@mifune/agro 0.9.0 → 0.10.0

package/dist/agro.js

@@ -2,20 +2,246 @@
 
 // src/cli.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname6, join as join10, resolve as resolve8 } from "node:path";
-import { existsSync as existsSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync11, rmSync as rmSync3 } from "node:fs";
+import { dirname as dirname8, join as join11, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 
 // src/commands/update.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import path3 from "node:path";
+
+// src/lib/compat.ts
 import {
-  existsSync as existsSync2,
-  statSync,
-  readFileSync as readFileSync2
+  existsSync,
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  readlinkSync,
+  statSync
 } from "node:fs";
-import path3 from "node:path";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+var GENERATIONS = {
+  legacy: {
+    controlDir: ".oh",
+    configFile: "oh.json",
+    envPrefix: "OH_",
+    userStateDir: ".oh",
+    seedDir: "/opt/oh-seed"
+  },
+  agro: {
+    controlDir: ".agro",
+    configFile: "agro.json",
+    envPrefix: "AGRO_",
+    userStateDir: ".agro",
+    seedDir: "/opt/agro-seed"
+  }
+};
+var LEGACY_CHECKOUT_DIR = ".openharness";
+var DEFAULT_GENERATION = "agro";
+var DEFAULT_SANDBOX_NAME = "agro";
+var CompatConflictError = class extends Error {
+  legacyPath;
+  agroPath;
+  differences;
+  constructor(legacyPath, agroPath, differences) {
+    super(
+      `${legacyPath} and ${agroPath} both exist and differ \u2014 resolve the conflict before continuing (keep exactly one, or make them identical); differences: ${differences.join("; ")}`
+    );
+    this.name = "CompatConflictError";
+    this.legacyPath = legacyPath;
+    this.agroPath = agroPath;
+    this.differences = differences;
+  }
+};
+function entryType(stats) {
+  if (stats.isSymbolicLink()) return "symlink";
+  if (stats.isDirectory()) return "directory";
+  if (stats.isFile()) return "file";
+  return "other";
+}
+function lstatOrUndefined(path4) {
+  return lstatSync(path4, { throwIfNoEntry: false });
+}
+function statOrUndefined(path4) {
+  try {
+    return statSync(path4, { throwIfNoEntry: false });
+  } catch {
+    return void 0;
+  }
+}
+function sameBytes(a, b) {
+  const left = readFileSync(a);
+  const right = readFileSync(b);
+  return left.equals(right);
+}
+function octal(mode) {
+  return (mode & 511).toString(8).padStart(3, "0");
+}
+function contentDifference(type, legacy, agro, left, right) {
+  switch (type) {
+    case "symlink":
+      return readlinkSync(legacy) !== readlinkSync(agro) ? "symlink target differs" : void 0;
+    case "file":
+      return left.size !== right.size || !sameBytes(legacy, agro) ? "content differs" : void 0;
+    case "other":
+      return "unsupported entry type";
+    default:
+      return void 0;
+  }
+}
+function entryDifferences(label, legacy, agro, left, right) {
+  const type = entryType(left);
+  if (type !== entryType(right)) return [`${label}: type ${type} vs ${entryType(right)}`];
+  const differences = [];
+  if ((left.mode & 511) !== (right.mode & 511)) {
+    differences.push(`${label}: mode ${octal(left.mode)} vs ${octal(right.mode)}`);
+  }
+  const content = contentDifference(type, legacy, agro, left, right);
+  if (content !== void 0) differences.push(`${label}: ${content}`);
+  return differences;
+}
+function compareTrees(legacy, agro, rel = "") {
+  const label = rel === "" ? "." : rel;
+  const left = lstatOrUndefined(legacy);
+  const right = lstatOrUndefined(agro);
+  if (left === void 0 && right === void 0) return [];
+  if (left === void 0) return [`${label}: only in ${agro}`];
+  if (right === void 0) return [`${label}: only in ${legacy}`];
+  const differences = entryDifferences(label, legacy, agro, left, right);
+  if (!left.isDirectory() || !right.isDirectory()) return differences;
+  const names = /* @__PURE__ */ new Set([...readdirSync(legacy), ...readdirSync(agro)]);
+  for (const name of [...names].sort()) {
+    const childRel = rel === "" ? name : `${rel}/${name}`;
+    differences.push(...compareTrees(join(legacy, name), join(agro, name), childRel));
+  }
+  return differences;
+}
+function resolvePair(legacyPath, agroPath, present) {
+  const legacyExists = present(legacyPath);
+  const agroExists = present(agroPath);
+  const base = { legacyPath, agroPath };
+  if (!legacyExists && !agroExists) {
+    const path4 = DEFAULT_GENERATION === "agro" ? agroPath : legacyPath;
+    return { ...base, kind: "absent", generation: DEFAULT_GENERATION, path: path4 };
+  }
+  if (legacyExists && !agroExists) {
+    return { ...base, kind: "legacy-only", generation: "legacy", path: legacyPath };
+  }
+  if (!legacyExists && agroExists) {
+    return { ...base, kind: "agro-only", generation: "agro", path: agroPath };
+  }
+  const differences = compareTrees(legacyPath, agroPath);
+  if (differences.length > 0) throw new CompatConflictError(legacyPath, agroPath, differences);
+  return { ...base, kind: "both-equivalent", generation: "agro", path: agroPath };
+}
+function isDirectoryAt(path4) {
+  return statOrUndefined(path4)?.isDirectory() === true;
+}
+function isFileAt(path4) {
+  return statOrUndefined(path4)?.isFile() === true;
+}
+function resolveControlDir(root) {
+  const dir = resolve(root);
+  return resolvePair(
+    join(dir, GENERATIONS.legacy.controlDir),
+    join(dir, GENERATIONS.agro.controlDir),
+    isDirectoryAt
+  );
+}
+function resolveConfigFile(root) {
+  const dir = resolve(root);
+  return resolvePair(
+    join(dir, GENERATIONS.legacy.configFile),
+    join(dir, GENERATIONS.agro.configFile),
+    isFileAt
+  );
+}
+function resolveProjectLayout(root) {
+  const dir = resolve(root);
+  const control = resolveControlDir(dir);
+  const config = resolveConfigFile(dir);
+  const generation = control.kind !== "absent" ? control.generation : config.kind !== "absent" ? config.generation : DEFAULT_GENERATION;
+  const names = GENERATIONS[generation];
+  return {
+    generation,
+    root: dir,
+    controlDir: join(dir, names.controlDir),
+    configFile: join(dir, names.configFile)
+  };
+}
+function controlDirCandidates() {
+  return [GENERATIONS.agro.controlDir, GENERATIONS.legacy.controlDir];
+}
+function remoteControlDirScript(root, rel, args) {
+  const candidates = controlDirCandidates().join(" ");
+  const script = `root="$1"; shift; rel="$1"; shift; for name in ${candidates}; do if [ -d "$root/$name" ]; then exec bash "$root/$name/$rel" "$@"; fi; done; printf 'no control plane (%s) under %s\\n' '${candidates}' "$root" >&2; exit 1`;
+  return ["bash", "-c", script, "control-dir", root, rel, ...args];
+}
+function envValue(env, key) {
+  const value = env[key];
+  return value !== void 0 && value !== "" ? value : void 0;
+}
+function resolveAliasedEnv(env, suffix) {
+  const agroKey = `${GENERATIONS.agro.envPrefix}${suffix}`;
+  const legacyKey = `${GENERATIONS.legacy.envPrefix}${suffix}`;
+  const agro = envValue(env, agroKey);
+  const legacy = envValue(env, legacyKey);
+  const conflict = agro !== void 0 && legacy !== void 0 && agro !== legacy;
+  if (agro !== void 0) {
+    return { key: suffix, agroKey, legacyKey, value: agro, source: "agro", conflict };
+  }
+  if (legacy !== void 0) {
+    return { key: suffix, agroKey, legacyKey, value: legacy, source: "legacy", conflict: false };
+  }
+  return { key: suffix, agroKey, legacyKey, value: void 0, source: "none", conflict: false };
+}
+function aliasConflictWarning(resolved2) {
+  if (!resolved2.conflict) return void 0;
+  return `compat: ${resolved2.agroKey} and ${resolved2.legacyKey} are both set and differ \u2014 using ${resolved2.agroKey}`;
+}
+function aliasedEnvPair(suffix, value) {
+  return {
+    [`${GENERATIONS.agro.envPrefix}${suffix}`]: value,
+    [`${GENERATIONS.legacy.envPrefix}${suffix}`]: value
+  };
+}
+function aliasedEnvValue(env, suffix, warn = (message) => process.stderr.write(`${message}
+`)) {
+  const resolved2 = resolveAliasedEnv(env, suffix);
+  const warning = aliasConflictWarning(resolved2);
+  if (warning !== void 0) warn(warning);
+  return resolved2.value;
+}
+var REGISTRY_SUBDIR = "sandboxes";
+function discoverUserState(home = homedir()) {
+  const probe = (name) => {
+    const path4 = join(home, name);
+    return { path: path4, exists: isDirectoryAt(path4) };
+  };
+  return {
+    agroHome: probe(GENERATIONS.agro.userStateDir),
+    legacyHome: probe(GENERATIONS.legacy.userStateDir),
+    legacyCheckout: probe(LEGACY_CHECKOUT_DIR)
+  };
+}
+function resolveRegistryHome(env = process.env, home = homedir(), warn) {
+  const configured = aliasedEnvValue(env, "HOME", warn);
+  if (configured !== void 0) return { path: resolve(configured), configured: true };
+  return { path: home, configured: false };
+}
+function resolveUserStateHome(env = process.env, home = homedir(), warn) {
+  const configured = aliasedEnvValue(env, "HOME", warn);
+  if (configured !== void 0) return resolve(configured);
+  const discovered = discoverUserState(home);
+  const legacyRegistry = join(discovered.legacyHome.path, REGISTRY_SUBDIR);
+  const agroRegistry = join(discovered.agroHome.path, REGISTRY_SUBDIR);
+  const resolution = resolvePair(legacyRegistry, agroRegistry, isDirectoryAt);
+  return resolution.generation === "agro" ? discovered.agroHome.path : discovered.legacyHome.path;
+}
 
 // src/lib/manifest.ts
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 import path from "node:path";
 var REGEX_SPECIAL = /* @__PURE__ */ new Set([".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]", "\\"]);
 function globToRegExp(glob) {
@@ -66,7 +292,7 @@ function rootPayloadDirs(manifest) {
 function loadManifest(fromOh) {
   try {
     const manifestPath = path.resolve(fromOh, "manifest.json");
-    const parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync2(manifestPath, "utf8"));
     if (!parsed || !Array.isArray(parsed.include) || parsed.include.length === 0) {
       return null;
     }
@@ -82,30 +308,30 @@ function loadManifest(fromOh) {
 
