return existsSync28(path60);
+function hasMemorySecret(path66 = MEMORY_SECRET_PATH) {
+  return existsSync28(path66);
 }
-function writeCloudMemorySecret(value, path60 = CLOUD_MEMORY_SECRET_PATH) {
-  writeSecretAtPath(path60, value);
+function writeCloudMemorySecret(value, path66 = CLOUD_MEMORY_SECRET_PATH) {
+  writeSecretAtPath(path66, value);
 }
 
 // src/lib/world-mcp-register.ts
@@ -17983,15 +18016,15 @@ var AGENTMEMORY_LOCAL_URL = "http://host.docker.internal:3111";
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs56 } = await import("node:fs");
-    const { default: os32 } = await import("node:os");
-    const { default: path60 } = await import("node:path");
-    const tp = path60.join(
-      process.env.OLAM_HOME ?? path60.join(os32.homedir(), ".olam"),
+    const { default: fs62 } = await import("node:fs");
+    const { default: os36 } = await import("node:os");
+    const { default: path66 } = await import("node:path");
+    const tp = path66.join(
+      process.env.OLAM_HOME ?? path66.join(os36.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs56.existsSync(tp)) return null;
-    return fs56.readFileSync(tp, "utf-8").trim();
+    if (!fs62.existsSync(tp)) return null;
+    return fs62.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -18399,12 +18432,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs56 } = await import("node:fs");
-    const { default: os32 } = await import("node:os");
-    const { default: path60 } = await import("node:path");
-    const tp = path60.join(os32.homedir(), ".olam", "host-cp.token");
-    if (!fs56.existsSync(tp)) return null;
-    const raw = fs56.readFileSync(tp, "utf-8").trim();
+    const { default: fs62 } = await import("node:fs");
+    const { default: os36 } = await import("node:os");
+    const { default: path66 } = await import("node:path");
+    const tp = path66.join(os36.homedir(), ".olam", "host-cp.token");
+    if (!fs62.existsSync(tp)) return null;
+    const raw = fs62.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -18617,10 +18650,72 @@ function registerList(program2) {
 // src/commands/status.ts
 init_output();
 import * as fs30 from "node:fs";
+import * as http3 from "node:http";
 import * as os16 from "node:os";
 import * as path31 from "node:path";
 var CLI_VERSION2 = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
 var HOST_CP_PORT2 = 19e3;
+var STATE_ENUM = [
+  "running",
+  "starting",
+  "stopped",
+  "crashed",
+  "unknown"
+];
+function parseRuntimeStatus(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const obj = raw;
+  const state = obj.state;
+  if (typeof state !== "string") return null;
+  if (!STATE_ENUM.includes(state)) return null;
+  const ready_replicas = typeof obj.ready_replicas === "number" ? obj.ready_replicas : 0;
+  const restarts = typeof obj.restarts === "number" ? obj.restarts : 0;
+  const last_event_type = typeof obj.last_event_type === "string" ? obj.last_event_type : null;
+  const last_event_age_seconds = typeof obj.last_event_age_seconds === "number" ? obj.last_event_age_seconds : null;
+  return {
+    state,
+    ready_replicas,
+    restarts,
+    last_event_type,
+    last_event_age_seconds
+  };
+}
+var fetchWorldRuntimeStatus = (worldId, token) => new Promise((resolve15) => {
+  const opts = {
+    host: "127.0.0.1",
+    port: HOST_CP_PORT2,
+    path: `/v1/worlds/${encodeURIComponent(worldId)}/status`,
+    method: "GET",
+    headers: { Authorization: `Bearer ${token}` },
+    timeout: 2e3
+  };
+  const req = http3.request(opts, (res) => {
+    if (res.statusCode !== 200) {
+      res.resume();
+      return resolve15(null);
+    }
+    let body = "";
+    res.setEncoding("utf-8");
+    res.on("data", (c) => {
+      body += c;
+    });
+    res.on("end", () => {
+      try {
+        const parsed = parseRuntimeStatus(JSON.parse(body));
+        resolve15(parsed);
+      } catch {
+        resolve15(null);
+      }
+    });
+    res.on("error", () => resolve15(null));
+  });
+  req.on("error", () => resolve15(null));
+  req.on("timeout", () => {
+    req.destroy();
+    resolve15(null);
+  });
+  req.end();
+});
 async function getMachineStatus(_probe, _loadCtx, _readToken) {
   const probe2 = _probe ?? (async () => {
     const { probeHostCp: probeHostCp2 } = await Promise.resolve().then(() => (init_host_cp(), host_cp_exports));
@@ -18673,7 +18768,7 @@ async function getMachineStatus(_probe, _loadCtx, _readToken) {
   };
 }
 function registerStatus(program2) {
-  program2.command("status").description("Show status (machine status when no world given; world details with a world ID)").argument("[world]", "World ID \u2014 omit to show machine status").option("--json", "Output as JSON").action(async (worldId, opts) => {
+  program2.command("status").description("Show status (machine status when no world given; world details with a world ID)").argument("[world]", "World ID \u2014 omit to show machine status").option("--json", "Output as JSON").option("--pretty", "Render world status as a human-readable table (engine-aware view)").action(async (worldId, opts) => {
     if (!worldId) {
       const ms = await getMachineStatus();
       if (opts.json) {
@@ -18710,8 +18805,13 @@ function registerStatus(program2) {
     }
     const cost = ctx.costTracker.getWorldCost(worldId);
     const dashboardUrl = `http://localhost:${19080 + world.portOffset}`;
+    const { readToken: readToken2 } = await Promise.resolve().then(() => (init_host_cp(), host_cp_exports));
+    const token = readToken2();
+    const runtime = token ? await fetchWorldRuntimeStatus(worldId, token) : null;
     if (opts.json) {
-      console.log(JSON.stringify({ ...world, dashboardUrl, cost }, null, 2));
+      const payload = { ...world, dashboardUrl, cost };
+      if (runtime) payload.runtime = runtime;
+      console.log(JSON.stringify(payload, null, 2));
       return;
     }
     printHeader(`${world.name} (${world.id})`);
@@ -18732,6 +18832,15 @@ function registerStatus(program2) {
     printInfo("Created", world.createdAt);
     printInfo("Uptime", formatAge(world.createdAt));
     printInfo("Updated", world.updatedAt);
+    if (runtime) {
+      printInfo("Runtime state", runtime.state);
+      printInfo("Ready replicas", String(runtime.ready_replicas));
+      printInfo("Restarts", String(runtime.restarts));
+      if (runtime.last_event_type) {
+        const ageSuffix = runtime.last_event_age_seconds != null ? `  (${runtime.last_event_age_seconds}s ago)` : "";
+        printInfo("Last event", `${runtime.last_event_type}${ageSuffix}`);
+      }
+    }
   });
 }
 
@@ -19726,7 +19835,7 @@ var DEFAULT_TIMEOUT_MS2 = 3e3;
 function worldBaseUrl(portOffset) {
   return `http://127.0.0.1:${HOST_CONTROL_PLANE_BASE2 + portOffset}`;
 }
-async function request(url2, init = {}, timeoutMs = DEFAULT_TIMEOUT_MS2) {
+async function request2(url2, init = {}, timeoutMs = DEFAULT_TIMEOUT_MS2) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -19736,13 +19845,13 @@ async function request(url2, init = {}, timeoutMs = DEFAULT_TIMEOUT_MS2) {
   }
 }
 async function listGates(portOffset) {
-  const res = await request(`${worldBaseUrl(portOffset)}/api/pr-gate`);
+  const res = await request2(`${worldBaseUrl(portOffset)}/api/pr-gate`);
   if (!res.ok)
     throw new Error(`list gates failed: HTTP ${res.status}`);
   return await res.json();
 }
 async function getGate(portOffset, id) {
-  const res = await request(`${worldBaseUrl(portOffset)}/api/pr-gate/${encodeURIComponent(id)}`);
+  const res = await request2(`${worldBaseUrl(portOffset)}/api/pr-gate/${encodeURIComponent(id)}`);
   if (res.status === 404)
     return null;
   if (!res.ok)
@@ -19750,7 +19859,7 @@ async function getGate(portOffset, id) {
   return await res.json();
 }
 async function decideGate(portOffset, id, payload) {
-  const res = await request(`${worldBaseUrl(portOffset)}/api/pr-gate/${encodeURIComponent(id)}/decision`, {
+  const res = await request2(`${worldBaseUrl(portOffset)}/api/pr-gate/${encodeURIComponent(id)}/decision`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(payload)
@@ -22135,11 +22244,11 @@ function zodIssueToError(issue, doc, lineCounter) {
     suggestion: deriveSuggestion(issue)
   };
 }
-function formatJsonPath(path60) {
-  if (path60.length === 0)
+function formatJsonPath(path66) {
+  if (path66.length === 0)
     return "<root>";
   let out = "";
-  for (const seg of path60) {
+  for (const seg of path66) {
     if (typeof seg === "number") {
       out += `[${seg}]`;
     } else {
@@ -22148,11 +22257,11 @@ function formatJsonPath(path60) {
   }
   return out;
 }
-function resolveYamlLocation(path60, doc, lineCounter) {
+function resolveYamlLocation(path66, doc, lineCounter) {
   let bestLine = 0;
   let bestColumn = 0;
-  for (let depth = path60.length; depth >= 0; depth -= 1) {
-    const segment = path60.slice(0, depth);
+  for (let depth = path66.length; depth >= 0; depth -= 1) {
+    const segment = path66.slice(0, depth);
     try {
       const node = doc.getIn(segment, true);
       if (node && typeof node === "object" && "range" in node) {
@@ -22370,11 +22479,11 @@ function topoSort(nodes) {
 }
 function traceCycle(start, byId) {
   const seen = /* @__PURE__ */ new Set();
-  const path60 = [];
+  const path66 = [];
   let current = start;
   while (current && !seen.has(current)) {
     seen.add(current);
-    path60.push(current);
+    path66.push(current);
     const node = byId.get(current);
     const next = node?.dependsOn[0];
     if (next === void 0)
@@ -22382,10 +22491,10 @@ function traceCycle(start, byId) {
     current = next;
   }
   if (current && seen.has(current)) {
-    const idx = path60.indexOf(current);
-    return [...path60.slice(idx), current];
+    const idx = path66.indexOf(current);
+    return [...path66.slice(idx), current];
   }
-  return path60;
+  return path66;
 }
 
 // ../core/dist/executor/types.js
@@ -25071,6 +25180,32 @@ async function runUpgradePullByDigest(deps = {}) {
     return { exitCode: EXIT_GENERIC_ERROR, summary: "socket-proxy recreate failed" };
   }
   proxySpinner.succeed("docker-socket-proxy recreated");
+  const inspectContainer = deps.inspectContainerImpl ?? defaultInspectContainerLabels;
+  const removeContainer = deps.removeContainerImpl ?? defaultRemoveContainer;
+  const orphanCheck = inspectContainer("olam-host-cp");
+  if (!orphanCheck.ok) {
+    process.stderr.write(
+      `${pc18.red("error")} docker inspect olam-host-cp failed:
+  ${orphanCheck.stderr.split("\n").slice(0, 3).join("\n  ")}
+`
+    );
+    return { exitCode: EXIT_GENERIC_ERROR, summary: "orphan inspect failed" };
+  }
+  if (orphanCheck.exists && orphanCheck.service !== "olam-host-cp") {
+    process.stderr.write(
+      `${pc18.yellow("info")} Removing pre-rename orphan container olam-host-cp (old project=${orphanCheck.project || "<none>"}, old service=${orphanCheck.service || "<none>"})
+`
+    );
+    const rm = removeContainer("olam-host-cp");
+    if (!rm.ok) {
+      process.stderr.write(
+        `${pc18.red("error")} docker rm -f olam-host-cp failed:
+  ${rm.stderr.split("\n").slice(0, 3).join("\n  ")}
+`
+      );
+      return { exitCode: EXIT_GENERIC_ERROR, summary: "orphan cleanup failed" };
+    }
+  }
   const composeSpinner = ora7("docker compose recreate olam-host-cp").start();
   const composeResult = composeRunner(
     ["up", "-d", "--force-recreate", "--no-deps", "olam-host-cp"],
@@ -25175,6 +25310,37 @@ async function defaultRecreateAuthForUpgrade() {
     };
   }
 }
+function defaultInspectContainerLabels(containerName) {
+  const result = spawnSync15(
+    "docker",
+    [
+      "inspect",
+      "--format",
+      '{{index .Config.Labels "com.docker.compose.project"}}|{{index .Config.Labels "com.docker.compose.service"}}',
+      containerName
+    ],
+    { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }
+  );
+  const stderr = result.stderr ?? "";
+  if (result.status === 0) {
+    const [project = "", service = ""] = (result.stdout ?? "").trim().split("|");
+    return { ok: true, exists: true, project, service, stderr: "" };
+  }
+  if (/No such (object|container)/i.test(stderr)) {
+    return { ok: true, exists: false, project: "", service: "", stderr: "" };
+  }
+  if (result.status === null) {
+    return { ok: true, exists: false, project: "", service: "", stderr: "" };
+  }
+  return { ok: false, exists: false, project: "", service: "", stderr };
+}
+function defaultRemoveContainer(containerName) {
+  const result = spawnSync15("docker", ["rm", "-f", containerName], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  return { ok: result.status === 0, stderr: result.stderr ?? "" };
+}
 async function handleUpgrade(opts) {
   const cwd = process.cwd();
   const rootCheck = validateRepoRoot(cwd);
@@ -25721,7 +25887,7 @@ function registerUpgrade(program2) {
 init_host_cp();
 init_context();
 init_output();
-import * as http3 from "node:http";
+import * as http4 from "node:http";
 import pc19 from "picocolors";
 var HOST_CP_PORT3 = 19e3;
 function colorLine(line) {
@@ -25730,25 +25896,16 @@ function colorLine(line) {
   if (/\bINFO\b/.test(line)) return pc19.dim(line);
   return line;
 }
-function formatLine(line, service, showService) {
-  const prefix = showService && service ? `${pc19.cyan(`[${service}]`)} ` : "";
-  return prefix + colorLine(line);
-}
-function parseSseEvent(raw) {
-  if (!raw.startsWith("data: ")) return null;
-  try {
-    const parsed = JSON.parse(raw.slice(6));
-    if (!parsed || typeof parsed !== "object") return null;
-    const ev = parsed;
-    if (ev.type === "replay" && Array.isArray(ev.lines)) return ev;
-    if (ev.type === "line" && typeof ev.line === "string") return ev;
-    return null;
-  } catch {
-    return null;
-  }
+function buildLogsUrl(worldId, opts, port2 = HOST_CP_PORT3) {
+  const qs = new URLSearchParams({
+    tail: String(opts.tail),
+    follow: opts.follow ? "1" : "0"
+  });
+  if (opts.service) qs.set("service", opts.service);
+  return `http://127.0.0.1:${port2}/v1/worlds/${encodeURIComponent(worldId)}/logs?${qs.toString()}`;
 }
 function registerLogs(program2) {
-  program2.command("logs").description("Stream application logs from a world").argument("<world>", "World ID").option("--service <name>", "Stream a specific service (default: all services)").option("--follow", "Stream indefinitely until Ctrl-C", false).option("--tail <n>", "Number of lines to display before exiting", "200").action(async (worldId, opts) => {
+  program2.command("logs").description("Stream application logs from a world (engine-agnostic)").argument("<world>", "World ID").option("--service <name>", "Stream a specific container within the world").option("--follow", "Stream indefinitely until Ctrl-C", false).option("--tail <n>", "Number of lines to display before exiting", "200").action(async (worldId, opts) => {
     const { ctx, error } = await loadContext();
     if (!ctx) {
       printError(error?.message ?? "Olam is not configured. Run `olam init` first.");
@@ -25768,10 +25925,11 @@ function registerLogs(program2) {
       return;
     }
     const tailLimit = Math.max(1, parseInt(opts.tail, 10) || 200);
-    const showService = opts.service === void 0;
-    const subPath = opts.service ? `/api/logs/${encodeURIComponent(opts.service)}` : "/api/logs";
-    const url2 = `http://127.0.0.1:${HOST_CP_PORT3}/api/world/${encodeURIComponent(worldId)}${subPath}`;
-    let lineCount = 0;
+    const url2 = buildLogsUrl(worldId, {
+      tail: tailLimit,
+      follow: opts.follow,
+      ...opts.service ? { service: opts.service } : {}
+    });
     let done = false;
     let resolveStream;
     const streamDone = new Promise((r) => {
@@ -25783,16 +25941,7 @@ function registerLogs(program2) {
         resolveStream();
       }
     };
-    const emit2 = (line, service) => {
-      process.stdout.write(formatLine(line, service, showService) + "\n");
-      lineCount++;
-      if (!opts.follow && lineCount >= tailLimit) {
-        finish();
-        return false;
-      }
-      return true;
-    };
-    const req = http3.get(url2, { headers: { Authorization: `Bearer ${token}` } }, (res) => {
+    const req = http4.get(url2, { headers: { Authorization: `Bearer ${token}` } }, (res) => {
       if (res.statusCode !== 200) {
         printError(`Log stream returned HTTP ${res.statusCode ?? "unknown"}`);
         process.exitCode = 1;
@@ -25808,21 +25957,14 @@ function registerLogs(program2) {
         buf = rawLines.pop() ?? "";
         for (const raw of rawLines) {
           if (done) break;
-          const ev = parseSseEvent(raw);
-          if (!ev) continue;
-          if (ev.type === "replay") {
-            for (const l of ev.lines) {
-              if (!emit2(l, ev.service)) {
-                req.destroy();
-                break;
-              }
-            }
-          } else if (ev.type === "line") {
-            if (!emit2(ev.line, ev.service)) req.destroy();
-          }
+          if (!raw) continue;
+          process.stdout.write(colorLine(raw) + "\n");
         }
       });
-      res.on("end", () => finish());
+      res.on("end", () => {
+        if (buf) process.stdout.write(colorLine(buf) + "\n");
+        finish();
+      });
       res.on("error", (err) => {
         if (!done) printError(`Stream error: ${err.message}`);
         finish();
@@ -26845,6 +26987,11 @@ var HARD_CAP_BYTES = 5e9;
 
