@pleri/olam-cli 0.1.168 → 0.1.170

package/dist/mcp-server.js

@@ -445,8 +445,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path52, errorMaps, issueData } = params;
-      const fullPath = [...path52, ...issueData.path || []];
+      const { data, path: path53, errorMaps, issueData } = params;
+      const fullPath = [...path53, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -754,11 +754,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path52, key) {
+      constructor(parent, value, path53, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path52;
+        this._path = path53;
         this._key = key;
       }
       get path() {
@@ -7090,7 +7090,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve14.call(this, root, ref);
+      let _sch = resolve15.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -7117,7 +7117,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve14(root, ref) {
+    function resolve15(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -7332,8 +7332,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path52) {
-      let input = path52;
+    function removeDotSegments(path53) {
+      let input = path53;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -7532,8 +7532,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path52, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path52 && path52 !== "/" ? path52 : void 0;
+        const [path53, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path53 && path53 !== "/" ? path53 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -7692,7 +7692,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve14(baseURI, relativeURI, options) {
+    function resolve15(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -7919,7 +7919,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve14,
+      resolve: resolve15,
       resolveComponent,
       equal,
       serialize,
@@ -10895,12 +10895,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs51, exportName) {
+    function addFormats(ajv, list, fs52, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs51[f]);
+        ajv.addFormat(f, fs52[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -11008,7 +11008,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path52, ctx, rejectSource) {
+function refineForbiddenKeys(value, path53, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -11016,12 +11016,12 @@ function refineForbiddenKeys(value, path52, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path52, key],
+        path: [...path53, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path52.length === 0 && key === "source") {
+    if (rejectSource && path53.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -11029,21 +11029,21 @@ function refineForbiddenKeys(value, path52, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path52, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path53, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path52, rejectSource) {
+function rejectForbiddenKeys(value, path53, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path52}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path53}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path52}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path53}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path52}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path53}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -11080,8 +11080,8 @@ function loadRepoManifest(repoDir) {
   } else {
     return null;
   }
-  const stat = lstatSync(manifestPath2);
-  if (stat.isSymbolicLink()) {
+  const stat2 = lstatSync(manifestPath2);
+  if (stat2.isSymbolicLink()) {
     throw new Error(`[manifest] ${manifestPath2}: symbolic links are not permitted`);
   }
   const raw = readFileSync3(manifestPath2, "utf-8");
@@ -11432,7 +11432,13 @@ var init_schema2 = __esm({
       user: external_exports.string().min(1),
       key: external_exports.string().optional()
     });
-    computeProviderType = external_exports.enum(["docker", "ssh", "e2b", "cloudflare"]);
+    computeProviderType = external_exports.enum([
+      "docker",
+      "ssh",
+      "e2b",
+      "cloudflare",
+      "cloudflare-isolate"
+    ]);
     stackImageSchema = external_exports.object({
       enabled: external_exports.boolean().optional().default(true),
       auto_commit: external_exports.boolean().optional().default(true),
@@ -11444,6 +11450,15 @@ var init_schema2 = __esm({
       }).optional(),
       ssh: external_exports.object({ hosts: external_exports.array(sshHostSchema).optional() }).optional(),
       e2b: external_exports.object({ template: external_exports.string().optional() }).optional(),
+      // V8-isolate runtime tier per ADR 022. Pure isolate, no DO, no Container.
+      // worker_url points at the deployed olam-worker-runner-isolate Worker.
+      // Same https-or-localhost guard as the cloudflare profile — bearer token
+      // in cleartext would leak the OLAM_TASK_TOKEN.
+      "cloudflare-isolate": external_exports.object({
+        worker_url: external_exports.string().url("worker_url must be a valid URL").refine(isSecureOrLocalhost, {
+          message: "worker_url must use https:// (or http://localhost for dev)"
+        }).optional()
+      }).optional(),
       cloudflare: external_exports.object({
         account_id: external_exports.string().optional(),
         // https-only refine: bare http:// would send the operator's Pylon
@@ -12076,23 +12091,23 @@ var init_schema4 = __esm({
 });
 
 // ../core/dist/global-config/store.js
-import * as fs10 from "node:fs";
+import * as fs11 from "node:fs";
 import * as os7 from "node:os";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 function globalConfigPath() {
   const override = process.env["OLAM_GLOBAL_CONFIG_PATH"];
   if (override && override.length > 0)
     return override;
-  return path13.join(os7.homedir(), ".olam", "config.json");
+  return path14.join(os7.homedir(), ".olam", "config.json");
 }
 function readGlobalConfig() {
   const configPath = globalConfigPath();
-  if (!fs10.existsSync(configPath)) {
+  if (!fs11.existsSync(configPath)) {
     return { ...DEFAULT_GLOBAL_CONFIG };
   }
   let raw;
   try {
-    raw = fs10.readFileSync(configPath, "utf-8");
+    raw = fs11.readFileSync(configPath, "utf-8");
   } catch (err) {
     throw new GlobalConfigReadError(configPath, err);
   }
@@ -12129,11 +12144,11 @@ function migrateSchemaVersion(parsed) {
 function writeGlobalConfig(config2) {
   const configPath = globalConfigPath();
   const validated = GlobalConfigSchema.parse(config2);
-  const dir = path13.dirname(configPath);
-  fs10.mkdirSync(dir, { recursive: true });
+  const dir = path14.dirname(configPath);
+  fs11.mkdirSync(dir, { recursive: true });
   const tmp = `${configPath}.tmp-${process.pid}`;
-  fs10.writeFileSync(tmp, JSON.stringify(validated, null, 2) + "\n", { mode: 420 });
-  fs10.renameSync(tmp, configPath);
+  fs11.writeFileSync(tmp, JSON.stringify(validated, null, 2) + "\n", { mode: 420 });
+  fs11.renameSync(tmp, configPath);
 }
 var GlobalConfigReadError;
 var init_store = __esm({
@@ -12152,12 +12167,12 @@ var init_store = __esm({
 });
 
 // ../core/dist/global-config/repos.js
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 import * as os8 from "node:os";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 function expandPath(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path14.join(os8.homedir(), p.slice(1));
+    return path15.join(os8.homedir(), p.slice(1));
   }
   return p;
 }
@@ -12170,7 +12185,7 @@ function addRepo(entry) {
     throw new Error(`repo "${entry.name}" already registered. Use "olam repos update" to change its path.`);
   }
   const resolvedPath = expandPath(entry.path);
-  if (!fs11.existsSync(resolvedPath)) {
+  if (!fs12.existsSync(resolvedPath)) {
     throw new Error(`path "${entry.path}" does not exist. Verify the path is correct.`);
   }
   const now = Date.now();
@@ -12199,7 +12214,7 @@ function updateRepo(name, updates) {
     throw new Error(`repo "${name}" is not registered. Run "olam repos list" to see registered repos.`);
   }
   const resolvedUpdatePath = updates.path !== void 0 ? expandPath(updates.path) : void 0;
-  if (resolvedUpdatePath !== void 0 && !fs11.existsSync(resolvedUpdatePath)) {
+  if (resolvedUpdatePath !== void 0 && !fs12.existsSync(resolvedUpdatePath)) {
     throw new Error(`path "${updates.path}" does not exist. Verify the path is correct.`);
   }
   const existing = config2.repos[idx];
@@ -12396,7 +12411,7 @@ var init_port_validator = __esm({
 });
 
 // ../core/dist/global-config/bridge.js
-import * as fs12 from "node:fs";
+import * as fs13 from "node:fs";
 function repoEntryToRepoConfig(entry) {
   if (!entry.url) {
     throw new Error(`Repo "${entry.name}" has no url. Re-register:
@@ -12404,7 +12419,7 @@ function repoEntryToRepoConfig(entry) {
   olam repos add ${entry.name} --path ${entry.path}`);
   }
   const repoPath = resolveTildePath(entry.path);
-  if (!fs12.existsSync(repoPath)) {
+  if (!fs13.existsSync(repoPath)) {
     throw new Error(`Repo "${entry.name}" path "${repoPath}" no longer exists. Run: olam repos update ${entry.name} --path <new-path>`);
   }
   let manifest = null;
@@ -12435,15 +12450,15 @@ var init_bridge = __esm({
 });
 
 // ../core/dist/skill-sources/trust-audit-log.js
-import * as fs13 from "node:fs";
-import * as path15 from "node:path";
+import * as fs14 from "node:fs";
+import * as path16 from "node:path";
 import * as os9 from "node:os";
 function skillSourcesAuditLogPath() {
   const override = process.env["OLAM_SKILL_SOURCES_AUDIT_LOG_PATH"];
   if (override && override.length > 0)
     return override;
-  const stateDir = process.env["OLAM_STATE_DIR"] ?? path15.join(os9.homedir(), ".olam", "state");
-  return path15.join(stateDir, SKILL_SOURCES_AUDIT_LOG_FILENAME);
+  const stateDir = process.env["OLAM_STATE_DIR"] ?? path16.join(os9.homedir(), ".olam", "state");
+  return path16.join(stateDir, SKILL_SOURCES_AUDIT_LOG_FILENAME);
 }
 function appendTrustAudit(entry) {
   const candidate = {
@@ -12452,20 +12467,20 @@ function appendTrustAudit(entry) {
   };
   const validated = TrustAuditEntrySchema.parse(candidate);
   const filePath = skillSourcesAuditLogPath();
-  fs13.mkdirSync(path15.dirname(filePath), { recursive: true, mode: 448 });
-  const fd = fs13.openSync(filePath, "a", 384);
+  fs14.mkdirSync(path16.dirname(filePath), { recursive: true, mode: 448 });
+  const fd = fs14.openSync(filePath, "a", 384);
   try {
-    fs13.writeSync(fd, JSON.stringify(validated) + "\n");
+    fs14.writeSync(fd, JSON.stringify(validated) + "\n");
   } finally {
-    fs13.closeSync(fd);
+    fs14.closeSync(fd);
   }
   return validated;
 }
 function readTrustAuditLog() {
   const filePath = skillSourcesAuditLogPath();
-  if (!fs13.existsSync(filePath))
+  if (!fs14.existsSync(filePath))
     return { entries: [], errors: [] };
-  const raw = fs13.readFileSync(filePath, "utf-8");
+  const raw = fs14.readFileSync(filePath, "utf-8");
   const lines = raw.split("\n");
   const entries = [];
   const errors = [];
@@ -12666,17 +12681,17 @@ var init_store2 = __esm({
 
 // ../core/dist/skill-sources/clone.js
 import { execFileSync as execFileSync2 } from "node:child_process";
-import * as fs14 from "node:fs";
+import * as fs15 from "node:fs";
 import * as os10 from "node:os";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 function skillSourcesRootDir() {
   const override = process.env["OLAM_SKILL_SOURCES_DIR"];
   if (override && override.length > 0)
     return override;
-  return path16.join(os10.homedir(), ".olam", "state", "skill-sources");
+  return path17.join(os10.homedir(), ".olam", "state", "skill-sources");
 }
 function skillSourceClonePath(id) {
-  return path16.join(skillSourcesRootDir(), id);
+  return path17.join(skillSourcesRootDir(), id);
 }
 function runGit(args, cwd) {
   try {
@@ -12691,15 +12706,15 @@ function runGit(args, cwd) {
 }
 function cloneSkillSource(opts) {
   const clonePath = skillSourceClonePath(opts.id);
-  if (fs14.existsSync(clonePath)) {
+  if (fs15.existsSync(clonePath)) {
     throw new Error(`clone path "${clonePath}" already exists. Remove the existing skill-source first.`);
   }
-  fs14.mkdirSync(skillSourcesRootDir(), { recursive: true });
+  fs15.mkdirSync(skillSourcesRootDir(), { recursive: true });
   try {
     runGit(["clone", "--depth", "1", "--branch", opts.branch, opts.gitUrl, clonePath]);
   } catch (err) {
-    if (fs14.existsSync(clonePath)) {
-      fs14.rmSync(clonePath, { recursive: true, force: true });
+    if (fs15.existsSync(clonePath)) {
+      fs15.rmSync(clonePath, { recursive: true, force: true });
     }
     throw new SkillSourceGitError("clone", opts.gitUrl, err);
   }
@@ -12713,7 +12728,7 @@ function cloneSkillSource(opts) {
 }
 function pullSkillSource(opts) {
   const clonePath = skillSourceClonePath(opts.id);
-  if (!fs14.existsSync(clonePath)) {
+  if (!fs15.existsSync(clonePath)) {
     throw new Error(`clone path "${clonePath}" does not exist. Run "olam skills source add" first.`);
   }
   try {
@@ -12731,8 +12746,8 @@ function pullSkillSource(opts) {
 }
 function removeSkillSourceClone(id) {
   const clonePath = skillSourceClonePath(id);
-  if (fs14.existsSync(clonePath)) {
-    fs14.rmSync(clonePath, { recursive: true, force: true });
+  if (fs15.existsSync(clonePath)) {
+    fs15.rmSync(clonePath, { recursive: true, force: true });
   }
 }
 var SkillSourceGitError;
@@ -12755,7 +12770,7 @@ var init_clone = __esm({
 });
 
 // ../core/dist/skill-sources/hook-template.js
-import * as fs15 from "node:fs";
+import * as fs16 from "node:fs";
 function buildSkillsHookEntry() {
   return {
     matcher: "",
@@ -12814,14 +12829,14 @@ function computeUninstall(settings) {
   return { status: "removed", settingsAfter: next };
 }
 function uninstallSkillsHookFromFile(filePath) {
-  if (!fs15.existsSync(filePath)) {
+  if (!fs16.existsSync(filePath)) {
     return { status: "no-settings" };
   }
-  const raw = fs15.readFileSync(filePath, "utf-8");
+  const raw = fs16.readFileSync(filePath, "utf-8");
   const settings = raw.trim() ? JSON.parse(raw) : {};
   const result = computeUninstall(settings);
   if (result.status === "removed" && result.settingsAfter) {
-    fs15.writeFileSync(filePath, JSON.stringify(result.settingsAfter, null, 2) + "\n");
+    fs16.writeFileSync(filePath, JSON.stringify(result.settingsAfter, null, 2) + "\n");
   }
   return result;
 }
@@ -12837,8 +12852,8 @@ var init_hook_template = __esm({
 });
 
 // ../core/dist/world/merge-settings.js
-import * as fs16 from "node:fs";
-import * as path17 from "node:path";
+import * as fs17 from "node:fs";
+import * as path18 from "node:path";
 import * as crypto4 from "node:crypto";
 function mergeHomeSettingsJson(filePath, options) {
   let settings;
@@ -12898,10 +12913,10 @@ function mergeHomeSettingsJson(filePath, options) {
   return { status: "installed", message: `settings.json updated at ${filePath}` };
 }
 function readSettings(filePath) {
-  if (!fs16.existsSync(filePath)) {
+  if (!fs17.existsSync(filePath)) {
     return {};
   }
-  const raw = fs16.readFileSync(filePath, "utf-8");
+  const raw = fs17.readFileSync(filePath, "utf-8");
   if (!raw.trim())
     return {};
   return JSON.parse(raw);
@@ -12922,13 +12937,13 @@ function isHookSentinelPresent(matchers, sentinel) {
   return false;
 }
 function atomicWriteJson(filePath, data) {
-  const dir = path17.dirname(filePath);
-  fs16.mkdirSync(dir, { recursive: true });
+  const dir = path18.dirname(filePath);
+  fs17.mkdirSync(dir, { recursive: true });
   const rand = crypto4.randomBytes(6).toString("hex");
   const tmp = `${filePath}.tmp.${process.pid}.${rand}`;
   const json = JSON.stringify(data, null, 2) + "\n";
-  fs16.writeFileSync(tmp, json, { mode: 420 });
-  fs16.renameSync(tmp, filePath);
+  fs17.writeFileSync(tmp, json, { mode: 420 });
+  fs17.renameSync(tmp, filePath);
 }
 var init_merge_settings = __esm({
   "../core/dist/world/merge-settings.js"() {
@@ -12937,25 +12952,25 @@ var init_merge_settings = __esm({
 });
 
 // ../core/dist/skill-sources/hook-install.js
-import * as fs17 from "node:fs";
-import * as path18 from "node:path";
+import * as fs18 from "node:fs";
+import * as path19 from "node:path";
 import * as os11 from "node:os";
 function settingsPathFor(scope, cwd) {
   if (scope === "user") {
-    return path18.join(os11.homedir(), ".claude", "settings.json");
+    return path19.join(os11.homedir(), ".claude", "settings.json");
   }
-  return path18.join(cwd ?? process.cwd(), ".claude", "settings.json");
+  return path19.join(cwd ?? process.cwd(), ".claude", "settings.json");
 }
 function backupFile(filePath) {
-  if (!fs17.existsSync(filePath))
+  if (!fs18.existsSync(filePath))
     return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs17.copyFileSync(filePath, backupPath);
+  fs18.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 function installSkillsHookToFile(filePath) {
-  fs17.mkdirSync(path18.dirname(filePath), { recursive: true });
+  fs18.mkdirSync(path19.dirname(filePath), { recursive: true });
   const backupPath = backupFile(filePath);
   const result = mergeHomeSettingsJson(filePath, {
     ensureHook: {
@@ -12966,7 +12981,7 @@ function installSkillsHookToFile(filePath) {
   });
   if (result.status === "already-present" && backupPath) {
     try {
-      fs17.unlinkSync(backupPath);
+      fs18.unlinkSync(backupPath);
     } catch {
     }
     return { status: "already-present", filePath, backupPath: null };
@@ -12974,11 +12989,11 @@ function installSkillsHookToFile(filePath) {
   return { status: result.status, filePath, backupPath };
 }
 function isSkillsHookInstalled(filePath) {
-  if (!fs17.existsSync(filePath))
+  if (!fs18.existsSync(filePath))
     return false;
   let parsed;
   try {
-    parsed = JSON.parse(fs17.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs18.readFileSync(filePath, "utf-8"));
   } catch {
     return false;
   }
@@ -13016,36 +13031,36 @@ var init_hook_install = __esm({
 });
 
 // ../core/dist/skill-sources/migration-snapshot.js
-import * as fs18 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os12 from "node:os";
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function claudeDirInternal() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path19.join(os12.homedir(), ".claude");
+  return path20.join(os12.homedir(), ".claude");
 }
 function migrationSnapshotsDir() {
   const override = process.env["OLAM_MIGRATION_SNAPSHOTS_DIR"];
   if (override && override.length > 0)
     return override;
-  return path19.join(os12.homedir(), ".olam", "state", "migration-snapshots");
+  return path20.join(os12.homedir(), ".olam", "state", "migration-snapshots");
 }
 function listToolboxManagedSymlinks(toolboxPath) {
   const claude = claudeDirInternal();
   const out = [];
   const BUCKETS2 = ["skills", "agents", "scripts", "rules", "commands"];
   for (const bucket of BUCKETS2) {
-    const dir = path19.join(claude, bucket);
-    if (!fs18.existsSync(dir))
+    const dir = path20.join(claude, bucket);
+    if (!fs19.existsSync(dir))
       continue;
-    for (const name of fs18.readdirSync(dir)) {
-      const link = path19.join(dir, name);
+    for (const name of fs19.readdirSync(dir)) {
+      const link = path20.join(dir, name);
       try {
-        const stat = fs18.lstatSync(link);
-        if (!stat.isSymbolicLink())
+        const stat2 = fs19.lstatSync(link);
+        if (!stat2.isSymbolicLink())
           continue;
-        const target = fs18.readlinkSync(link);
+        const target = fs19.readlinkSync(link);
         if (target.startsWith(toolboxPath)) {
           out.push({ link, target });
         }
@@ -13058,25 +13073,25 @@ function listToolboxManagedSymlinks(toolboxPath) {
 function detectToolboxState(opts) {
   const claude = claudeDirInternal();
   const toolboxPath = opts.toolboxPath;
-  const namespace = opts.namespace ?? path19.basename(toolboxPath);
-  const atlasUserFile = path19.join(claude, ".atlas-user");
-  const atlasUser = fs18.existsSync(atlasUserFile) ? fs18.readFileSync(atlasUserFile, "utf-8").trim() || void 0 : void 0;
+  const namespace = opts.namespace ?? path20.basename(toolboxPath);
+  const atlasUserFile = path20.join(claude, ".atlas-user");
+  const atlasUser = fs19.existsSync(atlasUserFile) ? fs19.readFileSync(atlasUserFile, "utf-8").trim() || void 0 : void 0;
   let subscriptionsJson;
   if (atlasUser) {
-    const sp = path19.join(toolboxPath, "members", atlasUser, "subscriptions.json");
-    if (fs18.existsSync(sp)) {
+    const sp = path20.join(toolboxPath, "members", atlasUser, "subscriptions.json");
+    if (fs19.existsSync(sp)) {
       try {
-        subscriptionsJson = JSON.parse(fs18.readFileSync(sp, "utf-8"));
+        subscriptionsJson = JSON.parse(fs19.readFileSync(sp, "utf-8"));
       } catch {
       }
     }
   }
   const atlasManagedSymlinks = listToolboxManagedSymlinks(toolboxPath);
   let originalSessionStartHook;
-  const settingsPath = path19.join(claude, "settings.json");
-  if (fs18.existsSync(settingsPath)) {
+  const settingsPath = path20.join(claude, "settings.json");
+  if (fs19.existsSync(settingsPath)) {
     try {
-      const settings = JSON.parse(fs18.readFileSync(settingsPath, "utf-8"));
+      const settings = JSON.parse(fs19.readFileSync(settingsPath, "utf-8"));
       const ss = settings?.hooks?.SessionStart;
       if (Array.isArray(ss))
         originalSessionStartHook = ss;
@@ -13099,21 +13114,21 @@ function detectToolboxState(opts) {
 }
 function writeMigrationSnapshot(snapshot) {
   const dir = migrationSnapshotsDir();
-  fs18.mkdirSync(dir, { recursive: true });
+  fs19.mkdirSync(dir, { recursive: true });
   const stamp = snapshot.takenAt.replace(/[:.]/g, "-");
-  const file = path19.join(dir, `${snapshot.namespace}-${stamp}.json`);
-  fs18.writeFileSync(file, JSON.stringify(snapshot, null, 2) + "\n", { mode: 420 });
+  const file = path20.join(dir, `${snapshot.namespace}-${stamp}.json`);
+  fs19.writeFileSync(file, JSON.stringify(snapshot, null, 2) + "\n", { mode: 420 });
   return file;
 }
 function readLatestMigrationSnapshot(opts = {}) {
   const dir = migrationSnapshotsDir();
-  if (!fs18.existsSync(dir))
+  if (!fs19.existsSync(dir))
     return void 0;
-  const files = fs18.readdirSync(dir).filter((f) => f.endsWith(".json")).sort().reverse();
+  const files = fs19.readdirSync(dir).filter((f) => f.endsWith(".json")).sort().reverse();
   for (const f of files) {
-    const full = path19.join(dir, f);
+    const full = path20.join(dir, f);
     try {
-      const snapshot = JSON.parse(fs18.readFileSync(full, "utf-8"));
+      const snapshot = JSON.parse(fs19.readFileSync(full, "utf-8"));
       if (snapshot.schemaVersion !== MIGRATION_SNAPSHOT_SCHEMA_VERSION)
         continue;
       if (opts.namespace !== void 0 && snapshot.namespace !== opts.namespace)
@@ -13126,7 +13141,7 @@ function readLatestMigrationSnapshot(opts = {}) {
   return void 0;
 }
 function readMigrationSnapshotFromPath(p) {
-  return JSON.parse(fs18.readFileSync(p, "utf-8"));
+  return JSON.parse(fs19.readFileSync(p, "utf-8"));
 }
 var MIGRATION_SNAPSHOT_SCHEMA_VERSION;
 var init_migration_snapshot = __esm({
@@ -13137,15 +13152,15 @@ var init_migration_snapshot = __esm({
 });
 
 // ../core/dist/skill-sync/artifact-resolver.js
-import * as fs19 from "node:fs";
-import * as path20 from "node:path";
+import * as fs20 from "node:fs";
+import * as path21 from "node:path";
 function resolveSubscriptions(opts) {
   const { clonePath, atlasUser } = opts;
   if (atlasUser) {
-    const subsPath = path20.join(clonePath, "members", atlasUser, "subscriptions.json");
-    if (fs19.existsSync(subsPath)) {
+    const subsPath = path21.join(clonePath, "members", atlasUser, "subscriptions.json");
+    if (fs20.existsSync(subsPath)) {
       try {
-        const parsed = JSON.parse(fs19.readFileSync(subsPath, "utf-8"));
+        const parsed = JSON.parse(fs20.readFileSync(subsPath, "utf-8"));
         if (Array.isArray(parsed?.categories)) {
           return {
             categories: parsed.categories.filter((c) => typeof c === "string"),
@@ -13157,10 +13172,10 @@ function resolveSubscriptions(opts) {
       }
     }
   }
-  const catsPath = path20.join(clonePath, "shared", "categories.json");
-  if (fs19.existsSync(catsPath)) {
+  const catsPath = path21.join(clonePath, "shared", "categories.json");
+  if (fs20.existsSync(catsPath)) {
     try {
-      const parsed = JSON.parse(fs19.readFileSync(catsPath, "utf-8"));
+      const parsed = JSON.parse(fs20.readFileSync(catsPath, "utf-8"));
       if (Array.isArray(parsed?.categories)) {
         return {
           categories: parsed.categories.map((c) => c.id).filter((id) => typeof id === "string"),
@@ -13171,14 +13186,14 @@ function resolveSubscriptions(opts) {
     } catch {
     }
   }
-  const sharedDir = path20.join(clonePath, "shared");
+  const sharedDir = path21.join(clonePath, "shared");
   const cats = [];
-  if (fs19.existsSync(sharedDir)) {
-    for (const name of fs19.readdirSync(sharedDir)) {
-      const dir = path20.join(sharedDir, name);
-      if (!fs19.statSync(dir).isDirectory())
+  if (fs20.existsSync(sharedDir)) {
+    for (const name of fs20.readdirSync(sharedDir)) {
+      const dir = path21.join(sharedDir, name);
+      if (!fs20.statSync(dir).isDirectory())
         continue;
-      if (fs19.existsSync(path20.join(dir, "skills")) || fs19.existsSync(path20.join(dir, "agents"))) {
+      if (fs20.existsSync(path21.join(dir, "skills")) || fs20.existsSync(path21.join(dir, "agents"))) {
         cats.push(name);
       }
     }
@@ -13186,29 +13201,29 @@ function resolveSubscriptions(opts) {
   return { categories: cats, fromSubscriptionsFile: false, atlasUser };
 }
 function listDirSafe(dir) {
-  if (!fs19.existsSync(dir))
+  if (!fs20.existsSync(dir))
     return [];
-  return fs19.readdirSync(dir);
+  return fs20.readdirSync(dir);
 }
 function resolveSkillsDir(opts) {
   const { sourceId, baseDir } = opts;
   const out = [];
   for (const name of listDirSafe(baseDir)) {
-    const subdir = path20.join(baseDir, name);
-    if (!fs19.statSync(subdir).isDirectory())
+    const subdir = path21.join(baseDir, name);
+    if (!fs20.statSync(subdir).isDirectory())
       continue;
-    if (!fs19.existsSync(path20.join(subdir, "SKILL.md")))
+    if (!fs20.existsSync(path21.join(subdir, "SKILL.md")))
       continue;
     out.push({ kind: "skill", sourceId, sourcePath: subdir, deployBasename: name });
-    const subagentsDir = path20.join(subdir, "references", "agents");
-    if (fs19.existsSync(subagentsDir) && fs19.statSync(subagentsDir).isDirectory()) {
+    const subagentsDir = path21.join(subdir, "references", "agents");
+    if (fs20.existsSync(subagentsDir) && fs20.statSync(subagentsDir).isDirectory()) {
       for (const f of listDirSafe(subagentsDir)) {
         if (!f.endsWith(".md"))
           continue;
         out.push({
           kind: "subagent",
           sourceId,
-          sourcePath: path20.join(subagentsDir, f),
+          sourcePath: path21.join(subagentsDir, f),
           deployBasename: f,
           parentSkill: name
         });
@@ -13221,18 +13236,18 @@ function resolveAgentsDir(opts) {
   const { sourceId, baseDir } = opts;
   const out = [];
   for (const name of listDirSafe(baseDir)) {
-    const full = path20.join(baseDir, name);
-    const stat = fs19.statSync(full);
-    if (stat.isFile() && name.endsWith(".md")) {
+    const full = path21.join(baseDir, name);
+    const stat2 = fs20.statSync(full);
+    if (stat2.isFile() && name.endsWith(".md")) {
       out.push({ kind: "agent", sourceId, sourcePath: full, deployBasename: name });
-    } else if (stat.isDirectory()) {
+    } else if (stat2.isDirectory()) {
       for (const f of listDirSafe(full)) {
         if (!f.endsWith(".md"))
           continue;
         out.push({
           kind: "agent",
           sourceId,
-          sourcePath: path20.join(full, f),
+          sourcePath: path21.join(full, f),
           deployBasename: `${name}-${f}`
         });
       }
@@ -13244,11 +13259,11 @@ function resolveScriptsDir(opts) {
   const { sourceId, baseDir } = opts;
   const out = [];
   for (const name of listDirSafe(baseDir)) {
-    const full = path20.join(baseDir, name);
-    const stat = fs19.statSync(full);
-    if (stat.isFile() && name.endsWith(".sh")) {
+    const full = path21.join(baseDir, name);
+    const stat2 = fs20.statSync(full);
+    if (stat2.isFile() && name.endsWith(".sh")) {
       out.push({ kind: "script", sourceId, sourcePath: full, deployBasename: name });
-    } else if (stat.isDirectory()) {
+    } else if (stat2.isDirectory()) {
       out.push({ kind: "script", sourceId, sourcePath: full, deployBasename: name });
     }
   }
@@ -13260,8 +13275,8 @@ function resolveRulesDir(opts) {
   for (const name of listDirSafe(baseDir)) {
     if (!name.endsWith(".md"))
       continue;
-    const full = path20.join(baseDir, name);
-    if (!fs19.statSync(full).isFile())
+    const full = path21.join(baseDir, name);
+    if (!fs20.statSync(full).isFile())
       continue;
     out.push({ kind: "rule", sourceId, sourcePath: full, deployBasename: name });
   }
@@ -13273,8 +13288,8 @@ function resolveJsonDir(opts) {
   for (const name of listDirSafe(baseDir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path20.join(baseDir, name);
-    if (!fs19.statSync(full).isFile())
+    const full = path21.join(baseDir, name);
+    if (!fs20.statSync(full).isFile())
       continue;
     out.push({ kind, sourceId, sourcePath: full, deployBasename: name });
   }
@@ -13286,8 +13301,8 @@ function resolveOverlaysDir(opts) {
   for (const name of listDirSafe(baseDir)) {
     if (!name.endsWith(".md"))
       continue;
-    const full = path20.join(baseDir, name);
-    if (!fs19.statSync(full).isFile())
+    const full = path21.join(baseDir, name);
+    if (!fs20.statSync(full).isFile())
       continue;
     const deployBasename = name.replace(/\.md$/, "");
     out.push({
@@ -13305,33 +13320,33 @@ function resolveSourceArtifacts(opts) {
   const subscription = resolveSubscriptions({ clonePath, atlasUser });
   const artifacts = [];
   for (const cat of subscription.categories) {
-    const catDir = path20.join(clonePath, "shared", cat);
-    if (!fs19.existsSync(catDir))
+    const catDir = path21.join(clonePath, "shared", cat);
+    if (!fs20.existsSync(catDir))
       continue;
-    artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path20.join(catDir, "skills") }));
-    artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path20.join(catDir, "agents") }));
-    artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path20.join(catDir, "scripts") }));
-    artifacts.push(...resolveRulesDir({ sourceId, baseDir: path20.join(catDir, "rules") }));
-    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path20.join(catDir, "hooks"), kind: "hook" }));
-    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path20.join(catDir, "permissions"), kind: "permission" }));
+    artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path21.join(catDir, "skills") }));
+    artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path21.join(catDir, "agents") }));
+    artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path21.join(catDir, "scripts") }));
+    artifacts.push(...resolveRulesDir({ sourceId, baseDir: path21.join(catDir, "rules") }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path21.join(catDir, "hooks"), kind: "hook" }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path21.join(catDir, "permissions"), kind: "permission" }));
   }
   if (atlasUser) {
-    const memberRoot = path20.join(clonePath, "members", atlasUser);
-    if (fs19.existsSync(memberRoot)) {
-      artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path20.join(memberRoot, "skills") }));
-      artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path20.join(memberRoot, "agents") }));
-      artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path20.join(memberRoot, "scripts") }));
-      artifacts.push(...resolveRulesDir({ sourceId, baseDir: path20.join(memberRoot, "rules") }));
-      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path20.join(memberRoot, "hooks"), kind: "hook" }));
-      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path20.join(memberRoot, "permissions"), kind: "permission" }));
+    const memberRoot = path21.join(clonePath, "members", atlasUser);
+    if (fs20.existsSync(memberRoot)) {
+      artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path21.join(memberRoot, "skills") }));
+      artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path21.join(memberRoot, "agents") }));
+      artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path21.join(memberRoot, "scripts") }));
+      artifacts.push(...resolveRulesDir({ sourceId, baseDir: path21.join(memberRoot, "rules") }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path21.join(memberRoot, "hooks"), kind: "hook" }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path21.join(memberRoot, "permissions"), kind: "permission" }));
       artifacts.push(...resolveOverlaysDir({
         sourceId,
-        baseDir: path20.join(memberRoot, "skills.overrides"),
+        baseDir: path21.join(memberRoot, "skills.overrides"),
         targetKind: "skill"
       }));
       artifacts.push(...resolveOverlaysDir({
         sourceId,
-        baseDir: path20.join(memberRoot, "agents.overrides"),
+        baseDir: path21.join(memberRoot, "agents.overrides"),
         targetKind: "agent"
       }));
     }
@@ -13396,14 +13411,14 @@ var init_shim_targets = __esm({
 });
 
 // ../core/dist/skill-sync/symlink-deployer.js
-import * as fs20 from "node:fs";
+import * as fs21 from "node:fs";
 import * as os13 from "node:os";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function claudeDir() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path21.join(os13.homedir(), ".claude");
+  return path22.join(os13.homedir(), ".claude");
 }
 function bucketFor(kind) {
   switch (kind) {
@@ -13463,16 +13478,16 @@ function detectCollisions(artifacts) {
 function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences, expectedAgentWinnerNames) {
   const shadowBackups = [];
   for (const bucket of BUCKETS) {
-    const dir = path21.join(claude, bucket);
-    if (!fs20.existsSync(dir))
+    const dir = path22.join(claude, bucket);
+    if (!fs21.existsSync(dir))
       continue;
-    for (const name of fs20.readdirSync(dir)) {
+    for (const name of fs21.readdirSync(dir)) {
       if (name === ".olam-merged")
         continue;
-      const p = path21.join(dir, name);
+      const p = path22.join(dir, name);
       try {
-        const stat = fs20.lstatSync(p);
-        if (stat.isSymbolicLink()) {
+        const stat2 = fs21.lstatSync(p);
+        if (stat2.isSymbolicLink()) {
           if (bucket === "scripts" && overlayReferences !== void 0) {
             const refs = overlayReferences.get(name);
             if (refs !== void 0 && refs.length > 0 && checkShimRemoval(name, "0.0.0") !== null) {
@@ -13492,8 +13507,8 @@ function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences, e
 `);
             }
           }
-          fs20.unlinkSync(p);
-        } else if (bucket === "agents" && stat.isFile() && !name.includes(".shadow-backup-")) {
+          fs21.unlinkSync(p);
+        } else if (bucket === "agents" && stat2.isFile() && !name.includes(".shadow-backup-")) {
           const hasWinner = expectedAgentWinnerNames !== void 0 ? expectedAgentWinnerNames.has(name) : true;
           if (hasWinner) {
             const backup = shadowBackup(p);
@@ -13509,34 +13524,34 @@ function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences, e
 function shadowBackup(link) {
   const epoch = Math.floor(Date.now() / 1e3);
   const backup = `${link}.shadow-backup-${epoch}`;
-  fs20.renameSync(link, backup);
+  fs21.renameSync(link, backup);
   return backup;
 }
 function linkIfNeeded(target, link) {
   try {
-    const existing = fs20.readlinkSync(link);
+    const existing = fs21.readlinkSync(link);
     if (existing === target)
       return { created: false };
   } catch {
   }
   let isLink = false;
   try {
-    isLink = fs20.lstatSync(link).isSymbolicLink();
+    isLink = fs21.lstatSync(link).isSymbolicLink();
   } catch {
   }
   let backup;
   if (isLink) {
-    fs20.unlinkSync(link);
-  } else if (fs20.existsSync(link)) {
+    fs21.unlinkSync(link);
+  } else if (fs21.existsSync(link)) {
     backup = shadowBackup(link);
   }
-  fs20.symlinkSync(target, link);
+  fs21.symlinkSync(target, link);
   return { created: true, shadowBackup: backup };
 }
 function deployArtifacts(artifacts, opts) {
   const claude = claudeDir();
   for (const bucket of BUCKETS) {
-    fs20.mkdirSync(path21.join(claude, bucket), { recursive: true });
+    fs21.mkdirSync(path22.join(claude, bucket), { recursive: true });
   }
   const { winners, collisions } = detectCollisions(artifacts);
   const expectedAgentWinnerNames = new Set(winners.filter((a) => a.kind === "agent").map((a) => a.deployBasename));
@@ -13546,11 +13561,11 @@ function deployArtifacts(artifacts, opts) {
     const bucket = bucketFor(artifact.kind);
     if (!bucket)
       continue;
-    const linkPath = path21.join(claude, bucket, artifact.deployBasename);
+    const linkPath = path22.join(claude, bucket, artifact.deployBasename);
     if (artifact.kind === "agent" && artifact.resolvedContent !== void 0) {
       const tmpPath = `${linkPath}.tmp-${process.pid}-${Date.now()}`;
-      fs20.writeFileSync(tmpPath, artifact.resolvedContent);
-      fs20.renameSync(tmpPath, linkPath);
+      fs21.writeFileSync(tmpPath, artifact.resolvedContent);
+      fs21.renameSync(tmpPath, linkPath);
       result.linked += 1;
       continue;
     }
@@ -13572,7 +13587,7 @@ var init_symlink_deployer = __esm({
 });
 
 // ../core/dist/meta-hooks/memory-recall.js
-import * as fs21 from "node:fs";
+import * as fs22 from "node:fs";
 function buildMemoryRecallHookEntry() {
   return {
     matcher: OLAM_META_MEMORY_RECALL_MATCHER,
@@ -13647,7 +13662,7 @@ var init_memory_recall = __esm({
 });
 
 // ../core/dist/meta-hooks/memory-classify.js
-import * as fs22 from "node:fs";
+import * as fs23 from "node:fs";
 function buildMemoryClassifyHookEntry() {
   return {
     matcher: OLAM_META_MEMORY_CLASSIFY_MATCHER,
@@ -13731,26 +13746,26 @@ var init_meta_hooks = __esm({
 });
 
 // ../core/dist/skill-sync/settings-merger.js
-import * as fs23 from "node:fs";
+import * as fs24 from "node:fs";
 import * as os14 from "node:os";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 function claudeSettingsPath() {
   const override = process.env["OLAM_CLAUDE_SETTINGS_PATH"];
   if (override && override.length > 0)
     return override;
-  return path22.join(claudeDirInternal2(), "settings.json");
+  return path23.join(claudeDirInternal2(), "settings.json");
 }
 function claudeDirInternal2() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path22.join(os14.homedir(), ".claude");
+  return path23.join(os14.homedir(), ".claude");
 }
 function settingsBackupDir() {
   const override = process.env["OLAM_SETTINGS_BACKUP_DIR"];
   if (override && override.length > 0)
     return override;
-  return path22.join(os14.homedir(), ".olam", "state", "settings-backups");
+  return path23.join(os14.homedir(), ".olam", "state", "settings-backups");
 }
 function dedupeByMatcher(entries) {
   const map = /* @__PURE__ */ new Map();
@@ -13797,28 +13812,28 @@ function tagOlam(entry) {
   return { ...entry, [OLAM_SKILLS_MARKER]: true };
 }
 function readJson(file) {
-  return JSON.parse(fs23.readFileSync(file, "utf-8"));
+  return JSON.parse(fs24.readFileSync(file, "utf-8"));
 }
 function rotateBackups(backupDir) {
-  if (!fs23.existsSync(backupDir))
+  if (!fs24.existsSync(backupDir))
     return;
-  const files = fs23.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path22.join(backupDir, f), mtime: fs23.statSync(path22.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  const files = fs24.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path23.join(backupDir, f), mtime: fs24.statSync(path23.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   for (const f of files.slice(BACKUP_RETENTION)) {
     try {
-      fs23.unlinkSync(f.full);
+      fs24.unlinkSync(f.full);
     } catch {
     }
   }
 }
 function backupSettings() {
   const src = claudeSettingsPath();
-  if (!fs23.existsSync(src))
+  if (!fs24.existsSync(src))
     return void 0;
   const dir = settingsBackupDir();
-  fs23.mkdirSync(dir, { recursive: true });
+  fs24.mkdirSync(dir, { recursive: true });
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dest = path22.join(dir, `settings-${stamp}.json`);
-  fs23.copyFileSync(src, dest);
+  const dest = path23.join(dir, `settings-${stamp}.json`);
+  fs24.copyFileSync(src, dest);
   rotateBackups(dir);
   return dest;
 }
@@ -13826,7 +13841,7 @@ function mergeSettings(input) {
   const settingsPath = claudeSettingsPath();
   const backupPath = backupSettings();
   let base = {};
-  if (fs23.existsSync(settingsPath)) {
+  if (fs24.existsSync(settingsPath)) {
     try {
       base = readJson(settingsPath);
     } catch {
@@ -13894,10 +13909,10 @@ function mergeSettings(input) {
       ...input.permissionFiles.length > 0 ? { allow: [...permSet] } : {}
     }
   };
-  fs23.mkdirSync(path22.dirname(settingsPath), { recursive: true });
+  fs24.mkdirSync(path23.dirname(settingsPath), { recursive: true });
   const tmp = `${settingsPath}.tmp-${process.pid}`;
-  fs23.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
-  fs23.renameSync(tmp, settingsPath);
+  fs24.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
+  fs24.renameSync(tmp, settingsPath);
   return { backupPath, hooksAdded, permissionsCount: permSet.size, dualWriteDeduped, dualWriteDroppedCommands };
 }
 var OLAM_SKILLS_MARKER, BACKUP_RETENTION, DUAL_WRITE_DEDUP_RULES;
@@ -13954,16 +13969,16 @@ var init_schema5 = __esm({
 
 // ../core/dist/skill-sync/per-project-override.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import * as fs24 from "node:fs";
-import * as path23 from "node:path";
+import * as fs25 from "node:fs";
+import * as path24 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function findProjectOverride(startDir) {
-  let dir = path23.resolve(startDir);
-  const root = path23.parse(dir).root;
+  let dir = path24.resolve(startDir);
+  const root = path24.parse(dir).root;
   while (true) {
-    const candidate = path23.join(dir, PROJECT_OVERRIDE_RELATIVE_PATH);
-    if (fs24.existsSync(candidate) && fs24.statSync(candidate).isFile()) {
-      const raw = fs24.readFileSync(candidate, "utf-8");
+    const candidate = path24.join(dir, PROJECT_OVERRIDE_RELATIVE_PATH);
+    if (fs25.existsSync(candidate) && fs25.statSync(candidate).isFile()) {
+      const raw = fs25.readFileSync(candidate, "utf-8");
       let parsed;
       try {
         parsed = parseYaml3(raw);
@@ -13976,7 +13991,7 @@ function findProjectOverride(startDir) {
     }
     if (dir === root)
       return void 0;
-    dir = path23.dirname(dir);
+    dir = path24.dirname(dir);
   }
 }
 function applyOverrideToArtifacts(artifacts, override) {
@@ -14017,14 +14032,14 @@ var init_per_project_override = __esm({
   "../core/dist/skill-sync/per-project-override.js"() {
     "use strict";
     init_schema5();
-    PROJECT_OVERRIDE_RELATIVE_PATH = path23.join(".olam", "skill-overrides.yaml");
+    PROJECT_OVERRIDE_RELATIVE_PATH = path24.join(".olam", "skill-overrides.yaml");
   }
 });
 
 // ../core/dist/lib/file-lock.js
-import * as fs25 from "node:fs";
+import * as fs26 from "node:fs";
 import * as os15 from "node:os";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 function defaultIsPidAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -14035,11 +14050,11 @@ function defaultIsPidAlive(pid) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 function readLockMeta(lockPath) {
   try {
-    const raw = fs25.readFileSync(lockPath, "utf-8");
+    const raw = fs26.readFileSync(lockPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
       return parsed;
@@ -14058,12 +14073,12 @@ function isLockStale(meta2, opts) {
 }
 function tryAcquireOnce(lockPath, meta2, opts) {
   try {
-    fs25.mkdirSync(path24.dirname(lockPath), { recursive: true });
-    const fd = fs25.openSync(lockPath, "wx", 384);
+    fs26.mkdirSync(path25.dirname(lockPath), { recursive: true });
+    const fd = fs26.openSync(lockPath, "wx", 384);
     try {
-      fs25.writeSync(fd, JSON.stringify(meta2));
+      fs26.writeSync(fd, JSON.stringify(meta2));
     } finally {
-      fs25.closeSync(fd);
+      fs26.closeSync(fd);
     }
     return true;
   } catch (err) {
@@ -14073,14 +14088,14 @@ function tryAcquireOnce(lockPath, meta2, opts) {
     const existing = readLockMeta(lockPath);
     if (existing === void 0) {
       try {
-        fs25.unlinkSync(lockPath);
+        fs26.unlinkSync(lockPath);
       } catch {
       }
       return tryAcquireOnce(lockPath, meta2, opts);
     }
     if (isLockStale(existing, opts)) {
       try {
-        fs25.unlinkSync(lockPath);
+        fs26.unlinkSync(lockPath);
       } catch {
       }
       return tryAcquireOnce(lockPath, meta2, opts);
@@ -14090,7 +14105,7 @@ function tryAcquireOnce(lockPath, meta2, opts) {
 }
 async function acquireFileLock(lockDir, options = {}) {
   const lockFilename = options.lockFilename ?? DEFAULT_LOCK_FILENAME;
-  const lockPath = path24.join(lockDir, lockFilename);
+  const lockPath = path25.join(lockDir, lockFilename);
   const acquireTimeoutMs = options.acquireTimeoutMs ?? DEFAULT_ACQUIRE_TIMEOUT_MS;
   const staleLockMs = options.staleLockMs ?? DEFAULT_STALE_LOCK_MS;
   const now = options.now ?? Date.now;
@@ -14110,7 +14125,7 @@ async function acquireFileLock(lockDir, options = {}) {
         lockPath,
         release: () => {
           try {
-            fs25.unlinkSync(lockPath);
+            fs26.unlinkSync(lockPath);
           } catch {
           }
         }
@@ -14214,11 +14229,11 @@ var init_min_version_filter = __esm({
 });
 
 // ../core/dist/skill-sync/overlay-scan.js
-import * as fs26 from "node:fs";
-import * as path25 from "node:path";
+import * as fs27 from "node:fs";
+import * as path26 from "node:path";
 function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
   const result = /* @__PURE__ */ new Map();
-  if (!fs26.existsSync(overlayRoot)) {
+  if (!fs27.existsSync(overlayRoot)) {
     return result;
   }
   if (basenames.length === 0) {
@@ -14227,13 +14242,13 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
   const mdFiles = [];
   let overlayRootReal;
   try {
-    overlayRootReal = fs26.realpathSync(overlayRoot);
+    overlayRootReal = fs27.realpathSync(overlayRoot);
   } catch {
     return result;
   }
   for (const subdir of OVERRIDE_SUBDIRS) {
-    const dir = path25.join(overlayRoot, subdir);
-    if (!fs26.existsSync(dir))
+    const dir = path26.join(overlayRoot, subdir);
+    if (!fs27.existsSync(dir))
       continue;
     walkMarkdown(dir, mdFiles, caps.maxFiles);
   }
@@ -14241,25 +14256,25 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
   for (const filepath of mdFiles) {
     let realFile;
     try {
-      realFile = fs26.realpathSync(filepath);
+      realFile = fs27.realpathSync(filepath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT" || code === "EACCES")
         continue;
       throw err;
     }
-    const rel = path25.relative(overlayRootReal, realFile);
-    if (rel.startsWith("..") || path25.isAbsolute(rel)) {
+    const rel = path26.relative(overlayRootReal, realFile);
+    if (rel.startsWith("..") || path26.isAbsolute(rel)) {
       continue;
     }
     let content;
     try {
-      const stat = fs26.statSync(filepath);
-      totalBytes += stat.size;
+      const stat2 = fs27.statSync(filepath);
+      totalBytes += stat2.size;
       if (totalBytes > caps.maxTotalBytes) {
         throw new Error(`[overlay-scan] aborted: overlay tree exceeds ${caps.maxTotalBytes} total bytes. Check OLAM_CLAUDE_DIR / overlay paths are correctly scoped.`);
       }
-      content = fs26.readFileSync(filepath, "utf8");
+      content = fs27.readFileSync(filepath, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT" || code === "EACCES") {
@@ -14267,7 +14282,7 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
       }
       throw err;
     }
-    const relpath = path25.relative(overlayRoot, filepath).split(path25.sep).join("/");
+    const relpath = path26.relative(overlayRoot, filepath).split(path26.sep).join("/");
     for (const basename6 of basenames) {
       if (content.includes(basename6)) {
         const list = result.get(basename6) ?? [];
@@ -14281,7 +14296,7 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
 function walkMarkdown(dir, out, cap) {
   let entries;
   try {
-    entries = fs26.readdirSync(dir, { withFileTypes: true });
+    entries = fs27.readdirSync(dir, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT")
       return;
@@ -14291,7 +14306,7 @@ function walkMarkdown(dir, out, cap) {
     if (out.length >= cap) {
       throw new Error(`[overlay-scan] aborted: overlay tree contains > ${cap} markdown files. Check OLAM_CLAUDE_DIR / overlay paths are correctly scoped.`);
     }
-    const full = path25.join(dir, entry.name);
+    const full = path26.join(dir, entry.name);
     if (entry.isSymbolicLink())
       continue;
     if (entry.isDirectory()) {
@@ -14316,12 +14331,12 @@ var init_overlay_scan = __esm({
 });
 
 // ../core/dist/skill-sync/settings-json-lock.js
-import * as fs27 from "node:fs";
+import * as fs28 from "node:fs";
 import * as os16 from "node:os";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 function defaultSettingsJsonLockPath() {
-  const stateDir = process.env["OLAM_STATE_DIR"] ?? path26.join(os16.homedir(), ".olam", "state");
-  return path26.join(stateDir, SETTINGS_JSON_LOCK_FILENAME);
+  const stateDir = process.env["OLAM_STATE_DIR"] ?? path27.join(os16.homedir(), ".olam", "state");
+  return path27.join(stateDir, SETTINGS_JSON_LOCK_FILENAME);
 }
 function defaultIsPidAlive2(pid) {
   try {
@@ -14333,11 +14348,11 @@ function defaultIsPidAlive2(pid) {
   }
 }
 function sleep4(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 function readLockMeta2(lockPath) {
   try {
-    const raw = fs27.readFileSync(lockPath, "utf-8");
+    const raw = fs28.readFileSync(lockPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
       return parsed;
@@ -14360,12 +14375,12 @@ function isLockStale2(meta2, opts) {
 function tryAcquireOnce2(lockPath, meta2, opts) {
   for (let attempt = 0; attempt <= MAX_STEAL_ATTEMPTS; attempt += 1) {
     try {
-      fs27.mkdirSync(path26.dirname(lockPath), { recursive: true });
-      const fd = fs27.openSync(lockPath, "wx", 384);
+      fs28.mkdirSync(path27.dirname(lockPath), { recursive: true });
+      const fd = fs28.openSync(lockPath, "wx", 384);
       try {
-        fs27.writeSync(fd, JSON.stringify(meta2));
+        fs28.writeSync(fd, JSON.stringify(meta2));
       } finally {
-        fs27.closeSync(fd);
+        fs28.closeSync(fd);
       }
       return true;
     } catch (err) {
@@ -14383,9 +14398,9 @@ function tryAcquireOnce2(lockPath, meta2, opts) {
     }
     const victimPath = `${lockPath}.victim-${process.pid}-${attempt}-${Date.now()}`;
     try {
-      fs27.renameSync(lockPath, victimPath);
+      fs28.renameSync(lockPath, victimPath);
       try {
-        fs27.unlinkSync(victimPath);
+        fs28.unlinkSync(victimPath);
       } catch {
       }
     } catch (err) {
@@ -14417,7 +14432,7 @@ async function acquireSettingsJsonLock(options = {}) {
         lockPath,
         release: () => {
           try {
-            fs27.unlinkSync(lockPath);
+            fs28.unlinkSync(lockPath);
           } catch {
           }
         }
@@ -14520,14 +14535,14 @@ var init_services_status = __esm({
 
 // ../core/dist/skill-sources/meta-hooks-migration-snapshot.js
 import * as crypto5 from "node:crypto";
-import * as fs28 from "node:fs";
+import * as fs29 from "node:fs";
 import * as os17 from "node:os";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 function migrationSnapshotsDir2() {
   const override = process.env["OLAM_MIGRATION_SNAPSHOTS_DIR"];
   if (override && override.length > 0)
     return override;
-  return path27.join(os17.homedir(), ".olam", "state", "migration-snapshots");
+  return path28.join(os17.homedir(), ".olam", "state", "migration-snapshots");
 }
 function writeMetaHooksSnapshot(originalSettings) {
   const snapshot = {
@@ -14538,11 +14553,11 @@ function writeMetaHooksSnapshot(originalSettings) {
   };
   const validated = MetaHooksMigrationSnapshotSchema.parse(snapshot);
   const dir = migrationSnapshotsDir2();
-  fs28.mkdirSync(dir, { recursive: true });
+  fs29.mkdirSync(dir, { recursive: true });
   const stamp = validated.takenAt.replace(/[:.]/g, "-");
   const rand = crypto5.randomBytes(3).toString("hex");
-  const file = path27.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
-  fs28.writeFileSync(file, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
+  const file = path28.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
+  fs29.writeFileSync(file, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
   return file;
 }
 var META_HOOKS_SNAPSHOT_SCHEMA_VERSION, META_HOOKS_SNAPSHOT_PREFIX, SettingsLooseSchema, MetaHooksMigrationSnapshotSchema;
@@ -14909,44 +14924,44 @@ var init_markdown_merger = __esm({
 });
 
 // ../core/dist/skill-sync/managed-merge.js
-import * as fs29 from "node:fs";
-import * as path28 from "node:path";
+import * as fs30 from "node:fs";
+import * as path29 from "node:path";
 function materializeMergedSkill(opts) {
   const { sourceId, sourcePath, deployBasename, mergedContent, claudeDir: claudeDir2 } = opts;
-  const managedDir = path28.join(claudeDir2, ".olam-merged", sourceId, deployBasename);
-  const sourceRoot = path28.resolve(path28.join(claudeDir2, ".olam-merged", sourceId));
-  const managedResolved = path28.resolve(managedDir);
-  if (!(managedResolved === sourceRoot || managedResolved.startsWith(sourceRoot + path28.sep))) {
+  const managedDir = path29.join(claudeDir2, ".olam-merged", sourceId, deployBasename);
+  const sourceRoot = path29.resolve(path29.join(claudeDir2, ".olam-merged", sourceId));
+  const managedResolved = path29.resolve(managedDir);
+  if (!(managedResolved === sourceRoot || managedResolved.startsWith(sourceRoot + path29.sep))) {
     throw new Error(`[managed-merge] refusing to materialize: deployBasename "${deployBasename}" escapes managed root "${sourceRoot}" (resolved to "${managedResolved}")`);
   }
-  fs29.mkdirSync(managedDir, { recursive: true });
-  const skillMdPath = path28.join(managedDir, "SKILL.md");
+  fs30.mkdirSync(managedDir, { recursive: true });
+  const skillMdPath = path29.join(managedDir, "SKILL.md");
   const tmpPath = `${skillMdPath}.tmp-${process.pid}-${Date.now()}`;
-  fs29.writeFileSync(tmpPath, mergedContent);
-  fs29.renameSync(tmpPath, skillMdPath);
-  const baseEntries = fs29.readdirSync(sourcePath);
+  fs30.writeFileSync(tmpPath, mergedContent);
+  fs30.renameSync(tmpPath, skillMdPath);
+  const baseEntries = fs30.readdirSync(sourcePath);
   for (const entry of baseEntries) {
     if (entry === "SKILL.md")
       continue;
-    const linkPath = path28.join(managedDir, entry);
-    const targetAbsolute = path28.join(sourcePath, entry);
-    const targetRelative = path28.relative(managedDir, targetAbsolute);
+    const linkPath = path29.join(managedDir, entry);
+    const targetAbsolute = path29.join(sourcePath, entry);
+    const targetRelative = path29.relative(managedDir, targetAbsolute);
     try {
-      fs29.lstatSync(linkPath);
-      fs29.rmSync(linkPath, { recursive: true, force: true });
+      fs30.lstatSync(linkPath);
+      fs30.rmSync(linkPath, { recursive: true, force: true });
     } catch {
     }
-    fs29.symlinkSync(targetRelative, linkPath);
+    fs30.symlinkSync(targetRelative, linkPath);
   }
-  const managedEntries = fs29.readdirSync(managedDir);
+  const managedEntries = fs30.readdirSync(managedDir);
   const baseEntrySet = new Set(baseEntries);
   for (const entry of managedEntries) {
     if (entry === "SKILL.md")
       continue;
     if (!baseEntrySet.has(entry)) {
-      const stalePath = path28.join(managedDir, entry);
+      const stalePath = path29.join(managedDir, entry);
       try {
-        fs29.rmSync(stalePath, { recursive: true, force: true });
+        fs30.rmSync(stalePath, { recursive: true, force: true });
       } catch {
       }
     }
@@ -14954,7 +14969,7 @@ function materializeMergedSkill(opts) {
   return managedDir;
 }
 function cleanMergedDir(claudeDir2) {
-  fs29.rmSync(path28.join(claudeDir2, ".olam-merged"), { recursive: true, force: true });
+  fs30.rmSync(path29.join(claudeDir2, ".olam-merged"), { recursive: true, force: true });
 }
 var init_managed_merge = __esm({
   "../core/dist/skill-sync/managed-merge.js"() {
@@ -15001,8 +15016,8 @@ var init_prefix_rules = __esm({
 });
 
 // ../core/dist/skill-sync/prefix-deploy.js
-import * as fs30 from "node:fs";
-import * as path29 from "node:path";
+import * as fs31 from "node:fs";
+import * as path30 from "node:path";
 function buildSourcePrefixMap(sources) {
   const byId = /* @__PURE__ */ new Map();
   const scopeById = /* @__PURE__ */ new Map();
@@ -15050,8 +15065,8 @@ function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir2, dryRun) {
       continue;
     }
     if (artifact.kind === "skill") {
-      const skillMdPath = path29.join(artifact.sourcePath, "SKILL.md");
-      const content = fs30.readFileSync(skillMdPath);
+      const skillMdPath = path30.join(artifact.sourcePath, "SKILL.md");
+      const content = fs31.readFileSync(skillMdPath);
       const rewritten = rewriteFrontmatterName(content, () => renamedFrontmatterName);
       const managedDir = materializeMergedSkill({
         sourceId: artifact.sourceId,
@@ -15063,7 +15078,7 @@ function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir2, dryRun) {
       artifact.sourcePath = managedDir;
       artifact.deployBasename = renamed;
     } else {
-      const content = artifact.resolvedContent !== void 0 ? artifact.resolvedContent : fs30.readFileSync(artifact.sourcePath);
+      const content = artifact.resolvedContent !== void 0 ? artifact.resolvedContent : fs31.readFileSync(artifact.sourcePath);
       const rewritten = rewriteFrontmatterName(content, () => renamedFrontmatterName);
       artifact.resolvedContent = rewritten;
       artifact.deployBasename = renamed;
@@ -15115,12 +15130,12 @@ function sourceConfigPath(clonePath) {
   return join31(clonePath, "shared", "source-config.yaml");
 }
 function readSourceConfig(clonePath, sourceId) {
-  const path52 = sourceConfigPath(clonePath);
-  if (!existsSync31(path52))
+  const path53 = sourceConfigPath(clonePath);
+  if (!existsSync31(path53))
     return void 0;
   let raw;
   try {
-    raw = readFileSync29(path52, "utf-8");
+    raw = readFileSync29(path53, "utf-8");
   } catch (err) {
     emitMalformedWarning(sourceId, `read failed: ${errToMsg(err)}`);
     return void 0;
@@ -15199,16 +15214,16 @@ var init_resolve_source_config = __esm({
 });
 
 // ../core/dist/skill-sync/engine.js
-import * as fs31 from "node:fs";
+import * as fs32 from "node:fs";
 import * as os18 from "node:os";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 function resolveAtlasUser(override) {
   if (override)
     return override;
-  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path30.join(os18.homedir(), ".claude");
-  const f = path30.join(claudeDir2, ".atlas-user");
-  if (fs31.existsSync(f)) {
-    return fs31.readFileSync(f, "utf-8").trim() || void 0;
+  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path31.join(os18.homedir(), ".claude");
+  const f = path31.join(claudeDir2, ".atlas-user");
+  if (fs32.existsSync(f)) {
+    return fs32.readFileSync(f, "utf-8").trim() || void 0;
   }
   return void 0;
 }
@@ -15220,7 +15235,7 @@ async function syncSkills(opts = {}) {
   const perSource = [];
   for (const source of sources) {
     const clonePath = skillSourceClonePath(source.id);
-    if (!fs31.existsSync(clonePath))
+    if (!fs32.existsSync(clonePath))
       continue;
     const { artifacts, subscription } = await withFileLock(clonePath, () => {
       const pinRef = projectOverride?.override.pin?.[source.id];
@@ -15260,7 +15275,7 @@ async function syncSkills(opts = {}) {
   const overlayArtifacts = memberOverlaysEnabled ? projectFilteredArtifacts.filter((a) => a.kind === "overlay") : [];
   const effectiveSources = sources.map((s) => {
     const clonePath = skillSourceClonePath(s.id);
-    const sourceConfig = fs31.existsSync(clonePath) ? readSourceConfig(clonePath, s.id) : void 0;
+    const sourceConfig = fs32.existsSync(clonePath) ? readSourceConfig(clonePath, s.id) : void 0;
     const eff = resolveEffectivePrefix(s, sourceConfig);
     const entry = {
       id: s.id,
@@ -15363,13 +15378,13 @@ async function syncSkills(opts = {}) {
       let baseContent;
       let basePath;
       if (overlay.targetKind === "skill") {
-        basePath = path30.join(base.sourcePath, "SKILL.md");
-        baseContent = fs31.readFileSync(basePath, "utf-8");
+        basePath = path31.join(base.sourcePath, "SKILL.md");
+        baseContent = fs32.readFileSync(basePath, "utf-8");
       } else {
         basePath = base.sourcePath;
-        baseContent = fs31.readFileSync(basePath, "utf-8");
+        baseContent = fs32.readFileSync(basePath, "utf-8");
       }
-      const overlayContent = fs31.readFileSync(overlay.sourcePath, "utf-8");
+      const overlayContent = fs32.readFileSync(overlay.sourcePath, "utf-8");
       const label = `${overlay.sourceId}/${overlay.deployBasename}`;
       const mergeResult = mergeMarkdown(baseContent, overlayContent, label, basePath, overlay.sourcePath);
       if ("error" in mergeResult) {
@@ -15430,7 +15445,7 @@ async function syncSkills(opts = {}) {
     summary.collisions = detectCollisions(baseArtifacts).collisions;
     return summary;
   }
-  const claudeDirPath = process.env["OLAM_CLAUDE_DIR"] || path30.join(os18.homedir(), ".claude");
+  const claudeDirPath = process.env["OLAM_CLAUDE_DIR"] || path31.join(os18.homedir(), ".claude");
   const overlayReferences = scanOverlayReferences(claudeDirPath, SHIM_TARGETS.map((t) => t.basename));
   summary.deploy = deployArtifacts(baseArtifacts, {
     installedOlamVersion,
@@ -15456,19 +15471,19 @@ async function injectMetaHooksIntoSettings(opts) {
   const result = await withSettingsJsonLock(() => {
     let currentSettings = {};
     let settingsExisted = false;
-    if (fs31.existsSync(settingsFile)) {
+    if (fs32.existsSync(settingsFile)) {
       settingsExisted = true;
       try {
-        const raw = fs31.readFileSync(settingsFile, "utf-8");
+        const raw = fs32.readFileSync(settingsFile, "utf-8");
         currentSettings = raw.trim() ? JSON.parse(raw) : {};
       } catch {
         try {
-          const raw = fs31.readFileSync(settingsFile);
-          const bakDir = path30.join(path30.dirname(settingsFile), ".malformed-backups");
-          fs31.mkdirSync(bakDir, { recursive: true });
+          const raw = fs32.readFileSync(settingsFile);
+          const bakDir = path31.join(path31.dirname(settingsFile), ".malformed-backups");
+          fs32.mkdirSync(bakDir, { recursive: true });
           const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-          const bakFile = path30.join(bakDir, `settings.json.malformed.${stamp}.bak`);
-          fs31.writeFileSync(bakFile, raw, { mode: 384 });
+          const bakFile = path31.join(bakDir, `settings.json.malformed.${stamp}.bak`);
+          fs32.writeFileSync(bakFile, raw, { mode: 384 });
           snapshotError = `settings.json was malformed; original bytes preserved at ${bakFile}`;
         } catch (bakErr) {
           snapshotError = `settings.json malformed AND .bak write failed: ${bakErr instanceof Error ? bakErr.message : String(bakErr)}`;
@@ -15518,10 +15533,10 @@ async function injectMetaHooksIntoSettings(opts) {
       } catch {
       }
     }
-    fs31.mkdirSync(path30.dirname(settingsFile), { recursive: true });
+    fs32.mkdirSync(path31.dirname(settingsFile), { recursive: true });
     const tmpPath = `${settingsFile}.tmp-${process.pid}-${Date.now()}`;
-    fs31.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
-    fs31.renameSync(tmpPath, settingsFile);
+    fs32.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
+    fs32.renameSync(tmpPath, settingsFile);
     return inject;
   }, { reason: `syncSkills meta-hook injection (mode=${mode})` });
   return {
@@ -15562,19 +15577,19 @@ var init_engine = __esm({
 });
 
 // ../core/dist/skill-sync/shadow-backup-manager.js
-import * as fs32 from "node:fs";
-import * as path31 from "node:path";
+import * as fs33 from "node:fs";
+import * as path32 from "node:path";
 function listShadowBackups(opts = {}) {
   const claude = opts.claudeDirOverride ?? claudeDir();
   const now = opts.now ?? Date.now();
   const out = [];
   for (const bucket of SHADOW_BACKUP_BUCKETS) {
-    const bucketDir = path31.join(claude, bucket);
-    if (!fs32.existsSync(bucketDir))
+    const bucketDir = path32.join(claude, bucket);
+    if (!fs33.existsSync(bucketDir))
       continue;
     let entries;
     try {
-      entries = fs32.readdirSync(bucketDir);
+      entries = fs33.readdirSync(bucketDir);
     } catch {
       continue;
     }
@@ -15585,10 +15600,10 @@ function listShadowBackups(opts = {}) {
       const epochSeconds = Number.parseInt(match[1], 10);
       if (!Number.isFinite(epochSeconds) || epochSeconds < 0)
         continue;
-      const full = path31.join(bucketDir, name);
+      const full = path32.join(bucketDir, name);
       let sizeBytes = 0;
       try {
-        const st = fs32.statSync(full);
+        const st = fs33.statSync(full);
         if (st.isDirectory())
           continue;
         sizeBytes = st.size;
@@ -15601,7 +15616,7 @@ function listShadowBackups(opts = {}) {
         bucket,
         basename: name,
         originalBasename,
-        originalPath: path31.join(bucketDir, originalBasename),
+        originalPath: path32.join(bucketDir, originalBasename),
         epochSeconds,
         ageMs: now - epochSeconds * 1e3,
         sizeBytes
@@ -15644,7 +15659,7 @@ function pruneShadowBackups(opts) {
     }
     if (!opts.dryRun) {
       try {
-        fs32.unlinkSync(b.path);
+        fs33.unlinkSync(b.path);
       } catch {
         skipped.push(b);
         continue;
@@ -15655,24 +15670,24 @@ function pruneShadowBackups(opts) {
   return { deleted, skipped };
 }
 function restoreShadowBackup(opts) {
-  const abs = path31.resolve(opts.backupPath);
-  if (!fs32.existsSync(abs)) {
+  const abs = path32.resolve(opts.backupPath);
+  if (!fs33.existsSync(abs)) {
     throw new Error(`backup file not found: ${abs}`);
   }
-  const basename6 = path31.basename(abs);
+  const basename6 = path32.basename(abs);
   const match = SHADOW_BACKUP_SUFFIX_RE.exec(basename6);
   if (!match) {
     throw new Error(`not a shadow-backup file (basename "${basename6}" does not match \`.shadow-backup-<epoch>\`): ${abs}`);
   }
   const originalBasename = basename6.slice(0, basename6.length - match[0].length);
-  const originalPath = path31.join(path31.dirname(abs), originalBasename);
-  if (fs32.existsSync(originalPath) && !opts.force) {
+  const originalPath = path32.join(path32.dirname(abs), originalBasename);
+  if (fs33.existsSync(originalPath) && !opts.force) {
     throw new Error(`original path already occupied: ${originalPath}. Move/rename it first OR re-run with --force.`);
   }
-  if (opts.force && fs32.existsSync(originalPath)) {
-    fs32.unlinkSync(originalPath);
+  if (opts.force && fs33.existsSync(originalPath)) {
+    fs33.unlinkSync(originalPath);
   }
-  fs32.renameSync(abs, originalPath);
+  fs33.renameSync(abs, originalPath);
   return { restoredTo: originalPath };
 }
 var SHADOW_BACKUP_BUCKETS, SHADOW_BACKUP_SUFFIX_RE;
@@ -15686,14 +15701,14 @@ var init_shadow_backup_manager = __esm({
 });
 
 // ../core/dist/skill-sources/doctor-checks.js
-import * as fs33 from "node:fs";
-import * as path32 from "node:path";
+import * as fs34 from "node:fs";
+import * as path33 from "node:path";
 import * as os19 from "node:os";
 function claudeDirInternal3() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path32.join(os19.homedir(), ".claude");
+  return path33.join(os19.homedir(), ".claude");
 }
 function checkStateFileParse() {
   const filePath = globalConfigPath();
@@ -15702,11 +15717,11 @@ function checkStateFileParse() {
     healthy: true,
     description: `~/.olam state file (${filePath})`
   };
-  if (!fs33.existsSync(filePath)) {
+  if (!fs34.existsSync(filePath)) {
     result.details = ["(file does not yet exist \u2014 will be created on first write)"];
     return result;
   }
-  const raw = fs33.readFileSync(filePath, "utf-8");
+  const raw = fs34.readFileSync(filePath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -15716,8 +15731,8 @@ function checkStateFileParse() {
     result.details = [err instanceof Error ? err.message : String(err)];
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs33.renameSync(filePath, aside);
-      fs33.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
+      fs34.renameSync(filePath, aside);
+      fs34.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
     };
     return result;
   }
@@ -15728,7 +15743,7 @@ function checkStateFileParse() {
     result.details = validation.error.issues.map((e) => `${e.path.join(".")}: ${e.message}`);
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs33.copyFileSync(filePath, aside);
+      fs34.copyFileSync(filePath, aside);
       const base = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
       const next = {
         ...base,
@@ -15737,7 +15752,7 @@ function checkStateFileParse() {
         runbooks: [],
         skillSources: []
       };
-      fs33.writeFileSync(filePath, JSON.stringify(next, null, 2));
+      fs34.writeFileSync(filePath, JSON.stringify(next, null, 2));
     };
     return result;
   }
@@ -15748,16 +15763,16 @@ function checkDanglingSymlinks() {
   const buckets = ["commands", "agents", "skills", "scripts", "rules"];
   const dangling = [];
   for (const bucket of buckets) {
-    const dir = path32.join(claude, bucket);
-    if (!fs33.existsSync(dir))
+    const dir = path33.join(claude, bucket);
+    if (!fs34.existsSync(dir))
       continue;
-    for (const name of fs33.readdirSync(dir)) {
-      const linkPath = path32.join(dir, name);
+    for (const name of fs34.readdirSync(dir)) {
+      const linkPath = path33.join(dir, name);
       try {
-        const lst = fs33.lstatSync(linkPath);
+        const lst = fs34.lstatSync(linkPath);
         if (!lst.isSymbolicLink())
           continue;
-        if (!fs33.existsSync(linkPath)) {
+        if (!fs34.existsSync(linkPath)) {
           dangling.push(linkPath);
         }
       } catch {
@@ -15775,7 +15790,7 @@ function checkDanglingSymlinks() {
     result.repair = () => {
       for (const p of dangling) {
         try {
-          fs33.unlinkSync(p);
+          fs34.unlinkSync(p);
         } catch {
         }
       }
@@ -15790,19 +15805,19 @@ function checkOrphanedSnapshots() {
     healthy: true,
     description: `orphaned migration snapshots under ${dir}`
   };
-  if (!fs33.existsSync(dir)) {
+  if (!fs34.existsSync(dir)) {
     return result;
   }
   const orphans = [];
-  for (const name of fs33.readdirSync(dir)) {
+  for (const name of fs34.readdirSync(dir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path32.join(dir, name);
+    const full = path33.join(dir, name);
     try {
-      const stat = fs33.statSync(full);
-      if (!stat.isFile())
+      const stat2 = fs34.statSync(full);
+      if (!stat2.isFile())
         continue;
-      const raw = fs33.readFileSync(full, "utf-8");
+      const raw = fs34.readFileSync(full, "utf-8");
       let parsed;
       try {
         parsed = JSON.parse(raw);
@@ -15827,7 +15842,7 @@ function checkOrphanedSnapshots() {
     result.repair = () => {
       for (const o of orphans) {
         try {
-          fs33.unlinkSync(o.path);
+          fs34.unlinkSync(o.path);
         } catch {
         }
       }
@@ -15842,12 +15857,12 @@ function checkSentinelDrift() {
     healthy: true,
     description: `olam-skills sentinel block in ${filePath}`
   };
-  if (!fs33.existsSync(filePath)) {
+  if (!fs34.existsSync(filePath)) {
     return result;
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs33.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs34.readFileSync(filePath, "utf-8"));
   } catch {
     return result;
   }
@@ -15888,7 +15903,7 @@ function checkSentinelDrift() {
         backupSettings();
       } catch {
       }
-      const next = JSON.parse(fs33.readFileSync(filePath, "utf-8"));
+      const next = JSON.parse(fs34.readFileSync(filePath, "utf-8"));
       if (!next.hooks)
         return;
       for (const stage of Object.keys(next.hooks)) {
@@ -15911,7 +15926,7 @@ function checkSentinelDrift() {
           return bad === void 0;
         });
       }
-      fs33.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs34.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
     };
   }
   return result;
@@ -15935,8 +15950,8 @@ function checkMemberNameMissing() {
     return result;
   }
   const claudeDir2 = claudeDirInternal3();
-  const atlasUserPath = path32.join(claudeDir2, ".atlas-user");
-  const value = fs33.existsSync(atlasUserPath) ? fs33.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  const atlasUserPath = path33.join(claudeDir2, ".atlas-user");
+  const value = fs34.existsSync(atlasUserPath) ? fs34.readFileSync(atlasUserPath, "utf-8").trim() : "";
   if (value.length > 0) {
     result.details = [`atlas-user: ${value}`];
     return result;
@@ -15944,10 +15959,10 @@ function checkMemberNameMissing() {
   result.healthy = false;
   result.issue = "atlas-toolbox source registered but ~/.claude/.atlas-user not set";
   const clonePath = skillSourceClonePath(atlasSource.id);
-  const membersDir = path32.join(clonePath, "members");
-  const existing = fs33.existsSync(membersDir) ? fs33.readdirSync(membersDir).filter((e) => {
+  const membersDir = path33.join(clonePath, "members");
+  const existing = fs34.existsSync(membersDir) ? fs34.readdirSync(membersDir).filter((e) => {
     try {
-      return fs33.statSync(path32.join(membersDir, e)).isDirectory();
+      return fs34.statSync(path33.join(membersDir, e)).isDirectory();
     } catch {
       return false;
     }
@@ -15961,8 +15976,8 @@ function checkMemberNameMissing() {
 }
 function checkMemberOverlayDrift() {
   const claudeDir2 = claudeDirInternal3();
-  const atlasUserPath = path32.join(claudeDir2, ".atlas-user");
-  const atlasUser = fs33.existsSync(atlasUserPath) ? fs33.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  const atlasUserPath = path33.join(claudeDir2, ".atlas-user");
+  const atlasUser = fs34.existsSync(atlasUserPath) ? fs34.readFileSync(atlasUserPath, "utf-8").trim() : "";
   if (atlasUser.length === 0) {
     return [];
   }
@@ -15978,26 +15993,26 @@ function checkMemberOverlayDrift() {
   const clonePath = skillSourceClonePath(atlasSource.id);
   const results = [];
   for (const kind of ["skills", "agents"]) {
-    const localRoot = path32.join(claudeDir2, `${kind}.overrides`);
-    if (!fs33.existsSync(localRoot))
+    const localRoot = path33.join(claudeDir2, `${kind}.overrides`);
+    if (!fs34.existsSync(localRoot))
       continue;
     let entries;
     try {
-      entries = fs33.readdirSync(localRoot);
+      entries = fs34.readdirSync(localRoot);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const localFile = path32.join(localRoot, entry);
-      let stat;
+      const localFile = path33.join(localRoot, entry);
+      let stat2;
       try {
-        stat = fs33.statSync(localFile);
+        stat2 = fs34.statSync(localFile);
       } catch {
         continue;
       }
-      if (!stat.isFile())
+      if (!stat2.isFile())
         continue;
-      const cloneFile = path32.join(clonePath, "members", atlasUser, `${kind}.overrides`, entry);
+      const cloneFile = path33.join(clonePath, "members", atlasUser, `${kind}.overrides`, entry);
       const localSha = sha256OfPath(localFile);
       const cloneSha = sha256OfPath(cloneFile);
       if (localSha === cloneSha) {
@@ -16421,10 +16436,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path52) {
-  if (!path52)
+function getElementAtPath(obj, path53) {
+  if (!path53)
     return obj;
-  return path52.reduce((acc, key) => acc?.[key], obj);
+  return path53.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -16833,11 +16848,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path52, issues) {
+function prefixIssues(path53, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path52);
+    iss.path.unshift(path53);
     return iss;
   });
 }
@@ -16984,16 +16999,16 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
 }
 function formatError(error2, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error3, path52 = []) => {
+  const processError = (error3, path53 = []) => {
     for (const issue2 of error3.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path53, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path53, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path53, ...issue2.path]);
       } else {
-        const fullpath = [...path52, ...issue2.path];
+        const fullpath = [...path53, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -23210,12 +23225,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve14) => {
+    return new Promise((resolve15) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve14();
+        resolve15();
       } else {
-        this._stdout.once("drain", resolve14);
+        this._stdout.once("drain", resolve15);
       }
     });
   }
@@ -25252,7 +25267,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
+        await new Promise((resolve15) => setTimeout(resolve15, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -25269,7 +25284,7 @@ var Protocol = class {
    */
   request(request2, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve14, reject2) => {
+    return new Promise((resolve15, reject2) => {
       const earlyReject = (error2) => {
         reject2(error2);
       };
@@ -25347,7 +25362,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject2(parseResult.error);
           } else {
-            resolve14(parseResult.data);
+            resolve15(parseResult.data);
           }
         } catch (error2) {
           reject2(error2);
@@ -25608,12 +25623,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve14, reject2) => {
+    return new Promise((resolve15, reject2) => {
       if (signal.aborted) {
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve14, interval);
+      const timeoutId = setTimeout(resolve15, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -26935,7 +26950,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
+      await new Promise((resolve15) => setTimeout(resolve15, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -27527,6 +27542,59 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 
+// ../mcp-server/src/tool-filter.ts
+function getToolFilterContextFromEnv() {
+  const raw = process.env.OLAM_ALLOWED_TOOLS;
+  const worldId = process.env.OLAM_WORLD_ID;
+  const context = {};
+  if (worldId && worldId.trim() !== "") {
+    context.worldId = worldId;
+  }
+  if (raw && raw.trim() !== "") {
+    const allowedTools = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    if (allowedTools.length > 0) {
+      context.allowedTools = allowedTools;
+    }
+  }
+  return context;
+}
+function withFilteredTools(server, context) {
+  const allowed = context.allowedTools;
+  if (!allowed || allowed.length === 0) {
+    return { server, finalize: () => {
+    } };
+  }
+  const allowedSet = new Set(allowed);
+  const registered = /* @__PURE__ */ new Set();
+  const host = server;
+  const original = host.tool;
+  const filtered = function(name, ...rest) {
+    if (typeof name === "string" && allowedSet.has(name)) {
+      registered.add(name);
+      return original.apply(
+        server,
+        [name, ...rest]
+      );
+    }
+    return void 0;
+  };
+  host.tool = filtered;
+  return {
+    server,
+    finalize: () => {
+      host.tool = original;
+      for (const name of allowedSet) {
+        if (!registered.has(name)) {
+          process.stderr.write(
+            `[tool-filter] warning: unknown tool name in OLAM_ALLOWED_TOOLS: "${name}"
+`
+          );
+        }
+      }
+    }
+  };
+}
+
 // ../mcp-server/src/tools/init.ts
 var init_exports = {};
 __export(init_exports, {
@@ -27728,6 +27796,7 @@ To reinitialize, delete .olam/ first.`
 // ../mcp-server/src/tools/auth.ts
 var auth_exports = {};
 __export(auth_exports, {
+  formatAccountFlag: () => formatAccountFlag,
   register: () => register2
 });
 init_v3();
@@ -27878,8 +27947,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path52, body, attempt = 0) {
-    const url2 = `${this.baseUrl}${path52}`;
+  async request(method, path53, body, attempt = 0) {
+    const url2 = `${this.baseUrl}${path53}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -27897,7 +27966,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path52, body, attempt + 1);
+        return this.request(method, path53, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -27924,7 +27993,7 @@ async function safeText(res) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 
 // ../core/dist/auth/container.js
@@ -28056,7 +28125,7 @@ function resolveAuthServicePath() {
   return path3.join(pkgsDir, "auth-service");
 }
 function sleep2(ms) {
-  return new Promise((resolve14) => setTimeout(resolve14, ms));
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
 }
 
 // ../core/dist/auth/preflight.js
@@ -28134,6 +28203,21 @@ function describe2(err) {
 }
 
 // ../mcp-server/src/tools/auth.ts
+function formatAccountFlag(a, now = Date.now()) {
+  if (a.state === "disabled") return "disabled";
+  if (a.state === "usage-capped") {
+    if (a.weeklyResetsAt && new Date(a.weeklyResetsAt).getTime() > now) {
+      return "weekly limit";
+    }
+    return "usage cap";
+  }
+  if (a.state === "cooldown") return "rate-limited";
+  if (a.state === "expired") return "expired";
+  if (a.state === "active") return "valid";
+  if (a.rateLimited) return "rate-limited";
+  if (!a.tokenValid) return "expired";
+  return "valid";
+}
 function register2(server, _ctx, _initError) {
   server.tool(
     "olam_auth_status",
@@ -28156,7 +28240,7 @@ function register2(server, _ctx, _initError) {
         lines.push("  (none \u2014 run olam_auth_login)");
       } else {
         for (const a of status2.accounts) {
-          const flag = a.tokenValid ? "valid" : a.rateLimited ? "rate-limited" : "expired";
+          const flag = formatAccountFlag(a);
           lines.push(`  - ${a.id.padEnd(20)} ${flag.padEnd(14)} expires in ${a.expiresIn}`);
         }
       }
@@ -28347,7 +28431,8 @@ function rowToMetadata(row) {
     ...expectedServices !== void 0 ? { expectedServices } : {},
     ...appPortUrls !== void 0 ? { appPortUrls } : {},
     ...worldDbNames !== void 0 ? { worldDbNames } : {},
-    ...row.world_role_name ? { worldRoleName: row.world_role_name } : {}
+    ...row.world_role_name ? { worldRoleName: row.world_role_name } : {},
+    ...row.claude_home ? { claudeHome: row.claude_home } : {}
   };
 }
 var SCHEMA_VERSION = "1";
@@ -28402,7 +28487,9 @@ var WorldRegistry = class {
       // world_db_names (SQLite has no native array; matches repos column shape).
       // TEXT[] would fail at DDL time (closes OQ13/OQ22 / FS-03).
       "world_db_names TEXT",
-      "world_role_name TEXT"
+      "world_role_name TEXT",
+      // ADR 045 — per-world Claude Code HOME path. Additive migration.
+      "claude_home TEXT"
     ]) {
       try {
         this.db.exec(`ALTER TABLE worlds ADD COLUMN ${col}`);
@@ -28433,8 +28520,8 @@ var WorldRegistry = class {
           compute_provider, total_cost_usd, thought_count, created_at, updated_at,
           pr_url, pr_number, pr_repo, pr_created_at, pr_state, pr_merged_at, auto_destroy_on_merge,
           readiness_chain, expected_services, app_port_urls,
-          world_db_names, world_role_name)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(world.id, world.name, world.status, JSON.stringify(world.repos), world.branch, world.portOffset, world.workspacePath, world.computeProvider, world.totalCostUsd, world.thoughtCount, world.createdAt, world.updatedAt, world.prUrl ?? null, world.prNumber ?? null, world.prRepo ?? null, world.prCreatedAt ?? null, world.prState ?? "none", world.prMergedAt ?? null, world.autoDestroyOnMerge === false ? 0 : 1, world.readinessChain !== void 0 ? JSON.stringify(world.readinessChain) : null, world.expectedServices !== void 0 ? JSON.stringify(world.expectedServices) : null, world.appPortUrls !== void 0 ? JSON.stringify(world.appPortUrls) : null, world.worldDbNames !== void 0 ? JSON.stringify(world.worldDbNames) : null, world.worldRoleName ?? null);
+          world_db_names, world_role_name, claude_home)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(world.id, world.name, world.status, JSON.stringify(world.repos), world.branch, world.portOffset, world.workspacePath, world.computeProvider, world.totalCostUsd, world.thoughtCount, world.createdAt, world.updatedAt, world.prUrl ?? null, world.prNumber ?? null, world.prRepo ?? null, world.prCreatedAt ?? null, world.prState ?? "none", world.prMergedAt ?? null, world.autoDestroyOnMerge === false ? 0 : 1, world.readinessChain !== void 0 ? JSON.stringify(world.readinessChain) : null, world.expectedServices !== void 0 ? JSON.stringify(world.expectedServices) : null, world.appPortUrls !== void 0 ? JSON.stringify(world.appPortUrls) : null, world.worldDbNames !== void 0 ? JSON.stringify(world.worldDbNames) : null, world.worldRoleName ?? null, world.claudeHome ?? null);
   }
   update(worldId, updates) {
     const setClauses = [];
@@ -28462,7 +28549,9 @@ var WorldRegistry = class {
       appPortUrls: "app_port_urls",
       // olam-hybrid-shared-postgres Phase A task A7.
       worldDbNames: "world_db_names",
-      worldRoleName: "world_role_name"
+      worldRoleName: "world_role_name",
+      // ADR 045 — per-world Claude Code HOME (multi-account isolation).
+      claudeHome: "claude_home"
     };
     const jsonColumns = /* @__PURE__ */ new Set(["repos", "readinessChain", "expectedServices", "appPortUrls", "worldDbNames"]);
     for (const [key, col] of Object.entries(columnMap)) {
@@ -28751,12 +28840,12 @@ function register3(server, _ctx, _initError) {
         registry2.close();
       }
       try {
-        const { default: fs51 } = await import("node:fs");
+        const { default: fs52 } = await import("node:fs");
         const { default: os31 } = await import("node:os");
-        const { default: path52 } = await import("node:path");
-        const tokenPath = path52.join(os31.homedir(), ".olam", "host-cp.token");
-        if (fs51.existsSync(tokenPath)) {
-          const token = fs51.readFileSync(tokenPath, "utf-8").trim();
+        const { default: path53 } = await import("node:path");
+        const tokenPath = path53.join(os31.homedir(), ".olam", "host-cp.token");
+        if (fs52.existsSync(tokenPath)) {
+          const token = fs52.readFileSync(tokenPath, "utf-8").trim();
           await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -29176,10 +29265,10 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path52) {
-  if (!existsSync6(path52)) return null;
+function readOptional(path53) {
+  if (!existsSync6(path53)) return null;
   try {
-    return readFileSync5(path52, "utf8");
+    return readFileSync5(path53, "utf8");
   } catch {
     return null;
   }
@@ -29304,7 +29393,7 @@ var realDocker = {
   }
 };
 function spawnAsync(cmd, args, opts = {}) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const child = spawn(cmd, [...args], {
       stdio: ["ignore", "pipe", "pipe"],
       signal: opts.signal
@@ -29318,10 +29407,10 @@ function spawnAsync(cmd, args, opts = {}) {
       stderr += chunk.toString();
     });
     child.on("error", (err) => {
-      resolve14({ exitCode: -1, stdout, stderr: stderr + err.message });
+      resolve15({ exitCode: -1, stdout, stderr: stderr + err.message });
     });
     child.on("close", (code) => {
-      resolve14({ exitCode: code ?? -1, stdout, stderr });
+      resolve15({ exitCode: code ?? -1, stdout, stderr });
     });
   });
 }
@@ -29772,7 +29861,7 @@ var stopAndRemove = async (container) => {
 
 // ../adapters/dist/docker/exec.js
 import { PassThrough } from "node:stream";
-var demuxStream = (stream) => new Promise((resolve14, reject2) => {
+var demuxStream = (stream) => new Promise((resolve15, reject2) => {
   const stdoutChunks = [];
   const stderrChunks = [];
   const stdout = new PassThrough();
@@ -29786,7 +29875,7 @@ var demuxStream = (stream) => new Promise((resolve14, reject2) => {
     stream.pipe(stdout);
   }
   stream.on("end", () => {
-    resolve14({
+    resolve15({
       stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
       stderr: Buffer.concat(stderrChunks).toString("utf-8")
     });
@@ -30159,7 +30248,7 @@ var SSHConnectionPool = class {
   // -----------------------------------------------------------------------
   async exec(host, command) {
     const client = await this.getConnection(host);
-    return new Promise((resolve14, reject2) => {
+    return new Promise((resolve15, reject2) => {
       client.exec(command, (err, stream) => {
         if (err) {
           reject2(new Error(`SSH exec failed on ${host}: ${err.message}`));
@@ -30174,7 +30263,7 @@ var SSHConnectionPool = class {
           stderr += data.toString();
         });
         stream.on("close", (code) => {
-          resolve14({
+          resolve15({
             exitCode: code ?? 0,
             stdout: stdout.trimEnd(),
             stderr: stderr.trimEnd()
@@ -30205,10 +30294,10 @@ var SSHConnectionPool = class {
       throw new Error(`No SSH configuration found for host: ${host}`);
     }
     const client = new SSHClient();
-    return new Promise((resolve14, reject2) => {
+    return new Promise((resolve15, reject2) => {
       client.on("ready", () => {
         this.connections.set(host, client);
-        resolve14(client);
+        resolve15(client);
       }).on("error", (err) => {
         this.connections.delete(host);
         reject2(new Error(`SSH connection to ${host} failed: ${err.message}`));
@@ -30625,8 +30714,8 @@ var CloudflareProvider = class extends ComputeProvider {
   // -----------------------------------------------------------------------
   // Internal fetch helper
   // -----------------------------------------------------------------------
-  async request(path52, method, body) {
-    const url2 = `${this.config.workerUrl}${path52}`;
+  async request(path53, method, body) {
+    const url2 = `${this.config.workerUrl}${path53}`;
     const bearer = await this.config.mintToken();
     const headers = {
       Authorization: `Bearer ${bearer}`
@@ -30902,6 +30991,10 @@ function selectComputeProvider(config2, env) {
       throw new Error(
         "Compute provider 'e2b' is not implemented. Use 'docker', 'ssh', or 'cloudflare'."
       );
+    case "cloudflare-isolate":
+      throw new Error(
+        "Compute provider 'cloudflare-isolate' is not yet wired for world dispatch. v1 ships the substrate (@olam/worker-runner-cloudflare-isolate) for direct POST /lookup invocation; per-world tier selection arrives in a follow-up PR (see docs/decisions/022-v8-isolate-runtime-tier.md \xA7Consequences)."
+      );
     case "docker":
       return new DockerProvider(resolveDockerHostOptions());
     default: {
@@ -31188,7 +31281,7 @@ function register6(server, ctx, initError) {
                 }
               } catch {
               }
-              await new Promise((resolve14) => setTimeout(resolve14, POLL_INTERVAL_MS));
+              await new Promise((resolve15) => setTimeout(resolve15, POLL_INTERVAL_MS));
             }
           }
           if (authenticated) {
@@ -31318,6 +31411,8 @@ function formatAge(createdAt) {
 // ../mcp-server/src/tools/world-dispatch.ts
 var world_dispatch_exports = {};
 __export(world_dispatch_exports, {
+  dispatchInputObject: () => dispatchInputObject,
+  dispatchInputSchema: () => dispatchInputSchema,
   register: () => register9
 });
 init_v3();
@@ -31905,17 +32000,17 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
     const srcPath = path10.join(src, name);
     const destPath = path10.join(dest, name);
     if (entry.isSymbolicLink()) {
-      let stat;
+      let stat2;
       try {
-        stat = fs8.statSync(srcPath);
+        stat2 = fs8.statSync(srcPath);
       } catch {
         continue;
       }
-      if (stat.isDirectory()) {
+      if (stat2.isDirectory()) {
         if (SKIP_DIRS_ANYWHERE.has(name))
           continue;
         copyDirRecursive(srcPath, destPath, depth + 1, skipFiles);
-      } else if (stat.isFile()) {
+      } else if (stat2.isFile()) {
         fs8.copyFileSync(srcPath, destPath);
       }
     } else if (entry.isDirectory()) {
@@ -32078,9 +32173,9 @@ function buildRepoEnvBundle(repoName, serviceEnv, crossRepoEnv, envOverrides) {
   const merged = { ...serviceEnv, ...injectables };
   return { merged, injectables };
 }
-function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, configCtx) {
+function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, configCtx, claudeHomeOverride) {
   try {
-    copyClaudeConfig(workspacePath, void 0, configCtx);
+    copyClaudeConfig(workspacePath, claudeHomeOverride, configCtx);
   } catch {
   }
   if (configCtx) {
@@ -32173,19 +32268,278 @@ function applyEnvOverrides(repoPath, overrides) {
   }
 }
 
+// ../mcp-server/src/dispatch/goal-verifier.ts
+init_v3();
+import * as fs9 from "node:fs/promises";
+import * as path11 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
+var GoalSpecSchema = external_exports.object({
+  type: external_exports.enum([
+    "pr-merged",
+    "pr-green",
+    "file-exists",
+    "test-passes",
+    "comment-posted"
+  ]),
+  spec: external_exports.string().min(1).describe(
+    "Type-specific spec: PR number, file path, test name, or comment marker"
+  ),
+  timeoutMinutes: external_exports.number().int().min(1).max(720).default(90)
+}).describe(
+  "Optional structured completion condition; when set, the world loops between turns checking this until met or timeout"
+);
+async function defaultExecGh(args) {
+  return new Promise((resolve15) => {
+    const child = spawn2("gh", [...args], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf8");
+    });
+    child.on("close", (code) => {
+      resolve15({ stdout, stderr, exitCode: code ?? 1 });
+    });
+    child.on("error", (err) => {
+      resolve15({
+        stdout: "",
+        stderr: err instanceof Error ? err.message : String(err),
+        exitCode: 1
+      });
+    });
+  });
+}
+async function defaultExecVitest(testNamePattern, cwd) {
+  return new Promise((resolve15) => {
+    const child = spawn2(
+      "npx",
+      [
+        "vitest",
+        "run",
+        "--reporter=basic",
+        "--testNamePattern",
+        testNamePattern
+      ],
+      { cwd, stdio: ["ignore", "pipe", "pipe"] }
+    );
+    child.on("close", (code) => {
+      resolve15({ exitCode: code ?? 1 });
+    });
+    child.on("error", () => {
+      resolve15({ exitCode: 1 });
+    });
+  });
+}
+async function verifyGoal(goal, worldId, opts = {}) {
+  const execGh = opts.execGh ?? defaultExecGh;
+  const execVitest = opts.execVitest ?? defaultExecVitest;
+  const statFn = opts.fsStat ?? fs9.stat;
+  const workspaceRoot = opts.workspaceRoot ?? process.cwd();
+  try {
+    switch (goal.type) {
+      case "pr-merged":
+        return await verifyPrMerged(goal.spec, execGh);
+      case "pr-green":
+        return await verifyPrGreen(goal.spec, execGh);
+      case "file-exists":
+        return await verifyFileExists(goal.spec, workspaceRoot, statFn);
+      case "test-passes":
+        return await verifyTestPasses(goal.spec, workspaceRoot, execVitest);
+      case "comment-posted":
+        return await verifyCommentPosted(goal.spec, worldId, execGh);
+      default: {
+        const _exhaustive = goal.type;
+        return {
+          met: false,
+          details: `unknown goal type: ${String(_exhaustive)}`
+        };
+      }
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { met: false, details: `verifier error: ${msg}` };
+  }
+}
+async function verifyPrMerged(spec, execGh) {
+  const { stdout, exitCode } = await execGh([
+    "pr",
+    "view",
+    spec,
+    "--json",
+    "state"
+  ]);
+  if (exitCode !== 0) {
+    return { met: false, details: `gh pr view failed: exit ${exitCode}` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return { met: false, details: `gh pr view returned non-JSON` };
+  }
+  if (parsed.state === "MERGED") {
+    return { met: true, details: `PR ${spec} merged` };
+  }
+  return {
+    met: false,
+    details: `PR ${spec} state=${parsed.state ?? "unknown"}`
+  };
+}
+async function verifyPrGreen(spec, execGh) {
+  const { stdout, exitCode } = await execGh([
+    "pr",
+    "checks",
+    spec,
+    "--json",
+    "name,state"
+  ]);
+  if (exitCode !== 0) {
+    return { met: false, details: `gh pr checks failed: exit ${exitCode}` };
+  }
+  let checks;
+  try {
+    checks = JSON.parse(stdout);
+  } catch {
+    return { met: false, details: `gh pr checks returned non-JSON` };
+  }
+  if (!Array.isArray(checks) || checks.length === 0) {
+    return { met: false, details: "no checks reported" };
+  }
+  const PASSING = /* @__PURE__ */ new Set([
+    "SUCCESS",
+    "PASS",
+    "PASSING",
+    "SKIPPING",
+    "SKIPPED",
+    "NEUTRAL"
+  ]);
+  const failing = checks.filter(
+    (c) => !PASSING.has(String(c.state ?? "").toUpperCase())
+  );
+  if (failing.length === 0) {
+    return { met: true, details: `all ${checks.length} checks pass/skip` };
+  }
+  const detail = failing.map((c) => `${c.name}=${c.state}`).slice(0, 5).join(", ");
+  return {
+    met: false,
+    details: `${failing.length}/${checks.length} non-passing: ${detail}`
+  };
+}
+async function verifyFileExists(spec, workspaceRoot, statFn) {
+  const target = path11.resolve(workspaceRoot, spec);
+  try {
+    await statFn(target);
+    return { met: true, details: `${target} exists` };
+  } catch {
+    return { met: false, details: `${target} not found` };
+  }
+}
+async function verifyTestPasses(spec, workspaceRoot, execVitest) {
+  const { exitCode } = await execVitest(spec, workspaceRoot);
+  if (exitCode === 0) {
+    return { met: true, details: `test "${spec}" passed` };
+  }
+  return { met: false, details: `test "${spec}" exit=${exitCode}` };
+}
+async function verifyCommentPosted(spec, worldId, execGh) {
+  let prNum;
+  let marker;
+  const colon = spec.indexOf(":");
+  if (colon > 0) {
+    prNum = spec.slice(0, colon);
+    marker = spec.slice(colon + 1);
+  } else {
+    const lookup = await execGh([
+      "pr",
+      "list",
+      "--search",
+      worldId,
+      "--json",
+      "number",
+      "--limit",
+      "1"
+    ]);
+    if (lookup.exitCode !== 0) {
+      return {
+        met: false,
+        details: `pr lookup failed for world ${worldId}: exit ${lookup.exitCode}`
+      };
+    }
+    let arr;
+    try {
+      arr = JSON.parse(lookup.stdout);
+    } catch {
+      return { met: false, details: `pr lookup returned non-JSON` };
+    }
+    if (!Array.isArray(arr) || arr.length === 0 || arr[0] === void 0) {
+      return { met: false, details: `no PR found for world ${worldId}` };
+    }
+    prNum = String(arr[0].number);
+    marker = spec;
+  }
+  if (marker.length === 0) {
+    return { met: false, details: "marker is empty" };
+  }
+  const { stdout, exitCode } = await execGh([
+    "pr",
+    "view",
+    prNum,
+    "--json",
+    "comments"
+  ]);
+  if (exitCode !== 0) {
+    return {
+      met: false,
+      details: `gh pr view comments failed: exit ${exitCode}`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return { met: false, details: `gh pr view comments returned non-JSON` };
+  }
+  const found = (parsed.comments ?? []).some(
+    (c) => (c.body ?? "").includes(marker)
+  );
+  if (found) {
+    return {
+      met: true,
+      details: `marker "${marker}" found in PR ${prNum} comments`
+    };
+  }
+  return {
+    met: false,
+    details: `marker "${marker}" not found in PR ${prNum} comments`
+  };
+}
+
 // ../mcp-server/src/tools/world-dispatch.ts
-function register9(server, ctx, initError) {
+var dispatchInputSchema = {
+  worldId: external_exports.string(),
+  prompt: external_exports.string(),
+  maxTurns: external_exports.number().optional(),
+  mode: external_exports.enum(["deep", "fast", "auto"]).optional().describe(
+    "Execution mode: 'deep' appends ultrathink + sub-agent instructions for complex/generative tasks, 'fast' for simple chores, 'auto' (default) detects from prompt complexity"
+  ),
+  goal: GoalSpecSchema.optional().describe(
+    "Optional structured completion condition. When set, the world's dispatch loop checks this condition after each turn until met or the timeout window closes. v1 ships a single post-dispatch check; v2 will close the loop. /goal-mode parity with Claude Code 2.1.139."
+  ),
+  escalationTiers: external_exports.array(external_exports.enum(["haiku", "sonnet", "opus"])).optional().default(["sonnet"]).describe(
+    "Ordered model-tier escalation chain for dispatch retries. On each retry, host-cp advances to the next tier instead of repeating the failed model. Default ['sonnet'] = no escalation (current behaviour, no cost surprise). Operators opt in via e.g. ['sonnet','opus'] or ['haiku','sonnet','opus']."
+  )
+};
+var dispatchInputObject = external_exports.object(dispatchInputSchema);
+function register9(server, ctx, initError, deps) {
+  const verify = deps?.verifyGoal ?? verifyGoal;
   server.tool(
     "olam_dispatch",
     "Send a task prompt to a world for autonomous execution.",
-    {
-      worldId: external_exports.string(),
-      prompt: external_exports.string(),
-      maxTurns: external_exports.number().optional(),
-      mode: external_exports.enum(["deep", "fast", "auto"]).optional().describe(
-        "Execution mode: 'deep' appends ultrathink + sub-agent instructions for complex/generative tasks, 'fast' for simple chores, 'auto' (default) detects from prompt complexity"
-      )
-    },
+    dispatchInputSchema,
     async (params) => {
       if (!ctx) {
         const errorMsg = initError?.message ?? "Olam is not configured. Run /olam:init to set up.";
@@ -32283,6 +32637,31 @@ function register9(server, ctx, initError) {
           `  full context between dispatches. Watch live in browser terminal`,
           `  or via: docker exec -it olam-${params.worldId}-devbox tmux attach -t ${claudeSession} -r`
         ];
+        if (params.goal) {
+          try {
+            const result = await verify(params.goal, params.worldId, {
+              workspaceRoot: worldMeta.workspacePath
+            });
+            lines.push(
+              ``,
+              `  goal:       ${params.goal.type} (${params.goal.spec})`,
+              `  goal-met:   ${result.met}`,
+              `  goal-info:  ${result.details}`
+            );
+          } catch (goalErr) {
+            const msg = goalErr instanceof Error ? goalErr.message : String(goalErr);
+            logger.warn("Goal verifier threw unexpectedly", {
+              worldId: params.worldId,
+              error: msg
+            });
+            lines.push(
+              ``,
+              `  goal:       ${params.goal.type} (${params.goal.spec})`,
+              `  goal-met:   false`,
+              `  goal-info:  verifier-exception: ${msg}`
+            );
+          }
+        }
         return {
           content: [{ type: "text", text: lines.join("\n") }]
         };
@@ -32428,7 +32807,7 @@ __export(world_crystallize_exports, {
 });
 init_v3();
 import "node:path";
-import * as fs9 from "node:fs";
+import * as fs10 from "node:fs";
 
 // ../core/dist/crystallize/checksum.js
 import { createHash as createHash2 } from "node:crypto";
@@ -32484,7 +32863,7 @@ function register12(server, ctx, initError) {
       }
       try {
         const thoughtDbPath = getWorldDbPath(world.workspacePath);
-        if (!fs9.existsSync(thoughtDbPath)) {
+        if (!fs10.existsSync(thoughtDbPath)) {
           return {
             content: [{
               type: "text",
@@ -32571,10 +32950,139 @@ __export(world_status_exports, {
   register: () => register13
 });
 init_v3();
+
+// ../skill-runtime/dist/skills/olam-status.js
+init_v3();
+
+// ../skill-runtime/dist/define-skill.js
+var KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function defineSkill(spec) {
+  if (!KEBAB_RE.test(spec.name)) {
+    throw new Error(`defineSkill: name "${spec.name}" must be kebab-case (lowercase letters, digits, and hyphens only; no leading/trailing/double hyphens).`);
+  }
+  return {
+    asMcpTool() {
+      return {
+        name: spec.name,
+        description: spec.description,
+        inputSchema: spec.inputSchema,
+        async handler(params) {
+          try {
+            const parsed = spec.inputSchema.safeParse(params);
+            if (!parsed.success) {
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: `Invalid input: ${parsed.error.message}`
+                  }
+                ],
+                isError: true
+              };
+            }
+            const output = await spec.handler(parsed.data);
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: typeof output === "string" ? output : JSON.stringify(output)
+                }
+              ]
+            };
+          } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+              content: [{ type: "text", text: `Error: ${message}` }],
+              isError: true
+            };
+          }
+        }
+      };
+    },
+    asHttpHandler() {
+      return async (req, res) => {
+        const parsed = spec.inputSchema.safeParse(req.body);
+        if (!parsed.success) {
+          res.status(400).json({
+            error: "Invalid input",
+            issues: parsed.error.issues
+          });
+          return;
+        }
+        try {
+          const output = await spec.handler(parsed.data);
+          res.status(200).json({ result: output });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          res.status(500).json({ error: message });
+        }
+      };
+    },
+    toJsonSchema() {
+      return zodToJsonSchema(spec.inputSchema, { target: "openApi3" });
+    }
+  };
+}
+
+// ../skill-runtime/dist/skills/olam-status.js
+var olamStatusInputSchema = external_exports.object({
+  world: external_exports.object({
+    id: external_exports.string(),
+    name: external_exports.string(),
+    status: external_exports.string(),
+    repos: external_exports.array(external_exports.string()),
+    branch: external_exports.string(),
+    computeProvider: external_exports.string(),
+    portOffset: external_exports.number(),
+    workspacePath: external_exports.string(),
+    thoughtCount: external_exports.number(),
+    createdAt: external_exports.string(),
+    updatedAt: external_exports.string(),
+    cost: external_exports.number()
+  })
+});
+function formatUptime(createdAt) {
+  const ms = Date.now() - new Date(createdAt).getTime();
+  const seconds = Math.floor(ms / 1e3);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  const days = Math.floor(hours / 24);
+  if (days > 0)
+    return `${days}d ${hours % 24}h ${minutes % 60}m`;
+  if (hours > 0)
+    return `${hours}h ${minutes % 60}m`;
+  return `${minutes}m`;
+}
+var olamStatusSkill = defineSkill({
+  name: "olam-status",
+  description: "Get detailed status information for a specific world.",
+  inputSchema: olamStatusInputSchema,
+  handler: ({ world }) => {
+    const uptime = formatUptime(world.createdAt);
+    const lines = [
+      `World: ${world.name} (${world.id})`,
+      ``,
+      `  Status:        ${world.status}`,
+      `  Repos:         ${world.repos.join(", ")}`,
+      `  Branch:        ${world.branch}`,
+      `  Provider:      ${world.computeProvider}`,
+      `  Port Offset:   ${world.portOffset}`,
+      `  Workspace:     ${world.workspacePath}`,
+      `  Total Cost:    $${world.cost.toFixed(4)}`,
+      `  Thought Count: ${world.thoughtCount}`,
+      `  Created:       ${world.createdAt}`,
+      `  Uptime:        ${uptime}`,
+      `  Last Updated:  ${world.updatedAt}`
+    ];
+    return lines.join("\n");
+  }
+});
+
+// ../mcp-server/src/tools/world-status.ts
 function register13(server, ctx, initError) {
   server.tool(
     "olam_status",
-    "Get detailed status information for a specific world.",
+    olamStatusSkill.asMcpTool().description,
     {
       worldId: external_exports.string()
     },
@@ -32594,26 +33102,23 @@ function register13(server, ctx, initError) {
             isError: true
           };
         }
-        const uptime = formatUptime(world.createdAt);
         const cost = ctx.costTracker.getWorldCost(params.worldId);
-        const lines = [
-          `World: ${world.name} (${world.id})`,
-          ``,
-          `  Status:        ${world.status}`,
-          `  Repos:         ${world.repos.join(", ")}`,
-          `  Branch:        ${world.branch}`,
-          `  Provider:      ${world.computeProvider}`,
-          `  Port Offset:   ${world.portOffset}`,
-          `  Workspace:     ${world.workspacePath}`,
-          `  Total Cost:    $${cost.toFixed(4)}`,
-          `  Thought Count: ${world.thoughtCount}`,
-          `  Created:       ${world.createdAt}`,
-          `  Uptime:        ${uptime}`,
-          `  Last Updated:  ${world.updatedAt}`
-        ];
-        return {
-          content: [{ type: "text", text: lines.join("\n") }]
-        };
+        return olamStatusSkill.asMcpTool().handler({
+          world: {
+            id: world.id,
+            name: world.name,
+            status: world.status,
+            repos: [...world.repos],
+            branch: world.branch,
+            computeProvider: world.computeProvider,
+            portOffset: world.portOffset,
+            workspacePath: world.workspacePath,
+            thoughtCount: world.thoughtCount,
+            createdAt: world.createdAt,
+            updatedAt: world.updatedAt,
+            cost
+          }
+        });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         return {
@@ -32624,16 +33129,6 @@ function register13(server, ctx, initError) {
     }
   );
 }
-function formatUptime(createdAt) {
-  const ms = Date.now() - new Date(createdAt).getTime();
-  const seconds = Math.floor(ms / 1e3);
-  const minutes = Math.floor(seconds / 60);
-  const hours = Math.floor(minutes / 60);
-  const days = Math.floor(hours / 24);
-  if (days > 0) return `${days}d ${hours % 24}h ${minutes % 60}m`;
-  if (hours > 0) return `${hours}h ${minutes % 60}m`;
-  return `${minutes}m`;
-}
 
 // ../mcp-server/src/tools/control-plane.ts
 var control_plane_exports = {};
@@ -33077,10 +33572,10 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path52 = join13(args.outDir, "manifest.json");
-  await writeFile(path52, `${JSON.stringify(manifest, null, 2)}
+  const path53 = join13(args.outDir, "manifest.json");
+  await writeFile(path53, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path52, manifest };
+  return { path: path53, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
@@ -33334,9 +33829,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path52 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path52))) {
-        return httpReject(403, "outside_allow_list", { path: path52 });
+      const path53 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path53))) {
+        return httpReject(403, "outside_allow_list", { path: path53 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -33440,15 +33935,15 @@ ${JSON.stringify({ error: reason })}`
       unlinkSync2(udsPath);
     } catch {
     }
-    await new Promise((resolve14, reject2) => {
-      server.listen(udsPath, () => resolve14());
+    await new Promise((resolve15, reject2) => {
+      server.listen(udsPath, () => resolve15());
       server.once("error", reject2);
     });
     chmodSync3(udsPath, 384);
     port2 = 0;
   } else {
-    await new Promise((resolve14, reject2) => {
-      server.listen(opts.port ?? 0, "127.0.0.1", () => resolve14());
+    await new Promise((resolve15, reject2) => {
+      server.listen(opts.port ?? 0, "127.0.0.1", () => resolve15());
       server.once("error", reject2);
     });
     const addr = server.address();
@@ -33464,10 +33959,10 @@ ${JSON.stringify({ error: reason })}`
     } catch {
     }
     await Promise.race([
-      new Promise((resolve14, reject2) => {
-        server.close((err) => err ? reject2(err) : resolve14());
+      new Promise((resolve15, reject2) => {
+        server.close((err) => err ? reject2(err) : resolve15());
       }),
-      new Promise((resolve14) => setTimeout(resolve14, 5e3))
+      new Promise((resolve15) => setTimeout(resolve15, 5e3))
     ]);
     if (udsPath) {
       try {
@@ -33497,9 +33992,9 @@ function ensureUdsParentDirSafe(udsPath) {
       `uds_parent_path_invalid: bindUdsPath "${udsPath}" has no manageable parent directory`
     );
   }
-  let stat = null;
+  let stat2 = null;
   try {
-    stat = statSync3(parent);
+    stat2 = statSync3(parent);
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new Error(
@@ -33507,25 +34002,25 @@ function ensureUdsParentDirSafe(udsPath) {
       );
     }
   }
-  if (!stat) {
+  if (!stat2) {
     mkdirSync7(parent, { recursive: true, mode: 448 });
     return;
   }
-  if (!stat.isDirectory()) {
+  if (!stat2.isDirectory()) {
     throw new Error(
       `uds_parent_dir_unsafe: "${parent}" exists but is not a directory`
     );
   }
-  const mode = stat.mode & 511;
+  const mode = stat2.mode & 511;
   if (process.platform !== "win32" && mode !== 448) {
     throw new Error(
       `uds_parent_dir_unsafe: "${parent}" mode is 0o${mode.toString(8)}, expected 0o700 (other local UIDs could traverse the dir and access the socket)`
     );
   }
   const me = userInfo().uid;
-  if (process.platform !== "win32" && stat.uid !== me) {
+  if (process.platform !== "win32" && stat2.uid !== me) {
     throw new Error(
-      `uds_parent_dir_unsafe: "${parent}" owned by uid=${stat.uid}, current process uid=${me}`
+      `uds_parent_dir_unsafe: "${parent}" owned by uid=${stat2.uid}, current process uid=${me}`
     );
   }
 }
@@ -33799,10 +34294,10 @@ async function acquireLaunchSlot() {
     _inFlightLaunches++;
     return releaseLaunchSlot;
   }
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     _launchQueue.push(() => {
       _inFlightLaunches++;
-      resolve14(releaseLaunchSlot);
+      resolve15(releaseLaunchSlot);
     });
   });
 }
@@ -34115,14 +34610,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path52 = join14(outDir, `${shot.name}.${ext}`);
+    const path53 = join14(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path52,
+      path: path53,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path52, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path53, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -34566,12 +35061,12 @@ function openUrl(url2) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs51 } = await import("node:fs");
+    const { default: fs52 } = await import("node:fs");
     const { default: os31 } = await import("node:os");
-    const { default: path52 } = await import("node:path");
-    const tp = path52.join(os31.homedir(), ".olam", "host-cp.token");
-    if (!fs51.existsSync(tp)) return { token: null };
-    return { token: fs51.readFileSync(tp, "utf-8").trim() };
+    const { default: path53 } = await import("node:path");
+    const tp = path53.join(os31.homedir(), ".olam", "host-cp.token");
+    if (!fs52.existsSync(tp)) return { token: null };
+    return { token: fs52.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -34831,9 +35326,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("Optional human-readable description."),
       defaultBranch: external_exports.string().optional().describe("Default branch name (e.g. main).")
     },
-    async ({ name, path: path52, description, defaultBranch }) => {
+    async ({ name, path: path53, description, defaultBranch }) => {
       try {
-        const entry = addRepo({ name, path: path52, description, defaultBranch });
+        const entry = addRepo({ name, path: path53, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -34874,9 +35369,9 @@ function register22(server, _ctx, _initError) {
       description: external_exports.string().optional().describe("New description."),
       defaultBranch: external_exports.string().optional().describe("New default branch.")
     },
-    async ({ name, path: path52, description, defaultBranch }) => {
+    async ({ name, path: path53, description, defaultBranch }) => {
       try {
-        const entry = updateRepo(name, { path: path52, description, defaultBranch });
+        const entry = updateRepo(name, { path: path53, description, defaultBranch });
         return {
           content: [{
             type: "text",
@@ -34897,15 +35392,15 @@ __export(process_port_exports, {
   resolveHostCpToken: () => resolveHostCpToken
 });
 init_v3();
-import fs34 from "node:fs";
+import fs35 from "node:fs";
 import os20 from "node:os";
-import path33 from "node:path";
+import path34 from "node:path";
 var HOST_CP_BASE = "http://127.0.0.1:19000";
 function resolveHostCpToken() {
   const envToken = process.env["OLAM_HOST_CP_TOKEN"];
   if (envToken) return envToken;
-  const tokenPath = path33.join(os20.homedir(), ".olam", "host-cp.token");
-  if (fs34.existsSync(tokenPath)) return fs34.readFileSync(tokenPath, "utf-8").trim();
+  const tokenPath = path34.join(os20.homedir(), ".olam", "host-cp.token");
+  if (fs35.existsSync(tokenPath)) return fs35.readFileSync(tokenPath, "utf-8").trim();
   return null;
 }
 function tokenMissingError() {
@@ -35337,8 +35832,8 @@ __export(skills_exports, {
 });
 init_v3();
 init_skill_sources();
-import * as fs35 from "node:fs";
-import * as path34 from "node:path";
+import * as fs36 from "node:fs";
+import * as path35 from "node:path";
 function asMessage8(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -35361,14 +35856,14 @@ function listDeployed() {
   );
   const entries = [];
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const bucketDir = path34.join(dir, bucket);
-    if (!fs35.existsSync(bucketDir)) continue;
-    for (const name of fs35.readdirSync(bucketDir)) {
-      const full = path34.join(bucketDir, name);
+    const bucketDir = path35.join(dir, bucket);
+    if (!fs36.existsSync(bucketDir)) continue;
+    for (const name of fs36.readdirSync(bucketDir)) {
+      const full = path35.join(bucketDir, name);
       try {
-        const stat = fs35.lstatSync(full);
-        if (!stat.isSymbolicLink()) continue;
-        const target = fs35.readlinkSync(full);
+        const stat2 = fs36.lstatSync(full);
+        if (!stat2.isSymbolicLink()) continue;
+        const target = fs36.readlinkSync(full);
         let sourceId;
         for (const [clonePath, id] of sourcePaths.entries()) {
           if (target.startsWith(clonePath)) {
@@ -35454,13 +35949,13 @@ __export(skills_search_exports, {
   register: () => register27
 });
 init_v3();
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 import * as os22 from "node:os";
 
 // ../mcp-server/src/lib/skills-index.mjs
 import { createRequire as createRequire4 } from "node:module";
-import * as fs36 from "node:fs";
-import * as path35 from "node:path";
+import * as fs37 from "node:fs";
+import * as path36 from "node:path";
 import * as os21 from "node:os";
 var VECTOR_DIM = 256;
 var SCHEMA_VERSION3 = "1";
@@ -35550,7 +36045,7 @@ function bufferToVector(buf) {
   return vec;
 }
 function openIndex(dbPath) {
-  if (!fs36.existsSync(dbPath)) {
+  if (!fs37.existsSync(dbPath)) {
     throw new Error(
       `skills index not found at ${dbPath}. Run \`node scripts/skills-index-build.mjs --out ${dbPath}\` first.`
     );
@@ -35592,14 +36087,14 @@ function searchIndex(dbPath, query, k = 5) {
     db.close();
   }
 }
-var DEFAULT_DB_PATH = path35.join(os21.homedir(), ".olam", "skills.vec.db");
-var DEFAULT_SOURCE_DIR = path35.join(os21.homedir(), ".claude", "skills");
+var DEFAULT_DB_PATH = path36.join(os21.homedir(), ".olam", "skills.vec.db");
+var DEFAULT_SOURCE_DIR = path36.join(os21.homedir(), ".claude", "skills");
 
 // ../mcp-server/src/tools/skills-search.ts
 function defaultDbPath() {
   const override = process.env["SKILLS_INDEX_PATH"];
   if (override) return override;
-  return path36.join(os22.homedir(), ".olam", "skills.vec.db");
+  return path37.join(os22.homedir(), ".olam", "skills.vec.db");
 }
 function asMessage9(err) {
   return err instanceof Error ? err.message : String(err);
@@ -35650,8 +36145,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path52) {
-  return `http://127.0.0.1:${port()}${path52}`;
+function url(path53) {
+  return `http://127.0.0.1:${port()}${path53}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -35850,8 +36345,8 @@ __export(kg_install_hook_exports, {
 });
 init_v3();
 init_merge_settings();
-import * as fs37 from "node:fs";
-import * as path37 from "node:path";
+import * as fs38 from "node:fs";
+import * as path38 from "node:path";
 import * as os23 from "node:os";
 
 // ../core/dist/kg/hook-template.js
@@ -35902,10 +36397,10 @@ function buildHookMatcherEntry(opts) {
 // ../mcp-server/src/tools/kg-install-hook.ts
 function settingsPathFor2(scope, projectPath) {
   if (scope === "user") {
-    return path37.join(os23.homedir(), ".claude", "settings.json");
+    return path38.join(os23.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path37.join(root, ".claude", "settings.json");
+  return path38.join(root, ".claude", "settings.json");
 }
 function register30(server, _ctx, _initError) {
   server.tool(
@@ -35919,12 +36414,12 @@ function register30(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor2(scope, params.projectPath);
       try {
-        fs37.mkdirSync(path37.dirname(filePath), { recursive: true });
+        fs38.mkdirSync(path38.dirname(filePath), { recursive: true });
         let backupPath = null;
-        if (fs37.existsSync(filePath)) {
+        if (fs38.existsSync(filePath)) {
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
           backupPath = `${filePath}.olam-bak.${ts}`;
-          fs37.copyFileSync(filePath, backupPath);
+          fs38.copyFileSync(filePath, backupPath);
         }
         const result = mergeHomeSettingsJson(filePath, {
           ensureHook: {
@@ -35935,7 +36430,7 @@ function register30(server, _ctx, _initError) {
         });
         if (result.status === "already-present" && backupPath) {
           try {
-            fs37.unlinkSync(backupPath);
+            fs38.unlinkSync(backupPath);
           } catch {
           }
         }
@@ -35979,15 +36474,15 @@ __export(kg_uninstall_hook_exports, {
   register: () => register31
 });
 init_v3();
-import * as fs38 from "node:fs";
-import * as path38 from "node:path";
+import * as fs39 from "node:fs";
+import * as path39 from "node:path";
 import * as os24 from "node:os";
 function settingsPathFor3(scope, projectPath) {
   if (scope === "user") {
-    return path38.join(os24.homedir(), ".claude", "settings.json");
+    return path39.join(os24.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path38.join(root, ".claude", "settings.json");
+  return path39.join(root, ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -36021,7 +36516,7 @@ function register31(server, _ctx, _initError) {
       const scope = params.scope === "user" ? "user" : "project";
       const filePath = settingsPathFor3(scope, params.projectPath);
       try {
-        if (!fs38.existsSync(filePath)) {
+        if (!fs39.existsSync(filePath)) {
           return {
             content: [
               {
@@ -36035,7 +36530,7 @@ function register31(server, _ctx, _initError) {
             ]
           };
         }
-        const raw = fs38.readFileSync(filePath, "utf-8");
+        const raw = fs39.readFileSync(filePath, "utf-8");
         const settings = raw.trim() ? JSON.parse(raw) : {};
         const preToolUse = settings.hooks?.PreToolUse;
         if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
@@ -36070,7 +36565,7 @@ function register31(server, _ctx, _initError) {
         const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         const backupPath = `${filePath}.olam-bak.${ts}`;
         try {
-          fs38.copyFileSync(filePath, backupPath);
+          fs39.copyFileSync(filePath, backupPath);
         } catch {
         }
         const next = {
@@ -36082,7 +36577,7 @@ function register31(server, _ctx, _initError) {
           if (otherStages.length === 0) delete next.hooks;
           else delete next.hooks.PreToolUse;
         }
-        fs38.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+        fs39.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
         return {
           content: [
             {
@@ -36151,17 +36646,23 @@ var toolModules = [
   kg_uninstall_hook_exports
 ];
 function registerAllTools(server, ctx, initError) {
-  for (const mod of toolModules) {
-    mod.register(server, ctx, initError);
+  const filterContext = getToolFilterContextFromEnv();
+  const { server: filtered, finalize: finalize2 } = withFilteredTools(server, filterContext);
+  try {
+    for (const mod of toolModules) {
+      mod.register(filtered, ctx, initError);
+    }
+  } finally {
+    finalize2();
   }
 }
 
 // ../mcp-server/src/resources/chunks.ts
-import fs39 from "node:fs";
+import fs40 from "node:fs";
 import os25 from "node:os";
-import path39 from "node:path";
+import path40 from "node:path";
 var DEFAULT_HOST_CP_URL = "http://127.0.0.1:19000";
-var DEFAULT_PLAN_CHAT_SECRET_PATH = path39.join(
+var DEFAULT_PLAN_CHAT_SECRET_PATH = path40.join(
   os25.homedir(),
   ".olam",
   "plan-chat-secret"
@@ -36176,7 +36677,7 @@ function loadBearer(bearerOpt, secretPath) {
   const envBearer = process.env.OLAM_PLAN_CHAT_BEARER?.trim();
   if (envBearer && envBearer.length > 0) return envBearer;
   try {
-    const onDisk = fs39.readFileSync(secretPath, "utf8").trim();
+    const onDisk = fs40.readFileSync(secretPath, "utf8").trim();
     return onDisk.length > 0 ? onDisk : null;
   } catch (err) {
     if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
@@ -36500,9 +37001,9 @@ init_loader();
 // ../core/dist/world/manager.js
 import * as crypto8 from "node:crypto";
 import { execSync as execSync5, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs48 from "node:fs";
+import * as fs49 from "node:fs";
 import * as os29 from "node:os";
-import * as path49 from "node:path";
+import * as path50 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -36598,8 +37099,8 @@ function resolveDevboxImage(config2, tag) {
 
 // ../core/dist/world/worktree.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import * as fs40 from "node:fs";
-import * as path40 from "node:path";
+import * as fs41 from "node:fs";
+import * as path41 from "node:path";
 function resolveGitDir(repo) {
   if (repo.path) {
     return repo.path;
@@ -36609,11 +37110,11 @@ function resolveGitDir(repo) {
 async function createWorktrees(repos, worldId, workspacePath, branch) {
   const created = [];
   for (const repo of repos) {
-    const worktreePath = path40.join(workspacePath, repo.name);
+    const worktreePath = path41.join(workspacePath, repo.name);
     const gitDir = resolveGitDir(repo);
     const branchName = branch || `olam/${worldId}`;
     try {
-      fs40.mkdirSync(path40.dirname(worktreePath), { recursive: true });
+      fs41.mkdirSync(path41.dirname(worktreePath), { recursive: true });
       execFileSync4("git", ["worktree", "add", worktreePath, "-b", branchName], {
         cwd: gitDir,
         stdio: "pipe"
@@ -36646,7 +37147,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
 }
 async function removeWorktrees(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path40.join(workspacePath, repo.name);
+    const worktreePath = path41.join(workspacePath, repo.name);
     let gitDir;
     try {
       gitDir = resolveGitDir(repo);
@@ -36721,12 +37222,12 @@ function removeBranch(repo, branch) {
 
 // ../core/dist/world/kg-overlay.js
 import { execFileSync as execFileSync5 } from "node:child_process";
-import * as fs41 from "node:fs";
-import * as path41 from "node:path";
+import * as fs42 from "node:fs";
+import * as path42 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
 import { homedir as homedir24 } from "node:os";
-import { join as join41, resolve as resolve9 } from "node:path";
+import { join as join41, resolve as resolve10 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
 var InvalidWorkspaceNameError = class extends Error {
@@ -36755,17 +37256,17 @@ function kgRoot() {
 function worldsRoot() {
   return join41(olamHome(), "worlds");
 }
-function assertWithinPrefix(path52, prefix, label) {
-  if (!path52.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path52} not under ${prefix}/`);
+function assertWithinPrefix(path53, prefix, label) {
+  if (!path53.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path53} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path52 = resolve9(join41(root, workspace));
-  assertWithinPrefix(path52, root, "kgPristinePath");
-  return path52;
+  const path53 = resolve10(join41(root, workspace));
+  assertWithinPrefix(path53, root, "kgPristinePath");
+  return path53;
 }
 var KG_PATHS_INTERNALS = Object.freeze({
   olamHome,
@@ -36781,10 +37282,10 @@ var KgOverlayError = class extends Error {
   }
 };
 function ensureGitignoreEntry(worldClonePath) {
-  const gitignorePath = path41.join(worldClonePath, ".gitignore");
-  if (!fs41.existsSync(gitignorePath))
+  const gitignorePath = path42.join(worldClonePath, ".gitignore");
+  if (!fs42.existsSync(gitignorePath))
     return "no-gitignore";
-  const content = fs41.readFileSync(gitignorePath, "utf-8");
+  const content = fs42.readFileSync(gitignorePath, "utf-8");
   const lines = content.split("\n").map((l) => l.trim());
   const recognised = /* @__PURE__ */ new Set([
     "graphify-out",
@@ -36799,24 +37300,24 @@ function ensureGitignoreEntry(worldClonePath) {
   const eol = content.includes("\r\n") ? "\r\n" : "\n";
   const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
   const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
-  fs41.appendFileSync(gitignorePath, block, "utf-8");
+  fs42.appendFileSync(gitignorePath, block, "utf-8");
   return "appended";
 }
 function createWorldOverlay(opts) {
   const pristineRoot = kgPristinePath(opts.workspace);
-  const pristinePath = path41.join(pristineRoot, "graphify-out");
-  if (!fs41.existsSync(pristinePath)) {
+  const pristinePath = path42.join(pristineRoot, "graphify-out");
+  if (!fs42.existsSync(pristinePath)) {
     throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
   }
-  if (!path41.isAbsolute(opts.worldClonePath)) {
+  if (!path42.isAbsolute(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
   }
-  if (!fs41.existsSync(opts.worldClonePath)) {
+  if (!fs42.existsSync(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
   }
-  const overlayPath = path41.join(opts.worldClonePath, "graphify-out");
-  if (fs41.existsSync(overlayPath)) {
-    fs41.rmSync(overlayPath, { recursive: true, force: true });
+  const overlayPath = path42.join(opts.worldClonePath, "graphify-out");
+  if (fs42.existsSync(overlayPath)) {
+    fs42.rmSync(overlayPath, { recursive: true, force: true });
   }
   const useReflink = process.platform === "darwin";
   let strategy;
@@ -36834,7 +37335,7 @@ function createWorldOverlay(opts) {
   } else {
     strategy = "cp-r";
   }
-  if (strategy === "cp-r" || !fs41.existsSync(overlayPath)) {
+  if (strategy === "cp-r" || !fs42.existsSync(overlayPath)) {
     try {
       execFileSync5("cp", ["-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
@@ -36846,7 +37347,7 @@ function createWorldOverlay(opts) {
       throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
     }
   }
-  if (!fs41.existsSync(overlayPath)) {
+  if (!fs42.existsSync(overlayPath)) {
     throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
   }
   const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
@@ -36860,9 +37361,9 @@ function createWorldOverlay(opts) {
 
 // ../core/dist/world/baseline-diff.js
 import { execFileSync as execFileSync6 } from "node:child_process";
-import * as fs42 from "node:fs";
+import * as fs43 from "node:fs";
 import * as os26 from "node:os";
-import * as path42 from "node:path";
+import * as path43 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 function expandHome2(p, homedir30) {
   return p.replace(/^~(?=$|\/|\\)/, homedir30());
@@ -36889,9 +37390,9 @@ ${stderr}`;
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
   const homedir30 = deps.homedir ?? (() => os26.homedir());
-  const baselineDir = path42.join(workspacePath, ".olam", "baseline");
+  const baselineDir = path43.join(workspacePath, ".olam", "baseline");
   try {
-    fs42.mkdirSync(baselineDir, { recursive: true });
+    fs43.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -36903,9 +37404,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path42.join(baselineDir, filename);
+    const outPath = path43.join(baselineDir, filename);
     const repoPath = expandHome2(repo.path, homedir30);
-    if (!fs42.existsSync(repoPath)) {
+    if (!fs43.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -36972,7 +37473,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs42.writeFileSync(outPath, content);
+    fs43.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -36980,8 +37481,8 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path42.join(workspacePath, repo.name);
-    if (!fs42.existsSync(worktreePath))
+    const worktreePath = path43.join(workspacePath, repo.name);
+    if (!fs43.existsSync(worktreePath))
       continue;
     try {
       execFileSync6("git", ["checkout", "--", "."], {
@@ -37041,17 +37542,17 @@ function extractStderr(err) {
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
   const homedir30 = deps.homedir ?? (() => os26.homedir());
-  const existsSync48 = deps.existsSync ?? ((p) => fs42.existsSync(p));
-  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs42.copyFileSync(src, dest));
+  const existsSync48 = deps.existsSync ?? ((p) => fs43.existsSync(p));
+  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs43.copyFileSync(src, dest));
   const mkdirSync30 = deps.mkdirSync ?? ((dirPath, opts) => {
-    fs42.mkdirSync(dirPath, opts);
+    fs43.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
     const repoPath = expandHome2(repo.path, homedir30);
-    const worktreePath = path42.join(workspacePath, repo.name);
+    const worktreePath = path43.join(workspacePath, repo.name);
     if (!existsSync48(repoPath))
       continue;
     if (!existsSync48(worktreePath)) {
@@ -37112,12 +37613,12 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
       }
     }
     for (const rel of plan.diff.untracked) {
-      const src = path42.join(plan.repoPath, rel);
-      const dest = path42.join(plan.worktreePath, rel);
+      const src = path43.join(plan.repoPath, rel);
+      const dest = path43.join(plan.worktreePath, rel);
       if (!existsSync48(src))
         continue;
       try {
-        mkdirSync30(path42.dirname(dest), { recursive: true });
+        mkdirSync30(path43.dirname(dest), { recursive: true });
         copyFileSync9(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -37143,8 +37644,8 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs43 from "node:fs";
-import * as path43 from "node:path";
+import * as fs44 from "node:fs";
+import * as path44 from "node:path";
 
 // ../core/dist/world/templates/_generated.js
 var GH_PR_CREATE = '# Creating PRs from inside an Olam world\n\n## The problem\n\nCalling `gh pr create` directly inside an Olam container **hangs forever** on a\nTTY confirmation prompt that the agent cannot answer. This is a known, reproduced issue.\n\n## The fix\n\nAlways use this exact pattern:\n\n```bash\necho y | timeout 30 gh pr create \\\n  --base main \\\n  --head <branch> \\\n  --title "<title>" \\\n  --body-file /tmp/pr-body.md\n```\n\n## Why each part matters\n\n- **`echo y |`** \u2014 answers the "Submit?" confirmation prompt up front so `gh` never pauses.\n- **`timeout 30`** \u2014 hard deadline. If `gh` hangs anyway, the command exits non-zero so the\n  agent can react instead of stalling the world indefinitely.\n- **`--body-file /tmp/pr-body.md`** \u2014 write the PR body to a temp file first. Avoids\n  shell-escaping bugs that occur with `--body "..."` for long or multi-line bodies.\n- **`--head` and `--base` explicitly** \u2014 removes all interactive prompts; `gh` has nothing to ask.\n\n## Troubleshooting\n\n**"no commits" or "branch not found" error:**\n\n```bash\ngit push -u origin <branch>\n# then retry:\necho y | timeout 30 gh pr create --base main --head <branch> --title "..." --body-file /tmp/pr-body.md\n```\n\n**Timeout exceeded (command exits 124):**\n\n- Check if the branch was pushed: `git log origin/<branch> --oneline -1`\n- Check GitHub CLI auth: `gh auth status`\n- Retry once; if it hangs again, open the PR via the GitHub web UI.\n';
@@ -37154,10 +37655,10 @@ var WORLD_CLAUDE_MD = '# Olam World: {{worldName}}\n\n{{taskBlock}}\n\n## Enviro
 // ../core/dist/world/context-injection.js
 function injectWorldContext(opts) {
   const { world } = opts;
-  const claudeDir2 = path43.join(world.workspacePath, ".claude");
-  fs43.mkdirSync(claudeDir2, { recursive: true });
+  const claudeDir2 = path44.join(world.workspacePath, ".claude");
+  fs44.mkdirSync(claudeDir2, { recursive: true });
   const content = WORLD_CLAUDE_MD.replace("{{worldName}}", world.name).replace("{{worldId}}", world.id).replace("{{branch}}", world.branch).replace("{{taskBlock}}", buildTaskBlock(opts)).replace("{{reposList}}", buildReposList(world)).replace("{{servicesLine}}", buildServicesLine(opts.services)).replace("{{pleriPlaneLine}}", buildPleriPlaneLine(opts.pleriPlaneUrl)).replace("{{planFileBlock}}", buildPlanFileBlock(world)).replace("{{extraContextBlock}}", buildExtraContextBlock(opts.claudeMdExtra));
-  fs43.writeFileSync(path43.join(claudeDir2, "CLAUDE.md"), content);
+  fs44.writeFileSync(path44.join(claudeDir2, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function buildTaskBlock(opts) {
@@ -37231,10 +37732,10 @@ function buildExtraContextBlock(extra) {
 ${extra}`;
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path43.join(workspacePath, ".olam", "docs");
-  fs43.mkdirSync(docsDir, { recursive: true });
-  fs43.writeFileSync(path43.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
-  fs43.writeFileSync(path43.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
+  const docsDir = path44.join(workspacePath, ".olam", "docs");
+  fs44.mkdirSync(docsDir, { recursive: true });
+  fs44.writeFileSync(path44.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
+  fs44.writeFileSync(path44.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -37248,9 +37749,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path43.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path44.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs43.existsSync(plansDir) && fs43.readdirSync(plansDir).length > 0;
+    return fs44.existsSync(plansDir) && fs44.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -37822,25 +38323,25 @@ init_repo_manifest();
 
 // ../core/dist/world/snapshot.js
 import * as crypto7 from "node:crypto";
-import * as fs44 from "node:fs";
+import * as fs45 from "node:fs";
 import * as os27 from "node:os";
-import * as path44 from "node:path";
-import { execFileSync as execFileSync7, spawn as spawn2 } from "node:child_process";
+import * as path45 from "node:path";
+import { execFileSync as execFileSync7, spawn as spawn3 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path44.join(os27.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path45.join(os27.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDirByWorkspace(workspace, arch, kind) {
-  return path44.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
+  return path45.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path44.join(snapshotsDir(), worldId);
+  const legacyDir = path45.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs44.existsSync(legacyDir))
+  if (!fs45.existsSync(legacyDir))
     return;
   try {
-    fs44.rmSync(legacyDir, { recursive: true, force: true });
+    fs45.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -37859,11 +38360,11 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path44.join(repoDir, "Gemfile.lock");
-  if (!fs44.existsSync(lockfile))
+  const lockfile = path45.join(repoDir, "Gemfile.lock");
+  if (!fs45.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs44.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs45.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -37873,10 +38374,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path44.join(repoDir, name);
-    if (fs44.existsSync(lockfile)) {
+    const lockfile = path45.join(repoDir, name);
+    if (fs45.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs44.readFileSync(lockfile) }
+        { path: name, content: fs45.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -37895,18 +38396,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path44.dirname(destDir);
-  fs44.mkdirSync(parent, { recursive: true });
+  const parent = path45.dirname(destDir);
+  fs45.mkdirSync(parent, { recursive: true });
   const tmpSuffix = `.tmp-${process.pid}-${crypto7.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs44.mkdirSync(tmpDir, { recursive: true });
+    fs45.mkdirSync(tmpDir, { recursive: true });
     execFileSync7("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs44.renameSync(tmpDir, destDir);
+    fs45.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs44.rmSync(tmpDir, { recursive: true, force: true });
+      fs45.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -37917,12 +38418,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path44.resolve(base, target);
-  const baseResolved = path44.resolve(base);
-  const rel = path44.relative(baseResolved, resolved);
+  const resolved = path45.resolve(base, target);
+  const baseResolved = path45.resolve(base);
+  const rel = path45.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path44.isAbsolute(rel);
+  return !rel.startsWith("..") && !path45.isAbsolute(rel);
 }
 var TYPE_CHAR_TO_TYPE = {
   "-": "file",
@@ -37972,7 +38473,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs44.readFileSync(tarPath));
+    raw = gunzipSync(fs45.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -37987,7 +38488,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path44.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path45.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -38025,7 +38526,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path44.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path45.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -38033,8 +38534,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path44.join(targetDir, path44.dirname(entry.name));
-      if (path44.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path44.join(path44.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path45.join(targetDir, path45.dirname(entry.name));
+      if (path45.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path45.join(path45.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -38044,7 +38545,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path44.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path45.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -38077,8 +38578,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path44.join(archDir, tarFilename);
-      if (!fs44.existsSync(tarPath)) {
+      const tarPath = path45.join(archDir, tarFilename);
+      if (!fs45.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -38093,9 +38594,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path44.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path45.join(repo.worktreeDir, targetSubpath);
       try {
-        fs44.rmSync(targetDir, { recursive: true, force: true });
+        fs45.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -38108,8 +38609,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs44.rmSync(tarPath, { force: true });
-          fs44.rmSync(manifestPath(tarPath), { force: true });
+          fs45.rmSync(tarPath, { force: true });
+          fs45.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -38125,10 +38626,10 @@ function restoreSnapshotsForRepos(input) {
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs44.existsSync(mPath))
+  if (!fs45.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs44.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs45.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
@@ -38143,17 +38644,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs44.mkdirSync(dir, { recursive: true });
-  const lockPath = path44.join(dir, EVICT_LOCK_FILENAME);
+  fs45.mkdirSync(dir, { recursive: true });
+  const lockPath = path45.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs44.openSync(lockPath, fs44.constants.O_WRONLY | fs44.constants.O_CREAT | fs44.constants.O_EXCL, 384);
+    fd = fs45.openSync(lockPath, fs45.constants.O_WRONLY | fs45.constants.O_CREAT | fs45.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs44.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs45.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -38161,23 +38662,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs44.unlinkSync(lockPath);
-      fd = fs44.openSync(lockPath, fs44.constants.O_WRONLY | fs44.constants.O_CREAT | fs44.constants.O_EXCL, 384);
+      fs45.unlinkSync(lockPath);
+      fd = fs45.openSync(lockPath, fs45.constants.O_WRONLY | fs45.constants.O_CREAT | fs45.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs44.writeSync(fd, `${process.pid}
+    fs45.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs44.closeSync(fd);
+    fs45.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs44.unlinkSync(lockPath);
+      fs45.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -38188,7 +38689,7 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   if (!/^[a-zA-Z0-9_\-.]+$/.test(worldId))
     return null;
   try {
-    const child = spawn2(olamBin, ["world", "snapshot", "create", worldId, "--kind", "all"], {
+    const child = spawn3(olamBin, ["world", "snapshot", "create", worldId, "--kind", "all"], {
       detached: true,
       stdio: "ignore",
       // OLAM_INTERNAL_SNAPSHOT=1 sentinel — Phase D D1's deprecation
@@ -38210,17 +38711,17 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs44.existsSync(dir))
+  if (!fs45.existsSync(dir))
     return 0;
   const allTars = [];
   const walk = (d) => {
-    for (const entry of fs44.readdirSync(d, { withFileTypes: true })) {
-      const full = path44.join(d, entry.name);
+    for (const entry of fs45.readdirSync(d, { withFileTypes: true })) {
+      const full = path45.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat = fs44.statSync(full);
-        allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
+        const stat2 = fs45.statSync(full);
+        allTars.push({ path: full, size: stat2.size, mtime: stat2.mtimeMs });
       }
     }
   };
@@ -38234,8 +38735,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs44.rmSync(tar.path, { force: true });
-    fs44.rmSync(manifestPath(tar.path), { force: true });
+    fs45.rmSync(tar.path, { force: true });
+    fs45.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -38352,14 +38853,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 
 // ../core/dist/world/olam-yaml.js
 init_repo_manifest();
-import * as path45 from "node:path";
+import * as path46 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path45.join(workspacePath, repo.name);
+    const repoDir = path46.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -38374,8 +38875,8 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs45 from "node:fs";
-import * as path46 from "node:path";
+import * as fs46 from "node:fs";
+import * as path47 from "node:path";
 import { parse as parseYaml5 } from "yaml";
 function parseFrontmatter2(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -38395,20 +38896,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path46.join(workspaceRoot, ".olam", "policies");
-  if (!fs45.existsSync(policiesDir))
+  const policiesDir = path47.join(workspaceRoot, ".olam", "policies");
+  if (!fs46.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs45.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs46.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path46.join(policiesDir, file);
+    const filePath = path47.join(policiesDir, file);
     try {
-      const content = fs45.readFileSync(filePath, "utf8");
+      const content = fs46.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter2(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -38491,7 +38992,7 @@ var TaskDispatchError = class extends Error {
     this.name = "TaskDispatchError";
   }
 };
-var DEFAULT_SLEEP = (ms) => new Promise((resolve14) => setTimeout(resolve14, ms));
+var DEFAULT_SLEEP = (ms) => new Promise((resolve15) => setTimeout(resolve15, ms));
 async function probeHealth(containerName, dockerExec, budgetMs, sleep5) {
   const deadline = Date.now() + budgetMs;
   const cadenceMs = 100;
@@ -38555,12 +39056,12 @@ init_store();
 init_bridge();
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs46 from "node:fs";
+import * as fs47 from "node:fs";
 import * as os28 from "node:os";
-import * as path47 from "node:path";
+import * as path48 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path47.join(os28.homedir(), p.slice(1));
+    return path48.join(os28.homedir(), p.slice(1));
   }
   return p;
 }
@@ -38572,7 +39073,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs46.existsSync(resolvedPath)) {
+    if (!fs47.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -38588,19 +39089,19 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
 init_port_validator();
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs47 from "node:fs";
-import * as path48 from "node:path";
+import * as fs48 from "node:fs";
+import * as path49 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path48.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path48.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path48.dirname(destAbs);
-    fs47.mkdirSync(destDir, { recursive: true });
-    fs47.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path49.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path49.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path49.dirname(destAbs);
+    fs48.mkdirSync(destDir, { recursive: true });
+    fs48.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -39236,7 +39737,7 @@ ${detail}`);
       runbookSeeds = resolved.seeds;
     }
     const worldId = generateWorldId();
-    const workspacePath = path49.join(os29.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path50.join(os29.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = this.resolveReposWithWorkspace(opts);
@@ -39257,7 +39758,8 @@ ${detail}`);
       createdAt: now,
       updatedAt: now,
       readinessChain,
-      expectedServices
+      expectedServices,
+      ...opts.claudeHome ? { claudeHome: opts.claudeHome } : {}
     };
     const sm = new WorldStateMachine(worldId, "creating");
     this.registry.register(metadata);
@@ -39318,37 +39820,37 @@ ${detail}`);
       if (!repo.path)
         continue;
       const sourceRoot = repo.path.replace(/^~/, os29.homedir());
-      const worktreeRoot = path49.join(workspacePath, repo.name);
-      if (!fs48.existsSync(sourceRoot) || !fs48.existsSync(worktreeRoot))
+      const worktreeRoot = path50.join(workspacePath, repo.name);
+      if (!fs49.existsSync(sourceRoot) || !fs49.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path49.dirname(pattern), path49.basename(pattern)];
-          const sourceDir = path49.join(sourceRoot, dir);
-          if (fs48.existsSync(sourceDir)) {
+          const [dir, glob] = [path50.dirname(pattern), path50.basename(pattern)];
+          const sourceDir = path50.join(sourceRoot, dir);
+          if (fs49.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs48.readdirSync(sourceDir)) {
+              for (const entry of fs49.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path49.join(dir, entry));
+                  matches2.push(path50.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs48.existsSync(path49.join(sourceRoot, pattern))) {
+        } else if (fs49.existsSync(path50.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path49.join(sourceRoot, rel);
-          const dst = path49.join(worktreeRoot, rel);
+          const src = path50.join(sourceRoot, rel);
+          const dst = path50.join(worktreeRoot, rel);
           try {
-            const st = fs48.statSync(src);
+            const st = fs49.statSync(src);
             if (!st.isFile())
               continue;
-            fs48.mkdirSync(path49.dirname(dst), { recursive: true });
-            fs48.copyFileSync(src, dst);
+            fs49.mkdirSync(path50.dirname(dst), { recursive: true });
+            fs49.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -39395,7 +39897,7 @@ ${detail}`);
         worlds_default: this.config.worlds_default,
         repos: enrichedRepos
       };
-      setupWorldEnv(enrichedRepos, workspacePath, serviceEnv, crossRepoEnv, configCtx);
+      setupWorldEnv(enrichedRepos, workspacePath, serviceEnv, crossRepoEnv, configCtx, opts.claudeHome);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.warn(`[WorldManager] env setup failed: ${msg}`);
@@ -39434,7 +39936,7 @@ ${detail}`);
     }
     const overlayAttachments = [];
     for (const repo of repos) {
-      const worldClonePath = path49.join(workspacePath, repo.name);
+      const worldClonePath = path50.join(workspacePath, repo.name);
       try {
         const result = createWorldOverlay({
           workspace: repo.name,
@@ -39489,7 +39991,7 @@ ${detail}`);
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path49.join(workspacePath, repo.name);
+          const repoDir = path50.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -39533,10 +40035,10 @@ ${detail}`);
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path49.join(os29.homedir(), ".olam", "r2-credentials.json");
-      if (fs48.existsSync(r2CredsPath)) {
+      const r2CredsPath = path50.join(os29.homedir(), ".olam", "r2-credentials.json");
+      if (fs49.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs48.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs49.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -39553,10 +40055,10 @@ ${detail}`);
         } catch {
         }
       }
-      const keysYamlPath = path49.join(os29.homedir(), ".olam", "keys.yaml");
-      if (fs48.existsSync(keysYamlPath)) {
+      const keysYamlPath = path50.join(os29.homedir(), ".olam", "keys.yaml");
+      if (fs49.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs48.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs49.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const parsed = YAML3.parse(keysRaw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -39615,10 +40117,10 @@ ${detail}`);
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path49.join(workspacePath, repoName, relativePath);
+          const absPath = path50.join(workspacePath, repoName, relativePath);
           try {
-            fs48.mkdirSync(path49.dirname(absPath), { recursive: true });
-            fs48.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs49.mkdirSync(path50.dirname(absPath), { recursive: true });
+            fs49.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -39795,7 +40297,7 @@ ${detail}`);
         imageDigest: void 0,
         repos: enrichedRepos.map((r) => ({
           name: r.name,
-          worktreeDir: path49.join(workspacePath, r.name)
+          worktreeDir: path50.join(workspacePath, r.name)
         }))
       });
       for (const out of restoreResult.outcomes) {
@@ -39901,7 +40403,7 @@ ${detail}`);
     }
     if (opts.task) {
       const allPolicies = repos.flatMap((repo) => {
-        const repoWorktree = path49.join(workspacePath, repo.name);
+        const repoWorktree = path50.join(workspacePath, repo.name);
         try {
           return loadPolicies(repoWorktree);
         } catch (err) {
@@ -39914,8 +40416,8 @@ ${detail}`);
         try {
           execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
           for (const repo of repos) {
-            const policiesDir = path49.join(workspacePath, repo.name, ".olam", "policies");
-            if (fs48.existsSync(policiesDir)) {
+            const policiesDir = path50.join(workspacePath, repo.name, ".olam", "policies");
+            if (fs49.existsSync(policiesDir)) {
               execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
             }
           }
@@ -40023,8 +40525,8 @@ ${detail}`);
     } catch {
     }
     try {
-      fs48.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs48.existsSync(world.workspacePath)) {
+      fs49.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs49.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -40133,14 +40635,14 @@ ${detail}`);
     }).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs48.readFileSync(planFilePath, "utf-8");
-    const planFileName = path49.basename(planFilePath);
+    const planContent = fs49.readFileSync(planFilePath, "utf-8");
+    const planFileName = path50.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path49.join(workspacePath, targetRepo, "docs", "plans");
-    fs48.mkdirSync(plansDir, { recursive: true });
-    fs48.writeFileSync(path49.join(plansDir, planFileName), planContent);
+    const plansDir = path50.join(workspacePath, targetRepo, "docs", "plans");
+    fs49.mkdirSync(plansDir, { recursive: true });
+    fs49.writeFileSync(path50.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -40272,7 +40774,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
   if (seedTemplates.length === 0) {
     return { worldDbNames: [] };
   }
-  const spawn4 = options.spawn ?? spawnSync4;
+  const spawn5 = options.spawn ?? spawnSync4;
   const seedToWorldDb = /* @__PURE__ */ new Map();
   for (const seed of seedTemplates) {
     seedToWorldDb.set(seed, deriveWorldDbName(seed, worldId));
@@ -40280,7 +40782,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
   const created = [];
   for (const seed of seedTemplates) {
     const worldDb = seedToWorldDb.get(seed);
-    const exists = spawn4("docker", [
+    const exists = spawn5("docker", [
       "exec",
       container,
       "psql",
@@ -40292,7 +40794,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
     const dbAlreadyExists = exists.status === 0 && (exists.stdout || "").trim() === "1";
     if (!dbAlreadyExists) {
       const sql = `CREATE DATABASE "${worldDb}" TEMPLATE "${seed}"`;
-      const create = spawn4("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
+      const create = spawn5("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
       if (create.status !== 0) {
         throw new Error(`failed to CREATE DATABASE "${worldDb}" TEMPLATE "${seed}": ${(create.stderr || "").trim()}`);
       }
@@ -40302,7 +40804,7 @@ function applyPostgresTemplateClone(worldId, enrichedRepos, options = {}) {
     if (stmts !== void 0 && stmts.length > 0) {
       for (const rawStmt of stmts) {
         const stmt = interpolatePostCloneSql(rawStmt, worldId, seedToWorldDb);
-        const fixup = spawn4("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", stmt], { encoding: "utf-8" });
+        const fixup = spawn5("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", stmt], { encoding: "utf-8" });
         if (fixup.status !== 0) {
           throw new Error(`post_clone_sql against "${worldDb}" failed (statement: ${truncate(stmt, 120)}): ${(fixup.stderr || "").trim()}`);
         }
@@ -40330,11 +40832,11 @@ function applyPostgresTestTemplateClone(worldId, enrichedRepos, options = {}) {
   if (testTemplates.length === 0) {
     return { worldTestDbNames: [] };
   }
-  const spawn4 = options.spawn ?? spawnSync4;
+  const spawn5 = options.spawn ?? spawnSync4;
   const created = [];
   for (const seed of testTemplates) {
     const worldDb = deriveWorldDbName(seed, worldId);
-    const exists = spawn4("docker", [
+    const exists = spawn5("docker", [
       "exec",
       container,
       "psql",
@@ -40346,7 +40848,7 @@ function applyPostgresTestTemplateClone(worldId, enrichedRepos, options = {}) {
     const dbAlreadyExists = exists.status === 0 && (exists.stdout || "").trim() === "1";
     if (!dbAlreadyExists) {
       const sql = `CREATE DATABASE "${worldDb}" TEMPLATE "${seed}"`;
-      const create = spawn4("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
+      const create = spawn5("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", sql], { encoding: "utf-8" });
       if (create.status !== 0) {
         throw new Error(`failed to CREATE DATABASE "${worldDb}" TEMPLATE "${seed}": ${(create.stderr || "").trim()}`);
       }
@@ -40387,13 +40889,13 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
   if (worldDbNames.length === 0) {
     throw new Error(`applyPostgresWorldRole called with empty worldDbNames for "${worldId}" \u2014 should only run when applyPostgresTemplateClone produced clones`);
   }
-  const spawn4 = options.spawn ?? spawnSync4;
+  const spawn5 = options.spawn ?? spawnSync4;
   const container = options.singletonContainer ?? "olam-postgres";
   const user = options.postgresUser ?? "development";
   const genPassword = options.generatePassword ?? defaultPasswordGenerator;
   const worldRoleName = deriveWorldRoleName(worldId);
   const password = genPassword();
-  const exists = spawn4("docker", [
+  const exists = spawn5("docker", [
     "exec",
     container,
     "psql",
@@ -40405,12 +40907,12 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
   const roleExists = exists.status === 0 && (exists.stdout || "").trim() === "1";
   const escapedPassword = escapeSqlLiteral(password);
   const roleDdl = roleExists ? `ALTER ROLE "${worldRoleName}" WITH LOGIN PASSWORD '${escapedPassword}' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION` : `CREATE ROLE "${worldRoleName}" WITH LOGIN PASSWORD '${escapedPassword}' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION`;
-  const dml = spawn4("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", roleDdl], { encoding: "utf-8" });
+  const dml = spawn5("docker", ["exec", container, "psql", "-U", user, "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", roleDdl], { encoding: "utf-8" });
   if (dml.status !== 0) {
     throw new Error(`failed to ${roleExists ? "ALTER" : "CREATE"} ROLE "${worldRoleName}": ` + redactCreateRolePassword((dml.stderr || "").trim()));
   }
   for (const worldDb of worldDbNames) {
-    const grantConnect = spawn4("docker", [
+    const grantConnect = spawn5("docker", [
       "exec",
       container,
       "psql",
@@ -40435,7 +40937,7 @@ function applyPostgresWorldRole(worldId, worldDbNames, options = {}) {
       `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO "${worldRoleName}"`,
       `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO "${worldRoleName}"`
     ].join("; ");
-    const grantResult = spawn4("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", perDbGrants], { encoding: "utf-8" });
+    const grantResult = spawn5("docker", ["exec", container, "psql", "-U", user, "-d", worldDb, "-v", "ON_ERROR_STOP=1", "-c", perDbGrants], { encoding: "utf-8" });
     if (grantResult.status !== 0) {
       throw new Error(`failed to GRANT privileges on "${worldDb}" to "${worldRoleName}": ${(grantResult.stderr || "").trim()}`);
     }
@@ -40455,11 +40957,11 @@ function dropPostgresWorldDbs(worldId, worldDbNames, options = {}) {
   if (worldDbNames.length === 0)
     return;
   assertSafeWorldId(worldId);
-  const spawn4 = options.spawn ?? spawnSync4;
+  const spawn5 = options.spawn ?? spawnSync4;
   const container = options.container ?? "olam-postgres";
   const user = options.user ?? "development";
   for (const db of worldDbNames) {
-    const drop = spawn4("docker", [
+    const drop = spawn5("docker", [
       "exec",
       container,
       "psql",
@@ -40479,10 +40981,10 @@ function dropPostgresWorldRole(worldId, worldRoleName, options = {}) {
   if (!worldRoleName)
     return;
   assertSafeWorldId(worldId);
-  const spawn4 = options.spawn ?? spawnSync4;
+  const spawn5 = options.spawn ?? spawnSync4;
   const container = options.container ?? "olam-postgres";
   const user = options.user ?? "development";
-  const cleanup = spawn4("docker", [
+  const cleanup = spawn5("docker", [
     "exec",
     container,
     "psql",
@@ -40574,8 +41076,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs49 from "node:fs";
-import * as path50 from "node:path";
+import * as fs50 from "node:fs";
+import * as path51 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -40634,15 +41136,15 @@ function parsePsAux(stdout) {
       continue;
     const cpuPercent = parseFloat(parts[2]) || 0;
     const rssKb = parseInt(parts[5], 10) || 0;
-    const stat = parts[7] ?? "";
+    const stat2 = parts[7] ?? "";
     const command = parts.slice(10).join(" ");
     const name = command.split(/\s/)[0]?.split("/").pop() ?? command;
     let status2 = "running";
-    if (stat.startsWith("T"))
+    if (stat2.startsWith("T"))
       status2 = "stopped";
-    else if (stat.startsWith("Z"))
+    else if (stat2.startsWith("Z"))
       status2 = "error";
-    else if (stat.startsWith("S") && cpuPercent === 0)
+    else if (stat2.startsWith("S") && cpuPercent === 0)
       status2 = "idle";
     result.push({
       pid,
@@ -40910,7 +41412,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs49.existsSync(dbPath))
+  if (!fs50.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -41081,13 +41583,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port: port2, registry: registry2 } = opts;
-  const thisDir = path50.dirname(fileURLToPath3(import.meta.url));
-  const defaultPublicDir = path50.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path51.dirname(fileURLToPath3(import.meta.url));
+  const defaultPublicDir = path51.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs49.existsSync(publicDir);
+  let hasPublicDir = fs50.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs49.existsSync(publicDir);
+      hasPublicDir = fs50.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port2}`;
     const url2 = new URL(req.url ?? "/", `http://${host}`);
@@ -41361,22 +41863,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path50.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path51.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs49.existsSync(filePath) && fs49.statSync(filePath).isFile()) {
-      const ext = path50.extname(filePath);
+    if (fs50.existsSync(filePath) && fs50.statSync(filePath).isFile()) {
+      const ext = path51.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs49.createReadStream(filePath).pipe(res);
+      fs50.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path50.join(publicDir, "index.html");
-    if (fs49.existsSync(filePath)) {
+    filePath = path51.join(publicDir, "index.html");
+    if (fs50.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs49.createReadStream(filePath).pipe(res);
+      fs50.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -41386,17 +41888,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs50 from "node:fs";
+import * as fs51 from "node:fs";
 import * as os30 from "node:os";
-import * as path51 from "node:path";
-var STATE_PATH = path51.join(os30.homedir(), ".olam", "dashboard.json");
+import * as path52 from "node:path";
+var STATE_PATH = path52.join(os30.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs50.mkdirSync(path51.dirname(STATE_PATH), { recursive: true });
-  fs50.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs51.mkdirSync(path52.dirname(STATE_PATH), { recursive: true });
+  fs51.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs50.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs51.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -41404,7 +41906,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs50.unlinkSync(STATE_PATH);
+    fs51.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -41422,7 +41924,7 @@ function isDashboardRunning() {
 }
 
 // ../core/dist/dashboard/tunnel.js
-import { spawn as spawn3, execSync as execSync6 } from "node:child_process";
+import { spawn as spawn4, execSync as execSync6 } from "node:child_process";
 var tunnelProcess = null;
 function isCloudflaredAvailable() {
   try {
@@ -41433,8 +41935,8 @@ function isCloudflaredAvailable() {
   }
 }
 function startTunnel(port2) {
-  return new Promise((resolve14, reject2) => {
-    const child = spawn3("cloudflared", ["tunnel", "--url", `http://localhost:${port2}`], {
+  return new Promise((resolve15, reject2) => {
+    const child = spawn4("cloudflared", ["tunnel", "--url", `http://localhost:${port2}`], {
       stdio: ["ignore", "pipe", "pipe"],
       detached: false
     });
@@ -41455,7 +41957,7 @@ function startTunnel(port2) {
       if (match) {
         resolved = true;
         clearTimeout(timeout);
-        resolve14(match[0]);
+        resolve15(match[0]);
       }
     }
     child.stdout?.on("data", scan);
@@ -41523,8 +42025,8 @@ var DashboardManager = class {
       }
       throw err;
     }
-    await new Promise((resolve14, reject2) => {
-      this.server.on("listening", resolve14);
+    await new Promise((resolve15, reject2) => {
+      this.server.on("listening", resolve15);
       this.server.on("error", reject2);
     });
     this.info = { localUrl: `http://localhost:${port2}` };
@@ -41570,8 +42072,8 @@ var DashboardManager = class {
   async stop() {
     stopTunnel();
     if (this.server) {
-      await new Promise((resolve14) => {
-        this.server.close(() => resolve14());
+      await new Promise((resolve15) => {
+        this.server.close(() => resolve15());
       });
       this.server = null;
     }
@@ -41685,7 +42187,7 @@ var PleriClient = class {
 
 // ../mcp-server/src/env-loader.ts
 import { readFileSync as readFileSync39, existsSync as existsSync47, statSync as statSync14 } from "node:fs";
-import { join as join52, dirname as dirname29, resolve as resolve13 } from "node:path";
+import { join as join52, dirname as dirname29, resolve as resolve14 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -41693,8 +42195,8 @@ var PROJECT_MARKERS = [
   "olam.yml"
 ];
 function findProjectRoot2(startDir) {
-  let dir = resolve13(startDir);
-  const root = resolve13("/");
+  let dir = resolve14(startDir);
+  const root = resolve14("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
       if (existsSync47(join52(dir, marker))) return dir;
@@ -41714,9 +42216,9 @@ function findProjectRoot2(startDir) {
     dir = parent;
   }
 }
-function parseEnvFile(path52) {
+function parseEnvFile(path53) {
   const out = {};
-  const raw = readFileSync39(path52, "utf8");
+  const raw = readFileSync39(path53, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;