@pleri/olam-cli 0.1.159 → 0.1.160

package/dist/mcp-server.js

@@ -445,8 +445,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path46, errorMaps, issueData } = params;
-      const fullPath = [...path46, ...issueData.path || []];
+      const { data, path: path48, errorMaps, issueData } = params;
+      const fullPath = [...path48, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -754,11 +754,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path46, key) {
+      constructor(parent, value, path48, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path46;
+        this._path = path48;
         this._key = key;
       }
       get path() {
@@ -7090,7 +7090,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve13.call(this, root, ref);
+      let _sch = resolve14.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -7117,7 +7117,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve13(root, ref) {
+    function resolve14(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -7332,8 +7332,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path46) {
-      let input = path46;
+    function removeDotSegments(path48) {
+      let input = path48;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -7532,8 +7532,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path46, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path46 && path46 !== "/" ? path46 : void 0;
+        const [path48, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path48 && path48 !== "/" ? path48 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -7692,55 +7692,55 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve13(baseURI, relativeURI, options) {
+    function resolve14(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative3, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse4(serialize(base, options), options);
-        relative3 = parse4(serialize(relative3, options), options);
+        relative5 = parse4(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative3.scheme) {
-        target.scheme = relative3.scheme;
-        target.userinfo = relative3.userinfo;
-        target.host = relative3.host;
-        target.port = relative3.port;
-        target.path = removeDotSegments(relative3.path || "");
-        target.query = relative3.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
-          target.userinfo = relative3.userinfo;
-          target.host = relative3.host;
-          target.port = relative3.port;
-          target.path = removeDotSegments(relative3.path || "");
-          target.query = relative3.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative3.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative3.query !== void 0) {
-              target.query = relative3.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative3.path[0] === "/") {
-              target.path = removeDotSegments(relative3.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative3.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative3.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative3.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -7748,7 +7748,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative3.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -7919,7 +7919,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve13,
+      resolve: resolve14,
       resolveComponent,
       equal,
       serialize,
@@ -10895,12 +10895,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs46, exportName) {
+    function addFormats(ajv, list, fs48, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs46[f]);
+        ajv.addFormat(f, fs48[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -11008,7 +11008,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path46, ctx, rejectSource) {
+function refineForbiddenKeys(value, path48, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -11016,12 +11016,12 @@ function refineForbiddenKeys(value, path46, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path46, key],
+        path: [...path48, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path46.length === 0 && key === "source") {
+    if (rejectSource && path48.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -11029,21 +11029,21 @@ function refineForbiddenKeys(value, path46, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path46, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path48, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path46, rejectSource) {
+function rejectForbiddenKeys(value, path48, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path46}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path48}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path46}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path48}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path46}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path48}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -12462,6 +12462,9 @@ function listSkillSources() {
 function getSkillSource(id) {
   return readGlobalConfig().skillSources.find((s) => s.id === id);
 }
+function getSkillSourceByName(name) {
+  return readGlobalConfig().skillSources.find((s) => s.name === name) ?? null;
+}
 function addSkillSource(entry) {
   const config2 = readGlobalConfig();
   const id = deriveSkillSourceId(entry.gitUrl);
@@ -13184,6 +13187,26 @@ function resolveJsonDir(opts) {
   }
   return out;
 }
+function resolveOverlaysDir(opts) {
+  const { sourceId, baseDir, targetKind } = opts;
+  const out = [];
+  for (const name of listDirSafe(baseDir)) {
+    if (!name.endsWith(".md"))
+      continue;
+    const full = path20.join(baseDir, name);
+    if (!fs19.statSync(full).isFile())
+      continue;
+    const deployBasename = name.replace(/\.md$/, "");
+    out.push({
+      kind: "overlay",
+      sourceId,
+      sourcePath: full,
+      deployBasename,
+      targetKind
+    });
+  }
+  return out;
+}
 function resolveSourceArtifacts(opts) {
   const { sourceId, clonePath, atlasUser } = opts;
   const subscription = resolveSubscriptions({ clonePath, atlasUser });
@@ -13208,6 +13231,16 @@ function resolveSourceArtifacts(opts) {
       artifacts.push(...resolveRulesDir({ sourceId, baseDir: path20.join(memberRoot, "rules") }));
       artifacts.push(...resolveJsonDir({ sourceId, baseDir: path20.join(memberRoot, "hooks"), kind: "hook" }));
       artifacts.push(...resolveJsonDir({ sourceId, baseDir: path20.join(memberRoot, "permissions"), kind: "permission" }));
+      artifacts.push(...resolveOverlaysDir({
+        sourceId,
+        baseDir: path20.join(memberRoot, "skills.overrides"),
+        targetKind: "skill"
+      }));
+      artifacts.push(...resolveOverlaysDir({
+        sourceId,
+        baseDir: path20.join(memberRoot, "agents.overrides"),
+        targetKind: "agent"
+      }));
     }
   }
   return { subscription, artifacts };
@@ -13218,6 +13251,57 @@ var init_artifact_resolver = __esm({
   }
 });
 
+// ../core/dist/lib/shim-targets.js
+function lookupShimTarget(basename6) {
+  return SHIM_TARGETS.find((t) => t.basename === basename6);
+}
+function compareSemver(installed, required2) {
+  const norm = (s) => {
+    const clean = s.replace(/^v/, "").split(/[-+]/)[0] ?? "0";
+    const parts = clean.split(".").map((p) => Number.parseInt(p, 10) || 0);
+    while (parts.length < 3)
+      parts.push(0);
+    return parts.slice(0, 3);
+  };
+  const i = norm(installed);
+  const r = norm(required2);
+  for (let idx = 0; idx < 3; idx++) {
+    const diff = (i[idx] ?? 0) - (r[idx] ?? 0);
+    if (diff !== 0)
+      return diff;
+  }
+  return 0;
+}
+function checkShimRemoval(basename6, installedOlamVersion) {
+  const target = lookupShimTarget(basename6);
+  if (target === void 0)
+    return null;
+  return {
+    basename: target.basename,
+    replacedBy: target.replacedBy,
+    installedOlamVersion,
+    minOlamVersion: target.minOlamVersion,
+    safeToRemove: compareSemver(installedOlamVersion, target.minOlamVersion) >= 0
+  };
+}
+var SHIM_TARGETS;
+var init_shim_targets = __esm({
+  "../core/dist/lib/shim-targets.js"() {
+    "use strict";
+    SHIM_TARGETS = Object.freeze([
+      { basename: "emit-breadcrumb.sh", minOlamVersion: "0.2.0", replacedBy: "olam flywheel emit-breadcrumb" },
+      { basename: "emit-breadcrumb.py", minOlamVersion: "0.2.0", replacedBy: "olam flywheel emit-breadcrumb" },
+      { basename: "sanitize-persona-output.py", minOlamVersion: "0.2.0", replacedBy: "olam flywheel sanitize-persona-output" },
+      { basename: "check-persona-skeleton.py", minOlamVersion: "0.2.0", replacedBy: "olam flywheel check-persona-skeleton" },
+      { basename: "k5-rubric-helper.py", minOlamVersion: "0.2.0", replacedBy: "olam flywheel k5-validate" },
+      { basename: "k10_budget.py", minOlamVersion: "0.2.0", replacedBy: "olam flywheel k10-measure" },
+      { basename: "diversity_check.py", minOlamVersion: "0.2.0", replacedBy: "olam flywheel diversity-check" },
+      { basename: "apply-overlays.py", minOlamVersion: "0.2.0", replacedBy: "olam skills apply-overlays" },
+      { basename: "sync-with-overlays.sh", minOlamVersion: "0.2.0", replacedBy: "olam skills sync --with-overlays" }
+    ]);
+  }
+});
+
 // ../core/dist/skill-sync/symlink-deployer.js
 import * as fs20 from "node:fs";
 import * as os13 from "node:os";
@@ -13243,6 +13327,9 @@ function bucketFor(kind) {
     case "hook":
     case "permission":
       return void 0;
+    // handled by settings-merger
+    case "overlay":
+      return void 0;
   }
 }
 function detectCollisions(artifacts) {
@@ -13280,22 +13367,48 @@ function detectCollisions(artifacts) {
   }
   return { winners, collisions };
 }
-function cleanManagedSymlinks(claude) {
+function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences) {
+  const shadowBackups = [];
   for (const bucket of BUCKETS) {
     const dir = path21.join(claude, bucket);
     if (!fs20.existsSync(dir))
       continue;
     for (const name of fs20.readdirSync(dir)) {
+      if (name === ".olam-merged")
+        continue;
       const p = path21.join(dir, name);
       try {
         const stat = fs20.lstatSync(p);
         if (stat.isSymbolicLink()) {
+          if (bucket === "scripts" && overlayReferences !== void 0) {
+            const refs = overlayReferences.get(name);
+            if (refs !== void 0 && refs.length > 0 && checkShimRemoval(name, "0.0.0") !== null) {
+              const firstRef = refs[0];
+              const extraCount = refs.length - 1;
+              const refDisplay = extraCount > 0 ? `${firstRef} (+${extraCount} more)` : firstRef;
+              const nameNoExt = name.replace(/\.[^.]+$/, "");
+              process.stderr.write(`[shim-preserved] ~/.claude/scripts/${name} \u2014 referenced by overlay ${refDisplay}; run \`olam flywheel migrate-overlays\` to update the overlay path, then \`olam flywheel ${nameNoExt}\` to install the replacement.
+`);
+              continue;
+            }
+          }
+          if (bucket === "scripts" && installedOlamVersion !== void 0) {
+            const check = checkShimRemoval(name, installedOlamVersion);
+            if (check !== null && !check.safeToRemove) {
+              process.stderr.write(`[shim-removal-warn] ~/.claude/scripts/${name} is being removed but operator olam ${check.installedOlamVersion} < flywheel min ${check.minOlamVersion}. After atlas-toolbox stops shipping this script, chain skills hardcoding the path will break. Upgrade to olam \u2265${check.minOlamVersion} + run \`olam flywheel install-shims\` to install the replacement (${check.replacedBy}).
+`);
+            }
+          }
           fs20.unlinkSync(p);
+        } else if (bucket === "agents" && stat.isFile() && !name.includes(".shadow-backup-")) {
+          const backup = shadowBackup(p);
+          shadowBackups.push(backup);
         }
       } catch {
       }
     }
   }
+  return shadowBackups;
 }
 function shadowBackup(link) {
   const epoch = Math.floor(Date.now() / 1e3);
@@ -13324,19 +13437,26 @@ function linkIfNeeded(target, link) {
   fs20.symlinkSync(target, link);
   return { created: true, shadowBackup: backup };
 }
-function deployArtifacts(artifacts) {
+function deployArtifacts(artifacts, opts) {
   const claude = claudeDir();
   for (const bucket of BUCKETS) {
     fs20.mkdirSync(path21.join(claude, bucket), { recursive: true });
   }
-  cleanManagedSymlinks(claude);
+  const sweepShadowBackups = cleanManagedSymlinks(claude, opts?.installedOlamVersion, opts?.overlayReferences);
   const { winners, collisions } = detectCollisions(artifacts);
-  const result = { linked: 0, shadowBackups: [], collisions };
+  const result = { linked: 0, shadowBackups: [...sweepShadowBackups], collisions };
   for (const artifact of winners) {
     const bucket = bucketFor(artifact.kind);
     if (!bucket)
       continue;
     const linkPath = path21.join(claude, bucket, artifact.deployBasename);
+    if (artifact.kind === "agent" && artifact.resolvedContent !== void 0) {
+      const tmpPath = `${linkPath}.tmp-${process.pid}-${Date.now()}`;
+      fs20.writeFileSync(tmpPath, artifact.resolvedContent);
+      fs20.renameSync(tmpPath, linkPath);
+      result.linked += 1;
+      continue;
+    }
     const { created, shadowBackup: backup } = linkIfNeeded(artifact.sourcePath, linkPath);
     if (created)
       result.linked += 1;
@@ -13349,6 +13469,7 @@ var BUCKETS;
 var init_symlink_deployer = __esm({
   "../core/dist/skill-sync/symlink-deployer.js"() {
     "use strict";
+    init_shim_targets();
     BUCKETS = ["commands", "agents", "skills", "scripts", "rules"];
   }
 });
@@ -13817,7 +13938,7 @@ function defaultIsPidAlive(pid) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 function readLockMeta(lockPath) {
   try {
@@ -13931,13 +14052,179 @@ var init_file_lock = __esm({
   }
 });
 
