@pleri/olam-cli 0.1.50 → 0.1.52

package/dist/index.js

@@ -1,6 +1,12 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -454,8 +460,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path44, errorMaps, issueData } = params;
-      const fullPath = [...path44, ...issueData.path || []];
+      const { data, path: path45, errorMaps, issueData } = params;
+      const fullPath = [...path45, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -763,11 +769,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path44, key) {
+      constructor(parent, value, path45, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path44;
+        this._path = path45;
         this._key = key;
       }
       get path() {
@@ -4248,7 +4254,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path44, ctx, rejectSource) {
+function refineForbiddenKeys(value, path45, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4256,12 +4262,12 @@ function refineForbiddenKeys(value, path44, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path44, key],
+        path: [...path45, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path44.length === 0 && key === "source") {
+    if (rejectSource && path45.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4269,21 +4275,21 @@ function refineForbiddenKeys(value, path44, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path44, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path45, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path44, rejectSource) {
+function rejectForbiddenKeys(value, path45, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path44}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path45}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path44}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path45}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path44}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path45}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5224,8 +5230,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path44, body, attempt = 0) {
-        const url = `${this.baseUrl}${path44}`;
+      async request(method, path45, body, attempt = 0) {
+        const url = `${this.baseUrl}${path45}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5243,7 +5249,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path44, body, attempt + 1);
+            return this.request(method, path45, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -6722,8 +6728,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path44, method, body) {
-        const url = `${this.config.workerUrl}${path44}`;
+      async request(path45, method, body) {
+        const url = `${this.config.workerUrl}${path45}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -7437,14 +7443,25 @@ function generateHooksConfig(hookServerUrl = DEFAULT_HOOK_SERVER_URL) {
     hooks: {
       // Codex adversarial review — fires on every user prompt in-world
       // Uses $HOME so sanitizeContainerClaudeHooks does not strip it
-      UserPromptSubmit: [{
-        matcher: "",
-        hooks: [{
-          type: "command",
-          command: "$HOME/.claude/scripts/codex-on-prompt.sh",
-          timeout: 15
-        }]
-      }],
+      UserPromptSubmit: [
+        {
+          matcher: "",
+          hooks: [{
+            type: "command",
+            command: "$HOME/.claude/scripts/codex-on-prompt.sh",
+            timeout: 15
+          }]
+        },
+        // C02: surface first-call hint when MCP creds are missing
+        {
+          matcher: "",
+          hooks: [{
+            type: "command",
+            command: "node /opt/olam/scripts/mcp-status-hint.mjs",
+            timeout: 2
+          }]
+        }
+      ],
       // Tool execution events → high-frequency thought capture
       // Layer 1: Upstream Codex review (PreToolUse) — runs after thought capture
       PreToolUse: [
@@ -7502,87 +7519,192 @@ var init_hooks_config = __esm({
   }
 });
 
-// ../core/dist/world/env-setup.js
-import * as crypto2 from "node:crypto";
+// ../core/dist/world/merge-settings.js
 import * as fs12 from "node:fs";
-import * as os8 from "node:os";
 import * as path13 from "node:path";
+import * as crypto2 from "node:crypto";
+function mergeHomeSettingsJson(filePath, options) {
+  let settings;
+  try {
+    settings = readSettings(filePath);
+  } catch (err) {
+    throw new Error(`merge-settings: failed to parse existing settings.json: ${err?.message ?? err}`);
+  }
+  let changed = false;
+  if (options.ensureHook) {
+    const { stage, sentinel, entry } = options.ensureHook;
+    if (!settings.hooks || typeof settings.hooks !== "object") {
+      settings = { ...settings, hooks: {} };
+      changed = true;
+    }
+    const hooks = settings.hooks;
+    if (!Array.isArray(hooks[stage])) {
+      settings = {
+        ...settings,
+        hooks: { ...hooks, [stage]: [] }
+      };
+      changed = true;
+    }
+    const stageArr = settings.hooks[stage];
+    if (isHookSentinelPresent(stageArr, sentinel)) {
+      if (!changed) {
+        return { status: "already-present", message: `hook already present at ${filePath}` };
+      }
+    } else {
+      settings = {
+        ...settings,
+        hooks: {
+          ...settings.hooks,
+          [stage]: [...stageArr, entry]
+        }
+      };
+      changed = true;
+    }
+  }
+  if (options.env) {
+    const existingEnv = settings.env && typeof settings.env === "object" ? settings.env : {};
+    const mergedEnv = { ...existingEnv, ...options.env };
+    const sameKeys = Object.keys(mergedEnv).length === Object.keys(existingEnv).length && Object.keys(mergedEnv).every((k) => existingEnv[k] === mergedEnv[k]);
+    if (!sameKeys) {
+      settings = { ...settings, env: mergedEnv };
+      changed = true;
+    }
+  }
+  if (!changed) {
+    return { status: "no-op", message: `no change needed at ${filePath}` };
+  }
+  try {
+    atomicWriteJson(filePath, settings);
+  } catch (err) {
+    throw new Error(`merge-settings: failed to write settings.json: ${err?.message ?? err}`);
+  }
+  return { status: "installed", message: `settings.json updated at ${filePath}` };
+}
+function readSettings(filePath) {
+  if (!fs12.existsSync(filePath)) {
+    return {};
+  }
+  const raw = fs12.readFileSync(filePath, "utf-8");
+  if (!raw.trim())
+    return {};
+  return JSON.parse(raw);
+}
+function isHookSentinelPresent(matchers, sentinel) {
+  for (const matcher of matchers) {
+    if (typeof matcher?.command === "string" && matcher.command.includes(sentinel)) {
+      return true;
+    }
+    if (Array.isArray(matcher?.hooks)) {
+      for (const h of matcher.hooks) {
+        if (typeof h?.command === "string" && h.command.includes(sentinel)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function atomicWriteJson(filePath, data) {
+  const dir = path13.dirname(filePath);
+  fs12.mkdirSync(dir, { recursive: true });
+  const rand = crypto2.randomBytes(6).toString("hex");
+  const tmp = `${filePath}.tmp.${process.pid}.${rand}`;
+  const json = JSON.stringify(data, null, 2) + "\n";
+  fs12.writeFileSync(tmp, json, { mode: 420 });
+  fs12.renameSync(tmp, filePath);
+}
+var init_merge_settings = __esm({
+  "../core/dist/world/merge-settings.js"() {
+    "use strict";
+  }
+});
+
+// ../core/dist/world/env-setup.js
+import * as crypto3 from "node:crypto";
+import * as fs13 from "node:fs";
+import * as os8 from "node:os";
+import * as path14 from "node:path";
 import { globSync } from "node:fs";
 function copyClaudeConfig(workspacePath, homeDir, configCtx) {
-  const sourceClaudeDir = path13.join(homeDir ?? os8.homedir(), ".claude");
-  const destClaudeDir = path13.join(workspacePath, ".claude-host-config");
+  const sourceClaudeDir = path14.join(homeDir ?? os8.homedir(), ".claude");
+  const destClaudeDir = path14.join(workspacePath, ".claude-host-config");
   void configCtx;
-  if (!fs12.existsSync(sourceClaudeDir))
+  if (!fs13.existsSync(sourceClaudeDir))
     return;
-  fs12.mkdirSync(destClaudeDir, { recursive: true });
-  const settingsPath = path13.join(sourceClaudeDir, "settings.json");
+  fs13.mkdirSync(destClaudeDir, { recursive: true });
+  const settingsPath = path14.join(sourceClaudeDir, "settings.json");
   let settings = {};
-  if (fs12.existsSync(settingsPath)) {
+  if (fs13.existsSync(settingsPath)) {
     try {
-      settings = JSON.parse(fs12.readFileSync(settingsPath, "utf-8"));
+      settings = JSON.parse(fs13.readFileSync(settingsPath, "utf-8"));
       delete settings["hooks"];
     } catch {
     }
   }
   const hooksConfig = generateHooksConfig(DEFAULT_HOOK_SERVER_URL);
   settings["hooks"] = hooksConfig["hooks"];
-  fs12.writeFileSync(path13.join(destClaudeDir, "settings.json"), JSON.stringify(settings, null, 2));
-  const claudeMdPath = path13.join(sourceClaudeDir, "CLAUDE.md");
-  if (fs12.existsSync(claudeMdPath)) {
-    fs12.copyFileSync(claudeMdPath, path13.join(destClaudeDir, "CLAUDE.md"));
+  fs13.writeFileSync(path14.join(destClaudeDir, "settings.json"), JSON.stringify(settings, null, 2));
+  const claudeMdPath = path14.join(sourceClaudeDir, "CLAUDE.md");
+  if (fs13.existsSync(claudeMdPath)) {
+    fs13.copyFileSync(claudeMdPath, path14.join(destClaudeDir, "CLAUDE.md"));
   }
-  const rulesDir = path13.join(sourceClaudeDir, "rules");
-  if (fs12.existsSync(rulesDir)) {
-    copyDirRecursive(rulesDir, path13.join(destClaudeDir, "rules"));
+  const rulesDir = path14.join(sourceClaudeDir, "rules");
+  if (fs13.existsSync(rulesDir)) {
+    copyDirRecursive(rulesDir, path14.join(destClaudeDir, "rules"));
   }
-  const agentsDir = path13.join(sourceClaudeDir, "agents");
-  if (fs12.existsSync(agentsDir)) {
-    copyDirRecursive(agentsDir, path13.join(destClaudeDir, "agents"));
+  const agentsDir = path14.join(sourceClaudeDir, "agents");
+  if (fs13.existsSync(agentsDir)) {
+    copyDirRecursive(agentsDir, path14.join(destClaudeDir, "agents"));
   }
-  const pluginsDir = path13.join(sourceClaudeDir, "plugins");
-  if (fs12.existsSync(pluginsDir)) {
-    copyDirRecursive(pluginsDir, path13.join(destClaudeDir, "plugins"), 0, SKIP_FILES);
+  const pluginsDir = path14.join(sourceClaudeDir, "plugins");
+  if (fs13.existsSync(pluginsDir)) {
+    copyDirRecursive(pluginsDir, path14.join(destClaudeDir, "plugins"), 0, SKIP_FILES);
   }
-  const skillsDir = path13.join(sourceClaudeDir, "skills");
-  if (fs12.existsSync(skillsDir)) {
-    copyDirRecursive(skillsDir, path13.join(destClaudeDir, "skills"));
+  const skillsDir = path14.join(sourceClaudeDir, "skills");
+  if (fs13.existsSync(skillsDir)) {
+    copyDirRecursive(skillsDir, path14.join(destClaudeDir, "skills"));
   }
-  const scriptsDir = path13.join(sourceClaudeDir, "scripts");
-  if (fs12.existsSync(scriptsDir)) {
-    copyDirRecursive(scriptsDir, path13.join(destClaudeDir, "scripts"));
+  const scriptsDir = path14.join(sourceClaudeDir, "scripts");
+  if (fs13.existsSync(scriptsDir)) {
+    copyDirRecursive(scriptsDir, path14.join(destClaudeDir, "scripts"));
   }
   applyProjectClaudeOverlay(workspacePath, destClaudeDir);
   writeStrippedMcpServersSnapshot(homeDir ?? os8.homedir(), workspacePath, destClaudeDir);
+  if (configCtx != null && configCtx.worlds_default?.agent_teams_enabled !== false) {
+    mergeHomeSettingsJson(path14.join(destClaudeDir, "settings.json"), {
+      env: { CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: "1" }
+    });
+  }
 }
 function applyProjectClaudeOverlay(workspacePath, destClaudeDir) {
-  const projectClaudeDir = path13.join(workspacePath, ".claude");
-  if (!fs12.existsSync(projectClaudeDir))
+  const projectClaudeDir = path14.join(workspacePath, ".claude");
+  if (!fs13.existsSync(projectClaudeDir))
     return;
-  const projectSettingsPath = path13.join(projectClaudeDir, "settings.json");
-  const destSettingsPath = path13.join(destClaudeDir, "settings.json");
-  if (fs12.existsSync(projectSettingsPath)) {
+  const projectSettingsPath = path14.join(projectClaudeDir, "settings.json");
+  const destSettingsPath = path14.join(destClaudeDir, "settings.json");
+  if (fs13.existsSync(projectSettingsPath)) {
     try {
-      const projectSettings = JSON.parse(fs12.readFileSync(projectSettingsPath, "utf-8"));
+      const projectSettings = JSON.parse(fs13.readFileSync(projectSettingsPath, "utf-8"));
       delete projectSettings["hooks"];
-      const existing = fs12.existsSync(destSettingsPath) ? JSON.parse(fs12.readFileSync(destSettingsPath, "utf-8")) : {};
+      const existing = fs13.existsSync(destSettingsPath) ? JSON.parse(fs13.readFileSync(destSettingsPath, "utf-8")) : {};
       const merged = { ...existing, ...projectSettings, hooks: existing["hooks"] };
-      fs12.writeFileSync(destSettingsPath, JSON.stringify(merged, null, 2));
+      fs13.writeFileSync(destSettingsPath, JSON.stringify(merged, null, 2));
     } catch {
     }
   }
-  const projectClaudeMd = path13.join(projectClaudeDir, "CLAUDE.md");
-  if (fs12.existsSync(projectClaudeMd)) {
-    fs12.copyFileSync(projectClaudeMd, path13.join(destClaudeDir, "CLAUDE.md"));
+  const projectClaudeMd = path14.join(projectClaudeDir, "CLAUDE.md");
+  if (fs13.existsSync(projectClaudeMd)) {
+    fs13.copyFileSync(projectClaudeMd, path14.join(destClaudeDir, "CLAUDE.md"));
   }
-  const projectAgentsMd = path13.join(projectClaudeDir, "AGENTS.md");
-  if (fs12.existsSync(projectAgentsMd)) {
-    fs12.copyFileSync(projectAgentsMd, path13.join(destClaudeDir, "AGENTS.md"));
+  const projectAgentsMd = path14.join(projectClaudeDir, "AGENTS.md");
+  if (fs13.existsSync(projectAgentsMd)) {
+    fs13.copyFileSync(projectAgentsMd, path14.join(destClaudeDir, "AGENTS.md"));
   }
   for (const subdir of ["rules", "agents", "plugins", "skills", "scripts"]) {
-    const projectSubdir = path13.join(projectClaudeDir, subdir);
-    if (fs12.existsSync(projectSubdir)) {
+    const projectSubdir = path14.join(projectClaudeDir, subdir);
+    if (fs13.existsSync(projectSubdir)) {
       const skip = subdir === "plugins" ? SKIP_FILES : /* @__PURE__ */ new Set();
-      copyDirRecursive(projectSubdir, path13.join(destClaudeDir, subdir), 0, skip);
+      copyDirRecursive(projectSubdir, path14.join(destClaudeDir, subdir), 0, skip);
     }
   }
 }
@@ -7612,8 +7734,8 @@ function stripMcpServers(mcpServers) {
   return out;
 }
 function writeStrippedMcpServersSnapshot(homeDir, workspacePath, destClaudeDir) {
-  const hostMcpServers = readMcpServersFromFile(path13.join(homeDir, ".claude.json"));
-  const projectMcpServers = readMcpServersFromFile(path13.join(workspacePath, ".mcp.json"));
+  const hostMcpServers = readMcpServersFromFile(path14.join(homeDir, ".claude.json"));
+  const projectMcpServers = readMcpServersFromFile(path14.join(workspacePath, ".mcp.json"));
   if (Object.keys(hostMcpServers).length === 0 && Object.keys(projectMcpServers).length === 0) {
     return;
   }
@@ -7622,11 +7744,11 @@ function writeStrippedMcpServersSnapshot(homeDir, workspacePath, destClaudeDir)
     ...stripMcpServers(projectMcpServers)
   };
   const output = { mcpServers: stripped };
-  fs12.writeFileSync(path13.join(destClaudeDir, ".claude.json"), JSON.stringify(output, null, 2), { mode: 384 });
+  fs13.writeFileSync(path14.join(destClaudeDir, ".claude.json"), JSON.stringify(output, null, 2), { mode: 384 });
 }
 function writeWorldEntitlementsJson(workspacePath, configCtx) {
-  const olamDir = path13.join(workspacePath, ".olam");
-  fs12.mkdirSync(olamDir, { recursive: true });
+  const olamDir = path14.join(workspacePath, ".olam");
+  fs13.mkdirSync(olamDir, { recursive: true });
   const resolvedRepos = configCtx.repos.map((repo) => {
     const repoEntitlement = repo;
     return {
@@ -7640,14 +7762,14 @@ function writeWorldEntitlementsJson(workspacePath, configCtx) {
     worlds_default: configCtx.worlds_default,
     repos: resolvedRepos
   };
-  const filePath = path13.join(olamDir, "world-entitlements.json");
-  fs12.writeFileSync(filePath, JSON.stringify(resolved, null, 2), { mode: 420 });
+  const filePath = path14.join(olamDir, "world-entitlements.json");
+  fs13.writeFileSync(filePath, JSON.stringify(resolved, null, 2), { mode: 420 });
 }
 function readMcpServersFromFile(filePath) {
-  if (!fs12.existsSync(filePath))
+  if (!fs13.existsSync(filePath))
     return {};
   try {
-    const raw = fs12.readFileSync(filePath, "utf-8");
+    const raw = fs13.readFileSync(filePath, "utf-8");
     if (!raw.trim())
       return {};
     const parsed = JSON.parse(raw);
@@ -7662,8 +7784,8 @@ function readMcpServersFromFile(filePath) {
 function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new Set()) {
   if (depth > 10)
     return;
-  fs12.mkdirSync(dest, { recursive: true });
-  for (const entry of fs12.readdirSync(src, { withFileTypes: true })) {
+  fs13.mkdirSync(dest, { recursive: true });
+  for (const entry of fs13.readdirSync(src, { withFileTypes: true })) {
     const { name } = entry;
     if (skipFiles.has(name))
       continue;
@@ -7673,12 +7795,12 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
       continue;
     if (entry.isDirectory() && SKIP_DIRS.has(name))
       continue;
-    const srcPath = path13.join(src, name);
-    const destPath = path13.join(dest, name);
+    const srcPath = path14.join(src, name);
+    const destPath = path14.join(dest, name);
     if (entry.isSymbolicLink()) {
       let stat;
       try {
-        stat = fs12.statSync(srcPath);
+        stat = fs13.statSync(srcPath);
       } catch {
         continue;
       }
@@ -7687,12 +7809,12 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
           continue;
         copyDirRecursive(srcPath, destPath, depth + 1, skipFiles);
       } else if (stat.isFile()) {
-        fs12.copyFileSync(srcPath, destPath);
+        fs13.copyFileSync(srcPath, destPath);
       }
     } else if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath, depth + 1, skipFiles);
     } else {
-      fs12.copyFileSync(srcPath, destPath);
+      fs13.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -7830,9 +7952,9 @@ function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, conf
     }
   }
   for (const repo of repos) {
-    const worktreePath = path13.join(workspacePath, repo.name);
+    const worktreePath = path14.join(workspacePath, repo.name);
     const sourcePath = repo.path;
-    if (!sourcePath || !fs12.existsSync(worktreePath))
+    if (!sourcePath || !fs13.existsSync(worktreePath))
       continue;
     const envSetup = repo.env_setup;
     if (!envSetup)
@@ -7851,23 +7973,23 @@ function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, conf
   }
 }
 function copyMatchingFiles(sourcePath, destPath, pattern) {
-  const fullPattern = path13.join(sourcePath, pattern);
+  const fullPattern = path14.join(sourcePath, pattern);
   if (!pattern.includes("*")) {
-    const sourceFile = path13.join(sourcePath, pattern);
-    const destFile = path13.join(destPath, pattern);
-    if (fs12.existsSync(sourceFile)) {
-      fs12.mkdirSync(path13.dirname(destFile), { recursive: true });
-      fs12.copyFileSync(sourceFile, destFile);
+    const sourceFile = path14.join(sourcePath, pattern);
+    const destFile = path14.join(destPath, pattern);
+    if (fs13.existsSync(sourceFile)) {
+      fs13.mkdirSync(path14.dirname(destFile), { recursive: true });
+      fs13.copyFileSync(sourceFile, destFile);
     }
     return;
   }
   try {
     const matches2 = globSync(fullPattern);
     for (const match2 of matches2) {
-      const relative2 = path13.relative(sourcePath, match2);
-      const dest = path13.join(destPath, relative2);
-      fs12.mkdirSync(path13.dirname(dest), { recursive: true });
-      fs12.copyFileSync(match2, dest);
+      const relative2 = path14.relative(sourcePath, match2);
+      const dest = path14.join(destPath, relative2);
+      fs13.mkdirSync(path14.dirname(dest), { recursive: true });
+      fs13.copyFileSync(match2, dest);
     }
   } catch {
   }
@@ -7875,14 +7997,14 @@ function copyMatchingFiles(sourcePath, destPath, pattern) {
 function generateEnvFromExample(repoPath, overrides) {
   const exampleFiles = [".env.example", ".env.sample", ".env.local.example"];
   for (const exampleName of exampleFiles) {
-    const examplePath = path13.join(repoPath, exampleName);
-    if (!fs12.existsSync(examplePath))
+    const examplePath = path14.join(repoPath, exampleName);
+    if (!fs13.existsSync(examplePath))
       continue;
     const targetName = exampleName.replace(".example", "").replace(".sample", "");
-    const targetPath = path13.join(repoPath, targetName);
-    if (fs12.existsSync(targetPath))
+    const targetPath = path14.join(repoPath, targetName);
+    if (fs13.existsSync(targetPath))
       continue;
-    const template = fs12.readFileSync(examplePath, "utf-8");
+    const template = fs13.readFileSync(examplePath, "utf-8");
     const generated = template.split("\n").map((line) => {
       const match2 = /^([A-Z_][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match2) {
@@ -7893,13 +8015,13 @@ function generateEnvFromExample(repoPath, overrides) {
       }
       return line;
     }).join("\n");
-    fs12.writeFileSync(targetPath, generated);
+    fs13.writeFileSync(targetPath, generated);
   }
 }
 function applyEnvOverrides(repoPath, overrides) {
-  const envPath = path13.join(repoPath, ".env");
-  if (fs12.existsSync(envPath)) {
-    const existing = fs12.readFileSync(envPath, "utf-8");
+  const envPath = path14.join(repoPath, ".env");
+  if (fs13.existsSync(envPath)) {
+    const existing = fs13.readFileSync(envPath, "utf-8");
     const existingKeys = new Set(existing.split("\n").map((l) => l.split("=")[0]?.trim()).filter(Boolean));
     const additions = [];
     for (const [key, value] of Object.entries(overrides)) {
@@ -7908,7 +8030,7 @@ function applyEnvOverrides(repoPath, overrides) {
       }
     }
     if (additions.length > 0) {
-      fs12.appendFileSync(envPath, "\n# Olam injected\n" + additions.join("\n") + "\n");
+      fs13.appendFileSync(envPath, "\n# Olam injected\n" + additions.join("\n") + "\n");
     }
   }
 }
@@ -7917,6 +8039,7 @@ var init_env_setup = __esm({
   "../core/dist/world/env-setup.js"() {
     "use strict";
     init_hooks_config();
+    init_merge_settings();
     MCP_SERVER_ALLOWLIST = /* @__PURE__ */ new Set([
       "command",
       "args",
@@ -7980,9 +8103,9 @@ var init_env_setup = __esm({
 
