@pleri/olam-cli 0.1.206 → 0.1.208

package/dist/mcp-server.js

@@ -445,8 +445,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path60, errorMaps, issueData } = params;
-      const fullPath = [...path60, ...issueData.path || []];
+      const { data, path: path62, errorMaps, issueData } = params;
+      const fullPath = [...path62, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -754,11 +754,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path60, key) {
+      constructor(parent, value, path62, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path60;
+        this._path = path62;
         this._key = key;
       }
       get path() {
@@ -7332,8 +7332,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path60) {
-      let input = path60;
+    function removeDotSegments(path62) {
+      let input = path62;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -7532,8 +7532,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path60, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path60 && path60 !== "/" ? path60 : void 0;
+        const [path62, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path62 && path62 !== "/" ? path62 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -10895,12 +10895,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs60, exportName) {
+    function addFormats(ajv, list, fs62, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs60[f]);
+        ajv.addFormat(f, fs62[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -10908,24 +10908,62 @@ var require_dist = __commonJS({
   }
 });
 
+// ../core/dist/paths/olam-paths.js
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+function olamHome() {
+  const fromEnv = process.env["OLAM_HOME"];
+  if (fromEnv && fromEnv.length > 0)
+    return fromEnv;
+  return join2(homedir(), ".olam");
+}
+function claudeDir() {
+  const fromEnv = process.env["OLAM_CLAUDE_DIR"];
+  if (fromEnv && fromEnv.length > 0)
+    return fromEnv;
+  return join2(homedir(), ".claude");
+}
+function globalConfigPath() {
+  const override = process.env["OLAM_GLOBAL_CONFIG_PATH"];
+  if (override && override.length > 0)
+    return override;
+  return join2(olamHome(), "config.json");
+}
+function stateDir() {
+  const override = process.env["OLAM_STATE_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return join2(olamHome(), "state");
+}
+function skillSourcesDir() {
+  const override = process.env["OLAM_SKILL_SOURCES_DIR"];
+  if (override && override.length > 0)
+    return override;
+  return join2(stateDir(), "skill-sources");
+}
+var init_olam_paths = __esm({
+  "../core/dist/paths/olam-paths.js"() {
+    "use strict";
+  }
+});
+
 // ../core/dist/secrets/paths.js
 import * as fs2 from "node:fs";
-import * as os from "node:os";
 import * as path2 from "node:path";
-function olamHome() {
-  return process.env.OLAM_HOME ?? path2.join(os.homedir(), ".olam");
+function olamHome2() {
+  return olamHome();
 }
 function canonicalSecretPath(name) {
-  return path2.join(olamHome(), "secrets", name);
+  return path2.join(olamHome2(), "secrets", name);
 }
 function ensureSecretsDir() {
-  fs2.mkdirSync(path2.join(olamHome(), "secrets"), { recursive: true, mode: 448 });
+  fs2.mkdirSync(path2.join(olamHome2(), "secrets"), { recursive: true, mode: 448 });
 }
 function resolveSecretPath(name) {
   const newPath = canonicalSecretPath(name);
   if (fs2.existsSync(newPath))
     return newPath;
-  const oldPath = path2.join(olamHome(), name);
+  const oldPath = path2.join(olamHome2(), name);
   if (fs2.existsSync(oldPath)) {
     if (!_warnedNames.has(name)) {
       _warnedNames.add(name);
@@ -10942,6 +10980,7 @@ var _warnedNames;
 var init_paths = __esm({
   "../core/dist/secrets/paths.js"() {
     "use strict";
+    init_olam_paths();
     _warnedNames = /* @__PURE__ */ new Set();
   }
 });
@@ -11048,12 +11087,12 @@ var init_version2 = __esm({
 
 // ../core/dist/world/repo-manifest.js
 import { existsSync as existsSync5, lstatSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join5, resolve as resolve3, sep } from "node:path";
+import { join as join6, resolve as resolve3, sep } from "node:path";
 import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path60, ctx, rejectSource) {
+function refineForbiddenKeys(value, path62, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -11061,12 +11100,12 @@ function refineForbiddenKeys(value, path60, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports2.ZodIssueCode.custom,
-        path: [...path60, key],
+        path: [...path62, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path60.length === 0 && key === "source") {
+    if (rejectSource && path62.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports2.ZodIssueCode.custom,
         path: ["source"],
@@ -11074,21 +11113,21 @@ function refineForbiddenKeys(value, path60, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path60, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path62, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path60, rejectSource) {
+function rejectForbiddenKeys(value, path62, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path60}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path62}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path60}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path62}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path60}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path62}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -11112,8 +11151,8 @@ function isPlainObject3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
 }
 function loadRepoManifest(repoDir) {
-  const olamPath = join5(repoDir, ".olam.yaml");
-  const adbPath = join5(repoDir, ".adb.yaml");
+  const olamPath = join6(repoDir, ".olam.yaml");
+  const adbPath = join6(repoDir, ".adb.yaml");
   let manifestPath2;
   let source;
   if (existsSync5(olamPath)) {
@@ -11354,13 +11393,13 @@ var init_repo_manifest = __esm({
 });
 
 // ../core/dist/util/path.js
-import * as os4 from "node:os";
+import * as os3 from "node:os";
 import * as path6 from "node:path";
 function resolveTildePath(p) {
   if (p === "~")
-    return os4.homedir();
+    return os3.homedir();
   if (p.startsWith("~/"))
-    return path6.join(os4.homedir(), p.slice(2));
+    return path6.join(os3.homedir(), p.slice(2));
   if (p.startsWith("~")) {
     throw new Error(`[path] POSIX "~user" syntax is not supported (got "${p}"). Use "~/..." for the operator's home or an absolute path.`);
   }
@@ -11376,14 +11415,14 @@ var init_path = __esm({
 
 // ../core/dist/workspace/store.js
 import * as fs5 from "node:fs";
-import * as os5 from "node:os";
+import * as os4 from "node:os";
 import * as path7 from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 function workspacesDir() {
   const override = process.env["OLAM_WORKSPACES_DIR"];
   if (override && override.length > 0)
     return override;
-  return path7.join(os5.homedir(), ".olam", "workspaces");
+  return path7.join(os4.homedir(), ".olam", "workspaces");
 }
 function validateName(name) {
   if (!WORKSPACE_NAME_PATTERN.test(name)) {
@@ -11752,7 +11791,7 @@ var init_volume = __esm({
 
 // ../adapters/dist/shared/anthropic-base-url.js
 import * as fs6 from "node:fs";
-import * as os6 from "node:os";
+import * as os5 from "node:os";
 import * as path8 from "node:path";
 function normalizeAnthropicBaseUrl(raw) {
   if (!raw)
@@ -11780,7 +11819,7 @@ function readAnthropicBaseUrl() {
   if (fromOlamEnv && fromOlamEnv.length > 0) {
     return normalizeAnthropicBaseUrl(fromOlamEnv.trim());
   }
-  const file2 = path8.join(os6.homedir(), ".olam", "anthropic-base-url");
+  const file2 = path8.join(os5.homedir(), ".olam", "anthropic-base-url");
   try {
     const content = fs6.readFileSync(file2, "utf-8").trim();
     if (content.length > 0)
@@ -12458,7 +12497,7 @@ var init_loader = __esm({
 
 // ../adapters/dist/docker/container.js
 import * as fs9 from "node:fs";
-import * as os7 from "node:os";
+import * as os6 from "node:os";
 import * as path10 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function readAuthSecret() {
@@ -12476,7 +12515,7 @@ function readHostCpToken() {
   const fromEnv = process.env["OLAM_HOST_CP_TOKEN"];
   if (fromEnv && fromEnv.length > 0)
     return fromEnv;
-  const file2 = path10.join(os7.homedir(), ".olam", "host-cp.token");
+  const file2 = path10.join(os6.homedir(), ".olam", "host-cp.token");
   try {
     return fs9.readFileSync(file2, "utf-8").trim();
   } catch {
@@ -12499,9 +12538,9 @@ function isKubernetesServiceSubstrate() {
 }
 function expandHome(p) {
   if (p.startsWith("~/"))
-    return path10.join(os7.homedir(), p.slice(2));
+    return path10.join(os6.homedir(), p.slice(2));
   if (p === "~")
-    return os7.homedir();
+    return os6.homedir();
   return p;
 }
 function readCloudMemorySecretAtPath(secretRef) {
@@ -12743,7 +12782,7 @@ var init_container = __esm({
         ...env
       };
       const envList = Object.entries(worldEnv).map(([k, v]) => `${k}=${v}`);
-      const olamHomeDir = process.env["HOME"] ?? os7.homedir();
+      const olamHomeDir = process.env["HOME"] ?? os6.homedir();
       const hostWorkspacesDir = `${olamHomeDir}/.olam/workspaces`;
       const binds = [
         "/var/run/docker.sock:/var/run/docker.sock",
@@ -13873,8 +13912,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path60, method, body) {
-        const url3 = `${this.config.workerUrl}${path60}`;
+      async request(path62, method, body) {
+        const url3 = `${this.config.workerUrl}${path62}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -14245,19 +14284,19 @@ var init_schema4 = __esm({
 
 // ../core/dist/global-config/store.js
 import * as fs13 from "node:fs";
-import * as os9 from "node:os";
+import * as os8 from "node:os";
 import * as path16 from "node:path";
-function globalConfigPath() {
+function globalConfigPath2() {
   const override = process.env["OLAM_GLOBAL_CONFIG_PATH"];
   if (override && override.length > 0)
     return override;
   if (process.env["VITEST"]) {
-    return path16.join(os9.tmpdir(), `olam-vitest-global-config-${process.pid}.json`);
+    return path16.join(os8.tmpdir(), `olam-vitest-global-config-${process.pid}.json`);
   }
-  return path16.join(os9.homedir(), ".olam", "config.json");
+  return globalConfigPath();
 }
 function readGlobalConfig() {
-  const configPath = globalConfigPath();
+  const configPath = globalConfigPath2();
   if (!fs13.existsSync(configPath)) {
     return { ...DEFAULT_GLOBAL_CONFIG };
   }
@@ -14283,9 +14322,80 @@ function readGlobalConfig() {
       }
     }
     return validated;
-  } catch (err) {
-    throw new GlobalConfigReadError(configPath, err);
+  } catch (strictErr) {
+    const salvaged = quarantineGlobalConfig(migrated.value);
+    if (salvaged !== null) {
+      let backupPath = null;
+      try {
+        backupPath = `${configPath}.quarantine-${Date.now()}`;
+        fs13.copyFileSync(configPath, backupPath);
+      } catch {
+        backupPath = null;
+      }
+      try {
+        writeGlobalConfig(salvaged.value);
+      } catch {
+      }
+      quarantineSink(configPath, { drops: salvaged.drops, backupPath });
+      return salvaged.value;
+    }
+    throw new GlobalConfigReadError(configPath, strictErr);
+  }
+}
+function quarantineGlobalConfig(migratedValue) {
+  if (migratedValue === null || typeof migratedValue !== "object" || Array.isArray(migratedValue)) {
+    return null;
   }
+  const obj = migratedValue;
+  const drops = [];
+  const filterField = (field, schema, dedupeKeys) => {
+    const v = obj[field];
+    if (v === void 0)
+      return [];
+    if (!Array.isArray(v)) {
+      drops.push({ field, entry: v, reason: `${field} is not an array` });
+      return [];
+    }
+    const out = [];
+    const seen = dedupeKeys.map(() => /* @__PURE__ */ new Set());
+    for (const e of v) {
+      const r = schema.safeParse(e);
+      if (!r.success || r.data === void 0) {
+        drops.push({ field, entry: e, reason: r.error?.issues[0]?.message ?? "invalid entry" });
+        continue;
+      }
+      let dupeKey = null;
+      for (let i = 0; i < dedupeKeys.length; i++) {
+        const k = dedupeKeys[i](r.data);
+        if (seen[i].has(k)) {
+          dupeKey = k;
+          break;
+        }
+      }
+      if (dupeKey !== null) {
+        drops.push({ field, entry: e, reason: `duplicate key "${dupeKey}"` });
+        continue;
+      }
+      for (let i = 0; i < dedupeKeys.length; i++)
+        seen[i].add(dedupeKeys[i](r.data));
+      out.push(r.data);
+    }
+    return out;
+  };
+  const repos = filterField("repos", RepoEntrySchema, [(r) => r.name]);
+  const runbooks = filterField("runbooks", RunbookSchema, [(r) => r.name]);
+  const skillSources = filterField("skillSources", SkillSourceSchema, [
+    (s) => s.id,
+    (s) => s.name
+  ]);
+  const metaHooksDisabled = filterField("metaHooksDisabled", MetaHookBlockKindSchema, [
+    (m) => m
+  ]);
+  const candidate = { schemaVersion: 1, repos, runbooks, skillSources, metaHooksDisabled };
+  const final = GlobalConfigSchema.safeParse(candidate);
+  if (!final.success)
+    return null;
+  return { value: final.data, drops };
 }
 function migrateSchemaVersion(parsed) {
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -14298,7 +14408,7 @@ function migrateSchemaVersion(parsed) {
   return { value: { ...obj, schemaVersion: 1 }, changed: true };
 }
 function writeGlobalConfig(config2) {
-  const configPath = globalConfigPath();
+  const configPath = globalConfigPath2();
   const validated = GlobalConfigSchema.parse(config2);
   const dir = path16.dirname(configPath);
   fs13.mkdirSync(dir, { recursive: true });
@@ -14306,11 +14416,27 @@ function writeGlobalConfig(config2) {
   fs13.writeFileSync(tmp, JSON.stringify(validated, null, 2) + "\n", { mode: 420 });
   fs13.renameSync(tmp, configPath);
 }
-var GlobalConfigReadError;
+var quarantineSink, GlobalConfigReadError;
 var init_store2 = __esm({
   "../core/dist/global-config/store.js"() {
     "use strict";
     init_schema4();
+    init_schema3();
+    init_olam_paths();
+    quarantineSink = (configPath, report) => {
+      if (report.drops.length === 0)
+        return;
+      process.stderr.write(`\x1B[33m\u26A0 global config at ${configPath} had ${report.drops.length} invalid entr${report.drops.length === 1 ? "y" : "ies"} \u2014 quarantined (kept the rest):\x1B[0m
+`);
+      for (const d of report.drops) {
+        process.stderr.write(`  \xB7 ${d.field}: ${d.reason}
+`);
+      }
+      if (report.backupPath) {
+        process.stderr.write(`  \u2192 original backed up to ${report.backupPath}
+`);
+      }
+    };
     GlobalConfigReadError = class extends Error {
       constructor(configPath, cause) {
         const msg = cause instanceof Error ? cause.message : String(cause);
@@ -14324,11 +14450,11 @@ var init_store2 = __esm({
 
 // ../core/dist/global-config/repos.js
 import * as fs14 from "node:fs";
-import * as os10 from "node:os";
+import * as os9 from "node:os";
 import * as path17 from "node:path";
 function expandPath(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path17.join(os10.homedir(), p.slice(1));
+    return path17.join(os9.homedir(), p.slice(1));
   }
   return p;
 }
@@ -14608,13 +14734,11 @@ var init_bridge = __esm({
 // ../core/dist/skill-sources/trust-audit-log.js
 import * as fs16 from "node:fs";
 import * as path18 from "node:path";
-import * as os11 from "node:os";
 function skillSourcesAuditLogPath() {
   const override = process.env["OLAM_SKILL_SOURCES_AUDIT_LOG_PATH"];
   if (override && override.length > 0)
     return override;
-  const stateDir = process.env["OLAM_STATE_DIR"] ?? path18.join(os11.homedir(), ".olam", "state");
-  return path18.join(stateDir, SKILL_SOURCES_AUDIT_LOG_FILENAME);
+  return path18.join(stateDir(), SKILL_SOURCES_AUDIT_LOG_FILENAME);
 }
 function appendTrustAudit(entry) {
   const candidate = {
@@ -14658,6 +14782,7 @@ var init_trust_audit_log = __esm({
   "../core/dist/skill-sources/trust-audit-log.js"() {
     "use strict";
     init_v3();
+    init_olam_paths();
     SKILL_SOURCES_AUDIT_LOG_FILENAME = "skill-sources-audit.log";
     TrustActionSchema = external_exports2.enum([
       "added",
@@ -14684,6 +14809,142 @@ var init_trust_audit_log = __esm({
   }
 });
 
+// ../core/dist/skill-sources/clone.js
+import { execFileSync as execFileSync2 } from "node:child_process";
+import * as fs17 from "node:fs";
+import * as path19 from "node:path";
+function skillSourcesRootDir() {
+  return skillSourcesDir();
+}
+function skillSourceClonePath(id) {
+  return path19.join(skillSourcesRootDir(), id);
+}
+function runGit(args, cwd) {
+  try {
+    return execFileSync2("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (err) {
+    throw err;
+  }
+}
+function cloneSkillSource(opts) {
+  const clonePath = skillSourceClonePath(opts.id);
+  if (fs17.existsSync(clonePath)) {
+    throw new Error(`clone path "${clonePath}" already exists. Remove the existing skill-source first.`);
+  }
+  fs17.mkdirSync(skillSourcesRootDir(), { recursive: true });
+  try {
+    runGit(["clone", "--depth", "1", "--branch", opts.branch, opts.gitUrl, clonePath]);
+  } catch (err) {
+    if (fs17.existsSync(clonePath)) {
+      fs17.rmSync(clonePath, { recursive: true, force: true });
+    }
+    throw new SkillSourceGitError("clone", opts.gitUrl, err);
+  }
+  let headSha;
+  try {
+    headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
+  } catch (err) {
+    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+  }
+  return { clonePath, headSha };
+}
+function pullSkillSource(opts) {
+  const clonePath = skillSourceClonePath(opts.id);
+  if (!fs17.existsSync(clonePath)) {
+    throw new Error(`clone path "${clonePath}" does not exist. Run "olam skills source add" first.`);
+  }
+  try {
+    runGit(["fetch", "origin", opts.branch], clonePath);
+    runGit(["reset", "--hard", `origin/${opts.branch}`], clonePath);
+  } catch (err) {
+    throw new SkillSourceGitError("fetch/reset", opts.gitUrl, err);
+  }
+  try {
+    const headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
+    return { headSha };
+  } catch (err) {
+    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+  }
+}
+function removeSkillSourceClone(id) {
+  const clonePath = skillSourceClonePath(id);
+  if (fs17.existsSync(clonePath)) {
+    fs17.rmSync(clonePath, { recursive: true, force: true });
+  }
+}
+var SkillSourceGitError;
+var init_clone = __esm({
+  "../core/dist/skill-sources/clone.js"() {
+    "use strict";
+    init_olam_paths();
+    SkillSourceGitError = class extends Error {
+      op;
+      gitUrl;
+      constructor(op, gitUrl, cause) {
+        const msg = cause instanceof Error ? cause.message : String(cause);
+        super(`git ${op} failed for "${gitUrl}": ${msg}`);
+        this.op = op;
+        this.gitUrl = gitUrl;
+        this.name = "SkillSourceGitError";
+        this.cause = cause;
+      }
+    };
+  }
+});
+
+// ../core/dist/skill-sources/source-file.js
+import * as fs18 from "node:fs";
+import * as path20 from "node:path";
+function sourceSidecarPath(id) {
+  return path20.join(skillSourceClonePath(id), SOURCE_SIDECAR_FILENAME);
+}
+function writeSourceSidecar(entry) {
+  const clonePath = skillSourceClonePath(entry.id);
+  if (!fs18.existsSync(clonePath))
+    return false;
+  try {
+    const validated = SourceSidecarSchema.parse(entry);
+    const target = sourceSidecarPath(entry.id);
+    const tmp = `${target}.tmp-${process.pid}`;
+    fs18.writeFileSync(tmp, JSON.stringify(validated, null, 2) + "\n", { mode: 420 });
+    fs18.renameSync(tmp, target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readSourceSidecar(id) {
+  const target = sourceSidecarPath(id);
+  let raw;
+  try {
+    raw = fs18.readFileSync(target, "utf-8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const result = SourceSidecarSchema.safeParse(parsed);
+  return result.success ? result.data : null;
+}
+var SOURCE_SIDECAR_FILENAME, SourceSidecarSchema;
+var init_source_file = __esm({
+  "../core/dist/skill-sources/source-file.js"() {
+    "use strict";
+    init_schema3();
+    init_clone();
+    SOURCE_SIDECAR_FILENAME = ".olam-source.json";
+    SourceSidecarSchema = SkillSourceSchema;
+  }
+});
+
 // ../core/dist/skill-sources/store.js
 import * as crypto3 from "node:crypto";
 function deriveSkillSourceId(gitUrl) {
@@ -14716,6 +14977,7 @@ function addSkillSource(entry) {
     addedAt: now
   };
   writeGlobalConfig({ ...config2, skillSources: [...config2.skillSources, newEntry] });
+  writeSourceSidecar(newEntry);
   try {
     appendTrustAudit({
       gitUrl: redactUrl2(entry.gitUrl),
@@ -14833,6 +15095,7 @@ function updateSkillSource(id, patch) {
   const next = [...config2.skillSources];
   next[idx] = updated;
   writeGlobalConfig({ ...config2, skillSources: next });
+  writeSourceSidecar(updated);
   return updated;
 }
 var PREFIX_PATTERN3;
@@ -14843,102 +15106,141 @@ var init_store3 = __esm({
     init_schema3();
     init_trust_audit_log();
     init_source_config_schema();
+    init_source_file();
     PREFIX_PATTERN3 = /^[a-z0-9][a-z0-9_-]{0,38}$/;
   }
 });
 
