@pleri/olam-cli 0.1.209 → 0.1.211

package/dist/index.js

@@ -535,8 +535,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path121, errorMaps, issueData } = params;
-      const fullPath = [...path121, ...issueData.path || []];
+      const { data, path: path122, errorMaps, issueData } = params;
+      const fullPath = [...path122, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -844,11 +844,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path121, key) {
+      constructor(parent, value, path122, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path121;
+        this._path = path122;
         this._key = key;
       }
       get path() {
@@ -4336,7 +4336,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path121, ctx, rejectSource) {
+function refineForbiddenKeys(value, path122, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4344,12 +4344,12 @@ function refineForbiddenKeys(value, path121, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path121, key],
+        path: [...path122, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path121.length === 0 && key === "source") {
+    if (rejectSource && path122.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4357,21 +4357,21 @@ function refineForbiddenKeys(value, path121, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path121, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path122, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path121, rejectSource) {
+function rejectForbiddenKeys(value, path122, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path121}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path122}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path121}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path122}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path121}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path122}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5645,16 +5645,16 @@ function isValidConfig(value) {
   if (typeof v.install_id !== "string" || v.install_id.length === 0) return false;
   return true;
 }
-function atomicWriteJSON(path121, value, stderr = process.stderr) {
+function atomicWriteJSON(path122, value, stderr = process.stderr) {
   ensureStateDir();
-  const dir = dirname3(path121);
+  const dir = dirname3(path122);
   if (!existsSync6(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
-  const tmp = `${path121}.tmp.${process.pid}`;
+  const tmp = `${path122}.tmp.${process.pid}`;
   try {
     writeFileSync2(tmp, JSON.stringify(value, null, 2) + "\n", { encoding: "utf8" });
-    renameSync2(tmp, path121);
+    renameSync2(tmp, path122);
   } catch (err) {
     if (existsSync6(tmp)) {
       try {
@@ -5669,16 +5669,16 @@ function atomicWriteJSON(path121, value, stderr = process.stderr) {
     throw err;
   }
 }
-function atomicWriteYaml(path121, value, stderr = process.stderr) {
+function atomicWriteYaml(path122, value, stderr = process.stderr) {
   ensureStateDir();
-  const dir = dirname3(path121);
+  const dir = dirname3(path122);
   if (!existsSync6(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
-  const tmp = `${path121}.tmp.${process.pid}`;
+  const tmp = `${path122}.tmp.${process.pid}`;
   try {
     writeFileSync2(tmp, stringifyYaml3(value), { encoding: "utf8" });
-    renameSync2(tmp, path121);
+    renameSync2(tmp, path122);
   } catch (err) {
     if (existsSync6(tmp)) {
       try {
@@ -5693,11 +5693,11 @@ function atomicWriteYaml(path121, value, stderr = process.stderr) {
     throw err;
   }
 }
-function atomicWrite(path121, value, stderr = process.stderr) {
-  if (isYamlPath(path121)) {
-    atomicWriteYaml(path121, value, stderr);
+function atomicWrite(path122, value, stderr = process.stderr) {
+  if (isYamlPath(path122)) {
+    atomicWriteYaml(path122, value, stderr);
   } else {
-    atomicWriteJSON(path121, value, stderr);
+    atomicWriteJSON(path122, value, stderr);
   }
 }
 function readConfig(opts = {}) {
@@ -6006,8 +6006,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path121, body, attempt = 0) {
-        const url2 = `${this.baseUrl}${path121}`;
+      async request(method, path122, body, attempt = 0) {
+        const url2 = `${this.baseUrl}${path122}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -6025,7 +6025,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path121, body, attempt + 1);
+            return this.request(method, path122, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -7903,8 +7903,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path121, method, body) {
-        const url2 = `${this.config.workerUrl}${path121}`;
+      async request(path122, method, body) {
+        const url2 = `${this.config.workerUrl}${path122}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -9740,17 +9740,17 @@ function kgRoot() {
 function worldsRoot() {
   return join19(olamHome3(), "worlds");
 }
-function assertWithinPrefix(path121, prefix, label) {
-  if (!path121.startsWith(prefix + "/")) {
-    throw new Error(`${label} escape: ${path121} not under ${prefix}/`);
+function assertWithinPrefix(path122, prefix, label) {
+  if (!path122.startsWith(prefix + "/")) {
+    throw new Error(`${label} escape: ${path122} not under ${prefix}/`);
   }
 }
 function kgPristinePath(workspace) {
   validateWorkspaceName(workspace);
   const root = kgRoot();
-  const path121 = resolve6(join19(root, workspace));
-  assertWithinPrefix(path121, root, "kgPristinePath");
-  return path121;
+  const path122 = resolve6(join19(root, workspace));
+  assertWithinPrefix(path122, root, "kgPristinePath");
+  return path122;
 }
 var KG_PATHS_INTERNALS;
 var init_storage_paths = __esm({
@@ -9865,8 +9865,8 @@ import { execFileSync as execFileSync4 } from "node:child_process";
 import * as fs17 from "node:fs";
 import * as os10 from "node:os";
 import * as path19 from "node:path";
-function expandHome2(p, homedir89) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir89());
+function expandHome2(p, homedir90) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir90());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -9889,7 +9889,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir89 = deps.homedir ?? (() => os10.homedir());
+  const homedir90 = deps.homedir ?? (() => os10.homedir());
   const baselineDir = path19.join(workspacePath, ".olam", "baseline");
   try {
     fs17.mkdirSync(baselineDir, { recursive: true });
@@ -9905,7 +9905,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path19.join(baselineDir, filename);
-    const repoPath = expandHome2(repo.path, homedir89);
+    const repoPath = expandHome2(repo.path, homedir90);
     if (!fs17.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -10025,8 +10025,8 @@ function extractStderr(err) {
 }
 function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync4(cmd, args, opts));
-  const homedir89 = deps.homedir ?? (() => os10.homedir());
-  const existsSync136 = deps.existsSync ?? ((p) => fs17.existsSync(p));
+  const homedir90 = deps.homedir ?? (() => os10.homedir());
+  const existsSync137 = deps.existsSync ?? ((p) => fs17.existsSync(p));
   const copyFileSync20 = deps.copyFileSync ?? ((src, dest) => fs17.copyFileSync(src, dest));
   const mkdirSync81 = deps.mkdirSync ?? ((dirPath, opts) => {
     fs17.mkdirSync(dirPath, opts);
@@ -10035,11 +10035,11 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
   for (const repo of repos) {
     if (!repo.path)
       continue;
-    const repoPath = expandHome2(repo.path, homedir89);
+    const repoPath = expandHome2(repo.path, homedir90);
     const worktreePath = path19.join(workspacePath, repo.name);
-    if (!existsSync136(repoPath))
+    if (!existsSync137(repoPath))
       continue;
-    if (!existsSync136(worktreePath)) {
+    if (!existsSync137(worktreePath)) {
       console.warn(`[carry] ${repo.name}: world worktree ${worktreePath} missing; skipping carry for this repo`);
       continue;
     }
@@ -10099,7 +10099,7 @@ function carryUncommittedEdits(repos, workspacePath, deps = {}) {
     for (const rel of plan.diff.untracked) {
       const src = path19.join(plan.repoPath, rel);
       const dest = path19.join(plan.worktreePath, rel);
-      if (!existsSync136(src))
+      if (!existsSync137(src))
         continue;
       try {
         mkdirSync81(path19.dirname(dest), { recursive: true });
@@ -16708,10 +16708,10 @@ async function readHostCpToken2() {
   if (!fs29.existsSync(tp)) return null;
   return fs29.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path121, body) {
+async function callHostCpProxy(method, worldId, path122, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path121}`;
+  const url2 = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path122}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -17132,57 +17132,57 @@ import { randomBytes as randomBytes8 } from "node:crypto";
 function generateSecret() {
   return randomBytes8(SECRET_LEN_BYTES).toString("hex");
 }
-function writeSecretAtPath(path121, value) {
-  mkdirSync23(dirname23(path121), { recursive: true, mode: 448 });
-  const tmp = `${path121}.tmp.${process.pid}`;
+function writeSecretAtPath(path122, value) {
+  mkdirSync23(dirname23(path122), { recursive: true, mode: 448 });
+  const tmp = `${path122}.tmp.${process.pid}`;
   writeFileSync18(tmp, value, { mode: 384 });
   chmodSync8(tmp, 384);
-  renameSync7(tmp, path121);
+  renameSync7(tmp, path122);
 }
-function readSecretAtPathOrNull(path121) {
-  if (!existsSync34(path121)) return null;
-  const mode = statSync9(path121).mode & 511;
+function readSecretAtPathOrNull(path122) {
+  if (!existsSync34(path122)) return null;
+  const mode = statSync9(path122).mode & 511;
   if (mode !== 384) {
     process.stderr.write(
-      `warn: ${path121} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
+      `warn: ${path122} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.
 `
     );
   }
-  return readFileSync28(path121, "utf8").trim();
+  return readFileSync28(path122, "utf8").trim();
 }
-function readSecretAtPath(path121) {
-  const v = readSecretAtPathOrNull(path121);
+function readSecretAtPath(path122) {
+  const v = readSecretAtPathOrNull(path122);
   if (v === null) {
     throw new Error(
-      `Secret not found at ${path121}. Run 'olam memory start' to generate it.`
+      `Secret not found at ${path122}. Run 'olam memory start' to generate it.`
     );
   }
   return v;
 }
-function ensureMemorySecret(path121 = MEMORY_SECRET_PATH) {
-  const existing = readSecretAtPathOrNull(path121);
+function ensureMemorySecret(path122 = MEMORY_SECRET_PATH) {
+  const existing = readSecretAtPathOrNull(path122);
   if (existing) return existing;
   const fresh = generateSecret();
-  const writePath = path121 === MEMORY_SECRET_PATH ? MEMORY_SECRET_CANONICAL_PATH : path121;
+  const writePath = path122 === MEMORY_SECRET_PATH ? MEMORY_SECRET_CANONICAL_PATH : path122;
   writeSecretAtPath(writePath, fresh);
   return fresh;
 }
-function readMemorySecretOrNull(path121 = MEMORY_SECRET_PATH) {
-  return readSecretAtPathOrNull(path121);
+function readMemorySecretOrNull(path122 = MEMORY_SECRET_PATH) {
+  return readSecretAtPathOrNull(path122);
 }
-function readMemorySecret(path121 = MEMORY_SECRET_PATH) {
-  return readSecretAtPath(path121);
+function readMemorySecret(path122 = MEMORY_SECRET_PATH) {
+  return readSecretAtPath(path122);
 }
-function rotateMemorySecret(path121 = MEMORY_SECRET_CANONICAL_PATH) {
+function rotateMemorySecret(path122 = MEMORY_SECRET_CANONICAL_PATH) {
   const fresh = generateSecret();
-  writeSecretAtPath(path121, fresh);
+  writeSecretAtPath(path122, fresh);
   return fresh;
 }
-function hasMemorySecret(path121 = MEMORY_SECRET_PATH) {
-  return existsSync34(path121);
+function hasMemorySecret(path122 = MEMORY_SECRET_PATH) {
+  return existsSync34(path122);
 }
-function writeCloudMemorySecret(value, path121 = CLOUD_MEMORY_SECRET_CANONICAL_PATH) {
-  writeSecretAtPath(path121, value);
+function writeCloudMemorySecret(value, path122 = CLOUD_MEMORY_SECRET_CANONICAL_PATH) {
+  writeSecretAtPath(path122, value);
 }
 var MEMORY_SECRET_PATH, CLOUD_MEMORY_SECRET_PATH, MEMORY_SECRET_CANONICAL_PATH, CLOUD_MEMORY_SECRET_CANONICAL_PATH, SECRET_LEN_BYTES;
 var init_memory_secret = __esm({
@@ -17260,31 +17260,31 @@ __export(from_manifest_exports, {
   provenanceLine: () => provenanceLine
 });
 import { readFileSync as readFileSync37 } from "node:fs";
-function parseForkManifest(path121) {
+function parseForkManifest(path122) {
   let raw;
   try {
-    raw = readFileSync37(path121, "utf8");
+    raw = readFileSync37(path122, "utf8");
   } catch (err) {
     const reason = err?.code === "ENOENT" ? "file does not exist" : err.message;
-    throw new Error(`--from-manifest: cannot read ${path121} (${reason})`);
+    throw new Error(`--from-manifest: cannot read ${path122} (${reason})`);
   }
   let json;
   try {
     json = JSON.parse(raw);
   } catch (err) {
-    throw new Error(`--from-manifest: ${path121} is not valid JSON (${err.message})`);
+    throw new Error(`--from-manifest: ${path122} is not valid JSON (${err.message})`);
   }
   if (!isPlainObject2(json)) {
-    throw new Error(`--from-manifest: ${path121} root must be a JSON object`);
+    throw new Error(`--from-manifest: ${path122} root must be a JSON object`);
   }
   const originalWorldId = json.originalWorldId;
   if (typeof originalWorldId !== "string" || originalWorldId.trim().length === 0) {
-    throw new Error(`--from-manifest: ${path121} missing required string "originalWorldId"`);
+    throw new Error(`--from-manifest: ${path122} missing required string "originalWorldId"`);
   }
   const newPrompt = json.newPrompt;
   if (typeof newPrompt !== "string" || newPrompt.trim().length === 0) {
     throw new Error(
-      `--from-manifest: ${path121} has no "newPrompt" \u2014 re-run trace-replay with --with-prompt "<alternate dispatch>"`
+      `--from-manifest: ${path122} has no "newPrompt" \u2014 re-run trace-replay with --with-prompt "<alternate dispatch>"`
     );
   }
   const fp = isPlainObject2(json.forkPoint) ? json.forkPoint : {};
@@ -17295,7 +17295,7 @@ function parseForkManifest(path121) {
     originalWorldId: originalWorldId.trim(),
     forkPoint: { resolvedPhase, resolvedSpanId, resolvedAt },
     newPrompt,
-    manifestPath: path121
+    manifestPath: path122
   };
 }
 function defaultNameFromManifest(manifest) {
@@ -17390,10 +17390,10 @@ function legacySecretPath(home = homedir27()) {
   return join53(home, ".olam", "secrets", "plan-agent-secret");
 }
 function readRemoteConnection() {
-  for (const path121 of [planChatConnectionPath(), legacyConnectionPath()]) {
+  for (const path122 of [planChatConnectionPath(), legacyConnectionPath()]) {
     try {
-      if (!existsSync45(path121)) continue;
-      const parsed = JSON.parse(readFileSync38(path121, "utf8"));
+      if (!existsSync45(path122)) continue;
+      const parsed = JSON.parse(readFileSync38(path122, "utf8"));
       if (typeof parsed.url !== "string" || parsed.url.length === 0) continue;
       return {
         url: parsed.url,
@@ -17407,12 +17407,12 @@ function readRemoteConnection() {
   return null;
 }
 function writeRemoteConnection(input2) {
-  const path121 = planChatConnectionPath();
-  mkdirSync29(dirname30(path121), { recursive: true, mode: 448 });
+  const path122 = planChatConnectionPath();
+  mkdirSync29(dirname30(path122), { recursive: true, mode: 448 });
   const payload = { url: input2.url, connectedAt: input2.connectedAt };
   if (input2.password) payload["password"] = input2.password;
   if (input2.bearer) payload["bearer"] = input2.bearer;
-  writeSecretAtPath(path121, JSON.stringify(payload, null, 2) + "\n");
+  writeSecretAtPath(path122, JSON.stringify(payload, null, 2) + "\n");
 }
 function resolveRemoteUrl2() {
   const env = process.env["OLAM_CLOUD_URL"];
@@ -17726,9 +17726,9 @@ function memoryConnectionPath() {
 }
 function readMemoryConnection() {
   try {
-    const path121 = memoryConnectionPath();
-    if (!existsSync63(path121)) return null;
-    const parsed = JSON.parse(readFileSync55(path121, "utf8"));
+    const path122 = memoryConnectionPath();
+    if (!existsSync63(path122)) return null;
+    const parsed = JSON.parse(readFileSync55(path122, "utf8"));
     if (typeof parsed.url !== "string" || parsed.url.length === 0) return null;
     return { url: parsed.url, connectedAt: parsed.connectedAt ?? "" };
   } catch {
@@ -17736,9 +17736,9 @@ function readMemoryConnection() {
   }
 }
 function writeMemoryConnection(url2, connectedAt) {
-  const path121 = memoryConnectionPath();
-  mkdirSync39(dirname36(path121), { recursive: true, mode: 448 });
-  writeSecretAtPath(path121, JSON.stringify({ url: url2, connectedAt }, null, 2) + "\n");
+  const path122 = memoryConnectionPath();
+  mkdirSync39(dirname36(path122), { recursive: true, mode: 448 });
+  writeSecretAtPath(path122, JSON.stringify({ url: url2, connectedAt }, null, 2) + "\n");
 }
 var init_memory_connection = __esm({
   "src/lib/memory-connection.ts"() {