 // src/lib/health-probes.ts
 var HEALTH_TIMEOUT_MS2 = 5e3;
+var COLIMA_010_WARN_TEXT = (
+  // eslint-disable-next-line @typescript-eslint/quotes
+  "Colima 0.10.1's --kubernetes mode is broken upstream. Either switch to OLAM_HOST_CP_ENGINE=docker (recommended) or downgrade Colima to 0.9.x. Track abiosoft/colima issues for fix."
+);
+var COLIMA_010_RANGE = /^v?0\.10\.\d+$/;
 var defaultDockerExec2 = (cmd, args) => {
   const r = spawnSync18(cmd, [...args], {
     encoding: "utf-8",
@@ -27068,6 +27215,146 @@ function formatBytes4(n) {
   if (n < 1024 * 1024 * 1024) return `${(n / 1024 / 1024).toFixed(1)} MB`;
   return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
+async function probeEngine(fetchImpl = defaultFetch) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), HEALTH_TIMEOUT_MS2);
+  try {
+    const res = await fetchImpl("http://127.0.0.1:19000/health", { signal: controller.signal });
+    await res.text().catch(() => "");
+    if (res.status !== 200) {
+      return {
+        ok: false,
+        message: `host-cp /health returned ${res.status}; engine unknown`,
+        remedy: "Restart host-cp via `olam host-cp start`; verify port 19000 is bound to 127.0.0.1."
+      };
+    }
+    const engineHeader = res.headers.get("x-olam-engine") ?? res.headers.get("X-Olam-Engine");
+    if (!engineHeader) {
+      return {
+        ok: true,
+        message: "engine unknown (X-Olam-Engine header absent \u2014 older host-cp?)"
+      };
+    }
+    return {
+      ok: true,
+      message: `engine ${engineHeader}`,
+      engineName: engineHeader
+    };
+  } catch (err) {
+    const e = err;
+    const reason = e.name === "AbortError" ? `timeout (${HEALTH_TIMEOUT_MS2}ms)` : e.message;
+    return {
+      ok: false,
+      message: `engine probe unreachable: ${reason}`,
+      remedy: "Restart host-cp via `olam host-cp start`; verify port 19000 is bound to 127.0.0.1."
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function probeColimaVersion(dockerExec = defaultDockerExec2) {
+  const r = dockerExec("colima", ["version"]);
+  if (r.status === null || r.status !== 0 && /not found|ENOENT|not.found/i.test(r.stderr)) {
+    return { ok: true, message: "colima not installed (not in use)" };
+  }
+  if (r.status !== 0) {
+    return {
+      ok: true,
+      message: `colima present but version probe failed: ${(r.stderr || "").trim()}`
+    };
+  }
+  const tokens = r.stdout.split(/\s+/);
+  const version = tokens.find((t) => /^v?\d+\.\d+\.\d+/.test(t)) ?? "";
+  if (!version) {
+    return {
+      ok: true,
+      message: `colima present but version unrecognised: ${r.stdout.trim().slice(0, 80)}`
+    };
+  }
+  if (COLIMA_010_RANGE.test(version)) {
+    return {
+      ok: true,
+      warn: true,
+      message: `colima ${version} detected \u2014 known kubernetes-mode regression`,
+      remedy: COLIMA_010_WARN_TEXT
+    };
+  }
+  return { ok: true, message: `colima ${version} (clear)` };
+}
+async function probeK8sApiReachable(exec = defaultDockerExec2) {
+  const r = exec("kubectl", ["version", "--output=json", "--request-timeout=2s"]);
+  if (r.status === 0 && r.stdout.length > 0) {
+    let parsed;
+    try {
+      parsed = JSON.parse(r.stdout);
+    } catch {
+      parsed = null;
+    }
+    const obj = parsed && typeof parsed === "object" ? parsed : {};
+    const serverInfo = obj.serverVersion;
+    const gitVersion = typeof serverInfo?.gitVersion === "string" ? serverInfo.gitVersion : "unknown";
+    return { ok: true, message: `api server ${gitVersion} reachable` };
+  }
+  return {
+    ok: false,
+    message: "api server not reachable",
+    remedy: "Confirm the cluster is up (e.g. `k3d cluster list`) and your context points at it."
+  };
+}
+async function probeK8sImagePresence(refs, exec = defaultDockerExec2) {
+  const r = exec("kubectl", ["get", "nodes", "-o", "json", "--request-timeout=2s"]);
+  if (r.status !== 0) {
+    return {
+      ok: false,
+      message: "unable to list cluster nodes for image presence check",
+      remedy: "Confirm the cluster is up and your context points at it; re-run `olam doctor`."
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(r.stdout);
+  } catch {
+    return {
+      ok: false,
+      message: "cluster node list returned malformed output",
+      remedy: "Restart your cluster; if persistent, re-create it."
+    };
+  }
+  const nodes = parsed && typeof parsed === "object" ? parsed.items : void 0;
+  if (!Array.isArray(nodes) || nodes.length === 0) {
+    return {
+      ok: false,
+      message: "cluster has no nodes",
+      remedy: "Start the cluster and try again."
+    };
+  }
+  const presentImages = /* @__PURE__ */ new Set();
+  for (const node of nodes) {
+    const status2 = node.status;
+    const images = status2?.images;
+    if (!Array.isArray(images)) continue;
+    for (const img of images) {
+      const names = img.names;
+      if (!Array.isArray(names)) continue;
+      for (const n of names) presentImages.add(n);
+    }
+  }
+  for (const ref of refs) {
+    if (!hasImageRef(presentImages, ref)) {
+      return {
+        ok: false,
+        message: `image ${ref} not present on any cluster node`,
+        remedy: "Run `olam bootstrap` to import the published image into the cluster."
+      };
+    }
+  }
+  return { ok: true, message: `${refs.length} image(s) present on cluster` };
+}
+function hasImageRef(present, ref) {
+  if (present.has(ref)) return true;
+  const variants = [`docker.io/library/${ref}`, `docker.io/${ref}`];
+  return variants.some((v) => present.has(v));
+}
 
 // src/commands/doctor.ts
 init_output();
@@ -27091,27 +27378,56 @@ async function runDoctor(opts, deps = {}) {
   const fetchImpl = deps.fetchImpl;
   const olamHomeOverride = deps.olamHomeOverride;
   const registry = deps.registry ?? DEFAULT_REGISTRY;
-  const dockerResult = await probeDockerDaemon(dockerExec);
-  const rows = [{ name: "docker daemon", result: dockerResult }];
-  if (!dockerResult.ok) {
-    return emit({ rows, summary: "FAILED", failureCount: 1 }, opts);
+  const engine = deps.engine ?? resolveEngineFromEnv();
+  const isK8s = engine === "kubernetes";
+  const slot1Result = isK8s ? await probeK8sApiReachable(dockerExec) : await probeDockerDaemon(dockerExec);
+  const slot1Name = isK8s ? "api server" : "docker daemon";
+  const rows = [{ name: slot1Name, result: slot1Result }];
+  if (!slot1Result.ok) {
+    const [engineRes, colimaRes] = await Promise.all([
+      probeEngine(fetchImpl),
+      probeColimaVersion(dockerExec)
+    ]);
+    rows.push(
+      { name: "engine", result: engineRes },
+      { name: "colima version", result: colimaRes }
+    );
+    return emit(makeReport(rows), opts);
   }
   const imageRefs = buildRequiredImageRefs(registry);
-  const [imageResult, hostCpResult, authResult, kgResult] = await Promise.all([
-    probeImagePresence(imageRefs, dockerExec),
+  const slot2Promise = isK8s ? probeK8sImagePresence(imageRefs, dockerExec) : probeImagePresence(imageRefs, dockerExec);
+  const [imageResult, hostCpResult, authResult, kgResult, engineResult, colimaResult] = await Promise.all([
+    slot2Promise,
     probeHostCpHealth(fetchImpl),
     probeAuthVault(olamHomeOverride),
-    probeKgStorage(olamHomeOverride)
+    probeKgStorage(olamHomeOverride),
+    probeEngine(fetchImpl),
+    probeColimaVersion(dockerExec)
   ]);
   rows.push(
     { name: "images", result: imageResult },
     { name: "host-cp /health", result: hostCpResult },
     { name: "auth vault", result: authResult },
-    { name: "KG storage", result: kgResult }
+    { name: "KG storage", result: kgResult },
+    { name: "engine", result: engineResult },
+    { name: "colima version", result: colimaResult }
   );
+  return emit(makeReport(rows), opts);
+}
+function makeReport(rows) {
   const failureCount = rows.filter((r) => !r.result.ok).length;
+  const warnCount = rows.filter((r) => isWarn(r.result)).length;
   const summary = failureCount === 0 ? "OK" : "FAILED";
-  return emit({ rows, summary, failureCount }, opts);
+  return { rows, summary, failureCount, warnCount };
+}
+function resolveEngineFromEnv() {
+  const explicit = process.env.OLAM_HOST_CP_ENGINE;
+  if (explicit === "kubernetes") return "kubernetes";
+  if (explicit === "docker") return "docker";
+  return process.env.KUBERNETES_SERVICE_HOST ? "kubernetes" : "docker";
+}
+function isWarn(r) {
+  return r.ok === true && r.warn === true;
 }
 function emit(report, opts) {
   if (opts.json) {
@@ -27120,12 +27436,19 @@ function emit(report, opts) {
         {
           summary: report.summary,
           failureCount: report.failureCount,
-          probes: report.rows.map((r) => ({
-            name: r.name,
-            ok: r.result.ok,
-            message: r.result.message,
-            ...r.result.ok ? {} : { remedy: r.result.remedy }
-          }))
+          warnCount: report.warnCount,
+          probes: report.rows.map((r) => {
+            const isFail = !r.result.ok;
+            const warn = isWarn(r.result);
+            const base = {
+              name: r.name,
+              ok: r.result.ok,
+              message: r.result.message
+            };
+            if (warn) base.warn = true;
+            if (isFail || warn) base.remedy = r.result.remedy;
+            return base;
+          })
         },
         null,
         2
@@ -27142,23 +27465,28 @@ function renderHuman(report) {
   const namePad = Math.max(...report.rows.map((r) => r.name.length));
   for (const row of report.rows) {
     const label = row.name.padEnd(namePad);
-    if (row.result.ok) {
-      printSuccess(`${label}  ${row.result.message}`);
+    if (isWarn(row.result)) {
+      printWarning(`[WARN] ${label}  ${row.result.message}`);
+      const remedy = row.result.remedy;
+      if (remedy) printWarning(`${"".padEnd(namePad + 7)}  remedy: ${remedy}`);
+    } else if (row.result.ok) {
+      printSuccess(`[PASS] ${label}  ${row.result.message}`);
     } else {
-      printError(`${label}  ${row.result.message}`);
-      printWarning(`${"".padEnd(namePad)}  remedy: ${row.result.remedy}`);
+      printError(`[FAIL] ${label}  ${row.result.message}`);
+      printWarning(`${"".padEnd(namePad + 7)}  remedy: ${row.result.remedy}`);
     }
   }
   process.stdout.write("\n");
   if (report.summary === "OK") {
-    printSuccess(`OK \u2014 all ${report.rows.length} probes green`);
+    const warnNote = report.warnCount > 0 ? ` (${report.warnCount} warn)` : "";
+    printSuccess(`OK \u2014 all ${report.rows.length} probes green${warnNote}`);
   } else {
     printError(`FAILED \u2014 ${report.failureCount} of ${report.rows.length} probes failed`);
   }
 }
 function registerDoctor(program2) {
   program2.command("doctor").description(
-    "Pass/fail host-health check. Exits 0 on a healthy host; 1 on any failed probe. Runs Docker daemon / image presence / host-cp /health / auth vault / KG storage probes."
+    "Pass/fail host-health check. Exits 0 on a healthy host (including WARN-only); 1 on any FAIL probe. Runs daemon / image / host-cp /health / auth / KG / engine / colima probes (7 total)."
   ).option("--json", "emit the report as JSON instead of a human-readable table").action(async (opts) => {
     const r = await runDoctor(opts);
     if (r.exitCode !== 0) process.exitCode = r.exitCode;
@@ -27913,11 +28241,11 @@ function registerBegin(program2) {
 }
 
 // src/commands/config.ts
-import * as fs46 from "node:fs";
+import * as fs51 from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 
 // ../core/dist/global-config/index.js
-init_schema3();
+init_schema4();
 init_store2();
 
 // ../core/dist/global-config/repos.js
@@ -27991,88 +28319,714 @@ init_runbooks();
 init_port_validator();
 init_bridge();
 
