agentwheel 0.14.8 → 0.14.13

package/dist/index.js

@@ -6,13 +6,14 @@ import {
   isIgnoredGeneratedEntry,
   pathExists,
   writeJsonAtomic
-} from "./chunk-QJTTISLY.js";
+} from "./chunk-PKAPR55N.js";
 
 // src/cli/index.ts
+import { createHash as createHash11 } from "crypto";
 import { existsSync } from "fs";
-import { mkdir as mkdir21, rm as rm11, writeFile as writeFile20 } from "fs/promises";
+import { mkdir as mkdir22, rm as rm11, writeFile as writeFile21 } from "fs/promises";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname30, join as join41, resolve as resolve20 } from "path";
+import { dirname as dirname31, join as join41, resolve as resolve20 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -485,9 +486,9 @@ async function resolveAdapter(options) {
 
 // src/install/apply.ts
 import { execFile as execFile3 } from "child_process";
-import { mkdtemp as mkdtemp2, rm as rm4, writeFile as writeFile9 } from "fs/promises";
+import { mkdtemp as mkdtemp2, rm as rm4, writeFile as writeFile10 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename3, dirname as dirname10, join as join5 } from "path";
+import { basename as basename3, dirname as dirname11, join as join5 } from "path";
 import { promisify as promisify3 } from "util";
 
 // src/model/graph-lock.ts
@@ -518,7 +519,18 @@ var graphLockRootSchema = z3.object({
   mode: z3.enum(["pinned", "tracking"]),
   selected: z3.array(z3.string().min(1)),
   aliases: z3.record(z3.string(), z3.string().min(1)).optional(),
-  overrides: z3.array(z3.string().min(1)).optional()
+  overrides: z3.array(z3.string().min(1)).optional(),
+  selectionImport: z3.object({
+    configPath: z3.string().min(1),
+    configHash: z3.string().min(16),
+    exportHash: z3.string().min(16),
+    exportName: z3.string().min(1),
+    extends: z3.array(z3.string().min(1)),
+    inherited: z3.array(z3.string().min(1)),
+    additions: z3.array(z3.string().min(1)),
+    exclusions: z3.array(z3.string().min(1)),
+    effective: z3.array(z3.string().min(1))
+  }).optional()
 });
 var graphLockEdgeSchema = z3.object({
   from: z3.string().min(1),
@@ -618,7 +630,14 @@ function canonicalizeGraphLock(lock) {
       roots: [...parsed.canonical.roots].map((root) => ({
         ...root,
         selected: sortedUnique(root.selected),
-        overrides: root.overrides ? sortedUnique(root.overrides) : void 0
+        overrides: root.overrides ? sortedUnique(root.overrides) : void 0,
+        selectionImport: root.selectionImport ? {
+          ...root.selectionImport,
+          inherited: sortedUnique(root.selectionImport.inherited),
+          additions: sortedUnique(root.selectionImport.additions),
+          exclusions: sortedUnique(root.selectionImport.exclusions),
+          effective: sortedUnique(root.selectionImport.effective)
+        } : void 0
       })).sort((a, b) => `${a.rootId}:${a.graphNodeId}`.localeCompare(`${b.rootId}:${b.graphNodeId}`)),
       nodes: [...parsed.canonical.nodes].map((node) => ({
         ...node,
@@ -999,6 +1018,15 @@ import { resolve as resolve3 } from "path";
 
 // src/model/manifest.ts
 import { z as z4 } from "zod";
+var mergeValueSchema = z4.lazy(() => z4.union([
+  z4.null(),
+  z4.boolean(),
+  z4.number(),
+  z4.string(),
+  z4.array(mergeValueSchema),
+  z4.record(z4.string(), mergeValueSchema)
+]));
+var mergeRemovalSchema = z4.record(z4.string(), mergeValueSchema);
 var dependencyRoleSchema = z4.enum(["root", "direct", "transitive", "fragment"]);
 var legacyUnownedWorkspaceOwner = "legacy:unowned";
 var semanticPluginSpecSchema = z4.object({
@@ -1025,6 +1053,8 @@ var manifestEntryV1Schema = z4.object({
   semanticPlugin: semanticPluginSpecSchema.optional(),
   executed: z4.boolean().optional(),
   mergeStrategy: z4.enum(["json-deep", "openclaw-json-deep", "yaml-deep", "codex-toml-mcp"]).optional(),
+  mergeRemoval: mergeRemovalSchema.optional(),
+  mergeCreatedDestination: z4.boolean().optional(),
   mode: z4.enum(["managed-block"]).optional(),
   composedFrom: z4.array(composedFromEntrySchema).optional()
 });
@@ -1270,6 +1300,23 @@ async function removeApplyJournal(targetRoot, adapter, transport = localTranspor
   await transport.rm(applyJournalPath(targetRoot, adapter, scope));
   await transport.rm(applyBackupDir(targetRoot, adapter, scope));
 }
+async function abortApplyJournal(targetRoot, adapter, transport = localTransport, scope = {}) {
+  const lock = await acquireApplyLock(targetRoot, adapter, transport, {}, scope);
+  try {
+    const journalPath = applyJournalPath(targetRoot, adapter, scope);
+    if (!await transport.pathExists(journalPath)) return void 0;
+    const stateKey = stateKeyFor(adapter, scope);
+    const archivePath = join3(metadataDir(targetRoot), "archive", `${stateKey}.apply-journal.failed-${journalTimestamp(/* @__PURE__ */ new Date())}.json`);
+    const content = await transport.readFile(journalPath);
+    await transport.writeFileAtomic(archivePath, content.endsWith("\n") ? content : `${content}
+`);
+    await transport.rm(journalPath);
+    await transport.rm(applyBackupDir(targetRoot, adapter, scope));
+    return { journalPath, archivePath };
+  } finally {
+    await lock.release();
+  }
+}
 async function recordBackup(operation, index, targetRoot, adapter, transport = localTransport, scope = {}) {
   const hadExisting = await transport.pathExists(operation.destPath);
   if (!hadExisting || transport.kind !== "local" || operation.action !== "update" && operation.action !== "remove" && operation.action !== "create") {
@@ -1326,6 +1373,9 @@ async function readLockOwner(ownerPath, transport) {
 function isAlreadyExists(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
 }
+function journalTimestamp(date) {
+  return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
 async function localPathExists(path) {
   try {
     await stat2(path);
@@ -1482,6 +1532,123 @@ function dedupeArray2(values) {
   return out;
 }
 
+// src/install/merge-removal.ts
+import { mkdir as mkdir8, readFile as readFile9, writeFile as writeFile8 } from "fs/promises";
+import { dirname as dirname9 } from "path";
+import { parse as parse3, stringify as stringify2 } from "yaml";
+async function mergeRemovalForInstall(sourcePath, strategy, currentContent) {
+  const source = await readMergeSource(sourcePath, strategy);
+  if (currentContent === void 0) return source;
+  if (strategy === "codex-toml-mcp") {
+    const existingServers = codexTomlMcpServerNames(currentContent);
+    const servers = isRecord4(source.mcpServers) ? source.mcpServers : source;
+    return { mcpServers: Object.fromEntries(Object.entries(servers).filter(([name]) => !existingServers.has(name))) };
+  }
+  return introducedMergeContent(parseMergeDestination(currentContent, strategy), source);
+}
+async function removeMergeContribution(destPath, strategy, removal) {
+  const content = await readFile9(destPath, "utf8");
+  if (strategy === "codex-toml-mcp") {
+    const servers = isRecord4(removal.mcpServers) ? removal.mcpServers : removal;
+    await writeFile8(destPath, removeCodexTomlMcpSections(content, Object.keys(servers)), "utf8");
+    return;
+  }
+  const current = parseMergeDestination(content, strategy);
+  removeIntroducedContent(current, removal);
+  await mkdir8(dirname9(destPath), { recursive: true });
+  await writeFile8(destPath, strategy === "yaml-deep" ? stringify2(current) : `${JSON.stringify(current, null, 2)}
+`, "utf8");
+}
+async function readMergeSource(sourcePath, strategy) {
+  const content = await readFile9(sourcePath, "utf8");
+  if (strategy === "yaml-deep") return requireRecord(normalizeYamlValue2(parse3(content)), "YAML merge source");
+  return requireRecord(JSON.parse(content), "JSON merge source");
+}
+function parseMergeDestination(content, strategy) {
+  if (strategy === "yaml-deep") return requireRecord(normalizeYamlValue2(parse3(content)), "YAML merge destination");
+  return requireRecord(JSON.parse(content), "JSON merge destination");
+}
+function introducedMergeContent(base, incoming) {
+  const introduced = {};
+  for (const [key, incomingValue] of Object.entries(incoming)) {
+    if (!(key in base)) {
+      introduced[key] = incomingValue;
+      continue;
+    }
+    const baseValue = base[key];
+    if (isRecord4(baseValue) && isRecord4(incomingValue)) {
+      const nested = introducedMergeContent(baseValue, incomingValue);
+      if (Object.keys(nested).length > 0) introduced[key] = nested;
+    } else if (Array.isArray(baseValue) && Array.isArray(incomingValue)) {
+      const additions = incomingValue.filter((value) => !baseValue.some((existing) => sameValue(existing, value)));
+      if (additions.length > 0) introduced[key] = additions;
+    }
+  }
+  return introduced;
+}
+function removeIntroducedContent(current, removal) {
+  for (const [key, removalValue] of Object.entries(removal)) {
+    if (!(key in current)) continue;
+    const currentValue = current[key];
+    if (isRecord4(currentValue) && isRecord4(removalValue)) {
+      removeIntroducedContent(currentValue, removalValue);
+      if (Object.keys(currentValue).length === 0) delete current[key];
+    } else if (Array.isArray(currentValue) && Array.isArray(removalValue)) {
+      const remaining = currentValue.filter((value) => !removalValue.some((removed) => sameValue(removed, value)));
+      if (remaining.length === 0) delete current[key];
+      else current[key] = remaining;
+    } else delete current[key];
+  }
+}
+function codexTomlMcpServerNames(content) {
+  const names = /* @__PURE__ */ new Set();
+  for (const line of content.split(/\r?\n/)) {
+    const section = line.match(/^\s*\[([^\]]+)]\s*$/)?.[1];
+    const match = section?.match(/^mcp_servers\.([^.\]]+)(?:\.|$)/);
+    if (match?.[1]) names.add(unquoteTomlKey2(match[1]));
+  }
+  return names;
+}
+function removeCodexTomlMcpSections(content, serverNames) {
+  if (serverNames.length === 0 || content.trim() === "") return content;
+  const names = new Set(serverNames);
+  const kept = [];
+  let skipping = false;
+  for (const line of content.split(/\r?\n/)) {
+    const section = line.match(/^\s*\[([^\]]+)]\s*$/)?.[1];
+    if (section) {
+      const match = section.match(/^mcp_servers\.([^.\]]+)(?:\.|$)/);
+      skipping = match ? names.has(unquoteTomlKey2(match[1] ?? "")) : false;
+    }
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n").replace(/\n{3,}$/g, "\n\n");
+}
+function normalizeYamlValue2(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") return value;
+  if (Array.isArray(value)) return value.map(normalizeYamlValue2);
+  if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, normalizeYamlValue2(child)]));
+  return value === void 0 ? null : String(value);
+}
+function requireRecord(value, label) {
+  if (!isRecord4(value)) throw new Error(`${label} must be an object`);
+  return value;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sameValue(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function unquoteTomlKey2(key) {
+  if (!key.startsWith('"')) return key;
+  try {
+    return JSON.parse(key);
+  } catch {
+    return key;
+  }
+}
+
 // src/install/desired.ts
 function normalizeOwners(owners) {
   const normalized = [...new Set(owners.map((owner) => owner.trim()).filter(Boolean))].sort();
@@ -1493,13 +1660,13 @@ function normalizeOwners(owners) {
 
 // src/install/instructions-block.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdtemp, readFile as readFile9, realpath, rm as rm3, writeFile as writeFile8 } from "fs/promises";
+import { mkdtemp, readFile as readFile10, realpath, rm as rm3, writeFile as writeFile9 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename2, dirname as dirname9, join as join4, relative as relative2 } from "path";
+import { basename as basename2, dirname as dirname10, join as join4, relative as relative2 } from "path";
 var managedInstructionBlockMode = "managed-block";
 var managedInstructionBanner = "<!-- agentwheel-managed: edit fragments, not this block -->";
 async function desiredManagedInstructionBlockHash(sourcePath) {
-  const source = await readFile9(sourcePath, "utf8");
+  const source = await readFile10(sourcePath, "utf8");
   return hashText(managedBlockBody(source));
 }
 async function readManagedInstructionBlockState(destPath, selector, transport) {
@@ -1519,7 +1686,7 @@ async function readManagedInstructionBlockState(destPath, selector, transport) {
   };
 }
 async function writeManagedInstructionBlock(sourcePath, destPath, selector, transport, options = {}) {
-  const source = await readFile9(sourcePath, "utf8");
+  const source = await readFile10(sourcePath, "utf8");
   const desired = renderManagedInstructionBlock(selector, source);
   const existing = await readOptionalText(destPath, transport);
   const merged = upsertManagedInstructionBlock(existing ?? "", selector, desired.block, options);
@@ -1631,7 +1798,7 @@ function assertCleanBlock(block, selector) {
   }
 }
 function referencesAgentsMd(content, claudePath, agentsPath) {
-  const claudeDir = dirname9(claudePath);
+  const claudeDir = dirname10(claudePath);
   for (const rawLine of content.split(/\r?\n/)) {
     const line = rawLine.trim();
     const atImport = /^@import\s+(.+)$/i.exec(line);
@@ -1641,7 +1808,7 @@ function referencesAgentsMd(content, claudePath, agentsPath) {
     const cleaned = referenced.trim().replace(/^["']|["']$/g, "");
     if (!/AGENTS\.md$/i.test(cleaned)) continue;
     const candidate = cleaned.startsWith("/") ? cleaned : join4(claudeDir, cleaned);
-    if (relative2(dirname9(agentsPath), candidate).replaceAll("\\", "/") === "AGENTS.md") return true;
+    if (relative2(dirname10(agentsPath), candidate).replaceAll("\\", "/") === "AGENTS.md") return true;
     if (candidate === agentsPath) return true;
   }
   return false;
@@ -1663,7 +1830,7 @@ async function writeTextWithTransport(path, content, transport) {
   const tempRoot = await mkdtemp(join4(tmpdir2(), "agentwheel-instructions-"));
   const localPath = join4(tempRoot, basename2(path) || "instructions.md");
   try {
-    await writeFile8(localPath, content, "utf8");
+    await writeFile9(localPath, content, "utf8");
     await transport.atomicCopy(localPath, path, "file");
   } finally {
     await rm3(tempRoot, { recursive: true, force: true });
@@ -1813,7 +1980,7 @@ async function uninstall(plan, options = {}) {
   const removedDrifted = resolvedOptions.force ? plan.operations.filter((operation) => operation.action === "keep" && isForceRemovableKeep(operation)).length : 0;
   if (resolvedOptions.dryRun) return { removed: resolvedOptions.keepFiles ? 0 : removable.length, kept: kept.length, removedDrifted };
   const preservedKept = resolvedOptions.keepFiles ? kept.filter((operation) => shouldPreserveKeptOperationWhenKeepingFiles(operation)) : kept;
-  const preserved = [...preservedKept, ...skipped];
+  const preserved = [...preservedKept, ...skipped].filter((operation) => operation.preserveInManifest !== false);
   for (const operation of [...removable, ...preserved]) assertOperationContained(operation, plan.targetRoot);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const finalManifest = withManifestRevision({
@@ -2017,6 +2184,12 @@ async function applyOperation(operation, context) {
     if (operation.mode === managedInstructionBlockMode) {
       const selector = managedInstructionSelector(operation.logicalSelector, operation.artifactType, operation.artifactName);
       await removeManagedInstructionBlock(operation.destPath, selector, transport, managedBlockMutationOptions(operation));
+    } else if (operation.mergeStrategy) {
+      if (operation.mergeCreatedDestination) {
+        await transport.rm(operation.destPath);
+      } else if (operation.mergeRemoval) {
+        await removeMergeWithTransport(operation.destPath, operation.mergeStrategy, operation.mergeRemoval, transport);
+      }
     } else {
       await transport.rm(operation.destPath);
     }
@@ -2038,7 +2211,12 @@ async function executePluginInstall(operation, transport) {
 async function executePluginUninstall(operation, transport) {
   const commands = operation.semanticPlugin?.uninstallCommands ?? [];
   if (commands.length === 0) throw new Error(`Invalid semantic plugin operation missing uninstall command: ${operation.relativeDestPath}`);
-  await executeSemanticCommands(operation, commands, transport);
+  try {
+    await executeSemanticCommands(operation, commands, transport);
+  } catch (error) {
+    if (!isPluginAlreadyAbsentError(operation, error)) throw error;
+    console.warn(`WARNING plugin-already-absent ${operation.relativeDestPath}: ${firstErrorLine(error)}`);
+  }
   if (operation.semanticPlugin?.stateRoot) {
     await transport.rm(operation.semanticPlugin.stateRoot);
   }
@@ -2185,6 +2363,35 @@ async function executeSemanticCommands(operation, commands, transport, options =
     await transport.rm(stagingRoot);
   }
 }
+function isPluginAlreadyAbsentError(operation, error) {
+  const output = commandErrorOutput(error).toLowerCase();
+  if (!output || output.includes("command not found") || output.includes("module not found")) return false;
+  const pluginName = (operation.semanticPlugin?.pluginName ?? operation.artifactName).toLowerCase();
+  const escapedName = escapeRegExp(pluginName);
+  const namedAbsent = [
+    new RegExp(`${escapedName}.{0,120}\\b(not installed|not found|does not exist|absent)\\b`, "s"),
+    new RegExp(`\\b(not installed|not found|does not exist|absent)\\b.{0,120}${escapedName}`, "s"),
+    new RegExp(`\\bunknown plugin\\b.{0,120}${escapedName}`, "s"),
+    new RegExp(`${escapedName}.{0,120}\\bunknown plugin\\b`, "s")
+  ].some((pattern) => pattern.test(output));
+  const genericAbsent = /\b(no such|unknown)\s+plugins?\b/.test(output) || /\bplugins?\b.{0,80}\bnot installed\b/s.test(output);
+  return namedAbsent || genericAbsent;
+}
+function commandErrorOutput(error) {
+  if (typeof error === "object" && error !== null) {
+    const stderr = "stderr" in error ? String(error.stderr ?? "") : "";
+    if (stderr.trim()) return stderr;
+    const stdout = "stdout" in error ? String(error.stdout ?? "") : "";
+    if (stdout.trim()) return stdout;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+function firstErrorLine(error) {
+  return commandErrorOutput(error).split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? "plugin is already absent";
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function semanticInstallCommands(operation) {
   if (operation.semanticPlugin) return operation.semanticPlugin.installCommands;
   return operation.semanticCommand ? [operation.semanticCommand] : [];
@@ -2248,6 +2455,8 @@ function manifestEntryForOperation(operation, values) {
     semanticPlugin: operation.semanticPlugin,
     executed: values.executed ?? operation.execute,
     mergeStrategy: operation.mergeStrategy,
+    mergeRemoval: operation.mergeRemoval,
+    mergeCreatedDestination: operation.mergeCreatedDestination,
     mode: operation.mode,
     composedFrom: operation.composedFrom,
     graphLockDigest: operation.graphLockDigest ?? values.graphLockDigest
@@ -2308,7 +2517,7 @@ async function mergeWithTransport(sourcePath, destPath, transport, merge) {
   const localDest = join5(tempRoot, basename3(destPath) || "merged");
   try {
     if (await transport.pathExists(destPath)) {
-      await writeFile9(localDest, await transport.readFile(destPath), "utf8");
+      await writeFile10(localDest, await transport.readFile(destPath), "utf8");
     }
     await merge(sourcePath, localDest);
     await transport.atomicCopy(localDest, destPath, "file");
@@ -2316,13 +2525,28 @@ async function mergeWithTransport(sourcePath, destPath, transport, merge) {
     await rm4(tempRoot, { recursive: true, force: true });
   }
 }
+async function removeMergeWithTransport(destPath, strategy, removal, transport) {
+  if (transport.kind === "local") {
+    await removeMergeContribution(destPath, strategy, removal);
+    return;
+  }
+  const tempRoot = await mkdtemp2(join5(tmpdir3(), "agentwheel-merge-remove-"));
+  const localDest = join5(tempRoot, basename3(destPath) || "merged");
+  try {
+    await writeFile10(localDest, await transport.readFile(destPath), "utf8");
+    await removeMergeContribution(localDest, strategy, removal);
+    await transport.atomicCopy(localDest, destPath, "file");
+  } finally {
+    await rm4(tempRoot, { recursive: true, force: true });
+  }
+}
 async function mergeOpenClawJsonWithTransport(sourcePath, destPath, transport) {
   const tempRoot = await mkdtemp2(join5(tmpdir3(), "agentwheel-openclaw-merge-"));
   const localDest = join5(tempRoot, basename3(destPath) || "openclaw.json");
   const validationPath = transport.kind === "local" ? localDest : `${destPath}.validate-agentwheel-${process.pid}-${Date.now()}`;
   try {
     if (await transport.pathExists(destPath)) {
-      await writeFile9(localDest, await transport.readFile(destPath), "utf8");
+      await writeFile10(localDest, await transport.readFile(destPath), "utf8");
     }
     await mergeOpenClawJsonFile(sourcePath, localDest);
     if (transport.kind !== "local") {
@@ -2339,7 +2563,7 @@ async function validateOpenClawConfig(configPath, destPath, transport) {
   if (!transport.execFile) {
     throw new Error(`Cannot validate OpenClaw config over ${transport.description}: transport does not support command execution.`);
   }
-  const openClawHome = dirname10(destPath);
+  const openClawHome = dirname11(destPath);
   const bundledBin = join5(openClawHome, "npm", "node_modules", ".bin", "openclaw");
   const script = String.raw`
 set -euo pipefail
@@ -2366,8 +2590,8 @@ printf '%s' "$out" | node -e 'let s=""; process.stdin.on("data", c => s += c); p
 import { basename as basename8, join as join16, relative as relative3 } from "path";
 
 // src/staging/codex-subagents.ts
-import { mkdir as mkdir8, readFile as readFile10, writeFile as writeFile10 } from "fs/promises";
-import { basename as basename4, dirname as dirname11, join as join6 } from "path";
+import { mkdir as mkdir9, readFile as readFile11, writeFile as writeFile11 } from "fs/promises";
+import { basename as basename4, dirname as dirname12, join as join6 } from "path";
 var requiredCodexAgentFields = ["name", "description", "developer_instructions"];
 async function renderCodexSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "codex") return artifacts;
@@ -2393,7 +2617,7 @@ async function renderCodexSubagent(artifact, stageRoot) {
   const renderedPath = join6(stageRoot, ".agentwheel-rendered", "codex-subagents", `${agentName}.toml`);
   const lowerSourcePath = sourcePath.toLowerCase();
   if (artifact.kind === "file" && (artifact.name.toLowerCase().endsWith(".toml") || lowerSourcePath.endsWith(".toml"))) {
-    const content = await readFile10(sourcePath, "utf8");
+    const content = await readFile11(sourcePath, "utf8");
     validateCodexAgentToml(content, sourcePath);
     return {
       ...artifact,
@@ -2410,10 +2634,10 @@ async function renderCodexSubagent(artifact, stageRoot) {
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !lowerSourcePath.endsWith(".md")) {
     throw new Error(`Codex subagent ${artifact.relativePath} must be a .toml file, .md file, or directory containing AGENTS.md.`);
   }
-  const markdown = await readFile10(markdownPath, "utf8");
+  const markdown = await readFile11(markdownPath, "utf8");
   const toml = markdownToCodexAgentToml(agentName, markdown);
-  await mkdir8(dirname11(renderedPath), { recursive: true });
-  await writeFile10(renderedPath, toml, "utf8");
+  await mkdir9(dirname12(renderedPath), { recursive: true });
+  await writeFile11(renderedPath, toml, "utf8");
   return {
     ...artifact,
     name: agentName,
@@ -2430,7 +2654,7 @@ function codexAgentName(artifact) {
 }
 function validateCodexAgentToml(content, path) {
   for (const field of requiredCodexAgentFields) {
-    const pattern = new RegExp(`(^|\\n)\\s*${escapeRegExp(field)}\\s*=`, "m");
+    const pattern = new RegExp(`(^|\\n)\\s*${escapeRegExp2(field)}\\s*=`, "m");
     if (!pattern.test(content)) {
       throw new Error(`Codex custom agent TOML ${path} is missing required field '${field}'.`);
     }
@@ -2476,13 +2700,13 @@ function tomlMultilineString(value) {
 ${escaped.endsWith("\n") ? escaped : `${escaped}
 `}"""`;
 }
-function escapeRegExp(value) {
+function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // src/staging/copilot-artifacts.ts
-import { mkdir as mkdir9, readFile as readFile11, writeFile as writeFile11 } from "fs/promises";
-import { basename as basename5, dirname as dirname12, join as join7 } from "path";
+import { mkdir as mkdir10, readFile as readFile12, writeFile as writeFile12 } from "fs/promises";
+import { basename as basename5, dirname as dirname13, join as join7 } from "path";
 async function renderCopilotArtifacts(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "copilot") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -2512,9 +2736,9 @@ async function renderCopilotSubagent(artifact, stageRoot) {
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md")) {
     throw new Error(`Copilot subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const markdown = await readFile11(markdownPath, "utf8");
-  await mkdir9(dirname12(renderedPath), { recursive: true });
-  await writeFile11(renderedPath, ensureCopilotAgentDescription(agentName, markdown), "utf8");
+  const markdown = await readFile12(markdownPath, "utf8");
+  await mkdir10(dirname13(renderedPath), { recursive: true });
+  await writeFile12(renderedPath, ensureCopilotAgentDescription(agentName, markdown), "utf8");
   return {
     ...artifact,
     name: `${agentName}.agent.md`,
@@ -2567,8 +2791,8 @@ function yamlString(value) {
 }
 
