@pleri/olam-cli 0.1.36 → 0.1.37

package/dist/index.js

@@ -421,8 +421,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path36, errorMaps, issueData } = params;
-      const fullPath = [...path36, ...issueData.path || []];
+      const { data, path: path40, errorMaps, issueData } = params;
+      const fullPath = [...path40, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -730,11 +730,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path36, key) {
+      constructor(parent, value, path40, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path36;
+        this._path = path40;
         this._key = key;
       }
       get path() {
@@ -2812,33 +2812,33 @@ var init_types = __esm({
         ...processCreateParams(params)
       });
     };
-    getDiscriminator = (type) => {
-      if (type instanceof ZodLazy) {
-        return getDiscriminator(type.schema);
-      } else if (type instanceof ZodEffects) {
-        return getDiscriminator(type.innerType());
-      } else if (type instanceof ZodLiteral) {
-        return [type.value];
-      } else if (type instanceof ZodEnum) {
-        return type.options;
-      } else if (type instanceof ZodNativeEnum) {
-        return util.objectValues(type.enum);
-      } else if (type instanceof ZodDefault) {
-        return getDiscriminator(type._def.innerType);
-      } else if (type instanceof ZodUndefined) {
+    getDiscriminator = (type2) => {
+      if (type2 instanceof ZodLazy) {
+        return getDiscriminator(type2.schema);
+      } else if (type2 instanceof ZodEffects) {
+        return getDiscriminator(type2.innerType());
+      } else if (type2 instanceof ZodLiteral) {
+        return [type2.value];
+      } else if (type2 instanceof ZodEnum) {
+        return type2.options;
+      } else if (type2 instanceof ZodNativeEnum) {
+        return util.objectValues(type2.enum);
+      } else if (type2 instanceof ZodDefault) {
+        return getDiscriminator(type2._def.innerType);
+      } else if (type2 instanceof ZodUndefined) {
         return [void 0];
-      } else if (type instanceof ZodNull) {
+      } else if (type2 instanceof ZodNull) {
         return [null];
-      } else if (type instanceof ZodOptional) {
-        return [void 0, ...getDiscriminator(type.unwrap())];
-      } else if (type instanceof ZodNullable) {
-        return [null, ...getDiscriminator(type.unwrap())];
-      } else if (type instanceof ZodBranded) {
-        return getDiscriminator(type.unwrap());
-      } else if (type instanceof ZodReadonly) {
-        return getDiscriminator(type.unwrap());
-      } else if (type instanceof ZodCatch) {
-        return getDiscriminator(type._def.innerType);
+      } else if (type2 instanceof ZodOptional) {
+        return [void 0, ...getDiscriminator(type2.unwrap())];
+      } else if (type2 instanceof ZodNullable) {
+        return [null, ...getDiscriminator(type2.unwrap())];
+      } else if (type2 instanceof ZodBranded) {
+        return getDiscriminator(type2.unwrap());
+      } else if (type2 instanceof ZodReadonly) {
+        return getDiscriminator(type2.unwrap());
+      } else if (type2 instanceof ZodCatch) {
+        return getDiscriminator(type2._def.innerType);
       } else {
         return [];
       }
@@ -2898,8 +2898,8 @@ var init_types = __esm({
        */
       static create(discriminator, options, params) {
         const optionsMap = /* @__PURE__ */ new Map();
-        for (const type of options) {
-          const discriminatorValues = getDiscriminator(type.shape[discriminator]);
+        for (const type2 of options) {
+          const discriminatorValues = getDiscriminator(type2.shape[discriminator]);
           if (!discriminatorValues.length) {
             throw new Error(`A discriminator value for key \`${discriminator}\` could not be extracted from all schema options`);
           }
@@ -2907,7 +2907,7 @@ var init_types = __esm({
             if (optionsMap.has(value)) {
               throw new Error(`Discriminator property ${String(discriminator)} has duplicate value ${String(value)}`);
             }
-            optionsMap.set(value, type);
+            optionsMap.set(value, type2);
           }
         }
         return new _ZodDiscriminatedUnion({
@@ -3673,9 +3673,9 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodOptional.create = (type, params) => {
+    ZodOptional.create = (type2, params) => {
       return new ZodOptional({
-        innerType: type,
+        innerType: type2,
         typeName: ZodFirstPartyTypeKind.ZodOptional,
         ...processCreateParams(params)
       });
@@ -3692,9 +3692,9 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodNullable.create = (type, params) => {
+    ZodNullable.create = (type2, params) => {
       return new ZodNullable({
-        innerType: type,
+        innerType: type2,
         typeName: ZodFirstPartyTypeKind.ZodNullable,
         ...processCreateParams(params)
       });
@@ -3716,9 +3716,9 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodDefault.create = (type, params) => {
+    ZodDefault.create = (type2, params) => {
       return new ZodDefault({
-        innerType: type,
+        innerType: type2,
         typeName: ZodFirstPartyTypeKind.ZodDefault,
         defaultValue: typeof params.default === "function" ? params.default : () => params.default,
         ...processCreateParams(params)
@@ -3769,9 +3769,9 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodCatch.create = (type, params) => {
+    ZodCatch.create = (type2, params) => {
       return new ZodCatch({
-        innerType: type,
+        innerType: type2,
         typeName: ZodFirstPartyTypeKind.ZodCatch,
         catchValue: typeof params.catch === "function" ? params.catch : () => params.catch,
         ...processCreateParams(params)
@@ -3883,9 +3883,9 @@ var init_types = __esm({
         return this._def.innerType;
       }
     };
-    ZodReadonly.create = (type, params) => {
+    ZodReadonly.create = (type2, params) => {
       return new ZodReadonly({
-        innerType: type,
+        innerType: type2,
         typeName: ZodFirstPartyTypeKind.ZodReadonly,
         ...processCreateParams(params)
       });
@@ -4221,7 +4221,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path36, ctx, rejectSource) {
+function refineForbiddenKeys(value, path40, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4229,12 +4229,12 @@ function refineForbiddenKeys(value, path36, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path36, key],
+        path: [...path40, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path36.length === 0 && key === "source") {
+    if (rejectSource && path40.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4244,30 +4244,30 @@ function refineForbiddenKeys(value, path36, ctx, rejectSource) {
     }
     refineForbiddenKeys(
       value[key],
-      [...path36, key],
+      [...path40, key],
       ctx,
       false
     );
   }
 }
-function rejectForbiddenKeys(value, path36, rejectSource) {
+function rejectForbiddenKeys(value, path40, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
       throw new Error(
-        `[manifest] ${path36}: forbidden key "${key}" (prototype-pollution surface)`
+        `[manifest] ${path40}: forbidden key "${key}" (prototype-pollution surface)`
       );
     }
     if (rejectSource && key === "source") {
       throw new Error(
-        `[manifest] ${path36}: top-level "source" is loader-stamped \u2014 manifests must not author it`
+        `[manifest] ${path40}: top-level "source" is loader-stamped \u2014 manifests must not author it`
       );
     }
     rejectForbiddenKeys(
       value[key],
-      `${path36}.${key}`,
+      `${path40}.${key}`,
       false
     );
   }
@@ -5208,8 +5208,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path36, body, attempt = 0) {
-        const url = `${this.baseUrl}${path36}`;
+      async request(method, path40, body, attempt = 0) {
+        const url = `${this.baseUrl}${path40}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5225,7 +5225,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path36, body, attempt + 1);
+            return this.request(method, path40, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -5644,7 +5644,7 @@ var init_container2 = __esm({
     init_volume();
     serviceContainerName = (worldId, serviceName) => `olam-${sanitizeContainerName(worldId)}-${sanitizeContainerName(serviceName)}`;
     worldContainerName = (worldId) => `olam-${sanitizeContainerName(worldId)}-devbox`;
-    miseCacheVolumeName = (arch = process.arch) => `olam-mise-cache-${arch}`;
+    miseCacheVolumeName = (arch2 = process.arch) => `olam-mise-cache-${arch2}`;
     PACKAGE_MANAGER_CACHE_DIRS = [
       { name: "bundle", hostSubpath: ".olam/cache/bundle", containerPath: "/home/olam/.bundle/cache" },
       { name: "npm", hostSubpath: ".olam/cache/npm", containerPath: "/home/olam/.npm" },
@@ -6715,8 +6715,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path36, method, body) {
-        const url = `${this.config.workerUrl}${path36}`;
+      async request(path40, method, body) {
+        const url = `${this.config.workerUrl}${path40}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -6817,8 +6817,8 @@ var init_provider3 = __esm({
       /**
        * Submit thumbs-up / thumbs-down feedback for a session.
        */
-      async submitFeedback(sessionId, type, comment) {
-        const body = { sessionId, type, comment };
+      async submitFeedback(sessionId, type2, comment) {
+        const body = { sessionId, type: type2, comment };
         const res = await this.request("/feedback", "POST", body);
         await assertOk(res, `submitFeedback ${sessionId}`);
       }
@@ -7570,8 +7570,8 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
   }
 }
 async function copyClaudeConfigIntoContainer(containerName) {
-  const { execSync: execSync10 } = await import("node:child_process");
-  const dockerExec = (cmd) => execSync10(`docker exec ${containerName} sh -c '${cmd}'`, { stdio: "pipe" });
+  const { execSync: execSync12 } = await import("node:child_process");
+  const dockerExec = (cmd) => execSync12(`docker exec ${containerName} sh -c '${cmd}'`, { stdio: "pipe" });
   dockerExec("mkdir -p /home/olam/.claude");
   dockerExec("test -f /home/olam/workspace/.claude-host-config/settings.json && cp /home/olam/workspace/.claude-host-config/settings.json /home/olam/.claude/settings.json || true");
