@pleri/olam-cli 0.1.75 → 0.1.77

package/dist/index.js

@@ -9788,6 +9788,7 @@ var init_schema3 = __esm({
       path: external_exports.string().min(1, "path must not be empty").refine(isAbsoluteOrTilde, {
         message: `path must be absolute (e.g. "/home/user/atlas-core") or "~/..." for the operator's home directory`
       }).refine(hasNoTraversalComponents, { message: 'path must not contain ".." components' }),
+      url: external_exports.string().min(1, "url must not be empty").optional(),
       description: external_exports.string().optional(),
       defaultBranch: external_exports.string().optional(),
       addedAt: external_exports.number().int().nonnegative(),
@@ -9998,8 +9999,47 @@ var init_runbooks = __esm({
   }
 });
 
-// ../core/dist/global-config/runbook-resolver.js
+// ../core/dist/global-config/bridge.js
 import * as fs19 from "node:fs";
+function repoEntryToRepoConfig(entry) {
+  if (!entry.url) {
+    throw new Error(`Repo "${entry.name}" has no url. Re-register:
+  olam repos remove ${entry.name}
+  olam repos add ${entry.name} --path ${entry.path}`);
+  }
+  const repoPath = resolveTildePath(entry.path);
+  if (!fs19.existsSync(repoPath)) {
+    throw new Error(`Repo "${entry.name}" path "${repoPath}" no longer exists. Run: olam repos update ${entry.name} --path <new-path>`);
+  }
+  let manifest = null;
+  try {
+    manifest = loadRepoManifest(repoPath);
+  } catch {
+  }
+  const config = {
+    name: entry.name,
+    url: entry.url,
+    // RepoEntry has no type field; generic is the safe universal default.
+    // Operators needing non-generic type behavior should declare the repo in local config.
+    type: "generic",
+    path: repoPath,
+    submodules: false,
+    services: [],
+    setup_commands: [],
+    ...manifest !== null ? { manifest } : {}
+  };
+  return config;
+}
+var init_bridge = __esm({
+  "../core/dist/global-config/bridge.js"() {
+    "use strict";
+    init_path();
+    init_repo_manifest();
+  }
+});
+
+// ../core/dist/global-config/runbook-resolver.js
+import * as fs20 from "node:fs";
 import * as os12 from "node:os";
 import * as path21 from "node:path";
 function expandTilde(p) {
@@ -10016,7 +10056,7 @@ function resolveRunbookToWorldParams(runbook, repoRegistry) {
       throw new Error(`repo "${repoName}" is referenced by runbook "${runbook.name}" but is not in the registry. Run "olam repos add ${repoName} --path <path>" to register it.`);
     }
     const resolvedPath = expandTilde(entry.path);
-    if (!fs19.existsSync(resolvedPath)) {
+    if (!fs20.existsSync(resolvedPath)) {
       throw new Error(`repo "${repoName}" path "${resolvedPath}" no longer exists. Run "olam repos update ${repoName} --path <new-path>" to fix.`);
     }
   }
@@ -10116,7 +10156,7 @@ var init_port_validator = __esm({
 });
 
 // ../core/dist/world/bootstrap-hooks.js
-import * as fs20 from "node:fs";
+import * as fs21 from "node:fs";
 import * as path22 from "node:path";
 function runFixtureCopySeeds(seeds, workspacePath) {
   if (!seeds)
@@ -10127,8 +10167,8 @@ function runFixtureCopySeeds(seeds, workspacePath) {
     const srcAbs = path22.resolve(workspacePath, seed.repo, seed.src);
     const destAbs = path22.resolve(workspacePath, seed.repo, seed.dest);
     const destDir = path22.dirname(destAbs);
-    fs20.mkdirSync(destDir, { recursive: true });
-    fs20.cpSync(srcAbs, destAbs, { recursive: true, force: true });
+    fs21.mkdirSync(destDir, { recursive: true });
+    fs21.cpSync(srcAbs, destAbs, { recursive: true, force: true });
   }
 }
 async function runSeedHooks(seeds, containerName, servicePortMap, exec) {
@@ -10285,7 +10325,7 @@ __export(manager_exports, {
 });
 import * as crypto5 from "node:crypto";
 import { execSync as execSync5 } from "node:child_process";
-import * as fs21 from "node:fs";
+import * as fs22 from "node:fs";
 import * as os13 from "node:os";
 import * as path23 from "node:path";
 import YAML3 from "yaml";
@@ -10651,6 +10691,7 @@ var init_manager = __esm({
     init_loader2();
     init_runbooks();
     init_store2();
+    init_bridge();
     init_runbook_resolver();
     init_port_validator();
     init_bootstrap_hooks();
@@ -10799,7 +10840,7 @@ ${detail}`);
             continue;
           const sourceRoot = repo.path.replace(/^~/, os13.homedir());
           const worktreeRoot = path23.join(workspacePath, repo.name);
-          if (!fs21.existsSync(sourceRoot) || !fs21.existsSync(worktreeRoot))
+          if (!fs22.existsSync(sourceRoot) || !fs22.existsSync(worktreeRoot))
             continue;
           let copied = 0;
           for (const pattern of RUNTIME_FILE_PATTERNS) {
@@ -10807,28 +10848,28 @@ ${detail}`);
             if (pattern.includes("*")) {
               const [dir, glob] = [path23.dirname(pattern), path23.basename(pattern)];
               const sourceDir = path23.join(sourceRoot, dir);
-              if (fs21.existsSync(sourceDir)) {
+              if (fs22.existsSync(sourceDir)) {
                 const ext2 = glob.replace(/^\*+/, "");
                 try {
-                  for (const entry of fs21.readdirSync(sourceDir)) {
+                  for (const entry of fs22.readdirSync(sourceDir)) {
                     if (ext2 === "" || entry.endsWith(ext2))
                       matches2.push(path23.join(dir, entry));
                   }
                 } catch {
                 }
               }
-            } else if (fs21.existsSync(path23.join(sourceRoot, pattern))) {
+            } else if (fs22.existsSync(path23.join(sourceRoot, pattern))) {
               matches2.push(pattern);
             }
             for (const rel of matches2) {
               const src = path23.join(sourceRoot, rel);
               const dst = path23.join(worktreeRoot, rel);
               try {
-                const st = fs21.statSync(src);
+                const st = fs22.statSync(src);
                 if (!st.isFile())
                   continue;
-                fs21.mkdirSync(path23.dirname(dst), { recursive: true });
-                fs21.copyFileSync(src, dst);
+                fs22.mkdirSync(path23.dirname(dst), { recursive: true });
+                fs22.copyFileSync(src, dst);
                 copied++;
               } catch {
               }
@@ -10995,9 +11036,9 @@ ${detail}`);
           if (opts.task)
             worldEnv.OLAM_TASK = opts.task;
           const r2CredsPath = path23.join(os13.homedir(), ".olam", "r2-credentials.json");
-          if (fs21.existsSync(r2CredsPath)) {
+          if (fs22.existsSync(r2CredsPath)) {
             try {
-              const r2Raw = fs21.readFileSync(r2CredsPath, "utf-8").trim();
+              const r2Raw = fs22.readFileSync(r2CredsPath, "utf-8").trim();
               if (r2Raw.length > 0) {
                 const r2 = JSON.parse(r2Raw);
                 if (typeof r2.account_id === "string")
@@ -11015,9 +11056,9 @@ ${detail}`);
             }
           }
           const keysYamlPath = path23.join(os13.homedir(), ".olam", "keys.yaml");
-          if (fs21.existsSync(keysYamlPath)) {
+          if (fs22.existsSync(keysYamlPath)) {
             try {
-              const keysRaw = fs21.readFileSync(keysYamlPath, "utf-8").trim();
+              const keysRaw = fs22.readFileSync(keysYamlPath, "utf-8").trim();
               if (keysRaw.length > 0) {
                 const parsed = YAML3.parse(keysRaw);
                 if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
@@ -11078,8 +11119,8 @@ ${detail}`);
             for (const { repoName, relativePath, content } of fileWrites) {
               const absPath = path23.join(workspacePath, repoName, relativePath);
               try {
-                fs21.mkdirSync(path23.dirname(absPath), { recursive: true });
-                fs21.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
+                fs22.mkdirSync(path23.dirname(absPath), { recursive: true });
+                fs22.writeFileSync(absPath, content.endsWith("\n") ? content : content + "\n", {
                   mode: 384
                 });
                 console.log(`[secrets] ${repoName}: materialised ${relativePath} (${content.length} chars, mode 0600)`);
@@ -11304,7 +11345,7 @@ ${opts.task}`;
                 execSync5(`docker exec ${containerName} mkdir -p /home/olam/.olam/policies`, { stdio: "pipe", timeout: 1e4 });
                 for (const repo of repos) {
                   const policiesDir = path23.join(workspacePath, repo.name, ".olam", "policies");
-                  if (fs21.existsSync(policiesDir)) {
+                  if (fs22.existsSync(policiesDir)) {
                     execSync5(`docker cp "${policiesDir}/." "${containerName}:/home/olam/.olam/policies/"`, { stdio: "pipe", timeout: 15e3 });
                   }
                 }
@@ -11396,8 +11437,8 @@ ${opts.task}`;
         } catch {
         }
         try {
-          fs21.rmSync(world.workspacePath, { recursive: true, force: true });
-          if (fs21.existsSync(world.workspacePath)) {
+          fs22.rmSync(world.workspacePath, { recursive: true, force: true });
+          if (fs22.existsSync(world.workspacePath)) {
             console.warn(`[WorldManager] destroyWorld(${worldId}): workspace dir ${world.workspacePath} still exists after rmSync. Run \`olam clean --apply\` to reap.`);
           }
         } catch (err) {
@@ -11470,26 +11511,50 @@ ${opts.task}`;
         if (!repoNames || repoNames.length === 0) {
           return [...this.config.repos];
         }
+        let globalRepos = [];
+        try {
+          globalRepos = readGlobalConfig().repos;
+        } catch {
+        }
         return repoNames.map((name) => {
-          const repo = this.config.repos.find((r) => r.name === name);
-          if (!repo) {
-            throw new Error(`Repo "${name}" not found in config`);
-          }
-          return repo;
+          const local = this.config.repos.find((r) => r.name === name);
+          if (local)
+            return local;
+          const globalEntry = globalRepos.find((r) => r.name === name);
+          if (globalEntry)
+            return repoEntryToRepoConfig(globalEntry);
+          throw new Error(`Repo "${name}" not found in config`);
         });
       }
       resolveReposFromNames(names) {
-        return names.map((name) => this.config.repos.find((r) => r.name === name)).filter((r) => r !== void 0);
+        let globalRepos = [];
+        try {
+          globalRepos = readGlobalConfig().repos;
+        } catch {
+        }
+        return names.map((name) => {
+          const local = this.config.repos.find((r) => r.name === name);
+          if (local)
+            return local;
+          const globalEntry = globalRepos.find((r) => r.name === name);
+          if (!globalEntry)
+            return void 0;
+          try {
+            return repoEntryToRepoConfig(globalEntry);
+          } catch {
+            return void 0;
+          }
+        }).filter((r) => r !== void 0);
       }
       transportPlanFile(planFilePath, workspacePath, repoNames) {
-        const planContent = fs21.readFileSync(planFilePath, "utf-8");
+        const planContent = fs22.readFileSync(planFilePath, "utf-8");
         const planFileName = path23.basename(planFilePath);
         const targetRepo = repoNames[0];
         if (!targetRepo)
           return;
         const plansDir = path23.join(workspacePath, targetRepo, "docs", "plans");
-        fs21.mkdirSync(plansDir, { recursive: true });
-        fs21.writeFileSync(path23.join(plansDir, planFileName), planContent);
+        fs22.mkdirSync(plansDir, { recursive: true });
+        fs22.writeFileSync(path23.join(plansDir, planFileName), planContent);
       }
       resolveServices(repos) {
         const services = [];
@@ -12202,7 +12267,7 @@ var init_session_aggregator = __esm({
 
