@fitlab-ai/agent-infra 0.8.4 → 0.8.5

package/templates/.agents/skills/review-code/SKILL.zh-CN.md

@@ -76,7 +76,7 @@ tail .agents/workspace/active/{task-id}/task.md
 - 一次性记录 `R=$(git rev-parse HEAD)`；本轮报告、指纹和任务审查事实都复用该 R，禁止稍后重新读取 HEAD 代替
 - `git diff --binary "$R" -- <post-review-globs>` 覆盖已跟踪变更
 - `git ls-files -o --exclude-standard -z -- <post-review-globs>` 覆盖未跟踪新文件
-- `node .agents/scripts/review-diff-fingerprint.js worktree "$R"` 生成审查差异指纹，并写入报告
+- `node .agents/scripts/review-diff-fingerprint.js worktree "$R" --format json` 一次生成审查差异指纹 `F` 与审查快照树 `T`，并写入报告
 
 > 详细审查标准、严重程度划分和 reviewer 关注点见 `reference/review-criteria.md`。执行此步骤前先读取 `reference/review-criteria.md`。
 > 测试审查硬门禁：当 `git diff` 触及测试文件时，必须先读取 `.agents/rules/testing-discipline.md` 并逐条核对（尤其"正向已覆盖时不应再加反向断言"）。
@@ -99,7 +99,7 @@ date "+%Y-%m-%d %H:%M:%S%z" | sed 's/\([+-][0-9][0-9]\)\([0-9][0-9]\)$/\1:\2/'
 - `assigned_to`：{当前代理}
 - `updated_at`：{当前时间}
 - `agent_infra_version`：按 `.agents/rules/version-stamp.md` 取值
-- 若本轮 `总体结论` / `Overall Verdict` 为 `通过` / `Approved`，写入 `last_reviewed_commit: {R}`；是否存在工作区 diff 不影响写入，重复写同一 R 幂等
+- 若本轮 `总体结论` / `Overall Verdict` 为 `通过` / `Approved` 且 `T == R^{tree}`，写入 `last_reviewed_commit: {R}`；若 Approved 快照包含未提交差异，则清除既有 `last_reviewed_commit`，等待 `commit` 锚定
 - 若本轮结论不是 Approved，保留既有 `last_reviewed_commit`，不得推进或清空
 - 追加：
 `- {YYYY-MM-DD HH:mm:ss±HH:MM} — **Review Code (Round {N})** by {agent} — Verdict: {Approved/Changes Requested/Rejected}, blockers: {n}, major: {n}, minor: {n}, Manual-validation: {n} → {artifact-filename}`

package/templates/.agents/skills/review-code/config/verify.en.json

@@ -32,7 +32,8 @@
         "^\\$ ",
         "^- \\*\\*Overall Verdict\\*\\*[:：]\\s*(?:通过|需要修改|拒绝|Approved|Changes Requested|Rejected)\\s*$",
         "^- \\*\\*Review Baseline Commit\\*\\*[:：]\\s*\\S",
-        "^- \\*\\*Reviewed Diff Fingerprint\\*\\*[:：]\\s*sha256:[0-9a-f]{64}\\s*$"
+        "^- \\*\\*Reviewed Diff Fingerprint\\*\\*[:：]\\s*sha256:[0-9a-f]{64}\\s*$",
+        "^- \\*\\*Reviewed Snapshot Tree\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$"
       ],
       "freshness_minutes": 30
     },

package/templates/.agents/skills/review-code/config/verify.zh-CN.json

@@ -32,7 +32,8 @@
         "^\\$ ",
         "^- \\*\\*总体结论\\*\\*[:：]\\s*(?:通过|需要修改|拒绝|Approved|Changes Requested|Rejected)\\s*$",
         "^- \\*\\*审查基线提交\\*\\*[:：]\\s*\\S",
-        "^- \\*\\*审查差异指纹\\*\\*[:：]\\s*sha256:[0-9a-f]{64}\\s*$"
+        "^- \\*\\*审查差异指纹\\*\\*[:：]\\s*sha256:[0-9a-f]{64}\\s*$",
+        "^- \\*\\*审查快照树\\*\\*[:：]\\s*[0-9a-f]{40,64}\\s*$"
       ],
       "freshness_minutes": 30
     },

