@mifune/agro 0.12.1 → 0.12.2

package/dist/agro.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname10, join as join14, resolve as resolve14 } from "node:path";
+import { dirname as dirname10, join as join14, resolve as resolve13 } from "node:path";
 import { existsSync as existsSync20, mkdtempSync as mkdtempSync4, readFileSync as readFileSync12, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 
@@ -230,16 +230,10 @@ function resolveRegistryHome(env = process.env, home = homedir(), warn) {
   if (configured !== void 0) return { path: resolve(configured), configured: true };
   return { path: home, configured: false };
 }
-function generationUserStateHome(generation, env, home, warn) {
+function resolveAgroUserStateHome(env = process.env, home = homedir(), warn) {
   const configured = aliasedEnvValue(env, "HOME", warn);
   if (configured !== void 0) return resolve(configured);
-  return join(home, GENERATIONS[generation].userStateDir);
-}
-function resolveAgroUserStateHome(env = process.env, home = homedir(), warn) {
-  return generationUserStateHome("agro", env, home, warn);
-}
-function resolveLegacyUserStateHome(env = process.env, home = homedir(), warn) {
-  return generationUserStateHome("legacy", env, home, warn);
+  return join(home, GENERATIONS.agro.userStateDir);
 }
 function resolveUserStateHome(env = process.env, home = homedir(), warn) {
   const configured = aliasedEnvValue(env, "HOME", warn);
@@ -1970,8 +1964,8 @@ function redact(token) {
 async function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    return await new Promise((resolve15) => {
-      rl.question(`  ${question} `, (answer) => resolve15(answer.trim()));
+    return await new Promise((resolve14) => {
+      rl.question(`  ${question} `, (answer) => resolve14(answer.trim()));
     });
   } finally {
     rl.close();
@@ -1983,7 +1977,7 @@ async function askSecret(question) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   const bytes = [];
-  return await new Promise((resolve15) => {
+  return await new Promise((resolve14) => {
     const cleanup = () => {
       try {
         process.stdin.setRawMode(false);
@@ -2001,7 +1995,7 @@ async function askSecret(question) {
         } else if (byte === 13 || byte === 10) {
           cleanup();
           process.stdout.write("\n");
-          resolve15(Buffer.from(bytes).toString("utf8").trim());
+          resolve14(Buffer.from(bytes).toString("utf8").trim());
           return;
         } else if (byte === 127 || byte === 8) {
           if (bytes.length > 0) {
@@ -2051,10 +2045,10 @@ async function askSecretPiped(question) {
   };
   process.on("SIGINT", onSigint);
   try {
-    return await new Promise((resolve15) => {
+    return await new Promise((resolve14) => {
       rl.question(`  ${question} `, (answer) => {
         process.stdout.write("\n");
-        resolve15(answer.trim());
+        resolve14(answer.trim());
       });
     });
   } finally {
@@ -4012,7 +4006,7 @@ async function runSandboxList(opts, io) {
 // src/commands/harness.ts
 import { existsSync as existsSync18 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { delimiter as delimiter2, join as join12, resolve as resolve12 } from "node:path";
+import { delimiter as delimiter2, join as join12 } from "node:path";
 
 // src/lib/docs.ts
 var SOURCE_DOCS_BASE = "https://github.com/mifunedev/agro/blob/main/";
@@ -4028,24 +4022,35 @@ function sourceDocsUrl(docsPath) {
 import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync11, renameSync as renameSync5, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute2, join as join10, resolve as resolve10 } from "node:path";
 var HOST_CONFIG_MODE = 420;
-function hostConfigPath(env = process.env, home) {
-  return join10(resolveAgroUserStateHome(env, home), GENERATIONS.agro.configFile);
+var HOST_CONFIG_FILE = "config.json";
+var WORKSPACES_SUBDIR = "workspaces";
+var DEFAULT_WORKSPACE_NAME = "default";
+function hostStateHome(env, home) {
+  return resolveAgroUserStateHome(env, home);
 }
-function legacyHostConfigPath(env = process.env, home) {
-  return join10(resolveLegacyUserStateHome(env, home), GENERATIONS.legacy.configFile);
+function hostConfigPath(env, home) {
+  return join10(hostStateHome(env, home), HOST_CONFIG_FILE);
 }
-function readableHostConfigPath(env, home) {
-  const path4 = hostConfigPath(env, home);
-  if (existsSync16(path4)) return path4;
-  const legacy = legacyHostConfigPath(env, home);
-  return existsSync16(legacy) ? legacy : path4;
+function assertWorkspaceName(name) {
+  if (!SANDBOX_NAME_PATTERN.test(name)) {
+    throw new Error(
+      `invalid workspace name "${name}" \u2014 use lowercase letters, digits and dashes, starting with a letter or digit`
+    );
+  }
 }
-function defaultHarnessRoot(env = process.env, home) {
-  return resolveAgroUserStateHome(env, home);
+function workspacesRoot(env, home) {
+  return join10(hostStateHome(env, home), WORKSPACES_SUBDIR);
+}
+function workspaceRoot(name, env, home) {
+  assertWorkspaceName(name);
+  return join10(workspacesRoot(env, home), name);
+}
+function defaultHarnessRoot(env, home) {
+  return join10(workspacesRoot(env, home), DEFAULT_WORKSPACE_NAME);
 }
 function validateHostConfig(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${GENERATIONS.agro.configFile}: must contain a JSON object`);
+    throw new Error(`${HOST_CONFIG_FILE}: must contain a JSON object`);
   }
   const record = value;
   if (record.version !== void 0 && record.version !== 1) {
@@ -4097,8 +4102,8 @@ function validateReceipts(value, field, noun) {
     }
   }
 }
-function readHostConfig(env = process.env, home) {
-  const path4 = readableHostConfigPath(env, home);
+function readHostConfig(env, home) {
+  const path4 = hostConfigPath(env, home);
   if (!existsSync16(path4)) return { version: 1 };
   let raw;
   try {
@@ -4115,7 +4120,7 @@ function readHostConfig(env = process.env, home) {
   }
   return validateHostConfig(parsed);
 }
-function writeHostConfig(config, env = process.env, home) {
+function writeHostConfig(config, env, home) {
   const path4 = hostConfigPath(env, home);
   const validated = validateHostConfig({ ...config, version: 1 });
   const body = `${JSON.stringify(validated, null, 2)}
@@ -4125,7 +4130,6 @@ function writeHostConfig(config, env = process.env, home) {
   try {
     writeFileSync8(tmp, body, { mode: HOST_CONFIG_MODE, encoding: "utf8" });
     renameSync5(tmp, path4);
-    retireLegacyHostConfig(env, home, path4);
   } catch (error) {
     try {
       unlinkSync5(tmp);
@@ -4134,19 +4138,14 @@ function writeHostConfig(config, env = process.env, home) {
     throw error;
   }
 }
-function resolveHarnessRoot(explicit, env = process.env, home) {
+function resolveHarnessRoot(explicit, env, home) {
   if (typeof explicit === "string" && explicit !== "") return resolve10(explicit);
   const configured = readHostConfig(env, home).harnessRoot;
   if (typeof configured === "string" && configured !== "") return resolve10(configured);
   return defaultHarnessRoot(env, home);
 }
-function retireLegacyHostConfig(env, home, written) {
-  const legacy = legacyHostConfigPath(env, home);
-  if (legacy === written || !existsSync16(legacy)) return;
-  unlinkSync5(legacy);
-}
 function fieldError2(path4, requirement) {
-  return new Error(`${GENERATIONS.agro.configFile}: ${path4} ${requirement}`);
+  return new Error(`${HOST_CONFIG_FILE}: ${path4} ${requirement}`);
 }
 