-// ../core/dist/skill-sync/settings-json-lock.js
+// ../core/dist/lib/min-version-filter.js
+import { existsSync as existsSync27, readFileSync as readFileSync23 } from "node:fs";
+function readOlamMinVersion(filepath) {
+  if (!existsSync27(filepath))
+    return void 0;
+  let text;
+  try {
+    text = readFileSync23(filepath, "utf8");
+  } catch {
+    return void 0;
+  }
+  const match = FM_RE.exec(text);
+  if (match === null)
+    return void 0;
+  const fmText = match[1] ?? "";
+  for (const rawLine of fmText.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#"))
+      continue;
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1)
+      continue;
+    const key = line.slice(0, colonIdx).trim();
+    if (key !== "olam-min-version")
+      continue;
+    const value = line.slice(colonIdx + 1).trim().replace(/^['"]|['"]$/g, "");
+    if (value === "" || !/^v?\d+(\.\d+)*/.test(value))
+      return void 0;
+    return value;
+  }
+  return void 0;
+}
+function filterArtifactsByMinVersion(artifacts, installedOlamVersion) {
+  const kept = [];
+  const dropped = [];
+  const warnings = [];
+  for (const artifact of artifacts) {
+    if (!artifact.sourcePath.endsWith(".md")) {
+      kept.push(artifact);
+      continue;
+    }
+    const required2 = readOlamMinVersion(artifact.sourcePath);
+    if (required2 === void 0) {
+      kept.push(artifact);
+      continue;
+    }
+    if (compareSemver(installedOlamVersion, required2) >= 0) {
+      kept.push(artifact);
+    } else {
+      dropped.push({ artifact, required: required2, installed: installedOlamVersion });
+      warnings.push(`[olam-min-version] dropping ${artifact.deployBasename}: requires olam \u2265${required2} but installed is ${installedOlamVersion}. Upgrade olam to deploy this skill.`);
+    }
+  }
+  return { kept, dropped, warnings };
+}
+var FM_RE;
+var init_min_version_filter = __esm({
+  "../core/dist/lib/min-version-filter.js"() {
+    "use strict";
+    init_shim_targets();
+    FM_RE = /^---\n([\s\S]*?)\n---\n?/;
+  }
+});
+
+// ../core/dist/skill-sync/overlay-scan.js
 import * as fs26 from "node:fs";
-import * as os16 from "node:os";
 import * as path25 from "node:path";
+function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
+  const result = /* @__PURE__ */ new Map();
+  if (!fs26.existsSync(overlayRoot)) {
+    return result;
+  }
+  if (basenames.length === 0) {
+    return result;
+  }
+  const mdFiles = [];
+  let overlayRootReal;
+  try {
+    overlayRootReal = fs26.realpathSync(overlayRoot);
+  } catch {
+    return result;
+  }
+  for (const subdir of OVERRIDE_SUBDIRS) {
+    const dir = path25.join(overlayRoot, subdir);
+    if (!fs26.existsSync(dir))
+      continue;
+    walkMarkdown(dir, mdFiles, caps.maxFiles);
+  }
+  let totalBytes = 0;
+  for (const filepath of mdFiles) {
+    let realFile;
+    try {
+      realFile = fs26.realpathSync(filepath);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT" || code === "EACCES")
+        continue;
+      throw err;
+    }
+    const rel = path25.relative(overlayRootReal, realFile);
+    if (rel.startsWith("..") || path25.isAbsolute(rel)) {
+      continue;
+    }
+    let content;
+    try {
+      const stat = fs26.statSync(filepath);
+      totalBytes += stat.size;
+      if (totalBytes > caps.maxTotalBytes) {
+        throw new Error(`[overlay-scan] aborted: overlay tree exceeds ${caps.maxTotalBytes} total bytes. Check OLAM_CLAUDE_DIR / overlay paths are correctly scoped.`);
+      }
+      content = fs26.readFileSync(filepath, "utf8");
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT" || code === "EACCES") {
+        continue;
+      }
+      throw err;
+    }
+    const relpath = path25.relative(overlayRoot, filepath).split(path25.sep).join("/");
+    for (const basename6 of basenames) {
+      if (content.includes(basename6)) {
+        const list = result.get(basename6) ?? [];
+        list.push(relpath);
+        result.set(basename6, list);
+      }
+    }
+  }
+  return result;
+}
+function walkMarkdown(dir, out, cap) {
+  let entries;
+  try {
+    entries = fs26.readdirSync(dir, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return;
+    throw err;
+  }
+  for (const entry of entries) {
+    if (out.length >= cap) {
+      throw new Error(`[overlay-scan] aborted: overlay tree contains > ${cap} markdown files. Check OLAM_CLAUDE_DIR / overlay paths are correctly scoped.`);
+    }
+    const full = path25.join(dir, entry.name);
+    if (entry.isSymbolicLink())
+      continue;
+    if (entry.isDirectory()) {
+      walkMarkdown(full, out, cap);
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      out.push(full);
+    }
+  }
+}
+var OVERRIDE_SUBDIRS, MAX_FILES, MAX_TOTAL_BYTES, DEFAULT_CAPS;
+var init_overlay_scan = __esm({
+  "../core/dist/skill-sync/overlay-scan.js"() {
+    "use strict";
+    OVERRIDE_SUBDIRS = ["skills.overrides", "agents.overrides"];
+    MAX_FILES = 5e3;
+    MAX_TOTAL_BYTES = 10 * 1024 * 1024;
+    DEFAULT_CAPS = {
+      maxFiles: MAX_FILES,
+      maxTotalBytes: MAX_TOTAL_BYTES
+    };
+  }
+});
+
+// ../core/dist/skill-sync/settings-json-lock.js
+import * as fs27 from "node:fs";
+import * as os16 from "node:os";
+import * as path26 from "node:path";
 function defaultSettingsJsonLockPath() {
-  const stateDir = process.env["OLAM_STATE_DIR"] ?? path25.join(os16.homedir(), ".olam", "state");
-  return path25.join(stateDir, SETTINGS_JSON_LOCK_FILENAME);
+  const stateDir = process.env["OLAM_STATE_DIR"] ?? path26.join(os16.homedir(), ".olam", "state");
+  return path26.join(stateDir, SETTINGS_JSON_LOCK_FILENAME);
 }
 function defaultIsPidAlive2(pid) {
   try {
@@ -13949,11 +14236,11 @@ function defaultIsPidAlive2(pid) {
   }
 }
 function sleep4(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 function readLockMeta2(lockPath) {
   try {
-    const raw = fs26.readFileSync(lockPath, "utf-8");
+    const raw = fs27.readFileSync(lockPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
       return parsed;
@@ -13976,12 +14263,12 @@ function isLockStale2(meta2, opts) {
 function tryAcquireOnce2(lockPath, meta2, opts) {
   for (let attempt = 0; attempt <= MAX_STEAL_ATTEMPTS; attempt += 1) {
     try {
-      fs26.mkdirSync(path25.dirname(lockPath), { recursive: true });
-      const fd = fs26.openSync(lockPath, "wx", 384);
+      fs27.mkdirSync(path26.dirname(lockPath), { recursive: true });
+      const fd = fs27.openSync(lockPath, "wx", 384);
       try {
-        fs26.writeSync(fd, JSON.stringify(meta2));
+        fs27.writeSync(fd, JSON.stringify(meta2));
       } finally {
-        fs26.closeSync(fd);
+        fs27.closeSync(fd);
       }
       return true;
     } catch (err) {
@@ -13999,9 +14286,9 @@ function tryAcquireOnce2(lockPath, meta2, opts) {
     }
     const victimPath = `${lockPath}.victim-${process.pid}-${attempt}-${Date.now()}`;
     try {
-      fs26.renameSync(lockPath, victimPath);
+      fs27.renameSync(lockPath, victimPath);
       try {
-        fs26.unlinkSync(victimPath);
+        fs27.unlinkSync(victimPath);
       } catch {
       }
     } catch (err) {
@@ -14033,7 +14320,7 @@ async function acquireSettingsJsonLock(options = {}) {
         lockPath,
         release: () => {
           try {
-            fs26.unlinkSync(lockPath);
+            fs27.unlinkSync(lockPath);
           } catch {
           }
         }
@@ -14136,14 +14423,14 @@ var init_services_status = __esm({
 
 // ../core/dist/skill-sources/meta-hooks-migration-snapshot.js
 import * as crypto5 from "node:crypto";
-import * as fs27 from "node:fs";
+import * as fs28 from "node:fs";
 import * as os17 from "node:os";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 function migrationSnapshotsDir2() {
   const override = process.env["OLAM_MIGRATION_SNAPSHOTS_DIR"];
   if (override && override.length > 0)
     return override;
-  return path26.join(os17.homedir(), ".olam", "state", "migration-snapshots");
+  return path27.join(os17.homedir(), ".olam", "state", "migration-snapshots");
 }
 function writeMetaHooksSnapshot(originalSettings) {
   const snapshot = {
@@ -14154,11 +14441,11 @@ function writeMetaHooksSnapshot(originalSettings) {
   };
   const validated = MetaHooksMigrationSnapshotSchema.parse(snapshot);
   const dir = migrationSnapshotsDir2();
-  fs27.mkdirSync(dir, { recursive: true });
+  fs28.mkdirSync(dir, { recursive: true });
   const stamp = validated.takenAt.replace(/[:.]/g, "-");
   const rand = crypto5.randomBytes(3).toString("hex");
-  const file = path26.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
-  fs27.writeFileSync(file, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
+  const file = path27.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
+  fs28.writeFileSync(file, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
   return file;
 }
 var META_HOOKS_SNAPSHOT_SCHEMA_VERSION, META_HOOKS_SNAPSHOT_PREFIX, SettingsLooseSchema, MetaHooksMigrationSnapshotSchema;
@@ -14389,17 +14676,206 @@ var init_meta_hook_injector = __esm({
   }
 });
 
+// ../core/dist/lib/markdown-merger.js
+import { createHash as createHash5 } from "node:crypto";
+import { readFileSync as readFileSync27, existsSync as existsSync30, statSync as statSync8 } from "node:fs";
+function parseFrontmatter(text) {
+  const match = FM_RE2.exec(text);
+  if (match === null)
+    return { fm: {}, body: text };
+  const fmText = match[1] ?? "";
+  const body = text.slice(match[0].length);
+  const fm = {};
+  for (const rawLine of fmText.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#"))
+      continue;
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1)
+      continue;
+    const key = line.slice(0, colonIdx).trim();
+    const value = line.slice(colonIdx + 1).trim();
+    fm[key] = value;
+  }
+  return { fm, body };
+}
+function serializeFrontmatter(fm) {
+  if (Object.keys(fm).length === 0)
+    return "";
+  const lines = ["---"];
+  for (const [k, v] of Object.entries(fm)) {
+    lines.push(`${k}: ${v}`);
+  }
+  lines.push("---");
+  return lines.join("\n") + "\n";
+}
+function parseSections(body) {
+  H2_RE.lastIndex = 0;
+  const parts = body.split(H2_RE);
+  const sections = [[null, parts[0] ?? ""]];
+  for (let i = 1; i < parts.length; i += 2) {
+    const heading = parts[i] ?? "";
+    const content = parts[i + 1] ?? "";
+    sections.push([heading, content]);
+  }
+  return sections;
+}
+function sectionsToBody(sections) {
+  const out = [];
+  for (const [heading, content] of sections) {
+    if (heading === null) {
+      out.push(content);
+    } else {
+      const current = out.join("");
+      if (current !== "" && !current.endsWith("\n\n")) {
+        if (current.endsWith("\n"))
+          out.push("\n");
+        else
+          out.push("\n\n");
+      }
+      out.push(heading + content);
+    }
+  }
+  return out.join("");
+}
+function mergeMarkdown(upstreamText, overlayText, labelForError, upstreamPath, overlayPath) {
+  const upstream = parseFrontmatter(upstreamText);
+  const overlay = parseFrontmatter(overlayText);
+  const upHasName = "name" in upstream.fm;
+  const ovHasName = "name" in overlay.fm;
+  if (upHasName !== ovHasName) {
+    return {
+      error: {
+        kind: "schema-mismatch",
+        reason: `[schema-mismatch] ${labelForError}: upstream ${upHasName ? "has" : "lacks"} \`name:\` in frontmatter but overlay ${ovHasName ? "has" : "lacks"} it.` + (upstreamPath !== void 0 ? `
+  upstream: ${upstreamPath}` : "") + (overlayPath !== void 0 ? `
+  overlay:  ${overlayPath}` : "")
+      }
+    };
+  }
+  const upstreamStartsFm = upstreamText.startsWith("---");
+  const overlayStartsFm = overlayText.startsWith("---");
+  if (upstreamStartsFm !== overlayStartsFm) {
+    return {
+      error: {
+        kind: "schema-mismatch",
+        reason: `[schema-mismatch] ${labelForError}: one file has YAML frontmatter, the other does not.` + (upstreamPath !== void 0 ? `
+  upstream: ${upstreamPath}` : "") + (overlayPath !== void 0 ? `
+  overlay:  ${overlayPath}` : "")
+      }
+    };
+  }
+  const mergedFm = { ...upstream.fm, ...overlay.fm };
+  const upSections = parseSections(upstream.body);
+  const ovSections = parseSections(overlay.body);
+  const ovByHeading = /* @__PURE__ */ new Map();
+  const ovHeadingsOrder = [];
+  for (const [heading, content] of ovSections) {
+    if (heading !== null) {
+      ovByHeading.set(heading, content);
+      ovHeadingsOrder.push(heading);
+    }
+  }
+  const mergedSections = [];
+  const upHeadingsSeen = /* @__PURE__ */ new Set();
+  for (const [heading, content] of upSections) {
+    if (heading === null) {
+      const preamble = content.trim() !== "" ? content : ovSections[0]?.[1] ?? content;
+      mergedSections.push([null, preamble]);
+    } else {
+      const overrideContent = ovByHeading.get(heading);
+      mergedSections.push([heading, overrideContent !== void 0 ? overrideContent : content]);
+      upHeadingsSeen.add(heading);
+    }
+  }
+  for (const heading of ovHeadingsOrder) {
+    if (!upHeadingsSeen.has(heading)) {
+      mergedSections.push([heading, ovByHeading.get(heading)]);
+    }
+  }
+  const mergedBody = sectionsToBody(mergedSections);
+  const fmBlock = serializeFrontmatter(mergedFm);
+  return { merged: fmBlock !== "" ? fmBlock + mergedBody : mergedBody };
+}
+function sha256OfPath(p) {
+  if (!existsSync30(p) || !statSync8(p).isFile())
+    return "MISSING";
+  return createHash5("sha256").update(readFileSync27(p)).digest("hex");
+}
+var FM_RE2, H2_RE;
+var init_markdown_merger = __esm({
+  "../core/dist/lib/markdown-merger.js"() {
+    "use strict";
+    FM_RE2 = /^---\n([\s\S]*?)\n---\n?/;
+    H2_RE = /^(## .+)$/gm;
+  }
+});
+
+// ../core/dist/skill-sync/managed-merge.js
+import * as fs29 from "node:fs";
+import * as path28 from "node:path";
+function materializeMergedSkill(opts) {
+  const { sourceId, sourcePath, deployBasename, mergedContent, claudeDir: claudeDir2 } = opts;
+  const managedDir = path28.join(claudeDir2, ".olam-merged", sourceId, deployBasename);
+  const sourceRoot = path28.resolve(path28.join(claudeDir2, ".olam-merged", sourceId));
+  const managedResolved = path28.resolve(managedDir);
+  if (!(managedResolved === sourceRoot || managedResolved.startsWith(sourceRoot + path28.sep))) {
+    throw new Error(`[managed-merge] refusing to materialize: deployBasename "${deployBasename}" escapes managed root "${sourceRoot}" (resolved to "${managedResolved}")`);
+  }
+  fs29.mkdirSync(managedDir, { recursive: true });
+  const skillMdPath = path28.join(managedDir, "SKILL.md");
+  const tmpPath = `${skillMdPath}.tmp-${process.pid}-${Date.now()}`;
+  fs29.writeFileSync(tmpPath, mergedContent);
+  fs29.renameSync(tmpPath, skillMdPath);
+  const baseEntries = fs29.readdirSync(sourcePath);
+  for (const entry of baseEntries) {
+    if (entry === "SKILL.md")
+      continue;
+    const linkPath = path28.join(managedDir, entry);
+    const targetAbsolute = path28.join(sourcePath, entry);
+    const targetRelative = path28.relative(managedDir, targetAbsolute);
+    try {
+      fs29.lstatSync(linkPath);
+      fs29.rmSync(linkPath, { recursive: true, force: true });
+    } catch {
+    }
+    fs29.symlinkSync(targetRelative, linkPath);
+  }
+  const managedEntries = fs29.readdirSync(managedDir);
+  const baseEntrySet = new Set(baseEntries);
+  for (const entry of managedEntries) {
+    if (entry === "SKILL.md")
+      continue;
+    if (!baseEntrySet.has(entry)) {
+      const stalePath = path28.join(managedDir, entry);
+      try {
+        fs29.rmSync(stalePath, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+  return managedDir;
+}
+function cleanMergedDir(claudeDir2) {
+  fs29.rmSync(path28.join(claudeDir2, ".olam-merged"), { recursive: true, force: true });
+}
+var init_managed_merge = __esm({
+  "../core/dist/skill-sync/managed-merge.js"() {
+    "use strict";
+  }
+});
+
 // ../core/dist/skill-sync/engine.js
-import * as fs28 from "node:fs";
+import * as fs30 from "node:fs";
 import * as os18 from "node:os";
-import * as path27 from "node:path";
+import * as path29 from "node:path";
 function resolveAtlasUser(override) {
   if (override)
     return override;
-  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path27.join(os18.homedir(), ".claude");
-  const f = path27.join(claudeDir2, ".atlas-user");
-  if (fs28.existsSync(f)) {
-    return fs28.readFileSync(f, "utf-8").trim() || void 0;
+  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path29.join(os18.homedir(), ".claude");
+  const f = path29.join(claudeDir2, ".atlas-user");
+  if (fs30.existsSync(f)) {
+    return fs30.readFileSync(f, "utf-8").trim() || void 0;
   }
   return void 0;
 }
@@ -14411,7 +14887,7 @@ async function syncSkills(opts = {}) {
   const perSource = [];
   for (const source of sources) {
     const clonePath = skillSourceClonePath(source.id);
-    if (!fs28.existsSync(clonePath))
+    if (!fs30.existsSync(clonePath))
       continue;
     const { artifacts, subscription } = await withFileLock(clonePath, () => {
       const pinRef = projectOverride?.override.pin?.[source.id];
@@ -14438,7 +14914,57 @@ async function syncSkills(opts = {}) {
       fromSubscriptionsFile: subscription.fromSubscriptionsFile
     });
   }
-  const projectFilteredArtifacts = projectOverride ? applyOverrideToArtifacts(allArtifacts, projectOverride.override) : allArtifacts;
+  const projectOverrideFilteredArtifacts = projectOverride ? applyOverrideToArtifacts(allArtifacts, projectOverride.override) : allArtifacts;
+  const installedOlamVersion = opts.installedOlamVersion ?? process.env["OLAM_VERSION"] ?? "0.0.0";
+  const minVersionResult = filterArtifactsByMinVersion(projectOverrideFilteredArtifacts, installedOlamVersion);
+  for (const warning of minVersionResult.warnings) {
+    process.stderr.write(`${warning}
+`);
+  }
+  const projectFilteredArtifacts = minVersionResult.kept;
+  const memberOverlaysEnabled = process.env["OLAM_MEMBER_OVERLAYS"] === "1";
+  const baseArtifacts = projectFilteredArtifacts.filter((a) => a.kind !== "overlay");
+  const overlayArtifacts = memberOverlaysEnabled ? projectFilteredArtifacts.filter((a) => a.kind === "overlay") : [];
+  if (memberOverlaysEnabled && overlayArtifacts.length > 0 && !opts.dryRun) {
+    const claude = claudeDir();
+    cleanMergedDir(claude);
+    for (const overlay of overlayArtifacts) {
+      if (!overlay.targetKind)
+        continue;
+      const base = baseArtifacts.find((a) => a.sourceId === overlay.sourceId && a.kind === overlay.targetKind && a.deployBasename === overlay.deployBasename);
+      if (!base)
+        continue;
+      let baseContent;
+      let basePath;
+      if (overlay.targetKind === "skill") {
+        basePath = path29.join(base.sourcePath, "SKILL.md");
+        baseContent = fs30.readFileSync(basePath, "utf-8");
+      } else {
+        basePath = base.sourcePath;
+        baseContent = fs30.readFileSync(basePath, "utf-8");
+      }
+      const overlayContent = fs30.readFileSync(overlay.sourcePath, "utf-8");
+      const label = `${overlay.sourceId}/${overlay.deployBasename}`;
+      const mergeResult = mergeMarkdown(baseContent, overlayContent, label, basePath, overlay.sourcePath);
+      if ("error" in mergeResult) {
+        process.stderr.write(`[no-such-section] ${label}
+`);
+        continue;
+      }
+      const mergedBuffer = Buffer.from(mergeResult.merged, "utf-8");
+      base.resolvedContent = mergedBuffer;
+      if (overlay.targetKind === "skill") {
+        const managedDir = materializeMergedSkill({
+          sourceId: base.sourceId,
+          sourcePath: base.sourcePath,
+          deployBasename: base.deployBasename,
+          mergedContent: mergedBuffer,
+          claudeDir: claude
+        });
+        base.sourcePath = managedDir;
+      }
+    }
+  }
   const hookFiles = projectFilteredArtifacts.filter((a) => a.kind === "hook").map((a) => a.sourcePath);
   const permissionFiles = projectFilteredArtifacts.filter((a) => a.kind === "permission").map((a) => a.sourcePath);
   const summary = {
@@ -14454,10 +14980,15 @@ async function syncSkills(opts = {}) {
     perSource
   };
   if (opts.dryRun) {
-    summary.collisions = detectCollisions(projectFilteredArtifacts).collisions;
+    summary.collisions = detectCollisions(baseArtifacts).collisions;
     return summary;
   }
-  summary.deploy = deployArtifacts(projectFilteredArtifacts);
+  const claudeDirPath = process.env["OLAM_CLAUDE_DIR"] || path29.join(os18.homedir(), ".claude");
+  const overlayReferences = scanOverlayReferences(claudeDirPath, SHIM_TARGETS.map((t) => t.basename));
+  summary.deploy = deployArtifacts(baseArtifacts, {
+    installedOlamVersion,
+    overlayReferences
+  });
   summary.collisions = summary.deploy.collisions;
   summary.merge = mergeSettings({ hookFiles, permissionFiles });
   if (opts.metaHooks !== "never") {
@@ -14478,19 +15009,19 @@ async function injectMetaHooksIntoSettings(opts) {
   const result = await withSettingsJsonLock(() => {
     let currentSettings = {};
     let settingsExisted = false;
-    if (fs28.existsSync(settingsFile)) {
+    if (fs30.existsSync(settingsFile)) {
       settingsExisted = true;
       try {
-        const raw = fs28.readFileSync(settingsFile, "utf-8");
+        const raw = fs30.readFileSync(settingsFile, "utf-8");
         currentSettings = raw.trim() ? JSON.parse(raw) : {};
       } catch {
         try {
-          const raw = fs28.readFileSync(settingsFile);
-          const bakDir = path27.join(path27.dirname(settingsFile), ".malformed-backups");
-          fs28.mkdirSync(bakDir, { recursive: true });
+          const raw = fs30.readFileSync(settingsFile);
+          const bakDir = path29.join(path29.dirname(settingsFile), ".malformed-backups");
+          fs30.mkdirSync(bakDir, { recursive: true });
           const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-          const bakFile = path27.join(bakDir, `settings.json.malformed.${stamp}.bak`);
-          fs28.writeFileSync(bakFile, raw, { mode: 384 });
+          const bakFile = path29.join(bakDir, `settings.json.malformed.${stamp}.bak`);
+          fs30.writeFileSync(bakFile, raw, { mode: 384 });
           snapshotError = `settings.json was malformed; original bytes preserved at ${bakFile}`;
         } catch (bakErr) {
           snapshotError = `settings.json malformed AND .bak write failed: ${bakErr instanceof Error ? bakErr.message : String(bakErr)}`;
@@ -14540,10 +15071,10 @@ async function injectMetaHooksIntoSettings(opts) {
       } catch {
       }
     }
-    fs28.mkdirSync(path27.dirname(settingsFile), { recursive: true });
+    fs30.mkdirSync(path29.dirname(settingsFile), { recursive: true });
     const tmpPath = `${settingsFile}.tmp-${process.pid}-${Date.now()}`;
-    fs28.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
-    fs28.renameSync(tmpPath, settingsFile);
+    fs30.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
+    fs30.renameSync(tmpPath, settingsFile);
     return inject;
   }, { reason: `syncSkills meta-hook injection (mode=${mode})` });
   return {
@@ -14566,29 +15097,34 @@ var init_engine = __esm({
     init_settings_merger();
     init_per_project_override();
     init_file_lock();
+    init_min_version_filter();
+    init_shim_targets();
+    init_overlay_scan();
     init_settings_json_lock();
     init_services_status();
     init_meta_hooks_migration_snapshot();
     init_trust_audit_log();
     init_atlas_hook_strip();
     init_meta_hook_injector();
+    init_markdown_merger();
+    init_managed_merge();
   }
 });
 