   dockerExec("test -f /home/olam/workspace/.claude-host-config/CLAUDE.md && cp /home/olam/workspace/.claude-host-config/CLAUDE.md /home/olam/.claude/CLAUDE.md || true");
@@ -7589,7 +7589,7 @@ async function copyClaudeConfigIntoContainer(containerName) {
   await sanitizeContainerClaudeHooks(containerName);
 }
 async function sanitizeContainerClaudeHooks(containerName) {
-  const { execSync: execSync10 } = await import("node:child_process");
+  const { execSync: execSync12 } = await import("node:child_process");
   const script = `
 const fs = require('fs');
 const p = '/home/olam/.claude/settings.json';
@@ -7633,7 +7633,7 @@ if (changed) {
 }
 `;
   try {
-    execSync10(
+    execSync12(
       `docker exec ${containerName} /usr/local/bin/node -e ${shQuote(script)}`,
       { stdio: "pipe" }
     );
@@ -7870,8 +7870,8 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import * as fs13 from "node:fs";
 import * as os9 from "node:os";
 import * as path14 from "node:path";
-function expandHome(p, homedir17) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir17());
+function expandHome(p, homedir20) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir20());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -7892,7 +7892,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
-  const homedir17 = deps.homedir ?? (() => os9.homedir());
+  const homedir20 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path14.join(workspacePath, ".olam", "baseline");
   try {
     fs13.mkdirSync(baselineDir, { recursive: true });
@@ -7907,7 +7907,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path) continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path14.join(baselineDir, filename);
-    const repoPath = expandHome(repo.path, homedir17);
+    const repoPath = expandHome(repo.path, homedir20);
     if (!fs13.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -9960,7 +9960,7 @@ var init_manager = __esm({
           console.warn(`[WorldManager] container git setup failed: ${msg}`);
         }
         try {
-          const safeExec = makeContainerExecFn(containerName);
+          const safeExec2 = makeContainerExecFn(containerName);
           let stacks;
           if (preDetectedStacks.size > 0) {
             stacks = preDetectedStacks;
@@ -9971,12 +9971,12 @@ var init_manager = __esm({
               if (repo.stack && Object.keys(repo.stack).length > 0) {
                 stacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
               } else {
-                const detected = await detectRepoStack(safeExec, repoDir, repo.name);
+                const detected = await detectRepoStack(safeExec2, repoDir, repo.name);
                 stacks.set(repo.name, detected);
               }
             }
           }
-          const stackResult = await installStack(safeExec, enrichedRepos, stacks);
+          const stackResult = await installStack(safeExec2, enrichedRepos, stacks);
           if (stackResult.installed.length > 0) {
             const summary = stackResult.installed.map((r) => `${r.runtime}@${r.version}`).join(", ");
             console.log(`[WorldManager] installed runtimes: ${summary}`);
@@ -10564,8 +10564,8 @@ var init_local_store = __esm({
         const rows = this.db.prepare("SELECT * FROM thought_edges").all();
         return rows.map(rowToEdge);
       }
-      getNodesByType(type) {
-        const rows = this.db.prepare("SELECT * FROM thought_nodes WHERE node_type = ? ORDER BY sequence_num").all(type);
+      getNodesByType(type2) {
+        const rows = this.db.prepare("SELECT * FROM thought_nodes WHERE node_type = ? ORDER BY sequence_num").all(type2);
         return rows.map(rowToNode);
       }
       getChainToRoot(nodeId) {
@@ -12118,10 +12118,64 @@ var init_checksum = __esm({
   }
 });
 
+// ../core/src/config/machine-schema.ts
+var machine_schema_exports = {};
+__export(machine_schema_exports, {
+  MachineConfigSchema: () => MachineConfigSchema,
+  initMachineConfig: () => initMachineConfig,
+  readMachineConfig: () => readMachineConfig,
+  writeMachineConfig: () => writeMachineConfig
+});
+import * as fs32 from "node:fs";
+import * as path36 from "node:path";
+import * as os19 from "node:os";
+import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
+function readMachineConfig(configPath) {
+  const p = configPath ?? DEFAULT_CONFIG_PATH;
+  if (!fs32.existsSync(p)) return null;
+  try {
+    const raw = fs32.readFileSync(p, "utf-8");
+    const parsed = parseYaml4(raw);
+    return MachineConfigSchema.parse(parsed);
+  } catch {
+    return null;
+  }
+}
+function writeMachineConfig(config, configPath) {
+  const p = configPath ?? DEFAULT_CONFIG_PATH;
+  fs32.mkdirSync(path36.dirname(p), { recursive: true });
+  fs32.writeFileSync(p, stringifyYaml4({ ...config }), { mode: 420 });
+}
+function initMachineConfig(opts = {}) {
+  const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
+  const existing = readMachineConfig(configPath);
+  if (existing) return existing;
+  const config = MachineConfigSchema.parse({
+    telemetry: opts.telemetry ?? true
+  });
+  writeMachineConfig(config, configPath);
+  return config;
+}
+var MachineConfigSchema, DEFAULT_CONFIG_PATH;
+var init_machine_schema = __esm({
+  "../core/src/config/machine-schema.ts"() {