-// ../core/dist/skill-sources/clone.js
-import { execFileSync as execFileSync2 } from "node:child_process";
-import * as fs17 from "node:fs";
-import * as os12 from "node:os";
-import * as path19 from "node:path";
-function skillSourcesRootDir() {
-  const override = process.env["OLAM_SKILL_SOURCES_DIR"];
-  if (override && override.length > 0)
-    return override;
-  return path19.join(os12.homedir(), ".olam", "state", "skill-sources");
-}
-function skillSourceClonePath(id) {
-  return path19.join(skillSourcesRootDir(), id);
-}
-function runGit(args, cwd) {
+// ../core/dist/skill-sources/reconcile.js
+import { execFileSync as execFileSync3 } from "node:child_process";
+import * as fs19 from "node:fs";
+import * as path21 from "node:path";
+function gitRead(args, cwd) {
   try {
-    return execFileSync2("git", args, {
+    return execFileSync3("git", args, {
       cwd,
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-  } catch (err) {
-    throw err;
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
   }
 }
-function cloneSkillSource(opts) {
-  const clonePath = skillSourceClonePath(opts.id);
-  if (fs17.existsSync(clonePath)) {
-    throw new Error(`clone path "${clonePath}" already exists. Remove the existing skill-source first.`);
-  }
-  fs17.mkdirSync(skillSourcesRootDir(), { recursive: true });
+function nameFromGitUrl(gitUrl) {
+  const tail = gitUrl.replace(/\.git$/, "").replace(/\/+$/, "").split(/[/:]/).filter((s) => s.length > 0).pop();
+  if (!tail)
+    return null;
+  const sanitized = tail.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return NAME_PATTERN2.test(sanitized) ? sanitized : null;
+}
+function recoverFromGit(id, clonePath) {
+  const gitUrl = gitRead(["remote", "get-url", "origin"], clonePath);
+  if (!gitUrl)
+    return null;
+  const branch = gitRead(["symbolic-ref", "--short", "HEAD"], clonePath) ?? gitRead(["rev-parse", "--abbrev-ref", "HEAD"], clonePath) ?? "main";
+  const headSha = gitRead(["rev-parse", "HEAD"], clonePath);
+  let addedAt = 0;
   try {
-    runGit(["clone", "--depth", "1", "--branch", opts.branch, opts.gitUrl, clonePath]);
-  } catch (err) {
-    if (fs17.existsSync(clonePath)) {
-      fs17.rmSync(clonePath, { recursive: true, force: true });
-    }
-    throw new SkillSourceGitError("clone", opts.gitUrl, err);
+    addedAt = Math.floor(fs19.statSync(clonePath).ctimeMs);
+  } catch {
+    addedAt = 0;
   }
-  let headSha;
+  const entry = {
+    id,
+    name: nameFromGitUrl(gitUrl) ?? `source-${id}`,
+    gitUrl,
+    branch,
+    addedAt,
+    ...headSha && SHA_PATTERN.test(headSha) ? { lastPulledSha: headSha } : {}
+  };
+  return entry;
+}
+function listCloneIds() {
+  const root = skillSourcesRootDir();
+  let dirents;
   try {
-    headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
-  } catch (err) {
-    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+    dirents = fs19.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
   }
-  return { clonePath, headSha };
+  return dirents.filter((d) => d.isDirectory() && fs19.existsSync(path21.join(root, d.name, ".git"))).map((d) => d.name);
 }
-function pullSkillSource(opts) {
-  const clonePath = skillSourceClonePath(opts.id);
-  if (!fs17.existsSync(clonePath)) {
-    throw new Error(`clone path "${clonePath}" does not exist. Run "olam skills source add" first.`);
+function reconcileSkillSources(opts = {}) {
+  const config2 = readGlobalConfig();
+  const existingById = new Map(config2.skillSources.map((s) => [s.id, s]));
+  const diskIds = new Set(listCloneIds());
+  const added = [];
+  const registryOnly = [];
+  const sidecarsBackfilled = [];
+  const usedNames = /* @__PURE__ */ new Set();
+  const ensureUniqueName = (entry) => {
+    if (!usedNames.has(entry.name)) {
+      usedNames.add(entry.name);
+      return entry;
+    }
+    const suffixed = `${entry.name}-${entry.id.slice(0, 6)}`.slice(0, 64).replace(/-+$/g, "");
+    usedNames.add(suffixed);
+    return { ...entry, name: suffixed };
+  };
+  const next = [];
+  for (const entry of config2.skillSources) {
+    if (diskIds.has(entry.id)) {
+      usedNames.add(entry.name);
+      next.push(entry);
+    } else {
+      registryOnly.push(entry);
+      if (!opts.prune) {
+        usedNames.add(entry.name);
+        next.push(entry);
+      }
+    }
   }
-  try {
-    runGit(["fetch", "origin", opts.branch], clonePath);
-    runGit(["reset", "--hard", `origin/${opts.branch}`], clonePath);
-  } catch (err) {
-    throw new SkillSourceGitError("fetch/reset", opts.gitUrl, err);
+  for (const id of diskIds) {
+    if (existingById.has(id)) {
+      if (readSourceSidecar(id) === null && writeSourceSidecar(existingById.get(id))) {
+        sidecarsBackfilled.push(id);
+      }
+      continue;
+    }
+    const sidecar = readSourceSidecar(id);
+    const recovered = sidecar ? { ...sidecar, id } : recoverFromGit(id, skillSourceClonePath(id));
+    if (recovered === null)
+      continue;
+    const unique = ensureUniqueName(recovered);
+    next.push(unique);
+    added.push(unique);
+    if (sidecar === null && writeSourceSidecar(unique))
+      sidecarsBackfilled.push(id);
   }
-  try {
-    const headSha = runGit(["rev-parse", "HEAD"], clonePath).trim();
-    return { headSha };
-  } catch (err) {
-    throw new SkillSourceGitError("rev-parse", opts.gitUrl, err);
+  const pruned = opts.prune ? registryOnly : [];
+  const changed = next.length !== config2.skillSources.length || next.some((e, i) => e !== config2.skillSources[i]);
+  if (changed) {
+    writeGlobalConfig({ ...config2, skillSources: next });
   }
+  return { added, registryOnly, pruned, sidecarsBackfilled, changed };
 }
-function removeSkillSourceClone(id) {
-  const clonePath = skillSourceClonePath(id);
-  if (fs17.existsSync(clonePath)) {
-    fs17.rmSync(clonePath, { recursive: true, force: true });
-  }
+function reconcileIfRegistryEmpty() {
+  if (readGlobalConfig().skillSources.length > 0)
+    return null;
+  if (listCloneIds().length === 0)
+    return null;
+  return reconcileSkillSources();
 }
-var SkillSourceGitError;
-var init_clone = __esm({
-  "../core/dist/skill-sources/clone.js"() {
+var NAME_PATTERN2, SHA_PATTERN;
+var init_reconcile = __esm({
+  "../core/dist/skill-sources/reconcile.js"() {
     "use strict";
-    SkillSourceGitError = class extends Error {
-      op;
-      gitUrl;
-      constructor(op, gitUrl, cause) {
-        const msg = cause instanceof Error ? cause.message : String(cause);
-        super(`git ${op} failed for "${gitUrl}": ${msg}`);
-        this.op = op;
-        this.gitUrl = gitUrl;
-        this.name = "SkillSourceGitError";
-        this.cause = cause;
-      }
-    };
+    init_store2();
+    init_schema3();
+    init_clone();
+    init_source_file();
+    NAME_PATTERN2 = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+    SHA_PATTERN = /^[a-f0-9]{40}$/;
   }
 });
 
 // ../core/dist/skill-sources/hook-template.js
-import * as fs18 from "node:fs";
+import * as fs20 from "node:fs";
 function buildSkillsHookEntry() {
   return {
     matcher: "",
@@ -14997,14 +15299,14 @@ function computeUninstall(settings) {
   return { status: "removed", settingsAfter: next };
 }
 function uninstallSkillsHookFromFile(filePath) {
-  if (!fs18.existsSync(filePath)) {
+  if (!fs20.existsSync(filePath)) {
     return { status: "no-settings" };
   }
-  const raw = fs18.readFileSync(filePath, "utf-8");
+  const raw = fs20.readFileSync(filePath, "utf-8");
   const settings = raw.trim() ? JSON.parse(raw) : {};
   const result = computeUninstall(settings);
   if (result.status === "removed" && result.settingsAfter) {
-    fs18.writeFileSync(filePath, JSON.stringify(result.settingsAfter, null, 2) + "\n");
+    fs20.writeFileSync(filePath, JSON.stringify(result.settingsAfter, null, 2) + "\n");
   }
   return result;
 }
@@ -15020,8 +15322,8 @@ var init_hook_template = __esm({
 });
 
 // ../core/dist/world/merge-settings.js
-import * as fs19 from "node:fs";
-import * as path20 from "node:path";
+import * as fs21 from "node:fs";
+import * as path22 from "node:path";
 import * as crypto4 from "node:crypto";
 function mergeHomeSettingsJson(filePath, options) {
   let settings;
@@ -15082,10 +15384,10 @@ function mergeHomeSettingsJson(filePath, options) {
   return { status: "installed", message: `settings.json updated at ${filePath}` };
 }
 function readSettings(filePath) {
-  if (!fs19.existsSync(filePath)) {
+  if (!fs21.existsSync(filePath)) {
     return {};
   }
-  const raw = fs19.readFileSync(filePath, "utf-8");
+  const raw = fs21.readFileSync(filePath, "utf-8");
   if (!raw.trim())
     return {};
   return JSON.parse(raw);
@@ -15124,13 +15426,13 @@ function isHookSentinelPresent(matchers, sentinel) {
   return false;
 }
 function atomicWriteJson(filePath, data) {
-  const dir = path20.dirname(filePath);
-  fs19.mkdirSync(dir, { recursive: true });
+  const dir = path22.dirname(filePath);
+  fs21.mkdirSync(dir, { recursive: true });
   const rand = crypto4.randomBytes(6).toString("hex");
   const tmp = `${filePath}.tmp.${process.pid}.${rand}`;
   const json2 = JSON.stringify(data, null, 2) + "\n";
-  fs19.writeFileSync(tmp, json2, { mode: 420 });
-  fs19.renameSync(tmp, filePath);
+  fs21.writeFileSync(tmp, json2, { mode: 420 });
+  fs21.renameSync(tmp, filePath);
 }
 var init_merge_settings = __esm({
   "../core/dist/world/merge-settings.js"() {
@@ -15139,25 +15441,24 @@ var init_merge_settings = __esm({
 });
 
 // ../core/dist/skill-sources/hook-install.js
-import * as fs20 from "node:fs";
-import * as path21 from "node:path";
-import * as os13 from "node:os";
+import * as fs22 from "node:fs";
+import * as path23 from "node:path";
 function settingsPathFor(scope, cwd) {
   if (scope === "user") {
-    return path21.join(os13.homedir(), ".claude", "settings.json");
+    return path23.join(claudeDir(), "settings.json");
   }
-  return path21.join(cwd ?? process.cwd(), ".claude", "settings.json");
+  return path23.join(cwd ?? process.cwd(), ".claude", "settings.json");
 }
 function backupFile(filePath) {
-  if (!fs20.existsSync(filePath))
+  if (!fs22.existsSync(filePath))
     return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs20.copyFileSync(filePath, backupPath);
+  fs22.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 function installSkillsHookToFile(filePath) {
-  fs20.mkdirSync(path21.dirname(filePath), { recursive: true });
+  fs22.mkdirSync(path23.dirname(filePath), { recursive: true });
   const backupPath = backupFile(filePath);
   const result = mergeHomeSettingsJson(filePath, {
     ensureHook: {
@@ -15168,7 +15469,7 @@ function installSkillsHookToFile(filePath) {
   });
   if (result.status === "already-present" && backupPath) {
     try {
-      fs20.unlinkSync(backupPath);
+      fs22.unlinkSync(backupPath);
     } catch {
     }
     return { status: "already-present", filePath, backupPath: null };
@@ -15176,11 +15477,11 @@ function installSkillsHookToFile(filePath) {
   return { status: result.status, filePath, backupPath };
 }
 function isSkillsHookInstalled(filePath) {
-  if (!fs20.existsSync(filePath))
+  if (!fs22.existsSync(filePath))
     return false;
   let parsed;
   try {
-    parsed = JSON.parse(fs20.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs22.readFileSync(filePath, "utf-8"));
   } catch {
     return false;
   }
@@ -15212,42 +15513,43 @@ function isSkillsHookInstalled(filePath) {
 var init_hook_install = __esm({
   "../core/dist/skill-sources/hook-install.js"() {
     "use strict";
+    init_olam_paths();
     init_merge_settings();
     init_hook_template();
   }
 });
 
 // ../core/dist/skill-sources/migration-snapshot.js
-import * as fs21 from "node:fs";
-import * as os14 from "node:os";
-import * as path22 from "node:path";
+import * as fs23 from "node:fs";
+import * as os10 from "node:os";
+import * as path24 from "node:path";
 function claudeDirInternal() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path22.join(os14.homedir(), ".claude");
+  return path24.join(os10.homedir(), ".claude");
 }
 function migrationSnapshotsDir() {
   const override = process.env["OLAM_MIGRATION_SNAPSHOTS_DIR"];
   if (override && override.length > 0)
     return override;
-  return path22.join(os14.homedir(), ".olam", "state", "migration-snapshots");
+  return path24.join(os10.homedir(), ".olam", "state", "migration-snapshots");
 }
 function listToolboxManagedSymlinks(toolboxPath) {
   const claude = claudeDirInternal();
   const out = [];
   const BUCKETS2 = ["skills", "agents", "scripts", "rules", "commands"];
   for (const bucket of BUCKETS2) {
-    const dir = path22.join(claude, bucket);
-    if (!fs21.existsSync(dir))
+    const dir = path24.join(claude, bucket);
+    if (!fs23.existsSync(dir))
       continue;
-    for (const name of fs21.readdirSync(dir)) {
-      const link = path22.join(dir, name);
+    for (const name of fs23.readdirSync(dir)) {
+      const link = path24.join(dir, name);
       try {
-        const stat2 = fs21.lstatSync(link);
+        const stat2 = fs23.lstatSync(link);
         if (!stat2.isSymbolicLink())
           continue;
-        const target = fs21.readlinkSync(link);
+        const target = fs23.readlinkSync(link);
         if (target.startsWith(toolboxPath)) {
           out.push({ link, target });
         }
@@ -15260,25 +15562,25 @@ function listToolboxManagedSymlinks(toolboxPath) {
 function detectToolboxState(opts) {
   const claude = claudeDirInternal();
   const toolboxPath = opts.toolboxPath;
-  const namespace = opts.namespace ?? path22.basename(toolboxPath);
-  const atlasUserFile = path22.join(claude, ".atlas-user");
-  const atlasUser = fs21.existsSync(atlasUserFile) ? fs21.readFileSync(atlasUserFile, "utf-8").trim() || void 0 : void 0;
+  const namespace = opts.namespace ?? path24.basename(toolboxPath);
+  const atlasUserFile = path24.join(claude, ".atlas-user");
+  const atlasUser = fs23.existsSync(atlasUserFile) ? fs23.readFileSync(atlasUserFile, "utf-8").trim() || void 0 : void 0;
   let subscriptionsJson;
   if (atlasUser) {
-    const sp = path22.join(toolboxPath, "members", atlasUser, "subscriptions.json");
-    if (fs21.existsSync(sp)) {
+    const sp = path24.join(toolboxPath, "members", atlasUser, "subscriptions.json");
+    if (fs23.existsSync(sp)) {
       try {
-        subscriptionsJson = JSON.parse(fs21.readFileSync(sp, "utf-8"));
+        subscriptionsJson = JSON.parse(fs23.readFileSync(sp, "utf-8"));
       } catch {
       }
     }
   }
   const atlasManagedSymlinks = listToolboxManagedSymlinks(toolboxPath);
   let originalSessionStartHook;
-  const settingsPath = path22.join(claude, "settings.json");
-  if (fs21.existsSync(settingsPath)) {
+  const settingsPath = path24.join(claude, "settings.json");
+  if (fs23.existsSync(settingsPath)) {
     try {
-      const settings = JSON.parse(fs21.readFileSync(settingsPath, "utf-8"));
+      const settings = JSON.parse(fs23.readFileSync(settingsPath, "utf-8"));
       const ss = settings?.hooks?.SessionStart;
       if (Array.isArray(ss))
         originalSessionStartHook = ss;
@@ -15301,21 +15603,21 @@ function detectToolboxState(opts) {
 }
 function writeMigrationSnapshot(snapshot) {
   const dir = migrationSnapshotsDir();
-  fs21.mkdirSync(dir, { recursive: true });
+  fs23.mkdirSync(dir, { recursive: true });
   const stamp = snapshot.takenAt.replace(/[:.]/g, "-");
-  const file2 = path22.join(dir, `${snapshot.namespace}-${stamp}.json`);
-  fs21.writeFileSync(file2, JSON.stringify(snapshot, null, 2) + "\n", { mode: 420 });
+  const file2 = path24.join(dir, `${snapshot.namespace}-${stamp}.json`);
+  fs23.writeFileSync(file2, JSON.stringify(snapshot, null, 2) + "\n", { mode: 420 });
   return file2;
 }
 function readLatestMigrationSnapshot(opts = {}) {
   const dir = migrationSnapshotsDir();
-  if (!fs21.existsSync(dir))
+  if (!fs23.existsSync(dir))
     return void 0;
-  const files = fs21.readdirSync(dir).filter((f) => f.endsWith(".json")).sort().reverse();
+  const files = fs23.readdirSync(dir).filter((f) => f.endsWith(".json")).sort().reverse();
   for (const f of files) {
-    const full = path22.join(dir, f);
+    const full = path24.join(dir, f);
     try {
-      const snapshot = JSON.parse(fs21.readFileSync(full, "utf-8"));
+      const snapshot = JSON.parse(fs23.readFileSync(full, "utf-8"));
       if (snapshot.schemaVersion !== MIGRATION_SNAPSHOT_SCHEMA_VERSION)
         continue;
       if (typeof snapshot.atlasToolboxRepoPath !== "string")
@@ -15332,7 +15634,7 @@ function readLatestMigrationSnapshot(opts = {}) {
   return void 0;
 }
 function readMigrationSnapshotFromPath(p) {
-  return JSON.parse(fs21.readFileSync(p, "utf-8"));
+  return JSON.parse(fs23.readFileSync(p, "utf-8"));
 }
 var MIGRATION_SNAPSHOT_SCHEMA_VERSION;
 var init_migration_snapshot = __esm({
@@ -15343,15 +15645,15 @@ var init_migration_snapshot = __esm({
 });
 
 // ../core/dist/skill-sync/artifact-resolver.js
-import * as fs22 from "node:fs";
-import * as path23 from "node:path";
+import * as fs24 from "node:fs";
+import * as path25 from "node:path";
 function resolveSubscriptions(opts) {
   const { clonePath, atlasUser } = opts;
   if (atlasUser) {
-    const subsPath = path23.join(clonePath, "members", atlasUser, "subscriptions.json");
-    if (fs22.existsSync(subsPath)) {
+    const subsPath = path25.join(clonePath, "members", atlasUser, "subscriptions.json");
+    if (fs24.existsSync(subsPath)) {
       try {
-        const parsed = JSON.parse(fs22.readFileSync(subsPath, "utf-8"));
+        const parsed = JSON.parse(fs24.readFileSync(subsPath, "utf-8"));
         if (Array.isArray(parsed?.categories)) {
           return {
             categories: parsed.categories.filter((c) => typeof c === "string"),
@@ -15363,10 +15665,10 @@ function resolveSubscriptions(opts) {
       }
     }
   }
-  const catsPath = path23.join(clonePath, "shared", "categories.json");
-  if (fs22.existsSync(catsPath)) {
+  const catsPath = path25.join(clonePath, "shared", "categories.json");
+  if (fs24.existsSync(catsPath)) {
     try {
-      const parsed = JSON.parse(fs22.readFileSync(catsPath, "utf-8"));
+      const parsed = JSON.parse(fs24.readFileSync(catsPath, "utf-8"));
       if (Array.isArray(parsed?.categories)) {
         return {
           categories: parsed.categories.map((c) => c.id).filter((id) => typeof id === "string"),
@@ -15377,14 +15679,14 @@ function resolveSubscriptions(opts) {
     } catch {
     }
   }
-  const sharedDir = path23.join(clonePath, "shared");
+  const sharedDir = path25.join(clonePath, "shared");
   const cats = [];
-  if (fs22.existsSync(sharedDir)) {
-    for (const name of fs22.readdirSync(sharedDir)) {
-      const dir = path23.join(sharedDir, name);
-      if (!fs22.statSync(dir).isDirectory())
+  if (fs24.existsSync(sharedDir)) {
+    for (const name of fs24.readdirSync(sharedDir)) {
+      const dir = path25.join(sharedDir, name);
+      if (!fs24.statSync(dir).isDirectory())
         continue;
-      if (fs22.existsSync(path23.join(dir, "skills")) || fs22.existsSync(path23.join(dir, "agents"))) {
+      if (fs24.existsSync(path25.join(dir, "skills")) || fs24.existsSync(path25.join(dir, "agents"))) {
         cats.push(name);
       }
     }
@@ -15392,29 +15694,29 @@ function resolveSubscriptions(opts) {
   return { categories: cats, fromSubscriptionsFile: false, atlasUser };
 }
 function listDirSafe(dir) {
-  if (!fs22.existsSync(dir))
+  if (!fs24.existsSync(dir))
     return [];
-  return fs22.readdirSync(dir);
+  return fs24.readdirSync(dir);
 }
 function resolveSkillsDir(opts) {
   const { sourceId, baseDir } = opts;
   const out = [];
   for (const name of listDirSafe(baseDir)) {
-    const subdir = path23.join(baseDir, name);
-    if (!fs22.statSync(subdir).isDirectory())
+    const subdir = path25.join(baseDir, name);
+    if (!fs24.statSync(subdir).isDirectory())
       continue;
-    if (!fs22.existsSync(path23.join(subdir, "SKILL.md")))
+    if (!fs24.existsSync(path25.join(subdir, "SKILL.md")))
       continue;
     out.push({ kind: "skill", sourceId, sourcePath: subdir, deployBasename: name });
-    const subagentsDir = path23.join(subdir, "references", "agents");
-    if (fs22.existsSync(subagentsDir) && fs22.statSync(subagentsDir).isDirectory()) {
+    const subagentsDir = path25.join(subdir, "references", "agents");
+    if (fs24.existsSync(subagentsDir) && fs24.statSync(subagentsDir).isDirectory()) {
       for (const f of listDirSafe(subagentsDir)) {
         if (!f.endsWith(".md"))
           continue;
         out.push({
           kind: "subagent",
           sourceId,
-          sourcePath: path23.join(subagentsDir, f),
+          sourcePath: path25.join(subagentsDir, f),
           deployBasename: f,
           parentSkill: name
         });
@@ -15427,8 +15729,8 @@ function resolveAgentsDir(opts) {
   const { sourceId, baseDir } = opts;
   const out = [];
   for (const name of listDirSafe(baseDir)) {
-    const full = path23.join(baseDir, name);
-    const stat2 = fs22.statSync(full);
+    const full = path25.join(baseDir, name);
+    const stat2 = fs24.statSync(full);
     if (stat2.isFile() && name.endsWith(".md")) {
       out.push({ kind: "agent", sourceId, sourcePath: full, deployBasename: name });
     } else if (stat2.isDirectory()) {
@@ -15438,7 +15740,7 @@ function resolveAgentsDir(opts) {
         out.push({
           kind: "agent",
           sourceId,
-          sourcePath: path23.join(full, f),
+          sourcePath: path25.join(full, f),
           deployBasename: `${name}-${f}`
         });
       }
@@ -15450,8 +15752,8 @@ function resolveScriptsDir(opts) {
   const { sourceId, baseDir } = opts;
   const out = [];
   for (const name of listDirSafe(baseDir)) {
-    const full = path23.join(baseDir, name);
-    const stat2 = fs22.statSync(full);
+    const full = path25.join(baseDir, name);
+    const stat2 = fs24.statSync(full);
     if (stat2.isFile() && name.endsWith(".sh")) {
       out.push({ kind: "script", sourceId, sourcePath: full, deployBasename: name });
     } else if (stat2.isDirectory()) {
@@ -15466,8 +15768,8 @@ function resolveRulesDir(opts) {
   for (const name of listDirSafe(baseDir)) {
     if (!name.endsWith(".md"))
       continue;
-    const full = path23.join(baseDir, name);
-    if (!fs22.statSync(full).isFile())
+    const full = path25.join(baseDir, name);
+    if (!fs24.statSync(full).isFile())
       continue;
     out.push({ kind: "rule", sourceId, sourcePath: full, deployBasename: name });
   }
@@ -15479,8 +15781,8 @@ function resolveJsonDir(opts) {
   for (const name of listDirSafe(baseDir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path23.join(baseDir, name);
-    if (!fs22.statSync(full).isFile())
+    const full = path25.join(baseDir, name);
+    if (!fs24.statSync(full).isFile())
       continue;
     out.push({ kind, sourceId, sourcePath: full, deployBasename: name });
   }
@@ -15492,8 +15794,8 @@ function resolveOverlaysDir(opts) {
   for (const name of listDirSafe(baseDir)) {
     if (!name.endsWith(".md"))
       continue;
-    const full = path23.join(baseDir, name);
-    if (!fs22.statSync(full).isFile())
+    const full = path25.join(baseDir, name);
+    if (!fs24.statSync(full).isFile())
       continue;
     const deployBasename = name.replace(/\.md$/, "");
     out.push({
@@ -15511,33 +15813,33 @@ function resolveSourceArtifacts(opts) {
   const subscription = resolveSubscriptions({ clonePath, atlasUser });
   const artifacts = [];
   for (const cat of subscription.categories) {
-    const catDir = path23.join(clonePath, "shared", cat);
-    if (!fs22.existsSync(catDir))
+    const catDir = path25.join(clonePath, "shared", cat);
+    if (!fs24.existsSync(catDir))
       continue;
-    artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path23.join(catDir, "skills") }));
-    artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path23.join(catDir, "agents") }));
-    artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path23.join(catDir, "scripts") }));
-    artifacts.push(...resolveRulesDir({ sourceId, baseDir: path23.join(catDir, "rules") }));
-    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path23.join(catDir, "hooks"), kind: "hook" }));
-    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path23.join(catDir, "permissions"), kind: "permission" }));
+    artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path25.join(catDir, "skills") }));
+    artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path25.join(catDir, "agents") }));
+    artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path25.join(catDir, "scripts") }));
+    artifacts.push(...resolveRulesDir({ sourceId, baseDir: path25.join(catDir, "rules") }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path25.join(catDir, "hooks"), kind: "hook" }));
+    artifacts.push(...resolveJsonDir({ sourceId, baseDir: path25.join(catDir, "permissions"), kind: "permission" }));
   }
   if (atlasUser) {
-    const memberRoot = path23.join(clonePath, "members", atlasUser);
-    if (fs22.existsSync(memberRoot)) {
-      artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path23.join(memberRoot, "skills") }));
-      artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path23.join(memberRoot, "agents") }));
-      artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path23.join(memberRoot, "scripts") }));
-      artifacts.push(...resolveRulesDir({ sourceId, baseDir: path23.join(memberRoot, "rules") }));
-      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path23.join(memberRoot, "hooks"), kind: "hook" }));
-      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path23.join(memberRoot, "permissions"), kind: "permission" }));
+    const memberRoot = path25.join(clonePath, "members", atlasUser);
+    if (fs24.existsSync(memberRoot)) {
+      artifacts.push(...resolveSkillsDir({ sourceId, baseDir: path25.join(memberRoot, "skills") }));
+      artifacts.push(...resolveAgentsDir({ sourceId, baseDir: path25.join(memberRoot, "agents") }));
+      artifacts.push(...resolveScriptsDir({ sourceId, baseDir: path25.join(memberRoot, "scripts") }));
+      artifacts.push(...resolveRulesDir({ sourceId, baseDir: path25.join(memberRoot, "rules") }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path25.join(memberRoot, "hooks"), kind: "hook" }));
+      artifacts.push(...resolveJsonDir({ sourceId, baseDir: path25.join(memberRoot, "permissions"), kind: "permission" }));
       artifacts.push(...resolveOverlaysDir({
         sourceId,
-        baseDir: path23.join(memberRoot, "skills.overrides"),
+        baseDir: path25.join(memberRoot, "skills.overrides"),
         targetKind: "skill"
       }));
       artifacts.push(...resolveOverlaysDir({
         sourceId,
-        baseDir: path23.join(memberRoot, "agents.overrides"),
+        baseDir: path25.join(memberRoot, "agents.overrides"),
         targetKind: "agent"
       }));
     }
@@ -15603,14 +15905,14 @@ var init_shim_targets = __esm({
 });
 
