@pleri/olam-cli 0.1.195 → 0.1.196

package/dist/index.js

@@ -7751,6 +7751,19 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync14, readdirSync as readdirSync2, readFileSync as readFileSync14, statSync } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import path14 from "node:path";
+function resolveAnthropicBaseUrl(olamHomeOverride) {
+  const envFirst = process.env.OLAM_ANTHROPIC_BASE_URL ?? process.env.ANTHROPIC_BASE_URL;
+  if (envFirst && envFirst.trim().length > 0) return envFirst.trim();
+  try {
+    const olamHome6 = olamHomeOverride ?? process.env.OLAM_HOME ?? path14.join(homedir9(), ".olam");
+    const filePath = path14.join(olamHome6, "anthropic-base-url");
+    if (!existsSync14(filePath)) return null;
+    const body = readFileSync14(filePath, "utf-8").trim();
+    return body.length > 0 ? body : null;
+  } catch {
+    return null;
+  }
+}
 async function probeDockerDaemon(dockerExec = defaultDockerExec) {
   const r = dockerExec("docker", ["info", "--format", "{{.ServerVersion}}"]);
   if (r.status === 0 && r.stdout.trim().length > 0) {
@@ -7854,6 +7867,11 @@ function isHostCpHealthEnvelope(body) {
   return true;
 }
 async function probeAuthVault(olamHomeOverride) {
+  const remoteUrl = resolveAnthropicBaseUrl(olamHomeOverride);
+  if (remoteUrl !== null) {
+    const safeUrl = remoteUrl.replace(/\/\/[^@/]*@/, "//<redacted>@");
+    return { ok: true, message: `remote auth-worker configured (${safeUrl})` };
+  }
   const vaultPath = resolveAccountsPath(olamHomeOverride);
   if (!existsSync14(vaultPath)) {
     return {
@@ -11210,14 +11228,14 @@ var init_olam_yaml = __esm({
 // ../core/dist/policies/loader.js
 import * as fs20 from "node:fs";
 import * as path23 from "node:path";
-import { parse as parseYaml3 } from "yaml";
+import { parse as parseYaml4 } from "yaml";
 function parseFrontmatter(content) {
   const match2 = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
   if (!match2)
     return null;
   const [, yamlText = "", body = ""] = match2;
   try {
-    const frontmatter = parseYaml3(yamlText);
+    const frontmatter = parseYaml4(yamlText);
     return { frontmatter, body };
   } catch {
     return null;
@@ -11477,7 +11495,17 @@ var init_source_config_schema = __esm({
        * `SkillSourceSchema.prefixScope`. Operators inherit this when their
        * `~/.olam/config.json` has no explicit `prefixScope` override.
        */
-      prefixScope: external_exports.array(external_exports.enum(["skill", "agent"])).optional()
+      prefixScope: external_exports.array(external_exports.enum(["skill", "agent"])).optional(),
+      /**
+       * Source's RECOMMENDED prefixTarget patterns. Same semantics as
+       * operator-side `SkillSourceSchema.prefixTarget`: an array of glob
+       * patterns (only `*` wildcard) that restrict which canonical names are
+       * renamed. Operators inherit this when their `~/.olam/config.json` has
+       * no explicit `prefixTarget` override.
+       *
+       * See: docs/decisions/022-prefix-target-name-patterns.md.
+       */
+      prefixTarget: external_exports.array(external_exports.string().min(1, "prefixTarget pattern must be a non-empty string")).optional()
     }).strict();
     SourceConfigSnapshotSchema = SourceConfigSchema;
   }
@@ -11523,6 +11551,29 @@ var init_schema3 = __esm({
        * NOT applicable when `prefix` is undefined.
        */
       prefixScope: external_exports.array(external_exports.enum(["skill", "agent"])).optional(),
+      /**
+       * Restrict prefix renaming to canonical names matching at least one glob
+       * pattern. Patterns support `*` as a wildcard (zero or more chars); no
+       * other metacharacters. Examples:
+       *
+       *   `['*']`             — rename ALL skills/agents (DEFAULT — today's behavior)
+       *   `['10x:*']`         — rename only canonicals that start with `10x:`
+       *   `['10x:*', 'atl:*']`— match either namespace
+       *   `['plan-*']`        — match a name-family prefix
+       *
+       * When `prefixTarget` is undefined OR `['*']`, all kind-allowed artifacts are
+       * renamed (identical to the pre-ADR-022 behavior — full backward compat).
