agentwheel 0.9.0 → 0.10.0

package/README.md

@@ -7,7 +7,7 @@
 <p align="center"><strong>One source. Every agent.</strong></p>
 
 <p align="center">
-  Weave your skills, rules, and instructions across every AI agent you use,
+  Weave skills, rules, instructions, commands, subagents, MCP, hooks, settings, and plugins across every AI agent you use,
   from any source, reconciled into each runtime with your private tweaks intact.
 </p>
 
@@ -15,8 +15,9 @@
 
 ## Why agentwheel?
 
-Your AI agents are multiplying. Claude here, Codex there, custom runtimes elsewhere, and each one
-wants skills, rules, instructions, commands, MCP, hooks, and settings in its own native shape.
+Your AI agents are multiplying. OpenClaw, Claude Code, Codex CLI, Copilot, Hermes — and the next
+harness your team adopts. Each one wants its own skills, rules, instructions, commands, subagents,
+MCP servers, hooks, and settings, in its own layout.
 
 **agentwheel makes that one declared state.** Add packages to `.agentwheel/config.json`, preview the
 runtime changes, then install the declared state into each target. Updates move tracking sources
@@ -37,6 +38,20 @@ live in your workspace, and runtimes stay generated output.
 > `add`, `install`, `update`, and `uninstall`. A hidden `sync` shim remains for one release only
 > so old bootstrapped skills can self-update; use `install` in all new docs and scripts.
 
+## Supported runtimes & resources
+
+agentwheel installs OpenPack resources into five built-in runtimes and into custom harnesses:
+
+- **OpenClaw** — `.openclaw/`
+- **Claude Code** — `.claude/`
+- **Codex CLI** — `.codex/`
+- **GitHub Copilot** — `.github/`
+- **Hermes** — `.hermes/`
+- **Bring your own** — JSONC config adapters with `--adapter-config`, or programmatic adapters with `--adapter-module`
+
+Supported resource types include instructions, rules, skills, commands, subagents, MCP, hooks,
+settings, plugins, and fragments; see the full per-runtime target table below.
+
 ## Core Commands
 
 | Command | Meaning |
@@ -133,6 +148,7 @@ For a control-plane setup, define named agents in config. Global config lives at
 agentwheel install --agent lab-openclaw
 agentwheel install --all
 agentwheel install --profile daily
+agentwheel install --all-detected
 ```
 
 SSH targets use the same manifest and drift model as local targets. Planning reads the remote
@@ -146,7 +162,9 @@ agentwheel init --fleet-example
 ```
 
 Target resolution order is exact: `--target-root` wins, then `--agent`, then auto-detect from the
-current directory, then fallback to the current directory.
+current directory, then fallback to the current directory. `--all-detected` is an explicit escape hatch
+for applying to every runtime marker found in the current directory or `--target-root`; `--all` remains
+reserved for configured agents.