 // ../core/dist/skill-sync/symlink-deployer.js
-import * as fs23 from "node:fs";
-import * as os15 from "node:os";
-import * as path24 from "node:path";
-function claudeDir() {
+import * as fs25 from "node:fs";
+import * as os11 from "node:os";
+import * as path26 from "node:path";
+function claudeDir2() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path24.join(os15.homedir(), ".claude");
+  return path26.join(os11.homedir(), ".claude");
 }
 function bucketFor(kind) {
   switch (kind) {
@@ -15670,15 +15972,15 @@ function detectCollisions(artifacts) {
 function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences, expectedAgentWinnerNames) {
   const shadowBackups = [];
   for (const bucket of BUCKETS) {
-    const dir = path24.join(claude, bucket);
-    if (!fs23.existsSync(dir))
+    const dir = path26.join(claude, bucket);
+    if (!fs25.existsSync(dir))
       continue;
-    for (const name of fs23.readdirSync(dir)) {
+    for (const name of fs25.readdirSync(dir)) {
       if (name === ".olam-merged")
         continue;
-      const p = path24.join(dir, name);
+      const p = path26.join(dir, name);
       try {
-        const stat2 = fs23.lstatSync(p);
+        const stat2 = fs25.lstatSync(p);
         if (stat2.isSymbolicLink()) {
           if (bucket === "scripts" && overlayReferences !== void 0) {
             const refs = overlayReferences.get(name);
@@ -15699,7 +16001,7 @@ function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences, e
 `);
             }
           }
-          fs23.unlinkSync(p);
+          fs25.unlinkSync(p);
         } else if (bucket === "agents" && stat2.isFile() && !name.includes(".shadow-backup-")) {
           const hasWinner = expectedAgentWinnerNames !== void 0 ? expectedAgentWinnerNames.has(name) : true;
           if (hasWinner) {
@@ -15716,34 +16018,34 @@ function cleanManagedSymlinks(claude, installedOlamVersion, overlayReferences, e
 function shadowBackup(link) {
   const epoch = Math.floor(Date.now() / 1e3);
   const backup = `${link}.shadow-backup-${epoch}`;
-  fs23.renameSync(link, backup);
+  fs25.renameSync(link, backup);
   return backup;
 }
 function linkIfNeeded(target, link) {
   try {
-    const existing = fs23.readlinkSync(link);
+    const existing = fs25.readlinkSync(link);
     if (existing === target)
       return { created: false };
   } catch {
   }
   let isLink = false;
   try {
-    isLink = fs23.lstatSync(link).isSymbolicLink();
+    isLink = fs25.lstatSync(link).isSymbolicLink();
   } catch {
   }
   let backup;
   if (isLink) {
-    fs23.unlinkSync(link);
-  } else if (fs23.existsSync(link)) {
+    fs25.unlinkSync(link);
+  } else if (fs25.existsSync(link)) {
     backup = shadowBackup(link);
   }
-  fs23.symlinkSync(target, link);
+  fs25.symlinkSync(target, link);
   return { created: true, shadowBackup: backup };
 }
 function deployArtifacts(artifacts, opts) {
-  const claude = claudeDir();
+  const claude = claudeDir2();
   for (const bucket of BUCKETS) {
-    fs23.mkdirSync(path24.join(claude, bucket), { recursive: true });
+    fs25.mkdirSync(path26.join(claude, bucket), { recursive: true });
   }
   const { winners, collisions } = detectCollisions(artifacts);
   const expectedAgentWinnerNames = new Set(winners.filter((a) => a.kind === "agent").map((a) => a.deployBasename));
@@ -15753,11 +16055,11 @@ function deployArtifacts(artifacts, opts) {
     const bucket = bucketFor(artifact.kind);
     if (!bucket)
       continue;
-    const linkPath = path24.join(claude, bucket, artifact.deployBasename);
+    const linkPath = path26.join(claude, bucket, artifact.deployBasename);
     if (artifact.kind === "agent" && artifact.resolvedContent !== void 0) {
       const tmpPath = `${linkPath}.tmp-${process.pid}-${Date.now()}`;
-      fs23.writeFileSync(tmpPath, artifact.resolvedContent);
-      fs23.renameSync(tmpPath, linkPath);
+      fs25.writeFileSync(tmpPath, artifact.resolvedContent);
+      fs25.renameSync(tmpPath, linkPath);
       result.linked += 1;
       continue;
     }
@@ -15779,7 +16081,7 @@ var init_symlink_deployer = __esm({
 });
 
 // ../core/dist/meta-hooks/memory-recall.js
-import * as fs24 from "node:fs";
+import * as fs26 from "node:fs";
 function buildMemoryRecallHookEntry() {
   return {
     matcher: OLAM_META_MEMORY_RECALL_MATCHER,
@@ -15854,7 +16156,7 @@ var init_memory_recall = __esm({
 });
 
 // ../core/dist/meta-hooks/memory-classify.js
-import * as fs25 from "node:fs";
+import * as fs27 from "node:fs";
 function buildMemoryClassifyHookEntry() {
   return {
     matcher: OLAM_META_MEMORY_CLASSIFY_MATCHER,
@@ -15929,7 +16231,7 @@ var init_memory_classify = __esm({
 });
 
 // ../core/dist/meta-hooks/model-router.js
-import * as fs26 from "node:fs";
+import * as fs28 from "node:fs";
 function buildModelRouterHookEntry() {
   return {
     hooks: [
@@ -16003,9 +16305,9 @@ var init_model_router = __esm({
 });
 
 // ../core/dist/meta-hooks/model-router-deploy.js
-import { existsSync as existsSync30, mkdirSync as mkdirSync16, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "node:fs";
-import { homedir as homedir18 } from "node:os";
-import { dirname as dirname13, join as join27, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync16, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
+import { dirname as dirname13, join as join30, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveModelRouterSourcePath() {
   const here = dirname13(fileURLToPath3(import.meta.url));
@@ -16019,28 +16321,28 @@ function resolveModelRouterSourcePath() {
     resolve7(here, "..", "..", "hooks", MODEL_ROUTER_SCRIPT_BASENAME)
   ];
   for (const candidate of candidates) {
-    if (existsSync30(candidate))
+    if (existsSync32(candidate))
       return candidate;
   }
   return candidates[0];
 }
 function deployModelRouterScript(opts = {}) {
-  const targetDir = opts.targetDir ?? join27(homedir18(), ".claude", "hooks");
-  const targetPath = join27(targetDir, MODEL_ROUTER_SCRIPT_BASENAME);
+  const targetDir = opts.targetDir ?? join30(homedir14(), ".claude", "hooks");
+  const targetPath = join30(targetDir, MODEL_ROUTER_SCRIPT_BASENAME);
   const sourcePath = opts.sourcePath ?? resolveModelRouterSourcePath();
-  if (!existsSync30(sourcePath)) {
+  if (!existsSync32(sourcePath)) {
     return { basename: MODEL_ROUTER_SCRIPT_BASENAME, action: "source-missing", targetPath };
   }
-  const newContent = readFileSync22(sourcePath, "utf8");
-  if (existsSync30(targetPath)) {
-    const existing = readFileSync22(targetPath, "utf8");
+  const newContent = readFileSync23(sourcePath, "utf8");
+  if (existsSync32(targetPath)) {
+    const existing = readFileSync23(targetPath, "utf8");
     if (existing === newContent) {
       return { basename: MODEL_ROUTER_SCRIPT_BASENAME, action: "unchanged", targetPath };
     }
   }
   if (opts.dryRun !== true) {
     mkdirSync16(dirname13(targetPath), { recursive: true });
-    writeFileSync14(targetPath, newContent, { mode: 493 });
+    writeFileSync15(targetPath, newContent, { mode: 493 });
   }
   return { basename: MODEL_ROUTER_SCRIPT_BASENAME, action: "written", targetPath };
 }
@@ -16064,26 +16366,26 @@ var init_meta_hooks = __esm({
 });
 
 // ../core/dist/skill-sync/settings-merger.js
-import * as fs27 from "node:fs";
-import * as os16 from "node:os";
-import * as path25 from "node:path";
+import * as fs29 from "node:fs";
+import * as os12 from "node:os";
+import * as path27 from "node:path";
 function claudeSettingsPath() {
   const override = process.env["OLAM_CLAUDE_SETTINGS_PATH"];
   if (override && override.length > 0)
     return override;
-  return path25.join(claudeDirInternal2(), "settings.json");
+  return path27.join(claudeDirInternal2(), "settings.json");
 }
 function claudeDirInternal2() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path25.join(os16.homedir(), ".claude");
+  return path27.join(os12.homedir(), ".claude");
 }
 function settingsBackupDir() {
   const override = process.env["OLAM_SETTINGS_BACKUP_DIR"];
   if (override && override.length > 0)
     return override;
-  return path25.join(os16.homedir(), ".olam", "state", "settings-backups");
+  return path27.join(os12.homedir(), ".olam", "state", "settings-backups");
 }
 function dedupeByMatcher(entries) {
   const map2 = /* @__PURE__ */ new Map();
@@ -16133,28 +16435,28 @@ function tagOlam(entry) {
   return { ...entry, [OLAM_SKILLS_MARKER]: true };
 }
 function readJson(file2) {
-  return JSON.parse(fs27.readFileSync(file2, "utf-8"));
+  return JSON.parse(fs29.readFileSync(file2, "utf-8"));
 }
 function rotateBackups(backupDir) {
-  if (!fs27.existsSync(backupDir))
+  if (!fs29.existsSync(backupDir))
     return;
-  const files = fs27.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path25.join(backupDir, f), mtime: fs27.statSync(path25.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  const files = fs29.readdirSync(backupDir).filter((f) => f.endsWith(".json")).map((f) => ({ name: f, full: path27.join(backupDir, f), mtime: fs29.statSync(path27.join(backupDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
   for (const f of files.slice(BACKUP_RETENTION)) {
     try {
-      fs27.unlinkSync(f.full);
+      fs29.unlinkSync(f.full);
     } catch {
     }
   }
 }
 function backupSettings() {
   const src = claudeSettingsPath();
-  if (!fs27.existsSync(src))
+  if (!fs29.existsSync(src))
     return void 0;
   const dir = settingsBackupDir();
-  fs27.mkdirSync(dir, { recursive: true });
+  fs29.mkdirSync(dir, { recursive: true });
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dest = path25.join(dir, `settings-${stamp}.json`);
-  fs27.copyFileSync(src, dest);
+  const dest = path27.join(dir, `settings-${stamp}.json`);
+  fs29.copyFileSync(src, dest);
   rotateBackups(dir);
   return dest;
 }
@@ -16162,7 +16464,7 @@ function mergeSettings(input) {
   const settingsPath = claudeSettingsPath();
   const backupPath = backupSettings();
   let base = {};
-  if (fs27.existsSync(settingsPath)) {
+  if (fs29.existsSync(settingsPath)) {
     try {
       base = readJson(settingsPath);
     } catch {
@@ -16230,10 +16532,10 @@ function mergeSettings(input) {
       ...input.permissionFiles.length > 0 ? { allow: [...permSet] } : {}
     }
   };
-  fs27.mkdirSync(path25.dirname(settingsPath), { recursive: true });
+  fs29.mkdirSync(path27.dirname(settingsPath), { recursive: true });
   const tmp = `${settingsPath}.tmp-${process.pid}`;
-  fs27.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
-  fs27.renameSync(tmp, settingsPath);
+  fs29.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
+  fs29.renameSync(tmp, settingsPath);
   return { backupPath, hooksAdded, permissionsCount: permSet.size, dualWriteDeduped, dualWriteDroppedCommands };
 }
 var OLAM_SKILLS_MARKER, BACKUP_RETENTION, DUAL_WRITE_DEDUP_RULES;
@@ -16289,17 +16591,17 @@ var init_schema5 = __esm({
 });
 
 // ../core/dist/skill-sync/per-project-override.js
-import { execFileSync as execFileSync3 } from "node:child_process";
-import * as fs28 from "node:fs";
-import * as path26 from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import * as fs30 from "node:fs";
+import * as path28 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function findProjectOverride(startDir) {
-  let dir = path26.resolve(startDir);
-  const root = path26.parse(dir).root;
+  let dir = path28.resolve(startDir);
+  const root = path28.parse(dir).root;
   while (true) {
-    const candidate = path26.join(dir, PROJECT_OVERRIDE_RELATIVE_PATH);
-    if (fs28.existsSync(candidate) && fs28.statSync(candidate).isFile()) {
-      const raw = fs28.readFileSync(candidate, "utf-8");
+    const candidate = path28.join(dir, PROJECT_OVERRIDE_RELATIVE_PATH);
+    if (fs30.existsSync(candidate) && fs30.statSync(candidate).isFile()) {
+      const raw = fs30.readFileSync(candidate, "utf-8");
       let parsed;
       try {
         parsed = parseYaml3(raw);
@@ -16312,7 +16614,7 @@ function findProjectOverride(startDir) {
     }
     if (dir === root)
       return void 0;
-    dir = path26.dirname(dir);
+    dir = path28.dirname(dir);
   }
 }
 function applyOverrideToArtifacts(artifacts, override) {
@@ -16332,7 +16634,7 @@ function applyPinToClone(opts) {
   if (ref.startsWith("-")) {
     throw new Error(`refuses ref "${ref}" \u2014 must not start with "-" (would be parsed as a git option)`);
   }
-  execFileSync3("git", ["-C", clonePath, "checkout", "-q", ref], {
+  execFileSync4("git", ["-C", clonePath, "checkout", "-q", ref], {
     stdio: ["ignore", "ignore", "pipe"]
   });
 }
@@ -16342,7 +16644,7 @@ function restoreCloneToBranchHead(opts) {
     return;
   }
   try {
-    execFileSync3("git", ["-C", clonePath, "checkout", "-q", branch], {
+    execFileSync4("git", ["-C", clonePath, "checkout", "-q", branch], {
       stdio: ["ignore", "ignore", "pipe"]
     });
   } catch {
@@ -16353,14 +16655,18 @@ var init_per_project_override = __esm({
   "../core/dist/skill-sync/per-project-override.js"() {
     "use strict";
     init_schema5();
-    PROJECT_OVERRIDE_RELATIVE_PATH = path26.join(".olam", "skill-overrides.yaml");
+    PROJECT_OVERRIDE_RELATIVE_PATH = path28.join(".olam", "skill-overrides.yaml");
   }
 });
 
 // ../core/dist/lib/file-lock.js
-import * as fs29 from "node:fs";
-import * as os17 from "node:os";
-import * as path27 from "node:path";
+import * as fs31 from "node:fs";
+import * as os13 from "node:os";
+import * as path29 from "node:path";
+function mintToken2() {
+  tokenCounter += 1;
+  return `${process.pid}-${tokenCounter}-${Math.random().toString(36).slice(2, 10)}`;
+}
 function defaultIsPidAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -16375,7 +16681,7 @@ function sleep3(ms) {
 }
 function readLockMeta(lockPath) {
   try {
-    const raw = fs29.readFileSync(lockPath, "utf-8");
+    const raw = fs31.readFileSync(lockPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
       return parsed;
@@ -16385,68 +16691,109 @@ function readLockMeta(lockPath) {
   return void 0;
 }
 function isLockStale(meta3, opts) {
-  if (meta3.hostname !== os17.hostname()) {
+  if (meta3.hostname !== os13.hostname()) {
     return opts.now - meta3.timestamp > opts.staleLockMs * 2;
   }
   if (!opts.isPidAlive(meta3.pid))
     return true;
   return opts.now - meta3.timestamp > opts.staleLockMs;
 }
+function sameAcquisition(a, b) {
+  if (a.token !== void 0 && b.token !== void 0)
+    return a.token === b.token;
+  return a.pid === b.pid && a.timestamp === b.timestamp;
+}
+function createLockFile(lockPath, meta3) {
+  const fd = fs31.openSync(lockPath, "wx", 384);
+  try {
+    fs31.writeSync(fd, JSON.stringify(meta3));
+    fs31.fsyncSync(fd);
+  } finally {
+    fs31.closeSync(fd);
+  }
+}
 function tryAcquireOnce(lockPath, meta3, opts) {
+  fs31.mkdirSync(path29.dirname(lockPath), { recursive: true });
   try {
-    fs29.mkdirSync(path27.dirname(lockPath), { recursive: true });
-    const fd = fs29.openSync(lockPath, "wx", 384);
-    try {
-      fs29.writeSync(fd, JSON.stringify(meta3));
-    } finally {
-      fs29.closeSync(fd);
-    }
+    createLockFile(lockPath, meta3);
     return true;
   } catch (err) {
     const code = err.code;
     if (code !== "EEXIST")
       throw err;
-    const existing = readLockMeta(lockPath);
-    if (existing === void 0) {
-      try {
-        fs29.unlinkSync(lockPath);
-      } catch {
-      }
-      return tryAcquireOnce(lockPath, meta3, opts);
+  }
+  const existing = readLockMeta(lockPath);
+  if (existing === void 0) {
+    let mtimeMs;
+    try {
+      mtimeMs = fs31.statSync(lockPath).mtimeMs;
+    } catch {
+      mtimeMs = 0;
     }
-    if (isLockStale(existing, opts)) {
-      try {
-        fs29.unlinkSync(lockPath);
-      } catch {
-      }
-      return tryAcquireOnce(lockPath, meta3, opts);
+    const graceMs = Math.min(2e3, opts.staleLockMs);
+    if (mtimeMs !== 0 && opts.now - mtimeMs <= graceMs) {
+      return false;
     }
+  } else if (!isLockStale(existing, opts)) {
     return false;
+  } else {
+    const recheck = readLockMeta(lockPath);
+    if (recheck !== void 0 && (!sameAcquisition(existing, recheck) || !isLockStale(recheck, opts))) {
+      return false;
+    }
+  }
+  try {
+    fs31.unlinkSync(lockPath);
+  } catch {
+  }
+  try {
+    createLockFile(lockPath, meta3);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EEXIST")
+      return false;
+    throw err;
   }
 }
 async function acquireFileLock(lockDir, options = {}) {
   const lockFilename = options.lockFilename ?? DEFAULT_LOCK_FILENAME;
-  const lockPath = path27.join(lockDir, lockFilename);
+  const lockPath = path29.join(lockDir, lockFilename);
   const acquireTimeoutMs = options.acquireTimeoutMs ?? DEFAULT_ACQUIRE_TIMEOUT_MS;
   const staleLockMs = options.staleLockMs ?? DEFAULT_STALE_LOCK_MS;
   const now = options.now ?? Date.now;
   const isPidAlive2 = options.isPidAlive ?? defaultIsPidAlive;
+  const ownToken = mintToken2();
   const deadline = now() + acquireTimeoutMs;
   let backoffMs = 25;
   while (true) {
     const meta3 = {
+      token: ownToken,
       pid: process.pid,
-      hostname: os17.hostname(),
+      hostname: os13.hostname(),
       timestamp: now(),
       ...options.reason ? { reason: options.reason } : {}
     };
     const acquired = tryAcquireOnce(lockPath, meta3, { now: now(), staleLockMs, isPidAlive: isPidAlive2 });
     if (acquired) {
+      let released = false;
       return {
         lockPath,
+        // Ownership-checked release: only unlink if WE still own the file.
+        // A holder that overran its lease and was stolen must not delete
+        // the new holder's lock. Idempotent (safe to call twice).
         release: () => {
+          if (released)
+            return;
+          released = true;
+          const current = readLockMeta(lockPath);
+          if (current === void 0)
+            return;
+          const isOurs = current.token !== void 0 ? current.token === ownToken : current.pid === process.pid;
+          if (!isOurs)
+            return;
           try {
-            fs29.unlinkSync(lockPath);
+            fs31.unlinkSync(lockPath);
           } catch {
           }
         }
@@ -16457,7 +16804,8 @@ async function acquireFileLock(lockDir, options = {}) {
       const held = existing ? `(held by pid ${existing.pid} on ${existing.hostname}, since ${new Date(existing.timestamp).toISOString()})` : "(holder unknown)";
       throw new FileLockError(`failed to acquire file lock at ${lockPath} within ${acquireTimeoutMs}ms ${held}`);
     }
-    await sleep3(Math.min(backoffMs, 200));
+    const jittered = backoffMs * (0.5 + Math.random());
+    await sleep3(Math.min(jittered, 200));
     backoffMs = Math.min(backoffMs * 2, 200);
   }
 }
@@ -16469,7 +16817,7 @@ async function withFileLock(lockDir, fn, options) {
     release();
   }
 }
-var DEFAULT_LOCK_FILENAME, DEFAULT_ACQUIRE_TIMEOUT_MS, DEFAULT_STALE_LOCK_MS, FileLockError;
+var DEFAULT_LOCK_FILENAME, DEFAULT_ACQUIRE_TIMEOUT_MS, DEFAULT_STALE_LOCK_MS, FileLockError, tokenCounter;
 var init_file_lock = __esm({
   "../core/dist/lib/file-lock.js"() {
     "use strict";
@@ -16482,17 +16830,18 @@ var init_file_lock = __esm({
         this.name = "FileLockError";
       }
     };
+    tokenCounter = 0;
   }
 });
 
 // ../core/dist/lib/min-version-filter.js
-import { existsSync as existsSync33, readFileSync as readFileSync26 } from "node:fs";
+import { existsSync as existsSync35, readFileSync as readFileSync27 } from "node:fs";
 function readOlamMinVersion(filepath) {
-  if (!existsSync33(filepath))
+  if (!existsSync35(filepath))
     return void 0;
   let text;
   try {
-    text = readFileSync26(filepath, "utf8");
+    text = readFileSync27(filepath, "utf8");
   } catch {
     return void 0;
   }
@@ -16550,11 +16899,11 @@ var init_min_version_filter = __esm({
 });
 
 // ../core/dist/skill-sync/overlay-scan.js
-import * as fs30 from "node:fs";
-import * as path28 from "node:path";
+import * as fs32 from "node:fs";
+import * as path30 from "node:path";
 function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
   const result = /* @__PURE__ */ new Map();
-  if (!fs30.existsSync(overlayRoot)) {
+  if (!fs32.existsSync(overlayRoot)) {
     return result;
   }
   if (basenames.length === 0) {
@@ -16563,13 +16912,13 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
   const mdFiles = [];
   let overlayRootReal;
   try {
-    overlayRootReal = fs30.realpathSync(overlayRoot);
+    overlayRootReal = fs32.realpathSync(overlayRoot);
   } catch {
     return result;
   }
   for (const subdir of OVERRIDE_SUBDIRS) {
-    const dir = path28.join(overlayRoot, subdir);
-    if (!fs30.existsSync(dir))
+    const dir = path30.join(overlayRoot, subdir);
+    if (!fs32.existsSync(dir))
       continue;
     walkMarkdown(dir, mdFiles, caps.maxFiles);
   }
@@ -16577,25 +16926,25 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
   for (const filepath of mdFiles) {
     let realFile;
     try {
-      realFile = fs30.realpathSync(filepath);
+      realFile = fs32.realpathSync(filepath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT" || code === "EACCES")
         continue;
       throw err;
     }
-    const rel = path28.relative(overlayRootReal, realFile);
-    if (rel.startsWith("..") || path28.isAbsolute(rel)) {
+    const rel = path30.relative(overlayRootReal, realFile);
+    if (rel.startsWith("..") || path30.isAbsolute(rel)) {
       continue;
     }
     let content;
     try {
-      const stat2 = fs30.statSync(filepath);
+      const stat2 = fs32.statSync(filepath);
       totalBytes += stat2.size;
       if (totalBytes > caps.maxTotalBytes) {
         throw new Error(`[overlay-scan] aborted: overlay tree exceeds ${caps.maxTotalBytes} total bytes. Check OLAM_CLAUDE_DIR / overlay paths are correctly scoped.`);
       }
-      content = fs30.readFileSync(filepath, "utf8");
+      content = fs32.readFileSync(filepath, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT" || code === "EACCES") {
@@ -16603,7 +16952,7 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
       }
       throw err;
     }
-    const relpath = path28.relative(overlayRoot, filepath).split(path28.sep).join("/");
+    const relpath = path30.relative(overlayRoot, filepath).split(path30.sep).join("/");
     for (const basename6 of basenames) {
       if (content.includes(basename6)) {
         const list = result.get(basename6) ?? [];
@@ -16617,7 +16966,7 @@ function scanOverlayReferences(overlayRoot, basenames, caps = DEFAULT_CAPS) {
 function walkMarkdown(dir, out, cap) {
   let entries;
   try {
-    entries = fs30.readdirSync(dir, { withFileTypes: true });
+    entries = fs32.readdirSync(dir, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT")
       return;
@@ -16627,7 +16976,7 @@ function walkMarkdown(dir, out, cap) {
     if (out.length >= cap) {
       throw new Error(`[overlay-scan] aborted: overlay tree contains > ${cap} markdown files. Check OLAM_CLAUDE_DIR / overlay paths are correctly scoped.`);
     }
-    const full = path28.join(dir, entry.name);
+    const full = path30.join(dir, entry.name);
     if (entry.isSymbolicLink())
       continue;
     if (entry.isDirectory()) {
@@ -16652,12 +17001,12 @@ var init_overlay_scan = __esm({
 });
 
 // ../core/dist/skill-sync/settings-json-lock.js
-import * as fs31 from "node:fs";
-import * as os18 from "node:os";
-import * as path29 from "node:path";
+import * as fs33 from "node:fs";
+import * as os14 from "node:os";
+import * as path31 from "node:path";
 function defaultSettingsJsonLockPath() {
-  const stateDir = process.env["OLAM_STATE_DIR"] ?? path29.join(os18.homedir(), ".olam", "state");
-  return path29.join(stateDir, SETTINGS_JSON_LOCK_FILENAME);
+  const stateDir2 = process.env["OLAM_STATE_DIR"] ?? path31.join(os14.homedir(), ".olam", "state");
+  return path31.join(stateDir2, SETTINGS_JSON_LOCK_FILENAME);
 }
 function defaultIsPidAlive2(pid) {
   try {
@@ -16673,7 +17022,7 @@ function sleep4(ms) {
 }
 function readLockMeta2(lockPath) {
   try {
-    const raw = fs31.readFileSync(lockPath, "utf-8");
+    const raw = fs33.readFileSync(lockPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.pid === "number" && typeof parsed?.hostname === "string" && typeof parsed?.timestamp === "number") {
       return parsed;
@@ -16686,7 +17035,7 @@ function isLockStale2(meta3, opts) {
   const ageMs = opts.now - meta3.timestamp;
   if (ageMs < opts.staleLockMs / 2)
     return false;
-  if (meta3.hostname !== os18.hostname()) {
+  if (meta3.hostname !== os14.hostname()) {
     return ageMs > opts.staleLockMs * 2;
   }
   if (!opts.isPidAlive(meta3.pid))
@@ -16696,12 +17045,12 @@ function isLockStale2(meta3, opts) {
 function tryAcquireOnce2(lockPath, meta3, opts) {
   for (let attempt = 0; attempt <= MAX_STEAL_ATTEMPTS; attempt += 1) {
     try {
-      fs31.mkdirSync(path29.dirname(lockPath), { recursive: true });
-      const fd = fs31.openSync(lockPath, "wx", 384);
+      fs33.mkdirSync(path31.dirname(lockPath), { recursive: true });
+      const fd = fs33.openSync(lockPath, "wx", 384);
       try {
-        fs31.writeSync(fd, JSON.stringify(meta3));
+        fs33.writeSync(fd, JSON.stringify(meta3));
       } finally {
-        fs31.closeSync(fd);
+        fs33.closeSync(fd);
       }
       return true;
     } catch (err) {
@@ -16719,9 +17068,9 @@ function tryAcquireOnce2(lockPath, meta3, opts) {
     }
     const victimPath = `${lockPath}.victim-${process.pid}-${attempt}-${Date.now()}`;
     try {
-      fs31.renameSync(lockPath, victimPath);
+      fs33.renameSync(lockPath, victimPath);
       try {
-        fs31.unlinkSync(victimPath);
+        fs33.unlinkSync(victimPath);
       } catch {
       }
     } catch (err) {
@@ -16743,7 +17092,7 @@ async function acquireSettingsJsonLock(options = {}) {
   while (true) {
     const meta3 = {
       pid: process.pid,
-      hostname: os18.hostname(),
+      hostname: os14.hostname(),
       timestamp: now(),
       ...options.reason ? { reason: options.reason } : {}
     };
@@ -16753,7 +17102,7 @@ async function acquireSettingsJsonLock(options = {}) {
         lockPath,
         release: () => {
           try {
-            fs31.unlinkSync(lockPath);
+            fs33.unlinkSync(lockPath);
           } catch {
           }
         }
@@ -16856,14 +17205,14 @@ var init_services_status = __esm({
 
 // ../core/dist/skill-sources/meta-hooks-migration-snapshot.js
 import * as crypto5 from "node:crypto";
-import * as fs32 from "node:fs";
-import * as os19 from "node:os";
-import * as path30 from "node:path";
+import * as fs34 from "node:fs";
+import * as os15 from "node:os";
+import * as path32 from "node:path";
 function migrationSnapshotsDir2() {
   const override = process.env["OLAM_MIGRATION_SNAPSHOTS_DIR"];
   if (override && override.length > 0)
     return override;
-  return path30.join(os19.homedir(), ".olam", "state", "migration-snapshots");
+  return path32.join(os15.homedir(), ".olam", "state", "migration-snapshots");
 }
 function writeMetaHooksSnapshot(originalSettings) {
   const snapshot = {
@@ -16874,11 +17223,11 @@ function writeMetaHooksSnapshot(originalSettings) {
   };
   const validated = MetaHooksMigrationSnapshotSchema.parse(snapshot);
   const dir = migrationSnapshotsDir2();
-  fs32.mkdirSync(dir, { recursive: true });
+  fs34.mkdirSync(dir, { recursive: true });
   const stamp = validated.takenAt.replace(/[:.]/g, "-");
   const rand = crypto5.randomBytes(3).toString("hex");
-  const file2 = path30.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
-  fs32.writeFileSync(file2, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
+  const file2 = path32.join(dir, `${META_HOOKS_SNAPSHOT_PREFIX}${stamp}-${process.pid}-${rand}.json`);
+  fs34.writeFileSync(file2, JSON.stringify(validated, null, 2) + "\n", { mode: 384 });
   return file2;
 }
 var META_HOOKS_SNAPSHOT_SCHEMA_VERSION, META_HOOKS_SNAPSHOT_PREFIX, SettingsLooseSchema, MetaHooksMigrationSnapshotSchema;
@@ -17168,7 +17517,7 @@ var init_meta_hook_injector = __esm({
 
 // ../core/dist/lib/markdown-merger.js
 import { createHash as createHash5 } from "node:crypto";
-import { readFileSync as readFileSync30, existsSync as existsSync36, statSync as statSync8 } from "node:fs";
+import { readFileSync as readFileSync31, existsSync as existsSync38, statSync as statSync10 } from "node:fs";
 function parseFrontmatter(text) {
   const match = FM_RE2.exec(text);
   if (match === null)
@@ -17297,9 +17646,9 @@ function mergeMarkdown(upstreamText, overlayText, labelForError, upstreamPath, o
   return { merged: fmBlock !== "" ? fmBlock + mergedBody : mergedBody };
 }
 function sha256OfPath(p) {
-  if (!existsSync36(p) || !statSync8(p).isFile())
+  if (!existsSync38(p) || !statSync10(p).isFile())
     return "MISSING";
-  return createHash5("sha256").update(readFileSync30(p)).digest("hex");
+  return createHash5("sha256").update(readFileSync31(p)).digest("hex");
 }
 var FM_RE2, H2_RE;
 var init_markdown_merger = __esm({
@@ -17311,52 +17660,52 @@ var init_markdown_merger = __esm({
 });
 
 // ../core/dist/skill-sync/managed-merge.js
-import * as fs33 from "node:fs";
-import * as path31 from "node:path";
+import * as fs35 from "node:fs";
+import * as path33 from "node:path";
 function materializeMergedSkill(opts) {
-  const { sourceId, sourcePath, deployBasename, mergedContent, claudeDir: claudeDir2 } = opts;
-  const managedDir = path31.join(claudeDir2, ".olam-merged", sourceId, deployBasename);
-  const sourceRoot = path31.resolve(path31.join(claudeDir2, ".olam-merged", sourceId));
-  const managedResolved = path31.resolve(managedDir);
-  if (!(managedResolved === sourceRoot || managedResolved.startsWith(sourceRoot + path31.sep))) {
+  const { sourceId, sourcePath, deployBasename, mergedContent, claudeDir: claudeDir3 } = opts;
+  const managedDir = path33.join(claudeDir3, ".olam-merged", sourceId, deployBasename);
+  const sourceRoot = path33.resolve(path33.join(claudeDir3, ".olam-merged", sourceId));
+  const managedResolved = path33.resolve(managedDir);
+  if (!(managedResolved === sourceRoot || managedResolved.startsWith(sourceRoot + path33.sep))) {
     throw new Error(`[managed-merge] refusing to materialize: deployBasename "${deployBasename}" escapes managed root "${sourceRoot}" (resolved to "${managedResolved}")`);
   }
-  fs33.mkdirSync(managedDir, { recursive: true });
-  const skillMdPath = path31.join(managedDir, "SKILL.md");
+  fs35.mkdirSync(managedDir, { recursive: true });
+  const skillMdPath = path33.join(managedDir, "SKILL.md");
   const tmpPath = `${skillMdPath}.tmp-${process.pid}-${Date.now()}`;
-  fs33.writeFileSync(tmpPath, mergedContent);
-  fs33.renameSync(tmpPath, skillMdPath);
-  const baseEntries = fs33.readdirSync(sourcePath);
+  fs35.writeFileSync(tmpPath, mergedContent);
+  fs35.renameSync(tmpPath, skillMdPath);
+  const baseEntries = fs35.readdirSync(sourcePath);
   for (const entry of baseEntries) {
     if (entry === "SKILL.md")
       continue;
-    const linkPath = path31.join(managedDir, entry);
-    const targetAbsolute = path31.join(sourcePath, entry);
-    const targetRelative = path31.relative(managedDir, targetAbsolute);
+    const linkPath = path33.join(managedDir, entry);
+    const targetAbsolute = path33.join(sourcePath, entry);
+    const targetRelative = path33.relative(managedDir, targetAbsolute);
     try {
-      fs33.lstatSync(linkPath);
-      fs33.rmSync(linkPath, { recursive: true, force: true });
+      fs35.lstatSync(linkPath);
+      fs35.rmSync(linkPath, { recursive: true, force: true });
     } catch {
     }
-    fs33.symlinkSync(targetRelative, linkPath);
+    fs35.symlinkSync(targetRelative, linkPath);
   }
-  const managedEntries = fs33.readdirSync(managedDir);
+  const managedEntries = fs35.readdirSync(managedDir);
   const baseEntrySet = new Set(baseEntries);
   for (const entry of managedEntries) {
     if (entry === "SKILL.md")
       continue;
     if (!baseEntrySet.has(entry)) {
-      const stalePath = path31.join(managedDir, entry);
+      const stalePath = path33.join(managedDir, entry);
       try {
-        fs33.rmSync(stalePath, { recursive: true, force: true });
+        fs35.rmSync(stalePath, { recursive: true, force: true });
       } catch {
       }
     }
   }
   return managedDir;
 }
-function cleanMergedDir(claudeDir2) {
-  fs33.rmSync(path31.join(claudeDir2, ".olam-merged"), { recursive: true, force: true });
+function cleanMergedDir(claudeDir3) {
+  fs35.rmSync(path33.join(claudeDir3, ".olam-merged"), { recursive: true, force: true });
 }
 var init_managed_merge = __esm({
   "../core/dist/skill-sync/managed-merge.js"() {
@@ -17454,8 +17803,8 @@ var init_prefix_rules = __esm({
 });
 
 // ../core/dist/skill-sync/prefix-deploy.js
-import * as fs34 from "node:fs";
-import * as path32 from "node:path";
+import * as fs36 from "node:fs";
+import * as path34 from "node:path";
 function buildSourcePrefixMap(sources) {
   const byId = /* @__PURE__ */ new Map();
   const scopeById = /* @__PURE__ */ new Map();
@@ -17476,7 +17825,7 @@ function buildSourcePrefixMap(sources) {
     registeredPrefixes: Array.from(prefixes)
   };
 }
-function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir2, dryRun) {
+function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir3, dryRun) {
   const result = { rewrittenCount: 0, entries: [] };
   for (const artifact of baseArtifacts) {
     if (artifact.kind !== "skill" && artifact.kind !== "agent")
@@ -17509,20 +17858,20 @@ function applyPrefixRewrites(baseArtifacts, sourceMap, claudeDir2, dryRun) {
       continue;
     }
     if (artifact.kind === "skill") {
-      const skillMdPath = path32.join(artifact.sourcePath, "SKILL.md");
-      const content = fs34.readFileSync(skillMdPath);
+      const skillMdPath = path34.join(artifact.sourcePath, "SKILL.md");
+      const content = fs36.readFileSync(skillMdPath);
       const rewritten = rewriteFrontmatterName(content, () => renamedFrontmatterName);
       const managedDir = materializeMergedSkill({
         sourceId: artifact.sourceId,
         sourcePath: artifact.sourcePath,
         deployBasename: renamed,
         mergedContent: rewritten,
-        claudeDir: claudeDir2
+        claudeDir: claudeDir3
       });
       artifact.sourcePath = managedDir;
       artifact.deployBasename = renamed;
     } else {
-      const content = artifact.resolvedContent !== void 0 ? artifact.resolvedContent : fs34.readFileSync(artifact.sourcePath);
+      const content = artifact.resolvedContent !== void 0 ? artifact.resolvedContent : fs36.readFileSync(artifact.sourcePath);
       const rewritten = rewriteFrontmatterName(content, () => renamedFrontmatterName);
       artifact.resolvedContent = rewritten;
       artifact.deployBasename = renamed;
@@ -17567,19 +17916,19 @@ var init_prefix_deploy = __esm({
 });
 
 // ../core/dist/skill-sync/resolve-source-config.js
-import { readFileSync as readFileSync32, existsSync as existsSync37 } from "node:fs";
-import { join as join36 } from "node:path";
+import { readFileSync as readFileSync33, existsSync as existsSync39 } from "node:fs";
+import { join as join39 } from "node:path";
 import { parse as parseYaml4 } from "yaml";
 function sourceConfigPath(clonePath) {
-  return join36(clonePath, "shared", "source-config.yaml");
+  return join39(clonePath, "shared", "source-config.yaml");
 }
 function readSourceConfig(clonePath, sourceId) {
-  const path60 = sourceConfigPath(clonePath);
-  if (!existsSync37(path60))
+  const path62 = sourceConfigPath(clonePath);
+  if (!existsSync39(path62))
     return void 0;
   let raw;
   try {
-    raw = readFileSync32(path60, "utf-8");
+    raw = readFileSync33(path62, "utf-8");
   } catch (err) {
     emitMalformedWarning(sourceId, `read failed: ${errToMsg(err)}`);
     return void 0;
@@ -17674,16 +18023,16 @@ var init_resolve_source_config = __esm({
 });
 
 // ../core/dist/skill-sync/engine.js
-import * as fs35 from "node:fs";
-import * as os20 from "node:os";
-import * as path33 from "node:path";
+import * as fs37 from "node:fs";
+import * as os16 from "node:os";
+import * as path35 from "node:path";
 function resolveAtlasUser(override) {
   if (override)
     return override;
-  const claudeDir2 = process.env["OLAM_CLAUDE_DIR"] || path33.join(os20.homedir(), ".claude");
-  const f = path33.join(claudeDir2, ".atlas-user");
-  if (fs35.existsSync(f)) {
-    return fs35.readFileSync(f, "utf-8").trim() || void 0;
+  const claudeDir3 = process.env["OLAM_CLAUDE_DIR"] || path35.join(os16.homedir(), ".claude");
+  const f = path35.join(claudeDir3, ".atlas-user");
+  if (fs37.existsSync(f)) {
+    return fs37.readFileSync(f, "utf-8").trim() || void 0;
   }
   return void 0;
 }
@@ -17695,7 +18044,7 @@ async function syncSkills(opts = {}) {
   const perSource = [];
   for (const source of sources) {
     const clonePath = skillSourceClonePath(source.id);
-    if (!fs35.existsSync(clonePath))
+    if (!fs37.existsSync(clonePath))
       continue;
     const { artifacts, subscription } = await withFileLock(clonePath, () => {
       const pinRef = projectOverride?.override.pin?.[source.id];
@@ -17735,7 +18084,7 @@ async function syncSkills(opts = {}) {
   const overlayArtifacts = memberOverlaysEnabled ? projectFilteredArtifacts.filter((a) => a.kind === "overlay") : [];
   const effectiveSources = sources.map((s) => {
     const clonePath = skillSourceClonePath(s.id);
-    const sourceConfig = fs35.existsSync(clonePath) ? readSourceConfig(clonePath, s.id) : void 0;
+    const sourceConfig = fs37.existsSync(clonePath) ? readSourceConfig(clonePath, s.id) : void 0;
     const eff = resolveEffectivePrefix(s, sourceConfig);
     const entry = {
       id: s.id,
@@ -17827,11 +18176,11 @@ async function syncSkills(opts = {}) {
   }
   const willMutateManagedDir = !opts.dryRun && (memberOverlaysEnabled && overlayArtifacts.length > 0 || hasPrefixRewrites);
   if (willMutateManagedDir) {
-    const claude = claudeDir();
+    const claude = claudeDir2();
     cleanMergedDir(claude);
   }
   if (memberOverlaysEnabled && overlayArtifacts.length > 0 && !opts.dryRun) {
-    const claude = claudeDir();
+    const claude = claudeDir2();
     for (const overlay of overlayArtifacts) {
       if (!overlay.targetKind)
         continue;
@@ -17841,13 +18190,13 @@ async function syncSkills(opts = {}) {
       let baseContent;
       let basePath;
       if (overlay.targetKind === "skill") {
-        basePath = path33.join(base.sourcePath, "SKILL.md");
-        baseContent = fs35.readFileSync(basePath, "utf-8");
+        basePath = path35.join(base.sourcePath, "SKILL.md");
+        baseContent = fs37.readFileSync(basePath, "utf-8");
       } else {
         basePath = base.sourcePath;
-        baseContent = fs35.readFileSync(basePath, "utf-8");
+        baseContent = fs37.readFileSync(basePath, "utf-8");
       }
-      const overlayContent = fs35.readFileSync(overlay.sourcePath, "utf-8");
+      const overlayContent = fs37.readFileSync(overlay.sourcePath, "utf-8");
       const label = `${overlay.sourceId}/${overlay.deployBasename}`;
       const mergeResult = mergeMarkdown(baseContent, overlayContent, label, basePath, overlay.sourcePath);
       if ("error" in mergeResult) {
@@ -17871,7 +18220,7 @@ async function syncSkills(opts = {}) {
   }
   const hookFiles = projectFilteredArtifacts.filter((a) => a.kind === "hook").map((a) => a.sourcePath);
   const permissionFiles = projectFilteredArtifacts.filter((a) => a.kind === "permission").map((a) => a.sourcePath);
-  const claudeDirForRewrites = claudeDir();
+  const claudeDirForRewrites = claudeDir2();
   const prefixRewriteResult = applyPrefixRewrites(baseArtifacts, sourcePrefixMap, claudeDirForRewrites, opts.dryRun === true);
   const prefixCollisions = detectPrefixCollisions(effectiveSources);
   if (!opts.dryRun) {
@@ -17908,7 +18257,7 @@ async function syncSkills(opts = {}) {
     summary.collisions = detectCollisions(baseArtifacts).collisions;
     return summary;
   }
-  const claudeDirPath = process.env["OLAM_CLAUDE_DIR"] || path33.join(os20.homedir(), ".claude");
+  const claudeDirPath = process.env["OLAM_CLAUDE_DIR"] || path35.join(os16.homedir(), ".claude");
   const overlayReferences = scanOverlayReferences(claudeDirPath, SHIM_TARGETS.map((t) => t.basename));
   summary.deploy = deployArtifacts(baseArtifacts, {
     installedOlamVersion,
@@ -17944,19 +18293,19 @@ async function injectMetaHooksIntoSettings(opts) {
   const result = await withSettingsJsonLock(() => {
     let currentSettings = {};
     let settingsExisted = false;
-    if (fs35.existsSync(settingsFile)) {
+    if (fs37.existsSync(settingsFile)) {
       settingsExisted = true;
       try {
-        const raw = fs35.readFileSync(settingsFile, "utf-8");
+        const raw = fs37.readFileSync(settingsFile, "utf-8");
         currentSettings = raw.trim() ? JSON.parse(raw) : {};
       } catch {
         try {
-          const raw = fs35.readFileSync(settingsFile);
-          const bakDir = path33.join(path33.dirname(settingsFile), ".malformed-backups");
-          fs35.mkdirSync(bakDir, { recursive: true });
+          const raw = fs37.readFileSync(settingsFile);
+          const bakDir = path35.join(path35.dirname(settingsFile), ".malformed-backups");
+          fs37.mkdirSync(bakDir, { recursive: true });
           const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-          const bakFile = path33.join(bakDir, `settings.json.malformed.${stamp}.bak`);
-          fs35.writeFileSync(bakFile, raw, { mode: 384 });
+          const bakFile = path35.join(bakDir, `settings.json.malformed.${stamp}.bak`);
+          fs37.writeFileSync(bakFile, raw, { mode: 384 });
           snapshotError = `settings.json was malformed; original bytes preserved at ${bakFile}`;
         } catch (bakErr) {
           snapshotError = `settings.json malformed AND .bak write failed: ${bakErr instanceof Error ? bakErr.message : String(bakErr)}`;
@@ -17996,10 +18345,10 @@ async function injectMetaHooksIntoSettings(opts) {
       } catch {
       }
     }
-    fs35.mkdirSync(path33.dirname(settingsFile), { recursive: true });
+    fs37.mkdirSync(path35.dirname(settingsFile), { recursive: true });
     const tmpPath = `${settingsFile}.tmp-${process.pid}-${Date.now()}`;
-    fs35.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
-    fs35.renameSync(tmpPath, settingsFile);
+    fs37.writeFileSync(tmpPath, JSON.stringify(inject.nextSettings, null, 2) + "\n");
+    fs37.renameSync(tmpPath, settingsFile);
     return inject;
   }, { reason: `syncSkills meta-hook injection (mode=${mode})` });
   let scriptDeploy;
@@ -18007,7 +18356,7 @@ async function injectMetaHooksIntoSettings(opts) {
   if (modelRouterTargeted) {
     try {
       scriptDeploy = deployModelRouterScript({
-        targetDir: path33.join(claudeDir(), "hooks")
+        targetDir: path35.join(claudeDir2(), "hooks")
       });
     } catch (err) {
       scriptDeploy = {
@@ -18058,19 +18407,19 @@ var init_engine = __esm({
 });
 
 // ../core/dist/skill-sync/shadow-backup-manager.js
-import * as fs36 from "node:fs";
-import * as path34 from "node:path";
+import * as fs38 from "node:fs";
+import * as path36 from "node:path";
 function listShadowBackups(opts = {}) {
-  const claude = opts.claudeDirOverride ?? claudeDir();
+  const claude = opts.claudeDirOverride ?? claudeDir2();
   const now = opts.now ?? Date.now();
   const out = [];
   for (const bucket of SHADOW_BACKUP_BUCKETS) {
-    const bucketDir = path34.join(claude, bucket);
-    if (!fs36.existsSync(bucketDir))
+    const bucketDir = path36.join(claude, bucket);
+    if (!fs38.existsSync(bucketDir))
       continue;
     let entries;
     try {
-      entries = fs36.readdirSync(bucketDir);
+      entries = fs38.readdirSync(bucketDir);
     } catch {
       continue;
     }
@@ -18081,11 +18430,11 @@ function listShadowBackups(opts = {}) {
       const epochSeconds = Number.parseInt(match[1], 10);
       if (!Number.isFinite(epochSeconds) || epochSeconds < 0)
         continue;
-      const full = path34.join(bucketDir, name);
+      const full = path36.join(bucketDir, name);
       let sizeBytes = 0;
       let isDir = false;
       try {
-        const st = fs36.statSync(full);
+        const st = fs38.statSync(full);
         isDir = st.isDirectory();
         if (!isDir)
           sizeBytes = st.size;
@@ -18098,7 +18447,7 @@ function listShadowBackups(opts = {}) {
         bucket,
         basename: name,
         originalBasename,
-        originalPath: path34.join(bucketDir, originalBasename),
+        originalPath: path36.join(bucketDir, originalBasename),
         epochSeconds,
         ageMs: now - epochSeconds * 1e3,
         sizeBytes,
@@ -18143,9 +18492,9 @@ function pruneShadowBackups(opts) {
     if (!opts.dryRun) {
       try {
         if (b.isDir) {
-          fs36.rmSync(b.path, { recursive: true, force: true });
+          fs38.rmSync(b.path, { recursive: true, force: true });
         } else {
-          fs36.unlinkSync(b.path);
+          fs38.unlinkSync(b.path);
         }
       } catch {
         skipped.push(b);
@@ -18157,29 +18506,29 @@ function pruneShadowBackups(opts) {
   return { deleted, skipped };
 }
 function restoreShadowBackup(opts) {
-  const abs = path34.resolve(opts.backupPath);
-  if (!fs36.existsSync(abs)) {
+  const abs = path36.resolve(opts.backupPath);
+  if (!fs38.existsSync(abs)) {
     throw new Error(`backup file not found: ${abs}`);
   }
-  const basename6 = path34.basename(abs);
+  const basename6 = path36.basename(abs);
   const match = SHADOW_BACKUP_SUFFIX_RE.exec(basename6);
   if (!match) {
     throw new Error(`not a shadow-backup file (basename "${basename6}" does not match \`.shadow-backup-<epoch>\`): ${abs}`);
   }
   const originalBasename = basename6.slice(0, basename6.length - match[0].length);
-  const originalPath = path34.join(path34.dirname(abs), originalBasename);
-  if (fs36.existsSync(originalPath) && !opts.force) {
+  const originalPath = path36.join(path36.dirname(abs), originalBasename);
+  if (fs38.existsSync(originalPath) && !opts.force) {
     throw new Error(`original path already occupied: ${originalPath}. Move/rename it first OR re-run with --force.`);
   }
-  if (opts.force && fs36.existsSync(originalPath)) {
-    const existingStat = fs36.statSync(originalPath);
+  if (opts.force && fs38.existsSync(originalPath)) {
+    const existingStat = fs38.statSync(originalPath);
     if (existingStat.isDirectory()) {
-      fs36.rmSync(originalPath, { recursive: true, force: true });
+      fs38.rmSync(originalPath, { recursive: true, force: true });
     } else {
-      fs36.unlinkSync(originalPath);
+      fs38.unlinkSync(originalPath);
     }
   }
-  fs36.renameSync(abs, originalPath);
+  fs38.renameSync(abs, originalPath);
   return { restoredTo: originalPath };
 }
 var SHADOW_BACKUP_BUCKETS, SHADOW_BACKUP_SUFFIX_RE;
@@ -18193,27 +18542,27 @@ var init_shadow_backup_manager = __esm({
 });
 