 // ../core/dist/world/baseline-diff.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import * as fs13 from "node:fs";
+import * as fs14 from "node:fs";
 import * as os9 from "node:os";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 function expandHome(p, homedir22) {
   return p.replace(/^~(?=$|\/|\\)/, homedir22());
 }
@@ -8008,9 +8131,9 @@ ${stderr}`;
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
   const homedir22 = deps.homedir ?? (() => os9.homedir());
-  const baselineDir = path14.join(workspacePath, ".olam", "baseline");
+  const baselineDir = path15.join(workspacePath, ".olam", "baseline");
   try {
-    fs13.mkdirSync(baselineDir, { recursive: true });
+    fs14.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -8022,9 +8145,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path14.join(baselineDir, filename);
+    const outPath = path15.join(baselineDir, filename);
     const repoPath = expandHome(repo.path, homedir22);
-    if (!fs13.existsSync(repoPath)) {
+    if (!fs14.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -8091,7 +8214,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs13.writeFileSync(outPath, content);
+    fs14.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -8099,8 +8222,8 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path14.join(workspacePath, repo.name);
-    if (!fs13.existsSync(worktreePath))
+    const worktreePath = path15.join(workspacePath, repo.name);
+    if (!fs14.existsSync(worktreePath))
       continue;
     try {
       execFileSync3("git", ["checkout", "--", "."], {
@@ -8137,12 +8260,12 @@ var init_baseline_diff = __esm({
 });
 
 // ../core/dist/world/context-injection.js
-import * as fs14 from "node:fs";
-import * as path15 from "node:path";
+import * as fs15 from "node:fs";
+import * as path16 from "node:path";
 function injectWorldContext(opts) {
   const { world, task, linearTicketId, claudeMdExtra, taskContext, services, pleriPlaneUrl } = opts;
-  const claudeDir = path15.join(world.workspacePath, ".claude");
-  fs14.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir = path16.join(world.workspacePath, ".claude");
+  fs15.mkdirSync(claudeDir, { recursive: true });
   const sections = [];
   sections.push(`# Olam World: ${world.name}`);
   sections.push("");
@@ -8303,7 +8426,7 @@ function injectWorldContext(opts) {
     sections.push("");
   }
   const content = sections.join("\n");
-  fs14.writeFileSync(path15.join(claudeDir, "CLAUDE.md"), content);
+  fs15.writeFileSync(path16.join(claudeDir, "CLAUDE.md"), content);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -8317,9 +8440,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path15.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path16.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs14.existsSync(plansDir) && fs14.readdirSync(plansDir).length > 0;
+    return fs15.existsSync(plansDir) && fs15.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -8564,7 +8687,7 @@ var init_stack_install = __esm({
 