-// src/commands/config.ts
+// ../core/dist/skill-sources/index.js
+init_schema3();
+
+// ../core/dist/skill-sources/store.js
 init_store2();
-var _require4 = createRequire4(import.meta.url);
-var { parse: parseWithMap } = _require4("json-source-map");
-function registerConfig(program2) {
-  const config = program2.command("config").description("Manage global olam configuration");
-  config.command("validate [path]").description("Validate ~/.olam/config.json (or a custom path) against the schema").action((filePath) => {
-    const resolvedPath = filePath ?? globalConfigPath();
-    if (!fs46.existsSync(resolvedPath)) {
-      process.stderr.write(`config file not found: ${resolvedPath}
-`);
-      process.exit(1);
-    }
-    let raw;
-    try {
-      raw = fs46.readFileSync(resolvedPath, "utf-8");
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`cannot read ${resolvedPath}: ${msg}
-`);
-      process.exit(1);
-    }
-    let parsed;
-    let pointers;
-    try {
-      const result2 = parseWithMap(raw);
-      parsed = result2.data;
-      pointers = result2.pointers;
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`${resolvedPath}: invalid JSON \u2014 ${msg}
-`);
-      process.exit(1);
-    }
-    const result = GlobalConfigSchema.safeParse(parsed);
-    if (result.success) {
-      process.exit(0);
-    }
-    for (const issue of result.error.issues) {
-      const pointer = "/" + issue.path.join("/");
-      const entry = pointers[pointer];
-      const rawLine = entry?.value?.line ?? entry?.key?.line ?? -1;
-      const lineStr = rawLine >= 0 ? `Line ${rawLine + 1}: ` : "";
-      process.stderr.write(`${lineStr}${pointer}: ${issue.message}
-`);
-    }
-    process.exit(1);
-  });
+init_schema3();
+import * as crypto7 from "node:crypto";
+function deriveSkillSourceId(gitUrl) {
+  return crypto7.createHash("sha256").update(gitUrl).digest("hex").slice(0, SKILL_SOURCE_ID_LENGTH);
 }
-
-// src/commands/repos.ts
-import pc25 from "picocolors";
-init_output();
-function asMessage(err) {
-  return err instanceof Error ? err.message : String(err);
+function listSkillSources() {
+  return readGlobalConfig().skillSources;
 }
-function registerRepos(program2) {
-  const repos = program2.command("repos").description("Manage the global repo registry");
-  repos.command("list").description("List all registered repos").action(() => {
-    const all = listRepos();
-    if (all.length === 0) {
-      console.log(pc25.dim("0 repo(s) registered. Add one with: olam repos add --name <n> --path <p>"));
-      return;
-    }
-    printHeader(`${all.length} repo(s)`);
-    for (const r of all) {
-      const when = new Date(r.addedAt).toISOString().slice(0, 10);
-      console.log(
-        `  ${pc25.bold(r.name.padEnd(24))} ${r.path.padEnd(48)} ${pc25.dim(when)}`
-      );
-    }
+function getSkillSource(id) {
+  return readGlobalConfig().skillSources.find((s) => s.id === id);
+}
+function addSkillSource(entry) {
+  const config = readGlobalConfig();
+  const id = deriveSkillSourceId(entry.gitUrl);
+  if (config.skillSources.some((s) => s.id === id)) {
+    throw new Error(`skill-source "${entry.gitUrl}" already registered (id "${id}"). Use "olam skills source list" to inspect.`);
+  }
+  if (config.skillSources.some((s) => s.name === entry.name)) {
+    throw new Error(`skill-source name "${entry.name}" already in use. Pick a different display name.`);
+  }
+  const now = Date.now();
+  const newEntry = {
+    id,
+    name: entry.name,
+    gitUrl: entry.gitUrl,
+    branch: entry.branch ?? "main",
+    addedAt: now
+  };
+  writeGlobalConfig({ ...config, skillSources: [...config.skillSources, newEntry] });
+  return newEntry;
+}
+function removeSkillSource(id) {
+  const config = readGlobalConfig();
+  if (!config.skillSources.some((s) => s.id === id)) {
+    throw new Error(`skill-source "${id}" is not registered. Run "olam skills source list" to see registered sources.`);
+  }
+  writeGlobalConfig({
+    ...config,
+    skillSources: config.skillSources.filter((s) => s.id !== id)
   });
-  repos.command("add").description("Register a local repo path").requiredOption("--name <name>", "Repo name (lowercase, digits, dash)").requiredOption("--path <path>", "Absolute or ~/... path to the local repo").option("--description <desc>", "Optional human-readable description").option("--default-branch <branch>", "Default branch name (e.g. main)").action((opts) => {
-    try {
-      const entry = addRepo({
-        name: opts.name,
-        path: opts.path,
-        description: opts.description,
-        defaultBranch: opts.defaultBranch
-      });
-      printSuccess(`registered repo "${entry.name}" at ${entry.path}`);
-    } catch (err) {
+}
+function updateSkillSource(id, patch) {
+  const config = readGlobalConfig();
+  const idx = config.skillSources.findIndex((s) => s.id === id);
+  if (idx === -1) {
+    throw new Error(`skill-source "${id}" is not registered. Run "olam skills source list" to see registered sources.`);
+  }
+  if (patch.name !== void 0) {
+    const collision = config.skillSources.find((s, i) => i !== idx && s.name === patch.name);
+    if (collision !== void 0) {
+      throw new Error(`skill-source name "${patch.name}" already in use by id "${collision.id}".`);
+    }
+  }
+  const existing = config.skillSources[idx];
+  const updated = {
+    ...existing,
+    ...patch.name !== void 0 ? { name: patch.name } : {},
+    ...patch.branch !== void 0 ? { branch: patch.branch } : {},
+    ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {}
+  };
+  const next = [...config.skillSources];
+  next[idx] = updated;
+  writeGlobalConfig({ ...config, skillSources: next });
+  return updated;
+}
+
+// ../core/dist/skill-sources/clone.js
+import { execFileSync as execFileSync12 } from "node:child_process";
+import * as fs46 from "node:fs";
+import * as os27 from "node:os";
+import * as path51 from "node:path";
+function skillSourcesRootDir() {
+  const override = process.env["OLAM_SKILL_SOURCES_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path51.join(os27.homedir(), ".olam", "state", "skill-sources");
+}
+function skillSourceClonePath(id) {
+  return path51.join(skillSourcesRootDir(), id);
+}
+var SkillSourceGitError = class extends Error {
+  op;
+  gitUrl;
+  constructor(op, gitUrl, cause) {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    super(`git ${op} failed for "${gitUrl}": ${msg}`);
+    this.op = op;
+    this.gitUrl = gitUrl;
+    this.name = "SkillSourceGitError";
+    this.cause = cause;
+  }
+};
+function runGit(args, cwd) {
+  try {
+    return execFileSync12("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (err) {
+    throw err;
+  }
+}
+function cloneSkillSource(opts) {
+  const clonePath = skillSourceClonePath(opts.id);
+  if (fs46.existsSync(clonePath)) {
+    throw new Error(`clone path "${clonePath}" already exists. Remove the existing skill-source first.`);
+  }
+  fs46.mkdirSync(skillSourcesRootDir(), { recursive: true });
+  try {
+    runGit(["clone", "--depth", "1", "--branch", opts.branch, opts.gitUrl, clonePath]);
+  } catch (err) {
+    if (fs46.existsSync(clonePath)) {
+      fs46.rmSync(clonePath, { recursive: true, force: true });
+    }
+    throw new SkillSourceGitError("clone", opts.gitUrl, err);
+  }
+  let headSha;
+  try {
+    headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
+  } catch (err) {
+    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+  }
+  return { clonePath, headSha };
+}
+function pullSkillSource(opts) {
+  const clonePath = skillSourceClonePath(opts.id);
+  if (!fs46.existsSync(clonePath)) {
+    throw new Error(`clone path "${clonePath}" does not exist. Run "olam skills source add" first.`);
+  }
+  try {
+    runGit(["fetch", "origin", opts.branch], clonePath);
+    runGit(["reset", "--hard", `origin/${opts.branch}`], clonePath);
+  } catch (err) {
+    throw new SkillSourceGitError("fetch/reset", opts.gitUrl, err);
+  }
+  try {
+    const headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
+    return { headSha };
+  } catch (err) {
+    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+  }
+}
+function removeSkillSourceClone(id) {
+  const clonePath = skillSourceClonePath(id);
+  if (fs46.existsSync(clonePath)) {
+    fs46.rmSync(clonePath, { recursive: true, force: true });
+  }
+}
+
+// ../core/dist/skill-sync/artifact-resolver.js
+import * as fs47 from "node:fs";
+import * as path52 from "node:path";
+function resolveSubscriptions(opts) {
+  const { clonePath, atlasUser } = opts;
+  if (atlasUser) {
+    const subsPath = path52.join(clonePath, "members", atlasUser, "subscriptions.json");
+    if (fs47.existsSync(subsPath)) {
+      try {
+        const parsed = JSON.parse(fs47.readFileSync(subsPath, "utf-8"));
+        if (Array.isArray(parsed?.categories)) {
+          return {
+            categories: parsed.categories.filter((c) => typeof c === "string"),
+            fromSubscriptionsFile: true,
+            atlasUser
+          };
+        }
+      } catch {
+      }
+    }
+  }
+  const catsPath = path52.join(clonePath, "shared", "categories.json");
+  if (fs47.existsSync(catsPath)) {
+    try {
+      const parsed = JSON.parse(fs47.readFileSync(catsPath, "utf-8"));
+      if (Array.isArray(parsed?.categories)) {
+        return {
+          categories: parsed.categories.map((c) => c.id).filter((id) => typeof id === "string"),
+          fromSubscriptionsFile: false,
+          atlasUser
+        };
+      }
+    } catch {
+    }
+  }
+  const sharedDir = path52.join(clonePath, "shared");
+  const cats = [];
+  if (fs47.existsSync(sharedDir)) {
+    for (const name of fs47.readdirSync(sharedDir)) {
+      const dir = path52.join(sharedDir, name);
+      if (!fs47.statSync(dir).isDirectory())
+        continue;
+      if (fs47.existsSync(path52.join(dir, "skills")) || fs47.existsSync(path52.join(dir, "agents"))) {
+        cats.push(name);
+      }
+    }
+  }
+  return { categories: cats, fromSubscriptionsFile: false, atlasUser };
+}
+function listDirSafe(dir) {
+  if (!fs47.existsSync(dir))
+    return [];
+  return fs47.readdirSync(dir);
+}
+function resolveSkillsDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    const subdir = path52.join(baseDir, name);
+    if (!fs47.statSync(subdir).isDirectory())
+      continue;
+    if (!fs47.existsSync(path52.join(subdir, "SKILL.md")))
+      continue;
+    out.push({ kind: "skill", sourceId, sourcePath: subdir, deployBasename: name });
+    const subagentsDir = path52.join(subdir, "references", "agents");
+    if (fs47.existsSync(subagentsDir) && fs47.statSync(subagentsDir).isDirectory()) {
+      for (const f of listDirSafe(subagentsDir)) {
+        if (!f.endsWith(".md"))
+          continue;
+        out.push({
+          kind: "subagent",
+          sourceId,
+          sourcePath: path52.join(subagentsDir, f),
+          deployBasename: f,
+          parentSkill: name
+        });
+      }
+    }
+  }
+  return out;
+}
+function resolveAgentsDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    const full = path52.join(baseDir, name);
+    const stat = fs47.statSync(full);
+    if (stat.isFile() && name.endsWith(".md")) {
+      out.push({ kind: "agent", sourceId, sourcePath: full, deployBasename: name });
+    } else if (stat.isDirectory()) {
+      for (const f of listDirSafe(full)) {
+        if (!f.endsWith(".md"))
+          continue;
+        out.push({
+          kind: "agent",
+          sourceId,
+          sourcePath: path52.join(full, f),
+          deployBasename: `${name}-${f}`
+        });
+      }
+    }
+  }
+  return out;
+}
+function resolveScriptsDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    const full = path52.join(baseDir, name);
+    const stat = fs47.statSync(full);
+    if (stat.isFile() && name.endsWith(".sh")) {
+      out.push({ kind: "script", sourceId, sourcePath: full, deployBasename: name });
+    } else if (stat.isDirectory()) {
+      out.push({ kind: "script", sourceId, sourcePath: full, deployBasename: name });
+    }
+  }
+  return out;
+}
+function resolveRulesDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    if (!name.endsWith(".md"))
+      continue;
+    const full = path52.join(baseDir, name);
+    if (!fs47.statSync(full).isFile())
+      continue;
+    out.push({ kind: "rule", sourceId, sourcePath: full, deployBasename: name });
+  }
+  return out;
+}
+function resolveJsonDir(opts) {
+  const { sourceId, baseDir, kind } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    if (!name.endsWith(".json"))
+      continue;
+    const full = path52.join(baseDir, name);
+    if (!fs47.statSync(full).isFile())
+      continue;
+    out.push({ kind, sourceId, sourcePath: full, deployBasename: name });
+  }
+  return out;
+}
+function resolveSourceArtifacts(opts) {
+  const { sourceId, clonePath, atlasUser } = opts;
+  const subscription = resolveSubscriptions({ clonePath, atlasUser });
+  const artifacts = [];
+  for (const cat of subscription.categories) {
+    const catDir = path52.join(clonePath, "shared", cat);
+    if (!fs47.existsSync(catDir))
+      continue;
+    artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path52.join(catDir, "skills") }));
+    artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path52.join(catDir, "agents") }));
+    artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path52.join(catDir, "scripts") }));
+    artifacts.push(...resolveRulesDir({ sourceId, baseDir: path52.join(catDir, "rules") }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path52.join(catDir, "hooks"), kind: "hook" }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path52.join(catDir, "permissions"), kind: "permission" }));
+  }
+  if (atlasUser) {
+    const memberRoot = path52.join(clonePath, "members", atlasUser);
+    if (fs47.existsSync(memberRoot)) {
+      artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path52.join(memberRoot, "skills") }));
+      artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path52.join(memberRoot, "agents") }));
+      artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path52.join(memberRoot, "scripts") }));
+      artifacts.push(...resolveRulesDir({ sourceId, baseDir: path52.join(memberRoot, "rules") }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path52.join(memberRoot, "hooks"), kind: "hook" }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path52.join(memberRoot, "permissions"), kind: "permission" }));
+    }
+  }
+  return { subscription, artifacts };
+}
+
+// ../core/dist/skill-sync/symlink-deployer.js
+import * as fs48 from "node:fs";
+import * as os28 from "node:os";
+import * as path53 from "node:path";
+function claudeDir() {
+  const override = process.env["OLAM_CLAUDE_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path53.join(os28.homedir(), ".claude");
+}
+var BUCKETS = ["commands", "agents", "skills", "scripts", "rules"];
+function bucketFor(kind) {
+  switch (kind) {
+    case "skill":
+      return "skills";
+    case "agent":
+      return "agents";
+    case "subagent":
+      return "agents";
+    case "script":
+      return "scripts";
+    case "rule":
+      return "rules";
+    case "hook":
+    case "permission":
+      return void 0;
+  }
+}
+function cleanManagedSymlinks(claude) {
+  for (const bucket of BUCKETS) {
+    const dir = path53.join(claude, bucket);
+    if (!fs48.existsSync(dir))
+      continue;
+    for (const name of fs48.readdirSync(dir)) {
+      const p = path53.join(dir, name);
+      try {
+        const stat = fs48.lstatSync(p);
+        if (stat.isSymbolicLink()) {
+          fs48.unlinkSync(p);
+        }
+      } catch {
+      }
+    }
+  }
+}
+function shadowBackup(link) {
+  const epoch = Math.floor(Date.now() / 1e3);
+  const backup2 = `${link}.shadow-backup-${epoch}`;
+  fs48.renameSync(link, backup2);
+  return backup2;
+}
+function linkIfNeeded(target, link) {
+  try {
+    const existing = fs48.readlinkSync(link);
+    if (existing === target)
+      return { created: false };
+  } catch {
+  }
+  let isLink = false;
+  try {
+    isLink = fs48.lstatSync(link).isSymbolicLink();
+  } catch {
+  }
+  let backup2;
+  if (isLink) {
+    fs48.unlinkSync(link);
+  } else if (fs48.existsSync(link)) {
+    backup2 = shadowBackup(link);
+  }
+  fs48.symlinkSync(target, link);
+  return { created: true, shadowBackup: backup2 };
+}
+function deployArtifacts(artifacts) {
+  const claude = claudeDir();
+  for (const bucket of BUCKETS) {
+    fs48.mkdirSync(path53.join(claude, bucket), { recursive: true });
+  }
+  cleanManagedSymlinks(claude);
+  const result = { linked: 0, shadowBackups: [], subagentCollisions: [] };
+  const seenAgentBasenames = /* @__PURE__ */ new Map();
+  const collisionLosers = /* @__PURE__ */ new Map();
+  for (const artifact of artifacts) {
+    const bucket = bucketFor(artifact.kind);
+    if (!bucket)
+      continue;
+    if (artifact.kind === "agent" || artifact.kind === "subagent") {
+      const prior = seenAgentBasenames.get(artifact.deployBasename);
+      if (prior) {
+        const losers = collisionLosers.get(artifact.deployBasename) ?? [];
+        losers.push(artifact.sourcePath);
+        collisionLosers.set(artifact.deployBasename, losers);
+        continue;
+      }
+      seenAgentBasenames.set(artifact.deployBasename, artifact.sourcePath);
+    }
+    const linkPath = path53.join(claude, bucket, artifact.deployBasename);
+    const { created, shadowBackup: backup2 } = linkIfNeeded(artifact.sourcePath, linkPath);
+    if (created)
+      result.linked += 1;
+    if (backup2)
+      result.shadowBackups.push(backup2);
+  }
+  for (const [name, losers] of collisionLosers.entries()) {
+    const winner = seenAgentBasenames.get(name);
+    result.subagentCollisions.push({ name, winner, losers });
+  }
+  return result;
+}
+
+// ../core/dist/skill-sync/settings-merger.js
+import * as fs49 from "node:fs";
+import * as os29 from "node:os";
+import * as path54 from "node:path";
+var OLAM_SKILLS_MARKER = "_olamSkillsManaged";
+var BACKUP_RETENTION = 30;
+function claudeSettingsPath() {
+  const override = process.env["OLAM_CLAUDE_SETTINGS_PATH"];
+  if (override && override.length > 0)
+    return override;
+  return path54.join(claudeDirInternal(), "settings.json");
+}
+function claudeDirInternal() {
+  const override = process.env["OLAM_CLAUDE_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path54.join(os29.homedir(), ".claude");
+}
+function settingsBackupDir() {
+  const override = process.env["OLAM_SETTINGS_BACKUP_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path54.join(os29.homedir(), ".olam", "state", "settings-backups");
+}
+function dedupeByMatcher(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    map.set(e.matcher ?? "", e);
+  }
+  return [...map.values()];
+}
+function tagOlam(entry) {
+  return { ...entry, [OLAM_SKILLS_MARKER]: true };
+}
+function readJson(file) {
+  return JSON.parse(fs49.readFileSync(file, "utf-8"));
+}
+function rotateBackups(backupDir) {
+  if (!fs49.existsSync(backupDir))
+    return;
+  const files = fs49.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path54.join(backupDir, f), mtime: fs49.statSync(path54.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  for (const f of files.slice(BACKUP_RETENTION)) {
+    try {
+      fs49.unlinkSync(f.full);
+    } catch {
+    }
+  }
+}
+function backupSettings() {
+  const src = claudeSettingsPath();
+  if (!fs49.existsSync(src))
+    return void 0;
+  const dir = settingsBackupDir();
+  fs49.mkdirSync(dir, { recursive: true });
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const dest = path54.join(dir, `settings-${stamp}.json`);
+  fs49.copyFileSync(src, dest);
+  rotateBackups(dir);
+  return dest;
+}
+function mergeSettings(input) {
+  const settingsPath = claudeSettingsPath();
+  const backupPath = backupSettings();
+  let base = {};
+  if (fs49.existsSync(settingsPath)) {
+    try {
+      base = readJson(settingsPath);
+    } catch {
+      base = {};
+    }
+  }
+  const olamHooksByCategory = /* @__PURE__ */ new Map();
+  for (const file of input.hookFiles) {
+    let parsed;
+    try {
+      parsed = readJson(file);
+    } catch {
+      continue;
+    }
+    if (!parsed.hooks || typeof parsed.hooks !== "object")
+      continue;
+    for (const [category, entries] of Object.entries(parsed.hooks)) {
+      if (!Array.isArray(entries))
+        continue;
+      const list = olamHooksByCategory.get(category) ?? [];
+      list.push(...entries.map(tagOlam));
+      olamHooksByCategory.set(category, list);
+    }
+  }
+  const mergedHooks = {};
+  const existingHooks = base.hooks && typeof base.hooks === "object" ? base.hooks : {};
+  const categories = /* @__PURE__ */ new Set([
+    ...Object.keys(existingHooks),
+    ...olamHooksByCategory.keys()
+  ]);
+  let hooksAdded = 0;
+  for (const cat of categories) {
+    const existing = Array.isArray(existingHooks[cat]) ? existingHooks[cat] : [];
+    const preserved = existing.filter((e) => !e[OLAM_SKILLS_MARKER]);
+    const olam = olamHooksByCategory.get(cat) ?? [];
+    const combined = [...preserved, ...olam];
+    mergedHooks[cat] = dedupeByMatcher(combined);
+    hooksAdded += olam.length;
+  }
+  const permSet = /* @__PURE__ */ new Set();
+  for (const file of input.permissionFiles) {
+    let parsed;
+    try {
+      parsed = readJson(file);
+    } catch {
+      continue;
+    }
+    const allow = parsed.permissions?.allow;
+    if (Array.isArray(allow)) {
+      for (const p of allow)
+        if (typeof p === "string")
+          permSet.add(p);
+    }
+  }
+  const next = {
+    ...base,
+    hooks: mergedHooks,
+    permissions: {
+      ...base.permissions ?? {},
+      ...input.permissionFiles.length > 0 ? { allow: [...permSet] } : {}
+    }
+  };
+  fs49.mkdirSync(path54.dirname(settingsPath), { recursive: true });
+  const tmp = `${settingsPath}.tmp-${process.pid}`;
+  fs49.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
+  fs49.renameSync(tmp, settingsPath);
+  return { backupPath, hooksAdded, permissionsCount: permSet.size };
+}
+
+// ../core/dist/skill-sync/engine.js
+import * as fs50 from "node:fs";
+import * as os30 from "node:os";
+import * as path55 from "node:path";
+function resolveAtlasUser(override) {
+  if (override)
+    return override;
+  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path55.join(os30.homedir(), ".claude");
+  const f = path55.join(claudeDir2, ".atlas-user");
+  if (fs50.existsSync(f)) {
+    return fs50.readFileSync(f, "utf-8").trim() || void 0;
+  }
+  return void 0;
+}
+async function syncSkills(opts = {}) {
+  const atlasUser = resolveAtlasUser(opts.atlasUser);
+  const sources = listSkillSources();
+  const allArtifacts = [];
+  const perSource = [];
+  for (const source of sources) {
+    const clonePath = skillSourceClonePath(source.id);
+    if (!fs50.existsSync(clonePath))
+      continue;
+    const { artifacts, subscription } = resolveSourceArtifacts({
+      sourceId: source.id,
+      clonePath,
+      atlasUser
+    });
+    allArtifacts.push(...artifacts);
+    perSource.push({
+      sourceId: source.id,
+      name: source.name,
+      artifactCount: artifacts.length,
+      categories: subscription.categories,
+      fromSubscriptionsFile: subscription.fromSubscriptionsFile
+    });
+  }
+  const hookFiles = allArtifacts.filter((a) => a.kind === "hook").map((a) => a.sourcePath);
+  const permissionFiles = allArtifacts.filter((a) => a.kind === "permission").map((a) => a.sourcePath);
+  const summary = {
+    sourceCount: sources.length,
+    artifactCount: allArtifacts.length,
+    hookFileCount: hookFiles.length,
+    permissionFileCount: permissionFiles.length,
+    deploy: void 0,
+    merge: void 0,
+    perSource
+  };
+  if (opts.dryRun)
+    return summary;
+  summary.deploy = deployArtifacts(allArtifacts);
+  summary.merge = mergeSettings({ hookFiles, permissionFiles });
+  return summary;
+}
+
+// src/commands/config.ts
+init_store2();
+var _require4 = createRequire4(import.meta.url);
+var { parse: parseWithMap } = _require4("json-source-map");
+function registerConfig(program2) {
+  const config = program2.command("config").description("Manage global olam configuration");
+  config.command("validate [path]").description("Validate ~/.olam/config.json (or a custom path) against the schema").action((filePath) => {
+    const resolvedPath = filePath ?? globalConfigPath();
+    if (!fs51.existsSync(resolvedPath)) {
+      process.stderr.write(`config file not found: ${resolvedPath}
+`);
+      process.exit(1);
+    }
+    let raw;
+    try {
+      raw = fs51.readFileSync(resolvedPath, "utf-8");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`cannot read ${resolvedPath}: ${msg}
+`);
+      process.exit(1);
+    }
+    let parsed;
+    let pointers;
+    try {
+      const result2 = parseWithMap(raw);
+      parsed = result2.data;
+      pointers = result2.pointers;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`${resolvedPath}: invalid JSON \u2014 ${msg}
+`);
+      process.exit(1);
+    }
+    const result = GlobalConfigSchema.safeParse(parsed);
+    if (result.success) {
+      process.exit(0);
+    }
+    for (const issue of result.error.issues) {
+      const pointer = "/" + issue.path.join("/");
+      const entry = pointers[pointer];
+      const rawLine = entry?.value?.line ?? entry?.key?.line ?? -1;
+      const lineStr = rawLine >= 0 ? `Line ${rawLine + 1}: ` : "";
+      process.stderr.write(`${lineStr}${pointer}: ${issue.message}
+`);
+    }
+    process.exit(1);
+  });
+}
+
+// src/commands/repos.ts
+import pc25 from "picocolors";
+init_output();
+function asMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function registerRepos(program2) {
+  const repos = program2.command("repos").description("Manage the global repo registry");
+  repos.command("list").description("List all registered repos").action(() => {
+    const all = listRepos();
+    if (all.length === 0) {
+      console.log(pc25.dim("0 repo(s) registered. Add one with: olam repos add --name <n> --path <p>"));
+      return;
+    }
+    printHeader(`${all.length} repo(s)`);
+    for (const r of all) {
+      const when = new Date(r.addedAt).toISOString().slice(0, 10);
+      console.log(
+        `  ${pc25.bold(r.name.padEnd(24))} ${r.path.padEnd(48)} ${pc25.dim(when)}`
+      );
+    }
+  });
+  repos.command("add").description("Register a local repo path").requiredOption("--name <name>", "Repo name (lowercase, digits, dash)").requiredOption("--path <path>", "Absolute or ~/... path to the local repo").option("--description <desc>", "Optional human-readable description").option("--default-branch <branch>", "Default branch name (e.g. main)").action((opts) => {
+    try {
+      const entry = addRepo({
+        name: opts.name,
+        path: opts.path,
+        description: opts.description,
+        defaultBranch: opts.defaultBranch
+      });
+      printSuccess(`registered repo "${entry.name}" at ${entry.path}`);
+    } catch (err) {
       printError(asMessage(err));
       process.exitCode = 1;
     }
@@ -28183,74 +29137,309 @@ function registerRunbooks(program2) {
       removeRunbook(name);
       printSuccess(`removed runbook "${name}"`);
     } catch (err) {
-      printError(asMessage2(err));
+      printError(asMessage2(err));
+      process.exitCode = 1;
+    }
+  });
+  runbooks.command("apply").description("Create a world from a runbook (delegates to olam create)").argument("<name>", "Runbook name").option("--name <world>", "World name override").option("--task <task>", "Initial task to dispatch").action((name, opts) => {
+    try {
+      const rb = getRunbook(name);
+      const { conflicts } = validateRunbookPorts(rb);
+      if (conflicts.length > 0) {
+        printError(`port conflicts detected for runbook "${name}":`);
+        for (const c of conflicts) {
+          console.error(formatConflict(c));
+        }
+        console.error(
+          `
+${conflicts.length} port conflict(s). Stop the conflicting processes or update portMap in runbook "${name}".`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      console.log(
+        pc26.dim(
+          `olam runbooks apply: port validation passed for "${name}" (repos: ${rb.repos.join(", ")}).`
+        )
+      );
+      console.log(
+        pc26.dim(
+          `Hint: use "olam create --repos ${rb.repos.join(" ")}${opts.task ? ` --task "${opts.task}"` : ""}${opts.name ? ` --name ${opts.name}` : ""}" to create the world.`
+        )
+      );
+      console.log(
+        pc26.yellow('Phase D will wire --runbook directly. For now, use "olam create --repos ..." above.')
+      );
+    } catch (err) {
+      printError(asMessage2(err));
+      process.exitCode = 1;
+    }
+  });
+  runbooks.command("check-ports").description("Check if runbook ports are available").argument("<name>", "Runbook name").action((name) => {
+    try {
+      const rb = getRunbook(name);
+      const { conflicts } = validateRunbookPorts(rb);
+      if (!rb.portMap || Object.keys(rb.portMap).length === 0) {
+        console.log(pc26.dim(`runbook "${name}" declares no ports.`));
+        return;
+      }
+      for (const [repoName, svcMap] of Object.entries(rb.portMap ?? {})) {
+        for (const [svcName, port2] of Object.entries(svcMap)) {
+          const conflict = conflicts.find((c) => c.port === port2);
+          if (conflict) {
+            console.log(formatConflict(conflict));
+          } else {
+            console.log(`  ${pc26.green("\u2713")} ${repoName}.${svcName}:${port2} \u2014 free`);
+          }
+        }
+      }
+      if (conflicts.length > 0) {
+        console.error(
+          `
+${conflicts.length} port conflict(s). Stop the conflicting processes or update portMap in runbook "${name}".`
+        );
+        process.exitCode = 1;
+      } else {
+        console.log(pc26.green("\n\u2713 all ports free"));
+      }
+    } catch (err) {
+      printError(asMessage2(err));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/skills-source.ts
+import pc27 from "picocolors";
+init_output();
+function asMessage3(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function registerSkillsSource(program2) {
+  const skills = program2.command("skills").description("Manage skill sources and synchronization");
+  const source = skills.command("source").description("Manage registered skill sources");
+  source.command("list").description("List all registered skill sources").action(() => {
+    const all = listSkillSources();
+    if (all.length === 0) {
+      console.log(
+        pc27.dim("0 skill source(s) registered. Add one with: olam skills source add --name <n> --git-url <url>")
+      );
+      return;
+    }
+    printHeader(`${all.length} skill source(s)`);
+    for (const s of all) {
+      const when = new Date(s.addedAt).toISOString().slice(0, 10);
+      const sha = s.lastPulledSha ? s.lastPulledSha.slice(0, 8) : pc27.dim("(unpulled)");
+      console.log(
+        `  ${pc27.bold(s.id.padEnd(14))} ${s.name.padEnd(24)} ${s.branch.padEnd(12)} ${sha.padEnd(12)} ${pc27.dim(when)} ${pc27.dim(s.gitUrl)}`
+      );
+    }
+  });
+  source.command("add").description("Register and clone a skill source").requiredOption("--name <name>", "Display name (lowercase, digits, dash)").requiredOption("--git-url <url>", "git URL (https://, git@, ssh://, file://, or absolute path)").option("--branch <branch>", "Branch to track", "main").action((opts) => {
+    let entry;
+    try {
+      entry = addSkillSource({ name: opts.name, gitUrl: opts.gitUrl, branch: opts.branch });
+    } catch (err) {
+      printError(asMessage3(err));
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      const result = cloneSkillSource({
+        gitUrl: entry.gitUrl,
+        branch: entry.branch,
+        id: entry.id
+      });
+      updateSkillSource(entry.id, { lastPulledSha: result.headSha });
+      printSuccess(
+        `registered skill source "${entry.name}" (${entry.id}) at ${result.clonePath} @ ${result.headSha.slice(0, 8)}`
+      );
+    } catch (err) {
+      try {
+        removeSkillSource(entry.id);
+      } catch {
+      }
+      printError(asMessage3(err));
+      process.exitCode = 1;
+    }
+  });
+  source.command("remove").description("Remove a registered skill source (deletes its clone)").argument("<id>", 'Skill source id (from "olam skills source list")').action((id) => {
+    try {
+      removeSkillSourceClone(id);
+      removeSkillSource(id);
+      printSuccess(`removed skill source "${id}"`);
+    } catch (err) {
+      printError(asMessage3(err));
+      process.exitCode = 1;
+    }
+  });
+  source.command("pull").description("Fetch + reset the clone to upstream HEAD").argument("<id>", "Skill source id").action((id) => {
+    try {
+      const entry = getSkillSource(id);
+      if (!entry) {
+        printError(`skill source "${id}" is not registered`);
+        process.exitCode = 1;
+        return;
+      }
+      const result = pullSkillSource({
+        gitUrl: entry.gitUrl,
+        branch: entry.branch,
+        id: entry.id
+      });
+      updateSkillSource(entry.id, { lastPulledSha: result.headSha });
+      printSuccess(`pulled "${entry.name}" \u2192 ${result.headSha.slice(0, 8)}`);
+    } catch (err) {
+      printError(asMessage3(err));
+      process.exitCode = 1;
+    }
+  });
+  source.command("show").description("Show details for a single skill source").argument("<id>", "Skill source id").action((id) => {
+    const entry = getSkillSource(id);
+    if (!entry) {
+      printError(`skill source "${id}" is not registered`);
+      process.exitCode = 1;
+      return;
+    }
+    const when = new Date(entry.addedAt).toISOString();
+    console.log(`${pc27.bold("id:")}            ${entry.id}`);
+    console.log(`${pc27.bold("name:")}          ${entry.name}`);
+    console.log(`${pc27.bold("gitUrl:")}        ${entry.gitUrl}`);
+    console.log(`${pc27.bold("branch:")}        ${entry.branch}`);
+    console.log(`${pc27.bold("addedAt:")}       ${when}`);
+    console.log(`${pc27.bold("lastPulledSha:")} ${entry.lastPulledSha ?? pc27.dim("(unpulled)")}`);
+    console.log(`${pc27.bold("clonePath:")}     ${skillSourceClonePath(entry.id)}`);
+  });
+}
+
+// src/commands/skills.ts
+import * as fs52 from "node:fs";
+import * as path56 from "node:path";
+import pc28 from "picocolors";
+init_output();
+function asMessage4(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function listDeployed() {
+  const dir = claudeDir();
+  const sources = listSkillSources();
+  const sourcePaths = new Map(
+    sources.map((s) => [skillSourceClonePath(s.id), s.id])
+  );
+  const entries = [];
+  for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
+    const bucketDir = path56.join(dir, bucket);
+    if (!fs52.existsSync(bucketDir)) continue;
+    for (const name of fs52.readdirSync(bucketDir)) {
+      const full = path56.join(bucketDir, name);
+      try {
+        const stat = fs52.lstatSync(full);
+        if (!stat.isSymbolicLink()) continue;
+        const target = fs52.readlinkSync(full);
+        let sourceId;
+        for (const [clonePath, id] of sourcePaths.entries()) {
+          if (target.startsWith(clonePath)) {
+            sourceId = id;
+            break;
+          }
+        }
+        entries.push({ bucket, name, target, sourceId });
+      } catch {
+      }
+    }
+  }
+  return entries;
+}
+function printSyncSummary(summary, dryRun) {
+  printHeader(dryRun ? "dry-run summary" : "sync summary");
+  console.log(`  sources:         ${summary.sourceCount}`);
+  console.log(`  artifacts:       ${summary.artifactCount}`);
+  console.log(`  hook files:      ${summary.hookFileCount}`);
+  console.log(`  permission files:${summary.permissionFileCount}`);
+  if (summary.deploy) {
+    console.log(`  symlinks made:   ${summary.deploy.linked}`);
+    if (summary.deploy.shadowBackups.length > 0) {
+      console.log(`  ${pc28.yellow("shadow backups:")} ${summary.deploy.shadowBackups.length}`);
+      for (const p of summary.deploy.shadowBackups) console.log(`    ${pc28.dim(p)}`);
+    }
+    if (summary.deploy.subagentCollisions.length > 0) {
+      console.log(`  ${pc28.yellow("agent name collisions:")} ${summary.deploy.subagentCollisions.length}`);
+      for (const c of summary.deploy.subagentCollisions) {
+        console.log(`    ${pc28.bold(c.name)} \u2192 winner: ${pc28.dim(c.winner)}`);
+        for (const l of c.losers) console.log(`      ${pc28.dim("(skipped)")} ${l}`);
+      }
+    }
+  }
+  if (summary.merge) {
+    console.log(`  hooks added:     ${summary.merge.hooksAdded}`);
+    console.log(`  permissions:     ${summary.merge.permissionsCount}`);
+    if (summary.merge.backupPath) {
+      console.log(`  settings backup: ${pc28.dim(summary.merge.backupPath)}`);
+    }
+  }
+  console.log();
+  for (const s of summary.perSource) {
+    const sub = s.fromSubscriptionsFile ? "(subscribed)" : "(all categories)";
+    console.log(`  ${pc28.bold(s.name.padEnd(24))} ${s.artifactCount} artifacts \xB7 ${s.categories.join(", ") || "(none)"} ${pc28.dim(sub)}`);
+  }
+}
+function registerSkills(program2) {
+  const skills = program2.commands.find((c) => c.name() === "skills") ?? program2.command("skills").description("Manage skill sources and synchronization");
+  skills.command("sync").description("Sync registered skill sources to ~/.claude/").option("--dry-run", "Resolve artifacts but do not deploy or merge").option("--atlas-user <user>", "Override atlas-user (defaults to ~/.claude/.atlas-user)").action(async (opts) => {
+    try {
+      const summary = await syncSkills({ dryRun: opts.dryRun, atlasUser: opts.atlasUser });
+      printSyncSummary(summary, !!opts.dryRun);
+      if (!opts.dryRun) {
+        printSuccess(`synced ${summary.sourceCount} source(s), ${summary.artifactCount} artifact(s)`);
+      }
+    } catch (err) {
+      printError(asMessage4(err));
       process.exitCode = 1;
     }
   });
-  runbooks.command("apply").description("Create a world from a runbook (delegates to olam create)").argument("<name>", "Runbook name").option("--name <world>", "World name override").option("--task <task>", "Initial task to dispatch").action((name, opts) => {
+  skills.command("diff").description("Show what `olam skills sync` would deploy (no on-disk changes)").option("--atlas-user <user>", "Override atlas-user").action(async (opts) => {
     try {
-      const rb = getRunbook(name);
-      const { conflicts } = validateRunbookPorts(rb);
-      if (conflicts.length > 0) {
-        printError(`port conflicts detected for runbook "${name}":`);
-        for (const c of conflicts) {
-          console.error(formatConflict(c));
-        }
-        console.error(
-          `
-${conflicts.length} port conflict(s). Stop the conflicting processes or update portMap in runbook "${name}".`
-        );
-        process.exitCode = 1;
-        return;
-      }
-      console.log(
-        pc26.dim(
-          `olam runbooks apply: port validation passed for "${name}" (repos: ${rb.repos.join(", ")}).`
-        )
-      );
-      console.log(
-        pc26.dim(
-          `Hint: use "olam create --repos ${rb.repos.join(" ")}${opts.task ? ` --task "${opts.task}"` : ""}${opts.name ? ` --name ${opts.name}` : ""}" to create the world.`
-        )
-      );
-      console.log(
-        pc26.yellow('Phase D will wire --runbook directly. For now, use "olam create --repos ..." above.')
-      );
+      const summary = await syncSkills({ dryRun: true, atlasUser: opts.atlasUser });
+      printSyncSummary(summary, true);
     } catch (err) {
-      printError(asMessage2(err));
+      printError(asMessage4(err));
       process.exitCode = 1;
     }
   });
-  runbooks.command("check-ports").description("Check if runbook ports are available").argument("<name>", "Runbook name").action((name) => {
-    try {
-      const rb = getRunbook(name);
-      const { conflicts } = validateRunbookPorts(rb);
-      if (!rb.portMap || Object.keys(rb.portMap).length === 0) {
-        console.log(pc26.dim(`runbook "${name}" declares no ports.`));
-        return;
-      }
-      for (const [repoName, svcMap] of Object.entries(rb.portMap ?? {})) {
-        for (const [svcName, port2] of Object.entries(svcMap)) {
-          const conflict = conflicts.find((c) => c.port === port2);
-          if (conflict) {
-            console.log(formatConflict(conflict));
-          } else {
-            console.log(`  ${pc26.green("\u2713")} ${repoName}.${svcName}:${port2} \u2014 free`);
-          }
-        }
-      }
-      if (conflicts.length > 0) {
-        console.error(
-          `
-${conflicts.length} port conflict(s). Stop the conflicting processes or update portMap in runbook "${name}".`
-        );
-        process.exitCode = 1;
-      } else {
-        console.log(pc26.green("\n\u2713 all ports free"));
+  skills.command("list").description("List artifacts currently deployed to ~/.claude/").action(() => {
+    const entries = listDeployed();
+    if (entries.length === 0) {
+      console.log(pc28.dim('0 deployed artifact(s). Run "olam skills sync" first.'));
+      return;
+    }
+    const byBucket = /* @__PURE__ */ new Map();
+    for (const e of entries) {
+      const list = byBucket.get(e.bucket) ?? [];
+      list.push(e);
+      byBucket.set(e.bucket, list);
+    }
+    printHeader(`${entries.length} deployed artifact(s)`);
+    for (const [bucket, list] of byBucket.entries()) {
+      console.log(`  ${pc28.bold(bucket)} (${list.length})`);
+      for (const e of list) {
+        const src = e.sourceId ? `[${e.sourceId}]` : pc28.yellow("[unknown]");
+        console.log(`    ${e.name.padEnd(40)} ${pc28.dim(src)} \u2192 ${pc28.dim(e.target)}`);
       }
-    } catch (err) {
-      printError(asMessage2(err));
+    }
+  });
+  skills.command("show").description("Show details for a deployed artifact (by name)").argument("<name>", "Artifact name (e.g. plan-hard, codex-second-opinion.md)").action((name) => {
+    const entries = listDeployed();
+    const matches2 = entries.filter((e) => e.name === name);
+    if (matches2.length === 0) {
+      printError(`no deployed artifact matches "${name}"`);
       process.exitCode = 1;
+      return;
+    }
+    for (const e of matches2) {
+      console.log(`${pc28.bold("bucket:")}   ${e.bucket}`);
+      console.log(`${pc28.bold("name:")}     ${e.name}`);
+      console.log(`${pc28.bold("target:")}   ${e.target}`);
+      console.log(`${pc28.bold("source:")}   ${e.sourceId ?? pc28.dim("(unknown \u2014 not from a registered olam source)")}`);
+      console.log();
     }
   });
 }
@@ -28329,17 +29518,17 @@ function registerWorldUpgrade(program2) {
 
