@pleri/olam-cli 0.1.143 → 0.1.145

package/dist/mcp-server.js

@@ -445,8 +445,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path31, errorMaps, issueData } = params;
-      const fullPath = [...path31, ...issueData.path || []];
+      const { data, path: path37, errorMaps, issueData } = params;
+      const fullPath = [...path37, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -754,11 +754,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path31, key) {
+      constructor(parent, value, path37, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path31;
+        this._path = path37;
         this._key = key;
       }
       get path() {
@@ -7332,8 +7332,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path31) {
-      let input = path31;
+    function removeDotSegments(path37) {
+      let input = path37;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -7532,8 +7532,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path31, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path31 && path31 !== "/" ? path31 : void 0;
+        const [path37, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path37 && path37 !== "/" ? path37 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -10895,12 +10895,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs28, exportName) {
+    function addFormats(ajv, list, fs34, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs28[f]);
+        ajv.addFormat(f, fs34[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -11008,7 +11008,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path31, ctx, rejectSource) {
+function refineForbiddenKeys(value, path37, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -11016,12 +11016,12 @@ function refineForbiddenKeys(value, path31, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path31, key],
+        path: [...path37, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path31.length === 0 && key === "source") {
+    if (rejectSource && path37.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -11029,21 +11029,21 @@ function refineForbiddenKeys(value, path31, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path31, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path37, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path31, rejectSource) {
+function rejectForbiddenKeys(value, path37, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path31}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path37}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path31}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path37}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path31}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path37}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -12116,10 +12116,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path31) {
-  if (!path31)
+function getElementAtPath(obj, path37) {
+  if (!path37)
     return obj;
-  return path31.reduce((acc, key) => acc?.[key], obj);
+  return path37.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -12528,11 +12528,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path31, issues) {
+function prefixIssues(path37, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path31);
+    iss.path.unshift(path37);
     return iss;
   });
 }
@@ -12679,16 +12679,16 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
 }
 function formatError(error2, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error3, path31 = []) => {
+  const processError = (error3, path37 = []) => {
     for (const issue2 of error3.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path31, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path37, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path37, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path31, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path37, ...issue2.path]);
       } else {
-        const fullpath = [...path31, ...issue2.path];
+        const fullpath = [...path37, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -23327,8 +23327,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path31, body, attempt = 0) {
-    const url2 = `${this.baseUrl}${path31}`;
+  async request(method, path37, body, attempt = 0) {
+    const url2 = `${this.baseUrl}${path37}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -23346,7 +23346,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path31, body, attempt + 1);
+        return this.request(method, path37, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -24197,12 +24197,12 @@ function register3(server, _ctx, _initError) {
         registry2.close();
       }
       try {
-        const { default: fs28 } = await import("node:fs");
-        const { default: os17 } = await import("node:os");
-        const { default: path31 } = await import("node:path");
-        const tokenPath = path31.join(os17.homedir(), ".olam", "host-cp.token");
-        if (fs28.existsSync(tokenPath)) {
-          const token = fs28.readFileSync(tokenPath, "utf-8").trim();
+        const { default: fs34 } = await import("node:fs");
+        const { default: os21 } = await import("node:os");
+        const { default: path37 } = await import("node:path");
+        const tokenPath = path37.join(os21.homedir(), ".olam", "host-cp.token");
+        if (fs34.existsSync(tokenPath)) {
+          const token = fs34.readFileSync(tokenPath, "utf-8").trim();
           await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -24639,10 +24639,10 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path31) {
-  if (!existsSync6(path31)) return null;
+function readOptional(path37) {
+  if (!existsSync6(path37)) return null;
   try {
-    return readFileSync5(path31, "utf8");
+    return readFileSync5(path37, "utf8");
   } catch {
     return null;
   }
@@ -26058,8 +26058,8 @@ var CloudflareProvider = class extends ComputeProvider {
   // -----------------------------------------------------------------------
   // Internal fetch helper
   // -----------------------------------------------------------------------
-  async request(path31, method, body) {
-    const url2 = `${this.config.workerUrl}${path31}`;
+  async request(path37, method, body) {
+    const url2 = `${this.config.workerUrl}${path37}`;
     const bearer = await this.config.mintToken();
     const headers = {
       Authorization: `Bearer ${bearer}`
@@ -28510,10 +28510,10 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path31 = join13(args.outDir, "manifest.json");
-  await writeFile(path31, `${JSON.stringify(manifest, null, 2)}
+  const path37 = join13(args.outDir, "manifest.json");
+  await writeFile(path37, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path31, manifest };
+  return { path: path37, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
@@ -28767,9 +28767,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path31 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path31))) {
-        return httpReject(403, "outside_allow_list", { path: path31 });
+      const path37 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path37))) {
+        return httpReject(403, "outside_allow_list", { path: path37 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -29548,14 +29548,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path31 = join14(outDir, `${shot.name}.${ext}`);
+    const path37 = join14(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path31,
+      path: path37,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path31, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path37, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -29999,12 +29999,12 @@ function openUrl(url2) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs28 } = await import("node:fs");
-    const { default: os17 } = await import("node:os");
-    const { default: path31 } = await import("node:path");
-    const tp = path31.join(os17.homedir(), ".olam", "host-cp.token");
-    if (!fs28.existsSync(tp)) return { token: null };
-    return { token: fs28.readFileSync(tp, "utf-8").trim() };
+    const { default: fs34 } = await import("node:fs");
+    const { default: os21 } = await import("node:os");
+    const { default: path37 } = await import("node:path");
+    const tp = path37.join(os21.homedir(), ".olam", "host-cp.token");
+    if (!fs34.existsSync(tp)) return { token: null };
+    return { token: fs34.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -30240,6 +30240,22 @@ init_v3();
 // ../core/dist/global-config/schema.js
 init_v3();
 init_schema();
+
+// ../core/dist/skill-sources/schema.js
+init_v3();
+var SKILL_SOURCE_ID_LENGTH = 12;
+var NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+var URL_PATTERN = /^(?:https?:\/\/|git@|ssh:\/\/|file:\/\/|\/).+/;
+var SkillSourceSchema = external_exports.object({
+  id: external_exports.string().length(SKILL_SOURCE_ID_LENGTH, `skill-source id must be exactly ${SKILL_SOURCE_ID_LENGTH} chars (sha256-of-url prefix)`).regex(/^[a-f0-9]+$/, "skill-source id must be lowercase hex"),
+  name: external_exports.string().regex(NAME_PATTERN, "skill-source name must be ASCII lowercase + digits + dash (1-64 chars, no leading/trailing dash)"),
+  gitUrl: external_exports.string().min(1, "gitUrl must not be empty").regex(URL_PATTERN, "gitUrl must look like a git URL (https://, git@, ssh://, file://, or absolute path)"),
+  branch: external_exports.string().min(1, "branch must not be empty").default("main"),
+  addedAt: external_exports.number().int().nonnegative(),
+  lastPulledSha: external_exports.string().regex(/^[a-f0-9]{40}$/, "lastPulledSha must be a 40-char lowercase hex git SHA").optional()
+});
+
+// ../core/dist/global-config/schema.js
 function isAbsoluteOrTilde(p) {
   return p.startsWith("/") || p === "~" || p.startsWith("~/");
 }
@@ -30292,7 +30308,8 @@ var RunbookSchema = external_exports.object({
 var GlobalConfigSchema = external_exports.object({
   schemaVersion: external_exports.literal(1),
   repos: external_exports.array(RepoEntrySchema).optional().default([]),
-  runbooks: external_exports.array(RunbookSchema).optional().default([])
+  runbooks: external_exports.array(RunbookSchema).optional().default([]),
+  skillSources: external_exports.array(SkillSourceSchema).optional().default([])
 }).strip().superRefine((val, ctx) => {
   const repoNames = val.repos.map((r) => r.name);
   const repoDupes = repoNames.filter((n, i) => repoNames.indexOf(n) !== i);
@@ -30304,11 +30321,22 @@ var GlobalConfigSchema = external_exports.object({
   for (const d of rbDupes) {
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate runbook name: "${d}"`, path: ["runbooks"] });
   }
+  const skillIds = val.skillSources.map((s) => s.id);
+  const skillIdDupes = skillIds.filter((n, i) => skillIds.indexOf(n) !== i);
+  for (const d of skillIdDupes) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate skill-source id: "${d}"`, path: ["skillSources"] });
+  }
+  const skillNames = val.skillSources.map((s) => s.name);
+  const skillNameDupes = skillNames.filter((n, i) => skillNames.indexOf(n) !== i);
+  for (const d of skillNameDupes) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate skill-source name: "${d}"`, path: ["skillSources"] });
+  }
 });
 var DEFAULT_GLOBAL_CONFIG = {
   schemaVersion: 1,
   repos: [],
-  runbooks: []
+  runbooks: [],
+  skillSources: []
 };
 
 // ../core/dist/global-config/store.js
@@ -30622,6 +30650,627 @@ function repoEntryToRepoConfig(entry) {
   return config2;
 }
 