 // src/lib/vendor.ts
 import {
-  existsSync,
-  lstatSync,
+  existsSync as existsSync2,
+  lstatSync as lstatSync2,
   mkdirSync,
-  readdirSync,
+  readdirSync as readdirSync2,
   copyFileSync
 } from "node:fs";
 import path2 from "node:path";
-function assertDestInTarget(dest, targetOh, sep4) {
-  if (dest === targetOh || dest.startsWith(targetOh + sep4)) {
+function assertDestInTarget(dest, targetOh, sep5) {
+  if (dest === targetOh || dest.startsWith(targetOh + sep5)) {
     return;
   }
   throw new Error("oh: refusing to write outside target .oh: " + dest);
 }
-function assertDestInRoot(dest, targetRoot, sep4) {
-  if (dest === targetRoot || dest.startsWith(targetRoot + sep4)) {
+function assertDestInRoot(dest, targetRoot, sep5) {
+  if (dest === targetRoot || dest.startsWith(targetRoot + sep5)) {
     return;
   }
   throw new Error("oh: refusing to write outside target root: " + dest);
 }
 function walkFiles(root, dir, acc) {
-  const entries = readdirSync(dir, { withFileTypes: true });
+  const entries = readdirSync2(dir, { withFileTypes: true });
   for (const entry of entries) {
     const abs = path2.resolve(dir, entry.name);
-    const st = lstatSync(abs);
+    const st = lstatSync2(abs);
     if (st.isSymbolicLink()) {
       continue;
     }
@@ -142,7 +368,7 @@ function copyOhPayload(fromOh, targetOh, manifest, opts, report) {
     }
     const dest = path2.join(targetOh, rel);
     assertDestInTarget(dest, targetOh, path2.sep);
-    const exists = existsSync(dest);
+    const exists = existsSync2(dest);
     if (exists && skipExisting && !force) {
       report?.("skip-exists", rel);
       skipped++;
@@ -168,7 +394,7 @@ function copyRootPayload(fromRoot, targetRoot, manifest, opts, report) {
   const relpaths = [];
   for (const dir of rootPayloadDirs(manifest)) {
     const abs = path2.join(fromRoot, dir);
-    if (!existsSync(abs) || !lstatSync(abs).isDirectory()) {
+    if (!existsSync2(abs) || !lstatSync2(abs).isDirectory()) {
       continue;
     }
     walkFiles(fromRoot, abs, relpaths);
@@ -190,7 +416,7 @@ function copyRootPayload(fromRoot, targetRoot, manifest, opts, report) {
     }
     const dest = path2.join(targetRoot, rel);
     assertDestInRoot(dest, targetRoot, path2.sep);
-    const exists = existsSync(dest);
+    const exists = existsSync2(dest);
     if (exists && skipExisting && !force) {
       report?.("skip-exists", rel);
       skipped++;
@@ -232,7 +458,7 @@ function compareVersions(a, b) {
 function readCliVersion(ohDir) {
   const pkgPath = path3.resolve(ohDir, "cli", "package.json");
   try {
-    const parsed = JSON.parse(readFileSync2(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync3(pkgPath, "utf8"));
     if (parsed && typeof parsed.version === "string") {
       return parsed.version;
     }
@@ -243,23 +469,27 @@ function readCliVersion(ohDir) {
 async function runUpdate(opts, io) {
   const { targetDir, fromDir, force, dryRun } = opts;
   const dryPrefix = dryRun ? "[dry-run] " : "";
-  const fromOh = path3.resolve(fromDir, ".oh");
-  if (!existsSync2(fromOh) || !statSync(fromOh).isDirectory()) {
+  const source = resolveControlDir(fromDir);
+  if (source.kind === "absent") {
     io.stderr(
-      "oh update: update source not found at " + fromOh + ". Pass --from <built-OpenHarness-checkout> or --from-remote [--ref <ref>].\n"
+      "oh update: update source not found at " + source.agroPath + " or " + source.legacyPath + ". Pass --from <built-AGRO-checkout> or --from-remote [--ref <ref>].\n"
     );
     return 1;
   }
-  const targetOh = path3.resolve(targetDir, ".oh");
+  const fromOh = source.path;
+  const controlName = path3.basename(fromOh);
+  const target = resolveControlDir(targetDir);
+  const targetOh = target.kind === "absent" ? path3.resolve(targetDir, controlName) : target.path;
+  const targetName = path3.basename(targetOh);
   if (fromOh === targetOh) {
-    io.stderr("oh update: source and target are the same .oh; nothing to update.\n");
+    io.stderr("oh update: source and target are the same " + targetName + "; nothing to update.\n");
     return 1;
   }
   const available = readCliVersion(fromOh);
   const current = readCliVersion(targetOh);
   const cmp = compareVersions(available, current);
   if (cmp > 0) {
-    io.stdout(dryPrefix + "updating .oh: " + current + " -> " + available + "\n");
+    io.stdout(dryPrefix + "updating " + targetName + ": " + current + " -> " + available + "\n");
   } else if (cmp === 0) {
     if (!force) {
       io.stdout(dryPrefix + "oh update: already up to date (v" + current + ")\n");
@@ -274,13 +504,13 @@ async function runUpdate(opts, io) {
       return 1;
     }
     io.stdout(
-      dryPrefix + "oh update: downgrading .oh: " + current + " -> " + available + " (--force)\n"
+      dryPrefix + "oh update: downgrading " + targetName + ": " + current + " -> " + available + " (--force)\n"
     );
   }
   const manifest = loadManifest(fromOh);
   if (manifest === null) {
     io.stdout(
-      dryPrefix + "oh update: no .oh/manifest.json in source; overlaying all of .oh/ (legacy mode)\n"
+      dryPrefix + "oh update: no " + controlName + "/manifest.json in source; overlaying all of " + controlName + "/ (legacy mode)\n"
     );
   }
   let created = 0;
@@ -311,245 +541,52 @@ async function runUpdate(opts, io) {
     path3.resolve(fromDir),
     path3.resolve(targetDir),
     manifest,
-    { force, dryRun },
-    report
-  );
-  for (const dir of rootPayloadDirs(manifest ?? { include: [], exclude: [] })) {
-    const stranded = path3.resolve(targetDir, ".oh", dir);
-    if (existsSync2(stranded)) {
-      io.stdout(
-        dryPrefix + "oh update: " + path3.join(".oh", dir) + " still exists from a pre-move install and is no longer read; move any local edits into " + dir + "/ and delete it\n"
-      );
-    }
-  }
-  io.stdout(
-    dryPrefix + "oh update: " + created + " created, " + overwritten + " overwritten, " + (skipped + rootResult.skipped) + " skipped\n"
-  );
-  return 0;
-}
-
-// src/commands/self-upgrade.ts
-import { spawnSync } from "node:child_process";
-import {
-  accessSync,
-  constants,
-  readFileSync as readFileSync4,
-  realpathSync,
-  renameSync,
-  statSync as statSync3,
-  unlinkSync,
-  writeFileSync
-} from "node:fs";
-import { basename as basename2, delimiter, dirname, extname, join as join2 } from "node:path";
-
-// src/lib/compat.ts
-import {
-  existsSync as existsSync3,
-  lstatSync as lstatSync2,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync3,
-  readlinkSync,
-  statSync as statSync2
-} from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-var GENERATIONS = {
-  legacy: {
-    controlDir: ".oh",
-    configFile: "oh.json",
-    envPrefix: "OH_",
-    userStateDir: ".oh",
-    seedDir: "/opt/oh-seed"
-  },
-  agro: {
-    controlDir: ".agro",
-    configFile: "agro.json",
-    envPrefix: "AGRO_",
-    userStateDir: ".agro",
-    seedDir: "/opt/agro-seed"
-  }
-};
-var LEGACY_CHECKOUT_DIR = ".openharness";
-var CompatConflictError = class extends Error {
-  legacyPath;
-  agroPath;
-  differences;
-  constructor(legacyPath, agroPath, differences) {
-    super(
-      `${legacyPath} and ${agroPath} both exist and differ \u2014 resolve the conflict before continuing (keep exactly one, or make them identical); differences: ${differences.join("; ")}`
-    );
-    this.name = "CompatConflictError";
-    this.legacyPath = legacyPath;
-    this.agroPath = agroPath;
-    this.differences = differences;
-  }
-};
-function entryType(stats) {
-  if (stats.isSymbolicLink()) return "symlink";
-  if (stats.isDirectory()) return "directory";
-  if (stats.isFile()) return "file";
-  return "other";
-}
-function lstatOrUndefined(path4) {
-  return lstatSync2(path4, { throwIfNoEntry: false });
-}
-function statOrUndefined(path4) {
-  try {
-    return statSync2(path4, { throwIfNoEntry: false });
-  } catch {
-    return void 0;
-  }
-}
-function sameBytes(a, b) {
-  const left = readFileSync3(a);
-  const right = readFileSync3(b);
-  return left.equals(right);
-}
-function octal(mode) {
-  return (mode & 511).toString(8).padStart(3, "0");
-}
-function contentDifference(type, legacy, agro, left, right) {
-  switch (type) {
-    case "symlink":
-      return readlinkSync(legacy) !== readlinkSync(agro) ? "symlink target differs" : void 0;
-    case "file":
-      return left.size !== right.size || !sameBytes(legacy, agro) ? "content differs" : void 0;
-    case "other":
-      return "unsupported entry type";
-    default:
-      return void 0;
-  }
-}
-function entryDifferences(label, legacy, agro, left, right) {
-  const type = entryType(left);
-  if (type !== entryType(right)) return [`${label}: type ${type} vs ${entryType(right)}`];
-  const differences = [];
-  if ((left.mode & 511) !== (right.mode & 511)) {
-    differences.push(`${label}: mode ${octal(left.mode)} vs ${octal(right.mode)}`);
-  }
-  const content = contentDifference(type, legacy, agro, left, right);
-  if (content !== void 0) differences.push(`${label}: ${content}`);
-  return differences;
-}
-function compareTrees(legacy, agro, rel = "") {
-  const label = rel === "" ? "." : rel;
-  const left = lstatOrUndefined(legacy);
-  const right = lstatOrUndefined(agro);
-  if (left === void 0 && right === void 0) return [];
-  if (left === void 0) return [`${label}: only in ${agro}`];
-  if (right === void 0) return [`${label}: only in ${legacy}`];
-  const differences = entryDifferences(label, legacy, agro, left, right);
-  if (!left.isDirectory() || !right.isDirectory()) return differences;
-  const names = /* @__PURE__ */ new Set([...readdirSync2(legacy), ...readdirSync2(agro)]);
-  for (const name of [...names].sort()) {
-    const childRel = rel === "" ? name : `${rel}/${name}`;
-    differences.push(...compareTrees(join(legacy, name), join(agro, name), childRel));
-  }
-  return differences;
-}
-function resolvePair(legacyPath, agroPath, present) {
-  const legacyExists = present(legacyPath);
-  const agroExists = present(agroPath);
-  const base = { legacyPath, agroPath };
-  if (!legacyExists && !agroExists) {
-    return { ...base, kind: "absent", generation: void 0, path: void 0 };
-  }
-  if (legacyExists && !agroExists) {
-    return { ...base, kind: "legacy-only", generation: "legacy", path: legacyPath };
-  }
-  if (!legacyExists && agroExists) {
-    return { ...base, kind: "agro-only", generation: "agro", path: agroPath };
-  }
-  const differences = compareTrees(legacyPath, agroPath);
-  if (differences.length > 0) throw new CompatConflictError(legacyPath, agroPath, differences);
-  return { ...base, kind: "both-equivalent", generation: "agro", path: agroPath };
-}
-function isDirectoryAt(path4) {
-  return statOrUndefined(path4)?.isDirectory() === true;
-}
-function isFileAt(path4) {
-  return statOrUndefined(path4)?.isFile() === true;
-}
-function resolveControlDir(root) {
-  const dir = resolve(root);
-  return resolvePair(
-    join(dir, GENERATIONS.legacy.controlDir),
-    join(dir, GENERATIONS.agro.controlDir),
-    isDirectoryAt
-  );
-}
-function resolveConfigFile(root) {
-  const dir = resolve(root);
-  return resolvePair(
-    join(dir, GENERATIONS.legacy.configFile),
-    join(dir, GENERATIONS.agro.configFile),
-    isFileAt
+    { force, dryRun },
+    report
   );
-}
-function envValue(env, key) {
-  const value = env[key];
-  return value !== void 0 && value !== "" ? value : void 0;
-}
-function resolveAliasedEnv(env, suffix) {
-  const agroKey = `${GENERATIONS.agro.envPrefix}${suffix}`;
-  const legacyKey = `${GENERATIONS.legacy.envPrefix}${suffix}`;
-  const agro = envValue(env, agroKey);
-  const legacy = envValue(env, legacyKey);
-  const conflict = agro !== void 0 && legacy !== void 0 && agro !== legacy;
-  if (agro !== void 0) {
-    return { key: suffix, agroKey, legacyKey, value: agro, source: "agro", conflict };
-  }
-  if (legacy !== void 0) {
-    return { key: suffix, agroKey, legacyKey, value: legacy, source: "legacy", conflict: false };
+  for (const dir of rootPayloadDirs(manifest ?? { include: [], exclude: [] })) {
+    const stranded = path3.join(targetOh, dir);
+    if (existsSync3(stranded)) {
+      io.stdout(
+        dryPrefix + "oh update: " + path3.join(targetName, dir) + " still exists from a pre-move install and is no longer read; move any local edits into " + dir + "/ and delete it\n"
+      );
+    }
   }
-  return { key: suffix, agroKey, legacyKey, value: void 0, source: "none", conflict: false };
-}
-function aliasConflictWarning(resolved) {
-  if (!resolved.conflict) return void 0;
-  return `compat: ${resolved.agroKey} and ${resolved.legacyKey} are both set and differ \u2014 using ${resolved.agroKey}`;
-}
-function aliasedEnvValue(env, suffix, warn = (message) => process.stderr.write(`${message}
-`)) {
-  const resolved = resolveAliasedEnv(env, suffix);
-  const warning = aliasConflictWarning(resolved);
-  if (warning !== void 0) warn(warning);
-  return resolved.value;
-}
-var REGISTRY_SUBDIR = "sandboxes";
-function discoverUserState(home = homedir()) {
-  const probe = (name) => {
-    const path4 = join(home, name);
-    return { path: path4, exists: isDirectoryAt(path4) };
-  };
-  return {
-    agroHome: probe(GENERATIONS.agro.userStateDir),
-    legacyHome: probe(GENERATIONS.legacy.userStateDir),
-    legacyCheckout: probe(LEGACY_CHECKOUT_DIR)
-  };
-}
-function resolveUserStateHome(env = process.env, home = homedir(), warn) {
-  const configured = aliasedEnvValue(env, "HOME", warn);
-  if (configured !== void 0) return resolve(configured);
-  const discovered = discoverUserState(home);
-  const legacyRegistry = join(discovered.legacyHome.path, REGISTRY_SUBDIR);
-  const agroRegistry = join(discovered.agroHome.path, REGISTRY_SUBDIR);
-  const resolution = resolvePair(legacyRegistry, agroRegistry, isDirectoryAt);
-  return resolution.generation === "agro" ? discovered.agroHome.path : discovered.legacyHome.path;
+  io.stdout(
+    dryPrefix + "oh update: " + created + " created, " + overwritten + " overwritten, " + (skipped + rootResult.skipped) + " skipped\n"
+  );
+  return 0;
 }
 
+// src/commands/self-upgrade.ts
+import { spawnSync } from "node:child_process";
+import {
+  accessSync,
+  constants,
+  readFileSync as readFileSync4,
+  realpathSync,
+  renameSync,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { basename as basename2, delimiter, dirname, extname, join as join2 } from "node:path";
+
 // src/lib/product.ts
 import { basename } from "node:path";
 var AGRO_PRODUCT = {
   name: "agro",
   bin: "agro",
   title: "AGRO CLI",
-  packageName: "@mifune/agro"
+  packageName: "@mifune/agro",
+  generation: "agro"
 };
 var LEGACY_PRODUCT = {
   name: "oh",
   bin: "oh",
   title: "Open Harness CLI",
-  packageName: "@mifune/openharness"
+  packageName: "@mifune/openharness",
+  generation: "legacy"
 };
 var FILE_EXTENSION = /\.[^.]*$/;
 function invokedName(argv1) {
@@ -559,9 +596,15 @@ function invokedName(argv1) {
 function resolveProduct(argv1) {
   return invokedName(argv1) === LEGACY_PRODUCT.bin ? LEGACY_PRODUCT : AGRO_PRODUCT;
 }
+function productFor(bin) {
+  return bin === LEGACY_PRODUCT.bin ? LEGACY_PRODUCT : AGRO_PRODUCT;
+}
+function stateNames(bin) {
+  return GENERATIONS[productFor(bin).generation];
+}
 
 // src/commands/self-upgrade.ts
-var DEFAULT_ARTIFACT_URL = "https://github.com/mifunedev/openharness/releases/latest/download/agro.js";
+var DEFAULT_ARTIFACT_URL = "https://github.com/mifunedev/agro/releases/latest/download/agro.js";
 var PREFIX = `${AGRO_PRODUCT.bin} update`;
 var PACKAGE = AGRO_PRODUCT.packageName;
 var IMAGE_ROOT = "/opt/oh/";
@@ -609,9 +652,9 @@ function kindOfTarget(target, deps) {
 function classifyInstallation(argv1, deps) {
   const invoked = argv1 ?? "";
   if (invoked === "") return { kind: "unknown", target: "", invoked, reason: "no executable path (argv[1] is empty)" };
-  const resolved = resolveTarget(invoked, deps);
-  if (resolved.reason !== void 0) return { kind: "unknown", target: resolved.target, invoked, reason: resolved.reason };
-  return { ...kindOfTarget(resolved.target, deps), target: resolved.target, invoked };
+  const resolved2 = resolveTarget(invoked, deps);
+  if (resolved2.reason !== void 0) return { kind: "unknown", target: resolved2.target, invoked, reason: resolved2.reason };
+  return { ...kindOfTarget(resolved2.target, deps), target: resolved2.target, invoked };
 }
 function parseSemver(input) {
   const m = SEMVER.exec(input.trim());
@@ -667,7 +710,7 @@ function refuseUnsupported(installation) {
         `${at} \u2014 the sandbox image ships this CLI; pull a newer image on the host (oh/agro stop, then agro sandbox install docker --name <name>)`
       );
     case "source":
-      return new Error(`${at} \u2014 rebuild from the checkout: npm --prefix .oh/cli run build`);
+      return new Error(`${at} \u2014 rebuild from the checkout: npm --prefix .agro/cli run build`);
     case "legacy-package":
       return new Error(`${at} \u2014 install the canonical package: npm install -g ${PACKAGE}`);
     default:
@@ -679,13 +722,13 @@ function refuseUnsupported(installation) {
 function assertOnlyAgroOnPath(installation, deps) {
   const found = deps.which(AGRO_PRODUCT.bin);
   if (found === void 0) return;
-  let resolved;
+  let resolved2;
   try {
-    resolved = deps.realpath(found);
+    resolved2 = deps.realpath(found);
   } catch {
-    resolved = found;
+    resolved2 = found;
   }
-  if (resolved !== installation.target) {
+  if (resolved2 !== installation.target) {
     throw new Error(
       `another ${AGRO_PRODUCT.bin} is earlier on PATH (${found}); upgrading ${installation.target} would not change what runs \u2014 remove or reorder it first`
     );
@@ -863,14 +906,14 @@ async function runSelfUpgrade(opts, deps, io) {
 }
 function whichOnPath(name, env, platform) {
   const win32 = platform === "win32";
-  const sep4 = win32 ? ";" : delimiter;
-  const dirs = (env.PATH ?? "").split(sep4).filter((d) => d !== "");
+  const sep5 = win32 ? ";" : delimiter;
+  const dirs = (env.PATH ?? "").split(sep5).filter((d) => d !== "");
   const exts = win32 ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")] : [""];
   for (const dir of dirs) {
     for (const ext of exts) {
       const candidate = join2(dir, `${name}${ext}`);
       try {
-        if (statSync3(candidate).isFile()) {
+        if (statSync2(candidate).isFile()) {
           if (!win32) accessSync(candidate, constants.X_OK);
           return candidate;
         }
@@ -897,7 +940,7 @@ function defaultDeps(currentVersion) {
   return {
     env: process.env,
     realpath: (path4) => realpathSync(path4),
-    stat: (path4) => statSync3(path4),
+    stat: (path4) => statSync2(path4),
     access: (path4, mode) => accessSync(path4, mode),
     readFile: (path4) => readFileSync4(path4),
     writeFile: (path4, data, mode) => writeFileSync(path4, data, { mode }),
@@ -912,10 +955,560 @@ function defaultDeps(currentVersion) {
   };
 }
 
+// src/commands/migrate.ts
+import { lstatSync as lstatSync4 } from "node:fs";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+
+// src/lib/migrate.ts
+import {
+  closeSync,
+  existsSync as existsSync4,
+  fsyncSync,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync5,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync2,
+  renameSync as renameSync2,
+  symlinkSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname as dirname2, isAbsolute, relative, resolve as resolve2, sep } from "node:path";
+var MIGRATION_PLAN_VERSION = 1;
+var RETIRED_SUFFIX = ".migrated";
+var LOCK_FILE = ".agro-migrate.lock";
+function snapshot(path4) {
+  const stats = lstatSync3(path4, { throwIfNoEntry: false });
+  if (stats === void 0) return void 0;
+  return {
+    type: stats.isSymbolicLink() ? "symlink" : stats.isDirectory() ? "directory" : "file",
+    mode: stats.mode & 511,
+    ino: stats.ino,
+    mtimeMs: stats.mtimeMs,
+    size: stats.size
+  };
+}
+function presentAs(path4, kind) {
+  let stats;
+  try {
+    stats = lstatSync3(path4, { throwIfNoEntry: false });
+  } catch {
+    return false;
+  }
+  if (stats === void 0) return false;
+  if (stats.isSymbolicLink()) return true;
+  return kind === "dir" ? stats.isDirectory() : stats.isFile();
+}
+function nearestExistingAncestor(path4) {
+  let cursor = path4;
+  while (!existsSync4(cursor)) {
+    const parent = dirname2(cursor);
+    if (parent === cursor) return cursor;
+    cursor = parent;
+  }
+  return cursor;
+}
+function insideRoot(root, candidate) {
+  const realRoot = realpathSync2(root);
+  const anchor = nearestExistingAncestor(dirname2(candidate));
+  const realAnchor = realpathSync2(anchor);
+  const rel = relative(realRoot, realAnchor);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function assertInsideRoot(root, path4, label) {
+  if (!isAbsolute(path4)) throw new Error(`migration ${label} must be absolute: ${path4}`);
+  const absolute = resolve2(path4);
+  if (!insideRoot(root, absolute)) {
+    throw new Error(`refusing migration ${label} outside ${root}: ${absolute}`);
+  }
+  return absolute;
+}
+function sameSnapshot(a, b) {
+  return b !== void 0 && a.type === b.type && a.mode === b.mode && a.ino === b.ino && a.mtimeMs === b.mtimeMs && a.size === b.size;
+}
+function planPair(root, pair) {
+  const legacy = assertInsideRoot(root, pair.legacy, "source");
+  const agro = assertInsideRoot(root, pair.agro, "destination");
+  const legacyPresent = presentAs(legacy, pair.kind);
+  const agroPresent = presentAs(agro, pair.kind);
+  if (!legacyPresent) {
+    return { kind: "noop", path: agro, reason: agroPresent ? "already migrated" : "absent in both generations" };
+  }
+  if (!agroPresent) {
+    if (lstatSync3(agro, { throwIfNoEntry: false }) !== void 0) {
+      return { path: agro, reason: `destination exists but is not a ${pair.kind}` };
+    }
+    return {
+      kind: "rename",
+      from: legacy,
+      to: agro,
+      snapshot: snapshot(legacy),
+      createsParent: !existsSync4(dirname2(agro))
+    };
+  }
+  const differences = compareTrees(legacy, agro);
+  if (differences.length > 0) {
+    return { path: agro, reason: "both generations exist and differ", differences };
+  }
+  const retired = `${legacy}${RETIRED_SUFFIX}`;
+  if (lstatSync3(retired, { throwIfNoEntry: false }) !== void 0) {
+    return { path: retired, reason: "retired copy already exists" };
+  }
+  return { kind: "retire", from: legacy, to: retired, snapshot: snapshot(legacy) };
+}
+function planRewrite(root, rewrite) {
+  const path4 = assertInsideRoot(root, rewrite.path, "rewrite target");
+  const current = snapshot(path4);
+  if (current === void 0 || current.type !== "file") {
+    return { kind: "noop", path: path4, reason: "rewrite target is not a regular file" };
+  }
+  const content = readFileSync5(path4, "utf8");
+  const changed = rewrite.replacements.some((r) => r.from !== "" && content.includes(r.from));
+  if (!changed) return { kind: "noop", path: path4, reason: "rewrite already applied" };
+  return { kind: "rewrite", path: path4, replacements: rewrite.replacements, snapshot: current };
+}
+function planRelink(root, relink) {
+  const path4 = assertInsideRoot(root, relink.path, "relink target");
+  const current = snapshot(path4);
+  if (current === void 0) return { kind: "noop", path: path4, reason: "link absent" };
+  if (current.type !== "symlink") return { kind: "noop", path: path4, reason: "not a symlink" };
+  const target = readlinkSync2(path4);
+  if (target === relink.to) return { kind: "noop", path: path4, reason: "link already points at the AGRO target" };
+  if (target !== relink.from) return { kind: "noop", path: path4, reason: `link points at ${target}, not ${relink.from}` };
+  return { kind: "relink", path: path4, from: relink.from, to: relink.to, snapshot: current };
+}
+function resolved(path4) {
+  try {
+    return realpathSync2(path4);
+  } catch {
+    return void 0;
+  }
+}
+function resolvesToPack(path4, packs) {
+  const target = resolved(path4);
+  if (target === void 0) return false;
+  return packs.some((pack) => resolved(pack) === target);
+}
+function replacementSurvives(retire) {
+  const current = snapshot(retire.replacement);
+  if (current === void 0 || current.type !== "symlink") return false;
+  if (!retire.replacementTargets.includes(readlinkSync2(retire.replacement))) return false;
+  return resolvesToPack(retire.replacement, retire.packs);
+}
+function preserveRetiredLink(root, retire, reason) {
+  const step = planRelink(root, { path: retire.path, ...retire.preserve });
+  return step.kind === "relink" ? step : { kind: "noop", path: resolve2(retire.path), reason };
+}
+function planRetireLink(root, retire) {
+  const path4 = assertInsideRoot(root, retire.path, "retired link");
+  const current = snapshot(path4);
+  if (current === void 0) return { kind: "noop", path: path4, reason: "link absent" };
+  if (current.type !== "symlink") return { kind: "noop", path: path4, reason: "not a symlink" };
+  if (!resolvesToPack(path4, retire.packs)) {
+    return preserveRetiredLink(root, retire, "link does not resolve to the Open Harness skill pack");
+  }
+  if (!replacementSurvives(retire)) {
+    return preserveRetiredLink(
+      root,
+      retire,
+      `${retire.replacement} is not an independent skill-pack link that survives the migration`
+    );
+  }
+  const retired = `${path4}${RETIRED_SUFFIX}`;
+  if (lstatSync3(retired, { throwIfNoEntry: false }) !== void 0) {
+    return { path: retired, reason: "retired copy already exists" };
+  }
+  return { kind: "retire", from: path4, to: retired, snapshot: current };
+}
+function isStep(entry) {
+  return "kind" in entry;
+}
+function planMigration(spec) {
+  const root = resolve2(spec.root);
+  if (!existsSync4(root)) throw new Error(`migration root does not exist: ${root}`);
+  const steps = [];
+  const conflicts = [];
+  for (const pair of spec.pairs) {
+    const planned = planPair(root, pair);
+    if (isStep(planned)) steps.push(planned);
+    else conflicts.push(planned);
+  }
+  for (const retired of spec.retireLinks ?? []) {
+    const planned = planRetireLink(root, retired);
+    if (isStep(planned)) steps.push(planned);
+    else conflicts.push(planned);
+  }
+  for (const rewrite of spec.rewrites ?? []) steps.push(planRewrite(root, rewrite));
+  for (const relink of spec.relinks ?? []) steps.push(planRelink(root, relink));
+  const mutating = steps.some((step) => step.kind !== "noop");
+  const status = conflicts.length > 0 ? "conflict" : mutating ? "ready" : "noop";
+  return { version: MIGRATION_PLAN_VERSION, root, status, steps, conflicts };
+}
+function acquireLock(root) {
+  const lock = resolve2(root, LOCK_FILE);
+  let fd;
+  try {
+    fd = openSync(lock, "wx", 384);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EEXIST") return void 0;
+    throw error;
+  }
+  writeFileSync2(fd, `${process.pid}
+`);
+  closeSync(fd);
+  return () => {
+    try {
+      unlinkSync2(lock);
+    } catch {
+    }
+  };
+}
+function revalidateInPlace(step) {
+  if (!sameSnapshot(step.snapshot, snapshot(step.path))) return `${step.path} changed since the plan was made`;
+  if (step.kind === "relink" && readlinkSync2(step.path) !== step.from) {
+    return `${step.path} changed since the plan was made`;
+  }
+  return void 0;
+}
+function revalidate(step) {
+  if (step.kind === "noop") return void 0;
+  if (step.kind === "rewrite" || step.kind === "relink") return revalidateInPlace(step);
+  if (!sameSnapshot(step.snapshot, snapshot(step.from))) {
+    return `${step.from} changed since the plan was made`;
+  }
+  if (lstatSync3(step.to, { throwIfNoEntry: false }) !== void 0) {
+    return `${step.to} appeared since the plan was made`;
+  }
+  return void 0;
+}
+function applyRewrite(step) {
+  let content = readFileSync5(step.path, "utf8");
+  for (const { from, to } of step.replacements) {
+    if (from === "") continue;
+    content = content.split(from).join(to);
+  }
+  const tmp = `${step.path}.tmp.${process.pid}`;
+  const fd = openSync(tmp, "w", step.snapshot.mode);
+  try {
+    writeFileSync2(fd, content, "utf8");
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync2(tmp, step.path);
+}
+function applyRelink(step) {
+  const tmp = `${step.path}.tmp.${process.pid}`;
+  symlinkSync(step.to, tmp);
+  try {
+    renameSync2(tmp, step.path);
+  } catch (error) {
+    unlinkSync2(tmp);
+    throw error;
+  }
+}
+function pendingResults(plan) {
+  return plan.steps.map((step) => ({ ...step, outcome: step.kind === "noop" ? "skipped" : "pending" }));
+}
+function refusal(plan) {
+  if (plan.version !== MIGRATION_PLAN_VERSION) return `unsupported plan version ${plan.version}`;
+  if (plan.status === "conflict") {
+    return plan.conflicts.map((c) => `${c.path}: ${c.reason}`).join("; ");
+  }
+  return void 0;
+}
+function revalidatePlan(root, plan) {
+  for (const step of plan.steps) {
+    const stale = revalidate(step);
+    if (stale !== void 0) return stale;
+    if (step.kind === "rename" || step.kind === "retire") {
+      assertInsideRoot(root, step.from, "source");
+      assertInsideRoot(root, step.to, "destination");
+    }
+  }
+  return void 0;
+}
+function applyStep(step) {
+  if (step.kind === "noop") return;
+  if (step.kind === "rewrite") {
+    applyRewrite(step);
+    return;
+  }
+  if (step.kind === "relink") {
+    applyRelink(step);
+    return;
+  }
+  if (step.kind === "rename" && step.createsParent) mkdirSync2(dirname2(step.to), { recursive: true });
+  renameSync2(step.from, step.to);
+}
+function applySteps(root, plan) {
+  const results = pendingResults(plan);
+  for (let i = 0; i < plan.steps.length; i += 1) {
+    const step = plan.steps[i];
+    if (step.kind === "noop") continue;
+    try {
+      applyStep(step);
+      results[i] = { ...step, outcome: "done" };
+    } catch (error) {
+      results[i] = { ...step, outcome: "failed", error: error instanceof Error ? error.message : String(error) };
+      return {
+        status: "failed",
+        root,
+        reason: `step ${i + 1} failed; completed steps are recoverable by reversing them in order`,
+        steps: results
+      };
+    }
+  }
+  return { status: "applied", root, steps: results };
+}
+function applyMigration(plan) {
+  const root = resolve2(plan.root);
+  const refused = refusal(plan);
+  if (refused !== void 0) return { status: "refused", root, reason: refused, steps: pendingResults(plan) };
+  if (plan.status === "noop") return { status: "noop", root, steps: pendingResults(plan) };
+  const release = acquireLock(root);
+  if (release === void 0) {
+    return {
+      status: "refused",
+      root,
+      reason: `another migration holds ${resolve2(root, LOCK_FILE)}`,
+      steps: pendingResults(plan)
+    };
+  }
+  try {
+    const stale = revalidatePlan(root, plan);
+    if (stale !== void 0) return { status: "refused", root, reason: stale, steps: pendingResults(plan) };
+    return applySteps(root, plan);
+  } finally {
+    release();
+  }
+}
+var PROVIDER_LINKS = [
+  { link: ".claude/skills", target: "skills" },
+  { link: ".claude/hooks", target: "hooks" },
+  { link: ".agents/skills", target: "skills" }
+];
+var CANONICAL_SKILL_PACKS = [".oh/skills", ".agro/skills"];
+var SURVIVING_SKILL_LINK_TARGETS = ["../.oh/skills", "../.agro/skills"];
+var RETIRED_PROVIDER_LINKS = [
+  {
+    link: ".pi/skills",
+    replacement: ".agents/skills",
+    preserve: { from: "../.oh/skills", to: "../.agro/skills" }
+  },
+  {
+    link: ".codex/skills",
+    replacement: ".agents/skills",
+    preserve: { from: "../.oh/skills", to: "../.agro/skills" }
+  }
+];
+function providerRelinks(root) {
+  const dir = resolve2(root);
+  return PROVIDER_LINKS.map(({ link, target }) => ({
+    path: resolve2(dir, ...link.split("/")),
+    from: `../.oh/${target}`,
+    to: `../.agro/${target}`
+  }));
+}
+function retiredProviderLinks(root) {
+  const dir = resolve2(root);
+  const packs = CANONICAL_SKILL_PACKS.map((pack) => resolve2(dir, ...pack.split("/")));
+  return RETIRED_PROVIDER_LINKS.map(({ link, replacement, preserve }) => ({
+    path: resolve2(dir, ...link.split("/")),
+    packs,
+    replacement: resolve2(dir, ...replacement.split("/")),
+    replacementTargets: [...SURVIVING_SKILL_LINK_TARGETS],
+    preserve
+  }));
+}
+function projectMigrationSpec(root) {
+  const dir = resolve2(root);
+  return {
+    root: dir,
+    pairs: [
+      { legacy: `${dir}${sep}.oh`, agro: `${dir}${sep}.agro`, kind: "dir" },
+      { legacy: `${dir}${sep}oh.json`, agro: `${dir}${sep}agro.json`, kind: "file" }
+    ],
+    retireLinks: retiredProviderLinks(dir),
+    relinks: providerRelinks(dir)
+  };
+}
+function userStateMigrationSpec(home) {
+  const dir = resolve2(home);
+  return {
+    root: dir,
+    pairs: [
+      {
+        legacy: `${dir}${sep}.oh${sep}sandboxes`,
+        agro: `${dir}${sep}.agro${sep}sandboxes`,
+        kind: "dir"
+      }
+    ]
+  };
+}
+
+// src/commands/migrate.ts
+var ROOT_MARKERS = [".oh", ".agro", "oh.json", "agro.json"];
+var HELP_FLAGS = ["-h", "--help", "help"];
+function defaultMigrateDeps() {
+  const registry = resolveRegistryHome();
+  return {
+    cwd: () => process.cwd(),
+    home: () => registry.path,
+    homeConfigured: () => registry.configured
+  };
+}
+function parseMigrateArgs(argv, bin) {
+  const args = { bin, help: false, check: false, home: false, json: false };
+  for (const arg of argv) {
+    if (HELP_FLAGS.includes(arg)) return { ok: true, args: { ...args, help: true } };
+    if (arg === "--check") args.check = true;
+    else if (arg === "--home") args.home = true;
+    else if (arg === "--json") args.json = true;
+    else return { ok: false, error: `${bin} migrate: unexpected argument "${arg}"`, showHelp: true };
+  }
+  return { ok: true, args };
+}
+function migrateHelpText(bin) {
+  return `${bin} migrate \u2014 Move a legacy .oh/ project or ~/.oh registry to AGRO names
+
+Usage:
+  ${bin} migrate [--check] [--home] [--json]
+
+Project mode (default) finds the nearest ancestor of the current directory that
+holds .oh/, .agro/, oh.json or agro.json and renames .oh/ -> .agro/ and
+oh.json -> agro.json wholesale. Provider links (.claude/skills, .claude/hooks,
+.agents/skills) that point at ../.oh/... are re-pointed at ../.agro/....
+Retired links (.pi/skills, .codex/skills) move to <path>.migrated only when each
+resolves to the Open Harness skill pack and .agents/skills independently links
+to that pack. Otherwise each retired link stays in place, re-pointed at
+../.agro/skills when it named the legacy pack. Other links stay unchanged.
+
+Flags:
+  --check   Print the plan and change nothing.
+  --home    Migrate the sandbox registry ~/.oh/sandboxes -> ~/.agro/sandboxes instead.
+  --json    Emit the plan (--check) or {plan, result} as JSON on stdout.
+
+Byte-identical legacy and AGRO copies retire the legacy one to <name>.migrated;
+divergent copies are refused and nothing is merged or deleted. ~/.openharness,
+.env and .git are never touched.
+
+Exit codes: 0 applied or nothing to do, 2 refused (conflict or lock), 1 failure.
+`;
+}
+function printMigrateHelp(bin) {
+  process.stdout.write(migrateHelpText(bin));
+}
+function hasMarker(dir) {
+  return ROOT_MARKERS.some((marker) => lstatSync4(join3(dir, marker), { throwIfNoEntry: false }) !== void 0);
+}
+function findProjectRoot(cwd) {
+  const start = resolve3(cwd);
+  let cursor = start;
+  while (true) {
+    if (hasMarker(cursor)) return cursor;
+    const parent = dirname3(cursor);
+    if (parent === cursor) return start;
+    cursor = parent;
+  }
+}
+function specFor(args, deps) {
+  return args.home ? userStateMigrationSpec(deps.home()) : projectMigrationSpec(findProjectRoot(deps.cwd()));
+}
+function describeStep(step) {
+  switch (step.kind) {
+    case "rename":
+      return `rename  ${step.from} -> ${step.to}`;
+    case "retire":
+      return `retire  ${step.from} -> ${step.to}`;
+    case "rewrite":
+      return `rewrite ${step.path} (${step.replacements.length} replacement${step.replacements.length === 1 ? "" : "s"})`;
+    case "relink":
+      return `relink  ${step.path}: ${step.from} -> ${step.to}`;
+    case "noop":
+      return `noop    ${step.path} (${step.reason})`;
+  }
+}
+function describeConflict(conflict) {
+  const lines = [`  ${conflict.path}: ${conflict.reason}`];
+  for (const difference of conflict.differences ?? []) lines.push(`    - ${difference}`);
+  return lines;
+}
+function planSummary(bin, plan) {
+  const lines = [`${bin} migrate: plan for ${plan.root}`];
+  for (const step of plan.steps) lines.push(`  ${describeStep(step)}`);
+  if (plan.conflicts.length > 0) {
+    lines.push("conflicts:");
+    for (const conflict of plan.conflicts) lines.push(...describeConflict(conflict));
+  }
+  lines.push(`status: ${plan.status}`);
+  return `${lines.join("\n")}
+`;
+}
+function describeOutcome(step) {
+  const suffix = step.error === void 0 ? "" : ` \u2014 ${step.error}`;
+  return `  ${step.outcome.padEnd(7)} ${describeStep(step)}${suffix}`;
+}
+function resultSummary(bin, result) {
+  const lines = [`${bin} migrate: ${result.status}${result.reason === void 0 ? "" : ` \u2014 ${result.reason}`}`];
+  for (const step of result.steps) lines.push(describeOutcome(step));
+  return `${lines.join("\n")}
+`;
+}
+function planExitCode(plan) {
+  return plan.status === "conflict" ? 2 : 0;
+}
+function resultExitCode(result) {
+  if (result.status === "applied" || result.status === "noop") return 0;
+  return result.status === "refused" ? 2 : 1;
+}
+function emitJson(io, value) {
+  io.stdout(`${JSON.stringify(value, null, 2)}
+`);
+}
+function check(args, plan, io) {
+  if (args.json) emitJson(io, plan);
+  else io.stdout(planSummary(args.bin, plan));
+  return planExitCode(plan);
+}
+function apply(args, plan, io) {
+  const result = applyMigration(plan);
+  if (args.json) {
+    emitJson(io, { plan, result });
+  } else {
+    io.stdout(planSummary(args.bin, plan));
+    io.stdout(resultSummary(args.bin, result));
+  }
+  return resultExitCode(result);
+}
+function runMigrate(args, io, deps = defaultMigrateDeps()) {
+  try {
+    if (args.home && deps.homeConfigured?.() === true) {
+      io.stdout(
+        `${args.bin} migrate: the registry home is set explicitly to ${deps.home()}, so it holds no .oh or .agro directory to rename
+`
+      );
+      io.stdout(`${args.bin} migrate: noop
+`);
+      return 0;
+    }
+    const plan = planMigration(specFor(args, deps));
+    return args.check ? check(args, plan, io) : apply(args, plan, io);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    io.stderr(`${args.bin} migrate: ${message}
+`);
+    return 1;
+  }
+}
+
 // src/commands/cloud.ts
 import { readFile } from "node:fs/promises";
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
-import { join as join3 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
+import { join as join4 } from "node:path";
 
 // src/lib/prompt.ts
 import { createInterface } from "node:readline";
@@ -944,8 +1537,8 @@ function redact(token) {
 async function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    return await new Promise((resolve9) => {
-      rl.question(`  ${question} `, (answer) => resolve9(answer.trim()));
+    return await new Promise((resolve11) => {
+      rl.question(`  ${question} `, (answer) => resolve11(answer.trim()));
     });
   } finally {
     rl.close();
@@ -957,7 +1550,7 @@ async function askSecret(question) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   const bytes = [];
-  return await new Promise((resolve9) => {
+  return await new Promise((resolve11) => {
     const cleanup = () => {
       try {
         process.stdin.setRawMode(false);
@@ -975,7 +1568,7 @@ async function askSecret(question) {
         } else if (byte === 13 || byte === 10) {
           cleanup();
           process.stdout.write("\n");
-          resolve9(Buffer.from(bytes).toString("utf8").trim());
+          resolve11(Buffer.from(bytes).toString("utf8").trim());
           return;
         } else if (byte === 127 || byte === 8) {
           if (bytes.length > 0) {
@@ -1025,10 +1618,10 @@ async function askSecretPiped(question) {
   };
   process.on("SIGINT", onSigint);
   try {
-    return await new Promise((resolve9) => {
+    return await new Promise((resolve11) => {
       rl.question(`  ${question} `, (answer) => {
         process.stdout.write("\n");
-        resolve9(answer.trim());
+        resolve11(answer.trim());
       });
     });
   } finally {
@@ -1044,14 +1637,14 @@ async function confirm(question, defaultYes = true) {
 }
 
 // src/lib/oh-config.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename as basename3, dirname as dirname2, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename as basename3, dirname as dirname4, resolve as resolve5 } from "node:path";
 
 // src/lib/env-file.ts
-import { existsSync as existsSync4 } from "node:fs";
-import { resolve as resolve2, sep } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { resolve as resolve4, sep as sep2 } from "node:path";
 function assertInRoot(dest, root) {
-  if (!(dest === root || dest.startsWith(root + sep))) {
+  if (!(dest === root || dest.startsWith(root + sep2))) {
     throw new Error(`refusing to write outside the project root: ${dest}`);
   }
 }
@@ -1075,12 +1668,12 @@ function setEnvValue(root, key, value) {
 }
 function setConfigField(root, path4, value) {
   const file = ohConfigPath(root);
-  assertInRoot(file, resolve2(root));
+  assertInRoot(file, resolve4(root));
   const config = readOhConfig(file);
   const before = getOhConfigValue(config, path4);
   const next = setOhConfigValue(config, path4, value);
   const after = getOhConfigValue(next, path4);
-  if (existsSync4(file) && JSON.stringify(before) === JSON.stringify(after)) {
+  if (existsSync5(file) && JSON.stringify(before) === JSON.stringify(after)) {
     return "already-set";
   }
   writeOhConfig(root, next);
@@ -1147,8 +1740,7 @@ var LANGFUSE_PRIVACY_PRESETS = [
 ];
 var SANDBOX_RUNTIMES = ["docker"];
 function ohConfigPath(root) {
-  const resolved = resolveConfigFile(root);
-  return resolved.generation === "agro" ? resolve3(root, GENERATIONS.agro.configFile) : resolve3(root, OH_CONFIG_FILE);
+  return resolveProjectLayout(root).configFile;
 }
 function defaultOhConfig(name) {
   return {
@@ -1173,10 +1765,10 @@ function defaultOhConfig(name) {
   };
 }
 function readOhConfig(path4) {
-  if (!existsSync5(path4)) return defaultOhConfig(basename3(dirname2(resolve3(path4))));
+  if (!existsSync6(path4)) return defaultOhConfig(basename3(dirname4(resolve5(path4))));
   let raw;
   try {
-    raw = readFileSync5(path4, "utf8");
+    raw = readFileSync6(path4, "utf8");
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     throw new Error(`could not read ${path4}: ${detail}`);
@@ -1185,24 +1777,24 @@ function readOhConfig(path4) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`${OH_CONFIG_FILE} is not valid JSON: ${path4}`);
+    throw new Error(`${basename3(path4)} is not valid JSON: ${path4}`);
   }
   return validateOhConfig(parsed);
 }
 function writeOhConfig(root, config) {
   const path4 = ohConfigPath(root);
-  assertInRoot(path4, resolve3(root));
+  assertInRoot(path4, resolve5(root));
   const validated = validateOhConfig({ ...config, version: 1 });
   const body = `${JSON.stringify(validated, null, 2)}
 `;
   const tmp = `${path4}.tmp.${process.pid}`;
-  mkdirSync2(dirname2(path4), { recursive: true });
+  mkdirSync3(dirname4(path4), { recursive: true });
   try {
-    writeFileSync2(tmp, body, { mode: OH_CONFIG_MODE, encoding: "utf8" });
-    renameSync2(tmp, path4);
+    writeFileSync3(tmp, body, { mode: OH_CONFIG_MODE, encoding: "utf8" });
+    renameSync3(tmp, path4);
   } catch (error) {
     try {
-      unlinkSync2(tmp);
+      unlinkSync3(tmp);
     } catch {
     }
     throw error;
@@ -1402,12 +1994,12 @@ function coerceFieldValue(field, raw) {
 }
 
 // src/lib/project.ts
-import { dirname as dirname3, resolve as resolve4 } from "node:path";
+import { dirname as dirname5, resolve as resolve6 } from "node:path";
 function resolveProjectRoot(startDir = process.cwd()) {
-  let dir = resolve4(startDir);
+  let dir = resolve6(startDir);
   for (; ; ) {
     if (resolveControlDir(dir).kind !== "absent") return dir;
-    const parent = dirname3(dir);
+    const parent = dirname5(dir);
     if (parent === dir) {
       throw new Error("not an OpenHarness-equipped repo \u2014 run `oh update` first");
     }
@@ -1416,23 +2008,23 @@ function resolveProjectRoot(startDir = process.cwd()) {
 }
 
 // src/lib/secrets.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 
 // src/lib/env.ts
 import {
-  readFileSync as readFileSync6,
-  writeFileSync as writeFileSync3,
-  existsSync as existsSync6,
-  fsyncSync,
-  renameSync as renameSync3,
-  unlinkSync as unlinkSync3,
-  openSync,
-  closeSync
+  readFileSync as readFileSync7,
+  writeFileSync as writeFileSync4,
+  existsSync as existsSync7,
+  fsyncSync as fsyncSync2,
+  renameSync as renameSync4,
+  unlinkSync as unlinkSync4,
+  openSync as openSync2,
+  closeSync as closeSync2
 } from "node:fs";
 function loadEnvInto(envPath, env) {
-  if (!existsSync6(envPath)) return;
-  const content = readFileSync6(envPath, "utf8");
+  if (!existsSync7(envPath)) return;
+  const content = readFileSync7(envPath, "utf8");
   for (const rawLine of content.split("\n")) {
     const line = rawLine.trimEnd();
     if (line === "" || /^\s*#/.test(line)) continue;
@@ -1448,21 +2040,21 @@ function writeEnvFile(envPath, content) {
   const tmpPath = `${envPath}.tmp.${process.pid}`;
   let fd;
   try {
-    fd = openSync(tmpPath, "w", 384);
-    writeFileSync3(tmpPath, content, "utf8");
-    fsyncSync(fd);
-    closeSync(fd);
+    fd = openSync2(tmpPath, "w", 384);
+    writeFileSync4(tmpPath, content, "utf8");
+    fsyncSync2(fd);
+    closeSync2(fd);
     fd = void 0;
-    renameSync3(tmpPath, envPath);
+    renameSync4(tmpPath, envPath);
   } catch (err) {
     if (fd !== void 0) {
       try {
-        closeSync(fd);
+        closeSync2(fd);
       } catch {
       }
     }
     try {
-      unlinkSync3(tmpPath);
+      unlinkSync4(tmpPath);
     } catch {
     }
     throw err;
@@ -1484,7 +2076,7 @@ var SECRET_KEYS = [
 ];
 var ALLOWED = new Set(SECRET_KEYS);
 function secretsFilePath(root) {
-  return resolve5(root, SECRETS_FILE);
+  return resolve7(root, SECRETS_FILE);
 }
 function isSecretKey(key) {
   return ALLOWED.has(key);
@@ -1498,7 +2090,7 @@ function assertSecretKey(key) {
 function readSecret(root, key) {
   assertSecretKey(key);
   const file = secretsFilePath(root);
-  if (!existsSync7(file)) return void 0;
+  if (!existsSync8(file)) return void 0;
   const env = {};
   loadEnvInto(file, env);
   const value = env[key]?.trim();
@@ -1510,14 +2102,14 @@ function setSecret(root, key, value) {
     throw new Error(`${key} value must not contain a newline`);
   }
   const file = secretsFilePath(root);
-  assertInRoot(file, resolve5(root));
-  const original = existsSync7(file) ? readFileSync7(file, "utf8") : "";
+  assertInRoot(file, resolve7(root));
+  const original = existsSync8(file) ? readFileSync8(file, "utf8") : "";
   const { content } = setKeyInEnv(original, key, value);
   writeEnvFile(file, content);
 }
 function listSecretKeys(root) {
   const file = secretsFilePath(root);
-  if (!existsSync7(file)) return [];
+  if (!existsSync8(file)) return [];
   const env = {};
   loadEnvInto(file, env);
   return SECRET_KEYS.filter((key) => {
@@ -1827,12 +2419,12 @@ function requireRoot(io) {
 function legacyCloudConfigPath(env) {
   const home = env.HOME ?? env.USERPROFILE;
   if (!home) return void 0;
-  return join3(home, ".config", "openharness", "cloud.json");
+  return join4(home, ".config", "openharness", "cloud.json");
 }
 function readLegacyCloudConfig(path4) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync8(path4, "utf8"));
+    parsed = JSON.parse(readFileSync9(path4, "utf8"));
   } catch {
     return void 0;
   }
@@ -1845,7 +2437,7 @@ function readLegacyCloudConfig(path4) {
 }
 function migrateLegacyCloudConfig(root, io, env) {
   const path4 = legacyCloudConfigPath(env);
-  if (!path4 || !existsSync8(path4)) return;
+  if (!path4 || !existsSync9(path4)) return;
   const config = readOhConfig(ohConfigPath(root));
   if (config.cloud?.apiUrl !== void 0) return;
   if (readSecret(root, PROVISION_KEY_SECRET) !== void 0) return;
@@ -1863,7 +2455,7 @@ function migrateLegacyCloudConfig(root, io, env) {
 `);
   if (legacy.apiUrl) io.stdout(`  cloud.apiUrl -> ${ohConfigPath(root)}
 `);
-  if (legacy.provisionKey) io.stdout(`  ${PROVISION_KEY_SECRET} -> ${join3(root, ".env")}
+  if (legacy.provisionKey) io.stdout(`  ${PROVISION_KEY_SECRET} -> ${join4(root, ".env")}
 `);
   io.stdout(`${path4} is no longer read; delete it when you no longer need the copy.
 `);
@@ -1890,7 +2482,7 @@ async function configureCloud(args, io, env) {
     assertNoExtraArgs(args);
     io.stdout(`Config: ${ohConfigPath(root)}
 `);
-    io.stdout(`Secrets: ${join3(root, ".env")}
+    io.stdout(`Secrets: ${join4(root, ".env")}
 `);
     io.stdout(`API URL: ${current.apiUrl ?? DEFAULT_API_URL}
 `);
@@ -1912,7 +2504,7 @@ async function configureCloud(args, io, env) {
   setSecret(root, PROVISION_KEY_SECRET, provisionKey);
   io.stdout(`Saved cloud.apiUrl to ${ohConfigPath(root)}
 `);
-  io.stdout(`Saved ${PROVISION_KEY_SECRET} to ${join3(root, ".env")}
+  io.stdout(`Saved ${PROVISION_KEY_SECRET} to ${join4(root, ".env")}
 `);
   io.stdout("Provision credential: configured\n");
 }
@@ -1950,7 +2542,7 @@ async function executeCloud(argv, io) {
   const result = await dispatch(args, {
     request,
     readFile: io.readFile ?? readFile,
-    sleep: io.sleep ?? ((milliseconds) => new Promise((resolve9) => setTimeout(resolve9, milliseconds))),
+    sleep: io.sleep ?? ((milliseconds) => new Promise((resolve11) => setTimeout(resolve11, milliseconds))),
     write
   });
   if (result === void 0) return;
@@ -1979,8 +2571,8 @@ async function runCloud(argv, io) {
 
 // src/lib/execution/runner.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { basename as basename4, join as join5 } from "node:path";
 var spawnRunner = (cmd, args, opts) => {
   const common = {
     env: opts.env,
@@ -2018,32 +2610,33 @@ function assertSpawned(r, what) {
   }
 }
 function requireLifecycleScript(root, rel) {
-  const script = join4(root, ".oh", "scripts", rel);
-  if (!existsSync9(script)) {
+  const { controlDir } = resolveProjectLayout(root);
+  const script = join5(controlDir, "scripts", rel);
+  if (!existsSync10(script)) {
     throw new Error(
-      `missing lifecycle script ${script} \u2014 the vendored .oh/ payload looks incomplete; run \`oh update\` to re-vendor it`
+      `missing lifecycle script ${script} \u2014 the vendored ${basename4(controlDir)}/ payload looks incomplete; run \`oh update\` to re-vendor it`
     );
   }
   return script;
 }
 
 // src/lib/registry.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join5, resolve as resolve6, sep as sep2 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname6, join as join6, resolve as resolve8, sep as sep3 } from "node:path";
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.yml
-var docker_compose_default = 'name: ${SANDBOX_NAME:-openharness}\n\nservices:\n  sandbox:\n    image: ${OH_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-openharness}}\n    pull_policy: ${OH_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-openharness}\n    build:\n      context: ${OH_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${OH_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${OH_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-openharness}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "/home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.yml
+var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-${OH_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}}\n    pull_policy: ${AGRO_PULL_POLICY:-${OH_PULL_POLICY:-missing}}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-${OH_REPO_DIR:-..}}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-${OH_HOME_MOUNT:-workspace}}:/home/sandbox\n      - ${AGRO_REPO_DIR:-${OH_REPO_DIR:-..}}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "if [ -d /home/sandbox/harness/.agro ]; then exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh; fi; exec bash /home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.image-only.yml
-var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-openharness}\n\nservices:\n  sandbox:\n    image: ${OH_SANDBOX_IMAGE:-ghcr.io/mifunedev/openharness:latest}\n    pull_policy: ${OH_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-openharness}\n    volumes:\n      - ${OH_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-openharness}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "/home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.image-only.yml
+var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-${OH_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}}\n    pull_policy: ${AGRO_PULL_POLICY:-${OH_PULL_POLICY:-always}}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-${OH_HOME_MOUNT:-workspace}}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "if [ -d /home/sandbox/harness/.agro ]; then exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh; fi; exec bash /home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.ssh.yml
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.ssh.yml
 var docker_compose_ssh_default = 'services:\n  sandbox:\n    ports:\n      - "127.0.0.1:${SANDBOX_SSH_PORT:-2222}:22"\n';
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.docker-sock.yml
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.docker-sock.yml
 var docker_compose_docker_sock_default = "services:\n  sandbox:\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n";
 
-// oh-asset:/home/runner/work/openharness/openharness/.oh/scripts/docker-compose.sh
+// oh-asset:/home/runner/work/agro/agro/.agro/scripts/docker-compose.sh
 var docker_compose_default2 = `#!/usr/bin/env bash
 
 set -euo pipefail
@@ -2059,10 +2652,10 @@ Usage: scripts/docker-compose.sh [--repo-dir DIR] [--extra-env-file FILE]
                                  [--print-argv] <docker-compose-args...>
 
 Builds the harness docker compose argv from the repository dotenv and the
-composeOverrides[] list in oh.json, then executes \`docker compose ...\` with the
+composeOverrides[] list in agro.json, then executes \`docker compose ...\` with the
 provided args.
 --extra-env-file adds a lower-precedence --env-file ahead of the dotenv; \`oh\`
-renders the non-secret settings of oh.json into that file.
+renders the non-secret settings of agro.json into that file.
 --print-argv prints one argv entry per line instead of executing; useful for
 safe diagnostics and tests.
 EOF
@@ -2102,7 +2695,7 @@ done
 
 COMPAT="$SCRIPT_DIR/compat.sh"
 if [ ! -f "$COMPAT" ]; then
-  printf 'error: %s is missing \u2014 the vendored .oh/scripts payload is incomplete; run \`oh update\`\\n' "$COMPAT" >&2
+  printf 'error: %s is missing \u2014 the vendored .agro/scripts payload is incomplete; run \`oh update\`\\n' "$COMPAT" >&2
   exit 2
 fi
 # shellcheck source=compat.sh
@@ -2166,7 +2759,7 @@ fi
 
 CONFIG_JSON="$(compat_selected_path compat_config_file "$REPO_DIR")" || exit 2
 
-if [ -z "$EXTRA_ENV_FILE" ] && [ -n "$CONFIG_JSON" ]; then
+if [ -z "$EXTRA_ENV_FILE" ] && [ -f "$CONFIG_JSON" ]; then
   printf 'note: non-secret config comes from %s via \`oh\`; this direct run uses only %s and the compose-file defaults\\n' \\
     "\${CONFIG_JSON#"$REPO_DIR"/}" "\${ENV_FILE#"$REPO_DIR"/}" >&2
 fi
@@ -2199,7 +2792,7 @@ if truthy "$ssh_value"; then
     port_check="$SCRIPT_DIR/check-host-port.sh"
     if [ -x "$port_check" ] || [ -f "$port_check" ]; then
       sandbox_name=\${SANDBOX_NAME:-$(read_env_value SANDBOX_NAME)}
-      [ -n "$sandbox_name" ] || sandbox_name=openharness
+      sandbox_name="$(compat_sandbox_name "$sandbox_name")"
       own_port=0
       if command -v docker >/dev/null 2>&1; then
         docker ps --format '{{.Names}}\\t{{.Ports}}' 2>/dev/null \\
@@ -2219,7 +2812,7 @@ if truthy "$ssh_value"; then
   fi
 fi
 
-[ -n "$CONFIG_JSON" ] || CONFIG_JSON="$REPO_DIR/.oh/config.json"
+[ -f "$CONFIG_JSON" ] || CONFIG_JSON="$REPO_DIR/.agro/config.json"
 [ -f "$CONFIG_JSON" ] || CONFIG_JSON="$REPO_DIR/config.json"
 if command -v jq >/dev/null 2>&1 && [ -f "$CONFIG_JSON" ]; then
   while IFS= read -r override; do
@@ -2235,11 +2828,11 @@ fi
 exec docker compose "\${args[@]}" "$@"
 `;
 
-// oh-asset:/home/runner/work/openharness/openharness/.oh/scripts/compat.sh
+// oh-asset:/home/runner/work/agro/agro/.agro/scripts/compat.sh
 var compat_default = `#!/usr/bin/env bash
 # Boot-safe dual-generation resolution: bash + coreutils only, no node, no jq.
-# The TypeScript contract is .oh/cli/src/lib/compat.ts; both consume the same
-# vectors in .oh/cli/src/lib/__tests__/fixtures/compat-vectors.json.
+# The TypeScript contract is .agro/cli/src/lib/compat.ts; both consume the same
+# vectors in .agro/cli/src/lib/__tests__/fixtures/compat-vectors.json.
 
 COMPAT_LEGACY_CONTROL_DIR=".oh"
 COMPAT_AGRO_CONTROL_DIR=".agro"
@@ -2247,6 +2840,8 @@ COMPAT_LEGACY_CONFIG_FILE="oh.json"
 COMPAT_AGRO_CONFIG_FILE="agro.json"
 COMPAT_LEGACY_SEED_DIR="/opt/oh-seed"
 COMPAT_AGRO_SEED_DIR="/opt/agro-seed"
+COMPAT_DEFAULT_GENERATION=agro
+COMPAT_DEFAULT_SANDBOX_NAME=agro
 COMPAT_CONFLICT_STATUS=3
 
 compat_tree_manifest() {
@@ -2294,6 +2889,14 @@ compat_tree_diff() {
   return "$rc"
 }
 
+compat_sandbox_name() {
+  if [ -n "\${1:-}" ]; then
+    printf '%s\\n' "$1"
+  else
+    printf '%s\\n' "$COMPAT_DEFAULT_SANDBOX_NAME"
+  fi
+}
+
 compat_present() {
   case "$1" in
     dir) [ -d "$2" ] ;;
@@ -2308,7 +2911,11 @@ compat_resolve_pair() {
   compat_present "$entry_kind" "$legacy" || legacy_present=0
   compat_present "$entry_kind" "$agro" || agro_present=0
   if [ "$legacy_present" = 0 ] && [ "$agro_present" = 0 ]; then
-    printf 'absent\\t\\n'
+    if [ "$COMPAT_DEFAULT_GENERATION" = agro ]; then
+      printf 'absent\\t%s\\n' "$agro"
+    else
+      printf 'absent\\t%s\\n' "$legacy"
+    fi
     return 0
   fi
   if [ "$legacy_present" = 1 ] && [ "$agro_present" = 0 ]; then
@@ -2374,10 +2981,10 @@ compat_seed_src() {
     printf '%s\\n' "$configured"
     return 0
   fi
-  if [ -d "$prefix$COMPAT_AGRO_SEED_DIR" ] && [ ! -d "$prefix$COMPAT_LEGACY_SEED_DIR" ]; then
-    printf '%s\\n' "$prefix$COMPAT_AGRO_SEED_DIR"
-  else
+  if [ -d "$prefix$COMPAT_LEGACY_SEED_DIR" ]; then
     printf '%s\\n' "$prefix$COMPAT_LEGACY_SEED_DIR"
+  else
+    printf '%s\\n' "$prefix$COMPAT_AGRO_SEED_DIR"
   fi
 }
 
@@ -2385,12 +2992,11 @@ compat_marker_file() {
   local root="$1" line dir
   line="$(compat_control_dir "$root")" || return $?
   dir="\${line#*	}"
-  [ -n "$dir" ] || return 1
   printf '%s\\n' "$dir/.image-seeded"
 }
 `;
 
-// oh-asset:/home/runner/work/openharness/openharness/.oh/scripts/check-host-port.sh
+// oh-asset:/home/runner/work/agro/agro/.agro/scripts/check-host-port.sh
 var check_host_port_default = `#!/usr/bin/env bash
 
 set -eu
@@ -2476,12 +3082,12 @@ exit 0
 
 // src/lib/registry.ts
 var SANDBOX_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
-var DEFAULT_NAME_PREFIX = "oh-sbx-";
+var DEFAULT_NAME_PREFIX = "agro-sbx-";
 function ohHome() {
   return resolveUserStateHome(process.env);
 }
 function registryRoot() {
-  return join5(ohHome(), "sandboxes");
+  return join6(ohHome(), "sandboxes");
 }
 function assertSandboxName(name) {
   if (!SANDBOX_NAME_PATTERN.test(name)) {
@@ -2492,20 +3098,20 @@ function assertSandboxName(name) {
 }
 function entryRoot(name) {
   assertSandboxName(name);
-  return join5(registryRoot(), name);
+  return join6(registryRoot(), name);
 }
 function isDirectory(path4) {
-  return statSync4(path4, { throwIfNoEntry: false })?.isDirectory() === true;
+  return statSync3(path4, { throwIfNoEntry: false })?.isDirectory() === true;
 }
 function listEntries() {
   const root = registryRoot();
   if (!isDirectory(root)) return [];
-  return readdirSync3(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => SANDBOX_NAME_PATTERN.test(name)).filter((name) => existsSync10(ohConfigPath(join5(root, name)))).sort();
+  return readdirSync3(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => SANDBOX_NAME_PATTERN.test(name)).filter((name) => existsSync11(ohConfigPath(join6(root, name)))).sort();
 }
 function entryRepo(name) {
   const config = readOhConfig(ohConfigPath(entryRoot(name)));
   const repo = config.repo;
-  return typeof repo === "string" && repo !== "" ? resolve6(repo) : void 0;
+  return typeof repo === "string" && repo !== "" ? resolve8(repo) : void 0;
 }
 function runningContainerNames(run) {
   const names = /* @__PURE__ */ new Set();
@@ -2531,26 +3137,27 @@ function nextDefaultName(run = spawnRunner) {
   }
 }
 function materialize(root, opts = {}) {
-  const entry = resolve6(root);
+  const entry = resolve8(root);
+  const scripts = join6(resolveProjectLayout(entry).controlDir, "scripts");
   const files = [
     {
-      rel: ".devcontainer/docker-compose.yml",
+      dest: join6(entry, ".devcontainer", "docker-compose.yml"),
       body: opts.repo === void 0 ? docker_compose_image_only_default : docker_compose_default,
       mode: 420
     },
-    { rel: ".devcontainer/docker-compose.ssh.yml", body: docker_compose_ssh_default, mode: 420 },
-    { rel: ".devcontainer/docker-compose.docker-sock.yml", body: docker_compose_docker_sock_default, mode: 420 },
-    { rel: ".oh/scripts/docker-compose.sh", body: docker_compose_default2, mode: 493 },
-    { rel: ".oh/scripts/compat.sh", body: compat_default, mode: 420 },
-    { rel: ".oh/scripts/check-host-port.sh", body: check_host_port_default, mode: 493 }
+    { dest: join6(entry, ".devcontainer", "docker-compose.ssh.yml"), body: docker_compose_ssh_default, mode: 420 },
+    { dest: join6(entry, ".devcontainer", "docker-compose.docker-sock.yml"), body: docker_compose_docker_sock_default, mode: 420 },
+    { dest: join6(scripts, "docker-compose.sh"), body: docker_compose_default2, mode: 493 },
+    { dest: join6(scripts, "compat.sh"), body: compat_default, mode: 420 },
+    { dest: join6(scripts, "check-host-port.sh"), body: check_host_port_default, mode: 493 }
   ];
   for (const file of files) {
-    const dest = resolve6(entry, file.rel);
-    if (!dest.startsWith(entry + sep2)) {
+    const dest = resolve8(file.dest);
+    if (!dest.startsWith(entry + sep3)) {
       throw new Error(`refusing to materialize outside the sandbox entry: ${dest}`);
     }
-    mkdirSync3(dirname4(dest), { recursive: true });
-    writeFileSync4(dest, file.body, { mode: file.mode, encoding: "utf8" });
+    mkdirSync4(dirname6(dest), { recursive: true });
+    writeFileSync5(dest, file.body, { mode: file.mode, encoding: "utf8" });
   }
 }
 function resolveSandboxRoot(opts = {}) {
@@ -2565,10 +3172,10 @@ function resolveSandboxRoot(opts = {}) {
   }
   const names = listEntries();
   if (names.length === 1) return entryRoot(names[0]);
-  const cwd = resolve6(opts.cwd ?? process.cwd());
+  const cwd = resolve8(opts.cwd ?? process.cwd());
   for (const name of names) {
     const repo = entryRepo(name);
-    if (repo !== void 0 && (cwd === repo || cwd.startsWith(repo + sep2))) {
+    if (repo !== void 0 && (cwd === repo || cwd.startsWith(repo + sep3))) {
       return entryRoot(name);
     }
   }
@@ -2814,15 +3421,15 @@ function sameRemote(url, owner, name) {
 }
 
 // src/commands/secret.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join8 } from "node:path";
 
 // src/lib/gitignore.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname5, join as join6 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join7 } from "node:path";
 function appendGitignoreLines(root, lines) {
-  const target = join6(root, ".gitignore");
-  const existing = existsSync11(target) ? readFileSync9(target, "utf8") : "";
+  const target = join7(root, ".gitignore");
+  const existing = existsSync12(target) ? readFileSync10(target, "utf8") : "";
   const present = new Set(existing.split("\n").map((line) => line.trimEnd()));
   const added = [];
   for (const line of lines) {
@@ -2836,8 +3443,8 @@ function appendGitignoreLines(root, lines) {
   if (output.length > 0 && !output.endsWith("\n")) output += "\n";
   output += `${added.join("\n")}
 `;
-  mkdirSync4(dirname5(target), { recursive: true });
-  writeFileSync5(target, output, "utf8");
+  mkdirSync5(dirname7(target), { recursive: true });
+  writeFileSync6(target, output, "utf8");
   return added;
 }
 
@@ -2846,7 +3453,7 @@ function secretsRoot(opts) {
   return opts.sandbox === void 0 ? resolveProjectRoot(opts.cwd) : resolveSandboxRoot({ name: opts.sandbox });
 }
 function ignoreSecretsFile(root) {
-  if (!existsSync12(join7(root, ".git"))) return;
+  if (!existsSync13(join8(root, ".git"))) return;
   appendGitignoreLines(root, [".env"]);
 }
 function secretKeyList() {
@@ -2901,14 +3508,14 @@ async function runSecretList(opts, io) {
 }
 
 // src/commands/lifecycle.ts
-import { existsSync as existsSync14, mkdtempSync, readFileSync as readFileSync10, rmSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync15, mkdtempSync, readFileSync as readFileSync11, rmSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename4, join as join8, sep as sep3 } from "node:path";
+import { basename as basename5, join as join9, sep as sep4 } from "node:path";
 
 // src/lib/execution/detect.ts
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 var SANDBOX_MARKER_FILE = "/.dockerenv";
-function runningInsideSandbox(env = process.env, fileExists = existsSync13) {
+function runningInsideSandbox(env = process.env, fileExists = existsSync14) {
   const override = resolveAliasedEnv(env, "EXECUTION_TARGET").value;
   if (override === "local") return true;
   if (override === "docker-compose") return false;
@@ -3151,6 +3758,7 @@ var RETIRED_KEYS = [
   "PROJECTS_DIR",
   "CRONS_DIR",
   "OH_PROJECT_ROOT",
+  "AGRO_PROJECT_ROOT",
   "INSTALL_DEEPAGENTS",
   "INSTALL_OPENCODE",
   "INSTALL_GROK_BUILD",
@@ -3174,24 +3782,24 @@ function renderComposeVars(config) {
   };
   put("SANDBOX_NAME", config.name);
   put("TZ", config.timezone);
-  put("OH_HOME_MOUNT", config.storage?.homePath);
-  put("OH_REPO_DIR", config.repo);
+  put("AGRO_HOME_MOUNT", config.storage?.homePath);
+  put("AGRO_REPO_DIR", config.repo);
   put("GIT_USER_NAME", config.git?.userName);
   put("GIT_USER_EMAIL", config.git?.userEmail);
   put("DOCKER_SOCKET", config.access?.dockerSocket);
   put("SANDBOX_SSH", config.access?.ssh);
   put("SANDBOX_SSH_PORT", config.access?.sshPort);
-  put("OH_SANDBOX_IMAGE", config.image?.ref);
-  put("OH_PULL_POLICY", config.image?.pullPolicy);
+  put("AGRO_SANDBOX_IMAGE", config.image?.ref);
+  put("AGRO_PULL_POLICY", config.image?.pullPolicy);
   for (const { key, value } of out) {
     if (isSecretKey(key)) {
-      throw new Error(`refusing to render secret ${key} from oh.json`);
+      throw new Error(`refusing to render secret ${key} from the sandbox config`);
     }
     if (RETIRED_KEYS.includes(key)) {
       throw new Error(`refusing to render retired variable ${key}`);
     }
     if (/[\r\n]/.test(value)) {
-      throw new Error(`oh.json value for ${key} must not contain a newline`);
+      throw new Error(`config value for ${key} must not contain a newline`);
     }
   }
   return out;
@@ -3205,18 +3813,18 @@ function renderComposeEnv(config) {
 // src/commands/lifecycle.ts
 var COMPOSE_ENV_DIR_PREFIX = "oh-compose-env-";
 function composeEnvDir() {
-  return mkdtempSync(join8(tmpdir(), COMPOSE_ENV_DIR_PREFIX));
+  return mkdtempSync(join9(tmpdir(), COMPOSE_ENV_DIR_PREFIX));
 }
 function writeComposeEnv(root, dir) {
-  const file = join8(dir, "compose.env");
-  writeFileSync6(file, renderComposeEnv(readOhConfig(ohConfigPath(root))), {
+  const file = join9(dir, "compose.env");
+  writeFileSync7(file, renderComposeEnv(readOhConfig(ohConfigPath(root))), {
     mode: 384,
     encoding: "utf8"
   });
   return file;
 }
 function withComposeEnvFile(root, fn) {
-  if (!existsSync14(ohConfigPath(root))) return fn([]);
+  if (!existsSync15(ohConfigPath(root))) return fn([]);
   const dir = composeEnvDir();
   try {
     return fn(["--extra-env-file", writeComposeEnv(root, dir)]);
@@ -3225,7 +3833,7 @@ function withComposeEnvFile(root, fn) {
   }
 }
 async function withComposeEnvFileAsync(root, fn) {
-  if (!existsSync14(ohConfigPath(root))) return await fn([]);
+  if (!existsSync15(ohConfigPath(root))) return await fn([]);
   const dir = composeEnvDir();
   try {
     return await fn(["--extra-env-file", writeComposeEnv(root, dir)]);
@@ -3235,17 +3843,17 @@ async function withComposeEnvFileAsync(root, fn) {
 }
 function sandboxRoot(opts) {
   const root = resolveSandboxRoot({ name: opts.name, cwd: opts.cwd });
-  if (existsSync14(ohConfigPath(root))) {
+  if (existsSync15(ohConfigPath(root))) {
     const repo = configuredString(root, "repo");
     materialize(root, repo === void 0 ? {} : { repo });
   }
   return root;
 }
-var DEFAULT_CONTAINER_NAME = "openharness";
-var DEFAULT_SANDBOX_IMAGE = "ghcr.io/mifunedev/openharness:latest";
+var DEFAULT_CONTAINER_NAME = DEFAULT_SANDBOX_NAME;
+var DEFAULT_SANDBOX_IMAGE = "ghcr.io/mifunedev/agro:latest";
 function configuredField(root, path4) {
   const file = ohConfigPath(root);
-  if (!existsSync14(file)) return void 0;
+  if (!existsSync15(file)) return void 0;
   try {
     return getOhConfigValue(readOhConfig(file), path4);
   } catch {
@@ -3267,8 +3875,8 @@ async function maybePromptDockerSocket(root, io) {
   if (dockerSocketConfigured(root)) return;
   const interactive = process.stdin.isTTY === true || io.ask !== void 0;
   if (!interactive) return;
-  const envDir = join8(root, ".devcontainer");
-  if (!existsSync14(envDir)) return;
+  const envDir = join9(root, ".devcontainer");
+  if (!existsSync15(envDir)) return;
   const askFn = io.ask ?? ask;
   const answer = (await askFn(
     "Mount host Docker socket into the sandbox? (effectively host root \u2014 enable only if the agent must drive Docker) [y/N]"
@@ -3288,7 +3896,7 @@ async function runSandbox(opts, io) {
   const useImage = opts.image === true || opts.imageRef !== void 0;
   const useNoBuild = useImage || opts.noBuild === true;
   const imageRef = useImage ? opts.imageRef ?? configuredImage(root) ?? DEFAULT_SANDBOX_IMAGE : void 0;
-  const env = imageRef === void 0 ? void 0 : { ...process.env, OH_SANDBOX_IMAGE: imageRef };
+  const env = imageRef === void 0 ? void 0 : { ...process.env, ...aliasedEnvPair("SANDBOX_IMAGE", imageRef) };
   if (opts.printArgv === true) {
     const script = requireLifecycleScript(root, "docker-compose.sh");
     return withComposeEnvFile(root, (extraArgs) => {
@@ -3405,7 +4013,7 @@ function runComposeConfig(opts, extra = []) {
 function namedVolumes(root) {
   let text;
   try {
-    text = readFileSync10(join8(root, ".devcontainer", "docker-compose.yml"), "utf8");
+    text = readFileSync11(join9(root, ".devcontainer", "docker-compose.yml"), "utf8");
   } catch {
     return [];
   }
@@ -3470,8 +4078,8 @@ stay there. Delete that directory yourself if you also want them gone.
       return 1;
     }
   }
-  const code = runComposeVerb("destroy", { ...opts, name: basename4(root) });
-  if (code === 0 && root.startsWith(registryRoot() + sep3)) {
+  const code = runComposeVerb("destroy", { ...opts, name: basename5(root) });
+  if (code === 0 && root.startsWith(registryRoot() + sep4)) {
     rmSync(root, { recursive: true, force: true });
     io.stdout(`removed the sandbox entry ${root}
 `);
@@ -3484,16 +4092,16 @@ function runGateway(args, opts) {
   const script = requireLifecycleScript(root, "gateway.sh");
   const r = run("bash", [script, ...args], {
     stdio: "inherit",
-    env: { ...process.env, OH_PROJECT_ROOT: root }
+    env: { ...process.env, ...aliasedEnvPair("PROJECT_ROOT", root) }
   });
   assertSpawned(r, `bash ${script}`);
   return r.status ?? 1;
 }
 
 // src/commands/sandbox.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join9, resolve as resolve7 } from "node:path";
+import { join as join10, resolve as resolve9 } from "node:path";
 
 // src/lib/runtimes/catalog.ts
 var RUNTIME_CATALOG = Object.freeze([
@@ -3540,23 +4148,53 @@ function gitIdentity(run, key) {
 function readSeedConfig(repo) {
   if (repo === void 0) return void 0;
   const file = ohConfigPath(repo);
-  return existsSync15(file) ? readOhConfig(file) : void 0;
+  return existsSync16(file) ? readOhConfig(file) : void 0;
+}
+function readEntryConfig(name) {
+  const file = ohConfigPath(entryRoot(name));
+  return existsSync16(file) ? readOhConfig(file) : void 0;
+}
+function assignSetting(target, path4, value) {
+  const segments = path4.split(".");
+  let cursor = target;
+  for (const segment of segments.slice(0, -1)) {
+    const section = cursor[segment];
+    if (!section || typeof section !== "object" || Array.isArray(section)) cursor[segment] = {};
+    cursor = cursor[segment];
+  }
+  cursor[segments[segments.length - 1]] = value;
+}
+function overlaySettings(target, source) {
+  if (source === void 0) return target;
+  for (const field of OH_CONFIG_FIELDS) {
+    const value = getOhConfigValue(source, field.path);
+    if (value !== void 0) assignSetting(target, field.path, value);
+  }
+  return target;
+}
+function mergeSettings(...sources) {
+  const present = sources.filter((source) => source !== void 0);
+  if (present.length === 0) return void 0;
+  const merged = { version: 1 };
+  for (const source of present) overlaySettings(merged, source);
+  return merged;
+}
+function nonEmpty(value) {
+  return value === void 0 || value === "" ? void 0 : value;
 }
 function seedConfig(name, repo, seed, run) {
-  const config = defaultOhConfig(name);
+  const config = overlaySettings(defaultOhConfig(name), seed);
+  config.name = name;
   config.runtime = "docker";
   if (repo !== void 0) config.repo = repo;
-  config.timezone = seed?.timezone ?? hostTimezone();
+  config.timezone = nonEmpty(seed?.timezone) ?? hostTimezone();
   config.git = {
-    userName: seed?.git?.userName ?? gitIdentity(run, "user.name"),
-    userEmail: seed?.git?.userEmail ?? gitIdentity(run, "user.email")
+    userName: nonEmpty(seed?.git?.userName) ?? gitIdentity(run, "user.name"),
+    userEmail: nonEmpty(seed?.git?.userEmail) ?? gitIdentity(run, "user.email")
   };
-  if (seed?.storage?.homePath !== void 0) config.storage = { homePath: seed.storage.homePath };
-  config.access = { ...config.access, ...seed?.access ?? {} };
   config.image = {
     ...config.image,
-    ...seed?.image ?? {},
-    mode: seed?.image?.mode ?? (repo === void 0 ? "image" : "build")
+    mode: seed?.image?.mode ?? (config.repo === void 0 ? "image" : "build")
   };
   return config;
 }
@@ -3612,14 +4250,14 @@ async function runSandboxInstall(opts, io) {
 `);
     return 1;
   }
-  const repo = opts.repo === void 0 ? void 0 : resolve7(opts.repo);
-  if (repo !== void 0 && !existsSync15(repo)) {
+  const repo = opts.repo === void 0 ? void 0 : resolve9(opts.repo);
+  if (repo !== void 0 && !existsSync16(repo)) {
     io.stderr(`oh sandbox install: --repo directory does not exist: ${repo}
 `);
     return 1;
   }
-  const seed = readSeedConfig(repo);
-  const name = opts.name ?? seed?.name ?? nextDefaultName(run);
+  const repoSeed = readSeedConfig(repo);
+  const name = opts.name ?? repoSeed?.name ?? nextDefaultName(run);
   try {
     assertSandboxName(name);
   } catch (error) {
@@ -3627,7 +4265,7 @@ async function runSandboxInstall(opts, io) {
 `);
     return 1;
   }
-  const config = seedConfig(name, repo, seed, run);
+  const config = seedConfig(name, repo, mergeSettings(readEntryConfig(name), repoSeed), run);
   const interactive = opts.yes !== true && (process.stdin.isTTY === true || io.ask !== void 0);
   if (interactive) {
     header("Configure the sandbox  (press Enter to accept the shown default)");
@@ -3644,7 +4282,7 @@ async function runSandboxInstall(opts, io) {
     ...useNoBuild ? { noBuild: true } : {}
   };
   if (opts.printArgv === true) {
-    const preview = mkdtempSync2(join9(tmpdir2(), "oh-sandbox-preview-"));
+    const preview = mkdtempSync2(join10(tmpdir2(), "oh-sandbox-preview-"));
     try {
       writeOhConfig(preview, config);
       materialize(preview, { ...config.repo !== void 0 ? { repo: config.repo } : {} });
@@ -3654,7 +4292,7 @@ async function runSandboxInstall(opts, io) {
     }
   }
   const root = entryRoot(config.name);
-  mkdirSync5(root, { recursive: true });
+  mkdirSync6(root, { recursive: true });
   writeOhConfig(root, config);
   materialize(root, { ...config.repo !== void 0 ? { repo: config.repo } : {} });
   const code = await runSandbox({ ...sandboxOpts, cwd: root }, io);
@@ -3709,7 +4347,7 @@ async function runSandboxList(opts, io) {
 }
 
 // src/lib/docs.ts
-var SOURCE_DOCS_BASE = "https://github.com/mifunedev/openharness/blob/main/";
+var SOURCE_DOCS_BASE = "https://github.com/mifunedev/agro/blob/main/";
 function sourceDocsUrl(docsPath) {
   const segments = docsPath.split("/");
   if (segments[0] !== "docs" || segments.length < 2 || segments.some((segment) => segment === "" || segment === "." || segment === "..") || docsPath.includes("\\") || docsPath.includes("?") || docsPath.includes("#")) {
@@ -3961,8 +4599,8 @@ function hermesTargetRoot(target) {
 async function reconcileHermes(target, io) {
   const root = hermesTargetRoot(target);
   const result = await target.exec({
-    argv: ["bash", `${root}/.oh/scripts/link-providers.sh`, "--init", "--hermes-only"],
-    env: { OH_PROJECT_ROOT: root },
+    argv: remoteControlDirScript(root, "scripts/link-providers.sh", ["--init", "--hermes-only"]),
+    env: aliasedEnvPair("PROJECT_ROOT", root),
     user: "sandbox",
     stdio: "inherit"
   });
@@ -4002,7 +4640,7 @@ Start it with \`oh sandbox\`, then re-run this command.
   }
   const hermes = entry.id === "hermes";
   const installEnv = hermes ? {
-    OH_PROJECT_ROOT: hermesTargetRoot(target),
+    ...aliasedEnvPair("PROJECT_ROOT", hermesTargetRoot(target)),
     HERMES_HOME: `${hermesTargetRoot(target)}/.hermes`
   } : void 0;
   if (hermes) {
@@ -4419,7 +5057,7 @@ Start it with \`oh sandbox\`, then re-run this command.
 
 // src/lib/remote.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-var DEFAULT_REPO_URL = "https://github.com/mifunedev/openharness";
+var DEFAULT_REPO_URL = "https://github.com/mifunedev/agro";
 var DEFAULT_CLONE_TIMEOUT_MS = 12e4;
 var spawnRunner2 = (cmd, args, opts) => {
   const r = spawnSync3(cmd, args, {
@@ -4436,7 +5074,7 @@ var spawnRunner2 = (cmd, args, opts) => {
   };
 };
 function fallbackHint() {
-  return "use --from <dir> to point at a local OpenHarness checkout instead";
+  return "use --from <dir> to point at a local AGRO checkout instead";
 }
 function fetchRemoteSource(opts) {
   const repoUrl2 = opts.repoUrl ?? DEFAULT_REPO_URL;
@@ -4481,9 +5119,9 @@ function fetchRemoteSource(opts) {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.9.0" : "0.0.0-dev";
-var DEFAULT_SOURCE_OH_DIR = resolve8(
-  dirname6(fileURLToPath(import.meta.url)),
+var VERSION = true ? "0.10.0" : "0.0.0-dev";
+var DEFAULT_SOURCE_OH_DIR = resolve10(
+  dirname8(fileURLToPath(import.meta.url)),
   "../.."
 );
 var INTEGRATIONS = {};
@@ -4506,14 +5144,16 @@ function compatibilityNote(product) {
 }
 function printOhHelp(product = LEGACY_PRODUCT) {
   const { bin, title } = product;
+  const updateSummary = bin === AGRO_PRODUCT.bin ? `Upgrade the installed ${bin} CLI` : `Vendor or upgrade the ${stateNames(bin).controlDir}/ control plane`;
   process.stdout.write(`${bin} \u2014 ${title} (v${VERSION})
 
 Usage:
   ${bin} sandbox <args...>      Create and list sandboxes (install|list)
   ${bin} shell [name]           Open a zsh shell in the running sandbox container
-  ${bin} config <args...>       Read and write oh.json (show|set), or run a wizard
+  ${bin} config <args...>       Read and write ${stateNames(bin).configFile} (show|set), or run a wizard
   ${bin} secret <args...>       Read and write the gitignored root .env (set|list)
-  ${bin} update                 Vendor or upgrade the .oh/ control plane
+  ${bin} update                 ${updateSummary}
+  ${bin} migrate                Move a legacy .oh/ project or ~/.oh registry to AGRO names (--check|--home)
   ${bin} stop [name]            Stop the sandbox, preserving volumes
   ${bin} restart [name]         Restart the sandbox service
   ${bin} logs [name]            Tail sandbox logs (follows)
@@ -4532,7 +5172,7 @@ ${integrationLines()}
 ${compatibilityNote(product)}`);
 }
 function printConfigHelp(bin = LEGACY_PRODUCT.bin) {
-  process.stdout.write(`${bin} config \u2014 Read and write oh.json, the tracked non-secret settings
+  process.stdout.write(`${bin} config \u2014 Read and write ${stateNames(bin).configFile}, the tracked non-secret settings
 
 Usage:
   ${bin} config show [--sandbox <name>]
@@ -4541,7 +5181,7 @@ Usage:
   ${bin} config <integration>         Run an integration wizard
   ${bin} config <integration> --help
 
-oh.json holds every non-secret setting and is tracked by git. Credentials live
+${stateNames(bin).configFile} holds every non-secret setting and is tracked by git. Credentials live
 in the gitignored root .env \u2014 write those with \`${bin} secret set <KEY>\`. Apply a
 change with \`${bin} stop <name> && ${bin} sandbox install docker --name <name>\`. Field
 reference:
@@ -4566,7 +5206,7 @@ the registry entry \`${bin} sandbox list\` names.
 
 The value is never read from the command line \u2014 an argument would land in your
 shell history. \`${bin} secret list\` never prints a raw value. .env is mode 0600 and
-gitignored; every non-secret setting belongs in oh.json (\`${bin} config set\`).
+gitignored; every non-secret setting belongs in ${stateNames(bin).configFile} (\`${bin} config set\`).
 
 Keys:
 ${secretKeyList()}
@@ -4579,7 +5219,7 @@ Usage:
   ${bin} update [--dry-run]
 
 Upgrades exactly one thing: the ${bin} executable that is running. It writes no
-project file \u2014 no .oh/, no oh.json, no .env \u2014 and it never asks for sudo.
+project file \u2014 no ${stateNames(bin).controlDir}/, no ${stateNames(bin).configFile}, no .env \u2014 and it never asks for sudo.
 
 The upgrade follows whichever mechanism installed this executable:
   npm-managed    realpath under node_modules/${AGRO_PRODUCT.packageName}/: reads the registry
@@ -4603,7 +5243,7 @@ Flags:
   --dry-run       Report the installation kind, target, and versions without
                   changing anything.
 
-Project payload vendoring (.oh/ + crons/) is \`oh update\` during the
+Project payload vendoring (${stateNames(bin).controlDir}/ + crons/) is \`oh update\` during the
 compatibility window; its --from, --from-remote, --ref and --force flags are
 not accepted here.
 `);
@@ -4613,22 +5253,22 @@ function printUpdateHelp(bin = LEGACY_PRODUCT.bin) {
     printSelfUpgradeHelp(bin);
     return;
   }
-  process.stdout.write(`${bin} update \u2014 Vendor or upgrade the .oh/ control plane
+  process.stdout.write(`${bin} update \u2014 Vendor or upgrade the ${stateNames(bin).controlDir}/ control plane
 
 Usage:
   ${bin} update [--from <dir> | --from-remote [--ref <ref>]] [--dry-run] [--force]
 
-Writes ONLY the .oh/ control plane and crons/ (skills, scripts, CLI) into the
+Writes ONLY the ${stateNames(bin).controlDir}/ control plane and crons/ (skills, scripts, CLI) into the
 current directory. An empty directory is equipped from scratch; everything else
-in your project is left untouched \u2014 it writes no oh.json, .env, AGENTS.md,
+in your project is left untouched \u2014 it writes no ${stateNames(bin).configFile}, .env, AGENTS.md,
 .gitignore or .devcontainer/.
 
 Payload source precedence: --from <dir> > --from-remote > the CLI's own bundled
-.oh/ payload > a remote fetch announced on one line.
+${stateNames(bin).controlDir}/ payload > a remote fetch announced on one line.
 
 Flags:
-  --from <dir>    A built OpenHarness checkout to vendor from.
-  --from-remote   Fetch the source checkout from the public OpenHarness repo
+  --from <dir>    A built AGRO checkout to vendor from.
+  --from-remote   Fetch the source checkout from the public AGRO repo
                   instead (shallow git clone into a temp dir, removed after
                   the run). Conflicts with --from.
   --ref <ref>     Branch or tag for --from-remote (default: the clone's
@@ -4651,7 +5291,7 @@ Usage:
                                [--image[=<ref>]] [--no-build] [--print-argv]
   ${bin} sandbox list [--json]
 
-\`install\` writes a sandbox entry under \${OH_HOME:-~/.oh}/sandboxes/<name>/,
+\`install\` writes a sandbox entry under \${${stateNames(bin).envPrefix}HOME:-~/${stateNames(bin).userStateDir}}/sandboxes/<name>/,
 materialises the compose files and the compose wrapper into it, then starts the
 container. It needs no project checkout and runs from any directory. Without
 --repo the sandbox runs the prebuilt image; with --repo <dir> that checkout is
@@ -4659,16 +5299,16 @@ bound at /home/sandbox/harness and can be built locally.
 
 On a terminal without --yes it asks for the sandbox name, the timezone, the git
 identity, SSH (with its host port), and the host Docker socket. With --repo it
-seeds those answers from that checkout's oh.json.
+seeds those answers from that checkout's ${stateNames(bin).configFile}.
 
 Flags:
-  --name <name>    Registry entry name (default: the lowest free oh-sbx-<n>)
+  --name <name>    Registry entry name (default: the lowest free ${DEFAULT_NAME_PREFIX}<n>)
   --repo <dir>     Bind this checkout into the sandbox and seed the defaults
-                   from its oh.json
+                   from its ${stateNames(bin).configFile}
   --yes            Non-interactive: keep every default and ask nothing
   --image[=<ref>]  Run the prebuilt image instead of building (implies
                    --no-build). Ref resolves last-wins: --image=<ref> >
-                   oh.json image.ref > ghcr.io/mifunedev/openharness:latest.
+                   ${stateNames(bin).configFile} image.ref > ${DEFAULT_SANDBOX_IMAGE}.
   --no-build       Suppress the local build and reuse an existing image
   --print-argv     Print the docker compose argv that would run, then exit
                    without writing an entry
@@ -4702,7 +5342,7 @@ Usage:
   ${bin} harness status [name]            Show installed state
 
 \`install\` is the only door: it probes the running sandbox, installs the harness
-into the persistent home volume, and reports. It reads and writes no \`oh.json\`
+into the persistent home volume, and reports. It reads and writes no \`${stateNames(bin).configFile}\`
 field, and it never rebuilds or restarts the sandbox. It requires a running
 sandbox \u2014 start one with \`${bin} sandbox\` first.
 
@@ -4723,7 +5363,7 @@ Usage:
   ${bin} gateway status                   show both sessions
 
 Only a LEADING --help/-h is intercepted here; everything else passes through
-verbatim to the vendored .oh/scripts/gateway.sh with OH_PROJECT_ROOT set to
+verbatim to the vendored ${stateNames(bin).controlDir}/scripts/gateway.sh with ${stateNames(bin).envPrefix}PROJECT_ROOT set to
 the equipped project root. Exits with the script's exit code.
 `);
 }
@@ -4751,7 +5391,7 @@ Most tools are baked into the image and are report-only; \`install\` works on:
 ${installableToolIds().map((t) => `  ${t}`).join("\n")}
 
 \`install\` is the only door: it probes the running sandbox, installs the tool
-into the persistent home volume, and reports. It reads and writes no \`oh.json\`
+into the persistent home volume, and reports. It reads and writes no \`${stateNames(bin).configFile}\`
 field, and it never rebuilds or restarts the sandbox. A large download is
 confirmed first, and a non-interactive run without --yes installs nothing.
 
@@ -4776,7 +5416,7 @@ function printComposeVerbHelp(verb, bin = LEGACY_PRODUCT.bin) {
 Usage:
   ${bin} ${verb} [name] [-- <extra docker compose args>]
 
-Runs .oh/scripts/docker-compose.sh inside the sandbox entry, the single
+Runs ${stateNames(bin).controlDir}/scripts/docker-compose.sh inside the sandbox entry, the single
 implementation. \`${bin}\` is the only lifecycle door. [name] is a sandbox entry from
 \`${bin} sandbox list\`; with exactly one registered sandbox it can be omitted.
 
@@ -4789,7 +5429,7 @@ function printDestroyHelp(bin = LEGACY_PRODUCT.bin) {
 Usage:
   ${bin} destroy [name] [--yes]
 
-Runs .oh/scripts/docker-compose.sh with \`down -v\`. This is the one destructive
+Runs ${stateNames(bin).controlDir}/scripts/docker-compose.sh with \`down -v\`. This is the one destructive
 lifecycle verb: \`-v\` deletes the named
 volumes, and those volumes hold every agent CLI login, the gh CLI token, and
 the SSH keys. Use \`${bin} stop\` when you only want the containers gone.
@@ -4812,11 +5452,11 @@ Usage:
   ${bin} compose config [-- <extra docker compose args>]
 
 Subcommands:
-  config   Print the compose configuration .oh/scripts/docker-compose.sh
-           resolves from .devcontainer/.env and .oh/config.json
+  config   Print the compose configuration ${stateNames(bin).controlDir}/scripts/docker-compose.sh
+           resolves from .devcontainer/.env and ${stateNames(bin).controlDir}/config.json
 
 Namespaced under \`${bin} compose\` because \`${bin} config <integration>\` already means
-"run an integration wizard", and \`${bin} config show/set\` reads and writes oh.json.
+"run an integration wizard", and \`${bin} config show/set\` reads and writes ${stateNames(bin).configFile}.
 
 See ${sourceDocsUrl("docs/lifecycle-commands.md")} for every verb.
 `);
@@ -4962,14 +5602,14 @@ function parseComposeArgs(rest, bin = LEGACY_PRODUCT.bin) {
   args.subcommand = "config";
   const tail = rest.slice(1);
   if (isHelpFlag(tail[0])) return { ok: true, args: { ...args, help: true } };
-  const sep4 = tail.indexOf("--");
-  if (sep4 === -1 && tail.length > 0) {
+  const sep5 = tail.indexOf("--");
+  if (sep5 === -1 && tail.length > 0) {
     return {
       ok: false,
       error: `${bin} compose config: unexpected argument "${tail[0]}" \u2014 pass extra docker compose args after \`--\``
     };
   }
-  if (sep4 !== -1) args.passthrough = tail.slice(sep4 + 1);
+  if (sep5 !== -1) args.passthrough = tail.slice(sep5 + 1);
   return { ok: true, args };
 }
 var PAYLOAD_UPDATE_FLAGS = ["--from", "--from-remote", "--ref", "--force"];
@@ -5203,19 +5843,19 @@ function parseGatewayArgs(rest) {
   }
   return { ok: true, args: { help: false, passthrough: [...rest] } };
 }
-function bundledPayloadExists(bundled, exists = existsSync16) {
-  return exists(join10(bundled.sourceOhDir, "manifest.json"));
+function bundledPayloadExists(bundled, exists = existsSync17) {
+  return exists(join11(bundled.sourceOhDir, "manifest.json"));
 }
 function resolveUpdateSource(args, bundled, bin = LEGACY_PRODUCT.bin) {
-  const exists = bundled.exists ?? existsSync16;
+  const exists = bundled.exists ?? existsSync17;
   if (args.fromDir !== void 0) {
-    return { kind: "local", fromDir: resolve8(args.fromDir) };
+    return { kind: "local", fromDir: resolve10(args.fromDir) };
   }
   if (args.fromRemote) {
     return { kind: "remote", ref: args.ref };
   }
   if (bundledPayloadExists(bundled, exists)) {
-    return { kind: "local", fromDir: resolve8(bundled.sourceOhDir, "..") };
+    return { kind: "local", fromDir: resolve10(bundled.sourceOhDir, "..") };
   }
   return {
     kind: "remote",
@@ -5227,7 +5867,7 @@ function resolveUpdateSource(args, bundled, bin = LEGACY_PRODUCT.bin) {
 function readPayloadVersion(checkoutDir) {
   try {
     const parsed = JSON.parse(
-      readFileSync11(join10(checkoutDir, ".oh", "cli", "package.json"), "utf8")
+      readFileSync12(join11(resolveControlDir(checkoutDir).path, "cli", "package.json"), "utf8")
     );
     if (parsed && typeof parsed.version === "string") return parsed.version;
   } catch {
@@ -5236,7 +5876,7 @@ function readPayloadVersion(checkoutDir) {
 }
 async function runWithRemoteSource(hooks, fn) {
   const fetch2 = hooks.fetch ?? fetchRemoteSource;
-  const mkdtemp = hooks.mkdtemp ?? (() => mkdtempSync3(join10(tmpdir3(), "oh-remote-")));
+  const mkdtemp = hooks.mkdtemp ?? (() => mkdtempSync3(join11(tmpdir3(), "oh-remote-")));
   const rm = hooks.rm ?? ((dir) => rmSync3(dir, { recursive: true, force: true }));
   const out = hooks.stdout ?? ((s) => process.stdout.write(s));
   const checkoutDir = mkdtemp();
@@ -5321,6 +5961,24 @@ async function main(argv) {
     if (a.verb === "list") return await runSecretList(scope, io);
     return await runSecretSet(a.key, scope, io);
   }
+  if (first === "migrate") {
+    const parsed = parseMigrateArgs(argv.slice(1), bin);
+    if (!parsed.ok) {
+      process.stderr.write(`${parsed.error}
+`);
+      if (parsed.showHelp) printMigrateHelp(bin);
+      return 1;
+    }
+    if (parsed.args.help) {
+      printMigrateHelp(bin);
+      return 0;
+    }
+    const io = {
+      stdout: (s) => process.stdout.write(s),
+      stderr: (s) => process.stderr.write(s)
+    };
+    return runMigrate(parsed.args, io);
+  }
   if (first === "update") {
     const parsed = parseUpdateArgs(argv.slice(1), bin);
     if (!parsed.ok) {
@@ -5437,9 +6095,9 @@ async function main(argv) {
       printComposeVerbHelp(verb, bin);
       return 0;
     }
-    const sep4 = rest.indexOf("--");
-    const head = sep4 === -1 ? rest : rest.slice(0, sep4);
-    const extra = sep4 === -1 ? [] : rest.slice(sep4 + 1);
+    const sep5 = rest.indexOf("--");
+    const head = sep5 === -1 ? rest : rest.slice(0, sep5);
+    const extra = sep5 === -1 ? [] : rest.slice(sep5 + 1);
     if (head.length > 0 && head[0].startsWith("-")) {
       process.stderr.write(`${bin} ${verb}: unknown flag "${head[0]}"
 `);