package/templates/.agents/skills/review-code/reference/report-template.en.md

@@ -21,8 +21,9 @@ Use this template when writing `review-code.md` or `review-code-r{N}.md`.
 - **Reviewer**: {reviewer-name}
 - **Review Time**: {timestamp}
 - **Scope**: {file-count and major modules}
-- **Review Baseline Commit**: {raw R captured once for this round} (baseline for the complete-task post-review commit gate; see `.agents/rules/review-handshake.md`)
+- **Review Baseline Commit**: {raw R captured once for this round} (diff base only; see `.agents/rules/review-handshake.md`)
 - **Reviewed Diff Fingerprint**: {raw node .agents/scripts/review-diff-fingerprint.js worktree "$R"}
+- **Reviewed Snapshot Tree**: {tree field from node .agents/scripts/review-diff-fingerprint.js worktree "$R" --format json}
 - **Overall Verdict**: {Approved / Changes Requested / Rejected} (pick exactly one; combined phrases will fail the verify gate)
 - **Findings (AI-actionable)**: 0 blockers, 0 majors, 0 minors / **Manual validation**: 0
 

package/templates/.agents/skills/review-code/reference/report-template.zh-CN.md

@@ -21,8 +21,9 @@
 - **审查者**：{reviewer-name}
 - **审查时间**：{timestamp}
 - **审查范围**：{file-count and major modules}
-- **审查基线提交**：{本轮一次性捕获的 R 原文}（complete-task 的 post-review commit 门禁基线；详见 `.agents/rules/review-handshake.md`）
+- **审查基线提交**：{本轮一次性捕获的 R 原文}（仅表示 diff base；详见 `.agents/rules/review-handshake.md`）
 - **审查差异指纹**：{node .agents/scripts/review-diff-fingerprint.js worktree "$R" 原文}
+- **审查快照树**：{node .agents/scripts/review-diff-fingerprint.js worktree "$R" --format json 的 tree 字段}
 - **总体结论**：{通过 / 需要修改 / 拒绝}（恰取一个；禁止写组合短语，否则 verify gate 失败）
 - **发现（AI 可处理）**：0 阻塞项，0 主要，0 次要 / **人工校验**：0
 

package/templates/.agents/skills/update-agent-infra/SKILL.en.md

@@ -33,7 +33,7 @@ same-path external files, and later external sources win over earlier external
 sources. Conflicts are recorded in the report. The script then performs:
 - detect the template source version
 - File registry sync (`defaults.json` → `.agents/.airc.json`)
-- All managed files (language selection → exclude merged/ejected → placeholder rendering → overwrite)
+- All managed files (language selection → exclude merged/ejected → placeholder rendering → write; built-in guarded managed files use a source-baseline three-way comparison)
 - Ejected files (create only on first install)
 - `.agents/.airc.json` update (`templateVersion`, file lists)
 
@@ -47,6 +47,8 @@ The script outputs JSON to stdout. Parse and record the report.
   list these in the report so users know which files were ignored because a
   built-in template or later external source won
 - `managed.written` / `managed.created`: updated / newly created managed files
+- `managed.protected`: guarded managed files whose local user-only modification or deletion was preserved
+- `managed.conflicts`: guarded managed files with unknown origin, two-sided changes, or ownership that cannot be proven during a platform switch; list each target, reason, and three-way hash
 - `managed.removed`: deleted managed files (including old paths removed during template migrations)
 - `managed.skippedPlatform`: managed / merged entries skipped because they belong to a different platform
 - `managed.skippedTUI`: managed / merged entries skipped because they are owned by a built-in TUI that is disabled in `tuis` (customTUI command files under the same path prefix are preserved)
@@ -56,6 +58,8 @@ The script outputs JSON to stdout. Parse and record the report.
 - `selfUpdate`: whether this is a self-update scenario
 - `configUpdated`: whether `.agents/.airc.json` was updated
 
+If `managed.conflicts` is non-empty, output every conflict and stop immediately before Phase B. Do not overwrite a conflicting file or advance its `files.managedBaselines` entry.
+
 ## Phase B: Process merged files (AI intelligent merge)
 