@@ -19407,16 +19407,25 @@ function settingsBackupDir() {
     return override;
   return path73.join(os38.homedir(), ".olam", "state", "settings-backups");
 }
+function entryKey(entry) {
+  const cmds = commandsInEntry(entry);
+  const cmdKey = cmds.length > 0 ? cmds[0] : "";
+  return `${entry.matcher ?? ""}\0${cmdKey}`;
+}
 function dedupeByMatcher(entries) {
   const map = /* @__PURE__ */ new Map();
   for (const e of entries) {
-    const cmds = commandsInEntry(e);
-    const cmdKey = cmds.length > 0 ? cmds[0] : "";
-    const key = `${e.matcher ?? ""}\0${cmdKey}`;
-    map.set(key, e);
+    map.set(entryKey(e), e);
   }
   return [...map.values()];
 }
+function reclaimLegacyDuplicates(preserved, olamFinal) {
+  if (olamFinal.length === 0)
+    return { kept: preserved, reclaimedCount: 0 };
+  const olamKeys = new Set(olamFinal.map(entryKey));
+  const kept = preserved.filter((e) => !olamKeys.has(entryKey(e)));
+  return { kept, reclaimedCount: preserved.length - kept.length };
+}
 function commandsInEntry(entry) {
   const cmds = [];
   const direct = entry["command"];
@@ -19517,6 +19526,7 @@ function mergeSettings(input2) {
   ]);
   let hooksAdded = 0;
   let dualWriteDeduped = 0;
+  let legacyReclaimed = 0;
   const dualWriteDroppedCommands = [];
   for (const cat of categories) {
     const existing = Array.isArray(existingHooks[cat]) ? existingHooks[cat] : [];
@@ -19526,7 +19536,9 @@ function mergeSettings(input2) {
     const { kept: olamFinal, droppedCount, droppedCommands } = applyDualWriteDedup(olamDeduped, preserved);
     dualWriteDeduped += droppedCount;
     dualWriteDroppedCommands.push(...droppedCommands);
-    mergedHooks[cat] = [...preserved, ...olamFinal];
+    const { kept: preservedFinal, reclaimedCount } = reclaimLegacyDuplicates(preserved, olamFinal);
+    legacyReclaimed += reclaimedCount;
+    mergedHooks[cat] = [...preservedFinal, ...olamFinal];
     hooksAdded += olamFinal.length;
   }
   const permSet = /* @__PURE__ */ new Set();
@@ -19556,7 +19568,14 @@ function mergeSettings(input2) {
   const tmp = `${settingsPath}.tmp-${process.pid}`;
   fs75.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 420 });
   fs75.renameSync(tmp, settingsPath);
-  return { backupPath, hooksAdded, permissionsCount: permSet.size, dualWriteDeduped, dualWriteDroppedCommands };
+  return {
+    backupPath,
+    hooksAdded,
+    permissionsCount: permSet.size,
+    dualWriteDeduped,
+    dualWriteDroppedCommands,
+    legacyReclaimed
+  };
 }
 var OLAM_SKILLS_MARKER, BACKUP_RETENTION, DUAL_WRITE_DEDUP_RULES;
 var init_settings_merger = __esm({
@@ -21013,12 +21032,12 @@ function sourceConfigPath(clonePath) {
   return join91(clonePath, "shared", "source-config.yaml");
 }
 function readSourceConfig(clonePath, sourceId) {
-  const path121 = sourceConfigPath(clonePath);
-  if (!existsSync88(path121))
+  const path122 = sourceConfigPath(clonePath);
+  if (!existsSync88(path122))
     return void 0;
   let raw;
   try {
-    raw = readFileSync82(path121, "utf-8");
+    raw = readFileSync82(path122, "utf-8");
   } catch (err) {
     emitMalformedWarning(sourceId, `read failed: ${errToMsg(err)}`);
     return void 0;
@@ -22744,10 +22763,16 @@ var init_kg_eager = __esm({
 // ../core/dist/kg/hook-template.js
 var hook_template_exports = {};
 __export(hook_template_exports, {
+  KG_HOOK_PROMPT_SENTINEL: () => KG_HOOK_PROMPT_SENTINEL,
+  KG_HOOK_PROMPT_SENTINEL_PREFIX: () => KG_HOOK_PROMPT_SENTINEL_PREFIX,
   KG_HOOK_SENTINEL: () => KG_HOOK_SENTINEL,
   KG_HOOK_SENTINEL_PREFIX: () => KG_HOOK_SENTINEL_PREFIX,
+  PROMPT_TERM_EXTRACT_PY: () => PROMPT_TERM_EXTRACT_PY,
+  TERM_EXTRACT_PY: () => TERM_EXTRACT_PY,
   buildHookCommand: () => buildHookCommand,
-  buildHookMatcherEntry: () => buildHookMatcherEntry
+  buildHookMatcherEntry: () => buildHookMatcherEntry,
+  buildPromptHookCommand: () => buildPromptHookCommand,
+  buildPromptHookMatcherEntry: () => buildPromptHookMatcherEntry
 });
 function defaultUrl(flavor) {
   if (flavor === "host")
@@ -22763,20 +22788,26 @@ function buildHookCommand(opts) {
 try:
   d=json.loads(sys.stdin.read())
   route=d.get("route","")
+  qnodes=[]
+  try:
+    qd=json.loads(os.environ.get("KG_QUERY_NODES","") or "{}")
+    if isinstance(qd,dict) and qd.get("ok") and isinstance(qd.get("nodes"),list):
+      qnodes=qd["nodes"]
+  except Exception: qnodes=[]
+  real_n=len(qnodes)
   if route:
     if route in ("kg","both"):
       label=d.get("top_match") or d.get("reason","")
       layer=d.get("layer","?")
-      nodes=d.get("nodes_matched",0)
+      nodes=real_n if real_n else d.get("nodes_matched",0)
       saved=(d.get("savings") or {}).get("saved_tokens_est",0)
       saved_k=round(saved/1000)
       sys.stderr.write(f"\\x1b[32m\\u29bf\\u29bf\\x1b[0m  KG hit \\u2713 {label} \\u2192  L{layer}/{route} \\u00b7 {nodes} nodes \\u00b7 \\x1b[32m~{saved_k}k tokens saved\\x1b[0m\\n")
-    else:
+    elif route=="grep":
       sys.stderr.write("\\U0001f50d Grep used\\n")
-  if route and route != "grep":
+  if route in ("kg","both"):
     label=d.get("top_match") or d.get("reason","")
     layer=d.get("layer","?")
-    nodes=d.get("nodes_matched",0)
     saved=(d.get("savings") or {}).get("saved_tokens_est",0)
     saved_k=round(saved/1000)
     q=os.environ.get("KG_QUERY","")[:60]
@@ -22786,20 +22817,44 @@ try:
     rel=any(k in ql for k in ("call","caller","import","uses","used","reference","who "))
     g="olam kg mirror graph \\"" + sym + "\\" --workspace <ws>"
     hint=g + (" --relates" if rel else "") + "  (where X is defined; add --relates for what calls/imports it; --repo <name> to browse a repo)"
-    print(json.dumps({"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":f"[kg-classifier L{layer}|{route}] {label[:140]}\\n\\u21b3 graph: {hint}"}}))
+    if qnodes:
+      lines=[]
+      for n in qnodes[:5]:
+        s=str(n.get("symbol") or n.get("label") or "?")
+        f=str(n.get("file") or "")
+        loc=str(n.get("loc") or "")
+        lines.append(f"  {s}  {f}:{loc}" if loc else f"  {s}  {f}")
+      body="[kg-classifier L"+str(layer)+"|"+route+"] "+label[:140]+"\\n\\u21b3 nodes ("+str(real_n)+"):\\n"+"\\n".join(lines)+"\\n\\u21b3 graph: "+hint
+    else:
+      body="[kg-classifier L"+str(layer)+"|"+route+"] "+label[:140]+"\\n\\u21b3 graph: "+hint
+    print(json.dumps({"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":body}}))
 except Exception: pass' 2>/dev/null`;
   const isCloud = opts.flavor === "cloud-sandbox";
   const resolvedUrl = isCloud ? '"${OLAM_KG_PROXY_URL:-}/v1/classify"' : url2;
   const authHeader = isCloud ? `-H "Authorization: Bearer \${OLAM_KG_PROXY_BEARER:-}"` : "";
   const cloudGuard = isCloud ? `if [ -z "\${OLAM_KG_PROXY_URL:-}" ] || [ -z "\${OLAM_KG_PROXY_BEARER:-}" ]; then exit 0; fi; ` : "";
-  const wsField = isCloud ? `,\\"workspace\\":\\"\${OLAM_KG_PROXY_WORKSPACE:-}\\"` : "";
-  const curlPost = `RESP=$(curl -s --max-time 1 -X POST -H 'Content-Type: application/json' ${authHeader} -d "{\\"q\\":\\"$(echo \\"$CMD\\" | head -c 200 | tr '\\"' ' ')\\"${wsField}}" ${resolvedUrl} 2>/dev/null)`;
-  const hostRemoteFallback = opts.flavor === "host" ? `; if [ -z "$RESP" ] && [ -r "$HOME/.olam/kg-proxy-url" ] && [ -r "$HOME/.olam/kg-proxy-bearer" ]; then KG_ORIGIN=$(sed 's|\\(https*://[^/]*\\).*|\\1|' "$HOME/.olam/kg-proxy-url" 2>/dev/null); RESP=$(curl -s --max-time 3 -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer $(cat "$HOME/.olam/kg-proxy-bearer")" -d "{\\"q\\":\\"$(echo \\"$CMD\\" | head -c 200 | tr '\\"' ' ')\\"}" "$KG_ORIGIN/v1/classify" 2>/dev/null); fi` : "";
+  const isHostOrWorld = opts.flavor === "host" || opts.flavor === "world";
+  const wsResolve = isHostOrWorld ? `KG_WS="\${OLAM_KG_WORKSPACE:-$(cat "\${OLAM_HOME:-$HOME/.olam}/kg-default-workspace" 2>/dev/null || echo atlas-one)}"; ` : "";
+  const wsField = isCloud ? `,\\"workspace\\":\\"\${OLAM_KG_PROXY_WORKSPACE:-}\\"` : `,\\"workspace\\":\\"$KG_WS\\"`;
+  const termExtract = TERM_EXTRACT_PY;
+  const qTermLocal = `$(echo \\"$KG_TERM\\" | head -c 200 | tr '\\"' ' ')`;
+  const setTerm = `KG_TERM=$(echo "$CMD" | ${termExtract}); `;
+  const curlPost = `${wsResolve}${setTerm}RESP=$(curl -s --max-time 1 -X POST -H 'Content-Type: application/json' ${authHeader} -d "{\\"q\\":\\"${qTermLocal}\\"${wsField}}" ${resolvedUrl} 2>/dev/null)`;
+  const hostRemoteFallback = opts.flavor === "host" ? `; if [ -r "$HOME/.olam/kg-proxy-url" ] && [ -r "$HOME/.olam/kg-proxy-bearer" ]; then KG_ORIGIN=$(sed 's|\\(https*://[^/]*\\).*|\\1|' "$HOME/.olam/kg-proxy-url" 2>/dev/null); if [ -z "$RESP" ]; then RESP=$(curl -s --max-time 3 -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer $(cat "$HOME/.olam/kg-proxy-bearer")" -d "{\\"q\\":\\"${qTermLocal}\\"${wsField}}" "$KG_ORIGIN/v1/classify" 2>/dev/null); fi; fi` : "";
+  const routeIsKg = `echo "$RESP" | grep -Eq '"route"[[:space:]]*:[[:space:]]*"(kg|both)"'`;
+  const queryBody = `-d "{\\"q\\":\\"${qTermLocal}\\",\\"limit\\":5${wsField}}"`;
+  let queryFollowup = "";
+  if (opts.flavor === "host") {
+    queryFollowup = `; KG_QUERY_NODES=""; if [ -n "$RESP" ] && ${routeIsKg} && [ -n "$KG_ORIGIN" ] && [ -r "$HOME/.olam/kg-proxy-bearer" ]; then KG_QUERY_NODES=$(curl -s --max-time 3 -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer $(cat "$HOME/.olam/kg-proxy-bearer")" ${queryBody} "$KG_ORIGIN/v1/query" 2>/dev/null); fi`;
+  } else if (isCloud) {
+    queryFollowup = `; KG_QUERY_NODES=""; if [ -n "$RESP" ] && ${routeIsKg}; then KG_QUERY_NODES=$(curl -s --max-time 3 -X POST -H 'Content-Type: application/json' ${authHeader} ${queryBody} "\${OLAM_KG_PROXY_URL:-}/v1/query" 2>/dev/null); fi`;
+  }
+  const emitLine = `export KG_QUERY="$(echo \\"$CMD\\" | head -c 60 | tr '\\"' ' ')"; export KG_QUERY_NODES="\${KG_QUERY_NODES:-}"; echo "$RESP" | ${emitContext}`;
   return [
     `KG_SENTINEL=${KG_HOOK_SENTINEL}`,
     `CMD=$(${extractCmd})`,
-    `case "$CMD" in grep\\ *|grep|git\\ grep\\ *|rg\\ *|ripgrep\\ *|find\\ *|fd\\ *|ack\\ *|ag\\ *) ${cloudGuard}${curlPost}${hostRemoteFallback}`,
-    `KG_QUERY="$(echo \\"$CMD\\" | head -c 60 | tr '\\"' ' ')" echo "$RESP" | ${emitContext}`,
+    `case "$CMD" in grep\\ *|grep|git\\ grep\\ *|rg\\ *|ripgrep\\ *|find\\ *|fd\\ *|ack\\ *|ag\\ *) ${cloudGuard}${curlPost}${hostRemoteFallback}${queryFollowup}`,
+    emitLine,
     `;; esac`
   ].join("; ");
 }
@@ -22814,12 +22869,112 @@ function buildHookMatcherEntry(opts) {
     ]
   };
 }
-var KG_HOOK_SENTINEL, KG_HOOK_SENTINEL_PREFIX;
+function buildPromptHookCommand(opts) {
+  const url2 = opts.url ?? defaultUrl(opts.flavor);
+  const isCloud = opts.flavor === "cloud-sandbox";
+  const isHostOrWorld = opts.flavor === "host" || opts.flavor === "world";
+  const extractCmd = `python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('prompt',''))" 2>/dev/null`;
+  const resolvedUrl = isCloud ? '"${OLAM_KG_PROXY_URL:-}/v1/classify"' : url2;
+  const authHeader = isCloud ? `-H "Authorization: Bearer \${OLAM_KG_PROXY_BEARER:-}"` : "";
+  const cloudGuard = isCloud ? `if [ -z "\${OLAM_KG_PROXY_URL:-}" ] || [ -z "\${OLAM_KG_PROXY_BEARER:-}" ]; then exit 0; fi; ` : "";
+  const wsResolve = isHostOrWorld ? `KG_WS="\${OLAM_KG_WORKSPACE:-$(cat "\${OLAM_HOME:-$HOME/.olam}/kg-default-workspace" 2>/dev/null || echo atlas-one)}"; ` : "";
+  const wsField = isCloud ? `,\\"workspace\\":\\"\${OLAM_KG_PROXY_WORKSPACE:-}\\"` : `,\\"workspace\\":\\"$KG_WS\\"`;
+  const classifyPost = `${wsResolve}RESP=$(curl -s --max-time 1 -X POST -H 'Content-Type: application/json' ${authHeader} -d "{\\"q\\":\\"$(echo \\"$PROMPT\\" | head -c 200 | tr '\\"' ' ')\\"${wsField}}" ${resolvedUrl} 2>/dev/null)`;
+  const hostRemoteFallback = opts.flavor === "host" ? `; if [ -r "$HOME/.olam/kg-proxy-url" ] && [ -r "$HOME/.olam/kg-proxy-bearer" ]; then KG_ORIGIN=$(sed 's|\\(https*://[^/]*\\).*|\\1|' "$HOME/.olam/kg-proxy-url" 2>/dev/null); if [ -z "$RESP" ]; then RESP=$(curl -s --max-time 3 -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer $(cat "$HOME/.olam/kg-proxy-bearer")" -d "{\\"q\\":\\"$(echo \\"$PROMPT\\" | head -c 200 | tr '\\"' ' ')\\"${wsField}}" "$KG_ORIGIN/v1/classify" 2>/dev/null); fi; fi` : "";
+  const setTerm = `KG_TERM=$(echo "$PROMPT" | ${PROMPT_TERM_EXTRACT_PY}); `;
+  const qTerm = `$(echo \\"$KG_TERM\\" | head -c 200 | tr '\\"' ' ')`;
+  const routeIsKg = `echo "$RESP" | grep -Eq '"route"[[:space:]]*:[[:space:]]*"(kg|both)"'`;
+  const queryBody = `-d "{\\"q\\":\\"${qTerm}\\",\\"limit\\":5${wsField}}"`;
+  let queryFollowup = "";
+  if (opts.flavor === "host") {
+    queryFollowup = `; KG_QUERY_NODES=""; if [ -n "$RESP" ] && ${routeIsKg} && [ -n "$KG_ORIGIN" ] && [ -r "$HOME/.olam/kg-proxy-bearer" ]; then ${setTerm}KG_QUERY_NODES=$(curl -s --max-time 3 -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer $(cat "$HOME/.olam/kg-proxy-bearer")" ${queryBody} "$KG_ORIGIN/v1/query" 2>/dev/null); fi`;
+  } else if (isCloud) {
+    queryFollowup = `; KG_QUERY_NODES=""; if [ -n "$RESP" ] && ${routeIsKg}; then ${setTerm}KG_QUERY_NODES=$(curl -s --max-time 3 -X POST -H 'Content-Type: application/json' ${authHeader} ${queryBody} "\${OLAM_KG_PROXY_URL:-}/v1/query" 2>/dev/null); fi`;
+  }
+  const emitContext = `python3 -c 'import json,sys,os
+try:
+  d=json.loads(sys.stdin.read())
+  route=d.get("route","")
+  if route not in ("kg","both"): sys.exit(0)
+  qnodes=[]
+  try:
+    qd=json.loads(os.environ.get("KG_QUERY_NODES","") or "{}")
+    if isinstance(qd,dict) and qd.get("ok") and isinstance(qd.get("nodes"),list):
+      qnodes=qd["nodes"]
+  except Exception: qnodes=[]
+  layer=d.get("layer","?")
+  cands=d.get("candidate_symbols") or []
+  sym=(cands[0] if cands else "") or "<symbol>"
+  q=os.environ.get("KG_QUERY","")[:60]
+  ql=q.lower()
+  rel=any(k in ql for k in ("call","caller","import","uses","used","reference","who "))
+  g="olam kg mirror graph \\"" + sym + "\\" --workspace <ws>"
+  hint=g + (" --relates" if rel else "") + "  (where X is defined; add --relates for what calls/imports it; --repo <name> to browse a repo)"
+  if qnodes:
+    lines=[]
+    for n in qnodes[:5]:
+      s=str(n.get("symbol") or n.get("label") or "?")
+      f=str(n.get("file") or "")
+      loc=str(n.get("loc") or "")
+      lines.append(f"  {s}  {f}:{loc}" if loc else f"  {s}  {f}")
+    body="[kg L"+str(layer)+"|"+route+"] this looks symbol-shaped \u2014 the KG already has:\\n\\u21b3 nodes ("+str(len(qnodes))+"):\\n"+"\\n".join(lines)+"\\n\\u21b3 graph: "+hint
+  else:
+    body="[kg L"+str(layer)+"|"+route+"] this looks symbol-shaped \u2014 prefer the KG over grep.\\n\\u21b3 graph: "+hint
+  print(json.dumps({"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":body}}))
+except Exception: pass' 2>/dev/null`;
+  const emitLine = `export KG_QUERY="$(echo \\"$PROMPT\\" | head -c 60 | tr '\\"' ' ')"; export KG_QUERY_NODES="\${KG_QUERY_NODES:-}"; echo "$RESP" | ${emitContext}`;
+  return [
+    `KG_SENTINEL=${KG_HOOK_PROMPT_SENTINEL}`,
+    `PROMPT=$(${extractCmd})`,
+    // No search-tool gate: classify every non-empty prompt. Empty prompt → no-op.
+    `if [ -n "$PROMPT" ]; then ${cloudGuard}${classifyPost}${hostRemoteFallback}${queryFollowup}; ${emitLine}; fi`
+  ].join("; ");
+}
+function buildPromptHookMatcherEntry(opts) {
+  return {
+    hooks: [
+      {
+        type: "command",
+        command: buildPromptHookCommand(opts)
+      }
+    ]
+  };
+}
+var KG_HOOK_SENTINEL, KG_HOOK_SENTINEL_PREFIX, KG_HOOK_PROMPT_SENTINEL, KG_HOOK_PROMPT_SENTINEL_PREFIX, TERM_EXTRACT_PY, PROMPT_TERM_EXTRACT_PY;
 var init_hook_template2 = __esm({
   "../core/dist/kg/hook-template.js"() {
     "use strict";
-    KG_HOOK_SENTINEL = "kg-service-v3-classifier-hook";
+    KG_HOOK_SENTINEL = "kg-service-v4-classifier-hook";
     KG_HOOK_SENTINEL_PREFIX = "kg-service-v";
+    KG_HOOK_PROMPT_SENTINEL = "kg-service-prompt-v4-classifier-hook";
+    KG_HOOK_PROMPT_SENTINEL_PREFIX = "kg-service-prompt-v";
+    TERM_EXTRACT_PY = `python3 -c 'import sys
+cmd=sys.stdin.read().strip()
+toks=cmd.split()
+TOOLS=("grep","rg","ripgrep","find","fd","ack","ag")
+DIRS=("src","lib","app","test","spec","packages")
+QUOTES=chr(34)+chr(39)+chr(96)
+i=0
+if toks and toks[0]=="git" and len(toks)>1 and toks[1]=="grep": i=2
+elif toks and toks[0] in TOOLS: i=1
+term=""
+for t in toks[i:]:
+  if t.startswith("-"): continue
+  s=t.strip(QUOTES)
+  if not s: continue
+  if "/" in s or s.endswith("/") or s in DIRS or s in (".",".."): continue
+  term=s; break
+print(term if term else cmd)' 2>/dev/null`;
+    PROMPT_TERM_EXTRACT_PY = `python3 -c 'import sys,re
+p=sys.stdin.read().strip()
+Q=chr(34); B=chr(96); A=chr(39)
+pats=[B+"([^"+B+"]{3,})"+B, Q+"([^"+Q+"]{3,})"+Q, A+"([^"+A+"]{3,})"+A, "\\\\b[A-Za-z_$][\\\\w$]*(?:\\\\.[A-Za-z_$][\\\\w$]*)+\\\\b", "\\\\b[a-zA-Z_$][\\\\w$]*[A-Z][\\\\w$]*\\\\b", "\\\\b[a-z_][a-z0-9_]*_[a-z0-9_]+\\\\b"]
+term=""
+for pat in pats:
+  m=re.search(pat,p)
+  if m:
+    term=(m.group(1) if m.groups() else m.group(0)).strip(); break
+print(term if term else p)' 2>/dev/null`;
   }
 });
 
