@pleri/olam-cli 0.1.162 → 0.1.167

package/dist/mcp-server.js

@@ -445,8 +445,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path49, errorMaps, issueData } = params;
-      const fullPath = [...path49, ...issueData.path || []];
+      const { data, path: path52, errorMaps, issueData } = params;
+      const fullPath = [...path52, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -754,11 +754,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path49, key) {
+      constructor(parent, value, path52, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path49;
+        this._path = path52;
         this._key = key;
       }
       get path() {
@@ -7332,8 +7332,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path49) {
-      let input = path49;
+    function removeDotSegments(path52) {
+      let input = path52;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -7532,8 +7532,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path49, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path49 && path49 !== "/" ? path49 : void 0;
+        const [path52, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path52 && path52 !== "/" ? path52 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -10895,12 +10895,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs49, exportName) {
+    function addFormats(ajv, list, fs51, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs49[f]);
+        ajv.addFormat(f, fs51[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -11008,7 +11008,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path49, ctx, rejectSource) {
+function refineForbiddenKeys(value, path52, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -11016,12 +11016,12 @@ function refineForbiddenKeys(value, path49, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path49, key],
+        path: [...path52, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path49.length === 0 && key === "source") {
+    if (rejectSource && path52.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -11029,21 +11029,21 @@ function refineForbiddenKeys(value, path49, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path49, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path52, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path49, rejectSource) {
+function rejectForbiddenKeys(value, path52, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path49}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path52}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path49}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path52}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path49}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path52}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -11920,7 +11920,19 @@ var init_schema3 = __esm({
        * use canonical names; `olam flywheel migrate-overlays --push` enforces
        * this via the reverse validator.
        */
-      prefix: external_exports.string().regex(PREFIX_PATTERN, "skill-source prefix must be ASCII lowercase + digits + dash/underscore (1-39 chars, no leading/trailing dash)").optional()
+      prefix: external_exports.string().regex(PREFIX_PATTERN, "skill-source prefix must be ASCII lowercase + digits + dash/underscore (1-39 chars, no leading/trailing dash)").optional(),
+      /**
+       * Which artifact kinds get renamed when `prefix` is set. Optional; defaults
+       * to `['skill', 'agent']` for back-compat with the original Phase A semantic
+       * (Decision 6 in docs/decisions/019-skill-prefix-rules.md). Operators who
+       * want to rebrand ONLY skills (keeping `@architect` etc. canonical) set
+       * `['skill']`; ones who want only agents set `['agent']`.
+       *
+       * Empty array `[]` = same as omitting `prefix` entirely (no renaming).
+       *
+       * NOT applicable when `prefix` is undefined.
+       */
+      prefixScope: external_exports.array(external_exports.enum(["skill", "agent"])).optional()
     });
   }
 });
@@ -12568,29 +12580,26 @@ function updateSkillSource(id, patch) {
     }
   }
   const existing = config2.skillSources[idx];
-  let prefixUpdate = {};
+  let working = { ...existing };
   if (patch.prefix === null) {
-    const { prefix: _dropped, ...rest } = existing;
-    void _dropped;
-    const updated2 = {
-      ...rest,
-      ...patch.name !== void 0 ? { name: patch.name } : {},
-      ...patch.branch !== void 0 ? { branch: patch.branch } : {},
-      ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {}
-    };
-    const next2 = [...config2.skillSources];
-    next2[idx] = updated2;
-    writeGlobalConfig({ ...config2, skillSources: next2 });
-    return updated2;
+    const { prefix: _p, ...rest } = working;
+    void _p;
+    working = rest;
   } else if (patch.prefix !== void 0) {
-    prefixUpdate = { prefix: patch.prefix };
+    working = { ...working, prefix: patch.prefix };
+  }
+  if (patch.prefixScope === null) {
+    const { prefixScope: _s, ...rest } = working;
+    void _s;
+    working = rest;
+  } else if (patch.prefixScope !== void 0) {
+    working = { ...working, prefixScope: [...patch.prefixScope] };
   }
   const updated = {
-    ...existing,
+    ...working,
     ...patch.name !== void 0 ? { name: patch.name } : {},
     ...patch.branch !== void 0 ? { branch: patch.branch } : {},
-    ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {},
-    ...prefixUpdate
+    ...patch.lastPulledSha !== void 0 ? { lastPulledSha: patch.lastPulledSha } : {}
   };
   const next = [...config2.skillSources];
   next[idx] = updated;
@@ -13404,7 +13413,7 @@ function detectCollisions(artifacts) {
   }
   return { winners, collisions };
 }
-function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences) {
+function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences, expectedAgentWinnerNames) {
   const shadowBackups = [];
   for (const bucket of BUCKETS) {
     const dir = path21.join(claude, bucket);
@@ -13438,8 +13447,11 @@ function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences) {
           }
           fs20.unlinkSync(p);
         } else if (bucket === "agents" && stat.isFile() && !name.includes(".shadow-backup-")) {
-          const backup = shadowBackup(p);
-          shadowBackups.push(backup);
+          const hasWinner = expectedAgentWinnerNames !== void 0 ? expectedAgentWinnerNames.has(name) : true;
+          if (hasWinner) {
+            const backup = shadowBackup(p);
+            shadowBackups.push(backup);
+          }
         }
       } catch {
       }
@@ -13479,8 +13491,9 @@ function deployArtifacts(artifacts, opts) {
   for (const bucket of BUCKETS) {
     fs20.mkdirSync(path21.join(claude, bucket), { recursive: true });
   }
-  const sweepShadowBackups = cleanManagedSymlinks(claude, opts?.installedOlamVersion, opts?.overlayReferences);
   const { winners, collisions } = detectCollisions(artifacts);
+  const expectedAgentWinnerNames = new Set(winners.filter((a) => a.kind === "agent").map((a) => a.deployBasename));
+  const sweepShadowBackups = cleanManagedSymlinks(claude, opts?.installedOlamVersion, opts?.overlayReferences, expectedAgentWinnerNames);
   const result = { linked: 0, shadowBackups: [...sweepShadowBackups], collisions };
   for (const artifact of winners) {
     const bucket = bucketFor(artifact.kind);
@@ -14945,15 +14958,18 @@ import * as fs30 from "node:fs";
 import * as path29 from "node:path";
 function buildSourcePrefixMap(sources) {
   const byId = /* @__PURE__ */ new Map();
+  const scopeById = /* @__PURE__ */ new Map();
   const prefixes = /* @__PURE__ */ new Set();
   for (const s of sources) {
     if (s.prefix !== void 0 && s.prefix.length > 0) {
       byId.set(s.id, s.prefix);
+      scopeById.set(s.id, s.prefixScope ?? DEFAULT_SCOPE);
       prefixes.add(s.prefix);
     }
   }
   return {
     get: (sourceId) => byId.get(sourceId),
+    getScope: (sourceId) => scopeById.get(sourceId) ?? DEFAULT_SCOPE,
     registeredPrefixes: Array.from(prefixes)
   };
 }
@@ -14965,6 +14981,9 @@ function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir2, dryRun) {
     const prefix = sourceMap.get(artifact.sourceId);
     if (prefix === void 0)
       continue;
+    const scope = sourceMap.getScope(artifact.sourceId);
+    if (!scope.includes(artifact.kind))
+      continue;
     const canonical = artifact.deployBasename;
     const otherPrefixes = sourceMap.registeredPrefixes.filter((p) => p !== prefix);
     const renamed = applyPrefix(canonical, prefix, otherPrefixes);
@@ -15031,11 +15050,13 @@ function detectPrefixCollisions(sources) {
   }
   return collisions;
 }
+var DEFAULT_SCOPE;
 var init_prefix_deploy = __esm({
   "../core/dist/skill-sync/prefix-deploy.js"() {
     "use strict";
     init_prefix_rules();
     init_managed_merge();
+    DEFAULT_SCOPE = ["skill", "agent"];
   }
 });
 
@@ -15917,6 +15938,9 @@ var init_global_config = __esm({
   }
 });
 
+// ../mcp-server/src/redirect-stdout-to-stderr.ts
+console.log = console.error;
+
 // ../../node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process3 from "node:process";
 
@@ -16160,10 +16184,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path49) {
-  if (!path49)
+function getElementAtPath(obj, path52) {
+  if (!path52)
     return obj;
-  return path49.reduce((acc, key) => acc?.[key], obj);
+  return path52.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -16572,11 +16596,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path49, issues) {
+function prefixIssues(path52, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path49);
+    iss.path.unshift(path52);
     return iss;
   });
 }
@@ -16723,16 +16747,16 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
 }
 function formatError(error2, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error3, path49 = []) => {
+  const processError = (error3, path52 = []) => {
     for (const issue2 of error3.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path49, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path49, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path49, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else {
-        const fullpath = [...path49, ...issue2.path];
+        const fullpath = [...path52, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -26155,6 +26179,228 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
+// ../../node_modules/@modelcontextprotocol/sdk/dist/esm/shared/uriTemplate.js
+var MAX_TEMPLATE_LENGTH = 1e6;
+var MAX_VARIABLE_LENGTH = 1e6;
+var MAX_TEMPLATE_EXPRESSIONS = 1e4;
+var MAX_REGEX_LENGTH = 1e6;
+var UriTemplate = class _UriTemplate {
+  /**
+   * Returns true if the given string contains any URI template expressions.
+   * A template expression is a sequence of characters enclosed in curly braces,
+   * like {foo} or {?bar}.
+   */
+  static isTemplate(str) {
+    return /\{[^}\s]+\}/.test(str);
+  }
+  static validateLength(str, max, context) {
+    if (str.length > max) {
+      throw new Error(`${context} exceeds maximum length of ${max} characters (got ${str.length})`);
+    }
+  }
+  get variableNames() {
+    return this.parts.flatMap((part) => typeof part === "string" ? [] : part.names);
+  }
+  constructor(template) {
+    _UriTemplate.validateLength(template, MAX_TEMPLATE_LENGTH, "Template");
+    this.template = template;
+    this.parts = this.parse(template);
+  }
+  toString() {
+    return this.template;
+  }
+  parse(template) {
+    const parts = [];
+    let currentText = "";
+    let i = 0;
+    let expressionCount = 0;
+    while (i < template.length) {
+      if (template[i] === "{") {
+        if (currentText) {
+          parts.push(currentText);
+          currentText = "";
+        }
+        const end = template.indexOf("}", i);
+        if (end === -1)
+          throw new Error("Unclosed template expression");
+        expressionCount++;
+        if (expressionCount > MAX_TEMPLATE_EXPRESSIONS) {
+          throw new Error(`Template contains too many expressions (max ${MAX_TEMPLATE_EXPRESSIONS})`);
+        }
+        const expr = template.slice(i + 1, end);
+        const operator = this.getOperator(expr);
+        const exploded = expr.includes("*");
+        const names = this.getNames(expr);
+        const name = names[0];
+        for (const name2 of names) {
+          _UriTemplate.validateLength(name2, MAX_VARIABLE_LENGTH, "Variable name");
+        }
+        parts.push({ name, operator, names, exploded });
+        i = end + 1;
+      } else {
+        currentText += template[i];
+        i++;
+      }
+    }
+    if (currentText) {
+      parts.push(currentText);
+    }
+    return parts;
+  }
+  getOperator(expr) {
+    const operators = ["+", "#", ".", "/", "?", "&"];
+    return operators.find((op) => expr.startsWith(op)) || "";
+  }
+  getNames(expr) {
+    const operator = this.getOperator(expr);
+    return expr.slice(operator.length).split(",").map((name) => name.replace("*", "").trim()).filter((name) => name.length > 0);
+  }
+  encodeValue(value, operator) {
+    _UriTemplate.validateLength(value, MAX_VARIABLE_LENGTH, "Variable value");
+    if (operator === "+" || operator === "#") {
+      return encodeURI(value);
+    }
+    return encodeURIComponent(value);
+  }
+  expandPart(part, variables) {
+    if (part.operator === "?" || part.operator === "&") {
+      const pairs = part.names.map((name) => {
+        const value2 = variables[name];
+        if (value2 === void 0)
+          return "";
+        const encoded2 = Array.isArray(value2) ? value2.map((v) => this.encodeValue(v, part.operator)).join(",") : this.encodeValue(value2.toString(), part.operator);
+        return `${name}=${encoded2}`;
+      }).filter((pair) => pair.length > 0);
+      if (pairs.length === 0)
+        return "";
+      const separator = part.operator === "?" ? "?" : "&";
+      return separator + pairs.join("&");
+    }
+    if (part.names.length > 1) {
+      const values2 = part.names.map((name) => variables[name]).filter((v) => v !== void 0);
+      if (values2.length === 0)
+        return "";
+      return values2.map((v) => Array.isArray(v) ? v[0] : v).join(",");
+    }
+    const value = variables[part.name];
+    if (value === void 0)
+      return "";
+    const values = Array.isArray(value) ? value : [value];
+    const encoded = values.map((v) => this.encodeValue(v, part.operator));
+    switch (part.operator) {
+      case "":
+        return encoded.join(",");
+      case "+":
+        return encoded.join(",");
+      case "#":
+        return "#" + encoded.join(",");
+      case ".":
+        return "." + encoded.join(".");
+      case "/":
+        return "/" + encoded.join("/");
+      default:
+        return encoded.join(",");
+    }
+  }
+  expand(variables) {
+    let result = "";
+    let hasQueryParam = false;
+    for (const part of this.parts) {
+      if (typeof part === "string") {
+        result += part;
+        continue;
+      }
+      const expanded = this.expandPart(part, variables);
+      if (!expanded)
+        continue;
+      if ((part.operator === "?" || part.operator === "&") && hasQueryParam) {
+        result += expanded.replace("?", "&");
+      } else {
+        result += expanded;
+      }
+      if (part.operator === "?" || part.operator === "&") {
+        hasQueryParam = true;
+      }
+    }
+    return result;
+  }
+  escapeRegExp(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+  partToRegExp(part) {
+    const patterns = [];
+    for (const name2 of part.names) {
+      _UriTemplate.validateLength(name2, MAX_VARIABLE_LENGTH, "Variable name");
+    }
+    if (part.operator === "?" || part.operator === "&") {
+      for (let i = 0; i < part.names.length; i++) {
+        const name2 = part.names[i];
+        const prefix = i === 0 ? "\\" + part.operator : "&";
+        patterns.push({
+          pattern: prefix + this.escapeRegExp(name2) + "=([^&]+)",
+          name: name2
+        });
+      }
+      return patterns;
+    }
+    let pattern;
+    const name = part.name;
+    switch (part.operator) {
+      case "":
+        pattern = part.exploded ? "([^/,]+(?:,[^/,]+)*)" : "([^/,]+)";
+        break;
+      case "+":
+      case "#":
+        pattern = "(.+)";
+        break;
+      case ".":
+        pattern = "\\.([^/,]+)";
+        break;
+      case "/":
+        pattern = "/" + (part.exploded ? "([^/,]+(?:,[^/,]+)*)" : "([^/,]+)");
+        break;
+      default:
+        pattern = "([^/]+)";
+    }
+    patterns.push({ pattern, name });
+    return patterns;
+  }
+  match(uri) {
+    _UriTemplate.validateLength(uri, MAX_TEMPLATE_LENGTH, "URI");
+    let pattern = "^";
+    const names = [];
+    for (const part of this.parts) {
+      if (typeof part === "string") {
+        pattern += this.escapeRegExp(part);
+      } else {
+        const patterns = this.partToRegExp(part);
+        for (const { pattern: partPattern, name } of patterns) {
+          pattern += partPattern;
+          names.push({ name, exploded: part.exploded });
+        }
+      }
+    }
+    pattern += "$";
+    _UriTemplate.validateLength(pattern, MAX_REGEX_LENGTH, "Generated regex pattern");
+    const regex = new RegExp(pattern);
+    const match = uri.match(regex);
+    if (!match)
+      return null;
+    const result = {};
+    for (let i = 0; i < names.length; i++) {
+      const { name, exploded } = names[i];
+      const value = match[i + 1];
+      const cleanName = name.replace("*", "");
+      if (exploded && value.includes(",")) {
+        result[cleanName] = value.split(",");
+      } else {
+        result[cleanName] = value;
+      }
+    }
+    return result;
+  }
+};
+
 // ../../node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
@@ -26944,6 +27190,30 @@ var McpServer = class {
     }
   }
 };
+var ResourceTemplate = class {
+  constructor(uriTemplate, _callbacks) {
+    this._callbacks = _callbacks;
+    this._uriTemplate = typeof uriTemplate === "string" ? new UriTemplate(uriTemplate) : uriTemplate;
+  }
+  /**
+   * Gets the URI template pattern.
+   */
+  get uriTemplate() {
+    return this._uriTemplate;
+  }
+  /**
+   * Gets the list callback, if one was provided.
+   */
+  get listCallback() {
+    return this._callbacks.list;
+  }
+  /**
+   * Gets the callback for completing a specific URI template variable, if one was provided.
+   */
+  completeCallback(variable) {
+    return this._callbacks.complete?.[variable];
+  }
+};
 var EMPTY_OBJECT_JSON_SCHEMA = {
   type: "object",
   properties: {}
@@ -27268,7 +27538,7 @@ function readSecretIfExists() {
 
 // ../core/dist/auth/client.js
 var DEFAULT_BASE_URL = "http://127.0.0.1:9999";
-var DEFAULT_TIMEOUT_MS = 3e3;
+var DEFAULT_TIMEOUT_MS = 1e4;
 var RETRY_COUNT = 2;
 var RETRY_BACKOFF_MS = 250;
 var AuthClient = class {
@@ -27371,8 +27641,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path49, body, attempt = 0) {
-    const url2 = `${this.baseUrl}${path49}`;
+  async request(method, path52, body, attempt = 0) {
+    const url2 = `${this.baseUrl}${path52}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -27390,7 +27660,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path49, body, attempt + 1);
+        return this.request(method, path52, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -28244,12 +28514,12 @@ function register3(server, _ctx, _initError) {
         registry2.close();
       }
       try {
-        const { default: fs49 } = await import("node:fs");
-        const { default: os28 } = await import("node:os");
-        const { default: path49 } = await import("node:path");
-        const tokenPath = path49.join(os28.homedir(), ".olam", "host-cp.token");
-        if (fs49.existsSync(tokenPath)) {
-          const token = fs49.readFileSync(tokenPath, "utf-8").trim();
+        const { default: fs51 } = await import("node:fs");
+        const { default: os31 } = await import("node:os");
+        const { default: path52 } = await import("node:path");
+        const tokenPath = path52.join(os31.homedir(), ".olam", "host-cp.token");
+        if (fs51.existsSync(tokenPath)) {
+          const token = fs51.readFileSync(tokenPath, "utf-8").trim();
           await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -28669,10 +28939,10 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path49) {
-  if (!existsSync6(path49)) return null;
+function readOptional(path52) {
+  if (!existsSync6(path52)) return null;
   try {
-    return readFileSync5(path49, "utf8");
+    return readFileSync5(path52, "utf8");
   } catch {
     return null;
   }
@@ -30118,8 +30388,8 @@ var CloudflareProvider = class extends ComputeProvider {
   // -----------------------------------------------------------------------
   // Internal fetch helper
   // -----------------------------------------------------------------------
-  async request(path49, method, body) {
-    const url2 = `${this.config.workerUrl}${path49}`;
+  async request(path52, method, body) {
+    const url2 = `${this.config.workerUrl}${path52}`;
     const bearer = await this.config.mintToken();
     const headers = {
       Authorization: `Bearer ${bearer}`
@@ -32570,10 +32840,10 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path49 = join13(args.outDir, "manifest.json");
-  await writeFile(path49, `${JSON.stringify(manifest, null, 2)}
+  const path52 = join13(args.outDir, "manifest.json");
+  await writeFile(path52, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path49, manifest };
+  return { path: path52, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
@@ -32827,9 +33097,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path49 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path49))) {
-        return httpReject(403, "outside_allow_list", { path: path49 });
+      const path52 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path52))) {
+        return httpReject(403, "outside_allow_list", { path: path52 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -33608,14 +33878,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path49 = join14(outDir, `${shot.name}.${ext}`);
+    const path52 = join14(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path49,
+      path: path52,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path49, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path52, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -34059,12 +34329,12 @@ function openUrl(url2) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs49 } = await import("node:fs");
-    const { default: os28 } = await import("node:os");
-    const { default: path49 } = await import("node:path");
-    const tp = path49.join(os28.homedir(), ".olam", "host-cp.token");
-    if (!fs49.existsSync(tp)) return { token: null };
-    return { token: fs49.readFileSync(tp, "utf-8").trim() };
+    const { default: fs51 } = await import("node:fs");
+    const { default: os31 } = await import("node:os");
+    const { default: path52 } = await import("node:path");
+    const tp = path52.join(os31.homedir(), ".olam", "host-cp.token");
+    if (!fs51.existsSync(tp)) return { token: null };
+    return { token: fs51.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -34324,9 +34594,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("Optional human-readable description."),
       defaultBranch: external_exports.string().optional().describe("Default branch name (e.g. main).")
     },
-    async ({ name, path: path49, description, defaultBranch }) => {
+    async ({ name, path: path52, description, defaultBranch }) => {
       try {
-        const entry = addRepo({ name, path: path49, description, defaultBranch });
+        const entry = addRepo({ name, path: path52, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -34367,9 +34637,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("New description."),
       defaultBranch: external_exports.string().optional().describe("New default branch.")
     },
-    async ({ name, path: path49, description, defaultBranch }) => {
+    async ({ name, path: path52, description, defaultBranch }) => {
       try {
-        const entry = updateRepo(name, { path: path49, description, defaultBranch });
+        const entry = updateRepo(name, { path: path52, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -34941,10 +35211,196 @@ function register26(server, _ctx, _initError) {
   );
 }
 
+// ../mcp-server/src/tools/skills-search.ts
+var skills_search_exports = {};
+__export(skills_search_exports, {
+  register: () => register27
+});
+init_v3();
+import * as path36 from "node:path";
+import * as os22 from "node:os";
+
+// ../mcp-server/src/lib/skills-index.mjs
+import { createRequire as createRequire4 } from "node:module";
+import * as fs36 from "node:fs";
+import * as path35 from "node:path";
+import * as os21 from "node:os";
+var VECTOR_DIM = 256;
+var SCHEMA_VERSION3 = "1";
+var SCHEMA_KEY = "skills_index_schema_version";
+var _require4 = createRequire4(import.meta.url);
+var _Database3 = null;
+function getDatabase3() {
+  if (_Database3 === null) {
+    _Database3 = _require4("better-sqlite3");
+  }
+  return _Database3;
+}
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "a",
+  "an",
+  "and",
+  "the",
+  "of",
+  "to",
+  "in",
+  "on",
+  "for",
+  "with",
+  "by",
+  "is",
+  "are",
+  "be",
+  "or",
+  "as",
+  "at",
+  "it",
+  "this",
+  "that",
+  "from",
+  "use",
+  "used",
+  "when",
+  "if",
+  "via"
+]);
+function fnv1a32(str) {
+  let h = 2166136261;
+  for (let i = 0; i < str.length; i++) {
+    h ^= str.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h >>> 0;
+}
+function tokenize(text) {
+  if (!text) return [];
+  const tokens = [];
+  for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw.length < 2) continue;
+    if (STOPWORDS.has(raw)) continue;
+    tokens.push(raw);
+  }
+  return tokens;
+}
+function embed(text) {
+  const vec = new Float32Array(VECTOR_DIM);
+  const tokens = tokenize(text);
+  if (tokens.length === 0) return vec;
+  for (const tok of tokens) {
+    const bucket = fnv1a32(tok) % VECTOR_DIM;
+    vec[bucket] += 1;
+  }
+  let mag = 0;
+  for (let i = 0; i < VECTOR_DIM; i++) mag += vec[i] * vec[i];
+  mag = Math.sqrt(mag);
+  if (mag > 0) {
+    for (let i = 0; i < VECTOR_DIM; i++) vec[i] /= mag;
+  }
+  return vec;
+}
+function cosine(a, b) {
+  let dot = 0;
+  for (let i = 0; i < VECTOR_DIM; i++) dot += a[i] * b[i];
+  return dot;
+}
+function bufferToVector(buf) {
+  const ab = new ArrayBuffer(buf.byteLength);
+  Buffer.from(ab).set(buf);
+  const vec = new Float32Array(ab);
+  if (vec.length !== VECTOR_DIM) {
+    throw new Error(`vector length mismatch: expected ${VECTOR_DIM}, got ${vec.length}`);
+  }
+  return vec;
+}
+function openIndex(dbPath) {
+  if (!fs36.existsSync(dbPath)) {
+    throw new Error(
+      `skills index not found at ${dbPath}. Run \`node scripts/skills-index-build.mjs --out ${dbPath}\` first.`
+    );
+  }
+  const Database = getDatabase3();
+  const db = new Database(dbPath, { readonly: true, fileMustExist: true });
+  let row;
+  try {
+    row = db.prepare("SELECT value FROM meta WHERE key = ?").get(SCHEMA_KEY);
+  } catch (e) {
+    db.close();
+    throw new Error(`skills index at ${dbPath} is not a valid skills DB: ${e.message}`);
+  }
+  if (!row || row.value !== SCHEMA_VERSION3) {
+    db.close();
+    throw new Error(
+      `skills index at ${dbPath} has schema version ${row ? row.value : "(none)"}, expected ${SCHEMA_VERSION3}. Rebuild it.`
+    );
+  }
+  return db;
+}
+function searchIndex(dbPath, query, k = 5) {
+  const db = openIndex(dbPath);
+  try {
+    const qvec = embed(query);
+    let qmag = 0;
+    for (let i = 0; i < VECTOR_DIM; i++) qmag += qvec[i] * qvec[i];
+    if (qmag === 0) return [];
+    const rows = db.prepare("SELECT name, description, vector FROM skills").all();
+    const scored = rows.map((r) => {
+      const v = bufferToVector(r.vector);
+      const score = cosine(qvec, v);
+      const snippet = (r.description || "").slice(0, 200);
+      return { name: r.name, score, snippet };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    return scored.slice(0, Math.max(1, k));
+  } finally {
+    db.close();
+  }
+}
+var DEFAULT_DB_PATH = path35.join(os21.homedir(), ".olam", "skills.vec.db");
+var DEFAULT_SOURCE_DIR = path35.join(os21.homedir(), ".claude", "skills");
+
+// ../mcp-server/src/tools/skills-search.ts
+function defaultDbPath() {
+  const override = process.env["SKILLS_INDEX_PATH"];
+  if (override) return override;
+  return path36.join(os22.homedir(), ".olam", "skills.vec.db");
+}
+function asMessage9(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function ok3(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
+function fail3(err) {
+  return {
+    content: [{ type: "text", text: asMessage9(err) }],
+    isError: true
+  };
+}
+function register27(server, _ctx, _initError) {
+  server.tool(
+    "olam_skills_search",
+    "Semantic search over the local Claude skills index. Returns top-k skills ranked by cosine similarity against a deterministic bag-of-words embedding. Requires `scripts/skills-index-build.mjs` to have been run; set `SKILLS_INDEX_PATH` to override the index location (defaults to ~/.olam/skills.vec.db).",
+    {
+      query: external_exports.string().min(1).describe('Natural-language description of the kind of skill you want (e.g. "stage and commit my changes" or "roll out a new release").'),
+      k: external_exports.number().int().min(1).max(50).optional().describe("Number of hits to return (default 5, max 50).")
+    },
+    async ({ query, k }) => {
+      try {
+        const hits = searchIndex(defaultDbPath(), query, k ?? 5);
+        return ok3({ query, k: k ?? 5, count: hits.length, hits });
+      } catch (err) {
+        return fail3(err);
+      }
+    }
+  );
+}
+
 // ../mcp-server/src/tools/kg-classify.ts
 var kg_classify_exports = {};
 __export(kg_classify_exports, {
-  register: () => register27
+  register: () => register28
 });
 init_v3();
 
@@ -34957,8 +35413,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path49) {
-  return `http://127.0.0.1:${port()}${path49}`;
+function url(path52) {
+  return `http://127.0.0.1:${port()}${path52}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -35019,7 +35475,7 @@ async function status(opts = {}) {
 }
 
 // ../mcp-server/src/tools/kg-classify.ts
-function register27(server, _ctx, _initError) {
+function register28(server, _ctx, _initError) {
   server.tool(
     "olam_kg_classify",
     "Route a question to kg | grep | both via the 4-layer classifier (kg-service container). Returns route + layer + reason + matched exemplar. Requires olam-kg-service running (see `olam services up`).",
@@ -35067,7 +35523,7 @@ function register27(server, _ctx, _initError) {
 // ../mcp-server/src/tools/kg-doctor.ts
 var kg_doctor_exports = {};
 __export(kg_doctor_exports, {
-  register: () => register28
+  register: () => register29
 });
 async function runProbes() {
   const results = [];
@@ -35117,7 +35573,7 @@ async function runProbes() {
   }
   return results;
 }
-function register28(server, _ctx, _initError) {
+function register29(server, _ctx, _initError) {
   server.tool(
     "olam_kg_doctor",
     "Diagnostic report for olam-kg-service over HTTP: /health readiness, workspace inventory, and /classify round-trip. Returns a JSON `probes` array. If the container isn't running, all probes fail with a hint to run `olam services up`.",
@@ -35153,13 +35609,13 @@ function register28(server, _ctx, _initError) {
 // ../mcp-server/src/tools/kg-install-hook.ts
 var kg_install_hook_exports = {};
 __export(kg_install_hook_exports, {
-  register: () => register29
+  register: () => register30
 });
 init_v3();
 init_merge_settings();
-import * as fs36 from "node:fs";
-import * as path35 from "node:path";
-import * as os21 from "node:os";
+import * as fs37 from "node:fs";
+import * as path37 from "node:path";
+import * as os23 from "node:os";
 
 // ../core/dist/kg/hook-template.js
 var KG_HOOK_SENTINEL = "kg-service-v2-classifier-hook";
@@ -35209,12 +35665,12 @@ function buildHookMatcherEntry(opts) {
 // ../mcp-server/src/tools/kg-install-hook.ts
 function settingsPathFor2(scope, projectPath) {
   if (scope === "user") {
-    return path35.join(os21.homedir(), ".claude", "settings.json");
+    return path37.join(os23.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path35.join(root, ".claude", "settings.json");
+  return path37.join(root, ".claude", "settings.json");
 }
-function register29(server, _ctx, _initError) {
+function register30(server, _ctx, _initError) {
   server.tool(
     "olam_kg_install_hook",
     "Install the kg-service PreToolUse hook into .claude/settings.json. Idempotent (sentinel-detected). Default scope=project (writes <cwd>/.claude/settings.json); scope=user writes ~/.claude/settings.json.",
@@ -35226,12 +35682,12 @@ function register29(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor2(scope, params.projectPath);
       try {
-        fs36.mkdirSync(path35.dirname(filePath), { recursive: true });
+        fs37.mkdirSync(path37.dirname(filePath), { recursive: true });
         let backupPath = null;
-        if (fs36.existsSync(filePath)) {
+        if (fs37.existsSync(filePath)) {
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
           backupPath = `${filePath}.olam-bak.${ts}`;
-          fs36.copyFileSync(filePath, backupPath);
+          fs37.copyFileSync(filePath, backupPath);
         }
         const result = mergeHomeSettingsJson(filePath, {
           ensureHook: {
@@ -35242,7 +35698,7 @@ function register29(server, _ctx, _initError) {
         });
         if (result.status === "already-present" && backupPath) {
           try {
-            fs36.unlinkSync(backupPath);
+            fs37.unlinkSync(backupPath);
           } catch {
           }
         }
@@ -35283,18 +35739,18 @@ function register29(server, _ctx, _initError) {
 // ../mcp-server/src/tools/kg-uninstall-hook.ts
 var kg_uninstall_hook_exports = {};
 __export(kg_uninstall_hook_exports, {
-  register: () => register30
+  register: () => register31
 });
 init_v3();
-import * as fs37 from "node:fs";
-import * as path36 from "node:path";
-import * as os22 from "node:os";
+import * as fs38 from "node:fs";
+import * as path38 from "node:path";
+import * as os24 from "node:os";
 function settingsPathFor3(scope, projectPath) {
   if (scope === "user") {
-    return path36.join(os22.homedir(), ".claude", "settings.json");
+    return path38.join(os24.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path36.join(root, ".claude", "settings.json");
+  return path38.join(root, ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -35316,7 +35772,7 @@ function dropSentinel(matchers) {
   }
   return { matchers: out, changed };
 }
-function register30(server, _ctx, _initError) {
+function register31(server, _ctx, _initError) {
   server.tool(
     "olam_kg_uninstall_hook",
     "Remove the kg-service PreToolUse hook from .claude/settings.json. Sentinel-matched: only the olam entry is removed; other PreToolUse hooks are preserved.",
@@ -35328,7 +35784,7 @@ function register30(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor3(scope, params.projectPath);
       try {
-        if (!fs37.existsSync(filePath)) {
+        if (!fs38.existsSync(filePath)) {
           return {
             content: [
               {
@@ -35342,7 +35798,7 @@ function register30(server, _ctx, _initError) {
             ]
           };
         }
-        const raw = fs37.readFileSync(filePath, "utf-8");
+        const raw = fs38.readFileSync(filePath, "utf-8");
         const settings = raw.trim() ? JSON.parse(raw) : {};
         const preToolUse = settings.hooks?.PreToolUse;
         if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
@@ -35377,7 +35833,7 @@ function register30(server, _ctx, _initError) {
         const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         const backupPath = `${filePath}.olam-bak.${ts}`;
         try {
-          fs37.copyFileSync(filePath, backupPath);
+          fs38.copyFileSync(filePath, backupPath);
         } catch {
         }
         const next = {
@@ -35389,7 +35845,7 @@ function register30(server, _ctx, _initError) {
           if (otherStages.length === 0) delete next.hooks;
           else delete next.hooks.PreToolUse;
         }
-        fs37.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+        fs38.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
         return {
           content: [
             {
@@ -35451,6 +35907,7 @@ var toolModules = [
   runbook_exports,
   skill_source_exports,
   skills_exports,
+  skills_search_exports,
   kg_classify_exports,
   kg_doctor_exports,
   kg_install_hook_exports,
@@ -35462,6 +35919,207 @@ function registerAllTools(server, ctx, initError) {
   }
 }
 
+// ../mcp-server/src/resources/chunks.ts
+import fs39 from "node:fs";
+import os25 from "node:os";
+import path39 from "node:path";
+var DEFAULT_HOST_CP_URL = "http://127.0.0.1:19000";
+var DEFAULT_PLAN_CHAT_SECRET_PATH = path39.join(
+  os25.homedir(),
+  ".olam",
+  "plan-chat-secret"
+);
+var URI_SCHEME = "olam:";
+var URI_HOST = "worlds";
+var WORLD_ID_RE2 = /^[a-z0-9][a-z0-9-_.]{0,62}$/i;
+var SESSION_ID_RE = /^[a-zA-Z0-9_\-.]{1,128}$/;
+var LIMIT_RE = /^[1-9][0-9]{0,5}$/;
+function loadBearer(bearerOpt, secretPath) {
+  if (typeof bearerOpt === "string" && bearerOpt.length > 0) return bearerOpt;
+  const envBearer = process.env.OLAM_PLAN_CHAT_BEARER?.trim();
+  if (envBearer && envBearer.length > 0) return envBearer;
+  try {
+    const onDisk = fs39.readFileSync(secretPath, "utf8").trim();
+    return onDisk.length > 0 ? onDisk : null;
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      return null;
+    }
+    return null;
+  }
+}
+function parseChunksUri(uri) {
+  let parsed;
+  try {
+    parsed = new URL(uri);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== URI_SCHEME) return null;
+  if (parsed.host !== URI_HOST) return null;
+  const segments = parsed.pathname.split("/").filter((s) => s.length > 0);
+  if (segments.length !== 2) return null;
+  const [rawWorldId, kind] = segments;
+  if (rawWorldId === void 0 || kind !== "chunks") return null;
+  const worldId = decodeURIComponent(rawWorldId);
+  if (!WORLD_ID_RE2.test(worldId)) return null;
+  const sessionIdRaw = parsed.searchParams.get("sessionId");
+  const limitRaw = parsed.searchParams.get("limit");
+  let sessionId;
+  if (sessionIdRaw !== null) {
+    if (!SESSION_ID_RE.test(sessionIdRaw)) return null;
+    sessionId = sessionIdRaw;
+  }
+  let limit;
+  if (limitRaw !== null) {
+    if (!LIMIT_RE.test(limitRaw)) return null;
+    limit = Number.parseInt(limitRaw, 10);
+  }
+  return { worldId, sessionId, limit };
+}
+function buildUpstreamUrl(hostCpUrl, parts) {
+  const upstream = new URL(hostCpUrl);
+  upstream.pathname = "/api/plan-chat/v1/shape";
+  upstream.searchParams.set("table", "chunks");
+  upstream.searchParams.set("world_id", parts.worldId);
+  if (parts.sessionId) {
+    upstream.searchParams.set("session_id", parts.sessionId);
+  }
+  if (typeof parts.limit === "number") {
+    upstream.searchParams.set("limit", String(parts.limit));
+  }
+  upstream.searchParams.set("offset", "-1");
+  return upstream;
+}
+function createChunksResource(deps = {}) {
+  const hostCpUrl = deps.hostCpUrl ?? process.env.OLAM_HOST_CP_URL?.trim() ?? DEFAULT_HOST_CP_URL;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const secretPath = deps.secretPath ?? DEFAULT_PLAN_CHAT_SECRET_PATH;
+  const resolveBearer = () => loadBearer(deps.bearer, secretPath);
+  return {
+    name: "olam-world-chunks",
+    // RFC 6570 form with required `sessionId` in the template (the SDK's
+    // matcher treats every listed var as required, so listing both
+    // `sessionId` AND `limit` would reject URIs that only pass sessionId).
+    // The optional `limit` param is parsed by `parseChunksUri` from the
+    // concrete URL instead — clients pass `?sessionId=...&limit=...` and
+    // both fields land in `ChunksUriParts`.
+    uriTemplate: "olam://worlds/{worldId}/chunks{?sessionId}",
+    description: "Per-world agent reasoning chunks (the chunks substrate). Append `?sessionId=<id>` to scope to a single planning session \u2014 Electric SQL requires it server-side. Optional `&limit=<n>` caps the returned row count. Returns the Electric shape snapshot as JSON.",
+    mimeType: "application/json",
+    parseUri: parseChunksUri,
+    async read(uri) {
+      const parts = parseChunksUri(uri);
+      if (!parts) {
+        return {
+          ok: false,
+          code: "invalid_uri",
+          message: `Invalid chunks URI: ${uri}. Expected \`olam://worlds/{worldId}/chunks?sessionId=<id>\`.`
+        };
+      }
+      if (!parts.sessionId) {
+        return {
+          ok: false,
+          code: "missing_session_id",
+          message: "sessionId query param is required. Electric SQL enforces per-(world_id,session_id) scope at the proxy layer."
+        };
+      }
+      const bearer = resolveBearer();
+      if (!bearer) {
+        return {
+          ok: false,
+          code: "missing_bearer",
+          message: "No plan-chat bearer available. Set OLAM_PLAN_CHAT_BEARER or ensure ~/.olam/plan-chat-secret exists."
+        };
+      }
+      const upstream = buildUpstreamUrl(hostCpUrl, parts);
+      let res;
+      try {
+        res = await fetchImpl(upstream.toString(), {
+          method: "GET",
+          headers: {
+            authorization: `Bearer ${bearer}`,
+            accept: "application/json"
+          }
+        });
+      } catch (err) {
+        return {
+          ok: false,
+          code: "upstream_unavailable",
+          message: `host-cp /api/plan-chat/v1/shape unreachable: ${err instanceof Error ? err.message : String(err)}`,
+          detail: { upstream: upstream.toString() }
+        };
+      }
+      if (!res.ok) {
+        let body = "";
+        try {
+          body = await res.text();
+        } catch {
+        }
+        return {
+          ok: false,
+          code: "upstream_error",
+          message: `host-cp returned ${res.status} ${res.statusText} for chunks fetch`,
+          detail: { upstream: upstream.toString(), body: body.slice(0, 512) }
+        };
+      }
+      let payload;
+      try {
+        payload = await res.json();
+      } catch (err) {
+        return {
+          ok: false,
+          code: "upstream_error",
+          message: `host-cp returned non-JSON body for chunks fetch: ${err instanceof Error ? err.message : String(err)}`,
+          detail: { upstream: upstream.toString() }
+        };
+      }
+      return {
+        ok: true,
+        uri,
+        mimeType: "application/json",
+        payload
+      };
+    }
+  };
+}
+
+// ../mcp-server/src/resources/index.ts
+function registerAllResources(server, deps = {}) {
+  const chunks = deps.chunks ?? createChunksResource();
+  server.registerResource(
+    chunks.name,
+    new ResourceTemplate(chunks.uriTemplate, {
+      list: void 0
+    }),
+    {
+      description: chunks.description,
+      mimeType: chunks.mimeType
+    },
+    async (uri) => {
+      const result = await chunks.read(uri.toString());
+      if (!result.ok) {
+        const err = new Error(result.message);
+        err.code = result.code;
+        throw err;
+      }
+      return {
+        contents: [
+          {
+            uri: result.uri,
+            mimeType: result.mimeType,
+            text: JSON.stringify(result.payload)
+          }
+        ]
+      };
+    }
+  );
+  logger.info("Olam MCP resources registered", {
+    resources: [chunks.name],
+    uriTemplate: chunks.uriTemplate
+  });
+}
+
 // ../mcp-server/src/server.ts
 var SERVER_NAME = "olam";
 var SERVER_VERSION = "0.1.0";
@@ -35477,6 +36135,7 @@ function createServer4(ctx, initError) {
     { instructions: SERVER_INSTRUCTIONS }
   );
   registerAllTools(server, ctx, initError);
+  registerAllResources(server);
   logger.info("Olam MCP server created", {
     name: SERVER_NAME,
     version: SERVER_VERSION,
@@ -35486,8 +36145,8 @@ function createServer4(ctx, initError) {
 }
 
 // ../mcp-server/src/utils/native-probe.ts
-import { createRequire as createRequire4 } from "node:module";
-var PROBE_REQUIRE = createRequire4(import.meta.url);
+import { createRequire as createRequire5 } from "node:module";
+var PROBE_REQUIRE = createRequire5(import.meta.url);
 function runtimeModuleVersion() {
   return Number.parseInt(process.versions.modules, 10);
 }
@@ -35604,9 +36263,9 @@ init_loader();
 // ../core/dist/world/manager.js
 import * as crypto8 from "node:crypto";
 import { execSync as execSync5, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs46 from "node:fs";
-import * as os26 from "node:os";
-import * as path46 from "node:path";
+import * as fs48 from "node:fs";
+import * as os29 from "node:os";
+import * as path49 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -35702,8 +36361,8 @@ function resolveDevboxImage(config2, tag) {
 
 // ../core/dist/world/worktree.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import * as fs38 from "node:fs";
-import * as path37 from "node:path";
+import * as fs40 from "node:fs";
+import * as path40 from "node:path";
 function resolveGitDir(repo) {
   if (repo.path) {
     return repo.path;
@@ -35713,11 +36372,11 @@ function resolveGitDir(repo) {
 async function createWorktrees(repos, worldId, workspacePath, branch) {
   const created = [];
   for (const repo of repos) {
-    const worktreePath = path37.join(workspacePath, repo.name);
+    const worktreePath = path40.join(workspacePath, repo.name);
     const gitDir = resolveGitDir(repo);
     const branchName = branch || `olam/${worldId}`;
     try {
-      fs38.mkdirSync(path37.dirname(worktreePath), { recursive: true });
+      fs40.mkdirSync(path40.dirname(worktreePath), { recursive: true });
       execFileSync4("git", ["worktree", "add", worktreePath, "-b", branchName], {
         cwd: gitDir,
         stdio: "pipe"
@@ -35750,7 +36409,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
 }
 async function removeWorktrees(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path37.join(workspacePath, repo.name);
+    const worktreePath = path40.join(workspacePath, repo.name);
     let gitDir;
     try {
       gitDir = resolveGitDir(repo);
@@ -35825,12 +36484,12 @@ function removeBranch(repo, branch) {
 
 // ../core/dist/world/kg-overlay.js
 import { execFileSync as execFileSync5 } from "node:child_process";
-import * as fs39 from "node:fs";
-import * as path38 from "node:path";
+import * as fs41 from "node:fs";
+import * as path41 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
-import { homedir as homedir22 } from "node:os";
-import { join as join38, resolve as resolve9 } from "node:path";
+import { homedir as homedir24 } from "node:os";
+import { join as join40, resolve as resolve9 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
 var InvalidWorkspaceNameError = class extends Error {
@@ -35851,25 +36510,25 @@ function validateWorkspaceName(name) {
 
 // ../core/dist/kg/storage-paths.js
 function olamHome() {
-  return process.env.OLAM_HOME ?? join38(homedir22(), ".olam");
+  return process.env.OLAM_HOME ?? join40(homedir24(), ".olam");
 }
 function kgRoot() {
-  return join38(olamHome(), "kg");
+  return join40(olamHome(), "kg");
 }
 function worldsRoot() {
-  return join38(olamHome(), "worlds");
+  return join40(olamHome(), "worlds");
 }
-function assertWithinPrefix(path49, prefix, label) {
-  if (!path49.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path49} not under ${prefix}/`);
+function assertWithinPrefix(path52, prefix, label) {
+  if (!path52.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path52} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path49 = resolve9(join38(root, workspace));
-  assertWithinPrefix(path49, root, "kgPristinePath");
-  return path49;
+  const path52 = resolve9(join40(root, workspace));
+  assertWithinPrefix(path52, root, "kgPristinePath");
+  return path52;
 }
 var KG_PATHS_INTERNALS = Object.freeze({
   olamHome,
@@ -35885,10 +36544,10 @@ var KgOverlayError = class extends Error {
   }
 };
 function ensureGitignoreEntry(worldClonePath) {
-  const gitignorePath = path38.join(worldClonePath, ".gitignore");
-  if (!fs39.existsSync(gitignorePath))
+  const gitignorePath = path41.join(worldClonePath, ".gitignore");
+  if (!fs41.existsSync(gitignorePath))
     return "no-gitignore";
-  const content = fs39.readFileSync(gitignorePath, "utf-8");
+  const content = fs41.readFileSync(gitignorePath, "utf-8");
   const lines = content.split("\n").map((l) => l.trim());
   const recognised = /* @__PURE__ */ new Set([
     "graphify-out",
@@ -35903,24 +36562,24 @@ function ensureGitignoreEntry(worldClonePath) {
   const eol = content.includes("\r\n") ? "\r\n" : "\n";
   const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
   const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
-  fs39.appendFileSync(gitignorePath, block, "utf-8");
+  fs41.appendFileSync(gitignorePath, block, "utf-8");
   return "appended";
 }
 function createWorldOverlay(opts) {
   const pristineRoot = kgPristinePath(opts.workspace);
-  const pristinePath = path38.join(pristineRoot, "graphify-out");
-  if (!fs39.existsSync(pristinePath)) {
+  const pristinePath = path41.join(pristineRoot, "graphify-out");
+  if (!fs41.existsSync(pristinePath)) {
     throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
   }
-  if (!path38.isAbsolute(opts.worldClonePath)) {
+  if (!path41.isAbsolute(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
   }
-  if (!fs39.existsSync(opts.worldClonePath)) {
+  if (!fs41.existsSync(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
   }
-  const overlayPath = path38.join(opts.worldClonePath, "graphify-out");
-  if (fs39.existsSync(overlayPath)) {
-    fs39.rmSync(overlayPath, { recursive: true, force: true });
+  const overlayPath = path41.join(opts.worldClonePath, "graphify-out");
+  if (fs41.existsSync(overlayPath)) {
+    fs41.rmSync(overlayPath, { recursive: true, force: true });
   }
   const useReflink = process.platform === "darwin";
   let strategy;
@@ -35938,7 +36597,7 @@ function createWorldOverlay(opts) {
   } else {
     strategy = "cp-r";
   }
-  if (strategy === "cp-r" || !fs39.existsSync(overlayPath)) {
+  if (strategy === "cp-r" || !fs41.existsSync(overlayPath)) {
     try {
       execFileSync5("cp", ["-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
@@ -35950,7 +36609,7 @@ function createWorldOverlay(opts) {
       throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
     }
   }
-  if (!fs39.existsSync(overlayPath)) {
+  if (!fs41.existsSync(overlayPath)) {
     throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
   }
   const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
@@ -35964,12 +36623,12 @@ function createWorldOverlay(opts) {
 
 // ../core/dist/world/baseline-diff.js
 import { execFileSync as execFileSync6 } from "node:child_process";
-import * as fs40 from "node:fs";
-import * as os23 from "node:os";
-import * as path39 from "node:path";
+import * as fs42 from "node:fs";
+import * as os26 from "node:os";
+import * as path42 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
-function expandHome2(p, homedir28) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir28());
+function expandHome2(p, homedir30) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir30());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -35992,10 +36651,10 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
-  const homedir28 = deps.homedir ?? (() => os23.homedir());
-  const baselineDir = path39.join(workspacePath, ".olam", "baseline");
+  const homedir30 = deps.homedir ?? (() => os26.homedir());
+  const baselineDir = path42.join(workspacePath, ".olam", "baseline");
   try {
-    fs40.mkdirSync(baselineDir, { recursive: true });
+    fs42.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -36007,9 +36666,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path39.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir28);
-    if (!fs40.existsSync(repoPath)) {
+    const outPath = path42.join(baselineDir, filename);
+    const repoPath = expandHome2(repo.path, homedir30);
+    if (!fs42.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -36076,7 +36735,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs40.writeFileSync(outPath, content);
+    fs42.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -36084,8 +36743,8 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path39.join(workspacePath, repo.name);
-    if (!fs40.existsSync(worktreePath))
+    const worktreePath = path42.join(workspacePath, repo.name);
+    if (!fs42.existsSync(worktreePath))
       continue;
     try {
       execFileSync6("git", ["checkout", "--", "."], {
@@ -36144,21 +36803,21 @@ function extractStderr(err) {
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
-  const homedir28 = deps.homedir ?? (() => os23.homedir());
-  const existsSync46 = deps.existsSync ?? ((p) => fs40.existsSync(p));
-  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs40.copyFileSync(src, dest));
-  const mkdirSync29 = deps.mkdirSync ?? ((dirPath, opts) => {
-    fs40.mkdirSync(dirPath, opts);
+  const homedir30 = deps.homedir ?? (() => os26.homedir());
+  const existsSync47 = deps.existsSync ?? ((p) => fs42.existsSync(p));
+  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs42.copyFileSync(src, dest));
+  const mkdirSync30 = deps.mkdirSync ?? ((dirPath, opts) => {
+    fs42.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir28);
-    const worktreePath = path39.join(workspacePath, repo.name);
-    if (!existsSync46(repoPath))
+    const repoPath = expandHome2(repo.path, homedir30);
+    const worktreePath = path42.join(workspacePath, repo.name);
+    if (!existsSync47(repoPath))
       continue;
-    if (!existsSync46(worktreePath)) {
+    if (!existsSync47(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -36216,12 +36875,12 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
       }
     }
     for (const rel of plan.diff.untracked) {
-      const src = path39.join(plan.repoPath, rel);
-      const dest = path39.join(plan.worktreePath, rel);
-      if (!existsSync46(src))
+      const src = path42.join(plan.repoPath, rel);
+      const dest = path42.join(plan.worktreePath, rel);
+      if (!existsSync47(src))
         continue;
       try {
-        mkdirSync29(path39.dirname(dest), { recursive: true });
+        mkdirSync30(path42.dirname(dest), { recursive: true });
         copyFileSync9(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -36247,8 +36906,8 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs41 from "node:fs";
-import * as path40 from "node:path";
+import * as fs43 from "node:fs";
+import * as path43 from "node:path";
 
 // ../core/dist/world/templates/_generated.js
 var GH_PR_CREATE = '# Creating PRs from inside an Olam world\n\n## The problem\n\nCalling `gh pr create` directly inside an Olam container **hangs forever** on a\nTTY confirmation prompt that the agent cannot answer. This is a known, reproduced issue.\n\n## The fix\n\nAlways use this exact pattern:\n\n```bash\necho y | timeout 30 gh pr create \\\n  --base main \\\n  --head <branch> \\\n  --title "<title>" \\\n  --body-file /tmp/pr-body.md\n```\n\n## Why each part matters\n\n- **`echo y |`** \u2014 answers the "Submit?" confirmation prompt up front so `gh` never pauses.\n- **`timeout 30`** \u2014 hard deadline. If `gh` hangs anyway, the command exits non-zero so the\n  agent can react instead of stalling the world indefinitely.\n- **`--body-file /tmp/pr-body.md`** \u2014 write the PR body to a temp file first. Avoids\n  shell-escaping bugs that occur with `--body "..."` for long or multi-line bodies.\n- **`--head` and `--base` explicitly** \u2014 removes all interactive prompts; `gh` has nothing to ask.\n\n## Troubleshooting\n\n**"no commits" or "branch not found" error:**\n\n```bash\ngit push -u origin <branch>\n# then retry:\necho y | timeout 30 gh pr create --base main --head <branch> --title "..." --body-file /tmp/pr-body.md\n```\n\n**Timeout exceeded (command exits 124):**\n\n- Check if the branch was pushed: `git log origin/<branch> --oneline -1`\n- Check GitHub CLI auth: `gh auth status`\n- Retry once; if it hangs again, open the PR via the GitHub web UI.\n';
@@ -36258,10 +36917,10 @@ var WORLD_CLAUDE_MD = '# Olam World: {{worldName}}\n\n{{taskBlock}}\n\n## Enviro
 // ../core/dist/world/context-injection.js
 function injectWorldContext(opts) {
   const { world } = opts;
-  const claudeDir2 = path40.join(world.workspacePath, ".claude");
-  fs41.mkdirSync(claudeDir2, { recursive: true });
+  const claudeDir2 = path43.join(world.workspacePath, ".claude");
+  fs43.mkdirSync(claudeDir2, { recursive: true });
   const content = WORLD_CLAUDE_MD.replace("{{worldName}}", world.name).replace("{{worldId}}", world.id).replace("{{branch}}", world.branch).replace("{{taskBlock}}", buildTaskBlock(opts)).replace("{{reposList}}", buildReposList(world)).replace("{{servicesLine}}", buildServicesLine(opts.services)).replace("{{pleriPlaneLine}}", buildPleriPlaneLine(opts.pleriPlaneUrl)).replace("{{planFileBlock}}", buildPlanFileBlock(world)).replace("{{extraContextBlock}}", buildExtraContextBlock(opts.claudeMdExtra));
-  fs41.writeFileSync(path40.join(claudeDir2, "CLAUDE.md"), content);
+  fs43.writeFileSync(path43.join(claudeDir2, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function buildTaskBlock(opts) {
@@ -36335,10 +36994,10 @@ function buildExtraContextBlock(extra) {
 ${extra}`;
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path40.join(workspacePath, ".olam", "docs");
-  fs41.mkdirSync(docsDir, { recursive: true });
-  fs41.writeFileSync(path40.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
-  fs41.writeFileSync(path40.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
+  const docsDir = path43.join(workspacePath, ".olam", "docs");
+  fs43.mkdirSync(docsDir, { recursive: true });
+  fs43.writeFileSync(path43.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
+  fs43.writeFileSync(path43.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -36352,9 +37011,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path40.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path43.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs41.existsSync(plansDir) && fs41.readdirSync(plansDir).length > 0;
+    return fs43.existsSync(plansDir) && fs43.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -36926,25 +37585,25 @@ init_repo_manifest();
 
 // ../core/dist/world/snapshot.js
 import * as crypto7 from "node:crypto";
-import * as fs42 from "node:fs";
-import * as os24 from "node:os";
-import * as path41 from "node:path";
+import * as fs44 from "node:fs";
+import * as os27 from "node:os";
+import * as path44 from "node:path";
 import { execFileSync as execFileSync7, spawn as spawn2 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path41.join(os24.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path44.join(os27.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDirByWorkspace(workspace, arch, kind) {
-  return path41.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
+  return path44.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path41.join(snapshotsDir(), worldId);
+  const legacyDir = path44.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs42.existsSync(legacyDir))
+  if (!fs44.existsSync(legacyDir))
     return;
   try {
-    fs42.rmSync(legacyDir, { recursive: true, force: true });
+    fs44.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -36963,11 +37622,11 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path41.join(repoDir, "Gemfile.lock");
-  if (!fs42.existsSync(lockfile))
+  const lockfile = path44.join(repoDir, "Gemfile.lock");
+  if (!fs44.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs42.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs44.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -36977,10 +37636,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path41.join(repoDir, name);
-    if (fs42.existsSync(lockfile)) {
+    const lockfile = path44.join(repoDir, name);
+    if (fs44.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs42.readFileSync(lockfile) }
+        { path: name, content: fs44.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -36999,18 +37658,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path41.dirname(destDir);
-  fs42.mkdirSync(parent, { recursive: true });
+  const parent = path44.dirname(destDir);
+  fs44.mkdirSync(parent, { recursive: true });
   const tmpSuffix = `.tmp-${process.pid}-${crypto7.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs42.mkdirSync(tmpDir, { recursive: true });
+    fs44.mkdirSync(tmpDir, { recursive: true });
     execFileSync7("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs42.renameSync(tmpDir, destDir);
+    fs44.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs42.rmSync(tmpDir, { recursive: true, force: true });
+      fs44.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -37021,12 +37680,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path41.resolve(base, target);
-  const baseResolved = path41.resolve(base);
-  const rel = path41.relative(baseResolved, resolved);
+  const resolved = path44.resolve(base, target);
+  const baseResolved = path44.resolve(base);
+  const rel = path44.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path41.isAbsolute(rel);
+  return !rel.startsWith("..") && !path44.isAbsolute(rel);
 }
 var TYPE_CHAR_TO_TYPE = {
   "-": "file",
@@ -37076,7 +37735,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs42.readFileSync(tarPath));
+    raw = gunzipSync(fs44.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -37091,7 +37750,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path41.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path44.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -37129,7 +37788,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path41.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path44.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -37137,8 +37796,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path41.join(targetDir, path41.dirname(entry.name));
-      if (path41.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path41.join(path41.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path44.join(targetDir, path44.dirname(entry.name));
+      if (path44.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path44.join(path44.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -37148,7 +37807,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path41.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path44.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -37181,8 +37840,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path41.join(archDir, tarFilename);
-      if (!fs42.existsSync(tarPath)) {
+      const tarPath = path44.join(archDir, tarFilename);
+      if (!fs44.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -37197,9 +37856,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path41.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path44.join(repo.worktreeDir, targetSubpath);
       try {
-        fs42.rmSync(targetDir, { recursive: true, force: true });
+        fs44.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -37212,8 +37871,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs42.rmSync(tarPath, { force: true });
-          fs42.rmSync(manifestPath(tarPath), { force: true });
+          fs44.rmSync(tarPath, { force: true });
+          fs44.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -37229,10 +37888,10 @@ function restoreSnapshotsForRepos(input) {
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs42.existsSync(mPath))
+  if (!fs44.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs42.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs44.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
@@ -37247,17 +37906,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs42.mkdirSync(dir, { recursive: true });
-  const lockPath = path41.join(dir, EVICT_LOCK_FILENAME);
+  fs44.mkdirSync(dir, { recursive: true });
+  const lockPath = path44.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs42.openSync(lockPath, fs42.constants.O_WRONLY | fs42.constants.O_CREAT | fs42.constants.O_EXCL, 384);
+    fd = fs44.openSync(lockPath, fs44.constants.O_WRONLY | fs44.constants.O_CREAT | fs44.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs42.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs44.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -37265,23 +37924,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs42.unlinkSync(lockPath);
-      fd = fs42.openSync(lockPath, fs42.constants.O_WRONLY | fs42.constants.O_CREAT | fs42.constants.O_EXCL, 384);
+      fs44.unlinkSync(lockPath);
+      fd = fs44.openSync(lockPath, fs44.constants.O_WRONLY | fs44.constants.O_CREAT | fs44.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs42.writeSync(fd, `${process.pid}
+    fs44.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs42.closeSync(fd);
+    fs44.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs42.unlinkSync(lockPath);
+      fs44.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -37314,16 +37973,16 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs42.existsSync(dir))
+  if (!fs44.existsSync(dir))
     return 0;
   const allTars = [];
   const walk = (d) => {
-    for (const entry of fs42.readdirSync(d, { withFileTypes: true })) {
-      const full = path41.join(d, entry.name);
+    for (const entry of fs44.readdirSync(d, { withFileTypes: true })) {
+      const full = path44.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat = fs42.statSync(full);
+        const stat = fs44.statSync(full);
         allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
       }
     }
@@ -37338,8 +37997,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs42.rmSync(tar.path, { force: true });
-    fs42.rmSync(manifestPath(tar.path), { force: true });
+    fs44.rmSync(tar.path, { force: true });
+    fs44.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -37456,14 +38115,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 
 // ../core/dist/world/olam-yaml.js
 init_repo_manifest();
-import * as path42 from "node:path";
+import * as path45 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path42.join(workspacePath, repo.name);
+    const repoDir = path45.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -37478,8 +38137,8 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs43 from "node:fs";
-import * as path43 from "node:path";
+import * as fs45 from "node:fs";
+import * as path46 from "node:path";
 import { parse as parseYaml4 } from "yaml";
 function parseFrontmatter2(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -37499,20 +38158,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path43.join(workspaceRoot, ".olam", "policies");
-  if (!fs43.existsSync(policiesDir))
+  const policiesDir = path46.join(workspaceRoot, ".olam", "policies");
+  if (!fs45.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs43.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs45.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path43.join(policiesDir, file);
+    const filePath = path46.join(policiesDir, file);
     try {
-      const content = fs43.readFileSync(filePath, "utf8");
+      const content = fs45.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter2(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -37659,12 +38318,12 @@ init_store();
 init_bridge();
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs44 from "node:fs";
-import * as os25 from "node:os";
-import * as path44 from "node:path";
+import * as fs46 from "node:fs";
+import * as os28 from "node:os";
+import * as path47 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path44.join(os25.homedir(), p.slice(1));
+    return path47.join(os28.homedir(), p.slice(1));
   }
   return p;
 }
@@ -37676,7 +38335,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs44.existsSync(resolvedPath)) {
+    if (!fs46.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -37692,19 +38351,19 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
 init_port_validator();
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs45 from "node:fs";
-import * as path45 from "node:path";
+import * as fs47 from "node:fs";
+import * as path48 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path45.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path45.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path45.dirname(destAbs);
-    fs45.mkdirSync(destDir, { recursive: true });
-    fs45.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path48.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path48.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path48.dirname(destAbs);
+    fs47.mkdirSync(destDir, { recursive: true });
+    fs47.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -38340,7 +38999,7 @@ ${detail}`);
       runbookSeeds = resolved.seeds;
     }
     const worldId = generateWorldId();
-    const workspacePath = path46.join(os26.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path49.join(os29.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = this.resolveReposWithWorkspace(opts);
@@ -38421,38 +39080,38 @@ ${detail}`);
     for (const repo of repos) {
       if (!repo.path)
         continue;
-      const sourceRoot = repo.path.replace(/^~/, os26.homedir());
-      const worktreeRoot = path46.join(workspacePath, repo.name);
-      if (!fs46.existsSync(sourceRoot) || !fs46.existsSync(worktreeRoot))
+      const sourceRoot = repo.path.replace(/^~/, os29.homedir());
+      const worktreeRoot = path49.join(workspacePath, repo.name);
+      if (!fs48.existsSync(sourceRoot) || !fs48.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path46.dirname(pattern), path46.basename(pattern)];
-          const sourceDir = path46.join(sourceRoot, dir);
-          if (fs46.existsSync(sourceDir)) {
+          const [dir, glob] = [path49.dirname(pattern), path49.basename(pattern)];
+          const sourceDir = path49.join(sourceRoot, dir);
+          if (fs48.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs46.readdirSync(sourceDir)) {
+              for (const entry of fs48.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path46.join(dir, entry));
+                  matches2.push(path49.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs46.existsSync(path46.join(sourceRoot, pattern))) {
+        } else if (fs48.existsSync(path49.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path46.join(sourceRoot, rel);
-          const dst = path46.join(worktreeRoot, rel);
+          const src = path49.join(sourceRoot, rel);
+          const dst = path49.join(worktreeRoot, rel);
           try {
-            const st = fs46.statSync(src);
+            const st = fs48.statSync(src);
             if (!st.isFile())
               continue;
-            fs46.mkdirSync(path46.dirname(dst), { recursive: true });
-            fs46.copyFileSync(src, dst);
+            fs48.mkdirSync(path49.dirname(dst), { recursive: true });
+            fs48.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -38538,7 +39197,7 @@ ${detail}`);
     }
     const overlayAttachments = [];
     for (const repo of repos) {
-      const worldClonePath = path46.join(workspacePath, repo.name);
+      const worldClonePath = path49.join(workspacePath, repo.name);
       try {
         const result = createWorldOverlay({
           workspace: repo.name,
@@ -38593,7 +39252,7 @@ ${detail}`);
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path46.join(workspacePath, repo.name);
+          const repoDir = path49.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -38637,10 +39296,10 @@ ${detail}`);
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path46.join(os26.homedir(), ".olam", "r2-credentials.json");
-      if (fs46.existsSync(r2CredsPath)) {
+      const r2CredsPath = path49.join(os29.homedir(), ".olam", "r2-credentials.json");
+      if (fs48.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs46.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs48.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -38657,10 +39316,10 @@ ${detail}`);
         } catch {
         }
       }
-      const keysYamlPath = path46.join(os26.homedir(), ".olam", "keys.yaml");
-      if (fs46.existsSync(keysYamlPath)) {
+      const keysYamlPath = path49.join(os29.homedir(), ".olam", "keys.yaml");
+      if (fs48.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs46.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs48.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const parsed = YAML3.parse(keysRaw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -38719,10 +39378,10 @@ ${detail}`);
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path46.join(workspacePath, repoName, relativePath);
+          const absPath = path49.join(workspacePath, repoName, relativePath);
           try {
-            fs46.mkdirSync(path46.dirname(absPath), { recursive: true });
-            fs46.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs48.mkdirSync(path49.dirname(absPath), { recursive: true });
+            fs48.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -38899,7 +39558,7 @@ ${detail}`);
         imageDigest: void 0,
         repos: enrichedRepos.map((r) => ({
           name: r.name,
-          worktreeDir: path46.join(workspacePath, r.name)
+          worktreeDir: path49.join(workspacePath, r.name)
         }))
       });
       for (const out of restoreResult.outcomes) {
@@ -39005,7 +39664,7 @@ ${detail}`);
     }
     if (opts.task) {
       const allPolicies = repos.flatMap((repo) => {
-        const repoWorktree = path46.join(workspacePath, repo.name);
+        const repoWorktree = path49.join(workspacePath, repo.name);
         try {
           return loadPolicies(repoWorktree);
         } catch (err) {
@@ -39018,8 +39677,8 @@ ${detail}`);
         try {
           execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
           for (const repo of repos) {
-            const policiesDir = path46.join(workspacePath, repo.name, ".olam", "policies");
-            if (fs46.existsSync(policiesDir)) {
+            const policiesDir = path49.join(workspacePath, repo.name, ".olam", "policies");
+            if (fs48.existsSync(policiesDir)) {
               execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
             }
           }
@@ -39127,8 +39786,8 @@ ${detail}`);
     } catch {
     }
     try {
-      fs46.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs46.existsSync(world.workspacePath)) {
+      fs48.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs48.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -39237,14 +39896,14 @@ ${detail}`);
     }).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs46.readFileSync(planFilePath, "utf-8");
-    const planFileName = path46.basename(planFilePath);
+    const planContent = fs48.readFileSync(planFilePath, "utf-8");
+    const planFileName = path49.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path46.join(workspacePath, targetRepo, "docs", "plans");
-    fs46.mkdirSync(plansDir, { recursive: true });
-    fs46.writeFileSync(path46.join(plansDir, planFileName), planContent);
+    const plansDir = path49.join(workspacePath, targetRepo, "docs", "plans");
+    fs48.mkdirSync(plansDir, { recursive: true });
+    fs48.writeFileSync(path49.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -39678,8 +40337,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs47 from "node:fs";
-import * as path47 from "node:path";
+import * as fs49 from "node:fs";
+import * as path50 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -40014,7 +40673,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs47.existsSync(dbPath))
+  if (!fs49.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -40185,13 +40844,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port: port2, registry: registry2 } = opts;
-  const thisDir = path47.dirname(fileURLToPath3(import.meta.url));
-  const defaultPublicDir = path47.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path50.dirname(fileURLToPath3(import.meta.url));
+  const defaultPublicDir = path50.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs47.existsSync(publicDir);
+  let hasPublicDir = fs49.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs47.existsSync(publicDir);
+      hasPublicDir = fs49.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port2}`;
     const url2 = new URL(req.url ?? "/", `http://${host}`);
@@ -40465,22 +41124,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path47.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path50.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs47.existsSync(filePath) && fs47.statSync(filePath).isFile()) {
-      const ext = path47.extname(filePath);
+    if (fs49.existsSync(filePath) && fs49.statSync(filePath).isFile()) {
+      const ext = path50.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs47.createReadStream(filePath).pipe(res);
+      fs49.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path47.join(publicDir, "index.html");
-    if (fs47.existsSync(filePath)) {
+    filePath = path50.join(publicDir, "index.html");
+    if (fs49.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs47.createReadStream(filePath).pipe(res);
+      fs49.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -40490,17 +41149,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs48 from "node:fs";
-import * as os27 from "node:os";
-import * as path48 from "node:path";
-var STATE_PATH = path48.join(os27.homedir(), ".olam", "dashboard.json");
+import * as fs50 from "node:fs";
+import * as os30 from "node:os";
+import * as path51 from "node:path";
+var STATE_PATH = path51.join(os30.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs48.mkdirSync(path48.dirname(STATE_PATH), { recursive: true });
-  fs48.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs50.mkdirSync(path51.dirname(STATE_PATH), { recursive: true });
+  fs50.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs48.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs50.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -40508,7 +41167,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs48.unlinkSync(STATE_PATH);
+    fs50.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -40788,8 +41447,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync37, existsSync as existsSync45, statSync as statSync14 } from "node:fs";
-import { join as join49, dirname as dirname28, resolve as resolve13 } from "node:path";
+import { readFileSync as readFileSync38, existsSync as existsSync46, statSync as statSync14 } from "node:fs";
+import { join as join51, dirname as dirname29, resolve as resolve13 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -40801,26 +41460,26 @@ function findProjectRoot2(startDir) {
   const root = resolve13("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync45(join49(dir, marker))) return dir;
+      if (existsSync46(join51(dir, marker))) return dir;
     }
-    const pkg = join49(dir, "package.json");
-    if (existsSync45(pkg)) {
+    const pkg = join51(dir, "package.json");
+    if (existsSync46(pkg)) {
       try {
-        const json = JSON.parse(readFileSync37(pkg, "utf8"));
+        const json = JSON.parse(readFileSync38(pkg, "utf8"));
         const isOlamWorkspace = typeof json.name === "string" && json.name.startsWith("@olam/");
         const hasOlamDep = json.dependencies && Object.keys(json.dependencies).some((k) => k.startsWith("@olam/")) || json.devDependencies && Object.keys(json.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
       } catch {
       }
     }
-    const parent = dirname28(dir);
+    const parent = dirname29(dir);
     if (parent === dir || parent === root) return null;
     dir = parent;
   }
 }
-function parseEnvFile(path49) {
+function parseEnvFile(path52) {
   const out = {};
-  const raw = readFileSync37(path49, "utf8");
+  const raw = readFileSync38(path52, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -40843,8 +41502,8 @@ function loadProjectEnv(startDir = process.cwd()) {
   const filesRead = [];
   const merged = {};
   for (const name of [".env", ".env.local"]) {
-    const p = join49(root, name);
-    if (existsSync45(p) && statSync14(p).isFile()) {
+    const p = join51(root, name);
+    if (existsSync46(p) && statSync14(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }
@@ -40880,12 +41539,12 @@ async function main() {
       maxDailyUsd: config2.cost.max_daily_usd,
       warningThreshold: config2.cost.warning_threshold
     });
-    const WORLD_ID_RE2 = /^[a-z0-9-]+$/;
+    const WORLD_ID_RE3 = /^[a-z0-9-]+$/;
     const callerWorldIdRaw = (process.env.OLAM_CALLER_WORLD_ID ?? "").trim();
     let callerWorldId;
     if (callerWorldIdRaw.length === 0) {
       callerWorldId = void 0;
-    } else if (WORLD_ID_RE2.test(callerWorldIdRaw)) {
+    } else if (WORLD_ID_RE3.test(callerWorldIdRaw)) {
       callerWorldId = callerWorldIdRaw;
     } else {
       logger.warn(