@pleri/olam-cli 0.1.206 → 0.1.208

package/hermes-bundle/version.json

@@ -1,4 +1,4 @@
 {
-  "bundledAt": "2026-06-02T12:45:34.001Z",
+  "bundledAt": "2026-06-03T04:32:31.735Z",
   "kgFirstSha": "29a9ccce1b115d049e375c4a90eb5cf7c123e610e2d0590270a4db2cdbc64a28"
 }

package/host-cp/k8s/manifests/50-deployment.yaml

@@ -118,7 +118,7 @@ spec:
         # k3d), started by `olam upgrade` Step 0.7 — not inside this Pod.
       containers:
         - name: olam-host-cp
-          image: ghcr.io/pleri/olam-host-cp@sha256:f11d34247171fba77439e3877ba8b781b857d1eb3f1c983bac2621dd7a254fef
+          image: ghcr.io/pleri/olam-host-cp@sha256:ddeb5b82c7a1d72d78070b299ea2266683e71ff832c5b399fe25ba28f2285d6f
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/auth-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-auth-service
-          image: ghcr.io/pleri/olam-auth@sha256:10879610c8930d06e2201171ca98249da756461fbbca7540face7593de3f2516
+          image: ghcr.io/pleri/olam-auth@sha256:238ef8b58198684f84ea7c2bf91b23a3ac216660a40f8ef6b4db11c83e555b3a
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/kg-service/50-deployment.yaml

@@ -61,7 +61,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-kg-service
-          image: ghcr.io/pleri/olam-kg-service@sha256:4fc5f7257d2fa8e11c07e5436a68edd0353c0d503739b9e90f7736e5b336a8fa
+          image: ghcr.io/pleri/olam-kg-service@sha256:8fa1ef59a27f9295b7f7375ccda8e1efa110c9a309603301c073076e919e35c3
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/mcp-auth-service/50-deployment.yaml

@@ -68,7 +68,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-mcp-auth-service
-          image: ghcr.io/pleri/olam-mcp-auth@sha256:0780d597d7eb7d124eb998cf8e56649e375a594e4181ddb181f8b1cb2d443701
+          image: ghcr.io/pleri/olam-mcp-auth@sha256:56964905f2da39c19f462b5e5f5f84e74a930c9a70a4518463606ce91276272b
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/memory-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
           # bootstrap-placeholder comment + run `npm run refresh:manifest-digests`
           # once ghcr.io/pleri/olam-memory-service has a real published digest.
           # bootstrap-placeholder: pre-publish; refresh after first release
-          image: ghcr.io/pleri/olam-memory-service@sha256:4b2742280eb0437e3865e603d1d148e28408a1ec8aa4a7dd2c726cd3d31ee8dd
+          image: ghcr.io/pleri/olam-memory-service@sha256:581f763fcdc2e7e056c805883efa5e510ce460c6c2096445a909f35fcb38f04b
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/memory-hooks/agentmemory-classify-queue.mjs

@@ -60,6 +60,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { isAgentMemoryEnabled } from './agent-memory-gate.mjs';
 
 /** Max bytes of captured text persisted per candidate. Keeps queue files small. */
 export const MAX_CAPTURED_CHARS = 4000;
@@ -315,6 +316,9 @@ function readContentField(obj) {
 }
 
 async function main() {
+  // Gate: memory is off by default — exit silently when not enabled.
+  if (!isAgentMemoryEnabled()) return;
+
   let event = {};
   try {
     event = JSON.parse(readFileSync(0, 'utf-8'));

package/memory-hooks/agentmemory-recall-trigger.mjs

@@ -33,6 +33,7 @@ import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isAgentMemoryEnabled } from './agent-memory-gate.mjs';
 
 // Built-in tool-event filter: only fire on tool calls where recall has
 // signal. Bash + Edit + MultiEdit + Read on substantive paths qualify;
@@ -190,6 +191,9 @@ export function formatAdditionalContext(response, prompt) {
 }
 
 async function main() {
+  // Gate: memory is off by default — exit silently when not enabled.
+  if (!isAgentMemoryEnabled()) return;
+
   let event = {};
   try {
     event = JSON.parse(readFileSync(0, 'utf-8'));