+    "use strict";
+    init_zod();
+    MachineConfigSchema = external_exports.object({
+      schema_version: external_exports.literal(1).default(1),
+      channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
+      auto_update: external_exports.boolean().default(true),
+      telemetry: external_exports.boolean().default(true),
+      worlds_dir: external_exports.string().default(() => path36.join(os19.homedir(), ".olam", "worlds"))
+    });
+    DEFAULT_CONFIG_PATH = path36.join(os19.homedir(), ".olam", "config.yaml");
+  }
+});
+
 // src/index.ts
 import { Command } from "commander";
-import * as fs31 from "node:fs";
-import * as path35 from "node:path";
+import * as fs35 from "node:fs";
+import * as path39 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/commands/init.ts
@@ -12529,11 +12583,11 @@ var UnknownArchetypeError = class extends Error {
   known;
 };
 var ArchetypeCycleError = class extends Error {
-  constructor(path36) {
+  constructor(path40) {
     super(
-      `Archetype inheritance cycle detected: ${path36.join(" \u2192 ")} \u2192 ${path36[0] ?? "?"}`
+      `Archetype inheritance cycle detected: ${path40.join(" \u2192 ")} \u2192 ${path40[0] ?? "?"}`
     );
-    this.path = path36;
+    this.path = path40;
     this.name = "ArchetypeCycleError";
   }
   path;
@@ -12547,15 +12601,15 @@ function walk(name, acc, stack) {
   if (stack.includes(name)) {
     throw new ArchetypeCycleError([...stack, name]);
   }
-  const arch = getArchetype(name);
-  if (!arch) {
+  const arch2 = getArchetype(name);
+  if (!arch2) {
     throw new UnknownArchetypeError(name, listArchetypeNames());
   }
   const nextStack = [...stack, name];
-  for (const parent of arch.inherits ?? []) {
+  for (const parent of arch2.inherits ?? []) {
     walk(parent, acc, nextStack);
   }
-  for (const cap of arch.capabilities) {
+  for (const cap of arch2.capabilities) {
     acc.add(cap);
   }
 }
@@ -12659,8 +12713,8 @@ function registerInstall(program2) {
     }
     if (!opts.as) {
       printError("Missing --as <archetype>. Known archetypes:");
-      for (const arch of ARCHETYPES) {
-        console.log(`  ${pc4.bold(arch.name.padEnd(20))} ${pc4.dim(arch.description)}`);
+      for (const arch2 of ARCHETYPES) {
+        console.log(`  ${pc4.bold(arch2.name.padEnd(20))} ${pc4.dim(arch2.description)}`);
       }
       process.exitCode = 1;
       return;
@@ -13374,10 +13428,10 @@ async function readHostCpToken2() {
   if (!fs19.existsSync(tp)) return null;
   return fs19.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path36, body) {
+async function callHostCpProxy(method, worldId, path40, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path36}`;
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path40}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -14450,9 +14504,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path36, mtimeMs } of result.newerSources) {
+  for (const { path: path40, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path36}  (modified ${when})`);
+    lines.push(`  \u2022 ${path40}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -14612,15 +14666,15 @@ init_context();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs32 } = await import("node:fs");
-    const { default: os18 } = await import("node:os");
-    const { default: path36 } = await import("node:path");
-    const tp = path36.join(
-      process.env.OLAM_HOME ?? path36.join(os18.homedir(), ".olam"),
+    const { default: fs36 } = await import("node:fs");
+    const { default: os21 } = await import("node:os");
+    const { default: path40 } = await import("node:path");
+    const tp = path40.join(
+      process.env.OLAM_HOME ?? path40.join(os21.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs32.existsSync(tp)) return null;
-    return fs32.readFileSync(tp, "utf-8").trim();
+    if (!fs36.existsSync(tp)) return null;
+    return fs36.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -14982,12 +15036,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs32 } = await import("node:fs");
-    const { default: os18 } = await import("node:os");
-    const { default: path36 } = await import("node:path");
-    const tp = path36.join(os18.homedir(), ".olam", "host-cp.token");
-    if (!fs32.existsSync(tp)) return null;
-    const raw = fs32.readFileSync(tp, "utf-8").trim();
+    const { default: fs36 } = await import("node:fs");
+    const { default: os21 } = await import("node:os");
+    const { default: path40 } = await import("node:path");
+    const tp = path40.join(os21.homedir(), ".olam", "host-cp.token");
+    if (!fs36.existsSync(tp)) return null;
+    const raw = fs36.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -16200,15 +16254,15 @@ var AST = class {
       parts: this.#parts
     };
   }
-  constructor(type, parent, options = {}) {
-    this.type = type;
-    if (type)
+  constructor(type2, parent, options = {}) {
+    this.type = type2;
+    if (type2)
       this.#hasMagic = true;
     this.#parent = parent;
     this.#root = this.#parent ? this.#parent.#root : this;
     this.#options = this.#root === this ? options : this.#root.#options;
     this.#negs = this.#root === this ? [] : this.#root.#negs;