+// ../core/dist/skill-sources/store.js
+import * as crypto3 from "node:crypto";
+function deriveSkillSourceId(gitUrl) {
+  return crypto3.createHash("sha256").update(gitUrl).digest("hex").slice(0, SKILL_SOURCE_ID_LENGTH);
+}
+function listSkillSources() {
+  return readGlobalConfig().skillSources;
+}
+function getSkillSource(id) {
+  return readGlobalConfig().skillSources.find((s) => s.id === id);
+}
+function addSkillSource(entry) {
+  const config2 = readGlobalConfig();
+  const id = deriveSkillSourceId(entry.gitUrl);
+  if (config2.skillSources.some((s) => s.id === id)) {
+    throw new Error(`skill-source "${entry.gitUrl}" already registered (id "${id}"). Use "olam skills source list" to inspect.`);
+  }
+  if (config2.skillSources.some((s) => s.name === entry.name)) {
+    throw new Error(`skill-source name "${entry.name}" already in use. Pick a different display name.`);
+  }
+  const now = Date.now();
+  const newEntry = {
+    id,
+    name: entry.name,
+    gitUrl: entry.gitUrl,
+    branch: entry.branch ?? "main",
+    addedAt: now
+  };
+  writeGlobalConfig({ ...config2, skillSources: [...config2.skillSources, newEntry] });
+  return newEntry;
+}
+function removeSkillSource(id) {
+  const config2 = readGlobalConfig();
+  if (!config2.skillSources.some((s) => s.id === id)) {
+    throw new Error(`skill-source "${id}" is not registered. Run "olam skills source list" to see registered sources.`);
+  }
+  writeGlobalConfig({
+    ...config2,
+    skillSources: config2.skillSources.filter((s) => s.id !== id)
+  });
+}
+function updateSkillSource(id, patch) {
+  const config2 = readGlobalConfig();
+  const idx = config2.skillSources.findIndex((s) => s.id === id);
+  if (idx === -1) {
+    throw new Error(`skill-source "${id}" is not registered. Run "olam skills source list" to see registered sources.`);
+  }
+  if (patch.name !== void 0) {
+    const collision = config2.skillSources.find((s, i) => i !== idx && s.name === patch.name);
+    if (collision !== void 0) {
+      throw new Error(`skill-source name "${patch.name}" already in use by id "${collision.id}".`);
+    }
+  }
+  const existing = config2.skillSources[idx];
+  const updated = {
+    ...existing,
+    ...patch.name !== void 0 ? { name: patch.name } : {},
+    ...patch.branch !== void 0 ? { branch: patch.branch } : {},
+    ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {}
+  };
+  const next = [...config2.skillSources];
+  next[idx] = updated;
+  writeGlobalConfig({ ...config2, skillSources: next });
+  return updated;
+}
+
+// ../core/dist/skill-sources/clone.js
+import { execFileSync as execFileSync2 } from "node:child_process";
+import * as fs13 from "node:fs";
+import * as os9 from "node:os";
+import * as path15 from "node:path";
+function skillSourcesRootDir() {
+  const override = process.env["OLAM_SKILL_SOURCES_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path15.join(os9.homedir(), ".olam", "state", "skill-sources");
+}
+function skillSourceClonePath(id) {
+  return path15.join(skillSourcesRootDir(), id);
+}
+var SkillSourceGitError = class extends Error {
+  op;
+  gitUrl;
+  constructor(op, gitUrl, cause) {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    super(`git ${op} failed for "${gitUrl}": ${msg}`);
+    this.op = op;
+    this.gitUrl = gitUrl;
+    this.name = "SkillSourceGitError";
+    this.cause = cause;
+  }
+};
+function runGit(args, cwd) {
+  try {
+    return execFileSync2("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (err) {
+    throw err;
+  }
+}
+function cloneSkillSource(opts) {
+  const clonePath = skillSourceClonePath(opts.id);
+  if (fs13.existsSync(clonePath)) {
+    throw new Error(`clone path "${clonePath}" already exists. Remove the existing skill-source first.`);
+  }
+  fs13.mkdirSync(skillSourcesRootDir(), { recursive: true });
+  try {
+    runGit(["clone", "--depth", "1", "--branch", opts.branch, opts.gitUrl, clonePath]);
+  } catch (err) {
+    if (fs13.existsSync(clonePath)) {
+      fs13.rmSync(clonePath, { recursive: true, force: true });
+    }
+    throw new SkillSourceGitError("clone", opts.gitUrl, err);
+  }
+  let headSha;
+  try {
+    headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
+  } catch (err) {
+    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+  }
+  return { clonePath, headSha };
+}
+function pullSkillSource(opts) {
+  const clonePath = skillSourceClonePath(opts.id);
+  if (!fs13.existsSync(clonePath)) {
+    throw new Error(`clone path "${clonePath}" does not exist. Run "olam skills source add" first.`);
+  }
+  try {
+    runGit(["fetch", "origin", opts.branch], clonePath);
+    runGit(["reset", "--hard", `origin/${opts.branch}`], clonePath);
+  } catch (err) {
+    throw new SkillSourceGitError("fetch/reset", opts.gitUrl, err);
+  }
+  try {
+    const headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
+    return { headSha };
+  } catch (err) {
+    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+  }
+}
+function removeSkillSourceClone(id) {
+  const clonePath = skillSourceClonePath(id);
+  if (fs13.existsSync(clonePath)) {
+    fs13.rmSync(clonePath, { recursive: true, force: true });
+  }
+}
+
+// ../core/dist/skill-sync/artifact-resolver.js
+import * as fs14 from "node:fs";
+import * as path16 from "node:path";
+function resolveSubscriptions(opts) {
+  const { clonePath, atlasUser } = opts;
+  if (atlasUser) {
+    const subsPath = path16.join(clonePath, "members", atlasUser, "subscriptions.json");
+    if (fs14.existsSync(subsPath)) {
+      try {
+        const parsed = JSON.parse(fs14.readFileSync(subsPath, "utf-8"));
+        if (Array.isArray(parsed?.categories)) {
+          return {
+            categories: parsed.categories.filter((c) => typeof c === "string"),
+            fromSubscriptionsFile: true,
+            atlasUser
+          };
+        }
+      } catch {
+      }
+    }
+  }
+  const catsPath = path16.join(clonePath, "shared", "categories.json");
+  if (fs14.existsSync(catsPath)) {
+    try {
+      const parsed = JSON.parse(fs14.readFileSync(catsPath, "utf-8"));
+      if (Array.isArray(parsed?.categories)) {
+        return {
+          categories: parsed.categories.map((c) => c.id).filter((id) => typeof id === "string"),
+          fromSubscriptionsFile: false,
+          atlasUser
+        };
+      }
+    } catch {
+    }
+  }
+  const sharedDir = path16.join(clonePath, "shared");
+  const cats = [];
+  if (fs14.existsSync(sharedDir)) {
+    for (const name of fs14.readdirSync(sharedDir)) {
+      const dir = path16.join(sharedDir, name);
+      if (!fs14.statSync(dir).isDirectory())
+        continue;
+      if (fs14.existsSync(path16.join(dir, "skills")) || fs14.existsSync(path16.join(dir, "agents"))) {
+        cats.push(name);
+      }
+    }
+  }
+  return { categories: cats, fromSubscriptionsFile: false, atlasUser };
+}
+function listDirSafe(dir) {
+  if (!fs14.existsSync(dir))
+    return [];
+  return fs14.readdirSync(dir);
+}
+function resolveSkillsDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    const subdir = path16.join(baseDir, name);
+    if (!fs14.statSync(subdir).isDirectory())
+      continue;
+    if (!fs14.existsSync(path16.join(subdir, "SKILL.md")))
+      continue;
+    out.push({ kind: "skill", sourceId, sourcePath: subdir, deployBasename: name });
+    const subagentsDir = path16.join(subdir, "references", "agents");
+    if (fs14.existsSync(subagentsDir) && fs14.statSync(subagentsDir).isDirectory()) {
+      for (const f of listDirSafe(subagentsDir)) {
+        if (!f.endsWith(".md"))
+          continue;
+        out.push({
+          kind: "subagent",
+          sourceId,
+          sourcePath: path16.join(subagentsDir, f),
+          deployBasename: f,
+          parentSkill: name
+        });
+      }
+    }
+  }
+  return out;
+}
+function resolveAgentsDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    const full = path16.join(baseDir, name);
+    const stat = fs14.statSync(full);
+    if (stat.isFile() && name.endsWith(".md")) {
+      out.push({ kind: "agent", sourceId, sourcePath: full, deployBasename: name });
+    } else if (stat.isDirectory()) {
+      for (const f of listDirSafe(full)) {
+        if (!f.endsWith(".md"))
+          continue;
+        out.push({
+          kind: "agent",
+          sourceId,
+          sourcePath: path16.join(full, f),
+          deployBasename: `${name}-${f}`
+        });
+      }
+    }
+  }
+  return out;
+}
+function resolveScriptsDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    const full = path16.join(baseDir, name);
+    const stat = fs14.statSync(full);
+    if (stat.isFile() && name.endsWith(".sh")) {
+      out.push({ kind: "script", sourceId, sourcePath: full, deployBasename: name });
+    } else if (stat.isDirectory()) {
+      out.push({ kind: "script", sourceId, sourcePath: full, deployBasename: name });
+    }
+  }
+  return out;
+}
+function resolveRulesDir(opts) {
+  const { sourceId, baseDir } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    if (!name.endsWith(".md"))
+      continue;
+    const full = path16.join(baseDir, name);
+    if (!fs14.statSync(full).isFile())
+      continue;
+    out.push({ kind: "rule", sourceId, sourcePath: full, deployBasename: name });
+  }
+  return out;
+}
+function resolveJsonDir(opts) {
+  const { sourceId, baseDir, kind } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    if (!name.endsWith(".json"))
+      continue;
+    const full = path16.join(baseDir, name);
+    if (!fs14.statSync(full).isFile())
+      continue;
+    out.push({ kind, sourceId, sourcePath: full, deployBasename: name });
+  }
+  return out;
+}
+function resolveSourceArtifacts(opts) {
+  const { sourceId, clonePath, atlasUser } = opts;
+  const subscription = resolveSubscriptions({ clonePath, atlasUser });
+  const artifacts = [];
+  for (const cat of subscription.categories) {
+    const catDir = path16.join(clonePath, "shared", cat);
+    if (!fs14.existsSync(catDir))
+      continue;
+    artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path16.join(catDir, "skills") }));
+    artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path16.join(catDir, "agents") }));
+    artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path16.join(catDir, "scripts") }));
+    artifacts.push(...resolveRulesDir({ sourceId, baseDir: path16.join(catDir, "rules") }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path16.join(catDir, "hooks"), kind: "hook" }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path16.join(catDir, "permissions"), kind: "permission" }));
+  }
+  if (atlasUser) {
+    const memberRoot = path16.join(clonePath, "members", atlasUser);
+    if (fs14.existsSync(memberRoot)) {
+      artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path16.join(memberRoot, "skills") }));
+      artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path16.join(memberRoot, "agents") }));
+      artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path16.join(memberRoot, "scripts") }));
+      artifacts.push(...resolveRulesDir({ sourceId, baseDir: path16.join(memberRoot, "rules") }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path16.join(memberRoot, "hooks"), kind: "hook" }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path16.join(memberRoot, "permissions"), kind: "permission" }));
+    }
+  }
+  return { subscription, artifacts };
+}
+
+// ../core/dist/skill-sync/symlink-deployer.js
+import * as fs15 from "node:fs";
+import * as os10 from "node:os";
+import * as path17 from "node:path";
+function claudeDir() {
+  const override = process.env["OLAM_CLAUDE_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path17.join(os10.homedir(), ".claude");
+}
+var BUCKETS = ["commands", "agents", "skills", "scripts", "rules"];
+function bucketFor(kind) {
+  switch (kind) {
+    case "skill":
+      return "skills";
+    case "agent":
+      return "agents";
+    case "subagent":
+      return "agents";
+    case "script":
+      return "scripts";
+    case "rule":
+      return "rules";
+    case "hook":
+    case "permission":
+      return void 0;
+  }
+}
+function cleanManagedSymlinks(claude) {
+  for (const bucket of BUCKETS) {
+    const dir = path17.join(claude, bucket);
+    if (!fs15.existsSync(dir))
+      continue;
+    for (const name of fs15.readdirSync(dir)) {
+      const p = path17.join(dir, name);
+      try {
+        const stat = fs15.lstatSync(p);
+        if (stat.isSymbolicLink()) {
+          fs15.unlinkSync(p);
+        }
+      } catch {
+      }
+    }
+  }
+}
+function shadowBackup(link) {
+  const epoch = Math.floor(Date.now() / 1e3);
+  const backup = `${link}.shadow-backup-${epoch}`;
+  fs15.renameSync(link, backup);
+  return backup;
+}
+function linkIfNeeded(target, link) {
+  try {
+    const existing = fs15.readlinkSync(link);
+    if (existing === target)
+      return { created: false };
+  } catch {
+  }
+  let isLink = false;
+  try {
+    isLink = fs15.lstatSync(link).isSymbolicLink();
+  } catch {
+  }
+  let backup;
+  if (isLink) {
+    fs15.unlinkSync(link);
+  } else if (fs15.existsSync(link)) {
+    backup = shadowBackup(link);
+  }
+  fs15.symlinkSync(target, link);
+  return { created: true, shadowBackup: backup };
+}
+function deployArtifacts(artifacts) {
+  const claude = claudeDir();
+  for (const bucket of BUCKETS) {
+    fs15.mkdirSync(path17.join(claude, bucket), { recursive: true });
+  }
+  cleanManagedSymlinks(claude);
+  const result = { linked: 0, shadowBackups: [], subagentCollisions: [] };
+  const seenAgentBasenames = /* @__PURE__ */ new Map();
+  const collisionLosers = /* @__PURE__ */ new Map();
+  for (const artifact of artifacts) {
+    const bucket = bucketFor(artifact.kind);
+    if (!bucket)
+      continue;
+    if (artifact.kind === "agent" || artifact.kind === "subagent") {
+      const prior = seenAgentBasenames.get(artifact.deployBasename);
+      if (prior) {
+        const losers = collisionLosers.get(artifact.deployBasename) ?? [];
+        losers.push(artifact.sourcePath);
+        collisionLosers.set(artifact.deployBasename, losers);
+        continue;
+      }
+      seenAgentBasenames.set(artifact.deployBasename, artifact.sourcePath);
+    }
+    const linkPath = path17.join(claude, bucket, artifact.deployBasename);
+    const { created, shadowBackup: backup } = linkIfNeeded(artifact.sourcePath, linkPath);
+    if (created)
+      result.linked += 1;
+    if (backup)
+      result.shadowBackups.push(backup);
+  }
+  for (const [name, losers] of collisionLosers.entries()) {
+    const winner = seenAgentBasenames.get(name);
+    result.subagentCollisions.push({ name, winner, losers });
+  }
+  return result;
+}
+
+// ../core/dist/skill-sync/settings-merger.js
+import * as fs16 from "node:fs";
+import * as os11 from "node:os";
+import * as path18 from "node:path";
+var OLAM_SKILLS_MARKER = "_olamSkillsManaged";
+var BACKUP_RETENTION = 30;
+function claudeSettingsPath() {
+  const override = process.env["OLAM_CLAUDE_SETTINGS_PATH"];
+  if (override && override.length > 0)
+    return override;
+  return path18.join(claudeDirInternal(), "settings.json");
+}
+function claudeDirInternal() {
+  const override = process.env["OLAM_CLAUDE_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path18.join(os11.homedir(), ".claude");
+}
+function settingsBackupDir() {
+  const override = process.env["OLAM_SETTINGS_BACKUP_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path18.join(os11.homedir(), ".olam", "state", "settings-backups");
+}
+function dedupeByMatcher(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    map.set(e.matcher ?? "", e);
+  }
+  return [...map.values()];
+}
+function tagOlam(entry) {
+  return { ...entry, [OLAM_SKILLS_MARKER]: true };
+}
+function readJson(file) {
+  return JSON.parse(fs16.readFileSync(file, "utf-8"));
+}
+function rotateBackups(backupDir) {
+  if (!fs16.existsSync(backupDir))
+    return;
+  const files = fs16.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path18.join(backupDir, f), mtime: fs16.statSync(path18.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  for (const f of files.slice(BACKUP_RETENTION)) {
+    try {
+      fs16.unlinkSync(f.full);
+    } catch {
+    }
+  }
+}
+function backupSettings() {
+  const src = claudeSettingsPath();
+  if (!fs16.existsSync(src))
+    return void 0;
+  const dir = settingsBackupDir();
+  fs16.mkdirSync(dir, { recursive: true });
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const dest = path18.join(dir, `settings-${stamp}.json`);
+  fs16.copyFileSync(src, dest);
+  rotateBackups(dir);
+  return dest;
+}
+function mergeSettings(input) {
+  const settingsPath = claudeSettingsPath();
+  const backupPath = backupSettings();
+  let base = {};
+  if (fs16.existsSync(settingsPath)) {
+    try {
+      base = readJson(settingsPath);
+    } catch {
+      base = {};
+    }
+  }
+  const olamHooksByCategory = /* @__PURE__ */ new Map();
+  for (const file of input.hookFiles) {
+    let parsed;
+    try {
+      parsed = readJson(file);
+    } catch {
+      continue;
+    }
+    if (!parsed.hooks || typeof parsed.hooks !== "object")
+      continue;
+    for (const [category, entries] of Object.entries(parsed.hooks)) {
+      if (!Array.isArray(entries))
+        continue;
+      const list = olamHooksByCategory.get(category) ?? [];
+      list.push(...entries.map(tagOlam));
+      olamHooksByCategory.set(category, list);
+    }
+  }
+  const mergedHooks = {};
+  const existingHooks = base.hooks && typeof base.hooks === "object" ? base.hooks : {};
+  const categories = /* @__PURE__ */ new Set([
+    ...Object.keys(existingHooks),
+    ...olamHooksByCategory.keys()
+  ]);
+  let hooksAdded = 0;
+  for (const cat of categories) {
+    const existing = Array.isArray(existingHooks[cat]) ? existingHooks[cat] : [];
+    const preserved = existing.filter((e) => !e[OLAM_SKILLS_MARKER]);
+    const olam = olamHooksByCategory.get(cat) ?? [];
+    const combined = [...preserved, ...olam];
+    mergedHooks[cat] = dedupeByMatcher(combined);
+    hooksAdded += olam.length;
+  }
+  const permSet = /* @__PURE__ */ new Set();
+  for (const file of input.permissionFiles) {
+    let parsed;
+    try {
+      parsed = readJson(file);
+    } catch {
+      continue;
+    }
+    const allow = parsed.permissions?.allow;
+    if (Array.isArray(allow)) {
+      for (const p of allow)
+        if (typeof p === "string")
+          permSet.add(p);
+    }
+  }
+  const next = {
+    ...base,
+    hooks: mergedHooks,
+    permissions: {
+      ...base.permissions ?? {},
+      ...input.permissionFiles.length > 0 ? { allow: [...permSet] } : {}
+    }
+  };
+  fs16.mkdirSync(path18.dirname(settingsPath), { recursive: true });
+  const tmp = `${settingsPath}.tmp-${process.pid}`;
+  fs16.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
+  fs16.renameSync(tmp, settingsPath);
+  return { backupPath, hooksAdded, permissionsCount: permSet.size };
+}
+
+// ../core/dist/skill-sync/engine.js
+import * as fs17 from "node:fs";
+import * as os12 from "node:os";
+import * as path19 from "node:path";
+function resolveAtlasUser(override) {
+  if (override)
+    return override;
+  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path19.join(os12.homedir(), ".claude");
+  const f = path19.join(claudeDir2, ".atlas-user");
+  if (fs17.existsSync(f)) {
+    return fs17.readFileSync(f, "utf-8").trim() || void 0;
+  }
+  return void 0;
+}
+async function syncSkills(opts = {}) {
+  const atlasUser = resolveAtlasUser(opts.atlasUser);
+  const sources = listSkillSources();
+  const allArtifacts = [];
+  const perSource = [];
+  for (const source of sources) {
+    const clonePath = skillSourceClonePath(source.id);
+    if (!fs17.existsSync(clonePath))
+      continue;
+    const { artifacts, subscription } = resolveSourceArtifacts({
+      sourceId: source.id,
+      clonePath,
+      atlasUser
+    });
+    allArtifacts.push(...artifacts);
+    perSource.push({
+      sourceId: source.id,
+      name: source.name,
+      artifactCount: artifacts.length,
+      categories: subscription.categories,
+      fromSubscriptionsFile: subscription.fromSubscriptionsFile
+    });
+  }
+  const hookFiles = allArtifacts.filter((a) => a.kind === "hook").map((a) => a.sourcePath);
+  const permissionFiles = allArtifacts.filter((a) => a.kind === "permission").map((a) => a.sourcePath);
+  const summary = {
+    sourceCount: sources.length,
+    artifactCount: allArtifacts.length,
+    hookFileCount: hookFiles.length,
+    permissionFileCount: permissionFiles.length,
+    deploy: void 0,
+    merge: void 0,
+    perSource
+  };
+  if (opts.dryRun)
+    return summary;
+  summary.deploy = deployArtifacts(allArtifacts);
+  summary.merge = mergeSettings({ hookFiles, permissionFiles });
+  return summary;
+}
+
 // ../mcp-server/src/tools/repo.ts
 function asMessage4(err) {
   return err instanceof Error ? err.message : String(err);
@@ -30650,9 +31299,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("Optional human-readable description."),
       defaultBranch: external_exports.string().optional().describe("Default branch name (e.g. main).")
     },
-    async ({ name, path: path31, description, defaultBranch }) => {
+    async ({ name, path: path37, description, defaultBranch }) => {
       try {
-        const entry = addRepo({ name, path: path31, description, defaultBranch });
+        const entry = addRepo({ name, path: path37, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -30693,9 +31342,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("New description."),
       defaultBranch: external_exports.string().optional().describe("New default branch.")
     },
-    async ({ name, path: path31, description, defaultBranch }) => {
+    async ({ name, path: path37, description, defaultBranch }) => {
       try {
-        const entry = updateRepo(name, { path: path31, description, defaultBranch });
+        const entry = updateRepo(name, { path: path37, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -30716,15 +31365,15 @@ __export(process_port_exports, {
   resolveHostCpToken: () => resolveHostCpToken
 });
 init_v3();
-import fs13 from "node:fs";
-import os9 from "node:os";
-import path15 from "node:path";
+import fs18 from "node:fs";
+import os13 from "node:os";
+import path20 from "node:path";
 var HOST_CP_BASE = "http://127.0.0.1:19000";
 function resolveHostCpToken() {
   const envToken = process.env["OLAM_HOST_CP_TOKEN"];
   if (envToken) return envToken;
-  const tokenPath = path15.join(os9.homedir(), ".olam", "host-cp.token");
-  if (fs13.existsSync(tokenPath)) return fs13.readFileSync(tokenPath, "utf-8").trim();
+  const tokenPath = path20.join(os13.homedir(), ".olam", "host-cp.token");
+  if (fs18.existsSync(tokenPath)) return fs18.readFileSync(tokenPath, "utf-8").trim();
   return null;
 }
 function tokenMissingError() {
@@ -31004,10 +31653,254 @@ ${conflicts.length} port conflict(s). Stop the conflicting processes or update p
   );
 }
 