 // ../core/dist/skill-sources/doctor-checks.js
-import * as fs37 from "node:fs";
-import * as path35 from "node:path";
-import * as os21 from "node:os";
+import * as fs39 from "node:fs";
+import * as path37 from "node:path";
+import * as os17 from "node:os";
 function claudeDirInternal3() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path35.join(os21.homedir(), ".claude");
+  return path37.join(os17.homedir(), ".claude");
 }
 function checkStateFileParse() {
-  const filePath = globalConfigPath();
+  const filePath = globalConfigPath2();
   const result = {
     name: "state-parse",
     healthy: true,
     description: `~/.olam state file (${filePath})`
   };
-  if (!fs37.existsSync(filePath)) {
+  if (!fs39.existsSync(filePath)) {
     result.details = ["(file does not yet exist \u2014 will be created on first write)"];
     return result;
   }
-  const raw = fs37.readFileSync(filePath, "utf-8");
+  const raw = fs39.readFileSync(filePath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -18223,8 +18572,8 @@ function checkStateFileParse() {
     result.details = [err instanceof Error ? err.message : String(err)];
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs37.renameSync(filePath, aside);
-      fs37.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
+      fs39.renameSync(filePath, aside);
+      fs39.writeFileSync(filePath, JSON.stringify({ schemaVersion: 1, repos: [], runbooks: [], skillSources: [] }, null, 2));
     };
     return result;
   }
@@ -18233,18 +18582,20 @@ function checkStateFileParse() {
     result.healthy = false;
     result.issue = "state file does not match GlobalConfigSchema";
     result.details = validation.error.issues.map((e) => `${e.path.join(".")}: ${e.message}`);
+    const salvaged = quarantineGlobalConfig(parsed);
+    const droppedCount = salvaged?.drops.length ?? 0;
+    if (salvaged !== null) {
+      result.details.push(`auto-fix will keep ${salvaged.value.skillSources.length} skill-source(s), ${salvaged.value.repos.length} repo(s), ${salvaged.value.runbooks.length} runbook(s); dropping ${droppedCount} invalid entr${droppedCount === 1 ? "y" : "ies"}.`);
+    } else {
+      result.details.push("auto-fix cannot salvage any entries (top-level corruption) \u2014 will reset to empty.");
+    }
     result.repair = () => {
       const aside = `${filePath}.corrupt-${Math.floor(Date.now() / 1e3)}`;
-      fs37.copyFileSync(filePath, aside);
+      fs39.copyFileSync(filePath, aside);
       const base = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-      const next = {
-        ...base,
-        schemaVersion: 1,
-        repos: [],
-        runbooks: [],
-        skillSources: []
-      };
-      fs37.writeFileSync(filePath, JSON.stringify(next, null, 2));
+      const recovered = quarantineGlobalConfig(parsed);
+      const next = recovered !== null ? { ...base, ...recovered.value } : { ...base, schemaVersion: 1, repos: [], runbooks: [], skillSources: [] };
+      fs39.writeFileSync(filePath, JSON.stringify(next, null, 2));
     };
     return result;
   }
@@ -18255,16 +18606,16 @@ function checkDanglingSymlinks() {
   const buckets = ["commands", "agents", "skills", "scripts", "rules"];
   const dangling = [];
   for (const bucket of buckets) {
-    const dir = path35.join(claude, bucket);
-    if (!fs37.existsSync(dir))
+    const dir = path37.join(claude, bucket);
+    if (!fs39.existsSync(dir))
       continue;
-    for (const name of fs37.readdirSync(dir)) {
-      const linkPath = path35.join(dir, name);
+    for (const name of fs39.readdirSync(dir)) {
+      const linkPath = path37.join(dir, name);
       try {
-        const lst = fs37.lstatSync(linkPath);
+        const lst = fs39.lstatSync(linkPath);
         if (!lst.isSymbolicLink())
           continue;
-        if (!fs37.existsSync(linkPath)) {
+        if (!fs39.existsSync(linkPath)) {
           dangling.push(linkPath);
         }
       } catch {
@@ -18282,7 +18633,7 @@ function checkDanglingSymlinks() {
     result.repair = () => {
       for (const p of dangling) {
         try {
-          fs37.unlinkSync(p);
+          fs39.unlinkSync(p);
         } catch {
         }
       }
@@ -18297,19 +18648,19 @@ function checkOrphanedSnapshots() {
     healthy: true,
     description: `orphaned migration snapshots under ${dir}`
   };
-  if (!fs37.existsSync(dir)) {
+  if (!fs39.existsSync(dir)) {
     return result;
   }
   const orphans = [];
-  for (const name of fs37.readdirSync(dir)) {
+  for (const name of fs39.readdirSync(dir)) {
     if (!name.endsWith(".json"))
       continue;
-    const full = path35.join(dir, name);
+    const full = path37.join(dir, name);
     try {
-      const stat2 = fs37.statSync(full);
+      const stat2 = fs39.statSync(full);
       if (!stat2.isFile())
         continue;
-      const raw = fs37.readFileSync(full, "utf-8");
+      const raw = fs39.readFileSync(full, "utf-8");
       let parsed;
       try {
         parsed = JSON.parse(raw);
@@ -18334,7 +18685,7 @@ function checkOrphanedSnapshots() {
     result.repair = () => {
       for (const o of orphans) {
         try {
-          fs37.unlinkSync(o.path);
+          fs39.unlinkSync(o.path);
         } catch {
         }
       }
@@ -18349,12 +18700,12 @@ function checkSentinelDrift() {
     healthy: true,
     description: `olam-skills sentinel block in ${filePath}`
   };
-  if (!fs37.existsSync(filePath)) {
+  if (!fs39.existsSync(filePath)) {
     return result;
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs37.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(fs39.readFileSync(filePath, "utf-8"));
   } catch {
     return result;
   }
@@ -18395,7 +18746,7 @@ function checkSentinelDrift() {
         backupSettings();
       } catch {
       }
-      const next = JSON.parse(fs37.readFileSync(filePath, "utf-8"));
+      const next = JSON.parse(fs39.readFileSync(filePath, "utf-8"));
       if (!next.hooks)
         return;
       for (const stage of Object.keys(next.hooks)) {
@@ -18418,7 +18769,7 @@ function checkSentinelDrift() {
           return bad === void 0;
         });
       }
-      fs37.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs39.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
     };
   }
   return result;
@@ -18441,9 +18792,9 @@ function checkMemberNameMissing() {
     result.details = ["(atlas-toolbox source not registered \u2014 check not applicable)"];
     return result;
   }
-  const claudeDir2 = claudeDirInternal3();
-  const atlasUserPath = path35.join(claudeDir2, ".atlas-user");
-  const value = fs37.existsSync(atlasUserPath) ? fs37.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  const claudeDir3 = claudeDirInternal3();
+  const atlasUserPath = path37.join(claudeDir3, ".atlas-user");
+  const value = fs39.existsSync(atlasUserPath) ? fs39.readFileSync(atlasUserPath, "utf-8").trim() : "";
   if (value.length > 0) {
     result.details = [`atlas-user: ${value}`];
     return result;
@@ -18451,10 +18802,10 @@ function checkMemberNameMissing() {
   result.healthy = false;
   result.issue = "atlas-toolbox source registered but ~/.claude/.atlas-user not set";
   const clonePath = skillSourceClonePath(atlasSource.id);
-  const membersDir = path35.join(clonePath, "members");
-  const existing = fs37.existsSync(membersDir) ? fs37.readdirSync(membersDir).filter((e) => {
+  const membersDir = path37.join(clonePath, "members");
+  const existing = fs39.existsSync(membersDir) ? fs39.readdirSync(membersDir).filter((e) => {
     try {
-      return fs37.statSync(path35.join(membersDir, e)).isDirectory();
+      return fs39.statSync(path37.join(membersDir, e)).isDirectory();
     } catch {
       return false;
     }
@@ -18467,9 +18818,9 @@ function checkMemberNameMissing() {
   return result;
 }
 function checkMemberOverlayDrift() {
-  const claudeDir2 = claudeDirInternal3();
-  const atlasUserPath = path35.join(claudeDir2, ".atlas-user");
-  const atlasUser = fs37.existsSync(atlasUserPath) ? fs37.readFileSync(atlasUserPath, "utf-8").trim() : "";
+  const claudeDir3 = claudeDirInternal3();
+  const atlasUserPath = path37.join(claudeDir3, ".atlas-user");
+  const atlasUser = fs39.existsSync(atlasUserPath) ? fs39.readFileSync(atlasUserPath, "utf-8").trim() : "";
   if (atlasUser.length === 0) {
     return [];
   }
@@ -18485,26 +18836,26 @@ function checkMemberOverlayDrift() {
   const clonePath = skillSourceClonePath(atlasSource.id);
   const results = [];
   for (const kind of ["skills", "agents"]) {
-    const localRoot = path35.join(claudeDir2, `${kind}.overrides`);
-    if (!fs37.existsSync(localRoot))
+    const localRoot = path37.join(claudeDir3, `${kind}.overrides`);
+    if (!fs39.existsSync(localRoot))
       continue;
     let entries;
     try {
-      entries = fs37.readdirSync(localRoot);
+      entries = fs39.readdirSync(localRoot);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const localFile = path35.join(localRoot, entry);
+      const localFile = path37.join(localRoot, entry);
       let stat2;
       try {
-        stat2 = fs37.statSync(localFile);
+        stat2 = fs39.statSync(localFile);
       } catch {
         continue;
       }
       if (!stat2.isFile())
         continue;
-      const cloneFile = path35.join(clonePath, "members", atlasUser, `${kind}.overrides`, entry);
+      const cloneFile = path37.join(clonePath, "members", atlasUser, `${kind}.overrides`, entry);
       const localSha = sha256OfPath(localFile);
       const cloneSha = sha256OfPath(cloneFile);
       if (localSha === cloneSha) {
@@ -18559,16 +18910,16 @@ var init_doctor_checks = __esm({
 });
 
 // ../core/dist/skill-sync/detect-pull-deploy-drift.js
-import * as fs38 from "node:fs";
-import * as path36 from "node:path";
+import * as fs40 from "node:fs";
+import * as path38 from "node:path";
 function deployedSymlinkBasenames(bucketDir) {
   const result = /* @__PURE__ */ new Set();
-  if (!fs38.existsSync(bucketDir))
+  if (!fs40.existsSync(bucketDir))
     return result;
-  for (const name of fs38.readdirSync(bucketDir)) {
-    const p = path36.join(bucketDir, name);
+  for (const name of fs40.readdirSync(bucketDir)) {
+    const p = path38.join(bucketDir, name);
     try {
-      if (fs38.lstatSync(p).isSymbolicLink()) {
+      if (fs40.lstatSync(p).isSymbolicLink()) {
         result.add(name);
       }
     } catch {
@@ -18579,7 +18930,7 @@ function deployedSymlinkBasenames(bucketDir) {
 function detectPullDeployDrift(opts) {
   const { clonePath, sourceId, atlasUser } = opts;
   const { artifacts } = resolveSourceArtifacts({ sourceId, clonePath, atlasUser });
-  const sourceConfig = fs38.existsSync(clonePath) ? readSourceConfig(clonePath, sourceId) : void 0;
+  const sourceConfig = fs40.existsSync(clonePath) ? readSourceConfig(clonePath, sourceId) : void 0;
   const eff = resolveEffectivePrefix(opts.operatorSource ?? {}, sourceConfig);
   const prefixEntry = { id: sourceId };
   if (eff.prefix !== void 0)
@@ -18588,7 +18939,7 @@ function detectPullDeployDrift(opts) {
     prefixEntry.prefixScope = eff.prefixScope;
   if (eff.prefixTarget !== void 0)
     prefixEntry.prefixTarget = eff.prefixTarget;
-  applyPrefixRewrites(artifacts, buildSourcePrefixMap([prefixEntry]), claudeDir(), true);
+  applyPrefixRewrites(artifacts, buildSourcePrefixMap([prefixEntry]), claudeDir2(), true);
   const cloneByKind = {
     skill: /* @__PURE__ */ new Set(),
     agent: /* @__PURE__ */ new Set(),
@@ -18606,7 +18957,7 @@ function detectPullDeployDrift(opts) {
     const kind = artifact.kind;
     cloneByKind[kind].add(artifact.deployBasename);
   }
-  const claude = claudeDir();
+  const claude = claudeDir2();
   const perKind = {
     skill: { added: [], removed: [] },
     agent: { added: [], removed: [] },
@@ -18616,7 +18967,7 @@ function detectPullDeployDrift(opts) {
   let total = 0;
   for (const kind of Object.keys(KIND_TO_BUCKET)) {
     const bucket = KIND_TO_BUCKET[kind];
-    const bucketDir = path36.join(claude, bucket);
+    const bucketDir = path38.join(claude, bucket);
     const deployed = deployedSymlinkBasenames(bucketDir);
     const cloneBasenames = cloneByKind[kind];
     const added = [];
@@ -18667,11 +19018,13 @@ __export(skill_sources_exports, {
   PROJECT_OVERRIDE_RELATIVE_PATH: () => PROJECT_OVERRIDE_RELATIVE_PATH,
   SKILL_SOURCES_AUDIT_LOG_FILENAME: () => SKILL_SOURCES_AUDIT_LOG_FILENAME,
   SKILL_SOURCE_ID_LENGTH: () => SKILL_SOURCE_ID_LENGTH,
+  SOURCE_SIDECAR_FILENAME: () => SOURCE_SIDECAR_FILENAME,
   SkillOverrideSchema: () => SkillOverrideSchema,
   SkillSourceGitError: () => SkillSourceGitError,
   SkillSourceSchema: () => SkillSourceSchema,
   SourceConfigSchema: () => SourceConfigSchema,
   SourceConfigSnapshotSchema: () => SourceConfigSnapshotSchema,
+  SourceSidecarSchema: () => SourceSidecarSchema,
   TrustActionSchema: () => TrustActionSchema,
   TrustAuditEntrySchema: () => TrustAuditEntrySchema,
   TrustMethodSchema: () => TrustMethodSchema,
@@ -18688,7 +19041,7 @@ __export(skill_sources_exports, {
   checkOrphanedSnapshots: () => checkOrphanedSnapshots,
   checkSentinelDrift: () => checkSentinelDrift,
   checkStateFileParse: () => checkStateFileParse,
-  claudeDir: () => claudeDir,
+  claudeDir: () => claudeDir2,
   claudeSettingsPath: () => claudeSettingsPath,
   cloneSkillSource: () => cloneSkillSource,
   computeSkillsHookUninstall: () => computeUninstall,
@@ -18713,7 +19066,10 @@ __export(skill_sources_exports, {
   readLatestMigrationSnapshot: () => readLatestMigrationSnapshot,
   readMigrationSnapshotFromPath: () => readMigrationSnapshotFromPath,
   readSourceConfig: () => readSourceConfig,
+  readSourceSidecar: () => readSourceSidecar,
   readTrustAuditLog: () => readTrustAuditLog,
+  reconcileIfRegistryEmpty: () => reconcileIfRegistryEmpty,
+  reconcileSkillSources: () => reconcileSkillSources,
   redactUrl: () => redactUrl2,
   removeSkillSource: () => removeSkillSource,
   removeSkillSourceClone: () => removeSkillSourceClone,
@@ -18732,11 +19088,13 @@ __export(skill_sources_exports, {
   skillsHookSettingsPathFor: () => settingsPathFor,
   sourceConfigPath: () => sourceConfigPath,
   sourceConfigsEqual: () => sourceConfigsEqual,
+  sourceSidecarPath: () => sourceSidecarPath,
   syncSkills: () => syncSkills,
   uninstallSkillsHookFromFile: () => uninstallSkillsHookFromFile,
   updateSkillSource: () => updateSkillSource,
   withFileLock: () => withFileLock,
-  writeMigrationSnapshot: () => writeMigrationSnapshot
+  writeMigrationSnapshot: () => writeMigrationSnapshot,
+  writeSourceSidecar: () => writeSourceSidecar
 });
 var init_skill_sources = __esm({
   "../core/dist/skill-sources/index.js"() {
@@ -18744,6 +19102,8 @@ var init_skill_sources = __esm({
     init_schema3();
     init_store3();
     init_clone();
+    init_source_file();
+    init_reconcile();
     init_hook_template();
     init_hook_install();
     init_migration_snapshot();
@@ -19549,10 +19909,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path60) {
-  if (!path60)
+function getElementAtPath(obj, path62) {
+  if (!path62)
     return obj;
-  return path60.reduce((acc, key) => acc?.[key], obj);
+  return path62.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -19961,11 +20321,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path60, issues) {
+function prefixIssues(path62, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path60);
+    iss.path.unshift(path62);
     return iss;
   });
 }
@@ -20112,16 +20472,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path60 = []) => {
+  const processError = (error52, path62 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path60, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path62, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path60, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path62, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path60, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path62, ...issue2.path]);
       } else {
-        const fullpath = [...path60, ...issue2.path];
+        const fullpath = [...path62, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -20148,17 +20508,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path60 = []) => {
+  const processError = (error52, path62 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path60, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path62, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path60, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path62, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path60, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path62, ...issue2.path]);
       } else {
-        const fullpath = [...path60, ...issue2.path];
+        const fullpath = [...path62, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -20190,8 +20550,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path60 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path60) {
+  const path62 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path62) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -32883,13 +33243,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path60 = ref.slice(1).split("/").filter(Boolean);
-  if (path60.length === 0) {
+  const path62 = ref.slice(1).split("/").filter(Boolean);
+  if (path62.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path60[0] === defsKey) {
-    const key = path60[1];
+  if (path62[0] === defsKey) {
+    const key = path62[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -39389,8 +39749,8 @@ var initSkill = defineSkill({
 // ../mcp-server/src/lib/validated-tool.ts
 function formatIssues(issues) {
   return issues.map((issue2) => {
-    const path60 = issue2.path.length > 0 ? issue2.path.join(".") : "<root>";
-    return `${path60}: ${issue2.message}`;
+    const path62 = issue2.path.length > 0 ? issue2.path.join(".") : "<root>";
+    return `${path62}: ${issue2.message}`;
   }).join("; ");
 }
 function validatedTool(server, skill, name, handler) {
@@ -39599,7 +39959,7 @@ __export(auth_exports, {
 init_paths();
 import * as crypto from "node:crypto";
 import * as fs3 from "node:fs";
-import * as os2 from "node:os";
+import * as os from "node:os";
 import * as path3 from "node:path";
 var SECRET_ENV_VAR = "OLAM_AUTH_SECRET";
 var SECRET_NAME = "auth-secret";
@@ -39741,8 +40101,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path60, body, attempt = 0) {
-    const url3 = `${this.baseUrl}${path60}`;
+  async request(method, path62, body, attempt = 0) {
+    const url3 = `${this.baseUrl}${path62}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -39760,7 +40120,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path60, body, attempt + 1);
+        return this.request(method, path62, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -40182,7 +40542,7 @@ __export(pr_exports, {
 // ../core/dist/world/registry.js
 import { createRequire } from "node:module";
 import * as net from "node:net";
-import * as os3 from "node:os";
+import * as os2 from "node:os";
 import * as path5 from "node:path";
 import * as fs4 from "node:fs";
 var _require = createRequire(import.meta.url);
@@ -40295,7 +40655,7 @@ CREATE TABLE IF NOT EXISTS meta (
 var WorldRegistry = class {
   db;
   constructor(dbPath) {
-    const resolvedPath = dbPath ?? path5.join(os3.homedir(), ".olam", "worlds.db");
+    const resolvedPath = dbPath ?? path5.join(os2.homedir(), ".olam", "worlds.db");
     if (resolvedPath !== ":memory:") {
       fs4.mkdirSync(path5.dirname(resolvedPath), { recursive: true });
     }
@@ -40759,12 +41119,12 @@ function register3(server, _ctx, _initError) {
       registry2.close();
     }
     try {
-      const { default: fs60 } = await import("node:fs");
-      const { default: os36 } = await import("node:os");
-      const { default: path60 } = await import("node:path");
-      const tokenPath = path60.join(os36.homedir(), ".olam", "host-cp.token");
-      if (fs60.existsSync(tokenPath)) {
-        const token = fs60.readFileSync(tokenPath, "utf-8").trim();
+      const { default: fs62 } = await import("node:fs");
+      const { default: os32 } = await import("node:os");
+      const { default: path62 } = await import("node:path");
+      const tokenPath = path62.join(os32.homedir(), ".olam", "host-cp.token");
+      if (fs62.existsSync(tokenPath)) {
+        const token = fs62.readFileSync(tokenPath, "utf-8").trim();
         await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
           method: "POST",
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -41013,7 +41373,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { readFileSync as readFileSync5, existsSync as existsSync7, statSync } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 var execFileP = promisify(execFile);
 async function tarSkillsDir(skillsDir) {
   if (!existsSync7(skillsDir) || !statSync(skillsDir).isDirectory()) {
@@ -41069,20 +41429,20 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path60) {
-  if (!existsSync7(path60)) return null;
+function readOptional(path62) {
+  if (!existsSync7(path62)) return null;
   try {
-    return readFileSync5(path60, "utf8");
+    return readFileSync5(path62, "utf8");
   } catch {
     return null;
   }
 }
 async function syncProfileToCloudflare(opts) {
   const home = opts.homeDir ?? homedir5();
-  const skillsDir = join8(home, ".claude", "skills");
-  const claudeJsonPath = join8(home, ".claude.json");
-  const claudeMdPath = join8(home, ".claude", "CLAUDE.md");
-  const agentsMdPath = join8(home, ".claude", "AGENTS.md");
+  const skillsDir = join9(home, ".claude", "skills");
+  const claudeJsonPath = join9(home, ".claude.json");
+  const claudeMdPath = join9(home, ".claude", "CLAUDE.md");
+  const agentsMdPath = join9(home, ".claude", "AGENTS.md");
   const form = new FormData();
   const skillsBuf = await tarSkillsDir(skillsDir);
   if (skillsBuf) {
@@ -41306,10 +41666,10 @@ async function selectComputeProvider(config2, env) {
 function createCloudflareProvider(CloudflareProviderClass, config2, env) {
   const resolved = resolveCloudflareCallerConfig(config2, env);
   warnOnWorkerPylonMismatch(resolved.workerUrl, resolved.pylonOrgUrl);
-  const mintToken2 = buildMintTokenForResolvedConfig(resolved);
+  const mintToken3 = buildMintTokenForResolvedConfig(resolved);
   return new CloudflareProviderClass({
     workerUrl: resolved.workerUrl,
-    mintToken: mintToken2,
+    mintToken: mintToken3,
     cfAccessClientId: resolved.cfAccessClientId,
     cfAccessClientSecret: resolved.cfAccessClientSecret
   });
@@ -41677,8 +42037,8 @@ function register5(server, ctx, initError) {
       }
       if (resolved) {
         try {
-          const mintToken2 = createMintTokenForCtx(resolved);
-          const authToken = await mintToken2();
+          const mintToken3 = createMintTokenForCtx(resolved);
+          const authToken = await mintToken3();
           await syncProfileToCloudflare({
             workerUrl: resolved.workerUrl,
             authToken,
@@ -42234,7 +42594,7 @@ var ThoughtLocalStore = class {
 // ../core/dist/world/env-setup.js
 import * as crypto2 from "node:crypto";
 import * as fs10 from "node:fs";
-import * as os8 from "node:os";
+import * as os7 from "node:os";
 import * as path12 from "node:path";
 import { globSync } from "node:fs";
 
