agentwheel 0.20.18 → 0.20.19

package/README.md

@@ -132,6 +132,12 @@ Apply the same command with the reviewed values added as `--expected-hash <sha25
 journal, rechecks the old owner and the live artifact hash, then atomically updates only the install
 manifest. Run one target at a time; named SSH agents use the same contract through `--agent`.
 
+Use `--from-unknown-owner` instead of `--from-workspace-root` for an entry recorded as
+`workspace:unknown`. A plain file or directory whose runtime no longer matches the recorded hash is
+refused unless `--carry-drift` is passed: the dry-run prints the runtime hash, the apply also needs
+`--expected-runtime-hash <sha256>`, and the manifest keeps the recorded hash so the next install
+still reports the drift. Merge and managed-block entries never carry drift.
+
 For a one-time MCP rename, keep the legacy artifact in a dedicated cutover workspace rather than
 the canonical desired-state profile. Set the legacy manifest `stateKey` on its named agent, then
 preview one runtime at a time:

package/dist/{apply-ZGCJLZMZ.js → apply-QJHTL7IK.js}

@@ -5,9 +5,9 @@ import {
   commitManifestMetadataJournal,
   recoverPendingApply,
   uninstall
-} from "./chunk-A44XYLUT.js";
-import "./chunk-FP26KSBM.js";
-import "./chunk-GE7F76AC.js";
+} from "./chunk-L37KQVRS.js";
+import "./chunk-BHT57MK5.js";
+import "./chunk-BNIF3FUR.js";
 export {
   applyCombinedInstallPlan,
   applyInstallPlan,

package/dist/{chunk-FP26KSBM.js → chunk-BHT57MK5.js}

@@ -4,7 +4,7 @@ import {
   hashPath,
   pathExists,
   writeJsonAtomic
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/install/transaction.ts
 import { createHash as createHash6 } from "crypto";
@@ -2865,8 +2865,8 @@ async function recoverMutationRuntime(operationId, options = {}) {
     }
     mutation = GovernedMutation.activateExisting(receipt, baseline, lock);
     const [{ recoverPendingApply }, { readLinkedLocalApplyJournal: readLinkedLocalApplyJournal2, removeApplyJournal: removeApplyJournal2, localPathExists: localPathExists2 }] = await Promise.all([
-      import("./apply-ZGCJLZMZ.js"),
-      import("./transaction-4KBNHDQX.js")
+      import("./apply-QJHTL7IK.js"),
+      import("./transaction-JHZJWBII.js")
     ]);
     let missingReservation = false;
     for (const entry of pending) {

package/dist/{chunk-GE7F76AC.js → chunk-BNIF3FUR.js}

@@ -24,6 +24,14 @@ async function pathExists(path) {
     return false;
   }
 }
+async function removeOnFailure(path, run) {
+  try {
+    return await run();
+  } catch (error) {
+    await rm(path, { recursive: true, force: true });
+    throw error;
+  }
+}
 async function hashPath(path) {
   const stats = await stat(path);
   if (stats.isFile()) {
@@ -129,6 +137,7 @@ function isAlreadyExists(error) {
 
 export {
   pathExists,
+  removeOnFailure,
   hashPath,
   listFiles,
   isIgnoredGeneratedEntry,

package/dist/{chunk-A44XYLUT.js → chunk-L37KQVRS.js}

@@ -24,11 +24,11 @@ import {
   rollbackCompletedOperations,
   sourceLockPath,
   writeApplyJournal
-} from "./chunk-FP26KSBM.js";
+} from "./chunk-BHT57MK5.js";
 import {
   pathExists,
   writeJsonAtomic
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/install/apply.ts
 import { execFile } from "child_process";

package/dist/{chunk-U2GRG4UI.js → chunk-QABA4WUP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   pathExists
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/source/identify.ts
 import { homedir } from "os";

package/dist/{identify-O54QXPQR.js → identify-M6IA4RS7.js}

@@ -2,8 +2,8 @@
 import {
   inferSourceDriverName,
   isExplicitSource
-} from "./chunk-U2GRG4UI.js";
-import "./chunk-GE7F76AC.js";
+} from "./chunk-QABA4WUP.js";
+import "./chunk-BNIF3FUR.js";
 export {
   inferSourceDriverName,
   isExplicitSource

package/dist/index.js

@@ -37,7 +37,7 @@ import {
   uninstall,
   withManifestRevision,
   writeInstallManifest
-} from "./chunk-A44XYLUT.js";
+} from "./chunk-L37KQVRS.js";
 import {
   CURRENT_WORKSPACE_SCHEMA_VERSION,
   GovernedMutation,
@@ -98,25 +98,26 @@ import {
   workspaceSelectionImportSchema,
   writeApplyJournal,
   writeWorkspaceConfig
-} from "./chunk-FP26KSBM.js";
+} from "./chunk-BHT57MK5.js";
 import {
   inferSourceDriverName
-} from "./chunk-U2GRG4UI.js";
+} from "./chunk-QABA4WUP.js";
 import {
   hashPath,
   isAlreadyExists,
   isIgnoredGeneratedEntry,
   listFiles,
   pathExists,
+  removeOnFailure,
   withFilesystemLock,
   writeJsonAtomic
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/cli/index.ts
 import { createHash as createHash16 } from "crypto";
 import { existsSync } from "fs";
-import { mkdir as mkdir16, mkdtemp as mkdtemp4, realpath as realpath3, rm as rm10, writeFile as writeFile13 } from "fs/promises";
-import { homedir as homedir12, tmpdir as tmpdir5 } from "os";
+import { mkdir as mkdir16, mkdtemp as mkdtemp3, realpath as realpath3, rm as rm10, writeFile as writeFile13 } from "fs/promises";
+import { homedir as homedir12, tmpdir as tmpdir4 } from "os";
 import { basename as basename21, dirname as dirname23, isAbsolute as isAbsolute5, join as join46, relative as relative11, resolve as resolve27 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
@@ -4079,6 +4080,58 @@ function errorMessage3(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/source/git-source.ts
+import { posix } from "path";
+var SUBPATH_SEPARATOR = "//";
+function parseGitSource(source) {
+  if (source.startsWith("github:")) {
+    const rest = source.slice("github:".length);
+    const hashIndex = rest.indexOf("#");
+    const repo = hashIndex >= 0 ? rest.slice(0, hashIndex) : rest;
+    if (!repo.includes("/")) throw new Error(`Invalid GitHub source: ${source}`);
+    return {
+      url: `https://github.com/${repo.replace(/\.git$/i, "")}.git`,
+      ...splitFragment(hashIndex >= 0 ? rest.slice(hashIndex + 1) : void 0, source)
+    };
+  }
+  if (source.startsWith("git:")) {
+    const rest = source.slice("git:".length);
+    const hashIndex = rest.lastIndexOf("#");
+    if (hashIndex < 0) return { url: rest };
+    return { url: rest.slice(0, hashIndex), ...splitFragment(rest.slice(hashIndex + 1), source) };
+  }
+  throw new Error(`Invalid git source: ${source}`);
+}
+function formatGitSource(url, ref, subpath) {
+  return subpath ? `git:${url}#${ref}${SUBPATH_SEPARATOR}${subpath}` : `git:${url}#${ref}`;
+}
+function normalizeGitSubpath(subpath, source) {
+  if (subpath === void 0) return void 0;
+  if (subpath.includes("\\")) throw new Error(`Git source subpath must use forward slashes: ${source}`);
+  if (subpath.startsWith("/")) throw new Error(`Git source subpath must be relative to the repository: ${source}`);
+  const normalized = posix.normalize(subpath).replace(/\/+$/g, "");
+  if (normalized === "." || normalized === "") return void 0;
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new Error(`Git source subpath escapes the repository: ${source}`);
+  }
+  return normalized;
+}
+function resolveGitRelativeSubpath(declaringSubpath, relative12, source) {
+  const joined = posix.normalize(posix.join(declaringSubpath ?? ".", relative12));
+  if (joined === ".." || joined.startsWith("../")) {
+    throw new Error(`Relative dependency '${relative12}' escapes the git repository it is declared in: ${source}`);
+  }
+  return normalizeGitSubpath(joined, source);
+}
+function splitFragment(fragment, source) {
+  if (fragment === void 0) return {};
+  const separator = fragment.indexOf(SUBPATH_SEPARATOR);
+  if (separator < 0) return fragment ? { ref: fragment } : {};
+  const ref = fragment.slice(0, separator);
+  const subpath = normalizeGitSubpath(fragment.slice(separator + SUBPATH_SEPARATOR.length), source);
+  return { ...ref ? { ref } : {}, ...subpath ? { subpath } : {} };
+}
+
 // src/source/git.ts
 var execFileAsync = promisify(execFile);
 var GitSourceDriver = class {
@@ -4138,15 +4191,18 @@ var GitSourceDriver = class {
           return { path, leasePath };
         }
       );
-      const snapshotPath = snapshot.path;
-      const manifest = await readPackageManifest(snapshotPath);
+      const packageRoot = parsed.subpath ? join19(snapshot.path, parsed.subpath) : snapshot.path;
+      if (parsed.subpath && !await isDirectory(packageRoot)) {
+        throw new Error(`Git source subpath '${parsed.subpath}' does not exist at ${resolvedCommit} in ${parsed.url}`);
+      }
+      const manifest = await readPackageManifest(packageRoot);
       return {
         ...resolved,
-        resolvedPath: snapshotPath,
+        resolvedPath: packageRoot,
         packageName: manifest?.name,
         packageVersion: manifest?.version,
         resolvedCommit,
-        sourceHash: await hashPath(snapshotPath),
+        sourceHash: await hashPath(packageRoot),
         cacheLeasePath: snapshot.leasePath
       };
     }, "git cache");
@@ -4164,22 +4220,12 @@ var GitSourceDriver = class {
     return resolved;
   }
 };
-function parseGitSource(source) {
-  if (source.startsWith("github:")) {
-    const rest = source.slice("github:".length);
-    const [repo, ref] = rest.split("#", 2);
-    if (!repo.includes("/")) throw new Error(`Invalid GitHub source: ${source}`);
-    return { url: `https://github.com/${repo}.git`, ref };
-  }
-  if (source.startsWith("git:")) {
-    const rest = source.slice("git:".length);
-    const hashIndex = rest.lastIndexOf("#");
-    if (hashIndex >= 0) {
-      return { url: rest.slice(0, hashIndex), ref: rest.slice(hashIndex + 1) };
-    }
-    return { url: rest };
+async function isDirectory(path) {
+  try {
+    return (await stat4(path)).isDirectory();
+  } catch {
+    return false;
   }
-  throw new Error(`Invalid git source: ${source}`);
 }
 function cachePathFor2(url, cacheRoot) {
   const root = cacheRoot ? resolve5(cacheRoot) : join19(homedir2(), ".agentwheel", "cache");
@@ -5337,7 +5383,8 @@ function claudeAgentName(artifact) {
 
 // src/staging/staging.ts
 async function stageSource(driver, source, options = {}) {
-  return renderStagedBundle(await stageSourceRaw(driver, source, options), options);
+  const raw = await stageSourceRaw(driver, source, options);
+  return removeOnFailure(raw.root, () => renderStagedBundle(raw, options));
 }
 async function stageSourceRaw(driver, source, options = {}) {
   const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(source, options))));
@@ -5352,25 +5399,27 @@ async function stageResolvedSourceRaw(driver, resolved) {
   const artifacts = await driver.list(resolved);
   return stageResolvedArtifactsRaw(resolved, artifacts);
 }
-async function stageResolvedArtifactsRaw(resolved, artifacts) {
-  const root = await mkdtemp(join27(tmpdir2(), "agentwheel-stage-"));
+async function stageResolvedArtifactsRaw(resolved, artifacts, parentDir = tmpdir2()) {
+  const root = await mkdtemp(join27(parentDir, "agentwheel-stage-"));
   const stagedArtifacts = [];
-  for (const artifact of artifacts) {
-    const stagedPath = join27(root, artifact.relativePath);
-    await mkdir11(dirname13(stagedPath), { recursive: true });
-    await cp3(artifact.sourcePath, stagedPath, {
-      recursive: artifact.kind === "dir",
-      dereference: true,
-      filter: (path) => !isIgnoredGeneratedEntry(basename16(path))
-    });
-    await composeAssets(artifact, resolved.resolvedPath, stagedPath);
-    stagedArtifacts.push({
-      ...artifact,
-      stagedPath,
-      hash: await hashPath(stagedPath),
-      channel: artifact.channel ?? "managed"
-    });
-  }
+  await removeOnFailure(root, async () => {
+    for (const artifact of artifacts) {
+      const stagedPath = join27(root, artifact.relativePath);
+      await mkdir11(dirname13(stagedPath), { recursive: true });
+      await cp3(artifact.sourcePath, stagedPath, {
+        recursive: artifact.kind === "dir",
+        dereference: true,
+        filter: (path) => !isIgnoredGeneratedEntry(basename16(path))
+      });
+      await composeAssets(artifact, resolved.resolvedPath, stagedPath);
+      stagedArtifacts.push({
+        ...artifact,
+        stagedPath,
+        hash: await hashPath(stagedPath),
+        channel: artifact.channel ?? "managed"
+      });
+    }
+  });
   return {
     root,
     source: resolved,
@@ -5527,8 +5576,7 @@ import { dirname as dirname15, join as join30, relative as relative6 } from "pat
 
 // src/resolve/graph.ts
 import { createHash as createHash6 } from "crypto";
-import { mkdtemp as mkdtemp2, readdir as readdir7, readFile as readFile17, stat as stat11 } from "fs/promises";
-import { tmpdir as tmpdir3 } from "os";
+import { readdir as readdir7, readFile as readFile17, stat as stat11 } from "fs/promises";
 import { basename as basename17, extname as extname4, join as join29 } from "path";
 
 // src/model/workspace-composition.ts
@@ -5789,7 +5837,7 @@ var RegistryClient = class {
   }
 };
 async function resolvePackageSource(source, workspaceRoot, options = {}) {
-  const { isExplicitSource } = await import("./identify-O54QXPQR.js");
+  const { isExplicitSource } = await import("./identify-M6IA4RS7.js");
   if (await isExplicitSource(source)) return { source };
   const entry = await new RegistryClient({ workspaceRoot, offline: options.offline, warn: options.warn }).resolve(source);
   if (!entry) {
@@ -5831,6 +5879,17 @@ async function normalizeDependencySource(source, options) {
   if (isBareRegistryName(trimmed)) {
     return normalizeRegistrySource(trimmed, options);
   }
+  if (options.declaringGitSource && (trimmed === "." || trimmed === ".." || trimmed.startsWith("./") || trimmed.startsWith("../"))) {
+    const declaring = options.declaringGitSource;
+    const subpath = resolveGitRelativeSubpath(declaring.subpath, trimmed, source);
+    const normalizedSource = formatGitSource(declaring.url, declaring.commit, subpath);
+    return {
+      source: normalizedSource,
+      normalizedSource,
+      driver: "git",
+      requestedRef: declaring.commit
+    };
+  }
   if (isLocalSource(trimmed)) {
     const path = localSourcePath(trimmed);
     const resolvedPath = resolveLocalPath(path, options.declaringPackageRoot);
@@ -5841,10 +5900,10 @@ async function normalizeDependencySource(source, options) {
     };
   }
   if (trimmed.startsWith("github:") || trimmed.startsWith("git:")) {
-    const parsed = parseGitSource2(trimmed);
+    const parsed = parseGitSource(trimmed);
     const requestedRef = options.ref ?? parsed.ref ?? "HEAD";
     const url = normalizeGitRemoteUrl(parsed.url, options.declaringPackageRoot);
-    const normalizedSource = `git:${url}#${requestedRef}`;
+    const normalizedSource = formatGitSource(url, requestedRef, parsed.subpath);
     return {
       source: normalizedSource,
       normalizedSource,
@@ -5921,20 +5980,6 @@ async function normalizeRegistrySource(name, options) {
     normalizedSource: `registry:${name}:${resolved.normalizedSource}`
   };
 }
-function parseGitSource2(source) {
-  if (source.startsWith("github:")) {
-    const rest2 = source.slice("github:".length);
-    const [repo, ref] = rest2.split("#", 2);
-    if (!repo.includes("/")) throw new Error(`Invalid GitHub dependency source: ${source}`);
-    return { url: `https://github.com/${repo.replace(/\.git$/i, "")}.git`, ref };
-  }
-  const rest = source.slice("git:".length);
-  const hashIndex = rest.lastIndexOf("#");
-  if (hashIndex >= 0) {
-    return { url: rest.slice(0, hashIndex), ref: rest.slice(hashIndex + 1) };
-  }
-  return { url: rest };
-}
 function normalizeGitRemoteUrl(url, declaringPackageRoot) {
   if (url.startsWith("./") || url.startsWith("../") || url.startsWith("/") || url === "~" || url.startsWith("~/")) {
     return resolveLocalPath(url, declaringPackageRoot);
@@ -5986,7 +6031,6 @@ var SnapshotConflictError = class extends Error {
 var cacheLocks = /* @__PURE__ */ new Map();
 async function resolveDependencyGraph(roots, options) {
   if (roots.length === 0) throw new Error("At least one graph root is required.");
-  const graphRoot = await mkdtemp2(join29(tmpdir3(), "agentwheel-graph-"));
   const fetchCache = /* @__PURE__ */ new Map();
   const nodesByKey = /* @__PURE__ */ new Map();
   const nodesBySource = /* @__PURE__ */ new Map();
@@ -6052,7 +6096,6 @@ async function resolveDependencyGraph(roots, options) {
   }
   detectDirectCollisions(rawNodes);
   return {
-    root: graphRoot,
     roots: rootResults.sort((a, b) => a.rootId.localeCompare(b.rootId)),
     nodes: rawNodes.map((state) => state.node),
     rawNodes,
@@ -6094,6 +6137,7 @@ async function processRequirement(requirement, options, fetchCache, nodesByKey,
     let lockedByReference = lockedNodeForRequirementReference(requirement, options, lockLabel);
     let normalized = lockedByReference ? normalizedSourceFromLockedNode(lockedByReference.node) : await normalizeDependencySource(requirement.source, {
       declaringPackageRoot: requirement.declaringPackageRoot,
+      declaringGitSource: requirement.declaringGitSource,
       workspaceRoot: options.workspaceRoot,
       ref: requirement.ref,
       registryClient: options.registryClient
@@ -6101,6 +6145,7 @@ async function processRequirement(requirement, options, fetchCache, nodesByKey,
     if (lockedByReference && shouldCheckLockedRootSource(requirement)) {
       const declared = await normalizeDependencySource(requirement.source, {
         declaringPackageRoot: requirement.declaringPackageRoot,
+        declaringGitSource: requirement.declaringGitSource,
         workspaceRoot: options.workspaceRoot,
         ref: requirement.ref,
         registryClient: options.registryClient
@@ -6378,6 +6423,7 @@ function dependencyRequirement(state, fetched, alias, dependency, select, chain,
     useLock: dependency.mode !== "tracking" || options.lockedResolution === true && !updateClosure,
     updateClosure,
     declaringPackageRoot: fetched.resolved.resolvedPath,
+    declaringGitSource: declaringGitSource(fetched),
     requiredBy: state.node.id,
     alias,
     parentId: state.node.id,
@@ -6885,6 +6931,15 @@ async function mapLimit(items, limit, fn) {
   if (failure !== void 0) throw failure;
   return out;
 }
+function declaringGitSource(fetched) {
+  if (fetched.resolved.driver !== "git" || !fetched.resolved.resolvedCommit) return void 0;
+  const parsed = parseGitSource(fetched.resolved.source);
+  return {
+    url: normalizeGitRemoteUrl(parsed.url, fetched.resolved.resolvedPath),
+    commit: fetched.resolved.resolvedCommit,
+    subpath: parsed.subpath
+  };
+}
 
 // src/lifecycle/customization.ts
 async function remember(workspaceRoot, runtime, text) {
@@ -7039,7 +7094,7 @@ import { rm as rm7 } from "fs/promises";
 // src/lifecycle/source-plan.ts
 import { createHash as createHash8 } from "crypto";
 import { mkdir as mkdir14, readdir as readdir9 } from "fs/promises";
-import { basename as basename18, dirname as dirname17, join as join33, posix as posix2, resolve as resolve16 } from "path";
+import { basename as basename18, dirname as dirname17, join as join33, posix as posix3, resolve as resolve16 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
@@ -7202,11 +7257,14 @@ function formatSelectionImport(root) {
 
 // src/resolve/render.ts
 import { createHash as createHash7 } from "crypto";
-import { readFile as readFile18, mkdtemp as mkdtemp3 } from "fs/promises";
-import { tmpdir as tmpdir4 } from "os";
+import { readFile as readFile18, mkdtemp as mkdtemp2 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
 import { join as join31 } from "path";
 async function renderGraphForTarget(graph, targetContext = {}) {
-  const root = await mkdtemp3(join31(tmpdir4(), "agentwheel-render-"));
+  const root = await mkdtemp2(join31(tmpdir3(), "agentwheel-render-"));
+  return removeOnFailure(root, () => renderGraphIntoRoot(root, graph, targetContext));
+}
+async function renderGraphIntoRoot(root, graph, targetContext) {
   const artifacts = [];
   const stagedNodes = /* @__PURE__ */ new Map();
   const includeEdges = /* @__PURE__ */ new Map();
@@ -7214,7 +7272,7 @@ async function renderGraphForTarget(graph, targetContext = {}) {
   for (const rawNode of graph.rawNodes) {
     const ownsCompositionRules = rawNode.depth === 0 && rawNode.manifest?.schemaVersion === 3 && Boolean(rawNode.manifest.compositionRules?.length);
     if (rawNode.node.selected.length === 0 && !ownsCompositionRules) continue;
-    const rawBundle = await stageResolvedArtifactsRaw(rawNode.resolved, rawNode.artifacts);
+    const rawBundle = await stageResolvedArtifactsRaw(rawNode.resolved, rawNode.artifacts, root);
     const fragmentCustomized = targetContext.workspaceRoot && targetContext.adapter ? await applyFragmentCustomizations(rawBundle.artifacts, {
       workspaceRoot: targetContext.workspaceRoot,
       adapter: targetContext.adapter,
@@ -8081,7 +8139,7 @@ function containsPath(parent, candidate) {
 }
 
 // src/model/target-state.ts
-import { posix, resolve as resolve15 } from "path";
+import { posix as posix2, resolve as resolve15 } from "path";
 var targetEvolutionFields = /* @__PURE__ */ new Set([
   "adapterCodeHash",
   "adapterConfig",
@@ -8114,7 +8172,7 @@ function persistentTargetParts(value) {
   );
 }
 function normalizeInstallRoot(path, transportKind) {
-  return transportKind === "ssh" ? posix.normalize(path) : resolve15(path);
+  return transportKind === "ssh" ? posix2.normalize(path) : resolve15(path);
 }
 function targetEndpoint(value, transportKind) {
   if (transportKind !== "ssh") return { kind: "local" };
@@ -8271,85 +8329,87 @@ async function createGraphSourcePlan(options) {
     noDeps: options.noDeps,
     warn
   });
-  const desiredArtifacts = filterArtifactsByAdapterTargets(
-    desiredArtifactsFromGraphBundle(bundle),
-    options.adapter,
-    installationType,
-    { warn }
-  );
-  const resolvedInstallationType = resolveInstallationTypeForArtifacts(options.adapter, desiredArtifacts.map((artifact) => artifact.type), installationType);
-  const resolvedInstallRoot = installRootForArtifacts(options.adapter, options.targetRoot, resolvedInstallationType, desiredArtifacts.map((artifact) => artifact.type), transport.kind === "ssh");
-  const graphLockDigest = digestGraphLock(bundle.graphLock);
-  const graphDiff = diffGraphLocks(previousLock, bundle.graphLock);
-  if (normalizeInstallRoot2(resolvedInstallRoot, transport.kind) !== normalizeInstallRoot2(installRoot, transport.kind)) {
-    throw new Error(
-      `Adapter ${options.adapter.name} resolved a different install root after rendering; target state identity cannot be proven.`
+  return removeOnFailure(bundle.root, async () => {
+    const desiredArtifacts = filterArtifactsByAdapterTargets(
+      desiredArtifactsFromGraphBundle(bundle),
+      options.adapter,
+      installationType,
+      { warn }
     );
-  }
-  const manifest = priorState.manifest;
-  const basePlan = options.retireExactMcp ? await createExactMcpRetirementPlan(
-    desiredArtifacts,
-    options.adapter,
-    options.targetRoot,
-    manifest,
-    transport,
-    {
-      installationType: resolvedInstallationType,
-      stateKey,
-      workspaceOwner,
-      expectedFromWorkspaceOwner: options.expectedFromWorkspaceOwner,
-      graphLockDigest
+    const resolvedInstallationType = resolveInstallationTypeForArtifacts(options.adapter, desiredArtifacts.map((artifact) => artifact.type), installationType);
+    const resolvedInstallRoot = installRootForArtifacts(options.adapter, options.targetRoot, resolvedInstallationType, desiredArtifacts.map((artifact) => artifact.type), transport.kind === "ssh");
+    const graphLockDigest = digestGraphLock(bundle.graphLock);
+    const graphDiff = diffGraphLocks(previousLock, bundle.graphLock);
+    if (normalizeInstallRoot2(resolvedInstallRoot, transport.kind) !== normalizeInstallRoot2(installRoot, transport.kind)) {
+      throw new Error(
+        `Adapter ${options.adapter.name} resolved a different install root after rendering; target state identity cannot be proven.`
+      );
     }
-  ) : await createCombinedInstallPlan(desiredArtifacts, options.adapter, options.targetRoot, manifest, transport, {
-    baseRevision: manifest?.revision ?? null,
-    graphLockDigest,
-    workspaceOwner,
-    installationType: resolvedInstallationType,
-    stateKey,
-    forceDrift: options.forceDrift,
-    forceConflict: options.forceConflict,
-    replaceConflict: options.replaceConflict,
-    stateMigration: priorState.migration,
-    warn
-  });
-  const plan = priorState.migration && !basePlan.stateMigration ? { ...basePlan, stateMigration: priorState.migration } : basePlan;
-  plan.targetStateFilePreconditions = {
-    graphLockPath,
-    graphLockRevision: stableLock ? digestGraphLock(stableLock) : null,
-    sourceLockRevision: computeSourceLockRevision(stableSourceLock)
-  };
-  let foreignStateObservations = [];
-  if (options.forceForeignState !== true && options.deferForeignStateCheck !== true) {
-    foreignStateObservations = await assertNoForeignWorkspaceState({
-      installRoot: resolvedInstallRoot,
-      adapter: options.adapter.name,
+    const manifest = priorState.manifest;
+    const basePlan = options.retireExactMcp ? await createExactMcpRetirementPlan(
+      desiredArtifacts,
+      options.adapter,
+      options.targetRoot,
+      manifest,
       transport,
-      workspaceRoot,
+      {
+        installationType: resolvedInstallationType,
+        stateKey,
+        workspaceOwner,
+        expectedFromWorkspaceOwner: options.expectedFromWorkspaceOwner,
+        graphLockDigest
+      }
+    ) : await createCombinedInstallPlan(desiredArtifacts, options.adapter, options.targetRoot, manifest, transport, {
+      baseRevision: manifest?.revision ?? null,
+      graphLockDigest,
       workspaceOwner,
-      globalRoot: options.globalRoot,
+      installationType: resolvedInstallationType,
       stateKey,
-      migratingStateKey: priorState.migration?.fromStateKey,
-      plannedPaths: plan.operations.map((operation) => operation.relativeDestPath),
-      plannedOperations: plan.operations
+      forceDrift: options.forceDrift,
+      forceConflict: options.forceConflict,
+      replaceConflict: options.replaceConflict,
+      stateMigration: priorState.migration,
+      warn
     });
-    plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
-  }
-  return {
-    plan,
-    graph,
-    bundle,
-    desiredArtifacts,
-    graphLockPath,
-    graphLockDigest,
-    targetFingerprint,
-    warnings,
-    newTransitiveSources: trustEvaluation.promptSources,
-    graphDiff,
-    recoveredPendingApply,
-    previousManifest: priorState.manifest,
-    previousGraphLock: priorState.graphLock,
-    foreignStateObservations
-  };
+    const plan = priorState.migration && !basePlan.stateMigration ? { ...basePlan, stateMigration: priorState.migration } : basePlan;
+    plan.targetStateFilePreconditions = {
+      graphLockPath,
+      graphLockRevision: stableLock ? digestGraphLock(stableLock) : null,
+      sourceLockRevision: computeSourceLockRevision(stableSourceLock)
+    };
+    let foreignStateObservations = [];
+    if (options.forceForeignState !== true && options.deferForeignStateCheck !== true) {
+      foreignStateObservations = await assertNoForeignWorkspaceState({
+        installRoot: resolvedInstallRoot,
+        adapter: options.adapter.name,
+        transport,
+        workspaceRoot,
+        workspaceOwner,
+        globalRoot: options.globalRoot,
+        stateKey,
+        migratingStateKey: priorState.migration?.fromStateKey,
+        plannedPaths: plan.operations.map((operation) => operation.relativeDestPath),
+        plannedOperations: plan.operations
+      });
+      plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
+    }
+    return {
+      plan,
+      graph,
+      bundle,
+      desiredArtifacts,
+      graphLockPath,
+      graphLockDigest,
+      targetFingerprint,
+      warnings,
+      newTransitiveSources: trustEvaluation.promptSources,
+      graphDiff,
+      recoveredPendingApply,
+      previousManifest: priorState.manifest,
+      previousGraphLock: priorState.graphLock,
+      foreignStateObservations
+    };
+  });
 }
 async function assertNoForeignWorkspaceStateForPlan(plan, options) {
   if (!plan.stateKey) throw new Error(`Foreign-state validation requires a state key for ${plan.adapter}.`);
@@ -8708,7 +8768,7 @@ function stableJson2(value) {
   return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort((left, right) => left.localeCompare(right)).map((key) => `${JSON.stringify(key)}:${stableJson2(record[key])}`).join(",")}}`;
 }
 function normalizeInstallRoot2(path, transportKind) {
-  return transportKind === "ssh" ? posix2.normalize(path) : resolve16(path);
+  return transportKind === "ssh" ? posix3.normalize(path) : resolve16(path);
 }
 var workspaceOwnerPrefix2 = "workspace-root:";
 async function assertNoForeignWorkspaceState(check) {
@@ -9785,6 +9845,7 @@ function resolveCliVersion() {
 
 // src/lifecycle/ownership.ts
 import { resolve as resolve20 } from "path";
+var unknownWorkspaceOwner = "workspace:unknown";
 async function planArtifactOwnershipHandoff(request) {
   return validateOwnershipHandoff(request, request.transport ?? localTransport);
 }
@@ -9803,6 +9864,9 @@ async function applyArtifactOwnershipHandoff(request) {
       throw new Error("Cannot hand off ownership while an apply journal is pending. Recover or abort it first.");
     }
     const plan = await validateOwnershipHandoff(request, transport);
+    if (plan.drifted && !request.expectedRuntimeHash) {
+      throw new Error("Applying a drifted ownership handoff requires expectedRuntimeHash from a reviewed dry-run.");
+    }
     const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, scope);
     if (!manifest || manifest.version !== 2) {
       throw new Error("Ownership handoff requires an Agentwheel v2 install manifest.");
@@ -9833,6 +9897,13 @@ async function applyArtifactOwnershipHandoff(request) {
 async function validateOwnershipHandoff(request, transport) {
   if (request.expectedHash) assertSha256(request.expectedHash, "expected artifact hash");
   if (request.expectedRevision) assertSha256(request.expectedRevision, "expected manifest revision");
+  if (request.expectedRuntimeHash) {
+    assertSha256(request.expectedRuntimeHash, "expected runtime hash");
+    if (request.carryDrift !== true) throw new Error("An expected runtime hash is only valid with carryDrift.");
+  }
+  if (request.fromWorkspaceRoot === void 0 === (request.fromUnknownOwner !== true)) {
+    throw new Error("Ownership handoff requires exactly one of fromWorkspaceRoot or fromUnknownOwner.");
+  }
   const scope = { installationType: request.installationType, stateKey: request.stateKey };
   const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, scope);
   if (!manifest) throw new Error(`No install manifest for ${request.adapter} at ${request.targetRoot}`);
@@ -9850,7 +9921,7 @@ async function validateOwnershipHandoff(request, transport) {
     );
   }
   const entry = matches[0];
-  const fromOwner = workspaceOwnerForRoot(request.fromWorkspaceRoot);
+  const fromOwner = request.fromUnknownOwner === true ? unknownWorkspaceOwner : workspaceOwnerForRoot(request.fromWorkspaceRoot);
   const toOwner = workspaceOwnerForRoot(request.toWorkspaceRoot, request.toFleetId);
   if (fromOwner === toOwner) throw new Error("Ownership handoff requires different workspace roots.");
   if (entry.workspaceOwner !== fromOwner) {
@@ -9861,9 +9932,14 @@ async function validateOwnershipHandoff(request, transport) {
   }
   const destPath = containedArtifactPath(request.targetRoot, entry.path);
   if (!await transport.pathExists(destPath)) throw new Error(`Managed artifact is missing: ${entry.path}`);
-  const currentHash = await verifiedEntryHash(entry, destPath, transport);
-  if (request.expectedHash && currentHash !== request.expectedHash) {
-    throw new Error(`Current hash precondition failed for ${entry.path}: expected ${request.expectedHash}, found ${currentHash}`);
+  const runtimeHash = await verifiedEntryHash(entry, destPath, transport, request.carryDrift === true);
+  const drifted = runtimeHash !== entry.hash;
+  if (drifted) {
+    if (request.expectedRuntimeHash && runtimeHash !== request.expectedRuntimeHash) {
+      throw new Error(`Runtime hash precondition failed for ${entry.path}: expected ${request.expectedRuntimeHash}, found ${runtimeHash}`);
+    }
+  } else if (request.expectedRuntimeHash) {
+    throw new Error(`Runtime hash precondition failed for ${entry.path}: the artifact is no longer drifted`);
   }
   return {
     adapter: request.adapter,
@@ -9872,13 +9948,15 @@ async function validateOwnershipHandoff(request, transport) {
     targetRoot: request.targetRoot,
     selector: `${request.artifactType}/${request.artifactName}`,
     path: entry.path,
-    artifactHash: currentHash,
+    artifactHash: entry.hash,
+    runtimeHash,
+    drifted,
     manifestRevision: manifest.revision,
     fromOwner,
     toOwner
   };
 }
-async function verifiedEntryHash(entry, destPath, transport) {
+async function verifiedEntryHash(entry, destPath, transport, carryFileDrift = false) {
   if (entry.semanticPlugin) throw new Error(`Ownership handoff cannot verify semantic plugin state at ${destPath}`);
   if (entry.mode === "managed-block") {
     const selector = managedInstructionSelector(entry.logicalSelector, entry.artifactType, entry.artifactName);
@@ -9896,7 +9974,7 @@ async function verifiedEntryHash(entry, destPath, transport) {
     return entry.hash;
   }
   const currentHash = await transport.hashPath(destPath);
-  if (currentHash !== entry.hash) {
+  if (currentHash !== entry.hash && !carryFileDrift) {
     throw new Error(`Managed artifact is drifted at ${destPath}: manifest ${entry.hash}, current ${currentHash}`);
   }
   return currentHash;
@@ -10226,7 +10304,7 @@ import { isAbsolute as isAbsolute3, relative as relative9, resolve as resolve23
 // src/lifecycle/legacy-recovery-plan.ts
 import { createHash as createHash10 } from "crypto";
 import { lstat as lstat3, readdir as readdir10 } from "fs/promises";
-import { basename as basename20, dirname as dirname21, join as join39, posix as posix3, relative as relative8, resolve as resolve22 } from "path";
+import { basename as basename20, dirname as dirname21, join as join39, posix as posix4, relative as relative8, resolve as resolve22 } from "path";
 async function inventoryHistoricalLocks(fleetRoot) {
   const root = join39(fleetRoot, ".agentwheel", "locks");
   const found = [];
@@ -10384,7 +10462,7 @@ function claimFor(item, entry, locks, binding) {
   const matches = locks.filter((candidate) => candidate.digest === digest2);
   const evidence = [];
   const owner = "workspaceOwner" in entry ? entry.workspaceOwner : legacyUnownedWorkspaceOwner;
-  const sameRoot = binding.transportKind === "ssh" ? posix3.normalize(item.manifest.targetRoot) === posix3.normalize(binding.installRoot) : resolve22(item.manifest.targetRoot) === resolve22(binding.installRoot);
+  const sameRoot = binding.transportKind === "ssh" ? posix4.normalize(item.manifest.targetRoot) === posix4.normalize(binding.installRoot) : resolve22(item.manifest.targetRoot) === resolve22(binding.installRoot);
   const inTargetDir = matches.filter((candidate) => resolve22(dirname21(candidate.path)) === resolve22(binding.targetLockDir));
   const boundLocks = inTargetDir.filter((candidate) => lockBindsState(candidate, item, binding));
   if (owner !== binding.expectedOwner) evidence.push("workspace owner differs from selected Fleet target");
@@ -14355,10 +14433,13 @@ program.command("remember").description("append text to the local instructions o
   console.log(nextInstallNudge());
 });
 var ownershipCommand = program.command("ownership").description("inspect and transfer manifest ownership without rewriting runtime artifacts");
-ownershipCommand.command("handoff").description("transfer one managed artifact between Agentwheel workspace roots").argument("<selector>", "exact artifact selector in type/name form").requiredOption("--from-workspace-root <path>", "current owning workspace root").requiredOption("--to-workspace-root <path>", "new owning workspace root").option("--to-fleet <id>", "qualify the new owner with a registered fleet id").option("--expected-hash <sha256>", "expected current artifact hash; required when applying").option("--expected-revision <sha256>", "expected install manifest revision; required when applying").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--profile <name>", "workspace runtime profile (must resolve to one target)").option("--dry-run", "validate all preconditions without writing the manifest", false).action(async (selector, options) => {
+ownershipCommand.command("handoff").description("transfer one managed artifact between Agentwheel workspace roots").argument("<selector>", "exact artifact selector in type/name form").option("--from-workspace-root <path>", "current owning workspace root").option("--from-unknown-owner", "hand off an artifact recorded as workspace:unknown", false).requiredOption("--to-workspace-root <path>", "new owning workspace root").option("--to-fleet <id>", "qualify the new owner with a registered fleet id").option("--expected-hash <sha256>", "expected recorded artifact hash; required when applying").option("--expected-revision <sha256>", "expected install manifest revision; required when applying").option("--carry-drift", "accept a file or directory whose runtime differs from the recorded hash; the recorded hash is kept", false).option("--expected-runtime-hash <sha256>", "expected drifted runtime hash; required when applying with --carry-drift").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--profile <name>", "workspace runtime profile (must resolve to one target)").option("--dry-run", "validate all preconditions without writing the manifest", false).action(async (selector, options) => {
   if (!options.dryRun && (!options.expectedHash || !options.expectedRevision)) {
     throw new Error("Applying an ownership handoff requires --expected-hash and --expected-revision from a reviewed --dry-run.");
   }
+  if (Boolean(options.fromWorkspaceRoot) === (options.fromUnknownOwner === true)) {
+    throw new Error("Ownership handoff requires exactly one of --from-workspace-root or --from-unknown-owner.");
+  }
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const targets = await resolveCliTargets(normalizedOptions);
   if (targets.length !== 1) {
@@ -14390,11 +14471,13 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
     adapter: adapter.name,
     artifactType,
     artifactName,
-    fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
+    ...options.fromUnknownOwner === true ? { fromUnknownOwner: true } : { fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot) },
     toWorkspaceRoot,
     toFleetId: options.toFleet,
     expectedHash: options.expectedHash,
     expectedRevision: options.expectedRevision,
+    carryDrift: options.carryDrift === true,
+    expectedRuntimeHash: options.expectedRuntimeHash,
     transport: transportForTarget(target)
   };
   const result = options.dryRun ? await planArtifactOwnershipHandoff(request) : await applyArtifactOwnershipHandoff(request);
@@ -14402,6 +14485,7 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   console.log(`Target: ${result.adapter}/${result.installationType ?? "default"} at ${result.targetRoot}`);
   console.log(`Path: ${result.path}`);
   console.log(`Hash: ${result.artifactHash}`);
+  if (result.drifted) console.log(`Runtime hash: ${result.runtimeHash} (drift carried; the recorded hash is kept)`);
   console.log(`Manifest revision: ${result.manifestRevision}`);
   console.log(`Owner: ${result.fromOwner} -> ${result.toOwner}`);
 });
@@ -14911,30 +14995,34 @@ async function runInstallCommand(nameOrSource, options, behavior) {
         throw teachingInstallError(nameOrSource, error);
       }
     }
-    for (const result of await buildGraphPlansForTarget(target, source, { ...targetOptions, scope, extraPackage, reportFormat: outputFormat }, { mode: "install" })) {
-      if (!behavior.quiet) console.log(formatGraphPlan(result));
-      if (behavior.apply) {
-        declareMutationPath(result.graphLockPath);
-        if (extraPackage && !targetOptions.onlySource) declareMutationPath(workspaceConfigPath(target.workspaceRoot));
-        const transport = transportForTarget(target);
-        const executePlugins = target.executePlugins ?? targetOptions.executePlugins;
-        await applyCombinedInstallPlan(result.plan, {
-          executePlugins,
-          transport,
-          graphLockDigest: result.graphLockDigest,
-          graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
-        });
-        const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
-          enabled: target.reloadRuntimes ?? shouldReloadRuntimes(targetOptions),
-          executePlugins
-        });
-        if (!behavior.quiet) {
-          console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
-          if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+    const results = await buildGraphPlansForTarget(target, source, { ...targetOptions, scope, extraPackage, reportFormat: outputFormat }, { mode: "install" });
+    try {
+      for (const result of results) {
+        if (!behavior.quiet) console.log(formatGraphPlan(result));
+        if (behavior.apply) {
+          declareMutationPath(result.graphLockPath);
+          if (extraPackage && !targetOptions.onlySource) declareMutationPath(workspaceConfigPath(target.workspaceRoot));
+          const transport = transportForTarget(target);
+          const executePlugins = target.executePlugins ?? targetOptions.executePlugins;
+          await applyCombinedInstallPlan(result.plan, {
+            executePlugins,
+            transport,
+            graphLockDigest: result.graphLockDigest,
+            graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
+          });
+          const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
+            enabled: target.reloadRuntimes ?? shouldReloadRuntimes(targetOptions),
+            executePlugins
+          });
+          if (!behavior.quiet) {
+            console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
+            if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+          }
         }
+        if (result.plan.hasBlockingChanges) process.exitCode = 1;
       }
-      await rm10(result.bundle.root, { recursive: true, force: true });
-      if (result.plan.hasBlockingChanges) process.exitCode = 1;
+    } finally {
+      await Promise.all(results.map((result) => rm10(result.bundle.root, { recursive: true, force: true })));
     }
     if (behavior.apply && extraPackage && !targetOptions.onlySource) {
       await writeWorkspaceConfig(target.workspaceRoot, upsertPackage(await readWorkspaceConfig(target.workspaceRoot), extraPackage));
@@ -15385,31 +15473,43 @@ async function runSkillUpdateCommand(skillName, options) {
 }
 async function runConfiguredGraphPackages(target, options, behavior) {
   const results = await buildGraphPlansForTarget(target, void 0, options, behavior);
-  for (const result of results) {
-    console.log(`${behavior.mode === "update" ? "Update" : "Install"} ${result.plan.adapter} at ${result.plan.targetRoot}:`);
-    console.log(formatGraphPlan(result));
-    if (!options.dryRun) {
-      declareMutationPath(result.graphLockPath);
-      const transport = transportForTarget(target);
-      const executePlugins = target.executePlugins ?? options.executePlugins;
-      await applyCombinedInstallPlan(result.plan, {
-        executePlugins,
-        transport,
-        graphLockDigest: result.graphLockDigest,
-        graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
-      });
-      const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
-        enabled: target.reloadRuntimes ?? shouldReloadRuntimes(options),
-        executePlugins
-      });
-      console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
-      if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+  try {
+    for (const result of results) {
+      console.log(`${behavior.mode === "update" ? "Update" : "Install"} ${result.plan.adapter} at ${result.plan.targetRoot}:`);
+      console.log(formatGraphPlan(result));
+      if (!options.dryRun) {
+        declareMutationPath(result.graphLockPath);
+        const transport = transportForTarget(target);
+        const executePlugins = target.executePlugins ?? options.executePlugins;
+        await applyCombinedInstallPlan(result.plan, {
+          executePlugins,
+          transport,
+          graphLockDigest: result.graphLockDigest,
+          graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
+        });
+        const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
+          enabled: target.reloadRuntimes ?? shouldReloadRuntimes(options),
+          executePlugins
+        });
+        console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
+        if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+      }
+      if (result.plan.hasBlockingChanges) process.exitCode = 1;
     }
-    await rm10(result.bundle.root, { recursive: true, force: true });
-    if (result.plan.hasBlockingChanges) process.exitCode = 1;
+  } finally {
+    await Promise.all(results.map((result) => rm10(result.bundle.root, { recursive: true, force: true })));
   }
 }
 async function buildGraphPlansForTarget(target, source, options, behavior) {
+  const bundleRoots = [];
+  try {
+    return await collectGraphPlansForTarget(target, source, options, behavior, bundleRoots);
+  } catch (error) {
+    await Promise.all(bundleRoots.map((root) => rm10(root, { recursive: true, force: true })));
+    throw error;
+  }
+}
+async function collectGraphPlansForTarget(target, source, options, behavior, bundleRoots) {
   const targetOptions = optionsForResolvedTarget(options, target);
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
   const groups = /* @__PURE__ */ new Map();
@@ -15603,6 +15703,7 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       expectedFromWorkspaceOwner: targetOptions.expectedFromWorkspaceOwner,
       recoverLegacyState: targetOptions.recoverLegacyState
     });
+    bundleRoots.push(result.bundle.root);
     if ((behavior.mode === "install" || behavior.mode === "update") && scopedRootId) {
       const manifest = result.previousManifest;
       const previousLock = result.previousGraphLock;
@@ -16239,7 +16340,7 @@ async function uninstallConfiguredPackage(target, packageName, options) {
     let renderedRoot;
     if (remainingGroup && remainingGroup.packages.length > 0) {
       const remainingAdapter = await resolveAdapterForTarget(remainingGroup.target, remainingGroup.adapterOptions);
-      const result2 = await createGraphSourcePlan({
+      const result = await createGraphSourcePlan({
         roots: remainingGroup.packages.map((pkg2) => ({
           rootId: pkg2.name,
           source: pkg2.source,
@@ -16271,46 +16372,49 @@ async function uninstallConfiguredPackage(target, packageName, options) {
         readOnly: options.dryRun === true,
         isTTY: process.stdin.isTTY === true
       });
-      remainingGraphPlan = result2;
-      remainingDesired = desiredArtifactsFromGraphBundle(result2.bundle);
-      renderedRoot = result2.bundle.root;
+      remainingGraphPlan = result;
+      remainingDesired = desiredArtifactsFromGraphBundle(result.bundle);
+      renderedRoot = result.bundle.root;
     }
-    const uninstallPlan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, {
-      graphLockDigest: remainingGraphPlan?.graphLockDigest
-    });
-    const transitionPlan = remainingGraphPlan?.plan;
-    const plan = {
-      ...uninstallPlan,
-      stateKey: transitionPlan?.stateKey ?? removedState.stableStateKey,
-      stateMigration: transitionPlan?.stateMigration ?? removedState.migration,
-      targetStateFilePreconditions: transitionPlan?.targetStateFilePreconditions ?? removedState.targetStateFilePreconditions
-    };
-    console.log(`Uninstall ${pkg.name} (${adapter.name} at ${removedTarget.targetRoot}):`);
-    console.log(formatPlan(plan));
-    const graphLockFinalState = remainingGraphPlan ? { graphLock: { path: remainingGraphPlan.graphLockPath, lock: remainingGraphPlan.bundle.graphLock } } : {
-      removeGraphLockPath: removedState.graphLockPath ?? removedState.stableGraphLockPath
-    };
-    if (!options.dryRun) {
-      declareMutationPath(workspaceConfigPath(target.workspaceRoot));
-      const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : removedState.graphLockPath ?? removedState.stableGraphLockPath;
-      declareMutationPath(declarativeGraphPath);
-    }
-    const result = await uninstall(plan, {
-      dryRun: options.dryRun,
-      force: options.force,
-      keepFiles: options.keepFiles,
-      transport,
-      ...graphLockFinalState,
-      workspaceConfig: {
-        path: workspaceConfigPath(target.workspaceRoot),
-        data: { ...config, packages: remaining }
+    try {
+      const uninstallPlan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, {
+        graphLockDigest: remainingGraphPlan?.graphLockDigest
+      });
+      const transitionPlan = remainingGraphPlan?.plan;
+      const plan = {
+        ...uninstallPlan,
+        stateKey: transitionPlan?.stateKey ?? removedState.stableStateKey,
+        stateMigration: transitionPlan?.stateMigration ?? removedState.migration,
+        targetStateFilePreconditions: transitionPlan?.targetStateFilePreconditions ?? removedState.targetStateFilePreconditions
+      };
+      console.log(`Uninstall ${pkg.name} (${adapter.name} at ${removedTarget.targetRoot}):`);
+      console.log(formatPlan(plan));
+      const graphLockFinalState = remainingGraphPlan ? { graphLock: { path: remainingGraphPlan.graphLockPath, lock: remainingGraphPlan.bundle.graphLock } } : {
+        removeGraphLockPath: removedState.graphLockPath ?? removedState.stableGraphLockPath
+      };
+      if (!options.dryRun) {
+        declareMutationPath(workspaceConfigPath(target.workspaceRoot));
+        const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : removedState.graphLockPath ?? removedState.stableGraphLockPath;
+        declareMutationPath(declarativeGraphPath);
       }
-    });
-    if (!options.dryRun) {
-      console.log(formatUninstallResult(result));
+      const result = await uninstall(plan, {
+        dryRun: options.dryRun,
+        force: options.force,
+        keepFiles: options.keepFiles,
+        transport,
+        ...graphLockFinalState,
+        workspaceConfig: {
+          path: workspaceConfigPath(target.workspaceRoot),
+          data: { ...config, packages: remaining }
+        }
+      });
+      if (!options.dryRun) {
+        console.log(formatUninstallResult(result));
+      }
+      if (plan.hasBlockingChanges) process.exitCode = 1;
+    } finally {
+      if (renderedRoot) await rm10(renderedRoot, { recursive: true, force: true });
     }
-    if (renderedRoot) await rm10(renderedRoot, { recursive: true, force: true });
-    if (plan.hasBlockingChanges) process.exitCode = 1;
   }
 }
 function graphGroupForPackage(groups, target, pkg, options) {
@@ -16367,7 +16471,7 @@ function targetFingerprintParts(target, adapter, options, installationType) {
   };
 }
 async function withFreshReadOnlyGraphPlan(target, adapter, adapterOptions, installationType, packages, use) {
-  const stage = await mkdtemp4(join46(tmpdir5(), "agentwheel-recovery-"));
+  const stage = await mkdtemp3(join46(tmpdir4(), "agentwheel-recovery-"));
   const priorTmpdir = process.env.TMPDIR;
   try {
     process.env.TMPDIR = stage;

package/dist/{transaction-4KBNHDQX.js → transaction-JHZJWBII.js}

@@ -18,8 +18,8 @@ import {
   removeApplyJournal,
   rollbackCompletedOperations,
   writeApplyJournal
-} from "./chunk-FP26KSBM.js";
-import "./chunk-GE7F76AC.js";
+} from "./chunk-BHT57MK5.js";
+import "./chunk-BNIF3FUR.js";
 export {
   abortApplyJournal,
   acquireApplyLock,

package/openpack.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "NestDevLab/agentwheel",
-  "version": "0.20.18",
+  "version": "0.20.19",
   "provides": [
     { "type": "skills", "path": "skills" }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.20.18",
+  "version": "0.20.19",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",

package/skills/agentwheel/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.20.18"
+  version: "0.20.19"
 ---
 
 # agentwheel

package/skills/agentwheel-discovery/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.20.18"
+  version: "0.20.19"
 ---
 
 # Agentwheel Discovery