agentwheel 0.22.3 → 0.22.4

package/dist/index.js

@@ -16558,7 +16558,8 @@ var init_local = __esm({
       atomicCopy,
       rm: (path) => rm3(path, { recursive: true, force: true }),
       async execFile(command, args, options = {}) {
-        await execFileAsync(command, args, { cwd: options.cwd });
+        const { stdout } = await execFileAsync(command, args, { cwd: options.cwd });
+        return stdout;
       }
     };
   }
@@ -16627,7 +16628,7 @@ function createSshTransport(config2) {
     execFile(command, commandArgs, options = {}) {
       const quoted = [command, ...commandArgs].map(quoteSh).join(" ");
       const remoteCommand = options.cwd ? `cd ${quoteSh(options.cwd)} && ${quoted}` : quoted;
-      return run(remoteCommand).then(() => void 0);
+      return run(remoteCommand);
     }
   };
 }
@@ -17180,6 +17181,189 @@ var init_transport = __esm({
   }
 });
 
+// src/resolve/semver.ts
+function parseSemver(value) {
+  const match = semverPattern.exec(value.trim());
+  if (!match) return void 0;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4]
+  };
+}
+function satisfiesVersionRange(version2, range) {
+  if (!range || range.trim() === "" || range.trim() === "*") return true;
+  const parsedVersion = parseSemver(version2);
+  const trimmed = range.trim();
+  if (!parsedVersion) {
+    return trimmed === "*" || trimmed === version2;
+  }
+  const comparators = parseRange(trimmed);
+  if (!comparators) return trimmed === version2;
+  return comparators.every((comparator) => compareWith(parsedVersion, comparator));
+}
+function semverMajorOrVersion(version2) {
+  const parsed = parseSemver(version2);
+  return parsed ? String(parsed.major) : version2;
+}
+function compareSemverStrings(a, b) {
+  const parsedA = parseSemver(a);
+  const parsedB = parseSemver(b);
+  if (!parsedA || !parsedB) return a.localeCompare(b);
+  return compareSemver(parsedA, parsedB);
+}
+function isSupportedVersionRange(range) {
+  const trimmed = range.trim();
+  return trimmed === "*" || parseRange(trimmed) !== void 0;
+}
+function parseRange(range) {
+  if (range === "*") return [];
+  if (range.startsWith("^")) {
+    const base = parseSemver(range.slice(1));
+    if (!base) return void 0;
+    return [
+      { op: ">=", version: base },
+      { op: "<", version: caretUpperBound(base) }
+    ];
+  }
+  if (range.startsWith("~")) {
+    const base = parseSemver(range.slice(1));
+    if (!base) return void 0;
+    return [
+      { op: ">=", version: base },
+      { op: "<", version: { major: base.major, minor: base.minor + 1, patch: 0 } }
+    ];
+  }
+  const parts = range.split(/\s+/).filter(Boolean);
+  const comparators = [];
+  for (const part of parts) {
+    const match = /^(>=|<=|>|<|=)?(.+)$/.exec(part);
+    if (!match) return void 0;
+    const version2 = parseSemver(match[2] ?? "");
+    if (!version2) return void 0;
+    comparators.push({ op: match[1] ?? "=", version: version2 });
+  }
+  return comparators;
+}
+function caretUpperBound(version2) {
+  if (version2.major > 0) return { major: version2.major + 1, minor: 0, patch: 0 };
+  if (version2.minor > 0) return { major: 0, minor: version2.minor + 1, patch: 0 };
+  return { major: 0, minor: 0, patch: version2.patch + 1 };
+}
+function compareWith(version2, comparator) {
+  const order = compareSemver(version2, comparator.version);
+  switch (comparator.op) {
+    case "=":
+      return order === 0;
+    case ">":
+      return order > 0;
+    case ">=":
+      return order >= 0;
+    case "<":
+      return order < 0;
+    case "<=":
+      return order <= 0;
+  }
+}
+function compareSemver(a, b) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (a[key] !== b[key]) return a[key] > b[key] ? 1 : -1;
+  }
+  if (a.prerelease === b.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b.prerelease) return -1;
+  return a.prerelease.localeCompare(b.prerelease);
+}
+var semverPattern;
+var init_semver = __esm({
+  "src/resolve/semver.ts"() {
+    "use strict";
+    semverPattern = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+  }
+});
+
+// src/targets/plugins/openclaw.ts
+import { readFile as readFile8 } from "fs/promises";
+import { join as join10 } from "path";
+function openClawPluginInstallCommand(request) {
+  return ["openclaw", "plugins", "install", "--force", ...request.acceptCapabilities ? ["--accept-capabilities"] : [], request.path];
+}
+function createOpenClawCapabilityDetector(run) {
+  let cached2;
+  return () => cached2 ??= detectOpenClawCapabilitySupport(run);
+}
+async function detectOpenClawCapabilitySupport(run) {
+  try {
+    const help = await run(["plugins", "install", "--help"]);
+    if (help?.trim()) return /(?:^|\s)--accept-capabilities(?=[\s=,]|$)/m.test(help);
+  } catch {
+  }
+  try {
+    const output = await run(["--version"]);
+    const version2 = output?.match(/(?:^|\s)v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?=\s|$)/)?.[1];
+    return version2 !== void 0 && parseSemver(version2) !== void 0 && satisfiesVersionRange(version2, ">=2026.8.1");
+  } catch {
+    return false;
+  }
+}
+function openClawPluginUninstallCommand(pluginName) {
+  return ["openclaw", "plugins", "uninstall", pluginName, "--force"];
+}
+async function openClawPluginSpec(request) {
+  if (request.format === "openclaw-clawhub-plugin") {
+    const metadata = await openClawClawHubPluginMetadata(request.path, request.fallbackPluginName);
+    return {
+      runtime: "openclaw",
+      pluginName: metadata.pluginName,
+      installCommands: [openClawPluginInstallCommand({ path: metadata.installSpec, dryRun: true })],
+      uninstallCommands: [openClawPluginUninstallCommand(metadata.pluginName)]
+    };
+  }
+  const pluginName = await openClawPluginName(request.path, request.fallbackPluginName);
+  return {
+    runtime: "openclaw",
+    pluginName,
+    installCommands: [openClawPluginInstallCommand({ path: request.path, dryRun: true })],
+    uninstallCommands: [openClawPluginUninstallCommand(pluginName)]
+  };
+}
+async function openClawPluginName(root, fallback) {
+  for (const manifestName of ["plugin.json", "openclaw.plugin.json"]) {
+    const manifestPath = join10(root, manifestName);
+    if (!await pathExists(manifestPath)) continue;
+    const parsed = JSON.parse(await readFile8(manifestPath, "utf8"));
+    if (typeof parsed.name === "string" && parsed.name.trim().length > 0) return parsed.name.trim();
+  }
+  return fallback;
+}
+async function openClawClawHubPluginMetadata(root, fallback) {
+  const metadataPath = join10(root, "clawhub.json");
+  if (!await pathExists(metadataPath)) {
+    throw new Error("OpenClaw ClawHub plugins must contain clawhub.json");
+  }
+  const parsed = JSON.parse(await readFile8(metadataPath, "utf8"));
+  const installSpec = stringField(parsed.installSpec);
+  if (!installSpec?.startsWith("clawhub:")) {
+    throw new Error("OpenClaw ClawHub plugin metadata must declare installSpec starting with clawhub:");
+  }
+  const pluginName = stringField(parsed.runtimeId) ?? installNameFor(stringField(parsed.name) ?? fallback);
+  return { installSpec, pluginName };
+}
+function stringField(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function installNameFor(value) {
+  return value.split("/").at(-1).replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "clawhub-plugin";
+}
+var init_openclaw2 = __esm({
+  "src/targets/plugins/openclaw.ts"() {
+    "use strict";
+    init_fs();
+    init_semver();
+  }
+});
+
 // src/transport/run-as-policy.ts
 function assertRunAsPlanSupported(plan, transport) {
   if (transport.kind !== "local-run-as") return;
@@ -17194,12 +17378,12 @@ var init_run_as_policy = __esm({
 });
 
 // src/install/json-merge.ts
-import { readFile as readFile8, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname7 } from "path";
 import { mkdir as mkdir5 } from "fs/promises";
 async function mergeJsonFile(sourcePath, destPath) {
-  const source = JSON.parse(await readFile8(sourcePath, "utf8"));
-  const current = await pathExists(destPath) ? JSON.parse(await readFile8(destPath, "utf8")) : {};
+  const source = JSON.parse(await readFile9(sourcePath, "utf8"));
+  const current = await pathExists(destPath) ? JSON.parse(await readFile9(destPath, "utf8")) : {};
   const merged = deepMerge(current, source);
   await mkdir5(dirname7(destPath), { recursive: true });
   await writeFile5(destPath, `${JSON.stringify(merged, null, 2)}
@@ -17240,11 +17424,11 @@ var init_json_merge = __esm({
 });
 
 // src/install/openclaw-json-merge.ts
-import { mkdir as mkdir6, readFile as readFile9, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir6, readFile as readFile10, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname8 } from "path";
 async function mergeOpenClawJsonFile(sourcePath, destPath) {
   const source = await renderOpenClawJsonMergeSource(sourcePath);
-  const current = await pathExists(destPath) ? JSON.parse(await readFile9(destPath, "utf8")) : {};
+  const current = await pathExists(destPath) ? JSON.parse(await readFile10(destPath, "utf8")) : {};
   const merged = mergeOpenClawJson(current, source);
   await mkdir6(dirname8(destPath), { recursive: true });
   await writeFile6(destPath, `${JSON.stringify(merged, null, 2)}
@@ -17252,7 +17436,7 @@ async function mergeOpenClawJsonFile(sourcePath, destPath) {
 }
 async function renderOpenClawJsonMergeSource(sourcePath) {
   return expandEnvPlaceholders(
-    normalizeOpenClawConfig(JSON.parse(await readFile9(sourcePath, "utf8"))),
+    normalizeOpenClawConfig(JSON.parse(await readFile10(sourcePath, "utf8"))),
     sourcePath
   );
 }
@@ -17517,9 +17701,9 @@ var init_manifest = __esm({
 });
 
 // src/install/paths.ts
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function metadataDir(targetRoot) {
-  return join10(targetRoot, ".agentwheel");
+  return join11(targetRoot, ".agentwheel");
 }
 function stateKeyFor(adapter, scope = {}) {
   assertPathSafeAdapterName(adapter);
@@ -17539,10 +17723,10 @@ function assertPathSafeAdapterName(adapter) {
   }
 }
 function installManifestPath(targetRoot, adapter, scope = {}) {
-  return join10(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.install-manifest.json`);
+  return join11(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.install-manifest.json`);
 }
 function sourceLockPath(targetRoot, adapter, scope = {}) {
-  return join10(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.source-lock.json`);
+  return join11(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.source-lock.json`);
 }
 function sanitizeStateKey(value) {
   return value.replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "default";
@@ -17556,7 +17740,7 @@ var init_paths = __esm({
 
 // src/install/manifest.ts
 import { createHash as createHash7 } from "crypto";
-import { join as join11, resolve as resolve10 } from "path";
+import { join as join12, resolve as resolve10 } from "path";
 async function readInstallManifest(targetRoot, adapter, transport = localTransport, scope = {}) {
   const path = installManifestPath(targetRoot, adapter, scope);
   if (!await transport.pathExists(path)) return void 0;
@@ -17574,7 +17758,7 @@ async function listInstallManifests(targetRoot, adapter, transport = localTransp
   for (const fileName of await transport.listDir(dir)) {
     if (!fileName.endsWith(suffix)) continue;
     const stateKey = fileName.slice(0, -suffix.length);
-    const path = join11(dir, fileName);
+    const path = join12(dir, fileName);
     try {
       const raw = JSON.parse(await transport.readFile(path));
       const parsed = installManifestSchema.parse(raw);
@@ -17759,108 +17943,6 @@ if private and (s.st_uid!=os.geteuid() or not stat.S_ISREG(s.st_mode) or s.st_nl
   }
 });
 
-// src/resolve/semver.ts
-function parseSemver(value) {
-  const match = semverPattern.exec(value.trim());
-  if (!match) return void 0;
-  return {
-    major: Number(match[1]),
-    minor: Number(match[2]),
-    patch: Number(match[3]),
-    prerelease: match[4]
-  };
-}
-function satisfiesVersionRange(version2, range) {
-  if (!range || range.trim() === "" || range.trim() === "*") return true;
-  const parsedVersion = parseSemver(version2);
-  const trimmed = range.trim();
-  if (!parsedVersion) {
-    return trimmed === "*" || trimmed === version2;
-  }
-  const comparators = parseRange(trimmed);
-  if (!comparators) return trimmed === version2;
-  return comparators.every((comparator) => compareWith(parsedVersion, comparator));
-}
-function semverMajorOrVersion(version2) {
-  const parsed = parseSemver(version2);
-  return parsed ? String(parsed.major) : version2;
-}
-function compareSemverStrings(a, b) {
-  const parsedA = parseSemver(a);
-  const parsedB = parseSemver(b);
-  if (!parsedA || !parsedB) return a.localeCompare(b);
-  return compareSemver(parsedA, parsedB);
-}
-function isSupportedVersionRange(range) {
-  const trimmed = range.trim();
-  return trimmed === "*" || parseRange(trimmed) !== void 0;
-}
-function parseRange(range) {
-  if (range === "*") return [];
-  if (range.startsWith("^")) {
-    const base = parseSemver(range.slice(1));
-    if (!base) return void 0;
-    return [
-      { op: ">=", version: base },
-      { op: "<", version: caretUpperBound(base) }
-    ];
-  }
-  if (range.startsWith("~")) {
-    const base = parseSemver(range.slice(1));
-    if (!base) return void 0;
-    return [
-      { op: ">=", version: base },
-      { op: "<", version: { major: base.major, minor: base.minor + 1, patch: 0 } }
-    ];
-  }
-  const parts = range.split(/\s+/).filter(Boolean);
-  const comparators = [];
-  for (const part of parts) {
-    const match = /^(>=|<=|>|<|=)?(.+)$/.exec(part);
-    if (!match) return void 0;
-    const version2 = parseSemver(match[2] ?? "");
-    if (!version2) return void 0;
-    comparators.push({ op: match[1] ?? "=", version: version2 });
-  }
-  return comparators;
-}
-function caretUpperBound(version2) {
-  if (version2.major > 0) return { major: version2.major + 1, minor: 0, patch: 0 };
-  if (version2.minor > 0) return { major: 0, minor: version2.minor + 1, patch: 0 };
-  return { major: 0, minor: 0, patch: version2.patch + 1 };
-}
-function compareWith(version2, comparator) {
-  const order = compareSemver(version2, comparator.version);
-  switch (comparator.op) {
-    case "=":
-      return order === 0;
-    case ">":
-      return order > 0;
-    case ">=":
-      return order >= 0;
-    case "<":
-      return order < 0;
-    case "<=":
-      return order <= 0;
-  }
-}
-function compareSemver(a, b) {
-  for (const key of ["major", "minor", "patch"]) {
-    if (a[key] !== b[key]) return a[key] > b[key] ? 1 : -1;
-  }
-  if (a.prerelease === b.prerelease) return 0;
-  if (!a.prerelease) return 1;
-  if (!b.prerelease) return -1;
-  return a.prerelease.localeCompare(b.prerelease);
-}
-var semverPattern;
-var init_semver = __esm({
-  "src/resolve/semver.ts"() {
-    "use strict";
-    semverPattern = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
-  }
-});
-
 // src/model/selection.ts
 function artifactSelectorKey(artifact) {
   return `${artifact.type}/${artifact.name}`;
@@ -17918,9 +18000,9 @@ var init_selection = __esm({
 });
 
 // src/model/workspace.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname9, join as join12, resolve as resolve13 } from "path";
+import { dirname as dirname9, join as join13, resolve as resolve13 } from "path";
 function packagesForTarget(packages, target, targetForPackage2) {
   return packages.filter((pkg) => !pkg.runtimes || pkg.runtimes.includes((targetForPackage2?.(pkg) ?? target).adapter));
 }
@@ -17928,12 +18010,12 @@ function supportsFleetConfig(config2) {
   return config2.schemaVersion === 3 || config2.schemaVersion === 4;
 }
 function workspaceConfigPath(workspaceRoot) {
-  return join12(workspaceRoot, ".agentwheel", "config.json");
+  return join13(workspaceRoot, ".agentwheel", "config.json");
 }
 async function readWorkspaceConfig(workspaceRoot) {
   const path = workspaceConfigPath(workspaceRoot);
   if (!await pathExists(path)) return emptyWorkspaceConfig();
-  return workspaceConfigSchema.parse(JSON.parse(await readFile10(path, "utf8")));
+  return workspaceConfigSchema.parse(JSON.parse(await readFile11(path, "utf8")));
 }
 async function writeWorkspaceConfig(workspaceRoot, config2) {
   const path = workspaceConfigPath(workspaceRoot);
@@ -17947,7 +18029,7 @@ async function pinConfiguredPackages(workspaceRoot, input, options = {}) {
       throw new Error("Package declarations require unique aliases.");
     }
     const path2 = workspaceConfigPath(workspaceRoot);
-    const config3 = JSON.parse(await readFile10(path2, "utf8"));
+    const config3 = JSON.parse(await readFile11(path2, "utf8"));
     workspaceConfigSchema.parse(config3);
     config3.packages = input;
     workspaceConfigSchema.parse(config3);
@@ -17970,7 +18052,7 @@ async function pinConfiguredPackages(workspaceRoot, input, options = {}) {
     throw new Error("Pin requires unique configured aliases.");
   }
   const path = workspaceConfigPath(workspaceRoot);
-  const config2 = JSON.parse(await readFile10(path, "utf8"));
+  const config2 = JSON.parse(await readFile11(path, "utf8"));
   workspaceConfigSchema.parse(config2);
   const updates = pins.map(({ alias, commit, select }) => {
     const matches = (config2.packages ?? []).filter((pkg2) => pkg2.name === alias);
@@ -18004,7 +18086,7 @@ function upsertPackage(config2, entry) {
   return workspaceConfigSchema.parse({ ...parsed, packages });
 }
 function globalWorkspaceConfigPath(globalRoot = homedir4()) {
-  return join12(globalRoot, ".agentwheel", "config.json");
+  return join13(globalRoot, ".agentwheel", "config.json");
 }
 async function findWorkspaceRoot(start = process.cwd()) {
   let current = resolve13(start);
@@ -18063,7 +18145,7 @@ function isCompositeWorkspaceProfile(profile) {
 }
 async function readConfigPath(path) {
   if (!await pathExists(path)) return emptyWorkspaceConfig();
-  return workspaceConfigSchema.parse(JSON.parse(await readFile10(path, "utf8")));
+  return workspaceConfigSchema.parse(JSON.parse(await readFile11(path, "utf8")));
 }
 function mergeWorkspaceTrust(global, project) {
   return {
@@ -18324,7 +18406,7 @@ var init_workspace = __esm({
 });
 
 // src/model/fleet.ts
-import { lstat as lstat2, readFile as readFile11, realpath } from "fs/promises";
+import { lstat as lstat2, readFile as readFile12, realpath } from "fs/promises";
 import { homedir as homedir5 } from "os";
 import { isAbsolute as isAbsolute10, relative as relative6, resolve as resolve14 } from "path";
 async function resolveWorkspaceScope(request = {}) {
@@ -18441,7 +18523,7 @@ async function readRequiredConfig(root, label) {
   const path = workspaceConfigPath(root);
   if (!await pathExists(path)) throw missingScopeError(label);
   try {
-    return workspaceConfigSchema.parse(JSON.parse(await readFile11(path, "utf8")));
+    return workspaceConfigSchema.parse(JSON.parse(await readFile12(path, "utf8")));
   } catch (error46) {
     throw new Error(`Invalid ${label} Agentwheel config at ${path}: ${error46 instanceof Error ? error46.message : String(error46)}`);
   }
@@ -18512,7 +18594,7 @@ var init_fleet = __esm({
 
 // src/mutation/repository.ts
 import { createHash as createHash8 } from "crypto";
-import { lstat as lstat3, readFile as readFile12, readlink, readdir as readdir5 } from "fs/promises";
+import { lstat as lstat3, readFile as readFile13, readlink, readdir as readdir5 } from "fs/promises";
 import { dirname as dirname10, posix as posix4, relative as relative7, resolve as resolve15, sep as sep5 } from "path";
 async function discoverGitRepository(start) {
   const probe = await runProcess("git", ["-C", start, "rev-parse", "--show-toplevel"], { allowExitCodes: [0, 128] });
@@ -18719,7 +18801,7 @@ async function hashWorkingPath(repositoryRoot, path) {
     throw error46;
   }
   if (stats.isSymbolicLink()) return sha256(Buffer.from(await readlink(absolute), "utf8"));
-  if (stats.isFile()) return sha256(await readFile12(absolute));
+  if (stats.isFile()) return sha256(await readFile13(absolute));
   if (stats.isDirectory()) return hashDirectory(absolute);
   throw new Error(`Unsupported repository path kind: ${path}`);
 }
@@ -18732,7 +18814,7 @@ async function hashDirectory(root) {
       const relativePath = normalizeRepoPath(relative7(root, absolute));
       if (entry.isDirectory()) await walk2(absolute);
       else if (entry.isSymbolicLink()) hash3.update(relativePath).update("\0").update(await readlink(absolute)).update("\0");
-      else if (entry.isFile()) hash3.update(relativePath).update("\0").update(await readFile12(absolute)).update("\0");
+      else if (entry.isFile()) hash3.update(relativePath).update("\0").update(await readFile13(absolute)).update("\0");
     }
   }
   await walk2(root);
@@ -18768,9 +18850,9 @@ var init_repository = __esm({
 
 // src/mutation/providers.ts
 import { createHash as createHash9 } from "crypto";
-import { chmod as chmod2, mkdtemp, open as open3, readFile as readFile13, rename as rename5, rm as rm4, rmdir, stat as stat3, writeFile as writeFile7 } from "fs/promises";
+import { chmod as chmod2, mkdtemp, open as open3, readFile as readFile14, rename as rename5, rm as rm4, rmdir, stat as stat3, writeFile as writeFile7 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { isAbsolute as isAbsolute11, join as join13, resolve as resolve16 } from "path";
+import { isAbsolute as isAbsolute11, join as join14, resolve as resolve16 } from "path";
 function revisionProviderRejection(error46) {
   return error46 instanceof RevisionProviderRejectedError ? error46.response : void 0;
 }
@@ -18879,8 +18961,8 @@ async function openImmutableExecutableSnapshot(bytes) {
       `Command revision providers require an unlinked immutable executable snapshot, which is unsupported on ${process.platform}.`
     );
   }
-  const root = await mkdtemp(join13(tmpdir2(), "agentwheel-revision-command-"));
-  const path = join13(root, "entrypoint");
+  const root = await mkdtemp(join14(tmpdir2(), "agentwheel-revision-command-"));
+  const path = join14(root, "entrypoint");
   let snapshot;
   try {
     await chmod2(root, 448);
@@ -19034,8 +19116,8 @@ async function finalizeGit(providerId, request, config2) {
   const indexLease = await captureIndexLease(request.repositoryRoot);
   await assertIndexTree(request.repositoryRoot, repository.head);
   const hookBaseline = await snapshotRepository(request.repositoryRoot);
-  const tempRoot = await mkdtemp(join13(tmpdir2(), "agentwheel-git-index-"));
-  const indexPath = join13(tempRoot, "index");
+  const tempRoot = await mkdtemp(join14(tmpdir2(), "agentwheel-git-index-"));
+  const indexPath = join14(tempRoot, "index");
   const env2 = { ...process.env, GIT_INDEX_FILE: indexPath };
   let commitSha;
   try {
@@ -19046,14 +19128,14 @@ async function finalizeGit(providerId, request, config2) {
     await verifyTemporaryIndexPaths(request, env2);
     await runProcess("git", ["-C", request.repositoryRoot, "diff", "--cached", "--check"], { env: env2 });
     const tree = (await runProcess("git", ["-C", request.repositoryRoot, "write-tree"], { env: env2 })).stdout.toString("utf8").trim();
-    const messagePath = join13(tempRoot, "COMMIT_EDITMSG");
+    const messagePath = join14(tempRoot, "COMMIT_EDITMSG");
     await writeFile7(messagePath, commitMessage(request, planDigest), { encoding: "utf8", mode: 384 });
     await runCommitHooks(request, env2, messagePath);
     assertRepositorySnapshotEqual(hookBaseline, await snapshotRepository(request.repositoryRoot), "Git commit hooks");
     const stagedAfterHooks = splitNull2((await runProcess("git", ["-C", request.repositoryRoot, "diff", "--cached", "--name-only", "-z"], { env: env2 })).stdout);
     assertExactSet(stagedAfterHooks, request.paths.map((entry) => entry.path), "temporary Git index after hooks");
     await verifyTemporaryIndexPaths(request, env2);
-    const message = await readFile13(messagePath, "utf8");
+    const message = await readFile14(messagePath, "utf8");
     assertCommitMessageContract(message, request, planDigest);
     commitSha = (await runProcess("git", ["-C", request.repositoryRoot, "commit-tree", tree, "-p", repository.head], {
       env: env2,
@@ -19172,7 +19254,7 @@ async function captureIndexLease(repositoryRoot) {
   const rawPath = (await runProcess("git", ["-C", repositoryRoot, "rev-parse", "--git-path", "index"])).stdout.toString("utf8").trim();
   const path = isAbsolute11(rawPath) ? rawPath : resolve16(repositoryRoot, rawPath);
   try {
-    const [content, info] = await Promise.all([readFile13(path), stat3(path)]);
+    const [content, info] = await Promise.all([readFile14(path), stat3(path)]);
     return { path, sha256: sha2562(content), mode: info.mode & 511 };
   } catch (error46) {
     if (isMissing4(error46)) return { path, sha256: null, mode: 384 };
@@ -19180,15 +19262,15 @@ async function captureIndexLease(repositoryRoot) {
   }
 }
 async function replaceIndexCas(repositoryRoot, lease, commitSha) {
-  const tempRoot = await mkdtemp(join13(tmpdir2(), "agentwheel-index-replacement-"));
-  const replacementPath = join13(tempRoot, "index");
+  const tempRoot = await mkdtemp(join14(tmpdir2(), "agentwheel-index-replacement-"));
+  const replacementPath = join14(tempRoot, "index");
   const lockPath = `${lease.path}.lock`;
   let handle;
   try {
     await runProcess("git", ["-C", repositoryRoot, "read-tree", commitSha], {
       env: { ...process.env, GIT_INDEX_FILE: replacementPath }
     });
-    const replacement = await readFile13(replacementPath);
+    const replacement = await readFile14(replacementPath);
     handle = await open3(lockPath, "wx", lease.mode);
     const current = await readOptionalFile(lease.path);
     const currentSha256 = current ? sha2562(current) : null;
@@ -19230,7 +19312,7 @@ async function hashGitObject(repositoryRoot, spec) {
 }
 async function readOptionalFile(path) {
   try {
-    return await readFile13(path);
+    return await readFile14(path);
   } catch (error46) {
     if (isMissing4(error46)) return null;
     throw error46;
@@ -19995,8 +20077,8 @@ var init_coordinator = __esm({
 
 // src/transport/ownership-snapshot.ts
 import { createHash as createHash10 } from "crypto";
-import { lstat as lstat4, readdir as readdir6, readFile as readFile14 } from "fs/promises";
-import { dirname as dirname12, join as join14, relative as relative9, resolve as resolve18 } from "path";
+import { lstat as lstat4, readdir as readdir6, readFile as readFile15 } from "fs/promises";
+import { dirname as dirname12, join as join15, relative as relative9, resolve as resolve18 } from "path";
 async function assertSnapshotAncestors(path) {
   let current = resolve18(path);
   while (true) {
@@ -20016,9 +20098,9 @@ async function ownershipRuntimeSnapshot(path) {
     }
     hash3.update(JSON.stringify([relative9(path, candidate), info.isDirectory() ? "dir" : "file", info.mode & 4095]));
     if (info.isDirectory()) {
-      for (const name of (await readdir6(candidate)).sort()) await visit2(join14(candidate, name));
+      for (const name of (await readdir6(candidate)).sort()) await visit2(join15(candidate, name));
     } else {
-      const content = await readFile14(candidate);
+      const content = await readFile15(candidate);
       hash3.update(String(content.length)).update("\0").update(content);
     }
   }
@@ -20067,7 +20149,7 @@ __export(transaction_exports, {
 });
 import { createHash as createHash11 } from "crypto";
 import { cp as cp2, lstat as lstat5, mkdir as mkdir7, open as open4, rm as rm5, stat as stat4 } from "fs/promises";
-import { dirname as dirname13, join as join15, relative as relative10, resolve as resolve19, sep as sep7 } from "path";
+import { dirname as dirname13, join as join16, relative as relative10, resolve as resolve19, sep as sep7 } from "path";
 async function assertNoSymlinkPath2(path) {
   const absolute = resolve19(path);
   let current = absolute;
@@ -20130,7 +20212,7 @@ function metadataAuditPath(audit, path) {
   if (resolve19(audit.workspaceRoot) !== audit.workspaceRoot || path !== `.agentwheel/${audit.kind === "ownership-handoff" ? "ownership-handoffs" : "ownership-releases"}/${audit.operationId}.json`) {
     throw new Error("Invalid ownership release audit path.");
   }
-  return join15(audit.workspaceRoot, ...path.split("/"));
+  return join16(audit.workspaceRoot, ...path.split("/"));
 }
 function metadataRuntimePath(root, path) {
   const result = resolve19(root, path);
@@ -20157,19 +20239,19 @@ async function syncMetadataPath(path, directoryOnly = false) {
 }
 function applyLockPath(targetRoot, adapter, scope = {}) {
   const installationType = scope.installationType ?? "local";
-  return join15(metadataDir(targetRoot), `${stateKeyFor(adapter, { installationType })}.runtime-apply-lock`);
+  return join16(metadataDir(targetRoot), `${stateKeyFor(adapter, { installationType })}.runtime-apply-lock`);
 }
 function applyJournalPath(targetRoot, adapter, scope = {}) {
-  return join15(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.apply-journal.json`);
+  return join16(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.apply-journal.json`);
 }
 function applyBackupDir(targetRoot, adapter, scope = {}) {
-  return join15(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.apply-backups`);
+  return join16(metadataDir(targetRoot), `${stateKeyFor(adapter, scope)}.apply-backups`);
 }
 async function acquireApplyLock(targetRoot, adapter, transport = localTransport, options = {}, scope = {}) {
   assertGovernedRuntimeTransportSupported(transport);
   if (transport.kind === "local-run-as") await transport.prepareApply();
   const lockPath = applyLockPath(targetRoot, adapter, scope);
-  const ownerPath = join15(lockPath, "owner.json");
+  const ownerPath = join16(lockPath, "owner.json");
   const metadata = {
     pid: process.pid,
     adapter,
@@ -20238,7 +20320,7 @@ async function listApplyJournals(targetRoot, adapter, transport = localTransport
   const found = [];
   for (const fileName of await transport.listDir(metadataDir(targetRoot))) {
     if (!fileName.endsWith(suffix)) continue;
-    const path = join15(metadataDir(targetRoot), fileName);
+    const path = join16(metadataDir(targetRoot), fileName);
     const journal = parseApplyJournal(JSON.parse(await transport.readFile(path)));
     if (journal.adapter !== adapter || (journal.installationType ?? "local") !== installationType) continue;
     found.push({ path, journal });
@@ -20250,7 +20332,7 @@ async function listAllApplyJournals(targetRoot, adapter, transport = localTransp
   const found = [];
   for (const fileName of await transport.listDir(metadataDir(targetRoot))) {
     if (!fileName.endsWith(suffix)) continue;
-    const path = join15(metadataDir(targetRoot), fileName);
+    const path = join16(metadataDir(targetRoot), fileName);
     const journal = parseApplyJournal(JSON.parse(await transport.readFile(path)));
     if (adapter === void 0 || journal.adapter === adapter) found.push({ path, journal });
   }
@@ -20308,7 +20390,7 @@ async function abortApplyJournal(targetRoot, adapter, transport = localTransport
     const journalPath = applyJournalPath(targetRoot, adapter, scope);
     if (!await transport.pathExists(journalPath)) return void 0;
     const stateKey = stateKeyFor(adapter, scope);
-    const archivePath = join15(metadataDir(targetRoot), "archive", `${stateKey}.apply-journal.failed-${journalTimestamp(/* @__PURE__ */ new Date())}.json`);
+    const archivePath = join16(metadataDir(targetRoot), "archive", `${stateKey}.apply-journal.failed-${journalTimestamp(/* @__PURE__ */ new Date())}.json`);
     const content = await transport.readFile(journalPath);
     const journal = parseApplyJournal(JSON.parse(content));
     if (journal.metadataAudit || journal.metadataGuards) {
@@ -20441,7 +20523,7 @@ async function recordBackup(operation, index, targetRoot, adapter, transport = l
       hadExisting
     };
   }
-  const backupPath = join15(applyBackupDir(targetRoot, adapter, scope), String(index));
+  const backupPath = join16(applyBackupDir(targetRoot, adapter, scope), String(index));
   if (transport.kind === "local-run-as") {
     assertGovernedRuntimeTransportSupported(transport);
     await transport.rm(backupPath);
@@ -20520,7 +20602,7 @@ function assertApplyJournalCompletedOperations(journal) {
     if (!operation || !["create", "update", "remove"].includes(operation.action) || item.destPath !== operation.destPath || item.kind !== operation.kind || typeof item.hadExisting !== "boolean" || item.completed !== void 0 && typeof item.completed !== "boolean") {
       throw new Error("Apply journal completion does not match its immutable operation.");
     }
-    const expectedBackup = join15(applyBackupDir(journal.targetRoot, journal.adapter, {
+    const expectedBackup = join16(applyBackupDir(journal.targetRoot, journal.adapter, {
       installationType: journal.installationType,
       stateKey: journal.stateKey
     }), String(item.index));
@@ -20546,15 +20628,24 @@ var init_transaction = __esm({
 });
 
 // src/install/toml-merge.ts
-import { mkdir as mkdir8, readFile as readFile16, writeFile as writeFile8 } from "fs/promises";
-import { parse as parseToml } from "smol-toml";
+import { mkdir as mkdir8, readFile as readFile17, writeFile as writeFile8 } from "fs/promises";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { dirname as dirname14 } from "path";
 async function mergeCodexTomlMcp(sourcePath, destPath) {
-  const source = JSON.parse(await readFile16(sourcePath, "utf8"));
+  const source = JSON.parse(await readFile17(sourcePath, "utf8"));
   const servers = extractMcpServers(source);
-  const current = await pathExists(destPath) ? await readFile16(destPath, "utf8") : "";
-  const withoutManaged = removeManagedMcpSections(current, Object.keys(servers));
-  const merged = appendMcpServers(withoutManaged, servers);
+  const current = await pathExists(destPath) ? await readFile17(destPath, "utf8") : "";
+  const parsed = parseToml(current, { integersAsBigInt: "asNeeded" });
+  const currentServers = isPlainRecord(parsed.mcp_servers) ? parsed.mcp_servers : {};
+  const blocks = [];
+  for (const [name, server] of Object.entries(servers).sort(([a], [b]) => a.localeCompare(b))) {
+    const rendered = parseToml(formatMcpServer(name, server), { integersAsBigInt: "asNeeded" });
+    const declared = rendered.mcp_servers[name];
+    const mergedServer = mergeManagedFields(currentServers[name], declared);
+    blocks.push(managedValueMatches(declared, mergedServer) ? formatMcpServer(name, server) : stringifyToml({ mcp_servers: { [name]: mergedServer } }).trimEnd());
+  }
+  const merged = appendMcpServers(removeManagedMcpSections(current, Object.keys(servers)), blocks);
+  parseToml(merged, { integersAsBigInt: "asNeeded" });
   await mkdir8(dirname14(destPath), { recursive: true });
   await writeFile8(destPath, merged, "utf8");
 }
@@ -20597,7 +20688,7 @@ function isPlainRecord(value) {
 }
 function extractMcpServers(source) {
   const raw = isRecord2(source.mcpServers) ? source.mcpServers : source;
-  const servers = {};
+  const servers = /* @__PURE__ */ Object.create(null);
   for (const [name, value] of Object.entries(raw)) {
     if (!isRecord2(value)) continue;
     servers[name] = value;
@@ -20608,23 +20699,39 @@ function extractMcpServers(source) {
   return servers;
 }
 function removeManagedMcpSections(content, serverNames) {
-  if (serverNames.length === 0 || content.trim() === "") return content;
   const names = new Set(serverNames);
-  const lines = content.split(/\r?\n/);
   const kept = [];
   let skipping = false;
-  for (const line of lines) {
-    const section = line.match(/^\s*\[([^\]]+)]\s*$/)?.[1];
-    if (section) {
-      const match = section.match(/^mcp_servers\.([^.\]]+)(?:\.|$)/);
-      skipping = match ? names.has(unquoteTomlKey(match[1] ?? "")) : false;
+  let offset = 0;
+  for (const line of content.split(/(?<=\n)/)) {
+    if (line.trimStart().startsWith("[")) {
+      try {
+        parseToml(content.slice(0, offset), { integersAsBigInt: "asNeeded" });
+        const header = parseToml(line, { integersAsBigInt: "asNeeded" });
+        const servers = isPlainRecord(header.mcp_servers) ? header.mcp_servers : {};
+        skipping = Object.keys(servers).some((name) => names.has(name));
+      } catch {
+      }
     }
     if (!skipping) kept.push(line);
+    offset += line.length;
   }
-  return kept.join("\n").replace(/\n{3,}$/g, "\n\n");
+  return kept.join("");
+}
+function mergeManagedFields(current, declared) {
+  if (!isPlainRecord(declared)) return declared;
+  const merged = isPlainRecord(current) ? { ...current } : {};
+  for (const [key, value] of Object.entries(declared)) {
+    Object.defineProperty(merged, key, {
+      value: mergeManagedFields(Object.hasOwn(merged, key) ? merged[key] : void 0, value),
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  }
+  return merged;
 }
-function appendMcpServers(content, servers) {
-  const blocks = Object.entries(servers).sort(([a], [b]) => a.localeCompare(b)).map(([name, server]) => formatMcpServer(name, server));
+function appendMcpServers(content, blocks) {
   const prefix = content.trimEnd();
   return `${prefix ? `${prefix}
 
@@ -20704,12 +20811,12 @@ var init_toml_merge = __esm({
 });
 
 // src/install/yaml-merge.ts
-import { mkdir as mkdir9, readFile as readFile17, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir9, readFile as readFile18, writeFile as writeFile9 } from "fs/promises";
 import { dirname as dirname15 } from "path";
 import { parse as parse7, stringify } from "yaml";
 async function mergeYamlFile(sourcePath, destPath) {
-  const source = parseYamlValue(await readFile17(sourcePath, "utf8"));
-  const current = await pathExists(destPath) ? parseYamlValue(await readFile17(destPath, "utf8")) : {};
+  const source = parseYamlValue(await readFile18(sourcePath, "utf8"));
+  const current = await pathExists(destPath) ? parseYamlValue(await readFile18(destPath, "utf8")) : {};
   const merged = deepMerge2(current, source);
   await mkdir9(dirname15(destPath), { recursive: true });
   await writeFile9(destPath, stringify(merged), "utf8");
@@ -20769,7 +20876,7 @@ var init_yaml_merge = __esm({
 });
 
 // src/install/merge-removal.ts
-import { mkdir as mkdir10, readFile as readFile18, writeFile as writeFile10 } from "fs/promises";
+import { mkdir as mkdir10, readFile as readFile19, writeFile as writeFile10 } from "fs/promises";
 import { dirname as dirname16 } from "path";
 import { parse as parse8, stringify as stringify2 } from "yaml";
 function assertExactMergeContribution(contribution, strategy, currentContent) {
@@ -20847,7 +20954,7 @@ async function mergeRemovalForInstall(sourcePath, strategy, currentContent, opti
   return introducedMergeContent(parseMergeDestination(currentContent, strategy), source);
 }
 async function removeMergeContribution(destPath, strategy, removal) {
-  const content = await readFile18(destPath, "utf8");
+  const content = await readFile19(destPath, "utf8");
   if (strategy === "codex-toml-mcp") {
     const servers = isRecord4(removal.mcpServers) ? removal.mcpServers : removal;
     await writeFile10(destPath, removeCodexTomlMcpSections(content, Object.keys(servers)), "utf8");
@@ -20871,7 +20978,7 @@ async function readMergeSource(sourcePath, strategy) {
   if (strategy === "openclaw-json-deep") {
     return requireRecord(await renderOpenClawJsonMergeSource(sourcePath), "OpenClaw JSON merge source");
   }
-  const content = await readFile18(sourcePath, "utf8");
+  const content = await readFile19(sourcePath, "utf8");
   if (strategy === "yaml-deep") return requireRecord(normalizeYamlValue2(parse8(content)), "YAML merge source");
   return requireRecord(JSON.parse(content), "JSON merge source");
 }
@@ -21123,9 +21230,9 @@ var init_desired = __esm({
 
 // src/install/instructions-block.ts
 import { createHash as createHash12 } from "crypto";
-import { mkdtemp as mkdtemp2, readFile as readFile19, realpath as realpath2, rm as rm6, writeFile as writeFile11 } from "fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile20, realpath as realpath2, rm as rm6, writeFile as writeFile11 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename2, dirname as dirname17, join as join16, relative as relative11 } from "path";
+import { basename as basename2, dirname as dirname17, join as join17, relative as relative11 } from "path";
 function exactManagedInstructionBlockSnapshot(content, selector) {
   const beginCount = [...content.matchAll(new RegExp(`<!-- BEGIN openpack:include ${escapeRegex2(selector)}(?=\\s|-->)`, "gu"))].length;
   const endCount = [...content.matchAll(new RegExp(`<!-- END openpack:include ${escapeRegex2(selector)}(?=\\s|-->)`, "gu"))].length;
@@ -21176,7 +21283,7 @@ function exactManagedInstructionBlockSnapshot(content, selector) {
   };
 }
 async function desiredManagedInstructionBlockHash(sourcePath) {
-  const source = await readFile19(sourcePath, "utf8");
+  const source = await readFile20(sourcePath, "utf8");
   return hashText(managedBlockBody(source));
 }
 async function readManagedInstructionBlockState(destPath, selector, transport) {
@@ -21196,7 +21303,7 @@ async function readManagedInstructionBlockState(destPath, selector, transport) {
   };
 }
 async function writeManagedInstructionBlock(sourcePath, destPath, selector, transport, options = {}) {
-  const source = await readFile19(sourcePath, "utf8");
+  const source = await readFile20(sourcePath, "utf8");
   const desired = renderManagedInstructionBlock(selector, source);
   const existing = await readOptionalText(destPath, transport);
   const merged = upsertManagedInstructionBlock(existing ?? "", selector, desired.block, options);
@@ -21317,7 +21424,7 @@ function referencesAgentsMd(content, claudePath, agentsPath) {
     if (!referenced) continue;
     const cleaned = referenced.trim().replace(/^["']|["']$/g, "");
     if (!/AGENTS\.md$/i.test(cleaned)) continue;
-    const candidate = cleaned.startsWith("/") ? cleaned : join16(claudeDir, cleaned);
+    const candidate = cleaned.startsWith("/") ? cleaned : join17(claudeDir, cleaned);
     if (relative11(dirname17(agentsPath), candidate).replaceAll("\\", "/") === "AGENTS.md") return true;
     if (candidate === agentsPath) return true;
   }
@@ -21337,8 +21444,8 @@ async function writeTextWithTransport(path, content, transport) {
     await transport.writeFileAtomic(path, content);
     return;
   }
-  const tempRoot = await mkdtemp2(join16(tmpdir3(), "agentwheel-instructions-"));
-  const localPath = join16(tempRoot, basename2(path) || "instructions.md");
+  const tempRoot = await mkdtemp2(join17(tmpdir3(), "agentwheel-instructions-"));
+  const localPath = join17(tempRoot, basename2(path) || "instructions.md");
   try {
     await writeFile11(localPath, content, "utf8");
     await transport.atomicCopy(localPath, path, "file");
@@ -21376,9 +21483,9 @@ __export(apply_exports, {
 });
 import { execFile as execFile5 } from "child_process";
 import { createHash as createHash13, randomUUID as randomUUID3 } from "crypto";
-import { chmod as chmod3, link as link2, lstat as lstat6, mkdir as mkdir11, mkdtemp as mkdtemp3, open as open5, readFile as readFile20, rm as rm7, writeFile as writeFile12 } from "fs/promises";
+import { chmod as chmod3, link as link2, lstat as lstat6, mkdir as mkdir11, mkdtemp as mkdtemp3, open as open5, readFile as readFile21, rm as rm7, writeFile as writeFile12 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename3, dirname as dirname18, join as join17, resolve as resolve20 } from "path";
+import { basename as basename3, dirname as dirname18, join as join18, resolve as resolve20 } from "path";
 import { promisify as promisify5 } from "util";
 async function applyInstallPlan(plan, sourceLock, options = {}) {
   return applyPlanTransactionally(plan, { ...options, sourceLock });
@@ -21478,6 +21585,10 @@ async function assertRuntimeStateRevision(plan, transport) {
 async function applyPlanTransactionally(plan, options = {}) {
   const transport = options.transport ?? localTransport;
   const scope = { installationType: plan.installationType, stateKey: plan.stateKey };
+  const openClawAcceptCapabilities = createOpenClawCapabilityDetector(async (args) => {
+    if (transport.kind === "local") return (await execFileAsync4("openclaw", args, { timeout: 1e4 })).stdout;
+    return transport.execFile?.("openclaw", args, { cwd: plan.targetRoot });
+  });
   if (plan.hasBlockingChanges) {
     const blockers = plan.operations.filter((operation) => operation.action === "drift" || operation.action === "conflict");
     throw new Error(`Refusing to apply with blocking changes: ${blockers.map((item) => item.relativeDestPath).join(", ")}`);
@@ -21538,6 +21649,7 @@ async function applyPlanTransactionally(plan, options = {}) {
         transport,
         now,
         executePlugins: options.executePlugins,
+        openClawAcceptCapabilities,
         graphLockDigest,
         plan
       });
@@ -21773,7 +21885,7 @@ async function assertCommittedJournalState(journal, expectedManifest, transport)
     }
   }
   if (journal.workspaceConfigPath && journal.workspaceConfig) {
-    const actual = JSON.parse(await readFile20(journal.workspaceConfigPath, "utf8"));
+    const actual = JSON.parse(await readFile21(journal.workspaceConfigPath, "utf8"));
     if (canonicalJson5(actual) !== canonicalJson5(journal.workspaceConfig)) {
       throw new Error(`Workspace config postcheck failed for ${journal.workspaceConfigPath}.`);
     }
@@ -21795,7 +21907,7 @@ async function assertMetadataAuditGuards(journal, after, transport, requireAfter
       throw new Error("Metadata-audit content digest is invalid.");
     }
     try {
-      if (await readFile20(path, "utf8") !== file2.content) throw new Error(`Metadata-audit file changed: ${path}`);
+      if (await readFile21(path, "utf8") !== file2.content) throw new Error(`Metadata-audit file changed: ${path}`);
     } catch (error46) {
       if (error46.code !== "ENOENT" || requireAfter) throw error46;
     }
@@ -21878,7 +21990,7 @@ async function writeAuditFileExclusive(path, content, validateCallerPath) {
     try {
       await link2(temporary, path);
     } catch (error46) {
-      if (error46.code !== "EEXIST" || await readFile20(path, "utf8") !== content) throw error46;
+      if (error46.code !== "EEXIST" || await readFile21(path, "utf8") !== content) throw error46;
     }
     const directory = await open5(dirname18(path), "r");
     try {
@@ -21903,7 +22015,7 @@ async function applyOperation(operation, context) {
       throw new Error(`Invalid plugin operation missing hash: ${operation.relativeDestPath}`);
     }
     if (context.executePlugins) {
-      await executePluginInstall(operation, transport);
+      await executePluginInstall(operation, transport, context.openClawAcceptCapabilities);
     }
     return manifestEntryForOperation(operation, {
       now,
@@ -22063,8 +22175,15 @@ async function applyOperation(operation, context) {
   }
   return void 0;
 }
-async function executePluginInstall(operation, transport) {
-  const commands = semanticInstallCommands(operation);
+async function executePluginInstall(operation, transport, openClawAcceptCapabilities) {
+  const commands = await Promise.all(semanticInstallCommands(operation).map(async (command) => {
+    if (command.length !== 5 || command.slice(0, 4).join(" ") !== "openclaw plugins install --force") return command;
+    return openClawPluginInstallCommand({
+      path: command[4],
+      dryRun: false,
+      acceptCapabilities: await openClawAcceptCapabilities?.() ?? false
+    });
+  }));
   if (commands.length === 0) throw new Error(`Invalid plugin operation missing command: ${operation.relativeDestPath}`);
   if (!operation.sourcePath) {
     throw new Error(`Invalid plugin operation missing source path: ${operation.relativeDestPath}`);
@@ -22112,10 +22231,10 @@ async function prepareSemanticPluginState(operation, transport) {
 async function prepareClaudeMarketplace(operation, transport) {
   const spec = requireSemanticPluginState(operation);
   const marketplaceName = requireMarketplaceName(operation);
-  const marketplaceRoot = join17(spec.stateRoot, "marketplace");
+  const marketplaceRoot = join18(spec.stateRoot, "marketplace");
   await transport.rm(spec.stateRoot);
-  await transport.atomicCopy(requireSourcePath(operation), join17(marketplaceRoot, "plugins", spec.pluginName), operation.kind);
-  await transport.writeJsonAtomic(join17(marketplaceRoot, ".claude-plugin", "marketplace.json"), {
+  await transport.atomicCopy(requireSourcePath(operation), join18(marketplaceRoot, "plugins", spec.pluginName), operation.kind);
+  await transport.writeJsonAtomic(join18(marketplaceRoot, ".claude-plugin", "marketplace.json"), {
     name: marketplaceName,
     owner: { name: "Agentwheel" },
     plugins: [
@@ -22130,10 +22249,10 @@ async function prepareClaudeMarketplace(operation, transport) {
 async function prepareCodexMarketplace(operation, transport) {
   const spec = requireSemanticPluginState(operation);
   const marketplaceName = requireMarketplaceName(operation);
-  const marketplaceRoot = join17(spec.stateRoot, "marketplace");
+  const marketplaceRoot = join18(spec.stateRoot, "marketplace");
   await transport.rm(spec.stateRoot);
-  await transport.atomicCopy(requireSourcePath(operation), join17(marketplaceRoot, "plugins", spec.pluginName), operation.kind);
-  await transport.writeJsonAtomic(join17(marketplaceRoot, ".agents", "plugins", "marketplace.json"), {
+  await transport.atomicCopy(requireSourcePath(operation), join18(marketplaceRoot, "plugins", spec.pluginName), operation.kind);
+  await transport.writeJsonAtomic(join18(marketplaceRoot, ".agents", "plugins", "marketplace.json"), {
     name: marketplaceName,
     interface: {
       displayName: "Agentwheel"
@@ -22157,11 +22276,11 @@ async function prepareCodexMarketplace(operation, transport) {
 async function prepareCopilotPlugin(operation, transport) {
   const spec = requireSemanticPluginState(operation);
   await transport.rm(spec.stateRoot);
-  await transport.atomicCopy(requireSourcePath(operation), join17(spec.stateRoot, "plugin"), operation.kind);
+  await transport.atomicCopy(requireSourcePath(operation), join18(spec.stateRoot, "plugin"), operation.kind);
 }
 async function prepareHermesGitShim(operation, transport) {
   const spec = requireSemanticPluginState(operation);
-  const repoRoot = join17(spec.stateRoot, "repo");
+  const repoRoot = join18(spec.stateRoot, "repo");
   await transport.rm(spec.stateRoot);
   await transport.atomicCopy(requireSourcePath(operation), repoRoot, operation.kind);
   if (!transport.execFile) {
@@ -22216,8 +22335,8 @@ async function executeSemanticCommands(operation, commands, transport, options =
   if (!operation.sourcePath) {
     throw new Error(`Invalid semantic plugin operation missing source path: ${operation.relativeDestPath}`);
   }
-  const stagingRoot = join17(operation.destPath, ".agentwheel", "plugin-staging", `${process.pid}-${Date.now()}`);
-  const remoteSourcePath = join17(stagingRoot, basename3(operation.sourcePath));
+  const stagingRoot = join18(operation.destPath, ".agentwheel", "plugin-staging", `${process.pid}-${Date.now()}`);
+  const remoteSourcePath = join18(stagingRoot, basename3(operation.sourcePath));
   try {
     await transport.atomicCopy(operation.sourcePath, remoteSourcePath, operation.kind);
     for (const [command, ...args] of commands) {
@@ -22484,8 +22603,8 @@ async function mergeWithTransport(sourcePath, destPath, transport, merge2) {
     await merge2(sourcePath, destPath);
     return;
   }
-  const tempRoot = await mkdtemp3(join17(tmpdir4(), "agentwheel-merge-"));
-  const localDest = join17(tempRoot, basename3(destPath) || "merged");
+  const tempRoot = await mkdtemp3(join18(tmpdir4(), "agentwheel-merge-"));
+  const localDest = join18(tempRoot, basename3(destPath) || "merged");
   try {
     if (await transport.pathExists(destPath)) {
       await writeFile12(localDest, await transport.readFile(destPath), "utf8");
@@ -22501,8 +22620,8 @@ async function removeMergeWithTransport(destPath, strategy, removal, transport)
     await removeMergeContribution(destPath, strategy, removal);
     return;
   }
-  const tempRoot = await mkdtemp3(join17(tmpdir4(), "agentwheel-merge-remove-"));
-  const localDest = join17(tempRoot, basename3(destPath) || "merged");
+  const tempRoot = await mkdtemp3(join18(tmpdir4(), "agentwheel-merge-remove-"));
+  const localDest = join18(tempRoot, basename3(destPath) || "merged");
   try {
     await writeFile12(localDest, await transport.readFile(destPath), "utf8");
     await removeMergeContribution(localDest, strategy, removal);
@@ -22512,8 +22631,8 @@ async function removeMergeWithTransport(destPath, strategy, removal, transport)
   }
 }
 async function mergeOpenClawJsonWithTransport(sourcePath, destPath, transport) {
-  const tempRoot = await mkdtemp3(join17(tmpdir4(), "agentwheel-openclaw-merge-"));
-  const localDest = join17(tempRoot, basename3(destPath) || "openclaw.json");
+  const tempRoot = await mkdtemp3(join18(tmpdir4(), "agentwheel-openclaw-merge-"));
+  const localDest = join18(tempRoot, basename3(destPath) || "openclaw.json");
   const validationPath = transport.kind === "local" ? localDest : `${destPath}.validate-agentwheel-${process.pid}-${Date.now()}`;
   try {
     if (await transport.pathExists(destPath)) {
@@ -22540,7 +22659,7 @@ async function validateOpenClawConfig(configPath, destPath, transport) {
     throw new Error(`Cannot validate OpenClaw config over ${transport.description}: transport does not support command execution.`);
   }
   const openClawHome = dirname18(destPath);
-  const bundledBin = join17(openClawHome, "npm", "node_modules", ".bin", "openclaw");
+  const bundledBin = join18(openClawHome, "npm", "node_modules", ".bin", "openclaw");
   const script = String.raw`
 set -euo pipefail
 cfg=$1
@@ -22568,6 +22687,7 @@ var init_apply = __esm({
     init_declarations();
     init_graph_lock();
     init_transport();
+    init_openclaw2();
     init_run_as_policy();
     init_json_merge();
     init_openclaw_json_merge();
@@ -22718,8 +22838,8 @@ import { basename as basename8, join as join28, relative as relative12 } from "p
 
 // src/staging/codex-subagents.ts
 init_fs();
-import { mkdir as mkdir12, readFile as readFile21, writeFile as writeFile13 } from "fs/promises";
-import { basename as basename4, dirname as dirname19, join as join18 } from "path";
+import { mkdir as mkdir12, readFile as readFile22, writeFile as writeFile13 } from "fs/promises";
+import { basename as basename4, dirname as dirname19, join as join19 } from "path";
 import { parse as parseYaml } from "yaml";
 var requiredCodexAgentFields = ["name", "description", "developer_instructions"];
 async function renderCodexSubagents(artifacts, stageRoot, adapter) {
@@ -22743,27 +22863,27 @@ async function renderCodexSubagents(artifacts, stageRoot, adapter) {
 async function renderCodexSubagent(artifact, stageRoot) {
   const sourcePath = artifact.stagedPath ?? artifact.sourcePath;
   const agentName = codexAgentName(artifact);
-  const renderedPath = join18(stageRoot, ".agentwheel-rendered", "codex-subagents", `${agentName}.toml`);
+  const renderedPath = join19(stageRoot, ".agentwheel-rendered", "codex-subagents", `${agentName}.toml`);
   const lowerSourcePath = sourcePath.toLowerCase();
   if (artifact.kind === "file" && (artifact.name.toLowerCase().endsWith(".toml") || lowerSourcePath.endsWith(".toml"))) {
-    const content = await readFile21(sourcePath, "utf8");
+    const content = await readFile22(sourcePath, "utf8");
     validateCodexAgentToml(content, sourcePath);
     return {
       ...artifact,
       name: agentName,
-      relativePath: join18("subagents", `${agentName}.toml`),
+      relativePath: join19("subagents", `${agentName}.toml`),
       kind: "file",
       hash: await hashPath(sourcePath)
     };
   }
-  const markdownPath = artifact.kind === "dir" ? join18(sourcePath, "AGENTS.md") : sourcePath;
+  const markdownPath = artifact.kind === "dir" ? join19(sourcePath, "AGENTS.md") : sourcePath;
   if (artifact.kind === "dir" && !await pathExists(markdownPath)) {
     throw new Error(`Codex subagent directory ${artifact.relativePath} must contain AGENTS.md.`);
   }
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !lowerSourcePath.endsWith(".md")) {
     throw new Error(`Codex subagent ${artifact.relativePath} must be a .toml file, .md file, or directory containing AGENTS.md.`);
   }
-  const markdown = await readFile21(markdownPath, "utf8");
+  const markdown = await readFile22(markdownPath, "utf8");
   const toml = markdownToCodexAgentToml(agentName, markdown);
   await mkdir12(dirname19(renderedPath), { recursive: true });
   await writeFile13(renderedPath, toml, "utf8");
@@ -22772,7 +22892,7 @@ async function renderCodexSubagent(artifact, stageRoot) {
     name: agentName,
     sourcePath: renderedPath,
     stagedPath: renderedPath,
-    relativePath: join18("subagents", `${agentName}.toml`),
+    relativePath: join19("subagents", `${agentName}.toml`),
     kind: "file",
     hash: await hashPath(renderedPath)
   };
@@ -22847,8 +22967,8 @@ function escapeRegExp2(value) {
 
 // src/staging/copilot-artifacts.ts
 init_fs();
-import { mkdir as mkdir13, readFile as readFile22, writeFile as writeFile14 } from "fs/promises";
-import { basename as basename5, dirname as dirname20, join as join19 } from "path";
+import { mkdir as mkdir13, readFile as readFile23, writeFile as writeFile14 } from "fs/promises";
+import { basename as basename5, dirname as dirname20, join as join20 } from "path";
 async function renderCopilotArtifacts(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "copilot") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -22870,15 +22990,15 @@ async function renderCopilotArtifacts(artifacts, stageRoot, adapter) {
 async function renderCopilotSubagent(artifact, stageRoot) {
   const sourcePath = artifact.stagedPath ?? artifact.sourcePath;
   const agentName = copilotAgentName(artifact);
-  const renderedPath = join19(stageRoot, ".agentwheel-rendered", "copilot-subagents", `${agentName}.agent.md`);
-  const markdownPath = artifact.kind === "dir" ? join19(sourcePath, "AGENTS.md") : sourcePath;
+  const renderedPath = join20(stageRoot, ".agentwheel-rendered", "copilot-subagents", `${agentName}.agent.md`);
+  const markdownPath = artifact.kind === "dir" ? join20(sourcePath, "AGENTS.md") : sourcePath;
   if (artifact.kind === "dir" && !await pathExists(markdownPath)) {
     throw new Error(`Copilot subagent directory ${artifact.relativePath} must contain AGENTS.md.`);
   }
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md")) {
     throw new Error(`Copilot subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const markdown = await readFile22(markdownPath, "utf8");
+  const markdown = await readFile23(markdownPath, "utf8");
   await mkdir13(dirname20(renderedPath), { recursive: true });
   await writeFile14(renderedPath, ensureCopilotAgentDescription(agentName, markdown), "utf8");
   return {
@@ -22886,7 +23006,7 @@ async function renderCopilotSubagent(artifact, stageRoot) {
     name: `${agentName}.agent.md`,
     sourcePath: renderedPath,
     stagedPath: renderedPath,
-    relativePath: join19("subagents", `${agentName}.agent.md`),
+    relativePath: join20("subagents", `${agentName}.agent.md`),
     kind: "file",
     hash: await hashPath(renderedPath)
   };
@@ -22934,8 +23054,8 @@ function yamlString(value) {
 
 // src/staging/openclaw-subagents.ts
 init_fs();
-import { mkdir as mkdir14, readFile as readFile23, writeFile as writeFile15 } from "fs/promises";
-import { basename as basename6, dirname as dirname21, join as join20 } from "path";
+import { mkdir as mkdir14, readFile as readFile24, writeFile as writeFile15 } from "fs/promises";
+import { basename as basename6, dirname as dirname21, join as join21 } from "path";
 async function renderOpenClawSubagents(artifacts, stageRoot, adapter) {
   if (adapter?.name !== "openclaw") return artifacts;
   const names = /* @__PURE__ */ new Set();
@@ -22957,18 +23077,18 @@ async function renderOpenClawSubagents(artifacts, stageRoot, adapter) {
 async function renderOpenClawSubagent(artifact, stageRoot) {
   const sourcePath = artifact.stagedPath ?? artifact.sourcePath;
   const agentId = openClawAgentId(artifact);
-  const markdownPath = artifact.kind === "dir" ? join20(sourcePath, "AGENTS.md") : sourcePath;
+  const markdownPath = artifact.kind === "dir" ? join21(sourcePath, "AGENTS.md") : sourcePath;
   if (artifact.kind === "dir" && !await pathExists(markdownPath)) {
     throw new Error(`OpenClaw subagent directory ${artifact.relativePath} must contain AGENTS.md.`);
   }
   if (artifact.kind === "file" && !artifact.name.toLowerCase().endsWith(".md") && !sourcePath.toLowerCase().endsWith(".md")) {
     throw new Error(`OpenClaw subagent ${artifact.relativePath} must be a .md file or directory containing AGENTS.md.`);
   }
-  const parsed = splitFrontmatter3(await readFile23(markdownPath, "utf8"));
+  const parsed = splitFrontmatter3(await readFile24(markdownPath, "utf8"));
   const body = parsed.body.trim().length > 0 ? parsed.body.trim() : `# ${titleFromAgentId(agentId)}
 
 ${parsed.description ?? `OpenClaw subagent ${agentId}.`}`;
-  const renderedPath = join20(stageRoot, ".agentwheel-rendered", "openclaw-subagents", agentId, "AGENTS.md");
+  const renderedPath = join21(stageRoot, ".agentwheel-rendered", "openclaw-subagents", agentId, "AGENTS.md");
   await mkdir14(dirname21(renderedPath), { recursive: true });
   await writeFile15(renderedPath, `${body}
 `, "utf8");
@@ -22978,7 +23098,7 @@ ${parsed.description ?? `OpenClaw subagent ${agentId}.`}`;
     name: agentId,
     sourcePath: renderedDir,
     stagedPath: renderedDir,
-    relativePath: join20("subagents", agentId),
+    relativePath: join21("subagents", agentId),
     kind: "dir",
     hash: await hashPath(renderedDir)
   };
@@ -23003,15 +23123,15 @@ function titleFromAgentId(agentId) {
 }
 
 // src/targets/plugins/claude.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 
 // src/targets/plugins/common.ts
 init_fs();
-import { readFile as readFile24 } from "fs/promises";
-import { join as join21 } from "path";
+import { readFile as readFile25 } from "fs/promises";
+import { join as join22 } from "path";
 import { parseDocument } from "yaml";
 function pluginStateRoot(request) {
-  return join21(
+  return join22(
     request.targetRoot,
     ".agentwheel",
     "plugins",
@@ -23029,16 +23149,16 @@ function safeNameSegment(value) {
   return normalized.length > 0 ? normalized : "unnamed";
 }
 async function jsonPluginName(root, relativeManifestPath, fallback) {
-  const manifestPath = join21(root, relativeManifestPath);
+  const manifestPath = join22(root, relativeManifestPath);
   if (!await pathExists(manifestPath)) return fallback;
-  const parsed = JSON.parse(await readFile24(manifestPath, "utf8"));
+  const parsed = JSON.parse(await readFile25(manifestPath, "utf8"));
   return typeof parsed.name === "string" && parsed.name.trim().length > 0 ? parsed.name.trim() : fallback;
 }
 async function yamlPluginName(root, relativeManifestPaths, fallback) {
   for (const relativeManifestPath of relativeManifestPaths) {
-    const manifestPath = join21(root, relativeManifestPath);
+    const manifestPath = join22(root, relativeManifestPath);
     if (!await pathExists(manifestPath)) continue;
-    const document = parseDocument(await readFile24(manifestPath, "utf8"));
+    const document = parseDocument(await readFile25(manifestPath, "utf8"));
     const parsed = document.toJSON();
     if (!isRecord5(parsed)) continue;
     for (const key of ["name", "module", "package"]) {
@@ -23067,7 +23187,7 @@ async function claudePluginSpec(request) {
     packageName: request.artifact.packageName,
     installName: request.installName
   });
-  const marketplaceRoot = join22(stateRoot, "marketplace");
+  const marketplaceRoot = join23(stateRoot, "marketplace");
   const scope = claudeScope(request.installationType);
   const selector = `${pluginName}@${marketplaceName}`;
   return {
@@ -23092,7 +23212,7 @@ function claudeScope(installationType) {
 }
 
 // src/targets/plugins/codex.ts
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 async function codexPluginSpec(request) {
   const pluginName = await jsonPluginName(request.sourcePath, ".codex-plugin/plugin.json", request.installName);
   const marketplaceName = agentwheelMarketplaceName(request.artifact.packageName, pluginName);
@@ -23103,7 +23223,7 @@ async function codexPluginSpec(request) {
     packageName: request.artifact.packageName,
     installName: request.installName
   });
-  const marketplaceRoot = join23(stateRoot, "marketplace");
+  const marketplaceRoot = join24(stateRoot, "marketplace");
   const selector = `${pluginName}@${marketplaceName}`;
   return {
     runtime: "codex",
@@ -23122,7 +23242,7 @@ async function codexPluginSpec(request) {
 }
 
 // src/targets/plugins/copilot.ts
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 async function copilotPluginSpec(request) {
   if (request.installationType !== "user") {
     throw new Error("Copilot plugins are persistent user-level installs only; pass --installation-type user.");
@@ -23135,7 +23255,7 @@ async function copilotPluginSpec(request) {
     packageName: request.artifact.packageName,
     installName: request.installName
   });
-  const pluginRoot = join24(stateRoot, "plugin");
+  const pluginRoot = join25(stateRoot, "plugin");
   return {
     runtime: "copilot",
     pluginName,
@@ -23146,7 +23266,7 @@ async function copilotPluginSpec(request) {
 }
 
 // src/targets/plugins/hermes.ts
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 async function hermesPluginSpec(request) {
   if (request.installationType !== "user") {
     throw new Error("Hermes plugins are user-level installs only; pass --installation-type user.");
@@ -23159,7 +23279,7 @@ async function hermesPluginSpec(request) {
     packageName: request.artifact.packageName,
     installName: request.installName
   });
-  const repoRoot = join25(stateRoot, "repo");
+  const repoRoot = join26(stateRoot, "repo");
   return {
     runtime: "hermes",
     pluginName,
@@ -23169,64 +23289,8 @@ async function hermesPluginSpec(request) {
   };
 }
 
-// src/targets/plugins/openclaw.ts
-init_fs();
-import { readFile as readFile25 } from "fs/promises";
-import { join as join26 } from "path";
-function openClawPluginInstallCommand(request) {
-  return ["openclaw", "plugins", "install", "--force", request.path];
-}
-function openClawPluginUninstallCommand(pluginName) {
-  return ["openclaw", "plugins", "uninstall", pluginName, "--force"];
-}
-async function openClawPluginSpec(request) {
-  if (request.format === "openclaw-clawhub-plugin") {
-    const metadata = await openClawClawHubPluginMetadata(request.path, request.fallbackPluginName);
-    return {
-      runtime: "openclaw",
-      pluginName: metadata.pluginName,
-      installCommands: [openClawPluginInstallCommand({ path: metadata.installSpec, dryRun: true })],
-      uninstallCommands: [openClawPluginUninstallCommand(metadata.pluginName)]
-    };
-  }
-  const pluginName = await openClawPluginName(request.path, request.fallbackPluginName);
-  return {
-    runtime: "openclaw",
-    pluginName,
-    installCommands: [openClawPluginInstallCommand({ path: request.path, dryRun: true })],
-    uninstallCommands: [openClawPluginUninstallCommand(pluginName)]
-  };
-}
-async function openClawPluginName(root, fallback) {
-  for (const manifestName of ["plugin.json", "openclaw.plugin.json"]) {
-    const manifestPath = join26(root, manifestName);
-    if (!await pathExists(manifestPath)) continue;
-    const parsed = JSON.parse(await readFile25(manifestPath, "utf8"));
-    if (typeof parsed.name === "string" && parsed.name.trim().length > 0) return parsed.name.trim();
-  }
-  return fallback;
-}
-async function openClawClawHubPluginMetadata(root, fallback) {
-  const metadataPath = join26(root, "clawhub.json");
-  if (!await pathExists(metadataPath)) {
-    throw new Error("OpenClaw ClawHub plugins must contain clawhub.json");
-  }
-  const parsed = JSON.parse(await readFile25(metadataPath, "utf8"));
-  const installSpec = stringField(parsed.installSpec);
-  if (!installSpec?.startsWith("clawhub:")) {
-    throw new Error("OpenClaw ClawHub plugin metadata must declare installSpec starting with clawhub:");
-  }
-  const pluginName = stringField(parsed.runtimeId) ?? installNameFor(stringField(parsed.name) ?? fallback);
-  return { installSpec, pluginName };
-}
-function stringField(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
-function installNameFor(value) {
-  return value.split("/").at(-1).replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "") || "clawhub-plugin";
-}
-
 // src/targets/plugins/index.ts
+init_openclaw2();
 async function semanticPluginSpecForArtifact(request) {
   if (request.semantic === "openclaw-plugin") {
     return openClawPluginSpec({
@@ -28570,6 +28634,7 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
     if (!satisfiesVersionRange(fetched.version, requirement.version)) {
       throw new Error(`Package ${fetched.name}@${fetched.version} does not satisfy requested version ${requirement.version}`);
     }
+    const requestedRef = frozen ? frozen.node.requestedRef : fetched.resolved.requestedRef;
     const nodeKey = `${normalized.normalizedSource}\0${fetched.name}`;
     let selectionImport = requirement.selection ? await resolveSelectionImport(fetched.resolved.resolvedPath, fetched.resolved.driver, requirement.selection) : void 0;
     const selected = computeSelectedSelectors(
@@ -28596,7 +28661,7 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
           source: fetched.resolved.source,
           normalizedSource: normalized.normalizedSource,
           driver: fetched.resolved.driver,
-          requestedRef: fetched.resolved.requestedRef,
+          requestedRef,
           resolvedCommit: fetched.resolved.resolvedCommit,
           cacheIdentity: fetched.resolved.cacheIdentity,
           sourceHash: fetched.sourceHash,
@@ -28654,7 +28719,7 @@ Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
         alias: requirement.alias,
         source: requirement.source,
         normalizedSource: normalized.normalizedSource,
-        requestedRef: fetched.resolved.requestedRef,
+        requestedRef,
         version: requirement.version,
         mode: requirement.mode,
         optional: requirement.optional,