@pleri/olam-cli 0.1.37 → 0.1.38

package/dist/index.js

@@ -9,6 +9,39 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/output.ts
+import pc from "picocolors";
+function printError(message) {
+  console.error(`${pc.red("error")} ${message}`);
+}
+function printSuccess(message) {
+  console.log(`${pc.green("ok")} ${message}`);
+}
+function printWarning(message) {
+  console.log(`${pc.yellow("warn")} ${message}`);
+}
+function printInfo(label, value) {
+  console.log(`  ${pc.dim(label.padEnd(14))} ${value}`);
+}
+function printHeader(title) {
+  console.log(`
+${pc.bold(title)}`);
+}
+function formatAge(createdAt) {
+  const ms = Date.now() - new Date(createdAt).getTime();
+  const minutes = Math.floor(ms / 6e4);
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ${minutes % 60}m`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ${hours % 24}h`;
+}
+var init_output = __esm({
+  "src/output.ts"() {
+    "use strict";
+  }
+});
+
 // ../../node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
@@ -421,8 +454,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path40, errorMaps, issueData } = params;
-      const fullPath = [...path40, ...issueData.path || []];
+      const { data, path: path42, errorMaps, issueData } = params;
+      const fullPath = [...path42, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -730,11 +763,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path40, key) {
+      constructor(parent, value, path42, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path40;
+        this._path = path42;
         this._key = key;
       }
       get path() {
@@ -4221,7 +4254,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path40, ctx, rejectSource) {
+function refineForbiddenKeys(value, path42, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4229,12 +4262,12 @@ function refineForbiddenKeys(value, path40, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path40, key],
+        path: [...path42, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path40.length === 0 && key === "source") {
+    if (rejectSource && path42.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4244,30 +4277,30 @@ function refineForbiddenKeys(value, path40, ctx, rejectSource) {
     }
     refineForbiddenKeys(
       value[key],
-      [...path40, key],
+      [...path42, key],
       ctx,
       false
     );
   }
 }
-function rejectForbiddenKeys(value, path40, rejectSource) {
+function rejectForbiddenKeys(value, path42, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
       throw new Error(
-        `[manifest] ${path40}: forbidden key "${key}" (prototype-pollution surface)`
+        `[manifest] ${path42}: forbidden key "${key}" (prototype-pollution surface)`
       );
     }
     if (rejectSource && key === "source") {
       throw new Error(
-        `[manifest] ${path40}: top-level "source" is loader-stamped \u2014 manifests must not author it`
+        `[manifest] ${path42}: top-level "source" is loader-stamped \u2014 manifests must not author it`
       );
     }
     rejectForbiddenKeys(
       value[key],
-      `${path40}.${key}`,
+      `${path42}.${key}`,
       false
     );
   }
@@ -5208,8 +5241,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path40, body, attempt = 0) {
-        const url = `${this.baseUrl}${path40}`;
+      async request(method, path42, body, attempt = 0) {
+        const url = `${this.baseUrl}${path42}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5225,7 +5258,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path40, body, attempt + 1);
+            return this.request(method, path42, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -6715,8 +6748,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path40, method, body) {
-        const url = `${this.config.workerUrl}${path40}`;
+      async request(path42, method, body) {
+        const url = `${this.config.workerUrl}${path42}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -6904,6 +6937,52 @@ var init_docker_host = __esm({
   }
 });
 
+// ../core/src/util/open-url.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+function openUrl(url) {
+  if (process.env.CI === "true") {
+    return { opened: false, reason: "CI environment detected" };
+  }
+  if (!process.stdout.isTTY) {
+    return { opened: false, reason: "non-interactive shell" };
+  }
+  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+    return { opened: false, reason: "headless linux (no DISPLAY/WAYLAND_DISPLAY)" };
+  }
+  let cmd;
+  let args;
+  if (process.platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    cmd = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const result = spawnSync3(cmd, args, { stdio: "ignore", timeout: 5e3 });
+    if (result.error) {
+      return { opened: false, reason: `spawn ${cmd}: ${result.error.message}` };
+    }
+    if (result.status !== 0 && result.status !== null) {
+      return { opened: false, reason: `${cmd} exited ${result.status}` };
+    }
+    return { opened: true };
+  } catch (err) {
+    return {
+      opened: false,
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var init_open_url = __esm({
+  "../core/src/util/open-url.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/world/state.ts
 var VALID_TRANSITIONS, WorldStateMachine;
 var init_state = __esm({
@@ -7870,8 +7949,8 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import * as fs13 from "node:fs";
 import * as os9 from "node:os";
 import * as path14 from "node:path";
-function expandHome(p, homedir20) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir20());
+function expandHome(p, homedir21) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir21());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -7892,7 +7971,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
-  const homedir20 = deps.homedir ?? (() => os9.homedir());
+  const homedir21 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path14.join(workspacePath, ".olam", "baseline");
   try {
     fs13.mkdirSync(baselineDir, { recursive: true });
@@ -7907,7 +7986,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path) continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path14.join(baselineDir, filename);
-    const repoPath = expandHome(repo.path, homedir20);
+    const repoPath = expandHome(repo.path, homedir21);
     if (!fs13.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -11861,1688 +11940,1769 @@ var init_context = __esm({
   }
 });
 
-// src/install-root.ts
-var install_root_exports = {};
-__export(install_root_exports, {
-  MissingBuildScriptError: () => MissingBuildScriptError,
-  installRoot: () => installRoot,
-  isDevMode: () => isDevMode,
-  resolveBuildScript: () => resolveBuildScript
+// src/commands/host-cp.ts
+var host_cp_exports = {};
+__export(host_cp_exports, {
+  HOST_CP_PORT: () => HOST_CP_PORT,
+  authSecretPath: () => authSecretPath,
+  buildComposeEnv: () => buildComposeEnv,
+  callHostCpProxy: () => callHostCpProxy,
+  callHostCpRegistry: () => callHostCpRegistry,
+  captureGhToken: () => captureGhToken,
+  findHostCpContainer: () => findHostCpContainer,
+  gatherProbeFailureDiagnostics: () => gatherProbeFailureDiagnostics,
+  openHostCpUrl: () => openUrl,
+  probeHostCp: () => probeHostCp,
+  r2CredentialsPath: () => r2CredentialsPath,
+  readAuthSecret: () => readAuthSecret2,
+  readPid: () => readPid,
+  readR2Credentials: () => readR2Credentials,
+  readToken: () => readToken,
+  registerHostCp: () => registerHostCp,
+  removePid: () => removePid,
+  removeToken: () => removeToken,
+  runCompose: () => runCompose,
+  startHostCp: () => startHostCp,
+  stopHostCp: () => stopHostCp,
+  writePid: () => writePid,
+  writeToken: () => writeToken
 });
-import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname13, join as join24, resolve as resolve6 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-function installRoot(metaUrl = import.meta.url) {
-  const here = fileURLToPath3(metaUrl);
-  return resolve6(dirname13(here), "..");
+import * as crypto5 from "node:crypto";
+import * as fs19 from "node:fs";
+import * as os12 from "node:os";
+import * as path22 from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import Dockerode2 from "dockerode";
+function findComposeFile() {
+  const candidates = [
+    // Bundled path: dist/index.js lives at <pkg>/dist/; host-cp/ is a sibling of dist/
+    path22.resolve(path22.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
+    // Source-mode: cwd is monorepo root
+    path22.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
+    // Source-mode: cwd is one level inside the monorepo
+    path22.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
+  ];
+  for (const c of candidates) {
+    if (fs19.existsSync(c)) return c;
+  }
+  return path22.resolve(process.cwd(), "packages/host-cp/compose.yaml");
 }
-function isDevMode(env = process.env, installRootDir = installRoot()) {
-  if (env.OLAM_DEV !== "1") return false;
-  const repoRoot = resolve6(installRootDir, "..", "..");
-  return existsSync18(join24(repoRoot, "packages")) && existsSync18(join24(repoRoot, "package.json"));
+function olamHome() {
+  return process.env.OLAM_HOME ?? path22.join(os12.homedir(), ".olam");
 }
-function resolveBuildScript(input) {
-  const { scriptRelPath, env = process.env, installRootDir = installRoot() } = input;
-  if (!isDevMode(env, installRootDir)) {
-    throw new MissingBuildScriptError(scriptRelPath);
-  }
-  const repoRoot = resolve6(installRootDir, "..", "..");
-  return join24(repoRoot, scriptRelPath);
+function tokenPath() {
+  return path22.join(olamHome(), "host-cp.token");
 }
-var MissingBuildScriptError;
-var init_install_root = __esm({
-  "src/install-root.ts"() {
-    "use strict";
-    MissingBuildScriptError = class extends Error {
-      constructor(scriptRelPath) {
-        super(
-          `Build script ${scriptRelPath} is not available in this CLI install.
-  Source-build paths require a monorepo clone:
-    git clone https://github.com/pleri/olam && cd olam
-    OLAM_DEV=1 olam <command> --from-source
-  For published-image upgrades (Phase B+), drop the --from-source flag
-  and the CLI will pull pre-built images from ghcr.io/pleri/* by digest.`
-        );
-        this.name = "MissingBuildScriptError";
-      }
-    };
-  }
-});
-
-// src/protocol-version.ts
-var protocol_version_exports = {};
-__export(protocol_version_exports, {
-  OLAM_PROTOCOL_VERSIONS_SUPPORTED: () => OLAM_PROTOCOL_VERSIONS_SUPPORTED,
-  checkProtocolOverlap: () => checkProtocolOverlap,
-  inspectImageProtocolVersions: () => inspectImageProtocolVersions,
-  parseProtocolVersionsLabel: () => parseProtocolVersionsLabel
-});
-import { spawnSync as spawnSync5 } from "node:child_process";
-function parseProtocolVersionsLabel(labelValue) {
-  if (!labelValue) return [];
-  const parts = labelValue.split(",").map((s) => s.trim()).filter(Boolean);
-  const versions = /* @__PURE__ */ new Set();
-  for (const part of parts) {
-    const n = Number.parseInt(part, 10);
-    if (Number.isFinite(n) && n > 0 && String(n) === part) {
-      versions.add(n);
-    }
-  }
-  return Array.from(versions).sort((a, b) => a - b);
+function pidPath() {
+  return path22.join(olamHome(), "host-cp.pid");
 }
-function checkProtocolOverlap(imageVersions, cliVersions = OLAM_PROTOCOL_VERSIONS_SUPPORTED) {
-  const cliSet = new Set(cliVersions);
-  const overlap = imageVersions.filter((v) => cliSet.has(v));
-  if (imageVersions.length === 0) {
-    return {
-      overlap: [],
-      imageVersions: [],
-      cliVersions,
-      compatible: false,
-      remedy: `Devbox image is missing the \`olam.protocol.versions\` LABEL. This CLI requires versions [${cliVersions.join(", ")}]. See docs/architecture/devbox-contract.md \xA71 for the contract; rebuild the image with \`LABEL olam.protocol.versions="1"\`.`
-    };
-  }
-  if (overlap.length === 0) {
-    const imgLow = Math.min(...imageVersions);
-    const imgHigh = Math.max(...imageVersions);
-    const cliLow = Math.min(...cliVersions);
-    const cliHigh = Math.max(...cliVersions);
-    return {
-      overlap: [],
-      imageVersions: [...imageVersions],
-      cliVersions,
-      compatible: false,
-      remedy: `Devbox image protocol versions [${imageVersions.join(", ")}] don't overlap CLI's [${cliVersions.join(", ")}]. ` + (imgHigh < cliLow ? `The image is older than this CLI supports \u2014 rebuild against the contract version ${cliLow}+ at docs/architecture/devbox-contract.md.` : imgLow > cliHigh ? `The image is newer than this CLI supports \u2014 pin a compatible CLI: \`npm install -g @pleri/olam-cli@<version-with-protocol-${imgLow}>\`.` : `Pin a compatible CLI version that overlaps with the image's range.`)
-    };
-  }
-  return {
-    overlap,
-    imageVersions: [...imageVersions],
-    cliVersions,
-    compatible: true,
-    remedy: ""
-  };
+function authSecretPath() {
+  return path22.join(olamHome(), "auth-secret");
 }
-function inspectImageProtocolVersions(imageRef, dockerInspect = realDockerInspect) {
-  const { exitCode, stdout, stderr } = dockerInspect(imageRef);
-  if (exitCode !== 0) {
+function readAuthSecret2() {
+  const filePath = authSecretPath();
+  if (!fs19.existsSync(filePath)) return null;
+  const raw = fs19.readFileSync(filePath, "utf-8").trim();
+  return raw.length > 0 ? raw : null;
+}
+function r2CredentialsPath() {
+  return path22.join(olamHome(), "r2-credentials.json");
+}
+function readR2Credentials() {
+  const filePath = r2CredentialsPath();
+  if (!fs19.existsSync(filePath)) return null;
+  const raw = fs19.readFileSync(filePath, "utf-8").trim();
+  if (raw.length === 0) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const creds = parsed;
+    if (typeof creds.account_id !== "string" || typeof creds.bucket !== "string" || typeof creds.access_key_id !== "string" || typeof creds.secret_access_key !== "string" || typeof creds.public_url_base !== "string") {
+      return null;
+    }
     return {
-      imageRef,
-      versions: [],
-      inspectFailed: true,
-      inspectError: stderr.trim() || `docker inspect exited ${exitCode}`
+      account_id: creds.account_id,
+      bucket: creds.bucket,
+      access_key_id: creds.access_key_id,
+      secret_access_key: creds.secret_access_key,
+      public_url_base: creds.public_url_base
     };
+  } catch {
+    return null;
   }
-  const raw = stdout.trim();
-  const value = raw === "<no value>" ? "" : raw;
-  return {
-    imageRef,
-    versions: parseProtocolVersionsLabel(value),
-    inspectFailed: false,
-    inspectError: void 0
-  };
 }
-var OLAM_PROTOCOL_VERSIONS_SUPPORTED, realDockerInspect;
-var init_protocol_version = __esm({
-  "src/protocol-version.ts"() {
-    "use strict";
-    OLAM_PROTOCOL_VERSIONS_SUPPORTED = [1];
-    realDockerInspect = (imageRef) => {
-      const result = spawnSync5(
-        "docker",
-        ["inspect", imageRef, "--format", '{{ index .Config.Labels "olam.protocol.versions" }}'],
-        { encoding: "utf8", timeout: 1e4 }
-      );
-      return {
-        exitCode: result.status ?? -1,
-        stdout: result.stdout ?? "",
-        stderr: result.stderr ?? ""
-      };
-    };
-  }
-});
-
-// src/registry-allowlist.ts
-var registry_allowlist_exports = {};
-__export(registry_allowlist_exports, {
-  decideAllowlist: () => decideAllowlist,
-  resolveDevboxImageOverride: () => resolveDevboxImageOverride
-});
-function decideAllowlist(input) {
-  const { imageRef, allowCustomRegistry } = input;
-  const allowedByDefault = DEFAULT_ALLOWLIST_PATTERNS.some((re) => re.test(imageRef));
-  if (allowedByDefault) {
-    return {
-      imageRef,
-      allowedByDefault: true,
-      accepted: true,
-      stderrLine: ""
-    };
-  }
-  if (allowCustomRegistry) {
-    return {
-      imageRef,
-      allowedByDefault: false,
-      accepted: true,
-      stderrLine: `Warning: using custom devbox image '${imageRef}'. (--allow-custom-registry was specified.) Verify the source and digest before proceeding.`
-    };
+function writeToken() {
+  const token = crypto5.randomBytes(32).toString("hex");
+  const filePath = tokenPath();
+  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
+  fs19.writeFileSync(filePath, token, { mode: 384 });
+  return token;
+}
+function readToken() {
+  const filePath = tokenPath();
+  if (!fs19.existsSync(filePath)) return null;
+  return fs19.readFileSync(filePath, "utf-8").trim();
+}
+function removeToken() {
+  const filePath = tokenPath();
+  if (!fs19.existsSync(filePath)) return false;
+  fs19.unlinkSync(filePath);
+  return true;
+}
+function writePid(pid) {
+  const filePath = pidPath();
+  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
+  fs19.writeFileSync(filePath, String(pid), { mode: 420 });
+}
+function readPid() {
+  const filePath = pidPath();
+  if (!fs19.existsSync(filePath)) return null;
+  const raw = fs19.readFileSync(filePath, "utf-8").trim();
+  const n = parseInt(raw, 10);
+  return Number.isFinite(n) ? n : null;
+}
+function removePid() {
+  const filePath = pidPath();
+  if (!fs19.existsSync(filePath)) return false;
+  fs19.unlinkSync(filePath);
+  return true;
+}
+async function findHostCpContainer() {
+  const docker2 = new Dockerode2(resolveDockerHostOptions());
+  const containers = await docker2.listContainers({ all: true });
+  for (const c of containers) {
+    const names = (c.Names ?? []).map((n) => n.replace(/^\//, ""));
+    if (names.includes("olam-host-cp")) {
+      return {
+        id: c.Id.slice(0, 12),
+        name: "olam-host-cp",
+        state: c.State,
+        status: c.Status
+      };
+    }
   }
-  return {
-    imageRef,
-    allowedByDefault: false,
-    accepted: false,
-    stderrLine: `Error: image '${imageRef}' is outside allowed registries (ghcr.io/pleri/*).
-  To override: re-run with --allow-custom-registry
-  Verify the source and digest before doing so.`
-  };
+  return null;
 }
-function resolveDevboxImageOverride(flagValue, env = process.env) {
-  if (flagValue && flagValue.trim().length > 0) {
-    return flagValue.trim();
+async function probeHostCp() {
+  const candidateUrl = `http://127.0.0.1:${HOST_CP_PORT}`;
+  let httpOk = false;
+  try {
+    const res = await fetch(`${candidateUrl}/api/bootstrap`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    httpOk = res.ok;
+  } catch {
+    httpOk = false;
   }
-  const envValue = env.OLAM_DEVBOX_IMAGE;
-  if (envValue && envValue.trim().length > 0) {
-    return envValue.trim();
+  if (httpOk) {
+    let mode = "bare";
+    try {
+      const container = await findHostCpContainer();
+      if (container && container.state === "running") {
+        mode = "container";
+      }
+    } catch {
+    }
+    return { url: candidateUrl, mode };
   }
-  return void 0;
+  try {
+    const container = await findHostCpContainer();
+    if (container && container.state === "running") {
+      try {
+        const res = await fetch(`${candidateUrl}/api/bootstrap`, {
+          signal: AbortSignal.timeout(2e3)
+        });
+        if (res.ok) {
+          return { url: candidateUrl, mode: "container" };
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
 }
-var DEFAULT_ALLOWLIST_PATTERNS;
-var init_registry_allowlist = __esm({
-  "src/registry-allowlist.ts"() {
-    "use strict";
-    DEFAULT_ALLOWLIST_PATTERNS = [
-      // ghcr.io/pleri/<anything>:<tag> or ghcr.io/pleri/<anything>@sha256:<digest>
-      /^ghcr\.io\/pleri\/[^/\s]+(?::[^\s]+|@sha256:[a-f0-9]+)?$/
-    ];
+async function gatherProbeFailureDiagnostics() {
+  let bootstrapStatus = "no response";
+  try {
+    const res = await fetch(`http://127.0.0.1:${HOST_CP_PORT}/api/bootstrap`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    bootstrapStatus = `HTTP ${res.status}`;
+  } catch (err) {
+    bootstrapStatus = err instanceof Error ? err.message : "connection refused";
   }
-});
-
-// ../core/src/orchestrator/enter.ts
-var enter_exports = {};
-__export(enter_exports, {
-  getEnterCommand: () => getEnterCommand
-});
-function getEnterCommand(worldId, containerId, provider, sshHost) {
-  if (provider === "docker") {
-    const command = `docker exec -it ${containerId} claude`;
-    return {
-      command,
-      instructions: [
-        "Run this command in your terminal to enter the world:",
-        "",
-        `  ${command}`,
-        "",
-        "Press Ctrl+C to exit."
-      ].join("\n")
-    };
+  let containerStatus = "not found";
+  try {
+    const container = await findHostCpContainer();
+    if (!container) {
+      containerStatus = "not found";
+    } else {
+      containerStatus = `found (state: ${container.state})`;
+    }
+  } catch {
+    containerStatus = "docker not available";
   }
-  if (provider === "ssh" && sshHost) {
-    const command = `ssh -t ${sshHost} docker exec -it ${containerId} claude`;
-    return {
-      command,
-      instructions: [
-        "Run this command to enter the remote world:",
-        "",
-        `  ${command}`,
-        "",
-        "Press Ctrl+C to exit."
-      ].join("\n")
-    };
+  return { bootstrapStatus, containerStatus };
+}
+async function probeHealth() {
+  try {
+    const res = await fetch(`http://127.0.0.1:${HOST_CP_PORT}/health`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
   }
+}
+function runCompose(args, composeFile, extraEnv = {}) {
+  const result = spawnSync4("docker", ["compose", "-f", composeFile, ...args], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, ...extraEnv }
+  });
   return {
-    command: "",
-    instructions: `Cannot determine enter command for provider: ${provider}`
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? ""
   };
 }
-var init_enter = __esm({
-  "../core/src/orchestrator/enter.ts"() {
-    "use strict";
+function buildComposeEnv(authSecret, ghToken) {
+  const env = {};
+  if (authSecret !== null && authSecret.length > 0) {
+    env.OLAM_AUTH_SECRET = authSecret;
   }
-});
-
-// ../core/src/crystallize/checksum.ts
-var checksum_exports = {};
-__export(checksum_exports, {
-  computeGraphChecksum: () => computeGraphChecksum
-});
-import { createHash as createHash2 } from "node:crypto";
-function computeGraphChecksum(nodes, edges) {
-  const sortedNodes = [...nodes].sort((a, b) => a.id.localeCompare(b.id));
-  const sortedEdges = [...edges].sort((a, b) => a.id.localeCompare(b.id));
-  const payload = JSON.stringify({ nodes: sortedNodes, edges: sortedEdges });
-  return createHash2("sha256").update(payload).digest("hex");
-}
-var init_checksum = __esm({
-  "../core/src/crystallize/checksum.ts"() {
-    "use strict";
+  if (ghToken != null && ghToken.length > 0) {
+    env.GH_TOKEN = ghToken;
   }
-});
-
-// ../core/src/config/machine-schema.ts
-var machine_schema_exports = {};
-__export(machine_schema_exports, {
-  MachineConfigSchema: () => MachineConfigSchema,
-  initMachineConfig: () => initMachineConfig,
-  readMachineConfig: () => readMachineConfig,
-  writeMachineConfig: () => writeMachineConfig
-});
-import * as fs32 from "node:fs";
-import * as path36 from "node:path";
-import * as os19 from "node:os";
-import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
-function readMachineConfig(configPath) {
-  const p = configPath ?? DEFAULT_CONFIG_PATH;
-  if (!fs32.existsSync(p)) return null;
+  return env;
+}
+function captureGhToken() {
   try {
-    const raw = fs32.readFileSync(p, "utf-8");
-    const parsed = parseYaml4(raw);
-    return MachineConfigSchema.parse(parsed);
+    const result = spawnSync4("gh", ["auth", "token"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (result.status === 0) {
+      const token = (result.stdout ?? "").trim();
+      return token.length > 0 ? token : null;
+    }
+    return null;
   } catch {
     return null;
   }
 }
-function writeMachineConfig(config, configPath) {
-  const p = configPath ?? DEFAULT_CONFIG_PATH;
-  fs32.mkdirSync(path36.dirname(p), { recursive: true });
-  fs32.writeFileSync(p, stringifyYaml4({ ...config }), { mode: 420 });
+async function startHostCp(opts) {
+  return handleStart(opts);
 }
-function initMachineConfig(opts = {}) {
-  const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
-  const existing = readMachineConfig(configPath);
-  if (existing) return existing;
-  const config = MachineConfigSchema.parse({
-    telemetry: opts.telemetry ?? true
-  });
-  writeMachineConfig(config, configPath);
-  return config;
-}
-var MachineConfigSchema, DEFAULT_CONFIG_PATH;
-var init_machine_schema = __esm({
-  "../core/src/config/machine-schema.ts"() {
-    "use strict";
-    init_zod();
-    MachineConfigSchema = external_exports.object({
-      schema_version: external_exports.literal(1).default(1),
-      channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
-      auto_update: external_exports.boolean().default(true),
-      telemetry: external_exports.boolean().default(true),
-      worlds_dir: external_exports.string().default(() => path36.join(os19.homedir(), ".olam", "worlds"))
-    });
-    DEFAULT_CONFIG_PATH = path36.join(os19.homedir(), ".olam", "config.yaml");
-  }
-});
-
-// src/index.ts
-import { Command } from "commander";
-import * as fs35 from "node:fs";
-import * as path39 from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-
-// src/commands/init.ts
-import * as fs5 from "node:fs";
-import * as path5 from "node:path";
-import { execSync } from "node:child_process";
-import pc3 from "picocolors";
-
-// src/output.ts
-import pc from "picocolors";
-function printError(message) {
-  console.error(`${pc.red("error")} ${message}`);
-}
-function printSuccess(message) {
-  console.log(`${pc.green("ok")} ${message}`);
-}
-function printWarning(message) {
-  console.log(`${pc.yellow("warn")} ${message}`);
-}
-function printInfo(label, value) {
-  console.log(`  ${pc.dim(label.padEnd(14))} ${value}`);
-}
-function printHeader(title) {
-  console.log(`
-${pc.bold(title)}`);
-}
-function formatAge(createdAt) {
-  const ms = Date.now() - new Date(createdAt).getTime();
-  const minutes = Math.floor(ms / 6e4);
-  if (minutes < 60) return `${minutes}m`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours}h ${minutes % 60}m`;
-  const days = Math.floor(hours / 24);
-  return `${days}d ${hours % 24}h`;
-}
-
-// src/commands/workspace.ts
-init_workspace();
-init_loader();
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
-import pc2 from "picocolors";
-import { stringify as stringifyYaml2 } from "yaml";
-function printWorkspaceNotFound(name) {
-  printError(`No workspace named "${name}" under ${workspacesDir()}`);
-}
-function parseRepoFlag(raw) {
-  const hashIdx = raw.indexOf("#");
-  const url = hashIdx === -1 ? raw : raw.slice(0, hashIdx);
-  const branch = hashIdx === -1 ? void 0 : raw.slice(hashIdx + 1);
-  if (url.length === 0) throw new Error(`invalid --repo value "${raw}" (empty url)`);
-  if (branch !== void 0 && branch.length === 0) {
-    throw new Error(`invalid --repo value "${raw}" (empty branch after #)`);
-  }
-  const nameFromUrl = url.replace(/\.git$/, "").split(/[\/:]/).filter(Boolean).at(-1) ?? "repo";
-  return branch ? { name: nameFromUrl, url, branch } : { name: nameFromUrl, url };
-}
-function registerWorkspace(program2) {
-  const workspace = program2.command("workspace").description("Manage the named catalog of repo bundles that worlds instantiate from");
-  workspace.command("list").description("List all workspaces (name, repoCount, updatedAt)").action(() => {
-    const all = listWorkspaces();
-    if (all.length === 0) {
-      console.log(pc2.dim(`No workspaces under ${workspacesDir()}`));
+async function handleStart(opts) {
+  const existing = await findHostCpContainer();
+  if (existing && existing.state === "running") {
+    const health = await probeHealth();
+    if (health) {
+      printSuccess(`Host CP already running at http://127.0.0.1:${HOST_CP_PORT}`);
+      printInfo("Container", existing.id);
+      printInfo("Uptime", String(health["uptime_seconds"] ?? "unknown") + "s");
       return;
     }
-    printHeader(`${all.length} workspace(s)`);
-    for (const ws of all) {
-      const when = new Date(ws.updatedAt).toISOString().slice(0, 10);
-      console.log(
-        `  ${pc2.bold(ws.name.padEnd(24))} ${String(ws.repos.length).padEnd(3)} repos   ${pc2.dim(when)}`
-      );
-    }
-  });
-  workspace.command("show").description("Show a workspace as YAML").argument("<name>", "Workspace name").action((name) => {
-    try {
-      const ws = readWorkspace(name);
-      if (!ws) {
-        printWorkspaceNotFound(name);
-        process.exitCode = 1;
-        return;
-      }
-      process.stdout.write(stringifyYaml2(ws));
-    } catch (err) {
-      printError(err instanceof Error ? err.message : String(err));
-      process.exitCode = 1;
-    }
-  });
-  workspace.command("remove").description("Delete a workspace (does NOT touch worlds that already referenced it)").argument("<name>", "Workspace name").option("--force", "Skip confirmation", false).action((name, _opts) => {
-    try {
-      if (removeWorkspace(name)) {
-        printSuccess(`Removed workspace "${name}"`);
-      } else {
-        printWorkspaceNotFound(name);
-        process.exitCode = 1;
-      }
-    } catch (err) {
-      printError(err instanceof Error ? err.message : String(err));
-      process.exitCode = 1;
-    }
-  });
-  workspace.command("add").description("Create a workspace from --from-config (reads current .olam/config.yaml) or repeated --repo flags").argument("<name>", "Workspace name").option("--from-config", "Seed from the repos in the current project's .olam/config.yaml", false).option("--repo <url>", "Repeatable. Format: <url> or <url>#<branch>", (val, acc) => {
-    acc.push(parseRepoFlag(val));
-    return acc;
-  }, []).option("--default-branch <branch>", "Fallback branch for repos that don't specify one").option("--force", "Overwrite an existing workspace with the same name", false).action((name, opts) => {
-    try {
-      const repos = [...opts.repo];
-      if (opts.fromConfig) {
-        try {
-          const cfg = loadConfig(process.cwd());
-          for (const r of cfg.repos) {
-            repos.push({
-              name: r.name,
-              url: r.url,
-              ...r.submodules ? { submodules: true } : {}
-            });
-          }
-        } catch (err) {
-          printError(`--from-config: ${err instanceof Error ? err.message : String(err)}`);
-          process.exitCode = 1;
-          return;
-        }
-      }
-      if (repos.length === 0) {
-        printError("No repos provided \u2014 pass --from-config or at least one --repo");
-        process.exitCode = 1;
-        return;
-      }
-      const ws = {
-        name,
-        repos,
-        ...opts.defaultBranch ? { defaults: { branch: opts.defaultBranch } } : {},
-        updatedAt: Date.now()
-      };
-      writeWorkspace(ws, { force: opts.force });
-      const file = path4.join(workspacesDir(), `${name}.yaml`);
-      printSuccess(`Created workspace "${name}" (${repos.length} repo${repos.length === 1 ? "" : "s"})`);
-      printInfo("File", file);
-      printInfo("Next", `olam create --name <world> --workspace ${name} --task "..."`);
-    } catch (err) {
-      if (err instanceof WorkspaceExistsError || err instanceof WorkspaceNameError) {
-        printError(err.message);
-        process.exitCode = 1;
-        return;
-      }
-      printError(err instanceof Error ? err.message : String(err));
-      process.exitCode = 1;
-    }
-  });
-}
-function ensureProjectWorkspaceFromConfig(projectRoot, workspaceName) {
-  const existing = (() => {
-    try {
-      return readWorkspace(workspaceName);
-    } catch {
-      return null;
-    }
-  })();
-  if (existing) {
-    return { created: false, file: path4.join(workspacesDir(), `${workspaceName}.yaml`) };
+    printWarning("Host CP container running but /health not responding. Wait a few seconds and retry, or stop+start.");
+    return;
   }
-  const cfg = loadConfig(projectRoot);
-  const repos = cfg.repos.map((r) => ({
-    name: r.name,
-    url: r.url,
-    ...r.submodules ? { submodules: true } : {}
-  }));
-  const ws = {
-    name: workspaceName,
-    repos,
-    updatedAt: Date.now()
-  };
-  writeWorkspace(ws);
-  const file = path4.join(workspacesDir(), `${workspaceName}.yaml`);
-  return { created: true, file };
-}
-
-// src/commands/init.ts
-function detectProjectType(root) {
-  if (fs5.existsSync(path5.join(root, "Gemfile")) || fs5.existsSync(path5.join(root, "config", "routes.rb"))) return "rails";
-  if (fs5.existsSync(path5.join(root, "package.json"))) return "node";
-  if (fs5.existsSync(path5.join(root, "pyproject.toml")) || fs5.existsSync(path5.join(root, "requirements.txt"))) return "python";
-  return "generic";
-}
-function getRepoName(root) {
   try {
-    const url = execSync("git remote get-url origin", {
-      cwd: root,
-      encoding: "utf-8"
-    }).trim();
-    const match2 = url.match(/\/([^/]+?)(?:\.git)?$/);
-    if (match2) return match2[1];
-  } catch {
-  }
-  return path5.basename(root);
-}
-function findProjectRoot(startDir) {
-  let current = path5.resolve(startDir);
-  while (true) {
-    if (fs5.existsSync(path5.join(current, ".git"))) return current;
-    const parent = path5.dirname(current);
-    if (parent === current) return startDir;
-    current = parent;
-  }
-}
-function registerInit(program2) {
-  program2.command("init").description("Initialize olam in the current project").option("--path <path>", "Project root path", process.cwd()).option("--skip-pleri", "Skip Pleri setup").action(async (opts) => {
-    try {
-      const projectRoot = findProjectRoot(opts.path);
-      const olamDir = path5.join(projectRoot, ".olam");
-      if (fs5.existsSync(path5.join(olamDir, "config.yaml"))) {
-        printError(`Already initialized at ${olamDir}/config.yaml`);
-        process.exitCode = 1;
-        return;
-      }
-      const projectType = detectProjectType(projectRoot);
-      const repoName = getRepoName(projectRoot);
-      let remoteUrl;
-      try {
-        remoteUrl = execSync("git remote get-url origin", {
-          cwd: projectRoot,
-          encoding: "utf-8"
-        }).trim();
-      } catch {
-        remoteUrl = `git@github.com:your-org/${repoName}.git`;
-      }
-      fs5.mkdirSync(path5.join(olamDir, "state"), { recursive: true });
-      fs5.mkdirSync(path5.join(olamDir, "thoughts"), { recursive: true });
-      const pleriSection = opts.skipPleri ? "# pleri:\n#   base_url: ${PLERI_BASE_URL}\n#   plane_id: ${PLERI_PLANE_ID}\n#   api_key: ${PLERI_API_KEY}\n" : "pleri:\n  base_url: ${PLERI_BASE_URL}\n  plane_id: ${PLERI_PLANE_ID}\n  api_key: ${PLERI_API_KEY}\n";
-      const config = [
-        "version: 2",
-        "",
-        pleriSection,
-        "repos:",
-        `  - name: ${repoName}`,
-        `    url: ${remoteUrl}`,
-        `    path: ${projectRoot}`,
-        `    type: ${projectType}`,
-        "    services: []",
-        "",
-        "compute:",
-        "  default: docker",
-        "",
-        "cost:",
-        "  # All values in USD (Anthropic's billing currency).",
-        "  # Convert from your local currency: USD 25 \u2248 SGD 33 / EUR 23 / GBP 20",
-        "  # at typical 2026 rates. Dashboard display localization is a future feature.",
-        "  max_per_world_usd: 25",
-        "  max_daily_usd: 100",
-        "  warning_threshold: 0.8",
-        "",
-        "auth:",
-        "  mode: oauth",
-        ""
-      ].join("\n");
-      fs5.writeFileSync(path5.join(olamDir, "config.yaml"), config);
-      const envExample = [
-        "# Pleri credentials",
-        "PLERI_BASE_URL=https://pleri.dev/api",
-        "PLERI_PLANE_ID=",
-        "PLERI_API_KEY=",
-        ""
-      ].join("\n");
-      fs5.writeFileSync(path5.join(olamDir, ".env.example"), envExample);
-      printHeader("Olam initialized");
-      printInfo("Config", `${olamDir}/config.yaml`);
-      printInfo("Project", `${projectType} (detected)`);
-      printInfo("Repo", repoName);
-      try {
-        const result = ensureProjectWorkspaceFromConfig(projectRoot, repoName);
-        if (result.created) {
-          printInfo("Workspace", `${repoName} \u2192 ${result.file}`);
-        } else {
-          printInfo("Workspace", `${repoName} (already registered)`);
-        }
-      } catch (err) {
-        printError(`Workspace auto-register failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
-      console.log(`
-${pc3.dim(`Next: olam create --name my-world --workspace ${repoName} --task "..."`)}`);
-    } catch (err) {
-      printError(err instanceof Error ? err.message : String(err));
+    const docker2 = new Dockerode2(resolveDockerHostOptions());
+    await auditPortsForZombies(docker2, [HOST_CP_PORT]);
+  } catch (err) {
+    if (err instanceof PortHeldByZombieError) {
+      printError(`Port ${HOST_CP_PORT} held by zombie container "${err.containerName}" (state: ${err.state}).`);
+      printError(`Run: docker rm ${err.containerName}`);
       process.exitCode = 1;
+      return;
     }
-  });
-}
-
-// src/commands/install.ts
-import * as fs6 from "node:fs";
-import * as os3 from "node:os";
-import * as path6 from "node:path";
-import pc4 from "picocolors";
-import { stringify as stringifyYaml3 } from "yaml";
-
-// ../core/src/archetypes/capabilities.ts
-var CAPABILITY_NAMES = [
-  // World operations
-  "world.create",
-  "world.operate",
-  "world.destroy",
-  // Workspace catalog
-  "workspace.read",
-  "workspace.write",
-  // Auth container + credentials. Phase 6b.2/A5: `auth.manage`
-  // removed — its only consumer (/auth/revoke) was reclassified to
-  // `auth.login` (self-managed auth flow) in A2, and the only
-  // archetype that held it (`bootstrapper`) is also removed below.
-  "auth.login",
-  "auth.read",
-  // PR gate
-  "pr-gate.read",
-  "pr-gate.decide",
-  // Policy
-  "policy.set",
-  // Phase 6b.2/A5: `role.manage` removed — Pylon owns role grants
-  // (`pylon role grant ...` from a user terminal). The `/api/roles*`
-  // route handlers were deleted in A2.
-  // Phase 6b.2/A5: `bootstrap.install` and `bootstrap.cf-deploy`
-  // removed — `/bootstrap` route handler deleted in A2; the
-  // `bootstrapper` archetype is also removed in this commit.
-  // Dev-only (repo clone privileges)
-  "dev.build",
-  "dev.test",
-  "dev.release"
-];
-var CAPABILITY_SET = new Set(CAPABILITY_NAMES);
-function isCapability(value) {
-  return CAPABILITY_SET.has(value);
-}
-function assertCapability(value) {
-  if (!isCapability(value)) {
-    throw new Error(
-      `Unknown capability "${value}". Valid capabilities: ${CAPABILITY_NAMES.join(", ")}`
+    throw err;
+  }
+  const token = writeToken();
+  const composeFile = findComposeFile();
+  if (!fs19.existsSync(composeFile)) {
+    printError(`compose.yaml not found at ${composeFile}. Run from the olam project root.`);
+    removeToken();
+    process.exitCode = 1;
+    return;
+  }
+  const authSecret = readAuthSecret2();
+  if (authSecret === null) {
+    printWarning(
+      `${authSecretPath()} not found or empty. host-cp will boot, but credential surfaces (auth fleet, hotswap) will fail with 401 until you run \`olam auth up\` to (re)generate the shared secret.`
     );
   }
-  return value;
-}
-
-// ../core/src/archetypes/registry.ts
-var ARCHETYPES = [
-  {
-    name: "user",
-    description: "Day-to-day world operator. Creates, runs, and tears down worlds; decides PR gates; reads the workspace catalog.",
-    capabilities: [
-      "world.create",
-      "world.operate",
-      "world.destroy",
-      "workspace.read",
-      "auth.login",
-      "auth.read",
-      "pr-gate.read",
-      "pr-gate.decide"
-    ]
-  },
-  {
-    name: "workspace-curator",
-    description: "User who also curates the workspace catalog. Typical: team lead scoping their squad's repo bundles.",
-    inherits: ["user"],
-    capabilities: ["workspace.write"]
-  },
-  {
-    name: "policy-admin",
-    description: "User who also sets deployment policy (permission mode, PR-gate defaults). No catalog or role authority.",
-    inherits: ["user"],
-    capabilities: ["policy.set"]
-  },
-  // Phase 6b.2/A5: `bootstrapper` archetype removed. Its capabilities
-  // (bootstrap.install, bootstrap.cf-deploy, auth.manage) are no
-  // longer enforced — `/bootstrap` route + `auth.manage` route
-  // gating are gone (deleted in A2). The trim keeps `admin` valid
-  // (no dangling inherits ref) and lets schema push succeed.
-  {
-    name: "admin",
-    description: "Full operational admin. Unions user + workspace-curator + policy-admin. Pylon owns role grants now (no role.manage).",
-    inherits: ["user", "workspace-curator", "policy-admin"],
-    capabilities: []
-  },
-  {
-    name: "dev",
-    description: "Contributor to Olam itself. Everything an admin has, plus repo-local dev operations (build, test, release).",
-    inherits: ["admin"],
-    capabilities: ["dev.build", "dev.test", "dev.release"]
+  const ghToken = captureGhToken();
+  if (ghToken === null) {
+    printWarning(
+      "GitHub CLI not authenticated; PR badges will not appear in the inbox. Run `gh auth login` then `olam host-cp restart`."
+    );
   }
-];
-var ARCHETYPE_BY_NAME = new Map(
-  ARCHETYPES.map((a) => [a.name, a])
-);
-function getArchetype(name) {
-  return ARCHETYPE_BY_NAME.get(name);
+  const composeEnv = buildComposeEnv(authSecret, ghToken);
+  const PULL_BACKOFF_MS = [0, 1e3, 3e3];
+  let pullOk = false;
+  let lastPullStderr = "";
+  for (let attempt = 0; attempt < PULL_BACKOFF_MS.length; attempt += 1) {
+    if (PULL_BACKOFF_MS[attempt] > 0) {
+      await new Promise((r) => setTimeout(r, PULL_BACKOFF_MS[attempt]));
+    }
+    const pullResult = runCompose(
+      ["pull", "--quiet", "docker-socket-proxy"],
+      composeFile,
+      composeEnv
+    );
+    if (pullResult.ok) {
+      pullOk = true;
+      break;
+    }
+    lastPullStderr = pullResult.stderr;
+  }
+  if (!pullOk) {
+    printError("docker compose pull docker-socket-proxy failed after 3 attempts");
+    process.stderr.write(lastPullStderr);
+    removeToken();
+    process.exitCode = 1;
+    return;
+  }
+  const result = runCompose(["up", "-d"], composeFile, composeEnv);
+  if (!result.ok) {
+    printError("docker compose up failed");
+    process.stderr.write(result.stderr);
+    removeToken();
+    process.exitCode = 1;
+    return;
+  }
+  const deadline = Date.now() + 1e4;
+  let healthy = false;
+  while (Date.now() < deadline) {
+    const h = await probeHealth();
+    if (h) {
+      healthy = true;
+      break;
+    }
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  if (!healthy) {
+    printWarning("Host CP started but /health did not respond within 10s. Check `docker compose logs host-cp`.");
+  }
+  const container = await findHostCpContainer();
+  if (container) {
+    writePid(1);
+  }
+  printSuccess(`Host CP running at http://127.0.0.1:${HOST_CP_PORT}`);
+  if (opts.showToken) {
+    printInfo("Token", token);
+  } else {
+    printInfo("Token", `(written to ${tokenPath()}; pass --show-token to print)`);
+  }
+  printInfo("Open", `http://127.0.0.1:${HOST_CP_PORT}`);
 }
-function listArchetypeNames() {
-  return ARCHETYPES.map((a) => a.name);
+async function stopHostCp() {
+  return handleStop();
 }
-
-// ../core/src/archetypes/expand.ts
-var UnknownArchetypeError = class extends Error {
-  constructor(name, known) {
-    super(
-      `Unknown archetype "${name}". Known archetypes: ${known.join(", ")}`
-    );
-    this.name = name;
-    this.known = known;
-    this.name = "UnknownArchetypeError";
+async function handleStop() {
+  const composeFile = findComposeFile();
+  if (!fs19.existsSync(composeFile)) {
+    printWarning(`compose.yaml not found at ${composeFile}. Cleaning up token + PID anyway.`);
+    removeToken();
+    removePid();
+    return;
   }
-  name;
-  known;
-};
-var ArchetypeCycleError = class extends Error {
-  constructor(path40) {
-    super(
-      `Archetype inheritance cycle detected: ${path40.join(" \u2192 ")} \u2192 ${path40[0] ?? "?"}`
-    );
-    this.path = path40;
-    this.name = "ArchetypeCycleError";
+  const existing = await findHostCpContainer();
+  if (!existing) {
+    printInfo("Host CP", "not running");
+    removeToken();
+    removePid();
+    return;
   }
-  path;
-};
-function expandArchetype(name) {
-  const out = /* @__PURE__ */ new Set();
-  walk(name, out, []);
-  return out;
+  const result = runCompose(["down"], composeFile);
+  if (!result.ok) {
+    printError("docker compose down failed");
+    process.stderr.write(result.stderr);
+    process.exitCode = 1;
+    return;
+  }
+  removeToken();
+  removePid();
+  printSuccess("Host CP stopped");
 }
-function walk(name, acc, stack) {
-  if (stack.includes(name)) {
-    throw new ArchetypeCycleError([...stack, name]);
+async function buildStatusReport() {
+  const container = await findHostCpContainer();
+  const health = await probeHealth();
+  const tokenFile = tokenPath();
+  const tokenPresent = fs19.existsSync(tokenFile);
+  let tokenModeOk = false;
+  if (tokenPresent) {
+    const mode = fs19.statSync(tokenFile).mode & 511;
+    tokenModeOk = mode === 384;
   }
-  const arch2 = getArchetype(name);
-  if (!arch2) {
-    throw new UnknownArchetypeError(name, listArchetypeNames());
+  const pidPresent = fs19.existsSync(pidPath());
+  let stack;
+  if (!container) {
+    stack = "not_started";
+  } else if (container.state === "running" && health) {
+    stack = "running";
+  } else if (container.state === "running") {
+    stack = "partial";
+  } else {
+    stack = "stopped";
   }
-  const nextStack = [...stack, name];
-  for (const parent of arch2.inherits ?? []) {
-    walk(parent, acc, nextStack);
+  return {
+    stack,
+    container,
+    health,
+    token_present: tokenPresent,
+    token_mode_ok: tokenModeOk,
+    pid_present: pidPresent,
+    url: `http://127.0.0.1:${HOST_CP_PORT}`
+  };
+}
+async function handleStatus(opts) {
+  const report = await buildStatusReport();
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+    process.exitCode = report.stack === "running" ? 0 : 1;
+    return;
   }
-  for (const cap of arch2.capabilities) {
-    acc.add(cap);
+  printHeader("Host CP Status");
+  printInfo("Stack", report.stack);
+  printInfo("URL", report.url);
+  if (report.container) {
+    printInfo("Container", `${report.container.id} (${report.container.state})`);
+    printInfo("Status line", report.container.status);
+  } else {
+    printInfo("Container", "not found (run `olam host-cp start`)");
+  }
+  if (report.health) {
+    printInfo("Health", "ok");
+    printInfo("Uptime", String(report.health["uptime_seconds"] ?? "unknown") + "s");
+    const cache = report.health["cache"];
+    if (cache) {
+      printInfo("Cached worlds", String(cache.worlds?.length ?? 0));
+      printInfo("Cache TTL", `${cache.ttl_sec ?? "unknown"}s`);
+    }
+    const sse = report.health["sse"];
+    if (sse) {
+      printInfo("SSE active", `${sse.active ?? 0} / ${sse.cap ?? 0}`);
+    }
+  } else {
+    printInfo("Health", "not responding");
   }
+  printInfo("Token file", report.token_present ? report.token_mode_ok ? "present (mode 600)" : "present (BAD MODE \u2014 should be 600)" : "absent");
+  printInfo("PID file", report.pid_present ? "present" : "absent");
+  process.exitCode = report.stack === "running" ? 0 : 1;
+}
+function registerHostCp(program2) {
+  const hostCp = program2.command("host-cp").description("Manage the Olam host control plane container");
+  hostCp.command("start").description("Start the host CP container (token regenerated each call)").option("--show-token", "Print the generated token to stdout (default: hide)").action(async (opts) => {
+    await handleStart({ showToken: opts.showToken === true });
+  });
+  hostCp.command("stop").description("Stop the host CP container + remove token + PID files").action(async () => {
+    await handleStop();
+  });
+  hostCp.command("status").description("Show host CP container + health diagnostics").option("--json", "Output as JSON (machine-parseable; sets exit code)").action(async (opts) => {
+    await handleStatus({ json: opts.json === true });
+  });
+  hostCp.command("register").description("Register a world with the running host CP so it appears in the unified UI").requiredOption("--world <id>", "World id (the docker container suffix, e.g. gold-arc-1454)").option("--port <port>", "Override per-world CP port; default: discovered from `olam list`").action(async (opts) => {
+    await handleRegister({ world: opts.world, port: opts.port });
+  });
+  hostCp.command("deregister").description("Remove a world from the host CP registry (does NOT destroy the world)").requiredOption("--world <id>", "World id to remove").action(async (opts) => {
+    await handleDeregister({ world: opts.world });
+  });
 }
-
-// src/commands/install.ts
-var ROLE_FILE_PATH = path6.join(os3.homedir(), ".olam", "role.yaml");
-function readRoleFile() {
-  if (!fs6.existsSync(ROLE_FILE_PATH)) return null;
+async function discoverWorldPort(worldId) {
   try {
-    const raw = fs6.readFileSync(ROLE_FILE_PATH, "utf-8");
-    const m = /archetype:\s*(\S+)/.exec(raw);
-    if (!m) return null;
-    const archetype = m[1];
-    const customCapabilities = [];
-    for (const line of raw.split("\n")) {
-      const caps = /^\s+-\s+(\S+)$/.exec(line);
-      if (caps) customCapabilities.push(caps[1]);
-    }
-    const installedAtMatch = /installedAt:\s*(\d+)/.exec(raw);
-    return {
-      archetype,
-      customCapabilities,
-      installedAt: installedAtMatch ? Number(installedAtMatch[1]) : 0
-    };
+    const { loadContext: loadContext2 } = await Promise.resolve().then(() => (init_context(), context_exports));
+    const { ctx } = await loadContext2();
+    if (!ctx) return null;
+    const world = await ctx.worldManager.getWorld(worldId);
+    if (!world) return null;
+    return 19080 + world.portOffset;
   } catch {
     return null;
   }
 }
-function writeRoleFile(role) {
-  fs6.mkdirSync(path6.dirname(ROLE_FILE_PATH), { recursive: true });
-  const yaml = stringifyYaml3({
-    archetype: role.archetype,
-    customCapabilities: [...role.customCapabilities],
-    installedAt: role.installedAt
-  });
-  fs6.writeFileSync(ROLE_FILE_PATH, yaml, { mode: 420 });
-}
-function nextStepsFor(archetype) {
-  switch (archetype) {
-    case "user":
-      return [
-        'You can now run `olam create --task "..."` against a workspace your admin has curated.',
-        "Register the Claude Code plugin if you haven't: `claude plugin install ./plugin`."
-      ];
-    case "workspace-curator":
-      return [
-        "You can now curate the catalog: `olam workspace add <name> --from-config`.",
-        "Share workspace YAML files via your usual dotfiles / rsync flow."
-      ];
-    case "policy-admin":
-      return [
-        "Set deployment-wide policy via env vars (OLAM_CLAUDE_PERMISSION_MODE) or wrangler secrets.",
-        "PR-gate defaults can be overridden per-workspace under `policy.set`."
-      ];
-    case "bootstrapper":
-      return [
-        "Start the auth container: `olam auth up`, then `olam auth login`.",
-        "For Cloudflare deployments: `cd packages/cloudflare-worker && pnpm wrangler deploy`."
-      ];
-    case "admin":
-      return [
-        "Start the auth container: `olam auth up`, then `olam auth login`.",
-        "Curate workspaces: `olam workspace add <name> --from-config`.",
-        "Assign narrower archetypes to teammates (CF side, once slice C lands): use `role.manage`."
-      ];
-    case "dev":
-      return [
-        "You have repo-local privileges. Run `npm run build:ci && npm run test:ci`.",
-        "Everything an admin has is available."
-      ];
-    default:
-      return [];
-  }
+async function readHostCpToken2() {
+  const tp = tokenPath();
+  if (!fs19.existsSync(tp)) return null;
+  return fs19.readFileSync(tp, "utf-8").trim();
 }
-function registerInstall(program2) {
-  program2.command("install").description("Pick an archetype preset for this Olam install").option("--as <archetype>", "Archetype name (user, workspace-curator, policy-admin, bootstrapper, admin, dev)").option(
-    "--capability <name>",
-    "Additional capability to grant beyond the archetype preset (repeatable)",
-    (value, acc) => {
-      acc.push(value);
-      return acc;
-    },
-    []
-  ).option("--force", "Overwrite an existing role.yaml", false).option("--show", "Print the current install's archetype and exit", false).action((opts) => {
-    if (opts.show) {
-      const existing2 = readRoleFile();
-      if (!existing2) {
-        console.log(pc4.dim(`No install recorded at ${ROLE_FILE_PATH}`));
-        return;
-      }
-      printHeader("Current install");
-      printInfo("Archetype", existing2.archetype);
-      printInfo("File", ROLE_FILE_PATH);
-      const caps = expandArchetype(existing2.archetype);
-      for (const cap of existing2.customCapabilities) caps.add(cap);
-      printHeader(`Effective capabilities (${caps.size})`);
-      for (const cap of [...caps].sort()) {
-        console.log(`  ${cap}`);
+async function callHostCpProxy(method, worldId, path42, body) {
+  const token = await readHostCpToken2();
+  if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path42}`;
+  try {
+    const headers = {
+      Authorization: `Bearer ${token}`
+    };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const res = await fetch(url, {
+      method,
+      headers,
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      let errMsg = text || `HTTP ${res.status}`;
+      try {
+        const parsed = JSON.parse(text);
+        if (parsed && typeof parsed === "object" && "error" in parsed) {
+          errMsg = String(parsed.error);
+        }
+      } catch {
       }
-      return;
+      return { ok: false, status: res.status, error: errMsg };
     }
-    if (!opts.as) {
-      printError("Missing --as <archetype>. Known archetypes:");
-      for (const arch2 of ARCHETYPES) {
-        console.log(`  ${pc4.bold(arch2.name.padEnd(20))} ${pc4.dim(arch2.description)}`);
-      }
-      process.exitCode = 1;
-      return;
+    const data = await res.json().catch(() => null);
+    return { ok: true, status: res.status, data };
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function callHostCpRegistry(method, body) {
+  const token = await readHostCpToken2();
+  if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
+  const url = method === "DELETE" ? `http://127.0.0.1:${HOST_CP_PORT}/api/admin/registry/${encodeURIComponent(body.id)}` : `http://127.0.0.1:${HOST_CP_PORT}/api/admin/registry`;
+  try {
+    const res = await fetch(url, {
+      method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        ...method === "POST" ? { "Content-Type": "application/json" } : {}
+      },
+      ...method === "POST" ? { body: JSON.stringify(body) } : {}
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      return { ok: false, status: res.status, error: text || `HTTP ${res.status}` };
     }
-    const archetype = getArchetype(opts.as);
-    if (!archetype) {
-      printError(
-        `Unknown archetype "${opts.as}". Known: ${listArchetypeNames().join(", ")}`
-      );
+    return { ok: true, status: res.status };
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function handleRegister(opts) {
+  printHeader("Register world with host CP");
+  let port = null;
+  if (opts.port) {
+    port = parseInt(opts.port, 10);
+    if (!Number.isFinite(port) || port <= 0) {
+      printError(`Invalid --port value: ${opts.port}`);
       process.exitCode = 1;
       return;
     }
-    const extras = [];
-    for (const raw of opts.capability) {
-      try {
-        extras.push(assertCapability(raw));
-      } catch (err) {
-        printError(err instanceof Error ? err.message : String(err));
-        process.exitCode = 1;
-        return;
-      }
-    }
-    const existing = readRoleFile();
-    if (existing && !opts.force) {
+  } else {
+    port = await discoverWorldPort(opts.world);
+    if (port === null) {
       printError(
-        `Install already recorded as "${existing.archetype}" at ${ROLE_FILE_PATH}. Pass --force to overwrite.`
+        `Could not discover port for world ${opts.world}. Pass --port explicitly or check that the world exists in \`olam list\`.`
       );
       process.exitCode = 1;
       return;
     }
-    let resolved;
-    try {
-      resolved = expandArchetype(archetype.name);
-    } catch (err) {
-      if (err instanceof UnknownArchetypeError) {
-        printError(err.message);
-        process.exitCode = 1;
-        return;
-      }
-      throw err;
-    }
-    for (const extra of extras) resolved.add(extra);
-    writeRoleFile({
-      archetype: archetype.name,
-      customCapabilities: extras,
-      installedAt: Date.now()
-    });
-    printHeader(`Installed as ${pc4.bold(archetype.name)}`);
-    printInfo("File", ROLE_FILE_PATH);
-    printInfo("Description", archetype.description);
-    printInfo("Capabilities", `${resolved.size} total`);
-    if (extras.length > 0) {
-      printInfo("Added beyond preset", extras.join(", "));
-    }
-    const steps = nextStepsFor(archetype.name);
-    if (steps.length > 0) {
-      printHeader("Next steps");
-      for (const step of steps) console.log(`  ${pc4.dim("\u2022")} ${step}`);
+  }
+  const result = await callHostCpRegistry("POST", { id: opts.world, port });
+  if (!result.ok) {
+    printError(`Register failed: ${result.error}`);
+    if (result.status === 0) {
+      printInfo("Hint", "Is host CP running? `olam host-cp status`");
     }
-    printSuccess("Done. Run `olam install --show` to see the full capability list.");
-  });
-}
-
-// src/commands/auth.ts
-init_auth();
-import pc8 from "picocolors";
-import * as readline from "node:readline/promises";
-import { spawn as spawn3 } from "node:child_process";
-
-// src/commands/auth-status.ts
-import * as fs8 from "node:fs";
-import * as os5 from "node:os";
-import * as path9 from "node:path";
-import pc5 from "picocolors";
-
-// ../auth-logic/dist/effective-state.js
-function effectiveState(account, now = Date.now()) {
-  const persisted = account.state ?? (account.rateLimited ? "cooldown" : "active");
-  if (persisted === "disabled")
-    return "disabled";
-  if (account.expiresAt != null && account.expiresAt <= now)
-    return "expired";
-  if (persisted === "cooldown" || persisted === "usage-capped") {
-    const reset = account.rateLimitResetsAt ? new Date(account.rateLimitResetsAt).getTime() : 0;
-    if (reset > 0 && reset <= now)
-      return "active";
-    return persisted;
+    process.exitCode = 1;
+    return;
   }
-  return "active";
+  printSuccess(`Registered ${opts.world} \u2192 :${port}`);
+  printInfo("UI", `http://127.0.0.1:${HOST_CP_PORT}/world/${encodeURIComponent(opts.world)}`);
 }
-
-// ../auth-logic/dist/pick-credential.js
-function pickCredential(accounts, now = Date.now()) {
-  const active = accounts.filter((a) => effectiveState(a, now) === "active");
-  if (active.length === 0)
-    return null;
-  return [...active].sort((a, b) => {
-    const aCount = a.usage?.requestCount5h ?? 0;
-    const bCount = b.usage?.requestCount5h ?? 0;
-    if (aCount !== bCount)
-      return aCount - bCount;
-    const aLast = a.lastUsed ? new Date(a.lastUsed).getTime() : 0;
-    const bLast = b.lastUsed ? new Date(b.lastUsed).getTime() : 0;
-    return aLast - bLast;
-  })[0] ?? null;
+async function handleDeregister(opts) {
+  printHeader("Deregister world from host CP");
+  const result = await callHostCpRegistry("DELETE", { id: opts.world });
+  if (!result.ok) {
+    printError(`Deregister failed: ${result.error}`);
+    if (result.status === 0) {
+      printInfo("Hint", "Is host CP running? `olam host-cp status`");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  printSuccess(`Deregistered ${opts.world}`);
 }
+var HOST_CP_PORT;
+var init_host_cp = __esm({
+  "src/commands/host-cp.ts"() {
+    "use strict";
+    init_dist();
+    init_output();
+    init_docker_host();
+    init_open_url();
+    HOST_CP_PORT = 19e3;
+  }
+});
 