 // src/commands/mcp/serve.ts
 init_output();
-import { existsSync as existsSync52 } from "node:fs";
-import { dirname as dirname27, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync58 } from "node:fs";
+import { dirname as dirname28, resolve as resolve13 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
-var here = dirname27(fileURLToPath5(import.meta.url));
+var here = dirname28(fileURLToPath5(import.meta.url));
 var BUNDLE_PATH_CANDIDATES = [
   // bundled (`dist/index.js` after bundle-cli.mjs) — sibling
   resolve13(here, "mcp-server.js"),
   // dev / tsc-only (`dist/commands/mcp/serve.js`) — up two levels
   resolve13(here, "..", "..", "mcp-server.js")
 ];
-function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync52) {
+function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync58) {
   return candidates2.find(exists) ?? null;
 }
 var MISSING_BUNDLE_REMEDY = "olam mcp server bundle missing. Searched: " + BUNDLE_PATH_CANDIDATES.join(", ") + ". For local dev, run: node packages/cli/scripts/bundle-mcp-server.mjs. A fresh `npm install -g @pleri/olam-cli@latest` should always include the bundle (see prepublishOnly in packages/cli/package.json); file an issue if it does not.";
@@ -28496,8 +29685,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path60, init = {}) {
-  const res = await fetch(`${BASE_URL}${path60}`, {
+async function apiFetch(path66, init = {}) {
+  const res = await fetch(`${BASE_URL}${path66}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -28649,7 +29838,7 @@ function registerMcpAdd(cmd) {
 