 // src/lib/host-workspace.ts
@@ -4159,6 +4158,40 @@ var IGNORABLE_ENTRIES = [
   GENERATIONS.agro.configFile,
   GENERATIONS.legacy.configFile
 ];
+var STATE_HOME_DIRS = [
+  GENERATIONS.legacy.userStateDir,
+  GENERATIONS.agro.userStateDir
+];
+function isDirectory2(path4) {
+  return statSync5(path4, { throwIfNoEntry: false })?.isDirectory() === true;
+}
+function stateHomes(home) {
+  return STATE_HOME_DIRS.map((name) => join11(home, name));
+}
+function stateHomeRefusal(bin, home) {
+  const [legacy, agro] = stateHomes(home);
+  if (isDirectory2(legacy) && isDirectory2(agro)) {
+    return `${bin} harness: the host state home is split \u2014 ${legacy} and ${agro} both exist.
+Merge them with \`${bin} migrate --home\`, then re-run this command.
+`;
+  }
+  if (isDirectory2(legacy)) {
+    return `${bin} harness: the host state home is the legacy ${legacy}, and host state now lives in ${agro}.
+Creating ${agro} beside it would split the two.
+Migrate first with \`${bin} migrate --home\`, then re-run this command.
+`;
+  }
+  return void 0;
+}
+function stateHomeRootRefusal(bin, root, home) {
+  const target = resolve11(root);
+  const enclosing = stateHomes(home).find((state) => target === state);
+  if (enclosing === void 0) return void 0;
+  return `${bin} harness: the harness root ${target} is the state home ${enclosing} itself.
+A workspace there collides with AGRO state and blocks every command run from ${home}.
+Move it out \u2014 for example \`mv ${enclosing} ${join11(home, "agro")}\` \u2014 then re-run this command.
+`;
+}
 function isIgnorableEntry(name) {
   return name.startsWith(".") || IGNORABLE_ENTRIES.includes(name);
 }
@@ -4229,7 +4262,8 @@ var HARNESS_CATALOG = [
     verifyArgv: ["claude", "--version"],
     uninstallArgv: ["npm", "--prefix", HARNESS_PREFIX_TOKEN, "uninstall", "-g", "@anthropic-ai/claude-code"],
     docsPath: "docs/harnesses/claude-code.md",
-    kind: "installable"
+    kind: "installable",
+    bypassPermissionsFlag: "--permission-mode bypassPermissions"
   },
   {
     id: "codex",
@@ -4376,6 +4410,9 @@ function resolveVerifyArgv(entry, prefix) {
 function resolveUninstallArgv(entry, prefix) {
   return entry.uninstallArgv === null ? null : substitute(entry.uninstallArgv, prefix);
 }
+function harnessLaunchCommand(entry) {
+  return entry.bypassPermissionsFlag === void 0 ? entry.binary : `${entry.binary} ${entry.bypassPermissionsFlag}`;
+}
 function harnessBinPath(prefix) {
   return `${prefix}/bin`;
 }
@@ -4443,7 +4480,7 @@ function stateOf(entry, installed, location) {
 function probeableHost(env, home) {
   let root;
   try {
-    root = resolveHarnessRoot(void 0, env);
+    root = resolveHarnessRoot(void 0, env, home);
   } catch {
     return void 0;
   }
@@ -4578,7 +4615,13 @@ function isInteractive(opts) {
 async function installOnHost(entry, opts, io, run, status) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
-  const flagged = opts.host === true || opts.path !== void 0;
+  const home = homeOf(opts);
+  const flagged = opts.host === true || opts.path !== void 0 || opts.workspace !== void 0;
+  const generation = stateHomeRefusal(bin, home);
+  if (generation !== void 0) {
+    io.stderr(generation);
+    return 1;
+  }
   if (!flagged && !isInteractive(opts)) {
     io.stderr(
       sandboxRefusal(bin, status) + `Or install on the host with \`${bin} harness install ${entry.id} --host\`.
@@ -4593,15 +4636,17 @@ async function installOnHost(entry, opts, io, run, status) {
   }
   let root;
   let recorded;
+  let explicit;
   try {
-    recorded = readHostConfig(env).harnessRoot;
-    root = resolveHarnessRoot(opts.path, env);
+    explicit = opts.workspace !== void 0 ? workspaceRoot(opts.workspace, env, home) : opts.path;
+    recorded = readHostConfig(env, home).harnessRoot;
+    root = resolveHarnessRoot(explicit, env, home);
   } catch (err) {
     io.stderr(`${bin} harness: ${messageOf(err)}
 `);
     return 1;
   }
-  const sticky = opts.path === void 0 && recorded !== void 0 && recorded !== "";
+  const sticky = explicit === void 0 && recorded !== void 0 && recorded !== "";
   if (!flagged) {
     const ask2 = io.ask ?? ask;
     const answer = (await ask2(
@@ -4612,12 +4657,23 @@ async function installOnHost(entry, opts, io, run, status) {
       return 1;
     }
     if (!sticky) {
-      const chosen = (await ask2(`Harness root [${root}]:`)).trim();
-      if (chosen !== "") root = resolve12(chosen);
+      const chosen = (await ask2(`Workspace name [${DEFAULT_WORKSPACE_NAME}]:`)).trim();
+      try {
+        root = workspaceRoot(chosen === "" ? DEFAULT_WORKSPACE_NAME : chosen, env, home);
+      } catch (err) {
+        io.stderr(`${bin} harness: ${messageOf(err)}
+`);
+        return 1;
+      }
     }
   }
   if (sticky) io.stdout(`using the recorded harness root ${root}
 `);
+  const nested = stateHomeRootRefusal(bin, root, home);
+  if (nested !== void 0) {
+    io.stderr(nested);
+    return 1;
+  }
   try {
     if (!existsSync18(join12(root, ".git"))) io.stdout(`cloning ${AGRO_REPO_URL} into ${root}\u2026
 `);
@@ -4633,8 +4689,21 @@ async function installOnHost(entry, opts, io, run, status) {
 `);
     return 1;
   }
-  const prefix = hostPrefix(homeOf(opts));
+  const prefix = hostPrefix(home);
   const target = hostTargetFor(root, prefix, run, env);
+  const linked = await target.exec({
+    argv: remoteControlDirScript(root, "scripts/link-providers.sh", ["--init"]),
+    env: aliasedEnvPair("PROJECT_ROOT", root),
+    stdio: "inherit"
+  });
+  if (linked.exitCode !== 0) {
+    io.stderr(
+      `${bin} harness: could not link provider skills in ${root} (exit ${linked.exitCode}); nothing was installed.
+Run: bash ${root}/.agro/scripts/link-providers.sh --init
+`
+    );
+    return 1;
+  }
   const hermes = entry.id === "hermes";
   const installEnv = hermes ? {
     ...aliasedEnvPair("PROJECT_ROOT", root),
@@ -4678,14 +4747,15 @@ async function installOnHost(entry, opts, io, run, status) {
     workspaceRoot: root
   };
   try {
-    const config = readHostConfig(env);
+    const config = readHostConfig(env, home);
     writeHostConfig(
       {
         ...config,
         harnessRoot: root,
         hostHarnesses: { ...config.hostHarnesses ?? {}, [entry.id]: receipt }
       },
-      env
+      env,
+      home
     );
   } catch (err) {
     io.stderr(`${bin} harness: could not record the install: ${messageOf(err)}
@@ -4698,7 +4768,7 @@ async function installOnHost(entry, opts, io, run, status) {
     io.stdout(`Add this line to your shell profile: export PATH="${harnessBinPath(prefix)}:$PATH"
 `);
   }
-  io.stdout(`Run ${entry.binary} from the AGRO workspace: cd ${root}
+  io.stdout(`Run ${entry.title} in the AGRO workspace: cd ${root} && ${harnessLaunchCommand(entry)}
 `);
   return 0;
 }
@@ -4742,7 +4812,13 @@ async function removeHarness(entry, target, prefix, user, opts, io) {
 async function uninstallOnHost(entry, opts, io, run) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
-  const computed = hostPrefix(homeOf(opts));
+  const home = homeOf(opts);
+  const computed = hostPrefix(home);
+  const generation = stateHomeRefusal(bin, home);
+  if (generation !== void 0) {
+    io.stderr(generation);
+    return 1;
+  }
   if (resolveUninstallArgv(entry, computed) === null) {
     io.stdout(`${entry.id}: nothing to remove \u2014 npx fetches it at each run
 `);
@@ -4751,13 +4827,18 @@ async function uninstallOnHost(entry, opts, io, run) {
   let config;
   let workspace;
   try {
-    config = readHostConfig(env);
-    workspace = resolveHarnessRoot(void 0, env);
+    config = readHostConfig(env, home);
+    workspace = resolveHarnessRoot(void 0, env, home);
   } catch (err) {
     io.stderr(`${bin} harness: ${messageOf(err)}
 `);
     return 1;
   }
+  const nested = stateHomeRootRefusal(bin, workspace, home);
+  if (nested !== void 0) {
+    io.stderr(nested);
+    return 1;
+  }
   const receipt = config.hostHarnesses?.[entry.id];
   if (receipt === void 0 && opts.force !== true) {
     io.stderr(
@@ -4774,7 +4855,7 @@ Removing it could delete a harness you installed yourself. Re-run with \`--force
     const remaining = { ...config.hostHarnesses ?? {} };
     delete remaining[entry.id];
     try {
-      writeHostConfig({ ...config, hostHarnesses: remaining }, env);
+      writeHostConfig({ ...config, hostHarnesses: remaining }, env, home);
     } catch (err) {
       io.stderr(`${bin} harness: could not clear the install record: ${messageOf(err)}
 `);
@@ -4859,7 +4940,7 @@ async function runHarnessInstall(name, opts, io) {
 // src/commands/tool.ts
 import { existsSync as existsSync19 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { delimiter as delimiter3, join as join13, resolve as resolve13 } from "node:path";
+import { delimiter as delimiter3, join as join13, resolve as resolve12 } from "node:path";
 