-// ../auth-logic/dist/next-cooldown-reset.js
-function nextCooldownReset(accounts, now = Date.now()) {
-  const upcoming = accounts.filter((a) => effectiveState(a, now) === "cooldown").map((a) => a.rateLimitResetsAt ? new Date(a.rateLimitResetsAt).getTime() : 0).filter((ts) => ts > now).sort((a, b) => a - b);
-  return upcoming.length > 0 ? new Date(upcoming[0]).toISOString() : null;
+// src/install-root.ts
+var install_root_exports = {};
+__export(install_root_exports, {
+  MissingBuildScriptError: () => MissingBuildScriptError,
+  installRoot: () => installRoot,
+  isDevMode: () => isDevMode,
+  resolveBuildScript: () => resolveBuildScript
+});
+import { existsSync as existsSync18 } from "node:fs";
+import { dirname as dirname13, join as join24, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+function installRoot(metaUrl = import.meta.url) {
+  const here = fileURLToPath3(metaUrl);
+  return resolve6(dirname13(here), "..");
+}
+function isDevMode(env = process.env, installRootDir = installRoot()) {
+  if (env.OLAM_DEV !== "1") return false;
+  const repoRoot = resolve6(installRootDir, "..", "..");
+  return existsSync18(join24(repoRoot, "packages")) && existsSync18(join24(repoRoot, "package.json"));
+}
+function resolveBuildScript(input) {
+  const { scriptRelPath, env = process.env, installRootDir = installRoot() } = input;
+  if (!isDevMode(env, installRootDir)) {
+    throw new MissingBuildScriptError(scriptRelPath);
+  }
+  const repoRoot = resolve6(installRootDir, "..", "..");
+  return join24(repoRoot, scriptRelPath);
 }
+var MissingBuildScriptError;
+var init_install_root = __esm({
+  "src/install-root.ts"() {
+    "use strict";
+    MissingBuildScriptError = class extends Error {
+      constructor(scriptRelPath) {
+        super(
+          `Build script ${scriptRelPath} is not available in this CLI install.
+  Source-build paths require a monorepo clone:
+    git clone https://github.com/pleri/olam && cd olam
+    OLAM_DEV=1 olam <command> --from-source
+  For published-image upgrades (Phase B+), drop the --from-source flag
+  and the CLI will pull pre-built images from ghcr.io/pleri/* by digest.`
+        );
+        this.name = "MissingBuildScriptError";
+      }
+    };
+  }
+});
 
-// src/commands/auth-status.ts
-init_auth();
-init_exit_codes();
-var LOCAL_DATA_DIR = path9.join(os5.homedir(), ".olam", "auth-data");
-function localHHMM(isoStr) {
-  const d = new Date(isoStr);
-  return d.toLocaleTimeString(void 0, {
-    hour: "2-digit",
-    minute: "2-digit",
-    hour12: false
-  });
+// src/protocol-version.ts
+var protocol_version_exports = {};
+__export(protocol_version_exports, {
+  OLAM_PROTOCOL_VERSIONS_SUPPORTED: () => OLAM_PROTOCOL_VERSIONS_SUPPORTED,
+  checkProtocolOverlap: () => checkProtocolOverlap,
+  inspectImageProtocolVersions: () => inspectImageProtocolVersions,
+  parseProtocolVersionsLabel: () => parseProtocolVersionsLabel
+});
+import { spawnSync as spawnSync5 } from "node:child_process";
+function parseProtocolVersionsLabel(labelValue) {
+  if (!labelValue) return [];
+  const parts = labelValue.split(",").map((s) => s.trim()).filter(Boolean);
+  const versions = /* @__PURE__ */ new Set();
+  for (const part of parts) {
+    const n = Number.parseInt(part, 10);
+    if (Number.isFinite(n) && n > 0 && String(n) === part) {
+      versions.add(n);
+    }
+  }
+  return Array.from(versions).sort((a, b) => a - b);
 }
-function daysAgoStr(expiresAt, now) {
-  const diffDays = Math.floor((now - expiresAt) / (1e3 * 60 * 60 * 24));
-  if (diffDays <= 0) return "expired today";
-  return `expired ${diffDays} day${diffDays === 1 ? "" : "s"} ago`;
+function checkProtocolOverlap(imageVersions, cliVersions = OLAM_PROTOCOL_VERSIONS_SUPPORTED) {
+  const cliSet = new Set(cliVersions);
+  const overlap = imageVersions.filter((v) => cliSet.has(v));
+  if (imageVersions.length === 0) {
+    return {
+      overlap: [],
+      imageVersions: [],
+      cliVersions,
+      compatible: false,
+      remedy: `Devbox image is missing the \`olam.protocol.versions\` LABEL. This CLI requires versions [${cliVersions.join(", ")}]. See docs/architecture/devbox-contract.md \xA71 for the contract; rebuild the image with \`LABEL olam.protocol.versions="1"\`.`
+    };
+  }
+  if (overlap.length === 0) {
+    const imgLow = Math.min(...imageVersions);
+    const imgHigh = Math.max(...imageVersions);
+    const cliLow = Math.min(...cliVersions);
+    const cliHigh = Math.max(...cliVersions);
+    return {
+      overlap: [],
+      imageVersions: [...imageVersions],
+      cliVersions,
+      compatible: false,
+      remedy: `Devbox image protocol versions [${imageVersions.join(", ")}] don't overlap CLI's [${cliVersions.join(", ")}]. ` + (imgHigh < cliLow ? `The image is older than this CLI supports \u2014 rebuild against the contract version ${cliLow}+ at docs/architecture/devbox-contract.md.` : imgLow > cliHigh ? `The image is newer than this CLI supports \u2014 pin a compatible CLI: \`npm install -g @pleri/olam-cli@<version-with-protocol-${imgLow}>\`.` : `Pin a compatible CLI version that overlaps with the image's range.`)
+    };
+  }
+  return {
+    overlap,
+    imageVersions: [...imageVersions],
+    cliVersions,
+    compatible: true,
+    remedy: ""
+  };
 }
-function trunc(s, maxLen) {
-  return s.length > maxLen ? s.slice(0, maxLen) : s;
+function inspectImageProtocolVersions(imageRef, dockerInspect = realDockerInspect) {
+  const { exitCode, stdout, stderr } = dockerInspect(imageRef);
+  if (exitCode !== 0) {
+    return {
+      imageRef,
+      versions: [],
+      inspectFailed: true,
+      inspectError: stderr.trim() || `docker inspect exited ${exitCode}`
+    };
+  }
+  const raw = stdout.trim();
+  const value = raw === "<no value>" ? "" : raw;
+  return {
+    imageRef,
+    versions: parseProtocolVersionsLabel(value),
+    inspectFailed: false,
+    inspectError: void 0
+  };
 }
-var STATE_PRIORITY = {
-  active: 0,
-  cooldown: 1,
-  "usage-capped": 2,
-  disabled: 3,
-  expired: 4
-};
-function formatAuthStatus(accounts, now = Date.now()) {
-  const picked = pickCredential(accounts, now);
-  const rows = accounts.map((account) => {
-    const state = effectiveState(account, now);
-    const isPicked = picked != null && account.id === picked.id;
-    const req5h = account.usage?.requestCount5h ?? 0;
-    const last429 = account.usage?.last429At ? localHHMM(account.usage.last429At) : "never";
-    let reason;
-    if (isPicked) {
-      reason = "\u2190 selected";
-    } else if (state === "active") {
-      reason = `req5h=${req5h} (higher than candidate)`;
-    } else if (state === "cooldown") {
-      const resetTime = account.rateLimitResetsAt ? localHHMM(account.rateLimitResetsAt) : "?";
-      reason = `cooldown until ${resetTime}`;
-    } else if (state === "expired") {
-      reason = daysAgoStr(account.expiresAt ?? 0, now);
-    } else {
-      reason = "disabled";
-    }
-    return { id: account.id, label: account.accountLabel ?? account.id, state, reason, req5h, last429, isPicked };
-  });
-  rows.sort((a, b) => {
-    if (a.isPicked !== b.isPicked) return a.isPicked ? -1 : 1;
-    return STATE_PRIORITY[a.state] - STATE_PRIORITY[b.state];
-  });
-  const COL = { id: 17, label: 17, state: 11, reason: 28, req5h: 7 };
-  const lines = [];
-  const hdr = "id".padEnd(COL.id) + "label".padEnd(COL.label) + "state".padEnd(COL.state) + "reason".padEnd(COL.reason) + "req5h".padEnd(COL.req5h) + "last429";
-  lines.push(pc5.dim(hdr));
-  lines.push(pc5.dim("-".repeat(hdr.length)));
-  for (const row of rows) {
-    const id = trunc(row.id, 16).padEnd(COL.id);
-    const label = trunc(row.label, 16).padEnd(COL.label);
-    const stateRaw = row.state.padEnd(COL.state);
-    const stateColored = row.state === "active" ? pc5.green(stateRaw) : row.state === "cooldown" ? pc5.yellow(stateRaw) : row.state === "expired" ? pc5.red(stateRaw) : pc5.dim(stateRaw);
-    const reason = row.reason.padEnd(COL.reason);
-    const req5h = String(row.req5h).padEnd(COL.req5h);
-    if (row.isPicked) {
-      lines.push(
-        pc5.bold(id) + pc5.bold(label) + stateColored + pc5.green(reason) + pc5.dim(req5h) + pc5.dim(row.last429)
+var OLAM_PROTOCOL_VERSIONS_SUPPORTED, realDockerInspect;
+var init_protocol_version = __esm({
+  "src/protocol-version.ts"() {
+    "use strict";
+    OLAM_PROTOCOL_VERSIONS_SUPPORTED = [1];
+    realDockerInspect = (imageRef) => {
+      const result = spawnSync5(
+        "docker",
+        ["inspect", imageRef, "--format", '{{ index .Config.Labels "olam.protocol.versions" }}'],
+        { encoding: "utf8", timeout: 1e4 }
       );
-    } else {
-      lines.push(id + label + stateColored + reason + pc5.dim(req5h) + pc5.dim(row.last429));
-    }
+      return {
+        exitCode: result.status ?? -1,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? ""
+      };
+    };
+  }
+});
+
+// src/registry-allowlist.ts
+var registry_allowlist_exports = {};
+__export(registry_allowlist_exports, {
+  decideAllowlist: () => decideAllowlist,
+  resolveDevboxImageOverride: () => resolveDevboxImageOverride
+});
+function decideAllowlist(input) {
+  const { imageRef, allowCustomRegistry } = input;
+  const allowedByDefault = DEFAULT_ALLOWLIST_PATTERNS.some((re) => re.test(imageRef));
+  if (allowedByDefault) {
+    return {
+      imageRef,
+      allowedByDefault: true,
+      accepted: true,
+      stderrLine: ""
+    };
   }
-  if (picked == null) {
-    const resetIso = nextCooldownReset(accounts, now);
-    lines.push("");
-    lines.push(
-      resetIso ? pc5.yellow(`Next reset: ${localHHMM(resetIso)}`) : pc5.dim("No reset scheduled")
-    );
-    return { output: lines.join("\n"), exitCode: EXIT_AUTH_NEEDS_ATTENTION };
+  if (allowCustomRegistry) {
+    return {
+      imageRef,
+      allowedByDefault: false,
+      accepted: true,
+      stderrLine: `Warning: using custom devbox image '${imageRef}'. (--allow-custom-registry was specified.) Verify the source and digest before proceeding.`
+    };
   }
-  return { output: lines.join("\n"), exitCode: 0 };
-}
-function toSafeAccount(a) {
   return {
-    id: a.id,
-    accountLabel: a.accountLabel,
-    // expiresAt not exposed in summary — state is pre-computed server-side
-    rateLimited: a.rateLimited,
-    rateLimitResetsAt: a.rateLimitResetsAt,
-    lastUsed: a.lastUsed,
-    state: a.state,
-    usage: a.usage ? { requestCount5h: a.usage.requestCount5h, last429At: a.usage.last429At } : void 0
+    imageRef,
+    allowedByDefault: false,
+    accepted: false,
+    stderrLine: `Error: image '${imageRef}' is outside allowed registries (ghcr.io/pleri/*).
+  To override: re-run with --allow-custom-registry
+  Verify the source and digest before doing so.`
   };
 }
-async function runAuthStatus(getStatus) {
-  const fetchStatus = getStatus ?? (() => new AuthClient().status());
-  let status;
-  try {
-    status = await fetchStatus();
-  } catch {
-    printError("Failed to contact auth service. Run `olam auth up` first.");
-    process.exitCode = 1;
-    return;
+function resolveDevboxImageOverride(flagValue, env = process.env) {
+  if (flagValue && flagValue.trim().length > 0) {
+    return flagValue.trim();
   }
-  if (!status.reachable) {
-    printError("Auth container is not reachable. Run `olam auth up` first.");
-    process.exitCode = 1;
-    return;
+  const envValue = env.OLAM_DEVBOX_IMAGE;
+  if (envValue && envValue.trim().length > 0) {
+    return envValue.trim();
   }
-  if (status.accounts.length === 0) {
-    console.log(pc5.dim("No credentials found. Run: olam auth login"));
-    return;
+  return void 0;
+}
+var DEFAULT_ALLOWLIST_PATTERNS;
+var init_registry_allowlist = __esm({
+  "src/registry-allowlist.ts"() {
+    "use strict";
+    DEFAULT_ALLOWLIST_PATTERNS = [
+      // ghcr.io/pleri/<anything>:<tag> or ghcr.io/pleri/<anything>@sha256:<digest>
+      /^ghcr\.io\/pleri\/[^/\s]+(?::[^\s]+|@sha256:[a-f0-9]+)?$/
+    ];
   }
-  const accounts = status.accounts.map(toSafeAccount);
-  const result = formatAuthStatus(accounts);
-  console.log(result.output);
-  if (result.exitCode !== 0) {
-    process.exitCode = result.exitCode;
+});
+
+// ../core/src/world/world-yaml.ts
+import * as fs21 from "node:fs";
+import * as path24 from "node:path";
+import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
+function writeWorldYaml(worldPath, data) {
+  const olamDir = path24.join(worldPath, ".olam");
+  fs21.mkdirSync(olamDir, { recursive: true });
+  fs21.writeFileSync(path24.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
+}
+function readWorldYaml(worldPath) {
+  const yamlPath = path24.join(worldPath, ".olam", "world.yaml");
+  if (!fs21.existsSync(yamlPath)) return null;
+  try {
+    const raw = fs21.readFileSync(yamlPath, "utf-8");
+    const parsed = parseYaml4(raw);
+    return WorldYamlSchema.parse(parsed);
+  } catch {
+    return null;
   }
 }
-
-// src/commands/auth-upgrade.ts
-import * as fs20 from "node:fs";
-import * as path23 from "node:path";
-import { spawnSync as spawnSync7 } from "node:child_process";
-import ora2 from "ora";
-import pc7 from "picocolors";
-
-// src/commands/host-cp.ts
-init_dist();
-import * as crypto5 from "node:crypto";
-import * as fs19 from "node:fs";
-import * as os12 from "node:os";
-import * as path22 from "node:path";
-import { spawnSync as spawnSync4 } from "node:child_process";
-import Dockerode2 from "dockerode";
-init_docker_host();
-
-// ../core/src/util/open-url.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-function openUrl(url) {
-  if (process.env.CI === "true") {
-    return { opened: false, reason: "CI environment detected" };
+var WorldYamlSchema;
+var init_world_yaml = __esm({
+  "../core/src/world/world-yaml.ts"() {
+    "use strict";
+    init_zod();
+    WorldYamlSchema = external_exports.object({
+      world_type: external_exports.enum(["worktree", "clone"]),
+      origin_url: external_exports.string().min(1),
+      cli_version: external_exports.string().nullable()
+    });
   }
-  if (!process.stdout.isTTY) {
-    return { opened: false, reason: "non-interactive shell" };
+});
+
+// ../core/src/world/version-pin.ts
+var version_pin_exports = {};
+__export(version_pin_exports, {
+  CLI_VERSION: () => CLI_VERSION,
+  checkVersionPin: () => checkVersionPin,
+  resetWarnedSet: () => resetWarnedSet,
+  stampVersionPin: () => stampVersionPin
+});
+function checkVersionPin(worldId, worldPath, cliVersion = CLI_VERSION, _readYaml = readWorldYaml, _warn = (msg) => console.warn(msg)) {
+  const yaml = _readYaml(worldPath);
+  if (!yaml || yaml.cli_version === null) return true;
+  if (yaml.cli_version === cliVersion) return true;
+  if (!warnedThisSession.has(worldId)) {
+    warnedThisSession.add(worldId);
+    _warn(
+      `[olam] World "${worldId}" was created with CLI v${yaml.cli_version}, current CLI is v${cliVersion}. Run \`olam world upgrade ${worldId}\` to refresh the pin.`
+    );
   }
-  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
-    return { opened: false, reason: "headless linux (no DISPLAY/WAYLAND_DISPLAY)" };
+  return false;
+}
+function stampVersionPin(worldPath, cliVersion = CLI_VERSION, _readYaml = readWorldYaml, _writeYaml = writeWorldYaml) {
+  const yaml = _readYaml(worldPath);
+  if (!yaml) return false;
+  if (yaml.cli_version === cliVersion) return false;
+  _writeYaml(worldPath, { ...yaml, cli_version: cliVersion });
+  return true;
+}
+function resetWarnedSet() {
+  warnedThisSession.clear();
+}
+var CLI_VERSION, warnedThisSession;
+var init_version_pin = __esm({
+  "../core/src/world/version-pin.ts"() {
+    "use strict";
+    init_world_yaml();
+    CLI_VERSION = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
+    warnedThisSession = /* @__PURE__ */ new Set();
   }
-  let cmd;
-  let args;
-  if (process.platform === "darwin") {
-    cmd = "open";
-    args = [url];
-  } else if (process.platform === "win32") {
-    cmd = "cmd";
-    args = ["/c", "start", "", url];
-  } else {
-    cmd = "xdg-open";
-    args = [url];
+});
+
+// ../core/src/orchestrator/enter.ts
+var enter_exports = {};
+__export(enter_exports, {
+  getEnterCommand: () => getEnterCommand
+});
+function getEnterCommand(worldId, containerId, provider, sshHost) {
+  if (provider === "docker") {
+    const command = `docker exec -it ${containerId} claude`;
+    return {
+      command,
+      instructions: [
+        "Run this command in your terminal to enter the world:",
+        "",
+        `  ${command}`,
+        "",
+        "Press Ctrl+C to exit."
+      ].join("\n")
+    };
   }
-  try {
-    const result = spawnSync3(cmd, args, { stdio: "ignore", timeout: 5e3 });
-    if (result.error) {
-      return { opened: false, reason: `spawn ${cmd}: ${result.error.message}` };
-    }
-    if (result.status !== 0 && result.status !== null) {
-      return { opened: false, reason: `${cmd} exited ${result.status}` };
-    }
-    return { opened: true };
-  } catch (err) {
+  if (provider === "ssh" && sshHost) {
+    const command = `ssh -t ${sshHost} docker exec -it ${containerId} claude`;
     return {
-      opened: false,
-      reason: err instanceof Error ? err.message : String(err)
+      command,
+      instructions: [
+        "Run this command to enter the remote world:",
+        "",
+        `  ${command}`,
+        "",
+        "Press Ctrl+C to exit."
+      ].join("\n")
     };
   }
+  return {
+    command: "",
+    instructions: `Cannot determine enter command for provider: ${provider}`
+  };
 }
-
-// src/commands/host-cp.ts
-var HOST_CP_PORT = 19e3;
-function findComposeFile() {
-  const candidates = [
-    // Bundled path: dist/index.js lives at <pkg>/dist/; host-cp/ is a sibling of dist/
-    path22.resolve(path22.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
-    // Source-mode: cwd is monorepo root
-    path22.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
-    // Source-mode: cwd is one level inside the monorepo
-    path22.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
-  ];
-  for (const c of candidates) {
-    if (fs19.existsSync(c)) return c;
+var init_enter = __esm({
+  "../core/src/orchestrator/enter.ts"() {
+    "use strict";
   }
-  return path22.resolve(process.cwd(), "packages/host-cp/compose.yaml");
-}
-function olamHome() {
-  return process.env.OLAM_HOME ?? path22.join(os12.homedir(), ".olam");
-}
-function tokenPath() {
-  return path22.join(olamHome(), "host-cp.token");
-}
-function pidPath() {
-  return path22.join(olamHome(), "host-cp.pid");
-}
-function authSecretPath() {
-  return path22.join(olamHome(), "auth-secret");
-}
-function readAuthSecret2() {
-  const filePath = authSecretPath();
-  if (!fs19.existsSync(filePath)) return null;
-  const raw = fs19.readFileSync(filePath, "utf-8").trim();
-  return raw.length > 0 ? raw : null;
-}
-function writeToken() {
-  const token = crypto5.randomBytes(32).toString("hex");
-  const filePath = tokenPath();
-  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
-  fs19.writeFileSync(filePath, token, { mode: 384 });
-  return token;
-}
-function readToken() {
-  const filePath = tokenPath();
-  if (!fs19.existsSync(filePath)) return null;
-  return fs19.readFileSync(filePath, "utf-8").trim();
+});
+
+// ../core/src/crystallize/checksum.ts
+var checksum_exports = {};
+__export(checksum_exports, {
+  computeGraphChecksum: () => computeGraphChecksum
+});
+import { createHash as createHash2 } from "node:crypto";
+function computeGraphChecksum(nodes, edges) {
+  const sortedNodes = [...nodes].sort((a, b) => a.id.localeCompare(b.id));
+  const sortedEdges = [...edges].sort((a, b) => a.id.localeCompare(b.id));
+  const payload = JSON.stringify({ nodes: sortedNodes, edges: sortedEdges });
+  return createHash2("sha256").update(payload).digest("hex");
 }
-function removeToken() {
-  const filePath = tokenPath();
-  if (!fs19.existsSync(filePath)) return false;
-  fs19.unlinkSync(filePath);
-  return true;
+var init_checksum = __esm({
+  "../core/src/crystallize/checksum.ts"() {
+    "use strict";
+  }
+});
+
+// ../core/src/config/machine-schema.ts
+var machine_schema_exports = {};
+__export(machine_schema_exports, {
+  MachineConfigSchema: () => MachineConfigSchema,
+  initMachineConfig: () => initMachineConfig,
+  readMachineConfig: () => readMachineConfig,
+  writeMachineConfig: () => writeMachineConfig
+});
+import * as fs34 from "node:fs";
+import * as path38 from "node:path";
+import * as os20 from "node:os";
+import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
+function readMachineConfig(configPath) {
+  const p = configPath ?? DEFAULT_CONFIG_PATH;
+  if (!fs34.existsSync(p)) return null;
+  try {
+    const raw = fs34.readFileSync(p, "utf-8");
+    const parsed = parseYaml5(raw);
+    return MachineConfigSchema.parse(parsed);
+  } catch {
+    return null;
+  }
 }
-function writePid(pid) {
-  const filePath = pidPath();
-  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
-  fs19.writeFileSync(filePath, String(pid), { mode: 420 });
+function writeMachineConfig(config, configPath) {
+  const p = configPath ?? DEFAULT_CONFIG_PATH;
+  fs34.mkdirSync(path38.dirname(p), { recursive: true });
+  fs34.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
 }
-function removePid() {
-  const filePath = pidPath();
-  if (!fs19.existsSync(filePath)) return false;
-  fs19.unlinkSync(filePath);
-  return true;
+function initMachineConfig(opts = {}) {
+  const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
+  const existing = readMachineConfig(configPath);
+  if (existing) return existing;
+  const config = MachineConfigSchema.parse({
+    telemetry: opts.telemetry ?? true
+  });
+  writeMachineConfig(config, configPath);
+  return config;
 }
-async function findHostCpContainer() {
-  const docker2 = new Dockerode2(resolveDockerHostOptions());
-  const containers = await docker2.listContainers({ all: true });
-  for (const c of containers) {
-    const names = (c.Names ?? []).map((n) => n.replace(/^\//, ""));
-    if (names.includes("olam-host-cp")) {
-      return {
-        id: c.Id.slice(0, 12),
-        name: "olam-host-cp",
-        state: c.State,
-        status: c.Status
-      };
-    }
+var MachineConfigSchema, DEFAULT_CONFIG_PATH;
+var init_machine_schema = __esm({
+  "../core/src/config/machine-schema.ts"() {
+    "use strict";
+    init_zod();
+    MachineConfigSchema = external_exports.object({
+      schema_version: external_exports.literal(1).default(1),
+      channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
+      auto_update: external_exports.boolean().default(true),
+      telemetry: external_exports.boolean().default(true),
+      worlds_dir: external_exports.string().default(() => path38.join(os20.homedir(), ".olam", "worlds"))
+    });
+    DEFAULT_CONFIG_PATH = path38.join(os20.homedir(), ".olam", "config.yaml");
   }
-  return null;
+});
+
+// src/index.ts
+import { Command } from "commander";
+import * as fs37 from "node:fs";
+import * as path41 from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+
+// src/commands/init.ts
+init_output();
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
+import { execSync } from "node:child_process";
+import pc3 from "picocolors";
+
+// src/commands/workspace.ts
+init_workspace();
+init_loader();
+init_output();
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+import pc2 from "picocolors";
+import { stringify as stringifyYaml2 } from "yaml";
+function printWorkspaceNotFound(name) {
+  printError(`No workspace named "${name}" under ${workspacesDir()}`);
 }
-async function probeHostCp() {
-  const candidateUrl = `http://127.0.0.1:${HOST_CP_PORT}`;
-  let httpOk = false;
-  try {
-    const res = await fetch(`${candidateUrl}/api/bootstrap`, {
-      signal: AbortSignal.timeout(2e3)
-    });
-    httpOk = res.ok;
-  } catch {
-    httpOk = false;
+function parseRepoFlag(raw) {
+  const hashIdx = raw.indexOf("#");
+  const url = hashIdx === -1 ? raw : raw.slice(0, hashIdx);
+  const branch = hashIdx === -1 ? void 0 : raw.slice(hashIdx + 1);
+  if (url.length === 0) throw new Error(`invalid --repo value "${raw}" (empty url)`);
+  if (branch !== void 0 && branch.length === 0) {
+    throw new Error(`invalid --repo value "${raw}" (empty branch after #)`);
   }
-  if (httpOk) {
-    let mode = "bare";
+  const nameFromUrl = url.replace(/\.git$/, "").split(/[\/:]/).filter(Boolean).at(-1) ?? "repo";
+  return branch ? { name: nameFromUrl, url, branch } : { name: nameFromUrl, url };
+}
+function registerWorkspace(program2) {
+  const workspace = program2.command("workspace").description("Manage the named catalog of repo bundles that worlds instantiate from");
+  workspace.command("list").description("List all workspaces (name, repoCount, updatedAt)").action(() => {
+    const all = listWorkspaces();
+    if (all.length === 0) {
+      console.log(pc2.dim(`No workspaces under ${workspacesDir()}`));
+      return;
+    }
+    printHeader(`${all.length} workspace(s)`);
+    for (const ws of all) {
+      const when = new Date(ws.updatedAt).toISOString().slice(0, 10);
+      console.log(
+        `  ${pc2.bold(ws.name.padEnd(24))} ${String(ws.repos.length).padEnd(3)} repos   ${pc2.dim(when)}`
+      );
+    }
+  });
+  workspace.command("show").description("Show a workspace as YAML").argument("<name>", "Workspace name").action((name) => {
     try {
-      const container = await findHostCpContainer();
-      if (container && container.state === "running") {
-        mode = "container";
+      const ws = readWorkspace(name);
+      if (!ws) {
+        printWorkspaceNotFound(name);
+        process.exitCode = 1;
+        return;
       }
-    } catch {
+      process.stdout.write(stringifyYaml2(ws));
+    } catch (err) {
+      printError(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
     }
-    return { url: candidateUrl, mode };
-  }
-  try {
-    const container = await findHostCpContainer();
-    if (container && container.state === "running") {
-      try {
-        const res = await fetch(`${candidateUrl}/api/bootstrap`, {
-          signal: AbortSignal.timeout(2e3)
-        });
-        if (res.ok) {
-          return { url: candidateUrl, mode: "container" };
+  });
+  workspace.command("remove").description("Delete a workspace (does NOT touch worlds that already referenced it)").argument("<name>", "Workspace name").option("--force", "Skip confirmation", false).action((name, _opts) => {
+    try {
+      if (removeWorkspace(name)) {
+        printSuccess(`Removed workspace "${name}"`);
+      } else {
+        printWorkspaceNotFound(name);
+        process.exitCode = 1;
+      }
+    } catch (err) {
+      printError(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
+    }
+  });
+  workspace.command("add").description("Create a workspace from --from-config (reads current .olam/config.yaml) or repeated --repo flags").argument("<name>", "Workspace name").option("--from-config", "Seed from the repos in the current project's .olam/config.yaml", false).option("--repo <url>", "Repeatable. Format: <url> or <url>#<branch>", (val, acc) => {
+    acc.push(parseRepoFlag(val));
+    return acc;
+  }, []).option("--default-branch <branch>", "Fallback branch for repos that don't specify one").option("--force", "Overwrite an existing workspace with the same name", false).action((name, opts) => {
+    try {
+      const repos = [...opts.repo];
+      if (opts.fromConfig) {
+        try {
+          const cfg = loadConfig(process.cwd());
+          for (const r of cfg.repos) {
+            repos.push({
+              name: r.name,
+              url: r.url,
+              ...r.submodules ? { submodules: true } : {}
+            });
+          }
+        } catch (err) {
+          printError(`--from-config: ${err instanceof Error ? err.message : String(err)}`);
+          process.exitCode = 1;
+          return;
         }
-      } catch {
       }
+      if (repos.length === 0) {
+        printError("No repos provided \u2014 pass --from-config or at least one --repo");
+        process.exitCode = 1;
+        return;
+      }
+      const ws = {
+        name,
+        repos,
+        ...opts.defaultBranch ? { defaults: { branch: opts.defaultBranch } } : {},
+        updatedAt: Date.now()
+      };
+      writeWorkspace(ws, { force: opts.force });
+      const file = path4.join(workspacesDir(), `${name}.yaml`);
+      printSuccess(`Created workspace "${name}" (${repos.length} repo${repos.length === 1 ? "" : "s"})`);
+      printInfo("File", file);
+      printInfo("Next", `olam create --name <world> --workspace ${name} --task "..."`);
+    } catch (err) {
+      if (err instanceof WorkspaceExistsError || err instanceof WorkspaceNameError) {
+        printError(err.message);
+        process.exitCode = 1;
+        return;
+      }
+      printError(err instanceof Error ? err.message : String(err));
+      process.exitCode = 1;
     }
-  } catch {
-  }
-  return null;
+  });
 }
-async function gatherProbeFailureDiagnostics() {
-  let bootstrapStatus = "no response";
-  try {
-    const res = await fetch(`http://127.0.0.1:${HOST_CP_PORT}/api/bootstrap`, {
-      signal: AbortSignal.timeout(2e3)
-    });
-    bootstrapStatus = `HTTP ${res.status}`;
-  } catch (err) {
-    bootstrapStatus = err instanceof Error ? err.message : "connection refused";
-  }
-  let containerStatus = "not found";
-  try {
-    const container = await findHostCpContainer();
-    if (!container) {
-      containerStatus = "not found";
-    } else {
-      containerStatus = `found (state: ${container.state})`;
+function ensureProjectWorkspaceFromConfig(projectRoot, workspaceName) {
+  const existing = (() => {
+    try {
+      return readWorkspace(workspaceName);
+    } catch {
+      return null;
     }
-  } catch {
-    containerStatus = "docker not available";
-  }
-  return { bootstrapStatus, containerStatus };
-}
-async function probeHealth() {
-  try {
-    const res = await fetch(`http://127.0.0.1:${HOST_CP_PORT}/health`, {
-      signal: AbortSignal.timeout(2e3)
-    });
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null;
+  })();
+  if (existing) {
+    return { created: false, file: path4.join(workspacesDir(), `${workspaceName}.yaml`) };
   }
-}
-function runCompose(args, composeFile, extraEnv = {}) {
-  const result = spawnSync4("docker", ["compose", "-f", composeFile, ...args], {
-    encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, ...extraEnv }
-  });
-  return {
-    ok: result.status === 0,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? ""
+  const cfg = loadConfig(projectRoot);
+  const repos = cfg.repos.map((r) => ({
+    name: r.name,
+    url: r.url,
+    ...r.submodules ? { submodules: true } : {}
+  }));
+  const ws = {
+    name: workspaceName,
+    repos,
+    updatedAt: Date.now()
   };
+  writeWorkspace(ws);
+  const file = path4.join(workspacesDir(), `${workspaceName}.yaml`);
+  return { created: true, file };
 }
-function buildComposeEnv(authSecret, ghToken) {
-  const env = {};
-  if (authSecret !== null && authSecret.length > 0) {
-    env.OLAM_AUTH_SECRET = authSecret;
-  }
-  if (ghToken != null && ghToken.length > 0) {
-    env.GH_TOKEN = ghToken;
-  }
-  return env;
+
+// src/commands/init.ts
+function detectProjectType(root) {
+  if (fs5.existsSync(path5.join(root, "Gemfile")) || fs5.existsSync(path5.join(root, "config", "routes.rb"))) return "rails";
+  if (fs5.existsSync(path5.join(root, "package.json"))) return "node";
+  if (fs5.existsSync(path5.join(root, "pyproject.toml")) || fs5.existsSync(path5.join(root, "requirements.txt"))) return "python";
+  return "generic";
 }
-function captureGhToken() {
+function getRepoName(root) {
   try {
-    const result = spawnSync4("gh", ["auth", "token"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    if (result.status === 0) {
-      const token = (result.stdout ?? "").trim();
-      return token.length > 0 ? token : null;
-    }
-    return null;
+    const url = execSync("git remote get-url origin", {
+      cwd: root,
+      encoding: "utf-8"
+    }).trim();
+    const match2 = url.match(/\/([^/]+?)(?:\.git)?$/);
+    if (match2) return match2[1];
   } catch {
-    return null;
   }
+  return path5.basename(root);
 }
-async function handleStart(opts) {
-  const existing = await findHostCpContainer();
-  if (existing && existing.state === "running") {
-    const health = await probeHealth();
-    if (health) {
-      printSuccess(`Host CP already running at http://127.0.0.1:${HOST_CP_PORT}`);
-      printInfo("Container", existing.id);
-      printInfo("Uptime", String(health["uptime_seconds"] ?? "unknown") + "s");
-      return;
-    }
-    printWarning("Host CP container running but /health not responding. Wait a few seconds and retry, or stop+start.");
-    return;
+function findProjectRoot(startDir) {
+  let current = path5.resolve(startDir);
+  while (true) {
+    if (fs5.existsSync(path5.join(current, ".git"))) return current;
+    const parent = path5.dirname(current);
+    if (parent === current) return startDir;
+    current = parent;
   }
-  try {
-    const docker2 = new Dockerode2(resolveDockerHostOptions());
-    await auditPortsForZombies(docker2, [HOST_CP_PORT]);
-  } catch (err) {
-    if (err instanceof PortHeldByZombieError) {
-      printError(`Port ${HOST_CP_PORT} held by zombie container "${err.containerName}" (state: ${err.state}).`);
-      printError(`Run: docker rm ${err.containerName}`);
+}
+function registerInit(program2) {
+  program2.command("init").description("Initialize olam in the current project").option("--path <path>", "Project root path", process.cwd()).option("--skip-pleri", "Skip Pleri setup").action(async (opts) => {
+    try {
+      const projectRoot = findProjectRoot(opts.path);
+      const olamDir = path5.join(projectRoot, ".olam");
+      if (fs5.existsSync(path5.join(olamDir, "config.yaml"))) {
+        printError(`Already initialized at ${olamDir}/config.yaml`);
+        process.exitCode = 1;
+        return;
+      }
+      const projectType = detectProjectType(projectRoot);
+      const repoName = getRepoName(projectRoot);
+      let remoteUrl;
+      try {
+        remoteUrl = execSync("git remote get-url origin", {
+          cwd: projectRoot,
+          encoding: "utf-8"
+        }).trim();
+      } catch {
+        remoteUrl = `git@github.com:your-org/${repoName}.git`;
+      }
+      fs5.mkdirSync(path5.join(olamDir, "state"), { recursive: true });
+      fs5.mkdirSync(path5.join(olamDir, "thoughts"), { recursive: true });
+      const pleriSection = opts.skipPleri ? "# pleri:\n#   base_url: ${PLERI_BASE_URL}\n#   plane_id: ${PLERI_PLANE_ID}\n#   api_key: ${PLERI_API_KEY}\n" : "pleri:\n  base_url: ${PLERI_BASE_URL}\n  plane_id: ${PLERI_PLANE_ID}\n  api_key: ${PLERI_API_KEY}\n";
+      const config = [
+        "version: 2",
+        "",
+        pleriSection,
+        "repos:",
+        `  - name: ${repoName}`,
+        `    url: ${remoteUrl}`,
+        `    path: ${projectRoot}`,
+        `    type: ${projectType}`,
+        "    services: []",
+        "",
+        "compute:",
+        "  default: docker",
+        "",
+        "cost:",
+        "  # All values in USD (Anthropic's billing currency).",
+        "  # Convert from your local currency: USD 25 \u2248 SGD 33 / EUR 23 / GBP 20",
+        "  # at typical 2026 rates. Dashboard display localization is a future feature.",
+        "  max_per_world_usd: 25",
+        "  max_daily_usd: 100",
+        "  warning_threshold: 0.8",
+        "",
+        "auth:",
+        "  mode: oauth",
+        ""
+      ].join("\n");
+      fs5.writeFileSync(path5.join(olamDir, "config.yaml"), config);
+      const envExample = [
+        "# Pleri credentials",
+        "PLERI_BASE_URL=https://pleri.dev/api",
+        "PLERI_PLANE_ID=",
+        "PLERI_API_KEY=",
+        ""
+      ].join("\n");
+      fs5.writeFileSync(path5.join(olamDir, ".env.example"), envExample);
+      printHeader("Olam initialized");
+      printInfo("Config", `${olamDir}/config.yaml`);
+      printInfo("Project", `${projectType} (detected)`);
+      printInfo("Repo", repoName);
+      try {
+        const result = ensureProjectWorkspaceFromConfig(projectRoot, repoName);
+        if (result.created) {
+          printInfo("Workspace", `${repoName} \u2192 ${result.file}`);
+        } else {
+          printInfo("Workspace", `${repoName} (already registered)`);
+        }
+      } catch (err) {
+        printError(`Workspace auto-register failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      console.log(`
+${pc3.dim(`Next: olam create --name my-world --workspace ${repoName} --task "..."`)}`);
+    } catch (err) {
+      printError(err instanceof Error ? err.message : String(err));
       process.exitCode = 1;
-      return;
     }
-    throw err;
-  }
-  const token = writeToken();
-  const composeFile = findComposeFile();
-  if (!fs19.existsSync(composeFile)) {
-    printError(`compose.yaml not found at ${composeFile}. Run from the olam project root.`);
-    removeToken();
-    process.exitCode = 1;
-    return;
-  }
-  const authSecret = readAuthSecret2();
-  if (authSecret === null) {
-    printWarning(
-      `${authSecretPath()} not found or empty. host-cp will boot, but credential surfaces (auth fleet, hotswap) will fail with 401 until you run \`olam auth up\` to (re)generate the shared secret.`
+  });
+}
+
+// src/commands/install.ts
+import * as fs6 from "node:fs";
+import * as os3 from "node:os";
+import * as path6 from "node:path";
+import pc4 from "picocolors";
+import { stringify as stringifyYaml3 } from "yaml";
+
+// ../core/src/archetypes/capabilities.ts
+var CAPABILITY_NAMES = [
+  // World operations
+  "world.create",
+  "world.operate",
+  "world.destroy",
+  // Workspace catalog
+  "workspace.read",
+  "workspace.write",
+  // Auth container + credentials. Phase 6b.2/A5: `auth.manage`
+  // removed — its only consumer (/auth/revoke) was reclassified to
+  // `auth.login` (self-managed auth flow) in A2, and the only
+  // archetype that held it (`bootstrapper`) is also removed below.
+  "auth.login",
+  "auth.read",
+  // PR gate
+  "pr-gate.read",
+  "pr-gate.decide",
+  // Policy
+  "policy.set",
+  // Phase 6b.2/A5: `role.manage` removed — Pylon owns role grants
+  // (`pylon role grant ...` from a user terminal). The `/api/roles*`
+  // route handlers were deleted in A2.
+  // Phase 6b.2/A5: `bootstrap.install` and `bootstrap.cf-deploy`
+  // removed — `/bootstrap` route handler deleted in A2; the
+  // `bootstrapper` archetype is also removed in this commit.
+  // Dev-only (repo clone privileges)
+  "dev.build",
+  "dev.test",
+  "dev.release"
+];
+var CAPABILITY_SET = new Set(CAPABILITY_NAMES);
+function isCapability(value) {
+  return CAPABILITY_SET.has(value);
+}
+function assertCapability(value) {
+  if (!isCapability(value)) {
+    throw new Error(
+      `Unknown capability "${value}". Valid capabilities: ${CAPABILITY_NAMES.join(", ")}`
     );
   }
-  const ghToken = captureGhToken();
-  if (ghToken === null) {
-    printWarning(
-      "GitHub CLI not authenticated; PR badges will not appear in the inbox. Run `gh auth login` then `olam host-cp restart`."
+  return value;
+}
+
+// ../core/src/archetypes/registry.ts
+var ARCHETYPES = [
+  {
+    name: "user",
+    description: "Day-to-day world operator. Creates, runs, and tears down worlds; decides PR gates; reads the workspace catalog.",
+    capabilities: [
+      "world.create",
+      "world.operate",
+      "world.destroy",
+      "workspace.read",
+      "auth.login",
+      "auth.read",
+      "pr-gate.read",
+      "pr-gate.decide"
+    ]
+  },
+  {
+    name: "workspace-curator",
+    description: "User who also curates the workspace catalog. Typical: team lead scoping their squad's repo bundles.",
+    inherits: ["user"],
+    capabilities: ["workspace.write"]
+  },
+  {
+    name: "policy-admin",
+    description: "User who also sets deployment policy (permission mode, PR-gate defaults). No catalog or role authority.",
+    inherits: ["user"],
+    capabilities: ["policy.set"]
+  },
+  // Phase 6b.2/A5: `bootstrapper` archetype removed. Its capabilities
+  // (bootstrap.install, bootstrap.cf-deploy, auth.manage) are no
+  // longer enforced — `/bootstrap` route + `auth.manage` route
+  // gating are gone (deleted in A2). The trim keeps `admin` valid
+  // (no dangling inherits ref) and lets schema push succeed.
+  {
+    name: "admin",
+    description: "Full operational admin. Unions user + workspace-curator + policy-admin. Pylon owns role grants now (no role.manage).",
+    inherits: ["user", "workspace-curator", "policy-admin"],
+    capabilities: []
+  },
+  {
+    name: "dev",
+    description: "Contributor to Olam itself. Everything an admin has, plus repo-local dev operations (build, test, release).",
+    inherits: ["admin"],
+    capabilities: ["dev.build", "dev.test", "dev.release"]
+  }
+];
+var ARCHETYPE_BY_NAME = new Map(
+  ARCHETYPES.map((a) => [a.name, a])
+);
+function getArchetype(name) {
+  return ARCHETYPE_BY_NAME.get(name);
+}
+function listArchetypeNames() {
+  return ARCHETYPES.map((a) => a.name);
+}
+
+// ../core/src/archetypes/expand.ts
+var UnknownArchetypeError = class extends Error {
+  constructor(name, known) {
+    super(
+      `Unknown archetype "${name}". Known archetypes: ${known.join(", ")}`
     );
+    this.name = name;
+    this.known = known;
+    this.name = "UnknownArchetypeError";
   }
-  const composeEnv = buildComposeEnv(authSecret, ghToken);
-  const PULL_BACKOFF_MS = [0, 1e3, 3e3];
-  let pullOk = false;
-  let lastPullStderr = "";
-  for (let attempt = 0; attempt < PULL_BACKOFF_MS.length; attempt += 1) {
-    if (PULL_BACKOFF_MS[attempt] > 0) {
-      await new Promise((r) => setTimeout(r, PULL_BACKOFF_MS[attempt]));
-    }
-    const pullResult = runCompose(
-      ["pull", "--quiet", "docker-socket-proxy"],
-      composeFile,
-      composeEnv
+  name;
+  known;
+};
+var ArchetypeCycleError = class extends Error {
+  constructor(path42) {
+    super(
+      `Archetype inheritance cycle detected: ${path42.join(" \u2192 ")} \u2192 ${path42[0] ?? "?"}`
     );
-    if (pullResult.ok) {
-      pullOk = true;
-      break;
-    }
-    lastPullStderr = pullResult.stderr;
-  }
-  if (!pullOk) {
-    printError("docker compose pull docker-socket-proxy failed after 3 attempts");
-    process.stderr.write(lastPullStderr);
-    removeToken();
-    process.exitCode = 1;
-    return;
-  }
-  const result = runCompose(["up", "-d"], composeFile, composeEnv);
-  if (!result.ok) {
-    printError("docker compose up failed");
-    process.stderr.write(result.stderr);
-    removeToken();
-    process.exitCode = 1;
-    return;
-  }
-  const deadline = Date.now() + 1e4;
-  let healthy = false;
-  while (Date.now() < deadline) {
-    const h = await probeHealth();
-    if (h) {
-      healthy = true;
-      break;
-    }
-    await new Promise((r) => setTimeout(r, 500));
-  }
-  if (!healthy) {
-    printWarning("Host CP started but /health did not respond within 10s. Check `docker compose logs host-cp`.");
-  }
-  const container = await findHostCpContainer();
-  if (container) {
-    writePid(1);
-  }
-  printSuccess(`Host CP running at http://127.0.0.1:${HOST_CP_PORT}`);
-  if (opts.showToken) {
-    printInfo("Token", token);
-  } else {
-    printInfo("Token", `(written to ${tokenPath()}; pass --show-token to print)`);
+    this.path = path42;
+    this.name = "ArchetypeCycleError";
   }
-  printInfo("Open", `http://127.0.0.1:${HOST_CP_PORT}`);
+  path;
+};
+function expandArchetype(name) {
+  const out = /* @__PURE__ */ new Set();
+  walk(name, out, []);
+  return out;
 }
-async function handleStop() {
-  const composeFile = findComposeFile();
-  if (!fs19.existsSync(composeFile)) {
-    printWarning(`compose.yaml not found at ${composeFile}. Cleaning up token + PID anyway.`);
-    removeToken();
-    removePid();
-    return;
-  }
-  const existing = await findHostCpContainer();
-  if (!existing) {
-    printInfo("Host CP", "not running");
-    removeToken();
-    removePid();
-    return;
+function walk(name, acc, stack) {
+  if (stack.includes(name)) {
+    throw new ArchetypeCycleError([...stack, name]);
   }
-  const result = runCompose(["down"], composeFile);
-  if (!result.ok) {
-    printError("docker compose down failed");
-    process.stderr.write(result.stderr);
-    process.exitCode = 1;
-    return;
+  const arch2 = getArchetype(name);
+  if (!arch2) {
+    throw new UnknownArchetypeError(name, listArchetypeNames());
   }
-  removeToken();
-  removePid();
-  printSuccess("Host CP stopped");
-}
-async function buildStatusReport() {
-  const container = await findHostCpContainer();
-  const health = await probeHealth();
-  const tokenFile = tokenPath();
-  const tokenPresent = fs19.existsSync(tokenFile);
-  let tokenModeOk = false;
-  if (tokenPresent) {
-    const mode = fs19.statSync(tokenFile).mode & 511;
-    tokenModeOk = mode === 384;
+  const nextStack = [...stack, name];
+  for (const parent of arch2.inherits ?? []) {
+    walk(parent, acc, nextStack);
   }
-  const pidPresent = fs19.existsSync(pidPath());
-  let stack;
-  if (!container) {
-    stack = "not_started";
-  } else if (container.state === "running" && health) {
-    stack = "running";
-  } else if (container.state === "running") {
-    stack = "partial";
-  } else {
-    stack = "stopped";
+  for (const cap of arch2.capabilities) {
+    acc.add(cap);
   }
-  return {
-    stack,
-    container,
-    health,
-    token_present: tokenPresent,
-    token_mode_ok: tokenModeOk,
-    pid_present: pidPresent,
-    url: `http://127.0.0.1:${HOST_CP_PORT}`
-  };
 }
-async function handleStatus(opts) {
-  const report = await buildStatusReport();
-  if (opts.json) {
-    process.stdout.write(JSON.stringify(report, null, 2) + "\n");
-    process.exitCode = report.stack === "running" ? 0 : 1;
-    return;
-  }
-  printHeader("Host CP Status");
-  printInfo("Stack", report.stack);
-  printInfo("URL", report.url);
-  if (report.container) {
-    printInfo("Container", `${report.container.id} (${report.container.state})`);
-    printInfo("Status line", report.container.status);
-  } else {
-    printInfo("Container", "not found (run `olam host-cp start`)");
-  }
-  if (report.health) {
-    printInfo("Health", "ok");
-    printInfo("Uptime", String(report.health["uptime_seconds"] ?? "unknown") + "s");
-    const cache = report.health["cache"];
-    if (cache) {
-      printInfo("Cached worlds", String(cache.worlds?.length ?? 0));
-      printInfo("Cache TTL", `${cache.ttl_sec ?? "unknown"}s`);
-    }
-    const sse = report.health["sse"];
-    if (sse) {
-      printInfo("SSE active", `${sse.active ?? 0} / ${sse.cap ?? 0}`);
+
+// src/commands/install.ts
+init_output();
+var ROLE_FILE_PATH = path6.join(os3.homedir(), ".olam", "role.yaml");
+function readRoleFile() {
+  if (!fs6.existsSync(ROLE_FILE_PATH)) return null;
+  try {
+    const raw = fs6.readFileSync(ROLE_FILE_PATH, "utf-8");
+    const m = /archetype:\s*(\S+)/.exec(raw);
+    if (!m) return null;
+    const archetype = m[1];
+    const customCapabilities = [];
+    for (const line of raw.split("\n")) {
+      const caps = /^\s+-\s+(\S+)$/.exec(line);
+      if (caps) customCapabilities.push(caps[1]);
     }
-  } else {
-    printInfo("Health", "not responding");
+    const installedAtMatch = /installedAt:\s*(\d+)/.exec(raw);
+    return {
+      archetype,
+      customCapabilities,
+      installedAt: installedAtMatch ? Number(installedAtMatch[1]) : 0
+    };
+  } catch {
+    return null;
   }
-  printInfo("Token file", report.token_present ? report.token_mode_ok ? "present (mode 600)" : "present (BAD MODE \u2014 should be 600)" : "absent");
-  printInfo("PID file", report.pid_present ? "present" : "absent");
-  process.exitCode = report.stack === "running" ? 0 : 1;
 }
-function registerHostCp(program2) {
-  const hostCp = program2.command("host-cp").description("Manage the Olam host control plane container");
-  hostCp.command("start").description("Start the host CP container (token regenerated each call)").option("--show-token", "Print the generated token to stdout (default: hide)").action(async (opts) => {
-    await handleStart({ showToken: opts.showToken === true });
-  });
-  hostCp.command("stop").description("Stop the host CP container + remove token + PID files").action(async () => {
-    await handleStop();
-  });
-  hostCp.command("status").description("Show host CP container + health diagnostics").option("--json", "Output as JSON (machine-parseable; sets exit code)").action(async (opts) => {
-    await handleStatus({ json: opts.json === true });
-  });
-  hostCp.command("register").description("Register a world with the running host CP so it appears in the unified UI").requiredOption("--world <id>", "World id (the docker container suffix, e.g. gold-arc-1454)").option("--port <port>", "Override per-world CP port; default: discovered from `olam list`").action(async (opts) => {
-    await handleRegister({ world: opts.world, port: opts.port });
-  });
-  hostCp.command("deregister").description("Remove a world from the host CP registry (does NOT destroy the world)").requiredOption("--world <id>", "World id to remove").action(async (opts) => {
-    await handleDeregister({ world: opts.world });
+function writeRoleFile(role) {
+  fs6.mkdirSync(path6.dirname(ROLE_FILE_PATH), { recursive: true });
+  const yaml = stringifyYaml3({
+    archetype: role.archetype,
+    customCapabilities: [...role.customCapabilities],
+    installedAt: role.installedAt
   });
+  fs6.writeFileSync(ROLE_FILE_PATH, yaml, { mode: 420 });
 }
-async function discoverWorldPort(worldId) {
-  try {
-    const { loadContext: loadContext2 } = await Promise.resolve().then(() => (init_context(), context_exports));
-    const { ctx } = await loadContext2();
-    if (!ctx) return null;
-    const world = await ctx.worldManager.getWorld(worldId);
-    if (!world) return null;
-    return 19080 + world.portOffset;
-  } catch {
-    return null;
+function nextStepsFor(archetype) {
+  switch (archetype) {
+    case "user":
+      return [
+        'You can now run `olam create --task "..."` against a workspace your admin has curated.',
+        "Register the Claude Code plugin if you haven't: `claude plugin install ./plugin`."
+      ];
+    case "workspace-curator":
+      return [
+        "You can now curate the catalog: `olam workspace add <name> --from-config`.",
+        "Share workspace YAML files via your usual dotfiles / rsync flow."
+      ];
+    case "policy-admin":
+      return [
+        "Set deployment-wide policy via env vars (OLAM_CLAUDE_PERMISSION_MODE) or wrangler secrets.",
+        "PR-gate defaults can be overridden per-workspace under `policy.set`."
+      ];
+    case "bootstrapper":
+      return [
+        "Start the auth container: `olam auth up`, then `olam auth login`.",
+        "For Cloudflare deployments: `cd packages/cloudflare-worker && pnpm wrangler deploy`."
+      ];
+    case "admin":
+      return [
+        "Start the auth container: `olam auth up`, then `olam auth login`.",
+        "Curate workspaces: `olam workspace add <name> --from-config`.",
+        "Assign narrower archetypes to teammates (CF side, once slice C lands): use `role.manage`."
+      ];
+    case "dev":
+      return [
+        "You have repo-local privileges. Run `npm run build:ci && npm run test:ci`.",
+        "Everything an admin has is available."
+      ];
+    default:
+      return [];
   }
 }
-async function readHostCpToken2() {
-  const tp = tokenPath();
-  if (!fs19.existsSync(tp)) return null;
-  return fs19.readFileSync(tp, "utf-8").trim();
-}
-async function callHostCpProxy(method, worldId, path40, body) {
-  const token = await readHostCpToken2();
-  if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path40}`;
-  try {
-    const headers = {
-      Authorization: `Bearer ${token}`
-    };
-    if (body !== void 0) headers["Content-Type"] = "application/json";
-    const res = await fetch(url, {
-      method,
-      headers,
-      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      let errMsg = text || `HTTP ${res.status}`;
+function registerInstall(program2) {
+  program2.command("install").description("Pick an archetype preset for this Olam install").option("--as <archetype>", "Archetype name (user, workspace-curator, policy-admin, bootstrapper, admin, dev)").option(
+    "--capability <name>",
+    "Additional capability to grant beyond the archetype preset (repeatable)",
+    (value, acc) => {
+      acc.push(value);
+      return acc;
+    },
+    []
+  ).option("--force", "Overwrite an existing role.yaml", false).option("--show", "Print the current install's archetype and exit", false).action((opts) => {
+    if (opts.show) {
+      const existing2 = readRoleFile();
+      if (!existing2) {
+        console.log(pc4.dim(`No install recorded at ${ROLE_FILE_PATH}`));
+        return;
+      }
+      printHeader("Current install");
+      printInfo("Archetype", existing2.archetype);
+      printInfo("File", ROLE_FILE_PATH);
+      const caps = expandArchetype(existing2.archetype);
+      for (const cap of existing2.customCapabilities) caps.add(cap);
+      printHeader(`Effective capabilities (${caps.size})`);
+      for (const cap of [...caps].sort()) {
+        console.log(`  ${cap}`);
+      }
+      return;
+    }
+    if (!opts.as) {
+      printError("Missing --as <archetype>. Known archetypes:");
+      for (const arch2 of ARCHETYPES) {
+        console.log(`  ${pc4.bold(arch2.name.padEnd(20))} ${pc4.dim(arch2.description)}`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    const archetype = getArchetype(opts.as);
+    if (!archetype) {
+      printError(
+        `Unknown archetype "${opts.as}". Known: ${listArchetypeNames().join(", ")}`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const extras = [];
+    for (const raw of opts.capability) {
       try {
-        const parsed = JSON.parse(text);
-        if (parsed && typeof parsed === "object" && "error" in parsed) {
-          errMsg = String(parsed.error);
-        }
-      } catch {
+        extras.push(assertCapability(raw));
+      } catch (err) {
+        printError(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+        return;
       }
-      return { ok: false, status: res.status, error: errMsg };
     }
-    const data = await res.json().catch(() => null);
-    return { ok: true, status: res.status, data };
-  } catch (err) {
-    return {
-      ok: false,
-      status: 0,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-async function callHostCpRegistry(method, body) {
-  const token = await readHostCpToken2();
-  if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = method === "DELETE" ? `http://127.0.0.1:${HOST_CP_PORT}/api/admin/registry/${encodeURIComponent(body.id)}` : `http://127.0.0.1:${HOST_CP_PORT}/api/admin/registry`;
-  try {
-    const res = await fetch(url, {
-      method,
-      headers: {
-        Authorization: `Bearer ${token}`,
-        ...method === "POST" ? { "Content-Type": "application/json" } : {}
-      },
-      ...method === "POST" ? { body: JSON.stringify(body) } : {}
+    const existing = readRoleFile();
+    if (existing && !opts.force) {
+      printError(
+        `Install already recorded as "${existing.archetype}" at ${ROLE_FILE_PATH}. Pass --force to overwrite.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    let resolved;
+    try {
+      resolved = expandArchetype(archetype.name);
+    } catch (err) {
+      if (err instanceof UnknownArchetypeError) {
+        printError(err.message);
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
+    }
+    for (const extra of extras) resolved.add(extra);
+    writeRoleFile({
+      archetype: archetype.name,
+      customCapabilities: extras,
+      installedAt: Date.now()
     });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      return { ok: false, status: res.status, error: text || `HTTP ${res.status}` };
+    printHeader(`Installed as ${pc4.bold(archetype.name)}`);
+    printInfo("File", ROLE_FILE_PATH);
+    printInfo("Description", archetype.description);
+    printInfo("Capabilities", `${resolved.size} total`);
+    if (extras.length > 0) {
+      printInfo("Added beyond preset", extras.join(", "));
     }
-    return { ok: true, status: res.status };
-  } catch (err) {
-    return {
-      ok: false,
-      status: 0,
-      error: err instanceof Error ? err.message : String(err)
-    };
+    const steps = nextStepsFor(archetype.name);
+    if (steps.length > 0) {
+      printHeader("Next steps");
+      for (const step of steps) console.log(`  ${pc4.dim("\u2022")} ${step}`);
+    }
+    printSuccess("Done. Run `olam install --show` to see the full capability list.");
+  });
+}
+
+// src/commands/auth.ts
+init_auth();
+init_output();
+import pc8 from "picocolors";
+import * as readline from "node:readline/promises";
+import { spawn as spawn3 } from "node:child_process";
+
+// src/commands/auth-status.ts
+import * as fs8 from "node:fs";
+import * as os5 from "node:os";
+import * as path9 from "node:path";
+import pc5 from "picocolors";
+
+// ../auth-logic/dist/effective-state.js
+function effectiveState(account, now = Date.now()) {
+  const persisted = account.state ?? (account.rateLimited ? "cooldown" : "active");
+  if (persisted === "disabled")
+    return "disabled";
+  if (account.expiresAt != null && account.expiresAt <= now)
+    return "expired";
+  if (persisted === "cooldown" || persisted === "usage-capped") {
+    const reset = account.rateLimitResetsAt ? new Date(account.rateLimitResetsAt).getTime() : 0;
+    if (reset > 0 && reset <= now)
+      return "active";
+    return persisted;
   }
+  return "active";
 }
-async function handleRegister(opts) {
-  printHeader("Register world with host CP");
-  let port = null;
-  if (opts.port) {
-    port = parseInt(opts.port, 10);
-    if (!Number.isFinite(port) || port <= 0) {
-      printError(`Invalid --port value: ${opts.port}`);
-      process.exitCode = 1;
-      return;
+
+// ../auth-logic/dist/pick-credential.js
+function pickCredential(accounts, now = Date.now()) {
+  const active = accounts.filter((a) => effectiveState(a, now) === "active");
+  if (active.length === 0)
+    return null;
+  return [...active].sort((a, b) => {
+    const aCount = a.usage?.requestCount5h ?? 0;
+    const bCount = b.usage?.requestCount5h ?? 0;
+    if (aCount !== bCount)
+      return aCount - bCount;
+    const aLast = a.lastUsed ? new Date(a.lastUsed).getTime() : 0;
+    const bLast = b.lastUsed ? new Date(b.lastUsed).getTime() : 0;
+    return aLast - bLast;
+  })[0] ?? null;
+}
+
+// ../auth-logic/dist/next-cooldown-reset.js
+function nextCooldownReset(accounts, now = Date.now()) {
+  const upcoming = accounts.filter((a) => effectiveState(a, now) === "cooldown").map((a) => a.rateLimitResetsAt ? new Date(a.rateLimitResetsAt).getTime() : 0).filter((ts) => ts > now).sort((a, b) => a - b);
+  return upcoming.length > 0 ? new Date(upcoming[0]).toISOString() : null;
+}
+
+// src/commands/auth-status.ts
+init_auth();
+init_output();
+init_exit_codes();
+var LOCAL_DATA_DIR = path9.join(os5.homedir(), ".olam", "auth-data");
+function localHHMM(isoStr) {
+  const d = new Date(isoStr);
+  return d.toLocaleTimeString(void 0, {
+    hour: "2-digit",
+    minute: "2-digit",
+    hour12: false
+  });
+}
+function daysAgoStr(expiresAt, now) {
+  const diffDays = Math.floor((now - expiresAt) / (1e3 * 60 * 60 * 24));
+  if (diffDays <= 0) return "expired today";
+  return `expired ${diffDays} day${diffDays === 1 ? "" : "s"} ago`;
+}
+function trunc(s, maxLen) {
+  return s.length > maxLen ? s.slice(0, maxLen) : s;
+}
+var STATE_PRIORITY = {
+  active: 0,
+  cooldown: 1,
+  "usage-capped": 2,
+  disabled: 3,
+  expired: 4
+};
+function formatAuthStatus(accounts, now = Date.now()) {
+  const picked = pickCredential(accounts, now);
+  const rows = accounts.map((account) => {
+    const state = effectiveState(account, now);
+    const isPicked = picked != null && account.id === picked.id;
+    const req5h = account.usage?.requestCount5h ?? 0;
+    const last429 = account.usage?.last429At ? localHHMM(account.usage.last429At) : "never";
+    let reason;
+    if (isPicked) {
+      reason = "\u2190 selected";
+    } else if (state === "active") {
+      reason = `req5h=${req5h} (higher than candidate)`;
+    } else if (state === "cooldown") {
+      const resetTime = account.rateLimitResetsAt ? localHHMM(account.rateLimitResetsAt) : "?";
+      reason = `cooldown until ${resetTime}`;
+    } else if (state === "expired") {
+      reason = daysAgoStr(account.expiresAt ?? 0, now);
+    } else {
+      reason = "disabled";
     }
-  } else {
-    port = await discoverWorldPort(opts.world);
-    if (port === null) {
-      printError(
-        `Could not discover port for world ${opts.world}. Pass --port explicitly or check that the world exists in \`olam list\`.`
+    return { id: account.id, label: account.accountLabel ?? account.id, state, reason, req5h, last429, isPicked };
+  });
+  rows.sort((a, b) => {
+    if (a.isPicked !== b.isPicked) return a.isPicked ? -1 : 1;
+    return STATE_PRIORITY[a.state] - STATE_PRIORITY[b.state];
+  });
+  const COL = { id: 17, label: 17, state: 11, reason: 28, req5h: 7 };
+  const lines = [];
+  const hdr = "id".padEnd(COL.id) + "label".padEnd(COL.label) + "state".padEnd(COL.state) + "reason".padEnd(COL.reason) + "req5h".padEnd(COL.req5h) + "last429";
+  lines.push(pc5.dim(hdr));
+  lines.push(pc5.dim("-".repeat(hdr.length)));
+  for (const row of rows) {
+    const id = trunc(row.id, 16).padEnd(COL.id);
+    const label = trunc(row.label, 16).padEnd(COL.label);
+    const stateRaw = row.state.padEnd(COL.state);
+    const stateColored = row.state === "active" ? pc5.green(stateRaw) : row.state === "cooldown" ? pc5.yellow(stateRaw) : row.state === "expired" ? pc5.red(stateRaw) : pc5.dim(stateRaw);
+    const reason = row.reason.padEnd(COL.reason);
+    const req5h = String(row.req5h).padEnd(COL.req5h);
+    if (row.isPicked) {
+      lines.push(
+        pc5.bold(id) + pc5.bold(label) + stateColored + pc5.green(reason) + pc5.dim(req5h) + pc5.dim(row.last429)
       );
-      process.exitCode = 1;
-      return;
+    } else {
+      lines.push(id + label + stateColored + reason + pc5.dim(req5h) + pc5.dim(row.last429));
     }
   }
-  const result = await callHostCpRegistry("POST", { id: opts.world, port });
-  if (!result.ok) {
-    printError(`Register failed: ${result.error}`);
-    if (result.status === 0) {
-      printInfo("Hint", "Is host CP running? `olam host-cp status`");
-    }
+  if (picked == null) {
+    const resetIso = nextCooldownReset(accounts, now);
+    lines.push("");
+    lines.push(
+      resetIso ? pc5.yellow(`Next reset: ${localHHMM(resetIso)}`) : pc5.dim("No reset scheduled")
+    );
+    return { output: lines.join("\n"), exitCode: EXIT_AUTH_NEEDS_ATTENTION };
+  }
+  return { output: lines.join("\n"), exitCode: 0 };
+}
+function toSafeAccount(a) {
+  return {
+    id: a.id,
+    accountLabel: a.accountLabel,
+    // expiresAt not exposed in summary — state is pre-computed server-side
+    rateLimited: a.rateLimited,
+    rateLimitResetsAt: a.rateLimitResetsAt,
+    lastUsed: a.lastUsed,
+    state: a.state,
+    usage: a.usage ? { requestCount5h: a.usage.requestCount5h, last429At: a.usage.last429At } : void 0
+  };
+}
+async function runAuthStatus(getStatus) {
+  const fetchStatus = getStatus ?? (() => new AuthClient().status());
+  let status;
+  try {
+    status = await fetchStatus();
+  } catch {
+    printError("Failed to contact auth service. Run `olam auth up` first.");
     process.exitCode = 1;
     return;
   }
-  printSuccess(`Registered ${opts.world} \u2192 :${port}`);
-  printInfo("UI", `http://127.0.0.1:${HOST_CP_PORT}/world/${encodeURIComponent(opts.world)}`);
-}
-async function handleDeregister(opts) {
-  printHeader("Deregister world from host CP");
-  const result = await callHostCpRegistry("DELETE", { id: opts.world });
-  if (!result.ok) {
-    printError(`Deregister failed: ${result.error}`);
-    if (result.status === 0) {
-      printInfo("Hint", "Is host CP running? `olam host-cp status`");
-    }
+  if (!status.reachable) {
+    printError("Auth container is not reachable. Run `olam auth up` first.");
     process.exitCode = 1;
     return;
   }
-  printSuccess(`Deregistered ${opts.world}`);
+  if (status.accounts.length === 0) {
+    console.log(pc5.dim("No credentials found. Run: olam auth login"));
+    return;
+  }
+  const accounts = status.accounts.map(toSafeAccount);
+  const result = formatAuthStatus(accounts);
+  console.log(result.output);
+  if (result.exitCode !== 0) {
+    process.exitCode = result.exitCode;
+  }
 }
 
 // src/commands/auth-upgrade.ts
+init_output();
+init_host_cp();
 init_auth();
+import * as fs20 from "node:fs";
+import * as path23 from "node:path";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import ora2 from "ora";
+import pc7 from "picocolors";
 
 // src/commands/bootstrap.ts
 init_install_root();
 init_exit_codes();
 init_protocol_version();
+init_output();
 import { spawn as spawn2, spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync19, readFileSync as readFileSync15 } from "node:fs";
 import { join as join25 } from "node:path";
@@ -14063,9 +14223,9 @@ async function defaultRecreateAuth() {
     });
     const controller = new AuthContainerController();
     controller.start();
-    const healthy = await waitForAuthHealth(15e3);
+    const healthy = await waitForAuthHealth(6e4);
     if (!healthy) {
-      return { ok: false, error: "auth-service /health did not respond within 15s" };
+      return { ok: false, error: "auth-service /health did not respond within 60s" };
     }
     return { ok: true };
   } catch (err) {
@@ -14504,9 +14664,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path40, mtimeMs } of result.newerSources) {
+  for (const { path: path42, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path40}  (modified ${when})`);
+    lines.push(`  \u2022 ${path42}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -14663,18 +14823,20 @@ function decideWorkspaceMatch(input) {
 
 // src/commands/create.ts
 init_context();
+init_output();
+init_host_cp();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs36 } = await import("node:fs");
-    const { default: os21 } = await import("node:os");
-    const { default: path40 } = await import("node:path");
-    const tp = path40.join(
-      process.env.OLAM_HOME ?? path40.join(os21.homedir(), ".olam"),
+    const { default: fs38 } = await import("node:fs");
+    const { default: os22 } = await import("node:os");
+    const { default: path42 } = await import("node:path");
+    const tp = path42.join(
+      process.env.OLAM_HOME ?? path42.join(os22.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs36.existsSync(tp)) return null;
-    return fs36.readFileSync(tp, "utf-8").trim();
+    if (!fs38.existsSync(tp)) return null;
+    return fs38.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -15036,12 +15198,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs36 } = await import("node:fs");
-    const { default: os21 } = await import("node:os");
-    const { default: path40 } = await import("node:path");
-    const tp = path40.join(os21.homedir(), ".olam", "host-cp.token");
-    if (!fs36.existsSync(tp)) return null;
-    const raw = fs36.readFileSync(tp, "utf-8").trim();
+    const { default: fs38 } = await import("node:fs");
+    const { default: os22 } = await import("node:os");
+    const { default: path42 } = await import("node:path");
+    const tp = path42.join(os22.homedir(), ".olam", "host-cp.token");
+    if (!fs38.existsSync(tp)) return null;
+    const raw = fs38.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -15084,6 +15246,7 @@ async function fetchHostCpExactMatches(projects) {
 
 // src/commands/dispatch.ts
 init_context();
+init_output();
 import ora4 from "ora";
 import pc10 from "picocolors";
 
@@ -15106,6 +15269,10 @@ function registerDispatch(program2) {
       process.exitCode = 1;
       return;
     }
+    {
+      const { checkVersionPin: checkVersionPin2 } = await Promise.resolve().then(() => (init_version_pin(), version_pin_exports));
+      checkVersionPin2(worldId, worldMeta.workspacePath);
+    }
     if (worldMeta.status !== "running") {
       printError(`World "${worldId}" is ${worldMeta.status}. Only running worlds accept dispatches.`);
       process.exitCode = 1;
@@ -15180,6 +15347,7 @@ ${pc10.dim(`Watch live: docker exec -it ${containerName} tmux attach -t claude-m
 
 // src/commands/observe.ts
 init_context();
+init_output();
 import pc11 from "picocolors";
 function registerObserve(program2) {
   program2.command("observe").description("Stream thoughts from a world (coming soon)").argument("<world>", "World ID").action(async (worldId) => {
@@ -15195,6 +15363,10 @@ function registerObserve(program2) {
       process.exitCode = 1;
       return;
     }
+    {
+      const { checkVersionPin: checkVersionPin2 } = await Promise.resolve().then(() => (init_version_pin(), version_pin_exports));
+      checkVersionPin2(worldId, world.workspacePath);
+    }
     console.log(
       pc11.yellow("Observation is coming in a future release.")
     );
@@ -15211,6 +15383,7 @@ ${pc11.dim(`For now: docker exec -it ${containerName} tmux attach -t claude-main
 
 // src/commands/list.ts
 init_context();
+init_output();
 import pc12 from "picocolors";
 function registerList(program2) {
   program2.command("list").alias("ls").description("List active worlds").action(async () => {
@@ -15241,10 +15414,88 @@ function registerList(program2) {
 }
 
 // src/commands/status.ts
-init_context();
+init_output();
+import * as fs22 from "node:fs";
+import * as os13 from "node:os";
+import * as path25 from "node:path";
+var CLI_VERSION2 = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
+var HOST_CP_PORT2 = 19e3;
+async function getMachineStatus(_probe, _loadCtx, _readToken) {
+  const probe = _probe ?? (async () => {
+    const { probeHostCp: probeHostCp2 } = await Promise.resolve().then(() => (init_host_cp(), host_cp_exports));
+    return probeHostCp2();
+  });
+  let readToken2;
+  if (_readToken) {
+    readToken2 = _readToken;
+  } else {
+    const { readToken: rt } = await Promise.resolve().then(() => (init_host_cp(), host_cp_exports));
+    readToken2 = rt;
+  }
+  const loadCtx = _loadCtx ?? (async () => {
+    const { loadContext: loadContext2 } = await Promise.resolve().then(() => (init_context(), context_exports));
+    return loadContext2();
+  });
+  const probeResult = await probe();
+  const tokenPresent = readToken2() !== null;
+  const hostCpRunning = probeResult !== null;
+  let worldCount = 0;
+  try {
+    const { ctx } = await loadCtx();
+    if (ctx) {
+      worldCount = ctx.worldManager.listWorlds().length;
+    }
+  } catch {
+  }
+  const manifestPath2 = path25.join(os13.homedir(), ".olam", "cache", "manifest.json");
+  let updateAvailable = null;
+  let lastUpdateCheck = null;
+  if (fs22.existsSync(manifestPath2)) {
+    const mtime = fs22.statSync(manifestPath2).mtime;
+    lastUpdateCheck = mtime.toISOString();
+    try {
+      const manifest = JSON.parse(fs22.readFileSync(manifestPath2, "utf-8"));
+      const latest = manifest["version"];
+      updateAvailable = latest !== void 0 && latest !== CLI_VERSION2;
+    } catch {
+      updateAvailable = null;
+    }
+  }
+  return {
+    version: CLI_VERSION2,
+    port: HOST_CP_PORT2,
+    host_cp: hostCpRunning ? "running" : "stopped",
+    token_present: tokenPresent,
+    worlds: worldCount,
+    update_available: updateAvailable,
+    last_update_check: lastUpdateCheck
+  };
+}
 function registerStatus(program2) {
-  program2.command("status").description("Show detailed world status").argument("<world>", "World ID").option("--json", "Output as JSON").action(async (worldId, opts) => {
-    const { ctx, error } = await loadContext();
+  program2.command("status").description("Show status (machine status when no world given; world details with a world ID)").argument("[world]", "World ID \u2014 omit to show machine status").option("--json", "Output as JSON").action(async (worldId, opts) => {
+    if (!worldId) {
+      const ms = await getMachineStatus();
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(ms, null, 2) + "\n");
+        process.exitCode = ms.host_cp === "running" ? 0 : 1;
+        return;
+      }
+      printHeader("Olam Status");
+      printInfo("CLI version", `@pleri/olam-cli@${ms.version}`);
+      printInfo("Host CP", ms.host_cp === "running" ? `running on port ${ms.port}` : "stopped");
+      printInfo("Worlds", String(ms.worlds));
+      printInfo("Token", ms.token_present ? "present" : "absent");
+      if (ms.last_update_check) {
+        printInfo("Last update check", ms.last_update_check);
+        printInfo("Update available", ms.update_available === true ? "yes" : ms.update_available === false ? "no" : "unknown");
+      } else {
+        printInfo("Update check", "never (run `olam update --check`)");
+      }
+      process.exitCode = ms.host_cp === "running" ? 0 : 1;
+      return;
+    }
+    const { loadContext: loadContext2 } = await Promise.resolve().then(() => (init_context(), context_exports));
+    const { ctx, error } = await loadContext2();
     if (!ctx) {
       printError(error?.message ?? "Olam is not configured. Run `olam init` first.");
       process.exitCode = 1;
@@ -15285,6 +15536,8 @@ function registerStatus(program2) {
 
 // src/commands/destroy.ts
 init_context();
+init_output();
+init_host_cp();
 import ora5 from "ora";
 function registerDestroy(program2) {
   program2.command("destroy").description("Destroy a world and clean up resources").argument("<world>", "World ID").option("--skip-crystallize", "Skip thought crystallization").action(async (worldId, opts) => {
@@ -15323,6 +15576,7 @@ function registerDestroy(program2) {
 
 // src/commands/enter.ts
 init_context();
+init_output();
 import { execSync as execSync7 } from "node:child_process";
 import pc13 from "picocolors";
 var SAFE_IDENT3 = /^[a-z0-9][a-z0-9-]{0,63}$/;
@@ -15382,6 +15636,11 @@ function registerEnter(program2) {
       process.exitCode = 1;
       return;
     }
+    const worldMeta = ctx.worldManager.getWorld(worldId);
+    if (worldMeta) {
+      const { checkVersionPin: checkVersionPin2 } = await Promise.resolve().then(() => (init_version_pin(), version_pin_exports));
+      checkVersionPin2(worldId, worldMeta.workspacePath);
+    }
     const computeWorld = await ctx.computeProvider.getWorld(worldId);
     if (!computeWorld) {
       printError(`World "${worldId}" not found.`);
@@ -15471,11 +15730,12 @@ ${pc13.dim(`Observe dispatch: docker exec -it ${containerName} tmux attach -t ol
 
 // src/commands/crystallize.ts
 init_context();
-import * as fs21 from "node:fs";
-import "node:path";
-import ora6 from "ora";
+init_output();
 init_exit_codes();
 init_world_paths();
+import * as fs23 from "node:fs";
+import "node:path";
+import ora6 from "ora";
 function registerCrystallize(program2, options = {}) {
   const cmd = program2.command("crystallize").description("Crystallize thoughts from a world to Pleri Plane").argument("<world>", "World ID").action(async (worldId) => {
     const { ctx, error } = await loadContext();
@@ -15505,7 +15765,7 @@ function registerCrystallize(program2, options = {}) {
       return;
     }
     const thoughtDbPath = getWorldDbPath(world.workspacePath);
-    if (!fs21.existsSync(thoughtDbPath)) {
+    if (!fs23.existsSync(thoughtDbPath)) {
       printError(`No thoughts captured yet for "${worldId}". Run a dispatch first.`);
       process.exitCode = EXIT_GENERIC_ERROR;
       return;
@@ -15620,6 +15880,7 @@ async function decideGate(portOffset, id, payload) {
 }
 
 // src/commands/pr.ts
+init_output();
 function runningWorlds() {
   const registry = new WorldRegistry();
   try {
@@ -15726,7 +15987,12 @@ function registerPr(program2) {
   decideCommand("reject", "block");
 }
 
+// src/index.ts
+init_host_cp();
+
 // src/commands/lanes.ts
+init_host_cp();
+init_output();
 async function handleList(world) {
   printHeader(`Lanes in world ${world}`);
   const result = await callHostCpProxy("GET", world, "/lanes");
@@ -16873,11 +17139,11 @@ var qmarksTestNoExtDot = ([$0]) => {
   return (f) => f.length === len && f !== "." && f !== "..";
 };
 var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path25 = {
+var path27 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep = defaultPlatform === "win32" ? path25.win32.sep : path25.posix.sep;
+var sep = defaultPlatform === "win32" ? path27.win32.sep : path27.posix.sep;
 minimatch.sep = sep;
 var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
@@ -17707,23 +17973,25 @@ function registerPolicyCheck(program2) {
 }
 
 // src/commands/upgrade.ts
-import * as fs24 from "node:fs";
-import * as path28 from "node:path";
+init_output();
+init_host_cp();
+import * as fs26 from "node:fs";
+import * as path30 from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
 import ora7 from "ora";
 import pc16 from "picocolors";
 
 // src/commands/upgrade-lock.ts
-import * as fs22 from "node:fs";
-import * as os13 from "node:os";
-import * as path26 from "node:path";
+import * as fs24 from "node:fs";
+import * as os14 from "node:os";
+import * as path28 from "node:path";
 import { spawnSync as spawnSync9 } from "node:child_process";
-var LOCK_FILE_PATH = path26.join(os13.homedir(), ".olam", ".upgrade.lock");
+var LOCK_FILE_PATH = path28.join(os14.homedir(), ".olam", ".upgrade.lock");
 var STALE_LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 function readLockFile(lockPath) {
   try {
-    if (!fs22.existsSync(lockPath)) return null;
-    const raw = fs22.readFileSync(lockPath, "utf-8").trim();
+    if (!fs24.existsSync(lockPath)) return null;
+    const raw = fs24.readFileSync(lockPath, "utf-8").trim();
     if (raw.length === 0) return null;
     const parsed = JSON.parse(raw);
     if (typeof parsed.pid !== "number" || typeof parsed.startTs !== "number") return null;
@@ -17768,16 +18036,16 @@ function isStaleLock(content, nowMs = Date.now()) {
   return false;
 }
 function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
-  const dir = path26.dirname(lockPath);
-  fs22.mkdirSync(dir, { recursive: true });
+  const dir = path28.dirname(lockPath);
+  fs24.mkdirSync(dir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = fs22.openSync(lockPath, "wx", 420);
+      const fd = fs24.openSync(lockPath, "wx", 420);
       try {
         const content = { pid: process.pid, startTs: nowMs };
-        fs22.writeSync(fd, JSON.stringify(content));
+        fs24.writeSync(fd, JSON.stringify(content));
       } finally {
-        fs22.closeSync(fd);
+        fs24.closeSync(fd);
       }
       return { acquired: true, lockPath };
     } catch (err) {
@@ -17786,7 +18054,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
       const existing2 = readLockFile(lockPath);
       if (isStaleLock(existing2, nowMs)) {
         try {
-          fs22.unlinkSync(lockPath);
+          fs24.unlinkSync(lockPath);
         } catch (unlinkErr) {
           const ucode = unlinkErr.code;
           if (ucode !== "ENOENT") throw unlinkErr;
@@ -17811,7 +18079,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
 }
 function releaseLock(lockPath = LOCK_FILE_PATH) {
   try {
-    fs22.unlinkSync(lockPath);
+    fs24.unlinkSync(lockPath);
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") throw err;
@@ -17829,19 +18097,19 @@ function formatRefusalMessage(result, lockPath = LOCK_FILE_PATH) {
 }
 
 // src/commands/upgrade-log.ts
-import * as fs23 from "node:fs";
-import * as os14 from "node:os";
-import * as path27 from "node:path";
+import * as fs25 from "node:fs";
+import * as os15 from "node:os";
+import * as path29 from "node:path";
 function getUpgradeLogPath() {
-  const home = process.env["HOME"] ?? os14.homedir();
-  return path27.join(home, ".olam", "upgrade.log");
+  const home = process.env["HOME"] ?? os15.homedir();
+  return path29.join(home, ".olam", "upgrade.log");
 }
 var UPGRADE_LOG_PATH = getUpgradeLogPath();
 function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   try {
-    fs23.mkdirSync(path27.dirname(logPath), { recursive: true });
+    fs25.mkdirSync(path29.dirname(logPath), { recursive: true });
     const line = JSON.stringify(row) + "\n";
-    fs23.appendFileSync(logPath, line, { mode: 420 });
+    fs25.appendFileSync(logPath, line, { mode: 420 });
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to append: ${err instanceof Error ? err.message : String(err)}
@@ -17850,10 +18118,10 @@ function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   }
 }
 function readUpgradeLog(limit = 10, logPath = getUpgradeLogPath()) {
-  if (!fs23.existsSync(logPath)) return [];
+  if (!fs25.existsSync(logPath)) return [];
   let raw;
   try {
-    raw = fs23.readFileSync(logPath, "utf-8");
+    raw = fs25.readFileSync(logPath, "utf-8");
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to read: ${err instanceof Error ? err.message : String(err)}
@@ -17915,6 +18183,7 @@ function formatHistoryJson(rows) {
 }
 
 // src/commands/upgrade-history.ts
+init_output();
 function parseHistoryOpts(raw) {
   const rawLimit = raw.n;
   const limit = typeof rawLimit === "number" ? rawLimit : typeof rawLimit === "string" ? Number.parseInt(rawLimit, 10) : 10;
@@ -17945,12 +18214,12 @@ init_protocol_version();
 init_install_root();
 var AUTH_HEALTH_URL2 = "http://127.0.0.1:9999/health";
 function isNodeModulesInSync(cwd) {
-  const lockPath = path28.join(cwd, "package-lock.json");
-  const markerPath = path28.join(cwd, "node_modules", ".package-lock.json");
-  if (!fs24.existsSync(lockPath) || !fs24.existsSync(markerPath)) return false;
+  const lockPath = path30.join(cwd, "package-lock.json");
+  const markerPath = path30.join(cwd, "node_modules", ".package-lock.json");
+  if (!fs26.existsSync(lockPath) || !fs26.existsSync(markerPath)) return false;
   try {
-    const lockStat = fs24.statSync(lockPath);
-    const markerStat = fs24.statSync(markerPath);
+    const lockStat = fs26.statSync(lockPath);
+    const markerStat = fs26.statSync(markerPath);
     return markerStat.mtimeMs >= lockStat.mtimeMs;
   } catch {
     return false;
@@ -17966,8 +18235,8 @@ function shouldSkipInstall(opts, cwd) {
   return { skip: false };
 }
 function validateRepoRoot(cwd) {
-  const marker = path28.join(cwd, "packages/host-cp/compose.yaml");
-  if (!fs24.existsSync(marker)) {
+  const marker = path30.join(cwd, "packages/host-cp/compose.yaml");
+  if (!fs26.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -18274,7 +18543,8 @@ function formatVersionMismatch(targetSha, snapshot) {
   }
   return lines.join("\n");
 }
-async function waitForAuthHealthLocal(timeoutMs = 15e3) {
+var AUTH_HEALTH_TIMEOUT_MS = 6e4;
+async function waitForAuthHealthLocal(timeoutMs = AUTH_HEALTH_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
@@ -18299,13 +18569,13 @@ async function recreateAuthService() {
     });
     const controller = new AuthContainerController();
     controller.start();
-    const healthy = await waitForAuthHealthLocal(15e3);
+    const healthy = await waitForAuthHealthLocal();
     const durationMs = Date.now() - start;
     if (!healthy) {
       return {
         ok: false,
         durationMs,
-        error: "auth-service /health did not respond within 15s after recreate"
+        error: `auth-service /health did not respond within ${AUTH_HEALTH_TIMEOUT_MS / 1e3}s after recreate`
       };
     }
     return { ok: true, durationMs };
@@ -18318,9 +18588,9 @@ async function recreateAuthService() {
   }
 }
 function readBundleHash(cwd) {
-  const indexPath = path28.join(cwd, "packages/control-plane/public/index.html");
-  if (!fs24.existsSync(indexPath)) return null;
-  return extractBundleHash(fs24.readFileSync(indexPath, "utf-8"));
+  const indexPath = path30.join(cwd, "packages/control-plane/public/index.html");
+  if (!fs26.existsSync(indexPath)) return null;
+  return extractBundleHash(fs26.readFileSync(indexPath, "utf-8"));
 }
 async function runUpgradePullByDigest(deps = {}) {
   const docker2 = deps.docker ?? realDocker;
@@ -18418,12 +18688,12 @@ async function runUpgradePullByDigest(deps = {}) {
     }
   }
   tagSpinner.succeed("Re-tagged 3 images to canonical refs");
-  const composeFile = deps.composeFile ?? path28.join(process.cwd(), "packages/host-cp/compose.yaml");
+  const composeFile = deps.composeFile ?? path30.join(process.cwd(), "packages/host-cp/compose.yaml");
   const authSecret = deps.authSecret ?? readAuthSecret2();
   const composeRunner = deps.runComposeImpl ?? runCompose;
   const composeSpinner = ora7("docker compose recreate host-cp").start();
   const composeResult = composeRunner(
-    ["up", "-d", "--force-recreate", "host-cp"],
+    ["up", "-d", "--force-recreate", "--no-deps", "host-cp"],
     composeFile,
     buildComposeEnv(authSecret)
   );
@@ -18467,9 +18737,12 @@ async function defaultRecreateAuthForUpgrade() {
     });
     const controller = new AuthContainerController();
     controller.start();
-    const healthy = await waitForAuthHealthLocal(15e3);
+    const healthy = await waitForAuthHealthLocal();
     if (!healthy) {
-      return { ok: false, error: "auth-service /health did not respond within 15s" };
+      return {
+        ok: false,
+        error: `auth-service /health did not respond within ${AUTH_HEALTH_TIMEOUT_MS / 1e3}s`
+      };
     }
     return { ok: true };
   } catch (err) {
@@ -18616,11 +18889,11 @@ manually inspect images with \`docker images olam-*:olam-rollback\`.`
     }
     printInfo("Rollback", swapResult.summary);
     const cwd = process.cwd();
-    const composeFile = path28.join(cwd, "packages/host-cp/compose.yaml");
+    const composeFile = path30.join(cwd, "packages/host-cp/compose.yaml");
     const authSecret = readAuthSecret2();
     process.stdout.write(`  ${pc16.dim("docker compose recreate host-cp".padEnd(34))}`);
     const composeStart = Date.now();
-    const composeResult = runCompose(["up", "-d", "--force-recreate", "host-cp"], composeFile, buildComposeEnv(authSecret));
+    const composeResult = runCompose(["up", "-d", "--force-recreate", "--no-deps", "host-cp"], composeFile, buildComposeEnv(authSecret));
     const composeDur = `${((Date.now() - composeStart) / 1e3).toFixed(1)}s`;
     process.stdout.write(`${composeResult.ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${composeDur}
 `);
@@ -18757,7 +19030,7 @@ ${buildResult.stderr}`);
     return;
   }
   const authSecret = readAuthSecret2();
-  const spaDir = path28.join(cwd, "packages/control-plane/app");
+  const spaDir = path30.join(cwd, "packages/control-plane/app");
   const spaResult = runStep2(
     "vite build (SPA)",
     "npx",
@@ -18890,7 +19163,7 @@ Recovery options:
     return;
   }
   printInfo("Swap", swapResult.summary);
-  const composeFile = path28.join(cwd, "packages/host-cp/compose.yaml");
+  const composeFile = path30.join(cwd, "packages/host-cp/compose.yaml");
   process.stdout.write(`  ${pc16.dim("docker compose recreate".padEnd(34))}`);
   const composeStart = Date.now();
   const composeResult = runCompose(
@@ -19023,10 +19296,12 @@ function registerUpgrade(program2) {
 }
 
 // src/commands/logs.ts
+init_host_cp();
+init_context();
+init_output();
 import * as http3 from "node:http";
 import pc17 from "picocolors";
-init_context();
-var HOST_CP_PORT2 = 19e3;
+var HOST_CP_PORT3 = 19e3;
 function colorLine(line) {
   if (/\bERROR\b/.test(line)) return pc17.red(line);
   if (/\bWARN\b/.test(line)) return pc17.yellow(line);
@@ -19073,7 +19348,7 @@ function registerLogs(program2) {
     const tailLimit = Math.max(1, parseInt(opts.tail, 10) || 200);
     const showService = opts.service === void 0;
     const subPath = opts.service ? `/api/logs/${encodeURIComponent(opts.service)}` : "/api/logs";
-    const url = `http://127.0.0.1:${HOST_CP_PORT2}/api/world/${encodeURIComponent(worldId)}${subPath}`;
+    const url = `http://127.0.0.1:${HOST_CP_PORT3}/api/world/${encodeURIComponent(worldId)}${subPath}`;
     let lineCount = 0;
     let done = false;
     let resolveStream;
@@ -19150,6 +19425,7 @@ function registerLogs(program2) {
 
 // src/commands/ps.ts
 init_context();
+init_output();
 import pc18 from "picocolors";
 import { spawnSync as spawnSync11 } from "node:child_process";
 var SAFE_IDENT4 = /^[a-z0-9][a-z0-9-]{0,63}$/;
@@ -19287,20 +19563,21 @@ ${pc18.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
 }
 
 // src/commands/keys.ts
-import * as fs25 from "node:fs";
-import * as os15 from "node:os";
-import * as path29 from "node:path";
+init_output();
+import * as fs27 from "node:fs";
+import * as os16 from "node:os";
+import * as path31 from "node:path";
 import YAML4 from "yaml";
 function olamHome2() {
-  return process.env.OLAM_HOME ?? path29.join(os15.homedir(), ".olam");
+  return process.env.OLAM_HOME ?? path31.join(os16.homedir(), ".olam");
 }
 function keysFilePath() {
-  return path29.join(olamHome2(), "keys.yaml");
+  return path31.join(olamHome2(), "keys.yaml");
 }
 function readKeysFile() {
   const filePath = keysFilePath();
-  if (!fs25.existsSync(filePath)) return null;
-  const raw = fs25.readFileSync(filePath, "utf-8").trim();
+  if (!fs27.existsSync(filePath)) return null;
+  const raw = fs27.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = YAML4.parse(raw);
@@ -19316,13 +19593,13 @@ function readKeysFile() {
 }
 function writeKeysFile(keys) {
   const dir = olamHome2();
-  if (!fs25.existsSync(dir)) {
-    fs25.mkdirSync(dir, { recursive: true });
+  if (!fs27.existsSync(dir)) {
+    fs27.mkdirSync(dir, { recursive: true });
   }
   const filePath = keysFilePath();
   const content = YAML4.stringify(keys);
-  fs25.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
-  fs25.chmodSync(filePath, 384);
+  fs27.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
+  fs27.chmodSync(filePath, 384);
 }
 function redact(value) {
   if (value.length <= 8) return value + "...";
@@ -19365,7 +19642,7 @@ function registerKeys(program2) {
       }
       const { [key]: _removed, ...rest } = existing;
       if (Object.keys(rest).length === 0) {
-        fs25.unlinkSync(keysFilePath());
+        fs27.unlinkSync(keysFilePath());
       } else {
         writeKeysFile(rest);
       }
@@ -19388,26 +19665,26 @@ function registerKeys(program2) {
 }
 
 // src/commands/world-snapshot.ts
-import * as fs27 from "node:fs";
-import * as path31 from "node:path";
+import * as fs29 from "node:fs";
+import * as path33 from "node:path";
 import { execSync as execSync9 } from "node:child_process";
 import pc19 from "picocolors";
 
 // ../core/src/world/snapshot.ts
 import * as crypto6 from "node:crypto";
-import * as fs26 from "node:fs";
-import * as os16 from "node:os";
-import * as path30 from "node:path";
+import * as fs28 from "node:fs";
+import * as os17 from "node:os";
+import * as path32 from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path30.join(os16.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path32.join(os17.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDir(worldId, kind) {
-  return path30.join(snapshotsDir(), worldId, kind);
+  return path32.join(snapshotsDir(), worldId, kind);
 }
 function snapshotTarPath(worldId, kind, repoName, hash) {
   const base = repoName ? `${repoName}-${hash}` : hash;
-  return path30.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
+  return path32.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
 }
 function manifestPath(tarPath) {
   return tarPath.replace(/\.tar\.gz$/, ".manifest.json");
@@ -19424,16 +19701,16 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir) {
-  const lockfile = path30.join(repoDir, "Gemfile.lock");
-  if (!fs26.existsSync(lockfile)) return null;
-  return hashBuffers([{ path: "Gemfile.lock", content: fs26.readFileSync(lockfile) }]);
+  const lockfile = path32.join(repoDir, "Gemfile.lock");
+  if (!fs28.existsSync(lockfile)) return null;
+  return hashBuffers([{ path: "Gemfile.lock", content: fs28.readFileSync(lockfile) }]);
 }
 function computeNodeFingerprint(repoDir) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path30.join(repoDir, name);
-    if (fs26.existsSync(lockfile)) {
-      return hashBuffers([{ path: name, content: fs26.readFileSync(lockfile) }]);
+    const lockfile = path32.join(repoDir, name);
+    if (fs28.existsSync(lockfile)) {
+      return hashBuffers([{ path: name, content: fs28.readFileSync(lockfile) }]);
     }
   }
   return null;
@@ -19443,59 +19720,59 @@ function computePgFingerprint(repoDirs) {
   const entries = [];
   for (const repoDir of repoDirs) {
     for (const pattern of patterns) {
-      const filePath = path30.join(repoDir, pattern);
-      if (fs26.existsSync(filePath)) {
-        entries.push({ path: filePath, content: fs26.readFileSync(filePath) });
+      const filePath = path32.join(repoDir, pattern);
+      if (fs28.existsSync(filePath)) {
+        entries.push({ path: filePath, content: fs28.readFileSync(filePath) });
       }
     }
   }
   return entries.length > 0 ? hashBuffers(entries) : null;
 }
 function packTarball(srcDir, destPath, opts = {}) {
-  fs26.mkdirSync(path30.dirname(destPath), { recursive: true });
+  fs28.mkdirSync(path32.dirname(destPath), { recursive: true });
   const tmp = `${destPath}.tmp`;
   const args = [];
   if (opts.followSymlinks) args.push("-h");
   args.push("-czf", tmp, "-C", srcDir, ".");
   try {
     execFileSync4("tar", args, { stdio: "pipe" });
-    fs26.renameSync(tmp, destPath);
+    fs28.renameSync(tmp, destPath);
   } catch (err) {
     try {
-      fs26.rmSync(tmp, { force: true });
+      fs28.rmSync(tmp, { force: true });
     } catch {
     }
     throw err;
   }
 }
 function writeManifest(manifest, tarPath) {
-  fs26.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
+  fs28.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs26.existsSync(mPath)) return null;
+  if (!fs28.existsSync(mPath)) return null;
   try {
-    return JSON.parse(fs26.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs28.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
 }
 function listSnapshots(worldIdFilter) {
   const root = snapshotsDir();
-  if (!fs26.existsSync(root)) return [];
+  if (!fs28.existsSync(root)) return [];
   const now = Date.now();
   const results = [];
-  const worlds = worldIdFilter ? [worldIdFilter] : fs26.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  const worlds = worldIdFilter ? [worldIdFilter] : fs28.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   for (const worldId of worlds) {
-    const worldDir = path30.join(root, worldId);
-    if (!fs26.existsSync(worldDir) || !fs26.statSync(worldDir).isDirectory()) continue;
+    const worldDir = path32.join(root, worldId);
+    if (!fs28.existsSync(worldDir) || !fs28.statSync(worldDir).isDirectory()) continue;
     for (const kind of ["gems", "node", "pg"]) {
-      const kindDir = path30.join(worldDir, kind);
-      if (!fs26.existsSync(kindDir)) continue;
-      const tarballs = fs26.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
+      const kindDir = path32.join(worldDir, kind);
+      if (!fs28.existsSync(kindDir)) continue;
+      const tarballs = fs28.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
       for (const tarFile of tarballs) {
-        const tarPath = path30.join(kindDir, tarFile);
-        const stat = fs26.statSync(tarPath);
+        const tarPath = path32.join(kindDir, tarFile);
+        const stat = fs28.statSync(tarPath);
         const manifest = readManifest(tarPath);
         if (!manifest) continue;
         results.push({ manifest, tarPath, ageMs: now - stat.mtimeMs });
@@ -19505,9 +19782,19 @@ function listSnapshots(worldIdFilter) {
   return results.sort((a, b) => a.manifest.createdAt.localeCompare(b.manifest.createdAt));
 }
 
