@pleri/olam-cli 0.1.207 → 0.1.208

package/hermes-bundle/version.json

@@ -1,4 +1,4 @@
 {
-  "bundledAt": "2026-06-02T16:46:23.219Z",
+  "bundledAt": "2026-06-03T04:32:31.735Z",
   "kgFirstSha": "29a9ccce1b115d049e375c4a90eb5cf7c123e610e2d0590270a4db2cdbc64a28"
 }

package/host-cp/k8s/manifests/50-deployment.yaml

@@ -118,7 +118,7 @@ spec:
         # k3d), started by `olam upgrade` Step 0.7 — not inside this Pod.
       containers:
         - name: olam-host-cp
-          image: ghcr.io/pleri/olam-host-cp@sha256:0d1869ed3c823e6ea1b5d885d2f73d7418134c1b82c9dd70719044fd04d74027
+          image: ghcr.io/pleri/olam-host-cp@sha256:ddeb5b82c7a1d72d78070b299ea2266683e71ff832c5b399fe25ba28f2285d6f
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/auth-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-auth-service
-          image: ghcr.io/pleri/olam-auth@sha256:9f8195a20727ec844d7393696c298b42e3e83e841fe684787ee9c6d1e301b5e8
+          image: ghcr.io/pleri/olam-auth@sha256:238ef8b58198684f84ea7c2bf91b23a3ac216660a40f8ef6b4db11c83e555b3a
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/kg-service/50-deployment.yaml

@@ -61,7 +61,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-kg-service
-          image: ghcr.io/pleri/olam-kg-service@sha256:0b1f78a566675509f371e4e0636a76859f800c1bec787f06742e3a4f116d7c90
+          image: ghcr.io/pleri/olam-kg-service@sha256:8fa1ef59a27f9295b7f7375ccda8e1efa110c9a309603301c073076e919e35c3
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/mcp-auth-service/50-deployment.yaml

@@ -68,7 +68,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-mcp-auth-service
-          image: ghcr.io/pleri/olam-mcp-auth@sha256:63ecc6bdd5c3def600a78046f0e7ab36938e88bc6fc7d31a446d7cec84a27a3a
+          image: ghcr.io/pleri/olam-mcp-auth@sha256:56964905f2da39c19f462b5e5f5f84e74a930c9a70a4518463606ce91276272b
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/memory-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
           # bootstrap-placeholder comment + run `npm run refresh:manifest-digests`
           # once ghcr.io/pleri/olam-memory-service has a real published digest.
           # bootstrap-placeholder: pre-publish; refresh after first release
-          image: ghcr.io/pleri/olam-memory-service@sha256:673156cc638fc9af096e73fc7cd7c666373f92e63e566a57f51271b691aa9d74
+          image: ghcr.io/pleri/olam-memory-service@sha256:581f763fcdc2e7e056c805883efa5e510ce460c6c2096445a909f35fcb38f04b
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/memory-hooks/agentmemory-classify-queue.mjs

@@ -60,6 +60,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { isAgentMemoryEnabled } from './agent-memory-gate.mjs';
 
 /** Max bytes of captured text persisted per candidate. Keeps queue files small. */
 export const MAX_CAPTURED_CHARS = 4000;
@@ -315,6 +316,9 @@ function readContentField(obj) {
 }
 
 async function main() {
+  // Gate: memory is off by default — exit silently when not enabled.
+  if (!isAgentMemoryEnabled()) return;
+
   let event = {};
   try {
     event = JSON.parse(readFileSync(0, 'utf-8'));

package/memory-hooks/agentmemory-recall-trigger.mjs

@@ -33,6 +33,7 @@ import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isAgentMemoryEnabled } from './agent-memory-gate.mjs';
 
 // Built-in tool-event filter: only fire on tool calls where recall has
 // signal. Bash + Edit + MultiEdit + Read on substantive paths qualify;
@@ -190,6 +191,9 @@ export function formatAdditionalContext(response, prompt) {
 }
 
 async function main() {
+  // Gate: memory is off by default — exit silently when not enabled.
+  if (!isAgentMemoryEnabled()) return;
+
   let event = {};
   try {
     event = JSON.parse(readFileSync(0, 'utf-8'));

package/memory-hooks/agentmemory-session-recall.js

@@ -40,6 +40,30 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 
+// ---------------------------------------------------------------------------
+// Opt-in gate — inline re-implementation of agent-memory-gate.mjs contract
+// (CJS cannot import ESM at the top level; inline ensures same fail-closed
+// semantics without a dynamic import or a build step).
+// ---------------------------------------------------------------------------
+const _GATE_TRUTHY_ENV = new Set(['1', 'true', 'on']);
+const _GATE_TRUTHY_FILE = new Set(['true', '1']);
+function _isAgentMemoryEnabled() {
+  const envVal = process.env['OLAM_AGENT_MEMORY'];
+  if (envVal !== undefined && envVal.length > 0) {
+    return _GATE_TRUTHY_ENV.has(envVal.trim().toLowerCase());
+  }
+  try {
+    const fromEnv = process.env['OLAM_HOME'];
+    const olamHome = (fromEnv && fromEnv.length > 0) ? fromEnv : path.join(os.homedir(), '.olam');
+    const flagPath = path.join(olamHome, 'agent-memory-enabled');
+    const raw = fs.readFileSync(flagPath, 'utf8').trim().toLowerCase();
+    return _GATE_TRUTHY_FILE.has(raw);
+  } catch {
+    return false;
+  }
+}
+// ---------------------------------------------------------------------------
+
 // Resolve the bridge URL: operator env wins, then the `olam memory connect`
 // artifact (~/.olam/memory-connection.json), then the LIVE memory-service
 // Worker. The prior default (olam-agent-memory.ernestcodes.workers.dev) is a
@@ -276,6 +300,9 @@ async function recall(query, limit = 5) {
 }
 
 async function main() {
+  // Gate: memory is off by default — exit silently when not enabled.
+  if (!_isAgentMemoryEnabled()) return;
+
   const raw = require('fs').readFileSync(0, 'utf8');
   let event = {};
   try { event = JSON.parse(raw); } catch (_) {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.207",
+  "version": "0.1.208",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"