agentwheel 0.16.5 → 0.17.0

package/README.md

@@ -106,11 +106,14 @@ Fragments are Agentwheel composition inputs, not runtime file-drop targets.
 | `agentwheel install` | Reconcile configured packages into the current target or selected fleet. Uses the graph lock as input by default. |
 | `agentwheel install <name-or-source>` | Ensure semantics: configured name/source scopes the install; a new source is added and installed. |
 | `agentwheel update [name]` | Re-resolve tracking packages, then apply. A configured name preserves artifacts owned by other roots; `--dependency <name-or-source>` moves one tracking dependency while unrelated graph nodes stay locked. |
+| `agentwheel skill update <name>` | Resolve the owning configured package and reconcile only its closure; pinned owners install current source, tracking owners re-resolve. |
 | `agentwheel uninstall <name-or-source>` | Remove a configured package from runtimes and config. |
 | `agentwheel uninstall <name> --keep-files` | Remove from config/manifest while leaving runtime files unmanaged. |
 | `agentwheel status` | Show configured packages, manifest/lock presence, and install state. Use `--profile <name>` for profile-managed fleets; `status --all` uses profile `all` when present. |
 | `agentwheel ownership handoff <type/name>` | Transfer one manifest entry to a different workspace root after exact owner, hash, and revision checks; runtime content is not rewritten. |
+| `agentwheel mcp retire <package>` | Preview removal of one exact legacy MCP contribution under an explicitly selected install-state key; add `--apply` only after review. |
 | `agentwheel doctor` | Check runtime setup and suggest explicit companion/selected skill install commands when they are missing. |
+| `agentwheel cache prune` | Preview old Git source snapshots; add `--apply` to remove them while retaining locked commits. |
 
 Mental model: **`install` = make what is declared true. `update` = move tracking declarations forward,
 then make them true.**
@@ -133,6 +136,22 @@ Apply the same command with the reviewed values added as `--expected-hash <sha25
 journal, rechecks the old owner and the live artifact hash, then atomically updates only the install
 manifest. Run one target at a time; named SSH agents use the same contract through `--agent`.
 
+For a one-time MCP rename, keep the legacy artifact in a dedicated cutover workspace rather than
+the canonical desired-state profile. Set the legacy manifest `stateKey` on its named agent, then
+preview one runtime at a time:
+
+```bash
+agentwheel mcp retire legacy-mcp --agent legacy-codex \
+  --from-workspace-root /old/cutover/workspace --dry-run
+agentwheel mcp retire legacy-mcp --agent legacy-claude --dry-run
+```
+
+The package must render exactly one MCP artifact. The command accepts only an exact JSON MCP server
+object or exact Codex TOML MCP sections, rejects unexpected manifest entries or owners, and
+revalidates the exact contribution under the apply lock. It removes only the selected legacy
+server; sibling servers and user configuration remain. The command previews by default. A later
+runtime approval must use the same command with `--apply` instead of `--dry-run`.
+
 For a surgical dependency update, start with a dry-run:
 
 ```bash

package/dist/{chunk-PKAPR55N.js → chunk-24IUHC3D.js}

@@ -84,6 +84,31 @@ async function writeJsonAtomic(path, data) {
 `, "utf8");
   await rename(temp, path);
 }
+async function withFilesystemLock(lockPath, timeoutMs, fn, description = "cache") {
+  await mkdir(dirname(lockPath), { recursive: true });
+  const started = Date.now();
+  while (true) {
+    try {
+      await mkdir(lockPath);
+      await writeFile(join(lockPath, "owner.json"), JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }), "utf8");
+      break;
+    } catch (error) {
+      if (!isAlreadyExists(error)) throw error;
+      if (Date.now() - started > timeoutMs) {
+        throw new Error(`Timed out waiting for ${description} lock at ${lockPath}`);
+      }
+      await new Promise((resolve2) => setTimeout(resolve2, 50));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    await rm(lockPath, { recursive: true, force: true });
+  }
+}
+function isAlreadyExists(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
 
 // src/source/identify.ts
 function inferSourceDriverName(source) {
@@ -114,6 +139,8 @@ export {
   isIgnoredGeneratedEntry,
   atomicCopy,
   writeJsonAtomic,
+  withFilesystemLock,
+  isAlreadyExists,
   inferSourceDriverName,
   isExplicitSource
 };

package/dist/{identify-VV7SXUIQ.js → identify-G3TXOHNS.js}

@@ -2,7 +2,7 @@
 import {
   inferSourceDriverName,
   isExplicitSource
-} from "./chunk-PKAPR55N.js";
+} from "./chunk-24IUHC3D.js";
 export {
   inferSourceDriverName,
   isExplicitSource