@detergent-software/atk 8.9.0 → 8.9.1

package/build/lib/schemas/lockfile.d.ts

@@ -1,31 +1,157 @@
 import { z } from 'zod';
-export declare const InstalledFile: z.ZodObject<{
-    checksum: z.ZodString;
-    installedPath: z.ZodOptional<z.ZodString>;
-    sourcePath: z.ZodString;
-}, z.core.$strip>;
-export type InstalledFile = z.infer<typeof InstalledFile>;
+/** The schemas built with `z.object`, for the exported types: a misspelt key in an `InstalledAsset` literal fails to compile. */
+type Known = ReturnType<typeof lockfileSchemas<z.core.$strip>>;
+/** `z.object` (drops keys it doesn't know) or `z.looseObject` (keeps them), for {@link lockfileSchemas}. */
+type ObjectOf<Config extends z.core.$ZodObjectConfig> = <Shape extends z.core.$ZodLooseShape>(shape: Shape) => z.ZodObject<Shape, Config>;
+declare function lockfileSchemas<Config extends z.core.$ZodObjectConfig>(object: ObjectOf<Config>): {
+    ConfigEntry: z.ZodObject<{
+        checksum: z.ZodString;
+        checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
+        command: z.ZodOptional<z.ZodString>;
+        file: z.ZodString;
+        key: z.ZodString;
+        tool: z.ZodOptional<z.ZodString>;
+    }, Config>;
+    InstalledAsset: z.ZodObject<{
+        bundleOrigin: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            org: z.ZodOptional<z.ZodString>;
+            version: z.ZodString;
+        }, Config>>;
+        configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            checksum: z.ZodString;
+            checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
+            command: z.ZodOptional<z.ZodString>;
+            file: z.ZodString;
+            key: z.ZodString;
+            tool: z.ZodOptional<z.ZodString>;
+        }, Config>>>;
+        dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            org: z.ZodOptional<z.ZodString>;
+            type: z.ZodEnum<{
+                skill: "skill";
+                agent: "agent";
+                rule: "rule";
+                hook: "hook";
+                "memory-template": "memory-template";
+                "mcp-config": "mcp-config";
+            }>;
+            version: z.ZodOptional<z.ZodString>;
+        }, Config>>>;
+        description: z.ZodOptional<z.ZodString>;
+        entrypoint: z.ZodOptional<z.ZodString>;
+        excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        files: z.ZodArray<z.ZodObject<{
+            checksum: z.ZodString;
+            installedPath: z.ZodOptional<z.ZodString>;
+            sourcePath: z.ZodString;
+        }, Config>>;
+        installReason: z.ZodOptional<z.ZodEnum<{
+            direct: "direct";
+            dependency: "dependency";
+        }>>;
+        name: z.ZodString;
+        org: z.ZodOptional<z.ZodString>;
+        pinnedVersion: z.ZodOptional<z.ZodString>;
+        type: z.ZodEnum<{
+            skill: "skill";
+            agent: "agent";
+            rule: "rule";
+            hook: "hook";
+            "memory-template": "memory-template";
+            "mcp-config": "mcp-config";
+        }>;
+        undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        version: z.ZodString;
+    }, Config>;
+    InstalledFile: z.ZodObject<{
+        checksum: z.ZodString;
+        installedPath: z.ZodOptional<z.ZodString>;
+        sourcePath: z.ZodString;
+    }, Config>;
+    LockfileSchema: z.ZodObject<{
+        assets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            bundleOrigin: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                org: z.ZodOptional<z.ZodString>;
+                version: z.ZodString;
+            }, Config>>;
+            configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                checksum: z.ZodString;
+                checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
+                command: z.ZodOptional<z.ZodString>;
+                file: z.ZodString;
+                key: z.ZodString;
+                tool: z.ZodOptional<z.ZodString>;
+            }, Config>>>;
+            dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                org: z.ZodOptional<z.ZodString>;
+                type: z.ZodEnum<{
+                    skill: "skill";
+                    agent: "agent";
+                    rule: "rule";
+                    hook: "hook";
+                    "memory-template": "memory-template";
+                    "mcp-config": "mcp-config";
+                }>;
+                version: z.ZodOptional<z.ZodString>;
+            }, Config>>>;
+            description: z.ZodOptional<z.ZodString>;
+            entrypoint: z.ZodOptional<z.ZodString>;
+            excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            files: z.ZodArray<z.ZodObject<{
+                checksum: z.ZodString;
+                installedPath: z.ZodOptional<z.ZodString>;
+                sourcePath: z.ZodString;
+            }, Config>>;
+            installReason: z.ZodOptional<z.ZodEnum<{
+                direct: "direct";
+                dependency: "dependency";
+            }>>;
+            name: z.ZodString;
+            org: z.ZodOptional<z.ZodString>;
+            pinnedVersion: z.ZodOptional<z.ZodString>;
+            type: z.ZodEnum<{
+                skill: "skill";
+                agent: "agent";
+                rule: "rule";
+                hook: "hook";
+                "memory-template": "memory-template";
+                "mcp-config": "mcp-config";
+            }>;
+            undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            version: z.ZodString;
+        }, Config>>>;
+        lockVersion: z.ZodLiteral<1>;
+        org: z.ZodOptional<z.ZodString>;
+        orgReviewers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, Config>;
+};
 export declare const ConfigEntry: z.ZodObject<{
     checksum: z.ZodString;
+    checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
     command: z.ZodOptional<z.ZodString>;
     file: z.ZodString;
     key: z.ZodString;
     tool: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type ConfigEntry = z.infer<typeof ConfigEntry>;
-export declare const InstalledAsset: z.ZodObject<{
+}, z.core.$loose>, InstalledAsset: z.ZodObject<{
     bundleOrigin: z.ZodOptional<z.ZodObject<{
         name: z.ZodString;
         org: z.ZodOptional<z.ZodString>;
         version: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
     configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
         checksum: z.ZodString;
+        checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
         command: z.ZodOptional<z.ZodString>;
         file: z.ZodString;
         key: z.ZodString;
         tool: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
+    }, z.core.$loose>>>;
     dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         org: z.ZodOptional<z.ZodString>;
@@ -38,7 +164,7 @@ export declare const InstalledAsset: z.ZodObject<{
             "mcp-config": "mcp-config";
         }>;
         version: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
+    }, z.core.$loose>>>;
     description: z.ZodOptional<z.ZodString>;
     entrypoint: z.ZodOptional<z.ZodString>;
     excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -46,7 +172,7 @@ export declare const InstalledAsset: z.ZodObject<{
         checksum: z.ZodString;
         installedPath: z.ZodOptional<z.ZodString>;
         sourcePath: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
     installReason: z.ZodOptional<z.ZodEnum<{
         direct: "direct";
         dependency: "dependency";
@@ -65,22 +191,25 @@ export declare const InstalledAsset: z.ZodObject<{
     undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     version: z.ZodString;
-}, z.core.$strip>;
-export type InstalledAsset = z.infer<typeof InstalledAsset>;
-export declare const LockfileSchema: z.ZodObject<{
+}, z.core.$loose>, InstalledFile: z.ZodObject<{
+    checksum: z.ZodString;
+    installedPath: z.ZodOptional<z.ZodString>;
+    sourcePath: z.ZodString;
+}, z.core.$loose>, LockfileSchema: z.ZodObject<{
     assets: z.ZodOptional<z.ZodArray<z.ZodObject<{
         bundleOrigin: z.ZodOptional<z.ZodObject<{
             name: z.ZodString;
             org: z.ZodOptional<z.ZodString>;
             version: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$loose>>;
         configEntries: z.ZodOptional<z.ZodArray<z.ZodObject<{
             checksum: z.ZodString;
+            checksumVersion: z.ZodOptional<z.ZodLiteral<2>>;
             command: z.ZodOptional<z.ZodString>;
             file: z.ZodString;
             key: z.ZodString;
             tool: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>>;
+        }, z.core.$loose>>>;
         dependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
             name: z.ZodString;
             org: z.ZodOptional<z.ZodString>;
@@ -93,7 +222,7 @@ export declare const LockfileSchema: z.ZodObject<{
                 "mcp-config": "mcp-config";
             }>;
             version: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>>;
+        }, z.core.$loose>>>;
         description: z.ZodOptional<z.ZodString>;
         entrypoint: z.ZodOptional<z.ZodString>;
         excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -101,7 +230,7 @@ export declare const LockfileSchema: z.ZodObject<{
             checksum: z.ZodString;
             installedPath: z.ZodOptional<z.ZodString>;
             sourcePath: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$loose>>;
         installReason: z.ZodOptional<z.ZodEnum<{
             direct: "direct";
             dependency: "dependency";
@@ -120,10 +249,14 @@ export declare const LockfileSchema: z.ZodObject<{
         undeclaredTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         userConfigDirs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         version: z.ZodString;
-    }, z.core.$strip>>>;
+    }, z.core.$loose>>>;
     lockVersion: z.ZodLiteral<1>;
     org: z.ZodOptional<z.ZodString>;
     orgReviewers: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export type Lockfile = z.infer<typeof LockfileSchema>;
+}, z.core.$loose>;
+export type ConfigEntry = z.infer<Known['ConfigEntry']>;
+export type InstalledAsset = z.infer<Known['InstalledAsset']>;
+export type InstalledFile = z.infer<Known['InstalledFile']>;
+export type Lockfile = z.infer<Known['LockfileSchema']>;
+export {};
 //# sourceMappingURL=lockfile.d.ts.map

package/build/lib/schemas/lockfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,aAAa;;;;iBASxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,WAAW;;;;;;iBAoBtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwDzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,iIAAiI;AACjI,KAAK,KAAK,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/D,4GAA4G;AAC5G,KAAK,QAAQ,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,EAC1F,KAAK,EAAE,KAAK,KACT,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAEhC,iBAAS,eAAe,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyHxF;AAID,eAAO,MAAQ,WAAW;;;;;;;mBAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAAE,aAAa;;;;mBAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAExE,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAC5D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC"}

package/build/lib/schemas/lockfile.js

@@ -1,82 +1,103 @@
 import { z } from 'zod';
 import { AssetTypeSchema as AssetType } from '../atk-schemas/index.js';
-export const InstalledFile = z.object({
-    checksum: z.string().describe('SHA-256 checksum of the file contents'),
-    installedPath: z
-        .string()
-        .optional()
-        .describe('Project-relative POSIX path to where the file was installed (computed via adapter for legacy entries); absolute at the user scope when the tool’s config directory is on another drive than the user root'),
-    sourcePath: z.string().describe('Original path within the asset directory'),
-});
-export const ConfigEntry = z.object({
-    checksum: z.string().describe('SHA-256 hex digest of the config entry value'),
-    command: z
-        .string()
-        .optional()
-        .describe('For array-valued config sections (e.g. hooks.<Event>): identifies the array element this asset owns by its nested hooks[].command value'),
-    file: z
-        .string()
-        .describe('Project-relative POSIX path to the config file; absolute at the user scope when the tool’s config directory is on another drive than the user root'),
-    key: z.string().describe('Dot-path key within the config file (e.g. hooks.Stop)'),
-    tool: z
-        .string()
-        .optional()
-        .describe('Tool adapter id (e.g. claude-code) that registered this entry. Absent on entries written by older CLI versions; ownership is then inferred from the config file path'),
-});
-export const InstalledAsset = z.object({
-    bundleOrigin: z
-        .object({
-        name: z.string().describe('Bundle name that sourced this asset'),
-        org: z.string().optional().describe('Organization scope of the bundle (absent for global bundles)'),
-        version: z.string().describe('Bundle version at install time'),
-    })
-        .optional()
-        .describe('Bundle that triggered this asset installation'),
-    configEntries: z.array(ConfigEntry).optional().describe('Config file entries registered by this asset'),
-    dependencies: z
-        .array(z.object({
-        name: z.string().describe('Dependency asset name'),
-        org: z.string().optional().describe('Organization scope of the dependency'),
-        type: AssetType.describe('Dependency asset type'),
-        version: z.string().optional().describe('Dependency version constraint at install time'),
-    }))
-        .optional()
-        .describe('Assets this asset depends on'),
-    description: z.string().optional().describe('Short description of the asset'),
-    entrypoint: z
-        .string()
-        .optional()
-        .describe('Primary file for this asset (relative to the asset directory), from the manifest — used to resolve adapter placement paths'),
-    excludedTools: z
-        .array(z.string())
-        .optional()
-        .describe('Tool adapter ids (e.g. codex-cli) this asset was explicitly uninstalled for, or that a hook was skipped for because its manifest does not declare them (those are also in undeclaredTools). Sync, audit and update skip the asset for these tools; installing it for a tool removes that tool again. Absent means the asset is wanted for every tool'),
-    files: z.array(InstalledFile).describe('Files placed by this asset'),
-    installReason: z
-        .enum(['direct', 'dependency'])
-        .optional()
-        .describe('Whether the user explicitly installed this or it was pulled in as a dependency'),
-    name: z.string().describe('Asset name'),
-    org: z.string().optional().describe('Organization scope for this asset'),
-    pinnedVersion: z.string().optional().describe('Pinned version constraint, if the asset is version-pinned'),
-    type: AssetType.describe('Asset type'),
-    undeclaredTools: z
-        .array(z.string())
-        .optional()
-        .describe('The tools in excludedTools that a hook was skipped for because its manifest does not declare them, not uninstalled for. Sync and update place the hook for such a tool once its version declares it'),
-    userConfigDirs: z
-        .record(z.string(), z.string())
-        .optional()
-        .describe('User scope only: per tool adapter id, the directory its `userConfigDir.env` (e.g. CLAUDE_CONFIG_DIR) had moved the tool’s user config to when ATK placed this asset, relative to the user root (e.g. { "claude-code": "../cc" }), or absolute when it is on another drive (e.g. "D:/cc"). A tool missing here placed it in its default directory. Uninstall, sync and audit find the tool’s copy there'),
-    version: z.string().describe('Installed version'),
-});
-export const LockfileSchema = z.object({
-    assets: z.array(InstalledAsset).optional().describe('Currently installed assets'),
-    lockVersion: z.literal(1).describe('Lock file format version'),
-    org: z.string().optional().describe('Organization scope for this lockfile'),
-    orgReviewers: z
-        .array(z.string())
-        .optional()
-        .describe('GitHub usernames auto-requested as PR reviewers for org-scoped asset publishes'),
-});
+import { ASSET_FILE_PATH, PATH_SEGMENT } from '../root-path.js';
+function lockfileSchemas(object) {
+    const InstalledFile = object({
+        checksum: z.string().describe('SHA-256 checksum of the file contents'),
+        installedPath: z
+            .string()
+            .optional()
+            .describe('Project-relative POSIX path to where the file was installed (computed via adapter for legacy entries); absolute at the user scope when the tool’s config directory is on another drive than the user root'),
+        sourcePath: z
+            .string()
+            .regex(ASSET_FILE_PATH, 'must be a relative path inside the asset directory, with no ".." segment')
+            .describe('Original path within the asset directory'),
+    });
+    const ConfigEntry = object({
+        checksum: z.string().describe('SHA-256 hex digest of the config entry value'),
+        checksumVersion: z
+            .literal(2)
+            .optional()
+            .describe('How the checksum was computed: 2 hashes the value with keys sorted at every depth. Absent on entries written by older CLI versions, whose digest ignores nested keys; the next sync records them again as 2. Hook groups (entries with a command) always hash every depth and ignore it'),
+        command: z
+            .string()
+            .optional()
+            .describe('For array-valued config sections (e.g. hooks.<Event>): identifies the array element this asset owns by its nested hooks[].command value'),
+        file: z
+            .string()
+            .describe('Project-relative POSIX path to the config file; absolute at the user scope when the tool’s config directory is on another drive than the user root'),
+        key: z.string().describe('Dot-path key within the config file (e.g. hooks.Stop)'),
+        tool: z
+            .string()
+            .optional()
+            .describe('Tool adapter id (e.g. claude-code) that registered this entry. Absent on entries written by older CLI versions; ownership is then inferred from the config file path'),
+    });
+    const InstalledAsset = object({
+        bundleOrigin: object({
+            name: z.string().describe('Bundle name that sourced this asset'),
+            org: z.string().optional().describe('Organization scope of the bundle (absent for global bundles)'),
+            version: z.string().describe('Bundle version at install time'),
+        })
+            .optional()
+            .describe('Bundle that triggered this asset installation'),
+        configEntries: z.array(ConfigEntry).optional().describe('Config file entries registered by this asset'),
+        dependencies: z
+            .array(object({
+            name: z.string().describe('Dependency asset name'),
+            org: z.string().optional().describe('Organization scope of the dependency'),
+            type: AssetType.describe('Dependency asset type'),
+            version: z.string().optional().describe('Dependency version constraint at install time'),
+        }))
+            .optional()
+            .describe('Assets this asset depends on'),
+        description: z.string().optional().describe('Short description of the asset'),
+        entrypoint: z
+            .string()
+            .optional()
+            .describe('Primary file for this asset (relative to the asset directory), from the manifest — used to resolve adapter placement paths'),
+        excludedTools: z
+            .array(z.string())
+            .optional()
+            .describe('Tool adapter ids (e.g. codex-cli) this asset was explicitly uninstalled for, or that a hook was skipped for because its manifest does not declare them (those are also in undeclaredTools). Sync, audit and update skip the asset for these tools; installing it for a tool removes that tool again. Absent means the asset is wanted for every tool'),
+        files: z.array(InstalledFile).describe('Files placed by this asset'),
+        installReason: z
+            .enum(['direct', 'dependency'])
+            .optional()
+            .describe('Whether the user explicitly installed this or it was pulled in as a dependency'),
+        name: z
+            .string()
+            .regex(PATH_SEGMENT, 'must be one path segment: no "/" or "\\", and not "." or ".."')
+            .describe('Asset name'),
+        org: z.string().optional().describe('Organization scope for this asset'),
+        pinnedVersion: z.string().optional().describe('Pinned version constraint, if the asset is version-pinned'),
+        type: AssetType.describe('Asset type'),
+        undeclaredTools: z
+            .array(z.string())
+            .optional()
+            .describe('The tools in excludedTools that a hook was skipped for because its manifest does not declare them, not uninstalled for. Sync and update place the hook for such a tool once its version declares it'),
+        userConfigDirs: z
+            .record(z.string(), z.string())
+            .optional()
+            .describe('User scope only: per tool adapter id, the directory its `userConfigDir.env` (e.g. CLAUDE_CONFIG_DIR) had moved the tool’s user config to when ATK placed this asset, relative to the user root (e.g. { "claude-code": "../cc" }), or absolute when it is on another drive (e.g. "D:/cc"). A tool missing here placed it in its default directory. Uninstall, sync and audit find the tool’s copy there'),
+        version: z.string().describe('Installed version'),
+    });
+    const LockfileSchema = object({
+        assets: z.array(InstalledAsset).optional().describe('Currently installed assets'),
+        // A new field doesn't bump this: since ATK-587 a CLI keeps the keys it doesn't know, so an older
+        // one writing the lockfile leaves a newer one's fields alone. Bump it only for a change an older
+        // CLI can't read safely: every released CLI refuses anything but 1 (readLockfile names the upgrade).
+        lockVersion: z
+            .literal(1)
+            .describe('Lock file format version. Added fields keep it at 1: a CLI keeps the keys it does not know when it writes the lockfile'),
+        org: z.string().optional().describe('Organization scope for this lockfile'),
+        orgReviewers: z
+            .array(z.string())
+            .optional()
+            .describe('GitHub usernames auto-requested as PR reviewers for org-scoped asset publishes'),
+    });
+    return { ConfigEntry, InstalledAsset, InstalledFile, LockfileSchema };
+}
+// The schemas keep keys this CLI doesn't know, so a teammate on an older CLI doesn't erase a newer
+// one's fields when they write the lockfile (ATK-587). The types come from `Known`, without them.
+export const { ConfigEntry, InstalledAsset, InstalledFile, LockfileSchema } = lockfileSchemas(z.looseObject);
 //# sourceMappingURL=lockfile.js.map

package/build/lib/schemas/lockfile.js.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,IAAI,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACtE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,2MAA2M,CAC5M;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;CAC5E,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC7E,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yIAAyI,CAC1I;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CACP,oJAAoJ,CACrJ;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACjF,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,sKAAsK,CACvK;CACJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;QACnG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC/D,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CAAC,+CAA+C,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IACvG,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QAC3E,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;KACzF,CAAC,CACH;SACA,QAAQ,EAAE;SACV,QAAQ,CAAC,8BAA8B,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC7E,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,4HAA4H,CAC7H;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,sVAAsV,CACvV;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;IAC7F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IAC1G,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;IACtC,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,qMAAqM,CACtM;IACH,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CACP,wYAAwY,CACzY;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACjF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC3E,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC,CAAC"}
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../../src/lib/schemas/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,IAAI,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUhE,SAAS,eAAe,CAAyC,MAAwB;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QACtE,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,2MAA2M,CAC5M;QACH,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,KAAK,CAAC,eAAe,EAAE,0EAA0E,CAAC;aAClG,QAAQ,CAAC,0CAA0C,CAAC;KACxD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QAC7E,eAAe,EAAE,CAAC;aACf,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,yRAAyR,CAC1R;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,yIAAyI,CAC1I;QACH,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,CACP,oJAAoJ,CACrJ;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACjF,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,sKAAsK,CACvK;KACJ,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,YAAY,EAAE,MAAM,CAAC;YACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;YACnG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAC/D,CAAC;aACC,QAAQ,EAAE;aACV,QAAQ,CAAC,+CAA+C,CAAC;QAC5D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QACvG,YAAY,EAAE,CAAC;aACZ,KAAK,CACJ,MAAM,CAAC;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YAC3E,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;SACzF,CAAC,CACH;aACA,QAAQ,EAAE;aACV,QAAQ,CAAC,8BAA8B,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAC7E,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,4HAA4H,CAC7H;QACH,aAAa,EAAE,CAAC;aACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CACP,sVAAsV,CACvV;QACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QACpE,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CAAC,gFAAgF,CAAC;QAC7F,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,KAAK,CAAC,YAAY,EAAE,+DAA+D,CAAC;aACpF,QAAQ,CAAC,YAAY,CAAC;QACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QAC1G,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,eAAe,EAAE,CAAC;aACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CACP,qMAAqM,CACtM;QACH,cAAc,EAAE,CAAC;aACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CACP,wYAAwY,CACzY;QACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KAClD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QACjF,iGAAiG;QACjG,iGAAiG;QACjG,qGAAqG;QACrG,WAAW,EAAE,CAAC;aACX,OAAO,CAAC,CAAC,CAAC;aACV,QAAQ,CACP,wHAAwH,CACzH;QACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;QAC3E,YAAY,EAAE,CAAC;aACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CAAC,gFAAgF,CAAC;KAC9F,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AACxE,CAAC;AAED,mGAAmG;AACnG,kGAAkG;AAClG,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,eAAe,CAC3F,CAAC,CAAC,WAAW,CACd,CAAC"}

package/build/lib/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/lib/setup.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,aAAa,EAAgB,MAAM,YAAY,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,WAAW,QAA4B,CAAC;AAMrD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAa1D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6GtG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWxF;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,WAAW,EACX,IAAY,GACb,EAAE;IACD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/lib/setup.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,aAAa,EAAgB,MAAM,YAAY,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,WAAW,QAA4B,CAAC;AAMrD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAa1D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkHtG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWxF;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,WAAW,EACX,IAAY,GACb,EAAE;IACD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB"}

package/build/lib/setup.js

@@ -5,7 +5,7 @@ import { loadAdapter } from './adapter.js';
 import { loadProjectConfig, saveProjectConfig } from './config.js';
 import { errorMessage } from './errors.js';
 import { ensureGitignoreEntries, ensureGitignorePatterns } from './gitignore.js';
-import { getLockfilePath, readLockfile, writeLockfile } from './lockfile.js';
+import { getLockfilePath, readLockfile, withLockfileErrorHandling, writeLockfile } from './lockfile.js';
 import { resolveSetupRoot } from './paths.js';
 import { isUserRoot, resolveScope } from './scope.js';
 // ---------------------------------------------------------------------------
@@ -48,56 +48,61 @@ export async function performSetupCreation(options) {
     const actions = [];
     const warnings = [];
     const resolvedOrg = resolveSetupOrg(orgValue, orgLocked);
-    // 1. Write .atkrc.json with { tools: [...] }. Setup replaces the tools list, so say which
-    //    list it replaced and which tools dropped out of it.
-    //    Frozen assets are not setup's to change, so they carry over.
-    const previousConfig = await loadPreviousConfig(projectDir);
-    const previousTools = previousConfig?.tools ?? [];
-    await saveProjectConfig(projectDir, {
-        ...(previousConfig?.frozenAssets?.length ? { frozenAssets: previousConfig.frozenAssets } : {}),
-        tools: selectedTools,
-    });
-    const listChanged = previousTools.length > 0 &&
-        (previousTools.length !== selectedTools.length || previousTools.some((t, i) => t !== selectedTools[i]));
-    actions.push({
-        detail: `tools: ${selectedTools.join(', ')}${listChanged ? ` — replaced: ${previousTools.join(', ')}` : ''}`,
-        label: 'Wrote .atkrc.json',
-    });
-    const removedTools = previousTools.filter((t) => !selectedTools.includes(t));
-    if (removedTools.length > 0) {
-        actions.push({
-            detail: `${removedTools.join(', ')} — installed files and config directories were left in place`,
-            label: 'Removed from tools list',
+    // Steps 1 and 2 run under the lockfile lock, so a concurrent install's or move's write isn't
+    // lost, and a lock that stays held fails setup before it changes anything.
+    await withLockfileErrorHandling(projectDir, async () => {
+        // 1. Write .atkrc.json with { tools: [...] }. Setup replaces the tools list, so say which
+        //    list it replaced and which tools dropped out of it.
+        //    Frozen assets are not setup's to change, so they carry over.
+        const previousConfig = await loadPreviousConfig(projectDir);
+        const previousTools = previousConfig?.tools ?? [];
+        await saveProjectConfig(projectDir, {
+            ...(previousConfig?.frozenAssets?.length ? { frozenAssets: previousConfig.frozenAssets } : {}),
+            tools: selectedTools,
         });
-    }
-    // 2. Write/update .atk-lock.json
-    const lockfilePath = getLockfilePath(projectDir);
-    if (existsSync(lockfilePath)) {
-        // Preserve existing assets and org
-        const existing = await readLockfile(projectDir);
-        // Only update org if it's not already set and we have a new one
-        const updatedLockfile = {
-            ...existing,
-            lockVersion: 1,
-            ...(resolvedOrg !== undefined && !existing.org ? { org: resolvedOrg } : {}),
-        };
-        await writeLockfile(projectDir, updatedLockfile);
+        const listChanged = previousTools.length > 0 &&
+            (previousTools.length !== selectedTools.length || previousTools.some((t, i) => t !== selectedTools[i]));
         actions.push({
-            detail: `${(existing.assets ?? []).length} existing asset(s) preserved`,
-            label: 'Updated .atk-lock.json',
+            detail: `tools: ${selectedTools.join(', ')}${listChanged ? ` — replaced: ${previousTools.join(', ')}` : ''}`,
+            label: 'Wrote .atkrc.json',
         });
-    }
-    else {
-        await writeLockfile(projectDir, {
-            assets: [],
-            lockVersion: 1,
-            ...(resolvedOrg !== undefined ? { org: resolvedOrg } : {}),
-        });
-        actions.push({
-            detail: resolvedOrg ? `org: ${resolvedOrg}` : 'no org',
-            label: 'Created .atk-lock.json',
-        });
-    }
+        const removedTools = previousTools.filter((t) => !selectedTools.includes(t));
+        if (removedTools.length > 0) {
+            actions.push({
+                detail: `${removedTools.join(', ')} — installed files and config directories were left in place`,
+                label: 'Removed from tools list',
+            });
+        }
+        // 2. Write/update .atk-lock.json. The existence check is under the lock too: an install
+        //    may create the lockfile meanwhile.
+        const lockfilePath = getLockfilePath(projectDir);
+        if (existsSync(lockfilePath)) {
+            // Preserve existing assets and org
+            const existing = await readLockfile(projectDir);
+            // Only update org if it's not already set and we have a new one
+            const updatedLockfile = {
+                ...existing,
+                lockVersion: 1,
+                ...(resolvedOrg !== undefined && !existing.org ? { org: resolvedOrg } : {}),
+            };
+            await writeLockfile(projectDir, updatedLockfile);
+            actions.push({
+                detail: `${(existing.assets ?? []).length} existing asset(s) preserved`,
+                label: 'Updated .atk-lock.json',
+            });
+        }
+        else {
+            await writeLockfile(projectDir, {
+                assets: [],
+                lockVersion: 1,
+                ...(resolvedOrg !== undefined ? { org: resolvedOrg } : {}),
+            });
+            actions.push({
+                detail: resolvedOrg ? `org: ${resolvedOrg}` : 'no org',
+                label: 'Created .atk-lock.json',
+            });
+        }
+    });
     // 3. Ensure each selected tool's marker directory exists and .atkrc.json is
     //    in .gitignore via the adapters' gitignore entries
     const allAdded = [];