@@ -42324,7 +42684,7 @@ function generateHooksConfig(hookServerUrl = DEFAULT_HOOK_SERVER_URL) {
 // ../core/dist/world/env-setup.js
 var DEFAULT_CLAUDE_MODEL = "claude-opus-4-7";
 function copyClaudeConfig(workspacePath, homeDir, configCtx) {
-  const sourceClaudeDir = path12.join(homeDir ?? os8.homedir(), ".claude");
+  const sourceClaudeDir = path12.join(homeDir ?? os7.homedir(), ".claude");
   const destClaudeDir = path12.join(workspacePath, ".claude-host-config");
   void configCtx;
   if (!fs10.existsSync(sourceClaudeDir))
@@ -42370,7 +42730,7 @@ function copyClaudeConfig(workspacePath, homeDir, configCtx) {
     copyDirRecursive(scriptsDir, path12.join(destClaudeDir, "scripts"));
   }
   applyProjectClaudeOverlay(workspacePath, destClaudeDir);
-  writeStrippedMcpServersSnapshot(homeDir ?? os8.homedir(), workspacePath, destClaudeDir);
+  writeStrippedMcpServersSnapshot(homeDir ?? os7.homedir(), workspacePath, destClaudeDir);
 }
 function applyProjectClaudeOverlay(workspacePath, destClaudeDir) {
   const projectClaudeDir = path12.join(workspacePath, ".claude");
@@ -44203,12 +44563,12 @@ __export(capture_view_exports, {
 });
 init_v3();
 import { mkdir } from "node:fs/promises";
-import { join as join15, resolve as resolvePath } from "node:path";
+import { join as join16, resolve as resolvePath } from "node:path";
 
 // ../mcp-server/src/tools/_capture/manifest.ts
 import { createHash as createHash3 } from "node:crypto";
 import { readFile, writeFile } from "node:fs/promises";
-import { basename as basename2, join as join14 } from "node:path";
+import { basename as basename2, join as join15 } from "node:path";
 function redactUrl(url3) {
   if (url3.startsWith("world://")) return url3;
   let parsed;
@@ -44251,10 +44611,10 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path60 = join14(args.outDir, "manifest.json");
-  await writeFile(path60, `${JSON.stringify(manifest, null, 2)}
+  const path62 = join15(args.outDir, "manifest.json");
+  await writeFile(path62, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path60, manifest };
+  return { path: path62, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
@@ -44508,9 +44868,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path60 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path60))) {
-        return httpReject(403, "outside_allow_list", { path: path60 });
+      const path62 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path62))) {
+        return httpReject(403, "outside_allow_list", { path: path62 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -45049,7 +45409,7 @@ function releaseLaunchSlot() {
 function resolveShootsRoot() {
   const fromEnv = process.env.OLAM_SHOOTS_ROOT;
   if (fromEnv && fromEnv.length > 0) return resolvePath(fromEnv);
-  return resolvePath(join15(process.cwd(), ".olam", "shoots"));
+  return resolvePath(join16(process.cwd(), ".olam", "shoots"));
 }
 function isUnderRoot(absPath, root) {
   if (absPath === root) return true;
@@ -45350,14 +45710,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path60 = join15(outDir, `${shot.name}.${ext}`);
+    const path62 = join16(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path60,
+      path: path62,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path60, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path62, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -45664,17 +46024,17 @@ var webTaskShape = external_exports2.object(webTaskInput);
 import { spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync14 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var WEBWRIGHT_SETUP_COMMAND = "olam webwright setup";
 function resolveVenvPath(cfg) {
   if (cfg?.venvPath && cfg.venvPath.length > 0) return cfg.venvPath;
-  return join16(homedir9(), ".olam", "venvs", "webwright");
+  return join17(homedir9(), ".olam", "venvs", "webwright");
 }
 function resolveConfigDir(cfg) {
   if (cfg?.configDir && cfg.configDir.length > 0) {
     return existsSync14(cfg.configDir) ? cfg.configDir : null;
   }
-  const candidate = join16(
+  const candidate = join17(
     homedir9(),
     ".claude",
     "plugins",
@@ -45692,9 +46052,9 @@ function isWebwrightEnabled(cfg) {
   return cfg?.enabled === true;
 }
 function venvPython(venvPath) {
-  const posix = join16(venvPath, "bin", "python");
+  const posix = join17(venvPath, "bin", "python");
   if (existsSync14(posix)) return posix;
-  const win = join16(venvPath, "Scripts", "python.exe");
+  const win = join17(venvPath, "Scripts", "python.exe");
   if (existsSync14(win)) return win;
   return null;
 }
@@ -45780,18 +46140,18 @@ import { spawn as spawn4 } from "node:child_process";
 import { mkdir as mkdir2, mkdtemp, readFile as readFile3, readdir, rm, writeFile as writeFile2 } from "node:fs/promises";
 import { existsSync as existsSync15 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join18, resolve as resolvePath2 } from "node:path";
+import { join as join19, resolve as resolvePath2 } from "node:path";
 
 // ../mcp-server/src/tools/_web_task/model-config.ts
 import { readFile as readFile2 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var PLACEHOLDER_ANTHROPIC_API_KEY = "olam-vault-routed-placeholder-stripped-by-proxy";
 var DEFAULT_WEB_TASK_MODEL = "claude-opus-4-7";
 var AnthropicBaseUrlMissingError = class extends Error {
-  constructor(path60, cause) {
+  constructor(path62, cause) {
     super(
-      `vault base URL is not resolvable from "${path60}" (${cause}). The web-task model call routes through olam's auth-worker vault, not a raw API key \u2014 this host has no vault base URL configured. Run \`olam auth login\` (or set OLAM_ANTHROPIC_BASE_URL) so the path-encoded /auth/<sub>/<secret> base exists.`
+      `vault base URL is not resolvable from "${path62}" (${cause}). The web-task model call routes through olam's auth-worker vault, not a raw API key \u2014 this host has no vault base URL configured. Run \`olam auth login\` (or set OLAM_ANTHROPIC_BASE_URL) so the path-encoded /auth/<sub>/<secret> base exists.`
     );
     this.name = "AnthropicBaseUrlMissingError";
   }
@@ -45800,7 +46160,7 @@ async function resolveVaultBaseUrl(opts = {}) {
   const env = opts.env ?? process.env;
   const fromEnv = env.OLAM_ANTHROPIC_BASE_URL;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();
-  const file2 = opts.baseUrlFile ?? join17(homedir10(), ".olam", "anthropic-base-url");
+  const file2 = opts.baseUrlFile ?? join18(homedir10(), ".olam", "anthropic-base-url");
   let raw;
   try {
     raw = await readFile2(file2, "utf-8");
@@ -45850,7 +46210,7 @@ var WebTaskSpawnError = class extends Error {
 function resolveWebTaskRoot() {
   const fromEnv = process.env.OLAM_WEB_TASK_ROOT;
   if (fromEnv && fromEnv.length > 0) return resolvePath2(fromEnv);
-  return resolvePath2(join18(process.cwd(), ".olam", "web-tasks"));
+  return resolvePath2(join19(process.cwd(), ".olam", "web-tasks"));
 }
 function isUnderRoot2(absPath, root) {
   if (absPath === root) return true;
@@ -45913,7 +46273,7 @@ async function runWebwright(pythonPath, args, spawnEnv, timeoutMs, deps) {
   });
 }
 async function locateRunDir(outDir) {
-  if (existsSync15(join18(outDir, "trajectory.json"))) return outDir;
+  if (existsSync15(join19(outDir, "trajectory.json"))) return outDir;
   let entries = [];
   try {
     entries = await readdir(outDir);
@@ -45922,8 +46282,8 @@ async function locateRunDir(outDir) {
   }
   const candidates = [];
   for (const name of entries) {
-    const sub = join18(outDir, name);
-    if (existsSync15(join18(sub, "trajectory.json"))) candidates.push({ dir: sub });
+    const sub = join19(outDir, name);
+    if (existsSync15(join19(sub, "trajectory.json"))) candidates.push({ dir: sub });
   }
   if (candidates.length === 0) return outDir;
   candidates.sort((a, b) => a.dir < b.dir ? 1 : -1);
@@ -45936,14 +46296,14 @@ async function collectScreenshots(runDir) {
   } catch {
     return [];
   }
-  const shots = entries.filter((n) => /\.(png|jpe?g)$/i.test(n)).sort().map((n, i) => ({ step: i, path: join18(runDir, n) }));
+  const shots = entries.filter((n) => /\.(png|jpe?g)$/i.test(n)).sort().map((n, i) => ({ step: i, path: join19(runDir, n) }));
   return shots;
 }
 async function readTrajectoryFacts(runDir, stdoutTail) {
   let answer = null;
   let modelCalls = null;
   try {
-    const raw = await readFile3(join18(runDir, "trajectory.json"), "utf-8");
+    const raw = await readFile3(join19(runDir, "trajectory.json"), "utf-8");
     const parsed = JSON.parse(raw);
     answer = extractFinalAnswer(parsed);
     modelCalls = extractModelCalls(parsed);
@@ -46076,11 +46436,11 @@ async function runSpawnExecutor(spec, ctx, provision, deps = { spawn: spawn4 })
   } catch (err) {
     throw new WebTaskSpawnError("vault_base_url_missing", err.message);
   }
-  const tmpDirRoot = await mkdtemp(join18(tmpdir2(), "olam-web-task-"));
-  const modelYamlPath = join18(tmpDirRoot, "model_olam.yaml");
+  const tmpDirRoot = await mkdtemp(join19(tmpdir2(), "olam-web-task-"));
+  const modelYamlPath = join19(tmpDirRoot, "model_olam.yaml");
   await writeFile2(modelYamlPath, modelYaml.yaml, "utf-8");
   try {
-    const baseYaml = join18(provision.configDir, "base.yaml");
+    const baseYaml = join19(provision.configDir, "base.yaml");
     const args = [
       "-m",
       "webwright.run.cli",
@@ -46134,10 +46494,10 @@ ${tail}` : ""}`
       );
     }
     const runDir = await locateRunDir(absOutDir);
-    const trajectoryPath = join18(runDir, "trajectory.json");
+    const trajectoryPath = join19(runDir, "trajectory.json");
     const screenshots = await collectScreenshots(runDir);
     const facts = await readTrajectoryFacts(runDir, outcome.stdout);
-    const scriptPath = existsSync15(join18(runDir, "final_script.py")) ? join18(runDir, "final_script.py") : void 0;
+    const scriptPath = existsSync15(join19(runDir, "final_script.py")) ? join19(runDir, "final_script.py") : void 0;
     return {
       result: facts.answer,
       trajectoryPath,
@@ -46690,12 +47050,12 @@ function openUrl(url3) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs60 } = await import("node:fs");
-    const { default: os36 } = await import("node:os");
-    const { default: path60 } = await import("node:path");
-    const tp = path60.join(os36.homedir(), ".olam", "host-cp.token");
-    if (!fs60.existsSync(tp)) return { token: null };
-    return { token: fs60.readFileSync(tp, "utf-8").trim() };
+    const { default: fs62 } = await import("node:fs");
+    const { default: os32 } = await import("node:os");
+    const { default: path62 } = await import("node:path");
+    const tp = path62.join(os32.homedir(), ".olam", "host-cp.token");
+    if (!fs62.existsSync(tp)) return { token: null };
+    return { token: fs62.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -46989,9 +47349,9 @@ function register22(server, _ctx, _initError) {
       }]
     };
   });
-  validatedTool(server, repoAddSkill, "olam_repo_add", async ({ name, path: path60, description, defaultBranch }) => {
+  validatedTool(server, repoAddSkill, "olam_repo_add", async ({ name, path: path62, description, defaultBranch }) => {
     try {
-      const entry = addRepo({ name, path: path60, description, defaultBranch });
+      const entry = addRepo({ name, path: path62, description, defaultBranch });
       return {
         content: [{
           type: "text",
@@ -47027,9 +47387,9 @@ function register22(server, _ctx, _initError) {
       };
     }
   });
-  validatedTool(server, repoUpdateSkill, "olam_repo_update", async ({ name, path: path60, description, defaultBranch }) => {
+  validatedTool(server, repoUpdateSkill, "olam_repo_update", async ({ name, path: path62, description, defaultBranch }) => {
     try {
-      const entry = updateRepo(name, { path: path60, description, defaultBranch });
+      const entry = updateRepo(name, { path: path62, description, defaultBranch });
       return {
         content: [{
           type: "text",
@@ -47054,9 +47414,9 @@ __export(process_port_exports, {
   register: () => register23,
   resolveHostCpToken: () => resolveHostCpToken
 });
-import fs39 from "node:fs";
-import os22 from "node:os";
-import path37 from "node:path";
+import fs41 from "node:fs";
+import os18 from "node:os";
+import path39 from "node:path";
 
 // ../skill-runtime/dist/skills/process-list.js
 init_v3();
@@ -47101,8 +47461,8 @@ var HOST_CP_BASE = "http://127.0.0.1:19000";
 function resolveHostCpToken() {
   const envToken = process.env["OLAM_HOST_CP_TOKEN"];
   if (envToken) return envToken;
-  const tokenPath = path37.join(os22.homedir(), ".olam", "host-cp.token");
-  if (fs39.existsSync(tokenPath)) return fs39.readFileSync(tokenPath, "utf-8").trim();
+  const tokenPath = path39.join(os18.homedir(), ".olam", "host-cp.token");
+  if (fs41.existsSync(tokenPath)) return fs41.readFileSync(tokenPath, "utf-8").trim();
   return null;
 }
 function tokenMissingError() {
@@ -47625,8 +47985,8 @@ __export(skills_exports, {
   register: () => register26
 });
 init_skill_sources();
-import * as fs40 from "node:fs";
-import * as path38 from "node:path";
+import * as fs42 from "node:fs";
+import * as path40 from "node:path";
 
 // ../skill-runtime/dist/skills/skills-sync.js
 init_v3();
@@ -47700,21 +48060,21 @@ function fail2(err, hint) {
   };
 }
 function listDeployed() {
-  const dir = claudeDir();
+  const dir = claudeDir2();
   const sources = listSkillSources();
   const sourcePaths = new Map(
     sources.map((s) => [skillSourceClonePath(s.id), s.id])
   );
   const entries = [];
   for (const bucket of ["skills", "agents", "scripts", "rules", "commands"]) {
-    const bucketDir = path38.join(dir, bucket);
-    if (!fs40.existsSync(bucketDir)) continue;
-    for (const name of fs40.readdirSync(bucketDir)) {
-      const full = path38.join(bucketDir, name);
+    const bucketDir = path40.join(dir, bucket);
+    if (!fs42.existsSync(bucketDir)) continue;
+    for (const name of fs42.readdirSync(bucketDir)) {
+      const full = path40.join(bucketDir, name);
       try {
-        const stat2 = fs40.lstatSync(full);
+        const stat2 = fs42.lstatSync(full);
         if (!stat2.isSymbolicLink()) continue;
-        const target = fs40.readlinkSync(full);
+        const target = fs42.readlinkSync(full);
         let sourceId;
         for (const [clonePath, id] of sourcePaths.entries()) {
           if (target.startsWith(clonePath)) {
@@ -47802,15 +48162,15 @@ function deriveModeId(name, taken) {
 
 // ../core/dist/ree-modes/store.js
 init_skill_sources();
-import * as fs42 from "node:fs";
-import * as os24 from "node:os";
-import * as path40 from "node:path";
+import * as fs44 from "node:fs";
+import * as os20 from "node:os";
+import * as path42 from "node:path";
 
 // ../core/dist/ree-modes/registry.js
 init_v3();
-import * as fs41 from "node:fs";
-import * as os23 from "node:os";
-import * as path39 from "node:path";
+import * as fs43 from "node:fs";
+import * as os19 from "node:os";
+import * as path41 from "node:path";
 var CadenceStatusSchema = external_exports2.enum(["running", "stopped"]);
 var CadenceEntrySchema = external_exports2.object({
   /** Unique cadence id (modeId + short timestamp). */
@@ -47832,18 +48192,18 @@ function olamRootDir() {
   const override = process.env["OLAM_STATE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path39.join(os23.homedir(), ".olam");
+  return path41.join(os19.homedir(), ".olam");
 }
 function cadenceRegistryPath() {
-  return path39.join(olamRootDir(), "ree-cadences.json");
+  return path41.join(olamRootDir(), "ree-cadences.json");
 }
 function readCadenceRegistry() {
   const file2 = cadenceRegistryPath();
-  if (!fs41.existsSync(file2))
+  if (!fs43.existsSync(file2))
     return { cadences: [] };
   let raw;
   try {
-    raw = JSON.parse(fs41.readFileSync(file2, "utf-8"));
+    raw = JSON.parse(fs43.readFileSync(file2, "utf-8"));
   } catch {
     return { cadences: [] };
   }
@@ -47852,10 +48212,10 @@ function readCadenceRegistry() {
 }
 function writeCadenceRegistry(registry2) {
   const file2 = cadenceRegistryPath();
-  fs41.mkdirSync(path39.dirname(file2), { recursive: true });
+  fs43.mkdirSync(path41.dirname(file2), { recursive: true });
   const tmp = `${file2}.tmp-${process.pid}`;
-  fs41.writeFileSync(tmp, JSON.stringify(registry2, null, 2) + "\n", "utf-8");
-  fs41.renameSync(tmp, file2);
+  fs43.writeFileSync(tmp, JSON.stringify(registry2, null, 2) + "\n", "utf-8");
+  fs43.renameSync(tmp, file2);
 }
 function startCadence(input) {
   const now = input.now ?? /* @__PURE__ */ new Date();
@@ -47899,18 +48259,18 @@ function claudeRootDir() {
   const override = process.env["OLAM_CLAUDE_DIR"];
   if (override && override.length > 0)
     return override;
-  return path40.join(os24.homedir(), ".claude");
+  return path42.join(os20.homedir(), ".claude");
 }
 function localModesDir() {
-  return path40.join(claudeRootDir(), "ree-modes.local");
+  return path42.join(claudeRootDir(), "ree-modes.local");
 }
 var SOURCE_CATALOG_RELATIVE_PATH = "shared/engineering/skills/ree-cadence/references/modes.md";
 function findSourceCatalogPath(opts) {
   if (opts && "_testCatalogPath" in opts)
     return opts._testCatalogPath ?? null;
   for (const source of listSkillSources()) {
-    const candidate = path40.join(skillSourceClonePath(source.id), SOURCE_CATALOG_RELATIVE_PATH);
-    if (fs42.existsSync(candidate))
+    const candidate = path42.join(skillSourceClonePath(source.id), SOURCE_CATALOG_RELATIVE_PATH);
+    if (fs44.existsSync(candidate))
       return candidate;
   }
   return null;
@@ -47960,16 +48320,16 @@ function parseModeCatalog(content, origin) {
 }
 function loadLocalModes() {
   const dir = localModesDir();
-  if (!fs42.existsSync(dir))
+  if (!fs44.existsSync(dir))
     return [];
   const out = [];
-  for (const entry of fs42.readdirSync(dir).sort()) {
+  for (const entry of fs44.readdirSync(dir).sort()) {
     if (!entry.endsWith(".md"))
       continue;
-    const full = path40.join(dir, entry);
+    const full = path42.join(dir, entry);
     let content;
     try {
-      content = fs42.readFileSync(full, "utf-8");
+      content = fs44.readFileSync(full, "utf-8");
     } catch {
       continue;
     }
@@ -47985,7 +48345,7 @@ function loadSourceModes(opts) {
     return [];
   let content;
   try {
-    content = fs42.readFileSync(catalogPath, "utf-8");
+    content = fs44.readFileSync(catalogPath, "utf-8");
   } catch {
     return [];
   }
@@ -48052,12 +48412,12 @@ function createLocalMode(input) {
     id = deriveModeId(name, taken);
   }
   const dir = localModesDir();
-  fs42.mkdirSync(dir, { recursive: true });
-  const file2 = path40.join(dir, `${id}.md`);
-  if (fs42.existsSync(file2)) {
+  fs44.mkdirSync(dir, { recursive: true });
+  const file2 = path42.join(dir, `${id}.md`);
+  if (fs44.existsSync(file2)) {
     throw new Error(`local mode file already exists: ${file2}`);
   }
-  fs42.writeFileSync(file2, scaffoldModeBlock({ id, name, instruction }), "utf-8");
+  fs44.writeFileSync(file2, scaffoldModeBlock({ id, name, instruction }), "utf-8");
   return { id, name, origin: "local", path: file2 };
 }
 function renameLocalMode(oldId, newId) {
@@ -48068,8 +48428,8 @@ function renameLocalMode(oldId, newId) {
     throw new Error(`invalid new id "${newId}" \u2014 must match ${MODE_ID_RE}.`);
   }
   const dir = localModesDir();
-  const oldFile = path40.join(dir, `${oldId}.md`);
-  if (!fs42.existsSync(oldFile)) {
+  const oldFile = path42.join(dir, `${oldId}.md`);
+  if (!fs44.existsSync(oldFile)) {
     const isSource = loadSourceModes().some((m) => m.id === oldId);
     if (isSource) {
       throw new Error(`"${oldId}" is a source built-in mode, not a local one \u2014 it can't be renamed directly. Create a local override (olam skills ree-modes add) and promote it instead.`);
@@ -48079,11 +48439,11 @@ function renameLocalMode(oldId, newId) {
   if (takenModeIds().has(newId)) {
     throw new Error(`target id "${newId}" already exists (source or local).`);
   }
-  const content = fs42.readFileSync(oldFile, "utf-8");
+  const content = fs44.readFileSync(oldFile, "utf-8");
   const rewritten = content.replace(new RegExp(`^## ${escapeRegex2(oldId)} \u2014 `, "m"), `## ${newId} \u2014 `);
-  const newFile = path40.join(dir, `${newId}.md`);
-  fs42.writeFileSync(newFile, rewritten, "utf-8");
-  fs42.rmSync(oldFile);
+  const newFile = path42.join(dir, `${newId}.md`);
+  fs44.writeFileSync(newFile, rewritten, "utf-8");
+  fs44.rmSync(oldFile);
   const danglingCadences = listCadences({ runningOnly: true }).filter((c) => c.modeId === oldId).map((c) => c.id);
   return { from: oldId, to: newId, origin: "local", path: newFile, danglingCadences };
 }
@@ -48103,8 +48463,8 @@ function deriveNameFromInstruction(instruction) {
 }
 
 // ../core/dist/ree-modes/promote.js
-import * as fs43 from "node:fs";
-import * as path41 from "node:path";
+import * as fs45 from "node:fs";
+import * as path43 from "node:path";
 
 // ../core/dist/ree-modes/disambiguation.js
 var PICKER_THRESHOLD = 4;
@@ -48279,14 +48639,14 @@ var skills_search_exports = {};
 __export(skills_search_exports, {
   register: () => register28
 });
-import * as path43 from "node:path";
-import * as os26 from "node:os";
+import * as path45 from "node:path";
+import * as os22 from "node:os";
 
 // ../mcp-server/src/lib/skills-index.mjs
 import { createRequire as createRequire5 } from "node:module";
-import * as fs44 from "node:fs";
-import * as path42 from "node:path";
-import * as os25 from "node:os";
+import * as fs46 from "node:fs";
+import * as path44 from "node:path";
+import * as os21 from "node:os";
 var VECTOR_DIM = 256;
 var SCHEMA_VERSION3 = "1";
 var SCHEMA_KEY = "skills_index_schema_version";
@@ -48375,7 +48735,7 @@ function bufferToVector(buf) {
   return vec;
 }
 function openIndex(dbPath) {
-  if (!fs44.existsSync(dbPath)) {
+  if (!fs46.existsSync(dbPath)) {
     throw new Error(
       `skills index not found at ${dbPath}. Run \`node scripts/skills-index-build.mjs --out ${dbPath}\` first.`
     );
@@ -48417,8 +48777,8 @@ function searchIndex(dbPath, query, k = 5) {
     db.close();
   }
 }
-var DEFAULT_DB_PATH = path42.join(os25.homedir(), ".olam", "skills.vec.db");
-var DEFAULT_SOURCE_DIR = path42.join(os25.homedir(), ".claude", "skills");
+var DEFAULT_DB_PATH = path44.join(os21.homedir(), ".olam", "skills.vec.db");
+var DEFAULT_SOURCE_DIR = path44.join(os21.homedir(), ".claude", "skills");
 
 // ../skill-runtime/dist/skills/skills-search.js
 init_v3();
@@ -48437,7 +48797,7 @@ var skillsSearchSkill = defineSkill({
 function defaultDbPath() {
   const override = process.env["SKILLS_INDEX_PATH"];
   if (override) return override;
-  return path43.join(os26.homedir(), ".olam", "skills.vec.db");
+  return path45.join(os22.homedir(), ".olam", "skills.vec.db");
 }
 function asMessage10(err) {
   return err instanceof Error ? err.message : String(err);
@@ -48481,8 +48841,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url2(path60) {
-  return `http://127.0.0.1:${port()}${path60}`;
+function url2(path62) {
+  return `http://127.0.0.1:${port()}${path62}`;
 }
 function kgServiceHealthUrl() {
   return url2("/health");
@@ -48711,9 +49071,9 @@ __export(kg_install_hook_exports, {
   register: () => register31
 });
 init_merge_settings();
-import * as fs45 from "node:fs";
-import * as path44 from "node:path";
-import * as os27 from "node:os";
+import * as fs47 from "node:fs";
+import * as path46 from "node:path";
+import * as os23 from "node:os";
 
 // ../core/dist/kg/hook-template.js
 var KG_HOOK_SENTINEL = "kg-service-v3-classifier-hook";
@@ -48809,22 +49169,22 @@ var kgInstallHookSkill = defineSkill({
 // ../mcp-server/src/tools/kg-install-hook.ts
 function settingsPathFor2(scope, projectPath) {
   if (scope === "user") {
-    return path44.join(os27.homedir(), ".claude", "settings.json");
+    return path46.join(os23.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path44.join(root, ".claude", "settings.json");
+  return path46.join(root, ".claude", "settings.json");
 }
 function register31(server, _ctx, _initError) {
   validatedTool(server, kgInstallHookSkill, "olam_kg_install_hook", async (params) => {
     const scope = params.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor2(scope, params.projectPath);
     try {
-      fs45.mkdirSync(path44.dirname(filePath), { recursive: true });
+      fs47.mkdirSync(path46.dirname(filePath), { recursive: true });
       let backupPath = null;
-      if (fs45.existsSync(filePath)) {
+      if (fs47.existsSync(filePath)) {
         const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         backupPath = `${filePath}.olam-bak.${ts}`;
-        fs45.copyFileSync(filePath, backupPath);
+        fs47.copyFileSync(filePath, backupPath);
       }
       const result = mergeHomeSettingsJson(filePath, {
         ensureHook: {
@@ -48835,7 +49195,7 @@ function register31(server, _ctx, _initError) {
       });
       if (result.status === "already-present" && backupPath) {
         try {
-          fs45.unlinkSync(backupPath);
+          fs47.unlinkSync(backupPath);
         } catch {
         }
       }
@@ -48877,9 +49237,9 @@ var kg_uninstall_hook_exports = {};
 __export(kg_uninstall_hook_exports, {
   register: () => register32
 });
-import * as fs46 from "node:fs";
-import * as path45 from "node:path";
-import * as os28 from "node:os";
+import * as fs48 from "node:fs";
+import * as path47 from "node:path";
+import * as os24 from "node:os";
 
 // ../skill-runtime/dist/skills/kg-uninstall-hook.js
 init_v3();
@@ -48901,10 +49261,10 @@ var kgUninstallHookSkill = defineSkill({
 // ../mcp-server/src/tools/kg-uninstall-hook.ts
 function settingsPathFor3(scope, projectPath) {
   if (scope === "user") {
-    return path45.join(os28.homedir(), ".claude", "settings.json");
+    return path47.join(os24.homedir(), ".claude", "settings.json");
   }
   const root = projectPath ?? process.cwd();
-  return path45.join(root, ".claude", "settings.json");
+  return path47.join(root, ".claude", "settings.json");
 }
 function dropSentinel(matchers) {
   let changed = false;
@@ -48931,7 +49291,7 @@ function register32(server, _ctx, _initError) {
     const scope = params.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor3(scope, params.projectPath);
     try {
-      if (!fs46.existsSync(filePath)) {
+      if (!fs48.existsSync(filePath)) {
         return {
           content: [
             {
@@ -48945,7 +49305,7 @@ function register32(server, _ctx, _initError) {
           ]
         };
       }
-      const raw = fs46.readFileSync(filePath, "utf-8");
+      const raw = fs48.readFileSync(filePath, "utf-8");
       const settings = raw.trim() ? JSON.parse(raw) : {};
       const preToolUse = settings.hooks?.PreToolUse;
       if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
@@ -48980,7 +49340,7 @@ function register32(server, _ctx, _initError) {
       const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const backupPath = `${filePath}.olam-bak.${ts}`;
       try {
-        fs46.copyFileSync(filePath, backupPath);
+        fs48.copyFileSync(filePath, backupPath);
       } catch {
       }
       const next = {
@@ -48992,7 +49352,7 @@ function register32(server, _ctx, _initError) {
         if (otherStages.length === 0) delete next.hooks;
         else delete next.hooks.PreToolUse;
       }
-      fs46.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs48.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
       return {
         content: [
           {
@@ -49730,12 +50090,12 @@ function registerAllTools(server, ctx, initError) {
 }
 
 // ../mcp-server/src/resources/chunks.ts
-import fs47 from "node:fs";
-import os29 from "node:os";
-import path46 from "node:path";
+import fs49 from "node:fs";
+import os25 from "node:os";
+import path48 from "node:path";
 var DEFAULT_HOST_CP_URL = "http://127.0.0.1:19000";
-var DEFAULT_PLAN_CHAT_SECRET_PATH = path46.join(
-  os29.homedir(),
+var DEFAULT_PLAN_CHAT_SECRET_PATH = path48.join(
+  os25.homedir(),
   ".olam",
   "plan-chat-secret"
 );
@@ -49749,7 +50109,7 @@ function loadBearer(bearerOpt, secretPath) {
   const envBearer = process.env.OLAM_PLAN_CHAT_BEARER?.trim();
   if (envBearer && envBearer.length > 0) return envBearer;
   try {
-    const onDisk = fs47.readFileSync(secretPath, "utf8").trim();
+    const onDisk = fs49.readFileSync(secretPath, "utf8").trim();
     return onDisk.length > 0 ? onDisk : null;
   } catch (err) {
     if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
@@ -51523,9 +51883,9 @@ init_loader();
 // ../core/dist/world/manager.js
 import * as crypto8 from "node:crypto";
 import { execSync as execSync6, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs57 from "node:fs";
-import * as os34 from "node:os";
-import * as path57 from "node:path";
+import * as fs59 from "node:fs";
+import * as os30 from "node:os";
+import * as path59 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -51620,9 +51980,9 @@ function resolveDevboxImage(config2, tag) {
 }
 
 // ../core/dist/world/worktree.js
-import { execFileSync as execFileSync4 } from "node:child_process";
-import * as fs48 from "node:fs";
-import * as path47 from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import * as fs50 from "node:fs";
+import * as path49 from "node:path";
 function resolveGitDir(repo) {
   if (repo.path) {
     return repo.path;
@@ -51632,18 +51992,18 @@ function resolveGitDir(repo) {
 async function createWorktrees(repos, worldId, workspacePath, branch) {
   const created = [];
   for (const repo of repos) {
-    const worktreePath = path47.join(workspacePath, repo.name);
+    const worktreePath = path49.join(workspacePath, repo.name);
     const gitDir = resolveGitDir(repo);
     const branchName = branch || `olam/${worldId}`;
     try {
-      fs48.mkdirSync(path47.dirname(worktreePath), { recursive: true });
-      execFileSync4("git", ["worktree", "add", worktreePath, "-b", branchName], {
+      fs50.mkdirSync(path49.dirname(worktreePath), { recursive: true });
+      execFileSync5("git", ["worktree", "add", worktreePath, "-b", branchName], {
         cwd: gitDir,
         stdio: "pipe"
       });
       if (repo.submodules) {
         try {
-          execFileSync4("git", ["submodule", "update", "--init", "--recursive"], {
+          execFileSync5("git", ["submodule", "update", "--init", "--recursive"], {
             cwd: worktreePath,
             stdio: "pipe"
           });
@@ -51655,7 +52015,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
       for (const entry of created) {
         try {
           const entryGitDir = resolveGitDir(entry.repo);
-          execFileSync4("git", ["worktree", "remove", entry.worktreePath, "--force"], {
+          execFileSync5("git", ["worktree", "remove", entry.worktreePath, "--force"], {
             cwd: entryGitDir,
             stdio: "pipe"
           });
@@ -51669,7 +52029,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
 }
 async function removeWorktrees(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path47.join(workspacePath, repo.name);
+    const worktreePath = path49.join(workspacePath, repo.name);
     let gitDir;
     try {
       gitDir = resolveGitDir(repo);
@@ -51678,7 +52038,7 @@ async function removeWorktrees(repos, workspacePath) {
     }
     let removed = false;
     try {
-      execFileSync4("git", ["worktree", "remove", "--force", worktreePath], {
+      execFileSync5("git", ["worktree", "remove", "--force", worktreePath], {
         cwd: gitDir,
         stdio: "pipe"
       });
@@ -51687,7 +52047,7 @@ async function removeWorktrees(repos, workspacePath) {
     }
     if (!removed) {
       try {
-        execFileSync4("git", ["worktree", "prune"], {
+        execFileSync5("git", ["worktree", "prune"], {
           cwd: gitDir,
           stdio: "pipe"
         });
@@ -51704,7 +52064,7 @@ function removeBranch(repo, branch) {
     return { branch, action: "not-found" };
   }
   try {
-    execFileSync4("git", ["show-ref", "--quiet", `refs/heads/${branch}`], {
+    execFileSync5("git", ["show-ref", "--quiet", `refs/heads/${branch}`], {
       cwd: gitDir,
       stdio: "pipe"
     });
@@ -51713,7 +52073,7 @@ function removeBranch(repo, branch) {
   }
   let hasUpstream = false;
   try {
-    execFileSync4("git", ["rev-parse", "--abbrev-ref", `${branch}@{upstream}`], { cwd: gitDir, stdio: "pipe" });
+    execFileSync5("git", ["rev-parse", "--abbrev-ref", `${branch}@{upstream}`], { cwd: gitDir, stdio: "pipe" });
     hasUpstream = true;
   } catch {
   }
@@ -51722,14 +52082,14 @@ function removeBranch(repo, branch) {
   }
   let localCommitCount = 0;
   try {
-    const output = execFileSync4("git", ["rev-list", "--count", branch, "--not", "--remotes"], { cwd: gitDir, stdio: "pipe" }).toString().trim();
+    const output = execFileSync5("git", ["rev-list", "--count", branch, "--not", "--remotes"], { cwd: gitDir, stdio: "pipe" }).toString().trim();
     localCommitCount = parseInt(output, 10) || 0;
   } catch {
     localCommitCount = 1;
   }
   if (localCommitCount === 0) {
     try {
-      execFileSync4("git", ["branch", "-D", branch], {
+      execFileSync5("git", ["branch", "-D", branch], {
         cwd: gitDir,
         stdio: "pipe"
       });
@@ -51743,13 +52103,13 @@ function removeBranch(repo, branch) {
 }
 
 // ../core/dist/world/kg-overlay.js
-import { execFileSync as execFileSync5 } from "node:child_process";
-import * as fs49 from "node:fs";
-import * as path48 from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import * as fs51 from "node:fs";
+import * as path50 from "node:path";
 
 // ../core/dist/kg/storage-paths.js
-import { homedir as homedir30 } from "node:os";
-import { join as join50, resolve as resolve11 } from "node:path";
+import { homedir as homedir26 } from "node:os";
+import { join as join53, resolve as resolve11 } from "node:path";
 
 // ../core/dist/world/workspace-name.js
 var InvalidWorkspaceNameError = class extends Error {
@@ -51769,29 +52129,29 @@ function validateWorkspaceName(name) {
 }
 
 // ../core/dist/kg/storage-paths.js
-function olamHome2() {
-  return process.env.OLAM_HOME ?? join50(homedir30(), ".olam");
+function olamHome3() {
+  return process.env.OLAM_HOME ?? join53(homedir26(), ".olam");
 }
 function kgRoot() {
-  return join50(olamHome2(), "kg");
+  return join53(olamHome3(), "kg");
 }
 function worldsRoot() {
-  return join50(olamHome2(), "worlds");
+  return join53(olamHome3(), "worlds");
 }
-function assertWithinPrefix(path60, prefix, label) {
-  if (!path60.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path60} not under ${prefix}/`);
+function assertWithinPrefix(path62, prefix, label) {
+  if (!path62.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path62} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path60 = resolve11(join50(root, workspace));
-  assertWithinPrefix(path60, root, "kgPristinePath");
-  return path60;
+  const path62 = resolve11(join53(root, workspace));
+  assertWithinPrefix(path62, root, "kgPristinePath");
+  return path62;
 }
 var KG_PATHS_INTERNALS = Object.freeze({
-  olamHome: olamHome2,
+  olamHome: olamHome3,
   kgRoot,
   worldsRoot
 });
@@ -51804,10 +52164,10 @@ var KgOverlayError = class extends Error {
   }
 };
 function ensureGitignoreEntry(worldClonePath) {
-  const gitignorePath = path48.join(worldClonePath, ".gitignore");
-  if (!fs49.existsSync(gitignorePath))
+  const gitignorePath = path50.join(worldClonePath, ".gitignore");
+  if (!fs51.existsSync(gitignorePath))
     return "no-gitignore";
-  const content = fs49.readFileSync(gitignorePath, "utf-8");
+  const content = fs51.readFileSync(gitignorePath, "utf-8");
   const lines = content.split("\n").map((l) => l.trim());
   const recognised = /* @__PURE__ */ new Set([
     "graphify-out",
@@ -51822,31 +52182,31 @@ function ensureGitignoreEntry(worldClonePath) {
   const eol = content.includes("\r\n") ? "\r\n" : "\n";
   const needsLeadingNewline = content.length > 0 && !content.endsWith(eol);
   const block = `${needsLeadingNewline ? eol : ""}${eol}# olam-kg-service: per-world KG overlay (Phase B1)${eol}graphify-out/${eol}`;
-  fs49.appendFileSync(gitignorePath, block, "utf-8");
+  fs51.appendFileSync(gitignorePath, block, "utf-8");
   return "appended";
 }
 function createWorldOverlay(opts) {
   const pristineRoot = kgPristinePath(opts.workspace);
-  const pristinePath = path48.join(pristineRoot, "graphify-out");
-  if (!fs49.existsSync(pristinePath)) {
+  const pristinePath = path50.join(pristineRoot, "graphify-out");
+  if (!fs51.existsSync(pristinePath)) {
     throw new KgOverlayError(`Pristine KG for workspace ${JSON.stringify(opts.workspace)} not found at ${pristinePath}. Run \`olam kg build ${opts.workspace}\` first.`);
   }
-  if (!path48.isAbsolute(opts.worldClonePath)) {
+  if (!path50.isAbsolute(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath must be absolute (got ${opts.worldClonePath})`);
   }
-  if (!fs49.existsSync(opts.worldClonePath)) {
+  if (!fs51.existsSync(opts.worldClonePath)) {
     throw new KgOverlayError(`worldClonePath does not exist: ${opts.worldClonePath}. Create the clone before reflinking.`);
   }
-  const overlayPath = path48.join(opts.worldClonePath, "graphify-out");
-  if (fs49.existsSync(overlayPath)) {
-    fs49.rmSync(overlayPath, { recursive: true, force: true });
+  const overlayPath = path50.join(opts.worldClonePath, "graphify-out");
+  if (fs51.existsSync(overlayPath)) {
+    fs51.rmSync(overlayPath, { recursive: true, force: true });
   }
   const useReflink = process.platform === "darwin";
   let strategy;
   let reflinkError;
   if (useReflink) {
     try {
-      execFileSync5("cp", ["-c", "-r", pristinePath, opts.worldClonePath], {
+      execFileSync6("cp", ["-c", "-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
       });
       strategy = "cp-c-r-reflink";
@@ -51857,9 +52217,9 @@ function createWorldOverlay(opts) {
   } else {
     strategy = "cp-r";
   }
-  if (strategy === "cp-r" || !fs49.existsSync(overlayPath)) {
+  if (strategy === "cp-r" || !fs51.existsSync(overlayPath)) {
     try {
-      execFileSync5("cp", ["-r", pristinePath, opts.worldClonePath], {
+      execFileSync6("cp", ["-r", pristinePath, opts.worldClonePath], {
         stdio: ["ignore", "ignore", "pipe"]
       });
       strategy = "cp-r";
@@ -51869,7 +52229,7 @@ function createWorldOverlay(opts) {
       throw new KgOverlayError(`cp -r failed: ${msg}${reflinkMsg}`);
     }
   }
-  if (!fs49.existsSync(overlayPath)) {
+  if (!fs51.existsSync(overlayPath)) {
     throw new KgOverlayError(`Overlay creation produced no ${overlayPath} after cp \u2014 filesystem returned without error?`);
   }
   const gitignoreAction = ensureGitignoreEntry(opts.worldClonePath);
@@ -51882,13 +52242,13 @@ function createWorldOverlay(opts) {
 }
 
 // ../core/dist/world/baseline-diff.js
-import { execFileSync as execFileSync6 } from "node:child_process";
-import * as fs50 from "node:fs";
-import * as os30 from "node:os";
-import * as path49 from "node:path";
+import { execFileSync as execFileSync7 } from "node:child_process";
+import * as fs52 from "node:fs";
+import * as os26 from "node:os";
+import * as path51 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
-function expandHome2(p, homedir37) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir37());
+function expandHome2(p, homedir33) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir33());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -51910,11 +52270,11 @@ ${stderr}`;
   return /unknown revision|bad revision|does not have any commits|HEAD'?: ambiguous|Needed a single revision/.test(blob);
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
-  const homedir37 = deps.homedir ?? (() => os30.homedir());
-  const baselineDir = path49.join(workspacePath, ".olam", "baseline");
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync7(cmd, args, opts));
+  const homedir33 = deps.homedir ?? (() => os26.homedir());
+  const baselineDir = path51.join(workspacePath, ".olam", "baseline");
   try {
-    fs50.mkdirSync(baselineDir, { recursive: true });
+    fs52.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -51926,9 +52286,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path49.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir37);
-    if (!fs50.existsSync(repoPath)) {
+    const outPath = path51.join(baselineDir, filename);
+    const repoPath = expandHome2(repo.path, homedir33);
+    if (!fs52.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -51995,7 +52355,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs50.writeFileSync(outPath, content);
+    fs52.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -52003,11 +52363,11 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path49.join(workspacePath, repo.name);
-    if (!fs50.existsSync(worktreePath))
+    const worktreePath = path51.join(workspacePath, repo.name);
+    if (!fs52.existsSync(worktreePath))
       continue;
     try {
-      execFileSync6("git", ["checkout", "--", "."], {
+      execFileSync7("git", ["checkout", "--", "."], {
         cwd: worktreePath,
         stdio: "pipe"
       });
@@ -52034,7 +52394,7 @@ ${stderr.trim()}` : "";
   }
 };
 function captureOperatorDiff(repoPath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync7(cmd, args, opts));
   const unstaged = exec("git", ["diff"], {
     cwd: repoPath,
     encoding: "utf-8",
@@ -52062,22 +52422,22 @@ function extractStderr(err) {
   return typeof raw === "string" ? raw : raw.toString("utf-8");
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
-  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync6(cmd, args, opts));
-  const homedir37 = deps.homedir ?? (() => os30.homedir());
-  const existsSync59 = deps.existsSync ?? ((p) => fs50.existsSync(p));
-  const copyFileSync9 = deps.copyFileSync ?? ((src, dest) => fs50.copyFileSync(src, dest));
+  const exec = deps.exec ?? ((cmd, args, opts) => execFileSync7(cmd, args, opts));
+  const homedir33 = deps.homedir ?? (() => os26.homedir());
+  const existsSync61 = deps.existsSync ?? ((p) => fs52.existsSync(p));
+  const copyFileSync10 = deps.copyFileSync ?? ((src, dest) => fs52.copyFileSync(src, dest));
   const mkdirSync34 = deps.mkdirSync ?? ((dirPath, opts) => {
-    fs50.mkdirSync(dirPath, opts);
+    fs52.mkdirSync(dirPath, opts);
   });
   const plans = [];
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir37);
-    const worktreePath = path49.join(workspacePath, repo.name);
-    if (!existsSync59(repoPath))
+    const repoPath = expandHome2(repo.path, homedir33);
+    const worktreePath = path51.join(workspacePath, repo.name);
+    if (!existsSync61(repoPath))
       continue;
-    if (!existsSync59(worktreePath)) {
+    if (!existsSync61(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -52135,13 +52495,13 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
       }
     }
     for (const rel of plan.diff.untracked) {
-      const src = path49.join(plan.repoPath, rel);
-      const dest = path49.join(plan.worktreePath, rel);
-      if (!existsSync59(src))
+      const src = path51.join(plan.repoPath, rel);
+      const dest = path51.join(plan.worktreePath, rel);
+      if (!existsSync61(src))
         continue;
       try {
-        mkdirSync34(path49.dirname(dest), { recursive: true });
-        copyFileSync9(src, dest);
+        mkdirSync34(path51.dirname(dest), { recursive: true });
+        copyFileSync10(src, dest);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         console.warn(`[carry] ${plan.name}: copy untracked ${rel} failed: ${msg}`);
@@ -52166,8 +52526,8 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs51 from "node:fs";
-import * as path50 from "node:path";
+import * as fs53 from "node:fs";
+import * as path52 from "node:path";
 
 // ../core/dist/world/templates/_generated.js
 var GH_PR_CREATE = '# Creating PRs from inside an Olam world\n\n## The problem\n\nCalling `gh pr create` directly inside an Olam container **hangs forever** on a\nTTY confirmation prompt that the agent cannot answer. This is a known, reproduced issue.\n\n## The fix\n\nAlways use this exact pattern:\n\n```bash\necho y | timeout 30 gh pr create \\\n  --base main \\\n  --head <branch> \\\n  --title "<title>" \\\n  --body-file /tmp/pr-body.md\n```\n\n## Why each part matters\n\n- **`echo y |`** \u2014 answers the "Submit?" confirmation prompt up front so `gh` never pauses.\n- **`timeout 30`** \u2014 hard deadline. If `gh` hangs anyway, the command exits non-zero so the\n  agent can react instead of stalling the world indefinitely.\n- **`--body-file /tmp/pr-body.md`** \u2014 write the PR body to a temp file first. Avoids\n  shell-escaping bugs that occur with `--body "..."` for long or multi-line bodies.\n- **`--head` and `--base` explicitly** \u2014 removes all interactive prompts; `gh` has nothing to ask.\n\n## Troubleshooting\n\n**"no commits" or "branch not found" error:**\n\n```bash\ngit push -u origin <branch>\n# then retry:\necho y | timeout 30 gh pr create --base main --head <branch> --title "..." --body-file /tmp/pr-body.md\n```\n\n**Timeout exceeded (command exits 124):**\n\n- Check if the branch was pushed: `git log origin/<branch> --oneline -1`\n- Check GitHub CLI auth: `gh auth status`\n- Retry once; if it hangs again, open the PR via the GitHub web UI.\n';
@@ -52177,10 +52537,10 @@ var WORLD_CLAUDE_MD = '# Olam World: {{worldName}}\n\n{{taskBlock}}\n\n## Enviro
 // ../core/dist/world/context-injection.js
 function injectWorldContext(opts) {
   const { world } = opts;
-  const claudeDir2 = path50.join(world.workspacePath, ".claude");
-  fs51.mkdirSync(claudeDir2, { recursive: true });
+  const claudeDir3 = path52.join(world.workspacePath, ".claude");
+  fs53.mkdirSync(claudeDir3, { recursive: true });
   const content = WORLD_CLAUDE_MD.replace("{{worldName}}", world.name).replace("{{worldId}}", world.id).replace("{{branch}}", world.branch).replace("{{taskBlock}}", buildTaskBlock(opts)).replace("{{reposList}}", buildReposList(world)).replace("{{servicesLine}}", buildServicesLine(opts.services)).replace("{{pleriPlaneLine}}", buildPleriPlaneLine(opts.pleriPlaneUrl)).replace("{{planFileBlock}}", buildPlanFileBlock(world)).replace("{{extraContextBlock}}", buildExtraContextBlock(opts.claudeMdExtra));
-  fs51.writeFileSync(path50.join(claudeDir2, "CLAUDE.md"), content);
+  fs53.writeFileSync(path52.join(claudeDir3, "CLAUDE.md"), content);
   writeOlamDocs(world.workspacePath);
 }
 function buildTaskBlock(opts) {
@@ -52254,10 +52614,10 @@ function buildExtraContextBlock(extra) {
 ${extra}`;
 }
 function writeOlamDocs(workspacePath) {
-  const docsDir = path50.join(workspacePath, ".olam", "docs");
-  fs51.mkdirSync(docsDir, { recursive: true });
-  fs51.writeFileSync(path50.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
-  fs51.writeFileSync(path50.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
+  const docsDir = path52.join(workspacePath, ".olam", "docs");
+  fs53.mkdirSync(docsDir, { recursive: true });
+  fs53.writeFileSync(path52.join(docsDir, "gh-pr-create.md"), GH_PR_CREATE);
+  fs53.writeFileSync(path52.join(docsDir, "lane-orchestration.md"), LANE_ORCHESTRATION);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -52271,9 +52631,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path50.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path52.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs51.existsSync(plansDir) && fs51.readdirSync(plansDir).length > 0;
+    return fs53.existsSync(plansDir) && fs53.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -52842,25 +53202,25 @@ init_repo_manifest();
 
 // ../core/dist/world/snapshot.js
 import * as crypto7 from "node:crypto";
-import * as fs52 from "node:fs";
-import * as os31 from "node:os";
-import * as path51 from "node:path";
-import { execFileSync as execFileSync7, spawn as spawn5 } from "node:child_process";
+import * as fs54 from "node:fs";
+import * as os27 from "node:os";
+import * as path53 from "node:path";
+import { execFileSync as execFileSync8, spawn as spawn5 } from "node:child_process";
 import { gunzipSync } from "node:zlib";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path51.join(os31.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path53.join(os27.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDirByWorkspace(workspace, arch, kind) {
-  return path51.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
+  return path53.join(snapshotsDir(), "by-workspace", workspace, arch, kind);
 }
 function cleanupLegacyByWorldDir(worldId) {
-  const legacyDir = path51.join(snapshotsDir(), worldId);
+  const legacyDir = path53.join(snapshotsDir(), worldId);
   if (worldId === "by-workspace")
     return;
-  if (!fs52.existsSync(legacyDir))
+  if (!fs54.existsSync(legacyDir))
     return;
   try {
-    fs52.rmSync(legacyDir, { recursive: true, force: true });
+    fs54.rmSync(legacyDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -52879,11 +53239,11 @@ function hashBuffers(entries) {
   return hash2.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir, imageDigest) {
-  const lockfile = path51.join(repoDir, "Gemfile.lock");
-  if (!fs52.existsSync(lockfile))
+  const lockfile = path53.join(repoDir, "Gemfile.lock");
+  if (!fs54.existsSync(lockfile))
     return null;
   const entries = [
-    { path: "Gemfile.lock", content: fs52.readFileSync(lockfile) }
+    { path: "Gemfile.lock", content: fs54.readFileSync(lockfile) }
   ];
   if (imageDigest) {
     entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -52893,10 +53253,10 @@ function computeGemsFingerprint(repoDir, imageDigest) {
 function computeNodeFingerprint(repoDir, imageDigest) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path51.join(repoDir, name);
-    if (fs52.existsSync(lockfile)) {
+    const lockfile = path53.join(repoDir, name);
+    if (fs54.existsSync(lockfile)) {
       const entries = [
-        { path: name, content: fs52.readFileSync(lockfile) }
+        { path: name, content: fs54.readFileSync(lockfile) }
       ];
       if (imageDigest) {
         entries.push({ path: "__image_digest__", content: Buffer.from(imageDigest, "utf-8") });
@@ -52915,18 +53275,18 @@ function unpackTarballAtomic(srcPath, destDir) {
       detail: validation.detail ?? `unsafe entry: ${validation.unsafePath}`
     };
   }
-  const parent = path51.dirname(destDir);
-  fs52.mkdirSync(parent, { recursive: true });
+  const parent = path53.dirname(destDir);
+  fs54.mkdirSync(parent, { recursive: true });
   const tmpSuffix = `.tmp-${process.pid}-${crypto7.randomBytes(4).toString("hex")}`;
   const tmpDir = `${destDir}${tmpSuffix}`;
   try {
-    fs52.mkdirSync(tmpDir, { recursive: true });
-    execFileSync7("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
-    fs52.renameSync(tmpDir, destDir);
+    fs54.mkdirSync(tmpDir, { recursive: true });
+    execFileSync8("tar", ["-xzf", srcPath, "-C", tmpDir], { stdio: "pipe" });
+    fs54.renameSync(tmpDir, destDir);
     return { ok: true, entryCount: validation.entries.length };
   } catch (err) {
     try {
-      fs52.rmSync(tmpDir, { recursive: true, force: true });
+      fs54.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     return {
@@ -52937,12 +53297,12 @@ function unpackTarballAtomic(srcPath, destDir) {
   }
 }
 function resolvesWithin(base, target) {
-  const resolved = path51.resolve(base, target);
-  const baseResolved = path51.resolve(base);
-  const rel = path51.relative(baseResolved, resolved);
+  const resolved = path53.resolve(base, target);
+  const baseResolved = path53.resolve(base);
+  const rel = path53.relative(baseResolved, resolved);
   if (rel === "")
     return true;
-  return !rel.startsWith("..") && !path51.isAbsolute(rel);
+  return !rel.startsWith("..") && !path53.isAbsolute(rel);
 }
 var TYPE_CHAR_TO_TYPE = {
   "-": "file",
@@ -52992,7 +53352,7 @@ function parseTarListLine(line) {
 function validateHardlinksBinary(tarPath, targetDir) {
   let raw;
   try {
-    raw = gunzipSync(fs52.readFileSync(tarPath));
+    raw = gunzipSync(fs54.readFileSync(tarPath));
   } catch {
     return null;
   }
@@ -53007,7 +53367,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
       const name = block.subarray(0, nameNull >= 0 && nameNull <= 99 ? nameNull : 100).toString("utf-8");
       const linkNull = block.indexOf(0, 157);
       const linkname = block.subarray(157, linkNull >= 157 && linkNull <= 256 ? linkNull : 257).toString("utf-8");
-      if (linkname && (path51.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
+      if (linkname && (path53.isAbsolute(linkname) || !resolvesWithin(targetDir, linkname))) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -53025,7 +53385,7 @@ function validateHardlinksBinary(tarPath, targetDir) {
 function enumerateAndValidateTarballEntries(tarPath, targetDir) {
   let raw;
   try {
-    raw = execFileSync7("tar", ["-tvf", tarPath], {
+    raw = execFileSync8("tar", ["-tvf", tarPath], {
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
       encoding: "utf-8",
@@ -53045,7 +53405,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
     const entry = parseTarListLine(line);
     if (!entry)
       continue;
-    if (path51.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
+    if (path53.isAbsolute(entry.name) || !resolvesWithin(targetDir, entry.name)) {
       return {
         valid: false,
         reason: "path-traversal",
@@ -53053,8 +53413,8 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       };
     }
     if (entry.type === "symlink" && entry.linkname !== void 0) {
-      const symlinkParent = path51.join(targetDir, path51.dirname(entry.name));
-      if (path51.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path51.join(path51.dirname(entry.name), entry.linkname))) {
+      const symlinkParent = path53.join(targetDir, path53.dirname(entry.name));
+      if (path53.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, path53.join(path53.dirname(entry.name), entry.linkname))) {
         return {
           valid: false,
           reason: "symlink-escape",
@@ -53064,7 +53424,7 @@ function enumerateAndValidateTarballEntries(tarPath, targetDir) {
       }
     }
     if (entry.type === "hardlink" && entry.linkname !== void 0) {
-      if (path51.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
+      if (path53.isAbsolute(entry.linkname) || !resolvesWithin(targetDir, entry.linkname)) {
         return {
           valid: false,
           reason: "hardlink-escape",
@@ -53097,8 +53457,8 @@ function restoreSnapshotsForRepos(input) {
       }
       const archDir = snapshotKindDirByWorkspace(input.workspace, input.arch, kind);
       const tarFilename = `${repo.name}-${input.arch}-${fingerprint}.tar.gz`;
-      const tarPath = path51.join(archDir, tarFilename);
-      if (!fs52.existsSync(tarPath)) {
+      const tarPath = path53.join(archDir, tarFilename);
+      if (!fs54.existsSync(tarPath)) {
         outcomes.push({ repo: repo.name, kind, outcome: "miss", reason: "no-tarball", fingerprint });
         continue;
       }
@@ -53113,9 +53473,9 @@ function restoreSnapshotsForRepos(input) {
         });
         continue;
       }
-      const targetDir = path51.join(repo.worktreeDir, targetSubpath);
+      const targetDir = path53.join(repo.worktreeDir, targetSubpath);
       try {
-        fs52.rmSync(targetDir, { recursive: true, force: true });
+        fs54.rmSync(targetDir, { recursive: true, force: true });
       } catch {
       }
       const result = unpackTarballAtomic(tarPath, targetDir);
@@ -53128,8 +53488,8 @@ function restoreSnapshotsForRepos(input) {
           fingerprint
         });
         try {
-          fs52.rmSync(tarPath, { force: true });
-          fs52.rmSync(manifestPath(tarPath), { force: true });
+          fs54.rmSync(tarPath, { force: true });
+          fs54.rmSync(manifestPath(tarPath), { force: true });
         } catch {
         }
         continue;
@@ -53145,10 +53505,10 @@ function restoreSnapshotsForRepos(input) {
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs52.existsSync(mPath))
+  if (!fs54.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs52.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs54.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
@@ -53163,17 +53523,17 @@ function isPidAlive(pid) {
   }
 }
 function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
-  fs52.mkdirSync(dir, { recursive: true });
-  const lockPath = path51.join(dir, EVICT_LOCK_FILENAME);
+  fs54.mkdirSync(dir, { recursive: true });
+  const lockPath = path53.join(dir, EVICT_LOCK_FILENAME);
   let fd;
   try {
-    fd = fs52.openSync(lockPath, fs52.constants.O_WRONLY | fs52.constants.O_CREAT | fs52.constants.O_EXCL, 384);
+    fd = fs54.openSync(lockPath, fs54.constants.O_WRONLY | fs54.constants.O_CREAT | fs54.constants.O_EXCL, 384);
   } catch (err) {
     if (err.code !== "EEXIST")
       return 0;
     let holderPid = null;
     try {
-      holderPid = parseInt(fs52.readFileSync(lockPath, "utf-8").trim(), 10);
+      holderPid = parseInt(fs54.readFileSync(lockPath, "utf-8").trim(), 10);
     } catch {
       holderPid = null;
     }
@@ -53181,23 +53541,23 @@ function evictOldSnapshotsWithFlock(maxBytes, dir = snapshotsDir()) {
       return 0;
     }
     try {
-      fs52.unlinkSync(lockPath);
-      fd = fs52.openSync(lockPath, fs52.constants.O_WRONLY | fs52.constants.O_CREAT | fs52.constants.O_EXCL, 384);
+      fs54.unlinkSync(lockPath);
+      fd = fs54.openSync(lockPath, fs54.constants.O_WRONLY | fs54.constants.O_CREAT | fs54.constants.O_EXCL, 384);
     } catch {
       return 0;
     }
   }
   try {
-    fs52.writeSync(fd, `${process.pid}
+    fs54.writeSync(fd, `${process.pid}
 `);
   } finally {
-    fs52.closeSync(fd);
+    fs54.closeSync(fd);
   }
   try {
     return evictOldSnapshots(maxBytes, dir);
   } finally {
     try {
-      fs52.unlinkSync(lockPath);
+      fs54.unlinkSync(lockPath);
     } catch {
     }
   }
@@ -53230,16 +53590,16 @@ function spawnAutoCapture(worldId, olamBin = "olam") {
   }
 }
 function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
-  if (!fs52.existsSync(dir))
+  if (!fs54.existsSync(dir))
     return 0;
   const allTars = [];
   const walk = (d) => {
-    for (const entry of fs52.readdirSync(d, { withFileTypes: true })) {
-      const full = path51.join(d, entry.name);
+    for (const entry of fs54.readdirSync(d, { withFileTypes: true })) {
+      const full = path53.join(d, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".tar.gz")) {
-        const stat2 = fs52.statSync(full);
+        const stat2 = fs54.statSync(full);
         allTars.push({ path: full, size: stat2.size, mtime: stat2.mtimeMs });
       }
     }
@@ -53254,8 +53614,8 @@ function evictOldSnapshots(maxBytes, dir = snapshotsDir()) {
   for (const tar of allTars) {
     if (remaining <= maxBytes)
       break;
-    fs52.rmSync(tar.path, { force: true });
-    fs52.rmSync(manifestPath(tar.path), { force: true });
+    fs54.rmSync(tar.path, { force: true });
+    fs54.rmSync(manifestPath(tar.path), { force: true });
     freed += tar.size;
     remaining -= tar.size;
   }
@@ -53372,14 +53732,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 
 // ../core/dist/world/olam-yaml.js
 init_repo_manifest();
-import * as path52 from "node:path";
+import * as path54 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path52.join(workspacePath, repo.name);
+    const repoDir = path54.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -53394,8 +53754,8 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs53 from "node:fs";
-import * as path53 from "node:path";
+import * as fs55 from "node:fs";
+import * as path55 from "node:path";
 import { parse as parseYaml5 } from "yaml";
 function parseFrontmatter2(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -53415,20 +53775,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path53.join(workspaceRoot, ".olam", "policies");
-  if (!fs53.existsSync(policiesDir))
+  const policiesDir = path55.join(workspaceRoot, ".olam", "policies");
+  if (!fs55.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs53.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs55.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file2 of files) {
-    const filePath = path53.join(policiesDir, file2);
+    const filePath = path55.join(policiesDir, file2);
     try {
-      const content = fs53.readFileSync(filePath, "utf8");
+      const content = fs55.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter2(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file2}: no valid frontmatter block`);
@@ -53572,9 +53932,9 @@ async function autoDispatchTask(opts) {
 }
 
 // ../core/dist/world/wiki-injection-loader.js
-import * as fs54 from "node:fs";
-import * as os32 from "node:os";
-import * as path54 from "node:path";
+import * as fs56 from "node:fs";
+import * as os28 from "node:os";
+import * as path56 from "node:path";
 var WIKI_INJECTION_FLAG = "OLAM_WIKI_INJECTION";
 var WIKI_PATH_ENV = "OLAM_WIKI_PATH";
 function flagEnabled(value) {
@@ -53587,14 +53947,14 @@ function wikiBlobPath() {
   const override = process.env[WIKI_PATH_ENV];
   if (override && override.length > 0)
     return override;
-  return path54.join(os32.homedir(), ".olam", "wiki.json");
+  return path56.join(os28.homedir(), ".olam", "wiki.json");
 }
 function defaultReadBlob() {
   const p = wikiBlobPath();
   try {
-    if (!fs54.existsSync(p))
+    if (!fs56.existsSync(p))
       return null;
-    return fs54.readFileSync(p, "utf8");
+    return fs56.readFileSync(p, "utf8");
   } catch {
     return null;
   }
@@ -53633,12 +53993,12 @@ init_store2();
 init_bridge();
 
 // ../core/dist/global-config/runbook-resolver.js
-import * as fs55 from "node:fs";
-import * as os33 from "node:os";
-import * as path55 from "node:path";
+import * as fs57 from "node:fs";
+import * as os29 from "node:os";
+import * as path57 from "node:path";
 function expandTilde(p) {
   if (p === "~" || p.startsWith("~/")) {
-    return path55.join(os33.homedir(), p.slice(1));
+    return path57.join(os29.homedir(), p.slice(1));
   }
   return p;
 }
@@ -53650,7 +54010,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs55.existsSync(resolvedPath)) {
+    if (!fs57.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -53666,19 +54026,19 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
 init_port_validator();
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs56 from "node:fs";
-import * as path56 from "node:path";
+import * as fs58 from "node:fs";
+import * as path58 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
     return;
   for (const seed of seeds) {
     if (seed.type !== "fixture-copy")
       continue;
-    const srcAbs = path56.resolve(workspacePath, seed.repo, seed.src);
-    const destAbs = path56.resolve(workspacePath, seed.repo, seed.dest);
-    const destDir = path56.dirname(destAbs);
-    fs56.mkdirSync(destDir, { recursive: true });
-    fs56.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    const srcAbs = path58.resolve(workspacePath, seed.repo, seed.src);
+    const destAbs = path58.resolve(workspacePath, seed.repo, seed.dest);
+    const destDir = path58.dirname(destAbs);
+    fs58.mkdirSync(destDir, { recursive: true });
+    fs58.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -54381,7 +54741,7 @@ ${detail}`);
       runbookSeeds = resolved.seeds;
     }
     const worldId = generateWorldId();
-    const workspacePath = path57.join(os34.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path59.join(os30.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = await this.resolveReposWithWorkspace(opts);
@@ -54463,38 +54823,38 @@ ${detail}`);
     for (const repo of repos) {
       if (!repo.path)
         continue;
-      const sourceRoot = repo.path.replace(/^~/, os34.homedir());
-      const worktreeRoot = path57.join(workspacePath, repo.name);
-      if (!fs57.existsSync(sourceRoot) || !fs57.existsSync(worktreeRoot))
+      const sourceRoot = repo.path.replace(/^~/, os30.homedir());
+      const worktreeRoot = path59.join(workspacePath, repo.name);
+      if (!fs59.existsSync(sourceRoot) || !fs59.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path57.dirname(pattern), path57.basename(pattern)];
-          const sourceDir = path57.join(sourceRoot, dir);
-          if (fs57.existsSync(sourceDir)) {
+          const [dir, glob] = [path59.dirname(pattern), path59.basename(pattern)];
+          const sourceDir = path59.join(sourceRoot, dir);
+          if (fs59.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs57.readdirSync(sourceDir)) {
+              for (const entry of fs59.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path57.join(dir, entry));
+                  matches2.push(path59.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs57.existsSync(path57.join(sourceRoot, pattern))) {
+        } else if (fs59.existsSync(path59.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path57.join(sourceRoot, rel);
-          const dst = path57.join(worktreeRoot, rel);
+          const src = path59.join(sourceRoot, rel);
+          const dst = path59.join(worktreeRoot, rel);
           try {
-            const st = fs57.statSync(src);
+            const st = fs59.statSync(src);
             if (!st.isFile())
               continue;
-            fs57.mkdirSync(path57.dirname(dst), { recursive: true });
-            fs57.copyFileSync(src, dst);
+            fs59.mkdirSync(path59.dirname(dst), { recursive: true });
+            fs59.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -54580,7 +54940,7 @@ ${detail}`);
     }
     const overlayAttachments = [];
     for (const repo of repos) {
-      const worldClonePath = path57.join(workspacePath, repo.name);
+      const worldClonePath = path59.join(workspacePath, repo.name);
       try {
         const result = createWorldOverlay({
           workspace: repo.name,
@@ -54635,7 +54995,7 @@ ${detail}`);
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path57.join(workspacePath, repo.name);
+          const repoDir = path59.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -54679,10 +55039,10 @@ ${detail}`);
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path57.join(os34.homedir(), ".olam", "r2-credentials.json");
-      if (fs57.existsSync(r2CredsPath)) {
+      const r2CredsPath = path59.join(os30.homedir(), ".olam", "r2-credentials.json");
+      if (fs59.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs57.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs59.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -54699,10 +55059,10 @@ ${detail}`);
         } catch {
         }
       }
-      const keysYamlPath = path57.join(os34.homedir(), ".olam", "keys.yaml");
-      if (fs57.existsSync(keysYamlPath)) {
+      const keysYamlPath = path59.join(os30.homedir(), ".olam", "keys.yaml");
+      if (fs59.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs57.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs59.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const { default: YAML3 } = await import("yaml");
             const parsed = YAML3.parse(keysRaw);
@@ -54762,10 +55122,10 @@ ${detail}`);
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path57.join(workspacePath, repoName, relativePath);
+          const absPath = path59.join(workspacePath, repoName, relativePath);
           try {
-            fs57.mkdirSync(path57.dirname(absPath), { recursive: true });
-            fs57.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs59.mkdirSync(path59.dirname(absPath), { recursive: true });
+            fs59.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -54942,7 +55302,7 @@ ${detail}`);
         imageDigest: void 0,
         repos: enrichedRepos.map((r) => ({
           name: r.name,
-          worktreeDir: path57.join(workspacePath, r.name)
+          worktreeDir: path59.join(workspacePath, r.name)
         }))
       });
       for (const out of restoreResult.outcomes) {
@@ -55048,7 +55408,7 @@ ${detail}`);
     }
     if (opts.task) {
       const allPolicies = repos.flatMap((repo) => {
-        const repoWorktree = path57.join(workspacePath, repo.name);
+        const repoWorktree = path59.join(workspacePath, repo.name);
         try {
           return loadPolicies(repoWorktree);
         } catch (err) {
@@ -55061,8 +55421,8 @@ ${detail}`);
         try {
           execSync6(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
           for (const repo of repos) {
-            const policiesDir = path57.join(workspacePath, repo.name, ".olam", "policies");
-            if (fs57.existsSync(policiesDir)) {
+            const policiesDir = path59.join(workspacePath, repo.name, ".olam", "policies");
+            if (fs59.existsSync(policiesDir)) {
               execSync6(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
             }
           }
@@ -55172,8 +55532,8 @@ ${detail}`);
     } catch {
     }
     try {
-      fs57.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs57.existsSync(world.workspacePath)) {
+      fs59.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs59.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -55283,14 +55643,14 @@ ${detail}`);
     }).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs57.readFileSync(planFilePath, "utf-8");
-    const planFileName = path57.basename(planFilePath);
+    const planContent = fs59.readFileSync(planFilePath, "utf-8");
+    const planFileName = path59.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path57.join(workspacePath, targetRepo, "docs", "plans");
-    fs57.mkdirSync(plansDir, { recursive: true });
-    fs57.writeFileSync(path57.join(plansDir, planFileName), planContent);
+    const plansDir = path59.join(workspacePath, targetRepo, "docs", "plans");
+    fs59.mkdirSync(plansDir, { recursive: true });
+    fs59.writeFileSync(path59.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -55754,8 +56114,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs58 from "node:fs";
-import * as path58 from "node:path";
+import * as fs60 from "node:fs";
+import * as path60 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -56090,7 +56450,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs58.existsSync(dbPath))
+  if (!fs60.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -56261,13 +56621,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port: port2, registry: registry2 } = opts;
-  const thisDir = path58.dirname(fileURLToPath4(import.meta.url));
-  const defaultPublicDir = path58.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path60.dirname(fileURLToPath4(import.meta.url));
+  const defaultPublicDir = path60.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs58.existsSync(publicDir);
+  let hasPublicDir = fs60.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs58.existsSync(publicDir);
+      hasPublicDir = fs60.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port2}`;
     const url3 = new URL(req.url ?? "/", `http://${host}`);
@@ -56541,22 +56901,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path58.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path60.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs58.existsSync(filePath) && fs58.statSync(filePath).isFile()) {
-      const ext = path58.extname(filePath);
+    if (fs60.existsSync(filePath) && fs60.statSync(filePath).isFile()) {
+      const ext = path60.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs58.createReadStream(filePath).pipe(res);
+      fs60.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path58.join(publicDir, "index.html");
-    if (fs58.existsSync(filePath)) {
+    filePath = path60.join(publicDir, "index.html");
+    if (fs60.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs58.createReadStream(filePath).pipe(res);
+      fs60.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -56566,17 +56926,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs59 from "node:fs";
-import * as os35 from "node:os";
-import * as path59 from "node:path";
-var STATE_PATH = path59.join(os35.homedir(), ".olam", "dashboard.json");
+import * as fs61 from "node:fs";
+import * as os31 from "node:os";
+import * as path61 from "node:path";
+var STATE_PATH = path61.join(os31.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs59.mkdirSync(path59.dirname(STATE_PATH), { recursive: true });
-  fs59.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs61.mkdirSync(path61.dirname(STATE_PATH), { recursive: true });
+  fs61.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs59.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs61.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -56584,7 +56944,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs59.unlinkSync(STATE_PATH);
+    fs61.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -56864,8 +57224,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync46, existsSync as existsSync58, statSync as statSync14 } from "node:fs";
-import { join as join62, dirname as dirname31, resolve as resolve15 } from "node:path";
+import { readFileSync as readFileSync47, existsSync as existsSync60, statSync as statSync16 } from "node:fs";
+import { join as join65, dirname as dirname31, resolve as resolve15 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -56877,12 +57237,12 @@ function findProjectRoot2(startDir) {
   const root = resolve15("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync58(join62(dir, marker))) return dir;
+      if (existsSync60(join65(dir, marker))) return dir;
     }
-    const pkg = join62(dir, "package.json");
-    if (existsSync58(pkg)) {
+    const pkg = join65(dir, "package.json");
+    if (existsSync60(pkg)) {
       try {
-        const json2 = JSON.parse(readFileSync46(pkg, "utf8"));
+        const json2 = JSON.parse(readFileSync47(pkg, "utf8"));
         const isOlamWorkspace = typeof json2.name === "string" && json2.name.startsWith("@olam/");
         const hasOlamDep = json2.dependencies && Object.keys(json2.dependencies).some((k) => k.startsWith("@olam/")) || json2.devDependencies && Object.keys(json2.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
@@ -56894,9 +57254,9 @@ function findProjectRoot2(startDir) {
     dir = parent;
   }
 }
-function parseEnvFile(path60) {
+function parseEnvFile(path62) {
   const out = {};
-  const raw = readFileSync46(path60, "utf8");
+  const raw = readFileSync47(path62, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -56919,8 +57279,8 @@ function loadProjectEnv(startDir = process.cwd()) {
   const filesRead = [];
   const merged = {};
   for (const name of [".env", ".env.local"]) {
-    const p = join62(root, name);
-    if (existsSync58(p) && statSync14(p).isFile()) {
+    const p = join65(root, name);
+    if (existsSync60(p) && statSync16(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }