@pleri/olam-cli 0.1.201 → 0.1.205

package/dist/commands/memory-service-container.js

@@ -1,251 +0,0 @@
-/**
- * MemoryServiceContainerController — lifecycle for olam-memory-service.
- *
- * Mirrors KgServiceContainerController (./kg-service-container.ts). memory-service,
- * like kg-service, runs as a host-side Docker peripheral managed by `olam services up`.
- * The Phase A predecessor (host-process model — `olam memory start` spawning the
- * npm-installed `agentmemory` bin) is retired in Phase B; both substrates coexist
- * during Phase A so operators can roll back without losing data
- * (`~/.olam/memory-data/` is bind-mounted and survives substrate swap).
- *
- * Divergence from kg-service:
- *   - Bearer-authenticated livez probe (kg-service `/health` is unauthenticated).
- *     `waitForReady` reads `~/.olam/memory-secret` and adds `Authorization: Bearer <secret>`.
- *   - No /host-home read-only mount (kg-service mounts $HOME for build ingestion;
- *     memory-service writes only to its own /data volume).
- *   - No prewarm probe (kg-service pre-warms bge-small inference; memory-service has
- *     no equivalent hot path — iii engine init happens at process start, not first request).
- *
- * Plan reference: docs/plans/memory-service-as-docker-peripheral/phase-a-tasks.md A1
- */
-import { execFileSync, spawnSync } from 'node:child_process';
-import * as fs from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { ensureMemorySecret } from '../lib/memory-secret.js';
-import { printWarning } from '../output.js';
-export const MEMORY_SERVICE_PORT = 3111;
-export const MEMORY_SERVICE_CONTAINER = 'olam-memory-service';
-export const MEMORY_SERVICE_LOCAL_TAG = 'olam-memory-service:local';
-export const MEMORY_SERVICE_PUBLISHED_TAG = 'ghcr.io/pleri/olam-memory-service:latest';
-export const MEMORY_SERVICE_DEV_TAG = 'olam-memory-service:dev';
-export const MEMORY_SERVICE_HEALTH_URL = `http://127.0.0.1:${MEMORY_SERVICE_PORT}/agentmemory/livez`;
-// Mirrors KgServiceContainerController: 60s timeout absorbs cold-start on flaky
-// CI runners (image pull + iii-engine boot can exceed the operator-visible
-// "took a moment" budget). Warm machines see ~3-5s.
-export const MEMORY_SERVICE_HEALTH_TIMEOUT_MS = 60_000;
-// memory-data is the host-mounted `~/.olam/memory-data/` so the container's
-// agentmemory engine can persist iii-engine state to a path the operator can
-// inspect + that survives `docker rm`.
-const MEMORY_SERVICE_VOLUME_TARGET = '/data';
-function parseHealth(raw) {
-    switch (raw) {
-        case 'starting':
-        case 'healthy':
-        case 'unhealthy':
-            return raw;
-        // Docker prints an empty `State.Health.Status` for images without a
-        // HEALTHCHECK. The `{{if}}` guard in the format string maps that to the
-        // literal `none` so we can distinguish "no healthcheck" from a parse miss.
-        case 'none':
-            return 'none';
-        default:
-            return 'unknown';
-    }
-}
-/**
- * Resolves the operator's memory-data root for the host bind-mount.
- *
- * Mirrors kg-service's `kgDataHostPath()`: respects `$HOME` for testability,
- * defaults to `~/.olam/memory-data` for the real operator path. Caller is
- * responsible for ensuring the directory exists pre-bind-mount (Linux dockerd
- * auto-creates as root:root if absent, which breaks subsequent host-side
- * reads/writes from the operator's UID).
- */
-function memoryDataHostPath() {
-    return join(homedir(), '.olam', 'memory-data');
-}
-export class MemoryServiceContainerController {
-    imageTag = MEMORY_SERVICE_LOCAL_TAG;
-    status() {
-        const r = spawnSync('docker', ['inspect', '--format', '{{.State.Status}}|{{.Id}}', MEMORY_SERVICE_CONTAINER], { encoding: 'utf-8' });
-        if (r.status === 0) {
-            const [stateRaw, id] = r.stdout.trim().split('|');
-            return {
-                state: stateRaw === 'running' ? 'running' : 'stopped',
-                port: MEMORY_SERVICE_PORT,
-                containerId: id,
-            };
-        }
-        return { state: 'missing', port: MEMORY_SERVICE_PORT };
-    }
-    /**
-     * Best-effort runtime metadata for the container — start time (for uptime),
-     * restart count, and Docker health. One `docker inspect` call; never throws.
-     *
-     * Returns `null` when the container doesn't exist (inspect exits non-zero).
-     * Field-level parse misses degrade to `null` / `'unknown'` so `olam memory
-     * status` can render partial data instead of failing the whole command.
-     *
-     * The format string emits three pipe-delimited fields:
-     *   {{.State.StartedAt}}|{{.RestartCount}}|{{health-or-"none"}}
-     *
-     * `StartedAt` is the zero-value `0001-01-01T00:00:00Z` for never-started
-     * containers; the caller treats that as "no uptime" via `null` mapping.
-     */
-    runtimeInspect() {
-        const r = spawnSync('docker', [
-            'inspect',
-            '--format',
-            '{{.State.StartedAt}}|{{.RestartCount}}|{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}',
-            MEMORY_SERVICE_CONTAINER,
-        ], { encoding: 'utf-8' });
-        if (r.status !== 0)
-            return null;
-        const [startedRaw = '', restartRaw = '', healthRaw = ''] = r.stdout.trim().split('|');
-        // Docker's zero-value timestamp means "never started" — treat as no uptime.
-        const startedAt = startedRaw && !startedRaw.startsWith('0001-01-01') ? startedRaw : null;
-        const restartNum = Number.parseInt(restartRaw, 10);
-        const restartCount = Number.isFinite(restartNum) ? restartNum : null;
-        return {
-            startedAt,
-            restartCount,
-            health: parseHealth(healthRaw),
-        };
-    }
-    imageExists(tag = this.imageTag) {
-        return spawnSync('docker', ['image', 'inspect', tag], { encoding: 'utf-8' }).status === 0;
-    }
-    /**
-     * Resolve the first available image tag: local → dev → published.
-     *
-     * The preferred path is :local (populated by `olam bootstrap` pulling the
-     * digest-pinned image and tagging it). The :published fallback is `:latest`
-     * which is NOT digest-pinned — Docker will pull whatever tag-head is on
-     * the registry at pull time. This is the degraded-mode path for operators
-     * whose image-digests.json predates the G1 memory-service digest fix; it
-     * is intentionally loud so they know they are not on the pinned path.
-     *
-     * Throws if none exist (operator should run `olam bootstrap` to pull, or
-     * `node packages/cli/scripts/build-memory-service-image.mjs` to build locally).
-     */
-    resolveImage() {
-        for (const tag of [MEMORY_SERVICE_LOCAL_TAG, MEMORY_SERVICE_DEV_TAG]) {
-            if (this.imageExists(tag))
-                return tag;
-        }
-        if (this.imageExists(MEMORY_SERVICE_PUBLISHED_TAG)) {
-            printWarning(`memory-service: using tag-pulled fallback image (${MEMORY_SERVICE_PUBLISHED_TAG}). ` +
-                'This image was NOT pulled by digest. Run `olam bootstrap` to pull the ' +
-                'digest-pinned image and eliminate this warning.');
-            return MEMORY_SERVICE_PUBLISHED_TAG;
-        }
-        throw new Error(`memory-service image not found. Tried: ${MEMORY_SERVICE_LOCAL_TAG}, ${MEMORY_SERVICE_DEV_TAG}, ${MEMORY_SERVICE_PUBLISHED_TAG}. ` +
-            'Run `olam bootstrap` to pull the published image, or `node packages/cli/scripts/build-memory-service-image.mjs` to build locally.');
-    }
-    /**
-     * Idempotent start. If already running → return. If stopped → docker start.
-     * If missing → ensure secret + bind-mount dir, then docker run with port-forward
-     * + memory-data volume mount + restart policy + bearer-secret env.
-     *
-     * The bearer secret is read from `~/.olam/memory-secret` (generated on first
-     * call via `ensureMemorySecret()`) and passed as `AGENTMEMORY_SECRET`. The
-     * container's agentmemory CLI requires this for the livez probe + all API
-     * calls; without it the container will start but reject every request as 401.
-     */
-    start() {
-        const current = this.status();
-        if (current.state === 'running')
-            return;
-        if (current.state === 'stopped') {
-            execFileSync('docker', ['start', MEMORY_SERVICE_CONTAINER], { stdio: 'pipe' });
-            return;
-        }
-        this.imageTag = this.resolveImage();
-        const memoryData = memoryDataHostPath();
-        const secret = ensureMemorySecret();
-        // Pre-create the host path with the operator's UID. Without this,
-        // dockerd on Linux auto-creates the bind-mount target as root:root,
-        // which breaks subsequent host-side reads from the operator's UID
-        // (EACCES). macOS Docker Desktop's user-mapped binds don't bite
-        // here but the explicit mkdir is portable + cheap.
-        fs.mkdirSync(memoryData, { recursive: true });
-        execFileSync('docker', [
-            'run',
-            '--detach',
-            '--name', MEMORY_SERVICE_CONTAINER,
-            '--restart', 'unless-stopped',
-            // Bind to 127.0.0.1 ONLY at the host port level — local-only by design.
-            '--publish', `127.0.0.1:${MEMORY_SERVICE_PORT}:${MEMORY_SERVICE_PORT}`,
-            // host-gateway lets this container reach the host. Worlds reach
-            // memory-service via the published 127.0.0.1:3111 PLUS their OWN
-            // --add-host flag configured in the world-create code path.
-            '--add-host', 'host.docker.internal:host-gateway',
-            // Bearer secret for all /agentmemory/* requests.
-            '--env', `AGENTMEMORY_SECRET=${secret}`,
-            // Bind to all interfaces inside the container; the host-port publish
-            // restricts access to 127.0.0.1 externally.
-            '--env', 'AGENTMEMORY_HOST=0.0.0.0',
-            '--env', `AGENTMEMORY_PORT=${MEMORY_SERVICE_PORT}`,
-            // Mount the operator's memory-data root so iii-engine state persists.
-            '--volume', `${memoryData}:${MEMORY_SERVICE_VOLUME_TARGET}`,
-            this.imageTag,
-        ], { stdio: 'pipe' });
-    }
-    /**
-     * Returns true when no memory-service image exists locally — useful for
-     * callers (e.g. servicesUp) to distinguish "operator opted out of
-     * memory-service" from "memory-service was supposed to work but is broken".
-     * The opted-out case should be silent; the broken case should warn.
-     */
-    imageMissingEverywhere() {
-        return (!this.imageExists(MEMORY_SERVICE_LOCAL_TAG) &&
-            !this.imageExists(MEMORY_SERVICE_DEV_TAG) &&
-            !this.imageExists(MEMORY_SERVICE_PUBLISHED_TAG));
-    }
-    stop() {
-        const current = this.status();
-        if (current.state !== 'running')
-            return;
-        execFileSync('docker', ['stop', MEMORY_SERVICE_CONTAINER], { stdio: 'pipe' });
-    }
-    remove() {
-        spawnSync('docker', ['rm', '-f', MEMORY_SERVICE_CONTAINER], { stdio: 'pipe' });
-    }
-    /**
-     * Poll /agentmemory/livez until 200 OK with `{status: "ok"}` body OR
-     * timeoutMs elapses. The probe is bearer-authenticated; without the secret
-     * header agentmemory returns 401 regardless of container state.
-     *
-     * Divergence from kg-service: kg-service's `/health` is unauthenticated and
-     * returns `{ready: true}` once bge-small is loaded. memory-service's
-     * `/agentmemory/livez` returns `{status: "ok"}` once iii-engine accepts
-     * connections — there's no equivalent "model warmed" state to wait for.
-     */
-    async waitForReady(timeoutMs = MEMORY_SERVICE_HEALTH_TIMEOUT_MS) {
-        const secret = ensureMemorySecret();
-        const deadline = Date.now() + timeoutMs;
-        while (Date.now() < deadline) {
-            try {
-                const res = await fetch(MEMORY_SERVICE_HEALTH_URL, {
-                    headers: { authorization: `Bearer ${secret}` },
-                    signal: AbortSignal.timeout(1_500),
-                });
-                if (res.ok) {
-                    const body = (await res.json());
-                    if (body.status === 'ok')
-                        return true;
-                }
-            }
-            catch {
-                // not ready yet (connection refused, container booting, network race)
-            }
-            await sleep(500);
-        }
-        return false;
-    }
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-//# sourceMappingURL=memory-service-container.js.map

package/dist/commands/memory-service-container.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory-service-container.js","sourceRoot":"","sources":["../../src/commands/memory-service-container.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,0CAA0C,CAAC;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,mBAAmB,oBAAoB,CAAC;AAErG,gFAAgF;AAChF,2EAA2E;AAC3E,oDAAoD;AACpD,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAEvD,4EAA4E;AAC5E,6EAA6E;AAC7E,uCAAuC;AACvC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AA+C7C,SAAS,WAAW,CAAC,GAAW;IAC9B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,GAAG,CAAC;QACb,oEAAoE;QACpE,wEAAwE;QACxE,2EAA2E;QAC3E,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,gCAAgC;IACnC,QAAQ,GAAW,wBAAwB,CAAC;IAEpD,MAAM;QACJ,MAAM,CAAC,GAAG,SAAS,CACjB,QAAQ,EACR,CAAC,SAAS,EAAE,UAAU,EAAE,2BAA2B,EAAE,wBAAwB,CAAC,EAC9E,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACrD,IAAI,EAAE,mBAAmB;gBACzB,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,cAAc;QACZ,MAAM,CAAC,GAAG,SAAS,CACjB,QAAQ,EACR;YACE,SAAS;YACT,UAAU;YACV,wGAAwG;YACxG,wBAAwB;SACzB,EACD,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtF,4EAA4E;QAC5E,MAAM,SAAS,GACb,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAErE,OAAO;YACL,SAAS;YACT,YAAY;YACZ,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;SAC/B,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ;QACrC,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,YAAY;QAClB,KAAK,MAAM,GAAG,IAAI,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACnD,YAAY,CACV,oDAAoD,4BAA4B,KAAK;gBACnF,wEAAwE;gBACxE,iDAAiD,CACpD,CAAC;YACF,OAAO,4BAA4B,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0CAA0C,wBAAwB,KAAK,sBAAsB,KAAK,4BAA4B,IAAI;YAChI,mIAAmI,CACtI,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACxC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,mDAAmD;QACnD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9C,YAAY,CACV,QAAQ,EACR;YACE,KAAK;YACL,UAAU;YACV,QAAQ,EAAE,wBAAwB;YAClC,WAAW,EAAE,gBAAgB;YAC7B,wEAAwE;YACxE,WAAW,EAAE,aAAa,mBAAmB,IAAI,mBAAmB,EAAE;YACtE,gEAAgE;YAChE,iEAAiE;YACjE,4DAA4D;YAC5D,YAAY,EAAE,mCAAmC;YACjD,iDAAiD;YACjD,OAAO,EAAE,sBAAsB,MAAM,EAAE;YACvC,qEAAqE;YACrE,4CAA4C;YAC5C,OAAO,EAAE,0BAA0B;YACnC,OAAO,EAAE,oBAAoB,mBAAmB,EAAE;YAClD,sEAAsE;YACtE,UAAU,EAAE,GAAG,UAAU,IAAI,4BAA4B,EAAE;YAC3D,IAAI,CAAC,QAAQ;SACd,EACD,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,CACL,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;YAC3C,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC;YACzC,CAAC,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAChD,CAAC;IACJ,CAAC;IAED,IAAI;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACxC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM;QACJ,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,SAAS,GAAG,gCAAgC;QAC7D,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;oBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;oBAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnC,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;oBACvD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;gBACxC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/commands/observe.d.ts

@@ -1,9 +0,0 @@
-/**
- * olam observe <world> — redirect to olam logs.
- *
- * Not yet implemented as an SSE-style streamer.
- * The working alternative is `olam logs --follow <world>`.
- */
-import type { Command } from 'commander';
-export declare function registerObserve(program: Command): void;
-//# sourceMappingURL=observe.d.ts.map

package/dist/commands/observe.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/commands/observe.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+BtD"}

package/dist/commands/observe.js

@@ -1,42 +0,0 @@
-/**
- * olam observe <world> — redirect to olam logs.
- *
- * Not yet implemented as an SSE-style streamer.
- * The working alternative is `olam logs --follow <world>`.
- */
-import pc from 'picocolors';
-import { loadContext } from '../context.js';
-import { printError } from '../output.js';
-export function registerObserve(program) {
-    program
-        .command('observe')
-        .description('redirect to "olam logs --follow <world>" (chunks streamer not yet implemented)')
-        .argument('<world>', 'World ID')
-        .action(async (worldId) => {
-        const { ctx, error } = await loadContext();
-        if (!ctx) {
-            printError(error?.message ?? 'Olam is not configured. Run `olam init` first.');
-            process.exitCode = 1;
-            return;
-        }
-        const world = ctx.worldManager.getWorld(worldId);
-        if (!world) {
-            printError(`World "${worldId}" not found. Run \`olam list\` to see worlds.`);
-            process.exitCode = 1;
-            return;
-        }
-        // D3: warn-not-block version pin check (once per world per session).
-        {
-            const { checkVersionPin } = await import('@olam/core/src/world/version-pin.js');
-            checkVersionPin(worldId, world.workspacePath);
-        }
-        console.error(pc.yellow('olam observe: not yet implemented as a chunks/SSE streamer.'));
-        console.error('');
-        console.error('For now, use:');
-        console.error(`  ${pc.cyan(`olam logs --follow ${worldId}`)}`);
-        console.error('');
-        console.error(pc.dim('Tracking issue: olam CLI audit #1381 (Top-3 FAKE #1).'));
-        process.exit(2);
-    });
-}
-//# sourceMappingURL=observe.js.map

package/dist/commands/observe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"observe.js","sourceRoot":"","sources":["../../src/commands/observe.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;QAChC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,KAAK,EAAE,OAAO,IAAI,gDAAgD,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,UAAU,OAAO,+CAA+C,CAAC,CAAC;YAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,CAAC;YAAC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;YAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAEnI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/plans-list-json.d.ts

@@ -1,77 +0,0 @@
-/**
- * Pure JSON serialiser for `olam plans list --json`.
- *
- * Kept separate from the command action so the wire contract is
- * unit-testable without a live cloud endpoint (mirrors the pattern
- * used by `repos-list-json.ts`, `auth-list-json.ts`, and
- * `servicesStatusJson` in services.ts).
- *
- * WHY this exists: agent/script drivers (Rico, flywheel chain, CI pipelines)
- * need to enumerate cloud plan state — plan IDs, statuses, modes — before
- * deciding whether to spawn a new plan or pick up an existing one. The human
- * table is colorized and column-width-sensitive, so scraping it is brittle.
- * This serialiser gives drivers a stable, color-free array via
- * `olam plans list --json | jq '.plans[] | select(.status=="active")'`.
- *
- * Secret redaction: the PlanSummary shape carries two URL fields
- * (`host_cp_url`, `auth_recovery_callback_url`) that MAY embed auth
- * tokens in the URL userinfo component. Both are redacted before emission
- * using the canonical `:***@` substitution that matches
- * `@olam/core/src/skill-sources/store.ts`'s `redactUrl`.
- * The `bearer` (showcase password) used for HTTP auth never enters the
- * PlanSummary shape itself and is therefore never serialised.
- */
-import type { PlanSummary } from '../lib/plans-client.js';
-/**
- * Per-plan row in the `plans list --json` payload.
- * Field names are load-bearing — add new fields freely, never rename.
- */
-export interface PlanListJsonEntry {
-    /** Stable UUID identifying the plan. */
-    readonly plan_id: string;
-    /** Operator that owns the plan. */
-    readonly operator_id: string;
-    /** Lifecycle state of the plan. */
-    readonly status: PlanSummary['status'];
-    /** Execution mode (cloud / goal). */
-    readonly mode: PlanSummary['mode'];
-    /** Unix epoch ms when the plan was created. */
-    readonly created_at: number;
-    /** Unix epoch ms of the last activity, or null when never active. */
-    readonly last_active_at: number | null;
-    /** Unix epoch ms until which the plan is pinned, or null when not pinned. */
-    readonly pinned_until: number | null;
-    /**
-     * Host-CP URL for the plan, with credentials redacted.
-     * null when not set.
-     */
-    readonly host_cp_url: string | null;
-    /**
-     * Auth recovery callback URL, with credentials redacted.
-     * null when not set.
-     */
-    readonly auth_recovery_callback_url: string | null;
-    /**
-     * Whether a recovery callback URL is registered (boolean convenience flag).
-     * Consumers should prefer this over checking `auth_recovery_callback_url`
-     * when they only need to know "does a callback exist?".
-     */
-    readonly has_recovery_callback: boolean;
-}
-/** Top-level shape emitted by `olam plans list --json`. */
-export interface PlansListJson {
-    /** Number of plans returned. */
-    readonly count: number;
-    readonly plans: readonly PlanListJsonEntry[];
-}
-/**
- * Serialise a PlanSummary array to the stable `--json` wire shape.
- * Returns a JSON string (no trailing newline — caller adds it).
- *
- * Redacts any URL credentials in `host_cp_url` and
- * `auth_recovery_callback_url` using the canonical `redactUrl` helper
- * (`:***@` substitution), matching the pattern used by `repos-list-json.ts`
- * and `skills source list --json`.
- */
-export declare function renderPlansListJson(plans: readonly PlanSummary[]): string;
-//# sourceMappingURL=plans-list-json.d.ts.map

package/dist/commands/plans-list-json.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plans-list-json.d.ts","sourceRoot":"","sources":["../../src/commands/plans-list-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAY1D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAqBzE"}

package/dist/commands/plans-list-json.js

@@ -1,61 +0,0 @@
-/**
- * Pure JSON serialiser for `olam plans list --json`.
- *
- * Kept separate from the command action so the wire contract is
- * unit-testable without a live cloud endpoint (mirrors the pattern
- * used by `repos-list-json.ts`, `auth-list-json.ts`, and
- * `servicesStatusJson` in services.ts).
- *
- * WHY this exists: agent/script drivers (Rico, flywheel chain, CI pipelines)
- * need to enumerate cloud plan state — plan IDs, statuses, modes — before
- * deciding whether to spawn a new plan or pick up an existing one. The human
- * table is colorized and column-width-sensitive, so scraping it is brittle.
- * This serialiser gives drivers a stable, color-free array via
- * `olam plans list --json | jq '.plans[] | select(.status=="active")'`.
- *
- * Secret redaction: the PlanSummary shape carries two URL fields
- * (`host_cp_url`, `auth_recovery_callback_url`) that MAY embed auth
- * tokens in the URL userinfo component. Both are redacted before emission
- * using the canonical `:***@` substitution that matches
- * `@olam/core/src/skill-sources/store.ts`'s `redactUrl`.
- * The `bearer` (showcase password) used for HTTP auth never enters the
- * PlanSummary shape itself and is therefore never serialised.
- */
-/**
- * Redact the password component of a URL's userinfo (`:password@` → `:***@`).
- * Matches the same pattern used by `@olam/core/src/skill-sources/store.ts`'s
- * `redactUrl`. Inlined here so the serialiser has no cross-package import that
- * would require built packages to resolve in test environments.
- */
-function redactUrlCredentials(url) {
-    return url.replace(/:[^@/\s]+@/g, ':***@');
-}
-/**
- * Serialise a PlanSummary array to the stable `--json` wire shape.
- * Returns a JSON string (no trailing newline — caller adds it).
- *
- * Redacts any URL credentials in `host_cp_url` and
- * `auth_recovery_callback_url` using the canonical `redactUrl` helper
- * (`:***@` substitution), matching the pattern used by `repos-list-json.ts`
- * and `skills source list --json`.
- */
-export function renderPlansListJson(plans) {
-    const rows = plans.map((p) => ({
-        plan_id: p.plan_id,
-        operator_id: p.operator_id,
-        status: p.status,
-        mode: p.mode,
-        created_at: p.created_at,
-        last_active_at: p.last_active_at ?? null,
-        pinned_until: p.pinned_until ?? null,
-        host_cp_url: p.host_cp_url != null ? redactUrlCredentials(p.host_cp_url) : null,
-        auth_recovery_callback_url: p.auth_recovery_callback_url != null ? redactUrlCredentials(p.auth_recovery_callback_url) : null,
-        has_recovery_callback: p.has_recovery_callback,
-    }));
-    const payload = {
-        count: rows.length,
-        plans: rows,
-    };
-    return JSON.stringify(payload);
-}
-//# sourceMappingURL=plans-list-json.js.map

package/dist/commands/plans-list-json.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plans-list-json.js","sourceRoot":"","sources":["../../src/commands/plans-list-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AA8CD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA6B;IAC/D,MAAM,IAAI,GAAwB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACxC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;QACpC,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/E,0BAA0B,EACxB,CAAC,CAAC,0BAA0B,IAAI,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,IAAI;QAClG,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;KAC/C,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAkB;QAC7B,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,KAAK,EAAE,IAAI;KACZ,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/plans.d.ts

@@ -1,3 +0,0 @@
-import type { Command } from 'commander';
-export declare function registerPlans(program: Command): void;
-//# sourceMappingURL=plans.d.ts.map

package/dist/commands/plans.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plans.d.ts","sourceRoot":"","sources":["../../src/commands/plans.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BzC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+LpD"}