 Process each item in the report's `merged.pending` list:

package/templates/.agents/skills/update-agent-infra/SKILL.zh-CN.md

@@ -27,7 +27,7 @@ node .agents/skills/update-agent-infra/scripts/sync-templates.js
 脚本读取 `.agents/.airc.json`，并通过 npm 自动定位已安装的 `@fitlab-ai/agent-infra/templates/` 目录。同步前会合并 `templates.sources` 中配置的外部模板源；相同文件以内置模板为准，多个外部源之间后者覆盖前者，冲突会写入报告。然后自动完成：
 - 检测模板源版本
 - 同步文件注册表（`defaults.json` → `.agents/.airc.json`）
-- 处理所有 managed 文件（语言选择 → 排除 merged/ejected → 占位符渲染 → 覆盖写入）
+- 处理所有 managed 文件（语言选择 → 排除 merged/ejected → 占位符渲染 → 写入；内建 guarded managed 文件使用来源基线三方比较）
 - 处理 ejected 文件（仅首次安装时创建）
 - 更新 `.agents/.airc.json`（`templateVersion`、文件列表）
 
@@ -39,6 +39,8 @@ node .agents/skills/update-agent-infra/scripts/sync-templates.js
 - `templateRoot`：模板文件根目录绝对路径
 - `templateSources.conflicts`：外部模板源冲突列表；报告中必须显式展示，说明哪些文件因内置模板或后续外部源获胜而被忽略
 - `managed.written` / `managed.created`：已更新/新建的 managed 文件
+- `managed.protected`：检测到用户单边修改或删除、因此保留本地状态的 guarded managed 文件
+- `managed.conflicts`：来源未知、双边修改或平台切换时无法证明官方所有权的 guarded managed 冲突；必须逐项展示 target、reason 与三方哈希
 - `managed.removed`：被删除的 managed 文件（包括模板迁移时移除的旧路径）
 - `managed.skippedPlatform`：因归属其他平台而被跳过的 managed / merged 条目
 - `managed.skippedTUI`：因 `tuis` 中未启用对应内建 TUI 而被跳过的 managed / merged 条目（落在同一路径前缀下的 customTUI 命令文件会被保留）
@@ -48,6 +50,8 @@ node .agents/skills/update-agent-infra/scripts/sync-templates.js
 - `selfUpdate`：是否为自更新模式
 - `configUpdated`：`.agents/.airc.json` 是否已更新
 
+如果 `managed.conflicts` 非空，输出全部冲突并立即停止，不进入阶段 B；禁止覆盖冲突文件或推进其 `files.managedBaselines`。
+
 ## 阶段 B：处理 merged 文件（AI 智能合并）
 
 根据报告中 `merged.pending` 列表，逐个文件处理。对于每个条目：

package/templates/.agents/skills/update-agent-infra/scripts/sync-templates.js

@@ -14,11 +14,17 @@
  */
 
 import childProcess from 'node:child_process';
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import {
+  formatAgentInfraPackageError,
+  resolveAgentInfraPackage
+} from '../../../scripts/lib/agent-infra-package.js';
+
 const DEFAULTS = {
   "platform": {
     "type": "github"
@@ -65,8 +71,16 @@ const DEFAULTS = {
       ".gemini/commands/",
       ".git-hooks/check-version-format.sh",
       ".github/scripts/",
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml",
       ".opencode/commands/"
     ],
+    "guardedManaged": [
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml"
+    ],
     "merged": [
       "**/post-release.*",
       "**/release.*",
@@ -88,7 +102,6 @@ const DEFAULTS = {
   }
 };
 
-const PACKAGE_NAME = '@fitlab-ai/agent-infra';
 const AGENT_INFRA_SANDBOX_TOOL = 'agent-infra';
 const LEGACY_DEFAULT_SANDBOX_TOOLS = ['claude-code', 'codex', 'gemini-cli', 'opencode'];
 const DEFAULT_SANDBOX_TOOLS = [AGENT_INFRA_SANDBOX_TOOL, ...LEGACY_DEFAULT_SANDBOX_TOOLS];
@@ -151,6 +164,14 @@ function migrateSandboxTools(cfg) {
 
 function norm(p) { return p.replace(/\\/g, '/'); }
 
+function sha256(content) {
+  return `sha256:${crypto.createHash('sha256').update(content).digest('hex')}`;
+}
+
+function trustedBaseline(value) {
+  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value) ? value : null;
+}
+
 function normDir(p) {
   return norm(p).replace(/^\.\//, '').replace(/\/+$/, '');
 }
@@ -839,117 +860,6 @@ function stripLangVariant(relativePath) {
   return relativePath;
 }
 
-function isTemplateDir(dir) {
-  try {
-    return fs.statSync(dir).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-function verifyPackageDir(dir) {
-  const pkgPath = path.join(dir, 'package.json');
-  if (!fs.existsSync(pkgPath)) {
-    return { templateRoot: null, reason: `package.json not found at ${pkgPath}` };
-  }
-
-  let pkg;
-  try {
-    pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-  } catch {
-    return { templateRoot: null, reason: `invalid package.json at ${pkgPath}` };
-  }
-
-  if (pkg.name !== PACKAGE_NAME) {
-    const packageName = typeof pkg.name === 'string' && pkg.name ? pkg.name : 'an unknown package';
-    return { templateRoot: null, reason: `${pkgPath} belongs to ${packageName}` };
-  }
-
-  const templateRoot = path.join(dir, 'templates');
-  if (!isTemplateDir(templateRoot)) {
-    return { templateRoot: null, reason: `templates/ not found at ${templateRoot}` };
-  }
-
-  return { templateRoot, reason: null };
-}
-
-function resolveUnixTemplateRoot(name) {
-  let linkPath;
-  try {
-    linkPath = childProcess.execSync(`command -v ${name}`, {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe']
-    }).trim();
-  } catch {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  if (!linkPath) {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  let realPath;
-  try {
-    realPath = fs.realpathSync(linkPath);
-  } catch {
-    return { templateRoot: null, reason: `cannot resolve symlink target for ${linkPath}` };
-  }
-
-  let dir = path.dirname(realPath);
-  while (true) {
-    const pkgPath = path.join(dir, 'package.json');
-    if (fs.existsSync(pkgPath)) {
-      return verifyPackageDir(dir);
-    }
-
-    const parentDir = path.dirname(dir);
-    if (parentDir === dir) {
-      break;
-    }
-    dir = parentDir;
-  }
-
-  return { templateRoot: null, reason: `no package.json found above ${realPath}` };
-}
-
-function resolveWindowsTemplateRoot(name) {
-  let output;
-  try {
-    output = childProcess.execSync(`where ${name}`, {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe']
-    }).trim();
-  } catch {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  const wrapperPaths = output.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
-  if (wrapperPaths.length === 0) {
-    return { templateRoot: null, reason: 'not found in PATH' };
-  }
-
-  const wrapperPath = wrapperPaths.find(line => /\.cmd$/i.test(line)) || wrapperPaths[0];
-  const packageDir = path.join(path.dirname(wrapperPath), 'node_modules', '@fitlab-ai', 'agent-infra');
-  return verifyPackageDir(packageDir);
-}
-
-function resolveTemplateRoot() {
-  const resolver = process.platform === 'win32'
-    ? resolveWindowsTemplateRoot
-    : resolveUnixTemplateRoot;
-  const errors = [];
-
-  for (const name of ['ai', 'agent-infra']) {
-    const result = resolver(name);
-    if (result.templateRoot) {
-      return result.templateRoot;
-    }
-    errors.push({ name, reason: result.reason });
-  }
-
-  return { templateRoot: null, errors };
-}
-
 function isBinary(fp) {
   const fd = fs.openSync(fp, 'r');
   const buf = Buffer.alloc(8192);
@@ -1037,25 +947,14 @@ function syncTemplates(projectRoot, templateRootOverride) {
   const configPathRel = norm(path.relative(projectRoot, cfgPath));
   let templateRoot = templateRootOverride;
   if (!templateRoot) {
-    const resolvedTemplateRoot = resolveTemplateRoot();
-    if (typeof resolvedTemplateRoot === 'string') {
-      templateRoot = resolvedTemplateRoot;
+    const packageResolution = resolveAgentInfraPackage({
+      startPath: path.join(projectRoot, '.agents', 'scripts', 'lib', 'agent-infra-package.js')
+    });
+    if (packageResolution.templateRoot && fs.existsSync(packageResolution.templateRoot)) {
+      templateRoot = packageResolution.templateRoot;
     } else {
-      const details = resolvedTemplateRoot.errors
-        .map(({ name, reason }) => `  - ${name}: ${reason}`)
-        .join('\n');
       return {
-        error: [
-          'Template source not found.',
-          '',
-          'Attempted binary lookups:',
-          details,
-          '',
-          'Please ensure agent-infra is installed and available on PATH.',
-          'If already installed, upgrade to the latest version or reinstall:',
-          '  npm install -g @fitlab-ai/agent-infra',
-          '  brew upgrade fitlab-ai/agent-infra/agent-infra || brew install fitlab-ai/agent-infra/agent-infra'
-        ].join('\n')
+        error: formatAgentInfraPackageError(packageResolution)
       };
     }
   }
@@ -1073,6 +972,19 @@ function syncTemplates(projectRoot, templateRootOverride) {
   const managed = [...(cfg.files.managed || [])];
   const merged  = [...(cfg.files.merged  || [])];
   const ejected = [...(cfg.files.ejected || [])];
+  const guardedManaged = new Set((DEFAULTS.files.guardedManaged || []).map(norm));
+  const managedBaselines = cfg.files.managedBaselines && typeof cfg.files.managedBaselines === 'object'
+    && !Array.isArray(cfg.files.managedBaselines)
+    ? { ...cfg.files.managedBaselines }
+    : {};
+  let baselinesChanged = false;
+
+  for (const target of Object.keys(managedBaselines)) {
+    if (!guardedManaged.has(norm(target))) {
+      delete managedBaselines[target];
+      baselinesChanged = true;
+    }
+  }
 
   const report = {
     templateVersion: version,
@@ -1085,7 +997,17 @@ function syncTemplates(projectRoot, templateRootOverride) {
       errors: [],
       conflicts: []
     },
-    managed: { written: [], created: [], unchanged: [], skippedMerged: [], skippedPlatform: [], skippedTUI: [], removed: [] },
+    managed: {
+      written: [],
+      created: [],
+      unchanged: [],
+      protected: [],
+      conflicts: [],
+      skippedMerged: [],
+      skippedPlatform: [],
+      skippedTUI: [],
+      removed: []
+    },
     custom: {
       detected: [],
       generated: [],
@@ -1127,6 +1049,22 @@ function syncTemplates(projectRoot, templateRootOverride) {
   const allRels = mergedRels;
   const allSet = new Set(allRels);
 
+  function renderedTemplate(entry) {
+    const target = norm(renderPathname(entry, project));
+    const selected = platformSelect(
+      langSelect(entryVariantRels(entry, allSet, platformType), lang, allSet, project),
+      platformType,
+      project
+    );
+    const src = selected.get(target);
+    if (!src) return null;
+    const srcRoot = sourceMap.get(src) || templateRoot;
+    const srcFull = path.join(srcRoot, src);
+    return isBinary(srcFull)
+      ? fs.readFileSync(srcFull)
+      : renderContent(fs.readFileSync(srcFull, 'utf8'), vars);
+  }
+
   for (const entry of [...managed, ...merged, ...ejected]) {
     if (!isPathOwnedByOtherPlatform(entry, platformType)) continue;
 
@@ -1135,17 +1073,49 @@ function syncTemplates(projectRoot, templateRootOverride) {
       if (!fs.existsSync(dir)) continue;
 
       for (const filePath of walkDir(dir)) {
+        const relativeFile = norm(path.relative(projectRoot, filePath));
+        if (guardedManaged.has(relativeFile)) continue;
         fs.unlinkSync(filePath);
-        report.managed.removed.push(norm(path.relative(projectRoot, filePath)));
+        report.managed.removed.push(relativeFile);
       }
       removeEmptyDirs(dir);
       continue;
     }
 
-    const target = path.join(projectRoot, renderPathname(entry, project));
-    if (!fs.existsSync(target)) continue;
-    fs.unlinkSync(target);
-    report.managed.removed.push(norm(path.relative(projectRoot, target)));
+    const renderedTarget = norm(renderPathname(entry, project));
+    const target = path.join(projectRoot, renderedTarget);
+    if (!guardedManaged.has(renderedTarget)) {
+      if (!fs.existsSync(target)) continue;
+      fs.unlinkSync(target);
+      report.managed.removed.push(renderedTarget);
+      continue;
+    }
+
+    const baseline = trustedBaseline(managedBaselines[renderedTarget]);
+    const templateContent = renderedTemplate(entry);
+    const templateHash = templateContent === null ? null : sha256(templateContent);
+    const localHash = fs.existsSync(target) ? sha256(fs.readFileSync(target)) : null;
+    const safeToRemove = localHash !== null && (localHash === baseline || (!baseline && localHash === templateHash));
+
+    if (safeToRemove) {
+      fs.unlinkSync(target);
+      report.managed.removed.push(renderedTarget);
+      if (Object.prototype.hasOwnProperty.call(managedBaselines, renderedTarget)) {
+        delete managedBaselines[renderedTarget];
+        baselinesChanged = true;
+      }
+      continue;
+    }
+
+    if (localHash !== null || baseline !== null) {
+      report.managed.conflicts.push({
+        target: renderedTarget,
+        reason: localHash === null ? 'platform-switch-deleted' : 'platform-switch-modified',
+        baseline,
+        local: localHash,
+        template: templateHash
+      });
+    }
   }
 
   // Cleanup files owned by disabled built-in TUIs. Iterates managed + merged
@@ -1230,6 +1200,68 @@ function syncTemplates(projectRoot, templateRootOverride) {
         : renderContent(fs.readFileSync(srcFull, 'utf8'), vars);
 
       const exists = fs.existsSync(dstFull);
+      if (guardedManaged.has(tgt)) {
+        const rawBaseline = managedBaselines[tgt];
+        const baseline = trustedBaseline(rawBaseline);
+        const templateHash = sha256(content);
+        const localHash = exists ? sha256(fs.readFileSync(dstFull)) : null;
+
+        if (rawBaseline !== undefined && baseline === null) {
+          delete managedBaselines[tgt];
+          baselinesChanged = true;
+        }
+
+        if (baseline === null && localHash !== null && localHash !== templateHash) {
+          report.managed.conflicts.push({
+            target: tgt,
+            reason: 'unknown-origin',
+            baseline: null,
+            local: localHash,
+            template: templateHash
+          });
+          continue;
+        }
+
+        if (baseline !== null && templateHash === baseline && localHash !== baseline) {
+          report.managed.protected.push({
+            target: tgt,
+            reason: localHash === null ? 'user-deleted' : 'user-modified',
+            baseline,
+            local: localHash,
+            template: templateHash
+          });
+          continue;
+        }
+
+        if (baseline !== null && localHash !== baseline && templateHash !== baseline && localHash !== templateHash) {
+          report.managed.conflicts.push({
+            target: tgt,
+            reason: 'both-modified',
+            baseline,
+            local: localHash,
+            template: templateHash
+          });
+          continue;
+        }
+
+        if (localHash === templateHash) {
+          report.managed.unchanged.push(tgt);
+          if (managedBaselines[tgt] !== templateHash) {
+            managedBaselines[tgt] = templateHash;
+            baselinesChanged = true;
+          }
+          continue;
+        }
+
+        const dir = path.dirname(dstFull);
+        if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(dstFull, content);
+        managedBaselines[tgt] = templateHash;
+        baselinesChanged = true;
+        (exists ? report.managed.written : report.managed.created).push(tgt);
+        continue;
+      }
+
       if (exists) {
         const cur = bin ? fs.readFileSync(dstFull) : fs.readFileSync(dstFull, 'utf8');
         if (bin ? content.equals(cur) : content === cur) {
@@ -1355,10 +1387,16 @@ function syncTemplates(projectRoot, templateRootOverride) {
   cfg.files.managed = managed;
   cfg.files.merged  = merged;
   cfg.files.ejected = ejected;
+  if (Object.keys(managedBaselines).length > 0) {
+    cfg.files.managedBaselines = managedBaselines;
+  } else {
+    if (Object.prototype.hasOwnProperty.call(cfg.files, 'managedBaselines')) baselinesChanged = true;
+    delete cfg.files.managedBaselines;
+  }
   cfg.templateVersion = version;
   delete cfg.templateSource;
 
-  report.configUpdated = hasChanges || prevVersion !== version || hadTemplateSource || sandboxToolsMigrated;
+  report.configUpdated = hasChanges || baselinesChanged || prevVersion !== version || hadTemplateSource || sandboxToolsMigrated;
 
   fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');