 // ../core/dist/skill-sync/shadow-backup-manager.js
-import * as fs29 from "node:fs";
-import * as path28 from "node:path";
+import * as fs31 from "node:fs";
+import * as path30 from "node:path";
 function listShadowBackups(opts = {}) {
   const claude = opts.claudeDirOverride ?? claudeDir();
   const now = opts.now ?? Date.now();
   const out = [];
   for (const bucket of SHADOW_BACKUP_BUCKETS) {
-    const bucketDir = path28.join(claude, bucket);
-    if (!fs29.existsSync(bucketDir))
+    const bucketDir = path30.join(claude, bucket);
+    if (!fs31.existsSync(bucketDir))
       continue;
     let entries;
     try {
-      entries = fs29.readdirSync(bucketDir);
+      entries = fs31.readdirSync(bucketDir);
     } catch {
       continue;
     }
@@ -14599,10 +15135,10 @@ function listShadowBackups(opts = {}) {
       const epochSeconds = Number.parseInt(match[1], 10);
       if (!Number.isFinite(epochSeconds) || epochSeconds < 0)
         continue;
-      const full = path28.join(bucketDir, name);
+      const full = path30.join(bucketDir, name);
       let sizeBytes = 0;
       try {
-        const st = fs29.statSync(full);
+        const st = fs31.statSync(full);
         if (st.isDirectory())
           continue;
         sizeBytes = st.size;
@@ -14615,7 +15151,7 @@ function listShadowBackups(opts = {}) {
         bucket,
         basename: name,
         originalBasename,
-        originalPath: path28.join(bucketDir, originalBasename),
+        originalPath: path30.join(bucketDir, originalBasename),
         epochSeconds,
         ageMs: now - epochSeconds * 1e3,
         sizeBytes
@@ -14658,7 +15194,7 @@ function pruneShadowBackups(opts) {
     }
     if (!opts.dryRun) {
       try {
-        fs29.unlinkSync(b.path);
+        fs31.unlinkSync(b.path);
       } catch {
         skipped.push(b);
         continue;
@@ -14669,24 +15205,24 @@ function pruneShadowBackups(opts) {
   return { deleted, skipped };
 }
 function restoreShadowBackup(opts) {
-  const abs = path28.resolve(opts.backupPath);
-  if (!fs29.existsSync(abs)) {
+  const abs = path30.resolve(opts.backupPath);
+  if (!fs31.existsSync(abs)) {
     throw new Error(`backup file not found: ${abs}`);
   }
-  const basename6 = path28.basename(abs);
+  const basename6 = path30.basename(abs);
   const match = SHADOW_BACKUP_SUFFIX_RE.exec(basename6);
   if (!match) {
     throw new Error(`not a shadow-backup file (basename "${basename6}" does not match \`.shadow-backup-<epoch>\`): ${abs}`);
   }
   const originalBasename = basename6.slice(0, basename6.length - match[0].length);
-  const originalPath = path28.join(path28.dirname(abs), originalBasename);
-  if (fs29.existsSync(originalPath) && !opts.force) {
+  const originalPath = path30.join(path30.dirname(abs), originalBasename);
+  if (fs31.existsSync(originalPath) && !opts.force) {
     throw new Error(`original path already occupied: ${originalPath}. Move/rename it first OR re-run with --force.`);
   }
-  if (opts.force && fs29.existsSync(originalPath)) {
-    fs29.unlinkSync(originalPath);
+  if (opts.force && fs31.existsSync(originalPath)) {
+    fs31.unlinkSync(originalPath);
   }
-  fs29.renameSync(abs, originalPath);
+  fs31.renameSync(abs, originalPath);
   return { restoredTo: originalPath };
 }
 var SHADOW_BACKUP_BUCKETS, SHADOW_BACKUP_SUFFIX_RE;
@@ -14700,14 +15236,14 @@ var init_shadow_backup_manager = __esm({
 });
 
 // ../core/dist/skill-sources/doctor-checks.js
-import * as fs30 from "node:fs";
-import * as path29 from "node:path";
+import * as fs32 from "node:fs";
+import * as path31 from "node:path";
 import * as os19 from "node:os";
 function claudeDirInternal3() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path29.join(os19.homedir(), ".claude");
+  return path31.join(os19.homedir(), ".claude");
 }
 function checkStateFileParse() {
   const filePath = globalConfigPath();
@@ -14716,11 +15252,11 @@ function checkStateFileParse() {
     healthy: true,
     description: `~/.olam state file (${filePath})`
   };
-  if (!fs30.existsSync(filePath)) {
+  if (!fs32.existsSync(filePath)) {
     result.details = ["(file does not yet exist \u2014 will be created on first write)"];
     return result;
   }
-  const raw = fs30.readFileSync(filePath, "utf-8");
+  const raw = fs32.readFileSync(filePath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -14730,8 +15266,8 @@ function checkStateFileParse() {
     result.details = [err instanceof Error ? err.message : String(err)];
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs30.renameSync(filePath, aside);
-      fs30.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
+      fs32.renameSync(filePath, aside);
+      fs32.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
     };
     return result;
   }
@@ -14742,7 +15278,7 @@ function checkStateFileParse() {
     result.details = validation.error.issues.map((e) => `${e.path.join(".")}: ${e.message}`);
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs30.copyFileSync(filePath, aside);
+      fs32.copyFileSync(filePath, aside);
       const base = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
       const next = {
         ...base,
@@ -14751,7 +15287,7 @@ function checkStateFileParse() {
         runbooks: [],
         skillSources: []
       };
-      fs30.writeFileSync(filePath, JSON.stringify(next, null, 2));
+      fs32.writeFileSync(filePath, JSON.stringify(next, null, 2));
     };
     return result;
   }
@@ -14762,16 +15298,16 @@ function checkDanglingSymlinks() {
   const buckets = ["commands", "agents", "skills", "scripts", "rules"];
   const dangling = [];
   for (const bucket of buckets) {
-    const dir = path29.join(claude, bucket);
-    if (!fs30.existsSync(dir))
+    const dir = path31.join(claude, bucket);
+    if (!fs32.existsSync(dir))
       continue;
-    for (const name of fs30.readdirSync(dir)) {
-      const linkPath = path29.join(dir, name);
+    for (const name of fs32.readdirSync(dir)) {
+      const linkPath = path31.join(dir, name);
       try {
-        const lst = fs30.lstatSync(linkPath);
+        const lst = fs32.lstatSync(linkPath);
         if (!lst.isSymbolicLink())
           continue;
-        if (!fs30.existsSync(linkPath)) {
+        if (!fs32.existsSync(linkPath)) {
           dangling.push(linkPath);
         }
       } catch {
@@ -14789,7 +15325,7 @@ function checkDanglingSymlinks() {
     result.repair = () => {
       for (const p of dangling) {
         try {
-          fs30.unlinkSync(p);
+          fs32.unlinkSync(p);
         } catch {
         }
       }
@@ -14804,19 +15340,19 @@ function checkOrphanedSnapshots() {
     healthy: true,
     description: `orphaned migration snapshots under ${dir}`
   };
-  if (!fs30.existsSync(dir)) {
+  if (!fs32.existsSync(dir)) {
     return result;
   }
   const orphans = [];
-  for (const name of fs30.readdirSync(dir)) {
+  for (const name of fs32.readdirSync(dir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path29.join(dir, name);
+    const full = path31.join(dir, name);
     try {
-      const stat = fs30.statSync(full);
+      const stat = fs32.statSync(full);
       if (!stat.isFile())
         continue;
-      const raw = fs30.readFileSync(full, "utf-8");
+      const raw = fs32.readFileSync(full, "utf-8");
       let parsed;
       try {
         parsed = JSON.parse(raw);
@@ -14841,7 +15377,7 @@ function checkOrphanedSnapshots() {
     result.repair = () => {
       for (const o of orphans) {
         try {
-          fs30.unlinkSync(o.path);
+          fs32.unlinkSync(o.path);
         } catch {
         }
       }
@@ -14856,12 +15392,12 @@ function checkSentinelDrift() {
     healthy: true,
     description: `olam-skills sentinel block in ${filePath}`
   };
-  if (!fs30.existsSync(filePath)) {
+  if (!fs32.existsSync(filePath)) {
     return result;
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs30.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs32.readFileSync(filePath, "utf-8"));
   } catch {
     return result;
   }
@@ -14902,7 +15438,7 @@ function checkSentinelDrift() {
         backupSettings();
       } catch {
       }
-      const next = JSON.parse(fs30.readFileSync(filePath, "utf-8"));
+      const next = JSON.parse(fs32.readFileSync(filePath, "utf-8"));
       if (!next.hooks)
         return;
       for (const stage of Object.keys(next.hooks)) {
@@ -14925,18 +15461,125 @@ function checkSentinelDrift() {
           return bad === void 0;
         });
       }
-      fs30.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs32.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
     };
   }
   return result;
 }
+function checkMemberNameMissing() {
+  const result = {
+    name: "[member-name-missing]",
+    healthy: true,
+    description: "atlas-toolbox registered and ~/.claude/.atlas-user configured"
+  };
+  let atlasSource;
+  try {
+    atlasSource = getSkillSourceByName("atlas-toolbox");
+  } catch (err) {
+    result.healthy = false;
+    result.issue = `global config unreadable: ${err instanceof Error ? err.message : String(err)}`;
+    return result;
+  }
+  if (atlasSource === null) {
+    result.details = ["(atlas-toolbox source not registered \u2014 check not applicable)"];
+    return result;
+  }
+  const claudeDir2 = claudeDirInternal3();
+  const atlasUserPath = path31.join(claudeDir2, ".atlas-user");
+  const value = fs32.existsSync(atlasUserPath) ? fs32.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  if (value.length > 0) {
+    result.details = [`atlas-user: ${value}`];
+    return result;
+  }
+  result.healthy = false;
+  result.issue = "atlas-toolbox source registered but ~/.claude/.atlas-user not set";
+  const clonePath = skillSourceClonePath(atlasSource.id);
+  const membersDir = path31.join(clonePath, "members");
+  const existing = fs32.existsSync(membersDir) ? fs32.readdirSync(membersDir).filter((e) => {
+    try {
+      return fs32.statSync(path31.join(membersDir, e)).isDirectory();
+    } catch {
+      return false;
+    }
+  }).sort() : [];
+  result.details = [
+    `Set via: echo <name> > ${atlasUserPath}`,
+    `List existing members: ls ${membersDir}`,
+    ...existing.length > 0 ? [`Existing members: ${existing.join(", ")}`] : []
+  ];
+  return result;
+}
+function checkMemberOverlayDrift() {
+  const claudeDir2 = claudeDirInternal3();
+  const atlasUserPath = path31.join(claudeDir2, ".atlas-user");
+  const atlasUser = fs32.existsSync(atlasUserPath) ? fs32.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  if (atlasUser.length === 0) {
+    return [];
+  }
+  let atlasSource;
+  try {
+    atlasSource = getSkillSourceByName("atlas-toolbox");
+  } catch {
+    return [];
+  }
+  if (atlasSource === null) {
+    return [];
+  }
+  const clonePath = skillSourceClonePath(atlasSource.id);
+  const results = [];
+  for (const kind of ["skills", "agents"]) {
+    const localRoot = path31.join(claudeDir2, `${kind}.overrides`);
+    if (!fs32.existsSync(localRoot))
+      continue;
+    let entries;
+    try {
+      entries = fs32.readdirSync(localRoot);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const localFile = path31.join(localRoot, entry);
+      let stat;
+      try {
+        stat = fs32.statSync(localFile);
+      } catch {
+        continue;
+      }
+      if (!stat.isFile())
+        continue;
+      const cloneFile = path31.join(clonePath, "members", atlasUser, `${kind}.overrides`, entry);
+      const localSha = sha256OfPath(localFile);
+      const cloneSha = sha256OfPath(cloneFile);
+      if (localSha === cloneSha) {
+        continue;
+      }
+      const driftResult = {
+        name: `[member-overlay-drift: ${kind}/${entry}]`,
+        healthy: false,
+        description: `Local ${kind}.overrides/${entry} differs from atlas-toolbox member copy`,
+        issue: `SHA mismatch: local=${localSha.slice(0, 8)}\u2026 clone=${cloneSha.slice(0, 8)}\u2026`,
+        details: [
+          `Diff: olam flywheel migrate-overlays --diff ${entry}`,
+          `Push local \u2192 atlas: olam flywheel migrate-overlays --push --target=atlas-toolbox`,
+          `Pull atlas \u2192 local: cp ${cloneFile} ${localFile}`,
+          `Discard local: rm ${localFile}`
+        ]
+      };
+      results.push(driftResult);
+    }
+  }
+  return results;
+}
 function runAllDoctorChecks() {
-  return [
+  const base = [
     checkStateFileParse(),
     checkDanglingSymlinks(),
     checkOrphanedSnapshots(),
-    checkSentinelDrift()
+    checkSentinelDrift(),
+    checkMemberNameMissing()
   ];
+  const driftResults = checkMemberOverlayDrift();
+  return [...base, ...driftResults];
 }
 var MigrationSnapshotMinimalSchema;
 var init_doctor_checks = __esm({
@@ -14948,6 +15591,9 @@ var init_doctor_checks = __esm({
     init_migration_snapshot();
     init_hook_template();
     init_settings_merger();
+    init_store2();
+    init_clone();
+    init_markdown_merger();
     MigrationSnapshotMinimalSchema = external_exports.object({
       schemaVersion: external_exports.literal(MIGRATION_SNAPSHOT_SCHEMA_VERSION),
       takenAt: external_exports.string()
@@ -14985,6 +15631,8 @@ __export(skill_sources_exports, {
   backupSettings: () => backupSettings,
   buildSkillsHookEntry: () => buildSkillsHookEntry,
   checkDanglingSymlinks: () => checkDanglingSymlinks,
+  checkMemberNameMissing: () => checkMemberNameMissing,
+  checkMemberOverlayDrift: () => checkMemberOverlayDrift,
   checkOrphanedSnapshots: () => checkOrphanedSnapshots,
   checkSentinelDrift: () => checkSentinelDrift,
   checkStateFileParse: () => checkStateFileParse,
@@ -14998,6 +15646,7 @@ __export(skill_sources_exports, {
   detectToolboxState: () => detectToolboxState,
   findProjectOverride: () => findProjectOverride,
   getSkillSource: () => getSkillSource,
+  getSkillSourceByName: () => getSkillSourceByName,
   installSkillsHookToFile: () => installSkillsHookToFile,
   isSkillsHookInstalled: () => isSkillsHookInstalled,
   listShadowBackups: () => listShadowBackups,
@@ -15015,6 +15664,7 @@ __export(skill_sources_exports, {
   removeSkillSource: () => removeSkillSource,
   removeSkillSourceClone: () => removeSkillSourceClone,
   reorderSkillSource: () => reorderSkillSource,
+  resolveAtlasUser: () => resolveAtlasUser,
   resolveSourceArtifacts: () => resolveSourceArtifacts,
   resolveSubscriptions: () => resolveSubscriptions,
   restoreCloneToBranchHead: () => restoreCloneToBranchHead,
@@ -15310,10 +15960,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path46) {
-  if (!path46)
+function getElementAtPath(obj, path48) {
+  if (!path48)
     return obj;
-  return path46.reduce((acc, key) => acc?.[key], obj);
+  return path48.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -15722,11 +16372,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path46, issues) {
+function prefixIssues(path48, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path46);
+    iss.path.unshift(path48);
     return iss;
   });
 }
@@ -15873,16 +16523,16 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
 }
 function formatError(error2, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error3, path46 = []) => {
+  const processError = (error3, path48 = []) => {
     for (const issue2 of error3.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path48, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path48, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path48, ...issue2.path]);
       } else {
-        const fullpath = [...path46, ...issue2.path];
+        const fullpath = [...path48, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -22099,12 +22749,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve13) => {
+    return new Promise((resolve14) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve13();
+        resolve14();
       } else {
-        this._stdout.once("drain", resolve13);
+        this._stdout.once("drain", resolve14);
       }
     });
   }
@@ -24141,7 +24791,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+        await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -24158,7 +24808,7 @@ var Protocol = class {
    */
   request(request2, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve13, reject2) => {
+    return new Promise((resolve14, reject2) => {
       const earlyReject = (error2) => {
         reject2(error2);
       };
@@ -24236,7 +24886,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject2(parseResult.error);
           } else {
-            resolve13(parseResult.data);
+            resolve14(parseResult.data);
           }
         } catch (error2) {
           reject2(error2);
@@ -24497,12 +25147,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve13, reject2) => {
+    return new Promise((resolve14, reject2) => {
       if (signal.aborted) {
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve13, interval);
+      const timeoutId = setTimeout(resolve14, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -25602,7 +26252,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -26521,8 +27171,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path46, body, attempt = 0) {
-    const url2 = `${this.baseUrl}${path46}`;
+  async request(method, path48, body, attempt = 0) {
+    const url2 = `${this.baseUrl}${path48}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -26540,7 +27190,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path46, body, attempt + 1);
+        return this.request(method, path48, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -26567,7 +27217,7 @@ async function safeText(res) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 
 // ../core/dist/auth/container.js
@@ -26699,7 +27349,7 @@ function resolveAuthServicePath() {
   return path3.join(pkgsDir, "auth-service");
 }
 function sleep2(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 
 // ../core/dist/auth/preflight.js
@@ -27068,6 +27718,9 @@ var WorldRegistry = class {
     }
   }
   register(world) {
+    if (world.id === "_planning") {
+      throw new Error("world.id '_planning' is reserved for in-flight planning sessions; see packages/chunks/src/schema.ts PLANNING_WORLD_ID");
+    }
     this.db.prepare(`INSERT INTO worlds
          (id, name, status, repos, branch, port_offset, workspace_path,
           compute_provider, total_cost_usd, thought_count, created_at, updated_at,
@@ -27391,12 +28044,12 @@ function register3(server, _ctx, _initError) {
         registry2.close();
       }
       try {
-        const { default: fs46 } = await import("node:fs");
+        const { default: fs48 } = await import("node:fs");
         const { default: os28 } = await import("node:os");
-        const { default: path46 } = await import("node:path");
-        const tokenPath = path46.join(os28.homedir(), ".olam", "host-cp.token");
-        if (fs46.existsSync(tokenPath)) {
-          const token = fs46.readFileSync(tokenPath, "utf-8").trim();
+        const { default: path48 } = await import("node:path");
+        const tokenPath = path48.join(os28.homedir(), ".olam", "host-cp.token");
+        if (fs48.existsSync(tokenPath)) {
+          const token = fs48.readFileSync(tokenPath, "utf-8").trim();
           await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -27816,10 +28469,10 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path46) {
-  if (!existsSync6(path46)) return null;
+function readOptional(path48) {
+  if (!existsSync6(path48)) return null;
   try {
-    return readFileSync5(path46, "utf8");
+    return readFileSync5(path48, "utf8");
   } catch {
     return null;
   }
@@ -27944,7 +28597,7 @@ var realDocker = {
   }
 };
 function spawnAsync(cmd, args, opts = {}) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     const child = spawn(cmd, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       signal: opts.signal
@@ -27958,10 +28611,10 @@ function spawnAsync(cmd, args, opts = {}) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve13({ exitCode: -1, stdout, stderr: stderr + err.message });
+      resolve14({ exitCode: -1, stdout, stderr: stderr + err.message });
     });
     child.on("close", (code) => {
-      resolve13({ exitCode: code ?? -1, stdout, stderr });
+      resolve14({ exitCode: code ?? -1, stdout, stderr });
     });
   });
 }
@@ -28412,7 +29065,7 @@ var stopAndRemove = async (container) => {
 