 // ../core/dist/world/stack-image.js
 import { execSync as execSync2 } from "node:child_process";
-import * as crypto3 from "node:crypto";
+import * as crypto4 from "node:crypto";
 function computeFingerprint(runtimes) {
   const parts = [];
   for (const [runtime, versions] of runtimes) {
@@ -8614,14 +8737,14 @@ function getBaseImageDigest() {
     cachedBaseDigest = digest.replace("sha256:", "").slice(0, 16);
     return cachedBaseDigest;
   } catch {
-    cachedBaseDigest = crypto3.createHash("sha256").update("unknown").digest("hex").slice(0, 16);
+    cachedBaseDigest = crypto4.createHash("sha256").update("unknown").digest("hex").slice(0, 16);
     return cachedBaseDigest;
   }
 }
 function sanitizeTag(raw) {
   let tag = raw.toLowerCase().replace(/[^a-z0-9._-]/g, "-");
   if (tag.length > MAX_TAG_LENGTH) {
-    const hash = crypto3.createHash("sha256").update(raw).digest("hex").slice(0, 12);
+    const hash = crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 12);
     tag = tag.slice(0, MAX_TAG_LENGTH - 13) + "_" + hash;
   }
   return tag;
@@ -9023,14 +9146,14 @@ var init_secrets_fetcher = __esm({
 });
 
 // ../core/dist/world/olam-yaml.js
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path16.join(workspacePath, repo.name);
+    const repoDir = path17.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -9051,8 +9174,8 @@ var init_olam_yaml = __esm({
 });
 
 // ../core/dist/policies/loader.js
-import * as fs15 from "node:fs";
-import * as path17 from "node:path";
+import * as fs16 from "node:fs";
+import * as path18 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function parseFrontmatter(content) {
   const match2 = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -9072,20 +9195,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path17.join(workspaceRoot, ".olam", "policies");
-  if (!fs15.existsSync(policiesDir))
+  const policiesDir = path18.join(workspaceRoot, ".olam", "policies");
+  if (!fs16.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs15.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs16.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path17.join(policiesDir, file);
+    const filePath = path18.join(policiesDir, file);
     try {
-      const content = fs15.readFileSync(filePath, "utf8");
+      const content = fs16.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -9249,6 +9372,7 @@ var manager_exports = {};
 __export(manager_exports, {
   AuthPreflightError: () => AuthPreflightError,
   BotIdentityError: () => BotIdentityError,
+  RepoSelectionRequiredError: () => RepoSelectionRequiredError,
   WorkspaceNotFoundError: () => WorkspaceNotFoundError,
   WorldManager: () => WorldManager,
   buildManifestRuntimeForTest: () => buildManifestRuntime,
@@ -9257,11 +9381,11 @@ __export(manager_exports, {
   planManifestPipeline: () => planManifestPipeline,
   runManifestRuntime: () => runManifestRuntime
 });
-import * as crypto4 from "node:crypto";
+import * as crypto5 from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
-import * as fs16 from "node:fs";
+import * as fs17 from "node:fs";
 import * as os10 from "node:os";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 import YAML3 from "yaml";
 function getTokenScopes(ghToken, _exec = execSync4) {
   try {
@@ -9343,12 +9467,42 @@ ${stderr.split("\n").slice(0, 3).join(" ")}`);
     dockerExec(`cd ${repoDir} && git checkout -b ${branch}`);
   }
   if (ghToken) {
+    const olamUserPresent = (() => {
+      try {
+        dockerExec(`id olam`);
+        return true;
+      } catch {
+        return false;
+      }
+    })();
+    if (!olamUserPresent) {
+      const imageName = (() => {
+        try {
+          const { execSync: execSync12 } = __require("node:child_process");
+          return execSync12(`docker inspect ${containerName} --format '{{.Config.Image}}'`, {
+            encoding: "utf8",
+            timeout: 5e3
+          }).trim() || "(unknown)";
+        } catch {
+          return "(unknown)";
+        }
+      })();
+      console.warn(`[world] gh auth setup skipped for ${containerName}: container has no \`olam\` user.
+         Image:    ${imageName}
+         Likely cause: corrupt local image, a custom devbox image without
+         the olam user (line 10 of devbox.Dockerfile), or NSS resolver
+         failure under cross-arch QEMU emulation.
+         Remedy:   docker rmi olam-devbox:latest && olam upgrade -y
+         (or set OLAM_DEVBOX_IMAGE to a known-good ref before \`olam create\`).
+         PR push from inside the world will not work until this is resolved.`);
+      return;
+    }
     let tokenWritten = false;
     try {
       dockerExec(`which gh || (sudo apt-get update -qq && sudo apt-get install -y -qq gh) 2>/dev/null`);
       dockerExec(`printf '%s' '${ghToken.replace(/'/g, "'\\''")}' > /tmp/.gh-token && chmod 600 /tmp/.gh-token`);
       tokenWritten = true;
-      dockerExec(`sudo chown olam:olam /home/olam/.config`);
+      dockerExec(`sudo chown olam:olam /home/olam/.config 2>/dev/null || true`);
       dockerExec(`gh auth login --with-token < /tmp/.gh-token`);
       dockerExec(`gh auth setup-git`);
     } catch (err) {
@@ -9570,7 +9724,7 @@ function buildManifestRuntime(worldId, repos) {
   }
   return { worldId, repos: runtimeRepos };
 }
-var BotIdentityError, ADJECTIVES, NOUNS, AuthPreflightError, WorkspaceNotFoundError, WorldManager;
+var BotIdentityError, ADJECTIVES, NOUNS, AuthPreflightError, WorkspaceNotFoundError, RepoSelectionRequiredError, WorldManager;
 var init_manager = __esm({
   "../core/dist/world/manager.js"() {
     "use strict";
@@ -9619,6 +9773,15 @@ var init_manager = __esm({
         this.name = "WorkspaceNotFoundError";
       }
     };
+    RepoSelectionRequiredError = class extends Error {
+      availableRepos;
+      constructor(availableRepos) {
+        const list = availableRepos.length > 0 ? availableRepos.join(", ") : "(none configured)";
+        super(`--repos or --workspace is required. Available repos: ${list}. Pick the subset you actually want \u2014 implicit "all repos" was removed to prevent accidental multi-repo bootstraps.`);
+        this.availableRepos = availableRepos;
+        this.name = "RepoSelectionRequiredError";
+      }
+    };
     WorldManager = class {
       config;
       provider;
@@ -9646,7 +9809,7 @@ var init_manager = __esm({
           }
         }
         const worldId = generateWorldId();
-        const workspacePath = path18.join(os10.homedir(), ".olam", "worlds", worldId);
+        const workspacePath = path19.join(os10.homedir(), ".olam", "worlds", worldId);
         const portOffset = this.registry.getNextPortOffset();
         const branch = opts.branchName ?? `olam/${worldId}`;
         const repos = this.resolveReposWithWorkspace(opts);
@@ -9703,37 +9866,37 @@ var init_manager = __esm({
           if (!repo.path)
             continue;
           const sourceRoot = repo.path.replace(/^~/, os10.homedir());
-          const worktreeRoot = path18.join(workspacePath, repo.name);
-          if (!fs16.existsSync(sourceRoot) || !fs16.existsSync(worktreeRoot))
+          const worktreeRoot = path19.join(workspacePath, repo.name);
+          if (!fs17.existsSync(sourceRoot) || !fs17.existsSync(worktreeRoot))
             continue;
           let copied = 0;
           for (const pattern of RUNTIME_FILE_PATTERNS) {
             const matches2 = [];
             if (pattern.includes("*")) {
-              const [dir, glob] = [path18.dirname(pattern), path18.basename(pattern)];
-              const sourceDir = path18.join(sourceRoot, dir);
-              if (fs16.existsSync(sourceDir)) {
+              const [dir, glob] = [path19.dirname(pattern), path19.basename(pattern)];
+              const sourceDir = path19.join(sourceRoot, dir);
+              if (fs17.existsSync(sourceDir)) {
                 const ext2 = glob.replace(/^\*+/, "");
                 try {
-                  for (const entry of fs16.readdirSync(sourceDir)) {
+                  for (const entry of fs17.readdirSync(sourceDir)) {
                     if (ext2 === "" || entry.endsWith(ext2))
-                      matches2.push(path18.join(dir, entry));
+                      matches2.push(path19.join(dir, entry));
                   }
                 } catch {
                 }
               }
-            } else if (fs16.existsSync(path18.join(sourceRoot, pattern))) {
+            } else if (fs17.existsSync(path19.join(sourceRoot, pattern))) {
               matches2.push(pattern);
             }
             for (const rel of matches2) {
-              const src = path18.join(sourceRoot, rel);
-              const dst = path18.join(worktreeRoot, rel);
+              const src = path19.join(sourceRoot, rel);
+              const dst = path19.join(worktreeRoot, rel);
               try {
-                const st = fs16.statSync(src);
+                const st = fs17.statSync(src);
                 if (!st.isFile())
                   continue;
-                fs16.mkdirSync(path18.dirname(dst), { recursive: true });
-                fs16.copyFileSync(src, dst);
+                fs17.mkdirSync(path19.dirname(dst), { recursive: true });
+                fs17.copyFileSync(src, dst);
                 copied++;
               } catch {
               }
@@ -9833,7 +9996,7 @@ var init_manager = __esm({
           try {
             const hostExec = makeHostExecFn();
             for (const repo of repos) {
-              const repoDir = path18.join(workspacePath, repo.name);
+              const repoDir = path19.join(workspacePath, repo.name);
               if (repo.stack && Object.keys(repo.stack).length > 0) {
                 preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
               } else {
@@ -9890,10 +10053,10 @@ var init_manager = __esm({
           const worldEnv = {};
           if (opts.task)
             worldEnv.OLAM_TASK = opts.task;
-          const r2CredsPath = path18.join(os10.homedir(), ".olam", "r2-credentials.json");
-          if (fs16.existsSync(r2CredsPath)) {
+          const r2CredsPath = path19.join(os10.homedir(), ".olam", "r2-credentials.json");
+          if (fs17.existsSync(r2CredsPath)) {
             try {
-              const r2Raw = fs16.readFileSync(r2CredsPath, "utf-8").trim();
+              const r2Raw = fs17.readFileSync(r2CredsPath, "utf-8").trim();
               if (r2Raw.length > 0) {
                 const r2 = JSON.parse(r2Raw);
                 if (typeof r2.account_id === "string")
@@ -9910,10 +10073,10 @@ var init_manager = __esm({
             } catch {
             }
           }
-          const keysYamlPath = path18.join(os10.homedir(), ".olam", "keys.yaml");
-          if (fs16.existsSync(keysYamlPath)) {
+          const keysYamlPath = path19.join(os10.homedir(), ".olam", "keys.yaml");
+          if (fs17.existsSync(keysYamlPath)) {
             try {
-              const keysRaw = fs16.readFileSync(keysYamlPath, "utf-8").trim();
+              const keysRaw = fs17.readFileSync(keysYamlPath, "utf-8").trim();
               if (keysRaw.length > 0) {
                 const parsed = YAML3.parse(keysRaw);
                 if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -9960,10 +10123,10 @@ var init_manager = __esm({
                 worldEnv[k] = v;
             }
             for (const { repoName, relativePath, content } of fileWrites) {
-              const absPath = path18.join(workspacePath, repoName, relativePath);
+              const absPath = path19.join(workspacePath, repoName, relativePath);
               try {
-                fs16.mkdirSync(path18.dirname(absPath), { recursive: true });
-                fs16.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+                fs17.mkdirSync(path19.dirname(absPath), { recursive: true });
+                fs17.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
                   mode: 384
                 });
                 console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -10115,7 +10278,7 @@ var init_manager = __esm({
             let taskWithPolicies = opts.task;
             try {
               const allPolicies = repos.flatMap((repo) => {
-                const repoWorktree = path18.join(workspacePath, repo.name);
+                const repoWorktree = path19.join(workspacePath, repo.name);
                 return loadPolicies(repoWorktree);
               });
               const seen = /* @__PURE__ */ new Set();
@@ -10131,8 +10294,8 @@ var init_manager = __esm({
 ${opts.task}`;
                 execSync4(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
                 for (const repo of repos) {
-                  const policiesDir = path18.join(workspacePath, repo.name, ".olam", "policies");
-                  if (fs16.existsSync(policiesDir)) {
+                  const policiesDir = path19.join(workspacePath, repo.name, ".olam", "policies");
+                  if (fs17.existsSync(policiesDir)) {
                     execSync4(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
                   }
                 }
@@ -10211,8 +10374,8 @@ ${opts.task}`;
         } catch {
         }
         try {
-          fs16.rmSync(world.workspacePath, { recursive: true, force: true });
-          if (fs16.existsSync(world.workspacePath)) {
+          fs17.rmSync(world.workspacePath, { recursive: true, force: true });
+          if (fs17.existsSync(world.workspacePath)) {
             console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
           }
         } catch (err) {
@@ -10267,7 +10430,10 @@ ${opts.task}`;
        * Resolution precedence (matches the CF worker exactly):
        *   1. inline `opts.repos` names → look up in `config.repos`
        *   2. named `opts.workspace` → load catalog YAML, map via workspaceToRepoConfigs
-       *   3. fallback → every repo declared in the project's config.yaml
+       *   3. neither → throw `RepoSelectionRequiredError`. The historical
+       *      "include every repo in config.yaml" fallback silently fanned a
+       *      single-repo audit into 7-repo bootstraps and steered
+       *      `image_selectors` to a wider tag than intended.
        */
       resolveReposWithWorkspace(opts) {
         if (opts.repos && opts.repos.length > 0) {
@@ -10279,7 +10445,7 @@ ${opts.task}`;
             throw new WorkspaceNotFoundError(opts.workspace);
           return workspaceToRepoConfigs(ws);
         }
-        return this.resolveRepos(void 0);
+        throw new RepoSelectionRequiredError(this.config.repos.map((r) => r.name));
       }
       resolveRepos(repoNames) {
         if (!repoNames || repoNames.length === 0) {
@@ -10297,14 +10463,14 @@ ${opts.task}`;
         return names.map((name) => this.config.repos.find((r) => r.name === name)).filter((r) => r !== void 0);
       }
       transportPlanFile(planFilePath, workspacePath, repoNames) {
-        const planContent = fs16.readFileSync(planFilePath, "utf-8");
-        const planFileName = path18.basename(planFilePath);
+        const planContent = fs17.readFileSync(planFilePath, "utf-8");
+        const planFileName = path19.basename(planFilePath);
         const targetRepo = repoNames[0];
         if (!targetRepo)
           return;
-        const plansDir = path18.join(workspacePath, targetRepo, "docs", "plans");
-        fs16.mkdirSync(plansDir, { recursive: true });
-        fs16.writeFileSync(path18.join(plansDir, planFileName), planContent);
+        const plansDir = path19.join(workspacePath, targetRepo, "docs", "plans");
+        fs17.mkdirSync(plansDir, { recursive: true });
+        fs17.writeFileSync(path19.join(plansDir, planFileName), planContent);
       }
       resolveServices(repos) {
         const services = [];
@@ -10397,9 +10563,9 @@ var init_tracker = __esm({
 });
 
