@pleri/olam-cli 0.1.55 → 0.1.57

package/dist/index.js

@@ -460,8 +460,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path45, errorMaps, issueData } = params;
-      const fullPath = [...path45, ...issueData.path || []];
+      const { data, path: path44, errorMaps, issueData } = params;
+      const fullPath = [...path44, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -769,11 +769,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path45, key) {
+      constructor(parent, value, path44, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path45;
+        this._path = path44;
         this._key = key;
       }
       get path() {
@@ -4254,7 +4254,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path45, ctx, rejectSource) {
+function refineForbiddenKeys(value, path44, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4262,12 +4262,12 @@ function refineForbiddenKeys(value, path45, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path45, key],
+        path: [...path44, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path45.length === 0 && key === "source") {
+    if (rejectSource && path44.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4275,21 +4275,21 @@ function refineForbiddenKeys(value, path45, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path45, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path44, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path45, rejectSource) {
+function rejectForbiddenKeys(value, path44, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path45}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path44}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path45}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path44}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path45}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path44}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -4604,7 +4604,22 @@ function isSecureOrLocalhost(value) {
     return false;
   return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]" || parsed.hostname === "::1";
 }
-var repoTypeSchema, envSetupSchema, EntitledMcpsSchema, RepoConfigSchema, ServiceConfigSchema, sshHostSchema, computeProviderType, stackImageSchema, computeProvidersSchema, ComputeConfigSchema, CostConfigSchema, DashboardConfigSchema, PleriConfigSchema, authModeSchema, AuthConfigSchema, DevboxRegistrySchema, DevboxImageSelectorSchema, DevboxConfigSchema, WorldsDefaultSchema, OlamConfigSchema;
+function inferRegistryProvider(prefix) {
+  if (!prefix)
+    return void 0;
+  const head = prefix.split("/")[0] ?? "";
+  if (!head.includes(".") && !head.includes(":"))
+    return "dockerhub";
+  if (head === "ghcr.io")
+    return "ghcr";
+  if (head === "docker.io")
+    return "dockerhub";
+  if (head === "gcr.io" || head.endsWith("-docker.pkg.dev") || head.endsWith(".pkg.dev")) {
+    return "gar";
+  }
+  return void 0;
+}
+var repoTypeSchema, envSetupSchema, EntitledMcpsSchema, RepoConfigSchema, ServiceConfigSchema, sshHostSchema, computeProviderType, stackImageSchema, computeProvidersSchema, ComputeConfigSchema, CostConfigSchema, DashboardConfigSchema, PleriConfigSchema, authModeSchema, AuthConfigSchema, DevboxRegistryProviderSchema, DevboxRegistrySchema, DevboxImageSelectorSchema, DevboxConfigSchema, WorldsDefaultSchema, OlamConfigSchema;
 var init_schema2 = __esm({
   "../core/dist/config/schema.js"() {
     "use strict";
@@ -4740,19 +4755,54 @@ var init_schema2 = __esm({
       mode: authModeSchema.default("oauth"),
       autoInject: external_exports.boolean().default(true).describe("Copy host credentials into world at creation. Set false to use browser OAuth instead.")
     });
+    DevboxRegistryProviderSchema = external_exports.enum(["ghcr", "gar", "dockerhub"]);
     DevboxRegistrySchema = external_exports.object({
       /**
        * Fully-qualified registry prefix (no trailing slash), e.g.
-       * "ghcr.io/<org>/olam-devbox". When set without per-tag overrides, ALL
-       * `olam-devbox:*` lookups are rewritten to `<prefix>:<tag>`.
+       * "ghcr.io/<org>/olam-devbox" or
+       * "us-central1-docker.pkg.dev/<gcp-project>/<repo>/olam-devbox".
+       * When set without per-tag overrides, ALL `olam-devbox:*` lookups are
+       * rewritten to `<prefix>:<tag>`.
        */
       prefix: external_exports.string().optional(),
+      /**
+       * Registry provider. Optional — inferred from `prefix` hostname when
+       * omitted. Set explicitly to assert which provider the consumer intends
+       * (a mismatch with `prefix` is a config error, not silent acceptance).
+       */
+      provider: DevboxRegistryProviderSchema.optional(),
       /**
        * Per-tag overrides. Wins over `prefix` when both are set. Use this when
        * different image tags live in different registries, or when a few tags
        * are local-only.
        */
       tags: external_exports.record(external_exports.string(), external_exports.string()).optional().default({})
+    }).superRefine((reg, ctx) => {
+      if (reg.provider && !reg.prefix) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["prefix"],
+          message: `devbox.registry.provider was set to "${reg.provider}" but no prefix was declared. Either drop the provider field or add a prefix like "<host>/<owner>/olam-devbox".`
+        });
+        return;
+      }
+      if (!reg.prefix)
+        return;
+      const inferred = inferRegistryProvider(reg.prefix);
+      if (reg.provider && inferred && reg.provider !== inferred) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["provider"],
+          message: `devbox.registry.provider "${reg.provider}" does not match prefix "${reg.prefix}" (inferred "${inferred}" from hostname). Fix the prefix host or drop the provider field.`
+        });
+      }
+      if (reg.provider && !inferred) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["prefix"],
+          message: `devbox.registry.prefix "${reg.prefix}" hostname is not recognised \u2014 provider "${reg.provider}" cannot be cross-checked. Recognised hosts: ghcr.io, *-docker.pkg.dev, gcr.io, docker.io, or a bare "owner/repo" (Docker Hub default).`
+        });
+      }
     });
     DevboxImageSelectorSchema = external_exports.object({
       /** Bare tag the resolver feeds to the registry (e.g. "rails-monorepo"). */
@@ -5230,8 +5280,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path45, body, attempt = 0) {
-        const url = `${this.baseUrl}${path45}`;
+      async request(method, path44, body, attempt = 0) {
+        const url = `${this.baseUrl}${path44}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5249,7 +5299,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path45, body, attempt + 1);
+            return this.request(method, path44, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -6728,8 +6778,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path45, method, body) {
-        const url = `${this.config.workerUrl}${path45}`;
+      async request(path44, method, body) {
+        const url = `${this.config.workerUrl}${path44}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -7519,192 +7569,87 @@ var init_hooks_config = __esm({
   }
 });
 
-// ../core/dist/world/merge-settings.js
-import * as fs12 from "node:fs";
-import * as path13 from "node:path";
-import * as crypto2 from "node:crypto";
-function mergeHomeSettingsJson(filePath, options) {
-  let settings;
-  try {
-    settings = readSettings(filePath);
-  } catch (err) {
-    throw new Error(`merge-settings: failed to parse existing settings.json: ${err?.message ?? err}`);
-  }
-  let changed = false;
-  if (options.ensureHook) {
-    const { stage, sentinel, entry } = options.ensureHook;
-    if (!settings.hooks || typeof settings.hooks !== "object") {
-      settings = { ...settings, hooks: {} };
-      changed = true;
-    }
-    const hooks = settings.hooks;
-    if (!Array.isArray(hooks[stage])) {
-      settings = {
-        ...settings,
-        hooks: { ...hooks, [stage]: [] }
-      };
-      changed = true;
-    }
-    const stageArr = settings.hooks[stage];
-    if (isHookSentinelPresent(stageArr, sentinel)) {
-      if (!changed) {
-        return { status: "already-present", message: `hook already present at ${filePath}` };
-      }
-    } else {
-      settings = {
-        ...settings,
-        hooks: {
-          ...settings.hooks,
-          [stage]: [...stageArr, entry]
-        }
-      };
-      changed = true;
-    }
-  }
-  if (options.env) {
-    const existingEnv = settings.env && typeof settings.env === "object" ? settings.env : {};
-    const mergedEnv = { ...existingEnv, ...options.env };
-    const sameKeys = Object.keys(mergedEnv).length === Object.keys(existingEnv).length && Object.keys(mergedEnv).every((k) => existingEnv[k] === mergedEnv[k]);
-    if (!sameKeys) {
-      settings = { ...settings, env: mergedEnv };
-      changed = true;
-    }
-  }
-  if (!changed) {
-    return { status: "no-op", message: `no change needed at ${filePath}` };
-  }
-  try {
-    atomicWriteJson(filePath, settings);
-  } catch (err) {
-    throw new Error(`merge-settings: failed to write settings.json: ${err?.message ?? err}`);
-  }
-  return { status: "installed", message: `settings.json updated at ${filePath}` };
-}
-function readSettings(filePath) {
-  if (!fs12.existsSync(filePath)) {
-    return {};
-  }
-  const raw = fs12.readFileSync(filePath, "utf-8");
-  if (!raw.trim())
-    return {};
-  return JSON.parse(raw);
-}
-function isHookSentinelPresent(matchers, sentinel) {
-  for (const matcher of matchers) {
-    if (typeof matcher?.command === "string" && matcher.command.includes(sentinel)) {
-      return true;
-    }
-    if (Array.isArray(matcher?.hooks)) {
-      for (const h of matcher.hooks) {
-        if (typeof h?.command === "string" && h.command.includes(sentinel)) {
-          return true;
-        }
-      }
-    }
-  }
-  return false;
-}
-function atomicWriteJson(filePath, data) {
-  const dir = path13.dirname(filePath);
-  fs12.mkdirSync(dir, { recursive: true });
-  const rand = crypto2.randomBytes(6).toString("hex");
-  const tmp = `${filePath}.tmp.${process.pid}.${rand}`;
-  const json = JSON.stringify(data, null, 2) + "\n";
-  fs12.writeFileSync(tmp, json, { mode: 420 });
-  fs12.renameSync(tmp, filePath);
-}
-var init_merge_settings = __esm({
-  "../core/dist/world/merge-settings.js"() {
-    "use strict";
-  }
-});
-
 // ../core/dist/world/env-setup.js
-import * as crypto3 from "node:crypto";
-import * as fs13 from "node:fs";
+import * as crypto2 from "node:crypto";
+import * as fs12 from "node:fs";
 import * as os8 from "node:os";
-import * as path14 from "node:path";
+import * as path13 from "node:path";
 import { globSync } from "node:fs";
 function copyClaudeConfig(workspacePath, homeDir, configCtx) {
-  const sourceClaudeDir = path14.join(homeDir ?? os8.homedir(), ".claude");
-  const destClaudeDir = path14.join(workspacePath, ".claude-host-config");
+  const sourceClaudeDir = path13.join(homeDir ?? os8.homedir(), ".claude");
+  const destClaudeDir = path13.join(workspacePath, ".claude-host-config");
   void configCtx;
-  if (!fs13.existsSync(sourceClaudeDir))
+  if (!fs12.existsSync(sourceClaudeDir))
     return;
-  fs13.mkdirSync(destClaudeDir, { recursive: true });
-  const settingsPath = path14.join(sourceClaudeDir, "settings.json");
+  fs12.mkdirSync(destClaudeDir, { recursive: true });
+  const settingsPath = path13.join(sourceClaudeDir, "settings.json");
   let settings = {};
-  if (fs13.existsSync(settingsPath)) {
+  if (fs12.existsSync(settingsPath)) {
     try {
-      settings = JSON.parse(fs13.readFileSync(settingsPath, "utf-8"));
+      settings = JSON.parse(fs12.readFileSync(settingsPath, "utf-8"));
       delete settings["hooks"];
     } catch {
     }
   }
   const hooksConfig = generateHooksConfig(DEFAULT_HOOK_SERVER_URL);
   settings["hooks"] = hooksConfig["hooks"];
-  fs13.writeFileSync(path14.join(destClaudeDir, "settings.json"), JSON.stringify(settings, null, 2));
-  const claudeMdPath = path14.join(sourceClaudeDir, "CLAUDE.md");
-  if (fs13.existsSync(claudeMdPath)) {
-    fs13.copyFileSync(claudeMdPath, path14.join(destClaudeDir, "CLAUDE.md"));
+  fs12.writeFileSync(path13.join(destClaudeDir, "settings.json"), JSON.stringify(settings, null, 2));
+  const claudeMdPath = path13.join(sourceClaudeDir, "CLAUDE.md");
+  if (fs12.existsSync(claudeMdPath)) {
+    fs12.copyFileSync(claudeMdPath, path13.join(destClaudeDir, "CLAUDE.md"));
   }
-  const rulesDir = path14.join(sourceClaudeDir, "rules");
-  if (fs13.existsSync(rulesDir)) {
-    copyDirRecursive(rulesDir, path14.join(destClaudeDir, "rules"));
+  const rulesDir = path13.join(sourceClaudeDir, "rules");
+  if (fs12.existsSync(rulesDir)) {
+    copyDirRecursive(rulesDir, path13.join(destClaudeDir, "rules"));
   }
-  const agentsDir = path14.join(sourceClaudeDir, "agents");
-  if (fs13.existsSync(agentsDir)) {
-    copyDirRecursive(agentsDir, path14.join(destClaudeDir, "agents"));
+  const agentsDir = path13.join(sourceClaudeDir, "agents");
+  if (fs12.existsSync(agentsDir)) {
+    copyDirRecursive(agentsDir, path13.join(destClaudeDir, "agents"));
   }
-  const pluginsDir = path14.join(sourceClaudeDir, "plugins");
-  if (fs13.existsSync(pluginsDir)) {
-    copyDirRecursive(pluginsDir, path14.join(destClaudeDir, "plugins"), 0, SKIP_FILES);
+  const pluginsDir = path13.join(sourceClaudeDir, "plugins");
+  if (fs12.existsSync(pluginsDir)) {
+    copyDirRecursive(pluginsDir, path13.join(destClaudeDir, "plugins"), 0, SKIP_FILES);
   }
-  const skillsDir = path14.join(sourceClaudeDir, "skills");
-  if (fs13.existsSync(skillsDir)) {
-    copyDirRecursive(skillsDir, path14.join(destClaudeDir, "skills"));
+  const skillsDir = path13.join(sourceClaudeDir, "skills");
+  if (fs12.existsSync(skillsDir)) {
+    copyDirRecursive(skillsDir, path13.join(destClaudeDir, "skills"));
   }
-  const scriptsDir = path14.join(sourceClaudeDir, "scripts");
-  if (fs13.existsSync(scriptsDir)) {
-    copyDirRecursive(scriptsDir, path14.join(destClaudeDir, "scripts"));
+  const scriptsDir = path13.join(sourceClaudeDir, "scripts");
+  if (fs12.existsSync(scriptsDir)) {
+    copyDirRecursive(scriptsDir, path13.join(destClaudeDir, "scripts"));
   }
   applyProjectClaudeOverlay(workspacePath, destClaudeDir);
   writeStrippedMcpServersSnapshot(homeDir ?? os8.homedir(), workspacePath, destClaudeDir);
-  if (configCtx != null && configCtx.worlds_default?.agent_teams_enabled !== false) {
-    mergeHomeSettingsJson(path14.join(destClaudeDir, "settings.json"), {
-      env: { CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: "1" }
-    });
-  }
 }
 function applyProjectClaudeOverlay(workspacePath, destClaudeDir) {
-  const projectClaudeDir = path14.join(workspacePath, ".claude");
-  if (!fs13.existsSync(projectClaudeDir))
+  const projectClaudeDir = path13.join(workspacePath, ".claude");
+  if (!fs12.existsSync(projectClaudeDir))
     return;
-  const projectSettingsPath = path14.join(projectClaudeDir, "settings.json");
-  const destSettingsPath = path14.join(destClaudeDir, "settings.json");
-  if (fs13.existsSync(projectSettingsPath)) {
+  const projectSettingsPath = path13.join(projectClaudeDir, "settings.json");
+  const destSettingsPath = path13.join(destClaudeDir, "settings.json");
+  if (fs12.existsSync(projectSettingsPath)) {
     try {
-      const projectSettings = JSON.parse(fs13.readFileSync(projectSettingsPath, "utf-8"));
+      const projectSettings = JSON.parse(fs12.readFileSync(projectSettingsPath, "utf-8"));
       delete projectSettings["hooks"];
-      const existing = fs13.existsSync(destSettingsPath) ? JSON.parse(fs13.readFileSync(destSettingsPath, "utf-8")) : {};
+      const existing = fs12.existsSync(destSettingsPath) ? JSON.parse(fs12.readFileSync(destSettingsPath, "utf-8")) : {};
       const merged = { ...existing, ...projectSettings, hooks: existing["hooks"] };
-      fs13.writeFileSync(destSettingsPath, JSON.stringify(merged, null, 2));
+      fs12.writeFileSync(destSettingsPath, JSON.stringify(merged, null, 2));
     } catch {
     }
   }
-  const projectClaudeMd = path14.join(projectClaudeDir, "CLAUDE.md");
-  if (fs13.existsSync(projectClaudeMd)) {
-    fs13.copyFileSync(projectClaudeMd, path14.join(destClaudeDir, "CLAUDE.md"));
+  const projectClaudeMd = path13.join(projectClaudeDir, "CLAUDE.md");
+  if (fs12.existsSync(projectClaudeMd)) {
+    fs12.copyFileSync(projectClaudeMd, path13.join(destClaudeDir, "CLAUDE.md"));
   }
-  const projectAgentsMd = path14.join(projectClaudeDir, "AGENTS.md");
-  if (fs13.existsSync(projectAgentsMd)) {
-    fs13.copyFileSync(projectAgentsMd, path14.join(destClaudeDir, "AGENTS.md"));
+  const projectAgentsMd = path13.join(projectClaudeDir, "AGENTS.md");
+  if (fs12.existsSync(projectAgentsMd)) {
+    fs12.copyFileSync(projectAgentsMd, path13.join(destClaudeDir, "AGENTS.md"));
   }
   for (const subdir of ["rules", "agents", "plugins", "skills", "scripts"]) {
-    const projectSubdir = path14.join(projectClaudeDir, subdir);
-    if (fs13.existsSync(projectSubdir)) {
+    const projectSubdir = path13.join(projectClaudeDir, subdir);
+    if (fs12.existsSync(projectSubdir)) {
       const skip = subdir === "plugins" ? SKIP_FILES : /* @__PURE__ */ new Set();
-      copyDirRecursive(projectSubdir, path14.join(destClaudeDir, subdir), 0, skip);
+      copyDirRecursive(projectSubdir, path13.join(destClaudeDir, subdir), 0, skip);
     }
   }
 }
@@ -7734,8 +7679,8 @@ function stripMcpServers(mcpServers) {
   return out;
 }
 function writeStrippedMcpServersSnapshot(homeDir, workspacePath, destClaudeDir) {
-  const hostMcpServers = readMcpServersFromFile(path14.join(homeDir, ".claude.json"));
-  const projectMcpServers = readMcpServersFromFile(path14.join(workspacePath, ".mcp.json"));
+  const hostMcpServers = readMcpServersFromFile(path13.join(homeDir, ".claude.json"));
+  const projectMcpServers = readMcpServersFromFile(path13.join(workspacePath, ".mcp.json"));
   if (Object.keys(hostMcpServers).length === 0 && Object.keys(projectMcpServers).length === 0) {
     return;
   }
@@ -7744,11 +7689,11 @@ function writeStrippedMcpServersSnapshot(homeDir, workspacePath, destClaudeDir)
     ...stripMcpServers(projectMcpServers)
   };
   const output = { mcpServers: stripped };
-  fs13.writeFileSync(path14.join(destClaudeDir, ".claude.json"), JSON.stringify(output, null, 2), { mode: 384 });
+  fs12.writeFileSync(path13.join(destClaudeDir, ".claude.json"), JSON.stringify(output, null, 2), { mode: 384 });
 }
 function writeWorldEntitlementsJson(workspacePath, configCtx) {
-  const olamDir = path14.join(workspacePath, ".olam");
-  fs13.mkdirSync(olamDir, { recursive: true });
+  const olamDir = path13.join(workspacePath, ".olam");
+  fs12.mkdirSync(olamDir, { recursive: true });
   const resolvedRepos = configCtx.repos.map((repo) => {
     const repoEntitlement = repo;
     return {
@@ -7762,14 +7707,14 @@ function writeWorldEntitlementsJson(workspacePath, configCtx) {
     worlds_default: configCtx.worlds_default,
     repos: resolvedRepos
   };
-  const filePath = path14.join(olamDir, "world-entitlements.json");
-  fs13.writeFileSync(filePath, JSON.stringify(resolved, null, 2), { mode: 420 });
+  const filePath = path13.join(olamDir, "world-entitlements.json");
+  fs12.writeFileSync(filePath, JSON.stringify(resolved, null, 2), { mode: 420 });
 }
 function readMcpServersFromFile(filePath) {
-  if (!fs13.existsSync(filePath))
+  if (!fs12.existsSync(filePath))
     return {};
   try {
-    const raw = fs13.readFileSync(filePath, "utf-8");
+    const raw = fs12.readFileSync(filePath, "utf-8");
     if (!raw.trim())
       return {};
     const parsed = JSON.parse(raw);
@@ -7784,8 +7729,8 @@ function readMcpServersFromFile(filePath) {
 function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new Set()) {
   if (depth > 10)
     return;
-  fs13.mkdirSync(dest, { recursive: true });
-  for (const entry of fs13.readdirSync(src, { withFileTypes: true })) {
+  fs12.mkdirSync(dest, { recursive: true });
+  for (const entry of fs12.readdirSync(src, { withFileTypes: true })) {
     const { name } = entry;
     if (skipFiles.has(name))
       continue;
@@ -7795,12 +7740,12 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
       continue;
     if (entry.isDirectory() && SKIP_DIRS.has(name))
       continue;
-    const srcPath = path14.join(src, name);
-    const destPath = path14.join(dest, name);
+    const srcPath = path13.join(src, name);
+    const destPath = path13.join(dest, name);
     if (entry.isSymbolicLink()) {
       let stat;
       try {
-        stat = fs13.statSync(srcPath);
+        stat = fs12.statSync(srcPath);
       } catch {
         continue;
       }
@@ -7809,12 +7754,12 @@ function copyDirRecursive(src, dest, depth = 0, skipFiles = /* @__PURE__ */ new
           continue;
         copyDirRecursive(srcPath, destPath, depth + 1, skipFiles);
       } else if (stat.isFile()) {
-        fs13.copyFileSync(srcPath, destPath);
+        fs12.copyFileSync(srcPath, destPath);
       }
     } else if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath, depth + 1, skipFiles);
     } else {
-      fs13.copyFileSync(srcPath, destPath);
+      fs12.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -7952,9 +7897,9 @@ function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, conf
     }
   }
   for (const repo of repos) {
-    const worktreePath = path14.join(workspacePath, repo.name);
+    const worktreePath = path13.join(workspacePath, repo.name);
     const sourcePath = repo.path;
-    if (!sourcePath || !fs13.existsSync(worktreePath))
+    if (!sourcePath || !fs12.existsSync(worktreePath))
       continue;
     const envSetup = repo.env_setup;
     if (!envSetup)
@@ -7973,23 +7918,23 @@ function setupWorldEnv(repos, workspacePath, serviceEnv, crossRepoEnv = {}, conf
   }
 }
 function copyMatchingFiles(sourcePath, destPath, pattern) {
-  const fullPattern = path14.join(sourcePath, pattern);
+  const fullPattern = path13.join(sourcePath, pattern);
   if (!pattern.includes("*")) {
-    const sourceFile = path14.join(sourcePath, pattern);
-    const destFile = path14.join(destPath, pattern);
-    if (fs13.existsSync(sourceFile)) {
-      fs13.mkdirSync(path14.dirname(destFile), { recursive: true });
-      fs13.copyFileSync(sourceFile, destFile);
+    const sourceFile = path13.join(sourcePath, pattern);
+    const destFile = path13.join(destPath, pattern);
+    if (fs12.existsSync(sourceFile)) {
+      fs12.mkdirSync(path13.dirname(destFile), { recursive: true });
+      fs12.copyFileSync(sourceFile, destFile);
     }
     return;
   }
   try {
     const matches2 = globSync(fullPattern);
     for (const match2 of matches2) {
-      const relative2 = path14.relative(sourcePath, match2);
-      const dest = path14.join(destPath, relative2);
-      fs13.mkdirSync(path14.dirname(dest), { recursive: true });
-      fs13.copyFileSync(match2, dest);
+      const relative2 = path13.relative(sourcePath, match2);
+      const dest = path13.join(destPath, relative2);
+      fs12.mkdirSync(path13.dirname(dest), { recursive: true });
+      fs12.copyFileSync(match2, dest);
     }
   } catch {
   }
@@ -7997,14 +7942,14 @@ function copyMatchingFiles(sourcePath, destPath, pattern) {
 function generateEnvFromExample(repoPath, overrides) {
   const exampleFiles = [".env.example", ".env.sample", ".env.local.example"];
   for (const exampleName of exampleFiles) {
-    const examplePath = path14.join(repoPath, exampleName);
-    if (!fs13.existsSync(examplePath))
+    const examplePath = path13.join(repoPath, exampleName);
+    if (!fs12.existsSync(examplePath))
       continue;
     const targetName = exampleName.replace(".example", "").replace(".sample", "");
-    const targetPath = path14.join(repoPath, targetName);
-    if (fs13.existsSync(targetPath))
+    const targetPath = path13.join(repoPath, targetName);
+    if (fs12.existsSync(targetPath))
       continue;
-    const template = fs13.readFileSync(examplePath, "utf-8");
+    const template = fs12.readFileSync(examplePath, "utf-8");
     const generated = template.split("\n").map((line) => {
       const match2 = /^([A-Z_][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match2) {
@@ -8015,13 +7960,13 @@ function generateEnvFromExample(repoPath, overrides) {
       }
       return line;
     }).join("\n");
-    fs13.writeFileSync(targetPath, generated);
+    fs12.writeFileSync(targetPath, generated);
   }
 }
 function applyEnvOverrides(repoPath, overrides) {
-  const envPath = path14.join(repoPath, ".env");
-  if (fs13.existsSync(envPath)) {
-    const existing = fs13.readFileSync(envPath, "utf-8");
+  const envPath = path13.join(repoPath, ".env");
+  if (fs12.existsSync(envPath)) {
+    const existing = fs12.readFileSync(envPath, "utf-8");
     const existingKeys = new Set(existing.split("\n").map((l) => l.split("=")[0]?.trim()).filter(Boolean));
     const additions = [];
     for (const [key, value] of Object.entries(overrides)) {
@@ -8030,7 +7975,7 @@ function applyEnvOverrides(repoPath, overrides) {
       }
     }
     if (additions.length > 0) {
-      fs13.appendFileSync(envPath, "\n# Olam injected\n" + additions.join("\n") + "\n");
+      fs12.appendFileSync(envPath, "\n# Olam injected\n" + additions.join("\n") + "\n");
     }
   }
 }
@@ -8039,7 +7984,6 @@ var init_env_setup = __esm({
   "../core/dist/world/env-setup.js"() {
     "use strict";
     init_hooks_config();
-    init_merge_settings();
     MCP_SERVER_ALLOWLIST = /* @__PURE__ */ new Set([
       "command",
       "args",
@@ -8103,9 +8047,9 @@ var init_env_setup = __esm({
 
 // ../core/dist/world/baseline-diff.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import * as fs14 from "node:fs";
+import * as fs13 from "node:fs";
 import * as os9 from "node:os";
-import * as path15 from "node:path";
+import * as path14 from "node:path";
 function expandHome(p, homedir22) {
   return p.replace(/^~(?=$|\/|\\)/, homedir22());
 }
@@ -8131,9 +8075,9 @@ ${stderr}`;
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
   const homedir22 = deps.homedir ?? (() => os9.homedir());
-  const baselineDir = path15.join(workspacePath, ".olam", "baseline");
+  const baselineDir = path14.join(workspacePath, ".olam", "baseline");
   try {
-    fs14.mkdirSync(baselineDir, { recursive: true });
+    fs13.mkdirSync(baselineDir, { recursive: true });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] mkdir ${baselineDir} failed: ${msg}; reaper will see no baseline at all`);
@@ -8145,9 +8089,9 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
     if (!repo.path)
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
-    const outPath = path15.join(baselineDir, filename);
+    const outPath = path14.join(baselineDir, filename);
     const repoPath = expandHome(repo.path, homedir22);
-    if (!fs14.existsSync(repoPath)) {
+    if (!fs13.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
 `);
@@ -8214,7 +8158,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
 }
 function writeBaselineFile(outPath, content) {
   try {
-    fs14.writeFileSync(outPath, content);
+    fs13.writeFileSync(outPath, content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[baseline-diff] write to ${outPath} failed: ${msg}`);
@@ -8222,8 +8166,8 @@ function writeBaselineFile(outPath, content) {
 }
 function stripWorktreeEdits(repos, workspacePath) {
   for (const repo of repos) {
-    const worktreePath = path15.join(workspacePath, repo.name);
-    if (!fs14.existsSync(worktreePath))
+    const worktreePath = path14.join(workspacePath, repo.name);
+    if (!fs13.existsSync(worktreePath))
       continue;
     try {
       execFileSync3("git", ["checkout", "--", "."], {
@@ -8260,12 +8204,12 @@ var init_baseline_diff = __esm({
 });
 
 // ../core/dist/world/context-injection.js
-import * as fs15 from "node:fs";
-import * as path16 from "node:path";
+import * as fs14 from "node:fs";
+import * as path15 from "node:path";
 function injectWorldContext(opts) {
   const { world, task, linearTicketId, claudeMdExtra, taskContext, services, pleriPlaneUrl } = opts;
-  const claudeDir = path16.join(world.workspacePath, ".claude");
-  fs15.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir = path15.join(world.workspacePath, ".claude");
+  fs14.mkdirSync(claudeDir, { recursive: true });
   const sections = [];
   sections.push(`# Olam World: ${world.name}`);
   sections.push("");
@@ -8426,7 +8370,7 @@ function injectWorldContext(opts) {
     sections.push("");
   }
   const content = sections.join("\n");
-  fs15.writeFileSync(path16.join(claudeDir, "CLAUDE.md"), content);
+  fs14.writeFileSync(path15.join(claudeDir, "CLAUDE.md"), content);
 }
 function formatTaskSource(ctx) {
   if (ctx.source === "linear" && ctx.ticketId) {
@@ -8440,9 +8384,9 @@ function formatTaskSource(ctx) {
 function hasPlanFile(world) {
   if (world.repos.length === 0)
     return false;
-  const plansDir = path16.join(world.workspacePath, world.repos[0], "docs", "plans");
+  const plansDir = path15.join(world.workspacePath, world.repos[0], "docs", "plans");
   try {
-    return fs15.existsSync(plansDir) && fs15.readdirSync(plansDir).length > 0;
+    return fs14.existsSync(plansDir) && fs14.readdirSync(plansDir).length > 0;
   } catch {
     return false;
   }
@@ -8687,7 +8631,7 @@ var init_stack_install = __esm({
 
 // ../core/dist/world/stack-image.js
 import { execSync as execSync2 } from "node:child_process";
-import * as crypto4 from "node:crypto";
+import * as crypto3 from "node:crypto";
 function computeFingerprint(runtimes) {
   const parts = [];
   for (const [runtime, versions] of runtimes) {
@@ -8737,14 +8681,14 @@ function getBaseImageDigest() {
     cachedBaseDigest = digest.replace("sha256:", "").slice(0, 16);
     return cachedBaseDigest;
   } catch {
-    cachedBaseDigest = crypto4.createHash("sha256").update("unknown").digest("hex").slice(0, 16);
+    cachedBaseDigest = crypto3.createHash("sha256").update("unknown").digest("hex").slice(0, 16);
     return cachedBaseDigest;
   }
 }
 function sanitizeTag(raw) {
   let tag = raw.toLowerCase().replace(/[^a-z0-9._-]/g, "-");
   if (tag.length > MAX_TAG_LENGTH) {
-    const hash = crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 12);
+    const hash = crypto3.createHash("sha256").update(raw).digest("hex").slice(0, 12);
     tag = tag.slice(0, MAX_TAG_LENGTH - 13) + "_" + hash;
   }
   return tag;
@@ -9146,14 +9090,14 @@ var init_secrets_fetcher = __esm({
 });
 
 // ../core/dist/world/olam-yaml.js
-import * as path17 from "node:path";
+import * as path16 from "node:path";
 import YAML2 from "yaml";
 function enrichReposWithManifests(repos, workspacePath) {
   return repos.map((repo) => {
     if (repo.manifest !== void 0 && repo.manifest !== null) {
       return repo;
     }
-    const repoDir = path17.join(workspacePath, repo.name);
+    const repoDir = path16.join(workspacePath, repo.name);
     let manifest = null;
     try {
       manifest = loadRepoManifest(repoDir);
@@ -9174,8 +9118,8 @@ var init_olam_yaml = __esm({
 });
 
 // ../core/dist/policies/loader.js
-import * as fs16 from "node:fs";
-import * as path18 from "node:path";
+import * as fs15 from "node:fs";
+import * as path17 from "node:path";
 import { parse as parseYaml3 } from "yaml";
 function parseFrontmatter(content) {
   const match2 = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/m.exec(content);
@@ -9195,20 +9139,20 @@ function toStringArray(v) {
   return v.filter((x) => typeof x === "string");
 }
 function loadPolicies(workspaceRoot) {
-  const policiesDir = path18.join(workspaceRoot, ".olam", "policies");
-  if (!fs16.existsSync(policiesDir))
+  const policiesDir = path17.join(workspaceRoot, ".olam", "policies");
+  if (!fs15.existsSync(policiesDir))
     return [];
   let files;
   try {
-    files = fs16.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
+    files = fs15.readdirSync(policiesDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
   const policies = [];
   for (const file of files) {
-    const filePath = path18.join(policiesDir, file);
+    const filePath = path17.join(policiesDir, file);
     try {
-      const content = fs16.readFileSync(filePath, "utf8");
+      const content = fs15.readFileSync(filePath, "utf8");
       const parsed = parseFrontmatter(content);
       if (!parsed) {
         console.warn(`[policies] skipping ${file}: no valid frontmatter block`);
@@ -9283,7 +9227,7 @@ async function startSupervisedApps(containerName, worldId, repos, exec, options
   const probeTimeoutMs = options.probeTimeoutMs ?? 3e4;
   const probeIntervalMs = options.probeIntervalMs ?? 1e3;
   const clock = options.clock ?? Date.now;
-  const sleep3 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep4 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   for (const repo of repos) {
     if (isPortBound(exec, containerName, repo.hostPort)) {
       throw new PortInUseError(repo.hostPort, repo.name, repo.manifestPath);
@@ -9308,7 +9252,7 @@ async function startSupervisedApps(containerName, worldId, repos, exec, options
     probeTimeoutMs,
     probeIntervalMs,
     clock,
-    sleep: sleep3
+    sleep: sleep4
   })));
   return {
     sessionName,
@@ -9372,7 +9316,6 @@ var manager_exports = {};
 __export(manager_exports, {
   AuthPreflightError: () => AuthPreflightError,
   BotIdentityError: () => BotIdentityError,
-  RepoSelectionRequiredError: () => RepoSelectionRequiredError,
   WorkspaceNotFoundError: () => WorkspaceNotFoundError,
   WorldManager: () => WorldManager,
   buildManifestRuntimeForTest: () => buildManifestRuntime,
@@ -9381,11 +9324,11 @@ __export(manager_exports, {
   planManifestPipeline: () => planManifestPipeline,
   runManifestRuntime: () => runManifestRuntime
 });
-import * as crypto5 from "node:crypto";
+import * as crypto4 from "node:crypto";
 import { execSync as execSync4 } from "node:child_process";
-import * as fs17 from "node:fs";
+import * as fs16 from "node:fs";
 import * as os10 from "node:os";
-import * as path19 from "node:path";
+import * as path18 from "node:path";
 import YAML3 from "yaml";
 function getTokenScopes(ghToken, _exec = execSync4) {
   try {
@@ -9724,7 +9667,7 @@ function buildManifestRuntime(worldId, repos) {
   }
   return { worldId, repos: runtimeRepos };
 }
-var BotIdentityError, ADJECTIVES, NOUNS, AuthPreflightError, WorkspaceNotFoundError, RepoSelectionRequiredError, WorldManager;
+var BotIdentityError, ADJECTIVES, NOUNS, AuthPreflightError, WorkspaceNotFoundError, WorldManager;
 var init_manager = __esm({
   "../core/dist/world/manager.js"() {
     "use strict";
@@ -9773,15 +9716,6 @@ var init_manager = __esm({
         this.name = "WorkspaceNotFoundError";
       }
     };
-    RepoSelectionRequiredError = class extends Error {
-      availableRepos;
-      constructor(availableRepos) {
-        const list = availableRepos.length > 0 ? availableRepos.join(", ") : "(none configured)";
-        super(`--repos or --workspace is required. Available repos: ${list}. Pick the subset you actually want \u2014 implicit "all repos" was removed to prevent accidental multi-repo bootstraps.`);
-        this.availableRepos = availableRepos;
-        this.name = "RepoSelectionRequiredError";
-      }
-    };
     WorldManager = class {
       config;
       provider;
@@ -9809,7 +9743,7 @@ var init_manager = __esm({
           }
         }
         const worldId = generateWorldId();
-        const workspacePath = path19.join(os10.homedir(), ".olam", "worlds", worldId);
+        const workspacePath = path18.join(os10.homedir(), ".olam", "worlds", worldId);
         const portOffset = this.registry.getNextPortOffset();
         const branch = opts.branchName ?? `olam/${worldId}`;
         const repos = this.resolveReposWithWorkspace(opts);
@@ -9866,37 +9800,37 @@ var init_manager = __esm({
           if (!repo.path)
             continue;
           const sourceRoot = repo.path.replace(/^~/, os10.homedir());
-          const worktreeRoot = path19.join(workspacePath, repo.name);
-          if (!fs17.existsSync(sourceRoot) || !fs17.existsSync(worktreeRoot))
+          const worktreeRoot = path18.join(workspacePath, repo.name);
+          if (!fs16.existsSync(sourceRoot) || !fs16.existsSync(worktreeRoot))
             continue;
           let copied = 0;
           for (const pattern of RUNTIME_FILE_PATTERNS) {
             const matches2 = [];
             if (pattern.includes("*")) {
-              const [dir, glob] = [path19.dirname(pattern), path19.basename(pattern)];
-              const sourceDir = path19.join(sourceRoot, dir);
-              if (fs17.existsSync(sourceDir)) {
+              const [dir, glob] = [path18.dirname(pattern), path18.basename(pattern)];
+              const sourceDir = path18.join(sourceRoot, dir);
+              if (fs16.existsSync(sourceDir)) {
                 const ext2 = glob.replace(/^\*+/, "");
                 try {
-                  for (const entry of fs17.readdirSync(sourceDir)) {
+                  for (const entry of fs16.readdirSync(sourceDir)) {
                     if (ext2 === "" || entry.endsWith(ext2))
-                      matches2.push(path19.join(dir, entry));
+                      matches2.push(path18.join(dir, entry));
                   }
                 } catch {
                 }
               }
-            } else if (fs17.existsSync(path19.join(sourceRoot, pattern))) {
+            } else if (fs16.existsSync(path18.join(sourceRoot, pattern))) {
               matches2.push(pattern);
             }
             for (const rel of matches2) {
-              const src = path19.join(sourceRoot, rel);
-              const dst = path19.join(worktreeRoot, rel);
+              const src = path18.join(sourceRoot, rel);
+              const dst = path18.join(worktreeRoot, rel);
               try {
-                const st = fs17.statSync(src);
+                const st = fs16.statSync(src);
                 if (!st.isFile())
                   continue;
-                fs17.mkdirSync(path19.dirname(dst), { recursive: true });
-                fs17.copyFileSync(src, dst);
+                fs16.mkdirSync(path18.dirname(dst), { recursive: true });
+                fs16.copyFileSync(src, dst);
                 copied++;
               } catch {
               }
@@ -9996,7 +9930,7 @@ var init_manager = __esm({
           try {
             const hostExec = makeHostExecFn();
             for (const repo of repos) {
-              const repoDir = path19.join(workspacePath, repo.name);
+              const repoDir = path18.join(workspacePath, repo.name);
               if (repo.stack && Object.keys(repo.stack).length > 0) {
                 preDetectedStacks.set(repo.name, { repoName: repo.name, versions: repo.stack });
               } else {
@@ -10053,10 +9987,10 @@ var init_manager = __esm({
           const worldEnv = {};
           if (opts.task)
             worldEnv.OLAM_TASK = opts.task;
-          const r2CredsPath = path19.join(os10.homedir(), ".olam", "r2-credentials.json");
-          if (fs17.existsSync(r2CredsPath)) {
+          const r2CredsPath = path18.join(os10.homedir(), ".olam", "r2-credentials.json");
+          if (fs16.existsSync(r2CredsPath)) {
             try {
-              const r2Raw = fs17.readFileSync(r2CredsPath, "utf-8").trim();
+              const r2Raw = fs16.readFileSync(r2CredsPath, "utf-8").trim();
               if (r2Raw.length > 0) {
                 const r2 = JSON.parse(r2Raw);
                 if (typeof r2.account_id === "string")
@@ -10073,10 +10007,10 @@ var init_manager = __esm({
             } catch {
             }
           }
-          const keysYamlPath = path19.join(os10.homedir(), ".olam", "keys.yaml");
-          if (fs17.existsSync(keysYamlPath)) {
+          const keysYamlPath = path18.join(os10.homedir(), ".olam", "keys.yaml");
+          if (fs16.existsSync(keysYamlPath)) {
             try {
-              const keysRaw = fs17.readFileSync(keysYamlPath, "utf-8").trim();
+              const keysRaw = fs16.readFileSync(keysYamlPath, "utf-8").trim();
               if (keysRaw.length > 0) {
                 const parsed = YAML3.parse(keysRaw);
                 if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -10123,10 +10057,10 @@ var init_manager = __esm({
                 worldEnv[k] = v;
             }
             for (const { repoName, relativePath, content } of fileWrites) {
-              const absPath = path19.join(workspacePath, repoName, relativePath);
+              const absPath = path18.join(workspacePath, repoName, relativePath);
               try {
-                fs17.mkdirSync(path19.dirname(absPath), { recursive: true });
-                fs17.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+                fs16.mkdirSync(path18.dirname(absPath), { recursive: true });
+                fs16.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
                   mode: 384
                 });
                 console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -10278,7 +10212,7 @@ var init_manager = __esm({
             let taskWithPolicies = opts.task;
             try {
               const allPolicies = repos.flatMap((repo) => {
-                const repoWorktree = path19.join(workspacePath, repo.name);
+                const repoWorktree = path18.join(workspacePath, repo.name);
                 return loadPolicies(repoWorktree);
               });
               const seen = /* @__PURE__ */ new Set();
@@ -10294,8 +10228,8 @@ var init_manager = __esm({
 ${opts.task}`;
                 execSync4(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
                 for (const repo of repos) {
-                  const policiesDir = path19.join(workspacePath, repo.name, ".olam", "policies");
-                  if (fs17.existsSync(policiesDir)) {
+                  const policiesDir = path18.join(workspacePath, repo.name, ".olam", "policies");
+                  if (fs16.existsSync(policiesDir)) {
                     execSync4(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
                   }
                 }
@@ -10374,8 +10308,8 @@ ${opts.task}`;
         } catch {
         }
         try {
-          fs17.rmSync(world.workspacePath, { recursive: true, force: true });
-          if (fs17.existsSync(world.workspacePath)) {
+          fs16.rmSync(world.workspacePath, { recursive: true, force: true });
+          if (fs16.existsSync(world.workspacePath)) {
             console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
           }
         } catch (err) {
@@ -10430,10 +10364,7 @@ ${opts.task}`;
        * Resolution precedence (matches the CF worker exactly):
        *   1. inline `opts.repos` names → look up in `config.repos`
        *   2. named `opts.workspace` → load catalog YAML, map via workspaceToRepoConfigs
-       *   3. neither → throw `RepoSelectionRequiredError`. The historical
-       *      "include every repo in config.yaml" fallback silently fanned a
-       *      single-repo audit into 7-repo bootstraps and steered
-       *      `image_selectors` to a wider tag than intended.
+       *   3. fallback → every repo declared in the project's config.yaml
        */
       resolveReposWithWorkspace(opts) {
         if (opts.repos && opts.repos.length > 0) {
@@ -10445,7 +10376,7 @@ ${opts.task}`;
             throw new WorkspaceNotFoundError(opts.workspace);
           return workspaceToRepoConfigs(ws);
         }
-        throw new RepoSelectionRequiredError(this.config.repos.map((r) => r.name));
+        return this.resolveRepos(void 0);
       }
       resolveRepos(repoNames) {
         if (!repoNames || repoNames.length === 0) {
@@ -10463,14 +10394,14 @@ ${opts.task}`;
         return names.map((name) => this.config.repos.find((r) => r.name === name)).filter((r) => r !== void 0);
       }
       transportPlanFile(planFilePath, workspacePath, repoNames) {
-        const planContent = fs17.readFileSync(planFilePath, "utf-8");
-        const planFileName = path19.basename(planFilePath);
+        const planContent = fs16.readFileSync(planFilePath, "utf-8");
+        const planFileName = path18.basename(planFilePath);
         const targetRepo = repoNames[0];
         if (!targetRepo)
           return;
-        const plansDir = path19.join(workspacePath, targetRepo, "docs", "plans");
-        fs17.mkdirSync(plansDir, { recursive: true });
-        fs17.writeFileSync(path19.join(plansDir, planFileName), planContent);
+        const plansDir = path18.join(workspacePath, targetRepo, "docs", "plans");
+        fs16.mkdirSync(plansDir, { recursive: true });
+        fs16.writeFileSync(path18.join(plansDir, planFileName), planContent);
       }
       resolveServices(repos) {
         const services = [];
@@ -10563,9 +10494,9 @@ var init_tracker = __esm({
 });
 
 // ../core/dist/world-paths.js
-import * as path20 from "node:path";
+import * as path19 from "node:path";
 function getWorldDbPath(workspacePath) {
-  return path20.join(workspacePath, WORLD_DB_FILENAME);
+  return path19.join(workspacePath, WORLD_DB_FILENAME);
 }
 var WORLD_DB_FILENAME;
 var init_world_paths = __esm({
@@ -11183,8 +11114,8 @@ var init_session_aggregator = __esm({
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs18 from "node:fs";
-import * as path21 from "node:path";
+import * as fs17 from "node:fs";
+import * as path20 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function jsonResponse(res, data, status = 200) {
   res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
@@ -11195,7 +11126,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs18.existsSync(dbPath))
+  if (!fs17.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -11366,13 +11297,13 @@ function findSessionInWorld(registry, sessionId) {
 }
 function createDashboardServer(opts) {
   const { port, registry } = opts;
-  const thisDir = path21.dirname(fileURLToPath2(import.meta.url));
-  const defaultPublicDir = path21.resolve(thisDir, "../../../control-plane/public");
+  const thisDir = path20.dirname(fileURLToPath2(import.meta.url));
+  const defaultPublicDir = path20.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs18.existsSync(publicDir);
+  let hasPublicDir = fs17.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs18.existsSync(publicDir);
+      hasPublicDir = fs17.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port}`;
     const url = new URL(req.url ?? "/", `http://${host}`);
@@ -11646,22 +11577,22 @@ function createDashboardServer(opts) {
       res.end(`<html><body style="font-family:system-ui;padding:2rem"><h1>Olam Dashboard</h1><p>The React app has not been built yet.</p><p>Run <code>npm run build:app</code> in <code>packages/control-plane</code> to build it.</p><p>API routes are available at <code>/api/*</code>.</p></body></html>`);
       return;
     }
-    let filePath = path21.join(publicDir, pathname === "/" ? "index.html" : pathname);
+    let filePath = path20.join(publicDir, pathname === "/" ? "index.html" : pathname);
     if (!filePath.startsWith(publicDir)) {
       notFound(res);
       return;
     }
-    if (fs18.existsSync(filePath) && fs18.statSync(filePath).isFile()) {
-      const ext2 = path21.extname(filePath);
+    if (fs17.existsSync(filePath) && fs17.statSync(filePath).isFile()) {
+      const ext2 = path20.extname(filePath);
       const contentType = MIME[ext2] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs18.createReadStream(filePath).pipe(res);
+      fs17.createReadStream(filePath).pipe(res);
       return;
     }
-    filePath = path21.join(publicDir, "index.html");
-    if (fs18.existsSync(filePath)) {
+    filePath = path20.join(publicDir, "index.html");
+    if (fs17.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs18.createReadStream(filePath).pipe(res);
+      fs17.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -11692,16 +11623,16 @@ var init_server = __esm({
 });
 
 // ../core/dist/dashboard/state.js
-import * as fs19 from "node:fs";
+import * as fs18 from "node:fs";
 import * as os11 from "node:os";
-import * as path22 from "node:path";
+import * as path21 from "node:path";
 function saveDashboardState(state) {
-  fs19.mkdirSync(path22.dirname(STATE_PATH), { recursive: true });
-  fs19.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs18.mkdirSync(path21.dirname(STATE_PATH), { recursive: true });
+  fs18.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs19.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs18.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -11709,7 +11640,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs19.unlinkSync(STATE_PATH);
+    fs18.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -11729,7 +11660,7 @@ var STATE_PATH;
 var init_state2 = __esm({
   "../core/dist/dashboard/state.js"() {
     "use strict";
-    STATE_PATH = path22.join(os11.homedir(), ".olam", "dashboard.json");
+    STATE_PATH = path21.join(os11.homedir(), ".olam", "dashboard.json");
   }
 });
 
@@ -12123,51 +12054,51 @@ __export(host_cp_exports, {
   writePid: () => writePid,
   writeToken: () => writeToken
 });
-import * as crypto6 from "node:crypto";
-import * as fs20 from "node:fs";
+import * as crypto5 from "node:crypto";
+import * as fs19 from "node:fs";
 import * as os12 from "node:os";
-import * as path23 from "node:path";
+import * as path22 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import Dockerode2 from "dockerode";
 function findComposeFile() {
   const candidates = [
     // Bundled path: dist/index.js lives at <pkg>/dist/; host-cp/ is a sibling of dist/
-    path23.resolve(path23.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
+    path22.resolve(path22.dirname(new URL(import.meta.url).pathname), "../host-cp/compose.yaml"),
     // Source-mode: cwd is monorepo root
-    path23.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
+    path22.resolve(process.cwd(), "packages/host-cp/compose.yaml"),
     // Source-mode: cwd is one level inside the monorepo
-    path23.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
+    path22.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
   ];
   for (const c of candidates) {
-    if (fs20.existsSync(c)) return c;
+    if (fs19.existsSync(c)) return c;
   }
-  return path23.resolve(process.cwd(), "packages/host-cp/compose.yaml");
+  return path22.resolve(process.cwd(), "packages/host-cp/compose.yaml");
 }
 function olamHome() {
-  return process.env.OLAM_HOME ?? path23.join(os12.homedir(), ".olam");
+  return process.env.OLAM_HOME ?? path22.join(os12.homedir(), ".olam");
 }
 function tokenPath() {
-  return path23.join(olamHome(), "host-cp.token");
+  return path22.join(olamHome(), "host-cp.token");
 }
 function pidPath() {
-  return path23.join(olamHome(), "host-cp.pid");
+  return path22.join(olamHome(), "host-cp.pid");
 }
 function authSecretPath() {
-  return path23.join(olamHome(), "auth-secret");
+  return path22.join(olamHome(), "auth-secret");
 }
 function readAuthSecret2() {
   const filePath = authSecretPath();
-  if (!fs20.existsSync(filePath)) return null;
-  const raw = fs20.readFileSync(filePath, "utf-8").trim();
+  if (!fs19.existsSync(filePath)) return null;
+  const raw = fs19.readFileSync(filePath, "utf-8").trim();
   return raw.length > 0 ? raw : null;
 }
 function r2CredentialsPath() {
-  return path23.join(olamHome(), "r2-credentials.json");
+  return path22.join(olamHome(), "r2-credentials.json");
 }
 function readR2Credentials() {
   const filePath = r2CredentialsPath();
-  if (!fs20.existsSync(filePath)) return null;
-  const raw = fs20.readFileSync(filePath, "utf-8").trim();
+  if (!fs19.existsSync(filePath)) return null;
+  const raw = fs19.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = JSON.parse(raw);
@@ -12188,39 +12119,39 @@ function readR2Credentials() {
   }
 }
 function writeToken() {
-  const token = crypto6.randomBytes(32).toString("hex");
+  const token = crypto5.randomBytes(32).toString("hex");
   const filePath = tokenPath();
-  fs20.mkdirSync(path23.dirname(filePath), { recursive: true });
-  fs20.writeFileSync(filePath, token, { mode: 384 });
+  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
+  fs19.writeFileSync(filePath, token, { mode: 384 });
   return token;
 }
 function readToken() {
   const filePath = tokenPath();
-  if (!fs20.existsSync(filePath)) return null;
-  return fs20.readFileSync(filePath, "utf-8").trim();
+  if (!fs19.existsSync(filePath)) return null;
+  return fs19.readFileSync(filePath, "utf-8").trim();
 }
 function removeToken() {
   const filePath = tokenPath();
-  if (!fs20.existsSync(filePath)) return false;
-  fs20.unlinkSync(filePath);
+  if (!fs19.existsSync(filePath)) return false;
+  fs19.unlinkSync(filePath);
   return true;
 }
 function writePid(pid) {
   const filePath = pidPath();
-  fs20.mkdirSync(path23.dirname(filePath), { recursive: true });
-  fs20.writeFileSync(filePath, String(pid), { mode: 420 });
+  fs19.mkdirSync(path22.dirname(filePath), { recursive: true });
+  fs19.writeFileSync(filePath, String(pid), { mode: 420 });
 }
 function readPid() {
   const filePath = pidPath();
-  if (!fs20.existsSync(filePath)) return null;
-  const raw = fs20.readFileSync(filePath, "utf-8").trim();
+  if (!fs19.existsSync(filePath)) return null;
+  const raw = fs19.readFileSync(filePath, "utf-8").trim();
   const n = parseInt(raw, 10);
   return Number.isFinite(n) ? n : null;
 }
 function removePid() {
   const filePath = pidPath();
-  if (!fs20.existsSync(filePath)) return false;
-  fs20.unlinkSync(filePath);
+  if (!fs19.existsSync(filePath)) return false;
+  fs19.unlinkSync(filePath);
   return true;
 }
 async function findHostCpContainer() {
@@ -12379,7 +12310,7 @@ async function handleStart(opts) {
   }
   const token = writeToken();
   const composeFile = findComposeFile();
-  if (!fs20.existsSync(composeFile)) {
+  if (!fs19.existsSync(composeFile)) {
     printError(`compose.yaml not found at ${composeFile}. Run from the olam project root.`);
     removeToken();
     process.exitCode = 1;
@@ -12461,7 +12392,7 @@ async function stopHostCp() {
 }
 async function handleStop() {
   const composeFile = findComposeFile();
-  if (!fs20.existsSync(composeFile)) {
+  if (!fs19.existsSync(composeFile)) {
     printWarning(`compose.yaml not found at ${composeFile}. Cleaning up token + PID anyway.`);
     removeToken();
     removePid();
@@ -12489,13 +12420,13 @@ async function buildStatusReport() {
   const container = await findHostCpContainer();
   const health = await probeHealth();
   const tokenFile = tokenPath();
-  const tokenPresent = fs20.existsSync(tokenFile);
+  const tokenPresent = fs19.existsSync(tokenFile);
   let tokenModeOk = false;
   if (tokenPresent) {
-    const mode = fs20.statSync(tokenFile).mode & 511;
+    const mode = fs19.statSync(tokenFile).mode & 511;
     tokenModeOk = mode === 384;
   }
-  const pidPresent = fs20.existsSync(pidPath());
+  const pidPresent = fs19.existsSync(pidPath());
   let stack;
   if (!container) {
     stack = "not_started";
@@ -12583,13 +12514,13 @@ async function discoverWorldPort(worldId) {
 }
 async function readHostCpToken2() {
   const tp = tokenPath();
-  if (!fs20.existsSync(tp)) return null;
-  return fs20.readFileSync(tp, "utf-8").trim();
+  if (!fs19.existsSync(tp)) return null;
+  return fs19.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path45, body) {
+async function callHostCpProxy(method, worldId, path44, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path45}`;
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path44}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -12714,17 +12645,17 @@ __export(install_root_exports, {
   isDevMode: () => isDevMode,
   resolveBuildScript: () => resolveBuildScript
 });
-import { existsSync as existsSync19 } from "node:fs";
-import { dirname as dirname14, join as join24, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { dirname as dirname13, join as join24, resolve as resolve6 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function installRoot(metaUrl = import.meta.url) {
   const here = fileURLToPath3(metaUrl);
-  return resolve6(dirname14(here), "..");
+  return resolve6(dirname13(here), "..");
 }
 function isDevMode(env = process.env, installRootDir = installRoot()) {
   if (env.OLAM_DEV !== "1") return false;
   const repoRoot = resolve6(installRootDir, "..", "..");
-  return existsSync19(join24(repoRoot, "packages")) && existsSync19(join24(repoRoot, "package.json"));
+  return existsSync18(join24(repoRoot, "packages")) && existsSync18(join24(repoRoot, "package.json"));
 }
 function resolveBuildScript(input) {
   const { scriptRelPath, env = process.env, installRootDir = installRoot() } = input;
@@ -12903,20 +12834,20 @@ var init_registry_allowlist = __esm({
 });
 
 // ../core/dist/world/world-yaml.js
-import * as fs22 from "node:fs";
-import * as path25 from "node:path";
+import * as fs21 from "node:fs";
+import * as path24 from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
 function writeWorldYaml(worldPath, data) {
-  const olamDir = path25.join(worldPath, ".olam");
-  fs22.mkdirSync(olamDir, { recursive: true });
-  fs22.writeFileSync(path25.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
+  const olamDir = path24.join(worldPath, ".olam");
+  fs21.mkdirSync(olamDir, { recursive: true });
+  fs21.writeFileSync(path24.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
 }
 function readWorldYaml(worldPath) {
-  const yamlPath = path25.join(worldPath, ".olam", "world.yaml");
-  if (!fs22.existsSync(yamlPath))
+  const yamlPath = path24.join(worldPath, ".olam", "world.yaml");
+  if (!fs21.existsSync(yamlPath))
     return null;
   try {
-    const raw = fs22.readFileSync(yamlPath, "utf-8");
+    const raw = fs21.readFileSync(yamlPath, "utf-8");
     const parsed = parseYaml4(raw);
     return WorldYamlSchema.parse(parsed);
   } catch {
@@ -13047,16 +12978,16 @@ __export(machine_schema_exports, {
   readMachineConfig: () => readMachineConfig,
   writeMachineConfig: () => writeMachineConfig
 });
-import * as fs36 from "node:fs";
-import * as path40 from "node:path";
+import * as fs35 from "node:fs";
+import * as path39 from "node:path";
 import * as os21 from "node:os";
 import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
 function readMachineConfig(configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  if (!fs36.existsSync(p))
+  if (!fs35.existsSync(p))
     return null;
   try {
-    const raw = fs36.readFileSync(p, "utf-8");
+    const raw = fs35.readFileSync(p, "utf-8");
     const parsed = parseYaml5(raw);
     return MachineConfigSchema.parse(parsed);
   } catch {
@@ -13065,8 +12996,8 @@ function readMachineConfig(configPath) {
 }
 function writeMachineConfig(config, configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  fs36.mkdirSync(path40.dirname(p), { recursive: true });
-  fs36.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
+  fs35.mkdirSync(path39.dirname(p), { recursive: true });
+  fs35.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
 }
 function initMachineConfig(opts = {}) {
   const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
@@ -13089,16 +13020,16 @@ var init_machine_schema = __esm({
       channel: external_exports.enum(["stable", "beta", "edge"]).default("stable"),
       auto_update: external_exports.boolean().default(true),
       telemetry: external_exports.boolean().default(true),
-      worlds_dir: external_exports.string().default(() => path40.join(os21.homedir(), ".olam", "worlds"))
+      worlds_dir: external_exports.string().default(() => path39.join(os21.homedir(), ".olam", "worlds"))
     });
-    DEFAULT_CONFIG_PATH = path40.join(os21.homedir(), ".olam", "config.yaml");
+    DEFAULT_CONFIG_PATH = path39.join(os21.homedir(), ".olam", "config.yaml");
   }
 });
 
 // src/index.ts
 import { Command } from "commander";
-import * as fs40 from "node:fs";
-import * as path44 from "node:path";
+import * as fs39 from "node:fs";
+import * as path43 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/commands/init.ts
@@ -13475,9 +13406,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path45) {
-    super(`Archetype inheritance cycle detected: ${path45.join(" \u2192 ")} \u2192 ${path45[0] ?? "?"}`);
-    this.path = path45;
+  constructor(path44) {
+    super(`Archetype inheritance cycle detected: ${path44.join(" \u2192 ")} \u2192 ${path44[0] ?? "?"}`);
+    this.path = path44;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -13671,7 +13602,7 @@ function registerInstall(program2) {
 // src/commands/auth.ts
 init_auth();
 init_output();
-import pc8 from "picocolors";
+import pc9 from "picocolors";
 import * as readline from "node:readline/promises";
 import { spawn as spawn3 } from "node:child_process";
 
@@ -13680,174 +13611,17 @@ import * as fs8 from "node:fs";
 import * as os5 from "node:os";
 import * as path9 from "node:path";
 import pc5 from "picocolors";
-
-// ../auth-logic/dist/effective-state.js
-function effectiveState(account, now = Date.now()) {
-  const persisted = account.state ?? (account.rateLimited ? "cooldown" : "active");
-  if (persisted === "disabled")
-    return "disabled";
-  if (account.expiresAt != null && account.expiresAt <= now)
-    return "expired";
-  if (persisted === "cooldown" || persisted === "usage-capped") {
-    const reset = account.rateLimitResetsAt ? new Date(account.rateLimitResetsAt).getTime() : 0;
-    if (reset > 0 && reset <= now)
-      return "active";
-    return persisted;
-  }
-  return "active";
-}
-
-// ../auth-logic/dist/pick-credential.js
-function pickCredential(accounts, now = Date.now()) {
-  const active = accounts.filter((a) => effectiveState(a, now) === "active");
-  if (active.length === 0)
-    return null;
-  return [...active].sort((a, b) => {
-    const aCount = a.usage?.requestCount5h ?? 0;
-    const bCount = b.usage?.requestCount5h ?? 0;
-    if (aCount !== bCount)
-      return aCount - bCount;
-    const aLast = a.lastUsed ? new Date(a.lastUsed).getTime() : 0;
-    const bLast = b.lastUsed ? new Date(b.lastUsed).getTime() : 0;
-    return aLast - bLast;
-  })[0] ?? null;
-}
-
-// ../auth-logic/dist/next-cooldown-reset.js
-function nextCooldownReset(accounts, now = Date.now()) {
-  const upcoming = accounts.filter((a) => effectiveState(a, now) === "cooldown").map((a) => a.rateLimitResetsAt ? new Date(a.rateLimitResetsAt).getTime() : 0).filter((ts) => ts > now).sort((a, b) => a - b);
-  return upcoming.length > 0 ? new Date(upcoming[0]).toISOString() : null;
-}
-
-// src/commands/auth-status.ts
 init_auth();
 init_output();
 init_exit_codes();
 var LOCAL_DATA_DIR = path9.join(os5.homedir(), ".olam", "auth-data");
-function localHHMM(isoStr) {
-  const d = new Date(isoStr);
-  return d.toLocaleTimeString(void 0, {
-    hour: "2-digit",
-    minute: "2-digit",
-    hour12: false
-  });
-}
-function daysAgoStr(expiresAt, now) {
-  const diffDays = Math.floor((now - expiresAt) / (1e3 * 60 * 60 * 24));
-  if (diffDays <= 0) return "expired today";
-  return `expired ${diffDays} day${diffDays === 1 ? "" : "s"} ago`;
-}
-function trunc(s, maxLen) {
-  return s.length > maxLen ? s.slice(0, maxLen) : s;
-}
-var STATE_PRIORITY = {
-  active: 0,
-  cooldown: 1,
-  "usage-capped": 2,
-  disabled: 3,
-  expired: 4
-};
-function formatAuthStatus(accounts, now = Date.now()) {
-  const picked = pickCredential(accounts, now);
-  const rows = accounts.map((account) => {
-    const state = effectiveState(account, now);
-    const isPicked = picked != null && account.id === picked.id;
-    const req5h = account.usage?.requestCount5h ?? 0;
-    const last429 = account.usage?.last429At ? localHHMM(account.usage.last429At) : "never";
-    let reason;
-    if (isPicked) {
-      reason = "\u2190 selected";
-    } else if (state === "active") {
-      reason = `req5h=${req5h} (higher than candidate)`;
-    } else if (state === "cooldown") {
-      const resetTime = account.rateLimitResetsAt ? localHHMM(account.rateLimitResetsAt) : "?";
-      reason = `cooldown until ${resetTime}`;
-    } else if (state === "expired") {
-      reason = daysAgoStr(account.expiresAt ?? 0, now);
-    } else {
-      reason = "disabled";
-    }
-    return { id: account.id, label: account.accountLabel ?? account.id, state, reason, req5h, last429, isPicked };
-  });
-  rows.sort((a, b) => {
-    if (a.isPicked !== b.isPicked) return a.isPicked ? -1 : 1;
-    return STATE_PRIORITY[a.state] - STATE_PRIORITY[b.state];
-  });
-  const COL = { id: 17, label: 17, state: 11, reason: 28, req5h: 7 };
-  const lines = [];
-  const hdr = "id".padEnd(COL.id) + "label".padEnd(COL.label) + "state".padEnd(COL.state) + "reason".padEnd(COL.reason) + "req5h".padEnd(COL.req5h) + "last429";
-  lines.push(pc5.dim(hdr));
-  lines.push(pc5.dim("-".repeat(hdr.length)));
-  for (const row of rows) {
-    const id = trunc(row.id, 16).padEnd(COL.id);
-    const label = trunc(row.label, 16).padEnd(COL.label);
-    const stateRaw = row.state.padEnd(COL.state);
-    const stateColored = row.state === "active" ? pc5.green(stateRaw) : row.state === "cooldown" ? pc5.yellow(stateRaw) : row.state === "expired" ? pc5.red(stateRaw) : pc5.dim(stateRaw);
-    const reason = row.reason.padEnd(COL.reason);
-    const req5h = String(row.req5h).padEnd(COL.req5h);
-    if (row.isPicked) {
-      lines.push(
-        pc5.bold(id) + pc5.bold(label) + stateColored + pc5.green(reason) + pc5.dim(req5h) + pc5.dim(row.last429)
-      );
-    } else {
-      lines.push(id + label + stateColored + reason + pc5.dim(req5h) + pc5.dim(row.last429));
-    }
-  }
-  if (picked == null) {
-    const resetIso = nextCooldownReset(accounts, now);
-    lines.push("");
-    lines.push(
-      resetIso ? pc5.yellow(`Next reset: ${localHHMM(resetIso)}`) : pc5.dim("No reset scheduled")
-    );
-    return { output: lines.join("\n"), exitCode: EXIT_AUTH_NEEDS_ATTENTION };
-  }
-  return { output: lines.join("\n"), exitCode: 0 };
-}
-function toSafeAccount(a) {
-  return {
-    id: a.id,
-    accountLabel: a.accountLabel,
-    // expiresAt not exposed in summary — state is pre-computed server-side
-    rateLimited: a.rateLimited,
-    rateLimitResetsAt: a.rateLimitResetsAt,
-    lastUsed: a.lastUsed,
-    state: a.state,
-    usage: a.usage ? { requestCount5h: a.usage.requestCount5h, last429At: a.usage.last429At } : void 0
-  };
-}
-async function runAuthStatus(getStatus) {
-  const fetchStatus = getStatus ?? (() => new AuthClient().status());
-  let status;
-  try {
-    status = await fetchStatus();
-  } catch {
-    printError("Failed to contact auth service. Run `olam auth up` first.");
-    process.exitCode = 1;
-    return;
-  }
-  if (!status.reachable) {
-    printError("Auth container is not reachable. Run `olam auth up` first.");
-    process.exitCode = 1;
-    return;
-  }
-  if (status.accounts.length === 0) {
-    console.log(pc5.dim("No credentials found. Run: olam auth login"));
-    return;
-  }
-  const accounts = status.accounts.map(toSafeAccount);
-  const result = formatAuthStatus(accounts);
-  console.log(result.output);
-  if (result.exitCode !== 0) {
-    process.exitCode = result.exitCode;
-  }
-}
 
 // src/commands/auth-upgrade.ts
 init_output();
 init_host_cp();
 init_auth();
-import * as fs21 from "node:fs";
-import * as path24 from "node:path";
+import * as fs20 from "node:fs";
+import * as path23 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 import ora2 from "ora";
 import pc7 from "picocolors";
@@ -13858,20 +13632,20 @@ init_exit_codes();
 init_protocol_version();
 init_output();
 import { spawn as spawn2, spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync15 } from "node:fs";
 import { join as join25 } from "node:path";
 import ora from "ora";
 import pc6 from "picocolors";
 function loadImageDigests(installRootDir = installRoot()) {
   const digestsPath = join25(installRootDir, "dist", "image-digests.json");
-  if (!existsSync20(digestsPath)) {
+  if (!existsSync19(digestsPath)) {
     throw new Error(
       `image-digests.json missing at ${digestsPath}. Re-run \`npm install -g @pleri/olam-cli@<version>\` to refresh the tarball.`
     );
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync16(digestsPath, "utf8"));
+    parsed = JSON.parse(readFileSync15(digestsPath, "utf8"));
   } catch (err) {
     throw new Error(`image-digests.json is not valid JSON: ${err.message}`);
   }
@@ -14129,9 +13903,9 @@ async function runBootstrap2(opts, deps = {}) {
     printSuccess("Smoke world created");
   }
   printHeader("Stack ready");
-  printInfo("host-cp", `running (${digests["host-cp"].slice(0, 19)}\u2026)`);
-  printInfo("auth", `running (${digests.auth.slice(0, 19)}\u2026)`);
-  printInfo("devbox", `pulled (${digests.devbox.slice(0, 19)}\u2026)`);
+  printInfo("olam-host-cp", `running (${digests["host-cp"].slice(0, 19)}\u2026)`);
+  printInfo("olam-auth", `running (${digests.auth.slice(0, 19)}\u2026)`);
+  printInfo("olam-devbox", `pulled (${digests.devbox.slice(0, 19)}\u2026)`);
   printInfo("next", '`olam create --task "your task"` to spawn a world');
   return { exitCode: 0, summary: "stack ready" };
 }
@@ -14171,8 +13945,8 @@ function parseAuthUpgradeOpts(raw) {
   };
 }
 function validateAuthRepoRoot(cwd) {
-  const marker = path24.join(cwd, "packages/auth-service/Dockerfile");
-  if (!fs21.existsSync(marker)) {
+  const marker = path23.join(cwd, "packages/auth-service/Dockerfile");
+  if (!fs20.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -14539,6 +14313,185 @@ function registerAuthUpgrade(auth) {
   });
 }
 
+// src/commands/services.ts
+init_auth();
+init_output();
+import { execFileSync as execFileSync4, spawnSync as spawnSync8 } from "node:child_process";
+import pc8 from "picocolors";
+var MCP_AUTH_PORT = 9998;
+var MCP_AUTH_VOLUME = "olam-mcp-auth-data";
+var MCP_AUTH_CONTAINER = "olam-mcp-auth";
+var MCP_AUTH_LOCAL_TAG = "olam-mcp-auth:local";
+var MCP_AUTH_PUBLISHED_TAG = "ghcr.io/pleri/olam-mcp-auth:latest";
+var MCP_AUTH_HEALTH_URL = `http://127.0.0.1:${MCP_AUTH_PORT}/health`;
+var MCP_AUTH_HEALTH_TIMEOUT_MS = 15e3;
+var McpAuthContainerController = class {
+  imageTag = MCP_AUTH_LOCAL_TAG;
+  status() {
+    const r = spawnSync8(
+      "docker",
+      ["inspect", "--format", "{{.State.Status}}|{{.Id}}", MCP_AUTH_CONTAINER],
+      { encoding: "utf-8" }
+    );
+    if (r.status === 0) {
+      const [stateRaw, id] = r.stdout.trim().split("|");
+      return {
+        state: stateRaw === "running" ? "running" : "stopped",
+        port: MCP_AUTH_PORT,
+        containerId: id
+      };
+    }
+    return { state: "missing", port: MCP_AUTH_PORT };
+  }
+  imageExists(tag = this.imageTag) {
+    return spawnSync8("docker", ["image", "inspect", tag], { encoding: "utf-8" }).status === 0;
+  }
+  start() {
+    const current = this.status();
+    if (current.state === "running") return;
+    if (current.state === "stopped") {
+      execFileSync4("docker", ["start", MCP_AUTH_CONTAINER], { stdio: "pipe" });
+      return;
+    }
+    if (!this.imageExists()) {
+      if (this.imageTag !== MCP_AUTH_PUBLISHED_TAG && this.imageExists(MCP_AUTH_PUBLISHED_TAG)) {
+        this.imageTag = MCP_AUTH_PUBLISHED_TAG;
+      } else {
+        throw new Error(
+          `mcp-auth image '${this.imageTag}' not found locally. Run \`olam bootstrap\` to pull the published image.`
+        );
+      }
+    }
+    execFileSync4(
+      "docker",
+      [
+        "run",
+        "--detach",
+        "--name",
+        MCP_AUTH_CONTAINER,
+        "--restart",
+        "unless-stopped",
+        "--publish",
+        `${MCP_AUTH_PORT}:${MCP_AUTH_PORT}`,
+        "--volume",
+        `${MCP_AUTH_VOLUME}:/mcp-auth-data`,
+        this.imageTag
+      ],
+      { stdio: "pipe" }
+    );
+  }
+  stop() {
+    const current = this.status();
+    if (current.state !== "running") return;
+    execFileSync4("docker", ["stop", MCP_AUTH_CONTAINER], { stdio: "pipe" });
+  }
+  remove() {
+    spawnSync8("docker", ["rm", "-f", MCP_AUTH_CONTAINER], { stdio: "pipe" });
+  }
+  async waitForReady(timeoutMs = MCP_AUTH_HEALTH_TIMEOUT_MS) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      try {
+        const res = await fetch(MCP_AUTH_HEALTH_URL, { signal: AbortSignal.timeout(1500) });
+        if (res.ok) return true;
+      } catch {
+      }
+      await sleep3(500);
+    }
+    return false;
+  }
+};
+function sleep3(ms) {
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
+}
+async function servicesUp() {
+  const auth = new AuthContainerController();
+  const mcpAuth = new McpAuthContainerController();
+  const authStatus = auth.status();
+  if (authStatus.state === "running") {
+    printSuccess(`olam-auth already running on :${authStatus.port}`);
+  } else {
+    try {
+      auth.start();
+    } catch (err) {
+      printError(`olam-auth failed to start: ${err instanceof Error ? err.message : String(err)}`);
+      return { exitCode: 1 };
+    }
+    const ready = await auth.waitForReady(15e3);
+    if (!ready) {
+      printWarning("olam-auth started but /health did not respond within 15s.");
+      return { exitCode: 1 };
+    }
+    printSuccess("olam-auth started");
+  }
+  const mcpStatus = mcpAuth.status();
+  if (mcpStatus.state === "running") {
+    printSuccess(`olam-mcp-auth already running on :${mcpStatus.port}`);
+  } else {
+    try {
+      mcpAuth.start();
+    } catch (err) {
+      printError(`olam-mcp-auth failed to start: ${err instanceof Error ? err.message : String(err)}`);
+      return { exitCode: 1 };
+    }
+    const ready = await mcpAuth.waitForReady();
+    if (!ready) {
+      printWarning("olam-mcp-auth started but /health did not respond within 15s.");
+      return { exitCode: 1 };
+    }
+    printSuccess("olam-mcp-auth started");
+  }
+  printHeader("Services up");
+  printInfo("olam-auth", ":9999");
+  printInfo("olam-mcp-auth", ":9998");
+  return { exitCode: 0 };
+}
+function servicesDown() {
+  const auth = new AuthContainerController();
+  const mcpAuth = new McpAuthContainerController();
+  let exitCode = 0;
+  try {
+    auth.stop();
+    printSuccess("olam-auth stopped.");
+  } catch (err) {
+    printError(`olam-auth: ${err instanceof Error ? err.message : String(err)}`);
+    exitCode = 1;
+  }
+  try {
+    mcpAuth.stop();
+    printSuccess("olam-mcp-auth stopped.");
+  } catch (err) {
+    printError(`olam-mcp-auth: ${err instanceof Error ? err.message : String(err)}`);
+    exitCode = 1;
+  }
+  return { exitCode };
+}
+function servicesStatus() {
+  const auth = new AuthContainerController();
+  const mcpAuth = new McpAuthContainerController();
+  printHeader("Services status");
+  const authState = auth.status();
+  const authStateStr = authState.state === "running" ? pc8.green("running") : authState.state === "stopped" ? pc8.yellow("stopped") : pc8.red("missing");
+  printInfo("olam-auth", `${authStateStr}  :${authState.port}`);
+  const mcpState = mcpAuth.status();
+  const mcpStateStr = mcpState.state === "running" ? pc8.green("running") : mcpState.state === "stopped" ? pc8.yellow("stopped") : pc8.red("missing");
+  printInfo("olam-mcp-auth", `${mcpStateStr}  :${mcpState.port}`);
+}
+function registerServices(program2) {
+  const services = program2.command("services").description("Manage Olam service containers (olam-auth, olam-mcp-auth)");
+  services.command("up").description("Start all service containers (idempotent)").action(async () => {
+    const result = await servicesUp();
+    if (result.exitCode !== 0) process.exitCode = result.exitCode;
+  });
+  services.command("down").description("Stop all service containers").action(() => {
+    const result = servicesDown();
+    if (result.exitCode !== 0) process.exitCode = result.exitCode;
+  });
+  services.command("status").description("Show state of all service containers").action(() => {
+    servicesStatus();
+  });
+}
+
 // src/commands/auth.ts
 function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
@@ -14559,44 +14512,19 @@ async function promptLine(question) {
 }
 function registerAuth(program2) {
   const auth = program2.command("auth").description("Manage the local Claude auth container");
-  auth.command("up").description("Start the auth container (idempotent)").action(async () => {
-    const controller = new AuthContainerController();
-    const initial = controller.status();
-    if (initial.state === "running") {
-      printSuccess(`Auth container already running on :${initial.port}`);
-      return;
-    }
-    try {
-      controller.start();
-    } catch (err) {
-      printError(err instanceof Error ? err.message : "failed to start");
-      process.exitCode = 1;
-      return;
-    }
-    const ready = await controller.waitForReady(15e3);
-    if (!ready) {
-      printWarning("Container started but /health did not respond within 15s.");
-      process.exitCode = 1;
-      return;
-    }
-    printHeader("Auth container up");
-    printInfo("Port", String(initial.port));
-    printInfo("Volume", "olam-auth-data");
-    console.log(`
-${pc8.dim("Next: olam auth login")}`);
+  auth.command("up").description("[deprecated] Start the auth container \u2014 use `olam services up` instead").action(async () => {
+    printWarning("`olam auth up` is deprecated. Use `olam services up` instead.");
+    const result = await servicesUp();
+    if (result.exitCode !== 0) process.exitCode = result.exitCode;
   });
-  auth.command("down").description("Stop the auth container (tokens persist in the volume)").action(() => {
-    const controller = new AuthContainerController();
-    try {
-      controller.stop();
-      printSuccess("Auth container stopped.");
-    } catch (err) {
-      printError(err instanceof Error ? err.message : "failed to stop");
-      process.exitCode = 1;
-    }
+  auth.command("down").description("[deprecated] Stop the auth container \u2014 use `olam services down` instead").action(() => {
+    printWarning("`olam auth down` is deprecated. Use `olam services down` instead.");
+    const result = servicesDown();
+    if (result.exitCode !== 0) process.exitCode = result.exitCode;
   });
-  auth.command("status").description("Show credential states from auth-service (same source as `auth list`)").action(async () => {
-    await runAuthStatus();
+  auth.command("status").description("[deprecated] Show container state \u2014 use `olam services status` instead").action(() => {
+    printWarning("`olam auth status` is deprecated. Use `olam services status` instead.");
+    servicesStatus();
   });
   auth.command("list").description("List all stored credentials with state, usage, and rate-limit status").action(async () => {
     const client = new AuthClient();
@@ -14608,15 +14536,15 @@ ${pc8.dim("Next: olam auth login")}`);
     }
     printHeader(`Credentials (${status.accounts.length})`);
     if (status.accounts.length === 0) {
-      console.log(`  ${pc8.dim("No credentials \u2014 run: olam auth login --label primary")}`);
+      console.log(`  ${pc9.dim("No credentials \u2014 run: olam auth login --label primary")}`);
       return;
     }
     const stateColor = (s) => {
-      if (s === "active") return pc8.green("active");
-      if (s === "cooldown") return pc8.yellow("cooldown");
-      if (s === "expired") return pc8.red("expired");
-      if (s === "disabled") return pc8.dim("disabled");
-      return pc8.dim(s ?? "unknown");
+      if (s === "active") return pc9.green("active");
+      if (s === "cooldown") return pc9.yellow("cooldown");
+      if (s === "expired") return pc9.red("expired");
+      if (s === "disabled") return pc9.dim("disabled");
+      return pc9.dim(s ?? "unknown");
     };
     for (const a of status.accounts) {
       const label = a.accountLabel ?? a.id;
@@ -14624,7 +14552,7 @@ ${pc8.dim("Next: olam auth login")}`);
       const last429 = a.usage?.last429At ? `last429=${a.usage.last429At}` : "last429=never";
       const reset = a.rateLimitResetsAt ? `resets=${a.rateLimitResetsAt}` : "";
       console.log(
-        `  ${pc8.bold(label.padEnd(18))} ${stateColor(a.state).padEnd(18)} ${pc8.dim(`req5h=${reqs}`)}  ${pc8.dim(`exp=${a.expiresIn}`)} ${pc8.dim(last429)} ${pc8.yellow(reset)}`
+        `  ${pc9.bold(label.padEnd(18))} ${stateColor(a.state).padEnd(18)} ${pc9.dim(`req5h=${reqs}`)}  ${pc9.dim(`exp=${a.expiresIn}`)} ${pc9.dim(last429)} ${pc9.yellow(reset)}`
       );
     }
   });
@@ -14662,7 +14590,7 @@ ${pc8.dim("Next: olam auth login")}`);
     const preflight = await runAuthPreflight({ autoStart: true });
     if (preflight.verdict !== "ok" && preflight.verdict !== "no-accounts") {
       printError(preflight.message);
-      console.log(`  ${pc8.dim(preflight.remedy)}`);
+      console.log(`  ${pc9.dim(preflight.remedy)}`);
       process.exitCode = 1;
       return;
     }
@@ -14695,14 +14623,14 @@ ${pc8.dim("Next: olam auth login")}`);
     }
     printHeader("Claude OAuth \u2014 PKCE flow");
     console.log(`
-  ${pc8.bold("1.")} Opening Claude in your default browser\u2026`);
-    console.log(`     ${pc8.dim(pending.loginUrl)}`);
+  ${pc9.bold("1.")} Opening Claude in your default browser\u2026`);
+    console.log(`     ${pc9.dim(pending.loginUrl)}`);
     openBrowser(pending.loginUrl);
     console.log(`
-  ${pc8.bold("2.")} After approving, paste the authorization code from the redirect page.`);
-    console.log(`     ${pc8.dim("(Format: <code>#<state> or just <code>.)")}
+  ${pc9.bold("2.")} After approving, paste the authorization code from the redirect page.`);
+    console.log(`     ${pc9.dim("(Format: <code>#<state> or just <code>.)")}
 `);
-    const raw = await promptLine(`${pc8.dim("code:")} `);
+    const raw = await promptLine(`${pc9.dim("code:")} `);
     if (!raw) {
       printError("No code provided.");
       process.exitCode = 1;
@@ -14713,7 +14641,7 @@ ${pc8.dim("Next: olam auth login")}`);
       const result = await client.completeLogin(statePart, codePart);
       printSuccess(`Account stored: ${result.account} (${result.expiresIn})`);
       console.log(`
-${pc8.dim("Next: olam create --name my-world")}`);
+${pc9.dim("Next: olam create --name my-world")}`);
     } catch (err) {
       printError(err instanceof Error ? err.message : "token exchange failed");
       process.exitCode = 1;
@@ -14744,15 +14672,15 @@ ${pc8.dim("Next: olam create --name my-world")}`);
 
 // src/commands/create.ts
 init_manager();
-import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync23 } from "node:fs";
-import { dirname as dirname15, resolve as resolve7 } from "node:path";
+import { spawnSync as spawnSync9 } from "node:child_process";
+import { existsSync as existsSync22 } from "node:fs";
+import { dirname as dirname14, resolve as resolve7 } from "node:path";
 import ora3 from "ora";
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 
 // ../core/dist/world/devbox-freshness.js
 import { execSync as execSync6 } from "node:child_process";
-import { existsSync as existsSync22, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync21, statSync as statSync5 } from "node:fs";
 import { join as join27 } from "node:path";
 var DEFAULT_DEVBOX_IMAGE = "olam-devbox:latest";
 var DEVBOX_BAKED_SOURCES = [
@@ -14821,9 +14749,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path45, mtimeMs } of result.newerSources) {
+  for (const { path: path44, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path45}  (modified ${when})`);
+    lines.push(`  \u2022 ${path44}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -14842,7 +14770,7 @@ function defaultDockerInspect(image) {
 }
 function defaultStatMtime(absPath) {
   try {
-    if (!existsSync22(absPath))
+    if (!existsSync21(absPath))
       return null;
     return statSync5(absPath).mtimeMs;
   } catch {
@@ -14982,15 +14910,15 @@ init_host_cp();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs41 } = await import("node:fs");
+    const { default: fs40 } = await import("node:fs");
     const { default: os24 } = await import("node:os");
-    const { default: path45 } = await import("node:path");
-    const tp = path45.join(
-      process.env.OLAM_HOME ?? path45.join(os24.homedir(), ".olam"),
+    const { default: path44 } = await import("node:path");
+    const tp = path44.join(
+      process.env.OLAM_HOME ?? path44.join(os24.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs41.existsSync(tp)) return null;
-    return fs41.readFileSync(tp, "utf-8").trim();
+    if (!fs40.existsSync(tp)) return null;
+    return fs40.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -15015,7 +14943,7 @@ function registerCreate(program2) {
       if (decision.stderrLine) {
         process.stderr.write(decision.stderrLine + "\n");
       }
-      spawnSync8("docker", ["pull", overrideRef], { stdio: "pipe" });
+      spawnSync9("docker", ["pull", overrideRef], { stdio: "pipe" });
       const { inspectImageProtocolVersions: inspectImageProtocolVersions2, checkProtocolOverlap: checkProtocolOverlap2 } = await Promise.resolve().then(() => (init_protocol_version(), protocol_version_exports));
       const inspect = inspectImageProtocolVersions2(overrideRef);
       if (inspect.inspectFailed) {
@@ -15064,9 +14992,9 @@ function registerCreate(program2) {
             const reason = inferred.repos.length === 0 ? "no repo names extracted from prompt" : `inference confidence ${inferred.confidence.toFixed(2)} below ${PICKER_CONFIDENCE_THRESHOLD}`;
             printError(`Picker needed: ${reason}`);
             if (catalogRepos.length > 0) {
-              console.log(pc9.dim(`  available repos: ${catalogRepos.join(", ")}`));
+              console.log(pc10.dim(`  available repos: ${catalogRepos.join(", ")}`));
             }
-            console.log(pc9.dim("  rerun with explicit --workspace <name> or --repos <a> <b> <c>"));
+            console.log(pc10.dim("  rerun with explicit --workspace <name> or --repos <a> <b> <c>"));
             process.exitCode = 1;
             return;
           }
@@ -15084,7 +15012,7 @@ function registerCreate(program2) {
             inferenceSpinner.fail(`Multiple workspaces match (${decision.result})`);
             const cands = decision.result === "exact-N" ? decision.candidates.map((w) => w.name) : decision.candidates.map((c) => c.workspace.name);
             printError(`Picker needed: ${cands.join(", ")}`);
-            console.log(pc9.dim("  rerun with explicit --workspace <name>"));
+            console.log(pc10.dim("  rerun with explicit --workspace <name>"));
             process.exitCode = 1;
             return;
           } else {
@@ -15132,7 +15060,7 @@ function registerCreate(program2) {
             throw err;
           }
           const spinner2 = ora3("Rebuilding olam-devbox:latest\u2026").start();
-          const rebuild = spawnSync8(
+          const rebuild = spawnSync9(
             "bash",
             [buildScript],
             { cwd: repoRoot, stdio: "inherit" }
@@ -15198,10 +15126,10 @@ function registerCreate(program2) {
       }
       if (world.credentialsInjected?.claude) {
         console.log(`
-${pc9.green("Credentials injected. World is ready for dispatch.")}`);
+${pc10.green("Credentials injected. World is ready for dispatch.")}`);
       } else if (world.dashboardUrl) {
         console.log(`
-${pc9.yellow("Authenticate at")} ${world.dashboardUrl}`);
+${pc10.yellow("Authenticate at")} ${world.dashboardUrl}`);
       }
       if (opts.hostCp !== false) {
         const probeResult = await probeHostCp().catch(() => null);
@@ -15213,14 +15141,14 @@ ${pc9.yellow("Authenticate at")} ${world.dashboardUrl}`);
           process.stderr.write(
             [
               "",
-              pc9.red("Host CP probe failed."),
+              pc10.red("Host CP probe failed."),
               `  tried: http://127.0.0.1:19000/api/bootstrap \u2192 ${diag.bootstrapStatus}`,
               `  tried: docker container "olam-host-cp" \u2192 ${diag.containerStatus}`,
               "",
-              pc9.yellow("World was created but the SPA inbox will not show it until you:"),
-              `  ${pc9.cyan("olam host-cp start")}            (start the host CP)`,
-              `  ${pc9.cyan(`olam host-cp register --world ${world.id}`)}   (register manually)`,
-              `  OR pass ${pc9.dim("--no-host-cp")} on next create to suppress this check.`,
+              pc10.yellow("World was created but the SPA inbox will not show it until you:"),
+              `  ${pc10.cyan("olam host-cp start")}            (start the host CP)`,
+              `  ${pc10.cyan(`olam host-cp register --world ${world.id}`)}   (register manually)`,
+              `  OR pass ${pc10.dim("--no-host-cp")} on next create to suppress this check.`,
               ""
             ].join("\n")
           );
@@ -15252,13 +15180,13 @@ ${pc9.yellow("Authenticate at")} ${world.dashboardUrl}`);
           process.stderr.write(
             [
               "",
-              pc9.red("Host CP registry POST failed."),
+              pc10.red("Host CP registry POST failed."),
               `  url: ${hostCpUrl}/api/admin/registry`,
               `  status: ${reg.status}`,
               `  error: ${reg.error}`,
               "",
-              pc9.yellow("World was created but not registered. Run manually:"),
-              `  ${pc9.cyan(`olam host-cp register --world ${world.id}`)}`,
+              pc10.yellow("World was created but not registered. Run manually:"),
+              `  ${pc10.cyan(`olam host-cp register --world ${world.id}`)}`,
               ""
             ].join("\n")
           );
@@ -15313,7 +15241,7 @@ ${pc9.yellow("Authenticate at")} ${world.dashboardUrl}`);
         }
         const worldUrl = `${hostCpUrl}/world/${encodeURIComponent(world.id)}`;
         console.log(`
-${pc9.cyan("Host CP UI:")} ${worldUrl}`);
+${pc10.cyan("Host CP UI:")} ${worldUrl}`);
         if (opts.open !== false && reg.ok) {
           const openResult = openUrl(worldUrl);
           if (openResult.opened) {
@@ -15327,14 +15255,7 @@ ${pc9.cyan("Host CP UI:")} ${worldUrl}`);
       spinner.fail("Failed to create world");
       if (err instanceof AuthPreflightError) {
         printError(err.message);
-        if (err.remedy) console.log(`  ${pc9.dim(err.remedy)}`);
-      } else if (err instanceof RepoSelectionRequiredError) {
-        printError(err.message);
-        if (err.availableRepos.length > 0) {
-          const example = err.availableRepos[0];
-          console.log(`  ${pc9.dim(`Example: olam create --name <name> --repos ${example} --task "<task>"`)}`);
-          console.log(`  ${pc9.dim('Or:      olam create --name <name> --workspace <workspace> --task "<task>"')}`);
-        }
+        if (err.remedy) console.log(`  ${pc10.dim(err.remedy)}`);
       } else {
         printError(err instanceof Error ? err.message : String(err));
       }
@@ -15345,10 +15266,10 @@ ${pc9.cyan("Host CP UI:")} ${worldUrl}`);
 function resolveRepoRoot(start) {
   let cur = start;
   while (true) {
-    if (existsSync23(resolve7(cur, "packages")) && existsSync23(resolve7(cur, "package.json"))) {
+    if (existsSync22(resolve7(cur, "packages")) && existsSync22(resolve7(cur, "package.json"))) {
       return cur;
     }
-    const parent = dirname15(cur);
+    const parent = dirname14(cur);
     if (parent === cur) return start;
     cur = parent;
   }
@@ -15359,12 +15280,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs41 } = await import("node:fs");
+    const { default: fs40 } = await import("node:fs");
     const { default: os24 } = await import("node:os");
-    const { default: path45 } = await import("node:path");
-    const tp = path45.join(os24.homedir(), ".olam", "host-cp.token");
-    if (!fs41.existsSync(tp)) return null;
-    const raw = fs41.readFileSync(tp, "utf-8").trim();
+    const { default: path44 } = await import("node:path");
+    const tp = path44.join(os24.homedir(), ".olam", "host-cp.token");
+    if (!fs40.existsSync(tp)) return null;
+    const raw = fs40.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -15409,7 +15330,7 @@ async function fetchHostCpExactMatches(projects) {
 init_context();
 init_output();
 import ora4 from "ora";
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 
 // ../core/dist/orchestrator/dispatch.js
 var DEEP_MODE_SUFFIX = "\n\nUltrathink and use sub-agents (the Agent tool) to parallelize independent work. Break complex tasks into focused sub-tasks.";
@@ -15496,7 +15417,7 @@ OLAM_EOF`
       const containerName = `olam-${worldId}-devbox`;
       console.log(
         `
-${pc10.dim(`Watch live: docker exec -it ${containerName} tmux attach -t claude-main -r`)}`
+${pc11.dim(`Watch live: docker exec -it ${containerName} tmux attach -t claude-main -r`)}`
       );
     } catch (err) {
       spinner.fail("Dispatch failed");
@@ -15509,7 +15430,7 @@ ${pc10.dim(`Watch live: docker exec -it ${containerName} tmux attach -t claude-m
 // src/commands/observe.ts
 init_context();
 init_output();
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 function registerObserve(program2) {
   program2.command("observe").description("Stream thoughts from a world (coming soon)").argument("<world>", "World ID").action(async (worldId) => {
     const { ctx, error } = await loadContext();
@@ -15529,15 +15450,15 @@ function registerObserve(program2) {
       checkVersionPin2(worldId, world.workspacePath);
     }
     console.log(
-      pc11.yellow("Observation is coming in a future release.")
+      pc12.yellow("Observation is coming in a future release.")
     );
     console.log(
-      pc11.dim("This will stream the world's reasoning in real-time.")
+      pc12.dim("This will stream the world's reasoning in real-time.")
     );
     const containerName = `olam-${worldId}-devbox`;
     console.log(
       `
-${pc11.dim(`For now: docker exec -it ${containerName} tmux attach -t claude-main -r`)}`
+${pc12.dim(`For now: docker exec -it ${containerName} tmux attach -t claude-main -r`)}`
     );
   });
 }
@@ -15545,7 +15466,7 @@ ${pc11.dim(`For now: docker exec -it ${containerName} tmux attach -t claude-main
 // src/commands/list.ts
 init_context();
 init_output();
-import pc12 from "picocolors";
+import pc13 from "picocolors";
 function registerList(program2) {
   program2.command("list").alias("ls").description("List active worlds").action(async () => {
     const { ctx, error } = await loadContext();
@@ -15556,18 +15477,18 @@ function registerList(program2) {
     }
     const worlds = ctx.worldManager.listWorlds();
     if (worlds.length === 0) {
-      console.log(pc12.dim("No worlds. Create one with `olam create --name my-world`."));
+      console.log(pc13.dim("No worlds. Create one with `olam create --name my-world`."));
       return;
     }
-    console.log(`${pc12.bold(String(worlds.length))} world(s)
+    console.log(`${pc13.bold(String(worlds.length))} world(s)
 `);
     for (const w of worlds) {
-      const statusColor = w.status === "running" ? pc12.green(w.status) : w.status === "error" ? pc12.red(w.status) : pc12.yellow(w.status);
+      const statusColor = w.status === "running" ? pc13.green(w.status) : w.status === "error" ? pc13.red(w.status) : pc13.yellow(w.status);
       const age = formatAge(w.createdAt);
       const cost = `$${w.totalCostUsd.toFixed(2)}`;
-      console.log(`  ${pc12.bold(w.name)} ${pc12.dim(`(${w.id})`)}`);
+      console.log(`  ${pc13.bold(w.name)} ${pc13.dim(`(${w.id})`)}`);
       console.log(
-        `    ${statusColor}  ${pc12.dim("|")}  ${w.repos.join(", ")}  ${pc12.dim("|")}  ${cost}  ${pc12.dim("|")}  ${age}`
+        `    ${statusColor}  ${pc13.dim("|")}  ${w.repos.join(", ")}  ${pc13.dim("|")}  ${cost}  ${pc13.dim("|")}  ${age}`
       );
       console.log();
     }
@@ -15576,9 +15497,9 @@ function registerList(program2) {
 
 // src/commands/status.ts
 init_output();
-import * as fs23 from "node:fs";
+import * as fs22 from "node:fs";
 import * as os13 from "node:os";
-import * as path26 from "node:path";
+import * as path25 from "node:path";
 var CLI_VERSION2 = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
 var HOST_CP_PORT2 = 19e3;
 async function getMachineStatus(_probe, _loadCtx, _readToken) {
@@ -15608,14 +15529,14 @@ async function getMachineStatus(_probe, _loadCtx, _readToken) {
     }
   } catch {
   }
-  const manifestPath2 = path26.join(os13.homedir(), ".olam", "cache", "manifest.json");
+  const manifestPath2 = path25.join(os13.homedir(), ".olam", "cache", "manifest.json");
   let updateAvailable = null;
   let lastUpdateCheck = null;
-  if (fs23.existsSync(manifestPath2)) {
-    const mtime = fs23.statSync(manifestPath2).mtime;
+  if (fs22.existsSync(manifestPath2)) {
+    const mtime = fs22.statSync(manifestPath2).mtime;
     lastUpdateCheck = mtime.toISOString();
     try {
-      const manifest = JSON.parse(fs23.readFileSync(manifestPath2, "utf-8"));
+      const manifest = JSON.parse(fs22.readFileSync(manifestPath2, "utf-8"));
       const latest = manifest["version"];
       updateAvailable = latest !== void 0 && latest !== CLI_VERSION2;
     } catch {
@@ -15738,10 +15659,10 @@ function registerDestroy(program2) {
 // src/commands/clean.ts
 init_context();
 init_output();
-import fs24 from "node:fs";
+import fs23 from "node:fs";
 import os14 from "node:os";
-import path27 from "node:path";
-import { execFileSync as execFileSync4 } from "node:child_process";
+import path26 from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
 function registerClean(program2) {
   program2.command("clean").description("Reap orphan world filesystem state under ~/.olam/worlds/").option("--apply", "Actually delete the orphans (default is dry-run)", false).option(
     "--include-dirty",
@@ -15764,8 +15685,8 @@ async function runClean(opts) {
     printError(error?.message ?? "Olam is not configured. Run `olam init` first.");
     return 1;
   }
-  const worldsDir = path27.join(os14.homedir(), ".olam", "worlds");
-  if (!fs24.existsSync(worldsDir)) {
+  const worldsDir = path26.join(os14.homedir(), ".olam", "worlds");
+  if (!fs23.existsSync(worldsDir)) {
     if (opts.json) {
       process.stdout.write(`${JSON.stringify({ worldsDir, entries: [] })}
 `);
@@ -15780,8 +15701,8 @@ async function runClean(opts) {
   }
   const worktreeMap = collectWorktrees(worldsDir);
   const entries = [];
-  for (const id of fs24.readdirSync(worldsDir).sort()) {
-    const fullPath = path27.join(worldsDir, id);
+  for (const id of fs23.readdirSync(worldsDir).sort()) {
+    const fullPath = path26.join(worldsDir, id);
     const stat = safeStat(fullPath);
     if (!stat || !stat.isDirectory()) continue;
     entries.push(classifyWorld({ id, fullPath, liveIds, worktreeMap }));
@@ -15847,7 +15768,7 @@ function classifyWorld(args) {
   if (liveIds.has(id)) {
     return { id, path: fullPath, bytes, category: "active", note: "in registry" };
   }
-  const worktreeChild = path27.join(fullPath, "olam");
+  const worktreeChild = path26.join(fullPath, "olam");
   const worktreeInfo = worktreeMap.get(worktreeChild);
   if (worktreeInfo) {
     if (worktreeInfo.dirty > 0 || worktreeInfo.unpushed > 0) {
@@ -15884,7 +15805,7 @@ function reapEntry(entry) {
     try {
       const gitDir = resolveGitDirForWorktree(entry.worktreePath);
       if (gitDir) {
-        execFileSync4("git", ["worktree", "remove", "--force", entry.worktreePath], {
+        execFileSync5("git", ["worktree", "remove", "--force", entry.worktreePath], {
           cwd: gitDir,
           stdio: "pipe"
         });
@@ -15893,20 +15814,20 @@ function reapEntry(entry) {
     }
   }
   try {
-    fs24.rmSync(entry.path, { recursive: true, force: true });
+    fs23.rmSync(entry.path, { recursive: true, force: true });
   } catch (err) {
     process.stderr.write(`  ! rm ${entry.path}: ${err instanceof Error ? err.message : String(err)}
 `);
     return false;
   }
-  return !fs24.existsSync(entry.path);
+  return !fs23.existsSync(entry.path);
 }
 function collectWorktrees(worldsDir) {
   const out = /* @__PURE__ */ new Map();
-  for (const id of fs24.readdirSync(worldsDir)) {
-    const child = path27.join(worldsDir, id, "olam");
-    const gitMarker = path27.join(child, ".git");
-    if (!fs24.existsSync(gitMarker)) continue;
+  for (const id of fs23.readdirSync(worldsDir)) {
+    const child = path26.join(worldsDir, id, "olam");
+    const gitMarker = path26.join(child, ".git");
+    if (!fs23.existsSync(gitMarker)) continue;
     const gitDir = resolveGitDirForWorktree(child);
     if (!gitDir) continue;
     const branch = readBranch(child);
@@ -15917,21 +15838,21 @@ function collectWorktrees(worldsDir) {
   return out;
 }
 function resolveGitDirForWorktree(worktreePath) {
-  const gitMarker = path27.join(worktreePath, ".git");
+  const gitMarker = path26.join(worktreePath, ".git");
   try {
-    const top = execFileSync4("git", ["rev-parse", "--show-toplevel"], {
+    const top = execFileSync5("git", ["rev-parse", "--show-toplevel"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
     }).trim();
     if (!top) return null;
-    const common = execFileSync4("git", ["rev-parse", "--git-common-dir"], {
+    const common = execFileSync5("git", ["rev-parse", "--git-common-dir"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
     }).trim();
     if (!common) return top;
-    return path27.dirname(path27.resolve(worktreePath, common));
+    return path26.dirname(path26.resolve(worktreePath, common));
   } catch {
     return null;
   }
@@ -15939,7 +15860,7 @@ function resolveGitDirForWorktree(worktreePath) {
 }
 function readBranch(worktreePath) {
   try {
-    return execFileSync4("git", ["branch", "--show-current"], {
+    return execFileSync5("git", ["branch", "--show-current"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
@@ -15950,7 +15871,7 @@ function readBranch(worktreePath) {
 }
 function countDirty(worktreePath) {
   try {
-    const out = execFileSync4("git", ["status", "--porcelain"], {
+    const out = execFileSync5("git", ["status", "--porcelain"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
@@ -15962,7 +15883,7 @@ function countDirty(worktreePath) {
 }
 function countUnpushed(worktreePath) {
   try {
-    const out = execFileSync4("git", ["log", "@{u}..HEAD", "--oneline"], {
+    const out = execFileSync5("git", ["log", "@{u}..HEAD", "--oneline"], {
       cwd: worktreePath,
       encoding: "utf-8",
       stdio: "pipe"
@@ -15974,7 +15895,7 @@ function countUnpushed(worktreePath) {
 }
 function safeStat(p) {
   try {
-    return fs24.statSync(p);
+    return fs23.statSync(p);
   } catch {
     return null;
   }
@@ -15986,7 +15907,7 @@ function computeBytes(p) {
     const cur = stack.pop();
     let st;
     try {
-      st = fs24.lstatSync(cur);
+      st = fs23.lstatSync(cur);
     } catch {
       continue;
     }
@@ -15994,11 +15915,11 @@ function computeBytes(p) {
     if (st.isDirectory()) {
       let entries;
       try {
-        entries = fs24.readdirSync(cur);
+        entries = fs23.readdirSync(cur);
       } catch {
         continue;
       }
-      for (const name of entries) stack.push(path27.join(cur, name));
+      for (const name of entries) stack.push(path26.join(cur, name));
     } else {
       total += st.size;
     }
@@ -16051,7 +15972,7 @@ async function confirmInteractive() {
 init_context();
 init_output();
 import { execSync as execSync7 } from "node:child_process";
-import pc13 from "picocolors";
+import pc14 from "picocolors";
 var SAFE_IDENT3 = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function buildStartClaudeCommands(containerName, sessionName, task) {
   if (!SAFE_IDENT3.test(containerName)) {
@@ -16158,7 +16079,7 @@ function registerEnter(program2) {
       }
       console.log("Run these commands in order to enter the world:\n");
       for (const step of steps) {
-        console.log(`  ${pc13.dim(`# ${step.description}`)}`);
+        console.log(`  ${pc14.dim(`# ${step.description}`)}`);
         if (step.stdin !== void 0) {
           const escaped = step.stdin.replace(/'/g, "'\\''");
           console.log(`  printf '%s' '${escaped}' | ${step.command}`);
@@ -16192,11 +16113,11 @@ function registerEnter(program2) {
       return;
     }
     console.log("Run this command to enter the world:\n");
-    console.log(`  ${pc13.bold(result.command)}`);
+    console.log(`  ${pc14.bold(result.command)}`);
     const containerName = `olam-${worldId}-devbox`;
     console.log(
       `
-${pc13.dim(`Observe dispatch: docker exec -it ${containerName} tmux attach -t olam-dispatch -r`)}`
+${pc14.dim(`Observe dispatch: docker exec -it ${containerName} tmux attach -t olam-dispatch -r`)}`
     );
   });
 }
@@ -16206,7 +16127,7 @@ init_context();
 init_output();
 init_exit_codes();
 init_world_paths();
-import * as fs25 from "node:fs";
+import * as fs24 from "node:fs";
 import "node:path";
 import ora6 from "ora";
 function registerCrystallize(program2, options = {}) {
@@ -16238,7 +16159,7 @@ function registerCrystallize(program2, options = {}) {
       return;
     }
     const thoughtDbPath = getWorldDbPath(world.workspacePath);
-    if (!fs25.existsSync(thoughtDbPath)) {
+    if (!fs24.existsSync(thoughtDbPath)) {
       printError(`No thoughts captured yet for "${worldId}". Run a dispatch first.`);
       process.exitCode = EXIT_GENERIC_ERROR;
       return;
@@ -16308,7 +16229,7 @@ function registerCrystallize(program2, options = {}) {
 
 // src/commands/pr.ts
 init_registry();
-import pc14 from "picocolors";
+import pc15 from "picocolors";
 
 // ../core/dist/pr-gate/client.js
 var HOST_CONTROL_PLANE_BASE2 = 19080;
@@ -16389,26 +16310,26 @@ async function findGate(id) {
   return null;
 }
 function formatStateBadge(state) {
-  if (state === "approve") return pc14.green("approve");
-  if (state === "block") return pc14.red("block");
-  if (state === "denied") return pc14.gray("denied");
-  return pc14.yellow("pending");
+  if (state === "approve") return pc15.green("approve");
+  if (state === "block") return pc15.red("block");
+  if (state === "denied") return pc15.gray("denied");
+  return pc15.yellow("pending");
 }
 function registerPr(program2) {
   const pr = program2.command("pr").description("Review and decide PR-gate requests from running worlds");
   pr.command("list").description("List all PR-gate requests across every running world").action(async () => {
     const all = await fanoutList();
     if (all.length === 0) {
-      console.log(pc14.dim("No gates open."));
+      console.log(pc15.dim("No gates open."));
       return;
     }
     printHeader(`${all.length} gate(s)`);
     for (const { world, gate } of all) {
       const badge = formatStateBadge(gate.state);
       console.log(
-        `  ${pc14.bold(gate.id.slice(0, 8))} ${badge.padEnd(20)} ${pc14.dim(world.name)} ${pc14.dim(gate.branch)}`
+        `  ${pc15.bold(gate.id.slice(0, 8))} ${badge.padEnd(20)} ${pc15.dim(world.name)} ${pc15.dim(gate.branch)}`
       );
-      console.log(`    ${pc14.dim(gate.command.slice(0, 100))}`);
+      console.log(`    ${pc15.dim(gate.command.slice(0, 100))}`);
     }
   });
   pr.command("show").description("Show full gate detail (diff, command, commits)").argument("<id>", "Gate id (prefix match ok)").action(async (id) => {
@@ -16431,9 +16352,9 @@ function registerPr(program2) {
       if (gate.reason) printInfo("Reason", gate.reason);
     }
     printHeader("Commits");
-    console.log(gate.commitLog || pc14.dim("  (empty)"));
+    console.log(gate.commitLog || pc15.dim("  (empty)"));
     printHeader("Diff stat");
-    console.log(gate.diffStat || pc14.dim("  (empty)"));
+    console.log(gate.diffStat || pc15.dim("  (empty)"));
   });
   function decideCommand(verb, decision) {
     pr.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} a pending gate`).argument("<id>", "Gate id").option("--reason <reason>", "Short free-text reason").option("--by <name>", "Deciding identity (defaults to $USER)", process.env["USER"] ?? "human").action(async (id, opts) => {
@@ -16558,7 +16479,7 @@ function registerLanes(program2) {
 // src/commands/policy-check.ts
 init_loader2();
 import { execSync as execSync8 } from "node:child_process";
-import pc15 from "picocolors";
+import pc16 from "picocolors";
 
 // ../../node_modules/balanced-match/dist/esm/index.js
 var balanced = (a, b, str) => {
@@ -17612,11 +17533,11 @@ var qmarksTestNoExtDot = ([$0]) => {
   return (f) => f.length === len && f !== "." && f !== "..";
 };
 var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-var path29 = {
+var path28 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep = defaultPlatform === "win32" ? path29.win32.sep : path29.posix.sep;
+var sep = defaultPlatform === "win32" ? path28.win32.sep : path28.posix.sep;
 minimatch.sep = sep;
 var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
@@ -18418,7 +18339,7 @@ function registerPolicyCheck(program2) {
     const workspaceRoot = opts.workspace ?? process.cwd();
     const policies = loadPolicies(workspaceRoot);
     if (policies.length === 0) {
-      console.log(pc15.dim("policy-check: no policies found in .olam/policies/ \u2014 nothing to enforce"));
+      console.log(pc16.dim("policy-check: no policies found in .olam/policies/ \u2014 nothing to enforce"));
       return;
     }
     const diff = getDiff(opts.base, workspaceRoot);
@@ -18427,11 +18348,11 @@ function registerPolicyCheck(program2) {
     for (const result of results) {
       if (result.passed) continue;
       if (result.severity === "error") {
-        console.error(`${pc15.red("policy error")} [${result.policyId}]`);
+        console.error(`${pc16.red("policy error")} [${result.policyId}]`);
         console.error(result.message);
         hasErrorFailure = true;
       } else {
-        console.warn(`${pc15.yellow("policy warn")} [${result.policyId}]`);
+        console.warn(`${pc16.yellow("policy warn")} [${result.policyId}]`);
         console.warn(result.message);
       }
     }
@@ -18444,23 +18365,23 @@ function registerPolicyCheck(program2) {
 // src/commands/upgrade.ts
 init_output();
 init_host_cp();
-import * as fs28 from "node:fs";
-import * as path32 from "node:path";
-import { spawnSync as spawnSync10 } from "node:child_process";
+import * as fs27 from "node:fs";
+import * as path31 from "node:path";
+import { spawnSync as spawnSync11 } from "node:child_process";
 import ora7 from "ora";
-import pc16 from "picocolors";
+import pc17 from "picocolors";
 
 // src/commands/upgrade-lock.ts
-import * as fs26 from "node:fs";
+import * as fs25 from "node:fs";
 import * as os15 from "node:os";
-import * as path30 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
-var LOCK_FILE_PATH = path30.join(os15.homedir(), ".olam", ".upgrade.lock");
+import * as path29 from "node:path";
+import { spawnSync as spawnSync10 } from "node:child_process";
+var LOCK_FILE_PATH = path29.join(os15.homedir(), ".olam", ".upgrade.lock");
 var STALE_LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 function readLockFile(lockPath) {
   try {
-    if (!fs26.existsSync(lockPath)) return null;
-    const raw = fs26.readFileSync(lockPath, "utf-8").trim();
+    if (!fs25.existsSync(lockPath)) return null;
+    const raw = fs25.readFileSync(lockPath, "utf-8").trim();
     if (raw.length === 0) return null;
     const parsed = JSON.parse(raw);
     if (typeof parsed.pid !== "number" || typeof parsed.startTs !== "number") return null;
@@ -18479,7 +18400,7 @@ function isPidAlive(pid) {
 }
 var PS_UNAVAILABLE = "__ps_unavailable__";
 function getPidCommand(pid) {
-  const result = spawnSync9("ps", ["-p", String(pid), "-o", "comm="], {
+  const result = spawnSync10("ps", ["-p", String(pid), "-o", "comm="], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "ignore"]
   });
@@ -18505,16 +18426,16 @@ function isStaleLock(content, nowMs = Date.now()) {
   return false;
 }
 function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
-  const dir = path30.dirname(lockPath);
-  fs26.mkdirSync(dir, { recursive: true });
+  const dir = path29.dirname(lockPath);
+  fs25.mkdirSync(dir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = fs26.openSync(lockPath, "wx", 420);
+      const fd = fs25.openSync(lockPath, "wx", 420);
       try {
         const content = { pid: process.pid, startTs: nowMs };
-        fs26.writeSync(fd, JSON.stringify(content));
+        fs25.writeSync(fd, JSON.stringify(content));
       } finally {
-        fs26.closeSync(fd);
+        fs25.closeSync(fd);
       }
       return { acquired: true, lockPath };
     } catch (err) {
@@ -18523,7 +18444,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
       const existing2 = readLockFile(lockPath);
       if (isStaleLock(existing2, nowMs)) {
         try {
-          fs26.unlinkSync(lockPath);
+          fs25.unlinkSync(lockPath);
         } catch (unlinkErr) {
           const ucode = unlinkErr.code;
           if (ucode !== "ENOENT") throw unlinkErr;
@@ -18548,7 +18469,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
 }
 function releaseLock(lockPath = LOCK_FILE_PATH) {
   try {
-    fs26.unlinkSync(lockPath);
+    fs25.unlinkSync(lockPath);
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") throw err;
@@ -18566,19 +18487,19 @@ function formatRefusalMessage(result, lockPath = LOCK_FILE_PATH) {
 }
 
 // src/commands/upgrade-log.ts
-import * as fs27 from "node:fs";
+import * as fs26 from "node:fs";
 import * as os16 from "node:os";
-import * as path31 from "node:path";
+import * as path30 from "node:path";
 function getUpgradeLogPath() {
   const home = process.env["HOME"] ?? os16.homedir();
-  return path31.join(home, ".olam", "upgrade.log");
+  return path30.join(home, ".olam", "upgrade.log");
 }
 var UPGRADE_LOG_PATH = getUpgradeLogPath();
 function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   try {
-    fs27.mkdirSync(path31.dirname(logPath), { recursive: true });
+    fs26.mkdirSync(path30.dirname(logPath), { recursive: true });
     const line = JSON.stringify(row) + "\n";
-    fs27.appendFileSync(logPath, line, { mode: 420 });
+    fs26.appendFileSync(logPath, line, { mode: 420 });
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to append: ${err instanceof Error ? err.message : String(err)}
@@ -18587,10 +18508,10 @@ function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   }
 }
 function readUpgradeLog(limit = 10, logPath = getUpgradeLogPath()) {
-  if (!fs27.existsSync(logPath)) return [];
+  if (!fs26.existsSync(logPath)) return [];
   let raw;
   try {
-    raw = fs27.readFileSync(logPath, "utf-8");
+    raw = fs26.readFileSync(logPath, "utf-8");
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to read: ${err instanceof Error ? err.message : String(err)}
@@ -18683,12 +18604,12 @@ init_protocol_version();
 init_install_root();
 var AUTH_HEALTH_URL2 = "http://127.0.0.1:9999/health";
 function isNodeModulesInSync(cwd) {
-  const lockPath = path32.join(cwd, "package-lock.json");
-  const markerPath = path32.join(cwd, "node_modules", ".package-lock.json");
-  if (!fs28.existsSync(lockPath) || !fs28.existsSync(markerPath)) return false;
+  const lockPath = path31.join(cwd, "package-lock.json");
+  const markerPath = path31.join(cwd, "node_modules", ".package-lock.json");
+  if (!fs27.existsSync(lockPath) || !fs27.existsSync(markerPath)) return false;
   try {
-    const lockStat = fs28.statSync(lockPath);
-    const markerStat = fs28.statSync(markerPath);
+    const lockStat = fs27.statSync(lockPath);
+    const markerStat = fs27.statSync(markerPath);
     return markerStat.mtimeMs >= lockStat.mtimeMs;
   } catch {
     return false;
@@ -18704,8 +18625,8 @@ function shouldSkipInstall(opts, cwd) {
   return { skip: false };
 }
 function validateRepoRoot(cwd) {
-  const marker = path32.join(cwd, "packages/host-cp/compose.yaml");
-  if (!fs28.existsSync(marker)) {
+  const marker = path31.join(cwd, "packages/host-cp/compose.yaml");
+  if (!fs27.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -18737,8 +18658,8 @@ function extractBundleHash(indexHtml) {
 }
 function runStep2(label, cmd, args, opts = {}) {
   const start = Date.now();
-  process.stdout.write(`  ${pc16.dim(label.padEnd(34))}`);
-  const result = spawnSync10(cmd, [...args], {
+  process.stdout.write(`  ${pc17.dim(label.padEnd(34))}`);
+  const result = spawnSync11(cmd, [...args], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd: opts.cwd ?? process.cwd(),
@@ -18747,7 +18668,7 @@ function runStep2(label, cmd, args, opts = {}) {
   const durationMs = Date.now() - start;
   const ok = result.status === 0 && result.error === void 0;
   const dur = `${(durationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${dur}
+  process.stdout.write(`${ok ? pc17.green("\u2713") : pc17.red("\u2717")} ${dur}
 `);
   return {
     ok,
@@ -18757,7 +18678,7 @@ function runStep2(label, cmd, args, opts = {}) {
   };
 }
 function isGitDirty(cwd) {
-  const result = spawnSync10("git", ["status", "--porcelain"], {
+  const result = spawnSync11("git", ["status", "--porcelain"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -18765,7 +18686,7 @@ function isGitDirty(cwd) {
   return (result.stdout ?? "").trim().length > 0;
 }
 function hasGitUpstream(cwd) {
-  const result = spawnSync10("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
+  const result = spawnSync11("git", ["rev-parse", "--abbrev-ref", "@{u}"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -18773,7 +18694,7 @@ function hasGitUpstream(cwd) {
   return result.status === 0;
 }
 function captureHeadSha(cwd) {
-  const result = spawnSync10("git", ["rev-parse", "HEAD"], {
+  const result = spawnSync11("git", ["rev-parse", "HEAD"], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"],
     cwd
@@ -18788,7 +18709,7 @@ function abbreviateSha(sha) {
 }
 function imageExists(tag) {
   try {
-    const result = spawnSync10("docker", ["image", "inspect", "--format", "{{.Id}}", tag], {
+    const result = spawnSync11("docker", ["image", "inspect", "--format", "{{.Id}}", tag], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -18802,10 +18723,12 @@ function checkRollbackSetExists(plan) {
   if (missing.length === 0) return null;
   return missing.join(", ");
 }
+var SMOKE_DOCKER_TIMEOUT_MS = 3e4;
 function smokeImage(image, targetSha) {
-  const createResult = spawnSync10("docker", ["create", "--name", `olam-smoke-${Date.now()}`, image], {
+  const createResult = spawnSync11("docker", ["create", "--name", `olam-smoke-${Date.now()}`, image], {
     encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: SMOKE_DOCKER_TIMEOUT_MS
   });
   if (createResult.status !== 0) {
     return {
@@ -18816,18 +18739,20 @@ function smokeImage(image, targetSha) {
     };
   }
   const containerId = (createResult.stdout ?? "").trim();
-  const inspectResult = spawnSync10(
+  const inspectResult = spawnSync11(
     "docker",
     ["inspect", "--format", '{{index .Config.Labels "olam.build.sha"}}', image],
     {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: SMOKE_DOCKER_TIMEOUT_MS
     }
   );
   if (containerId.length > 0) {
-    spawnSync10("docker", ["rm", "-f", containerId], {
+    spawnSync11("docker", ["rm", "-f", containerId], {
       encoding: "utf-8",
-      stdio: ["ignore", "ignore", "ignore"]
+      stdio: ["ignore", "ignore", "ignore"],
+      timeout: SMOKE_DOCKER_TIMEOUT_MS
     });
   }
   if (inspectResult.status !== 0) {
@@ -18864,7 +18789,7 @@ var PRODUCTION_SWAP_PLAN = [
 ];
 function dockerTag(source, dest) {
   try {
-    const result = spawnSync10("docker", ["tag", source, dest], {
+    const result = spawnSync11("docker", ["tag", source, dest], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -19028,11 +18953,11 @@ async function waitForAuthHealthLocal(timeoutMs = AUTH_HEALTH_TIMEOUT_MS) {
 async function recreateAuthService() {
   const start = Date.now();
   try {
-    spawnSync10("docker", ["stop", "olam-auth"], {
+    spawnSync11("docker", ["stop", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
-    spawnSync10("docker", ["rm", "olam-auth"], {
+    spawnSync11("docker", ["rm", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -19057,9 +18982,9 @@ async function recreateAuthService() {
   }
 }
 function readBundleHash(cwd) {
-  const indexPath = path32.join(cwd, "packages/control-plane/public/index.html");
-  if (!fs28.existsSync(indexPath)) return null;
-  return extractBundleHash(fs28.readFileSync(indexPath, "utf-8"));
+  const indexPath = path31.join(cwd, "packages/control-plane/public/index.html");
+  if (!fs27.existsSync(indexPath)) return null;
+  return extractBundleHash(fs27.readFileSync(indexPath, "utf-8"));
 }
 async function runUpgradePullByDigest(deps = {}) {
   const docker2 = deps.docker ?? realDocker;
@@ -19071,19 +18996,27 @@ async function runUpgradePullByDigest(deps = {}) {
   if (info.exitCode !== 0) {
     infoSpinner.fail("docker daemon not reachable");
     process.stderr.write(
-      `${pc16.red("error")} docker info exited with ${info.exitCode}.
+      `${pc17.red("error")} docker info exited with ${info.exitCode}.
   Ensure Docker Desktop / Colima / Rancher is running, then retry.
 `
     );
     return { exitCode: EXIT_GENERIC_ERROR, summary: "docker daemon not reachable" };
   }
   infoSpinner.succeed("docker daemon reachable");
-  const imageRefs = [
+  const hasMcpAuthDigest = typeof digests["mcp-auth"] === "string" && digests["mcp-auth"].length > 0;
+  const baseRefs = [
     { name: "host-cp", ref: `${registry}/olam-host-cp@${digests["host-cp"]}` },
     { name: "auth", ref: `${registry}/olam-auth@${digests.auth}` },
     { name: "devbox", ref: `${registry}/olam-devbox@${digests.devbox}` }
   ];
-  const pullSpinner = ora7("Pulling images (3 parallel)").start();
+  if (hasMcpAuthDigest) {
+    baseRefs.push({
+      name: "mcp-auth",
+      ref: `${registry}/olam-mcp-auth@${digests["mcp-auth"]}`
+    });
+  }
+  const imageRefs = baseRefs;
+  const pullSpinner = ora7(`Pulling images (${imageRefs.length} parallel)`).start();
   const pullStart = Date.now();
   const pullResults = await Promise.all(
     imageRefs.map(async ({ name, ref }) => ({
@@ -19098,7 +19031,7 @@ async function runUpgradePullByDigest(deps = {}) {
     pullSpinner.fail(`Pull failed for ${failed.map((r) => r.name).join(", ")}`);
     for (const f of failed) {
       process.stderr.write(
-        `  ${pc16.red(f.name)} (${f.ref}):
+        `  ${pc17.red(f.name)} (${f.ref}):
     exit=${f.result.exitCode}
     stderr: ${f.result.stderr.split("\n")[0] ?? "(empty)"}
 `
@@ -19112,14 +19045,14 @@ async function runUpgradePullByDigest(deps = {}) {
       summary: `pull failed: ${failed.map((r) => r.name).join(", ")}`
     };
   }
-  pullSpinner.succeed(`Pulled 3 images in ${pullElapsed}s`);
+  pullSpinner.succeed(`Pulled ${imageRefs.length} images in ${pullElapsed}s`);
   const handshakeSpinner = ora7("Verifying olam.protocol.versions handshake").start();
   for (const { name, ref } of imageRefs) {
     const inspect = await docker2.inspectLabel(ref, "olam.protocol.versions");
     if (inspect.exitCode !== 0) {
       handshakeSpinner.fail(`Could not inspect ${name}`);
       process.stderr.write(
-        `${pc16.red("error")} docker inspect ${ref} failed: ${inspect.stderr}
+        `${pc17.red("error")} docker inspect ${ref} failed: ${inspect.stderr}
 `
       );
       return { exitCode: EXIT_GENERIC_ERROR, summary: `inspect failed: ${name}` };
@@ -19131,7 +19064,7 @@ async function runUpgradePullByDigest(deps = {}) {
     const decision = checkProtocolOverlap(versions);
     if (!decision.compatible) {
       handshakeSpinner.fail(`Protocol mismatch on ${name}`);
-      process.stderr.write(`${pc16.red("error")} ${decision.remedy}
+      process.stderr.write(`${pc17.red("error")} ${decision.remedy}
 `);
       return {
         exitCode: EXIT_PROTOCOL_MISMATCH,
@@ -19139,8 +19072,8 @@ async function runUpgradePullByDigest(deps = {}) {
       };
     }
   }
-  handshakeSpinner.succeed("Protocol handshake passed (all 3 images)");
-  const tagPlan = [
+  handshakeSpinner.succeed(`Protocol handshake passed (all ${imageRefs.length} images)`);
+  const tagPlanBase = [
     { from: imageRefs[0].ref, to: "olam-host-cp:latest", name: "host-cp (bare)" },
     { from: imageRefs[0].ref, to: `${registry}/olam-host-cp:latest`, name: "host-cp (registry)" },
     { from: imageRefs[1].ref, to: "olam-auth:local", name: "auth (bare)" },
@@ -19148,13 +19081,20 @@ async function runUpgradePullByDigest(deps = {}) {
     { from: imageRefs[2].ref, to: "olam-devbox:latest", name: "devbox (bare)" },
     { from: imageRefs[2].ref, to: `${registry}/olam-devbox:latest`, name: "devbox (registry)" }
   ];
+  if (hasMcpAuthDigest && imageRefs[3]) {
+    tagPlanBase.push(
+      { from: imageRefs[3].ref, to: "olam-mcp-auth:local", name: "mcp-auth (bare)" },
+      { from: imageRefs[3].ref, to: `${registry}/olam-mcp-auth:latest`, name: "mcp-auth (registry)" }
+    );
+  }
+  const tagPlan = tagPlanBase;
   const tagSpinner = ora7("Tagging digests \u2192 canonical local refs").start();
   const tagger = deps.tagImpl ?? dockerTag;
   for (const t of tagPlan) {
     const r = tagger(t.from, t.to);
     if (!r.ok) {
       tagSpinner.fail(`docker tag failed for ${t.name}`);
-      process.stderr.write(`${pc16.red("error")} ${r.error ?? "docker tag failed"}
+      process.stderr.write(`${pc17.red("error")} ${r.error ?? "docker tag failed"}
 `);
       return { exitCode: EXIT_GENERIC_ERROR, summary: `tag failed: ${t.name}` };
     }
@@ -19172,7 +19112,7 @@ async function runUpgradePullByDigest(deps = {}) {
   if (!composeResult.ok) {
     composeSpinner.fail("compose recreate failed");
     process.stderr.write(
-      `${pc16.red("error")} docker compose up --force-recreate host-cp failed:
+      `${pc17.red("error")} docker compose up --force-recreate host-cp failed:
   ${composeResult.stderr.split("\n").slice(0, 3).join("\n  ")}
 `
     );
@@ -19185,25 +19125,68 @@ async function runUpgradePullByDigest(deps = {}) {
   if (!authResult.ok) {
     authSpinner.fail("auth-service recreate failed");
     process.stderr.write(
-      `${pc16.red("error")} ${authResult.error ?? "unknown failure"}
+      `${pc17.red("error")} ${authResult.error ?? "unknown failure"}
 `
     );
     return { exitCode: EXIT_GENERIC_ERROR, summary: "auth recreate failed" };
   }
   authSpinner.succeed("auth-service running on new image");
+  if (hasMcpAuthDigest) {
+    const mcpSpinner = ora7("recreate mcp-auth-service").start();
+    const mcpRecreate = deps.recreateMcpAuth ?? defaultRecreateMcpAuthForUpgrade;
+    const mcpResult = await mcpRecreate();
+    if (!mcpResult.ok) {
+      mcpSpinner.fail("mcp-auth-service recreate failed");
+      process.stderr.write(
+        `${pc17.red("error")} ${mcpResult.error ?? "unknown failure"}
+`
+      );
+      return { exitCode: EXIT_GENERIC_ERROR, summary: "mcp-auth recreate failed" };
+    }
+    mcpSpinner.succeed("mcp-auth-service running on new image");
+  }
   printSuccess("Upgrade complete (pull-by-digest)");
   printInfo("host-cp", `running (${digests["host-cp"].slice(0, 19)}\u2026)`);
   printInfo("auth", `running (${digests.auth.slice(0, 19)}\u2026)`);
   printInfo("devbox", `pulled (${digests.devbox.slice(0, 19)}\u2026)`);
+  if (hasMcpAuthDigest) {
+    printInfo("mcp-auth", `running (${digests["mcp-auth"].slice(0, 19)}\u2026)`);
+  }
   return { exitCode: 0, summary: "stack upgraded" };
 }
+async function defaultRecreateMcpAuthForUpgrade() {
+  try {
+    const { spawnSync: ss } = await import("node:child_process");
+    ss("docker", ["stop", "olam-mcp-auth"], { stdio: "ignore" });
+    ss("docker", ["rm", "-f", "olam-mcp-auth"], { stdio: "ignore" });
+    const startResult = ss("docker", [
+      "run",
+      "-d",
+      "--name",
+      "olam-mcp-auth",
+      "-p",
+      "9998:9998",
+      "-v",
+      "olam-mcp-auth-data:/mcp-auth-data",
+      "--restart",
+      "unless-stopped",
+      "olam-mcp-auth:local"
+    ], { stdio: "pipe" });
+    if (startResult.status !== 0) {
+      return { ok: false, error: `docker run failed: ${startResult.stderr?.toString() ?? "unknown"}` };
+    }
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
 async function defaultRecreateAuthForUpgrade() {
   try {
-    spawnSync10("docker", ["stop", "olam-auth"], {
+    spawnSync11("docker", ["stop", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
-    spawnSync10("docker", ["rm", "olam-auth"], {
+    spawnSync11("docker", ["rm", "olam-auth"], {
       encoding: "utf-8",
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -19348,11 +19331,11 @@ manually inspect images with \`docker images olam-*:olam-rollback\`.`
   process.once("SIGINT", releaseOnSignal);
   process.once("SIGTERM", releaseOnSignal);
   try {
-    process.stdout.write(`  ${pc16.dim("rollback retag (3 ops)".padEnd(34))}`);
+    process.stdout.write(`  ${pc17.dim("rollback retag (3 ops)".padEnd(34))}`);
     const swapStart = Date.now();
     const swapResult = performRollbackSwap(PRODUCTION_SWAP_PLAN);
     const swapDur = `${((Date.now() - swapStart) / 1e3).toFixed(1)}s`;
-    process.stdout.write(`${swapResult.ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${swapDur}
+    process.stdout.write(`${swapResult.ok ? pc17.green("\u2713") : pc17.red("\u2717")} ${swapDur}
 `);
     if (!swapResult.ok) {
       printError(`Rollback retag failed: ${swapResult.summary}`);
@@ -19362,11 +19345,11 @@ manually inspect images with \`docker images olam-*:olam-rollback\`.`
     printInfo("Rollback", swapResult.summary);
     const composeFile = findComposeFile();
     const authSecret = readAuthSecret2();
-    process.stdout.write(`  ${pc16.dim("docker compose recreate host-cp".padEnd(34))}`);
+    process.stdout.write(`  ${pc17.dim("docker compose recreate host-cp".padEnd(34))}`);
     const composeStart = Date.now();
     const composeResult = runCompose(["up", "-d", "--force-recreate", "--no-deps", "host-cp"], composeFile, buildComposeEnv(authSecret));
     const composeDur = `${((Date.now() - composeStart) / 1e3).toFixed(1)}s`;
-    process.stdout.write(`${composeResult.ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${composeDur}
+    process.stdout.write(`${composeResult.ok ? pc17.green("\u2713") : pc17.red("\u2717")} ${composeDur}
 `);
     if (!composeResult.ok) {
       printError(
@@ -19377,10 +19360,10 @@ Canonical tags are at :olam-rollback (good); container restart pending. Manually
       process.exitCode = 1;
       return;
     }
-    process.stdout.write(`  ${pc16.dim("recreate auth-service".padEnd(34))}`);
+    process.stdout.write(`  ${pc17.dim("recreate auth-service".padEnd(34))}`);
     const authResult = await recreateAuthService();
     const authDur = `${(authResult.durationMs / 1e3).toFixed(1)}s`;
-    process.stdout.write(`${authResult.ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${authDur}
+    process.stdout.write(`${authResult.ok ? pc17.green("\u2713") : pc17.red("\u2717")} ${authDur}
 `);
     if (!authResult.ok) {
       printError(`Auth-service recreate failed: ${authResult.error ?? "unknown"}`);
@@ -19501,7 +19484,7 @@ ${buildResult.stderr}`);
     return;
   }
   const authSecret = readAuthSecret2();
-  const spaDir = path32.join(cwd, "packages/control-plane/app");
+  const spaDir = path31.join(cwd, "packages/control-plane/app");
   const spaResult = runStep2(
     "vite build (SPA)",
     "npx",
@@ -19546,10 +19529,10 @@ ${spaResult.stderr}`);
       throw err;
     }
     if (step.tee) {
-      process.stdout.write(`  ${pc16.dim(step.label.padEnd(34))}
+      process.stdout.write(`  ${pc17.dim(step.label.padEnd(34))}
 `);
       const start = Date.now();
-      const result = spawnSync10("bash", [scriptPath], {
+      const result = spawnSync11("bash", [scriptPath], {
         stdio: "inherit",
         cwd,
         env: { ...process.env, ...olamTagEnv }
@@ -19557,7 +19540,7 @@ ${spaResult.stderr}`);
       const durationMs = Date.now() - start;
       const ok = result.status === 0 && result.error === void 0;
       const dur = `${(durationMs / 1e3).toFixed(1)}s`;
-      process.stdout.write(`  ${pc16.dim(step.label.padEnd(34))}${ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${dur}
+      process.stdout.write(`  ${pc17.dim(step.label.padEnd(34))}${ok ? pc17.green("\u2713") : pc17.red("\u2717")} ${dur}
 `);
       timings.push({ label: step.label, durationMs });
       if (!ok) {
@@ -19583,7 +19566,7 @@ ${result.stderr.split("\n").slice(-3).join("\n")}`);
   }
   for (const t of timings) logRow.durations_ms[t.label] = t.durationMs;
   const smokeStart = Date.now();
-  process.stdout.write(`  ${pc16.dim("smoke (docker create + inspect)".padEnd(34))}`);
+  process.stdout.write(`  ${pc17.dim("smoke (docker create + inspect)".padEnd(34))}`);
   const smokeImages = [
     "olam-auth:olam-next",
     "olam-devbox:olam-next",
@@ -19593,7 +19576,7 @@ ${result.stderr.split("\n").slice(-3).join("\n")}`);
   const smokeFailures = smokeResults.filter((r) => !r.ok);
   const smokeDurationMs = Date.now() - smokeStart;
   const smokeDur = `${(smokeDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${smokeFailures.length === 0 ? pc16.green("\u2713") : pc16.red("\u2717")} ${smokeDur}
+  process.stdout.write(`${smokeFailures.length === 0 ? pc17.green("\u2713") : pc17.red("\u2717")} ${smokeDur}
 `);
   timings.push({ label: "smoke", durationMs: smokeDurationMs });
   if (smokeFailures.length > 0) {
@@ -19620,12 +19603,12 @@ Recovery options:
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`  ${pc16.dim("atomic 6-tag swap".padEnd(34))}`);
+  process.stdout.write(`  ${pc17.dim("atomic 6-tag swap".padEnd(34))}`);
   const swapStart = Date.now();
   const swapResult = performAtomicSwap(PRODUCTION_SWAP_PLAN);
   const swapDurationMs = Date.now() - swapStart;
   const swapDur = `${(swapDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${swapResult.ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${swapDur}
+  process.stdout.write(`${swapResult.ok ? pc17.green("\u2713") : pc17.red("\u2717")} ${swapDur}
 `);
   timings.push({ label: "atomic swap", durationMs: swapDurationMs });
   if (!swapResult.ok) {
@@ -19635,7 +19618,7 @@ Recovery options:
   }
   printInfo("Swap", swapResult.summary);
   const composeFile = findComposeFile();
-  process.stdout.write(`  ${pc16.dim("docker compose recreate".padEnd(34))}`);
+  process.stdout.write(`  ${pc17.dim("docker compose recreate".padEnd(34))}`);
   const composeStart = Date.now();
   const composeResult = runCompose(
     ["up", "-d", "--force-recreate"],
@@ -19645,7 +19628,7 @@ Recovery options:
   const composeDurationMs = Date.now() - composeStart;
   const composeOk = composeResult.ok;
   const composeDur = `${(composeDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${composeOk ? pc16.green("\u2713") : pc16.red("\u2717")} ${composeDur}
+  process.stdout.write(`${composeOk ? pc17.green("\u2713") : pc17.red("\u2717")} ${composeDur}
 `);
   timings.push({ label: "container recreate", durationMs: composeDurationMs });
   if (!composeOk) {
@@ -19661,10 +19644,10 @@ Recovery options:
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`  ${pc16.dim("recreate auth-service".padEnd(34))}`);
+  process.stdout.write(`  ${pc17.dim("recreate auth-service".padEnd(34))}`);
   const authResult = await recreateAuthService();
   const authDur = `${(authResult.durationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${authResult.ok ? pc16.green("\u2713") : pc16.red("\u2717")} ${authDur}
+  process.stdout.write(`${authResult.ok ? pc17.green("\u2713") : pc17.red("\u2717")} ${authDur}
 `);
   timings.push({ label: "auth recreate", durationMs: authResult.durationMs });
   if (!authResult.ok) {
@@ -19679,12 +19662,12 @@ Recovery options:
     process.exitCode = 1;
     return;
   }
-  process.stdout.write(`  ${pc16.dim("waiting for /health".padEnd(34))}`);
+  process.stdout.write(`  ${pc17.dim("waiting for /health".padEnd(34))}`);
   const healthStart = Date.now();
   const healthy = await waitForHealth(1e4);
   const healthDurationMs = Date.now() - healthStart;
   const healthDur = `${(healthDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${healthy ? pc16.green("\u2713") : pc16.yellow("?")} ${healthDur}
+  process.stdout.write(`${healthy ? pc17.green("\u2713") : pc17.yellow("?")} ${healthDur}
 `);
   timings.push({ label: "/health", durationMs: healthDurationMs });
   if (!healthy) {
@@ -19692,12 +19675,12 @@ Recovery options:
       "Host CP started but /health did not respond within 10s.\n  \u2022 Check: docker logs olam-host-cp\n  \u2022 If the new SHA is broken: `olam upgrade --rollback` restores the prior set in <30s."
     );
   }
-  process.stdout.write(`  ${pc16.dim("verify /version/status round-trip".padEnd(34))}`);
+  process.stdout.write(`  ${pc17.dim("verify /version/status round-trip".padEnd(34))}`);
   const versionStart = Date.now();
   const versionMatch = await waitForVersionMatch(_targetSha, 9e4);
   const versionDurationMs = Date.now() - versionStart;
   const versionDur = `${(versionDurationMs / 1e3).toFixed(1)}s`;
-  process.stdout.write(`${versionMatch.matched ? pc16.green("\u2713") : pc16.yellow("?")} ${versionDur}
+  process.stdout.write(`${versionMatch.matched ? pc17.green("\u2713") : pc17.yellow("?")} ${versionDur}
 `);
   timings.push({ label: "/version/status round-trip", durationMs: versionDurationMs });
   if (!versionMatch.matched) {
@@ -19771,16 +19754,16 @@ init_host_cp();
 init_context();
 init_output();
 import * as http3 from "node:http";
-import pc17 from "picocolors";
+import pc18 from "picocolors";
 var HOST_CP_PORT3 = 19e3;
 function colorLine(line) {
-  if (/\bERROR\b/.test(line)) return pc17.red(line);
-  if (/\bWARN\b/.test(line)) return pc17.yellow(line);
-  if (/\bINFO\b/.test(line)) return pc17.dim(line);
+  if (/\bERROR\b/.test(line)) return pc18.red(line);
+  if (/\bWARN\b/.test(line)) return pc18.yellow(line);
+  if (/\bINFO\b/.test(line)) return pc18.dim(line);
   return line;
 }
 function formatLine(line, service, showService) {
-  const prefix = showService && service ? `${pc17.cyan(`[${service}]`)} ` : "";
+  const prefix = showService && service ? `${pc18.cyan(`[${service}]`)} ` : "";
   return prefix + colorLine(line);
 }
 function parseSseEvent(raw) {
@@ -19897,8 +19880,8 @@ function registerLogs(program2) {
 // src/commands/ps.ts
 init_context();
 init_output();
-import pc18 from "picocolors";
-import { spawnSync as spawnSync11 } from "node:child_process";
+import pc19 from "picocolors";
+import { spawnSync as spawnSync12 } from "node:child_process";
 var SAFE_IDENT4 = /^[a-z0-9][a-z0-9-]{0,63}$/;
 function parseDockerTop(stdout) {
   const trimmed = stdout.trim();
@@ -19958,18 +19941,18 @@ function printTable2(rows) {
   const fixedWidth = 5 + 1 + 8 + 1 + 6 + 1 + 6 + 1 + 10 + 1 + 6 + 1;
   const cmdWidth = Math.max(20, cols - fixedWidth);
   const header = [
-    pc18.bold(pc18.dim("PID".padEnd(5))),
-    pc18.bold(pc18.dim("USER".padEnd(8))),
-    pc18.bold(pc18.dim("%CPU".padEnd(6))),
-    pc18.bold(pc18.dim("%MEM".padEnd(6))),
-    pc18.bold(pc18.dim("STARTED".padEnd(10))),
-    pc18.bold(pc18.dim("STATE".padEnd(6))),
-    pc18.bold(pc18.dim("COMMAND"))
+    pc19.bold(pc19.dim("PID".padEnd(5))),
+    pc19.bold(pc19.dim("USER".padEnd(8))),
+    pc19.bold(pc19.dim("%CPU".padEnd(6))),
+    pc19.bold(pc19.dim("%MEM".padEnd(6))),
+    pc19.bold(pc19.dim("STARTED".padEnd(10))),
+    pc19.bold(pc19.dim("STATE".padEnd(6))),
+    pc19.bold(pc19.dim("COMMAND"))
   ].join(" ");
   console.log(header);
   for (const row of rows) {
     const cmd = row.command.length > cmdWidth ? row.command.slice(0, cmdWidth - 1) + "\u2026" : row.command;
-    const stateFn = row.state.startsWith("R") ? pc18.green : row.state.startsWith("Z") ? pc18.red : pc18.dim;
+    const stateFn = row.state.startsWith("R") ? pc19.green : row.state.startsWith("Z") ? pc19.red : pc19.dim;
     console.log([
       row.pid.padEnd(5),
       row.user.slice(0, 8).padEnd(8),
@@ -19998,7 +19981,7 @@ function registerPs(program2) {
     const containerName = `olam-${worldId}-devbox`;
     let watchInterval;
     function fetchAndPrint() {
-      const result = spawnSync11(
+      const result = spawnSync12(
         "docker",
         ["top", containerName, "pid", "user", "pcpu", "pmem", "stime", "stat", "cmd"],
         { encoding: "utf-8", timeout: 3e3 }
@@ -20018,7 +20001,7 @@ function registerPs(program2) {
       printTable2(rows);
       if (opts.watch) {
         process.stdout.write(`
-${pc18.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
+${pc19.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
 `);
       }
     }
@@ -20035,20 +20018,20 @@ ${pc18.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
 
 // src/commands/keys.ts
 init_output();
-import * as fs29 from "node:fs";
+import * as fs28 from "node:fs";
 import * as os17 from "node:os";
-import * as path33 from "node:path";
+import * as path32 from "node:path";
 import YAML4 from "yaml";
 function olamHome2() {
-  return process.env.OLAM_HOME ?? path33.join(os17.homedir(), ".olam");
+  return process.env.OLAM_HOME ?? path32.join(os17.homedir(), ".olam");
 }
 function keysFilePath() {
-  return path33.join(olamHome2(), "keys.yaml");
+  return path32.join(olamHome2(), "keys.yaml");
 }
 function readKeysFile() {
   const filePath = keysFilePath();
-  if (!fs29.existsSync(filePath)) return null;
-  const raw = fs29.readFileSync(filePath, "utf-8").trim();
+  if (!fs28.existsSync(filePath)) return null;
+  const raw = fs28.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = YAML4.parse(raw);
@@ -20064,13 +20047,13 @@ function readKeysFile() {
 }
 function writeKeysFile(keys) {
   const dir = olamHome2();
-  if (!fs29.existsSync(dir)) {
-    fs29.mkdirSync(dir, { recursive: true });
+  if (!fs28.existsSync(dir)) {
+    fs28.mkdirSync(dir, { recursive: true });
   }
   const filePath = keysFilePath();
   const content = YAML4.stringify(keys);
-  fs29.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
-  fs29.chmodSync(filePath, 384);
+  fs28.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
+  fs28.chmodSync(filePath, 384);
 }
 function redact(value) {
   if (value.length <= 8) return value + "...";
@@ -20113,7 +20096,7 @@ function registerKeys(program2) {
       }
       const { [key]: _removed, ...rest } = existing;
       if (Object.keys(rest).length === 0) {
-        fs29.unlinkSync(keysFilePath());
+        fs28.unlinkSync(keysFilePath());
       } else {
         writeKeysFile(rest);
       }
@@ -20136,33 +20119,33 @@ function registerKeys(program2) {
 }
 
 // src/commands/world-snapshot.ts
-import * as fs31 from "node:fs";
-import * as path35 from "node:path";
+import * as fs30 from "node:fs";
+import * as path34 from "node:path";
 import { execSync as execSync9 } from "node:child_process";
-import pc19 from "picocolors";
+import pc20 from "picocolors";
 
 // ../core/dist/world/snapshot.js
-import * as crypto7 from "node:crypto";
-import * as fs30 from "node:fs";
+import * as crypto6 from "node:crypto";
+import * as fs29 from "node:fs";
 import * as os18 from "node:os";
-import * as path34 from "node:path";
-import { execFileSync as execFileSync5 } from "node:child_process";
+import * as path33 from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
 function snapshotsDir() {
-  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path34.join(os18.homedir(), ".olam", "snapshots");
+  return process.env["OLAM_SNAPSHOTS_DIR"] ?? path33.join(os18.homedir(), ".olam", "snapshots");
 }
 function snapshotKindDir(worldId, kind) {
-  return path34.join(snapshotsDir(), worldId, kind);
+  return path33.join(snapshotsDir(), worldId, kind);
 }
 function snapshotTarPath(worldId, kind, repoName, hash) {
   const base = repoName ? `${repoName}-${hash}` : hash;
-  return path34.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
+  return path33.join(snapshotKindDir(worldId, kind), `${base}.tar.gz`);
 }
 function manifestPath(tarPath) {
   return tarPath.replace(/\.tar\.gz$/, ".manifest.json");
 }
 function hashBuffers(entries) {
   const sorted = [...entries].sort((a, b) => a.path.localeCompare(b.path));
-  const hash = crypto7.createHash("sha256");
+  const hash = crypto6.createHash("sha256");
   for (const entry of sorted) {
     hash.update(entry.path);
     hash.update("\0");
@@ -20172,17 +20155,17 @@ function hashBuffers(entries) {
   return hash.digest("hex").slice(0, 12);
 }
 function computeGemsFingerprint(repoDir) {
-  const lockfile = path34.join(repoDir, "Gemfile.lock");
-  if (!fs30.existsSync(lockfile))
+  const lockfile = path33.join(repoDir, "Gemfile.lock");
+  if (!fs29.existsSync(lockfile))
     return null;
-  return hashBuffers([{ path: "Gemfile.lock", content: fs30.readFileSync(lockfile) }]);
+  return hashBuffers([{ path: "Gemfile.lock", content: fs29.readFileSync(lockfile) }]);
 }
 function computeNodeFingerprint(repoDir) {
   const candidates = ["yarn.lock", "pnpm-lock.yaml", "package-lock.json"];
   for (const name of candidates) {
-    const lockfile = path34.join(repoDir, name);
-    if (fs30.existsSync(lockfile)) {
-      return hashBuffers([{ path: name, content: fs30.readFileSync(lockfile) }]);
+    const lockfile = path33.join(repoDir, name);
+    if (fs29.existsSync(lockfile)) {
+      return hashBuffers([{ path: name, content: fs29.readFileSync(lockfile) }]);
     }
   }
   return null;
@@ -20192,64 +20175,64 @@ function computePgFingerprint(repoDirs) {
   const entries = [];
   for (const repoDir of repoDirs) {
     for (const pattern of patterns) {
-      const filePath = path34.join(repoDir, pattern);
-      if (fs30.existsSync(filePath)) {
-        entries.push({ path: filePath, content: fs30.readFileSync(filePath) });
+      const filePath = path33.join(repoDir, pattern);
+      if (fs29.existsSync(filePath)) {
+        entries.push({ path: filePath, content: fs29.readFileSync(filePath) });
       }
     }
   }
   return entries.length > 0 ? hashBuffers(entries) : null;
 }
 function packTarball(srcDir, destPath, opts = {}) {
-  fs30.mkdirSync(path34.dirname(destPath), { recursive: true });
+  fs29.mkdirSync(path33.dirname(destPath), { recursive: true });
   const tmp = `${destPath}.tmp`;
   const args = [];
   if (opts.followSymlinks)
     args.push("-h");
   args.push("-czf", tmp, "-C", srcDir, ".");
   try {
-    execFileSync5("tar", args, { stdio: "pipe" });
-    fs30.renameSync(tmp, destPath);
+    execFileSync6("tar", args, { stdio: "pipe" });
+    fs29.renameSync(tmp, destPath);
   } catch (err) {
     try {
-      fs30.rmSync(tmp, { force: true });
+      fs29.rmSync(tmp, { force: true });
     } catch {
     }
     throw err;
   }
 }
 function writeManifest(manifest, tarPath) {
-  fs30.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
+  fs29.writeFileSync(manifestPath(tarPath), JSON.stringify(manifest, null, 2), "utf-8");
 }
 function readManifest(tarPath) {
   const mPath = manifestPath(tarPath);
-  if (!fs30.existsSync(mPath))
+  if (!fs29.existsSync(mPath))
     return null;
   try {
-    return JSON.parse(fs30.readFileSync(mPath, "utf-8"));
+    return JSON.parse(fs29.readFileSync(mPath, "utf-8"));
   } catch {
     return null;
   }
 }
 function listSnapshots(worldIdFilter) {
   const root = snapshotsDir();
-  if (!fs30.existsSync(root))
+  if (!fs29.existsSync(root))
     return [];
   const now = Date.now();
   const results = [];
-  const worlds = worldIdFilter ? [worldIdFilter] : fs30.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  const worlds = worldIdFilter ? [worldIdFilter] : fs29.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   for (const worldId of worlds) {
-    const worldDir = path34.join(root, worldId);
-    if (!fs30.existsSync(worldDir) || !fs30.statSync(worldDir).isDirectory())
+    const worldDir = path33.join(root, worldId);
+    if (!fs29.existsSync(worldDir) || !fs29.statSync(worldDir).isDirectory())
       continue;
     for (const kind of ["gems", "node", "pg"]) {
-      const kindDir = path34.join(worldDir, kind);
-      if (!fs30.existsSync(kindDir))
+      const kindDir = path33.join(worldDir, kind);
+      if (!fs29.existsSync(kindDir))
         continue;
-      const tarballs = fs30.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
+      const tarballs = fs29.readdirSync(kindDir).filter((f) => f.endsWith(".tar.gz"));
       for (const tarFile of tarballs) {
-        const tarPath = path34.join(kindDir, tarFile);
-        const stat = fs30.statSync(tarPath);
+        const tarPath = path33.join(kindDir, tarFile);
+        const stat = fs29.statSync(tarPath);
         const manifest = readManifest(tarPath);
         if (!manifest)
           continue;
@@ -20325,7 +20308,7 @@ async function handleCreate2(worldId, kindArg) {
     const label = r.repo ? `${r.kind}/${r.repo}` : r.kind;
     if (r.ok) {
       printSuccess(`${label}`);
-      console.log(`         ${pc19.dim(r.tarPath)}`);
+      console.log(`         ${pc20.dim(r.tarPath)}`);
     } else {
       printWarning(`${label}: ${r.msg ?? "skipped"}`);
     }
@@ -20339,17 +20322,17 @@ function resolveKinds(arg) {
   return [];
 }
 async function captureGems(worldId, workspacePath, repo) {
-  const repoDir = path35.join(workspacePath, repo);
+  const repoDir = path34.join(workspacePath, repo);
   const fingerprint = computeGemsFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock \u2014 layer does not apply" };
   }
   const tarPath = snapshotTarPath(worldId, "gems", repo, fingerprint);
-  const vendorBundle = path35.join(repoDir, "vendor", "bundle");
-  if (fs31.existsSync(vendorBundle)) {
+  const vendorBundle = path34.join(repoDir, "vendor", "bundle");
+  if (fs30.existsSync(vendorBundle)) {
     try {
       packTarball(vendorBundle, tarPath);
-      const stat = fs31.statSync(tarPath);
+      const stat = fs30.statSync(tarPath);
       const manifest = {
         kind: "gems",
         worldId,
@@ -20382,10 +20365,10 @@ async function captureGems(worldId, workspacePath, repo) {
       `docker exec ${containerName} sh -c 'mkdir -p "$(dirname ${tmpTar})" && tar -czf ${tmpTar}.tmp -C ${bundlePath} . && mv ${tmpTar}.tmp ${tmpTar}'`,
       { stdio: "pipe", timeout: 12e4 }
     );
-    fs31.mkdirSync(path35.dirname(tarPath), { recursive: true });
+    fs30.mkdirSync(path34.dirname(tarPath), { recursive: true });
     execSync9(`docker cp ${containerName}:${tmpTar} "${tarPath}"`, { stdio: "pipe", timeout: 12e4 });
     execSync9(`docker exec ${containerName} rm -f ${tmpTar}`, { stdio: "pipe" });
-    const stat = fs31.statSync(tarPath);
+    const stat = fs30.statSync(tarPath);
     const manifest = {
       kind: "gems",
       worldId,
@@ -20402,19 +20385,19 @@ async function captureGems(worldId, workspacePath, repo) {
   }
 }
 async function captureNode(worldId, workspacePath, repo) {
-  const repoDir = path35.join(workspacePath, repo);
+  const repoDir = path34.join(workspacePath, repo);
   const fingerprint = computeNodeFingerprint(repoDir);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no lockfile \u2014 layer does not apply" };
   }
-  const nodeModules = path35.join(repoDir, "node_modules");
-  if (!fs31.existsSync(nodeModules)) {
+  const nodeModules = path34.join(repoDir, "node_modules");
+  if (!fs30.existsSync(nodeModules)) {
     return { ok: false, tarPath: "", msg: "node_modules not installed yet" };
   }
   const tarPath = snapshotTarPath(worldId, "node", repo, fingerprint);
   try {
     packTarball(nodeModules, tarPath);
-    const stat = fs31.statSync(tarPath);
+    const stat = fs30.statSync(tarPath);
     const manifest = {
       kind: "node",
       worldId,
@@ -20431,7 +20414,7 @@ async function captureNode(worldId, workspacePath, repo) {
   }
 }
 async function capturePg(worldId, workspacePath, repoNames) {
-  const repoDirs = repoNames.map((r) => path35.join(workspacePath, r));
+  const repoDirs = repoNames.map((r) => path34.join(workspacePath, r));
   const fingerprint = computePgFingerprint(repoDirs);
   if (!fingerprint) {
     return { ok: false, tarPath: "", msg: "no Gemfile.lock / schema.rb \u2014 layer does not apply" };
@@ -20446,13 +20429,13 @@ async function capturePg(worldId, workspacePath, repoNames) {
   }
   try {
     execSync9(`docker stop ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    fs31.mkdirSync(path35.dirname(tarPath), { recursive: true });
+    fs30.mkdirSync(path34.dirname(tarPath), { recursive: true });
     execSync9(
-      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path35.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path35.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path35.basename(tarPath)}.tmp /dest/${path35.basename(tarPath)}'`,
+      `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path34.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path34.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path34.basename(tarPath)}.tmp /dest/${path34.basename(tarPath)}'`,
       { stdio: "pipe", timeout: 18e4 }
     );
     execSync9(`docker start ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    const stat = fs31.statSync(tarPath);
+    const stat = fs30.statSync(tarPath);
     const manifest = {
       kind: "pg",
       worldId,
@@ -20475,7 +20458,7 @@ function handleList2(worldIdFilter) {
   const entries = listSnapshots(worldIdFilter);
   if (entries.length === 0) {
     const where = worldIdFilter ? ` for world "${worldIdFilter}"` : "";
-    console.log(pc19.dim(`No snapshots found${where}. Run \`olam world snapshot create <worldId>\` first.`));
+    console.log(pc20.dim(`No snapshots found${where}. Run \`olam world snapshot create <worldId>\` first.`));
     return;
   }
   printHeader(`${entries.length} snapshot(s)`);
@@ -20484,15 +20467,15 @@ function handleList2(worldIdFilter) {
   for (const entry of entries) {
     const { manifest } = entry;
     if (manifest.worldId !== lastWorldId) {
-      console.log(pc19.bold(manifest.worldId));
+      console.log(pc20.bold(manifest.worldId));
       lastWorldId = manifest.worldId;
     }
     const repo = manifest.repo ?? "(all repos)";
     const size = formatBytes2(manifest.sizeBytes);
     const age = formatAge2(entry.ageMs);
-    const kindColor = manifest.kind === "gems" ? pc19.magenta(manifest.kind) : manifest.kind === "node" ? pc19.cyan(manifest.kind) : pc19.yellow(manifest.kind);
+    const kindColor = manifest.kind === "gems" ? pc20.magenta(manifest.kind) : manifest.kind === "node" ? pc20.cyan(manifest.kind) : pc20.yellow(manifest.kind);
     console.log(
-      `  ${kindColor.padEnd(6)}  ${pc19.dim(repo.padEnd(24))}  ${manifest.fingerprint}  ${size.padStart(8)}  ${age}`
+      `  ${kindColor.padEnd(6)}  ${pc20.dim(repo.padEnd(24))}  ${manifest.fingerprint}  ${size.padStart(8)}  ${age}`
     );
   }
   console.log();
@@ -20527,35 +20510,35 @@ function formatAge2(ms) {
 // src/commands/refresh.ts
 init_context();
 init_output();
-import * as fs33 from "node:fs";
+import * as fs32 from "node:fs";
 import * as os19 from "node:os";
-import * as path37 from "node:path";
-import { spawnSync as spawnSync12 } from "node:child_process";
+import * as path36 from "node:path";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import ora8 from "ora";
 
 // src/commands/refresh-helpers.ts
-import * as fs32 from "node:fs";
-import * as path36 from "node:path";
+import * as fs31 from "node:fs";
+import * as path35 from "node:path";
 function collectCpSourceFiles(standaloneDir) {
-  if (!fs32.existsSync(standaloneDir)) {
+  if (!fs31.existsSync(standaloneDir)) {
     throw new Error(`CP standalone dir not found: ${standaloneDir}`);
   }
   const entries = [];
-  const topLevel = fs32.readdirSync(standaloneDir).filter((f) => {
-    const stat = fs32.statSync(path36.join(standaloneDir, f));
+  const topLevel = fs31.readdirSync(standaloneDir).filter((f) => {
+    const stat = fs31.statSync(path35.join(standaloneDir, f));
     return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
   }).sort();
   for (const f of topLevel) {
-    entries.push({ srcPath: path36.join(standaloneDir, f), destRelPath: f });
+    entries.push({ srcPath: path35.join(standaloneDir, f), destRelPath: f });
   }
-  const libDir = path36.join(standaloneDir, "lib");
-  if (fs32.existsSync(libDir) && fs32.statSync(libDir).isDirectory()) {
-    const libFiles = fs32.readdirSync(libDir).filter((f) => {
-      const stat = fs32.statSync(path36.join(libDir, f));
+  const libDir = path35.join(standaloneDir, "lib");
+  if (fs31.existsSync(libDir) && fs31.statSync(libDir).isDirectory()) {
+    const libFiles = fs31.readdirSync(libDir).filter((f) => {
+      const stat = fs31.statSync(path35.join(libDir, f));
       return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
     }).sort();
     for (const f of libFiles) {
-      entries.push({ srcPath: path36.join(libDir, f), destRelPath: `lib/${f}` });
+      entries.push({ srcPath: path35.join(libDir, f), destRelPath: `lib/${f}` });
     }
   }
   return entries;
@@ -20574,7 +20557,7 @@ var RESTART_TIMEOUT_S = 30;
 var HEALTH_POLL_MS = 500;
 var HEALTH_TIMEOUT_MS = 3e4;
 function docker(args) {
-  const result = spawnSync12("docker", args, {
+  const result = spawnSync13("docker", args, {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -20613,16 +20596,16 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  const stagingDir = fs33.mkdtempSync(
-    path37.join(os19.tmpdir(), `olam-refresh-${worldId}-`)
+  const stagingDir = fs32.mkdtempSync(
+    path36.join(os19.tmpdir(), `olam-refresh-${worldId}-`)
   );
   try {
     const hasLib = entries.some((e) => e.destRelPath.startsWith("lib/"));
     if (hasLib) {
-      fs33.mkdirSync(path37.join(stagingDir, "lib"), { recursive: true });
+      fs32.mkdirSync(path36.join(stagingDir, "lib"), { recursive: true });
     }
     for (const { srcPath, destRelPath } of entries) {
-      fs33.copyFileSync(srcPath, path37.join(stagingDir, destRelPath));
+      fs32.copyFileSync(srcPath, path36.join(stagingDir, destRelPath));
     }
     const cpResult = docker([
       "cp",
@@ -20637,7 +20620,7 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       };
     }
   } finally {
-    fs33.rmSync(stagingDir, { recursive: true, force: true });
+    fs32.rmSync(stagingDir, { recursive: true, force: true });
   }
   if (opts.restart) {
     const restartResult = docker([
@@ -20674,11 +20657,11 @@ function registerRefresh(program2) {
       process.exitCode = 1;
       return;
     }
-    const standaloneDir = path37.join(
+    const standaloneDir = path36.join(
       process.cwd(),
       "packages/control-plane/standalone"
     );
-    if (!fs33.existsSync(standaloneDir)) {
+    if (!fs32.existsSync(standaloneDir)) {
       printError(
         `CP standalone source not found at ${standaloneDir}.
 Run \`olam refresh\` from the olam repo root.`
@@ -20757,11 +20740,11 @@ Run \`olam refresh\` from the olam repo root.`
 }
 
 // src/commands/diagnose.ts
-import * as fs34 from "node:fs";
+import * as fs33 from "node:fs";
 import * as os20 from "node:os";
-import * as path38 from "node:path";
-import { execFileSync as execFileSync6, execSync as execSync10 } from "node:child_process";
-import pc20 from "picocolors";
+import * as path37 from "node:path";
+import { execFileSync as execFileSync7, execSync as execSync10 } from "node:child_process";
+import pc21 from "picocolors";
 
 // ../core/dist/diagnose/secret-stripper.js
 var SECRET_PATTERNS = [
@@ -20794,9 +20777,9 @@ function stripSecrets(input) {
 }
 
 // src/commands/diagnose.ts
-var DIAGNOSTICS_DIR = path38.join(os20.homedir(), ".olam", "diagnostics");
-var LOG_DIR = path38.join(os20.homedir(), ".olam", "log");
-var CACHE_DIR = path38.join(os20.homedir(), ".olam", "cache");
+var DIAGNOSTICS_DIR = path37.join(os20.homedir(), ".olam", "diagnostics");
+var LOG_DIR = path37.join(os20.homedir(), ".olam", "log");
+var CACHE_DIR = path37.join(os20.homedir(), ".olam", "cache");
 var LOG_TAIL_LINES = 200;
 function safeExec(cmd) {
   try {
@@ -20806,14 +20789,14 @@ function safeExec(cmd) {
   }
 }
 function defaultZip(zipPath, files) {
-  execFileSync6("zip", ["-j", zipPath, ...files]);
+  execFileSync7("zip", ["-j", zipPath, ...files]);
 }
 async function buildDiagnosticsZip(_exec = (cmd) => safeExec(cmd), _outDir = DIAGNOSTICS_DIR, _logDir = LOG_DIR, _zip = defaultZip) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 23);
-  const zipPath = path38.join(_outDir, `olam-diag-${ts}.zip`);
-  const tmpDir = fs34.mkdtempSync(path38.join(os20.tmpdir(), "olam-diag-"));
+  const zipPath = path37.join(_outDir, `olam-diag-${ts}.zip`);
+  const tmpDir = fs33.mkdtempSync(path37.join(os20.tmpdir(), "olam-diag-"));
   try {
-    fs34.mkdirSync(_outDir, { recursive: true });
+    fs33.mkdirSync(_outDir, { recursive: true });
     const entries = [];
     const version = process.env["OLAM_CLI_VERSION"] ?? "unknown";
     const nodeVersion = process.version;
@@ -20829,14 +20812,14 @@ platform: ${platform}
       `uptime: ${os20.uptime()}s`
     ].join("\n") + "\n";
     _writeEntry(tmpDir, "os-info.txt", stripSecrets(osContent), entries);
-    const depsFile = path38.join(CACHE_DIR, "deps.json");
-    if (fs34.existsSync(depsFile)) {
-      const deps = fs34.readFileSync(depsFile, "utf-8");
+    const depsFile = path37.join(CACHE_DIR, "deps.json");
+    if (fs33.existsSync(depsFile)) {
+      const deps = fs33.readFileSync(depsFile, "utf-8");
       _writeEntry(tmpDir, "deps.json", stripSecrets(deps), entries);
     }
     const latestLog = _latestLog(_logDir);
     if (latestLog) {
-      const lines = fs34.readFileSync(latestLog, "utf-8").split("\n");
+      const lines = fs33.readFileSync(latestLog, "utf-8").split("\n");
       const tail = lines.slice(-LOG_TAIL_LINES).join("\n");
       _writeEntry(tmpDir, "log-tail.txt", stripSecrets(tail), entries);
     }
@@ -20848,38 +20831,38 @@ platform: ${platform}
     if (authAudit) {
       _writeEntry(tmpDir, "audit-auth-callers.txt", stripSecrets(authAudit), entries);
     }
-    const fileArgs = entries.map((e) => path38.join(tmpDir, e));
+    const fileArgs = entries.map((e) => path37.join(tmpDir, e));
     try {
       _zip(zipPath, fileArgs);
     } catch (err) {
       throw new Error(`zip command produced no output file. zip stderr: ${err.message}`);
     }
-    if (!fs34.existsSync(zipPath)) {
+    if (!fs33.existsSync(zipPath)) {
       throw new Error("zip command produced no output file.");
     }
     return { zipPath, entries };
   } finally {
     try {
-      fs34.rmSync(tmpDir, { recursive: true, force: true });
+      fs33.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
 }
 function _writeEntry(dir, name, content, entries) {
-  fs34.writeFileSync(path38.join(dir, name), content, { mode: 420 });
+  fs33.writeFileSync(path37.join(dir, name), content, { mode: 420 });
   entries.push(name);
 }
 function _latestLog(logDir) {
-  if (!fs34.existsSync(logDir)) return null;
-  const files = fs34.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
-  return files.length > 0 ? path38.join(logDir, files[0]) : null;
+  if (!fs33.existsSync(logDir)) return null;
+  const files = fs33.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
+  return files.length > 0 ? path37.join(logDir, files[0]) : null;
 }
 async function buildTelemetryPayload() {
   const channel = "stable";
-  const manifestFile = path38.join(CACHE_DIR, "manifest.json");
+  const manifestFile = path37.join(CACHE_DIR, "manifest.json");
   let manifestAgeHours = null;
-  if (fs34.existsSync(manifestFile)) {
-    const mtime = fs34.statSync(manifestFile).mtime.getTime();
+  if (fs33.existsSync(manifestFile)) {
+    const mtime = fs33.statSync(manifestFile).mtime.getTime();
     manifestAgeHours = Math.round((Date.now() - mtime) / 36e5);
   }
   return {
@@ -20899,47 +20882,47 @@ function registerDiagnose(program2) {
       return;
     }
     if (!opts.quiet) {
-      console.log(pc20.cyan("Building diagnostics zip\u2026"));
+      console.log(pc21.cyan("Building diagnostics zip\u2026"));
     }
     try {
       const { zipPath, entries } = await buildDiagnosticsZip();
       if (!opts.quiet) {
-        console.log(pc20.green(`Done: ${zipPath}`));
-        console.log(pc20.dim(`Contents: ${entries.join(", ")}`));
+        console.log(pc21.green(`Done: ${zipPath}`));
+        console.log(pc21.dim(`Contents: ${entries.join(", ")}`));
       }
       if (opts.upload) {
-        console.log(pc20.yellow(
+        console.log(pc21.yellow(
           `Telemetry endpoint not yet provisioned. Share the zip manually:
   File: ${zipPath}
   See docs/runbooks/share-diagnostics.md for instructions.`
         ));
       }
     } catch (err) {
-      console.error(pc20.red(`Diagnose failed: ${err.message}`));
+      console.error(pc21.red(`Diagnose failed: ${err.message}`));
       process.exitCode = 1;
     }
   });
 }
 
 // src/commands/update.ts
-import * as fs37 from "node:fs";
+import * as fs36 from "node:fs";
 import * as os22 from "node:os";
-import * as path41 from "node:path";
+import * as path40 from "node:path";
 import { execSync as execSync11 } from "node:child_process";
-import pc21 from "picocolors";
+import pc22 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
-import * as fs35 from "node:fs";
-import * as path39 from "node:path";
+import * as fs34 from "node:fs";
+import * as path38 from "node:path";
 var realFs = {
-  readdirSync: (p) => fs35.readdirSync(p),
-  existsSync: (p) => fs35.existsSync(p),
-  lstatSync: (p) => fs35.lstatSync(p),
-  readlinkSync: (p) => fs35.readlinkSync(p),
-  symlinkSync: (t, l) => fs35.symlinkSync(t, l),
-  unlinkSync: (p) => fs35.unlinkSync(p),
+  readdirSync: (p) => fs34.readdirSync(p),
+  existsSync: (p) => fs34.existsSync(p),
+  lstatSync: (p) => fs34.lstatSync(p),
+  readlinkSync: (p) => fs34.readlinkSync(p),
+  symlinkSync: (t, l) => fs34.symlinkSync(t, l),
+  unlinkSync: (p) => fs34.unlinkSync(p),
   mkdirSync: (p, o) => {
-    fs35.mkdirSync(p, o);
+    fs34.mkdirSync(p, o);
   }
 };
 function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
@@ -20949,8 +20932,8 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   _fs.mkdirSync(claudeSkillsDir, { recursive: true });
   const sourceSkills = _fs.existsSync(npmSkillsDir) ? _fs.readdirSync(npmSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const skill of sourceSkills) {
-    const linkPath = path39.join(claudeSkillsDir, skill);
-    const target = path39.join(npmSkillsDir, skill);
+    const linkPath = path38.join(claudeSkillsDir, skill);
+    const target = path38.join(npmSkillsDir, skill);
     if (!_fs.existsSync(linkPath)) {
       try {
         _fs.symlinkSync(target, linkPath);
@@ -20963,7 +20946,7 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
   }
   const deployedEntries = _fs.existsSync(claudeSkillsDir) ? _fs.readdirSync(claudeSkillsDir).filter((d) => d.startsWith("olam-")) : [];
   for (const entry of deployedEntries) {
-    const linkPath = path39.join(claudeSkillsDir, entry);
+    const linkPath = path38.join(claudeSkillsDir, entry);
     let isSymlink = false;
     try {
       isSymlink = _fs.lstatSync(linkPath).isSymbolicLink();
@@ -20988,9 +20971,9 @@ function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
 
 // src/commands/update.ts
 var PACKAGE_NAME = "@pleri/olam-cli";
-var CACHE_DIR2 = path41.join(os22.homedir(), ".olam", "cache");
-var LOG_DIR2 = path41.join(os22.homedir(), ".olam", "log");
-var LAST_STABLE_FILE = path41.join(CACHE_DIR2, "last-stable.txt");
+var CACHE_DIR2 = path40.join(os22.homedir(), ".olam", "cache");
+var LOG_DIR2 = path40.join(os22.homedir(), ".olam", "log");
+var LAST_STABLE_FILE = path40.join(CACHE_DIR2, "last-stable.txt");
 function defaultExec(cmd) {
   try {
     const stdout = execSync11(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
@@ -21012,22 +20995,22 @@ function getCurrentVersion(_exec = defaultExec) {
 }
 function readLastStable(file = LAST_STABLE_FILE) {
   try {
-    const v = fs37.readFileSync(file, "utf-8").trim();
+    const v = fs36.readFileSync(file, "utf-8").trim();
     return v || null;
   } catch {
     return null;
   }
 }
 function writeLastStable(version, file = LAST_STABLE_FILE) {
-  fs37.mkdirSync(path41.dirname(file), { recursive: true });
-  fs37.writeFileSync(file, version, { mode: 420 });
+  fs36.mkdirSync(path40.dirname(file), { recursive: true });
+  fs36.writeFileSync(file, version, { mode: 420 });
 }
 function logUpdateFailure(stderr) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const logFile = path41.join(LOG_DIR2, `update-${ts}.log`);
+  const logFile = path40.join(LOG_DIR2, `update-${ts}.log`);
   try {
-    fs37.mkdirSync(LOG_DIR2, { recursive: true });
-    fs37.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
+    fs36.mkdirSync(LOG_DIR2, { recursive: true });
+    fs36.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
 ${stderr}
 `, "utf-8");
   } catch {
@@ -21078,52 +21061,52 @@ async function doUpdate(opts, _exec = defaultExec, _reconcile = reconcileSkillSy
     writeLastStable(prevVersion);
   }
   if (!quiet) {
-    console.log(pc21.cyan(`Installing ${PACKAGE_NAME}@${channel}\u2026`));
+    console.log(pc22.cyan(`Installing ${PACKAGE_NAME}@${channel}\u2026`));
   }
   const installResult = _exec(`npm install -g ${PACKAGE_NAME}@${channel}`);
   if (installResult.exitCode !== 0) {
     logUpdateFailure(installResult.stderr);
     if (!quiet) {
-      console.error(pc21.red("Update failed."));
+      console.error(pc22.red("Update failed."));
     }
     const prev = readLastStable();
     if (prev) {
       if (!quiet) {
-        console.log(pc21.yellow(`Restoring to ${prev}\u2026`));
+        console.log(pc22.yellow(`Restoring to ${prev}\u2026`));
       }
       const restoreResult = _exec(`npm install -g ${PACKAGE_NAME}@${prev}`);
       if (restoreResult.exitCode !== 0) {
         if (!quiet) {
-          console.error(pc21.red(
+          console.error(pc22.red(
             `Restore also failed. Run: npm install -g ${PACKAGE_NAME}@${prev} manually.`
           ));
         }
       } else if (!quiet) {
-        console.log(pc21.yellow(`Restored to ${prev}.`));
+        console.log(pc22.yellow(`Restored to ${prev}.`));
       }
     } else if (!quiet) {
-      console.error(pc21.red("No previous version cached; cannot auto-restore."));
+      console.error(pc22.red("No previous version cached; cannot auto-restore."));
     }
     return { action: "restored", prevVersion: prev ?? void 0, exitCode: 11 };
   }
   const newVersion = getCurrentVersion(_exec) ?? void 0;
   if (!quiet && newVersion) {
-    console.log(pc21.green(`Updated to ${newVersion}.`));
+    console.log(pc22.green(`Updated to ${newVersion}.`));
   }
   const npmRootResult = _getNpmRoot("npm root -g");
   let symlinkResult = { added: [], removed: [] };
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
-    const npmSkillsDir = path41.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
-    const claudeSkillsDir = path41.join(os22.homedir(), ".claude", "skills");
+    const npmSkillsDir = path40.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills");
+    const claudeSkillsDir = path40.join(os22.homedir(), ".claude", "skills");
     const rec = _reconcile(npmSkillsDir, claudeSkillsDir);
     symlinkResult = { added: rec.added, removed: rec.removed };
     if (!quiet && (rec.added.length > 0 || rec.removed.length > 0)) {
       if (rec.added.length > 0) {
-        console.log(pc21.dim(`Skills added: ${rec.added.join(", ")}`));
+        console.log(pc22.dim(`Skills added: ${rec.added.join(", ")}`));
       }
       if (rec.removed.length > 0) {
-        console.log(pc21.dim(`Skills removed (dangling): ${rec.removed.join(", ")}`));
+        console.log(pc22.dim(`Skills removed (dangling): ${rec.removed.join(", ")}`));
       }
     }
   }
@@ -21161,8 +21144,8 @@ async function doRollback(_exec = defaultExec, _reconcile = reconcileSkillSymlin
   if (npmRootResult.exitCode === 0) {
     const npmRoot = npmRootResult.stdout.trim();
     _reconcile(
-      path41.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
-      path41.join(os22.homedir(), ".claude", "skills")
+      path40.join(npmRoot, "@pleri", "olam-cli", "plugin", "skills"),
+      path40.join(os22.homedir(), ".claude", "skills")
     );
   }
   return { action: "rolled-back", restoredVersion: prev, exitCode: 0 };
@@ -21217,7 +21200,7 @@ function registerUpdate(program2) {
 // src/commands/begin.ts
 init_host_cp();
 init_open_url();
-import pc22 from "picocolors";
+import pc23 from "picocolors";
 async function doBegin(opts, _startFn = startHostCp, _openFn = openUrl) {
   const prevExitCode = process.exitCode;
   await _startFn({ showToken: opts.showToken });
@@ -21227,7 +21210,7 @@ async function doBegin(opts, _startFn = startHostCp, _openFn = openUrl) {
     const token = readToken();
     if (token) {
       const base = `http://127.0.0.1:${HOST_CP_PORT}/`;
-      console.log(pc22.dim(`Opening ${base}`));
+      console.log(pc23.dim(`Opening ${base}`));
       _openFn(`${base}?token=${token}`);
     }
   }
@@ -21323,8 +21306,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path45, init = {}) {
-  const res = await fetch(`${BASE_URL}${path45}`, {
+async function apiFetch(path44, init = {}) {
+  const res = await fetch(`${BASE_URL}${path44}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -21476,7 +21459,7 @@ function registerMcpAdd(cmd) {
 
 // src/commands/mcp/list.ts
 init_output();
-import pc23 from "picocolors";
+import pc24 from "picocolors";
 function registerMcpList(cmd) {
   cmd.command("list").description("List all registered MCP credentials").action(async () => {
     const client = getMcpAuthClient();
@@ -21491,8 +21474,8 @@ function registerMcpList(cmd) {
     }
     const mcps = data.mcps ?? [];
     if (mcps.length === 0) {
-      console.log(pc23.dim("No MCP credentials registered."));
-      console.log(pc23.dim("Add one with: olam mcp add <service>"));
+      console.log(pc24.dim("No MCP credentials registered."));
+      console.log(pc24.dim("Add one with: olam mcp add <service>"));
       return;
     }
     const [c0, c1, c2, c3] = [16, 20, 10, 24];
@@ -21503,12 +21486,12 @@ function registerMcpList(cmd) {
       "ENV VAR".padEnd(c3),
       "STATUS"
     ].join("  ");
-    console.log(pc23.dim(header));
-    console.log(pc23.dim("\u2500".repeat(header.length)));
+    console.log(pc24.dim(header));
+    console.log(pc24.dim("\u2500".repeat(header.length)));
     for (const m of mcps) {
-      const status = !m.validated ? pc23.yellow("unvalidated") : m.expired ? pc23.red("expired") : pc23.green("active");
+      const status = !m.validated ? pc24.yellow("unvalidated") : m.expired ? pc24.red("expired") : pc24.green("active");
       const row = [
-        pc23.cyan(m.service.padEnd(c0)),
+        pc24.cyan(m.service.padEnd(c0)),
         m.label.padEnd(c1).slice(0, c1),
         m.type.padEnd(c2),
         (m.envName ?? "\u2014").padEnd(c3).slice(0, c3),
@@ -21536,13 +21519,13 @@ function registerMcpRemove(cmd) {
 
 // src/commands/mcp/status.ts
 init_output();
-import pc24 from "picocolors";
+import pc25 from "picocolors";
 function formatExpiry(expiresAt) {
   if (!expiresAt) return "\u2014";
   const ms = expiresAt - Date.now();
-  if (ms <= 0) return pc24.red("expired");
+  if (ms <= 0) return pc25.red("expired");
   const hours = ms / (1e3 * 60 * 60);
-  if (hours < 1) return pc24.yellow(`${Math.ceil(ms / 6e4)}m`);
+  if (hours < 1) return pc25.yellow(`${Math.ceil(ms / 6e4)}m`);
   return `${hours.toFixed(1)}h`;
 }
 function registerMcpStatus(cmd) {
@@ -21559,14 +21542,14 @@ function registerMcpStatus(cmd) {
     const mcps = data.mcps ?? [];
     printHeader(`MCP Credentials (${mcps.length})`);
     if (mcps.length === 0) {
-      console.log(pc24.dim("No credentials registered."));
+      console.log(pc25.dim("No credentials registered."));
       return;
     }
     for (const m of mcps) {
-      const stateColor = !m.validated ? pc24.yellow : m.expired ? pc24.red : pc24.green;
+      const stateColor = !m.validated ? pc25.yellow : m.expired ? pc25.red : pc25.green;
       const stateLabel = !m.validated ? "unvalidated" : m.expired ? "expired" : "active";
       console.log(`
-  ${pc24.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
+  ${pc25.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
       console.log(`    label:      ${m.label}`);
       console.log(`    type:       ${m.type}`);
       if (m.envName) console.log(`    env var:    ${m.envName}`);
@@ -21581,15 +21564,15 @@ function registerMcpStatus(cmd) {
 // src/commands/mcp/import.ts
 init_output();
 import * as readline3 from "node:readline";
-import pc25 from "picocolors";
+import pc26 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs38 from "node:fs";
+import * as fs37 from "node:fs";
 import * as os23 from "node:os";
-import * as path42 from "node:path";
+import * as path41 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs38.readFileSync(filePath, "utf-8");
+    const raw = fs37.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -21618,24 +21601,24 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path42.join(os23.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path41.join(os23.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path42.join(os23.homedir(), "AppData", "Roaming");
-    return path42.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path41.join(os23.homedir(), "AppData", "Roaming");
+    return path41.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path42.join(os23.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path41.join(os23.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path42.join(os23.homedir(), ".olam", "config.yaml"),
-    path42.join(process.cwd(), ".olam", "config.yaml")
+    path41.join(os23.homedir(), ".olam", "config.yaml"),
+    path41.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs38.existsSync(configPath)) continue;
+    if (!fs37.existsSync(configPath)) continue;
     try {
-      const raw = fs38.readFileSync(configPath, "utf-8");
+      const raw = fs37.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -21651,7 +21634,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path42.join(os23.homedir(), ".claude.json"),
+      path: path41.join(os23.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -21659,19 +21642,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path42.join(os23.homedir(), ".cursor", "mcp.json"),
+      path: path41.join(os23.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path42.join(os23.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path41.join(os23.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path42.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path42.basename(repoPath)})`
+      path: path41.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path41.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -21751,13 +21734,13 @@ async function validateMcpEntry(entry) {
 // src/commands/mcp/import.ts
 async function multiSelectPicker(entries) {
   if (entries.length === 0) return [];
-  console.log("\n" + pc25.bold("Discovered MCP servers:"));
+  console.log("\n" + pc26.bold("Discovered MCP servers:"));
   entries.forEach((e, i) => {
     console.log(
-      `  ${pc25.dim(`[${i + 1}]`)} ${pc25.cyan(e.name.padEnd(20))} ${pc25.dim(e.sourceLabel)}`
+      `  ${pc26.dim(`[${i + 1}]`)} ${pc26.cyan(e.name.padEnd(20))} ${pc26.dim(e.sourceLabel)}`
     );
   });
-  console.log("\n" + pc25.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
+  console.log("\n" + pc26.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
   const answer = await new Promise((resolve8) => {
     const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("> ", (ans) => {
@@ -21784,7 +21767,7 @@ function registerMcpImport(cmd) {
     const repoPaths = opts.repoPaths ? opts.repoPaths.split(",").map((s) => s.trim()) : void 0;
     const { entries, sources, durationMs } = await discoverMcpSources(repoPaths);
     if (entries.length === 0) {
-      console.log(pc25.dim("No MCP servers found in any source path."));
+      console.log(pc26.dim("No MCP servers found in any source path."));
       return;
     }
     printInfo("Sources", sources.length > 0 ? sources.join(", ") : "none");
@@ -21797,15 +21780,15 @@ function registerMcpImport(cmd) {
       candidates = filtered;
     }
     if (skippedCount > 0) {
-      console.log(pc25.dim(`skipped: ${skippedCount} already registered`));
+      console.log(pc26.dim(`skipped: ${skippedCount} already registered`));
     }
     if (candidates.length === 0) {
-      console.log(pc25.dim("Nothing new to import. Use --reimport to force."));
+      console.log(pc26.dim("Nothing new to import. Use --reimport to force."));
       return;
     }
     const selected = await multiSelectPicker(candidates);
     if (selected.length === 0) {
-      console.log(pc25.dim("No servers selected."));
+      console.log(pc26.dim("No servers selected."));
       return;
     }
     console.log(`
@@ -21816,16 +21799,16 @@ Importing ${selected.length} server(s)\u2026`);
       let validated = false;
       let validationReason = "skipped";
       if (opts.validate !== false) {
-        process.stdout.write(`  ${pc25.dim("\u2192")} ${entry.name}  validating\u2026 `);
+        process.stdout.write(`  ${pc26.dim("\u2192")} ${entry.name}  validating\u2026 `);
         const vr = await validateMcpEntry(entry);
         validated = vr.validated;
         validationReason = vr.reason;
         process.stdout.write(
-          validated ? pc25.green("ok\n") : pc25.yellow(`unvalidated (${vr.reason})
+          validated ? pc26.green("ok\n") : pc26.yellow(`unvalidated (${vr.reason})
 `)
         );
       } else {
-        console.log(`  ${pc25.dim("\u2192")} ${entry.name}  ${pc25.dim("(validation skipped)")}`);
+        console.log(`  ${pc26.dim("\u2192")} ${entry.name}  ${pc26.dim("(validation skipped)")}`);
       }
       if (validated) validatedCount++;
       const result = await client.staticAdd({
@@ -21840,21 +21823,21 @@ Importing ${selected.length} server(s)\u2026`);
       }
     }
     console.log("");
-    console.log(pc25.green(`\u2713 Imported ${importedCount}/${selected.length}`));
+    console.log(pc26.green(`\u2713 Imported ${importedCount}/${selected.length}`));
     if (validatedCount > 0) {
-      console.log(pc25.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
+      console.log(pc26.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
     }
   });
 }
 
 // src/commands/mcp/revoke.ts
 init_output();
-import pc26 from "picocolors";
+import pc27 from "picocolors";
 function registerMcpRevoke(cmd) {
   cmd.command("revoke <user> <world> <service>").description("Revoke a user's MCP service entitlement (multi-tenant mode only)").action(async (user, world, service) => {
     const multiTenant = (process.env["OLAM_MCP_MULTI_TENANT"] ?? "").toLowerCase() === "true";
     if (!multiTenant) {
-      console.warn(pc26.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
+      console.warn(pc27.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
       return;
     }
     const baseUrl = process.env["OLAM_MCP_AUTH_SERVICE_URL"] ?? "http://127.0.0.1:9998";
@@ -21883,8 +21866,8 @@ function registerMcpRevoke(cmd) {
       process.exitCode = 1;
       return;
     }
-    console.log(pc26.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
-    console.log(pc26.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
+    console.log(pc27.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
+    console.log(pc27.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
   });
 }
 
@@ -21901,18 +21884,18 @@ function registerMcp(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs39 from "node:fs";
-import * as path43 from "node:path";
+import * as fs38 from "node:fs";
+import * as path42 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path43.join(configDir, "config.yaml");
-  if (!fs39.existsSync(configPath)) {
+  const configPath = path42.join(configDir, "config.yaml");
+  if (!fs38.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs39.readFileSync(configPath, "utf8");
+    const contents = fs38.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -21923,14 +21906,14 @@ function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
 var program = new Command();
 function readCliVersion() {
   try {
-    const here = path44.dirname(fileURLToPath4(import.meta.url));
+    const here = path43.dirname(fileURLToPath4(import.meta.url));
     for (const candidate of [
-      path44.join(here, "package.json"),
-      path44.join(here, "..", "package.json"),
-      path44.join(here, "..", "..", "package.json")
+      path43.join(here, "package.json"),
+      path43.join(here, "..", "package.json"),
+      path43.join(here, "..", "..", "package.json")
     ]) {
-      if (fs40.existsSync(candidate)) {
-        const pkg = JSON.parse(fs40.readFileSync(candidate, "utf-8"));
+      if (fs39.existsSync(candidate)) {
+        const pkg = JSON.parse(fs39.readFileSync(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
       }
     }
@@ -21969,4 +21952,5 @@ registerBegin(program);
 registerStop(program);
 registerWorldUpgrade(program);
 registerMcp(program);
+registerServices(program);
 program.parse();