@pleri/olam-cli 0.1.167 → 0.1.168

package/dist/mcp-server.js

@@ -11894,16 +11894,42 @@ var init_loader = __esm({
   }
 });
 
+// ../core/dist/skill-sources/source-config-schema.js
+var PREFIX_PATTERN, SourceConfigSchema, SourceConfigSnapshotSchema;
+var init_source_config_schema = __esm({
+  "../core/dist/skill-sources/source-config-schema.js"() {
+    "use strict";
+    init_v3();
+    PREFIX_PATTERN = /^[a-z0-9][a-z0-9_-]{0,38}$/;
+    SourceConfigSchema = external_exports.object({
+      /**
+       * Source's RECOMMENDED rename prefix. Operators inherit this when their
+       * `~/.olam/config.json` has no explicit `prefix` override. Same regex
+       * shape as operator-side `SkillSourceSchema.prefix`.
+       */
+      prefix: external_exports.string().regex(PREFIX_PATTERN, "source-config prefix must be ASCII lowercase + digits + dash/underscore (1-39 chars, no leading/trailing dash)").optional(),
+      /**
+       * Source's RECOMMENDED prefix scope. Same enum as operator-side
+       * `SkillSourceSchema.prefixScope`. Operators inherit this when their
+       * `~/.olam/config.json` has no explicit `prefixScope` override.
+       */
+      prefixScope: external_exports.array(external_exports.enum(["skill", "agent"])).optional()
+    }).strict();
+    SourceConfigSnapshotSchema = SourceConfigSchema;
+  }
+});
+
 // ../core/dist/skill-sources/schema.js
-var SKILL_SOURCE_ID_LENGTH, NAME_PATTERN, URL_PATTERN, PREFIX_PATTERN, SkillSourceSchema;
+var SKILL_SOURCE_ID_LENGTH, NAME_PATTERN, URL_PATTERN, PREFIX_PATTERN2, SkillSourceSchema;
 var init_schema3 = __esm({
   "../core/dist/skill-sources/schema.js"() {
     "use strict";
     init_v3();
+    init_source_config_schema();
     SKILL_SOURCE_ID_LENGTH = 12;
     NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
     URL_PATTERN = /^(?:https?:\/\/|git@|ssh:\/\/|file:\/\/|\/).+/;
-    PREFIX_PATTERN = /^[a-z0-9][a-z0-9_-]{0,38}$/;
+    PREFIX_PATTERN2 = /^[a-z0-9][a-z0-9_-]{0,38}$/;
     SkillSourceSchema = external_exports.object({
       id: external_exports.string().length(SKILL_SOURCE_ID_LENGTH, `skill-source id must be exactly ${SKILL_SOURCE_ID_LENGTH} chars (sha256-of-url prefix)`).regex(/^[a-f0-9]+$/, "skill-source id must be lowercase hex"),
       name: external_exports.string().regex(NAME_PATTERN, "skill-source name must be ASCII lowercase + digits + dash (1-64 chars, no leading/trailing dash)"),
@@ -11920,7 +11946,7 @@ var init_schema3 = __esm({
        * use canonical names; `olam flywheel migrate-overlays --push` enforces
        * this via the reverse validator.
        */
-      prefix: external_exports.string().regex(PREFIX_PATTERN, "skill-source prefix must be ASCII lowercase + digits + dash/underscore (1-39 chars, no leading/trailing dash)").optional(),
+      prefix: external_exports.string().regex(PREFIX_PATTERN2, "skill-source prefix must be ASCII lowercase + digits + dash/underscore (1-39 chars, no leading/trailing dash)").optional(),
       /**