 
 ## Core Ideas
 
@@ -290,15 +308,21 @@ published:
 agentwheel install ./my-pack --adapter-config ./myco-internal.jsonc
 ```
 
+For adapter behavior that needs code, load a programmatic adapter module:
+
+```bash
+agentwheel install ./my-pack --adapter-module ./myco-adapter.js
+```
+
 Built-in runtime targets:
 
 | Runtime | Main targets |
 |---|---|
-| **OpenClaw** | `.openclaw/AGENTS.md`, `.openclaw/skills`, `.openclaw/rules`, `.openclaw/commands`, MCP/hooks/settings, semantic plugin planning |
+| **OpenClaw** | `.openclaw/AGENTS.md`, `.openclaw/skills`, `.openclaw/rules`, `.openclaw/commands`, `.openclaw/agents`, MCP/hooks/settings, semantic plugin planning |
 | **Claude Code** | `.claude/CLAUDE.md`, `.claude/skills`, `.claude/commands`, `.claude/agents`, `.claude/rules`, `.claude/.mcp.json`, `.claude/settings.json` |
 | **Codex CLI** | `.codex/AGENTS.md`, `.codex/skills`, `.codex/commands`, `.codex/agents`, `.codex/rules`, `.codex/config.toml`, `.codex/hooks.json` |
-| **Hermes** | `.hermes/AGENTS.md`, `.hermes/skills`, `.hermes/rules`, `.hermes/commands`, MCP/hooks/settings |
-| **GitHub Copilot** | `.github/copilot-instructions.md`, `.github/instructions`, `.github/prompts` |
+| **Hermes** | `.hermes/AGENTS.md`, `.hermes/skills`, `.hermes/rules`, `.hermes/commands`, `.hermes/agents`, MCP/hooks/settings |
+| **GitHub Copilot** | `.github/copilot-instructions.md`, `.github/instructions`, `.github/prompts`, `.github/skills`, `.github/agents`, `.vscode/mcp.json` |
 
 ## Docs
 

package/dist/index.js

@@ -9,7 +9,7 @@ import {
 
 // src/cli/index.ts
 import { mkdir as mkdir14, rm as rm9, writeFile as writeFile12 } from "fs/promises";
-import { dirname as dirname21, join as join28, resolve as resolve17 } from "path";
+import { dirname as dirname21, join as join28, resolve as resolve18 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command } from "commander";
 
@@ -131,9 +131,9 @@ var copilotAdapter = {
     instructions: { enabled: true, dest: ".github/copilot-instructions.md" },
     rules: { enabled: true, dest: ".github/instructions" },
     commands: { enabled: true, dest: ".github/prompts" },
-    // GitHub Copilot has no native SKILL.md runtime surface; keep skills disabled
-    // until a conversion target is introduced.
-    skills: { enabled: false, dest: ".github/skills" }
+    skills: { enabled: true, dest: ".github/skills" },
+    subagents: { enabled: true, dest: ".github/agents" },
+    mcp: { enabled: true, dest: ".vscode/mcp.json", merge: "json-deep" }
   }
 };
 
@@ -162,6 +162,7 @@ var hermesAdapter = {
     rules: { enabled: true, dest: ".hermes/rules" },
     skills: { enabled: true, dest: ".hermes/skills" },
     commands: { enabled: true, dest: ".hermes/commands" },
+    subagents: { enabled: true, dest: ".hermes/agents" },
     mcp: { enabled: true, dest: ".hermes/mcp", merge: "json-deep" },
     hooks: { enabled: true, dest: ".hermes/hooks", merge: "json-deep" },
     settings: { enabled: true, dest: ".hermes/settings.json", merge: "json-deep" }
@@ -177,6 +178,7 @@ var openClawAdapter = {
     rules: { enabled: true, dest: ".openclaw/rules" },
     skills: { enabled: true, dest: ".openclaw/skills" },
     commands: { enabled: true, dest: ".openclaw/commands" },
+    subagents: { enabled: true, dest: ".openclaw/agents" },
     mcp: { enabled: true, dest: ".openclaw/mcp", merge: "json-deep" },
     hooks: { enabled: true, dest: ".openclaw/hooks", merge: "json-deep" },
     settings: { enabled: true, dest: ".openclaw/settings.json", merge: "json-deep" },
@@ -542,13 +544,13 @@ async function spawnWithInput(command, args, input) {
   if (result.stderr) throw new Error(result.stderr);
 }
 function waitForProcess(child, label) {
-  return new Promise((resolve18, reject) => {
+  return new Promise((resolve19, reject) => {
     const stderr = [];
     child.stderr?.on("data", (chunk) => stderr.push(chunk));
     child.on("error", reject);
     child.on("close", (code) => {
       const message = Buffer.concat(stderr).toString("utf8");
-      if (code === 0) resolve18({ stderr: "" });
+      if (code === 0) resolve19({ stderr: "" });
       else reject(new Error(`${label} exited ${code}${message ? `: ${message}` : ""}`));
     });
   });
@@ -654,6 +656,7 @@ import { resolve as resolve3 } from "path";
 // src/model/manifest.ts
 import { z as z4 } from "zod";
 var dependencyRoleSchema = z4.enum(["root", "direct", "transitive", "fragment"]);
+var legacyUnownedWorkspaceOwner = "legacy:unowned";
 var manifestEntryV1Schema = z4.object({
   path: z4.string().min(1),
   artifactType: artifactTypeSchema,
@@ -676,6 +679,7 @@ var manifestEntrySchema = manifestEntryV1Schema.extend({
   dependencyRole: dependencyRoleSchema.default("root"),
   owners: z4.array(z4.string().min(1)).min(1),
   refCount: z4.number().int().positive(),
+  workspaceOwner: z4.string().min(1).default(legacyUnownedWorkspaceOwner),
   graphLockDigest: z4.string().min(1).optional()
 }).transform((entry) => {
   const owners = [...new Set(entry.owners)].sort();
@@ -1388,6 +1392,7 @@ function manifestEntryForOperation(operation, values) {
     dependencyRole: operation.dependencyRole ?? "root",
     owners,
     refCount: owners.length,
+    workspaceOwner: operation.workspaceOwner ?? "workspace:unknown",
     kind: operation.kind,
     hash: values.hash,
     sourceHash: values.sourceHash,
@@ -1476,6 +1481,10 @@ async function createCombinedInstallPlan(desiredArtifacts, adapter, targetRoot,
   return createPlanFromOperations(desired, adapter, targetRoot, manifest, transport, options);
 }
 async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifest, transport, options) {
+  const workspaceOwner = options.workspaceOwner;
+  if (workspaceOwner) {
+    for (const op of desiredOps) op.workspaceOwner = workspaceOwner;
+  }
   for (const op of desiredOps) assertOperationContained(op, targetRoot);
   const migration = await migrateManifestForPlan(manifest, desiredOps, targetRoot, transport);
   const effectiveEntries = migration.entries;
@@ -1518,6 +1527,12 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
       continue;
     }
     const existing = manifestByPath.get(op.relativeDestPath);
+    if (existing && workspaceOwner && !entryOwnedByWorkspace(existing, workspaceOwner)) {
+      if (!await canAdoptLegacyUnownedEntry(existing, op, transport)) {
+        operations.push(keepForeignManifestEntryOperation(existing, targetRoot, workspaceOwner, op));
+        continue;
+      }
+    }
     const exists = await transport.pathExists(op.destPath);
     if (!exists) {
       operations.push({ ...op, action: "create", reason: "destination missing" });
@@ -1559,6 +1574,10 @@ async function createPlanFromOperations(desiredOps, adapter, targetRoot, manifes
     const destPath = join5(targetRoot, entry.path);
     if (!await transport.pathExists(destPath)) continue;
     const currentHash = await transport.hashPath(destPath);
+    if (workspaceOwner && !entryOwnedByWorkspace(entry, workspaceOwner)) {
+      operations.push(keepForeignManifestEntryOperation(entry, targetRoot, workspaceOwner, void 0, currentHash));
+      continue;
+    }
     if (currentHash !== entry.hash) {
       operations.push({
         action: "drift",
@@ -1714,6 +1733,16 @@ function operationMatchesManifestEntry(op, entry) {
   if ("graphNodeId" in entry && entry.graphNodeId && op.graphNodeId && entry.graphNodeId === op.graphNodeId) return true;
   return op.packageName !== void 0 && entry.packageName === op.packageName;
 }
+function entryOwnedByWorkspace(entry, workspaceOwner) {
+  return "workspaceOwner" in entry && entry.workspaceOwner === workspaceOwner;
+}
+async function canAdoptLegacyUnownedEntry(entry, op, transport) {
+  if (!("workspaceOwner" in entry) || entry.workspaceOwner !== legacyUnownedWorkspaceOwner) return false;
+  if (entry.artifactType !== op.artifactType || entry.kind !== op.kind) return false;
+  if (!op.desiredHash || entry.sourceHash !== op.desiredHash) return false;
+  if (!await transport.pathExists(op.destPath)) return false;
+  return await transport.hashPath(op.destPath) === entry.hash;
+}
 function collisionOperation(op, group, incumbent) {
   const owners = group.map(describeOperationOwner).sort();
   const incumbentText = incumbent ? `; incumbent ${describeOperationOwner(incumbent)} keeps the plain name` : "";
@@ -1737,6 +1766,7 @@ function adoptLegacyEntry(entry, op) {
     dependencyRole: op.dependencyRole ?? "root",
     owners,
     refCount: owners.length,
+    workspaceOwner: op.workspaceOwner ?? legacyUnownedWorkspaceOwner,
     graphLockDigest: op.graphLockDigest,
     composedFrom: op.composedFrom ?? entry.composedFrom
   };
@@ -1759,6 +1789,7 @@ function operationMetadataFromEntry(entry) {
       graphNodeId: entry.graphNodeId,
       dependencyRole: entry.dependencyRole,
       owners: entry.owners,
+      workspaceOwner: entry.workspaceOwner,
       graphLockDigest: entry.graphLockDigest
     };
   }
@@ -1766,7 +1797,31 @@ function operationMetadataFromEntry(entry) {
     installName: entry.artifactName,
     logicalSelector: `${entry.artifactType}/${entry.artifactName}`,
     dependencyRole: "root",
-    owners: [entry.packageName ?? "legacy"]
+    owners: [entry.packageName ?? "legacy"],
+    workspaceOwner: legacyUnownedWorkspaceOwner
+  };
+}
+function keepForeignManifestEntryOperation(entry, targetRoot, workspaceOwner, operation, currentHash) {
+  const owner = "workspaceOwner" in entry ? entry.workspaceOwner : legacyUnownedWorkspaceOwner;
+  return {
+    action: "keep",
+    artifactType: entry.artifactType,
+    artifactName: entry.artifactName,
+    kind: entry.kind,
+    destPath: operation?.destPath ?? join5(targetRoot, entry.path),
+    relativeDestPath: entry.path,
+    desiredHash: entry.sourceHash,
+    currentHash: currentHash ?? operation?.currentHash ?? entry.hash,
+    manifestHash: entry.hash,
+    reason: `foreign artifact owned by ${owner}; kept outside workspace ${workspaceOwner}`,
+    channel: entry.channel,
+    packageName: entry.packageName,
+    semanticCommand: entry.semanticCommand,
+    execute: entry.executed,
+    mergeStrategy: entry.mergeStrategy,
+    composedFrom: entry.composedFrom,
+    preserveInManifest: true,
+    ...operationMetadataFromEntry(entry)
   };
 }
 function normalizeOperationOwners(op) {
@@ -2714,7 +2769,7 @@ async function withFilesystemLock(lockPath, timeoutMs, fn) {
       if (Date.now() - started > timeoutMs) {
         throw new Error(`Timed out waiting for git cache lock at ${lockPath}`);
       }
-      await new Promise((resolve18) => setTimeout(resolve18, 50));
+      await new Promise((resolve19) => setTimeout(resolve19, 50));
     }
   }
   try {
@@ -4318,13 +4373,33 @@ function createGraphLock(graph, artifacts = [], targetFingerprint, includeEdges
 async function processRequirement(requirement, options, fetchCache, nodesByKey, rootResults, edgeMap) {
   try {
     const lockLabel = options.offline ? "Offline" : options.frozenLock ? "Frozen lock" : "Locked install";
-    const lockedByReference = lockedNodeForRequirementReference(requirement, options, lockLabel);
-    const normalized = lockedByReference ? normalizedSourceFromLockedNode(lockedByReference.node) : await normalizeDependencySource(requirement.source, {
+    let lockedByReference = lockedNodeForRequirementReference(requirement, options, lockLabel);
+    let normalized = lockedByReference ? normalizedSourceFromLockedNode(lockedByReference.node) : await normalizeDependencySource(requirement.source, {
       declaringPackageRoot: requirement.declaringPackageRoot,
       workspaceRoot: options.workspaceRoot,
       ref: requirement.ref,
       registryClient: options.registryClient
     });
+    if (lockedByReference && shouldCheckLockedRootSource(requirement)) {
+      const declared = await normalizeDependencySource(requirement.source, {
+        declaringPackageRoot: requirement.declaringPackageRoot,
+        workspaceRoot: options.workspaceRoot,
+        ref: requirement.ref,
+        registryClient: options.registryClient
+      });
+      if (lockedRootSourceDrifted(declared, lockedByReference.node)) {
+        if (options.frozenLock || options.offline) {
+          throw new Error(
+            `${lockLabel} root '${requirement.rootId}' source differs from declared source:
+- declared: ${declared.normalizedSource}
+- locked: ${lockedByReference.node.normalizedSource}
+Run without ${lockLabel === "Offline" ? "--offline" : "--frozen-lock"} first.`
+          );
+        }
+        lockedByReference = void 0;
+        normalized = declared;
+      }
+    }
     const frozen = lockedByReference ?? lockedNodeForRequirement(normalized.normalizedSource, requirement, options, lockLabel);
     let fetched;
     try {
@@ -4747,6 +4822,18 @@ function lockedNodeForRequirementReference(requirement, options, label) {
     requestedRef: node.driver === "git" ? node.resolvedCommit ?? node.requestedRef : node.requestedRef
   };
 }
+function shouldCheckLockedRootSource(requirement) {
+  if (!requirement.useLock) return false;
+  if (requirement.depth !== 0 || !requirement.rootId) return false;
+  return isExplicitNonRegistrySource(requirement.source);
+}
+function isExplicitNonRegistrySource(source) {
+  const trimmed = source.trim();
+  return trimmed === "~" || trimmed.startsWith("~/") || trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("/") || trimmed.startsWith("local:") || trimmed.startsWith("github:") || trimmed.startsWith("git:") || trimmed.startsWith("skillkit:") || trimmed.startsWith("vercel:");
+}
+function lockedRootSourceDrifted(declared, locked) {
+  return declared.normalizedSource !== locked.normalizedSource || declared.requestedRef !== locked.requestedRef;
+}
 function normalizedSourceFromLockedNode(node) {
   return {
     source: node.source,
@@ -4765,8 +4852,8 @@ function verifyIntegrity(integrity, sourceHash, label) {
 async function withCachePathLock(path, fn) {
   const previous = cacheLocks.get(path) ?? Promise.resolve();
   let release = () => void 0;
-  const current = previous.then(() => new Promise((resolve18) => {
-    release = resolve18;
+  const current = previous.then(() => new Promise((resolve19) => {
+    release = resolve19;
   }));
   cacheLocks.set(path, current);
   await previous;
@@ -4974,7 +5061,7 @@ import { rm as rm8 } from "fs/promises";
 // src/lifecycle/source-plan.ts
 import { createHash as createHash6 } from "crypto";
 import { mkdir as mkdir12 } from "fs/promises";
-import { dirname as dirname17, join as join22 } from "path";
+import { dirname as dirname17, join as join22, resolve as resolve14 } from "path";
 
 // src/resolve/graph-diff.ts
 function diffGraphLocks(previous, next) {
@@ -5512,7 +5599,8 @@ async function createGraphSourcePlan(options) {
   const manifest = await readInstallManifest(options.targetRoot, options.adapter.name, transport);
   const plan = await createCombinedInstallPlan(desiredArtifacts, options.adapter, options.targetRoot, manifest, transport, {
     baseRevision: manifest?.revision ?? null,
-    graphLockDigest
+    graphLockDigest,
+    workspaceOwner: workspaceOwnerId(workspaceRoot)
   });
   return {
     plan,
@@ -5570,6 +5658,9 @@ function sanitizePathSegment(value) {
 function digestGraphLock(lock) {
   return createHash6("sha256").update(canonicalGraphLockJson(lock)).digest("hex");
 }
+function workspaceOwnerId(workspaceRoot) {
+  return `workspace-root:${resolve14(workspaceRoot)}`;
+}
 function assertFrozenGraph(previousLock, graph, frozen, label) {
   if (!frozen) return;
   if (!previousLock) {
@@ -5743,7 +5834,7 @@ async function packageFromSource(source, options) {
 }
 
 // src/runtime/target.ts
-import { basename as basename12, dirname as dirname18, join as join23, resolve as resolve14 } from "path";
+import { basename as basename12, dirname as dirname18, join as join23, resolve as resolve15 } from "path";
 var runtimeMarkers = [
   { adapter: "openclaw", dirs: [".openclaw", ".clawdbot", ".moltbot"] },
   { adapter: "claude", dirs: [".claude"] },
@@ -5752,9 +5843,9 @@ var runtimeMarkers = [
   { adapter: "copilot", dirs: [".github"] }
 ];
 async function resolveRuntimeTarget(request = {}) {
-  const cwd = resolve14(request.cwd ?? process.cwd());
+  const cwd = resolve15(request.cwd ?? process.cwd());
   if (request.targetRoot) {
-    const targetRoot = resolve14(request.targetRoot);
+    const targetRoot = resolve15(request.targetRoot);
     return {
       adapter: request.adapter ?? "openclaw",
       targetRoot,
@@ -5783,7 +5874,7 @@ async function resolveRuntimeTarget(request = {}) {
 async function resolveAllRuntimeTargets(request = {}) {
   if (request.targetRoot) return [await resolveRuntimeTarget(request)];
   if (request.agent) return [await resolveRuntimeTarget(request)];
-  const cwd = resolve14(request.cwd ?? process.cwd());
+  const cwd = resolve15(request.cwd ?? process.cwd());
   const workspaceRoot = await findWorkspaceRoot(cwd);
   const config = await readMergedWorkspaceConfig(workspaceRoot, { globalRoot: request.globalRoot });
   const targets = Object.entries(config.agents).map(([name]) => targetFromAgent(name, config, workspaceRoot));
@@ -5792,8 +5883,29 @@ async function resolveAllRuntimeTargets(request = {}) {
   }
   return targets;
 }
+async function resolveAllDetectedRuntimeTargets(request = {}) {
+  if (request.agent) return [await resolveRuntimeTarget(request)];
+  const scanRoot = runtimeScanRoot(request);
+  const matches = await detectRuntimeTargets(scanRoot, request.adapter);
+  if (matches.length === 0) {
+    throw new Error(`No runtime directories detected at ${scanRoot}. Pass --target-root or --agent.`);
+  }
+  return Promise.all(matches.map(async (match) => ({
+    ...match,
+    workspaceRoot: await findWorkspaceRoot(match.targetRoot),
+    transport: "local",
+    source: "auto-detect"
+  })));
+}
 async function detectRuntimeTarget(cwd = process.cwd(), adapterFilter) {
-  const root = resolve14(cwd);
+  const unique = await detectRuntimeTargets(cwd, adapterFilter);
+  if (unique.length > 1) {
+    throw new Error(`Multiple runtime directories detected: ${unique.map((item) => `${item.adapter} at ${item.targetRoot}`).join(", ")}. Pass --adapter, --agent, or --all-detected.`);
+  }
+  return unique[0];
+}
+async function detectRuntimeTargets(cwd = process.cwd(), adapterFilter) {
+  const root = resolve15(cwd);
   const matches = [];
   for (const marker of runtimeMarkers) {
     if (adapterFilter && marker.adapter !== adapterFilter) continue;
@@ -5805,11 +5917,7 @@ async function detectRuntimeTarget(cwd = process.cwd(), adapterFilter) {
       }
     }
   }
-  const unique = dedupeTargets(matches);
-  if (unique.length > 1) {
-    throw new Error(`Multiple runtime directories detected: ${unique.map((item) => `${item.adapter} at ${item.targetRoot}`).join(", ")}. Pass --adapter or --agent.`);
-  }
-  return unique[0];
+  return dedupeTargets(matches);
 }
 function targetFromAgent(name, config, workspaceRoot) {
   const agent = config.agents[name];
@@ -5838,6 +5946,11 @@ function dedupeTargets(matches) {
   }
   return [...byKey.values()];
 }
+function runtimeScanRoot(request) {
+  const root = resolve15(request.targetRoot ?? request.cwd ?? process.cwd());
+  if (request.targetRoot) return root;
+  return runtimeMarkers.some((marker) => marker.dirs.includes(basename12(root))) ? dirname18(root) : root;
+}
 
 // src/cli/update-check.ts
 import { mkdir as mkdir13, readFile as readFile16, writeFile as writeFile10 } from "fs/promises";
@@ -5919,9 +6032,9 @@ function normalizeVersion(version) {
 
 // src/model/package-validate.ts
 import { stat as stat11 } from "fs/promises";
-import { resolve as resolve15 } from "path";
+import { resolve as resolve16 } from "path";
 async function validatePackage(root) {
-  const packageRoot = resolve15(root);
+  const packageRoot = resolve16(root);
   const findings = [];
   const manifestPath = await findPackageManifestPath(packageRoot);
   if (!manifestPath) {
@@ -5989,7 +6102,7 @@ async function validateManifestComposeInclude(packageRoot, selector, optional, f
   try {
     validateSelector(selector, "compose.include", findings, manifestPath, { fragmentsOnly: true, aliases });
     if (isCrossPackageSelector(selector)) return;
-    const full = resolve15(packageRoot, selector);
+    const full = resolve16(packageRoot, selector);
     if (full !== packageRoot && !full.startsWith(`${packageRoot}/`)) {
       findings.push({ level: "error", message: `Compose include escapes package root: ${selector}`, path: manifestPath });
       return;
@@ -6043,10 +6156,10 @@ function isCrossPackageSelector(value) {
 
 // src/model/package-migrate.ts
 import { readFile as readFile17, rename as rename4, writeFile as writeFile11 } from "fs/promises";
-import { join as join26, resolve as resolve16 } from "path";
+import { join as join26, resolve as resolve17 } from "path";
 import { applyEdits, modify, parse as parse3 } from "jsonc-parser";
 async function migratePackageManifest(root) {
-  const packageRoot = resolve16(root);
+  const packageRoot = resolve17(root);
   for (const name of openPackManifestNames) {
     const path = join26(packageRoot, name);
     if (await pathExists(path)) {
@@ -6165,13 +6278,13 @@ program.command("scan").description("scan a package source for validation findin
   }
   if (!result.ok) process.exitCode = 1;
 });
-program.command("plan").description("preview what install would reconcile without writing").argument("[name-or-source]", "configured package name/source or package source to preview").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--dry-run", "accepted for symmetry; plan never writes", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
+program.command("plan").description("preview what install would reconcile without writing").argument("[name-or-source]", "configured package name/source or package source to preview").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--dry-run", "accepted for symmetry; plan never writes", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
   await runInstallCommand(source, { ...options, dryRun: true }, { apply: false });
 });
-program.command("install").description("install configured packages into runtime targets").argument("[name-or-source]", "configured package name/source or package source to add and install").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).addHelpText("after", "\nScoped install never removes files owned only by other configured packages; run a full install to reconcile those removals.\n").action(async (source, options) => {
+program.command("install").description("install configured packages into runtime targets").argument("[name-or-source]", "configured package name/source or package source to add and install").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).addHelpText("after", "\nScoped install never removes files owned only by other configured packages; run a full install to reconcile those removals.\n").action(async (source, options) => {
   await runInstallCommand(source, options, { apply: !options.dryRun });
 });
-program.command("sync", { hidden: true }).argument("[name-or-source]", "configured package name/source or package source").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
+program.command("sync", { hidden: true }).argument("[name-or-source]", "configured package name/source or package source").option("--driver <driver>", "source driver").option("--adapter <adapter>", "built-in adapter").option("--adapter-config <path>", "adapter JSON/JSONC file").option("--adapter-module <path>", "local programmatic adapter module").option("--allow-adapter-code", "allow loading local adapter code", false).option("--target-root <path>", "runtime/project root").option("--agent <name>", "named agent from merged config").option("--all", "run for every configured agent", false).option("--all-detected", "run for every runtime directory detected in the target root", false).option("--mode <mode>", "pinned or tracking").option("--select <type/name>", "select an artifact by type/name (repeatable or comma-separated)", collectSelectOption, []).option("--skill <name>", "select a skill by name (repeatable or comma-separated)", collectSkillOption, []).option("--profile <name>", "workspace runtime profile").option("--dry-run", "show plan without writing", false).option("--execute-plugins", "execute semantic plugin installs", false).option("--no-deps", "resolve only root sources and ignore requires with a warning").option("--only-source", "with a source argument, exclude configured workspace packages", false).option("--frozen-lock", "resolve strictly from the existing graph lock and cached sources", false).option("--offline", "resolve strictly from graph locks and local caches", false).option("--yes", "trust all new transitive sources", false).option("--trust <pattern>", "pre-approve a transitive source glob (repeatable)", collectTrustOption, []).action(async (source, options) => {
   console.error("warning: 'agentwheel sync' is deprecated and will be removed in 0.10. Use 'agentwheel install'.");
   await runInstallCommand(source, options, { apply: !options.dryRun });
 });
@@ -6345,7 +6458,7 @@ async function runInstallCommand(nameOrSource, options, behavior) {
     let extraPackage;
     if (nameOrSource && !configured) {
       try {
-        const entry = await packageEntryFromSource(nameOrSource, target.workspaceRoot, options);
+        const entry = await packageEntryFromSource(nameOrSource, target.workspaceRoot, { ...options, adapter: options.adapter ?? target.adapter });
         scope = entry.name;
         if (behavior.apply) {
           await writeWorkspaceConfig(target.workspaceRoot, upsertPackage(await readWorkspaceConfig(target.workspaceRoot), entry));
@@ -6433,9 +6546,15 @@ function nextInstallNudge() {
   return "Preview: agentwheel plan - Apply: agentwheel install";
 }
 async function resolveCliTargets(options) {
+  if (options.all && options.allDetected) {
+    throw new Error("Choose either --all for configured agents or --all-detected for detected runtime directories.");
+  }
   if (options.all) {
     return resolveAllRuntimeTargets({ targetRoot: options.targetRoot, adapter: options.adapter, agent: options.agent, all: options.all });
   }
+  if (options.allDetected) {
+    return resolveAllDetectedRuntimeTargets({ targetRoot: options.targetRoot, adapter: options.adapter, agent: options.agent, allDetected: options.allDetected });
+  }
   return [await resolveRuntimeTarget({ targetRoot: options.targetRoot, adapter: options.adapter, agent: options.agent })];
 }
 async function resolveAdapterForTarget(target, options) {
@@ -6659,6 +6778,7 @@ function keepManifestEntryOperation(entry, targetRoot, rootId, operation, option
     graphNodeId: fresh?.graphNodeId ?? ("graphNodeId" in entry ? entry.graphNodeId : void 0),
     dependencyRole: fresh?.dependencyRole ?? ("dependencyRole" in entry ? entry.dependencyRole : "root"),
     owners: fresh?.owners ?? owners,
+    workspaceOwner: fresh?.workspaceOwner ?? ("workspaceOwner" in entry ? entry.workspaceOwner : "legacy:unowned"),
     graphLockDigest: fresh ? void 0 : "graphLockDigest" in entry ? entry.graphLockDigest : void 0
   };
 }
@@ -6955,7 +7075,7 @@ function withFleetExample(config) {
   };
 }
 async function findAgentwheelPackageRoot(start) {
-  let current = resolve17(start);
+  let current = resolve18(start);
   while (true) {
     if (await findPackageManifestPath(current, { warnLegacy: false })) return current;
     const parent = dirname21(current);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",