+// src/commands/world-snapshot.ts
+init_output();
+
+// src/commands/world.ts
+function getOrCreateWorldCommand(program2) {
+  const existing = program2.commands.find((c) => c.name() === "world");
+  if (existing) return existing;
+  return program2.command("world").description("World management subcommands");
+}
+
 // src/commands/world-snapshot.ts
 function registerWorldSnapshot(program2) {
-  const world = program2.command("world").description("World management subcommands");
+  const world = getOrCreateWorldCommand(program2);
   const snapshot = world.command("snapshot").description("Manage world snapshots for fast boot");
   snapshot.command("create <worldId>").description("Capture installed state from a running world into tarballs").option(
     "--kind <kind>",
@@ -19574,17 +19861,17 @@ function resolveKinds(arg) {
   return [];
 }
 async function captureGems(worldId, workspacePath, repo) {
-  const repoDir = path31.join(workspacePath, repo);
+  const repoDir = path33.join(workspacePath, repo);
   const fingerprint = computeGemsFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock \u2014 layer does not apply" };
   }
   const tarPath = snapshotTarPath(worldId, "gems", repo, fingerprint);
-  const vendorBundle = path31.join(repoDir, "vendor", "bundle");
-  if (fs27.existsSync(vendorBundle)) {
+  const vendorBundle = path33.join(repoDir, "vendor", "bundle");
+  if (fs29.existsSync(vendorBundle)) {
     try {
       packTarball(vendorBundle, tarPath);
-      const stat = fs27.statSync(tarPath);
+      const stat = fs29.statSync(tarPath);
       const manifest = {
         kind: "gems",
         worldId,
@@ -19617,10 +19904,10 @@ async function captureGems(worldId, workspacePath, repo) {
       `docker exec ${containerName} sh -c 'mkdir -p "$(dirname ${tmpTar})" && tar -czf ${tmpTar}.tmp -C ${bundlePath} . && mv ${tmpTar}.tmp ${tmpTar}'`,
       { stdio: "pipe", timeout: 12e4 }
     );
-    fs27.mkdirSync(path31.dirname(tarPath), { recursive: true });
+    fs29.mkdirSync(path33.dirname(tarPath), { recursive: true });
     execSync9(`docker cp ${containerName}:${tmpTar} "${tarPath}"`, { stdio: "pipe", timeout: 12e4 });
     execSync9(`docker exec ${containerName} rm -f ${tmpTar}`, { stdio: "pipe" });
-    const stat = fs27.statSync(tarPath);
+    const stat = fs29.statSync(tarPath);
     const manifest = {
       kind: "gems",
       worldId,
@@ -19637,19 +19924,19 @@ async function captureGems(worldId, workspacePath, repo) {
   }
 }
 async function captureNode(worldId, workspacePath, repo) {
-  const repoDir = path31.join(workspacePath, repo);
+  const repoDir = path33.join(workspacePath, repo);
   const fingerprint = computeNodeFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no lockfile \u2014 layer does not apply" };
   }
-  const nodeModules = path31.join(repoDir, "node_modules");
-  if (!fs27.existsSync(nodeModules)) {
+  const nodeModules = path33.join(repoDir, "node_modules");
+  if (!fs29.existsSync(nodeModules)) {
     return { ok: false, tarPath: "", msg: "node_modules not installed yet" };
   }
   const tarPath = snapshotTarPath(worldId, "node", repo, fingerprint);
   try {
     packTarball(nodeModules, tarPath);
-    const stat = fs27.statSync(tarPath);
+    const stat = fs29.statSync(tarPath);
     const manifest = {
       kind: "node",
       worldId,
@@ -19666,7 +19953,7 @@ async function captureNode(worldId, workspacePath, repo) {
   }
 }
 async function capturePg(worldId, workspacePath, repoNames) {
-  const repoDirs = repoNames.map((r) => path31.join(workspacePath, r));
+  const repoDirs = repoNames.map((r) => path33.join(workspacePath, r));
   const fingerprint = computePgFingerprint(repoDirs);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock / schema.rb \u2014 layer does not apply" };
@@ -19681,13 +19968,13 @@ async function capturePg(worldId, workspacePath, repoNames) {
   }
   try {
     execSync9(`docker stop ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    fs27.mkdirSync(path31.dirname(tarPath), { recursive: true });
+    fs29.mkdirSync(path33.dirname(tarPath), { recursive: true });
     execSync9(
-      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path31.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path31.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path31.basename(tarPath)}.tmp /dest/${path31.basename(tarPath)}'`,
+      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path33.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path33.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path33.basename(tarPath)}.tmp /dest/${path33.basename(tarPath)}'`,
       { stdio: "pipe", timeout: 18e4 }
     );
     execSync9(`docker start ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    const stat = fs27.statSync(tarPath);
+    const stat = fs29.statSync(tarPath);
     const manifest = {
       kind: "pg",
       worldId,
@@ -19761,35 +20048,36 @@ function formatAge2(ms) {
 
 // src/commands/refresh.ts
 init_context();
-import * as fs29 from "node:fs";
-import * as os17 from "node:os";
-import * as path33 from "node:path";
+init_output();
+import * as fs31 from "node:fs";
+import * as os18 from "node:os";
+import * as path35 from "node:path";
 import { spawnSync as spawnSync12 } from "node:child_process";
 import ora8 from "ora";
 
 // src/commands/refresh-helpers.ts
-import * as fs28 from "node:fs";
-import * as path32 from "node:path";
+import * as fs30 from "node:fs";
+import * as path34 from "node:path";
 function collectCpSourceFiles(standaloneDir) {
-  if (!fs28.existsSync(standaloneDir)) {
+  if (!fs30.existsSync(standaloneDir)) {
     throw new Error(`CP standalone dir not found: ${standaloneDir}`);
   }
   const entries = [];
-  const topLevel = fs28.readdirSync(standaloneDir).filter((f) => {
-    const stat = fs28.statSync(path32.join(standaloneDir, f));
+  const topLevel = fs30.readdirSync(standaloneDir).filter((f) => {
+    const stat = fs30.statSync(path34.join(standaloneDir, f));
     return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
   }).sort();
   for (const f of topLevel) {
-    entries.push({ srcPath: path32.join(standaloneDir, f), destRelPath: f });
+    entries.push({ srcPath: path34.join(standaloneDir, f), destRelPath: f });
   }
-  const libDir = path32.join(standaloneDir, "lib");
-  if (fs28.existsSync(libDir) && fs28.statSync(libDir).isDirectory()) {
-    const libFiles = fs28.readdirSync(libDir).filter((f) => {
-      const stat = fs28.statSync(path32.join(libDir, f));
+  const libDir = path34.join(standaloneDir, "lib");
+  if (fs30.existsSync(libDir) && fs30.statSync(libDir).isDirectory()) {
+    const libFiles = fs30.readdirSync(libDir).filter((f) => {
+      const stat = fs30.statSync(path34.join(libDir, f));
       return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
     }).sort();
     for (const f of libFiles) {
-      entries.push({ srcPath: path32.join(libDir, f), destRelPath: `lib/${f}` });
+      entries.push({ srcPath: path34.join(libDir, f), destRelPath: `lib/${f}` });
     }
   }
   return entries;
@@ -19847,16 +20135,16 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  const stagingDir = fs29.mkdtempSync(
-    path33.join(os17.tmpdir(), `olam-refresh-${worldId}-`)
+  const stagingDir = fs31.mkdtempSync(
+    path35.join(os18.tmpdir(), `olam-refresh-${worldId}-`)
   );
   try {
     const hasLib = entries.some((e) => e.destRelPath.startsWith("lib/"));
     if (hasLib) {
-      fs29.mkdirSync(path33.join(stagingDir, "lib"), { recursive: true });
+      fs31.mkdirSync(path35.join(stagingDir, "lib"), { recursive: true });
     }
     for (const { srcPath, destRelPath } of entries) {
-      fs29.copyFileSync(srcPath, path33.join(stagingDir, destRelPath));
+      fs31.copyFileSync(srcPath, path35.join(stagingDir, destRelPath));
     }
     const cpResult = docker([
       "cp",
@@ -19871,7 +20159,7 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       };
     }
   } finally {
-    fs29.rmSync(stagingDir, { recursive: true, force: true });
+    fs31.rmSync(stagingDir, { recursive: true, force: true });
   }
   if (opts.restart) {
     const restartResult = docker([
@@ -19908,11 +20196,11 @@ function registerRefresh(program2) {
       process.exitCode = 1;
       return;
     }
-    const standaloneDir = path33.join(
+    const standaloneDir = path35.join(
       process.cwd(),
       "packages/control-plane/standalone"
     );
-    if (!fs29.existsSync(standaloneDir)) {
+    if (!fs31.existsSync(standaloneDir)) {
       printError(
         `CP standalone source not found at ${standaloneDir}.
 Run \`olam refresh\` from the olam repo root.`
@@ -19991,9 +20279,9 @@ Run \`olam refresh\` from the olam repo root.`
 }
 
 // src/commands/diagnose.ts
-import * as fs30 from "node:fs";
-import * as os18 from "node:os";
-import * as path34 from "node:path";
+import * as fs32 from "node:fs";
+import * as os19 from "node:os";
+import * as path36 from "node:path";
 import { execFileSync as execFileSync5, execSync as execSync10 } from "node:child_process";
 import pc20 from "picocolors";
 
@@ -20028,9 +20316,9 @@ function stripSecrets(input) {
 }
 
 // src/commands/diagnose.ts
-var DIAGNOSTICS_DIR = path34.join(os18.homedir(), ".olam", "diagnostics");
-var LOG_DIR = path34.join(os18.homedir(), ".olam", "log");
-var CACHE_DIR = path34.join(os18.homedir(), ".olam", "cache");
+var DIAGNOSTICS_DIR = path36.join(os19.homedir(), ".olam", "diagnostics");
+var LOG_DIR = path36.join(os19.homedir(), ".olam", "log");
+var CACHE_DIR = path36.join(os19.homedir(), ".olam", "cache");
 var LOG_TAIL_LINES = 200;
 function safeExec(cmd) {
   try {
@@ -20044,10 +20332,10 @@ function defaultZip(zipPath, files) {
 }
 async function buildDiagnosticsZip(_exec = (cmd) => safeExec(cmd), _outDir = DIAGNOSTICS_DIR, _logDir = LOG_DIR, _zip = defaultZip) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 23);
-  const zipPath = path34.join(_outDir, `olam-diag-${ts}.zip`);
-  const tmpDir = fs30.mkdtempSync(path34.join(os18.tmpdir(), "olam-diag-"));
+  const zipPath = path36.join(_outDir, `olam-diag-${ts}.zip`);
+  const tmpDir = fs32.mkdtempSync(path36.join(os19.tmpdir(), "olam-diag-"));
   try {
-    fs30.mkdirSync(_outDir, { recursive: true });
+    fs32.mkdirSync(_outDir, { recursive: true });
     const entries = [];
     const version = process.env["OLAM_CLI_VERSION"] ?? "unknown";
     const nodeVersion = process.version;
@@ -20058,19 +20346,19 @@ platform: ${platform}
 `;
     _writeEntry(tmpDir, "version.txt", stripSecrets(versionContent), entries);
     const osContent = [
-      `os: ${os18.type()} ${os18.release()}`,
-      `arch: ${os18.arch()}`,
-      `uptime: ${os18.uptime()}s`
+      `os: ${os19.type()} ${os19.release()}`,
+      `arch: ${os19.arch()}`,
+      `uptime: ${os19.uptime()}s`
     ].join("\n") + "\n";
     _writeEntry(tmpDir, "os-info.txt", stripSecrets(osContent), entries);
-    const depsFile = path34.join(CACHE_DIR, "deps.json");
-    if (fs30.existsSync(depsFile)) {
-      const deps = fs30.readFileSync(depsFile, "utf-8");
+    const depsFile = path36.join(CACHE_DIR, "deps.json");
+    if (fs32.existsSync(depsFile)) {
+      const deps = fs32.readFileSync(depsFile, "utf-8");
       _writeEntry(tmpDir, "deps.json", stripSecrets(deps), entries);
     }
     const latestLog = _latestLog(_logDir);
     if (latestLog) {
-      const lines = fs30.readFileSync(latestLog, "utf-8").split("\n");
+      const lines = fs32.readFileSync(latestLog, "utf-8").split("\n");
       const tail = lines.slice(-LOG_TAIL_LINES).join("\n");
       _writeEntry(tmpDir, "log-tail.txt", stripSecrets(tail), entries);
     }
@@ -20082,38 +20370,38 @@ platform: ${platform}
     if (authAudit) {
       _writeEntry(tmpDir, "audit-auth-callers.txt", stripSecrets(authAudit), entries);
     }
-    const fileArgs = entries.map((e) => path34.join(tmpDir, e));
+    const fileArgs = entries.map((e) => path36.join(tmpDir, e));
     try {
       _zip(zipPath, fileArgs);
     } catch (err) {
       throw new Error(`zip command produced no output file. zip stderr: ${err.message}`);
     }
-    if (!fs30.existsSync(zipPath)) {
+    if (!fs32.existsSync(zipPath)) {
       throw new Error("zip command produced no output file.");
     }
     return { zipPath, entries };
   } finally {
     try {
-      fs30.rmSync(tmpDir, { recursive: true, force: true });
+      fs32.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
 }
 function _writeEntry(dir, name, content, entries) {
-  fs30.writeFileSync(path34.join(dir, name), content, { mode: 420 });
+  fs32.writeFileSync(path36.join(dir, name), content, { mode: 420 });
   entries.push(name);
 }
 function _latestLog(logDir) {
-  if (!fs30.existsSync(logDir)) return null;
-  const files = fs30.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
-  return files.length > 0 ? path34.join(logDir, files[0]) : null;
+  if (!fs32.existsSync(logDir)) return null;
+  const files = fs32.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
+  return files.length > 0 ? path36.join(logDir, files[0]) : null;
 }
 async function buildTelemetryPayload() {
   const channel = "stable";
-  const manifestFile = path34.join(CACHE_DIR, "manifest.json");
+  const manifestFile = path36.join(CACHE_DIR, "manifest.json");
   let manifestAgeHours = null;
-  if (fs30.existsSync(manifestFile)) {
-    const mtime = fs30.statSync(manifestFile).mtime.getTime();
+  if (fs32.existsSync(manifestFile)) {
+    const mtime = fs32.statSync(manifestFile).mtime.getTime();
     manifestAgeHours = Math.round((Date.now() - mtime) / 36e5);
   }
   return {
@@ -20156,24 +20444,24 @@ function registerDiagnose(program2) {
 }
 
 // src/commands/update.ts
-import * as fs33 from "node:fs";
-import * as os20 from "node:os";
-import * as path37 from "node:path";
+import * as fs35 from "node:fs";
+import * as os21 from "node:os";
+import * as path39 from "node:path";
 import { execSync as execSync11 } from "node:child_process";
 import pc21 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
-import * as fs31 from "node:fs";
-import * as path35 from "node:path";
+import * as fs33 from "node:fs";
+import * as path37 from "node:path";
 var realFs = {
-  readdirSync: (p) => fs31.readdirSync(p),
-  existsSync: (p) => fs31.existsSync(p),
-  lstatSync: (p) => fs31.lstatSync(p),
-  readlinkSync: (p) => fs31.readlinkSync(p),
-  symlinkSync: (t, l) => fs31.symlinkSync(t, l),
-  unlinkSync: (p) => fs31.unlinkSync(p),
+  readdirSync: (p) => fs33.readdirSync(p),
+  existsSync: (p) => fs33.existsSync(p),
+  lstatSync: (p) => fs33.lstatSync(p),
+  readlinkSync: (p) => fs33.readlinkSync(p),
+  symlinkSync: (t, l) => fs33.symlinkSync(t, l),
+  unlinkSync: (p) => fs33.unlinkSync(p),
   mkdirSync: (p, o) => {
-    fs31.mkdirSync(p, o);
+    fs33.mkdirSync(p, o);
   }
 };
 function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
@@ -20183,8 +20471,8 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   _fs.mkdirSync(claudeSkillsDir, { recursive: true });
   const sourceSkills = _fs.existsSync(npmSkillsDir) ? _fs.readdirSync(npmSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const skill of sourceSkills) {
-    const linkPath = path35.join(claudeSkillsDir, skill);
-    const target = path35.join(npmSkillsDir, skill);
+    const linkPath = path37.join(claudeSkillsDir, skill);
+    const target = path37.join(npmSkillsDir, skill);
     if (!_fs.existsSync(linkPath)) {
       try {
         _fs.symlinkSync(target, linkPath);
@@ -20197,7 +20485,7 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   }
   const deployedEntries = _fs.existsSync(claudeSkillsDir) ? _fs.readdirSync(claudeSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const entry of deployedEntries) {
-    const linkPath = path35.join(claudeSkillsDir, entry);
+    const linkPath = path37.join(claudeSkillsDir, entry);
     let isSymlink = false;
     try {
       isSymlink = _fs.lstatSync(linkPath).isSymbolicLink();
@@ -20222,9 +20510,9 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
 
 // src/commands/update.ts
 var PACKAGE_NAME = "@pleri/olam-cli";
-var CACHE_DIR2 = path37.join(os20.homedir(), ".olam", "cache");
-var LOG_DIR2 = path37.join(os20.homedir(), ".olam", "log");
-var LAST_STABLE_FILE = path37.join(CACHE_DIR2, "last-stable.txt");
+var CACHE_DIR2 = path39.join(os21.homedir(), ".olam", "cache");
+var LOG_DIR2 = path39.join(os21.homedir(), ".olam", "log");
+var LAST_STABLE_FILE = path39.join(CACHE_DIR2, "last-stable.txt");
 function defaultExec(cmd) {
   try {
     const stdout = execSync11(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
@@ -20246,22 +20534,22 @@ function getCurrentVersion(_exec = defaultExec) {
 }
 function readLastStable(file = LAST_STABLE_FILE) {
   try {
-    const v = fs33.readFileSync(file, "utf-8").trim();
+    const v = fs35.readFileSync(file, "utf-8").trim();
     return v || null;
   } catch {
     return null;
   }
 }
 function writeLastStable(version, file = LAST_STABLE_FILE) {
-  fs33.mkdirSync(path37.dirname(file), { recursive: true });
-  fs33.writeFileSync(file, version, { mode: 420 });
+  fs35.mkdirSync(path39.dirname(file), { recursive: true });
+  fs35.writeFileSync(file, version, { mode: 420 });
 }
 function logUpdateFailure(stderr) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const logFile = path37.join(LOG_DIR2, `update-${ts}.log`);
+  const logFile = path39.join(LOG_DIR2, `update-${ts}.log`);
   try {
-    fs33.mkdirSync(LOG_DIR2, { recursive: true });
-    fs33.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
+    fs35.mkdirSync(LOG_DIR2, { recursive: true });
+    fs35.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
 ${stderr}
 `, "utf-8");
   } catch {
@@ -20348,8 +20636,8 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
   let symlinkResult = { added: [], removed: [] };
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
-    const npmSkillsDir = path37.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
-    const claudeSkillsDir = path37.join(os20.homedir(), ".claude", "skills");
+    const npmSkillsDir = path39.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
+    const claudeSkillsDir = path39.join(os21.homedir(), ".claude", "skills");
     const rec = _reconcile(npmSkillsDir, claudeSkillsDir);
     symlinkResult = { added: rec.added, removed: rec.removed };
     if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
@@ -20395,8 +20683,8 @@ async function doRollback(_exec = defaultExec, _reconcile = reconcileSkillSymlin
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
     _reconcile(
-      path37.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
-      path37.join(os20.homedir(), ".claude", "skills")
+      path39.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
+      path39.join(os21.homedir(), ".claude", "skills")
     );
   }
   return { action: "rolled-back", restoredVersion: prev, exitCode: 0 };
@@ -20448,19 +20736,119 @@ function registerUpdate(program2) {
   });
 }
 
+// src/commands/begin.ts
+init_host_cp();
+init_open_url();
+import pc22 from "picocolors";
+async function doBegin(opts, _startFn = startHostCp, _openFn = openUrl) {
+  const prevExitCode = process.exitCode;
+  await _startFn({ showToken: opts.showToken });
+  const failed = process.exitCode !== void 0 && process.exitCode !== 0 && process.exitCode !== prevExitCode;
+  if (failed) return false;
+  if (opts.browser) {
+    const token = readToken();
+    if (token) {
+      const base = `http://127.0.0.1:${HOST_CP_PORT}/`;
+      console.log(pc22.dim(`Opening ${base}`));
+      _openFn(`${base}?token=${token}`);
+    }
+  }
+  return true;
+}
+function registerBegin(program2) {
+  program2.command("begin").description("Start the Olam host control plane (alias: olam host-cp start)").option("--show-token", "Print token to stdout").option("--no-browser", "Skip opening browser").action(async (opts) => {
+    await doBegin({
+      showToken: opts.showToken === true,
+      browser: opts.browser !== false
+    });
+  });
+}
+
+// src/commands/stop.ts
+init_host_cp();
+async function doStop(_stopFn = stopHostCp) {
+  await _stopFn();
+}
+function registerStop(program2) {
+  program2.command("stop").description("Stop the Olam host control plane (alias: olam host-cp stop)").action(async () => {
+    await doStop();
+  });
+}
+
+// src/commands/world-upgrade.ts
+init_output();
+init_version_pin();
+async function doWorldUpgrade(opts) {
+  const version = opts.version ?? CLI_VERSION;
+  const stamp = opts.stampPin ?? ((p, v) => stampVersionPin(p, v));
+  let targets;
+  if (opts.all) {
+    targets = opts.getWorlds();
+  } else if (opts.slug) {
+    const w = opts.getWorld(opts.slug);
+    if (!w) return [];
+    targets = [w];
+  } else {
+    return [];
+  }
+  return targets.map((w) => {
+    const stamped = opts.dryRun ? false : stamp(w.workspacePath, version);
+    return { worldId: w.id, stamped, dryRun: opts.dryRun === true };
+  });
+}
+function registerWorldUpgrade(program2) {
+  const world = getOrCreateWorldCommand(program2);
+  world.command("upgrade [slug]").description("Refresh cli_version pin in world.yaml to current CLI version").option("--all", "Upgrade all worlds").option("--dry-run", "Preview which worlds would be upgraded without writing").action(async (slug, opts) => {
+    const { loadContext: loadContext2 } = await Promise.resolve().then(() => (init_context(), context_exports));
+    const { ctx, error } = await loadContext2();
+    if (!ctx) {
+      printError(error?.message ?? "Olam is not configured. Run `olam init` first.");
+      process.exitCode = 1;
+      return;
+    }
+    if (!slug && !opts.all) {
+      printError("Specify a world slug or --all.");
+      process.exitCode = 1;
+      return;
+    }
+    const results = await doWorldUpgrade({
+      slug,
+      all: opts.all,
+      dryRun: opts.dryRun,
+      getWorlds: () => ctx.worldManager.listWorlds(),
+      getWorld: (id) => ctx.worldManager.getWorld(id)
+    });
+    if (results.length === 0) {
+      printError(`World "${slug}" not found.`);
+      process.exitCode = 1;
+      return;
+    }
+    printHeader(`World upgrade ${opts.dryRun ? "(dry run)" : ""}`);
+    for (const r of results) {
+      if (opts.dryRun) {
+        printInfo(r.worldId, "would upgrade");
+      } else if (r.stamped) {
+        printInfo(r.worldId, `stamped \u2192 v${CLI_VERSION}`);
+      } else {
+        printInfo(r.worldId, `already at v${CLI_VERSION} (no-op)`);
+      }
+    }
+  });
+}
+
 // src/pleri-config.ts
-import * as fs34 from "node:fs";
-import * as path38 from "node:path";
+import * as fs36 from "node:fs";
+import * as path40 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path38.join(configDir, "config.yaml");
-  if (!fs34.existsSync(configPath)) {
+  const configPath = path40.join(configDir, "config.yaml");
+  if (!fs36.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs34.readFileSync(configPath, "utf8");
+    const contents = fs36.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -20471,14 +20859,14 @@ function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
 var program = new Command();
 function readCliVersion() {
   try {
-    const here = path39.dirname(fileURLToPath4(import.meta.url));
+    const here = path41.dirname(fileURLToPath4(import.meta.url));
     for (const candidate of [
-      path39.join(here, "package.json"),
-      path39.join(here, "..", "package.json"),
-      path39.join(here, "..", "..", "package.json")
+      path41.join(here, "package.json"),
+      path41.join(here, "..", "package.json"),
+      path41.join(here, "..", "..", "package.json")
     ]) {
-      if (fs35.existsSync(candidate)) {
-        const pkg = JSON.parse(fs35.readFileSync(candidate, "utf-8"));
+      if (fs37.existsSync(candidate)) {
+        const pkg = JSON.parse(fs37.readFileSync(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
       }
     }
@@ -20512,4 +20900,7 @@ registerRefresh(program);
 registerBootstrap(program);
 registerDiagnose(program);
 registerUpdate(program);
+registerBegin(program);
+registerStop(program);
+registerWorldUpgrade(program);
 program.parse();