-    if (type === "!" && !this.#root.#filledNegs)
+    if (type2 === "!" && !this.#root.#filledNegs)
       this.#negs.push(this);
     this.#parentIndex = this.#parent ? this.#parent.#parts.length : 0;
   }
@@ -16851,8 +16905,8 @@ var defaults = (def) => {
     },
     AST: class AST extends orig.AST {
       /* c8 ignore start */
-      constructor(type, parent, options = {}) {
-        super(type, parent, ext(def, options));
+      constructor(type2, parent, options = {}) {
+        super(type2, parent, ext(def, options));
       }
       /* c8 ignore stop */
       static fromGlob(pattern, options = {}) {
@@ -19936,19 +19990,477 @@ Run \`olam refresh\` from the olam repo root.`
   });
 }
 
-// src/pleri-config.ts
+// src/commands/diagnose.ts
 import * as fs30 from "node:fs";
+import * as os18 from "node:os";
 import * as path34 from "node:path";
+import { execFileSync as execFileSync5, execSync as execSync10 } from "node:child_process";
+import pc20 from "picocolors";
+
+// ../core/src/diagnose/secret-stripper.ts
+var SECRET_PATTERNS = [
+  { name: "anthropic-key", re: /sk-ant-[A-Za-z0-9\-_]{8,}/g },
+  { name: "github-pat", re: /gh[pourstu]_[A-Za-z0-9]{20,}/g },
+  { name: "github-pat-fgp", re: /github_pat_[A-Za-z0-9_]{22,}/g },
+  { name: "aws-access-key", re: /AKIA[A-Z0-9]{16}/g },
+  { name: "bearer-header", re: /Bearer\s+[A-Za-z0-9._\-+/=]{16,}/g },
+  { name: "slack-token", re: /xox[bpsa]-[A-Za-z0-9-]{10,}/g },
+  { name: "host-cp-token", re: /(?:host[-_.]?cp[-_.]?token|"token")\s*[:=]\s*"?([A-Za-z0-9._\-]{16,})"?/gi },
+  { name: "generic-hex-key", re: /\bkey\s*[:=]\s*[0-9a-f]{32,}/gi },
+  { name: "db-url", re: /(?:postgres|mysql|redis|mongodb):\/\/[^:]+:[^@]+@[^\s'"]+/gi },
+  { name: "env-secret", re: /(?:API_KEY|SECRET_KEY|AUTH_TOKEN|ACCESS_TOKEN|PRIVATE_KEY|DATABASE_URL|REDIS_URL)\s*[=:]\s*\S+/gi },
+  { name: "pem-key", re: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC )?PRIVATE KEY-----/g }
+];
+var REDACTED = "[REDACTED]";
+function stripSecrets(input) {
+  let out = input;
+  for (const { re } of SECRET_PATTERNS) {
+    re.lastIndex = 0;
+    out = out.replace(re, (match2) => {
+      const colonOrEq = match2.indexOf(":") !== -1 ? match2.indexOf(":") : match2.indexOf("=");
+      if (colonOrEq !== -1 && (match2.includes("token") || match2.includes("key") || match2.includes("KEY"))) {
+        return match2.slice(0, colonOrEq + 1) + " " + REDACTED;
+      }
+      return REDACTED;
+    });
+  }
+  return out;
+}
+
+// src/commands/diagnose.ts
+var DIAGNOSTICS_DIR = path34.join(os18.homedir(), ".olam", "diagnostics");
+var LOG_DIR = path34.join(os18.homedir(), ".olam", "log");
+var CACHE_DIR = path34.join(os18.homedir(), ".olam", "cache");
+var LOG_TAIL_LINES = 200;
+function safeExec(cmd) {
+  try {
+    return execSync10(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+  } catch {
+    return "";
+  }
+}
+function defaultZip(zipPath, files) {
+  execFileSync5("zip", ["-j", zipPath, ...files]);
+}
+async function buildDiagnosticsZip(_exec = (cmd) => safeExec(cmd), _outDir = DIAGNOSTICS_DIR, _logDir = LOG_DIR, _zip = defaultZip) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 23);
+  const zipPath = path34.join(_outDir, `olam-diag-${ts}.zip`);
+  const tmpDir = fs30.mkdtempSync(path34.join(os18.tmpdir(), "olam-diag-"));
+  try {
+    fs30.mkdirSync(_outDir, { recursive: true });
+    const entries = [];
+    const version = process.env["OLAM_CLI_VERSION"] ?? "unknown";
+    const nodeVersion = process.version;
+    const platform = `${process.platform}/${process.arch}`;
+    const versionContent = `olam: ${version}
+node: ${nodeVersion}
+platform: ${platform}
+`;
+    _writeEntry(tmpDir, "version.txt", stripSecrets(versionContent), entries);
+    const osContent = [
+      `os: ${os18.type()} ${os18.release()}`,
+      `arch: ${os18.arch()}`,
+      `uptime: ${os18.uptime()}s`
+    ].join("\n") + "\n";
+    _writeEntry(tmpDir, "os-info.txt", stripSecrets(osContent), entries);
+    const depsFile = path34.join(CACHE_DIR, "deps.json");
+    if (fs30.existsSync(depsFile)) {
+      const deps = fs30.readFileSync(depsFile, "utf-8");
+      _writeEntry(tmpDir, "deps.json", stripSecrets(deps), entries);
+    }
+    const latestLog = _latestLog(_logDir);
+    if (latestLog) {
+      const lines = fs30.readFileSync(latestLog, "utf-8").split("\n");
+      const tail = lines.slice(-LOG_TAIL_LINES).join("\n");
+      _writeEntry(tmpDir, "log-tail.txt", stripSecrets(tail), entries);
+    }
+    const statusOut = _exec("olam status --json");
+    if (statusOut) {
+      _writeEntry(tmpDir, "status.json", stripSecrets(statusOut), entries);
+    }
+    const authAudit = _exec("npm run audit:auth-callers --if-present 2>&1");
+    if (authAudit) {
+      _writeEntry(tmpDir, "audit-auth-callers.txt", stripSecrets(authAudit), entries);
+    }
+    const fileArgs = entries.map((e) => path34.join(tmpDir, e));
+    try {
+      _zip(zipPath, fileArgs);
+    } catch (err) {
+      throw new Error(`zip command produced no output file. zip stderr: ${err.message}`);
+    }
+    if (!fs30.existsSync(zipPath)) {
+      throw new Error("zip command produced no output file.");
+    }
+    return { zipPath, entries };
+  } finally {
+    try {
+      fs30.rmSync(tmpDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function _writeEntry(dir, name, content, entries) {
+  fs30.writeFileSync(path34.join(dir, name), content, { mode: 420 });
+  entries.push(name);
+}
+function _latestLog(logDir) {
+  if (!fs30.existsSync(logDir)) return null;
+  const files = fs30.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
+  return files.length > 0 ? path34.join(logDir, files[0]) : null;
+}
+async function buildTelemetryPayload() {
+  const channel = "stable";
+  const manifestFile = path34.join(CACHE_DIR, "manifest.json");
+  let manifestAgeHours = null;
+  if (fs30.existsSync(manifestFile)) {
+    const mtime = fs30.statSync(manifestFile).mtime.getTime();
+    manifestAgeHours = Math.round((Date.now() - mtime) / 36e5);
+  }
+  return {
+    version: process.env["OLAM_CLI_VERSION"] ?? "unknown",
+    os: process.platform,
+    arch: process.arch,
+    channel,
+    manifest_age_hours: manifestAgeHours
+    // No userid, no project, no path — privacy per design doc
+  };
+}
+function registerDiagnose(program2) {
+  program2.command("diagnose").description("Bundle diagnostics into a zip file for sharing with maintainers").option("--show-telemetry", "Print the telemetry payload that would be sent (no endpoint yet)").option("--no-telemetry", "Suppress telemetry payload (future opt-out)").option("--upload", "Share zip with maintainers (endpoint not yet provisioned)").option("--quiet", "Suppress progress output").action(async (opts) => {
+    if (opts.showTelemetry) {
+      const payload = await buildTelemetryPayload();
+      console.log(JSON.stringify(payload, null, 2));
+      return;
+    }
+    if (!opts.quiet) {
+      console.log(pc20.cyan("Building diagnostics zip\u2026"));
+    }
+    try {
+      const { zipPath, entries } = await buildDiagnosticsZip();
+      if (!opts.quiet) {
+        console.log(pc20.green(`Done: ${zipPath}`));
+        console.log(pc20.dim(`Contents: ${entries.join(", ")}`));
+      }
+      if (opts.upload) {
+        console.log(pc20.yellow(
+          `Telemetry endpoint not yet provisioned. Share the zip manually:
+  File: ${zipPath}
+  See docs/runbooks/share-diagnostics.md for instructions.`
+        ));
+      }
+    } catch (err) {
+      console.error(pc20.red(`Diagnose failed: ${err.message}`));
+      process.exitCode = 1;
+    }
+  });
+}
+
+// src/commands/update.ts
+import * as fs33 from "node:fs";
+import * as os20 from "node:os";
+import * as path37 from "node:path";
+import { execSync as execSync11 } from "node:child_process";
+import pc21 from "picocolors";
+
+// src/lib/symlink-reconcile.ts
+import * as fs31 from "node:fs";
+import * as path35 from "node:path";
+var realFs = {
+  readdirSync: (p) => fs31.readdirSync(p),
+  existsSync: (p) => fs31.existsSync(p),
+  lstatSync: (p) => fs31.lstatSync(p),
+  readlinkSync: (p) => fs31.readlinkSync(p),
+  symlinkSync: (t, l) => fs31.symlinkSync(t, l),
+  unlinkSync: (p) => fs31.unlinkSync(p),
+  mkdirSync: (p, o) => {
+    fs31.mkdirSync(p, o);
+  }
+};
+function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
+  const added = [];
+  const removed = [];
+  const kept = [];
+  _fs.mkdirSync(claudeSkillsDir, { recursive: true });
+  const sourceSkills = _fs.existsSync(npmSkillsDir) ? _fs.readdirSync(npmSkillsDir).filter((d) => d.startsWith("olam-")) : [];
+  for (const skill of sourceSkills) {
+    const linkPath = path35.join(claudeSkillsDir, skill);
+    const target = path35.join(npmSkillsDir, skill);
+    if (!_fs.existsSync(linkPath)) {
+      try {
+        _fs.symlinkSync(target, linkPath);
+        added.push(skill);
+      } catch (e) {
+        if (e.code !== "EEXIST") throw e;
+        kept.push(skill);
+      }
+    }
+  }
+  const deployedEntries = _fs.existsSync(claudeSkillsDir) ? _fs.readdirSync(claudeSkillsDir).filter((d) => d.startsWith("olam-")) : [];
+  for (const entry of deployedEntries) {
+    const linkPath = path35.join(claudeSkillsDir, entry);
+    let isSymlink = false;
+    try {
+      isSymlink = _fs.lstatSync(linkPath).isSymbolicLink();
+    } catch {
+      continue;
+    }
+    if (!isSymlink) continue;
+    const target = _fs.readlinkSync(linkPath);
+    if (!target.includes("@pleri/olam-cli")) {
+      kept.push(entry);
+      continue;
+    }
+    if (_fs.existsSync(target)) {
+      kept.push(entry);
+    } else {
+      _fs.unlinkSync(linkPath);
+      removed.push(entry);
+    }
+  }
+  return { added, removed, kept };
+}
+
+// src/commands/update.ts
+var PACKAGE_NAME = "@pleri/olam-cli";
+var CACHE_DIR2 = path37.join(os20.homedir(), ".olam", "cache");
+var LOG_DIR2 = path37.join(os20.homedir(), ".olam", "log");
+var LAST_STABLE_FILE = path37.join(CACHE_DIR2, "last-stable.txt");
+function defaultExec(cmd) {
+  try {
+    const stdout = execSync11(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+    return { exitCode: 0, stdout, stderr: "" };
+  } catch (err) {
+    const e = err;
+    return { exitCode: e.status ?? 1, stdout: e.stdout ?? "", stderr: e.stderr ?? "" };
+  }
+}
+function getCurrentVersion(_exec = defaultExec) {
+  const result = _exec(`npm ls -g ${PACKAGE_NAME} --json --depth=0`);
+  if (result.exitCode !== 0) return null;
+  try {
