agentwheel 0.19.0 → 0.19.2

package/dist/index.js

@@ -1674,6 +1674,16 @@ import { dirname as dirname9 } from "path";
 import { parse as parse3, stringify as stringify2 } from "yaml";
 var MergeAdoptionMismatchError = class extends Error {
 };
+function assertExactMergeContribution(contribution, strategy, currentContent) {
+  if (strategy === "codex-toml-mcp") {
+    assertExactMcpMergeContribution(contribution, strategy, currentContent);
+    return;
+  }
+  const mismatch = firstMergeContributionMismatch(parseMergeDestination(currentContent, strategy), contribution);
+  if (mismatch) {
+    throw new MergeAdoptionMismatchError(`exact merge contribution differs or is missing at ${mismatch}`);
+  }
+}
 function assertExactMcpMergeContribution(removal, strategy, currentContent) {
   if (strategy === "codex-toml-mcp") {
     const mismatched = mismatchedCodexTomlMcpServers(removal, currentContent);
@@ -1780,6 +1790,25 @@ function firstMcpContributionMismatch(current, incoming) {
   }
   return void 0;
 }
+function firstMergeContributionMismatch(current, contribution, path = "$") {
+  if (isRecord4(contribution)) {
+    if (!isRecord4(current)) return path;
+    for (const [key, value] of Object.entries(contribution)) {
+      if (!(key in current)) return `${path}.${key}`;
+      const mismatch = firstMergeContributionMismatch(current[key], value, `${path}.${key}`);
+      if (mismatch) return mismatch;
+    }
+    return void 0;
+  }
+  if (Array.isArray(contribution)) {
+    if (!Array.isArray(current)) return path;
+    for (const value of contribution) {
+      if (!current.some((candidate) => sameMcpValue(candidate, value))) return path;
+    }
+    return void 0;
+  }
+  return current === contribution ? void 0 : path;
+}
 function combineMergeValues(existing, incoming) {
   if (isRecord4(existing) && isRecord4(incoming)) {
     const combined = { ...existing };
@@ -10489,8 +10518,8 @@ async function createExactMcpRetirementPlan(desiredArtifacts, adapter, targetRoo
   }
   const removalKeys = Object.keys(operation.mergeRemoval);
   const servers = operation.mergeRemoval.mcpServers;
-  if (removalKeys.length !== 1 || removalKeys[0] !== "mcpServers" || !servers || typeof servers !== "object" || Array.isArray(servers) || Object.keys(servers).length !== 1) {
-    throw new Error("Exact MCP retirement requires exactly one MCP server and no non-MCP configuration.");
+  if (removalKeys.length !== 1 || removalKeys[0] !== "mcpServers" || !servers || typeof servers !== "object" || Array.isArray(servers) || Object.keys(servers).length === 0) {
+    throw new Error("Exact MCP retirement requires one or more MCP servers and no non-MCP configuration.");
   }
   const entry = manifest?.entries[0];
   if (entry) {
@@ -11729,7 +11758,7 @@ async function validateOwnershipHandoff(request, transport) {
   }
   const entry = matches[0];
   const fromOwner = workspaceOwnerForRoot(request.fromWorkspaceRoot);
-  const toOwner = workspaceOwnerForRoot(request.toWorkspaceRoot);
+  const toOwner = workspaceOwnerForRoot(request.toWorkspaceRoot, request.toFleetId);
   if (fromOwner === toOwner) throw new Error("Ownership handoff requires different workspace roots.");
   if (entry.workspaceOwner !== fromOwner) {
     throw new Error(`Old owner precondition failed for ${entry.path}: expected ${fromOwner}, found ${entry.workspaceOwner}`);
@@ -11739,10 +11768,7 @@ async function validateOwnershipHandoff(request, transport) {
   }
   const destPath = containedArtifactPath(request.targetRoot, entry.path);
   if (!await transport.pathExists(destPath)) throw new Error(`Managed artifact is missing: ${entry.path}`);
-  const currentHash = await transport.hashPath(destPath);
-  if (currentHash !== entry.hash) {
-    throw new Error(`Managed artifact is drifted at ${entry.path}: manifest ${entry.hash}, current ${currentHash}`);
-  }
+  const currentHash = await verifiedEntryHash(entry, destPath, transport);
   if (request.expectedHash && currentHash !== request.expectedHash) {
     throw new Error(`Current hash precondition failed for ${entry.path}: expected ${request.expectedHash}, found ${currentHash}`);
   }
@@ -11759,6 +11785,29 @@ async function validateOwnershipHandoff(request, transport) {
     toOwner
   };
 }
+async function verifiedEntryHash(entry, destPath, transport) {
+  if (entry.semanticPlugin) throw new Error(`Ownership handoff cannot verify semantic plugin state at ${destPath}`);
+  if (entry.mode === "managed-block") {
+    const selector = managedInstructionSelector(entry.logicalSelector, entry.artifactType, entry.artifactName);
+    const state = await readManagedInstructionBlockState(destPath, selector, transport);
+    if (!state.hasBlock || state.drifted || state.hash !== entry.hash) {
+      throw new Error(`Managed artifact is drifted at ${destPath}: managed block is missing or changed`);
+    }
+    return entry.hash;
+  }
+  if (entry.mergeStrategy) {
+    if (!hasMergeRemovalContent(entry.mergeRemoval)) {
+      throw new Error(`Ownership handoff cannot verify incomplete merge ownership at ${destPath}`);
+    }
+    assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, await transport.readFile(destPath));
+    return entry.hash;
+  }
+  const currentHash = await transport.hashPath(destPath);
+  if (currentHash !== entry.hash) {
+    throw new Error(`Managed artifact is drifted at ${destPath}: manifest ${entry.hash}, current ${currentHash}`);
+  }
+  return currentHash;
+}
 function containedArtifactPath(targetRoot, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\0")) {
     throw new Error(`Unsafe managed artifact path: ${relativePath}`);
@@ -13767,7 +13816,7 @@ async function inspectInstalledState(source, destination, packageNames) {
         throw new Error(`Partial ownership at ${sourceEntry.renderedPath} includes packages outside the normalization selection.`);
       }
       const destinationRenderedPath = renderedEntryPathForRoot(destinationState.installRoot, sourceEntry.entry.path);
-      await assertEquivalentRuntimeBytes(sourceEntry.renderedPath, destinationRenderedPath, sourceEntry.entry.hash);
+      await assertEquivalentRuntimeState(sourceEntry.entry, sourceEntry.renderedPath, destinationRenderedPath);
       plannedDestinationPaths.add(destinationRenderedPath);
       sourceRenderedPaths.push(sourceEntry.renderedPath);
       destinationRenderedPaths.push(destinationRenderedPath);
@@ -13931,7 +13980,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
       if (!coveredByCurrentGraph && !matchesCurrentGraph && !orphanedOwners.has(entry.entry.workspaceOwner)) {
         throw new Error(`Legacy manifest entry is not covered by its graph lock: ${entry.renderedPath}`);
       }
-      await assertEquivalentRuntimeBytes(entry.renderedPath, entry.renderedPath, entry.entry.hash);
+      await assertEquivalentRuntimeState(entry.entry, entry.renderedPath, entry.renderedPath);
       renderedPaths.add(entry.renderedPath);
       sourceRenderedPaths.push(entry.renderedPath);
       if (coveredByCurrentGraph || matchesCurrentGraph) {
@@ -14341,6 +14390,33 @@ async function assertEquivalentRuntimeBytes(sourcePath, destinationPath, expecte
     throw new Error(`Runtime content drift at ${destinationPath}; source and destination bytes are not equivalent.`);
   }
 }
+async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath) {
+  if (entry.mode === "managed-block") {
+    const selector = managedInstructionSelector(entry.logicalSelector, entry.artifactType, entry.artifactName);
+    for (const path of /* @__PURE__ */ new Set([sourcePath, destinationPath])) {
+      const state = await readManagedInstructionBlockState(path, selector, localTransport);
+      if (!state.exists || !state.hasBlock || state.drifted || state.hash !== entry.hash) {
+        throw new Error(`Runtime managed-block drift at ${path}; the installed contribution is missing or changed.`);
+      }
+    }
+    return;
+  }
+  if (entry.mergeStrategy) {
+    for (const path of /* @__PURE__ */ new Set([sourcePath, destinationPath])) {
+      if (!await pathExists(path)) throw new Error(`Runtime merge destination is missing: ${path}`);
+      const content = await readFile37(path, "utf8");
+      if (hasMergeRemovalContent(entry.mergeRemoval)) {
+        assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, content);
+      } else if (resolve25(sourcePath) === resolve25(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
+        assertExactMergeContribution({}, entry.mergeStrategy, content);
+      } else {
+        throw new Error(`Installed-state normalization cannot prove incomplete merge ownership at ${path}.`);
+      }
+    }
+    return;
+  }
+  await assertEquivalentRuntimeBytes(sourcePath, destinationPath, entry.hash);
+}
 function renderedEntryPathForRoot(root, entryPath) {
   const normalizedRoot = resolve25(root);
   const candidate = resolve25(normalizedRoot, entryPath);
@@ -14448,8 +14524,8 @@ function workspaceOwners(scope) {
   ]);
 }
 function assertSimpleVerifiableEntry(entry, path) {
-  if (entry.semanticPlugin || entry.mergeStrategy || entry.mode) {
-    throw new Error(`Installed-state normalization cannot byte-verify semantic, merge, or managed-block entry ${path}.`);
+  if (entry.semanticPlugin) {
+    throw new Error(`Installed-state normalization cannot byte-verify semantic plugin entry ${path}.`);
   }
   if (entry.kind !== "file" && entry.kind !== "dir") throw new Error(`Unsupported installed entry kind at ${path}.`);
 }
@@ -14481,7 +14557,7 @@ function graphArtifactIdentity(artifact) {
     dependencyRole: artifact.dependencyRole,
     owners: artifact.owners,
     kind: artifact.kind,
-    sourceHash: artifact.hash,
+    ...artifact.composedFrom?.length ? { composedFrom: artifact.composedFrom } : { sourceHash: artifact.hash },
     channel: artifact.channel
   });
 }
@@ -14495,7 +14571,7 @@ function graphEntryIdentity(entry) {
     dependencyRole: entry.dependencyRole,
     owners: entry.owners,
     kind: entry.kind,
-    sourceHash: entry.sourceHash,
+    ...entry.composedFrom?.length ? { composedFrom: entry.composedFrom } : { sourceHash: entry.sourceHash },
     channel: entry.channel
   });
 }
@@ -15134,7 +15210,7 @@ program.command("remember").description("append text to the local instructions o
   console.log(nextInstallNudge());
 });
 var ownershipCommand = program.command("ownership").description("inspect and transfer manifest ownership without rewriting runtime artifacts");
-ownershipCommand.command("handoff").description("transfer one managed artifact between Agentwheel workspace roots").argument("<selector>", "exact artifact selector in type/name form").requiredOption("--from-workspace-root <path>", "current owning workspace root").requiredOption("--to-workspace-root <path>", "new owning workspace root").option("--expected-hash <sha256>", "expected current artifact hash; required when applying").option("--expected-revision <sha256>", "expected install manifest revision; required when applying").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--profile <name>", "workspace runtime profile (must resolve to one target)").option("--dry-run", "validate all preconditions without writing the manifest", false).action(async (selector, options) => {
+ownershipCommand.command("handoff").description("transfer one managed artifact between Agentwheel workspace roots").argument("<selector>", "exact artifact selector in type/name form").requiredOption("--from-workspace-root <path>", "current owning workspace root").requiredOption("--to-workspace-root <path>", "new owning workspace root").option("--to-fleet <id>", "qualify the new owner with a registered fleet id").option("--expected-hash <sha256>", "expected current artifact hash; required when applying").option("--expected-revision <sha256>", "expected install manifest revision; required when applying").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--profile <name>", "workspace runtime profile (must resolve to one target)").option("--dry-run", "validate all preconditions without writing the manifest", false).action(async (selector, options) => {
   if (!options.dryRun && (!options.expectedHash || !options.expectedRevision)) {
     throw new Error("Applying an ownership handoff requires --expected-hash and --expected-revision from a reviewed --dry-run.");
   }
@@ -15152,6 +15228,13 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   const adapter = await resolveAdapterForTarget(target, adapterOptions);
   const installationType = normalizedOptions.installationType ?? target.installationType ?? resolveInstallationTypeForAdapter(adapter);
   const state = installStateForTarget(target, adapter, adapterOptions, installationType);
+  const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
+  if (options.toFleet) {
+    const fleet = await showRegisteredFleet(options.toFleet);
+    if (resolve26(fleet.root) !== resolve26(toWorkspaceRoot)) {
+      throw new Error(`Destination fleet '${options.toFleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
+    }
+  }
   const request = {
     ...state,
     targetRoot: state.installRoot,
@@ -15159,7 +15242,8 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
     artifactType,
     artifactName,
     fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
-    toWorkspaceRoot: normalizeCliPath(options.toWorkspaceRoot),
+    toWorkspaceRoot,
+    toFleetId: options.toFleet,
     expectedHash: options.expectedHash,
     expectedRevision: options.expectedRevision,
     transport: transportForTarget(target)
@@ -15805,6 +15889,7 @@ async function runExactMcpRetirement(packageName, options) {
     onlySource: true,
     retireExactMcp: true,
     expectedFromWorkspaceOwner,
+    deferForeignStateCheck: true,
     dryRun: true
   }, { mode: "install" });
   if (results.length !== 1) {

package/openpack.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "NestDevLab/agentwheel",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "provides": [
     { "type": "skills", "path": "skills" }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",

package/skills/agentwheel/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.19.0"
+  version: "0.19.2"
 ---
 
 # agentwheel

package/skills/agentwheel-discovery/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.19.0"
+  version: "0.19.2"
 ---
 
 # Agentwheel Discovery