 // ../adapters/dist/docker/exec.js
 import { PassThrough } from "node:stream";
-var demuxStream = (stream) => new Promise((resolve13, reject2) => {
+var demuxStream = (stream) => new Promise((resolve14, reject2) => {
   const stdoutChunks = [];
   const stderrChunks = [];
   const stdout = new PassThrough();
@@ -28426,7 +29079,7 @@ var demuxStream = (stream) => new Promise((resolve13, reject2) => {
     stream.pipe(stdout);
   }
   stream.on("end", () => {
-    resolve13({
+    resolve14({
       stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
       stderr: Buffer.concat(stderrChunks).toString("utf-8")
     });
@@ -28799,7 +29452,7 @@ var SSHConnectionPool = class {
   // -----------------------------------------------------------------------
   async exec(host, command) {
     const client = await this.getConnection(host);
-    return new Promise((resolve13, reject2) => {
+    return new Promise((resolve14, reject2) => {
       client.exec(command, (err, stream) => {
         if (err) {
           reject2(new Error(`SSH exec failed on ${host}: ${err.message}`));
@@ -28814,7 +29467,7 @@ var SSHConnectionPool = class {
           stderr += data.toString();
         });
         stream.on("close", (code) => {
-          resolve13({
+          resolve14({
             exitCode: code ?? 0,
             stdout: stdout.trimEnd(),
             stderr: stderr.trimEnd()
@@ -28845,10 +29498,10 @@ var SSHConnectionPool = class {
       throw new Error(`No SSH configuration found for host: ${host}`);
     }
     const client = new SSHClient();
-    return new Promise((resolve13, reject2) => {
+    return new Promise((resolve14, reject2) => {
       client.on("ready", () => {
         this.connections.set(host, client);
-        resolve13(client);
+        resolve14(client);
       }).on("error", (err) => {
         this.connections.delete(host);
         reject2(new Error(`SSH connection to ${host} failed: ${err.message}`));
@@ -29265,8 +29918,8 @@ var CloudflareProvider = class extends ComputeProvider {
   // -----------------------------------------------------------------------
   // Internal fetch helper
   // -----------------------------------------------------------------------
-  async request(path46, method, body) {
-    const url2 = `${this.config.workerUrl}${path46}`;
+  async request(path48, method, body) {
+    const url2 = `${this.config.workerUrl}${path48}`;
     const bearer = await this.config.mintToken();
     const headers = {
       Authorization: `Bearer ${bearer}`
@@ -29828,7 +30481,7 @@ function register6(server, ctx, initError) {
                 }
               } catch {
               }
-              await new Promise((resolve13) => setTimeout(resolve13, POLL_INTERVAL_MS));
+              await new Promise((resolve14) => setTimeout(resolve14, POLL_INTERVAL_MS));
             }
           }
           if (authenticated) {
@@ -30764,8 +31417,8 @@ function copyMatchingFiles(sourcePath, destPath, pattern) {
   try {
     const matches2 = globSync(fullPattern);
     for (const match of matches2) {
-      const relative3 = path10.relative(sourcePath, match);
-      const dest = path10.join(destPath, relative3);
+      const relative5 = path10.relative(sourcePath, match);
+      const dest = path10.join(destPath, relative5);
       fs8.mkdirSync(path10.dirname(dest), { recursive: true });
       fs8.copyFileSync(match, dest);
     }
@@ -31717,10 +32370,10 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path46 = join13(args.outDir, "manifest.json");
-  await writeFile(path46, `${JSON.stringify(manifest, null, 2)}
+  const path48 = join13(args.outDir, "manifest.json");
+  await writeFile(path48, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path46, manifest };
+  return { path: path48, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
@@ -31974,9 +32627,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path46 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path46))) {
-        return httpReject(403, "outside_allow_list", { path: path46 });
+      const path48 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path48))) {
+        return httpReject(403, "outside_allow_list", { path: path48 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -32080,15 +32733,15 @@ ${JSON.stringify({ error: reason })}`
       unlinkSync2(udsPath);
     } catch {
     }
-    await new Promise((resolve13, reject2) => {
-      server.listen(udsPath, () => resolve13());
+    await new Promise((resolve14, reject2) => {
+      server.listen(udsPath, () => resolve14());
       server.once("error", reject2);
     });
     chmodSync3(udsPath, 384);
     port2 = 0;
   } else {
-    await new Promise((resolve13, reject2) => {
-      server.listen(opts.port ?? 0, "127.0.0.1", () => resolve13());
+    await new Promise((resolve14, reject2) => {
+      server.listen(opts.port ?? 0, "127.0.0.1", () => resolve14());
       server.once("error", reject2);
     });
     const addr = server.address();
@@ -32104,10 +32757,10 @@ ${JSON.stringify({ error: reason })}`
     } catch {
     }
     await Promise.race([
-      new Promise((resolve13, reject2) => {
-        server.close((err) => err ? reject2(err) : resolve13());
+      new Promise((resolve14, reject2) => {
+        server.close((err) => err ? reject2(err) : resolve14());
       }),
-      new Promise((resolve13) => setTimeout(resolve13, 5e3))
+      new Promise((resolve14) => setTimeout(resolve14, 5e3))
     ]);
     if (udsPath) {
       try {
@@ -32439,10 +33092,10 @@ async function acquireLaunchSlot() {
     _inFlightLaunches++;
     return releaseLaunchSlot;
   }
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     _launchQueue.push(() => {
       _inFlightLaunches++;
-      resolve13(releaseLaunchSlot);
+      resolve14(releaseLaunchSlot);
     });
   });
 }
@@ -32458,8 +33111,8 @@ function resolveShootsRoot() {
 }
 function isUnderRoot(absPath, root) {
   if (absPath === root) return true;
-  const sep2 = root.endsWith("/") ? "" : "/";
-  return absPath.startsWith(root + sep2);
+  const sep4 = root.endsWith("/") ? "" : "/";
+  return absPath.startsWith(root + sep4);
 }
 function deriveAllowedPaths(shots) {
   const paths = /* @__PURE__ */ new Set();
@@ -32755,14 +33408,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path46 = join14(outDir, `${shot.name}.${ext}`);
+    const path48 = join14(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path46,
+      path: path48,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path46, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path48, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -33206,12 +33859,12 @@ function openUrl(url2) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs46 } = await import("node:fs");
+    const { default: fs48 } = await import("node:fs");
     const { default: os28 } = await import("node:os");
-    const { default: path46 } = await import("node:path");
-    const tp = path46.join(os28.homedir(), ".olam", "host-cp.token");
-    if (!fs46.existsSync(tp)) return { token: null };
-    return { token: fs46.readFileSync(tp, "utf-8").trim() };
+    const { default: path48 } = await import("node:path");
+    const tp = path48.join(os28.homedir(), ".olam", "host-cp.token");
+    if (!fs48.existsSync(tp)) return { token: null };
+    return { token: fs48.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -33471,9 +34124,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("Optional human-readable description."),
       defaultBranch: external_exports.string().optional().describe("Default branch name (e.g. main).")
     },
-    async ({ name, path: path46, description, defaultBranch }) => {
+    async ({ name, path: path48, description, defaultBranch }) => {
       try {
-        const entry = addRepo({ name, path: path46, description, defaultBranch });
+        const entry = addRepo({ name, path: path48, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -33514,9 +34167,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("New description."),
       defaultBranch: external_exports.string().optional().describe("New default branch.")
     },
-    async ({ name, path: path46, description, defaultBranch }) => {
+    async ({ name, path: path48, description, defaultBranch }) => {
       try {
-        const entry = updateRepo(name, { path: path46, description, defaultBranch });
+        const entry = updateRepo(name, { path: path48, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -33537,15 +34190,15 @@ __export(process_port_exports, {
   resolveHostCpToken: () => resolveHostCpToken
 });
 init_v3();
-import fs31 from "node:fs";
+import fs33 from "node:fs";
 import os20 from "node:os";
-import path30 from "node:path";
+import path32 from "node:path";
 var HOST_CP_BASE = "http://127.0.0.1:19000";
 function resolveHostCpToken() {
   const envToken = process.env["OLAM_HOST_CP_TOKEN"];
   if (envToken) return envToken;
-  const tokenPath = path30.join(os20.homedir(), ".olam", "host-cp.token");
-  if (fs31.existsSync(tokenPath)) return fs31.readFileSync(tokenPath, "utf-8").trim();
+  const tokenPath = path32.join(os20.homedir(), ".olam", "host-cp.token");
+  if (fs33.existsSync(tokenPath)) return fs33.readFileSync(tokenPath, "utf-8").trim();
   return null;
 }
 function tokenMissingError() {
@@ -33977,8 +34630,8 @@ __export(skills_exports, {
 });
 init_v3();
 init_skill_sources();
-import * as fs32 from "node:fs";
-import * as path31 from "node:path";
+import * as fs34 from "node:fs";
+import * as path33 from "node:path";
 function asMessage8(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -34001,14 +34654,14 @@ function listDeployed() {
   );
   const entries = [];
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const bucketDir = path31.join(dir, bucket);
-    if (!fs32.existsSync(bucketDir)) continue;
-    for (const name of fs32.readdirSync(bucketDir)) {
-      const full = path31.join(bucketDir, name);
+    const bucketDir = path33.join(dir, bucket);
+    if (!fs34.existsSync(bucketDir)) continue;
+    for (const name of fs34.readdirSync(bucketDir)) {
+      const full = path33.join(bucketDir, name);
       try {
-        const stat = fs32.lstatSync(full);
+        const stat = fs34.lstatSync(full);
         if (!stat.isSymbolicLink()) continue;
-        const target = fs32.readlinkSync(full);
+        const target = fs34.readlinkSync(full);
         let sourceId;
         for (const [clonePath, id] of sourcePaths.entries()) {
           if (target.startsWith(clonePath)) {
@@ -34104,8 +34757,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path46) {
-  return `http://127.0.0.1:${port()}${path46}`;
+function url(path48) {
+  return `http://127.0.0.1:${port()}${path48}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -34304,8 +34957,8 @@ __export(kg_install_hook_exports, {
 });
 init_v3();
 init_merge_settings();
-import * as fs33 from "node:fs";
-import * as path32 from "node:path";
+import * as fs35 from "node:fs";
+import * as path34 from "node:path";
 import * as os21 from "node:os";
 
 // ../core/dist/kg/hook-template.js
@@ -34356,10 +35009,10 @@ function buildHookMatcherEntry(opts) {
 // ../mcp-server/src/tools/kg-install-hook.ts
 function settingsPathFor2(scope, projectPath) {
   if (scope === "user") {
-    return path32.join(os21.homedir(), ".claude", "settings.json");
+    return path34.join(os21.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path32.join(root, ".claude", "settings.json");
+  return path34.join(root, ".claude", "settings.json");
 }
 function register29(server, _ctx, _initError) {
   server.tool(
@@ -34373,12 +35026,12 @@ function register29(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor2(scope, params.projectPath);
       try {
-        fs33.mkdirSync(path32.dirname(filePath), { recursive: true });
+        fs35.mkdirSync(path34.dirname(filePath), { recursive: true });
         let backupPath = null;
-        if (fs33.existsSync(filePath)) {
+        if (fs35.existsSync(filePath)) {
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
           backupPath = `${filePath}.olam-bak.${ts}`;
-          fs33.copyFileSync(filePath, backupPath);
+          fs35.copyFileSync(filePath, backupPath);
         }
         const result = mergeHomeSettingsJson(filePath, {
           ensureHook: {
@@ -34389,7 +35042,7 @@ function register29(server, _ctx, _initError) {
         });
         if (result.status === "already-present" && backupPath) {
           try {
-            fs33.unlinkSync(backupPath);
+            fs35.unlinkSync(backupPath);
           } catch {
           }
         }
@@ -34433,15 +35086,15 @@ __export(kg_uninstall_hook_exports, {
   register: () => register30
 });
 init_v3();
-import * as fs34 from "node:fs";
-import * as path33 from "node:path";
+import * as fs36 from "node:fs";
+import * as path35 from "node:path";
 import * as os22 from "node:os";
 function settingsPathFor3(scope, projectPath) {
   if (scope === "user") {
-    return path33.join(os22.homedir(), ".claude", "settings.json");
+    return path35.join(os22.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path33.join(root, ".claude", "settings.json");
+  return path35.join(root, ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -34475,7 +35128,7 @@ function register30(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor3(scope, params.projectPath);
       try {
-        if (!fs34.existsSync(filePath)) {
+        if (!fs36.existsSync(filePath)) {
           return {
             content: [
               {
@@ -34489,7 +35142,7 @@ function register30(server, _ctx, _initError) {
             ]
           };
         }
-        const raw = fs34.readFileSync(filePath, "utf-8");
+        const raw = fs36.readFileSync(filePath, "utf-8");
         const settings = raw.trim() ? JSON.parse(raw) : {};
         const preToolUse = settings.hooks?.PreToolUse;
         if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
@@ -34524,7 +35177,7 @@ function register30(server, _ctx, _initError) {
         const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         const backupPath = `${filePath}.olam-bak.${ts}`;
         try {
-          fs34.copyFileSync(filePath, backupPath);
+          fs36.copyFileSync(filePath, backupPath);
         } catch {
         }
         const next = {
@@ -34536,7 +35189,7 @@ function register30(server, _ctx, _initError) {
           if (otherStages.length === 0) delete next.hooks;
           else delete next.hooks.PreToolUse;
         }
-        fs34.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+        fs36.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
         return {
           content: [
             {
@@ -34751,9 +35404,9 @@ init_loader();
 // ../core/dist/world/manager.js
 import * as crypto8 from "node:crypto";
 import { execSync as execSync5, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs43 from "node:fs";
+import * as fs45 from "node:fs";
 import * as os26 from "node:os";
-import * as path43 from "node:path";
+import * as path45 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -34849,8 +35502,8 @@ function resolveDevboxImage(config2, tag) {
 
 // ../core/dist/world/worktree.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import * as fs35 from "node:fs";
-import * as path34 from "node:path";
+import * as fs37 from "node:fs";
+import * as path36 from "node:path";
 function resolveGitDir(repo) {
   if (repo.path) {
     return repo.path;
@@ -34860,11 +35513,11 @@ function resolveGitDir(repo) {
 async function createWorktrees(repos, worldId, workspacePath, branch) {
   const created = [];
   for (const repo of repos) {
-    const worktreePath = path34.join(workspacePath, repo.name);
+    const worktreePath = path36.join(workspacePath, repo.name);
     const gitDir = resolveGitDir(repo);
     const branchName = branch || `olam/${worldId}`;
     try {
-      fs35.mkdirSync(path34.dirname(worktreePath), { recursive: true });
+      fs37.mkdirSync(path36.dirname(worktreePath), { recursive: true });
       execFileSync4("git", ["worktree", "add", worktreePath, "-b", branchName], {
         cwd: gitDir,
         stdio: "pipe"
@@ -34897,7 +35550,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
 }
 async function removeWorktrees(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path34.join(workspacePath, repo.name);
+    const worktreePath = path36.join(workspacePath, repo.name);
     let gitDir;
     try {
       gitDir = resolveGitDir(repo);
@@ -34972,12 +35625,12 @@ function removeBranch(repo, branch) {
 
 // ../core/dist/world/kg-overlay.js
 import { execFileSync as execFileSync5 } from "node:child_process";
-import * as fs36 from "node:fs";
-import * as path35 from "node:path";
+import * as fs38 from "node:fs";
+import * as path37 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
 import { homedir as homedir22 } from "node:os";
-import { join as join35, resolve as resolve8 } from "node:path";
+import { join as join37, resolve as resolve9 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
 var InvalidWorkspaceNameError = class extends Error {
@@ -34998,25 +35651,25 @@ function validateWorkspaceName(name) {
 
 // ../core/dist/kg/storage-paths.js
 function olamHome() {
-  return process.env.OLAM_HOME ?? join35(homedir22(), ".olam");
+  return process.env.OLAM_HOME ?? join37(homedir22(), ".olam");
 }
 function kgRoot() {
-  return join35(olamHome(), "kg");
+  return join37(olamHome(), "kg");
 }
 function worldsRoot() {
-  return join35(olamHome(), "worlds");
+  return join37(olamHome(), "worlds");
 }
-function assertWithinPrefix(path46, prefix, label) {
-  if (!path46.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path46} not under ${prefix}/`);
+function assertWithinPrefix(path48, prefix, label) {
+  if (!path48.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path48} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path46 = resolve8(join35(root, workspace));
-  assertWithinPrefix(path46, root, "kgPristinePath");
-  return path46;
+  const path48 = resolve9(join37(root, workspace));
+  assertWithinPrefix(path48, root, "kgPristinePath");
+  return path48;
 }
 var KG_PATHS_INTERNALS = Object.freeze({
   olamHome,
@@ -35032,10 +35685,10 @@ var KgOverlayError = class extends Error {
   }
 };
 function ensureGitignoreEntry(worldClonePath) {
-  const gitignorePath = path35.join(worldClonePath, ".gitignore");
-  if (!fs36.existsSync(gitignorePath))
+  const gitignorePath = path37.join(worldClonePath, ".gitignore");
+  if (!fs38.existsSync(gitignorePath))
     return "no-gitignore";
-  const content = fs36.readFileSync(gitignorePath, "utf-8");
+  const content = fs38.readFileSync(gitignorePath, "utf-8");
   const lines = content.split("\n").map((l) => l.trim());
   const recognised = /* @__PURE__ */ new Set([
     "graphify-out",
@@ -35050,24 +35703,24 @@ function ensureGitignoreEntry(worldClonePath) {
   const eol = content.includes("\r\n") ? "\r\n" : "\n";
   const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
   const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
-  fs36.appendFileSync(gitignorePath, block, "utf-8");
+  fs38.appendFileSync(gitignorePath, block, "utf-8");
   return "appended";
 }
 function createWorldOverlay(opts) {
   const pristineRoot = kgPristinePath(opts.workspace);
-  const pristinePath = path35.join(pristineRoot, "graphify-out");
-  if (!fs36.existsSync(pristinePath)) {
+  const pristinePath = path37.join(pristineRoot, "graphify-out");
+  if (!fs38.existsSync(pristinePath)) {
     throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
   }
-  if (!path35.isAbsolute(opts.worldClonePath)) {
+  if (!path37.isAbsolute(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
   }
-  if (!fs36.existsSync(opts.worldClonePath)) {
+  if (!fs38.existsSync(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
   }
-  const overlayPath = path35.join(opts.worldClonePath, "graphify-out");
-  if (fs36.existsSync(overlayPath)) {
-    fs36.rmSync(overlayPath, { recursive: true, force: true });
+  const overlayPath = path37.join(opts.worldClonePath, "graphify-out");
+  if (fs38.existsSync(overlayPath)) {
+    fs38.rmSync(overlayPath, { recursive: true, force: true });
   }
   const useReflink = process.platform === "darwin";
   let strategy;
@@ -35085,7 +35738,7 @@ function createWorldOverlay(opts) {
   } else {
     strategy = "cp-r";
   }
-  if (strategy === "cp-r" || !fs36.existsSync(overlayPath)) {
+  if (strategy === "cp-r" || !fs38.existsSync(overlayPath)) {
     try {
       execFileSync5("cp", ["-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
@@ -35097,7 +35750,7 @@ function createWorldOverlay(opts) {
       throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
     }
   }
-  if (!fs36.existsSync(overlayPath)) {
+  if (!fs38.existsSync(overlayPath)) {
     throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
   }
   const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
@@ -35111,9 +35764,9 @@ function createWorldOverlay(opts) {
 
 // ../core/dist/world/baseline-diff.js
 import { execFileSync as execFileSync6 } from "node:child_process";
-import * as fs37 from "node:fs";
+import * as fs39 from "node:fs";
 import * as os23 from "node:os";
-import * as path36 from "node:path";
+import * as path38 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 function expandHome2(p, homedir28) {
   return p.replace(/^~(?=$|\/|\\)/, homedir28());
@@ -35140,9 +35793,9 @@ ${stderr}`;
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
   const homedir28 = deps.homedir ?? (() => os23.homedir());
-  const baselineDir = path36.join(workspacePath, ".olam", "baseline");
+  const baselineDir = path38.join(workspacePath, ".olam", "baseline");
   try {
-    fs37.mkdirSync(baselineDir, { recursive: true });
+    fs39.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -35154,9 +35807,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path36.join(baselineDir, filename);
+    const outPath = path38.join(baselineDir, filename);
     const repoPath = expandHome2(repo.path, homedir28);
-    if (!fs37.existsSync(repoPath)) {
+    if (!fs39.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -35223,7 +35876,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs37.writeFileSync(outPath, content);
+    fs39.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -35231,8 +35884,8 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path36.join(workspacePath, repo.name);
-    if (!fs37.existsSync(worktreePath))
+    const worktreePath = path38.join(workspacePath, repo.name);
+    if (!fs39.existsSync(worktreePath))
       continue;
     try {
       execFileSync6("git", ["checkout", "--", "."], {
@@ -35292,20 +35945,20 @@ function extractStderr(err) {
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
   const homedir28 = deps.homedir ?? (() => os23.homedir());
-  const existsSync43 = deps.existsSync ?? ((p) => fs37.existsSync(p));
-  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs37.copyFileSync(src, dest));
-  const mkdirSync28 = deps.mkdirSync ?? ((dirPath, opts) => {
-    fs37.mkdirSync(dirPath, opts);
+  const existsSync46 = deps.existsSync ?? ((p) => fs39.existsSync(p));
+  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs39.copyFileSync(src, dest));
+  const mkdirSync29 = deps.mkdirSync ?? ((dirPath, opts) => {
+    fs39.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
     const repoPath = expandHome2(repo.path, homedir28);
-    const worktreePath = path36.join(workspacePath, repo.name);
-    if (!existsSync43(repoPath))
+    const worktreePath = path38.join(workspacePath, repo.name);
+    if (!existsSync46(repoPath))
       continue;
-    if (!existsSync43(worktreePath)) {
+    if (!existsSync46(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -35363,12 +36016,12 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
       }
     }
     for (const rel of plan.diff.untracked) {
-      const src = path36.join(plan.repoPath, rel);
-      const dest = path36.join(plan.worktreePath, rel);
-      if (!existsSync43(src))
+      const src = path38.join(plan.repoPath, rel);
+      const dest = path38.join(plan.worktreePath, rel);
+      if (!existsSync46(src))
         continue;
       try {
-        mkdirSync28(path36.dirname(dest), { recursive: true });
+        mkdirSync29(path38.dirname(dest), { recursive: true });
         copyFileSync9(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -35394,8 +36047,8 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs38 from "node:fs";
-import * as path37 from "node:path";
+import * as fs40 from "node:fs";
+import * as path39 from "node:path";
 
 // ../core/dist/world/templates/_generated.js
 var GH_PR_CREATE = '# Creating PRs from inside an Olam world\n\n## The problem\n\nCalling `gh pr create` directly inside an Olam container **hangs forever** on a\nTTY confirmation prompt that the agent cannot answer. This is a known, reproduced issue.\n\n## The fix\n\nAlways use this exact pattern:\n\n```bash\necho y | timeout 30 gh pr create \\\n  --base main \\\n  --head <branch> \\\n  --title "<title>" \\\n  --body-file /tmp/pr-body.md\n```\n\n## Why each part matters\n\n- **`echo y |`** \u2014 answers the "Submit?" confirmation prompt up front so `gh` never pauses.\n- **`timeout 30`** \u2014 hard deadline. If `gh` hangs anyway, the command exits non-zero so the\n  agent can react instead of stalling the world indefinitely.\n- **`--body-file /tmp/pr-body.md`** \u2014 write the PR body to a temp file first. Avoids\n  shell-escaping bugs that occur with `--body "..."` for long or multi-line bodies.\n- **`--head` and `--base` explicitly** \u2014 removes all interactive prompts; `gh` has nothing to ask.\n\n## Troubleshooting\n\n**"no commits" or "branch not found" error:**\n\n```bash\ngit push -u origin <branch>\n# then retry:\necho y | timeout 30 gh pr create --base main --head <branch> --title "..." --body-file /tmp/pr-body.md\n```\n\n**Timeout exceeded (command exits 124):**\n\n- Check if the branch was pushed: `git log origin/<branch> --oneline -1`\n- Check GitHub CLI auth: `gh auth status`\n- Retry once; if it hangs again, open the PR via the GitHub web UI.\n';
@@ -35405,10 +36058,10 @@ var WORLD_CLAUDE_MD = '# Olam World: {{worldName}}\n\n{{taskBlock}}\n\n## Enviro
 // ../core/dist/world/context-injection.js
 function injectWorldContext(opts) {
   const { world } = opts;
-  const claudeDir2 = path37.join(world.workspacePath, ".claude");
-  fs38.mkdirSync(claudeDir2, { recursive: true });
+  const claudeDir2 = path39.join(world.workspacePath, ".claude");
+  fs40.mkdirSync(claudeDir2, { recursive: true });
   const content = WORLD_CLAUDE_MD.replace("{{worldName}}", world.name).replace("{{worldId}}", world.id).replace("{{branch}}", world.branch).replace("{{taskBlock}}", buildTaskBlock(opts)).replace("{{reposList}}", buildReposList(world)).replace("{{servicesLine}}", buildServicesLine(opts.services)).replace("{{pleriPlaneLine}}", buildPleriPlaneLine(opts.pleriPlaneUrl)).replace("{{planFileBlock}}", buildPlanFileBlock(world)).replace("{{extraContextBlock}}", buildExtraContextBlock(opts.claudeMdExtra));
-  fs38.writeFileSync(path37.join(claudeDir2, "CLAUDE.md"), content);
+  fs40.writeFileSync(path39.join(claudeDir2, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function buildTaskBlock(opts) {
@@ -35482,10 +36135,10 @@ function buildExtraContextBlock(extra) {
 ${extra}`;
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path37.join(workspacePath, ".olam", "docs");
-  fs38.mkdirSync(docsDir, { recursive: true });
-  fs38.writeFileSync(path37.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
-  fs38.writeFileSync(path37.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
+  const docsDir = path39.join(workspacePath, ".olam", "docs");
+  fs40.mkdirSync(docsDir, { recursive: true });
+  fs40.writeFileSync(path39.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
+  fs40.writeFileSync(path39.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -35499,9 +36152,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path37.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path39.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs38.existsSync(plansDir) && fs38.readdirSync(plansDir).length > 0;
+    return fs40.existsSync(plansDir) && fs40.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -36073,25 +36726,25 @@ init_repo_manifest();
 
 // ../core/dist/world/snapshot.js
 import * as crypto7 from "node:crypto";
-import * as fs39 from "node:fs";
+import * as fs41 from "node:fs";
 import * as os24 from "node:os";
-import * as path38 from "node:path";
+import * as path40 from "node:path";
 import { execFileSync as execFileSync7, spawn as spawn2 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path38.join(os24.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path40.join(os24.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDirByWorkspace(workspace, arch, kind) {
-  return path38.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
+  return path40.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path38.join(snapshotsDir(), worldId);
+  const legacyDir = path40.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs39.existsSync(legacyDir))
+  if (!fs41.existsSync(legacyDir))
     return;
   try {
-    fs39.rmSync(legacyDir, { recursive: true, force: true });
+    fs41.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -36110,11 +36763,11 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path38.join(repoDir, "Gemfile.lock");
-  if (!fs39.existsSync(lockfile))
+  const lockfile = path40.join(repoDir, "Gemfile.lock");
+  if (!fs41.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs39.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs41.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -36124,10 +36777,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path38.join(repoDir, name);
-    if (fs39.existsSync(lockfile)) {
+    const lockfile = path40.join(repoDir, name);
+    if (fs41.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs39.readFileSync(lockfile) }
+        { path: name, content: fs41.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -36146,18 +36799,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path38.dirname(destDir);
-  fs39.mkdirSync(parent, { recursive: true });
+  const parent = path40.dirname(destDir);
+  fs41.mkdirSync(parent, { recursive: true });
   const tmpSuffix = `.tmp-${process.pid}-${crypto7.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs39.mkdirSync(tmpDir, { recursive: true });
+    fs41.mkdirSync(tmpDir, { recursive: true });
     execFileSync7("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs39.renameSync(tmpDir, destDir);
+    fs41.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs39.rmSync(tmpDir, { recursive: true, force: true });
+      fs41.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -36168,12 +36821,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path38.resolve(base, target);
-  const baseResolved = path38.resolve(base);
-  const rel = path38.relative(baseResolved, resolved);
+  const resolved = path40.resolve(base, target);
+  const baseResolved = path40.resolve(base);
+  const rel = path40.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path38.isAbsolute(rel);
+  return !rel.startsWith("..") && !path40.isAbsolute(rel);
 }
 var TYPE_CHAR_TO_TYPE = {
   "-": "file",
@@ -36223,7 +36876,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs39.readFileSync(tarPath));
+    raw = gunzipSync(fs41.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -36238,7 +36891,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path38.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path40.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -36276,7 +36929,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path38.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path40.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -36284,8 +36937,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path38.join(targetDir, path38.dirname(entry.name));
-      if (path38.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path38.join(path38.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path40.join(targetDir, path40.dirname(entry.name));
+      if (path40.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path40.join(path40.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -36295,7 +36948,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path38.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path40.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -36328,8 +36981,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path38.join(archDir, tarFilename);
-      if (!fs39.existsSync(tarPath)) {
+      const tarPath = path40.join(archDir, tarFilename);
+      if (!fs41.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -36344,9 +36997,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path38.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path40.join(repo.worktreeDir, targetSubpath);
       try {
-        fs39.rmSync(targetDir, { recursive: true, force: true });
+        fs41.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -36359,8 +37012,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs39.rmSync(tarPath, { force: true });
-          fs39.rmSync(manifestPath(tarPath), { force: true });
+          fs41.rmSync(tarPath, { force: true });
+          fs41.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -36376,10 +37029,10 @@ function restoreSnapshotsForRepos(input) {
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs39.existsSync(mPath))
+  if (!fs41.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs39.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs41.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
@@ -36394,17 +37047,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs39.mkdirSync(dir, { recursive: true });
-  const lockPath = path38.join(dir, EVICT_LOCK_FILENAME);
+  fs41.mkdirSync(dir, { recursive: true });
+  const lockPath = path40.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs39.openSync(lockPath, fs39.constants.O_WRONLY | fs39.constants.O_CREAT | fs39.constants.O_EXCL, 384);
+    fd = fs41.openSync(lockPath, fs41.constants.O_WRONLY | fs41.constants.O_CREAT | fs41.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs39.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs41.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -36412,23 +37065,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs39.unlinkSync(lockPath);
-      fd = fs39.openSync(lockPath, fs39.constants.O_WRONLY | fs39.constants.O_CREAT | fs39.constants.O_EXCL, 384);
+      fs41.unlinkSync(lockPath);
+      fd = fs41.openSync(lockPath, fs41.constants.O_WRONLY | fs41.constants.O_CREAT | fs41.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs39.writeSync(fd, `${process.pid}
+    fs41.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs39.closeSync(fd);
+    fs41.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs39.unlinkSync(lockPath);
+      fs41.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -36461,16 +37114,16 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs39.existsSync(dir))
+  if (!fs41.existsSync(dir))
     return 0;
   const allTars = [];
   const walk = (d) => {
-    for (const entry of fs39.readdirSync(d, { withFileTypes: true })) {
-      const full = path38.join(d, entry.name);
+    for (const entry of fs41.readdirSync(d, { withFileTypes: true })) {
+      const full = path40.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat = fs39.statSync(full);
+        const stat = fs41.statSync(full);
         allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
       }
     }
@@ -36485,8 +37138,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs39.rmSync(tar.path, { force: true });
-    fs39.rmSync(manifestPath(tar.path), { force: true });
+    fs41.rmSync(tar.path, { force: true });
+    fs41.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -36603,14 +37256,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 
 // ../core/dist/world/olam-yaml.js
 init_repo_manifest();
-import * as path39 from "node:path";
+import * as path41 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path39.join(workspacePath, repo.name);
+    const repoDir = path41.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -36625,10 +37278,10 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs40 from "node:fs";
-import * as path40 from "node:path";
+import * as fs42 from "node:fs";
+import * as path42 from "node:path";
 import { parse as parseYaml4 } from "yaml";
-function parseFrontmatter(content) {
+function parseFrontmatter2(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
   if (!match)
     return null;
@@ -36646,21 +37299,21 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path40.join(workspaceRoot, ".olam", "policies");
-  if (!fs40.existsSync(policiesDir))
+  const policiesDir = path42.join(workspaceRoot, ".olam", "policies");
+  if (!fs42.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs40.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs42.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path40.join(policiesDir, file);
+    const filePath = path42.join(policiesDir, file);
     try {
-      const content = fs40.readFileSync(filePath, "utf8");
-      const parsed = parseFrontmatter(content);
+      const content = fs42.readFileSync(filePath, "utf8");
+      const parsed = parseFrontmatter2(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
         continue;
@@ -36742,7 +37395,7 @@ var TaskDispatchError = class extends Error {
     this.name = "TaskDispatchError";
   }
 };
-var DEFAULT_SLEEP = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
+var DEFAULT_SLEEP = (ms) => new Promise((resolve14) => setTimeout(resolve14, ms));
 async function probeHealth(containerName, dockerExec, budgetMs, sleep5) {
   const deadline = Date.now() + budgetMs;
   const cadenceMs = 100;
@@ -36806,12 +37459,12 @@ init_store();
 init_bridge();
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs41 from "node:fs";
+import * as fs43 from "node:fs";
 import * as os25 from "node:os";
-import * as path41 from "node:path";
+import * as path43 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path41.join(os25.homedir(), p.slice(1));
+    return path43.join(os25.homedir(), p.slice(1));
   }
   return p;
 }
@@ -36823,7 +37476,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs41.existsSync(resolvedPath)) {
+    if (!fs43.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -36839,19 +37492,19 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
 init_port_validator();
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs42 from "node:fs";
-import * as path42 from "node:path";
+import * as fs44 from "node:fs";
+import * as path44 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path42.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path42.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path42.dirname(destAbs);
-    fs42.mkdirSync(destDir, { recursive: true });
-    fs42.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path44.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path44.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path44.dirname(destAbs);
+    fs44.mkdirSync(destDir, { recursive: true });
+    fs44.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -37487,7 +38140,7 @@ ${detail}`);
       runbookSeeds = resolved.seeds;
     }
     const worldId = generateWorldId();
-    const workspacePath = path43.join(os26.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path45.join(os26.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = this.resolveReposWithWorkspace(opts);
@@ -37569,37 +38222,37 @@ ${detail}`);
       if (!repo.path)
         continue;
       const sourceRoot = repo.path.replace(/^~/, os26.homedir());
-      const worktreeRoot = path43.join(workspacePath, repo.name);
-      if (!fs43.existsSync(sourceRoot) || !fs43.existsSync(worktreeRoot))
+      const worktreeRoot = path45.join(workspacePath, repo.name);
+      if (!fs45.existsSync(sourceRoot) || !fs45.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path43.dirname(pattern), path43.basename(pattern)];
-          const sourceDir = path43.join(sourceRoot, dir);
-          if (fs43.existsSync(sourceDir)) {
+          const [dir, glob] = [path45.dirname(pattern), path45.basename(pattern)];
+          const sourceDir = path45.join(sourceRoot, dir);
+          if (fs45.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs43.readdirSync(sourceDir)) {
+              for (const entry of fs45.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path43.join(dir, entry));
+                  matches2.push(path45.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs43.existsSync(path43.join(sourceRoot, pattern))) {
+        } else if (fs45.existsSync(path45.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path43.join(sourceRoot, rel);
-          const dst = path43.join(worktreeRoot, rel);
+          const src = path45.join(sourceRoot, rel);
+          const dst = path45.join(worktreeRoot, rel);
           try {
-            const st = fs43.statSync(src);
+            const st = fs45.statSync(src);
             if (!st.isFile())
               continue;
-            fs43.mkdirSync(path43.dirname(dst), { recursive: true });
-            fs43.copyFileSync(src, dst);
+            fs45.mkdirSync(path45.dirname(dst), { recursive: true });
+            fs45.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -37685,7 +38338,7 @@ ${detail}`);
     }
     const overlayAttachments = [];
     for (const repo of repos) {
-      const worldClonePath = path43.join(workspacePath, repo.name);
+      const worldClonePath = path45.join(workspacePath, repo.name);
       try {
         const result = createWorldOverlay({
           workspace: repo.name,
@@ -37740,7 +38393,7 @@ ${detail}`);
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path43.join(workspacePath, repo.name);
+          const repoDir = path45.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -37784,10 +38437,10 @@ ${detail}`);
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path43.join(os26.homedir(), ".olam", "r2-credentials.json");
-      if (fs43.existsSync(r2CredsPath)) {
+      const r2CredsPath = path45.join(os26.homedir(), ".olam", "r2-credentials.json");
+      if (fs45.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs43.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs45.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -37804,10 +38457,10 @@ ${detail}`);
         } catch {
         }
       }
-      const keysYamlPath = path43.join(os26.homedir(), ".olam", "keys.yaml");
-      if (fs43.existsSync(keysYamlPath)) {
+      const keysYamlPath = path45.join(os26.homedir(), ".olam", "keys.yaml");
+      if (fs45.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs43.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs45.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const parsed = YAML3.parse(keysRaw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -37866,10 +38519,10 @@ ${detail}`);
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path43.join(workspacePath, repoName, relativePath);
+          const absPath = path45.join(workspacePath, repoName, relativePath);
           try {
-            fs43.mkdirSync(path43.dirname(absPath), { recursive: true });
-            fs43.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs45.mkdirSync(path45.dirname(absPath), { recursive: true });
+            fs45.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -38046,7 +38699,7 @@ ${detail}`);
         imageDigest: void 0,
         repos: enrichedRepos.map((r) => ({
           name: r.name,
-          worktreeDir: path43.join(workspacePath, r.name)
+          worktreeDir: path45.join(workspacePath, r.name)
         }))
       });
       for (const out of restoreResult.outcomes) {
@@ -38152,7 +38805,7 @@ ${detail}`);
     }
     if (opts.task) {
       const allPolicies = repos.flatMap((repo) => {
-        const repoWorktree = path43.join(workspacePath, repo.name);
+        const repoWorktree = path45.join(workspacePath, repo.name);
         try {
           return loadPolicies(repoWorktree);
         } catch (err) {
@@ -38165,8 +38818,8 @@ ${detail}`);
         try {
           execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
           for (const repo of repos) {
-            const policiesDir = path43.join(workspacePath, repo.name, ".olam", "policies");
-            if (fs43.existsSync(policiesDir)) {
+            const policiesDir = path45.join(workspacePath, repo.name, ".olam", "policies");
+            if (fs45.existsSync(policiesDir)) {
               execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
             }
           }
@@ -38274,8 +38927,8 @@ ${detail}`);
     } catch {
     }
     try {
-      fs43.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs43.existsSync(world.workspacePath)) {
+      fs45.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs45.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -38384,14 +39037,14 @@ ${detail}`);
     }).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs43.readFileSync(planFilePath, "utf-8");
-    const planFileName = path43.basename(planFilePath);
+    const planContent = fs45.readFileSync(planFilePath, "utf-8");
+    const planFileName = path45.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path43.join(workspacePath, targetRepo, "docs", "plans");
-    fs43.mkdirSync(plansDir, { recursive: true });
-    fs43.writeFileSync(path43.join(plansDir, planFileName), planContent);
+    const plansDir = path45.join(workspacePath, targetRepo, "docs", "plans");
+    fs45.mkdirSync(plansDir, { recursive: true });
+    fs45.writeFileSync(path45.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -38825,8 +39478,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs44 from "node:fs";
-import * as path44 from "node:path";
+import * as fs46 from "node:fs";
+import * as path46 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -39161,7 +39814,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs44.existsSync(dbPath))
+  if (!fs46.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -39332,13 +39985,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port: port2, registry: registry2 } = opts;
-  const thisDir = path44.dirname(fileURLToPath3(import.meta.url));
-  const defaultPublicDir = path44.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path46.dirname(fileURLToPath3(import.meta.url));
+  const defaultPublicDir = path46.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs44.existsSync(publicDir);
+  let hasPublicDir = fs46.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs44.existsSync(publicDir);
+      hasPublicDir = fs46.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port2}`;
     const url2 = new URL(req.url ?? "/", `http://${host}`);
@@ -39612,22 +40265,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path44.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path46.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs44.existsSync(filePath) && fs44.statSync(filePath).isFile()) {
-      const ext = path44.extname(filePath);
+    if (fs46.existsSync(filePath) && fs46.statSync(filePath).isFile()) {
+      const ext = path46.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs44.createReadStream(filePath).pipe(res);
+      fs46.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path44.join(publicDir, "index.html");
-    if (fs44.existsSync(filePath)) {
+    filePath = path46.join(publicDir, "index.html");
+    if (fs46.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs44.createReadStream(filePath).pipe(res);
+      fs46.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -39637,17 +40290,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs45 from "node:fs";
+import * as fs47 from "node:fs";
 import * as os27 from "node:os";
-import * as path45 from "node:path";
-var STATE_PATH = path45.join(os27.homedir(), ".olam", "dashboard.json");
+import * as path47 from "node:path";
+var STATE_PATH = path47.join(os27.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs45.mkdirSync(path45.dirname(STATE_PATH), { recursive: true });
-  fs45.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs47.mkdirSync(path47.dirname(STATE_PATH), { recursive: true });
+  fs47.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs45.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs47.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -39655,7 +40308,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs45.unlinkSync(STATE_PATH);
+    fs47.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -39684,7 +40337,7 @@ function isCloudflaredAvailable() {
   }
 }
 function startTunnel(port2) {
-  return new Promise((resolve13, reject2) => {
+  return new Promise((resolve14, reject2) => {
     const child = spawn3("cloudflared", ["tunnel", "--url", `http://localhost:${port2}`], {
       stdio: ["ignore", "pipe", "pipe"],
       detached: false
@@ -39706,7 +40359,7 @@ function startTunnel(port2) {
       if (match) {
         resolved = true;
         clearTimeout(timeout);
-        resolve13(match[0]);
+        resolve14(match[0]);
       }
     }
     child.stdout?.on("data", scan);
@@ -39774,8 +40427,8 @@ var DashboardManager = class {
       }
       throw err;
     }
-    await new Promise((resolve13, reject2) => {
-      this.server.on("listening", resolve13);
+    await new Promise((resolve14, reject2) => {
+      this.server.on("listening", resolve14);
       this.server.on("error", reject2);
     });
     this.info = { localUrl: `http://localhost:${port2}` };
@@ -39821,8 +40474,8 @@ var DashboardManager = class {
   async stop() {
     stopTunnel();
     if (this.server) {
-      await new Promise((resolve13) => {
-        this.server.close(() => resolve13());
+      await new Promise((resolve14) => {
+        this.server.close(() => resolve14());
       });
       this.server = null;
     }
@@ -39935,8 +40588,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync33, existsSync as existsSync42, statSync as statSync12 } from "node:fs";
-import { join as join46, dirname as dirname28, resolve as resolve12 } from "node:path";
+import { readFileSync as readFileSync36, existsSync as existsSync45, statSync as statSync14 } from "node:fs";
+import { join as join48, dirname as dirname28, resolve as resolve13 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -39944,16 +40597,16 @@ var PROJECT_MARKERS = [
   "olam.yml"
 ];
 function findProjectRoot2(startDir) {
-  let dir = resolve12(startDir);
-  const root = resolve12("/");
+  let dir = resolve13(startDir);
+  const root = resolve13("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync42(join46(dir, marker))) return dir;
+      if (existsSync45(join48(dir, marker))) return dir;
     }
-    const pkg = join46(dir, "package.json");
-    if (existsSync42(pkg)) {
+    const pkg = join48(dir, "package.json");
+    if (existsSync45(pkg)) {
       try {
-        const json = JSON.parse(readFileSync33(pkg, "utf8"));
+        const json = JSON.parse(readFileSync36(pkg, "utf8"));
         const isOlamWorkspace = typeof json.name === "string" && json.name.startsWith("@olam/");
         const hasOlamDep = json.dependencies && Object.keys(json.dependencies).some((k) => k.startsWith("@olam/")) || json.devDependencies && Object.keys(json.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
@@ -39965,9 +40618,9 @@ function findProjectRoot2(startDir) {
     dir = parent;
   }
 }
-function parseEnvFile(path46) {
+function parseEnvFile(path48) {
   const out = {};
-  const raw = readFileSync33(path46, "utf8");
+  const raw = readFileSync36(path48, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -39990,8 +40643,8 @@ function loadProjectEnv(startDir = process.cwd()) {
   const filesRead = [];
   const merged = {};
   for (const name of [".env", ".env.local"]) {
-    const p = join46(root, name);
-    if (existsSync42(p) && statSync12(p).isFile()) {
+    const p = join48(root, name);
+    if (existsSync45(p) && statSync14(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }