@pleri/olam-cli 0.1.146 → 0.1.147

package/dist/index.js

@@ -492,8 +492,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path78, errorMaps, issueData } = params;
-      const fullPath = [...path78, ...issueData.path || []];
+      const { data, path: path82, errorMaps, issueData } = params;
+      const fullPath = [...path82, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -801,11 +801,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path78, key) {
+      constructor(parent, value, path82, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path78;
+        this._path = path82;
         this._key = key;
       }
       get path() {
@@ -4286,7 +4286,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path78, ctx, rejectSource) {
+function refineForbiddenKeys(value, path82, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4294,12 +4294,12 @@ function refineForbiddenKeys(value, path78, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path78, key],
+        path: [...path82, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path78.length === 0 && key === "source") {
+    if (rejectSource && path82.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4307,21 +4307,21 @@ function refineForbiddenKeys(value, path78, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path78, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path82, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path78, rejectSource) {
+function rejectForbiddenKeys(value, path82, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path78}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path82}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path78}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path82}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path78}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path82}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5389,7 +5389,7 @@ async function safeText(res) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 var DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, RETRY_COUNT, RETRY_BACKOFF_MS, AuthClient;
 var init_client = __esm({
@@ -5500,8 +5500,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path78, body, attempt = 0) {
-        const url2 = `${this.baseUrl}${path78}`;
+      async request(method, path82, body, attempt = 0) {
+        const url2 = `${this.baseUrl}${path82}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5519,7 +5519,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path78, body, attempt + 1);
+            return this.request(method, path82, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -5541,7 +5541,7 @@ function resolveAuthServicePath() {
   return path9.join(pkgsDir, "auth-service");
 }
 function sleep2(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 var DEFAULT_PORT, DEFAULT_VOLUME, DEFAULT_CONTAINER, DEFAULT_IMAGE, AuthContainerController;
 var init_container = __esm({
@@ -5839,7 +5839,7 @@ var init_network = __esm({
 // ../adapters/dist/docker/pull.js
 import { spawn } from "node:child_process";
 function spawnAsync(cmd, args, opts = {}) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const child = spawn(cmd, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       signal: opts.signal
@@ -5853,10 +5853,10 @@ function spawnAsync(cmd, args, opts = {}) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve18({ exitCode: -1, stdout, stderr: stderr + err.message });
+      resolve19({ exitCode: -1, stdout, stderr: stderr + err.message });
     });
     child.on("close", (code) => {
-      resolve18({ exitCode: code ?? -1, stdout, stderr });
+      resolve19({ exitCode: code ?? -1, stdout, stderr });
     });
   });
 }
@@ -6330,7 +6330,7 @@ var demuxStream, execInContainer;
 var init_exec = __esm({
   "../adapters/dist/docker/exec.js"() {
     "use strict";
-    demuxStream = (stream) => new Promise((resolve18, reject) => {
+    demuxStream = (stream) => new Promise((resolve19, reject) => {
       const stdoutChunks = [];
       const stderrChunks = [];
       const stdout = new PassThrough();
@@ -6344,7 +6344,7 @@ var init_exec = __esm({
         stream.pipe(stdout);
       }
       stream.on("end", () => {
-        resolve18({
+        resolve19({
           stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
           stderr: Buffer.concat(stderrChunks).toString("utf-8")
         });
@@ -6804,7 +6804,7 @@ var init_connection = __esm({
       // -----------------------------------------------------------------------
       async exec(host, command) {
         const client = await this.getConnection(host);
-        return new Promise((resolve18, reject) => {
+        return new Promise((resolve19, reject) => {
           client.exec(command, (err, stream) => {
             if (err) {
               reject(new Error(`SSH exec failed on ${host}: ${err.message}`));
@@ -6819,7 +6819,7 @@ var init_connection = __esm({
               stderr += data.toString();
             });
             stream.on("close", (code) => {
-              resolve18({
+              resolve19({
                 exitCode: code ?? 0,
                 stdout: stdout.trimEnd(),
                 stderr: stderr.trimEnd()
@@ -6850,10 +6850,10 @@ var init_connection = __esm({
           throw new Error(`No SSH configuration found for host: ${host}`);
         }
         const client = new SSHClient();
-        return new Promise((resolve18, reject) => {
+        return new Promise((resolve19, reject) => {
           client.on("ready", () => {
             this.connections.set(host, client);
-            resolve18(client);
+            resolve19(client);
           }).on("error", (err) => {
             this.connections.delete(host);
             reject(new Error(`SSH connection to ${host} failed: ${err.message}`));
@@ -7292,8 +7292,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path78, method, body) {
-        const url2 = `${this.config.workerUrl}${path78}`;
+      async request(path82, method, body) {
+        const url2 = `${this.config.workerUrl}${path82}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -8640,17 +8640,17 @@ function kgRoot() {
 function worldsRoot() {
   return join16(olamHome(), "worlds");
 }
-function assertWithinPrefix(path78, prefix, label) {
-  if (!path78.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path78} not under ${prefix}/`);
+function assertWithinPrefix(path82, prefix, label) {
+  if (!path82.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path82} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path78 = resolve5(join16(root, workspace));
-  assertWithinPrefix(path78, root, "kgPristinePath");
-  return path78;
+  const path82 = resolve5(join16(root, workspace));
+  assertWithinPrefix(path82, root, "kgPristinePath");
+  return path82;
 }
 var KG_PATHS_INTERNALS;
 var init_storage_paths = __esm({
@@ -8765,8 +8765,8 @@ import { execFileSync as execFileSync4 } from "node:child_process";
 import * as fs15 from "node:fs";
 import * as os9 from "node:os";
 import * as path16 from "node:path";
-function expandHome2(p, homedir45) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir45());
+function expandHome2(p, homedir47) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir47());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -8789,7 +8789,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir45 = deps.homedir ?? (() => os9.homedir());
+  const homedir47 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path16.join(workspacePath, ".olam", "baseline");
   try {
     fs15.mkdirSync(baselineDir, { recursive: true });
@@ -8805,7 +8805,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path16.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir45);
+    const repoPath = expandHome2(repo.path, homedir47);
     if (!fs15.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -8925,21 +8925,21 @@ function extractStderr(err) {
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir45 = deps.homedir ?? (() => os9.homedir());
-  const existsSync86 = deps.existsSync ?? ((p) => fs15.existsSync(p));
+  const homedir47 = deps.homedir ?? (() => os9.homedir());
+  const existsSync90 = deps.existsSync ?? ((p) => fs15.existsSync(p));
   const copyFileSync12 = deps.copyFileSync ?? ((src, dest) => fs15.copyFileSync(src, dest));
-  const mkdirSync47 = deps.mkdirSync ?? ((dirPath, opts) => {
+  const mkdirSync51 = deps.mkdirSync ?? ((dirPath, opts) => {
     fs15.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir45);
+    const repoPath = expandHome2(repo.path, homedir47);
     const worktreePath = path16.join(workspacePath, repo.name);
-    if (!existsSync86(repoPath))
+    if (!existsSync90(repoPath))
       continue;
-    if (!existsSync86(worktreePath)) {
+    if (!existsSync90(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -8999,10 +8999,10 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
     for (const rel of plan.diff.untracked) {
       const src = path16.join(plan.repoPath, rel);
       const dest = path16.join(plan.worktreePath, rel);
-      if (!existsSync86(src))
+      if (!existsSync90(src))
         continue;
       try {
-        mkdirSync47(path16.dirname(dest), { recursive: true });
+        mkdirSync51(path16.dirname(dest), { recursive: true });
         copyFileSync12(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -10515,7 +10515,7 @@ var init_loader2 = __esm({
 });
 
 // ../core/dist/world/auto-dispatch-task.js
-async function probeHealth(containerName, dockerExec, budgetMs, sleep7) {
+async function probeHealth(containerName, dockerExec, budgetMs, sleep8) {
   const deadline = Date.now() + budgetMs;
   const cadenceMs = 100;
   let lastErr = "";
@@ -10528,7 +10528,7 @@ async function probeHealth(containerName, dockerExec, budgetMs, sleep7) {
     } catch (err) {
       lastErr = err instanceof Error ? err.message.slice(0, 200) : String(err).slice(0, 200);
     }
-    await sleep7(cadenceMs);
+    await sleep8(cadenceMs);
   }
   throw new TaskDispatchError(`container-cp /health did not return 200 within ${budgetMs}ms`, "health-probe", lastErr || "no response");
 }
@@ -10564,9 +10564,9 @@ function composeTaskPrompt(task, policies, formatPoliciesBrief2) {
 ${task}`;
 }
 async function autoDispatchTask(opts) {
-  const { containerName, task, policies, dockerExec, healthBudgetMs = 15e3, sleep: sleep7 = DEFAULT_SLEEP, logger = console, formatPoliciesBrief: formatPoliciesBrief2 } = opts;
+  const { containerName, task, policies, dockerExec, healthBudgetMs = 15e3, sleep: sleep8 = DEFAULT_SLEEP, logger = console, formatPoliciesBrief: formatPoliciesBrief2 } = opts;
   const finalPrompt = composeTaskPrompt(task, policies, formatPoliciesBrief2);
-  await probeHealth(containerName, dockerExec, healthBudgetMs, sleep7);
+  await probeHealth(containerName, dockerExec, healthBudgetMs, sleep8);
   startAgent(containerName, dockerExec);
   dispatch(containerName, finalPrompt, dockerExec);
   logger.log(`[world] Task auto-dispatched (${finalPrompt.length} chars)`);
@@ -10585,7 +10585,7 @@ var init_auto_dispatch_task = __esm({
         this.name = "TaskDispatchError";
       }
     };
-    DEFAULT_SLEEP = (ms) => new Promise((resolve18) => setTimeout(resolve18, ms));
+    DEFAULT_SLEEP = (ms) => new Promise((resolve19) => setTimeout(resolve19, ms));
   }
 });
 
@@ -10616,7 +10616,7 @@ function isAbsoluteOrTilde(p) {
 function hasNoTraversalComponents(p) {
   return !p.split("/").some((seg) => seg === "..");
 }
-var RepoEntrySchema, PortMapSchema, SeedSqlFileSchema, SeedCommandSchema, SeedFixtureCopySchema, SeedSchema, RunbookSchema, GlobalConfigSchema, DEFAULT_GLOBAL_CONFIG;
+var RepoEntrySchema, PortMapSchema, SeedSqlFileSchema, SeedCommandSchema, SeedFixtureCopySchema, SeedSchema, RunbookSchema, MetaHookBlockKindSchema, GlobalConfigSchema, DEFAULT_GLOBAL_CONFIG;
 var init_schema4 = __esm({
   "../core/dist/global-config/schema.js"() {
     "use strict";
@@ -10666,11 +10666,19 @@ var init_schema4 = __esm({
       env: external_exports.record(external_exports.string().min(1), external_exports.record(external_exports.string().min(1), external_exports.string())).optional(),
       updatedAt: external_exports.number().int().nonnegative()
     });
+    MetaHookBlockKindSchema = external_exports.enum(["memory-recall", "memory-classify"]);
     GlobalConfigSchema = external_exports.object({
       schemaVersion: external_exports.literal(1),
       repos: external_exports.array(RepoEntrySchema).optional().default([]),
       runbooks: external_exports.array(RunbookSchema).optional().default([]),
-      skillSources: external_exports.array(SkillSourceSchema).optional().default([])
+      skillSources: external_exports.array(SkillSourceSchema).optional().default([]),
+      /**
+       * Phase B B4 — per-block disable list. Operator escape-hatch when a
+       * specific meta-hook misbehaves; engine `injectMetaHooks` filters
+       * these out regardless of services-status detection. CLI
+       * `--meta-hooks-disabled <a,b>` flag (deferred) can override per-call.
+       */
+      metaHooksDisabled: external_exports.array(MetaHookBlockKindSchema).optional().default([])
     }).strip().superRefine((val, ctx) => {
       const repoNames = val.repos.map((r) => r.name);
       const repoDupes = repoNames.filter((n, i) => repoNames.indexOf(n) !== i);
@@ -10697,7 +10705,8 @@ var init_schema4 = __esm({
       schemaVersion: 1,
       repos: [],
       runbooks: [],
-      skillSources: []
+      skillSources: [],
+      metaHooksDisabled: []
     };
   }
 });
@@ -11106,7 +11115,7 @@ async function startSupervisedApps(containerName, worldId, repos, exec, options
   const probeTimeoutMs = options.probeTimeoutMs ?? 3e4;
   const probeIntervalMs = options.probeIntervalMs ?? 1e3;
   const clock = options.clock ?? Date.now;
-  const sleep7 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep8 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   for (const repo of repos) {
     if (isPortBound(exec, containerName, repo.hostPort)) {
       throw new PortInUseError(repo.hostPort, repo.name, repo.manifestPath);
@@ -11131,7 +11140,7 @@ async function startSupervisedApps(containerName, worldId, repos, exec, options
     probeTimeoutMs,
     probeIntervalMs,
     clock,
-    sleep: sleep7
+    sleep: sleep8
   })));
   return {
     sessionName,
@@ -14249,7 +14258,7 @@ function isCloudflaredAvailable() {
   }
 }
 function startTunnel(port2) {
-  return new Promise((resolve18, reject) => {
+  return new Promise((resolve19, reject) => {
     const child = spawn3("cloudflared", ["tunnel", "--url", `http://localhost:${port2}`], {
       stdio: ["ignore", "pipe", "pipe"],
       detached: false
@@ -14271,7 +14280,7 @@ function startTunnel(port2) {
       if (match2) {
         resolved = true;
         clearTimeout(timeout);
-        resolve18(match2[0]);
+        resolve19(match2[0]);
       }
     }
     child.stdout?.on("data", scan);
@@ -14358,8 +14367,8 @@ var init_dashboard = __esm({
           }
           throw err;
         }
-        await new Promise((resolve18, reject) => {
-          this.server.on("listening", resolve18);
+        await new Promise((resolve19, reject) => {
+          this.server.on("listening", resolve19);
           this.server.on("error", reject);
         });
         this.info = { localUrl: `http://localhost:${port2}` };
@@ -14405,8 +14414,8 @@ var init_dashboard = __esm({
       async stop() {
         stopTunnel();
         if (this.server) {
-          await new Promise((resolve18) => {
-            this.server.close(() => resolve18());
+          await new Promise((resolve19) => {
+            this.server.close(() => resolve19());
           });
           this.server = null;
         }
@@ -15095,10 +15104,10 @@ async function readHostCpToken2() {
   if (!fs26.existsSync(tp)) return null;
   return fs26.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path78, body) {
+async function callHostCpProxy(method, worldId, path82, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path78}`;
+  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path82}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -15492,7 +15501,7 @@ async function ensureOlamPostgresSingleton(options = {}) {
   };
 }
 function sleep3(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 var DEFAULT_POSTGRES_NETWORK, DEFAULT_POSTGRES_CONTAINER, DEFAULT_POSTGRES_HOST_PORT, DEFAULT_POSTGRES_IMAGE, DEFAULT_POSTGRES_USER, DEFAULT_POSTGRES_PASSWORD, DEFAULT_POSTGRES_DB, DEFAULT_POSTGRES_READY_TIMEOUT_MS;
 var init_postgres_init_helpers = __esm({
@@ -16135,9 +16144,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path78) {
-    super(`Archetype inheritance cycle detected: ${path78.join(" \u2192 ")} \u2192 ${path78[0] ?? "?"}`);
-    this.path = path78;
+  constructor(path82) {
+    super(`Archetype inheritance cycle detected: ${path82.join(" \u2192 ")} \u2192 ${path82[0] ?? "?"}`);
+    this.path = path82;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -16765,10 +16774,10 @@ async function confirm(message) {
   if (!process.stdin.isTTY) return true;
   const { createInterface: createInterface9 } = await import("node:readline");
   const rl = createInterface9({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
-      resolve18(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
+      resolve19(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
     });
   });
 }
@@ -17219,7 +17228,7 @@ var KgServiceContainerController = class {
   }
 };
 function sleep4(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 
 // src/commands/services.ts
@@ -17307,7 +17316,7 @@ var McpAuthContainerController = class {
   }
 };
 function sleep5(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function dumpContainerLogs(container, tail = 40) {
   try {
@@ -17725,9 +17734,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path78, mtimeMs } of result.newerSources) {
+  for (const { path: path82, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path78}  (modified ${when})`);
+    lines.push(`  \u2022 ${path82}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -17895,56 +17904,56 @@ var SECRET_LEN_BYTES = 32;
 function generateSecret() {
   return randomBytes6(SECRET_LEN_BYTES).toString("hex");
 }
-function writeSecretAtPath(path78, value) {
-  mkdirSync18(dirname19(path78), { recursive: true });
-  const tmp = `${path78}.tmp.${process.pid}`;
+function writeSecretAtPath(path82, value) {
+  mkdirSync18(dirname19(path82), { recursive: true });
+  const tmp = `${path82}.tmp.${process.pid}`;
   writeFileSync13(tmp, value, { mode: 384 });
   chmodSync3(tmp, 384);
-  renameSync4(tmp, path78);
+  renameSync4(tmp, path82);
 }
-function readSecretAtPathOrNull(path78) {
-  if (!existsSync28(path78)) return null;
-  const mode = statSync7(path78).mode & 511;
+function readSecretAtPathOrNull(path82) {
+  if (!existsSync28(path82)) return null;
+  const mode = statSync7(path82).mode & 511;
   if (mode !== 384) {
     process.stderr.write(
-      `warn: ${path78} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
+      `warn: ${path82} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
 `
     );
   }
-  return readFileSync20(path78, "utf8").trim();
+  return readFileSync20(path82, "utf8").trim();
 }
-function readSecretAtPath(path78) {
-  const v = readSecretAtPathOrNull(path78);
+function readSecretAtPath(path82) {
+  const v = readSecretAtPathOrNull(path82);
   if (v === null) {
     throw new Error(
-      `Secret not found at ${path78}. Run 'olam memory start' to generate it.`
+      `Secret not found at ${path82}. Run 'olam memory start' to generate it.`
     );
   }
   return v;
 }
-function ensureMemorySecret(path78 = MEMORY_SECRET_PATH) {
-  const existing = readSecretAtPathOrNull(path78);
+function ensureMemorySecret(path82 = MEMORY_SECRET_PATH) {
+  const existing = readSecretAtPathOrNull(path82);
   if (existing) return existing;
   const fresh = generateSecret();
-  writeSecretAtPath(path78, fresh);
+  writeSecretAtPath(path82, fresh);
   return fresh;
 }
-function readMemorySecretOrNull(path78 = MEMORY_SECRET_PATH) {
-  return readSecretAtPathOrNull(path78);
+function readMemorySecretOrNull(path82 = MEMORY_SECRET_PATH) {
+  return readSecretAtPathOrNull(path82);
 }
-function readMemorySecret(path78 = MEMORY_SECRET_PATH) {
-  return readSecretAtPath(path78);
+function readMemorySecret(path82 = MEMORY_SECRET_PATH) {
+  return readSecretAtPath(path82);
 }
-function rotateMemorySecret(path78 = MEMORY_SECRET_PATH) {
+function rotateMemorySecret(path82 = MEMORY_SECRET_PATH) {
   const fresh = generateSecret();
-  writeSecretAtPath(path78, fresh);
+  writeSecretAtPath(path82, fresh);
   return fresh;
 }
-function hasMemorySecret(path78 = MEMORY_SECRET_PATH) {
-  return existsSync28(path78);
+function hasMemorySecret(path82 = MEMORY_SECRET_PATH) {
+  return existsSync28(path82);
 }
-function writeCloudMemorySecret(value, path78 = CLOUD_MEMORY_SECRET_PATH) {
-  writeSecretAtPath(path78, value);
+function writeCloudMemorySecret(value, path82 = CLOUD_MEMORY_SECRET_PATH) {
+  writeSecretAtPath(path82, value);
 }
 
