agentwheel 0.22.2 → 0.22.3

package/dist/index.js

@@ -18513,7 +18513,7 @@ var init_fleet = __esm({
 // src/mutation/repository.ts
 import { createHash as createHash8 } from "crypto";
 import { lstat as lstat3, readFile as readFile12, readlink, readdir as readdir5 } from "fs/promises";
-import { posix as posix4, relative as relative7, resolve as resolve15, sep as sep5 } from "path";
+import { dirname as dirname10, posix as posix4, relative as relative7, resolve as resolve15, sep as sep5 } from "path";
 async function discoverGitRepository(start) {
   const probe = await runProcess("git", ["-C", start, "rev-parse", "--show-toplevel"], { allowExitCodes: [0, 128] });
   if (probe.exitCode !== 0) return void 0;
@@ -18540,6 +18540,9 @@ async function assertGitPreflight(repository) {
   }
 }
 async function assertHeadLease(repositoryRoot, expectedHead, head, paths, provider) {
+  return assertHeadLeaseWithRecovery(repositoryRoot, expectedHead, head, paths, provider, []);
+}
+async function assertHeadLeaseWithRecovery(repositoryRoot, expectedHead, head, paths, provider, recoveryPaths, terminalChanges = /* @__PURE__ */ new Map()) {
   if (head === expectedHead) return;
   if (provider?.headLease !== "path-scoped" || paths.length === 0) {
     throw new Error(`Git HEAD lease mismatch: expected ${expectedHead}, found ${head}.`);
@@ -18575,10 +18578,65 @@ async function assertHeadLease(repositoryRoot, expectedHead, head, paths, provid
       "-z",
       commit
     ])).stdout);
-    if (touched.some((path) => protectedPaths.some((protectedPath) => path === protectedPath || path.startsWith(`${protectedPath}/`) || protectedPath.startsWith(`${path}/`)))) {
-      throw new Error(`Git HEAD lease overlaps protected paths in intervening commit ${commit}.`);
+    for (const path of touched) {
+      if (!protectedPaths.some((protectedPath) => overlaps(path, protectedPath))) continue;
+      if (terminalChanges.get(commit)?.has(path)) continue;
+      const proof = recoveryPaths.find((entry) => entry.path === path && paths.includes(path));
+      if (!proof || overlaps(path, ".agentwheel/config.json") || overlaps(path, ".syncwheel/manifest.json") || await gitPathMode(repositoryRoot, commit, path) !== "100644" || await hashHeadPath(repositoryRoot, expectedHead, path) !== proof.beforeSha256 || await hashHeadPath(repositoryRoot, commit, path) !== proof.afterSha256 || await hashHeadPath(repositoryRoot, head, path) !== proof.afterSha256 || await hashWorkingPath(repositoryRoot, path) !== proof.afterSha256) {
+        throw new Error(`Git HEAD lease overlaps protected paths in intervening commit ${commit}.`);
+      }
+    }
+  }
+}
+function overlaps(left, right) {
+  return left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
+}
+async function committedRecoveryPaths(repositoryRoot, expectedHead, head, declarations, receiptPaths, provider) {
+  await verifyRevisionPaths(repositoryRoot, expectedHead, receiptPaths);
+  const committed = [];
+  for (const entry of receiptPaths) {
+    if (!declarations.includes(entry.path)) throw new Error(`Recovery path was not declared: ${entry.path}.`);
+    if (await hashHeadPath(repositoryRoot, head, entry.path) === entry.afterSha256 && entry.beforeSha256 !== entry.afterSha256) {
+      await assertRecoveryFileIdentity(repositoryRoot, expectedHead, head, entry.path);
+      committed.push(entry);
     }
   }
+  await assertHeadLeaseWithRecovery(repositoryRoot, expectedHead, head, declarations, provider, committed);
+  return committed;
+}
+async function verifyCompletedRecoveryPaths(repositoryRoot, expectedHead, declarations, savedPaths, provider, productCommitSha, productPaths, controlCommitSha) {
+  const head = await currentHead(repositoryRoot);
+  await verifyRevisionPaths(repositoryRoot, expectedHead, savedPaths);
+  for (const entry of savedPaths) {
+    await assertRecoveryFileIdentity(repositoryRoot, expectedHead, head, entry.path);
+    if (await hashHeadPath(repositoryRoot, head, entry.path) !== entry.afterSha256) {
+      throw new Error(`Committed recovery path changed during provider completion: ${entry.path}.`);
+    }
+  }
+  const terminalChanges = /* @__PURE__ */ new Map();
+  if (productCommitSha) terminalChanges.set(productCommitSha, new Set(productPaths));
+  if (controlCommitSha) terminalChanges.set(controlCommitSha, /* @__PURE__ */ new Set([".syncwheel/manifest.json"]));
+  await assertHeadLeaseWithRecovery(repositoryRoot, expectedHead, head, declarations, provider, savedPaths, terminalChanges);
+}
+async function gitPathMode(repositoryRoot, head, path) {
+  const tree = (await runProcess("git", ["-C", repositoryRoot, "ls-tree", "-z", head, "--", path])).stdout.toString("utf8");
+  const entry = tree.split("\0").find((value) => value.slice(value.indexOf("	") + 1) === path);
+  return entry?.split(" ")[0];
+}
+async function assertRecoveryFileIdentity(repositoryRoot, expectedHead, head, path) {
+  if (await gitPathMode(repositoryRoot, expectedHead, path) !== "100644" || await gitPathMode(repositoryRoot, head, path) !== "100644") {
+    throw new Error(`Recovery requires an existing regular non-executable Git file: ${path}.`);
+  }
+  const absolute = resolve15(repositoryRoot, ...path.split("/"));
+  const stats = await lstat3(absolute);
+  if (!stats.isFile() || (stats.mode & 73) !== 0) throw new Error(`Recovery file identity changed: ${path}.`);
+  let ancestor = dirname10(absolute);
+  while (true) {
+    if ((await lstat3(ancestor)).isSymbolicLink()) throw new Error(`Recovery symlink ancestor is unsupported: ${path}.`);
+    const parent = dirname10(ancestor);
+    if (parent === ancestor) break;
+    ancestor = parent;
+  }
 }
 function isAgentwheelWritablePath(path) {
   return /^\.agentwheel(?:\/|$)/u.test(path) || /^profiles\/[^/]+\/\.agentwheel(?:\/|$)/u.test(path);
@@ -19279,7 +19337,7 @@ var init_providers = __esm({
 // src/mutation/coordinator.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname10, isAbsolute as isAbsolute12, relative as relative8, resolve as resolve17, sep as sep6 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute12, relative as relative8, resolve as resolve17, sep as sep6 } from "path";
 function dirtyRepositoryPaths(repositoryRoot, baseline, paths) {
   const conflicts = /* @__PURE__ */ new Set();
   for (const path of paths) {
@@ -19353,12 +19411,15 @@ async function resumeMutation(operationId, action) {
       );
       receipt = await updateMutationReceipt(receipt, { paths, status: "mutation-applied" });
     }
-    await invokeRevisionProvider(provider, providerRequest(receipt, "preflight", paths), {
+    const request = action === "recover" && receipt.runtimeJournals.length > 0 ? await recoveryProviderRequest(receipt, paths) : providerRequest(receipt, action, paths);
+    await invokeRevisionProvider(provider, revisionProviderRequestSchema.parse({ ...request, action: "preflight" }), {
       workspaceRoot: receipt.workspaceRoot
     });
-    const response = await invokeRevisionProvider(provider, providerRequest(receipt, action, paths), {
+    if (action === "recover") await verifyRecoveryProjection(receipt, request);
+    const response = await invokeRevisionProvider(provider, request, {
       workspaceRoot: receipt.workspaceRoot
     });
+    await verifyCompletedRecoveryProjection(receipt, request, response);
     return updateMutationReceipt(receipt, {
       status: receiptStatusForProvider(response.status),
       providerResponse: response,
@@ -19401,17 +19462,19 @@ async function recoverMutationRuntime(operationId, options = {}) {
           `Mutation '${receipt.operationId}' repository HEAD lease changed before runtime recovery.`
         );
       }
-      await assertHeadLease(
+      if (receipt.noCommit) await assertHeadLease(receipt.repositoryRoot, receipt.expectedHead, repository.head, [], receipt.provider);
+      else await committedRecoveryPaths(
         receipt.repositoryRoot,
         receipt.expectedHead,
         repository.head,
-        receipt.noCommit ? [] : declarations,
+        declarations,
+        receipt.paths,
         receipt.provider
       );
       await assertGitPreflight(repository);
       await collectIntroducedPaths(receipt.repositoryRoot, receipt.expectedHead, baseline, declarations);
     }
-    mutation = GovernedMutation.activateExisting(receipt, baseline, lock);
+    mutation = GovernedMutation.activateExisting(receipt, baseline, lock, options.beforeProviderCompletion);
     const [{ recoverPendingApply: recoverPendingApply2 }, { readLinkedLocalApplyJournal: readLinkedLocalApplyJournal2 }] = await Promise.all([
       Promise.resolve().then(() => (init_apply(), apply_exports)),
       Promise.resolve().then(() => (init_transaction(), transaction_exports))
@@ -19523,7 +19586,7 @@ async function mutationPolicyForWorkspace(workspaceRoot, globalRoot = homedir6()
   const globalConfig2 = await readWorkspaceConfig(globalRoot);
   const global = globalConfig2.schemaVersion === 4 ? globalConfig2.mutationPolicy : void 0;
   let existingRoot = resolve17(workspaceRoot);
-  while (!await pathExists(existingRoot) && dirname10(existingRoot) !== existingRoot) existingRoot = dirname10(existingRoot);
+  while (!await pathExists(existingRoot) && dirname11(existingRoot) !== existingRoot) existingRoot = dirname11(existingRoot);
   const owner = await resolveWorkspaceOwnershipScope(existingRoot, { globalRoot });
   const fleetConfig = owner.fleetId ? await readWorkspaceConfig(owner.root) : void 0;
   const fleet = fleetConfig?.schemaVersion === 4 ? fleetConfig.mutationPolicy : void 0;
@@ -19545,6 +19608,50 @@ function mergeMutationPolicies(global, scoped) {
     revisioning
   });
 }
+async function recoveryProviderRequest(receipt, paths) {
+  const request = providerRequest(receipt, "recover", paths);
+  if (receipt.noCommit) return request;
+  const head = await currentHead(request.repositoryRoot);
+  const committed = await committedRecoveryPaths(
+    request.repositoryRoot,
+    request.expectedHead,
+    head,
+    readMutationPathDeclarations(receipt.operationId),
+    paths,
+    receipt.provider
+  );
+  if (committed.length === 0) return request;
+  const saved = new Set(committed.map((entry) => entry.path));
+  return revisionProviderRequestSchema.parse({
+    ...request,
+    expectedHead: head,
+    paths: paths.filter((entry) => !saved.has(entry.path))
+  });
+}
+async function verifyCompletedRecoveryProjection(receipt, request, response) {
+  if (request.expectedHead === receipt.expectedHead) return;
+  if (response.action !== "recover" && response.action !== "finalize") throw new Error("Recovery requires a terminal provider response.");
+  const remaining = new Set(request.paths.map((entry) => entry.path));
+  await verifyCompletedRecoveryPaths(
+    request.repositoryRoot,
+    receipt.expectedHead,
+    readMutationPathDeclarations(receipt.operationId),
+    receipt.paths.filter((entry) => !remaining.has(entry.path)),
+    receipt.provider,
+    response.productCommitSha,
+    request.paths.map((entry) => entry.path),
+    response.controlCommitSha
+  );
+}
+async function verifyRecoveryProjection(receipt, request) {
+  if (request.expectedHead === receipt.expectedHead) return;
+  if (await currentHead(request.repositoryRoot) !== request.expectedHead) throw new Error("Recovery projection HEAD changed.");
+  const verified = await recoveryProviderRequest(receipt, receipt.paths);
+  if (JSON.stringify(verified) !== JSON.stringify(request)) throw new Error("Recovery projection changed before provider completion.");
+  const repository = await discoverGitRepository(request.repositoryRoot);
+  if (!repository) throw new Error("Recovery repository disappeared.");
+  await assertGitPreflight(repository);
+}
 function providerRequest(receipt, action, paths) {
   if (!receipt.repositoryRoot || !receipt.expectedHead || !receipt.provider) {
     throw new Error(`Mutation '${receipt.operationId}' is missing revision provider request state.`);
@@ -19614,17 +19721,21 @@ var init_coordinator = __esm({
     init_repository();
     init_session_ownership();
     GovernedMutation = class _GovernedMutation {
-      constructor(policy, receipt, baseline, lock) {
+      constructor(policy, receipt, baseline, lock, runtimeRecovery = false, beforeProviderCompletion) {
         this.policy = policy;
         this.receipt = receipt;
         this.baseline = baseline;
         this.lock = lock;
+        this.runtimeRecovery = runtimeRecovery;
+        this.beforeProviderCompletion = beforeProviderCompletion;
         this.operationId = receipt.operationId;
       }
       policy;
       receipt;
       baseline;
       lock;
+      runtimeRecovery;
+      beforeProviderCompletion;
       operationId;
       closed = false;
       static async begin(options) {
@@ -19730,7 +19841,7 @@ var init_coordinator = __esm({
             );
           }
           this.receipt = await updateMutationReceipt(this.receipt, { status: "handler-succeeded" });
-          paths = await this.collectPaths();
+          paths = await this.collectPaths(action === "recover" && this.runtimeRecovery);
           this.receipt = await updateMutationReceipt(this.receipt, { paths, status: "mutation-applied" });
         } catch (error46) {
           this.receipt = await updateMutationReceipt(this.receipt, {
@@ -19748,12 +19859,16 @@ var init_coordinator = __esm({
             return this.receipt;
           }
           const provider = this.policy.revisioning.provider;
-          await invokeRevisionProvider(provider, providerRequest(this.receipt, "preflight", paths), {
+          const request = this.runtimeRecovery && action === "recover" ? await recoveryProviderRequest(this.receipt, paths) : providerRequest(this.receipt, action, paths);
+          await invokeRevisionProvider(provider, revisionProviderRequestSchema.parse({ ...request, action: "preflight" }), {
             workspaceRoot: this.receipt.workspaceRoot
           });
-          const response = await invokeRevisionProvider(provider, providerRequest(this.receipt, action, paths), {
+          if (this.runtimeRecovery) await verifyRecoveryProjection(this.receipt, request);
+          await this.beforeProviderCompletion?.();
+          const response = await invokeRevisionProvider(provider, request, {
             workspaceRoot: this.receipt.workspaceRoot
           });
+          await verifyCompletedRecoveryProjection(this.receipt, request, response);
           this.receipt = await updateMutationReceipt(this.receipt, {
             status: receiptStatusForProvider(response.status),
             providerResponse: response
@@ -19813,7 +19928,7 @@ var init_coordinator = __esm({
         const runtimeJournals = upsertRuntimeJournal(this.receipt.runtimeJournals, existing, status);
         this.receipt = await updateMutationReceipt(this.receipt, { runtimeJournals });
       }
-      static activateExisting(receipt, baseline, lock) {
+      static activateExisting(receipt, baseline, lock, beforeProviderCompletion) {
         if (receipt.revisionMode === "commit-after-verify" && !receipt.provider) {
           throw new Error(`Mutation '${receipt.operationId}' is missing its revision provider recovery policy.`);
         }
@@ -19831,24 +19946,41 @@ var init_coordinator = __esm({
           journal: "required",
           revisioning: { mode: "off" }
         });
-        const mutation = new _GovernedMutation(policy, receipt, baseline, lock);
+        const mutation = new _GovernedMutation(policy, receipt, baseline, lock, true, beforeProviderCompletion);
         activeMutation = mutation;
         return mutation;
       }
-      async collectPaths() {
+      async collectPaths(recover = false) {
         if (!this.receipt.repositoryRoot || !this.receipt.expectedHead || !this.baseline) return [];
         const declarations = [.../* @__PURE__ */ new Set([
           ...declaredMutationPaths(),
           ...readMutationPathDeclarations(this.receipt.operationId)
         ])].sort((a, b) => a.localeCompare(b));
-        if (this.receipt.provider) await assertHeadLease(
+        const head = await currentHead(this.receipt.repositoryRoot);
+        const committed = recover && !this.receipt.noCommit ? await committedRecoveryPaths(
+          this.receipt.repositoryRoot,
+          this.receipt.expectedHead,
+          head,
+          declarations,
+          this.receipt.paths,
+          this.receipt.provider
+        ) : [];
+        if (this.receipt.provider && !recover) await assertHeadLease(
           this.receipt.repositoryRoot,
           this.receipt.expectedHead,
-          await currentHead(this.receipt.repositoryRoot),
+          head,
           this.receipt.noCommit ? [] : declarations,
           this.receipt.provider
         );
-        return collectIntroducedPaths(this.receipt.repositoryRoot, this.receipt.expectedHead, this.baseline, declarations);
+        if (recover && this.receipt.noCommit) await assertHeadLease(
+          this.receipt.repositoryRoot,
+          this.receipt.expectedHead,
+          head,
+          [],
+          this.receipt.provider
+        );
+        const introduced = await collectIntroducedPaths(this.receipt.repositoryRoot, this.receipt.expectedHead, this.baseline, declarations);
+        return [...committed, ...introduced].sort((a, b) => a.path.localeCompare(b.path));
       }
       async close() {
         if (this.closed) return;
@@ -19864,12 +19996,12 @@ var init_coordinator = __esm({
 // src/transport/ownership-snapshot.ts
 import { createHash as createHash10 } from "crypto";
 import { lstat as lstat4, readdir as readdir6, readFile as readFile14 } from "fs/promises";
-import { dirname as dirname11, join as join14, relative as relative9, resolve as resolve18 } from "path";
+import { dirname as dirname12, join as join14, relative as relative9, resolve as resolve18 } from "path";
 async function assertSnapshotAncestors(path) {
   let current = resolve18(path);
   while (true) {
     if ((await lstat4(current)).isSymbolicLink()) throw new Error(`Symlink path is unsupported: ${current}`);
-    const parent = dirname11(current);
+    const parent = dirname12(current);
     if (parent === current) return;
     current = parent;
   }
@@ -19935,7 +20067,7 @@ __export(transaction_exports, {
 });
 import { createHash as createHash11 } from "crypto";
 import { cp as cp2, lstat as lstat5, mkdir as mkdir7, open as open4, rm as rm5, stat as stat4 } from "fs/promises";
-import { dirname as dirname12, join as join15, relative as relative10, resolve as resolve19, sep as sep7 } from "path";
+import { dirname as dirname13, join as join15, relative as relative10, resolve as resolve19, sep as sep7 } from "path";
 async function assertNoSymlinkPath2(path) {
   const absolute = resolve19(path);
   let current = absolute;
@@ -19945,7 +20077,7 @@ async function assertNoSymlinkPath2(path) {
     } catch (error46) {
       if (error46.code !== "ENOENT") throw error46;
     }
-    const parent = dirname12(current);
+    const parent = dirname13(current);
     if (parent === current) break;
     current = parent;
   }
@@ -20016,7 +20148,7 @@ async function syncMetadataPath(path, directoryOnly = false) {
       await file2.close();
     }
   }
-  const directory = await open4(directoryOnly ? path : dirname12(path), "r");
+  const directory = await open4(directoryOnly ? path : dirname13(path), "r");
   try {
     await directory.sync();
   } finally {
@@ -20166,7 +20298,7 @@ async function removeApplyJournal(targetRoot, adapter, transport = localTranspor
   if (existing?.mutation) await beginResolveMutationRuntimeJournal(existing.mutation.operationId, path);
   await transport.rm(applyJournalPath(targetRoot, adapter, scope));
   await transport.rm(applyBackupDir(targetRoot, adapter, scope));
-  if ((existing?.metadataAudit || existing?.metadataGuards) && transport.kind === "local") await syncMetadataPath(dirname12(path), true);
+  if ((existing?.metadataAudit || existing?.metadataGuards) && transport.kind === "local") await syncMetadataPath(dirname13(path), true);
   if (existing?.mutation) await resolveMutationRuntimeJournal(existing.mutation.operationId, path);
 }
 async function abortApplyJournal(targetRoot, adapter, transport = localTransport, scope = {}) {
@@ -20317,7 +20449,7 @@ async function recordBackup(operation, index, targetRoot, adapter, transport = l
     await transport.copyWithin(operation.destPath, backupPath, operation.kind);
   } else {
     await rm5(backupPath, { recursive: true, force: true });
-    await mkdir7(dirname12(backupPath), { recursive: true });
+    await mkdir7(dirname13(backupPath), { recursive: true });
     await cp2(operation.destPath, backupPath, { recursive: operation.kind === "dir", dereference: true });
   }
   return {
@@ -20416,14 +20548,14 @@ var init_transaction = __esm({
 // src/install/toml-merge.ts
 import { mkdir as mkdir8, readFile as readFile16, writeFile as writeFile8 } from "fs/promises";
 import { parse as parseToml } from "smol-toml";
-import { dirname as dirname13 } from "path";
+import { dirname as dirname14 } from "path";
 async function mergeCodexTomlMcp(sourcePath, destPath) {
   const source = JSON.parse(await readFile16(sourcePath, "utf8"));
   const servers = extractMcpServers(source);
   const current = await pathExists(destPath) ? await readFile16(destPath, "utf8") : "";
   const withoutManaged = removeManagedMcpSections(current, Object.keys(servers));
   const merged = appendMcpServers(withoutManaged, servers);
-  await mkdir8(dirname13(destPath), { recursive: true });
+  await mkdir8(dirname14(destPath), { recursive: true });
   await writeFile8(destPath, merged, "utf8");
 }
 function mismatchedCodexTomlMcpServers(source, currentContent) {
@@ -20573,13 +20705,13 @@ var init_toml_merge = __esm({
 
 // src/install/yaml-merge.ts
 import { mkdir as mkdir9, readFile as readFile17, writeFile as writeFile9 } from "fs/promises";
-import { dirname as dirname14 } from "path";
+import { dirname as dirname15 } from "path";
 import { parse as parse7, stringify } from "yaml";
 async function mergeYamlFile(sourcePath, destPath) {
   const source = parseYamlValue(await readFile17(sourcePath, "utf8"));
   const current = await pathExists(destPath) ? parseYamlValue(await readFile17(destPath, "utf8")) : {};
   const merged = deepMerge2(current, source);
-  await mkdir9(dirname14(destPath), { recursive: true });
+  await mkdir9(dirname15(destPath), { recursive: true });
   await writeFile9(destPath, stringify(merged), "utf8");
 }
 function parseYamlValue(content) {
@@ -20638,7 +20770,7 @@ var init_yaml_merge = __esm({
 
 // src/install/merge-removal.ts
 import { mkdir as mkdir10, readFile as readFile18, writeFile as writeFile10 } from "fs/promises";
-import { dirname as dirname15 } from "path";
+import { dirname as dirname16 } from "path";
 import { parse as parse8, stringify as stringify2 } from "yaml";
 function assertExactMergeContribution(contribution, strategy, currentContent) {
   if (strategy === "codex-toml-mcp") {
@@ -20723,7 +20855,7 @@ async function removeMergeContribution(destPath, strategy, removal) {
   }
   const current = parseMergeDestination(content, strategy);
   removeIntroducedContent(current, removal);
-  await mkdir10(dirname15(destPath), { recursive: true });
+  await mkdir10(dirname16(destPath), { recursive: true });
   await writeFile10(destPath, strategy === "yaml-deep" ? stringify2(current) : `${JSON.stringify(current, null, 2)}
 `, "utf8");
 }
@@ -20993,7 +21125,7 @@ var init_desired = __esm({
 import { createHash as createHash12 } from "crypto";
 import { mkdtemp as mkdtemp2, readFile as readFile19, realpath as realpath2, rm as rm6, writeFile as writeFile11 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename2, dirname as dirname16, join as join16, relative as relative11 } from "path";
+import { basename as basename2, dirname as dirname17, join as join16, relative as relative11 } from "path";
 function exactManagedInstructionBlockSnapshot(content, selector) {
   const beginCount = [...content.matchAll(new RegExp(`<!-- BEGIN openpack:include ${escapeRegex2(selector)}(?=\\s|-->)`, "gu"))].length;
   const endCount = [...content.matchAll(new RegExp(`<!-- END openpack:include ${escapeRegex2(selector)}(?=\\s|-->)`, "gu"))].length;
@@ -21176,7 +21308,7 @@ function assertCleanBlock(block, selector) {
   }
 }
 function referencesAgentsMd(content, claudePath, agentsPath) {
-  const claudeDir = dirname16(claudePath);
+  const claudeDir = dirname17(claudePath);
   for (const rawLine of content.split(/\r?\n/)) {
     const line = rawLine.trim();
     const atImport = /^@import\s+(.+)$/i.exec(line);
@@ -21186,7 +21318,7 @@ function referencesAgentsMd(content, claudePath, agentsPath) {
     const cleaned = referenced.trim().replace(/^["']|["']$/g, "");
     if (!/AGENTS\.md$/i.test(cleaned)) continue;
     const candidate = cleaned.startsWith("/") ? cleaned : join16(claudeDir, cleaned);
-    if (relative11(dirname16(agentsPath), candidate).replaceAll("\\", "/") === "AGENTS.md") return true;
+    if (relative11(dirname17(agentsPath), candidate).replaceAll("\\", "/") === "AGENTS.md") return true;
     if (candidate === agentsPath) return true;
   }
   return false;
@@ -21246,7 +21378,7 @@ import { execFile as execFile5 } from "child_process";
 import { createHash as createHash13, randomUUID as randomUUID3 } from "crypto";
 import { chmod as chmod3, link as link2, lstat as lstat6, mkdir as mkdir11, mkdtemp as mkdtemp3, open as open5, readFile as readFile20, rm as rm7, writeFile as writeFile12 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename3, dirname as dirname17, join as join17, resolve as resolve20 } from "path";
+import { basename as basename3, dirname as dirname18, join as join17, resolve as resolve20 } from "path";
 import { promisify as promisify5 } from "util";
 async function applyInstallPlan(plan, sourceLock, options = {}) {
   return applyPlanTransactionally(plan, { ...options, sourceLock });
@@ -21714,7 +21846,7 @@ async function createPrivateAuditDirectory(path) {
   } catch (error46) {
     if (error46.code !== "ENOENT") throw error46;
   }
-  await createPrivateAuditDirectory(dirname17(path));
+  await createPrivateAuditDirectory(dirname18(path));
   try {
     await mkdir11(path, { mode: 448 });
   } catch (error46) {
@@ -21725,14 +21857,14 @@ async function createPrivateAuditDirectory(path) {
   }
   await chmod3(path, 448);
   await syncMetadataPath(path, true);
-  await syncMetadataPath(dirname17(path), true);
+  await syncMetadataPath(dirname18(path), true);
 }
 async function writeAuditFileExclusive(path, content, validateCallerPath) {
   await assertNoSymlinkPath2(path);
-  await createPrivateAuditDirectory(dirname17(path));
+  await createPrivateAuditDirectory(dirname18(path));
   await assertNoSymlinkPath2(path);
   await validateCallerPath();
-  await syncMetadataPath(dirname17(dirname17(path)), true);
+  await syncMetadataPath(dirname18(dirname18(path)), true);
   const temporary = `${path}.pending-${randomUUID3()}`;
   try {
     const handle = await open5(temporary, "wx", 384);
@@ -21748,7 +21880,7 @@ async function writeAuditFileExclusive(path, content, validateCallerPath) {
     } catch (error46) {
       if (error46.code !== "EEXIST" || await readFile20(path, "utf8") !== content) throw error46;
     }
-    const directory = await open5(dirname17(path), "r");
+    const directory = await open5(dirname18(path), "r");
     try {
       await directory.sync();
     } finally {
@@ -22407,7 +22539,7 @@ async function validateOpenClawConfig(configPath, destPath, transport) {
   if (!transport.execFile) {
     throw new Error(`Cannot validate OpenClaw config over ${transport.description}: transport does not support command execution.`);
   }
-  const openClawHome = dirname17(destPath);
+  const openClawHome = dirname18(destPath);
   const bundledBin = join17(openClawHome, "npm", "node_modules", ".bin", "openclaw");
   const script = String.raw`
 set -euo pipefail
@@ -22494,7 +22626,7 @@ import { createHash as createHash32 } from "crypto";
 import { existsSync } from "fs";
 import { mkdir as mkdir28, mkdtemp as mkdtemp6, readFile as readFile45, realpath as realpath4, rm as rm16, writeFile as writeFile24 } from "fs/promises";
 import { homedir as homedir18, tmpdir as tmpdir7 } from "os";
-import { basename as basename24, dirname as dirname41, isAbsolute as isAbsolute17, join as join66, relative as relative22, resolve as resolve48, sep as sep12 } from "path";
+import { basename as basename24, dirname as dirname42, isAbsolute as isAbsolute17, join as join66, relative as relative22, resolve as resolve48, sep as sep12 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command } from "commander";
 
@@ -22587,7 +22719,7 @@ import { basename as basename8, join as join28, relative as relative12 } from "p
 // src/staging/codex-subagents.ts
 init_fs();
 import { mkdir as mkdir12, readFile as readFile21, writeFile as writeFile13 } from "fs/promises";
-import { basename as basename4, dirname as dirname18, join as join18 } from "path";
+import { basename as basename4, dirname as dirname19, join as join18 } from "path";
 import { parse as parseYaml } from "yaml";
 var requiredCodexAgentFields = ["name", "description", "developer_instructions"];
 async function renderCodexSubagents(artifacts, stageRoot, adapter) {
@@ -22633,7 +22765,7 @@ async function renderCodexSubagent(artifact, stageRoot) {
   }
   const markdown = await readFile21(markdownPath, "utf8");
   const toml = markdownToCodexAgentToml(agentName, markdown);
-  await mkdir12(dirname18(renderedPath), { recursive: true });
+  await mkdir12(dirname19(renderedPath), { recursive: true });
   await writeFile13(renderedPath, toml, "utf8");
   return {
     ...artifact,
@@ -22716,7 +22848,7 @@ function escapeRegExp2(value) {
 // src/staging/copilot-artifacts.ts
 init_fs();
 import { mkdir as mkdir13, readFile as readFile22, writeFile as writeFile14 } from "fs/promises";
-import { basename as basename5, dirname as dirname19, join as join19 } from "path";
+import { basename as basename5, dirname as dirname20, join as join19 } from "path";
 async function renderCopilotArtifacts(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "copilot") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -22747,7 +22879,7 @@ async function renderCopilotSubagent(artifact, stageRoot) {
     throw new Error(`Copilot subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
   const markdown = await readFile22(markdownPath, "utf8");
-  await mkdir13(dirname19(renderedPath), { recursive: true });
+  await mkdir13(dirname20(renderedPath), { recursive: true });
   await writeFile14(renderedPath, ensureCopilotAgentDescription(agentName, markdown), "utf8");
   return {
     ...artifact,
@@ -22803,7 +22935,7 @@ function yamlString(value) {
 // src/staging/openclaw-subagents.ts
 init_fs();
 import { mkdir as mkdir14, readFile as readFile23, writeFile as writeFile15 } from "fs/promises";
-import { basename as basename6, dirname as dirname20, join as join20 } from "path";
+import { basename as basename6, dirname as dirname21, join as join20 } from "path";
 async function renderOpenClawSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "openclaw") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -22837,10 +22969,10 @@ async function renderOpenClawSubagent(artifact, stageRoot) {
 
 ${parsed.description ?? `OpenClaw subagent ${agentId}.`}`;
   const renderedPath = join20(stageRoot, ".agentwheel-rendered", "openclaw-subagents", agentId, "AGENTS.md");
-  await mkdir14(dirname20(renderedPath), { recursive: true });
+  await mkdir14(dirname21(renderedPath), { recursive: true });
   await writeFile15(renderedPath, `${body}
 `, "utf8");
-  const renderedDir = dirname20(renderedPath);
+  const renderedDir = dirname21(renderedPath);
   return {
     ...artifact,
     name: agentId,
@@ -25391,7 +25523,7 @@ function errorMessage2(error46) {
 
 // src/source/clawhub.ts
 import { mkdir as mkdir15, rm as rm8, writeFile as writeFile16 } from "fs/promises";
-import { basename as basename10, dirname as dirname21, join as join32, resolve as resolve22 } from "path";
+import { basename as basename10, dirname as dirname22, join as join32, resolve as resolve22 } from "path";
 
 // src/model/package.ts
 init_main();
@@ -25964,7 +26096,7 @@ async function writeGeneratedPackage(root, packageInfo) {
   };
   const pluginPath = join32(root, "plugins", pluginId, "clawhub.json");
   await rm8(root, { recursive: true, force: true });
-  await mkdir15(dirname21(pluginPath), { recursive: true });
+  await mkdir15(dirname22(pluginPath), { recursive: true });
   await writeFile16(join32(root, "openpack.json"), `${JSON.stringify({
     schemaVersion: CURRENT_OPENPACK_SCHEMA_VERSION,
     name: `clawhub/${name}`,
@@ -25997,7 +26129,7 @@ function cachePathFor(packageName, cacheRoot) {
 import { execFile as execFile6 } from "child_process";
 import { mkdir as mkdir17, rename as rename6, rm as rm10, stat as stat7 } from "fs/promises";
 import { homedir as homedir8 } from "os";
-import { basename as basename11, dirname as dirname23, join as join35, resolve as resolve23, sep as sep8 } from "path";
+import { basename as basename11, dirname as dirname24, join as join35, resolve as resolve23, sep as sep8 } from "path";
 import { promisify as promisify6 } from "util";
 init_fs();
 
@@ -26080,7 +26212,7 @@ function isMissingFile(error46) {
 init_fs();
 import { randomUUID as randomUUID4 } from "crypto";
 import { mkdir as mkdir16, readdir as readdir9, readFile as readFile29, rm as rm9, stat as stat6, writeFile as writeFile17 } from "fs/promises";
-import { dirname as dirname22, join as join34 } from "path";
+import { dirname as dirname23, join as join34 } from "path";
 var snapshotNamePattern = /^(.*)-([0-9a-f]{12})$/i;
 var leaseMarker = ".agentwheel-lease-";
 async function pruneGitCache(cacheRoot, options = {}) {
@@ -26148,7 +26280,7 @@ async function removeGeneratedEntries(root, preserveGit) {
   }
 }
 async function pruneGitCacheUnlocked(cacheRoot, options) {
-  const referencedCommits = await referencedGraphLockCommits(join34(dirname22(cacheRoot), "locks"));
+  const referencedCommits = await referencedGraphLockCommits(join34(dirname23(cacheRoot), "locks"));
   const entries = await readdir9(cacheRoot, { withFileTypes: true });
   const groups = /* @__PURE__ */ new Map();
   for (const entry of entries) {
@@ -26215,7 +26347,7 @@ async function walkGraphLocks(root, visit2) {
   }
 }
 async function hasLiveSnapshotLease(snapshotPath, dryRun) {
-  const directory = dirname22(snapshotPath);
+  const directory = dirname23(snapshotPath);
   const prefix = `${snapshotPath.slice(directory.length + 1)}${leaseMarker}`;
   const entries = await readdir9(directory, { withFileTypes: true });
   let live = false;
@@ -26354,7 +26486,7 @@ var GitSourceDriver = class {
   async fetch(resolved) {
     return withFilesystemLock(`${resolved.resolvedPath}.lock`, resolved.cacheLockTimeoutMs ?? 3e4, async () => {
       const parsed = parseGitSource(resolved.source);
-      const cacheRoot = dirname23(resolved.resolvedPath);
+      const cacheRoot = dirname24(resolved.resolvedPath);
       await mkdir17(cacheRoot, { recursive: true });
       await assertOwnedByCurrentUser(cacheRoot);
       if (await pathExists(resolved.resolvedPath)) await assertOwnedByCurrentUser(resolved.resolvedPath);
@@ -26449,9 +26581,9 @@ async function resolveCommit(checkoutPath, ref) {
   throw lastError;
 }
 async function snapshotCommit(checkoutPath, commit) {
-  const snapshotPath = join35(dirname23(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
+  const snapshotPath = join35(dirname24(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
   if (await pathExists(snapshotPath)) return snapshotPath;
-  const tempPath = join35(dirname23(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
+  const tempPath = join35(dirname24(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
   const tempIndexPath = `${tempPath}.index`;
   await rm10(tempPath, { recursive: true, force: true });
   await rm10(tempIndexPath, { force: true });
@@ -26489,7 +26621,7 @@ async function assertOwnedByCurrentUser(path) {
 
 // src/source/mcp-registry.ts
 import { mkdir as mkdir18, writeFile as writeFile18 } from "fs/promises";
-import { basename as basename12, dirname as dirname24, join as join36, resolve as resolve24 } from "path";
+import { basename as basename12, dirname as dirname25, join as join36, resolve as resolve24 } from "path";
 init_fs();
 var registryBaseUrl = "https://registry.modelcontextprotocol.io/v0.1";
 var sourcePrefix2 = "mcp-registry:";
@@ -26597,7 +26729,7 @@ function isSafeHttpUrl(value) {
 async function writeGeneratedPackage2(root, server) {
   const serverId = installNameFor3(server.serverName);
   const mcpPath = join36(root, "mcp", `${serverId}.json`);
-  await mkdir18(dirname24(mcpPath), { recursive: true });
+  await mkdir18(dirname25(mcpPath), { recursive: true });
   await writeFile18(join36(root, "openpack.json"), `${JSON.stringify({
     schemaVersion: CURRENT_OPENPACK_SCHEMA_VERSION,
     name: `mcp-registry/${server.serverName}`,
@@ -26631,14 +26763,14 @@ import { createHash as createHash16, randomUUID as randomUUID5 } from "crypto";
 import { execFile as execFile7 } from "child_process";
 import { cp as cp3, mkdir as mkdir19, readFile as readFile30, rename as rename7, rm as rm11 } from "fs/promises";
 import { homedir as homedir9 } from "os";
-import { basename as basename14, dirname as dirname26, join as join38, resolve as resolve25 } from "path";
+import { basename as basename14, dirname as dirname27, join as join38, resolve as resolve25 } from "path";
 import { promisify as promisify7 } from "util";
 import * as defaultSkillKit from "@skillkit/core";
 
 // src/source/skill-artifacts.ts
 init_fs();
 import { readdir as readdir10, stat as stat8 } from "fs/promises";
-import { basename as basename13, dirname as dirname25, extname as extname2, join as join37 } from "path";
+import { basename as basename13, dirname as dirname26, extname as extname2, join as join37 } from "path";
 async function artifactsFromSkillPaths(paths, packageName) {
   const artifacts = [];
   const seen = /* @__PURE__ */ new Set();
@@ -26675,7 +26807,7 @@ async function artifactFromSkillPath(item, packageName) {
     };
   }
   if (stats.isFile() && basename13(item.path).toLowerCase() === "skill.md") {
-    const dir = dirname25(item.path);
+    const dir = dirname26(item.path);
     const name = sanitizeSkillName(item.name ?? basename13(dir));
     return {
       type: "skills",
@@ -26783,7 +26915,7 @@ var SkillKitSourceDriver = class {
         sourceHash: await hashPath(resolved.resolvedPath)
       };
     }
-    const specCachePath = cachePathFor4(spec, dirname26(dirname26(resolved.resolvedPath)));
+    const specCachePath = cachePathFor4(spec, dirname27(dirname27(resolved.resolvedPath)));
     const refIdentity = resolved.requestedRef ?? "default";
     const lockPath = `${specCachePath}.ref-${createHash16("sha256").update(refIdentity).digest("hex")}.lock`;
     const inflightKey = `${lockPath}\0${requestedCommit ?? "movable"}`;
@@ -26804,11 +26936,11 @@ var SkillKitSourceDriver = class {
       throw new Error("SkillKit provider API unavailable or cannot resolve source. Expected @skillkit/core detectProvider().clone().");
     }
     const materialized = await withFilesystemLock(lockPath, resolved.cacheLockTimeoutMs ?? 3e4, async () => {
-      const immutablePath = requestedCommit ? cachePathFor4(spec, dirname26(dirname26(specCachePath)), requestedCommit) : void 0;
+      const immutablePath = requestedCommit ? cachePathFor4(spec, dirname27(dirname27(specCachePath)), requestedCommit) : void 0;
       if (immutablePath && await pathExists(immutablePath)) {
         return { path: immutablePath, commit: requestedCommit, cacheIdentity: requestedCommit };
       }
-      await mkdir19(dirname26(specCachePath), { recursive: true });
+      await mkdir19(dirname27(specCachePath), { recursive: true });
       const candidatePath = `${specCachePath}.agentwheel-tmp-${process.pid}-${randomUUID5()}`;
       const publishPath = `${candidatePath}.publish`;
       let result;
@@ -26830,7 +26962,7 @@ var SkillKitSourceDriver = class {
             `SkillKit provider resolved ${resolvedIdentity.commit ?? "non-Git content"} instead of requested commit ${requestedCommit}`
           );
         }
-        const cachePath = cachePathFor4(spec, dirname26(dirname26(specCachePath)), resolvedIdentity.cacheKey);
+        const cachePath = cachePathFor4(spec, dirname27(dirname27(specCachePath)), resolvedIdentity.cacheKey);
         if (await pathExists(cachePath)) {
           return { path: cachePath, commit: resolvedIdentity.commit, cacheIdentity: resolvedIdentity.cacheKey };
         }
@@ -27101,7 +27233,7 @@ init_identify();
 
 // src/staging/staging.ts
 import { chmod as chmod4, cp as cp5, mkdir as mkdir22, mkdtemp as mkdtemp4, readdir as readdir13, stat as stat12 } from "fs/promises";
-import { basename as basename19, dirname as dirname30, join as join43, relative as relative16, resolve as resolve29, sep as sep10 } from "path";
+import { basename as basename19, dirname as dirname31, join as join43, relative as relative16, resolve as resolve29, sep as sep10 } from "path";
 import { tmpdir as tmpdir5 } from "os";
 init_fs();
 
@@ -27110,7 +27242,7 @@ init_artifact();
 init_fs();
 import { createHash as createHash17 } from "crypto";
 import { readdir as readdir11, readFile as readFile31, stat as stat10, writeFile as writeFile19 } from "fs/promises";
-import { basename as basename16, dirname as dirname27, extname as extname3, join as join40, relative as relative15, resolve as resolve28, sep as sep9 } from "path";
+import { basename as basename16, dirname as dirname28, extname as extname3, join as join40, relative as relative15, resolve as resolve28, sep as sep9 } from "path";
 var includePattern = /<!--\s*openpack:include(\?)?\s+([^>]+?)\s*-->/g;
 var escapedIncludePattern = /<!--\s*openpack\\:include(\?)?\s+([^>]+?)\s*-->/g;
 var generatedPattern = /<!--\s*(?:BEGIN|END)\s+openpack:include\b/;
@@ -27365,11 +27497,11 @@ async function listMarkdownFiles(root) {
 function composeEntriesForFile(artifact, file2) {
   if (!artifact.compose?.length) return [];
   if (artifact.kind === "file") return [resolve28(artifact.stagedPath ?? artifact.sourcePath), resolve28(file2)].every(Boolean) && resolve28(artifact.stagedPath ?? artifact.sourcePath) === resolve28(file2) ? artifact.compose : [];
-  return basename16(file2) === "SKILL.md" && dirname27(file2) === resolve28(artifact.stagedPath ?? artifact.sourcePath) ? artifact.compose : [];
+  return basename16(file2) === "SKILL.md" && dirname28(file2) === resolve28(artifact.stagedPath ?? artifact.sourcePath) ? artifact.compose : [];
 }
 function isPrimaryMarkdownFile(artifact, file2) {
   if (artifact.kind === "file") return resolve28(artifact.stagedPath ?? artifact.sourcePath) === resolve28(file2);
-  return basename16(file2) === "SKILL.md" && dirname27(file2) === resolve28(artifact.stagedPath ?? artifact.sourcePath);
+  return basename16(file2) === "SKILL.md" && dirname28(file2) === resolve28(artifact.stagedPath ?? artifact.sourcePath);
 }
 function orderedForExpansion(artifacts) {
   return [...artifacts].sort((a, b) => Number(a.type === "fragments") - Number(b.type === "fragments"));
@@ -27417,7 +27549,7 @@ function artifactPathMap(artifacts) {
 // src/staging/customize.ts
 init_fs();
 import { cp as cp4, mkdir as mkdir20, readdir as readdir12, readFile as readFile32, writeFile as writeFile20 } from "fs/promises";
-import { dirname as dirname28, join as join41 } from "path";
+import { dirname as dirname29, join as join41 } from "path";
 async function applyCustomizations(artifacts, options) {
   let next = [...artifacts];
   next = await applyReplacements2(next, options, "override", installableArtifactTypes());
@@ -27441,7 +27573,7 @@ async function applyInstructionOverlay(artifacts, options) {
   const managed = await readFile32(artifact.stagedPath ?? artifact.sourcePath, "utf8");
   const local = await readFile32(overlayPath, "utf8");
   const composedPath = join41(options.stageRoot, ".agentwheel-composed", "instructions", "AGENTS.md");
-  await mkdir20(dirname28(composedPath), { recursive: true });
+  await mkdir20(dirname29(composedPath), { recursive: true });
   await writeFile20(
     composedPath,
     [
@@ -27514,7 +27646,7 @@ async function applyReplacements2(artifacts, options, channel, artifactTypes) {
         const artifactKind = entry.isDirectory() ? "dir" : "file";
         const existing = byKey.get(artifactMapKey);
         const stagedPath = join41(options.stageRoot, ".agentwheel-composed", channel, type, entry.name);
-        await mkdir20(dirname28(stagedPath), { recursive: true });
+        await mkdir20(dirname29(stagedPath), { recursive: true });
         await cp4(full, stagedPath, { recursive: artifactKind === "dir", dereference: true });
         byKey.set(artifactMapKey, {
           ...existing,
@@ -27560,7 +27692,7 @@ async function sortedDirEntries2(path) {
 // src/staging/claude-subagents.ts
 init_fs();
 import { mkdir as mkdir21, readFile as readFile33, writeFile as writeFile21 } from "fs/promises";
-import { basename as basename18, dirname as dirname29, join as join42 } from "path";
+import { basename as basename18, dirname as dirname30, join as join42 } from "path";
 async function renderClaudeSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "claude") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -27591,7 +27723,7 @@ async function renderClaudeSubagent(artifact, stageRoot) {
   }
   const content = await readFile33(markdownPath, "utf8");
   const renderedPath = join42(stageRoot, ".agentwheel-rendered", "claude-subagents", `${agentName}.md`);
-  await mkdir21(dirname29(renderedPath), { recursive: true });
+  await mkdir21(dirname30(renderedPath), { recursive: true });
   await writeFile21(renderedPath, content.endsWith("\n") ? content : `${content}
 `, "utf8");
   return {
@@ -27634,7 +27766,7 @@ async function stageResolvedArtifactsRaw(resolved, artifacts, parentDir = tmpdir
   await removeOnFailure(root, async () => {
     for (const artifact of artifacts) {
       const stagedPath = join43(root, artifact.relativePath);
-      await mkdir22(dirname30(stagedPath), { recursive: true });
+      await mkdir22(dirname31(stagedPath), { recursive: true });
       await cp5(artifact.sourcePath, stagedPath, {
         recursive: artifact.kind === "dir",
         dereference: true,
@@ -27740,7 +27872,7 @@ async function copyAsset(asset, source, dest) {
     throw new Error(`Asset include source is not a file or directory: ${source}`);
   }
   if (!asset.include?.length) {
-    await mkdir22(dirname30(dest), { recursive: true });
+    await mkdir22(dirname31(dest), { recursive: true });
     await cp5(source, dest, { recursive: true, dereference: true });
     if (asset.mode === "copy") await normalizeCopiedModes(dest);
     return;
@@ -27752,7 +27884,7 @@ async function copyAsset(asset, source, dest) {
   }
 }
 async function copyAssetFile(source, dest, asset) {
-  await mkdir22(dirname30(dest), { recursive: true });
+  await mkdir22(dirname31(dest), { recursive: true });
   await cp5(source, dest, { dereference: true });
   if (asset.mode === "copy") await chmod4(dest, 420);
 }
@@ -27808,7 +27940,7 @@ init_adapter();
 init_artifact();
 init_workspace();
 import { appendFile, cp as cp6, lstat as lstat7, mkdir as mkdir23, readdir as readdir15, rm as rm13 } from "fs/promises";
-import { dirname as dirname32, join as join46, relative as relative17 } from "path";
+import { dirname as dirname33, join as join46, relative as relative17 } from "path";
 
 // src/resolve/graph.ts
 import { createHash as createHash19 } from "crypto";
@@ -27946,7 +28078,7 @@ import { resolve as resolve31 } from "path";
 // src/registry/client.ts
 import { readFile as readFile35, rm as rm12, stat as stat13 } from "fs/promises";
 import { homedir as homedir11 } from "os";
-import { dirname as dirname31, join as join44, resolve as resolve30 } from "path";
+import { dirname as dirname32, join as join44, resolve as resolve30 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/model/registry.ts
@@ -28067,7 +28199,7 @@ var RegistryClient = class {
       const stats = await stat13(fullPath);
       return readFile35(stats.isDirectory() ? join44(fullPath, "index.json") : fullPath, "utf8");
     }
-    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join44(dirname31(this.cachePath), "registry-repos") }));
+    const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join44(dirname32(this.cachePath), "registry-repos") }));
     return readFile35(join44(resolved.resolvedPath, "index.json"), "utf8");
   }
   warnCompatibility(entries) {
@@ -29194,7 +29326,7 @@ init_declarations();
 async function remember(workspaceRoot, runtime, text) {
   const overlayPath = join46(workspaceRoot, ".agentwheel", "overlays", runtime, "instructions.local.md");
   declareMutationPath(overlayPath);
-  await mkdir23(dirname32(overlayPath), { recursive: true });
+  await mkdir23(dirname33(overlayPath), { recursive: true });
   await appendFile(overlayPath, `${text.trim()}
 `, "utf8");
   return { overlayPath };
@@ -29227,7 +29359,7 @@ async function ejectArtifact(workspaceRoot, item) {
     } else {
       declareMutationPath(ejectedPath);
     }
-    await mkdir23(dirname32(ejectedPath), { recursive: true });
+    await mkdir23(dirname33(ejectedPath), { recursive: true });
     await rm13(ejectedPath, { recursive: true, force: true });
     await cp6(sourcePath, ejectedPath, { recursive: artifact.kind === "dir", dereference: true });
     return {
@@ -29346,7 +29478,7 @@ init_adapter();
 init_graph_lock();
 import { createHash as createHash21 } from "crypto";
 import { mkdir as mkdir25, readdir as readdir16 } from "fs/promises";
-import { basename as basename21, dirname as dirname34, join as join49, posix as posix7, resolve as resolve34 } from "path";
+import { basename as basename21, dirname as dirname35, join as join49, posix as posix7, resolve as resolve34 } from "path";
 init_paths();
 init_merge_removal();
 init_transaction();
@@ -30034,7 +30166,7 @@ init_zod();
 init_fs();
 import { mkdir as mkdir24, readFile as readFile38 } from "fs/promises";
 import { homedir as homedir13 } from "os";
-import { dirname as dirname33, join as join48 } from "path";
+import { dirname as dirname34, join as join48 } from "path";
 var trustStoreSchema = external_exports.object({
   version: external_exports.literal(1),
   acceptedSources: external_exports.array(external_exports.string().min(1)).default([])
@@ -30110,7 +30242,7 @@ async function readTrustStore(path) {
   return trustStoreSchema.parse(JSON.parse(await readFile38(path, "utf8")));
 }
 async function writeTrustStore(path, store) {
-  await mkdir24(dirname33(path), { recursive: true });
+  await mkdir24(dirname34(path), { recursive: true });
   await writeJsonAtomic(path, trustStoreSchema.parse(store));
 }
 function defaultTrustStorePath() {
@@ -30610,7 +30742,7 @@ async function discoverTargetApplyJournal(options) {
       continue;
     }
     if (!journal.graphLockPath || !journal.graphLock || !journal.graphLockDigest) continue;
-    if (resolve34(dirname34(journal.graphLockPath)) !== resolve34(dirname34(options.graphLockPath))) continue;
+    if (resolve34(dirname35(journal.graphLockPath)) !== resolve34(dirname35(options.graphLockPath))) continue;
     if (options.transport.kind === "ssh") {
       throw new Error(
         `Legacy SSH apply journal at ${item.path} does not record its original endpoint; Agentwheel cannot prove endpoint identity, so the journal was preserved.`
@@ -30752,7 +30884,7 @@ async function resolvePriorTargetState(options) {
   return {};
 }
 async function discoverLegacyStateCandidates(options) {
-  const directory = dirname34(options.graphLockPath);
+  const directory = dirname35(options.graphLockPath);
   let names;
   try {
     names = await readdir16(directory);
@@ -31040,7 +31172,7 @@ function mcpServerNames(strategy, removal) {
   return new Set(Object.keys(servers));
 }
 function globalConfigRoot(globalRoot) {
-  return dirname34(dirname34(globalWorkspaceConfigPath(globalRoot)));
+  return dirname35(dirname35(globalWorkspaceConfigPath(globalRoot)));
 }
 function ownedByWorkspace(owner, desiredOwner, workspaceRoot, ownsSubWorkspaces) {
   if (owner === desiredOwner) return true;
@@ -31188,7 +31320,7 @@ function targetLabel(target) {
 init_workspace();
 init_run_as_identity();
 init_fs();
-import { basename as basename22, dirname as dirname35, join as join50, resolve as resolve35 } from "path";
+import { basename as basename22, dirname as dirname36, join as join50, resolve as resolve35 } from "path";
 var runtimeMarkers = [
   { adapter: "openclaw", dirs: [".openclaw", ".clawdbot", ".moltbot"] },
   { adapter: "claude", dirs: [".claude"] },
@@ -31314,7 +31446,7 @@ async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
     if (adapterFilter && marker.adapter !== adapterFilter) continue;
     for (const dir of marker.dirs) {
       if (basename22(root) === dir) {
-        matches.push({ adapter: marker.adapter, targetRoot: dirname35(root) });
+        matches.push({ adapter: marker.adapter, targetRoot: dirname36(root) });
       } else if (await pathExists(join50(root, dir))) {
         matches.push({ adapter: marker.adapter, targetRoot: root });
       }
@@ -31361,7 +31493,7 @@ function dedupeTargets(matches) {
 function runtimeScanRoot(request) {
   const root = resolve35(request.targetRoot ?? request.cwd ?? process.cwd());
   if (request.targetRoot) return root;
-  return runtimeMarkers.some((marker) => marker.dirs.includes(basename22(root))) ? dirname35(root) : root;
+  return runtimeMarkers.some((marker) => marker.dirs.includes(basename22(root))) ? dirname36(root) : root;
 }
 
 // src/lifecycle/profile.ts
@@ -31695,7 +31827,7 @@ init_selection();
 // src/cli/update-check.ts
 import { mkdir as mkdir26, readFile as readFile39, writeFile as writeFile22 } from "fs/promises";
 import { homedir as homedir14 } from "os";
-import { dirname as dirname36, join as join51 } from "path";
+import { dirname as dirname37, join as join51 } from "path";
 var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_TIMEOUT_MS = 300;
 var REGISTRY_URL = "https://registry.npmjs.org/agentwheel";
@@ -31748,7 +31880,7 @@ async function readCache(path) {
   }
 }
 async function writeCache(path, cache) {
-  await mkdir26(dirname36(path), { recursive: true });
+  await mkdir26(dirname37(path), { recursive: true });
   await writeFile22(path, `${JSON.stringify(cache, null, 2)}
 `, "utf8");
 }
@@ -31984,11 +32116,11 @@ init_graph_lock();
 
 // src/cli/version.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname37, join as join54 } from "path";
+import { dirname as dirname38, join as join54 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var FALLBACK_VERSION = "0.0.0";
 function resolveCliVersion() {
-  let dir = dirname37(fileURLToPath3(import.meta.url));
+  let dir = dirname38(fileURLToPath3(import.meta.url));
   while (true) {
     try {
       const pkg = JSON.parse(readFileSync2(join54(dir, "package.json"), "utf8"));
@@ -31997,7 +32129,7 @@ function resolveCliVersion() {
       }
     } catch {
     }
-    const parent = dirname37(dir);
+    const parent = dirname38(dir);
     if (parent === dir) return FALLBACK_VERSION;
     dir = parent;
   }
@@ -32906,7 +33038,7 @@ init_graph_lock();
 init_manifest();
 import { createHash as createHash26 } from "crypto";
 import { lstat as lstat8, readdir as readdir17 } from "fs/promises";
-import { basename as basename23, dirname as dirname38, join as join57, posix as posix8, relative as relative18, resolve as resolve42 } from "path";
+import { basename as basename23, dirname as dirname39, join as join57, posix as posix8, relative as relative18, resolve as resolve42 } from "path";
 async function inventoryHistoricalLocks(fleetRoot) {
   const root = join57(fleetRoot, ".agentwheel", "locks");
   const found = [];
@@ -32953,7 +33085,7 @@ async function planLegacyRecovery(input) {
   const { graphPlan, installRoot, targetKey: targetKey2, adapter, installationType, historicalLocks, transport } = input;
   assertCompleteGraphPlan(graphPlan);
   const binding = {
-    targetLockDir: dirname38(graphPlan.graphLockPath),
+    targetLockDir: dirname39(graphPlan.graphLockPath),
     stableLockPath: graphPlan.graphLockPath,
     stableStateKey: graphPlan.plan.stateKey,
     currentFingerprint: graphPlan.targetFingerprint,
@@ -33065,7 +33197,7 @@ function claimFor(item, entry, locks, binding) {
   const evidence = [];
   const owner = "workspaceOwner" in entry ? entry.workspaceOwner : legacyUnownedWorkspaceOwner;
   const sameRoot = binding.transportKind === "ssh" ? posix8.normalize(item.manifest.targetRoot) === posix8.normalize(binding.installRoot) : resolve42(item.manifest.targetRoot) === resolve42(binding.installRoot);
-  const inTargetDir = matches.filter((candidate) => resolve42(dirname38(candidate.path)) === resolve42(binding.targetLockDir));
+  const inTargetDir = matches.filter((candidate) => resolve42(dirname39(candidate.path)) === resolve42(binding.targetLockDir));
   const boundLocks = inTargetDir.filter((candidate) => lockBindsState(candidate, item, binding));
   if (owner !== binding.expectedOwner) evidence.push("workspace owner differs from selected Fleet target");
   if (item.manifest.version !== 2 || item.manifest.installationType !== binding.installationType) evidence.push("installation type differs or manifest is legacy v1");
@@ -35114,7 +35246,7 @@ init_fleet();
 // src/lifecycle/fleet-normalize.ts
 import { createHash as createHash31 } from "crypto";
 import { homedir as homedir17 } from "os";
-import { dirname as dirname40, isAbsolute as isAbsolute16, join as join65, relative as relative21, resolve as resolve47 } from "path";
+import { dirname as dirname41, isAbsolute as isAbsolute16, join as join65, relative as relative21, resolve as resolve47 } from "path";
 init_manifest2();
 init_paths();
 init_merge_removal();
@@ -35140,7 +35272,7 @@ init_caller_write_trust();
 import { AsyncLocalStorage } from "async_hooks";
 import { readFile as readLocalFile, readdir as readLocalDir, rm as removeLocal, mkdir as mkdir27, open as open6, rename as rename9 } from "fs/promises";
 import { randomUUID as randomUUID8 } from "crypto";
-import { dirname as dirname39, isAbsolute as isAbsolute15, relative as relative20, resolve as resolve46, sep as sep11 } from "path";
+import { dirname as dirname40, isAbsolute as isAbsolute15, relative as relative20, resolve as resolve46, sep as sep11 } from "path";
 var contexts = new AsyncLocalStorage();
 var inside = (root, path) => {
   const rel = relative20(root, resolve46(path));
@@ -35202,7 +35334,7 @@ async function normalizationRemove(path, options) {
   }
   await assertNormalizationCallerWrite(path);
   await removeLocal(path, options);
-  if (normalizationIdentities().length) await syncMetadataPath(dirname39(path), true);
+  if (normalizationIdentities().length) await syncMetadataPath(dirname40(path), true);
 }
 async function normalizationWriteJson(path, data) {
   const transport = normalizationTransport(path);
@@ -35216,7 +35348,7 @@ async function normalizationWriteJson(path, data) {
   }
   await assertNormalizationCallerWrite(path);
   await assertNoSymlinkPath2(path);
-  await mkdir27(dirname39(path), { recursive: true, mode: 448 });
+  await mkdir27(dirname40(path), { recursive: true, mode: 448 });
   await assertNormalizationCallerWrite(path);
   const temporary = `${path}.pending-${randomUUID8()}`;
   try {
@@ -35230,8 +35362,8 @@ async function normalizationWriteJson(path, data) {
       await file2.close();
     }
     await rename9(temporary, path);
-    await syncMetadataPath(dirname39(path), true);
-    await syncMetadataPath(dirname39(dirname39(path)), true);
+    await syncMetadataPath(dirname40(path), true);
+    await syncMetadataPath(dirname40(dirname40(path)), true);
   } finally {
     await removeLocal(temporary, { force: true });
   }
@@ -36282,7 +36414,7 @@ async function releasedTargetStateForGraph(scope, graph, identityFleetId = scope
     ...current,
     stateKey,
     targetFingerprint,
-    graphLockPath: join65(dirname40(graph.path), `${targetFingerprint}.graph-lock.json`),
+    graphLockPath: join65(dirname41(graph.path), `${targetFingerprint}.graph-lock.json`),
     manifestPath: installManifestPath(current.installRoot, current.adapter, {
       installationType: current.installationType,
       stateKey
@@ -37536,7 +37668,7 @@ ownershipCommand.command("recovery-plan").description("write a read-only per-pat
   const adapter = await resolveAdapterForTarget(target, {});
   const transport = transportForTarget(target);
   const requestedReport = normalizeCliPath(options.report);
-  const reportPath = join66(await realpath4(dirname41(requestedReport)), basename24(requestedReport));
+  const reportPath = join66(await realpath4(dirname42(requestedReport)), basename24(requestedReport));
   const reportInsideTarget = relative22(resolve48(target.targetRoot), reportPath);
   if (reportInsideTarget === "" || !reportInsideTarget.startsWith("..") && !isAbsolute17(reportInsideTarget)) {
     throw new Error("Recovery report must be outside the runtime target root.");
@@ -40559,7 +40691,7 @@ async function initPackage(root) {
   await writeFile24(instructionsPath, "# Agent Instructions\n", "utf8");
 }
 async function defaultBootstrapPackage(_root) {
-  const packageRoot = await findAgentwheelPackageRoot(dirname41(fileURLToPath4(import.meta.url)));
+  const packageRoot = await findAgentwheelPackageRoot(dirname42(fileURLToPath4(import.meta.url)));
   if (!packageRoot) return void 0;
   return {
     name: "agentwheel",
@@ -40606,7 +40738,7 @@ async function findAgentwheelPackageRoot(start) {
   let current = resolve48(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
-    const parent = dirname41(current);
+    const parent = dirname42(current);
     if (parent === current) return void 0;
     current = parent;
   }

package/openpack.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "NestDevLab/agentwheel",
-  "version": "0.22.2",
+  "version": "0.22.3",
   "provides": [
     { "type": "skills", "path": "skills" }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.22.2",
+  "version": "0.22.3",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",

package/skills/agentwheel/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.22.2"
+  version: "0.22.3"
 ---
 
 # agentwheel

package/skills/agentwheel-discovery/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.22.2"
+  version: "0.22.3"
 ---
 
 # Agentwheel Discovery