agentwheel 0.20.17 → 0.20.19

package/README.md

@@ -132,6 +132,12 @@ Apply the same command with the reviewed values added as `--expected-hash <sha25
 journal, rechecks the old owner and the live artifact hash, then atomically updates only the install
 manifest. Run one target at a time; named SSH agents use the same contract through `--agent`.
 
+Use `--from-unknown-owner` instead of `--from-workspace-root` for an entry recorded as
+`workspace:unknown`. A plain file or directory whose runtime no longer matches the recorded hash is
+refused unless `--carry-drift` is passed: the dry-run prints the runtime hash, the apply also needs
+`--expected-runtime-hash <sha256>`, and the manifest keeps the recorded hash so the next install
+still reports the drift. Merge and managed-block entries never carry drift.
+
 For a one-time MCP rename, keep the legacy artifact in a dedicated cutover workspace rather than
 the canonical desired-state profile. Set the legacy manifest `stateKey` on its named agent, then
 preview one runtime at a time:
@@ -471,6 +477,35 @@ when every source entry is covered, apply removes the old manifest and source lo
 runtime files or the stable manifest. Preserve copies of those old state files before applying a
 retirement when they are needed as historical evidence.
 
+A nested, non-Fleet workspace (for example a profile checked out beneath a registered Fleet root)
+can inherit paths that older installs claimed under a fingerprint-only state key. Those claims name
+another plain workspace root, or this workspace's own root from before it was Fleet-qualified, so
+install refuses them as foreign. Adopt them into this workspace's stable state without
+`--force-foreign-state`, running from the workspace that owns the target:
+
+```bash
+agentwheel ownership adopt-legacy --agent <agent> \
+  --source-state-key <adapter>.<installation-type>.<legacy-fingerprint> \
+  --from-workspace-root <previous-owner-root> --json
+```
+
+The dry-run proves each moved entry: the previous owner root must hold a graph lock named by the
+legacy fingerprint, and for another workspace root exactly one such lock must match the entry's
+graph-lock digest, node, selector, and source hash. Only entries the current graph still installs at
+the same path with the same artifact identity move; the rest stay in the source manifest and are
+listed. The current graph groups packages as install does, by installation type and adapter
+configuration, and the command refuses when they resolve to more than one install state or when
+`--installation-type`, `--adapter-config`, or `--adapter-module` differs from what install resolves.
+Runtime bytes must match the recorded hash unless `--carry-drift` keeps that hash, so the next
+install reports drift instead of overwriting local changes. A path another owner still claims blocks the
+plan. A duplicate claim by the same previous owner is listed only when it sits under another legacy
+key of that root with the same proof and the same recorded artifact and hashes; run the command
+again with that key to retire it. Any other duplicate, including one in that root's current state,
+blocks the plan. Apply only the emitted command. It writes the stable manifest first and the legacy
+manifest second, and changes nothing else. A pending apply journal blocks the command. If an apply
+stops after the stable manifest was written, run the dry-run again: paths already in the stable
+state are then retired from the legacy key.
+
 ## Core Ideas
 
 **Three places, one direction:**

package/dist/{apply-ZGCJLZMZ.js → apply-QJHTL7IK.js}

@@ -5,9 +5,9 @@ import {
   commitManifestMetadataJournal,
   recoverPendingApply,
   uninstall
-} from "./chunk-A44XYLUT.js";
-import "./chunk-FP26KSBM.js";
-import "./chunk-GE7F76AC.js";
+} from "./chunk-L37KQVRS.js";
+import "./chunk-BHT57MK5.js";
+import "./chunk-BNIF3FUR.js";
 export {
   applyCombinedInstallPlan,
   applyInstallPlan,

package/dist/{chunk-FP26KSBM.js → chunk-BHT57MK5.js}

@@ -4,7 +4,7 @@ import {
   hashPath,
   pathExists,
   writeJsonAtomic
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/install/transaction.ts
 import { createHash as createHash6 } from "crypto";
@@ -2865,8 +2865,8 @@ async function recoverMutationRuntime(operationId, options = {}) {
     }
     mutation = GovernedMutation.activateExisting(receipt, baseline, lock);
     const [{ recoverPendingApply }, { readLinkedLocalApplyJournal: readLinkedLocalApplyJournal2, removeApplyJournal: removeApplyJournal2, localPathExists: localPathExists2 }] = await Promise.all([
-      import("./apply-ZGCJLZMZ.js"),
-      import("./transaction-4KBNHDQX.js")
+      import("./apply-QJHTL7IK.js"),
+      import("./transaction-JHZJWBII.js")
     ]);
     let missingReservation = false;
     for (const entry of pending) {

package/dist/{chunk-GE7F76AC.js → chunk-BNIF3FUR.js}

@@ -24,6 +24,14 @@ async function pathExists(path) {
     return false;
   }
 }
+async function removeOnFailure(path, run) {
+  try {
+    return await run();
+  } catch (error) {
+    await rm(path, { recursive: true, force: true });
+    throw error;
+  }
+}
 async function hashPath(path) {
   const stats = await stat(path);
   if (stats.isFile()) {
@@ -129,6 +137,7 @@ function isAlreadyExists(error) {
 
 export {
   pathExists,
+  removeOnFailure,
   hashPath,
   listFiles,
   isIgnoredGeneratedEntry,

package/dist/{chunk-A44XYLUT.js → chunk-L37KQVRS.js}

@@ -24,11 +24,11 @@ import {
   rollbackCompletedOperations,
   sourceLockPath,
   writeApplyJournal
-} from "./chunk-FP26KSBM.js";
+} from "./chunk-BHT57MK5.js";
 import {
   pathExists,
   writeJsonAtomic
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/install/apply.ts
 import { execFile } from "child_process";

package/dist/{chunk-U2GRG4UI.js → chunk-QABA4WUP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   pathExists
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/source/identify.ts
 import { homedir } from "os";

package/dist/{identify-O54QXPQR.js → identify-M6IA4RS7.js}

@@ -2,8 +2,8 @@
 import {
   inferSourceDriverName,
   isExplicitSource
-} from "./chunk-U2GRG4UI.js";
-import "./chunk-GE7F76AC.js";
+} from "./chunk-QABA4WUP.js";
+import "./chunk-BNIF3FUR.js";
 export {
   inferSourceDriverName,
   isExplicitSource