+    const parsed = JSON.parse(result.stdout);
+    return parsed.dependencies?.[PACKAGE_NAME]?.version ?? null;
+  } catch {
+    return null;
+  }
+}
+function readLastStable(file = LAST_STABLE_FILE) {
+  try {
+    const v = fs33.readFileSync(file, "utf-8").trim();
+    return v || null;
+  } catch {
+    return null;
+  }
+}
+function writeLastStable(version, file = LAST_STABLE_FILE) {
+  fs33.mkdirSync(path37.dirname(file), { recursive: true });
+  fs33.writeFileSync(file, version, { mode: 420 });
+}
+function logUpdateFailure(stderr) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const logFile = path37.join(LOG_DIR2, `update-${ts}.log`);
+  try {
+    fs33.mkdirSync(LOG_DIR2, { recursive: true });
+    fs33.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
+${stderr}
+`, "utf-8");
+  } catch {
+  }
+}
+var SAFE_VERSION_RE = /^[a-zA-Z0-9._-]{1,64}$/;
+function isUpgradeBlocked(channelOrVersion, _exec = defaultExec) {
+  if (!SAFE_VERSION_RE.test(channelOrVersion)) return false;
+  const result = _exec(`npm view ${PACKAGE_NAME}@${channelOrVersion} olam.upgrade_blocked --json`);
+  if (result.exitCode !== 0) return false;
+  try {
+    const val = JSON.parse(result.stdout.trim());
+    return val === true;
+  } catch {
+    return false;
+  }
+}
+async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSymlinks, _readConfig, _getNpmRoot = defaultExec) {
+  const readConfig = _readConfig ?? (async () => {
+    const { readMachineConfig: readMachineConfig2 } = await Promise.resolve().then(() => (init_machine_schema(), machine_schema_exports));
+    return readMachineConfig2();
+  });
+  const config = await readConfig();
+  const channel = opts.channel ?? config?.channel ?? "stable";
+  const quiet = opts.quiet ?? false;
+  const force = opts.force ?? false;
+  if (!SAFE_VERSION_RE.test(channel)) {
+    if (!quiet) console.error(`Invalid channel/version: ${channel}`);
+    return { action: "failed", exitCode: 11 };
+  }
+  if (!force && config && config.auto_update === false) {
+    if (!quiet) {
+      console.log("Updates frozen. Run `olam update --force` to override or `olam update --freeze` to manage.");
+    }
+    return { action: "failed", exitCode: 11 };
+  }
+  if (!force) {
+    const blocked = isUpgradeBlocked(channel, _exec);
+    if (blocked) {
+      if (!quiet) {
+        console.error(`Version @${channel} has upgrade_blocked: true. Run with --force to override.`);
+      }
+      return { action: "failed", exitCode: 11 };
+    }
+  }
+  const prevVersion = getCurrentVersion(_exec);
+  if (prevVersion) {
+    writeLastStable(prevVersion);
+  }
+  if (!quiet) {
+    console.log(pc21.cyan(`Installing ${PACKAGE_NAME}@${channel}\u2026`));
+  }
+  const installResult = _exec(`npm install -g ${PACKAGE_NAME}@${channel}`);
+  if (installResult.exitCode !== 0) {
+    logUpdateFailure(installResult.stderr);
+    if (!quiet) {
+      console.error(pc21.red("Update failed."));
+    }
+    const prev = readLastStable();
+    if (prev) {
+      if (!quiet) {
+        console.log(pc21.yellow(`Restoring to ${prev}\u2026`));
+      }
+      const restoreResult = _exec(`npm install -g ${PACKAGE_NAME}@${prev}`);
+      if (restoreResult.exitCode !== 0) {
+        if (!quiet) {
+          console.error(pc21.red(
+            `Restore also failed. Run: npm install -g ${PACKAGE_NAME}@${prev} manually.`
+          ));
+        }
+      } else if (!quiet) {
+        console.log(pc21.yellow(`Restored to ${prev}.`));
+      }
+    } else if (!quiet) {
+      console.error(pc21.red("No previous version cached; cannot auto-restore."));
+    }
+    return { action: "restored", prevVersion: prev ?? void 0, exitCode: 11 };
+  }
+  const newVersion = getCurrentVersion(_exec) ?? void 0;
+  if (!quiet && newVersion) {
+    console.log(pc21.green(`Updated to ${newVersion}.`));
+  }
+  const npmRootResult = _getNpmRoot("npm root -g");
+  let symlinkResult = { added: [], removed: [] };
+  if (npmRootResult.exitCode === 0) {
+    const npmRoot = npmRootResult.stdout.trim();
+    const npmSkillsDir = path37.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
+    const claudeSkillsDir = path37.join(os20.homedir(), ".claude", "skills");
+    const rec = _reconcile(npmSkillsDir, claudeSkillsDir);
+    symlinkResult = { added: rec.added, removed: rec.removed };
+    if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
+      if (rec.added.length > 0) {
+        console.log(pc21.dim(`Skills added: ${rec.added.join(", ")}`));
+      }
+      if (rec.removed.length > 0) {
+        console.log(pc21.dim(`Skills removed (dangling): ${rec.removed.join(", ")}`));
+      }
+    }
+  }
+  return {
+    action: "installed",
+    version: newVersion,
+    prevVersion: prevVersion ?? void 0,
+    exitCode: 0,
+    symlinks: symlinkResult
+  };
+}
+async function doCheck(_exec = defaultExec) {
+  const current = getCurrentVersion(_exec);
+  const viewResult = _exec(`npm view ${PACKAGE_NAME} dist-tags.stable`);
+  const latest = viewResult.exitCode === 0 ? viewResult.stdout.trim() || null : null;
+  if (current && latest && current === latest) {
+    return { action: "already-current", current, latest, exitCode: 10 };
+  }
+  return { action: "update-available", current, latest, exitCode: 0 };