@@ -23383,8 +23538,8 @@ function olamDir(deps) {
   return join104(deps.home ?? homedir56(), ".olam");
 }
 function resolveLocalSecretValue(obj, deps = {}) {
-  const path121 = join104(olamDir(deps), obj.local);
-  const direct = readSecretAtPathOrNull(path121);
+  const path122 = join104(olamDir(deps), obj.local);
+  const direct = readSecretAtPathOrNull(path122);
   if (direct) return direct;
   if (obj.object === "plan-chat-secret") {
     const conn = readRemoteConnection();
@@ -23696,9 +23851,9 @@ var init_machine_schema = __esm({
 init_cli_version();
 init_output();
 init_exit_codes();
-import { existsSync as existsSync135 } from "node:fs";
-import { homedir as homedir88 } from "node:os";
-import { join as join143 } from "node:path";
+import { existsSync as existsSync136 } from "node:fs";
+import { homedir as homedir89 } from "node:os";
+import { join as join144 } from "node:path";
 import { Command } from "commander";
 
 // src/commands/init.ts
@@ -24254,9 +24409,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path121) {
-    super(`Archetype inheritance cycle detected: ${path121.join(" \u2192 ")} \u2192 ${path121[0] ?? "?"}`);
-    this.path = path121;
+  constructor(path122) {
+    super(`Archetype inheritance cycle detected: ${path122.join(" \u2192 ")} \u2192 ${path122[0] ?? "?"}`);
+    this.path = path122;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -25606,8 +25761,8 @@ async function installObservability(opts) {
   }
   const outcomes = [];
   for (const script of OBSERVABILITY_SCRIPTS) {
-    const path121 = join37(observabilityDir, script);
-    if (!existsSync31(path121)) {
+    const path122 = join37(observabilityDir, script);
+    if (!existsSync31(path122)) {
       outcomes.push({ script, state: "missing" });
       continue;
     }
@@ -25619,7 +25774,7 @@ async function installObservability(opts) {
       }
     }
     const runResult = await runObservabilityScript(
-      path121,
+      path122,
       script,
       scriptEnv,
       opts.verbose
@@ -27291,8 +27446,8 @@ function locateMkcert(deps) {
   const spawn14 = deps.spawnImpl ?? defaultSpawn;
   const which = spawn14("which", ["mkcert"]);
   if (which.status === 0) {
-    const path121 = which.stdout.trim();
-    if (path121.length > 0) return path121;
+    const path122 = which.stdout.trim();
+    if (path122.length > 0) return path122;
   }
   const brewPath = "/opt/homebrew/bin/mkcert";
   const exists = spawn14("test", ["-x", brewPath]);
@@ -28622,12 +28777,12 @@ function appendAuditEntry(entry, auditLogPath, writeFileSyncImpl) {
 async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, peripheral) {
   const auditLogPath = deps.auditLogPath ?? MANIFEST_REFRESH_AUDIT_LOG;
   const readdirSync37 = deps.readdirSync ?? fs35.readdirSync;
-  const readFileSync125 = deps.readFileSync ?? fs35.readFileSync;
+  const readFileSync126 = deps.readFileSync ?? fs35.readFileSync;
   const writeFileSyncImpl = deps.writeFileSync ?? fs35.writeFileSync;
-  const existsSync136 = deps.existsSync ?? fs35.existsSync;
+  const existsSync137 = deps.existsSync ?? fs35.existsSync;
   const now = deps.now ? deps.now() : /* @__PURE__ */ new Date();
   const targetDir = peripheral ? path36.join(manifestsDir, peripheral) : manifestsDir;
-  if (!existsSync136(targetDir)) {
+  if (!existsSync137(targetDir)) {
     return {
       ok: false,
       message: peripheral ? `peripheral manifests directory not found: ${targetDir}` : `manifests directory not found: ${targetDir}`
@@ -28648,7 +28803,7 @@ async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, per
     const filePath = path36.join(targetDir, file);
     let content;
     try {
-      content = readFileSync125(filePath, "utf8");
+      content = readFileSync126(filePath, "utf8");
     } catch {
       continue;
     }
@@ -28907,11 +29062,11 @@ async function checkSecretPreCondition(context, deps) {
 }
 async function applyConfigMapSubstitution(context, manifestsDir, deps) {
   const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
-  const readFileSync125 = deps.readFileSyncImpl ?? fs36.readFileSync;
+  const readFileSync126 = deps.readFileSyncImpl ?? fs36.readFileSync;
   const configMapPath = path37.join(manifestsDir, "30-configmap.yaml");
   let rawYaml;
   try {
-    rawYaml = readFileSync125(configMapPath, "utf8");
+    rawYaml = readFileSync126(configMapPath, "utf8");
   } catch (err) {
     return `Failed to read ConfigMap at ${configMapPath}: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -30205,10 +30360,10 @@ function emptyMigrationState() {
   return { version: 1, migrated: {} };
 }
 function readMigrationState(statePath, deps) {
-  const existsSync136 = deps.existsSync ?? fs40.existsSync;
-  const readFileSync125 = deps.readFileSync ?? ((p) => fs40.readFileSync(p, "utf-8"));
-  if (!existsSync136(statePath)) return emptyMigrationState();
-  const raw = readFileSync125(statePath);
+  const existsSync137 = deps.existsSync ?? fs40.existsSync;
+  const readFileSync126 = deps.readFileSync ?? ((p) => fs40.readFileSync(p, "utf-8"));
+  if (!existsSync137(statePath)) return emptyMigrationState();
+  const raw = readFileSync126(statePath);
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -30225,17 +30380,17 @@ function readMigrationState(statePath, deps) {
   return parsed;
 }
 function writeMigrationStateAtomic(statePath, state, deps) {
-  const writeFileSync76 = deps.writeFileSync ?? ((p, d) => fs40.writeFileSync(p, d, "utf-8"));
+  const writeFileSync77 = deps.writeFileSync ?? ((p, d) => fs40.writeFileSync(p, d, "utf-8"));
   const renameSync23 = deps.renameSync ?? fs40.renameSync;
   const tmpPath = `${statePath}.tmp`;
-  writeFileSync76(tmpPath, JSON.stringify(state, null, 2) + "\n");
+  writeFileSync77(tmpPath, JSON.stringify(state, null, 2) + "\n");
   renameSync23(tmpPath, statePath);
 }
 function readLocalAccounts(accountsPath, deps) {
-  const existsSync136 = deps.existsSync ?? fs40.existsSync;
-  const readFileSync125 = deps.readFileSync ?? ((p) => fs40.readFileSync(p, "utf-8"));
-  if (!existsSync136(accountsPath)) return null;
-  const raw = readFileSync125(accountsPath);
+  const existsSync137 = deps.existsSync ?? fs40.existsSync;
+  const readFileSync126 = deps.readFileSync ?? ((p) => fs40.readFileSync(p, "utf-8"));
+  if (!existsSync137(accountsPath)) return null;
+  const raw = readFileSync126(accountsPath);
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -33877,9 +34032,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path121, mtimeMs } of result.newerSources) {
+  for (const { path: path122, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path121}  (modified ${when})`);
+    lines.push(`  \u2022 ${path122}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -34259,15 +34414,15 @@ var AGENTMEMORY_LOCAL_URL = "http://host.docker.internal:3111";
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs121 } = await import("node:fs");
-    const { default: os66 } = await import("node:os");
-    const { default: path121 } = await import("node:path");
-    const tp = path121.join(
-      process.env.OLAM_HOME ?? path121.join(os66.homedir(), ".olam"),
+    const { default: fs122 } = await import("node:fs");
+    const { default: os67 } = await import("node:os");
+    const { default: path122 } = await import("node:path");
+    const tp = path122.join(
+      process.env.OLAM_HOME ?? path122.join(os67.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs121.existsSync(tp)) return null;
-    return fs121.readFileSync(tp, "utf-8").trim();
+    if (!fs122.existsSync(tp)) return null;
+    return fs122.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -34767,12 +34922,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs121 } = await import("node:fs");
-    const { default: os66 } = await import("node:os");
-    const { default: path121 } = await import("node:path");
-    const tp = path121.join(os66.homedir(), ".olam", "host-cp.token");
-    if (!fs121.existsSync(tp)) return null;
-    const raw = fs121.readFileSync(tp, "utf-8").trim();
+    const { default: fs122 } = await import("node:fs");
+    const { default: os67 } = await import("node:os");
+    const { default: path122 } = await import("node:path");
+    const tp = path122.join(os67.homedir(), ".olam", "host-cp.token");
+    if (!fs122.existsSync(tp)) return null;
+    const raw = fs122.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -36853,13 +37008,13 @@ var PlansClient = class {
     const credentials = Buffer.from(`operator:${this.cfg.bearer}`).toString("base64");
     return `Basic ${credentials}`;
   }
-  async request(path121, init) {
+  async request(path122, init) {
     const headers = {
       Authorization: this.authHeader()
     };
     if (init.body) headers["content-type"] = "application/json";
     if (init.adminSecret) headers["X-Admin-Secret"] = init.adminSecret;
-    return fetch(`${this.cfg.cloudUrl}${path121}`, {
+    return fetch(`${this.cfg.cloudUrl}${path122}`, {
       method: init.method,
       headers,
       body: init.body ? JSON.stringify(init.body) : void 0
@@ -39410,11 +39565,11 @@ function zodIssueToError(issue, doc, lineCounter) {
     suggestion: deriveSuggestion(issue)
   };
 }
-function formatJsonPath(path121) {
-  if (path121.length === 0)
+function formatJsonPath(path122) {
+  if (path122.length === 0)
     return "<root>";
   let out = "";
-  for (const seg of path121) {
+  for (const seg of path122) {
     if (typeof seg === "number") {
       out += `[${seg}]`;
     } else {
@@ -39423,11 +39578,11 @@ function formatJsonPath(path121) {
   }
   return out;
 }
-function resolveYamlLocation(path121, doc, lineCounter) {
+function resolveYamlLocation(path122, doc, lineCounter) {
   let bestLine = 0;
   let bestColumn = 0;
-  for (let depth = path121.length; depth >= 0; depth -= 1) {
-    const segment = path121.slice(0, depth);
+  for (let depth = path122.length; depth >= 0; depth -= 1) {
+    const segment = path122.slice(0, depth);
     try {
       const node = doc.getIn(segment, true);
       if (node && typeof node === "object" && "range" in node) {
@@ -39645,11 +39800,11 @@ function topoSort(nodes) {
 }
 function traceCycle(start, byId) {
   const seen = /* @__PURE__ */ new Set();
-  const path121 = [];
+  const path122 = [];
   let current = start;
   while (current && !seen.has(current)) {
     seen.add(current);
-    path121.push(current);
+    path122.push(current);
     const node = byId.get(current);
     const next = node?.dependsOn[0];
     if (next === void 0)
@@ -39657,10 +39812,10 @@ function traceCycle(start, byId) {
     current = next;
   }
   if (current && seen.has(current)) {
-    const idx = path121.indexOf(current);
-    return [...path121.slice(idx), current];
+    const idx = path122.indexOf(current);
+    return [...path122.slice(idx), current];
   }
-  return path121;
+  return path122;
 }
 