 // ../core/dist/world-paths.js
-import * as path19 from "node:path";
+import * as path20 from "node:path";
 function getWorldDbPath(workspacePath) {
-  return path19.join(workspacePath, WORLD_DB_FILENAME);
+  return path20.join(workspacePath, WORLD_DB_FILENAME);
 }
 var WORLD_DB_FILENAME;
 var init_world_paths = __esm({
@@ -11017,8 +11183,8 @@ var init_session_aggregator = __esm({
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs17 from "node:fs";
-import * as path20 from "node:path";
+import * as fs18 from "node:fs";
+import * as path21 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function jsonResponse(res, data, status = 200) {
   res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
@@ -11029,7 +11195,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs17.existsSync(dbPath))
+  if (!fs18.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -11200,13 +11366,13 @@ function findSessionInWorld(registry, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port, registry } = opts;
-  const thisDir = path20.dirname(fileURLToPath2(import.meta.url));
-  const defaultPublicDir = path20.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path21.dirname(fileURLToPath2(import.meta.url));
+  const defaultPublicDir = path21.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs17.existsSync(publicDir);
+  let hasPublicDir = fs18.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs17.existsSync(publicDir);
+      hasPublicDir = fs18.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port}`;
     const url = new URL(req.url ?? "/", `http://${host}`);
@@ -11480,22 +11646,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path20.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path21.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs17.existsSync(filePath) && fs17.statSync(filePath).isFile()) {
-      const ext2 = path20.extname(filePath);
+    if (fs18.existsSync(filePath) && fs18.statSync(filePath).isFile()) {
+      const ext2 = path21.extname(filePath);
       const contentType = MIME[ext2] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs17.createReadStream(filePath).pipe(res);
+      fs18.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path20.join(publicDir, "index.html");
-    if (fs17.existsSync(filePath)) {
+    filePath = path21.join(publicDir, "index.html");
+    if (fs18.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs17.createReadStream(filePath).pipe(res);
+      fs18.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -11526,16 +11692,16 @@ var init_server = __esm({
 });
 
 // ../core/dist/dashboard/state.js
-import * as fs18 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os11 from "node:os";
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 function saveDashboardState(state) {
-  fs18.mkdirSync(path21.dirname(STATE_PATH), { recursive: true });
-  fs18.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs19.mkdirSync(path22.dirname(STATE_PATH), { recursive: true });
+  fs19.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs18.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs19.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -11543,7 +11709,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs18.unlinkSync(STATE_PATH);
+    fs19.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -11563,7 +11729,7 @@ var STATE_PATH;
 var init_state2 = __esm({
   "../core/dist/dashboard/state.js"() {
     "use strict";
-    STATE_PATH = path21.join(os11.homedir(), ".olam", "dashboard.json");
+    STATE_PATH = path22.join(os11.homedir(), ".olam", "dashboard.json");
   }
 });
 
@@ -11957,51 +12123,51 @@ __export(host_cp_exports, {
   writePid: () => writePid,
   writeToken: () => writeToken
 });
-import * as crypto5 from "node:crypto";
-import * as fs19 from "node:fs";
+import * as crypto6 from "node:crypto";
+import * as fs20 from "node:fs";
 import * as os12 from "node:os";
-import * as path22 from "node:path";
+import * as path23 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import Dockerode2 from "dockerode";
 function findComposeFile() {
   const candidates = [
     // Bundled path: dist/index.js lives at <pkg>/dist/; host-cp/ is a sibling of dist/
-    path22.resolve(path22.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
+    path23.resolve(path23.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
     // Source-mode: cwd is monorepo root
-    path22.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
+    path23.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
     // Source-mode: cwd is one level inside the monorepo
-    path22.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
+    path23.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
   ];
   for (const c of candidates) {
-    if (fs19.existsSync(c)) return c;
+    if (fs20.existsSync(c)) return c;
   }
-  return path22.resolve(process.cwd(), "packages/host-cp/compose.yaml");
+  return path23.resolve(process.cwd(), "packages/host-cp/compose.yaml");
 }
 function olamHome() {
-  return process.env.OLAM_HOME ?? path22.join(os12.homedir(), ".olam");
+  return process.env.OLAM_HOME ?? path23.join(os12.homedir(), ".olam");
 }
 function tokenPath() {
-  return path22.join(olamHome(), "host-cp.token");
+  return path23.join(olamHome(), "host-cp.token");
 }
 function pidPath() {
-  return path22.join(olamHome(), "host-cp.pid");
+  return path23.join(olamHome(), "host-cp.pid");
 }
 function authSecretPath() {
-  return path22.join(olamHome(), "auth-secret");
+  return path23.join(olamHome(), "auth-secret");
 }
 function readAuthSecret2() {
   const filePath = authSecretPath();
-  if (!fs19.existsSync(filePath)) return null;
-  const raw = fs19.readFileSync(filePath, "utf-8").trim();
+  if (!fs20.existsSync(filePath)) return null;
+  const raw = fs20.readFileSync(filePath, "utf-8").trim();
   return raw.length > 0 ? raw : null;
 }
 function r2CredentialsPath() {
-  return path22.join(olamHome(), "r2-credentials.json");
+  return path23.join(olamHome(), "r2-credentials.json");
 }
 function readR2Credentials() {
   const filePath = r2CredentialsPath();
-  if (!fs19.existsSync(filePath)) return null;
-  const raw = fs19.readFileSync(filePath, "utf-8").trim();
+  if (!fs20.existsSync(filePath)) return null;
+  const raw = fs20.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = JSON.parse(raw);
@@ -12022,39 +12188,39 @@ function readR2Credentials() {
   }
 }
 function writeToken() {
-  const token = crypto5.randomBytes(32).toString("hex");
+  const token = crypto6.randomBytes(32).toString("hex");
   const filePath = tokenPath();
-  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
-  fs19.writeFileSync(filePath, token, { mode: 384 });
+  fs20.mkdirSync(path23.dirname(filePath), { recursive: true });
+  fs20.writeFileSync(filePath, token, { mode: 384 });
   return token;
 }
 function readToken() {
   const filePath = tokenPath();
-  if (!fs19.existsSync(filePath)) return null;
-  return fs19.readFileSync(filePath, "utf-8").trim();
+  if (!fs20.existsSync(filePath)) return null;
+  return fs20.readFileSync(filePath, "utf-8").trim();
 }
 function removeToken() {
   const filePath = tokenPath();
-  if (!fs19.existsSync(filePath)) return false;
-  fs19.unlinkSync(filePath);
+  if (!fs20.existsSync(filePath)) return false;
+  fs20.unlinkSync(filePath);
   return true;
 }
 function writePid(pid) {
   const filePath = pidPath();
-  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
-  fs19.writeFileSync(filePath, String(pid), { mode: 420 });
+  fs20.mkdirSync(path23.dirname(filePath), { recursive: true });
+  fs20.writeFileSync(filePath, String(pid), { mode: 420 });
 }
 function readPid() {
   const filePath = pidPath();
-  if (!fs19.existsSync(filePath)) return null;
-  const raw = fs19.readFileSync(filePath, "utf-8").trim();
+  if (!fs20.existsSync(filePath)) return null;
+  const raw = fs20.readFileSync(filePath, "utf-8").trim();
   const n = parseInt(raw, 10);
   return Number.isFinite(n) ? n : null;
 }
 function removePid() {
   const filePath = pidPath();
-  if (!fs19.existsSync(filePath)) return false;
-  fs19.unlinkSync(filePath);
+  if (!fs20.existsSync(filePath)) return false;
+  fs20.unlinkSync(filePath);
   return true;
 }
 async function findHostCpContainer() {
@@ -12213,7 +12379,7 @@ async function handleStart(opts) {
   }
   const token = writeToken();
   const composeFile = findComposeFile();
-  if (!fs19.existsSync(composeFile)) {
+  if (!fs20.existsSync(composeFile)) {
     printError(`compose.yaml not found at ${composeFile}. Run from the olam project root.`);
     removeToken();
     process.exitCode = 1;
@@ -12295,7 +12461,7 @@ async function stopHostCp() {
 }
 async function handleStop() {
   const composeFile = findComposeFile();
-  if (!fs19.existsSync(composeFile)) {
+  if (!fs20.existsSync(composeFile)) {
     printWarning(`compose.yaml not found at ${composeFile}. Cleaning up token + PID anyway.`);
     removeToken();
     removePid();
@@ -12323,13 +12489,13 @@ async function buildStatusReport() {
   const container = await findHostCpContainer();
   const health = await probeHealth();
   const tokenFile = tokenPath();
-  const tokenPresent = fs19.existsSync(tokenFile);
+  const tokenPresent = fs20.existsSync(tokenFile);
   let tokenModeOk = false;
   if (tokenPresent) {
-    const mode = fs19.statSync(tokenFile).mode & 511;
+    const mode = fs20.statSync(tokenFile).mode & 511;
     tokenModeOk = mode === 384;
   }
-  const pidPresent = fs19.existsSync(pidPath());
+  const pidPresent = fs20.existsSync(pidPath());
   let stack;
   if (!container) {
     stack = "not_started";
@@ -12417,13 +12583,13 @@ async function discoverWorldPort(worldId) {
 }
 async function readHostCpToken2() {
   const tp = tokenPath();
-  if (!fs19.existsSync(tp)) return null;
-  return fs19.readFileSync(tp, "utf-8").trim();
+  if (!fs20.existsSync(tp)) return null;
+  return fs20.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path44, body) {
+async function callHostCpProxy(method, worldId, path45, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path44}`;
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path45}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -12548,17 +12714,17 @@ __export(install_root_exports, {
   isDevMode: () => isDevMode,
   resolveBuildScript: () => resolveBuildScript
 });
-import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname13, join as join24, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { dirname as dirname14, join as join24, resolve as resolve6 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function installRoot(metaUrl = import.meta.url) {
   const here = fileURLToPath3(metaUrl);
-  return resolve6(dirname13(here), "..");
+  return resolve6(dirname14(here), "..");
 }
 function isDevMode(env = process.env, installRootDir = installRoot()) {
   if (env.OLAM_DEV !== "1") return false;
   const repoRoot = resolve6(installRootDir, "..", "..");
-  return existsSync18(join24(repoRoot, "packages")) && existsSync18(join24(repoRoot, "package.json"));
+  return existsSync19(join24(repoRoot, "packages")) && existsSync19(join24(repoRoot, "package.json"));
 }
 function resolveBuildScript(input) {
   const { scriptRelPath, env = process.env, installRootDir = installRoot() } = input;
@@ -12737,20 +12903,20 @@ var init_registry_allowlist = __esm({
 });
 
