@pleri/olam-cli 0.1.152 → 0.1.157

package/dist/commands/memory/stop.js

@@ -1,77 +1,48 @@
 /**
- * olam memory stop — terminate the host agent-memory process gracefully.
+ * olam memory stop — stop the agent-memory Docker container.
  *
- * SIGTERM → wait 10s → SIGKILL. Removes the pidfile on clean exit.
- * Idempotent: no pidfile or stale pidfile → exit 0 with informational message.
+ * Phase B substrate: delegates to `MemoryServiceContainerController.stop()`.
+ * Also cleans up any residual Phase A legacy state (`~/.olam/memory.pid` +
+ * the log file) via `migrateFromHostProcess({ removeLog: true })`.
  *
- * Plan reference: docs/plans/olam-agent-memory-distributed/phase-a-tasks.md A2
+ * Plan reference: docs/plans/memory-service-as-docker-peripheral/phase-b-tasks.md B2
  */
-import { existsSync, readFileSync, unlinkSync } from 'node:fs';
-import { printSuccess, printWarning, printInfo, printHeader } from '../../output.js';
-import { MEMORY_PID_PATH } from './_paths.js';
-const SIGTERM_GRACE_MS = 10_000;
-const POLL_MS = 250;
-function isAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
+import { printSuccess, printInfo, printHeader, printWarning } from '../../output.js';
+import { MemoryServiceContainerController } from '../memory-service-container.js';
+import { migrateFromHostProcess } from '../../lib/memory-host-process-migration.js';
 export async function runMemoryStop() {
     printHeader('olam memory stop');
-    if (!existsSync(MEMORY_PID_PATH)) {
-        printSuccess('no pidfile present (nothing to stop)');
+    // Always sweep up legacy state. Stop is the canonical "remove all running
+    // agent-memory" verb; we additionally remove the log file here (vs start.ts
+    // which leaves it in place — see B5's removeLog flag).
+    const migration = migrateFromHostProcess({ removeLog: true });
+    if (migration.cleaned) {
+        printInfo('migration', migration.summary);
+    }
+    const controller = new MemoryServiceContainerController();
+    const current = controller.status();
+    if (current.state === 'missing') {
+        printSuccess('no olam-memory-service container present (nothing to stop)');
         return 0;
     }
-    const pid = parseInt(readFileSync(MEMORY_PID_PATH, 'utf8').trim(), 10);
-    if (!Number.isFinite(pid) || pid <= 0) {
-        printWarning(`pidfile contained invalid value; removing`);
-        unlinkSync(MEMORY_PID_PATH);
+    if (current.state === 'stopped') {
+        printSuccess('olam-memory-service container already stopped');
         return 0;
     }
-    if (!isAlive(pid)) {
-        printSuccess(`pid ${pid} is not running (stale pidfile); cleaned up`);
-        unlinkSync(MEMORY_PID_PATH);
-        return 0;
-    }
-    printInfo('pid', `${pid}`);
     try {
-        process.kill(pid, 'SIGTERM');
+        controller.stop();
     }
     catch (err) {
-        printWarning(`SIGTERM to pid ${pid} failed: ${err.message}`);
-    }
-    // Wait for graceful exit
-    const deadline = Date.now() + SIGTERM_GRACE_MS;
-    while (Date.now() < deadline) {
-        if (!isAlive(pid))
-            break;
-        await new Promise((r) => setTimeout(r, POLL_MS));
-    }
-    if (isAlive(pid)) {
-        printWarning(`pid ${pid} did not exit within ${SIGTERM_GRACE_MS / 1000}s; sending SIGKILL`);
-        try {
-            process.kill(pid, 'SIGKILL');
-        }
-        catch (err) {
-            printWarning(`SIGKILL to pid ${pid} failed: ${err.message}`);
-        }
-        // Brief wait for SIGKILL to take effect
-        await new Promise((r) => setTimeout(r, 500));
-    }
-    if (existsSync(MEMORY_PID_PATH)) {
-        unlinkSync(MEMORY_PID_PATH);
+        printWarning(`docker stop failed: ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
     }
-    printSuccess(`stopped (pid ${pid})`);
+    printSuccess('olam-memory-service stopped');
     return 0;
 }
 export function registerMemoryStop(cmd) {
     cmd
         .command('stop')
-        .description('Stop the host agent-memory process (SIGTERM → SIGKILL after 10s; idempotent)')
+        .description('Stop the agent-memory Docker container (Phase B substrate; idempotent).')
         .action(async () => {
         const rc = await runMemoryStop();
         if (rc !== 0)

package/dist/commands/memory/stop.js.map

@@ -1 +1 @@
-{"version":3,"file":"stop.js","sourceRoot":"","sources":["../../../src/commands/memory/stop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEhC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,YAAY,CAAC,sCAAsC,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACtC,YAAY,CAAC,2CAA2C,CAAC,CAAC;QAC1D,UAAU,CAAC,eAAe,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,YAAY,CAAC,OAAO,GAAG,6CAA6C,CAAC,CAAC;QACtE,UAAU,CAAC,eAAe,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,SAAS,CAAC,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,kBAAkB,GAAG,YAAa,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;IAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM;QACzB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,GAAG,wBAAwB,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,CAAC;QAC5F,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,kBAAkB,GAAG,YAAa,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,wCAAwC;QACxC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,UAAU,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IACD,YAAY,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8EAA8E,CAAC;SAC3F,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"stop.js","sourceRoot":"","sources":["../../../src/commands/memory/stop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEhC,0EAA0E;IAC1E,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,YAAY,CAAC,4DAA4D,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,YAAY,CAAC,+CAA+C,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,YAAY,CAAC,6BAA6B,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/memory-service-container.d.ts

@@ -0,0 +1,78 @@
+/**
+ * MemoryServiceContainerController — lifecycle for olam-memory-service.
+ *
+ * Mirrors KgServiceContainerController (./kg-service-container.ts). memory-service,
+ * like kg-service, runs as a host-side Docker peripheral managed by `olam services up`.
+ * The Phase A predecessor (host-process model — `olam memory start` spawning the
+ * npm-installed `agentmemory` bin) is retired in Phase B; both substrates coexist
+ * during Phase A so operators can roll back without losing data
+ * (`~/.olam/memory-data/` is bind-mounted and survives substrate swap).
+ *
+ * Divergence from kg-service:
+ *   - Bearer-authenticated livez probe (kg-service `/health` is unauthenticated).
+ *     `waitForReady` reads `~/.olam/memory-secret` and adds `Authorization: Bearer <secret>`.
+ *   - No /host-home read-only mount (kg-service mounts $HOME for build ingestion;
+ *     memory-service writes only to its own /data volume).
+ *   - No prewarm probe (kg-service pre-warms bge-small inference; memory-service has
+ *     no equivalent hot path — iii engine init happens at process start, not first request).
+ *
+ * Plan reference: docs/plans/memory-service-as-docker-peripheral/phase-a-tasks.md A1
+ */
+export declare const MEMORY_SERVICE_PORT = 3111;
+export declare const MEMORY_SERVICE_CONTAINER = "olam-memory-service";
+export declare const MEMORY_SERVICE_LOCAL_TAG = "olam-memory-service:local";
+export declare const MEMORY_SERVICE_PUBLISHED_TAG = "ghcr.io/pleri/olam-memory-service:latest";
+export declare const MEMORY_SERVICE_DEV_TAG = "olam-memory-service:dev";
+export declare const MEMORY_SERVICE_HEALTH_URL = "http://127.0.0.1:3111/agentmemory/livez";
+export declare const MEMORY_SERVICE_HEALTH_TIMEOUT_MS = 60000;
+type ContainerState = 'running' | 'stopped' | 'missing';
+export interface MemoryServiceStatus {
+    readonly state: ContainerState;
+    readonly port: number;
+    readonly containerId?: string;
+    readonly ready?: boolean;
+}
+export declare class MemoryServiceContainerController {
+    private imageTag;
+    status(): MemoryServiceStatus;
+    private imageExists;
+    /**
+     * Resolve the first available image tag: local → dev → published.
+     * Throws if none exist (operator should run `olam bootstrap` to pull, or
+     * `node packages/cli/scripts/build-memory-service-image.mjs` to build locally).
+     */
+    private resolveImage;
+    /**
+     * Idempotent start. If already running → return. If stopped → docker start.
+     * If missing → ensure secret + bind-mount dir, then docker run with port-forward
+     * + memory-data volume mount + restart policy + bearer-secret env.
+     *
+     * The bearer secret is read from `~/.olam/memory-secret` (generated on first
+     * call via `ensureMemorySecret()`) and passed as `AGENTMEMORY_SECRET`. The
+     * container's agentmemory CLI requires this for the livez probe + all API
+     * calls; without it the container will start but reject every request as 401.
+     */
+    start(): void;
+    /**
+     * Returns true when no memory-service image exists locally — useful for
+     * callers (e.g. servicesUp) to distinguish "operator opted out of
+     * memory-service" from "memory-service was supposed to work but is broken".
+     * The opted-out case should be silent; the broken case should warn.
+     */
+    imageMissingEverywhere(): boolean;
+    stop(): void;
+    remove(): void;
+    /**
+     * Poll /agentmemory/livez until 200 OK with `{status: "ok"}` body OR
+     * timeoutMs elapses. The probe is bearer-authenticated; without the secret
+     * header agentmemory returns 401 regardless of container state.
+     *
+     * Divergence from kg-service: kg-service's `/health` is unauthenticated and
+     * returns `{ready: true}` once bge-small is loaded. memory-service's
+     * `/agentmemory/livez` returns `{status: "ok"}` once iii-engine accepts
+     * connections — there's no equivalent "model warmed" state to wait for.
+     */
+    waitForReady(timeoutMs?: number): Promise<boolean>;
+}
+export {};
+//# sourceMappingURL=memory-service-container.d.ts.map

package/dist/commands/memory-service-container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-service-container.d.ts","sourceRoot":"","sources":["../../src/commands/memory-service-container.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AACpE,eAAO,MAAM,4BAA4B,6CAA6C,CAAC;AACvF,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAChE,eAAO,MAAM,yBAAyB,4CAA8D,CAAC;AAKrG,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAOvD,KAAK,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAeD,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAoC;IAEpD,MAAM,IAAI,mBAAmB;IAiB7B,OAAO,CAAC,WAAW;IAInB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;;;OASG;IACH,KAAK,IAAI,IAAI;IA6Cb;;;;;OAKG;IACH,sBAAsB,IAAI,OAAO;IAQjC,IAAI,IAAI,IAAI;IAMZ,MAAM,IAAI,IAAI;IAId;;;;;;;;;OASG;IACG,YAAY,CAAC,SAAS,SAAmC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoBnF"}

package/dist/commands/memory-service-container.js

@@ -0,0 +1,187 @@
+/**
+ * MemoryServiceContainerController — lifecycle for olam-memory-service.
+ *
+ * Mirrors KgServiceContainerController (./kg-service-container.ts). memory-service,
+ * like kg-service, runs as a host-side Docker peripheral managed by `olam services up`.
+ * The Phase A predecessor (host-process model — `olam memory start` spawning the
+ * npm-installed `agentmemory` bin) is retired in Phase B; both substrates coexist
+ * during Phase A so operators can roll back without losing data
+ * (`~/.olam/memory-data/` is bind-mounted and survives substrate swap).
+ *
+ * Divergence from kg-service:
+ *   - Bearer-authenticated livez probe (kg-service `/health` is unauthenticated).
+ *     `waitForReady` reads `~/.olam/memory-secret` and adds `Authorization: Bearer <secret>`.
+ *   - No /host-home read-only mount (kg-service mounts $HOME for build ingestion;
+ *     memory-service writes only to its own /data volume).
+ *   - No prewarm probe (kg-service pre-warms bge-small inference; memory-service has
+ *     no equivalent hot path — iii engine init happens at process start, not first request).
+ *
+ * Plan reference: docs/plans/memory-service-as-docker-peripheral/phase-a-tasks.md A1
+ */
+import { execFileSync, spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ensureMemorySecret } from '../lib/memory-secret.js';
+export const MEMORY_SERVICE_PORT = 3111;
+export const MEMORY_SERVICE_CONTAINER = 'olam-memory-service';
+export const MEMORY_SERVICE_LOCAL_TAG = 'olam-memory-service:local';
+export const MEMORY_SERVICE_PUBLISHED_TAG = 'ghcr.io/pleri/olam-memory-service:latest';
+export const MEMORY_SERVICE_DEV_TAG = 'olam-memory-service:dev';
+export const MEMORY_SERVICE_HEALTH_URL = `http://127.0.0.1:${MEMORY_SERVICE_PORT}/agentmemory/livez`;
+// Mirrors KgServiceContainerController: 60s timeout absorbs cold-start on flaky
+// CI runners (image pull + iii-engine boot can exceed the operator-visible
+// "took a moment" budget). Warm machines see ~3-5s.
+export const MEMORY_SERVICE_HEALTH_TIMEOUT_MS = 60_000;
+// memory-data is the host-mounted `~/.olam/memory-data/` so the container's
+// agentmemory engine can persist iii-engine state to a path the operator can
+// inspect + that survives `docker rm`.
+const MEMORY_SERVICE_VOLUME_TARGET = '/data';
+/**
+ * Resolves the operator's memory-data root for the host bind-mount.
+ *
+ * Mirrors kg-service's `kgDataHostPath()`: respects `$HOME` for testability,
+ * defaults to `~/.olam/memory-data` for the real operator path. Caller is
+ * responsible for ensuring the directory exists pre-bind-mount (Linux dockerd
+ * auto-creates as root:root if absent, which breaks subsequent host-side
+ * reads/writes from the operator's UID).
+ */
+function memoryDataHostPath() {
+    return join(homedir(), '.olam', 'memory-data');
+}
+export class MemoryServiceContainerController {
+    imageTag = MEMORY_SERVICE_LOCAL_TAG;
+    status() {
+        const r = spawnSync('docker', ['inspect', '--format', '{{.State.Status}}|{{.Id}}', MEMORY_SERVICE_CONTAINER], { encoding: 'utf-8' });
+        if (r.status === 0) {
+            const [stateRaw, id] = r.stdout.trim().split('|');
+            return {
+                state: stateRaw === 'running' ? 'running' : 'stopped',
+                port: MEMORY_SERVICE_PORT,
+                containerId: id,
+            };
+        }
+        return { state: 'missing', port: MEMORY_SERVICE_PORT };
+    }
+    imageExists(tag = this.imageTag) {
+        return spawnSync('docker', ['image', 'inspect', tag], { encoding: 'utf-8' }).status === 0;
+    }
+    /**
+     * Resolve the first available image tag: local → dev → published.
+     * Throws if none exist (operator should run `olam bootstrap` to pull, or
+     * `node packages/cli/scripts/build-memory-service-image.mjs` to build locally).
+     */
+    resolveImage() {
+        for (const tag of [MEMORY_SERVICE_LOCAL_TAG, MEMORY_SERVICE_DEV_TAG, MEMORY_SERVICE_PUBLISHED_TAG]) {
+            if (this.imageExists(tag))
+                return tag;
+        }
+        throw new Error(`memory-service image not found. Tried: ${MEMORY_SERVICE_LOCAL_TAG}, ${MEMORY_SERVICE_DEV_TAG}, ${MEMORY_SERVICE_PUBLISHED_TAG}. ` +
+            'Run `olam bootstrap` to pull the published image, or `node packages/cli/scripts/build-memory-service-image.mjs` to build locally.');
+    }
+    /**
+     * Idempotent start. If already running → return. If stopped → docker start.
+     * If missing → ensure secret + bind-mount dir, then docker run with port-forward
+     * + memory-data volume mount + restart policy + bearer-secret env.
+     *
+     * The bearer secret is read from `~/.olam/memory-secret` (generated on first
+     * call via `ensureMemorySecret()`) and passed as `AGENTMEMORY_SECRET`. The
+     * container's agentmemory CLI requires this for the livez probe + all API
+     * calls; without it the container will start but reject every request as 401.
+     */
+    start() {
+        const current = this.status();
+        if (current.state === 'running')
+            return;
+        if (current.state === 'stopped') {
+            execFileSync('docker', ['start', MEMORY_SERVICE_CONTAINER], { stdio: 'pipe' });
+            return;
+        }
+        this.imageTag = this.resolveImage();
+        const memoryData = memoryDataHostPath();
+        const secret = ensureMemorySecret();
+        // Pre-create the host path with the operator's UID. Without this,
+        // dockerd on Linux auto-creates the bind-mount target as root:root,
+        // which breaks subsequent host-side reads from the operator's UID
+        // (EACCES). macOS Docker Desktop's user-mapped binds don't bite
+        // here but the explicit mkdir is portable + cheap.
+        fs.mkdirSync(memoryData, { recursive: true });
+        execFileSync('docker', [
+            'run',
+            '--detach',
+            '--name', MEMORY_SERVICE_CONTAINER,
+            '--restart', 'unless-stopped',
+            // Bind to 127.0.0.1 ONLY at the host port level — local-only by design.
+            '--publish', `127.0.0.1:${MEMORY_SERVICE_PORT}:${MEMORY_SERVICE_PORT}`,
+            // host-gateway lets this container reach the host. Worlds reach
+            // memory-service via the published 127.0.0.1:3111 PLUS their OWN
+            // --add-host flag configured in the world-create code path.
+            '--add-host', 'host.docker.internal:host-gateway',
+            // Bearer secret for all /agentmemory/* requests.
+            '--env', `AGENTMEMORY_SECRET=${secret}`,
+            // Bind to all interfaces inside the container; the host-port publish
+            // restricts access to 127.0.0.1 externally.
+            '--env', 'AGENTMEMORY_HOST=0.0.0.0',
+            '--env', `AGENTMEMORY_PORT=${MEMORY_SERVICE_PORT}`,
+            // Mount the operator's memory-data root so iii-engine state persists.
+            '--volume', `${memoryData}:${MEMORY_SERVICE_VOLUME_TARGET}`,
+            this.imageTag,
+        ], { stdio: 'pipe' });
+    }
+    /**
+     * Returns true when no memory-service image exists locally — useful for
+     * callers (e.g. servicesUp) to distinguish "operator opted out of
+     * memory-service" from "memory-service was supposed to work but is broken".
+     * The opted-out case should be silent; the broken case should warn.
+     */
+    imageMissingEverywhere() {
+        return (!this.imageExists(MEMORY_SERVICE_LOCAL_TAG) &&
+            !this.imageExists(MEMORY_SERVICE_DEV_TAG) &&
+            !this.imageExists(MEMORY_SERVICE_PUBLISHED_TAG));
+    }
+    stop() {
+        const current = this.status();
+        if (current.state !== 'running')
+            return;
+        execFileSync('docker', ['stop', MEMORY_SERVICE_CONTAINER], { stdio: 'pipe' });
+    }
+    remove() {
+        spawnSync('docker', ['rm', '-f', MEMORY_SERVICE_CONTAINER], { stdio: 'pipe' });
+    }
+    /**
+     * Poll /agentmemory/livez until 200 OK with `{status: "ok"}` body OR
+     * timeoutMs elapses. The probe is bearer-authenticated; without the secret
+     * header agentmemory returns 401 regardless of container state.
+     *
+     * Divergence from kg-service: kg-service's `/health` is unauthenticated and
+     * returns `{ready: true}` once bge-small is loaded. memory-service's
+     * `/agentmemory/livez` returns `{status: "ok"}` once iii-engine accepts
+     * connections — there's no equivalent "model warmed" state to wait for.
+     */
+    async waitForReady(timeoutMs = MEMORY_SERVICE_HEALTH_TIMEOUT_MS) {
+        const secret = ensureMemorySecret();
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            try {
+                const res = await fetch(MEMORY_SERVICE_HEALTH_URL, {
+                    headers: { authorization: `Bearer ${secret}` },
+                    signal: AbortSignal.timeout(1_500),
+                });
+                if (res.ok) {
+                    const body = (await res.json());
+                    if (body.status === 'ok')
+                        return true;
+                }
+            }
+            catch {
+                // not ready yet (connection refused, container booting, network race)
+            }
+            await sleep(500);
+        }
+        return false;
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=memory-service-container.js.map

package/dist/commands/memory-service-container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-service-container.js","sourceRoot":"","sources":["../../src/commands/memory-service-container.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,0CAA0C,CAAC;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,mBAAmB,oBAAoB,CAAC;AAErG,gFAAgF;AAChF,2EAA2E;AAC3E,oDAAoD;AACpD,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAEvD,4EAA4E;AAC5E,6EAA6E;AAC7E,uCAAuC;AACvC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAW7C;;;;;;;;GAQG;AACH,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,gCAAgC;IACnC,QAAQ,GAAW,wBAAwB,CAAC;IAEpD,MAAM;QACJ,MAAM,CAAC,GAAG,SAAS,CACjB,QAAQ,EACR,CAAC,SAAS,EAAE,UAAU,EAAE,2BAA2B,EAAE,wBAAwB,CAAC,EAC9E,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrD,IAAI,EAAE,mBAAmB;gBACzB,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACzD,CAAC;IAEO,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ;QACrC,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5F,CAAC;IAED;;;;OAIG;IACK,YAAY;QAClB,KAAK,MAAM,GAAG,IAAI,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,4BAA4B,CAAC,EAAE,CAAC;YACnG,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0CAA0C,wBAAwB,KAAK,sBAAsB,KAAK,4BAA4B,IAAI;YAChI,mIAAmI,CACtI,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACxC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,mDAAmD;QACnD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,YAAY,CACV,QAAQ,EACR;YACE,KAAK;YACL,UAAU;YACV,QAAQ,EAAE,wBAAwB;YAClC,WAAW,EAAE,gBAAgB;YAC7B,wEAAwE;YACxE,WAAW,EAAE,aAAa,mBAAmB,IAAI,mBAAmB,EAAE;YACtE,gEAAgE;YAChE,iEAAiE;YACjE,4DAA4D;YAC5D,YAAY,EAAE,mCAAmC;YACjD,iDAAiD;YACjD,OAAO,EAAE,sBAAsB,MAAM,EAAE;YACvC,qEAAqE;YACrE,4CAA4C;YAC5C,OAAO,EAAE,0BAA0B;YACnC,OAAO,EAAE,oBAAoB,mBAAmB,EAAE;YAClD,sEAAsE;YACtE,UAAU,EAAE,GAAG,UAAU,IAAI,4BAA4B,EAAE;YAC3D,IAAI,CAAC,QAAQ;SACd,EACD,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,CACL,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;YAC3C,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC;YACzC,CAAC,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAChD,CAAC;IACJ,CAAC;IAED,IAAI;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACxC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM;QACJ,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,SAAS,GAAG,gCAAgC;QAC7D,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;oBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;oBAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnC,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;oBACvD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;gBACxC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/commands/services.d.ts

@@ -55,9 +55,24 @@ export declare function servicesDownKubernetes(deps?: ServicesKubernetesDeps): P
  * the compose table shape: NAME | STATUS | IMAGE | AGE | RESTARTS.
  */
 export declare function servicesStatusKubernetes(deps?: ServicesKubernetesDeps): Promise<void>;
+/**
+ * Normalize a user-supplied service name to the k8s Deployment name form.
+ *
+ * All olam peripheral Deployments are named `olam-<short-name>` in the k8s
+ * manifests (e.g. `olam-kg-service`, `olam-auth-service`). When the operator
+ * types `olam services restart kg-service` the CLI must prepend `olam-` before
+ * calling `kubectl rollout restart deployment/olam-kg-service`.
+ *
+ * Idempotent: if the user already types the full name (`olam-kg-service`), the
+ * prefix is NOT doubled → `olam-kg-service` (NOT `olam-olam-kg-service`).
+ *
+ * Exported for unit testing (C1 — R3-D).
+ */
+export declare function normalizeK8sDeploymentName(name: string): string;
 /**
  * `olam services restart <name>` on kubernetes substrate.
- * Uses `kubectl rollout restart deployment/<name>`.
+ * Uses `kubectl rollout restart deployment/olam-<name>`.
+ * Prepends `olam-` to the user-supplied name (idempotent — no double-prefix).
  */
 export declare function servicesRestartKubernetes(name: string, deps?: ServicesKubernetesDeps): Promise<{
     exitCode: number;

package/dist/commands/services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/commands/services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAwBrD,KAAK,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD,UAAU,eAAe;IACvB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAA8B;IAE9C,MAAM,IAAI,eAAe;IAiBzB,OAAO,CAAC,WAAW;IAInB,KAAK,IAAI,IAAI;IAgCb,IAAI,IAAI,IAAI;IAMZ,MAAM,IAAI,IAAI;IAIR,YAAY,CAAC,SAAS,SAA6B,GAAG,OAAO,CAAC,OAAO,CAAC;CAa7E;AAkDD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,WAAW,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B/B;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/B;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB/B;AA4BD,wBAAsB,UAAU,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgGhE;AAED,mCAAmC;AACnC,wBAAgB,YAAY,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CA+BnD;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,IAAI,IAAI,CAiCrC;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2DvD"}
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/commands/services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAyBrD,KAAK,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD,UAAU,eAAe;IACvB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAA8B;IAE9C,MAAM,IAAI,eAAe;IAiBzB,OAAO,CAAC,WAAW;IAInB,KAAK,IAAI,IAAI;IAgCb,IAAI,IAAI,IAAI;IAMZ,MAAM,IAAI,IAAI;IAIR,YAAY,CAAC,SAAS,SAA6B,GAAG,OAAO,CAAC,OAAO,CAAC;CAa7E;AA6BD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,WAAW,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B/B;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/B;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB/B;AA4BD,wBAAsB,UAAU,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAwIhE;AAED,mCAAmC;AACnC,wBAAgB,YAAY,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAwCnD;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,IAAI,IAAI,CA2CrC;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2DvD"}