 // ../core/dist/executor/types.js
@@ -44546,8 +44701,8 @@ function checkWorld(container, hostShas, dockerExec) {
     const m = shaLine.match(/^([a-f0-9]{64})\s+(.+)$/);
     if (!m) continue;
     const sha = m[1];
-    const path121 = m[2];
-    const filename = path121?.split("/").pop();
+    const path122 = m[2];
+    const filename = path122?.split("/").pop();
     if (!filename) continue;
     const mtimeSecs = parseInt(mtimeLine.trim(), 10);
     if (Number.isNaN(mtimeSecs) || !sha) continue;
@@ -45665,9 +45820,9 @@ var TasksClient = class {
     this.olamNodeId = opts.olamNodeId;
     this.sessionId = opts.sessionId;
   }
-  async call(method, path121, scopes, body, query) {
+  async call(method, path122, scopes, body, query) {
     const qs = query ? "?" + new URLSearchParams(Object.entries(query).filter(([, v]) => v !== void 0)).toString() : "";
-    const url2 = `${this.baseUrl}${path121}${qs}`;
+    const url2 = `${this.baseUrl}${path122}${qs}`;
     const res = await fetch(url2, {
       method,
       headers: {
@@ -45718,8 +45873,8 @@ function parseFrontmatter2(raw) {
   }
   return { frontmatter: fm, body };
 }
-function parseTracker(path121) {
-  const raw = readFileSync60(path121, "utf8");
+function parseTracker(path122) {
+  const raw = readFileSync60(path122, "utf8");
   const { frontmatter, body } = parseFrontmatter2(raw);
   const lines = body.split("\n");
   const tasks = [];
@@ -45956,8 +46111,8 @@ function registerTasks(program2) {
 `);
     }
   });
-  tasks.command("sync-tracker <path>").description("Parse /10x:commit-plan tracker.md + upsert each task via POST /api/tasks (B2.4; dual-emit pattern, olam-side per cross-ownership decoupling)").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--dry-run", "Parse + print task records; do not POST").option("--json", "Output raw JSON envelope").action(async (path121, opts) => {
-    const parsed = parseTracker(path121);
+  tasks.command("sync-tracker <path>").description("Parse /10x:commit-plan tracker.md + upsert each task via POST /api/tasks (B2.4; dual-emit pattern, olam-side per cross-ownership decoupling)").option("--node-id <uuid>", "Olam node ID").option("--session-id <uuid>", "Session ID").option("--dry-run", "Parse + print task records; do not POST").option("--json", "Output raw JSON envelope").action(async (path122, opts) => {
+    const parsed = parseTracker(path122);
     if (opts.dryRun) {
       process.stdout.write(JSON.stringify(parsed, null, 2) + "\n");
       return;
@@ -47520,7 +47675,7 @@ function registerSetup(program2) {
     const hasCloudArg = Boolean(
       rawOpts.skillsSource || rawOpts.memoryUrl || rawOpts.remoteMemoryUrl || rawOpts.kgUrl || rawOpts.remoteKgUrl || rawOpts.remoteUrl || rawOpts.remoteDispatchUrl || rawOpts.credentials
     );
-    let path121 = resolveSetupPath2(
+    let path122 = resolveSetupPath2(
       {
         localMode: rawOpts.localMode,
         cloudFirst: rawOpts.cloudFirst || hasCloudArg,
@@ -47530,7 +47685,7 @@ function registerSetup(program2) {
       },
       isTty
     );
-    if (path121 === "prompt") {
+    if (path122 === "prompt") {
       const { select: select2 } = await import("@inquirer/prompts");
       const choice = await select2({
         message: "How do you want to set up olam?",
@@ -47540,9 +47695,9 @@ function registerSetup(program2) {
         ],
         default: "cloud"
       });
-      path121 = choice === "local" ? "local" : "cloud";
+      path122 = choice === "local" ? "local" : "cloud";
     }
-    if (path121 === "cloud") {
+    if (path122 === "cloud") {
       const credentials = rawOpts.credentials === "gcp" ? "gcp" : rawOpts.credentials === "prompt" ? "prompt" : void 0;
       if (rawOpts.credentials !== void 0 && credentials === void 0) {
         process.stderr.write(`[olam setup] invalid --credentials "${rawOpts.credentials}" (expected: gcp | prompt)
@@ -49786,7 +49941,10 @@ var HOOK_BASENAMES = [
   "agentmemory-recall-trigger.mjs",
   "agentmemory-classify-queue.mjs",
   "agentmemory-reflect-cite.mjs",
-  "recall-log.mjs"
+  "recall-log.mjs",
+  // Shared dependency module imported by recall-trigger, classify-queue, and
+  // agentmemory-save. Copied (not registered) — sibling of its importers.
+  "agent-memory-gate.mjs"
 ];
 var SOURCE_ANCHOR = "agentmemory-session-recall.js";
 function resolveSourceDir(here3) {
@@ -49908,9 +50066,19 @@ function installHooks(opts = {}) {
       }
     });
     settings.push(`kg-hook (PreToolUse): ${describeMerge(kgResult.status)}`);
+    const kgPromptResult = mergeHomeSettingsJson(settingsPath, {
+      ensureHook: {
+        stage: "UserPromptSubmit",
+        sentinel: KG_HOOK_PROMPT_SENTINEL,
+        staleSentinelPrefix: KG_HOOK_PROMPT_SENTINEL_PREFIX,
+        entry: buildPromptHookMatcherEntry({ flavor: "host" })
+      }
+    });
+    settings.push(`kg-hook (UserPromptSubmit): ${describeMerge(kgPromptResult.status)}`);
   } else {
     settings.push("save-hook (PostToolUse): dry-run");
     settings.push("kg-hook (PreToolUse): dry-run");
+    settings.push("kg-hook (UserPromptSubmit): dry-run");
   }
   return { filesWritten, filesReplaced, filesUnchanged, backups, settings };
 }
@@ -50558,6 +50726,9 @@ function printSyncSummary(summary2, dryRun, verbose = false) {
         console.log(`    ${pc38.dim("(dropped)")} ${cmd.slice(0, 120)}${cmd.length > 120 ? "\u2026" : ""}`);
       }
     }
+    if (summary2.merge.legacyReclaimed > 0) {
+      console.log(`  ${pc38.dim(`legacy duplicates reclaimed: ${summary2.merge.legacyReclaimed} (pre-marker hook copies collapsed; each olam hook now fires once)`)}`);
+    }
   }
   if (summary2.metaHooks) {
     const mh = summary2.metaHooks;
@@ -53827,7 +53998,7 @@ function resolveBundlePath(candidates2 = BUNDLE_PATH_CANDIDATES, exists = exists
 var MISSING_BUNDLE_REMEDY = "olam mcp server bundle missing. Searched: " + BUNDLE_PATH_CANDIDATES.join(", ") + ". For local dev, run: node packages/cli/scripts/bundle-mcp-server.mjs. A fresh `npm install -g @pleri/olam-cli@latest` should always include the bundle (see prepublishOnly in packages/cli/package.json); file an issue if it does not.";
 function registerMcpServe(cmd) {
   cmd.command("serve").description(
-    "Run the olam MCP server (stdio transport). Claude Code wires this via `claude mcp add olam --scope user -- npx -y @pleri/olam-cli mcp serve`."
+    "Run the olam MCP server (stdio transport). Claude Code wires this via `claude mcp add olam --scope user -- npx -y @pleri/olam-cli@latest mcp serve`."
   ).action(async () => {
     const bundlePath = resolveBundlePath();
     if (bundlePath === null) {
@@ -53845,8 +54016,9 @@ function registerMcpServe(cmd) {
 init_output();
 init_install_shared();
 var NPM_PACKAGE_NAME2 = "@pleri/olam-cli";
+var NPM_PACKAGE_SPEC = `${NPM_PACKAGE_NAME2}@latest`;
 function buildClaudeMcpAddArgs2(scope, useGlobal) {
-  const target = useGlobal ? { cmd: "olam", args: ["mcp", "serve"] } : { cmd: "npx", args: ["-y", NPM_PACKAGE_NAME2, "mcp", "serve"] };
+  const target = useGlobal ? { cmd: "olam", args: ["mcp", "serve"] } : { cmd: "npx", args: ["-y", NPM_PACKAGE_SPEC, "mcp", "serve"] };
   return {
     command: "claude",
     args: ["mcp", "add", "olam", "--scope", scope, "--", target.cmd, ...target.args]
@@ -53956,8 +54128,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path121, init = {}) {
-  const res = await fetch(`${BASE_URL}${path121}`, {
+async function apiFetch(path122, init = {}) {
+  const res = await fetch(`${BASE_URL}${path122}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -54974,18 +55146,29 @@ import { existsSync as existsSync121 } from "node:fs";
 // ../core/dist/memory/gate.js
 init_olam_paths();
 import { readFileSync as readFileSync108 } from "node:fs";
-var TRUTHY_ENV = /* @__PURE__ */ new Set(["1", "true", "on"]);
-var TRUTHY_FILE = /* @__PURE__ */ new Set(["true", "1"]);
-function isAgentMemoryEnabled() {
+var ENV_MODE = /* @__PURE__ */ new Map([
+  ["readonly", "readonly"],
+  ["editor", "editor"],
+  ["1", "readonly"],
+  ["true", "readonly"],
+  ["on", "readonly"]
+]);
+var FILE_MODE = /* @__PURE__ */ new Map([
+  ["readonly", "readonly"],
+  ["editor", "editor"],
+  ["true", "readonly"],
+  ["1", "readonly"]
+]);
+function agentMemoryMode() {
   const envVal = process.env["OLAM_AGENT_MEMORY"];
   if (envVal !== void 0 && envVal.length > 0) {
-    return TRUTHY_ENV.has(envVal.trim().toLowerCase());
+    return ENV_MODE.get(envVal.trim().toLowerCase()) ?? "off";
   }
   try {
     const raw = readFileSync108(agentMemoryEnabledPath(), "utf8").trim().toLowerCase();
-    return TRUTHY_FILE.has(raw);
+    return FILE_MODE.get(raw) ?? "off";
   } catch {
-    return false;
+    return "off";
   }
 }
 
@@ -55039,18 +55222,18 @@ async function runMemoryStatus(opts = {}) {
   printInfo("livez", s.livez);
   printInfo("secret", s.secretSet ? "~/.olam/memory-secret (set)" : "(missing)");
   printInfo("port", `${s.port}`);
-  const gateEnabled = isAgentMemoryEnabled();
+  const mode = agentMemoryMode();
   const envVal = process.env["OLAM_AGENT_MEMORY"];
   const envActive = envVal !== void 0 && envVal.length > 0;
-  if (gateEnabled) {
-    printInfo(
-      "agent-memory",
-      envActive ? `ENABLED (OLAM_AGENT_MEMORY=${envVal} env override)` : `ENABLED (flag file: ${agentMemoryEnabledPath()})`
-    );
+  const source = envActive ? `OLAM_AGENT_MEMORY=${envVal} env override` : `flag file: ${agentMemoryEnabledPath()}`;
+  if (mode === "editor") {
+    printInfo("agent-memory", `EDITOR \u2014 recall + capture (${source})`);
+  } else if (mode === "readonly") {
+    printInfo("agent-memory", `READONLY \u2014 recall only, no capture (${source})`);
   } else {
     printInfo(
       "agent-memory",
-      envActive ? `DISABLED (OLAM_AGENT_MEMORY=${envVal} env override)` : `DISABLED \u2014 enable with \`olam memory enable\``
+      envActive ? `OFF (${source})` : `OFF \u2014 enable with \`olam memory enable\` (--editor for capture)`
     );
   }
   if (s.legacyPidfilePresent) {
@@ -55196,27 +55379,34 @@ init_olam_paths();
 import { mkdirSync as mkdirSync73, writeFileSync as writeFileSync66 } from "node:fs";
 import { dirname as dirname69 } from "node:path";
 init_output();
-function writeGateFlag(enabled) {
+function writeGateFlag(value) {
   const flagPath = agentMemoryEnabledPath();
   mkdirSync73(dirname69(flagPath), { recursive: true });
-  writeFileSync66(flagPath, enabled ? "TRUE\n" : "FALSE\n", { mode: 420 });
+  writeFileSync66(flagPath, `${value}
+`, { mode: 420 });
 }
 function registerMemoryEnable(parent) {
-  parent.command("enable").description("Enable agent-memory recall and capture (writes TRUE to the gate flag file)").action(() => {
-    writeGateFlag(true);
-    const flagPath = agentMemoryEnabledPath();
-    printSuccess(`agent-memory enabled`);
-    printInfo("flag file", flagPath);
-    printInfo("gate", isAgentMemoryEnabled() ? "ENABLED" : "ENABLED (re-read confirms)");
+  parent.command("enable").description(
+    "Enable agent-memory. Default READONLY (recall only); pass --editor for recall + capture."
+  ).option("--editor", "Grant capture (write) access \u2014 fully agentic mode (EDITOR)").option("--readonly", "Recall only, no capture (READONLY) \u2014 the default").action((opts) => {
+    if (opts.editor && opts.readonly) {
+      printInfo("gate", "pass only one of --editor / --readonly");
+      process.exitCode = 1;
+      return;
+    }
+    const value = opts.editor ? "EDITOR" : "READONLY";
+    writeGateFlag(value);
+    printSuccess(`agent-memory enabled (${value})`);
+    printInfo("flag file", agentMemoryEnabledPath());
+    printInfo("mode", agentMemoryMode());
   });
 }
 function registerMemoryDisable(parent) {
   parent.command("disable").description("Disable agent-memory recall and capture (writes FALSE to the gate flag file)").action(() => {
-    writeGateFlag(false);
-    const flagPath = agentMemoryEnabledPath();
+    writeGateFlag("FALSE");
     printSuccess(`agent-memory disabled`);
-    printInfo("flag file", flagPath);
-    printInfo("gate", isAgentMemoryEnabled() ? "DISABLED (re-read confirms)" : "DISABLED");
+    printInfo("flag file", agentMemoryEnabledPath());
+    printInfo("mode", agentMemoryMode());
   });
 }
 
