@pleri/olam-cli 0.1.49 → 0.1.52

package/dist/mcp-server.js

@@ -5,7 +5,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 var __export = (target, all) => {
@@ -3222,8 +3228,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path21) {
-      let input = path21;
+    function removeDotSegments(path22) {
+      let input = path22;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3422,8 +3428,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path21, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path21 && path21 !== "/" ? path21 : void 0;
+        const [path22, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path22 && path22 !== "/" ? path22 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -6785,12 +6791,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs17, exportName) {
+    function addFormats(ajv, list, fs18, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs17[f]);
+        ajv.addFormat(f, fs18[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -6996,10 +7002,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path21) {
-  if (!path21)
+function getElementAtPath(obj, path22) {
+  if (!path22)
     return obj;
-  return path21.reduce((acc, key) => acc?.[key], obj);
+  return path22.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -7319,11 +7325,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path21, issues) {
+function prefixIssues(path22, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path21);
+    iss.path.unshift(path22);
     return iss;
   });
 }
@@ -13397,8 +13403,8 @@ function getErrorMap() {
 
 // ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path21, errorMaps, issueData } = params;
-  const fullPath = [...path21, ...issueData.path || []];
+  const { data, path: path22, errorMaps, issueData } = params;
+  const fullPath = [...path22, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -13514,11 +13520,11 @@ var errorUtil;
 
 // ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path21, key) {
+  constructor(parent, value, path22, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path21;
+    this._path = path22;
     this._key = key;
   }
   get path() {
@@ -21359,8 +21365,8 @@ var AuthClient = class {
       throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
     }
   }
-  async request(method, path21, body, attempt = 0) {
-    const url = `${this.baseUrl}${path21}`;
+  async request(method, path22, body, attempt = 0) {
+    const url = `${this.baseUrl}${path22}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     const headers = {};
@@ -21378,7 +21384,7 @@ var AuthClient = class {
     } catch (err) {
       if (attempt < RETRY_COUNT && isTransient(err)) {
         await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-        return this.request(method, path21, body, attempt + 1);
+        return this.request(method, path22, body, attempt + 1);
       }
       throw err;
     } finally {
@@ -22185,12 +22191,12 @@ function register3(server, _ctx, _initError) {
         registry2.close();
       }
       try {
-        const { default: fs17 } = await import("node:fs");
+        const { default: fs18 } = await import("node:fs");
         const { default: os10 } = await import("node:os");
-        const { default: path21 } = await import("node:path");
-        const tokenPath = path21.join(os10.homedir(), ".olam", "host-cp.token");
-        if (fs17.existsSync(tokenPath)) {
-          const token = fs17.readFileSync(tokenPath, "utf-8").trim();
+        const { default: path22 } = await import("node:path");
+        const tokenPath = path22.join(os10.homedir(), ".olam", "host-cp.token");
+        if (fs18.existsSync(tokenPath)) {
+          const token = fs18.readFileSync(tokenPath, "utf-8").trim();
           await fetch("http://127.0.0.1:19000/api/admin/world-pr", {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -22383,7 +22389,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "deploy"
 ]);
 var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function refineForbiddenKeys(value, path21, ctx, rejectSource) {
+function refineForbiddenKeys(value, path22, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -22391,12 +22397,12 @@ function refineForbiddenKeys(value, path21, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path21, key],
+        path: [...path22, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path21.length === 0 && key === "source") {
+    if (rejectSource && path22.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -22404,21 +22410,21 @@ function refineForbiddenKeys(value, path21, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path21, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path22, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path21, rejectSource) {
+function rejectForbiddenKeys(value, path22, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path21}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path22}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path21}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path22}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path21}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path22}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -22856,10 +22862,10 @@ function extractMcpConfig(claudeJsonPath) {
   }
   return { mcpServers, secrets };
 }
-function readOptional(path21) {
-  if (!existsSync6(path21)) return null;
+function readOptional(path22) {
+  if (!existsSync6(path22)) return null;
   try {
-    return readFileSync5(path21, "utf8");
+    return readFileSync5(path22, "utf8");
   } catch {
     return null;
   }
@@ -24002,8 +24008,8 @@ var CloudflareProvider = class extends ComputeProvider {
   // -----------------------------------------------------------------------
   // Internal fetch helper
   // -----------------------------------------------------------------------
-  async request(path21, method, body) {
-    const url = `${this.config.workerUrl}${path21}`;
+  async request(path22, method, body) {
+    const url = `${this.config.workerUrl}${path22}`;
     const bearer = await this.config.mintToken();
     const headers = {
       Authorization: `Bearer ${bearer}`
@@ -24983,10 +24989,10 @@ var ThoughtLocalStore = class {
 };
 
 // ../core/dist/world/env-setup.js
-import * as crypto2 from "node:crypto";
-import * as fs6 from "node:fs";
+import * as crypto3 from "node:crypto";
+import * as fs7 from "node:fs";
 import * as os6 from "node:os";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 import { globSync } from "node:fs";
 
 // ../core/dist/thought/hooks-config.js
@@ -25003,14 +25009,25 @@ function generateHooksConfig(hookServerUrl = DEFAULT_HOOK_SERVER_URL) {
     hooks: {
       // Codex adversarial review — fires on every user prompt in-world
       // Uses $HOME so sanitizeContainerClaudeHooks does not strip it
-      UserPromptSubmit: [{
-        matcher: "",
-        hooks: [{
-          type: "command",
-          command: "$HOME/.claude/scripts/codex-on-prompt.sh",
-          timeout: 15
-        }]
-      }],
+      UserPromptSubmit: [
+        {
+          matcher: "",
+          hooks: [{
+            type: "command",
+            command: "$HOME/.claude/scripts/codex-on-prompt.sh",
+            timeout: 15
+          }]
+        },
+        // C02: surface first-call hint when MCP creds are missing
+        {
+          matcher: "",
+          hooks: [{
+            type: "command",
+            command: "node /opt/olam/scripts/mcp-status-hint.mjs",
+            timeout: 2
+          }]
+        }
+      ],
       // Tool execution events → high-frequency thought capture
       // Layer 1: Upstream Codex review (PreToolUse) — runs after thought capture
       PreToolUse: [
@@ -25061,82 +25078,182 @@ function generateHooksConfig(hookServerUrl = DEFAULT_HOOK_SERVER_URL) {
   };
 }
 
