@pleri/olam-cli 0.1.205 → 0.1.207

package/hermes-bundle/version.json

@@ -1,4 +1,4 @@
 {
-  "bundledAt": "2026-06-02T08:06:35.843Z",
+  "bundledAt": "2026-06-02T16:46:23.219Z",
   "kgFirstSha": "29a9ccce1b115d049e375c4a90eb5cf7c123e610e2d0590270a4db2cdbc64a28"
 }

package/host-cp/k8s/manifests/50-deployment.yaml

@@ -118,7 +118,7 @@ spec:
         # k3d), started by `olam upgrade` Step 0.7 — not inside this Pod.
       containers:
         - name: olam-host-cp
-          image: ghcr.io/pleri/olam-host-cp@sha256:501037587e33d0a1c13df88d72ad9b855508e4c0163cb65673211cd3ddd9227b
+          image: ghcr.io/pleri/olam-host-cp@sha256:0d1869ed3c823e6ea1b5d885d2f73d7418134c1b82c9dd70719044fd04d74027
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/auth-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-auth-service
-          image: ghcr.io/pleri/olam-auth@sha256:06c9cd39405e650141a78927f1701bf7b06a86cd98eeaef9b22eb53d46f6f523
+          image: ghcr.io/pleri/olam-auth@sha256:9f8195a20727ec844d7393696c298b42e3e83e841fe684787ee9c6d1e301b5e8
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/kg-service/50-deployment.yaml

@@ -61,7 +61,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-kg-service
-          image: ghcr.io/pleri/olam-kg-service@sha256:a739f0fdf60aef0d26b51314698a07bba423c3d43571616cffd7b1195abb205d
+          image: ghcr.io/pleri/olam-kg-service@sha256:0b1f78a566675509f371e4e0636a76859f800c1bec787f06742e3a4f116d7c90
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/mcp-auth-service/50-deployment.yaml

@@ -68,7 +68,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-mcp-auth-service
-          image: ghcr.io/pleri/olam-mcp-auth@sha256:cdeb8813619f0198dbbcc80b2c98dbeb3a842e8d1ec38796d459ad254c5e1d98
+          image: ghcr.io/pleri/olam-mcp-auth@sha256:63ecc6bdd5c3def600a78046f0e7ab36938e88bc6fc7d31a446d7cec84a27a3a
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/memory-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
           # bootstrap-placeholder comment + run `npm run refresh:manifest-digests`
           # once ghcr.io/pleri/olam-memory-service has a real published digest.
           # bootstrap-placeholder: pre-publish; refresh after first release
-          image: ghcr.io/pleri/olam-memory-service@sha256:b10649ba9b56bb11b99e5142559d4b8a37a2b8ae2ad8ce38fb8b535449d26f85
+          image: ghcr.io/pleri/olam-memory-service@sha256:673156cc638fc9af096e73fc7cd7c666373f92e63e566a57f51271b691aa9d74
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/src/server.mjs

@@ -2241,6 +2241,35 @@ const server = http.createServer(instrumentHandler('host-cp', async (req, res) =
           ...(burstKgWorkspace ? { kgWorkspace: burstKgWorkspace } : {}),
           ...(burstHostCpUrl ? { hostCpUrl: burstHostCpUrl } : {}),
           ...(burstChunksSinkUrl ? { chunksSinkUrl: burstChunksSinkUrl } : {}),
+          // attachments → runner materializes operator-pasted file/image bytes
+          // from R2 into /workspace/<sid>/.attachments (plan-chat-spa-attachments
+          // Phase A, #1614). The runner reads body.attachments; sandbox-dispatch-client
+          // forwards it on the plan-DO path, so cloud-burst must too — else a
+          // sandbox dispatch carrying attachments silently runs without the files
+          // (drift parity with sandbox-dispatch-client — same class as #1605/#1622).
+          ...(Array.isArray(parsedBody.attachments) && parsedBody.attachments.length > 0 ? { attachments: parsedBody.attachments } : {}),
+          // Agent-capability fields the runner /spawn handler reads and
+          // sandbox-dispatch-client (cell #4) already forwards. The cloud-burst
+          // path (cell #2) builds an explicit spawnBody, so it must forward them
+          // too or a local-mode→sandbox dispatch carrying any of these silently
+          // loses the capability (same drift class as submodules/attachments).
+          // Body-supplied (the cell #2 SPA send is the only source on this path);
+          // absent → spread to nothing, so today's bare {prompt,session_id,world_id}
+          // burst is byte-for-byte unchanged.
+          //   skillSources → runner lays the operator's /100x chain into ~/.claude.
+          //   mcpServers   → runner writes ~/.claude.json so the agent has MCP tools.
+          //   interactive  → runner launches a tmux REPL instead of headless -p.
+          //   operatorSub  → in-container poster stamps chunks with the owner sub
+          //                  (runner reads body.operatorSub ?? body.operator_sub;
+          //                  forwarding the camelCase alias satisfies both reads —
+          //                  operator_sub is a documented EXCLUSIONS alias).
+          //   chunksSinkBearer → per-dispatch chunk-sink auth (NEVER logged); runner
+          //                  prefers it over its deploy-time env.CHUNKS_INGEST_BEARER.
+          ...(Array.isArray(parsedBody.skillSources) && parsedBody.skillSources.length > 0 ? { skillSources: parsedBody.skillSources } : {}),
+          ...(parsedBody.mcpServers && typeof parsedBody.mcpServers === 'object' && Object.keys(parsedBody.mcpServers).length > 0 ? { mcpServers: parsedBody.mcpServers } : {}),
+          ...(parsedBody.interactive ? { interactive: true } : {}),
+          ...(parsedBody.operatorSub ? { operatorSub: parsedBody.operatorSub } : {}),
+          ...(parsedBody.chunksSinkBearer ? { chunksSinkBearer: parsedBody.chunksSinkBearer } : {}),
           idempotencyKey,
           ...safeOptions,
         };
@@ -4064,7 +4093,7 @@ const _spaCacheByKey = new Map();
 // audit FAIL. Keep it as the canonical HN/WP-array parity source until
 // that audit is repointed at worldFetch.ts directly (follow-up).
 // eslint-disable-next-line no-unused-vars -- retained as HN/WP parity-audit source
-const BOOTSTRAP_SCRIPT = `<script>(function(){function ck(){var m=document.cookie.match(/olam_host_cp_token=([^;]+)/);return m?m[1]:'';}function sw(t){document.cookie='olam_host_cp_token='+t+'; path=/; samesite=strict';}try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);sw(d.token);}}catch(e){console.error('[host-cp bootstrap]',e);}var reloading=false;function recover(){if(reloading)return;try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);if(d.token&&ck()!==d.token){reloading=true;sw(d.token);console.warn('[host-cp auth recover] token rotated; reloading');location.reload();}}}catch(e){console.error('[host-cp auth recover]',e);}}var HN=['/api/bootstrap','/api/worlds','/api/projects','/api/workspaces','/api/workspaces/match','/api/repos','/api/runbooks','/api/auth','/api/host-stream','/api/plan-chat','/api/plan/agent-runtime','/health'];var WP=['/api/','/session/','/hooks/','/dispatch','/lanes','/codex/','/review/'];function sr(p){if(typeof p!=='string')return false;if(p.startsWith('/api/world/'))return false;for(var i=0;i<HN.length;i++){var n=HN[i];if(p===n||p.startsWith(n+'?')||p.startsWith(n+'/'))return false;}for(var j=0;j<WP.length;j++){var w=WP[j];if(p===w||p===w.replace(/\\/$/,'')||p.startsWith(w)||p.startsWith(w.replace(/\\/$/,'')+'?')||p.startsWith(w.replace(/\\/$/,'')+'/'))return true;}return false;}function wid(){var p=location.pathname;var m=p.match(/^\\/(world|inbox|session)\\/([^/?#]+)/);if(m)return m[2];if(/^\\/(?:worlds?|workspaces?|world|sandbox|session|inbox|plan|design|repos|runbooks|assets|api|health|favicon)($|\\/|\\?)/.test(p))return null;var r=p.match(/^\\/([a-z][a-z0-9-]+)(?:\\/|$|\\?)/);return r?r[1]:null;}function rw(p){var w=wid();return w?'/api/world/'+w+p:p;}var of=window.fetch.bind(window);window.fetch=function(input,init){var pr;if(typeof input==='string'&&sr(input))pr=of(rw(input),init);else if(input&&typeof input.url==='string'&&sr(input.url))pr=of(new Request(rw(input.url),input),init);else pr=of(input,init);return pr.then(function(res){if(res&&res.status===401)recover();return res;});};var OE=window.EventSource;if(OE){window.EventSource=function(u,i){var s=u;if(typeof s==='string'&&sr(s))s=rw(s);var es=new OE(s,i);es.addEventListener('error',function(){if(es.readyState===OE.CLOSED)recover();});return es;};window.EventSource.prototype=OE.prototype;window.EventSource.CONNECTING=OE.CONNECTING;window.EventSource.OPEN=OE.OPEN;window.EventSource.CLOSED=OE.CLOSED;}})();</script>`;
+const BOOTSTRAP_SCRIPT = `<script>(function(){function ck(){var m=document.cookie.match(/olam_host_cp_token=([^;]+)/);return m?m[1]:'';}function sw(t){document.cookie='olam_host_cp_token='+t+'; path=/; samesite=strict';}try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);sw(d.token);}}catch(e){console.error('[host-cp bootstrap]',e);}var reloading=false;function recover(){if(reloading)return;try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);if(d.token&&ck()!==d.token){reloading=true;sw(d.token);console.warn('[host-cp auth recover] token rotated; reloading');location.reload();}}}catch(e){console.error('[host-cp auth recover]',e);}}var HN=['/api/bootstrap','/api/whoami','/api/worlds','/api/projects','/api/chats','/api/workspaces','/api/workspaces/match','/api/repos','/api/runbooks','/api/auth','/api/host-stream','/api/plan-chat','/api/plan/agent-runtime','/health'];var WP=['/api/','/session/','/hooks/','/dispatch','/lanes','/codex/','/review/'];function sr(p){if(typeof p!=='string')return false;if(p.startsWith('/api/world/'))return false;for(var i=0;i<HN.length;i++){var n=HN[i];if(p===n||p.startsWith(n+'?')||p.startsWith(n+'/'))return false;}for(var j=0;j<WP.length;j++){var w=WP[j];if(p===w||p===w.replace(/\\/$/,'')||p.startsWith(w)||p.startsWith(w.replace(/\\/$/,'')+'?')||p.startsWith(w.replace(/\\/$/,'')+'/'))return true;}return false;}function wid(){var p=location.pathname;var m=p.match(/^\\/(world|inbox|session)\\/([^/?#]+)/);if(m)return m[2];if(/^\\/(?:worlds?|workspaces?|world|sandbox|session|inbox|plan|design|repos|runbooks|assets|api|health|favicon)($|\\/|\\?)/.test(p))return null;var r=p.match(/^\\/([a-z][a-z0-9-]+)(?:\\/|$|\\?)/);return r?r[1]:null;}function rw(p){var w=wid();return w?'/api/world/'+w+p:p;}var of=window.fetch.bind(window);window.fetch=function(input,init){var pr;if(typeof input==='string'&&sr(input))pr=of(rw(input),init);else if(input&&typeof input.url==='string'&&sr(input.url))pr=of(new Request(rw(input.url),input),init);else pr=of(input,init);return pr.then(function(res){if(res&&res.status===401)recover();return res;});};var OE=window.EventSource;if(OE){window.EventSource=function(u,i){var s=u;if(typeof s==='string'&&sr(s))s=rw(s);var es=new OE(s,i);es.addEventListener('error',function(){if(es.readyState===OE.CLOSED)recover();});return es;};window.EventSource.prototype=OE.prototype;window.EventSource.CONNECTING=OE.CONNECTING;window.EventSource.OPEN=OE.OPEN;window.EventSource.CLOSED=OE.CLOSED;}})();</script>`;
 
 /**
  * Build the plan-chat bearer injection script. Reads

package/memory-hooks/agentmemory-recall-trigger.mjs

@@ -204,6 +204,11 @@ async function main() {
   const additionalContext = formatAdditionalContext(response, prompt);
   if (!additionalContext) return;
 
+  const count = response?.results?.length ?? 0;
+  process.stderr.write(
+    `\x1b[34m[🧠⇣ Memory recalled]\x1b[0m (${count} memories · "${prompt.slice(0, 60)}${prompt.length > 60 ? '…' : ''}")\n`
+  );
+
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',

package/memory-hooks/agentmemory-save.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+/**
+ * agentmemory-save.mjs — PostToolUse hook: persist agent-written memory notes.
+ *
+ * AM_SENTINEL=olam-agent-memory-hook-v2
+ *
+ * This is the FILE-BASED port of the legacy inline python SAVE blob that used
+ * to live directly in ~/.claude/settings.json under
+ * `AM_SENTINEL=olam-agent-memory-hook-v1; python3 -c '…'`. The installer
+ * (`olam hooks install-all`, invoked by `olam skills sync`) copies this file to
+ * ~/.claude/scripts/hooks/ and registers a settings.json entry pointing at it,
+ * REPLACING the inline blob. Keeping the logic in a real source file means it
+ * is version-controlled, testable, bundled into @pleri/olam-cli, and owned by
+ * sync — not stranded as a string in the operator's settings.
+ *
+ * Behaviour (byte-faithful port of the v1 blob):
+ *   - Reads the PostToolUse JSON payload from stdin.
+ *   - Acts ONLY when tool_name === "Write" AND the written file_path matches
+ *     /\/\.claude\/projects\/.*\/memory\/.*\.md$/ ; otherwise bails (exit 0).
+ *   - Requires OLAM_AGENT_MEMORY_BEARER (trimmed, non-empty); else bails.
+ *   - Parses YAML-ish frontmatter delimited by leading "---":
+ *       description: → title (default "memory")   ← keyed on description, per v1
+ *       type:        → type  (default "fact")
+ *       remainder    → body
+ *   - POSTs {title, content: body, type} to
+ *       <OLAM_AGENT_MEMORY_URL|default>/agentmemory/remember
+ *     with Authorization: Bearer <bearer>, ~3s timeout.
+ *   - On success prints to STDERR the green status line:
+ *       [🧠⇡ Memory saved] "<title first 60 chars>"
+ *   - Fail-open: ANY error → silent, exit 0. Never throws to the caller.
+ *
+ * Node built-ins only (global fetch + AbortController, available on Node ≥18).
+ */
+
+import { readFileSync } from 'node:fs';
+
+const DEFAULT_URL = 'https://atlas-agent-memory.atlas-kitchen.workers.dev';
+const MEMORY_PATH_RE = /\/\.claude\/projects\/.*\/memory\/.*\.md$/;
+const TIMEOUT_MS = 3000;
+
+/** Read all of stdin as a UTF-8 string. */
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Parse leading "---"-delimited frontmatter. Returns {title, type, body}.
+ * Mirrors the v1 blob: title comes from `description:`, type from `type:`.
+ */
+function parseNote(raw) {
+  let title = 'memory';
+  let type = 'fact';
+  let body = raw;
+  if (raw.startsWith('---')) {
+    // Split into [before-first-delim, frontmatter, …rest]. JS's limited split
+    // truncates the remainder, so slice manually to keep the full body.
+    const firstDelimEnd = 3; // length of leading "---"
+    const secondDelim = raw.indexOf('---', firstDelimEnd);
+    if (secondDelim !== -1) {
+      const fm = raw.slice(firstDelimEnd, secondDelim);
+      body = raw.slice(secondDelim + 3).trim();
+      for (const ln of fm.split('\n')) {
+        const s = ln.trim();
+        if (s.startsWith('description:')) {
+          title = stripQuotes(s.slice(s.indexOf(':') + 1).trim());
+        } else if (s.startsWith('type:')) {
+          type = stripQuotes(s.slice(s.indexOf(':') + 1).trim());
+        }
+      }
+    }
+  }
+  return { title, type, body };
+}
+
+function stripQuotes(v) {
+  return v.replace(/^["']/, '').replace(/["']$/, '');
+}
+
+async function main() {
+  const payloadRaw = readStdin();
+  let payload;
+  try {
+    payload = JSON.parse(payloadRaw);
+  } catch {
+    return; // not parseable → fail-open
+  }
+
+  const toolName = payload?.tool_name ?? '';
+  const filePath = payload?.tool_input?.file_path ?? '';
+  if (toolName !== 'Write' || !MEMORY_PATH_RE.test(filePath)) return;
+
+  const bearer = (process.env['OLAM_AGENT_MEMORY_BEARER'] ?? '').trim();
+  if (!bearer) return;
+
+  let raw;
+  try {
+    raw = readFileSync(filePath, 'utf8');
+  } catch {
+    return;
+  }
+
+  const { title, type, body } = parseNote(raw);
+  const base = (process.env['OLAM_AGENT_MEMORY_URL'] ?? DEFAULT_URL).replace(/\/$/, '');
+  const url = `${base}/agentmemory/remember`;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const resp = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${bearer}`,
+        'User-Agent': 'olam-agent-memory-hook/2',
+      },
+      body: JSON.stringify({ title, content: body, type }),
+      signal: controller.signal,
+    });
+    // Treat any non-throwing response as delivered (the v1 blob did the same —
+    // it printed on a non-exception urlopen regardless of status code).
+    if (resp) {
+      const label = title.slice(0, 60);
+      process.stderr.write(`\x1b[32m[\u{1F9E0}\u{21E1} Memory saved]\x1b[0m "${label}"\n`);
+    }
+  } catch {
+    // Fail-open: network error / timeout / abort → silent.
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+main().catch(() => {
+  /* fail-open: never propagate to the caller */
+});

package/memory-hooks/agentmemory-session-recall.js

@@ -321,6 +321,10 @@ async function main() {
   const additionalContext =
     `## Recalled from agent memory (query: "${query}")\n\n${lines}\n\n${nudge}`;
 
+  process.stderr.write(
+    `\x1b[34m[🧠⇣ Memory recalled]\x1b[0m (${result.results.length} memories · "${query}")\n`
+  );
+
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: {
       hookEventName: 'SessionStart',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.205",
+  "version": "0.1.207",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"