agentwheel 0.20.18 → 0.20.20

package/dist/index.js

@@ -37,7 +37,7 @@ import {
   uninstall,
   withManifestRevision,
   writeInstallManifest
-} from "./chunk-A44XYLUT.js";
+} from "./chunk-45WVSUJA.js";
 import {
   CURRENT_WORKSPACE_SCHEMA_VERSION,
   GovernedMutation,
@@ -56,6 +56,7 @@ import {
   findExistingWorkspaceRoot,
   findWorkspaceRoot,
   fleetIdSchema,
+  getAdapter,
   globalWorkspaceConfigPath,
   installManifestPath,
   installRootForAdapterInstallationType,
@@ -74,6 +75,7 @@ import {
   packageItemRequireSchema,
   packageItemSuggestSchema,
   packageSupersedesEntrySchema,
+  packagesForTarget,
   parseSemver,
   readApplyJournal,
   readMergedWorkspaceConfig,
@@ -98,25 +100,26 @@ import {
   workspaceSelectionImportSchema,
   writeApplyJournal,
   writeWorkspaceConfig
-} from "./chunk-FP26KSBM.js";
+} from "./chunk-FGFPAZ4J.js";
 import {
   inferSourceDriverName
-} from "./chunk-U2GRG4UI.js";
+} from "./chunk-QABA4WUP.js";
 import {
   hashPath,
   isAlreadyExists,
   isIgnoredGeneratedEntry,
   listFiles,
   pathExists,
+  removeOnFailure,
   withFilesystemLock,
   writeJsonAtomic
-} from "./chunk-GE7F76AC.js";
+} from "./chunk-BNIF3FUR.js";
 
 // src/cli/index.ts
 import { createHash as createHash16 } from "crypto";
 import { existsSync } from "fs";
-import { mkdir as mkdir16, mkdtemp as mkdtemp4, realpath as realpath3, rm as rm10, writeFile as writeFile13 } from "fs/promises";
-import { homedir as homedir12, tmpdir as tmpdir5 } from "os";
+import { mkdir as mkdir16, mkdtemp as mkdtemp3, realpath as realpath3, rm as rm10, writeFile as writeFile13 } from "fs/promises";
+import { homedir as homedir12, tmpdir as tmpdir4 } from "os";
 import { basename as basename21, dirname as dirname23, isAbsolute as isAbsolute5, join as join46, relative as relative11, resolve as resolve27 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
@@ -124,185 +127,6 @@ import { Command } from "commander";
 // src/adapters/resolve.ts
 import { resolve as resolve2 } from "path";
 
-// src/adapters/claude.ts
-var claudeAdapter = {
-  name: "claude",
-  displayName: "Claude Code",
-  targets: {
-    instructions: {
-      local: { enabled: true, dest: "CLAUDE.md", mode: "managed-block" },
-      user: { enabled: true, root: "home", dest: ".claude/CLAUDE.md", mode: "managed-block" }
-    },
-    rules: {
-      local: { enabled: true, dest: ".claude/rules", formats: ["markdown-rule", "claude-markdown-rule"] },
-      user: { enabled: true, root: "home", dest: ".claude/rules", formats: ["markdown-rule", "claude-markdown-rule"] }
-    },
-    skills: {
-      local: { enabled: true, dest: ".claude/skills" },
-      user: { enabled: true, root: "home", dest: ".claude/skills" }
-    },
-    commands: {
-      local: { enabled: true, dest: ".claude/commands" },
-      user: { enabled: true, root: "home", dest: ".claude/commands" }
-    },
-    subagents: {
-      local: { enabled: true, dest: ".claude/agents" },
-      user: { enabled: true, root: "home", dest: ".claude/agents" }
-    },
-    plugins: {
-      local: { enabled: true, dest: ".agentwheel/plugins/claude", semantic: "claude-plugin" },
-      user: { enabled: true, root: "home", dest: ".agentwheel/plugins/claude", semantic: "claude-plugin" }
-    },
-    mcp: {
-      local: { enabled: true, dest: ".mcp.json", merge: "json-deep" }
-    },
-    hooks: {
-      local: { enabled: true, dest: ".claude/settings.json", merge: "json-deep" },
-      user: { enabled: true, root: "home", dest: ".claude/settings.json", merge: "json-deep" }
-    },
-    settings: {
-      local: { enabled: true, dest: ".claude/settings.json", merge: "json-deep" },
-      user: { enabled: true, root: "home", dest: ".claude/settings.json", merge: "json-deep" }
-    }
-  }
-};
-
-// src/adapters/copilot.ts
-var copilotAdapter = {
-  name: "copilot",
-  displayName: "GitHub Copilot CLI",
-  targets: {
-    instructions: {
-      local: { enabled: true, dest: ".github/copilot-instructions.md", mode: "managed-block" },
-      user: { enabled: true, root: "home", dest: ".copilot/copilot-instructions.md", mode: "managed-block" }
-    },
-    rules: {
-      local: { enabled: true, dest: ".github/instructions", formats: ["markdown-rule", "copilot-instruction-rule"], semantic: "copilot-instruction" },
-      user: { enabled: true, root: "home", dest: ".copilot/instructions", formats: ["markdown-rule", "copilot-instruction-rule"], semantic: "copilot-instruction" }
-    },
-    commands: {
-      local: { enabled: true, dest: ".github/prompts", semantic: "copilot-prompt" }
-    },
-    skills: {
-      local: { enabled: true, dest: ".github/skills" },
-      user: { enabled: true, root: "home", dest: ".copilot/skills" }
-    },
-    plugins: {
-      user: { enabled: true, root: "home", dest: ".agentwheel/plugins/copilot", semantic: "copilot-plugin" }
-    },
-    subagents: {
-      local: { enabled: true, dest: ".github/agents", semantic: "copilot-agent" },
-      user: { enabled: true, root: "home", dest: ".copilot/agents", semantic: "copilot-agent" }
-    },
-    mcp: {
-      local: { enabled: true, dest: ".github/mcp.json", merge: "json-deep" },
-      user: { enabled: true, root: "home", dest: ".copilot/mcp-config.json", merge: "json-deep" }
-    },
-    hooks: {
-      local: { enabled: true, dest: ".github/hooks" },
-      user: { enabled: true, root: "home", dest: ".copilot/hooks" }
-    },
-    settings: {
-      local: { enabled: true, dest: ".github/settings.json", merge: "json-deep" },
-      user: { enabled: true, root: "home", dest: ".copilot/settings.json", merge: "json-deep" }
-    }
-  }
-};
-
-// src/adapters/codex.ts
-var codexAdapter = {
-  name: "codex",
-  displayName: "Codex CLI",
-  targets: {
-    instructions: {
-      local: { enabled: true, dest: "AGENTS.md", mode: "managed-block" },
-      user: { enabled: true, root: "home", dest: ".codex/AGENTS.md", mode: "managed-block" }
-    },
-    skills: {
-      local: { enabled: true, dest: ".agents/skills" },
-      user: { enabled: true, root: "home", dest: ".agents/skills" }
-    },
-    plugins: {
-      local: { enabled: true, dest: ".agentwheel/plugins/codex", semantic: "codex-plugin" },
-      user: { enabled: true, root: "home", dest: ".agentwheel/plugins/codex", semantic: "codex-plugin" }
-    },
-    subagents: {
-      local: { enabled: true, dest: ".codex/agents", semantic: "codex-subagent" },
-      user: { enabled: true, root: "home", dest: ".codex/agents", semantic: "codex-subagent" }
-    },
-    mcp: {
-      local: { enabled: true, dest: ".codex/config.toml", merge: "codex-toml-mcp" },
-      user: { enabled: true, root: "home", dest: ".codex/config.toml", merge: "codex-toml-mcp" }
-    },
-    hooks: {
-      local: { enabled: true, dest: ".codex/hooks.json", merge: "json-deep" },
-      user: { enabled: true, root: "home", dest: ".codex/hooks.json", merge: "json-deep" }
-    }
-  }
-};
-
-// src/adapters/hermes.ts
-var hermesAdapter = {
-  name: "hermes",
-  displayName: "Hermes",
-  targets: {
-    instructions: {
-      local: { enabled: true, dest: "AGENTS.md", mode: "managed-block" },
-      // Hermes documents SOUL.md as the user-level instruction surface.
-      user: { enabled: true, root: "home", dest: ".hermes/SOUL.md", mode: "managed-block" }
-    },
-    skills: {
-      user: { enabled: true, root: "home", dest: ".hermes/skills" }
-    },
-    mcp: {
-      user: { enabled: true, root: "home", dest: ".hermes/config.yaml", merge: "yaml-deep" }
-    },
-    settings: {
-      user: { enabled: true, root: "home", dest: ".hermes/config.yaml", merge: "yaml-deep" }
-    },
-    plugins: {
-      user: { enabled: true, root: "home", dest: ".agentwheel/plugins/hermes", semantic: "hermes-plugin" }
-    }
-  }
-};
-
-// src/adapters/openclaw.ts
-var openClawAdapter = {
-  name: "openclaw",
-  displayName: "OpenClaw",
-  targets: {
-    instructions: {
-      user: { enabled: true, root: "home", dest: ".openclaw/workspace/AGENTS.md", mode: "managed-block" }
-    },
-    skills: {
-      local: { enabled: true, dest: "skills" },
-      user: { enabled: true, root: "home", dest: ".openclaw/skills" }
-    },
-    subagents: {
-      user: { enabled: true, root: "home", dest: ".openclaw/workspace-subagents", semantic: "openclaw-subagent" }
-    },
-    mcp: {
-      user: { enabled: true, root: "home", dest: ".openclaw/openclaw.json", merge: "openclaw-json-deep" }
-    },
-    settings: {
-      user: { enabled: true, root: "home", dest: ".openclaw/openclaw.json", merge: "openclaw-json-deep" }
-    },
-    plugins: {
-      local: { enabled: true, dest: ".openclaw/plugins", formats: ["openclaw-plugin", "openclaw-clawhub-plugin"], semantic: "openclaw-plugin" }
-    }
-  }
-};
-
-// src/adapters/index.ts
-var adapters = [openClawAdapter, claudeAdapter, codexAdapter, hermesAdapter, copilotAdapter];
-function getAdapter(name) {
-  const adapter = adapters.find((candidate) => candidate.name === name);
-  if (!adapter) {
-    throw new Error(`Unknown adapter: ${name}`);
-  }
-  return adapter;
-}
-
 // src/adapters/programmatic.ts
 import { stat, readFile, writeFile } from "fs/promises";
 import { tmpdir } from "os";
@@ -4079,6 +3903,58 @@ function errorMessage3(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/source/git-source.ts
+import { posix } from "path";
+var SUBPATH_SEPARATOR = "//";
+function parseGitSource(source) {
+  if (source.startsWith("github:")) {
+    const rest = source.slice("github:".length);
+    const hashIndex = rest.indexOf("#");
+    const repo = hashIndex >= 0 ? rest.slice(0, hashIndex) : rest;
+    if (!repo.includes("/")) throw new Error(`Invalid GitHub source: ${source}`);
+    return {
+      url: `https://github.com/${repo.replace(/\.git$/i, "")}.git`,
+      ...splitFragment(hashIndex >= 0 ? rest.slice(hashIndex + 1) : void 0, source)
+    };
+  }
+  if (source.startsWith("git:")) {
+    const rest = source.slice("git:".length);
+    const hashIndex = rest.lastIndexOf("#");
+    if (hashIndex < 0) return { url: rest };
+    return { url: rest.slice(0, hashIndex), ...splitFragment(rest.slice(hashIndex + 1), source) };
+  }
+  throw new Error(`Invalid git source: ${source}`);
+}
+function formatGitSource(url, ref, subpath) {
+  return subpath ? `git:${url}#${ref}${SUBPATH_SEPARATOR}${subpath}` : `git:${url}#${ref}`;
+}
+function normalizeGitSubpath(subpath, source) {
+  if (subpath === void 0) return void 0;
+  if (subpath.includes("\\")) throw new Error(`Git source subpath must use forward slashes: ${source}`);
+  if (subpath.startsWith("/")) throw new Error(`Git source subpath must be relative to the repository: ${source}`);
+  const normalized = posix.normalize(subpath).replace(/\/+$/g, "");
+  if (normalized === "." || normalized === "") return void 0;
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new Error(`Git source subpath escapes the repository: ${source}`);
+  }
+  return normalized;
+}
+function resolveGitRelativeSubpath(declaringSubpath, relative12, source) {
+  const joined = posix.normalize(posix.join(declaringSubpath ?? ".", relative12));
+  if (joined === ".." || joined.startsWith("../")) {
+    throw new Error(`Relative dependency '${relative12}' escapes the git repository it is declared in: ${source}`);
+  }
+  return normalizeGitSubpath(joined, source);
+}
+function splitFragment(fragment, source) {
+  if (fragment === void 0) return {};
+  const separator = fragment.indexOf(SUBPATH_SEPARATOR);
+  if (separator < 0) return fragment ? { ref: fragment } : {};
+  const ref = fragment.slice(0, separator);
+  const subpath = normalizeGitSubpath(fragment.slice(separator + SUBPATH_SEPARATOR.length), source);
+  return { ...ref ? { ref } : {}, ...subpath ? { subpath } : {} };
+}
+
 // src/source/git.ts
 var execFileAsync = promisify(execFile);
 var GitSourceDriver = class {
@@ -4138,15 +4014,18 @@ var GitSourceDriver = class {
           return { path, leasePath };
         }
       );
-      const snapshotPath = snapshot.path;
-      const manifest = await readPackageManifest(snapshotPath);
+      const packageRoot = parsed.subpath ? join19(snapshot.path, parsed.subpath) : snapshot.path;
+      if (parsed.subpath && !await isDirectory(packageRoot)) {
+        throw new Error(`Git source subpath '${parsed.subpath}' does not exist at ${resolvedCommit} in ${parsed.url}`);
+      }
+      const manifest = await readPackageManifest(packageRoot);
       return {
         ...resolved,
-        resolvedPath: snapshotPath,
+        resolvedPath: packageRoot,
         packageName: manifest?.name,
         packageVersion: manifest?.version,
         resolvedCommit,
-        sourceHash: await hashPath(snapshotPath),
+        sourceHash: await hashPath(packageRoot),
         cacheLeasePath: snapshot.leasePath
       };
     }, "git cache");
@@ -4164,22 +4043,12 @@ var GitSourceDriver = class {
     return resolved;
   }
 };
-function parseGitSource(source) {
-  if (source.startsWith("github:")) {
-    const rest = source.slice("github:".length);
-    const [repo, ref] = rest.split("#", 2);
-    if (!repo.includes("/")) throw new Error(`Invalid GitHub source: ${source}`);
-    return { url: `https://github.com/${repo}.git`, ref };
-  }
-  if (source.startsWith("git:")) {
-    const rest = source.slice("git:".length);
-    const hashIndex = rest.lastIndexOf("#");
-    if (hashIndex >= 0) {
-      return { url: rest.slice(0, hashIndex), ref: rest.slice(hashIndex + 1) };
-    }
-    return { url: rest };
+async function isDirectory(path) {
+  try {
+    return (await stat4(path)).isDirectory();
+  } catch {
+    return false;
   }
-  throw new Error(`Invalid git source: ${source}`);
 }
 function cachePathFor2(url, cacheRoot) {
   const root = cacheRoot ? resolve5(cacheRoot) : join19(homedir2(), ".agentwheel", "cache");
@@ -5337,7 +5206,8 @@ function claudeAgentName(artifact) {
 
 // src/staging/staging.ts
 async function stageSource(driver, source, options = {}) {
-  return renderStagedBundle(await stageSourceRaw(driver, source, options), options);
+  const raw = await stageSourceRaw(driver, source, options);
+  return removeOnFailure(raw.root, () => renderStagedBundle(raw, options));
 }
 async function stageSourceRaw(driver, source, options = {}) {
   const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(source, options))));
@@ -5352,25 +5222,27 @@ async function stageResolvedSourceRaw(driver, resolved) {
   const artifacts = await driver.list(resolved);
   return stageResolvedArtifactsRaw(resolved, artifacts);
 }
-async function stageResolvedArtifactsRaw(resolved, artifacts) {
-  const root = await mkdtemp(join27(tmpdir2(), "agentwheel-stage-"));
+async function stageResolvedArtifactsRaw(resolved, artifacts, parentDir = tmpdir2()) {
+  const root = await mkdtemp(join27(parentDir, "agentwheel-stage-"));
   const stagedArtifacts = [];
-  for (const artifact of artifacts) {
-    const stagedPath = join27(root, artifact.relativePath);
-    await mkdir11(dirname13(stagedPath), { recursive: true });
-    await cp3(artifact.sourcePath, stagedPath, {
-      recursive: artifact.kind === "dir",
-      dereference: true,
-      filter: (path) => !isIgnoredGeneratedEntry(basename16(path))
-    });
-    await composeAssets(artifact, resolved.resolvedPath, stagedPath);
-    stagedArtifacts.push({
-      ...artifact,
-      stagedPath,
-      hash: await hashPath(stagedPath),
-      channel: artifact.channel ?? "managed"
-    });
-  }
+  await removeOnFailure(root, async () => {
+    for (const artifact of artifacts) {
+      const stagedPath = join27(root, artifact.relativePath);
+      await mkdir11(dirname13(stagedPath), { recursive: true });
+      await cp3(artifact.sourcePath, stagedPath, {
+        recursive: artifact.kind === "dir",
+        dereference: true,
+        filter: (path) => !isIgnoredGeneratedEntry(basename16(path))
+      });
+      await composeAssets(artifact, resolved.resolvedPath, stagedPath);
+      stagedArtifacts.push({
+        ...artifact,
+        stagedPath,
+        hash: await hashPath(stagedPath),
+        channel: artifact.channel ?? "managed"
+      });
+    }
+  });
   return {
     root,
     source: resolved,
@@ -5527,8 +5399,7 @@ import { dirname as dirname15, join as join30, relative as relative6 } from "pat
 
 // src/resolve/graph.ts
 import { createHash as createHash6 } from "crypto";
-import { mkdtemp as mkdtemp2, readdir as readdir7, readFile as readFile17, stat as stat11 } from "fs/promises";
-import { tmpdir as tmpdir3 } from "os";
+import { readdir as readdir7, readFile as readFile17, stat as stat11 } from "fs/promises";
 import { basename as basename17, extname as extname4, join as join29 } from "path";
 
 // src/model/workspace-composition.ts
@@ -5789,7 +5660,7 @@ var RegistryClient = class {
   }
 };
 async function resolvePackageSource(source, workspaceRoot, options = {}) {
-  const { isExplicitSource } = await import("./identify-O54QXPQR.js");
+  const { isExplicitSource } = await import("./identify-M6IA4RS7.js");
   if (await isExplicitSource(source)) return { source };
   const entry = await new RegistryClient({ workspaceRoot, offline: options.offline, warn: options.warn }).resolve(source);
   if (!entry) {
@@ -5831,6 +5702,17 @@ async function normalizeDependencySource(source, options) {
   if (isBareRegistryName(trimmed)) {
     return normalizeRegistrySource(trimmed, options);
   }
+  if (options.declaringGitSource && (trimmed === "." || trimmed === ".." || trimmed.startsWith("./") || trimmed.startsWith("../"))) {
+    const declaring = options.declaringGitSource;
+    const subpath = resolveGitRelativeSubpath(declaring.subpath, trimmed, source);
+    const normalizedSource = formatGitSource(declaring.url, declaring.commit, subpath);
+    return {
+      source: normalizedSource,
+      normalizedSource,
+      driver: "git",
+      requestedRef: declaring.commit
+    };
+  }
   if (isLocalSource(trimmed)) {
     const path = localSourcePath(trimmed);
     const resolvedPath = resolveLocalPath(path, options.declaringPackageRoot);
@@ -5841,10 +5723,10 @@ async function normalizeDependencySource(source, options) {
     };
   }
   if (trimmed.startsWith("github:") || trimmed.startsWith("git:")) {
-    const parsed = parseGitSource2(trimmed);
+    const parsed = parseGitSource(trimmed);
     const requestedRef = options.ref ?? parsed.ref ?? "HEAD";
     const url = normalizeGitRemoteUrl(parsed.url, options.declaringPackageRoot);
-    const normalizedSource = `git:${url}#${requestedRef}`;
+    const normalizedSource = formatGitSource(url, requestedRef, parsed.subpath);
     return {
       source: normalizedSource,
       normalizedSource,
@@ -5921,20 +5803,6 @@ async function normalizeRegistrySource(name, options) {
     normalizedSource: `registry:${name}:${resolved.normalizedSource}`
   };
 }
-function parseGitSource2(source) {
-  if (source.startsWith("github:")) {
-    const rest2 = source.slice("github:".length);
-    const [repo, ref] = rest2.split("#", 2);
-    if (!repo.includes("/")) throw new Error(`Invalid GitHub dependency source: ${source}`);
-    return { url: `https://github.com/${repo.replace(/\.git$/i, "")}.git`, ref };
-  }
-  const rest = source.slice("git:".length);
-  const hashIndex = rest.lastIndexOf("#");
-  if (hashIndex >= 0) {
-    return { url: rest.slice(0, hashIndex), ref: rest.slice(hashIndex + 1) };
-  }
-  return { url: rest };
-}
 function normalizeGitRemoteUrl(url, declaringPackageRoot) {
   if (url.startsWith("./") || url.startsWith("../") || url.startsWith("/") || url === "~" || url.startsWith("~/")) {
     return resolveLocalPath(url, declaringPackageRoot);
@@ -5985,8 +5853,7 @@ var SnapshotConflictError = class extends Error {
 };
 var cacheLocks = /* @__PURE__ */ new Map();
 async function resolveDependencyGraph(roots, options) {
-  if (roots.length === 0) throw new Error("At least one graph root is required.");
-  const graphRoot = await mkdtemp2(join29(tmpdir3(), "agentwheel-graph-"));
+  if (roots.length === 0 && !options.allowEmptyRoots) throw new Error("At least one graph root is required.");
   const fetchCache = /* @__PURE__ */ new Map();
   const nodesByKey = /* @__PURE__ */ new Map();
   const nodesBySource = /* @__PURE__ */ new Map();
@@ -6052,7 +5919,6 @@ async function resolveDependencyGraph(roots, options) {
   }
   detectDirectCollisions(rawNodes);
   return {
-    root: graphRoot,
     roots: rootResults.sort((a, b) => a.rootId.localeCompare(b.rootId)),
     nodes: rawNodes.map((state) => state.node),
     rawNodes,
@@ -6094,6 +5960,7 @@ async function processRequirement(requirement, options, fetchCache, nodesByKey,
     let lockedByReference = lockedNodeForRequirementReference(requirement, options, lockLabel);
     let normalized = lockedByReference ? normalizedSourceFromLockedNode(lockedByReference.node) : await normalizeDependencySource(requirement.source, {
       declaringPackageRoot: requirement.declaringPackageRoot,
+      declaringGitSource: requirement.declaringGitSource,
       workspaceRoot: options.workspaceRoot,
       ref: requirement.ref,
       registryClient: options.registryClient
@@ -6101,6 +5968,7 @@ async function processRequirement(requirement, options, fetchCache, nodesByKey,
     if (lockedByReference && shouldCheckLockedRootSource(requirement)) {
       const declared = await normalizeDependencySource(requirement.source, {
         declaringPackageRoot: requirement.declaringPackageRoot,
+        declaringGitSource: requirement.declaringGitSource,
         workspaceRoot: options.workspaceRoot,
         ref: requirement.ref,
         registryClient: options.registryClient
@@ -6378,6 +6246,7 @@ function dependencyRequirement(state, fetched, alias, dependency, select, chain,
     useLock: dependency.mode !== "tracking" || options.lockedResolution === true && !updateClosure,
     updateClosure,
     declaringPackageRoot: fetched.resolved.resolvedPath,
+    declaringGitSource: declaringGitSource(fetched),
     requiredBy: state.node.id,
     alias,
     parentId: state.node.id,
@@ -6885,6 +6754,15 @@ async function mapLimit(items, limit, fn) {
   if (failure !== void 0) throw failure;
   return out;
 }
+function declaringGitSource(fetched) {
+  if (fetched.resolved.driver !== "git" || !fetched.resolved.resolvedCommit) return void 0;
+  const parsed = parseGitSource(fetched.resolved.source);
+  return {
+    url: normalizeGitRemoteUrl(parsed.url, fetched.resolved.resolvedPath),
+    commit: fetched.resolved.resolvedCommit,
+    subpath: parsed.subpath
+  };
+}
 
 // src/lifecycle/customization.ts
 async function remember(workspaceRoot, runtime, text) {
@@ -7039,7 +6917,7 @@ import { rm as rm7 } from "fs/promises";
 // src/lifecycle/source-plan.ts
 import { createHash as createHash8 } from "crypto";
 import { mkdir as mkdir14, readdir as readdir9 } from "fs/promises";
-import { basename as basename18, dirname as dirname17, join as join33, posix as posix2, resolve as resolve16 } from "path";
+import { basename as basename18, dirname as dirname17, join as join33, posix as posix3, resolve as resolve16 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
@@ -7202,11 +7080,14 @@ function formatSelectionImport(root) {
 
 // src/resolve/render.ts
 import { createHash as createHash7 } from "crypto";
-import { readFile as readFile18, mkdtemp as mkdtemp3 } from "fs/promises";
-import { tmpdir as tmpdir4 } from "os";
+import { readFile as readFile18, mkdtemp as mkdtemp2 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
 import { join as join31 } from "path";
 async function renderGraphForTarget(graph, targetContext = {}) {
-  const root = await mkdtemp3(join31(tmpdir4(), "agentwheel-render-"));
+  const root = await mkdtemp2(join31(tmpdir3(), "agentwheel-render-"));
+  return removeOnFailure(root, () => renderGraphIntoRoot(root, graph, targetContext));
+}
+async function renderGraphIntoRoot(root, graph, targetContext) {
   const artifacts = [];
   const stagedNodes = /* @__PURE__ */ new Map();
   const includeEdges = /* @__PURE__ */ new Map();
@@ -7214,7 +7095,7 @@ async function renderGraphForTarget(graph, targetContext = {}) {
   for (const rawNode of graph.rawNodes) {
     const ownsCompositionRules = rawNode.depth === 0 && rawNode.manifest?.schemaVersion === 3 && Boolean(rawNode.manifest.compositionRules?.length);
     if (rawNode.node.selected.length === 0 && !ownsCompositionRules) continue;
-    const rawBundle = await stageResolvedArtifactsRaw(rawNode.resolved, rawNode.artifacts);
+    const rawBundle = await stageResolvedArtifactsRaw(rawNode.resolved, rawNode.artifacts, root);
     const fragmentCustomized = targetContext.workspaceRoot && targetContext.adapter ? await applyFragmentCustomizations(rawBundle.artifacts, {
       workspaceRoot: targetContext.workspaceRoot,
       adapter: targetContext.adapter,
@@ -8081,7 +7962,7 @@ function containsPath(parent, candidate) {
 }
 
 // src/model/target-state.ts
-import { posix, resolve as resolve15 } from "path";
+import { posix as posix2, resolve as resolve15 } from "path";
 var targetEvolutionFields = /* @__PURE__ */ new Set([
   "adapterCodeHash",
   "adapterConfig",
@@ -8114,7 +7995,7 @@ function persistentTargetParts(value) {
   );
 }
 function normalizeInstallRoot(path, transportKind) {
-  return transportKind === "ssh" ? posix.normalize(path) : resolve15(path);
+  return transportKind === "ssh" ? posix2.normalize(path) : resolve15(path);
 }
 function targetEndpoint(value, transportKind) {
   if (transportKind !== "ssh") return { kind: "local" };
@@ -8139,7 +8020,7 @@ function targetEndpoint(value, transportKind) {
 
 // src/lifecycle/source-plan.ts
 async function createGraphSourcePlan(options) {
-  if (options.roots.length === 0) {
+  if (options.roots.length === 0 && !options.allowEmptyRoots) {
     throw new Error("At least one source is required for a graph plan.");
   }
   if (options.freshGraphOnly && options.readOnly !== true) {
@@ -8255,7 +8136,8 @@ async function createGraphSourcePlan(options) {
     offline: options.offline,
     previousLock,
     warn,
-    runtime: options.adapter.name
+    runtime: options.adapter.name,
+    allowEmptyRoots: options.allowEmptyRoots
   });
   assertFrozenGraph(previousLock, graph, lockMode, lockLabel);
   assertTrustArtifactPolicy(graph, trustPolicy);
@@ -8271,85 +8153,97 @@ async function createGraphSourcePlan(options) {
     noDeps: options.noDeps,
     warn
   });
-  const desiredArtifacts = filterArtifactsByAdapterTargets(
-    desiredArtifactsFromGraphBundle(bundle),
-    options.adapter,
-    installationType,
-    { warn }
-  );
-  const resolvedInstallationType = resolveInstallationTypeForArtifacts(options.adapter, desiredArtifacts.map((artifact) => artifact.type), installationType);
-  const resolvedInstallRoot = installRootForArtifacts(options.adapter, options.targetRoot, resolvedInstallationType, desiredArtifacts.map((artifact) => artifact.type), transport.kind === "ssh");
-  const graphLockDigest = digestGraphLock(bundle.graphLock);
-  const graphDiff = diffGraphLocks(previousLock, bundle.graphLock);
-  if (normalizeInstallRoot2(resolvedInstallRoot, transport.kind) !== normalizeInstallRoot2(installRoot, transport.kind)) {
-    throw new Error(
-      `Adapter ${options.adapter.name} resolved a different install root after rendering; target state identity cannot be proven.`
+  return removeOnFailure(bundle.root, async () => {
+    const desiredArtifacts = filterArtifactsByAdapterTargets(
+      desiredArtifactsFromGraphBundle(bundle),
+      options.adapter,
+      installationType,
+      { warn }
     );
-  }
-  const manifest = priorState.manifest;
-  const basePlan = options.retireExactMcp ? await createExactMcpRetirementPlan(
-    desiredArtifacts,
-    options.adapter,
-    options.targetRoot,
-    manifest,
-    transport,
-    {
-      installationType: resolvedInstallationType,
-      stateKey,
-      workspaceOwner,
-      expectedFromWorkspaceOwner: options.expectedFromWorkspaceOwner,
-      graphLockDigest
+    const resolvedInstallationType = resolveInstallationTypeForArtifacts(options.adapter, desiredArtifacts.map((artifact) => artifact.type), installationType);
+    const resolvedInstallRoot = installRootForArtifacts(options.adapter, options.targetRoot, resolvedInstallationType, desiredArtifacts.map((artifact) => artifact.type), transport.kind === "ssh");
+    const graphLockDigest = digestGraphLock(bundle.graphLock);
+    const graphDiff = diffGraphLocks(previousLock, bundle.graphLock);
+    if (normalizeInstallRoot2(resolvedInstallRoot, transport.kind) !== normalizeInstallRoot2(installRoot, transport.kind)) {
+      throw new Error(
+        `Adapter ${options.adapter.name} resolved a different install root after rendering; target state identity cannot be proven.`
+      );
     }
-  ) : await createCombinedInstallPlan(desiredArtifacts, options.adapter, options.targetRoot, manifest, transport, {
-    baseRevision: manifest?.revision ?? null,
-    graphLockDigest,
-    workspaceOwner,
-    installationType: resolvedInstallationType,
-    stateKey,
-    forceDrift: options.forceDrift,
-    forceConflict: options.forceConflict,
-    replaceConflict: options.replaceConflict,
-    stateMigration: priorState.migration,
-    warn
-  });
-  const plan = priorState.migration && !basePlan.stateMigration ? { ...basePlan, stateMigration: priorState.migration } : basePlan;
-  plan.targetStateFilePreconditions = {
-    graphLockPath,
-    graphLockRevision: stableLock ? digestGraphLock(stableLock) : null,
-    sourceLockRevision: computeSourceLockRevision(stableSourceLock)
-  };
-  let foreignStateObservations = [];
-  if (options.forceForeignState !== true && options.deferForeignStateCheck !== true) {
-    foreignStateObservations = await assertNoForeignWorkspaceState({
-      installRoot: resolvedInstallRoot,
-      adapter: options.adapter.name,
+    const manifest = priorState.manifest;
+    const basePlan = options.retireExactMcp ? await createExactMcpRetirementPlan(
+      desiredArtifacts,
+      options.adapter,
+      options.targetRoot,
+      manifest,
       transport,
-      workspaceRoot,
+      {
+        installationType: resolvedInstallationType,
+        stateKey,
+        workspaceOwner,
+        expectedFromWorkspaceOwner: options.expectedFromWorkspaceOwner,
+        graphLockDigest
+      }
+    ) : await createCombinedInstallPlan(desiredArtifacts, options.adapter, options.targetRoot, manifest, transport, {
+      baseRevision: manifest?.revision ?? null,
+      graphLockDigest,
       workspaceOwner,
-      globalRoot: options.globalRoot,
+      installationType: resolvedInstallationType,
       stateKey,
-      migratingStateKey: priorState.migration?.fromStateKey,
-      plannedPaths: plan.operations.map((operation) => operation.relativeDestPath),
-      plannedOperations: plan.operations
+      forceDrift: options.forceDrift,
+      forceConflict: options.forceConflict,
+      replaceConflict: options.replaceConflict,
+      stateMigration: priorState.migration,
+      warn
     });
-    plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
-  }
-  return {
-    plan,
-    graph,
-    bundle,
-    desiredArtifacts,
-    graphLockPath,
-    graphLockDigest,
-    targetFingerprint,
-    warnings,
-    newTransitiveSources: trustEvaluation.promptSources,
-    graphDiff,
-    recoveredPendingApply,
-    previousManifest: priorState.manifest,
-    previousGraphLock: priorState.graphLock,
-    foreignStateObservations
-  };
+    const plan = priorState.migration && !basePlan.stateMigration ? { ...basePlan, stateMigration: priorState.migration } : basePlan;
+    if (options.excludedRootIds?.length && previousLock) {
+      const excludedRoots = new Set(options.excludedRootIds);
+      const excludedNodeIds = new Set(previousLock.canonical.roots.filter((root) => excludedRoots.has(root.rootId)).map((root) => root.graphNodeId));
+      for (const operation of plan.operations) {
+        const excludedOwner = operation.owners?.length && operation.owners.every((owner) => excludedRoots.has(owner));
+        if (operation.action === "remove" && (excludedOwner || operation.graphNodeId && excludedNodeIds.has(operation.graphNodeId))) {
+          operation.reason = "excluded by package runtimes";
+        }
+      }
+    }
+    plan.targetStateFilePreconditions = {
+      graphLockPath,
+      graphLockRevision: stableLock ? digestGraphLock(stableLock) : null,
+      sourceLockRevision: computeSourceLockRevision(stableSourceLock)
+    };
+    let foreignStateObservations = [];
+    if (options.forceForeignState !== true && options.deferForeignStateCheck !== true) {
+      foreignStateObservations = await assertNoForeignWorkspaceState({
+        installRoot: resolvedInstallRoot,
+        adapter: options.adapter.name,
+        transport,
+        workspaceRoot,
+        workspaceOwner,
+        globalRoot: options.globalRoot,
+        stateKey,
+        migratingStateKey: priorState.migration?.fromStateKey,
+        plannedPaths: plan.operations.map((operation) => operation.relativeDestPath),
+        plannedOperations: plan.operations
+      });
+      plan.hasBlockingChanges = plan.operations.some((operation) => operation.action === "drift" || operation.action === "conflict");
+    }
+    return {
+      plan,
+      graph,
+      bundle,
+      desiredArtifacts,
+      graphLockPath,
+      graphLockDigest,
+      targetFingerprint,
+      warnings,
+      newTransitiveSources: trustEvaluation.promptSources,
+      graphDiff,
+      recoveredPendingApply,
+      previousManifest: priorState.manifest,
+      previousGraphLock: priorState.graphLock,
+      foreignStateObservations
+    };
+  });
 }
 async function assertNoForeignWorkspaceStateForPlan(plan, options) {
   if (!plan.stateKey) throw new Error(`Foreign-state validation requires a state key for ${plan.adapter}.`);
@@ -8708,7 +8602,7 @@ function stableJson2(value) {
   return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort((left, right) => left.localeCompare(right)).map((key) => `${JSON.stringify(key)}:${stableJson2(record[key])}`).join(",")}}`;
 }
 function normalizeInstallRoot2(path, transportKind) {
-  return transportKind === "ssh" ? posix2.normalize(path) : resolve16(path);
+  return transportKind === "ssh" ? posix3.normalize(path) : resolve16(path);
 }
 var workspaceOwnerPrefix2 = "workspace-root:";
 async function assertNoForeignWorkspaceState(check) {
@@ -9196,8 +9090,17 @@ async function syncProfile(options) {
   if (selected && packages.some((pkg) => pkg.selection)) {
     throw new Error("--select/--skill cannot be combined with a package selection import.");
   }
+  if (!options.source) {
+    const adapters = new Set(profile.runtimes.map((runtime) => resolveProfileRuntimeTarget(runtime, config, options.workspaceRoot, options.installationType, options.fleetId).adapter));
+    for (const pkg of packages) {
+      if (pkg.runtimes && !pkg.runtimes.some((runtime) => adapters.has(runtime))) {
+        options.warn?.(`Package '${pkg.name}' matches no runtime in profile '${options.profile}'.`);
+      }
+    }
+  }
   for (const runtime of profile.runtimes) {
     const target = resolveProfileRuntimeTarget(runtime, config, options.workspaceRoot, options.installationType, options.fleetId);
+    const runtimePackages = options.source ? packages : packagesForTarget(packages, target);
     const transport = transportForTarget(target);
     const adapter = await resolveAdapter({
       adapter: target.adapter,
@@ -9210,7 +9113,7 @@ async function syncProfile(options) {
     const installationType = target.installationType ?? defaultInstallationType;
     resolveInstallationTypeForAdapter(adapter, installationType);
     const graphPlan = await createGraphSourcePlan({
-      roots: packages.map((pkg) => ({
+      roots: runtimePackages.map((pkg) => ({
         rootId: pkg.name,
         source: pkg.source,
         mode: options.mode ?? pkg.mode,
@@ -9259,14 +9162,16 @@ async function syncProfile(options) {
       forceConflict: options.forceConflict,
       forceForeignState: options.forceForeignState,
       replaceConflict: options.replaceConflict,
-      recoverLegacyState: options.recoverLegacyState
+      recoverLegacyState: options.recoverLegacyState,
+      allowEmptyRoots: runtimePackages.length === 0,
+      excludedRootIds: options.source ? [] : packages.filter((pkg) => !runtimePackages.includes(pkg)).map((pkg) => pkg.name)
     });
     try {
       const result = {
         runtime: adapter.name,
         targetRoot: installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, transport.kind === "ssh"),
         transport: transport.kind,
-        packageName: packages.map((pkg) => pkg.name).join(","),
+        packageName: runtimePackages.map((pkg) => pkg.name).join(",") || "(no packages)",
         plan: graphPlan.plan,
         graphPlan,
         graphLockDigest: graphPlan.graphLockDigest,
@@ -9785,6 +9690,7 @@ function resolveCliVersion() {
 
 // src/lifecycle/ownership.ts
 import { resolve as resolve20 } from "path";
+var unknownWorkspaceOwner = "workspace:unknown";
 async function planArtifactOwnershipHandoff(request) {
   return validateOwnershipHandoff(request, request.transport ?? localTransport);
 }
@@ -9803,6 +9709,9 @@ async function applyArtifactOwnershipHandoff(request) {
       throw new Error("Cannot hand off ownership while an apply journal is pending. Recover or abort it first.");
     }
     const plan = await validateOwnershipHandoff(request, transport);
+    if (plan.drifted && !request.expectedRuntimeHash) {
+      throw new Error("Applying a drifted ownership handoff requires expectedRuntimeHash from a reviewed dry-run.");
+    }
     const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, scope);
     if (!manifest || manifest.version !== 2) {
       throw new Error("Ownership handoff requires an Agentwheel v2 install manifest.");
@@ -9833,6 +9742,13 @@ async function applyArtifactOwnershipHandoff(request) {
 async function validateOwnershipHandoff(request, transport) {
   if (request.expectedHash) assertSha256(request.expectedHash, "expected artifact hash");
   if (request.expectedRevision) assertSha256(request.expectedRevision, "expected manifest revision");
+  if (request.expectedRuntimeHash) {
+    assertSha256(request.expectedRuntimeHash, "expected runtime hash");
+    if (request.carryDrift !== true) throw new Error("An expected runtime hash is only valid with carryDrift.");
+  }
+  if (request.fromWorkspaceRoot === void 0 === (request.fromUnknownOwner !== true)) {
+    throw new Error("Ownership handoff requires exactly one of fromWorkspaceRoot or fromUnknownOwner.");
+  }
   const scope = { installationType: request.installationType, stateKey: request.stateKey };
   const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, scope);
   if (!manifest) throw new Error(`No install manifest for ${request.adapter} at ${request.targetRoot}`);
@@ -9850,7 +9766,7 @@ async function validateOwnershipHandoff(request, transport) {
     );
   }
   const entry = matches[0];
-  const fromOwner = workspaceOwnerForRoot(request.fromWorkspaceRoot);
+  const fromOwner = request.fromUnknownOwner === true ? unknownWorkspaceOwner : workspaceOwnerForRoot(request.fromWorkspaceRoot);
   const toOwner = workspaceOwnerForRoot(request.toWorkspaceRoot, request.toFleetId);
   if (fromOwner === toOwner) throw new Error("Ownership handoff requires different workspace roots.");
   if (entry.workspaceOwner !== fromOwner) {
@@ -9861,9 +9777,14 @@ async function validateOwnershipHandoff(request, transport) {
   }
   const destPath = containedArtifactPath(request.targetRoot, entry.path);
   if (!await transport.pathExists(destPath)) throw new Error(`Managed artifact is missing: ${entry.path}`);
-  const currentHash = await verifiedEntryHash(entry, destPath, transport);
-  if (request.expectedHash && currentHash !== request.expectedHash) {
-    throw new Error(`Current hash precondition failed for ${entry.path}: expected ${request.expectedHash}, found ${currentHash}`);
+  const runtimeHash = await verifiedEntryHash(entry, destPath, transport, request.carryDrift === true);
+  const drifted = runtimeHash !== entry.hash;
+  if (drifted) {
+    if (request.expectedRuntimeHash && runtimeHash !== request.expectedRuntimeHash) {
+      throw new Error(`Runtime hash precondition failed for ${entry.path}: expected ${request.expectedRuntimeHash}, found ${runtimeHash}`);
+    }
+  } else if (request.expectedRuntimeHash) {
+    throw new Error(`Runtime hash precondition failed for ${entry.path}: the artifact is no longer drifted`);
   }
   return {
     adapter: request.adapter,
@@ -9872,13 +9793,15 @@ async function validateOwnershipHandoff(request, transport) {
     targetRoot: request.targetRoot,
     selector: `${request.artifactType}/${request.artifactName}`,
     path: entry.path,
-    artifactHash: currentHash,
+    artifactHash: entry.hash,
+    runtimeHash,
+    drifted,
     manifestRevision: manifest.revision,
     fromOwner,
     toOwner
   };
 }
-async function verifiedEntryHash(entry, destPath, transport) {
+async function verifiedEntryHash(entry, destPath, transport, carryFileDrift = false) {
   if (entry.semanticPlugin) throw new Error(`Ownership handoff cannot verify semantic plugin state at ${destPath}`);
   if (entry.mode === "managed-block") {
     const selector = managedInstructionSelector(entry.logicalSelector, entry.artifactType, entry.artifactName);
@@ -9896,7 +9819,7 @@ async function verifiedEntryHash(entry, destPath, transport) {
     return entry.hash;
   }
   const currentHash = await transport.hashPath(destPath);
-  if (currentHash !== entry.hash) {
+  if (currentHash !== entry.hash && !carryFileDrift) {
     throw new Error(`Managed artifact is drifted at ${destPath}: manifest ${entry.hash}, current ${currentHash}`);
   }
   return currentHash;
@@ -10226,7 +10149,7 @@ import { isAbsolute as isAbsolute3, relative as relative9, resolve as resolve23
 // src/lifecycle/legacy-recovery-plan.ts
 import { createHash as createHash10 } from "crypto";
 import { lstat as lstat3, readdir as readdir10 } from "fs/promises";
-import { basename as basename20, dirname as dirname21, join as join39, posix as posix3, relative as relative8, resolve as resolve22 } from "path";
+import { basename as basename20, dirname as dirname21, join as join39, posix as posix4, relative as relative8, resolve as resolve22 } from "path";
 async function inventoryHistoricalLocks(fleetRoot) {
   const root = join39(fleetRoot, ".agentwheel", "locks");
   const found = [];
@@ -10384,7 +10307,7 @@ function claimFor(item, entry, locks, binding) {
   const matches = locks.filter((candidate) => candidate.digest === digest2);
   const evidence = [];
   const owner = "workspaceOwner" in entry ? entry.workspaceOwner : legacyUnownedWorkspaceOwner;
-  const sameRoot = binding.transportKind === "ssh" ? posix3.normalize(item.manifest.targetRoot) === posix3.normalize(binding.installRoot) : resolve22(item.manifest.targetRoot) === resolve22(binding.installRoot);
+  const sameRoot = binding.transportKind === "ssh" ? posix4.normalize(item.manifest.targetRoot) === posix4.normalize(binding.installRoot) : resolve22(item.manifest.targetRoot) === resolve22(binding.installRoot);
   const inTargetDir = matches.filter((candidate) => resolve22(dirname21(candidate.path)) === resolve22(binding.targetLockDir));
   const boundLocks = inTargetDir.filter((candidate) => lockBindsState(candidate, item, binding));
   if (owner !== binding.expectedOwner) evidence.push("workspace owner differs from selected Fleet target");
@@ -12390,7 +12313,7 @@ async function planFleetNormalization(request) {
     const destinationDeclaration = canonicalJson2(destinationPackage);
     if (sourceDeclaration !== destinationDeclaration) {
       throw new Error(
-        `Package '${name}' has divergent declarations. Source, driver, adapter, adapter configuration, installation type, version policy, selections, aliases, overrides, and suggestions must match before normalization.`
+        `Package '${name}' has divergent declarations. Source, driver, adapter, adapter configuration, installation type, version policy, runtime restrictions, selections, aliases, overrides, and suggestions must match before normalization.`
       );
     }
     packages.push({ name, declarationDigest: sha2565(sourceDeclaration) });
@@ -14355,10 +14278,13 @@ program.command("remember").description("append text to the local instructions o
   console.log(nextInstallNudge());
 });
 var ownershipCommand = program.command("ownership").description("inspect and transfer manifest ownership without rewriting runtime artifacts");
-ownershipCommand.command("handoff").description("transfer one managed artifact between Agentwheel workspace roots").argument("<selector>", "exact artifact selector in type/name form").requiredOption("--from-workspace-root <path>", "current owning workspace root").requiredOption("--to-workspace-root <path>", "new owning workspace root").option("--to-fleet <id>", "qualify the new owner with a registered fleet id").option("--expected-hash <sha256>", "expected current artifact hash; required when applying").option("--expected-revision <sha256>", "expected install manifest revision; required when applying").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--profile <name>", "workspace runtime profile (must resolve to one target)").option("--dry-run", "validate all preconditions without writing the manifest", false).action(async (selector, options) => {
+ownershipCommand.command("handoff").description("transfer one managed artifact between Agentwheel workspace roots").argument("<selector>", "exact artifact selector in type/name form").option("--from-workspace-root <path>", "current owning workspace root").option("--from-unknown-owner", "hand off an artifact recorded as workspace:unknown", false).requiredOption("--to-workspace-root <path>", "new owning workspace root").option("--to-fleet <id>", "qualify the new owner with a registered fleet id").option("--expected-hash <sha256>", "expected recorded artifact hash; required when applying").option("--expected-revision <sha256>", "expected install manifest revision; required when applying").option("--carry-drift", "accept a file or directory whose runtime differs from the recorded hash; the recorded hash is kept", false).option("--expected-runtime-hash <sha256>", "expected drifted runtime hash; required when applying with --carry-drift").option("--adapter <adapter>", "built-in adapter").option("-i, --installation-type <type>", "installation type (for example local or user)").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("-t, --target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--profile <name>", "workspace runtime profile (must resolve to one target)").option("--dry-run", "validate all preconditions without writing the manifest", false).action(async (selector, options) => {
   if (!options.dryRun && (!options.expectedHash || !options.expectedRevision)) {
     throw new Error("Applying an ownership handoff requires --expected-hash and --expected-revision from a reviewed --dry-run.");
   }
+  if (Boolean(options.fromWorkspaceRoot) === (options.fromUnknownOwner === true)) {
+    throw new Error("Ownership handoff requires exactly one of --from-workspace-root or --from-unknown-owner.");
+  }
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const targets = await resolveCliTargets(normalizedOptions);
   if (targets.length !== 1) {
@@ -14390,11 +14316,13 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
     adapter: adapter.name,
     artifactType,
     artifactName,
-    fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot),
+    ...options.fromUnknownOwner === true ? { fromUnknownOwner: true } : { fromWorkspaceRoot: normalizeCliPath(options.fromWorkspaceRoot) },
     toWorkspaceRoot,
     toFleetId: options.toFleet,
     expectedHash: options.expectedHash,
     expectedRevision: options.expectedRevision,
+    carryDrift: options.carryDrift === true,
+    expectedRuntimeHash: options.expectedRuntimeHash,
     transport: transportForTarget(target)
   };
   const result = options.dryRun ? await planArtifactOwnershipHandoff(request) : await applyArtifactOwnershipHandoff(request);
@@ -14402,6 +14330,7 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   console.log(`Target: ${result.adapter}/${result.installationType ?? "default"} at ${result.targetRoot}`);
   console.log(`Path: ${result.path}`);
   console.log(`Hash: ${result.artifactHash}`);
+  if (result.drifted) console.log(`Runtime hash: ${result.runtimeHash} (drift carried; the recorded hash is kept)`);
   console.log(`Manifest revision: ${result.manifestRevision}`);
   console.log(`Owner: ${result.fromOwner} -> ${result.toOwner}`);
 });
@@ -14420,8 +14349,9 @@ ownershipCommand.command("recovery-plan").description("write a read-only per-pat
   }
   const installationType = target.installationType ?? resolveInstallationTypeForAdapter(adapter, void 0);
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
-  if (config.packages.length === 0) throw new Error("Fleet has no configured source packages.");
-  await withFreshReadOnlyGraphPlan(target, adapter, adapterOptionsForTarget(target, {}), installationType, config.packages, async (graphPlan) => {
+  const targetPackages = packagesForCliTarget(config.packages, target, {});
+  if (targetPackages.length === 0) throw new Error("Fleet target has no configured source packages.");
+  await withFreshReadOnlyGraphPlan(target, adapter, adapterOptionsForTarget(target, {}), installationType, targetPackages, async (graphPlan) => {
     const installRoot = installRootForAdapterInstallationType(adapter, target.targetRoot, installationType, transport.kind === "ssh");
     const report = await planLegacyRecovery({
       graphPlan,
@@ -14548,7 +14478,7 @@ ownershipCommand.command("adopt-legacy").description("move proven legacy-keyed o
   if (target.transport === "ssh") throw new Error("Legacy ownership adoption does not support SSH targets.");
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
   const groups = /* @__PURE__ */ new Map();
-  for (const pkg of config.packages) graphGroupForPackage(groups, target, pkg, plainInstallOptions).packages.push(pkg);
+  for (const pkg of packagesForCliTarget(config.packages, target, plainInstallOptions)) graphGroupForPackage(groups, target, pkg, plainInstallOptions).packages.push(pkg);
   if (groups.size === 0) throw new Error(`No configured source packages in ${target.workspaceRoot}.`);
   const installationTypes = [...new Set([...groups.values()].map((candidate) => candidate.installationType))];
   if (installationTypes.length > 1) {
@@ -14890,7 +14820,7 @@ async function runInstallCommand(nameOrSource, options, behavior) {
   for (const target of targets) {
     const targetOptions = optionsForResolvedTarget(normalizedOptions, target);
     const config = await readMergedWorkspaceConfig(target.workspaceRoot);
-    const configured = nameOrSource ? findConfiguredPackageForTarget(config.packages, nameOrSource, targetOptions, target) : void 0;
+    const configured = nameOrSource ? findConfiguredPackageForTarget(packagesForCliTarget(config.packages, target, targetOptions), nameOrSource, targetOptions, target) : void 0;
     let source;
     let scope = configured?.name;
     let extraPackage;
@@ -14911,30 +14841,34 @@ async function runInstallCommand(nameOrSource, options, behavior) {
         throw teachingInstallError(nameOrSource, error);
       }
     }
-    for (const result of await buildGraphPlansForTarget(target, source, { ...targetOptions, scope, extraPackage, reportFormat: outputFormat }, { mode: "install" })) {
-      if (!behavior.quiet) console.log(formatGraphPlan(result));
-      if (behavior.apply) {
-        declareMutationPath(result.graphLockPath);
-        if (extraPackage && !targetOptions.onlySource) declareMutationPath(workspaceConfigPath(target.workspaceRoot));
-        const transport = transportForTarget(target);
-        const executePlugins = target.executePlugins ?? targetOptions.executePlugins;
-        await applyCombinedInstallPlan(result.plan, {
-          executePlugins,
-          transport,
-          graphLockDigest: result.graphLockDigest,
-          graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
-        });
-        const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
-          enabled: target.reloadRuntimes ?? shouldReloadRuntimes(targetOptions),
-          executePlugins
-        });
-        if (!behavior.quiet) {
-          console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
-          if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+    const results = await buildGraphPlansForTarget(target, source, { ...targetOptions, scope, extraPackage, reportFormat: outputFormat }, { mode: "install" });
+    try {
+      for (const result of results) {
+        if (!behavior.quiet) console.log(formatGraphPlan(result));
+        if (behavior.apply) {
+          declareMutationPath(result.graphLockPath);
+          if (extraPackage && !targetOptions.onlySource) declareMutationPath(workspaceConfigPath(target.workspaceRoot));
+          const transport = transportForTarget(target);
+          const executePlugins = target.executePlugins ?? targetOptions.executePlugins;
+          await applyCombinedInstallPlan(result.plan, {
+            executePlugins,
+            transport,
+            graphLockDigest: result.graphLockDigest,
+            graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
+          });
+          const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
+            enabled: target.reloadRuntimes ?? shouldReloadRuntimes(targetOptions),
+            executePlugins
+          });
+          if (!behavior.quiet) {
+            console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
+            if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+          }
         }
+        if (result.plan.hasBlockingChanges) process.exitCode = 1;
       }
-      await rm10(result.bundle.root, { recursive: true, force: true });
-      if (result.plan.hasBlockingChanges) process.exitCode = 1;
+    } finally {
+      await Promise.all(results.map((result) => rm10(result.bundle.root, { recursive: true, force: true })));
     }
     if (behavior.apply && extraPackage && !targetOptions.onlySource) {
       await writeWorkspaceConfig(target.workspaceRoot, upsertPackage(await readWorkspaceConfig(target.workspaceRoot), extraPackage));
@@ -14977,11 +14911,11 @@ async function buildPlanReport(nameOrSource, options) {
       yes: normalizedOptions.yes,
       trustPatterns: normalizedOptions.trust ?? [],
       readOnly: true,
-      isTTY: false
+      isTTY: false,
+      warn: collectWarning
     });
     for (const result of results) {
       reportTargets.push(installPlanReportTarget(result.plan, result.graphLockDigest));
-      reportWarnings.push(...result.warnings);
     }
     return planReport(reportTargets, reportWarnings);
   }
@@ -14989,7 +14923,7 @@ async function buildPlanReport(nameOrSource, options) {
   for (const target of targets) {
     const targetOptions = optionsForResolvedTarget(normalizedOptions, target);
     const config = await readMergedWorkspaceConfig(target.workspaceRoot);
-    const configured = nameOrSource ? findConfiguredPackageForTarget(config.packages, nameOrSource, targetOptions, target) : void 0;
+    const configured = nameOrSource ? findConfiguredPackageForTarget(packagesForCliTarget(config.packages, target, targetOptions), nameOrSource, targetOptions, target) : void 0;
     let source;
     let scope = configured?.name;
     let extraPackage;
@@ -15219,13 +15153,13 @@ async function resolveCliTargets(options, behavior = {}) {
   if (normalizedOptions.profile && (normalizedOptions.all || normalizedOptions.allDetected || normalizedOptions.agent)) {
     throw new Error("--profile cannot be combined with --all, --all-detected, or --agent.");
   }
-  const adapters2 = adapterListFromOption(normalizedOptions.adapter);
-  if (adapters2.length > 1) {
+  const adapters = adapterListFromOption(normalizedOptions.adapter);
+  if (adapters.length > 1) {
     if (normalizedOptions.all || normalizedOptions.allDetected || normalizedOptions.agent || normalizedOptions.profile) {
       throw new Error("--adapter <a,b> cannot be combined with --all, --all-detected, --agent, or --profile. Use a profile for mixed configured targets.");
     }
     const targets = [];
-    for (const adapter of adapters2) {
+    for (const adapter of adapters) {
       targets.push(await resolveRuntimeTarget({
         cwd: scopeRoot,
         targetRoot: normalizedOptions.targetRoot,
@@ -15371,7 +15305,7 @@ async function runSkillUpdateCommand(skillName, options) {
   const targets = await resolveCliTargets(normalizedOptions, { preferAllProfile: true });
   for (const target of targets) {
     const config = await readMergedWorkspaceConfig(target.workspaceRoot);
-    const owner = await configuredPackageForSkill(target, config.packages, skillName, normalizedOptions, options.package);
+    const owner = await configuredPackageForSkill(target, packagesForCliTarget(config.packages, target, normalizedOptions), skillName, normalizedOptions, options.package);
     const mode = owner.mode === "tracking" ? "update" : "install";
     console.log(`Skill ${skillName}: ${owner.name} (${mode}).`);
     await runConfiguredGraphPackages(target, {
@@ -15385,49 +15319,67 @@ async function runSkillUpdateCommand(skillName, options) {
 }
 async function runConfiguredGraphPackages(target, options, behavior) {
   const results = await buildGraphPlansForTarget(target, void 0, options, behavior);
-  for (const result of results) {
-    console.log(`${behavior.mode === "update" ? "Update" : "Install"} ${result.plan.adapter} at ${result.plan.targetRoot}:`);
-    console.log(formatGraphPlan(result));
-    if (!options.dryRun) {
-      declareMutationPath(result.graphLockPath);
-      const transport = transportForTarget(target);
-      const executePlugins = target.executePlugins ?? options.executePlugins;
-      await applyCombinedInstallPlan(result.plan, {
-        executePlugins,
-        transport,
-        graphLockDigest: result.graphLockDigest,
-        graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
-      });
-      const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
-        enabled: target.reloadRuntimes ?? shouldReloadRuntimes(options),
-        executePlugins
-      });
-      console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
-      if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+  try {
+    for (const result of results) {
+      console.log(`${behavior.mode === "update" ? "Update" : "Install"} ${result.plan.adapter} at ${result.plan.targetRoot}:`);
+      console.log(formatGraphPlan(result));
+      if (!options.dryRun) {
+        declareMutationPath(result.graphLockPath);
+        const transport = transportForTarget(target);
+        const executePlugins = target.executePlugins ?? options.executePlugins;
+        await applyCombinedInstallPlan(result.plan, {
+          executePlugins,
+          transport,
+          graphLockDigest: result.graphLockDigest,
+          graphLock: { path: result.graphLockPath, lock: result.bundle.graphLock }
+        });
+        const reloaded = await reloadRuntimeAfterPluginChanges(result.plan, target, transport, {
+          enabled: target.reloadRuntimes ?? shouldReloadRuntimes(options),
+          executePlugins
+        });
+        console.log(`Applied ${result.plan.adapter} at ${result.plan.targetRoot}.`);
+        if (reloaded) console.log(`Reloaded runtime via ${formatReloadCommands(target.reloadCommands)}.`);
+      }
+      if (result.plan.hasBlockingChanges) process.exitCode = 1;
     }
-    await rm10(result.bundle.root, { recursive: true, force: true });
-    if (result.plan.hasBlockingChanges) process.exitCode = 1;
+  } finally {
+    await Promise.all(results.map((result) => rm10(result.bundle.root, { recursive: true, force: true })));
   }
 }
 async function buildGraphPlansForTarget(target, source, options, behavior) {
+  const bundleRoots = [];
+  try {
+    return await collectGraphPlansForTarget(target, source, options, behavior, bundleRoots);
+  } catch (error) {
+    await Promise.all(bundleRoots.map((root) => rm10(root, { recursive: true, force: true })));
+    throw error;
+  }
+}
+async function collectGraphPlansForTarget(target, source, options, behavior, bundleRoots) {
   const targetOptions = optionsForResolvedTarget(options, target);
   const config = await readMergedWorkspaceConfig(target.workspaceRoot);
+  const targetPackages = packagesForCliTarget(config.packages, target, targetOptions);
   const groups = /* @__PURE__ */ new Map();
   const selectedArtifacts = selectedArtifactsFromOptions(targetOptions);
   const dependencyUpdateSelectors = sortedUniqueValues(targetOptions.dependency ?? []);
   const scopedDependencyUpdate = behavior.mode === "update" && dependencyUpdateSelectors.length > 0;
-  const scopedPackage = targetOptions.scope ? findConfiguredPackage(config.packages, targetOptions.scope) : void 0;
+  const scopedPackage = targetOptions.scope ? findConfiguredPackage(targetPackages, targetOptions.scope) : void 0;
   const scopedRootId = scopedPackage?.name ?? (source ? targetOptions.scope : void 0);
   if (targetOptions.scope && !scopedPackage && !source) throw new Error(`Configured package not found: ${targetOptions.scope}`);
   if (scopedPackage && targetOptions.onlySource) {
     const group = graphGroupForPackage(groups, target, scopedPackage, targetOptions);
     group.packages.push(scopedPackage);
   } else if (!source || !targetOptions.onlySource) {
-    for (const pkg of config.packages) {
+    for (const pkg of targetPackages) {
       const group = graphGroupForPackage(groups, target, pkg, targetOptions);
       group.packages.push(pkg);
     }
   }
+  if (!source && !targetOptions.scope) {
+    for (const pkg of config.packages.filter((candidate) => !targetPackages.includes(candidate))) {
+      graphGroupForPackage(groups, target, pkg, targetOptions);
+    }
+  }
   if (source) {
     let entry = targetOptions.extraPackage ?? await packageEntryFromSource(source, target.workspaceRoot, {
       ...targetOptions,
@@ -15467,6 +15419,11 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
     const adapter = await resolveAdapterForTarget(group.target, { ...group.adapterOptions, warn: targetOptions.warn });
     const transport = transportForTarget(group.target);
     const allPackages = [...group.packages, ...group.extraPackages];
+    const excludedRootIds = config.packages.filter((pkg) => !targetPackages.includes(pkg) && graphGroupKey(targetForPackage(target, pkg, targetOptions), {
+      installationType: targetOptions.installationType ?? pkg.installationType ?? target.installationType ?? "local",
+      adapterConfig: targetOptions.adapterConfig ?? target.adapterConfig ?? pkg.adapterConfig,
+      adapterModule: targetOptions.adapterModule ?? target.adapterModule ?? pkg.adapterModule
+    }) === graphGroupKey(group.target, { ...group.adapterOptions, installationType: group.installationType })).map((pkg) => pkg.name);
     const groupHasScope = !scopedRootId || allPackages.some((pkg) => pkg.name === scopedRootId || pkg.source === targetOptions.scope);
     if (behavior.mode === "install" && scopedRootId && !groupHasScope) continue;
     if (behavior.readOnly !== true && targetOptions.dryRun !== true) {
@@ -15565,15 +15522,16 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
     ];
     if (behavior.mode === "update") {
       const changed = roots.filter((root) => root.useLock === false);
-      if (changed.length === 0 && !scopedDependencyUpdate) {
+      if (changed.length === 0 && !scopedDependencyUpdate && excludedRootIds.length === 0) {
         const label = targetOptions.scope ? ` ${targetOptions.scope}` : "";
         console.log(`No tracking packages to update${label}.`);
         continue;
       }
     }
-    if (roots.length === 0) continue;
     const result = await createGraphSourcePlan({
       roots,
+      allowEmptyRoots: roots.length === 0,
+      excludedRootIds,
       targetRoot: group.target.targetRoot,
       workspaceRoot: group.target.workspaceRoot,
       fleetId: group.target.fleetId,
@@ -15603,6 +15561,7 @@ async function buildGraphPlansForTarget(target, source, options, behavior) {
       expectedFromWorkspaceOwner: targetOptions.expectedFromWorkspaceOwner,
       recoverLegacyState: targetOptions.recoverLegacyState
     });
+    bundleRoots.push(result.bundle.root);
     if ((behavior.mode === "install" || behavior.mode === "update") && scopedRootId) {
       const manifest = result.previousManifest;
       const previousLock = result.previousGraphLock;
@@ -16206,7 +16165,7 @@ async function uninstallConfiguredPackage(target, packageName, options) {
   if (removed.length === 0) {
     throw new Error(`Configured package not found: ${packageName}`);
   }
-  const remaining = config.packages.filter((pkg) => !removed.includes(pkg));
+  const remaining = packagesForCliTarget(config.packages.filter((pkg) => !removed.includes(pkg)), target, options);
   const groups = /* @__PURE__ */ new Map();
   for (const pkg of remaining) {
     const group = graphGroupForPackage(groups, target, pkg, options);
@@ -16239,7 +16198,7 @@ async function uninstallConfiguredPackage(target, packageName, options) {
     let renderedRoot;
     if (remainingGroup && remainingGroup.packages.length > 0) {
       const remainingAdapter = await resolveAdapterForTarget(remainingGroup.target, remainingGroup.adapterOptions);
-      const result2 = await createGraphSourcePlan({
+      const result = await createGraphSourcePlan({
         roots: remainingGroup.packages.map((pkg2) => ({
           rootId: pkg2.name,
           source: pkg2.source,
@@ -16271,46 +16230,49 @@ async function uninstallConfiguredPackage(target, packageName, options) {
         readOnly: options.dryRun === true,
         isTTY: process.stdin.isTTY === true
       });
-      remainingGraphPlan = result2;
-      remainingDesired = desiredArtifactsFromGraphBundle(result2.bundle);
-      renderedRoot = result2.bundle.root;
+      remainingGraphPlan = result;
+      remainingDesired = desiredArtifactsFromGraphBundle(result.bundle);
+      renderedRoot = result.bundle.root;
     }
-    const uninstallPlan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, {
-      graphLockDigest: remainingGraphPlan?.graphLockDigest
-    });
-    const transitionPlan = remainingGraphPlan?.plan;
-    const plan = {
-      ...uninstallPlan,
-      stateKey: transitionPlan?.stateKey ?? removedState.stableStateKey,
-      stateMigration: transitionPlan?.stateMigration ?? removedState.migration,
-      targetStateFilePreconditions: transitionPlan?.targetStateFilePreconditions ?? removedState.targetStateFilePreconditions
-    };
-    console.log(`Uninstall ${pkg.name} (${adapter.name} at ${removedTarget.targetRoot}):`);
-    console.log(formatPlan(plan));
-    const graphLockFinalState = remainingGraphPlan ? { graphLock: { path: remainingGraphPlan.graphLockPath, lock: remainingGraphPlan.bundle.graphLock } } : {
-      removeGraphLockPath: removedState.graphLockPath ?? removedState.stableGraphLockPath
-    };
-    if (!options.dryRun) {
-      declareMutationPath(workspaceConfigPath(target.workspaceRoot));
-      const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : removedState.graphLockPath ?? removedState.stableGraphLockPath;
-      declareMutationPath(declarativeGraphPath);
-    }
-    const result = await uninstall(plan, {
-      dryRun: options.dryRun,
-      force: options.force,
-      keepFiles: options.keepFiles,
-      transport,
-      ...graphLockFinalState,
-      workspaceConfig: {
-        path: workspaceConfigPath(target.workspaceRoot),
-        data: { ...config, packages: remaining }
+    try {
+      const uninstallPlan = await createOwnershipUninstallPlan(manifest, remainingDesired, adapter, transport, {
+        graphLockDigest: remainingGraphPlan?.graphLockDigest
+      });
+      const transitionPlan = remainingGraphPlan?.plan;
+      const plan = {
+        ...uninstallPlan,
+        stateKey: transitionPlan?.stateKey ?? removedState.stableStateKey,
+        stateMigration: transitionPlan?.stateMigration ?? removedState.migration,
+        targetStateFilePreconditions: transitionPlan?.targetStateFilePreconditions ?? removedState.targetStateFilePreconditions
+      };
+      console.log(`Uninstall ${pkg.name} (${adapter.name} at ${removedTarget.targetRoot}):`);
+      console.log(formatPlan(plan));
+      const graphLockFinalState = remainingGraphPlan ? { graphLock: { path: remainingGraphPlan.graphLockPath, lock: remainingGraphPlan.bundle.graphLock } } : {
+        removeGraphLockPath: removedState.graphLockPath ?? removedState.stableGraphLockPath
+      };
+      if (!options.dryRun) {
+        declareMutationPath(workspaceConfigPath(target.workspaceRoot));
+        const declarativeGraphPath = remainingGraphPlan ? remainingGraphPlan.graphLockPath : removedState.graphLockPath ?? removedState.stableGraphLockPath;
+        declareMutationPath(declarativeGraphPath);
       }
-    });
-    if (!options.dryRun) {
-      console.log(formatUninstallResult(result));
+      const result = await uninstall(plan, {
+        dryRun: options.dryRun,
+        force: options.force,
+        keepFiles: options.keepFiles,
+        transport,
+        ...graphLockFinalState,
+        workspaceConfig: {
+          path: workspaceConfigPath(target.workspaceRoot),
+          data: { ...config, packages: remaining }
+        }
+      });
+      if (!options.dryRun) {
+        console.log(formatUninstallResult(result));
+      }
+      if (plan.hasBlockingChanges) process.exitCode = 1;
+    } finally {
+      if (renderedRoot) await rm10(renderedRoot, { recursive: true, force: true });
     }
-    if (renderedRoot) await rm10(renderedRoot, { recursive: true, force: true });
-    if (plan.hasBlockingChanges) process.exitCode = 1;
   }
 }
 function graphGroupForPackage(groups, target, pkg, options) {
@@ -16339,6 +16301,9 @@ function targetForPackage(target, pkg, options) {
   const installationType = options.installationType ?? pkg.installationType ?? target.installationType;
   return options.adapter || target.source !== "cwd" ? { ...target, installationType } : { ...target, adapter: pkg.adapter, installationType };
 }
+function packagesForCliTarget(packages, target, options) {
+  return packagesForTarget(packages, target, (pkg) => targetForPackage(target, pkg, options));
+}
 function graphGroupKey(target, options) {
   return JSON.stringify({
     adapter: target.adapter,
@@ -16367,7 +16332,7 @@ function targetFingerprintParts(target, adapter, options, installationType) {
   };
 }
 async function withFreshReadOnlyGraphPlan(target, adapter, adapterOptions, installationType, packages, use) {
-  const stage = await mkdtemp4(join46(tmpdir5(), "agentwheel-recovery-"));
+  const stage = await mkdtemp3(join46(tmpdir4(), "agentwheel-recovery-"));
   const priorTmpdir = process.env.TMPDIR;
   try {
     process.env.TMPDIR = stage;
@@ -16515,7 +16480,7 @@ async function collectTargetStatus(target, options) {
     observation.manifestRevision
   ]).sort())).digest("hex") : null;
   const packages = [];
-  for (const pkg of config.packages) {
+  for (const pkg of packagesForCliTarget(config.packages, target, options)) {
     const root = effectiveGraphLock?.canonical.roots.find((candidate) => candidate.rootId === pkg.name);
     const node = root ? effectiveGraphLock?.canonical.nodes.find((candidate) => candidate.id === root.graphNodeId) : void 0;
     const availability = await discoverPackageVersions(pkg, target.workspaceRoot, {
@@ -17253,9 +17218,9 @@ function isHomePath(path) {
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
-  const adapters2 = splitSelectorList(adapter);
-  const unique = [...new Set(adapters2)];
-  if (unique.length !== adapters2.length) {
+  const adapters = splitSelectorList(adapter);
+  const unique = [...new Set(adapters)];
+  if (unique.length !== adapters.length) {
     throw new Error(`Duplicate adapter in --adapter: ${adapter}`);
   }
   return unique;