+       *
+       * When set, artifacts whose canonical name does NOT match ANY pattern are
+       * deployed WITHOUT a prefix (canonical-only). No error is raised; `sync`
+       * output emits a `[prefix-target: <n> skipped]` warning so operators can
+       * detect misconfigured patterns.
+       *
+       * NOT applicable when `prefix` is undefined.
+       *
+       * See: docs/decisions/022-prefix-target-name-patterns.md.
+       */
+      prefixTarget: external_exports.array(external_exports.string().min(1, "prefixTarget pattern must be a non-empty string")).optional(),
       /**
        * Snapshot of the LAST source-config.yaml content this operator saw +
        * consented to (ADR-021). Trust-gate state: when the live source-config
@@ -16818,11 +16869,11 @@ var init_home_override = __esm({
 // ../core/dist/world/world-yaml.js
 import * as fs40 from "node:fs";
 import * as path41 from "node:path";
-import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
+import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
 function writeWorldYaml(worldPath, data) {
   const olamDir = path41.join(worldPath, ".olam");
   fs40.mkdirSync(olamDir, { recursive: true });
-  fs40.writeFileSync(path41.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
+  fs40.writeFileSync(path41.join(olamDir, "world.yaml"), stringifyYaml5(data), "utf-8");
 }
 function readWorldYaml(worldPath) {
   const yamlPath = path41.join(worldPath, ".olam", "world.yaml");
@@ -16830,7 +16881,7 @@ function readWorldYaml(worldPath) {
     return null;
   try {
     const raw = fs40.readFileSync(yamlPath, "utf-8");
-    const parsed = parseYaml4(raw);
+    const parsed = parseYaml5(raw);
     return WorldYamlSchema.parse(parsed);
   } catch {
     return null;
@@ -17151,6 +17202,18 @@ function updateSkillSource(id, patch) {
   } else if (patch.prefixScope !== void 0) {
     working = { ...working, prefixScope: [...patch.prefixScope] };
   }
+  if (patch.prefixTarget === null) {
+    const { prefixTarget: _t, ...rest } = working;
+    void _t;
+    working = rest;
+  } else if (patch.prefixTarget !== void 0) {
+    for (const p of patch.prefixTarget) {
+      if (typeof p !== "string" || p.length === 0) {
+        throw new Error(`prefixTarget patterns must be non-empty strings \u2014 got ${JSON.stringify(p)}`);
+      }
+    }
+    working = { ...working, prefixTarget: [...patch.prefixTarget] };
+  }
   if (patch.lastSeenSourcePrefix === null) {
     const { lastSeenSourcePrefix: _l, ...rest } = working;
     void _l;
@@ -18482,7 +18545,7 @@ var init_schema5 = __esm({
 import { execFileSync as execFileSync16 } from "node:child_process";
 import * as fs68 from "node:fs";
 import * as path67 from "node:path";
-import { parse as parseYaml5 } from "yaml";
+import { parse as parseYaml6 } from "yaml";
 function findProjectOverride(startDir) {
   let dir = path67.resolve(startDir);
   const root = path67.parse(dir).root;
@@ -18492,7 +18555,7 @@ function findProjectOverride(startDir) {
       const raw = fs68.readFileSync(candidate, "utf-8");
       let parsed;
       try {
-        parsed = parseYaml5(raw);
+        parsed = parseYaml6(raw);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(`failed to parse "${candidate}" as YAML: ${msg}`);
@@ -19588,6 +19651,55 @@ function validateCanonical(filenameBasename, content, registeredPrefixes) {
   }
   return { ok: true };
 }
+function matchesSinglePattern(candidate, pattern) {
+  const cacheKey = `${candidate}\0${pattern}`;
+  const cached = _matchCache.get(cacheKey);
+  if (cached !== void 0)
+    return cached;
+  const result = _matchesSinglePatternRaw(candidate, pattern);
+  _matchCache.set(cacheKey, result);
+  return result;
+}
+function _matchesSinglePatternRaw(candidate, pattern) {
+  if (pattern === "*")
+    return true;
+  if (!pattern.includes("*"))
+    return candidate === pattern;
+  const segments = pattern.split("*");
+  let pos = 0;
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    if (seg.length === 0)
+      continue;
+    if (i === 0) {
+      if (!candidate.startsWith(seg))
+        return false;
+      pos = seg.length;
+    } else if (i === segments.length - 1) {
+      if (!candidate.endsWith(seg))
+        return false;
+      if (pos > candidate.length - seg.length)
+        return false;
+    } else {
+      const found = candidate.indexOf(seg, pos);
+      if (found === -1)
+        return false;
+      pos = found + seg.length;
+    }
+  }
+  return true;
+}
+function matchesPrefixTarget(canonical, patterns) {
+  if (patterns === void 0 || patterns.length === 0)
+    return true;
+  if (patterns.length === 1 && patterns[0] === "*")
+    return true;
+  for (const pattern of patterns) {
+    if (matchesSinglePattern(canonical, pattern))
+      return true;
+  }
+  return false;
+}
 function formatCanonicalViolation(filePath, violation) {
   const surface = violation.kind === "filename" ? "filename" : "frontmatter `name:` field";
   const stripped = violation.value.replace(new RegExp(`^${violation.prefix}:`), "");
@@ -19598,10 +19710,12 @@ function formatCanonicalViolation(filePath, violation) {
     `See docs/plans/skill-prefix-rules/README.md \xA7 Bidirectional invariant.`
   ].join("\n  ");
 }
+var _matchCache;
 var init_prefix_rules = __esm({
   "../core/dist/skill-sync/prefix-rules.js"() {
     "use strict";
     init_markdown_merger();
+    _matchCache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -19611,17 +19725,20 @@ import * as path73 from "node:path";
 function buildSourcePrefixMap(sources) {
   const byId = /* @__PURE__ */ new Map();
   const scopeById = /* @__PURE__ */ new Map();
+  const targetById = /* @__PURE__ */ new Map();
   const prefixes = /* @__PURE__ */ new Set();
   for (const s of sources) {
     if (s.prefix !== void 0 && s.prefix.length > 0) {
       byId.set(s.id, s.prefix);
       scopeById.set(s.id, s.prefixScope ?? DEFAULT_SCOPE);
+      targetById.set(s.id, s.prefixTarget);
       prefixes.add(s.prefix);
     }
   }
   return {
     get: (sourceId) => byId.get(sourceId),
     getScope: (sourceId) => scopeById.get(sourceId) ?? DEFAULT_SCOPE,
+    getPrefixTarget: (sourceId) => targetById.get(sourceId),
     registeredPrefixes: Array.from(prefixes)
   };
 }
@@ -19637,6 +19754,9 @@ function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir2, dryRun) {
     if (!scope.includes(artifact.kind))
       continue;
     const canonical = artifact.deployBasename;
+    const prefixTarget = sourceMap.getPrefixTarget(artifact.sourceId);
+    if (!matchesPrefixTarget(canonical, prefixTarget))
+      continue;
     const otherPrefixes = sourceMap.registeredPrefixes.filter((p) => p !== prefix);
     const renamed = applyPrefix(canonical, prefix, otherPrefixes);
     if (renamed === canonical)
@@ -19715,7 +19835,7 @@ var init_prefix_deploy = __esm({
 // ../core/dist/skill-sync/resolve-source-config.js
 import { readFileSync as readFileSync72, existsSync as existsSync81 } from "node:fs";
 import { join as join81 } from "node:path";
-import { parse as parseYaml6 } from "yaml";
+import { parse as parseYaml7 } from "yaml";
 function sourceConfigPath(clonePath) {
   return join81(clonePath, "shared", "source-config.yaml");
 }
@@ -19732,7 +19852,7 @@ function readSourceConfig(clonePath, sourceId) {
   }
   let parsed;
   try {
-    parsed = parseYaml6(raw);
+    parsed = parseYaml7(raw);
   } catch (err) {
     emitMalformedWarning(sourceId, `YAML parse failed: ${errToMsg(err)}`);
     return void 0;
@@ -19756,18 +19876,23 @@ function errToMsg(err) {
 function resolveEffectivePrefix(operatorSource, sourceConfig) {
   const opPrefix = operatorSource.prefix;
   const opScope = operatorSource.prefixScope;
+  const opTarget = operatorSource.prefixTarget;
   const srcPrefix = sourceConfig?.prefix;
   const srcScope = sourceConfig?.prefixScope;
+  const srcTarget = sourceConfig?.prefixTarget;
   const effectivePrefix = opPrefix ?? srcPrefix;
   const effectiveScope = opScope ?? srcScope;
-  const operatorHasAny = opPrefix !== void 0 || opScope !== void 0 && opScope.length > 0;
-  const sourceHasAny = srcPrefix !== void 0 || srcScope !== void 0 && srcScope.length > 0;
+  const effectiveTarget = opTarget ?? srcTarget;
+  const operatorHasAny = opPrefix !== void 0 || opScope !== void 0 && opScope.length > 0 || opTarget !== void 0 && opTarget.length > 0;
+  const sourceHasAny = srcPrefix !== void 0 || srcScope !== void 0 && srcScope.length > 0 || srcTarget !== void 0 && srcTarget.length > 0;
   const origin = operatorHasAny ? "operator" : sourceHasAny ? "source" : "none";
   const result = { origin };
   if (effectivePrefix !== void 0)
     result.prefix = effectivePrefix;
   if (effectiveScope !== void 0)
     result.prefixScope = effectiveScope;
+  if (effectiveTarget !== void 0)
+    result.prefixTarget = effectiveTarget;
   return result;
 }
 function sourceConfigsEqual(a, b) {
@@ -19780,6 +19905,9 @@ function sourceConfigsEqual(a, b) {
     if (c.prefixScope !== void 0 && c.prefixScope.length > 0) {
       out.prefixScope = [...c.prefixScope];
     }
+    if (c.prefixTarget !== void 0 && c.prefixTarget.length > 0) {
+      out.prefixTarget = [...c.prefixTarget];
+    }
     return out;
   };
   const na = normalize(a);
@@ -19794,6 +19922,14 @@ function sourceConfigsEqual(a, b) {
     if (sa[i] !== sb[i])
       return false;
   }
+  const ta = na.prefixTarget ?? [];
+  const tb = nb.prefixTarget ?? [];
+  if (ta.length !== tb.length)
+    return false;
+  for (let i = 0; i < ta.length; i++) {
+    if (ta[i] !== tb[i])
+      return false;
+  }
   return true;
 }
 var init_resolve_source_config = __esm({
@@ -19876,6 +20012,8 @@ async function syncSkills(opts = {}) {
       entry.prefix = eff.prefix;
     if (eff.prefixScope !== void 0)
       entry.prefixScope = eff.prefixScope;
+    if (eff.prefixTarget !== void 0)
+      entry.prefixTarget = eff.prefixTarget;
     return entry;
   });
   const sourcePrefixGateOutcomes = [];
@@ -19934,6 +20072,7 @@ async function syncSkills(opts = {}) {
     } else {
       delete eff.prefix;
       delete eff.prefixScope;
+      delete eff.prefixTarget;
       eff.origin = "none";
       const isNonTty = opts.sourcePrefixPrompt === void 0;
       sourcePrefixGateOutcomes.push({
@@ -21082,14 +21221,14 @@ __export(machine_schema_exports, {
 import * as fs82 from "node:fs";
 import * as path83 from "node:path";
 import * as os45 from "node:os";
-import { parse as parseYaml7, stringify as stringifyYaml5 } from "yaml";
+import { parse as parseYaml8, stringify as stringifyYaml6 } from "yaml";
 function readMachineConfig(configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
   if (!fs82.existsSync(p))
     return null;
   try {
     const raw = fs82.readFileSync(p, "utf-8");
-    const parsed = parseYaml7(raw);
+    const parsed = parseYaml8(raw);
     return MachineConfigSchema.parse(parsed);
   } catch {
     return null;
@@ -21098,7 +21237,7 @@ function readMachineConfig(configPath) {
 function writeMachineConfig(config, configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
   fs82.mkdirSync(path83.dirname(p), { recursive: true });
-  fs82.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
+  fs82.writeFileSync(p, stringifyYaml6({ ...config }), { mode: 420 });
 }
 function initMachineConfig(opts = {}) {
   const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
@@ -21325,14 +21464,25 @@ import {
 import { homedir as homedir3, tmpdir } from "node:os";
 import { join as join7, dirname as dirname3 } from "node:path";
 import { randomUUID } from "node:crypto";
+import { parse as parseYaml3, stringify as stringifyYaml3 } from "yaml";
 var OLAM_HOME = join7(homedir3(), ".olam");
 var OLAM_STATE_DIR = join7(OLAM_HOME, "state");
-var OLAM_CONFIG_PATH = join7(OLAM_HOME, "config.json");
+function resolveConfigPath(home = OLAM_HOME) {
+  const jsonPath = join7(home, "config.json");
+  const yamlPath = join7(home, "config.yaml");
+  if (existsSync6(jsonPath)) return jsonPath;
+  if (existsSync6(yamlPath)) return yamlPath;
+  return jsonPath;
+}
+var OLAM_CONFIG_PATH = resolveConfigPath();
 function defaultConfigPath() {
   if (process.env["VITEST"]) {
     return join7(tmpdir(), `olam-vitest-config-${process.pid}.json`);
   }
-  return OLAM_CONFIG_PATH;
+  return resolveConfigPath();
+}
+function isYamlPath(p) {
+  return p.endsWith(".yaml") || p.endsWith(".yml");
 }
 var DEFAULT_SUBSTRATE = "kubernetes";
 function makeDefaultConfig() {
@@ -21381,6 +21531,37 @@ function atomicWriteJSON(path103, value, stderr = process.stderr) {
     throw err;
   }
 }
+function atomicWriteYaml(path103, value, stderr = process.stderr) {
+  ensureStateDir();
+  const dir = dirname3(path103);
+  if (!existsSync6(dir)) {
+    mkdirSync2(dir, { recursive: true });
+  }
+  const tmp = `${path103}.tmp.${process.pid}`;
+  try {
+    writeFileSync2(tmp, stringifyYaml3(value), { encoding: "utf8" });
+    renameSync2(tmp, path103);
+  } catch (err) {
+    if (existsSync6(tmp)) {
+      try {
+        unlinkSync2(tmp);
+      } catch {
+      }
+    }
+    stderr.write(
+      `[WARN] olam config write failed: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    throw err;
+  }
+}
+function atomicWrite(path103, value, stderr = process.stderr) {
+  if (isYamlPath(path103)) {
+    atomicWriteYaml(path103, value, stderr);
+  } else {
+    atomicWriteJSON(path103, value, stderr);
+  }
+}
 function readConfig(opts = {}) {
   const configPath = opts.configPath ?? defaultConfigPath();
   const stateDir = opts.stateDir ?? OLAM_STATE_DIR;
@@ -21388,20 +21569,20 @@ function readConfig(opts = {}) {
   ensureStateDir(stateDir);
   if (!existsSync6(configPath)) {
     const fresh = makeDefaultConfig();
-    atomicWriteJSON(configPath, fresh, stderr);
+    atomicWrite(configPath, fresh, stderr);
     return fresh;
   }
   let parsed;
   try {
     const raw = readFileSync6(configPath, "utf8");
-    parsed = JSON.parse(raw);
+    parsed = isYamlPath(configPath) ? parseYaml3(raw) : JSON.parse(raw);
   } catch (err) {
     stderr.write(
       `[WARN] olam config malformed at ${configPath}: ${err instanceof Error ? err.message : String(err)}; falling back to defaults
 `
     );
     const fresh = makeDefaultConfig();
-    atomicWriteJSON(configPath, fresh, stderr);
+    atomicWrite(configPath, fresh, stderr);
     return fresh;
   }
   if (!isValidConfig(parsed)) {
@@ -21410,7 +21591,7 @@ function readConfig(opts = {}) {
 `
     );
     const fresh = makeDefaultConfig();
-    atomicWriteJSON(configPath, fresh, stderr);
+    atomicWrite(configPath, fresh, stderr);
     return fresh;
   }
   return parsed;
@@ -21425,7 +21606,7 @@ function writeConfig(updates, opts = {}) {
     host: { ...current.host, ...updates.host ?? {} },
     install_id: current.install_id
   };
-  atomicWriteJSON(configPath, next, stderr);
+  atomicWrite(configPath, next, stderr);
   return next;
 }
 
@@ -21688,7 +21869,7 @@ import * as fs7 from "node:fs";
 import * as os3 from "node:os";
 import * as path7 from "node:path";
 import pc4 from "picocolors";
-import { stringify as stringifyYaml3 } from "yaml";
+import { stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/archetypes/capabilities.js
 var CAPABILITY_NAMES = [
@@ -21854,7 +22035,7 @@ function readRoleFile() {
 }
 function writeRoleFile(role) {
   fs7.mkdirSync(path7.dirname(ROLE_FILE_PATH), { recursive: true });
-  const yaml = stringifyYaml3({
+  const yaml = stringifyYaml4({
     archetype: role.archetype,
     customCapabilities: [...role.customCapabilities],
     installedAt: role.installedAt
@@ -24583,6 +24764,7 @@ import { existsSync as existsSync35, mkdtempSync as mkdtempSync2, readFileSync a
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join42, resolve as resolve13 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
+init_install_root();
 var SECRET_NAME2 = "olam-host-cp-tls";
 var NAMESPACE = "olam";
 var SAN_LIST = ["olam.local", "127.0.0.1", "::1"];
@@ -24620,6 +24802,12 @@ function isMkcertRootTrusted(mkcertPath, spawn13) {
   }
   return true;
 }
+function resolveHostCpManifestDir() {
+  const installed = join42(installRoot(), "host-cp", "k8s", "manifests");
+  if (existsSync35(installed)) return installed;
+  const here3 = fileURLToPath6(import.meta.url);
+  return resolve13(here3, "..", "..", "..", "..", "host-cp", "k8s", "manifests");
+}
 function readCertNotAfter(pemBytes, spawnImpl) {
   const r = spawnImpl("openssl", ["x509", "-noout", "-enddate"], { input: pemBytes });
   if (r.status !== 0) return null;
@@ -24881,9 +25069,7 @@ function tlsSecretExists(spawnArg, context) {
   return r.status === 0 && r.stdout.trim().length > 0;
 }
 function applyIngressManifests(context) {
-  const here3 = fileURLToPath6(import.meta.url);
-  const manifestDir = resolve13(here3, "..", "..", "..", "..", "host-cp", "k8s", "manifests");
-  const ingressManifest = join42(manifestDir, "70-ingressroute.yaml");
+  const ingressManifest = join42(resolveHostCpManifestDir(), "70-ingressroute.yaml");
   try {
     execFileSync8("kubectl", [
       "--context",
@@ -29993,6 +30179,7 @@ Top-level commands (run \`olam <command> --help\` for flags and subcommands):
 - \`olam services\` \u2014 Manage Olam service containers (up/down/status/logs)
 - \`olam set-prefix\` \u2014 Set the deploy prefix for a registered skill source (skills+agents deploy as <prefix>:<canonical-name>)
 - \`olam set-prefix-scope\` \u2014 Set which artifact kinds are renamed by the prefix (comma-separated: skill, agent, or skill,agent)
+- \`olam set-prefix-target\` \u2014 Restrict prefix renaming to canonical names matching the given glob patterns (only * wildcard supported).
 - \`olam setup\` \u2014 Fresh-host onboarding wizard (k3d cluster + services, idempotent)
 - \`olam setup-linux-gate-status\` \u2014 Check whether the Linux platform expansion gate has been triggered
 - \`olam setup-metrics\` \u2014 Query trust-audit-log for setup dogfood statistics
@@ -30011,6 +30198,7 @@ Top-level commands (run \`olam <command> --help\` for flags and subcommands):
 - \`olam uninstall-hook\` \u2014 Remove kg-service PreToolUse hook from .claude/settings.json (sentinel-matched; surgical)
 - \`olam unset-prefix\` \u2014 Remove the deploy prefix from a registered skill source (reverts to canonical deploy names)
 - \`olam unset-prefix-scope\` \u2014 Remove the prefix-scope override from a registered skill source (reverts to default: both skill and agent are renamed)
+- \`olam unset-prefix-target\` \u2014 Remove the prefix-target override from a registered skill source (reverts to default: all canonical names are renamed)
 - \`olam up\` \u2014 [deprecated] Start the auth container \u2014 use
 - \`olam update\` \u2014 Update a registered repo
 - \`olam upgrade\` \u2014 Upgrade the olam-auth container. Default: pull olam-auth@<digest> from ghcr.io and recreate.
@@ -42683,13 +42871,22 @@ async function phase1SystemCheck(substrate, deps) {
     if (!kubectlProbe.ok) {
       return phaseFromProbe(kubectlProbe);
     }
-    const dockerProbe2 = await probeDockerDaemon(deps.dockerExec);
-    if (!dockerProbe2.ok) {
-      return {
-        ok: false,
-        message: "docker daemon required for k3d: " + dockerProbe2.message,
-        remedy: dockerProbe2.remedy
-      };
+    const ctx = resolveKubectlContext(deps.configPath);
+    const isK3dManaged = ctx.context?.startsWith("k3d-") ?? false;
+    if (isK3dManaged) {
+      const dockerProbe2 = await probeDockerDaemon(deps.dockerExec);
+      if (!dockerProbe2.ok) {
+        return {
+          ok: false,
+          message: "docker daemon required for k3d-managed cluster: " + dockerProbe2.message,
+          remedy: dockerProbe2.remedy
+        };
+      }
+    } else if (ctx.context !== void 0) {
+      process.stdout.write(
+        `  \u2139 skipped docker check \u2014 kubectl context "${ctx.context}" is not k3d-managed
+`
+      );
     }
     if (!nodeOk) {
       return {
@@ -42705,7 +42902,8 @@ async function phase1SystemCheck(substrate, deps) {
       const lintWithWarn = colimaLint;
       printWarning(`  \u26A0 ${lintWithWarn.remedy}`);
     }
-    return { ok: true, message: `kubectl on PATH; docker ready; node ${nodeVersion}` };
+    const dockerNote = isK3dManaged ? "; docker ready" : "";
+    return { ok: true, message: `kubectl on PATH${dockerNote}; node ${nodeVersion}` };
   }
   const dockerProbe = await probeDockerDaemon(deps.dockerExec);
   if (!dockerProbe.ok) {
@@ -42738,6 +42936,15 @@ async function phase1_5InstallSubstrate(substrate, opts, deps, reuseContext) {
       message: `skipped k3d install (reusing context ${reuseContext})`
     };
   }
+  const ctx = resolveKubectlContext(deps.configPath);
+  const isK3dManaged = ctx.context?.startsWith("k3d-") ?? false;
+  if (!isK3dManaged && ctx.context !== void 0) {
+    return {
+      ok: true,
+      skipped: true,
+      message: `skipped k3d install \u2014 kubectl context "${ctx.context}" is not k3d-managed`
+    };
+  }
   const spawnFn = deps.spawnSubprocess ?? defaultSpawn2;
   const promptFn = deps.prompt ?? defaultPrompt;
   const k3dProbe = await probeK3d(deps.dockerExec);
@@ -44456,9 +44663,11 @@ function registerSkillsSource(program2) {
           clonePath,
           prefix: s.prefix ?? null,
           prefixScope: s.prefixScope ? [...s.prefixScope] : null,
+          prefixTarget: s.prefixTarget ? [...s.prefixTarget] : null,
           effective: {
             prefix: eff.prefix ?? null,
             prefixScope: eff.prefixScope ? [...eff.prefixScope] : null,
+            prefixTarget: eff.prefixTarget ? [...eff.prefixTarget] : null,
             origin: eff.origin
           }
         };
@@ -44878,15 +45087,21 @@ function registerSkillsSource(program2) {
           lastPulledSha: entry.lastPulledSha ?? null,
           clonePath
         },
-        sourceConfig: srcCfg === void 0 ? null : { prefix: srcCfg.prefix ?? null, prefixScope: srcCfg.prefixScope ? [...srcCfg.prefixScope] : null },
+        sourceConfig: srcCfg === void 0 ? null : {
+          prefix: srcCfg.prefix ?? null,
+          prefixScope: srcCfg.prefixScope ? [...srcCfg.prefixScope] : null,
+          prefixTarget: srcCfg.prefixTarget ? [...srcCfg.prefixTarget] : null
+        },
         operator: {
           prefix: entry.prefix ?? null,
           prefixScope: entry.prefixScope ? [...entry.prefixScope] : null,
+          prefixTarget: entry.prefixTarget ? [...entry.prefixTarget] : null,
           lastSeenSourcePrefix: entry.lastSeenSourcePrefix ?? null
         },
         effective: {
           prefix: effJson.prefix ?? null,
           prefixScope: effJson.prefixScope ? [...effJson.prefixScope] : null,
+          prefixTarget: effJson.prefixTarget ? [...effJson.prefixTarget] : null,
           origin: effJson.origin
         }
       };
@@ -44913,15 +45128,18 @@ function registerSkillsSource(program2) {
     } else {
       console.log(`  ${pc36.bold("prefix:")}        ${sourceConfig.prefix ?? pc36.dim("\u2014")}`);
       console.log(`  ${pc36.bold("prefixScope:")}   ${sourceConfig.prefixScope?.join(",") ?? pc36.dim("\u2014")}`);
+      console.log(`  ${pc36.bold("prefixTarget:")}  ${sourceConfig.prefixTarget?.join(" ") ?? pc36.dim("\u2014")}`);
     }
     console.log(pc36.bold("\u25B8 operator overrides"));
     console.log(`  ${pc36.bold("prefix:")}        ${entry.prefix ?? pc36.dim("\u2014")}`);
     console.log(`  ${pc36.bold("prefixScope:")}   ${entry.prefixScope?.join(",") ?? pc36.dim("\u2014")}`);
+    console.log(`  ${pc36.bold("prefixTarget:")}  ${entry.prefixTarget?.join(" ") ?? pc36.dim("\u2014")}`);
     console.log(`  ${pc36.bold("lastSeen:")}      ${entry.lastSeenSourcePrefix ? JSON.stringify(entry.lastSeenSourcePrefix) : pc36.dim("\u2014")}`);
     const eff = resolveEffectivePrefix(entry, sourceConfig);
     console.log(pc36.bold(`\u25B8 effective ${pc36.dim(`(origin: ${eff.origin})`)}`));
     console.log(`  ${pc36.bold("prefix:")}        ${eff.prefix ?? pc36.dim("\u2014")}`);
     console.log(`  ${pc36.bold("prefixScope:")}   ${eff.prefixScope?.join(",") ?? pc36.dim("\u2014")}`);
+    console.log(`  ${pc36.bold("prefixTarget:")}  ${eff.prefixTarget?.join(" ") ?? pc36.dim("\u2014")}`);
   });
   source.command("set-prefix").description(
     "Set the deploy prefix for a registered skill source (skills+agents deploy as <prefix>:<canonical-name>)"
@@ -45006,6 +45224,57 @@ function registerSkillsSource(program2) {
       process.exitCode = 1;
     }
   });
+  source.command("set-prefix-target").description(
+    'Restrict prefix renaming to canonical names matching the given glob patterns (only * wildcard supported). E.g. "10x:*" renames only skills whose canonical name starts with "10x:". Pass multiple patterns as separate arguments.'
+  ).argument("<name>", 'Display name of the skill source (from "olam skills source list")').argument("<patterns...>", 'One or more glob patterns (e.g. "10x:*" "atl:*" "plan-*")').action((name, patterns) => {
+    const entry = getSkillSourceByName(name);
+    if (entry === null) {
+      printError(
+        `skill source "${name}" is not registered. Run "olam skills source list" to see registered sources.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    for (const p of patterns) {
+      if (p.length === 0) {
+        printError("prefixTarget patterns must be non-empty strings");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    if (patterns.length === 0) {
+      printError('at least one pattern is required \u2014 use "unset-prefix-target" to revert to match-all');
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      updateSkillSource(entry.id, { prefixTarget: patterns });
+      const display = patterns.map((p) => `"${p}"`).join(" ");
+      printSuccess(`set prefix-target ${display} on source "${name}" (${entry.id})`);
+    } catch (err) {
+      printError(asMessage3(err));
+      process.exitCode = 1;
+    }
+  });
+  source.command("unset-prefix-target").description(
+    "Remove the prefix-target override from a registered skill source (reverts to default: all canonical names are renamed)"
+  ).argument("<name>", 'Display name of the skill source (from "olam skills source list")').action((name) => {
+    const entry = getSkillSourceByName(name);
+    if (entry === null) {
+      printError(
+        `skill source "${name}" is not registered. Run "olam skills source list" to see registered sources.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      updateSkillSource(entry.id, { prefixTarget: null });
+      printSuccess(`unset prefix-target on source "${name}" (${entry.id}) \u2014 reverted to default (match all)`);
+    } catch (err) {
+      printError(asMessage3(err));
+      process.exitCode = 1;
+    }
+  });
 }
 
 // src/commands/skills.ts
@@ -48583,7 +48852,7 @@ init_output();
 import { existsSync as existsSync108, readFileSync as readFileSync91, writeFileSync as writeFileSync55 } from "node:fs";
 import { join as join102 } from "node:path";
 import * as readline7 from "node:readline/promises";
-import { parse as parseYaml8, stringify as stringifyYaml6 } from "yaml";
+import { parse as parseYaml9, stringify as stringifyYaml7 } from "yaml";
 var CONFIG_REL = ".olam/config.yaml";
 function locateConfig(cwd) {
   const absPath = join102(cwd, CONFIG_REL);
@@ -48596,14 +48865,14 @@ function locateConfig(cwd) {
 }
 function readConfigYaml(absPath) {
   const raw = readFileSync91(absPath, "utf-8");
-  const parsed = parseYaml8(raw) ?? {};
+  const parsed = parseYaml9(raw) ?? {};
   if (typeof parsed !== "object" || parsed === null) {
     throw new Error(`${absPath} is not a YAML object`);
   }
   return { raw, parsed };
 }
 function writeConfigYaml(absPath, parsed) {
-  const out = stringifyYaml6(parsed, { aliasDuplicateObjects: false });
+  const out = stringifyYaml7(parsed, { aliasDuplicateObjects: false });
   writeFileSync55(absPath, out, "utf-8");
 }
 async function defaultPromptText(question) {