agentwheel 0.16.1 → 0.16.3

package/README.md

@@ -189,6 +189,12 @@ agentwheel install mcp-registry:publisher/server-name --adapter claude --local
 agentwheel install clawhub:@openclaw/whatsapp --adapter openclaw --local
 ```
 
+### Private GitHub sources
+
+OpenPack manifests stay portable and do not contain personal GitHub accounts or tokens. Configure
+local `gh` accounts through a user-local auth profile; see [Git Authentication](docs/git-authentication.md)
+for the configuration format and runtime behavior.
+
 `mcp-registry:<server-name>` reads the public MCP Registry and stages a generated OpenPack package
 only when the server exposes a safe unauthenticated `streamable-http` remote. Entries that require
 secret headers or only publish native package instructions remain discovery-only until they are

package/dist/index.js

@@ -12,8 +12,8 @@ import {
 import { createHash as createHash12 } from "crypto";
 import { existsSync } from "fs";
 import { mkdir as mkdir23, rm as rm12, writeFile as writeFile22 } from "fs/promises";
-import { homedir as homedir10 } from "os";
-import { dirname as dirname32, join as join45, resolve as resolve22 } from "path";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname32, join as join46, resolve as resolve22 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -941,6 +941,9 @@ function mergeOpenClawJson(base, incoming, path = []) {
   if (path.join(".") === "agents.list" && Array.isArray(base) && Array.isArray(incoming)) {
     return mergeOpenClawAgentsById(base, incoming);
   }
+  if (isAgentwheelSkillRouterRepositoriesPath(path) && Array.isArray(base) && Array.isArray(incoming)) {
+    return mergeOpenClawRecordsByKey(base, incoming, "name");
+  }
   if (Array.isArray(base) && Array.isArray(incoming)) {
     return deepMerge(base, incoming);
   }
@@ -956,6 +959,9 @@ function mergeOpenClawJson(base, incoming, path = []) {
 function isMcpServerCodexAgentsPath(path) {
   return path.length === 5 && path[0] === "mcp" && path[1] === "servers" && path[3] === "codex" && path[4] === "agents";
 }
+function isAgentwheelSkillRouterRepositoriesPath(path) {
+  return path.join(".") === "plugins.entries.agentwheel-skill-router.config.repositories";
+}
 function expandEnvPlaceholders(value, sourcePath) {
   if (typeof value === "string") {
     return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_match, name) => {
@@ -1011,6 +1017,35 @@ function mergeOpenClawAgentsById(base, incoming) {
   }
   return out;
 }
+function mergeOpenClawRecordsByKey(base, incoming, key) {
+  const replacements = /* @__PURE__ */ new Map();
+  for (const value of incoming) {
+    const recordKey = isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+    if (recordKey) replacements.set(recordKey, value);
+  }
+  const out = [];
+  const emitted = /* @__PURE__ */ new Set();
+  for (const value of base) {
+    const recordKey = isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+    const replacement = recordKey ? replacements.get(recordKey) : void 0;
+    if (!recordKey || !replacement) {
+      out.push(value);
+      continue;
+    }
+    if (!emitted.has(recordKey)) {
+      out.push(replacement);
+      emitted.add(recordKey);
+    }
+  }
+  for (const value of incoming) {
+    const recordKey = isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+    if (!recordKey || !emitted.has(recordKey)) {
+      out.push(value);
+      if (recordKey) emitted.add(recordKey);
+    }
+  }
+  return out;
+}
 
 // src/install/manifest.ts
 import { createHash as createHash2 } from "crypto";
@@ -5915,9 +5950,80 @@ function cachePathFor(packageName, cacheRoot) {
 // src/source/git.ts
 import { execFile as execFile4 } from "child_process";
 import { cp as cp2, mkdir as mkdir13, rename as rename3, rm as rm6, writeFile as writeFile15 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { basename as basename11, dirname as dirname16, join as join21, resolve as resolve7 } from "path";
+import { homedir as homedir3 } from "os";
+import { basename as basename11, dirname as dirname16, join as join22, resolve as resolve7 } from "path";
 import { promisify as promisify4 } from "util";
+
+// src/source/auth.ts
+import { readFile as readFile18 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join21 } from "path";
+var AUTH_CONFIG_ENV = "AGENTWHEEL_AUTH_CONFIG";
+async function gitAuthArguments(url) {
+  const profile = await matchingGitAuthProfile(url);
+  if (!profile) return [];
+  if (profile.provider !== "gh") {
+    throw new Error(`Unsupported Agentwheel Git auth provider: ${profile.provider}`);
+  }
+  const account = shellQuote(profile.account);
+  const helper = `!f() { echo username=x-access-token; echo password="$(gh auth token --user ${account})"; }; f`;
+  return ["-c", "credential.helper=", "-c", `credential.helper=${helper}`];
+}
+async function matchingGitAuthProfile(url) {
+  const config = await readGitAuthConfig();
+  if (!config) return void 0;
+  const repository = repositoryKey(url);
+  return Object.values(config.profiles).find(
+    (profile) => profile.repositories.some((pattern) => matchesRepository(pattern, repository))
+  );
+}
+async function readGitAuthConfig() {
+  const path = process.env[AUTH_CONFIG_ENV] ?? join21(homedir2(), ".agentwheel", "auth.json");
+  try {
+    const parsed = JSON.parse(await readFile18(path, "utf8"));
+    return parseGitAuthConfig(parsed, path);
+  } catch (error) {
+    if (isMissingFile(error)) return void 0;
+    if (error instanceof SyntaxError) throw new Error(`Invalid Agentwheel auth config JSON: ${path}`);
+    throw error;
+  }
+}
+function parseGitAuthConfig(value, path) {
+  if (!isRecord8(value) || !isRecord8(value.profiles)) {
+    throw new Error(`Invalid Agentwheel auth config: expected profiles in ${path}`);
+  }
+  const profiles = {};
+  for (const [name, candidate] of Object.entries(value.profiles)) {
+    if (!isRecord8(candidate) || candidate.provider !== "gh" || typeof candidate.account !== "string" || !Array.isArray(candidate.repositories)) {
+      throw new Error(`Invalid Agentwheel auth profile '${name}' in ${path}`);
+    }
+    const repositories = candidate.repositories.filter((repository) => typeof repository === "string" && repository.length > 0);
+    if (repositories.length !== candidate.repositories.length) {
+      throw new Error(`Invalid repository matcher in Agentwheel auth profile '${name}' in ${path}`);
+    }
+    profiles[name] = { provider: "gh", account: candidate.account, repositories };
+  }
+  return { profiles };
+}
+function repositoryKey(url) {
+  const parsed = new URL(url);
+  return `${parsed.host}/${parsed.pathname.replace(/^\//, "").replace(/\.git$/, "")}`.toLowerCase();
+}
+function matchesRepository(pattern, repository) {
+  const escaped = pattern.toLowerCase().replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`).test(repository);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function isRecord8(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMissingFile(error) {
+  return isRecord8(error) && error.code === "ENOENT";
+}
+
+// src/source/git.ts
 var execFileAsync4 = promisify4(execFile4);
 var GitSourceDriver = class {
   name = "git";
@@ -5940,14 +6046,22 @@ var GitSourceDriver = class {
     return withFilesystemLock(`${resolved.resolvedPath}.lock`, resolved.cacheLockTimeoutMs ?? 3e4, async () => {
       const parsed = parseGitSource(resolved.source);
       await mkdir13(resolve7(resolved.resolvedPath, ".."), { recursive: true });
-      if (!await pathExists(join21(resolved.resolvedPath, ".git"))) {
+      if (!await pathExists(join22(resolved.resolvedPath, ".git"))) {
         if (resolved.frozenLock) {
           throw new Error(`Frozen lock requires cached git checkout at ${resolved.resolvedPath}`);
         }
         await rm6(resolved.resolvedPath, { recursive: true, force: true });
-        await git(["clone", parsed.url, resolved.resolvedPath]);
+        await git([...await gitAuthArguments(parsed.url), "clone", parsed.url, resolved.resolvedPath]);
       } else if (!resolved.frozenLock) {
-        await git(["-C", resolved.resolvedPath, "fetch", "--tags", "--prune", "origin"]);
+        await git([
+          ...await gitAuthArguments(parsed.url),
+          "-C",
+          resolved.resolvedPath,
+          "fetch",
+          "--tags",
+          "--prune",
+          "origin"
+        ]);
       }
       const ref = resolved.requestedRef ?? parsed.ref ?? "HEAD";
       if (ref === "HEAD") {
@@ -6007,20 +6121,20 @@ function parseGitSource(source) {
   throw new Error(`Invalid git source: ${source}`);
 }
 function cachePathFor2(url, cacheRoot) {
-  const root = cacheRoot ? resolve7(cacheRoot) : join21(homedir2(), ".agentwheel", "cache");
+  const root = cacheRoot ? resolve7(cacheRoot) : join22(homedir3(), ".agentwheel", "cache");
   const slug2 = url.replace(/^[a-z]+:\/\//i, "").replace(/\.git$/i, "").replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "");
-  return join21(root, slug2 || basename11(url));
+  return join22(root, slug2 || basename11(url));
 }
 async function git(args) {
   return execFileAsync4("git", args, { maxBuffer: 1024 * 1024 * 10 });
 }
 async function snapshotCheckout(checkoutPath, commit) {
-  const snapshotPath = join21(dirname16(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
+  const snapshotPath = join22(dirname16(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
   if (await pathExists(snapshotPath)) return snapshotPath;
-  const tempPath = join21(dirname16(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
+  const tempPath = join22(dirname16(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
   await rm6(tempPath, { recursive: true, force: true });
   await cp2(checkoutPath, tempPath, { recursive: true, dereference: true });
-  await rm6(join21(tempPath, ".git"), { recursive: true, force: true });
+  await rm6(join22(tempPath, ".git"), { recursive: true, force: true });
   try {
     await rename3(tempPath, snapshotPath);
   } catch (error) {
@@ -6036,7 +6150,7 @@ async function withFilesystemLock(lockPath, timeoutMs, fn) {
   while (true) {
     try {
       await mkdir13(lockPath);
-      await writeFile15(join21(lockPath, "owner.json"), JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
+      await writeFile15(join22(lockPath, "owner.json"), JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
       break;
     } catch (error) {
       if (!isAlreadyExists2(error)) throw error;
@@ -6058,7 +6172,7 @@ function isAlreadyExists2(error) {
 
 // src/source/mcp-registry.ts
 import { mkdir as mkdir14, writeFile as writeFile16 } from "fs/promises";
-import { basename as basename12, dirname as dirname17, join as join22, resolve as resolve8 } from "path";
+import { basename as basename12, dirname as dirname17, join as join23, resolve as resolve8 } from "path";
 var registryBaseUrl = "https://registry.modelcontextprotocol.io/v0.1";
 var sourcePrefix2 = "mcp-registry:";
 var McpRegistrySourceDriver = class {
@@ -6124,7 +6238,7 @@ var McpRegistrySourceDriver = class {
     return this.local.list({ ...resolved, driver: "local" });
   }
   async scan(resolved) {
-    if (!await pathExists(join22(resolved.resolvedPath, "mcp"))) {
+    if (!await pathExists(join23(resolved.resolvedPath, "mcp"))) {
       return { ok: false, findings: [{ level: "error", message: "MCP registry source has no generated mcp artifact" }] };
     }
     return { ok: true, findings: [] };
@@ -6164,9 +6278,9 @@ function isSafeHttpUrl(value) {
 }
 async function writeGeneratedPackage2(root, server) {
   const serverId = installNameFor3(server.serverName);
-  const mcpPath = join22(root, "mcp", `${serverId}.json`);
+  const mcpPath = join23(root, "mcp", `${serverId}.json`);
   await mkdir14(dirname17(mcpPath), { recursive: true });
-  await writeFile16(join22(root, "openpack.json"), `${JSON.stringify({
+  await writeFile16(join23(root, "openpack.json"), `${JSON.stringify({
     schemaVersion: 2,
     name: `mcp-registry/${server.serverName}`,
     version: server.version ?? "latest",
@@ -6187,20 +6301,20 @@ function installNameFor3(serverName) {
   return basename12(serverName).replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "mcp-server";
 }
 function cachePathFor3(serverName, cacheRoot) {
-  const root = cacheRoot ? resolve8(cacheRoot) : join22(process.env.HOME ?? ".", ".agentwheel", "cache");
+  const root = cacheRoot ? resolve8(cacheRoot) : join23(process.env.HOME ?? ".", ".agentwheel", "cache");
   const slug2 = `mcp-registry-${serverName}`.replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "");
-  return join22(root, slug2 || "mcp-registry-server");
+  return join23(root, slug2 || "mcp-registry-server");
 }
 
 // src/source/skillkit.ts
-import { cp as cp3, mkdir as mkdir15, readFile as readFile18, rm as rm7 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { basename as basename14, dirname as dirname19, join as join24, resolve as resolve9 } from "path";
+import { cp as cp3, mkdir as mkdir15, readFile as readFile19, rm as rm7 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { basename as basename14, dirname as dirname19, join as join25, resolve as resolve9 } from "path";
 import * as defaultSkillKit from "@skillkit/core";
 
 // src/source/skill-artifacts.ts
 import { readdir as readdir2, stat as stat4 } from "fs/promises";
-import { basename as basename13, dirname as dirname18, extname as extname2, join as join23 } from "path";
+import { basename as basename13, dirname as dirname18, extname as extname2, join as join24 } from "path";
 async function artifactsFromSkillPaths(paths, packageName) {
   const artifacts = [];
   const seen = /* @__PURE__ */ new Set();
@@ -6222,14 +6336,14 @@ async function discoverSkillPaths(root) {
 async function artifactFromSkillPath(item, packageName) {
   const stats = await stat4(item.path);
   if (stats.isDirectory()) {
-    const skillMd = join23(item.path, "SKILL.md");
+    const skillMd = join24(item.path, "SKILL.md");
     if (!await pathExists(skillMd)) return void 0;
     const name = sanitizeSkillName(item.name ?? basename13(item.path));
     return {
       type: "skills",
       name,
       sourcePath: item.path,
-      relativePath: join23("skills", name),
+      relativePath: join24("skills", name),
       kind: "dir",
       hash: await hashPath(item.path),
       packageName,
@@ -6243,7 +6357,7 @@ async function artifactFromSkillPath(item, packageName) {
       type: "skills",
       name,
       sourcePath: dir,
-      relativePath: join23("skills", name),
+      relativePath: join24("skills", name),
       kind: "dir",
       hash: await hashPath(dir),
       packageName,
@@ -6256,7 +6370,7 @@ async function artifactFromSkillPath(item, packageName) {
       type: "skills",
       name,
       sourcePath: item.path,
-      relativePath: join23("skills", `${name}.md`),
+      relativePath: join24("skills", `${name}.md`),
       kind: "file",
       hash: await hashPath(item.path),
       packageName,
@@ -6274,7 +6388,7 @@ async function walk(dir, paths) {
   }
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory() || entry.name === ".git" || entry.name === "node_modules") continue;
-    await walk(join23(dir, entry.name), paths);
+    await walk(join24(dir, entry.name), paths);
   }
 }
 function sanitizeSkillName(name) {
@@ -6374,9 +6488,9 @@ var SkillKitSourceDriver = class {
       throw new Error("SkillKit translateSkill API unavailable");
     }
     for (const skill of this.discover(resolved.resolvedPath)) {
-      const skillMd = join24(skill.path, "SKILL.md");
+      const skillMd = join25(skill.path, "SKILL.md");
       if (await pathExists(skillMd)) {
-        this.core.translateSkill(await readFile18(skillMd, "utf8"), "openclaw", { sourceFilename: "SKILL.md" });
+        this.core.translateSkill(await readFile19(skillMd, "utf8"), "openclaw", { sourceFilename: "SKILL.md" });
       }
     }
     return resolved;
@@ -6405,8 +6519,8 @@ function normalizeProviderSource(spec) {
   return spec;
 }
 function cachePathFor4(spec, cacheRoot) {
-  const root = cacheRoot ? resolve9(cacheRoot) : join24(homedir3(), ".agentwheel", "cache");
-  return join24(root, "skillkit", packageSlug(spec));
+  const root = cacheRoot ? resolve9(cacheRoot) : join25(homedir4(), ".agentwheel", "cache");
+  return join25(root, "skillkit", packageSlug(spec));
 }
 function packageSlug(spec) {
   return spec.replace(/^[a-z]+:\/\//i, "").replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "source";
@@ -6419,7 +6533,7 @@ function mapSeverity(severity) {
 
 // src/source/vercel-skills.ts
 import { stat as stat5 } from "fs/promises";
-import { basename as basename15, join as join25, relative as relative5, resolve as resolve10 } from "path";
+import { basename as basename15, join as join26, relative as relative5, resolve as resolve10 } from "path";
 var VercelSkillsSourceDriver = class {
   name = "vercel-skills";
   git = new GitSourceDriver();
@@ -6482,7 +6596,7 @@ var VercelSkillsSourceDriver = class {
 };
 async function resolveVercelSkillSubpath(root, subpath) {
   if (!subpath) return root;
-  const candidates = [join25(root, subpath), join25(root, "skills", subpath)];
+  const candidates = [join26(root, subpath), join26(root, "skills", subpath)];
   for (const candidate of candidates) {
     if (await pathExists(candidate)) return candidate;
   }
@@ -6553,13 +6667,13 @@ function getSourceDriver(name = "local") {
 
 // src/staging/staging.ts
 import { chmod, cp as cp5, mkdir as mkdir18, mkdtemp as mkdtemp3, readdir as readdir5, stat as stat8 } from "fs/promises";
-import { basename as basename19, dirname as dirname23, join as join29, relative as relative7, resolve as resolve12, sep as sep2 } from "path";
+import { basename as basename19, dirname as dirname23, join as join30, relative as relative7, resolve as resolve12, sep as sep2 } from "path";
 import { tmpdir as tmpdir4 } from "os";
 
 // src/compose/markdown.ts
 import { createHash as createHash6 } from "crypto";
-import { readdir as readdir3, readFile as readFile19, stat as stat6, writeFile as writeFile17 } from "fs/promises";
-import { basename as basename16, dirname as dirname20, extname as extname3, join as join26, relative as relative6, resolve as resolve11, sep } from "path";
+import { readdir as readdir3, readFile as readFile20, stat as stat6, writeFile as writeFile17 } from "fs/promises";
+import { basename as basename16, dirname as dirname20, extname as extname3, join as join27, relative as relative6, resolve as resolve11, sep } from "path";
 var includePattern = /<!--\s*openpack:include(\?)?\s+([^>]+?)\s*-->/g;
 var escapedIncludePattern = /<!--\s*openpack\\:include(\?)?\s+([^>]+?)\s*-->/g;
 var generatedPattern = /<!--\s*(?:BEGIN|END)\s+openpack:include\b/;
@@ -6597,7 +6711,7 @@ async function validateMarkdownIncludes(artifacts, packageRoot, options = {}) {
   }
 }
 async function expandFile(file, packageRoot, appendEntries, artifactPaths, options) {
-  const raw = await readFile19(file, "utf8");
+  const raw = await readFile20(file, "utf8");
   const owner = ownerSelector(packageRoot, file, options.nodeId);
   const expanded = await expandContent(raw, packageRoot, [owner], artifactPaths, options);
   let content = expanded.content;
@@ -6690,7 +6804,7 @@ async function expandInclude(selector, packageRoot, artifactPaths, options) {
   if (!stats.isFile()) {
     throw new Error(`OpenPack include is not a file: ${displaySelector}`);
   }
-  const raw = sourceContent ?? await readFile19(sourcePath, "utf8");
+  const raw = sourceContent ?? await readFile20(sourcePath, "utf8");
   const { optional: _optional, markers: _markers, chain: _chain, ...childOptions } = options;
   const expanded = await expandContent(raw, includePackageRoot, [...options.chain, displaySelector], includeArtifactPaths, {
     ...childOptions,
@@ -6766,7 +6880,7 @@ async function listMarkdownFiles(root) {
   const out = [];
   async function walk2(dir) {
     for (const entry of (await readdir3(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
-      const full = join26(dir, entry.name);
+      const full = join27(dir, entry.name);
       if (entry.isDirectory()) {
         await walk2(full);
       } else if (entry.isFile() && extname3(entry.name).toLowerCase() === ".md") {
@@ -6826,8 +6940,8 @@ function artifactPathMap(artifacts) {
 }
 
 // src/staging/customize.ts
-import { cp as cp4, mkdir as mkdir16, readdir as readdir4, readFile as readFile20, writeFile as writeFile18 } from "fs/promises";
-import { dirname as dirname21, join as join27 } from "path";
+import { cp as cp4, mkdir as mkdir16, readdir as readdir4, readFile as readFile21, writeFile as writeFile18 } from "fs/promises";
+import { dirname as dirname21, join as join28 } from "path";
 async function applyCustomizations(artifacts, options) {
   let next = [...artifacts];
   next = await applyReplacements2(next, options, "override", installableArtifactTypes());
@@ -6843,14 +6957,14 @@ async function applyFragmentCustomizations(artifacts, options) {
   return next.sort((a, b) => `${a.type}:${a.name}:${a.channel}`.localeCompare(`${b.type}:${b.name}:${b.channel}`));
 }
 async function applyInstructionOverlay(artifacts, options) {
-  const overlayPath = join27(options.workspaceRoot, ".agentwheel", "overlays", options.adapter.name, "instructions.local.md");
+  const overlayPath = join28(options.workspaceRoot, ".agentwheel", "overlays", options.adapter.name, "instructions.local.md");
   if (!await pathExists(overlayPath)) return artifacts;
   const index = artifacts.findIndex((artifact2) => artifact2.type === "instructions");
   if (index < 0) return artifacts;
   const artifact = artifacts[index];
-  const managed = await readFile20(artifact.stagedPath ?? artifact.sourcePath, "utf8");
-  const local = await readFile20(overlayPath, "utf8");
-  const composedPath = join27(options.stageRoot, ".agentwheel-composed", "instructions", "AGENTS.md");
+  const managed = await readFile21(artifact.stagedPath ?? artifact.sourcePath, "utf8");
+  const local = await readFile21(overlayPath, "utf8");
+  const composedPath = join28(options.stageRoot, ".agentwheel-composed", "instructions", "AGENTS.md");
   await mkdir16(dirname21(composedPath), { recursive: true });
   await writeFile18(
     composedPath,
@@ -6878,19 +6992,19 @@ async function applyInstructionOverlay(artifacts, options) {
   return [...artifacts.slice(0, index), updated, ...artifacts.slice(index + 1)];
 }
 async function applyAdditions(artifacts, options) {
-  const additionsRoot = join27(options.workspaceRoot, ".agentwheel", "additions");
-  const rulesRoot = join27(additionsRoot, "rules");
+  const additionsRoot = join28(options.workspaceRoot, ".agentwheel", "additions");
+  const rulesRoot = join28(additionsRoot, "rules");
   if (!await pathExists(rulesRoot)) return artifacts;
   const additions = [];
   for (const entry of await sortedDirEntries2(rulesRoot)) {
-    const full = join27(rulesRoot, entry.name);
+    const full = join28(rulesRoot, entry.name);
     if (!entry.isFile()) continue;
     additions.push({
       type: "rules",
       name: entry.name,
       sourcePath: full,
       stagedPath: full,
-      relativePath: join27("additions", "rules", entry.name),
+      relativePath: join28("additions", "rules", entry.name),
       kind: "file",
       hash: await hashPath(full),
       packageName: options.packageName,
@@ -6914,16 +7028,16 @@ async function applyReplacements2(artifacts, options, channel, artifactTypes) {
       );
     }
     for (const type of artifactTypes) {
-      const typeRoot = join27(root, type);
+      const typeRoot = join28(root, type);
       if (!await pathExists(typeRoot)) continue;
       for (const entry of await sortedDirEntries2(typeRoot)) {
         const artifactMapKey = `${type}:${entry.name}`;
         if (seen.has(artifactMapKey)) continue;
         seen.add(artifactMapKey);
-        const full = join27(typeRoot, entry.name);
+        const full = join28(typeRoot, entry.name);
         const artifactKind = entry.isDirectory() ? "dir" : "file";
         const existing = byKey.get(artifactMapKey);
-        const stagedPath = join27(options.stageRoot, ".agentwheel-composed", channel, type, entry.name);
+        const stagedPath = join28(options.stageRoot, ".agentwheel-composed", channel, type, entry.name);
         await mkdir16(dirname21(stagedPath), { recursive: true });
         await cp4(full, stagedPath, { recursive: artifactKind === "dir", dereference: true });
         byKey.set(artifactMapKey, {
@@ -6932,7 +7046,7 @@ async function applyReplacements2(artifacts, options, channel, artifactTypes) {
           name: entry.name,
           sourcePath: full,
           stagedPath,
-          relativePath: existing?.relativePath ?? join27(type, entry.name),
+          relativePath: existing?.relativePath ?? join28(type, entry.name),
           kind: artifactKind,
           hash: await hashPath(stagedPath),
           packageName,
@@ -6947,13 +7061,13 @@ function replacementRoots(options, channel) {
   const stateDir = channel === "override" ? "overrides" : "ejected";
   const roots = [];
   if (options.graphNodeId) {
-    roots.push({ root: join27(options.workspaceRoot, ".agentwheel", stateDir, ...options.graphNodeId.split("/")), kind: "node" });
+    roots.push({ root: join28(options.workspaceRoot, ".agentwheel", stateDir, ...options.graphNodeId.split("/")), kind: "node" });
   }
   if (options.packageName && options.packageVersion) {
-    roots.push({ root: join27(options.workspaceRoot, ".agentwheel", stateDir, ...`${options.packageName}@${options.packageVersion}`.split("/")), kind: "version" });
+    roots.push({ root: join28(options.workspaceRoot, ".agentwheel", stateDir, ...`${options.packageName}@${options.packageVersion}`.split("/")), kind: "version" });
   }
   if (options.packageName) {
-    roots.push({ root: join27(options.workspaceRoot, ".agentwheel", stateDir, ...options.packageName.split("/")), kind: "package" });
+    roots.push({ root: join28(options.workspaceRoot, ".agentwheel", stateDir, ...options.packageName.split("/")), kind: "package" });
   }
   return roots;
 }
@@ -6968,8 +7082,8 @@ async function sortedDirEntries2(path) {
 }
 
 // src/staging/claude-subagents.ts
-import { mkdir as mkdir17, readFile as readFile21, writeFile as writeFile19 } from "fs/promises";
-import { basename as basename18, dirname as dirname22, join as join28 } from "path";
+import { mkdir as mkdir17, readFile as readFile22, writeFile as writeFile19 } from "fs/promises";
+import { basename as basename18, dirname as dirname22, join as join29 } from "path";
 async function renderClaudeSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "claude") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -6991,15 +7105,15 @@ async function renderClaudeSubagents(artifacts, stageRoot, adapter) {
 async function renderClaudeSubagent(artifact, stageRoot) {
   const sourcePath = artifact.stagedPath ?? artifact.sourcePath;
   const agentName = claudeAgentName(artifact);
-  const markdownPath = artifact.kind === "dir" ? join28(sourcePath, "AGENTS.md") : sourcePath;
+  const markdownPath = artifact.kind === "dir" ? join29(sourcePath, "AGENTS.md") : sourcePath;
   if (artifact.kind === "dir" && !await pathExists(markdownPath)) {
     throw new Error(`Claude subagent directory ${artifact.relativePath} must contain AGENTS.md.`);
   }
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !sourcePath.toLowerCase().endsWith(".md")) {
     throw new Error(`Claude subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const content = await readFile21(markdownPath, "utf8");
-  const renderedPath = join28(stageRoot, ".agentwheel-rendered", "claude-subagents", `${agentName}.md`);
+  const content = await readFile22(markdownPath, "utf8");
+  const renderedPath = join29(stageRoot, ".agentwheel-rendered", "claude-subagents", `${agentName}.md`);
   await mkdir17(dirname22(renderedPath), { recursive: true });
   await writeFile19(renderedPath, content.endsWith("\n") ? content : `${content}
 `, "utf8");
@@ -7008,7 +7122,7 @@ async function renderClaudeSubagent(artifact, stageRoot) {
     name: `${agentName}.md`,
     sourcePath: renderedPath,
     stagedPath: renderedPath,
-    relativePath: join28("subagents", `${agentName}.md`),
+    relativePath: join29("subagents", `${agentName}.md`),
     kind: "file",
     hash: await hashPath(renderedPath)
   };
@@ -7031,10 +7145,10 @@ async function stageResolvedSourceRaw(driver, resolved) {
   return stageResolvedArtifactsRaw(resolved, artifacts);
 }
 async function stageResolvedArtifactsRaw(resolved, artifacts) {
-  const root = await mkdtemp3(join29(tmpdir4(), "agentwheel-stage-"));
+  const root = await mkdtemp3(join30(tmpdir4(), "agentwheel-stage-"));
   const stagedArtifacts = [];
   for (const artifact of artifacts) {
-    const stagedPath = join29(root, artifact.relativePath);
+    const stagedPath = join30(root, artifact.relativePath);
     await mkdir18(dirname23(stagedPath), { recursive: true });
     await cp5(artifact.sourcePath, stagedPath, {
       recursive: artifact.kind === "dir",
@@ -7122,7 +7236,7 @@ async function composeAssets(artifact, packageRoot, stagedPath) {
   }
   for (const asset of artifact.assets) {
     const source = resolvePackagePath(packageRoot, asset.from);
-    const dest = join29(stagedPath, asset.into);
+    const dest = join30(stagedPath, asset.into);
     await copyAsset(asset, source, dest);
   }
 }
@@ -7131,7 +7245,7 @@ async function copyAsset(asset, source, dest) {
   if (sourceStats.isFile()) {
     if (matchesAny(basename19(source), asset.include)) {
       await mkdir18(dest, { recursive: true });
-      await copyAssetFile(source, join29(dest, basename19(source)), asset);
+      await copyAssetFile(source, join30(dest, basename19(source)), asset);
     }
     return;
   }
@@ -7147,7 +7261,7 @@ async function copyAsset(asset, source, dest) {
   for (const file of await listFiles(source)) {
     const rel = relative7(source, file).replaceAll("\\", "/");
     if (!matchesAny(rel, asset.include) && !matchesAny(basename19(file), asset.include)) continue;
-    await copyAssetFile(file, join29(dest, rel), asset);
+    await copyAssetFile(file, join30(dest, rel), asset);
   }
 }
 async function copyAssetFile(source, dest, asset) {
@@ -7167,7 +7281,7 @@ async function listFiles(root) {
   const out = [];
   async function walk2(dir) {
     for (const entry of (await readdir5(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
-      const full = join29(dir, entry.name);
+      const full = join30(dir, entry.name);
       if (entry.isDirectory()) {
         await walk2(full);
       } else if (entry.isFile()) {
@@ -7186,7 +7300,7 @@ async function normalizeCopiedModes(path) {
   }
   if (!stats.isDirectory()) return;
   for (const entry of await readdir5(path, { withFileTypes: true })) {
-    await normalizeCopiedModes(join29(path, entry.name));
+    await normalizeCopiedModes(join30(path, entry.name));
   }
 }
 function matchesAny(path, patterns) {
@@ -7199,9 +7313,9 @@ function matchesGlob(path, pattern) {
 }
 
 // src/model/workspace.ts
-import { readFile as readFile22 } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname24, join as join30, resolve as resolve13 } from "path";
+import { readFile as readFile23 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname24, join as join31, resolve as resolve13 } from "path";
 import { z as z6 } from "zod";
 
 // src/resolve/semver.ts
@@ -7472,12 +7586,12 @@ var workspaceConfigSchema = z6.discriminatedUnion("schemaVersion", [
   workspaceConfigV2Schema
 ]);
 function workspaceConfigPath(workspaceRoot) {
-  return join30(workspaceRoot, ".agentwheel", "config.json");
+  return join31(workspaceRoot, ".agentwheel", "config.json");
 }
 async function readWorkspaceConfig(workspaceRoot) {
   const path = workspaceConfigPath(workspaceRoot);
   if (!await pathExists(path)) return emptyWorkspaceConfig();
-  return workspaceConfigSchema.parse(JSON.parse(await readFile22(path, "utf8")));
+  return workspaceConfigSchema.parse(JSON.parse(await readFile23(path, "utf8")));
 }
 async function writeWorkspaceConfig(workspaceRoot, config) {
   await writeJsonAtomic(workspaceConfigPath(workspaceRoot), workspaceConfigSchema.parse(config));
@@ -7489,8 +7603,8 @@ function upsertPackage(config, entry) {
   packages.sort((a, b) => a.name.localeCompare(b.name));
   return workspaceConfigSchema.parse({ ...parsed, packages });
 }
-function globalWorkspaceConfigPath(globalRoot = homedir4()) {
-  return join30(globalRoot, ".agentwheel", "config.json");
+function globalWorkspaceConfigPath(globalRoot = homedir5()) {
+  return join31(globalRoot, ".agentwheel", "config.json");
 }
 async function findWorkspaceRoot(start = process.cwd()) {
   let current = resolve13(start);
@@ -7526,8 +7640,8 @@ function mergeWorkspaceConfig(global, project) {
   });
 }
 function resolveConfigPath(path, baseRoot) {
-  if (path.startsWith("~/")) return resolve13(homedir4(), path.slice(2));
-  if (path === "~") return homedir4();
+  if (path.startsWith("~/")) return resolve13(homedir5(), path.slice(2));
+  if (path === "~") return homedir5();
   return path.startsWith("/") ? resolve13(path) : resolve13(baseRoot, path);
 }
 function emptyWorkspaceConfig() {
@@ -7538,7 +7652,7 @@ function isCompositeWorkspaceProfile(profile) {
 }
 async function readConfigPath(path) {
   if (!await pathExists(path)) return emptyWorkspaceConfig();
-  return workspaceConfigSchema.parse(JSON.parse(await readFile22(path, "utf8")));
+  return workspaceConfigSchema.parse(JSON.parse(await readFile23(path, "utf8")));
 }
 function mergeWorkspaceTrust(global, project) {
   return {
@@ -7554,17 +7668,17 @@ function sortedUnique2(values) {
 
 // src/lifecycle/customization.ts
 import { appendFile, cp as cp6, mkdir as mkdir19, rm as rm9 } from "fs/promises";
-import { dirname as dirname26, join as join33 } from "path";
+import { dirname as dirname26, join as join34 } from "path";
 
 // src/resolve/graph.ts
 import { createHash as createHash8 } from "crypto";
-import { mkdtemp as mkdtemp4, readdir as readdir6, readFile as readFile25, stat as stat10 } from "fs/promises";
+import { mkdtemp as mkdtemp4, readdir as readdir6, readFile as readFile26, stat as stat10 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import { basename as basename20, extname as extname4, join as join32 } from "path";
+import { basename as basename20, extname as extname4, join as join33 } from "path";
 
 // src/model/workspace-composition.ts
 import { createHash as createHash7 } from "crypto";
-import { readFile as readFile23 } from "fs/promises";
+import { readFile as readFile24 } from "fs/promises";
 import { z as z7 } from "zod";
 var selectionSourceConfigSchema = z7.object({
   schemaVersion: z7.literal(2),
@@ -7583,12 +7697,12 @@ async function resolveSelectionImport(sourceRoot, sourceDriver, selection) {
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile23(path, "utf8"));
+    raw = JSON.parse(await readFile24(path, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Selection import '${parsedSelection.export}' cannot parse ${path}: ${message}`);
   }
-  if (!isRecord8(raw) || raw.schemaVersion !== 2) {
+  if (!isRecord9(raw) || raw.schemaVersion !== 2) {
     throw new Error(`Selection import '${parsedSelection.export}' requires schemaVersion 2 in ${path}.`);
   }
   let sourceConfig;
@@ -7676,18 +7790,18 @@ function stableValue2(value) {
   }
   return out;
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
 // src/resolve/identity.ts
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { resolve as resolve15 } from "path";
 
 // src/registry/client.ts
-import { readFile as readFile24, rm as rm8, stat as stat9 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname25, join as join31, resolve as resolve14 } from "path";
+import { readFile as readFile25, rm as rm8, stat as stat9 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname25, join as join32, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 
 // src/model/registry.ts
@@ -7784,7 +7898,7 @@ var RegistryClient = class {
   }
   async readCache() {
     if (!await pathExists(this.cachePath)) return void 0;
-    return registryCacheSchema.parse(JSON.parse(await readFile24(this.cachePath, "utf8")));
+    return registryCacheSchema.parse(JSON.parse(await readFile25(this.cachePath, "utf8")));
   }
   isExpired(cache, ttlMs) {
     return this.now().getTime() - new Date(cache.fetchedAt).getTime() > ttlMs;
@@ -7803,10 +7917,10 @@ var RegistryClient = class {
     if (await pathExists(filePath)) {
       const fullPath = resolve14(filePath);
       const stats = await stat9(fullPath);
-      return readFile24(stats.isDirectory() ? join31(fullPath, "index.json") : fullPath, "utf8");
+      return readFile25(stats.isDirectory() ? join32(fullPath, "index.json") : fullPath, "utf8");
     }
-    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join31(dirname25(this.cachePath), "registry-repos") }));
-    return readFile24(join31(resolved.resolvedPath, "index.json"), "utf8");
+    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join32(dirname25(this.cachePath), "registry-repos") }));
+    return readFile25(join32(resolved.resolvedPath, "index.json"), "utf8");
   }
   warnCompatibility(entries) {
     for (const entry of entries) {
@@ -7844,7 +7958,7 @@ function mergeIndexes(indexes) {
   return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 function defaultRegistryCachePath() {
-  return join31(homedir5(), ".agentwheel", "registry-cache.json");
+  return join32(homedir6(), ".agentwheel", "registry-cache.json");
 }
 function sameSources(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
@@ -7929,8 +8043,8 @@ function localSourcePath(source) {
   return source.startsWith("local:") ? source.slice("local:".length) : source;
 }
 function resolveLocalPath(path, declaringPackageRoot) {
-  if (path === "~") return homedir6();
-  if (path.startsWith("~/")) return resolve15(homedir6(), path.slice(2));
+  if (path === "~") return homedir7();
+  if (path.startsWith("~/")) return resolve15(homedir7(), path.slice(2));
   if (path.startsWith("/")) return resolve15(path);
   return resolve15(declaringPackageRoot, path);
 }
@@ -8008,7 +8122,7 @@ function normalizeLiteralProviderSpec(source, prefix) {
 var cacheLocks = /* @__PURE__ */ new Map();
 async function resolveDependencyGraph(roots, options) {
   if (roots.length === 0) throw new Error("At least one graph root is required.");
-  const graphRoot = await mkdtemp4(join32(tmpdir5(), "agentwheel-graph-"));
+  const graphRoot = await mkdtemp4(join33(tmpdir5(), "agentwheel-graph-"));
   const fetchCache = /* @__PURE__ */ new Map();
   const nodesByKey = /* @__PURE__ */ new Map();
   const rootResults = [];
@@ -8528,7 +8642,7 @@ async function collectIncludeNeeds(artifact, artifactsByRelativePath) {
     const file = stack.shift();
     if (scanned.has(file)) continue;
     scanned.add(file);
-    const content = await readFile25(file, "utf8");
+    const content = await readFile26(file, "utf8");
     for (const include of extractOpenPackIncludeSelectors(content)) {
       await collectIncludeSelector(include.raw, include.optional, artifactsByRelativePath, scanned, stack, needs);
     }
@@ -8571,7 +8685,7 @@ async function listMarkdownFiles2(root) {
   const out = [];
   async function walk2(dir) {
     for (const entry of (await readdir6(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
-      const full = join32(dir, entry.name);
+      const full = join33(dir, entry.name);
       if (entry.isDirectory()) {
         await walk2(full);
       } else if (entry.isFile() && extname4(entry.name).toLowerCase() === ".md") {
@@ -8606,7 +8720,7 @@ async function fetchPackage(normalized, mode, options, fetchCache, refOverride)
   const promise = (async () => {
     const driver = getSourceDriver(normalized.driver);
     const resolved = await driver.resolve(normalized.source, {
-      cacheRoot: options.cacheRoot ?? join32(options.workspaceRoot, ".agentwheel", "cache"),
+      cacheRoot: options.cacheRoot ?? join33(options.workspaceRoot, ".agentwheel", "cache"),
       mode,
       ref: refOverride ?? normalized.requestedRef,
       frozenLock: hardLockedCheckout
@@ -8813,7 +8927,7 @@ async function mapLimit(items, limit, fn) {
 
 // src/lifecycle/customization.ts
 async function remember(workspaceRoot, runtime, text) {
-  const overlayPath = join33(workspaceRoot, ".agentwheel", "overlays", runtime, "instructions.local.md");
+  const overlayPath = join34(workspaceRoot, ".agentwheel", "overlays", runtime, "instructions.local.md");
   await mkdir19(dirname26(overlayPath), { recursive: true });
   await appendFile(overlayPath, `${text.trim()}
 `, "utf8");
@@ -8837,7 +8951,7 @@ async function ejectArtifact(workspaceRoot, item) {
       throw new Error(`Artifact not found: ${item}`);
     }
     const ejectedIdentity = parsed.packageIdentity === parsed.packageName ? parsed.packageIdentity : candidate.nodeId === parsed.packageIdentity ? candidate.nodeId : `${candidate.packageName}@${candidate.packageVersion}`;
-    const ejectedPath = join33(workspaceRoot, ".agentwheel", "ejected", ...ejectedIdentity.split("/"), parsed.type, parsed.name);
+    const ejectedPath = join34(workspaceRoot, ".agentwheel", "ejected", ...ejectedIdentity.split("/"), parsed.type, parsed.name);
     await mkdir19(dirname26(ejectedPath), { recursive: true });
     await rm9(ejectedPath, { recursive: true, force: true });
     await cp6(artifact.stagedPath ?? artifact.sourcePath, ejectedPath, { recursive: artifact.kind === "dir", dereference: true });
@@ -8880,7 +8994,7 @@ async function stageEjectCandidate(workspaceRoot, pkg) {
   const adapter = pkg.adapterConfig ? await loadAdapterConfig(pkg.adapterConfig) : getAdapter(pkg.adapter);
   const bundle = await stageSource(driver, normalized.source, {
     adapter,
-    cacheRoot: join33(workspaceRoot, ".agentwheel", "cache"),
+    cacheRoot: join34(workspaceRoot, ".agentwheel", "cache"),
     mode: pkg.mode,
     ref: normalized.requestedRef ?? pkg.requestedRef
   });
@@ -8932,7 +9046,7 @@ import { rm as rm10 } from "fs/promises";
 // src/lifecycle/source-plan.ts
 import { createHash as createHash10 } from "crypto";
 import { mkdir as mkdir21 } from "fs/promises";
-import { dirname as dirname28, join as join36 } from "path";
+import { dirname as dirname28, join as join37 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
@@ -9094,11 +9208,11 @@ function formatSelectionImport(root) {
 
 // src/resolve/render.ts
 import { createHash as createHash9 } from "crypto";
-import { readFile as readFile26, mkdtemp as mkdtemp5 } from "fs/promises";
+import { readFile as readFile27, mkdtemp as mkdtemp5 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 async function renderGraphForTarget(graph, targetContext = {}) {
-  const root = await mkdtemp5(join34(tmpdir6(), "agentwheel-render-"));
+  const root = await mkdtemp5(join35(tmpdir6(), "agentwheel-render-"));
   const artifacts = [];
   const stagedNodes = /* @__PURE__ */ new Map();
   const includeEdges = /* @__PURE__ */ new Map();
@@ -9220,7 +9334,7 @@ async function artifactContentMap(artifacts) {
   const out = /* @__PURE__ */ new Map();
   for (const artifact of artifacts) {
     if (artifact.kind !== "file") continue;
-    out.set(artifact.relativePath.replaceAll("\\", "/"), await readFile26(artifact.stagedPath ?? artifact.sourcePath, "utf8"));
+    out.set(artifact.relativePath.replaceAll("\\", "/"), await readFile27(artifact.stagedPath ?? artifact.sourcePath, "utf8"));
   }
   return out;
 }
@@ -9483,9 +9597,9 @@ function lockArtifactFor(artifact) {
 }
 
 // src/lifecycle/trust.ts
-import { mkdir as mkdir20, readFile as readFile27 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname27, join as join35 } from "path";
+import { mkdir as mkdir20, readFile as readFile28 } from "fs/promises";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname27, join as join36 } from "path";
 import { z as z9 } from "zod";
 var trustStoreSchema = z9.object({
   version: z9.literal(1),
@@ -9559,14 +9673,14 @@ function sortedUnique5(values) {
 }
 async function readTrustStore(path) {
   if (!await pathExists(path)) return { version: 1, acceptedSources: [] };
-  return trustStoreSchema.parse(JSON.parse(await readFile27(path, "utf8")));
+  return trustStoreSchema.parse(JSON.parse(await readFile28(path, "utf8")));
 }
 async function writeTrustStore(path, store) {
   await mkdir20(dirname27(path), { recursive: true });
   await writeJsonAtomic(path, trustStoreSchema.parse(store));
 }
 function defaultTrustStorePath() {
-  return process.env.AGENTWHEEL_TRUST_STORE ?? join35(homedir7(), ".agentwheel", "trust.json");
+  return process.env.AGENTWHEEL_TRUST_STORE ?? join36(homedir8(), ".agentwheel", "trust.json");
 }
 
 // src/lifecycle/ownership.ts
@@ -9738,7 +9852,7 @@ async function createGraphSourcePlan(options) {
   const registryClient = new RegistryClient({ workspaceRoot, offline: lockMode, offlineLabel: lockLabel, warn });
   const graph = await resolveDependencyGraph(options.roots, {
     workspaceRoot,
-    cacheRoot: join36(workspaceRoot, ".agentwheel", "cache"),
+    cacheRoot: join37(workspaceRoot, ".agentwheel", "cache"),
     registryClient,
     noDeps: options.noDeps,
     includeSuggestions: options.includeSuggestions,
@@ -9844,7 +9958,7 @@ async function readExistingGraphLock(path) {
   return readGraphLock(path);
 }
 function pathForGraphLock(workspaceRoot, targetKey2, adapter, targetFingerprint) {
-  return join36(workspaceRoot, ".agentwheel", "locks", sanitizePathSegment(targetKey2), sanitizePathSegment(adapter), `${targetFingerprint}.graph-lock.json`);
+  return join37(workspaceRoot, ".agentwheel", "locks", sanitizePathSegment(targetKey2), sanitizePathSegment(adapter), `${targetFingerprint}.graph-lock.json`);
 }
 function sanitizePathSegment(value) {
   return value.replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "default";
@@ -9976,7 +10090,7 @@ function targetLabel(target) {
 }
 
 // src/runtime/target.ts
-import { basename as basename21, dirname as dirname29, join as join37, resolve as resolve17 } from "path";
+import { basename as basename21, dirname as dirname29, join as join38, resolve as resolve17 } from "path";
 var runtimeMarkers = [
   { adapter: "openclaw", dirs: [".openclaw", ".clawdbot", ".moltbot"] },
   { adapter: "claude", dirs: [".claude"] },
@@ -10098,7 +10212,7 @@ async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
     for (const dir of marker.dirs) {
       if (basename21(root) === dir) {
         matches.push({ adapter: marker.adapter, targetRoot: dirname29(root) });
-      } else if (await pathExists(join37(root, dir))) {
+      } else if (await pathExists(join38(root, dir))) {
         matches.push({ adapter: marker.adapter, targetRoot: root });
       }
     }
@@ -10442,9 +10556,9 @@ function shellQuoteArg(value) {
 }
 
 // src/cli/update-check.ts
-import { mkdir as mkdir22, readFile as readFile28, writeFile as writeFile20 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname30, join as join38 } from "path";
+import { mkdir as mkdir22, readFile as readFile29, writeFile as writeFile20 } from "fs/promises";
+import { homedir as homedir9 } from "os";
+import { dirname as dirname30, join as join39 } from "path";
 var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_TIMEOUT_MS = 300;
 var REGISTRY_URL = "https://registry.npmjs.org/agentwheel";
@@ -10452,7 +10566,7 @@ async function maybeCheckForUpdate(options) {
   if (isDisabled(options)) return;
   const now = options.now?.() ?? /* @__PURE__ */ new Date();
   const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-  const cachePath = options.cachePath ?? join38(homedir8(), ".agentwheel", "update-check.json");
+  const cachePath = options.cachePath ?? join39(homedir9(), ".agentwheel", "update-check.json");
   try {
     const cached = await readCache(cachePath);
     if (cached && now.getTime() - Date.parse(cached.checkedAt) < ttlMs) {
@@ -10489,7 +10603,7 @@ async function fetchLatestVersion(fetchImpl, timeoutMs) {
 }
 async function readCache(path) {
   try {
-    const parsed = JSON.parse(await readFile28(path, "utf8"));
+    const parsed = JSON.parse(await readFile29(path, "utf8"));
     if (typeof parsed.checkedAt !== "string" || typeof parsed.latest !== "string") return void 0;
     return { checkedAt: parsed.checkedAt, latest: parsed.latest };
   } catch {
@@ -10661,13 +10775,13 @@ function isCrossPackageSelector(value) {
 }
 
 // src/model/package-migrate.ts
-import { readFile as readFile29, rename as rename4, writeFile as writeFile21 } from "fs/promises";
-import { join as join40, resolve as resolve19 } from "path";
+import { readFile as readFile30, rename as rename4, writeFile as writeFile21 } from "fs/promises";
+import { join as join41, resolve as resolve19 } from "path";
 import { applyEdits, modify, parse as parse5 } from "jsonc-parser";
 async function migratePackageManifest(root) {
   const packageRoot = resolve19(root);
   for (const name of openPackManifestNames) {
-    const path = join40(packageRoot, name);
+    const path = join41(packageRoot, name);
     if (await pathExists(path)) {
       return { changed: false, to: path, message: `Package already uses ${name}.` };
     }
@@ -10676,10 +10790,10 @@ async function migratePackageManifest(root) {
   if (!legacyName) {
     throw new Error(`No legacy package manifest found at ${packageRoot}`);
   }
-  const from = join40(packageRoot, legacyName);
+  const from = join41(packageRoot, legacyName);
   const toName = legacyName.endsWith(".jsonc") ? "openpack.jsonc" : "openpack.json";
-  const to = join40(packageRoot, toName);
-  const content = await readFile29(from, "utf8");
+  const to = join41(packageRoot, toName);
+  const content = await readFile30(from, "utf8");
   const updated = updateSchemaVersion(content);
   await rename4(from, to);
   await writeFile21(to, updated, "utf8");
@@ -10687,7 +10801,7 @@ async function migratePackageManifest(root) {
 }
 async function firstExistingLegacyManifest(root) {
   for (const name of legacyPackageManifestNames) {
-    if (await pathExists(join40(root, name))) return name;
+    if (await pathExists(join41(root, name))) return name;
   }
   return void 0;
 }
@@ -10705,14 +10819,14 @@ function updateSchemaVersion(content) {
 
 // src/cli/version.ts
 import { readFileSync } from "fs";
-import { dirname as dirname31, join as join41 } from "path";
+import { dirname as dirname31, join as join42 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var FALLBACK_VERSION = "0.0.0";
 function resolveCliVersion() {
   let dir = dirname31(fileURLToPath2(import.meta.url));
   while (true) {
     try {
-      const pkg = JSON.parse(readFileSync(join41(dir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync(join42(dir, "package.json"), "utf8"));
       if (pkg.name === "agentwheel" && typeof pkg.version === "string") {
         return pkg.version;
       }
@@ -10726,8 +10840,8 @@ function resolveCliVersion() {
 
 // src/version/policy.ts
 import { execFile as execFile5 } from "child_process";
-import { readFile as readFile30 } from "fs/promises";
-import { join as join42, resolve as resolve20 } from "path";
+import { readFile as readFile31 } from "fs/promises";
+import { join as join43, resolve as resolve20 } from "path";
 import { promisify as promisify5 } from "util";
 import { parse as parseJsonc } from "jsonc-parser";
 import { z as z10 } from "zod";
@@ -10836,7 +10950,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
   }
   const driver = getSourceDriver(driverName);
   const resolved = await driver.resolve(pkg.source, {
-    cacheRoot: join42(workspaceRoot, ".agentwheel", "cache"),
+    cacheRoot: join43(workspaceRoot, ".agentwheel", "cache"),
     mode: "tracking",
     ref: pkg.requestedRef
   });
@@ -10930,12 +11044,12 @@ function gitUrlFromSource(source) {
   throw new Error(`Version discovery does not support Git source: ${source}`);
 }
 function versionCachePath(workspaceRoot) {
-  return join42(workspaceRoot, ".agentwheel", "cache", "version-index.json");
+  return join43(workspaceRoot, ".agentwheel", "cache", "version-index.json");
 }
 async function readVersionCache(path) {
   if (!await pathExists(path)) return { schemaVersion: 1, sources: {} };
   try {
-    return versionCacheSchema.parse(JSON.parse(await readFile30(path, "utf8")));
+    return versionCacheSchema.parse(JSON.parse(await readFile31(path, "utf8")));
   } catch {
     return { schemaVersion: 1, sources: {} };
   }
@@ -10943,8 +11057,8 @@ async function readVersionCache(path) {
 
 // src/profile/members.ts
 import { execFile as execFile6 } from "child_process";
-import { readFile as readFile31 } from "fs/promises";
-import { join as join43, resolve as resolve21 } from "path";
+import { readFile as readFile32 } from "fs/promises";
+import { join as join44, resolve as resolve21 } from "path";
 import { promisify as promisify6 } from "util";
 import { z as z12 } from "zod";
 
@@ -11130,11 +11244,11 @@ async function invokeMemberStatus(member, parentWorkspace, chain, options, cliEn
     } else {
       const sshArgs = sshArguments(member);
       const remoteArgs = [
-        `cd ${shellQuote(member.workspace)}`,
+        `cd ${shellQuote2(member.workspace)}`,
         "&&",
-        `AGENTWHEEL_COMPOSITE_CHAIN=${shellQuote(JSON.stringify(chain))}`,
+        `AGENTWHEEL_COMPOSITE_CHAIN=${shellQuote2(JSON.stringify(chain))}`,
         "agentwheel",
-        ...args.map(shellQuote)
+        ...args.map(shellQuote2)
       ];
       const result = await execFileAsync6("ssh", [...sshArgs, remoteArgs.join(" ")], {
         env,
@@ -11173,12 +11287,12 @@ async function runMemberAgentwheel(member, parentWorkspace, args, chain) {
       return { stdout: result2.stdout, stderr: result2.stderr };
     }
     const remoteArgs = [
-      `cd ${shellQuote(member.workspace)}`,
+      `cd ${shellQuote2(member.workspace)}`,
       "&&",
-      `AGENTWHEEL_COMPOSITE_CHAIN=${shellQuote(JSON.stringify(chain))}`,
+      `AGENTWHEEL_COMPOSITE_CHAIN=${shellQuote2(JSON.stringify(chain))}`,
       "agentwheel",
       "--no-update-check",
-      ...args.map(shellQuote)
+      ...args.map(shellQuote2)
     ];
     const result = await execFileAsync6("ssh", [...sshArguments(member), remoteArgs.join(" ")], {
       env,
@@ -11202,7 +11316,7 @@ function sshArguments(member) {
     destination
   ];
 }
-function shellQuote(value) {
+function shellQuote2(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 function commandErrorDetail(error) {
@@ -11240,12 +11354,12 @@ function memberFailure(member, health, error) {
   };
 }
 function memberCachePath(workspaceRoot, profileName, memberId) {
-  return join43(workspaceRoot, ".agentwheel", "cache", "member-status", profileName, `${memberId}.json`);
+  return join44(workspaceRoot, ".agentwheel", "cache", "member-status", profileName, `${memberId}.json`);
 }
 async function readMemberCache(path) {
   if (!await pathExists(path)) return void 0;
   try {
-    return memberCacheSchema.parse(JSON.parse(await readFile31(path, "utf8")));
+    return memberCacheSchema.parse(JSON.parse(await readFile32(path, "utf8")));
   } catch {
     return void 0;
   }
@@ -11314,9 +11428,9 @@ function valueAfter(lines, prefix) {
 
 // src/catalogue/client.ts
 import { createHash as createHash11 } from "crypto";
-import { readFile as readFile32, rm as rm11 } from "fs/promises";
-import { homedir as homedir9 } from "os";
-import { join as join44 } from "path";
+import { readFile as readFile33, rm as rm11 } from "fs/promises";
+import { homedir as homedir10 } from "os";
+import { join as join45 } from "path";
 
 // src/model/catalogue.ts
 import { z as z13 } from "zod";
@@ -11511,7 +11625,7 @@ var CatalogueClient = class {
   async readCache() {
     if (!await pathExists(this.cachePath)) return void 0;
     try {
-      const value = JSON.parse(await readFile32(this.cachePath, "utf8"));
+      const value = JSON.parse(await readFile33(this.cachePath, "utf8"));
       const envelope = catalogueCacheEnvelopeSchema.parse(value);
       if (envelope.contentHash) {
         const contentHash = catalogueContentHash(envelope.enriched, envelope.vercel);
@@ -11567,7 +11681,7 @@ var CatalogueClient = class {
   }
 };
 function defaultCatalogueCachePath() {
-  return join44(homedir9(), ".agentwheel", "catalogue-cache.json");
+  return join45(homedir10(), ".agentwheel", "catalogue-cache.json");
 }
 function sameSources2(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
@@ -11652,7 +11766,7 @@ function normalizeRegistryEntry(entry) {
     tags: sortedUniqueStrings(entry.tags),
     provides: [],
     source: entry.source,
-    installCommand: `npx agentwheel install ${shellQuote2(entry.name)}`,
+    installCommand: `npx agentwheel install ${shellQuote3(entry.name)}`,
     installability: "registry",
     provenances: ["registry"],
     archived: false,
@@ -11700,7 +11814,7 @@ function normalizeVercelEntry(entry) {
     provides: ["skills"],
     source,
     repoUrl: `https://github.com/${entry.o}/${entry.r}`,
-    installCommand: `npx agentwheel install ${shellQuote2(source)}`,
+    installCommand: `npx agentwheel install ${shellQuote3(source)}`,
     installability: "source",
     provenances: ["vercel"],
     archived: false,
@@ -11897,11 +12011,11 @@ function enrichedInstallCommand(entry, source) {
   const catalogueCommand = nonEmpty(entry.installCommand);
   if (!source) return catalogueCommand;
   if (entry.ecosystem === "mcp-registry" || entry.ecosystem === "clawhub") {
-    return catalogueCommand ?? `npx agentwheel install ${shellQuote2(source)}`;
+    return catalogueCommand ?? `npx agentwheel install ${shellQuote3(source)}`;
   }
-  return `npx agentwheel install ${shellQuote2(source)}`;
+  return `npx agentwheel install ${shellQuote3(source)}`;
 }
-function shellQuote2(value) {
+function shellQuote3(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 function matchesPhrase(fields, query) {
@@ -11977,7 +12091,7 @@ program.command("list").description("list artifacts exposed by a package source"
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const selectedArtifacts = selectedArtifactsFromOptionsOrRegistry(options, resolvedInput.registryEntry);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
-  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join45(targetRoot, ".agentwheel", "cache") }))));
+  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join46(targetRoot, ".agentwheel", "cache") }))));
   const artifacts = filterArtifactsBySelection(await driver.list(resolved), selectedArtifacts);
   for (const artifact of artifacts) {
     console.log(`${artifact.type}	${artifact.name}	${artifact.relativePath}`);
@@ -12029,7 +12143,7 @@ program.command("scan").description("scan a package source for validation findin
   const targetRoot = normalizeTargetRoot(options.targetRoot);
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
-  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join45(targetRoot, ".agentwheel", "cache") }))));
+  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join46(targetRoot, ".agentwheel", "cache") }))));
   const result = await driver.scan(resolved);
   if (result.findings.length === 0) {
     console.log("Scan ok: no findings");
@@ -12297,7 +12411,7 @@ journalCommand.command("list").description("show pending apply journals for reso
     if (!journal) continue;
     pending += 1;
     console.log(`PENDING ${state.adapter.name}/${state.installationType} at ${state.installRoot}`);
-    console.log(`  journal: ${join45(state.installRoot, ".agentwheel", `${state.state.stateKey}.apply-journal.json`)}`);
+    console.log(`  journal: ${join46(state.installRoot, ".agentwheel", `${state.state.stateKey}.apply-journal.json`)}`);
     console.log(`  stateKey: ${state.state.stateKey}`);
     console.log(`  createdAt: ${journal.createdAt}`);
     console.log(`  updatedAt: ${journal.updatedAt}`);
@@ -12600,7 +12714,7 @@ async function packageEntryFromSource(source, targetRoot, options) {
   const bundle = await stageSource(driver, resolvedSource, {
     workspaceRoot: targetRoot,
     adapter,
-    cacheRoot: join45(targetRoot, ".agentwheel", "cache"),
+    cacheRoot: join46(targetRoot, ".agentwheel", "cache"),
     mode: options.mode,
     ref: initialVersion?.ref,
     frozenLock: lockMode,
@@ -13234,7 +13348,7 @@ function keepManifestEntryOperation(entry, targetRoot, scopeDescription, operati
     artifactType: entry.artifactType,
     artifactName: entry.artifactName,
     kind: entry.kind,
-    destPath: operation?.destPath ?? join45(targetRoot, entry.path),
+    destPath: operation?.destPath ?? join46(targetRoot, entry.path),
     relativeDestPath: entry.path,
     desiredHash: entry.sourceHash,
     currentHash: operation?.currentHash ?? entry.hash,
@@ -13819,12 +13933,12 @@ async function printDoctor(target, options) {
   const requestedSkills = doctorSkillRequests(target, options);
   const skills = [];
   for (const request of requestedSkills) {
-    const skillPath = join45(state.installRoot, targetMapping.dest, request.name);
+    const skillPath = join46(state.installRoot, targetMapping.dest, request.name);
     const exists = await pathExists(skillPath);
     const manifestEntry = manifest?.entries.find((entry) => {
       if (entry.artifactType !== "skills") return false;
       const legacyInstallName = "installName" in entry && typeof entry.installName === "string" ? entry.installName : void 0;
-      return entry.artifactName === request.name || legacyInstallName === request.name || entry.path === join45(targetMapping.dest, request.name);
+      return entry.artifactName === request.name || legacyInstallName === request.name || entry.path === join46(targetMapping.dest, request.name);
     });
     const status = manifestEntry ? "managed" : exists ? "present-unmanaged" : "missing";
     skills.push({
@@ -13904,7 +14018,7 @@ function doctorSkillLabel(name) {
   return `${name} skill`;
 }
 function isSyncwheelWorkspace(targetRoot) {
-  return existsSync(join45(targetRoot, ".syncwheel", "manifest.json"));
+  return existsSync(join46(targetRoot, ".syncwheel", "manifest.json"));
 }
 function skillInstallCommand(adapter, installationType, options, skill, behavior = {}) {
   const args = [
@@ -13972,7 +14086,7 @@ function normalizeRuntimeScopeOptions(options, behavior = {}) {
   }
   const canDefaultTargetRoot = !options.agent && !options.all && !options.allDetected && !options.profile;
   if (!targetRoot && canDefaultTargetRoot && (options.user || installationType === "user" || behavior.defaultUser)) {
-    targetRoot = homedir10();
+    targetRoot = homedir11();
   }
   if (!installationType && behavior.defaultUser) {
     installationType = "user";
@@ -13992,12 +14106,12 @@ function looksLikeSourceSpecifier(value) {
   return value.includes(":") || value.startsWith("/") || value.startsWith("./") || value.startsWith("../") || value === "~" || value.startsWith("~/");
 }
 function normalizeCliPath(value) {
-  if (value === "~") return homedir10();
-  if (value.startsWith("~/")) return resolve22(homedir10(), value.slice(2));
+  if (value === "~") return homedir11();
+  if (value.startsWith("~/")) return resolve22(homedir11(), value.slice(2));
   return resolve22(value);
 }
 function isHomePath(path) {
-  return resolve22(path) === resolve22(homedir10());
+  return resolve22(path) === resolve22(homedir11());
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
@@ -14052,10 +14166,10 @@ function filterUninstallPlanBySelection(plan, selected) {
   };
 }
 async function initPackage(root) {
-  await mkdir23(join45(root, "instructions"), { recursive: true });
-  await mkdir23(join45(root, "rules"), { recursive: true });
-  await mkdir23(join45(root, "skills"), { recursive: true });
-  const manifestPath = join45(root, "openpack.json");
+  await mkdir23(join46(root, "instructions"), { recursive: true });
+  await mkdir23(join46(root, "rules"), { recursive: true });
+  await mkdir23(join46(root, "skills"), { recursive: true });
+  const manifestPath = join46(root, "openpack.json");
   const manifest = {
     schemaVersion: 2,
     name: "example/agentwheel-package",
@@ -14068,7 +14182,7 @@ async function initPackage(root) {
   };
   await writeFile22(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  await writeFile22(join45(root, "instructions", "AGENTS.md"), "# Agent Instructions\n", "utf8");
+  await writeFile22(join46(root, "instructions", "AGENTS.md"), "# Agent Instructions\n", "utf8");
 }
 async function defaultBootstrapPackage(_root) {
   const packageRoot = await findAgentwheelPackageRoot(dirname32(fileURLToPath3(import.meta.url)));

package/openpack.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "NestDevLab/agentwheel",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "provides": [
     { "type": "skills", "path": "skills" }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",

package/skills/agentwheel/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.16.1"
+  version: "0.16.3"
 ---
 
 # agentwheel