 // src/commands/mcp/list.ts
 init_output();
-import pc27 from "picocolors";
+import pc29 from "picocolors";
 function registerMcpList(cmd) {
   cmd.command("list").description("List all registered MCP credentials").action(async () => {
     const client = getMcpAuthClient();
@@ -28664,8 +29853,8 @@ function registerMcpList(cmd) {
     }
     const mcps = data.mcps ?? [];
     if (mcps.length === 0) {
-      console.log(pc27.dim("No MCP credentials registered."));
-      console.log(pc27.dim("Add one with: olam mcp add <service>"));
+      console.log(pc29.dim("No MCP credentials registered."));
+      console.log(pc29.dim("Add one with: olam mcp add <service>"));
       return;
     }
     const [c0, c1, c2, c3] = [16, 20, 10, 24];
@@ -28676,12 +29865,12 @@ function registerMcpList(cmd) {
       "ENV VAR".padEnd(c3),
       "STATUS"
     ].join("  ");
-    console.log(pc27.dim(header));
-    console.log(pc27.dim("\u2500".repeat(header.length)));
+    console.log(pc29.dim(header));
+    console.log(pc29.dim("\u2500".repeat(header.length)));
     for (const m of mcps) {
-      const status2 = !m.validated ? pc27.yellow("unvalidated") : m.expired ? pc27.red("expired") : pc27.green("active");
+      const status2 = !m.validated ? pc29.yellow("unvalidated") : m.expired ? pc29.red("expired") : pc29.green("active");
       const row = [
-        pc27.cyan(m.service.padEnd(c0)),
+        pc29.cyan(m.service.padEnd(c0)),
         m.label.padEnd(c1).slice(0, c1),
         m.type.padEnd(c2),
         (m.envName ?? "\u2014").padEnd(c3).slice(0, c3),
@@ -28709,13 +29898,13 @@ function registerMcpRemove(cmd) {
 
 // src/commands/mcp/status.ts
 init_output();
-import pc28 from "picocolors";
+import pc30 from "picocolors";
 function formatExpiry(expiresAt) {
   if (!expiresAt) return "\u2014";
   const ms = expiresAt - Date.now();
-  if (ms <= 0) return pc28.red("expired");
+  if (ms <= 0) return pc30.red("expired");
   const hours = ms / (1e3 * 60 * 60);
-  if (hours < 1) return pc28.yellow(`${Math.ceil(ms / 6e4)}m`);
+  if (hours < 1) return pc30.yellow(`${Math.ceil(ms / 6e4)}m`);
   return `${hours.toFixed(1)}h`;
 }
 function registerMcpStatus(cmd) {
@@ -28732,14 +29921,14 @@ function registerMcpStatus(cmd) {
     const mcps = data.mcps ?? [];
     printHeader(`MCP Credentials (${mcps.length})`);
     if (mcps.length === 0) {
-      console.log(pc28.dim("No credentials registered."));
+      console.log(pc30.dim("No credentials registered."));
       return;
     }
     for (const m of mcps) {
-      const stateColor = !m.validated ? pc28.yellow : m.expired ? pc28.red : pc28.green;
+      const stateColor = !m.validated ? pc30.yellow : m.expired ? pc30.red : pc30.green;
       const stateLabel = !m.validated ? "unvalidated" : m.expired ? "expired" : "active";
       console.log(`
-  ${pc28.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
+  ${pc30.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
       console.log(`    label:      ${m.label}`);
       console.log(`    type:       ${m.type}`);
       if (m.envName) console.log(`    env var:    ${m.envName}`);
@@ -28754,15 +29943,15 @@ function registerMcpStatus(cmd) {
 // src/commands/mcp/import.ts
 init_output();
 import * as readline3 from "node:readline";
-import pc29 from "picocolors";
+import pc31 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs47 from "node:fs";
-import * as os27 from "node:os";
-import * as path51 from "node:path";
+import * as fs53 from "node:fs";
+import * as os31 from "node:os";
+import * as path57 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs47.readFileSync(filePath, "utf-8");
+    const raw = fs53.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -28791,24 +29980,24 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path51.join(os27.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path57.join(os31.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path51.join(os27.homedir(), "AppData", "Roaming");
-    return path51.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path57.join(os31.homedir(), "AppData", "Roaming");
+    return path57.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path51.join(os27.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path57.join(os31.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path51.join(os27.homedir(), ".olam", "config.yaml"),
-    path51.join(process.cwd(), ".olam", "config.yaml")
+    path57.join(os31.homedir(), ".olam", "config.yaml"),
+    path57.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs47.existsSync(configPath)) continue;
+    if (!fs53.existsSync(configPath)) continue;
     try {
-      const raw = fs47.readFileSync(configPath, "utf-8");
+      const raw = fs53.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -28824,7 +30013,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path51.join(os27.homedir(), ".claude.json"),
+      path: path57.join(os31.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -28832,19 +30021,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path51.join(os27.homedir(), ".cursor", "mcp.json"),
+      path: path57.join(os31.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path51.join(os27.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path57.join(os31.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path51.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path51.basename(repoPath)})`
+      path: path57.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path57.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -28924,13 +30113,13 @@ async function validateMcpEntry(entry) {
 // src/commands/mcp/import.ts
 async function multiSelectPicker(entries) {
   if (entries.length === 0) return [];
-  console.log("\n" + pc29.bold("Discovered MCP servers:"));
+  console.log("\n" + pc31.bold("Discovered MCP servers:"));
   entries.forEach((e, i) => {
     console.log(
-      `  ${pc29.dim(`[${i + 1}]`)} ${pc29.cyan(e.name.padEnd(20))} ${pc29.dim(e.sourceLabel)}`
+      `  ${pc31.dim(`[${i + 1}]`)} ${pc31.cyan(e.name.padEnd(20))} ${pc31.dim(e.sourceLabel)}`
     );
   });
-  console.log("\n" + pc29.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
+  console.log("\n" + pc31.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
   const answer = await new Promise((resolve15) => {
     const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("> ", (ans) => {
@@ -28957,7 +30146,7 @@ function registerMcpImport(cmd) {
     const repoPaths = opts.repoPaths ? opts.repoPaths.split(",").map((s) => s.trim()) : void 0;
     const { entries, sources, durationMs } = await discoverMcpSources(repoPaths);
     if (entries.length === 0) {
-      console.log(pc29.dim("No MCP servers found in any source path."));
+      console.log(pc31.dim("No MCP servers found in any source path."));
       return;
     }
     printInfo("Sources", sources.length > 0 ? sources.join(", ") : "none");
@@ -28970,15 +30159,15 @@ function registerMcpImport(cmd) {
       candidates2 = filtered;
     }
     if (skippedCount > 0) {
-      console.log(pc29.dim(`skipped: ${skippedCount} already registered`));
+      console.log(pc31.dim(`skipped: ${skippedCount} already registered`));
     }
     if (candidates2.length === 0) {
-      console.log(pc29.dim("Nothing new to import. Use --reimport to force."));
+      console.log(pc31.dim("Nothing new to import. Use --reimport to force."));
       return;
     }
     const selected = await multiSelectPicker(candidates2);
     if (selected.length === 0) {
-      console.log(pc29.dim("No servers selected."));
+      console.log(pc31.dim("No servers selected."));
       return;
     }
     console.log(`
@@ -28989,16 +30178,16 @@ Importing ${selected.length} server(s)\u2026`);
       let validated = false;
       let validationReason = "skipped";
       if (opts.validate !== false) {
-        process.stdout.write(`  ${pc29.dim("\u2192")} ${entry.name}  validating\u2026 `);
+        process.stdout.write(`  ${pc31.dim("\u2192")} ${entry.name}  validating\u2026 `);
         const vr = await validateMcpEntry(entry);
         validated = vr.validated;
         validationReason = vr.reason;
         process.stdout.write(
-          validated ? pc29.green("ok\n") : pc29.yellow(`unvalidated (${vr.reason})
+          validated ? pc31.green("ok\n") : pc31.yellow(`unvalidated (${vr.reason})
 `)
         );
       } else {
-        console.log(`  ${pc29.dim("\u2192")} ${entry.name}  ${pc29.dim("(validation skipped)")}`);
+        console.log(`  ${pc31.dim("\u2192")} ${entry.name}  ${pc31.dim("(validation skipped)")}`);
       }
       if (validated) validatedCount++;
       const result = await client.staticAdd({
@@ -29013,21 +30202,21 @@ Importing ${selected.length} server(s)\u2026`);
       }
     }
     console.log("");
-    console.log(pc29.green(`\u2713 Imported ${importedCount}/${selected.length}`));
+    console.log(pc31.green(`\u2713 Imported ${importedCount}/${selected.length}`));
     if (validatedCount > 0) {
-      console.log(pc29.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
+      console.log(pc31.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
     }
   });
 }
 
 // src/commands/mcp/revoke.ts
 init_output();
-import pc30 from "picocolors";
+import pc32 from "picocolors";
 function registerMcpRevoke(cmd) {
   cmd.command("revoke <user> <world> <service>").description("Revoke a user's MCP service entitlement (multi-tenant mode only)").action(async (user, world, service) => {
     const multiTenant = (process.env["OLAM_MCP_MULTI_TENANT"] ?? "").toLowerCase() === "true";
     if (!multiTenant) {
-      console.warn(pc30.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
+      console.warn(pc32.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
       return;
     }
     const baseUrl = process.env["OLAM_MCP_AUTH_SERVICE_URL"] ?? "http://127.0.0.1:9998";
@@ -29056,8 +30245,8 @@ function registerMcpRevoke(cmd) {
       process.exitCode = 1;
       return;
     }
-    console.log(pc30.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
-    console.log(pc30.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
+    console.log(pc32.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
+    console.log(pc32.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
   });
 }
 