        * Which artifact kinds get renamed when `prefix` is set. Optional; defaults
        * to `['skill', 'agent']` for back-compat with the original Phase A semantic
@@ -11932,7 +11958,17 @@ var init_schema3 = __esm({
        *
        * NOT applicable when `prefix` is undefined.
        */
-      prefixScope: external_exports.array(external_exports.enum(["skill", "agent"])).optional()
+      prefixScope: external_exports.array(external_exports.enum(["skill", "agent"])).optional(),
+      /**
+       * Snapshot of the LAST source-config.yaml content this operator saw +
+       * consented to (ADR-021). Trust-gate state: when the live source-config
+       * differs from this snapshot, sync halts with a consent prompt instead
+       * of silently rebranding. Snapshot is updated on accept; persists across
+       * syncs. When undefined: operator has never seen a source-config from this
+       * source (first-sync flow applies). Field shape mirrors SourceConfigSchema
+       * for round-trip simplicity.
+       */
+      lastSeenSourcePrefix: SourceConfigSnapshotSchema.optional()
     });
   }
 });
@@ -12461,7 +12497,9 @@ var init_trust_audit_log = __esm({
       "meta-hook-stripped",
       "setup-skill-source-picked",
       "setup-project-sweep-completed",
-      "prefix-collision"
+      "prefix-collision",
+      "source-prefix-adopted",
+      "source-prefix-changed"
     ]);
     TrustMethodSchema = external_exports.enum(["flag", "interactive", "auto-reject-tty", "none"]);
     TrustAuditEntrySchema = external_exports.object({
@@ -12575,7 +12613,7 @@ function updateSkillSource(id, patch) {
     }
   }
   if (patch.prefix !== void 0 && patch.prefix !== null) {
-    if (!PREFIX_PATTERN2.test(patch.prefix)) {
+    if (!PREFIX_PATTERN3.test(patch.prefix)) {
       throw new Error(`prefix must match /^[a-z0-9][a-z0-9_-]{0,38}$/ \u2014 got "${patch.prefix}"`);
     }
   }
@@ -12595,6 +12633,14 @@ function updateSkillSource(id, patch) {
   } else if (patch.prefixScope !== void 0) {
     working = { ...working, prefixScope: [...patch.prefixScope] };
   }
+  if (patch.lastSeenSourcePrefix === null) {
+    const { lastSeenSourcePrefix: _l, ...rest } = working;
+    void _l;
+    working = rest;
+  } else if (patch.lastSeenSourcePrefix !== void 0) {
+    const validated = SourceConfigSnapshotSchema.parse(patch.lastSeenSourcePrefix);
+    working = { ...working, lastSeenSourcePrefix: validated };
+  }
   const updated = {
     ...working,
     ...patch.name !== void 0 ? { name: patch.name } : {},
@@ -12606,14 +12652,15 @@ function updateSkillSource(id, patch) {
   writeGlobalConfig({ ...config2, skillSources: next });
   return updated;
 }
-var PREFIX_PATTERN2;
+var PREFIX_PATTERN3;
 var init_store2 = __esm({
   "../core/dist/skill-sources/store.js"() {
     "use strict";
     init_store();
     init_schema3();
     init_trust_audit_log();
-    PREFIX_PATTERN2 = /^[a-z0-9][a-z0-9_-]{0,38}$/;
+    init_source_config_schema();
+    PREFIX_PATTERN3 = /^[a-z0-9][a-z0-9_-]{0,38}$/;
   }
 });
 
@@ -15060,6 +15107,97 @@ var init_prefix_deploy = __esm({
   }
 });
 
+// ../core/dist/skill-sync/resolve-source-config.js
+import { readFileSync as readFileSync29, existsSync as existsSync31 } from "node:fs";
+import { join as join31 } from "node:path";
+import { parse as parseYaml4 } from "yaml";
+function sourceConfigPath(clonePath) {
+  return join31(clonePath, "shared", "source-config.yaml");
+}
+function readSourceConfig(clonePath, sourceId) {
+  const path52 = sourceConfigPath(clonePath);
+  if (!existsSync31(path52))
+    return void 0;
+  let raw;
+  try {
+    raw = readFileSync29(path52, "utf-8");
+  } catch (err) {
+    emitMalformedWarning(sourceId, `read failed: ${errToMsg(err)}`);
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = parseYaml4(raw);
+  } catch (err) {
+    emitMalformedWarning(sourceId, `YAML parse failed: ${errToMsg(err)}`);
+    return void 0;
+  }
+  const candidate = parsed === null || parsed === void 0 ? {} : parsed;
+  const result = SourceConfigSchema.safeParse(candidate);
+  if (!result.success) {
+    emitMalformedWarning(sourceId, `schema validation failed: ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`);
+    return void 0;
+  }
+  return result.data;
+}
+function emitMalformedWarning(sourceId, reason) {
+  const id = sourceId ?? "<unknown source>";
+  process.stderr.write(`[source-config:malformed] ${id}: ${reason}
+`);
+}
+function errToMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function resolveEffectivePrefix(operatorSource, sourceConfig) {
+  const opPrefix = operatorSource.prefix;
+  const opScope = operatorSource.prefixScope;
+  const srcPrefix = sourceConfig?.prefix;
+  const srcScope = sourceConfig?.prefixScope;
+  const effectivePrefix = opPrefix ?? srcPrefix;
+  const effectiveScope = opScope ?? srcScope;
+  const operatorHasAny = opPrefix !== void 0 || opScope !== void 0 && opScope.length > 0;
+  const sourceHasAny = srcPrefix !== void 0 || srcScope !== void 0 && srcScope.length > 0;
+  const origin = operatorHasAny ? "operator" : sourceHasAny ? "source" : "none";
+  const result = { origin };
+  if (effectivePrefix !== void 0)
+    result.prefix = effectivePrefix;
+  if (effectiveScope !== void 0)
+    result.prefixScope = effectiveScope;
+  return result;
+}
+function sourceConfigsEqual(a, b) {
+  const normalize = (c) => {
+    if (c === void 0)
+      return {};
+    const out = {};
+    if (c.prefix !== void 0)
+      out.prefix = c.prefix;
+    if (c.prefixScope !== void 0 && c.prefixScope.length > 0) {
+      out.prefixScope = [...c.prefixScope];
+    }
+    return out;
+  };
+  const na = normalize(a);
+  const nb = normalize(b);
+  if (na.prefix !== nb.prefix)
+    return false;
+  const sa = na.prefixScope ?? [];
+  const sb = nb.prefixScope ?? [];
+  if (sa.length !== sb.length)
+    return false;
+  for (let i = 0; i < sa.length; i++) {
+    if (sa[i] !== sb[i])
+      return false;
+  }
+  return true;
+}
+var init_resolve_source_config = __esm({
+  "../core/dist/skill-sync/resolve-source-config.js"() {
+    "use strict";
+    init_source_config_schema();
+  }
+});
+
 // ../core/dist/skill-sync/engine.js
 import * as fs31 from "node:fs";
 import * as os18 from "node:os";
@@ -15120,8 +15258,95 @@ async function syncSkills(opts = {}) {
   const memberOverlaysEnabled = process.env["OLAM_MEMBER_OVERLAYS"] === "1";
   const baseArtifacts = projectFilteredArtifacts.filter((a) => a.kind !== "overlay");
   const overlayArtifacts = memberOverlaysEnabled ? projectFilteredArtifacts.filter((a) => a.kind === "overlay") : [];
-  const sourcePrefixMap = buildSourcePrefixMap(sources);
-  const hasPrefixRewrites = sources.some((s) => s.prefix !== void 0 && s.prefix.length > 0);
+  const effectiveSources = sources.map((s) => {
+    const clonePath = skillSourceClonePath(s.id);
+    const sourceConfig = fs31.existsSync(clonePath) ? readSourceConfig(clonePath, s.id) : void 0;
+    const eff = resolveEffectivePrefix(s, sourceConfig);
+    const entry = {
+      id: s.id,
+      origin: eff.origin,
+      sourceConfig
+    };
+    if (eff.prefix !== void 0)
+      entry.prefix = eff.prefix;
+    if (eff.prefixScope !== void 0)
+      entry.prefixScope = eff.prefixScope;
+    return entry;
+  });
+  const sourcePrefixGateOutcomes = [];
+  for (const eff of effectiveSources) {
+    if (eff.sourceConfig === void 0) {
+      sourcePrefixGateOutcomes.push({ sourceId: eff.id, outcome: "no-source-config" });
+      continue;
+    }
+    if (eff.origin === "operator") {
+      sourcePrefixGateOutcomes.push({ sourceId: eff.id, outcome: "no-change" });
+      continue;
+    }
+    const operatorSource = sources.find((s) => s.id === eff.id);
+    const lastSeen = operatorSource?.lastSeenSourcePrefix;
+    const sameAsLastSeen = sourceConfigsEqual(lastSeen, eff.sourceConfig);
+    if (sameAsLastSeen) {
+      sourcePrefixGateOutcomes.push({ sourceId: eff.id, outcome: "no-change" });
+      continue;
+    }
+    const kind = lastSeen === void 0 ? "first-time" : "changed";
+    const flagGrant = kind === "first-time" && opts.autoAcceptSourcePrefix === true || kind === "changed" && opts.acceptSourcePrefixChanges === true;
+    let consented = flagGrant;
+    if (!consented && opts.sourcePrefixPrompt !== void 0) {
+      try {
+        const promptInput = {
+          sourceName: operatorSource?.name ?? eff.id,
+          sourceId: eff.id,
+          newConfig: eff.sourceConfig,
+          kind
+        };
+        if (lastSeen !== void 0)
+          promptInput.priorConfig = lastSeen;
+        consented = await opts.sourcePrefixPrompt(promptInput);
+      } catch {
+        consented = false;
+      }
+    }
+    if (consented) {
+      if (!opts.dryRun) {
+        try {
+          updateSkillSource(eff.id, { lastSeenSourcePrefix: eff.sourceConfig });
+          appendTrustAudit({
+            gitUrl: `internal:source-prefix-${kind === "first-time" ? "adopted" : "changed"}`,
+            action: kind === "first-time" ? "source-prefix-adopted" : "source-prefix-changed",
+            trustMethod: flagGrant ? "flag" : "interactive",
+            sourceId: eff.id,
+            note: kind === "first-time" ? `snapshot=${JSON.stringify(eff.sourceConfig)}` : `prior=${JSON.stringify(lastSeen ?? {})}; new=${JSON.stringify(eff.sourceConfig)}`
+          });
+        } catch {
+        }
+      }
+      sourcePrefixGateOutcomes.push({
+        sourceId: eff.id,
+        outcome: kind === "first-time" ? "adopted" : "changed"
+      });
+    } else {
+      delete eff.prefix;
+      delete eff.prefixScope;
+      eff.origin = "none";
+      const isNonTty = opts.sourcePrefixPrompt === void 0;
+      sourcePrefixGateOutcomes.push({
+        sourceId: eff.id,
+        outcome: isNonTty ? "skipped-non-tty" : "rejected"
+      });
+      if (isNonTty) {
+        process.stderr.write(`[source-prefix:skipped] ${operatorSource?.name ?? eff.id}: source-config has prefix-suggestion '${eff.sourceConfig.prefix ?? "<empty>"}' but no consent (non-TTY without --auto-accept-source-prefix). Skipping for this sync; canonical names deployed.
+`);
+      }
+    }
+  }
+  const sourcePrefixMap = buildSourcePrefixMap(effectiveSources);
+  const hasPrefixRewrites = effectiveSources.some((s) => s.prefix !== void 0 && s.prefix.length > 0);
+  const effectivePrefixOrigins = {};
+  for (const s of effectiveSources) {
+    effectivePrefixOrigins[s.id] = s.origin;
+  }
   const willMutateManagedDir = !opts.dryRun && (memberOverlaysEnabled && overlayArtifacts.length > 0 || hasPrefixRewrites);
   if (willMutateManagedDir) {
     const claude = claudeDir();
@@ -15170,7 +15395,7 @@ async function syncSkills(opts = {}) {
   const permissionFiles = projectFilteredArtifacts.filter((a) => a.kind === "permission").map((a) => a.sourcePath);
   const claudeDirForRewrites = claudeDir();
   const prefixRewriteResult = applyPrefixRewrites(baseArtifacts, sourcePrefixMap, claudeDirForRewrites, opts.dryRun === true);
-  const prefixCollisions = detectPrefixCollisions(sources);
+  const prefixCollisions = detectPrefixCollisions(effectiveSources);
   if (!opts.dryRun) {
     for (const collision of prefixCollisions) {
       try {
@@ -15197,7 +15422,9 @@ async function syncSkills(opts = {}) {
     metaHooks: void 0,
     perSource,
     prefixRewrites: prefixRewriteResult.entries,
-    prefixCollisions
+    prefixCollisions,
+    effectivePrefixOrigins,
+    sourcePrefixGateOutcomes
   };
   if (opts.dryRun) {
     summary.collisions = detectCollisions(baseArtifacts).collisions;
@@ -15329,6 +15556,8 @@ var init_engine = __esm({
     init_markdown_merger();
     init_managed_merge();
     init_prefix_deploy();
+    init_resolve_source_config();
+    init_store2();
   }
 });
 
@@ -15841,6 +16070,8 @@ __export(skill_sources_exports, {
   SkillOverrideSchema: () => SkillOverrideSchema,
   SkillSourceGitError: () => SkillSourceGitError,
   SkillSourceSchema: () => SkillSourceSchema,
+  SourceConfigSchema: () => SourceConfigSchema,
+  SourceConfigSnapshotSchema: () => SourceConfigSnapshotSchema,
   TrustActionSchema: () => TrustActionSchema,
   TrustAuditEntrySchema: () => TrustAuditEntrySchema,
   TrustMethodSchema: () => TrustMethodSchema,
@@ -15880,12 +16111,14 @@ __export(skill_sources_exports, {
   pullSkillSource: () => pullSkillSource,
   readLatestMigrationSnapshot: () => readLatestMigrationSnapshot,
   readMigrationSnapshotFromPath: () => readMigrationSnapshotFromPath,
+  readSourceConfig: () => readSourceConfig,
   readTrustAuditLog: () => readTrustAuditLog,
   redactUrl: () => redactUrl2,
   removeSkillSource: () => removeSkillSource,
   removeSkillSourceClone: () => removeSkillSourceClone,
   reorderSkillSource: () => reorderSkillSource,
   resolveAtlasUser: () => resolveAtlasUser,
+  resolveEffectivePrefix: () => resolveEffectivePrefix,
   resolveSourceArtifacts: () => resolveSourceArtifacts,
   resolveSubscriptions: () => resolveSubscriptions,
   restoreCloneToBranchHead: () => restoreCloneToBranchHead,
@@ -15896,6 +16129,8 @@ __export(skill_sources_exports, {
   skillSourcesAuditLogPath: () => skillSourcesAuditLogPath,
   skillSourcesRootDir: () => skillSourcesRootDir,
   skillsHookSettingsPathFor: () => settingsPathFor,
+  sourceConfigPath: () => sourceConfigPath,
+  sourceConfigsEqual: () => sourceConfigsEqual,
   syncSkills: () => syncSkills,
   uninstallSkillsHookFromFile: () => uninstallSkillsHookFromFile,
   updateSkillSource: () => updateSkillSource,
@@ -15912,6 +16147,8 @@ var init_skill_sources = __esm({
     init_hook_install();
     init_migration_snapshot();
     init_engine();
+    init_resolve_source_config();
+    init_source_config_schema();
     init_file_lock();
     init_schema5();
     init_per_project_override();
@@ -36489,7 +36726,7 @@ import * as path41 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
 import { homedir as homedir24 } from "node:os";
-import { join as join40, resolve as resolve9 } from "node:path";
+import { join as join41, resolve as resolve9 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
 var InvalidWorkspaceNameError = class extends Error {
@@ -36510,13 +36747,13 @@ function validateWorkspaceName(name) {
 
 // ../core/dist/kg/storage-paths.js
 function olamHome() {
-  return process.env.OLAM_HOME ?? join40(homedir24(), ".olam");
+  return process.env.OLAM_HOME ?? join41(homedir24(), ".olam");
 }
 function kgRoot() {
-  return join40(olamHome(), "kg");
+  return join41(olamHome(), "kg");
 }
 function worldsRoot() {
-  return join40(olamHome(), "worlds");
+  return join41(olamHome(), "worlds");
 }
 function assertWithinPrefix(path52, prefix, label) {
   if (!path52.startsWith(prefix + "/")) {
@@ -36526,7 +36763,7 @@ function assertWithinPrefix(path52, prefix, label) {
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path52 = resolve9(join40(root, workspace));
+  const path52 = resolve9(join41(root, workspace));
   assertWithinPrefix(path52, root, "kgPristinePath");
   return path52;
 }
@@ -36804,7 +37041,7 @@ function extractStderr(err) {
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
   const homedir30 = deps.homedir ?? (() => os26.homedir());
-  const existsSync47 = deps.existsSync ?? ((p) => fs42.existsSync(p));
+  const existsSync48 = deps.existsSync ?? ((p) => fs42.existsSync(p));
   const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs42.copyFileSync(src, dest));
   const mkdirSync30 = deps.mkdirSync ?? ((dirPath, opts) => {
     fs42.mkdirSync(dirPath, opts);
@@ -36815,9 +37052,9 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
       continue;
     const repoPath = expandHome2(repo.path, homedir30);
     const worktreePath = path42.join(workspacePath, repo.name);
-    if (!existsSync47(repoPath))
+    if (!existsSync48(repoPath))
       continue;
-    if (!existsSync47(worktreePath)) {
+    if (!existsSync48(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -36877,7 +37114,7 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
     for (const rel of plan.diff.untracked) {
       const src = path42.join(plan.repoPath, rel);
       const dest = path42.join(plan.worktreePath, rel);
-      if (!existsSync47(src))
+      if (!existsSync48(src))
         continue;
       try {
         mkdirSync30(path42.dirname(dest), { recursive: true });
@@ -38139,14 +38376,14 @@ function enrichReposWithManifests(repos, workspacePath) {
 // ../core/dist/policies/loader.js
 import * as fs45 from "node:fs";
 import * as path46 from "node:path";
-import { parse as parseYaml4 } from "yaml";
+import { parse as parseYaml5 } from "yaml";
 function parseFrontmatter2(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
   if (!match)
     return null;
   const [, yamlText = "", body = ""] = match;
   try {
-    const frontmatter = parseYaml4(yamlText);
+    const frontmatter = parseYaml5(yamlText);
     return { frontmatter, body };
   } catch {
     return null;
@@ -41447,8 +41684,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync38, existsSync as existsSync46, statSync as statSync14 } from "node:fs";
-import { join as join51, dirname as dirname29, resolve as resolve13 } from "node:path";
+import { readFileSync as readFileSync39, existsSync as existsSync47, statSync as statSync14 } from "node:fs";
+import { join as join52, dirname as dirname29, resolve as resolve13 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -41460,12 +41697,12 @@ function findProjectRoot2(startDir) {
   const root = resolve13("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync46(join51(dir, marker))) return dir;
+      if (existsSync47(join52(dir, marker))) return dir;
     }
-    const pkg = join51(dir, "package.json");
-    if (existsSync46(pkg)) {
+    const pkg = join52(dir, "package.json");
+    if (existsSync47(pkg)) {
       try {
-        const json = JSON.parse(readFileSync38(pkg, "utf8"));
+        const json = JSON.parse(readFileSync39(pkg, "utf8"));
         const isOlamWorkspace = typeof json.name === "string" && json.name.startsWith("@olam/");
         const hasOlamDep = json.dependencies && Object.keys(json.dependencies).some((k) => k.startsWith("@olam/")) || json.devDependencies && Object.keys(json.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
@@ -41479,7 +41716,7 @@ function findProjectRoot2(startDir) {
 }
 function parseEnvFile(path52) {
   const out = {};
-  const raw = readFileSync38(path52, "utf8");
+  const raw = readFileSync39(path52, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -41502,8 +41739,8 @@ function loadProjectEnv(startDir = process.cwd()) {
   const filesRead = [];
   const merged = {};
   for (const name of [".env", ".env.local"]) {
-    const p = join51(root, name);
-    if (existsSync46(p) && statSync14(p).isFile()) {
+    const p = join52(root, name);
+    if (existsSync47(p) && statSync14(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }

package/hermes-bundle/version.json

@@ -1,4 +1,4 @@
 {
-  "bundledAt": "2026-05-23T04:15:22.463Z",
+  "bundledAt": "2026-05-23T09:39:55.721Z",
   "kgFirstSha": "29a9ccce1b115d049e375c4a90eb5cf7c123e610e2d0590270a4db2cdbc64a28"
 }

package/host-cp/k8s/manifests/50-deployment.yaml

@@ -111,7 +111,7 @@ spec:
         # k3d), started by `olam upgrade` Step 0.7 — not inside this Pod.
       containers:
         - name: olam-host-cp
-          image: ghcr.io/pleri/olam-host-cp@sha256:b89b6e518d852c1a4f2bcd4cf08f9a46c62d71de18ceabc993b6f8cac080fb72
+          image: ghcr.io/pleri/olam-host-cp@sha256:766e07263fcf7e765c3689a7b8d40c47754b4ab90c697710843265a7fc84969a
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/auth-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-auth-service
-          image: ghcr.io/pleri/olam-auth@sha256:86a8921ba22de43122592904e3f853e33e29ee3e30213d550ae9315a47e2ad2c
+          image: ghcr.io/pleri/olam-auth@sha256:c6d163f7ac5fe1ca4652ed34afb1d8555c6f61d06398db767db65fee0944b209
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/kg-service/50-deployment.yaml

@@ -61,7 +61,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-kg-service
-          image: ghcr.io/pleri/olam-kg-service@sha256:f5e10089a5f87bf772f52fd62693639ab8db244a17586b654da9db022a7ff266
+          image: ghcr.io/pleri/olam-kg-service@sha256:77fd9b19d87c6f4cba4d33d76ff476dd7677f78725f3bf75a9076009e17355cc
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/mcp-auth-service/50-deployment.yaml

@@ -68,7 +68,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-mcp-auth-service
-          image: ghcr.io/pleri/olam-mcp-auth@sha256:01d663eda72772be77123c121b3d4cb7b8364b134fca7edcf21cb185ad0273ba
+          image: ghcr.io/pleri/olam-mcp-auth@sha256:cb5b1d7caece5bca4a4723eb20522a748cd48001aa94a7e7ec106d29bd2142b0
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/memory-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
           # bootstrap-placeholder comment + run `npm run refresh:manifest-digests`
           # once ghcr.io/pleri/olam-memory-service has a real published digest.
           # bootstrap-placeholder: pre-publish; refresh after first release
-          image: ghcr.io/pleri/olam-memory-service@sha256:6a895bfc815daadfeb1b62ae5b603659317f617300c3cccbe7b2e4adc638b56d
+          image: ghcr.io/pleri/olam-memory-service@sha256:38b2c1f36e49183f5d36999c6519533a8402f3e784109ede8ad7f6e1a205c195
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/src/halt-detect.mjs

@@ -0,0 +1,43 @@
+// W4 — Halt-shape detection for the host-cp chunk-write proxy.
+//
+// When plan-DO's dispatchPlanningAgent (W1) trips a guardrail, it
+// emits a chunk with chunk_type='goal_mode_assumption' and content
+// matching: `[assumption: <cap>-tripped — spent $X.XXXX of $Y]` (or
+// similar shape per GuardrailState.haltChunkText()).
+//
+// host-cp's /api/plan-chat proxy passes the chunk through to the
+// chunks substrate AND, if it detects a halt-shaped chunk, broadcasts
+// a typed `plan.halted` event on host-stream so the SPA's
+// PlanHaltBanner subscriber fires.
+//
+// Extracted as a pure fn so it can be unit-tested without booting
+// the host-cp server.
+
+const HALT_RE =
+  /^\[assumption:\s*(usd|turns|tool_calls|wall_clock)-tripped(?:\s*—\s*spent\s*\$([0-9.]+))?/;
+
+/**
+ * Detect a halt-shaped chunk + extract its components.
+ *
+ * Returns null when:
+ *   - chunk is null/undefined
+ *   - chunk_type isn't 'goal_mode_assumption'
+ *   - content doesn't match the halt regex
+ *
+ * Returns the parsed payload otherwise. Caller broadcasts this as
+ * the `plan.halted` event payload.
+ */
+export function detectHaltChunk(chunk) {
+  if (!chunk || typeof chunk !== 'object') return null;
+  if (chunk.chunk_type !== 'goal_mode_assumption') return null;
+  if (typeof chunk.chunk !== 'string') return null;
+  const m = chunk.chunk.match(HALT_RE);
+  if (!m) return null;
+  return {
+    plan_id: chunk.session_id ?? 'unknown',
+    operator_id: chunk.operator_id ?? 'unknown',
+    halt_reason: m[1],
+    usd_spent_so_far: m[2] ? Number.parseFloat(m[2]) : undefined,
+    halted_at: Date.now(),
+  };
+}