+// ../core/dist/world/merge-settings.js
+import * as fs6 from "node:fs";
+import * as path9 from "node:path";
+import * as crypto2 from "node:crypto";
+function mergeHomeSettingsJson(filePath, options) {
+  let settings;
+  try {
+    settings = readSettings(filePath);
+  } catch (err) {
+    throw new Error(`merge-settings: failed to parse existing settings.json: ${err?.message ?? err}`);
+  }
+  let changed = false;
+  if (options.ensureHook) {
+    const { stage, sentinel, entry } = options.ensureHook;
+    if (!settings.hooks || typeof settings.hooks !== "object") {
+      settings = { ...settings, hooks: {} };
+      changed = true;
+    }
+    const hooks = settings.hooks;
+    if (!Array.isArray(hooks[stage])) {
+      settings = {
+        ...settings,
+        hooks: { ...hooks, [stage]: [] }
+      };
+      changed = true;
+    }
+    const stageArr = settings.hooks[stage];
+    if (isHookSentinelPresent(stageArr, sentinel)) {
+      if (!changed) {
+        return { status: "already-present", message: `hook already present at ${filePath}` };
+      }
+    } else {
+      settings = {
+        ...settings,
+        hooks: {
+          ...settings.hooks,
+          [stage]: [...stageArr, entry]
+        }
+      };
+      changed = true;
+    }
+  }
+  if (options.env) {
+    const existingEnv = settings.env && typeof settings.env === "object" ? settings.env : {};
+    const mergedEnv = { ...existingEnv, ...options.env };
+    const sameKeys = Object.keys(mergedEnv).length === Object.keys(existingEnv).length && Object.keys(mergedEnv).every((k) => existingEnv[k] === mergedEnv[k]);
+    if (!sameKeys) {
+      settings = { ...settings, env: mergedEnv };
+      changed = true;
+    }
+  }
+  if (!changed) {
+    return { status: "no-op", message: `no change needed at ${filePath}` };
+  }
+  try {
+    atomicWriteJson(filePath, settings);
+  } catch (err) {
+    throw new Error(`merge-settings: failed to write settings.json: ${err?.message ?? err}`);
+  }
+  return { status: "installed", message: `settings.json updated at ${filePath}` };
+}
+function readSettings(filePath) {
+  if (!fs6.existsSync(filePath)) {
+    return {};
+  }
+  const raw = fs6.readFileSync(filePath, "utf-8");
+  if (!raw.trim())
+    return {};
+  return JSON.parse(raw);
+}
+function isHookSentinelPresent(matchers, sentinel) {
+  for (const matcher of matchers) {
+    if (typeof matcher?.command === "string" && matcher.command.includes(sentinel)) {
+      return true;
+    }
+    if (Array.isArray(matcher?.hooks)) {
+      for (const h of matcher.hooks) {
+        if (typeof h?.command === "string" && h.command.includes(sentinel)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function atomicWriteJson(filePath, data) {
+  const dir = path9.dirname(filePath);
+  fs6.mkdirSync(dir, { recursive: true });
+  const rand = crypto2.randomBytes(6).toString("hex");
+  const tmp = `${filePath}.tmp.${process.pid}.${rand}`;
+  const json = JSON.stringify(data, null, 2) + "\n";
+  fs6.writeFileSync(tmp, json, { mode: 420 });
+  fs6.renameSync(tmp, filePath);
+}
+
 // ../core/dist/world/env-setup.js
 function copyClaudeConfig(workspacePath, homeDir, configCtx) {
-  const sourceClaudeDir = path9.join(homeDir ?? os6.homedir(), ".claude");
-  const destClaudeDir = path9.join(workspacePath, ".claude-host-config");
+  const sourceClaudeDir = path10.join(homeDir ?? os6.homedir(), ".claude");
+  const destClaudeDir = path10.join(workspacePath, ".claude-host-config");
   void configCtx;
-  if (!fs6.existsSync(sourceClaudeDir))
+  if (!fs7.existsSync(sourceClaudeDir))
     return;
-  fs6.mkdirSync(destClaudeDir, { recursive: true });
-  const settingsPath = path9.join(sourceClaudeDir, "settings.json");
+  fs7.mkdirSync(destClaudeDir, { recursive: true });
+  const settingsPath = path10.join(sourceClaudeDir, "settings.json");
   let settings = {};
-  if (fs6.existsSync(settingsPath)) {
+  if (fs7.existsSync(settingsPath)) {
     try {
-      settings = JSON.parse(fs6.readFileSync(settingsPath, "utf-8"));
+      settings = JSON.parse(fs7.readFileSync(settingsPath, "utf-8"));
       delete settings["hooks"];
     } catch {
     }
   }
   const hooksConfig = generateHooksConfig(DEFAULT_HOOK_SERVER_URL);
   settings["hooks"] = hooksConfig["hooks"];
-  fs6.writeFileSync(path9.join(destClaudeDir, "settings.json"), JSON.stringify(settings, null, 2));
-  const claudeMdPath = path9.join(sourceClaudeDir, "CLAUDE.md");
-  if (fs6.existsSync(claudeMdPath)) {
-    fs6.copyFileSync(claudeMdPath, path9.join(destClaudeDir, "CLAUDE.md"));
+  fs7.writeFileSync(path10.join(destClaudeDir, "settings.json"), JSON.stringify(settings, null, 2));
+  const claudeMdPath = path10.join(sourceClaudeDir, "CLAUDE.md");
+  if (fs7.existsSync(claudeMdPath)) {
+    fs7.copyFileSync(claudeMdPath, path10.join(destClaudeDir, "CLAUDE.md"));
   }
-  const rulesDir = path9.join(sourceClaudeDir, "rules");
-  if (fs6.existsSync(rulesDir)) {
-    copyDirRecursive(rulesDir, path9.join(destClaudeDir, "rules"));
+  const rulesDir = path10.join(sourceClaudeDir, "rules");
+  if (fs7.existsSync(rulesDir)) {
+    copyDirRecursive(rulesDir, path10.join(destClaudeDir, "rules"));
   }
-  const agentsDir = path9.join(sourceClaudeDir, "agents");
-  if (fs6.existsSync(agentsDir)) {
-    copyDirRecursive(agentsDir, path9.join(destClaudeDir, "agents"));
+  const agentsDir = path10.join(sourceClaudeDir, "agents");
+  if (fs7.existsSync(agentsDir)) {
+    copyDirRecursive(agentsDir, path10.join(destClaudeDir, "agents"));
   }
-  const pluginsDir = path9.join(sourceClaudeDir, "plugins");
-  if (fs6.existsSync(pluginsDir)) {
-    copyDirRecursive(pluginsDir, path9.join(destClaudeDir, "plugins"), 0, SKIP_FILES);
+  const pluginsDir = path10.join(sourceClaudeDir, "plugins");
+  if (fs7.existsSync(pluginsDir)) {
+    copyDirRecursive(pluginsDir, path10.join(destClaudeDir, "plugins"), 0, SKIP_FILES);
   }
-  const skillsDir = path9.join(sourceClaudeDir, "skills");
-  if (fs6.existsSync(skillsDir)) {
-    copyDirRecursive(skillsDir, path9.join(destClaudeDir, "skills"));
+  const skillsDir = path10.join(sourceClaudeDir, "skills");
+  if (fs7.existsSync(skillsDir)) {
+    copyDirRecursive(skillsDir, path10.join(destClaudeDir, "skills"));
   }
-  const scriptsDir = path9.join(sourceClaudeDir, "scripts");
-  if (fs6.existsSync(scriptsDir)) {
-    copyDirRecursive(scriptsDir, path9.join(destClaudeDir, "scripts"));
+  const scriptsDir = path10.join(sourceClaudeDir, "scripts");
+  if (fs7.existsSync(scriptsDir)) {
+    copyDirRecursive(scriptsDir, path10.join(destClaudeDir, "scripts"));
   }
   applyProjectClaudeOverlay(workspacePath, destClaudeDir);
   writeStrippedMcpServersSnapshot(homeDir ?? os6.homedir(), workspacePath, destClaudeDir);
+  if (configCtx != null && configCtx.worlds_default?.agent_teams_enabled !== false) {
+    mergeHomeSettingsJson(path10.join(destClaudeDir, "settings.json"), {
+      env: { CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: "1" }
+    });
+  }
 }
 function applyProjectClaudeOverlay(workspacePath, destClaudeDir) {
-  const projectClaudeDir = path9.join(workspacePath, ".claude");
-  if (!fs6.existsSync(projectClaudeDir))
+  const projectClaudeDir = path10.join(workspacePath, ".claude");
+  if (!fs7.existsSync(projectClaudeDir))
     return;
-  const projectSettingsPath = path9.join(projectClaudeDir, "settings.json");
-  const destSettingsPath = path9.join(destClaudeDir, "settings.json");
-  if (fs6.existsSync(projectSettingsPath)) {
+  const projectSettingsPath = path10.join(projectClaudeDir, "settings.json");
+  const destSettingsPath = path10.join(destClaudeDir, "settings.json");
+  if (fs7.existsSync(projectSettingsPath)) {
     try {
-      const projectSettings = JSON.parse(fs6.readFileSync(projectSettingsPath, "utf-8"));
+      const projectSettings = JSON.parse(fs7.readFileSync(projectSettingsPath, "utf-8"));
       delete projectSettings["hooks"];
-      const existing = fs6.existsSync(destSettingsPath) ? JSON.parse(fs6.readFileSync(destSettingsPath, "utf-8")) : {};
+      const existing = fs7.existsSync(destSettingsPath) ? JSON.parse(fs7.readFileSync(destSettingsPath, "utf-8")) : {};
       const merged = { ...existing, ...projectSettings, hooks: existing["hooks"] };
-      fs6.writeFileSync(destSettingsPath, JSON.stringify(merged, null, 2));
+      fs7.writeFileSync(destSettingsPath, JSON.stringify(merged, null, 2));
     } catch {
     }
   }
-  const projectClaudeMd = path9.join(projectClaudeDir, "CLAUDE.md");
-  if (fs6.existsSync(projectClaudeMd)) {
-    fs6.copyFileSync(projectClaudeMd, path9.join(destClaudeDir, "CLAUDE.md"));
+  const projectClaudeMd = path10.join(projectClaudeDir, "CLAUDE.md");
+  if (fs7.existsSync(projectClaudeMd)) {
+    fs7.copyFileSync(projectClaudeMd, path10.join(destClaudeDir, "CLAUDE.md"));
   }
-  const projectAgentsMd = path9.join(projectClaudeDir, "AGENTS.md");
-  if (fs6.existsSync(projectAgentsMd)) {
-    fs6.copyFileSync(projectAgentsMd, path9.join(destClaudeDir, "AGENTS.md"));
+  const projectAgentsMd = path10.join(projectClaudeDir, "AGENTS.md");
+  if (fs7.existsSync(projectAgentsMd)) {
+    fs7.copyFileSync(projectAgentsMd, path10.join(destClaudeDir, "AGENTS.md"));
   }
   for (const subdir of ["rules", "agents", "plugins", "skills", "scripts"]) {
-    const projectSubdir = path9.join(projectClaudeDir, subdir);
-    if (fs6.existsSync(projectSubdir)) {
+    const projectSubdir = path10.join(projectClaudeDir, subdir);
+    if (fs7.existsSync(projectSubdir)) {
       const skip = subdir === "plugins" ? SKIP_FILES : /* @__PURE__ */ new Set();
-      copyDirRecursive(projectSubdir, path9.join(destClaudeDir, subdir), 0, skip);
+      copyDirRecursive(projectSubdir, path10.join(destClaudeDir, subdir), 0, skip);
     }
   }
 }
@@ -25172,8 +25289,8 @@ function stripMcpServers(mcpServers) {
   return out;
 }
 function writeStrippedMcpServersSnapshot(homeDir, workspacePath, destClaudeDir) {
-  const hostMcpServers = readMcpServersFromFile(path9.join(homeDir, ".claude.json"));
-  const projectMcpServers = readMcpServersFromFile(path9.join(workspacePath, ".mcp.json"));
+  const hostMcpServers = readMcpServersFromFile(path10.join(homeDir, ".claude.json"));
+  const projectMcpServers = readMcpServersFromFile(path10.join(workspacePath, ".mcp.json"));
   if (Object.keys(hostMcpServers).length === 0 && Object.keys(projectMcpServers).length === 0) {
     return;
   }
@@ -25182,11 +25299,11 @@ function writeStrippedMcpServersSnapshot(homeDir, workspacePath, destClaudeDir)
     ...stripMcpServers(projectMcpServers)
   };
   const output = { mcpServers: stripped };
-  fs6.writeFileSync(path9.join(destClaudeDir, ".claude.json"), JSON.stringify(output, null, 2), { mode: 384 });
+  fs7.writeFileSync(path10.join(destClaudeDir, ".claude.json"), JSON.stringify(output, null, 2), { mode: 384 });
 }
 function writeWorldEntitlementsJson(workspacePath, configCtx) {
-  const olamDir = path9.join(workspacePath, ".olam");
-  fs6.mkdirSync(olamDir, { recursive: true });
+  const olamDir = path10.join(workspacePath, ".olam");
+  fs7.mkdirSync(olamDir, { recursive: true });
   const resolvedRepos = configCtx.repos.map((repo) => {
     const repoEntitlement = repo;
     return {
@@ -25200,14 +25317,14 @@ function writeWorldEntitlementsJson(workspacePath, configCtx) {
     worlds_default: configCtx.worlds_default,
     repos: resolvedRepos
   };
-  const filePath = path9.join(olamDir, "world-entitlements.json");
-  fs6.writeFileSync(filePath, JSON.stringify(resolved, null, 2), { mode: 420 });
+  const filePath = path10.join(olamDir, "world-entitlements.json");
+  fs7.writeFileSync(filePath, JSON.stringify(resolved, null, 2), { mode: 420 });
 }
 function readMcpServersFromFile(filePath) {
-  if (!fs6.existsSync(filePath))
+  if (!fs7.existsSync(filePath))
     return {};
   try {
-    const raw = fs6.readFileSync(filePath, "utf-8");
+    const raw = fs7.readFileSync(filePath, "utf-8");
     if (!raw.trim())
       return {};
     const parsed = JSON.parse(raw);
@@ -25243,8 +25360,8 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
 function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new Set()) {
   if (depth > 10)
     return;
-  fs6.mkdirSync(dest, { recursive: true });
-  for (const entry of fs6.readdirSync(src, { withFileTypes: true })) {
+  fs7.mkdirSync(dest, { recursive: true });
+  for (const entry of fs7.readdirSync(src, { withFileTypes: true })) {
     const { name } = entry;
     if (skipFiles.has(name))
       continue;
@@ -25254,12 +25371,12 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
       continue;
     if (entry.isDirectory() && SKIP_DIRS.has(name))
       continue;
-    const srcPath = path9.join(src, name);
-    const destPath = path9.join(dest, name);
+    const srcPath = path10.join(src, name);
+    const destPath = path10.join(dest, name);
     if (entry.isSymbolicLink()) {
       let stat;
       try {
-        stat = fs6.statSync(srcPath);
+        stat = fs7.statSync(srcPath);
       } catch {
         continue;
       }
@@ -25268,12 +25385,12 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
           continue;
         copyDirRecursive(srcPath, destPath, depth + 1, skipFiles);
       } else if (stat.isFile()) {
-        fs6.copyFileSync(srcPath, destPath);
+        fs7.copyFileSync(srcPath, destPath);
       }
     } else if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath, depth + 1, skipFiles);
     } else {
-      fs6.copyFileSync(srcPath, destPath);
+      fs7.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -25442,9 +25559,9 @@ function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, conf
     }
   }
   for (const repo of repos) {
-    const worktreePath = path9.join(workspacePath, repo.name);
+    const worktreePath = path10.join(workspacePath, repo.name);
     const sourcePath = repo.path;
-    if (!sourcePath || !fs6.existsSync(worktreePath))
+    if (!sourcePath || !fs7.existsSync(worktreePath))
       continue;
     const envSetup = repo.env_setup;
     if (!envSetup)
@@ -25463,23 +25580,23 @@ function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, conf
   }
 }
 function copyMatchingFiles(sourcePath, destPath, pattern) {
-  const fullPattern = path9.join(sourcePath, pattern);
+  const fullPattern = path10.join(sourcePath, pattern);
   if (!pattern.includes("*")) {
-    const sourceFile = path9.join(sourcePath, pattern);
-    const destFile = path9.join(destPath, pattern);
-    if (fs6.existsSync(sourceFile)) {
-      fs6.mkdirSync(path9.dirname(destFile), { recursive: true });
-      fs6.copyFileSync(sourceFile, destFile);
+    const sourceFile = path10.join(sourcePath, pattern);
+    const destFile = path10.join(destPath, pattern);
+    if (fs7.existsSync(sourceFile)) {
+      fs7.mkdirSync(path10.dirname(destFile), { recursive: true });
+      fs7.copyFileSync(sourceFile, destFile);
     }
     return;
   }
   try {
     const matches2 = globSync(fullPattern);
     for (const match of matches2) {
-      const relative2 = path9.relative(sourcePath, match);
-      const dest = path9.join(destPath, relative2);
-      fs6.mkdirSync(path9.dirname(dest), { recursive: true });
-      fs6.copyFileSync(match, dest);
+      const relative2 = path10.relative(sourcePath, match);
+      const dest = path10.join(destPath, relative2);
+      fs7.mkdirSync(path10.dirname(dest), { recursive: true });
+      fs7.copyFileSync(match, dest);
     }
   } catch {
   }
@@ -25487,14 +25604,14 @@ function copyMatchingFiles(sourcePath, destPath, pattern) {
 function generateEnvFromExample(repoPath, overrides) {
   const exampleFiles = [".env.example", ".env.sample", ".env.local.example"];
   for (const exampleName of exampleFiles) {
-    const examplePath = path9.join(repoPath, exampleName);
-    if (!fs6.existsSync(examplePath))
+    const examplePath = path10.join(repoPath, exampleName);
+    if (!fs7.existsSync(examplePath))
       continue;
     const targetName = exampleName.replace(".example", "").replace(".sample", "");
-    const targetPath = path9.join(repoPath, targetName);
-    if (fs6.existsSync(targetPath))
+    const targetPath = path10.join(repoPath, targetName);
+    if (fs7.existsSync(targetPath))
       continue;
-    const template = fs6.readFileSync(examplePath, "utf-8");
+    const template = fs7.readFileSync(examplePath, "utf-8");
     const generated = template.split("\n").map((line) => {
       const match = /^([A-Z_][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) {
@@ -25505,13 +25622,13 @@ function generateEnvFromExample(repoPath, overrides) {
       }
       return line;
     }).join("\n");
-    fs6.writeFileSync(targetPath, generated);
+    fs7.writeFileSync(targetPath, generated);
   }
 }
 function applyEnvOverrides(repoPath, overrides) {
-  const envPath = path9.join(repoPath, ".env");
-  if (fs6.existsSync(envPath)) {
-    const existing = fs6.readFileSync(envPath, "utf-8");
+  const envPath = path10.join(repoPath, ".env");
+  if (fs7.existsSync(envPath)) {
+    const existing = fs7.readFileSync(envPath, "utf-8");
     const existingKeys = new Set(existing.split("\n").map((l) => l.split("=")[0]?.trim()).filter(Boolean));
     const additions = [];
     for (const [key, value] of Object.entries(overrides)) {
@@ -25520,7 +25637,7 @@ function applyEnvOverrides(repoPath, overrides) {
       }
     }
     if (additions.length > 0) {
-      fs6.appendFileSync(envPath, "\n# Olam injected\n" + additions.join("\n") + "\n");
+      fs7.appendFileSync(envPath, "\n# Olam injected\n" + additions.join("\n") + "\n");
     }
   }
 }
@@ -25777,7 +25894,7 @@ __export(world_crystallize_exports, {
   register: () => register12
 });
 import "node:path";
-import * as fs7 from "node:fs";
+import * as fs8 from "node:fs";
 
 // ../core/dist/crystallize/checksum.js
 import { createHash as createHash2 } from "node:crypto";
@@ -25833,7 +25950,7 @@ function register12(server, ctx, initError) {
       }
       try {
         const thoughtDbPath = getWorldDbPath(world.workspacePath);
-        if (!fs7.existsSync(thoughtDbPath)) {
+        if (!fs8.existsSync(thoughtDbPath)) {
           return {
             content: [{
               type: "text",
@@ -26419,23 +26536,23 @@ async function writeManifest(args) {
     capturedAt: args.capturedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     shots: entries
   };
-  const path21 = join12(args.outDir, "manifest.json");
-  await writeFile(path21, `${JSON.stringify(manifest, null, 2)}
+  const path22 = join12(args.outDir, "manifest.json");
+  await writeFile(path22, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  return { path: path21, manifest };
+  return { path: path22, manifest };
 }
 
 // ../mcp-server/src/tools/_capture/proxy.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync7, statSync as statSync3, unlinkSync as unlinkSync2 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync8, statSync as statSync3, unlinkSync as unlinkSync2 } from "node:fs";
 import { createServer as createServer2 } from "node:http";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { connect as netConnect } from "node:net";
-import { dirname as dirname6 } from "node:path";
+import { dirname as dirname7 } from "node:path";
 import { userInfo } from "node:os";
 
 // ../mcp-server/src/tools/_capture/token.ts
-import { createHmac, randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+import { createHmac, randomBytes as randomBytes4, timingSafeEqual } from "node:crypto";
 var HOST_TTL_MAX_SEC = 600;
 var WORLD_TTL_MAX_SEC = 60;
 var WORLD_HOURLY_QUOTA = 50;
@@ -26477,7 +26594,7 @@ function loadHmacKey() {
     );
     _autoKeyWarned = true;
   }
-  _hmacKey = randomBytes3(32);
+  _hmacKey = randomBytes4(32);
   return _hmacKey;
 }
 function base64url2(buf) {
@@ -26545,7 +26662,7 @@ function mintToken(input) {
       window2.count++;
     }
   }
-  const correlationId = base32Crockford(randomBytes3(16));
+  const correlationId = base32Crockford(randomBytes4(16));
   const exp = Math.floor(_now() / 1e3) + ttlClamped;
   const scope = {
     allowedPaths: input.allowedPaths,
@@ -26676,9 +26793,9 @@ async function startProxy(opts) {
       const liveCompiled = verified.allowedPaths.map(compileGlob);
       const target = parseRequestTarget(req);
       if (!target) return httpReject(400, "invalid_target");
-      const path21 = target.pathname;
-      if (!liveCompiled.some((re) => re.test(path21))) {
-        return httpReject(403, "outside_allow_list", { path: path21 });
+      const path22 = target.pathname;
+      if (!liveCompiled.some((re) => re.test(path22))) {
+        return httpReject(403, "outside_allow_list", { path: path22 });
       }
       const headerWorld = req.headers[WORLD_ASSERT_HEADER];
       const headerWorldStr = typeof headerWorld === "string" ? headerWorld : Array.isArray(headerWorld) && headerWorld.length > 0 ? headerWorld[0] : void 0;
@@ -26833,7 +26950,7 @@ ${JSON.stringify({ error: reason })}`
   };
 }
 function ensureUdsParentDirSafe(udsPath) {
-  const parent = dirname6(udsPath);
+  const parent = dirname7(udsPath);
   if (!parent || parent === udsPath || parent === ".") {
     throw new Error(
       `uds_parent_path_invalid: bindUdsPath "${udsPath}" has no manageable parent directory`
@@ -26850,7 +26967,7 @@ function ensureUdsParentDirSafe(udsPath) {
     }
   }
   if (!stat) {
-    mkdirSync7(parent, { recursive: true, mode: 448 });
+    mkdirSync8(parent, { recursive: true, mode: 448 });
     return;
   }
   if (!stat.isDirectory()) {
@@ -27457,14 +27574,14 @@ async function runShot(browser, shot, outDir, format, jpegQuality, allowEval, as
       await page.waitForTimeout(shot.afterLoadMs);
     }
     const ext = format === "jpeg" ? "jpg" : "png";
-    const path21 = join13(outDir, `${shot.name}.${ext}`);
+    const path22 = join13(outDir, `${shot.name}.${ext}`);
     await page.screenshot({
-      path: path21,
+      path: path22,
       type: format,
       ...format === "jpeg" ? { quality: jpegQuality } : {},
       fullPage: false
     });
-    return { name: shot.name, path: path21, urlRedacted: redactUrl(shot.url), viewport };
+    return { name: shot.name, path: path22, urlRedacted: redactUrl(shot.url), viewport };
   } finally {
     await context.close();
   }
@@ -27907,12 +28024,12 @@ function openUrl(url) {
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpToken2() {
   try {
-    const { default: fs17 } = await import("node:fs");
+    const { default: fs18 } = await import("node:fs");
     const { default: os10 } = await import("node:os");
-    const { default: path21 } = await import("node:path");
-    const tp = path21.join(os10.homedir(), ".olam", "host-cp.token");
-    if (!fs17.existsSync(tp)) return { token: null };
-    return { token: fs17.readFileSync(tp, "utf-8").trim() };
+    const { default: path22 } = await import("node:path");
+    const tp = path22.join(os10.homedir(), ".olam", "host-cp.token");
+    if (!fs18.existsSync(tp)) return { token: null };
+    return { token: fs18.readFileSync(tp, "utf-8").trim() };
   } catch {
     return { token: null };
   }
@@ -28192,8 +28309,8 @@ function createServer3(ctx, initError) {
 }
 
 // ../core/dist/config/loader.js
-import * as fs9 from "node:fs";
-import * as path12 from "node:path";
+import * as fs10 from "node:fs";
+import * as path13 from "node:path";
 import { parse as parseYaml2 } from "yaml";
 
 // ../core/dist/config/schema.js
@@ -28523,11 +28640,11 @@ function substituteEnvVars(obj) {
 }
 
 // ../core/dist/config/dotenv.js
-import * as fs8 from "node:fs";
+import * as fs9 from "node:fs";
 function loadDotEnv(envPath) {
-  if (!fs8.existsSync(envPath))
+  if (!fs9.existsSync(envPath))
     return;
-  const content = fs8.readFileSync(envPath, "utf-8");
+  const content = fs9.readFileSync(envPath, "utf-8");
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#"))
@@ -28546,18 +28663,18 @@ function loadDotEnv(envPath) {
 // ../core/dist/config/loader.js
 function findConfigFile(startDir) {
   const searched = [];
-  let current = path12.resolve(startDir);
+  let current = path13.resolve(startDir);
   while (true) {
-    const newLayout = path12.join(current, CONFIG_DIR_NAME, CONFIG_FILENAME);
-    const legacyLayout = path12.join(current, LEGACY_CONFIG_FILENAME);
+    const newLayout = path13.join(current, CONFIG_DIR_NAME, CONFIG_FILENAME);
+    const legacyLayout = path13.join(current, LEGACY_CONFIG_FILENAME);
     searched.push(newLayout, legacyLayout);
-    if (fs9.existsSync(newLayout)) {
+    if (fs10.existsSync(newLayout)) {
       return { path: newLayout, isLegacy: false };
     }
-    if (fs9.existsSync(legacyLayout)) {
+    if (fs10.existsSync(legacyLayout)) {
       return { path: legacyLayout, isLegacy: true };
     }
-    const parent = path12.dirname(current);
+    const parent = path13.dirname(current);
     if (parent === current)
       break;
     current = parent;
@@ -28572,12 +28689,12 @@ function loadConfig(startDir) {
        Run /olam:init to migrate to .olam/config.yaml
 `);
   } else {
-    const envPath = path12.join(path12.dirname(found.path), ".env");
+    const envPath = path13.join(path13.dirname(found.path), ".env");
     loadDotEnv(envPath);
   }
   let rawContent;
   try {
-    rawContent = fs9.readFileSync(found.path, "utf-8");
+    rawContent = fs10.readFileSync(found.path, "utf-8");
   } catch (err) {
     throw new Error(`Failed to read ${found.path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -28607,11 +28724,11 @@ function loadConfig(startDir) {
 }
 
 // ../core/dist/world/manager.js
-import * as crypto4 from "node:crypto";
+import * as crypto5 from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
-import * as fs14 from "node:fs";
+import * as fs15 from "node:fs";
 import * as os8 from "node:os";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 
 // ../core/dist/world/state.js
 var VALID_TRANSITIONS = {
@@ -28693,8 +28810,8 @@ function resolveDevboxImage(config2, tag) {
 
 // ../core/dist/world/worktree.js
 import { execFileSync as execFileSync2 } from "node:child_process";
-import * as fs10 from "node:fs";
-import * as path13 from "node:path";
+import * as fs11 from "node:fs";
+import * as path14 from "node:path";
 function resolveGitDir(repo) {
   if (repo.path) {
     return repo.path;
@@ -28704,11 +28821,11 @@ function resolveGitDir(repo) {
 async function createWorktrees(repos, worldId, workspacePath, branch) {
   const created = [];
   for (const repo of repos) {
-    const worktreePath = path13.join(workspacePath, repo.name);
+    const worktreePath = path14.join(workspacePath, repo.name);
     const gitDir = resolveGitDir(repo);
     const branchName = branch || `olam/${worldId}`;
     try {
-      fs10.mkdirSync(path13.dirname(worktreePath), { recursive: true });
+      fs11.mkdirSync(path14.dirname(worktreePath), { recursive: true });
       execFileSync2("git", ["worktree", "add", worktreePath, "-b", branchName], {
         cwd: gitDir,
         stdio: "pipe"
@@ -28741,7 +28858,7 @@ async function createWorktrees(repos, worldId, workspacePath, branch) {
 }
 async function removeWorktrees(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path13.join(workspacePath, repo.name);
+    const worktreePath = path14.join(workspacePath, repo.name);
     let gitDir;
     try {
       gitDir = resolveGitDir(repo);
@@ -28816,9 +28933,9 @@ function removeBranch(repo, branch) {
 
 // ../core/dist/world/baseline-diff.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 import * as os7 from "node:os";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 var DEFAULT_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 function expandHome(p, homedir11) {
   return p.replace(/^~(?=$|\/|\\)/, homedir11());
@@ -28845,9 +28962,9 @@ ${stderr}`;
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
   const homedir11 = deps.homedir ?? (() => os7.homedir());
-  const baselineDir = path14.join(workspacePath, ".olam", "baseline");
+  const baselineDir = path15.join(workspacePath, ".olam", "baseline");
   try {
-    fs11.mkdirSync(baselineDir, { recursive: true });
+    fs12.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -28859,9 +28976,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path14.join(baselineDir, filename);
+    const outPath = path15.join(baselineDir, filename);
     const repoPath = expandHome(repo.path, homedir11);
-    if (!fs11.existsSync(repoPath)) {
+    if (!fs12.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -28928,7 +29045,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs11.writeFileSync(outPath, content);
+    fs12.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -28936,8 +29053,8 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path14.join(workspacePath, repo.name);
-    if (!fs11.existsSync(worktreePath))
+    const worktreePath = path15.join(workspacePath, repo.name);
+    if (!fs12.existsSync(worktreePath))
       continue;
     try {
       execFileSync3("git", ["checkout", "--", "."], {
@@ -28967,12 +29084,12 @@ function formatBaselineSummary(result) {
 }
 
 // ../core/dist/world/context-injection.js
-import * as fs12 from "node:fs";
-import * as path15 from "node:path";
+import * as fs13 from "node:fs";
+import * as path16 from "node:path";
 function injectWorldContext(opts) {
   const { world, task, linearTicketId, claudeMdExtra, taskContext, services, pleriPlaneUrl } = opts;
-  const claudeDir = path15.join(world.workspacePath, ".claude");
-  fs12.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir = path16.join(world.workspacePath, ".claude");
+  fs13.mkdirSync(claudeDir, { recursive: true });
   const sections = [];
   sections.push(`# Olam World: ${world.name}`);
   sections.push("");
@@ -29133,7 +29250,7 @@ function injectWorldContext(opts) {
     sections.push("");
   }
   const content = sections.join("\n");
-  fs12.writeFileSync(path15.join(claudeDir, "CLAUDE.md"), content);
+  fs13.writeFileSync(path16.join(claudeDir, "CLAUDE.md"), content);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -29147,9 +29264,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path15.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path16.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs12.existsSync(plansDir) && fs12.readdirSync(plansDir).length > 0;
+    return fs13.existsSync(plansDir) && fs13.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -29376,7 +29493,7 @@ async function installStack(exec, repos, stacks) {
 
 // ../core/dist/world/stack-image.js
 import { execSync as execSync2 } from "node:child_process";
-import * as crypto3 from "node:crypto";
+import * as crypto4 from "node:crypto";
 var BASE_IMAGE = "olam-devbox";
 var LABEL_PREFIX = "olam.stack-image";
 var MAX_TAG_LENGTH = 128;
@@ -29430,14 +29547,14 @@ function getBaseImageDigest() {
     cachedBaseDigest = digest.replace("sha256:", "").slice(0, 16);
     return cachedBaseDigest;
   } catch {
-    cachedBaseDigest = crypto3.createHash("sha256").update("unknown").digest("hex").slice(0, 16);
+    cachedBaseDigest = crypto4.createHash("sha256").update("unknown").digest("hex").slice(0, 16);
     return cachedBaseDigest;
   }
 }
 function sanitizeTag(raw) {
   let tag = raw.toLowerCase().replace(/[^a-z0-9._-]/g, "-");
   if (tag.length > MAX_TAG_LENGTH) {
-    const hash = crypto3.createHash("sha256").update(raw).digest("hex").slice(0, 12);
+    const hash = crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 12);
     tag = tag.slice(0, MAX_TAG_LENGTH - 13) + "_" + hash;
   }
   return tag;
@@ -29815,14 +29932,14 @@ function gcloudAvailable(execFn = defaultExecFn) {
 }
 
 // ../core/dist/world/olam-yaml.js
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path16.join(workspacePath, repo.name);
+    const repoDir = path17.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -29837,8 +29954,8 @@ function enrichReposWithManifests(repos, workspacePath) {
 }
 
 // ../core/dist/policies/loader.js
-import * as fs13 from "node:fs";
-import * as path17 from "node:path";
+import * as fs14 from "node:fs";
+import * as path18 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function parseFrontmatter(content) {
   const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -29858,20 +29975,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path17.join(workspaceRoot, ".olam", "policies");
-  if (!fs13.existsSync(policiesDir))
+  const policiesDir = path18.join(workspaceRoot, ".olam", "policies");
+  if (!fs14.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs13.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs14.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path17.join(policiesDir, file);
+    const filePath = path18.join(policiesDir, file);
     try {
-      const content = fs13.readFileSync(filePath, "utf8");
+      const content = fs14.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -30106,12 +30223,42 @@ ${stderr.split("\n").slice(0, 3).join(" ")}`);
     dockerExec(`cd ${repoDir} && git checkout -b ${branch}`);
   }
   if (ghToken) {
+    const olamUserPresent = (() => {
+      try {
+        dockerExec(`id olam`);
+        return true;
+      } catch {
+        return false;
+      }
+    })();
+    if (!olamUserPresent) {
+      const imageName = (() => {
+        try {
+          const { execSync: execSync6 } = __require("node:child_process");
+          return execSync6(`docker inspect ${containerName} --format '{{.Config.Image}}'`, {
+            encoding: "utf8",
+            timeout: 5e3
+          }).trim() || "(unknown)";
+        } catch {
+          return "(unknown)";
+        }
+      })();
+      console.warn(`[world] gh auth setup skipped for ${containerName}: container has no \`olam\` user.
+         Image:    ${imageName}
+         Likely cause: corrupt local image, a custom devbox image without
+         the olam user (line 10 of devbox.Dockerfile), or NSS resolver
+         failure under cross-arch QEMU emulation.
+         Remedy:   docker rmi olam-devbox:latest && olam upgrade -y
+         (or set OLAM_DEVBOX_IMAGE to a known-good ref before \`olam create\`).
+         PR push from inside the world will not work until this is resolved.`);
+      return;
+    }
     let tokenWritten = false;
     try {
       dockerExec(`which gh || (sudo apt-get update -qq && sudo apt-get install -y -qq gh) 2>/dev/null`);
       dockerExec(`printf '%s' '${ghToken.replace(/'/g, "'\\''")}' > /tmp/.gh-token && chmod 600 /tmp/.gh-token`);
       tokenWritten = true;
-      dockerExec(`sudo chown olam:olam /home/olam/.config`);
+      dockerExec(`sudo chown olam:olam /home/olam/.config 2>/dev/null || true`);
       dockerExec(`gh auth login --with-token < /tmp/.gh-token`);
       dockerExec(`gh auth setup-git`);
     } catch (err) {
@@ -30328,6 +30475,15 @@ var WorkspaceNotFoundError = class extends Error {
     this.name = "WorkspaceNotFoundError";
   }
 };
+var RepoSelectionRequiredError = class extends Error {
+  availableRepos;
+  constructor(availableRepos) {
+    const list = availableRepos.length > 0 ? availableRepos.join(", ") : "(none configured)";
+    super(`--repos or --workspace is required. Available repos: ${list}. Pick the subset you actually want \u2014 implicit "all repos" was removed to prevent accidental multi-repo bootstraps.`);
+    this.availableRepos = availableRepos;
+    this.name = "RepoSelectionRequiredError";
+  }
+};
 function buildManifestRuntime(worldId, repos) {
   const runtimeRepos = [];
   for (const repo of repos) {
@@ -30380,7 +30536,7 @@ var WorldManager = class {
       }
     }
     const worldId = generateWorldId();
-    const workspacePath = path18.join(os8.homedir(), ".olam", "worlds", worldId);
+    const workspacePath = path19.join(os8.homedir(), ".olam", "worlds", worldId);
     const portOffset = this.registry.getNextPortOffset();
     const branch = opts.branchName ?? `olam/${worldId}`;
     const repos = this.resolveReposWithWorkspace(opts);
@@ -30437,37 +30593,37 @@ var WorldManager = class {
       if (!repo.path)
         continue;
       const sourceRoot = repo.path.replace(/^~/, os8.homedir());
-      const worktreeRoot = path18.join(workspacePath, repo.name);
-      if (!fs14.existsSync(sourceRoot) || !fs14.existsSync(worktreeRoot))
+      const worktreeRoot = path19.join(workspacePath, repo.name);
+      if (!fs15.existsSync(sourceRoot) || !fs15.existsSync(worktreeRoot))
         continue;
       let copied = 0;
       for (const pattern of RUNTIME_FILE_PATTERNS) {
         const matches2 = [];
         if (pattern.includes("*")) {
-          const [dir, glob] = [path18.dirname(pattern), path18.basename(pattern)];
-          const sourceDir = path18.join(sourceRoot, dir);
-          if (fs14.existsSync(sourceDir)) {
+          const [dir, glob] = [path19.dirname(pattern), path19.basename(pattern)];
+          const sourceDir = path19.join(sourceRoot, dir);
+          if (fs15.existsSync(sourceDir)) {
             const ext = glob.replace(/^\*+/, "");
             try {
-              for (const entry of fs14.readdirSync(sourceDir)) {
+              for (const entry of fs15.readdirSync(sourceDir)) {
                 if (ext === "" || entry.endsWith(ext))
-                  matches2.push(path18.join(dir, entry));
+                  matches2.push(path19.join(dir, entry));
               }
             } catch {
             }
           }
-        } else if (fs14.existsSync(path18.join(sourceRoot, pattern))) {
+        } else if (fs15.existsSync(path19.join(sourceRoot, pattern))) {
           matches2.push(pattern);
         }
         for (const rel of matches2) {
-          const src = path18.join(sourceRoot, rel);
-          const dst = path18.join(worktreeRoot, rel);
+          const src = path19.join(sourceRoot, rel);
+          const dst = path19.join(worktreeRoot, rel);
           try {
-            const st = fs14.statSync(src);
+            const st = fs15.statSync(src);
             if (!st.isFile())
               continue;
-            fs14.mkdirSync(path18.dirname(dst), { recursive: true });
-            fs14.copyFileSync(src, dst);
+            fs15.mkdirSync(path19.dirname(dst), { recursive: true });
+            fs15.copyFileSync(src, dst);
             copied++;
           } catch {
           }
@@ -30567,7 +30723,7 @@ var WorldManager = class {
       try {
         const hostExec = makeHostExecFn();
         for (const repo of repos) {
-          const repoDir = path18.join(workspacePath, repo.name);
+          const repoDir = path19.join(workspacePath, repo.name);
           if (repo.stack && Object.keys(repo.stack).length > 0) {
             preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
           } else {
@@ -30624,10 +30780,10 @@ var WorldManager = class {
       const worldEnv = {};
       if (opts.task)
         worldEnv.OLAM_TASK = opts.task;
-      const r2CredsPath = path18.join(os8.homedir(), ".olam", "r2-credentials.json");
-      if (fs14.existsSync(r2CredsPath)) {
+      const r2CredsPath = path19.join(os8.homedir(), ".olam", "r2-credentials.json");
+      if (fs15.existsSync(r2CredsPath)) {
         try {
-          const r2Raw = fs14.readFileSync(r2CredsPath, "utf-8").trim();
+          const r2Raw = fs15.readFileSync(r2CredsPath, "utf-8").trim();
           if (r2Raw.length > 0) {
             const r2 = JSON.parse(r2Raw);
             if (typeof r2.account_id === "string")
@@ -30644,10 +30800,10 @@ var WorldManager = class {
         } catch {
         }
       }
-      const keysYamlPath = path18.join(os8.homedir(), ".olam", "keys.yaml");
-      if (fs14.existsSync(keysYamlPath)) {
+      const keysYamlPath = path19.join(os8.homedir(), ".olam", "keys.yaml");
+      if (fs15.existsSync(keysYamlPath)) {
         try {
-          const keysRaw = fs14.readFileSync(keysYamlPath, "utf-8").trim();
+          const keysRaw = fs15.readFileSync(keysYamlPath, "utf-8").trim();
           if (keysRaw.length > 0) {
             const parsed = YAML3.parse(keysRaw);
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -30694,10 +30850,10 @@ var WorldManager = class {
             worldEnv[k] = v;
         }
         for (const { repoName, relativePath, content } of fileWrites) {
-          const absPath = path18.join(workspacePath, repoName, relativePath);
+          const absPath = path19.join(workspacePath, repoName, relativePath);
           try {
-            fs14.mkdirSync(path18.dirname(absPath), { recursive: true });
-            fs14.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+            fs15.mkdirSync(path19.dirname(absPath), { recursive: true });
+            fs15.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
               mode: 384
             });
             console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -30849,7 +31005,7 @@ var WorldManager = class {
         let taskWithPolicies = opts.task;
         try {
           const allPolicies = repos.flatMap((repo) => {
-            const repoWorktree = path18.join(workspacePath, repo.name);
+            const repoWorktree = path19.join(workspacePath, repo.name);
             return loadPolicies(repoWorktree);
           });
           const seen = /* @__PURE__ */ new Set();
@@ -30865,8 +31021,8 @@ var WorldManager = class {
 ${opts.task}`;
             execSync4(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
             for (const repo of repos) {
-              const policiesDir = path18.join(workspacePath, repo.name, ".olam", "policies");
-              if (fs14.existsSync(policiesDir)) {
+              const policiesDir = path19.join(workspacePath, repo.name, ".olam", "policies");
+              if (fs15.existsSync(policiesDir)) {
                 execSync4(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
               }
             }
@@ -30945,8 +31101,8 @@ ${opts.task}`;
     } catch {
     }
     try {
-      fs14.rmSync(world.workspacePath, { recursive: true, force: true });
-      if (fs14.existsSync(world.workspacePath)) {
+      fs15.rmSync(world.workspacePath, { recursive: true, force: true });
+      if (fs15.existsSync(world.workspacePath)) {
         console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
       }
     } catch (err) {
@@ -31001,7 +31157,10 @@ ${opts.task}`;
    * Resolution precedence (matches the CF worker exactly):
    *   1. inline `opts.repos` names → look up in `config.repos`
    *   2. named `opts.workspace` → load catalog YAML, map via workspaceToRepoConfigs
-   *   3. fallback → every repo declared in the project's config.yaml
+   *   3. neither → throw `RepoSelectionRequiredError`. The historical
+   *      "include every repo in config.yaml" fallback silently fanned a
+   *      single-repo audit into 7-repo bootstraps and steered
+   *      `image_selectors` to a wider tag than intended.
    */
   resolveReposWithWorkspace(opts) {
     if (opts.repos && opts.repos.length > 0) {
@@ -31013,7 +31172,7 @@ ${opts.task}`;
         throw new WorkspaceNotFoundError(opts.workspace);
       return workspaceToRepoConfigs(ws);
     }
-    return this.resolveRepos(void 0);
+    throw new RepoSelectionRequiredError(this.config.repos.map((r) => r.name));
   }
   resolveRepos(repoNames) {
     if (!repoNames || repoNames.length === 0) {
@@ -31031,14 +31190,14 @@ ${opts.task}`;
     return names.map((name) => this.config.repos.find((r) => r.name === name)).filter((r) => r !== void 0);
   }
   transportPlanFile(planFilePath, workspacePath, repoNames) {
-    const planContent = fs14.readFileSync(planFilePath, "utf-8");
-    const planFileName = path18.basename(planFilePath);
+    const planContent = fs15.readFileSync(planFilePath, "utf-8");
+    const planFileName = path19.basename(planFilePath);
     const targetRepo = repoNames[0];
     if (!targetRepo)
       return;
-    const plansDir = path18.join(workspacePath, targetRepo, "docs", "plans");
-    fs14.mkdirSync(plansDir, { recursive: true });
-    fs14.writeFileSync(path18.join(plansDir, planFileName), planContent);
+    const plansDir = path19.join(workspacePath, targetRepo, "docs", "plans");
+    fs15.mkdirSync(plansDir, { recursive: true });
+    fs15.writeFileSync(path19.join(plansDir, planFileName), planContent);
   }
   resolveServices(repos) {
     const services = [];
@@ -31123,8 +31282,8 @@ import * as http2 from "node:http";
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs15 from "node:fs";
-import * as path19 from "node:path";
+import * as fs16 from "node:fs";
+import * as path20 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../core/dist/dashboard/serialize.js
@@ -31459,7 +31618,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs15.existsSync(dbPath))
+  if (!fs16.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -31630,13 +31789,13 @@ function findSessionInWorld(registry2, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port, registry: registry2 } = opts;
-  const thisDir = path19.dirname(fileURLToPath2(import.meta.url));
-  const defaultPublicDir = path19.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path20.dirname(fileURLToPath2(import.meta.url));
+  const defaultPublicDir = path20.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs15.existsSync(publicDir);
+  let hasPublicDir = fs16.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs15.existsSync(publicDir);
+      hasPublicDir = fs16.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port}`;
     const url = new URL(req.url ?? "/", `http://${host}`);
@@ -31910,22 +32069,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path19.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path20.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs15.existsSync(filePath) && fs15.statSync(filePath).isFile()) {
-      const ext = path19.extname(filePath);
+    if (fs16.existsSync(filePath) && fs16.statSync(filePath).isFile()) {
+      const ext = path20.extname(filePath);
       const contentType = MIME[ext] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs15.createReadStream(filePath).pipe(res);
+      fs16.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path19.join(publicDir, "index.html");
-    if (fs15.existsSync(filePath)) {
+    filePath = path20.join(publicDir, "index.html");
+    if (fs16.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs15.createReadStream(filePath).pipe(res);
+      fs16.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -31935,17 +32094,17 @@ function createDashboardServer(opts) {
 }
 
 // ../core/dist/dashboard/state.js
-import * as fs16 from "node:fs";
+import * as fs17 from "node:fs";
 import * as os9 from "node:os";
-import * as path20 from "node:path";
-var STATE_PATH = path20.join(os9.homedir(), ".olam", "dashboard.json");
+import * as path21 from "node:path";
+var STATE_PATH = path21.join(os9.homedir(), ".olam", "dashboard.json");
 function saveDashboardState(state) {
-  fs16.mkdirSync(path20.dirname(STATE_PATH), { recursive: true });
-  fs16.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs17.mkdirSync(path21.dirname(STATE_PATH), { recursive: true });
+  fs17.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs16.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs17.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -31953,7 +32112,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs16.unlinkSync(STATE_PATH);
+    fs17.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -32233,8 +32392,8 @@ var PleriClient = class {
 };
 
 // ../mcp-server/src/env-loader.ts
-import { readFileSync as readFileSync14, existsSync as existsSync17, statSync as statSync6 } from "node:fs";
-import { join as join23, dirname as dirname12, resolve as resolve5 } from "node:path";
+import { readFileSync as readFileSync15, existsSync as existsSync18, statSync as statSync6 } from "node:fs";
+import { join as join23, dirname as dirname13, resolve as resolve5 } from "node:path";
 var PROJECT_MARKERS = [
   ".olam/config.yaml",
   ".olam/config.yml",
@@ -32246,26 +32405,26 @@ function findProjectRoot2(startDir) {
   const root = resolve5("/");
   while (true) {
     for (const marker of PROJECT_MARKERS) {
-      if (existsSync17(join23(dir, marker))) return dir;
+      if (existsSync18(join23(dir, marker))) return dir;
     }
     const pkg = join23(dir, "package.json");
-    if (existsSync17(pkg)) {
+    if (existsSync18(pkg)) {
       try {
-        const json = JSON.parse(readFileSync14(pkg, "utf8"));
+        const json = JSON.parse(readFileSync15(pkg, "utf8"));
         const isOlamWorkspace = typeof json.name === "string" && json.name.startsWith("@olam/");
         const hasOlamDep = json.dependencies && Object.keys(json.dependencies).some((k) => k.startsWith("@olam/")) || json.devDependencies && Object.keys(json.devDependencies).some((k) => k.startsWith("@olam/"));
         if (isOlamWorkspace || hasOlamDep) return dir;
       } catch {
       }
     }
-    const parent = dirname12(dir);
+    const parent = dirname13(dir);
     if (parent === dir || parent === root) return null;
     dir = parent;
   }
 }
-function parseEnvFile(path21) {
+function parseEnvFile(path22) {
   const out = {};
-  const raw = readFileSync14(path21, "utf8");
+  const raw = readFileSync15(path22, "utf8");
   for (const line of raw.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -32289,7 +32448,7 @@ function loadProjectEnv(startDir = process.cwd()) {
   const merged = {};
   for (const name of [".env", ".env.local"]) {
     const p = join23(root, name);
-    if (existsSync17(p) && statSync6(p).isFile()) {
+    if (existsSync18(p) && statSync6(p).isFile()) {
       Object.assign(merged, parseEnvFile(p));
       filesRead.push(p);
     }