@@ -29079,34 +30268,34 @@ function registerMcp(program2) {
 // src/commands/memory/start.ts
 init_output();
 import { spawn as spawn8 } from "node:child_process";
-import { existsSync as existsSync54, mkdirSync as mkdirSync31, openSync as openSync3, readFileSync as readFileSync38, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join52 } from "node:path";
+import { existsSync as existsSync60, mkdirSync as mkdirSync34, openSync as openSync3, readFileSync as readFileSync41, writeFileSync as writeFileSync25 } from "node:fs";
+import { join as join58 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/commands/memory/_paths.ts
-import { homedir as homedir30 } from "node:os";
-import { join as join51, dirname as dirname28 } from "node:path";
+import { homedir as homedir34 } from "node:os";
+import { join as join57, dirname as dirname29 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
-var OLAM_HOME = join51(homedir30(), ".olam");
-var OLAM_BIN_DIR = join51(OLAM_HOME, "bin");
-var III_BINARY_PATH = join51(OLAM_BIN_DIR, "iii");
-var MEMORY_PID_PATH = join51(OLAM_HOME, "memory.pid");
-var MEMORY_LOG_PATH = join51(OLAM_HOME, "memory-service.log");
-var MEMORY_DATA_DIR = join51(OLAM_HOME, "memory-data");
+var OLAM_HOME = join57(homedir34(), ".olam");
+var OLAM_BIN_DIR = join57(OLAM_HOME, "bin");
+var III_BINARY_PATH = join57(OLAM_BIN_DIR, "iii");
+var MEMORY_PID_PATH = join57(OLAM_HOME, "memory.pid");
+var MEMORY_LOG_PATH = join57(OLAM_HOME, "memory-service.log");
+var MEMORY_DATA_DIR = join57(OLAM_HOME, "memory-data");
 var MEMORY_REST_PORT = 3111;
 var MEMORY_LIVEZ_URL = `http://localhost:${MEMORY_REST_PORT}/agentmemory/livez`;
-var here2 = dirname28(fileURLToPath6(import.meta.url));
+var here2 = dirname29(fileURLToPath6(import.meta.url));
 var candidates = [
   // 1. Workspace dev (built): packages/cli/dist/commands/memory/_paths.js → packages/cli → packages/memory-service
-  join51(here2, "..", "..", "..", "..", "memory-service"),
+  join57(here2, "..", "..", "..", "..", "memory-service"),
   // 2a. Workspace bundled: packages/cli/dist/index.js → packages/cli → packages/memory-service
-  join51(here2, "..", "..", "memory-service"),
+  join57(here2, "..", "..", "memory-service"),
   // 2b. Published tarball: <prefix>/node_modules/@pleri/olam-cli/dist/index.js
   //     → <prefix>/node_modules/@pleri/olam-cli/memory-service-bundle
   //     (copied at publish time by bundle-cli.mjs)
-  join51(here2, "..", "memory-service-bundle"),
+  join57(here2, "..", "memory-service-bundle"),
   // 3. CWD fallback
-  join51(process.cwd(), "packages", "memory-service")
+  join57(process.cwd(), "packages", "memory-service")
 ];
 var MEMORY_SERVICE_CANDIDATES = candidates;
 
@@ -29115,7 +30304,7 @@ var READINESS_TIMEOUT_MS = 3e4;
 var READINESS_POLL_MS = 500;
 function resolveMemoryServiceDir() {
   for (const c of MEMORY_SERVICE_CANDIDATES) {
-    if (existsSync54(c)) return c;
+    if (existsSync60(c)) return c;
   }
   throw new Error(
     `Could not find packages/memory-service/. Searched: ${MEMORY_SERVICE_CANDIDATES.join(", ")}. If running from a published @pleri/olam-cli tarball, this is a packaging bug \u2014 please file an issue.`
@@ -29123,12 +30312,12 @@ function resolveMemoryServiceDir() {
 }
 function resolveAgentMemoryBin(serviceDir) {
   const candidates2 = [
-    join52(serviceDir, "node_modules", ".bin", "agentmemory"),
-    join52(serviceDir, "..", "..", "node_modules", ".bin", "agentmemory"),
-    join52(serviceDir, "..", "..", "..", "node_modules", ".bin", "agentmemory")
+    join58(serviceDir, "node_modules", ".bin", "agentmemory"),
+    join58(serviceDir, "..", "..", "node_modules", ".bin", "agentmemory"),
+    join58(serviceDir, "..", "..", "..", "node_modules", ".bin", "agentmemory")
   ];
   for (const c of candidates2) {
-    if (existsSync54(c)) return c;
+    if (existsSync60(c)) return c;
   }
   throw new Error(
     `Could not find agentmemory bin. Searched: ${candidates2.join(", ")}. Run 'npm install' from the repo root.`
@@ -29143,8 +30332,8 @@ function isProcessAlive(pid) {
   }
 }
 function readPidFromFile() {
-  if (!existsSync54(MEMORY_PID_PATH)) return null;
-  const raw = readFileSync38(MEMORY_PID_PATH, "utf8").trim();
+  if (!existsSync60(MEMORY_PID_PATH)) return null;
+  const raw = readFileSync41(MEMORY_PID_PATH, "utf8").trim();
   const pid = parseInt(raw, 10);
   if (!Number.isFinite(pid) || pid <= 0) return null;
   return pid;
@@ -29171,7 +30360,7 @@ async function waitForReady(secret) {
   return false;
 }
 async function autoEnsureIiiBinary(serviceDir) {
-  const helperPath = join52(serviceDir, "scripts", "ensure-iii-engine.mjs");
+  const helperPath = join58(serviceDir, "scripts", "ensure-iii-engine.mjs");
   const mod = await import(pathToFileURL(helperPath).href);
   const result = await mod.ensureIiiEngine();
   if (!result.ok) {
@@ -29187,7 +30376,7 @@ async function runMemoryStart() {
     printError(err instanceof Error ? err.message : String(err));
     return 1;
   }
-  if (!existsSync54(III_BINARY_PATH)) {
+  if (!existsSync60(III_BINARY_PATH)) {
     printInfo("iii binary", `missing at ${III_BINARY_PATH} \u2014 auto-fetching v0.11.2`);
     try {
       await autoEnsureIiiBinary(serviceDir);
@@ -29215,8 +30404,8 @@ async function runMemoryStart() {
     );
     return 1;
   }
-  mkdirSync31(OLAM_HOME, { recursive: true });
-  mkdirSync31(MEMORY_DATA_DIR, { recursive: true });
+  mkdirSync34(OLAM_HOME, { recursive: true });
+  mkdirSync34(MEMORY_DATA_DIR, { recursive: true });
   const logFd = openSync3(MEMORY_LOG_PATH, "a");
   const child = spawn8(agentmemoryBin, [], {
     cwd: OLAM_HOME,
@@ -29239,7 +30428,7 @@ async function runMemoryStart() {
     printError("spawn returned no pid (process failed to start)");
     return 1;
   }
-  writeFileSync24(MEMORY_PID_PATH, `${child.pid}
+  writeFileSync25(MEMORY_PID_PATH, `${child.pid}
 `, { mode: 420 });
   printInfo("pid", `${child.pid}`);
   printInfo("readiness", `polling ${MEMORY_LIVEZ_URL}`);
@@ -29262,7 +30451,7 @@ function registerMemoryStart(cmd) {
 
 // src/commands/memory/stop.ts
 init_output();
-import { existsSync as existsSync55, readFileSync as readFileSync39, unlinkSync as unlinkSync9 } from "node:fs";
+import { existsSync as existsSync61, readFileSync as readFileSync42, unlinkSync as unlinkSync11 } from "node:fs";
 var SIGTERM_GRACE_MS = 1e4;
 var POLL_MS = 250;
 function isAlive(pid) {
@@ -29275,19 +30464,19 @@ function isAlive(pid) {
 }
 async function runMemoryStop() {
   printHeader("olam memory stop");
-  if (!existsSync55(MEMORY_PID_PATH)) {
+  if (!existsSync61(MEMORY_PID_PATH)) {
     printSuccess("no pidfile present (nothing to stop)");
     return 0;
   }
-  const pid = parseInt(readFileSync39(MEMORY_PID_PATH, "utf8").trim(), 10);
+  const pid = parseInt(readFileSync42(MEMORY_PID_PATH, "utf8").trim(), 10);
   if (!Number.isFinite(pid) || pid <= 0) {
     printWarning(`pidfile contained invalid value; removing`);
-    unlinkSync9(MEMORY_PID_PATH);
+    unlinkSync11(MEMORY_PID_PATH);
     return 0;
   }
   if (!isAlive(pid)) {
     printSuccess(`pid ${pid} is not running (stale pidfile); cleaned up`);
-    unlinkSync9(MEMORY_PID_PATH);
+    unlinkSync11(MEMORY_PID_PATH);
     return 0;
   }
   printInfo("pid", `${pid}`);
@@ -29310,8 +30499,8 @@ async function runMemoryStop() {
     }
     await new Promise((r) => setTimeout(r, 500));
   }
-  if (existsSync55(MEMORY_PID_PATH)) {
-    unlinkSync9(MEMORY_PID_PATH);
+  if (existsSync61(MEMORY_PID_PATH)) {
+    unlinkSync11(MEMORY_PID_PATH);
   }
   printSuccess(`stopped (pid ${pid})`);
   return 0;
@@ -29325,7 +30514,7 @@ function registerMemoryStop(cmd) {
 
 // src/commands/memory/status.ts
 init_output();
-import { existsSync as existsSync56, readFileSync as readFileSync40 } from "node:fs";
+import { existsSync as existsSync62, readFileSync as readFileSync43 } from "node:fs";
 function isAlive2(pid) {
   try {
     process.kill(pid, 0);
@@ -29349,8 +30538,8 @@ async function probe(secret) {
 }
 async function collectMemoryStatus() {
   let pid = null;
-  if (existsSync56(MEMORY_PID_PATH)) {
-    const raw = readFileSync40(MEMORY_PID_PATH, "utf8").trim();
+  if (existsSync62(MEMORY_PID_PATH)) {
+    const raw = readFileSync43(MEMORY_PID_PATH, "utf8").trim();
     const parsed = parseInt(raw, 10);
     pid = Number.isFinite(parsed) && parsed > 0 ? parsed : null;
   }
@@ -29362,7 +30551,7 @@ async function collectMemoryStatus() {
     alive,
     livez,
     secretSet: hasMemorySecret(),
-    iiiBinary: existsSync56(III_BINARY_PATH) ? III_BINARY_PATH : null,
+    iiiBinary: existsSync62(III_BINARY_PATH) ? III_BINARY_PATH : null,
     port: MEMORY_REST_PORT
   };
 }
@@ -29405,10 +30594,10 @@ function registerMemoryStatus(cmd) {
 
 // src/commands/memory/logs.ts
 init_output();
-import { existsSync as existsSync57 } from "node:fs";
+import { existsSync as existsSync63 } from "node:fs";
 import { spawn as spawn9 } from "node:child_process";
 async function runMemoryLogs(opts) {
-  if (!existsSync57(MEMORY_LOG_PATH)) {
+  if (!existsSync63(MEMORY_LOG_PATH)) {
     printWarning(`no log at ${MEMORY_LOG_PATH} (start the service first via 'olam memory start')`);
     return 1;
   }
@@ -29434,7 +30623,7 @@ function registerMemoryLogs(cmd) {
 }
 
 // src/commands/memory/secret.ts
-import { existsSync as existsSync58 } from "node:fs";
+import { existsSync as existsSync64 } from "node:fs";
 init_output();
 async function runMemorySecretShow() {
   if (!hasMemorySecret()) {
@@ -29449,7 +30638,7 @@ async function runMemorySecretShow() {
 }
 async function runMemorySecretRotate() {
   printHeader("olam memory secret rotate");
-  const wasRunning = existsSync58(MEMORY_PID_PATH);
+  const wasRunning = existsSync64(MEMORY_PID_PATH);
   if (wasRunning) {
     printInfo("current state", "service running; will restart with new secret");
     const stopRc = await runMemoryStop();
@@ -29631,14 +30820,14 @@ function registerMemoryUninstall(cmd) {
 // src/commands/memory/mode.ts
 init_schema2();
 init_output();
-import { existsSync as existsSync59, readFileSync as readFileSync41, writeFileSync as writeFileSync25 } from "node:fs";
-import { join as join53 } from "node:path";
+import { existsSync as existsSync65, readFileSync as readFileSync44, writeFileSync as writeFileSync26 } from "node:fs";
+import { join as join59 } from "node:path";
 import * as readline4 from "node:readline/promises";
 import { parse as parseYaml6, stringify as stringifyYaml6 } from "yaml";
 var CONFIG_REL = ".olam/config.yaml";
 function locateConfig(cwd) {
-  const absPath = join53(cwd, CONFIG_REL);
-  if (!existsSync59(absPath)) {
+  const absPath = join59(cwd, CONFIG_REL);
+  if (!existsSync65(absPath)) {
     throw new Error(
       `No ${CONFIG_REL} at ${cwd}. Run \`olam init\` in your workspace root first.`
     );
@@ -29646,7 +30835,7 @@ function locateConfig(cwd) {
   return { absPath };
 }
 function readConfigYaml(absPath) {
-  const raw = readFileSync41(absPath, "utf-8");
+  const raw = readFileSync44(absPath, "utf-8");
   const parsed = parseYaml6(raw) ?? {};
   if (typeof parsed !== "object" || parsed === null) {
     throw new Error(`${absPath} is not a YAML object`);
@@ -29655,7 +30844,7 @@ function readConfigYaml(absPath) {
 }
 function writeConfigYaml(absPath, parsed) {
   const out = stringifyYaml6(parsed, { aliasDuplicateObjects: false });
-  writeFileSync25(absPath, out, "utf-8");
+  writeFileSync26(absPath, out, "utf-8");
 }
 async function defaultPromptText(question) {
   const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -29771,10 +30960,371 @@ function registerMemoryMode(cmd) {
   });
 }
 