 // src/staging/openclaw-subagents.ts
-import { mkdir as mkdir10, readFile as readFile12, writeFile as writeFile12 } from "fs/promises";
-import { basename as basename6, dirname as dirname13, join as join8 } from "path";
+import { mkdir as mkdir11, readFile as readFile13, writeFile as writeFile13 } from "fs/promises";
+import { basename as basename6, dirname as dirname14, join as join8 } from "path";
 async function renderOpenClawSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "openclaw") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -2597,15 +2821,15 @@ async function renderOpenClawSubagent(artifact, stageRoot) {
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !sourcePath.toLowerCase().endsWith(".md")) {
     throw new Error(`OpenClaw subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const parsed = splitFrontmatter3(await readFile12(markdownPath, "utf8"));
+  const parsed = splitFrontmatter3(await readFile13(markdownPath, "utf8"));
   const body = parsed.body.trim().length > 0 ? parsed.body.trim() : `# ${titleFromAgentId(agentId)}
 
 ${parsed.description ?? `OpenClaw subagent ${agentId}.`}`;
   const renderedPath = join8(stageRoot, ".agentwheel-rendered", "openclaw-subagents", agentId, "AGENTS.md");
-  await mkdir10(dirname13(renderedPath), { recursive: true });
-  await writeFile12(renderedPath, `${body}
+  await mkdir11(dirname14(renderedPath), { recursive: true });
+  await writeFile13(renderedPath, `${body}
 `, "utf8");
-  const renderedDir = dirname13(renderedPath);
+  const renderedDir = dirname14(renderedPath);
   return {
     ...artifact,
     name: agentId,
@@ -2639,7 +2863,7 @@ function titleFromAgentId(agentId) {
 import { join as join10 } from "path";
 
 // src/targets/plugins/common.ts
-import { readFile as readFile13 } from "fs/promises";
+import { readFile as readFile14 } from "fs/promises";
 import { join as join9 } from "path";
 import { parseDocument } from "yaml";
 function pluginStateRoot(request) {
@@ -2663,28 +2887,28 @@ function safeNameSegment(value) {
 async function jsonPluginName(root, relativeManifestPath, fallback) {
   const manifestPath = join9(root, relativeManifestPath);
   if (!await pathExists(manifestPath)) return fallback;
-  const parsed = JSON.parse(await readFile13(manifestPath, "utf8"));
+  const parsed = JSON.parse(await readFile14(manifestPath, "utf8"));
   return typeof parsed.name === "string" && parsed.name.trim().length > 0 ? parsed.name.trim() : fallback;
 }
 async function yamlPluginName(root, relativeManifestPaths, fallback) {
   for (const relativeManifestPath of relativeManifestPaths) {
     const manifestPath = join9(root, relativeManifestPath);
     if (!await pathExists(manifestPath)) continue;
-    const document = parseDocument(await readFile13(manifestPath, "utf8"));
+    const document = parseDocument(await readFile14(manifestPath, "utf8"));
     const parsed = document.toJSON();
-    if (!isRecord4(parsed)) continue;
+    if (!isRecord5(parsed)) continue;
     for (const key of ["name", "module", "package"]) {
       const value = parsed[key];
       if (typeof value === "string" && value.trim().length > 0) return value.trim();
     }
     const packageValue = parsed.package;
-    if (isRecord4(packageValue) && typeof packageValue.name === "string" && packageValue.name.trim().length > 0) {
+    if (isRecord5(packageValue) && typeof packageValue.name === "string" && packageValue.name.trim().length > 0) {
       return packageValue.name.trim();
     }
   }
   return fallback;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -2802,7 +3026,7 @@ async function hermesPluginSpec(request) {
 }
 
 // src/targets/plugins/openclaw.ts
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile15 } from "fs/promises";
 import { join as join14 } from "path";
 function openClawPluginInstallCommand(request) {
   return ["openclaw", "plugins", "install", "--force", request.path];
@@ -2832,7 +3056,7 @@ async function openClawPluginName(root, fallback) {
   for (const manifestName of ["plugin.json", "openclaw.plugin.json"]) {
     const manifestPath = join14(root, manifestName);
     if (!await pathExists(manifestPath)) continue;
-    const parsed = JSON.parse(await readFile14(manifestPath, "utf8"));
+    const parsed = JSON.parse(await readFile15(manifestPath, "utf8"));
     if (typeof parsed.name === "string" && parsed.name.trim().length > 0) return parsed.name.trim();
   }
   return fallback;
@@ -2842,7 +3066,7 @@ async function openClawClawHubPluginMetadata(root, fallback) {
   if (!await pathExists(metadataPath)) {
     throw new Error("OpenClaw ClawHub plugins must contain clawhub.json");
   }
-  const parsed = JSON.parse(await readFile14(metadataPath, "utf8"));
+  const parsed = JSON.parse(await readFile15(metadataPath, "utf8"));
   const installSpec = stringField(parsed.installSpec);
   if (!installSpec?.startsWith("clawhub:")) {
     throw new Error("OpenClaw ClawHub plugin metadata must declare installSpec starting with clawhub:");
@@ -2973,7 +3197,7 @@ function skipWarning(selector, adapter, installationType, artifactType, support)
 }
 
 // src/validation/artifacts.ts
-import { readFile as readFile15 } from "fs/promises";
+import { readFile as readFile16 } from "fs/promises";
 import { basename as basename7, join as join15 } from "path";
 import { parseDocument as parseDocument2 } from "yaml";
 var behavioralRuleFormats = ["markdown-rule", "claude-markdown-rule", "copilot-instruction-rule"];
@@ -3178,7 +3402,7 @@ async function validateGenericStructure(artifact, target) {
 async function validateSkillFrontmatter(artifact, skillMdPath) {
   let content;
   try {
-    content = await readFile15(skillMdPath, "utf8");
+    content = await readFile16(skillMdPath, "utf8");
   } catch (error) {
     return [{ artifact, message: `could not read SKILL.md: ${errorMessage(error)}` }];
   }
@@ -3248,7 +3472,7 @@ async function validateHermesPlugin(artifact) {
     return [{ artifact, message: "Hermes plugins must contain plugin.yaml or plugin.yml" }];
   }
   try {
-    const document = parseDocument2(await readFile15(manifestPath, "utf8"));
+    const document = parseDocument2(await readFile16(manifestPath, "utf8"));
     if (document.errors.length > 0) {
       return [{ artifact, message: `Hermes ${basename7(manifestPath)} must be valid YAML: ${document.errors[0]?.message ?? "parse error"}` }];
     }
@@ -3272,8 +3496,8 @@ async function firstExistingPath(paths) {
 }
 async function parseJsonPluginManifest(manifestPath, label) {
   try {
-    const parsed = JSON.parse(await readFile15(manifestPath, "utf8"));
-    if (!isRecord5(parsed)) {
+    const parsed = JSON.parse(await readFile16(manifestPath, "utf8"));
+    if (!isRecord6(parsed)) {
       return { ok: false, message: `${label} ${basename7(manifestPath)} must be a JSON object` };
     }
     if (typeof parsed.name !== "string" || parsed.name.trim().length === 0) {
@@ -3319,8 +3543,8 @@ async function validateOpenClawClawHubPlugin(artifact) {
     return [{ artifact, message: "OpenClaw ClawHub plugins must contain clawhub.json" }];
   }
   try {
-    const parsed = JSON.parse(await readFile15(metadataPath, "utf8"));
-    if (!isRecord5(parsed)) {
+    const parsed = JSON.parse(await readFile16(metadataPath, "utf8"));
+    if (!isRecord6(parsed)) {
       return [{ artifact, message: "OpenClaw ClawHub clawhub.json must be a JSON object" }];
     }
     if (typeof parsed.installSpec !== "string" || !parsed.installSpec.trim().startsWith("clawhub:")) {
@@ -3343,8 +3567,8 @@ async function openClawPluginManifestPaths(artifact) {
 async function parseOpenClawPluginManifest(manifestPath) {
   const manifestName = basename7(manifestPath);
   try {
-    const parsed = JSON.parse(await readFile15(manifestPath, "utf8"));
-    if (!isRecord5(parsed)) {
+    const parsed = JSON.parse(await readFile16(manifestPath, "utf8"));
+    if (!isRecord6(parsed)) {
       return { ok: false, path: manifestPath, message: `OpenClaw ${manifestName} must be a JSON object` };
     }
     if (typeof parsed.name !== "string" || parsed.name.trim().length === 0) {
@@ -3360,8 +3584,8 @@ async function parseJsonObjectArtifact(artifact) {
     return { ok: false, message: "merge artifacts must be JSON files" };
   }
   try {
-    const parsed = JSON.parse(await readFile15(artifactPath(artifact), "utf8"));
-    if (!isRecord5(parsed)) return { ok: false, message: "merge artifacts must contain a JSON object" };
+    const parsed = JSON.parse(await readFile16(artifactPath(artifact), "utf8"));
+    if (!isRecord6(parsed)) return { ok: false, message: "merge artifacts must contain a JSON object" };
     return { ok: true, value: parsed };
   } catch (error) {
     return { ok: false, message: `merge artifact must be valid JSON: ${errorMessage(error)}` };
@@ -3372,7 +3596,7 @@ async function parseYamlObjectArtifact(artifact) {
     return { ok: false, message: "merge artifacts must be YAML files" };
   }
   try {
-    const document = parseDocument2(await readFile15(artifactPath(artifact), "utf8"));
+    const document = parseDocument2(await readFile16(artifactPath(artifact), "utf8"));
     if (document.errors.length > 0) {
       return { ok: false, message: `merge artifact must be valid YAML: ${document.errors[0]?.message ?? "parse error"}` };
     }
@@ -3384,10 +3608,10 @@ async function parseYamlObjectArtifact(artifact) {
   }
 }
 function extractMcpServers2(source) {
-  const raw = isRecord5(source.mcpServers) ? source.mcpServers : source;
+  const raw = isRecord6(source.mcpServers) ? source.mcpServers : source;
   const servers = {};
   for (const [name, value] of Object.entries(raw)) {
-    if (isRecord5(value)) servers[name] = value;
+    if (isRecord6(value)) servers[name] = value;
   }
   return servers;
 }
@@ -3404,7 +3628,7 @@ function hasExtension(artifact, extension) {
 function isPluginFormat(value) {
   return value !== void 0 && pluginFormats.includes(value);
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isUnknownRecord(value) {
@@ -3472,7 +3696,7 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
     if (op.action === "plugin") {
       const existing2 = manifestByPath.get(op.relativeDestPath);
       if (existing2 && existing2.sourceHash === op.desiredHash && existing2.executed === true) {
-        operations.push({ ...op, action: "skip", manifestHash: existing2.hash, reason: "semantic plugin already executed" });
+        operations.push({ ...op, action: "skip", manifestHash: existing2.hash, execute: true, reason: "semantic plugin already executed" });
       } else {
         operations.push(existing2 && existing2.sourceHash === op.desiredHash ? { ...op, manifestHash: existing2.hash, reason: "semantic plugin pending execution" } : op);
       }
@@ -3494,15 +3718,16 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
     if (op.mergeStrategy) {
       const existing2 = manifestByPath.get(op.relativeDestPath);
       const exists2 = await transport.pathExists(op.destPath);
+      const mergeRemoval = await mergeRemovalForInstall(op.sourcePath, op.mergeStrategy, exists2 ? await transport.readFile(op.destPath) : void 0);
       if (!exists2) {
-        operations.push({ ...op, action: "create", reason: "merge destination missing" });
+        operations.push({ ...op, action: "create", mergeRemoval, mergeCreatedDestination: true, reason: "merge destination missing" });
         continue;
       }
       const currentHash2 = await transport.hashPath(op.destPath);
       if (existing2 && existing2.sourceHash === op.desiredHash) {
-        operations.push(options.forceDrift ? { ...op, action: "update", currentHash: currentHash2, manifestHash: existing2.hash, reason: "force refreshing managed merge destination" } : { ...op, action: "skip", currentHash: currentHash2, manifestHash: existing2.hash, reason: "merged source already up to date" });
+        operations.push(options.forceDrift ? { ...op, action: "update", mergeRemoval, mergeCreatedDestination: existing2.mergeCreatedDestination, currentHash: currentHash2, manifestHash: existing2.hash, reason: "force refreshing managed merge destination" } : { ...op, action: "skip", mergeRemoval: existing2.mergeRemoval, mergeCreatedDestination: existing2.mergeCreatedDestination, currentHash: currentHash2, manifestHash: existing2.hash, reason: "merged source already up to date" });
       } else {
-        operations.push({ ...op, action: "update", currentHash: currentHash2, manifestHash: existing2?.hash, reason: existing2 ? "merge source changed" : "merge into existing destination" });
+        operations.push({ ...op, action: "update", mergeRemoval, mergeCreatedDestination: existing2?.mergeCreatedDestination, currentHash: currentHash2, manifestHash: existing2?.hash, reason: existing2 ? "merge source changed" : "merge into existing destination" });
       }
       continue;
     }
@@ -3619,7 +3844,7 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
         relativeDestPath: entry.path,
         currentHash,
         manifestHash: entry.hash,
-        reason: "artifact removed from source",
+        reason: staleRemovalReason(entry),
         channel: entry.channel,
         packageName: entry.packageName,
         semanticCommand: semanticPlugin?.uninstallCommands[0] ?? entry.semanticCommand,
@@ -3934,7 +4159,9 @@ function operationMetadataFromEntry(entry) {
       dependencyRole: entry.dependencyRole,
       owners: entry.owners,
       workspaceOwner: entry.workspaceOwner,
-      graphLockDigest: entry.graphLockDigest
+      graphLockDigest: entry.graphLockDigest,
+      mergeRemoval: entry.mergeRemoval,
+      mergeCreatedDestination: entry.mergeCreatedDestination
     };
   }
   return {
@@ -3973,6 +4200,10 @@ function keepForeignManifestEntryOperation(entry, targetRoot, workspaceOwner, op
 function normalizeOperationOwners(op) {
   return normalizeOwners(op.owners ?? [op.packageName ?? op.artifactName]);
 }
+function staleRemovalReason(entry) {
+  if (!entry.mergeStrategy) return "artifact removed from source";
+  return "mergeCreatedDestination" in entry && entry.mergeCreatedDestination === true ? "remove entire file created by Agentwheel as merge destination" : "remove managed merge contribution; preserving merge destination";
+}
 function isGuardedMergeTarget(type) {
   return type === "mcp" || type === "hooks" || type === "settings" || type === "plugins";
 }
@@ -4147,6 +4378,8 @@ async function createUninstallPlan(manifest, transport = localTransport) {
         composedFrom: entry.composedFrom,
         ...operationMetadataFromEntry2(entry)
       });
+    } else if (entry.mergeStrategy && !("mergeRemoval" in entry && entry.mergeRemoval !== void 0) && !("mergeCreatedDestination" in entry && entry.mergeCreatedDestination === true)) {
+      operations.push(legacyMergeKeepOperation(entry, destPath));
     } else {
       operations.push({
         action: "remove",
@@ -4158,7 +4391,7 @@ async function createUninstallPlan(manifest, transport = localTransport) {
         desiredHash: entry.sourceHash,
         currentHash,
         manifestHash: entry.hash,
-        reason: "uninstall managed artifact",
+        reason: removalReason(entry, "uninstall managed artifact"),
         channel: entry.channel,
         packageName: entry.packageName,
         semanticCommand: semanticPlugin?.uninstallCommands[0] ?? entry.semanticCommand,
@@ -4246,6 +4479,8 @@ async function createOwnershipUninstallPlan(manifest, remainingDesired, adapter,
         ...operationMetadataFromEntry2(entry),
         graphLockDigest: options.graphLockDigest
       });
+    } else if (entry.mergeStrategy && !("mergeRemoval" in entry && entry.mergeRemoval !== void 0) && !("mergeCreatedDestination" in entry && entry.mergeCreatedDestination === true)) {
+      operations.push(legacyMergeKeepOperation(entry, destPath));
     } else {
       operations.push({
         action: "remove",
@@ -4257,7 +4492,7 @@ async function createOwnershipUninstallPlan(manifest, remainingDesired, adapter,
         desiredHash: entry.sourceHash,
         currentHash,
         manifestHash: entry.hash,
-        reason: "owner set became empty",
+        reason: removalReason(entry, "owner set became empty"),
         channel: entry.channel,
         packageName: entry.packageName,
         semanticCommand: semanticPlugin?.uninstallCommands[0] ?? entry.semanticCommand,
@@ -4297,7 +4532,9 @@ function operationMetadataFromEntry2(entry, ownersOverride) {
       graphNodeId: entry.graphNodeId,
       dependencyRole: entry.dependencyRole,
       owners: ownersOverride ?? entry.owners,
-      graphLockDigest: entry.graphLockDigest
+      graphLockDigest: entry.graphLockDigest,
+      mergeRemoval: entry.mergeRemoval,
+      mergeCreatedDestination: entry.mergeCreatedDestination
     };
   }
   return {
@@ -4307,6 +4544,34 @@ function operationMetadataFromEntry2(entry, ownersOverride) {
     owners: ownersOverride?.length ? ownersOverride : [entry.packageName ?? "legacy"]
   };
 }
+function legacyMergeKeepOperation(entry, destPath) {
+  return {
+    action: "keep",
+    artifactType: entry.artifactType,
+    artifactName: entry.artifactName,
+    kind: entry.kind,
+    destPath,
+    relativeDestPath: entry.path,
+    desiredHash: entry.sourceHash,
+    currentHash: entry.hash,
+    manifestHash: entry.hash,
+    reason: "legacy merge ownership is incomplete; preserving destination and releasing management",
+    channel: entry.channel,
+    packageName: entry.packageName,
+    semanticCommand: entry.semanticCommand,
+    semanticPlugin: "semanticPlugin" in entry ? entry.semanticPlugin : void 0,
+    execute: entry.executed,
+    mergeStrategy: entry.mergeStrategy,
+    mode: entry.mode,
+    composedFrom: entry.composedFrom,
+    preserveInManifest: false,
+    ...operationMetadataFromEntry2(entry, [])
+  };
+}
+function removalReason(entry, fallback) {
+  if (!entry.mergeStrategy) return fallback;
+  return "mergeCreatedDestination" in entry && entry.mergeCreatedDestination === true ? "remove entire file created by Agentwheel as merge destination" : "remove managed merge contribution; preserving merge destination";
+}
 
 // src/cli/format.ts
 var labels = {
@@ -4345,6 +4610,56 @@ function formatPlan(plan) {
   );
   return lines.join("\n");
 }
+function planReport(targets, warnings = []) {
+  return {
+    schemaVersion: 1,
+    targets: [...targets].sort(comparePlanReportTargets),
+    warnings: [...warnings].sort((a, b) => a.localeCompare(b))
+  };
+}
+function installPlanReportTarget(plan, graphLockDigest = plan.graphLockDigest) {
+  return {
+    adapter: plan.adapter,
+    installationType: plan.installationType,
+    targetRoot: plan.targetRoot,
+    graphLockDigest: graphLockDigest ?? null,
+    hasBlockingChanges: plan.hasBlockingChanges,
+    summary: planReportSummary(plan),
+    operations: sortedPlanOperations(plan.operations).map(planReportOperation)
+  };
+}
+function comparePlanReportTargets(a, b) {
+  return a.adapter.localeCompare(b.adapter) || a.installationType.localeCompare(b.installationType) || a.targetRoot.localeCompare(b.targetRoot);
+}
+function planReportSummary(plan) {
+  const summary = summarizePlan(plan);
+  return {
+    create: summary.create,
+    update: summary.update,
+    skip: summary.skip,
+    remove: summary.remove,
+    keep: summary.keep,
+    drift: summary.drift,
+    conflict: summary.conflict,
+    plugin: summary.plugin
+  };
+}
+function planReportOperation(operation) {
+  return {
+    action: operation.action,
+    channel: operation.channel,
+    artifactType: operation.artifactType,
+    artifactName: operation.artifactName,
+    logicalSelector: operation.logicalSelector ?? null,
+    relativeDestPath: operation.relativeDestPath,
+    reason: operation.reason,
+    packageName: operation.packageName ?? null,
+    owners: operation.owners ?? [],
+    graphNodeId: operation.graphNodeId ?? null,
+    dependencyRole: operation.dependencyRole ?? null,
+    blockedReason: operation.blockedReason ?? null
+  };
+}
 function formatSemanticCommandSuffix(operation) {
   const commands = semanticCommandsForOperation(operation);
   return commands.length > 0 ? ` :: ${commands.map((command) => command.join(" ")).join(" && ")}` : "";
@@ -4368,6 +4683,7 @@ function sortedPlanOperations(operations) {
 function formatGraphPlan(result) {
   const lines = [
     ...formatDependencyTree(result.graph),
+    ...formatSelectionImports(result.graph),
     `LOCK    ${result.graphLockPath} (${result.graphLockDigest})`
   ];
   if (result.recoveredPendingApply) {
@@ -4411,6 +4727,20 @@ function formatDependencyTree(graph) {
   }
   return lines;
 }
+function formatSelectionImports(graph) {
+  const lines = [];
+  for (const root of graph.roots) {
+    const selection = root.selectionImport;
+    if (!selection) continue;
+    lines.push(
+      `IMPORT  root=${root.rootId} source=${root.normalizedSource} config=${selection.configPath} configSha256=${selection.configHash} export=${selection.exportName} exportSha256=${selection.exportHash} extends=[${selection.extends.join(",")}]`
+    );
+    lines.push(
+      `SELECT  root=${root.rootId} inherited=[${selection.inherited.join(",")}] add=[${selection.additions.join(",")}] exclude=[${selection.exclusions.join(",")}] effective=[${selection.effective.join(",")}]`
+    );
+  }
+  return lines;
+}
 function formatLockDependencyTree(lock) {
   const depths = lockNodeDepths(lock);
   const lines = ["Dependency graph"];
@@ -4420,6 +4750,16 @@ function formatLockDependencyTree(lock) {
     const requiredBy = node.requiredBy.length > 0 ? node.requiredBy.join(",") : "<root>";
     lines.push(`${label.padEnd(7)} ${node.id} source=${node.normalizedSource} selected=[${selected}] requiredBy=[${requiredBy}]`);
   }
+  for (const root of lock.canonical.roots) {
+    const selection = root.selectionImport;
+    if (!selection) continue;
+    lines.push(
+      `IMPORT  root=${root.rootId} source=${root.normalizedSource} config=${selection.configPath} configSha256=${selection.configHash} export=${selection.exportName} exportSha256=${selection.exportHash} extends=[${selection.extends.join(",")}]`
+    );
+    lines.push(
+      `SELECT  root=${root.rootId} inherited=[${selection.inherited.join(",")}] add=[${selection.additions.join(",")}] exclude=[${selection.exclusions.join(",")}] effective=[${selection.effective.join(",")}]`
+    );
+  }
   for (const edge of lock.canonical.edges) {
     const selected = edge.selected.length > 0 ? edge.selected.join(",") : "<none>";
     lines.push(`EDGE    ${edge.from} --${edge.alias}--> ${edge.to} selected=[${selected}]`);
@@ -4511,124 +4851,607 @@ function ownerChains(lock, nodeId) {
   return incoming.flatMap((edge) => ownerChains(lock, edge.from).map((chain) => [...chain, `${edge.alias}:${nodeId}`]));
 }
 
-// src/source/clawhub.ts
-import { mkdir as mkdir11, rm as rm5, writeFile as writeFile13 } from "fs/promises";
-import { basename as basename10, dirname as dirname14, join as join20, resolve as resolve6 } from "path";
-
-// src/source/local.ts
-import { createHash as createHash4 } from "crypto";
-import { readdir, stat as stat3 } from "fs/promises";
-import { basename as basename9, join as join19, relative as relative4, resolve as resolve5 } from "path";
-
-// src/model/package.ts
-import { readFile as readFile16 } from "fs/promises";
-import { join as join18 } from "path";
-import { parse as parse3, printParseErrorCode as printParseErrorCode2 } from "jsonc-parser";
-import { z as z5 } from "zod";
-var legacyArtifactTypeSchema = z5.enum([
-  "instructions",
-  "rules",
-  "skills",
-  "commands",
-  "subagents",
-  "mcp",
-  "hooks",
-  "settings",
-  "plugins"
-]);
-var runtimeListSchema = z5.array(z5.string().min(1));
-var packageProvideBaseSchema = z5.object({
-  path: z5.string().min(1),
-  format: artifactFormatSchema.optional(),
-  assets: z5.array(packageAssetSchema).optional(),
-  required: z5.boolean().optional()
-});
-var packageItemSchema = z5.object({
-  format: artifactFormatSchema.optional(),
-  requires: z5.array(packageItemRequireSchema).optional(),
-  suggests: z5.array(packageItemSuggestSchema).optional(),
-  compose: z5.array(packageComposeEntrySchema).optional(),
-  runtimes: runtimeListSchema.optional()
-});
-var packageDependencySchema = z5.object({
-  source: z5.string().min(1),
-  ref: z5.string().min(1).optional(),
-  version: z5.string().min(1).optional(),
-  select: z5.array(z5.string().min(1)).optional(),
-  mode: z5.enum(["pinned", "tracking"]).optional(),
-  optional: z5.boolean().optional(),
-  integrity: z5.string().min(1).optional(),
-  runtimes: runtimeListSchema.optional()
-});
-var packageSuggestionSchema = packageDependencySchema.extend({
-  reason: z5.string().min(1).optional(),
-  when: z5.string().min(1).optional()
-});
-var packageProvideV1Schema = packageProvideBaseSchema.extend({
-  type: legacyArtifactTypeSchema
-});
-var packageProvideSchema = packageProvideBaseSchema.extend({
-  type: artifactTypeSchema,
-  runtimes: runtimeListSchema.optional(),
-  items: z5.record(z5.string().min(1), packageItemSchema).optional()
-});
-var packageManifestV1Schema = z5.object({
-  schemaVersion: z5.literal(1),
-  name: z5.string().min(1),
-  version: z5.string().min(1),
-  provides: z5.array(packageProvideV1Schema).min(1)
-});
-var packageManifestV2Schema = z5.object({
-  schemaVersion: z5.literal(2),
-  name: z5.string().min(1),
-  version: z5.string().min(1),
-  runtimes: runtimeListSchema.optional(),
-  requires: z5.record(z5.string().min(1), packageDependencySchema).optional(),
-  suggests: z5.record(z5.string().min(1), packageSuggestionSchema).optional(),
-  compose: z5.array(packageComposeEntrySchema).optional(),
-  provides: z5.array(packageProvideSchema).default([])
-}).superRefine((manifest, ctx) => {
-  const hasProvides = manifest.provides.length > 0;
-  const hasRequires = Object.keys(manifest.requires ?? {}).length > 0;
-  if (!hasProvides && !hasRequires) {
-    ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
-      path: ["provides"],
-      message: "OpenPack v2 manifest must declare at least one provides entry or one requires dependency"
-    });
+// src/cli/render.ts
+function renderReport(report, format) {
+  if (format === "json") return renderJson(report);
+  if (format === "mermaid") return renderMermaid(report);
+  return renderHtml(report);
+}
+function renderJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+function renderMermaid(report) {
+  const packageNames = sortedPackageNames(report);
+  const packageIds = new Map(packageNames.map((name, index) => [name, `pkg_${index}`]));
+  const targetIds = new Map(report.targets.map((target, index) => [targetKey(target, index), `rt_${index}`]));
+  const edges = mermaidEdges(report, packageIds, targetIds);
+  const targetHealth = new Map(report.targets.map((target, index) => [
+    `rt_${index}`,
+    healthForOperations(target.operations)
+  ]));
+  const packageHealth = new Map(packageNames.map((name) => [
+    packageIds.get(name),
+    worstHealth(edges.filter((edge) => edge.packageName === name).map((edge) => edge.health))
+  ]));
+  const lines = [
+    "flowchart LR",
+    "  classDef ok fill:#dff5e3,stroke:#2f7d4f,color:#173a25",
+    "  classDef pending fill:#e5f0ff,stroke:#3367b0,color:#17345f",
+    "  classDef warn fill:#fff3cd,stroke:#9a6a00,color:#4f3600",
+    "  classDef bad fill:#fde2e1,stroke:#b42318,color:#5f1712"
+  ];
+  for (const [index, target] of report.targets.entries()) {
+    lines.push(`  rt_${index}["${escapeMermaidLabel(`${target.adapter}/${target.installationType}`)}"]`);
   }
-});
-var packageManifestSchema = z5.union([packageManifestV1Schema, packageManifestV2Schema]);
-var openPackManifestNames = ["openpack.json", "openpack.jsonc"];
-var legacyPackageManifestNames = ["agentwheel.json", "agentwheel.jsonc"];
-var packageManifestNames = [...openPackManifestNames, ...legacyPackageManifestNames];
-var warnedLegacyManifestPaths = /* @__PURE__ */ new Set();
-async function findPackageManifestPath(root, options = {}) {
-  for (const name of packageManifestNames) {
-    const candidate = join18(root, name);
-    if (!await pathExists(candidate)) continue;
-    if (isLegacyPackageManifestName(name) && options.warnLegacy !== false && !warnedLegacyManifestPaths.has(candidate)) {
-      warnedLegacyManifestPaths.add(candidate);
-      (options.warn ?? console.warn)(`Deprecated package manifest ${name}; use openpack.json or openpack.jsonc.`);
-    }
-    return candidate;
+  for (const name of packageNames) {
+    lines.push(`  ${packageIds.get(name)}["${escapeMermaidLabel(name)}"]`);
   }
-  return void 0;
-}
-async function readPackageManifest(root) {
-  const path = await findPackageManifestPath(root);
-  if (!path) return void 0;
-  const content = await readFile16(path, "utf8");
-  const errors = [];
-  const parsed = parse3(content, errors, { allowTrailingComma: true, disallowComments: false });
-  if (errors.length > 0) {
-    const details = errors.map((error) => `${printParseErrorCode2(error.error)} at offset ${error.offset}`).join(", ");
-    throw new Error(`Invalid package manifest ${path}: ${details}`);
+  for (const edge of edges) {
+    const label = edge.operationCount === 1 ? "1 op" : `${edge.operationCount} ops`;
+    lines.push(`  ${edge.packageId} ${edge.id}@-->|${label}| ${edge.targetId}`);
+  }
+  for (const [id, health] of [...targetHealth.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    lines.push(`  class ${id} ${health}`);
+  }
+  for (const [id, health] of [...packageHealth.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    lines.push(`  class ${id} ${health}`);
+  }
+  for (const edge of edges) {
+    lines.push(`  class ${edge.id} ${edge.health}`);
+  }
+  return lines.join("\n");
+}
+function renderHtml(report, options = {}) {
+  const assets = options.assets ?? "inline";
+  const mermaid = renderMermaid(report);
+  const totals = reportTotals(report);
+  const linkedScript = assets === "linked" ? '\n<script src="mermaid.js"></script>\n<script>if (window.mermaid) { window.mermaid.initialize({ startOnLoad: true }); }</script>' : "";
+  const targetSections = report.targets.map((target, index) => renderTargetSection(target, index)).join("\n");
+  const warnings = report.warnings.length > 0 ? `<section class="panel"><h2>Warnings</h2><ul>${report.warnings.map((warning) => `<li>${escapeHtml(warning)}</li>`).join("")}</ul></section>` : "";
+  return [
+    "<!doctype html>",
+    '<html lang="en">',
+    "<head>",
+    '<meta charset="utf-8">',
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    "<title>Agentwheel Plan Report</title>",
+    `<style>${htmlStyles()}</style>`,
+    "</head>",
+    "<body>",
+    "<main>",
+    '<header class="hero">',
+    "<h1>Agentwheel Plan Report</h1>",
+    `<p>${totals.targets} targets, ${totals.operations} operations, ${totals.blockingTargets} blocking targets, ${report.warnings.length} warnings</p>`,
+    "</header>",
+    '<section class="totals" aria-label="Plan totals">',
+    ...summaryItems(totals.summary).map(([name, value]) => `<div><span>${escapeHtml(name)}</span><strong>${value}</strong></div>`),
+    "</section>",
+    warnings,
+    targetSections,
+    '<details class="panel diagram" open>',
+    "<summary>Mermaid source</summary>",
+    `<pre class="mermaid">${escapeHtml(mermaid)}</pre>`,
+    "</details>",
+    "</main>",
+    linkedScript,
+    "</body>",
+    "</html>"
+  ].filter(Boolean).join("\n");
+}
+function renderTargetSection(target, index) {
+  return [
+    `<section class="panel target ${target.hasBlockingChanges ? "is-blocking" : ""}">`,
+    "<header>",
+    `<h2>${escapeHtml(target.adapter)}/${escapeHtml(target.installationType)}</h2>`,
+    `<p>${escapeHtml(target.targetRoot)}</p>`,
+    "</header>",
+    '<div class="summary">',
+    ...summaryItems(target.summary).map(([name, value]) => `<span><b>${value}</b> ${escapeHtml(name)}</span>`),
+    "</div>",
+    "<table>",
+    "<thead><tr><th>Action</th><th>Channel</th><th>Artifact</th><th>Path</th><th>Reason</th></tr></thead>",
+    `<tbody>${target.operations.map((operation) => renderOperationRow(operation)).join("")}</tbody>`,
+    "</table>",
+    `<p class="digest">Target ${index + 1} lock: ${escapeHtml(target.graphLockDigest ?? "none")}</p>`,
+    "</section>"
+  ].join("\n");
+}
+function renderOperationRow(operation) {
+  const artifact = `${operation.artifactType}/${operation.artifactName}`;
+  return [
+    `<tr class="health-${healthForAction(operation.action)}">`,
+    `<td>${escapeHtml(operation.action)}</td>`,
+    `<td>${escapeHtml(operation.channel)}</td>`,
+    `<td>${escapeHtml(artifact)}</td>`,
+    `<td><code>${escapeHtml(operation.relativeDestPath)}</code></td>`,
+    `<td>${escapeHtml(operation.reason)}</td>`,
+    "</tr>"
+  ].join("");
+}
+function mermaidEdges(report, packageIds, targetIds) {
+  const edgeGroups = /* @__PURE__ */ new Map();
+  for (const [targetIndex, target] of report.targets.entries()) {
+    const targetId = targetIds.get(targetKey(target, targetIndex));
+    const operationsByPackage = /* @__PURE__ */ new Map();
+    for (const operation of target.operations) {
+      const name = operation.packageName ?? "(unowned)";
+      operationsByPackage.set(name, [...operationsByPackage.get(name) ?? [], operation]);
+    }
+    for (const [packageName, operations] of operationsByPackage) {
+      edgeGroups.set(`${packageName}\0${targetId}`, { packageName, targetId, operations });
+    }
+  }
+  return [...edgeGroups.values()].sort((a, b) => a.packageName.localeCompare(b.packageName) || a.targetId.localeCompare(b.targetId)).map((edge, index) => ({
+    id: `edge_${index}`,
+    packageName: edge.packageName,
+    packageId: packageIds.get(edge.packageName),
+    targetId: edge.targetId,
+    operationCount: edge.operations.length,
+    health: healthForOperations(edge.operations)
+  }));
+}
+function sortedPackageNames(report) {
+  const names = /* @__PURE__ */ new Set();
+  for (const target of report.targets) {
+    for (const operation of target.operations) {
+      names.add(operation.packageName ?? "(unowned)");
+    }
+  }
+  return [...names].sort((a, b) => a.localeCompare(b));
+}
+function targetKey(target, index) {
+  return `${index}\0${target.adapter}\0${target.installationType}\0${target.targetRoot}`;
+}
+function healthForOperations(operations) {
+  return worstHealth(operations.map((operation) => healthForAction(operation.action)));
+}
+function worstHealth(healths) {
+  return healths.sort((a, b) => healthRank(b) - healthRank(a))[0] ?? "ok";
+}
+function healthForAction(action) {
+  if (action === "conflict" || action === "remove") return "bad";
+  if (action === "drift") return "warn";
+  if (action === "create" || action === "update" || action === "plugin" || action === "program") return "pending";
+  return "ok";
+}
+function healthRank(health) {
+  return { ok: 0, pending: 1, warn: 2, bad: 3 }[health];
+}
+function reportTotals(report) {
+  const summary = {
+    create: 0,
+    update: 0,
+    skip: 0,
+    remove: 0,
+    keep: 0,
+    drift: 0,
+    conflict: 0,
+    plugin: 0
+  };
+  let operations = 0;
+  for (const target of report.targets) {
+    operations += target.operations.length;
+    for (const [name] of summaryItems(target.summary)) {
+      summary[name] += target.summary[name];
+    }
+  }
+  return {
+    targets: report.targets.length,
+    operations,
+    blockingTargets: report.targets.filter((target) => target.hasBlockingChanges).length,
+    summary
+  };
+}
+function summaryItems(summary) {
+  return [
+    ["create", summary.create],
+    ["update", summary.update],
+    ["skip", summary.skip],
+    ["remove", summary.remove],
+    ["keep", summary.keep],
+    ["drift", summary.drift],
+    ["conflict", summary.conflict],
+    ["plugin", summary.plugin]
+  ];
+}
+function escapeMermaidLabel(value) {
+  return value.replaceAll("\\", "\\\\").replaceAll('"', "#quot;").replaceAll("\n", " ");
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function htmlStyles() {
+  return `
+:root { color-scheme: light dark; --bg: #f7f8fb; --panel: #ffffff; --text: #1d2433; --muted: #617086; --line: #d8dee9; --ok: #e7f6ec; --pending: #e7f0ff; --warn: #fff4d8; --bad: #ffe6e4; }
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--bg); color: var(--text); font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+main { width: min(1180px, calc(100% - 32px)); margin: 0 auto; padding: 32px 0; }
+.hero { margin-bottom: 20px; }
+h1, h2, p { margin: 0; }
+h1 { font-size: 28px; line-height: 1.2; }
+h2 { font-size: 18px; line-height: 1.3; }
+.hero p, .target header p, .digest { color: var(--muted); margin-top: 6px; }
+.totals { display: grid; grid-template-columns: repeat(auto-fit, minmax(118px, 1fr)); gap: 8px; margin-bottom: 16px; }
+.totals div, .summary span { border: 1px solid var(--line); background: var(--panel); border-radius: 6px; padding: 8px 10px; }
+.totals span { display: block; color: var(--muted); font-size: 12px; text-transform: uppercase; }
+.totals strong { display: block; font-size: 20px; margin-top: 2px; }
+.panel { background: var(--panel); border: 1px solid var(--line); border-radius: 8px; padding: 16px; margin: 16px 0; overflow: auto; }
+.target.is-blocking { border-color: #c23a31; }
+.summary { display: flex; flex-wrap: wrap; gap: 8px; margin: 14px 0; }
+.summary span { font-size: 13px; }
+table { width: 100%; border-collapse: collapse; min-width: 760px; }
+th, td { border-bottom: 1px solid var(--line); padding: 8px; text-align: left; vertical-align: top; font-size: 13px; }
+th { color: var(--muted); font-size: 12px; text-transform: uppercase; }
+code, pre { font-family: "SFMono-Regular", Consolas, "Liberation Mono", monospace; }
+pre { white-space: pre-wrap; margin: 12px 0 0; padding: 12px; border: 1px solid var(--line); border-radius: 6px; background: color-mix(in srgb, var(--panel), var(--bg) 55%); }
+summary { cursor: pointer; font-weight: 700; }
+.health-ok { background: var(--ok); }
+.health-pending { background: var(--pending); }
+.health-warn { background: var(--warn); }
+.health-bad { background: var(--bad); }
+@media (prefers-color-scheme: dark) {
+  :root { --bg: #11151d; --panel: #191f2b; --text: #edf1f7; --muted: #a6b1c2; --line: #323b4f; --ok: #173824; --pending: #172d4f; --warn: #44330d; --bad: #4d1d1a; }
+}
+`.trim();
+}
+
+// src/cli/serve.ts
+import { createHash as createHash4 } from "crypto";
+import { createReadStream } from "fs";
+import { createRequire } from "module";
+import { isIP } from "net";
+import { createServer } from "http";
+var DEFAULT_BIND = "127.0.0.1";
+var DEFAULT_PORT = 8765;
+var DEFAULT_INTERVAL_SECONDS = 60;
+var require2 = createRequire(import.meta.url);
+async function servePlanDashboard(options) {
+  const bind = options.bind ?? DEFAULT_BIND;
+  const port = options.port ?? DEFAULT_PORT;
+  const intervalSeconds = options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS;
+  const log = options.log ?? console.log;
+  const warn = options.warn ?? console.warn;
+  const errorLog = options.error ?? console.error;
+  if (!isLoopbackBind(bind)) {
+    warn(`WARNING: agentwheel serve is bound to ${bind}; this unauthenticated dashboard may expose runtime topology on a non-local interface.`);
+  }
+  let cache = await buildServeCache(options.buildReport);
+  let refreshing = false;
+  let timer;
+  const server = createServer((request, response) => {
+    void handleRequest(request, response, () => cache);
+  });
+  await listen(server, port, bind);
+  const address = server.address();
+  log(`Serving agentwheel plan report at ${servedUrl(address, bind, port)}`);
+  if (!options.once) {
+    timer = setInterval(() => {
+      if (refreshing) return;
+      refreshing = true;
+      void buildServeCache(options.buildReport).then((nextCache) => {
+        cache = nextCache;
+      }).catch((error) => {
+        const message = errorMessage2(error);
+        errorLog(`agentwheel serve refresh failed: ${message}`);
+        cache = {
+          ...cache,
+          mermaidAvailable: mermaidAssetAvailable(),
+          html: decorateServedHtml(cache.baseHtml, {
+            version: cache.version,
+            mermaidAvailable: mermaidAssetAvailable(),
+            lastError: message
+          })
+        };
+      }).finally(() => {
+        refreshing = false;
+      });
+    }, intervalSeconds * 1e3);
+    timer.unref?.();
+  }
+  await waitForShutdown(server, () => {
+    if (timer) clearInterval(timer);
+  });
+}
+function parseServePort(value) {
+  if (value === void 0) return DEFAULT_PORT;
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error(`Invalid --port value: ${value}. Expected an integer from 0 to 65535.`);
+  }
+  return port;
+}
+function parseServeIntervalSeconds(value) {
+  if (value === void 0) return DEFAULT_INTERVAL_SECONDS;
+  const seconds = Number(value);
+  if (!Number.isFinite(seconds) || seconds <= 0) {
+    throw new Error(`Invalid --interval value: ${value}. Expected a positive number of seconds.`);
+  }
+  return seconds;
+}
+function isLoopbackBind(bind) {
+  const normalized = bind.trim().toLowerCase();
+  if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]" || normalized === "0:0:0:0:0:0:0:1") return true;
+  if (isIP(normalized) === 4) return normalized.startsWith("127.");
+  return false;
+}
+function resolveMermaidAssetPath() {
+  try {
+    return require2.resolve("mermaid/dist/mermaid.min.js");
+  } catch {
+    return void 0;
+  }
+}
+async function buildServeCache(buildReport) {
+  const report = await buildReport();
+  const json = `${renderJson(report)}
+`;
+  const version = createHash4("sha256").update(json).digest("hex");
+  const baseHtml = renderHtml(report, { assets: "linked" });
+  const mermaidAvailable = mermaidAssetAvailable();
+  return {
+    json,
+    version,
+    baseHtml,
+    mermaidAvailable,
+    html: decorateServedHtml(baseHtml, { version, mermaidAvailable })
+  };
+}
+function mermaidAssetAvailable() {
+  return resolveMermaidAssetPath() !== void 0;
+}
+async function handleRequest(request, response, cacheForRequest) {
+  if (request.method !== "GET") {
+    writeText(response, 404, "Not found\n");
+    return;
+  }
+  const url = new URL(request.url ?? "/", "http://agentwheel.local");
+  const cache = cacheForRequest();
+  if (url.pathname === "/") {
+    response.writeHead(200, {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    response.end(cache.html);
+    return;
+  }
+  if (url.pathname === "/report.json") {
+    response.writeHead(200, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    response.end(cache.json);
+    return;
+  }
+  if (url.pathname === "/version") {
+    writeText(response, 200, `${cache.version}
+`);
+    return;
+  }
+  if (url.pathname === "/mermaid.js") {
+    await writeMermaidAsset(response);
+    return;
+  }
+  writeText(response, 404, "Not found\n");
+}
+function writeText(response, statusCode, body) {
+  response.writeHead(statusCode, {
+    "content-type": "text/plain; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  response.end(body);
+}
+async function writeMermaidAsset(response) {
+  const assetPath = resolveMermaidAssetPath();
+  if (!assetPath) {
+    writeText(response, 404, "Mermaid is not installed. Install mermaid to render the diagram.\n");
+    return;
+  }
+  response.writeHead(200, {
+    "content-type": "application/javascript; charset=utf-8",
+    "cache-control": "public, max-age=3600"
+  });
+  await new Promise((resolve21) => {
+    const stream = createReadStream(assetPath);
+    stream.on("error", () => {
+      if (!response.headersSent) writeText(response, 404, "Mermaid asset unavailable.\n");
+      else response.destroy();
+      resolve21();
+    });
+    stream.on("end", resolve21);
+    stream.pipe(response);
+  });
+}
+function decorateServedHtml(html, options) {
+  const notes = [
+    options.mermaidAvailable ? "" : '<section class="panel serve-note"><strong>Diagram rendering unavailable.</strong> Install <code>mermaid</code> to render the diagram.</section>',
+    options.lastError ? `<section class="panel serve-error" role="alert"><strong>Last refresh failed.</strong> ${escapeHtml2(options.lastError)}</section>` : ""
+  ].filter(Boolean).join("\n");
+  const withNotes = notes ? injectBefore(html, "</main>", `${notes}
+`) : html;
+  return injectBefore(withNotes, "</body>", `${livenessScript(options.version)}
+`);
+}
+function livenessScript(version) {
+  return `<script>(()=>{const current=${JSON.stringify(version)};async function check(){try{const response=await fetch("/version",{cache:"no-store"});if(!response.ok)return;const next=(await response.text()).trim();if(next&&next!==current)location.reload();}catch{}}setInterval(check,5000);})();</script>`;
+}
+function injectBefore(value, marker, insertion) {
+  const index = value.lastIndexOf(marker);
+  if (index === -1) return `${value}
+${insertion}`;
+  return `${value.slice(0, index)}${insertion}${value.slice(index)}`;
+}
+function escapeHtml2(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function listen(server, port, bind) {
+  return new Promise((resolve21, reject) => {
+    const onError = (error) => {
+      server.off("listening", onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve21();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, bind);
+  });
+}
+function waitForShutdown(server, beforeClose) {
+  return new Promise((resolve21) => {
+    let closing = false;
+    const shutdown = () => {
+      if (closing) return;
+      closing = true;
+      process.off("SIGINT", shutdown);
+      process.off("SIGTERM", shutdown);
+      beforeClose();
+      server.close(() => resolve21());
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+    server.once("close", () => {
+      if (closing) return;
+      closing = true;
+      process.off("SIGINT", shutdown);
+      process.off("SIGTERM", shutdown);
+      beforeClose();
+      resolve21();
+    });
+  });
+}
+function servedUrl(address, bind, requestedPort) {
+  if (typeof address === "object" && address) {
+    return `http://${formatUrlHost(address.address || bind)}:${address.port}/`;
+  }
+  return `http://${formatUrlHost(bind)}:${requestedPort}/`;
+}
+function formatUrlHost(host) {
+  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/source/clawhub.ts
+import { mkdir as mkdir12, rm as rm5, writeFile as writeFile14 } from "fs/promises";
+import { basename as basename10, dirname as dirname15, join as join20, resolve as resolve6 } from "path";
+
+// src/source/local.ts
+import { createHash as createHash5 } from "crypto";
+import { readdir, stat as stat3 } from "fs/promises";
+import { basename as basename9, join as join19, relative as relative4, resolve as resolve5 } from "path";
+
+// src/model/package.ts
+import { readFile as readFile17 } from "fs/promises";
+import { join as join18 } from "path";
+import { parse as parse4, printParseErrorCode as printParseErrorCode2 } from "jsonc-parser";
+import { z as z5 } from "zod";
+var legacyArtifactTypeSchema = z5.enum([
+  "instructions",
+  "rules",
+  "skills",
+  "commands",
+  "subagents",
+  "mcp",
+  "hooks",
+  "settings",
+  "plugins"
+]);
+var runtimeListSchema = z5.array(z5.string().min(1));
+var packageProvideBaseSchema = z5.object({
+  path: z5.string().min(1),
+  format: artifactFormatSchema.optional(),
+  assets: z5.array(packageAssetSchema).optional(),
+  required: z5.boolean().optional()
+});
+var packageItemSchema = z5.object({
+  format: artifactFormatSchema.optional(),
+  requires: z5.array(packageItemRequireSchema).optional(),
+  suggests: z5.array(packageItemSuggestSchema).optional(),
+  compose: z5.array(packageComposeEntrySchema).optional(),
+  runtimes: runtimeListSchema.optional()
+});
+var packageDependencySchema = z5.object({
+  source: z5.string().min(1),
+  ref: z5.string().min(1).optional(),
+  version: z5.string().min(1).optional(),
+  select: z5.array(z5.string().min(1)).optional(),
+  mode: z5.enum(["pinned", "tracking"]).optional(),
+  optional: z5.boolean().optional(),
+  integrity: z5.string().min(1).optional(),
+  runtimes: runtimeListSchema.optional()
+});
+var packageSuggestionSchema = packageDependencySchema.extend({
+  reason: z5.string().min(1).optional(),
+  when: z5.string().min(1).optional()
+});
+var packageProvideV1Schema = packageProvideBaseSchema.extend({
+  type: legacyArtifactTypeSchema
+});
+var packageProvideSchema = packageProvideBaseSchema.extend({
+  type: artifactTypeSchema,
+  runtimes: runtimeListSchema.optional(),
+  items: z5.record(z5.string().min(1), packageItemSchema).optional()
+});
+var packageManifestV1Schema = z5.object({
+  schemaVersion: z5.literal(1),
+  name: z5.string().min(1),
+  version: z5.string().min(1),
+  provides: z5.array(packageProvideV1Schema).min(1)
+});
+var packageManifestV2Schema = z5.object({
+  schemaVersion: z5.literal(2),
+  name: z5.string().min(1),
+  version: z5.string().min(1),
+  runtimes: runtimeListSchema.optional(),
+  requires: z5.record(z5.string().min(1), packageDependencySchema).optional(),
+  suggests: z5.record(z5.string().min(1), packageSuggestionSchema).optional(),
+  compose: z5.array(packageComposeEntrySchema).optional(),
+  provides: z5.array(packageProvideSchema).default([])
+}).superRefine((manifest, ctx) => {
+  const hasProvides = manifest.provides.length > 0;
+  const hasRequires = Object.keys(manifest.requires ?? {}).length > 0;
+  if (!hasProvides && !hasRequires) {
+    ctx.addIssue({
+      code: z5.ZodIssueCode.custom,
+      path: ["provides"],
+      message: "OpenPack v2 manifest must declare at least one provides entry or one requires dependency"
+    });
+  }
+});
+var packageManifestSchema = z5.union([packageManifestV1Schema, packageManifestV2Schema]);
+var openPackManifestNames = ["openpack.json", "openpack.jsonc"];
+var legacyPackageManifestNames = ["agentwheel.json", "agentwheel.jsonc"];
+var packageManifestNames = [...openPackManifestNames, ...legacyPackageManifestNames];
+var warnedLegacyManifestPaths = /* @__PURE__ */ new Set();
+async function findPackageManifestPath(root, options = {}) {
+  for (const name of packageManifestNames) {
+    const candidate = join18(root, name);
+    if (!await pathExists(candidate)) continue;
+    if (isLegacyPackageManifestName(name) && options.warnLegacy !== false && !warnedLegacyManifestPaths.has(candidate)) {
+      warnedLegacyManifestPaths.add(candidate);
+      (options.warn ?? console.warn)(`Deprecated package manifest ${name}; use openpack.json or openpack.jsonc.`);
+    }
+    return candidate;
+  }
+  return void 0;
+}
+async function readPackageManifest(root) {
+  const path = await findPackageManifestPath(root);
+  if (!path) return void 0;
+  const content = await readFile17(path, "utf8");
+  const errors = [];
+  const parsed = parse4(content, errors, { allowTrailingComma: true, disallowComments: false });
+  if (errors.length > 0) {
+    const details = errors.map((error) => `${printParseErrorCode2(error.error)} at offset ${error.offset}`).join(", ");
+    throw new Error(`Invalid package manifest ${path}: ${details}`);
   }
   return parsePackageManifest(parsed, path);
 }
 function parsePackageManifest(parsed, path = "package manifest") {
-  if (!isRecord6(parsed)) {
+  if (!isRecord7(parsed)) {
     throw new Error(`Invalid package manifest ${path}: expected an object`);
   }
   if (parsed.schemaVersion === 1) {
@@ -4656,7 +5479,7 @@ function v1OpenPackViolations(manifest) {
   }
   const provides = Array.isArray(manifest.provides) ? manifest.provides : [];
   for (const [index, provide] of provides.entries()) {
-    if (!isRecord6(provide)) continue;
+    if (!isRecord7(provide)) continue;
     if (provide.type === "fragments") violations.push(`provides[${index}].type=fragments`);
     for (const key of ["format", "items", "compose", "runtimes"]) {
       if (Object.prototype.hasOwnProperty.call(provide, key)) violations.push(`provides[${index}].${key}`);
@@ -4667,7 +5490,7 @@ function v1OpenPackViolations(manifest) {
 function isLegacyPackageManifestName(name) {
   return legacyPackageManifestNames.includes(name);
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -4811,7 +5634,7 @@ var LocalSourceDriver = class {
 };
 async function hashLocalSource(root, manifest) {
   if (!manifest) return hashPath(root);
-  const hash = createHash4("sha256").update("local-openpack\0");
+  const hash = createHash5("sha256").update("local-openpack\0");
   const manifestPath = await findPackageManifestPath(root, { warnLegacy: false });
   if (manifestPath) {
     hash.update("manifest\0");
@@ -5046,8 +5869,8 @@ async function writeGeneratedPackage(root, packageInfo) {
   };
   const pluginPath = join20(root, "plugins", pluginId, "clawhub.json");
   await rm5(root, { recursive: true, force: true });
-  await mkdir11(dirname14(pluginPath), { recursive: true });
-  await writeFile13(join20(root, "openpack.json"), `${JSON.stringify({
+  await mkdir12(dirname15(pluginPath), { recursive: true });
+  await writeFile14(join20(root, "openpack.json"), `${JSON.stringify({
     schemaVersion: 2,
     name: `clawhub/${name}`,
     version: packageInfo.latestVersion ?? "latest",
@@ -5063,7 +5886,7 @@ async function writeGeneratedPackage(root, packageInfo) {
     ]
   }, null, 2)}
 `, "utf8");
-  await writeFile13(pluginPath, `${JSON.stringify(plugin, null, 2)}
+  await writeFile14(pluginPath, `${JSON.stringify(plugin, null, 2)}
 `, "utf8");
 }
 function installNameFor2(value) {
@@ -5077,9 +5900,9 @@ function cachePathFor(packageName, cacheRoot) {
 
 // src/source/git.ts
 import { execFile as execFile4 } from "child_process";
-import { cp as cp2, mkdir as mkdir12, rename as rename3, rm as rm6, writeFile as writeFile14 } from "fs/promises";
+import { cp as cp2, mkdir as mkdir13, rename as rename3, rm as rm6, writeFile as writeFile15 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { basename as basename11, dirname as dirname15, join as join21, resolve as resolve7 } from "path";
+import { basename as basename11, dirname as dirname16, join as join21, resolve as resolve7 } from "path";
 import { promisify as promisify4 } from "util";
 var execFileAsync4 = promisify4(execFile4);
 var GitSourceDriver = class {
@@ -5102,7 +5925,7 @@ var GitSourceDriver = class {
   async fetch(resolved) {
     return withFilesystemLock(`${resolved.resolvedPath}.lock`, resolved.cacheLockTimeoutMs ?? 3e4, async () => {
       const parsed = parseGitSource(resolved.source);
-      await mkdir12(resolve7(resolved.resolvedPath, ".."), { recursive: true });
+      await mkdir13(resolve7(resolved.resolvedPath, ".."), { recursive: true });
       if (!await pathExists(join21(resolved.resolvedPath, ".git"))) {
         if (resolved.frozenLock) {
           throw new Error(`Frozen lock requires cached git checkout at ${resolved.resolvedPath}`);
@@ -5178,9 +6001,9 @@ async function git(args) {
   return execFileAsync4("git", args, { maxBuffer: 1024 * 1024 * 10 });
 }
 async function snapshotCheckout(checkoutPath, commit) {
-  const snapshotPath = join21(dirname15(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
+  const snapshotPath = join21(dirname16(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
   if (await pathExists(snapshotPath)) return snapshotPath;
-  const tempPath = join21(dirname15(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
+  const tempPath = join21(dirname16(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
   await rm6(tempPath, { recursive: true, force: true });
   await cp2(checkoutPath, tempPath, { recursive: true, dereference: true });
   await rm6(join21(tempPath, ".git"), { recursive: true, force: true });
@@ -5194,12 +6017,12 @@ async function snapshotCheckout(checkoutPath, commit) {
   return snapshotPath;
 }
 async function withFilesystemLock(lockPath, timeoutMs, fn) {
-  await mkdir12(dirname15(lockPath), { recursive: true });
+  await mkdir13(dirname16(lockPath), { recursive: true });
   const started = Date.now();
   while (true) {
     try {
-      await mkdir12(lockPath);
-      await writeFile14(join21(lockPath, "owner.json"), JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
+      await mkdir13(lockPath);
+      await writeFile15(join21(lockPath, "owner.json"), JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
       break;
     } catch (error) {
       if (!isAlreadyExists2(error)) throw error;
@@ -5220,8 +6043,8 @@ function isAlreadyExists2(error) {
 }
 
 // src/source/mcp-registry.ts
-import { mkdir as mkdir13, writeFile as writeFile15 } from "fs/promises";
-import { basename as basename12, dirname as dirname16, join as join22, resolve as resolve8 } from "path";
+import { mkdir as mkdir14, writeFile as writeFile16 } from "fs/promises";
+import { basename as basename12, dirname as dirname17, join as join22, resolve as resolve8 } from "path";
 var registryBaseUrl = "https://registry.modelcontextprotocol.io/v0.1";
 var sourcePrefix2 = "mcp-registry:";
 var McpRegistrySourceDriver = class {
@@ -5328,15 +6151,15 @@ function isSafeHttpUrl(value) {
 async function writeGeneratedPackage2(root, server) {
   const serverId = installNameFor3(server.serverName);
   const mcpPath = join22(root, "mcp", `${serverId}.json`);
-  await mkdir13(dirname16(mcpPath), { recursive: true });
-  await writeFile15(join22(root, "openpack.json"), `${JSON.stringify({
+  await mkdir14(dirname17(mcpPath), { recursive: true });
+  await writeFile16(join22(root, "openpack.json"), `${JSON.stringify({
     schemaVersion: 2,
     name: `mcp-registry/${server.serverName}`,
     version: server.version ?? "latest",
     provides: [{ type: "mcp", path: "mcp" }]
   }, null, 2)}
 `, "utf8");
-  await writeFile15(mcpPath, `${JSON.stringify({
+  await writeFile16(mcpPath, `${JSON.stringify({
     mcpServers: {
       [serverId]: {
         type: "streamable-http",
@@ -5356,14 +6179,14 @@ function cachePathFor3(serverName, cacheRoot) {
 }
 
 // src/source/skillkit.ts
-import { cp as cp3, mkdir as mkdir14, readFile as readFile17, rm as rm7 } from "fs/promises";
+import { cp as cp3, mkdir as mkdir15, readFile as readFile18, rm as rm7 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { basename as basename14, dirname as dirname18, join as join24, resolve as resolve9 } from "path";
+import { basename as basename14, dirname as dirname19, join as join24, resolve as resolve9 } from "path";
 import * as defaultSkillKit from "@skillkit/core";
 
 // src/source/skill-artifacts.ts
 import { readdir as readdir2, stat as stat4 } from "fs/promises";
-import { basename as basename13, dirname as dirname17, extname as extname2, join as join23 } from "path";
+import { basename as basename13, dirname as dirname18, extname as extname2, join as join23 } from "path";
 async function artifactsFromSkillPaths(paths, packageName) {
   const artifacts = [];
   const seen = /* @__PURE__ */ new Set();
@@ -5400,7 +6223,7 @@ async function artifactFromSkillPath(item, packageName) {
     };
   }
   if (stats.isFile() && basename13(item.path).toLowerCase() === "skill.md") {
-    const dir = dirname17(item.path);
+    const dir = dirname18(item.path);
     const name = sanitizeSkillName(item.name ?? basename13(dir));
     return {
       type: "skills",
@@ -5493,7 +6316,7 @@ var SkillKitSourceDriver = class {
     if (!provider?.clone) {
       throw new Error("SkillKit provider API unavailable or cannot resolve source. Expected @skillkit/core detectProvider().clone().");
     }
-    await mkdir14(dirname18(resolved.resolvedPath), { recursive: true });
+    await mkdir15(dirname19(resolved.resolvedPath), { recursive: true });
     const result = await provider.clone(providerSpec, resolved.resolvedPath, {});
     if (!result.success || !result.path) {
       throw new Error(`SkillKit provider failed to fetch ${spec}: ${result.error ?? "unknown error"}`);
@@ -5539,7 +6362,7 @@ var SkillKitSourceDriver = class {
     for (const skill of this.discover(resolved.resolvedPath)) {
       const skillMd = join24(skill.path, "SKILL.md");
       if (await pathExists(skillMd)) {
-        this.core.translateSkill(await readFile17(skillMd, "utf8"), "openclaw", { sourceFilename: "SKILL.md" });
+        this.core.translateSkill(await readFile18(skillMd, "utf8"), "openclaw", { sourceFilename: "SKILL.md" });
       }
     }
     return resolved;
@@ -5715,14 +6538,14 @@ function getSourceDriver(name = "local") {
 }
 
 // src/staging/staging.ts
-import { chmod, cp as cp5, mkdir as mkdir16, mkdtemp as mkdtemp3, readdir as readdir5, stat as stat8 } from "fs/promises";
-import { basename as basename18, dirname as dirname21, join as join28, relative as relative7, resolve as resolve12, sep as sep2 } from "path";
+import { chmod, cp as cp5, mkdir as mkdir17, mkdtemp as mkdtemp3, readdir as readdir5, stat as stat8 } from "fs/promises";
+import { basename as basename18, dirname as dirname22, join as join28, relative as relative7, resolve as resolve12, sep as sep2 } from "path";
 import { tmpdir as tmpdir4 } from "os";
 
 // src/compose/markdown.ts
-import { createHash as createHash5 } from "crypto";
-import { readdir as readdir3, readFile as readFile18, stat as stat6, writeFile as writeFile16 } from "fs/promises";
-import { basename as basename16, dirname as dirname19, extname as extname3, join as join26, relative as relative6, resolve as resolve11, sep } from "path";
+import { createHash as createHash6 } from "crypto";
+import { readdir as readdir3, readFile as readFile19, stat as stat6, writeFile as writeFile17 } from "fs/promises";
+import { basename as basename16, dirname as dirname20, extname as extname3, join as join26, relative as relative6, resolve as resolve11, sep } from "path";
 var includePattern = /<!--\s*openpack:include(\?)?\s+([^>]+?)\s*-->/g;
 var escapedIncludePattern = /<!--\s*openpack\\:include(\?)?\s+([^>]+?)\s*-->/g;
 var generatedPattern = /<!--\s*(?:BEGIN|END)\s+openpack:include\b/;
@@ -5732,12 +6555,13 @@ async function expandMarkdownIncludes(artifacts, packageRoot, options = {}) {
   for (const artifact of artifacts) byKey.set(artifactKey(artifact), artifact);
   const artifactPaths = artifactPathMap(artifacts);
   for (const artifact of orderedForExpansion(artifacts)) {
+    if (artifact.type === "fragments") continue;
     const files = await markdownFilesForArtifact(artifact);
     if (files.length === 0) continue;
     const composedFrom = [];
     for (const file of files) {
       const result = await expandFile(file, packageRoot, composeEntriesForFile(artifact, file), artifactPaths, options);
-      if (result.changed) await writeFile16(file, result.content, "utf8");
+      if (result.changed) await writeFile17(file, result.content, "utf8");
       composedFrom.push(...result.composedFrom);
     }
     const stagedPath = artifact.stagedPath ?? artifact.sourcePath;
@@ -5759,7 +6583,7 @@ async function validateMarkdownIncludes(artifacts, packageRoot, options = {}) {
   }
 }
 async function expandFile(file, packageRoot, appendEntries, artifactPaths, options) {
-  const raw = await readFile18(file, "utf8");
+  const raw = await readFile19(file, "utf8");
   const owner = ownerSelector(packageRoot, file, options.nodeId);
   const expanded = await expandContent(raw, packageRoot, [owner], artifactPaths, options);
   let content = expanded.content;
@@ -5852,7 +6676,7 @@ async function expandInclude(selector, packageRoot, artifactPaths, options) {
   if (!stats.isFile()) {
     throw new Error(`OpenPack include is not a file: ${displaySelector}`);
   }
-  const raw = sourceContent ?? await readFile18(sourcePath, "utf8");
+  const raw = sourceContent ?? await readFile19(sourcePath, "utf8");
   const { optional: _optional, markers: _markers, chain: _chain, ...childOptions } = options;
   const expanded = await expandContent(raw, includePackageRoot, [...options.chain, displaySelector], includeArtifactPaths, {
     ...childOptions,
@@ -5942,7 +6766,7 @@ async function listMarkdownFiles(root) {
 function composeEntriesForFile(artifact, file) {
   if (!artifact.compose?.length) return [];
   if (artifact.kind === "file") return [resolve11(artifact.stagedPath ?? artifact.sourcePath), resolve11(file)].every(Boolean) && resolve11(artifact.stagedPath ?? artifact.sourcePath) === resolve11(file) ? artifact.compose : [];
-  return basename16(file) === "SKILL.md" && dirname19(file) === resolve11(artifact.stagedPath ?? artifact.sourcePath) ? artifact.compose : [];
+  return basename16(file) === "SKILL.md" && dirname20(file) === resolve11(artifact.stagedPath ?? artifact.sourcePath) ? artifact.compose : [];
 }
 function orderedForExpansion(artifacts) {
   return [...artifacts].sort((a, b) => Number(a.type === "fragments") - Number(b.type === "fragments"));
@@ -5973,7 +6797,7 @@ function cleanSelector(value) {
   return value.trim().replace(/\s+/g, " ");
 }
 function sha256(content) {
-  return createHash5("sha256").update(content).digest("hex");
+  return createHash6("sha256").update(content).digest("hex");
 }
 function uniqueComposedFrom(entries) {
   if (entries.length === 0) return [];
@@ -5988,8 +6812,8 @@ function artifactPathMap(artifacts) {
 }
 
 // src/staging/customize.ts
-import { cp as cp4, mkdir as mkdir15, readdir as readdir4, readFile as readFile19, writeFile as writeFile17 } from "fs/promises";
-import { dirname as dirname20, join as join27 } from "path";
+import { cp as cp4, mkdir as mkdir16, readdir as readdir4, readFile as readFile20, writeFile as writeFile18 } from "fs/promises";
+import { dirname as dirname21, join as join27 } from "path";
 async function applyCustomizations(artifacts, options) {
   let next = [...artifacts];
   next = await applyReplacements2(next, options, "override", installableArtifactTypes());
@@ -6010,11 +6834,11 @@ async function applyInstructionOverlay(artifacts, options) {
   const index = artifacts.findIndex((artifact2) => artifact2.type === "instructions");
   if (index < 0) return artifacts;
   const artifact = artifacts[index];
-  const managed = await readFile19(artifact.stagedPath ?? artifact.sourcePath, "utf8");
-  const local = await readFile19(overlayPath, "utf8");
+  const managed = await readFile20(artifact.stagedPath ?? artifact.sourcePath, "utf8");
+  const local = await readFile20(overlayPath, "utf8");
   const composedPath = join27(options.stageRoot, ".agentwheel-composed", "instructions", "AGENTS.md");
-  await mkdir15(dirname20(composedPath), { recursive: true });
-  await writeFile17(
+  await mkdir16(dirname21(composedPath), { recursive: true });
+  await writeFile18(
     composedPath,
     [
       "<!-- BEGIN agentwheel managed: upstream -->",
@@ -6086,7 +6910,7 @@ async function applyReplacements2(artifacts, options, channel, artifactTypes) {
         const artifactKind = entry.isDirectory() ? "dir" : "file";
         const existing = byKey.get(artifactMapKey);
         const stagedPath = join27(options.stageRoot, ".agentwheel-composed", channel, type, entry.name);
-        await mkdir15(dirname20(stagedPath), { recursive: true });
+        await mkdir16(dirname21(stagedPath), { recursive: true });
         await cp4(full, stagedPath, { recursive: artifactKind === "dir", dereference: true });
         byKey.set(artifactMapKey, {
           ...existing,
@@ -6146,7 +6970,7 @@ async function stageResolvedArtifactsRaw(resolved, artifacts) {
   const stagedArtifacts = [];
   for (const artifact of artifacts) {
     const stagedPath = join28(root, artifact.relativePath);
-    await mkdir16(dirname21(stagedPath), { recursive: true });
+    await mkdir17(dirname22(stagedPath), { recursive: true });
     await cp5(artifact.sourcePath, stagedPath, {
       recursive: artifact.kind === "dir",
       dereference: true,
@@ -6240,7 +7064,7 @@ async function copyAsset(asset, source, dest) {
   const sourceStats = await stat8(source);
   if (sourceStats.isFile()) {
     if (matchesAny(basename18(source), asset.include)) {
-      await mkdir16(dest, { recursive: true });
+      await mkdir17(dest, { recursive: true });
       await copyAssetFile(source, join28(dest, basename18(source)), asset);
     }
     return;
@@ -6249,7 +7073,7 @@ async function copyAsset(asset, source, dest) {
     throw new Error(`Asset include source is not a file or directory: ${source}`);
   }
   if (!asset.include?.length) {
-    await mkdir16(dirname21(dest), { recursive: true });
+    await mkdir17(dirname22(dest), { recursive: true });
     await cp5(source, dest, { recursive: true, dereference: true });
     if (asset.mode === "copy") await normalizeCopiedModes(dest);
     return;
@@ -6261,7 +7085,7 @@ async function copyAsset(asset, source, dest) {
   }
 }
 async function copyAssetFile(source, dest, asset) {
-  await mkdir16(dirname21(dest), { recursive: true });
+  await mkdir17(dirname22(dest), { recursive: true });
   await cp5(source, dest, { dereference: true });
   if (asset.mode === "copy") await chmod(dest, 420);
 }
@@ -6309,11 +7133,41 @@ function matchesGlob(path, pattern) {
 }
 
 // src/model/workspace.ts
-import { readFile as readFile20 } from "fs/promises";
+import { readFile as readFile21 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname22, join as join29, resolve as resolve13 } from "path";
+import { dirname as dirname23, join as join29, resolve as resolve13 } from "path";
 import { z as z6 } from "zod";
-var workspacePackageSchema = z6.object({
+var artifactSelectorListSchema = z6.array(z6.string().min(1));
+var workspaceSelectionImportSchema = z6.object({
+  export: z6.string().min(1),
+  add: artifactSelectorListSchema.optional(),
+  exclude: artifactSelectorListSchema.optional()
+}).strict();
+var workspaceSelectionExportSchema = z6.object({
+  extends: z6.string().min(1).optional(),
+  select: artifactSelectorListSchema.optional(),
+  add: artifactSelectorListSchema.optional(),
+  exclude: artifactSelectorListSchema.optional()
+}).strict().superRefine((selection, ctx) => {
+  if (selection.extends && selection.select) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["select"],
+      message: "Selection exports may use either select or extends, not both."
+    });
+  }
+  if (!selection.extends && !selection.select) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["select"],
+      message: "Selection exports without extends require select."
+    });
+  }
+});
+var workspaceExportsSchema = z6.object({
+  selections: z6.record(z6.string().min(1), workspaceSelectionExportSchema).default({})
+}).strict();
+var workspacePackageBaseSchema = z6.object({
   name: z6.string().min(1),
   source: z6.string().min(1),
   driver: z6.enum(["local", "git", "skillkit", "vercel-skills", "mcp-registry", "clawhub"]).default("local"),
@@ -6331,6 +7185,22 @@ var workspacePackageSchema = z6.object({
   aliases: z6.record(z6.string(), z6.string().min(1)).optional(),
   overrides: z6.array(z6.string().min(1)).optional()
 });
+var workspacePackageSchema = workspacePackageBaseSchema.extend({
+  selection: workspaceSelectionImportSchema.optional()
+}).superRefine((pkg, ctx) => {
+  if (pkg.selection && (pkg.select !== void 0 || pkg.skills !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["selection"],
+      message: "Packages may use either selection or select/skills, not both."
+    });
+  }
+});
+var workspacePackageV1Schema = workspacePackageBaseSchema.extend({
+  selection: z6.never().optional()
+});
+var commandSchema = z6.array(z6.string().min(1)).min(1);
+var commandListSchema = z6.array(commandSchema).min(1).optional();
 var workspaceProfileRuntimeSchema = z6.object({
   agent: z6.string().min(1).optional(),
   adapter: z6.string().min(1).default("openclaw"),
@@ -6338,7 +7208,9 @@ var workspaceProfileRuntimeSchema = z6.object({
   adapterModule: z6.string().min(1).optional(),
   installationType: installationTypeSchema.optional(),
   targetRoot: z6.string().min(1).optional(),
-  executePlugins: z6.boolean().optional()
+  executePlugins: z6.boolean().optional(),
+  reloadRuntimes: z6.boolean().optional(),
+  reloadCommands: commandListSchema
 });
 var workspaceProfileSchema = z6.object({
   runtimes: z6.array(workspaceProfileRuntimeSchema).min(1)
@@ -6363,7 +7235,8 @@ var workspaceAgentSchema = z6.object({
   host: z6.string().min(1).optional(),
   user: z6.string().min(1).optional(),
   port: z6.number().int().positive().optional(),
-  identityFile: z6.string().min(1).optional()
+  identityFile: z6.string().min(1).optional(),
+  reloadCommands: commandListSchema
 }).superRefine((agent, ctx) => {
   if (agent.transport !== "ssh") return;
   if (!agent.host) {
@@ -6374,22 +7247,34 @@ var workspaceAgentSchema = z6.object({
     });
   }
 });
-var workspaceConfigSchema = z6.object({
-  schemaVersion: z6.literal(1),
-  packages: z6.array(workspacePackageSchema).default([]),
+var workspaceConfigBaseSchema = z6.object({
   bootstrapSkills: z6.boolean().optional(),
   registry: workspaceRegistrySchema,
   trust: workspaceTrustSchema,
   profiles: z6.record(z6.string(), workspaceProfileSchema).default({}),
   agents: z6.record(z6.string(), workspaceAgentSchema).default({})
 });
+var workspaceConfigV1Schema = workspaceConfigBaseSchema.extend({
+  schemaVersion: z6.literal(1),
+  packages: z6.array(workspacePackageV1Schema).default([]),
+  exports: z6.never().optional()
+});
+var workspaceConfigV2Schema = workspaceConfigBaseSchema.extend({
+  schemaVersion: z6.literal(2),
+  packages: z6.array(workspacePackageSchema).default([]),
+  exports: workspaceExportsSchema.default({ selections: {} })
+});
+var workspaceConfigSchema = z6.discriminatedUnion("schemaVersion", [
+  workspaceConfigV1Schema,
+  workspaceConfigV2Schema
+]);
 function workspaceConfigPath(workspaceRoot) {
   return join29(workspaceRoot, ".agentwheel", "config.json");
 }
 async function readWorkspaceConfig(workspaceRoot) {
   const path = workspaceConfigPath(workspaceRoot);
   if (!await pathExists(path)) return emptyWorkspaceConfig();
-  return workspaceConfigSchema.parse(JSON.parse(await readFile20(path, "utf8")));
+  return workspaceConfigSchema.parse(JSON.parse(await readFile21(path, "utf8")));
 }
 async function writeWorkspaceConfig(workspaceRoot, config) {
   await writeJsonAtomic(workspaceConfigPath(workspaceRoot), workspaceConfigSchema.parse(config));
@@ -6399,7 +7284,7 @@ function upsertPackage(config, entry) {
   const packages = parsed.packages.filter((candidate) => candidate.name !== entry.name);
   packages.push(entry);
   packages.sort((a, b) => a.name.localeCompare(b.name));
-  return { schemaVersion: 1, packages, bootstrapSkills: parsed.bootstrapSkills, registry: parsed.registry ?? {}, trust: parsed.trust ?? {}, profiles: parsed.profiles ?? {}, agents: parsed.agents ?? {} };
+  return workspaceConfigSchema.parse({ ...parsed, packages });
 }
 function globalWorkspaceConfigPath(globalRoot = homedir4()) {
   return join29(globalRoot, ".agentwheel", "config.json");
@@ -6408,7 +7293,7 @@ async function findWorkspaceRoot(start = process.cwd()) {
   let current = resolve13(start);
   while (true) {
     if (await pathExists(workspaceConfigPath(current))) return current;
-    const parent = dirname22(current);
+    const parent = dirname23(current);
     if (parent === current) return resolve13(start);
     current = parent;
   }
@@ -6419,8 +7304,10 @@ async function readMergedWorkspaceConfig(projectRoot, options = {}) {
   return mergeWorkspaceConfig(global, project);
 }
 function mergeWorkspaceConfig(global, project) {
+  const schemaVersion = global.schemaVersion === 2 || project.schemaVersion === 2 ? 2 : 1;
+  const exports = project.schemaVersion === 2 ? project.exports : global.schemaVersion === 2 ? global.exports : void 0;
   return workspaceConfigSchema.parse({
-    schemaVersion: 1,
+    schemaVersion,
     packages: project.packages.length > 0 ? project.packages : global.packages,
     bootstrapSkills: project.bootstrapSkills ?? global.bootstrapSkills,
     registry: {
@@ -6431,7 +7318,8 @@ function mergeWorkspaceConfig(global, project) {
     },
     trust: mergeWorkspaceTrust(global.trust, project.trust),
     profiles: { ...global.profiles, ...project.profiles },
-    agents: { ...global.agents, ...project.agents }
+    agents: { ...global.agents, ...project.agents },
+    ...exports ? { exports } : {}
   });
 }
 function resolveConfigPath(path, baseRoot) {
@@ -6444,7 +7332,7 @@ function emptyWorkspaceConfig() {
 }
 async function readConfigPath(path) {
   if (!await pathExists(path)) return emptyWorkspaceConfig();
-  return workspaceConfigSchema.parse(JSON.parse(await readFile20(path, "utf8")));
+  return workspaceConfigSchema.parse(JSON.parse(await readFile21(path, "utf8")));
 }
 function mergeWorkspaceTrust(global, project) {
   return {
@@ -6459,56 +7347,174 @@ function sortedUnique2(values) {
 }
 
 // src/lifecycle/customization.ts
-import { appendFile, cp as cp6, mkdir as mkdir17, rm as rm9 } from "fs/promises";
-import { dirname as dirname24, join as join32 } from "path";
+import { appendFile, cp as cp6, mkdir as mkdir18, rm as rm9 } from "fs/promises";
+import { dirname as dirname25, join as join32 } from "path";
 
 // src/resolve/graph.ts
-import { createHash as createHash6 } from "crypto";
-import { mkdtemp as mkdtemp4, readdir as readdir6, readFile as readFile22, stat as stat10 } from "fs/promises";
+import { createHash as createHash8 } from "crypto";
+import { mkdtemp as mkdtemp4, readdir as readdir6, readFile as readFile24, stat as stat10 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
 import { basename as basename19, extname as extname4, join as join31 } from "path";
 
+// src/model/workspace-composition.ts
+import { createHash as createHash7 } from "crypto";
+import { readFile as readFile22 } from "fs/promises";
+import { z as z7 } from "zod";
+var selectionSourceConfigSchema = z7.object({
+  schemaVersion: z7.literal(2),
+  exports: workspaceExportsSchema
+}).passthrough();
+async function resolveSelectionImport(sourceRoot, sourceDriver, selection) {
+  const parsedSelection = workspaceSelectionImportSchema.parse(selection);
+  if (sourceDriver !== "local" && sourceDriver !== "git") {
+    throw new Error(
+      `Selection import '${parsedSelection.export}' is unsupported for source driver '${sourceDriver}'. Only local and git sources expose a stable project configuration.`
+    );
+  }
+  const path = workspaceConfigPath(sourceRoot);
+  if (!await pathExists(path)) {
+    throw new Error(`Selection import '${parsedSelection.export}' requires source config: ${path}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(await readFile22(path, "utf8"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Selection import '${parsedSelection.export}' cannot parse ${path}: ${message}`);
+  }
+  if (!isRecord8(raw) || raw.schemaVersion !== 2) {
+    throw new Error(`Selection import '${parsedSelection.export}' requires schemaVersion 2 in ${path}.`);
+  }
+  let sourceConfig;
+  try {
+    sourceConfig = selectionSourceConfigSchema.parse(raw);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Selection import '${parsedSelection.export}' has invalid exports in ${path}: ${message}`);
+  }
+  const selections = sourceConfig.exports.selections;
+  let exportSelection;
+  let additions;
+  let exclusions;
+  try {
+    exportSelection = resolveExport(parsedSelection.export, selections, []);
+    additions = normalizeSelectors(parsedSelection.add, `selection import '${parsedSelection.export}' add`);
+    exclusions = normalizeSelectors(parsedSelection.exclude, `selection import '${parsedSelection.export}' exclude`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Selection import '${parsedSelection.export}' in ${path}: ${message}`);
+  }
+  const effective = applySelection(exportSelection.effective, additions, exclusions);
+  const configHash = sha2562(stableJson({ selections }));
+  const exportHash = sha2562(stableJson({
+    export: parsedSelection.export,
+    chain: exportSelection.chain.map((name) => ({ name, selection: selections[name] }))
+  }));
+  return {
+    configPath: ".agentwheel/config.json",
+    configHash,
+    exportHash,
+    exportName: parsedSelection.export,
+    extends: exportSelection.chain,
+    inherited: exportSelection.effective,
+    additions,
+    exclusions,
+    effective
+  };
+}
+function resolveExport(name, selections, stack) {
+  if (stack.includes(name)) {
+    throw new Error(`Selection export cycle: ${[...stack, name].join(" -> ")}`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(selections, name)) {
+    throw new Error(`Selection export not found: ${name}`);
+  }
+  const selection = selections[name];
+  const nextStack = [...stack, name];
+  const inherited = selection.extends ? resolveExport(selection.extends, selections, nextStack) : { chain: [], effective: normalizeSelectors(selection.select, `selection export '${name}' select`) };
+  const additions = normalizeSelectors(selection.add, `selection export '${name}' add`);
+  const exclusions = normalizeSelectors(selection.exclude, `selection export '${name}' exclude`);
+  return {
+    chain: [...inherited.chain, name],
+    effective: applySelection(inherited.effective, additions, exclusions)
+  };
+}
+function applySelection(inherited, additions, exclusions) {
+  const excluded = new Set(exclusions);
+  return sortedUnique3([...inherited, ...additions]).filter((selector) => !excluded.has(selector));
+}
+function normalizeSelectors(values, label) {
+  try {
+    return sortedUnique3(normalizeArtifactSelectors(values) ?? []);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid ${label}: ${message}`);
+  }
+}
+function sortedUnique3(values) {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+function sha2562(value) {
+  return createHash7("sha256").update(value).digest("hex");
+}
+function stableJson(value) {
+  return JSON.stringify(stableValue2(value));
+}
+function stableValue2(value) {
+  if (Array.isArray(value)) return value.map(stableValue2);
+  if (!value || typeof value !== "object") return value;
+  const out = {};
+  for (const key of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
+    const item = value[key];
+    if (item !== void 0) out[key] = stableValue2(item);
+  }
+  return out;
+}
+function isRecord8(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
 // src/resolve/identity.ts
 import { homedir as homedir6 } from "os";
 import { resolve as resolve15 } from "path";
 
 // src/registry/client.ts
-import { readFile as readFile21, rm as rm8, stat as stat9 } from "fs/promises";
+import { readFile as readFile23, rm as rm8, stat as stat9 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname23, join as join30, resolve as resolve14 } from "path";
+import { dirname as dirname24, join as join30, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 
 // src/model/registry.ts
-import { z as z7 } from "zod";
-var registryEntrySchema = z7.object({
-  name: z7.string().min(1),
-  source: z7.string().min(1),
-  type: z7.enum(["package", "skill", "plugin", "mcp", "adapter"]).default("package"),
-  description: z7.string().default(""),
-  tags: z7.array(z7.string().min(1)).default([]),
-  select: z7.array(z7.string().min(1)).optional(),
-  skills: z7.array(z7.string().min(1)).optional(),
-  homepageUrl: z7.string().min(1).optional(),
-  homepageLinkLabel: z7.string().min(1).optional(),
-  sourceUrl: z7.string().min(1).optional(),
-  sourceLinkLabel: z7.string().min(1).optional(),
-  openpack: z7.object({
-    schemaVersion: z7.number().int().positive().optional(),
-    specVersion: z7.string().min(1).optional()
+import { z as z8 } from "zod";
+var registryEntrySchema = z8.object({
+  name: z8.string().min(1),
+  source: z8.string().min(1),
+  type: z8.enum(["package", "skill", "plugin", "mcp", "adapter"]).default("package"),
+  description: z8.string().default(""),
+  tags: z8.array(z8.string().min(1)).default([]),
+  select: z8.array(z8.string().min(1)).optional(),
+  skills: z8.array(z8.string().min(1)).optional(),
+  homepageUrl: z8.string().min(1).optional(),
+  homepageLinkLabel: z8.string().min(1).optional(),
+  sourceUrl: z8.string().min(1).optional(),
+  sourceLinkLabel: z8.string().min(1).optional(),
+  openpack: z8.object({
+    schemaVersion: z8.number().int().positive().optional(),
+    specVersion: z8.string().min(1).optional()
   }).passthrough().optional()
 });
-var registryIndexSchema = z7.union([
-  z7.array(registryEntrySchema),
-  z7.object({
-    schemaVersion: z7.literal(1).optional(),
-    entries: z7.array(registryEntrySchema)
+var registryIndexSchema = z8.union([
+  z8.array(registryEntrySchema),
+  z8.object({
+    schemaVersion: z8.literal(1).optional(),
+    entries: z8.array(registryEntrySchema)
   })
 ]).transform((value) => Array.isArray(value) ? value : value.entries);
-var registryCacheSchema = z7.object({
-  version: z7.literal(1),
-  fetchedAt: z7.string().datetime(),
-  sources: z7.array(z7.string().min(1)),
-  entries: z7.array(registryEntrySchema)
+var registryCacheSchema = z8.object({
+  version: z8.literal(1),
+  fetchedAt: z8.string().datetime(),
+  sources: z8.array(z8.string().min(1)),
+  entries: z8.array(registryEntrySchema)
 });
 
 // src/registry/client.ts
@@ -6579,7 +7585,7 @@ var RegistryClient = class {
   }
   async readCache() {
     if (!await pathExists(this.cachePath)) return void 0;
-    return registryCacheSchema.parse(JSON.parse(await readFile21(this.cachePath, "utf8")));
+    return registryCacheSchema.parse(JSON.parse(await readFile23(this.cachePath, "utf8")));
   }
   isExpired(cache, ttlMs) {
     return this.now().getTime() - new Date(cache.fetchedAt).getTime() > ttlMs;
@@ -6598,10 +7604,10 @@ var RegistryClient = class {
     if (await pathExists(filePath)) {
       const fullPath = resolve14(filePath);
       const stats = await stat9(fullPath);
-      return readFile21(stats.isDirectory() ? join30(fullPath, "index.json") : fullPath, "utf8");
+      return readFile23(stats.isDirectory() ? join30(fullPath, "index.json") : fullPath, "utf8");
     }
-    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join30(dirname23(this.cachePath), "registry-repos") }));
-    return readFile21(join30(resolved.resolvedPath, "index.json"), "utf8");
+    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join30(dirname24(this.cachePath), "registry-repos") }));
+    return readFile23(join30(resolved.resolvedPath, "index.json"), "utf8");
   }
   warnCompatibility(entries) {
     for (const entry of entries) {
@@ -6615,7 +7621,7 @@ var RegistryClient = class {
   }
 };
 async function resolvePackageSource(source, workspaceRoot, options = {}) {
-  const { isExplicitSource } = await import("./identify-T4RE5RBD.js");
+  const { isExplicitSource } = await import("./identify-VV7SXUIQ.js");
   if (await isExplicitSource(source)) return { source };
   const entry = await new RegistryClient({ workspaceRoot, offline: options.offline, warn: options.warn }).resolve(source);
   if (!entry) {
@@ -6718,7 +7724,7 @@ function isBareRegistryName(source) {
   return !source.includes(":") && !isLocalSource(source);
 }
 function isLocalSource(source) {
-  return source === "~" || source.startsWith("~/") || source.startsWith("./") || source.startsWith("../") || source.startsWith("/") || source.startsWith("local:");
+  return source === "." || source === ".." || source === "~" || source.startsWith("~/") || source.startsWith("./") || source.startsWith("../") || source.startsWith("/") || source.startsWith("local:");
 }
 function localSourcePath(source) {
   return source.startsWith("local:") ? source.slice("local:".length) : source;
@@ -6894,11 +7900,13 @@ async function resolveDependencyGraph(roots, options) {
   const nodesByKey = /* @__PURE__ */ new Map();
   const rootResults = [];
   const edgeMap = /* @__PURE__ */ new Map();
+  assertDependencyUpdateSelectors(options.previousLock, options.dependencyUpdateSelectors);
   const queue = roots.map((root, index) => {
     const rootId = root.rootId ?? `root-${index + 1}`;
     return {
       source: root.source,
       select: root.select,
+      selection: root.selection,
       mode: root.mode ?? "pinned",
       ref: root.ref,
       declaringPackageRoot: options.workspaceRoot,
@@ -6907,11 +7915,12 @@ async function resolveDependencyGraph(roots, options) {
       aliases: root.aliases,
       overrides: root.overrides,
       useLock: root.useLock ?? options.lockedResolution,
+      updateClosure: root.useLock === false,
       depth: 0,
       optional: false,
       chain: [`workspace:${rootId}`],
       includeSuggestions: root.includeSuggestions ?? options.includeSuggestions,
-      suggestionAliases: sortedUnique3([...root.suggestionAliases ?? [], ...options.suggestionAliases ?? []])
+      suggestionAliases: sortedUnique4([...root.suggestionAliases ?? [], ...options.suggestionAliases ?? []])
     };
   });
   let iterations = 0;
@@ -6948,7 +7957,8 @@ function createGraphLock(graph, artifacts = [], targetFingerprint, includeEdges
     mode: root.mode,
     selected: root.selected,
     aliases: root.aliases,
-    overrides: root.overrides
+    overrides: root.overrides,
+    selectionImport: root.selectionImport
   }));
   return {
     version: 1,
@@ -7012,7 +8022,14 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
       throw new Error(`Package ${fetched.name}@${fetched.version} does not satisfy requested version ${requirement.version}`);
     }
     const nodeKey = `${normalized.normalizedSource}\0${fetched.name}`;
-    const selected = computeSelectedSelectors(fetched.artifacts, requirement.select, requirement.depth === 0, requirement.chain);
+    let selectionImport = requirement.selection ? await resolveSelectionImport(fetched.resolved.resolvedPath, fetched.resolved.driver, requirement.selection) : void 0;
+    const selected = computeSelectedSelectors(
+      fetched.artifacts,
+      selectionImport?.effective ?? requirement.select,
+      requirement.depth === 0,
+      requirement.chain
+    );
+    if (selectionImport) selectionImport = { ...selectionImport, effective: selected };
     let state = nodesByKey.get(nodeKey);
     if (!state) {
       const id = graphNodeId(fetched.name, fetched.version, normalized.normalizedSource, fetched.resolved.resolvedCommit, fetched.sourceHash);
@@ -7043,13 +8060,15 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
         depth: requirement.depth,
         fullPackageSelected: false,
         includeSuggestions: false,
-        suggestionAliases: /* @__PURE__ */ new Set()
+        suggestionAliases: /* @__PURE__ */ new Set(),
+        updateClosure: false
       };
       nodesByKey.set(nodeKey, state);
     }
     state.depth = Math.min(state.depth, requirement.depth);
-    state.fullPackageSelected = state.fullPackageSelected || requirement.select === void 0;
+    state.fullPackageSelected = state.fullPackageSelected || requirement.select === void 0 && !requirement.selection;
     state.includeSuggestions = state.includeSuggestions || requirement.includeSuggestions === true;
+    state.updateClosure = state.updateClosure || requirement.updateClosure === true;
     for (const alias of requirement.suggestionAliases ?? []) state.suggestionAliases.add(alias);
     state.requiredBy.add(requirement.requiredBy);
     for (const selector of selected) addSelectedSelector(state, selector, requirement.selectionReason);
@@ -7063,7 +8082,8 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
         mode: state.node.mode,
         selected: state.node.selected,
         aliases: requirement.aliases,
-        overrides: requirement.overrides
+        overrides: requirement.overrides,
+        selectionImport
       });
     }
     if (requirement.parentId && requirement.alias) {
@@ -7079,7 +8099,7 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
         version: requirement.version,
         mode: requirement.mode,
         optional: requirement.optional,
-        selected: sortedUnique3([...previous?.selected ?? [], ...selected])
+        selected: sortedUnique4([...previous?.selected ?? [], ...selected])
       });
     }
     return await collectDependencyNeeds(state, fetched, options, requirement.chain);
@@ -7110,7 +8130,7 @@ async function collectDependencyNeeds(state, fetched, options, chain) {
       if (!dependency.select?.length && !(state.fullPackageSelected && dependency.select === void 0)) continue;
       state.processedPackageAliases.add(alias);
       if (!dependencyTargetsRuntime(dependency.runtimes, options.runtime, state.node.id, alias, options.warn)) continue;
-      requirements.push(dependencyRequirement(state, fetched, alias, dependency, dependency.select, chain, options.lockedResolution === true));
+      requirements.push(dependencyRequirement(state, fetched, alias, dependency, dependency.select, chain, options));
     }
     for (const [alias, suggestion] of suggestionEntries) {
       if (state.processedSuggestions.has(alias)) continue;
@@ -7146,9 +8166,9 @@ async function collectDependencyNeeds(state, fetched, options, chain) {
             fetched,
             parsed.alias,
             dependency,
-            sortedUnique3([...dependency.select ?? [], parsed.selector]),
+            sortedUnique4([...dependency.select ?? [], parsed.selector]),
             chain,
-            options.lockedResolution === true,
+            options,
             parsed.optional || dependency.optional === true,
             `required by ${parentSelector}`
           ));
@@ -7198,9 +8218,9 @@ async function collectDependencyNeeds(state, fetched, options, chain) {
           fetched,
           include.alias,
           dependency,
-          sortedUnique3([...dependency.select ?? [], include.selector]),
+          sortedUnique4([...dependency.select ?? [], include.selector]),
           chain,
-          options.lockedResolution === true,
+          options,
           include.optional || dependency.optional === true
         ));
       }
@@ -7210,13 +8230,15 @@ async function collectDependencyNeeds(state, fetched, options, chain) {
   refreshNode(state);
   return requirements;
 }
-function dependencyRequirement(state, fetched, alias, dependency, select, chain, lockByDefault, optional = dependency.optional ?? false, selectionReason) {
+function dependencyRequirement(state, fetched, alias, dependency, select, chain, options, optional = dependency.optional ?? false, selectionReason) {
+  const updateClosure = state.updateClosure || dependencyUpdateEdgeSelected(state.node.id, alias, options);
   return {
     source: dependency.source,
     select,
     mode: dependency.mode ?? "pinned",
     ref: dependency.ref,
-    useLock: lockByDefault || dependency.mode !== "tracking",
+    useLock: dependency.mode !== "tracking" || options.lockedResolution === true && !updateClosure,
+    updateClosure,
     declaringPackageRoot: fetched.resolved.resolvedPath,
     requiredBy: state.node.id,
     alias,
@@ -7228,7 +8250,7 @@ function dependencyRequirement(state, fetched, alias, dependency, select, chain,
     integrity: dependency.integrity,
     selectionReason,
     includeSuggestions: state.includeSuggestions,
-    suggestionAliases: sortedUnique3([...state.suggestionAliases])
+    suggestionAliases: sortedUnique4([...state.suggestionAliases])
   };
 }
 function suggestionRequirement(state, fetched, alias, suggestion, select, chain, options, optional = shouldTreatSuggestionAsOptional(alias, suggestion, options), selectionReason) {
@@ -7239,11 +8261,51 @@ function suggestionRequirement(state, fetched, alias, suggestion, select, chain,
     suggestion,
     select,
     chain,
-    options.lockedResolution === true,
+    options,
     optional,
     selectionReason
   );
 }
+function assertDependencyUpdateSelectors(lock, selectors) {
+  for (const selector of sortedUnique4(selectors ?? [])) {
+    if (!lock) throw new Error(`Dependency update '${selector}' requires an existing graph lock.`);
+    const nodeIds = matchingDependencyUpdateNodeIds(lock, selector);
+    if (nodeIds.size === 0) throw new Error(`Tracking dependency not found in graph lock: ${selector}`);
+    if (nodeIds.size > 1) {
+      throw new Error(`Dependency update selector is ambiguous: ${selector}. Use an exact node id or source.`);
+    }
+  }
+}
+function matchingDependencyUpdateNodeIds(lock, selector) {
+  const nodes = new Map(lock.canonical.nodes.map((node) => [node.id, node]));
+  const nodeIds = new Set(matchingDependencyUpdateEdges(lock, selector).map((edge) => edge.to));
+  for (const root of lock.canonical.roots) {
+    if (root.mode !== "tracking") continue;
+    const node = nodes.get(root.graphNodeId);
+    if (!node) continue;
+    if (dependencyUpdateSelectorMatchesRoot(root, node, selector)) {
+      nodeIds.add(root.graphNodeId);
+    }
+  }
+  return nodeIds;
+}
+function dependencyUpdateSelectorMatchesRoot(root, node, selector) {
+  return selector === root.rootId || selector === root.source || selector === root.normalizedSource || selector === root.graphNodeId || selector === node.name || selector === node.source || selector === node.normalizedSource;
+}
+function dependencyUpdateEdgeSelected(parentId, alias, options) {
+  const lock = options.previousLock;
+  if (!lock) return false;
+  const selectedNodeIds = new Set((options.dependencyUpdateSelectors ?? []).flatMap((selector) => matchingDependencyUpdateEdges(lock, selector).map((edge) => edge.to)));
+  return lock.canonical.edges.some((edge) => edge.from === parentId && edge.alias === alias && selectedNodeIds.has(edge.to));
+}
+function matchingDependencyUpdateEdges(lock, selector) {
+  const nodes = new Map(lock.canonical.nodes.map((node) => [node.id, node]));
+  return lock.canonical.edges.filter((edge) => {
+    const node = nodes.get(edge.to);
+    if (!node || node.mode !== "tracking") return false;
+    return selector === edge.alias || selector === edge.source || selector === edge.normalizedSource || selector === node.id || selector === node.name || selector === node.source || selector === node.normalizedSource;
+  });
+}
 function dependencyForAlias(dependencies, nodeId, alias) {
   const dependency = dependencies[alias];
   if (!dependency) {
@@ -7259,7 +8321,7 @@ function suggestionForAlias(suggestions, nodeId, alias) {
   return suggestion;
 }
 function warnNoDepsOnce(state, aliases, warn) {
-  const unique = sortedUnique3(aliases.filter(Boolean));
+  const unique = sortedUnique4(aliases.filter(Boolean));
   if (unique.length === 0 || state.processedPackageAliases.has("__noDepsWarned")) return;
   state.processedPackageAliases.add("__noDepsWarned");
   warn?.(`--no-deps ignored dependencies for ${state.node.id}: ${unique.join(", ")}`);
@@ -7300,7 +8362,7 @@ function suggestionOptionsForState(state, options) {
   return {
     ...options,
     includeSuggestions: state.includeSuggestions || options.includeSuggestions === true,
-    suggestionAliases: sortedUnique3([...options.suggestionAliases ?? [], ...state.suggestionAliases])
+    suggestionAliases: sortedUnique4([...options.suggestionAliases ?? [], ...state.suggestionAliases])
   };
 }
 function explicitSuggestionAlias(alias, options) {
@@ -7312,7 +8374,7 @@ function shouldTreatSuggestionAsOptional(alias, suggestion, options) {
 }
 function combinedSelectors(base, extra) {
   const values = [...base ?? [], ...extra ?? []];
-  return values.length > 0 ? sortedUnique3(values) : void 0;
+  return values.length > 0 ? sortedUnique4(values) : void 0;
 }
 function parseDependencySelector(value) {
   const cleaned = value.trim();
@@ -7352,7 +8414,7 @@ async function collectIncludeNeeds(artifact, artifactsByRelativePath) {
     const file = stack.shift();
     if (scanned.has(file)) continue;
     scanned.add(file);
-    const content = await readFile22(file, "utf8");
+    const content = await readFile24(file, "utf8");
     for (const include of extractOpenPackIncludeSelectors(content)) {
       await collectIncludeSelector(include.raw, include.optional, artifactsByRelativePath, scanned, stack, needs);
     }
@@ -7560,8 +8622,8 @@ async function withCachePathLock(path, fn) {
   }
 }
 function computeSelectedSelectors(artifacts, select, isRoot, chain) {
-  if (isRoot && !select?.length) {
-    return sortedUnique3(artifacts.map(artifactSelectorKey));
+  if (isRoot && select === void 0) {
+    return sortedUnique4(artifacts.map(artifactSelectorKey));
   }
   const explicit = normalizeArtifactSelectors(select) ?? [];
   const available = new Set(artifacts.map(artifactSelectorKey));
@@ -7570,7 +8632,7 @@ function computeSelectedSelectors(artifacts, select, isRoot, chain) {
     throw new Error(`Selected artifact not found in package: ${missing.join(", ")} (${chain.join(" -> ")})`);
   }
   const required = artifacts.filter((artifact) => artifact.required && artifact.type !== "fragments").map(artifactSelectorKey);
-  return sortedUnique3([...explicit, ...required]);
+  return sortedUnique4([...explicit, ...required]);
 }
 function materializeRawNode(state) {
   refreshNode(state);
@@ -7583,11 +8645,11 @@ function materializeRawNode(state) {
   };
 }
 function refreshNode(state) {
-  state.node.requiredBy = sortedUnique3([...state.requiredBy]);
-  state.node.selected = sortedUnique3([...state.selected]);
+  state.node.requiredBy = sortedUnique4([...state.requiredBy]);
+  state.node.selected = sortedUnique4([...state.selected]);
   const selectionReasons = {};
   for (const [selector, reasons] of [...state.selectionReasons.entries()].sort(([a], [b]) => a.localeCompare(b))) {
-    selectionReasons[selector] = sortedUnique3([...reasons]);
+    selectionReasons[selector] = sortedUnique4([...reasons]);
   }
   state.node.selectionReasons = Object.keys(selectionReasons).length > 0 ? selectionReasons : void 0;
 }
@@ -7616,10 +8678,10 @@ function detectDirectCollisions(nodes) {
   }
 }
 function graphNodeId(name, version, normalizedSource, resolvedCommit, sourceHash) {
-  const digest = createHash6("sha256").update(normalizedSource).update("\0").update(resolvedCommit ?? sourceHash).digest("hex").slice(0, 12);
+  const digest = createHash8("sha256").update(normalizedSource).update("\0").update(resolvedCommit ?? sourceHash).digest("hex").slice(0, 12);
   return `${name}@${version}+${digest}`;
 }
-function sortedUnique3(values) {
+function sortedUnique4(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
 async function mapLimit(items, limit, fn) {
@@ -7638,7 +8700,7 @@ async function mapLimit(items, limit, fn) {
 // src/lifecycle/customization.ts
 async function remember(workspaceRoot, runtime, text) {
   const overlayPath = join32(workspaceRoot, ".agentwheel", "overlays", runtime, "instructions.local.md");
-  await mkdir17(dirname24(overlayPath), { recursive: true });
+  await mkdir18(dirname25(overlayPath), { recursive: true });
   await appendFile(overlayPath, `${text.trim()}
 `, "utf8");
   return { overlayPath };
@@ -7662,7 +8724,7 @@ async function ejectArtifact(workspaceRoot, item) {
     }
     const ejectedIdentity = parsed.packageIdentity === parsed.packageName ? parsed.packageIdentity : candidate.nodeId === parsed.packageIdentity ? candidate.nodeId : `${candidate.packageName}@${candidate.packageVersion}`;
     const ejectedPath = join32(workspaceRoot, ".agentwheel", "ejected", ...ejectedIdentity.split("/"), parsed.type, parsed.name);
-    await mkdir17(dirname24(ejectedPath), { recursive: true });
+    await mkdir18(dirname25(ejectedPath), { recursive: true });
     await rm9(ejectedPath, { recursive: true, force: true });
     await cp6(artifact.stagedPath ?? artifact.sourcePath, ejectedPath, { recursive: artifact.kind === "dir", dereference: true });
     return {
@@ -7754,20 +8816,40 @@ function ejectCommands(candidates, parsed) {
 import { rm as rm10 } from "fs/promises";
 
 // src/lifecycle/source-plan.ts
-import { createHash as createHash8 } from "crypto";
-import { mkdir as mkdir19 } from "fs/promises";
-import { dirname as dirname26, join as join35, resolve as resolve16 } from "path";
+import { createHash as createHash10 } from "crypto";
+import { mkdir as mkdir20 } from "fs/promises";
+import { dirname as dirname27, join as join35 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
   if (!previous) return [];
   return [
+    ...diffRoots(previous.canonical.roots, next.canonical.roots),
     ...diffNodes(previous.canonical.nodes, next.canonical.nodes),
     ...diffIncludeEdges(previous.canonical.includeEdges, next.canonical.includeEdges),
     ...diffNamespacing(previous.canonical.namespacing, next.canonical.namespacing),
     ...diffOverrides(previous.canonical.overrides, next.canonical.overrides)
   ];
 }
+function diffRoots(previous, next) {
+  const previousById = new Map(previous.map((root) => [root.rootId, root]));
+  const nextById = new Map(next.map((root) => [root.rootId, root]));
+  const lines = [];
+  for (const [rootId, root] of nextById) {
+    const old = previousById.get(rootId);
+    if (!old) {
+      lines.push(`ADDED root ${rootId}`);
+      continue;
+    }
+    if (selectionImportKey(old) !== selectionImportKey(root)) {
+      lines.push(`CHANGED selection import ${rootId}: ${formatSelectionImport(old)} -> ${formatSelectionImport(root)}`);
+    }
+  }
+  for (const rootId of previousById.keys()) {
+    if (!nextById.has(rootId)) lines.push(`REMOVED root ${rootId}`);
+  }
+  return lines.sort((a, b) => a.localeCompare(b));
+}
 function diffNodes(previous, next) {
   const previousById = new Map(previous.map((node) => [node.id, node]));
   const nextById = new Map(next.map((node) => [node.id, node]));
@@ -7875,10 +8957,30 @@ function formatOverride(decision) {
 function short(hash) {
   return hash.slice(0, 12);
 }
+function selectionImportKey(root) {
+  const selection = root.selectionImport;
+  if (!selection) return "";
+  return JSON.stringify({
+    configPath: selection.configPath,
+    configHash: selection.configHash,
+    exportHash: selection.exportHash,
+    exportName: selection.exportName,
+    extends: selection.extends,
+    inherited: [...selection.inherited].sort(),
+    additions: [...selection.additions].sort(),
+    exclusions: [...selection.exclusions].sort(),
+    effective: [...selection.effective].sort()
+  });
+}
+function formatSelectionImport(root) {
+  const selection = root.selectionImport;
+  if (!selection) return "<direct selectors>";
+  return `${selection.exportName} sha256:${short(selection.exportHash)} effective=[${selection.effective.join(",")}]`;
+}
 
 // src/resolve/render.ts
-import { createHash as createHash7 } from "crypto";
-import { readFile as readFile23, mkdtemp as mkdtemp5 } from "fs/promises";
+import { createHash as createHash9 } from "crypto";
+import { readFile as readFile25, mkdtemp as mkdtemp5 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
 import { join as join33 } from "path";
 async function renderGraphForTarget(graph, targetContext = {}) {
@@ -7932,7 +9034,7 @@ async function renderGraphForTarget(graph, targetContext = {}) {
         if (sourceContent === void 0) {
           throw new Error(`OpenPack include source is not a file: ${edge.to}:${request.selector}`);
         }
-        const sourceHash = target.artifacts.find((artifact) => artifact.relativePath.replaceAll("\\", "/") === request.selector)?.hash ?? target.rawNode.artifacts.find((artifact) => artifact.relativePath.replaceAll("\\", "/") === request.selector)?.hash ?? sha2562(sourceContent);
+        const sourceHash = target.artifacts.find((artifact) => artifact.relativePath.replaceAll("\\", "/") === request.selector)?.hash ?? target.rawNode.artifacts.find((artifact) => artifact.relativePath.replaceAll("\\", "/") === request.selector)?.hash ?? sha2563(sourceContent);
         const includeEdge = {
           fromNodeId: request.fromNodeId,
           alias: request.alias,
@@ -8003,7 +9105,7 @@ async function artifactContentMap(artifacts) {
   const out = /* @__PURE__ */ new Map();
   for (const artifact of artifacts) {
     if (artifact.kind !== "file") continue;
-    out.set(artifact.relativePath.replaceAll("\\", "/"), await readFile23(artifact.stagedPath ?? artifact.sourcePath, "utf8"));
+    out.set(artifact.relativePath.replaceAll("\\", "/"), await readFile25(artifact.stagedPath ?? artifact.sourcePath, "utf8"));
   }
   return out;
 }
@@ -8016,8 +9118,8 @@ function filterArtifactsByRuntime2(artifacts, adapterName, selectedSet) {
     return false;
   });
 }
-function sha2562(content) {
-  return createHash7("sha256").update(content).digest("hex");
+function sha2563(content) {
+  return createHash9("sha256").update(content).digest("hex");
 }
 function assignInstallNames(graph, artifacts) {
   const aliases = workspaceAliases(graph);
@@ -8266,19 +9368,19 @@ function lockArtifactFor(artifact) {
 }
 
 // src/lifecycle/trust.ts
-import { mkdir as mkdir18, readFile as readFile24 } from "fs/promises";
+import { mkdir as mkdir19, readFile as readFile26 } from "fs/promises";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname25, join as join34 } from "path";
-import { z as z8 } from "zod";
-var trustStoreSchema = z8.object({
-  version: z8.literal(1),
-  acceptedSources: z8.array(z8.string().min(1)).default([])
+import { dirname as dirname26, join as join34 } from "path";
+import { z as z9 } from "zod";
+var trustStoreSchema = z9.object({
+  version: z9.literal(1),
+  acceptedSources: z9.array(z9.string().min(1)).default([])
 });
 function normalizeTrustPolicy(policy) {
   return {
-    allow: sortedUnique4(policy?.allow ?? []),
-    acceptedSources: sortedUnique4(policy?.acceptedSources ?? []),
-    denyArtifactTypes: sortedUnique4(policy?.denyArtifactTypes ?? []),
+    allow: sortedUnique5(policy?.allow ?? []),
+    acceptedSources: sortedUnique5(policy?.acceptedSources ?? []),
+    denyArtifactTypes: sortedUnique5(policy?.denyArtifactTypes ?? []),
     requireReviewForTransitive: policy?.requireReviewForTransitive ?? true
   };
 }
@@ -8315,10 +9417,10 @@ async function readTrustedSources(_workspaceRoot, storePath = defaultTrustStoreP
   return (await readTrustStore(storePath)).acceptedSources;
 }
 async function rememberTrustedSources(_workspaceRoot, sources, storePath = defaultTrustStorePath()) {
-  const unique = sortedUnique4(sources);
+  const unique = sortedUnique5(sources);
   if (unique.length === 0) return [];
   const store = await readTrustStore(storePath);
-  const acceptedSources = sortedUnique4([...store.acceptedSources, ...unique]);
+  const acceptedSources = sortedUnique5([...store.acceptedSources, ...unique]);
   await writeTrustStore(storePath, { version: 1, acceptedSources });
   return unique.filter((source) => !store.acceptedSources.includes(source));
 }
@@ -8337,21 +9439,155 @@ function matchesGlob2(value, pattern) {
   const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${escaped}$`).test(value);
 }
-function sortedUnique4(values) {
+function sortedUnique5(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
 async function readTrustStore(path) {
   if (!await pathExists(path)) return { version: 1, acceptedSources: [] };
-  return trustStoreSchema.parse(JSON.parse(await readFile24(path, "utf8")));
+  return trustStoreSchema.parse(JSON.parse(await readFile26(path, "utf8")));
 }
 async function writeTrustStore(path, store) {
-  await mkdir18(dirname25(path), { recursive: true });
+  await mkdir19(dirname26(path), { recursive: true });
   await writeJsonAtomic(path, trustStoreSchema.parse(store));
 }
 function defaultTrustStorePath() {
   return process.env.AGENTWHEEL_TRUST_STORE ?? join34(homedir7(), ".agentwheel", "trust.json");
 }
 
+// src/lifecycle/ownership.ts
+import { resolve as resolve16 } from "path";
+function workspaceOwnerForRoot(workspaceRoot) {
+  return `workspace-root:${resolve16(workspaceRoot)}`;
+}
+async function planArtifactOwnershipHandoff(request) {
+  return validateOwnershipHandoff(request, request.transport ?? localTransport);
+}
+async function applyArtifactOwnershipHandoff(request) {
+  if (!request.expectedHash || !request.expectedRevision) {
+    throw new Error("Applying an ownership handoff requires expectedHash and expectedRevision from a reviewed dry-run.");
+  }
+  const transport = request.transport ?? localTransport;
+  const scope = { installationType: request.installationType, stateKey: request.stateKey };
+  const lock = await acquireApplyLock(request.targetRoot, request.adapter, transport, {}, scope);
+  try {
+    if (await readApplyJournal(request.targetRoot, request.adapter, transport, scope)) {
+      throw new Error("Cannot hand off ownership while an apply journal is pending. Recover or abort it first.");
+    }
+    const plan = await validateOwnershipHandoff(request, transport);
+    const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, scope);
+    if (!manifest || manifest.version !== 2) {
+      throw new Error("Ownership handoff requires an Agentwheel v2 install manifest.");
+    }
+    assertManifestIdentity(manifest, request);
+    if (manifest.revision !== request.expectedRevision) {
+      throw new Error(`Manifest revision changed while locked: expected ${request.expectedRevision}, found ${manifest.revision}`);
+    }
+    const matches = manifest.entries.filter(
+      (entry) => entry.artifactType === request.artifactType && entry.artifactName === request.artifactName
+    );
+    const selected = matches[0];
+    if (!selected || matches.length !== 1) {
+      throw new Error(`Ownership handoff selection changed while locked: ${request.artifactType}/${request.artifactName}`);
+    }
+    if (selected.workspaceOwner !== plan.fromOwner || selected.hash !== request.expectedHash) {
+      throw new Error(`Ownership handoff preconditions changed while locked: ${request.artifactType}/${request.artifactName}`);
+    }
+    await writeInstallManifest({
+      ...manifest,
+      entries: manifest.entries.map((entry) => entry.artifactType === request.artifactType && entry.artifactName === request.artifactName ? { ...entry, workspaceOwner: plan.toOwner } : entry)
+    }, transport);
+    return plan;
+  } finally {
+    await lock.release();
+  }
+}
+async function validateOwnershipHandoff(request, transport) {
+  if (request.expectedHash) assertSha256(request.expectedHash, "expected artifact hash");
+  if (request.expectedRevision) assertSha256(request.expectedRevision, "expected manifest revision");
+  const scope = { installationType: request.installationType, stateKey: request.stateKey };
+  const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, scope);
+  if (!manifest) throw new Error(`No install manifest for ${request.adapter} at ${request.targetRoot}`);
+  if (manifest.version !== 2) throw new Error("Ownership handoff requires an Agentwheel v2 install manifest.");
+  assertManifestIdentity(manifest, request);
+  if (request.expectedRevision && manifest.revision !== request.expectedRevision) {
+    throw new Error(`Manifest revision precondition failed: expected ${request.expectedRevision}, found ${manifest.revision}`);
+  }
+  const matches = manifest.entries.filter(
+    (entry2) => entry2.artifactType === request.artifactType && entry2.artifactName === request.artifactName
+  );
+  if (matches.length !== 1) {
+    throw new Error(
+      `Expected exactly one managed artifact for ${request.artifactType}/${request.artifactName}, found ${matches.length}`
+    );
+  }
+  const entry = matches[0];
+  const fromOwner = workspaceOwnerForRoot(request.fromWorkspaceRoot);
+  const toOwner = workspaceOwnerForRoot(request.toWorkspaceRoot);
+  if (fromOwner === toOwner) throw new Error("Ownership handoff requires different workspace roots.");
+  if (entry.workspaceOwner !== fromOwner) {
+    throw new Error(`Old owner precondition failed for ${entry.path}: expected ${fromOwner}, found ${entry.workspaceOwner}`);
+  }
+  if (request.expectedHash && entry.hash !== request.expectedHash) {
+    throw new Error(`Manifest hash precondition failed for ${entry.path}: expected ${request.expectedHash}, found ${entry.hash}`);
+  }
+  const destPath = containedArtifactPath(request.targetRoot, entry.path);
+  if (!await transport.pathExists(destPath)) throw new Error(`Managed artifact is missing: ${entry.path}`);
+  const currentHash = await transport.hashPath(destPath);
+  if (currentHash !== entry.hash) {
+    throw new Error(`Managed artifact is drifted at ${entry.path}: manifest ${entry.hash}, current ${currentHash}`);
+  }
+  if (request.expectedHash && currentHash !== request.expectedHash) {
+    throw new Error(`Current hash precondition failed for ${entry.path}: expected ${request.expectedHash}, found ${currentHash}`);
+  }
+  return {
+    adapter: request.adapter,
+    installationType: request.installationType,
+    stateKey: request.stateKey,
+    targetRoot: request.targetRoot,
+    selector: `${request.artifactType}/${request.artifactName}`,
+    path: entry.path,
+    artifactHash: currentHash,
+    manifestRevision: manifest.revision,
+    fromOwner,
+    toOwner
+  };
+}
+function containedArtifactPath(targetRoot, relativePath) {
+  if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\0")) {
+    throw new Error(`Unsafe managed artifact path: ${relativePath}`);
+  }
+  const root = resolve16(targetRoot);
+  const candidate = resolve16(root, relativePath);
+  if (candidate !== root && !candidate.startsWith(`${root}/`)) {
+    throw new Error(`Managed artifact path escapes target root: ${relativePath}`);
+  }
+  return candidate;
+}
+function assertSha256(value, label) {
+  if (!/^[a-f0-9]{64}$/.test(value)) throw new Error(`${label} must be a lowercase SHA-256 digest.`);
+}
+function assertManifestIdentity(manifest, request) {
+  const requestedInstallationType = request.installationType ?? defaultInstallationType;
+  const requestedStateKey = stateKeyFor(request.adapter, {
+    installationType: requestedInstallationType,
+    stateKey: request.stateKey
+  });
+  const manifestStateKey = stateKeyFor(manifest.adapter, {
+    installationType: manifest.installationType,
+    stateKey: manifest.stateKey
+  });
+  const mismatches = [];
+  if (manifest.targetRoot !== request.targetRoot) mismatches.push(`targetRoot ${manifest.targetRoot}`);
+  if (manifest.adapter !== request.adapter) mismatches.push(`adapter ${manifest.adapter}`);
+  if (manifest.installationType !== requestedInstallationType) {
+    mismatches.push(`installationType ${manifest.installationType}`);
+  }
+  if (manifestStateKey !== requestedStateKey) mismatches.push(`stateKey ${manifestStateKey}`);
+  if (mismatches.length > 0) {
+    throw new Error(`Install manifest identity does not match requested target: ${mismatches.join(", ")}`);
+  }
+}
+
 // src/lifecycle/source-plan.ts
 async function createGraphSourcePlan(options) {
   if (options.roots.length === 0) {
@@ -8392,6 +9628,7 @@ async function createGraphSourcePlan(options) {
     noDeps: options.noDeps,
     includeSuggestions: options.includeSuggestions,
     suggestionAliases: options.suggestionAliases,
+    dependencyUpdateSelectors: options.dependencyUpdateSelectors,
     lockedResolution: options.lockedResolution,
     frozenLock: lockMode,
     offline: options.offline,
@@ -8426,7 +9663,7 @@ async function createGraphSourcePlan(options) {
   const plan = await createCombinedInstallPlan(desiredArtifacts, options.adapter, options.targetRoot, manifest, transport, {
     baseRevision: manifest?.revision ?? null,
     graphLockDigest,
-    workspaceOwner: workspaceOwnerId(workspaceRoot),
+    workspaceOwner: workspaceOwnerForRoot(workspaceRoot),
     installationType: resolvedInstallationType,
     stateKey,
     forceDrift: options.forceDrift,
@@ -8448,8 +9685,8 @@ async function createGraphSourcePlan(options) {
     recoveredPendingApply
   };
 }
-function graphLockPathForTarget(workspaceRoot, targetKey, adapter, targetFingerprintParts2) {
-  return pathForGraphLock(workspaceRoot, targetKey, adapter, computeTargetFingerprint(targetFingerprintParts2));
+function graphLockPathForTarget(workspaceRoot, targetKey2, adapter, targetFingerprintParts2) {
+  return pathForGraphLock(workspaceRoot, targetKey2, adapter, computeTargetFingerprint(targetFingerprintParts2));
 }
 function desiredArtifactsFromGraphBundle(bundle) {
   return bundle.artifacts.map((artifact) => desiredArtifactFromResolved(artifact));
@@ -8491,17 +9728,14 @@ async function readExistingGraphLock(path) {
   if (!await pathExists(path)) return void 0;
   return readGraphLock(path);
 }
-function pathForGraphLock(workspaceRoot, targetKey, adapter, targetFingerprint) {
-  return join35(workspaceRoot, ".agentwheel", "locks", sanitizePathSegment(targetKey), sanitizePathSegment(adapter), `${targetFingerprint}.graph-lock.json`);
+function pathForGraphLock(workspaceRoot, targetKey2, adapter, targetFingerprint) {
+  return join35(workspaceRoot, ".agentwheel", "locks", sanitizePathSegment(targetKey2), sanitizePathSegment(adapter), `${targetFingerprint}.graph-lock.json`);
 }
 function sanitizePathSegment(value) {
   return value.replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "default";
 }
 function digestGraphLock(lock) {
-  return createHash8("sha256").update(canonicalGraphLockJson(lock)).digest("hex");
-}
-function workspaceOwnerId(workspaceRoot) {
-  return `workspace-root:${resolve16(workspaceRoot)}`;
+  return createHash10("sha256").update(canonicalGraphLockJson(lock)).digest("hex");
 }
 function assertFrozenGraph(previousLock, graph, frozen, label) {
   if (!frozen) return;
@@ -8523,11 +9757,51 @@ function assertFrozenGraph(previousLock, graph, frozen, label) {
       mismatches.push(`${node.id}: sourceHash ${locked.sourceHash} -> ${node.sourceHash}`);
     }
   }
+  const lockedRoots = new Map(previousLock.canonical.roots.map((root) => [root.rootId, root]));
+  const graphRootIds = new Set(graph.roots.map((root) => root.rootId));
+  for (const root of graph.roots) {
+    const locked = lockedRoots.get(root.rootId);
+    if (!locked) {
+      mismatches.push(`${root.rootId}: new graph root`);
+      continue;
+    }
+    if (selectionImportKey2(locked.selectionImport) !== selectionImportKey2(root.selectionImport)) {
+      mismatches.push(`${root.rootId}: selection import changed`);
+    }
+    if (selectorKey(locked.selected) !== selectorKey(root.selected)) {
+      mismatches.push(`${root.rootId}: selected artifacts changed`);
+    }
+  }
+  for (const root of previousLock.canonical.roots) {
+    if (!graphRootIds.has(root.rootId)) {
+      mismatches.push(`${root.rootId}: removed graph root`);
+    }
+  }
   if (mismatches.length > 0) {
     throw new Error(`${label} would change graph nodes:
 ${mismatches.map((item) => `- ${item}`).join("\n")}`);
   }
 }
+function selectionImportKey2(selection) {
+  if (!selection) return "";
+  return JSON.stringify({
+    configPath: selection.configPath,
+    configHash: selection.configHash,
+    exportHash: selection.exportHash,
+    exportName: selection.exportName,
+    extends: selection.extends,
+    inherited: sortedUnique6(selection.inherited),
+    additions: sortedUnique6(selection.additions),
+    exclusions: sortedUnique6(selection.exclusions),
+    effective: sortedUnique6(selection.effective)
+  });
+}
+function sortedUnique6(values) {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+function selectorKey(selectors) {
+  return sortedUnique6(selectors).join("\0");
+}
 async function assertTrusted(sources, options) {
   if (sources.length === 0) return;
   if (options.readOnly === true) {
@@ -8555,8 +9829,39 @@ Type yes to continue: `);
 ${sources.map((source) => `- ${source}`).join("\n")}`);
 }
 
+// src/runtime/reload.ts
+function hasExecutedSemanticPluginChanges(plan, options = {}) {
+  return plan.operations.some((operation) => {
+    if (operation.action === "plugin") return options.executePlugins === true;
+    if (operation.action === "remove" && operation.semanticPlugin) return operation.execute !== false;
+    return false;
+  });
+}
+async function reloadRuntimeAfterPluginChanges(plan, target, transport, options = {}) {
+  if (!options.enabled) return false;
+  if (!hasExecutedSemanticPluginChanges(plan, options)) return false;
+  const commands = target.reloadCommands ?? [];
+  if (commands.length === 0) {
+    throw new Error(`--reload-runtimes requested for ${targetLabel(target)} but no reloadCommands are configured on the agent or profile runtime.`);
+  }
+  if (!transport.execFile) {
+    throw new Error(`Cannot reload ${targetLabel(target)} over ${transport.description}: transport does not support command execution.`);
+  }
+  for (const [command, ...args] of commands) {
+    if (!command) throw new Error(`Invalid empty reload command for ${targetLabel(target)}.`);
+    await transport.execFile(command, args, { cwd: target.targetRoot });
+  }
+  return true;
+}
+function formatReloadCommands(commands) {
+  return (commands ?? []).map((command) => command.join(" ")).join(" && ");
+}
+function targetLabel(target) {
+  return target.targetKey ?? target.agentName ?? `${target.adapter} at ${target.targetRoot}`;
+}
+
 // src/runtime/target.ts
-import { basename as basename20, dirname as dirname27, join as join36, resolve as resolve17 } from "path";
+import { basename as basename20, dirname as dirname28, join as join36, resolve as resolve17 } from "path";
 var runtimeMarkers = [
   { adapter: "openclaw", dirs: [".openclaw", ".clawdbot", ".moltbot"] },
   { adapter: "claude", dirs: [".claude"] },
@@ -8624,6 +9929,9 @@ function resolveProfileRuntimeTarget(runtime, config, workspaceRoot, installatio
       ...target,
       adapterConfig: runtime.adapterConfig,
       adapterModule: runtime.adapterModule,
+      executePlugins: runtime.executePlugins,
+      reloadRuntimes: runtime.reloadRuntimes,
+      reloadCommands: runtime.reloadCommands ?? target.reloadCommands,
       targetKey: runtime.agent,
       source: "profile"
     };
@@ -8635,6 +9943,9 @@ function resolveProfileRuntimeTarget(runtime, config, workspaceRoot, installatio
     installationType: installationType ?? runtime.installationType,
     targetRoot: runtime.targetRoot ? resolveConfigPath(runtime.targetRoot, workspaceRoot) : workspaceRoot,
     workspaceRoot,
+    executePlugins: runtime.executePlugins,
+    reloadRuntimes: runtime.reloadRuntimes,
+    reloadCommands: runtime.reloadCommands,
     transport: "local",
     source: "profile"
   };
@@ -8668,7 +9979,7 @@ async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
     if (adapterFilter && marker.adapter !== adapterFilter) continue;
     for (const dir of marker.dirs) {
       if (basename20(root) === dir) {
-        matches.push({ adapter: marker.adapter, targetRoot: dirname27(root) });
+        matches.push({ adapter: marker.adapter, targetRoot: dirname28(root) });
       } else if (await pathExists(join36(root, dir))) {
         matches.push({ adapter: marker.adapter, targetRoot: root });
       }
@@ -8690,6 +10001,7 @@ function targetFromAgent(name, config, workspaceRoot, installationType) {
     installationType: installationType ?? agent.installationType,
     targetRoot: agent.transport === "ssh" ? agent.root : resolveConfigPath(agent.root, workspaceRoot),
     workspaceRoot,
+    reloadCommands: agent.reloadCommands,
     transport: agent.transport,
     ssh: agent.transport === "ssh" ? {
       host: agent.host ?? "",
@@ -8710,7 +10022,7 @@ function dedupeTargets(matches) {
 function runtimeScanRoot(request) {
   const root = resolve17(request.targetRoot ?? request.cwd ?? process.cwd());
   if (request.targetRoot) return root;
-  return runtimeMarkers.some((marker) => marker.dirs.includes(basename20(root))) ? dirname27(root) : root;
+  return runtimeMarkers.some((marker) => marker.dirs.includes(basename20(root))) ? dirname28(root) : root;
 }
 
 // src/lifecycle/profile.ts
@@ -8725,6 +10037,10 @@ async function syncProfile(options) {
     throw new Error("Profile sync needs a source argument or configured packages.");
   }
   const results = [];
+  const selected = normalizeArtifactSelectors(options.select, options.skills);
+  if (selected && packages.some((pkg) => pkg.selection)) {
+    throw new Error("--select/--skill cannot be combined with a package selection import.");
+  }
   for (const runtime of profile.runtimes) {
     const target = resolveProfileRuntimeTarget(runtime, config, options.workspaceRoot, options.installationType);
     const transport = transportForTarget(target);
@@ -8738,14 +10054,14 @@ async function syncProfile(options) {
     });
     const installationType = target.installationType ?? defaultInstallationType;
     resolveInstallationTypeForAdapter(adapter, installationType);
-    const selected = normalizeArtifactSelectors(options.select, options.skills);
     const graphPlan = await createGraphSourcePlan({
       roots: packages.map((pkg) => ({
         rootId: pkg.name,
         source: pkg.source,
         mode: options.mode ?? pkg.mode,
         ref: pkg.requestedRef,
-        select: selected ?? normalizeArtifactSelectors(pkg.select, pkg.skills),
+        select: pkg.selection ? void 0 : selected ?? normalizeArtifactSelectors(pkg.select, pkg.skills),
+        selection: pkg.selection,
         aliases: pkg.aliases,
         overrides: pkg.overrides,
         includeSuggestions: options.includeSuggestions === true || pkg.withSuggestions === true,
@@ -8784,21 +10100,31 @@ async function syncProfile(options) {
       replaceConflict: options.replaceConflict
     });
     try {
-      results.push({
+      const result = {
         runtime: adapter.name,
         targetRoot: installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, transport.kind === "ssh"),
         transport: transport.kind,
         packageName: packages.map((pkg) => pkg.name).join(","),
-        plan: graphPlan.plan
-      });
+        plan: graphPlan.plan,
+        graphPlan,
+        graphLockDigest: graphPlan.graphLockDigest,
+        warnings: graphPlan.warnings
+      };
       if (!options.dryRun) {
+        const executePlugins = runtime.executePlugins ?? options.executePlugins;
         await applyCombinedInstallPlan(graphPlan.plan, {
-          executePlugins: runtime.executePlugins ?? options.executePlugins,
+          executePlugins,
           transport,
           graphLockDigest: graphPlan.graphLockDigest,
           graphLock: { path: graphPlan.graphLockPath, lock: graphPlan.bundle.graphLock }
         });
+        result.reloaded = await reloadRuntimeAfterPluginChanges(graphPlan.plan, target, transport, {
+          enabled: runtime.reloadRuntimes ?? options.reloadRuntimes,
+          executePlugins
+        });
+        result.reloadCommandSummary = result.reloaded ? formatReloadCommands(target.reloadCommands) : void 0;
       }
+      results.push(result);
     } finally {
       await rm10(graphPlan.bundle.root, { recursive: true, force: true });
     }
@@ -8994,9 +10320,9 @@ function shellQuoteArg(value) {
 }
 
 // src/cli/update-check.ts
-import { mkdir as mkdir20, readFile as readFile25, writeFile as writeFile18 } from "fs/promises";
+import { mkdir as mkdir21, readFile as readFile27, writeFile as writeFile19 } from "fs/promises";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname28, join as join37 } from "path";
+import { dirname as dirname29, join as join37 } from "path";
 var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_TIMEOUT_MS = 300;
 var REGISTRY_URL = "https://registry.npmjs.org/agentwheel";
@@ -9041,7 +10367,7 @@ async function fetchLatestVersion(fetchImpl, timeoutMs) {
 }
 async function readCache(path) {
   try {
-    const parsed = JSON.parse(await readFile25(path, "utf8"));
+    const parsed = JSON.parse(await readFile27(path, "utf8"));
     if (typeof parsed.checkedAt !== "string" || typeof parsed.latest !== "string") return void 0;
     return { checkedAt: parsed.checkedAt, latest: parsed.latest };
   } catch {
@@ -9049,8 +10375,8 @@ async function readCache(path) {
   }
 }
 async function writeCache(path, cache) {
-  await mkdir20(dirname28(path), { recursive: true });
-  await writeFile18(path, `${JSON.stringify(cache, null, 2)}
+  await mkdir21(dirname29(path), { recursive: true });
+  await writeFile19(path, `${JSON.stringify(cache, null, 2)}
 `, "utf8");
 }
 function warnIfNewer(latest, current, stderr = process.stderr) {
@@ -9213,9 +10539,9 @@ function isCrossPackageSelector(value) {
 }
 
 // src/model/package-migrate.ts
-import { readFile as readFile26, rename as rename4, writeFile as writeFile19 } from "fs/promises";
+import { readFile as readFile28, rename as rename4, writeFile as writeFile20 } from "fs/promises";
 import { join as join39, resolve as resolve19 } from "path";
-import { applyEdits, modify, parse as parse4 } from "jsonc-parser";
+import { applyEdits, modify, parse as parse5 } from "jsonc-parser";
 async function migratePackageManifest(root) {
   const packageRoot = resolve19(root);
   for (const name of openPackManifestNames) {
@@ -9231,10 +10557,10 @@ async function migratePackageManifest(root) {
   const from = join39(packageRoot, legacyName);
   const toName = legacyName.endsWith(".jsonc") ? "openpack.jsonc" : "openpack.json";
   const to = join39(packageRoot, toName);
-  const content = await readFile26(from, "utf8");
+  const content = await readFile28(from, "utf8");
   const updated = updateSchemaVersion(content);
   await rename4(from, to);
-  await writeFile19(to, updated, "utf8");
+  await writeFile20(to, updated, "utf8");
   return { changed: true, from, to, message: `Migrated ${legacyName} to ${toName}.` };
 }
 async function firstExistingLegacyManifest(root) {
@@ -9245,7 +10571,7 @@ async function firstExistingLegacyManifest(root) {
 }
 function updateSchemaVersion(content) {
   const errors = [];
-  parse4(content, errors, { allowTrailingComma: true, disallowComments: false });
+  parse5(content, errors, { allowTrailingComma: true, disallowComments: false });
   if (errors.length > 0) {
     throw new Error("Cannot migrate invalid JSON/JSONC package manifest.");
   }
@@ -9257,11 +10583,11 @@ function updateSchemaVersion(content) {
 
 // src/cli/version.ts
 import { readFileSync } from "fs";
-import { dirname as dirname29, join as join40 } from "path";
+import { dirname as dirname30, join as join40 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var FALLBACK_VERSION = "0.0.0";
 function resolveCliVersion() {
-  let dir = dirname29(fileURLToPath2(import.meta.url));
+  let dir = dirname30(fileURLToPath2(import.meta.url));
   while (true) {
     try {
       const pkg = JSON.parse(readFileSync(join40(dir, "package.json"), "utf8"));
@@ -9270,7 +10596,7 @@ function resolveCliVersion() {
       }
     } catch {
     }
-    const parent = dirname29(dir);
+    const parent = dirname30(dir);
     if (parent === dir) return FALLBACK_VERSION;
     dir = parent;
   }
@@ -9280,6 +10606,7 @@ function resolveCliVersion() {
 var CLI_VERSION = resolveCliVersion();
 var COMPANION_SKILL_SOURCE = "github:NestDevLab/agentwheel";
 var COMPANION_SKILL_NAME = "agentwheel";
+var planOutputFormats = ["human", "json", "mermaid", "html"];
 var program = new Command();
 program.name("agentwheel").description("Multi-runtime agent artifact orchestrator").version(CLI_VERSION).showSuggestionAfterError(false).option("--no-update-check", "disable npm version update check", false).addHelpText("after", `
 
@@ -9339,17 +10666,33 @@ program.command("scan").description("scan a package source for validation findin
   }
   if (!result.ok) process.exitCode = 1;
 });
-program.command("plan").description("preview what install would reconcile without writing").argument("[name-or-source]", "configured package name/source or package source to preview").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--override <source-or-package::type/name>", "for source previews, allow the source to replace a colliding artifact (repeatable)", collectOverrideOption, []).option("--dry-run", "accepted for symmetry; plan never writes", false).option("--force-drift", "replace drifted managed artifacts during install planning", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
+program.command("plan").description("preview what install would reconcile without writing").argument("[name-or-source]", "configured package name/source or package source to preview").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--profile <name>", "workspace runtime profile").option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--override <source-or-package::type/name>", "for source previews, allow the source to replace a colliding artifact (repeatable)", collectOverrideOption, []).option("--dry-run", "accepted for symmetry; plan never writes", false).option("--format <fmt>", "output format: human|json|mermaid|html", "human").option("--json", "print the resolved plan as JSON", false).option("--force-drift", "replace drifted managed artifacts during install planning", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
   await runInstallCommand(source, { ...options, dryRun: true }, { apply: false });
 });
-program.command("install").description("install configured packages into runtime targets").argument("[name-or-source]", "configured package name/source or package source to add and install").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--override <source-or-package::type/name>", "when adding a source, allow it to replace a colliding artifact (repeatable)", collectOverrideOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--force-drift", "replace drifted managed artifacts", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).addHelpText("after", "\nScoped install never removes files owned only by other configured packages; run a full install to reconcile those removals.\n").action(async (source, options) => {
+program.command("install").description("install configured packages into runtime targets").argument("[name-or-source]", "configured package name/source or package source to add and install").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--override <source-or-package::type/name>", "when adding a source, allow it to replace a colliding artifact (repeatable)", collectOverrideOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--format <fmt>", "output format: human|json|mermaid|html", "human").option("--json", "print the resolved plan as JSON", false).option("--force-drift", "replace drifted managed artifacts", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--reload-runtimes", "run configured runtime reload commands after executed semantic plugin changes", false).option("--restart-runtimes", "alias for --reload-runtimes", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).addHelpText("after", "\nScoped install never removes files owned only by other configured packages; run a full install to reconcile those removals.\n").action(async (source, options) => {
   await runInstallCommand(source, options, { apply: !options.dryRun });
 });
-program.command("sync", { hidden: true }).argument("[name-or-source]", "configured package name/source or package source").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--override <source-or-package::type/name>", "when adding a source, allow it to replace a colliding artifact (repeatable)", collectOverrideOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--force-drift", "replace drifted managed artifacts", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
+program.command("serve").description("serve a read-only live dashboard for the resolved install plan").argument("[name-or-source]", "configured package name/source or package source to preview").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--profile <name>", "workspace runtime profile").option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--override <source-or-package::type/name>", "for source previews, allow the source to replace a colliding artifact (repeatable)", collectOverrideOption, []).option("--force-drift", "replace drifted managed artifacts during install planning", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).option("--bind <addr>", "interface to bind", "127.0.0.1").option("--port <n>", "TCP port (0 selects an ephemeral port)", "8765").option("--interval <seconds>", "background re-render cadence in seconds", "60").option("--once", "render once and skip the background re-render loop", false).action(async (source, options) => {
+  await servePlanDashboard({
+    bind: options.bind,
+    port: parseServePort(options.port),
+    intervalSeconds: parseServeIntervalSeconds(options.interval),
+    once: options.once === true,
+    buildReport: () => buildPlanReport(source, options)
+  });
+});
+program.command("sync", { hidden: true }).argument("[name-or-source]", "configured package name/source or package source").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--override <source-or-package::type/name>", "when adding a source, allow it to replace a colliding artifact (repeatable)", collectOverrideOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--force-drift", "replace drifted managed artifacts", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--reload-runtimes", "run configured runtime reload commands after executed semantic plugin changes", false).option("--restart-runtimes", "alias for --reload-runtimes", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
   console.error("warning: 'agentwheel sync' is deprecated and will be removed in 0.10. Use 'agentwheel install'.");
   await runInstallCommand(source, options, { apply: !options.dryRun });
 });
-program.command("update").description("re-resolve tracking packages, then apply the result").argument("[name]", "configured package name or source to update").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("-t, --target-root <path>", "workspace root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plans without writing", false).option("--force-drift", "replace drifted managed artifacts", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--allow-adapter-code", "allow loading local adapter code from configured packages", false).option("--select <type/name>", "temporarily select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "temporarily select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (name, options) => {
+program.command("update").description("re-resolve tracking packages, then apply the result").argument("[name]", "configured package name or source to update").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("-t, --target-root <path>", "workspace root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plans without writing", false).option("--force-drift", "replace drifted managed artifacts", false).option("--force-conflict", "adopt unmanaged destinations when their content already matches the desired artifact", false).option("--replace-conflict", "replace unmanaged destinations even when their content differs", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--reload-runtimes", "run configured runtime reload commands after executed semantic plugin changes", false).option("--restart-runtimes", "alias for --reload-runtimes", false).option("--allow-adapter-code", "allow loading local adapter code from configured packages", false).option("--select <type/name>", "temporarily select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "temporarily select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--dependency <name-or-source>", "update one tracking dependency while keeping unrelated graph nodes locked (repeatable)", collectDependencyOption, []).option("--with-suggestions", "include suggested companion artifacts for selected roots", false).option("--suggestion <alias>", "include one suggested companion alias (repeatable or comma-separated)", collectSuggestionOption, []).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (name, options) => {
+  if (name && options.dependency.length > 0) throw new Error("A package argument cannot be combined with --dependency.");
+  if (options.dependency.length > 0 && (options.select.length > 0 || options.skill.length > 0)) {
+    throw new Error("--dependency cannot be combined with --select or --skill; package selections remain unchanged.");
+  }
+  if (options.dependency.length > 0 && (options.frozenLock || options.offline)) {
+    throw new Error("--dependency cannot be combined with --frozen-lock or --offline.");
+  }
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const targets = await resolveCliTargets(normalizedOptions, { preferAllProfile: true });
   for (const target of targets) {
@@ -9465,6 +10808,45 @@ program.command("remember").description("append text to the local instructions o
   console.log(`Remembered in ${result.overlayPath}.`);
   console.log(nextInstallNudge());
 });
+var ownershipCommand = program.command("ownership").description("inspect and transfer manifest ownership without rewriting runtime artifacts");
+ownershipCommand.command("handoff").description("transfer one managed artifact between Agentwheel workspace roots").argument("<selector>", "exact artifact selector in type/name form").requiredOption("--from-workspace-root <path>", "current owning workspace root").requiredOption("--to-workspace-root <path>", "new owning workspace root").option("--expected-hash <sha256>", "expected current artifact hash; required when applying").option("--expected-revision <sha256>", "expected install manifest revision; required when applying").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--profile <name>", "workspace runtime profile (must resolve to one target)").option("--dry-run", "validate all preconditions without writing the manifest", false).action(async (selector, options) => {
+  if (!options.dryRun && (!options.expectedHash || !options.expectedRevision)) {
+    throw new Error("Applying an ownership handoff requires --expected-hash and --expected-revision from a reviewed --dry-run.");
+  }
+  const normalizedOptions = normalizeRuntimeScopeOptions(options);
+  const targets = await resolveCliTargets(normalizedOptions);
+  if (targets.length !== 1) {
+    throw new Error(`Ownership handoff requires exactly one runtime target, found ${targets.length}. Select one --agent or adapter target.`);
+  }
+  const [artifactType, artifactName, ...extra] = selector.split("/");
+  if (!artifactType || !artifactName || extra.length > 0) {
+    throw new Error(`Ownership handoff selector must be exactly type/name: ${selector}`);
+  }
+  const target = targets[0];
+  const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
+  const adapter = await resolveAdapterForTarget(target, adapterOptions);
+  const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
+  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const request = {
+    ...state,
+    targetRoot: state.installRoot,
+    adapter: adapter.name,
+    artifactType,
+    artifactName,
+    fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
+    toWorkspaceRoot: normalizeCliPath(options.toWorkspaceRoot),
+    expectedHash: options.expectedHash,
+    expectedRevision: options.expectedRevision,
+    transport: transportForTarget(target)
+  };
+  const result = options.dryRun ? await planArtifactOwnershipHandoff(request) : await applyArtifactOwnershipHandoff(request);
+  console.log(`${options.dryRun ? "Ownership handoff plan" : "Ownership handed off"}: ${result.selector}`);
+  console.log(`Target: ${result.adapter}/${result.installationType ?? "default"} at ${result.targetRoot}`);
+  console.log(`Path: ${result.path}`);
+  console.log(`Hash: ${result.artifactHash}`);
+  console.log(`Manifest revision: ${result.manifestRevision}`);
+  console.log(`Owner: ${result.fromOwner} -> ${result.toOwner}`);
+});
 program.command("eject").description("copy a managed artifact into local ownership").argument("<item>", "package/type/name").option("-t, --target-root <path>", "workspace root", process.cwd()).action(async (item, options) => {
   const targetRoot = normalizeTargetRoot(options.targetRoot);
   const result = await ejectArtifact(targetRoot, item);
@@ -9514,6 +10896,38 @@ program.command("status").description("show configured packages and runtime inst
     await printStatus(target, normalizedOptions);
   }
 });
+var journalCommand = program.command("journal").description("inspect or abort pending apply journals");
+journalCommand.command("list").description("show pending apply journals for resolved runtime targets").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--profile <name>", "workspace runtime profile").action(async (options) => {
+  const normalizedOptions = normalizeRuntimeScopeOptions(options);
+  const targets = await resolveCliTargets(normalizedOptions, { preferAllProfile: true });
+  let pending = 0;
+  for (const target of targets) {
+    const state = await journalStateForTarget(target, normalizedOptions);
+    const journal = await readApplyJournal(state.installRoot, state.adapter.name, state.transport, state.state);
+    if (!journal) continue;
+    pending += 1;
+    console.log(`PENDING ${state.adapter.name}/${state.installationType} at ${state.installRoot}`);
+    console.log(`  journal: ${join41(state.installRoot, ".agentwheel", `${state.state.stateKey}.apply-journal.json`)}`);
+    console.log(`  stateKey: ${state.state.stateKey}`);
+    console.log(`  createdAt: ${journal.createdAt}`);
+    console.log(`  updatedAt: ${journal.updatedAt}`);
+    console.log(`  operations: ${journal.operations.length}, completed: ${journal.completed.length}`);
+  }
+  if (pending === 0) console.log("No pending apply journals.");
+});
+journalCommand.command("abort").description("archive pending apply journals without touching runtime files").option("--adapter <adapter>", "built-in adapter or comma-separated adapters").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--profile <name>", "workspace runtime profile").action(async (options) => {
+  const normalizedOptions = normalizeRuntimeScopeOptions(options);
+  const targets = await resolveCliTargets(normalizedOptions, { preferAllProfile: true });
+  let aborted = 0;
+  for (const target of targets) {
+    const state = await journalStateForTarget(target, normalizedOptions);
+    const result = await abortApplyJournal(state.installRoot, state.adapter.name, state.transport, state.state);
+    if (!result) continue;
+    aborted += 1;
+    console.log(`Archived ${state.adapter.name}/${state.installationType} pending journal: ${result.archivePath}`);
+  }
+  if (aborted === 0) console.log("No pending apply journals.");
+});
 program.command("doctor").description("check agentwheel runtime setup and companion skill guidance").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "shortcut for --installation-type user and home-scoped state", false).option("--local", "shortcut for --installation-type local", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--skill <name>", "check a specific skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--source <source>", "source to use in suggested install commands").option("--json", "print machine-readable doctor report", false).action(async (options) => {
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const target = await resolveRuntimeTarget({
@@ -9526,7 +10940,15 @@ program.command("doctor").description("check agentwheel runtime setup and compan
 });
 async function runInstallCommand(nameOrSource, options, behavior) {
   const normalizedOptions = normalizeRuntimeScopeOptions(options, { defaultUser: shouldDefaultUserInstall(nameOrSource, options) });
-  if (options.profile) {
+  const outputFormat = effectivePlanOutputFormat(normalizedOptions);
+  if (outputFormat !== "human") {
+    const report = await buildPlanReport(nameOrSource, normalizedOptions);
+    if (report.targets.some((target) => target.hasBlockingChanges)) process.exitCode = 1;
+    process.stdout.write(`${renderReport(report, outputFormat)}
+`);
+    return;
+  }
+  if (normalizedOptions.profile) {
     const target = await resolveRuntimeTarget({
       targetRoot: normalizedOptions.targetRoot,
       adapter: normalizedOptions.adapter,
@@ -9535,7 +10957,7 @@ async function runInstallCommand(nameOrSource, options, behavior) {
     });
     const results = await syncProfile({
       workspaceRoot: target.workspaceRoot,
-      profile: options.profile,
+      profile: normalizedOptions.profile,
       source: nameOrSource,
       driver: normalizedOptions.driver,
       mode: normalizedOptions.mode,
@@ -9543,6 +10965,7 @@ async function runInstallCommand(nameOrSource, options, behavior) {
       installationType: normalizedOptions.installationType,
       dryRun: !behavior.apply,
       executePlugins: normalizedOptions.executePlugins,
+      reloadRuntimes: shouldReloadRuntimes(normalizedOptions),
       allowAdapterCode: normalizedOptions.allowAdapterCode,
       forceDrift: normalizedOptions.forceDrift,
       forceConflict: normalizedOptions.forceConflict,
@@ -9562,9 +10985,12 @@ async function runInstallCommand(nameOrSource, options, behavior) {
     for (const result of results) {
       console.log(`Profile ${normalizedOptions.profile} / ${result.runtime} / ${result.packageName} at ${result.targetRoot} (${result.transport}):`);
       console.log(formatPlan(result.plan));
+      if (result.reloaded) console.log(`Reloaded runtime via ${result.reloadCommandSummary}.`);
       if (result.plan.hasBlockingChanges) process.exitCode = 1;
     }
-    if (behavior.apply) console.log("Applied.");
+    if (behavior.apply) {
+      console.log("Applied.");
+    }
     return;
   }
   const targets = await resolveCliTargets(normalizedOptions);
@@ -9588,16 +11014,23 @@ async function runInstallCommand(nameOrSource, options, behavior) {
         throw teachingInstallError(nameOrSource, error);
       }
     }
-    for (const result of await buildGraphPlansForTarget(target, source, { ...targetOptions, scope, extraPackage }, { mode: "install" })) {
+    for (const result of await buildGraphPlansForTarget(target, source, { ...targetOptions, scope, extraPackage, reportFormat: outputFormat }, { mode: "install" })) {
       console.log(formatGraphPlan(result));
       if (behavior.apply) {
+        const transport = transportForTarget(target);
+        const executePlugins = target.executePlugins ?? targetOptions.executePlugins;
         await applyCombinedInstallPlan(result.plan, {
-          executePlugins: targetOptions.executePlugins,
-          transport: transportForTarget(target),
+          executePlugins,
+          transport,
           graphLockDigest: result.graphLockDigest,
           graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
         });
+        const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
+          enabled: target.reloadRuntimes ?? shouldReloadRuntimes(targetOptions),
+          executePlugins
+        });
         console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
+        if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
       }
       await rm11(result.bundle.root, { recursive: true, force: true });
       if (result.plan.hasBlockingChanges) process.exitCode = 1;
@@ -9607,6 +11040,111 @@ async function runInstallCommand(nameOrSource, options, behavior) {
     }
   }
 }
+async function buildPlanReport(nameOrSource, options) {
+  const normalizedOptions = normalizeRuntimeScopeOptions(options, { defaultUser: shouldDefaultUserInstall(nameOrSource, options) });
+  const reportTargets = [];
+  const reportWarnings = [];
+  const collectWarning = (message) => {
+    reportWarnings.push(message);
+  };
+  if (normalizedOptions.profile) {
+    const target = await resolveRuntimeTarget({
+      targetRoot: normalizedOptions.targetRoot,
+      adapter: normalizedOptions.adapter,
+      installationType: normalizedOptions.installationType,
+      agent: normalizedOptions.agent
+    });
+    const results = await syncProfile({
+      workspaceRoot: target.workspaceRoot,
+      profile: normalizedOptions.profile,
+      source: nameOrSource,
+      driver: normalizedOptions.driver,
+      mode: normalizedOptions.mode,
+      select: selectedArtifactsFromOptions(normalizedOptions),
+      installationType: normalizedOptions.installationType,
+      dryRun: true,
+      executePlugins: normalizedOptions.executePlugins,
+      allowAdapterCode: normalizedOptions.allowAdapterCode,
+      forceDrift: normalizedOptions.forceDrift,
+      forceConflict: normalizedOptions.forceConflict,
+      replaceConflict: normalizedOptions.replaceConflict,
+      noDeps: noDepsFromOptions(normalizedOptions),
+      includeSuggestions: normalizedOptions.withSuggestions,
+      suggestionAliases: suggestionAliasesFromOptions(normalizedOptions),
+      lockedResolution: true,
+      frozenLock: normalizedOptions.frozenLock,
+      offline: normalizedOptions.offline,
+      yes: normalizedOptions.yes,
+      trustPatterns: normalizedOptions.trust ?? [],
+      readOnly: true,
+      isTTY: false
+    });
+    for (const result of results) {
+      reportTargets.push(installPlanReportTarget(result.plan, result.graphLockDigest));
+      reportWarnings.push(...result.warnings);
+    }
+    return planReport(reportTargets, reportWarnings);
+  }
+  const targets = await resolveCliTargets(normalizedOptions);
+  for (const target of targets) {
+    const targetOptions = optionsForResolvedTarget(normalizedOptions, target);
+    const config = await readMergedWorkspaceConfig(target.workspaceRoot);
+    const configured = nameOrSource ? findConfiguredPackageForTarget(config.packages, nameOrSource, targetOptions, target) : void 0;
+    let source;
+    let scope = configured?.name;
+    let extraPackage;
+    if (nameOrSource && !configured) {
+      try {
+        let entry = await packageEntryFromSource(nameOrSource, target.workspaceRoot, {
+          ...targetOptions,
+          adapter: targetOptions.adapter ?? target.adapter,
+          warn: collectWarning
+        });
+        if (targetOptions.multiAdapterSource) {
+          entry = packageEntryWithAdapterSuffix(entry);
+        }
+        scope = entry.name;
+        source = nameOrSource;
+        extraPackage = entry;
+      } catch (error) {
+        throw teachingInstallError(nameOrSource, error);
+      }
+    }
+    const results = await buildGraphPlansForTarget(
+      target,
+      source,
+      {
+        ...targetOptions,
+        scope,
+        extraPackage,
+        dryRun: true,
+        reportFormat: "json",
+        suppressEmptyMessage: true,
+        warn: collectWarning
+      },
+      { mode: "install" }
+    );
+    for (const result of results) {
+      reportTargets.push(installPlanReportTarget(result.plan, result.graphLockDigest));
+      reportWarnings.push(...result.warnings);
+      await rm11(result.bundle.root, { recursive: true, force: true });
+    }
+  }
+  return planReport(reportTargets, reportWarnings);
+}
+function effectivePlanOutputFormat(options) {
+  const format = options.format ?? "human";
+  if (!isPlanOutputFormat(format)) {
+    throw new Error(`Unknown --format value: ${format}. Valid formats: ${planOutputFormats.join(", ")}.`);
+  }
+  if (options.json && format !== "human" && format !== "json") {
+    throw new Error(`--json conflicts with --format ${format}. Use --format json instead.`);
+  }
+  return format !== "human" ? format : options.json ? "json" : "human";
+}
+function isPlanOutputFormat(value) {
+  return planOutputFormats.includes(value);
+}
 async function packageEntryFromSource(source, targetRoot, options) {
   const lockMode = options.frozenLock === true || options.offline === true;
   const resolvedInput = await resolvePackageSource(source, targetRoot, { offline: lockMode });
@@ -9620,7 +11158,7 @@ async function packageEntryFromSource(source, targetRoot, options) {
     adapterModule: options.adapterModule,
     allowAdapterCode: options.allowAdapterCode,
     baseDir: targetRoot,
-    warn: (message) => console.warn(message)
+    warn: options.warn ?? ((message) => console.warn(message))
   });
   const bundle = await stageSource(driver, resolvedSource, {
     workspaceRoot: targetRoot,
@@ -9662,6 +11200,9 @@ function findConfiguredPackageForTarget(packages, value, options, target) {
 function noDepsFromOptions(options) {
   return options.noDeps === true || options.deps === false;
 }
+function shouldReloadRuntimes(options) {
+  return options.reloadRuntimes === true || options.restartRuntimes === true;
+}
 function packageEntryWithAdapterSuffix(entry) {
   const suffix = `-${entry.adapter}`;
   return entry.name.endsWith(suffix) ? entry : { ...entry, name: `${entry.name}${suffix}` };
@@ -9763,7 +11304,7 @@ async function resolveAdapterForTarget(target, options) {
     adapterModule: adapterOptions.adapterModule,
     allowAdapterCode: adapterOptions.allowAdapterCode,
     baseDir: target.workspaceRoot,
-    warn: (message) => console.warn(message)
+    warn: options.warn ?? ((message) => console.warn(message))
   });
 }
 function adapterOptionsForTarget(target, options) {
@@ -9782,13 +11323,20 @@ async function runConfiguredGraphPackages(target, options, behavior) {
     console.log(`${behavior.mode === "update" ? "Update" : "Install"} ${result.plan.adapter} at ${result.plan.targetRoot}:`);
     console.log(formatGraphPlan(result));
     if (!options.dryRun) {
+      const transport = transportForTarget(target);
+      const executePlugins = target.executePlugins ?? options.executePlugins;
       await applyCombinedInstallPlan(result.plan, {
-        executePlugins: options.executePlugins,
-        transport: transportForTarget(target),
+        executePlugins,
+        transport,
         graphLockDigest: result.graphLockDigest,
         graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
       });
+      const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
+        enabled: target.reloadRuntimes ?? shouldReloadRuntimes(options),
+        executePlugins
+      });
       console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
+      if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
     }
     await rm11(result.bundle.root, { recursive: true, force: true });
     if (result.plan.hasBlockingChanges) process.exitCode = 1;
@@ -9799,6 +11347,8 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
   const groups = /* @__PURE__ */ new Map();
   const selectedArtifacts = selectedArtifactsFromOptions(targetOptions);
+  const dependencyUpdateSelectors = sortedUniqueValues(targetOptions.dependency ?? []);
+  const scopedDependencyUpdate = behavior.mode === "update" && dependencyUpdateSelectors.length > 0;
   const scopedPackage = targetOptions.scope ? findConfiguredPackage(config.packages, targetOptions.scope) : void 0;
   const scopedRootId = scopedPackage?.name ?? (source ? targetOptions.scope : void 0);
   if (targetOptions.scope && !scopedPackage && !source) throw new Error(`Configured package not found: ${targetOptions.scope}`);
@@ -9832,39 +11382,65 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
     groups.set(key, group);
   }
   if (groups.size === 0) {
-    console.log(`No packages configured at ${target.workspaceRoot}.`);
+    const message = `No packages configured at ${target.workspaceRoot}.`;
+    if (!targetOptions.suppressEmptyMessage) {
+      if (targetOptions.reportFormat && targetOptions.reportFormat !== "human") console.warn(message);
+      else console.log(message);
+    }
     return [];
   }
   const results = [];
   for (const group of groups.values()) {
-    const adapter = await resolveAdapterForTarget(group.target, group.adapterOptions);
+    const adapter = await resolveAdapterForTarget(group.target, { ...group.adapterOptions, warn: targetOptions.warn });
     const transport = transportForTarget(group.target);
     const allPackages = [...group.packages, ...group.extraPackages];
     const groupHasScope = !scopedRootId || allPackages.some((pkg) => pkg.name === scopedRootId || pkg.source === targetOptions.scope);
     if (behavior.mode === "install" && scopedRootId && !groupHasScope) continue;
+    const dependencyUpdateRootNames = /* @__PURE__ */ new Set();
+    if (scopedDependencyUpdate) {
+      const graphLockPath = graphLockPathForTarget(
+        group.target.workspaceRoot,
+        targetKeyForTarget(group.target, adapter.name),
+        adapter.name,
+        targetFingerprintParts(group.target, adapter, group.adapterOptions, group.installationType)
+      );
+      const previousLock = await (await pathExists(graphLockPath) ? readGraphLock(graphLockPath) : void 0);
+      for (const pkg of group.packages) {
+        const root = previousLock?.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
+        if (root?.mode !== "tracking") continue;
+        const node = previousLock?.canonical.nodes.find((candidate) => candidate.id === root.graphNodeId);
+        if (node && dependencyUpdateSelectors.some((selector) => dependencyUpdateSelectorMatchesRoot(root, node, selector))) {
+          dependencyUpdateRootNames.add(pkg.name);
+        }
+      }
+    }
     const updateScope = behavior.mode === "update" ? scopedPackage ? /* @__PURE__ */ new Set([scopedPackage.name]) : void 0 : void 0;
     const roots = [
       ...allPackages.map((pkg) => {
-        const updateThisPackage = behavior.mode === "update" && pkg.mode === "tracking" && (!updateScope || updateScope.has(pkg.name) || updateScope.has(pkg.source));
+        const updateThisPackage = behavior.mode === "update" && !scopedDependencyUpdate && pkg.mode === "tracking" && (!updateScope || updateScope.has(pkg.name) || updateScope.has(pkg.source));
         const packageIsScoped = scopedRootId ? pkg.name === scopedRootId || pkg.source === targetOptions.scope : true;
+        if (pkg.selection && selectedArtifacts && packageIsScoped) {
+          throw new Error(`--select/--skill cannot override imported selection for configured package '${pkg.name}'.`);
+        }
         return {
           rootId: pkg.name,
           source: pkg.source,
           mode: pkg.mode,
           ref: pkg.requestedRef,
-          select: selectedArtifacts && packageIsScoped ? selectedArtifacts : normalizeArtifactSelectors(pkg.select, pkg.skills),
+          select: pkg.selection ? void 0 : selectedArtifacts && packageIsScoped ? selectedArtifacts : normalizeArtifactSelectors(pkg.select, pkg.skills),
+          selection: pkg.selection,
           aliases: pkg.aliases,
           overrides: pkg.overrides,
           includeSuggestions: targetOptions.withSuggestions === true || pkg.withSuggestions === true,
           suggestionAliases: packageSuggestionAliases(pkg, targetOptions),
-          useLock: behavior.mode === "install" ? true : !updateThisPackage
+          useLock: behavior.mode === "install" ? true : scopedDependencyUpdate ? !dependencyUpdateRootNames.has(pkg.name) : !updateThisPackage
         };
       }),
       ...group.extraRoots
     ];
     if (behavior.mode === "update") {
       const changed = roots.filter((root) => root.useLock === false);
-      if (changed.length === 0) {
+      if (changed.length === 0 && !scopedDependencyUpdate) {
         const label = targetOptions.scope ? ` ${targetOptions.scope}` : "";
         console.log(`No tracking packages to update${label}.`);
         continue;
@@ -9883,7 +11459,8 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       noDeps: noDepsFromOptions(targetOptions),
       includeSuggestions: targetOptions.withSuggestions,
       suggestionAliases: suggestionAliasesFromOptions(targetOptions),
-      lockedResolution: behavior.mode === "install",
+      lockedResolution: behavior.mode === "install" || scopedDependencyUpdate,
+      dependencyUpdateSelectors,
       frozenLock: targetOptions.frozenLock,
       offline: targetOptions.offline,
       yes: targetOptions.yes,
@@ -9894,16 +11471,179 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       forceConflict: targetOptions.forceConflict,
       replaceConflict: targetOptions.replaceConflict
     });
-    if (behavior.mode === "install" && scopedRootId) {
+    if ((behavior.mode === "install" || behavior.mode === "update") && scopedRootId) {
       const state = installStateForTarget(group.target, adapter, group.adapterOptions, group.installationType);
       const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
       results.push(scopeInstallPlanToRoot(result, scopedRootId, manifest));
+    } else if (scopedDependencyUpdate) {
+      const state = installStateForTarget(group.target, adapter, group.adapterOptions, group.installationType);
+      const manifest = await readInstallManifest(state.installRoot, adapter.name, transport, state);
+      const previousLock = await readGraphLock(result.graphLockPath);
+      results.push(scopeUpdatePlanToDependencies(result, dependencyUpdateSelectors, previousLock, manifest));
     } else {
       results.push(result);
     }
   }
   return results;
 }
+function scopeUpdatePlanToDependencies(result, selectors, previousLock, manifest) {
+  const selectedNames = dependencyUpdatePackageNames(previousLock, selectors);
+  const allowedNodeIds = new Set(result.graph.nodes.filter((node) => selectedNames.has(node.name)).map((node) => node.id));
+  const queue = [...allowedNodeIds];
+  while (queue.length > 0) {
+    const parentId = queue.shift();
+    for (const edge of result.graph.edges) {
+      if (edge.from !== parentId || allowedNodeIds.has(edge.to)) continue;
+      allowedNodeIds.add(edge.to);
+      queue.push(edge.to);
+    }
+  }
+  const selectedPreviousNodeIds = dependencyUpdateNodeIds(previousLock, selectors);
+  const allowedNames = new Set(result.graph.nodes.filter((node) => allowedNodeIds.has(node.id)).map((node) => node.name));
+  for (const name of selectedNames) allowedNames.add(name);
+  const manifestByPath = new Map((manifest?.entries ?? []).map((entry) => [entry.path, entry]));
+  const operations = result.plan.operations.flatMap((operation) => {
+    if (operation.action === "skip" || operation.action === "keep" || operationBelongsToDependencyUpdate(operation, allowedNodeIds, allowedNames)) {
+      return [operation];
+    }
+    return transformOutOfScopeOperation(
+      operation,
+      manifestByPath.get(operation.relativeDestPath),
+      result.plan.targetRoot,
+      `scoped dependency update ${selectors.join(", ")}`
+    );
+  });
+  const selectedRootIds = dependencyUpdateRootIds(previousLock, selectors);
+  const graphLock = preserveUnrelatedGraphPackages(
+    result.bundle.graphLock,
+    previousLock,
+    allowedNodeIds,
+    selectedPreviousNodeIds,
+    selectedRootIds
+  );
+  const graphLockDigest = createHash11("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  return {
+    ...result,
+    bundle: { ...result.bundle, graphLock },
+    graphLockDigest,
+    graphDiff: diffGraphLocks(previousLock, graphLock),
+    plan: {
+      ...result.plan,
+      operations,
+      graphLockDigest,
+      hasBlockingChanges: operations.some((operation) => operation.action === "drift" || operation.action === "conflict")
+    }
+  };
+}
+function preserveUnrelatedGraphPackages(current, previous, selectedCurrentNodeIds, selectedPreviousNodeIds, selectedRootIds) {
+  const selectedCurrentRoots = current.canonical.roots.filter((root) => selectedRootIds.has(root.rootId));
+  const currentRootsById = new Map(selectedCurrentRoots.map((root) => [root.rootId, root]));
+  const roots = previous.canonical.roots.map((root) => currentRootsById.get(root.rootId) ?? root);
+  for (const root of selectedCurrentRoots) {
+    if (!previous.canonical.roots.some((candidate) => candidate.rootId === root.rootId)) roots.push(root);
+  }
+  const currentNodes = current.canonical.nodes.filter((node) => selectedCurrentNodeIds.has(node.id));
+  const previousNodes = previous.canonical.nodes.filter((node) => !selectedPreviousNodeIds.has(node.id));
+  const selectedCurrentArtifacts = current.canonical.artifacts.filter((artifact) => selectedCurrentNodeIds.has(artifact.graphNodeId));
+  const previousArtifacts = previous.canonical.artifacts.filter((artifact) => !selectedPreviousNodeIds.has(artifact.graphNodeId));
+  const edgeTouchesSelected = (from, to) => selectedCurrentNodeIds.has(from) || selectedCurrentNodeIds.has(to);
+  const previousEdge = (edge) => !selectedPreviousNodeIds.has(edge.from) && !selectedPreviousNodeIds.has(edge.to);
+  const previousIncludeEdge = (edge) => !selectedPreviousNodeIds.has(edge.fromNodeId) && !selectedPreviousNodeIds.has(edge.toNodeId);
+  const selectedCurrentRootIds = new Set(selectedCurrentRoots.map((root) => root.graphNodeId));
+  const currentRootOrNode = (id) => selectedCurrentNodeIds.has(id) || selectedCurrentRootIds.has(id);
+  const previousRootOrNode = (id) => selectedPreviousNodeIds.has(id) || previous.canonical.roots.some((root) => selectedRootIds.has(root.rootId) && root.graphNodeId === id);
+  return canonicalizeGraphLock({
+    ...current,
+    canonical: {
+      ...current.canonical,
+      roots,
+      nodes: [...currentNodes, ...previousNodes],
+      edges: [
+        ...current.canonical.edges.filter((edge) => edgeTouchesSelected(edge.from, edge.to)),
+        ...previous.canonical.edges.filter(previousEdge)
+      ],
+      includeEdges: [
+        ...current.canonical.includeEdges.filter((edge) => edgeTouchesSelected(edge.fromNodeId, edge.toNodeId)),
+        ...previous.canonical.includeEdges.filter(previousIncludeEdge)
+      ],
+      artifacts: [...selectedCurrentArtifacts, ...previousArtifacts],
+      namespacing: [
+        ...current.canonical.namespacing.filter((entry) => currentRootOrNode(entry.graphNodeId)),
+        ...previous.canonical.namespacing.filter((entry) => !previousRootOrNode(entry.graphNodeId))
+      ],
+      overrides: [
+        ...current.canonical.overrides.filter((entry) => currentRootOrNode(entry.graphNodeId) || currentRootOrNode(entry.overriddenGraphNodeId)),
+        ...previous.canonical.overrides.filter((entry) => !previousRootOrNode(entry.graphNodeId) && !previousRootOrNode(entry.overriddenGraphNodeId))
+      ],
+      plainNameIncumbents: [
+        ...current.canonical.plainNameIncumbents.filter((entry) => currentRootOrNode(entry.graphNodeId)),
+        ...previous.canonical.plainNameIncumbents.filter((entry) => !previousRootOrNode(entry.graphNodeId))
+      ]
+    }
+  });
+}
+function dependencyUpdateRootIds(lock, selectors) {
+  const nodes = new Map(lock.canonical.nodes.map((node) => [node.id, node]));
+  return new Set(lock.canonical.roots.filter((root) => {
+    const node = nodes.get(root.graphNodeId);
+    return root.mode === "tracking" && node && selectors.some((selector) => dependencyUpdateSelectorMatchesRoot(root, node, selector));
+  }).map((root) => root.rootId));
+}
+function dependencyUpdateNodeIds(lock, selectors) {
+  const nodes = new Map(lock.canonical.nodes.map((node) => [node.id, node]));
+  const selected = /* @__PURE__ */ new Set();
+  for (const root of lock.canonical.roots) {
+    const node = nodes.get(root.graphNodeId);
+    if (root.mode === "tracking" && node && selectors.some((selector) => dependencyUpdateSelectorMatchesRoot(root, node, selector))) {
+      selected.add(root.graphNodeId);
+    }
+  }
+  for (const selector of selectors) {
+    for (const edge of lock.canonical.edges) {
+      const node = nodes.get(edge.to);
+      if (!node || node.mode !== "tracking") continue;
+      if (selector === edge.alias || selector === edge.source || selector === edge.normalizedSource || selector === node.id || selector === node.name || selector === node.source || selector === node.normalizedSource) {
+        selected.add(edge.to);
+      }
+    }
+  }
+  const queue = [...selected];
+  while (queue.length > 0) {
+    const parentId = queue.shift();
+    for (const edge of lock.canonical.edges) {
+      if (edge.from !== parentId || selected.has(edge.to)) continue;
+      selected.add(edge.to);
+      queue.push(edge.to);
+    }
+  }
+  return selected;
+}
+function dependencyUpdatePackageNames(lock, selectors) {
+  const nodes = new Map(lock.canonical.nodes.map((node) => [node.id, node]));
+  const names = /* @__PURE__ */ new Set();
+  for (const selector of selectors) {
+    for (const root of lock.canonical.roots) {
+      const node = nodes.get(root.graphNodeId);
+      if (root.mode !== "tracking" || !node) continue;
+      if (dependencyUpdateSelectorMatchesRoot(root, node, selector)) {
+        names.add(node.name);
+      }
+    }
+    for (const edge of lock.canonical.edges) {
+      const node = nodes.get(edge.to);
+      if (!node || node.mode !== "tracking") continue;
+      if (selector === edge.alias || selector === edge.source || selector === edge.normalizedSource || selector === node.id || selector === node.name || selector === node.source || selector === node.normalizedSource) {
+        names.add(node.name);
+      }
+    }
+  }
+  return names;
+}
+function operationBelongsToDependencyUpdate(operation, allowedNodeIds, allowedNames) {
+  if (operation.graphNodeId && allowedNodeIds.has(operation.graphNodeId)) return true;
+  if (operation.owners?.some((owner) => allowedNodeIds.has(owner))) return true;
+  return operation.composedFrom?.some((entry) => [...allowedNames].some((name) => entry.selector.startsWith(`${name}@`) || entry.selector.startsWith(`${name}:`))) === true;
+}
 function scopeInstallPlanToRoot(result, rootId, manifest) {
   const scopedOwners = scopedGraphOwnerKeys(result, rootId);
   const manifestByPath = new Map((manifest?.entries ?? []).map((entry) => [entry.path, entry]));
@@ -9917,7 +11657,7 @@ function scopeInstallPlanToRoot(result, rootId, manifest) {
       continue;
     }
     const entry = manifestByPath.get(operation.relativeDestPath);
-    const transformed = transformOutOfScopeOperation(operation, entry, result.plan.targetRoot, rootId);
+    const transformed = transformOutOfScopeOperation(operation, entry, result.plan.targetRoot, `scoped install ${rootId}`);
     for (const scopedOperation of transformed) {
       if (preservedPaths.has(scopedOperation.relativeDestPath)) continue;
       preservedPaths.add(scopedOperation.relativeDestPath);
@@ -9927,7 +11667,7 @@ function scopeInstallPlanToRoot(result, rootId, manifest) {
   for (const entry of manifest?.entries ?? []) {
     if (plannedPaths.has(entry.path) || preservedPaths.has(entry.path) || entryBelongsToScopedRoot(entry, scopedOwners)) continue;
     preservedPaths.add(entry.path);
-    operations.push(keepManifestEntryOperation(entry, result.plan.targetRoot, rootId));
+    operations.push(keepManifestEntryOperation(entry, result.plan.targetRoot, `scoped install ${rootId}`));
   }
   return {
     ...result,
@@ -9938,16 +11678,16 @@ function scopeInstallPlanToRoot(result, rootId, manifest) {
     }
   };
 }
-function transformOutOfScopeOperation(operation, entry, targetRoot, rootId) {
+function transformOutOfScopeOperation(operation, entry, targetRoot, scopeDescription) {
   if (operation.action === "skip") return [operation];
   if (operation.action === "update" || operation.action === "drift") {
-    return entry ? [keepManifestEntryOperation(entry, targetRoot, rootId, operation, { freshMetadata: true })] : [];
+    return entry ? [keepManifestEntryOperation(entry, targetRoot, scopeDescription, operation, { freshMetadata: true })] : [];
   }
   if (operation.action === "remove") {
-    return entry ? [keepManifestEntryOperation(entry, targetRoot, rootId)] : [];
+    return entry ? [keepManifestEntryOperation(entry, targetRoot, scopeDescription)] : [];
   }
   if (operation.action === "plugin" || operation.action === "program") {
-    return entry ? [keepManifestEntryOperation(entry, targetRoot, rootId)] : [];
+    return entry ? [keepManifestEntryOperation(entry, targetRoot, scopeDescription)] : [];
   }
   return [];
 }
@@ -9975,7 +11715,7 @@ function entryBelongsToScopedRoot(entry, scopedOwners) {
   const owners = "owners" in entry ? entry.owners : [entry.packageName ?? "legacy"];
   return owners.some((owner) => scopedOwners.has(owner));
 }
-function keepManifestEntryOperation(entry, targetRoot, rootId, operation, options = {}) {
+function keepManifestEntryOperation(entry, targetRoot, scopeDescription, operation, options = {}) {
   const owners = "owners" in entry ? entry.owners : [entry.packageName ?? "legacy"];
   const fresh = options.freshMetadata ? operation : void 0;
   return {
@@ -9988,7 +11728,7 @@ function keepManifestEntryOperation(entry, targetRoot, rootId, operation, option
     desiredHash: entry.sourceHash,
     currentHash: operation?.currentHash ?? entry.hash,
     manifestHash: entry.hash,
-    reason: `preserved outside scoped install ${rootId}`,
+    reason: `preserved outside ${scopeDescription}`,
     channel: entry.channel,
     packageName: entry.packageName,
     semanticCommand: entry.semanticCommand,
@@ -10046,7 +11786,8 @@ async function uninstallConfiguredPackage(target, packageName, options) {
           source: pkg2.source,
           mode: pkg2.mode,
           ref: pkg2.requestedRef,
-          select: normalizeArtifactSelectors(pkg2.select, pkg2.skills),
+          select: pkg2.selection ? void 0 : normalizeArtifactSelectors(pkg2.select, pkg2.skills),
+          selection: pkg2.selection,
           aliases: pkg2.aliases,
           overrides: pkg2.overrides,
           includeSuggestions: options.withSuggestions === true || pkg2.withSuggestions === true,
@@ -10206,6 +11947,14 @@ async function printStatus(target, options) {
   }
   await printPendingInstallWork(target, options);
 }
+async function journalStateForTarget(target, options) {
+  const adapterOptions = adapterOptionsForTarget(target, options);
+  const adapter = await resolveAdapterForTarget(target, adapterOptions);
+  const transport = transportForTarget(target);
+  const installationType = options.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
+  const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  return { adapter, transport, installationType, installRoot: state.installRoot, state };
+}
 async function printPendingInstallWork(target, options) {
   let results = [];
   try {
@@ -10369,6 +12118,12 @@ function collectSuggestionOption(value, previous) {
 function collectTrustOption(value, previous) {
   return [...previous, value];
 }
+function collectDependencyOption(value, previous) {
+  return [...previous, ...splitSelectorList(value)];
+}
+function sortedUniqueValues(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort((a, b) => a.localeCompare(b));
+}
 function collectOverrideOption(value, previous) {
   return [...previous, ...splitSelectorList(value)];
 }
@@ -10470,9 +12225,9 @@ function filterUninstallPlanBySelection(plan, selected) {
   };
 }
 async function initPackage(root) {
-  await mkdir21(join41(root, "instructions"), { recursive: true });
-  await mkdir21(join41(root, "rules"), { recursive: true });
-  await mkdir21(join41(root, "skills"), { recursive: true });
+  await mkdir22(join41(root, "instructions"), { recursive: true });
+  await mkdir22(join41(root, "rules"), { recursive: true });
+  await mkdir22(join41(root, "skills"), { recursive: true });
   const manifestPath = join41(root, "openpack.json");
   const manifest = {
     schemaVersion: 2,
@@ -10484,12 +12239,12 @@ async function initPackage(root) {
       { type: "skills", path: "skills" }
     ]
   };
-  await writeFile20(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  await writeFile21(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  await writeFile20(join41(root, "instructions", "AGENTS.md"), "# Agent Instructions\n", "utf8");
+  await writeFile21(join41(root, "instructions", "AGENTS.md"), "# Agent Instructions\n", "utf8");
 }
 async function defaultBootstrapPackage(_root) {
-  const packageRoot = await findAgentwheelPackageRoot(dirname30(fileURLToPath3(import.meta.url)));
+  const packageRoot = await findAgentwheelPackageRoot(dirname31(fileURLToPath3(import.meta.url)));
   if (!packageRoot) return void 0;
   return {
     name: "agentwheel",
@@ -10536,7 +12291,7 @@ async function findAgentwheelPackageRoot(start) {
   let current = resolve20(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
-    const parent = dirname30(current);
+    const parent = dirname31(current);
     if (parent === current) return void 0;
     current = parent;
   }