package/memory-hooks/agentmemory-save.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+/**
+ * agentmemory-save.mjs — PostToolUse hook: persist agent-written memory notes.
+ *
+ * AM_SENTINEL=olam-agent-memory-hook-v2
+ *
+ * This is the FILE-BASED port of the legacy inline python SAVE blob that used
+ * to live directly in ~/.claude/settings.json under
+ * `AM_SENTINEL=olam-agent-memory-hook-v1; python3 -c '…'`. The installer
+ * (`olam hooks install-all`, invoked by `olam skills sync`) copies this file to
+ * ~/.claude/scripts/hooks/ and registers a settings.json entry pointing at it,
+ * REPLACING the inline blob. Keeping the logic in a real source file means it
+ * is version-controlled, testable, bundled into @pleri/olam-cli, and owned by
+ * sync — not stranded as a string in the operator's settings.
+ *
+ * Behaviour (byte-faithful port of the v1 blob):
+ *   - Reads the PostToolUse JSON payload from stdin.
+ *   - Acts ONLY when tool_name === "Write" AND the written file_path matches
+ *     /\/\.claude\/projects\/.*\/memory\/.*\.md$/ ; otherwise bails (exit 0).
+ *   - Requires OLAM_AGENT_MEMORY_BEARER (trimmed, non-empty); else bails.
+ *   - Parses YAML-ish frontmatter delimited by leading "---":
+ *       description: → title (default "memory")   ← keyed on description, per v1
+ *       type:        → type  (default "fact")
+ *       remainder    → body
+ *   - POSTs {title, content: body, type} to
+ *       <OLAM_AGENT_MEMORY_URL|default>/agentmemory/remember
+ *     with Authorization: Bearer <bearer>, ~3s timeout.
+ *   - On success prints to STDERR the green status line:
+ *       [🧠⇡ Memory saved] "<title first 60 chars>"
+ *   - Fail-open: ANY error → silent, exit 0. Never throws to the caller.
+ *
+ * Node built-ins only (global fetch + AbortController, available on Node ≥18).
+ */
+
+import { readFileSync } from 'node:fs';
+
+const DEFAULT_URL = 'https://atlas-agent-memory.atlas-kitchen.workers.dev';
+const MEMORY_PATH_RE = /\/\.claude\/projects\/.*\/memory\/.*\.md$/;
+const TIMEOUT_MS = 3000;
+
+/** Read all of stdin as a UTF-8 string. */
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Parse leading "---"-delimited frontmatter. Returns {title, type, body}.
+ * Mirrors the v1 blob: title comes from `description:`, type from `type:`.
+ */
+function parseNote(raw) {
+  let title = 'memory';
+  let type = 'fact';
+  let body = raw;
+  if (raw.startsWith('---')) {
+    // Split into [before-first-delim, frontmatter, …rest]. JS's limited split
+    // truncates the remainder, so slice manually to keep the full body.
+    const firstDelimEnd = 3; // length of leading "---"
+    const secondDelim = raw.indexOf('---', firstDelimEnd);
+    if (secondDelim !== -1) {
+      const fm = raw.slice(firstDelimEnd, secondDelim);
+      body = raw.slice(secondDelim + 3).trim();
+      for (const ln of fm.split('\n')) {
+        const s = ln.trim();
+        if (s.startsWith('description:')) {
+          title = stripQuotes(s.slice(s.indexOf(':') + 1).trim());
+        } else if (s.startsWith('type:')) {
+          type = stripQuotes(s.slice(s.indexOf(':') + 1).trim());
+        }
+      }
+    }
+  }
+  return { title, type, body };
+}
+
+function stripQuotes(v) {
+  return v.replace(/^["']/, '').replace(/["']$/, '');
+}
+
+async function main() {
+  const payloadRaw = readStdin();
+  let payload;
+  try {
+    payload = JSON.parse(payloadRaw);
+  } catch {
+    return; // not parseable → fail-open
+  }
+
+  const toolName = payload?.tool_name ?? '';
+  const filePath = payload?.tool_input?.file_path ?? '';
+  if (toolName !== 'Write' || !MEMORY_PATH_RE.test(filePath)) return;
+
+  const bearer = (process.env['OLAM_AGENT_MEMORY_BEARER'] ?? '').trim();
+  if (!bearer) return;
+
+  let raw;
+  try {
+    raw = readFileSync(filePath, 'utf8');
+  } catch {
+    return;
+  }
+
+  const { title, type, body } = parseNote(raw);
+  const base = (process.env['OLAM_AGENT_MEMORY_URL'] ?? DEFAULT_URL).replace(/\/$/, '');
+  const url = `${base}/agentmemory/remember`;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const resp = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${bearer}`,
+        'User-Agent': 'olam-agent-memory-hook/2',
+      },
+      body: JSON.stringify({ title, content: body, type }),
+      signal: controller.signal,
+    });
+    // Treat any non-throwing response as delivered (the v1 blob did the same —
+    // it printed on a non-exception urlopen regardless of status code).
+    if (resp) {
+      const label = title.slice(0, 60);
+      process.stderr.write(`\x1b[32m[\u{1F9E0}\u{21E1} Memory saved]\x1b[0m "${label}"\n`);
+    }
+  } catch {
+    // Fail-open: network error / timeout / abort → silent.
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+main().catch(() => {
+  /* fail-open: never propagate to the caller */
+});

package/memory-hooks/agentmemory-session-recall.js

@@ -40,6 +40,30 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 
+// ---------------------------------------------------------------------------
+// Opt-in gate — inline re-implementation of agent-memory-gate.mjs contract
+// (CJS cannot import ESM at the top level; inline ensures same fail-closed
+// semantics without a dynamic import or a build step).
+// ---------------------------------------------------------------------------
+const _GATE_TRUTHY_ENV = new Set(['1', 'true', 'on']);
+const _GATE_TRUTHY_FILE = new Set(['true', '1']);
+function _isAgentMemoryEnabled() {
+  const envVal = process.env['OLAM_AGENT_MEMORY'];
+  if (envVal !== undefined && envVal.length > 0) {
+    return _GATE_TRUTHY_ENV.has(envVal.trim().toLowerCase());
+  }
+  try {
+    const fromEnv = process.env['OLAM_HOME'];
+    const olamHome = (fromEnv && fromEnv.length > 0) ? fromEnv : path.join(os.homedir(), '.olam');
+    const flagPath = path.join(olamHome, 'agent-memory-enabled');
+    const raw = fs.readFileSync(flagPath, 'utf8').trim().toLowerCase();
+    return _GATE_TRUTHY_FILE.has(raw);
+  } catch {
+    return false;
+  }
+}
+// ---------------------------------------------------------------------------
+
 // Resolve the bridge URL: operator env wins, then the `olam memory connect`
 // artifact (~/.olam/memory-connection.json), then the LIVE memory-service
 // Worker. The prior default (olam-agent-memory.ernestcodes.workers.dev) is a
@@ -276,6 +300,9 @@ async function recall(query, limit = 5) {
 }
 
 async function main() {
+  // Gate: memory is off by default — exit silently when not enabled.
+  if (!_isAgentMemoryEnabled()) return;
+
   const raw = require('fs').readFileSync(0, 'utf8');
   let event = {};
   try { event = JSON.parse(raw); } catch (_) {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.206",
+  "version": "0.1.208",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"