 // ../core/dist/world/world-yaml.js
-import * as fs21 from "node:fs";
-import * as path24 from "node:path";
+import * as fs22 from "node:fs";
+import * as path25 from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
 function writeWorldYaml(worldPath, data) {
-  const olamDir = path24.join(worldPath, ".olam");
-  fs21.mkdirSync(olamDir, { recursive: true });
-  fs21.writeFileSync(path24.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
+  const olamDir = path25.join(worldPath, ".olam");
+  fs22.mkdirSync(olamDir, { recursive: true });
+  fs22.writeFileSync(path25.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
 }
 function readWorldYaml(worldPath) {
-  const yamlPath = path24.join(worldPath, ".olam", "world.yaml");
-  if (!fs21.existsSync(yamlPath))
+  const yamlPath = path25.join(worldPath, ".olam", "world.yaml");
+  if (!fs22.existsSync(yamlPath))
     return null;
   try {
-    const raw = fs21.readFileSync(yamlPath, "utf-8");
+    const raw = fs22.readFileSync(yamlPath, "utf-8");
     const parsed = parseYaml4(raw);
     return WorldYamlSchema.parse(parsed);
   } catch {
@@ -12881,16 +13047,16 @@ __export(machine_schema_exports, {
   readMachineConfig: () => readMachineConfig,
   writeMachineConfig: () => writeMachineConfig
 });
-import * as fs35 from "node:fs";
-import * as path39 from "node:path";
+import * as fs36 from "node:fs";
+import * as path40 from "node:path";
 import * as os21 from "node:os";
 import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
 function readMachineConfig(configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  if (!fs35.existsSync(p))
+  if (!fs36.existsSync(p))
     return null;
   try {
-    const raw = fs35.readFileSync(p, "utf-8");
+    const raw = fs36.readFileSync(p, "utf-8");
     const parsed = parseYaml5(raw);
     return MachineConfigSchema.parse(parsed);
   } catch {
@@ -12899,8 +13065,8 @@ function readMachineConfig(configPath) {
 }
 function writeMachineConfig(config, configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  fs35.mkdirSync(path39.dirname(p), { recursive: true });
-  fs35.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
+  fs36.mkdirSync(path40.dirname(p), { recursive: true });
+  fs36.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
 }
 function initMachineConfig(opts = {}) {
   const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
@@ -12923,16 +13089,16 @@ var init_machine_schema = __esm({
       channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
       auto_update: external_exports.boolean().default(true),
       telemetry: external_exports.boolean().default(true),
-      worlds_dir: external_exports.string().default(() => path39.join(os21.homedir(), ".olam", "worlds"))
+      worlds_dir: external_exports.string().default(() => path40.join(os21.homedir(), ".olam", "worlds"))
     });
-    DEFAULT_CONFIG_PATH = path39.join(os21.homedir(), ".olam", "config.yaml");
+    DEFAULT_CONFIG_PATH = path40.join(os21.homedir(), ".olam", "config.yaml");
   }
 });
 
 // src/index.ts
 import { Command } from "commander";
-import * as fs39 from "node:fs";
-import * as path43 from "node:path";
+import * as fs40 from "node:fs";
+import * as path44 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/commands/init.ts
@@ -13309,9 +13475,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path44) {
-    super(`Archetype inheritance cycle detected: ${path44.join(" \u2192 ")} \u2192 ${path44[0] ?? "?"}`);
-    this.path = path44;
+  constructor(path45) {
+    super(`Archetype inheritance cycle detected: ${path45.join(" \u2192 ")} \u2192 ${path45[0] ?? "?"}`);
+    this.path = path45;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -13680,8 +13846,8 @@ async function runAuthStatus(getStatus) {
 init_output();
 init_host_cp();
 init_auth();
-import * as fs20 from "node:fs";
-import * as path23 from "node:path";
+import * as fs21 from "node:fs";
+import * as path24 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 import ora2 from "ora";
 import pc7 from "picocolors";
@@ -13692,20 +13858,20 @@ init_exit_codes();
 init_protocol_version();
 init_output();
 import { spawn as spawn2, spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
 import { join as join25 } from "node:path";
 import ora from "ora";
 import pc6 from "picocolors";
 function loadImageDigests(installRootDir = installRoot()) {
   const digestsPath = join25(installRootDir, "dist", "image-digests.json");
-  if (!existsSync19(digestsPath)) {
+  if (!existsSync20(digestsPath)) {
     throw new Error(
       `image-digests.json missing at ${digestsPath}. Re-run \`npm install -g @pleri/olam-cli@<version>\` to refresh the tarball.`
     );
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync15(digestsPath, "utf8"));
+    parsed = JSON.parse(readFileSync16(digestsPath, "utf8"));
   } catch (err) {
     throw new Error(`image-digests.json is not valid JSON: ${err.message}`);
   }
@@ -14005,8 +14171,8 @@ function parseAuthUpgradeOpts(raw) {
   };
 }
 function validateAuthRepoRoot(cwd) {
-  const marker = path23.join(cwd, "packages/auth-service/Dockerfile");
-  if (!fs20.existsSync(marker)) {
+  const marker = path24.join(cwd, "packages/auth-service/Dockerfile");
+  if (!fs21.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -14579,14 +14745,14 @@ ${pc8.dim("Next: olam create --name my-world")}`);
 // src/commands/create.ts
 init_manager();
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync22 } from "node:fs";
-import { dirname as dirname14, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { dirname as dirname15, resolve as resolve7 } from "node:path";
 import ora3 from "ora";
 import pc9 from "picocolors";
 
 // ../core/dist/world/devbox-freshness.js
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync21, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync22, statSync as statSync5 } from "node:fs";
 import { join as join27 } from "node:path";
 var DEFAULT_DEVBOX_IMAGE = "olam-devbox:latest";
 var DEVBOX_BAKED_SOURCES = [
@@ -14595,6 +14761,7 @@ var DEVBOX_BAKED_SOURCES = [
   "packages/control-plane/standalone/intelligence-bridge.mjs",
   "packages/control-plane/standalone/d1-sqlite-adapter.mjs",
   "packages/adapters/src/docker/scripts/fetch-creds.mjs",
+  "packages/adapters/src/docker/scripts/mcp-status-hint.mjs",
   "packages/adapters/src/docker/scripts/pr-gate-hook.mjs",
   "packages/adapters/src/docker/scripts/entrypoint.sh"
 ];
@@ -14654,9 +14821,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path44, mtimeMs } of result.newerSources) {
+  for (const { path: path45, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path44}  (modified ${when})`);
+    lines.push(`  \u2022 ${path45}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -14675,7 +14842,7 @@ function defaultDockerInspect(image) {
 }
 function defaultStatMtime(absPath) {
   try {
-    if (!existsSync21(absPath))
+    if (!existsSync22(absPath))
       return null;
     return statSync5(absPath).mtimeMs;
   } catch {
@@ -14815,15 +14982,15 @@ init_host_cp();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs40 } = await import("node:fs");
+    const { default: fs41 } = await import("node:fs");
     const { default: os24 } = await import("node:os");
-    const { default: path44 } = await import("node:path");
-    const tp = path44.join(
-      process.env.OLAM_HOME ?? path44.join(os24.homedir(), ".olam"),
+    const { default: path45 } = await import("node:path");
+    const tp = path45.join(
+      process.env.OLAM_HOME ?? path45.join(os24.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs40.existsSync(tp)) return null;
-    return fs40.readFileSync(tp, "utf-8").trim();
+    if (!fs41.existsSync(tp)) return null;
+    return fs41.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -15161,6 +15328,13 @@ ${pc9.cyan("Host CP UI:")} ${worldUrl}`);
       if (err instanceof AuthPreflightError) {
         printError(err.message);
         if (err.remedy) console.log(`  ${pc9.dim(err.remedy)}`);
+      } else if (err instanceof RepoSelectionRequiredError) {
+        printError(err.message);
+        if (err.availableRepos.length > 0) {
+          const example = err.availableRepos[0];
+          console.log(`  ${pc9.dim(`Example: olam create --name <name> --repos ${example} --task "<task>"`)}`);
+          console.log(`  ${pc9.dim('Or:      olam create --name <name> --workspace <workspace> --task "<task>"')}`);
+        }
       } else {
         printError(err instanceof Error ? err.message : String(err));
       }
@@ -15171,10 +15345,10 @@ ${pc9.cyan("Host CP UI:")} ${worldUrl}`);
 function resolveRepoRoot(start) {
   let cur = start;
   while (true) {
-    if (existsSync22(resolve7(cur, "packages")) && existsSync22(resolve7(cur, "package.json"))) {
+    if (existsSync23(resolve7(cur, "packages")) && existsSync23(resolve7(cur, "package.json"))) {
       return cur;
     }
-    const parent = dirname14(cur);
+    const parent = dirname15(cur);
     if (parent === cur) return start;
     cur = parent;
   }
@@ -15185,12 +15359,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs40 } = await import("node:fs");
+    const { default: fs41 } = await import("node:fs");
     const { default: os24 } = await import("node:os");
-    const { default: path44 } = await import("node:path");
-    const tp = path44.join(os24.homedir(), ".olam", "host-cp.token");
-    if (!fs40.existsSync(tp)) return null;
-    const raw = fs40.readFileSync(tp, "utf-8").trim();
+    const { default: path45 } = await import("node:path");
+    const tp = path45.join(os24.homedir(), ".olam", "host-cp.token");
+    if (!fs41.existsSync(tp)) return null;
+    const raw = fs41.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -15402,9 +15576,9 @@ function registerList(program2) {
 
 // src/commands/status.ts
 init_output();
-import * as fs22 from "node:fs";
+import * as fs23 from "node:fs";
 import * as os13 from "node:os";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 var CLI_VERSION2 = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
 var HOST_CP_PORT2 = 19e3;
 async function getMachineStatus(_probe, _loadCtx, _readToken) {
@@ -15434,14 +15608,14 @@ async function getMachineStatus(_probe, _loadCtx, _readToken) {
     }
   } catch {
   }
-  const manifestPath2 = path25.join(os13.homedir(), ".olam", "cache", "manifest.json");
+  const manifestPath2 = path26.join(os13.homedir(), ".olam", "cache", "manifest.json");
   let updateAvailable = null;
   let lastUpdateCheck = null;
-  if (fs22.existsSync(manifestPath2)) {
-    const mtime = fs22.statSync(manifestPath2).mtime;
+  if (fs23.existsSync(manifestPath2)) {
+    const mtime = fs23.statSync(manifestPath2).mtime;
     lastUpdateCheck = mtime.toISOString();
     try {
-      const manifest = JSON.parse(fs22.readFileSync(manifestPath2, "utf-8"));
+      const manifest = JSON.parse(fs23.readFileSync(manifestPath2, "utf-8"));
       const latest = manifest["version"];
       updateAvailable = latest !== void 0 && latest !== CLI_VERSION2;
     } catch {
@@ -15564,9 +15738,9 @@ function registerDestroy(program2) {
 // src/commands/clean.ts
 init_context();
 init_output();
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 import os14 from "node:os";
-import path26 from "node:path";
+import path27 from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 function registerClean(program2) {
   program2.command("clean").description("Reap orphan world filesystem state under ~/.olam/worlds/").option("--apply", "Actually delete the orphans (default is dry-run)", false).option(
@@ -15590,8 +15764,8 @@ async function runClean(opts) {
     printError(error?.message ?? "Olam is not configured. Run `olam init` first.");
     return 1;
   }
-  const worldsDir = path26.join(os14.homedir(), ".olam", "worlds");
-  if (!fs23.existsSync(worldsDir)) {
+  const worldsDir = path27.join(os14.homedir(), ".olam", "worlds");
+  if (!fs24.existsSync(worldsDir)) {
     if (opts.json) {
       process.stdout.write(`${JSON.stringify({ worldsDir, entries: [] })}
 `);
@@ -15606,8 +15780,8 @@ async function runClean(opts) {
   }
   const worktreeMap = collectWorktrees(worldsDir);
   const entries = [];
-  for (const id of fs23.readdirSync(worldsDir).sort()) {
-    const fullPath = path26.join(worldsDir, id);
+  for (const id of fs24.readdirSync(worldsDir).sort()) {
+    const fullPath = path27.join(worldsDir, id);
     const stat = safeStat(fullPath);
     if (!stat || !stat.isDirectory()) continue;
     entries.push(classifyWorld({ id, fullPath, liveIds, worktreeMap }));
@@ -15673,7 +15847,7 @@ function classifyWorld(args) {
   if (liveIds.has(id)) {
     return { id, path: fullPath, bytes, category: "active", note: "in registry" };
   }
-  const worktreeChild = path26.join(fullPath, "olam");
+  const worktreeChild = path27.join(fullPath, "olam");
   const worktreeInfo = worktreeMap.get(worktreeChild);
   if (worktreeInfo) {
     if (worktreeInfo.dirty > 0 || worktreeInfo.unpushed > 0) {
@@ -15719,20 +15893,20 @@ function reapEntry(entry) {
     }
   }
   try {
-    fs23.rmSync(entry.path, { recursive: true, force: true });
+    fs24.rmSync(entry.path, { recursive: true, force: true });
   } catch (err) {
     process.stderr.write(`  ! rm ${entry.path}: ${err instanceof Error ? err.message : String(err)}
 `);
     return false;
   }
-  return !fs23.existsSync(entry.path);
+  return !fs24.existsSync(entry.path);
 }
 function collectWorktrees(worldsDir) {
   const out = /* @__PURE__ */ new Map();
-  for (const id of fs23.readdirSync(worldsDir)) {
-    const child = path26.join(worldsDir, id, "olam");
-    const gitMarker = path26.join(child, ".git");
-    if (!fs23.existsSync(gitMarker)) continue;
+  for (const id of fs24.readdirSync(worldsDir)) {
+    const child = path27.join(worldsDir, id, "olam");
+    const gitMarker = path27.join(child, ".git");
+    if (!fs24.existsSync(gitMarker)) continue;
     const gitDir = resolveGitDirForWorktree(child);
     if (!gitDir) continue;
     const branch = readBranch(child);
@@ -15743,7 +15917,7 @@ function collectWorktrees(worldsDir) {
   return out;
 }
 function resolveGitDirForWorktree(worktreePath) {
-  const gitMarker = path26.join(worktreePath, ".git");
+  const gitMarker = path27.join(worktreePath, ".git");
   try {
     const top = execFileSync4("git", ["rev-parse", "--show-toplevel"], {
       cwd: worktreePath,
@@ -15757,7 +15931,7 @@ function resolveGitDirForWorktree(worktreePath) {
       stdio: "pipe"
     }).trim();
     if (!common) return top;
-    return path26.dirname(path26.resolve(worktreePath, common));
+    return path27.dirname(path27.resolve(worktreePath, common));
   } catch {
     return null;
   }
@@ -15800,7 +15974,7 @@ function countUnpushed(worktreePath) {
 }
 function safeStat(p) {
   try {
-    return fs23.statSync(p);
+    return fs24.statSync(p);
   } catch {
     return null;
   }
@@ -15812,7 +15986,7 @@ function computeBytes(p) {
     const cur = stack.pop();
     let st;
     try {
-      st = fs23.lstatSync(cur);
+      st = fs24.lstatSync(cur);
     } catch {
       continue;
     }
@@ -15820,11 +15994,11 @@ function computeBytes(p) {
     if (st.isDirectory()) {
       let entries;
       try {
-        entries = fs23.readdirSync(cur);
+        entries = fs24.readdirSync(cur);
       } catch {
         continue;
       }
-      for (const name of entries) stack.push(path26.join(cur, name));
+      for (const name of entries) stack.push(path27.join(cur, name));
     } else {
       total += st.size;
     }
@@ -16032,7 +16206,7 @@ init_context();
 init_output();
 init_exit_codes();
 init_world_paths();
-import * as fs24 from "node:fs";
+import * as fs25 from "node:fs";
 import "node:path";
 import ora6 from "ora";
 function registerCrystallize(program2, options = {}) {
@@ -16064,7 +16238,7 @@ function registerCrystallize(program2, options = {}) {
       return;
     }
     const thoughtDbPath = getWorldDbPath(world.workspacePath);
-    if (!fs24.existsSync(thoughtDbPath)) {
+    if (!fs25.existsSync(thoughtDbPath)) {
       printError(`No thoughts captured yet for "${worldId}". Run a dispatch first.`);
       process.exitCode = EXIT_GENERIC_ERROR;
       return;
@@ -17438,11 +17612,11 @@ var qmarksTestNoExtDot = ([$0]) => {
   return (f) => f.length === len && f !== "." && f !== "..";
 };
 var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path28 = {
+var path29 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep = defaultPlatform === "win32" ? path28.win32.sep : path28.posix.sep;
+var sep = defaultPlatform === "win32" ? path29.win32.sep : path29.posix.sep;
 minimatch.sep = sep;
 var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
@@ -18270,23 +18444,23 @@ function registerPolicyCheck(program2) {
 // src/commands/upgrade.ts
 init_output();
 init_host_cp();
-import * as fs27 from "node:fs";
-import * as path31 from "node:path";
+import * as fs28 from "node:fs";
+import * as path32 from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
 import ora7 from "ora";
 import pc16 from "picocolors";
 
 // src/commands/upgrade-lock.ts
-import * as fs25 from "node:fs";
+import * as fs26 from "node:fs";
 import * as os15 from "node:os";
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 import { spawnSync as spawnSync9 } from "node:child_process";
-var LOCK_FILE_PATH = path29.join(os15.homedir(), ".olam", ".upgrade.lock");
+var LOCK_FILE_PATH = path30.join(os15.homedir(), ".olam", ".upgrade.lock");
 var STALE_LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 function readLockFile(lockPath) {
   try {
-    if (!fs25.existsSync(lockPath)) return null;
-    const raw = fs25.readFileSync(lockPath, "utf-8").trim();
+    if (!fs26.existsSync(lockPath)) return null;
+    const raw = fs26.readFileSync(lockPath, "utf-8").trim();
     if (raw.length === 0) return null;
     const parsed = JSON.parse(raw);
     if (typeof parsed.pid !== "number" || typeof parsed.startTs !== "number") return null;
@@ -18331,16 +18505,16 @@ function isStaleLock(content, nowMs = Date.now()) {
   return false;
 }
 function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
-  const dir = path29.dirname(lockPath);
-  fs25.mkdirSync(dir, { recursive: true });
+  const dir = path30.dirname(lockPath);
+  fs26.mkdirSync(dir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = fs25.openSync(lockPath, "wx", 420);
+      const fd = fs26.openSync(lockPath, "wx", 420);
       try {
         const content = { pid: process.pid, startTs: nowMs };
-        fs25.writeSync(fd, JSON.stringify(content));
+        fs26.writeSync(fd, JSON.stringify(content));
       } finally {
-        fs25.closeSync(fd);
+        fs26.closeSync(fd);
       }
       return { acquired: true, lockPath };
     } catch (err) {
@@ -18349,7 +18523,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
       const existing2 = readLockFile(lockPath);
       if (isStaleLock(existing2, nowMs)) {
         try {
-          fs25.unlinkSync(lockPath);
+          fs26.unlinkSync(lockPath);
         } catch (unlinkErr) {
           const ucode = unlinkErr.code;
           if (ucode !== "ENOENT") throw unlinkErr;
@@ -18374,7 +18548,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
 }
 function releaseLock(lockPath = LOCK_FILE_PATH) {
   try {
-    fs25.unlinkSync(lockPath);
+    fs26.unlinkSync(lockPath);
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") throw err;
@@ -18392,19 +18566,19 @@ function formatRefusalMessage(result, lockPath = LOCK_FILE_PATH) {
 }
 
 // src/commands/upgrade-log.ts
-import * as fs26 from "node:fs";
+import * as fs27 from "node:fs";
 import * as os16 from "node:os";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 function getUpgradeLogPath() {
   const home = process.env["HOME"] ?? os16.homedir();
-  return path30.join(home, ".olam", "upgrade.log");
+  return path31.join(home, ".olam", "upgrade.log");
 }
 var UPGRADE_LOG_PATH = getUpgradeLogPath();
 function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   try {
-    fs26.mkdirSync(path30.dirname(logPath), { recursive: true });
+    fs27.mkdirSync(path31.dirname(logPath), { recursive: true });
     const line = JSON.stringify(row) + "\n";
-    fs26.appendFileSync(logPath, line, { mode: 420 });
+    fs27.appendFileSync(logPath, line, { mode: 420 });
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to append: ${err instanceof Error ? err.message : String(err)}
@@ -18413,10 +18587,10 @@ function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   }
 }
 function readUpgradeLog(limit = 10, logPath = getUpgradeLogPath()) {
-  if (!fs26.existsSync(logPath)) return [];
+  if (!fs27.existsSync(logPath)) return [];
   let raw;
   try {
-    raw = fs26.readFileSync(logPath, "utf-8");
+    raw = fs27.readFileSync(logPath, "utf-8");
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to read: ${err instanceof Error ? err.message : String(err)}
@@ -18509,12 +18683,12 @@ init_protocol_version();
 init_install_root();
 var AUTH_HEALTH_URL2 = "http://127.0.0.1:9999/health";
 function isNodeModulesInSync(cwd) {
-  const lockPath = path31.join(cwd, "package-lock.json");
-  const markerPath = path31.join(cwd, "node_modules", ".package-lock.json");
-  if (!fs27.existsSync(lockPath) || !fs27.existsSync(markerPath)) return false;
+  const lockPath = path32.join(cwd, "package-lock.json");
+  const markerPath = path32.join(cwd, "node_modules", ".package-lock.json");
+  if (!fs28.existsSync(lockPath) || !fs28.existsSync(markerPath)) return false;
   try {
-    const lockStat = fs27.statSync(lockPath);
-    const markerStat = fs27.statSync(markerPath);
+    const lockStat = fs28.statSync(lockPath);
+    const markerStat = fs28.statSync(markerPath);
     return markerStat.mtimeMs >= lockStat.mtimeMs;
   } catch {
     return false;
@@ -18530,8 +18704,8 @@ function shouldSkipInstall(opts, cwd) {
   return { skip: false };
 }
 function validateRepoRoot(cwd) {
-  const marker = path31.join(cwd, "packages/host-cp/compose.yaml");
-  if (!fs27.existsSync(marker)) {
+  const marker = path32.join(cwd, "packages/host-cp/compose.yaml");
+  if (!fs28.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -18883,9 +19057,9 @@ async function recreateAuthService() {
   }
 }
 function readBundleHash(cwd) {
-  const indexPath = path31.join(cwd, "packages/control-plane/public/index.html");
-  if (!fs27.existsSync(indexPath)) return null;
-  return extractBundleHash(fs27.readFileSync(indexPath, "utf-8"));
+  const indexPath = path32.join(cwd, "packages/control-plane/public/index.html");
+  if (!fs28.existsSync(indexPath)) return null;
+  return extractBundleHash(fs28.readFileSync(indexPath, "utf-8"));
 }
 async function runUpgradePullByDigest(deps = {}) {
   const docker2 = deps.docker ?? realDocker;
@@ -19324,7 +19498,7 @@ ${buildResult.stderr}`);
     return;
   }
   const authSecret = readAuthSecret2();
-  const spaDir = path31.join(cwd, "packages/control-plane/app");
+  const spaDir = path32.join(cwd, "packages/control-plane/app");
   const spaResult = runStep2(
     "vite build (SPA)",
     "npx",
@@ -19858,20 +20032,20 @@ ${pc18.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
 
 // src/commands/keys.ts
 init_output();
-import * as fs28 from "node:fs";
+import * as fs29 from "node:fs";
 import * as os17 from "node:os";
-import * as path32 from "node:path";
+import * as path33 from "node:path";
 import YAML4 from "yaml";
 function olamHome2() {
-  return process.env.OLAM_HOME ?? path32.join(os17.homedir(), ".olam");
+  return process.env.OLAM_HOME ?? path33.join(os17.homedir(), ".olam");
 }
 function keysFilePath() {
-  return path32.join(olamHome2(), "keys.yaml");
+  return path33.join(olamHome2(), "keys.yaml");
 }
 function readKeysFile() {
   const filePath = keysFilePath();
-  if (!fs28.existsSync(filePath)) return null;
-  const raw = fs28.readFileSync(filePath, "utf-8").trim();
+  if (!fs29.existsSync(filePath)) return null;
+  const raw = fs29.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = YAML4.parse(raw);
@@ -19887,13 +20061,13 @@ function readKeysFile() {
 }
 function writeKeysFile(keys) {
   const dir = olamHome2();
-  if (!fs28.existsSync(dir)) {
-    fs28.mkdirSync(dir, { recursive: true });
+  if (!fs29.existsSync(dir)) {
+    fs29.mkdirSync(dir, { recursive: true });
   }
   const filePath = keysFilePath();
   const content = YAML4.stringify(keys);
-  fs28.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
-  fs28.chmodSync(filePath, 384);
+  fs29.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
+  fs29.chmodSync(filePath, 384);
 }
 function redact(value) {
   if (value.length <= 8) return value + "...";
@@ -19936,7 +20110,7 @@ function registerKeys(program2) {
       }
       const { [key]: _removed, ...rest } = existing;
       if (Object.keys(rest).length === 0) {
-        fs28.unlinkSync(keysFilePath());
+        fs29.unlinkSync(keysFilePath());
       } else {
         writeKeysFile(rest);
       }
@@ -19959,33 +20133,33 @@ function registerKeys(program2) {
 }
 
 // src/commands/world-snapshot.ts
-import * as fs30 from "node:fs";
-import * as path34 from "node:path";
+import * as fs31 from "node:fs";
+import * as path35 from "node:path";
 import { execSync as execSync9 } from "node:child_process";
 import pc19 from "picocolors";
 
 // ../core/dist/world/snapshot.js
-import * as crypto6 from "node:crypto";
-import * as fs29 from "node:fs";
+import * as crypto7 from "node:crypto";
+import * as fs30 from "node:fs";
 import * as os18 from "node:os";
-import * as path33 from "node:path";
+import * as path34 from "node:path";
 import { execFileSync as execFileSync5 } from "node:child_process";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path33.join(os18.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path34.join(os18.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDir(worldId, kind) {
-  return path33.join(snapshotsDir(), worldId, kind);
+  return path34.join(snapshotsDir(), worldId, kind);
 }
 function snapshotTarPath(worldId, kind, repoName, hash) {
   const base = repoName ? `${repoName}-${hash}` : hash;
-  return path33.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
+  return path34.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
 }
 function manifestPath(tarPath) {
   return tarPath.replace(/\.tar\.gz$/, ".manifest.json");
 }
 function hashBuffers(entries) {
   const sorted = [...entries].sort((a, b) => a.path.localeCompare(b.path));
-  const hash = crypto6.createHash("sha256");
+  const hash = crypto7.createHash("sha256");
   for (const entry of sorted) {
     hash.update(entry.path);
     hash.update("\0");
@@ -19995,17 +20169,17 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir) {
-  const lockfile = path33.join(repoDir, "Gemfile.lock");
-  if (!fs29.existsSync(lockfile))
+  const lockfile = path34.join(repoDir, "Gemfile.lock");
+  if (!fs30.existsSync(lockfile))
     return null;
-  return hashBuffers([{ path: "Gemfile.lock", content: fs29.readFileSync(lockfile) }]);
+  return hashBuffers([{ path: "Gemfile.lock", content: fs30.readFileSync(lockfile) }]);
 }
 function computeNodeFingerprint(repoDir) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path33.join(repoDir, name);
-    if (fs29.existsSync(lockfile)) {
-      return hashBuffers([{ path: name, content: fs29.readFileSync(lockfile) }]);
+    const lockfile = path34.join(repoDir, name);
+    if (fs30.existsSync(lockfile)) {
+      return hashBuffers([{ path: name, content: fs30.readFileSync(lockfile) }]);
     }
   }
   return null;
@@ -20015,16 +20189,16 @@ function computePgFingerprint(repoDirs) {
   const entries = [];
   for (const repoDir of repoDirs) {
     for (const pattern of patterns) {
-      const filePath = path33.join(repoDir, pattern);
-      if (fs29.existsSync(filePath)) {
-        entries.push({ path: filePath, content: fs29.readFileSync(filePath) });
+      const filePath = path34.join(repoDir, pattern);
+      if (fs30.existsSync(filePath)) {
+        entries.push({ path: filePath, content: fs30.readFileSync(filePath) });
       }
     }
   }
   return entries.length > 0 ? hashBuffers(entries) : null;
 }
 function packTarball(srcDir, destPath, opts = {}) {
-  fs29.mkdirSync(path33.dirname(destPath), { recursive: true });
+  fs30.mkdirSync(path34.dirname(destPath), { recursive: true });
   const tmp = `${destPath}.tmp`;
   const args = [];
   if (opts.followSymlinks)
@@ -20032,47 +20206,47 @@ function packTarball(srcDir, destPath, opts = {}) {
   args.push("-czf", tmp, "-C", srcDir, ".");
   try {
     execFileSync5("tar", args, { stdio: "pipe" });
-    fs29.renameSync(tmp, destPath);
+    fs30.renameSync(tmp, destPath);
   } catch (err) {
     try {
-      fs29.rmSync(tmp, { force: true });
+      fs30.rmSync(tmp, { force: true });
     } catch {
     }
     throw err;
   }
 }
 function writeManifest(manifest, tarPath) {
-  fs29.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
+  fs30.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs29.existsSync(mPath))
+  if (!fs30.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs29.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs30.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
 }
 function listSnapshots(worldIdFilter) {
   const root = snapshotsDir();
-  if (!fs29.existsSync(root))
+  if (!fs30.existsSync(root))
     return [];
   const now = Date.now();
   const results = [];
-  const worlds = worldIdFilter ? [worldIdFilter] : fs29.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  const worlds = worldIdFilter ? [worldIdFilter] : fs30.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   for (const worldId of worlds) {
-    const worldDir = path33.join(root, worldId);
-    if (!fs29.existsSync(worldDir) || !fs29.statSync(worldDir).isDirectory())
+    const worldDir = path34.join(root, worldId);
+    if (!fs30.existsSync(worldDir) || !fs30.statSync(worldDir).isDirectory())
       continue;
     for (const kind of ["gems", "node", "pg"]) {
-      const kindDir = path33.join(worldDir, kind);
-      if (!fs29.existsSync(kindDir))
+      const kindDir = path34.join(worldDir, kind);
+      if (!fs30.existsSync(kindDir))
         continue;
-      const tarballs = fs29.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
+      const tarballs = fs30.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
       for (const tarFile of tarballs) {
-        const tarPath = path33.join(kindDir, tarFile);
-        const stat = fs29.statSync(tarPath);
+        const tarPath = path34.join(kindDir, tarFile);
+        const stat = fs30.statSync(tarPath);
         const manifest = readManifest(tarPath);
         if (!manifest)
           continue;
@@ -20162,17 +20336,17 @@ function resolveKinds(arg) {
   return [];
 }
 async function captureGems(worldId, workspacePath, repo) {
-  const repoDir = path34.join(workspacePath, repo);
+  const repoDir = path35.join(workspacePath, repo);
   const fingerprint = computeGemsFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock \u2014 layer does not apply" };
   }
   const tarPath = snapshotTarPath(worldId, "gems", repo, fingerprint);
-  const vendorBundle = path34.join(repoDir, "vendor", "bundle");
-  if (fs30.existsSync(vendorBundle)) {
+  const vendorBundle = path35.join(repoDir, "vendor", "bundle");
+  if (fs31.existsSync(vendorBundle)) {
     try {
       packTarball(vendorBundle, tarPath);
-      const stat = fs30.statSync(tarPath);
+      const stat = fs31.statSync(tarPath);
       const manifest = {
         kind: "gems",
         worldId,
@@ -20205,10 +20379,10 @@ async function captureGems(worldId, workspacePath, repo) {
       `docker exec ${containerName} sh -c 'mkdir -p "$(dirname ${tmpTar})" && tar -czf ${tmpTar}.tmp -C ${bundlePath} . && mv ${tmpTar}.tmp ${tmpTar}'`,
       { stdio: "pipe", timeout: 12e4 }
     );
-    fs30.mkdirSync(path34.dirname(tarPath), { recursive: true });
+    fs31.mkdirSync(path35.dirname(tarPath), { recursive: true });
     execSync9(`docker cp ${containerName}:${tmpTar} "${tarPath}"`, { stdio: "pipe", timeout: 12e4 });
     execSync9(`docker exec ${containerName} rm -f ${tmpTar}`, { stdio: "pipe" });
-    const stat = fs30.statSync(tarPath);
+    const stat = fs31.statSync(tarPath);
     const manifest = {
       kind: "gems",
       worldId,
@@ -20225,19 +20399,19 @@ async function captureGems(worldId, workspacePath, repo) {
   }
 }
 async function captureNode(worldId, workspacePath, repo) {
-  const repoDir = path34.join(workspacePath, repo);
+  const repoDir = path35.join(workspacePath, repo);
   const fingerprint = computeNodeFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no lockfile \u2014 layer does not apply" };
   }
-  const nodeModules = path34.join(repoDir, "node_modules");
-  if (!fs30.existsSync(nodeModules)) {
+  const nodeModules = path35.join(repoDir, "node_modules");
+  if (!fs31.existsSync(nodeModules)) {
     return { ok: false, tarPath: "", msg: "node_modules not installed yet" };
   }
   const tarPath = snapshotTarPath(worldId, "node", repo, fingerprint);
   try {
     packTarball(nodeModules, tarPath);
-    const stat = fs30.statSync(tarPath);
+    const stat = fs31.statSync(tarPath);
     const manifest = {
       kind: "node",
       worldId,
@@ -20254,7 +20428,7 @@ async function captureNode(worldId, workspacePath, repo) {
   }
 }
 async function capturePg(worldId, workspacePath, repoNames) {
-  const repoDirs = repoNames.map((r) => path34.join(workspacePath, r));
+  const repoDirs = repoNames.map((r) => path35.join(workspacePath, r));
   const fingerprint = computePgFingerprint(repoDirs);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock / schema.rb \u2014 layer does not apply" };
@@ -20269,13 +20443,13 @@ async function capturePg(worldId, workspacePath, repoNames) {
   }
   try {
     execSync9(`docker stop ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    fs30.mkdirSync(path34.dirname(tarPath), { recursive: true });
+    fs31.mkdirSync(path35.dirname(tarPath), { recursive: true });
     execSync9(
-      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path34.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path34.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path34.basename(tarPath)}.tmp /dest/${path34.basename(tarPath)}'`,
+      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path35.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path35.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path35.basename(tarPath)}.tmp /dest/${path35.basename(tarPath)}'`,
       { stdio: "pipe", timeout: 18e4 }
     );
     execSync9(`docker start ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    const stat = fs30.statSync(tarPath);
+    const stat = fs31.statSync(tarPath);
     const manifest = {
       kind: "pg",
       worldId,
@@ -20350,35 +20524,35 @@ function formatAge2(ms) {
 // src/commands/refresh.ts
 init_context();
 init_output();
-import * as fs32 from "node:fs";
+import * as fs33 from "node:fs";
 import * as os19 from "node:os";
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 import { spawnSync as spawnSync12 } from "node:child_process";
 import ora8 from "ora";
 
 // src/commands/refresh-helpers.ts
-import * as fs31 from "node:fs";
-import * as path35 from "node:path";
+import * as fs32 from "node:fs";
+import * as path36 from "node:path";
 function collectCpSourceFiles(standaloneDir) {
-  if (!fs31.existsSync(standaloneDir)) {
+  if (!fs32.existsSync(standaloneDir)) {
     throw new Error(`CP standalone dir not found: ${standaloneDir}`);
   }
   const entries = [];
-  const topLevel = fs31.readdirSync(standaloneDir).filter((f) => {
-    const stat = fs31.statSync(path35.join(standaloneDir, f));
+  const topLevel = fs32.readdirSync(standaloneDir).filter((f) => {
+    const stat = fs32.statSync(path36.join(standaloneDir, f));
     return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
   }).sort();
   for (const f of topLevel) {
-    entries.push({ srcPath: path35.join(standaloneDir, f), destRelPath: f });
+    entries.push({ srcPath: path36.join(standaloneDir, f), destRelPath: f });
   }
-  const libDir = path35.join(standaloneDir, "lib");
-  if (fs31.existsSync(libDir) && fs31.statSync(libDir).isDirectory()) {
-    const libFiles = fs31.readdirSync(libDir).filter((f) => {
-      const stat = fs31.statSync(path35.join(libDir, f));
+  const libDir = path36.join(standaloneDir, "lib");
+  if (fs32.existsSync(libDir) && fs32.statSync(libDir).isDirectory()) {
+    const libFiles = fs32.readdirSync(libDir).filter((f) => {
+      const stat = fs32.statSync(path36.join(libDir, f));
       return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
     }).sort();
     for (const f of libFiles) {
-      entries.push({ srcPath: path35.join(libDir, f), destRelPath: `lib/${f}` });
+      entries.push({ srcPath: path36.join(libDir, f), destRelPath: `lib/${f}` });
     }
   }
   return entries;
@@ -20436,16 +20610,16 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  const stagingDir = fs32.mkdtempSync(
-    path36.join(os19.tmpdir(), `olam-refresh-${worldId}-`)
+  const stagingDir = fs33.mkdtempSync(
+    path37.join(os19.tmpdir(), `olam-refresh-${worldId}-`)
   );
   try {
     const hasLib = entries.some((e) => e.destRelPath.startsWith("lib/"));
     if (hasLib) {
-      fs32.mkdirSync(path36.join(stagingDir, "lib"), { recursive: true });
+      fs33.mkdirSync(path37.join(stagingDir, "lib"), { recursive: true });
     }
     for (const { srcPath, destRelPath } of entries) {
-      fs32.copyFileSync(srcPath, path36.join(stagingDir, destRelPath));
+      fs33.copyFileSync(srcPath, path37.join(stagingDir, destRelPath));
     }
     const cpResult = docker([
       "cp",
@@ -20460,7 +20634,7 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       };
     }
   } finally {
-    fs32.rmSync(stagingDir, { recursive: true, force: true });
+    fs33.rmSync(stagingDir, { recursive: true, force: true });
   }
   if (opts.restart) {
     const restartResult = docker([
@@ -20497,11 +20671,11 @@ function registerRefresh(program2) {
       process.exitCode = 1;
       return;
     }
-    const standaloneDir = path36.join(
+    const standaloneDir = path37.join(
       process.cwd(),
       "packages/control-plane/standalone"
     );
-    if (!fs32.existsSync(standaloneDir)) {
+    if (!fs33.existsSync(standaloneDir)) {
       printError(
         `CP standalone source not found at ${standaloneDir}.
 Run \`olam refresh\` from the olam repo root.`
@@ -20580,9 +20754,9 @@ Run \`olam refresh\` from the olam repo root.`
 }
 
 // src/commands/diagnose.ts
-import * as fs33 from "node:fs";
+import * as fs34 from "node:fs";
 import * as os20 from "node:os";
-import * as path37 from "node:path";
+import * as path38 from "node:path";
 import { execFileSync as execFileSync6, execSync as execSync10 } from "node:child_process";
 import pc20 from "picocolors";
 
@@ -20617,9 +20791,9 @@ function stripSecrets(input) {
 }
 
 // src/commands/diagnose.ts
-var DIAGNOSTICS_DIR = path37.join(os20.homedir(), ".olam", "diagnostics");
-var LOG_DIR = path37.join(os20.homedir(), ".olam", "log");
-var CACHE_DIR = path37.join(os20.homedir(), ".olam", "cache");
+var DIAGNOSTICS_DIR = path38.join(os20.homedir(), ".olam", "diagnostics");
+var LOG_DIR = path38.join(os20.homedir(), ".olam", "log");
+var CACHE_DIR = path38.join(os20.homedir(), ".olam", "cache");
 var LOG_TAIL_LINES = 200;
 function safeExec(cmd) {
   try {
@@ -20633,10 +20807,10 @@ function defaultZip(zipPath, files) {
 }
 async function buildDiagnosticsZip(_exec = (cmd) => safeExec(cmd), _outDir = DIAGNOSTICS_DIR, _logDir = LOG_DIR, _zip = defaultZip) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 23);
-  const zipPath = path37.join(_outDir, `olam-diag-${ts}.zip`);
-  const tmpDir = fs33.mkdtempSync(path37.join(os20.tmpdir(), "olam-diag-"));
+  const zipPath = path38.join(_outDir, `olam-diag-${ts}.zip`);
+  const tmpDir = fs34.mkdtempSync(path38.join(os20.tmpdir(), "olam-diag-"));
   try {
-    fs33.mkdirSync(_outDir, { recursive: true });
+    fs34.mkdirSync(_outDir, { recursive: true });
     const entries = [];
     const version = process.env["OLAM_CLI_VERSION"] ?? "unknown";
     const nodeVersion = process.version;
@@ -20652,14 +20826,14 @@ platform: ${platform}
       `uptime: ${os20.uptime()}s`
     ].join("\n") + "\n";
     _writeEntry(tmpDir, "os-info.txt", stripSecrets(osContent), entries);
-    const depsFile = path37.join(CACHE_DIR, "deps.json");
-    if (fs33.existsSync(depsFile)) {
-      const deps = fs33.readFileSync(depsFile, "utf-8");
+    const depsFile = path38.join(CACHE_DIR, "deps.json");
+    if (fs34.existsSync(depsFile)) {
+      const deps = fs34.readFileSync(depsFile, "utf-8");
       _writeEntry(tmpDir, "deps.json", stripSecrets(deps), entries);
     }
     const latestLog = _latestLog(_logDir);
     if (latestLog) {
-      const lines = fs33.readFileSync(latestLog, "utf-8").split("\n");
+      const lines = fs34.readFileSync(latestLog, "utf-8").split("\n");
       const tail = lines.slice(-LOG_TAIL_LINES).join("\n");
       _writeEntry(tmpDir, "log-tail.txt", stripSecrets(tail), entries);
     }
@@ -20671,38 +20845,38 @@ platform: ${platform}
     if (authAudit) {
       _writeEntry(tmpDir, "audit-auth-callers.txt", stripSecrets(authAudit), entries);
     }
-    const fileArgs = entries.map((e) => path37.join(tmpDir, e));
+    const fileArgs = entries.map((e) => path38.join(tmpDir, e));
     try {
       _zip(zipPath, fileArgs);
     } catch (err) {
       throw new Error(`zip command produced no output file. zip stderr: ${err.message}`);
     }
-    if (!fs33.existsSync(zipPath)) {
+    if (!fs34.existsSync(zipPath)) {
       throw new Error("zip command produced no output file.");
     }
     return { zipPath, entries };
   } finally {
     try {
-      fs33.rmSync(tmpDir, { recursive: true, force: true });
+      fs34.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
 }
 function _writeEntry(dir, name, content, entries) {
-  fs33.writeFileSync(path37.join(dir, name), content, { mode: 420 });
+  fs34.writeFileSync(path38.join(dir, name), content, { mode: 420 });
   entries.push(name);
 }
 function _latestLog(logDir) {
-  if (!fs33.existsSync(logDir)) return null;
-  const files = fs33.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
-  return files.length > 0 ? path37.join(logDir, files[0]) : null;
+  if (!fs34.existsSync(logDir)) return null;
+  const files = fs34.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
+  return files.length > 0 ? path38.join(logDir, files[0]) : null;
 }
 async function buildTelemetryPayload() {
   const channel = "stable";
-  const manifestFile = path37.join(CACHE_DIR, "manifest.json");
+  const manifestFile = path38.join(CACHE_DIR, "manifest.json");
   let manifestAgeHours = null;
-  if (fs33.existsSync(manifestFile)) {
-    const mtime = fs33.statSync(manifestFile).mtime.getTime();
+  if (fs34.existsSync(manifestFile)) {
+    const mtime = fs34.statSync(manifestFile).mtime.getTime();
     manifestAgeHours = Math.round((Date.now() - mtime) / 36e5);
   }
   return {
@@ -20745,24 +20919,24 @@ function registerDiagnose(program2) {
 }
 
 // src/commands/update.ts
-import * as fs36 from "node:fs";
+import * as fs37 from "node:fs";
 import * as os22 from "node:os";
-import * as path40 from "node:path";
+import * as path41 from "node:path";
 import { execSync as execSync11 } from "node:child_process";
 import pc21 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
-import * as fs34 from "node:fs";
-import * as path38 from "node:path";
+import * as fs35 from "node:fs";
+import * as path39 from "node:path";
 var realFs = {
-  readdirSync: (p) => fs34.readdirSync(p),
-  existsSync: (p) => fs34.existsSync(p),
-  lstatSync: (p) => fs34.lstatSync(p),
-  readlinkSync: (p) => fs34.readlinkSync(p),
-  symlinkSync: (t, l) => fs34.symlinkSync(t, l),
-  unlinkSync: (p) => fs34.unlinkSync(p),
+  readdirSync: (p) => fs35.readdirSync(p),
+  existsSync: (p) => fs35.existsSync(p),
+  lstatSync: (p) => fs35.lstatSync(p),
+  readlinkSync: (p) => fs35.readlinkSync(p),
+  symlinkSync: (t, l) => fs35.symlinkSync(t, l),
+  unlinkSync: (p) => fs35.unlinkSync(p),
   mkdirSync: (p, o) => {
-    fs34.mkdirSync(p, o);
+    fs35.mkdirSync(p, o);
   }
 };
 function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
@@ -20772,8 +20946,8 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   _fs.mkdirSync(claudeSkillsDir, { recursive: true });
   const sourceSkills = _fs.existsSync(npmSkillsDir) ? _fs.readdirSync(npmSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const skill of sourceSkills) {
-    const linkPath = path38.join(claudeSkillsDir, skill);
-    const target = path38.join(npmSkillsDir, skill);
+    const linkPath = path39.join(claudeSkillsDir, skill);
+    const target = path39.join(npmSkillsDir, skill);
     if (!_fs.existsSync(linkPath)) {
       try {
         _fs.symlinkSync(target, linkPath);
@@ -20786,7 +20960,7 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   }
   const deployedEntries = _fs.existsSync(claudeSkillsDir) ? _fs.readdirSync(claudeSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const entry of deployedEntries) {
-    const linkPath = path38.join(claudeSkillsDir, entry);
+    const linkPath = path39.join(claudeSkillsDir, entry);
     let isSymlink = false;
     try {
       isSymlink = _fs.lstatSync(linkPath).isSymbolicLink();
@@ -20811,9 +20985,9 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
 
 // src/commands/update.ts
 var PACKAGE_NAME = "@pleri/olam-cli";
-var CACHE_DIR2 = path40.join(os22.homedir(), ".olam", "cache");
-var LOG_DIR2 = path40.join(os22.homedir(), ".olam", "log");
-var LAST_STABLE_FILE = path40.join(CACHE_DIR2, "last-stable.txt");
+var CACHE_DIR2 = path41.join(os22.homedir(), ".olam", "cache");
+var LOG_DIR2 = path41.join(os22.homedir(), ".olam", "log");
+var LAST_STABLE_FILE = path41.join(CACHE_DIR2, "last-stable.txt");
 function defaultExec(cmd) {
   try {
     const stdout = execSync11(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
@@ -20835,22 +21009,22 @@ function getCurrentVersion(_exec = defaultExec) {
 }
 function readLastStable(file = LAST_STABLE_FILE) {
   try {
-    const v = fs36.readFileSync(file, "utf-8").trim();
+    const v = fs37.readFileSync(file, "utf-8").trim();
     return v || null;
   } catch {
     return null;
   }
 }
 function writeLastStable(version, file = LAST_STABLE_FILE) {
-  fs36.mkdirSync(path40.dirname(file), { recursive: true });
-  fs36.writeFileSync(file, version, { mode: 420 });
+  fs37.mkdirSync(path41.dirname(file), { recursive: true });
+  fs37.writeFileSync(file, version, { mode: 420 });
 }
 function logUpdateFailure(stderr) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const logFile = path40.join(LOG_DIR2, `update-${ts}.log`);
+  const logFile = path41.join(LOG_DIR2, `update-${ts}.log`);
   try {
-    fs36.mkdirSync(LOG_DIR2, { recursive: true });
-    fs36.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
+    fs37.mkdirSync(LOG_DIR2, { recursive: true });
+    fs37.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
 ${stderr}
 `, "utf-8");
   } catch {
@@ -20937,8 +21111,8 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
   let symlinkResult = { added: [], removed: [] };
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
-    const npmSkillsDir = path40.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
-    const claudeSkillsDir = path40.join(os22.homedir(), ".claude", "skills");
+    const npmSkillsDir = path41.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
+    const claudeSkillsDir = path41.join(os22.homedir(), ".claude", "skills");
     const rec = _reconcile(npmSkillsDir, claudeSkillsDir);
     symlinkResult = { added: rec.added, removed: rec.removed };
     if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
@@ -20984,8 +21158,8 @@ async function doRollback(_exec = defaultExec, _reconcile = reconcileSkillSymlin
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
     _reconcile(
-      path40.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
-      path40.join(os22.homedir(), ".claude", "skills")
+      path41.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
+      path41.join(os22.homedir(), ".claude", "skills")
     );
   }
   return { action: "rolled-back", restoredVersion: prev, exitCode: 0 };
@@ -21146,8 +21320,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path44, init = {}) {
-  const res = await fetch(`${BASE_URL}${path44}`, {
+async function apiFetch(path45, init = {}) {
+  const res = await fetch(`${BASE_URL}${path45}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -21407,12 +21581,12 @@ import * as readline3 from "node:readline";
 import pc25 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs37 from "node:fs";
+import * as fs38 from "node:fs";
 import * as os23 from "node:os";
-import * as path41 from "node:path";
+import * as path42 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs37.readFileSync(filePath, "utf-8");
+    const raw = fs38.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -21441,24 +21615,24 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path41.join(os23.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path42.join(os23.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path41.join(os23.homedir(), "AppData", "Roaming");
-    return path41.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path42.join(os23.homedir(), "AppData", "Roaming");
+    return path42.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path41.join(os23.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path42.join(os23.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path41.join(os23.homedir(), ".olam", "config.yaml"),
-    path41.join(process.cwd(), ".olam", "config.yaml")
+    path42.join(os23.homedir(), ".olam", "config.yaml"),
+    path42.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs37.existsSync(configPath)) continue;
+    if (!fs38.existsSync(configPath)) continue;
     try {
-      const raw = fs37.readFileSync(configPath, "utf-8");
+      const raw = fs38.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -21474,7 +21648,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path41.join(os23.homedir(), ".claude.json"),
+      path: path42.join(os23.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -21482,19 +21656,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path41.join(os23.homedir(), ".cursor", "mcp.json"),
+      path: path42.join(os23.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path41.join(os23.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path42.join(os23.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path41.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path41.basename(repoPath)})`
+      path: path42.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path42.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -21670,30 +21844,72 @@ Importing ${selected.length} server(s)\u2026`);
   });
 }
 
+// src/commands/mcp/revoke.ts
+init_output();
+import pc26 from "picocolors";
+function registerMcpRevoke(cmd) {
+  cmd.command("revoke <user> <world> <service>").description("Revoke a user's MCP service entitlement (multi-tenant mode only)").action(async (user, world, service) => {
+    const multiTenant = (process.env["OLAM_MCP_MULTI_TENANT"] ?? "").toLowerCase() === "true";
+    if (!multiTenant) {
+      console.warn(pc26.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
+      return;
+    }
+    const baseUrl = process.env["OLAM_MCP_AUTH_SERVICE_URL"] ?? "http://127.0.0.1:9998";
+    const secret = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
+    const headers = { "Content-Type": "application/json" };
+    if (secret) headers["X-Olam-Mcp-Secret"] = secret;
+    let res;
+    try {
+      res = await fetch(
+        `${baseUrl}/entitlement/${encodeURIComponent(user)}/${encodeURIComponent(world)}/${encodeURIComponent(service)}`,
+        { method: "DELETE", headers }
+      );
+    } catch (err) {
+      printError(`Could not reach mcp-auth service: ${err instanceof Error ? err.message : "unknown"}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (!res.ok) {
+      let msg = `HTTP ${res.status}`;
+      try {
+        const body = await res.json();
+        if (body.error) msg = body.error;
+      } catch {
+      }
+      printError(`Revoke failed: ${msg}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(pc26.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
+    console.log(pc26.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
+  });
+}
+
 // src/commands/mcp/index.ts
 function registerMcp(program2) {
-  const mcp = program2.command("mcp").description("Manage MCP server credentials (login, add, list, remove, import)");
+  const mcp = program2.command("mcp").description("Manage MCP server credentials (login, add, list, remove, import, revoke)");
   registerMcpLogin(mcp);
   registerMcpAdd(mcp);
   registerMcpList(mcp);
   registerMcpRemove(mcp);
   registerMcpStatus(mcp);
   registerMcpImport(mcp);
+  registerMcpRevoke(mcp);
 }
 
 // src/pleri-config.ts
-import * as fs38 from "node:fs";
-import * as path42 from "node:path";
+import * as fs39 from "node:fs";
+import * as path43 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path42.join(configDir, "config.yaml");
-  if (!fs38.existsSync(configPath)) {
+  const configPath = path43.join(configDir, "config.yaml");
+  if (!fs39.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs38.readFileSync(configPath, "utf8");
+    const contents = fs39.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -21704,14 +21920,14 @@ function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
 var program = new Command();
 function readCliVersion() {
   try {
-    const here = path43.dirname(fileURLToPath4(import.meta.url));
+    const here = path44.dirname(fileURLToPath4(import.meta.url));
     for (const candidate of [
-      path43.join(here, "package.json"),
-      path43.join(here, "..", "package.json"),
-      path43.join(here, "..", "..", "package.json")
+      path44.join(here, "package.json"),
+      path44.join(here, "..", "package.json"),
+      path44.join(here, "..", "..", "package.json")
     ]) {
-      if (fs39.existsSync(candidate)) {
-        const pkg = JSON.parse(fs39.readFileSync(candidate, "utf-8"));
+      if (fs40.existsSync(candidate)) {
+        const pkg = JSON.parse(fs40.readFileSync(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
       }
     }