+}
+async function doRollback(_exec = defaultExec, _reconcile = reconcileSkillSymlinks, _getNpmRoot = defaultExec) {
+  const prev = readLastStable();
+  if (!prev) {
+    return { action: "nothing-to-rollback", exitCode: 14 };
+  }
+  const current = getCurrentVersion(_exec);
+  if (current && current === prev) {
+    return { action: "already-at-cached", restoredVersion: prev, exitCode: 0 };
+  }
+  const result = _exec(`npm install -g ${PACKAGE_NAME}@${prev}`);
+  if (result.exitCode !== 0) {
+    return { action: "failed", restoredVersion: prev, exitCode: 11 };
+  }
+  const npmRootResult = _getNpmRoot("npm root -g");
+  if (npmRootResult.exitCode === 0) {
+    const npmRoot = npmRootResult.stdout.trim();
+    _reconcile(
+      path37.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
+      path37.join(os20.homedir(), ".claude", "skills")
+    );
+  }
+  return { action: "rolled-back", restoredVersion: prev, exitCode: 0 };
+}
+function registerUpdate(program2) {
+  program2.command("update").description("Update @pleri/olam-cli to the latest version on the configured channel").option("--to <version>", "Install a specific version").option("--rollback", "Restore the previously installed version").option("--check", "Check if a newer version is available (read-only)").option("--channel <channel>", "Switch to channel and install (stable|beta|edge)").option("--freeze", "Disable automatic updates (sets auto_update: false)").option("--force", "Override freeze and upgrade_blocked checks").option("--quiet", "Suppress output").action(async (opts) => {
+    if (opts.freeze) {
+      const { readMachineConfig: readMachineConfig2, writeMachineConfig: writeMachineConfig2, MachineConfigSchema: MachineConfigSchema2 } = await Promise.resolve().then(() => (init_machine_schema(), machine_schema_exports));
+      const cfg = readMachineConfig2() ?? MachineConfigSchema2.parse({});
+      writeMachineConfig2({ ...cfg, auto_update: false });
+      if (!opts.quiet) console.log("Updates frozen. Run `olam update --force` to override.");
+      return;
+    }
+    if (opts.check) {
+      const r = await doCheck();
+      if (!opts.quiet) {
+        if (r.action === "already-current") {
+          console.log(`Already on latest: ${r.current}`);
+        } else {
+          console.log(`Current: ${r.current ?? "unknown"}, Latest: ${r.latest ?? "unknown"}`);
+        }
+      }
+      process.exitCode = r.exitCode;
+      return;
+    }
+    if (opts.rollback) {
+      const r = await doRollback();
+      if (!opts.quiet) {
+        if (r.action === "nothing-to-rollback") {
+          console.error("Nothing to roll back. Use --to=<version> for a specific target.");
+        } else if (r.action === "already-at-cached") {
+          console.log(`Already at cached version ${r.restoredVersion}. Use --to=<v> for older targets.`);
+        } else if (r.action === "rolled-back") {
+          console.log(`Rolled back to ${r.restoredVersion}.`);
+        } else {
+          console.error(`Rollback failed.`);
+        }
+      }
+      process.exitCode = r.exitCode;
+      return;
+    }
+    if (opts.channel) {
+      const { readMachineConfig: readMachineConfig2, writeMachineConfig: writeMachineConfig2, MachineConfigSchema: MachineConfigSchema2 } = await Promise.resolve().then(() => (init_machine_schema(), machine_schema_exports));
+      const cfg = readMachineConfig2() ?? MachineConfigSchema2.parse({});
+      writeMachineConfig2({ ...cfg, channel: opts.channel });
+    }
+    const result = await doUpdate({ channel: opts.to ?? opts.channel, quiet: opts.quiet, force: opts.force });
+    process.exitCode = result.exitCode;
+  });
+}
+
+// src/pleri-config.ts
+import * as fs34 from "node:fs";
+import * as path38 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path34.join(configDir, "config.yaml");
-  if (!fs30.existsSync(configPath)) {
+  const configPath = path38.join(configDir, "config.yaml");
+  if (!fs34.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs30.readFileSync(configPath, "utf8");
+    const contents = fs34.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -19959,14 +20471,14 @@ function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
 var program = new Command();
 function readCliVersion() {
   try {
-    const here = path35.dirname(fileURLToPath4(import.meta.url));
+    const here = path39.dirname(fileURLToPath4(import.meta.url));
     for (const candidate of [
-      path35.join(here, "package.json"),
-      path35.join(here, "..", "package.json"),
-      path35.join(here, "..", "..", "package.json")
+      path39.join(here, "package.json"),
+      path39.join(here, "..", "package.json"),
+      path39.join(here, "..", "..", "package.json")
     ]) {
-      if (fs31.existsSync(candidate)) {
-        const pkg = JSON.parse(fs31.readFileSync(candidate, "utf-8"));
+      if (fs35.existsSync(candidate)) {
+        const pkg = JSON.parse(fs35.readFileSync(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
       }
     }
@@ -19998,4 +20510,6 @@ registerKeys(program);
 registerWorldSnapshot(program);
 registerRefresh(program);
 registerBootstrap(program);
+registerDiagnose(program);
+registerUpdate(program);
 program.parse();