@@ -55581,13 +55771,13 @@ function resolveMemoryServiceDir() {
   );
 }
 function resolveLocalBridgeScript(serviceDir) {
-  const path121 = join126(serviceDir, "scripts", "local-bridge-server.mjs");
-  if (!existsSync123(path121)) {
+  const path122 = join126(serviceDir, "scripts", "local-bridge-server.mjs");
+  if (!existsSync123(path122)) {
     throw new Error(
-      `Could not find local-bridge-server.mjs at ${path121}. Verify packages/memory-service ships the scripts/ directory.`
+      `Could not find local-bridge-server.mjs at ${path122}. Verify packages/memory-service ships the scripts/ directory.`
     );
   }
-  return path121;
+  return path122;
 }
 function validateBridgeOpts(opts) {
   const local = opts.local ?? true;
@@ -56446,18 +56636,179 @@ function registerInboxInstallHookCommand(inbox) {
   });
 }
 
+// src/commands/inbox-toggle.ts
+init_merge_settings();
+import * as fs112 from "node:fs";
+import * as os60 from "node:os";
+import * as path112 from "node:path";
+init_output();
+var INBOX_ENV_KEY = "OLAM_QUESTION_INBOX";
+var OPT_OUT_VALUE = "0";
+function isOptOutValue(v) {
+  const s = (v ?? "").toLowerCase();
+  return s === "0" || s === "false" || s === "off" || s === "no";
+}
+function resolveScope(opts) {
+  return opts.scope === "project" ? "project" : "user";
+}
+function localBrokerBasePresent() {
+  return fs112.existsSync(path112.join(os60.homedir(), ".olam", "anthropic-base-url"));
+}
+function readPersistedOptOut(filePath) {
+  if (!fs112.existsSync(filePath)) return void 0;
+  const raw = fs112.readFileSync(filePath, "utf-8");
+  if (!raw.trim()) return void 0;
+  let settings;
+  try {
+    settings = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const env = settings["env"];
+  if (!env || typeof env !== "object") return void 0;
+  const val = env[INBOX_ENV_KEY];
+  return typeof val === "string" ? val : void 0;
+}
+function doDisable(scope) {
+  const filePath = settingsPathFor3(scope);
+  let result;
+  try {
+    result = mergeHomeSettingsJson(filePath, { env: { [INBOX_ENV_KEY]: OPT_OUT_VALUE } });
+  } catch (err) {
+    printError(
+      `could not update ${filePath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (result.status === "installed") {
+    printSuccess(`question inbox DISABLED (${scope} scope)`);
+  } else {
+    printInfo("inbox", `already disabled (${scope} scope)`);
+  }
+  printInfo("settings", filePath);
+  printInfo("effect", "new Claude Code sessions answer AskUserQuestion in the terminal");
+  printInfo("re-enable", `olam inbox enable --scope ${scope}`);
+}
+function doEnable(scope) {
+  const filePath = settingsPathFor3(scope);
+  if (!fs112.existsSync(filePath)) {
+    printInfo("inbox", `no settings at ${filePath} \u2014 already at default (ON for local)`);
+    return;
+  }
+  const raw = fs112.readFileSync(filePath, "utf-8");
+  if (!raw.trim()) {
+    printInfo("inbox", `settings empty at ${filePath} \u2014 already at default (ON for local)`);
+    return;
+  }
+  let settings;
+  try {
+    settings = JSON.parse(raw);
+  } catch {
+    printError(`could not parse ${filePath} \u2014 no changes made`);
+    process.exitCode = 1;
+    return;
+  }
+  const env = settings["env"];
+  if (!env || typeof env !== "object" || !(INBOX_ENV_KEY in env)) {
+    printInfo("inbox", `not disabled at this scope (${scope}) \u2014 nothing to enable`);
+    return;
+  }
+  const nextEnv = { ...env };
+  delete nextEnv[INBOX_ENV_KEY];
+  const updated = { ...settings, env: nextEnv };
+  const backupPath = backup2(filePath);
+  try {
+    fs112.writeFileSync(filePath, JSON.stringify(updated, null, 2) + "\n", { mode: 420 });
+  } catch (err) {
+    printError(
+      `could not write ${filePath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    if (backupPath) printInfo("backup", `settings.json preserved at ${backupPath}`);
+    process.exitCode = 1;
+    return;
+  }
+  printSuccess(`question inbox ENABLED (${scope} scope) \u2014 default-ON restored`);
+  printInfo("settings", filePath);
+  if (backupPath) printInfo("backup", backupPath);
+  if (!localBrokerBasePresent()) {
+    printInfo(
+      "note",
+      "no ~/.olam/anthropic-base-url found \u2014 inbox stays inactive until cloud auth is set up (olam auth issue-anthropic-token)"
+    );
+  }
+}
+function doStatus(scope) {
+  const filePath = settingsPathFor3(scope);
+  const persisted = readPersistedOptOut(filePath);
+  const brokerUrl = process.env.OLAM_QUESTION_BROKER_URL;
+  const runtimeOptOut = process.env[INBOX_ENV_KEY];
+  const basePresent = localBrokerBasePresent();
+  printInfo("scope", `${scope} (${filePath})`);
+  printInfo(
+    `${INBOX_ENV_KEY} (persisted)`,
+    persisted === void 0 ? "(unset)" : JSON.stringify(persisted)
+  );
+  if (runtimeOptOut !== void 0) {
+    printInfo(`${INBOX_ENV_KEY} (current env)`, JSON.stringify(runtimeOptOut));
+  }
+  printInfo("~/.olam/anthropic-base-url", basePresent ? "present" : "absent");
+  if (brokerUrl) printInfo("OLAM_QUESTION_BROKER_URL", "set (forces inbox ON)");
+  let on;
+  let reason;
+  if (brokerUrl) {
+    on = true;
+    reason = "OLAM_QUESTION_BROKER_URL is set (explicit/CF override)";
+  } else if (isOptOutValue(persisted)) {
+    on = false;
+    reason = `${INBOX_ENV_KEY}=${JSON.stringify(persisted)} opts out`;
+  } else if (basePresent) {
+    on = true;
+    reason = "default-ON (anthropic-base-url present, not opted out)";
+  } else {
+    on = false;
+    reason = "no broker base (~/.olam/anthropic-base-url absent) \u2192 passthrough";
+  }
+  if (on) {
+    printInfo("inbox interception", `ON \u2014 ${reason}`);
+  } else {
+    printSuccess(`inbox interception: OFF \u2014 ${reason}`);
+  }
+}
+function scopeOption(cmd) {
+  return cmd.option(
+    "--scope <scope>",
+    "user (default; ~/.claude/settings.json) or project (<cwd>/.claude/settings.json)",
+    "user"
+  );
+}
+function registerInboxToggleCommands(inbox) {
+  scopeOption(
+    inbox.command("disable").description(
+      "Stop routing AskUserQuestion to the mobile inbox; answer in the terminal instead"
+    )
+  ).action((opts) => doDisable(resolveScope(opts)));
+  scopeOption(
+    inbox.command("enable").description("Re-enable inbox routing for AskUserQuestion (restore default-ON)")
+  ).action((opts) => doEnable(resolveScope(opts)));
+  scopeOption(
+    inbox.command("status").description("Show whether AskUserQuestion is routed to the inbox in this scope")
+  ).action((opts) => doStatus(resolveScope(opts)));
+}
+
 // src/commands/inbox/index.ts
 function registerInbox(program2) {
   const inbox = program2.command("inbox").description("Mobile question-inbox operations (route AskUserQuestion to phone)");
   registerInboxInstallHookCommand(inbox);
+  registerInboxToggleCommands(inbox);
 }
 
 // src/commands/kg-build.ts
 init_storage_paths();
 init_workspace_name();
-import * as fs117 from "node:fs";
-import * as os63 from "node:os";
-import * as path117 from "node:path";
+import * as fs118 from "node:fs";
+import * as os64 from "node:os";
+import * as path118 from "node:path";
 
 // ../core/dist/kg/kg-service-client.js
 var KG_SERVICE_PORT_DEFAULT = 9997;
@@ -56468,8 +56819,8 @@ function port() {
   const n = Number.parseInt(env, 10);
   return Number.isFinite(n) && n > 0 ? n : KG_SERVICE_PORT_DEFAULT;
 }
-function url(path121) {
-  return `http://127.0.0.1:${port()}${path121}`;
+function url(path122) {
+  return `http://127.0.0.1:${port()}${path122}`;
 }
 function kgServiceHealthUrl() {
   return url("/health");
@@ -56549,39 +56900,39 @@ init_storage_paths();
 init_workspace_name();
 init_kg_caps();
 init_output();
-import fs112 from "node:fs";
-import { homedir as homedir75 } from "node:os";
-import path112 from "node:path";
+import fs113 from "node:fs";
+import { homedir as homedir76 } from "node:os";
+import path113 from "node:path";
 function olamHome6() {
-  return process.env.OLAM_HOME ?? path112.join(homedir75(), ".olam");
+  return process.env.OLAM_HOME ?? path113.join(homedir76(), ".olam");
 }
 function kgRoot2() {
-  return path112.join(olamHome6(), "kg");
+  return path113.join(olamHome6(), "kg");
 }
 function worldsRoot2() {
-  return path112.join(olamHome6(), "worlds");
+  return path113.join(olamHome6(), "worlds");
 }
 function dirSizeBytes2(dir) {
-  if (!fs112.existsSync(dir)) return 0;
+  if (!fs113.existsSync(dir)) return 0;
   let total = 0;
   const stack = [dir];
   while (stack.length > 0) {
     const cur = stack.pop();
     let entries;
     try {
-      entries = fs112.readdirSync(cur, { withFileTypes: true });
+      entries = fs113.readdirSync(cur, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const full = path112.join(cur, entry.name);
+      const full = path113.join(cur, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
       }
       try {
-        total += fs112.statSync(full).size;
+        total += fs113.statSync(full).size;
       } catch {
       }
     }
@@ -56595,10 +56946,10 @@ function formatBytes5(n) {
   return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 function readFreshness(workspace) {
-  const file = path112.join(kgPristinePath(workspace), "freshness.json");
-  if (!fs112.existsSync(file)) return null;
+  const file = path113.join(kgPristinePath(workspace), "freshness.json");
+  if (!fs113.existsSync(file)) return null;
   try {
-    const raw = JSON.parse(fs112.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs113.readFileSync(file, "utf-8"));
     if (raw && typeof raw === "object") return raw;
     return null;
   } catch {
@@ -56606,10 +56957,10 @@ function readFreshness(workspace) {
   }
 }
 function readOverlayNodeCount(graphifyOutDir) {
-  const graphPath = path112.join(graphifyOutDir, "graph.json");
-  if (!fs112.existsSync(graphPath)) return null;
+  const graphPath = path113.join(graphifyOutDir, "graph.json");
+  if (!fs113.existsSync(graphPath)) return null;
   try {
-    const raw = JSON.parse(fs112.readFileSync(graphPath, "utf-8"));
+    const raw = JSON.parse(fs113.readFileSync(graphPath, "utf-8"));
     if (raw && typeof raw === "object") {
       const nodes = raw.nodes;
       if (Array.isArray(nodes)) return nodes.length;
@@ -56621,28 +56972,28 @@ function readOverlayNodeCount(graphifyOutDir) {
 }
 function listOverlays() {
   const root = worldsRoot2();
-  if (!fs112.existsSync(root)) return [];
+  if (!fs113.existsSync(root)) return [];
   const records = [];
   let worldDirs;
   try {
-    worldDirs = fs112.readdirSync(root, { withFileTypes: true });
+    worldDirs = fs113.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
   for (const worldEntry of worldDirs) {
     if (!worldEntry.isDirectory()) continue;
     const worldId = worldEntry.name;
-    const worldDir = path112.join(root, worldId);
+    const worldDir = path113.join(root, worldId);
     let cloneDirs;
     try {
-      cloneDirs = fs112.readdirSync(worldDir, { withFileTypes: true });
+      cloneDirs = fs113.readdirSync(worldDir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const cloneEntry of cloneDirs) {
       if (!cloneEntry.isDirectory()) continue;
-      const graphifyOut = path112.join(worldDir, cloneEntry.name, "graphify-out");
-      if (!fs112.existsSync(graphifyOut)) continue;
+      const graphifyOut = path113.join(worldDir, cloneEntry.name, "graphify-out");
+      if (!fs113.existsSync(graphifyOut)) continue;
       records.push({
         world_id: worldId,
         clone_dir: cloneEntry.name,
@@ -56656,11 +57007,11 @@ function listOverlays() {
 }
 function listPristines(overlays) {
   const root = kgRoot2();
-  if (!fs112.existsSync(root)) return [];
+  if (!fs113.existsSync(root)) return [];
   const records = [];
   let entries;
   try {
-    entries = fs112.readdirSync(root, { withFileTypes: true });
+    entries = fs113.readdirSync(root, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -56673,7 +57024,7 @@ function listPristines(overlays) {
       continue;
     }
     const fresh = readFreshness(workspace);
-    const graphifyOut = path112.join(kgPristinePath(workspace), "graphify-out");
+    const graphifyOut = path113.join(kgPristinePath(workspace), "graphify-out");
     const size = dirSizeBytes2(graphifyOut);
     const worldCount = overlays.filter((o) => o.clone_dir === workspace).length;
     records.push({
@@ -56809,10 +57160,10 @@ init_storage_paths();
 init_workspace_name();
 init_output();
 import { spawn as spawn13 } from "node:child_process";
-import fs113 from "node:fs";
-import path113 from "node:path";
+import fs114 from "node:fs";
+import path114 from "node:path";
 function pidFilePath2(workspace) {
-  return path113.join(kgPristinePath(workspace), ".watch.pid");
+  return path114.join(kgPristinePath(workspace), ".watch.pid");
 }
 function isPidAlive3(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -56827,39 +57178,39 @@ function isPidAlive3(pid) {
 }
 function readAndClassifyPid(workspace) {
   const file = pidFilePath2(workspace);
-  if (!fs113.existsSync(file)) return { status: "no-pidfile", pid: null };
+  if (!fs114.existsSync(file)) return { status: "no-pidfile", pid: null };
   let pid;
   try {
-    const raw = fs113.readFileSync(file, "utf-8").trim();
+    const raw = fs114.readFileSync(file, "utf-8").trim();
     pid = Number.parseInt(raw, 10);
   } catch {
-    fs113.rmSync(file, { force: true });
+    fs114.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (!Number.isInteger(pid) || pid <= 0) {
-    fs113.rmSync(file, { force: true });
+    fs114.rmSync(file, { force: true });
     return { status: "stale-reclaimed", pid: null };
   }
   if (isPidAlive3(pid)) return { status: "active", pid };
-  fs113.rmSync(file, { force: true });
+  fs114.rmSync(file, { force: true });
   return { status: "stale-reclaimed", pid: null };
 }
 function writePidFile2(workspace, pid) {
   const file = pidFilePath2(workspace);
-  const dir = path113.dirname(file);
-  fs113.mkdirSync(dir, { recursive: true });
-  fs113.writeFileSync(file, String(pid), { encoding: "utf-8" });
+  const dir = path114.dirname(file);
+  fs114.mkdirSync(dir, { recursive: true });
+  fs114.writeFileSync(file, String(pid), { encoding: "utf-8" });
 }
 function removePidFile(workspace) {
   const file = pidFilePath2(workspace);
   try {
-    fs113.rmSync(file, { force: true });
+    fs114.rmSync(file, { force: true });
   } catch {
   }
 }
 async function runKgWatch(workspaceArg, opts, deps = {}) {
   const cwd = deps.cwd ?? opts.cwd ?? process.cwd();
-  const name = workspaceArg ?? path113.basename(cwd).toLowerCase();
+  const name = workspaceArg ?? path114.basename(cwd).toLowerCase();
   try {
     validateWorkspaceName(name);
   } catch (err) {
@@ -56867,7 +57218,7 @@ async function runKgWatch(workspaceArg, opts, deps = {}) {
     return { exitCode: 1, pidWritten: false };
   }
   const pristinePath = kgPristinePath(name);
-  const graphPath = path113.join(pristinePath, "graphify-out", "graph.json");
+  const graphPath = path114.join(pristinePath, "graphify-out", "graph.json");
   const pidState = readAndClassifyPid(name);
   if (pidState.status === "active") {
     printError(
@@ -57180,33 +57531,33 @@ function registerKgDoctorCommand(kg) {
 init_merge_settings();
 init_hook_template2();
 init_output();
-import * as fs114 from "node:fs";
-import * as path114 from "node:path";
-import * as os60 from "node:os";
+import * as fs115 from "node:fs";
+import * as path115 from "node:path";
+import * as os61 from "node:os";
 import { parse as yamlParse3, stringify as yamlStringify4 } from "yaml";
 function settingsPathFor4(scope) {
   if (scope === "user") {
-    return path114.join(os60.homedir(), ".claude", "settings.json");
+    return path115.join(os61.homedir(), ".claude", "settings.json");
   }
-  return path114.join(process.cwd(), ".claude", "settings.json");
+  return path115.join(process.cwd(), ".claude", "settings.json");
 }
 function backup3(filePath) {
-  if (!fs114.existsSync(filePath)) return null;
+  if (!fs115.existsSync(filePath)) return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
-  fs114.copyFileSync(filePath, backupPath);
+  fs115.copyFileSync(filePath, backupPath);
   return backupPath;
 }
 var HERMES_HOOK_MATCHERS = ["terminal", "bash", "shell", "search_files", "grep", "ripgrep"];
 function hermesConfigPath2() {
-  return path114.join(os60.homedir(), ".hermes", "config.yaml");
+  return path115.join(os61.homedir(), ".hermes", "config.yaml");
 }
 function hermesHooksDir() {
-  return path114.join(os60.homedir(), ".hermes", "hooks");
+  return path115.join(os61.homedir(), ".hermes", "hooks");
 }
 function patchHermesConfigForHook(action) {
   const configPath = hermesConfigPath2();
-  const raw = fs114.readFileSync(configPath, "utf-8");
+  const raw = fs115.readFileSync(configPath, "utf-8");
   const config = yamlParse3(raw);
   const hooks = config["hooks"] ?? {};
   const preToolCall = Array.isArray(hooks["pre_tool_call"]) ? hooks["pre_tool_call"] : [];
@@ -57215,7 +57566,7 @@ function patchHermesConfigForHook(action) {
       (e) => typeof e["command"] === "string" && e["command"].includes(HERMES_KG_HOOK_SENTINEL)
     );
     if (alreadyPresent) return "already-present";
-    const hookScriptPath = path114.join(hermesHooksDir(), "kg-first.sh");
+    const hookScriptPath = path115.join(hermesHooksDir(), "kg-first.sh");
     const entry = {
       matcher: HERMES_HOOK_MATCHERS.join("|"),
       command: `${hookScriptPath} # ${HERMES_KG_HOOK_SENTINEL}`
@@ -57225,7 +57576,7 @@ function patchHermesConfigForHook(action) {
       hooks: { ...hooks, pre_tool_call: [...preToolCall, entry] },
       hooks_auto_accept: true
     };
-    fs114.writeFileSync(configPath, yamlStringify4(updated2), "utf-8");
+    fs115.writeFileSync(configPath, yamlStringify4(updated2), "utf-8");
     return "patched";
   }
   const filtered = preToolCall.filter(
@@ -57236,12 +57587,12 @@ function patchHermesConfigForHook(action) {
     ...config,
     hooks: { ...hooks, pre_tool_call: filtered }
   };
-  fs114.writeFileSync(configPath, yamlStringify4(updated), "utf-8");
+  fs115.writeFileSync(configPath, yamlStringify4(updated), "utf-8");
   return "patched";
 }
 function doInstallForHermes() {
   const configPath = hermesConfigPath2();
-  if (!fs114.existsSync(configPath)) {
+  if (!fs115.existsSync(configPath)) {
     printError(`~/.hermes/config.yaml not found at ${configPath}`);
     printInfo("remedy", "Install Hermes first, then re-run `olam kg install-hook --for hermes`");
     process.exitCode = 1;
@@ -57269,17 +57620,17 @@ function doInstallForHermes() {
 function doUninstallForHermes() {
   const configPath = hermesConfigPath2();
   const hooksDir = hermesHooksDir();
-  const hookScriptPath = path114.join(hooksDir, "kg-first.sh");
+  const hookScriptPath = path115.join(hooksDir, "kg-first.sh");
   let scriptRemoved = false;
-  if (fs114.existsSync(hookScriptPath)) {
-    const content = fs114.readFileSync(hookScriptPath, "utf-8");
+  if (fs115.existsSync(hookScriptPath)) {
+    const content = fs115.readFileSync(hookScriptPath, "utf-8");
     if (content.includes(HERMES_KG_HOOK_SENTINEL)) {
-      fs114.unlinkSync(hookScriptPath);
+      fs115.unlinkSync(hookScriptPath);
       scriptRemoved = true;
     }
   }
   let configPatched = false;
-  if (fs114.existsSync(configPath)) {
+  if (fs115.existsSync(configPath)) {
     const result = patchHermesConfigForHook("uninstall");
     configPatched = result === "patched";
   }
@@ -57304,9 +57655,9 @@ function registerKgInstallHookCommand(kg) {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor4(scope);
     try {
-      fs114.mkdirSync(path114.dirname(filePath), { recursive: true });
+      fs115.mkdirSync(path115.dirname(filePath), { recursive: true });
     } catch (err) {
-      printError(`could not create ${path114.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
+      printError(`could not create ${path115.dirname(filePath)}: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
       return;
     }
@@ -57320,6 +57671,14 @@ function registerKgInstallHookCommand(kg) {
           entry: buildHookMatcherEntry({ flavor: "host" })
         }
       });
+      mergeHomeSettingsJson(filePath, {
+        ensureHook: {
+          stage: "UserPromptSubmit",
+          sentinel: KG_HOOK_PROMPT_SENTINEL,
+          staleSentinelPrefix: KG_HOOK_PROMPT_SENTINEL_PREFIX,
+          entry: buildPromptHookMatcherEntry({ flavor: "host" })
+        }
+      });
       switch (result.status) {
         case "installed":
           printSuccess(`kg-service hook installed (${scope} scope)`);
@@ -57331,7 +57690,7 @@ function registerKgInstallHookCommand(kg) {
           printInfo("kg-service hook", `already installed at ${filePath}`);
           if (backupPath) {
             try {
-              fs114.unlinkSync(backupPath);
+              fs115.unlinkSync(backupPath);
             } catch {
             }
           }
@@ -57351,22 +57710,22 @@ function registerKgInstallHookCommand(kg) {
 // src/commands/kg-uninstall-hook.ts
 init_hook_template2();
 init_output();
-import * as fs115 from "node:fs";
-import * as path115 from "node:path";
-import * as os61 from "node:os";
+import * as fs116 from "node:fs";
+import * as path116 from "node:path";
+import * as os62 from "node:os";
 function settingsPathFor5(scope) {
   if (scope === "user") {
-    return path115.join(os61.homedir(), ".claude", "settings.json");
+    return path116.join(os62.homedir(), ".claude", "settings.json");
   }
-  return path115.join(process.cwd(), ".claude", "settings.json");
+  return path116.join(process.cwd(), ".claude", "settings.json");
 }
-function dropSentinel(matchers) {
+function dropSentinel(matchers, sentinelPrefix) {
   let changed = false;
   const out = [];
   for (const matcher of matchers) {
     const innerHooks = matcher.hooks ?? [];
     const keptInner = innerHooks.filter((h) => {
-      if (typeof h.command === "string" && h.command.includes(KG_HOOK_SENTINEL_PREFIX)) {
+      if (typeof h.command === "string" && h.command.includes(sentinelPrefix)) {
         changed = true;
         return false;
       }
@@ -57388,13 +57747,13 @@ function registerKgUninstallHookCommand(kg) {
   kg.command("uninstall-hook").description("Remove kg-service PreToolUse hook from .claude/settings.json (sentinel-matched; surgical)").option("--scope <scope>", "project (default) or user", "project").action((opts) => {
     const scope = opts.scope === "user" ? "user" : "project";
     const filePath = settingsPathFor5(scope);
-    if (!fs115.existsSync(filePath)) {
+    if (!fs116.existsSync(filePath)) {
       printInfo("kg-service hook", `no settings.json at ${filePath} \u2014 nothing to remove`);
       return;
     }
     let settings;
     try {
-      const raw = fs115.readFileSync(filePath, "utf-8");
+      const raw = fs116.readFileSync(filePath, "utf-8");
       settings = raw.trim() ? JSON.parse(raw) : {};
     } catch (err) {
       printError(`could not parse ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
@@ -57402,38 +57761,36 @@ function registerKgUninstallHookCommand(kg) {
       return;
     }
     const preToolUse = settings.hooks?.PreToolUse;
-    if (!Array.isArray(preToolUse) || preToolUse.length === 0) {
-      printInfo("kg-service hook", `no PreToolUse hooks at ${filePath} \u2014 nothing to remove`);
+    const promptSubmit = settings.hooks?.UserPromptSubmit;
+    const hasPre = Array.isArray(preToolUse) && preToolUse.length > 0;
+    const hasPrompt = Array.isArray(promptSubmit) && promptSubmit.length > 0;
+    if (!hasPre && !hasPrompt) {
+      printInfo("kg-service hook", `no kg hooks at ${filePath} \u2014 nothing to remove`);
       return;
     }
-    const { matchers, changed } = dropSentinel(preToolUse);
-    if (!changed) {
+    const preResult = hasPre ? dropSentinel(preToolUse, KG_HOOK_SENTINEL_PREFIX) : { matchers: [], changed: false };
+    const promptResult = hasPrompt ? dropSentinel(promptSubmit, KG_HOOK_PROMPT_SENTINEL_PREFIX) : { matchers: [], changed: false };
+    if (!preResult.changed && !promptResult.changed) {
       printInfo("kg-service hook", `not found in ${filePath} \u2014 already uninstalled`);
       return;
     }
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const backupPath = `${filePath}.olam-bak.${ts}`;
     try {
-      fs115.copyFileSync(filePath, backupPath);
+      fs116.copyFileSync(filePath, backupPath);
     } catch {
     }
-    const next = {
-      ...settings,
-      hooks: {
-        ...settings.hooks,
-        PreToolUse: matchers
-      }
-    };
-    if (matchers.length === 0) {
-      const otherStages = Object.keys(next.hooks ?? {}).filter((k) => k !== "PreToolUse");
-      if (otherStages.length === 0) {
-        delete next.hooks;
-      } else {
-        delete next.hooks.PreToolUse;
-      }
+    const nextHooks = { ...settings.hooks };
+    if (hasPre) nextHooks.PreToolUse = preResult.matchers;
+    if (hasPrompt) nextHooks.UserPromptSubmit = promptResult.matchers;
+    if (hasPre && preResult.matchers.length === 0) delete nextHooks.PreToolUse;
+    if (hasPrompt && promptResult.matchers.length === 0) delete nextHooks.UserPromptSubmit;
+    const next = { ...settings, hooks: nextHooks };
+    if (Object.keys(nextHooks).length === 0) {
+      delete next.hooks;
     }
     try {
-      fs115.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
+      fs116.writeFileSync(filePath, JSON.stringify(next, null, 2) + "\n");
       printSuccess(`kg-service hook removed from ${filePath}`);
       printInfo("backup", backupPath);
     } catch (err) {
@@ -57506,15 +57863,15 @@ function registerKgSavingsCommand(kg) {
 
 // src/commands/kg-mirror.ts
 init_output();
-import * as fs116 from "node:fs";
-import * as os62 from "node:os";
-import * as path116 from "node:path";
+import * as fs117 from "node:fs";
+import * as os63 from "node:os";
+import * as path117 from "node:path";
 function readEnvOrFile(envVar, fileName) {
   const fromEnv = process.env[envVar];
   if (fromEnv && fromEnv.length > 0) return fromEnv.trim();
   try {
-    const file = path116.join(os62.homedir(), ".olam", fileName);
-    const content = fs116.readFileSync(file, "utf-8").trim();
+    const file = path117.join(os63.homedir(), ".olam", fileName);
+    const content = fs117.readFileSync(file, "utf-8").trim();
     if (content.length > 0) return content;
   } catch {
   }
@@ -57776,14 +58133,14 @@ async function runKgMirrorGraph(symbol, options = {}) {
 function guessGitUrl(workspace) {
   try {
     const { spawnSync: spawnSync36 } = __require("node:child_process");
-    const cwd = path116.resolve(process.cwd());
+    const cwd = path117.resolve(process.cwd());
     const candidates2 = [
       cwd,
-      path116.join(path116.dirname(cwd), workspace),
-      path116.join(os62.homedir(), "Projects", workspace)
+      path117.join(path117.dirname(cwd), workspace),
+      path117.join(os63.homedir(), "Projects", workspace)
     ];
     for (const dir of candidates2) {
-      if (!fs116.existsSync(path116.join(dir, ".git"))) continue;
+      if (!fs117.existsSync(path117.join(dir, ".git"))) continue;
       const r = spawnSync36("git", ["-C", dir, "remote", "get-url", "origin"], {
         encoding: "utf-8"
       });
@@ -57821,12 +58178,12 @@ function registerKgMirrorCommand(kg) {
 // src/commands/kg-connect.ts
 init_memory_secret();
 init_connect_url();
-import { existsSync as existsSync129, readFileSync as readFileSync115 } from "node:fs";
-import { homedir as homedir79 } from "node:os";
-import { join as join133 } from "node:path";
+import { existsSync as existsSync130, readFileSync as readFileSync116 } from "node:fs";
+import { homedir as homedir80 } from "node:os";
+import { join as join134 } from "node:path";
 init_output();
 function olamFile(name) {
-  return join133(homedir79(), ".olam", name);
+  return join134(homedir80(), ".olam", name);
 }
 function safeUrl3(url2) {
   try {
@@ -57847,7 +58204,7 @@ function registerKgConnectCommand(kg) {
       return;
     }
     const urlPath = olamFile("kg-proxy-url");
-    const previous = existsSync129(urlPath) ? readFileSync115(urlPath, "utf8").trim() : "";
+    const previous = existsSync130(urlPath) ? readFileSync116(urlPath, "utf8").trim() : "";
     writeSecretAtPath(urlPath, classifierUrl);
     if (opts.bearer) writeSecretAtPath(olamFile("kg-proxy-bearer"), opts.bearer);
     if (opts.builderUrl) {
@@ -57882,8 +58239,8 @@ function registerKgConnectCommand(kg) {
 
 // src/commands/kg-build.ts
 function readQueueFromDisk(queuePath) {
-  if (!fs117.existsSync(queuePath)) return [];
-  const raw = fs117.readFileSync(queuePath, "utf-8");
+  if (!fs118.existsSync(queuePath)) return [];
+  const raw = fs118.readFileSync(queuePath, "utf-8");
   const entries = [];
   for (const line of raw.split("\n")) {
     const t = line.trim();
@@ -57896,14 +58253,14 @@ function readQueueFromDisk(queuePath) {
   return entries;
 }
 function writeQueueToDisk(queuePath, entries) {
-  fs117.mkdirSync(path117.dirname(queuePath), { recursive: true });
+  fs118.mkdirSync(path118.dirname(queuePath), { recursive: true });
   const content = entries.map((e) => JSON.stringify(e)).join("\n") + (entries.length > 0 ? "\n" : "");
-  fs117.writeFileSync(queuePath, content, "utf-8");
+  fs118.writeFileSync(queuePath, content, "utf-8");
 }
 async function runKgBuildPending(opts = {}) {
   const queuePath = opts.queuePath ?? (() => {
-    const stateDir2 = process.env["OLAM_STATE_DIR"] ?? path117.join(os63.homedir(), ".olam", "state");
-    return path117.join(stateDir2, "kg-pending.jsonl");
+    const stateDir2 = process.env["OLAM_STATE_DIR"] ?? path118.join(os64.homedir(), ".olam", "state");
+    return path118.join(stateDir2, "kg-pending.jsonl");
   })();
   const readQueue2 = opts.readQueueFn ?? readQueueFromDisk;
   const writeQueue2 = opts.writeQueueFn ?? writeQueueToDisk;
@@ -57919,7 +58276,7 @@ async function runKgBuildPending(opts = {}) {
   const remaining = [];
   for (const entry of deduped) {
     const repoPath = entry.path;
-    const workspaceName = path117.basename(repoPath).toLowerCase();
+    const workspaceName = path118.basename(repoPath).toLowerCase();
     printInfo("kg build --pending", `building ${repoPath} (workspace=${workspaceName})`);
     let containerPath;
     try {
@@ -57957,20 +58314,20 @@ async function runKgBuildPending(opts = {}) {
 }
 function resolveWorkspace(arg) {
   const cwd = process.cwd();
-  const name = arg ?? path117.basename(cwd).toLowerCase();
+  const name = arg ?? path118.basename(cwd).toLowerCase();
   validateWorkspaceName(name);
   return { name, sourcePath: cwd };
 }
 function toContainerPath(hostPath) {
-  const home = os63.homedir();
-  const resolved = path117.resolve(hostPath);
-  if (!resolved.startsWith(home + path117.sep) && resolved !== home) {
+  const home = os64.homedir();
+  const resolved = path118.resolve(hostPath);
+  if (!resolved.startsWith(home + path118.sep) && resolved !== home) {
     throw new Error(
       `source path "${resolved}" is not under $HOME (${home}). kg-service can only build repos that live under your home dir (it bind-mounts $HOME:/host-home:ro at start). Move the repo or set OLAM_HOME if you need a different root.`
     );
   }
-  const rel = path117.relative(home, resolved);
-  return rel === "" ? "/host-home" : path117.posix.join("/host-home", rel.split(path117.sep).join("/"));
+  const rel = path118.relative(home, resolved);
+  return rel === "" ? "/host-home" : path118.posix.join("/host-home", rel.split(path118.sep).join("/"));
 }
 async function runKgBuild(workspaceArg, options = {}) {
   let workspace;
@@ -57988,7 +58345,7 @@ async function runKgBuild(workspaceArg, options = {}) {
     return { exitCode: 2 };
   }
   const outDir = kgPristinePath(workspace.name);
-  fs117.mkdirSync(outDir, { recursive: true });
+  fs118.mkdirSync(outDir, { recursive: true });
   const human = !options.json;
   if (human) {
     printInfo("kg build", `workspace=${workspace.name} source=${workspace.sourcePath}`);
@@ -58021,12 +58378,12 @@ async function runKgBuild(workspaceArg, options = {}) {
     workspace: workspace.name,
     graphify_path: "container"
   };
-  fs117.writeFileSync(
-    path117.join(outDir, "freshness.json"),
+  fs118.writeFileSync(
+    path118.join(outDir, "freshness.json"),
     JSON.stringify(freshness, null, 2) + "\n",
     "utf-8"
   );
-  const finalOut = path117.join(outDir, "graphify-out");
+  const finalOut = path118.join(outDir, "graphify-out");
   if (options.json) {
     process.stdout.write(JSON.stringify(freshness) + "\n");
   } else {
@@ -58070,12 +58427,12 @@ function registerKg(program2) {
 // src/commands/flywheel/emit-breadcrumb.ts
 init_file_lock();
 import { mkdirSync as mkdirSync77, appendFileSync as appendFileSync6 } from "node:fs";
-import { homedir as homedir81 } from "node:os";
-import { dirname as dirname74, join as join135 } from "node:path";
+import { homedir as homedir82 } from "node:os";
+import { dirname as dirname74, join as join136 } from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 var VALID_SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "low", "info", "warn"]);
 var PROMPT_FEEDING_FIELDS = ["extracted_pattern", "severity", "affected_persona", "proposed_edit"];
-var BREADCRUMBS_BASE = join135(homedir81(), ".local", "share", "claude", "breadcrumbs");
+var BREADCRUMBS_BASE = join136(homedir82(), ".local", "share", "claude", "breadcrumbs");
 var LOCK_FILENAME = ".flywheel-emit.lock";
 function buildRecord(opts) {
   const rec = {
@@ -58122,7 +58479,7 @@ function validatePromptFeeding(rec) {
 }
 function destPath(projectSlug) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  return join135(BREADCRUMBS_BASE, projectSlug, `${today}.jsonl`);
+  return join136(BREADCRUMBS_BASE, projectSlug, `${today}.jsonl`);
 }
 async function emitBreadcrumb(opts) {
   if (!VALID_SEVERITIES.has(opts.severity)) {
@@ -58141,14 +58498,14 @@ async function emitBreadcrumb(opts) {
     );
     process.exit(2);
   }
-  const path121 = destPath(rec.project_slug);
-  const lockDir = dirname74(path121);
+  const path122 = destPath(rec.project_slug);
+  const lockDir = dirname74(path122);
   mkdirSync77(lockDir, { recursive: true });
   const line = JSON.stringify(rec) + "\n";
   await withFileLock(
     lockDir,
     () => {
-      appendFileSync6(path121, line, "utf8");
+      appendFileSync6(path122, line, "utf8");
     },
     {
       lockFilename: LOCK_FILENAME,
@@ -58164,7 +58521,7 @@ async function emitBreadcrumb(opts) {
       acquireTimeoutMs: 2e4
     }
   );
-  process.stdout.write(`[K7-emit] ${path121}: ${rec.extracted_pattern} (${rec.severity})
+  process.stdout.write(`[K7-emit] ${path122}: ${rec.extracted_pattern} (${rec.severity})
 `);
 }
 function registerFlywheelEmitBreadcrumb(parent) {
@@ -58229,7 +58586,7 @@ function registerFlywheelK5Score(parent) {
 }
 
 // src/commands/flywheel/k5-validate.ts
-import { readFileSync as readFileSync117, statSync as statSync33 } from "node:fs";
+import { readFileSync as readFileSync118, statSync as statSync33 } from "node:fs";
 import { parse as parseYAML } from "yaml";
 var K5_DIMS = ["direction", "approach", "open_questions", "constraints", "reuse"];
 var MAX_PLAN_BYTES = 1048576;
@@ -58287,9 +58644,9 @@ function validateK5ScoredAt(scoredAt) {
   }
   return null;
 }
-function validatePlan(path121) {
+function validatePlan(path122) {
   const emptyJson = (status2, errors2) => ({
-    path: path121,
+    path: path122,
     status: status2,
     errors: errors2,
     k5_scores: null,
@@ -58300,33 +58657,33 @@ function validatePlan(path121) {
   });
   let stat;
   try {
-    stat = statSync33(path121);
+    stat = statSync33(path122);
   } catch (err) {
-    const m = `FAIL cannot stat ${path121}: ${err instanceof Error ? err.message : "unknown"}`;
+    const m = `FAIL cannot stat ${path122}: ${err instanceof Error ? err.message : "unknown"}`;
     return { ok: false, message: m, json: emptyJson("error", [m]) };
   }
   if (stat.size > MAX_PLAN_BYTES) {
-    const m = `FAIL ${path121}: plan file exceeds 1MB (${stat.size} bytes); refusing to parse`;
+    const m = `FAIL ${path122}: plan file exceeds 1MB (${stat.size} bytes); refusing to parse`;
     return { ok: false, message: m, json: emptyJson("error", [m]) };
   }
   let text;
   try {
-    text = readFileSync117(path121, "utf8");
+    text = readFileSync118(path122, "utf8");
   } catch (err) {
-    const m = `FAIL cannot read ${path121}: ${err instanceof Error ? err.message : "unknown"}`;
+    const m = `FAIL cannot read ${path122}: ${err instanceof Error ? err.message : "unknown"}`;
     return { ok: false, message: m, json: emptyJson("error", [m]) };
   }
   if (!text.replace(/^/, "").startsWith("---")) {
-    const m = `FAIL ${path121}: no YAML frontmatter (missing opening --- marker)`;
+    const m = `FAIL ${path122}: no YAML frontmatter (missing opening --- marker)`;
     return { ok: false, message: m, json: emptyJson("error", [m]) };
   }
   if (!text.includes("\n---", 3)) {
-    const m = `FAIL ${path121}: frontmatter block never closed (missing closing --- marker)`;
+    const m = `FAIL ${path122}: frontmatter block never closed (missing closing --- marker)`;
     return { ok: false, message: m, json: emptyJson("error", [m]) };
   }
   const fm = extractFrontmatter(text);
   if (fm === null) {
-    const m = `FAIL ${path121}: frontmatter could not be parsed as YAML`;
+    const m = `FAIL ${path122}: frontmatter could not be parsed as YAML`;
     return { ok: false, message: m, json: emptyJson("error", [m]) };
   }
   const hasScores = "k5_scores" in fm;
@@ -58336,7 +58693,7 @@ function validatePlan(path121) {
   if (!hasScores && !hasBoost && !hasComposite && !hasScoredAt) {
     return {
       ok: true,
-      message: `PASS ${path121}: k5_scores absent (acceptable \u2014 legacy plan)`,
+      message: `PASS ${path122}: k5_scores absent (acceptable \u2014 legacy plan)`,
       json: emptyJson("absent", [])
     };
   }
@@ -58360,12 +58717,12 @@ function validatePlan(path121) {
   if (errors.length > 0) {
     return {
       ok: false,
-      message: `FAIL ${path121}: ${errors.join("; ")}`,
+      message: `FAIL ${path122}: ${errors.join("; ")}`,
       json: emptyJson("fail", errors)
     };
   }
   const json = emptyJson("pass", []);
-  const lines = [`PASS ${path121}: k5_scores valid`];
+  const lines = [`PASS ${path122}: k5_scores valid`];
   if (hasScores && typeof fm.k5_scores === "object" && fm.k5_scores !== null) {
     const scoresObj = fm.k5_scores;
     const parsed = {};
@@ -58435,7 +58792,7 @@ function registerFlywheelK5Validate(parent) {
 }
 
 // src/commands/flywheel/k10-measure.ts
-import { readFileSync as readFileSync118 } from "node:fs";
+import { readFileSync as readFileSync119 } from "node:fs";
 
 // ../core/dist/lib/k10-budget.js
 var K10_TOKEN_CAP = 5500;
@@ -58492,7 +58849,7 @@ function registerFlywheelK10Measure(parent) {
   parent.command("k10-measure").description("Measure K10 token budget for upstream + optional overlay; emit PASS/REJECT verdict").requiredOption("--upstream <path>", "path to upstream file (e.g. persona prompt)").option("--overlay <path>", "path to overlay file (omit if none \u2014 PASS without enforcement)").option("--json", "emit verdict as JSON instead of human-readable").action((opts) => {
     let upstreamText;
     try {
-      upstreamText = readFileSync118(opts.upstream, "utf8");
+      upstreamText = readFileSync119(opts.upstream, "utf8");
     } catch (err) {
       process.stderr.write(
         `[k10-measure-error] cannot read upstream ${opts.upstream}: ${err instanceof Error ? err.message : "unknown"}
@@ -58504,7 +58861,7 @@ function registerFlywheelK10Measure(parent) {
     let overlayTokens = null;
     if (opts.overlay !== void 0) {
       try {
-        const overlayText = readFileSync118(opts.overlay, "utf8");
+        const overlayText = readFileSync119(opts.overlay, "utf8");
         overlayTokens = tokensFromText(overlayText);
       } catch (err) {
         process.stderr.write(
@@ -58538,13 +58895,13 @@ function registerFlywheelK10Measure(parent) {
 }
 
 // src/commands/flywheel/check-persona-skeleton.ts
-import { existsSync as existsSync131, readFileSync as readFileSync119, statSync as statSync34 } from "node:fs";
-import { homedir as homedir82 } from "node:os";
-import { basename as basename14, join as join136 } from "node:path";
+import { existsSync as existsSync132, readFileSync as readFileSync120, statSync as statSync34 } from "node:fs";
+import { homedir as homedir83 } from "node:os";
+import { basename as basename14, join as join137 } from "node:path";
 import { parse as parseYAML2 } from "yaml";
 var CHARS_PER_TOKEN3 = 4;
 var K10_TOKEN_CAP2 = 6e3;
-var AGENTS_DIR = join136(homedir82(), ".claude", "agents");
+var AGENTS_DIR = join137(homedir83(), ".claude", "agents");
 var REQUIRED_FRONTMATTER_KEYS = ["name", "description", "allowed-tools"];
 var REQUIRED_SECTIONS = [
   "## Role",
@@ -58584,10 +58941,10 @@ function countNamedPatterns(sectionText) {
   return Math.max(h3Count, bulletCount);
 }
 function checkFile(filepath) {
-  if (!existsSync131(filepath) || !statSync34(filepath).isFile()) {
+  if (!existsSync132(filepath) || !statSync34(filepath).isFile()) {
     return { passed: false, failures: [`file not found: ${filepath}`], tokens: 0, mergedSkipped: false };
   }
-  const text = readFileSync119(filepath, "utf8");
+  const text = readFileSync120(filepath, "utf8");
   const { fm, body } = parseFile(text);
   const failures = [];
   for (const key of REQUIRED_FRONTMATTER_KEYS) {
@@ -58600,8 +58957,8 @@ function checkFile(filepath) {
   const agentName = typeof fm.name === "string" ? fm.name : "";
   let mergedSkipped = false;
   if (!isNewAgent && agentName !== "") {
-    const upstreamPath = join136(AGENTS_DIR, `${agentName}.md`);
-    if (existsSync131(upstreamPath)) {
+    const upstreamPath = join137(AGENTS_DIR, `${agentName}.md`);
+    if (existsSync132(upstreamPath)) {
       mergedSkipped = true;
     }
   }
@@ -58653,7 +59010,7 @@ Results: ${passCount} passed, ${failCount} failed
 }
 
 // src/commands/flywheel/diversity-check.ts
-import { readFileSync as readFileSync120 } from "node:fs";
+import { readFileSync as readFileSync121 } from "node:fs";
 import { basename as basename15 } from "node:path";
 import { globSync as globSync2 } from "node:fs";
 
@@ -58763,7 +59120,7 @@ function registerFlywheelDiversityCheck(parent) {
     const personas = /* @__PURE__ */ new Map();
     for (const filepath of files) {
       try {
-        const body = readFileSync120(filepath, "utf8");
+        const body = readFileSync121(filepath, "utf8");
         if (body.trim().length > 0) {
           personas.set(basename15(filepath, ".md"), body);
         }
@@ -58794,9 +59151,9 @@ ${formatRedivergencePrompt(persona_a, persona_b, score, void 0, void 0, threshol
 }
 
