agentwheel 0.14.8 → 0.14.13

package/AGENT.md

@@ -9,7 +9,7 @@ commands, subagents, MCP, hooks, settings, plugins, or fragments.
 - `add` records desired packages in `.agentwheel/config.json`.
 - `plan` previews what would change.
 - `install` makes the declared state true.
-- `update` refreshes tracking packages, then installs.
+- `update` refreshes tracking packages, then installs; a configured package name preserves other roots, while `update --dependency <name-or-source>` advances one tracking dependency and keeps unrelated graph nodes locked.
 - `uninstall` removes managed runtime output and config entries.
 
 Runtime output directories are generated. Do not hand-edit generated skills, runtime config, or

package/README.md

@@ -99,13 +99,14 @@ Fragments are Agentwheel composition inputs, not runtime file-drop targets.
 | Command | Meaning |
 |---|---|
 | `agentwheel add <source>` | Validate and save a package entry in `.agentwheel/config.json`; does not touch runtimes. |
-| `agentwheel plan [name-or-source]` | Preview what `install` would reconcile without writing. |
+| `agentwheel plan [name-or-source]` | Preview what `install` would reconcile without writing; supports `--profile <name>` and `--json`. |
 | `agentwheel install` | Reconcile configured packages into the current target or selected fleet. Uses the graph lock as input by default. |
 | `agentwheel install <name-or-source>` | Ensure semantics: configured name/source scopes the install; a new source is added and installed. |
-| `agentwheel update [name]` | Re-resolve tracking packages, then apply. Pinned packages stay locked. Use `--profile <name>` for profile-managed fleets. |
+| `agentwheel update [name]` | Re-resolve tracking packages, then apply. A configured name preserves artifacts owned by other roots; `--dependency <name-or-source>` moves one tracking dependency while unrelated graph nodes stay locked. |
 | `agentwheel uninstall <name-or-source>` | Remove a configured package from runtimes and config. |
 | `agentwheel uninstall <name> --keep-files` | Remove from config/manifest while leaving runtime files unmanaged. |
 | `agentwheel status` | Show configured packages, manifest/lock presence, and install state. Use `--profile <name>` for profile-managed fleets; `status --all` uses profile `all` when present. |
+| `agentwheel ownership handoff <type/name>` | Transfer one manifest entry to a different workspace root after exact owner, hash, and revision checks; runtime content is not rewritten. |
 | `agentwheel doctor` | Check runtime setup and suggest explicit companion/selected skill install commands when they are missing. |
 
 Mental model: **`install` = make what is declared true. `update` = move tracking declarations forward,
@@ -113,6 +114,35 @@ then make them true.**
 Scoped installs do not remove files owned only by other configured packages; run a full `agentwheel install`
 to reconcile those removals.
 
+When a managed fleet profile moves between workspace roots, preview a single-artifact ownership
+handoff first. The dry-run prints the current artifact hash and manifest revision:
+
+```bash
+agentwheel ownership handoff skills/example-skill \
+  --adapter codex --user --target-root "$HOME" \
+  --from-workspace-root /old/fleet/profile \
+  --to-workspace-root /new/fleet/profile \
+  --dry-run
+```
+
+Apply the same command with the reviewed values added as `--expected-hash <sha256>` and
+`--expected-revision <sha256>`. Agentwheel takes the target apply lock, rejects a pending apply
+journal, rechecks the old owner and the live artifact hash, then atomically updates only the install
+manifest. Run one target at a time; named SSH agents use the same contract through `--agent`.
+
+For a surgical dependency update, start with a dry-run:
+
+```bash
+agentwheel update --dependency shared-core --agent lab-codex --dry-run
+agentwheel update --dependency github:your-org/shared-core --agent lab-codex
+```
+
+The selector must uniquely match a locked tracking dependency by package name, dependency alias,
+node id, or source. Agentwheel advances that node and its required tracking closure, writes the
+complete graph lock, and applies atomically. Configured selections stay unchanged, so this mode
+rejects package arguments, `--select`, `--skill`, `--frozen-lock`, and `--offline`. A later full
+`update` can advance the remaining graph.
+
 ## Quick Start
 
 ```bash
@@ -145,6 +175,14 @@ wrapped by an explicit OpenPack source.
 wrapper for OpenClaw. The generated artifact plans `openclaw plugins install --force clawhub:<name>`;
 plugin execution remains opt-in through Agentwheel's plugin execution controls.
 
+Runtime reloads or service restarts remain a separate opt-in gate. Configure structured
+`reloadCommands` on an agent or profile runtime, then pass `--reload-runtimes` (or the alias
+`--restart-runtimes`) with an apply command that executes plugins:
+
+```bash
+agentwheel install --profile extra-message-policy --execute-plugins --reload-runtimes
+```
+
 Submit a public resource to the catalogue without editing `index.json` by hand:
 
 ```bash
@@ -243,6 +281,15 @@ For a control-plane setup, define named agents in config. Global config lives at
       "user": "agent",
       "port": 22,
       "identityFile": "~/.ssh/id_ed25519"
+    },
+    "tirrenia": {
+      "adapter": "openclaw",
+      "installationType": "local",
+      "root": "/home/openclaw-tirrenia",
+      "transport": "ssh",
+      "host": "ct110",
+      "user": "openclaw-tirrenia",
+      "reloadCommands": [["systemctl", "restart", "openclaw-gateway-tirrenia.service"]]
     }
   },
   "profiles": {
@@ -331,6 +378,85 @@ be deselected:
 }
 ```
 
+### Project-owned selection exports
+
+Workspace configuration `schemaVersion: 2` can export named artifact selections. This is useful
+when a project owns its content and portable local profiles, while a fleet only references the
+project's curated selection for a remote runtime.
+
+```json
+{
+  "schemaVersion": 2,
+  "exports": {
+    "selections": {
+      "default": {
+        "select": ["skills/project-start", "skills/project-checkin"]
+      },
+      "remote": {
+        "extends": "default",
+        "add": ["skills/remote-guard"],
+        "exclude": ["skills/project-checkin"]
+      }
+    }
+  },
+  "packages": [
+    {
+      "name": "project-workspace",
+      "source": ".",
+      "driver": "local",
+      "adapter": "copilot",
+      "mode": "pinned",
+      "selection": { "export": "default" }
+    }
+  ],
+  "agents": {
+    "mac-copilot": { "adapter": "copilot", "root": ".", "installationType": "local" }
+  },
+  "profiles": {
+    "local-mac": { "runtimes": [{ "agent": "mac-copilot" }] }
+  }
+}
+```
+
+The import is data-only: Agentwheel resolves the package first, then reads only
+`exports.selections` from that resolved source's `.agentwheel/config.json`. It never imports the
+source project's agents, profiles, SSH fields, adapter modules, trust policy, or other workspace
+settings. Initial support is intentionally limited to `local` and `git` sources, so a Git import
+uses the same immutable checkout as its artifacts.
+
+A consuming fleet can reuse that selection without inheriting the project's runtime policy:
+
+```json
+{
+  "schemaVersion": 2,
+  "packages": [
+    {
+      "name": "project-workspace",
+      "source": "/workspace/project",
+      "driver": "local",
+      "adapter": "hermes",
+      "mode": "pinned",
+      "selection": {
+        "export": "remote",
+        "add": ["skills/fleet-only-check"],
+        "exclude": ["skills/remote-guard"]
+      }
+    }
+  ]
+}
+```
+
+Resolution order is: exported base selection, each exported `extends` step, importer `add`, then
+importer `exclude`; exclusion wins. Required artifacts remain selected. A package may use either
+`selection` or `select`/legacy `skills`, never both, and CLI `--select`/`--skill` cannot override an
+imported selection.
+
+Plans print `IMPORT` and `SELECT` audit lines with the source, export catalog hash, requested
+export, extension chain, additions, exclusions, and effective selectors. `agentwheel plan --profile
+local-mac`, `agentwheel install --profile local-mac --dry-run`, and `--json` expose the same audit
+data. The export catalog and resolved selection are recorded in graph locks, so `--frozen-lock`
+rejects config-only selection changes.
+
 Package authors can also declare suggested companion packages. Suggestions are not installed by
 default; users opt in with `--with-suggestions` for all suggestions relevant to selected artifacts,
 or `--suggestion <alias>` for one named suggestion. The choice is saved when used with `add` or

package/dist/{chunk-QJTTISLY.js → chunk-PKAPR55N.js}

@@ -97,7 +97,7 @@ async function isExplicitSource(source) {
   if (source.startsWith("github:") || source.startsWith("git:") || source.startsWith("skillkit:") || source.startsWith("vercel:") || source.startsWith("mcp-registry:") || source.startsWith("clawhub:")) {
     return true;
   }
-  if (source.startsWith("./") || source.startsWith("../") || source.startsWith("/") || source.startsWith("~/")) {
+  if (source === "." || source === ".." || source.startsWith("./") || source.startsWith("../") || source.startsWith("/") || source.startsWith("~/")) {
     return true;
   }
   return pathExists(resolveLocalPath(source));

package/dist/{identify-T4RE5RBD.js → identify-VV7SXUIQ.js}

@@ -2,7 +2,7 @@
 import {
   inferSourceDriverName,
   isExplicitSource
-} from "./chunk-QJTTISLY.js";
+} from "./chunk-PKAPR55N.js";
 export {
   inferSourceDriverName,
   isExplicitSource