agentwheel 0.21.6 → 0.21.7

package/dist/index.js

@@ -583,7 +583,7 @@ async function withFilesystemLock(lockPath, timeoutMs, fn, description = "cache"
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for ${description} lock at ${lockPath}`);
       }
-      await new Promise((resolve45) => setTimeout(resolve45, 50));
+      await new Promise((resolve46) => setTimeout(resolve46, 50));
     }
   }
   try {
@@ -853,7 +853,7 @@ var init_protocol = __esm({
 // src/mutation/process.ts
 import { spawn } from "child_process";
 async function runProcess(command, args, options = {}) {
-  return new Promise((resolve45, reject) => {
+  return new Promise((resolve46, reject) => {
     const useProcessGroup = options.killProcessGroup === true && process.platform !== "win32";
     const child = spawn(command, args, {
       cwd: options.cwd,
@@ -913,7 +913,7 @@ async function runProcess(command, args, options = {}) {
         reject(new Error(`${command} exited ${exitCode}${detail ? `: ${detail}` : ""}`));
         return;
       }
-      resolve45(result);
+      resolve46(result);
     });
     if (options.input !== void 0) child.stdin.end(options.input);
     else child.stdin.end();
@@ -1961,13 +1961,13 @@ async function spawnWithInput(command, args, input) {
   if (result.stderr) throw new Error(result.stderr);
 }
 function waitForProcess(child, label) {
-  return new Promise((resolve45, reject) => {
+  return new Promise((resolve46, reject) => {
     const stderr = [];
     child.stderr?.on("data", (chunk) => stderr.push(chunk));
     child.on("error", reject);
     child.on("close", (code) => {
       const message = Buffer.concat(stderr).toString("utf8");
-      if (code === 0) resolve45({ stderr: "" });
+      if (code === 0) resolve46({ stderr: "" });
       else reject(new Error(`${label} exited ${code}${message ? `: ${message}` : ""}`));
     });
   });
@@ -3267,10 +3267,197 @@ var init_workspace = __esm({
   }
 });
 
+// src/model/fleet.ts
+import { lstat, readFile as readFile11, realpath } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { isAbsolute as isAbsolute7, relative as relative5, resolve as resolve12 } from "path";
+async function resolveWorkspaceScope(request = {}) {
+  const selected = [request.user === true, request.local === true, request.fleet !== void 0].filter(Boolean).length;
+  if (selected > 1) {
+    throw new Error("Choose exactly one workspace selector: --user, --local, or --fleet <id>.");
+  }
+  const globalRoot = resolve12(request.globalRoot ?? homedir5());
+  if (request.user) {
+    const config2 = await readWorkspaceConfig(globalRoot);
+    assertNonFleetScope("user", config2);
+    return { kind: "user", root: globalRoot, config: config2 };
+  }
+  if (request.fleet !== void 0) {
+    const id = fleetIdSchema.parse(request.fleet);
+    const registration = await showRegisteredFleet(id, { globalRoot });
+    const root = await assertCanonicalDirectory(registration.root, `Registered fleet '${id}' root`);
+    const config2 = await readRequiredConfig(root, `fleet '${id}'`);
+    assertFleetContract(id, registration, config2);
+    return { kind: "fleet", root, fleetId: id, config: config2 };
+  }
+  const cwd = resolve12(request.cwd ?? process.cwd());
+  const discoveredRoot = await findExistingWorkspaceRoot(cwd);
+  if (!discoveredRoot || discoveredRoot === globalRoot) {
+    if (request.local === true && cwd !== globalRoot) {
+      return { kind: "local", root: cwd, config: await readWorkspaceConfig(cwd) };
+    }
+    throw missingScopeError(request.local === true ? "local" : "implicit local");
+  }
+  const config = await readRequiredConfig(discoveredRoot, "local");
+  assertNonFleetScope("local", config);
+  return { kind: "local", root: discoveredRoot, config };
+}
+async function registerFleet(request) {
+  const id = fleetIdSchema.parse(request.id);
+  const requiredPackages = sortedUnique3(request.requiredPackages);
+  if (requiredPackages.length === 0) throw new Error("Fleet registration requires at least one --required-package <name>.");
+  const globalRoot = resolve12(request.globalRoot ?? homedir5());
+  const home = await readWorkspaceConfig(globalRoot);
+  if (supportsFleetConfig(home) && home.fleetId) {
+    throw new Error(`The home config is fleet '${home.fleetId}', so it cannot own the global fleet registry.`);
+  }
+  const existing = supportsFleetConfig(home) ? await canonicalizeExistingFleetRoots(home.fleets, globalRoot) : {};
+  if (existing[id]) throw new Error(`Fleet '${id}' is already registered.`);
+  const root = await assertCanonicalDirectory(request.root, `Fleet '${id}' root`);
+  const duplicateRoot = Object.entries(existing).find(([, value]) => value.root === root);
+  if (duplicateRoot) throw new Error(`Fleet root ${root} is already registered as '${duplicateRoot[0]}'.`);
+  if (root === globalRoot) throw new Error("A fleet root must be outside the user config root contract.");
+  const target = await readRequiredConfig(root, `fleet '${id}'`);
+  const registration = registeredFleetSchema.parse({ root, requiredPackages });
+  assertFleetContract(id, registration, target);
+  const upgraded = workspaceConfigSchema.parse({
+    ...home,
+    schemaVersion: CURRENT_WORKSPACE_SCHEMA_VERSION,
+    exports: home.schemaVersion >= 2 ? home.exports : { selections: {} },
+    fleets: { ...existing, [id]: registration }
+  });
+  const configPath = globalWorkspaceConfigPath(globalRoot);
+  declareMutationPath(configPath);
+  await writeJsonAtomic(configPath, upgraded);
+  return { id, ...registration };
+}
+async function canonicalizeExistingFleetRoots(fleets, globalRoot) {
+  const canonical = /* @__PURE__ */ new Map();
+  const normalized = {};
+  for (const [id, registration] of Object.entries(fleets).sort(([a], [b]) => a.localeCompare(b))) {
+    const root = await canonicalizeDirectory(registration.root, `Registered fleet '${id}' root`);
+    if (root === globalRoot) throw new Error(`Registered fleet '${id}' root must be outside the user config root contract.`);
+    const incumbent = canonical.get(root);
+    if (incumbent) {
+      throw new Error(`Fleet root ${root} is registered more than once as '${incumbent}' and '${id}'.`);
+    }
+    canonical.set(root, id);
+    normalized[id] = registeredFleetSchema.parse({ ...registration, root });
+  }
+  return normalized;
+}
+async function listRegisteredFleets(options = {}) {
+  const globalRoot = resolve12(options.globalRoot ?? homedir5());
+  const home = await readWorkspaceConfig(globalRoot);
+  if (!supportsFleetConfig(home)) return [];
+  return Object.entries(home.fleets).sort(([a], [b]) => a.localeCompare(b)).map(([id, registration]) => ({ id, ...registration }));
+}
+async function showRegisteredFleet(idInput, options = {}) {
+  const id = fleetIdSchema.parse(idInput);
+  const fleets = await listRegisteredFleets(options);
+  const registration = fleets.find((candidate) => candidate.id === id);
+  if (!registration) {
+    throw new Error(`Unknown fleet '${id}'. Use 'agentwheel fleet list' or register it with 'agentwheel fleet register'.`);
+  }
+  return registration;
+}
+async function resolveWorkspaceOwnershipScope(workspaceRootInput, options = {}) {
+  const workspaceRoot = await canonicalizeDirectory(resolve12(workspaceRootInput), "Workspace ownership root");
+  if (options.fleetId) {
+    return { root: workspaceRoot, fleetId: fleetIdSchema.parse(options.fleetId) };
+  }
+  const syntacticallyContaining = (await listRegisteredFleets({ globalRoot: options.globalRoot })).filter((fleet2) => containsPath(resolve12(fleet2.root), workspaceRoot));
+  const registered = await Promise.all(syntacticallyContaining.map(async (fleet2) => ({
+    ...fleet2,
+    root: await canonicalizeDirectory(fleet2.root, `Registered fleet '${fleet2.id}' root`)
+  })));
+  const containing = registered.filter((fleet2) => containsPath(fleet2.root, workspaceRoot));
+  if (containing.length > 1) {
+    throw new Error(
+      `Workspace ${workspaceRoot} is contained by multiple registered fleets: ` + containing.map((fleet2) => `'${fleet2.id}' at ${fleet2.root}`).join(", ") + ". Resolve the overlapping registrations before planning ownership."
+    );
+  }
+  const fleet = containing[0];
+  if (fleet) assertFleetContract(fleet.id, fleet, await readRequiredConfig(fleet.root, `fleet '${fleet.id}'`));
+  return fleet ? { root: fleet.root, fleetId: fleet.id } : { root: workspaceRoot };
+}
+async function readRequiredConfig(root, label) {
+  const path = workspaceConfigPath(root);
+  if (!await pathExists(path)) throw missingScopeError(label);
+  try {
+    return workspaceConfigSchema.parse(JSON.parse(await readFile11(path, "utf8")));
+  } catch (error) {
+    throw new Error(`Invalid ${label} Agentwheel config at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function assertFleetContract(id, registration, config) {
+  if (!supportsFleetConfig(config)) {
+    throw new Error(`Fleet '${id}' config must use schemaVersion 3 or newer before registration or selection.`);
+  }
+  if (config.fleetId !== id) {
+    throw new Error(`Fleet fleetId mismatch: expected '${id}', found '${config.fleetId ?? "missing"}'.`);
+  }
+  if (Object.keys(config.fleets).length > 0) {
+    throw new Error(`Fleet '${id}' config may not contain the home fleets registry.`);
+  }
+  const names = new Set(config.packages.map((pkg) => pkg.name));
+  for (const packageName of registration.requiredPackages) {
+    if (!names.has(packageName)) throw new Error(`Fleet '${id}' is missing required package '${packageName}'.`);
+  }
+}
+async function assertCanonicalDirectory(input, label) {
+  const canonical = await canonicalizeDirectory(input, label);
+  const normalized = resolve12(input);
+  const stats = await lstat(input);
+  if (stats.isSymbolicLink() || canonical !== normalized || input !== normalized) {
+    throw new Error(`${label} must be canonical and symlink-unambiguous: ${input} resolves to ${canonical}.`);
+  }
+  return canonical;
+}
+async function canonicalizeDirectory(input, label) {
+  if (!isAbsolute7(input)) throw new Error(`${label} must be an absolute canonical path.`);
+  let canonical;
+  try {
+    canonical = await realpath(input);
+  } catch {
+    throw new Error(`${label} does not exist: ${input}`);
+  }
+  const stats = await lstat(canonical);
+  if (!stats.isDirectory()) throw new Error(`${label} is not a directory: ${input}`);
+  return canonical;
+}
+function missingScopeError(label) {
+  return new Error(
+    `Missing ${label} Agentwheel workspace config. Select --user, --local, or --fleet <id>, or run 'agentwheel init workspace' in the intended local root. Agentwheel never falls back to home desired state.`
+  );
+}
+function assertNonFleetScope(kind, config) {
+  if (supportsFleetConfig(config) && config.fleetId) {
+    throw new Error(
+      `The ${kind} config declares fleetId '${config.fleetId}'. Select it through the registered --fleet <id> scope.`
+    );
+  }
+}
+function sortedUnique3(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort((a, b) => a.localeCompare(b));
+}
+function containsPath(parent, candidate) {
+  const path = relative5(parent, candidate);
+  return path === "" || !path.startsWith("..") && !isAbsolute7(path);
+}
+var init_fleet = __esm({
+  "src/model/fleet.ts"() {
+    "use strict";
+    init_fs();
+    init_declarations();
+    init_workspace();
+  }
+});
+
 // src/mutation/repository.ts
 import { createHash as createHash7 } from "crypto";
-import { lstat, readFile as readFile11, readlink, readdir as readdir4 } from "fs/promises";
-import { posix as posix3, relative as relative5, resolve as resolve12, sep as sep3 } from "path";
+import { lstat as lstat2, readFile as readFile12, readlink, readdir as readdir4 } from "fs/promises";
+import { posix as posix3, relative as relative6, resolve as resolve13, sep as sep3 } from "path";
 async function discoverGitRepository(start) {
   const probe = await runProcess("git", ["-C", start, "rev-parse", "--show-toplevel"], { allowExitCodes: [0, 128] });
   if (probe.exitCode !== 0) return void 0;
@@ -3293,7 +3480,7 @@ async function assertGitPreflight(repository) {
     if (result.exitCode === 0) throw new Error(`Revisioning refuses an in-progress Git operation (${marker}) in ${gitDir}.`);
   }
   for (const marker of ["rebase-merge", "rebase-apply"]) {
-    if (await exists(resolve12(gitDir, marker))) throw new Error(`Revisioning refuses an in-progress Git operation (${marker}) in ${gitDir}.`);
+    if (await exists(resolve13(gitDir, marker))) throw new Error(`Revisioning refuses an in-progress Git operation (${marker}) in ${gitDir}.`);
   }
 }
 async function assertHeadLease(repositoryRoot, expectedHead, head, paths, provider) {
@@ -3409,16 +3596,16 @@ async function hashHeadPath(repositoryRoot, head, path) {
   return sha256(result.stdout);
 }
 async function hashWorkingPath(repositoryRoot, path) {
-  const absolute = resolve12(repositoryRoot, ...path.split("/"));
+  const absolute = resolve13(repositoryRoot, ...path.split("/"));
   let stats;
   try {
-    stats = await lstat(absolute);
+    stats = await lstat2(absolute);
   } catch (error) {
     if (isMissing3(error)) return null;
     throw error;
   }
   if (stats.isSymbolicLink()) return sha256(Buffer.from(await readlink(absolute), "utf8"));
-  if (stats.isFile()) return sha256(await readFile11(absolute));
+  if (stats.isFile()) return sha256(await readFile12(absolute));
   if (stats.isDirectory()) return hashDirectory(absolute);
   throw new Error(`Unsupported repository path kind: ${path}`);
 }
@@ -3427,11 +3614,11 @@ async function hashDirectory(root) {
   async function walk2(dir) {
     for (const entry of (await readdir4(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
       if (entry.name === ".git" || entry.name === "node_modules") continue;
-      const absolute = resolve12(dir, entry.name);
-      const relativePath = normalizeRepoPath(relative5(root, absolute));
+      const absolute = resolve13(dir, entry.name);
+      const relativePath = normalizeRepoPath(relative6(root, absolute));
       if (entry.isDirectory()) await walk2(absolute);
       else if (entry.isSymbolicLink()) hash2.update(relativePath).update("\0").update(await readlink(absolute)).update("\0");
-      else if (entry.isFile()) hash2.update(relativePath).update("\0").update(await readFile11(absolute)).update("\0");
+      else if (entry.isFile()) hash2.update(relativePath).update("\0").update(await readFile12(absolute)).update("\0");
     }
   }
   await walk2(root);
@@ -3451,7 +3638,7 @@ function isMissing3(error) {
 }
 async function exists(path) {
   try {
-    await lstat(path);
+    await lstat2(path);
     return true;
   } catch (error) {
     if (isMissing3(error)) return false;
@@ -3467,9 +3654,9 @@ var init_repository = __esm({
 
 // src/mutation/providers.ts
 import { createHash as createHash8 } from "crypto";
-import { chmod as chmod2, mkdtemp, open as open2, readFile as readFile12, rename as rename5, rm as rm4, rmdir, stat as stat3, writeFile as writeFile7 } from "fs/promises";
+import { chmod as chmod2, mkdtemp, open as open2, readFile as readFile13, rename as rename5, rm as rm4, rmdir, stat as stat3, writeFile as writeFile7 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { isAbsolute as isAbsolute7, join as join10, resolve as resolve13 } from "path";
+import { isAbsolute as isAbsolute8, join as join10, resolve as resolve14 } from "path";
 function revisionProviderRejection(error) {
   return error instanceof RevisionProviderRejectedError ? error.response : void 0;
 }
@@ -3675,7 +3862,7 @@ async function assertProviderSemantics(request, response, config) {
 }
 async function invokeGitProvider(providerId, request, config) {
   const repository = await discoverGitRepository(request.repositoryRoot);
-  if (!repository || repository.root !== resolve13(request.repositoryRoot)) {
+  if (!repository || repository.root !== resolve14(request.repositoryRoot)) {
     throw new Error(`Git revision provider requires the repository root itself: ${request.repositoryRoot}.`);
   }
   if (request.action === "check" || request.action === "preflight") {
@@ -3752,7 +3939,7 @@ async function finalizeGit(providerId, request, config) {
     const stagedAfterHooks = splitNull2((await runProcess("git", ["-C", request.repositoryRoot, "diff", "--cached", "--name-only", "-z"], { env: env2 })).stdout);
     assertExactSet(stagedAfterHooks, request.paths.map((entry) => entry.path), "temporary Git index after hooks");
     await verifyTemporaryIndexPaths(request, env2);
-    const message = await readFile12(messagePath, "utf8");
+    const message = await readFile13(messagePath, "utf8");
     assertCommitMessageContract(message, request, planDigest);
     commitSha = (await runProcess("git", ["-C", request.repositoryRoot, "commit-tree", tree, "-p", repository.head], {
       env: env2,
@@ -3783,7 +3970,7 @@ async function runCommitHooks(request, env2, messagePath) {
     ["commit-msg", [messagePath]]
   ]) {
     const rawPath = (await runProcess("git", ["-C", request.repositoryRoot, "rev-parse", "--git-path", `hooks/${name}`])).stdout.toString("utf8").trim();
-    const hookPath = isAbsolute7(rawPath) ? rawPath : resolve13(request.repositoryRoot, rawPath);
+    const hookPath = isAbsolute8(rawPath) ? rawPath : resolve14(request.repositoryRoot, rawPath);
     let executable = false;
     try {
       executable = ((await stat3(hookPath)).mode & 73) !== 0;
@@ -3869,9 +4056,9 @@ async function realignIndexAfterRecoveredCommit(repositoryRoot, expectedHead, co
 }
 async function captureIndexLease(repositoryRoot) {
   const rawPath = (await runProcess("git", ["-C", repositoryRoot, "rev-parse", "--git-path", "index"])).stdout.toString("utf8").trim();
-  const path = isAbsolute7(rawPath) ? rawPath : resolve13(repositoryRoot, rawPath);
+  const path = isAbsolute8(rawPath) ? rawPath : resolve14(repositoryRoot, rawPath);
   try {
-    const [content, info] = await Promise.all([readFile12(path), stat3(path)]);
+    const [content, info] = await Promise.all([readFile13(path), stat3(path)]);
     return { path, sha256: sha2562(content), mode: info.mode & 511 };
   } catch (error) {
     if (isMissing4(error)) return { path, sha256: null, mode: 384 };
@@ -3887,7 +4074,7 @@ async function replaceIndexCas(repositoryRoot, lease, commitSha) {
     await runProcess("git", ["-C", repositoryRoot, "read-tree", commitSha], {
       env: { ...process.env, GIT_INDEX_FILE: replacementPath }
     });
-    const replacement = await readFile12(replacementPath);
+    const replacement = await readFile13(replacementPath);
     handle = await open2(lockPath, "wx", lease.mode);
     const current = await readOptionalFile(lease.path);
     const currentSha256 = current ? sha2562(current) : null;
@@ -3929,7 +4116,7 @@ async function hashGitObject(repositoryRoot, spec) {
 }
 async function readOptionalFile(path) {
   try {
-    return await readFile12(path);
+    return await readFile13(path);
   } catch (error) {
     if (isMissing4(error)) return null;
     throw error;
@@ -4035,14 +4222,14 @@ var init_providers = __esm({
 
 // src/mutation/coordinator.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute8, relative as relative6, resolve as resolve14, sep as sep4 } from "path";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname9, isAbsolute as isAbsolute9, relative as relative7, resolve as resolve15, sep as sep4 } from "path";
 function dirtyRepositoryPaths(repositoryRoot, baseline, paths) {
   const conflicts = /* @__PURE__ */ new Set();
   for (const path of paths) {
-    const absolute = isAbsolute8(path) ? resolve14(path) : resolve14(process.cwd(), path);
-    const relativePath = relative6(repositoryRoot, absolute);
-    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep4}`) || isAbsolute8(relativePath)) continue;
+    const absolute = isAbsolute9(path) ? resolve15(path) : resolve15(process.cwd(), path);
+    const relativePath = relative7(repositoryRoot, absolute);
+    if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${sep4}`) || isAbsolute9(relativePath)) continue;
     const normalized = relativePath.split(sep4).join("/");
     if (baseline.changed.has(normalized)) conflicts.add(normalized);
   }
@@ -4259,13 +4446,18 @@ async function checkMutationProvider(workspaceRoot, globalRoot) {
   });
   return invokeRevisionProvider(policy.revisioning.provider, request, { workspaceRoot });
 }
-async function mutationPolicyForWorkspace(workspaceRoot, globalRoot = homedir5()) {
+async function mutationPolicyForWorkspace(workspaceRoot, globalRoot = homedir6()) {
   const scopedConfig = await readWorkspaceConfig(workspaceRoot);
   const scoped = scopedConfig.schemaVersion === 4 ? scopedConfig.mutationPolicy : void 0;
-  if (resolve14(workspaceRoot) === resolve14(globalRoot)) return scoped;
+  if (resolve15(workspaceRoot) === resolve15(globalRoot)) return scoped;
   const globalConfig = await readWorkspaceConfig(globalRoot);
   const global = globalConfig.schemaVersion === 4 ? globalConfig.mutationPolicy : void 0;
-  return mergeMutationPolicies(global, scoped);
+  let existingRoot = resolve15(workspaceRoot);
+  while (!await pathExists(existingRoot) && dirname9(existingRoot) !== existingRoot) existingRoot = dirname9(existingRoot);
+  const owner = await resolveWorkspaceOwnershipScope(existingRoot, { globalRoot });
+  const fleetConfig = owner.fleetId ? await readWorkspaceConfig(owner.root) : void 0;
+  const fleet = fleetConfig?.schemaVersion === 4 ? fleetConfig.mutationPolicy : void 0;
+  return mergeMutationPolicies(mergeMutationPolicies(global, fleet), scoped);
 }
 function mergeMutationPolicies(global, scoped) {
   if (!global) return scoped;
@@ -4337,6 +4529,8 @@ var init_coordinator = __esm({
     "use strict";
     init_mutation();
     init_workspace();
+    init_fleet();
+    init_fs();
     init_declarations();
     init_providers();
     init_protocol();
@@ -4619,18 +4813,18 @@ __export(transaction_exports, {
   writeApplyJournal: () => writeApplyJournal
 });
 import { createHash as createHash9 } from "crypto";
-import { cp as cp2, lstat as lstat2, mkdir as mkdir7, open as open3, readFile as readFile13, readdir as readdir5, rm as rm5, stat as stat4 } from "fs/promises";
-import { dirname as dirname9, join as join11, relative as relative7, resolve as resolve15, sep as sep5 } from "path";
+import { cp as cp2, lstat as lstat3, mkdir as mkdir7, open as open3, readFile as readFile14, readdir as readdir5, rm as rm5, stat as stat4 } from "fs/promises";
+import { dirname as dirname10, join as join11, relative as relative8, resolve as resolve16, sep as sep5 } from "path";
 async function assertNoSymlinkPath(path) {
-  const absolute = resolve15(path);
+  const absolute = resolve16(path);
   let current = absolute;
   while (true) {
     try {
-      if ((await lstat2(current)).isSymbolicLink()) throw new Error(`Symlink path is unsupported: ${current}`);
+      if ((await lstat3(current)).isSymbolicLink()) throw new Error(`Symlink path is unsupported: ${current}`);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    const parent = dirname9(current);
+    const parent = dirname10(current);
     if (parent === current) break;
     current = parent;
   }
@@ -4639,15 +4833,15 @@ async function ownershipRuntimeSnapshot(path) {
   await assertNoSymlinkPath(path);
   const hash2 = createHash9("sha256");
   async function visit(candidate) {
-    const info = await lstat2(candidate);
+    const info = await lstat3(candidate);
     if (info.isSymbolicLink() || !info.isDirectory() && !info.isFile()) {
       throw new Error(`Unsupported ownership runtime path: ${candidate}`);
     }
-    hash2.update(JSON.stringify([relative7(path, candidate), info.isDirectory() ? "dir" : "file", info.mode & 4095]));
+    hash2.update(JSON.stringify([relative8(path, candidate), info.isDirectory() ? "dir" : "file", info.mode & 4095]));
     if (info.isDirectory()) {
       for (const name of (await readdir5(candidate)).sort()) await visit(join11(candidate, name));
     } else {
-      const content = await readFile13(candidate);
+      const content = await readFile14(candidate);
       hash2.update(String(content.length)).update("\0").update(content);
     }
   }
@@ -4656,14 +4850,14 @@ async function ownershipRuntimeSnapshot(path) {
 }
 function metadataAuditPath(audit, path) {
   mutationOperationIdSchema.parse(audit.operationId);
-  if (resolve15(audit.workspaceRoot) !== audit.workspaceRoot || path !== `.agentwheel/ownership-releases/${audit.operationId}.json`) {
+  if (resolve16(audit.workspaceRoot) !== audit.workspaceRoot || path !== `.agentwheel/${audit.kind === "ownership-handoff" ? "ownership-handoffs" : "ownership-releases"}/${audit.operationId}.json`) {
     throw new Error("Invalid ownership release audit path.");
   }
   return join11(audit.workspaceRoot, ...path.split("/"));
 }
 function metadataRuntimePath(root, path) {
-  const result = resolve15(root, path);
-  if (!path || relative7(resolve15(root), result).split(sep5).join("/") !== path || path === ".agentwheel" || path.startsWith(".agentwheel/") || result === resolve15(root) || !result.startsWith(`${resolve15(root)}${sep5}`)) {
+  const result = resolve16(root, path);
+  if (!path || relative8(resolve16(root), result).split(sep5).join("/") !== path || path === ".agentwheel" || path.startsWith(".agentwheel/") || result === resolve16(root) || !result.startsWith(`${resolve16(root)}${sep5}`)) {
     throw new Error(`Unsafe ownership release path: ${path}`);
   }
   return result;
@@ -4677,7 +4871,7 @@ async function syncMetadataPath(path, directoryOnly = false) {
       await file.close();
     }
   }
-  const directory = await open3(directoryOnly ? path : dirname9(path), "r");
+  const directory = await open3(directoryOnly ? path : dirname10(path), "r");
   try {
     await directory.sync();
   } finally {
@@ -4781,8 +4975,8 @@ async function listAllApplyJournals(targetRoot, adapter, transport = localTransp
   return found.sort((a, b) => a.path.localeCompare(b.path));
 }
 async function readLinkedLocalApplyJournal(path, operationId, expectedDigest, expectedTransportDescription) {
-  const absolutePath = resolve15(path);
-  const journal = parseApplyJournal(JSON.parse(await readFile13(absolutePath, "utf8")));
+  const absolutePath = resolve16(path);
+  const journal = parseApplyJournal(JSON.parse(await readFile14(absolutePath, "utf8")));
   if (journal.version !== 2 || !journal.mutation) {
     throw new Error(`Runtime apply journal ${absolutePath} is not linked to a governed mutation.`);
   }
@@ -4800,7 +4994,7 @@ async function readLinkedLocalApplyJournal(path, operationId, expectedDigest, ex
   }) !== expectedDigest) {
     throw new Error(`Runtime apply journal ${absolutePath} digest does not match its durable receipt.`);
   }
-  const expectedPath = resolve15(applyJournalPath(journal.targetRoot, journal.adapter, {
+  const expectedPath = resolve16(applyJournalPath(journal.targetRoot, journal.adapter, {
     installationType: journal.installationType,
     stateKey: journal.stateKey
   }));
@@ -4815,7 +5009,7 @@ async function removeApplyJournal(targetRoot, adapter, transport = localTranspor
   if (existing?.mutation) await beginResolveMutationRuntimeJournal(existing.mutation.operationId, path);
   await transport.rm(applyJournalPath(targetRoot, adapter, scope));
   await transport.rm(applyBackupDir(targetRoot, adapter, scope));
-  if ((existing?.metadataAudit || existing?.metadataGuards) && transport.kind === "local") await syncMetadataPath(dirname9(path), true);
+  if ((existing?.metadataAudit || existing?.metadataGuards) && transport.kind === "local") await syncMetadataPath(dirname10(path), true);
   if (existing?.mutation) await resolveMutationRuntimeJournal(existing.mutation.operationId, path);
 }
 async function abortApplyJournal(targetRoot, adapter, transport = localTransport, scope = {}) {
@@ -4875,7 +5069,7 @@ function applyJournalLinkDigest(journal, transport) {
     adapter: journal.adapter,
     installationType: journal.installationType ?? null,
     stateKey: journal.stateKey ?? null,
-    targetRoot: resolve15(journal.targetRoot),
+    targetRoot: resolve16(journal.targetRoot),
     baseRevision: journal.baseRevision,
     graphLockDigest: journal.graphLockDigest ?? null,
     graphLockPath: journal.graphLockPath ?? null,
@@ -4951,7 +5145,7 @@ async function recordBackup(operation, index, targetRoot, adapter, transport = l
   }
   const backupPath = join11(applyBackupDir(targetRoot, adapter, scope), String(index));
   await rm5(backupPath, { recursive: true, force: true });
-  await mkdir7(dirname9(backupPath), { recursive: true });
+  await mkdir7(dirname10(backupPath), { recursive: true });
   await cp2(operation.destPath, backupPath, { recursive: operation.kind === "dir", dereference: true });
   return {
     index,
@@ -5017,15 +5211,15 @@ var init_transaction = __esm({
 });
 
 // src/install/toml-merge.ts
-import { mkdir as mkdir8, readFile as readFile14, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname10 } from "path";
+import { mkdir as mkdir8, readFile as readFile15, writeFile as writeFile8 } from "fs/promises";
+import { dirname as dirname11 } from "path";
 async function mergeCodexTomlMcp(sourcePath, destPath) {
-  const source = JSON.parse(await readFile14(sourcePath, "utf8"));
+  const source = JSON.parse(await readFile15(sourcePath, "utf8"));
   const servers = extractMcpServers(source);
-  const current = await pathExists(destPath) ? await readFile14(destPath, "utf8") : "";
+  const current = await pathExists(destPath) ? await readFile15(destPath, "utf8") : "";
   const withoutManaged = removeManagedMcpSections(current, Object.keys(servers));
   const merged = appendMcpServers(withoutManaged, servers);
-  await mkdir8(dirname10(destPath), { recursive: true });
+  await mkdir8(dirname11(destPath), { recursive: true });
   await writeFile8(destPath, merged, "utf8");
 }
 function mismatchedCodexTomlMcpServers(source, currentContent) {
@@ -5141,14 +5335,14 @@ var init_toml_merge = __esm({
 });
 
 // src/install/yaml-merge.ts
-import { mkdir as mkdir9, readFile as readFile15, writeFile as writeFile9 } from "fs/promises";
-import { dirname as dirname11 } from "path";
+import { mkdir as mkdir9, readFile as readFile16, writeFile as writeFile9 } from "fs/promises";
+import { dirname as dirname12 } from "path";
 import { parse as parse2, stringify } from "yaml";
 async function mergeYamlFile(sourcePath, destPath) {
-  const source = parseYamlValue(await readFile15(sourcePath, "utf8"));
-  const current = await pathExists(destPath) ? parseYamlValue(await readFile15(destPath, "utf8")) : {};
+  const source = parseYamlValue(await readFile16(sourcePath, "utf8"));
+  const current = await pathExists(destPath) ? parseYamlValue(await readFile16(destPath, "utf8")) : {};
   const merged = deepMerge2(current, source);
-  await mkdir9(dirname11(destPath), { recursive: true });
+  await mkdir9(dirname12(destPath), { recursive: true });
   await writeFile9(destPath, stringify(merged), "utf8");
 }
 function parseYamlValue(content) {
@@ -5206,8 +5400,8 @@ var init_yaml_merge = __esm({
 });
 
 // src/install/merge-removal.ts
-import { mkdir as mkdir10, readFile as readFile16, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname12 } from "path";
+import { mkdir as mkdir10, readFile as readFile17, writeFile as writeFile10 } from "fs/promises";
+import { dirname as dirname13 } from "path";
 import { parse as parse3, stringify as stringify2 } from "yaml";
 function assertExactMergeContribution(contribution, strategy, currentContent) {
   if (strategy === "codex-toml-mcp") {
@@ -5274,7 +5468,7 @@ async function mergeRemovalForInstall(sourcePath, strategy, currentContent, opti
   return introducedMergeContent(parseMergeDestination(currentContent, strategy), source);
 }
 async function removeMergeContribution(destPath, strategy, removal) {
-  const content = await readFile16(destPath, "utf8");
+  const content = await readFile17(destPath, "utf8");
   if (strategy === "codex-toml-mcp") {
     const servers = isRecord4(removal.mcpServers) ? removal.mcpServers : removal;
     await writeFile10(destPath, removeCodexTomlMcpSections(content, Object.keys(servers)), "utf8");
@@ -5282,7 +5476,7 @@ async function removeMergeContribution(destPath, strategy, removal) {
   }
   const current = parseMergeDestination(content, strategy);
   removeIntroducedContent(current, removal);
-  await mkdir10(dirname12(destPath), { recursive: true });
+  await mkdir10(dirname13(destPath), { recursive: true });
   await writeFile10(destPath, strategy === "yaml-deep" ? stringify2(current) : `${JSON.stringify(current, null, 2)}
 `, "utf8");
 }
@@ -5298,7 +5492,7 @@ async function readMergeSource(sourcePath, strategy) {
   if (strategy === "openclaw-json-deep") {
     return requireRecord(await renderOpenClawJsonMergeSource(sourcePath), "OpenClaw JSON merge source");
   }
-  const content = await readFile16(sourcePath, "utf8");
+  const content = await readFile17(sourcePath, "utf8");
   if (strategy === "yaml-deep") return requireRecord(normalizeYamlValue2(parse3(content)), "YAML merge source");
   return requireRecord(JSON.parse(content), "JSON merge source");
 }
@@ -5550,9 +5744,9 @@ var init_desired = __esm({
 
 // src/install/instructions-block.ts
 import { createHash as createHash10 } from "crypto";
-import { mkdtemp as mkdtemp2, readFile as readFile17, realpath, rm as rm6, writeFile as writeFile11 } from "fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile18, realpath as realpath2, rm as rm6, writeFile as writeFile11 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename2, dirname as dirname13, join as join12, relative as relative8 } from "path";
+import { basename as basename2, dirname as dirname14, join as join12, relative as relative9 } from "path";
 function exactManagedInstructionBlockSnapshot(content, selector) {
   const beginCount = [...content.matchAll(new RegExp(`<!-- BEGIN openpack:include ${escapeRegex(selector)}(?=\\s|-->)`, "gu"))].length;
   const endCount = [...content.matchAll(new RegExp(`<!-- END openpack:include ${escapeRegex(selector)}(?=\\s|-->)`, "gu"))].length;
@@ -5603,7 +5797,7 @@ function exactManagedInstructionBlockSnapshot(content, selector) {
   };
 }
 async function desiredManagedInstructionBlockHash(sourcePath) {
-  const source = await readFile17(sourcePath, "utf8");
+  const source = await readFile18(sourcePath, "utf8");
   return hashText(managedBlockBody(source));
 }
 async function readManagedInstructionBlockState(destPath, selector, transport) {
@@ -5623,7 +5817,7 @@ async function readManagedInstructionBlockState(destPath, selector, transport) {
   };
 }
 async function writeManagedInstructionBlock(sourcePath, destPath, selector, transport, options = {}) {
-  const source = await readFile17(sourcePath, "utf8");
+  const source = await readFile18(sourcePath, "utf8");
   const desired = renderManagedInstructionBlock(selector, source);
   const existing = await readOptionalText(destPath, transport);
   const merged = upsertManagedInstructionBlock(existing ?? "", selector, desired.block, options);
@@ -5643,7 +5837,7 @@ async function managedInstructionBlockLanded(destPath, selector, expectedHash, t
 }
 async function managedInstructionPhysicalKey(destPath, transport) {
   if (transport.kind !== "local" || !await transport.pathExists(destPath)) return destPath;
-  return realpath(destPath);
+  return realpath2(destPath);
 }
 async function claudeInstructionBridgesAgents(claudePath, agentsPath, transport) {
   if (!await transport.pathExists(claudePath)) return false;
@@ -5735,7 +5929,7 @@ function assertCleanBlock(block, selector) {
   }
 }
 function referencesAgentsMd(content, claudePath, agentsPath) {
-  const claudeDir = dirname13(claudePath);
+  const claudeDir = dirname14(claudePath);
   for (const rawLine of content.split(/\r?\n/)) {
     const line = rawLine.trim();
     const atImport = /^@import\s+(.+)$/i.exec(line);
@@ -5745,7 +5939,7 @@ function referencesAgentsMd(content, claudePath, agentsPath) {
     const cleaned = referenced.trim().replace(/^["']|["']$/g, "");
     if (!/AGENTS\.md$/i.test(cleaned)) continue;
     const candidate = cleaned.startsWith("/") ? cleaned : join12(claudeDir, cleaned);
-    if (relative8(dirname13(agentsPath), candidate).replaceAll("\\", "/") === "AGENTS.md") return true;
+    if (relative9(dirname14(agentsPath), candidate).replaceAll("\\", "/") === "AGENTS.md") return true;
     if (candidate === agentsPath) return true;
   }
   return false;
@@ -5753,7 +5947,7 @@ function referencesAgentsMd(content, claudePath, agentsPath) {
 async function samePhysicalPath(left, right, transport) {
   if (transport.kind !== "local") return false;
   if (!await transport.pathExists(left) || !await transport.pathExists(right)) return false;
-  return await realpath(left) === await realpath(right);
+  return await realpath2(left) === await realpath2(right);
 }
 async function readOptionalText(path, transport) {
   if (!await transport.pathExists(path)) return void 0;
@@ -5803,9 +5997,9 @@ __export(apply_exports, {
 });
 import { execFile as execFile4 } from "child_process";
 import { createHash as createHash11, randomUUID as randomUUID3 } from "crypto";
-import { link as link2, mkdir as mkdir11, mkdtemp as mkdtemp3, open as open4, readFile as readFile18, rm as rm7, writeFile as writeFile12 } from "fs/promises";
+import { link as link2, mkdir as mkdir11, mkdtemp as mkdtemp3, open as open4, readFile as readFile19, rm as rm7, writeFile as writeFile12 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename3, dirname as dirname14, join as join13, resolve as resolve16 } from "path";
+import { basename as basename3, dirname as dirname15, join as join13, resolve as resolve17 } from "path";
 import { promisify as promisify4 } from "util";
 async function applyInstallPlan(plan, sourceLock, options = {}) {
   return applyPlanTransactionally(plan, { ...options, sourceLock });
@@ -6172,7 +6366,7 @@ async function assertCommittedJournalState(journal, expectedManifest, transport)
     }
   }
   if (journal.workspaceConfigPath && journal.workspaceConfig) {
-    const actual = JSON.parse(await readFile18(journal.workspaceConfigPath, "utf8"));
+    const actual = JSON.parse(await readFile19(journal.workspaceConfigPath, "utf8"));
     if (canonicalJson5(actual) !== canonicalJson5(journal.workspaceConfig)) {
       throw new Error(`Workspace config postcheck failed for ${journal.workspaceConfigPath}.`);
     }
@@ -6182,7 +6376,7 @@ async function assertCommittedJournalState(journal, expectedManifest, transport)
 async function assertMetadataAuditGuards(journal, after, transport, requireAfter = false) {
   const audit = journal.metadataAudit;
   const sha = /^[a-f0-9]{64}$/;
-  if (transport.kind !== "local" || audit.kind !== "ownership-release" || after.adapter !== journal.adapter || after.targetRoot !== journal.targetRoot || after.installationType !== journal.installationType || after.stateKey !== journal.stateKey || journal.mode !== "uninstall" || journal.operations.length || journal.completed.length || journal.sourceLock || journal.graphLock || journal.graphLockPath || journal.graphLockRemovePath || journal.stateRemoveKey || journal.workspaceConfigPath || journal.workspaceConfig || !sha.test(audit.planDigest) || !sha.test(journal.baseRevision ?? "") || audit.auditFiles.length !== 1 || audit.runtime.length !== 1 || !audit.inventory.length) {
+  if (transport.kind !== "local" || audit.kind !== "ownership-release" && audit.kind !== "ownership-handoff" || after.adapter !== journal.adapter || after.targetRoot !== journal.targetRoot || after.installationType !== journal.installationType || after.stateKey !== journal.stateKey || journal.mode !== "uninstall" || journal.operations.length || journal.completed.length || journal.sourceLock || journal.graphLock || journal.graphLockPath || journal.graphLockRemovePath || journal.stateRemoveKey || journal.workspaceConfigPath || journal.workspaceConfig || !sha.test(audit.planDigest) || !sha.test(journal.baseRevision ?? "") || audit.auditFiles.length !== 1 || audit.runtime.length !== 1 || !audit.inventory.length) {
     throw new Error("Invalid metadata-audit transaction; no state was committed.");
   }
   await assertMetadataStateGuards(journal, after, audit, transport, requireAfter);
@@ -6193,7 +6387,7 @@ async function assertMetadataAuditGuards(journal, after, transport, requireAfter
       throw new Error("Metadata-audit content digest is invalid.");
     }
     try {
-      if (await readFile18(path, "utf8") !== file.content) throw new Error(`Metadata-audit file changed: ${path}`);
+      if (await readFile19(path, "utf8") !== file.content) throw new Error(`Metadata-audit file changed: ${path}`);
     } catch (error) {
       if (error.code !== "ENOENT" || requireAfter) throw error;
     }
@@ -6235,8 +6429,8 @@ async function assertMetadataStateGuards(journal, after, guards, transport, requ
 }
 async function writeAuditFileExclusive(path, content) {
   await assertNoSymlinkPath(path);
-  await mkdir11(dirname14(path), { recursive: true });
-  await syncMetadataPath(dirname14(dirname14(path)), true);
+  await mkdir11(dirname15(path), { recursive: true });
+  await syncMetadataPath(dirname15(dirname15(path)), true);
   const temporary = `${path}.pending-${randomUUID3()}`;
   try {
     const handle = await open4(temporary, "wx", 384);
@@ -6249,9 +6443,9 @@ async function writeAuditFileExclusive(path, content) {
     try {
       await link2(temporary, path);
     } catch (error) {
-      if (error.code !== "EEXIST" || await readFile18(path, "utf8") !== content) throw error;
+      if (error.code !== "EEXIST" || await readFile19(path, "utf8") !== content) throw error;
     }
-    const directory = await open4(dirname14(path), "r");
+    const directory = await open4(dirname15(path), "r");
     try {
       await directory.sync();
     } finally {
@@ -6710,7 +6904,7 @@ async function assertBaseRevision(plan, transport) {
 async function assertTargetStateFilePreconditions(plan, transport, graphLockWritePath) {
   const expected = plan.targetStateFilePreconditions;
   if (!expected) return;
-  if (graphLockWritePath && resolve16(graphLockWritePath) !== resolve16(expected.graphLockPath)) {
+  if (graphLockWritePath && resolve17(graphLockWritePath) !== resolve17(expected.graphLockPath)) {
     throw new Error(
       `Graph-lock destination changed after planning: expected ${expected.graphLockPath}, found ${graphLockWritePath}; replan needed.`
     );
@@ -6903,7 +7097,7 @@ async function validateOpenClawConfig(configPath, destPath, transport) {
   if (!transport.execFile) {
     throw new Error(`Cannot validate OpenClaw config over ${transport.description}: transport does not support command execution.`);
   }
-  const openClawHome = dirname14(destPath);
+  const openClawHome = dirname15(destPath);
   const bundledBin = join13(openClawHome, "npm", "node_modules", ".bin", "openclaw");
   const script = String.raw`
 set -euo pipefail
@@ -6954,8 +7148,8 @@ __export(identify_exports, {
   inferSourceDriverName: () => inferSourceDriverName,
   isExplicitSource: () => isExplicitSource
 });
-import { homedir as homedir9 } from "os";
-import { resolve as resolve23 } from "path";
+import { homedir as homedir10 } from "os";
+import { resolve as resolve24 } from "path";
 function inferSourceDriverName(source) {
   if (source.startsWith("clawhub:")) return "clawhub";
   if (source.startsWith("mcp-registry:")) return "mcp-registry";
@@ -6973,9 +7167,9 @@ async function isExplicitSource(source) {
   return pathExists(resolveLocalPath(source));
 }
 function resolveLocalPath(source) {
-  if (source === "~") return homedir9();
-  if (source.startsWith("~/")) return resolve23(homedir9(), source.slice(2));
-  return resolve23(source);
+  if (source === "~") return homedir10();
+  if (source.startsWith("~/")) return resolve24(homedir10(), source.slice(2));
+  return resolve24(source);
 }
 var init_identify = __esm({
   "src/source/identify.ts"() {
@@ -6985,11 +7179,11 @@ var init_identify = __esm({
 });
 
 // src/cli/index.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 import { existsSync } from "fs";
 import { mkdir as mkdir27, mkdtemp as mkdtemp6, readFile as readFile45, realpath as realpath4, rm as rm17, writeFile as writeFile24 } from "fs/promises";
 import { homedir as homedir18, tmpdir as tmpdir7 } from "os";
-import { basename as basename24, dirname as dirname37, isAbsolute as isAbsolute14, join as join61, relative as relative19, resolve as resolve44 } from "path";
+import { basename as basename24, dirname as dirname38, isAbsolute as isAbsolute14, join as join62, relative as relative19, resolve as resolve45 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command } from "commander";
 
@@ -7077,12 +7271,12 @@ init_manifest2();
 // src/install/plan.ts
 init_adapter();
 init_manifest();
-import { basename as basename8, join as join24, relative as relative9 } from "path";
+import { basename as basename8, join as join24, relative as relative10 } from "path";
 
 // src/staging/codex-subagents.ts
 init_fs();
-import { mkdir as mkdir12, readFile as readFile19, writeFile as writeFile13 } from "fs/promises";
-import { basename as basename4, dirname as dirname15, join as join14 } from "path";
+import { mkdir as mkdir12, readFile as readFile20, writeFile as writeFile13 } from "fs/promises";
+import { basename as basename4, dirname as dirname16, join as join14 } from "path";
 import { parse as parseYaml } from "yaml";
 var requiredCodexAgentFields = ["name", "description", "developer_instructions"];
 async function renderCodexSubagents(artifacts, stageRoot, adapter) {
@@ -7109,7 +7303,7 @@ async function renderCodexSubagent(artifact, stageRoot) {
   const renderedPath = join14(stageRoot, ".agentwheel-rendered", "codex-subagents", `${agentName}.toml`);
   const lowerSourcePath = sourcePath.toLowerCase();
   if (artifact.kind === "file" && (artifact.name.toLowerCase().endsWith(".toml") || lowerSourcePath.endsWith(".toml"))) {
-    const content = await readFile19(sourcePath, "utf8");
+    const content = await readFile20(sourcePath, "utf8");
     validateCodexAgentToml(content, sourcePath);
     return {
       ...artifact,
@@ -7126,9 +7320,9 @@ async function renderCodexSubagent(artifact, stageRoot) {
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !lowerSourcePath.endsWith(".md")) {
     throw new Error(`Codex subagent ${artifact.relativePath} must be a .toml file, .md file, or directory containing AGENTS.md.`);
   }
-  const markdown = await readFile19(markdownPath, "utf8");
+  const markdown = await readFile20(markdownPath, "utf8");
   const toml = markdownToCodexAgentToml(agentName, markdown);
-  await mkdir12(dirname15(renderedPath), { recursive: true });
+  await mkdir12(dirname16(renderedPath), { recursive: true });
   await writeFile13(renderedPath, toml, "utf8");
   return {
     ...artifact,
@@ -7210,8 +7404,8 @@ function escapeRegExp2(value) {
 
 // src/staging/copilot-artifacts.ts
 init_fs();
-import { mkdir as mkdir13, readFile as readFile20, writeFile as writeFile14 } from "fs/promises";
-import { basename as basename5, dirname as dirname16, join as join15 } from "path";
+import { mkdir as mkdir13, readFile as readFile21, writeFile as writeFile14 } from "fs/promises";
+import { basename as basename5, dirname as dirname17, join as join15 } from "path";
 async function renderCopilotArtifacts(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "copilot") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -7241,8 +7435,8 @@ async function renderCopilotSubagent(artifact, stageRoot) {
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md")) {
     throw new Error(`Copilot subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const markdown = await readFile20(markdownPath, "utf8");
-  await mkdir13(dirname16(renderedPath), { recursive: true });
+  const markdown = await readFile21(markdownPath, "utf8");
+  await mkdir13(dirname17(renderedPath), { recursive: true });
   await writeFile14(renderedPath, ensureCopilotAgentDescription(agentName, markdown), "utf8");
   return {
     ...artifact,
@@ -7297,8 +7491,8 @@ function yamlString(value) {
 
 // src/staging/openclaw-subagents.ts
 init_fs();
-import { mkdir as mkdir14, readFile as readFile21, writeFile as writeFile15 } from "fs/promises";
-import { basename as basename6, dirname as dirname17, join as join16 } from "path";
+import { mkdir as mkdir14, readFile as readFile22, writeFile as writeFile15 } from "fs/promises";
+import { basename as basename6, dirname as dirname18, join as join16 } from "path";
 async function renderOpenClawSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "openclaw") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -7327,15 +7521,15 @@ async function renderOpenClawSubagent(artifact, stageRoot) {
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !sourcePath.toLowerCase().endsWith(".md")) {
     throw new Error(`OpenClaw subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const parsed = splitFrontmatter3(await readFile21(markdownPath, "utf8"));
+  const parsed = splitFrontmatter3(await readFile22(markdownPath, "utf8"));
   const body = parsed.body.trim().length > 0 ? parsed.body.trim() : `# ${titleFromAgentId(agentId)}
 
 ${parsed.description ?? `OpenClaw subagent ${agentId}.`}`;
   const renderedPath = join16(stageRoot, ".agentwheel-rendered", "openclaw-subagents", agentId, "AGENTS.md");
-  await mkdir14(dirname17(renderedPath), { recursive: true });
+  await mkdir14(dirname18(renderedPath), { recursive: true });
   await writeFile15(renderedPath, `${body}
 `, "utf8");
-  const renderedDir = dirname17(renderedPath);
+  const renderedDir = dirname18(renderedPath);
   return {
     ...artifact,
     name: agentId,
@@ -7370,7 +7564,7 @@ import { join as join18 } from "path";
 
 // src/targets/plugins/common.ts
 init_fs();
-import { readFile as readFile22 } from "fs/promises";
+import { readFile as readFile23 } from "fs/promises";
 import { join as join17 } from "path";
 import { parseDocument } from "yaml";
 function pluginStateRoot(request) {
@@ -7394,14 +7588,14 @@ function safeNameSegment(value) {
 async function jsonPluginName(root, relativeManifestPath, fallback) {
   const manifestPath = join17(root, relativeManifestPath);
   if (!await pathExists(manifestPath)) return fallback;
-  const parsed = JSON.parse(await readFile22(manifestPath, "utf8"));
+  const parsed = JSON.parse(await readFile23(manifestPath, "utf8"));
   return typeof parsed.name === "string" && parsed.name.trim().length > 0 ? parsed.name.trim() : fallback;
 }
 async function yamlPluginName(root, relativeManifestPaths, fallback) {
   for (const relativeManifestPath of relativeManifestPaths) {
     const manifestPath = join17(root, relativeManifestPath);
     if (!await pathExists(manifestPath)) continue;
-    const document = parseDocument(await readFile22(manifestPath, "utf8"));
+    const document = parseDocument(await readFile23(manifestPath, "utf8"));
     const parsed = document.toJSON();
     if (!isRecord5(parsed)) continue;
     for (const key of ["name", "module", "package"]) {
@@ -7534,7 +7728,7 @@ async function hermesPluginSpec(request) {
 
 // src/targets/plugins/openclaw.ts
 init_fs();
-import { readFile as readFile23 } from "fs/promises";
+import { readFile as readFile24 } from "fs/promises";
 import { join as join22 } from "path";
 function openClawPluginInstallCommand(request) {
   return ["openclaw", "plugins", "install", "--force", request.path];
@@ -7564,7 +7758,7 @@ async function openClawPluginName(root, fallback) {
   for (const manifestName of ["plugin.json", "openclaw.plugin.json"]) {
     const manifestPath = join22(root, manifestName);
     if (!await pathExists(manifestPath)) continue;
-    const parsed = JSON.parse(await readFile23(manifestPath, "utf8"));
+    const parsed = JSON.parse(await readFile24(manifestPath, "utf8"));
     if (typeof parsed.name === "string" && parsed.name.trim().length > 0) return parsed.name.trim();
   }
   return fallback;
@@ -7574,7 +7768,7 @@ async function openClawClawHubPluginMetadata(root, fallback) {
   if (!await pathExists(metadataPath)) {
     throw new Error("OpenClaw ClawHub plugins must contain clawhub.json");
   }
-  const parsed = JSON.parse(await readFile23(metadataPath, "utf8"));
+  const parsed = JSON.parse(await readFile24(metadataPath, "utf8"));
   const installSpec = stringField(parsed.installSpec);
   if (!installSpec?.startsWith("clawhub:")) {
     throw new Error("OpenClaw ClawHub plugin metadata must declare installSpec starting with clawhub:");
@@ -7663,7 +7857,7 @@ function skipWarning(selector, adapter, installationType, artifactType, support)
 init_adapter();
 init_selection();
 init_fs();
-import { readFile as readFile24 } from "fs/promises";
+import { readFile as readFile25 } from "fs/promises";
 import { basename as basename7, join as join23 } from "path";
 import { parseDocument as parseDocument2 } from "yaml";
 var behavioralRuleFormats = ["markdown-rule", "claude-markdown-rule", "copilot-instruction-rule"];
@@ -7868,7 +8062,7 @@ async function validateGenericStructure(artifact, target) {
 async function validateSkillFrontmatter(artifact, skillMdPath) {
   let content;
   try {
-    content = await readFile24(skillMdPath, "utf8");
+    content = await readFile25(skillMdPath, "utf8");
   } catch (error) {
     return [{ artifact, message: `could not read SKILL.md: ${errorMessage(error)}` }];
   }
@@ -7938,7 +8132,7 @@ async function validateHermesPlugin(artifact) {
     return [{ artifact, message: "Hermes plugins must contain plugin.yaml or plugin.yml" }];
   }
   try {
-    const document = parseDocument2(await readFile24(manifestPath, "utf8"));
+    const document = parseDocument2(await readFile25(manifestPath, "utf8"));
     if (document.errors.length > 0) {
       return [{ artifact, message: `Hermes ${basename7(manifestPath)} must be valid YAML: ${document.errors[0]?.message ?? "parse error"}` }];
     }
@@ -7962,7 +8156,7 @@ async function firstExistingPath(paths) {
 }
 async function parseJsonPluginManifest(manifestPath, label) {
   try {
-    const parsed = JSON.parse(await readFile24(manifestPath, "utf8"));
+    const parsed = JSON.parse(await readFile25(manifestPath, "utf8"));
     if (!isRecord6(parsed)) {
       return { ok: false, message: `${label} ${basename7(manifestPath)} must be a JSON object` };
     }
@@ -8009,7 +8203,7 @@ async function validateOpenClawClawHubPlugin(artifact) {
     return [{ artifact, message: "OpenClaw ClawHub plugins must contain clawhub.json" }];
   }
   try {
-    const parsed = JSON.parse(await readFile24(metadataPath, "utf8"));
+    const parsed = JSON.parse(await readFile25(metadataPath, "utf8"));
     if (!isRecord6(parsed)) {
       return [{ artifact, message: "OpenClaw ClawHub clawhub.json must be a JSON object" }];
     }
@@ -8033,7 +8227,7 @@ async function openClawPluginManifestPaths(artifact) {
 async function parseOpenClawPluginManifest(manifestPath) {
   const manifestName = basename7(manifestPath);
   try {
-    const parsed = JSON.parse(await readFile24(manifestPath, "utf8"));
+    const parsed = JSON.parse(await readFile25(manifestPath, "utf8"));
     if (!isRecord6(parsed)) {
       return { ok: false, path: manifestPath, message: `OpenClaw ${manifestName} must be a JSON object` };
     }
@@ -8050,7 +8244,7 @@ async function parseJsonObjectArtifact(artifact) {
     return { ok: false, message: "merge artifacts must be JSON files" };
   }
   try {
-    const parsed = JSON.parse(await readFile24(artifactPath(artifact), "utf8"));
+    const parsed = JSON.parse(await readFile25(artifactPath(artifact), "utf8"));
     if (!isRecord6(parsed)) return { ok: false, message: "merge artifacts must contain a JSON object" };
     return { ok: true, value: parsed };
   } catch (error) {
@@ -8062,7 +8256,7 @@ async function parseYamlObjectArtifact(artifact) {
     return { ok: false, message: "merge artifacts must be YAML files" };
   }
   try {
-    const document = parseDocument2(await readFile24(artifactPath(artifact), "utf8"));
+    const document = parseDocument2(await readFile25(artifactPath(artifact), "utf8"));
     if (document.errors.length > 0) {
       return { ok: false, message: `merge artifact must be valid YAML: ${document.errors[0]?.message ?? "parse error"}` };
     }
@@ -8784,7 +8978,7 @@ async function operationForArtifact(artifact, adapter, targetRoot, installationT
       kind: "file",
       sourcePath: artifact.stagedPath ?? artifact.sourcePath,
       destPath: destPath2,
-      relativeDestPath: relative9(targetRoot, destPath2).replaceAll("\\", "/"),
+      relativeDestPath: relative10(targetRoot, destPath2).replaceAll("\\", "/"),
       desiredHash: artifact.hash,
       reason: "destination missing",
       channel: artifact.channel ?? "managed",
@@ -8802,7 +8996,7 @@ async function operationForArtifact(artifact, adapter, targetRoot, installationT
     kind: artifact.kind,
     sourcePath: artifact.stagedPath ?? artifact.sourcePath,
     destPath,
-    relativeDestPath: relative9(targetRoot, destPath).replaceAll("\\", "/"),
+    relativeDestPath: relative10(targetRoot, destPath).replaceAll("\\", "/"),
     desiredHash: artifact.hash,
     reason: "destination missing",
     channel: artifact.channel ?? "managed",
@@ -9799,14 +9993,14 @@ async function writeMermaidAsset(response) {
     "content-type": "application/javascript; charset=utf-8",
     "cache-control": "public, max-age=3600"
   });
-  await new Promise((resolve45) => {
+  await new Promise((resolve46) => {
     const stream = createReadStream(assetPath);
     stream.on("error", () => {
       if (!response.headersSent) writeText(response, 404, "Mermaid asset unavailable.\n");
       else response.destroy();
-      resolve45();
+      resolve46();
     });
-    stream.on("end", resolve45);
+    stream.on("end", resolve46);
     stream.pipe(response);
   });
 }
@@ -9833,14 +10027,14 @@ function escapeHtml2(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 function listen(server, port, bind) {
-  return new Promise((resolve45, reject) => {
+  return new Promise((resolve46, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
       reject(error);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve45();
+      resolve46();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -9848,7 +10042,7 @@ function listen(server, port, bind) {
   });
 }
 function waitForShutdown(server, beforeClose) {
-  return new Promise((resolve45) => {
+  return new Promise((resolve46) => {
     let closing = false;
     const shutdown = () => {
       if (closing) return;
@@ -9856,7 +10050,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      server.close(() => resolve45());
+      server.close(() => resolve46());
     };
     process.once("SIGINT", shutdown);
     process.once("SIGTERM", shutdown);
@@ -9866,7 +10060,7 @@ function waitForShutdown(server, beforeClose) {
       process.off("SIGINT", shutdown);
       process.off("SIGTERM", shutdown);
       beforeClose();
-      resolve45();
+      resolve46();
     });
   });
 }
@@ -9885,13 +10079,13 @@ function errorMessage2(error) {
 
 // src/source/clawhub.ts
 import { mkdir as mkdir15, rm as rm8, writeFile as writeFile16 } from "fs/promises";
-import { basename as basename10, dirname as dirname18, join as join28, resolve as resolve18 } from "path";
+import { basename as basename10, dirname as dirname19, join as join28, resolve as resolve19 } from "path";
 
 // src/model/package.ts
 init_artifact();
 init_fs();
 init_artifact();
-import { readFile as readFile25 } from "fs/promises";
+import { readFile as readFile26 } from "fs/promises";
 import { join as join26 } from "path";
 import { parse as parse4, printParseErrorCode as printParseErrorCode2 } from "jsonc-parser";
 import { z as z11 } from "zod";
@@ -9999,7 +10193,7 @@ async function findPackageManifestPath(root, options = {}) {
 async function readPackageManifest(root) {
   const path = await findPackageManifestPath(root);
   if (!path) return void 0;
-  const content = await readFile25(path, "utf8");
+  const content = await readFile26(path, "utf8");
   const errors = [];
   const parsed = parse4(content, errors, { allowTrailingComma: true, disallowComments: false });
   if (errors.length > 0) {
@@ -10079,12 +10273,12 @@ init_fs();
 // src/source/local.ts
 import { createHash as createHash13 } from "crypto";
 import { readdir as readdir6, stat as stat5 } from "fs/promises";
-import { basename as basename9, join as join27, relative as relative10, resolve as resolve17 } from "path";
+import { basename as basename9, join as join27, relative as relative11, resolve as resolve18 } from "path";
 init_fs();
 var LocalSourceDriver = class {
   name = "local";
   async resolve(source) {
-    const resolvedPath = resolve17(source);
+    const resolvedPath = resolve18(source);
     if (!await pathExists(resolvedPath)) {
       throw new Error(`Local source not found: ${resolvedPath}`);
     }
@@ -10224,7 +10418,7 @@ async function hashLocalSource(root, manifest) {
   const manifestPath = await findPackageManifestPath(root, { warnLegacy: false });
   if (manifestPath) {
     hash2.update("manifest\0");
-    hash2.update(relative10(root, manifestPath).replaceAll("\\", "/")).update("\0");
+    hash2.update(relative11(root, manifestPath).replaceAll("\\", "/")).update("\0");
     hash2.update(await hashPath(manifestPath)).update("\0");
   }
   const provides = [...manifest.provides].sort((a, b) => `${a.type}\0${a.path}`.localeCompare(`${b.type}\0${b.path}`));
@@ -10426,7 +10620,7 @@ async function fetchClawHubPackage(fetchImpl, packageName) {
   throw new Error(`ClawHub lookup failed for ${packageName}`);
 }
 async function delay(ms) {
-  await new Promise((resolve45) => setTimeout(resolve45, ms));
+  await new Promise((resolve46) => setTimeout(resolve46, ms));
 }
 function parseClawHubSource(source) {
   if (!source.startsWith(sourcePrefix)) {
@@ -10458,7 +10652,7 @@ async function writeGeneratedPackage(root, packageInfo) {
   };
   const pluginPath = join28(root, "plugins", pluginId, "clawhub.json");
   await rm8(root, { recursive: true, force: true });
-  await mkdir15(dirname18(pluginPath), { recursive: true });
+  await mkdir15(dirname19(pluginPath), { recursive: true });
   await writeFile16(join28(root, "openpack.json"), `${JSON.stringify({
     schemaVersion: CURRENT_OPENPACK_SCHEMA_VERSION,
     name: `clawhub/${name}`,
@@ -10482,7 +10676,7 @@ function installNameFor2(value) {
   return basename10(value).replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "clawhub-plugin";
 }
 function cachePathFor(packageName, cacheRoot) {
-  const root = cacheRoot ? resolve18(cacheRoot) : join28(process.env.HOME ?? ".", ".agentwheel", "cache");
+  const root = cacheRoot ? resolve19(cacheRoot) : join28(process.env.HOME ?? ".", ".agentwheel", "cache");
   const slug2 = `clawhub-${packageName}`.replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "");
   return join28(root, slug2 || "clawhub-package");
 }
@@ -10490,14 +10684,14 @@ function cachePathFor(packageName, cacheRoot) {
 // src/source/git.ts
 import { execFile as execFile5 } from "child_process";
 import { mkdir as mkdir17, rename as rename6, rm as rm10, stat as stat7 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { basename as basename11, dirname as dirname20, join as join31, resolve as resolve19, sep as sep6 } from "path";
+import { homedir as homedir8 } from "os";
+import { basename as basename11, dirname as dirname21, join as join31, resolve as resolve20, sep as sep6 } from "path";
 import { promisify as promisify5 } from "util";
 init_fs();
 
 // src/source/auth.ts
-import { readFile as readFile26 } from "fs/promises";
-import { homedir as homedir6 } from "os";
+import { readFile as readFile27 } from "fs/promises";
+import { homedir as homedir7 } from "os";
 import { join as join29 } from "path";
 var AUTH_CONFIG_ENV = "AGENTWHEEL_AUTH_CONFIG";
 async function gitAuthArguments(url) {
@@ -10520,9 +10714,9 @@ async function matchingGitAuthProfile(url) {
   );
 }
 async function readGitAuthConfig() {
-  const path = process.env[AUTH_CONFIG_ENV] ?? join29(homedir6(), ".agentwheel", "auth.json");
+  const path = process.env[AUTH_CONFIG_ENV] ?? join29(homedir7(), ".agentwheel", "auth.json");
   try {
-    const parsed = JSON.parse(await readFile26(path, "utf8"));
+    const parsed = JSON.parse(await readFile27(path, "utf8"));
     return parseGitAuthConfig(parsed, path);
   } catch (error) {
     if (isMissingFile(error)) return void 0;
@@ -10573,8 +10767,8 @@ function isMissingFile(error) {
 // src/source/cache.ts
 init_fs();
 import { randomUUID as randomUUID4 } from "crypto";
-import { mkdir as mkdir16, readdir as readdir7, readFile as readFile27, rm as rm9, stat as stat6, writeFile as writeFile17 } from "fs/promises";
-import { dirname as dirname19, join as join30 } from "path";
+import { mkdir as mkdir16, readdir as readdir7, readFile as readFile28, rm as rm9, stat as stat6, writeFile as writeFile17 } from "fs/promises";
+import { dirname as dirname20, join as join30 } from "path";
 var snapshotNamePattern = /^(.*)-([0-9a-f]{12})$/i;
 var leaseMarker = ".agentwheel-lease-";
 async function pruneGitCache(cacheRoot, options = {}) {
@@ -10605,7 +10799,7 @@ async function withGitCacheMaintenanceLock(cacheRoot, timeoutMs, fn) {
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for git cache maintenance lock at ${lockPath}`);
       }
-      await new Promise((resolve45) => setTimeout(resolve45, 50));
+      await new Promise((resolve46) => setTimeout(resolve46, 50));
     }
   }
   try {
@@ -10642,7 +10836,7 @@ async function removeGeneratedEntries(root, preserveGit) {
   }
 }
 async function pruneGitCacheUnlocked(cacheRoot, options) {
-  const referencedCommits = await referencedGraphLockCommits(join30(dirname19(cacheRoot), "locks"));
+  const referencedCommits = await referencedGraphLockCommits(join30(dirname20(cacheRoot), "locks"));
   const entries = await readdir7(cacheRoot, { withFileTypes: true });
   const groups = /* @__PURE__ */ new Map();
   for (const entry of entries) {
@@ -10701,7 +10895,7 @@ async function walkGraphLocks(root, visit) {
       await walkGraphLocks(path, visit);
     } else if (entry.isFile() && entry.name.endsWith(".graph-lock.json")) {
       try {
-        visit(JSON.parse(await readFile27(path, "utf8")));
+        visit(JSON.parse(await readFile28(path, "utf8")));
       } catch (error) {
         throw new Error(`Cannot read graph lock ${path}; cache prune aborted: ${errorMessage3(error)}`);
       }
@@ -10709,7 +10903,7 @@ async function walkGraphLocks(root, visit) {
   }
 }
 async function hasLiveSnapshotLease(snapshotPath, dryRun) {
-  const directory = dirname19(snapshotPath);
+  const directory = dirname20(snapshotPath);
   const prefix = `${snapshotPath.slice(directory.length + 1)}${leaseMarker}`;
   const entries = await readdir7(directory, { withFileTypes: true });
   let live = false;
@@ -10717,7 +10911,7 @@ async function hasLiveSnapshotLease(snapshotPath, dryRun) {
     if (!entry.isFile() || !entry.name.startsWith(prefix)) continue;
     const leasePath = join30(directory, entry.name);
     try {
-      const value = JSON.parse(await readFile27(leasePath, "utf8"));
+      const value = JSON.parse(await readFile28(leasePath, "utf8"));
       if (typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0) {
         live = true;
       } else if (isProcessAlive2(value.pid)) {
@@ -10733,7 +10927,7 @@ async function hasLiveSnapshotLease(snapshotPath, dryRun) {
 }
 async function removeStaleMaintenanceLock(lockPath) {
   try {
-    const value = JSON.parse(await readFile27(join30(lockPath, "owner.json"), "utf8"));
+    const value = JSON.parse(await readFile28(join30(lockPath, "owner.json"), "utf8"));
     if (typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0 || isProcessAlive2(value.pid)) {
       return false;
     }
@@ -10848,7 +11042,7 @@ var GitSourceDriver = class {
   async fetch(resolved) {
     return withFilesystemLock(`${resolved.resolvedPath}.lock`, resolved.cacheLockTimeoutMs ?? 3e4, async () => {
       const parsed = parseGitSource(resolved.source);
-      const cacheRoot = dirname20(resolved.resolvedPath);
+      const cacheRoot = dirname21(resolved.resolvedPath);
       await mkdir17(cacheRoot, { recursive: true });
       await assertOwnedByCurrentUser(cacheRoot);
       if (await pathExists(resolved.resolvedPath)) await assertOwnedByCurrentUser(resolved.resolvedPath);
@@ -10922,7 +11116,7 @@ async function isDirectory(path) {
   }
 }
 function cachePathFor2(url, cacheRoot) {
-  const root = cacheRoot ? resolve19(cacheRoot) : join31(homedir7(), ".agentwheel", "cache");
+  const root = cacheRoot ? resolve20(cacheRoot) : join31(homedir8(), ".agentwheel", "cache");
   const slug2 = url.replace(/^[a-z]+:\/\//i, "").replace(/\.git$/i, "").replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "");
   return join31(root, slug2 || basename11(url));
 }
@@ -10943,9 +11137,9 @@ async function resolveCommit(checkoutPath, ref) {
   throw lastError;
 }
 async function snapshotCommit(checkoutPath, commit) {
-  const snapshotPath = join31(dirname20(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
+  const snapshotPath = join31(dirname21(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
   if (await pathExists(snapshotPath)) return snapshotPath;
-  const tempPath = join31(dirname20(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
+  const tempPath = join31(dirname21(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
   const tempIndexPath = `${tempPath}.index`;
   await rm10(tempPath, { recursive: true, force: true });
   await rm10(tempIndexPath, { force: true });
@@ -10953,7 +11147,7 @@ async function snapshotCommit(checkoutPath, commit) {
   const env2 = { ...process.env, GIT_INDEX_FILE: tempIndexPath };
   try {
     await git(["-C", checkoutPath, "read-tree", commit], env2);
-    await git(["-C", checkoutPath, "checkout-index", "--all", `--prefix=${resolve19(tempPath)}${sep6}`], env2);
+    await git(["-C", checkoutPath, "checkout-index", "--all", `--prefix=${resolve20(tempPath)}${sep6}`], env2);
     await removeGeneratedEntries(tempPath, false);
   } catch (error) {
     await rm10(tempPath, { recursive: true, force: true });
@@ -10983,7 +11177,7 @@ async function assertOwnedByCurrentUser(path) {
 
 // src/source/mcp-registry.ts
 import { mkdir as mkdir18, writeFile as writeFile18 } from "fs/promises";
-import { basename as basename12, dirname as dirname21, join as join32, resolve as resolve20 } from "path";
+import { basename as basename12, dirname as dirname22, join as join32, resolve as resolve21 } from "path";
 init_fs();
 var registryBaseUrl = "https://registry.modelcontextprotocol.io/v0.1";
 var sourcePrefix2 = "mcp-registry:";
@@ -11091,7 +11285,7 @@ function isSafeHttpUrl(value) {
 async function writeGeneratedPackage2(root, server) {
   const serverId = installNameFor3(server.serverName);
   const mcpPath = join32(root, "mcp", `${serverId}.json`);
-  await mkdir18(dirname21(mcpPath), { recursive: true });
+  await mkdir18(dirname22(mcpPath), { recursive: true });
   await writeFile18(join32(root, "openpack.json"), `${JSON.stringify({
     schemaVersion: CURRENT_OPENPACK_SCHEMA_VERSION,
     name: `mcp-registry/${server.serverName}`,
@@ -11113,7 +11307,7 @@ function installNameFor3(serverName) {
   return basename12(serverName).replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "mcp-server";
 }
 function cachePathFor3(serverName, cacheRoot) {
-  const root = cacheRoot ? resolve20(cacheRoot) : join32(process.env.HOME ?? ".", ".agentwheel", "cache");
+  const root = cacheRoot ? resolve21(cacheRoot) : join32(process.env.HOME ?? ".", ".agentwheel", "cache");
   const slug2 = `mcp-registry-${serverName}`.replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "");
   return join32(root, slug2 || "mcp-registry-server");
 }
@@ -11123,16 +11317,16 @@ init_cache_identity();
 init_fs();
 import { createHash as createHash14, randomUUID as randomUUID5 } from "crypto";
 import { execFile as execFile6 } from "child_process";
-import { cp as cp3, mkdir as mkdir19, readFile as readFile28, rename as rename7, rm as rm11 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import { basename as basename14, dirname as dirname23, join as join34, resolve as resolve21 } from "path";
+import { cp as cp3, mkdir as mkdir19, readFile as readFile29, rename as rename7, rm as rm11 } from "fs/promises";
+import { homedir as homedir9 } from "os";
+import { basename as basename14, dirname as dirname24, join as join34, resolve as resolve22 } from "path";
 import { promisify as promisify6 } from "util";
 import * as defaultSkillKit from "@skillkit/core";
 
 // src/source/skill-artifacts.ts
 init_fs();
 import { readdir as readdir8, stat as stat8 } from "fs/promises";
-import { basename as basename13, dirname as dirname22, extname as extname2, join as join33 } from "path";
+import { basename as basename13, dirname as dirname23, extname as extname2, join as join33 } from "path";
 async function artifactsFromSkillPaths(paths, packageName) {
   const artifacts = [];
   const seen = /* @__PURE__ */ new Set();
@@ -11169,7 +11363,7 @@ async function artifactFromSkillPath(item, packageName) {
     };
   }
   if (stats.isFile() && basename13(item.path).toLowerCase() === "skill.md") {
-    const dir = dirname22(item.path);
+    const dir = dirname23(item.path);
     const name = sanitizeSkillName(item.name ?? basename13(dir));
     return {
       type: "skills",
@@ -11225,7 +11419,7 @@ var SkillKitSourceDriver = class {
   async resolve(source, options = {}) {
     const spec = parseSkillKitSource(source);
     if (await pathExists(spec)) {
-      const resolvedPath = resolve21(spec);
+      const resolvedPath = resolve22(spec);
       return {
         driver: this.name,
         source,
@@ -11277,7 +11471,7 @@ var SkillKitSourceDriver = class {
         sourceHash: await hashPath(resolved.resolvedPath)
       };
     }
-    const specCachePath = cachePathFor4(spec, dirname23(dirname23(resolved.resolvedPath)));
+    const specCachePath = cachePathFor4(spec, dirname24(dirname24(resolved.resolvedPath)));
     const refIdentity = resolved.requestedRef ?? "default";
     const lockPath = `${specCachePath}.ref-${createHash14("sha256").update(refIdentity).digest("hex")}.lock`;
     const inflightKey = `${lockPath}\0${requestedCommit ?? "movable"}`;
@@ -11298,11 +11492,11 @@ var SkillKitSourceDriver = class {
       throw new Error("SkillKit provider API unavailable or cannot resolve source. Expected @skillkit/core detectProvider().clone().");
     }
     const materialized = await withFilesystemLock(lockPath, resolved.cacheLockTimeoutMs ?? 3e4, async () => {
-      const immutablePath = requestedCommit ? cachePathFor4(spec, dirname23(dirname23(specCachePath)), requestedCommit) : void 0;
+      const immutablePath = requestedCommit ? cachePathFor4(spec, dirname24(dirname24(specCachePath)), requestedCommit) : void 0;
       if (immutablePath && await pathExists(immutablePath)) {
         return { path: immutablePath, commit: requestedCommit, cacheIdentity: requestedCommit };
       }
-      await mkdir19(dirname23(specCachePath), { recursive: true });
+      await mkdir19(dirname24(specCachePath), { recursive: true });
       const candidatePath = `${specCachePath}.agentwheel-tmp-${process.pid}-${randomUUID5()}`;
       const publishPath = `${candidatePath}.publish`;
       let result;
@@ -11324,11 +11518,11 @@ var SkillKitSourceDriver = class {
             `SkillKit provider resolved ${resolvedIdentity.commit ?? "non-Git content"} instead of requested commit ${requestedCommit}`
           );
         }
-        const cachePath = cachePathFor4(spec, dirname23(dirname23(specCachePath)), resolvedIdentity.cacheKey);
+        const cachePath = cachePathFor4(spec, dirname24(dirname24(specCachePath)), resolvedIdentity.cacheKey);
         if (await pathExists(cachePath)) {
           return { path: cachePath, commit: resolvedIdentity.commit, cacheIdentity: resolvedIdentity.cacheKey };
         }
-        const publishCandidate = resolve21(result.path) === resolve21(candidatePath) ? candidatePath : publishPath;
+        const publishCandidate = resolve22(result.path) === resolve22(candidatePath) ? candidatePath : publishPath;
         if (publishCandidate === publishPath) await cp3(result.path, publishPath, { recursive: true, dereference: true });
         try {
           await rename7(publishCandidate, cachePath);
@@ -11382,7 +11576,7 @@ var SkillKitSourceDriver = class {
     for (const skill of this.discover(resolved.resolvedPath)) {
       const skillMd = join34(skill.path, "SKILL.md");
       if (await pathExists(skillMd)) {
-        this.core.translateSkill(await readFile28(skillMd, "utf8"), "openclaw", { sourceFilename: "SKILL.md" });
+        this.core.translateSkill(await readFile29(skillMd, "utf8"), "openclaw", { sourceFilename: "SKILL.md" });
       }
     }
     return resolved;
@@ -11411,7 +11605,7 @@ function normalizeProviderSource(spec) {
   return spec;
 }
 function cachePathFor4(spec, cacheRoot, immutableIdentity) {
-  const root = cacheRoot ? resolve21(cacheRoot) : join34(homedir8(), ".agentwheel", "cache");
+  const root = cacheRoot ? resolve22(cacheRoot) : join34(homedir9(), ".agentwheel", "cache");
   const sourceIdentity = createHash14("sha256").update(spec).digest("hex");
   const snapshotIdentity = immutableIdentity ? `-${immutableIdentity.toLowerCase()}` : "";
   return join34(root, "skillkit", `${packageSlug(spec)}-${sourceIdentity}${snapshotIdentity}`);
@@ -11458,14 +11652,14 @@ async function checkoutCommit(root, commit) {
 // src/source/vercel-skills.ts
 init_fs();
 import { stat as stat9 } from "fs/promises";
-import { basename as basename15, join as join35, relative as relative11, resolve as resolve22 } from "path";
+import { basename as basename15, join as join35, relative as relative12, resolve as resolve23 } from "path";
 var VercelSkillsSourceDriver = class {
   name = "vercel-skills";
   git = new GitSourceDriver();
   async resolve(source, options = {}) {
     const parsed = parseVercelSource(source);
     if (parsed.kind === "local") {
-      const resolvedPath = resolve22(parsed.path);
+      const resolvedPath = resolve23(parsed.path);
       if (!await pathExists(resolvedPath) || !(await stat9(resolvedPath)).isDirectory()) {
         throw new Error(`Vercel skills local source not found: ${resolvedPath}`);
       }
@@ -11525,7 +11719,7 @@ async function resolveVercelSkillSubpath(root, subpath) {
   for (const candidate of candidates) {
     if (await pathExists(candidate)) return candidate;
   }
-  const tried = candidates.map((candidate) => relative11(root, candidate)).join(", ");
+  const tried = candidates.map((candidate) => relative12(root, candidate)).join(", ");
   throw new Error(`Vercel skills subpath not found: ${subpath} (tried ${tried})`);
 }
 function parseVercelSource(source) {
@@ -11595,7 +11789,7 @@ init_identify();
 
 // src/staging/staging.ts
 import { chmod as chmod3, cp as cp5, mkdir as mkdir22, mkdtemp as mkdtemp4, readdir as readdir11, stat as stat12 } from "fs/promises";
-import { basename as basename19, dirname as dirname27, join as join39, relative as relative13, resolve as resolve25, sep as sep8 } from "path";
+import { basename as basename19, dirname as dirname28, join as join39, relative as relative14, resolve as resolve26, sep as sep8 } from "path";
 import { tmpdir as tmpdir5 } from "os";
 init_fs();
 
@@ -11603,8 +11797,8 @@ init_fs();
 init_artifact();
 init_fs();
 import { createHash as createHash15 } from "crypto";
-import { readdir as readdir9, readFile as readFile29, stat as stat10, writeFile as writeFile19 } from "fs/promises";
-import { basename as basename16, dirname as dirname24, extname as extname3, join as join36, relative as relative12, resolve as resolve24, sep as sep7 } from "path";
+import { readdir as readdir9, readFile as readFile30, stat as stat10, writeFile as writeFile19 } from "fs/promises";
+import { basename as basename16, dirname as dirname25, extname as extname3, join as join36, relative as relative13, resolve as resolve25, sep as sep7 } from "path";
 var includePattern = /<!--\s*openpack:include(\?)?\s+([^>]+?)\s*-->/g;
 var escapedIncludePattern = /<!--\s*openpack\\:include(\?)?\s+([^>]+?)\s*-->/g;
 var generatedPattern = /<!--\s*(?:BEGIN|END)\s+openpack:include\b/;
@@ -11650,7 +11844,7 @@ async function validateMarkdownIncludes(artifacts, packageRoot, options = {}) {
   }
 }
 async function expandFile(file, packageRoot, appendEntries, artifactPaths, options) {
-  const raw = await readFile29(file, "utf8");
+  const raw = await readFile30(file, "utf8");
   const owner = ownerSelector(packageRoot, file, options.nodeId);
   const expanded = await expandContent(raw, packageRoot, [owner], artifactPaths, options);
   let content = expanded.content;
@@ -11752,14 +11946,14 @@ async function expandInclude(selector, packageRoot, artifactPaths, options) {
   if (!stats.isFile()) {
     throw new Error(`OpenPack include is not a file: ${displaySelector}`);
   }
-  const raw = sourceContent ?? await readFile29(sourcePath, "utf8");
+  const raw = sourceContent ?? await readFile30(sourcePath, "utf8");
   const { optional: _optional, markers: _markers, chain: _chain, ...childOptions } = options;
   const expanded = await expandContent(raw, includePackageRoot, [...options.chain, displaySelector], includeArtifactPaths, {
     ...childOptions,
     nodeId: includeNodeId
   });
   const contentHash = sha2563(expanded.content);
-  const identity = `${includeNodeId ?? resolve24(includePackageRoot)}\0${parsed.selector}\0${contentHash}`;
+  const identity = `${includeNodeId ?? resolve25(includePackageRoot)}\0${parsed.selector}\0${contentHash}`;
   const ownEntry = { selector: displaySelector, hash: contentHash };
   const composedFrom = uniqueComposedFrom([ownEntry, ...expanded.composedFrom]);
   if (!options.markers) return { rendered: expanded.content, composedFrom, identity };
@@ -11812,8 +12006,8 @@ function extractOpenPackIncludeSelectors(content) {
   return selectors;
 }
 function resolvePackageSelector(packageRoot, selector) {
-  const root = resolve24(packageRoot);
-  const resolved = resolve24(root, selector);
+  const root = resolve25(packageRoot);
+  const resolved = resolve25(root, selector);
   if (resolved !== root && !resolved.startsWith(`${root}${sep7}`)) {
     throw new Error(`OpenPack include escapes package root: ${selector}`);
   }
@@ -11843,12 +12037,12 @@ async function listMarkdownFiles(root) {
 }
 function composeEntriesForFile(artifact, file) {
   if (!artifact.compose?.length) return [];
-  if (artifact.kind === "file") return [resolve24(artifact.stagedPath ?? artifact.sourcePath), resolve24(file)].every(Boolean) && resolve24(artifact.stagedPath ?? artifact.sourcePath) === resolve24(file) ? artifact.compose : [];
-  return basename16(file) === "SKILL.md" && dirname24(file) === resolve24(artifact.stagedPath ?? artifact.sourcePath) ? artifact.compose : [];
+  if (artifact.kind === "file") return [resolve25(artifact.stagedPath ?? artifact.sourcePath), resolve25(file)].every(Boolean) && resolve25(artifact.stagedPath ?? artifact.sourcePath) === resolve25(file) ? artifact.compose : [];
+  return basename16(file) === "SKILL.md" && dirname25(file) === resolve25(artifact.stagedPath ?? artifact.sourcePath) ? artifact.compose : [];
 }
 function isPrimaryMarkdownFile(artifact, file) {
-  if (artifact.kind === "file") return resolve24(artifact.stagedPath ?? artifact.sourcePath) === resolve24(file);
-  return basename16(file) === "SKILL.md" && dirname24(file) === resolve24(artifact.stagedPath ?? artifact.sourcePath);
+  if (artifact.kind === "file") return resolve25(artifact.stagedPath ?? artifact.sourcePath) === resolve25(file);
+  return basename16(file) === "SKILL.md" && dirname25(file) === resolve25(artifact.stagedPath ?? artifact.sourcePath);
 }
 function orderedForExpansion(artifacts) {
   return [...artifacts].sort((a, b) => Number(a.type === "fragments") - Number(b.type === "fragments"));
@@ -11865,7 +12059,7 @@ function applyReplacements(content, replacements) {
   return out + content.slice(cursor);
 }
 function relativeSelector(root, file) {
-  return relative12(root, file).replaceAll("\\", "/");
+  return relative13(root, file).replaceAll("\\", "/");
 }
 function ownerSelector(root, file, nodeId) {
   const selector = relativeSelector(root, file);
@@ -11895,8 +12089,8 @@ function artifactPathMap(artifacts) {
 
 // src/staging/customize.ts
 init_fs();
-import { cp as cp4, mkdir as mkdir20, readdir as readdir10, readFile as readFile30, writeFile as writeFile20 } from "fs/promises";
-import { dirname as dirname25, join as join37 } from "path";
+import { cp as cp4, mkdir as mkdir20, readdir as readdir10, readFile as readFile31, writeFile as writeFile20 } from "fs/promises";
+import { dirname as dirname26, join as join37 } from "path";
 async function applyCustomizations(artifacts, options) {
   let next = [...artifacts];
   next = await applyReplacements2(next, options, "override", installableArtifactTypes());
@@ -11917,10 +12111,10 @@ async function applyInstructionOverlay(artifacts, options) {
   const index = artifacts.findIndex((artifact2) => artifact2.type === "instructions");
   if (index < 0) return artifacts;
   const artifact = artifacts[index];
-  const managed = await readFile30(artifact.stagedPath ?? artifact.sourcePath, "utf8");
-  const local = await readFile30(overlayPath, "utf8");
+  const managed = await readFile31(artifact.stagedPath ?? artifact.sourcePath, "utf8");
+  const local = await readFile31(overlayPath, "utf8");
   const composedPath = join37(options.stageRoot, ".agentwheel-composed", "instructions", "AGENTS.md");
-  await mkdir20(dirname25(composedPath), { recursive: true });
+  await mkdir20(dirname26(composedPath), { recursive: true });
   await writeFile20(
     composedPath,
     [
@@ -11993,7 +12187,7 @@ async function applyReplacements2(artifacts, options, channel, artifactTypes) {
         const artifactKind = entry.isDirectory() ? "dir" : "file";
         const existing = byKey.get(artifactMapKey);
         const stagedPath = join37(options.stageRoot, ".agentwheel-composed", channel, type, entry.name);
-        await mkdir20(dirname25(stagedPath), { recursive: true });
+        await mkdir20(dirname26(stagedPath), { recursive: true });
         await cp4(full, stagedPath, { recursive: artifactKind === "dir", dereference: true });
         byKey.set(artifactMapKey, {
           ...existing,
@@ -12038,8 +12232,8 @@ async function sortedDirEntries2(path) {
 
 // src/staging/claude-subagents.ts
 init_fs();
-import { mkdir as mkdir21, readFile as readFile31, writeFile as writeFile21 } from "fs/promises";
-import { basename as basename18, dirname as dirname26, join as join38 } from "path";
+import { mkdir as mkdir21, readFile as readFile32, writeFile as writeFile21 } from "fs/promises";
+import { basename as basename18, dirname as dirname27, join as join38 } from "path";
 async function renderClaudeSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "claude") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -12068,9 +12262,9 @@ async function renderClaudeSubagent(artifact, stageRoot) {
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !sourcePath.toLowerCase().endsWith(".md")) {
     throw new Error(`Claude subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const content = await readFile31(markdownPath, "utf8");
+  const content = await readFile32(markdownPath, "utf8");
   const renderedPath = join38(stageRoot, ".agentwheel-rendered", "claude-subagents", `${agentName}.md`);
-  await mkdir21(dirname26(renderedPath), { recursive: true });
+  await mkdir21(dirname27(renderedPath), { recursive: true });
   await writeFile21(renderedPath, content.endsWith("\n") ? content : `${content}
 `, "utf8");
   return {
@@ -12113,7 +12307,7 @@ async function stageResolvedArtifactsRaw(resolved, artifacts, parentDir = tmpdir
   await removeOnFailure(root, async () => {
     for (const artifact of artifacts) {
       const stagedPath = join39(root, artifact.relativePath);
-      await mkdir22(dirname27(stagedPath), { recursive: true });
+      await mkdir22(dirname28(stagedPath), { recursive: true });
       await cp5(artifact.sourcePath, stagedPath, {
         recursive: artifact.kind === "dir",
         dereference: true,
@@ -12219,25 +12413,25 @@ async function copyAsset(asset, source, dest) {
     throw new Error(`Asset include source is not a file or directory: ${source}`);
   }
   if (!asset.include?.length) {
-    await mkdir22(dirname27(dest), { recursive: true });
+    await mkdir22(dirname28(dest), { recursive: true });
     await cp5(source, dest, { recursive: true, dereference: true });
     if (asset.mode === "copy") await normalizeCopiedModes(dest);
     return;
   }
   for (const file of await listFiles2(source)) {
-    const rel = relative13(source, file).replaceAll("\\", "/");
+    const rel = relative14(source, file).replaceAll("\\", "/");
     if (!matchesAny(rel, asset.include) && !matchesAny(basename19(file), asset.include)) continue;
     await copyAssetFile(file, join39(dest, rel), asset);
   }
 }
 async function copyAssetFile(source, dest, asset) {
-  await mkdir22(dirname27(dest), { recursive: true });
+  await mkdir22(dirname28(dest), { recursive: true });
   await cp5(source, dest, { dereference: true });
   if (asset.mode === "copy") await chmod3(dest, 420);
 }
 function resolvePackagePath(packageRoot, path) {
-  const resolved = resolve25(packageRoot, path);
-  const root = resolve25(packageRoot);
+  const resolved = resolve26(packageRoot, path);
+  const root = resolve26(packageRoot);
   if (resolved !== root && !resolved.startsWith(`${root}${sep8}`)) {
     throw new Error(`Asset include escapes package root: ${path}`);
   }
@@ -12286,12 +12480,12 @@ init_adapters();
 init_adapter();
 init_artifact();
 init_workspace();
-import { appendFile, cp as cp6, lstat as lstat3, mkdir as mkdir23, readdir as readdir13, rm as rm13 } from "fs/promises";
-import { dirname as dirname29, join as join42, relative as relative14 } from "path";
+import { appendFile, cp as cp6, lstat as lstat4, mkdir as mkdir23, readdir as readdir13, rm as rm13 } from "fs/promises";
+import { dirname as dirname30, join as join42, relative as relative15 } from "path";
 
 // src/resolve/graph.ts
 import { createHash as createHash17 } from "crypto";
-import { readdir as readdir12, readFile as readFile34, stat as stat14 } from "fs/promises";
+import { readdir as readdir12, readFile as readFile35, stat as stat14 } from "fs/promises";
 import { basename as basename20, extname as extname4, join as join41 } from "path";
 init_artifact();
 init_fs();
@@ -12302,7 +12496,7 @@ init_workspace();
 init_selection();
 init_fs();
 import { createHash as createHash16 } from "crypto";
-import { readFile as readFile32 } from "fs/promises";
+import { readFile as readFile33 } from "fs/promises";
 import { z as z12 } from "zod";
 var selectionSourceConfigSchema = z12.object({
   schemaVersion: z12.literal(2),
@@ -12321,7 +12515,7 @@ async function resolveSelectionImport(sourceRoot, sourceDriver, selection) {
   }
   let raw;
   try {
-    raw = JSON.parse(await readFile32(path, "utf8"));
+    raw = JSON.parse(await readFile33(path, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Selection import '${parsedSelection.export}' cannot parse ${path}: ${message}`);
@@ -12385,17 +12579,17 @@ function resolveExport(name, selections, stack) {
 }
 function applySelection(inherited, additions, exclusions) {
   const excluded = new Set(exclusions);
-  return sortedUnique3([...inherited, ...additions]).filter((selector) => !excluded.has(selector));
+  return sortedUnique4([...inherited, ...additions]).filter((selector) => !excluded.has(selector));
 }
 function normalizeSelectors(values, label) {
   try {
-    return sortedUnique3(normalizeArtifactSelectors(values) ?? []);
+    return sortedUnique4(normalizeArtifactSelectors(values) ?? []);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Invalid ${label}: ${message}`);
   }
 }
-function sortedUnique3(values) {
+function sortedUnique4(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
 function sha2564(value) {
@@ -12419,13 +12613,13 @@ function isRecord9(value) {
 }
 
 // src/resolve/identity.ts
-import { homedir as homedir11 } from "os";
-import { resolve as resolve27 } from "path";
+import { homedir as homedir12 } from "os";
+import { resolve as resolve28 } from "path";
 
 // src/registry/client.ts
-import { readFile as readFile33, rm as rm12, stat as stat13 } from "fs/promises";
-import { homedir as homedir10 } from "os";
-import { dirname as dirname28, join as join40, resolve as resolve26 } from "path";
+import { readFile as readFile34, rm as rm12, stat as stat13 } from "fs/promises";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname29, join as join40, resolve as resolve27 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/model/registry.ts
@@ -12525,7 +12719,7 @@ var RegistryClient = class {
   }
   async readCache() {
     if (!await pathExists(this.cachePath)) return void 0;
-    return registryCacheSchema.parse(JSON.parse(await readFile33(this.cachePath, "utf8")));
+    return registryCacheSchema.parse(JSON.parse(await readFile34(this.cachePath, "utf8")));
   }
   isExpired(cache, ttlMs) {
     return this.now().getTime() - new Date(cache.fetchedAt).getTime() > ttlMs;
@@ -12542,12 +12736,12 @@ var RegistryClient = class {
     }
     const filePath = source.startsWith("file:") ? fileURLToPath2(source) : source;
     if (await pathExists(filePath)) {
-      const fullPath = resolve26(filePath);
+      const fullPath = resolve27(filePath);
       const stats = await stat13(fullPath);
-      return readFile33(stats.isDirectory() ? join40(fullPath, "index.json") : fullPath, "utf8");
+      return readFile34(stats.isDirectory() ? join40(fullPath, "index.json") : fullPath, "utf8");
     }
-    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join40(dirname28(this.cachePath), "registry-repos") }));
-    return readFile33(join40(resolved.resolvedPath, "index.json"), "utf8");
+    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join40(dirname29(this.cachePath), "registry-repos") }));
+    return readFile34(join40(resolved.resolvedPath, "index.json"), "utf8");
   }
   warnCompatibility(entries) {
     for (const entry of entries) {
@@ -12585,7 +12779,7 @@ function mergeIndexes(indexes) {
   return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 function defaultRegistryCachePath() {
-  return join40(homedir10(), ".agentwheel", "registry-cache.json");
+  return join40(homedir11(), ".agentwheel", "registry-cache.json");
 }
 function sameSources(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
@@ -12682,10 +12876,10 @@ function localSourcePath(source) {
   return source.startsWith("local:") ? source.slice("local:".length) : source;
 }
 function resolveLocalPath2(path, declaringPackageRoot) {
-  if (path === "~") return homedir11();
-  if (path.startsWith("~/")) return resolve27(homedir11(), path.slice(2));
-  if (path.startsWith("/")) return resolve27(path);
-  return resolve27(declaringPackageRoot, path);
+  if (path === "~") return homedir12();
+  if (path.startsWith("~/")) return resolve28(homedir12(), path.slice(2));
+  if (path.startsWith("/")) return resolve28(path);
+  return resolve28(declaringPackageRoot, path);
 }
 async function normalizeRegistrySource(name, options) {
   const client = options.registryClient ?? new RegistryClient({ workspaceRoot: options.workspaceRoot });
@@ -12784,7 +12978,7 @@ async function resolveDependencyGraph(roots, options) {
       optional: false,
       chain: [`workspace:${rootId}`],
       includeSuggestions: root.includeSuggestions ?? options.includeSuggestions,
-      suggestionAliases: sortedUnique4([...root.suggestionAliases ?? [], ...options.suggestionAliases ?? []])
+      suggestionAliases: sortedUnique5([...root.suggestionAliases ?? [], ...options.suggestionAliases ?? []])
     };
   });
   const requiredQueue = rootRequirements();
@@ -13005,7 +13199,7 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
         version: requirement.version,
         mode: requirement.mode,
         optional: requirement.optional,
-        selected: sortedUnique4([...previous?.selected ?? [], ...selected])
+        selected: sortedUnique5([...previous?.selected ?? [], ...selected])
       });
     }
     return await collectDependencyNeeds(state, fetched, options, requirement.chain);
@@ -13075,7 +13269,7 @@ async function collectDependencyNeeds(state, fetched, options, chain) {
             fetched,
             parsed.alias,
             dependency,
-            sortedUnique4([...dependency.select ?? [], parsed.selector]),
+            sortedUnique5([...dependency.select ?? [], parsed.selector]),
             chain,
             options,
             parsed.optional || dependency.optional === true,
@@ -13127,7 +13321,7 @@ async function collectDependencyNeeds(state, fetched, options, chain) {
           fetched,
           include.alias,
           dependency,
-          sortedUnique4([...dependency.select ?? [], include.selector]),
+          sortedUnique5([...dependency.select ?? [], include.selector]),
           chain,
           options,
           include.optional || dependency.optional === true
@@ -13160,7 +13354,7 @@ function dependencyRequirement(state, fetched, alias, dependency, select, chain,
     integrity: dependency.integrity,
     selectionReason,
     includeSuggestions: state.includeSuggestions,
-    suggestionAliases: sortedUnique4([...state.suggestionAliases])
+    suggestionAliases: sortedUnique5([...state.suggestionAliases])
   };
 }
 function suggestionRequirement(state, fetched, alias, suggestion, select, chain, options, optional = shouldTreatSuggestionAsOptional(alias, suggestion, options), selectionReason) {
@@ -13177,7 +13371,7 @@ function suggestionRequirement(state, fetched, alias, suggestion, select, chain,
   );
 }
 function assertDependencyUpdateSelectors(lock, selectors) {
-  for (const selector of sortedUnique4(selectors ?? [])) {
+  for (const selector of sortedUnique5(selectors ?? [])) {
     if (!lock) throw new Error(`Dependency update '${selector}' requires an existing graph lock.`);
     const nodeIds = matchingDependencyUpdateNodeIds(lock, selector);
     if (nodeIds.size === 0) throw new Error(`Tracking dependency not found in graph lock: ${selector}`);
@@ -13231,7 +13425,7 @@ function suggestionForAlias(suggestions, nodeId, alias) {
   return suggestion;
 }
 function warnNoDepsOnce(state, aliases, warn) {
-  const unique = sortedUnique4(aliases.filter(Boolean));
+  const unique = sortedUnique5(aliases.filter(Boolean));
   if (unique.length === 0 || state.processedPackageAliases.has("__noDepsWarned")) return;
   state.processedPackageAliases.add("__noDepsWarned");
   warn?.(`--no-deps ignored dependencies for ${state.node.id}: ${unique.join(", ")}`);
@@ -13272,7 +13466,7 @@ function suggestionOptionsForState(state, options) {
   return {
     ...options,
     includeSuggestions: state.includeSuggestions || options.includeSuggestions === true,
-    suggestionAliases: sortedUnique4([...options.suggestionAliases ?? [], ...state.suggestionAliases])
+    suggestionAliases: sortedUnique5([...options.suggestionAliases ?? [], ...state.suggestionAliases])
   };
 }
 function explicitSuggestionAlias(alias, options) {
@@ -13284,7 +13478,7 @@ function shouldTreatSuggestionAsOptional(alias, suggestion, options) {
 }
 function combinedSelectors(base, extra) {
   const values = [...base ?? [], ...extra ?? []];
-  return values.length > 0 ? sortedUnique4(values) : void 0;
+  return values.length > 0 ? sortedUnique5(values) : void 0;
 }
 function parseDependencySelector(value) {
   const cleaned = value.trim();
@@ -13324,7 +13518,7 @@ async function collectIncludeNeeds(artifact, artifactsByRelativePath) {
     const file = stack.shift();
     if (scanned.has(file)) continue;
     scanned.add(file);
-    const content = await readFile34(file, "utf8");
+    const content = await readFile35(file, "utf8");
     for (const include of extractOpenPackIncludeSelectors(content)) {
       await collectIncludeSelector(include.raw, include.optional, artifactsByRelativePath, scanned, stack, needs);
     }
@@ -13473,7 +13667,7 @@ function lockedNodeCoversRequirementSelection(node, requirement, options) {
       return false;
     }
     const requestedExclusionSet = new Set(requestedExclusions);
-    const requestedEffective = sortedUnique4([...lockedSelection2.inherited, ...requestedAdditions]).filter((selector) => !requestedExclusionSet.has(selector));
+    const requestedEffective = sortedUnique5([...lockedSelection2.inherited, ...requestedAdditions]).filter((selector) => !requestedExclusionSet.has(selector));
     const lockedSelectors = new Set(node.selected);
     return requestedEffective.every((selector) => lockedSelectors.has(selector));
   }
@@ -13548,8 +13742,8 @@ function verifyIntegrity(integrity, sourceHash, label) {
 async function withCachePathLock(path, fn) {
   const previous = cacheLocks.get(path) ?? Promise.resolve();
   let release = () => void 0;
-  const current = previous.then(() => new Promise((resolve45) => {
-    release = resolve45;
+  const current = previous.then(() => new Promise((resolve46) => {
+    release = resolve46;
   }));
   cacheLocks.set(path, current);
   await previous;
@@ -13562,7 +13756,7 @@ async function withCachePathLock(path, fn) {
 }
 function computeSelectedSelectors(artifacts, select, isRoot, chain) {
   if (isRoot && select === void 0) {
-    return sortedUnique4(artifacts.map(artifactSelectorKey));
+    return sortedUnique5(artifacts.map(artifactSelectorKey));
   }
   const explicit = normalizeArtifactSelectors(select) ?? [];
   const available = new Set(artifacts.map(artifactSelectorKey));
@@ -13571,7 +13765,7 @@ function computeSelectedSelectors(artifacts, select, isRoot, chain) {
     throw new Error(`Selected artifact not found in package: ${missing.join(", ")} (${chain.join(" -> ")})`);
   }
   const required = artifacts.filter((artifact) => artifact.required && artifact.type !== "fragments").map(artifactSelectorKey);
-  return sortedUnique4([...explicit, ...required]);
+  return sortedUnique5([...explicit, ...required]);
 }
 function materializeRawNode(state) {
   refreshNode(state);
@@ -13584,11 +13778,11 @@ function materializeRawNode(state) {
   };
 }
 function refreshNode(state) {
-  state.node.requiredBy = sortedUnique4([...state.requiredBy]);
-  state.node.selected = sortedUnique4([...state.selected]);
+  state.node.requiredBy = sortedUnique5([...state.requiredBy]);
+  state.node.selected = sortedUnique5([...state.selected]);
   const selectionReasons = {};
   for (const [selector, reasons] of [...state.selectionReasons.entries()].sort(([a], [b]) => a.localeCompare(b))) {
-    selectionReasons[selector] = sortedUnique4([...reasons]);
+    selectionReasons[selector] = sortedUnique5([...reasons]);
   }
   state.node.selectionReasons = Object.keys(selectionReasons).length > 0 ? selectionReasons : void 0;
 }
@@ -13633,7 +13827,7 @@ function graphNodeId(name, version, normalizedSource, resolvedCommit, sourceHash
   const digest3 = createHash17("sha256").update(normalizedSource).update("\0").update(resolvedCommit ?? sourceHash).digest("hex").slice(0, 12);
   return `${name}@${version}+${digest3}`;
 }
-function sortedUnique4(values) {
+function sortedUnique5(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
 function closureProcessingKey(value, updateClosure) {
@@ -13673,7 +13867,7 @@ init_declarations();
 async function remember(workspaceRoot, runtime, text) {
   const overlayPath = join42(workspaceRoot, ".agentwheel", "overlays", runtime, "instructions.local.md");
   declareMutationPath(overlayPath);
-  await mkdir23(dirname29(overlayPath), { recursive: true });
+  await mkdir23(dirname30(overlayPath), { recursive: true });
   await appendFile(overlayPath, `${text.trim()}
 `, "utf8");
   return { overlayPath };
@@ -13701,12 +13895,12 @@ async function ejectArtifact(workspaceRoot, item) {
     for (const path of await listFilesIfPresent(ejectedPath)) declareMutationPath(path);
     if (artifact.kind === "dir") {
       for (const sourceFile of await listFiles3(sourcePath)) {
-        declareMutationPath(join42(ejectedPath, relative14(sourcePath, sourceFile)));
+        declareMutationPath(join42(ejectedPath, relative15(sourcePath, sourceFile)));
       }
     } else {
       declareMutationPath(ejectedPath);
     }
-    await mkdir23(dirname29(ejectedPath), { recursive: true });
+    await mkdir23(dirname30(ejectedPath), { recursive: true });
     await rm13(ejectedPath, { recursive: true, force: true });
     await cp6(sourcePath, ejectedPath, { recursive: artifact.kind === "dir", dereference: true });
     return {
@@ -13722,7 +13916,7 @@ async function ejectArtifact(workspaceRoot, item) {
   }
 }
 async function listFiles3(root) {
-  const stats = await lstat3(root);
+  const stats = await lstat4(root);
   if (stats.isFile()) return [root];
   const files = [];
   async function walk2(dir) {
@@ -13825,7 +14019,7 @@ init_adapter();
 init_graph_lock();
 import { createHash as createHash19 } from "crypto";
 import { mkdir as mkdir25, readdir as readdir14 } from "fs/promises";
-import { basename as basename21, dirname as dirname31, join as join45, posix as posix6, resolve as resolve31 } from "path";
+import { basename as basename21, dirname as dirname32, join as join45, posix as posix6, resolve as resolve31 } from "path";
 init_paths();
 init_merge_removal();
 init_transaction();
@@ -13992,7 +14186,7 @@ function formatSelectionImport(root) {
 // src/resolve/render.ts
 init_selection();
 import { createHash as createHash18 } from "crypto";
-import { readFile as readFile35, mkdtemp as mkdtemp5 } from "fs/promises";
+import { readFile as readFile36, mkdtemp as mkdtemp5 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
 import { join as join43 } from "path";
 init_fs();
@@ -14185,7 +14379,7 @@ async function artifactContentMap(artifacts) {
   const out = /* @__PURE__ */ new Map();
   for (const artifact of artifacts) {
     if (artifact.kind !== "file") continue;
-    out.set(artifact.relativePath.replaceAll("\\", "/"), await readFile35(artifact.stagedPath ?? artifact.sourcePath, "utf8"));
+    out.set(artifact.relativePath.replaceAll("\\", "/"), await readFile36(artifact.stagedPath ?? artifact.sourcePath, "utf8"));
   }
   return out;
 }
@@ -14507,9 +14701,9 @@ init_fs();
 
 // src/lifecycle/trust.ts
 init_fs();
-import { mkdir as mkdir24, readFile as readFile36 } from "fs/promises";
-import { homedir as homedir12 } from "os";
-import { dirname as dirname30, join as join44 } from "path";
+import { mkdir as mkdir24, readFile as readFile37 } from "fs/promises";
+import { homedir as homedir13 } from "os";
+import { dirname as dirname31, join as join44 } from "path";
 import { z as z14 } from "zod";
 var trustStoreSchema = z14.object({
   version: z14.literal(1),
@@ -14517,9 +14711,9 @@ var trustStoreSchema = z14.object({
 });
 function normalizeTrustPolicy(policy) {
   return {
-    allow: sortedUnique5(policy?.allow ?? []),
-    acceptedSources: sortedUnique5(policy?.acceptedSources ?? []),
-    denyArtifactTypes: sortedUnique5(policy?.denyArtifactTypes ?? []),
+    allow: sortedUnique6(policy?.allow ?? []),
+    acceptedSources: sortedUnique6(policy?.acceptedSources ?? []),
+    denyArtifactTypes: sortedUnique6(policy?.denyArtifactTypes ?? []),
     requireReviewForTransitive: policy?.requireReviewForTransitive ?? true
   };
 }
@@ -14556,10 +14750,10 @@ async function readTrustedSources(_workspaceRoot, storePath = defaultTrustStoreP
   return (await readTrustStore(storePath)).acceptedSources;
 }
 async function rememberTrustedSources(_workspaceRoot, sources, storePath = defaultTrustStorePath()) {
-  const unique = sortedUnique5(sources);
+  const unique = sortedUnique6(sources);
   if (unique.length === 0) return [];
   const store = await readTrustStore(storePath);
-  const acceptedSources = sortedUnique5([...store.acceptedSources, ...unique]);
+  const acceptedSources = sortedUnique6([...store.acceptedSources, ...unique]);
   await writeTrustStore(storePath, { version: 1, acceptedSources });
   return unique.filter((source) => !store.acceptedSources.includes(source));
 }
@@ -14578,19 +14772,19 @@ function matchesGlob2(value, pattern) {
   const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${escaped}$`).test(value);
 }
-function sortedUnique5(values) {
+function sortedUnique6(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
 async function readTrustStore(path) {
   if (!await pathExists(path)) return { version: 1, acceptedSources: [] };
-  return trustStoreSchema.parse(JSON.parse(await readFile36(path, "utf8")));
+  return trustStoreSchema.parse(JSON.parse(await readFile37(path, "utf8")));
 }
 async function writeTrustStore(path, store) {
-  await mkdir24(dirname30(path), { recursive: true });
+  await mkdir24(dirname31(path), { recursive: true });
   await writeJsonAtomic(path, trustStoreSchema.parse(store));
 }
 function defaultTrustStorePath() {
-  return process.env.AGENTWHEEL_TRUST_STORE ?? join44(homedir12(), ".agentwheel", "trust.json");
+  return process.env.AGENTWHEEL_TRUST_STORE ?? join44(homedir13(), ".agentwheel", "trust.json");
 }
 
 // src/lifecycle/source-plan.ts
@@ -14599,14 +14793,14 @@ init_selection();
 
 // src/model/workspace-owner.ts
 import { Buffer as Buffer2 } from "buffer";
-import { isAbsolute as isAbsolute9, resolve as resolve28 } from "path";
+import { isAbsolute as isAbsolute10, resolve as resolve29 } from "path";
 var workspaceOwnerPrefix = "workspace-root:";
 var fleetOwnerSeparator = "|fleet-id:";
 var encodedRootPrefix = "v2:";
 var fleetIdPattern = /^[a-z0-9][a-z0-9._-]*$/i;
 var base64UrlPattern = /^[a-z0-9_-]+$/i;
 function workspaceOwnerForRoot(workspaceRoot, fleetId) {
-  const root = resolve28(workspaceRoot);
+  const root = resolve29(workspaceRoot);
   const encodedRoot = root.includes(fleetOwnerSeparator) ? `${encodedRootPrefix}${Buffer2.from(root, "utf8").toString("base64url")}` : root;
   const legacy = `${workspaceOwnerPrefix}${encodedRoot}`;
   return fleetId ? `${legacy}${fleetOwnerSeparator}${fleetId}` : legacy;
@@ -14618,7 +14812,7 @@ function parseWorkspaceOwner(value) {
   const encodedRoot = separator === -1 ? encoded : encoded.slice(0, separator);
   const fleetId = separator === -1 ? void 0 : encoded.slice(separator + fleetOwnerSeparator.length);
   const rootValue = decodeRoot(encodedRoot);
-  if (!rootValue || !isAbsolute9(rootValue) || resolve28(rootValue) !== rootValue) return void 0;
+  if (!rootValue || !isAbsolute10(rootValue) || resolve29(rootValue) !== rootValue) return void 0;
   if (fleetId !== void 0 && !fleetIdPattern.test(fleetId)) return void 0;
   return { root: rootValue, ...fleetId ? { fleetId } : {} };
 }
@@ -14711,187 +14905,8 @@ async function createExactMcpRetirementPlan(desiredArtifacts, adapter, targetRoo
   };
 }
 
-// src/model/fleet.ts
-init_fs();
-init_declarations();
-init_workspace();
-import { lstat as lstat4, readFile as readFile37, realpath as realpath2 } from "fs/promises";
-import { homedir as homedir13 } from "os";
-import { isAbsolute as isAbsolute10, relative as relative15, resolve as resolve29 } from "path";
-async function resolveWorkspaceScope(request = {}) {
-  const selected = [request.user === true, request.local === true, request.fleet !== void 0].filter(Boolean).length;
-  if (selected > 1) {
-    throw new Error("Choose exactly one workspace selector: --user, --local, or --fleet <id>.");
-  }
-  const globalRoot = resolve29(request.globalRoot ?? homedir13());
-  if (request.user) {
-    const config2 = await readWorkspaceConfig(globalRoot);
-    assertNonFleetScope("user", config2);
-    return { kind: "user", root: globalRoot, config: config2 };
-  }
-  if (request.fleet !== void 0) {
-    const id = fleetIdSchema.parse(request.fleet);
-    const registration = await showRegisteredFleet(id, { globalRoot });
-    const root = await assertCanonicalDirectory(registration.root, `Registered fleet '${id}' root`);
-    const config2 = await readRequiredConfig(root, `fleet '${id}'`);
-    assertFleetContract(id, registration, config2);
-    return { kind: "fleet", root, fleetId: id, config: config2 };
-  }
-  const cwd = resolve29(request.cwd ?? process.cwd());
-  const discoveredRoot = await findExistingWorkspaceRoot(cwd);
-  if (!discoveredRoot || discoveredRoot === globalRoot) {
-    if (request.local === true && cwd !== globalRoot) {
-      return { kind: "local", root: cwd, config: await readWorkspaceConfig(cwd) };
-    }
-    throw missingScopeError(request.local === true ? "local" : "implicit local");
-  }
-  const config = await readRequiredConfig(discoveredRoot, "local");
-  assertNonFleetScope("local", config);
-  return { kind: "local", root: discoveredRoot, config };
-}
-async function registerFleet(request) {
-  const id = fleetIdSchema.parse(request.id);
-  const requiredPackages = sortedUnique6(request.requiredPackages);
-  if (requiredPackages.length === 0) throw new Error("Fleet registration requires at least one --required-package <name>.");
-  const globalRoot = resolve29(request.globalRoot ?? homedir13());
-  const home = await readWorkspaceConfig(globalRoot);
-  if (supportsFleetConfig(home) && home.fleetId) {
-    throw new Error(`The home config is fleet '${home.fleetId}', so it cannot own the global fleet registry.`);
-  }
-  const existing = supportsFleetConfig(home) ? await canonicalizeExistingFleetRoots(home.fleets, globalRoot) : {};
-  if (existing[id]) throw new Error(`Fleet '${id}' is already registered.`);
-  const root = await assertCanonicalDirectory(request.root, `Fleet '${id}' root`);
-  const duplicateRoot = Object.entries(existing).find(([, value]) => value.root === root);
-  if (duplicateRoot) throw new Error(`Fleet root ${root} is already registered as '${duplicateRoot[0]}'.`);
-  if (root === globalRoot) throw new Error("A fleet root must be outside the user config root contract.");
-  const target = await readRequiredConfig(root, `fleet '${id}'`);
-  const registration = registeredFleetSchema.parse({ root, requiredPackages });
-  assertFleetContract(id, registration, target);
-  const upgraded = workspaceConfigSchema.parse({
-    ...home,
-    schemaVersion: CURRENT_WORKSPACE_SCHEMA_VERSION,
-    exports: home.schemaVersion >= 2 ? home.exports : { selections: {} },
-    fleets: { ...existing, [id]: registration }
-  });
-  const configPath = globalWorkspaceConfigPath(globalRoot);
-  declareMutationPath(configPath);
-  await writeJsonAtomic(configPath, upgraded);
-  return { id, ...registration };
-}
-async function canonicalizeExistingFleetRoots(fleets, globalRoot) {
-  const canonical = /* @__PURE__ */ new Map();
-  const normalized = {};
-  for (const [id, registration] of Object.entries(fleets).sort(([a], [b]) => a.localeCompare(b))) {
-    const root = await canonicalizeDirectory(registration.root, `Registered fleet '${id}' root`);
-    if (root === globalRoot) throw new Error(`Registered fleet '${id}' root must be outside the user config root contract.`);
-    const incumbent = canonical.get(root);
-    if (incumbent) {
-      throw new Error(`Fleet root ${root} is registered more than once as '${incumbent}' and '${id}'.`);
-    }
-    canonical.set(root, id);
-    normalized[id] = registeredFleetSchema.parse({ ...registration, root });
-  }
-  return normalized;
-}
-async function listRegisteredFleets(options = {}) {
-  const globalRoot = resolve29(options.globalRoot ?? homedir13());
-  const home = await readWorkspaceConfig(globalRoot);
-  if (!supportsFleetConfig(home)) return [];
-  return Object.entries(home.fleets).sort(([a], [b]) => a.localeCompare(b)).map(([id, registration]) => ({ id, ...registration }));
-}
-async function showRegisteredFleet(idInput, options = {}) {
-  const id = fleetIdSchema.parse(idInput);
-  const fleets = await listRegisteredFleets(options);
-  const registration = fleets.find((candidate) => candidate.id === id);
-  if (!registration) {
-    throw new Error(`Unknown fleet '${id}'. Use 'agentwheel fleet list' or register it with 'agentwheel fleet register'.`);
-  }
-  return registration;
-}
-async function resolveWorkspaceOwnershipScope(workspaceRootInput, options = {}) {
-  const workspaceRoot = await canonicalizeDirectory(resolve29(workspaceRootInput), "Workspace ownership root");
-  if (options.fleetId) {
-    return { root: workspaceRoot, fleetId: fleetIdSchema.parse(options.fleetId) };
-  }
-  const syntacticallyContaining = (await listRegisteredFleets({ globalRoot: options.globalRoot })).filter((fleet2) => containsPath(resolve29(fleet2.root), workspaceRoot));
-  const registered = await Promise.all(syntacticallyContaining.map(async (fleet2) => ({
-    ...fleet2,
-    root: await canonicalizeDirectory(fleet2.root, `Registered fleet '${fleet2.id}' root`)
-  })));
-  const containing = registered.filter((fleet2) => containsPath(fleet2.root, workspaceRoot));
-  if (containing.length > 1) {
-    throw new Error(
-      `Workspace ${workspaceRoot} is contained by multiple registered fleets: ` + containing.map((fleet2) => `'${fleet2.id}' at ${fleet2.root}`).join(", ") + ". Resolve the overlapping registrations before planning ownership."
-    );
-  }
-  const fleet = containing[0];
-  if (fleet) assertFleetContract(fleet.id, fleet, await readRequiredConfig(fleet.root, `fleet '${fleet.id}'`));
-  return fleet ? { root: fleet.root, fleetId: fleet.id } : { root: workspaceRoot };
-}
-async function readRequiredConfig(root, label) {
-  const path = workspaceConfigPath(root);
-  if (!await pathExists(path)) throw missingScopeError(label);
-  try {
-    return workspaceConfigSchema.parse(JSON.parse(await readFile37(path, "utf8")));
-  } catch (error) {
-    throw new Error(`Invalid ${label} Agentwheel config at ${path}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-function assertFleetContract(id, registration, config) {
-  if (!supportsFleetConfig(config)) {
-    throw new Error(`Fleet '${id}' config must use schemaVersion 3 or newer before registration or selection.`);
-  }
-  if (config.fleetId !== id) {
-    throw new Error(`Fleet fleetId mismatch: expected '${id}', found '${config.fleetId ?? "missing"}'.`);
-  }
-  if (Object.keys(config.fleets).length > 0) {
-    throw new Error(`Fleet '${id}' config may not contain the home fleets registry.`);
-  }
-  const names = new Set(config.packages.map((pkg) => pkg.name));
-  for (const packageName of registration.requiredPackages) {
-    if (!names.has(packageName)) throw new Error(`Fleet '${id}' is missing required package '${packageName}'.`);
-  }
-}
-async function assertCanonicalDirectory(input, label) {
-  const canonical = await canonicalizeDirectory(input, label);
-  const normalized = resolve29(input);
-  const stats = await lstat4(input);
-  if (stats.isSymbolicLink() || canonical !== normalized || input !== normalized) {
-    throw new Error(`${label} must be canonical and symlink-unambiguous: ${input} resolves to ${canonical}.`);
-  }
-  return canonical;
-}
-async function canonicalizeDirectory(input, label) {
-  if (!isAbsolute10(input)) throw new Error(`${label} must be an absolute canonical path.`);
-  let canonical;
-  try {
-    canonical = await realpath2(input);
-  } catch {
-    throw new Error(`${label} does not exist: ${input}`);
-  }
-  const stats = await lstat4(canonical);
-  if (!stats.isDirectory()) throw new Error(`${label} is not a directory: ${input}`);
-  return canonical;
-}
-function missingScopeError(label) {
-  return new Error(
-    `Missing ${label} Agentwheel workspace config. Select --user, --local, or --fleet <id>, or run 'agentwheel init workspace' in the intended local root. Agentwheel never falls back to home desired state.`
-  );
-}
-function assertNonFleetScope(kind, config) {
-  if (supportsFleetConfig(config) && config.fleetId) {
-    throw new Error(
-      `The ${kind} config declares fleetId '${config.fleetId}'. Select it through the registered --fleet <id> scope.`
-    );
-  }
-}
-function sortedUnique6(values) {
-  return [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort((a, b) => a.localeCompare(b));
-}
-function containsPath(parent, candidate) {
-  const path = relative15(parent, candidate);
-  return path === "" || !path.startsWith("..") && !isAbsolute10(path);
-}
+// src/lifecycle/source-plan.ts
+init_fleet();
 
 // src/model/target-state.ts
 init_graph_lock();
@@ -15265,7 +15280,7 @@ async function discoverTargetApplyJournal(options) {
       continue;
     }
     if (!journal.graphLockPath || !journal.graphLock || !journal.graphLockDigest) continue;
-    if (resolve31(dirname31(journal.graphLockPath)) !== resolve31(dirname31(options.graphLockPath))) continue;
+    if (resolve31(dirname32(journal.graphLockPath)) !== resolve31(dirname32(options.graphLockPath))) continue;
     if (options.transport.kind === "ssh") {
       throw new Error(
         `Legacy SSH apply journal at ${item.path} does not record its original endpoint; Agentwheel cannot prove endpoint identity, so the journal was preserved.`
@@ -15407,7 +15422,7 @@ async function resolvePriorTargetState(options) {
   return {};
 }
 async function discoverLegacyStateCandidates(options) {
-  const directory = dirname31(options.graphLockPath);
+  const directory = dirname32(options.graphLockPath);
   let names;
   try {
     names = await readdir14(directory);
@@ -15695,7 +15710,7 @@ function mcpServerNames(strategy, removal) {
   return new Set(Object.keys(servers));
 }
 function globalConfigRoot(globalRoot) {
-  return dirname31(dirname31(globalWorkspaceConfigPath(globalRoot)));
+  return dirname32(dirname32(globalWorkspaceConfigPath(globalRoot)));
 }
 function ownedByWorkspace(owner, desiredOwner, workspaceRoot, ownsSubWorkspaces) {
   if (owner === desiredOwner) return true;
@@ -15841,7 +15856,7 @@ function targetLabel(target) {
 
 // src/runtime/target.ts
 init_workspace();
-import { basename as basename22, dirname as dirname32, join as join47, resolve as resolve33 } from "path";
+import { basename as basename22, dirname as dirname33, join as join47, resolve as resolve33 } from "path";
 
 // src/transport/run-as-identity.ts
 import { execFileSync } from "child_process";
@@ -16013,7 +16028,7 @@ async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
     if (adapterFilter && marker.adapter !== adapterFilter) continue;
     for (const dir of marker.dirs) {
       if (basename22(root) === dir) {
-        matches.push({ adapter: marker.adapter, targetRoot: dirname32(root) });
+        matches.push({ adapter: marker.adapter, targetRoot: dirname33(root) });
       } else if (await pathExists(join47(root, dir))) {
         matches.push({ adapter: marker.adapter, targetRoot: root });
       }
@@ -16060,7 +16075,7 @@ function dedupeTargets(matches) {
 function runtimeScanRoot(request) {
   const root = resolve33(request.targetRoot ?? request.cwd ?? process.cwd());
   if (request.targetRoot) return root;
-  return runtimeMarkers.some((marker) => marker.dirs.includes(basename22(root))) ? dirname32(root) : root;
+  return runtimeMarkers.some((marker) => marker.dirs.includes(basename22(root))) ? dirname33(root) : root;
 }
 
 // src/lifecycle/profile.ts
@@ -16394,7 +16409,7 @@ init_selection();
 // src/cli/update-check.ts
 import { mkdir as mkdir26, readFile as readFile38, writeFile as writeFile22 } from "fs/promises";
 import { homedir as homedir14 } from "os";
-import { dirname as dirname33, join as join48 } from "path";
+import { dirname as dirname34, join as join48 } from "path";
 var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_TIMEOUT_MS = 300;
 var REGISTRY_URL = "https://registry.npmjs.org/agentwheel";
@@ -16447,7 +16462,7 @@ async function readCache(path) {
   }
 }
 async function writeCache(path, cache) {
-  await mkdir26(dirname33(path), { recursive: true });
+  await mkdir26(dirname34(path), { recursive: true });
   await writeFile22(path, `${JSON.stringify(cache, null, 2)}
 `, "utf8");
 }
@@ -16683,11 +16698,11 @@ init_graph_lock();
 
 // src/cli/version.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname34, join as join51 } from "path";
+import { dirname as dirname35, join as join51 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var FALLBACK_VERSION = "0.0.0";
 function resolveCliVersion() {
-  let dir = dirname34(fileURLToPath3(import.meta.url));
+  let dir = dirname35(fileURLToPath3(import.meta.url));
   while (true) {
     try {
       const pkg = JSON.parse(readFileSync2(join51(dir, "package.json"), "utf8"));
@@ -16696,13 +16711,146 @@ function resolveCliVersion() {
       }
     } catch {
     }
-    const parent = dirname34(dir);
+    const parent = dirname35(dir);
     if (parent === dir) return FALLBACK_VERSION;
     dir = parent;
   }
 }
 
+// src/lifecycle/ownership-handoff-audit.ts
+init_apply();
+init_manifest2();
+init_paths();
+init_transaction();
+init_coordinator();
+init_declarations();
+init_protocol();
+init_process();
+init_repository();
+init_transport();
+import { createHash as createHash20, randomUUID as randomUUID6 } from "crypto";
+import { join as join52, resolve as resolve36 } from "path";
+async function applyAuditedOwnershipHandoff(request, observe4) {
+  const existing = activeMutationMetadata();
+  const workspaceRoot = resolve36(request.workspaceRoot ?? existing.workspaceRoot);
+  if (existing && (resolve36(existing.workspaceRoot) !== workspaceRoot || request.reason !== void 0 && existing.reason !== request.reason.replace(/\r\n?/gu, "\n").trim() || request.operationId && request.operationId !== existing.operationId)) {
+    throw new Error("Ownership handoff does not match the active governed workspace, reason or operation.");
+  }
+  const operationId = mutationOperationIdSchema.parse(existing?.operationId ?? request.operationId ?? randomUUID6());
+  const auditPath = join52(workspaceRoot, ".agentwheel", "ownership-handoffs", `${operationId}.json`);
+  const mutation = existing ? void 0 : await GovernedMutation.begin({
+    workspaceRoot,
+    commandName: "agentwheel ownership handoff",
+    reason: request.reason,
+    operationId,
+    noCommit: request.noCommit,
+    globalRoot: request.globalRoot,
+    anticipatedPaths: [auditPath]
+  });
+  try {
+    const transport = request.transport ?? localTransport;
+    assertGovernedRuntimeTransportSupported(transport);
+    if (transport.kind !== "local") throw new Error("Audited ownership handoff supports local targets only.");
+    await assertNoSymlinkPath(workspaceRoot);
+    await assertNoSymlinkPath(auditPath);
+    if ((existing ?? mutation?.metadata())?.revisionMode === "commit-after-verify") {
+      const repository = await discoverGitRepository(workspaceRoot);
+      if (!repository) throw new Error("Ownership handoff requires a declarative Git audit path.");
+      const ignored = await runProcess("git", ["-C", repository.root, "check-ignore", "--no-index", "--", auditPath], { allowExitCodes: [0, 1] });
+      if (ignored.exitCode === 0) throw new Error("Ownership handoff audit path is Git-ignored; declare it before handing off ownership.");
+    }
+    const scope = { installationType: request.installationType, stateKey: request.stateKey };
+    await assertNoSymlinkPath(join52(request.targetRoot, ".agentwheel"));
+    const lock = await acquireApplyLock(request.targetRoot, request.adapter, transport, {}, scope);
+    try {
+      if ((await listAllApplyJournals(request.targetRoot, void 0, transport)).length) {
+        throw new Error("Cannot hand off ownership while an apply journal is pending. Recover the same operation first.");
+      }
+      if (await transport.pathExists(auditPath)) throw new Error("Ownership handoff intent already exists; recover the same operation instead of applying again.");
+      const plan = await observe4(request, transport);
+      if (plan.drifted && !request.expectedRuntimeHash) {
+        throw new Error("Applying a drifted ownership handoff requires expectedRuntimeHash from a reviewed dry-run.");
+      }
+      const manifest = await readInstallManifest(request.targetRoot, request.adapter, transport, scope);
+      if (!manifest || manifest.version !== 2 || manifest.revision !== plan.manifestRevision) {
+        throw new Error("Ownership handoff manifest changed while locked; replan required.");
+      }
+      const inventory = await listInstallManifests(request.targetRoot, void 0, transport);
+      for (const item of inventory) await assertNoSymlinkPath(item.path);
+      const runtimePath = metadataRuntimePath(request.targetRoot, plan.path);
+      const runtime = [{ path: plan.path, hash: await transport.hashPath(runtimePath), snapshotDigest: await ownershipRuntimeSnapshot(runtimePath) }];
+      const reason = existing?.reason ?? mutation?.metadata().reason ?? request.reason ?? "Ownership handoff";
+      const intent = {
+        schemaVersion: 1,
+        event: "ownership-handoff-intent",
+        operationId,
+        reason,
+        // Explicit whitelist: never serialize manifest entries, mergeRemoval or runtime/config values.
+        plan: {
+          adapter: plan.adapter,
+          installationType: manifest.installationType,
+          stateKey: manifest.stateKey,
+          targetRoot: plan.targetRoot,
+          selector: plan.selector,
+          path: plan.path,
+          artifactHash: plan.artifactHash,
+          runtimeHash: plan.runtimeHash,
+          drifted: plan.drifted,
+          manifestRevision: plan.manifestRevision,
+          fromOwner: plan.fromOwner,
+          toOwner: plan.toOwner
+        },
+        completion: "Verify the linked runtime journal and mutation receipt; intent alone is not completion."
+      };
+      const content = `${JSON.stringify(intent, null, 2)}
+`;
+      const sha2568 = createHash20("sha256").update(content).digest("hex");
+      declareMutationPath(auditPath);
+      declareMutationPath(installManifestPath(request.targetRoot, request.adapter, scope));
+      const metadata = mutationMetadataForApplyJournal();
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const journal = {
+        version: metadata ? 2 : 1,
+        ...metadata ? { mutation: metadata } : {},
+        mode: "uninstall",
+        adapter: manifest.adapter,
+        installationType: manifest.installationType,
+        stateKey: manifest.stateKey,
+        targetRoot: manifest.targetRoot,
+        baseRevision: manifest.revision,
+        createdAt: now,
+        updatedAt: now,
+        operations: [],
+        completed: [],
+        manifest: { ...manifest, entries: manifest.entries.map((entry) => entry.artifactType === request.artifactType && entry.artifactName === request.artifactName ? { ...entry, workspaceOwner: plan.toOwner } : entry) },
+        metadataAudit: {
+          kind: "ownership-handoff",
+          workspaceRoot,
+          operationId,
+          planDigest: sha2568,
+          inventory: inventory.map((item) => ({ stateKey: item.stateKey, revision: item.manifest.revision })),
+          runtime,
+          auditFiles: [{ path: `.agentwheel/ownership-handoffs/${operationId}.json`, content, sha256: sha2568 }]
+        }
+      };
+      if (JSON.stringify(await observe4(request, transport)) !== JSON.stringify(plan)) {
+        throw new Error("Ownership handoff preconditions changed before journaling; replan required.");
+      }
+      await writeApplyJournal(journal, transport);
+      await commitManifestMetadataJournal(journal, transport);
+      await mutation?.complete();
+      return plan;
+    } finally {
+      await lock.release();
+    }
+  } catch (error) {
+    await mutation?.fail(error);
+    throw error;
+  }
+}
+
 // src/lifecycle/ownership.ts
+init_coordinator();
 init_manifest2();
 init_paths();
 init_merge_removal();
@@ -16710,7 +16858,7 @@ init_instructions_block();
 init_adapter();
 init_transaction();
 init_transport();
-import { resolve as resolve36 } from "path";
+import { resolve as resolve37 } from "path";
 var unknownWorkspaceOwner = "workspace:unknown";
 async function planArtifactOwnershipHandoff(request) {
   return validateOwnershipHandoff(request, request.transport ?? localTransport);
@@ -16719,6 +16867,9 @@ async function applyArtifactOwnershipHandoff(request) {
   if (!request.expectedHash || !request.expectedRevision) {
     throw new Error("Applying an ownership handoff requires expectedHash and expectedRevision from a reviewed dry-run.");
   }
+  if (request.workspaceRoot || activeMutationMetadata()) {
+    return applyAuditedOwnershipHandoff(request, validateOwnershipHandoff);
+  }
   const transport = request.transport ?? localTransport;
   assertGovernedRuntimeTransportSupported(transport);
   const scope = { installationType: request.installationType, stateKey: request.stateKey };
@@ -16854,8 +17005,8 @@ function containedArtifactPath(targetRoot, relativePath) {
   if (!relativePath || relativePath.startsWith("/") || relativePath.includes("\0")) {
     throw new Error(`Unsafe managed artifact path: ${relativePath}`);
   }
-  const root = resolve36(targetRoot);
-  const candidate = resolve36(root, relativePath);
+  const root = resolve37(targetRoot);
+  const candidate = resolve37(root, relativePath);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Managed artifact path escapes target root: ${relativePath}`);
   }
@@ -16892,8 +17043,8 @@ init_apply();
 init_paths();
 init_transaction();
 init_selection();
-import { createHash as createHash20 } from "crypto";
-import { resolve as resolve37 } from "path";
+import { createHash as createHash21 } from "crypto";
+import { resolve as resolve38 } from "path";
 init_declarations();
 init_transport();
 init_instructions_block();
@@ -17030,14 +17181,14 @@ async function observe(request, transport) {
   return { ...withoutDigest, planDigest: digest(withoutDigest) };
 }
 function normalizeRequest(request) {
-  const targetRoot = resolve37(request.targetRoot);
+  const targetRoot = resolve38(request.targetRoot);
   const sourceStateKey = exactStateKey(request.adapter, request.sourceStateKey, request.installationType, "source");
   const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, request.installationType, "destination");
   if (sourceStateKey === destinationStateKey) throw new Error("Source and destination state keys must differ.");
   if (!request.toFleetId.trim()) throw new Error("Destination Fleet id is required.");
   const fromFleetId = request.fromFleetId?.trim();
   if (request.fromFleetId !== void 0 && !fromFleetId) throw new Error("Source Fleet id cannot be empty.");
-  if (fromFleetId && (fromFleetId !== request.toFleetId.trim() || resolve37(request.fromWorkspaceRoot) !== resolve37(request.toWorkspaceRoot))) {
+  if (fromFleetId && (fromFleetId !== request.toFleetId.trim() || resolve38(request.fromWorkspaceRoot) !== resolve38(request.toWorkspaceRoot))) {
     throw new Error("Fleet-qualified stale ownership retirement requires the same source and destination Fleet and workspace root.");
   }
   return {
@@ -17046,9 +17197,9 @@ function normalizeRequest(request) {
     installationType: request.installationType.trim(),
     sourceStateKey,
     destinationStateKey,
-    fromWorkspaceRoot: resolve37(request.fromWorkspaceRoot),
+    fromWorkspaceRoot: resolve38(request.fromWorkspaceRoot),
     ...fromFleetId ? { fromFleetId } : {},
-    toWorkspaceRoot: resolve37(request.toWorkspaceRoot),
+    toWorkspaceRoot: resolve38(request.toWorkspaceRoot),
     toFleetId: request.toFleetId.trim()
   };
 }
@@ -17069,7 +17220,7 @@ async function requireManifest(request, stateKey, transport, label) {
     installationType: manifest.installationType,
     stateKey: manifest.stateKey
   });
-  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve37(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
+  if (manifest.adapter !== request.adapter || manifest.installationType !== request.installationType || resolve38(manifest.targetRoot) !== request.targetRoot || actualStateKey !== stateKey) {
     throw new Error(`${label} install manifest identity does not match the requested adapter, target, installation type, and state key.`);
   }
   return manifest;
@@ -17162,7 +17313,7 @@ function entryDigest(entry) {
   return digest(entry);
 }
 function digest(value) {
-  return createHash20("sha256").update(canonicalJson6(value)).digest("hex");
+  return createHash21("sha256").update(canonicalJson6(value)).digest("hex");
 }
 function canonicalJson6(value) {
   if (Array.isArray(value)) return `[${value.map(canonicalJson6).join(",")}]`;
@@ -17176,9 +17327,9 @@ init_apply();
 init_manifest2();
 init_paths();
 init_transaction();
-import { createHash as createHash21, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash22, randomUUID as randomUUID7 } from "crypto";
 import { lstat as lstat5 } from "fs/promises";
-import { join as join52, resolve as resolve38 } from "path";
+import { join as join53, resolve as resolve39 } from "path";
 init_coordinator();
 init_declarations();
 init_protocol();
@@ -17196,13 +17347,13 @@ async function applyReleaseOwnership(request) {
   })) {
     if (!value || !/^[a-f0-9]{64}$/.test(value)) throw new Error(`Reviewed SHA-256 ${name} is required to release a claim.`);
   }
-  const workspaceRoot = resolve38(request.workspaceRoot);
+  const workspaceRoot = resolve39(request.workspaceRoot);
   const existing = activeMutationMetadata();
-  if (existing && (resolve38(existing.workspaceRoot) !== workspaceRoot || existing.reason !== request.reason.replace(/\r\n?/gu, "\n").trim() || request.operationId && request.operationId !== existing.operationId)) {
+  if (existing && (resolve39(existing.workspaceRoot) !== workspaceRoot || existing.reason !== request.reason.replace(/\r\n?/gu, "\n").trim() || request.operationId && request.operationId !== existing.operationId)) {
     throw new Error("Ownership release does not match the active governed workspace, reason or operation.");
   }
-  const operationId = mutationOperationIdSchema.parse(existing?.operationId ?? request.operationId ?? randomUUID6());
-  const auditPath = join52(workspaceRoot, ".agentwheel", "ownership-releases", `${operationId}.json`);
+  const operationId = mutationOperationIdSchema.parse(existing?.operationId ?? request.operationId ?? randomUUID7());
+  const auditPath = join53(workspaceRoot, ".agentwheel", "ownership-releases", `${operationId}.json`);
   const mutation = existing ? void 0 : await GovernedMutation.begin({
     workspaceRoot,
     commandName: "agentwheel ownership release-claim",
@@ -17232,9 +17383,9 @@ async function applyReleaseOwnership(request) {
 async function applyLocked(request, operationId, auditPath) {
   const transport = request.transport ?? localTransport;
   if (transport.kind !== "local") throw new Error("Ownership release supports local targets only.");
-  await assertNoSymlinkPath(join52(resolve38(request.targetRoot), ".agentwheel"));
+  await assertNoSymlinkPath(join53(resolve39(request.targetRoot), ".agentwheel"));
   await assertNoSymlinkPath(auditPath);
-  const lock = await acquireApplyLock(resolve38(request.targetRoot), request.adapter, transport, {}, {
+  const lock = await acquireApplyLock(resolve39(request.targetRoot), request.adapter, transport, {}, {
     installationType: request.installationType,
     stateKey: request.stateKey
   });
@@ -17303,15 +17454,15 @@ async function applyLocked(request, operationId, auditPath) {
 async function observe2(request) {
   const transport = request.transport ?? localTransport;
   if (transport.kind !== "local") throw new Error("Ownership release supports local targets only.");
-  const targetRoot = resolve38(request.targetRoot);
-  const workspaceRoot = resolve38(request.workspaceRoot);
+  const targetRoot = resolve39(request.targetRoot);
+  const workspaceRoot = resolve39(request.workspaceRoot);
   const reason = mutationReasonSchema.parse(request.reason.trim());
   if (!request.stateKey || stateKeyFor(request.adapter, { stateKey: request.stateKey }) !== request.stateKey || !request.installationType.trim() || !request.selector.includes("/")) {
     throw new Error("Ownership release requires an exact state key, installation type and type/name selector.");
   }
   const runtimePath = metadataRuntimePath(targetRoot, request.path);
   await assertNoSymlinkPath(workspaceRoot);
-  await assertNoSymlinkPath(join52(targetRoot, ".agentwheel"));
+  await assertNoSymlinkPath(join53(targetRoot, ".agentwheel"));
   const manifests = await listInstallManifests(targetRoot, void 0, transport);
   for (const item of manifests) await assertNoSymlinkPath(item.path);
   const source = manifests.find((item) => item.stateKey === request.stateKey);
@@ -17366,7 +17517,7 @@ async function observe2(request) {
   return { ...plan, planDigest: digest2(plan) };
 }
 function hash(content) {
-  return createHash21("sha256").update(content).digest("hex");
+  return createHash22("sha256").update(content).digest("hex");
 }
 function digest2(value) {
   return hash(canonicalJson7(value));
@@ -17384,10 +17535,11 @@ init_manifest2();
 init_paths();
 init_transaction();
 init_instructions_block();
-import { createHash as createHash23 } from "crypto";
-import { realpath as realpath3 } from "fs/promises";
-import { isAbsolute as isAbsolute12, join as join54, relative as relative17, resolve as resolve40 } from "path";
+init_fleet();
 init_manifest();
+import { createHash as createHash24 } from "crypto";
+import { realpath as realpath3 } from "fs/promises";
+import { isAbsolute as isAbsolute12, join as join55, relative as relative17, resolve as resolve41 } from "path";
 init_declarations();
 init_transport();
 init_fs();
@@ -17399,18 +17551,18 @@ init_instructions_block();
 init_merge_removal();
 init_graph_lock();
 init_manifest();
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 import { lstat as lstat6, readdir as readdir15 } from "fs/promises";
-import { basename as basename23, dirname as dirname35, join as join53, posix as posix7, relative as relative16, resolve as resolve39 } from "path";
+import { basename as basename23, dirname as dirname36, join as join54, posix as posix7, relative as relative16, resolve as resolve40 } from "path";
 async function inventoryHistoricalLocks(fleetRoot) {
-  const root = join53(fleetRoot, ".agentwheel", "locks");
+  const root = join54(fleetRoot, ".agentwheel", "locks");
   const found = [];
   async function visit(dir) {
     for (const entry of await readdir15(dir, { withFileTypes: true }).catch((error) => {
       if (error.code === "ENOENT") return [];
       throw error;
     })) {
-      const path = join53(dir, entry.name);
+      const path = join54(dir, entry.name);
       if (entry.isDirectory()) await visit(path);
       else if (entry.isFile() && entry.name.endsWith(".graph-lock.json")) found.push(await historicalLock(path));
     }
@@ -17419,14 +17571,14 @@ async function inventoryHistoricalLocks(fleetRoot) {
   return found.sort((a, b) => a.path.localeCompare(b.path));
 }
 async function findLegacyNamedLocks(workspaceRoot, adapter, fingerprint) {
-  const root = join53(workspaceRoot, ".agentwheel", "locks");
+  const root = join54(workspaceRoot, ".agentwheel", "locks");
   const found = [];
   for (const target of await readdir15(root, { withFileTypes: true }).catch((error) => {
     if (error.code === "ENOENT") return [];
     throw error;
   })) {
     if (!target.isDirectory()) continue;
-    const path = join53(root, target.name, adapter, `${fingerprint}.graph-lock.json`);
+    const path = join54(root, target.name, adapter, `${fingerprint}.graph-lock.json`);
     const stats = await lstat6(path).catch((error) => {
       if (error.code === "ENOENT") return void 0;
       throw error;
@@ -17448,7 +17600,7 @@ async function planLegacyRecovery(input) {
   const { graphPlan, installRoot, targetKey: targetKey2, adapter, installationType, historicalLocks, transport } = input;
   assertCompleteGraphPlan(graphPlan);
   const binding = {
-    targetLockDir: dirname35(graphPlan.graphLockPath),
+    targetLockDir: dirname36(graphPlan.graphLockPath),
     stableLockPath: graphPlan.graphLockPath,
     stableStateKey: graphPlan.plan.stateKey,
     currentFingerprint: graphPlan.targetFingerprint,
@@ -17487,7 +17639,7 @@ async function planLegacyRecovery(input) {
     const currentNodeIds = [...new Set(current.map((item) => item.graphNodeId).filter((value) => Boolean(value)))].sort();
     const currentSelectors = [...new Set(current.map((item) => item.logicalSelector).filter((value) => Boolean(value)))].sort();
     const currentOwners = [...new Set(current.flatMap((item) => item.owners ?? []))].sort();
-    const livePath = resolve39(installRoot, path);
+    const livePath = resolve40(installRoot, path);
     if (relative16(installRoot, livePath).startsWith("..")) throw new Error(`Manifest path escapes target: ${path}`);
     const liveHash = await transport.pathExists(livePath) ? await transport.hashPath(livePath) : null;
     const reasons = [];
@@ -17559,8 +17711,8 @@ function claimFor(item, entry, locks, binding) {
   const matches = locks.filter((candidate) => candidate.digest === digest3);
   const evidence = [];
   const owner = "workspaceOwner" in entry ? entry.workspaceOwner : legacyUnownedWorkspaceOwner;
-  const sameRoot = binding.transportKind === "ssh" ? posix7.normalize(item.manifest.targetRoot) === posix7.normalize(binding.installRoot) : resolve39(item.manifest.targetRoot) === resolve39(binding.installRoot);
-  const inTargetDir = matches.filter((candidate) => resolve39(dirname35(candidate.path)) === resolve39(binding.targetLockDir));
+  const sameRoot = binding.transportKind === "ssh" ? posix7.normalize(item.manifest.targetRoot) === posix7.normalize(binding.installRoot) : resolve40(item.manifest.targetRoot) === resolve40(binding.installRoot);
+  const inTargetDir = matches.filter((candidate) => resolve40(dirname36(candidate.path)) === resolve40(binding.targetLockDir));
   const boundLocks = inTargetDir.filter((candidate) => lockBindsState(candidate, item, binding));
   if (owner !== binding.expectedOwner) evidence.push("workspace owner differs from selected Fleet target");
   if (item.manifest.version !== 2 || item.manifest.installationType !== binding.installationType) evidence.push("installation type differs or manifest is legacy v1");
@@ -17602,7 +17754,7 @@ function lockBindsState(candidate, manifest, binding) {
   if (!name.endsWith(".graph-lock.json")) return false;
   const fingerprint = name.slice(0, -".graph-lock.json".length);
   if (!/^[a-f0-9]{64}$/u.test(fingerprint)) return false;
-  const stable = resolve39(candidate.path) === resolve39(binding.stableLockPath);
+  const stable = resolve40(candidate.path) === resolve40(binding.stableLockPath);
   if (stable) {
     return manifest.stateKey === binding.stableStateKey && candidate.lock.canonical.targetFingerprint === binding.currentFingerprint;
   }
@@ -17670,7 +17822,7 @@ function assertCompleteGraphPlan(plan) {
   }
 }
 function sha2566(value) {
-  return createHash22("sha256").update(value).digest("hex");
+  return createHash23("sha256").update(value).digest("hex");
 }
 
 // src/lifecycle/ownership-adopt-legacy.ts
@@ -17692,12 +17844,12 @@ async function planAdoptLegacyOwnership(request) {
 async function applyAdoptLegacyOwnership(request) {
   assertApplyPreconditions2(request);
   const transport = request.transport ?? localTransport;
-  const targetRoot = resolve40(request.targetRoot);
+  const targetRoot = resolve41(request.targetRoot);
   const installationType = request.installationType.trim();
   if (transport.kind !== "local") throw new Error("Legacy ownership adoption requires a local filesystem transport.");
   const beforeLock = await readInstallManifest(targetRoot, request.adapter, transport, { installationType, stateKey: request.sourceStateKey });
   if (beforeLock?.entries.some((entry) => entry.mode === "managed-block")) {
-    await assertNoSymlinkPath(join54(targetRoot, ".agentwheel"));
+    await assertNoSymlinkPath(join55(targetRoot, ".agentwheel"));
   }
   const lock = await acquireApplyLock(targetRoot, request.adapter, transport, {}, {
     installationType,
@@ -17936,13 +18088,13 @@ async function observe3(request, transport) {
       }))
     } } : {}
   };
-  return { ...withoutDigest, planDigest: createHash23("sha256").update(canonicalJson6(withoutDigest)).digest("hex") };
+  return { ...withoutDigest, planDigest: createHash24("sha256").update(canonicalJson6(withoutDigest)).digest("hex") };
 }
 async function normalizeRequest2(request) {
   if (request.destinationFleetId !== void 0) {
     throw new Error("Legacy ownership adoption targets a nested workspace; a Fleet target uses fleet normalize or ownership retire-stale.");
   }
-  const targetRoot = resolve40(request.targetRoot);
+  const targetRoot = resolve41(request.targetRoot);
   const installationType = request.installationType.trim();
   const sourceStateKey = exactStateKey(request.adapter, request.sourceStateKey, installationType, "source");
   const destinationStateKey = exactStateKey(request.adapter, request.destinationStateKey, installationType, "destination");
@@ -17954,22 +18106,22 @@ async function normalizeRequest2(request) {
   const scope = await resolveWorkspaceOwnershipScope(request.workspaceRoot, { globalRoot: request.globalRoot });
   const destinationOwner = workspaceOwnerForRoot(scope.root, scope.fleetId);
   const workspaceRoot = await realpath3(request.workspaceRoot);
-  const sourceRoot = resolve40(request.fromWorkspaceRoot);
+  const sourceRoot = resolve41(request.fromWorkspaceRoot);
   const sourceOwner = workspaceOwnerForRoot(sourceRoot);
   let sourceClass;
-  if (sourceRoot === workspaceRoot || sourceRoot === resolve40(request.workspaceRoot)) {
+  if (sourceRoot === workspaceRoot || sourceRoot === resolve41(request.workspaceRoot)) {
     if (sourceOwner === destinationOwner) {
       throw new Error(`${sourceOwner} is already the destination owner; ordinary install migration handles its legacy state.`);
     }
     sourceClass = "own-legacy-owner";
   } else {
     const sourceForms = [sourceRoot, ...await realpath3(sourceRoot).then((path) => [path], () => [])];
-    const workspaceForms = [workspaceRoot, resolve40(request.workspaceRoot), scope.root];
+    const workspaceForms = [workspaceRoot, resolve41(request.workspaceRoot), scope.root];
     if (sourceForms.some((source) => workspaceForms.some((workspace) => containsPath2(source, workspace) || containsPath2(workspace, source)))) {
       throw new Error(`Source root ${sourceRoot} contains or is contained by the destination workspace; it cannot be adopted as a foreign root.`);
     }
     for (const fleet of await listRegisteredFleets({ globalRoot: request.globalRoot })) {
-      const fleetForms = [resolve40(fleet.root), ...await realpath3(fleet.root).then((path) => [path], () => [])];
+      const fleetForms = [resolve41(fleet.root), ...await realpath3(fleet.root).then((path) => [path], () => [])];
       if (sourceForms.some((source) => fleetForms.some((root) => containsPath2(root, source)))) {
         throw new Error(`Source root ${sourceRoot} is inside registered Fleet '${fleet.id}'; use fleet normalize or ownership retire-stale.`);
       }
@@ -18126,7 +18278,7 @@ function containsPath2(parent, candidate) {
 // src/version/policy.ts
 import { execFile as execFile7 } from "child_process";
 import { readFile as readFile40 } from "fs/promises";
-import { join as join55, resolve as resolve41 } from "path";
+import { join as join56, resolve as resolve42 } from "path";
 import { promisify as promisify7 } from "util";
 import { parse as parseJsonc } from "jsonc-parser";
 import { z as z15 } from "zod";
@@ -18223,7 +18375,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
     if (tagged.length > 0) return tagged;
   }
   if (driverName === "local") {
-    const root = resolve41(workspaceRoot, pkg.source);
+    const root = resolve42(workspaceRoot, pkg.source);
     const manifest2 = await readPackageManifest(root);
     const current = manifest2 ? [{ version: manifest2.version, ref: pkg.requestedRef ?? root }] : [];
     try {
@@ -18238,7 +18390,7 @@ async function discoverVersionsFromSource(pkg, workspaceRoot) {
   }
   const driver = getSourceDriver(driverName);
   const resolved = await driver.resolve(pkg.source, {
-    cacheRoot: join55(workspaceRoot, ".agentwheel", "cache"),
+    cacheRoot: join56(workspaceRoot, ".agentwheel", "cache"),
     mode: "tracking",
     ref: pkg.requestedRef
   });
@@ -18332,7 +18484,7 @@ function gitUrlFromSource(source) {
   throw new Error(`Version discovery does not support Git source: ${source}`);
 }
 function versionCachePath(workspaceRoot) {
-  return join55(workspaceRoot, ".agentwheel", "cache", "version-index.json");
+  return join56(workspaceRoot, ".agentwheel", "cache", "version-index.json");
 }
 async function readVersionCache(path) {
   if (!await pathExists(path)) return { schemaVersion: 1, sources: {} };
@@ -18349,7 +18501,7 @@ init_semver();
 // src/profile/members.ts
 import { execFile as execFile8 } from "child_process";
 import { readFile as readFile41 } from "fs/promises";
-import { join as join56, resolve as resolve42 } from "path";
+import { join as join57, resolve as resolve43 } from "path";
 import { promisify as promisify8 } from "util";
 import { z as z17 } from "zod";
 
@@ -18525,7 +18677,7 @@ async function invokeMemberStatus(member, parentWorkspace, chain, options, cliEn
   let stderr = "";
   try {
     if (member.transport === "local") {
-      const workspace = resolve42(parentWorkspace, member.workspace);
+      const workspace = resolve43(parentWorkspace, member.workspace);
       const result = await execFileAsync8(process.execPath, [cliEntry, ...args], {
         cwd: workspace,
         env: env2,
@@ -18571,7 +18723,7 @@ async function runMemberAgentwheel(member, parentWorkspace, args, chain) {
         process.execPath,
         [process.argv[1], ...memberCommandArgs(member, args)],
         {
-          cwd: resolve42(parentWorkspace, member.workspace),
+          cwd: resolve43(parentWorkspace, member.workspace),
           env: env2,
           maxBuffer: 20 * 1024 * 1024
         }
@@ -18651,7 +18803,7 @@ function memberFailure(member, health, error) {
   };
 }
 function memberCachePath(workspaceRoot, profileName, memberId) {
-  return join56(workspaceRoot, ".agentwheel", "cache", "member-status", profileName, `${memberId}.json`);
+  return join57(workspaceRoot, ".agentwheel", "cache", "member-status", profileName, `${memberId}.json`);
 }
 async function readMemberCache(path) {
   if (!await pathExists(path)) return void 0;
@@ -18677,7 +18829,7 @@ function assertNoCompositeCycle(workspaceRoot, profileName, chain) {
   }
 }
 function compositeKey(workspaceRoot, profileName) {
-  return `${resolve42(workspaceRoot)}#${profileName}`;
+  return `${resolve43(workspaceRoot)}#${profileName}`;
 }
 
 // src/status/repository.ts
@@ -18724,10 +18876,10 @@ function valueAfter(lines, prefix) {
 }
 
 // src/catalogue/client.ts
-import { createHash as createHash24 } from "crypto";
+import { createHash as createHash25 } from "crypto";
 import { readFile as readFile42, rm as rm15 } from "fs/promises";
 import { homedir as homedir15 } from "os";
-import { join as join57 } from "path";
+import { join as join58 } from "path";
 
 // src/model/catalogue.ts
 import { z as z18 } from "zod";
@@ -19000,18 +19152,18 @@ var CatalogueClient = class {
     }
     return {
       value: schema.parse(value),
-      digest: createHash24("sha256").update(bytes).digest("hex")
+      digest: createHash25("sha256").update(bytes).digest("hex")
     };
   }
 };
 function defaultCatalogueCachePath() {
-  return join57(homedir15(), ".agentwheel", "catalogue-cache.json");
+  return join58(homedir15(), ".agentwheel", "catalogue-cache.json");
 }
 function sameSources2(a, b) {
   return a.length === b.length && a.every((source, index) => source === b[index]);
 }
 function catalogueContentHash(enriched, vercel) {
-  return createHash24("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
+  return createHash25("sha256").update(JSON.stringify({ enriched, vercel })).digest("hex");
 }
 
 // src/search/index.ts
@@ -19373,9 +19525,9 @@ function includesToken(normalizedText, token) {
 }
 
 // src/semantic/index.ts
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 import { homedir as homedir16 } from "os";
-import { join as join58 } from "path";
+import { join as join59 } from "path";
 import { env, pipeline } from "@huggingface/transformers";
 var DEFAULT_SEMANTIC_INDEX_URL = "https://raw.githubusercontent.com/NestDevLab/agentwheel-registry/main/catalogue-semantic-index/gte-v1/";
 var CONTRACT = {
@@ -19463,13 +19615,13 @@ var SemanticSearchClient = class {
     if (!response.ok) throw new Error(`Semantic index file failed (${response.status}): ${descriptor.path}`);
     const bytes = new Uint8Array(await response.arrayBuffer());
     if (bytes.byteLength !== descriptor.bytes) throw new Error(`Semantic index file size does not match: ${descriptor.path}`);
-    const digest3 = createHash25("sha256").update(bytes).digest("hex");
+    const digest3 = createHash26("sha256").update(bytes).digest("hex");
     if (digest3 !== descriptor.sha256) throw new Error(`Semantic index checksum does not match: ${descriptor.path}`);
     return bytes;
   }
 };
 async function embedQuery(query) {
-  env.cacheDir = join58(homedir16(), ".agentwheel", "semantic-models");
+  env.cacheDir = join59(homedir16(), ".agentwheel", "semantic-models");
   const extractor = await pipeline("feature-extraction", CONTRACT.model.id, {
     revision: CONTRACT.model.revision,
     dtype: CONTRACT.model.dtype,
@@ -19554,9 +19706,9 @@ function ensureTrailingSlash(value) {
 
 // src/trial/skill.ts
 init_selection();
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 import { readFile as readFile43, stat as stat16 } from "fs/promises";
-import { join as join59 } from "path";
+import { join as join60 } from "path";
 import { parse as parseYaml2 } from "yaml";
 var MAX_TRIAL_SKILL_BYTES = 512 * 1024;
 async function createSkillTrial(driver, resolved, selectors) {
@@ -19568,7 +19720,7 @@ async function createSkillTrial(driver, resolved, selectors) {
     throw new Error("Skill trial requires exactly one selected skill. Use --skill <name> or --select skills/<name>.");
   }
   const artifact = skills[0];
-  const path = artifact.kind === "dir" ? join59(artifact.sourcePath, "SKILL.md") : artifact.sourcePath;
+  const path = artifact.kind === "dir" ? join60(artifact.sourcePath, "SKILL.md") : artifact.sourcePath;
   const info = await stat16(path);
   if (info.size > MAX_TRIAL_SKILL_BYTES) {
     throw new Error(`Skill trial exceeds the ${MAX_TRIAL_SKILL_BYTES / 1024} KiB content limit.`);
@@ -19584,7 +19736,7 @@ async function createSkillTrial(driver, resolved, selectors) {
     skill: {
       name: artifact.name,
       relativePath: artifact.relativePath,
-      sha256: createHash26("sha256").update(content).digest("hex"),
+      sha256: createHash27("sha256").update(content).digest("hex"),
       frontmatter,
       content
     }
@@ -19602,17 +19754,21 @@ function readSkillFrontmatter(content, artifact) {
   return { name: value.name, description: value.description };
 }
 
+// src/cli/index.ts
+init_fleet();
+
 // src/lifecycle/fleet-normalize.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import { readFile as readFile44, readdir as readdir16, rm as rm16 } from "fs/promises";
 import { homedir as homedir17 } from "os";
-import { dirname as dirname36, isAbsolute as isAbsolute13, join as join60, relative as relative18, resolve as resolve43 } from "path";
+import { dirname as dirname37, isAbsolute as isAbsolute13, join as join61, relative as relative18, resolve as resolve44 } from "path";
 init_manifest2();
 init_paths();
 init_merge_removal();
 init_instructions_block();
 init_transaction();
 init_adapter();
+init_fleet();
 init_graph_lock();
 init_manifest();
 init_workspace();
@@ -19896,17 +20052,17 @@ function normalizeRequest3(request) {
     ...profile ? { profile } : {},
     ...agent ? { agent } : {},
     ...orphanedOwnerRoots ? { orphanedOwnerRoots } : {},
-    ...request.globalRoot ? { globalRoot: resolve43(request.globalRoot) } : {}
+    ...request.globalRoot ? { globalRoot: resolve44(request.globalRoot) } : {}
   };
 }
 function normalizeOrphanedOwnerRoot(value) {
   const root = value.trim();
   if (!root || !isAbsolute13(root)) throw new Error(`Invalid orphaned owner root '${value}'; expected an absolute workspace path.`);
-  return resolve43(root);
+  return resolve44(root);
 }
 async function normalizationRoots(request) {
   const destination = await showRegisteredFleet(request.destinationFleet, { globalRoot: request.globalRoot });
-  const source = request.from === "user" ? resolve43(request.globalRoot ?? homedir17()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
+  const source = request.from === "user" ? resolve44(request.globalRoot ?? homedir17()) : (await showRegisteredFleet(request.from.slice("fleet:".length), { globalRoot: request.globalRoot })).root;
   return { source, destination: destination.root };
 }
 async function withOrderedLocks(roots, fn) {
@@ -19914,7 +20070,7 @@ async function withOrderedLocks(roots, fn) {
     if (index === roots.length) return fn();
     const root = roots[index];
     return withFilesystemLock(
-      join60(root, ".agentwheel", "fleet-normalize.lock"),
+      join61(root, ".agentwheel", "fleet-normalize.lock"),
       5e3,
       () => run(index + 1),
       "fleet normalization"
@@ -20121,7 +20277,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
   let normalizedGraphCount = 0;
   for (const graph of graphCandidates) {
     const destinationState = await targetStateForGraph(fleet, graph, fleet.fleetId, allowOrphanedRetiredPackages);
-    if (resolve43(destinationState.graphLockPath) === resolve43(graph.path)) {
+    if (resolve44(destinationState.graphLockPath) === resolve44(graph.path)) {
       const destinationManifest = (await collectManifestPaths([destinationState.manifestPath]))[0];
       if (destinationManifest?.manifest.entries.some((entry) => entry.workspaceOwner === fleetOwner && entryMatchesPackages(entry, selected))) {
         assertCorrelatedGraphManifest(
@@ -20136,7 +20292,7 @@ async function inspectLegacySelfInstalledState(fleet, packageNames, profileName,
       }
     }
     const legacyState = await legacyTargetStateForGraph(fleet, graph, allowOrphanedRetiredPackages);
-    if (resolve43(legacyState.graphLockPath) !== resolve43(graph.path)) {
+    if (resolve44(legacyState.graphLockPath) !== resolve44(graph.path)) {
       throw new Error(`Legacy graph lock target identity is stale or noncanonical: ${graph.path}`);
     }
     const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
@@ -20311,7 +20467,7 @@ function targetKeysForAgent(scope, name) {
 async function runtimeRoots(scope) {
   const roots = /* @__PURE__ */ new Set([scope.root]);
   if (scope.config.packages.some((pkg) => pkg.installationType === "user") || Object.values(scope.config.agents).some((agent) => agent.installationType === "user")) {
-    roots.add(resolve43(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir17()));
+    roots.add(resolve44(process.env.AGENTWHEEL_TEST_HOME || process.env.HOME || homedir17()));
   }
   for (const [name, agent] of Object.entries(scope.config.agents)) {
     if (agent.transport === "ssh" || agent.transport === "local-run-as") throw new Error(`Installed-state normalization cannot inspect ${agent.transport} agent '${name}' locally.`);
@@ -20329,7 +20485,7 @@ async function runtimeRoots(scope) {
 async function collectManifests(roots) {
   const found = /* @__PURE__ */ new Map();
   for (const root of roots) {
-    const dir = join60(root, ".agentwheel");
+    const dir = join61(root, ".agentwheel");
     let names;
     try {
       names = await readdir16(dir);
@@ -20339,7 +20495,7 @@ async function collectManifests(roots) {
     }
     for (const name of names.sort((a, b) => a.localeCompare(b))) {
       if (!name.endsWith(".install-manifest.json")) continue;
-      const path = join60(dir, name);
+      const path = join61(dir, name);
       const raw = JSON.parse(await readFile44(path, "utf8"));
       const parsed = installManifestSchema.parse(raw);
       if (parsed.version !== 2) {
@@ -20348,14 +20504,14 @@ async function collectManifests(roots) {
         }
         continue;
       }
-      if (resolve43(parsed.targetRoot) !== resolve43(root)) {
+      if (resolve44(parsed.targetRoot) !== resolve44(root)) {
         throw new Error(`Install manifest target root does not match its enumerated runtime root: ${path}`);
       }
       const expectedPath = installManifestPath(parsed.targetRoot, parsed.adapter, {
         installationType: parsed.installationType,
         stateKey: parsed.stateKey
       });
-      if (resolve43(expectedPath) !== resolve43(path)) {
+      if (resolve44(expectedPath) !== resolve44(path)) {
         throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
       }
       found.set(path, { path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -20376,7 +20532,7 @@ async function collectManifestPaths(paths) {
       installationType: parsed.installationType,
       stateKey: parsed.stateKey
     });
-    if (resolve43(expectedPath) !== resolve43(path)) {
+    if (resolve44(expectedPath) !== resolve44(path)) {
       throw new Error(`Install manifest state identity does not match its canonical path: ${path}`);
     }
     found.push({ path, raw, manifest: { ...parsed, revision: computeManifestRevision(raw), legacy: false } });
@@ -20395,7 +20551,7 @@ function assertNoForeignSamePathOwnership(manifests, renderedPaths, allowedOwner
   }
 }
 async function relevantGraphLocks(workspaceRoot, selected, targetKeys, include) {
-  const root = join60(workspaceRoot, ".agentwheel", "locks");
+  const root = join61(workspaceRoot, ".agentwheel", "locks");
   if (!await pathExists(root)) return [];
   const results = [];
   for (const path of await listFiles(root)) {
@@ -20444,7 +20600,7 @@ async function hasRelevantLegacyManifestCandidate(scope, graph, selected) {
   const legacyManifest = (await collectManifestPaths([legacyState.manifestPath]))[0];
   if (legacyManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected))) return true;
   const stableState = await targetStateForGraph(scope, graph, scope.fleetId ?? null);
-  if (resolve43(stableState.graphLockPath) !== resolve43(graph.path)) return false;
+  if (resolve44(stableState.graphLockPath) !== resolve44(graph.path)) return false;
   const stableManifest = (await collectManifestPaths([stableState.manifestPath]))[0];
   return stableManifest?.manifest.entries.some((entry) => entryMatchesGraphPackages(entry, graph.lock, selected)) ?? false;
 }
@@ -20465,7 +20621,7 @@ async function legacyManifestPathForConfiguredTarget(scope, graph) {
     baseDir: scope.root
   });
   const targetRoot = resolveConfigPath(agent.root, scope.root);
-  const installRoot = resolve43(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, { kind: "local" }));
+  const installRoot = resolve44(installRootForAdapterInstallationType(adapter, targetRoot, agent.installationType, { kind: "local" }));
   const stateKey = stateKeyFor(adapter.name, {
     installationType: agent.installationType,
     stateKey: agent.stateKey,
@@ -20533,7 +20689,7 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
     ssh: void 0,
     ...agent?.stateKey ? { stateKey: agent.stateKey } : {}
   };
-  const installRoot = resolve43(installRootForAdapterInstallationType(adapter, targetRoot, installationType, { kind: "local" }));
+  const installRoot = resolve44(installRootForAdapterInstallationType(adapter, targetRoot, installationType, { kind: "local" }));
   const targetIdentity = resolveTargetStateIdentity({
     targetFingerprintParts: fingerprintParts,
     workspaceRoot: scope.root,
@@ -20565,16 +20721,16 @@ async function targetStateForGraph(scope, graph, identityFleetId = scope.fleetId
 async function installedTargetStateForGraph(scope, graph, manifests, owners, selected, identityFleetId = scope.fleetId ?? null) {
   const stable = await targetStateForGraph(scope, graph, identityFleetId);
   let state;
-  if (resolve43(graph.path) === resolve43(stable.graphLockPath)) {
+  if (resolve44(graph.path) === resolve44(stable.graphLockPath)) {
     state = stable;
   } else {
     const released = await releasedTargetStateForGraph(scope, graph, identityFleetId);
-    if (resolve43(graph.path) !== resolve43(released.graphLockPath)) {
+    if (resolve44(graph.path) !== resolve44(released.graphLockPath)) {
       throw new Error(`Graph lock target identity is stale or noncanonical: ${graph.path}`);
     }
     state = released;
   }
-  const manifest = manifests.find((candidate) => resolve43(candidate.path) === resolve43(state.manifestPath));
+  const manifest = manifests.find((candidate) => resolve44(candidate.path) === resolve44(state.manifestPath));
   if (!manifest) {
     throw new Error(`Graph lock is not covered by its canonical install manifest: ${state.manifestPath}`);
   }
@@ -20598,7 +20754,7 @@ async function releasedTargetStateForGraph(scope, graph, identityFleetId = scope
     ...current,
     stateKey,
     targetFingerprint,
-    graphLockPath: join60(dirname36(graph.path), `${targetFingerprint}.graph-lock.json`),
+    graphLockPath: join61(dirname37(graph.path), `${targetFingerprint}.graph-lock.json`),
     manifestPath: installManifestPath(current.installRoot, current.adapter, {
       installationType: current.installationType,
       stateKey
@@ -20606,7 +20762,7 @@ async function releasedTargetStateForGraph(scope, graph, identityFleetId = scope
   };
 }
 function assertCorrelatedGraphManifest(graph, state, manifest, owners, selected) {
-  if (manifest.manifest.adapter !== state.adapter || manifest.manifest.installationType !== state.installationType || manifest.manifest.stateKey !== state.stateKey || resolve43(manifest.manifest.targetRoot) !== resolve43(state.installRoot)) {
+  if (manifest.manifest.adapter !== state.adapter || manifest.manifest.installationType !== state.installationType || manifest.manifest.stateKey !== state.stateKey || resolve44(manifest.manifest.targetRoot) !== resolve44(state.installRoot)) {
     throw new Error(`Install manifest identity does not match graph target state: ${manifest.path}`);
   }
   const entries = manifest.manifest.entries.filter((entry) => entryMatchesGraphPackages(entry, graph.lock, selected));
@@ -20663,7 +20819,7 @@ function destinationGraphFromSource(source, targetFingerprint) {
 function mergeDestinationManifest(existing, state, generatedAt, desiredEntries, replaceOwners = /* @__PURE__ */ new Set()) {
   if (existing) {
     const manifest2 = existing.manifest;
-    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve43(manifest2.targetRoot) !== state.installRoot) {
+    if (manifest2.adapter !== state.adapter || manifest2.installationType !== state.installationType || manifest2.stateKey !== state.stateKey || resolve44(manifest2.targetRoot) !== state.installRoot) {
       throw new Error(`Destination manifest identity diverges from the derived target: ${existing.path}`);
     }
   }
@@ -20723,7 +20879,7 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
       const content = await readFile44(path, "utf8");
       if (hasMergeRemovalContent(entry.mergeRemoval)) {
         assertExactMergeContribution(entry.mergeRemoval, entry.mergeStrategy, content);
-      } else if (resolve43(sourcePath) === resolve43(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
+      } else if (resolve44(sourcePath) === resolve44(destinationPath) && entry.mergeStrategy !== "codex-toml-mcp") {
         assertExactMergeContribution({}, entry.mergeStrategy, content);
       } else {
         throw new Error(`Installed-state normalization cannot prove incomplete merge ownership at ${path}.`);
@@ -20734,8 +20890,8 @@ async function assertEquivalentRuntimeState(entry, sourcePath, destinationPath)
   await assertEquivalentRuntimeBytes(sourcePath, destinationPath, entry.hash);
 }
 function renderedEntryPathForRoot(root, entryPath) {
-  const normalizedRoot = resolve43(root);
-  const candidate = resolve43(normalizedRoot, entryPath);
+  const normalizedRoot = resolve44(root);
+  const candidate = resolve44(normalizedRoot, entryPath);
   if (candidate !== normalizedRoot && !candidate.startsWith(`${normalizedRoot}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entryPath}`);
   }
@@ -20826,8 +20982,8 @@ function ownerMatchesGraphPackage(lock, owner, selected) {
   return ownerMatchesPackage(owner, selected) || lock.canonical.roots.some((root) => selected.has(root.rootId) && root.graphNodeId === owner);
 }
 function renderedEntryPath(manifest, entry) {
-  const root = resolve43(manifest.targetRoot);
-  const candidate = resolve43(root, entry.path);
+  const root = resolve44(manifest.targetRoot);
+  const candidate = resolve44(root, entry.path);
   if (candidate !== root && !candidate.startsWith(`${root}/`)) {
     throw new Error(`Install manifest entry escapes its target root: ${entry.path}`);
   }
@@ -21168,7 +21324,7 @@ function configRevision(config) {
   return sha2567(canonicalJson8(config));
 }
 function normalizationJournalPath(sourceRoot, destinationFleet) {
-  return join60(sourceRoot, ".agentwheel", `fleet-normalize-${destinationFleet}.journal.json`);
+  return join61(sourceRoot, ".agentwheel", `fleet-normalize-${destinationFleet}.journal.json`);
 }
 function canonicalJson8(value) {
   return JSON.stringify(sortValue(value));
@@ -21181,7 +21337,7 @@ function sortValue(value) {
   return value;
 }
 function sha2567(value) {
-  return createHash27("sha256").update(value).digest("hex");
+  return createHash28("sha256").update(value).digest("hex");
 }
 function assertDigest(value) {
   if (!/^[a-f0-9]{64}$/.test(value)) throw new Error(`Invalid plan digest: ${value}`);
@@ -21335,7 +21491,7 @@ fleetCommand.command("normalize").description("plan or apply duplicate desired-s
 });
 cacheCommand.command("prune").description("remove old Git source snapshots while preserving locked commits").option("--user", "use the user workspace", false).option("--local", "use the nearest local workspace", false).option("--fleet <id>", "use one registered named fleet").option("-t, --target-root <path>", "explicit workspace root").option("--keep <count>", "newest snapshots to retain per source", parsePositiveInteger, 3).option("--apply", "delete the selected snapshots; without this flag only preview", false).action(async (options) => {
   const targetRoot = await workspaceContextRootFromOptions(normalizeRuntimeScopeOptions(options));
-  const cacheRoot = join61(targetRoot, ".agentwheel", "cache");
+  const cacheRoot = join62(targetRoot, ".agentwheel", "cache");
   const result = await pruneGitCache(cacheRoot, { keepSnapshots: options.keep, dryRun: !options.apply });
   const verb = options.apply ? "Removed" : "Would remove";
   for (const path of result.removedPaths) console.log(`${verb} ${path}`);
@@ -21355,7 +21511,7 @@ program.command("pin").description("pin configured revisions or replace package
     throw new Error("Choose pin <alias> <commit> [--select ...], --pins-file <path>, or --packages-file <path>, exclusively.");
   }
   const inputFile = options.packagesFile ?? options.pinsFile;
-  const input = inputFile ? JSON.parse(await readFile45(resolve44(inputFile), "utf8")) : [{ alias, commit, ...options.select === void 0 ? {} : { select: options.select } }];
+  const input = inputFile ? JSON.parse(await readFile45(resolve45(inputFile), "utf8")) : [{ alias, commit, ...options.select === void 0 ? {} : { select: options.select } }];
   const config = await pinConfiguredPackages(workspaceRoot, input, {
     dryRun: options.dryRun,
     replacePackages: options.packagesFile !== void 0
@@ -21368,7 +21524,7 @@ program.command("list").description("list artifacts exposed by a package source"
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const selectedArtifacts = selectedArtifactsFromOptionsOrRegistry(options, resolvedInput.registryEntry);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
-  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join61(targetRoot, ".agentwheel", "cache") }))));
+  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join62(targetRoot, ".agentwheel", "cache") }))));
   try {
     const artifacts = filterArtifactsBySelection(await driver.list(resolved), selectedArtifacts);
     for (const artifact of artifacts) {
@@ -21437,7 +21593,7 @@ program.command("try").description("read and validate one skill for the current
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
   const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, {
-    cacheRoot: join61(targetRoot, ".agentwheel", "cache")
+    cacheRoot: join62(targetRoot, ".agentwheel", "cache")
   }))));
   try {
     const trial = await createSkillTrial(driver, resolved, selectedArtifactsFromOptionsOrRegistry(options, resolvedInput.registryEntry));
@@ -21459,7 +21615,7 @@ program.command("scan").description("scan a package source for validation findin
   const targetRoot = await workspaceContextRootFromOptions(normalizeRuntimeScopeOptions(options));
   const resolvedInput = await resolvePackageSource(source, targetRoot);
   const driver = getSourceDriver(options.driver ?? inferSourceDriverName(resolvedInput.source));
-  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join61(targetRoot, ".agentwheel", "cache") }))));
+  const resolved = await driver.export(await driver.translate(await driver.fetch(await driver.resolve(resolvedInput.source, { cacheRoot: join62(targetRoot, ".agentwheel", "cache") }))));
   try {
     const result = await driver.scan(resolved);
     if (result.findings.length === 0) {
@@ -21715,11 +21871,15 @@ ownershipCommand.command("handoff").description("transfer one managed artifact b
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
   if (options.toFleet) {
     const fleet = await showRegisteredFleet(options.toFleet);
-    if (resolve44(fleet.root) !== resolve44(toWorkspaceRoot)) {
+    if (resolve45(fleet.root) !== resolve45(toWorkspaceRoot)) {
       throw new Error(`Destination fleet '${options.toFleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
     }
   }
   const request = {
+    workspaceRoot: await workspaceRootFromOptions(normalizedOptions),
+    reason: options.reason,
+    operationId: options.operationId,
+    noCommit: options.commit === false,
     installationType,
     stateKey: state.stableStateKey,
     targetRoot: state.installRoot,
@@ -21756,8 +21916,8 @@ ownershipCommand.command("recovery-plan").description("write a read-only per-pat
   const adapter = await resolveAdapterForTarget(target, {});
   const transport = transportForTarget(target);
   const requestedReport = normalizeCliPath(options.report);
-  const reportPath = join61(await realpath4(dirname37(requestedReport)), basename24(requestedReport));
-  const reportInsideTarget = relative19(resolve44(target.targetRoot), reportPath);
+  const reportPath = join62(await realpath4(dirname38(requestedReport)), basename24(requestedReport));
+  const reportInsideTarget = relative19(resolve45(target.targetRoot), reportPath);
   if (reportInsideTarget === "" || !reportInsideTarget.startsWith("..") && !isAbsolute14(reportInsideTarget)) {
     throw new Error("Recovery report must be outside the runtime target root.");
   }
@@ -21788,7 +21948,7 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
   const normalizedOptions = normalizeRuntimeScopeOptions(options);
   const fleet = await showRegisteredFleet(options.fleet);
   const toWorkspaceRoot = normalizeCliPath(options.toWorkspaceRoot);
-  if (resolve44(fleet.root) !== resolve44(toWorkspaceRoot)) {
+  if (resolve45(fleet.root) !== resolve45(toWorkspaceRoot)) {
     throw new Error(`Destination Fleet '${options.fleet}' is registered at ${fleet.root}, not ${toWorkspaceRoot}.`);
   }
   const targets = await resolveCliTargets(normalizedOptions);
@@ -21796,7 +21956,7 @@ ownershipCommand.command("retire-stale").description("retire stale source-manife
     throw new Error(`Stale ownership retirement requires exactly one destination Fleet target, found ${targets.length}.`);
   }
   const target = targets[0];
-  if (target.fleetId !== options.fleet || resolve44(target.workspaceRoot) !== resolve44(fleet.root)) {
+  if (target.fleetId !== options.fleet || resolve45(target.workspaceRoot) !== resolve45(fleet.root)) {
     throw new Error(`Resolved target does not belong to destination Fleet '${options.fleet}'.`);
   }
   const adapterOptions = adapterOptionsForTarget(target, normalizedOptions);
@@ -21918,7 +22078,7 @@ ownershipCommand.command("adopt-legacy").description("move proven legacy-keyed o
   ];
   for (const { flag, requested, resolved, none } of requestedAdapterSettings) {
     if (requested === void 0) continue;
-    if (resolved !== void 0 && resolve44(target.workspaceRoot, requested) === resolve44(target.workspaceRoot, resolved)) continue;
+    if (resolved !== void 0 && resolve45(target.workspaceRoot, requested) === resolve45(target.workspaceRoot, resolved)) continue;
     throw new Error(`${flag} ${requested} does not match what install resolves for the configured packages: ${resolved ?? none}.`);
   }
   const adapter = await resolveAdapterForTarget(group.target, adapterOptions);
@@ -22088,7 +22248,7 @@ journalCommand.command("list").description("show pending apply journals for reso
     if (!journal) continue;
     pending += 1;
     console.log(`PENDING ${state.adapter.name}/${state.installationType} at ${state.installRoot}`);
-    console.log(`  journal: ${join61(state.installRoot, ".agentwheel", `${state.state.stateKey}.apply-journal.json`)}`);
+    console.log(`  journal: ${join62(state.installRoot, ".agentwheel", `${state.state.stateKey}.apply-journal.json`)}`);
     console.log(`  stateKey: ${state.state.stateKey}`);
     console.log(`  createdAt: ${journal.createdAt}`);
     console.log(`  updatedAt: ${journal.updatedAt}`);
@@ -22438,14 +22598,14 @@ async function packageEntryFromSource(source, targetRoot, options) {
     );
   }
   const bundle = options.deferGraphRendering ? await stageSourceRaw(driver, resolvedSource, {
-    cacheRoot: join61(targetRoot, ".agentwheel", "cache"),
+    cacheRoot: join62(targetRoot, ".agentwheel", "cache"),
     mode: options.mode,
     ref: initialVersion?.ref,
     frozenLock: lockMode
   }) : await stageSource(driver, resolvedSource, {
     workspaceRoot: targetRoot,
     adapter,
-    cacheRoot: join61(targetRoot, ".agentwheel", "cache"),
+    cacheRoot: join62(targetRoot, ".agentwheel", "cache"),
     mode: options.mode,
     ref: initialVersion?.ref,
     frozenLock: lockMode,
@@ -23054,7 +23214,7 @@ function scopeUpdatePlanToDependencies(result, selectors, previousLock, manifest
     selectedPreviousNodeIds,
     selectedRootIds
   );
-  const graphLockDigest = createHash28("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash29("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...result,
     bundle: { ...result.bundle, graphLock },
@@ -23180,7 +23340,7 @@ function operationBelongsToDependencyUpdate(operation, allowedNodeIds, allowedNa
 function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest);
   const graphLock = focusedGraphLockForInstall(scoped.bundle.graphLock, rootId, focused);
-  const graphLockDigest = createHash28("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash29("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -23191,7 +23351,7 @@ function scopeInstallPlanToArtifact(result, rootId, focused, manifest) {
 function scopeUpdatePlanToArtifact(result, rootId, focused, previousLock, manifest) {
   const scoped = scopePlanOperationsToArtifact(result, rootId, focused, manifest, previousLock);
   const graphLock = mergeFocusedArtifactGraphLock(scoped.bundle.graphLock, previousLock, rootId, focused);
-  const graphLockDigest = createHash28("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash29("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -23486,7 +23646,7 @@ function scopeUpdatePlanToRoot(result, rootId, previousLock, manifest) {
     selectedPreviousNodeIds,
     /* @__PURE__ */ new Set([rootId])
   );
-  const graphLockDigest = createHash28("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
+  const graphLockDigest = createHash29("sha256").update(canonicalGraphLockJson(graphLock)).digest("hex");
   return {
     ...scoped,
     bundle: { ...scoped.bundle, graphLock },
@@ -23558,7 +23718,7 @@ function keepManifestEntryOperation(entry, targetRoot, scopeDescription, operati
     artifactType: entry.artifactType,
     artifactName: entry.artifactName,
     kind: entry.kind,
-    destPath: operation?.destPath ?? join61(targetRoot, entry.path),
+    destPath: operation?.destPath ?? join62(targetRoot, entry.path),
     relativeDestPath: entry.path,
     desiredHash: entry.sourceHash,
     currentHash: operation?.currentHash ?? entry.hash,
@@ -23759,7 +23919,7 @@ function installRootContextForTarget(target) {
   return { kind: target.transport, homeRoot: target.runAs?.home };
 }
 async function withFreshReadOnlyGraphPlan(target, adapter, adapterOptions, installationType, packages, use) {
-  const stage = await mkdtemp6(join61(tmpdir7(), "agentwheel-recovery-"));
+  const stage = await mkdtemp6(join62(tmpdir7(), "agentwheel-recovery-"));
   const priorTmpdir = process.env.TMPDIR;
   try {
     process.env.TMPDIR = stage;
@@ -23791,8 +23951,8 @@ async function withFreshReadOnlyGraphPlan(target, adapter, adapterOptions, insta
       yes: true,
       freshGraphOnly: true,
       deferForeignStateCheck: true,
-      cacheRoot: join61(stage, "source-cache"),
-      registryCachePath: join61(stage, "registry.json")
+      cacheRoot: join62(stage, "source-cache"),
+      registryCachePath: join62(stage, "registry.json")
     });
     return await use(graphPlan);
   } finally {
@@ -23879,7 +24039,7 @@ async function resolveCliTargetState(target, options) {
     migration: prior.migration,
     targetStateFilePreconditions: {
       graphLockPath: stableGraphLockPath,
-      graphLockRevision: stableLock ? createHash28("sha256").update(canonicalGraphLockJson(stableLock)).digest("hex") : null,
+      graphLockRevision: stableLock ? createHash29("sha256").update(canonicalGraphLockJson(stableLock)).digest("hex") : null,
       sourceLockRevision: computeSourceLockRevision(stableSourceLock)
     }
   };
@@ -23902,7 +24062,7 @@ async function collectTargetStatus(target, options) {
   const pending = await collectPendingInstallWork(target, options);
   const foreignObservations = pending.foreignStateObservations;
   const effectiveGraphLock = graphLock ?? pending.observedGraphLock;
-  const observedManifestRevision = foreignObservations.length > 0 ? createHash28("sha256").update(JSON.stringify(foreignObservations.map((observation) => [
+  const observedManifestRevision = foreignObservations.length > 0 ? createHash29("sha256").update(JSON.stringify(foreignObservations.map((observation) => [
     observation.fileName,
     observation.manifestRevision
   ]).sort())).digest("hex") : null;
@@ -24149,7 +24309,7 @@ async function assertCompositeMutationSupported(workspaceRoot, profile, readOnly
         `Composite-profile mutation is refused before member execution because ${member.id} uses ${member.transport}; durable remote policy and recovery preflight is not implemented.`
       );
     }
-    const memberRoot = resolve44(workspaceRoot, member.workspace);
+    const memberRoot = resolve45(workspaceRoot, member.workspace);
     const memberPolicy = await mutationPolicyForWorkspace(memberRoot);
     if (memberPolicy?.revisioning.mode === "commit-after-verify") {
       throw new Error(
@@ -24386,12 +24546,12 @@ async function printDoctor(target, options) {
   const requestedSkills = doctorSkillRequests(target, options);
   const skills = [];
   for (const request of requestedSkills) {
-    const skillPath = join61(state.installRoot, targetMapping.dest, request.name);
+    const skillPath = join62(state.installRoot, targetMapping.dest, request.name);
     const exists2 = await pathExists(skillPath);
     const manifestEntry = manifest?.entries.find((entry) => {
       if (entry.artifactType !== "skills") return false;
       const legacyInstallName = "installName" in entry && typeof entry.installName === "string" ? entry.installName : void 0;
-      return entry.artifactName === request.name || legacyInstallName === request.name || entry.path === join61(targetMapping.dest, request.name);
+      return entry.artifactName === request.name || legacyInstallName === request.name || entry.path === join62(targetMapping.dest, request.name);
     });
     const status = manifestEntry ? "managed" : exists2 ? "present-unmanaged" : "missing";
     skills.push({
@@ -24471,7 +24631,7 @@ function doctorSkillLabel(name) {
   return `${name} skill`;
 }
 function isSyncwheelWorkspace(targetRoot) {
-  return existsSync(join61(targetRoot, ".syncwheel", "manifest.json"));
+  return existsSync(join62(targetRoot, ".syncwheel", "manifest.json"));
 }
 function skillInstallCommand(adapter, installationType, options, skill, behavior = {}) {
   const args = [
@@ -24634,14 +24794,14 @@ function looksLikeSourceSpecifier(value) {
 }
 function normalizeCliPath(value) {
   if (value === "~") return homedir18();
-  if (value.startsWith("~/")) return resolve44(homedir18(), value.slice(2));
-  return resolve44(value);
+  if (value.startsWith("~/")) return resolve45(homedir18(), value.slice(2));
+  return resolve45(value);
 }
 function shellQuoteArgument(value) {
   return /^[a-z0-9_./:@%+=,-]+$/i.test(value) ? value : `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 function isHomePath(path) {
-  return resolve44(path) === resolve44(homedir18());
+  return resolve45(path) === resolve45(homedir18());
 }
 function adapterListFromOption(adapter) {
   if (!adapter) return [];
@@ -24696,11 +24856,11 @@ function filterUninstallPlanBySelection(plan, selected) {
   };
 }
 async function initPackage(root) {
-  await mkdir27(join61(root, "instructions"), { recursive: true });
-  await mkdir27(join61(root, "rules"), { recursive: true });
-  await mkdir27(join61(root, "skills"), { recursive: true });
-  const manifestPath = join61(root, "openpack.json");
-  const instructionsPath = join61(root, "instructions", "AGENTS.md");
+  await mkdir27(join62(root, "instructions"), { recursive: true });
+  await mkdir27(join62(root, "rules"), { recursive: true });
+  await mkdir27(join62(root, "skills"), { recursive: true });
+  const manifestPath = join62(root, "openpack.json");
+  const instructionsPath = join62(root, "instructions", "AGENTS.md");
   const manifest = {
     schemaVersion: CURRENT_OPENPACK_SCHEMA_VERSION,
     name: "example/agentwheel-package",
@@ -24718,7 +24878,7 @@ async function initPackage(root) {
   await writeFile24(instructionsPath, "# Agent Instructions\n", "utf8");
 }
 async function defaultBootstrapPackage(_root) {
-  const packageRoot = await findAgentwheelPackageRoot(dirname37(fileURLToPath4(import.meta.url)));
+  const packageRoot = await findAgentwheelPackageRoot(dirname38(fileURLToPath4(import.meta.url)));
   if (!packageRoot) return void 0;
   return {
     name: "agentwheel",
@@ -24762,10 +24922,10 @@ function withFleetExample(config) {
   };
 }
 async function findAgentwheelPackageRoot(start) {
-  let current = resolve44(start);
+  let current = resolve45(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
-    const parent = dirname37(current);
+    const parent = dirname38(current);
     if (parent === current) return void 0;
     current = parent;
   }
@@ -24890,14 +25050,14 @@ async function governedCommandContext(command, options) {
     const kind = String(command.args[0] ?? "workspace");
     return {
       workspaceRoot: workspaceRoot2,
-      anticipatedPaths: kind === "package" ? [join61(targetRoot, "openpack.json"), join61(targetRoot, "instructions", "AGENTS.md")] : [workspaceConfigPath(targetRoot)]
+      anticipatedPaths: kind === "package" ? [join62(targetRoot, "openpack.json"), join62(targetRoot, "instructions", "AGENTS.md")] : [workspaceConfigPath(targetRoot)]
     };
   }
   if (path === "package migrate") {
     const packageRoot = normalizeTargetRoot(String(command.args[0] ?? "."));
     return {
       workspaceRoot: await findExistingWorkspaceRoot(packageRoot) ?? packageRoot,
-      anticipatedPaths: ["agentwheel.json", "agentwheel.jsonc", "openpack.json", "openpack.jsonc"].map((name) => join61(packageRoot, name))
+      anticipatedPaths: ["agentwheel.json", "agentwheel.jsonc", "openpack.json", "openpack.jsonc"].map((name) => join62(packageRoot, name))
     };
   }
   const source = typeof command.args[0] === "string" ? command.args[0] : void 0;
@@ -24909,14 +25069,13 @@ async function governedCommandContext(command, options) {
   const anticipatedPaths = [];
   if (path === "add" || path === "pin") anticipatedPaths.push(workspaceConfigPath(workspaceRoot));
   if (path === "remember" && options.runtime) {
-    anticipatedPaths.push(join61(workspaceRoot, ".agentwheel", "overlays", options.runtime, "instructions.local.md"));
+    anticipatedPaths.push(join62(workspaceRoot, ".agentwheel", "overlays", options.runtime, "instructions.local.md"));
   }
   if (path === "uninstall" && source) anticipatedPaths.push(workspaceConfigPath(workspaceRoot));
   return {
     workspaceRoot,
     anticipatedPaths,
-    requireCleanWorkingTree: requiresCleanMutationPreflight(path),
-    requiresDeclarativeRepositoryDelta: path === "ownership handoff"
+    requireCleanWorkingTree: requiresCleanMutationPreflight(path)
   };
 }
 function commandPath(command) {