+// ../mcp-server/src/tools/skill-source.ts
+var skill_source_exports = {};
+__export(skill_source_exports, {
+  register: () => register25
+});
+init_v3();
+function asMessage7(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function ok(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
+function fail(err) {
+  return {
+    content: [{ type: "text", text: asMessage7(err) }],
+    isError: true
+  };
+}
+function register25(server, _ctx, _initError) {
+  server.tool(
+    "olam_skills_source_list",
+    "List every registered skill source. Returns { skillSources: SkillSource[] }.",
+    {},
+    async () => {
+      return ok({ skillSources: listSkillSources() });
+    }
+  );
+  server.tool(
+    "olam_skills_source_add",
+    "Register and clone a skill source. Clones to ~/.olam/state/skill-sources/<id>/. Atomic: rolls back the state-store entry if the clone fails.",
+    {
+      name: external_exports.string().min(1).describe("Display name (lowercase, digits, dash; 1\u201364 chars)."),
+      gitUrl: external_exports.string().min(1).describe("Git URL (https://, git@, ssh://, file://, or absolute path)."),
+      branch: external_exports.string().min(1).optional().describe('Branch to track. Defaults to "main".')
+    },
+    async ({ name, gitUrl, branch }) => {
+      let entry;
+      try {
+        entry = addSkillSource({ name, gitUrl, branch });
+      } catch (err) {
+        return fail(err);
+      }
+      try {
+        const result = cloneSkillSource({
+          gitUrl: entry.gitUrl,
+          branch: entry.branch,
+          id: entry.id
+        });
+        const updated = updateSkillSource(entry.id, { lastPulledSha: result.headSha });
+        return ok({
+          source: updated,
+          clonePath: result.clonePath,
+          message: `Registered skill source "${entry.name}" (${entry.id}) @ ${result.headSha.slice(0, 8)}.`
+        });
+      } catch (err) {
+        try {
+          removeSkillSource(entry.id);
+        } catch {
+        }
+        return fail(err);
+      }
+    }
+  );
+  server.tool(
+    "olam_skills_source_remove",
+    "Remove a registered skill source. Deletes the clone directory and the state entry.",
+    {
+      id: external_exports.string().length(12).describe("Skill source id (from olam_skills_source_list).")
+    },
+    async ({ id }) => {
+      try {
+        removeSkillSourceClone(id);
+        removeSkillSource(id);
+        return ok({ id, message: `Removed skill source "${id}".` });
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.tool(
+    "olam_skills_source_pull",
+    "Fetch + reset the clone to upstream HEAD. Updates lastPulledSha.",
+    {
+      id: external_exports.string().length(12).describe("Skill source id.")
+    },
+    async ({ id }) => {
+      const entry = getSkillSource(id);
+      if (!entry) {
+        return fail(new Error(`skill source "${id}" is not registered`));
+      }
+      try {
+        const result = pullSkillSource({
+          gitUrl: entry.gitUrl,
+          branch: entry.branch,
+          id: entry.id
+        });
+        const updated = updateSkillSource(entry.id, { lastPulledSha: result.headSha });
+        return ok({
+          source: updated,
+          message: `Pulled "${entry.name}" \u2192 ${result.headSha.slice(0, 8)}.`
+        });
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.tool(
+    "olam_skills_source_show",
+    "Show details for a single skill source (state-store entry + resolved clone path).",
+    {
+      id: external_exports.string().length(12).describe("Skill source id.")
+    },
+    async ({ id }) => {
+      const entry = getSkillSource(id);
+      if (!entry) {
+        return fail(new Error(`skill source "${id}" is not registered`));
+      }
+      return ok({
+        source: entry,
+        clonePath: skillSourceClonePath(entry.id)
+      });
+    }
+  );
+}
+
+// ../mcp-server/src/tools/skills.ts
+var skills_exports = {};
+__export(skills_exports, {
+  register: () => register26
+});
+init_v3();
+import * as fs19 from "node:fs";
+import * as path21 from "node:path";
+function asMessage8(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function ok2(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
+function fail2(err) {
+  return {
+    content: [{ type: "text", text: asMessage8(err) }],
+    isError: true
+  };
+}
+function listDeployed() {
+  const dir = claudeDir();
+  const sources = listSkillSources();
+  const sourcePaths = new Map(
+    sources.map((s) => [skillSourceClonePath(s.id), s.id])
+  );
+  const entries = [];
+  for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
+    const bucketDir = path21.join(dir, bucket);
+    if (!fs19.existsSync(bucketDir)) continue;
+    for (const name of fs19.readdirSync(bucketDir)) {
+      const full = path21.join(bucketDir, name);
+      try {
+        const stat = fs19.lstatSync(full);
+        if (!stat.isSymbolicLink()) continue;
+        const target = fs19.readlinkSync(full);
+        let sourceId;
+        for (const [clonePath, id] of sourcePaths.entries()) {
+          if (target.startsWith(clonePath)) {
+            sourceId = id;
+            break;
+          }
+        }
+        entries.push({ bucket, name, target, sourceId });
+      } catch {
+      }
+    }
+  }
+  return entries;
+}
+function register26(server, _ctx, _initError) {
+  server.tool(
+    "olam_skills_sync",
+    "Sync all registered skill sources to ~/.claude/. Returns SyncSummary with per-source artifact breakdown, deploy result, and merge result.",
+    {
+      dryRun: external_exports.boolean().optional().describe("Resolve artifacts but do not deploy or merge. Returns the summary that sync would produce."),
+      atlasUser: external_exports.string().optional().describe("Override atlas-user identifier (defaults to ~/.claude/.atlas-user).")
+    },
+    async ({ dryRun, atlasUser }) => {
+      try {
+        const summary = await syncSkills({ dryRun, atlasUser });
+        return ok2(summary);
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "olam_skills_diff",
+    "Show what `olam skills sync` would deploy without making on-disk changes. Equivalent to sync with dryRun=true.",
+    {
+      atlasUser: external_exports.string().optional().describe("Override atlas-user identifier.")
+    },
+    async ({ atlasUser }) => {
+      try {
+        const summary = await syncSkills({ dryRun: true, atlasUser });
+        return ok2(summary);
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "olam_skills_list",
+    "List artifacts currently deployed under ~/.claude/{skills,agents,scripts,rules,commands}/ along with their source-id (if from a registered olam source).",
+    {},
+    async () => {
+      try {
+        const entries = listDeployed();
+        return ok2({ deployed: entries, count: entries.length });
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+  server.tool(
+    "olam_skills_show",
+    'Show details for a deployed artifact by name (e.g. "plan-hard" or "codex-second-opinion.md"). Returns one or more matches across buckets.',
+    {
+      name: external_exports.string().min(1).describe("Artifact name (basename under any of the managed buckets).")
+    },
+    async ({ name }) => {
+      try {
+        const entries = listDeployed().filter((e) => e.name === name);
+        if (entries.length === 0) {
+          return fail2(new Error(`no deployed artifact matches "${name}"`));
+        }
+        return ok2({ matches: entries });
+      } catch (err) {
+        return fail2(err);
+      }
+    }
+  );
+}
+
 // ../mcp-server/src/tools/kg-classify.ts
 var kg_classify_exports = {};
 __export(kg_classify_exports, {
-  register: () => register25
+  register: () => register27
 });
 init_v3();
 