+// src/commands/memory/bridge.ts
+init_output();
+import { spawn as spawn10 } from "node:child_process";
+import { existsSync as existsSync66 } from "node:fs";
+import { join as join60 } from "node:path";
+var DEFAULT_PORT2 = 8788;
+function resolveMemoryServiceDir2() {
+  for (const c of MEMORY_SERVICE_CANDIDATES) {
+    if (existsSync66(c)) return c;
+  }
+  throw new Error(
+    `Could not find packages/memory-service/. Searched: ${MEMORY_SERVICE_CANDIDATES.join(", ")}. If running from a published @pleri/olam-cli tarball, this is a packaging bug \u2014 please file an issue.`
+  );
+}
+function resolveLocalBridgeScript(serviceDir) {
+  const path66 = join60(serviceDir, "scripts", "local-bridge-server.mjs");
+  if (!existsSync66(path66)) {
+    throw new Error(
+      `Could not find local-bridge-server.mjs at ${path66}. Verify packages/memory-service ships the scripts/ directory.`
+    );
+  }
+  return path66;
+}
+function validateBridgeOpts(opts) {
+  const local = opts.local ?? false;
+  if (!local) {
+    throw new Error(
+      `'olam memory bridge serve' currently requires --local. Remote-bridge orchestration is reserved for future flags.`
+    );
+  }
+  const port2 = opts.port ?? DEFAULT_PORT2;
+  if (!Number.isInteger(port2) || port2 < 0 || port2 > 65535) {
+    throw new Error(`--port must be an integer 0..65535 (got: ${opts.port})`);
+  }
+  const result = {
+    port: port2,
+    local
+  };
+  if (typeof opts.persistTo === "string" && opts.persistTo.length > 0) {
+    result.persistTo = opts.persistTo;
+  }
+  return result;
+}
+async function runBridgeServe(opts, deps = {}) {
+  printHeader("olam memory bridge serve --local");
+  const validated = validateBridgeOpts(opts);
+  printInfo("port", String(validated.port));
+  if (validated.persistTo) {
+    printInfo("persist-to", validated.persistTo);
+  } else {
+    printInfo("persist-to", "(in-memory \u2014 DO state lost on restart)");
+  }
+  const serviceDir = (deps.resolveServiceDir ?? resolveMemoryServiceDir2)();
+  const scriptPath = resolveLocalBridgeScript(serviceDir);
+  printInfo("entry", scriptPath);
+  const secret = (deps.ensureSecret ?? ensureMemorySecret)();
+  const args = ["--port", String(validated.port)];
+  if (validated.persistTo) {
+    args.push("--persist-to", validated.persistTo);
+  }
+  const env = {
+    ...process.env,
+    AGENTMEMORY_SECRET: secret
+  };
+  const spawner = deps.spawnChild ?? ((command, spawnArgs, spawnEnv) => spawn10(command, [...spawnArgs], {
+    env: spawnEnv,
+    stdio: "inherit"
+  }));
+  const child = spawner(process.execPath, [scriptPath, ...args], env);
+  return new Promise((resolve15) => {
+    let resolved = false;
+    const finish = (code) => {
+      if (resolved) return;
+      resolved = true;
+      resolve15(code);
+    };
+    const forward = (signal) => () => {
+      if (!child.killed) {
+        try {
+          child.kill(signal);
+        } catch {
+        }
+      }
+    };
+    process.on("SIGTERM", forward("SIGTERM"));
+    process.on("SIGINT", forward("SIGINT"));
+    child.on("error", (err) => {
+      printError(`failed to spawn local-bridge-server.mjs: ${err.message}`);
+      finish(1);
+    });
+    child.on("exit", (code, signal) => {
+      if (signal) {
+        finish(0);
+      } else {
+        finish(code ?? 1);
+      }
+    });
+  });
+}
+function registerMemoryBridge(cmd) {
+  const bridge = cmd.command("bridge").description("Local bridge service (Miniflare-embedded) for the agent-memory engine");
+  bridge.command("serve").description(
+    "Run the agent-memory bridge as a foreground Node process (suitable for systemd/launchd)"
+  ).option("--local", "Use the embedded Miniflare runtime (currently required)").option("--port <n>", "TCP port to bind on", (v) => parseInt(v, 10), DEFAULT_PORT2).option("--persist-to <path>", "DO SQLite persistence directory").action(async (opts) => {
+    try {
+      const rc = await runBridgeServe(opts);
+      if (rc !== 0) process.exitCode = rc;
+    } catch (err) {
+      printError(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/memory/reclassify.ts
+init_output();
+var DEFAULT_BRIDGE_URL = "https://olam-agent-memory.ernestcodes.workers.dev";
+var RECLASSIFY_TIMEOUT_MS = 1e4;
+function validateReclassifyOptions(opts) {
+  const hasHash = typeof opts.contentHash === "string" && opts.contentHash.length > 0;
+  const hasVersion = typeof opts.sinceVersion === "string" && opts.sinceVersion.length > 0;
+  if (!hasHash && !hasVersion) {
+    return "must specify one of --content-hash or --since-version";
+  }
+  if (hasHash && hasVersion) {
+    return "--content-hash and --since-version are mutually exclusive";
+  }
+  if (hasHash && !/^sha256:[0-9a-f]{64}$/.test(opts.contentHash)) {
+    return "--content-hash must be sha256:<64hex>";
+  }
+  return null;
+}
+function resolveBridgeUrl(opts) {
+  return opts.bridgeUrl ?? process.env["AGENTMEMORY_BRIDGE_URL"] ?? DEFAULT_BRIDGE_URL;
+}
+function resolveBearer(opts) {
+  const fromOpt = opts.bearer;
+  if (fromOpt && fromOpt.length > 0) return fromOpt;
+  const fromEnv = process.env["AGENTMEMORY_BRIDGE_SECRET"];
+  if (fromEnv && fromEnv.length > 0) return fromEnv;
+  return null;
+}
+async function runReclassify(opts, fetchImpl = fetch) {
+  const validationError = validateReclassifyOptions(opts);
+  if (validationError) {
+    return { ok: false, busted: 0, mode: opts.contentHash ? "hash" : "version", error: validationError };
+  }
+  if (opts.dryRun) {
+    return {
+      ok: true,
+      busted: 0,
+      mode: "dry-run"
+    };
+  }
+  const bridgeUrl = resolveBridgeUrl(opts);
+  const bearer = resolveBearer(opts);
+  if (!bearer) {
+    return {
+      ok: false,
+      busted: 0,
+      mode: opts.contentHash ? "hash" : "version",
+      error: "AGENTMEMORY_BRIDGE_SECRET not set (or --bearer not passed)"
+    };
+  }
+  const body = opts.contentHash ? { content_hash: opts.contentHash } : { since_version: opts.sinceVersion };
+  try {
+    const res = await fetchImpl(`${bridgeUrl}/classify/cache-bust`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${bearer}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(RECLASSIFY_TIMEOUT_MS)
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      return {
+        ok: false,
+        busted: 0,
+        mode: opts.contentHash ? "hash" : "version",
+        error: `bridge returned ${res.status} ${res.statusText}${detail ? `: ${detail.slice(0, 200)}` : ""}`
+      };
+    }
+    const payload = await res.json();
+    return {
+      ok: true,
+      busted: payload.busted,
+      mode: payload.mode,
+      memoryId: payload.memoryId
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      busted: 0,
+      mode: opts.contentHash ? "hash" : "version",
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function runReclassifyCli(opts) {
+  const result = await runReclassify(opts);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return result.ok ? 0 : 1;
+  }
+  printHeader("olam memory reclassify");
+  if (opts.contentHash) {
+    printInfo("content-hash", opts.contentHash);
+  }
+  if (opts.sinceVersion) {
+    printInfo("since-version", opts.sinceVersion);
+  }
+  printInfo("mode", result.mode);
+  if (opts.dryRun) {
+    printInfo("dry-run", "no HTTP call made");
+    return 0;
+  }
+  if (!result.ok) {
+    printError(`reclassify failed: ${result.error ?? "(unknown error)"}`);
+    return 1;
+  }
+  if (result.busted === 0) {
+    printWarning(`no rows busted (hash not in cache OR no rows matched the version)`);
+  } else {
+    printInfo("busted", `${result.busted}`);
+    if (result.memoryId) {
+      printInfo("memory-id", result.memoryId);
+    }
+  }
+  return 0;
+}
+function registerMemoryReclassify(cmd) {
+  cmd.command("reclassify").description(
+    "Bust the bridge classifier cache (single entry by content hash OR bulk by classifier_version) so the next batch re-runs the LLM"
+  ).option("--content-hash <hash>", "Bust one entry by sha256:<64hex> content hash").option("--since-version <version>", 'Bulk bust by classifier_version (e.g. "haiku-v1+prompt-v1")').option("--dry-run", "Show what would be busted without calling the bridge", false).option("--bridge-url <url>", "Override AGENTMEMORY_BRIDGE_URL").option("--bearer <token>", "Override AGENTMEMORY_BRIDGE_SECRET").option("--json", "Machine-readable JSON output", false).action(async (opts) => {
+    const rc = await runReclassifyCli(opts);
+    if (rc !== 0) process.exitCode = rc;
+  });
+}
+
+// src/commands/memory/stats.ts
+init_output();
+var DEFAULT_BRIDGE_URL2 = "https://olam-agent-memory.ernestcodes.workers.dev";
+var STATS_TIMEOUT_MS = 1e4;
+function computeCacheErrorRate(counters) {
+  if (counters.writes_observed <= 0) return 0;
+  const busted = counters.cache_busted_hash + counters.cache_busted_version;
+  return busted / counters.writes_observed;
+}
+function resolveBridgeUrl2(opts) {
+  return opts.bridgeUrl ?? process.env["AGENTMEMORY_BRIDGE_URL"] ?? DEFAULT_BRIDGE_URL2;
+}
+function resolveBearer2(opts) {
+  const fromOpt = opts.bearer;
+  if (fromOpt && fromOpt.length > 0) return fromOpt;
+  const fromEnv = process.env["AGENTMEMORY_BRIDGE_SECRET"];
+  if (fromEnv && fromEnv.length > 0) return fromEnv;
+  return null;
+}
+function intOrZero(v) {
+  if (typeof v !== "number" || !Number.isFinite(v)) return 0;
+  return Math.trunc(v);
+}
+function extractCounters(stats) {
+  return {
+    writes_observed: intOrZero(stats.classifier_writes_observed),
+    writes_deduped_hash: intOrZero(stats.classifier_writes_deduped_hash),
+    writes_deduped_semantic: intOrZero(stats.classifier_writes_deduped_semantic),
+    recalls_observed: intOrZero(stats.classifier_recalls_observed),
+    cache_busted_hash: intOrZero(stats.classifier_cache_busted_hash),
+    cache_busted_version: intOrZero(stats.classifier_cache_busted_version)
+  };
+}
+async function runStats(opts, fetchImpl = fetch) {
+  const bridgeUrl = resolveBridgeUrl2(opts);
+  const bearer = resolveBearer2(opts);
+  if (!bearer) {
+    return {
+      ok: false,
+      error: "AGENTMEMORY_BRIDGE_SECRET not set (or --bearer not passed)"
+    };
+  }
+  try {
+    const res = await fetchImpl(`${bridgeUrl}/bridge/stats`, {
+      method: "GET",
+      headers: {
+        authorization: `Bearer ${bearer}`
+      },
+      signal: AbortSignal.timeout(STATS_TIMEOUT_MS)
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      return {
+        ok: false,
+        error: `bridge returned ${res.status} ${res.statusText}${detail ? `: ${detail.slice(0, 200)}` : ""}`
+      };
+    }
+    const payload = await res.json();
+    if (!payload || typeof payload !== "object" || !payload.stats || typeof payload.stats !== "object") {
+      return {
+        ok: false,
+        error: "bridge response missing stats envelope"
+      };
+    }
+    const counters = extractCounters(payload.stats);
+    const cacheErrorRate = computeCacheErrorRate(counters);
+    return {
+      ok: true,
+      counters,
+      cacheErrorRate,
+      raw: payload
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function formatPct(numerator, denominator) {
+  if (denominator <= 0) return "0.0%";
+  return `${(numerator / denominator * 100).toFixed(1)}%`;
+}
+async function runStatsCli(opts) {
+  const result = await runStats(opts);
+  if (opts.json) {
+    const out = result.ok && result.raw !== void 0 ? result.raw : result;
+    process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+    return result.ok ? 0 : 1;
+  }
+  printHeader("olam memory stats \u2014 bridge counters");
+  if (!result.ok) {
+    printError(`stats failed: ${result.error ?? "(unknown error)"}`);
+    return 1;
+  }
+  const c = result.counters;
+  printInfo("writes_observed", String(c.writes_observed));
+  printInfo(
+    "writes_deduped_hash",
+    `${c.writes_deduped_hash}  (${formatPct(c.writes_deduped_hash, c.writes_observed)})`
+  );
+  printInfo(
+    "writes_deduped_semantic",
+    `${c.writes_deduped_semantic}  (${formatPct(c.writes_deduped_semantic, c.writes_observed)})`
+  );
+  printInfo("recalls_observed", String(c.recalls_observed));
+  printInfo("cache_busted_hash", String(c.cache_busted_hash));
+  printInfo("cache_busted_version", String(c.cache_busted_version));
+  printInfo("cache_error_rate", `${(result.cacheErrorRate * 100).toFixed(1)}%`);
+  return 0;
+}
+function registerMemoryStats(cmd) {
+  cmd.command("stats").description(
+    "Fetch /bridge/stats from the agent-memory bridge and format classifier counters (writes_observed, dedup rates, recalls, cache busts, derived cache_error_rate)"
+  ).option("--bridge-url <url>", "Override AGENTMEMORY_BRIDGE_URL").option("--bearer <token>", "Override AGENTMEMORY_BRIDGE_SECRET").option("--json", "Machine-readable JSON output (raw bridge envelope)", false).action(async (opts) => {
+    const rc = await runStatsCli(opts);
+    if (rc !== 0) process.exitCode = rc;
+  });
+}
+
 // src/commands/memory/index.ts
 function registerMemory(program2) {
   const memory = program2.command("memory").description(
-    "Host-process agent-memory service for the olam fleet (start, stop, status, logs, secret, install, uninstall)"
+    "Host-process agent-memory service for the olam fleet (start, stop, status, logs, secret, install, uninstall, bridge, reclassify, stats)"
   );
   registerMemoryStart(memory);
   registerMemoryStop(memory);
@@ -29784,14 +31334,17 @@ function registerMemory(program2) {
   registerMemoryInstall(memory);
   registerMemoryUninstall(memory);
   registerMemoryMode(memory);
+  registerMemoryBridge(memory);
+  registerMemoryReclassify(memory);
+  registerMemoryStats(memory);
 }
 
 // src/commands/kg-build.ts
 init_storage_paths();
 init_workspace_name();
-import * as fs53 from "node:fs";
-import * as os30 from "node:os";
-import * as path57 from "node:path";
+import * as fs59 from "node:fs";
+import * as os34 from "node:os";
+import * as path63 from "node:path";
 
 // ../core/dist/kg/kg-service-client.js
 var KG_SERVICE_PORT_DEFAULT = 9997;
@@ -29802,8 +31355,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path60) {
-  return `http://127.0.0.1:${port()}${path60}`;
+function url(path66) {
+  return `http://127.0.0.1:${port()}${path66}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -29881,40 +31434,40 @@ init_output();
 // src/commands/kg-status.ts
 init_storage_paths();
 init_workspace_name();
-import fs48 from "node:fs";
-import { homedir as homedir31 } from "node:os";
-import path52 from "node:path";
+import fs54 from "node:fs";
+import { homedir as homedir35 } from "node:os";
+import path58 from "node:path";
 init_output();
 function olamHome4() {
-  return process.env.OLAM_HOME ?? path52.join(homedir31(), ".olam");
+  return process.env.OLAM_HOME ?? path58.join(homedir35(), ".olam");
 }
 function kgRoot2() {
-  return path52.join(olamHome4(), "kg");
+  return path58.join(olamHome4(), "kg");
 }
 function worldsRoot2() {
-  return path52.join(olamHome4(), "worlds");
+  return path58.join(olamHome4(), "worlds");
 }
 function dirSizeBytes2(dir) {
-  if (!fs48.existsSync(dir)) return 0;
+  if (!fs54.existsSync(dir)) return 0;
   let total = 0;
   const stack = [dir];
   while (stack.length > 0) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs48.readdirSync(cur, { withFileTypes: true });
+      entries = fs54.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const full = path52.join(cur, entry.name);
+      const full = path58.join(cur, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
       }
       try {
-        total += fs48.statSync(full).size;
+        total += fs54.statSync(full).size;
       } catch {
       }
     }
@@ -29928,10 +31481,10 @@ function formatBytes5(n) {
   return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 function readFreshness(workspace) {
-  const file = path52.join(kgPristinePath(workspace), "freshness.json");
-  if (!fs48.existsSync(file)) return null;
+  const file = path58.join(kgPristinePath(workspace), "freshness.json");
+  if (!fs54.existsSync(file)) return null;
   try {
-    const raw = JSON.parse(fs48.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs54.readFileSync(file, "utf-8"));
     if (raw && typeof raw === "object") return raw;
     return null;
   } catch {
@@ -29939,10 +31492,10 @@ function readFreshness(workspace) {
   }
 }
 function readOverlayNodeCount(graphifyOutDir) {
-  const graphPath = path52.join(graphifyOutDir, "graph.json");
-  if (!fs48.existsSync(graphPath)) return null;
+  const graphPath = path58.join(graphifyOutDir, "graph.json");
+  if (!fs54.existsSync(graphPath)) return null;
   try {
-    const raw = JSON.parse(fs48.readFileSync(graphPath, "utf-8"));
+    const raw = JSON.parse(fs54.readFileSync(graphPath, "utf-8"));
     if (raw && typeof raw === "object") {
       const nodes = raw.nodes;
       if (Array.isArray(nodes)) return nodes.length;
@@ -29954,28 +31507,28 @@ function readOverlayNodeCount(graphifyOutDir) {
 }
 function listOverlays() {
   const root = worldsRoot2();
-  if (!fs48.existsSync(root)) return [];
+  if (!fs54.existsSync(root)) return [];
   const records = [];
   let worldDirs;
   try {
-    worldDirs = fs48.readdirSync(root, { withFileTypes: true });
+    worldDirs = fs54.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
   for (const worldEntry of worldDirs) {
     if (!worldEntry.isDirectory()) continue;
     const worldId = worldEntry.name;
-    const worldDir = path52.join(root, worldId);
+    const worldDir = path58.join(root, worldId);
     let cloneDirs;
     try {
-      cloneDirs = fs48.readdirSync(worldDir, { withFileTypes: true });
+      cloneDirs = fs54.readdirSync(worldDir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const cloneEntry of cloneDirs) {
       if (!cloneEntry.isDirectory()) continue;
-      const graphifyOut = path52.join(worldDir, cloneEntry.name, "graphify-out");
-      if (!fs48.existsSync(graphifyOut)) continue;
+      const graphifyOut = path58.join(worldDir, cloneEntry.name, "graphify-out");
+      if (!fs54.existsSync(graphifyOut)) continue;
       records.push({
         world_id: worldId,
         clone_dir: cloneEntry.name,
@@ -29989,11 +31542,11 @@ function listOverlays() {
 }
 function listPristines(overlays) {
   const root = kgRoot2();
-  if (!fs48.existsSync(root)) return [];
+  if (!fs54.existsSync(root)) return [];
   const records = [];
   let entries;
   try {
-    entries = fs48.readdirSync(root, { withFileTypes: true });
+    entries = fs54.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -30006,7 +31559,7 @@ function listPristines(overlays) {
       continue;
     }
     const fresh = readFreshness(workspace);
-    const graphifyOut = path52.join(kgPristinePath(workspace), "graphify-out");
+    const graphifyOut = path58.join(kgPristinePath(workspace), "graphify-out");
     const size = dirSizeBytes2(graphifyOut);
     const worldCount = overlays.filter((o) => o.clone_dir === workspace).length;
     records.push({
@@ -30141,11 +31694,11 @@ function registerKgStatusCommand(kg) {
 init_storage_paths();
 init_workspace_name();
 init_output();
-import { spawn as spawn10 } from "node:child_process";
-import fs49 from "node:fs";
-import path53 from "node:path";
+import { spawn as spawn11 } from "node:child_process";
+import fs55 from "node:fs";
+import path59 from "node:path";
 function pidFilePath(workspace) {
-  return path53.join(kgPristinePath(workspace), ".watch.pid");
+  return path59.join(kgPristinePath(workspace), ".watch.pid");
 }
 function isPidAlive3(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -30160,39 +31713,39 @@ function isPidAlive3(pid) {
 }
 function readAndClassifyPid(workspace) {
   const file = pidFilePath(workspace);
-  if (!fs49.existsSync(file)) return { status: "no-pidfile", pid: null };
+  if (!fs55.existsSync(file)) return { status: "no-pidfile", pid: null };
   let pid;
   try {
-    const raw = fs49.readFileSync(file, "utf-8").trim();
+    const raw = fs55.readFileSync(file, "utf-8").trim();
     pid = Number.parseInt(raw, 10);
   } catch {
-    fs49.rmSync(file, { force: true });
+    fs55.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (!Number.isInteger(pid) || pid <= 0) {
-    fs49.rmSync(file, { force: true });
+    fs55.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (isPidAlive3(pid)) return { status: "active", pid };
-  fs49.rmSync(file, { force: true });
+  fs55.rmSync(file, { force: true });
   return { status: "stale-reclaimed", pid: null };
 }
 function writePidFile(workspace, pid) {
   const file = pidFilePath(workspace);
-  const dir = path53.dirname(file);
-  fs49.mkdirSync(dir, { recursive: true });
-  fs49.writeFileSync(file, String(pid), { encoding: "utf-8" });
+  const dir = path59.dirname(file);
+  fs55.mkdirSync(dir, { recursive: true });
+  fs55.writeFileSync(file, String(pid), { encoding: "utf-8" });
 }
 function removePidFile(workspace) {
   const file = pidFilePath(workspace);
   try {
-    fs49.rmSync(file, { force: true });
+    fs55.rmSync(file, { force: true });
   } catch {
   }
 }
 async function runKgWatch(workspaceArg, opts, deps = {}) {
   const cwd = deps.cwd ?? opts.cwd ?? process.cwd();
-  const name = workspaceArg ?? path53.basename(cwd).toLowerCase();
+  const name = workspaceArg ?? path59.basename(cwd).toLowerCase();
   try {
     validateWorkspaceName(name);
   } catch (err) {
@@ -30200,7 +31753,7 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
     return { exitCode: 1, pidWritten: false };
   }
   const pristinePath = kgPristinePath(name);
-  const graphPath = path53.join(pristinePath, "graphify-out", "graph.json");
+  const graphPath = path59.join(pristinePath, "graphify-out", "graph.json");
   const pidState = readAndClassifyPid(name);
   if (pidState.status === "active") {
     printError(
@@ -30211,7 +31764,7 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
   if (pidState.status === "stale-reclaimed") {
     printInfo("stale-pid", `reclaimed dead PID file at ${pidFilePath(name)}`);
   }
-  const spawnFn = deps.spawnImpl ?? spawn10;
+  const spawnFn = deps.spawnImpl ?? spawn11;
   const child = spawnFn(
     "graphify",
     [cwd, "--watch", "--update", "--graph", graphPath],
@@ -30263,7 +31816,7 @@ function registerKgWatchCommand(kg) {
 }
 
 // src/commands/kg-classify.ts
-import pc31 from "picocolors";
+import pc33 from "picocolors";
 init_output();
 function registerKgClassifyCommand(kg) {
   kg.command("classify <question>").description("Route a question to kg | grep | both via the 4-layer classifier (kg-service required)").option("--workspace <name>", "Scope the L2 probe gate to a specific workspace graph").option("--json", "Emit raw JSON instead of the formatted summary").action(async (question, opts) => {
@@ -30273,7 +31826,7 @@ function registerKgClassifyCommand(kg) {
         process.stdout.write(JSON.stringify(result, null, 2) + "\n");
         return;
       }
-      const routeStr = result.route === "kg" ? pc31.cyan("kg") : result.route === "grep" ? pc31.magenta("grep") : pc31.yellow("both");
+      const routeStr = result.route === "kg" ? pc33.cyan("kg") : result.route === "grep" ? pc33.magenta("grep") : pc33.yellow("both");
       printInfo("route", `${routeStr}  (layer ${result.layer}, took ${result.took_ms}ms)`);
       printInfo("confidence", String(result.confidence));
       printInfo("reason", result.reason);
@@ -30295,7 +31848,7 @@ function registerKgClassifyCommand(kg) {
 }
 
 // src/commands/kg-doctor.ts
-import pc32 from "picocolors";
+import pc34 from "picocolors";
 init_output();
 async function runProbes() {
   const results = [];
@@ -30414,12 +31967,12 @@ function registerKgDoctorCommand(kg) {
     } else {
       printHeader("kg-service doctor");
       for (const p of probes) {
-        const badge = p.status === "ok" ? pc32.green("\u2713") : p.status === "warn" ? pc32.yellow("\u2298") : pc32.red("\u2717");
+        const badge = p.status === "ok" ? pc34.green("\u2713") : p.status === "warn" ? pc34.yellow("\u2298") : pc34.red("\u2717");
         const label = `${badge}  ${p.name}`;
         const detail = p.detail ?? "";
         printInfo(label, detail);
         if (p.remedy) {
-          process.stderr.write(`      ${pc32.dim("remedy:")} ${p.remedy}
+          process.stderr.write(`      ${pc34.dim("remedy:")} ${p.remedy}
 `);
         }
       }
@@ -30437,14 +31990,14 @@ function registerKgDoctorCommand(kg) {
 }
 
 // src/commands/kg-install-hook.ts
-import * as fs51 from "node:fs";
-import * as path55 from "node:path";
-import * as os28 from "node:os";
+import * as fs57 from "node:fs";
+import * as path61 from "node:path";
+import * as os32 from "node:os";
 
 // ../core/dist/world/merge-settings.js
-import * as fs50 from "node:fs";
-import * as path54 from "node:path";
-import * as crypto7 from "node:crypto";
+import * as fs56 from "node:fs";
+import * as path60 from "node:path";
+import * as crypto8 from "node:crypto";
 function mergeHomeSettingsJson(filePath, options) {
   let settings;
   try {
@@ -30503,10 +32056,10 @@ function mergeHomeSettingsJson(filePath, options) {
   return { status: "installed", message: `settings.json updated at ${filePath}` };
 }
 function readSettings(filePath) {
-  if (!fs50.existsSync(filePath)) {
+  if (!fs56.existsSync(filePath)) {
     return {};
   }
-  const raw = fs50.readFileSync(filePath, "utf-8");
+  const raw = fs56.readFileSync(filePath, "utf-8");
   if (!raw.trim())
     return {};
   return JSON.parse(raw);
@@ -30527,13 +32080,13 @@ function isHookSentinelPresent(matchers, sentinel) {
   return false;
 }
 function atomicWriteJson(filePath, data) {
-  const dir = path54.dirname(filePath);
-  fs50.mkdirSync(dir, { recursive: true });
-  const rand = crypto7.randomBytes(6).toString("hex");
+  const dir = path60.dirname(filePath);
+  fs56.mkdirSync(dir, { recursive: true });
+  const rand = crypto8.randomBytes(6).toString("hex");
   const tmp = `${filePath}.tmp.${process.pid}.${rand}`;
   const json = JSON.stringify(data, null, 2) + "\n";
-  fs50.writeFileSync(tmp, json, { mode: 420 });
-  fs50.renameSync(tmp, filePath);
+  fs56.writeFileSync(tmp, json, { mode: 420 });
+  fs56.renameSync(tmp, filePath);
 }
 
 // ../core/dist/kg/hook-template.js
@@ -30560,11 +32113,11 @@ try:
     sys.stderr.write(f"\\x1b[32m\\u2713 KG hit\\x1b[0m  \\"{q}\\"  \\u2192  L{layer}/{route} \\u00b7 {nodes} nodes \\u00b7 ~{saved_k}k tokens saved\\n")
     print(json.dumps({"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":f"[kg-classifier L{layer}|{route}] {label[:160]}"}}))
 except Exception: pass' 2>/dev/null`;
+  const curlPost = `RESP=$(curl -s --max-time 1 -X POST -H 'Content-Type: application/json' -d "{\\"q\\":\\"$(echo \\"$CMD\\" | head -c 200 | tr '\\"' ' ')\\"}" ${url2} 2>/dev/null)`;
   return [
     `KG_SENTINEL=${KG_HOOK_SENTINEL}`,
     `CMD=$(${extractCmd})`,
-    `case "$CMD" in *grep*|*rg\\ *|*ripgrep*|*find\\ *|*fd\\ *|*ack\\ *|*ag\\ *)`,
-    `RESP=$(curl -s --max-time 1 -X POST -H 'Content-Type: application/json' -d "{\\"q\\":\\"$(echo \\"$CMD\\" | head -c 200 | tr '\\"' ' ')\\"}" ${url2} 2>/dev/null)`,
+    `case "$CMD" in *grep*|*rg\\ *|*ripgrep*|*find\\ *|*fd\\ *|*ack\\ *|*ag\\ *) ${curlPost}`,
     `KG_QUERY="$(echo \\"$CMD\\" | head -c 60 | tr '\\"' ' ')" echo "$RESP" | ${emitContext}`,
     `;; esac`
   ].join("; ");
@@ -30585,15 +32138,15 @@ function buildHookMatcherEntry(opts) {
 init_output();
 function settingsPathFor(scope) {
   if (scope === "user") {
-    return path55.join(os28.homedir(), ".claude", "settings.json");
+    return path61.join(os32.homedir(), ".claude", "settings.json");
   }
-  return path55.join(process.cwd(), ".claude", "settings.json");
+  return path61.join(process.cwd(), ".claude", "settings.json");
 }
 function backup(filePath) {
-  if (!fs51.existsSync(filePath)) return null;
+  if (!fs57.existsSync(filePath)) return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs51.copyFileSync(filePath, backupPath);
+  fs57.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 function registerKgInstallHookCommand(kg) {
@@ -30601,9 +32154,9 @@ function registerKgInstallHookCommand(kg) {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor(scope);
     try {
-      fs51.mkdirSync(path55.dirname(filePath), { recursive: true });
+      fs57.mkdirSync(path61.dirname(filePath), { recursive: true });
     } catch (err) {
-      printError(`could not create ${path55.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
+      printError(`could not create ${path61.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
       return;
     }
@@ -30627,7 +32180,7 @@ function registerKgInstallHookCommand(kg) {
           printInfo("kg-service hook", `already installed at ${filePath}`);
           if (backupPath) {
             try {
-              fs51.unlinkSync(backupPath);
+              fs57.unlinkSync(backupPath);
             } catch {
             }
           }
@@ -30645,15 +32198,15 @@ function registerKgInstallHookCommand(kg) {
 }
 
 // src/commands/kg-uninstall-hook.ts
-import * as fs52 from "node:fs";
-import * as path56 from "node:path";
-import * as os29 from "node:os";
+import * as fs58 from "node:fs";
+import * as path62 from "node:path";
+import * as os33 from "node:os";
 init_output();
 function settingsPathFor2(scope) {
   if (scope === "user") {
-    return path56.join(os29.homedir(), ".claude", "settings.json");
+    return path62.join(os33.homedir(), ".claude", "settings.json");
   }
-  return path56.join(process.cwd(), ".claude", "settings.json");
+  return path62.join(process.cwd(), ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -30683,13 +32236,13 @@ function registerKgUninstallHookCommand(kg) {
   kg.command("uninstall-hook").description("Remove kg-service PreToolUse hook from .claude/settings.json (sentinel-matched; surgical)").option("--scope <scope>", "project (default) or user", "project").action((opts) => {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor2(scope);
-    if (!fs52.existsSync(filePath)) {
+    if (!fs58.existsSync(filePath)) {
       printInfo("kg-service hook", `no settings.json at ${filePath} \u2014 nothing to remove`);
       return;
     }
     let settings;
     try {
-      const raw = fs52.readFileSync(filePath, "utf-8");
+      const raw = fs58.readFileSync(filePath, "utf-8");
       settings = raw.trim() ? JSON.parse(raw) : {};
     } catch (err) {
       printError(`could not parse ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
@@ -30709,7 +32262,7 @@ function registerKgUninstallHookCommand(kg) {
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const backupPath = `${filePath}.olam-bak.${ts}`;
     try {
-      fs52.copyFileSync(filePath, backupPath);
+      fs58.copyFileSync(filePath, backupPath);
     } catch {
     }
     const next = {
@@ -30728,7 +32281,7 @@ function registerKgUninstallHookCommand(kg) {
       }
     }
     try {
-      fs52.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs58.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
       printSuccess(`kg-service hook removed from ${filePath}`);
       printInfo("backup", backupPath);
     } catch (err) {
@@ -30802,20 +32355,20 @@ function registerKgSavingsCommand(kg) {
 // src/commands/kg-build.ts
 function resolveWorkspace(arg) {
   const cwd = process.cwd();
-  const name = arg ?? path57.basename(cwd).toLowerCase();
+  const name = arg ?? path63.basename(cwd).toLowerCase();
   validateWorkspaceName(name);
   return { name, sourcePath: cwd };
 }
 function toContainerPath(hostPath) {
-  const home = os30.homedir();
-  const resolved = path57.resolve(hostPath);
-  if (!resolved.startsWith(home + path57.sep) && resolved !== home) {
+  const home = os34.homedir();
+  const resolved = path63.resolve(hostPath);
+  if (!resolved.startsWith(home + path63.sep) && resolved !== home) {
     throw new Error(
       `source path "${resolved}" is not under $HOME (${home}). kg-service can only build repos that live under your home dir (it bind-mounts $HOME:/host-home:ro at start). Move the repo or set OLAM_HOME if you need a different root.`
     );
   }
-  const rel = path57.relative(home, resolved);
-  return rel === "" ? "/host-home" : path57.posix.join("/host-home", rel.split(path57.sep).join("/"));
+  const rel = path63.relative(home, resolved);
+  return rel === "" ? "/host-home" : path63.posix.join("/host-home", rel.split(path63.sep).join("/"));
 }
 async function runKgBuild(workspaceArg, options = {}) {
   let workspace;
@@ -30833,7 +32386,7 @@ async function runKgBuild(workspaceArg, options = {}) {
     return { exitCode: 2 };
   }
   const outDir = kgPristinePath(workspace.name);
-  fs53.mkdirSync(outDir, { recursive: true });
+  fs59.mkdirSync(outDir, { recursive: true });
   const human = !options.json;
   if (human) {
     printInfo("kg build", `workspace=${workspace.name} source=${workspace.sourcePath}`);
@@ -30866,12 +32419,12 @@ async function runKgBuild(workspaceArg, options = {}) {
     workspace: workspace.name,
     graphify_path: "container"
   };
-  fs53.writeFileSync(
-    path57.join(outDir, "freshness.json"),
+  fs59.writeFileSync(
+    path63.join(outDir, "freshness.json"),
     JSON.stringify(freshness, null, 2) + "\n",
     "utf-8"
   );
-  const finalOut = path57.join(outDir, "graphify-out");
+  const finalOut = path63.join(outDir, "graphify-out");
   if (options.json) {
     process.stdout.write(JSON.stringify(freshness) + "\n");
   } else {
@@ -31148,17 +32701,17 @@ init_manager();
 init_context();
 init_output();
 import { spawnSync as defaultSpawnSync } from "node:child_process";
-import * as fs54 from "node:fs";
-import * as os31 from "node:os";
-import * as path58 from "node:path";
+import * as fs60 from "node:fs";
+import * as os35 from "node:os";
+import * as path64 from "node:path";
 function devboxContainerName(worldId) {
   return `olam-${worldId}-devbox`;
 }
 function olamHomeDir() {
-  return process.env["OLAM_HOME"] ?? path58.join(os31.homedir(), ".olam");
+  return process.env["OLAM_HOME"] ?? path64.join(os35.homedir(), ".olam");
 }
-function defaultRestartContainer(name, spawn11 = defaultSpawnSync) {
-  const r = spawn11("docker", ["restart", "--time", "30", name], {
+function defaultRestartContainer(name, spawn12 = defaultSpawnSync) {
+  const r = spawn12("docker", ["restart", "--time", "30", name], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -31168,8 +32721,8 @@ function defaultRestartContainer(name, spawn11 = defaultSpawnSync) {
   };
 }
 function defaultAppendAuditLog(homeDir, line) {
-  fs54.mkdirSync(homeDir, { recursive: true });
-  fs54.appendFileSync(path58.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
+  fs60.mkdirSync(homeDir, { recursive: true });
+  fs60.appendFileSync(path64.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
     encoding: "utf-8"
   });
 }
@@ -31214,19 +32767,19 @@ async function doRekey(worldId, deps) {
   );
   const rotatedAt = deps.now().toISOString();
   const homeDir = deps.olamHomeDir();
-  const worldDir = path58.join(homeDir, "worlds", worldId);
-  fs54.mkdirSync(worldDir, { recursive: true });
-  const credentialsPath = path58.join(worldDir, "credentials.json");
+  const worldDir = path64.join(homeDir, "worlds", worldId);
+  fs60.mkdirSync(worldDir, { recursive: true });
+  const credentialsPath = path64.join(worldDir, "credentials.json");
   const payload = {
     worldRoleName,
     password,
     rotatedAt
   };
-  fs54.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
+  fs60.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
-  fs54.chmodSync(credentialsPath, 384);
+  fs60.chmodSync(credentialsPath, 384);
   const restart = deps.restartContainer(devboxContainerName(worldId));
   deps.appendAuditLog(`${rotatedAt} ${worldId} rekey`);
   if (!restart.ok) {
@@ -31290,18 +32843,18 @@ function registerRekey(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs55 from "node:fs";
-import * as path59 from "node:path";
+import * as fs61 from "node:fs";
+import * as path65 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path59.join(configDir, "config.yaml");
-  if (!fs55.existsSync(configPath)) {
+  const configPath = path65.join(configDir, "config.yaml");
+  if (!fs61.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs55.readFileSync(configPath, "utf8");
+    const contents = fs61.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -31366,4 +32919,6 @@ registerKg(program);
 registerConfig(program);
 registerRepos(program);
 registerRunbooks(program);
+registerSkillsSource(program);
+registerSkills(program);
 program.parse();