 // ../core/dist/dashboard/server.js
 import * as http from "node:http";
-import * as fs22 from "node:fs";
+import * as fs23 from "node:fs";
 import * as path25 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function jsonResponse(res, data, status = 200) {
@@ -12214,7 +12279,7 @@ function notFound(res) {
 }
 function openThoughtStore(workspacePath) {
   const dbPath = getWorldDbPath(workspacePath);
-  if (!fs22.existsSync(dbPath))
+  if (!fs23.existsSync(dbPath))
     return null;
   return new ThoughtLocalStore(dbPath);
 }
@@ -12388,10 +12453,10 @@ function createDashboardServer(opts) {
   const thisDir = path25.dirname(fileURLToPath3(import.meta.url));
   const defaultPublicDir = path25.resolve(thisDir, "../../../control-plane/public");
   const publicDir = opts.publicDir ?? defaultPublicDir;
-  let hasPublicDir = fs22.existsSync(publicDir);
+  let hasPublicDir = fs23.existsSync(publicDir);
   const server = http.createServer((req, res) => {
     if (!hasPublicDir) {
-      hasPublicDir = fs22.existsSync(publicDir);
+      hasPublicDir = fs23.existsSync(publicDir);
     }
     const host = req.headers.host ?? `localhost:${port}`;
     const url = new URL(req.url ?? "/", `http://${host}`);
@@ -12670,17 +12735,17 @@ function createDashboardServer(opts) {
       notFound(res);
       return;
     }
-    if (fs22.existsSync(filePath) && fs22.statSync(filePath).isFile()) {
+    if (fs23.existsSync(filePath) && fs23.statSync(filePath).isFile()) {
       const ext2 = path25.extname(filePath);
       const contentType = MIME[ext2] ?? "application/octet-stream";
       res.writeHead(200, { "Content-Type": contentType });
-      fs22.createReadStream(filePath).pipe(res);
+      fs23.createReadStream(filePath).pipe(res);
       return;
     }
     filePath = path25.join(publicDir, "index.html");
-    if (fs22.existsSync(filePath)) {
+    if (fs23.existsSync(filePath)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      fs22.createReadStream(filePath).pipe(res);
+      fs23.createReadStream(filePath).pipe(res);
       return;
     }
     notFound(res);
@@ -12711,16 +12776,16 @@ var init_server = __esm({
 });
 
 // ../core/dist/dashboard/state.js
-import * as fs23 from "node:fs";
+import * as fs24 from "node:fs";
 import * as os14 from "node:os";
 import * as path26 from "node:path";
 function saveDashboardState(state) {
-  fs23.mkdirSync(path26.dirname(STATE_PATH), { recursive: true });
-  fs23.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
+  fs24.mkdirSync(path26.dirname(STATE_PATH), { recursive: true });
+  fs24.writeFileSync(STATE_PATH, JSON.stringify(state, null, 2));
 }
 function loadDashboardState() {
   try {
-    const raw = fs23.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs24.readFileSync(STATE_PATH, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -12728,7 +12793,7 @@ function loadDashboardState() {
 }
 function clearDashboardState() {
   try {
-    fs23.unlinkSync(STATE_PATH);
+    fs24.unlinkSync(STATE_PATH);
   } catch {
   }
 }
@@ -13143,7 +13208,7 @@ __export(host_cp_exports, {
   writeToken: () => writeToken
 });
 import * as crypto6 from "node:crypto";
-import * as fs24 from "node:fs";
+import * as fs25 from "node:fs";
 import * as os15 from "node:os";
 import * as path27 from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -13158,7 +13223,7 @@ function findComposeFile() {
     path27.resolve(process.cwd(), "../packages/host-cp/compose.yaml")
   ];
   for (const c of candidates) {
-    if (fs24.existsSync(c)) return c;
+    if (fs25.existsSync(c)) return c;
   }
   return path27.resolve(process.cwd(), "packages/host-cp/compose.yaml");
 }
@@ -13176,8 +13241,8 @@ function authSecretPath() {
 }
 function readAuthSecret2() {
   const filePath = authSecretPath();
-  if (!fs24.existsSync(filePath)) return null;
-  const raw = fs24.readFileSync(filePath, "utf-8").trim();
+  if (!fs25.existsSync(filePath)) return null;
+  const raw = fs25.readFileSync(filePath, "utf-8").trim();
   return raw.length > 0 ? raw : null;
 }
 function r2CredentialsPath() {
@@ -13185,8 +13250,8 @@ function r2CredentialsPath() {
 }
 function readR2Credentials() {
   const filePath = r2CredentialsPath();
-  if (!fs24.existsSync(filePath)) return null;
-  const raw = fs24.readFileSync(filePath, "utf-8").trim();
+  if (!fs25.existsSync(filePath)) return null;
+  const raw = fs25.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = JSON.parse(raw);
@@ -13209,37 +13274,37 @@ function readR2Credentials() {
 function writeToken() {
   const token = crypto6.randomBytes(32).toString("hex");
   const filePath = tokenPath();
-  fs24.mkdirSync(path27.dirname(filePath), { recursive: true });
-  fs24.writeFileSync(filePath, token, { mode: 384 });
+  fs25.mkdirSync(path27.dirname(filePath), { recursive: true });
+  fs25.writeFileSync(filePath, token, { mode: 384 });
   return token;
 }
 function readToken() {
   const filePath = tokenPath();
-  if (!fs24.existsSync(filePath)) return null;
-  return fs24.readFileSync(filePath, "utf-8").trim();
+  if (!fs25.existsSync(filePath)) return null;
+  return fs25.readFileSync(filePath, "utf-8").trim();
 }
 function removeToken() {
   const filePath = tokenPath();
-  if (!fs24.existsSync(filePath)) return false;
-  fs24.unlinkSync(filePath);
+  if (!fs25.existsSync(filePath)) return false;
+  fs25.unlinkSync(filePath);
   return true;
 }
 function writePid(pid) {
   const filePath = pidPath();
-  fs24.mkdirSync(path27.dirname(filePath), { recursive: true });
-  fs24.writeFileSync(filePath, String(pid), { mode: 420 });
+  fs25.mkdirSync(path27.dirname(filePath), { recursive: true });
+  fs25.writeFileSync(filePath, String(pid), { mode: 420 });
 }
 function readPid() {
   const filePath = pidPath();
-  if (!fs24.existsSync(filePath)) return null;
-  const raw = fs24.readFileSync(filePath, "utf-8").trim();
+  if (!fs25.existsSync(filePath)) return null;
+  const raw = fs25.readFileSync(filePath, "utf-8").trim();
   const n = parseInt(raw, 10);
   return Number.isFinite(n) ? n : null;
 }
 function removePid() {
   const filePath = pidPath();
-  if (!fs24.existsSync(filePath)) return false;
-  fs24.unlinkSync(filePath);
+  if (!fs25.existsSync(filePath)) return false;
+  fs25.unlinkSync(filePath);
   return true;
 }
 async function findHostCpContainer() {
@@ -13402,7 +13467,7 @@ async function handleStart(opts) {
   }
   const token = writeToken();
   const composeFile = findComposeFile();
-  if (!fs24.existsSync(composeFile)) {
+  if (!fs25.existsSync(composeFile)) {
     printError(`compose.yaml not found at ${composeFile}. Run from the olam project root.`);
     removeToken();
     process.exitCode = 1;
@@ -13484,7 +13549,7 @@ async function stopHostCp() {
 }
 async function handleStop() {
   const composeFile = findComposeFile();
-  if (!fs24.existsSync(composeFile)) {
+  if (!fs25.existsSync(composeFile)) {
     printWarning(`compose.yaml not found at ${composeFile}. Cleaning up token + PID anyway.`);
     removeToken();
     removePid();
@@ -13512,13 +13577,13 @@ async function buildStatusReport() {
   const container = await findHostCpContainer();
   const health = await probeHealth();
   const tokenFile = tokenPath();
-  const tokenPresent = fs24.existsSync(tokenFile);
+  const tokenPresent = fs25.existsSync(tokenFile);
   let tokenModeOk = false;
   if (tokenPresent) {
-    const mode = fs24.statSync(tokenFile).mode & 511;
+    const mode = fs25.statSync(tokenFile).mode & 511;
     tokenModeOk = mode === 384;
   }
-  const pidPresent = fs24.existsSync(pidPath());
+  const pidPresent = fs25.existsSync(pidPath());
   let stack;
   if (!container) {
     stack = "not_started";
@@ -13606,8 +13671,8 @@ async function discoverWorldPort(worldId) {
 }
 async function readHostCpToken2() {
   const tp = tokenPath();
-  if (!fs24.existsSync(tp)) return null;
-  return fs24.readFileSync(tp, "utf-8").trim();
+  if (!fs25.existsSync(tp)) return null;
+  return fs25.readFileSync(tp, "utf-8").trim();
 }
 async function callHostCpProxy(method, worldId, path48, body) {
   const token = await readHostCpToken2();
@@ -13738,7 +13803,7 @@ __export(install_root_exports, {
   isDevMode: () => isDevMode,
   resolveBuildScript: () => resolveBuildScript
 });
-import { existsSync as existsSync22 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 import { dirname as dirname17, join as join28, resolve as resolve8 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function installRoot(metaUrl = import.meta.url) {
@@ -13748,7 +13813,7 @@ function installRoot(metaUrl = import.meta.url) {
 function isDevMode(env = process.env, installRootDir = installRoot()) {
   if (env.OLAM_DEV !== "1") return false;
   const repoRoot = resolve8(installRootDir, "..", "..");
-  return existsSync22(join28(repoRoot, "packages")) && existsSync22(join28(repoRoot, "package.json"));
+  return existsSync23(join28(repoRoot, "packages")) && existsSync23(join28(repoRoot, "package.json"));
 }
 function resolveBuildScript(input) {
   const { scriptRelPath, env = process.env, installRootDir = installRoot() } = input;
@@ -13927,20 +13992,20 @@ var init_registry_allowlist = __esm({
 });
 
 // ../core/dist/world/world-yaml.js
-import * as fs26 from "node:fs";
+import * as fs27 from "node:fs";
 import * as path29 from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
 function writeWorldYaml(worldPath, data) {
   const olamDir = path29.join(worldPath, ".olam");
-  fs26.mkdirSync(olamDir, { recursive: true });
-  fs26.writeFileSync(path29.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
+  fs27.mkdirSync(olamDir, { recursive: true });
+  fs27.writeFileSync(path29.join(olamDir, "world.yaml"), stringifyYaml4(data), "utf-8");
 }
 function readWorldYaml(worldPath) {
   const yamlPath = path29.join(worldPath, ".olam", "world.yaml");
-  if (!fs26.existsSync(yamlPath))
+  if (!fs27.existsSync(yamlPath))
     return null;
   try {
-    const raw = fs26.readFileSync(yamlPath, "utf-8");
+    const raw = fs27.readFileSync(yamlPath, "utf-8");
     const parsed = parseYaml4(raw);
     return WorldYamlSchema.parse(parsed);
   } catch {
@@ -14071,16 +14136,16 @@ __export(machine_schema_exports, {
   readMachineConfig: () => readMachineConfig,
   writeMachineConfig: () => writeMachineConfig
 });
-import * as fs39 from "node:fs";
+import * as fs40 from "node:fs";
 import * as path43 from "node:path";
 import * as os23 from "node:os";
 import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
 function readMachineConfig(configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  if (!fs39.existsSync(p))
+  if (!fs40.existsSync(p))
     return null;
   try {
-    const raw = fs39.readFileSync(p, "utf-8");
+    const raw = fs40.readFileSync(p, "utf-8");
     const parsed = parseYaml5(raw);
     return MachineConfigSchema.parse(parsed);
   } catch {
@@ -14089,8 +14154,8 @@ function readMachineConfig(configPath) {
 }
 function writeMachineConfig(config, configPath) {
   const p = configPath ?? DEFAULT_CONFIG_PATH;
-  fs39.mkdirSync(path43.dirname(p), { recursive: true });
-  fs39.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
+  fs40.mkdirSync(path43.dirname(p), { recursive: true });
+  fs40.writeFileSync(p, stringifyYaml5({ ...config }), { mode: 420 });
 }
 function initMachineConfig(opts = {}) {
   const configPath = opts.configPath ?? DEFAULT_CONFIG_PATH;
@@ -14711,7 +14776,7 @@ var LOCAL_DATA_DIR = path10.join(os5.homedir(), ".olam", "auth-data");
 init_output();
 init_host_cp();
 init_auth();
-import * as fs25 from "node:fs";
+import * as fs26 from "node:fs";
 import * as path28 from "node:path";
 import { spawnSync as spawnSync7 } from "node:child_process";
 import ora2 from "ora";
@@ -14723,13 +14788,13 @@ init_exit_codes();
 init_protocol_version();
 init_output();
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync18 } from "node:fs";
 import { join as join29 } from "node:path";
 import ora from "ora";
 import pc6 from "picocolors";
 function loadImageDigests(installRootDir = installRoot()) {
   const digestsPath = join29(installRootDir, "dist", "image-digests.json");
-  if (!existsSync23(digestsPath)) {
+  if (!existsSync24(digestsPath)) {
     throw new Error(
       `image-digests.json missing at ${digestsPath}. Re-run \`npm install -g @pleri/olam-cli@<version>\` to refresh the tarball.`
     );
@@ -15054,7 +15119,7 @@ function parseAuthUpgradeOpts(raw) {
 }
 function validateAuthRepoRoot(cwd) {
   const marker = path28.join(cwd, "packages/auth-service/Dockerfile");
-  if (!fs25.existsSync(marker)) {
+  if (!fs26.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -15788,14 +15853,14 @@ ${pc9.dim("Next: olam create --name my-world")}`);
 // src/commands/create.ts
 init_manager();
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { existsSync as existsSync26 } from "node:fs";
+import { existsSync as existsSync27 } from "node:fs";
 import { dirname as dirname18, resolve as resolve9 } from "node:path";
 import ora3 from "ora";
 import pc10 from "picocolors";
 
 // ../core/dist/world/devbox-freshness.js
 import { execSync as execSync7 } from "node:child_process";
-import { existsSync as existsSync25, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync26, statSync as statSync6 } from "node:fs";
 import { join as join31 } from "node:path";
 var DEFAULT_DEVBOX_IMAGE = "olam-devbox:latest";
 var DEVBOX_BAKED_SOURCES = [
@@ -15885,7 +15950,7 @@ function defaultDockerInspect(image) {
 }
 function defaultStatMtime(absPath) {
   try {
-    if (!existsSync25(absPath))
+    if (!existsSync26(absPath))
       return null;
     return statSync6(absPath).mtimeMs;
   } catch {
@@ -16025,15 +16090,15 @@ init_host_cp();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs45 } = await import("node:fs");
+    const { default: fs46 } = await import("node:fs");
     const { default: os27 } = await import("node:os");
     const { default: path48 } = await import("node:path");
     const tp = path48.join(
       process.env.OLAM_HOME ?? path48.join(os27.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs45.existsSync(tp)) return null;
-    return fs45.readFileSync(tp, "utf-8").trim();
+    if (!fs46.existsSync(tp)) return null;
+    return fs46.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -16382,7 +16447,7 @@ ${pc10.cyan("Host CP UI:")} ${worldUrl}`);
 function resolveRepoRoot(start) {
   let cur = start;
   while (true) {
-    if (existsSync26(resolve9(cur, "packages")) && existsSync26(resolve9(cur, "package.json"))) {
+    if (existsSync27(resolve9(cur, "packages")) && existsSync27(resolve9(cur, "package.json"))) {
       return cur;
     }
     const parent = dirname18(cur);
@@ -16396,12 +16461,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs45 } = await import("node:fs");
+    const { default: fs46 } = await import("node:fs");
     const { default: os27 } = await import("node:os");
     const { default: path48 } = await import("node:path");
     const tp = path48.join(os27.homedir(), ".olam", "host-cp.token");
-    if (!fs45.existsSync(tp)) return null;
-    const raw = fs45.readFileSync(tp, "utf-8").trim();
+    if (!fs46.existsSync(tp)) return null;
+    const raw = fs46.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -16613,7 +16678,7 @@ function registerList(program2) {
 
 // src/commands/status.ts
 init_output();
-import * as fs27 from "node:fs";
+import * as fs28 from "node:fs";
 import * as os16 from "node:os";
 import * as path30 from "node:path";
 var CLI_VERSION2 = process.env["OLAM_CLI_VERSION"] ?? "0.0.0";
@@ -16648,11 +16713,11 @@ async function getMachineStatus(_probe, _loadCtx, _readToken) {
   const manifestPath2 = path30.join(os16.homedir(), ".olam", "cache", "manifest.json");
   let updateAvailable = null;
   let lastUpdateCheck = null;
-  if (fs27.existsSync(manifestPath2)) {
-    const mtime = fs27.statSync(manifestPath2).mtime;
+  if (fs28.existsSync(manifestPath2)) {
+    const mtime = fs28.statSync(manifestPath2).mtime;
     lastUpdateCheck = mtime.toISOString();
     try {
-      const manifest = JSON.parse(fs27.readFileSync(manifestPath2, "utf-8"));
+      const manifest = JSON.parse(fs28.readFileSync(manifestPath2, "utf-8"));
       const latest = manifest["version"];
       updateAvailable = latest !== void 0 && latest !== CLI_VERSION2;
     } catch {
@@ -16775,7 +16840,7 @@ function registerDestroy(program2) {
 // src/commands/clean.ts
 init_context();
 init_output();
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 import os17 from "node:os";
 import path31 from "node:path";
 import { execFileSync as execFileSync6 } from "node:child_process";
@@ -16802,7 +16867,7 @@ async function runClean(opts) {
     return 1;
   }
   const worldsDir = path31.join(os17.homedir(), ".olam", "worlds");
-  if (!fs28.existsSync(worldsDir)) {
+  if (!fs29.existsSync(worldsDir)) {
     if (opts.json) {
       process.stdout.write(`${JSON.stringify({ worldsDir, entries: [] })}
 `);
@@ -16817,7 +16882,7 @@ async function runClean(opts) {
   }
   const worktreeMap = collectWorktrees(worldsDir);
   const entries = [];
-  for (const id of fs28.readdirSync(worldsDir).sort()) {
+  for (const id of fs29.readdirSync(worldsDir).sort()) {
     const fullPath = path31.join(worldsDir, id);
     const stat = safeStat(fullPath);
     if (!stat || !stat.isDirectory()) continue;
@@ -16930,20 +16995,20 @@ function reapEntry(entry) {
     }
   }
   try {
-    fs28.rmSync(entry.path, { recursive: true, force: true });
+    fs29.rmSync(entry.path, { recursive: true, force: true });
   } catch (err) {
     process.stderr.write(`  ! rm ${entry.path}: ${err instanceof Error ? err.message : String(err)}
 `);
     return false;
   }
-  return !fs28.existsSync(entry.path);
+  return !fs29.existsSync(entry.path);
 }
 function collectWorktrees(worldsDir) {
   const out = /* @__PURE__ */ new Map();
-  for (const id of fs28.readdirSync(worldsDir)) {
+  for (const id of fs29.readdirSync(worldsDir)) {
     const child = path31.join(worldsDir, id, "olam");
     const gitMarker = path31.join(child, ".git");
-    if (!fs28.existsSync(gitMarker)) continue;
+    if (!fs29.existsSync(gitMarker)) continue;
     const gitDir = resolveGitDirForWorktree(child);
     if (!gitDir) continue;
     const branch = readBranch(child);
@@ -17011,7 +17076,7 @@ function countUnpushed(worktreePath) {
 }
 function safeStat(p) {
   try {
-    return fs28.statSync(p);
+    return fs29.statSync(p);
   } catch {
     return null;
   }
@@ -17023,7 +17088,7 @@ function computeBytes(p) {
     const cur = stack.pop();
     let st;
     try {
-      st = fs28.lstatSync(cur);
+      st = fs29.lstatSync(cur);
     } catch {
       continue;
     }
@@ -17031,7 +17096,7 @@ function computeBytes(p) {
     if (st.isDirectory()) {
       let entries;
       try {
-        entries = fs28.readdirSync(cur);
+        entries = fs29.readdirSync(cur);
       } catch {
         continue;
       }
@@ -17243,7 +17308,7 @@ init_context();
 init_output();
 init_exit_codes();
 init_world_paths();
-import * as fs29 from "node:fs";
+import * as fs30 from "node:fs";
 import "node:path";
 import ora6 from "ora";
 function registerCrystallize(program2, options = {}) {
@@ -17275,7 +17340,7 @@ function registerCrystallize(program2, options = {}) {
       return;
     }
     const thoughtDbPath = getWorldDbPath(world.workspacePath);
-    if (!fs29.existsSync(thoughtDbPath)) {
+    if (!fs30.existsSync(thoughtDbPath)) {
       printError(`No thoughts captured yet for "${worldId}". Run a dispatch first.`);
       process.exitCode = EXIT_GENERIC_ERROR;
       return;
@@ -19479,7 +19544,7 @@ function registerPolicyCheck(program2) {
 }
 
 // src/commands/worldspec/compile.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync18, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "node:fs";
 import { resolve as resolvePath } from "node:path";
 import YAML5 from "yaml";
 
@@ -20282,7 +20347,7 @@ function registerWorldspecCompile(parent) {
     const sourcePolicies = [];
     for (const p of paths) {
       const abs = resolvePath(process.cwd(), p);
-      if (!existsSync30(abs)) {
+      if (!existsSync31(abs)) {
         printError(`worldspec not found at ${abs}`);
         process.exit(EXIT_WORLDSPEC_FILE_NOT_FOUND);
       }
@@ -20373,7 +20438,7 @@ function getPkgVersion() {
 // src/commands/worldspec/init.ts
 init_exit_codes();
 init_output();
-import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "node:fs";
 import { execSync as execSync10 } from "node:child_process";
 import { basename as basename3, resolve as resolvePath2 } from "node:path";
 function registerWorldspecInit(parent) {
@@ -20391,7 +20456,7 @@ function registerWorldspecInit(parent) {
     const cwd = process.cwd();
     const targetDir = resolvePath2(cwd, ".olam/worldspecs");
     const targetFile = resolvePath2(targetDir, "default.yaml");
-    if (existsSync31(targetFile) && !opts.force) {
+    if (existsSync32(targetFile) && !opts.force) {
       printError(
         `${targetFile} already exists; pass --force to overwrite`
       );
@@ -20425,12 +20490,12 @@ function registerWorldspecInit(parent) {
   });
 }
 function detectProjectShape(root, useAdbYaml) {
-  const hasGemfile = existsSync31(resolvePath2(root, "Gemfile"));
-  const hasNodePackageJson = existsSync31(resolvePath2(root, "package.json"));
-  const hasAdbYaml = existsSync31(resolvePath2(root, ".adb.yaml"));
+  const hasGemfile = existsSync32(resolvePath2(root, "Gemfile"));
+  const hasNodePackageJson = existsSync32(resolvePath2(root, "package.json"));
+  const hasAdbYaml = existsSync32(resolvePath2(root, ".adb.yaml"));
   let rubyVersion = null;
   const rubyVersionPath = resolvePath2(root, ".ruby-version");
-  if (existsSync31(rubyVersionPath)) {
+  if (existsSync32(rubyVersionPath)) {
     try {
       const raw = readFileSync22(rubyVersionPath, "utf8").trim();
       const match2 = raw.match(/(\d+\.\d+\.\d+)/);
@@ -21835,7 +21900,7 @@ function registerWorldspecSchema(parent) {
 }
 
 // src/commands/worldspec/validate.ts
-import { existsSync as existsSync32, readFileSync as readFileSync23 } from "node:fs";
+import { existsSync as existsSync33, readFileSync as readFileSync23 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 init_exit_codes();
 init_output();
@@ -21852,7 +21917,7 @@ function registerWorldspecValidate(parent) {
     "human"
   ).action(async (pathArg, opts) => {
     const absPath = resolvePath4(process.cwd(), pathArg);
-    if (!existsSync32(absPath)) {
+    if (!existsSync33(absPath)) {
       printError(`worldspec not found at ${absPath}`);
       process.exit(EXIT_WORLDSPEC_FILE_NOT_FOUND);
     }
@@ -21904,14 +21969,14 @@ function registerWorldspec(program2) {
 // src/commands/upgrade.ts
 init_output();
 init_host_cp();
-import * as fs32 from "node:fs";
+import * as fs33 from "node:fs";
 import * as path36 from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 import ora7 from "ora";
 import pc17 from "picocolors";
 
 // src/commands/upgrade-lock.ts
-import * as fs30 from "node:fs";
+import * as fs31 from "node:fs";
 import * as os18 from "node:os";
 import * as path34 from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
@@ -21919,8 +21984,8 @@ var LOCK_FILE_PATH = path34.join(os18.homedir(), ".olam", ".upgrade.lock");
 var STALE_LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
 function readLockFile(lockPath) {
   try {
-    if (!fs30.existsSync(lockPath)) return null;
-    const raw = fs30.readFileSync(lockPath, "utf-8").trim();
+    if (!fs31.existsSync(lockPath)) return null;
+    const raw = fs31.readFileSync(lockPath, "utf-8").trim();
     if (raw.length === 0) return null;
     const parsed = JSON.parse(raw);
     if (typeof parsed.pid !== "number" || typeof parsed.startTs !== "number") return null;
@@ -21966,15 +22031,15 @@ function isStaleLock(content, nowMs = Date.now()) {
 }
 function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
   const dir = path34.dirname(lockPath);
-  fs30.mkdirSync(dir, { recursive: true });
+  fs31.mkdirSync(dir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = fs30.openSync(lockPath, "wx", 420);
+      const fd = fs31.openSync(lockPath, "wx", 420);
       try {
         const content = { pid: process.pid, startTs: nowMs };
-        fs30.writeSync(fd, JSON.stringify(content));
+        fs31.writeSync(fd, JSON.stringify(content));
       } finally {
-        fs30.closeSync(fd);
+        fs31.closeSync(fd);
       }
       return { acquired: true, lockPath };
     } catch (err) {
@@ -21983,7 +22048,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
       const existing2 = readLockFile(lockPath);
       if (isStaleLock(existing2, nowMs)) {
         try {
-          fs30.unlinkSync(lockPath);
+          fs31.unlinkSync(lockPath);
         } catch (unlinkErr) {
           const ucode = unlinkErr.code;
           if (ucode !== "ENOENT") throw unlinkErr;
@@ -22008,7 +22073,7 @@ function acquireLock(lockPath = LOCK_FILE_PATH, nowMs = Date.now()) {
 }
 function releaseLock(lockPath = LOCK_FILE_PATH) {
   try {
-    fs30.unlinkSync(lockPath);
+    fs31.unlinkSync(lockPath);
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") throw err;
@@ -22026,7 +22091,7 @@ function formatRefusalMessage(result, lockPath = LOCK_FILE_PATH) {
 }
 
 // src/commands/upgrade-log.ts
-import * as fs31 from "node:fs";
+import * as fs32 from "node:fs";
 import * as os19 from "node:os";
 import * as path35 from "node:path";
 function getUpgradeLogPath() {
@@ -22036,9 +22101,9 @@ function getUpgradeLogPath() {
 var UPGRADE_LOG_PATH = getUpgradeLogPath();
 function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   try {
-    fs31.mkdirSync(path35.dirname(logPath), { recursive: true });
+    fs32.mkdirSync(path35.dirname(logPath), { recursive: true });
     const line = JSON.stringify(row) + "\n";
-    fs31.appendFileSync(logPath, line, { mode: 420 });
+    fs32.appendFileSync(logPath, line, { mode: 420 });
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to append: ${err instanceof Error ? err.message : String(err)}
@@ -22047,10 +22112,10 @@ function appendUpgradeLog(row, logPath = getUpgradeLogPath()) {
   }
 }
 function readUpgradeLog(limit = 10, logPath = getUpgradeLogPath()) {
-  if (!fs31.existsSync(logPath)) return [];
+  if (!fs32.existsSync(logPath)) return [];
   let raw;
   try {
-    raw = fs31.readFileSync(logPath, "utf-8");
+    raw = fs32.readFileSync(logPath, "utf-8");
   } catch (err) {
     process.stderr.write(
       `[upgrade-log] failed to read: ${err instanceof Error ? err.message : String(err)}
@@ -22145,10 +22210,10 @@ var AUTH_HEALTH_URL2 = "http://127.0.0.1:9999/health";
 function isNodeModulesInSync(cwd) {
   const lockPath = path36.join(cwd, "package-lock.json");
   const markerPath = path36.join(cwd, "node_modules", ".package-lock.json");
-  if (!fs32.existsSync(lockPath) || !fs32.existsSync(markerPath)) return false;
+  if (!fs33.existsSync(lockPath) || !fs33.existsSync(markerPath)) return false;
   try {
-    const lockStat = fs32.statSync(lockPath);
-    const markerStat = fs32.statSync(markerPath);
+    const lockStat = fs33.statSync(lockPath);
+    const markerStat = fs33.statSync(markerPath);
     return markerStat.mtimeMs >= lockStat.mtimeMs;
   } catch {
     return false;
@@ -22165,7 +22230,7 @@ function shouldSkipInstall(opts, cwd) {
 }
 function validateRepoRoot(cwd) {
   const marker = path36.join(cwd, "packages/host-cp/compose.yaml");
-  if (!fs32.existsSync(marker)) {
+  if (!fs33.existsSync(marker)) {
     return {
       ok: false,
       error: `Not an olam repo root (expected ${marker}).
@@ -22522,8 +22587,8 @@ async function recreateAuthService() {
 }
 function readBundleHash(cwd) {
   const indexPath = path36.join(cwd, "packages/control-plane/public/index.html");
-  if (!fs32.existsSync(indexPath)) return null;
-  return extractBundleHash(fs32.readFileSync(indexPath, "utf-8"));
+  if (!fs33.existsSync(indexPath)) return null;
+  return extractBundleHash(fs33.readFileSync(indexPath, "utf-8"));
 }
 async function runUpgradePullByDigest(deps = {}) {
   const docker2 = deps.docker ?? realDocker;
@@ -23557,7 +23622,7 @@ ${pc19.dim(`world: ${worldId}  sort: ${sortKey}  refresh: 5s  Ctrl-C to exit`)}
 
 // src/commands/keys.ts
 init_output();
-import * as fs33 from "node:fs";
+import * as fs34 from "node:fs";
 import * as os20 from "node:os";
 import * as path37 from "node:path";
 import YAML6 from "yaml";
@@ -23569,8 +23634,8 @@ function keysFilePath() {
 }
 function readKeysFile() {
   const filePath = keysFilePath();
-  if (!fs33.existsSync(filePath)) return null;
-  const raw = fs33.readFileSync(filePath, "utf-8").trim();
+  if (!fs34.existsSync(filePath)) return null;
+  const raw = fs34.readFileSync(filePath, "utf-8").trim();
   if (raw.length === 0) return null;
   try {
     const parsed = YAML6.parse(raw);
@@ -23586,13 +23651,13 @@ function readKeysFile() {
 }
 function writeKeysFile(keys) {
   const dir = olamHome2();
-  if (!fs33.existsSync(dir)) {
-    fs33.mkdirSync(dir, { recursive: true });
+  if (!fs34.existsSync(dir)) {
+    fs34.mkdirSync(dir, { recursive: true });
   }
   const filePath = keysFilePath();
   const content = YAML6.stringify(keys);
-  fs33.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
-  fs33.chmodSync(filePath, 384);
+  fs34.writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
+  fs34.chmodSync(filePath, 384);
 }
 function redact(value) {
   if (value.length <= 8) return value + "...";
@@ -23635,7 +23700,7 @@ function registerKeys(program2) {
       }
       const { [key]: _removed, ...rest } = existing;
       if (Object.keys(rest).length === 0) {
-        fs33.unlinkSync(keysFilePath());
+        fs34.unlinkSync(keysFilePath());
       } else {
         writeKeysFile(rest);
       }
@@ -23660,7 +23725,7 @@ function registerKeys(program2) {
 // src/commands/world-snapshot.ts
 init_snapshot();
 init_output();
-import * as fs34 from "node:fs";
+import * as fs35 from "node:fs";
 import * as path38 from "node:path";
 import { execSync as execSync11 } from "node:child_process";
 import pc20 from "picocolors";
@@ -23686,14 +23751,14 @@ function bumpDeprecationCounter() {
   if (process.env[INTERNAL_SENTINEL_ENV] === "1") return;
   const counterPath = path38.join(snapshotsDir(), ".deprecation-counter");
   try {
-    fs34.mkdirSync(path38.dirname(counterPath), { recursive: true });
+    fs35.mkdirSync(path38.dirname(counterPath), { recursive: true });
     let current = 0;
-    if (fs34.existsSync(counterPath)) {
-      const raw = fs34.readFileSync(counterPath, "utf-8").trim();
+    if (fs35.existsSync(counterPath)) {
+      const raw = fs35.readFileSync(counterPath, "utf-8").trim();
       const parsed = parseInt(raw, 10);
       if (Number.isInteger(parsed) && parsed >= 0) current = parsed;
     }
-    fs34.writeFileSync(counterPath, String(current + 1), { mode: 384 });
+    fs35.writeFileSync(counterPath, String(current + 1), { mode: 384 });
   } catch {
   }
 }
@@ -23776,10 +23841,10 @@ async function captureGems(worldId, workspacePath, repo) {
   }
   const tarPath = snapshotTarPath(worldId, "gems", repo, fingerprint);
   const vendorBundle = path38.join(repoDir, "vendor", "bundle");
-  if (fs34.existsSync(vendorBundle)) {
+  if (fs35.existsSync(vendorBundle)) {
     try {
       packTarball(vendorBundle, tarPath);
-      const stat = fs34.statSync(tarPath);
+      const stat = fs35.statSync(tarPath);
       const manifest = {
         kind: "gems",
         worldId,
@@ -23812,10 +23877,10 @@ async function captureGems(worldId, workspacePath, repo) {
       `docker exec ${containerName} sh -c 'mkdir -p "$(dirname ${tmpTar})" && tar -czf ${tmpTar}.tmp -C ${bundlePath} . && mv ${tmpTar}.tmp ${tmpTar}'`,
       { stdio: "pipe", timeout: 12e4 }
     );
-    fs34.mkdirSync(path38.dirname(tarPath), { recursive: true });
+    fs35.mkdirSync(path38.dirname(tarPath), { recursive: true });
     execSync11(`docker cp ${containerName}:${tmpTar} "${tarPath}"`, { stdio: "pipe", timeout: 12e4 });
     execSync11(`docker exec ${containerName} rm -f ${tmpTar}`, { stdio: "pipe" });
-    const stat = fs34.statSync(tarPath);
+    const stat = fs35.statSync(tarPath);
     const manifest = {
       kind: "gems",
       worldId,
@@ -23838,13 +23903,13 @@ async function captureNode(worldId, workspacePath, repo) {
     return { ok: false, tarPath: "", msg: "no lockfile \u2014 layer does not apply" };
   }
   const nodeModules = path38.join(repoDir, "node_modules");
-  if (!fs34.existsSync(nodeModules)) {
+  if (!fs35.existsSync(nodeModules)) {
     return { ok: false, tarPath: "", msg: "node_modules not installed yet" };
   }
   const tarPath = snapshotTarPath(worldId, "node", repo, fingerprint);
   try {
     packTarball(nodeModules, tarPath);
-    const stat = fs34.statSync(tarPath);
+    const stat = fs35.statSync(tarPath);
     const manifest = {
       kind: "node",
       worldId,
@@ -23876,13 +23941,13 @@ async function capturePg(worldId, workspacePath, repoNames) {
   }
   try {
     execSync11(`docker stop ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    fs34.mkdirSync(path38.dirname(tarPath), { recursive: true });
+    fs35.mkdirSync(path38.dirname(tarPath), { recursive: true });
     execSync11(
       `docker run --rm         -v "${volumeName2}:/pgdata:ro"         -v "${path38.dirname(tarPath)}:/dest"         alpine         sh -c 'tar -czf /dest/${path38.basename(tarPath)}.tmp -C /pgdata . && mv /dest/${path38.basename(tarPath)}.tmp /dest/${path38.basename(tarPath)}'`,
       { stdio: "pipe", timeout: 18e4 }
     );
     execSync11(`docker start ${containerName}`, { stdio: "pipe", timeout: 3e4 });
-    const stat = fs34.statSync(tarPath);
+    const stat = fs35.statSync(tarPath);
     const manifest = {
       kind: "pg",
       worldId,
@@ -23906,18 +23971,18 @@ async function handleEvict(opts) {
   const maxBytes = Number.isInteger(cap) && cap > 0 ? cap : 5 * 1024 * 1024 * 1024;
   if (opts.dryRun) {
     const root = snapshotsDir();
-    if (!fs34.existsSync(root)) {
+    if (!fs35.existsSync(root)) {
       console.log(pc20.dim("No snapshot dir; nothing to evict."));
       return;
     }
     const allTars = [];
     const walk2 = (d) => {
-      for (const entry of fs34.readdirSync(d, { withFileTypes: true })) {
+      for (const entry of fs35.readdirSync(d, { withFileTypes: true })) {
         const full = path38.join(d, entry.name);
         if (entry.isDirectory()) {
           walk2(full);
         } else if (entry.name.endsWith(".tar.gz")) {
-          const stat = fs34.statSync(full);
+          const stat = fs35.statSync(full);
           allTars.push({ path: full, size: stat.size, mtime: stat.mtimeMs });
         }
       }
@@ -24010,31 +24075,31 @@ function formatAge2(ms) {
 // src/commands/refresh.ts
 init_context();
 init_output();
-import * as fs36 from "node:fs";
+import * as fs37 from "node:fs";
 import * as os21 from "node:os";
 import * as path40 from "node:path";
 import { spawnSync as spawnSync13 } from "node:child_process";
 import ora8 from "ora";
 
 // src/commands/refresh-helpers.ts
-import * as fs35 from "node:fs";
+import * as fs36 from "node:fs";
 import * as path39 from "node:path";
 function collectCpSourceFiles(standaloneDir) {
-  if (!fs35.existsSync(standaloneDir)) {
+  if (!fs36.existsSync(standaloneDir)) {
     throw new Error(`CP standalone dir not found: ${standaloneDir}`);
   }
   const entries = [];
-  const topLevel = fs35.readdirSync(standaloneDir).filter((f) => {
-    const stat = fs35.statSync(path39.join(standaloneDir, f));
+  const topLevel = fs36.readdirSync(standaloneDir).filter((f) => {
+    const stat = fs36.statSync(path39.join(standaloneDir, f));
     return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
   }).sort();
   for (const f of topLevel) {
     entries.push({ srcPath: path39.join(standaloneDir, f), destRelPath: f });
   }
   const libDir = path39.join(standaloneDir, "lib");
-  if (fs35.existsSync(libDir) && fs35.statSync(libDir).isDirectory()) {
-    const libFiles = fs35.readdirSync(libDir).filter((f) => {
-      const stat = fs35.statSync(path39.join(libDir, f));
+  if (fs36.existsSync(libDir) && fs36.statSync(libDir).isDirectory()) {
+    const libFiles = fs36.readdirSync(libDir).filter((f) => {
+      const stat = fs36.statSync(path39.join(libDir, f));
       return stat.isFile() && f.endsWith(".mjs") && !f.endsWith(".test.mjs");
     }).sort();
     for (const f of libFiles) {
@@ -24096,16 +24161,16 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  const stagingDir = fs36.mkdtempSync(
+  const stagingDir = fs37.mkdtempSync(
     path40.join(os21.tmpdir(), `olam-refresh-${worldId}-`)
   );
   try {
     const hasLib = entries.some((e) => e.destRelPath.startsWith("lib/"));
     if (hasLib) {
-      fs36.mkdirSync(path40.join(stagingDir, "lib"), { recursive: true });
+      fs37.mkdirSync(path40.join(stagingDir, "lib"), { recursive: true });
     }
     for (const { srcPath, destRelPath } of entries) {
-      fs36.copyFileSync(srcPath, path40.join(stagingDir, destRelPath));
+      fs37.copyFileSync(srcPath, path40.join(stagingDir, destRelPath));
     }
     const cpResult = docker([
       "cp",
@@ -24120,7 +24185,7 @@ async function refreshWorld(worldId, portOffset, standaloneDir, opts) {
       };
     }
   } finally {
-    fs36.rmSync(stagingDir, { recursive: true, force: true });
+    fs37.rmSync(stagingDir, { recursive: true, force: true });
   }
   if (opts.restart) {
     const restartResult = docker([
@@ -24161,7 +24226,7 @@ function registerRefresh(program2) {
       process.cwd(),
       "packages/control-plane/standalone"
     );
-    if (!fs36.existsSync(standaloneDir)) {
+    if (!fs37.existsSync(standaloneDir)) {
       printError(
         `CP standalone source not found at ${standaloneDir}.
 Run \`olam refresh\` from the olam repo root.`
@@ -24240,7 +24305,7 @@ Run \`olam refresh\` from the olam repo root.`
 }
 
 // src/commands/diagnose.ts
-import * as fs37 from "node:fs";
+import * as fs38 from "node:fs";
 import * as os22 from "node:os";
 import * as path41 from "node:path";
 import { execFileSync as execFileSync8, execSync as execSync12 } from "node:child_process";
@@ -24294,9 +24359,9 @@ function defaultZip(zipPath, files) {
 async function buildDiagnosticsZip(_exec = (cmd) => safeExec(cmd), _outDir = DIAGNOSTICS_DIR, _logDir = LOG_DIR, _zip = defaultZip) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 23);
   const zipPath = path41.join(_outDir, `olam-diag-${ts}.zip`);
-  const tmpDir = fs37.mkdtempSync(path41.join(os22.tmpdir(), "olam-diag-"));
+  const tmpDir = fs38.mkdtempSync(path41.join(os22.tmpdir(), "olam-diag-"));
   try {
-    fs37.mkdirSync(_outDir, { recursive: true });
+    fs38.mkdirSync(_outDir, { recursive: true });
     const entries = [];
     const version = process.env["OLAM_CLI_VERSION"] ?? "unknown";
     const nodeVersion = process.version;
@@ -24313,13 +24378,13 @@ platform: ${platform}
     ].join("\n") + "\n";
     _writeEntry(tmpDir, "os-info.txt", stripSecrets(osContent), entries);
     const depsFile = path41.join(CACHE_DIR, "deps.json");
-    if (fs37.existsSync(depsFile)) {
-      const deps = fs37.readFileSync(depsFile, "utf-8");
+    if (fs38.existsSync(depsFile)) {
+      const deps = fs38.readFileSync(depsFile, "utf-8");
       _writeEntry(tmpDir, "deps.json", stripSecrets(deps), entries);
     }
     const latestLog = _latestLog(_logDir);
     if (latestLog) {
-      const lines = fs37.readFileSync(latestLog, "utf-8").split("\n");
+      const lines = fs38.readFileSync(latestLog, "utf-8").split("\n");
       const tail = lines.slice(-LOG_TAIL_LINES).join("\n");
       _writeEntry(tmpDir, "log-tail.txt", stripSecrets(tail), entries);
     }
@@ -24337,32 +24402,32 @@ platform: ${platform}
     } catch (err) {
       throw new Error(`zip command produced no output file. zip stderr: ${err.message}`);
     }
-    if (!fs37.existsSync(zipPath)) {
+    if (!fs38.existsSync(zipPath)) {
       throw new Error("zip command produced no output file.");
     }
     return { zipPath, entries };
   } finally {
     try {
-      fs37.rmSync(tmpDir, { recursive: true, force: true });
+      fs38.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
 }
 function _writeEntry(dir, name, content, entries) {
-  fs37.writeFileSync(path41.join(dir, name), content, { mode: 420 });
+  fs38.writeFileSync(path41.join(dir, name), content, { mode: 420 });
   entries.push(name);
 }
 function _latestLog(logDir) {
-  if (!fs37.existsSync(logDir)) return null;
-  const files = fs37.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
+  if (!fs38.existsSync(logDir)) return null;
+  const files = fs38.readdirSync(logDir).filter((f) => f.startsWith("host-")).sort().reverse();
   return files.length > 0 ? path41.join(logDir, files[0]) : null;
 }
 async function buildTelemetryPayload() {
   const channel = "stable";
   const manifestFile = path41.join(CACHE_DIR, "manifest.json");
   let manifestAgeHours = null;
-  if (fs37.existsSync(manifestFile)) {
-    const mtime = fs37.statSync(manifestFile).mtime.getTime();
+  if (fs38.existsSync(manifestFile)) {
+    const mtime = fs38.statSync(manifestFile).mtime.getTime();
     manifestAgeHours = Math.round((Date.now() - mtime) / 36e5);
   }
   return {
@@ -24405,24 +24470,24 @@ function registerDiagnose(program2) {
 }
 
 // src/commands/update.ts
-import * as fs40 from "node:fs";
+import * as fs41 from "node:fs";
 import * as os24 from "node:os";
 import * as path44 from "node:path";
 import { execSync as execSync13 } from "node:child_process";
 import pc22 from "picocolors";
 
 // src/lib/symlink-reconcile.ts
-import * as fs38 from "node:fs";
+import * as fs39 from "node:fs";
 import * as path42 from "node:path";
 var realFs = {
-  readdirSync: (p) => fs38.readdirSync(p),
-  existsSync: (p) => fs38.existsSync(p),
-  lstatSync: (p) => fs38.lstatSync(p),
-  readlinkSync: (p) => fs38.readlinkSync(p),
-  symlinkSync: (t, l) => fs38.symlinkSync(t, l),
-  unlinkSync: (p) => fs38.unlinkSync(p),
+  readdirSync: (p) => fs39.readdirSync(p),
+  existsSync: (p) => fs39.existsSync(p),
+  lstatSync: (p) => fs39.lstatSync(p),
+  readlinkSync: (p) => fs39.readlinkSync(p),
+  symlinkSync: (t, l) => fs39.symlinkSync(t, l),
+  unlinkSync: (p) => fs39.unlinkSync(p),
   mkdirSync: (p, o) => {
-    fs38.mkdirSync(p, o);
+    fs39.mkdirSync(p, o);
   }
 };
 function reconcileSkillSymlinks(npmSkillsDir, claudeSkillsDir, _fs = realFs) {
@@ -24495,22 +24560,22 @@ function getCurrentVersion(_exec = defaultExec) {
 }
 function readLastStable(file = LAST_STABLE_FILE) {
   try {
-    const v = fs40.readFileSync(file, "utf-8").trim();
+    const v = fs41.readFileSync(file, "utf-8").trim();
     return v || null;
   } catch {
     return null;
   }
 }
 function writeLastStable(version, file = LAST_STABLE_FILE) {
-  fs40.mkdirSync(path44.dirname(file), { recursive: true });
-  fs40.writeFileSync(file, version, { mode: 420 });
+  fs41.mkdirSync(path44.dirname(file), { recursive: true });
+  fs41.writeFileSync(file, version, { mode: 420 });
 }
 function logUpdateFailure(stderr) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const logFile = path44.join(LOG_DIR2, `update-${ts}.log`);
   try {
-    fs40.mkdirSync(LOG_DIR2, { recursive: true });
-    fs40.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
+    fs41.mkdirSync(LOG_DIR2, { recursive: true });
+    fs41.appendFileSync(logFile, `[update-failure ${(/* @__PURE__ */ new Date()).toISOString()}]
 ${stderr}
 `, "utf-8");
   } catch {
@@ -24726,7 +24791,7 @@ function registerBegin(program2) {
 }
 
 // src/commands/config.ts
-import * as fs42 from "node:fs";
+import * as fs43 from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
 
 // ../core/dist/global-config/index.js
@@ -24735,7 +24800,7 @@ init_store2();
 
 // ../core/dist/global-config/repos.js
 init_store2();
-import * as fs41 from "node:fs";
+import * as fs42 from "node:fs";
 import * as os25 from "node:os";
 import * as path45 from "node:path";
 function expandPath(p) {
@@ -24753,7 +24818,7 @@ function addRepo(entry) {
     throw new Error(`repo "${entry.name}" already registered. Use "olam repos update" to change its path.`);
   }
   const resolvedPath = expandPath(entry.path);
-  if (!fs41.existsSync(resolvedPath)) {
+  if (!fs42.existsSync(resolvedPath)) {
     throw new Error(`path "${entry.path}" does not exist. Verify the path is correct.`);
   }
   const now = Date.now();
@@ -24782,7 +24847,7 @@ function updateRepo(name, updates) {
     throw new Error(`repo "${name}" is not registered. Run "olam repos list" to see registered repos.`);
   }
   const resolvedUpdatePath = updates.path !== void 0 ? expandPath(updates.path) : void 0;
-  if (resolvedUpdatePath !== void 0 && !fs41.existsSync(resolvedUpdatePath)) {
+  if (resolvedUpdatePath !== void 0 && !fs42.existsSync(resolvedUpdatePath)) {
     throw new Error(`path "${updates.path}" does not exist. Verify the path is correct.`);
   }
   const existing = config.repos[idx];
@@ -24802,6 +24867,7 @@ function updateRepo(name, updates) {
 // ../core/dist/global-config/index.js
 init_runbooks();
 init_port_validator();
+init_bridge();
 
 // src/commands/config.ts
 init_store2();
@@ -24811,14 +24877,14 @@ function registerConfig(program2) {
   const config = program2.command("config").description("Manage global olam configuration");
   config.command("validate [path]").description("Validate ~/.olam/config.json (or a custom path) against the schema").action((filePath) => {
     const resolvedPath = filePath ?? globalConfigPath();
-    if (!fs42.existsSync(resolvedPath)) {
+    if (!fs43.existsSync(resolvedPath)) {
       process.stderr.write(`config file not found: ${resolvedPath}
 `);
       process.exit(1);
     }
     let raw;
     try {
-      raw = fs42.readFileSync(resolvedPath, "utf-8");
+      raw = fs43.readFileSync(resolvedPath, "utf-8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       process.stderr.write(`cannot read ${resolvedPath}: ${msg}
@@ -25409,12 +25475,12 @@ import * as readline3 from "node:readline";
 import pc28 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs43 from "node:fs";
+import * as fs44 from "node:fs";
 import * as os26 from "node:os";
 import * as path46 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs43.readFileSync(filePath, "utf-8");
+    const raw = fs44.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -25458,9 +25524,9 @@ function getOlamRepoPaths() {
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs43.existsSync(configPath)) continue;
+    if (!fs44.existsSync(configPath)) continue;
     try {
-      const raw = fs43.readFileSync(configPath, "utf-8");
+      const raw = fs44.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -25726,18 +25792,18 @@ function registerMcp(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs44 from "node:fs";
+import * as fs45 from "node:fs";
 import * as path47 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
   const configPath = path47.join(configDir, "config.yaml");
-  if (!fs44.existsSync(configPath)) {
+  if (!fs45.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs44.readFileSync(configPath, "utf8");
+    const contents = fs45.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;