@@ -31020,8 +31913,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path31) {
-  return `http://127.0.0.1:${port()}${path31}`;
+function url(path37) {
+  return `http://127.0.0.1:${port()}${path37}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -31082,7 +31975,7 @@ async function status(opts = {}) {
 }
 
 // ../mcp-server/src/tools/kg-classify.ts
-function register25(server, _ctx, _initError) {
+function register27(server, _ctx, _initError) {
   server.tool(
     "olam_kg_classify",
     "Route a question to kg | grep | both via the 4-layer classifier (kg-service container). Returns route + layer + reason + matched exemplar. Requires olam-kg-service running (see `olam services up`).",
@@ -31130,7 +32023,7 @@ function register25(server, _ctx, _initError) {
 // ../mcp-server/src/tools/kg-doctor.ts
 var kg_doctor_exports = {};
 __export(kg_doctor_exports, {
-  register: () => register26
+  register: () => register28
 });
 async function runProbes() {
   const results = [];
@@ -31180,7 +32073,7 @@ async function runProbes() {
   }
   return results;
 }
-function register26(server, _ctx, _initError) {
+function register28(server, _ctx, _initError) {
   server.tool(
     "olam_kg_doctor",
     "Diagnostic report for olam-kg-service over HTTP: /health readiness, workspace inventory, and /classify round-trip. Returns a JSON `probes` array. If the container isn't running, all probes fail with a hint to run `olam services up`.",
@@ -31216,17 +32109,17 @@ function register26(server, _ctx, _initError) {
 // ../mcp-server/src/tools/kg-install-hook.ts
 var kg_install_hook_exports = {};
 __export(kg_install_hook_exports, {
-  register: () => register27
+  register: () => register29
 });
 init_v3();
-import * as fs15 from "node:fs";
-import * as path17 from "node:path";
-import * as os10 from "node:os";
+import * as fs21 from "node:fs";
+import * as path23 from "node:path";
+import * as os14 from "node:os";
 
 // ../core/dist/world/merge-settings.js
-import * as fs14 from "node:fs";
-import * as path16 from "node:path";
-import * as crypto3 from "node:crypto";
+import * as fs20 from "node:fs";
+import * as path22 from "node:path";
+import * as crypto4 from "node:crypto";
 function mergeHomeSettingsJson(filePath, options) {
   let settings;
   try {
@@ -31285,10 +32178,10 @@ function mergeHomeSettingsJson(filePath, options) {
   return { status: "installed", message: `settings.json updated at ${filePath}` };
 }
 function readSettings(filePath) {
-  if (!fs14.existsSync(filePath)) {
+  if (!fs20.existsSync(filePath)) {
     return {};
   }
-  const raw = fs14.readFileSync(filePath, "utf-8");
+  const raw = fs20.readFileSync(filePath, "utf-8");
   if (!raw.trim())
     return {};
   return JSON.parse(raw);
@@ -31309,13 +32202,13 @@ function isHookSentinelPresent(matchers, sentinel) {
   return false;
 }
 function atomicWriteJson(filePath, data) {
-  const dir = path16.dirname(filePath);
-  fs14.mkdirSync(dir, { recursive: true });
-  const rand = crypto3.randomBytes(6).toString("hex");
+  const dir = path22.dirname(filePath);
+  fs20.mkdirSync(dir, { recursive: true });
+  const rand = crypto4.randomBytes(6).toString("hex");
   const tmp = `${filePath}.tmp.${process.pid}.${rand}`;
   const json = JSON.stringify(data, null, 2) + "\n";
-  fs14.writeFileSync(tmp, json, { mode: 420 });
-  fs14.renameSync(tmp, filePath);
+  fs20.writeFileSync(tmp, json, { mode: 420 });
+  fs20.renameSync(tmp, filePath);
 }
 