 // src/lib/tools/catalog.ts
 var TOOLS_DOC = "docs/installation.md";
@@ -5145,7 +5226,7 @@ function rowOf(entry, installed, version, location) {
 function probeableHost2(env, home) {
   let root;
   try {
-    root = resolveHarnessRoot(void 0, env);
+    root = resolveHarnessRoot(void 0, env, home);
   } catch {
     return void 0;
   }
@@ -5293,6 +5374,7 @@ ${hostCapableToolIds().map((t) => `  ${bin} tool install ${t} --host`).join("\n"
 async function installOnHost2(entry, opts, io, run, status) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
+  const home = homeOf2(opts);
   const flagged = opts.host === true || opts.path !== void 0;
   if (!entry.hostCapable) {
     io.stderr(sandboxRefusal2(bin, status));
@@ -5326,8 +5408,8 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
   let root;
   let recorded;
   try {
-    recorded = readHostConfig(env).harnessRoot;
-    root = resolveHarnessRoot(opts.path, env);
+    recorded = readHostConfig(env, home).harnessRoot;
+    root = resolveHarnessRoot(opts.path, env, home);
   } catch (err) {
     io.stderr(`${bin} tool: ${messageOf2(err)}
 `);
@@ -5345,7 +5427,7 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
     }
     if (!sticky) {
       const chosen = (await ask2(`Harness root [${root}]:`)).trim();
-      if (chosen !== "") root = resolve13(chosen);
+      if (chosen !== "") root = resolve12(chosen);
     }
   }
   if (sticky) io.stdout(`using the recorded harness root ${root}
@@ -5365,7 +5447,7 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
 `);
     return 1;
   }
-  const prefix = hostPrefix2(homeOf2(opts));
+  const prefix = hostPrefix2(home);
   const installEnv = { NPM_USER_PREFIX: prefix };
   const target = hostTargetFor2(root, prefix, run, env);
   if (await probeInstalled2(target, entry, void 0, installEnv) === true) {
@@ -5394,14 +5476,15 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
     workspaceRoot: root
   };
   try {
-    const config = readHostConfig(env);
+    const config = readHostConfig(env, home);
     writeHostConfig(
       {
         ...config,
         harnessRoot: root,
         hostTools: { ...config.hostTools ?? {}, [entry.id]: receipt }
       },
-      env
+      env,
+      home
     );
   } catch (err) {
     io.stderr(`${bin} tool: could not record the install: ${messageOf2(err)}
@@ -5502,12 +5585,13 @@ async function removeTool(entry, target, prefix, user, opts, io) {
 async function uninstallOnHost2(entry, opts, io, run) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
-  const computed = hostPrefix2(homeOf2(opts));
+  const home = homeOf2(opts);
+  const computed = hostPrefix2(home);
   let config;
   let workspace;
   try {
-    config = readHostConfig(env);
-    workspace = resolveHarnessRoot(void 0, env);
+    config = readHostConfig(env, home);
+    workspace = resolveHarnessRoot(void 0, env, home);
   } catch (err) {
     io.stderr(`${bin} tool: ${messageOf2(err)}
 `);
@@ -5529,7 +5613,7 @@ Removing it could delete a tool you installed yourself. Re-run with \`--force\`
     const remaining = { ...config.hostTools ?? {} };
     delete remaining[entry.id];
     try {
-      writeHostConfig({ ...config, hostTools: remaining }, env);
+      writeHostConfig({ ...config, hostTools: remaining }, env, home);
     } catch (err) {
       io.stderr(`${bin} tool: could not clear the install record: ${messageOf2(err)}
 `);
@@ -5624,8 +5708,8 @@ function fetchRemoteSource(opts) {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.12.1" : "0.0.0-dev";
-var DEFAULT_SOURCE_OH_DIR = resolve14(
+var VERSION = true ? "0.12.2" : "0.0.0-dev";
+var DEFAULT_SOURCE_OH_DIR = resolve13(
   dirname10(fileURLToPath(import.meta.url)),
   "../.."
 );
@@ -5862,10 +5946,11 @@ Usage:
 
 \`install\` and \`uninstall\` act on the running sandbox. When no sandbox is
 reachable they act on the host. A host install clones the AGRO workspace into the
-harness root, then installs the harness into \`~/.local\`. \`--path <dir>\` chooses
-the harness root; a successful install records it as \`harnessRoot\` in the host
-\`${stateNames(bin).configFile}\`. The default is \`~/.agro\`, and the install prefix is
-always \`~/.local\`.
+harness root, then installs the harness into \`~/.local\`. The default root is the
+workspace registry entry \`~/.agro/workspaces/default\`; an interactive run asks for
+the workspace name. \`--workspace <name>\` chooses that entry and \`--path <dir>\` a
+directory outside the registry. A successful install records the root as
+\`harnessRoot\` in \`~/.agro/config.json\`. The install prefix is always \`~/.local\`.
 
 On the host, \`uninstall\` removes only the harness \`install\` recorded, from the
 prefix in that record. Without a record it refuses, and \`--force\` overrides. In
@@ -5874,7 +5959,8 @@ the sandbox it needs no record. See \`docs/harnesses/overview.md\`.
 Flags:
   --json           Machine-readable output (list/status)
   --host           Install on the host when the sandbox is not running (install)
-  --path <dir>     Harness root for the workspace clone; implies --host (install)
+  --workspace <name>  Workspace registry entry to clone into; implies --host (install)
+  --path <dir>     Harness root outside the registry; implies --host (install)
   --force          Remove without a recorded host install (uninstall)
 
 Harnesses:
@@ -5930,8 +6016,8 @@ only on these tools:
 ${hostCapableToolIds().map((t) => `  ${t}`).join("\n")}
 
 A host install clones the AGRO workspace into the harness root \u2014 \`--path <dir>\`,
-then \`harnessRoot\` in the host \`${stateNames(bin).configFile}\`, then \`~/.agro\` \u2014 and installs into
-\`~/.local\`. It records the install as \`hostTools\` in that same file. On the host,
+then \`harnessRoot\` in \`~/.agro/config.json\`, then \`~/.agro/workspaces/default\` \u2014 and
+installs into \`~/.local\`. It records the install as \`hostTools\` in that same file. On the host,
 \`uninstall\` removes only what \`install\` recorded, from the prefix in that record.
 Without a record it refuses, and \`--force\` overrides.
 
@@ -6331,11 +6417,16 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
   }
   const positionals = [];
   let expectPath = false;
+  let expectWorkspace = false;
   for (const token of rest) {
     if (expectPath) {
       expectPath = false;
       args.path = token;
       args.host = true;
+    } else if (expectWorkspace) {
+      expectWorkspace = false;
+      args.workspace = token;
+      args.host = true;
     } else if (token === "--json") {
       args.json = true;
     } else if (token === "--host") {
@@ -6347,6 +6438,11 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
     } else if (token.startsWith("--path=")) {
       args.path = token.slice("--path=".length);
       args.host = true;
+    } else if (token === "--workspace") {
+      expectWorkspace = true;
+    } else if (token.startsWith("--workspace=")) {
+      args.workspace = token.slice("--workspace=".length);
+      args.host = true;
     } else if (token.startsWith("-")) {
       return { ok: false, error: `${bin} harness: unknown flag "${token}"` };
     } else {
@@ -6356,6 +6452,15 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
   if (expectPath || args.path === "") {
     return { ok: false, error: `${bin} harness: --path requires a directory` };
   }
+  if (expectWorkspace || args.workspace === "") {
+    return { ok: false, error: `${bin} harness: --workspace requires a name` };
+  }
+  if (args.path !== void 0 && args.workspace !== void 0) {
+    return {
+      ok: false,
+      error: `${bin} harness: --workspace names a registry entry and --path names a directory \u2014 pass one, not both`
+    };
+  }
   const [sub, name, ...extra] = positionals;
   if (sub !== "list" && sub !== "install" && sub !== "status" && sub !== "uninstall") {
     return {
@@ -6374,7 +6479,10 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
     return { ok: false, error: `${bin} harness list: unexpected argument "${name}"` };
   }
   if (sub !== "install" && args.host) {
-    return { ok: false, error: `${bin} harness ${sub}: --host and --path apply to install only` };
+    return {
+      ok: false,
+      error: `${bin} harness ${sub}: --host, --workspace and --path apply to install only`
+    };
   }
   if (sub !== "uninstall" && args.force) {
     return { ok: false, error: `${bin} harness ${sub}: --force applies to uninstall only` };
@@ -6449,13 +6557,13 @@ function bundledPayloadExists(bundled, exists = existsSync20) {
 function resolveUpdateSource(args, bundled, bin = LEGACY_PRODUCT.bin) {
   const exists = bundled.exists ?? existsSync20;
   if (args.fromDir !== void 0) {
-    return { kind: "local", fromDir: resolve14(args.fromDir) };
+    return { kind: "local", fromDir: resolve13(args.fromDir) };
   }
   if (args.fromRemote) {
     return { kind: "remote", ref: args.ref };
   }
   if (bundledPayloadExists(bundled, exists)) {
-    return { kind: "local", fromDir: resolve14(bundled.sourceOhDir, "..") };
+    return { kind: "local", fromDir: resolve13(bundled.sourceOhDir, "..") };
   }
   return {
     kind: "remote",
@@ -6747,7 +6855,12 @@ async function main(argv) {
     }
     return await runHarnessInstall(
       a.name,
-      { bin, host: a.host, ...a.path !== void 0 ? { path: a.path } : {} },
+      {
+        bin,
+        host: a.host,
+        ...a.path !== void 0 ? { path: a.path } : {},
+        ...a.workspace !== void 0 ? { workspace: a.workspace } : {}
+      },
       io
     );
   }

package/dist/oh.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname10, join as join14, resolve as resolve14 } from "node:path";
+import { dirname as dirname10, join as join14, resolve as resolve13 } from "node:path";
 import { existsSync as existsSync20, mkdtempSync as mkdtempSync4, readFileSync as readFileSync12, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 
@@ -230,16 +230,10 @@ function resolveRegistryHome(env = process.env, home = homedir(), warn) {
   if (configured !== void 0) return { path: resolve(configured), configured: true };
   return { path: home, configured: false };
 }
-function generationUserStateHome(generation, env, home, warn) {
+function resolveAgroUserStateHome(env = process.env, home = homedir(), warn) {
   const configured = aliasedEnvValue(env, "HOME", warn);
   if (configured !== void 0) return resolve(configured);
-  return join(home, GENERATIONS[generation].userStateDir);
-}
-function resolveAgroUserStateHome(env = process.env, home = homedir(), warn) {
-  return generationUserStateHome("agro", env, home, warn);
-}
-function resolveLegacyUserStateHome(env = process.env, home = homedir(), warn) {
-  return generationUserStateHome("legacy", env, home, warn);
+  return join(home, GENERATIONS.agro.userStateDir);
 }
 function resolveUserStateHome(env = process.env, home = homedir(), warn) {
   const configured = aliasedEnvValue(env, "HOME", warn);
@@ -1970,8 +1964,8 @@ function redact(token) {
 async function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    return await new Promise((resolve15) => {
-      rl.question(`  ${question} `, (answer) => resolve15(answer.trim()));
+    return await new Promise((resolve14) => {
+      rl.question(`  ${question} `, (answer) => resolve14(answer.trim()));
     });
   } finally {
     rl.close();
@@ -1983,7 +1977,7 @@ async function askSecret(question) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   const bytes = [];
-  return await new Promise((resolve15) => {
+  return await new Promise((resolve14) => {
     const cleanup = () => {
       try {
         process.stdin.setRawMode(false);
@@ -2001,7 +1995,7 @@ async function askSecret(question) {
         } else if (byte === 13 || byte === 10) {
           cleanup();
           process.stdout.write("\n");
-          resolve15(Buffer.from(bytes).toString("utf8").trim());
+          resolve14(Buffer.from(bytes).toString("utf8").trim());
           return;
         } else if (byte === 127 || byte === 8) {
           if (bytes.length > 0) {
@@ -2051,10 +2045,10 @@ async function askSecretPiped(question) {
   };
   process.on("SIGINT", onSigint);
   try {
-    return await new Promise((resolve15) => {
+    return await new Promise((resolve14) => {
       rl.question(`  ${question} `, (answer) => {
         process.stdout.write("\n");
-        resolve15(answer.trim());
+        resolve14(answer.trim());
       });
     });
   } finally {
@@ -4012,7 +4006,7 @@ async function runSandboxList(opts, io) {
 // src/commands/harness.ts
 import { existsSync as existsSync18 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { delimiter as delimiter2, join as join12, resolve as resolve12 } from "node:path";
+import { delimiter as delimiter2, join as join12 } from "node:path";
 
 // src/lib/docs.ts
 var SOURCE_DOCS_BASE = "https://github.com/mifunedev/agro/blob/main/";
@@ -4028,24 +4022,35 @@ function sourceDocsUrl(docsPath) {
 import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync11, renameSync as renameSync5, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute2, join as join10, resolve as resolve10 } from "node:path";
 var HOST_CONFIG_MODE = 420;
-function hostConfigPath(env = process.env, home) {
-  return join10(resolveAgroUserStateHome(env, home), GENERATIONS.agro.configFile);
+var HOST_CONFIG_FILE = "config.json";
+var WORKSPACES_SUBDIR = "workspaces";
+var DEFAULT_WORKSPACE_NAME = "default";
+function hostStateHome(env, home) {
+  return resolveAgroUserStateHome(env, home);
 }
-function legacyHostConfigPath(env = process.env, home) {
-  return join10(resolveLegacyUserStateHome(env, home), GENERATIONS.legacy.configFile);
+function hostConfigPath(env, home) {
+  return join10(hostStateHome(env, home), HOST_CONFIG_FILE);
 }
-function readableHostConfigPath(env, home) {
-  const path4 = hostConfigPath(env, home);
-  if (existsSync16(path4)) return path4;
-  const legacy = legacyHostConfigPath(env, home);
-  return existsSync16(legacy) ? legacy : path4;
+function assertWorkspaceName(name) {
+  if (!SANDBOX_NAME_PATTERN.test(name)) {
+    throw new Error(
+      `invalid workspace name "${name}" \u2014 use lowercase letters, digits and dashes, starting with a letter or digit`
+    );
+  }
 }
-function defaultHarnessRoot(env = process.env, home) {
-  return resolveAgroUserStateHome(env, home);
+function workspacesRoot(env, home) {
+  return join10(hostStateHome(env, home), WORKSPACES_SUBDIR);
+}
+function workspaceRoot(name, env, home) {
+  assertWorkspaceName(name);
+  return join10(workspacesRoot(env, home), name);
+}
+function defaultHarnessRoot(env, home) {
+  return join10(workspacesRoot(env, home), DEFAULT_WORKSPACE_NAME);
 }
 function validateHostConfig(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${GENERATIONS.agro.configFile}: must contain a JSON object`);
+    throw new Error(`${HOST_CONFIG_FILE}: must contain a JSON object`);
   }
   const record = value;
   if (record.version !== void 0 && record.version !== 1) {
@@ -4097,8 +4102,8 @@ function validateReceipts(value, field, noun) {
     }
   }
 }
-function readHostConfig(env = process.env, home) {
-  const path4 = readableHostConfigPath(env, home);
+function readHostConfig(env, home) {
+  const path4 = hostConfigPath(env, home);
   if (!existsSync16(path4)) return { version: 1 };
   let raw;
   try {
@@ -4115,7 +4120,7 @@ function readHostConfig(env = process.env, home) {
   }
   return validateHostConfig(parsed);
 }
-function writeHostConfig(config, env = process.env, home) {
+function writeHostConfig(config, env, home) {
   const path4 = hostConfigPath(env, home);
   const validated = validateHostConfig({ ...config, version: 1 });
   const body = `${JSON.stringify(validated, null, 2)}
@@ -4125,7 +4130,6 @@ function writeHostConfig(config, env = process.env, home) {
   try {
     writeFileSync8(tmp, body, { mode: HOST_CONFIG_MODE, encoding: "utf8" });
     renameSync5(tmp, path4);
-    retireLegacyHostConfig(env, home, path4);
   } catch (error) {
     try {
       unlinkSync5(tmp);
@@ -4134,19 +4138,14 @@ function writeHostConfig(config, env = process.env, home) {
     throw error;
   }
 }
-function resolveHarnessRoot(explicit, env = process.env, home) {
+function resolveHarnessRoot(explicit, env, home) {
   if (typeof explicit === "string" && explicit !== "") return resolve10(explicit);
   const configured = readHostConfig(env, home).harnessRoot;
   if (typeof configured === "string" && configured !== "") return resolve10(configured);
   return defaultHarnessRoot(env, home);
 }
-function retireLegacyHostConfig(env, home, written) {
-  const legacy = legacyHostConfigPath(env, home);
-  if (legacy === written || !existsSync16(legacy)) return;
-  unlinkSync5(legacy);
-}
 function fieldError2(path4, requirement) {
-  return new Error(`${GENERATIONS.agro.configFile}: ${path4} ${requirement}`);
+  return new Error(`${HOST_CONFIG_FILE}: ${path4} ${requirement}`);
 }
 
 // src/lib/host-workspace.ts
@@ -4159,6 +4158,40 @@ var IGNORABLE_ENTRIES = [
   GENERATIONS.agro.configFile,
   GENERATIONS.legacy.configFile
 ];
+var STATE_HOME_DIRS = [
+  GENERATIONS.legacy.userStateDir,
+  GENERATIONS.agro.userStateDir
+];
+function isDirectory2(path4) {
+  return statSync5(path4, { throwIfNoEntry: false })?.isDirectory() === true;
+}
+function stateHomes(home) {
+  return STATE_HOME_DIRS.map((name) => join11(home, name));
+}
+function stateHomeRefusal(bin, home) {
+  const [legacy, agro] = stateHomes(home);
+  if (isDirectory2(legacy) && isDirectory2(agro)) {
+    return `${bin} harness: the host state home is split \u2014 ${legacy} and ${agro} both exist.
+Merge them with \`${bin} migrate --home\`, then re-run this command.
+`;
+  }
+  if (isDirectory2(legacy)) {
+    return `${bin} harness: the host state home is the legacy ${legacy}, and host state now lives in ${agro}.
+Creating ${agro} beside it would split the two.
+Migrate first with \`${bin} migrate --home\`, then re-run this command.
+`;
+  }
+  return void 0;
+}
+function stateHomeRootRefusal(bin, root, home) {
+  const target = resolve11(root);
+  const enclosing = stateHomes(home).find((state) => target === state);
+  if (enclosing === void 0) return void 0;
+  return `${bin} harness: the harness root ${target} is the state home ${enclosing} itself.
+A workspace there collides with AGRO state and blocks every command run from ${home}.
+Move it out \u2014 for example \`mv ${enclosing} ${join11(home, "agro")}\` \u2014 then re-run this command.
+`;
+}
 function isIgnorableEntry(name) {
   return name.startsWith(".") || IGNORABLE_ENTRIES.includes(name);
 }
@@ -4229,7 +4262,8 @@ var HARNESS_CATALOG = [
     verifyArgv: ["claude", "--version"],
     uninstallArgv: ["npm", "--prefix", HARNESS_PREFIX_TOKEN, "uninstall", "-g", "@anthropic-ai/claude-code"],
     docsPath: "docs/harnesses/claude-code.md",
-    kind: "installable"
+    kind: "installable",
+    bypassPermissionsFlag: "--permission-mode bypassPermissions"
   },
   {
     id: "codex",
@@ -4376,6 +4410,9 @@ function resolveVerifyArgv(entry, prefix) {
 function resolveUninstallArgv(entry, prefix) {
   return entry.uninstallArgv === null ? null : substitute(entry.uninstallArgv, prefix);
 }
+function harnessLaunchCommand(entry) {
+  return entry.bypassPermissionsFlag === void 0 ? entry.binary : `${entry.binary} ${entry.bypassPermissionsFlag}`;
+}
 function harnessBinPath(prefix) {
   return `${prefix}/bin`;
 }
@@ -4443,7 +4480,7 @@ function stateOf(entry, installed, location) {
 function probeableHost(env, home) {
   let root;
   try {
-    root = resolveHarnessRoot(void 0, env);
+    root = resolveHarnessRoot(void 0, env, home);
   } catch {
     return void 0;
   }
@@ -4578,7 +4615,13 @@ function isInteractive(opts) {
 async function installOnHost(entry, opts, io, run, status) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
-  const flagged = opts.host === true || opts.path !== void 0;
+  const home = homeOf(opts);
+  const flagged = opts.host === true || opts.path !== void 0 || opts.workspace !== void 0;
+  const generation = stateHomeRefusal(bin, home);
+  if (generation !== void 0) {
+    io.stderr(generation);
+    return 1;
+  }
   if (!flagged && !isInteractive(opts)) {
     io.stderr(
       sandboxRefusal(bin, status) + `Or install on the host with \`${bin} harness install ${entry.id} --host\`.
@@ -4593,15 +4636,17 @@ async function installOnHost(entry, opts, io, run, status) {
   }
   let root;
   let recorded;
+  let explicit;
   try {
-    recorded = readHostConfig(env).harnessRoot;
-    root = resolveHarnessRoot(opts.path, env);
+    explicit = opts.workspace !== void 0 ? workspaceRoot(opts.workspace, env, home) : opts.path;
+    recorded = readHostConfig(env, home).harnessRoot;
+    root = resolveHarnessRoot(explicit, env, home);
   } catch (err) {
     io.stderr(`${bin} harness: ${messageOf(err)}
 `);
     return 1;
   }
-  const sticky = opts.path === void 0 && recorded !== void 0 && recorded !== "";
+  const sticky = explicit === void 0 && recorded !== void 0 && recorded !== "";
   if (!flagged) {
     const ask2 = io.ask ?? ask;
     const answer = (await ask2(
@@ -4612,12 +4657,23 @@ async function installOnHost(entry, opts, io, run, status) {
       return 1;
     }
     if (!sticky) {
-      const chosen = (await ask2(`Harness root [${root}]:`)).trim();
-      if (chosen !== "") root = resolve12(chosen);
+      const chosen = (await ask2(`Workspace name [${DEFAULT_WORKSPACE_NAME}]:`)).trim();
+      try {
+        root = workspaceRoot(chosen === "" ? DEFAULT_WORKSPACE_NAME : chosen, env, home);
+      } catch (err) {
+        io.stderr(`${bin} harness: ${messageOf(err)}
+`);
+        return 1;
+      }
     }
   }
   if (sticky) io.stdout(`using the recorded harness root ${root}
 `);
+  const nested = stateHomeRootRefusal(bin, root, home);
+  if (nested !== void 0) {
+    io.stderr(nested);
+    return 1;
+  }
   try {
     if (!existsSync18(join12(root, ".git"))) io.stdout(`cloning ${AGRO_REPO_URL} into ${root}\u2026
 `);
@@ -4633,8 +4689,21 @@ async function installOnHost(entry, opts, io, run, status) {
 `);
     return 1;
   }
-  const prefix = hostPrefix(homeOf(opts));
+  const prefix = hostPrefix(home);
   const target = hostTargetFor(root, prefix, run, env);
+  const linked = await target.exec({
+    argv: remoteControlDirScript(root, "scripts/link-providers.sh", ["--init"]),
+    env: aliasedEnvPair("PROJECT_ROOT", root),
+    stdio: "inherit"
+  });
+  if (linked.exitCode !== 0) {
+    io.stderr(
+      `${bin} harness: could not link provider skills in ${root} (exit ${linked.exitCode}); nothing was installed.
+Run: bash ${root}/.agro/scripts/link-providers.sh --init
+`
+    );
+    return 1;
+  }
   const hermes = entry.id === "hermes";
   const installEnv = hermes ? {
     ...aliasedEnvPair("PROJECT_ROOT", root),
@@ -4678,14 +4747,15 @@ async function installOnHost(entry, opts, io, run, status) {
     workspaceRoot: root
   };
   try {
-    const config = readHostConfig(env);
+    const config = readHostConfig(env, home);
     writeHostConfig(
       {
         ...config,
         harnessRoot: root,
         hostHarnesses: { ...config.hostHarnesses ?? {}, [entry.id]: receipt }
       },
-      env
+      env,
+      home
     );
   } catch (err) {
     io.stderr(`${bin} harness: could not record the install: ${messageOf(err)}
@@ -4698,7 +4768,7 @@ async function installOnHost(entry, opts, io, run, status) {
     io.stdout(`Add this line to your shell profile: export PATH="${harnessBinPath(prefix)}:$PATH"
 `);
   }
-  io.stdout(`Run ${entry.binary} from the AGRO workspace: cd ${root}
+  io.stdout(`Run ${entry.title} in the AGRO workspace: cd ${root} && ${harnessLaunchCommand(entry)}
 `);
   return 0;
 }
@@ -4742,7 +4812,13 @@ async function removeHarness(entry, target, prefix, user, opts, io) {
 async function uninstallOnHost(entry, opts, io, run) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
-  const computed = hostPrefix(homeOf(opts));
+  const home = homeOf(opts);
+  const computed = hostPrefix(home);
+  const generation = stateHomeRefusal(bin, home);
+  if (generation !== void 0) {
+    io.stderr(generation);
+    return 1;
+  }
   if (resolveUninstallArgv(entry, computed) === null) {
     io.stdout(`${entry.id}: nothing to remove \u2014 npx fetches it at each run
 `);
@@ -4751,13 +4827,18 @@ async function uninstallOnHost(entry, opts, io, run) {
   let config;
   let workspace;
   try {
-    config = readHostConfig(env);
-    workspace = resolveHarnessRoot(void 0, env);
+    config = readHostConfig(env, home);
+    workspace = resolveHarnessRoot(void 0, env, home);
   } catch (err) {
     io.stderr(`${bin} harness: ${messageOf(err)}
 `);
     return 1;
   }
+  const nested = stateHomeRootRefusal(bin, workspace, home);
+  if (nested !== void 0) {
+    io.stderr(nested);
+    return 1;
+  }
   const receipt = config.hostHarnesses?.[entry.id];
   if (receipt === void 0 && opts.force !== true) {
     io.stderr(
@@ -4774,7 +4855,7 @@ Removing it could delete a harness you installed yourself. Re-run with \`--force
     const remaining = { ...config.hostHarnesses ?? {} };
     delete remaining[entry.id];
     try {
-      writeHostConfig({ ...config, hostHarnesses: remaining }, env);
+      writeHostConfig({ ...config, hostHarnesses: remaining }, env, home);
     } catch (err) {
       io.stderr(`${bin} harness: could not clear the install record: ${messageOf(err)}
 `);
@@ -4859,7 +4940,7 @@ async function runHarnessInstall(name, opts, io) {
 // src/commands/tool.ts
 import { existsSync as existsSync19 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { delimiter as delimiter3, join as join13, resolve as resolve13 } from "node:path";
+import { delimiter as delimiter3, join as join13, resolve as resolve12 } from "node:path";
 
 // src/lib/tools/catalog.ts
 var TOOLS_DOC = "docs/installation.md";
@@ -5145,7 +5226,7 @@ function rowOf(entry, installed, version, location) {
 function probeableHost2(env, home) {
   let root;
   try {
-    root = resolveHarnessRoot(void 0, env);
+    root = resolveHarnessRoot(void 0, env, home);
   } catch {
     return void 0;
   }
@@ -5293,6 +5374,7 @@ ${hostCapableToolIds().map((t) => `  ${bin} tool install ${t} --host`).join("\n"
 async function installOnHost2(entry, opts, io, run, status) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
+  const home = homeOf2(opts);
   const flagged = opts.host === true || opts.path !== void 0;
   if (!entry.hostCapable) {
     io.stderr(sandboxRefusal2(bin, status));
@@ -5326,8 +5408,8 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
   let root;
   let recorded;
   try {
-    recorded = readHostConfig(env).harnessRoot;
-    root = resolveHarnessRoot(opts.path, env);
+    recorded = readHostConfig(env, home).harnessRoot;
+    root = resolveHarnessRoot(opts.path, env, home);
   } catch (err) {
     io.stderr(`${bin} tool: ${messageOf2(err)}
 `);
@@ -5345,7 +5427,7 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
     }
     if (!sticky) {
       const chosen = (await ask2(`Harness root [${root}]:`)).trim();
-      if (chosen !== "") root = resolve13(chosen);
+      if (chosen !== "") root = resolve12(chosen);
     }
   }
   if (sticky) io.stdout(`using the recorded harness root ${root}
@@ -5365,7 +5447,7 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
 `);
     return 1;
   }
-  const prefix = hostPrefix2(homeOf2(opts));
+  const prefix = hostPrefix2(home);
   const installEnv = { NPM_USER_PREFIX: prefix };
   const target = hostTargetFor2(root, prefix, run, env);
   if (await probeInstalled2(target, entry, void 0, installEnv) === true) {
@@ -5394,14 +5476,15 @@ Every tool installer in the catalog is Debian-specific. Install ${entry.id} with
     workspaceRoot: root
   };
   try {
-    const config = readHostConfig(env);
+    const config = readHostConfig(env, home);
     writeHostConfig(
       {
         ...config,
         harnessRoot: root,
         hostTools: { ...config.hostTools ?? {}, [entry.id]: receipt }
       },
-      env
+      env,
+      home
     );
   } catch (err) {
     io.stderr(`${bin} tool: could not record the install: ${messageOf2(err)}
@@ -5502,12 +5585,13 @@ async function removeTool(entry, target, prefix, user, opts, io) {
 async function uninstallOnHost2(entry, opts, io, run) {
   const bin = opts.bin;
   const env = opts.env ?? process.env;
-  const computed = hostPrefix2(homeOf2(opts));
+  const home = homeOf2(opts);
+  const computed = hostPrefix2(home);
   let config;
   let workspace;
   try {
-    config = readHostConfig(env);
-    workspace = resolveHarnessRoot(void 0, env);
+    config = readHostConfig(env, home);
+    workspace = resolveHarnessRoot(void 0, env, home);
   } catch (err) {
     io.stderr(`${bin} tool: ${messageOf2(err)}
 `);
@@ -5529,7 +5613,7 @@ Removing it could delete a tool you installed yourself. Re-run with \`--force\`
     const remaining = { ...config.hostTools ?? {} };
     delete remaining[entry.id];
     try {
-      writeHostConfig({ ...config, hostTools: remaining }, env);
+      writeHostConfig({ ...config, hostTools: remaining }, env, home);
     } catch (err) {
       io.stderr(`${bin} tool: could not clear the install record: ${messageOf2(err)}
 `);
@@ -5624,8 +5708,8 @@ function fetchRemoteSource(opts) {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.12.1" : "0.0.0-dev";
-var DEFAULT_SOURCE_OH_DIR = resolve14(
+var VERSION = true ? "0.12.2" : "0.0.0-dev";
+var DEFAULT_SOURCE_OH_DIR = resolve13(
   dirname10(fileURLToPath(import.meta.url)),
   "../.."
 );
@@ -5862,10 +5946,11 @@ Usage:
 
 \`install\` and \`uninstall\` act on the running sandbox. When no sandbox is
 reachable they act on the host. A host install clones the AGRO workspace into the
-harness root, then installs the harness into \`~/.local\`. \`--path <dir>\` chooses
-the harness root; a successful install records it as \`harnessRoot\` in the host
-\`${stateNames(bin).configFile}\`. The default is \`~/.agro\`, and the install prefix is
-always \`~/.local\`.
+harness root, then installs the harness into \`~/.local\`. The default root is the
+workspace registry entry \`~/.agro/workspaces/default\`; an interactive run asks for
+the workspace name. \`--workspace <name>\` chooses that entry and \`--path <dir>\` a
+directory outside the registry. A successful install records the root as
+\`harnessRoot\` in \`~/.agro/config.json\`. The install prefix is always \`~/.local\`.
 
 On the host, \`uninstall\` removes only the harness \`install\` recorded, from the
 prefix in that record. Without a record it refuses, and \`--force\` overrides. In
@@ -5874,7 +5959,8 @@ the sandbox it needs no record. See \`docs/harnesses/overview.md\`.
 Flags:
   --json           Machine-readable output (list/status)
   --host           Install on the host when the sandbox is not running (install)
-  --path <dir>     Harness root for the workspace clone; implies --host (install)
+  --workspace <name>  Workspace registry entry to clone into; implies --host (install)
+  --path <dir>     Harness root outside the registry; implies --host (install)
   --force          Remove without a recorded host install (uninstall)
 
 Harnesses:
@@ -5930,8 +6016,8 @@ only on these tools:
 ${hostCapableToolIds().map((t) => `  ${t}`).join("\n")}
 
 A host install clones the AGRO workspace into the harness root \u2014 \`--path <dir>\`,
-then \`harnessRoot\` in the host \`${stateNames(bin).configFile}\`, then \`~/.agro\` \u2014 and installs into
-\`~/.local\`. It records the install as \`hostTools\` in that same file. On the host,
+then \`harnessRoot\` in \`~/.agro/config.json\`, then \`~/.agro/workspaces/default\` \u2014 and
+installs into \`~/.local\`. It records the install as \`hostTools\` in that same file. On the host,
 \`uninstall\` removes only what \`install\` recorded, from the prefix in that record.
 Without a record it refuses, and \`--force\` overrides.
 
@@ -6331,11 +6417,16 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
   }
   const positionals = [];
   let expectPath = false;
+  let expectWorkspace = false;
   for (const token of rest) {
     if (expectPath) {
       expectPath = false;
       args.path = token;
       args.host = true;
+    } else if (expectWorkspace) {
+      expectWorkspace = false;
+      args.workspace = token;
+      args.host = true;
     } else if (token === "--json") {
       args.json = true;
     } else if (token === "--host") {
@@ -6347,6 +6438,11 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
     } else if (token.startsWith("--path=")) {
       args.path = token.slice("--path=".length);
       args.host = true;
+    } else if (token === "--workspace") {
+      expectWorkspace = true;
+    } else if (token.startsWith("--workspace=")) {
+      args.workspace = token.slice("--workspace=".length);
+      args.host = true;
     } else if (token.startsWith("-")) {
       return { ok: false, error: `${bin} harness: unknown flag "${token}"` };
     } else {
@@ -6356,6 +6452,15 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
   if (expectPath || args.path === "") {
     return { ok: false, error: `${bin} harness: --path requires a directory` };
   }
+  if (expectWorkspace || args.workspace === "") {
+    return { ok: false, error: `${bin} harness: --workspace requires a name` };
+  }
+  if (args.path !== void 0 && args.workspace !== void 0) {
+    return {
+      ok: false,
+      error: `${bin} harness: --workspace names a registry entry and --path names a directory \u2014 pass one, not both`
+    };
+  }
   const [sub, name, ...extra] = positionals;
   if (sub !== "list" && sub !== "install" && sub !== "status" && sub !== "uninstall") {
     return {
@@ -6374,7 +6479,10 @@ function parseHarnessArgs(rest, bin = LEGACY_PRODUCT.bin) {
     return { ok: false, error: `${bin} harness list: unexpected argument "${name}"` };
   }
   if (sub !== "install" && args.host) {
-    return { ok: false, error: `${bin} harness ${sub}: --host and --path apply to install only` };
+    return {
+      ok: false,
+      error: `${bin} harness ${sub}: --host, --workspace and --path apply to install only`
+    };
   }
   if (sub !== "uninstall" && args.force) {
     return { ok: false, error: `${bin} harness ${sub}: --force applies to uninstall only` };
@@ -6449,13 +6557,13 @@ function bundledPayloadExists(bundled, exists = existsSync20) {
 function resolveUpdateSource(args, bundled, bin = LEGACY_PRODUCT.bin) {
   const exists = bundled.exists ?? existsSync20;
   if (args.fromDir !== void 0) {
-    return { kind: "local", fromDir: resolve14(args.fromDir) };
+    return { kind: "local", fromDir: resolve13(args.fromDir) };
   }
   if (args.fromRemote) {
     return { kind: "remote", ref: args.ref };
   }
   if (bundledPayloadExists(bundled, exists)) {
-    return { kind: "local", fromDir: resolve14(bundled.sourceOhDir, "..") };
+    return { kind: "local", fromDir: resolve13(bundled.sourceOhDir, "..") };
   }
   return {
     kind: "remote",
@@ -6747,7 +6855,12 @@ async function main(argv) {
     }
     return await runHarnessInstall(
       a.name,
-      { bin, host: a.host, ...a.path !== void 0 ? { path: a.path } : {} },
+      {
+        bin,
+        host: a.host,
+        ...a.path !== void 0 ? { path: a.path } : {},
+        ...a.workspace !== void 0 ? { workspace: a.workspace } : {}
+      },
       io
     );
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mifune/agro",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "AGRO CLI — create and manage sandboxes for coding agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/mifunedev/agro#readme",