@pleri/olam-cli 0.1.146 → 0.1.148

package/dist/mcp-server.js

@@ -445,8 +445,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path44, errorMaps, issueData } = params;
-      const fullPath = [...path44, ...issueData.path || []];
+      const { data, path: path46, errorMaps, issueData } = params;
+      const fullPath = [...path46, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -754,11 +754,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path44, key) {
+      constructor(parent, value, path46, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path44;
+        this._path = path46;
         this._key = key;
       }
       get path() {
@@ -7332,8 +7332,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path44) {
-      let input = path44;
+    function removeDotSegments(path46) {
+      let input = path46;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -7532,8 +7532,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path44, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path44 && path44 !== "/" ? path44 : void 0;
+        const [path46, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path46 && path46 !== "/" ? path46 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -10895,12 +10895,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs42, exportName) {
+    function addFormats(ajv, list, fs46, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs42[f]);
+        ajv.addFormat(f, fs46[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -11008,7 +11008,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path44, ctx, rejectSource) {
+function refineForbiddenKeys(value, path46, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -11016,12 +11016,12 @@ function refineForbiddenKeys(value, path44, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path44, key],
+        path: [...path46, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path44.length === 0 && key === "source") {
+    if (rejectSource && path46.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -11029,21 +11029,21 @@ function refineForbiddenKeys(value, path44, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path44, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path46, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path44, rejectSource) {
+function rejectForbiddenKeys(value, path46, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path44}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path46}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path44}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path46}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path44}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path46}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -11921,7 +11921,7 @@ function isAbsoluteOrTilde(p) {
 function hasNoTraversalComponents(p) {
   return !p.split("/").some((seg) => seg === "..");
 }
-var RepoEntrySchema, PortMapSchema, SeedSqlFileSchema, SeedCommandSchema, SeedFixtureCopySchema, SeedSchema, RunbookSchema, GlobalConfigSchema, DEFAULT_GLOBAL_CONFIG;
+var RepoEntrySchema, PortMapSchema, SeedSqlFileSchema, SeedCommandSchema, SeedFixtureCopySchema, SeedSchema, RunbookSchema, MetaHookBlockKindSchema, GlobalConfigSchema, DEFAULT_GLOBAL_CONFIG;
 var init_schema4 = __esm({
   "../core/dist/global-config/schema.js"() {
     "use strict";
@@ -11971,11 +11971,19 @@ var init_schema4 = __esm({
       env: external_exports.record(external_exports.string().min(1), external_exports.record(external_exports.string().min(1), external_exports.string())).optional(),
       updatedAt: external_exports.number().int().nonnegative()
     });
+    MetaHookBlockKindSchema = external_exports.enum(["memory-recall", "memory-classify"]);
     GlobalConfigSchema = external_exports.object({
       schemaVersion: external_exports.literal(1),
       repos: external_exports.array(RepoEntrySchema).optional().default([]),
       runbooks: external_exports.array(RunbookSchema).optional().default([]),
-      skillSources: external_exports.array(SkillSourceSchema).optional().default([])
+      skillSources: external_exports.array(SkillSourceSchema).optional().default([]),
+      /**
+       * Phase B B4 — per-block disable list. Operator escape-hatch when a
+       * specific meta-hook misbehaves; engine `injectMetaHooks` filters
+       * these out regardless of services-status detection. CLI
+       * `--meta-hooks-disabled <a,b>` flag (deferred) can override per-call.
+       */
+      metaHooksDisabled: external_exports.array(MetaHookBlockKindSchema).optional().default([])
     }).strip().superRefine((val, ctx) => {
       const repoNames = val.repos.map((r) => r.name);
       const repoDupes = repoNames.filter((n, i) => repoNames.indexOf(n) !== i);
@@ -12002,7 +12010,8 @@ var init_schema4 = __esm({
       schemaVersion: 1,
       repos: [],
       runbooks: [],
-      skillSources: []
+      skillSources: [],
+      metaHooksDisabled: []
     };
   }
 });
@@ -12402,7 +12411,14 @@ var init_trust_audit_log = __esm({
     "use strict";
     init_v3();
     SKILL_SOURCES_AUDIT_LOG_FILENAME = "skill-sources-audit.log";
-    TrustActionSchema = external_exports.enum(["added", "rejected", "auto-rejected", "failed", "removed"]);
+    TrustActionSchema = external_exports.enum([
+      "added",
+      "rejected",
+      "auto-rejected",
+      "failed",
+      "removed",
+      "meta-hook-stripped"
+    ]);
     TrustMethodSchema = external_exports.enum(["flag", "interactive", "auto-reject-tty", "none"]);
     TrustAuditEntrySchema = external_exports.object({
       timestamp: external_exports.string().min(1),
@@ -13317,8 +13333,167 @@ var init_symlink_deployer = __esm({
   }
 });
 
-// ../core/dist/skill-sync/settings-merger.js
+// ../core/dist/meta-hooks/memory-recall.js
 import * as fs21 from "node:fs";
+function buildMemoryRecallHookEntry() {
+  return {
+    matcher: OLAM_META_MEMORY_RECALL_MATCHER,
+    hooks: [
+      {
+        type: "command",
+        command: `OLAM_META_SENTINEL=${OLAM_META_MEMORY_RECALL_SENTINEL}; ${OLAM_META_NOOP_GUARD} node "${OLAM_META_MEMORY_RECALL_SCRIPT_PATH}"`,
+        timeout: OLAM_META_MEMORY_RECALL_TIMEOUT_MS
+      }
+    ]
+  };
+}
+function computeMemoryRecallUninstall(settings) {
+  const matchers = settings.hooks?.PreToolUse;
+  if (!Array.isArray(matchers) || matchers.length === 0) {
+    return { status: "not-found" };
+  }
+  let changed = false;
+  const filteredMatchers = [];
+  for (const matcher of matchers) {
+    const innerHooks = matcher.hooks ?? [];
+    const keptInner = innerHooks.filter((h) => {
+      if (typeof h.command === "string" && h.command.includes(OLAM_META_MEMORY_RECALL_SENTINEL)) {
+        changed = true;
+        return false;
+      }
+      return true;
+    });
+    if (keptInner.length === 0 && innerHooks.length > 0) {
+      changed = true;
+      continue;
+    }
+    if (keptInner.length === innerHooks.length) {
+      filteredMatchers.push(matcher);
+    } else {
+      filteredMatchers.push({ ...matcher, hooks: keptInner });
+    }
+  }
+  if (!changed)
+    return { status: "not-found" };
+  const next = {
+    ...settings,
+    hooks: {
+      ...settings.hooks,
+      PreToolUse: filteredMatchers
+    }
+  };
+  if (filteredMatchers.length === 0) {
+    const otherStages = Object.keys(next.hooks ?? {}).filter((k) => k !== "PreToolUse");
+    if (otherStages.length === 0) {
+      delete next.hooks;
+    } else {
+      delete next.hooks.PreToolUse;
+    }
+  }
+  return { status: "removed", settingsAfter: next };
+}
+function matchMemoryRecallSentinel(commandLine) {
+  return commandLine.includes(OLAM_META_MEMORY_RECALL_SENTINEL);
+}
+var OLAM_META_MEMORY_RECALL_SENTINEL, OLAM_META_MEMORY_RECALL_STAGE, OLAM_META_MEMORY_RECALL_MATCHER, OLAM_META_MEMORY_RECALL_TIMEOUT_MS, OLAM_META_MEMORY_RECALL_SCRIPT_PATH, OLAM_META_NOOP_GUARD;
+var init_memory_recall = __esm({
+  "../core/dist/meta-hooks/memory-recall.js"() {
+    "use strict";
+    OLAM_META_MEMORY_RECALL_SENTINEL = "olam-meta-memory-recall-v1";
+    OLAM_META_MEMORY_RECALL_STAGE = "PreToolUse";
+    OLAM_META_MEMORY_RECALL_MATCHER = "Bash|Edit|MultiEdit|Write|Read|NotebookEdit";
+    OLAM_META_MEMORY_RECALL_TIMEOUT_MS = 5e3;
+    OLAM_META_MEMORY_RECALL_SCRIPT_PATH = "$HOME/.claude/scripts/agentmemory-classifier/agentmemory-recall-trigger.mjs";
+    OLAM_META_NOOP_GUARD = "command -v olam >/dev/null 2>&1 || exit 0;";
+  }
+});
+
+// ../core/dist/meta-hooks/memory-classify.js
+import * as fs22 from "node:fs";
+function buildMemoryClassifyHookEntry() {
+  return {
+    matcher: OLAM_META_MEMORY_CLASSIFY_MATCHER,
+    hooks: [
+      {
+        type: "command",
+        command: `OLAM_META_SENTINEL=${OLAM_META_MEMORY_CLASSIFY_SENTINEL}; ${OLAM_META_NOOP_GUARD2} node "${OLAM_META_MEMORY_CLASSIFY_SCRIPT_PATH}"`,
+        timeout: OLAM_META_MEMORY_CLASSIFY_TIMEOUT_MS
+      }
+    ]
+  };
+}
+function computeMemoryClassifyUninstall(settings) {
+  const matchers = settings.hooks?.PostToolUse;
+  if (!Array.isArray(matchers) || matchers.length === 0) {
+    return { status: "not-found" };
+  }
+  let changed = false;
+  const filteredMatchers = [];
+  for (const matcher of matchers) {
+    const innerHooks = matcher.hooks ?? [];
+    const keptInner = innerHooks.filter((h) => {
+      if (typeof h.command === "string" && h.command.includes(OLAM_META_MEMORY_CLASSIFY_SENTINEL)) {
+        changed = true;
+        return false;
+      }
+      return true;
+    });
+    if (keptInner.length === 0 && innerHooks.length > 0) {
+      changed = true;
+      continue;
+    }
+    if (keptInner.length === innerHooks.length) {
+      filteredMatchers.push(matcher);
+    } else {
+      filteredMatchers.push({ ...matcher, hooks: keptInner });
+    }
+  }
+  if (!changed)
+    return { status: "not-found" };
+  const next = {
+    ...settings,
+    hooks: {
+      ...settings.hooks,
+      PostToolUse: filteredMatchers
+    }
+  };
+  if (filteredMatchers.length === 0) {
+    const otherStages = Object.keys(next.hooks ?? {}).filter((k) => k !== "PostToolUse");
+    if (otherStages.length === 0) {
+      delete next.hooks;
+    } else {
+      delete next.hooks.PostToolUse;
+    }
+  }
+  return { status: "removed", settingsAfter: next };
+}
+function matchMemoryClassifySentinel(commandLine) {
+  return commandLine.includes(OLAM_META_MEMORY_CLASSIFY_SENTINEL);
+}
+var OLAM_META_MEMORY_CLASSIFY_SENTINEL, OLAM_META_MEMORY_CLASSIFY_STAGE, OLAM_META_MEMORY_CLASSIFY_MATCHER, OLAM_META_MEMORY_CLASSIFY_TIMEOUT_MS, OLAM_META_MEMORY_CLASSIFY_SCRIPT_PATH, OLAM_META_NOOP_GUARD2;
+var init_memory_classify = __esm({
+  "../core/dist/meta-hooks/memory-classify.js"() {
+    "use strict";
+    OLAM_META_MEMORY_CLASSIFY_SENTINEL = "olam-meta-memory-classify-v1";
+    OLAM_META_MEMORY_CLASSIFY_STAGE = "PostToolUse";
+    OLAM_META_MEMORY_CLASSIFY_MATCHER = "Bash|Edit|MultiEdit|Write|Read|NotebookEdit";
+    OLAM_META_MEMORY_CLASSIFY_TIMEOUT_MS = 5e3;
+    OLAM_META_MEMORY_CLASSIFY_SCRIPT_PATH = "$HOME/.claude/scripts/agentmemory-classifier/agentmemory-classify-queue.mjs";
+    OLAM_META_NOOP_GUARD2 = "command -v olam >/dev/null 2>&1 || exit 0;";
+  }
+});
+
+// ../core/dist/meta-hooks/index.js
+var init_meta_hooks = __esm({
+  "../core/dist/meta-hooks/index.js"() {
+    "use strict";
+    init_memory_recall();
+    init_memory_classify();
+  }
+});
+
+// ../core/dist/skill-sync/settings-merger.js
+import * as fs23 from "node:fs";
 import * as os14 from "node:os";
 import * as path22 from "node:path";
 function claudeSettingsPath() {
@@ -13346,32 +13521,66 @@ function dedupeByMatcher(entries) {
   }
   return [...map.values()];
 }
+function commandsInEntry(entry) {
+  const cmds = [];
+  const direct = entry["command"];
+  if (typeof direct === "string")
+    cmds.push(direct);
+  const inner = entry["hooks"];
+  if (Array.isArray(inner)) {
+    for (const h of inner) {
+      if (h && typeof h === "object" && typeof h.command === "string") {
+        cmds.push(h.command);
+      }
+    }
+  }
+  return cmds;
+}
+function applyDualWriteDedup(incoming, preserved) {
+  const preservedCommands = preserved.flatMap(commandsInEntry);
+  const preservedHas = (sentinel) => preservedCommands.some((c) => c.includes(sentinel));
+  let droppedCount = 0;
+  const droppedCommands = [];
+  const kept = incoming.filter((entry) => {
+    const incomingCommands = commandsInEntry(entry);
+    for (const rule of DUAL_WRITE_DEDUP_RULES) {
+      const hasIncomingScript = incomingCommands.some((c) => c.includes(rule.incomingCommandSubstring));
+      if (hasIncomingScript && preservedHas(rule.preservedSentinel)) {
+        droppedCount += 1;
+        droppedCommands.push(...incomingCommands.filter((c) => c.includes(rule.incomingCommandSubstring)));
+        return false;
+      }
+    }
+    return true;
+  });
+  return { kept, droppedCount, droppedCommands };
+}
 function tagOlam(entry) {
   return { ...entry, [OLAM_SKILLS_MARKER]: true };
 }
 function readJson(file) {
-  return JSON.parse(fs21.readFileSync(file, "utf-8"));
+  return JSON.parse(fs23.readFileSync(file, "utf-8"));
 }
 function rotateBackups(backupDir) {
-  if (!fs21.existsSync(backupDir))
+  if (!fs23.existsSync(backupDir))
     return;
-  const files = fs21.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path22.join(backupDir, f), mtime: fs21.statSync(path22.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  const files = fs23.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path22.join(backupDir, f), mtime: fs23.statSync(path22.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   for (const f of files.slice(BACKUP_RETENTION)) {
     try {
-      fs21.unlinkSync(f.full);
+      fs23.unlinkSync(f.full);
     } catch {
     }
   }
 }
 function backupSettings() {
   const src = claudeSettingsPath();
-  if (!fs21.existsSync(src))
+  if (!fs23.existsSync(src))
     return void 0;
   const dir = settingsBackupDir();
-  fs21.mkdirSync(dir, { recursive: true });
+  fs23.mkdirSync(dir, { recursive: true });
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const dest = path22.join(dir, `settings-${stamp}.json`);
-  fs21.copyFileSync(src, dest);
+  fs23.copyFileSync(src, dest);
   rotateBackups(dir);
   return dest;
 }
@@ -13379,7 +13588,7 @@ function mergeSettings(input) {
   const settingsPath = claudeSettingsPath();
   const backupPath = backupSettings();
   let base = {};
-  if (fs21.existsSync(settingsPath)) {
+  if (fs23.existsSync(settingsPath)) {
     try {
       base = readJson(settingsPath);
     } catch {
@@ -13411,13 +13620,18 @@ function mergeSettings(input) {
     ...olamHooksByCategory.keys()
   ]);
   let hooksAdded = 0;
+  let dualWriteDeduped = 0;
+  const dualWriteDroppedCommands = [];
   for (const cat of categories) {
     const existing = Array.isArray(existingHooks[cat]) ? existingHooks[cat] : [];
     const preserved = existing.filter((e) => !e[OLAM_SKILLS_MARKER]);
     const olam = olamHooksByCategory.get(cat) ?? [];
     const olamDeduped = dedupeByMatcher(olam);
-    mergedHooks[cat] = [...preserved, ...olamDeduped];
-    hooksAdded += olam.length;
+    const { kept: olamFinal, droppedCount, droppedCommands } = applyDualWriteDedup(olamDeduped, preserved);
+    dualWriteDeduped += droppedCount;
+    dualWriteDroppedCommands.push(...droppedCommands);
+    mergedHooks[cat] = [...preserved, ...olamFinal];
+    hooksAdded += olamFinal.length;
   }
   const permSet = /* @__PURE__ */ new Set();
   for (const file of input.permissionFiles) {
@@ -13442,18 +13656,29 @@ function mergeSettings(input) {
       ...input.permissionFiles.length > 0 ? { allow: [...permSet] } : {}
     }
   };
-  fs21.mkdirSync(path22.dirname(settingsPath), { recursive: true });
+  fs23.mkdirSync(path22.dirname(settingsPath), { recursive: true });
   const tmp = `${settingsPath}.tmp-${process.pid}`;
-  fs21.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
-  fs21.renameSync(tmp, settingsPath);
-  return { backupPath, hooksAdded, permissionsCount: permSet.size };
+  fs23.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
+  fs23.renameSync(tmp, settingsPath);
+  return { backupPath, hooksAdded, permissionsCount: permSet.size, dualWriteDeduped, dualWriteDroppedCommands };
 }
-var OLAM_SKILLS_MARKER, BACKUP_RETENTION;
+var OLAM_SKILLS_MARKER, BACKUP_RETENTION, DUAL_WRITE_DEDUP_RULES;
 var init_settings_merger = __esm({
   "../core/dist/skill-sync/settings-merger.js"() {
     "use strict";
+    init_meta_hooks();
     OLAM_SKILLS_MARKER = "_olamSkillsManaged";
     BACKUP_RETENTION = 30;
+    DUAL_WRITE_DEDUP_RULES = [
+      {
+        preservedSentinel: OLAM_META_MEMORY_RECALL_SENTINEL,
+        incomingCommandSubstring: "agentmemory-recall-trigger.mjs"
+      },
+      {
+        preservedSentinel: OLAM_META_MEMORY_CLASSIFY_SENTINEL,
+        incomingCommandSubstring: "agentmemory-classify-queue.mjs"
+      }
+    ];
   }
 });
 
@@ -13491,7 +13716,7 @@ var init_schema5 = __esm({
 
 // ../core/dist/skill-sync/per-project-override.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import * as fs22 from "node:fs";
+import * as fs24 from "node:fs";
 import * as path23 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function findProjectOverride(startDir) {
@@ -13499,8 +13724,8 @@ function findProjectOverride(startDir) {
   const root = path23.parse(dir).root;
   while (true) {
     const candidate = path23.join(dir, PROJECT_OVERRIDE_RELATIVE_PATH);
-    if (fs22.existsSync(candidate) && fs22.statSync(candidate).isFile()) {
-      const raw = fs22.readFileSync(candidate, "utf-8");
+    if (fs24.existsSync(candidate) && fs24.statSync(candidate).isFile()) {
+      const raw = fs24.readFileSync(candidate, "utf-8");
       let parsed;
       try {
         parsed = parseYaml3(raw);
@@ -13559,7 +13784,7 @@ var init_per_project_override = __esm({
 });
 
 // ../core/dist/skill-sync/source-lock.js
-import * as fs23 from "node:fs";
+import * as fs25 from "node:fs";
 import * as os15 from "node:os";
 import * as path24 from "node:path";
 function defaultIsPidAlive(pid) {
@@ -13576,7 +13801,7 @@ function sleep3(ms) {
 }
 function readLockMeta(lockPath) {
   try {
-    const raw = fs23.readFileSync(lockPath, "utf-8");
+    const raw = fs25.readFileSync(lockPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
       return parsed;
@@ -13595,12 +13820,12 @@ function isLockStale(meta2, opts) {
 }
 function tryAcquireOnce(lockPath, meta2, opts) {
   try {
-    fs23.mkdirSync(path24.dirname(lockPath), { recursive: true });
-    const fd = fs23.openSync(lockPath, "wx", 384);
+    fs25.mkdirSync(path24.dirname(lockPath), { recursive: true });
+    const fd = fs25.openSync(lockPath, "wx", 384);
     try {
-      fs23.writeSync(fd, JSON.stringify(meta2));
+      fs25.writeSync(fd, JSON.stringify(meta2));
     } finally {
-      fs23.closeSync(fd);
+      fs25.closeSync(fd);
     }
     return true;
   } catch (err) {
@@ -13610,14 +13835,14 @@ function tryAcquireOnce(lockPath, meta2, opts) {
     const existing = readLockMeta(lockPath);
     if (existing === void 0) {
       try {
-        fs23.unlinkSync(lockPath);
+        fs25.unlinkSync(lockPath);
       } catch {
       }
       return tryAcquireOnce(lockPath, meta2, opts);
     }
     if (isLockStale(existing, opts)) {
       try {
-        fs23.unlinkSync(lockPath);
+        fs25.unlinkSync(lockPath);
       } catch {
       }
       return tryAcquireOnce(lockPath, meta2, opts);
@@ -13646,7 +13871,7 @@ async function acquireSourceLock(clonePath, options = {}) {
         lockPath,
         release: () => {
           try {
-            fs23.unlinkSync(lockPath);
+            fs25.unlinkSync(lockPath);
           } catch {
           }
         }
@@ -13685,17 +13910,475 @@ var init_source_lock = __esm({
   }
 });
 
-// ../core/dist/skill-sync/engine.js
-import * as fs24 from "node:fs";
+// ../core/dist/skill-sync/settings-json-lock.js
+import * as fs26 from "node:fs";
 import * as os16 from "node:os";
 import * as path25 from "node:path";
+function defaultSettingsJsonLockPath() {
+  const stateDir = process.env["OLAM_STATE_DIR"] ?? path25.join(os16.homedir(), ".olam", "state");
+  return path25.join(stateDir, SETTINGS_JSON_LOCK_FILENAME);
+}
+function defaultIsPidAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    return code === "EPERM";
+  }
+}
+function sleep4(ms) {
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
+}
+function readLockMeta2(lockPath) {
+  try {
+    const raw = fs26.readFileSync(lockPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
+      return parsed;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isLockStale2(meta2, opts) {
+  const ageMs = opts.now - meta2.timestamp;
+  if (ageMs < opts.staleLockMs / 2)
+    return false;
+  if (meta2.hostname !== os16.hostname()) {
+    return ageMs > opts.staleLockMs * 2;
+  }
+  if (!opts.isPidAlive(meta2.pid))
+    return true;
+  return ageMs > opts.staleLockMs;
+}
+function tryAcquireOnce2(lockPath, meta2, opts) {
+  for (let attempt = 0; attempt <= MAX_STEAL_ATTEMPTS; attempt += 1) {
+    try {
+      fs26.mkdirSync(path25.dirname(lockPath), { recursive: true });
+      const fd = fs26.openSync(lockPath, "wx", 384);
+      try {
+        fs26.writeSync(fd, JSON.stringify(meta2));
+      } finally {
+        fs26.closeSync(fd);
+      }
+      return true;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EEXIST")
+        throw err;
+    }
+    if (attempt >= MAX_STEAL_ATTEMPTS) {
+      return false;
+    }
+    const existing = readLockMeta2(lockPath);
+    const isStale = existing === void 0 || isLockStale2(existing, opts);
+    if (!isStale) {
+      return false;
+    }
+    const victimPath = `${lockPath}.victim-${process.pid}-${attempt}-${Date.now()}`;
+    try {
+      fs26.renameSync(lockPath, victimPath);
+      try {
+        fs26.unlinkSync(victimPath);
+      } catch {
+      }
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT")
+        throw err;
+    }
+  }
+  return false;
+}
+async function acquireSettingsJsonLock(options = {}) {
+  const lockPath = options.lockPath ?? defaultSettingsJsonLockPath();
+  const acquireTimeoutMs = options.acquireTimeoutMs ?? DEFAULT_ACQUIRE_TIMEOUT_MS2;
+  const staleLockMs = options.staleLockMs ?? DEFAULT_STALE_LOCK_MS2;
+  const now = options.now ?? Date.now;
+  const isPidAlive2 = options.isPidAlive ?? defaultIsPidAlive2;
+  const deadline = now() + acquireTimeoutMs;
+  let backoffMs = 25;
+  while (true) {
+    const meta2 = {
+      pid: process.pid,
+      hostname: os16.hostname(),
+      timestamp: now(),
+      ...options.reason ? { reason: options.reason } : {}
+    };
+    const acquired = tryAcquireOnce2(lockPath, meta2, { now: now(), staleLockMs, isPidAlive: isPidAlive2 });
+    if (acquired) {
+      return {
+        lockPath,
+        release: () => {
+          try {
+            fs26.unlinkSync(lockPath);
+          } catch {
+          }
+        }
+      };
+    }
+    if (now() >= deadline) {
+      const existing = readLockMeta2(lockPath);
+      const held = existing ? `(held by pid ${existing.pid} on ${existing.hostname}, since ${new Date(existing.timestamp).toISOString()})` : "(holder unknown)";
+      throw new SettingsJsonLockError(`failed to acquire settings.json lock at ${lockPath} within ${acquireTimeoutMs}ms ${held}`);
+    }
+    await sleep4(Math.min(backoffMs, 200));
+    backoffMs = Math.min(backoffMs * 2, 200);
+  }
+}
+async function withSettingsJsonLock(fn, options) {
+  const { release } = await acquireSettingsJsonLock(options);
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+var SETTINGS_JSON_LOCK_FILENAME, DEFAULT_ACQUIRE_TIMEOUT_MS2, DEFAULT_STALE_LOCK_MS2, SettingsJsonLockError, MAX_STEAL_ATTEMPTS;
+var init_settings_json_lock = __esm({
+  "../core/dist/skill-sync/settings-json-lock.js"() {
+    "use strict";
+    SETTINGS_JSON_LOCK_FILENAME = ".settings-json.lock";
+    DEFAULT_ACQUIRE_TIMEOUT_MS2 = 1e4;
+    DEFAULT_STALE_LOCK_MS2 = 5 * 6e4;
+    SettingsJsonLockError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "SettingsJsonLockError";
+      }
+    };
+    MAX_STEAL_ATTEMPTS = 3;
+  }
+});
+
+// ../core/dist/services-status/memory-probe.js
+async function probeMemoryBridge(opts = {}) {
+  const port2 = opts.port ?? DEFAULT_MEMORY_PORT;
+  const healthPath = opts.healthPath ?? DEFAULT_HEALTH_PATH;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
+  const url2 = `http://127.0.0.1:${port2}${healthPath}`;
+  const t0 = Date.now();
+  try {
+    const res = await fetch(url2, {
+      signal: AbortSignal.timeout(timeoutMs),
+      // CP3 LOW fix: refuse to follow redirects. A local attacker
+      // controlling the bridge port (or a misconfigured bridge
+      // returning 3xx) could redirect to an external URL; default
+      // `redirect: 'follow'` would leak timing + reachability.
+      redirect: "error"
+    });
+    await res.text().catch(() => "");
+    const latencyMs = Date.now() - t0;
+    if (res.ok) {
+      return { up: true, latencyMs };
+    }
+    return {
+      up: false,
+      latencyMs,
+      detail: `http ${res.status}`
+    };
+  } catch (err) {
+    const latencyMs = Date.now() - t0;
+    const code = err?.code;
+    const name = err?.name;
+    if (name === "AbortError" || name === "TimeoutError") {
+      return { up: false, latencyMs, detail: `timeout after ${timeoutMs}ms` };
+    }
+    if (code === "ECONNREFUSED") {
+      return { up: false, latencyMs, detail: "connection refused (bridge not running)" };
+    }
+    return {
+      up: false,
+      latencyMs,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var DEFAULT_TIMEOUT_MS3, DEFAULT_MEMORY_PORT, DEFAULT_HEALTH_PATH;
+var init_memory_probe = __esm({
+  "../core/dist/services-status/memory-probe.js"() {
+    "use strict";
+    DEFAULT_TIMEOUT_MS3 = 2e3;
+    DEFAULT_MEMORY_PORT = 3111;
+    DEFAULT_HEALTH_PATH = "/agentmemory/livez";
+  }
+});
+
+// ../core/dist/services-status/index.js
+var init_services_status = __esm({
+  "../core/dist/services-status/index.js"() {
+    "use strict";
+    init_memory_probe();
+  }
+});
+
+// ../core/dist/skill-sources/meta-hooks-migration-snapshot.js
+import * as crypto5 from "node:crypto";
+import * as fs27 from "node:fs";
+import * as os17 from "node:os";
+import * as path26 from "node:path";
+function migrationSnapshotsDir2() {
+  const override = process.env["OLAM_MIGRATION_SNAPSHOTS_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return path26.join(os17.homedir(), ".olam", "state", "migration-snapshots");
+}
+function writeMetaHooksSnapshot(originalSettings) {
+  const snapshot = {
+    schemaVersion: META_HOOKS_SNAPSHOT_SCHEMA_VERSION,
+    takenAt: (/* @__PURE__ */ new Date()).toISOString(),
+    namespace: "meta-hooks",
+    originalSettings
+  };
+  const validated = MetaHooksMigrationSnapshotSchema.parse(snapshot);
+  const dir = migrationSnapshotsDir2();
+  fs27.mkdirSync(dir, { recursive: true });
+  const stamp = validated.takenAt.replace(/[:.]/g, "-");
+  const rand = crypto5.randomBytes(3).toString("hex");
+  const file = path26.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
+  fs27.writeFileSync(file, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
+  return file;
+}
+var META_HOOKS_SNAPSHOT_SCHEMA_VERSION, META_HOOKS_SNAPSHOT_PREFIX, SettingsLooseSchema, MetaHooksMigrationSnapshotSchema;
+var init_meta_hooks_migration_snapshot = __esm({
+  "../core/dist/skill-sources/meta-hooks-migration-snapshot.js"() {
+    "use strict";
+    init_v3();
+    META_HOOKS_SNAPSHOT_SCHEMA_VERSION = 1;
+    META_HOOKS_SNAPSHOT_PREFIX = "meta-hooks-";
+    SettingsLooseSchema = external_exports.record(external_exports.unknown());
+    MetaHooksMigrationSnapshotSchema = external_exports.object({
+      schemaVersion: external_exports.literal(META_HOOKS_SNAPSHOT_SCHEMA_VERSION),
+      takenAt: external_exports.string().min(1),
+      namespace: external_exports.literal("meta-hooks"),
+      /**
+       * Full settings.json content captured before injection. Reverting
+       * writes this back verbatim. May be `null` when no settings.json
+       * existed pre-injection (operator's first sync wrote a fresh one);
+       * revert in that case deletes the file.
+       */
+      originalSettings: external_exports.union([SettingsLooseSchema, external_exports.null()])
+    });
+  }
+});
+
+// ../core/dist/skill-sync/atlas-hook-strip.js
+function isStripCommand(command) {
+  for (const sentinel of OLAM_META_SENTINELS_GUARDED) {
+    if (command.includes(sentinel))
+      return { match: false };
+  }
+  for (const pattern of AGENTMEMORY_SCRIPT_PATTERNS) {
+    if (command.includes(pattern))
+      return { match: true, pattern };
+  }
+  return { match: false };
+}
+function findStripCandidates(settings) {
+  const stages = ["PreToolUse", "PostToolUse"];
+  const out = [];
+  for (const stage of stages) {
+    const matchers = settings.hooks?.[stage];
+    if (!Array.isArray(matchers))
+      continue;
+    for (let mi = 0; mi < matchers.length; mi += 1) {
+      const matcher = matchers[mi];
+      const inner = Array.isArray(matcher.hooks) ? matcher.hooks : [];
+      for (let ii = 0; ii < inner.length; ii += 1) {
+        const cmd = inner[ii]?.command;
+        if (typeof cmd !== "string")
+          continue;
+        const verdict = isStripCommand(cmd);
+        if (verdict.match) {
+          out.push({
+            stage,
+            matcherIndex: mi,
+            innerIndex: ii,
+            command: cmd,
+            matcher: matcher.matcher,
+            matchedPattern: verdict.pattern
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+function applyStrip(settings, candidates) {
+  if (candidates.length === 0) {
+    return { nextSettings: settings, removedCount: 0 };
+  }
+  const stripByStageMatcher = /* @__PURE__ */ new Map();
+  for (const c of candidates) {
+    const key = `${c.stage}:${c.matcherIndex}`;
+    if (!stripByStageMatcher.has(key))
+      stripByStageMatcher.set(key, /* @__PURE__ */ new Set());
+    stripByStageMatcher.get(key).add(c.innerIndex);
+  }
+  const nextHooks = { ...settings.hooks ?? {} };
+  const stages = ["PreToolUse", "PostToolUse"];
+  for (const stage of stages) {
+    const matchers = settings.hooks?.[stage];
+    if (!Array.isArray(matchers))
+      continue;
+    const nextMatchers = [];
+    for (let mi = 0; mi < matchers.length; mi += 1) {
+      const matcher = matchers[mi];
+      const innerHooks = Array.isArray(matcher.hooks) ? matcher.hooks : [];
+      const stripIdx = stripByStageMatcher.get(`${stage}:${mi}`);
+      const keptInner = stripIdx === void 0 ? innerHooks : innerHooks.filter((_, ii) => !stripIdx.has(ii));
+      if (keptInner.length === innerHooks.length) {
+        nextMatchers.push(matcher);
+      } else if (keptInner.length === 0) {
+      } else {
+        nextMatchers.push({ ...matcher, hooks: keptInner });
+      }
+    }
+    if (nextMatchers.length === 0) {
+      delete nextHooks[stage];
+    } else {
+      nextHooks[stage] = nextMatchers;
+    }
+  }
+  const next = { ...settings };
+  if (Object.keys(nextHooks).length === 0) {
+    delete next.hooks;
+  } else {
+    next.hooks = nextHooks;
+  }
+  return { nextSettings: next, removedCount: candidates.length };
+}
+var AGENTMEMORY_SCRIPT_PATTERNS, OLAM_META_SENTINELS_GUARDED;
+var init_atlas_hook_strip = __esm({
+  "../core/dist/skill-sync/atlas-hook-strip.js"() {
+    "use strict";
+    init_memory_recall();
+    init_memory_classify();
+    AGENTMEMORY_SCRIPT_PATTERNS = [
+      "agentmemory-recall-trigger.mjs",
+      "agentmemory-classify-queue.mjs"
+    ];
+    OLAM_META_SENTINELS_GUARDED = [
+      OLAM_META_MEMORY_RECALL_SENTINEL,
+      OLAM_META_MEMORY_CLASSIFY_SENTINEL
+    ];
+  }
+});
+
+// ../core/dist/skill-sync/meta-hook-injector.js
+function decideTargetBlocks(opts) {
+  const mode = opts.mode ?? "auto";
+  const disabled = new Set(opts.disabledBlocks ?? []);
+  if (mode === "never")
+    return /* @__PURE__ */ new Set();
+  const wantMemory = mode === "always" || opts.servicesStatus.memory;
+  const target = /* @__PURE__ */ new Set();
+  if (wantMemory && !disabled.has("memory-recall"))
+    target.add("memory-recall");
+  if (wantMemory && !disabled.has("memory-classify"))
+    target.add("memory-classify");
+  return target;
+}
+function injectMetaHooks(opts) {
+  const target = decideTargetBlocks(opts);
+  let working = JSON.parse(JSON.stringify(opts.currentSettings ?? {}));
+  const blocksAdded = [];
+  const blocksRemoved = [];
+  const memoryRecallPresent = hasMemoryRecallBlock(working);
+  if (target.has("memory-recall")) {
+    if (!memoryRecallPresent) {
+      working = appendBlock(working, OLAM_META_MEMORY_RECALL_STAGE, buildMemoryRecallHookEntry());
+      blocksAdded.push("memory-recall");
+    }
+  } else {
+    if (memoryRecallPresent) {
+      const r = computeMemoryRecallUninstall(working);
+      if (r.status === "removed" && r.settingsAfter) {
+        working = r.settingsAfter;
+        blocksRemoved.push("memory-recall");
+      }
+    }
+  }
+  const memoryClassifyPresent = hasMemoryClassifyBlock(working);
+  if (target.has("memory-classify")) {
+    if (!memoryClassifyPresent) {
+      working = appendBlock(working, OLAM_META_MEMORY_CLASSIFY_STAGE, buildMemoryClassifyHookEntry());
+      blocksAdded.push("memory-classify");
+    }
+  } else {
+    if (memoryClassifyPresent) {
+      const r = computeMemoryClassifyUninstall(working);
+      if (r.status === "removed" && r.settingsAfter) {
+        working = r.settingsAfter;
+        blocksRemoved.push("memory-classify");
+      }
+    }
+  }
+  return {
+    nextSettings: working,
+    blocksAdded,
+    blocksRemoved,
+    mode: opts.mode ?? "auto"
+  };
+}
+function hasMemoryRecallBlock(settings) {
+  const entries = settings.hooks?.PreToolUse;
+  if (!Array.isArray(entries))
+    return false;
+  for (const matcher of entries) {
+    const inner = matcher?.hooks ?? [];
+    if (!Array.isArray(inner))
+      continue;
+    for (const h of inner) {
+      if (typeof h?.command === "string" && matchMemoryRecallSentinel(h.command))
+        return true;
+    }
+  }
+  return false;
+}
+function hasMemoryClassifyBlock(settings) {
+  const entries = settings.hooks?.PostToolUse;
+  if (!Array.isArray(entries))
+    return false;
+  for (const matcher of entries) {
+    const inner = matcher?.hooks ?? [];
+    if (!Array.isArray(inner))
+      continue;
+    for (const h of inner) {
+      if (typeof h?.command === "string" && matchMemoryClassifySentinel(h.command))
+        return true;
+    }
+  }
+  return false;
+}
+function appendBlock(settings, stage, entry) {
+  const next = { ...settings };
+  const hooks = { ...settings.hooks ?? {} };
+  const stageEntries = Array.isArray(hooks[stage]) ? [...hooks[stage]] : [];
+  stageEntries.push(entry);
+  hooks[stage] = stageEntries;
+  next.hooks = hooks;
+  return next;
+}
+var init_meta_hook_injector = __esm({
+  "../core/dist/skill-sync/meta-hook-injector.js"() {
+    "use strict";
+    init_meta_hooks();
+  }
+});
+
+// ../core/dist/skill-sync/engine.js
+import * as fs28 from "node:fs";
+import * as os18 from "node:os";
+import * as path27 from "node:path";
 function resolveAtlasUser(override) {
   if (override)
     return override;
-  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path25.join(os16.homedir(), ".claude");
-  const f = path25.join(claudeDir2, ".atlas-user");
-  if (fs24.existsSync(f)) {
-    return fs24.readFileSync(f, "utf-8").trim() || void 0;
+  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path27.join(os18.homedir(), ".claude");
+  const f = path27.join(claudeDir2, ".atlas-user");
+  if (fs28.existsSync(f)) {
+    return fs28.readFileSync(f, "utf-8").trim() || void 0;
   }
   return void 0;
 }
@@ -13707,7 +14390,7 @@ async function syncSkills(opts = {}) {
   const perSource = [];
   for (const source of sources) {
     const clonePath = skillSourceClonePath(source.id);
-    if (!fs24.existsSync(clonePath))
+    if (!fs28.existsSync(clonePath))
       continue;
     const { artifacts, subscription } = await withSourceLock(clonePath, () => {
       const pinRef = projectOverride?.override.pin?.[source.id];
@@ -13743,6 +14426,7 @@ async function syncSkills(opts = {}) {
     projectOverride,
     deploy: void 0,
     merge: void 0,
+    metaHooks: void 0,
     perSource
   };
   if (opts.dryRun) {
@@ -13752,35 +14436,135 @@ async function syncSkills(opts = {}) {
   summary.deploy = deployArtifacts(projectFilteredArtifacts);
   summary.collisions = summary.deploy.collisions;
   summary.merge = mergeSettings({ hookFiles, permissionFiles });
+  if (opts.metaHooks !== "never") {
+    summary.metaHooks = await injectMetaHooksIntoSettings(opts);
+  }
   return summary;
 }
+async function injectMetaHooksIntoSettings(opts) {
+  const mode = opts.metaHooks ?? "auto";
+  const memoryProbe = await probeMemoryBridge();
+  const servicesStatus = {
+    memory: memoryProbe.up,
+    ...memoryProbe.detail !== void 0 ? { memoryDetail: memoryProbe.detail } : {}
+  };
+  const settingsFile = claudeSettingsPath();
+  let snapshotError;
+  let stripCandidates = [];
+  const result = await withSettingsJsonLock(() => {
+    let currentSettings = {};
+    let settingsExisted = false;
+    if (fs28.existsSync(settingsFile)) {
+      settingsExisted = true;
+      try {
+        const raw = fs28.readFileSync(settingsFile, "utf-8");
+        currentSettings = raw.trim() ? JSON.parse(raw) : {};
+      } catch {
+        try {
+          const raw = fs28.readFileSync(settingsFile);
+          const bakDir = path27.join(path27.dirname(settingsFile), ".malformed-backups");
+          fs28.mkdirSync(bakDir, { recursive: true });
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          const bakFile = path27.join(bakDir, `settings.json.malformed.${stamp}.bak`);
+          fs28.writeFileSync(bakFile, raw, { mode: 384 });
+          snapshotError = `settings.json was malformed; original bytes preserved at ${bakFile}`;
+        } catch (bakErr) {
+          snapshotError = `settings.json malformed AND .bak write failed: ${bakErr instanceof Error ? bakErr.message : String(bakErr)}`;
+        }
+        currentSettings = {};
+        settingsExisted = false;
+      }
+    }
+    stripCandidates = findStripCandidates(currentSettings);
+    const settingsForInject = stripCandidates.length > 0 ? applyStrip(currentSettings, stripCandidates).nextSettings : currentSettings;
+    let configDisabled = [];
+    try {
+      const cfg = readGlobalConfig();
+      configDisabled = cfg.metaHooksDisabled ?? [];
+    } catch {
+    }
+    const disabledBlocks = Array.from(/* @__PURE__ */ new Set([
+      ...configDisabled,
+      ...opts.metaHooksDisabled ?? []
+    ]));
+    const inject = injectMetaHooks({
+      servicesStatus,
+      currentSettings: settingsForInject,
+      mode,
+      ...disabledBlocks.length > 0 ? { disabledBlocks } : {}
+    });
+    const noInjectDelta = inject.blocksAdded.length === 0 && inject.blocksRemoved.length === 0;
+    const noStripDelta = stripCandidates.length === 0;
+    if (noInjectDelta && noStripDelta) {
+      return inject;
+    }
+    let snapshotPath;
+    try {
+      snapshotPath = writeMetaHooksSnapshot(settingsExisted ? currentSettings : null);
+    } catch (err) {
+      snapshotError = err instanceof Error ? err.message : String(err);
+    }
+    if (stripCandidates.length > 0) {
+      try {
+        appendTrustAudit({
+          gitUrl: "internal:olam-meta-hooks",
+          action: "meta-hook-stripped",
+          trustMethod: "none",
+          sourceId: "atlas-toolbox",
+          note: `auto-migration during syncSkills stripped ${stripCandidates.length} agentmemory hook entry(ies)${snapshotPath ? `; snapshot at ${snapshotPath}` : ""}`
+        });
+      } catch {
+      }
+    }
+    fs28.mkdirSync(path27.dirname(settingsFile), { recursive: true });
+    const tmpPath = `${settingsFile}.tmp-${process.pid}-${Date.now()}`;
+    fs28.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
+    fs28.renameSync(tmpPath, settingsFile);
+    return inject;
+  }, { reason: `syncSkills meta-hook injection (mode=${mode})` });
+  return {
+    mode: result.mode,
+    servicesStatus,
+    blocksAdded: result.blocksAdded,
+    blocksRemoved: result.blocksRemoved,
+    ...snapshotError !== void 0 ? { snapshotError } : {},
+    ...stripCandidates.length > 0 ? { autoMigrated: { strippedCount: stripCandidates.length, stripCandidates } } : {}
+  };
+}
 var init_engine = __esm({
   "../core/dist/skill-sync/engine.js"() {
     "use strict";
     init_store2();
     init_clone();
+    init_store();
     init_artifact_resolver();
     init_symlink_deployer();
     init_settings_merger();
     init_per_project_override();
     init_source_lock();
+    init_settings_json_lock();
+    init_services_status();
+    init_meta_hooks_migration_snapshot();
+    init_trust_audit_log();
+    init_atlas_hook_strip();
+    init_meta_hook_injector();
   }
 });
 
 // ../core/dist/skill-sync/shadow-backup-manager.js
-import * as fs25 from "node:fs";
-import * as path26 from "node:path";
+import * as fs29 from "node:fs";
+import * as path28 from "node:path";
 function listShadowBackups(opts = {}) {
   const claude = opts.claudeDirOverride ?? claudeDir();
   const now = opts.now ?? Date.now();
   const out = [];
   for (const bucket of SHADOW_BACKUP_BUCKETS) {
-    const bucketDir = path26.join(claude, bucket);
-    if (!fs25.existsSync(bucketDir))
+    const bucketDir = path28.join(claude, bucket);
+    if (!fs29.existsSync(bucketDir))
       continue;
     let entries;
     try {
-      entries = fs25.readdirSync(bucketDir);
+      entries = fs29.readdirSync(bucketDir);
     } catch {
       continue;
     }
@@ -13791,10 +14575,10 @@ function listShadowBackups(opts = {}) {
       const epochSeconds = Number.parseInt(match[1], 10);
       if (!Number.isFinite(epochSeconds) || epochSeconds < 0)
         continue;
-      const full = path26.join(bucketDir, name);
+      const full = path28.join(bucketDir, name);
       let sizeBytes = 0;
       try {
-        const st = fs25.statSync(full);
+        const st = fs29.statSync(full);
         if (st.isDirectory())
           continue;
         sizeBytes = st.size;
@@ -13807,7 +14591,7 @@ function listShadowBackups(opts = {}) {
         bucket,
         basename: name,
         originalBasename,
-        originalPath: path26.join(bucketDir, originalBasename),
+        originalPath: path28.join(bucketDir, originalBasename),
         epochSeconds,
         ageMs: now - epochSeconds * 1e3,
         sizeBytes
@@ -13850,7 +14634,7 @@ function pruneShadowBackups(opts) {
     }
     if (!opts.dryRun) {
       try {
-        fs25.unlinkSync(b.path);
+        fs29.unlinkSync(b.path);
       } catch {
         skipped.push(b);
         continue;
@@ -13861,24 +14645,24 @@ function pruneShadowBackups(opts) {
   return { deleted, skipped };
 }
 function restoreShadowBackup(opts) {
-  const abs = path26.resolve(opts.backupPath);
-  if (!fs25.existsSync(abs)) {
+  const abs = path28.resolve(opts.backupPath);
+  if (!fs29.existsSync(abs)) {
     throw new Error(`backup file not found: ${abs}`);
   }
-  const basename6 = path26.basename(abs);
+  const basename6 = path28.basename(abs);
   const match = SHADOW_BACKUP_SUFFIX_RE.exec(basename6);
   if (!match) {
     throw new Error(`not a shadow-backup file (basename "${basename6}" does not match \`.shadow-backup-<epoch>\`): ${abs}`);
   }
   const originalBasename = basename6.slice(0, basename6.length - match[0].length);
-  const originalPath = path26.join(path26.dirname(abs), originalBasename);
-  if (fs25.existsSync(originalPath) && !opts.force) {
+  const originalPath = path28.join(path28.dirname(abs), originalBasename);
+  if (fs29.existsSync(originalPath) && !opts.force) {
     throw new Error(`original path already occupied: ${originalPath}. Move/rename it first OR re-run with --force.`);
   }
-  if (opts.force && fs25.existsSync(originalPath)) {
-    fs25.unlinkSync(originalPath);
+  if (opts.force && fs29.existsSync(originalPath)) {
+    fs29.unlinkSync(originalPath);
   }
-  fs25.renameSync(abs, originalPath);
+  fs29.renameSync(abs, originalPath);
   return { restoredTo: originalPath };
 }
 var SHADOW_BACKUP_BUCKETS, SHADOW_BACKUP_SUFFIX_RE;
@@ -13892,14 +14676,14 @@ var init_shadow_backup_manager = __esm({
 });
 
 // ../core/dist/skill-sources/doctor-checks.js
-import * as fs26 from "node:fs";
-import * as path27 from "node:path";
-import * as os17 from "node:os";
+import * as fs30 from "node:fs";
+import * as path29 from "node:path";
+import * as os19 from "node:os";
 function claudeDirInternal3() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path27.join(os17.homedir(), ".claude");
+  return path29.join(os19.homedir(), ".claude");
 }
 function checkStateFileParse() {
   const filePath = globalConfigPath();
@@ -13908,11 +14692,11 @@ function checkStateFileParse() {
     healthy: true,
     description: `~/.olam state file (${filePath})`
   };
-  if (!fs26.existsSync(filePath)) {
+  if (!fs30.existsSync(filePath)) {
     result.details = ["(file does not yet exist \u2014 will be created on first write)"];
     return result;
   }
-  const raw = fs26.readFileSync(filePath, "utf-8");
+  const raw = fs30.readFileSync(filePath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -13922,8 +14706,8 @@ function checkStateFileParse() {
     result.details = [err instanceof Error ? err.message : String(err)];
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs26.renameSync(filePath, aside);
-      fs26.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
+      fs30.renameSync(filePath, aside);
+      fs30.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
     };
     return result;
   }
@@ -13934,7 +14718,7 @@ function checkStateFileParse() {
     result.details = validation.error.issues.map((e) => `${e.path.join(".")}: ${e.message}`);
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs26.copyFileSync(filePath, aside);
+      fs30.copyFileSync(filePath, aside);
       const base = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
       const next = {
         ...base,
@@ -13943,7 +14727,7 @@ function checkStateFileParse() {
         runbooks: [],
         skillSources: []
       };
-      fs26.writeFileSync(filePath, JSON.stringify(next, null, 2));
+      fs30.writeFileSync(filePath, JSON.stringify(next, null, 2));
     };
     return result;
   }
@@ -13954,16 +14738,16 @@ function checkDanglingSymlinks() {
   const buckets = ["commands", "agents", "skills", "scripts", "rules"];
   const dangling = [];
   for (const bucket of buckets) {
-    const dir = path27.join(claude, bucket);
-    if (!fs26.existsSync(dir))
+    const dir = path29.join(claude, bucket);
+    if (!fs30.existsSync(dir))
       continue;
-    for (const name of fs26.readdirSync(dir)) {
-      const linkPath = path27.join(dir, name);
+    for (const name of fs30.readdirSync(dir)) {
+      const linkPath = path29.join(dir, name);
       try {
-        const lst = fs26.lstatSync(linkPath);
+        const lst = fs30.lstatSync(linkPath);
         if (!lst.isSymbolicLink())
           continue;
-        if (!fs26.existsSync(linkPath)) {
+        if (!fs30.existsSync(linkPath)) {
           dangling.push(linkPath);
         }
       } catch {
@@ -13981,7 +14765,7 @@ function checkDanglingSymlinks() {
     result.repair = () => {
       for (const p of dangling) {
         try {
-          fs26.unlinkSync(p);
+          fs30.unlinkSync(p);
         } catch {
         }
       }
@@ -13996,19 +14780,19 @@ function checkOrphanedSnapshots() {
     healthy: true,
     description: `orphaned migration snapshots under ${dir}`
   };
-  if (!fs26.existsSync(dir)) {
+  if (!fs30.existsSync(dir)) {
     return result;
   }
   const orphans = [];
-  for (const name of fs26.readdirSync(dir)) {
+  for (const name of fs30.readdirSync(dir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path27.join(dir, name);
+    const full = path29.join(dir, name);
     try {
-      const stat = fs26.statSync(full);
+      const stat = fs30.statSync(full);
       if (!stat.isFile())
         continue;
-      const raw = fs26.readFileSync(full, "utf-8");
+      const raw = fs30.readFileSync(full, "utf-8");
       let parsed;
       try {
         parsed = JSON.parse(raw);
@@ -14033,7 +14817,7 @@ function checkOrphanedSnapshots() {
     result.repair = () => {
       for (const o of orphans) {
         try {
-          fs26.unlinkSync(o.path);
+          fs30.unlinkSync(o.path);
         } catch {
         }
       }
@@ -14048,12 +14832,12 @@ function checkSentinelDrift() {
     healthy: true,
     description: `olam-skills sentinel block in ${filePath}`
   };
-  if (!fs26.existsSync(filePath)) {
+  if (!fs30.existsSync(filePath)) {
     return result;
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs26.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs30.readFileSync(filePath, "utf-8"));
   } catch {
     return result;
   }
@@ -14094,7 +14878,7 @@ function checkSentinelDrift() {
         backupSettings();
       } catch {
       }
-      const next = JSON.parse(fs26.readFileSync(filePath, "utf-8"));
+      const next = JSON.parse(fs30.readFileSync(filePath, "utf-8"));
       if (!next.hooks)
         return;
       for (const stage of Object.keys(next.hooks)) {
@@ -14117,7 +14901,7 @@ function checkSentinelDrift() {
           return bad === void 0;
         });
       }
-      fs26.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs30.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
     };
   }
   return result;
@@ -14502,10 +15286,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path44) {
-  if (!path44)
+function getElementAtPath(obj, path46) {
+  if (!path46)
     return obj;
-  return path44.reduce((acc, key) => acc?.[key], obj);
+  return path46.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14914,11 +15698,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path44, issues) {
+function prefixIssues(path46, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path44);
+    iss.path.unshift(path46);
     return iss;
   });
 }
@@ -15065,16 +15849,16 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
 }
 function formatError(error2, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error3, path44 = []) => {
+  const processError = (error3, path46 = []) => {
     for (const issue2 of error3.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else {
-        const fullpath = [...path44, ...issue2.path];
+        const fullpath = [...path46, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -25713,8 +26497,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path44, body, attempt = 0) {
-    const url2 = `${this.baseUrl}${path44}`;
+  async request(method, path46, body, attempt = 0) {
+    const url2 = `${this.baseUrl}${path46}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -25732,7 +26516,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path44, body, attempt + 1);
+        return this.request(method, path46, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -26583,12 +27367,12 @@ function register3(server, _ctx, _initError) {
         registry2.close();
       }
       try {
-        const { default: fs42 } = await import("node:fs");
-        const { default: os26 } = await import("node:os");
-        const { default: path44 } = await import("node:path");
-        const tokenPath = path44.join(os26.homedir(), ".olam", "host-cp.token");
-        if (fs42.existsSync(tokenPath)) {
-          const token = fs42.readFileSync(tokenPath, "utf-8").trim();
+        const { default: fs46 } = await import("node:fs");
+        const { default: os28 } = await import("node:os");
+        const { default: path46 } = await import("node:path");
+        const tokenPath = path46.join(os28.homedir(), ".olam", "host-cp.token");
+        if (fs46.existsSync(tokenPath)) {
+          const token = fs46.readFileSync(tokenPath, "utf-8").trim();
           await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -27008,10 +27792,10 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path44) {
-  if (!existsSync6(path44)) return null;
+function readOptional(path46) {
+  if (!existsSync6(path46)) return null;
   try {
-    return readFileSync5(path44, "utf8");
+    return readFileSync5(path46, "utf8");
   } catch {
     return null;
   }
@@ -28427,8 +29211,8 @@ var CloudflareProvider = class extends ComputeProvider {
   // -----------------------------------------------------------------------
   // Internal fetch helper
   // -----------------------------------------------------------------------
-  async request(path44, method, body) {
-    const url2 = `${this.config.workerUrl}${path44}`;
+  async request(path46, method, body) {
+    const url2 = `${this.config.workerUrl}${path46}`;
     const bearer = await this.config.mintToken();
     const headers = {
       Authorization: `Bearer ${bearer}`
@@ -30879,10 +31663,10 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path44 = join13(args.outDir, "manifest.json");
-  await writeFile(path44, `${JSON.stringify(manifest, null, 2)}
+  const path46 = join13(args.outDir, "manifest.json");
+  await writeFile(path46, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path44, manifest };
+  return { path: path46, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
@@ -31136,9 +31920,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path44 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path44))) {
-        return httpReject(403, "outside_allow_list", { path: path44 });
+      const path46 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path46))) {
+        return httpReject(403, "outside_allow_list", { path: path46 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -31501,16 +32285,16 @@ var UnsafeUrlError = class extends Error {
     this.reason = reason;
   }
 };
-async function lookupWithTimeout(hostname2, lookup, timeoutMs) {
+async function lookupWithTimeout(hostname3, lookup, timeoutMs) {
   let timer;
   const timeout = new Promise((_, reject2) => {
     timer = setTimeout(
-      () => reject2(new Error(`dns_lookup_timeout: ${hostname2} (>${timeoutMs}ms)`)),
+      () => reject2(new Error(`dns_lookup_timeout: ${hostname3} (>${timeoutMs}ms)`)),
       timeoutMs
     );
   });
   try {
-    return await Promise.race([lookup(hostname2), timeout]);
+    return await Promise.race([lookup(hostname3), timeout]);
   } finally {
     if (timer) clearTimeout(timer);
   }
@@ -31917,14 +32701,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path44 = join14(outDir, `${shot.name}.${ext}`);
+    const path46 = join14(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path44,
+      path: path46,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path44, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path46, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -32368,12 +33152,12 @@ function openUrl(url2) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs42 } = await import("node:fs");
-    const { default: os26 } = await import("node:os");
-    const { default: path44 } = await import("node:path");
-    const tp = path44.join(os26.homedir(), ".olam", "host-cp.token");
-    if (!fs42.existsSync(tp)) return { token: null };
-    return { token: fs42.readFileSync(tp, "utf-8").trim() };
+    const { default: fs46 } = await import("node:fs");
+    const { default: os28 } = await import("node:os");
+    const { default: path46 } = await import("node:path");
+    const tp = path46.join(os28.homedir(), ".olam", "host-cp.token");
+    if (!fs46.existsSync(tp)) return { token: null };
+    return { token: fs46.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -32633,9 +33417,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("Optional human-readable description."),
       defaultBranch: external_exports.string().optional().describe("Default branch name (e.g. main).")
     },
-    async ({ name, path: path44, description, defaultBranch }) => {
+    async ({ name, path: path46, description, defaultBranch }) => {
       try {
-        const entry = addRepo({ name, path: path44, description, defaultBranch });
+        const entry = addRepo({ name, path: path46, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -32676,9 +33460,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("New description."),
       defaultBranch: external_exports.string().optional().describe("New default branch.")
     },
-    async ({ name, path: path44, description, defaultBranch }) => {
+    async ({ name, path: path46, description, defaultBranch }) => {
       try {
-        const entry = updateRepo(name, { path: path44, description, defaultBranch });
+        const entry = updateRepo(name, { path: path46, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -32699,15 +33483,15 @@ __export(process_port_exports, {
   resolveHostCpToken: () => resolveHostCpToken
 });
 init_v3();
-import fs27 from "node:fs";
-import os18 from "node:os";
-import path28 from "node:path";
+import fs31 from "node:fs";
+import os20 from "node:os";
+import path30 from "node:path";
 var HOST_CP_BASE = "http://127.0.0.1:19000";
 function resolveHostCpToken() {
   const envToken = process.env["OLAM_HOST_CP_TOKEN"];
   if (envToken) return envToken;
-  const tokenPath = path28.join(os18.homedir(), ".olam", "host-cp.token");
-  if (fs27.existsSync(tokenPath)) return fs27.readFileSync(tokenPath, "utf-8").trim();
+  const tokenPath = path30.join(os20.homedir(), ".olam", "host-cp.token");
+  if (fs31.existsSync(tokenPath)) return fs31.readFileSync(tokenPath, "utf-8").trim();
   return null;
 }
 function tokenMissingError() {
@@ -33139,8 +33923,8 @@ __export(skills_exports, {
 });
 init_v3();
 init_skill_sources();
-import * as fs28 from "node:fs";
-import * as path29 from "node:path";
+import * as fs32 from "node:fs";
+import * as path31 from "node:path";
 function asMessage8(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -33163,14 +33947,14 @@ function listDeployed() {
   );
   const entries = [];
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const bucketDir = path29.join(dir, bucket);
-    if (!fs28.existsSync(bucketDir)) continue;
-    for (const name of fs28.readdirSync(bucketDir)) {
-      const full = path29.join(bucketDir, name);
+    const bucketDir = path31.join(dir, bucket);
+    if (!fs32.existsSync(bucketDir)) continue;
+    for (const name of fs32.readdirSync(bucketDir)) {
+      const full = path31.join(bucketDir, name);
       try {
-        const stat = fs28.lstatSync(full);
+        const stat = fs32.lstatSync(full);
         if (!stat.isSymbolicLink()) continue;
-        const target = fs28.readlinkSync(full);
+        const target = fs32.readlinkSync(full);
         let sourceId;
         for (const [clonePath, id] of sourcePaths.entries()) {
           if (target.startsWith(clonePath)) {
@@ -33266,8 +34050,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path44) {
-  return `http://127.0.0.1:${port()}${path44}`;
+function url(path46) {
+  return `http://127.0.0.1:${port()}${path46}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -33286,8 +34070,8 @@ var KgServiceUnreachableError = class extends Error {
     this.name = "KgServiceUnreachableError";
   }
 };
-var DEFAULT_TIMEOUT_MS3 = 5e3;
-async function postJson(endpointUrl, body, timeoutMs = DEFAULT_TIMEOUT_MS3) {
+var DEFAULT_TIMEOUT_MS4 = 5e3;
+async function postJson(endpointUrl, body, timeoutMs = DEFAULT_TIMEOUT_MS4) {
   let res;
   try {
     res = await fetch(endpointUrl, {
@@ -33305,7 +34089,7 @@ async function postJson(endpointUrl, body, timeoutMs = DEFAULT_TIMEOUT_MS3) {
   }
   return await res.json();
 }
-async function getJson(endpointUrl, timeoutMs = DEFAULT_TIMEOUT_MS3) {
+async function getJson(endpointUrl, timeoutMs = DEFAULT_TIMEOUT_MS4) {
   let res;
   try {
     res = await fetch(endpointUrl, { signal: AbortSignal.timeout(timeoutMs) });
@@ -33466,9 +34250,9 @@ __export(kg_install_hook_exports, {
 });
 init_v3();
 init_merge_settings();
-import * as fs29 from "node:fs";
-import * as path30 from "node:path";
-import * as os19 from "node:os";
+import * as fs33 from "node:fs";
+import * as path32 from "node:path";
+import * as os21 from "node:os";
 
 // ../core/dist/kg/hook-template.js
 var KG_HOOK_SENTINEL = "kg-service-v2-classifier-hook";
@@ -33518,10 +34302,10 @@ function buildHookMatcherEntry(opts) {
 // ../mcp-server/src/tools/kg-install-hook.ts
 function settingsPathFor2(scope, projectPath) {
   if (scope === "user") {
-    return path30.join(os19.homedir(), ".claude", "settings.json");
+    return path32.join(os21.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path30.join(root, ".claude", "settings.json");
+  return path32.join(root, ".claude", "settings.json");
 }
 function register29(server, _ctx, _initError) {
   server.tool(
@@ -33535,12 +34319,12 @@ function register29(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor2(scope, params.projectPath);
       try {
-        fs29.mkdirSync(path30.dirname(filePath), { recursive: true });
+        fs33.mkdirSync(path32.dirname(filePath), { recursive: true });
         let backupPath = null;
-        if (fs29.existsSync(filePath)) {
+        if (fs33.existsSync(filePath)) {
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
           backupPath = `${filePath}.olam-bak.${ts}`;
-          fs29.copyFileSync(filePath, backupPath);
+          fs33.copyFileSync(filePath, backupPath);
         }
         const result = mergeHomeSettingsJson(filePath, {
           ensureHook: {
@@ -33551,7 +34335,7 @@ function register29(server, _ctx, _initError) {
         });
         if (result.status === "already-present" && backupPath) {
           try {
-            fs29.unlinkSync(backupPath);
+            fs33.unlinkSync(backupPath);
           } catch {
           }
         }
@@ -33595,15 +34379,15 @@ __export(kg_uninstall_hook_exports, {
   register: () => register30
 });
 init_v3();
-import * as fs30 from "node:fs";
-import * as path31 from "node:path";
-import * as os20 from "node:os";
+import * as fs34 from "node:fs";
+import * as path33 from "node:path";
+import * as os22 from "node:os";
 function settingsPathFor3(scope, projectPath) {
   if (scope === "user") {
-    return path31.join(os20.homedir(), ".claude", "settings.json");
+    return path33.join(os22.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path31.join(root, ".claude", "settings.json");
+  return path33.join(root, ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -33637,7 +34421,7 @@ function register30(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor3(scope, params.projectPath);
       try {
-        if (!fs30.existsSync(filePath)) {
+        if (!fs34.existsSync(filePath)) {
           return {
             content: [
               {
@@ -33651,7 +34435,7 @@ function register30(server, _ctx, _initError) {
             ]
           };
         }
-        const raw = fs30.readFileSync(filePath, "utf-8");
+        const raw = fs34.readFileSync(filePath, "utf-8");
         const settings = raw.trim() ? JSON.parse(raw) : {};
         const preToolUse = settings.hooks?.PreToolUse;
         if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
@@ -33686,7 +34470,7 @@ function register30(server, _ctx, _initError) {
         const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         const backupPath = `${filePath}.olam-bak.${ts}`;
         try {
-          fs30.copyFileSync(filePath, backupPath);
+          fs34.copyFileSync(filePath, backupPath);
         } catch {
         }
         const next = {
@@ -33698,7 +34482,7 @@ function register30(server, _ctx, _initError) {
           if (otherStages.length === 0) delete next.hooks;
           else delete next.hooks.PreToolUse;
         }
-        fs30.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+        fs34.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
         return {
           content: [
             {
@@ -33911,11 +34695,11 @@ function assertBetterSqlite3Loadable(deps = {}) {
 init_loader();
 
 // ../core/dist/world/manager.js
-import * as crypto7 from "node:crypto";
+import * as crypto8 from "node:crypto";
 import { execSync as execSync5, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs39 from "node:fs";
-import * as os24 from "node:os";
-import * as path41 from "node:path";
+import * as fs43 from "node:fs";
+import * as os26 from "node:os";
+import * as path43 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -34011,8 +34795,8 @@ function resolveDevboxImage(config2, tag) {
 
 // ../core/dist/world/worktree.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import * as fs31 from "node:fs";
-import * as path32 from "node:path";
+import * as fs35 from "node:fs";
+import * as path34 from "node:path";
 function resolveGitDir(repo) {
   if (repo.path) {
     return repo.path;
@@ -34022,11 +34806,11 @@ function resolveGitDir(repo) {
 async function createWorktrees(repos, worldId, workspacePath, branch) {
   const created = [];
   for (const repo of repos) {
-    const worktreePath = path32.join(workspacePath, repo.name);
+    const worktreePath = path34.join(workspacePath, repo.name);
     const gitDir = resolveGitDir(repo);
     const branchName = branch || `olam/${worldId}`;
     try {
-      fs31.mkdirSync(path32.dirname(worktreePath), { recursive: true });
+      fs35.mkdirSync(path34.dirname(worktreePath), { recursive: true });
       execFileSync4("git", ["worktree", "add", worktreePath, "-b", branchName], {
         cwd: gitDir,
         stdio: "pipe"
@@ -34059,7 +34843,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
 }
 async function removeWorktrees(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path32.join(workspacePath, repo.name);
+    const worktreePath = path34.join(workspacePath, repo.name);
     let gitDir;
     try {
       gitDir = resolveGitDir(repo);
@@ -34134,12 +34918,12 @@ function removeBranch(repo, branch) {
 
 // ../core/dist/world/kg-overlay.js
 import { execFileSync as execFileSync5 } from "node:child_process";
-import * as fs32 from "node:fs";
-import * as path33 from "node:path";
+import * as fs36 from "node:fs";
+import * as path35 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
-import { homedir as homedir20 } from "node:os";
-import { join as join33, resolve as resolve7 } from "node:path";
+import { homedir as homedir22 } from "node:os";
+import { join as join35, resolve as resolve7 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
 var InvalidWorkspaceNameError = class extends Error {
@@ -34160,25 +34944,25 @@ function validateWorkspaceName(name) {
 
 // ../core/dist/kg/storage-paths.js
 function olamHome() {
-  return process.env.OLAM_HOME ?? join33(homedir20(), ".olam");
+  return process.env.OLAM_HOME ?? join35(homedir22(), ".olam");
 }
 function kgRoot() {
-  return join33(olamHome(), "kg");
+  return join35(olamHome(), "kg");
 }
 function worldsRoot() {
-  return join33(olamHome(), "worlds");
+  return join35(olamHome(), "worlds");
 }
-function assertWithinPrefix(path44, prefix, label) {
-  if (!path44.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path44} not under ${prefix}/`);
+function assertWithinPrefix(path46, prefix, label) {
+  if (!path46.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path46} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path44 = resolve7(join33(root, workspace));
-  assertWithinPrefix(path44, root, "kgPristinePath");
-  return path44;
+  const path46 = resolve7(join35(root, workspace));
+  assertWithinPrefix(path46, root, "kgPristinePath");
+  return path46;
 }
 var KG_PATHS_INTERNALS = Object.freeze({
   olamHome,
@@ -34194,10 +34978,10 @@ var KgOverlayError = class extends Error {
   }
 };
 function ensureGitignoreEntry(worldClonePath) {
-  const gitignorePath = path33.join(worldClonePath, ".gitignore");
-  if (!fs32.existsSync(gitignorePath))
+  const gitignorePath = path35.join(worldClonePath, ".gitignore");
+  if (!fs36.existsSync(gitignorePath))
     return "no-gitignore";
-  const content = fs32.readFileSync(gitignorePath, "utf-8");
+  const content = fs36.readFileSync(gitignorePath, "utf-8");
   const lines = content.split("\n").map((l) => l.trim());
   const recognised = /* @__PURE__ */ new Set([
     "graphify-out",
@@ -34212,24 +34996,24 @@ function ensureGitignoreEntry(worldClonePath) {
   const eol = content.includes("\r\n") ? "\r\n" : "\n";
   const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
   const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
-  fs32.appendFileSync(gitignorePath, block, "utf-8");
+  fs36.appendFileSync(gitignorePath, block, "utf-8");
   return "appended";
 }
 function createWorldOverlay(opts) {
   const pristineRoot = kgPristinePath(opts.workspace);
-  const pristinePath = path33.join(pristineRoot, "graphify-out");
-  if (!fs32.existsSync(pristinePath)) {
+  const pristinePath = path35.join(pristineRoot, "graphify-out");
+  if (!fs36.existsSync(pristinePath)) {
     throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
   }
-  if (!path33.isAbsolute(opts.worldClonePath)) {
+  if (!path35.isAbsolute(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
   }
-  if (!fs32.existsSync(opts.worldClonePath)) {
+  if (!fs36.existsSync(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
   }
-  const overlayPath = path33.join(opts.worldClonePath, "graphify-out");
-  if (fs32.existsSync(overlayPath)) {
-    fs32.rmSync(overlayPath, { recursive: true, force: true });
+  const overlayPath = path35.join(opts.worldClonePath, "graphify-out");
+  if (fs36.existsSync(overlayPath)) {
+    fs36.rmSync(overlayPath, { recursive: true, force: true });
   }
   const useReflink = process.platform === "darwin";
   let strategy;
@@ -34247,7 +35031,7 @@ function createWorldOverlay(opts) {
   } else {
     strategy = "cp-r";
   }
-  if (strategy === "cp-r" || !fs32.existsSync(overlayPath)) {
+  if (strategy === "cp-r" || !fs36.existsSync(overlayPath)) {
     try {
       execFileSync5("cp", ["-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
@@ -34259,7 +35043,7 @@ function createWorldOverlay(opts) {
       throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
     }
   }
-  if (!fs32.existsSync(overlayPath)) {
+  if (!fs36.existsSync(overlayPath)) {
     throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
   }
   const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
@@ -34273,12 +35057,12 @@ function createWorldOverlay(opts) {
 
 // ../core/dist/world/baseline-diff.js
 import { execFileSync as execFileSync6 } from "node:child_process";
-import * as fs33 from "node:fs";
-import * as os21 from "node:os";
-import * as path34 from "node:path";
+import * as fs37 from "node:fs";
+import * as os23 from "node:os";
+import * as path36 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
-function expandHome2(p, homedir26) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir26());
+function expandHome2(p, homedir28) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir28());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -34301,10 +35085,10 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
-  const homedir26 = deps.homedir ?? (() => os21.homedir());
-  const baselineDir = path34.join(workspacePath, ".olam", "baseline");
+  const homedir28 = deps.homedir ?? (() => os23.homedir());
+  const baselineDir = path36.join(workspacePath, ".olam", "baseline");
   try {
-    fs33.mkdirSync(baselineDir, { recursive: true });
+    fs37.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -34316,9 +35100,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path34.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir26);
-    if (!fs33.existsSync(repoPath)) {
+    const outPath = path36.join(baselineDir, filename);
+    const repoPath = expandHome2(repo.path, homedir28);
+    if (!fs37.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -34385,7 +35169,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs33.writeFileSync(outPath, content);
+    fs37.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -34393,8 +35177,8 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path34.join(workspacePath, repo.name);
-    if (!fs33.existsSync(worktreePath))
+    const worktreePath = path36.join(workspacePath, repo.name);
+    if (!fs37.existsSync(worktreePath))
       continue;
     try {
       execFileSync6("git", ["checkout", "--", "."], {
@@ -34453,21 +35237,21 @@ function extractStderr(err) {
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
-  const homedir26 = deps.homedir ?? (() => os21.homedir());
-  const existsSync40 = deps.existsSync ?? ((p) => fs33.existsSync(p));
-  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs33.copyFileSync(src, dest));
-  const mkdirSync25 = deps.mkdirSync ?? ((dirPath, opts) => {
-    fs33.mkdirSync(dirPath, opts);
+  const homedir28 = deps.homedir ?? (() => os23.homedir());
+  const existsSync43 = deps.existsSync ?? ((p) => fs37.existsSync(p));
+  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs37.copyFileSync(src, dest));
+  const mkdirSync28 = deps.mkdirSync ?? ((dirPath, opts) => {
+    fs37.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir26);
-    const worktreePath = path34.join(workspacePath, repo.name);
-    if (!existsSync40(repoPath))
+    const repoPath = expandHome2(repo.path, homedir28);
+    const worktreePath = path36.join(workspacePath, repo.name);
+    if (!existsSync43(repoPath))
       continue;
-    if (!existsSync40(worktreePath)) {
+    if (!existsSync43(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -34525,12 +35309,12 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
       }
     }
     for (const rel of plan.diff.untracked) {
-      const src = path34.join(plan.repoPath, rel);
-      const dest = path34.join(plan.worktreePath, rel);
-      if (!existsSync40(src))
+      const src = path36.join(plan.repoPath, rel);
+      const dest = path36.join(plan.worktreePath, rel);
+      if (!existsSync43(src))
         continue;
       try {
-        mkdirSync25(path34.dirname(dest), { recursive: true });
+        mkdirSync28(path36.dirname(dest), { recursive: true });
         copyFileSync9(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -34556,8 +35340,8 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs34 from "node:fs";
-import * as path35 from "node:path";
+import * as fs38 from "node:fs";
+import * as path37 from "node:path";
 
 // ../core/dist/world/templates/_generated.js
 var GH_PR_CREATE = '# Creating PRs from inside an Olam world\n\n## The problem\n\nCalling `gh pr create` directly inside an Olam container **hangs forever** on a\nTTY confirmation prompt that the agent cannot answer. This is a known, reproduced issue.\n\n## The fix\n\nAlways use this exact pattern:\n\n```bash\necho y | timeout 30 gh pr create \\\n  --base main \\\n  --head <branch> \\\n  --title "<title>" \\\n  --body-file /tmp/pr-body.md\n```\n\n## Why each part matters\n\n- **`echo y |`** \u2014 answers the "Submit?" confirmation prompt up front so `gh` never pauses.\n- **`timeout 30`** \u2014 hard deadline. If `gh` hangs anyway, the command exits non-zero so the\n  agent can react instead of stalling the world indefinitely.\n- **`--body-file /tmp/pr-body.md`** \u2014 write the PR body to a temp file first. Avoids\n  shell-escaping bugs that occur with `--body "..."` for long or multi-line bodies.\n- **`--head` and `--base` explicitly** \u2014 removes all interactive prompts; `gh` has nothing to ask.\n\n## Troubleshooting\n\n**"no commits" or "branch not found" error:**\n\n```bash\ngit push -u origin <branch>\n# then retry:\necho y | timeout 30 gh pr create --base main --head <branch> --title "..." --body-file /tmp/pr-body.md\n```\n\n**Timeout exceeded (command exits 124):**\n\n- Check if the branch was pushed: `git log origin/<branch> --oneline -1`\n- Check GitHub CLI auth: `gh auth status`\n- Retry once; if it hangs again, open the PR via the GitHub web UI.\n';
@@ -34567,10 +35351,10 @@ var WORLD_CLAUDE_MD = '# Olam World: {{worldName}}\n\n{{taskBlock}}\n\n## Enviro
 // ../core/dist/world/context-injection.js
 function injectWorldContext(opts) {
   const { world } = opts;
-  const claudeDir2 = path35.join(world.workspacePath, ".claude");
-  fs34.mkdirSync(claudeDir2, { recursive: true });
+  const claudeDir2 = path37.join(world.workspacePath, ".claude");
+  fs38.mkdirSync(claudeDir2, { recursive: true });
   const content = WORLD_CLAUDE_MD.replace("{{worldName}}", world.name).replace("{{worldId}}", world.id).replace("{{branch}}", world.branch).replace("{{taskBlock}}", buildTaskBlock(opts)).replace("{{reposList}}", buildReposList(world)).replace("{{servicesLine}}", buildServicesLine(opts.services)).replace("{{pleriPlaneLine}}", buildPleriPlaneLine(opts.pleriPlaneUrl)).replace("{{planFileBlock}}", buildPlanFileBlock(world)).replace("{{extraContextBlock}}", buildExtraContextBlock(opts.claudeMdExtra));
-  fs34.writeFileSync(path35.join(claudeDir2, "CLAUDE.md"), content);
+  fs38.writeFileSync(path37.join(claudeDir2, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function buildTaskBlock(opts) {
@@ -34644,10 +35428,10 @@ function buildExtraContextBlock(extra) {
 ${extra}`;
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path35.join(workspacePath, ".olam", "docs");
-  fs34.mkdirSync(docsDir, { recursive: true });
-  fs34.writeFileSync(path35.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
-  fs34.writeFileSync(path35.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
+  const docsDir = path37.join(workspacePath, ".olam", "docs");
+  fs38.mkdirSync(docsDir, { recursive: true });
+  fs38.writeFileSync(path37.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
+  fs38.writeFileSync(path37.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -34661,9 +35445,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path35.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path37.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs34.existsSync(plansDir) && fs34.readdirSync(plansDir).length > 0;
+    return fs38.existsSync(plansDir) && fs38.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -34891,7 +35675,7 @@ async function installStack(exec, repos, stacks) {
 
 // ../core/dist/world/stack-image.js
 import { execSync as execSync3 } from "node:child_process";
-import * as crypto5 from "node:crypto";
+import * as crypto6 from "node:crypto";
 var BASE_IMAGE = "olam-devbox";
 var LABEL_PREFIX = "olam.stack-image";
 var MAX_TAG_LENGTH = 128;
@@ -34947,7 +35731,7 @@ function getImageDigest(imageRef) {
     cachedImageDigests.set(imageRef, short);
     return short;
   } catch {
-    const fallback = crypto5.createHash("sha256").update(imageRef).digest("hex").slice(0, 16);
+    const fallback = crypto6.createHash("sha256").update(imageRef).digest("hex").slice(0, 16);
     cachedImageDigests.set(imageRef, fallback);
     return fallback;
   }
@@ -34958,7 +35742,7 @@ function getBaseImageDigest() {
 function sanitizeTag(raw) {
   let tag = raw.toLowerCase().replace(/[^a-z0-9._-]/g, "-");
   if (tag.length > MAX_TAG_LENGTH) {
-    const hash = crypto5.createHash("sha256").update(raw).digest("hex").slice(0, 12);
+    const hash = crypto6.createHash("sha256").update(raw).digest("hex").slice(0, 12);
     tag = tag.slice(0, MAX_TAG_LENGTH - 13) + "_" + hash;
   }
   return tag;
@@ -35234,26 +36018,26 @@ function shellQuote(s) {
 init_repo_manifest();
 
 // ../core/dist/world/snapshot.js
-import * as crypto6 from "node:crypto";
-import * as fs35 from "node:fs";
-import * as os22 from "node:os";
-import * as path36 from "node:path";
+import * as crypto7 from "node:crypto";
+import * as fs39 from "node:fs";
+import * as os24 from "node:os";
+import * as path38 from "node:path";
 import { execFileSync as execFileSync7, spawn as spawn2 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path36.join(os22.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path38.join(os24.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDirByWorkspace(workspace, arch, kind) {
-  return path36.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
+  return path38.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path36.join(snapshotsDir(), worldId);
+  const legacyDir = path38.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs35.existsSync(legacyDir))
+  if (!fs39.existsSync(legacyDir))
     return;
   try {
-    fs35.rmSync(legacyDir, { recursive: true, force: true });
+    fs39.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -35262,7 +36046,7 @@ function manifestPath(tarPath) {
 }
 function hashBuffers(entries) {
   const sorted = [...entries].sort((a, b) => a.path.localeCompare(b.path));
-  const hash = crypto6.createHash("sha256");
+  const hash = crypto7.createHash("sha256");
   for (const entry of sorted) {
     hash.update(entry.path);
     hash.update("\0");
@@ -35272,11 +36056,11 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path36.join(repoDir, "Gemfile.lock");
-  if (!fs35.existsSync(lockfile))
+  const lockfile = path38.join(repoDir, "Gemfile.lock");
+  if (!fs39.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs35.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs39.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -35286,10 +36070,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path36.join(repoDir, name);
-    if (fs35.existsSync(lockfile)) {
+    const lockfile = path38.join(repoDir, name);
+    if (fs39.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs35.readFileSync(lockfile) }
+        { path: name, content: fs39.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -35308,18 +36092,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path36.dirname(destDir);
-  fs35.mkdirSync(parent, { recursive: true });
-  const tmpSuffix = `.tmp-${process.pid}-${crypto6.randomBytes(4).toString("hex")}`;
+  const parent = path38.dirname(destDir);
+  fs39.mkdirSync(parent, { recursive: true });
+  const tmpSuffix = `.tmp-${process.pid}-${crypto7.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs35.mkdirSync(tmpDir, { recursive: true });
+    fs39.mkdirSync(tmpDir, { recursive: true });
     execFileSync7("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs35.renameSync(tmpDir, destDir);
+    fs39.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs35.rmSync(tmpDir, { recursive: true, force: true });
+      fs39.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -35330,12 +36114,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path36.resolve(base, target);
-  const baseResolved = path36.resolve(base);
-  const rel = path36.relative(baseResolved, resolved);
+  const resolved = path38.resolve(base, target);
+  const baseResolved = path38.resolve(base);
+  const rel = path38.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path36.isAbsolute(rel);
+  return !rel.startsWith("..") && !path38.isAbsolute(rel);
 }
 var TYPE_CHAR_TO_TYPE = {
   "-": "file",
@@ -35385,7 +36169,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs35.readFileSync(tarPath));
+    raw = gunzipSync(fs39.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -35400,7 +36184,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path36.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path38.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -35438,7 +36222,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path36.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path38.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -35446,8 +36230,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path36.join(targetDir, path36.dirname(entry.name));
-      if (path36.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path36.join(path36.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path38.join(targetDir, path38.dirname(entry.name));
+      if (path38.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path38.join(path38.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -35457,7 +36241,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path36.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path38.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -35490,8 +36274,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path36.join(archDir, tarFilename);
-      if (!fs35.existsSync(tarPath)) {
+      const tarPath = path38.join(archDir, tarFilename);
+      if (!fs39.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -35506,9 +36290,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path36.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path38.join(repo.worktreeDir, targetSubpath);
       try {
-        fs35.rmSync(targetDir, { recursive: true, force: true });
+        fs39.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -35521,8 +36305,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs35.rmSync(tarPath, { force: true });
-          fs35.rmSync(manifestPath(tarPath), { force: true });
+          fs39.rmSync(tarPath, { force: true });
+          fs39.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -35538,10 +36322,10 @@ function restoreSnapshotsForRepos(input) {
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs35.existsSync(mPath))
+  if (!fs39.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs35.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs39.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
@@ -35556,17 +36340,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs35.mkdirSync(dir, { recursive: true });
-  const lockPath = path36.join(dir, EVICT_LOCK_FILENAME);
+  fs39.mkdirSync(dir, { recursive: true });
+  const lockPath = path38.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs35.openSync(lockPath, fs35.constants.O_WRONLY | fs35.constants.O_CREAT | fs35.constants.O_EXCL, 384);
+    fd = fs39.openSync(lockPath, fs39.constants.O_WRONLY | fs39.constants.O_CREAT | fs39.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs35.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs39.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -35574,23 +36358,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs35.unlinkSync(lockPath);
-      fd = fs35.openSync(lockPath, fs35.constants.O_WRONLY | fs35.constants.O_CREAT | fs35.constants.O_EXCL, 384);
+      fs39.unlinkSync(lockPath);
+      fd = fs39.openSync(lockPath, fs39.constants.O_WRONLY | fs39.constants.O_CREAT | fs39.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs35.writeSync(fd, `${process.pid}
+    fs39.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs35.closeSync(fd);
+    fs39.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs35.unlinkSync(lockPath);
+      fs39.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -35623,16 +36407,16 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs35.existsSync(dir))
+  if (!fs39.existsSync(dir))
     return 0;
   const allTars = [];
   const walk = (d) => {
-    for (const entry of fs35.readdirSync(d, { withFileTypes: true })) {
-      const full = path36.join(d, entry.name);
+    for (const entry of fs39.readdirSync(d, { withFileTypes: true })) {
+      const full = path38.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat = fs35.statSync(full);
+        const stat = fs39.statSync(full);
         allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
       }
     }
@@ -35647,8 +36431,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs35.rmSync(tar.path, { force: true });
-    fs35.rmSync(manifestPath(tar.path), { force: true });
+    fs39.rmSync(tar.path, { force: true });
+    fs39.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -35765,14 +36549,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 
 // ../core/dist/world/olam-yaml.js
 init_repo_manifest();
-import * as path37 from "node:path";
+import * as path39 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path37.join(workspacePath, repo.name);
+    const repoDir = path39.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -35787,8 +36571,8 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs36 from "node:fs";
-import * as path38 from "node:path";
+import * as fs40 from "node:fs";
+import * as path40 from "node:path";
 import { parse as parseYaml4 } from "yaml";
 function parseFrontmatter(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -35808,20 +36592,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path38.join(workspaceRoot, ".olam", "policies");
-  if (!fs36.existsSync(policiesDir))
+  const policiesDir = path40.join(workspaceRoot, ".olam", "policies");
+  if (!fs40.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs36.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs40.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path38.join(policiesDir, file);
+    const filePath = path40.join(policiesDir, file);
     try {
-      const content = fs36.readFileSync(filePath, "utf8");
+      const content = fs40.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -35905,7 +36689,7 @@ var TaskDispatchError = class extends Error {
   }
 };
 var DEFAULT_SLEEP = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
-async function probeHealth(containerName, dockerExec, budgetMs, sleep4) {
+async function probeHealth(containerName, dockerExec, budgetMs, sleep5) {
   const deadline = Date.now() + budgetMs;
   const cadenceMs = 100;
   let lastErr = "";
@@ -35918,7 +36702,7 @@ async function probeHealth(containerName, dockerExec, budgetMs, sleep4) {
     } catch (err) {
       lastErr = err instanceof Error ? err.message.slice(0, 200) : String(err).slice(0, 200);
     }
-    await sleep4(cadenceMs);
+    await sleep5(cadenceMs);
   }
   throw new TaskDispatchError(`container-cp /health did not return 200 within ${budgetMs}ms`, "health-probe", lastErr || "no response");
 }
@@ -35954,9 +36738,9 @@ function composeTaskPrompt(task, policies, formatPoliciesBrief2) {
 ${task}`;
 }
 async function autoDispatchTask(opts) {
-  const { containerName, task, policies, dockerExec, healthBudgetMs = 15e3, sleep: sleep4 = DEFAULT_SLEEP, logger: logger2 = console, formatPoliciesBrief: formatPoliciesBrief2 } = opts;
+  const { containerName, task, policies, dockerExec, healthBudgetMs = 15e3, sleep: sleep5 = DEFAULT_SLEEP, logger: logger2 = console, formatPoliciesBrief: formatPoliciesBrief2 } = opts;
   const finalPrompt = composeTaskPrompt(task, policies, formatPoliciesBrief2);
-  await probeHealth(containerName, dockerExec, healthBudgetMs, sleep4);
+  await probeHealth(containerName, dockerExec, healthBudgetMs, sleep5);
   startAgent(containerName, dockerExec);
   dispatch2(containerName, finalPrompt, dockerExec);
   logger2.log(`[world] Task auto-dispatched (${finalPrompt.length} chars)`);
@@ -35968,12 +36752,12 @@ init_store();
 init_bridge();
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs37 from "node:fs";
-import * as os23 from "node:os";
-import * as path39 from "node:path";
+import * as fs41 from "node:fs";
+import * as os25 from "node:os";
+import * as path41 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path39.join(os23.homedir(), p.slice(1));
+    return path41.join(os25.homedir(), p.slice(1));
   }
   return p;
 }
@@ -35985,7 +36769,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs37.existsSync(resolvedPath)) {
+    if (!fs41.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -36001,19 +36785,19 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
 init_port_validator();
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs38 from "node:fs";
-import * as path40 from "node:path";
+import * as fs42 from "node:fs";
+import * as path42 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path40.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path40.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path40.dirname(destAbs);
-    fs38.mkdirSync(destDir, { recursive: true });
-    fs38.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path42.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path42.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path42.dirname(destAbs);
+    fs42.mkdirSync(destDir, { recursive: true });
+    fs42.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -36107,7 +36891,7 @@ async function startSupervisedApps(containerName, worldId, repos, exec, options
   const probeTimeoutMs = options.probeTimeoutMs ?? 3e4;
   const probeIntervalMs = options.probeIntervalMs ?? 1e3;
   const clock = options.clock ?? Date.now;
-  const sleep4 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep5 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   for (const repo of repos) {
     if (isPortBound(exec, containerName, repo.hostPort)) {
       throw new PortInUseError(repo.hostPort, repo.name, repo.manifestPath);
@@ -36132,7 +36916,7 @@ async function startSupervisedApps(containerName, worldId, repos, exec, options
     probeTimeoutMs,
     probeIntervalMs,
     clock,
-    sleep: sleep4
+    sleep: sleep5
   })));
   return {
     sessionName,
@@ -36649,7 +37433,7 @@ ${detail}`);
       runbookSeeds = resolved.seeds;
     }
     const worldId = generateWorldId();
-    const workspacePath = path41.join(os24.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path43.join(os26.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = this.resolveReposWithWorkspace(opts);
@@ -36730,38 +37514,38 @@ ${detail}`);
     for (const repo of repos) {
       if (!repo.path)
         continue;
-      const sourceRoot = repo.path.replace(/^~/, os24.homedir());
-      const worktreeRoot = path41.join(workspacePath, repo.name);
-      if (!fs39.existsSync(sourceRoot) || !fs39.existsSync(worktreeRoot))
+      const sourceRoot = repo.path.replace(/^~/, os26.homedir());
+      const worktreeRoot = path43.join(workspacePath, repo.name);
+      if (!fs43.existsSync(sourceRoot) || !fs43.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path41.dirname(pattern), path41.basename(pattern)];
-          const sourceDir = path41.join(sourceRoot, dir);
-          if (fs39.existsSync(sourceDir)) {
+          const [dir, glob] = [path43.dirname(pattern), path43.basename(pattern)];
+          const sourceDir = path43.join(sourceRoot, dir);
+          if (fs43.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs39.readdirSync(sourceDir)) {
+              for (const entry of fs43.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path41.join(dir, entry));
+                  matches2.push(path43.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs39.existsSync(path41.join(sourceRoot, pattern))) {
+        } else if (fs43.existsSync(path43.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path41.join(sourceRoot, rel);
-          const dst = path41.join(worktreeRoot, rel);
+          const src = path43.join(sourceRoot, rel);
+          const dst = path43.join(worktreeRoot, rel);
           try {
-            const st = fs39.statSync(src);
+            const st = fs43.statSync(src);
             if (!st.isFile())
               continue;
-            fs39.mkdirSync(path41.dirname(dst), { recursive: true });
-            fs39.copyFileSync(src, dst);
+            fs43.mkdirSync(path43.dirname(dst), { recursive: true });
+            fs43.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -36847,7 +37631,7 @@ ${detail}`);
     }
     const overlayAttachments = [];
     for (const repo of repos) {
-      const worldClonePath = path41.join(workspacePath, repo.name);
+      const worldClonePath = path43.join(workspacePath, repo.name);
       try {
         const result = createWorldOverlay({
           workspace: repo.name,
@@ -36902,7 +37686,7 @@ ${detail}`);
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path41.join(workspacePath, repo.name);
+          const repoDir = path43.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -36946,10 +37730,10 @@ ${detail}`);
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path41.join(os24.homedir(), ".olam", "r2-credentials.json");
-      if (fs39.existsSync(r2CredsPath)) {
+      const r2CredsPath = path43.join(os26.homedir(), ".olam", "r2-credentials.json");
+      if (fs43.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs39.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs43.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -36966,10 +37750,10 @@ ${detail}`);
         } catch {
         }
       }
-      const keysYamlPath = path41.join(os24.homedir(), ".olam", "keys.yaml");
-      if (fs39.existsSync(keysYamlPath)) {
+      const keysYamlPath = path43.join(os26.homedir(), ".olam", "keys.yaml");
+      if (fs43.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs39.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs43.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const parsed = YAML3.parse(keysRaw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -37028,10 +37812,10 @@ ${detail}`);
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path41.join(workspacePath, repoName, relativePath);
+          const absPath = path43.join(workspacePath, repoName, relativePath);
           try {
-            fs39.mkdirSync(path41.dirname(absPath), { recursive: true });
-            fs39.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs43.mkdirSync(path43.dirname(absPath), { recursive: true });
+            fs43.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -37202,7 +37986,7 @@ ${detail}`);
         imageDigest: void 0,
         repos: enrichedRepos.map((r) => ({
           name: r.name,
-          worktreeDir: path41.join(workspacePath, r.name)
+          worktreeDir: path43.join(workspacePath, r.name)
         }))
       });
       for (const out of restoreResult.outcomes) {
@@ -37308,7 +38092,7 @@ ${detail}`);
     }
     if (opts.task) {
       const allPolicies = repos.flatMap((repo) => {
-        const repoWorktree = path41.join(workspacePath, repo.name);
+        const repoWorktree = path43.join(workspacePath, repo.name);
         try {
           return loadPolicies(repoWorktree);
         } catch (err) {
@@ -37321,8 +38105,8 @@ ${detail}`);
         try {
           execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
           for (const repo of repos) {
-            const policiesDir = path41.join(workspacePath, repo.name, ".olam", "policies");
-            if (fs39.existsSync(policiesDir)) {
+            const policiesDir = path43.join(workspacePath, repo.name, ".olam", "policies");
+            if (fs43.existsSync(policiesDir)) {
               execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
             }
           }
@@ -37430,8 +38214,8 @@ ${detail}`);
     } catch {
     }
     try {
-      fs39.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs39.existsSync(world.workspacePath)) {
+      fs43.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs43.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -37540,14 +38324,14 @@ ${detail}`);
     }).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs39.readFileSync(planFilePath, "utf-8");
-    const planFileName = path41.basename(planFilePath);
+    const planContent = fs43.readFileSync(planFilePath, "utf-8");
+    const planFileName = path43.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path41.join(workspacePath, targetRepo, "docs", "plans");
-    fs39.mkdirSync(plansDir, { recursive: true });
-    fs39.writeFileSync(path41.join(plansDir, planFileName), planContent);
+    const plansDir = path43.join(workspacePath, targetRepo, "docs", "plans");
+    fs43.mkdirSync(plansDir, { recursive: true });
+    fs43.writeFileSync(path43.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -37850,7 +38634,7 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
   return { worldRoleName, password };
 }
 function defaultPasswordGenerator() {
-  return crypto7.randomBytes(24).toString("base64url");
+  return crypto8.randomBytes(24).toString("base64url");
 }
 function escapeSqlLiteral(s) {
   return s.replace(/'/g, "''");
@@ -37981,8 +38765,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs40 from "node:fs";
-import * as path42 from "node:path";
+import * as fs44 from "node:fs";
+import * as path44 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -38317,7 +39101,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs40.existsSync(dbPath))
+  if (!fs44.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -38488,13 +39272,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port: port2, registry: registry2 } = opts;
-  const thisDir = path42.dirname(fileURLToPath2(import.meta.url));
-  const defaultPublicDir = path42.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path44.dirname(fileURLToPath2(import.meta.url));
+  const defaultPublicDir = path44.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs40.existsSync(publicDir);
+  let hasPublicDir = fs44.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs40.existsSync(publicDir);
+      hasPublicDir = fs44.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port2}`;
     const url2 = new URL(req.url ?? "/", `http://${host}`);
@@ -38768,22 +39552,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path42.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path44.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs40.existsSync(filePath) && fs40.statSync(filePath).isFile()) {
-      const ext = path42.extname(filePath);
+    if (fs44.existsSync(filePath) && fs44.statSync(filePath).isFile()) {
+      const ext = path44.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs40.createReadStream(filePath).pipe(res);
+      fs44.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path42.join(publicDir, "index.html");
-    if (fs40.existsSync(filePath)) {
+    filePath = path44.join(publicDir, "index.html");
+    if (fs44.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs40.createReadStream(filePath).pipe(res);
+      fs44.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -38793,17 +39577,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs41 from "node:fs";
-import * as os25 from "node:os";
-import * as path43 from "node:path";
-var STATE_PATH = path43.join(os25.homedir(), ".olam", "dashboard.json");
+import * as fs45 from "node:fs";
+import * as os27 from "node:os";
+import * as path45 from "node:path";
+var STATE_PATH = path45.join(os27.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs41.mkdirSync(path43.dirname(STATE_PATH), { recursive: true });
-  fs41.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs45.mkdirSync(path45.dirname(STATE_PATH), { recursive: true });
+  fs45.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs41.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs45.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -38811,7 +39595,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs41.unlinkSync(STATE_PATH);
+    fs45.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -39091,8 +39875,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync29, existsSync as existsSync39, statSync as statSync12 } from "node:fs";
-import { join as join44, dirname as dirname24, resolve as resolve11 } from "node:path";
+import { readFileSync as readFileSync33, existsSync as existsSync42, statSync as statSync12 } from "node:fs";
+import { join as join46, dirname as dirname27, resolve as resolve11 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -39104,26 +39888,26 @@ function findProjectRoot2(startDir) {
   const root = resolve11("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync39(join44(dir, marker))) return dir;
+      if (existsSync42(join46(dir, marker))) return dir;
     }
-    const pkg = join44(dir, "package.json");
-    if (existsSync39(pkg)) {
+    const pkg = join46(dir, "package.json");
+    if (existsSync42(pkg)) {
       try {
-        const json = JSON.parse(readFileSync29(pkg, "utf8"));
+        const json = JSON.parse(readFileSync33(pkg, "utf8"));
         const isOlamWorkspace = typeof json.name === "string" && json.name.startsWith("@olam/");
         const hasOlamDep = json.dependencies && Object.keys(json.dependencies).some((k) => k.startsWith("@olam/")) || json.devDependencies && Object.keys(json.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
       } catch {
       }
     }
-    const parent = dirname24(dir);
+    const parent = dirname27(dir);
     if (parent === dir || parent === root) return null;
     dir = parent;
   }
 }
-function parseEnvFile(path44) {
+function parseEnvFile(path46) {
   const out = {};
-  const raw = readFileSync29(path44, "utf8");
+  const raw = readFileSync33(path46, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -39146,8 +39930,8 @@ function loadProjectEnv(startDir = process.cwd()) {
   const filesRead = [];
   const merged = {};
   for (const name of [".env", ".env.local"]) {
-    const p = join44(root, name);
-    if (existsSync39(p) && statSync12(p).isFile()) {
+    const p = join46(root, name);
+    if (existsSync42(p) && statSync12(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }