@pleri/olam-cli 0.1.157 → 0.1.159

package/dist/index.js

@@ -3,12 +3,6 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -6398,21 +6392,21 @@ var init_exec = __esm({
       const stream = await exec.start({ Detach: false, Tty: false });
       const timeoutMs = opts?.timeout ? opts.timeout * 1e3 : void 0;
       const outputPromise = demuxStream(stream);
-      let output;
+      let output2;
       if (timeoutMs) {
         const timer = new Promise((_, reject) => {
           setTimeout(() => reject(new Error(`Command timed out after ${opts.timeout}s`)), timeoutMs);
         });
-        output = await Promise.race([outputPromise, timer]);
+        output2 = await Promise.race([outputPromise, timer]);
       } else {
-        output = await outputPromise;
+        output2 = await outputPromise;
       }
       const inspection = await exec.inspect();
       const exitCode = inspection.ExitCode ?? 1;
       return {
         exitCode,
-        stdout: output.stdout,
-        stderr: output.stderr
+        stdout: output2.stdout,
+        stderr: output2.stderr
       };
     };
   }
@@ -7890,27 +7884,6 @@ function hasImageRef(present, ref) {
   const variants = [`docker.io/library/${ref}`, `docker.io/${ref}`];
   return variants.some((v) => present.has(v));
 }
-function defaultDetectK8sClusterType(kubectlContext) {
-  const ctx = kubectlContext ?? readCurrentKubectlContext();
-  if (!ctx) return "unknown";
-  if (ctx.startsWith("colima")) return "colima";
-  if (ctx.startsWith("k3d-")) return "k3d";
-  return "unknown";
-}
-function readCurrentKubectlContext() {
-  const r = spawnSync3("kubectl", ["config", "current-context"], {
-    encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  if (r.status !== 0) return void 0;
-  return r.stdout?.trim() || void 0;
-}
-function buildDockerSocketRemedy(clusterType) {
-  if (clusterType === "colima") {
-    return "Recreate the Colima k3s cluster with the docker socket bind-mount:\n  colima stop\n  colima start --kubernetes \\\n    --mount /var/run/docker.sock:/var/run/docker.sock:w \\\n    --mount ~/.config/gh:/host/.config/gh:r\nThen run: olam upgrade";
-  }
-  return "Recreate the k3d cluster with the docker socket bind-mount:\n  k3d cluster create olam-host \\\n    --volume /var/run/docker.sock:/var/run/docker.sock@server:* \\\n    --volume ~/.config/gh:/host/.config/gh \\\n    --wait --timeout 90s\nThen run: olam upgrade";
-}
 var HEALTH_TIMEOUT_MS, COLIMA_010_WARN_TEXT, COLIMA_010_RANGE, defaultDockerExec, defaultFetch;
 var init_health_probes = __esm({
   "src/lib/health-probes.ts"() {
@@ -8481,8 +8454,8 @@ function removeBranch(repo, branch) {
   }
   let localCommitCount = 0;
   try {
-    const output = execFileSync2("git", ["rev-list", "--count", branch, "--not", "--remotes"], { cwd: gitDir, stdio: "pipe" }).toString().trim();
-    localCommitCount = parseInt(output, 10) || 0;
+    const output2 = execFileSync2("git", ["rev-list", "--count", branch, "--not", "--remotes"], { cwd: gitDir, stdio: "pipe" }).toString().trim();
+    localCommitCount = parseInt(output2, 10) || 0;
   } catch {
     localCommitCount = 1;
   }
@@ -8717,8 +8690,8 @@ function writeStrippedMcpServersSnapshot(homeDir, workspacePath, destClaudeDir)
     ...stripMcpServers(hostMcpServers),
     ...stripMcpServers(projectMcpServers)
   };
-  const output = { mcpServers: stripped };
-  fs13.writeFileSync(path15.join(destClaudeDir, ".claude.json"), JSON.stringify(output, null, 2), { mode: 384 });
+  const output2 = { mcpServers: stripped };
+  fs13.writeFileSync(path15.join(destClaudeDir, ".claude.json"), JSON.stringify(output2, null, 2), { mode: 384 });
 }
 function writeWorldEntitlementsJson(workspacePath, configCtx) {
   const olamDir = path15.join(workspacePath, ".olam");
@@ -9241,8 +9214,8 @@ import { execFileSync as execFileSync4 } from "node:child_process";
 import * as fs15 from "node:fs";
 import * as os9 from "node:os";
 import * as path17 from "node:path";
-function expandHome2(p, homedir54) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir54());
+function expandHome2(p, homedir55) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir55());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -9265,7 +9238,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir54 = deps.homedir ?? (() => os9.homedir());
+  const homedir55 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path17.join(workspacePath, ".olam", "baseline");
   try {
     fs15.mkdirSync(baselineDir, { recursive: true });
@@ -9281,7 +9254,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path17.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir54);
+    const repoPath = expandHome2(repo.path, homedir55);
     if (!fs15.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -9401,8 +9374,8 @@ function extractStderr(err) {
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir54 = deps.homedir ?? (() => os9.homedir());
-  const existsSync102 = deps.existsSync ?? ((p) => fs15.existsSync(p));
+  const homedir55 = deps.homedir ?? (() => os9.homedir());
+  const existsSync103 = deps.existsSync ?? ((p) => fs15.existsSync(p));
   const copyFileSync12 = deps.copyFileSync ?? ((src, dest) => fs15.copyFileSync(src, dest));
   const mkdirSync60 = deps.mkdirSync ?? ((dirPath, opts) => {
     fs15.mkdirSync(dirPath, opts);
@@ -9411,11 +9384,11 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir54);
+    const repoPath = expandHome2(repo.path, homedir55);
     const worktreePath = path17.join(workspacePath, repo.name);
-    if (!existsSync102(repoPath))
+    if (!existsSync103(repoPath))
       continue;
-    if (!existsSync102(worktreePath)) {
+    if (!existsSync103(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -9475,7 +9448,7 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
     for (const rel of plan.diff.untracked) {
       const src = path17.join(plan.repoPath, rel);
       const dest = path17.join(plan.worktreePath, rel);
-      if (!existsSync102(src))
+      if (!existsSync103(src))
         continue;
       try {
         mkdirSync60(path17.dirname(dest), { recursive: true });
@@ -19073,6 +19046,7 @@ __export(project_sweep_exports, {
   walkProjectRoot: () => walkProjectRoot
 });
 import * as path69 from "node:path";
+import { readdirSync as readdirSync22, lstatSync as lstatSync5, statSync as statSync23, existsSync as existsSync77 } from "node:fs";
 function isSkipped(basename13, extra) {
   if (DEFAULT_SKIP.has(basename13))
     return true;
@@ -19135,12 +19109,11 @@ function walk2(currentPath, depth, maxDepth, extraExclude, fsAdapter, results) {
   }
 }
 function makeRealFsAdapter() {
-  const fs92 = __require("node:fs");
   return {
-    readdirSync: (p) => fs92.readdirSync(p, { encoding: "utf-8" }),
+    readdirSync: (p) => readdirSync22(p, { encoding: "utf-8" }),
     // lstatSync does NOT follow symlinks — used for descent decisions.
     lstatSync: (p) => {
-      const s = fs92.lstatSync(p, { throwIfNoEntry: true });
+      const s = lstatSync5(p, { throwIfNoEntry: true });
       return {
         isDirectory: () => s.isDirectory(),
         isSymbolicLink: () => s.isSymbolicLink(),
@@ -19149,10 +19122,10 @@ function makeRealFsAdapter() {
     },
     // statSync DOES follow symlinks — used only for mtime reads on manifest/HEAD files.
     statSync: (p) => {
-      const s = fs92.statSync(p, { throwIfNoEntry: true });
+      const s = statSync23(p, { throwIfNoEntry: true });
       return { isDirectory: () => s.isDirectory(), mtimeMs: s.mtimeMs };
     },
-    existsSync: (p) => fs92.existsSync(p)
+    existsSync: (p) => existsSync77(p)
   };
 }
 function walkProjectRoot(rootPath, opts = {}) {
@@ -21774,7 +21747,6 @@ import { stringify as yamlStringify2 } from "yaml";
 
 // src/lib/upgrade-kubernetes.ts
 init_output();
-init_health_probes();
 import * as fs32 from "node:fs";
 import "node:os";
 import * as path33 from "node:path";
@@ -22141,13 +22113,13 @@ function appendAuditEntry(entry, auditLogPath, writeFileSyncImpl) {
 }
 async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, peripheral) {
   const auditLogPath = deps.auditLogPath ?? MANIFEST_REFRESH_AUDIT_LOG;
-  const readdirSync27 = deps.readdirSync ?? fs31.readdirSync;
-  const readFileSync78 = deps.readFileSync ?? fs31.readFileSync;
+  const readdirSync28 = deps.readdirSync ?? fs31.readdirSync;
+  const readFileSync80 = deps.readFileSync ?? fs31.readFileSync;
   const writeFileSyncImpl = deps.writeFileSync ?? fs31.writeFileSync;
-  const existsSync102 = deps.existsSync ?? fs31.existsSync;
+  const existsSync103 = deps.existsSync ?? fs31.existsSync;
   const now = deps.now ? deps.now() : /* @__PURE__ */ new Date();
   const targetDir = peripheral ? path32.join(manifestsDir, peripheral) : manifestsDir;
-  if (!existsSync102(targetDir)) {
+  if (!existsSync103(targetDir)) {
     return {
       ok: false,
       message: peripheral ? `peripheral manifests directory not found: ${targetDir}` : `manifests directory not found: ${targetDir}`
@@ -22155,7 +22127,7 @@ async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, per
   }
   let files;
   try {
-    const entries = readdirSync27(targetDir, { withFileTypes: true });
+    const entries = readdirSync28(targetDir, { withFileTypes: true });
     files = entries.filter((e) => e.isFile() && (e.name.endsWith(".yaml") || e.name.endsWith(".json"))).map((e) => e.name);
   } catch (err) {
     return {
@@ -22168,7 +22140,7 @@ async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, per
     const filePath = path32.join(targetDir, file);
     let content;
     try {
-      content = readFileSync78(filePath, "utf8");
+      content = readFileSync80(filePath, "utf8");
     } catch {
       continue;
     }
@@ -22216,7 +22188,7 @@ init_install_root();
 
 // src/lib/k8s-secret-render.ts
 import { spawnSync as spawnSync14 } from "node:child_process";
-import { existsSync as existsSync32, readFileSync as readFileSync26, writeFileSync as writeFileSync17, mkdirSync as mkdirSync23, chmodSync as chmodSync4 } from "node:fs";
+import { existsSync as existsSync32, readFileSync as readFileSync26, writeFileSync as writeFileSync17, mkdirSync as mkdirSync23, chmodSync as chmodSync4, renameSync as renameSync7 } from "node:fs";
 import { join as join38, dirname as dirname24 } from "node:path";
 import { randomBytes as randomBytes7 } from "node:crypto";
 var K8S_SECRETS_STATE_PATH = join38(OLAM_HOME, "k8s-secrets-state.json");
@@ -22314,7 +22286,7 @@ function writeSecretsState(state, statePath = K8S_SECRETS_STATE_PATH) {
   const tmp = `${statePath}.tmp.${process.pid}`;
   writeFileSync17(tmp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   chmodSync4(tmp, 384);
-  __require("node:fs").renameSync(tmp, statePath);
+  renameSync7(tmp, statePath);
 }
 function resolveSourceValue(source, olamHome5, reuseFromState, rotate, deps) {
   if (!rotate && reuseFromState !== void 0 && reuseFromState !== "") {
@@ -22537,7 +22509,100 @@ ${a.stderr}
   return { exitCode: 0, result: { applied, skipped, secretResults: results } };
 }
 
+// src/lib/host-side-proxy.ts
+import { spawnSync as spawnSync16 } from "node:child_process";
+function probeDockerCompose(deps) {
+  const spawn13 = deps.spawnSyncImpl ?? spawnSync16;
+  const env = deps.dockerContext !== void 0 ? { ...process.env, DOCKER_CONTEXT: deps.dockerContext } : process.env;
+  const r = spawn13("docker", ["compose", "version"], {
+    env,
+    encoding: "utf8",
+    timeout: 5e3
+  });
+  if (r.error !== void 0 || r.status !== 0) {
+    return {
+      ok: false,
+      reason: "docker compose plugin not found. Install via `brew install docker-compose` or the Docker Desktop installer. The legacy `docker-compose` binary is NOT a substitute \u2014 olam requires `docker compose` (v2 plugin) for the host-side docker-socket-proxy lifecycle on macOS."
+    };
+  }
+  return { ok: true };
+}
+function startHostSideProxy(composePath, deps = {}) {
+  const probe2 = probeDockerCompose(deps);
+  if (!probe2.ok) {
+    return probe2;
+  }
+  const spawn13 = deps.spawnSyncImpl ?? spawnSync16;
+  const env = deps.dockerContext !== void 0 ? { ...process.env, DOCKER_CONTEXT: deps.dockerContext } : process.env;
+  const r = spawn13("docker", ["compose", "-f", composePath, "up", "-d"], {
+    env,
+    encoding: "utf8",
+    timeout: 6e4
+  });
+  if (r.error !== void 0) {
+    return { ok: false, reason: `docker compose up failed: ${r.error.message}` };
+  }
+  if (r.status !== 0) {
+    const stderr = (r.stderr ?? "").toString().trim();
+    return {
+      ok: false,
+      reason: `docker compose -f ${composePath} up -d exited ${r.status ?? "null"}: ${stderr || "(no stderr)"}. Check: \`docker context ls\` shows colima active; \`docker info\` succeeds; the compose file exists at the printed path.`
+    };
+  }
+  return { ok: true };
+}
+function statusHostSideProxy(composePath, deps = {}) {
+  const probe2 = probeDockerCompose(deps);
+  if (!probe2.ok) {
+    return { ok: false, status: "unknown", reason: probe2.reason };
+  }
+  const spawn13 = deps.spawnSyncImpl ?? spawnSync16;
+  const env = deps.dockerContext !== void 0 ? { ...process.env, DOCKER_CONTEXT: deps.dockerContext } : process.env;
+  const r = spawn13("docker", ["compose", "-f", composePath, "ps", "--format", "json"], {
+    env,
+    encoding: "utf8",
+    timeout: 1e4
+  });
+  if (r.error !== void 0 || r.status !== 0) {
+    return {
+      ok: false,
+      status: "unknown",
+      reason: `docker compose ps failed: ${(r.stderr ?? r.error?.message ?? "(no detail)").toString().trim()}`
+    };
+  }
+  const stdout = (r.stdout ?? "").toString().trim();
+  if (stdout === "" || stdout === "[]") {
+    return { ok: true, status: "stopped" };
+  }
+  try {
+    const parsed = stdout.startsWith("[") ? JSON.parse(stdout) : stdout.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
+    if (!Array.isArray(parsed) || parsed.length === 0) {
+      return { ok: true, status: "stopped" };
+    }
+    const allRunning = parsed.every((entry) => {
+      if (typeof entry !== "object" || entry === null) {
+        return false;
+      }
+      const state = entry.State;
+      return typeof state === "string" && state.toLowerCase() === "running";
+    });
+    return { ok: true, status: allRunning ? "running" : "stopped" };
+  } catch {
+    return {
+      ok: false,
+      status: "unknown",
+      reason: "docker compose ps emitted unparseable JSON; check `docker compose version`."
+    };
+  }
+}
+
 // src/lib/upgrade-kubernetes.ts
+function resolveHostSideProxyComposePath() {
+  const root = resolveK8sAssetsRoot();
+  if (root === null) return null;
+  const candidate = path33.join(root, "host-side", "docker-socket-proxy.compose.yaml");
+  return fs32.existsSync(candidate) ? candidate : null;
+}
 var OLAM_K8S_MANIFESTS_DIR = path33.join(OLAM_HOME, "k8s", "manifests");
 var K8S_NAMESPACE3 = "olam";
 var HOST_CP_SECRET_NAME = "olam-host-cp-secret";
@@ -22603,28 +22668,6 @@ async function detectManagedK8sProvider(deps) {
   }
   return null;
 }
-async function checkDockerSocketAccessible(context, deps) {
-  if (deps.checkDockerSocketImpl) {
-    return deps.checkDockerSocketImpl(context);
-  }
-  const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
-  const result = await wrap(
-    [
-      "--context",
-      context,
-      "exec",
-      "deploy/olam-host-cp",
-      "-n",
-      "olam",
-      "--",
-      "test",
-      "-S",
-      "/var/run/docker.sock"
-    ],
-    { timeout: 1e4 }
-  );
-  return result.ok;
-}
 async function probeKubernetesApiReachable(context, deps) {
   const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
   const result = await wrap(
@@ -22678,11 +22721,11 @@ async function checkSecretPreCondition(context, deps) {
 }
 async function applyConfigMapSubstitution(context, manifestsDir, deps) {
   const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
-  const readFileSync78 = deps.readFileSyncImpl ?? fs32.readFileSync;
+  const readFileSync80 = deps.readFileSyncImpl ?? fs32.readFileSync;
   const configMapPath = path33.join(manifestsDir, "30-configmap.yaml");
   let rawYaml;
   try {
-    rawYaml = readFileSync78(configMapPath, "utf8");
+    rawYaml = readFileSync80(configMapPath, "utf8");
   } catch (err) {
     return `Failed to read ConfigMap at ${configMapPath}: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -22824,48 +22867,6 @@ async function createGhcrPullSecret(context, deps, stderr) {
   }
   return { skipped: false };
 }
-var K3D_NODE_CONTAINER = "k3d-olam-host-server-0";
-async function defaultCheckK3dNodeMounts() {
-  const { execFile } = await import("node:child_process");
-  const { promisify } = await import("node:util");
-  const execFileAsync = promisify(execFile);
-  try {
-    const { stdout } = await execFileAsync(
-      "docker",
-      ["inspect", K3D_NODE_CONTAINER, "--format", "{{json .HostConfig.Binds}}"],
-      { timeout: 8e3 }
-    );
-    const binds = JSON.parse(stdout.trim());
-    if (!Array.isArray(binds)) return "none";
-    if (binds.some((b) => b.includes("/host-colima/"))) return "new-form";
-    if (binds.some((b) => b.startsWith("/var/run/docker.sock:"))) return "old-form";
-    return "none";
-  } catch {
-    return "none";
-  }
-}
-async function preflightK3dNodeMounts(deps, stderr) {
-  const check = deps.checkK3dNodeMountsImpl ?? defaultCheckK3dNodeMounts;
-  const form = await check();
-  if (form === "new-form") {
-    return null;
-  }
-  if (form === "old-form") {
-    return `Your k3d cluster was created with the old --volume form which fails on colima.
-  Recreate the cluster with:
-    k3d cluster delete olam-host
-    k3d cluster create olam-host --volume "$HOME/.colima/default/:/host-colima/@server:*"
-  Then re-run olam upgrade.`;
-  }
-  stderr.write(
-    `${pc9.yellow("[warn]")} step 0.5: k3d node container "${K3D_NODE_CONTAINER}" not found or bind form undetectable.
-  This is expected on non-k3d clusters (bare k3s, minikube). Continuing.
-  On colima+k3d: ensure the cluster was created with:
-    k3d cluster create olam-host --volume "$HOME/.colima/default/:/host-colima/@server:*"
-`
-  );
-  return null;
-}
 async function runUpgradeKubernetes(opts = {}, deps = {}) {
   const stdout = deps.stdout ?? process.stdout;
   const stderr = deps.stderr ?? process.stderr;
@@ -22883,32 +22884,6 @@ async function runUpgradeKubernetes(opts = {}, deps = {}) {
       return { exitCode: 1, summary: "manifest seed failed" };
     }
   }
-  {
-    const preliminaryResolved = resolveKubectlContext(deps.configPath);
-    if (preliminaryResolved.error === void 0) {
-      const preliminaryContext = preliminaryResolved.context;
-      const step04Spinner = ora3("Creating ghcr-pull imagePullSecret (R3-C)").start();
-      const pullSecretResult = await createGhcrPullSecret(preliminaryContext, deps, stderr);
-      if (pullSecretResult.skipped) {
-        step04Spinner.warn(`ghcr-pull Secret skipped: ${pullSecretResult.reason ?? "no token"}`);
-      } else if (pullSecretResult.reason) {
-        const warnMsg = `ghcr-pull Secret apply failed (continuing): ${pullSecretResult.reason}`;
-        step04Spinner.warn(warnMsg);
-        stderr.write(`${pc9.yellow("[warn]")} ${warnMsg}
-`);
-      } else {
-        step04Spinner.succeed("ghcr-pull imagePullSecret created/updated");
-      }
-    }
-  }
-  {
-    const step05Error = await preflightK3dNodeMounts(deps, stderr);
-    if (step05Error !== null) {
-      stderr.write(`${pc9.red("error:")} ${step05Error}
-`);
-      return { exitCode: 1, summary: "k3d node bind-mount preflight failed (Decision #11)" };
-    }
-  }
   const resolved = resolveKubectlContext(deps.configPath);
   if (resolved.error !== void 0) {
     stderr.write(`${pc9.red("error:")} ${resolved.error}
@@ -22935,22 +22910,6 @@ async function runUpgradeKubernetes(opts = {}, deps = {}) {
       return { exitCode: 1, summary: "managed-k8s context detected (Decision #18 retraction)" };
     }
   }
-  {
-    const socketAccessible = await checkDockerSocketAccessible(pinnedContext, deps);
-    if (!socketAccessible) {
-      const clusterType = defaultDetectK8sClusterType(pinnedContext);
-      const remedyText = buildDockerSocketRemedy(clusterType).split("\n").map((line) => `  ${line}`).join("\n");
-      stderr.write(
-        `${pc9.yellow("[WARN]")} docker socket not accessible at /var/run/docker.sock inside the host-cp pod.
-  This means the cluster was not created with the docker socket bind-mount,
-  or host-cp is not yet deployed (first install \u2014 this warning is expected).
-  For subsequent upgrades:
-${remedyText}
-  Run olam doctor to check probe 28 (probeDockerSocketBindMount).
-`
-      );
-    }
-  }
   const step0Spinner = ora3("Probing Kubernetes API reachability").start();
   const reachable = await probeKubernetesApiReachable(pinnedContext, deps);
   if (!reachable) {
@@ -22989,6 +22948,41 @@ ${remedyText}
     const note = skippedCount > 0 ? ` (${skippedCount} skipped \u2014 see warnings above)` : "";
     step05Spinner.succeed(`k8s bootstrap: ${appliedCount} applied${note}`);
   }
+  {
+    const step06Spinner = ora3("Creating ghcr-pull imagePullSecret (R3-C)").start();
+    const pullSecretResult = await createGhcrPullSecret(pinnedContext, deps, stderr);
+    if (pullSecretResult.skipped) {
+      step06Spinner.warn(`ghcr-pull Secret skipped: ${pullSecretResult.reason ?? "no token"}`);
+    } else if (pullSecretResult.reason) {
+      const warnMsg = `ghcr-pull Secret apply failed (continuing): ${pullSecretResult.reason}`;
+      step06Spinner.warn(warnMsg);
+      stderr.write(`${pc9.yellow("[warn]")} ${warnMsg}
+`);
+    } else {
+      step06Spinner.succeed("ghcr-pull imagePullSecret created/updated");
+    }
+  }
+  if (process.platform === "darwin") {
+    const step07Spinner = ora3("Starting host-side docker-socket-proxy (R4-W2-F)").start();
+    const composePath = resolveHostSideProxyComposePath();
+    if (composePath === null) {
+      step07Spinner.warn("host-side docker-socket-proxy compose yaml not found (bundle layout?)");
+      stderr.write(
+        `${pc9.yellow("[warn]")} could not locate docker-socket-proxy.compose.yaml in the bundled k8s assets.
+  This is a packaging bug \u2014 please report. Continuing without auto-start.
+`
+      );
+    } else {
+      const startResult = startHostSideProxy(composePath);
+      if (!startResult.ok) {
+        step07Spinner.warn(`host-side docker-socket-proxy start failed (continuing): ${startResult.reason ?? "unknown"}`);
+        stderr.write(`${pc9.yellow("[warn]")} ${startResult.reason ?? "unknown error"}
+`);
+      } else {
+        step07Spinner.succeed("docker-socket-proxy ready on host");
+      }
+    }
+  }
   const step1Spinner = ora3("Verifying kubectl context (D10)").start();
   if (!isContextAllowed(pinnedContext)) {
     step1Spinner.fail("Context disallowed");
@@ -23474,7 +23468,7 @@ ${pc11.dim("Next: olam create --name my-world")}`);
 
 // src/commands/create.ts
 init_manager();
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 import { existsSync as existsSync38 } from "node:fs";
 import { dirname as dirname27, resolve as resolve14 } from "node:path";
 import ora5 from "ora";
@@ -23712,9 +23706,9 @@ init_output();
 init_host_cp();
 
 // src/lib/world-mcp-register.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 var DEFAULT_DOCKER_EXEC_DEPS = {
-  spawn: spawnSync16,
+  spawn: spawnSync17,
   log: (msg) => console.log(msg)
 };
 var MCP_NAME = "agentmemory";
@@ -23779,7 +23773,7 @@ function registerAgentMemoryMcp(opts, deps = DEFAULT_DOCKER_EXEC_DEPS) {
 init_install_root();
 import * as fs34 from "node:fs";
 import * as path35 from "node:path";
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 import ora4 from "ora";
 
 // src/lib/bundle-source.ts
@@ -23902,7 +23896,7 @@ function buildIfStale(repoRoot, env = process.env) {
   }
   const reason = distMtime === 0 ? "dist is absent" : `source newer by ${Math.round((srcMtime - distMtime) / 1e3)}s`;
   const spinner = ora4(`Rebuilding agent-stream bundle\u2026 (${reason})`).start();
-  const result = spawnSync17(
+  const result = spawnSync18(
     "npm",
     ["run", "build", "--workspace=@olam/intelligence"],
     {
@@ -23966,7 +23960,7 @@ function registerCreate(program2) {
       if (decision.stderrLine) {
         process.stderr.write(decision.stderrLine + "\n");
       }
-      spawnSync18("docker", ["pull", overrideRef], { stdio: "pipe" });
+      spawnSync19("docker", ["pull", overrideRef], { stdio: "pipe" });
       const { inspectImageProtocolVersions: inspectImageProtocolVersions2, checkProtocolOverlap: checkProtocolOverlap2 } = await Promise.resolve().then(() => (init_protocol_version(), protocol_version_exports));
       const inspect = inspectImageProtocolVersions2(overrideRef);
       if (inspect.inspectFailed) {
@@ -24083,7 +24077,7 @@ function registerCreate(program2) {
             throw err;
           }
           const spinner2 = ora5("Rebuilding olam-devbox:latest\u2026").start();
-          const rebuild = spawnSync18(
+          const rebuild = spawnSync19(
             "bash",
             [buildScript],
             { cwd: repoRoot, stdio: "inherit" }
@@ -30341,7 +30335,7 @@ init_output();
 init_host_cp();
 import * as fs42 from "node:fs";
 import * as path44 from "node:path";
-import { spawnSync as spawnSync20 } from "node:child_process";
+import { spawnSync as spawnSync21 } from "node:child_process";
 import ora9 from "ora";
 import pc20 from "picocolors";
 
@@ -30349,7 +30343,7 @@ import pc20 from "picocolors";
 import * as fs40 from "node:fs";
 import * as os21 from "node:os";
 import * as path42 from "node:path";
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 var LOCK_FILE_PATH = path42.join(os21.homedir(), ".olam", ".upgrade.lock");
 var STALE_LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 function readLockFile(lockPath) {
@@ -30374,7 +30368,7 @@ function isPidAlive2(pid) {
 }
 var PS_UNAVAILABLE = "__ps_unavailable__";
 function getPidCommand(pid) {
-  const result = spawnSync19("ps", ["-p", String(pid), "-o", "comm="], {
+  const result = spawnSync20("ps", ["-p", String(pid), "-o", "comm="], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "ignore"]
   });
@@ -30635,7 +30629,7 @@ function extractBundleHash(indexHtml) {
 function runStep2(label, cmd, args, opts = {}) {
   const start = Date.now();
   process.stdout.write(`  ${pc20.dim(label.padEnd(34))}`);
-  const result = spawnSync20(cmd, [...args], {
+  const result = spawnSync21(cmd, [...args], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd: opts.cwd ?? process.cwd(),
@@ -30654,7 +30648,7 @@ function runStep2(label, cmd, args, opts = {}) {
   };
 }
 function isGitDirty(cwd) {
-  const result = spawnSync20("git", ["status", "--porcelain"], {
+  const result = spawnSync21("git", ["status", "--porcelain"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -30662,7 +30656,7 @@ function isGitDirty(cwd) {
   return (result.stdout ?? "").trim().length > 0;
 }
 function hasGitUpstream(cwd) {
-  const result = spawnSync20("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
+  const result = spawnSync21("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -30670,7 +30664,7 @@ function hasGitUpstream(cwd) {
   return result.status === 0;
 }
 function captureHeadSha(cwd) {
-  const result = spawnSync20("git", ["rev-parse", "HEAD"], {
+  const result = spawnSync21("git", ["rev-parse", "HEAD"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -30685,7 +30679,7 @@ function abbreviateSha(sha) {
 }
 function imageExists(tag) {
   try {
-    const result = spawnSync20("docker", ["image", "inspect", "--format", "{{.Id}}", tag], {
+    const result = spawnSync21("docker", ["image", "inspect", "--format", "{{.Id}}", tag], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -30701,7 +30695,7 @@ function checkRollbackSetExists(plan) {
 }
 var SMOKE_DOCKER_TIMEOUT_MS = 3e4;
 function smokeImage(image, targetSha) {
-  const createResult = spawnSync20("docker", ["create", "--name", `olam-smoke-${Date.now()}`, image], {
+  const createResult = spawnSync21("docker", ["create", "--name", `olam-smoke-${Date.now()}`, image], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: SMOKE_DOCKER_TIMEOUT_MS
@@ -30715,7 +30709,7 @@ function smokeImage(image, targetSha) {
     };
   }
   const containerId = (createResult.stdout ?? "").trim();
-  const inspectResult = spawnSync20(
+  const inspectResult = spawnSync21(
     "docker",
     ["inspect", "--format", '{{index .Config.Labels "olam.build.sha"}}', image],
     {
@@ -30725,7 +30719,7 @@ function smokeImage(image, targetSha) {
     }
   );
   if (containerId.length > 0) {
-    spawnSync20("docker", ["rm", "-f", containerId], {
+    spawnSync21("docker", ["rm", "-f", containerId], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"],
       timeout: SMOKE_DOCKER_TIMEOUT_MS
@@ -30767,7 +30761,7 @@ var PRODUCTION_SWAP_PLAN = [
 ];
 function dockerTag(source, dest) {
   try {
-    const result = spawnSync20("docker", ["tag", source, dest], {
+    const result = spawnSync21("docker", ["tag", source, dest], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -30931,11 +30925,11 @@ async function waitForAuthHealthLocal(timeoutMs = AUTH_HEALTH_TIMEOUT_MS) {
 async function recreateAuthService() {
   const start = Date.now();
   try {
-    spawnSync20("docker", ["stop", "olam-auth"], {
+    spawnSync21("docker", ["stop", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
-    spawnSync20("docker", ["rm", "olam-auth"], {
+    spawnSync21("docker", ["rm", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -31233,11 +31227,11 @@ async function defaultRecreateMcpAuthForUpgrade() {
 }
 async function defaultRecreateAuthForUpgrade() {
   try {
-    spawnSync20("docker", ["stop", "olam-auth"], {
+    spawnSync21("docker", ["stop", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
-    spawnSync20("docker", ["rm", "olam-auth"], {
+    spawnSync21("docker", ["rm", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -31259,7 +31253,7 @@ async function defaultRecreateAuthForUpgrade() {
   }
 }
 function defaultInspectContainerLabels(containerName) {
-  const result = spawnSync20(
+  const result = spawnSync21(
     "docker",
     [
       "inspect",
@@ -31283,7 +31277,7 @@ function defaultInspectContainerLabels(containerName) {
   return { ok: false, exists: false, project: "", service: "", stderr };
 }
 function defaultRemoveContainer(containerName) {
-  const result = spawnSync20("docker", ["rm", "-f", containerName], {
+  const result = spawnSync21("docker", ["rm", "-f", containerName], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -31614,7 +31608,7 @@ ${spaResult.stderr}`);
       process.stdout.write(`  ${pc20.dim(step.label.padEnd(34))}
 `);
       const start = Date.now();
-      const result = spawnSync20("bash", [scriptPath], {
+      const result = spawnSync21("bash", [scriptPath], {
         stdio: "inherit",
         cwd,
         env: { ...process.env, ...olamTagEnv }
@@ -31970,7 +31964,7 @@ function registerLogs(program2) {
 init_context();
 init_output();
 import pc22 from "picocolors";
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 var SAFE_IDENT4 = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function parseDockerTop(stdout) {
   const trimmed = stdout.trim();
@@ -32070,7 +32064,7 @@ function registerPs(program2) {
     const containerName = `olam-${worldId}-devbox`;
     let watchInterval;
     function fetchAndPrint() {
-      const result = spawnSync21(
+      const result = spawnSync22(
         "docker",
         ["top", containerName, "pid", "user", "pcpu", "pmem", "stime", "stat", "cmd"],
         { encoding: "utf-8", timeout: 3e3 }
@@ -32563,7 +32557,7 @@ init_output();
 import * as fs46 from "node:fs";
 import * as os24 from "node:os";
 import * as path48 from "node:path";
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 import ora10 from "ora";
 
 // src/commands/refresh-helpers.ts
@@ -32607,7 +32601,7 @@ var RESTART_TIMEOUT_S = 30;
 var HEALTH_POLL_MS = 500;
 var HEALTH_TIMEOUT_MS2 = 3e4;
 function docker(args) {
-  const result = spawnSync22("docker", args, {
+  const result = spawnSync23("docker", args, {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -32794,10 +32788,10 @@ init_context();
 init_output();
 import { existsSync as existsSync53 } from "node:fs";
 import { dirname as dirname32, resolve as resolve15 } from "node:path";
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 var RESTART_TIMEOUT_S2 = 30;
 function docker2(args) {
-  const result = spawnSync23("docker", args, {
+  const result = spawnSync24("docker", args, {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -33318,9 +33312,9 @@ async function runDoctor(opts, deps = {}) {
     const nodeMemResult = probeNodeMemory(dockerExec, k8sCtx);
     rows.push({ name: "node memory", result: nodeMemResult, position: 27 });
     const socketCheckImpl = deps.dockerSocketCheckImpl;
-    const detectClusterTypeImpl = deps.detectK8sClusterTypeImpl;
-    const socketResult = await probeDockerSocketBindMount(k8sCtx, wrapImpl, socketCheckImpl, detectClusterTypeImpl);
-    rows.push({ name: "docker socket bind-mount", result: socketResult, position: 28 });
+    const composePath = deps.hostSideProxyComposePathOverride !== void 0 ? deps.hostSideProxyComposePathOverride : defaultResolveHostSideProxyComposePath();
+    const socketResult = await probeHostSideProxyReachability(composePath, socketCheckImpl);
+    rows.push({ name: "host-side proxy", result: socketResult, position: 28 });
   } else {
     const bundleResult = await probeBundleFreshness({
       dockerExec,
@@ -33540,36 +33534,50 @@ function probeNodeMemory(dockerExec, kubectlContext) {
     message: `node free RAM ${freeGiB.toFixed(1)} GiB (\u2265${WARN_THRESHOLD_GIB} GiB threshold)`
   };
 }
-async function defaultDockerSocketCheck(kubectlContext, wrapImpl) {
-  const ctxArgs = kubectlContext ? ["--context", kubectlContext] : [];
-  const result = await wrapImpl(
-    [
-      ...ctxArgs,
-      "exec",
-      "deploy/olam-host-cp",
-      "-n",
-      "olam",
-      "--",
-      "test",
-      "-S",
-      "/var/run/docker.sock"
-    ],
-    { timeout: 1e4 }
-  );
-  return result.ok;
+function defaultResolveHostSideProxyComposePath() {
+  const root = resolveK8sAssetsRoot();
+  if (root === null) return null;
+  const candidate = path51.join(root, "host-side", "docker-socket-proxy.compose.yaml");
+  return fs49.existsSync(candidate) ? candidate : null;
+}
+async function defaultDockerSocketCheck(composePath) {
+  const result = statusHostSideProxy(composePath);
+  return result.status;
 }
-async function probeDockerSocketBindMount(kubectlContext, wrapImpl, checkImpl, detectClusterTypeImpl) {
+async function probeHostSideProxyReachability(composePath, checkImpl) {
+  if (composePath === null) {
+    return {
+      ok: true,
+      warn: true,
+      message: "host-side proxy compose yaml not found in CLI bundle",
+      remedy: "The bundled `docker-socket-proxy.compose.yaml` could not be resolved.\nThis is a packaging issue \u2014 try `npm install -g @pleri/olam-cli@latest`\nto restore the bundled k8s assets."
+    };
+  }
   const check = checkImpl ?? defaultDockerSocketCheck;
-  const accessible = await check(kubectlContext, wrapImpl);
-  if (accessible) {
-    return { ok: true, message: "docker socket accessible at /var/run/docker.sock" };
+  const status2 = await check(composePath);
+  if (status2 === "running") {
+    return {
+      ok: true,
+      message: "host-side docker-socket-proxy running on operator docker daemon"
+    };
+  }
+  if (status2 === "stopped") {
+    return {
+      ok: true,
+      warn: true,
+      message: "host-side docker-socket-proxy not running",
+      remedy: `Start the proxy on the operator host:
+  - macOS: re-run \`olam upgrade\` (Step 0.7 auto-starts the proxy)
+  - Linux: \`docker compose -f ${composePath} up -d\`
+host-cp connects to docker through this proxy via the in-cluster
+ExternalName Service \`docker-socket-proxy.olam.svc.cluster.local:2375\`.`
+    };
   }
-  const clusterType = (detectClusterTypeImpl ?? defaultDetectK8sClusterType)(kubectlContext);
   return {
     ok: true,
     warn: true,
-    message: "docker socket not accessible at /var/run/docker.sock",
-    remedy: buildDockerSocketRemedy(clusterType)
+    message: "host-side docker-socket-proxy status unknown",
+    remedy: "Probe failed before reaching the docker daemon. Check:\n  - `docker compose version` succeeds (compose v2 plugin installed)\n  - `docker context ls` shows your active context (colima for macOS)\n  - `docker info` succeeds against that context"
   };
 }
 async function runK8sPreflight(opts, deps = {}) {
@@ -33981,6 +33989,345 @@ function registerSubstrate(program2) {
   registerSubstrateAuditLog(sub);
 }
 
+// ../cli-plugin-tasks/dist/client.js
+import { readFileSync as readFileSync45 } from "node:fs";
+import { homedir as homedir28 } from "node:os";
+import { join as join59 } from "node:path";
+var TasksClient = class {
+  baseUrl;
+  token;
+  olamNodeId;
+  sessionId;
+  constructor(opts) {
+    this.baseUrl = (opts.hostCpUrl ?? process.env.OLAM_HOST_CP_URL ?? "http://localhost:19000").replace(/\/$/, "");
+    const tokenPath2 = opts.tokenPath ?? join59(homedir28(), ".olam", "host-cp.token");
+    try {
+      this.token = readFileSync45(tokenPath2, "utf8").trim();
+    } catch (e) {
+      throw new Error(`cli-plugin-tasks: cannot read host-cp token at ${tokenPath2} (${e instanceof Error ? e.message : "unknown"}). Bootstrap host-cp first.`);
+    }
+    this.olamNodeId = opts.olamNodeId;
+    this.sessionId = opts.sessionId;
+  }
+  async call(method, path91, scopes, body, query) {
+    const qs = query ? "?" + new URLSearchParams(Object.entries(query).filter(([, v]) => v !== void 0)).toString() : "";
+    const url2 = `${this.baseUrl}${path91}${qs}`;
+    const res = await fetch(url2, {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.token}`,
+        "X-Olam-Node-Id": this.olamNodeId,
+        "X-Olam-Session-Id": this.sessionId,
+        "X-Olam-Tasks-Scopes": scopes.join(",")
+      },
+      body: body && method === "POST" ? JSON.stringify(body) : void 0
+    });
+    const envelope = await res.json().catch(() => ({ success: false, data: null, error: "invalid JSON response" }));
+    return { status: res.status, envelope };
+  }
+};
+
+// ../cli-plugin-tasks/dist/tracker-parser.js
+import { readFileSync as readFileSync46 } from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
+function contentHash(parts) {
+  const normalized = parts.map((p) => (p ?? "").trim()).join("|");
+  const h = createHash6("sha256").update(normalized).digest("hex");
+  return `sha256-${h.slice(0, 16)}`;
+}
+function parseFrontmatter2(raw) {
+  if (!raw.startsWith("---\n"))
+    return { frontmatter: {}, body: raw };
+  const end = raw.indexOf("\n---\n", 4);
+  if (end === -1)
+    return { frontmatter: {}, body: raw };
+  const yaml = raw.slice(4, end);
+  const body = raw.slice(end + 5);
+  const fm = {};
+  for (const line of yaml.split("\n")) {
+    const m = /^(\w+):\s*(.+?)\s*$/.exec(line);
+    if (!m)
+      continue;
+    const key = m[1] ?? "";
+    const value = m[2] ?? "";
+    if (key === "feature")
+      fm.feature = value;
+    else if (key === "phase")
+      fm.phase = value;
+    else if (key === "tier")
+      fm.tier = value;
+    else if (key === "autonomous")
+      fm.autonomous = value === "true";
+  }
+  return { frontmatter: fm, body };
+}
+function parseTracker(path91) {
+  const raw = readFileSync46(path91, "utf8");
+  const { frontmatter, body } = parseFrontmatter2(raw);
+  const lines = body.split("\n");
+  const tasks = [];
+  let current = null;
+  let currentGoal = null;
+  const flush = () => {
+    if (!current)
+      return;
+    tasks.push({
+      taskId: contentHash([current.title, currentGoal ?? "", frontmatter.feature ?? ""]),
+      rawId: current.rawId,
+      title: current.title,
+      feature: frontmatter.feature ?? null,
+      phase: frontmatter.phase ?? null,
+      goal: currentGoal
+    });
+    current = null;
+    currentGoal = null;
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const headerMatch = line ? /^### ([A-Za-z]+\d+(?:\.\d+)*) — (.+?)\s*$/.exec(line) : null;
+    if (headerMatch) {
+      flush();
+      current = { rawId: headerMatch[1] ?? "", title: headerMatch[2] ?? "", lineNo: i };
+      continue;
+    }
+    if (current && !currentGoal && line) {
+      const goalMatch = /^> \*\*Goal\*\*:\s*(.+?)\s*$/.exec(line);
+      if (goalMatch)
+        currentGoal = goalMatch[1] ?? null;
+    }
+  }
+  flush();
+  return { frontmatter, tasks };
+}
+
+// ../cli-plugin-tasks/dist/commands/workers.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+var SUBSTRATES = ["mac-mini", "cloudflare-container", "gcp-vm"];
+function generateProvisionPlan(opts) {
+  const workerId = opts.workerId ?? `worker-${randomUUID2().slice(0, 8)}`;
+  const hostCpUrl = opts.hostCpUrl ?? "http://localhost:19000";
+  const nodeId = opts.olamNodeId ?? `<OLAM_NODE_ID>`;
+  const sessionId = opts.sessionId ?? `<OLAM_SESSION_ID>`;
+  const tokenPlaceholder = `<TASK_TOKEN_FROM_AUTH_SERVICE>`;
+  let lines;
+  switch (opts.substrate) {
+    case "mac-mini":
+      lines = [
+        `# 1. Issue task-token from auth-service:`,
+        `#    curl -X POST $AUTH_SERVICE_URL/credentials/issue-task-token \\`,
+        `#      -d '{"sub":"${workerId}","scopes":["tasks-claim","tasks-state-update"]}'`,
+        `# 2. Install launchd plist:`,
+        `cd packages/worker-runner/profiles/mac-mini && bash install.sh \\`,
+        `  --worker-id "${workerId}" \\`,
+        `  --host-cp-url "${hostCpUrl}" \\`,
+        `  --olam-node-id "${nodeId}" \\`,
+        `  --session-id "${sessionId}" \\`,
+        `  --task-token "${tokenPlaceholder}"`,
+        `# 3. Verify: launchctl list | grep com.olam.worker-runner`
+      ];
+      break;
+    case "cloudflare-container":
+      lines = [
+        `# 1. Issue task-token (same as mac-mini above)`,
+        `# 2. Deploy Cloudflare Container:`,
+        `cd packages/worker-runner/profiles/cloudflare-container`,
+        `wrangler secret put OLAM_TASK_TOKEN     # paste ${tokenPlaceholder}`,
+        `wrangler secret put OLAM_NODE_ID        # paste ${nodeId}`,
+        `wrangler secret put OLAM_HOST_CP_URL    # paste ${hostCpUrl}`,
+        `wrangler deploy`,
+        `# 3. Verify: wrangler tail (watch worker logs)`
+      ];
+      break;
+    case "gcp-vm":
+      lines = [
+        `# 1. Issue task-token (same as mac-mini above)`,
+        `# 2. Provision GCP VM with workload-identity-federation:`,
+        `cd packages/worker-runner/profiles/gcp-vm`,
+        `terraform apply -var="worker_id=${workerId}"`,
+        `gcloud compute instances create olam-worker-${workerId} \\`,
+        `  --metadata-from-file startup-script=startup-script.sh \\`,
+        `  --metadata olam-host-cp-url=${hostCpUrl},olam-node-id=${nodeId}`,
+        `# 3. Verify: gcloud compute ssh olam-worker-${workerId} -- systemctl status olam-worker-runner`
+      ];
+      break;
+    default: {
+      const _exhaustive = opts.substrate;
+      throw new Error(`Unknown substrate: ${_exhaustive}`);
+    }
+  }
+  return {
+    substrate: opts.substrate,
+    workerId,
+    taskTokenPlaceholder: tokenPlaceholder,
+    installLines: lines
+  };
+}
+function registerWorkers(program2) {
+  const workers = program2.command("workers").description("Manage multi-substrate workers (B4.6; provision/list/revoke task-tokens for mac-mini/cloudflare-container/gcp-vm deploy profiles)");
+  workers.command("provision <substrate>").description(`Generate substrate-specific install lines + token-issuance instructions. substrate: ${SUBSTRATES.join(" | ")}`).option("--worker-id <id>", "Worker identifier (default: random uuid-prefix)").option("--host-cp-url <url>", "host-cp URL (default: http://localhost:19000)").option("--node-id <uuid>", "Olam node ID this worker reports as (default: env OLAM_NODE_ID)").option("--session-id <uuid>", "Session ID this worker uses for claims (default: env OLAM_SESSION_ID)").option("--json", "Output structured JSON instead of operator-friendly lines").action((substrate, opts) => {
+    if (!SUBSTRATES.includes(substrate)) {
+      process.stderr.write(`Error: substrate must be one of: ${SUBSTRATES.join(", ")}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const plan = generateProvisionPlan({
+      substrate,
+      workerId: opts.workerId,
+      hostCpUrl: opts.hostCpUrl,
+      olamNodeId: opts.nodeId ?? process.env.OLAM_NODE_ID,
+      sessionId: opts.sessionId ?? process.env.OLAM_SESSION_ID
+    });
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
+    } else {
+      process.stdout.write(`# olam workers provision: ${plan.substrate} substrate (worker-id=${plan.workerId})
+
+`);
+      for (const line of plan.installLines)
+        process.stdout.write(line + "\n");
+    }
+  });
+  workers.command("list").description("List active task-tokens (calls auth-service /credentials/list-task-tokens; B4.5-HTTP follow-up)").option("--json", "Output structured JSON").action((opts) => {
+    const message = "olam workers list: auth-service HTTP wrap not yet shipped (B4.5-HTTP follow-up). For v1: inspect TaskTokenService blocklist via auth-service in-process surface.";
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ status: "pending-http-wrap", message }, null, 2) + "\n");
+    } else {
+      process.stderr.write(`${message}
+`);
+    }
+    process.exitCode = 1;
+  });
+  workers.command("revoke <token-or-worker-id>").description("Revoke a task-token (calls auth-service /credentials/revoke-task-token; B4.5-HTTP follow-up)").action((_target) => {
+    const message = "olam workers revoke: auth-service HTTP wrap not yet shipped (B4.5-HTTP follow-up). For v1: call TaskTokenService.revoke() directly from auth-service process.";
+    process.stderr.write(`${message}
+`);
+    process.exitCode = 1;
+  });
+}
+
+// ../cli-plugin-tasks/dist/index.js
+function makeClient(opts) {
+  const olamNodeId = opts.nodeId ?? process.env.OLAM_NODE_ID;
+  const sessionId = opts.sessionId ?? process.env.OLAM_SESSION_ID;
+  if (!olamNodeId)
+    throw new Error("olam tasks: --node-id <uuid> or OLAM_NODE_ID env required");
+  if (!sessionId)
+    throw new Error("olam tasks: --session-id <uuid> or OLAM_SESSION_ID env required");
+  return new TasksClient({ olamNodeId, sessionId });
+}
+function output(envelope, status2, json) {
+  if (json) {
+    process.stdout.write(JSON.stringify({ status: status2, envelope }, null, 2) + "\n");
+    return;
+  }
+  if (status2 >= 200 && status2 < 300) {
+    process.stdout.write(JSON.stringify(envelope, null, 2) + "\n");
+  } else {
+    process.stderr.write(`[${status2}] ${JSON.stringify(envelope, null, 2)}
+`);
+    process.exitCode = 1;
+  }
+}
+function registerTasks(program2) {
+  const tasks = program2.command("tasks").description("Manage @olam/tasks substrate (per-node task tracking with multi-tenant compound PK + RLS)");
+  tasks.command("new <title>").description("Create a new task (POST /api/tasks)").option("--feature <slug>", "Feature slug").option("--phase <letter>", "Phase letter").option("--priority <n>", "Priority 0-10", (v) => parseInt(v, 10)).option("--node-id <uuid>", "Olam node ID (or OLAM_NODE_ID env)").option("--session-id <uuid>", "Session ID (or OLAM_SESSION_ID env)").option("--json", "Output raw JSON envelope").action(async (title, opts) => {
+    const client = makeClient(opts);
+    const body = { title, feature: opts.feature, phase: opts.phase, priority: opts.priority };
+    const { status: status2, envelope } = await client.call("POST", "/api/tasks", ["tasks-create"], body);
+    output(envelope, status2, !!opts.json);
+  });
+  tasks.command("list").description("List tasks (GET /api/tasks)").option("--feature <slug>", "Filter by feature").option("--state <state>", "Filter by state (open|claimed|done|cancelled|blocked)").option("--limit <n>", "Max rows", (v) => parseInt(v, 10)).option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--json", "Output raw JSON envelope").action(async (opts) => {
+    const client = makeClient(opts);
+    const query = {
+      feature: opts.feature,
+      state: opts.state,
+      limit: opts.limit ? String(opts.limit) : void 0
+    };
+    const { status: status2, envelope } = await client.call("GET", "/api/tasks", ["tasks-query"], void 0, query);
+    output(envelope, status2, !!opts.json);
+  });
+  tasks.command("claim").description("Claim the next open task (POST /api/tasks/claim)").option("--feature <slug>", "Filter by feature").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--json", "Output raw JSON envelope").action(async (opts) => {
+    const client = makeClient(opts);
+    const body = opts.feature ? { filter: { feature: opts.feature } } : {};
+    const { status: status2, envelope } = await client.call("POST", "/api/tasks/claim", ["tasks-claim"], body);
+    output(envelope, status2, !!opts.json);
+  });
+  tasks.command("heartbeat <task-id>").description("Heartbeat an active claim (POST /api/tasks/:id/heartbeat)").requiredOption("--creator-node-id <uuid>", "Task creator olam node ID").requiredOption("--claim-token <token>", "Claim token from `olam tasks claim`").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--json", "Output raw JSON envelope").action(async (taskId, opts) => {
+    const client = makeClient(opts);
+    const body = { creatorOlamNodeId: opts.creatorNodeId, claimToken: opts.claimToken };
+    const { status: status2, envelope } = await client.call("POST", `/api/tasks/${taskId}/heartbeat`, ["tasks-state-update"], body);
+    output(envelope, status2, !!opts.json);
+  });
+  tasks.command("done <task-id>").description("Complete a claimed task (POST /api/tasks/:id/complete)").requiredOption("--creator-node-id <uuid>", "Task creator olam node ID").requiredOption("--claim-token <token>", "Claim token from `olam tasks claim`").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--json", "Output raw JSON envelope").action(async (taskId, opts) => {
+    const client = makeClient(opts);
+    const body = { creatorOlamNodeId: opts.creatorNodeId, claimToken: opts.claimToken };
+    const { status: status2, envelope } = await client.call("POST", `/api/tasks/${taskId}/complete`, ["tasks-state-update"], body);
+    output(envelope, status2, !!opts.json);
+  });
+  tasks.command("update <task-id>").description("Update task fields (POST /api/tasks/:id/update)").requiredOption("--creator-node-id <uuid>", "Task creator olam node ID").option("--priority <n>", "New priority 0-10", (v) => parseInt(v, 10)).option("--feature <slug>", "New feature slug").option("--phase <letter>", "New phase letter").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--json", "Output raw JSON envelope").action(async (taskId, opts) => {
+    const client = makeClient(opts);
+    const body = { creatorOlamNodeId: opts.creatorNodeId };
+    if (opts.priority !== void 0)
+      body.priority = opts.priority;
+    if (opts.feature)
+      body.feature = opts.feature;
+    if (opts.phase)
+      body.phase = opts.phase;
+    const { status: status2, envelope } = await client.call("POST", `/api/tasks/${taskId}/update`, ["tasks-state-update"], body);
+    output(envelope, status2, !!opts.json);
+  });
+  tasks.command("pickup").description("B2.5 execute-workflow convenience: claim next + emit parseable claim-token + creator-node-id for downstream heartbeat/done").option("--feature <slug>", "Filter to a specific feature").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--json", "Output raw JSON envelope").action(async (opts) => {
+    const client = makeClient(opts);
+    const body = opts.feature ? { filter: { feature: opts.feature } } : {};
+    const { status: status2, envelope } = await client.call("POST", "/api/tasks/claim", ["tasks-claim"], body);
+    if (status2 !== 200 || !envelope.success || !envelope.data) {
+      output(envelope, status2, !!opts.json);
+      return;
+    }
+    const task = envelope.data;
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ status: status2, envelope, exports: { OLAM_TASK_ID: task.id, OLAM_TASK_CREATOR: task.creatorOlamNodeId } }, null, 2) + "\n");
+    } else {
+      process.stdout.write(`# olam tasks pickup: claimed ${task.id}
+`);
+      process.stdout.write(`export OLAM_TASK_ID="${task.id}"
+`);
+      process.stdout.write(`export OLAM_TASK_CREATOR="${task.creatorOlamNodeId}"
+`);
+      process.stdout.write(`# eval "$(olam tasks pickup --feature B2)"  # exports vars; downstream uses them for heartbeat / done
+`);
+    }
+  });
+  tasks.command("sync-tracker <path>").description("Parse /10x:commit-plan tracker.md + upsert each task via POST /api/tasks (B2.4; dual-emit pattern, olam-side per cross-ownership decoupling)").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--dry-run", "Parse + print task records; do not POST").option("--json", "Output raw JSON envelope").action(async (path91, opts) => {
+    const parsed = parseTracker(path91);
+    if (opts.dryRun) {
+      process.stdout.write(JSON.stringify(parsed, null, 2) + "\n");
+      return;
+    }
+    const client = makeClient(opts);
+    const results = [];
+    for (const task of parsed.tasks) {
+      const body = {
+        title: task.title,
+        feature: task.feature ?? void 0,
+        phase: task.phase ?? void 0
+      };
+      const { status: status2, envelope } = await client.call("POST", "/api/tasks", ["tasks-create"], body);
+      results.push({ rawId: task.rawId, taskId: task.taskId, status: status2, success: envelope.success, error: envelope.error });
+    }
+    output({ total: parsed.tasks.length, results }, 200, !!opts.json);
+  });
+  tasks.command("distill").description("Cross-cutting distillation query (GET /api/tasks/distill) \u2014 B2.7 scope").option("--query <name>", "Query name (per-phase-complexity-drift | contested-tasks | prior-art-pull)").option("--corpus <type>", "local | team", "local").option("--keyword <str>", "Keyword for prior-art-pull").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--json", "Output raw JSON envelope").action(async (opts) => {
+    const client = makeClient(opts);
+    const query = { query: opts.query, corpus: opts.corpus, keyword: opts.keyword };
+    const scopes = opts.corpus === "team" ? ["tasks-query"] : ["tasks-query"];
+    const { status: status2, envelope } = await client.call("GET", "/api/tasks/distill", scopes, void 0, query);
+    output(envelope, status2, !!opts.json);
+  });
+}
+
 // src/lib/completion-generator.ts
 var UnsupportedShellError = class extends Error {
   constructor(shell) {
@@ -34091,8 +34438,8 @@ function registerCompletion(program2) {
   ).argument("<shell>", "zsh | bash").action((shell) => {
     const tree = program2.parent ?? program2;
     try {
-      const output = generateCompletion(tree, shell);
-      process.stdout.write(output);
+      const output2 = generateCompletion(tree, shell);
+      process.stdout.write(output2);
     } catch (err) {
       if (err instanceof UnsupportedShellError) {
         process.stderr.write(`${err.message}
@@ -34109,20 +34456,20 @@ function registerCompletion(program2) {
 init_cli_version();
 init_health_probes();
 import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync79 } from "node:fs";
-import { homedir as homedir41 } from "node:os";
+import { existsSync as existsSync80 } from "node:fs";
+import { homedir as homedir42 } from "node:os";
 import path72 from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // src/lib/shell-rc.ts
-import { copyFileSync as copyFileSync5, existsSync as existsSync59, readFileSync as readFileSync45, renameSync as renameSync7, writeFileSync as writeFileSync28 } from "node:fs";
+import { copyFileSync as copyFileSync5, existsSync as existsSync59, readFileSync as readFileSync47, renameSync as renameSync8, writeFileSync as writeFileSync28 } from "node:fs";
 import path52 from "node:path";
 function appendIdempotent(opts) {
   const { rcPath, marker, contentLine, clock = () => /* @__PURE__ */ new Date() } = opts;
   if (!existsSync59(rcPath)) {
     return { status: "no-rc-file", backupPath: null };
   }
-  const content = readFileSync45(rcPath, "utf-8");
+  const content = readFileSync47(rcPath, "utf-8");
   if (content.includes(marker)) {
     return { status: "already-present", backupPath: null };
   }
@@ -34134,7 +34481,7 @@ function appendIdempotent(opts) {
   const nextContent = `${content}${separator}${contentLine}${trailing}`;
   const tmpPath = `${rcPath}.olam-tmp.${process.pid}`;
   writeFileSync28(tmpPath, nextContent, { encoding: "utf-8" });
-  renameSync7(tmpPath, rcPath);
+  renameSync8(tmpPath, rcPath);
   return { status: "appended", backupPath };
 }
 function resolveShellRc(home, shellEnv) {
@@ -34300,7 +34647,7 @@ async function pickSkillSourcePhase(opts, deps) {
 }
 
 // src/commands/setup-phase-5b-project-sweep.ts
-import { homedir as homedir40 } from "node:os";
+import { homedir as homedir41 } from "node:os";
 import * as path71 from "node:path";
 import * as fs71 from "node:fs";
 async function loadWalkFn() {
@@ -34333,7 +34680,7 @@ async function runProjectSweepPhase(opts, deps, sweepDeps = {}) {
   if (opts.skipProjectSweep) {
     return { ok: true, skipped: true, message: "skipped via --skip-project-sweep" };
   }
-  const home = deps.home ?? homedir40();
+  const home = deps.home ?? homedir41();
   const projectsRoot = opts.projects ?? path71.join(home, "Projects");
   const existsSyncFn = sweepDeps.existsSync ?? fs71.existsSync;
   if (!existsSyncFn(projectsRoot)) {
@@ -34532,7 +34879,7 @@ async function phase4ShellInit(opts, deps) {
   if (opts.skipShellInit) {
     return { ok: true, skipped: true, message: "skipped via --skip-shell-init" };
   }
-  const home = deps.home ?? homedir41();
+  const home = deps.home ?? homedir42();
   const shellEnv = deps.shellEnv ?? process.env.SHELL;
   const rcPath = resolveShellRc(home, shellEnv);
   if (rcPath === null) {
@@ -34569,7 +34916,7 @@ async function phase5InitProject(opts, deps) {
   const cwd = deps.cwd ?? process.cwd();
   const projectRoot = findProjectRoot(cwd);
   const configPath = path72.join(projectRoot, ".olam", "config.yaml");
-  if (existsSync79(configPath)) {
+  if (existsSync80(configPath)) {
     return { ok: true, message: `${configPath} present (no change)` };
   }
   const promptFn = deps.prompt ?? defaultPrompt;
@@ -37524,7 +37871,7 @@ function registerWorldUpgrade(program2) {
 
 // src/commands/mcp/serve.ts
 init_output();
-import { existsSync as existsSync91 } from "node:fs";
+import { existsSync as existsSync92 } from "node:fs";
 import { dirname as dirname52, resolve as resolve22 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var here = dirname52(fileURLToPath7(import.meta.url));
@@ -37534,7 +37881,7 @@ var BUNDLE_PATH_CANDIDATES = [
   // dev / tsc-only (`dist/commands/mcp/serve.js`) — up two levels
   resolve22(here, "..", "..", "mcp-server.js")
 ];
-function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync91) {
+function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = existsSync92) {
   return candidates2.find(exists) ?? null;
 }
 var MISSING_BUNDLE_REMEDY = "olam mcp server bundle missing. Searched: " + BUNDLE_PATH_CANDIDATES.join(", ") + ". For local dev, run: node packages/cli/scripts/bundle-mcp-server.mjs. A fresh `npm install -g @pleri/olam-cli@latest` should always include the bundle (see prepublishOnly in packages/cli/package.json); file an issue if it does not.";
@@ -37556,9 +37903,9 @@ function registerMcpServe(cmd) {
 init_output();
 
 // src/commands/mcp/install-shared.ts
-import { spawnSync as spawnSync25 } from "node:child_process";
+import { spawnSync as spawnSync26 } from "node:child_process";
 var DEFAULT_CLAUDE_SHELL_DEPS = {
-  spawn: spawnSync25,
+  spawn: spawnSync26,
   log: (msg) => console.log(msg)
 };
 function isOnPath(deps, bin) {
@@ -38275,27 +38622,27 @@ function registerMcp(program2) {
 init_output();
 
 // src/lib/memory-host-process-migration.ts
-import { existsSync as existsSync93, readFileSync as readFileSync71, unlinkSync as unlinkSync23 } from "node:fs";
-import { spawnSync as spawnSync26 } from "node:child_process";
+import { existsSync as existsSync94, readFileSync as readFileSync73, unlinkSync as unlinkSync23 } from "node:fs";
+import { spawnSync as spawnSync27 } from "node:child_process";
 
 // src/commands/memory/_paths.ts
-import { homedir as homedir46 } from "node:os";
-import { join as join86, dirname as dirname53 } from "node:path";
+import { homedir as homedir47 } from "node:os";
+import { join as join87, dirname as dirname53 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
-var OLAM_HOME3 = join86(homedir46(), ".olam");
-var MEMORY_PID_PATH = join86(OLAM_HOME3, "memory.pid");
-var MEMORY_LOG_PATH = join86(OLAM_HOME3, "memory-service.log");
-var MEMORY_DATA_DIR = join86(OLAM_HOME3, "memory-data");
+var OLAM_HOME3 = join87(homedir47(), ".olam");
+var MEMORY_PID_PATH = join87(OLAM_HOME3, "memory.pid");
+var MEMORY_LOG_PATH = join87(OLAM_HOME3, "memory-service.log");
+var MEMORY_DATA_DIR = join87(OLAM_HOME3, "memory-data");
 var MEMORY_REST_PORT = 3111;
 var MEMORY_LIVEZ_URL = `http://localhost:${MEMORY_REST_PORT}/agentmemory/livez`;
 var here2 = dirname53(fileURLToPath8(import.meta.url));
 var candidates = [
   // 1. Workspace dev (built): packages/cli/dist/commands/memory/_paths.js → packages/cli → packages/memory-service
-  join86(here2, "..", "..", "..", "..", "memory-service"),
+  join87(here2, "..", "..", "..", "..", "memory-service"),
   // 2. Workspace bundled: packages/cli/dist/index.js → packages/cli → packages/memory-service
-  join86(here2, "..", "..", "memory-service"),
+  join87(here2, "..", "..", "memory-service"),
   // 3. CWD fallback
-  join86(process.cwd(), "packages", "memory-service")
+  join87(process.cwd(), "packages", "memory-service")
 ];
 var MEMORY_SERVICE_CANDIDATES = candidates;
 
@@ -38304,8 +38651,8 @@ var KILL_TIMEOUT_MS = 5e3;
 function migrateFromHostProcess(opts = {}) {
   const pidPath2 = opts.pidPath ?? MEMORY_PID_PATH;
   const logPath = opts.logPath ?? MEMORY_LOG_PATH;
-  const pidfileExists = existsSync93(pidPath2);
-  const logExists = existsSync93(logPath);
+  const pidfileExists = existsSync94(pidPath2);
+  const logExists = existsSync94(logPath);
   if (!pidfileExists && !logExists) {
     return { cleaned: false, summary: "no legacy host-process state to clean" };
   }
@@ -38344,7 +38691,7 @@ function migrateFromHostProcess(opts = {}) {
 }
 function readPidFromFile(pidPath2) {
   try {
-    const raw = readFileSync71(pidPath2, "utf8").trim();
+    const raw = readFileSync73(pidPath2, "utf8").trim();
     const pid = parseInt(raw, 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
@@ -38361,7 +38708,7 @@ function isProcessAlive(pid) {
   }
 }
 function processCommName(pid) {
-  const r = spawnSync26("ps", ["-p", String(pid), "-o", "comm="], { encoding: "utf-8" });
+  const r = spawnSync27("ps", ["-p", String(pid), "-o", "comm="], { encoding: "utf-8" });
   if (r.status !== 0) return null;
   const comm = r.stdout.trim();
   return comm.split("/").pop() ?? null;
@@ -38375,7 +38722,7 @@ function terminateProcess(pid) {
   const deadline = Date.now() + KILL_TIMEOUT_MS;
   while (Date.now() < deadline) {
     if (!isProcessAlive(pid)) return true;
-    spawnSync26("sleep", ["0.1"]);
+    spawnSync27("sleep", ["0.1"]);
   }
   try {
     process.kill(pid, "SIGKILL");
@@ -38472,7 +38819,7 @@ function registerMemoryStop(cmd) {
 
 // src/commands/memory/status.ts
 init_output();
-import { existsSync as existsSync94 } from "node:fs";
+import { existsSync as existsSync95 } from "node:fs";
 async function probe(secret) {
   try {
     const headers = {};
@@ -38497,7 +38844,7 @@ async function collectMemoryStatus() {
     livez,
     secretSet: hasMemorySecret(),
     port: MEMORY_REST_PORT,
-    legacyPidfilePresent: existsSync94(MEMORY_PID_PATH)
+    legacyPidfilePresent: existsSync95(MEMORY_PID_PATH)
   };
 }
 async function runMemoryStatus(opts = {}) {
@@ -38580,7 +38927,7 @@ function registerMemoryLogs(cmd) {
 }
 
 // src/commands/memory/secret.ts
-import { existsSync as existsSync95 } from "node:fs";
+import { existsSync as existsSync96 } from "node:fs";
 init_output();
 async function runMemorySecretShow() {
   if (!hasMemorySecret()) {
@@ -38595,7 +38942,7 @@ async function runMemorySecretShow() {
 }
 async function runMemorySecretRotate() {
   printHeader("olam memory secret rotate");
-  const wasRunning = existsSync95(MEMORY_PID_PATH);
+  const wasRunning = existsSync96(MEMORY_PID_PATH);
   if (wasRunning) {
     printInfo("current state", "service running; will restart with new secret");
     const stopRc = await runMemoryStop();
@@ -38777,14 +39124,14 @@ function registerMemoryUninstall(cmd) {
 // src/commands/memory/mode.ts
 init_schema2();
 init_output();
-import { existsSync as existsSync96, readFileSync as readFileSync72, writeFileSync as writeFileSync45 } from "node:fs";
-import { join as join87 } from "node:path";
+import { existsSync as existsSync97, readFileSync as readFileSync74, writeFileSync as writeFileSync45 } from "node:fs";
+import { join as join88 } from "node:path";
 import * as readline6 from "node:readline/promises";
 import { parse as parseYaml7, stringify as stringifyYaml6 } from "yaml";
 var CONFIG_REL = ".olam/config.yaml";
 function locateConfig(cwd) {
-  const absPath = join87(cwd, CONFIG_REL);
-  if (!existsSync96(absPath)) {
+  const absPath = join88(cwd, CONFIG_REL);
+  if (!existsSync97(absPath)) {
     throw new Error(
       `No ${CONFIG_REL} at ${cwd}. Run \`olam init\` in your workspace root first.`
     );
@@ -38792,7 +39139,7 @@ function locateConfig(cwd) {
   return { absPath };
 }
 function readConfigYaml(absPath) {
-  const raw = readFileSync72(absPath, "utf-8");
+  const raw = readFileSync74(absPath, "utf-8");
   const parsed = parseYaml7(raw) ?? {};
   if (typeof parsed !== "object" || parsed === null) {
     throw new Error(`${absPath} is not a YAML object`);
@@ -38920,20 +39267,20 @@ function registerMemoryMode(cmd) {
 // src/commands/memory/bridge.ts
 init_output();
 import { spawn as spawn11 } from "node:child_process";
-import { existsSync as existsSync97 } from "node:fs";
-import { join as join88 } from "node:path";
+import { existsSync as existsSync98 } from "node:fs";
+import { join as join89 } from "node:path";
 var DEFAULT_PORT2 = 8788;
 function resolveMemoryServiceDir() {
   for (const c of MEMORY_SERVICE_CANDIDATES) {
-    if (existsSync97(c)) return c;
+    if (existsSync98(c)) return c;
   }
   throw new Error(
     `Could not find packages/memory-service/. Searched: ${MEMORY_SERVICE_CANDIDATES.join(", ")}. If running from a published @pleri/olam-cli tarball, this is a packaging bug \u2014 please file an issue.`
   );
 }
 function resolveLocalBridgeScript(serviceDir) {
-  const path91 = join88(serviceDir, "scripts", "local-bridge-server.mjs");
-  if (!existsSync97(path91)) {
+  const path91 = join89(serviceDir, "scripts", "local-bridge-server.mjs");
+  if (!existsSync98(path91)) {
     throw new Error(
       `Could not find local-bridge-server.mjs at ${path91}. Verify packages/memory-service ships the scripts/ directory.`
     );
@@ -39394,10 +39741,10 @@ init_workspace_name();
 init_kg_caps();
 init_output();
 import fs85 from "node:fs";
-import { homedir as homedir47 } from "node:os";
+import { homedir as homedir48 } from "node:os";
 import path84 from "node:path";
 function olamHome4() {
-  return process.env.OLAM_HOME ?? path84.join(homedir47(), ".olam");
+  return process.env.OLAM_HOME ?? path84.join(homedir48(), ".olam");
 }
 function kgRoot2() {
   return path84.join(olamHome4(), "kg");
@@ -40507,16 +40854,16 @@ function registerKg(program2) {
 // src/commands/flywheel/emit-breadcrumb.ts
 init_file_lock();
 import { mkdirSync as mkdirSync57, appendFileSync as appendFileSync6 } from "node:fs";
-import { homedir as homedir51 } from "node:os";
-import { dirname as dirname56, join as join92 } from "node:path";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { homedir as homedir52 } from "node:os";
+import { dirname as dirname56, join as join93 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "low", "info", "warn"]);
 var PROMPT_FEEDING_FIELDS = ["extracted_pattern", "severity", "affected_persona", "proposed_edit"];
-var BREADCRUMBS_BASE = join92(homedir51(), ".local", "share", "claude", "breadcrumbs");
+var BREADCRUMBS_BASE = join93(homedir52(), ".local", "share", "claude", "breadcrumbs");
 var LOCK_FILENAME = ".flywheel-emit.lock";
 function buildRecord(opts) {
   const rec = {
-    breadcrumb_id: randomUUID2().replace(/-/g, ""),
+    breadcrumb_id: randomUUID3().replace(/-/g, ""),
     emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
     emitted_by_skill: opts.skill,
     pass_number: opts.pass !== void 0 ? Number.parseInt(opts.pass, 10) : 0,
@@ -40559,7 +40906,7 @@ function validatePromptFeeding(rec) {
 }
 function destPath(projectSlug) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  return join92(BREADCRUMBS_BASE, projectSlug, `${today}.jsonl`);
+  return join93(BREADCRUMBS_BASE, projectSlug, `${today}.jsonl`);
 }
 async function emitBreadcrumb(opts) {
   if (!VALID_SEVERITIES.has(opts.severity)) {
@@ -40660,7 +41007,7 @@ function registerFlywheelK5Score(parent) {
 }
 
 // src/commands/flywheel/k5-validate.ts
-import { readFileSync as readFileSync76, statSync as statSync23 } from "node:fs";
+import { readFileSync as readFileSync78, statSync as statSync24 } from "node:fs";
 import { parse as parseYAML } from "yaml";
 var K5_DIMS = ["direction", "approach", "open_questions", "constraints", "reuse"];
 var MAX_PLAN_BYTES = 1048576;
@@ -40721,7 +41068,7 @@ function validateK5ScoredAt(scoredAt) {
 function validatePlan(path91) {
   let stat;
   try {
-    stat = statSync23(path91);
+    stat = statSync24(path91);
   } catch (err) {
     return { ok: false, message: `FAIL cannot stat ${path91}: ${err instanceof Error ? err.message : "unknown"}` };
   }
@@ -40730,7 +41077,7 @@ function validatePlan(path91) {
   }
   let text;
   try {
-    text = readFileSync76(path91, "utf8");
+    text = readFileSync78(path91, "utf8");
   } catch (err) {
     return { ok: false, message: `FAIL cannot read ${path91}: ${err instanceof Error ? err.message : "unknown"}` };
   }
@@ -40855,8 +41202,8 @@ function registerFlywheelDiversityCheck(parent) {
 
 // src/commands/flywheel/ping.ts
 import { mkdirSync as mkdirSync58, writeFileSync as writeFileSync49 } from "node:fs";
-import { homedir as homedir52 } from "node:os";
-import { dirname as dirname57, join as join93 } from "node:path";
+import { homedir as homedir53 } from "node:os";
+import { dirname as dirname57, join as join94 } from "node:path";
 var COLD_START_BUDGET_GOOD_MS = 200;
 var COLD_START_BUDGET_FAIR_MS = 500;
 function classifyColdStart(coldStartMs) {
@@ -40872,7 +41219,7 @@ function readOlamVersion() {
   }
 }
 function writeBaseline(record) {
-  const baselinePath = join93(homedir52(), ".local", "share", "olam", "flywheel-baseline.json");
+  const baselinePath = join94(homedir53(), ".local", "share", "olam", "flywheel-baseline.json");
   mkdirSync58(dirname57(baselinePath), { recursive: true });
   writeFileSync49(baselinePath, JSON.stringify(record, null, 2) + "\n", "utf8");
   return baselinePath;
@@ -40936,7 +41283,7 @@ function registerFlywheel(program2) {
 
 // src/commands/seed.ts
 init_output();
-import { spawnSync as spawnSync27, spawn as spawnAsync2 } from "node:child_process";
+import { spawnSync as spawnSync28, spawn as spawnAsync2 } from "node:child_process";
 var DEFAULT_SINGLETON_CONTAINER = "olam-postgres";
 var DEFAULT_SINGLETON_USER = "development";
 function assertValidSeedName(name) {
@@ -40947,7 +41294,7 @@ function assertValidSeedName(name) {
   }
 }
 function singletonDocker(container, user, args, stdin) {
-  return spawnSync27(
+  return spawnSync28(
     "docker",
     ["exec", "-i", container, "psql", "-U", user, ...args],
     { encoding: "utf-8", input: stdin }
@@ -41002,7 +41349,7 @@ async function handleBake(opts) {
   if (sources.length > 1) {
     throw new Error("multiple sources specified \u2014 pass exactly one of --source-container, --source-url, --source-local");
   }
-  const ping = spawnSync27("docker", ["inspect", "--format", "{{.State.Status}}", singleton], { encoding: "utf-8" });
+  const ping = spawnSync28("docker", ["inspect", "--format", "{{.State.Status}}", singleton], { encoding: "utf-8" });
   if (ping.status !== 0 || (ping.stdout || "").trim() !== "running") {
     throw new Error(`singleton container "${singleton}" not running \u2014 run \`olam bootstrap\` first`);
   }
@@ -41391,6 +41738,8 @@ registerBootstrap(program);
 registerDiagnose(program);
 registerDoctor(program);
 registerSubstrate(program);
+registerTasks(program);
+registerWorkers(program);
 registerCompletion(program);
 registerSetup(program);
 registerSetupMetrics(program);