 // ../core/dist/kg/hook-template.js
@@ -31342,11 +32235,11 @@ try:
     sys.stderr.write(f"\\x1b[32m\\u2713 KG hit\\x1b[0m  \\"{q}\\"  \\u2192  L{layer}/{route} \\u00b7 {nodes} nodes \\u00b7 ~{saved_k}k tokens saved\\n")
     print(json.dumps({"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":f"[kg-classifier L{layer}|{route}] {label[:160]}"}}))
 except Exception: pass' 2>/dev/null`;
+  const curlPost = `RESP=$(curl -s --max-time 1 -X POST -H 'Content-Type: application/json' -d "{\\"q\\":\\"$(echo \\"$CMD\\" | head -c 200 | tr '\\"' ' ')\\"}" ${url2} 2>/dev/null)`;
   return [
     `KG_SENTINEL=${KG_HOOK_SENTINEL}`,
     `CMD=$(${extractCmd})`,
-    `case "$CMD" in *grep*|*rg\\ *|*ripgrep*|*find\\ *|*fd\\ *|*ack\\ *|*ag\\ *)`,
-    `RESP=$(curl -s --max-time 1 -X POST -H 'Content-Type: application/json' -d "{\\"q\\":\\"$(echo \\"$CMD\\" | head -c 200 | tr '\\"' ' ')\\"}" ${url2} 2>/dev/null)`,
+    `case "$CMD" in *grep*|*rg\\ *|*ripgrep*|*find\\ *|*fd\\ *|*ack\\ *|*ag\\ *) ${curlPost}`,
     `KG_QUERY="$(echo \\"$CMD\\" | head -c 60 | tr '\\"' ' ')" echo "$RESP" | ${emitContext}`,
     `;; esac`
   ].join("; ");
@@ -31366,12 +32259,12 @@ function buildHookMatcherEntry(opts) {
 // ../mcp-server/src/tools/kg-install-hook.ts
 function settingsPathFor(scope, projectPath) {
   if (scope === "user") {
-    return path17.join(os10.homedir(), ".claude", "settings.json");
+    return path23.join(os14.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path17.join(root, ".claude", "settings.json");
+  return path23.join(root, ".claude", "settings.json");
 }
-function register27(server, _ctx, _initError) {
+function register29(server, _ctx, _initError) {
   server.tool(
     "olam_kg_install_hook",
     "Install the kg-service PreToolUse hook into .claude/settings.json. Idempotent (sentinel-detected). Default scope=project (writes <cwd>/.claude/settings.json); scope=user writes ~/.claude/settings.json.",
@@ -31383,12 +32276,12 @@ function register27(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor(scope, params.projectPath);
       try {
-        fs15.mkdirSync(path17.dirname(filePath), { recursive: true });
+        fs21.mkdirSync(path23.dirname(filePath), { recursive: true });
         let backupPath = null;
-        if (fs15.existsSync(filePath)) {
+        if (fs21.existsSync(filePath)) {
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
           backupPath = `${filePath}.olam-bak.${ts}`;
-          fs15.copyFileSync(filePath, backupPath);
+          fs21.copyFileSync(filePath, backupPath);
         }
         const result = mergeHomeSettingsJson(filePath, {
           ensureHook: {
@@ -31399,7 +32292,7 @@ function register27(server, _ctx, _initError) {
         });
         if (result.status === "already-present" && backupPath) {
           try {
-            fs15.unlinkSync(backupPath);
+            fs21.unlinkSync(backupPath);
           } catch {
           }
         }
@@ -31440,18 +32333,18 @@ function register27(server, _ctx, _initError) {
 // ../mcp-server/src/tools/kg-uninstall-hook.ts
 var kg_uninstall_hook_exports = {};
 __export(kg_uninstall_hook_exports, {
-  register: () => register28
+  register: () => register30
 });
 init_v3();
-import * as fs16 from "node:fs";
-import * as path18 from "node:path";
-import * as os11 from "node:os";
+import * as fs22 from "node:fs";
+import * as path24 from "node:path";
+import * as os15 from "node:os";
 function settingsPathFor2(scope, projectPath) {
   if (scope === "user") {
-    return path18.join(os11.homedir(), ".claude", "settings.json");
+    return path24.join(os15.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path18.join(root, ".claude", "settings.json");
+  return path24.join(root, ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -31473,7 +32366,7 @@ function dropSentinel(matchers) {
   }
   return { matchers: out, changed };
 }
-function register28(server, _ctx, _initError) {
+function register30(server, _ctx, _initError) {
   server.tool(
     "olam_kg_uninstall_hook",
     "Remove the kg-service PreToolUse hook from .claude/settings.json. Sentinel-matched: only the olam entry is removed; other PreToolUse hooks are preserved.",
@@ -31485,7 +32378,7 @@ function register28(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor2(scope, params.projectPath);
       try {
-        if (!fs16.existsSync(filePath)) {
+        if (!fs22.existsSync(filePath)) {
           return {
             content: [
               {
@@ -31499,7 +32392,7 @@ function register28(server, _ctx, _initError) {
             ]
           };
         }
-        const raw = fs16.readFileSync(filePath, "utf-8");
+        const raw = fs22.readFileSync(filePath, "utf-8");
         const settings = raw.trim() ? JSON.parse(raw) : {};
         const preToolUse = settings.hooks?.PreToolUse;
         if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
@@ -31534,7 +32427,7 @@ function register28(server, _ctx, _initError) {
         const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         const backupPath = `${filePath}.olam-bak.${ts}`;
         try {
-          fs16.copyFileSync(filePath, backupPath);
+          fs22.copyFileSync(filePath, backupPath);
         } catch {
         }
         const next = {
@@ -31546,7 +32439,7 @@ function register28(server, _ctx, _initError) {
           if (otherStages.length === 0) delete next.hooks;
           else delete next.hooks.PreToolUse;
         }
-        fs16.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+        fs22.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
         return {
           content: [
             {
@@ -31606,6 +32499,8 @@ var toolModules = [
   repo_exports,
   process_port_exports,
   runbook_exports,
+  skill_source_exports,
+  skills_exports,
   kg_classify_exports,
   kg_doctor_exports,
   kg_install_hook_exports,
@@ -31757,11 +32652,11 @@ function assertBetterSqlite3Loadable(deps = {}) {
 init_loader();
 
 // ../core/dist/world/manager.js
-import * as crypto6 from "node:crypto";
+import * as crypto7 from "node:crypto";
 import { execSync as execSync5, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs25 from "node:fs";
-import * as os15 from "node:os";
-import * as path28 from "node:path";
+import * as fs31 from "node:fs";
+import * as os19 from "node:os";
+import * as path34 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -31856,9 +32751,9 @@ function resolveDevboxImage(config2, tag) {
 }
 
 // ../core/dist/world/worktree.js
-import { execFileSync as execFileSync2 } from "node:child_process";
-import * as fs17 from "node:fs";
-import * as path19 from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import * as fs23 from "node:fs";
+import * as path25 from "node:path";
 function resolveGitDir(repo) {
   if (repo.path) {
     return repo.path;
@@ -31868,18 +32763,18 @@ function resolveGitDir(repo) {
 async function createWorktrees(repos, worldId, workspacePath, branch) {
   const created = [];
   for (const repo of repos) {
-    const worktreePath = path19.join(workspacePath, repo.name);
+    const worktreePath = path25.join(workspacePath, repo.name);
     const gitDir = resolveGitDir(repo);
     const branchName = branch || `olam/${worldId}`;
     try {
-      fs17.mkdirSync(path19.dirname(worktreePath), { recursive: true });
-      execFileSync2("git", ["worktree", "add", worktreePath, "-b", branchName], {
+      fs23.mkdirSync(path25.dirname(worktreePath), { recursive: true });
+      execFileSync3("git", ["worktree", "add", worktreePath, "-b", branchName], {
         cwd: gitDir,
         stdio: "pipe"
       });
       if (repo.submodules) {
         try {
-          execFileSync2("git", ["submodule", "update", "--init", "--recursive"], {
+          execFileSync3("git", ["submodule", "update", "--init", "--recursive"], {
             cwd: worktreePath,
             stdio: "pipe"
           });
@@ -31891,7 +32786,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
       for (const entry of created) {
         try {
           const entryGitDir = resolveGitDir(entry.repo);
-          execFileSync2("git", ["worktree", "remove", entry.worktreePath, "--force"], {
+          execFileSync3("git", ["worktree", "remove", entry.worktreePath, "--force"], {
             cwd: entryGitDir,
             stdio: "pipe"
           });
@@ -31905,7 +32800,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
 }
 async function removeWorktrees(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path19.join(workspacePath, repo.name);
+    const worktreePath = path25.join(workspacePath, repo.name);
     let gitDir;
     try {
       gitDir = resolveGitDir(repo);
@@ -31914,7 +32809,7 @@ async function removeWorktrees(repos, workspacePath) {
     }
     let removed = false;
     try {
-      execFileSync2("git", ["worktree", "remove", "--force", worktreePath], {
+      execFileSync3("git", ["worktree", "remove", "--force", worktreePath], {
         cwd: gitDir,
         stdio: "pipe"
       });
@@ -31923,7 +32818,7 @@ async function removeWorktrees(repos, workspacePath) {
     }
     if (!removed) {
       try {
-        execFileSync2("git", ["worktree", "prune"], {
+        execFileSync3("git", ["worktree", "prune"], {
           cwd: gitDir,
           stdio: "pipe"
         });
@@ -31940,7 +32835,7 @@ function removeBranch(repo, branch) {
     return { branch, action: "not-found" };
   }
   try {
-    execFileSync2("git", ["show-ref", "--quiet", `refs/heads/${branch}`], {
+    execFileSync3("git", ["show-ref", "--quiet", `refs/heads/${branch}`], {
       cwd: gitDir,
       stdio: "pipe"
     });
@@ -31949,7 +32844,7 @@ function removeBranch(repo, branch) {
   }
   let hasUpstream = false;
   try {
-    execFileSync2("git", ["rev-parse", "--abbrev-ref", `${branch}@{upstream}`], { cwd: gitDir, stdio: "pipe" });
+    execFileSync3("git", ["rev-parse", "--abbrev-ref", `${branch}@{upstream}`], { cwd: gitDir, stdio: "pipe" });
     hasUpstream = true;
   } catch {
   }
@@ -31958,14 +32853,14 @@ function removeBranch(repo, branch) {
   }
   let localCommitCount = 0;
   try {
-    const output = execFileSync2("git", ["rev-list", "--count", branch, "--not", "--remotes"], { cwd: gitDir, stdio: "pipe" }).toString().trim();
+    const output = execFileSync3("git", ["rev-list", "--count", branch, "--not", "--remotes"], { cwd: gitDir, stdio: "pipe" }).toString().trim();
     localCommitCount = parseInt(output, 10) || 0;
   } catch {
     localCommitCount = 1;
   }
   if (localCommitCount === 0) {
     try {
-      execFileSync2("git", ["branch", "-D", branch], {
+      execFileSync3("git", ["branch", "-D", branch], {
         cwd: gitDir,
         stdio: "pipe"
       });
@@ -31979,13 +32874,13 @@ function removeBranch(repo, branch) {
 }
 