 // src/commands/flywheel/ping.ts
-import { mkdirSync as mkdirSync78, writeFileSync as writeFileSync73 } from "node:fs";
-import { homedir as homedir83 } from "node:os";
-import { dirname as dirname75, join as join137 } from "node:path";
+import { mkdirSync as mkdirSync78, writeFileSync as writeFileSync74 } from "node:fs";
+import { homedir as homedir84 } from "node:os";
+import { dirname as dirname75, join as join138 } from "node:path";
 var COLD_START_BUDGET_GOOD_MS = 200;
 var COLD_START_BUDGET_FAIR_MS = 500;
 function classifyColdStart(coldStartMs) {
@@ -58812,9 +59169,9 @@ function readOlamVersion() {
   }
 }
 function writeBaseline(record) {
-  const baselinePath = join137(homedir83(), ".local", "share", "olam", "flywheel-baseline.json");
+  const baselinePath = join138(homedir84(), ".local", "share", "olam", "flywheel-baseline.json");
   mkdirSync78(dirname75(baselinePath), { recursive: true });
-  writeFileSync73(baselinePath, JSON.stringify(record, null, 2) + "\n", "utf8");
+  writeFileSync74(baselinePath, JSON.stringify(record, null, 2) + "\n", "utf8");
   return baselinePath;
 }
 function registerFlywheelPing(parent) {
@@ -58849,30 +59206,30 @@ function registerFlywheelPing(parent) {
 }
 
 // src/commands/flywheel/session-start.ts
-import { readFileSync as readFileSync121, statSync as statSync35 } from "node:fs";
-import { homedir as homedir84 } from "node:os";
-import { join as join138 } from "node:path";
+import { readFileSync as readFileSync122, statSync as statSync35 } from "node:fs";
+import { homedir as homedir85 } from "node:os";
+import { join as join139 } from "node:path";
 var SESSIONSTART_HOOK_SENTINEL = "olam-sessionstart-context-hook-v1";
 var MAX_WAKE_BRIEF_BYTES = 8 * 1024;
 var MAX_ACTIVE_WORLD_BYTES = 4 * 1024;
 var MAX_CONFIG_BYTES = 8 * 1024;
-function tryReadCapped(path121, maxBytes) {
+function tryReadCapped(path122, maxBytes) {
   try {
-    const stat = statSync35(path121);
+    const stat = statSync35(path122);
     if (!stat.isFile() || stat.size === 0) return null;
     if (stat.size > maxBytes) {
       process.stderr.write(
-        `[${SESSIONSTART_HOOK_SENTINEL}] skipping ${path121}: ${stat.size} bytes > ${maxBytes} cap
+        `[${SESSIONSTART_HOOK_SENTINEL}] skipping ${path122}: ${stat.size} bytes > ${maxBytes} cap
 `
       );
       return null;
     }
-    return readFileSync121(path121, "utf-8");
+    return readFileSync122(path122, "utf-8");
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") return null;
     process.stderr.write(
-      `[${SESSIONSTART_HOOK_SENTINEL}] read failed for ${path121}: ${err?.message ?? err}
+      `[${SESSIONSTART_HOOK_SENTINEL}] read failed for ${path122}: ${err?.message ?? err}
 `
     );
     return null;
@@ -58892,15 +59249,15 @@ function tryParseJson(raw, label) {
 }
 function buildContextBlock(olamHome7) {
   const config = tryParseJson(
-    tryReadCapped(join138(olamHome7, "config.json"), MAX_CONFIG_BYTES),
+    tryReadCapped(join139(olamHome7, "config.json"), MAX_CONFIG_BYTES),
     "config.json"
   );
   const activeWorld = tryParseJson(
-    tryReadCapped(join138(olamHome7, "state", "active-world.json"), MAX_ACTIVE_WORLD_BYTES),
+    tryReadCapped(join139(olamHome7, "state", "active-world.json"), MAX_ACTIVE_WORLD_BYTES),
     "active-world.json"
   );
   const wakeBrief = tryReadCapped(
-    join138(olamHome7, "state", "wake-brief.md"),
+    join139(olamHome7, "state", "wake-brief.md"),
     MAX_WAKE_BRIEF_BYTES
   );
   const sections = [];
@@ -58952,7 +59309,7 @@ function registerFlywheelSessionStart(parent) {
   parent.command("session-start").description(
     "Emit operator-state context for the SessionStart hook (4th defense layer). Reads ~/.olam/state/* and writes the additionalContext JSON to stdout. Fail-soft: always exits 0."
   ).action(() => {
-    const olamHome7 = process.env.OLAM_HOME ?? join138(homedir84(), ".olam");
+    const olamHome7 = process.env.OLAM_HOME ?? join139(homedir85(), ".olam");
     emitSessionStartContext(olamHome7);
     process.exit(0);
   });
@@ -58961,9 +59318,9 @@ function registerFlywheelSessionStart(parent) {
 // src/commands/flywheel/install-sessionstart-hook.ts
 init_merge_settings();
 init_output();
-import { existsSync as existsSync132, copyFileSync as copyFileSync19, mkdirSync as mkdirSync79, readFileSync as readFileSync122, unlinkSync as unlinkSync26, writeFileSync as writeFileSync74 } from "node:fs";
-import { homedir as homedir85 } from "node:os";
-import { dirname as dirname76, join as join139 } from "node:path";
+import { existsSync as existsSync133, copyFileSync as copyFileSync19, mkdirSync as mkdirSync79, readFileSync as readFileSync123, unlinkSync as unlinkSync26, writeFileSync as writeFileSync75 } from "node:fs";
+import { homedir as homedir86 } from "node:os";
+import { dirname as dirname76, join as join140 } from "node:path";
 var SESSIONSTART_HOOK_STAGE = "SessionStart";
 var SESSIONSTART_HOOK_TIMEOUT_MS = 5e3;
 var NOOP_GUARD = "command -v olam >/dev/null 2>&1 || exit 0;";
@@ -58980,11 +59337,11 @@ function buildSessionStartHookEntry() {
   };
 }
 function settingsPathFor6(scope, cwd) {
-  if (scope === "user") return join139(homedir85(), ".claude", "settings.json");
-  return join139(cwd ?? process.cwd(), ".claude", "settings.json");
+  if (scope === "user") return join140(homedir86(), ".claude", "settings.json");
+  return join140(cwd ?? process.cwd(), ".claude", "settings.json");
 }
 function backup4(filePath) {
-  if (!existsSync132(filePath)) return null;
+  if (!existsSync133(filePath)) return null;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${filePath}.olam-bak.${ts}`;
   copyFileSync19(filePath, backupPath);
@@ -59010,8 +59367,8 @@ function installSessionStartHook(filePath) {
   return { status: result.status, filePath, backupPath };
 }
 function uninstallSessionStartHook(filePath) {
-  if (!existsSync132(filePath)) return { status: "no-settings", filePath };
-  const raw = readFileSync122(filePath, "utf-8");
+  if (!existsSync133(filePath)) return { status: "no-settings", filePath };
+  const raw = readFileSync123(filePath, "utf-8");
   const settings = raw.trim() ? JSON.parse(raw) : {};
   const matchers = settings.hooks?.SessionStart;
   if (!Array.isArray(matchers) || matchers.length === 0) {
@@ -59051,7 +59408,7 @@ function uninstallSessionStartHook(filePath) {
       delete next.hooks.SessionStart;
     }
   }
-  writeFileSync74(filePath, JSON.stringify(next, null, 2) + "\n");
+  writeFileSync75(filePath, JSON.stringify(next, null, 2) + "\n");
   return { status: "removed", filePath };
 }
 function registerFlywheelInstallSessionStartHook(parent) {
@@ -59379,14 +59736,14 @@ init_manager();
 init_context();
 init_output();
 import { spawnSync as defaultSpawnSync } from "node:child_process";
-import * as fs118 from "node:fs";
-import * as os64 from "node:os";
-import * as path118 from "node:path";
+import * as fs119 from "node:fs";
+import * as os65 from "node:os";
+import * as path119 from "node:path";
 function devboxContainerName(worldId) {
   return `olam-${worldId}-devbox`;
 }
 function olamHomeDir() {
-  return process.env["OLAM_HOME"] ?? path118.join(os64.homedir(), ".olam");
+  return process.env["OLAM_HOME"] ?? path119.join(os65.homedir(), ".olam");
 }
 function defaultRestartContainer(name, spawn14 = defaultSpawnSync) {
   const r = spawn14("docker", ["restart", "--time", "30", name], {
@@ -59399,8 +59756,8 @@ function defaultRestartContainer(name, spawn14 = defaultSpawnSync) {
   };
 }
 function defaultAppendAuditLog(homeDir, line) {
-  fs118.mkdirSync(homeDir, { recursive: true });
-  fs118.appendFileSync(path118.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
+  fs119.mkdirSync(homeDir, { recursive: true });
+  fs119.appendFileSync(path119.join(homeDir, "usage.log"), line.endsWith("\n") ? line : line + "\n", {
     encoding: "utf-8"
   });
 }
@@ -59445,19 +59802,19 @@ async function doRekey(worldId, deps) {
   );
   const rotatedAt = deps.now().toISOString();
   const homeDir = deps.olamHomeDir();
-  const worldDir = path118.join(homeDir, "worlds", worldId);
-  fs118.mkdirSync(worldDir, { recursive: true });
-  const credentialsPath = path118.join(worldDir, "credentials.json");
+  const worldDir = path119.join(homeDir, "worlds", worldId);
+  fs119.mkdirSync(worldDir, { recursive: true });
+  const credentialsPath = path119.join(worldDir, "credentials.json");
   const payload = {
     worldRoleName,
     password,
     rotatedAt
   };
-  fs118.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
+  fs119.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
-  fs118.chmodSync(credentialsPath, 384);
+  fs119.chmodSync(credentialsPath, 384);
   const restart = deps.restartContainer(devboxContainerName(worldId));
   deps.appendAuditLog(`${rotatedAt} ${worldId} rekey`);
   if (!restart.ok) {
@@ -59523,9 +59880,9 @@ function registerRekey(program2) {
 // src/commands/yolo.ts
 init_output();
 import * as childProcess2 from "node:child_process";
-import * as fs119 from "node:fs";
-import * as os65 from "node:os";
-import * as path119 from "node:path";
+import * as fs120 from "node:fs";
+import * as os66 from "node:os";
+import * as path120 from "node:path";
 import pc51 from "picocolors";
 var YOLO_BOOT_DELAY_MS = 8e3;
 var CAPTURE_DELAY_MS = 4e3;
@@ -59553,7 +59910,7 @@ function defaultSleeper(ms) {
 function detectTmuxBinary(runner = defaultRunner) {
   for (const p of TMUX_PROBE_PATHS) {
     if (TMUX_SHIM_MARKERS.some((m) => p.includes(m))) continue;
-    if (fs119.existsSync(p)) return p;
+    if (fs120.existsSync(p)) return p;
   }
   const result = runner("which", ["tmux"]);
   if (result.status === 0 && result.stdout) {
@@ -59567,17 +59924,17 @@ function resolveWorktreeRoot(runner = defaultRunner, cwd = process.cwd()) {
   if (process.env["OLAM_TMUX_YOLO_ROOT"]) {
     return process.env["OLAM_TMUX_YOLO_ROOT"];
   }
-  const rootFile = path119.join(os65.homedir(), ".olam-tmux-yolo-root");
-  if (fs119.existsSync(rootFile)) {
-    const line = fs119.readFileSync(rootFile, "utf-8").trim();
+  const rootFile = path120.join(os66.homedir(), ".olam-tmux-yolo-root");
+  if (fs120.existsSync(rootFile)) {
+    const line = fs120.readFileSync(rootFile, "utf-8").trim();
     if (line) return line;
   }
   const gitResult = runner("git", ["rev-parse", "--show-toplevel"], { cwd });
   if (gitResult.status !== 0 || !gitResult.stdout) {
-    return path119.join(cwd, "..", path119.basename(cwd) + "-wt");
+    return path120.join(cwd, "..", path120.basename(cwd) + "-wt");
   }
   const repoRoot = gitResult.stdout.trim();
-  return path119.join(path119.dirname(repoRoot), path119.basename(repoRoot) + "-wt");
+  return path120.join(path120.dirname(repoRoot), path120.basename(repoRoot) + "-wt");
 }
 function resolveYoloCommand(runner = defaultRunner) {
   const result = runner("bash", ["-lc", "command -v yolo"]);
@@ -59603,7 +59960,7 @@ async function spawnYolo(opts) {
     );
   }
   try {
-    fs119.accessSync(opts.promptFile, fs119.constants.R_OK);
+    fs120.accessSync(opts.promptFile, fs120.constants.R_OK);
   } catch {
     throw new Error(
       `Prompt file not found or not readable: ${opts.promptFile}
@@ -59611,7 +59968,7 @@ Create the file with your task description and try again.`
     );
   }
   const worktreeRoot = resolveWorktreeRoot(runner, cwd);
-  const worktreePath = path119.join(worktreeRoot, opts.name);
+  const worktreePath = path120.join(worktreeRoot, opts.name);
   const branchCheck = runner("git", ["show-ref", "--verify", "--quiet", `refs/heads/${opts.branch}`], { cwd });
   if (branchCheck.status === 0) {
     throw new Error(
@@ -59619,7 +59976,7 @@ Create the file with your task description and try again.`
 Run: olam yolo --cleanup ${opts.name}  (or use --force to bypass the merged check)`
     );
   }
-  if (fs119.existsSync(worktreePath)) {
+  if (fs120.existsSync(worktreePath)) {
     throw new Error(
       `Worktree directory already exists: ${worktreePath}
 Run: olam yolo --cleanup ${opts.name}  to remove it first.`
@@ -59684,10 +60041,10 @@ function listYoloWindows(opts = {}) {
   const windowNames = listResult.stdout.split("\n").map((n) => n.trim()).filter(Boolean);
   const worktreeRoot = resolveWorktreeRoot(runner, cwd);
   return windowNames.map((name) => {
-    const worktreePath = path119.join(worktreeRoot, name);
+    const worktreePath = path120.join(worktreeRoot, name);
     return {
       name,
-      worktreePath: fs119.existsSync(worktreePath) ? worktreePath : void 0
+      worktreePath: fs120.existsSync(worktreePath) ? worktreePath : void 0
     };
   });
 }
@@ -59696,7 +60053,7 @@ async function cleanupYolo(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const mainBranch = opts.mainBranch ?? "main";
   const worktreeRoot = resolveWorktreeRoot(runner, cwd);
-  const worktreePath = path119.join(worktreeRoot, opts.name);
+  const worktreePath = path120.join(worktreeRoot, opts.name);
   const worktreeList = runner("git", ["worktree", "list", "--porcelain"], { cwd });
   let branch;
   if (worktreeList.status === 0) {
@@ -59821,18 +60178,18 @@ function registerYolo(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs120 from "node:fs";
-import * as path120 from "node:path";
+import * as fs121 from "node:fs";
+import * as path121 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path120.join(configDir, "config.yaml");
-  if (!fs120.existsSync(configPath)) {
+  const configPath = path121.join(configDir, "config.yaml");
+  if (!fs121.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs120.readFileSync(configPath, "utf8");
+    const contents = fs121.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -59909,7 +60266,7 @@ var HELP_GROUPS = [
     // crystallize is conditionally hidden (requires Pleri); kept here so it
     // lands in the right group when Pleri IS configured.
     title: "Dev tools",
-    names: ["begin", "completion", "crystallize", "hermes", "lanes", "policy-check", "pr", "stop", "yolo"]
+    names: ["begin", "completion", "crystallize", "hermes", "inbox", "lanes", "policy-check", "pr", "stop", "yolo"]
   },
   {
     // Alphabetical within group. `config` lives in 'Cloud setup' above.
@@ -60131,7 +60488,7 @@ try {
   }
 }
 void scheduleUpgradeCheck(cliVersion);
-if (process.argv.length <= 2 && !existsSync135(join143(homedir88(), ".olam", "config.json"))) {
+if (process.argv.length <= 2 && !existsSync136(join144(homedir89(), ".olam", "config.json"))) {
   process.stdout.write("No olam config found yet.\n");
   process.stdout.write("Get started: olam setup\n\n");
 }