@pleri/olam-cli 0.1.185 → 0.1.188

package/dist/index.js

@@ -5581,7 +5581,8 @@ var init_client = __esm({
 
 // ../core/dist/auth/container.js
 import { execFileSync, spawnSync } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync10, mkdtempSync, rmSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
 import * as path9 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function resolveAuthServicePath() {
@@ -5671,28 +5672,41 @@ var init_container = __esm({
       /**
        * `docker run` the auth container. Injects the shared secret so every
        * /credentials* request must present X-Olam-Secret to succeed.
+       *
+       * The secret is written to a 0600-permissioned temp file and passed via
+       * `--env-file` so it never appears in `ps aux` / `/proc/<pid>/cmdline`
+       * during the spawn window.
        */
       runContainer() {
         const secret = getOrCreateSecret();
-        execFileSync("docker", [
-          "run",
-          "--detach",
-          "--name",
-          this.containerName,
-          "--restart",
-          "unless-stopped",
-          "--publish",
-          `${this.port}:9999`,
-          "--volume",
-          `${this.volume}:/auth-data`,
-          "--env",
-          `AUTH_BIND=0.0.0.0`,
-          "--env",
-          `AUTH_DATA_DIR=/auth-data`,
-          "--env",
-          `OLAM_AUTH_SECRET=${secret}`,
-          this.imageTag
-        ], { stdio: "pipe" });
+        const tmpDir = mkdtempSync(path9.join(tmpdir2(), "olam-auth-"));
+        const envFilePath = path9.join(tmpDir, "env");
+        writeFileSync6(envFilePath, `OLAM_AUTH_SECRET=${secret}
+`, { mode: 384 });
+        chmodSync2(envFilePath, 384);
+        try {
+          execFileSync("docker", [
+            "run",
+            "--detach",
+            "--name",
+            this.containerName,
+            "--restart",
+            "unless-stopped",
+            "--publish",
+            `${this.port}:9999`,
+            "--volume",
+            `${this.volume}:/auth-data`,
+            "--env",
+            `AUTH_BIND=0.0.0.0`,
+            "--env",
+            `AUTH_DATA_DIR=/auth-data`,
+            "--env-file",
+            envFilePath,
+            this.imageTag
+          ], { stdio: "pipe" });
+        } finally {
+          rmSync(tmpDir, { recursive: true, force: true });
+        }
       }
       stop() {
         const current = this.status();
@@ -7701,7 +7715,7 @@ async function probeAuthVault(olamHomeOverride) {
     return {
       ok: false,
       message: `auth vault missing at ${vaultPath}`,
-      remedy: "Run `olam auth up && olam auth login` to provision the vault."
+      remedy: "Run `olam services up && olam auth login` to provision the vault."
     };
   }
   let parsed;
@@ -7711,14 +7725,14 @@ async function probeAuthVault(olamHomeOverride) {
     return {
       ok: false,
       message: `auth vault malformed: ${err.message}`,
-      remedy: "Inspect the accounts.json file; restore from backup or re-run `olam auth up`."
+      remedy: "Inspect the accounts.json file; restore from backup or re-run `olam services up`."
     };
   }
   if (!Array.isArray(parsed)) {
     return {
       ok: false,
       message: "auth vault malformed: expected JSON array at top level",
-      remedy: "Restore the vault from backup or re-run `olam auth up && olam auth login`."
+      remedy: "Restore the vault from backup or re-run `olam services up && olam auth login`."
     };
   }
   const accounts = parsed.filter((a) => a !== null && typeof a === "object");
@@ -7766,7 +7780,8 @@ async function probeKgStorage(olamHomeOverride) {
   if (totalBytes >= SOFT_CAP_BYTES) {
     return {
       ok: true,
-      message: `KG storage ${formatBytes(totalBytes)} (soft-warn \u2014 exceeds 1.5 GB; consider pruning)`
+      message: `KG storage ${formatBytes(totalBytes)} (soft-warn \u2014 exceeds 1.5 GB; consider pruning)`,
+      remedy: "Prune stale pristines: `rm -rf ~/.olam/kg/<workspace>` or raise OLAM_KG_SOFT_CAP."
     };
   }
   return { ok: true, message: `KG storage ${formatBytes(totalBytes)} (under cap)` };
@@ -21693,12 +21708,12 @@ function nextStepsFor(archetype) {
       ];
     case "bootstrapper":
       return [
-        "Start the auth container: `olam auth up`, then `olam auth login`.",
+        "Start the auth container: `olam services up`, then `olam auth login`.",
         "For Cloudflare deployments: `cd packages/cloudflare-worker && pnpm wrangler deploy`."
       ];
     case "admin":
       return [
-        "Start the auth container: `olam auth up`, then `olam auth login`.",
+        "Start the auth container: `olam services up`, then `olam auth login`.",
         "Curate workspaces: `olam workspace add <name> --from-config`.",
         "Assign narrower archetypes to teammates (CF side, once slice C lands): use `role.manage`."
       ];
@@ -21893,8 +21908,8 @@ import {
   existsSync as existsSync30,
   mkdirSync as mkdirSync19,
   readdirSync as readdirSync9,
-  writeFileSync as writeFileSync15,
-  chmodSync as chmodSync4
+  writeFileSync as writeFileSync16,
+  chmodSync as chmodSync5
 } from "node:fs";
 import { join as join36 } from "node:path";
 import { homedir as homedir21, platform } from "node:os";
@@ -22010,7 +22025,7 @@ init_install_root();
 
 // src/lib/k8s-secret-render.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync28, readFileSync as readFileSync24, writeFileSync as writeFileSync14, mkdirSync as mkdirSync18, chmodSync as chmodSync3, renameSync as renameSync5 } from "node:fs";
+import { existsSync as existsSync28, readFileSync as readFileSync24, writeFileSync as writeFileSync15, mkdirSync as mkdirSync18, chmodSync as chmodSync4, renameSync as renameSync5 } from "node:fs";
 import { join as join34, dirname as dirname21 } from "node:path";
 import { randomBytes as randomBytes6 } from "node:crypto";
 var K8S_SECRETS_STATE_PATH = join34(OLAM_HOME, "k8s-secrets-state.json");
@@ -22110,8 +22125,8 @@ var defaultRunGhTokenCmd = () => {
 var defaultReadFile = (p, enc) => readFileSync24(p, enc);
 var defaultWriteFile = (p, data, mode) => {
   mkdirSync18(dirname21(p), { recursive: true });
-  writeFileSync14(p, data, { encoding: "utf8", mode });
-  chmodSync3(p, mode);
+  writeFileSync15(p, data, { encoding: "utf8", mode });
+  chmodSync4(p, mode);
 };
 var defaultFileExists = (p) => existsSync28(p);
 function readSecretsState(statePath = K8S_SECRETS_STATE_PATH) {
@@ -22128,8 +22143,8 @@ function readSecretsState(statePath = K8S_SECRETS_STATE_PATH) {
 function writeSecretsState(state, statePath = K8S_SECRETS_STATE_PATH) {
   mkdirSync18(dirname21(statePath), { recursive: true });
   const tmp = `${statePath}.tmp.${process.pid}`;
-  writeFileSync14(tmp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
-  chmodSync3(tmp, 384);
+  writeFileSync15(tmp, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  chmodSync4(tmp, 384);
   renameSync5(tmp, statePath);
 }
 function resolveSourceValue(source, olamHome5, reuseFromState, rotate, deps) {
@@ -22497,8 +22512,8 @@ function ensureSecrets() {
       continue;
     }
     const hex = randomBytes7(32).toString("hex");
-    writeFileSync15(path101, hex + "\n", { encoding: "utf8", mode: 384 });
-    chmodSync4(path101, 384);
+    writeFileSync16(path101, hex + "\n", { encoding: "utf8", mode: 384 });
+    chmodSync5(path101, 384);
     printSuccess(`generated ~/.olam/${name}`);
   }
 }
@@ -23647,7 +23662,7 @@ import { homedir as homedir24 } from "node:os";
 import { join as join41 } from "node:path";
 
 // src/lib/memory-secret.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync22, readFileSync as readFileSync27, statSync as statSync8, writeFileSync as writeFileSync17, renameSync as renameSync6, chmodSync as chmodSync6 } from "node:fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync22, readFileSync as readFileSync27, statSync as statSync8, writeFileSync as writeFileSync18, renameSync as renameSync6, chmodSync as chmodSync7 } from "node:fs";
 import { homedir as homedir23 } from "node:os";
 import { join as join40, dirname as dirname23 } from "node:path";
 import { randomBytes as randomBytes8 } from "node:crypto";
@@ -23660,8 +23675,8 @@ function generateSecret() {
 function writeSecretAtPath(path101, value) {
   mkdirSync22(dirname23(path101), { recursive: true });
   const tmp = `${path101}.tmp.${process.pid}`;
-  writeFileSync17(tmp, value, { mode: 384 });
-  chmodSync6(tmp, 384);
+  writeFileSync18(tmp, value, { mode: 384 });
+  chmodSync7(tmp, 384);
   renameSync6(tmp, path101);
 }
 function readSecretAtPathOrNull(path101) {
@@ -24404,6 +24419,10 @@ async function servicesUp() {
     if (!ready) {
       printError(`olam-auth started but /health did not respond within ${MCP_AUTH_HEALTH_TIMEOUT_MS / 1e3}s.`);
       dumpContainerLogs("olam-auth");
+      printError("\nTry:");
+      printError("  - olam doctor                    # check service prereqs");
+      printError("  - docker logs olam-auth          # full logs");
+      printError("  - docker restart olam-auth       # restart");
       return { exitCode: 1 };
     }
     printSuccess("olam-auth started");
@@ -24422,6 +24441,10 @@ async function servicesUp() {
     if (!ready) {
       printError(`olam-mcp-auth started but /health did not respond within ${MCP_AUTH_HEALTH_TIMEOUT_MS / 1e3}s.`);
       dumpContainerLogs("olam-mcp-auth");
+      printError("\nTry:");
+      printError("  - olam doctor                    # check service prereqs");
+      printError("  - docker logs olam-mcp-auth      # full logs");
+      printError("  - docker restart olam-mcp-auth   # restart");
       return { exitCode: 1 };
     }
     printSuccess("olam-mcp-auth started");
@@ -24488,6 +24511,10 @@ async function servicesUp() {
         `olam-memory-service started but /agentmemory/livez did not respond within ${MEMORY_SERVICE_HEALTH_TIMEOUT_MS / 1e3}s.`
       );
       dumpContainerLogs("olam-memory-service");
+      printError("\nTry:");
+      printError("  - olam doctor                       # check service prereqs");
+      printError("  - docker logs olam-memory-service   # full logs");
+      printError("  - docker restart olam-memory-service # restart");
       return { exitCode: 1 };
     }
     printSuccess("olam-memory-service started");
@@ -26449,7 +26476,7 @@ ${pc12.dim("Tip: set ANTHROPIC_BASE_URL=" + baseUrl.replace(/\/+$/, "") + "/v1/p
         process.exitCode = 1;
         return;
       }
-      printError("Auth container is not reachable. Run `olam auth up` first.");
+      printError("Auth container is not reachable. Run `olam services up` first.");
       process.exitCode = 1;
       return;
     }
@@ -26865,20 +26892,16 @@ codes are explicit: \`3\` = pull failed, \`4\` = protocol mismatch.
 
 ## Quick start
 
+**Two paths: Kubernetes (default, full-featured) or Docker Compose (lighter, for CI).**
+
+### Kubernetes (recommended)
+
 \`\`\`bash
 curl -fsSL https://olam.bar.dev/install | sh
 olam setup
 \`\`\`
 
-That's it. The installer puts \`@pleri/olam-cli\` on your PATH (requires Node.js \u2265 20 and npm). \`olam setup\` installs k3d (if absent), creates a local Kubernetes cluster named \`olam-dev\`, and brings up the full peripheral stack (host-cp, auth-service, mcp-auth-service, kg-service, memory-service). Works on macOS and Linux. No source checkout required.
-
-The setup wizard is **idempotent** \u2014 re-running skips steps that are already complete.
-
-After setup, every world is one call:
-
-\`\`\`bash
-olam create --name my-world --task "audit the auth module for SSRF"
-\`\`\`
+The installer puts \`@pleri/olam-cli\` on your PATH (requires Node.js \u2265 20 and npm). \`olam setup\` installs k3d (if absent), creates a local Kubernetes cluster named \`olam-dev\`, and brings up the full peripheral stack (host-cp, auth-service, mcp-auth-service, kg-service, memory-service). Works on macOS and Linux. No source checkout required. The setup wizard is **idempotent** \u2014 re-running skips steps that are already complete.
 
 Full setup guide (prereqs, observability, troubleshooting):
 [\`docs/onboarding/k3s-mode-setup.md\`](./docs/onboarding/k3s-mode-setup.md).
@@ -26896,6 +26919,16 @@ This runs three host containers (auth, mcp-auth, kg-service) via docker compose
 
 Full setup guide for compose mode: [\`docs/onboarding/fresh-machine-setup.md\`](./docs/onboarding/fresh-machine-setup.md).
 
+### Create your first world
+
+After setup completes, every world is one call:
+
+\`\`\`bash
+olam create --name my-world --task "audit the auth module for SSRF"
+\`\`\`
+
+Open the dashboard URL in your browser \u2014 you'll see the world provisioning, credentials flowing in from the vault, and your task dispatching to an in-world Claude session.
+
 ---
 
 ## Setup
@@ -27475,6 +27508,7 @@ Source: \`docs/ONBOARDING.md\`
 
 - **Docker daemon** running (Docker Desktop, or colima on macOS)
 - **Node.js \u2265 20** (\`node --version\`)
+- **GitHub CLI authenticated** (\`gh auth login\`) \u2014 \`olam setup\` uses \`gh auth token\` to create a GHCR pull secret; skipping this fails on first image pull
 - **Claude Code** (\`claude --version\`) \u2014 authenticated via \`claude auth login\`
 - **Git** with SSH key configured for your repos
 
@@ -27485,7 +27519,7 @@ Source: \`docs/ONBOARDING.md\`
 No source checkout required \u2014 the CLI publishes to npm:
 
 \`\`\`bash
-curl -fsSL https://olam.bar.dev/install | sh   # installs @pleri/olam-cli on PATH
+curl -fsSL https://olam.bar.dev/install | sh   # installs @pleri/olam-cli on PATH (PLERI is the GitHub org & npm scope)
 olam setup                                       # k3d cluster + full peripheral stack
 \`\`\`
 
@@ -27496,7 +27530,15 @@ mcp-auth-service, kg-service, and memory-service. Pass
 no cluster). Full guide:
 [\`docs/onboarding/k3s-mode-setup.md\`](onboarding/k3s-mode-setup.md).
 
-## 2. Register the MCP server (1 minute)
+## 2. Verify your setup (1 minute)
+
+\`\`\`bash
+olam doctor      # runs 8\u201323 checks: auth, services, vault, network
+\`\`\`
+
+This diagnoses common issues (Docker daemon, images, credentials, etc.). Any FAIL row shows an actionable remedy \u2014 fix and re-run until all rows PASS.
+
+## 3. Register the MCP server (1 minute)
 
 \`\`\`bash
 olam mcp install                  # default --scope=user
@@ -27509,7 +27551,7 @@ worlds directly. Core tools: \`olam_create\`, \`olam_dispatch\`,
 \`olam_enter\`, \`olam_crystallize\`, \`olam_pr_*\`. Restart Claude Code and
 verify with \`claude mcp list\` (look for \`olam\`).
 
-## 3. Configure your repos (2 minutes)
+## 4. Configure your repos (2 minutes)
 
 Point Olam at the repos a world should clone. Use the interactive
 wizard:
@@ -27524,7 +27566,7 @@ world-runner tier (\`docker\` | \`cloudflare\` | \`cloudflare-isolate\`). See
 [\`docs/architecture/config-spec.md\`](architecture/config-spec.md) for
 the full schema.
 
-## 4. Create your first world (2 minutes)
+## 5. Create your first world (2 minutes)
 
 In Claude Code, say:
 
@@ -27536,9 +27578,9 @@ Claude will:
 1. Create a Docker container (or CF Sandbox) with your repo cloned
 2. Set up git worktrees for isolation
 3. Boot the in-world Claude session and auto-dispatch the task
-4. Return the Host CP dashboard URL (\`http://127.0.0.1:19000\`)
+4. Return the Host CP dashboard URL (\`http://127.0.0.1:19001\`)
 
-## 5. Dispatch a task (1 minute)
+## 6. Dispatch a task (1 minute)
 
 \`\`\`
 Dispatch to the world: investigate and fix the session timeout issue
@@ -27546,7 +27588,7 @@ Dispatch to the world: investigate and fix the session timeout issue
 
 Claude Code runs autonomously inside the world. Every tool call, every decision, every exploration is captured as a thought node.
 
-## 6. Watch it work (ongoing)
+## 7. Watch it work (ongoing)
 
 **Dashboard:** Open the Host CP URL from step 4. You'll see:
 - the **seed of thought** pinned at the top (the immutable task)
@@ -27561,7 +27603,7 @@ Claude Code runs autonomously inside the world. Every tool call, every decision,
 What is the world thinking right now?
 \`\`\`
 
-## 7. Clean up
+## 8. Clean up
 
 \`\`\`
 Crystallize and destroy the world
@@ -27583,7 +27625,7 @@ after \`olam setup\`):
 \`\`\`bash
 olam create --name login-fix --repos my-project --task "Fix session timeout"
 olam dispatch login-fix "investigate and fix the session timeout"
-olam observe login-fix             # placeholder; for now attach via the world terminal
+olam observe login-fix             # Alternative: \`olam enter login-fix\` for a shell inside the world (until \`olam observe\` ships)
 olam status login-fix
 olam crystallize login-fix         # requires PLERI; otherwise no-op (exit 2)
 olam destroy login-fix             # accepts the world ID or name
@@ -27621,11 +27663,38 @@ refresh token never leaves the service.
 
 | Problem | Fix |
 |---------|-----|
+| Something not working | Run \`olam doctor\` \u2014 it diagnoses the setup and shows remedies for each issue |
 | "Docker not running" | Start Docker Desktop |
 | "No Claude credentials" | Run \`claude auth login\` on the host |
+| "GHCR pull secret failed" or "401 unauthorized" on first \`olam setup\` | Run \`gh auth login\` and verify with \`gh auth status\` |
 | Dashboard shows empty | Wait for the first dispatch to generate thoughts |
 | "Port already in use" | Another world is running. Use \`olam list\` to check |
 | Session seems stuck | Use \`olam enter <world>\` to open the terminal and check |
+| **Blank white page at \`localhost:19001\`** | SPA dist not built. Run \`cd packages/host-cp && npm run build:spa\` from the repo root (or just \`npm start\` \u2014 the \`prestart\` hook does it automatically). |
+| Cloud toggle missing in SPA | Both \`OLAM_CLOUD_URL\` and \`OLAM_SHOWCASE_PASSWORD\` must be set. If only one is set the server logs a \`[cloud]\` warning at startup. |
+
+## Bare-node / source-checkout mode
+
+If you are running host-cp directly from source (not via \`olam setup\`
+or a pulled Docker image), you need to build the SPA before first boot:
+
+\`\`\`bash
+# From the repo root:
+cd packages/host-cp
+npm run build:spa   # builds plan-chat-spa and stages it into packages/host-cp/dist/
+npm start           # prestart hook runs check:spa first; rebuilds if dist is stale
+\`\`\`
+
+\`npm start\` runs \`check:spa\` first. If \`dist/\` is already populated and
+self-consistent (every asset in \`index.html\` is present on disk) it skips
+the build and starts immediately. If not, it calls \`build:spa\` to rebuild.
+
+The \`build:spa\` script triggers a full \`npm run build:ci\` + \`vite build\`
+chain on a cold checkout (takes ~60s the first time; subsequent runs skip
+the vite build if \`packages/plan-chat-spa/dist/client/\` is already populated).
+
+**This is not required when using \`olam setup\`** \u2014 the Docker image has the
+SPA baked in and host-cp never touches the local \`dist/\` directory.
 
 ## Architecture
 
@@ -27780,16 +27849,18 @@ olam skills source list
 
 ---
 
-## 5. Start the memory-bridge
+## 5. Start the memory service (Docker container)
 
-The memory-bridge is a host process that serves \`127.0.0.1:3111/agentmemory/livez\`. When it's running, \`olam skills sync\` will inject the olam-meta-memory-recall + olam-meta-memory-classify hook blocks into \`~/.claude/settings.json\`. When it's NOT running, the strip half of the auto-migration still fires but no olam-meta blocks land \u2014 meaning operator gets no recall/classify behavior.
+The memory-service is a Docker container (managed by \`olam services\`) that serves \`127.0.0.1:3111/agentmemory/livez\`. When it's running, \`olam skills sync\` will inject the olam-meta-memory-recall + olam-meta-memory-classify hook blocks into \`~/.claude/settings.json\`. When it's NOT running, the strip half of the auto-migration still fires but no olam-meta blocks land \u2014 meaning operator gets no recall/classify behavior.
 
 \`\`\`bash
 olam memory secret                # \u2192 shows the bearer at ~/.olam/memory-secret (auto-generated on first run)
-olam memory start                 # \u2192 starts the host process; polls livez until ready
-olam memory status                # \u2192 pid + livez + secret-set check
+olam memory start                 # \u2192 starts the olam-memory-service container; polls livez until ready
+olam memory status                # \u2192 container state + livez + secret-set check
 \`\`\`
 
+**Note:** \`~/.olam/memory-secret\` is used with the Docker Compose substrate (this guide). For Kubernetes, the file is \`~/.olam/memory-bearer-secret\`. They are the same logical service in different deployment substrates.
+
 Sanity check the live probe:
 
 \`\`\`bash
@@ -27917,6 +27988,7 @@ If the recall hook doesn't fire, run \`olam memory status\` to confirm the bridg
 ## What's NOT in this doc
 
 - Setting up Cloudflare-substrate worlds (separate doc: \`docs/architecture/cf-worlds-spec.md\`).
+- **Cloud-mode (optional)**: if you want dispatches to run on Cloudflare Sandboxes instead of local Docker, follow [plan-cloud-mode-setup.md](../runbooks/plan-cloud-mode-setup.md) to set \`OLAM_CLOUD_URL\` + \`OLAM_SHOWCASE_PASSWORD\` on host-cp.
 - PLERI thought-graph integration (separate setup; skip-pleri is fine for most operators).
 - Per-project skill overrides (advanced; see Phase B B2 + \`docs/architecture/skill-source-contract.md\`).
 - Cutting an olam release (developer flow, not operator flow; see \`~/.claude/skills/olam-cut-release/SKILL.md\`).
@@ -27943,6 +28015,345 @@ npm uninstall -g @pleri/olam-cli
 
 ---
 
+## Setup \u2014 k3d/k3s mode (default substrate, port 19001)
+
+Source: \`docs/onboarding/k3s-mode-setup.md\`
+
+# Olam in k3d mode \u2014 definitive setup guide
+
+> **Audience**: an operator setting up olam on their workstation. k3d mode runs olam's full peripheral stack (host-cp, auth-service, mcp-auth-service, kg-service, memory-service) as a real Kubernetes deployment on a local k3d cluster, with Prometheus + Grafana + Loki + Kyverno for observability.
+>
+> **End state**: a local k3d cluster \`olam-dev\`, five peripheral pods at \`1/1 Running\` in the \`olam\` namespace, a \`monitoring\` namespace with kube-prometheus-stack + Grafana, the \`olam\` CLI talking to host-cp inside the cluster.
+>
+> **Time**: ~5 minutes warm, ~10 minutes cold (image pulls).
+>
+> **k3d on all platforms**: olam uses k3d (k3s wrapped in Docker) on both macOS and Linux. No sudo needed \u2014 k3d only requires a Docker daemon. Same substrate, same mental model, same teardown on every machine.
+
+k3d is the **default mode** for olam. For the lighter docker-compose mode (3 containers, no cluster), see [fresh-machine-setup.md](fresh-machine-setup.md).
+
+---
+
+## 0. Prerequisites
+
+You need these tools installed. \`olam setup\` will prompt to install missing brew-formulae for you on macOS (answer y); on Linux it uses the upstream k3d install script (no sudo needed). Pass \`-y\` to skip all prompts.
+
+| Tool | Why | Install |
+|---|---|---|
+| **Node.js \u2265 20** | The olam CLI runs on Node | \`nvm install 20\` |
+| **Docker daemon** | k3d runs k3s nodes as Docker containers (required on all platforms) | Docker Desktop (macOS/Windows) or \`sudo apt install docker.io\` (Linux); colima works too |
+| **colima** (macOS, optional) | Lightweight Docker runtime for macOS | \`brew install colima && colima start --cpu 4 --memory 8 --vm-type=vz --mount-type=virtiofs\` |
+| **k3d** | Wraps k3s in Docker for local clusters \u2014 works on macOS and Linux, no sudo | \`brew install k3d\` (macOS/Linux with brew) or \`curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh \\| bash\` |
+| **kubectl** | Cluster operations | \`brew install kubectl\` |
+| **helm** | Installs Loki + Promtail + Grafana + Prometheus + Kyverno | \`brew install helm\` |
+| **gh** | ghcr-pull secret + \`gh auth token\` | \`brew install gh && gh auth login\` |
+| **docker** + \`docker compose\` plugin | Hosts the docker-socket-proxy sibling container | Docker Desktop, or colima ships it |
+| **jq, curl, openssl** | Shell helpers | macOS defaults |
+| **Claude Code subscription** | The \`claude\` CLI inside each world consumes your local subscription | \`npm install -g @anthropic-ai/claude-code\` |
+
+---
+
+## 1. Install the olam CLI
+
+\`\`\`bash
+# One-line installer (recommended)
+curl -fsSL https://olam.bar.dev/install | sh
+
+# Or via npm directly
+npm install -g @pleri/olam-cli
+\`\`\`
+
+Verify:
+
+\`\`\`bash
+olam --version
+\`\`\`
+
+The CLI ships every manifest, secret template, and observability install script it needs inside the npm tarball \u2014 no \`git clone\` required.
+
+---
+
+## 2. Authenticate \`gh\`
+
+\`\`\`bash
+gh auth login
+\`\`\`
+
+The bootstrap creates a \`ghcr-pull\` Kubernetes Secret from \`gh auth token\` so pulls of \`ghcr.io/pleri/olam-*\` images don't hit anonymous rate limits.
+
+---
+
+## 3. Bootstrap
+
+Single command, end-to-end:
+
+\`\`\`bash
+olam setup
+\`\`\`
+
+Pass \`-y\` to skip all prompts (non-interactive, auto-affirm every step):
+
+\`\`\`bash
+olam setup -y
+\`\`\`
+
+The command is **idempotent** \u2014 re-running against an existing cluster only does work for incomplete steps. It runs five ordered phases:
+
+| # | Phase | What it does |
+|---|---|---|
+| 0 | **Preflight** | Detects missing tools and prints actionable install commands. Verifies \`gh\` is authenticated and the docker daemon is reachable. |
+| 1 | **Secrets** | Generates \`~/.olam/{auth-secret,kg-bearer-token,auth-db-secret,mcp-auth-jwt-secret,memory-bearer-secret}\` if absent (32-byte hex, mode 0600). |
+| 2 | **Colima** (macOS only) | Ensures colima is running; if not, starts it with sensible defaults. Applies \`chmod 666 /var/run/docker.sock\` inside the colima VM (virtiofs mitigation). |
+| 3 | **Cluster** | \`k3d cluster create olam-dev\` with the gh-config bind. Skipped if cluster exists. (Override the name with \`--cluster-name\`.) |
+| 4 | **Observability** | Chains the bundled install scripts: Loki + Promtail, Grafana with port-forward + admin secret, kube-prometheus-stack with recording rules, Kyverno admission policy. |
+| 5 | **Apply manifests + rollout** | Delegates to the existing \`olam upgrade\` flow: namespace, RBAC, secrets, ghcr-pull, host-side docker-socket-proxy, manifest apply, rollout status (per-deployment, 90s timeout), port-forward, \`/health\` verify, audit log. |
+
+Flag reference:
+
+\`\`\`bash
+olam setup --help
+\`\`\`
+
+Common overrides:
+
+- \`-y, --yes\` \u2014 auto-affirm every prompt (non-interactive).
+- \`--substrate <docker|kubernetes>\` \u2014 force a substrate instead of auto-detecting.
+- \`--cluster-name <name>\` \u2014 k3d cluster name to create/use (default: \`olam-dev\`).
+- \`--reuse-cluster <name>\` \u2014 reuse an existing reachable kube context instead of provisioning.
+- \`--skip-cluster-create\` \u2014 cluster already exists; skip cluster provisioning.
+- \`--skip-doctor\` \u2014 skip final health check (useful in CI).
+
+---
+
+## 4. Verify the cluster is healthy
+
+\`\`\`bash
+kubectl get pods -n olam
+\`\`\`
+
+Expected \u2014 all five \`1/1 Running\`:
+
+\`\`\`
+NAME                                     READY   STATUS    RESTARTS   AGE
+olam-auth-service-...                    1/1     Running   0          ~5m
+olam-host-cp-...                         1/1     Running   0          ~5m
+olam-kg-service-...                      1/1     Running   0          ~5m
+olam-mcp-auth-service-...                1/1     Running   0          ~5m
+olam-memory-service-...                  1/1     Running   0          ~5m
+\`\`\`
+
+If something's off:
+
+\`\`\`bash
+olam doctor                       # checks substrate, cluster, pods, secrets
+olam services status              # k8s-aware status table
+\`\`\`
+
+---
+
+## 5. Open Grafana
+
+\`\`\`bash
+kubectl port-forward -n monitoring svc/olam-grafana 3000:80
+open http://localhost:3000
+\`\`\`
+
+User \`admin\`, password from:
+
+\`\`\`bash
+kubectl get secret olam-grafana-admin -n monitoring \\
+  -o jsonpath='{.data.admin-password}' | base64 -d
+\`\`\`
+
+Pre-installed dashboards (under "Olam"):
+
+- **olam-home** \u2014 at-a-glance status across all peripherals.
+- **host-cp** \u2014 request rate, p50/p95/p99 latency, world counts.
+- **kg-service** \u2014 classifier hit rate, classify latency, hook traffic.
+- **request-rate** \u2014 per-route HTTP request rate (uses recording rule \`olam:http_requests:rate5m_by_service_route\`).
+
+---
+
+## 6. Day-to-day operations
+
+\`\`\`bash
+olam doctor                       # health check across substrate
+olam services status              # peripherals status table (k8s-aware)
+olam services restart <name>      # kubectl rollout restart for one peripheral
+olam services down                # scale all peripherals to 0 replicas
+olam services up                  # scale them back to 1
+\`\`\`
+
+To pick up a new release after \`npm install -g @pleri/olam-cli@latest\`:
+
+\`\`\`bash
+olam upgrade
+\`\`\`
+
+The upgrade flow re-applies all manifests (Kubernetes rolls the deployments to the new image digests); persistent volumes survive.
+
+---
+
+## 7. Tear down
+
+\`\`\`bash
+olam implode --dry-run            # preview what will be removed
+olam implode                      # confirmed: cluster + secrets + state
+\`\`\`
+
+\`olam implode\` removes the k3d cluster, the host-side docker-socket-proxy sibling, every container, every secret in \`~/.olam/\`, and the global config. Use it when you want to start completely fresh; otherwise prefer \`olam services down\` or scale to 0.
+
+---
+
+## Choosing compose mode instead
+
+To use the lighter 3-container compose path instead:
+
+\`\`\`bash
+curl -fsSL https://olam.bar.dev/install | sh
+olam setup --substrate=docker
+\`\`\`
+
+The CLI is substrate-aware: \`olam setup\`, \`olam services up|down|status|restart\`, \`olam upgrade\`, and \`olam doctor\` all route to the correct backend based on \`~/.olam/config.json\`'s \`host.substrate\` value.
+
+Full compose guide: [\`fresh-machine-setup.md\`](./fresh-machine-setup.md).
+
+---
+
+## Architecture quick-ref
+
+\`\`\`
+                    \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+                    \u2502   operator's machine    \u2502
+                    \u2502                         \u2502
+                    \u2502  ~/.olam/*-secret  \u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u25B6 Kubernetes Secrets
+                    \u2502  ~/.config/gh      \u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u25B6 k3d --volume bind
+                    \u2502                         \u2502
+                    \u2502  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510    \u2502
+                    \u2502  \u2502 docker daemon   \u2502    \u2502
+                    \u2502  \u2502                 \u2502    \u2502
+                    \u2502  \u2502  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510   \u2502    \u2502
+                    \u2502  \u2502  \u2502 k3d node \u2502   \u2502    \u2502     \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+                    \u2502  \u2502  \u2502  cluster \u2502\u25C0\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2502  ghcr.io/pleri/olam-*   \u2502
+                    \u2502  \u2502  \u2502 olam-dev \u2502   \u2502    \u2502     \u2502  (pulled with gh token) \u2502
+                    \u2502  \u2502  \u2514\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2518   \u2502    \u2502     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+                    \u2502  \u2502       \u2502 TCP     \u2502    \u2502
+                    \u2502  \u2502       \u25BC :2375   \u2502    \u2502
+                    \u2502  \u2502  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2510   \u2502
+                    \u2502  \u2502  \u2502 docker-socket \u2502   \u2502
+                    \u2502  \u2502  \u2502     proxy     \u2502   \u2502
+                    \u2502  \u2502  \u2502 (sibling      \u2502   \u2502
+                    \u2502  \u2502  \u2502  container)   \u2502   \u2502
+                    \u2502  \u2502  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518   \u2502
+                    \u2502  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+                    \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+                                  \u2502
+                                  \u25BC k3d nodes via host.k3d.internal:2375
+                          \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+                          \u2502           cluster: olam-dev          \u2502
+                          \u2502                                      \u2502
+                          \u2502  namespace: olam                     \u2502
+                          \u2502    olam-host-cp        (1/1 Running) \u2502
+                          \u2502    olam-auth-service   (1/1 Running) \u2502
+                          \u2502    olam-mcp-auth-svc   (1/1 Running) \u2502
+                          \u2502    olam-kg-service     (1/1 Running) \u2502
+                          \u2502    olam-memory-service (1/1 Running) \u2502
+                          \u2502                                      \u2502
+                          \u2502  namespace: monitoring               \u2502
+                          \u2502    olam-grafana                      \u2502
+                          \u2502    prometheus-operated               \u2502
+                          \u2502    loki + promtail                   \u2502
+                          \u2502    kyverno (admission)               \u2502
+                          \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+\`\`\`
+
+Why the sibling docker-socket-proxy? On macOS, colima exposes \`/var/run/docker.sock\` via virtiofs, which blocks unix-socket bind-mounts into k3d pods. The proxy runs as a normal Docker container on the operator's daemon and exposes the same socket over TCP \`:2375\`. Pods reach it through an ExternalName Service. See [\`docs/test-reports/olam-k3d-on-mac-substrate-decision-eli5.md\`](../test-reports/olam-k3d-on-mac-substrate-decision-eli5.md).
+
+---
+
+## Common issues
+
+| Symptom | Fix |
+|---|---|
+| \`colima not running\` | \`colima start --cpu 4 --memory 8 --vm-type=vz --mount-type=virtiofs\` |
+| \`permission denied\` on docker socket | \`colima ssh -- sudo chmod 666 /var/run/docker.sock\` |
+| Missing tool errors at preflight | Install manually per the prereq table, then re-run \`olam setup\` |
+| \`helm install\` timeout during observability bootstrap | Set \`OLAM_HELM_TIMEOUT=600s\` (or higher on loaded machines). See [Tuning](#tuning-helm-timeouts-on-resource-constrained-machines) for details. |
+| \`host-cp\` \`CrashLoopBackOff\` with \`inClusterContext is not in the allowlist\` | Image pre-dates v0.1.161 \u2014 \`npm install -g @pleri/olam-cli@latest && olam upgrade\` |
+| \`memory-service\` \`CrashLoopBackOff\` with \`port 3111 is already in use\` | Image pre-dates v0.1.163 \u2014 \`npm install -g @pleri/olam-cli@latest && olam upgrade\` |
+| \`imagePullBackOff\` from \`ghcr.io/pleri/olam-*\` | The bootstrap creates \`ghcr-pull\` from \`gh auth token\`; re-run \`olam setup\` after \`gh auth login\` |
+| Grafana dashboards missing | \`kubectl rollout restart deploy/olam-grafana -n monitoring\` |
+| host-cp can't reach docker | \`docker ps \\| grep docker-socket-proxy\` \u2014 restart with \`olam setup --skip-cluster-create\` to re-run only the proxy + manifest-apply steps |
+| \`helm install\` fails with \`Error: context deadline exceeded\` during observability bootstrap (grafana / loki / kube-prometheus-stack / kyverno) | The Colima VM is sharing CPU/memory with too many other containers. Bump the helm timeout via \`OLAM_HELM_TIMEOUT=900s olam setup\` (default is \`600s\`). On very loaded machines, \`1200s\` is reasonable. Applies to every \`helm install\` step in the observability chain. |
+
+### Tuning helm timeouts on resource-constrained machines
+
+Every observability \`helm install\` (grafana, loki, promtail, kube-prometheus-stack, kyverno) reads \`OLAM_HELM_TIMEOUT\` (default \`600s\`). When the Colima VM is sharing resources with a heavy local workload, charts can take longer than the default to converge \u2014 bump the env var instead of editing scripts:
+
+\`\`\`bash
+OLAM_HELM_TIMEOUT=900s olam setup           # bootstrap with longer timeout
+OLAM_HELM_TIMEOUT=1200s olam setup          # very loaded machines
+\`\`\`
+
+CI Linux runners run unmodified at \`600s\` (dedicated resources). The knob exists for macOS-Colima hosts that share a VM with other docker workloads.
+
+### Tuning Prometheus scrape/discovery waits
+
+The Phase C E2E scripts in \`scripts/e2e/\` poll Prometheus for synthetic-target discovery (\`TARGET_DISCOVERY_TIMEOUT\`, default 240s \u2014 \`cardinality-drop.sh\`, \`kyverno-cardinality-mutate.sh\`, \`dashboards-have-data.sh\`) and then sleep for recording-rule evaluation (\`SCRAPE_WAIT\`, default 70s \u2014 \`dashboards-have-data.sh\`). Both default values cover \u22652 rule-evaluation cycles at the 30s rule interval against a 15s scrape interval. Override on very slow runners:
+
+\`\`\`bash
+OLAM_PROM_DISCOVERY_TIMEOUT=300 OLAM_PROM_SCRAPE_WAIT=120 npm run test:ingress-integration
+\`\`\`
+
+### Troubleshooting port-forwards
+
+**Problem:** connections to a port-forward (e.g. \`localhost:19001\` for host-cp, \`localhost:3000\` for Grafana) suddenly fail with "connection refused".
+
+**Why:** kubectl port-forwards die when:
+- The terminal that started them exits
+- k3d restarts or the cluster reboots
+- The underlying pod crashes or is redeployed
+- The local kube context changes
+
+**Diagnose:**
+\`\`\`bash
+ps aux | grep "kubectl port-forward"
+\`\`\`
+
+If nothing shows up, the port-forward is dead and needs to be re-established.
+
+**Fix:**
+
+Option 1 \u2014 re-establish all port-forwards at once:
+\`\`\`bash
+olam services up
+\`\`\`
+
+Option 2 \u2014 manually restart the port-forward (canonical command from the setup doc):
+\`\`\`bash
+kubectl port-forward -n olam svc/host-cp 19001:19001
+\`\`\`
+
+Use \`olam services status\` to see which services are running and which port each binds to locally.
+
+When everything else fails, tear down and re-create:
+
+\`\`\`bash
+olam implode
+olam setup
+\`\`\`
+
+\`olam implode\` removes everything; \`olam setup\` re-creates from scratch.
+
+---
+
+## What to read next
+
+- \`olam --help\`, \`olam setup --help\` \u2014 the canonical CLI surface.
+- [\`docs/architecture/peripheral-services-on-k3s.md\`](../architecture/peripheral-services-on-k3s.md) \u2014 design doc for the k3s peripheral architecture.
+- [\`docs/test-reports/olam-k3d-on-mac-substrate-decision-eli5.md\`](../test-reports/olam-k3d-on-mac-substrate-decision-eli5.md) \u2014 why the docker-socket-proxy sits where it sits.
+
+---
+
 ## Architecture \u2014 the problem olam solves
 
 Source: \`docs/architecture/01-problem.md\`
@@ -29691,6 +30102,11 @@ function registerCreate(program2) {
       if (resolvedTask) {
         printInfo("Task", resolvedTask);
       }
+      if (!opts.json) {
+        console.log(`
+${pc14.cyan("Dashboard:")} ${HOST_CP_URL}/plan/${encodeURIComponent(world.id)}`);
+        console.log(`${pc14.cyan("Enter world:")} ${pc14.dim(`olam enter ${world.name}`)}`);
+      }
       if (world.credentialsInjected?.claude) {
         console.log(`
 ${pc14.green("Credentials injected. World is ready for dispatch.")}`);
@@ -30208,6 +30624,7 @@ import * as fs40 from "node:fs";
 import * as http3 from "node:http";
 import * as os22 from "node:os";
 import * as path42 from "node:path";
+import pc18 from "picocolors";
 var CLI_VERSION2 = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
 var HOST_CP_PORT2 = 19e3;
 var STATE_ENUM = [
@@ -30334,6 +30751,9 @@ function registerStatus(program2) {
       printHeader("Olam Status");
       printInfo("CLI version", `@pleri/olam-cli@${ms.version}`);
       printInfo("Host CP", ms.host_cp === "running" ? `running on port ${ms.port}` : "stopped");
+      if (ms.host_cp === "stopped") {
+        console.log(pc18.dim("  \u2192 run `olam doctor` to diagnose"));
+      }
       printInfo("Worlds", String(ms.worlds));
       printInfo("Token", ms.token_present ? "present" : "absent");
       if (ms.last_update_check) {
@@ -30404,7 +30824,7 @@ init_context();
 init_output();
 init_host_cp();
 import ora7 from "ora";
-import pc18 from "picocolors";
+import pc19 from "picocolors";
 async function runDestroy(worldArg, opts, deps) {
   const worlds = deps.listWorlds();
   const world = resolveWorld(worlds, worldArg);
@@ -30412,12 +30832,12 @@ async function runDestroy(worldArg, opts, deps) {
     deps.stderr(`World "${worldArg}" not found.`);
     const suggestions = suggestWorlds(worlds, worldArg);
     if (suggestions.length > 0) {
-      deps.stdout(pc18.dim("\n  Did you mean:"));
+      deps.stdout(pc19.dim("\n  Did you mean:"));
       for (const s of suggestions) {
-        deps.stdout(`    ${pc18.bold(s.name)} ${pc18.dim(`(${s.id})`)}  ${pc18.dim(s.status)}`);
+        deps.stdout(`    ${pc19.bold(s.name)} ${pc19.dim(`(${s.id})`)}  ${pc19.dim(s.status)}`);
       }
     }
-    deps.stdout(pc18.dim("\n  Run `olam list` to see all worlds."));
+    deps.stdout(pc19.dim("\n  Run `olam list` to see all worlds."));
     return 1;
   }
   const worldId = world.id;
@@ -30796,7 +31216,7 @@ import * as fs42 from "node:fs";
 import * as os24 from "node:os";
 import * as path44 from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
-import pc19 from "picocolors";
+import pc20 from "picocolors";
 var NPM_PACKAGE = "@pleri/olam-cli";
 var realExec = (cmd, args) => {
   try {
@@ -30953,7 +31373,7 @@ function renderSurvey(survey, opts) {
   const dirtyWorlds = survey.worlds.filter((w) => w.dirty);
   const cleanWorlds = survey.worlds.filter((w) => !w.dirty);
   const worldBytes = survey.worlds.reduce((acc, w) => acc + w.bytes, 0);
-  lines.push(pc19.bold(pc19.red("\u2014 olam implode survey \u2014")));
+  lines.push(pc20.bold(pc20.red("\u2014 olam implode survey \u2014")));
   lines.push("");
   lines.push(`  containers (olam-*):   ${survey.containers.length}`);
   lines.push(`  images:                ${survey.images.length}`);
@@ -30969,13 +31389,13 @@ function renderSurvey(survey, opts) {
   );
   if (dirtyWorlds.length > 0) {
     lines.push("");
-    lines.push(pc19.yellow(`  \u26A0 dirty worlds (${dirtyWorlds.length}) \u2014 pass --include-dirty to destroy:`));
+    lines.push(pc20.yellow(`  \u26A0 dirty worlds (${dirtyWorlds.length}) \u2014 pass --include-dirty to destroy:`));
     for (const w of dirtyWorlds) {
       lines.push(`    - ${w.id}  ${formatBytes3(w.bytes)}  (${w.note})`);
     }
   }
   lines.push("");
-  lines.push(pc19.dim("  Run with --yes to actually destroy. Default is dry-run."));
+  lines.push(pc20.dim("  Run with --yes to actually destroy. Default is dry-run."));
   return lines.join("\n");
 }
 function formatBytes3(n) {
@@ -31150,11 +31570,11 @@ async function runImplode(opts) {
   process.stdout.write("\n");
   process.stdout.write(`To reinstall a fresh copy:
 `);
-  process.stdout.write(`  ${pc19.cyan(`npm install -g ${NPM_PACKAGE}`)}
+  process.stdout.write(`  ${pc20.cyan(`npm install -g ${NPM_PACKAGE}`)}
 `);
-  process.stdout.write(`  ${pc19.cyan("olam init")}
+  process.stdout.write(`  ${pc20.cyan("olam init")}
 `);
-  process.stdout.write(`  ${pc19.cyan("olam auth login")}
+  process.stdout.write(`  ${pc20.cyan("olam auth login")}
 `);
   return result.errors.length > 0 ? 1 : 0;
 }
@@ -31163,7 +31583,7 @@ async function runImplode(opts) {
 init_context();
 init_output();
 import { execSync as execSync9 } from "node:child_process";
-import pc20 from "picocolors";
+import pc21 from "picocolors";
 var SAFE_IDENT3 = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function buildStartClaudeCommands(containerName, sessionName, task) {
   if (!SAFE_IDENT3.test(containerName)) {
@@ -31227,7 +31647,7 @@ function registerEnter(program2) {
       checkVersionPin2(worldId, worldMeta.workspacePath);
       if (worldMeta.claudeHome) {
         console.log(
-          pc20.dim(`# claude-home: ${worldMeta.claudeHome} (per-world Claude Code instance, ADR 045)`)
+          pc21.dim(`# claude-home: ${worldMeta.claudeHome} (per-world Claude Code instance, ADR 045)`)
         );
       }
     }
@@ -31275,7 +31695,7 @@ function registerEnter(program2) {
       }
       console.log("Run these commands in order to enter the world:\n");
       for (const step2 of steps) {
-        console.log(`  ${pc20.dim(`# ${step2.description}`)}`);
+        console.log(`  ${pc21.dim(`# ${step2.description}`)}`);
         if (step2.stdin !== void 0) {
           const escaped = step2.stdin.replace(/'/g, "'\\''");
           console.log(`  printf '%s' '${escaped}' | ${step2.command}`);
@@ -31309,11 +31729,11 @@ function registerEnter(program2) {
       return;
     }
     console.log("Run this command to enter the world:\n");
-    console.log(`  ${pc20.bold(result.command)}`);
+    console.log(`  ${pc21.bold(result.command)}`);
     const containerName = `olam-${worldId}-devbox`;
     console.log(
       `
-${pc20.dim(`Observe dispatch: docker exec -it ${containerName} tmux attach -t olam-dispatch -r`)}`
+${pc21.dim(`Observe dispatch: docker exec -it ${containerName} tmux attach -t olam-dispatch -r`)}`
     );
   });
 }
@@ -31557,7 +31977,7 @@ function registerCrystallize(program2, options = {}) {
 
 // src/commands/pr.ts
 init_registry();
-import pc21 from "picocolors";
+import pc22 from "picocolors";
 
 // ../core/dist/pr-gate/client.js
 var HOST_CONTROL_PLANE_BASE2 = 19080;
@@ -31638,26 +32058,26 @@ async function findGate(id) {
   return null;
 }
 function formatStateBadge(state) {
-  if (state === "approve") return pc21.green("approve");
-  if (state === "block") return pc21.red("block");
-  if (state === "denied") return pc21.gray("denied");
-  return pc21.yellow("pending");
+  if (state === "approve") return pc22.green("approve");
+  if (state === "block") return pc22.red("block");
+  if (state === "denied") return pc22.gray("denied");
+  return pc22.yellow("pending");
 }
 function registerPr(program2) {
   const pr = program2.command("pr").description("Review and decide PR-gate requests from running worlds");
   pr.command("list").description("List all PR-gate requests across every running world").action(async () => {
     const all = await fanoutList();
     if (all.length === 0) {
-      console.log(pc21.dim("No gates open."));
+      console.log(pc22.dim("No gates open."));
       return;
     }
     printHeader(`${all.length} gate(s)`);
     for (const { world, gate } of all) {
       const badge = formatStateBadge(gate.state);
       console.log(
-        `  ${pc21.bold(gate.id.slice(0, 8))} ${badge.padEnd(20)} ${pc21.dim(world.name)} ${pc21.dim(gate.branch)}`
+        `  ${pc22.bold(gate.id.slice(0, 8))} ${badge.padEnd(20)} ${pc22.dim(world.name)} ${pc22.dim(gate.branch)}`
       );
-      console.log(`    ${pc21.dim(gate.command.slice(0, 100))}`);
+      console.log(`    ${pc22.dim(gate.command.slice(0, 100))}`);
     }
   });
   pr.command("show").description("Show full gate detail (diff, command, commits)").argument("<id>", "Gate id (prefix match ok)").action(async (id) => {
@@ -31680,9 +32100,9 @@ function registerPr(program2) {
       if (gate.reason) printInfo("Reason", gate.reason);
     }
     printHeader("Commits");
-    console.log(gate.commitLog || pc21.dim("  (empty)"));
+    console.log(gate.commitLog || pc22.dim("  (empty)"));
     printHeader("Diff stat");
-    console.log(gate.diffStat || pc21.dim("  (empty)"));
+    console.log(gate.diffStat || pc22.dim("  (empty)"));
   });
   function decideCommand(verb, decision) {
     pr.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} a pending gate`).argument("<id>", "Gate id").option("--reason <reason>", "Short free-text reason").option("--by <name>", "Deciding identity (defaults to $USER)", process.env["USER"] ?? "human").action(async (id, opts) => {
@@ -32135,7 +32555,7 @@ function registerLanes(program2) {
 // src/commands/policy-check.ts
 init_loader2();
 import { execSync as execSync10 } from "node:child_process";
-import pc22 from "picocolors";
+import pc23 from "picocolors";
 
 // ../../node_modules/balanced-match/dist/esm/index.js
 var balanced = (a, b, str) => {
@@ -33995,7 +34415,7 @@ function registerPolicyCheck(program2) {
     const workspaceRoot = opts.workspace ?? process.cwd();
     const policies = loadPolicies(workspaceRoot);
     if (policies.length === 0) {
-      console.log(pc22.dim("policy-check: no policies found in .olam/policies/ \u2014 nothing to enforce"));
+      console.log(pc23.dim("policy-check: no policies found in .olam/policies/ \u2014 nothing to enforce"));
       return;
     }
     const diff = getDiff(opts.base, workspaceRoot);
@@ -34004,11 +34424,11 @@ function registerPolicyCheck(program2) {
     for (const result of results) {
       if (result.passed) continue;
       if (result.severity === "error") {
-        console.error(`${pc22.red("policy error")} [${result.policyId}]`);
+        console.error(`${pc23.red("policy error")} [${result.policyId}]`);
         console.error(result.message);
         hasErrorFailure = true;
       } else {
-        console.warn(`${pc22.yellow("policy warn")} [${result.policyId}]`);
+        console.warn(`${pc23.yellow("policy warn")} [${result.policyId}]`);
         console.warn(result.message);
       }
     }
@@ -34019,7 +34439,7 @@ function registerPolicyCheck(program2) {
 }
 
 // src/commands/worldspec/compile.ts
-import { existsSync as existsSync46, mkdirSync as mkdirSync29, readFileSync as readFileSync37, writeFileSync as writeFileSync23 } from "node:fs";
+import { existsSync as existsSync46, mkdirSync as mkdirSync29, readFileSync as readFileSync37, writeFileSync as writeFileSync24 } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 import YAML5 from "yaml";
 
@@ -34885,12 +35305,12 @@ Resolutions:
       const outDir = resolvePath(process.cwd(), opts.out);
       try {
         mkdirSync29(outDir, { recursive: true });
-        writeFileSync23(
+        writeFileSync24(
           resolvePath(outDir, "execution-graph.json"),
           graphJson,
           "utf8"
         );
-        writeFileSync23(
+        writeFileSync24(
           resolvePath(outDir, "lockfile.json"),
           lockfileJson,
           "utf8"
@@ -34913,7 +35333,7 @@ function getPkgVersion() {
 // src/commands/worldspec/init.ts
 init_exit_codes();
 init_output();
-import { existsSync as existsSync47, mkdirSync as mkdirSync30, readFileSync as readFileSync38, writeFileSync as writeFileSync24 } from "node:fs";
+import { existsSync as existsSync47, mkdirSync as mkdirSync30, readFileSync as readFileSync38, writeFileSync as writeFileSync25 } from "node:fs";
 import { execSync as execSync11 } from "node:child_process";
 import { basename as basename3, resolve as resolvePath2 } from "node:path";
 function registerWorldspecInit(parent) {
@@ -34947,7 +35367,7 @@ function registerWorldspecInit(parent) {
     const yaml = renderWorldspecYaml(shape);
     try {
       mkdirSync30(targetDir, { recursive: true });
-      writeFileSync24(targetFile, yaml, {
+      writeFileSync25(targetFile, yaml, {
         encoding: "utf8",
         flag: opts.force ? "w" : "wx"
       });
@@ -35044,7 +35464,7 @@ function relativeFromCwd(absPath, cwd) {
 }
 
 // src/commands/worldspec/schema.ts
-import { writeFileSync as writeFileSync25 } from "node:fs";
+import { writeFileSync as writeFileSync26 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 
 // ../../node_modules/zod-to-json-schema/dist/esm/Options.js
@@ -36366,7 +36786,7 @@ function registerWorldspecSchema(parent) {
     if (opts.out) {
       const absPath = resolvePath3(process.cwd(), opts.out);
       try {
-        writeFileSync25(absPath, json + "\n", "utf8");
+        writeFileSync26(absPath, json + "\n", "utf8");
       } catch (err) {
         printError(
           `failed to write ${absPath}: ${err.message}`
@@ -36455,7 +36875,7 @@ import * as fs47 from "node:fs";
 import * as path50 from "node:path";
 import { spawnSync as spawnSync23 } from "node:child_process";
 import ora9 from "ora";
-import pc23 from "picocolors";
+import pc24 from "picocolors";
 
 // src/commands/upgrade-lock.ts
 import * as fs45 from "node:fs";
@@ -36746,7 +37166,7 @@ function extractBundleHash(indexHtml) {
 }
 function runStep2(label, cmd, args, opts = {}) {
   const start = Date.now();
-  process.stdout.write(`  ${pc23.dim(label.padEnd(34))}`);
+  process.stdout.write(`  ${pc24.dim(label.padEnd(34))}`);
   const result = spawnSync23(cmd, [...args], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
@@ -36756,7 +37176,7 @@ function runStep2(label, cmd, args, opts = {}) {
   const durationMs = Date.now() - start;
   const ok = result.status === 0 && result.error === void 0;
   const dur = `${(durationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${ok ? pc23.green("\u2713") : pc23.red("\u2717")} ${dur}
+  process.stdout.write(`${ok ? pc24.green("\u2713") : pc24.red("\u2717")} ${dur}
 `);
   return {
     ok,
@@ -37086,7 +37506,7 @@ async function runUpgradePullByDigest(deps = {}) {
   if (info.exitCode !== 0) {
     infoSpinner.fail("docker daemon not reachable");
     process.stderr.write(
-      `${pc23.red("error")} docker info exited with ${info.exitCode}.
+      `${pc24.red("error")} docker info exited with ${info.exitCode}.
   Ensure Docker Desktop / Colima / Rancher is running, then retry.
 `
     );
@@ -37135,7 +37555,7 @@ async function runUpgradePullByDigest(deps = {}) {
     pullSpinner.fail(`Pull failed for ${failed.map((r) => r.name).join(", ")}`);
     for (const f of failed) {
       process.stderr.write(
-        `  ${pc23.red(f.name)} (${f.ref}):
+        `  ${pc24.red(f.name)} (${f.ref}):
     exit=${f.result.exitCode}
     stderr: ${f.result.stderr.split("\n")[0] ?? "(empty)"}
 `
@@ -37156,7 +37576,7 @@ async function runUpgradePullByDigest(deps = {}) {
     if (inspect.exitCode !== 0) {
       handshakeSpinner.fail(`Could not inspect ${name}`);
       process.stderr.write(
-        `${pc23.red("error")} docker inspect ${ref} failed: ${inspect.stderr}
+        `${pc24.red("error")} docker inspect ${ref} failed: ${inspect.stderr}
 `
       );
       return { exitCode: EXIT_GENERIC_ERROR, summary: `inspect failed: ${name}` };
@@ -37168,7 +37588,7 @@ async function runUpgradePullByDigest(deps = {}) {
     const decision = checkProtocolOverlap(versions);
     if (!decision.compatible) {
       handshakeSpinner.fail(`Protocol mismatch on ${name}`);
-      process.stderr.write(`${pc23.red("error")} ${decision.remedy}
+      process.stderr.write(`${pc24.red("error")} ${decision.remedy}
 `);
       return {
         exitCode: EXIT_PROTOCOL_MISMATCH,
@@ -37215,7 +37635,7 @@ async function runUpgradePullByDigest(deps = {}) {
     const r = tagger(t.from, t.to);
     if (!r.ok) {
       tagSpinner.fail(`docker tag failed for ${t.name}`);
-      process.stderr.write(`${pc23.red("error")} ${r.error ?? "docker tag failed"}
+      process.stderr.write(`${pc24.red("error")} ${r.error ?? "docker tag failed"}
 `);
       return { exitCode: EXIT_GENERIC_ERROR, summary: `tag failed: ${t.name}` };
     }
@@ -37233,7 +37653,7 @@ async function runUpgradePullByDigest(deps = {}) {
   if (!proxyResult.ok) {
     proxySpinner.fail("docker-socket-proxy recreate failed");
     process.stderr.write(
-      `${pc23.red("error")} docker compose up --force-recreate docker-socket-proxy failed:
+      `${pc24.red("error")} docker compose up --force-recreate docker-socket-proxy failed:
   ${proxyResult.stderr.split("\n").slice(0, 3).join("\n  ")}
 `
     );
@@ -37245,7 +37665,7 @@ async function runUpgradePullByDigest(deps = {}) {
   const orphanCheck = inspectContainer("olam-host-cp");
   if (!orphanCheck.ok) {
     process.stderr.write(
-      `${pc23.red("error")} docker inspect olam-host-cp failed:
+      `${pc24.red("error")} docker inspect olam-host-cp failed:
   ${orphanCheck.stderr.split("\n").slice(0, 3).join("\n  ")}
 `
     );
@@ -37253,13 +37673,13 @@ async function runUpgradePullByDigest(deps = {}) {
   }
   if (orphanCheck.exists && orphanCheck.service !== "olam-host-cp") {
     process.stderr.write(
-      `${pc23.yellow("info")} Removing pre-rename orphan container olam-host-cp (old project=${orphanCheck.project || "<none>"}, old service=${orphanCheck.service || "<none>"})
+      `${pc24.yellow("info")} Removing pre-rename orphan container olam-host-cp (old project=${orphanCheck.project || "<none>"}, old service=${orphanCheck.service || "<none>"})
 `
     );
     const rm = removeContainer("olam-host-cp");
     if (!rm.ok) {
       process.stderr.write(
-        `${pc23.red("error")} docker rm -f olam-host-cp failed:
+        `${pc24.red("error")} docker rm -f olam-host-cp failed:
   ${rm.stderr.split("\n").slice(0, 3).join("\n  ")}
 `
       );
@@ -37275,7 +37695,7 @@ async function runUpgradePullByDigest(deps = {}) {
   if (!composeResult.ok) {
     composeSpinner.fail("compose recreate failed");
     process.stderr.write(
-      `${pc23.red("error")} docker compose up --force-recreate olam-host-cp failed:
+      `${pc24.red("error")} docker compose up --force-recreate olam-host-cp failed:
   ${composeResult.stderr.split("\n").slice(0, 3).join("\n  ")}
 `
     );
@@ -37288,7 +37708,7 @@ async function runUpgradePullByDigest(deps = {}) {
   if (!authResult.ok) {
     authSpinner.fail("auth-service recreate failed");
     process.stderr.write(
-      `${pc23.red("error")} ${authResult.error ?? "unknown failure"}
+      `${pc24.red("error")} ${authResult.error ?? "unknown failure"}
 `
     );
     return { exitCode: EXIT_GENERIC_ERROR, summary: "auth recreate failed" };
@@ -37301,7 +37721,7 @@ async function runUpgradePullByDigest(deps = {}) {
     if (!mcpResult.ok) {
       mcpSpinner.fail("mcp-auth-service recreate failed");
       process.stderr.write(
-        `${pc23.red("error")} ${mcpResult.error ?? "unknown failure"}
+        `${pc24.red("error")} ${mcpResult.error ?? "unknown failure"}
 `
       );
       return { exitCode: EXIT_GENERIC_ERROR, summary: "mcp-auth recreate failed" };
@@ -37525,11 +37945,11 @@ manually inspect images with \`docker images olam-*:olam-rollback\`.`
   process.once("SIGINT", releaseOnSignal);
   process.once("SIGTERM", releaseOnSignal);
   try {
-    process.stdout.write(`  ${pc23.dim("rollback retag (3 ops)".padEnd(34))}`);
+    process.stdout.write(`  ${pc24.dim("rollback retag (3 ops)".padEnd(34))}`);
     const swapStart = Date.now();
     const swapResult = performRollbackSwap(PRODUCTION_SWAP_PLAN);
     const swapDur = `${((Date.now() - swapStart) / 1e3).toFixed(1)}s`;
-    process.stdout.write(`${swapResult.ok ? pc23.green("\u2713") : pc23.red("\u2717")} ${swapDur}
+    process.stdout.write(`${swapResult.ok ? pc24.green("\u2713") : pc24.red("\u2717")} ${swapDur}
 `);
     if (!swapResult.ok) {
       printError(`Rollback retag failed: ${swapResult.summary}`);
@@ -37539,11 +37959,11 @@ manually inspect images with \`docker images olam-*:olam-rollback\`.`
     printInfo("Rollback", swapResult.summary);
     const composeFile = findComposeFile();
     const authSecret = readAuthSecret2();
-    process.stdout.write(`  ${pc23.dim("docker compose recreate olam-host-cp".padEnd(34))}`);
+    process.stdout.write(`  ${pc24.dim("docker compose recreate olam-host-cp".padEnd(34))}`);
     const composeStart = Date.now();
     const composeResult = runCompose(["up", "-d", "--force-recreate", "--no-deps", "olam-host-cp"], composeFile, buildComposeEnv(authSecret, captureGhToken()));
     const composeDur = `${((Date.now() - composeStart) / 1e3).toFixed(1)}s`;
-    process.stdout.write(`${composeResult.ok ? pc23.green("\u2713") : pc23.red("\u2717")} ${composeDur}
+    process.stdout.write(`${composeResult.ok ? pc24.green("\u2713") : pc24.red("\u2717")} ${composeDur}
 `);
     if (!composeResult.ok) {
       printError(
@@ -37554,10 +37974,10 @@ Canonical tags are at :olam-rollback (good); container restart pending. Manually
       process.exitCode = 1;
       return;
     }
-    process.stdout.write(`  ${pc23.dim("recreate auth-service".padEnd(34))}`);
+    process.stdout.write(`  ${pc24.dim("recreate auth-service".padEnd(34))}`);
     const authResult = await recreateAuthService();
     const authDur = `${(authResult.durationMs / 1e3).toFixed(1)}s`;
-    process.stdout.write(`${authResult.ok ? pc23.green("\u2713") : pc23.red("\u2717")} ${authDur}
+    process.stdout.write(`${authResult.ok ? pc24.green("\u2713") : pc24.red("\u2717")} ${authDur}
 `);
     if (!authResult.ok) {
       printError(`Auth-service recreate failed: ${authResult.error ?? "unknown"}`);
@@ -37723,7 +38143,7 @@ ${spaResult.stderr}`);
       throw err;
     }
     if (step2.tee) {
-      process.stdout.write(`  ${pc23.dim(step2.label.padEnd(34))}
+      process.stdout.write(`  ${pc24.dim(step2.label.padEnd(34))}
 `);
       const start = Date.now();
       const result = spawnSync23("bash", [scriptPath], {
@@ -37734,7 +38154,7 @@ ${spaResult.stderr}`);
       const durationMs = Date.now() - start;
       const ok = result.status === 0 && result.error === void 0;
       const dur = `${(durationMs / 1e3).toFixed(1)}s`;
-      process.stdout.write(`  ${pc23.dim(step2.label.padEnd(34))}${ok ? pc23.green("\u2713") : pc23.red("\u2717")} ${dur}
+      process.stdout.write(`  ${pc24.dim(step2.label.padEnd(34))}${ok ? pc24.green("\u2713") : pc24.red("\u2717")} ${dur}
 `);
       timings.push({ label: step2.label, durationMs });
       if (!ok) {
@@ -37760,7 +38180,7 @@ ${result.stderr.split("\n").slice(-3).join("\n")}`);
   }
   for (const t of timings) logRow.durations_ms[t.label] = t.durationMs;
   const smokeStart = Date.now();
-  process.stdout.write(`  ${pc23.dim("smoke (docker create + inspect)".padEnd(34))}`);
+  process.stdout.write(`  ${pc24.dim("smoke (docker create + inspect)".padEnd(34))}`);
   const smokeImages = [
     "olam-auth:olam-next",
     "olam-devbox:olam-next",
@@ -37770,7 +38190,7 @@ ${result.stderr.split("\n").slice(-3).join("\n")}`);
   const smokeFailures = smokeResults.filter((r) => !r.ok);
   const smokeDurationMs = Date.now() - smokeStart;
   const smokeDur = `${(smokeDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${smokeFailures.length === 0 ? pc23.green("\u2713") : pc23.red("\u2717")} ${smokeDur}
+  process.stdout.write(`${smokeFailures.length === 0 ? pc24.green("\u2713") : pc24.red("\u2717")} ${smokeDur}
 `);
   timings.push({ label: "smoke", durationMs: smokeDurationMs });
   if (smokeFailures.length > 0) {
@@ -37797,12 +38217,12 @@ Recovery options:
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`  ${pc23.dim("atomic 6-tag swap".padEnd(34))}`);
+  process.stdout.write(`  ${pc24.dim("atomic 6-tag swap".padEnd(34))}`);
   const swapStart = Date.now();
   const swapResult = performAtomicSwap(PRODUCTION_SWAP_PLAN);
   const swapDurationMs = Date.now() - swapStart;
   const swapDur = `${(swapDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${swapResult.ok ? pc23.green("\u2713") : pc23.red("\u2717")} ${swapDur}
+  process.stdout.write(`${swapResult.ok ? pc24.green("\u2713") : pc24.red("\u2717")} ${swapDur}
 `);
   timings.push({ label: "atomic swap", durationMs: swapDurationMs });
   if (!swapResult.ok) {
@@ -37812,7 +38232,7 @@ Recovery options:
   }
   printInfo("Swap", swapResult.summary);
   const composeFile = findComposeFile();
-  process.stdout.write(`  ${pc23.dim("docker compose recreate".padEnd(34))}`);
+  process.stdout.write(`  ${pc24.dim("docker compose recreate".padEnd(34))}`);
   const composeStart = Date.now();
   const composeResult = runCompose(
     ["up", "-d", "--force-recreate"],
@@ -37822,7 +38242,7 @@ Recovery options:
   const composeDurationMs = Date.now() - composeStart;
   const composeOk = composeResult.ok;
   const composeDur = `${(composeDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${composeOk ? pc23.green("\u2713") : pc23.red("\u2717")} ${composeDur}
+  process.stdout.write(`${composeOk ? pc24.green("\u2713") : pc24.red("\u2717")} ${composeDur}
 `);
   timings.push({ label: "container recreate", durationMs: composeDurationMs });
   if (!composeOk) {
@@ -37838,10 +38258,10 @@ Recovery options:
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`  ${pc23.dim("recreate auth-service".padEnd(34))}`);
+  process.stdout.write(`  ${pc24.dim("recreate auth-service".padEnd(34))}`);
   const authResult = await recreateAuthService();
   const authDur = `${(authResult.durationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${authResult.ok ? pc23.green("\u2713") : pc23.red("\u2717")} ${authDur}
+  process.stdout.write(`${authResult.ok ? pc24.green("\u2713") : pc24.red("\u2717")} ${authDur}
 `);
   timings.push({ label: "auth recreate", durationMs: authResult.durationMs });
   if (!authResult.ok) {
@@ -37856,12 +38276,12 @@ Recovery options:
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`  ${pc23.dim("waiting for /health".padEnd(34))}`);
+  process.stdout.write(`  ${pc24.dim("waiting for /health".padEnd(34))}`);
   const healthStart = Date.now();
   const healthy = await waitForHealth(1e4);
   const healthDurationMs = Date.now() - healthStart;
   const healthDur = `${(healthDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${healthy ? pc23.green("\u2713") : pc23.yellow("?")} ${healthDur}
+  process.stdout.write(`${healthy ? pc24.green("\u2713") : pc24.yellow("?")} ${healthDur}
 `);
   timings.push({ label: "/health", durationMs: healthDurationMs });
   if (!healthy) {
@@ -37869,12 +38289,12 @@ Recovery options:
       "Host CP started but /health did not respond within 10s.\n  \u2022 Check: docker logs olam-host-cp\n  \u2022 If the new SHA is broken: `olam upgrade --rollback` restores the prior set in <30s."
     );
   }
-  process.stdout.write(`  ${pc23.dim("verify /version/status round-trip".padEnd(34))}`);
+  process.stdout.write(`  ${pc24.dim("verify /version/status round-trip".padEnd(34))}`);
   const versionStart = Date.now();
   const versionMatch = await waitForVersionMatch(_targetSha, 9e4);
   const versionDurationMs = Date.now() - versionStart;
   const versionDur = `${(versionDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${versionMatch.matched ? pc23.green("\u2713") : pc23.yellow("?")} ${versionDur}
+  process.stdout.write(`${versionMatch.matched ? pc24.green("\u2713") : pc24.yellow("?")} ${versionDur}
 `);
   timings.push({ label: "/version/status round-trip", durationMs: versionDurationMs });
   if (!versionMatch.matched) {
@@ -37979,12 +38399,12 @@ init_host_cp();
 init_context();
 init_output();
 import * as http4 from "node:http";
-import pc24 from "picocolors";
+import pc25 from "picocolors";
 var HOST_CP_PORT3 = 19e3;
 function colorLine(line) {
-  if (/\bERROR\b/.test(line)) return pc24.red(line);
-  if (/\bWARN\b/.test(line)) return pc24.yellow(line);
-  if (/\bINFO\b/.test(line)) return pc24.dim(line);
+  if (/\bERROR\b/.test(line)) return pc25.red(line);
+  if (/\bWARN\b/.test(line)) return pc25.yellow(line);
+  if (/\bINFO\b/.test(line)) return pc25.dim(line);
   return line;
 }
 function buildLogsUrl(worldId, opts, port2 = HOST_CP_PORT3) {
@@ -38081,7 +38501,7 @@ function registerLogs(program2) {
 // src/commands/ps.ts
 init_context();
 init_output();
-import pc25 from "picocolors";
+import pc26 from "picocolors";
 import { spawnSync as spawnSync24 } from "node:child_process";
 var SAFE_IDENT4 = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function parseDockerTop(stdout) {
@@ -38164,18 +38584,18 @@ function printTable2(rows) {
   const fixedWidth = 5 + 1 + 8 + 1 + 6 + 1 + 6 + 1 + 10 + 1 + 6 + 1;
   const cmdWidth = Math.max(20, cols - fixedWidth);
   const header = [
-    pc25.bold(pc25.dim("PID".padEnd(5))),
-    pc25.bold(pc25.dim("USER".padEnd(8))),
-    pc25.bold(pc25.dim("%CPU".padEnd(6))),
-    pc25.bold(pc25.dim("%MEM".padEnd(6))),
-    pc25.bold(pc25.dim("STARTED".padEnd(10))),
-    pc25.bold(pc25.dim("STATE".padEnd(6))),
-    pc25.bold(pc25.dim("COMMAND"))
+    pc26.bold(pc26.dim("PID".padEnd(5))),
+    pc26.bold(pc26.dim("USER".padEnd(8))),
+    pc26.bold(pc26.dim("%CPU".padEnd(6))),
+    pc26.bold(pc26.dim("%MEM".padEnd(6))),
+    pc26.bold(pc26.dim("STARTED".padEnd(10))),
+    pc26.bold(pc26.dim("STATE".padEnd(6))),
+    pc26.bold(pc26.dim("COMMAND"))
   ].join(" ");
   console.log(header);
   for (const row of rows) {
     const cmd = row.command.length > cmdWidth ? row.command.slice(0, cmdWidth - 1) + "\u2026" : row.command;
-    const stateFn = row.state.startsWith("R") ? pc25.green : row.state.startsWith("Z") ? pc25.red : pc25.dim;
+    const stateFn = row.state.startsWith("R") ? pc26.green : row.state.startsWith("Z") ? pc26.red : pc26.dim;
     console.log([
       row.pid.padEnd(5),
       row.user.slice(0, 8).padEnd(8),
@@ -38229,7 +38649,7 @@ function registerPs(program2) {
       printTable2(rows);
       if (opts.watch) {
         process.stdout.write(`
-${pc25.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
+${pc26.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
 `);
       }
     }
@@ -38379,7 +38799,7 @@ init_output();
 import * as fs49 from "node:fs";
 import * as path52 from "node:path";
 import { execSync as execSync12 } from "node:child_process";
-import pc26 from "picocolors";
+import pc27 from "picocolors";
 
 // src/commands/world.ts
 function getOrCreateWorldCommand(program2) {
@@ -38489,7 +38909,7 @@ async function handleCreate2(worldId, kindArg) {
     const label = r.repo ? `${r.kind}/${r.repo}` : r.kind;
     if (r.ok) {
       printSuccess(`${label}`);
-      console.log(`         ${pc26.dim(r.tarPath)}`);
+      console.log(`         ${pc27.dim(r.tarPath)}`);
     } else {
       printWarning(`${label}: ${r.msg ?? "skipped"}`);
     }
@@ -38679,18 +39099,18 @@ function handleInspect(opts) {
     const label = `${out.kind}/${out.repo}`;
     if (out.outcome === "hit") {
       const size = out.sizeBytes !== void 0 ? ` (${formatBytes4(out.sizeBytes)})` : "";
-      printSuccess(`${label.padEnd(24)} HIT  ${pc26.dim(out.fingerprint ?? "")}${size}`);
+      printSuccess(`${label.padEnd(24)} HIT  ${pc27.dim(out.fingerprint ?? "")}${size}`);
     } else {
       printWarning(`${label.padEnd(24)} MISS ${explainInspectReason(out)}`);
       if (out.expectedTarPath) {
-        console.log(`         ${pc26.dim("expected: " + out.expectedTarPath)}`);
+        console.log(`         ${pc27.dim("expected: " + out.expectedTarPath)}`);
       }
     }
   }
   console.log();
   if (hits === 0) {
     console.log(
-      pc26.dim(
+      pc27.dim(
         "No warm snapshot would be restored \u2014 the next `olam create` takes the cold path. See docs/architecture/snapshot-restore.md \xA7 FAQ."
       )
     );
@@ -38702,7 +39122,7 @@ async function handleEvict(opts) {
   if (opts.dryRun) {
     const root = snapshotsDir();
     if (!fs49.existsSync(root)) {
-      console.log(pc26.dim("No snapshot dir; nothing to evict."));
+      console.log(pc27.dim("No snapshot dir; nothing to evict."));
       return;
     }
     const allTars = [];
@@ -38735,17 +39155,17 @@ async function handleEvict(opts) {
     console.log();
     for (const t of toEvict) {
       const age = formatAge2(Date.now() - t.mtime);
-      console.log(`  ${pc26.dim(formatBytes4(t.size).padStart(8))}  ${age.padStart(10)}  ${t.path}`);
+      console.log(`  ${pc27.dim(formatBytes4(t.size).padStart(8))}  ${age.padStart(10)}  ${t.path}`);
     }
     console.log();
-    console.log(pc26.dim(`Total after eviction: ${formatBytes4(remaining)} (cap: ${formatBytes4(maxBytes)})`));
+    console.log(pc27.dim(`Total after eviction: ${formatBytes4(remaining)} (cap: ${formatBytes4(maxBytes)})`));
     return;
   }
   const freed = evictOldSnapshotsWithFlock(maxBytes);
   if (freed > 0) {
     printSuccess(`Evicted ${formatBytes4(freed)} (cap: ${formatBytes4(maxBytes)})`);
   } else {
-    console.log(pc26.dim("No eviction needed (or another process held the lock)."));
+    console.log(pc27.dim("No eviction needed (or another process held the lock)."));
   }
 }
 function handleList2(worldIdFilter) {
@@ -38753,7 +39173,7 @@ function handleList2(worldIdFilter) {
   const entries = listSnapshots(worldIdFilter);
   if (entries.length === 0) {
     const where = worldIdFilter ? ` for world "${worldIdFilter}"` : "";
-    console.log(pc26.dim(`No snapshots found${where}. Run \`olam world snapshot create <worldId>\` first.`));
+    console.log(pc27.dim(`No snapshots found${where}. Run \`olam world snapshot create <worldId>\` first.`));
     return;
   }
   printHeader(`${entries.length} snapshot(s)`);
@@ -38762,15 +39182,15 @@ function handleList2(worldIdFilter) {
   for (const entry of entries) {
     const { manifest } = entry;
     if (manifest.worldId !== lastWorldId) {
-      console.log(pc26.bold(manifest.worldId));
+      console.log(pc27.bold(manifest.worldId));
       lastWorldId = manifest.worldId;
     }
     const repo = manifest.repo ?? "(all repos)";
     const size = formatBytes4(manifest.sizeBytes);
     const age = formatAge2(entry.ageMs);
-    const kindColor = manifest.kind === "gems" ? pc26.magenta(manifest.kind) : manifest.kind === "node" ? pc26.cyan(manifest.kind) : pc26.yellow(manifest.kind);
+    const kindColor = manifest.kind === "gems" ? pc27.magenta(manifest.kind) : manifest.kind === "node" ? pc27.cyan(manifest.kind) : pc27.yellow(manifest.kind);
     console.log(
-      `  ${kindColor.padEnd(6)}  ${pc26.dim(repo.padEnd(24))}  ${manifest.fingerprint}  ${size.padStart(8)}  ${age}`
+      `  ${kindColor.padEnd(6)}  ${pc27.dim(repo.padEnd(24))}  ${manifest.fingerprint}  ${size.padStart(8)}  ${age}`
     );
   }
   console.log();
@@ -39122,7 +39542,7 @@ import * as fs52 from "node:fs";
 import * as os30 from "node:os";
 import * as path55 from "node:path";
 import { execFileSync as execFileSync13, execSync as execSync13 } from "node:child_process";
-import pc27 from "picocolors";
+import pc28 from "picocolors";
 
 // ../core/dist/diagnose/secret-stripper.js
 var SECRET_PATTERNS = [
@@ -39260,23 +39680,23 @@ function registerDiagnose(program2) {
       return;
     }
     if (!opts.quiet) {
-      console.log(pc27.cyan("Building diagnostics zip\u2026"));
+      console.log(pc28.cyan("Building diagnostics zip\u2026"));
     }
     try {
       const { zipPath, entries } = await buildDiagnosticsZip();
       if (!opts.quiet) {
-        console.log(pc27.green(`Done: ${zipPath}`));
-        console.log(pc27.dim(`Contents: ${entries.join(", ")}`));
+        console.log(pc28.green(`Done: ${zipPath}`));
+        console.log(pc28.dim(`Contents: ${entries.join(", ")}`));
       }
       if (opts.upload) {
-        console.log(pc27.yellow(
+        console.log(pc28.yellow(
           `Telemetry endpoint not yet provisioned. Share the zip manually:
   File: ${zipPath}
   See docs/runbooks/share-diagnostics.md for instructions.`
         ));
       }
     } catch (err) {
-      console.error(pc27.red(`Diagnose failed: ${err.message}`));
+      console.error(pc28.red(`Diagnose failed: ${err.message}`));
       process.exitCode = 1;
     }
   });
@@ -39979,13 +40399,13 @@ function registerDoctor(program2) {
 }
 
 // src/commands/substrate.ts
-import pc29 from "picocolors";
+import pc30 from "picocolors";
 init_context();
 init_output();
 
 // src/commands/substrate-audit-log.ts
 import * as fs55 from "node:fs";
-import pc28 from "picocolors";
+import pc29 from "picocolors";
 var VALID_PERIPHERAL_NAMES = PERIPHERALS.map((p) => p.name).sort();
 var DEFAULT_LIMIT = 50;
 function parseAuditLog(raw) {
@@ -40002,8 +40422,8 @@ function parseAuditLog(raw) {
 }
 function formatEntryRow(entry, index) {
   const ts = entry.ts ?? "(no timestamp)";
-  const regression = entry.security_regression ? pc28.red("yes") : pc28.green("no");
-  const accepted = entry.accepted ? pc28.yellow("yes") : "\u2014";
+  const regression = entry.security_regression ? pc29.red("yes") : pc29.green("no");
+  const accepted = entry.accepted ? pc29.yellow("yes") : "\u2014";
   const fields = (entry.changed_fields ?? []).join(", ") || "\u2014";
   return `  ${String(index + 1).padStart(3)}  ${ts}  regression=${regression}  accepted=${accepted}  fields=[${fields}]`;
 }
@@ -40029,7 +40449,7 @@ function handleAuditLog(opts, deps = {}) {
     raw = readFileSyncImpl(auditLogPath, "utf8");
   } catch (err) {
     stderr.write(
-      `${pc28.red("error:")} could not read audit log at ${auditLogPath}: ${err instanceof Error ? err.message : String(err)}
+      `${pc29.red("error:")} could not read audit log at ${auditLogPath}: ${err instanceof Error ? err.message : String(err)}
 `
     );
     return 1;
@@ -40038,7 +40458,7 @@ function handleAuditLog(opts, deps = {}) {
   if (opts.peripheral) {
     if (!VALID_PERIPHERAL_NAMES.includes(opts.peripheral)) {
       stderr.write(
-        `${pc28.red("error:")} unknown peripheral "${opts.peripheral}". Valid names: ${VALID_PERIPHERAL_NAMES.join(", ")}
+        `${pc29.red("error:")} unknown peripheral "${opts.peripheral}". Valid names: ${VALID_PERIPHERAL_NAMES.join(", ")}
 `
       );
       return 1;
@@ -40049,7 +40469,7 @@ function handleAuditLog(opts, deps = {}) {
     const sinceMs = Date.parse(opts.since);
     if (Number.isNaN(sinceMs)) {
       stderr.write(
-        `${pc28.red("error:")} invalid --since date "${opts.since}". Expected ISO-8601 (e.g. 2026-05-20T00:00:00Z).
+        `${pc29.red("error:")} invalid --since date "${opts.since}". Expected ISO-8601 (e.g. 2026-05-20T00:00:00Z).
 `
       );
       return 1;
@@ -40104,9 +40524,9 @@ async function defaultCountWorlds() {
 }
 function formatBetaLine(cfg) {
   if (cfg.host.substrate === "compose") {
-    return `Substrate: ${pc29.bold("compose")}`;
+    return `Substrate: ${pc30.bold("compose")}`;
   }
-  return `Substrate: ${pc29.bold("kubernetes")} (beta until ${BETA_EXPIRY_DATE}, flavor=k3s)`;
+  return `Substrate: ${pc30.bold("kubernetes")} (beta until ${BETA_EXPIRY_DATE}, flavor=k3s)`;
 }
 async function handleGet(deps = {}) {
   const read = deps.readConfig ?? readConfig;
@@ -40128,7 +40548,7 @@ async function handleSet(target, deps = {}) {
   void runDoctorFn;
   if (target !== "compose" && target !== "kubernetes") {
     stderr.write(
-      `${pc29.red("error:")} unsupported substrate "${target}". Expected: compose | kubernetes.
+      `${pc30.red("error:")} unsupported substrate "${target}". Expected: compose | kubernetes.
 `
     );
     return 1;
@@ -40137,7 +40557,7 @@ async function handleSet(target, deps = {}) {
   const current = read();
   if (current.host.substrate === targetSubstrate) {
     stdout.write(
-      `Substrate already set to ${pc29.bold(targetSubstrate)}. No change.
+      `Substrate already set to ${pc30.bold(targetSubstrate)}. No change.
 `
     );
     return 0;
@@ -40147,23 +40567,23 @@ async function handleSet(target, deps = {}) {
     worldsCount = await countWorlds();
   } catch (err) {
     stderr.write(
-      `${pc29.yellow("warn:")} could not list worlds (${err instanceof Error ? err.message : String(err)}); assuming none exist and proceeding.
+      `${pc30.yellow("warn:")} could not list worlds (${err instanceof Error ? err.message : String(err)}); assuming none exist and proceeding.
 `
     );
     worldsCount = 0;
   }
   if (worldsCount > 0) {
     stderr.write(
-      `${pc29.red("error:")} ${worldsCount} world(s) exist on the current substrate (${pc29.bold(
+      `${pc30.red("error:")} ${worldsCount} world(s) exist on the current substrate (${pc30.bold(
         current.host.substrate
       )}). Switching substrates abandons their state.
 `
     );
-    stderr.write(`       Run ${pc29.bold("olam destroy --all")} first, then re-run this command.
+    stderr.write(`       Run ${pc30.bold("olam destroy --all")} first, then re-run this command.
 `);
     return 1;
   }
-  stdout.write(`Running pre-flight for ${pc29.bold(targetSubstrate)} substrate\u2026
+  stdout.write(`Running pre-flight for ${pc30.bold(targetSubstrate)} substrate\u2026
 `);
   let doctorResult;
   try {
@@ -40174,18 +40594,18 @@ async function handleSet(target, deps = {}) {
     }
   } catch (err) {
     stderr.write(
-      `${pc29.red("error:")} pre-flight crashed: ${err instanceof Error ? err.message : String(err)}
+      `${pc30.red("error:")} pre-flight crashed: ${err instanceof Error ? err.message : String(err)}
 `
     );
     return 1;
   }
   if (doctorResult.exitCode !== 0) {
     stderr.write(
-      `${pc29.red("error:")} pre-flight failed for ${pc29.bold(targetSubstrate)} substrate.
+      `${pc30.red("error:")} pre-flight failed for ${pc30.bold(targetSubstrate)} substrate.
 `
     );
     stderr.write(
-      `       Run ${pc29.bold(
+      `       Run ${pc30.bold(
         `olam doctor${targetSubstrate === "kubernetes" ? " --substrate=kubernetes" : ""}`
       )} to see what's missing, fix the named prereqs, then re-run.
 `
@@ -40202,14 +40622,14 @@ async function handleSet(target, deps = {}) {
     stdout.write(
       `
 Kubernetes substrate is in beta until ${BETA_EXPIRY_DATE}.
-Rollback: ${pc29.bold("olam substrate set compose")} (preserves compose worlds you create after this).
-Next: ${pc29.bold("olam upgrade")} to deploy host-cp to your kubectl context.
+Rollback: ${pc30.bold("olam substrate set compose")} (preserves compose worlds you create after this).
+Next: ${pc30.bold("olam upgrade")} to deploy host-cp to your kubectl context.
 `
     );
   } else {
     stdout.write(
       `
-Next: ${pc29.bold("olam upgrade")} to redeploy host-cp on the compose substrate.
+Next: ${pc30.bold("olam upgrade")} to redeploy host-cp on the compose substrate.
 `
     );
   }
@@ -40713,7 +41133,7 @@ import path81 from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
 
 // src/lib/shell-rc.ts
-import { copyFileSync as copyFileSync5, existsSync as existsSync62, readFileSync as readFileSync52, renameSync as renameSync8, writeFileSync as writeFileSync30 } from "node:fs";
+import { copyFileSync as copyFileSync5, existsSync as existsSync62, readFileSync as readFileSync52, renameSync as renameSync8, writeFileSync as writeFileSync31 } from "node:fs";
 import path58 from "node:path";
 function appendIdempotent(opts) {
   const { rcPath, marker, contentLine, clock = () => /* @__PURE__ */ new Date() } = opts;
@@ -40731,7 +41151,7 @@ function appendIdempotent(opts) {
   const trailing = contentLine.endsWith("\n") ? "" : "\n";
   const nextContent = `${content}${separator}${contentLine}${trailing}`;
   const tmpPath = `${rcPath}.olam-tmp.${process.pid}`;
-  writeFileSync30(tmpPath, nextContent, { encoding: "utf-8" });
+  writeFileSync31(tmpPath, nextContent, { encoding: "utf-8" });
   renameSync8(tmpPath, rcPath);
   return { status: "appended", backupPath };
 }
@@ -41335,7 +41755,7 @@ async function phase2_5ProvisionCluster(substrate, clusterName, opts, deps, reus
     return {
       ok: false,
       message: `k3d cluster create ${clusterName} failed (exit ${createResult.status ?? "signal"})`,
-      remedy: `Run manually: k3d cluster create ${clusterName} --wait --timeout 90s`
+      remedy: `Run manually: k3d cluster create ${clusterName} --volume ~/.config/gh:/host/.config/gh --wait --timeout 90s`
     };
   }
   const ctxResult = captureSpawnSync("kubectl", ["config", "current-context"]);
@@ -41853,7 +42273,7 @@ import * as fs82 from "node:fs";
 import * as os46 from "node:os";
 import * as path84 from "node:path";
 import { execSync as execSync15 } from "node:child_process";
-import pc30 from "picocolors";
+import pc31 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
 import * as fs80 from "node:fs";
@@ -42005,37 +42425,37 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
     writeLastStable(prevVersion);
   }
   if (!quiet) {
-    console.log(pc30.cyan(`Installing ${PACKAGE_NAME}@${channel}\u2026`));
+    console.log(pc31.cyan(`Installing ${PACKAGE_NAME}@${channel}\u2026`));
   }
   const installResult = _exec(`npm install -g ${PACKAGE_NAME}@${channel}`);
   if (installResult.exitCode !== 0) {
     logUpdateFailure(installResult.stderr);
     if (!quiet) {
-      console.error(pc30.red("Update failed."));
+      console.error(pc31.red("Update failed."));
     }
     const prev = readLastStable();
     if (prev) {
       if (!quiet) {
-        console.log(pc30.yellow(`Restoring to ${prev}\u2026`));
+        console.log(pc31.yellow(`Restoring to ${prev}\u2026`));
       }
       const restoreResult = _exec(`npm install -g ${PACKAGE_NAME}@${prev}`);
       if (restoreResult.exitCode !== 0) {
         if (!quiet) {
-          console.error(pc30.red(
+          console.error(pc31.red(
             `Restore also failed. Run: npm install -g ${PACKAGE_NAME}@${prev} manually.`
           ));
         }
       } else if (!quiet) {
-        console.log(pc30.yellow(`Restored to ${prev}.`));
+        console.log(pc31.yellow(`Restored to ${prev}.`));
       }
     } else if (!quiet) {
-      console.error(pc30.red("No previous version cached; cannot auto-restore."));
+      console.error(pc31.red("No previous version cached; cannot auto-restore."));
     }
     return { action: "restored", prevVersion: prev ?? void 0, exitCode: 11 };
   }
   const newVersion = getCurrentVersion(_exec) ?? void 0;
   if (!quiet && newVersion) {
-    console.log(pc30.green(`Updated to ${newVersion}.`));
+    console.log(pc31.green(`Updated to ${newVersion}.`));
   }
   const npmRootResult = _getNpmRoot("npm root -g");
   let symlinkResult = { added: [], removed: [] };
@@ -42047,10 +42467,10 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
     symlinkResult = { added: rec.added, removed: rec.removed };
     if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
       if (rec.added.length > 0) {
-        console.log(pc30.dim(`Skills added: ${rec.added.join(", ")}`));
+        console.log(pc31.dim(`Skills added: ${rec.added.join(", ")}`));
       }
       if (rec.removed.length > 0) {
-        console.log(pc30.dim(`Skills removed (dangling): ${rec.removed.join(", ")}`));
+        console.log(pc31.dim(`Skills removed (dangling): ${rec.removed.join(", ")}`));
       }
     }
   }
@@ -42144,7 +42564,7 @@ function registerUpdate(program2) {
 // src/commands/begin.ts
 init_host_cp();
 init_open_url();
-import pc31 from "picocolors";
+import pc32 from "picocolors";
 async function doBegin(opts, _startFn = startHostCp, _openFn = openUrl) {
   const prevExitCode = process.exitCode;
   await _startFn({ showToken: opts.showToken });
@@ -42154,7 +42574,7 @@ async function doBegin(opts, _startFn = startHostCp, _openFn = openUrl) {
     const token = readToken();
     if (token) {
       const base = `http://127.0.0.1:${HOST_CP_PORT}/`;
-      console.log(pc31.dim(`Opening ${base}`));
+      console.log(pc32.dim(`Opening ${base}`));
       _openFn(`${base}?token=${token}`);
     }
   }
@@ -42302,7 +42722,7 @@ function registerConfig(program2) {
 // src/commands/repos.ts
 init_global_config();
 init_output();
-import pc32 from "picocolors";
+import pc33 from "picocolors";
 
 // src/commands/repos-list-json.ts
 init_skill_sources();
@@ -42337,14 +42757,14 @@ function registerRepos(program2) {
       return;
     }
     if (all.length === 0) {
-      console.log(pc32.dim("0 repo(s) registered. Add one with: olam repos add --name <n> --path <p>"));
+      console.log(pc33.dim("0 repo(s) registered. Add one with: olam repos add --name <n> --path <p>"));
       return;
     }
     printHeader(`${all.length} repo(s)`);
     for (const r of all) {
       const when = new Date(r.addedAt).toISOString().slice(0, 10);
       console.log(
-        `  ${pc32.bold(r.name.padEnd(24))} ${r.path.padEnd(48)} ${pc32.dim(when)}`
+        `  ${pc33.bold(r.name.padEnd(24))} ${r.path.padEnd(48)} ${pc33.dim(when)}`
       );
     }
   });
@@ -42389,7 +42809,7 @@ function registerRepos(program2) {
 // src/commands/runbooks.ts
 init_global_config();
 init_output();
-import pc33 from "picocolors";
+import pc34 from "picocolors";
 function asMessage2(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -42408,13 +42828,13 @@ function renderRunbookList(runbooks, opts) {
     );
   }
   if (runbooks.length === 0) {
-    return pc33.dim("0 runbook(s). Add one with: olam runbooks add <name> --repos <repo>");
+    return pc34.dim("0 runbook(s). Add one with: olam runbooks add <name> --repos <repo>");
   }
-  const lines = [pc33.bold(`${runbooks.length} runbook(s)`)];
+  const lines = [pc34.bold(`${runbooks.length} runbook(s)`)];
   for (const rb of runbooks) {
     const when = new Date(rb.updatedAt).toISOString().slice(0, 10);
     const repoList = rb.repos.join(", ");
-    lines.push(`  ${pc33.bold(rb.name.padEnd(24))} ${repoList.padEnd(40)} ${pc33.dim(when)}`);
+    lines.push(`  ${pc34.bold(rb.name.padEnd(24))} ${repoList.padEnd(40)} ${pc34.dim(when)}`);
   }
   return lines.join("\n");
 }
@@ -42463,7 +42883,7 @@ function parsePortFlags(ports) {
 }
 function formatConflict(c) {
   const occupantStr = c.occupant.type === "olam-world" ? `in use by world "${c.occupant.worldId}" (olam)` : `in use by PID ${c.occupant.pid ?? "unknown"} (non-olam process)`;
-  return `  ${pc33.red("\u2717")} ${c.repoName}.${c.serviceName}:${c.port} \u2014 ${occupantStr}`;
+  return `  ${pc34.red("\u2717")} ${c.repoName}.${c.serviceName}:${c.port} \u2014 ${occupantStr}`;
 }
 function registerRunbooks(program2) {
   const runbooks = program2.command("runbooks").description("Manage runbooks in the global config");
@@ -42523,17 +42943,17 @@ ${conflicts.length} port conflict(s). Stop the conflicting processes or update p
         return;
       }
       console.log(
-        pc33.dim(
+        pc34.dim(
           `olam runbooks apply: port validation passed for "${name}" (repos: ${rb.repos.join(", ")}).`
         )
       );
       console.log(
-        pc33.dim(
+        pc34.dim(
           `Hint: use "olam create --repos ${rb.repos.join(" ")}${opts.task ? ` --task "${opts.task}"` : ""}${opts.name ? ` --name ${opts.name}` : ""}" to create the world.`
         )
       );
       console.log(
-        pc33.yellow('Phase D will wire --runbook directly. For now, use "olam create --repos ..." above.')
+        pc34.yellow('Phase D will wire --runbook directly. For now, use "olam create --repos ..." above.')
       );
     } catch (err) {
       printError(asMessage2(err));
@@ -42551,7 +42971,7 @@ ${conflicts.length} port conflict(s). Stop the conflicting processes or update p
         return;
       }
       if (rows.length === 0) {
-        console.log(pc33.dim(`runbook "${name}" declares no ports.`));
+        console.log(pc34.dim(`runbook "${name}" declares no ports.`));
         return;
       }
       for (const row of rows) {
@@ -42559,7 +42979,7 @@ ${conflicts.length} port conflict(s). Stop the conflicting processes or update p
           const conflict = conflicts.find((c) => c.port === row.port);
           if (conflict) console.log(formatConflict(conflict));
         } else {
-          console.log(`  ${pc33.green("\u2713")} ${row.repoName}.${row.serviceName}:${row.port} \u2014 free`);
+          console.log(`  ${pc34.green("\u2713")} ${row.repoName}.${row.serviceName}:${row.port} \u2014 free`);
         }
       }
       if (conflicts.length > 0) {
@@ -42569,7 +42989,7 @@ ${conflicts.length} port conflict(s). Stop the conflicting processes or update p
         );
         process.exitCode = 1;
       } else {
-        console.log(pc33.green("\n\u2713 all ports free"));
+        console.log(pc34.green("\n\u2713 all ports free"));
       }
     } catch (err) {
       printError(asMessage2(err));
@@ -42582,10 +43002,10 @@ ${conflicts.length} port conflict(s). Stop the conflicting processes or update p
 init_skill_sources();
 init_output();
 import * as readline2 from "node:readline";
-import pc34 from "picocolors";
+import pc35 from "picocolors";
 
 // src/commands/flywheel/install-shims.ts
-import { copyFileSync as copyFileSync9, existsSync as existsSync91, mkdirSync as mkdirSync54, readFileSync as readFileSync78, writeFileSync as writeFileSync45 } from "node:fs";
+import { copyFileSync as copyFileSync9, existsSync as existsSync91, mkdirSync as mkdirSync54, readFileSync as readFileSync78, writeFileSync as writeFileSync46 } from "node:fs";
 import { homedir as homedir52 } from "node:os";
 import { dirname as dirname50, join as join92 } from "node:path";
 
@@ -42685,7 +43105,7 @@ function installOne(spec, targetDir, opts) {
   if (!existsSync91(targetPath)) {
     if (opts.dryRun !== true) {
       mkdirSync54(dirname50(targetPath), { recursive: true });
-      writeFileSync45(targetPath, newContent, { mode: 493 });
+      writeFileSync46(targetPath, newContent, { mode: 493 });
     }
     return { basename: spec.basename, action: "written", targetPath };
   }
@@ -42695,7 +43115,7 @@ function installOne(spec, targetDir, opts) {
   }
   if (isOlamGeneratedShim(existing)) {
     if (opts.dryRun !== true) {
-      writeFileSync45(targetPath, newContent, { mode: 493 });
+      writeFileSync46(targetPath, newContent, { mode: 493 });
     }
     return { basename: spec.basename, action: "overwritten", targetPath };
   }
@@ -42703,7 +43123,7 @@ function installOne(spec, targetDir, opts) {
     const backupPath = `${targetPath}.shim-backup-${Math.floor(Date.now() / 1e3)}`;
     if (opts.dryRun !== true) {
       copyFileSync9(targetPath, backupPath);
-      writeFileSync45(targetPath, newContent, { mode: 493 });
+      writeFileSync46(targetPath, newContent, { mode: 493 });
     }
     return { basename: spec.basename, action: "overwritten", targetPath, backupPath };
   }
@@ -42767,10 +43187,10 @@ function defaultTrustPrompt(gitUrl) {
   return new Promise((resolve28) => {
     const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     process.stdout.write(
-      `${pc34.yellow("Trust gate:")} register "${gitUrl}" as a skill source?
+      `${pc35.yellow("Trust gate:")} register "${gitUrl}" as a skill source?
   This grants the source permission to symlink artifacts into
   ~/.claude/ on every \`olam skills sync\`.
-Type ${pc34.bold("y")} to add + trust, anything else to cancel: `
+Type ${pc35.bold("y")} to add + trust, anything else to cancel: `
     );
     rl.question("", (a) => {
       rl.close();
@@ -42786,8 +43206,8 @@ function defaultSourcePrefixPrompt(input2) {
     const scopeLabel = cfg.prefixScope !== void 0 && cfg.prefixScope.length > 0 ? ` (scope: ${cfg.prefixScope.join(",")})` : "";
     process.stdout.write(
       `
-${pc34.cyan("Source-config:")} ${input2.sourceName} suggests prefix ${pc34.bold(prefixLabel)}${scopeLabel}.
-Adopt for this host? ${pc34.dim("[Y/n] ")}`
+${pc35.cyan("Source-config:")} ${input2.sourceName} suggests prefix ${pc35.bold(prefixLabel)}${scopeLabel}.
+Adopt for this host? ${pc35.dim("[Y/n] ")}`
     );
     rl.question("", (a) => {
       rl.close();
@@ -42799,7 +43219,7 @@ function defaultPostAddPrompt(input2) {
   return new Promise((resolve28) => {
     const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
     process.stdout.write(`
-${pc34.bold("Sync now?")} ${pc34.dim("[Y/n] ")}`);
+${pc35.bold("Sync now?")} ${pc35.dim("[Y/n] ")}`);
     rl.question("", (syncAnswer) => {
       const sync = !/^n(o)?$/i.test(syncAnswer.trim());
       if (input2.hookAlreadyInstalled) {
@@ -42808,7 +43228,7 @@ ${pc34.bold("Sync now?")} ${pc34.dim("[Y/n] ")}`);
         return;
       }
       process.stdout.write(
-        `${pc34.bold("Install SessionStart hook so future sessions auto-sync?")} ${pc34.dim("[Y/n] ")}`
+        `${pc35.bold("Install SessionStart hook so future sessions auto-sync?")} ${pc35.dim("[Y/n] ")}`
       );
       rl.question("", (hookAnswer) => {
         rl.close();
@@ -42865,7 +43285,7 @@ function registerSkillsSource(program2) {
     }
     if (all.length === 0) {
       console.log(
-        pc34.dim("0 skill source(s) registered. Add one with: olam skills source add --name <n> --git-url <url>")
+        pc35.dim("0 skill source(s) registered. Add one with: olam skills source add --name <n> --git-url <url>")
       );
       return;
     }
@@ -42886,19 +43306,19 @@ function registerSkillsSource(program2) {
     for (let i = 0; i < all.length; i += 1) {
       const s = all[i];
       const when = new Date(s.addedAt).toISOString().slice(0, 10);
-      const sha = s.lastPulledSha ? s.lastPulledSha.slice(0, 8) : pc34.dim("(unpulled)");
-      const ord = pc34.dim(`[${i + 1}]`);
-      const prefixCol = s.prefix ? pc34.cyan(s.prefix.padEnd(12)) : pc34.dim("\u2014".padEnd(12));
+      const sha = s.lastPulledSha ? s.lastPulledSha.slice(0, 8) : pc35.dim("(unpulled)");
+      const ord = pc35.dim(`[${i + 1}]`);
+      const prefixCol = s.prefix ? pc35.cyan(s.prefix.padEnd(12)) : pc35.dim("\u2014".padEnd(12));
       const scopeDisplay = s.prefixScope !== void 0 ? s.prefixScope.join(",") : DEFAULT_SCOPE_REPR;
-      const scopeCol = showScopeCol ? ` ${pc34.yellow(scopeDisplay.padEnd(12))}` : "";
+      const scopeCol = showScopeCol ? ` ${pc35.yellow(scopeDisplay.padEnd(12))}` : "";
       let originCol = "";
       if (showOriginCol) {
         const eff = resolveEffectivePrefix(s, sourceConfigs[i]);
-        const tag = eff.origin === "operator" ? pc34.dim("(operator)") : eff.origin === "source" ? pc34.dim("(source)") : "";
+        const tag = eff.origin === "operator" ? pc35.dim("(operator)") : eff.origin === "source" ? pc35.dim("(source)") : "";
         originCol = ` ${tag.padEnd(10)}`;
       }
       console.log(
-        `  ${ord} ${pc34.bold(s.id.padEnd(14))} ${s.name.padEnd(24)} ${s.branch.padEnd(12)} ${sha.padEnd(12)} ${prefixCol}${originCol}${scopeCol} ${pc34.dim(when)} ${pc34.dim(s.gitUrl)}`
+        `  ${ord} ${pc35.bold(s.id.padEnd(14))} ${s.name.padEnd(24)} ${s.branch.padEnd(12)} ${sha.padEnd(12)} ${prefixCol}${originCol}${scopeCol} ${pc35.dim(when)} ${pc35.dim(s.gitUrl)}`
       );
     }
   });
@@ -43280,35 +43700,35 @@ function registerSkillsSource(program2) {
       console.log(JSON.stringify(payload, null, 2));
       return;
     }
-    console.log(pc34.bold("\u25B8 registered"));
-    console.log(`  ${pc34.bold("id:")}            ${entry.id}`);
-    console.log(`  ${pc34.bold("name:")}          ${entry.name}`);
-    console.log(`  ${pc34.bold("gitUrl:")}        ${entry.gitUrl}`);
-    console.log(`  ${pc34.bold("branch:")}        ${entry.branch}`);
-    console.log(`  ${pc34.bold("addedAt:")}       ${when}`);
-    console.log(`  ${pc34.bold("lastPulledSha:")} ${entry.lastPulledSha ?? pc34.dim("(unpulled)")}`);
-    console.log(`  ${pc34.bold("clonePath:")}     ${clonePath}`);
+    console.log(pc35.bold("\u25B8 registered"));
+    console.log(`  ${pc35.bold("id:")}            ${entry.id}`);
+    console.log(`  ${pc35.bold("name:")}          ${entry.name}`);
+    console.log(`  ${pc35.bold("gitUrl:")}        ${entry.gitUrl}`);
+    console.log(`  ${pc35.bold("branch:")}        ${entry.branch}`);
+    console.log(`  ${pc35.bold("addedAt:")}       ${when}`);
+    console.log(`  ${pc35.bold("lastPulledSha:")} ${entry.lastPulledSha ?? pc35.dim("(unpulled)")}`);
+    console.log(`  ${pc35.bold("clonePath:")}     ${clonePath}`);
     let sourceConfig;
     try {
       sourceConfig = readSourceConfig(clonePath, entry.id);
     } catch {
       sourceConfig = void 0;
     }
-    console.log(pc34.bold("\u25B8 source-config (from clone)"));
+    console.log(pc35.bold("\u25B8 source-config (from clone)"));
     if (sourceConfig === void 0) {
-      console.log(`  ${pc34.dim("(no shared/source-config.yaml in clone)")}`);
+      console.log(`  ${pc35.dim("(no shared/source-config.yaml in clone)")}`);
     } else {
-      console.log(`  ${pc34.bold("prefix:")}        ${sourceConfig.prefix ?? pc34.dim("\u2014")}`);
-      console.log(`  ${pc34.bold("prefixScope:")}   ${sourceConfig.prefixScope?.join(",") ?? pc34.dim("\u2014")}`);
+      console.log(`  ${pc35.bold("prefix:")}        ${sourceConfig.prefix ?? pc35.dim("\u2014")}`);
+      console.log(`  ${pc35.bold("prefixScope:")}   ${sourceConfig.prefixScope?.join(",") ?? pc35.dim("\u2014")}`);
     }
-    console.log(pc34.bold("\u25B8 operator overrides"));
-    console.log(`  ${pc34.bold("prefix:")}        ${entry.prefix ?? pc34.dim("\u2014")}`);
-    console.log(`  ${pc34.bold("prefixScope:")}   ${entry.prefixScope?.join(",") ?? pc34.dim("\u2014")}`);
-    console.log(`  ${pc34.bold("lastSeen:")}      ${entry.lastSeenSourcePrefix ? JSON.stringify(entry.lastSeenSourcePrefix) : pc34.dim("\u2014")}`);
+    console.log(pc35.bold("\u25B8 operator overrides"));
+    console.log(`  ${pc35.bold("prefix:")}        ${entry.prefix ?? pc35.dim("\u2014")}`);
+    console.log(`  ${pc35.bold("prefixScope:")}   ${entry.prefixScope?.join(",") ?? pc35.dim("\u2014")}`);
+    console.log(`  ${pc35.bold("lastSeen:")}      ${entry.lastSeenSourcePrefix ? JSON.stringify(entry.lastSeenSourcePrefix) : pc35.dim("\u2014")}`);
     const eff = resolveEffectivePrefix(entry, sourceConfig);
-    console.log(pc34.bold(`\u25B8 effective ${pc34.dim(`(origin: ${eff.origin})`)}`));
-    console.log(`  ${pc34.bold("prefix:")}        ${eff.prefix ?? pc34.dim("\u2014")}`);
-    console.log(`  ${pc34.bold("prefixScope:")}   ${eff.prefixScope?.join(",") ?? pc34.dim("\u2014")}`);
+    console.log(pc35.bold(`\u25B8 effective ${pc35.dim(`(origin: ${eff.origin})`)}`));
+    console.log(`  ${pc35.bold("prefix:")}        ${eff.prefix ?? pc35.dim("\u2014")}`);
+    console.log(`  ${pc35.bold("prefixScope:")}   ${eff.prefixScope?.join(",") ?? pc35.dim("\u2014")}`);
   });
   source.command("set-prefix").description(
     "Set the deploy prefix for a registered skill source (skills+agents deploy as <prefix>:<canonical-name>)"
@@ -43402,7 +43822,7 @@ import * as fs84 from "node:fs";
 import * as os47 from "node:os";
 import * as path85 from "node:path";
 import * as readline3 from "node:readline";
-import pc35 from "picocolors";
+import pc36 from "picocolors";
 
 // src/lib/skills-apply-overlays.ts
 init_markdown_merger();
@@ -43415,9 +43835,9 @@ import {
   readdirSync as readdirSync27,
   readFileSync as readFileSync79,
   readlinkSync as readlinkSync4,
-  rmSync as rmSync9,
+  rmSync as rmSync10,
   statSync as statSync27,
-  writeFileSync as writeFileSync46
+  writeFileSync as writeFileSync47
 } from "node:fs";
 import { homedir as homedir53 } from "node:os";
 import { basename as basename8, dirname as dirname51, isAbsolute as isAbsolute4, join as join93, relative as relative5, resolve as resolve22 } from "node:path";
@@ -43493,7 +43913,7 @@ function ensureRealDir(p) {
   if (stat.isSymbolicLink()) {
     const targetRaw = readlinkSync4(p);
     const target = isAbsolute4(targetRaw) ? targetRaw : resolve22(dirname51(p), targetRaw);
-    rmSync9(p);
+    rmSync10(p);
     mkdirSync55(p, { recursive: true });
     if (existsSync92(target) && statSync27(target).isDirectory()) {
       for (const entry of readdirSync27(target)) {
@@ -43534,7 +43954,7 @@ function mergeOne(upstreamPath, overlayPath, destPath2, label, dryRun, messages)
   }
   if (!dryRun) {
     mkdirSync55(dirname51(destPath2), { recursive: true });
-    writeFileSync46(destPath2, result.merged, "utf8");
+    writeFileSync47(destPath2, result.merged, "utf8");
   }
   messages.push(`MERGED ${label} \u2192 ${destPath2}${dryRun ? " (dry-run)" : ""}`);
   return { ok: true };
@@ -43706,13 +44126,13 @@ function defaultSourcePrefixSyncPrompt(input2) {
     let line;
     if (input2.kind === "first-time") {
       line = `
-${pc35.cyan("Source-config:")} ${input2.sourceName} suggests prefix ${pc35.bold(newLabel)}.
-Adopt for this host? ${pc35.dim("[Y/n] ")}`;
+${pc36.cyan("Source-config:")} ${input2.sourceName} suggests prefix ${pc36.bold(newLabel)}.
+Adopt for this host? ${pc36.dim("[Y/n] ")}`;
     } else {
       const oldLabel = formatSourcePrefix(input2.priorConfig);
       line = `
-${pc35.cyan("Source-config CHANGED:")} ${input2.sourceName} changed from ${pc35.bold(oldLabel)} to ${pc35.bold(newLabel)}.
-Accept change? ${pc35.dim("[Y/n] ")}`;
+${pc36.cyan("Source-config CHANGED:")} ${input2.sourceName} changed from ${pc36.bold(oldLabel)} to ${pc36.bold(newLabel)}.
+Accept change? ${pc36.dim("[Y/n] ")}`;
     }
     process.stdout.write(line);
     rl.question("", (a) => {
@@ -43761,9 +44181,9 @@ async function resolveAtlasUserWithPicker(cliOverride, opts) {
   const OTHER_OPTION = "[Other (type a new name)]";
   const choices = [...members, OTHER_OPTION];
   process.stdout.write("\n");
-  process.stdout.write(pc35.bold("First sync detected \u2014 pick your member name:\n"));
+  process.stdout.write(pc36.bold("First sync detected \u2014 pick your member name:\n"));
   choices.forEach((choice, i) => {
-    process.stdout.write(`  ${pc35.dim(String(i + 1) + ".")} ${choice}
+    process.stdout.write(`  ${pc36.dim(String(i + 1) + ".")} ${choice}
 `);
   });
   process.stdout.write("\n");
@@ -43798,7 +44218,7 @@ async function resolveAtlasUserWithPicker(cliOverride, opts) {
   const claudeDirPath = opts?._testClaudeDir ?? (process.env["OLAM_CLAUDE_DIR"] ?? path85.join(os47.homedir(), ".claude"));
   fs84.mkdirSync(claudeDirPath, { recursive: true });
   fs84.writeFileSync(path85.join(claudeDirPath, ".atlas-user"), picked + "\n", "utf8");
-  process.stdout.write(pc35.green(`\u2713 atlas-user set to "${picked}" (written to ${path85.join(claudeDirPath, ".atlas-user")})
+  process.stdout.write(pc36.green(`\u2713 atlas-user set to "${picked}" (written to ${path85.join(claudeDirPath, ".atlas-user")})
 `));
   return picked;
 }
@@ -43841,21 +44261,21 @@ function printSyncSummary(summary2, dryRun) {
   if (summary2.deploy) {
     console.log(`  symlinks made:   ${summary2.deploy.linked}`);
     if (summary2.deploy.shadowBackups.length > 0) {
-      console.log(`  ${pc35.yellow("shadow backups:")} ${summary2.deploy.shadowBackups.length}`);
-      for (const p of summary2.deploy.shadowBackups) console.log(`    ${pc35.dim(p)}`);
+      console.log(`  ${pc36.yellow("shadow backups:")} ${summary2.deploy.shadowBackups.length}`);
+      for (const p of summary2.deploy.shadowBackups) console.log(`    ${pc36.dim(p)}`);
     }
   }
   if (summary2.collisions.length > 0) {
-    console.log(`  ${pc35.yellow("[conflict] name collisions:")} ${summary2.collisions.length}`);
+    console.log(`  ${pc36.yellow("[conflict] name collisions:")} ${summary2.collisions.length}`);
     for (const c of summary2.collisions) {
       const winnerIdShort = c.winnerSourceId.slice(0, 8);
       console.log(
-        `    ${pc35.bold(`${c.bucket}/${c.basename}`)}: ${c.loserSourceIds.length + 1} sources export \u2014 using source [${winnerIdShort}]`
+        `    ${pc36.bold(`${c.bucket}/${c.basename}`)}: ${c.loserSourceIds.length + 1} sources export \u2014 using source [${winnerIdShort}]`
       );
-      console.log(`      ${pc35.dim("(winner)")} ${c.winnerSourcePath}`);
+      console.log(`      ${pc36.dim("(winner)")} ${c.winnerSourcePath}`);
       for (let i = 0; i < c.loserSourcePaths.length; i += 1) {
         const loserIdShort = c.loserSourceIds[i].slice(0, 8);
-        console.log(`      ${pc35.dim(`(skipped, source ${loserIdShort})`)} ${c.loserSourcePaths[i]}`);
+        console.log(`      ${pc36.dim(`(skipped, source ${loserIdShort})`)} ${c.loserSourcePaths[i]}`);
       }
     }
   }
@@ -43863,33 +44283,33 @@ function printSyncSummary(summary2, dryRun) {
     console.log(`  hooks added:     ${summary2.merge.hooksAdded}`);
     console.log(`  permissions:     ${summary2.merge.permissionsCount}`);
     if (summary2.merge.backupPath) {
-      console.log(`  settings backup: ${pc35.dim(summary2.merge.backupPath)}`);
+      console.log(`  settings backup: ${pc36.dim(summary2.merge.backupPath)}`);
     }
     if (summary2.merge.dualWriteDeduped > 0) {
-      console.log(`  ${pc35.dim(`dual-write deduped: ${summary2.merge.dualWriteDeduped} (atlas-shipped hook redundant with olam-meta block)`)}`);
+      console.log(`  ${pc36.dim(`dual-write deduped: ${summary2.merge.dualWriteDeduped} (atlas-shipped hook redundant with olam-meta block)`)}`);
       for (const cmd of summary2.merge.dualWriteDroppedCommands) {
-        console.log(`    ${pc35.dim("(dropped)")} ${cmd.slice(0, 120)}${cmd.length > 120 ? "\u2026" : ""}`);
+        console.log(`    ${pc36.dim("(dropped)")} ${cmd.slice(0, 120)}${cmd.length > 120 ? "\u2026" : ""}`);
       }
     }
   }
   if (summary2.metaHooks) {
     const mh = summary2.metaHooks;
-    const memLabel = mh.servicesStatus.memory ? pc35.green("up") : pc35.dim("down");
-    console.log(`  meta-hooks:      mode=${mh.mode} \xB7 memory=${memLabel}${mh.servicesStatus.memoryDetail ? pc35.dim(` (${mh.servicesStatus.memoryDetail})`) : ""}`);
+    const memLabel = mh.servicesStatus.memory ? pc36.green("up") : pc36.dim("down");
+    console.log(`  meta-hooks:      mode=${mh.mode} \xB7 memory=${memLabel}${mh.servicesStatus.memoryDetail ? pc36.dim(` (${mh.servicesStatus.memoryDetail})`) : ""}`);
     if (mh.autoMigrated && mh.autoMigrated.strippedCount > 0) {
       console.log(
-        `  ${pc35.cyan("~ auto-migrated:")} stripped ${mh.autoMigrated.strippedCount} atlas-toolbox-shipped agentmemory hook entry(ies); replaced by olam-injected blocks`
+        `  ${pc36.cyan("~ auto-migrated:")} stripped ${mh.autoMigrated.strippedCount} atlas-toolbox-shipped agentmemory hook entry(ies); replaced by olam-injected blocks`
       );
     }
     if (mh.blocksAdded.length > 0) {
-      console.log(`  ${pc35.green("+ injected:")} ${mh.blocksAdded.join(", ")}`);
+      console.log(`  ${pc36.green("+ injected:")} ${mh.blocksAdded.join(", ")}`);
     }
     if (mh.blocksRemoved.length > 0) {
-      console.log(`  ${pc35.yellow("- stripped:")} ${mh.blocksRemoved.join(", ")}`);
+      console.log(`  ${pc36.yellow("- stripped:")} ${mh.blocksRemoved.join(", ")}`);
     }
     if (mh.snapshotError) {
-      console.log(`  ${pc35.red("! snapshot FAILED:")} ${mh.snapshotError}`);
-      console.log(`  ${pc35.red("  (migrate-hooks-back will not be able to undo this sync)")}`);
+      console.log(`  ${pc36.red("! snapshot FAILED:")} ${mh.snapshotError}`);
+      console.log(`  ${pc36.red("  (migrate-hooks-back will not be able to undo this sync)")}`);
     }
   }
   if (summary2.prefixRewrites.length > 0) {
@@ -43901,14 +44321,14 @@ function printSyncSummary(summary2, dryRun) {
       const winnerName = allSources.find((s) => s.sourceId === col.winnerSourceId)?.name ?? col.winnerSourceId.slice(0, 8);
       const loserNames = col.loserSourceIds.map((id) => allSources.find((s) => s.sourceId === id)?.name ?? id.slice(0, 8)).join(", ");
       console.log(
-        `  ${pc35.yellow(`\u26A0 prefix collision: '${col.prefix}' used by ${winnerName} (winner) + ${loserNames}; first-registered wins`)}`
+        `  ${pc36.yellow(`\u26A0 prefix collision: '${col.prefix}' used by ${winnerName} (winner) + ${loserNames}; first-registered wins`)}`
       );
     }
   }
   console.log();
   for (const s of summary2.perSource) {
     const sub = s.fromSubscriptionsFile ? "(subscribed)" : "(all categories)";
-    console.log(`  ${pc35.bold(s.name.padEnd(24))} ${s.artifactCount} artifacts \xB7 ${s.categories.join(", ") || "(none)"} ${pc35.dim(sub)}`);
+    console.log(`  ${pc36.bold(s.name.padEnd(24))} ${s.artifactCount} artifacts \xB7 ${s.categories.join(", ") || "(none)"} ${pc36.dim(sub)}`);
   }
 }
 function registerSkills(program2) {
@@ -43986,7 +44406,7 @@ function registerSkills(program2) {
       return;
     }
     if (entries.length === 0) {
-      console.log(pc35.dim('0 deployed artifact(s). Run "olam skills sync" first.'));
+      console.log(pc36.dim('0 deployed artifact(s). Run "olam skills sync" first.'));
       return;
     }
     const byBucket = /* @__PURE__ */ new Map();
@@ -43997,10 +44417,10 @@ function registerSkills(program2) {
     }
     printHeader(`${entries.length} deployed artifact(s)`);
     for (const [bucket, list] of byBucket.entries()) {
-      console.log(`  ${pc35.bold(bucket)} (${list.length})`);
+      console.log(`  ${pc36.bold(bucket)} (${list.length})`);
       for (const e of list) {
-        const src = e.sourceId ? `[${e.sourceId}]` : pc35.yellow("[unknown]");
-        console.log(`    ${e.name.padEnd(40)} ${pc35.dim(src)} \u2192 ${pc35.dim(e.target)}`);
+        const src = e.sourceId ? `[${e.sourceId}]` : pc36.yellow("[unknown]");
+        console.log(`    ${e.name.padEnd(40)} ${pc36.dim(src)} \u2192 ${pc36.dim(e.target)}`);
       }
     }
   });
@@ -44013,10 +44433,10 @@ function registerSkills(program2) {
       return;
     }
     for (const e of matches2) {
-      console.log(`${pc35.bold("bucket:")}   ${e.bucket}`);
-      console.log(`${pc35.bold("name:")}     ${e.name}`);
-      console.log(`${pc35.bold("target:")}   ${e.target}`);
-      console.log(`${pc35.bold("source:")}   ${e.sourceId ?? pc35.dim("(unknown \u2014 not from a registered olam source)")}`);
+      console.log(`${pc36.bold("bucket:")}   ${e.bucket}`);
+      console.log(`${pc36.bold("name:")}     ${e.name}`);
+      console.log(`${pc36.bold("target:")}   ${e.target}`);
+      console.log(`${pc36.bold("source:")}   ${e.sourceId ?? pc36.dim("(unknown \u2014 not from a registered olam source)")}`);
       console.log();
     }
   });
@@ -44111,7 +44531,7 @@ function registerSkillsHook(program2) {
 // src/commands/skills-onboard.ts
 init_skill_sources();
 init_output();
-import pc36 from "picocolors";
+import pc37 from "picocolors";
 function asMessage5(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -44264,7 +44684,7 @@ function registerSkillsOnboard(program2) {
     }
     printInfo("sync", `${syncedArtifacts} artifact(s) deployed`);
     console.log();
-    console.log(pc36.dim("  Open a new Claude Code session to pick up the deployed skills."));
+    console.log(pc37.dim("  Open a new Claude Code session to pick up the deployed skills."));
   });
 }
 
@@ -44619,7 +45039,7 @@ init_atlas_hook_strip();
 init_output();
 import * as fs88 from "node:fs";
 import * as path88 from "node:path";
-import pc37 from "picocolors";
+import pc38 from "picocolors";
 var MIGRATE_HOOKS_COMMAND = "migrate-hooks";
 function settingsHasOlamMetaSentinel(settings) {
   for (const stage of ["PreToolUse", "PostToolUse"]) {
@@ -44656,12 +45076,12 @@ function printSummary(candidates2, opts) {
     return;
   }
   const verb = opts.dryRun ? "would strip" : "stripped";
-  console.log(pc37.bold(`${verb} ${candidates2.length} atlas-toolbox-shipped agentmemory hook entry(ies):`));
+  console.log(pc38.bold(`${verb} ${candidates2.length} atlas-toolbox-shipped agentmemory hook entry(ies):`));
   for (const c of candidates2) {
     const matcher = c.matcher ?? "*";
     const cmdPreview = c.command.length > 120 ? `${c.command.slice(0, 117)}...` : c.command;
-    console.log(`  ${pc37.dim(`[${c.stage}]`)} matcher=${pc37.cyan(matcher)} pattern=${pc37.yellow(c.matchedPattern)}`);
-    console.log(`    ${pc37.dim(cmdPreview)}`);
+    console.log(`  ${pc38.dim(`[${c.stage}]`)} matcher=${pc38.cyan(matcher)} pattern=${pc38.yellow(c.matchedPattern)}`);
+    console.log(`    ${pc38.dim(cmdPreview)}`);
   }
   if (opts.snapshotPath) {
     console.log();
@@ -44784,7 +45204,7 @@ function registerSkillsMigrateHooksBack(program2) {
 init_skill_sources();
 init_output();
 import * as fs89 from "node:fs";
-import pc38 from "picocolors";
+import pc39 from "picocolors";
 function asMessage10(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -44808,7 +45228,7 @@ function printBackupRows(backups) {
   for (const b of backups) {
     const when = new Date(b.epochSeconds * 1e3).toISOString().slice(0, 10);
     console.log(
-      `  ${pc38.dim(formatAge3(b.ageMs).padStart(6))}  ${formatSize(b.sizeBytes).padStart(7)}  ${pc38.dim(when)}  ${b.bucket}/${pc38.bold(b.basename)}`
+      `  ${pc39.dim(formatAge3(b.ageMs).padStart(6))}  ${formatSize(b.sizeBytes).padStart(7)}  ${pc39.dim(when)}  ${b.bucket}/${pc39.bold(b.basename)}`
     );
   }
 }
@@ -44818,11 +45238,11 @@ function registerSkillsShadowBackups(program2) {
   sb.command("list").description("List all shadow-backup files under ~/.claude/").action(() => {
     const all = listShadowBackups();
     if (all.length === 0) {
-      console.log(pc38.dim("No shadow-backup files under ~/.claude/."));
+      console.log(pc39.dim("No shadow-backup files under ~/.claude/."));
       return;
     }
     printHeader(`${all.length} shadow backup(s)`);
-    console.log(pc38.dim("   age      size  created     bucket/basename"));
+    console.log(pc39.dim("   age      size  created     bucket/basename"));
     printBackupRows(all);
   });
   sb.command("prune").description("Delete shadow-backup files older than a duration (e.g. 30d) OR all of them with --all --force").option("--older-than <duration>", "Delete backups older than this duration (e.g. 30d, 7d, 24h, 2w)", "30d").option("--all", "Delete every shadow-backup file (requires --force)").option("--force", "Confirm deletion when --all is used").option("--dry-run", "Show what would be deleted without deleting").action((opts) => {
@@ -44849,13 +45269,13 @@ function registerSkillsShadowBackups(program2) {
       const result = pruneShadowBackups(pruneOpts);
       const action = opts.dryRun ? "would delete" : "deleted";
       if (result.deleted.length === 0) {
-        console.log(pc38.dim(`No shadow-backups match \u2014 ${result.skipped.length} kept`));
+        console.log(pc39.dim(`No shadow-backups match \u2014 ${result.skipped.length} kept`));
         return;
       }
       printHeader(`${action} ${result.deleted.length} shadow backup(s) (${result.skipped.length} kept)`);
       printBackupRows(result.deleted);
       if (opts.dryRun) {
-        console.log(pc38.dim("\n(dry-run \u2014 re-run without --dry-run to delete)"));
+        console.log(pc39.dim("\n(dry-run \u2014 re-run without --dry-run to delete)"));
       } else {
         printSuccess(`pruned ${result.deleted.length} backup(s)`);
       }
@@ -44884,7 +45304,7 @@ function registerSkillsShadowBackups(program2) {
 init_skill_sources();
 init_output();
 import * as readline4 from "node:readline";
-import pc39 from "picocolors";
+import pc40 from "picocolors";
 function asMessage11(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -44907,16 +45327,16 @@ async function confirmRepair(check) {
 }
 function printCheck(check) {
   if (check.healthy) {
-    console.log(`  ${pc39.green("\u2713")} ${pc39.bold(check.name.padEnd(22))} ${pc39.dim(check.description)}`);
+    console.log(`  ${pc40.green("\u2713")} ${pc40.bold(check.name.padEnd(22))} ${pc40.dim(check.description)}`);
     if (check.details && check.details.length > 0) {
-      for (const d of check.details) console.log(`      ${pc39.dim(d)}`);
+      for (const d of check.details) console.log(`      ${pc40.dim(d)}`);
     }
   } else {
-    console.log(`  ${pc39.red("\u2717")} ${pc39.bold(check.name.padEnd(22))} ${pc39.yellow(check.issue ?? "unhealthy")}`);
-    console.log(`      ${pc39.dim(check.description)}`);
+    console.log(`  ${pc40.red("\u2717")} ${pc40.bold(check.name.padEnd(22))} ${pc40.yellow(check.issue ?? "unhealthy")}`);
+    console.log(`      ${pc40.dim(check.description)}`);
     if (check.details) {
-      for (const d of check.details.slice(0, 10)) console.log(`      ${pc39.dim("\xB7 " + d)}`);
-      if (check.details.length > 10) console.log(`      ${pc39.dim(`\u2026 and ${check.details.length - 10} more`)}`);
+      for (const d of check.details.slice(0, 10)) console.log(`      ${pc40.dim("\xB7 " + d)}`);
+      if (check.details.length > 10) console.log(`      ${pc40.dim(`\u2026 and ${check.details.length - 10} more`)}`);
     }
   }
 }
@@ -44947,7 +45367,7 @@ function registerSkillsDoctor(program2) {
     console.log();
     printWarning(`${unhealthy.length} of ${checks.length} check(s) report issues`);
     if (opts.checkOnly) {
-      console.log(pc39.dim("(--check-only \u2014 exiting without repair)"));
+      console.log(pc40.dim("(--check-only \u2014 exiting without repair)"));
       process.exitCode = 1;
       return;
     }
@@ -44955,19 +45375,19 @@ function registerSkillsDoctor(program2) {
     let skipped = 0;
     for (const check of unhealthy) {
       if (!check.repair) {
-        console.log(pc39.dim(`  (no auto-repair for ${check.name} \u2014 operator-attention required)`));
+        console.log(pc40.dim(`  (no auto-repair for ${check.name} \u2014 operator-attention required)`));
         skipped += 1;
         continue;
       }
       const shouldRepair = opts.autoFix ? true : await confirmRepair(check);
       if (!shouldRepair) {
-        console.log(pc39.dim(`  skipped: ${check.name}`));
+        console.log(pc40.dim(`  skipped: ${check.name}`));
         skipped += 1;
         continue;
       }
       try {
         await check.repair();
-        console.log(pc39.green(`  repaired: ${check.name}`));
+        console.log(pc40.green(`  repaired: ${check.name}`));
         repaired += 1;
       } catch (err) {
         printError(`  repair failed for ${check.name}: ${asMessage11(err)}`);
@@ -45898,7 +46318,7 @@ function registerMcpAdd(cmd) {
 
 // src/commands/mcp/list.ts
 init_output();
-import pc40 from "picocolors";
+import pc41 from "picocolors";
 function registerMcpList(cmd) {
   cmd.command("list").description("List all registered MCP credentials").action(async () => {
     const client = getMcpAuthClient();
@@ -45913,8 +46333,8 @@ function registerMcpList(cmd) {
     }
     const mcps = data.mcps ?? [];
     if (mcps.length === 0) {
-      console.log(pc40.dim("No MCP credentials registered."));
-      console.log(pc40.dim("Add one with: olam mcp add <service>"));
+      console.log(pc41.dim("No MCP credentials registered."));
+      console.log(pc41.dim("Add one with: olam mcp add <service>"));
       return;
     }
     const [c0, c1, c2, c3] = [16, 20, 10, 24];
@@ -45925,12 +46345,12 @@ function registerMcpList(cmd) {
       "ENV VAR".padEnd(c3),
       "STATUS"
     ].join("  ");
-    console.log(pc40.dim(header));
-    console.log(pc40.dim("\u2500".repeat(header.length)));
+    console.log(pc41.dim(header));
+    console.log(pc41.dim("\u2500".repeat(header.length)));
     for (const m of mcps) {
-      const status2 = !m.validated ? pc40.yellow("unvalidated") : m.expired ? pc40.red("expired") : pc40.green("active");
+      const status2 = !m.validated ? pc41.yellow("unvalidated") : m.expired ? pc41.red("expired") : pc41.green("active");
       const row = [
-        pc40.cyan(m.service.padEnd(c0)),
+        pc41.cyan(m.service.padEnd(c0)),
         m.label.padEnd(c1).slice(0, c1),
         m.type.padEnd(c2),
         (m.envName ?? "\u2014").padEnd(c3).slice(0, c3),
@@ -45958,13 +46378,13 @@ function registerMcpRemove(cmd) {
 
 // src/commands/mcp/status.ts
 init_output();
-import pc41 from "picocolors";
+import pc42 from "picocolors";
 function formatExpiry(expiresAt) {
   if (!expiresAt) return "\u2014";
   const ms = expiresAt - Date.now();
-  if (ms <= 0) return pc41.red("expired");
+  if (ms <= 0) return pc42.red("expired");
   const hours = ms / (1e3 * 60 * 60);
-  if (hours < 1) return pc41.yellow(`${Math.ceil(ms / 6e4)}m`);
+  if (hours < 1) return pc42.yellow(`${Math.ceil(ms / 6e4)}m`);
   return `${hours.toFixed(1)}h`;
 }
 function registerMcpStatus(cmd) {
@@ -45981,14 +46401,14 @@ function registerMcpStatus(cmd) {
     const mcps = data.mcps ?? [];
     printHeader(`MCP Credentials (${mcps.length})`);
     if (mcps.length === 0) {
-      console.log(pc41.dim("No credentials registered."));
+      console.log(pc42.dim("No credentials registered."));
       return;
     }
     for (const m of mcps) {
-      const stateColor = !m.validated ? pc41.yellow : m.expired ? pc41.red : pc41.green;
+      const stateColor = !m.validated ? pc42.yellow : m.expired ? pc42.red : pc42.green;
       const stateLabel = !m.validated ? "unvalidated" : m.expired ? "expired" : "active";
       console.log(`
-  ${pc41.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
+  ${pc42.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
       console.log(`    label:      ${m.label}`);
       console.log(`    type:       ${m.type}`);
       if (m.envName) console.log(`    env var:    ${m.envName}`);
@@ -46003,7 +46423,7 @@ function registerMcpStatus(cmd) {
 // src/commands/mcp/import.ts
 init_output();
 import * as readline6 from "node:readline";
-import pc42 from "picocolors";
+import pc43 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
 import * as fs92 from "node:fs";
@@ -46173,13 +46593,13 @@ async function validateMcpEntry(entry) {
 // src/commands/mcp/import.ts
 async function multiSelectPicker(entries) {
   if (entries.length === 0) return [];
-  console.log("\n" + pc42.bold("Discovered MCP servers:"));
+  console.log("\n" + pc43.bold("Discovered MCP servers:"));
   entries.forEach((e, i) => {
     console.log(
-      `  ${pc42.dim(`[${i + 1}]`)} ${pc42.cyan(e.name.padEnd(20))} ${pc42.dim(e.sourceLabel)}`
+      `  ${pc43.dim(`[${i + 1}]`)} ${pc43.cyan(e.name.padEnd(20))} ${pc43.dim(e.sourceLabel)}`
     );
   });
-  console.log("\n" + pc42.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
+  console.log("\n" + pc43.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
   const answer = await new Promise((resolve28) => {
     const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("> ", (ans) => {
@@ -46206,7 +46626,7 @@ function registerMcpImport(cmd) {
     const repoPaths = opts.repoPaths ? opts.repoPaths.split(",").map((s) => s.trim()) : void 0;
     const { entries, sources, durationMs } = await discoverMcpSources(repoPaths);
     if (entries.length === 0) {
-      console.log(pc42.dim("No MCP servers found in any source path."));
+      console.log(pc43.dim("No MCP servers found in any source path."));
       return;
     }
     printInfo("Sources", sources.length > 0 ? sources.join(", ") : "none");
@@ -46219,15 +46639,15 @@ function registerMcpImport(cmd) {
       candidates2 = filtered;
     }
     if (skippedCount > 0) {
-      console.log(pc42.dim(`skipped: ${skippedCount} already registered`));
+      console.log(pc43.dim(`skipped: ${skippedCount} already registered`));
     }
     if (candidates2.length === 0) {
-      console.log(pc42.dim("Nothing new to import. Use --reimport to force."));
+      console.log(pc43.dim("Nothing new to import. Use --reimport to force."));
       return;
     }
     const selected = await multiSelectPicker(candidates2);
     if (selected.length === 0) {
-      console.log(pc42.dim("No servers selected."));
+      console.log(pc43.dim("No servers selected."));
       return;
     }
     console.log(`
@@ -46238,16 +46658,16 @@ Importing ${selected.length} server(s)\u2026`);
       let validated = false;
       let validationReason = "skipped";
       if (opts.validate !== false) {
-        process.stdout.write(`  ${pc42.dim("\u2192")} ${entry.name}  validating\u2026 `);
+        process.stdout.write(`  ${pc43.dim("\u2192")} ${entry.name}  validating\u2026 `);
         const vr = await validateMcpEntry(entry);
         validated = vr.validated;
         validationReason = vr.reason;
         process.stdout.write(
-          validated ? pc42.green("ok\n") : pc42.yellow(`unvalidated (${vr.reason})
+          validated ? pc43.green("ok\n") : pc43.yellow(`unvalidated (${vr.reason})
 `)
         );
       } else {
-        console.log(`  ${pc42.dim("\u2192")} ${entry.name}  ${pc42.dim("(validation skipped)")}`);
+        console.log(`  ${pc43.dim("\u2192")} ${entry.name}  ${pc43.dim("(validation skipped)")}`);
       }
       if (validated) validatedCount++;
       const result = await client.staticAdd({
@@ -46262,21 +46682,21 @@ Importing ${selected.length} server(s)\u2026`);
       }
     }
     console.log("");
-    console.log(pc42.green(`\u2713 Imported ${importedCount}/${selected.length}`));
+    console.log(pc43.green(`\u2713 Imported ${importedCount}/${selected.length}`));
     if (validatedCount > 0) {
-      console.log(pc42.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
+      console.log(pc43.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
     }
   });
 }
 
 // src/commands/mcp/revoke.ts
 init_output();
-import pc43 from "picocolors";
+import pc44 from "picocolors";
 function registerMcpRevoke(cmd) {
   cmd.command("revoke <user> <world> <service>").description("Revoke a user's MCP service entitlement (multi-tenant mode only)").action(async (user, world, service) => {
     const multiTenant = (process.env["OLAM_MCP_MULTI_TENANT"] ?? "").toLowerCase() === "true";
     if (!multiTenant) {
-      console.warn(pc43.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
+      console.warn(pc44.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
       return;
     }
     const baseUrl = process.env["OLAM_MCP_AUTH_SERVICE_URL"] ?? "http://127.0.0.1:9998";
@@ -46305,8 +46725,8 @@ function registerMcpRevoke(cmd) {
       process.exitCode = 1;
       return;
     }
-    console.log(pc43.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
-    console.log(pc43.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
+    console.log(pc44.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
+    console.log(pc44.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
   });
 }
 
@@ -46849,7 +47269,7 @@ function registerMemoryUninstall(cmd) {
 // src/commands/memory/mode.ts
 init_schema2();
 init_output();
-import { existsSync as existsSync106, readFileSync as readFileSync88, writeFileSync as writeFileSync52 } from "node:fs";
+import { existsSync as existsSync106, readFileSync as readFileSync88, writeFileSync as writeFileSync53 } from "node:fs";
 import { join as join101 } from "node:path";
 import * as readline7 from "node:readline/promises";
 import { parse as parseYaml8, stringify as stringifyYaml6 } from "yaml";
@@ -46873,7 +47293,7 @@ function readConfigYaml(absPath) {
 }
 function writeConfigYaml(absPath, parsed) {
   const out = stringifyYaml6(parsed, { aliasDuplicateObjects: false });
-  writeFileSync52(absPath, out, "utf-8");
+  writeFileSync53(absPath, out, "utf-8");
 }
 async function defaultPromptText(question) {
   const rl = readline7.createInterface({ input: process.stdin, output: process.stdout });
@@ -47351,7 +47771,7 @@ function registerMemoryStats(cmd) {
 }
 
 // src/commands/memory/install-hooks.ts
-import { copyFileSync as copyFileSync12, existsSync as existsSync108, mkdirSync as mkdirSync61, readFileSync as readFileSync89, writeFileSync as writeFileSync53 } from "node:fs";
+import { copyFileSync as copyFileSync12, existsSync as existsSync108, mkdirSync as mkdirSync61, readFileSync as readFileSync89, writeFileSync as writeFileSync54 } from "node:fs";
 import { homedir as homedir58 } from "node:os";
 import { dirname as dirname58, join as join103, resolve as resolve26 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
@@ -47378,7 +47798,7 @@ function installOne2(basename17, sourceDir, targetDir, opts) {
   if (!existsSync108(targetPath)) {
     if (opts.dryRun !== true) {
       mkdirSync61(dirname58(targetPath), { recursive: true });
-      writeFileSync53(targetPath, newContent, { mode: 493 });
+      writeFileSync54(targetPath, newContent, { mode: 493 });
     }
     return { basename: basename17, action: "written", targetPath };
   }
@@ -47390,7 +47810,7 @@ function installOne2(basename17, sourceDir, targetDir, opts) {
     const backupPath = `${targetPath}.agentmemory-hook-backup-${Math.floor(Date.now() / 1e3)}`;
     if (opts.dryRun !== true) {
       copyFileSync12(targetPath, backupPath);
-      writeFileSync53(targetPath, newContent, { mode: 493 });
+      writeFileSync54(targetPath, newContent, { mode: 493 });
     }
     return { basename: basename17, action: "force-overwritten", targetPath, backupPath };
   }
@@ -47974,7 +48394,7 @@ function registerKgWatchCommand(kg) {
 }
 
 // src/commands/kg-classify.ts
-import pc44 from "picocolors";
+import pc45 from "picocolors";
 init_output();
 function formatSavedTokens(n) {
   if (n >= 1e6) return `~${(n / 1e6).toFixed(1)}M`;
@@ -47989,7 +48409,7 @@ function registerKgClassifyCommand(kg) {
         process.stdout.write(JSON.stringify(result, null, 2) + "\n");
         return;
       }
-      const routeStr = result.route === "kg" ? pc44.cyan("kg") : result.route === "grep" ? pc44.magenta("grep") : pc44.yellow("both");
+      const routeStr = result.route === "kg" ? pc45.cyan("kg") : result.route === "grep" ? pc45.magenta("grep") : pc45.yellow("both");
       printInfo("route", `${routeStr}  (layer ${result.layer}, took ${result.took_ms}ms)`);
       printInfo("confidence", String(result.confidence));
       printInfo("reason", result.reason);
@@ -48019,7 +48439,7 @@ function registerKgClassifyCommand(kg) {
 }
 
 // src/commands/kg-doctor.ts
-import pc45 from "picocolors";
+import pc46 from "picocolors";
 init_output();
 function formatUptime(seconds) {
   if (!Number.isFinite(seconds) || seconds < 0) return "?";
@@ -48181,12 +48601,12 @@ async function runKgDoctor(opts, deps = {}) {
   } else {
     printHeader("kg-service doctor");
     for (const p of probes) {
-      const badge = p.status === "ok" ? pc45.green("\u2713") : p.status === "warn" ? pc45.yellow("\u2298") : pc45.red("\u2717");
+      const badge = p.status === "ok" ? pc46.green("\u2713") : p.status === "warn" ? pc46.yellow("\u2298") : pc46.red("\u2717");
       const label = `${badge}  ${p.name}`;
       const detail = p.detail ?? "";
       printInfo(label, detail);
       if (p.remedy) {
-        process.stderr.write(`      ${pc45.dim("remedy:")} ${p.remedy}
+        process.stderr.write(`      ${pc46.dim("remedy:")} ${p.remedy}
 `);
       }
     }
@@ -49490,7 +49910,7 @@ ${formatRedivergencePrompt(persona_a, persona_b, score, void 0, void 0, threshol
 }
 
 // src/commands/flywheel/ping.ts
-import { mkdirSync as mkdirSync65, writeFileSync as writeFileSync57 } from "node:fs";
+import { mkdirSync as mkdirSync65, writeFileSync as writeFileSync58 } from "node:fs";
 import { homedir as homedir65 } from "node:os";
 import { dirname as dirname62, join as join109 } from "node:path";
 var COLD_START_BUDGET_GOOD_MS = 200;
@@ -49510,7 +49930,7 @@ function readOlamVersion() {
 function writeBaseline(record) {
   const baselinePath = join109(homedir65(), ".local", "share", "olam", "flywheel-baseline.json");
   mkdirSync65(dirname62(baselinePath), { recursive: true });
-  writeFileSync57(baselinePath, JSON.stringify(record, null, 2) + "\n", "utf8");
+  writeFileSync58(baselinePath, JSON.stringify(record, null, 2) + "\n", "utf8");
   return baselinePath;
 }
 function registerFlywheelPing(parent) {
@@ -49555,7 +49975,7 @@ import {
   readFileSync as readFileSync97,
   readdirSync as readdirSync32,
   statSync as statSync32,
-  writeFileSync as writeFileSync58
+  writeFileSync as writeFileSync59
 } from "node:fs";
 import { spawnSync as spawnSync31 } from "node:child_process";
 import { homedir as homedir66 } from "node:os";
@@ -50035,10 +50455,10 @@ function initMember(opts) {
   }
   try {
     mkdirSync66(join110(memberDir, "skills.overrides"), { recursive: true });
-    writeFileSync58(join110(memberDir, "skills.overrides", ".gitkeep"), "");
+    writeFileSync59(join110(memberDir, "skills.overrides", ".gitkeep"), "");
     mkdirSync66(join110(memberDir, "agents.overrides"), { recursive: true });
-    writeFileSync58(join110(memberDir, "agents.overrides", ".gitkeep"), "");
-    writeFileSync58(
+    writeFileSync59(join110(memberDir, "agents.overrides", ".gitkeep"), "");
+    writeFileSync59(
       join110(memberDir, "README.md"),
       `# Member overlays for \`${memberName}\`
 
@@ -50110,7 +50530,7 @@ function migrateOverlays(opts = {}) {
       continue;
     }
     if (opts.dryRun !== true) {
-      writeFileSync58(filePath, newContent, "utf8");
+      writeFileSync59(filePath, newContent, "utf8");
     }
     summary2.modified += 1;
     summary2.totalReplacements += totalReplacements;
@@ -50353,7 +50773,7 @@ function registerFlywheelSessionStart(parent) {
 // src/commands/flywheel/install-sessionstart-hook.ts
 init_merge_settings();
 init_output();
-import { existsSync as existsSync114, copyFileSync as copyFileSync16, mkdirSync as mkdirSync67, readFileSync as readFileSync99, unlinkSync as unlinkSync25, writeFileSync as writeFileSync59 } from "node:fs";
+import { existsSync as existsSync114, copyFileSync as copyFileSync16, mkdirSync as mkdirSync67, readFileSync as readFileSync99, unlinkSync as unlinkSync25, writeFileSync as writeFileSync60 } from "node:fs";
 import { homedir as homedir68 } from "node:os";
 import { dirname as dirname64, join as join112 } from "node:path";
 var SESSIONSTART_HOOK_STAGE = "SessionStart";
@@ -50443,7 +50863,7 @@ function uninstallSessionStartHook(filePath) {
       delete next.hooks.SessionStart;
     }
   }
-  writeFileSync59(filePath, JSON.stringify(next, null, 2) + "\n");
+  writeFileSync60(filePath, JSON.stringify(next, null, 2) + "\n");
   return { status: "removed", filePath };
 }
 function registerFlywheelInstallSessionStartHook(parent) {
@@ -50910,7 +51330,7 @@ import * as childProcess2 from "node:child_process";
 import * as fs99 from "node:fs";
 import * as os54 from "node:os";
 import * as path99 from "node:path";
-import pc46 from "picocolors";
+import pc47 from "picocolors";
 var YOLO_BOOT_DELAY_MS = 8e3;
 var CAPTURE_DELAY_MS = 4e3;
 var TMUX_PROBE_PATHS = [
@@ -51137,13 +51557,13 @@ function registerYolo(program2) {
       if (opts.list) {
         const windows = listYoloWindows();
         if (windows.length === 0) {
-          console.log(pc46.dim("No active yolo windows found (tmux session 0)."));
+          console.log(pc47.dim("No active yolo windows found (tmux session 0)."));
           return;
         }
         printHeader(`${windows.length} yolo window(s)`);
         for (const w of windows) {
-          const wt = w.worktreePath ? pc46.dim(w.worktreePath) : pc46.dim("(no worktree)");
-          console.log(`  ${pc46.bold(w.name.padEnd(24))} ${wt}`);
+          const wt = w.worktreePath ? pc47.dim(w.worktreePath) : pc47.dim("(no worktree)");
+          console.log(`  ${pc47.bold(w.name.padEnd(24))} ${wt}`);
         }
         return;
       }
@@ -51190,7 +51610,7 @@ function registerYolo(program2) {
         printInfo("Attach", result.attachHint);
         if (result.yoloFallbackUsed) {
           console.log(
-            pc46.dim(
+            pc47.dim(
               "  [note] yolo alias not found on PATH \u2014 used ~/.local/bin/claude --dangerously-skip-permissions"
             )
           );