 // src/lib/world-mcp-register.ts
@@ -18016,15 +18025,15 @@ var AGENTMEMORY_LOCAL_URL = "http://host.docker.internal:3111";
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs77 } = await import("node:fs");
-    const { default: os43 } = await import("node:os");
-    const { default: path78 } = await import("node:path");
-    const tp = path78.join(
-      process.env.OLAM_HOME ?? path78.join(os43.homedir(), ".olam"),
+    const { default: fs82 } = await import("node:fs");
+    const { default: os45 } = await import("node:os");
+    const { default: path82 } = await import("node:path");
+    const tp = path82.join(
+      process.env.OLAM_HOME ?? path82.join(os45.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs77.existsSync(tp)) return null;
-    return fs77.readFileSync(tp, "utf-8").trim();
+    if (!fs82.existsSync(tp)) return null;
+    return fs82.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -18432,12 +18441,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs77 } = await import("node:fs");
-    const { default: os43 } = await import("node:os");
-    const { default: path78 } = await import("node:path");
-    const tp = path78.join(os43.homedir(), ".olam", "host-cp.token");
-    if (!fs77.existsSync(tp)) return null;
-    const raw = fs77.readFileSync(tp, "utf-8").trim();
+    const { default: fs82 } = await import("node:fs");
+    const { default: os45 } = await import("node:os");
+    const { default: path82 } = await import("node:path");
+    const tp = path82.join(os45.homedir(), ".olam", "host-cp.token");
+    if (!fs82.existsSync(tp)) return null;
+    const raw = fs82.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -18680,7 +18689,7 @@ function parseRuntimeStatus(raw) {
     last_event_age_seconds
   };
 }
-var fetchWorldRuntimeStatus = (worldId, token) => new Promise((resolve18) => {
+var fetchWorldRuntimeStatus = (worldId, token) => new Promise((resolve19) => {
   const opts = {
     host: "127.0.0.1",
     port: HOST_CP_PORT2,
@@ -18692,7 +18701,7 @@ var fetchWorldRuntimeStatus = (worldId, token) => new Promise((resolve18) => {
   const req = http3.request(opts, (res) => {
     if (res.statusCode !== 200) {
       res.resume();
-      return resolve18(null);
+      return resolve19(null);
     }
     let body = "";
     res.setEncoding("utf-8");
@@ -18702,17 +18711,17 @@ var fetchWorldRuntimeStatus = (worldId, token) => new Promise((resolve18) => {
     res.on("end", () => {
       try {
         const parsed = parseRuntimeStatus(JSON.parse(body));
-        resolve18(parsed);
+        resolve19(parsed);
       } catch {
-        resolve18(null);
+        resolve19(null);
       }
     });
-    res.on("error", () => resolve18(null));
+    res.on("error", () => resolve19(null));
   });
-  req.on("error", () => resolve18(null));
+  req.on("error", () => resolve19(null));
   req.on("timeout", () => {
     req.destroy();
-    resolve18(null);
+    resolve19(null);
   });
   req.end();
 });
@@ -19181,14 +19190,14 @@ function printTable(entries) {
 async function confirmInteractive() {
   process.stdout.write("  Type `yes` to proceed: ");
   const buf = [];
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const onData = (chunk) => {
       buf.push(chunk);
       if (Buffer.concat(buf).toString("utf-8").includes("\n")) {
         process.stdin.removeListener("data", onData);
         process.stdin.pause();
         const answer = Buffer.concat(buf).toString("utf-8").trim();
-        resolve18(answer.toLowerCase() === "yes");
+        resolve19(answer.toLowerCase() === "yes");
       }
     };
     process.stdin.resume();
@@ -22244,11 +22253,11 @@ function zodIssueToError(issue, doc, lineCounter) {
     suggestion: deriveSuggestion(issue)
   };
 }
-function formatJsonPath(path78) {
-  if (path78.length === 0)
+function formatJsonPath(path82) {
+  if (path82.length === 0)
     return "<root>";
   let out = "";
-  for (const seg of path78) {
+  for (const seg of path82) {
     if (typeof seg === "number") {
       out += `[${seg}]`;
     } else {
@@ -22257,11 +22266,11 @@ function formatJsonPath(path78) {
   }
   return out;
 }
-function resolveYamlLocation(path78, doc, lineCounter) {
+function resolveYamlLocation(path82, doc, lineCounter) {
   let bestLine = 0;
   let bestColumn = 0;
-  for (let depth = path78.length; depth >= 0; depth -= 1) {
-    const segment = path78.slice(0, depth);
+  for (let depth = path82.length; depth >= 0; depth -= 1) {
+    const segment = path82.slice(0, depth);
     try {
       const node = doc.getIn(segment, true);
       if (node && typeof node === "object" && "range" in node) {
@@ -22479,11 +22488,11 @@ function topoSort(nodes) {
 }
 function traceCycle(start, byId) {
   const seen = /* @__PURE__ */ new Set();
-  const path78 = [];
+  const path82 = [];
   let current = start;
   while (current && !seen.has(current)) {
     seen.add(current);
-    path78.push(current);
+    path82.push(current);
     const node = byId.get(current);
     const next = node?.dependsOn[0];
     if (next === void 0)
@@ -22491,10 +22500,10 @@ function traceCycle(start, byId) {
     current = next;
   }
   if (current && seen.has(current)) {
-    const idx = path78.indexOf(current);
-    return [...path78.slice(idx), current];
+    const idx = path82.indexOf(current);
+    return [...path82.slice(idx), current];
   }
-  return path78;
+  return path82;
 }
 
 // ../core/dist/executor/types.js
@@ -24669,16 +24678,16 @@ function isValidConfig(value) {
   if (typeof v.install_id !== "string" || v.install_id.length === 0) return false;
   return true;
 }
-function atomicWriteJSON(path78, value, stderr = process.stderr) {
+function atomicWriteJSON(path82, value, stderr = process.stderr) {
   ensureStateDir();
-  const dir = dirname24(path78);
+  const dir = dirname24(path82);
   if (!existsSync39(dir)) {
     mkdirSync24(dir, { recursive: true });
   }
-  const tmp = `${path78}.tmp.${process.pid}`;
+  const tmp = `${path82}.tmp.${process.pid}`;
   try {
     writeFileSync18(tmp, JSON.stringify(value, null, 2) + "\n", { encoding: "utf8" });
-    renameSync5(tmp, path78);
+    renameSync5(tmp, path82);
   } catch (err) {
     if (existsSync39(tmp)) {
       try {
@@ -24756,7 +24765,7 @@ async function kubectlWrap(args, opts = {}) {
   const spawnImpl = opts.spawnImpl ?? spawn5;
   const stdout = [];
   const stderr = [];
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     let resolved = false;
     let killTimer = null;
     let sigkillTimer = null;
@@ -24771,7 +24780,7 @@ async function kubectlWrap(args, opts = {}) {
         clearTimeout(sigkillTimer);
         sigkillTimer = null;
       }
-      resolve18(r);
+      resolve19(r);
     }
     let child;
     try {
@@ -24780,7 +24789,7 @@ async function kubectlWrap(args, opts = {}) {
         env: { ...process.env, ...opts.env ?? {} }
       });
     } catch (err) {
-      resolve18({
+      resolve19({
         ok: false,
         stdout: "",
         stderr: err instanceof Error ? err.message : String(err),
@@ -24857,14 +24866,14 @@ async function probePortForwardLiveness(deps = {}) {
   return probe2("127.0.0.1", PORT_FORWARD_PORT, TCP_PROBE_TIMEOUT_MS);
 }
 function realTcpProbe(host, port2, timeoutMs) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const socket = new net3.Socket();
     let done = false;
     function finish(result) {
       if (done) return;
       done = true;
       socket.destroy();
-      resolve18(result);
+      resolve19(result);
     }
     const timer = setTimeout(() => finish(false), timeoutMs);
     socket.once("connect", () => {
@@ -25090,12 +25099,12 @@ function appendAuditEntry(entry, auditLogPath, writeFileSyncImpl) {
 }
 async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}) {
   const auditLogPath = deps.auditLogPath ?? MANIFEST_REFRESH_AUDIT_LOG;
-  const readdirSync22 = deps.readdirSync ?? fs37.readdirSync;
-  const readFileSync61 = deps.readFileSync ?? fs37.readFileSync;
+  const readdirSync23 = deps.readdirSync ?? fs37.readdirSync;
+  const readFileSync66 = deps.readFileSync ?? fs37.readFileSync;
   const writeFileSyncImpl = deps.writeFileSync ?? fs37.writeFileSync;
-  const existsSync86 = deps.existsSync ?? fs37.existsSync;
+  const existsSync90 = deps.existsSync ?? fs37.existsSync;
   const now = deps.now ? deps.now() : /* @__PURE__ */ new Date();
-  if (!existsSync86(manifestsDir)) {
+  if (!existsSync90(manifestsDir)) {
     return {
       ok: false,
       message: `manifests directory not found: ${manifestsDir}`
@@ -25103,7 +25112,7 @@ async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}) {
   }
   let files;
   try {
-    const entries = readdirSync22(manifestsDir, { withFileTypes: true });
+    const entries = readdirSync23(manifestsDir, { withFileTypes: true });
     files = entries.filter((e) => e.isFile() && (e.name.endsWith(".yaml") || e.name.endsWith(".json"))).map((e) => e.name);
   } catch (err) {
     return {
@@ -25116,7 +25125,7 @@ async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}) {
     const filePath = path39.join(manifestsDir, file);
     let content;
     try {
-      content = readFileSync61(filePath, "utf8");
+      content = readFileSync66(filePath, "utf8");
     } catch {
       continue;
     }
@@ -25697,10 +25706,10 @@ async function confirm2(message) {
   if (!process.stdin.isTTY) return true;
   const { createInterface: createInterface9 } = await import("node:readline");
   const rl = createInterface9({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
-      resolve18(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
+      resolve19(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
     });
   });
 }
@@ -28699,9 +28708,9 @@ function appendIdempotent(opts) {
 }
 function resolveShellRc(home, shellEnv) {
   if (!shellEnv) return null;
-  const basename11 = path48.basename(shellEnv);
-  if (basename11 === "zsh") return path48.join(home, ".zshrc");
-  if (basename11 === "bash") return path48.join(home, ".bashrc");
+  const basename12 = path48.basename(shellEnv);
+  if (basename12 === "zsh") return path48.join(home, ".zshrc");
+  if (basename12 === "bash") return path48.join(home, ".bashrc");
   return null;
 }
 
@@ -28713,10 +28722,10 @@ var NEXT_STEPS_DOCS = [
   "docs/architecture/manifest-spec.md    \u2014 per-repo .adb.yaml schema",
   "docs/architecture/config-spec.md      \u2014 workspace .olam/config.yaml schema"
 ];
-var defaultSpawn = (cmd, args) => new Promise((resolve18) => {
+var defaultSpawn = (cmd, args) => new Promise((resolve19) => {
   const child = spawn7(cmd, [...args], { stdio: "inherit" });
-  child.on("exit", (code) => resolve18({ status: code }));
-  child.on("error", () => resolve18({ status: 1 }));
+  child.on("exit", (code) => resolve19({ status: code }));
+  child.on("error", () => resolve19({ status: 1 }));
 });
 var defaultPrompt = (question, defaultYes) => {
   if (!process.stdin.isTTY) {
@@ -28726,18 +28735,18 @@ var defaultPrompt = (question, defaultYes) => {
     );
     return Promise.resolve(defaultYes);
   }
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const rl = createInterface3({ input: process.stdin, output: process.stdout });
     const suffix = defaultYes ? " [Y/n]: " : " [y/N]: ";
     rl.question(`${question}${suffix}`, (answer) => {
       rl.close();
       const t = answer.trim().toLowerCase();
-      if (t === "") resolve18(defaultYes);
-      else if (t === "y" || t === "yes") resolve18(true);
-      else if (t === "n" || t === "no") resolve18(false);
-      else resolve18(defaultYes);
+      if (t === "") resolve19(defaultYes);
+      else if (t === "y" || t === "yes") resolve19(true);
+      else if (t === "n" || t === "no") resolve19(false);
+      else resolve19(defaultYes);
     });
-    rl.on("close", () => resolve18(defaultYes));
+    rl.on("close", () => resolve19(defaultYes));
   });
 };
 async function phase1SystemCheck(deps) {
@@ -29290,7 +29299,7 @@ function registerBegin(program2) {
 }
 
 // src/commands/config.ts
-import * as fs63 from "node:fs";
+import * as fs67 from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 
 // ../core/dist/global-config/index.js
@@ -29382,7 +29391,14 @@ import * as fs49 from "node:fs";
 import * as path54 from "node:path";
 import * as os29 from "node:os";
 var SKILL_SOURCES_AUDIT_LOG_FILENAME = "skill-sources-audit.log";
-var TrustActionSchema = external_exports.enum(["added", "rejected", "auto-rejected", "failed", "removed"]);
+var TrustActionSchema = external_exports.enum([
+  "added",
+  "rejected",
+  "auto-rejected",
+  "failed",
+  "removed",
+  "meta-hook-stripped"
+]);
 var TrustMethodSchema = external_exports.enum(["flag", "interactive", "auto-reject-tty", "none"]);
 var TrustAuditEntrySchema = external_exports.object({
   timestamp: external_exports.string().min(1),
@@ -29968,6 +29984,9 @@ function readMigrationSnapshotFromPath(p) {
   return JSON.parse(fs54.readFileSync(p, "utf-8"));
 }
 
+// ../core/dist/skill-sync/engine.js
+init_store2();
+
 // ../core/dist/skill-sync/artifact-resolver.js
 import * as fs55 from "node:fs";
 import * as path59 from "node:path";
@@ -30191,11 +30210,11 @@ function detectCollisions(artifacts) {
   }
   const collisions = [];
   for (const [key, loserList] of losersByKey.entries()) {
-    const [bucket, basename11] = key.split("\0");
+    const [bucket, basename12] = key.split("\0");
     const winner = seen.get(key);
     collisions.push({
       bucket,
-      basename: basename11,
+      basename: basename12,
       winnerSourceId: winner.sourceId,
       winnerSourcePath: winner.sourcePath,
       loserSourceIds: loserList.map((l) => l.sourceId),
@@ -30271,11 +30290,161 @@ function deployArtifacts(artifacts) {
 }
 
 // ../core/dist/skill-sync/settings-merger.js
-import * as fs57 from "node:fs";
+import * as fs59 from "node:fs";
 import * as os34 from "node:os";
 import * as path61 from "node:path";
+
+// ../core/dist/meta-hooks/memory-recall.js
+import * as fs57 from "node:fs";
+var OLAM_META_MEMORY_RECALL_SENTINEL = "olam-meta-memory-recall-v1";
+var OLAM_META_MEMORY_RECALL_STAGE = "PreToolUse";
+var OLAM_META_MEMORY_RECALL_MATCHER = "Bash|Edit|MultiEdit|Write|Read|NotebookEdit";
+var OLAM_META_MEMORY_RECALL_TIMEOUT_MS = 5e3;
+var OLAM_META_MEMORY_RECALL_SCRIPT_PATH = "$HOME/.claude/scripts/agentmemory-classifier/agentmemory-recall-trigger.mjs";
+var OLAM_META_NOOP_GUARD = "command -v olam >/dev/null 2>&1 || exit 0;";
+function buildMemoryRecallHookEntry() {
+  return {
+    matcher: OLAM_META_MEMORY_RECALL_MATCHER,
+    hooks: [
+      {
+        type: "command",
+        command: `OLAM_META_SENTINEL=${OLAM_META_MEMORY_RECALL_SENTINEL}; ${OLAM_META_NOOP_GUARD} node "${OLAM_META_MEMORY_RECALL_SCRIPT_PATH}"`,
+        timeout: OLAM_META_MEMORY_RECALL_TIMEOUT_MS
+      }
+    ]
+  };
+}
+function computeMemoryRecallUninstall(settings) {
+  const matchers = settings.hooks?.PreToolUse;
+  if (!Array.isArray(matchers) || matchers.length === 0) {
+    return { status: "not-found" };
+  }
+  let changed = false;
+  const filteredMatchers = [];
+  for (const matcher of matchers) {
+    const innerHooks = matcher.hooks ?? [];
+    const keptInner = innerHooks.filter((h) => {
+      if (typeof h.command === "string" && h.command.includes(OLAM_META_MEMORY_RECALL_SENTINEL)) {
+        changed = true;
+        return false;
+      }
+      return true;
+    });
+    if (keptInner.length === 0 && innerHooks.length > 0) {
+      changed = true;
+      continue;
+    }
+    if (keptInner.length === innerHooks.length) {
+      filteredMatchers.push(matcher);
+    } else {
+      filteredMatchers.push({ ...matcher, hooks: keptInner });
+    }
+  }
+  if (!changed)
+    return { status: "not-found" };
+  const next = {
+    ...settings,
+    hooks: {
+      ...settings.hooks,
+      PreToolUse: filteredMatchers
+    }
+  };
+  if (filteredMatchers.length === 0) {
+    const otherStages = Object.keys(next.hooks ?? {}).filter((k) => k !== "PreToolUse");
+    if (otherStages.length === 0) {
+      delete next.hooks;
+    } else {
+      delete next.hooks.PreToolUse;
+    }
+  }
+  return { status: "removed", settingsAfter: next };
+}
+function matchMemoryRecallSentinel(commandLine) {
+  return commandLine.includes(OLAM_META_MEMORY_RECALL_SENTINEL);
+}
+
+// ../core/dist/meta-hooks/memory-classify.js
+import * as fs58 from "node:fs";
+var OLAM_META_MEMORY_CLASSIFY_SENTINEL = "olam-meta-memory-classify-v1";
+var OLAM_META_MEMORY_CLASSIFY_STAGE = "PostToolUse";
+var OLAM_META_MEMORY_CLASSIFY_MATCHER = "Bash|Edit|MultiEdit|Write|Read|NotebookEdit";
+var OLAM_META_MEMORY_CLASSIFY_TIMEOUT_MS = 5e3;
+var OLAM_META_MEMORY_CLASSIFY_SCRIPT_PATH = "$HOME/.claude/scripts/agentmemory-classifier/agentmemory-classify-queue.mjs";
+var OLAM_META_NOOP_GUARD2 = "command -v olam >/dev/null 2>&1 || exit 0;";
+function buildMemoryClassifyHookEntry() {
+  return {
+    matcher: OLAM_META_MEMORY_CLASSIFY_MATCHER,
+    hooks: [
+      {
+        type: "command",
+        command: `OLAM_META_SENTINEL=${OLAM_META_MEMORY_CLASSIFY_SENTINEL}; ${OLAM_META_NOOP_GUARD2} node "${OLAM_META_MEMORY_CLASSIFY_SCRIPT_PATH}"`,
+        timeout: OLAM_META_MEMORY_CLASSIFY_TIMEOUT_MS
+      }
+    ]
+  };
+}
+function computeMemoryClassifyUninstall(settings) {
+  const matchers = settings.hooks?.PostToolUse;
+  if (!Array.isArray(matchers) || matchers.length === 0) {
+    return { status: "not-found" };
+  }
+  let changed = false;
+  const filteredMatchers = [];
+  for (const matcher of matchers) {
+    const innerHooks = matcher.hooks ?? [];
+    const keptInner = innerHooks.filter((h) => {
+      if (typeof h.command === "string" && h.command.includes(OLAM_META_MEMORY_CLASSIFY_SENTINEL)) {
+        changed = true;
+        return false;
+      }
+      return true;
+    });
+    if (keptInner.length === 0 && innerHooks.length > 0) {
+      changed = true;
+      continue;
+    }
+    if (keptInner.length === innerHooks.length) {
+      filteredMatchers.push(matcher);
+    } else {
+      filteredMatchers.push({ ...matcher, hooks: keptInner });
+    }
+  }
+  if (!changed)
+    return { status: "not-found" };
+  const next = {
+    ...settings,
+    hooks: {
+      ...settings.hooks,
+      PostToolUse: filteredMatchers
+    }
+  };
+  if (filteredMatchers.length === 0) {
+    const otherStages = Object.keys(next.hooks ?? {}).filter((k) => k !== "PostToolUse");
+    if (otherStages.length === 0) {
+      delete next.hooks;
+    } else {
+      delete next.hooks.PostToolUse;
+    }
+  }
+  return { status: "removed", settingsAfter: next };
+}
+function matchMemoryClassifySentinel(commandLine) {
+  return commandLine.includes(OLAM_META_MEMORY_CLASSIFY_SENTINEL);
+}
+
+// ../core/dist/skill-sync/settings-merger.js
 var OLAM_SKILLS_MARKER = "_olamSkillsManaged";
 var BACKUP_RETENTION = 30;
+var DUAL_WRITE_DEDUP_RULES = [
+  {
+    preservedSentinel: OLAM_META_MEMORY_RECALL_SENTINEL,
+    incomingCommandSubstring: "agentmemory-recall-trigger.mjs"
+  },
+  {
+    preservedSentinel: OLAM_META_MEMORY_CLASSIFY_SENTINEL,
+    incomingCommandSubstring: "agentmemory-classify-queue.mjs"
+  }
+];
 function claudeSettingsPath() {
   const override = process.env["OLAM_CLAUDE_SETTINGS_PATH"];
   if (override && override.length > 0)
@@ -30301,32 +30470,66 @@ function dedupeByMatcher(entries) {
   }
   return [...map.values()];
 }
+function commandsInEntry(entry) {
+  const cmds = [];
+  const direct = entry["command"];
+  if (typeof direct === "string")
+    cmds.push(direct);
+  const inner = entry["hooks"];
+  if (Array.isArray(inner)) {
+    for (const h of inner) {
+      if (h && typeof h === "object" && typeof h.command === "string") {
+        cmds.push(h.command);
+      }
+    }
+  }
+  return cmds;
+}
+function applyDualWriteDedup(incoming, preserved) {
+  const preservedCommands = preserved.flatMap(commandsInEntry);
+  const preservedHas = (sentinel) => preservedCommands.some((c) => c.includes(sentinel));
+  let droppedCount = 0;
+  const droppedCommands = [];
+  const kept = incoming.filter((entry) => {
+    const incomingCommands = commandsInEntry(entry);
+    for (const rule of DUAL_WRITE_DEDUP_RULES) {
+      const hasIncomingScript = incomingCommands.some((c) => c.includes(rule.incomingCommandSubstring));
+      if (hasIncomingScript && preservedHas(rule.preservedSentinel)) {
+        droppedCount += 1;
+        droppedCommands.push(...incomingCommands.filter((c) => c.includes(rule.incomingCommandSubstring)));
+        return false;
+      }
+    }
+    return true;
+  });
+  return { kept, droppedCount, droppedCommands };
+}
 function tagOlam(entry) {
   return { ...entry, [OLAM_SKILLS_MARKER]: true };
 }
 function readJson(file) {
-  return JSON.parse(fs57.readFileSync(file, "utf-8"));
+  return JSON.parse(fs59.readFileSync(file, "utf-8"));
 }
 function rotateBackups(backupDir) {
-  if (!fs57.existsSync(backupDir))
+  if (!fs59.existsSync(backupDir))
     return;
-  const files = fs57.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path61.join(backupDir, f), mtime: fs57.statSync(path61.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  const files = fs59.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path61.join(backupDir, f), mtime: fs59.statSync(path61.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   for (const f of files.slice(BACKUP_RETENTION)) {
     try {
-      fs57.unlinkSync(f.full);
+      fs59.unlinkSync(f.full);
     } catch {
     }
   }
 }
 function backupSettings() {
   const src = claudeSettingsPath();
-  if (!fs57.existsSync(src))
+  if (!fs59.existsSync(src))
     return void 0;
   const dir = settingsBackupDir();
-  fs57.mkdirSync(dir, { recursive: true });
+  fs59.mkdirSync(dir, { recursive: true });
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const dest = path61.join(dir, `settings-${stamp}.json`);
-  fs57.copyFileSync(src, dest);
+  fs59.copyFileSync(src, dest);
   rotateBackups(dir);
   return dest;
 }
@@ -30334,7 +30537,7 @@ function mergeSettings(input) {
   const settingsPath = claudeSettingsPath();
   const backupPath = backupSettings();
   let base = {};
-  if (fs57.existsSync(settingsPath)) {
+  if (fs59.existsSync(settingsPath)) {
     try {
       base = readJson(settingsPath);
     } catch {
@@ -30366,13 +30569,18 @@ function mergeSettings(input) {
     ...olamHooksByCategory.keys()
   ]);
   let hooksAdded = 0;
+  let dualWriteDeduped = 0;
+  const dualWriteDroppedCommands = [];
   for (const cat of categories) {
     const existing = Array.isArray(existingHooks[cat]) ? existingHooks[cat] : [];
     const preserved = existing.filter((e) => !e[OLAM_SKILLS_MARKER]);
     const olam = olamHooksByCategory.get(cat) ?? [];
     const olamDeduped = dedupeByMatcher(olam);
-    mergedHooks[cat] = [...preserved, ...olamDeduped];
-    hooksAdded += olam.length;
+    const { kept: olamFinal, droppedCount, droppedCommands } = applyDualWriteDedup(olamDeduped, preserved);
+    dualWriteDeduped += droppedCount;
+    dualWriteDroppedCommands.push(...droppedCommands);
+    mergedHooks[cat] = [...preserved, ...olamFinal];
+    hooksAdded += olamFinal.length;
   }
   const permSet = /* @__PURE__ */ new Set();
   for (const file of input.permissionFiles) {
@@ -30397,16 +30605,16 @@ function mergeSettings(input) {
       ...input.permissionFiles.length > 0 ? { allow: [...permSet] } : {}
     }
   };
-  fs57.mkdirSync(path61.dirname(settingsPath), { recursive: true });
+  fs59.mkdirSync(path61.dirname(settingsPath), { recursive: true });
   const tmp = `${settingsPath}.tmp-${process.pid}`;
-  fs57.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
-  fs57.renameSync(tmp, settingsPath);
-  return { backupPath, hooksAdded, permissionsCount: permSet.size };
+  fs59.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
+  fs59.renameSync(tmp, settingsPath);
+  return { backupPath, hooksAdded, permissionsCount: permSet.size, dualWriteDeduped, dualWriteDroppedCommands };
 }
 
 // ../core/dist/skill-sync/per-project-override.js
 import { execFileSync as execFileSync13 } from "node:child_process";
-import * as fs58 from "node:fs";
+import * as fs60 from "node:fs";
 import * as path62 from "node:path";
 import { parse as parseYaml6 } from "yaml";
 
@@ -30443,8 +30651,8 @@ function findProjectOverride(startDir) {
   const root = path62.parse(dir).root;
   while (true) {
     const candidate = path62.join(dir, PROJECT_OVERRIDE_RELATIVE_PATH);
-    if (fs58.existsSync(candidate) && fs58.statSync(candidate).isFile()) {
-      const raw = fs58.readFileSync(candidate, "utf-8");
+    if (fs60.existsSync(candidate) && fs60.statSync(candidate).isFile()) {
+      const raw = fs60.readFileSync(candidate, "utf-8");
       let parsed;
       try {
         parsed = parseYaml6(raw);
@@ -30495,7 +30703,7 @@ function restoreCloneToBranchHead(opts) {
 }
 
 // ../core/dist/skill-sync/source-lock.js
-import * as fs59 from "node:fs";
+import * as fs61 from "node:fs";
 import * as os35 from "node:os";
 import * as path63 from "node:path";
 var SOURCE_LOCK_FILENAME = ".olam-sync.lock";
@@ -30517,11 +30725,11 @@ function defaultIsPidAlive(pid) {
   }
 }
 function sleep6(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function readLockMeta(lockPath) {
   try {
-    const raw = fs59.readFileSync(lockPath, "utf-8");
+    const raw = fs61.readFileSync(lockPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
       return parsed;
@@ -30540,12 +30748,12 @@ function isLockStale(meta, opts) {
 }
 function tryAcquireOnce(lockPath, meta, opts) {
   try {
-    fs59.mkdirSync(path63.dirname(lockPath), { recursive: true });
-    const fd = fs59.openSync(lockPath, "wx", 384);
+    fs61.mkdirSync(path63.dirname(lockPath), { recursive: true });
+    const fd = fs61.openSync(lockPath, "wx", 384);
     try {
-      fs59.writeSync(fd, JSON.stringify(meta));
+      fs61.writeSync(fd, JSON.stringify(meta));
     } finally {
-      fs59.closeSync(fd);
+      fs61.closeSync(fd);
     }
     return true;
   } catch (err) {
@@ -30555,14 +30763,14 @@ function tryAcquireOnce(lockPath, meta, opts) {
     const existing = readLockMeta(lockPath);
     if (existing === void 0) {
       try {
-        fs59.unlinkSync(lockPath);
+        fs61.unlinkSync(lockPath);
       } catch {
       }
       return tryAcquireOnce(lockPath, meta, opts);
     }
     if (isLockStale(existing, opts)) {
       try {
-        fs59.unlinkSync(lockPath);
+        fs61.unlinkSync(lockPath);
       } catch {
       }
       return tryAcquireOnce(lockPath, meta, opts);
@@ -30591,7 +30799,7 @@ async function acquireSourceLock(clonePath, options = {}) {
         lockPath,
         release: () => {
           try {
-            fs59.unlinkSync(lockPath);
+            fs61.unlinkSync(lockPath);
           } catch {
           }
         }
@@ -30615,17 +30823,464 @@ async function withSourceLock(clonePath, fn, options) {
   }
 }
 
-// ../core/dist/skill-sync/engine.js
-import * as fs60 from "node:fs";
+// ../core/dist/skill-sync/settings-json-lock.js
+import * as fs62 from "node:fs";
 import * as os36 from "node:os";
 import * as path64 from "node:path";
+var SETTINGS_JSON_LOCK_FILENAME = ".settings-json.lock";
+var DEFAULT_ACQUIRE_TIMEOUT_MS2 = 1e4;
+var DEFAULT_STALE_LOCK_MS2 = 5 * 6e4;
+var SettingsJsonLockError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SettingsJsonLockError";
+  }
+};
+function defaultSettingsJsonLockPath() {
+  const stateDir = process.env["OLAM_STATE_DIR"] ?? path64.join(os36.homedir(), ".olam", "state");
+  return path64.join(stateDir, SETTINGS_JSON_LOCK_FILENAME);
+}
+function defaultIsPidAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    return code === "EPERM";
+  }
+}
+function sleep7(ms) {
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
+}
+function readLockMeta2(lockPath) {
+  try {
+    const raw = fs62.readFileSync(lockPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
+      return parsed;
+    }
+  } catch {
+  }
+  return void 0;
+}
+var MAX_STEAL_ATTEMPTS = 3;
+function isLockStale2(meta, opts) {
+  const ageMs = opts.now - meta.timestamp;
+  if (ageMs < opts.staleLockMs / 2)
+    return false;
+  if (meta.hostname !== os36.hostname()) {
+    return ageMs > opts.staleLockMs * 2;
+  }
+  if (!opts.isPidAlive(meta.pid))
+    return true;
+  return ageMs > opts.staleLockMs;
+}
+function tryAcquireOnce2(lockPath, meta, opts) {
+  for (let attempt = 0; attempt <= MAX_STEAL_ATTEMPTS; attempt += 1) {
+    try {
+      fs62.mkdirSync(path64.dirname(lockPath), { recursive: true });
+      const fd = fs62.openSync(lockPath, "wx", 384);
+      try {
+        fs62.writeSync(fd, JSON.stringify(meta));
+      } finally {
+        fs62.closeSync(fd);
+      }
+      return true;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EEXIST")
+        throw err;
+    }
+    if (attempt >= MAX_STEAL_ATTEMPTS) {
+      return false;
+    }
+    const existing = readLockMeta2(lockPath);
+    const isStale = existing === void 0 || isLockStale2(existing, opts);
+    if (!isStale) {
+      return false;
+    }
+    const victimPath = `${lockPath}.victim-${process.pid}-${attempt}-${Date.now()}`;
+    try {
+      fs62.renameSync(lockPath, victimPath);
+      try {
+        fs62.unlinkSync(victimPath);
+      } catch {
+      }
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT")
+        throw err;
+    }
+  }
+  return false;
+}
+async function acquireSettingsJsonLock(options = {}) {
+  const lockPath = options.lockPath ?? defaultSettingsJsonLockPath();
+  const acquireTimeoutMs = options.acquireTimeoutMs ?? DEFAULT_ACQUIRE_TIMEOUT_MS2;
+  const staleLockMs = options.staleLockMs ?? DEFAULT_STALE_LOCK_MS2;
+  const now = options.now ?? Date.now;
+  const isPidAlive4 = options.isPidAlive ?? defaultIsPidAlive2;
+  const deadline = now() + acquireTimeoutMs;
+  let backoffMs = 25;
+  while (true) {
+    const meta = {
+      pid: process.pid,
+      hostname: os36.hostname(),
+      timestamp: now(),
+      ...options.reason ? { reason: options.reason } : {}
+    };
+    const acquired = tryAcquireOnce2(lockPath, meta, { now: now(), staleLockMs, isPidAlive: isPidAlive4 });
+    if (acquired) {
+      return {
+        lockPath,
+        release: () => {
+          try {
+            fs62.unlinkSync(lockPath);
+          } catch {
+          }
+        }
+      };
+    }
+    if (now() >= deadline) {
+      const existing = readLockMeta2(lockPath);
+      const held = existing ? `(held by pid ${existing.pid} on ${existing.hostname}, since ${new Date(existing.timestamp).toISOString()})` : "(holder unknown)";
+      throw new SettingsJsonLockError(`failed to acquire settings.json lock at ${lockPath} within ${acquireTimeoutMs}ms ${held}`);
+    }
+    await sleep7(Math.min(backoffMs, 200));
+    backoffMs = Math.min(backoffMs * 2, 200);
+  }
+}
+async function withSettingsJsonLock(fn, options) {
+  const { release: release2 } = await acquireSettingsJsonLock(options);
+  try {
+    return await fn();
+  } finally {
+    release2();
+  }
+}
+
+// ../core/dist/services-status/memory-probe.js
+var DEFAULT_TIMEOUT_MS4 = 2e3;
+var DEFAULT_MEMORY_PORT = 3111;
+var DEFAULT_HEALTH_PATH = "/agentmemory/livez";
+async function probeMemoryBridge(opts = {}) {
+  const port2 = opts.port ?? DEFAULT_MEMORY_PORT;
+  const healthPath = opts.healthPath ?? DEFAULT_HEALTH_PATH;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS4;
+  const url2 = `http://127.0.0.1:${port2}${healthPath}`;
+  const t0 = Date.now();
+  try {
+    const res = await fetch(url2, {
+      signal: AbortSignal.timeout(timeoutMs),
+      // CP3 LOW fix: refuse to follow redirects. A local attacker
+      // controlling the bridge port (or a misconfigured bridge
+      // returning 3xx) could redirect to an external URL; default
+      // `redirect: 'follow'` would leak timing + reachability.
+      redirect: "error"
+    });
+    await res.text().catch(() => "");
+    const latencyMs = Date.now() - t0;
+    if (res.ok) {
+      return { up: true, latencyMs };
+    }
+    return {
+      up: false,
+      latencyMs,
+      detail: `http ${res.status}`
+    };
+  } catch (err) {
+    const latencyMs = Date.now() - t0;
+    const code = err?.code;
+    const name = err?.name;
+    if (name === "AbortError" || name === "TimeoutError") {
+      return { up: false, latencyMs, detail: `timeout after ${timeoutMs}ms` };
+    }
+    if (code === "ECONNREFUSED") {
+      return { up: false, latencyMs, detail: "connection refused (bridge not running)" };
+    }
+    return {
+      up: false,
+      latencyMs,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+
+// ../core/dist/skill-sources/meta-hooks-migration-snapshot.js
+init_v3();
+import * as crypto9 from "node:crypto";
+import * as fs63 from "node:fs";
+import * as os37 from "node:os";
+import * as path65 from "node:path";
+var META_HOOKS_SNAPSHOT_SCHEMA_VERSION = 1;
+var META_HOOKS_SNAPSHOT_PREFIX = "meta-hooks-";
+var SettingsLooseSchema = external_exports.record(external_exports.unknown());
+var MetaHooksMigrationSnapshotSchema = external_exports.object({
+  schemaVersion: external_exports.literal(META_HOOKS_SNAPSHOT_SCHEMA_VERSION),
+  takenAt: external_exports.string().min(1),
+  namespace: external_exports.literal("meta-hooks"),
+  /**
+   * Full settings.json content captured before injection. Reverting
+   * writes this back verbatim. May be `null` when no settings.json
+   * existed pre-injection (operator's first sync wrote a fresh one);
+   * revert in that case deletes the file.
+   */
+  originalSettings: external_exports.union([SettingsLooseSchema, external_exports.null()])
+});
+function migrationSnapshotsDir2() {
+  const override = process.env["OLAM_MIGRATION_SNAPSHOTS_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path65.join(os37.homedir(), ".olam", "state", "migration-snapshots");
+}
+function writeMetaHooksSnapshot(originalSettings) {
+  const snapshot = {
+    schemaVersion: META_HOOKS_SNAPSHOT_SCHEMA_VERSION,
+    takenAt: (/* @__PURE__ */ new Date()).toISOString(),
+    namespace: "meta-hooks",
+    originalSettings
+  };
+  const validated = MetaHooksMigrationSnapshotSchema.parse(snapshot);
+  const dir = migrationSnapshotsDir2();
+  fs63.mkdirSync(dir, { recursive: true });
+  const stamp = validated.takenAt.replace(/[:.]/g, "-");
+  const rand = crypto9.randomBytes(3).toString("hex");
+  const file = path65.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
+  fs63.writeFileSync(file, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
+  return file;
+}
+function readMetaHooksSnapshot(filePath) {
+  if (!fs63.existsSync(filePath)) {
+    throw new Error(`snapshot file not found: ${filePath}`);
+  }
+  const raw = fs63.readFileSync(filePath, "utf-8");
+  const parsed = JSON.parse(raw);
+  return MetaHooksMigrationSnapshotSchema.parse(parsed);
+}
+function findLatestMetaHooksSnapshot() {
+  const dir = migrationSnapshotsDir2();
+  if (!fs63.existsSync(dir))
+    return void 0;
+  const candidates2 = fs63.readdirSync(dir).filter((n) => n.startsWith(META_HOOKS_SNAPSHOT_PREFIX) && n.endsWith(".json")).sort().reverse();
+  if (candidates2.length === 0)
+    return void 0;
+  return path65.join(dir, candidates2[0]);
+}
+function restoreSettingsFromSnapshot(snapshot, settingsPath) {
+  if (snapshot.originalSettings === null) {
+    if (fs63.existsSync(settingsPath)) {
+      fs63.unlinkSync(settingsPath);
+    }
+    return;
+  }
+  fs63.mkdirSync(path65.dirname(settingsPath), { recursive: true });
+  const tmp = `${settingsPath}.tmp-restore-${process.pid}-${Date.now()}`;
+  fs63.writeFileSync(tmp, JSON.stringify(snapshot.originalSettings, null, 2) + "\n");
+  fs63.renameSync(tmp, settingsPath);
+}
+
+// ../core/dist/skill-sync/atlas-hook-strip.js
+var AGENTMEMORY_SCRIPT_PATTERNS = [
+  "agentmemory-recall-trigger.mjs",
+  "agentmemory-classify-queue.mjs"
+];
+var OLAM_META_SENTINELS_GUARDED = [
+  OLAM_META_MEMORY_RECALL_SENTINEL,
+  OLAM_META_MEMORY_CLASSIFY_SENTINEL
+];
+function isStripCommand(command) {
+  for (const sentinel of OLAM_META_SENTINELS_GUARDED) {
+    if (command.includes(sentinel))
+      return { match: false };
+  }
+  for (const pattern of AGENTMEMORY_SCRIPT_PATTERNS) {
+    if (command.includes(pattern))
+      return { match: true, pattern };
+  }
+  return { match: false };
+}
+function findStripCandidates(settings) {
+  const stages = ["PreToolUse", "PostToolUse"];
+  const out = [];
+  for (const stage of stages) {
+    const matchers = settings.hooks?.[stage];
+    if (!Array.isArray(matchers))
+      continue;
+    for (let mi = 0; mi < matchers.length; mi += 1) {
+      const matcher = matchers[mi];
+      const inner = Array.isArray(matcher.hooks) ? matcher.hooks : [];
+      for (let ii = 0; ii < inner.length; ii += 1) {
+        const cmd = inner[ii]?.command;
+        if (typeof cmd !== "string")
+          continue;
+        const verdict = isStripCommand(cmd);
+        if (verdict.match) {
+          out.push({
+            stage,
+            matcherIndex: mi,
+            innerIndex: ii,
+            command: cmd,
+            matcher: matcher.matcher,
+            matchedPattern: verdict.pattern
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+function applyStrip(settings, candidates2) {
+  if (candidates2.length === 0) {
+    return { nextSettings: settings, removedCount: 0 };
+  }
+  const stripByStageMatcher = /* @__PURE__ */ new Map();
+  for (const c of candidates2) {
+    const key = `${c.stage}:${c.matcherIndex}`;
+    if (!stripByStageMatcher.has(key))
+      stripByStageMatcher.set(key, /* @__PURE__ */ new Set());
+    stripByStageMatcher.get(key).add(c.innerIndex);
+  }
+  const nextHooks = { ...settings.hooks ?? {} };
+  const stages = ["PreToolUse", "PostToolUse"];
+  for (const stage of stages) {
+    const matchers = settings.hooks?.[stage];
+    if (!Array.isArray(matchers))
+      continue;
+    const nextMatchers = [];
+    for (let mi = 0; mi < matchers.length; mi += 1) {
+      const matcher = matchers[mi];
+      const innerHooks = Array.isArray(matcher.hooks) ? matcher.hooks : [];
+      const stripIdx = stripByStageMatcher.get(`${stage}:${mi}`);
+      const keptInner = stripIdx === void 0 ? innerHooks : innerHooks.filter((_, ii) => !stripIdx.has(ii));
+      if (keptInner.length === innerHooks.length) {
+        nextMatchers.push(matcher);
+      } else if (keptInner.length === 0) {
+      } else {
+        nextMatchers.push({ ...matcher, hooks: keptInner });
+      }
+    }
+    if (nextMatchers.length === 0) {
+      delete nextHooks[stage];
+    } else {
+      nextHooks[stage] = nextMatchers;
+    }
+  }
+  const next = { ...settings };
+  if (Object.keys(nextHooks).length === 0) {
+    delete next.hooks;
+  } else {
+    next.hooks = nextHooks;
+  }
+  return { nextSettings: next, removedCount: candidates2.length };
+}
+
+// ../core/dist/skill-sync/meta-hook-injector.js
+function decideTargetBlocks(opts) {
+  const mode = opts.mode ?? "auto";
+  const disabled = new Set(opts.disabledBlocks ?? []);
+  if (mode === "never")
+    return /* @__PURE__ */ new Set();
+  const wantMemory = mode === "always" || opts.servicesStatus.memory;
+  const target = /* @__PURE__ */ new Set();
+  if (wantMemory && !disabled.has("memory-recall"))
+    target.add("memory-recall");
+  if (wantMemory && !disabled.has("memory-classify"))
+    target.add("memory-classify");
+  return target;
+}
+function injectMetaHooks(opts) {
+  const target = decideTargetBlocks(opts);
+  let working = JSON.parse(JSON.stringify(opts.currentSettings ?? {}));
+  const blocksAdded = [];
+  const blocksRemoved = [];
+  const memoryRecallPresent = hasMemoryRecallBlock(working);
+  if (target.has("memory-recall")) {
+    if (!memoryRecallPresent) {
+      working = appendBlock(working, OLAM_META_MEMORY_RECALL_STAGE, buildMemoryRecallHookEntry());
+      blocksAdded.push("memory-recall");
+    }
+  } else {
+    if (memoryRecallPresent) {
+      const r = computeMemoryRecallUninstall(working);
+      if (r.status === "removed" && r.settingsAfter) {
+        working = r.settingsAfter;
+        blocksRemoved.push("memory-recall");
+      }
+    }
+  }
+  const memoryClassifyPresent = hasMemoryClassifyBlock(working);
+  if (target.has("memory-classify")) {
+    if (!memoryClassifyPresent) {
+      working = appendBlock(working, OLAM_META_MEMORY_CLASSIFY_STAGE, buildMemoryClassifyHookEntry());
+      blocksAdded.push("memory-classify");
+    }
+  } else {
+    if (memoryClassifyPresent) {
+      const r = computeMemoryClassifyUninstall(working);
+      if (r.status === "removed" && r.settingsAfter) {
+        working = r.settingsAfter;
+        blocksRemoved.push("memory-classify");
+      }
+    }
+  }
+  return {
+    nextSettings: working,
+    blocksAdded,
+    blocksRemoved,
+    mode: opts.mode ?? "auto"
+  };
+}
+function hasMemoryRecallBlock(settings) {
+  const entries = settings.hooks?.PreToolUse;
+  if (!Array.isArray(entries))
+    return false;
+  for (const matcher of entries) {
+    const inner = matcher?.hooks ?? [];
+    if (!Array.isArray(inner))
+      continue;
+    for (const h of inner) {
+      if (typeof h?.command === "string" && matchMemoryRecallSentinel(h.command))
+        return true;
+    }
+  }
+  return false;
+}
+function hasMemoryClassifyBlock(settings) {
+  const entries = settings.hooks?.PostToolUse;
+  if (!Array.isArray(entries))
+    return false;
+  for (const matcher of entries) {
+    const inner = matcher?.hooks ?? [];
+    if (!Array.isArray(inner))
+      continue;
+    for (const h of inner) {
+      if (typeof h?.command === "string" && matchMemoryClassifySentinel(h.command))
+        return true;
+    }
+  }
+  return false;
+}
+function appendBlock(settings, stage, entry) {
+  const next = { ...settings };
+  const hooks = { ...settings.hooks ?? {} };
+  const stageEntries = Array.isArray(hooks[stage]) ? [...hooks[stage]] : [];
+  stageEntries.push(entry);
+  hooks[stage] = stageEntries;
+  next.hooks = hooks;
+  return next;
+}
+
+// ../core/dist/skill-sync/engine.js
+import * as fs64 from "node:fs";
+import * as os38 from "node:os";
+import * as path66 from "node:path";
 function resolveAtlasUser(override) {
   if (override)
     return override;
-  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path64.join(os36.homedir(), ".claude");
-  const f = path64.join(claudeDir2, ".atlas-user");
-  if (fs60.existsSync(f)) {
-    return fs60.readFileSync(f, "utf-8").trim() || void 0;
+  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path66.join(os38.homedir(), ".claude");
+  const f = path66.join(claudeDir2, ".atlas-user");
+  if (fs64.existsSync(f)) {
+    return fs64.readFileSync(f, "utf-8").trim() || void 0;
   }
   return void 0;
 }
@@ -30637,7 +31292,7 @@ async function syncSkills(opts = {}) {
   const perSource = [];
   for (const source of sources) {
     const clonePath = skillSourceClonePath(source.id);
-    if (!fs60.existsSync(clonePath))
+    if (!fs64.existsSync(clonePath))
       continue;
     const { artifacts, subscription } = await withSourceLock(clonePath, () => {
       const pinRef = projectOverride?.override.pin?.[source.id];
@@ -30673,6 +31328,7 @@ async function syncSkills(opts = {}) {
     projectOverride,
     deploy: void 0,
     merge: void 0,
+    metaHooks: void 0,
     perSource
   };
   if (opts.dryRun) {
@@ -30682,12 +31338,105 @@ async function syncSkills(opts = {}) {
   summary.deploy = deployArtifacts(projectFilteredArtifacts);
   summary.collisions = summary.deploy.collisions;
   summary.merge = mergeSettings({ hookFiles, permissionFiles });
+  if (opts.metaHooks !== "never") {
+    summary.metaHooks = await injectMetaHooksIntoSettings(opts);
+  }
   return summary;
 }
+async function injectMetaHooksIntoSettings(opts) {
+  const mode = opts.metaHooks ?? "auto";
+  const memoryProbe = await probeMemoryBridge();
+  const servicesStatus2 = {
+    memory: memoryProbe.up,
+    ...memoryProbe.detail !== void 0 ? { memoryDetail: memoryProbe.detail } : {}
+  };
+  const settingsFile = claudeSettingsPath();
+  let snapshotError;
+  let stripCandidates = [];
+  const result = await withSettingsJsonLock(() => {
+    let currentSettings = {};
+    let settingsExisted = false;
+    if (fs64.existsSync(settingsFile)) {
+      settingsExisted = true;
+      try {
+        const raw = fs64.readFileSync(settingsFile, "utf-8");
+        currentSettings = raw.trim() ? JSON.parse(raw) : {};
+      } catch {
+        try {
+          const raw = fs64.readFileSync(settingsFile);
+          const bakDir = path66.join(path66.dirname(settingsFile), ".malformed-backups");
+          fs64.mkdirSync(bakDir, { recursive: true });
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const bakFile = path66.join(bakDir, `settings.json.malformed.${stamp}.bak`);
+          fs64.writeFileSync(bakFile, raw, { mode: 384 });
+          snapshotError = `settings.json was malformed; original bytes preserved at ${bakFile}`;
+        } catch (bakErr) {
+          snapshotError = `settings.json malformed AND .bak write failed: ${bakErr instanceof Error ? bakErr.message : String(bakErr)}`;
+        }
+        currentSettings = {};
+        settingsExisted = false;
+      }
+    }
+    stripCandidates = findStripCandidates(currentSettings);
+    const settingsForInject = stripCandidates.length > 0 ? applyStrip(currentSettings, stripCandidates).nextSettings : currentSettings;
+    let configDisabled = [];
+    try {
+      const cfg = readGlobalConfig();
+      configDisabled = cfg.metaHooksDisabled ?? [];
+    } catch {
+    }
+    const disabledBlocks = Array.from(/* @__PURE__ */ new Set([
+      ...configDisabled,
+      ...opts.metaHooksDisabled ?? []
+    ]));
+    const inject = injectMetaHooks({
+      servicesStatus: servicesStatus2,
+      currentSettings: settingsForInject,
+      mode,
+      ...disabledBlocks.length > 0 ? { disabledBlocks } : {}
+    });
+    const noInjectDelta = inject.blocksAdded.length === 0 && inject.blocksRemoved.length === 0;
+    const noStripDelta = stripCandidates.length === 0;
+    if (noInjectDelta && noStripDelta) {
+      return inject;
+    }
+    let snapshotPath;
+    try {
+      snapshotPath = writeMetaHooksSnapshot(settingsExisted ? currentSettings : null);
+    } catch (err) {
+      snapshotError = err instanceof Error ? err.message : String(err);
+    }
+    if (stripCandidates.length > 0) {
+      try {
+        appendTrustAudit({
+          gitUrl: "internal:olam-meta-hooks",
+          action: "meta-hook-stripped",
+          trustMethod: "none",
+          sourceId: "atlas-toolbox",
+          note: `auto-migration during syncSkills stripped ${stripCandidates.length} agentmemory hook entry(ies)${snapshotPath ? `; snapshot at ${snapshotPath}` : ""}`
+        });
+      } catch {
+      }
+    }
+    fs64.mkdirSync(path66.dirname(settingsFile), { recursive: true });
+    const tmpPath = `${settingsFile}.tmp-${process.pid}-${Date.now()}`;
+    fs64.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
+    fs64.renameSync(tmpPath, settingsFile);
+    return inject;
+  }, { reason: `syncSkills meta-hook injection (mode=${mode})` });
+  return {
+    mode: result.mode,
+    servicesStatus: servicesStatus2,
+    blocksAdded: result.blocksAdded,
+    blocksRemoved: result.blocksRemoved,
+    ...snapshotError !== void 0 ? { snapshotError } : {},
+    ...stripCandidates.length > 0 ? { autoMigrated: { strippedCount: stripCandidates.length, stripCandidates } } : {}
+  };
+}
 
 // ../core/dist/skill-sync/shadow-backup-manager.js
-import * as fs61 from "node:fs";
-import * as path65 from "node:path";
+import * as fs65 from "node:fs";
+import * as path67 from "node:path";
 var SHADOW_BACKUP_BUCKETS = ["commands", "agents", "skills", "scripts", "rules"];
 var SHADOW_BACKUP_SUFFIX_RE = /\.shadow-backup-(\d+)$/;
 function listShadowBackups(opts = {}) {
@@ -30695,12 +31444,12 @@ function listShadowBackups(opts = {}) {
   const now = opts.now ?? Date.now();
   const out = [];
   for (const bucket of SHADOW_BACKUP_BUCKETS) {
-    const bucketDir = path65.join(claude, bucket);
-    if (!fs61.existsSync(bucketDir))
+    const bucketDir = path67.join(claude, bucket);
+    if (!fs65.existsSync(bucketDir))
       continue;
     let entries;
     try {
-      entries = fs61.readdirSync(bucketDir);
+      entries = fs65.readdirSync(bucketDir);
     } catch {
       continue;
     }
@@ -30711,10 +31460,10 @@ function listShadowBackups(opts = {}) {
       const epochSeconds = Number.parseInt(match2[1], 10);
       if (!Number.isFinite(epochSeconds) || epochSeconds < 0)
         continue;
-      const full = path65.join(bucketDir, name);
+      const full = path67.join(bucketDir, name);
       let sizeBytes = 0;
       try {
-        const st = fs61.statSync(full);
+        const st = fs65.statSync(full);
         if (st.isDirectory())
           continue;
         sizeBytes = st.size;
@@ -30727,7 +31476,7 @@ function listShadowBackups(opts = {}) {
         bucket,
         basename: name,
         originalBasename,
-        originalPath: path65.join(bucketDir, originalBasename),
+        originalPath: path67.join(bucketDir, originalBasename),
         epochSeconds,
         ageMs: now - epochSeconds * 1e3,
         sizeBytes
@@ -30770,7 +31519,7 @@ function pruneShadowBackups(opts) {
     }
     if (!opts.dryRun) {
       try {
-        fs61.unlinkSync(b.path);
+        fs65.unlinkSync(b.path);
       } catch {
         skipped.push(b);
         continue;
@@ -30781,38 +31530,38 @@ function pruneShadowBackups(opts) {
   return { deleted, skipped };
 }
 function restoreShadowBackup(opts) {
-  const abs = path65.resolve(opts.backupPath);
-  if (!fs61.existsSync(abs)) {
+  const abs = path67.resolve(opts.backupPath);
+  if (!fs65.existsSync(abs)) {
     throw new Error(`backup file not found: ${abs}`);
   }
-  const basename11 = path65.basename(abs);
-  const match2 = SHADOW_BACKUP_SUFFIX_RE.exec(basename11);
+  const basename12 = path67.basename(abs);
+  const match2 = SHADOW_BACKUP_SUFFIX_RE.exec(basename12);
   if (!match2) {
-    throw new Error(`not a shadow-backup file (basename "${basename11}" does not match \`.shadow-backup-<epoch>\`): ${abs}`);
+    throw new Error(`not a shadow-backup file (basename "${basename12}" does not match \`.shadow-backup-<epoch>\`): ${abs}`);
   }
-  const originalBasename = basename11.slice(0, basename11.length - match2[0].length);
-  const originalPath = path65.join(path65.dirname(abs), originalBasename);
-  if (fs61.existsSync(originalPath) && !opts.force) {
+  const originalBasename = basename12.slice(0, basename12.length - match2[0].length);
+  const originalPath = path67.join(path67.dirname(abs), originalBasename);
+  if (fs65.existsSync(originalPath) && !opts.force) {
     throw new Error(`original path already occupied: ${originalPath}. Move/rename it first OR re-run with --force.`);
   }
-  if (opts.force && fs61.existsSync(originalPath)) {
-    fs61.unlinkSync(originalPath);
+  if (opts.force && fs65.existsSync(originalPath)) {
+    fs65.unlinkSync(originalPath);
   }
-  fs61.renameSync(abs, originalPath);
+  fs65.renameSync(abs, originalPath);
   return { restoredTo: originalPath };
 }
 
 // ../core/dist/skill-sources/doctor-checks.js
 init_v3();
-import * as fs62 from "node:fs";
-import * as path66 from "node:path";
-import * as os37 from "node:os";
+import * as fs66 from "node:fs";
+import * as path68 from "node:path";
+import * as os39 from "node:os";
 init_schema4();
 function claudeDirInternal3() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path66.join(os37.homedir(), ".claude");
+  return path68.join(os39.homedir(), ".claude");
 }
 function checkStateFileParse() {
   const filePath = globalConfigPath();
@@ -30821,11 +31570,11 @@ function checkStateFileParse() {
     healthy: true,
     description: `~/.olam state file (${filePath})`
   };
-  if (!fs62.existsSync(filePath)) {
+  if (!fs66.existsSync(filePath)) {
     result.details = ["(file does not yet exist \u2014 will be created on first write)"];
     return result;
   }
-  const raw = fs62.readFileSync(filePath, "utf-8");
+  const raw = fs66.readFileSync(filePath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -30835,8 +31584,8 @@ function checkStateFileParse() {
     result.details = [err instanceof Error ? err.message : String(err)];
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs62.renameSync(filePath, aside);
-      fs62.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
+      fs66.renameSync(filePath, aside);
+      fs66.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
     };
     return result;
   }
@@ -30847,7 +31596,7 @@ function checkStateFileParse() {
     result.details = validation.error.issues.map((e) => `${e.path.join(".")}: ${e.message}`);
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs62.copyFileSync(filePath, aside);
+      fs66.copyFileSync(filePath, aside);
       const base = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
       const next = {
         ...base,
@@ -30856,7 +31605,7 @@ function checkStateFileParse() {
         runbooks: [],
         skillSources: []
       };
-      fs62.writeFileSync(filePath, JSON.stringify(next, null, 2));
+      fs66.writeFileSync(filePath, JSON.stringify(next, null, 2));
     };
     return result;
   }
@@ -30867,16 +31616,16 @@ function checkDanglingSymlinks() {
   const buckets = ["commands", "agents", "skills", "scripts", "rules"];
   const dangling = [];
   for (const bucket of buckets) {
-    const dir = path66.join(claude, bucket);
-    if (!fs62.existsSync(dir))
+    const dir = path68.join(claude, bucket);
+    if (!fs66.existsSync(dir))
       continue;
-    for (const name of fs62.readdirSync(dir)) {
-      const linkPath = path66.join(dir, name);
+    for (const name of fs66.readdirSync(dir)) {
+      const linkPath = path68.join(dir, name);
       try {
-        const lst = fs62.lstatSync(linkPath);
+        const lst = fs66.lstatSync(linkPath);
         if (!lst.isSymbolicLink())
           continue;
-        if (!fs62.existsSync(linkPath)) {
+        if (!fs66.existsSync(linkPath)) {
           dangling.push(linkPath);
         }
       } catch {
@@ -30894,7 +31643,7 @@ function checkDanglingSymlinks() {
     result.repair = () => {
       for (const p of dangling) {
         try {
-          fs62.unlinkSync(p);
+          fs66.unlinkSync(p);
         } catch {
         }
       }
@@ -30913,19 +31662,19 @@ function checkOrphanedSnapshots() {
     healthy: true,
     description: `orphaned migration snapshots under ${dir}`
   };
-  if (!fs62.existsSync(dir)) {
+  if (!fs66.existsSync(dir)) {
     return result;
   }
   const orphans = [];
-  for (const name of fs62.readdirSync(dir)) {
+  for (const name of fs66.readdirSync(dir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path66.join(dir, name);
+    const full = path68.join(dir, name);
     try {
-      const stat = fs62.statSync(full);
+      const stat = fs66.statSync(full);
       if (!stat.isFile())
         continue;
-      const raw = fs62.readFileSync(full, "utf-8");
+      const raw = fs66.readFileSync(full, "utf-8");
       let parsed;
       try {
         parsed = JSON.parse(raw);
@@ -30950,7 +31699,7 @@ function checkOrphanedSnapshots() {
     result.repair = () => {
       for (const o of orphans) {
         try {
-          fs62.unlinkSync(o.path);
+          fs66.unlinkSync(o.path);
         } catch {
         }
       }
@@ -30965,12 +31714,12 @@ function checkSentinelDrift() {
     healthy: true,
     description: `olam-skills sentinel block in ${filePath}`
   };
-  if (!fs62.existsSync(filePath)) {
+  if (!fs66.existsSync(filePath)) {
     return result;
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs62.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs66.readFileSync(filePath, "utf-8"));
   } catch {
     return result;
   }
@@ -31011,7 +31760,7 @@ function checkSentinelDrift() {
         backupSettings();
       } catch {
       }
-      const next = JSON.parse(fs62.readFileSync(filePath, "utf-8"));
+      const next = JSON.parse(fs66.readFileSync(filePath, "utf-8"));
       if (!next.hooks)
         return;
       for (const stage of Object.keys(next.hooks)) {
@@ -31034,7 +31783,7 @@ function checkSentinelDrift() {
           return bad === void 0;
         });
       }
-      fs62.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs66.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
     };
   }
   return result;
@@ -31056,14 +31805,14 @@ function registerConfig(program2) {
   const config = program2.command("config").description("Manage global olam configuration");
   config.command("validate [path]").description("Validate ~/.olam/config.json (or a custom path) against the schema").action((filePath) => {
     const resolvedPath = filePath ?? globalConfigPath();
-    if (!fs63.existsSync(resolvedPath)) {
+    if (!fs67.existsSync(resolvedPath)) {
       process.stderr.write(`config file not found: ${resolvedPath}
 `);
       process.exit(1);
     }
     let raw;
     try {
-      raw = fs63.readFileSync(resolvedPath, "utf-8");
+      raw = fs67.readFileSync(resolvedPath, "utf-8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`cannot read ${resolvedPath}: ${msg}
@@ -31336,7 +32085,7 @@ async function decideTrust(opts) {
   return { granted: yes, method: "interactive" };
 }
 function defaultTrustPrompt(gitUrl) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     process.stdout.write(
       `${pc30.yellow("Trust gate:")} register "${gitUrl}" as a skill source?
@@ -31346,12 +32095,12 @@ Type ${pc30.bold("y")} to add + trust, anything else to cancel: `
     );
     rl.question("", (a) => {
       rl.close();
-      resolve18(a);
+      resolve19(a);
     });
   });
 }
 function defaultPostAddPrompt(input) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     process.stdout.write(`
 ${pc30.bold("Sync now?")} ${pc30.dim("[Y/n] ")}`);
@@ -31359,7 +32108,7 @@ ${pc30.bold("Sync now?")} ${pc30.dim("[Y/n] ")}`);
       const sync = !/^n(o)?$/i.test(syncAnswer.trim());
       if (input.hookAlreadyInstalled) {
         rl.close();
-        resolve18({ syncNow: sync, installHook: false });
+        resolve19({ syncNow: sync, installHook: false });
         return;
       }
       process.stdout.write(
@@ -31368,7 +32117,7 @@ ${pc30.bold("Sync now?")} ${pc30.dim("[Y/n] ")}`);
       rl.question("", (hookAnswer) => {
         rl.close();
         const installHook = !/^n(o)?$/i.test(hookAnswer.trim());
-        resolve18({ syncNow: sync, installHook });
+        resolve19({ syncNow: sync, installHook });
       });
     });
   });
@@ -31642,8 +32391,8 @@ function registerSkillsSource(program2) {
 }
 
 // src/commands/skills.ts
-import * as fs64 from "node:fs";
-import * as path67 from "node:path";
+import * as fs68 from "node:fs";
+import * as path69 from "node:path";
 import pc31 from "picocolors";
 init_output();
 function asMessage4(err) {
@@ -31657,14 +32406,14 @@ function listDeployed() {
   );
   const entries = [];
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const bucketDir = path67.join(dir, bucket);
-    if (!fs64.existsSync(bucketDir)) continue;
-    for (const name of fs64.readdirSync(bucketDir)) {
-      const full = path67.join(bucketDir, name);
+    const bucketDir = path69.join(dir, bucket);
+    if (!fs68.existsSync(bucketDir)) continue;
+    for (const name of fs68.readdirSync(bucketDir)) {
+      const full = path69.join(bucketDir, name);
       try {
-        const stat = fs64.lstatSync(full);
+        const stat = fs68.lstatSync(full);
         if (!stat.isSymbolicLink()) continue;
-        const target = fs64.readlinkSync(full);
+        const target = fs68.readlinkSync(full);
         let sourceId;
         for (const [clonePath, id] of sourcePaths.entries()) {
           if (target.startsWith(clonePath)) {
@@ -31712,6 +32461,32 @@ function printSyncSummary(summary, dryRun) {
     if (summary.merge.backupPath) {
       console.log(`  settings backup: ${pc31.dim(summary.merge.backupPath)}`);
     }
+    if (summary.merge.dualWriteDeduped > 0) {
+      console.log(`  ${pc31.dim(`dual-write deduped: ${summary.merge.dualWriteDeduped} (atlas-shipped hook redundant with olam-meta block)`)}`);
+      for (const cmd of summary.merge.dualWriteDroppedCommands) {
+        console.log(`    ${pc31.dim("(dropped)")} ${cmd.slice(0, 120)}${cmd.length > 120 ? "\u2026" : ""}`);
+      }
+    }
+  }
+  if (summary.metaHooks) {
+    const mh = summary.metaHooks;
+    const memLabel = mh.servicesStatus.memory ? pc31.green("up") : pc31.dim("down");
+    console.log(`  meta-hooks:      mode=${mh.mode} \xB7 memory=${memLabel}${mh.servicesStatus.memoryDetail ? pc31.dim(` (${mh.servicesStatus.memoryDetail})`) : ""}`);
+    if (mh.autoMigrated && mh.autoMigrated.strippedCount > 0) {
+      console.log(
+        `  ${pc31.cyan("~ auto-migrated:")} stripped ${mh.autoMigrated.strippedCount} atlas-toolbox-shipped agentmemory hook entry(ies); replaced by olam-injected blocks`
+      );
+    }
+    if (mh.blocksAdded.length > 0) {
+      console.log(`  ${pc31.green("+ injected:")} ${mh.blocksAdded.join(", ")}`);
+    }
+    if (mh.blocksRemoved.length > 0) {
+      console.log(`  ${pc31.yellow("- stripped:")} ${mh.blocksRemoved.join(", ")}`);
+    }
+    if (mh.snapshotError) {
+      console.log(`  ${pc31.red("! snapshot FAILED:")} ${mh.snapshotError}`);
+      console.log(`  ${pc31.red("  (migrate-hooks-back will not be able to undo this sync)")}`);
+    }
   }
   console.log();
   for (const s of summary.perSource) {
@@ -31721,9 +32496,23 @@ function printSyncSummary(summary, dryRun) {
 }
 function registerSkills(program2) {
   const skills = program2.commands.find((c) => c.name() === "skills") ?? program2.command("skills").description("Manage skill sources and synchronization");
-  skills.command("sync").description("Sync registered skill sources to ~/.claude/").option("--dry-run", "Resolve artifacts but do not deploy or merge").option("--atlas-user <user>", "Override atlas-user (defaults to ~/.claude/.atlas-user)").action(async (opts) => {
+  skills.command("sync").description("Sync registered skill sources to ~/.claude/").option("--dry-run", "Resolve artifacts but do not deploy or merge").option("--atlas-user <user>", "Override atlas-user (defaults to ~/.claude/.atlas-user)").option(
+    "--meta-hooks <mode>",
+    'olam-meta hook injection mode (B3): "auto" (default) \u2014 inject blocks for detected olam services; "always" \u2014 inject all blocks unconditionally; "never" \u2014 skip injection entirely',
+    "auto"
+  ).action(async (opts) => {
     try {
-      const summary = await syncSkills({ dryRun: opts.dryRun, atlasUser: opts.atlasUser });
+      const validModes = ["auto", "always", "never"];
+      if (opts.metaHooks && !validModes.includes(opts.metaHooks)) {
+        printError(`--meta-hooks must be one of: ${validModes.join(", ")} (got "${opts.metaHooks}")`);
+        process.exitCode = 1;
+        return;
+      }
+      const summary = await syncSkills({
+        dryRun: opts.dryRun,
+        atlasUser: opts.atlasUser,
+        metaHooks: opts.metaHooks ?? "auto"
+      });
       printSyncSummary(summary, !!opts.dryRun);
       if (!opts.dryRun) {
         printSuccess(`synced ${summary.sourceCount} source(s), ${summary.artifactCount} artifact(s)`);
@@ -31783,12 +32572,12 @@ function registerSkills(program2) {
 
 // src/commands/skills-hook.ts
 init_output();
-import * as fs65 from "node:fs";
+import * as fs69 from "node:fs";
 function backup(filePath) {
-  if (!fs65.existsSync(filePath)) return null;
+  if (!fs69.existsSync(filePath)) return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs65.copyFileSync(filePath, backupPath);
+  fs69.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 function registerSkillsHook(program2) {
@@ -31836,7 +32625,7 @@ function registerSkillsHook(program2) {
           printInfo("olam-skills hook", `not found in ${filePath} \u2014 already uninstalled`);
           if (backupPath) {
             try {
-              fs65.unlinkSync(backupPath);
+              fs69.unlinkSync(backupPath);
             } catch {
             }
           }
@@ -32013,25 +32802,25 @@ function registerSkillsOnboard(program2) {
 }
 
 // src/commands/skills-migrate.ts
-import * as fs66 from "node:fs";
-import * as path68 from "node:path";
+import * as fs70 from "node:fs";
+import * as path70 from "node:path";
 init_output();
 var MIGRATE_FROM_TOOLBOX_COMMAND = "migrate-from-toolbox";
 function asMessage6(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function isOlamSkillsHookPresent(filePath) {
-  if (!fs66.existsSync(filePath)) return false;
+  if (!fs70.existsSync(filePath)) return false;
   try {
-    const raw = fs66.readFileSync(filePath, "utf-8");
+    const raw = fs70.readFileSync(filePath, "utf-8");
     return raw.includes(OLAM_SKILLS_HOOK_SENTINEL);
   } catch {
     return false;
   }
 }
 function uninstallLegacyToolboxSessionStartHook(filePath, toolboxPath) {
-  if (!fs66.existsSync(filePath)) return { removed: 0 };
-  const raw = fs66.readFileSync(filePath, "utf-8");
+  if (!fs70.existsSync(filePath)) return { removed: 0 };
+  const raw = fs70.readFileSync(filePath, "utf-8");
   const settings = raw.trim() ? JSON.parse(raw) : {};
   const ss = settings?.hooks?.SessionStart;
   if (!Array.isArray(ss)) return { removed: 0 };
@@ -32060,7 +32849,7 @@ function uninstallLegacyToolboxSessionStartHook(filePath, toolboxPath) {
     if (otherStages.length === 0) delete next.hooks;
     else delete next.hooks.SessionStart;
   }
-  fs66.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+  fs70.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
   return { removed };
 }
 function registerSkillsMigrate(program2) {
@@ -32083,7 +32872,7 @@ function registerSkillsMigrate(program2) {
       return;
     }
     const toolboxPath = opts.path;
-    const namespace = opts.namespace ?? path68.basename(toolboxPath);
+    const namespace = opts.namespace ?? path70.basename(toolboxPath);
     const sourceName = opts.sourceName ?? namespace;
     const snapshot = detectToolboxState({ toolboxPath, namespace });
     if (!snapshot) {
@@ -32137,9 +32926,9 @@ function registerSkillsMigrate(program2) {
       printWarning(`legacy hook removal failed: ${asMessage6(err)}; proceeding`);
     }
     const scope = opts.scope === "user" ? "user" : "project";
-    const olamHookPath = scope === "user" ? settingsFile : path68.join(process.cwd(), ".claude", "settings.json");
+    const olamHookPath = scope === "user" ? settingsFile : path70.join(process.cwd(), ".claude", "settings.json");
     try {
-      fs66.mkdirSync(path68.dirname(olamHookPath), { recursive: true });
+      fs70.mkdirSync(path70.dirname(olamHookPath), { recursive: true });
       const result = mergeHomeSettingsJson(olamHookPath, {
         ensureHook: {
           stage: OLAM_SKILLS_HOOK_STAGE,
@@ -32170,8 +32959,8 @@ function registerSkillsMigrate(program2) {
 }
 
 // src/commands/skills-migrate-back.ts
-import * as fs67 from "node:fs";
-import * as path69 from "node:path";
+import * as fs71 from "node:fs";
+import * as path71 from "node:path";
 init_output();
 var MIGRATE_BACK_TO_TOOLBOX_COMMAND = "migrate-back-to-toolbox";
 function asMessage7(err) {
@@ -32180,16 +32969,16 @@ function asMessage7(err) {
 function claudeDirInternal4() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0) return override;
-  return path69.join(process.env["HOME"] ?? "", ".claude");
+  return path71.join(process.env["HOME"] ?? "", ".claude");
 }
 function restoreSessionStartFromSnapshot(filePath, originalSessionStartHook) {
   if (!originalSessionStartHook || originalSessionStartHook.length === 0) {
     return { restored: false };
   }
   let settings;
-  if (fs67.existsSync(filePath)) {
+  if (fs71.existsSync(filePath)) {
     try {
-      const raw = fs67.readFileSync(filePath, "utf-8");
+      const raw = fs71.readFileSync(filePath, "utf-8");
       settings = raw.trim() ? JSON.parse(raw) : {};
     } catch {
       settings = {};
@@ -32205,8 +32994,8 @@ function restoreSessionStartFromSnapshot(filePath, originalSessionStartHook) {
       SessionStart: originalSessionStartHook
     }
   };
-  fs67.mkdirSync(path69.dirname(filePath), { recursive: true });
-  fs67.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+  fs71.mkdirSync(path71.dirname(filePath), { recursive: true });
+  fs71.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
   return { restored: true };
 }
 function removeOlamManagedSymlinks() {
@@ -32215,16 +33004,16 @@ function removeOlamManagedSymlinks() {
   const olamClonePaths = sources.map((s) => skillSourceClonePath(s.id));
   let removed = 0;
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const dir = path69.join(claude, bucket);
-    if (!fs67.existsSync(dir)) continue;
-    for (const name of fs67.readdirSync(dir)) {
-      const linkPath = path69.join(dir, name);
+    const dir = path71.join(claude, bucket);
+    if (!fs71.existsSync(dir)) continue;
+    for (const name of fs71.readdirSync(dir)) {
+      const linkPath = path71.join(dir, name);
       try {
-        const stat = fs67.lstatSync(linkPath);
+        const stat = fs71.lstatSync(linkPath);
         if (!stat.isSymbolicLink()) continue;
-        const target = fs67.readlinkSync(linkPath);
+        const target = fs71.readlinkSync(linkPath);
         if (olamClonePaths.some((cp) => target.startsWith(cp))) {
-          fs67.unlinkSync(linkPath);
+          fs71.unlinkSync(linkPath);
           removed += 1;
         }
       } catch {
@@ -32237,18 +33026,18 @@ function restoreToolboxSymlinks(symlinks) {
   let restored = 0;
   for (const { link, target } of symlinks) {
     try {
-      fs67.mkdirSync(path69.dirname(link), { recursive: true });
-      if (fs67.existsSync(link) || (() => {
+      fs71.mkdirSync(path71.dirname(link), { recursive: true });
+      if (fs71.existsSync(link) || (() => {
         try {
-          fs67.lstatSync(link);
+          fs71.lstatSync(link);
           return true;
         } catch {
           return false;
         }
       })()) {
-        fs67.unlinkSync(link);
+        fs71.unlinkSync(link);
       }
-      fs67.symlinkSync(target, link);
+      fs71.symlinkSync(target, link);
       restored += 1;
     } catch {
     }
@@ -32257,9 +33046,9 @@ function restoreToolboxSymlinks(symlinks) {
 }
 function restoreAtlasUserMarker(atlasUser) {
   if (!atlasUser) return false;
-  const file = path69.join(claudeDirInternal4(), ".atlas-user");
-  fs67.mkdirSync(path69.dirname(file), { recursive: true });
-  fs67.writeFileSync(file, atlasUser);
+  const file = path71.join(claudeDirInternal4(), ".atlas-user");
+  fs71.mkdirSync(path71.dirname(file), { recursive: true });
+  fs71.writeFileSync(file, atlasUser);
   return true;
 }
 function registerSkillsMigrateBack(program2) {
@@ -32272,15 +33061,15 @@ function registerSkillsMigrateBack(program2) {
     let snapshot;
     try {
       if (opts.snapshot) {
-        snapshotPath = path69.resolve(opts.snapshot);
-        if (!fs67.existsSync(snapshotPath)) {
+        snapshotPath = path71.resolve(opts.snapshot);
+        if (!fs71.existsSync(snapshotPath)) {
           printError(`snapshot not found at ${snapshotPath}`);
           process.exitCode = 1;
           return;
         }
         snapshot = readMigrationSnapshotFromPath(snapshotPath);
       } else {
-        const filterNamespace = opts.namespace ?? (opts.path ? path69.basename(opts.path) : void 0);
+        const filterNamespace = opts.namespace ?? (opts.path ? path71.basename(opts.path) : void 0);
         const latest = readLatestMigrationSnapshot({ namespace: filterNamespace });
         if (!latest) {
           const where = filterNamespace ? ` for namespace "${filterNamespace}"` : "";
@@ -32350,13 +33139,176 @@ function registerSkillsMigrateBack(program2) {
   });
 }
 
-// src/commands/skills-shadow-backups.ts
-import * as fs68 from "node:fs";
+// src/commands/skills-migrate-hooks.ts
+import * as fs72 from "node:fs";
+import * as path72 from "node:path";
 import pc33 from "picocolors";
 init_output();
+var MIGRATE_HOOKS_COMMAND = "migrate-hooks";
+function settingsHasOlamMetaSentinel(settings) {
+  for (const stage of ["PreToolUse", "PostToolUse"]) {
+    const matchers = settings.hooks?.[stage];
+    if (!Array.isArray(matchers)) continue;
+    for (const matcher of matchers) {
+      const inner = Array.isArray(matcher.hooks) ? matcher.hooks : [];
+      for (const h of inner) {
+        const cmd = h?.command;
+        if (typeof cmd !== "string") continue;
+        for (const sentinel of OLAM_META_SENTINELS_GUARDED) {
+          if (cmd.includes(sentinel)) return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function readSettings2(filePath) {
+  if (!fs72.existsSync(filePath)) return null;
+  const raw = fs72.readFileSync(filePath, "utf-8");
+  if (raw.trim().length === 0) return {};
+  return JSON.parse(raw);
+}
+function writeSettings(filePath, settings) {
+  fs72.mkdirSync(path72.dirname(filePath), { recursive: true });
+  const tmp = `${filePath}.tmp-migrate-hooks-${process.pid}-${Date.now()}`;
+  fs72.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
+  fs72.renameSync(tmp, filePath);
+}
+function printSummary(candidates2, opts) {
+  if (candidates2.length === 0) {
+    printInfo(MIGRATE_HOOKS_COMMAND, "no atlas-toolbox-shipped agentmemory hooks found in settings.json \u2014 nothing to migrate");
+    return;
+  }
+  const verb = opts.dryRun ? "would strip" : "stripped";
+  console.log(pc33.bold(`${verb} ${candidates2.length} atlas-toolbox-shipped agentmemory hook entry(ies):`));
+  for (const c of candidates2) {
+    const matcher = c.matcher ?? "*";
+    const cmdPreview = c.command.length > 120 ? `${c.command.slice(0, 117)}...` : c.command;
+    console.log(`  ${pc33.dim(`[${c.stage}]`)} matcher=${pc33.cyan(matcher)} pattern=${pc33.yellow(c.matchedPattern)}`);
+    console.log(`    ${pc33.dim(cmdPreview)}`);
+  }
+  if (opts.snapshotPath) {
+    console.log();
+    printInfo("snapshot", opts.snapshotPath);
+    printInfo("reverse", `run \`olam skills migrate-hooks-back\` (or \`migrate-hooks-back --snapshot <path>\`) to restore the pre-strip settings.json`);
+  }
+}
 function asMessage8(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function registerSkillsMigrateHooks(program2) {
+  const skills = program2.commands.find((c) => c.name() === "skills") ?? program2.command("skills").description("Manage skill sources and synchronization");
+  skills.command(MIGRATE_HOOKS_COMMAND).description("Strip atlas-toolbox-shipped agentmemory hook entries from ~/.claude/settings.json (forward migration; reverse via migrate-hooks-back)").option("--dry-run", "Show what would be stripped without mutating settings.json or writing a snapshot").action(async (opts) => {
+    try {
+      await withSettingsJsonLock(
+        async () => {
+          const settingsFile = claudeSettingsPath();
+          const settings = readSettings2(settingsFile);
+          if (settings === null) {
+            printInfo(
+              MIGRATE_HOOKS_COMMAND,
+              `${settingsFile} does not exist \u2014 nothing to migrate`
+            );
+            return;
+          }
+          const candidates2 = findStripCandidates(settings);
+          if (opts.dryRun) {
+            printSummary(candidates2, { dryRun: true });
+            return;
+          }
+          if (candidates2.length === 0) {
+            printSummary(candidates2, { dryRun: false });
+            return;
+          }
+          const hasOlamMetaSentinel = settingsHasOlamMetaSentinel(settings);
+          if (!hasOlamMetaSentinel) {
+            printWarning(
+              `stripping ${candidates2.length} atlas-toolbox-shipped agentmemory entry(ies) WITHOUT any olam-meta sentinel-bound block present in settings.json. After the strip, agentmemory recall/classify will NOT fire from this settings.json. If unintended, reverse with \`olam skills migrate-hooks-back\` and re-sync with \`olam skills sync\` (default mode injects olam-meta blocks when memory-bridge is running).`
+            );
+          }
+          const snapshotPath = writeMetaHooksSnapshot(settings);
+          const { nextSettings, removedCount } = applyStrip(settings, candidates2);
+          writeSettings(settingsFile, nextSettings);
+          appendTrustAudit({
+            gitUrl: "internal:olam-meta-hooks",
+            action: "meta-hook-stripped",
+            trustMethod: "none",
+            sourceId: "atlas-toolbox",
+            note: `removed ${removedCount} agentmemory hook entry(ies); snapshot at ${snapshotPath}`
+          });
+          printSummary(candidates2, { dryRun: false, snapshotPath });
+          printSuccess(`stripped ${removedCount} atlas-toolbox-shipped agentmemory hook entry(ies) from ${settingsFile}`);
+        },
+        { reason: `cli:${MIGRATE_HOOKS_COMMAND}` }
+      );
+    } catch (err) {
+      printError(asMessage8(err));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/skills-migrate-hooks-back.ts
+import * as path73 from "node:path";
+init_output();
+function asMessage9(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function registerSkillsMigrateHooksBack(program2) {
+  const skills = program2.commands.find((c) => c.name() === "skills") ?? program2.command("skills").description("Manage skill sources and synchronization");
+  skills.command("migrate-hooks-back").description("Reverse olam-meta hook injection by restoring ~/.claude/settings.json from a B5 snapshot").option("--snapshot <path>", "Use a specific snapshot file (default: most recent meta-hooks-*.json)").action((opts) => {
+    try {
+      const snapshotPath = opts.snapshot ?? findLatestMetaHooksSnapshot();
+      if (!snapshotPath) {
+        printError(
+          "No meta-hooks-* snapshot found in ~/.olam/state/migration-snapshots/. Engine writes one before every injection that mutates settings.json; if none exist, no reversible injection has happened yet."
+        );
+        process.exitCode = 1;
+        return;
+      }
+      if (opts.snapshot) {
+        const resolved = path73.resolve(opts.snapshot);
+        const allowedDir = path73.resolve(migrationSnapshotsDir2());
+        if (!resolved.startsWith(allowedDir + path73.sep)) {
+          printError(
+            `--snapshot path must be inside ${allowedDir} (got "${resolved}"). Refusing to restore from an arbitrary path \u2014 settings.json would land operator-chosen content.`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        const basename12 = path73.basename(resolved);
+        if (!basename12.startsWith(META_HOOKS_SNAPSHOT_PREFIX)) {
+          printError(
+            `--snapshot filename must start with "${META_HOOKS_SNAPSHOT_PREFIX}" (got "${basename12}"). Cross-namespace snapshots (atlas-toolbox-*) are not valid restore targets for olam-meta hooks.`
+          );
+          process.exitCode = 1;
+          return;
+        }
+      }
+      printInfo("snapshot", snapshotPath);
+      const snapshot = readMetaHooksSnapshot(snapshotPath);
+      printInfo("takenAt", snapshot.takenAt);
+      const settingsFile = claudeSettingsPath();
+      restoreSettingsFromSnapshot(snapshot, settingsFile);
+      if (snapshot.originalSettings === null) {
+        printSuccess(`removed ${settingsFile} (no settings.json existed pre-injection)`);
+      } else {
+        printSuccess(`restored ${settingsFile} to pre-injection state`);
+      }
+    } catch (err) {
+      printError(asMessage9(err));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/skills-shadow-backups.ts
+import * as fs73 from "node:fs";
+import pc34 from "picocolors";
+init_output();
+function asMessage10(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 function formatAge3(ms) {
   if (ms < 0) return "<future>";
   const d = Math.floor(ms / 864e5);
@@ -32377,7 +33329,7 @@ function printBackupRows(backups) {
   for (const b of backups) {
     const when = new Date(b.epochSeconds * 1e3).toISOString().slice(0, 10);
     console.log(
-      `  ${pc33.dim(formatAge3(b.ageMs).padStart(6))}  ${formatSize(b.sizeBytes).padStart(7)}  ${pc33.dim(when)}  ${b.bucket}/${pc33.bold(b.basename)}`
+      `  ${pc34.dim(formatAge3(b.ageMs).padStart(6))}  ${formatSize(b.sizeBytes).padStart(7)}  ${pc34.dim(when)}  ${b.bucket}/${pc34.bold(b.basename)}`
     );
   }
 }
@@ -32387,11 +33339,11 @@ function registerSkillsShadowBackups(program2) {
   sb.command("list").description("List all shadow-backup files under ~/.claude/").action(() => {
     const all = listShadowBackups();
     if (all.length === 0) {
-      console.log(pc33.dim("No shadow-backup files under ~/.claude/."));
+      console.log(pc34.dim("No shadow-backup files under ~/.claude/."));
       return;
     }
     printHeader(`${all.length} shadow backup(s)`);
-    console.log(pc33.dim("   age      size  created     bucket/basename"));
+    console.log(pc34.dim("   age      size  created     bucket/basename"));
     printBackupRows(all);
   });
   sb.command("prune").description("Delete shadow-backup files older than a duration (e.g. 30d) OR all of them with --all --force").option("--older-than <duration>", "Delete backups older than this duration (e.g. 30d, 7d, 24h, 2w)", "30d").option("--all", "Delete every shadow-backup file (requires --force)").option("--force", "Confirm deletion when --all is used").option("--dry-run", "Show what would be deleted without deleting").action((opts) => {
@@ -32418,24 +33370,24 @@ function registerSkillsShadowBackups(program2) {
       const result = pruneShadowBackups(pruneOpts);
       const action = opts.dryRun ? "would delete" : "deleted";
       if (result.deleted.length === 0) {
-        console.log(pc33.dim(`No shadow-backups match \u2014 ${result.skipped.length} kept`));
+        console.log(pc34.dim(`No shadow-backups match \u2014 ${result.skipped.length} kept`));
         return;
       }
       printHeader(`${action} ${result.deleted.length} shadow backup(s) (${result.skipped.length} kept)`);
       printBackupRows(result.deleted);
       if (opts.dryRun) {
-        console.log(pc33.dim("\n(dry-run \u2014 re-run without --dry-run to delete)"));
+        console.log(pc34.dim("\n(dry-run \u2014 re-run without --dry-run to delete)"));
       } else {
         printSuccess(`pruned ${result.deleted.length} backup(s)`);
       }
     } catch (err) {
-      printError(asMessage8(err));
+      printError(asMessage10(err));
       process.exitCode = 1;
     }
   });
   sb.command("restore").description("Move a shadow-backup file back to its original path").argument("<path>", "Absolute path to the .shadow-backup-<epoch> file").option("--force", "Overwrite the original path if it already exists").action((p, opts) => {
     try {
-      if (!fs68.existsSync(p)) {
+      if (!fs73.existsSync(p)) {
         printError(`backup file not found: ${p}`);
         process.exitCode = 1;
         return;
@@ -32443,7 +33395,7 @@ function registerSkillsShadowBackups(program2) {
       const result = restoreShadowBackup({ backupPath: p, force: opts.force });
       printSuccess(`restored \u2192 ${result.restoredTo}`);
     } catch (err) {
-      printError(asMessage8(err));
+      printError(asMessage10(err));
       process.exitCode = 1;
     }
   });
@@ -32451,17 +33403,17 @@ function registerSkillsShadowBackups(program2) {
 
 // src/commands/skills-doctor.ts
 import * as readline3 from "node:readline";
-import pc34 from "picocolors";
+import pc35 from "picocolors";
 init_output();
-function asMessage9(err) {
+function asMessage11(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function defaultDoctorPrompt(question) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(question, (a) => {
       rl.close();
-      resolve18(a);
+      resolve19(a);
     });
   });
 }
@@ -32475,16 +33427,16 @@ async function confirmRepair(check) {
 }
 function printCheck(check) {
   if (check.healthy) {
-    console.log(`  ${pc34.green("\u2713")} ${pc34.bold(check.name.padEnd(22))} ${pc34.dim(check.description)}`);
+    console.log(`  ${pc35.green("\u2713")} ${pc35.bold(check.name.padEnd(22))} ${pc35.dim(check.description)}`);
     if (check.details && check.details.length > 0) {
-      for (const d of check.details) console.log(`      ${pc34.dim(d)}`);
+      for (const d of check.details) console.log(`      ${pc35.dim(d)}`);
     }
   } else {
-    console.log(`  ${pc34.red("\u2717")} ${pc34.bold(check.name.padEnd(22))} ${pc34.yellow(check.issue ?? "unhealthy")}`);
-    console.log(`      ${pc34.dim(check.description)}`);
+    console.log(`  ${pc35.red("\u2717")} ${pc35.bold(check.name.padEnd(22))} ${pc35.yellow(check.issue ?? "unhealthy")}`);
+    console.log(`      ${pc35.dim(check.description)}`);
     if (check.details) {
-      for (const d of check.details.slice(0, 10)) console.log(`      ${pc34.dim("\xB7 " + d)}`);
-      if (check.details.length > 10) console.log(`      ${pc34.dim(`\u2026 and ${check.details.length - 10} more`)}`);
+      for (const d of check.details.slice(0, 10)) console.log(`      ${pc35.dim("\xB7 " + d)}`);
+      if (check.details.length > 10) console.log(`      ${pc35.dim(`\u2026 and ${check.details.length - 10} more`)}`);
     }
   }
 }
@@ -32501,7 +33453,7 @@ function registerSkillsDoctor(program2) {
     try {
       checks = runAllDoctorChecks();
     } catch (err) {
-      printError(`doctor checks crashed: ${asMessage9(err)}`);
+      printError(`doctor checks crashed: ${asMessage11(err)}`);
       process.exitCode = 1;
       return;
     }
@@ -32515,7 +33467,7 @@ function registerSkillsDoctor(program2) {
     console.log();
     printWarning(`${unhealthy.length} of ${checks.length} check(s) report issues`);
     if (opts.checkOnly) {
-      console.log(pc34.dim("(--check-only \u2014 exiting without repair)"));
+      console.log(pc35.dim("(--check-only \u2014 exiting without repair)"));
       process.exitCode = 1;
       return;
     }
@@ -32523,22 +33475,22 @@ function registerSkillsDoctor(program2) {
     let skipped = 0;
     for (const check of unhealthy) {
       if (!check.repair) {
-        console.log(pc34.dim(`  (no auto-repair for ${check.name} \u2014 operator-attention required)`));
+        console.log(pc35.dim(`  (no auto-repair for ${check.name} \u2014 operator-attention required)`));
         skipped += 1;
         continue;
       }
       const shouldRepair = opts.autoFix ? true : await confirmRepair(check);
       if (!shouldRepair) {
-        console.log(pc34.dim(`  skipped: ${check.name}`));
+        console.log(pc35.dim(`  skipped: ${check.name}`));
         skipped += 1;
         continue;
       }
       try {
         await check.repair();
-        console.log(pc34.green(`  repaired: ${check.name}`));
+        console.log(pc35.green(`  repaired: ${check.name}`));
         repaired += 1;
       } catch (err) {
-        printError(`  repair failed for ${check.name}: ${asMessage9(err)}`);
+        printError(`  repair failed for ${check.name}: ${asMessage11(err)}`);
         skipped += 1;
       }
     }
@@ -32626,17 +33578,17 @@ function registerWorldUpgrade(program2) {
 
 // src/commands/mcp/serve.ts
 init_output();
-import { existsSync as existsSync74 } from "node:fs";
-import { dirname as dirname38, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync78 } from "node:fs";
+import { dirname as dirname42, resolve as resolve17 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
-var here = dirname38(fileURLToPath5(import.meta.url));
+var here = dirname42(fileURLToPath5(import.meta.url));
 var BUNDLE_PATH_CANDIDATES = [
   // bundled (`dist/index.js` after bundle-cli.mjs) — sibling
-  resolve16(here, "mcp-server.js"),
+  resolve17(here, "mcp-server.js"),
   // dev / tsc-only (`dist/commands/mcp/serve.js`) — up two levels
-  resolve16(here, "..", "..", "mcp-server.js")
+  resolve17(here, "..", "..", "mcp-server.js")
 ];
-function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync74) {
+function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync78) {
   return candidates2.find(exists) ?? null;
 }
 var MISSING_BUNDLE_REMEDY = "olam mcp server bundle missing. Searched: " + BUNDLE_PATH_CANDIDATES.join(", ") + ". For local dev, run: node packages/cli/scripts/bundle-mcp-server.mjs. A fresh `npm install -g @pleri/olam-cli@latest` should always include the bundle (see prepublishOnly in packages/cli/package.json); file an issue if it does not.";
@@ -32793,8 +33745,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path78, init = {}) {
-  const res = await fetch(`${BASE_URL}${path78}`, {
+async function apiFetch(path82, init = {}) {
+  const res = await fetch(`${BASE_URL}${path82}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -32881,7 +33833,7 @@ function registerMcpLogin(cmd) {
 init_output();
 import * as readline4 from "node:readline";
 async function readTokenSilent(prompt) {
-  return new Promise((resolve18, reject) => {
+  return new Promise((resolve19, reject) => {
     const rl = readline4.createInterface({
       input: process.stdin,
       output: process.stdout,
@@ -32899,7 +33851,7 @@ async function readTokenSilent(prompt) {
         process.stdin.removeListener("data", onData);
         process.stdout.write("\n");
         rl.close();
-        resolve18(token);
+        resolve19(token);
       } else if (char === "") {
         if (process.stdin.isTTY) process.stdin.setRawMode(false);
         process.stdin.removeListener("data", onData);
@@ -32946,7 +33898,7 @@ function registerMcpAdd(cmd) {
 
 // src/commands/mcp/list.ts
 init_output();
-import pc35 from "picocolors";
+import pc36 from "picocolors";
 function registerMcpList(cmd) {
   cmd.command("list").description("List all registered MCP credentials").action(async () => {
     const client = getMcpAuthClient();
@@ -32961,8 +33913,8 @@ function registerMcpList(cmd) {
     }
     const mcps = data.mcps ?? [];
     if (mcps.length === 0) {
-      console.log(pc35.dim("No MCP credentials registered."));
-      console.log(pc35.dim("Add one with: olam mcp add <service>"));
+      console.log(pc36.dim("No MCP credentials registered."));
+      console.log(pc36.dim("Add one with: olam mcp add <service>"));
       return;
     }
     const [c0, c1, c2, c3] = [16, 20, 10, 24];
@@ -32973,12 +33925,12 @@ function registerMcpList(cmd) {
       "ENV VAR".padEnd(c3),
       "STATUS"
     ].join("  ");
-    console.log(pc35.dim(header));
-    console.log(pc35.dim("\u2500".repeat(header.length)));
+    console.log(pc36.dim(header));
+    console.log(pc36.dim("\u2500".repeat(header.length)));
     for (const m of mcps) {
-      const status2 = !m.validated ? pc35.yellow("unvalidated") : m.expired ? pc35.red("expired") : pc35.green("active");
+      const status2 = !m.validated ? pc36.yellow("unvalidated") : m.expired ? pc36.red("expired") : pc36.green("active");
       const row = [
-        pc35.cyan(m.service.padEnd(c0)),
+        pc36.cyan(m.service.padEnd(c0)),
         m.label.padEnd(c1).slice(0, c1),
         m.type.padEnd(c2),
         (m.envName ?? "\u2014").padEnd(c3).slice(0, c3),
@@ -33006,13 +33958,13 @@ function registerMcpRemove(cmd) {
 
 // src/commands/mcp/status.ts
 init_output();
-import pc36 from "picocolors";
+import pc37 from "picocolors";
 function formatExpiry(expiresAt) {
   if (!expiresAt) return "\u2014";
   const ms = expiresAt - Date.now();
-  if (ms <= 0) return pc36.red("expired");
+  if (ms <= 0) return pc37.red("expired");
   const hours = ms / (1e3 * 60 * 60);
-  if (hours < 1) return pc36.yellow(`${Math.ceil(ms / 6e4)}m`);
+  if (hours < 1) return pc37.yellow(`${Math.ceil(ms / 6e4)}m`);
   return `${hours.toFixed(1)}h`;
 }
 function registerMcpStatus(cmd) {
@@ -33029,14 +33981,14 @@ function registerMcpStatus(cmd) {
     const mcps = data.mcps ?? [];
     printHeader(`MCP Credentials (${mcps.length})`);
     if (mcps.length === 0) {
-      console.log(pc36.dim("No credentials registered."));
+      console.log(pc37.dim("No credentials registered."));
       return;
     }
     for (const m of mcps) {
-      const stateColor = !m.validated ? pc36.yellow : m.expired ? pc36.red : pc36.green;
+      const stateColor = !m.validated ? pc37.yellow : m.expired ? pc37.red : pc37.green;
       const stateLabel = !m.validated ? "unvalidated" : m.expired ? "expired" : "active";
       console.log(`
-  ${pc36.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
+  ${pc37.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
       console.log(`    label:      ${m.label}`);
       console.log(`    type:       ${m.type}`);
       if (m.envName) console.log(`    env var:    ${m.envName}`);
@@ -33051,15 +34003,15 @@ function registerMcpStatus(cmd) {
 // src/commands/mcp/import.ts
 init_output();
 import * as readline5 from "node:readline";
-import pc37 from "picocolors";
+import pc38 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs69 from "node:fs";
-import * as os38 from "node:os";
-import * as path70 from "node:path";
+import * as fs74 from "node:fs";
+import * as os40 from "node:os";
+import * as path74 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs69.readFileSync(filePath, "utf-8");
+    const raw = fs74.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -33088,24 +34040,24 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path70.join(os38.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path74.join(os40.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path70.join(os38.homedir(), "AppData", "Roaming");
-    return path70.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path74.join(os40.homedir(), "AppData", "Roaming");
+    return path74.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path70.join(os38.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path74.join(os40.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path70.join(os38.homedir(), ".olam", "config.yaml"),
-    path70.join(process.cwd(), ".olam", "config.yaml")
+    path74.join(os40.homedir(), ".olam", "config.yaml"),
+    path74.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs69.existsSync(configPath)) continue;
+    if (!fs74.existsSync(configPath)) continue;
     try {
-      const raw = fs69.readFileSync(configPath, "utf-8");
+      const raw = fs74.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -33121,7 +34073,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path70.join(os38.homedir(), ".claude.json"),
+      path: path74.join(os40.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -33129,19 +34081,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path70.join(os38.homedir(), ".cursor", "mcp.json"),
+      path: path74.join(os40.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path70.join(os38.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path74.join(os40.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path70.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path70.basename(repoPath)})`
+      path: path74.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path74.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -33174,7 +34126,7 @@ async function discoverMcpSources(repoPaths) {
 import { spawn as spawn9 } from "node:child_process";
 var VALIDATION_TIMEOUT_MS = 5e3;
 async function validateMcpEntry(entry) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     let stdout = "";
     let timedOut = false;
     let child;
@@ -33184,7 +34136,7 @@ async function validateMcpEntry(entry) {
         env: { ...process.env, ...entry.env ?? {} }
       });
     } catch (err) {
-      resolve18({
+      resolve19({
         name: entry.name,
         validated: false,
         reason: err instanceof Error ? err.message : "spawn failed"
@@ -33201,11 +34153,11 @@ async function validateMcpEntry(entry) {
     child.on("close", (code) => {
       clearTimeout(timer);
       if (timedOut) {
-        resolve18({ name: entry.name, validated: false, reason: "timeout (5s)" });
+        resolve19({ name: entry.name, validated: false, reason: "timeout (5s)" });
         return;
       }
       const validated = code === 0 && stdout.trim().length > 0;
-      resolve18({
+      resolve19({
         name: entry.name,
         validated,
         reason: validated ? "ok" : `exit code ${code ?? "null"}`
@@ -33213,7 +34165,7 @@ async function validateMcpEntry(entry) {
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve18({ name: entry.name, validated: false, reason: err.message });
+      resolve19({ name: entry.name, validated: false, reason: err.message });
     });
   });
 }
@@ -33221,18 +34173,18 @@ async function validateMcpEntry(entry) {
 // src/commands/mcp/import.ts
 async function multiSelectPicker(entries) {
   if (entries.length === 0) return [];
-  console.log("\n" + pc37.bold("Discovered MCP servers:"));
+  console.log("\n" + pc38.bold("Discovered MCP servers:"));
   entries.forEach((e, i) => {
     console.log(
-      `  ${pc37.dim(`[${i + 1}]`)} ${pc37.cyan(e.name.padEnd(20))} ${pc37.dim(e.sourceLabel)}`
+      `  ${pc38.dim(`[${i + 1}]`)} ${pc38.cyan(e.name.padEnd(20))} ${pc38.dim(e.sourceLabel)}`
     );
   });
-  console.log("\n" + pc37.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
-  const answer = await new Promise((resolve18) => {
+  console.log("\n" + pc38.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
+  const answer = await new Promise((resolve19) => {
     const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("> ", (ans) => {
       rl.close();
-      resolve18(ans.trim());
+      resolve19(ans.trim());
     });
   });
   if (!answer || answer === "") return [];
@@ -33254,7 +34206,7 @@ function registerMcpImport(cmd) {
     const repoPaths = opts.repoPaths ? opts.repoPaths.split(",").map((s) => s.trim()) : void 0;
     const { entries, sources, durationMs } = await discoverMcpSources(repoPaths);
     if (entries.length === 0) {
-      console.log(pc37.dim("No MCP servers found in any source path."));
+      console.log(pc38.dim("No MCP servers found in any source path."));
       return;
     }
     printInfo("Sources", sources.length > 0 ? sources.join(", ") : "none");
@@ -33267,15 +34219,15 @@ function registerMcpImport(cmd) {
       candidates2 = filtered;
     }
     if (skippedCount > 0) {
-      console.log(pc37.dim(`skipped: ${skippedCount} already registered`));
+      console.log(pc38.dim(`skipped: ${skippedCount} already registered`));
     }
     if (candidates2.length === 0) {
-      console.log(pc37.dim("Nothing new to import. Use --reimport to force."));
+      console.log(pc38.dim("Nothing new to import. Use --reimport to force."));
       return;
     }
     const selected = await multiSelectPicker(candidates2);
     if (selected.length === 0) {
-      console.log(pc37.dim("No servers selected."));
+      console.log(pc38.dim("No servers selected."));
       return;
     }
     console.log(`
@@ -33286,16 +34238,16 @@ Importing ${selected.length} server(s)\u2026`);
       let validated = false;
       let validationReason = "skipped";
       if (opts.validate !== false) {
-        process.stdout.write(`  ${pc37.dim("\u2192")} ${entry.name}  validating\u2026 `);
+        process.stdout.write(`  ${pc38.dim("\u2192")} ${entry.name}  validating\u2026 `);
         const vr = await validateMcpEntry(entry);
         validated = vr.validated;
         validationReason = vr.reason;
         process.stdout.write(
-          validated ? pc37.green("ok\n") : pc37.yellow(`unvalidated (${vr.reason})
+          validated ? pc38.green("ok\n") : pc38.yellow(`unvalidated (${vr.reason})
 `)
         );
       } else {
-        console.log(`  ${pc37.dim("\u2192")} ${entry.name}  ${pc37.dim("(validation skipped)")}`);
+        console.log(`  ${pc38.dim("\u2192")} ${entry.name}  ${pc38.dim("(validation skipped)")}`);
       }
       if (validated) validatedCount++;
       const result = await client.staticAdd({
@@ -33310,21 +34262,21 @@ Importing ${selected.length} server(s)\u2026`);
       }
     }
     console.log("");
-    console.log(pc37.green(`\u2713 Imported ${importedCount}/${selected.length}`));
+    console.log(pc38.green(`\u2713 Imported ${importedCount}/${selected.length}`));
     if (validatedCount > 0) {
-      console.log(pc37.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
+      console.log(pc38.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
     }
   });
 }
 
 // src/commands/mcp/revoke.ts
 init_output();
-import pc38 from "picocolors";
+import pc39 from "picocolors";
 function registerMcpRevoke(cmd) {
   cmd.command("revoke <user> <world> <service>").description("Revoke a user's MCP service entitlement (multi-tenant mode only)").action(async (user, world, service) => {
     const multiTenant = (process.env["OLAM_MCP_MULTI_TENANT"] ?? "").toLowerCase() === "true";
     if (!multiTenant) {
-      console.warn(pc38.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
+      console.warn(pc39.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
       return;
     }
     const baseUrl = process.env["OLAM_MCP_AUTH_SERVICE_URL"] ?? "http://127.0.0.1:9998";
@@ -33353,8 +34305,8 @@ function registerMcpRevoke(cmd) {
       process.exitCode = 1;
       return;
     }
-    console.log(pc38.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
-    console.log(pc38.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
+    console.log(pc39.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
+    console.log(pc39.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
   });
 }
 
@@ -33376,34 +34328,34 @@ function registerMcp(program2) {
 // src/commands/memory/start.ts
 init_output();
 import { spawn as spawn10 } from "node:child_process";
-import { existsSync as existsSync76, mkdirSync as mkdirSync43, openSync as openSync6, readFileSync as readFileSync55, writeFileSync as writeFileSync34 } from "node:fs";
-import { join as join71 } from "node:path";
+import { existsSync as existsSync80, mkdirSync as mkdirSync47, openSync as openSync7, readFileSync as readFileSync60, writeFileSync as writeFileSync39 } from "node:fs";
+import { join as join73 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/commands/memory/_paths.ts
-import { homedir as homedir39 } from "node:os";
-import { join as join70, dirname as dirname39 } from "node:path";
+import { homedir as homedir41 } from "node:os";
+import { join as join72, dirname as dirname43 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
-var OLAM_HOME2 = join70(homedir39(), ".olam");
-var OLAM_BIN_DIR = join70(OLAM_HOME2, "bin");
-var III_BINARY_PATH = join70(OLAM_BIN_DIR, "iii");
-var MEMORY_PID_PATH = join70(OLAM_HOME2, "memory.pid");
-var MEMORY_LOG_PATH = join70(OLAM_HOME2, "memory-service.log");
-var MEMORY_DATA_DIR = join70(OLAM_HOME2, "memory-data");
+var OLAM_HOME2 = join72(homedir41(), ".olam");
+var OLAM_BIN_DIR = join72(OLAM_HOME2, "bin");
+var III_BINARY_PATH = join72(OLAM_BIN_DIR, "iii");
+var MEMORY_PID_PATH = join72(OLAM_HOME2, "memory.pid");
+var MEMORY_LOG_PATH = join72(OLAM_HOME2, "memory-service.log");
+var MEMORY_DATA_DIR = join72(OLAM_HOME2, "memory-data");
 var MEMORY_REST_PORT = 3111;
 var MEMORY_LIVEZ_URL = `http://localhost:${MEMORY_REST_PORT}/agentmemory/livez`;
-var here2 = dirname39(fileURLToPath6(import.meta.url));
+var here2 = dirname43(fileURLToPath6(import.meta.url));
 var candidates = [
   // 1. Workspace dev (built): packages/cli/dist/commands/memory/_paths.js → packages/cli → packages/memory-service
-  join70(here2, "..", "..", "..", "..", "memory-service"),
+  join72(here2, "..", "..", "..", "..", "memory-service"),
   // 2a. Workspace bundled: packages/cli/dist/index.js → packages/cli → packages/memory-service
-  join70(here2, "..", "..", "memory-service"),
+  join72(here2, "..", "..", "memory-service"),
   // 2b. Published tarball: <prefix>/node_modules/@pleri/olam-cli/dist/index.js
   //     → <prefix>/node_modules/@pleri/olam-cli/memory-service-bundle
   //     (copied at publish time by bundle-cli.mjs)
-  join70(here2, "..", "memory-service-bundle"),
+  join72(here2, "..", "memory-service-bundle"),
   // 3. CWD fallback
-  join70(process.cwd(), "packages", "memory-service")
+  join72(process.cwd(), "packages", "memory-service")
 ];
 var MEMORY_SERVICE_CANDIDATES = candidates;
 
@@ -33412,7 +34364,7 @@ var READINESS_TIMEOUT_MS = 3e4;
 var READINESS_POLL_MS = 500;
 function resolveMemoryServiceDir() {
   for (const c of MEMORY_SERVICE_CANDIDATES) {
-    if (existsSync76(c)) return c;
+    if (existsSync80(c)) return c;
   }
   throw new Error(
     `Could not find packages/memory-service/. Searched: ${MEMORY_SERVICE_CANDIDATES.join(", ")}. If running from a published @pleri/olam-cli tarball, this is a packaging bug \u2014 please file an issue.`
@@ -33420,12 +34372,12 @@ function resolveMemoryServiceDir() {
 }
 function resolveAgentMemoryBin(serviceDir) {
   const candidates2 = [
-    join71(serviceDir, "node_modules", ".bin", "agentmemory"),
-    join71(serviceDir, "..", "..", "node_modules", ".bin", "agentmemory"),
-    join71(serviceDir, "..", "..", "..", "node_modules", ".bin", "agentmemory")
+    join73(serviceDir, "node_modules", ".bin", "agentmemory"),
+    join73(serviceDir, "..", "..", "node_modules", ".bin", "agentmemory"),
+    join73(serviceDir, "..", "..", "..", "node_modules", ".bin", "agentmemory")
   ];
   for (const c of candidates2) {
-    if (existsSync76(c)) return c;
+    if (existsSync80(c)) return c;
   }
   throw new Error(
     `Could not find agentmemory bin. Searched: ${candidates2.join(", ")}. Run 'npm install' from the repo root.`
@@ -33440,8 +34392,8 @@ function isProcessAlive(pid) {
   }
 }
 function readPidFromFile() {
-  if (!existsSync76(MEMORY_PID_PATH)) return null;
-  const raw = readFileSync55(MEMORY_PID_PATH, "utf8").trim();
+  if (!existsSync80(MEMORY_PID_PATH)) return null;
+  const raw = readFileSync60(MEMORY_PID_PATH, "utf8").trim();
   const pid = parseInt(raw, 10);
   if (!Number.isFinite(pid) || pid <= 0) return null;
   return pid;
@@ -33468,7 +34420,7 @@ async function waitForReady(secret) {
   return false;
 }
 async function autoEnsureIiiBinary(serviceDir) {
-  const helperPath = join71(serviceDir, "scripts", "ensure-iii-engine.mjs");
+  const helperPath = join73(serviceDir, "scripts", "ensure-iii-engine.mjs");
   const mod = await import(pathToFileURL(helperPath).href);
   const result = await mod.ensureIiiEngine();
   if (!result.ok) {
@@ -33484,7 +34436,7 @@ async function runMemoryStart() {
     printError(err instanceof Error ? err.message : String(err));
     return 1;
   }
-  if (!existsSync76(III_BINARY_PATH)) {
+  if (!existsSync80(III_BINARY_PATH)) {
     printInfo("iii binary", `missing at ${III_BINARY_PATH} \u2014 auto-fetching v0.11.2`);
     try {
       await autoEnsureIiiBinary(serviceDir);
@@ -33512,9 +34464,9 @@ async function runMemoryStart() {
     );
     return 1;
   }
-  mkdirSync43(OLAM_HOME2, { recursive: true });
-  mkdirSync43(MEMORY_DATA_DIR, { recursive: true });
-  const logFd = openSync6(MEMORY_LOG_PATH, "a");
+  mkdirSync47(OLAM_HOME2, { recursive: true });
+  mkdirSync47(MEMORY_DATA_DIR, { recursive: true });
+  const logFd = openSync7(MEMORY_LOG_PATH, "a");
   const child = spawn10(agentmemoryBin, [], {
     cwd: OLAM_HOME2,
     env: {
@@ -33536,7 +34488,7 @@ async function runMemoryStart() {
     printError("spawn returned no pid (process failed to start)");
     return 1;
   }
-  writeFileSync34(MEMORY_PID_PATH, `${child.pid}
+  writeFileSync39(MEMORY_PID_PATH, `${child.pid}
 `, { mode: 420 });
   printInfo("pid", `${child.pid}`);
   printInfo("readiness", `polling ${MEMORY_LIVEZ_URL}`);
@@ -33559,7 +34511,7 @@ function registerMemoryStart(cmd) {
 
 // src/commands/memory/stop.ts
 init_output();
-import { existsSync as existsSync77, readFileSync as readFileSync56, unlinkSync as unlinkSync19 } from "node:fs";
+import { existsSync as existsSync81, readFileSync as readFileSync61, unlinkSync as unlinkSync21 } from "node:fs";
 var SIGTERM_GRACE_MS = 1e4;
 var POLL_MS = 250;
 function isAlive(pid) {
@@ -33572,19 +34524,19 @@ function isAlive(pid) {
 }
 async function runMemoryStop() {
   printHeader("olam memory stop");
-  if (!existsSync77(MEMORY_PID_PATH)) {
+  if (!existsSync81(MEMORY_PID_PATH)) {
     printSuccess("no pidfile present (nothing to stop)");
     return 0;
   }
-  const pid = parseInt(readFileSync56(MEMORY_PID_PATH, "utf8").trim(), 10);
+  const pid = parseInt(readFileSync61(MEMORY_PID_PATH, "utf8").trim(), 10);
   if (!Number.isFinite(pid) || pid <= 0) {
     printWarning(`pidfile contained invalid value; removing`);
-    unlinkSync19(MEMORY_PID_PATH);
+    unlinkSync21(MEMORY_PID_PATH);
     return 0;
   }
   if (!isAlive(pid)) {
     printSuccess(`pid ${pid} is not running (stale pidfile); cleaned up`);
-    unlinkSync19(MEMORY_PID_PATH);
+    unlinkSync21(MEMORY_PID_PATH);
     return 0;
   }
   printInfo("pid", `${pid}`);
@@ -33607,8 +34559,8 @@ async function runMemoryStop() {
     }
     await new Promise((r) => setTimeout(r, 500));
   }
-  if (existsSync77(MEMORY_PID_PATH)) {
-    unlinkSync19(MEMORY_PID_PATH);
+  if (existsSync81(MEMORY_PID_PATH)) {
+    unlinkSync21(MEMORY_PID_PATH);
   }
   printSuccess(`stopped (pid ${pid})`);
   return 0;
@@ -33622,7 +34574,7 @@ function registerMemoryStop(cmd) {
 
 // src/commands/memory/status.ts
 init_output();
-import { existsSync as existsSync78, readFileSync as readFileSync57 } from "node:fs";
+import { existsSync as existsSync82, readFileSync as readFileSync62 } from "node:fs";
 function isAlive2(pid) {
   try {
     process.kill(pid, 0);
@@ -33646,8 +34598,8 @@ async function probe(secret) {
 }
 async function collectMemoryStatus() {
   let pid = null;
-  if (existsSync78(MEMORY_PID_PATH)) {
-    const raw = readFileSync57(MEMORY_PID_PATH, "utf8").trim();
+  if (existsSync82(MEMORY_PID_PATH)) {
+    const raw = readFileSync62(MEMORY_PID_PATH, "utf8").trim();
     const parsed = parseInt(raw, 10);
     pid = Number.isFinite(parsed) && parsed > 0 ? parsed : null;
   }
@@ -33659,7 +34611,7 @@ async function collectMemoryStatus() {
     alive,
     livez,
     secretSet: hasMemorySecret(),
-    iiiBinary: existsSync78(III_BINARY_PATH) ? III_BINARY_PATH : null,
+    iiiBinary: existsSync82(III_BINARY_PATH) ? III_BINARY_PATH : null,
     port: MEMORY_REST_PORT
   };
 }
@@ -33702,10 +34654,10 @@ function registerMemoryStatus(cmd) {
 
 // src/commands/memory/logs.ts
 init_output();
-import { existsSync as existsSync79 } from "node:fs";
+import { existsSync as existsSync83 } from "node:fs";
 import { spawn as spawn11 } from "node:child_process";
 async function runMemoryLogs(opts) {
-  if (!existsSync79(MEMORY_LOG_PATH)) {
+  if (!existsSync83(MEMORY_LOG_PATH)) {
     printWarning(`no log at ${MEMORY_LOG_PATH} (start the service first via 'olam memory start')`);
     return 1;
   }
@@ -33719,8 +34671,8 @@ async function runMemoryLogs(opts) {
   args.push(MEMORY_LOG_PATH);
   printHeader(`olam memory logs (${opts.follow ? "follow" : `tail -n ${tailN}`})`);
   const child = spawn11("tail", args, { stdio: "inherit" });
-  return new Promise((resolve18) => {
-    child.on("exit", (code) => resolve18(code ?? 0));
+  return new Promise((resolve19) => {
+    child.on("exit", (code) => resolve19(code ?? 0));
   });
 }
 function registerMemoryLogs(cmd) {
@@ -33731,7 +34683,7 @@ function registerMemoryLogs(cmd) {
 }
 
 // src/commands/memory/secret.ts
-import { existsSync as existsSync80 } from "node:fs";
+import { existsSync as existsSync84 } from "node:fs";
 init_output();
 async function runMemorySecretShow() {
   if (!hasMemorySecret()) {
@@ -33746,7 +34698,7 @@ async function runMemorySecretShow() {
 }
 async function runMemorySecretRotate() {
   printHeader("olam memory secret rotate");
-  const wasRunning = existsSync80(MEMORY_PID_PATH);
+  const wasRunning = existsSync84(MEMORY_PID_PATH);
   if (wasRunning) {
     printInfo("current state", "service running; will restart with new secret");
     const stopRc = await runMemoryStop();
@@ -33928,14 +34880,14 @@ function registerMemoryUninstall(cmd) {
 // src/commands/memory/mode.ts
 init_schema2();
 init_output();
-import { existsSync as existsSync81, readFileSync as readFileSync58, writeFileSync as writeFileSync35 } from "node:fs";
-import { join as join72 } from "node:path";
+import { existsSync as existsSync85, readFileSync as readFileSync63, writeFileSync as writeFileSync40 } from "node:fs";
+import { join as join74 } from "node:path";
 import * as readline6 from "node:readline/promises";
 import { parse as parseYaml7, stringify as stringifyYaml6 } from "yaml";
 var CONFIG_REL = ".olam/config.yaml";
 function locateConfig(cwd) {
-  const absPath = join72(cwd, CONFIG_REL);
-  if (!existsSync81(absPath)) {
+  const absPath = join74(cwd, CONFIG_REL);
+  if (!existsSync85(absPath)) {
     throw new Error(
       `No ${CONFIG_REL} at ${cwd}. Run \`olam init\` in your workspace root first.`
     );
@@ -33943,7 +34895,7 @@ function locateConfig(cwd) {
   return { absPath };
 }
 function readConfigYaml(absPath) {
-  const raw = readFileSync58(absPath, "utf-8");
+  const raw = readFileSync63(absPath, "utf-8");
   const parsed = parseYaml7(raw) ?? {};
   if (typeof parsed !== "object" || parsed === null) {
     throw new Error(`${absPath} is not a YAML object`);
@@ -33952,7 +34904,7 @@ function readConfigYaml(absPath) {
 }
 function writeConfigYaml(absPath, parsed) {
   const out = stringifyYaml6(parsed, { aliasDuplicateObjects: false });
-  writeFileSync35(absPath, out, "utf-8");
+  writeFileSync40(absPath, out, "utf-8");
 }
 async function defaultPromptText(question) {
   const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
@@ -34071,25 +35023,25 @@ function registerMemoryMode(cmd) {
 // src/commands/memory/bridge.ts
 init_output();
 import { spawn as spawn12 } from "node:child_process";
-import { existsSync as existsSync82 } from "node:fs";
-import { join as join73 } from "node:path";
+import { existsSync as existsSync86 } from "node:fs";
+import { join as join75 } from "node:path";
 var DEFAULT_PORT2 = 8788;
 function resolveMemoryServiceDir2() {
   for (const c of MEMORY_SERVICE_CANDIDATES) {
-    if (existsSync82(c)) return c;
+    if (existsSync86(c)) return c;
   }
   throw new Error(
     `Could not find packages/memory-service/. Searched: ${MEMORY_SERVICE_CANDIDATES.join(", ")}. If running from a published @pleri/olam-cli tarball, this is a packaging bug \u2014 please file an issue.`
   );
 }
 function resolveLocalBridgeScript(serviceDir) {
-  const path78 = join73(serviceDir, "scripts", "local-bridge-server.mjs");
-  if (!existsSync82(path78)) {
+  const path82 = join75(serviceDir, "scripts", "local-bridge-server.mjs");
+  if (!existsSync86(path82)) {
     throw new Error(
-      `Could not find local-bridge-server.mjs at ${path78}. Verify packages/memory-service ships the scripts/ directory.`
+      `Could not find local-bridge-server.mjs at ${path82}. Verify packages/memory-service ships the scripts/ directory.`
     );
   }
-  return path78;
+  return path82;
 }
 function validateBridgeOpts(opts) {
   const local = opts.local ?? false;
@@ -34137,12 +35089,12 @@ async function runBridgeServe(opts, deps = {}) {
     stdio: "inherit"
   }));
   const child = spawner(process.execPath, [scriptPath, ...args], env);
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     let resolved = false;
     const finish = (code) => {
       if (resolved) return;
       resolved = true;
-      resolve18(code);
+      resolve19(code);
     };
     const forward = (signal) => () => {
       if (!child.killed) {
@@ -34450,9 +35402,9 @@ function registerMemory(program2) {
 // src/commands/kg-build.ts
 init_storage_paths();
 init_workspace_name();
-import * as fs74 from "node:fs";
-import * as os41 from "node:os";
-import * as path75 from "node:path";
+import * as fs79 from "node:fs";
+import * as os43 from "node:os";
+import * as path79 from "node:path";
 
 // ../core/dist/kg/kg-service-client.js
 var KG_SERVICE_PORT_DEFAULT = 9997;
@@ -34463,8 +35415,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path78) {
-  return `http://127.0.0.1:${port()}${path78}`;
+function url(path82) {
+  return `http://127.0.0.1:${port()}${path82}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -34489,8 +35441,8 @@ var KgServiceUnreachableError = class extends Error {
     this.name = "KgServiceUnreachableError";
   }
 };
-var DEFAULT_TIMEOUT_MS4 = 5e3;
-async function postJson(endpointUrl, body, timeoutMs = DEFAULT_TIMEOUT_MS4) {
+var DEFAULT_TIMEOUT_MS5 = 5e3;
+async function postJson(endpointUrl, body, timeoutMs = DEFAULT_TIMEOUT_MS5) {
   let res;
   try {
     res = await fetch(endpointUrl, {
@@ -34508,7 +35460,7 @@ async function postJson(endpointUrl, body, timeoutMs = DEFAULT_TIMEOUT_MS4) {
   }
   return await res.json();
 }
-async function getJson(endpointUrl, timeoutMs = DEFAULT_TIMEOUT_MS4) {
+async function getJson(endpointUrl, timeoutMs = DEFAULT_TIMEOUT_MS5) {
   let res;
   try {
     res = await fetch(endpointUrl, { signal: AbortSignal.timeout(timeoutMs) });
@@ -34542,40 +35494,40 @@ init_output();
 // src/commands/kg-status.ts
 init_storage_paths();
 init_workspace_name();
-import fs70 from "node:fs";
-import { homedir as homedir40 } from "node:os";
-import path71 from "node:path";
+import fs75 from "node:fs";
+import { homedir as homedir42 } from "node:os";
+import path75 from "node:path";
 init_output();
 function olamHome4() {
-  return process.env.OLAM_HOME ?? path71.join(homedir40(), ".olam");
+  return process.env.OLAM_HOME ?? path75.join(homedir42(), ".olam");
 }
 function kgRoot2() {
-  return path71.join(olamHome4(), "kg");
+  return path75.join(olamHome4(), "kg");
 }
 function worldsRoot2() {
-  return path71.join(olamHome4(), "worlds");
+  return path75.join(olamHome4(), "worlds");
 }
 function dirSizeBytes2(dir) {
-  if (!fs70.existsSync(dir)) return 0;
+  if (!fs75.existsSync(dir)) return 0;
   let total = 0;
   const stack = [dir];
   while (stack.length > 0) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs70.readdirSync(cur, { withFileTypes: true });
+      entries = fs75.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const full = path71.join(cur, entry.name);
+      const full = path75.join(cur, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
       }
       try {
-        total += fs70.statSync(full).size;
+        total += fs75.statSync(full).size;
       } catch {
       }
     }
@@ -34589,10 +35541,10 @@ function formatBytes5(n) {
   return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 function readFreshness(workspace) {
-  const file = path71.join(kgPristinePath(workspace), "freshness.json");
-  if (!fs70.existsSync(file)) return null;
+  const file = path75.join(kgPristinePath(workspace), "freshness.json");
+  if (!fs75.existsSync(file)) return null;
   try {
-    const raw = JSON.parse(fs70.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs75.readFileSync(file, "utf-8"));
     if (raw && typeof raw === "object") return raw;
     return null;
   } catch {
@@ -34600,10 +35552,10 @@ function readFreshness(workspace) {
   }
 }
 function readOverlayNodeCount(graphifyOutDir) {
-  const graphPath = path71.join(graphifyOutDir, "graph.json");
-  if (!fs70.existsSync(graphPath)) return null;
+  const graphPath = path75.join(graphifyOutDir, "graph.json");
+  if (!fs75.existsSync(graphPath)) return null;
   try {
-    const raw = JSON.parse(fs70.readFileSync(graphPath, "utf-8"));
+    const raw = JSON.parse(fs75.readFileSync(graphPath, "utf-8"));
     if (raw && typeof raw === "object") {
       const nodes = raw.nodes;
       if (Array.isArray(nodes)) return nodes.length;
@@ -34615,28 +35567,28 @@ function readOverlayNodeCount(graphifyOutDir) {
 }
 function listOverlays() {
   const root = worldsRoot2();
-  if (!fs70.existsSync(root)) return [];
+  if (!fs75.existsSync(root)) return [];
   const records = [];
   let worldDirs;
   try {
-    worldDirs = fs70.readdirSync(root, { withFileTypes: true });
+    worldDirs = fs75.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
   for (const worldEntry of worldDirs) {
     if (!worldEntry.isDirectory()) continue;
     const worldId = worldEntry.name;
-    const worldDir = path71.join(root, worldId);
+    const worldDir = path75.join(root, worldId);
     let cloneDirs;
     try {
-      cloneDirs = fs70.readdirSync(worldDir, { withFileTypes: true });
+      cloneDirs = fs75.readdirSync(worldDir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const cloneEntry of cloneDirs) {
       if (!cloneEntry.isDirectory()) continue;
-      const graphifyOut = path71.join(worldDir, cloneEntry.name, "graphify-out");
-      if (!fs70.existsSync(graphifyOut)) continue;
+      const graphifyOut = path75.join(worldDir, cloneEntry.name, "graphify-out");
+      if (!fs75.existsSync(graphifyOut)) continue;
       records.push({
         world_id: worldId,
         clone_dir: cloneEntry.name,
@@ -34650,11 +35602,11 @@ function listOverlays() {
 }
 function listPristines(overlays) {
   const root = kgRoot2();
-  if (!fs70.existsSync(root)) return [];
+  if (!fs75.existsSync(root)) return [];
   const records = [];
   let entries;
   try {
-    entries = fs70.readdirSync(root, { withFileTypes: true });
+    entries = fs75.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -34667,7 +35619,7 @@ function listPristines(overlays) {
       continue;
     }
     const fresh = readFreshness(workspace);
-    const graphifyOut = path71.join(kgPristinePath(workspace), "graphify-out");
+    const graphifyOut = path75.join(kgPristinePath(workspace), "graphify-out");
     const size = dirSizeBytes2(graphifyOut);
     const worldCount = overlays.filter((o) => o.clone_dir === workspace).length;
     records.push({
@@ -34803,10 +35755,10 @@ init_storage_paths();
 init_workspace_name();
 init_output();
 import { spawn as spawn13 } from "node:child_process";
-import fs71 from "node:fs";
-import path72 from "node:path";
+import fs76 from "node:fs";
+import path76 from "node:path";
 function pidFilePath2(workspace) {
-  return path72.join(kgPristinePath(workspace), ".watch.pid");
+  return path76.join(kgPristinePath(workspace), ".watch.pid");
 }
 function isPidAlive3(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -34821,39 +35773,39 @@ function isPidAlive3(pid) {
 }
 function readAndClassifyPid(workspace) {
   const file = pidFilePath2(workspace);
-  if (!fs71.existsSync(file)) return { status: "no-pidfile", pid: null };
+  if (!fs76.existsSync(file)) return { status: "no-pidfile", pid: null };
   let pid;
   try {
-    const raw = fs71.readFileSync(file, "utf-8").trim();
+    const raw = fs76.readFileSync(file, "utf-8").trim();
     pid = Number.parseInt(raw, 10);
   } catch {
-    fs71.rmSync(file, { force: true });
+    fs76.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (!Number.isInteger(pid) || pid <= 0) {
-    fs71.rmSync(file, { force: true });
+    fs76.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (isPidAlive3(pid)) return { status: "active", pid };
-  fs71.rmSync(file, { force: true });
+  fs76.rmSync(file, { force: true });
   return { status: "stale-reclaimed", pid: null };
 }
 function writePidFile2(workspace, pid) {
   const file = pidFilePath2(workspace);
-  const dir = path72.dirname(file);
-  fs71.mkdirSync(dir, { recursive: true });
-  fs71.writeFileSync(file, String(pid), { encoding: "utf-8" });
+  const dir = path76.dirname(file);
+  fs76.mkdirSync(dir, { recursive: true });
+  fs76.writeFileSync(file, String(pid), { encoding: "utf-8" });
 }
 function removePidFile(workspace) {
   const file = pidFilePath2(workspace);
   try {
-    fs71.rmSync(file, { force: true });
+    fs76.rmSync(file, { force: true });
   } catch {
   }
 }
 async function runKgWatch(workspaceArg, opts, deps = {}) {
   const cwd = deps.cwd ?? opts.cwd ?? process.cwd();
-  const name = workspaceArg ?? path72.basename(cwd).toLowerCase();
+  const name = workspaceArg ?? path76.basename(cwd).toLowerCase();
   try {
     validateWorkspaceName(name);
   } catch (err) {
@@ -34861,7 +35813,7 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
     return { exitCode: 1, pidWritten: false };
   }
   const pristinePath = kgPristinePath(name);
-  const graphPath = path72.join(pristinePath, "graphify-out", "graph.json");
+  const graphPath = path76.join(pristinePath, "graphify-out", "graph.json");
   const pidState = readAndClassifyPid(name);
   if (pidState.status === "active") {
     printError(
@@ -34901,16 +35853,16 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
     process.on("SIGINT", () => forward("SIGINT"));
     process.on("SIGTERM", () => forward("SIGTERM"));
   }
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     child.on("exit", (code, signal) => {
       removePidFile(name);
       const exitCode = typeof code === "number" ? code : signal === "SIGINT" || signal === "SIGTERM" ? 0 : 1;
-      resolve18({ exitCode, pidWritten: true });
+      resolve19({ exitCode, pidWritten: true });
     });
     child.on("error", (err) => {
       removePidFile(name);
       printError(`graphify subprocess error: ${err.message}`);
-      resolve18({ exitCode: 1, pidWritten: true });
+      resolve19({ exitCode: 1, pidWritten: true });
     });
   });
 }
@@ -34924,7 +35876,7 @@ function registerKgWatchCommand(kg) {
 }
 
 // src/commands/kg-classify.ts
-import pc39 from "picocolors";
+import pc40 from "picocolors";
 init_output();
 function registerKgClassifyCommand(kg) {
   kg.command("classify <question>").description("Route a question to kg | grep | both via the 4-layer classifier (kg-service required)").option("--workspace <name>", "Scope the L2 probe gate to a specific workspace graph").option("--json", "Emit raw JSON instead of the formatted summary").action(async (question, opts) => {
@@ -34934,7 +35886,7 @@ function registerKgClassifyCommand(kg) {
         process.stdout.write(JSON.stringify(result, null, 2) + "\n");
         return;
       }
-      const routeStr = result.route === "kg" ? pc39.cyan("kg") : result.route === "grep" ? pc39.magenta("grep") : pc39.yellow("both");
+      const routeStr = result.route === "kg" ? pc40.cyan("kg") : result.route === "grep" ? pc40.magenta("grep") : pc40.yellow("both");
       printInfo("route", `${routeStr}  (layer ${result.layer}, took ${result.took_ms}ms)`);
       printInfo("confidence", String(result.confidence));
       printInfo("reason", result.reason);
@@ -34956,7 +35908,7 @@ function registerKgClassifyCommand(kg) {
 }
 
 // src/commands/kg-doctor.ts
-import pc40 from "picocolors";
+import pc41 from "picocolors";
 init_output();
 async function runProbes() {
   const results = [];
@@ -35075,12 +36027,12 @@ function registerKgDoctorCommand(kg) {
     } else {
       printHeader("kg-service doctor");
       for (const p of probes) {
-        const badge = p.status === "ok" ? pc40.green("\u2713") : p.status === "warn" ? pc40.yellow("\u2298") : pc40.red("\u2717");
+        const badge = p.status === "ok" ? pc41.green("\u2713") : p.status === "warn" ? pc41.yellow("\u2298") : pc41.red("\u2717");
         const label = `${badge}  ${p.name}`;
         const detail = p.detail ?? "";
         printInfo(label, detail);
         if (p.remedy) {
-          process.stderr.write(`      ${pc40.dim("remedy:")} ${p.remedy}
+          process.stderr.write(`      ${pc41.dim("remedy:")} ${p.remedy}
 `);
         }
       }
@@ -35098,9 +36050,9 @@ function registerKgDoctorCommand(kg) {
 }
 
 // src/commands/kg-install-hook.ts
-import * as fs72 from "node:fs";
-import * as path73 from "node:path";
-import * as os39 from "node:os";
+import * as fs77 from "node:fs";
+import * as path77 from "node:path";
+import * as os41 from "node:os";
 
 // ../core/dist/kg/hook-template.js
 var KG_HOOK_SENTINEL = "kg-service-v2-classifier-hook";
@@ -35151,15 +36103,15 @@ function buildHookMatcherEntry(opts) {
 init_output();
 function settingsPathFor2(scope) {
   if (scope === "user") {
-    return path73.join(os39.homedir(), ".claude", "settings.json");
+    return path77.join(os41.homedir(), ".claude", "settings.json");
   }
-  return path73.join(process.cwd(), ".claude", "settings.json");
+  return path77.join(process.cwd(), ".claude", "settings.json");
 }
 function backup2(filePath) {
-  if (!fs72.existsSync(filePath)) return null;
+  if (!fs77.existsSync(filePath)) return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs72.copyFileSync(filePath, backupPath);
+  fs77.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 function registerKgInstallHookCommand(kg) {
@@ -35167,9 +36119,9 @@ function registerKgInstallHookCommand(kg) {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor2(scope);
     try {
-      fs72.mkdirSync(path73.dirname(filePath), { recursive: true });
+      fs77.mkdirSync(path77.dirname(filePath), { recursive: true });
     } catch (err) {
-      printError(`could not create ${path73.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
+      printError(`could not create ${path77.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
       return;
     }
@@ -35193,7 +36145,7 @@ function registerKgInstallHookCommand(kg) {
           printInfo("kg-service hook", `already installed at ${filePath}`);
           if (backupPath) {
             try {
-              fs72.unlinkSync(backupPath);
+              fs77.unlinkSync(backupPath);
             } catch {
             }
           }
@@ -35211,15 +36163,15 @@ function registerKgInstallHookCommand(kg) {
 }
 
 // src/commands/kg-uninstall-hook.ts
-import * as fs73 from "node:fs";
-import * as path74 from "node:path";
-import * as os40 from "node:os";
+import * as fs78 from "node:fs";
+import * as path78 from "node:path";
+import * as os42 from "node:os";
 init_output();
 function settingsPathFor3(scope) {
   if (scope === "user") {
-    return path74.join(os40.homedir(), ".claude", "settings.json");
+    return path78.join(os42.homedir(), ".claude", "settings.json");
   }
-  return path74.join(process.cwd(), ".claude", "settings.json");
+  return path78.join(process.cwd(), ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -35249,13 +36201,13 @@ function registerKgUninstallHookCommand(kg) {
   kg.command("uninstall-hook").description("Remove kg-service PreToolUse hook from .claude/settings.json (sentinel-matched; surgical)").option("--scope <scope>", "project (default) or user", "project").action((opts) => {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor3(scope);
-    if (!fs73.existsSync(filePath)) {
+    if (!fs78.existsSync(filePath)) {
       printInfo("kg-service hook", `no settings.json at ${filePath} \u2014 nothing to remove`);
       return;
     }
     let settings;
     try {
-      const raw = fs73.readFileSync(filePath, "utf-8");
+      const raw = fs78.readFileSync(filePath, "utf-8");
       settings = raw.trim() ? JSON.parse(raw) : {};
     } catch (err) {
       printError(`could not parse ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
@@ -35275,7 +36227,7 @@ function registerKgUninstallHookCommand(kg) {
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const backupPath = `${filePath}.olam-bak.${ts}`;
     try {
-      fs73.copyFileSync(filePath, backupPath);
+      fs78.copyFileSync(filePath, backupPath);
     } catch {
     }
     const next = {
@@ -35294,7 +36246,7 @@ function registerKgUninstallHookCommand(kg) {
       }
     }
     try {
-      fs73.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs78.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
       printSuccess(`kg-service hook removed from ${filePath}`);
       printInfo("backup", backupPath);
     } catch (err) {
@@ -35368,20 +36320,20 @@ function registerKgSavingsCommand(kg) {
 // src/commands/kg-build.ts
 function resolveWorkspace(arg) {
   const cwd = process.cwd();
-  const name = arg ?? path75.basename(cwd).toLowerCase();
+  const name = arg ?? path79.basename(cwd).toLowerCase();
   validateWorkspaceName(name);
   return { name, sourcePath: cwd };
 }
 function toContainerPath(hostPath) {
-  const home = os41.homedir();
-  const resolved = path75.resolve(hostPath);
-  if (!resolved.startsWith(home + path75.sep) && resolved !== home) {
+  const home = os43.homedir();
+  const resolved = path79.resolve(hostPath);
+  if (!resolved.startsWith(home + path79.sep) && resolved !== home) {
     throw new Error(
       `source path "${resolved}" is not under $HOME (${home}). kg-service can only build repos that live under your home dir (it bind-mounts $HOME:/host-home:ro at start). Move the repo or set OLAM_HOME if you need a different root.`
     );
   }
-  const rel = path75.relative(home, resolved);
-  return rel === "" ? "/host-home" : path75.posix.join("/host-home", rel.split(path75.sep).join("/"));
+  const rel = path79.relative(home, resolved);
+  return rel === "" ? "/host-home" : path79.posix.join("/host-home", rel.split(path79.sep).join("/"));
 }
 async function runKgBuild(workspaceArg, options = {}) {
   let workspace;
@@ -35399,7 +36351,7 @@ async function runKgBuild(workspaceArg, options = {}) {
     return { exitCode: 2 };
   }
   const outDir = kgPristinePath(workspace.name);
-  fs74.mkdirSync(outDir, { recursive: true });
+  fs79.mkdirSync(outDir, { recursive: true });
   const human = !options.json;
   if (human) {
     printInfo("kg build", `workspace=${workspace.name} source=${workspace.sourcePath}`);
@@ -35432,12 +36384,12 @@ async function runKgBuild(workspaceArg, options = {}) {
     workspace: workspace.name,
     graphify_path: "container"
   };
-  fs74.writeFileSync(
-    path75.join(outDir, "freshness.json"),
+  fs79.writeFileSync(
+    path79.join(outDir, "freshness.json"),
     JSON.stringify(freshness, null, 2) + "\n",
     "utf-8"
   );
-  const finalOut = path75.join(outDir, "graphify-out");
+  const finalOut = path79.join(outDir, "graphify-out");
   if (options.json) {
     process.stdout.write(JSON.stringify(freshness) + "\n");
   } else {
@@ -35714,14 +36666,14 @@ init_manager();
 init_context();
 init_output();
 import { spawnSync as defaultSpawnSync } from "node:child_process";
-import * as fs75 from "node:fs";
-import * as os42 from "node:os";
-import * as path76 from "node:path";
+import * as fs80 from "node:fs";
+import * as os44 from "node:os";
+import * as path80 from "node:path";
 function devboxContainerName(worldId) {
   return `olam-${worldId}-devbox`;
 }
 function olamHomeDir() {
-  return process.env["OLAM_HOME"] ?? path76.join(os42.homedir(), ".olam");
+  return process.env["OLAM_HOME"] ?? path80.join(os44.homedir(), ".olam");
 }
 function defaultRestartContainer(name, spawn14 = defaultSpawnSync) {
   const r = spawn14("docker", ["restart", "--time", "30", name], {
@@ -35734,8 +36686,8 @@ function defaultRestartContainer(name, spawn14 = defaultSpawnSync) {
   };
 }
 function defaultAppendAuditLog(homeDir, line) {
-  fs75.mkdirSync(homeDir, { recursive: true });
-  fs75.appendFileSync(path76.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
+  fs80.mkdirSync(homeDir, { recursive: true });
+  fs80.appendFileSync(path80.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
     encoding: "utf-8"
   });
 }
@@ -35780,19 +36732,19 @@ async function doRekey(worldId, deps) {
   );
   const rotatedAt = deps.now().toISOString();
   const homeDir = deps.olamHomeDir();
-  const worldDir = path76.join(homeDir, "worlds", worldId);
-  fs75.mkdirSync(worldDir, { recursive: true });
-  const credentialsPath = path76.join(worldDir, "credentials.json");
+  const worldDir = path80.join(homeDir, "worlds", worldId);
+  fs80.mkdirSync(worldDir, { recursive: true });
+  const credentialsPath = path80.join(worldDir, "credentials.json");
   const payload = {
     worldRoleName,
     password,
     rotatedAt
   };
-  fs75.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
+  fs80.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
-  fs75.chmodSync(credentialsPath, 384);
+  fs80.chmodSync(credentialsPath, 384);
   const restart = deps.restartContainer(devboxContainerName(worldId));
   deps.appendAuditLog(`${rotatedAt} ${worldId} rekey`);
   if (!restart.ok) {
@@ -35856,18 +36808,18 @@ function registerRekey(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs76 from "node:fs";
-import * as path77 from "node:path";
+import * as fs81 from "node:fs";
+import * as path81 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path77.join(configDir, "config.yaml");
-  if (!fs76.existsSync(configPath)) {
+  const configPath = path81.join(configDir, "config.yaml");
+  if (!fs81.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs76.readFileSync(configPath, "utf8");
+    const contents = fs81.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -35939,6 +36891,8 @@ registerSkillsHook(program);
 registerSkillsOnboard(program);
 registerSkillsMigrate(program);
 registerSkillsMigrateBack(program);
+registerSkillsMigrateHooks(program);
+registerSkillsMigrateHooksBack(program);
 registerSkillsShadowBackups(program);
 registerSkillsDoctor(program);
 program.parse();