@pleri/olam-cli 0.1.147 → 0.1.150

package/dist/lib/bundle-freshness.js

@@ -0,0 +1,223 @@
+/**
+ * bundle-freshness.ts — Phase A1 of olam-world-bundle-freshness.
+ *
+ * Surfaces whether each running olam world is running the SAME agent-stream
+ * bundle that the operator has built locally (`packages/intelligence/dist/
+ * agent-stream/`).
+ *
+ * The bake mechanism (devbox.runtime.glibc.Dockerfile:263-287) builds the
+ * bundle INSIDE the world image at world-image-build time, so subsequent
+ * fixes to agent-stream do NOT reach running worlds via `olam restart` —
+ * they need either a docker cp (manual workaround) or the Phase B
+ * bind-mount overlay (the real fix).
+ *
+ * This probe makes the staleness gap visible BEFORE Phase B lands.
+ *
+ * Verdict:
+ *   - fresh   — every checked file's sha256 matches host + host dist ≥ container.
+ *   - stale   — at least one file's sha differs OR host dist is newer by >60s.
+ *   - unknown — no running worlds, OR host dist missing, OR docker unreachable.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+/**
+ * Files the probe checks inside each world's
+ * `/opt/olam/agent-stream/dist/`. Mirrors the brainstorm's docker-cp
+ * recovery list (PR #653 + PR #665).
+ */
+export const BUNDLE_FILES = [
+    'driver-runner.js',
+    'codex-runner.js',
+    'agent-sdk-to-chunks.js',
+    'agent-stream-launch.js',
+    'operator-subscription.js',
+    'chunks-subscriber-transport.js',
+];
+/** Mtime drift tolerance — host can be up to this much newer than world without flagging stale. */
+const MTIME_TOLERANCE_MS = 60_000;
+/**
+ * Aggregate doctor probe.
+ *
+ * Returns:
+ *   - PASS (`ok: true, no warn`) when every running world is `fresh`.
+ *   - WARN (`ok: true, warn: true`) when at least one world is `stale`.
+ *   - PASS-with-unknown (`ok: true, no warn`) when no running worlds OR no
+ *     host dist exists — nothing to be stale against, so no alarm.
+ *
+ * Never FAILs — bundle staleness is an informational signal, not a
+ * gate. Operators land Phase B by reading this row before Phase B
+ * makes the row redundant.
+ */
+export async function probeBundleFreshness(deps = {}) {
+    const dockerExec = deps.dockerExec;
+    // Host dist path. CLI's install-root pattern: <cli-pkg>/../../.
+    // In source-mode this resolves to <repo>/packages/intelligence/dist/agent-stream.
+    // In install-mode there's no host dist; return unknown.
+    const repoRoot = deps.repoRootOverride ?? resolveRepoRootBestEffort();
+    if (!repoRoot) {
+        return {
+            ok: true,
+            message: 'bundle: unknown (repo root not detected; install-mode CLI cannot probe host dist)',
+        };
+    }
+    const hostDistDir = join(repoRoot, 'packages', 'intelligence', 'dist', 'agent-stream');
+    if (!existsSync(hostDistDir)) {
+        return {
+            ok: true,
+            message: `bundle: unknown (host dist missing at ${hostDistDir})`,
+        };
+    }
+    // Enumerate running olam worlds. Match container names like `olam-<id>-devbox`.
+    if (!dockerExec) {
+        return { ok: true, message: 'bundle: unknown (no docker exec injected)' };
+    }
+    const psResult = dockerExec('docker', ['ps', '--format', '{{.Names}}']);
+    if (psResult.status !== 0) {
+        return {
+            ok: true,
+            message: `bundle: unknown (docker ps failed: ${psResult.stderr.trim() || 'no stderr'})`,
+        };
+    }
+    const containers = psResult.stdout
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => /^olam-[a-z0-9][a-z0-9-]*-devbox$/.test(l));
+    if (containers.length === 0) {
+        return { ok: true, message: 'bundle: unknown (no running olam worlds)' };
+    }
+    // Compute host shas once.
+    const hostShas = new Map();
+    for (const f of BUNDLE_FILES) {
+        const p = join(hostDistDir, f);
+        if (!existsSync(p))
+            continue;
+        const buf = readFileSync(p);
+        const sha = createHash('sha256').update(buf).digest('hex');
+        const mtimeMs = statSync(p).mtimeMs;
+        hostShas.set(f, { sha, mtimeMs });
+    }
+    if (hostShas.size === 0) {
+        return {
+            ok: true,
+            message: `bundle: unknown (no BUNDLE_FILES present at ${hostDistDir})`,
+        };
+    }
+    // Per-world comparison.
+    const perWorld = [];
+    for (const container of containers) {
+        perWorld.push(checkWorld(container, hostShas, dockerExec));
+    }
+    const staleWorlds = perWorld.filter((w) => w.verdict === 'stale');
+    if (staleWorlds.length > 0) {
+        const remedy = `Run \`olam restart <worldId>\` after Phase B lands, OR for now: ` +
+            `\`for f in ${BUNDLE_FILES.join(' ')}; do docker cp packages/intelligence/dist/agent-stream/$f <container>:/opt/olam/agent-stream/dist/$f; done\``;
+        return {
+            ok: true,
+            warn: true,
+            message: `bundle: stale in ${staleWorlds.length}/${perWorld.length} world(s) — ${staleWorlds
+                .map((w) => `${w.container} (${w.mismatchedFiles.length} file(s) differ)`)
+                .join(', ')}`,
+            remedy,
+        };
+    }
+    const unknownCount = perWorld.filter((w) => w.verdict === 'unknown').length;
+    if (unknownCount === perWorld.length) {
+        return {
+            ok: true,
+            message: `bundle: unknown (could not probe ${unknownCount}/${perWorld.length} world(s); docker exec failed)`,
+        };
+    }
+    return {
+        ok: true,
+        message: `bundle: fresh in ${perWorld.length} world(s)`,
+    };
+}
+function checkWorld(container, hostShas, dockerExec) {
+    // Single exec sha256s all bundle files at once for efficiency.
+    // Format: `<sha>  <path>` per line.
+    const filePaths = Array.from(hostShas.keys()).map((f) => `/opt/olam/agent-stream/dist/${f}`);
+    const r = dockerExec('docker', [
+        'exec',
+        container,
+        'sh',
+        '-c',
+        `for f in ${filePaths.join(' ')}; do if [ -f "$f" ]; then sha256sum "$f"; stat -c '%Y' "$f"; fi; done`,
+    ]);
+    if (r.status !== 0) {
+        return { container, verdict: 'unknown', mismatchedFiles: [] };
+    }
+    // Parse: alternating lines of `<sha>  <path>` and `<mtime_epoch_seconds>`.
+    const lines = r.stdout.trim().split('\n');
+    const containerShas = new Map();
+    for (let i = 0; i < lines.length; i += 2) {
+        const shaLine = lines[i];
+        const mtimeLine = lines[i + 1];
+        if (!shaLine || !mtimeLine)
+            continue;
+        const m = shaLine.match(/^([a-f0-9]{64})\s+(.+)$/);
+        if (!m)
+            continue;
+        const sha = m[1];
+        const path = m[2];
+        const filename = path?.split('/').pop();
+        if (!filename)
+            continue;
+        const mtimeSecs = parseInt(mtimeLine.trim(), 10);
+        if (Number.isNaN(mtimeSecs) || !sha)
+            continue;
+        containerShas.set(filename, { sha, mtimeMs: mtimeSecs * 1000 });
+    }
+    const mismatched = [];
+    let maxMtimeDelta = 0;
+    for (const [filename, hostEntry] of hostShas) {
+        const containerEntry = containerShas.get(filename);
+        if (!containerEntry) {
+            // File present on host, absent in world → mismatch.
+            mismatched.push(filename);
+            continue;
+        }
+        if (containerEntry.sha !== hostEntry.sha) {
+            mismatched.push(filename);
+        }
+        const delta = hostEntry.mtimeMs - containerEntry.mtimeMs;
+        if (delta > maxMtimeDelta)
+            maxMtimeDelta = delta;
+    }
+    // Fresh = no sha mismatches AND mtime drift within tolerance.
+    if (mismatched.length === 0 && maxMtimeDelta <= MTIME_TOLERANCE_MS) {
+        return { container, verdict: 'fresh', mismatchedFiles: [], mtimeDeltaMs: maxMtimeDelta };
+    }
+    return {
+        container,
+        verdict: 'stale',
+        mismatchedFiles: mismatched,
+        mtimeDeltaMs: maxMtimeDelta,
+    };
+}
+/**
+ * Best-effort repo root resolution. Mirrors install-root.ts's pattern:
+ * the CLI lives at `<repo>/packages/cli` in source-mode; walking up two
+ * levels lands at the repo root iff `packages/` AND `package.json` exist
+ * there.
+ */
+function resolveRepoRootBestEffort() {
+    // The probe is module-level; we can't reach __dirname in ESM directly,
+    // but the CLI loads from <repo>/packages/cli/dist/lib/bundle-freshness.js
+    // (or src/lib in dev), so process.argv[1] points into the CLI tree.
+    // Fall back to cwd if argv resolution fails.
+    const start = process.argv[1] ?? process.cwd();
+    // Walk up looking for a parent that has BOTH `packages/` AND `package.json`.
+    let dir = resolve(start);
+    for (let i = 0; i < 6; i++) {
+        const parent = resolve(dir, '..');
+        if (parent === dir)
+            break;
+        if (existsSync(join(parent, 'packages')) && existsSync(join(parent, 'package.json'))) {
+            return parent;
+        }
+        dir = parent;
+    }
+    return null;
+}
+//# sourceMappingURL=bundle-freshness.js.map

package/dist/lib/bundle-freshness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-freshness.js","sourceRoot":"","sources":["../../src/lib/bundle-freshness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAA0B;IACjD,kBAAkB;IAClB,iBAAiB;IACjB,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,gCAAgC;CACjC,CAAC;AAEF,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAmBlC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA4B,EAAE;IAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAEnC,gEAAgE;IAChE,kFAAkF;IAClF,wDAAwD;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,yBAAyB,EAAE,CAAC;IACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,mFAAmF;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACvF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,yCAAyC,WAAW,GAAG;SACjE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,sCAAsC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,WAAW,GAAG;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM;SAC/B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAkD,IAAI,GAAG,EAAE,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACpC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,+CAA+C,WAAW,GAAG;SACvE,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GACV,kEAAkE;YAClE,cAAc,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,8GAA8G,CAAC;QACrJ,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,oBAAoB,WAAW,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,eAAe,WAAW;iBACzF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,kBAAkB,CAAC;iBACzE,IAAI,CAAC,IAAI,CAAC,EAAE;YACf,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC5E,IAAI,YAAY,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,oCAAoC,YAAY,IAAI,QAAQ,CAAC,MAAM,gCAAgC;SAC7G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,oBAAoB,QAAQ,CAAC,MAAM,WAAW;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,SAAiB,EACjB,QAA+D,EAC/D,UAAsB;IAEtB,+DAA+D;IAC/D,oCAAoC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,EAAE,CAC1C,CAAC;IACF,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE;QAC7B,MAAM;QACN,SAAS;QACT,IAAI;QACJ,IAAI;QACJ,YAAY,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,uEAAuE;KACvG,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,2EAA2E;IAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,SAAS;QACrC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YAAE,SAAS;QAC9C,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC7C,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,oDAAoD;YACpD,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QACzD,IAAI,KAAK,GAAG,aAAa;YAAE,aAAa,GAAG,KAAK,CAAC;IACnD,CAAC;IAED,8DAA8D;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,IAAI,kBAAkB,EAAE,CAAC;QACnE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,OAAO;QAChB,eAAe,EAAE,UAAU;QAC3B,YAAY,EAAE,aAAa;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB;IAChC,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/C,6EAA6E;IAC7E,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/bundle-source.d.ts

@@ -0,0 +1,52 @@
+/**
+ * bundle-source.ts — Phase C C2 (olam-world-bundle-freshness).
+ *
+ * Single resolver for the agent-stream bind-mount source path. Two modes:
+ *
+ *   source-mode  (OLAM_DEV=1 + packages/ sibling in repo root):
+ *     → <repo>/packages/intelligence/dist/agent-stream
+ *
+ *   install-mode (OLAM_FORCE_INSTALL_MODE=1, or OLAM_DEV is absent/not '1',
+ *                 or the packages/ sibling is absent):
+ *     → <cli-pkg-root>/dist/agent-stream
+ *     (the path populated by bundle-agent-stream.mjs at publish time)
+ *
+ * Throws `BundleSourceNotFoundError` with a remediation message when neither
+ * path exists on disk.
+ *
+ * Design decisions:
+ *   - Reuses `installRoot()` + `isDevMode()` from install-root.ts (the seam
+ *     established by Phase B / fresh-install-self-bootstrap). No new heuristics.
+ *   - `OLAM_FORCE_INSTALL_MODE=1` forces install-mode regardless of cwd; used
+ *     by the C4 integration test to exercise install-mode paths without a real
+ *     global install.
+ *   - Does NOT import from @olam/adapters (dep cycle — adapters cannot import
+ *     from @pleri/olam-cli). The container.ts refactor in Phase C receives the
+ *     resolved path as an argument instead of computing it internally.
+ */
+/** Resolved bundle source description. */
+export interface BundleSource {
+    /** 'source' = operator repo dist; 'install' = CLI package dist. */
+    readonly mode: 'source' | 'install';
+    /** Absolute path to the agent-stream dist directory. */
+    readonly path: string;
+}
+/**
+ * Thrown when neither the source-mode nor the install-mode bundle directory
+ * exists on disk. Carries a remediation message operators can act on.
+ */
+export declare class BundleSourceNotFoundError extends Error {
+    constructor(sourceModePath: string, installModePath: string);
+}
+/**
+ * Resolve the agent-stream bind-mount source for the current runtime context.
+ *
+ * @param env - Process environment. Defaults to `process.env`. Injectable for
+ *   tests — pass `{ OLAM_FORCE_INSTALL_MODE: '1' }` to exercise install-mode.
+ * @param installRootDir - Override the CLI package root. Defaults to
+ *   `installRoot()`. Injectable for tests.
+ * @returns `BundleSource` with the resolved mode and absolute directory path.
+ * @throws `BundleSourceNotFoundError` when neither path exists.
+ */
+export declare function resolveBundleSource(env?: NodeJS.ProcessEnv, installRootDir?: string): BundleSource;
+//# sourceMappingURL=bundle-source.d.ts.map

package/dist/lib/bundle-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-source.d.ts","sourceRoot":"","sources":["../../src/lib/bundle-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IACpC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM;CAa5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,cAAc,GAAE,MAAsB,GACrC,YAAY,CA2Bd"}

package/dist/lib/bundle-source.js

@@ -0,0 +1,83 @@
+/**
+ * bundle-source.ts — Phase C C2 (olam-world-bundle-freshness).
+ *
+ * Single resolver for the agent-stream bind-mount source path. Two modes:
+ *
+ *   source-mode  (OLAM_DEV=1 + packages/ sibling in repo root):
+ *     → <repo>/packages/intelligence/dist/agent-stream
+ *
+ *   install-mode (OLAM_FORCE_INSTALL_MODE=1, or OLAM_DEV is absent/not '1',
+ *                 or the packages/ sibling is absent):
+ *     → <cli-pkg-root>/dist/agent-stream
+ *     (the path populated by bundle-agent-stream.mjs at publish time)
+ *
+ * Throws `BundleSourceNotFoundError` with a remediation message when neither
+ * path exists on disk.
+ *
+ * Design decisions:
+ *   - Reuses `installRoot()` + `isDevMode()` from install-root.ts (the seam
+ *     established by Phase B / fresh-install-self-bootstrap). No new heuristics.
+ *   - `OLAM_FORCE_INSTALL_MODE=1` forces install-mode regardless of cwd; used
+ *     by the C4 integration test to exercise install-mode paths without a real
+ *     global install.
+ *   - Does NOT import from @olam/adapters (dep cycle — adapters cannot import
+ *     from @pleri/olam-cli). The container.ts refactor in Phase C receives the
+ *     resolved path as an argument instead of computing it internally.
+ */
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { installRoot, isDevMode } from '../install-root.js';
+/**
+ * Thrown when neither the source-mode nor the install-mode bundle directory
+ * exists on disk. Carries a remediation message operators can act on.
+ */
+export class BundleSourceNotFoundError extends Error {
+    constructor(sourceModePath, installModePath) {
+        super(`agent-stream bundle not found in either location:\n` +
+            `  source-mode path: ${sourceModePath}\n` +
+            `  install-mode path: ${installModePath}\n` +
+            `\n` +
+            `Remediation:\n` +
+            `  In a monorepo clone (OLAM_DEV=1): run \`npm run build --workspace=@olam/intelligence\`\n` +
+            `  In a global install: reinstall or update — \`npm install -g @pleri/olam-cli@latest\`\n` +
+            `    (the published tarball ships dist/agent-stream/ as of Phase C)\n`);
+        this.name = 'BundleSourceNotFoundError';
+    }
+}
+/**
+ * Resolve the agent-stream bind-mount source for the current runtime context.
+ *
+ * @param env - Process environment. Defaults to `process.env`. Injectable for
+ *   tests — pass `{ OLAM_FORCE_INSTALL_MODE: '1' }` to exercise install-mode.
+ * @param installRootDir - Override the CLI package root. Defaults to
+ *   `installRoot()`. Injectable for tests.
+ * @returns `BundleSource` with the resolved mode and absolute directory path.
+ * @throws `BundleSourceNotFoundError` when neither path exists.
+ */
+export function resolveBundleSource(env = process.env, installRootDir = installRoot()) {
+    // OLAM_FORCE_INSTALL_MODE=1 skips the source-mode check unconditionally.
+    // Used by the C4 integration test to force install-mode without a real
+    // global install.
+    const forceInstall = env['OLAM_FORCE_INSTALL_MODE'] === '1';
+    // Source-mode: OLAM_DEV=1 + packages/ sibling + package.json (per isDevMode).
+    if (!forceInstall && isDevMode(env, installRootDir)) {
+        // installRoot sits at <repo>/packages/cli; walk up two levels to repo root.
+        const repoRoot = resolve(installRootDir, '..', '..');
+        const sourcePath = join(repoRoot, 'packages', 'intelligence', 'dist', 'agent-stream');
+        const installPath = join(installRootDir, 'dist', 'agent-stream');
+        if (!existsSync(sourcePath)) {
+            throw new BundleSourceNotFoundError(sourcePath, installPath);
+        }
+        return { mode: 'source', path: sourcePath };
+    }
+    // Install-mode: use the CLI's own dist/agent-stream/ (shipped via C1).
+    const installPath = join(installRootDir, 'dist', 'agent-stream');
+    // Source path for error message.
+    const repoRoot = resolve(installRootDir, '..', '..');
+    const sourcePath = join(repoRoot, 'packages', 'intelligence', 'dist', 'agent-stream');
+    if (!existsSync(installPath)) {
+        throw new BundleSourceNotFoundError(sourcePath, installPath);
+    }
+    return { mode: 'install', path: installPath };
+}
+//# sourceMappingURL=bundle-source.js.map

package/dist/lib/bundle-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-source.js","sourceRoot":"","sources":["../../src/lib/bundle-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAU5D;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,cAAsB,EAAE,eAAuB;QACzD,KAAK,CACH,qDAAqD;YACnD,uBAAuB,cAAc,IAAI;YACzC,wBAAwB,eAAe,IAAI;YAC3C,IAAI;YACJ,gBAAgB;YAChB,4FAA4F;YAC5F,0FAA0F;YAC1F,sEAAsE,CACzE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAyB,OAAO,CAAC,GAAG,EACpC,iBAAyB,WAAW,EAAE;IAEtC,yEAAyE;IACzE,uEAAuE;IACvE,kBAAkB;IAClB,MAAM,YAAY,GAAG,GAAG,CAAC,yBAAyB,CAAC,KAAK,GAAG,CAAC;IAE5D,8EAA8E;IAC9E,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QACpD,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,uEAAuE;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACjE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAyB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC"}

package/dist/lib/kubectl-wrap.d.ts

@@ -48,6 +48,12 @@ export interface KubectlWrapOpts {
      * Signature matches `child_process.spawn` return type.
      */
     readonly spawnImpl?: typeof spawn;
+    /**
+     * Optional stdin payload. When set, the subprocess stdin is set to 'pipe'
+     * and this string is written then closed. Used for `kubectl apply -f -`
+     * patterns (C1 ConfigMap substitution; D20 — value never in argv).
+     */
+    readonly stdin?: string;
 }
 /**
  * Invoke kubectl with a timeout.

package/dist/lib/kubectl-wrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl-wrap.d.ts","sourceRoot":"","sources":["../../src/lib/kubectl-wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAG1C,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7G,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CAuFxB"}
+{"version":3,"file":"kubectl-wrap.d.ts","sourceRoot":"","sources":["../../src/lib/kubectl-wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAG1C,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7G,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CA6FxB"}

package/dist/lib/kubectl-wrap.js

@@ -59,7 +59,7 @@ export async function kubectlWrap(args, opts = {}) {
         let child;
         try {
             child = spawnImpl('kubectl', [...args], {
-                stdio: ['ignore', 'pipe', 'pipe'],
+                stdio: [opts.stdin !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'],
                 env: { ...process.env, ...(opts.env ?? {}) },
             });
         }
@@ -73,6 +73,11 @@ export async function kubectlWrap(args, opts = {}) {
             });
             return;
         }
+        // Write stdin payload and close the stream when provided.
+        if (opts.stdin !== undefined && child.stdin) {
+            child.stdin.write(opts.stdin, 'utf8');
+            child.stdin.end();
+        }
         if (child.stdout) {
             child.stdout.on('data', (chunk) => { stdout.push(chunk.toString('utf8')); });
         }

package/dist/lib/kubectl-wrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl-wrap.js","sourceRoot":"","sources":["../../src/lib/kubectl-wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAkB/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,OAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAS,GAAyC,IAAI,CAAC;QAC3D,IAAI,YAAY,GAAyC,IAAI,CAAC;QAE9D,SAAS,WAAW,CAAC,CAAgB;YACnC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;YAAC,CAAC;YACtE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAAC,YAAY,GAAG,IAAI,CAAC;YAAC,CAAC;YAC/E,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QAED,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,WAAW,CAAC;gBACV,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,qCAAqC;YACrC,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAE7D,gEAAgE;YAChE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBAC7D,0EAA0E;gBAC1E,2EAA2E;gBAC3E,WAAW,CAAC;oBACV,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"kubectl-wrap.js","sourceRoot":"","sources":["../../src/lib/kubectl-wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAwB/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,OAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAS,GAAyC,IAAI,CAAC;QAC3D,IAAI,YAAY,GAAyC,IAAI,CAAC;QAE9D,SAAS,WAAW,CAAC,CAAgB;YACnC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;YAAC,CAAC;YACtE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAAC,YAAY,GAAG,IAAI,CAAC;YAAC,CAAC;YAC/E,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QAED,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACtC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACrE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,WAAW,CAAC;gBACV,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,qCAAqC;YACrC,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAE7D,gEAAgE;YAChE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBAC7D,0EAA0E;gBAC1E,2EAA2E;gBAC3E,WAAW,CAAC;oBACV,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/manifest-refresh.d.ts

@@ -42,6 +42,8 @@ export interface ManifestRefreshAuditEntry {
     changed_fields: string[];
     accepted: boolean;
     operator_pid: number;
+    /** When set, the refresh was scoped to this peripheral's manifest subdir (C4/D19). */
+    peripheral?: string;
 }
 export interface ManifestRefreshDeps {
     /** Override state dir for tests. */
@@ -61,6 +63,40 @@ export interface ManifestRefreshDeps {
     /** Override Date.now for tests. */
     readonly now?: () => Date;
 }
+export interface SeedManifestsDeps {
+    /** Override installRoot path (for tests). */
+    readonly installRootDir?: string;
+    /** Override target manifests dir path (for tests). */
+    readonly targetManifestsDir?: string;
+    /** Override fs.existsSync (for tests). */
+    readonly existsSync?: typeof fs.existsSync;
+    /** Override fs.cpSync (for tests). */
+    readonly cpSync?: typeof fs.cpSync;
+    /** Override fs.mkdirSync (for tests). */
+    readonly mkdirSync?: typeof fs.mkdirSync;
+}
+export type SeedManifestsResult = {
+    seeded: true;
+    source: string;
+    target: string;
+    message: string;
+} | {
+    seeded: false;
+    skipped: true;
+    reason: string;
+} | {
+    seeded: false;
+    skipped: false;
+    error: string;
+};
+/**
+ * Copy bundled manifests from the CLI package's host-cp/k8s/manifests/ to
+ * ~/.olam/k8s/manifests/ if the target dir does not yet exist.
+ *
+ * @param forceRefresh — when true, always overwrite (--force-refresh-manifests path).
+ * @param deps         — injectable for tests.
+ */
+export declare function seedManifestsFromBundle(forceRefresh: boolean, deps?: SeedManifestsDeps): SeedManifestsResult;
 /**
  * Pure diff between two YAML manifest file contents (as strings).
  * Parses each as JSON (manifests may be JSON or YAML; we handle JSON
@@ -82,14 +118,19 @@ export type ManifestRefreshResult = {
  * @param manifestsDir    — path to ~/.olam/k8s/manifests/
  * @param acceptRegression — true when --accept-security-regression is set
  * @param deps            — injectable for tests
+ * @param peripheral      — when set, scope diff to manifests/<peripheral>/ ONLY (C4/D19)
  *
  * Returns ok=false when:
  *   - Security-sensitive fields differ AND !acceptRegression.
  *   - Audit log write fails (ENOSPC).
+ *   - peripheral is set but the peripheral subdir does not exist.
  *
  * On ok=true the audit log entry is written with accepted=true (or
  * accepted=false when no regression was detected — regression-free
  * refreshes are still audited).
+ *
+ * When peripheral is set, the audit-log entry includes { peripheral: <name> } (D19).
+ * Other peripherals' security drift does NOT block a targeted peripheral refresh (D19).
  */
-export declare function runManifestRefresh(manifestsDir: string, acceptRegression: boolean, deps?: ManifestRefreshDeps): Promise<ManifestRefreshResult>;
+export declare function runManifestRefresh(manifestsDir: string, acceptRegression: boolean, deps?: ManifestRefreshDeps, peripheral?: string): Promise<ManifestRefreshResult>;
 //# sourceMappingURL=manifest-refresh.d.ts.map

package/dist/lib/manifest-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-refresh.d.ts","sourceRoot":"","sources":["../../src/lib/manifest-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAI9B,eAAO,MAAM,0BAA0B,QAA4D,CAAC;AAEpG,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,qGAM5B,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uCAAuC;IACvC,aAAa,EAAE,sBAAsB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC;IAC7C,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC;IAC/C,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC;IACjD,wCAAwC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;IAC3C,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAkCD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CA4BpB;AAyBD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,OAAO,EACzB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAqFhC"}
+{"version":3,"file":"manifest-refresh.d.ts","sourceRoot":"","sources":["../../src/lib/manifest-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAK9B,eAAO,MAAM,0BAA0B,QAA4D,CAAC;AAEpG,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,qGAM5B,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uCAAuC;IACvC,aAAa,EAAE,sBAAsB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC;IAC7C,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC;IAC/C,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC;IACjD,wCAAwC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;IAC3C,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAuBD,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;IAC3C,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IACnC,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC;CAC1C;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,OAAO,EACrB,IAAI,GAAE,iBAAsB,GAC3B,mBAAmB,CAkErB;AAkCD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CA4BpB;AAyBD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,OAAO,EACzB,IAAI,GAAE,mBAAwB,EAC9B,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,CAAC,CA2FhC"}