 // ../core/dist/world/kg-overlay.js
-import { execFileSync as execFileSync3 } from "node:child_process";
-import * as fs18 from "node:fs";
-import * as path20 from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import * as fs24 from "node:fs";
+import * as path26 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
-import { homedir as homedir12 } from "node:os";
-import { join as join20, resolve as resolve5 } from "node:path";
+import { homedir as homedir16 } from "node:os";
+import { join as join26, resolve as resolve5 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
 var InvalidWorkspaceNameError = class extends Error {
@@ -32006,25 +32901,25 @@ function validateWorkspaceName(name) {
 
 // ../core/dist/kg/storage-paths.js
 function olamHome() {
-  return process.env.OLAM_HOME ?? join20(homedir12(), ".olam");
+  return process.env.OLAM_HOME ?? join26(homedir16(), ".olam");
 }
 function kgRoot() {
-  return join20(olamHome(), "kg");
+  return join26(olamHome(), "kg");
 }
 function worldsRoot() {
-  return join20(olamHome(), "worlds");
+  return join26(olamHome(), "worlds");
 }
-function assertWithinPrefix(path31, prefix, label) {
-  if (!path31.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path31} not under ${prefix}/`);
+function assertWithinPrefix(path37, prefix, label) {
+  if (!path37.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path37} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path31 = resolve5(join20(root, workspace));
-  assertWithinPrefix(path31, root, "kgPristinePath");
-  return path31;
+  const path37 = resolve5(join26(root, workspace));
+  assertWithinPrefix(path37, root, "kgPristinePath");
+  return path37;
 }
 var KG_PATHS_INTERNALS = Object.freeze({
   olamHome,
@@ -32040,10 +32935,10 @@ var KgOverlayError = class extends Error {
   }
 };
 function ensureGitignoreEntry(worldClonePath) {
-  const gitignorePath = path20.join(worldClonePath, ".gitignore");
-  if (!fs18.existsSync(gitignorePath))
+  const gitignorePath = path26.join(worldClonePath, ".gitignore");
+  if (!fs24.existsSync(gitignorePath))
     return "no-gitignore";
-  const content = fs18.readFileSync(gitignorePath, "utf-8");
+  const content = fs24.readFileSync(gitignorePath, "utf-8");
   const lines = content.split("\n").map((l) => l.trim());
   const recognised = /* @__PURE__ */ new Set([
     "graphify-out",
@@ -32058,31 +32953,31 @@ function ensureGitignoreEntry(worldClonePath) {
   const eol = content.includes("\r\n") ? "\r\n" : "\n";
   const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
   const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
-  fs18.appendFileSync(gitignorePath, block, "utf-8");
+  fs24.appendFileSync(gitignorePath, block, "utf-8");
   return "appended";
 }
 function createWorldOverlay(opts) {
   const pristineRoot = kgPristinePath(opts.workspace);
-  const pristinePath = path20.join(pristineRoot, "graphify-out");
-  if (!fs18.existsSync(pristinePath)) {
+  const pristinePath = path26.join(pristineRoot, "graphify-out");
+  if (!fs24.existsSync(pristinePath)) {
     throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
   }
-  if (!path20.isAbsolute(opts.worldClonePath)) {
+  if (!path26.isAbsolute(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
   }
-  if (!fs18.existsSync(opts.worldClonePath)) {
+  if (!fs24.existsSync(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
   }
-  const overlayPath = path20.join(opts.worldClonePath, "graphify-out");
-  if (fs18.existsSync(overlayPath)) {
-    fs18.rmSync(overlayPath, { recursive: true, force: true });
+  const overlayPath = path26.join(opts.worldClonePath, "graphify-out");
+  if (fs24.existsSync(overlayPath)) {
+    fs24.rmSync(overlayPath, { recursive: true, force: true });
   }
   const useReflink = process.platform === "darwin";
   let strategy;
   let reflinkError;
   if (useReflink) {
     try {
-      execFileSync3("cp", ["-c", "-r", pristinePath, opts.worldClonePath], {
+      execFileSync4("cp", ["-c", "-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
       });
       strategy = "cp-c-r-reflink";
@@ -32093,9 +32988,9 @@ function createWorldOverlay(opts) {
   } else {
     strategy = "cp-r";
   }
-  if (strategy === "cp-r" || !fs18.existsSync(overlayPath)) {
+  if (strategy === "cp-r" || !fs24.existsSync(overlayPath)) {
     try {
-      execFileSync3("cp", ["-r", pristinePath, opts.worldClonePath], {
+      execFileSync4("cp", ["-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
       });
       strategy = "cp-r";
@@ -32105,7 +33000,7 @@ function createWorldOverlay(opts) {
       throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
     }
   }
-  if (!fs18.existsSync(overlayPath)) {
+  if (!fs24.existsSync(overlayPath)) {
     throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
   }
   const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
@@ -32118,13 +33013,13 @@ function createWorldOverlay(opts) {
 }
 
 // ../core/dist/world/baseline-diff.js
-import { execFileSync as execFileSync4 } from "node:child_process";
-import * as fs19 from "node:fs";
-import * as os12 from "node:os";
-import * as path21 from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import * as fs25 from "node:fs";
+import * as os16 from "node:os";
+import * as path27 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
-function expandHome2(p, homedir18) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir18());
+function expandHome2(p, homedir22) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir22());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -32146,11 +33041,11 @@ ${stderr}`;
   return /unknown revision|bad revision|does not have any commits|HEAD'?: ambiguous|Needed a single revision/.test(blob);
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir18 = deps.homedir ?? (() => os12.homedir());
-  const baselineDir = path21.join(workspacePath, ".olam", "baseline");
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync5(cmd, args, opts));
+  const homedir22 = deps.homedir ?? (() => os16.homedir());
+  const baselineDir = path27.join(workspacePath, ".olam", "baseline");
   try {
-    fs19.mkdirSync(baselineDir, { recursive: true });
+    fs25.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -32162,9 +33057,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path21.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir18);
-    if (!fs19.existsSync(repoPath)) {
+    const outPath = path27.join(baselineDir, filename);
+    const repoPath = expandHome2(repo.path, homedir22);
+    if (!fs25.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -32231,7 +33126,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs19.writeFileSync(outPath, content);
+    fs25.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -32239,11 +33134,11 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path21.join(workspacePath, repo.name);
-    if (!fs19.existsSync(worktreePath))
+    const worktreePath = path27.join(workspacePath, repo.name);
+    if (!fs25.existsSync(worktreePath))
       continue;
     try {
-      execFileSync4("git", ["checkout", "--", "."], {
+      execFileSync5("git", ["checkout", "--", "."], {
         cwd: worktreePath,
         stdio: "pipe"
       });
@@ -32270,7 +33165,7 @@ ${stderr.trim()}` : "";
   }
 };
 function captureOperatorDiff(repoPath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync5(cmd, args, opts));
   const unstaged = exec("git", ["diff"], {
     cwd: repoPath,
     encoding: "utf-8",
@@ -32298,22 +33193,22 @@ function extractStderr(err) {
   return typeof raw === "string" ? raw : raw.toString("utf-8");
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir18 = deps.homedir ?? (() => os12.homedir());
-  const existsSync27 = deps.existsSync ?? ((p) => fs19.existsSync(p));
-  const copyFileSync6 = deps.copyFileSync ?? ((src, dest) => fs19.copyFileSync(src, dest));
-  const mkdirSync18 = deps.mkdirSync ?? ((dirPath, opts) => {
-    fs19.mkdirSync(dirPath, opts);
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync5(cmd, args, opts));
+  const homedir22 = deps.homedir ?? (() => os16.homedir());
+  const existsSync33 = deps.existsSync ?? ((p) => fs25.existsSync(p));
+  const copyFileSync7 = deps.copyFileSync ?? ((src, dest) => fs25.copyFileSync(src, dest));
+  const mkdirSync21 = deps.mkdirSync ?? ((dirPath, opts) => {
+    fs25.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir18);
-    const worktreePath = path21.join(workspacePath, repo.name);
-    if (!existsSync27(repoPath))
+    const repoPath = expandHome2(repo.path, homedir22);
+    const worktreePath = path27.join(workspacePath, repo.name);
+    if (!existsSync33(repoPath))
       continue;
-    if (!existsSync27(worktreePath)) {
+    if (!existsSync33(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -32371,13 +33266,13 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
       }
     }
     for (const rel of plan.diff.untracked) {
-      const src = path21.join(plan.repoPath, rel);
-      const dest = path21.join(plan.worktreePath, rel);
-      if (!existsSync27(src))
+      const src = path27.join(plan.repoPath, rel);
+      const dest = path27.join(plan.worktreePath, rel);
+      if (!existsSync33(src))
         continue;
       try {
-        mkdirSync18(path21.dirname(dest), { recursive: true });
-        copyFileSync6(src, dest);
+        mkdirSync21(path27.dirname(dest), { recursive: true });
+        copyFileSync7(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         console.warn(`[carry] ${plan.name}: copy untracked ${rel} failed: ${msg}`);
@@ -32402,8 +33297,8 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs20 from "node:fs";
-import * as path22 from "node:path";
+import * as fs26 from "node:fs";
+import * as path28 from "node:path";
 
 // ../core/dist/world/templates/_generated.js
 var GH_PR_CREATE = '# Creating PRs from inside an Olam world\n\n## The problem\n\nCalling `gh pr create` directly inside an Olam container **hangs forever** on a\nTTY confirmation prompt that the agent cannot answer. This is a known, reproduced issue.\n\n## The fix\n\nAlways use this exact pattern:\n\n```bash\necho y | timeout 30 gh pr create \\\n  --base main \\\n  --head <branch> \\\n  --title "<title>" \\\n  --body-file /tmp/pr-body.md\n```\n\n## Why each part matters\n\n- **`echo y |`** \u2014 answers the "Submit?" confirmation prompt up front so `gh` never pauses.\n- **`timeout 30`** \u2014 hard deadline. If `gh` hangs anyway, the command exits non-zero so the\n  agent can react instead of stalling the world indefinitely.\n- **`--body-file /tmp/pr-body.md`** \u2014 write the PR body to a temp file first. Avoids\n  shell-escaping bugs that occur with `--body "..."` for long or multi-line bodies.\n- **`--head` and `--base` explicitly** \u2014 removes all interactive prompts; `gh` has nothing to ask.\n\n## Troubleshooting\n\n**"no commits" or "branch not found" error:**\n\n```bash\ngit push -u origin <branch>\n# then retry:\necho y | timeout 30 gh pr create --base main --head <branch> --title "..." --body-file /tmp/pr-body.md\n```\n\n**Timeout exceeded (command exits 124):**\n\n- Check if the branch was pushed: `git log origin/<branch> --oneline -1`\n- Check GitHub CLI auth: `gh auth status`\n- Retry once; if it hangs again, open the PR via the GitHub web UI.\n';
@@ -32413,10 +33308,10 @@ var WORLD_CLAUDE_MD = '# Olam World: {{worldName}}\n\n{{taskBlock}}\n\n## Enviro
 // ../core/dist/world/context-injection.js
 function injectWorldContext(opts) {
   const { world } = opts;
-  const claudeDir = path22.join(world.workspacePath, ".claude");
-  fs20.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir2 = path28.join(world.workspacePath, ".claude");
+  fs26.mkdirSync(claudeDir2, { recursive: true });
   const content = WORLD_CLAUDE_MD.replace("{{worldName}}", world.name).replace("{{worldId}}", world.id).replace("{{branch}}", world.branch).replace("{{taskBlock}}", buildTaskBlock(opts)).replace("{{reposList}}", buildReposList(world)).replace("{{servicesLine}}", buildServicesLine(opts.services)).replace("{{pleriPlaneLine}}", buildPleriPlaneLine(opts.pleriPlaneUrl)).replace("{{planFileBlock}}", buildPlanFileBlock(world)).replace("{{extraContextBlock}}", buildExtraContextBlock(opts.claudeMdExtra));
-  fs20.writeFileSync(path22.join(claudeDir, "CLAUDE.md"), content);
+  fs26.writeFileSync(path28.join(claudeDir2, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function buildTaskBlock(opts) {
@@ -32490,10 +33385,10 @@ function buildExtraContextBlock(extra) {
 ${extra}`;
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path22.join(workspacePath, ".olam", "docs");
-  fs20.mkdirSync(docsDir, { recursive: true });
-  fs20.writeFileSync(path22.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
-  fs20.writeFileSync(path22.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
+  const docsDir = path28.join(workspacePath, ".olam", "docs");
+  fs26.mkdirSync(docsDir, { recursive: true });
+  fs26.writeFileSync(path28.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
+  fs26.writeFileSync(path28.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -32507,9 +33402,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path22.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path28.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs20.existsSync(plansDir) && fs20.readdirSync(plansDir).length > 0;
+    return fs26.existsSync(plansDir) && fs26.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -32737,7 +33632,7 @@ async function installStack(exec, repos, stacks) {
 
 // ../core/dist/world/stack-image.js
 import { execSync as execSync3 } from "node:child_process";
-import * as crypto4 from "node:crypto";
+import * as crypto5 from "node:crypto";
 var BASE_IMAGE = "olam-devbox";
 var LABEL_PREFIX = "olam.stack-image";
 var MAX_TAG_LENGTH = 128;
@@ -32793,7 +33688,7 @@ function getImageDigest(imageRef) {
     cachedImageDigests.set(imageRef, short);
     return short;
   } catch {
-    const fallback = crypto4.createHash("sha256").update(imageRef).digest("hex").slice(0, 16);
+    const fallback = crypto5.createHash("sha256").update(imageRef).digest("hex").slice(0, 16);
     cachedImageDigests.set(imageRef, fallback);
     return fallback;
   }
@@ -32804,7 +33699,7 @@ function getBaseImageDigest() {
 function sanitizeTag(raw) {
   let tag = raw.toLowerCase().replace(/[^a-z0-9._-]/g, "-");
   if (tag.length > MAX_TAG_LENGTH) {
-    const hash = crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 12);
+    const hash = crypto5.createHash("sha256").update(raw).digest("hex").slice(0, 12);
     tag = tag.slice(0, MAX_TAG_LENGTH - 13) + "_" + hash;
   }
   return tag;
@@ -33080,26 +33975,26 @@ function shellQuote(s) {
 init_repo_manifest();
 
 // ../core/dist/world/snapshot.js
-import * as crypto5 from "node:crypto";
-import * as fs21 from "node:fs";
-import * as os13 from "node:os";
-import * as path23 from "node:path";
-import { execFileSync as execFileSync5, spawn as spawn2 } from "node:child_process";
+import * as crypto6 from "node:crypto";
+import * as fs27 from "node:fs";
+import * as os17 from "node:os";
+import * as path29 from "node:path";
+import { execFileSync as execFileSync6, spawn as spawn2 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path23.join(os13.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path29.join(os17.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDirByWorkspace(workspace, arch, kind) {
-  return path23.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
+  return path29.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path23.join(snapshotsDir(), worldId);
+  const legacyDir = path29.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs21.existsSync(legacyDir))
+  if (!fs27.existsSync(legacyDir))
     return;
   try {
-    fs21.rmSync(legacyDir, { recursive: true, force: true });
+    fs27.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -33108,7 +34003,7 @@ function manifestPath(tarPath) {
 }
 function hashBuffers(entries) {
   const sorted = [...entries].sort((a, b) => a.path.localeCompare(b.path));
-  const hash = crypto5.createHash("sha256");
+  const hash = crypto6.createHash("sha256");
   for (const entry of sorted) {
     hash.update(entry.path);
     hash.update("\0");
@@ -33118,11 +34013,11 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path23.join(repoDir, "Gemfile.lock");
-  if (!fs21.existsSync(lockfile))
+  const lockfile = path29.join(repoDir, "Gemfile.lock");
+  if (!fs27.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs21.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs27.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -33132,10 +34027,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path23.join(repoDir, name);
-    if (fs21.existsSync(lockfile)) {
+    const lockfile = path29.join(repoDir, name);
+    if (fs27.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs21.readFileSync(lockfile) }
+        { path: name, content: fs27.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -33154,18 +34049,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path23.dirname(destDir);
-  fs21.mkdirSync(parent, { recursive: true });
-  const tmpSuffix = `.tmp-${process.pid}-${crypto5.randomBytes(4).toString("hex")}`;
+  const parent = path29.dirname(destDir);
+  fs27.mkdirSync(parent, { recursive: true });
+  const tmpSuffix = `.tmp-${process.pid}-${crypto6.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs21.mkdirSync(tmpDir, { recursive: true });
-    execFileSync5("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs21.renameSync(tmpDir, destDir);
+    fs27.mkdirSync(tmpDir, { recursive: true });
+    execFileSync6("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
+    fs27.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs21.rmSync(tmpDir, { recursive: true, force: true });
+      fs27.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -33176,12 +34071,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path23.resolve(base, target);
-  const baseResolved = path23.resolve(base);
-  const rel = path23.relative(baseResolved, resolved);
+  const resolved = path29.resolve(base, target);
+  const baseResolved = path29.resolve(base);
+  const rel = path29.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path23.isAbsolute(rel);
+  return !rel.startsWith("..") && !path29.isAbsolute(rel);
 }
 var TYPE_CHAR_TO_TYPE = {
   "-": "file",
@@ -33231,7 +34126,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs21.readFileSync(tarPath));
+    raw = gunzipSync(fs27.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -33246,7 +34141,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path23.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path29.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -33264,7 +34159,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
 function enumerateAndValidateTarballEntries(tarPath, targetDir) {
   let raw;
   try {
-    raw = execFileSync5("tar", ["-tvf", tarPath], {
+    raw = execFileSync6("tar", ["-tvf", tarPath], {
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
       encoding: "utf-8",
@@ -33284,7 +34179,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path23.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path29.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -33292,8 +34187,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path23.join(targetDir, path23.dirname(entry.name));
-      if (path23.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path23.join(path23.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path29.join(targetDir, path29.dirname(entry.name));
+      if (path29.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path29.join(path29.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -33303,7 +34198,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path23.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path29.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -33336,8 +34231,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path23.join(archDir, tarFilename);
-      if (!fs21.existsSync(tarPath)) {
+      const tarPath = path29.join(archDir, tarFilename);
+      if (!fs27.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -33352,9 +34247,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path23.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path29.join(repo.worktreeDir, targetSubpath);
       try {
-        fs21.rmSync(targetDir, { recursive: true, force: true });
+        fs27.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -33367,8 +34262,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs21.rmSync(tarPath, { force: true });
-          fs21.rmSync(manifestPath(tarPath), { force: true });
+          fs27.rmSync(tarPath, { force: true });
+          fs27.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -33384,10 +34279,10 @@ function restoreSnapshotsForRepos(input) {
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs21.existsSync(mPath))
+  if (!fs27.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs21.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs27.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
@@ -33402,17 +34297,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs21.mkdirSync(dir, { recursive: true });
-  const lockPath = path23.join(dir, EVICT_LOCK_FILENAME);
+  fs27.mkdirSync(dir, { recursive: true });
+  const lockPath = path29.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs21.openSync(lockPath, fs21.constants.O_WRONLY | fs21.constants.O_CREAT | fs21.constants.O_EXCL, 384);
+    fd = fs27.openSync(lockPath, fs27.constants.O_WRONLY | fs27.constants.O_CREAT | fs27.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs21.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs27.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -33420,23 +34315,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs21.unlinkSync(lockPath);
-      fd = fs21.openSync(lockPath, fs21.constants.O_WRONLY | fs21.constants.O_CREAT | fs21.constants.O_EXCL, 384);
+      fs27.unlinkSync(lockPath);
+      fd = fs27.openSync(lockPath, fs27.constants.O_WRONLY | fs27.constants.O_CREAT | fs27.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs21.writeSync(fd, `${process.pid}
+    fs27.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs21.closeSync(fd);
+    fs27.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs21.unlinkSync(lockPath);
+      fs27.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -33469,16 +34364,16 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs21.existsSync(dir))
+  if (!fs27.existsSync(dir))
     return 0;
   const allTars = [];
   const walk = (d) => {
-    for (const entry of fs21.readdirSync(d, { withFileTypes: true })) {
-      const full = path23.join(d, entry.name);
+    for (const entry of fs27.readdirSync(d, { withFileTypes: true })) {
+      const full = path29.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat = fs21.statSync(full);
+        const stat = fs27.statSync(full);
         allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
       }
     }
@@ -33493,8 +34388,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs21.rmSync(tar.path, { force: true });
-    fs21.rmSync(manifestPath(tar.path), { force: true });
+    fs27.rmSync(tar.path, { force: true });
+    fs27.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -33611,14 +34506,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 
 // ../core/dist/world/olam-yaml.js
 init_repo_manifest();
-import * as path24 from "node:path";
+import * as path30 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path24.join(workspacePath, repo.name);
+    const repoDir = path30.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -33633,8 +34528,8 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs22 from "node:fs";
-import * as path25 from "node:path";
+import * as fs28 from "node:fs";
+import * as path31 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function parseFrontmatter(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -33654,20 +34549,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path25.join(workspaceRoot, ".olam", "policies");
-  if (!fs22.existsSync(policiesDir))
+  const policiesDir = path31.join(workspaceRoot, ".olam", "policies");
+  if (!fs28.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs22.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs28.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path25.join(policiesDir, file);
+    const filePath = path31.join(policiesDir, file);
     try {
-      const content = fs22.readFileSync(filePath, "utf8");
+      const content = fs28.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -33809,12 +34704,12 @@ async function autoDispatchTask(opts) {
 }
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs23 from "node:fs";
-import * as os14 from "node:os";
-import * as path26 from "node:path";
+import * as fs29 from "node:fs";
+import * as os18 from "node:os";
+import * as path32 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path26.join(os14.homedir(), p.slice(1));
+    return path32.join(os18.homedir(), p.slice(1));
   }
   return p;
 }
@@ -33826,7 +34721,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs23.existsSync(resolvedPath)) {
+    if (!fs29.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -33839,19 +34734,19 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
 }
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs24 from "node:fs";
-import * as path27 from "node:path";
+import * as fs30 from "node:fs";
+import * as path33 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path27.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path27.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path27.dirname(destAbs);
-    fs24.mkdirSync(destDir, { recursive: true });
-    fs24.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path33.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path33.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path33.dirname(destAbs);
+    fs30.mkdirSync(destDir, { recursive: true });
+    fs30.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -34487,7 +35382,7 @@ ${detail}`);
       runbookSeeds = resolved.seeds;
     }
     const worldId = generateWorldId();
-    const workspacePath = path28.join(os15.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path34.join(os19.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = this.resolveReposWithWorkspace(opts);
@@ -34568,38 +35463,38 @@ ${detail}`);
     for (const repo of repos) {
       if (!repo.path)
         continue;
-      const sourceRoot = repo.path.replace(/^~/, os15.homedir());
-      const worktreeRoot = path28.join(workspacePath, repo.name);
-      if (!fs25.existsSync(sourceRoot) || !fs25.existsSync(worktreeRoot))
+      const sourceRoot = repo.path.replace(/^~/, os19.homedir());
+      const worktreeRoot = path34.join(workspacePath, repo.name);
+      if (!fs31.existsSync(sourceRoot) || !fs31.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path28.dirname(pattern), path28.basename(pattern)];
-          const sourceDir = path28.join(sourceRoot, dir);
-          if (fs25.existsSync(sourceDir)) {
+          const [dir, glob] = [path34.dirname(pattern), path34.basename(pattern)];
+          const sourceDir = path34.join(sourceRoot, dir);
+          if (fs31.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs25.readdirSync(sourceDir)) {
+              for (const entry of fs31.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path28.join(dir, entry));
+                  matches2.push(path34.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs25.existsSync(path28.join(sourceRoot, pattern))) {
+        } else if (fs31.existsSync(path34.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path28.join(sourceRoot, rel);
-          const dst = path28.join(worktreeRoot, rel);
+          const src = path34.join(sourceRoot, rel);
+          const dst = path34.join(worktreeRoot, rel);
           try {
-            const st = fs25.statSync(src);
+            const st = fs31.statSync(src);
             if (!st.isFile())
               continue;
-            fs25.mkdirSync(path28.dirname(dst), { recursive: true });
-            fs25.copyFileSync(src, dst);
+            fs31.mkdirSync(path34.dirname(dst), { recursive: true });
+            fs31.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -34685,7 +35580,7 @@ ${detail}`);
     }
     const overlayAttachments = [];
     for (const repo of repos) {
-      const worldClonePath = path28.join(workspacePath, repo.name);
+      const worldClonePath = path34.join(workspacePath, repo.name);
       try {
         const result = createWorldOverlay({
           workspace: repo.name,
@@ -34740,7 +35635,7 @@ ${detail}`);
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path28.join(workspacePath, repo.name);
+          const repoDir = path34.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -34784,10 +35679,10 @@ ${detail}`);
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path28.join(os15.homedir(), ".olam", "r2-credentials.json");
-      if (fs25.existsSync(r2CredsPath)) {
+      const r2CredsPath = path34.join(os19.homedir(), ".olam", "r2-credentials.json");
+      if (fs31.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs25.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs31.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -34804,10 +35699,10 @@ ${detail}`);
         } catch {
         }
       }
-      const keysYamlPath = path28.join(os15.homedir(), ".olam", "keys.yaml");
-      if (fs25.existsSync(keysYamlPath)) {
+      const keysYamlPath = path34.join(os19.homedir(), ".olam", "keys.yaml");
+      if (fs31.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs25.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs31.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const parsed = YAML3.parse(keysRaw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -34866,10 +35761,10 @@ ${detail}`);
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path28.join(workspacePath, repoName, relativePath);
+          const absPath = path34.join(workspacePath, repoName, relativePath);
           try {
-            fs25.mkdirSync(path28.dirname(absPath), { recursive: true });
-            fs25.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs31.mkdirSync(path34.dirname(absPath), { recursive: true });
+            fs31.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -35040,7 +35935,7 @@ ${detail}`);
         imageDigest: void 0,
         repos: enrichedRepos.map((r) => ({
           name: r.name,
-          worktreeDir: path28.join(workspacePath, r.name)
+          worktreeDir: path34.join(workspacePath, r.name)
         }))
       });
       for (const out of restoreResult.outcomes) {
@@ -35146,7 +36041,7 @@ ${detail}`);
     }
     if (opts.task) {
       const allPolicies = repos.flatMap((repo) => {
-        const repoWorktree = path28.join(workspacePath, repo.name);
+        const repoWorktree = path34.join(workspacePath, repo.name);
         try {
           return loadPolicies(repoWorktree);
         } catch (err) {
@@ -35159,8 +36054,8 @@ ${detail}`);
         try {
           execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
           for (const repo of repos) {
-            const policiesDir = path28.join(workspacePath, repo.name, ".olam", "policies");
-            if (fs25.existsSync(policiesDir)) {
+            const policiesDir = path34.join(workspacePath, repo.name, ".olam", "policies");
+            if (fs31.existsSync(policiesDir)) {
               execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
             }
           }
@@ -35268,8 +36163,8 @@ ${detail}`);
     } catch {
     }
     try {
-      fs25.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs25.existsSync(world.workspacePath)) {
+      fs31.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs31.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -35378,14 +36273,14 @@ ${detail}`);
     }).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs25.readFileSync(planFilePath, "utf-8");
-    const planFileName = path28.basename(planFilePath);
+    const planContent = fs31.readFileSync(planFilePath, "utf-8");
+    const planFileName = path34.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path28.join(workspacePath, targetRepo, "docs", "plans");
-    fs25.mkdirSync(plansDir, { recursive: true });
-    fs25.writeFileSync(path28.join(plansDir, planFileName), planContent);
+    const plansDir = path34.join(workspacePath, targetRepo, "docs", "plans");
+    fs31.mkdirSync(plansDir, { recursive: true });
+    fs31.writeFileSync(path34.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -35688,7 +36583,7 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
   return { worldRoleName, password };
 }
 function defaultPasswordGenerator() {
-  return crypto6.randomBytes(24).toString("base64url");
+  return crypto7.randomBytes(24).toString("base64url");
 }
 function escapeSqlLiteral(s) {
   return s.replace(/'/g, "''");
@@ -35819,8 +36714,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs26 from "node:fs";
-import * as path29 from "node:path";
+import * as fs32 from "node:fs";
+import * as path35 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -36155,7 +37050,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs26.existsSync(dbPath))
+  if (!fs32.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -36326,13 +37221,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port: port2, registry: registry2 } = opts;
-  const thisDir = path29.dirname(fileURLToPath2(import.meta.url));
-  const defaultPublicDir = path29.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path35.dirname(fileURLToPath2(import.meta.url));
+  const defaultPublicDir = path35.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs26.existsSync(publicDir);
+  let hasPublicDir = fs32.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs26.existsSync(publicDir);
+      hasPublicDir = fs32.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port2}`;
     const url2 = new URL(req.url ?? "/", `http://${host}`);
@@ -36606,22 +37501,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path29.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path35.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs26.existsSync(filePath) && fs26.statSync(filePath).isFile()) {
-      const ext = path29.extname(filePath);
+    if (fs32.existsSync(filePath) && fs32.statSync(filePath).isFile()) {
+      const ext = path35.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs26.createReadStream(filePath).pipe(res);
+      fs32.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path29.join(publicDir, "index.html");
-    if (fs26.existsSync(filePath)) {
+    filePath = path35.join(publicDir, "index.html");
+    if (fs32.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs26.createReadStream(filePath).pipe(res);
+      fs32.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -36631,17 +37526,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs27 from "node:fs";
-import * as os16 from "node:os";
-import * as path30 from "node:path";
-var STATE_PATH = path30.join(os16.homedir(), ".olam", "dashboard.json");
+import * as fs33 from "node:fs";
+import * as os20 from "node:os";
+import * as path36 from "node:path";
+var STATE_PATH = path36.join(os20.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs27.mkdirSync(path30.dirname(STATE_PATH), { recursive: true });
-  fs27.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs33.mkdirSync(path36.dirname(STATE_PATH), { recursive: true });
+  fs33.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs27.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs33.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -36649,7 +37544,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs27.unlinkSync(STATE_PATH);
+    fs33.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -36929,8 +37824,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync19, existsSync as existsSync26, statSync as statSync7 } from "node:fs";
-import { join as join31, dirname as dirname18, resolve as resolve9 } from "node:path";
+import { readFileSync as readFileSync22, existsSync as existsSync32, statSync as statSync9 } from "node:fs";
+import { join as join37, dirname as dirname19, resolve as resolve9 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -36942,26 +37837,26 @@ function findProjectRoot2(startDir) {
   const root = resolve9("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync26(join31(dir, marker))) return dir;
+      if (existsSync32(join37(dir, marker))) return dir;
     }
-    const pkg = join31(dir, "package.json");
-    if (existsSync26(pkg)) {
+    const pkg = join37(dir, "package.json");
+    if (existsSync32(pkg)) {
       try {
-        const json = JSON.parse(readFileSync19(pkg, "utf8"));
+        const json = JSON.parse(readFileSync22(pkg, "utf8"));
         const isOlamWorkspace = typeof json.name === "string" && json.name.startsWith("@olam/");
         const hasOlamDep = json.dependencies && Object.keys(json.dependencies).some((k) => k.startsWith("@olam/")) || json.devDependencies && Object.keys(json.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
       } catch {
       }
     }
-    const parent = dirname18(dir);
+    const parent = dirname19(dir);
     if (parent === dir || parent === root) return null;
     dir = parent;
   }
 }
-function parseEnvFile(path31) {
+function parseEnvFile(path37) {
   const out = {};
-  const raw = readFileSync19(path31, "utf8");
+  const raw = readFileSync22(path37, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -36984,8 +37879,8 @@ function loadProjectEnv(startDir = process.cwd()) {
   const filesRead = [];
   const merged = {};
   for (const name of [".env", ".env.local"]) {
-    const p = join31(root, name);
-    if (existsSync26(p) && statSync7(p).isFile()) {
+    const p = join37(root, name);
+    if (existsSync32(p) && statSync9(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }