@iseoane/agent-depot 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-10-07
+
+### Changed
+
+- The TUI fills the terminal from startup, responds to resize, and restores the primary screen on exit.
+- Catalog keeps a stable list height while you move between Skills with different Package owners.
+- Catalog `a` marks or clears only visible loose Skills in the repository under the cursor. Marks in other repositories and filtered-out Skills stay unchanged.
+
+### Fixed
+
+- Catalog rows use readable contrast, one-line truncation, and compact Package badges. A separate panel explains the highlighted Skill's ownership.
+- Host-confirmed installed Packages disappear from Catalog. Selected-only Packages and Packages with unknown installation state remain visible.
+- Pi Git Package inspections read the installed checkout's origin, commit, and version without changing the checkout. Local modifications keep the Package installed but make version assessment unavailable.
+- Git Package updates require cached Source history to prove that the installed commit precedes the available commit. Different or locally divergent commits alone do not imply an update.
+- Tests isolate `PI_CODING_AGENT_DIR` so an inherited shell override cannot redirect fixtures to user state.
+
 ## [0.5.0] - 2026-10-06
 
 ### Added

package/dist/src/git-source.js

@@ -238,6 +238,27 @@ export class GitSourceSnapshotAccess {
             files: Object.freeze(files),
         });
     }
+    /** True only when the cached Source history proves `olderCommit` precedes `newerCommit`. */
+    async isAncestor(source, olderCommit, newerCommit) {
+        if (![olderCommit, newerCommit].every((commit) => /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/iu.test(commit))) {
+            return undefined;
+        }
+        try {
+            const destination = await this.requireMirror(source);
+            await this.runner.run("git", [
+                "--git-dir",
+                destination,
+                "merge-base",
+                "--is-ancestor",
+                olderCommit,
+                newerCommit,
+            ]);
+            return true;
+        }
+        catch {
+            return undefined;
+        }
+    }
     /** Resolves the selected ref to an immutable commit without refreshing the mirror. */
     async readResolvedCommit(source) {
         const destination = await this.requireMirror(source);

package/dist/src/package-flow.js

@@ -38,6 +38,7 @@ export function createPackageOperations(environment = {}) {
     const readHostView = () => readHostInstallView({
         ...(environment.homeDirectory === undefined ? {} : { homeDirectory: environment.homeDirectory }),
         ...(environment.readHostStateFile === undefined ? {} : { readHostStateFile: environment.readHostStateFile }),
+        ...(environment.readPiCheckout === undefined ? {} : { readPiCheckout: environment.readPiCheckout }),
     });
     async function resolveSourceFor(projectSource) {
         return sourceOperations.resolveProjectSource
@@ -170,10 +171,15 @@ export function createPackageOperations(environment = {}) {
         const installed = bundle === undefined
             ? Object.freeze({ kind: "unknown", reason: drift ?? "the bundle could not be resolved" })
             : findInstalledBundle(view, bundle.descriptor, selection);
+        const installedCommitIsAncestor = bundle?.resolvedCommit === undefined || installed.kind !== "installed" || installed.commit === undefined
+            ? undefined
+            : await contentAccess.isCommitAncestor?.(bundle.source, installed.commit, bundle.resolvedCommit).catch(() => undefined);
         return Object.freeze({
             ...(bundle === undefined ? {} : { descriptor: bundle.descriptor }),
             installed,
             ...(bundle?.available === undefined ? {} : { available: bundle.available }),
+            ...(bundle?.resolvedCommit === undefined ? {} : { availableCommit: bundle.resolvedCommit }),
+            ...(installedCommitIsAncestor === true ? { installedCommitIsAncestor: true } : {}),
             approval,
             ...((drift ?? identityDrift) === undefined ? {} : { drift: drift ?? identityDrift }),
         });
@@ -181,11 +187,12 @@ export function createPackageOperations(environment = {}) {
     async function checkOne(record) {
         try {
             const inspection = await inspect(record.selection);
-            const status = classifyUpdate(inspection.installed, inspection.available);
+            const status = classifyUpdate(inspection.installed, inspection.available, inspection.availableCommit, inspection.installedCommitIsAncestor);
             return Object.freeze({
                 installed: record,
                 status,
                 ...(inspection.available === undefined ? {} : { available: inspection.available }),
+                ...(inspection.availableCommit === undefined ? {} : { availableCommit: inspection.availableCommit }),
                 ...(status === "unknown" ? { reason: inspection.drift ?? describeEvidence(inspection.installed) } : {}),
             });
         }
@@ -525,14 +532,14 @@ function installedEvidenceChange(previous, observed) {
     if (previous.kind === "absent") {
         return "changed";
     }
-    if (previous.version !== undefined && observed.version !== undefined) {
-        return sameAppVersion(previous.version, observed.version) ? "unchanged" : "changed";
-    }
     const previousCommit = previous.commit === undefined ? undefined : gitCommitId(previous.commit);
     const observedCommit = observed.commit === undefined ? undefined : gitCommitId(observed.commit);
     if (previousCommit !== undefined && observedCommit !== undefined) {
         return previousCommit === observedCommit ? "unchanged" : "changed";
     }
+    if (previous.version !== undefined && observed.version !== undefined) {
+        return sameAppVersion(previous.version, observed.version) ? "unchanged" : "changed";
+    }
     return "unknown";
 }
 /**
@@ -609,6 +616,8 @@ function hasControlCharacter(value) {
 function describeEvidence(evidence) {
     switch (evidence.kind) {
         case "installed": {
+            if (evidence.reason !== undefined)
+                return evidence.reason;
             if (evidence.version !== undefined) {
                 return `installed ${JSON.stringify(evidence.version)}`;
             }

package/dist/src/package-host-plans.js

@@ -124,13 +124,21 @@ export function packageApprovalDigest(declaration) {
 }
 /**
  * Compares installed evidence with available evidence. Manifest versions compare
- * through `sameAppVersion` and `compareAppVersions`; commits compare by equality.
- * A mixed pair, missing evidence, or an opaque version is `unknown`, never `current`.
+ * through `sameAppVersion` and `compareAppVersions`; differing commits compare only
+ * when cached Source history proves the installed commit is an ancestor.
  */
-export function classifyUpdate(installed, available) {
-    if (installed.kind !== "installed" || available === undefined) {
+export function classifyUpdate(installed, available, availableCommit, installedCommitIsAncestor) {
+    if (installed.kind !== "installed" || installed.reason !== undefined || available === undefined) {
         return "unknown";
     }
+    if (installed.commit !== undefined) {
+        const sourceCommit = availableCommit ?? (available.kind === "git-commit" ? available.commit : undefined);
+        if (sourceCommit === undefined)
+            return "unknown";
+        if (normalizeCommit(installed.commit) === normalizeCommit(sourceCommit))
+            return "current";
+        return installedCommitIsAncestor === true ? "update available" : "unknown";
+    }
     if (installed.version !== undefined && available.kind === "manifest-version") {
         if (sameAppVersion(installed.version, available.version)) {
             return "current";
@@ -141,11 +149,6 @@ export function classifyUpdate(installed, available) {
         }
         return order < 0 ? "update available" : "current";
     }
-    if (installed.commit !== undefined && available.kind === "git-commit") {
-        return normalizeCommit(installed.commit) === normalizeCommit(available.commit)
-            ? "current"
-            : "update available";
-    }
     return "unknown";
 }
 /** Validates one host argv with the shared portable-command rules. */

package/dist/src/package-host-state.js

@@ -1,6 +1,9 @@
-import { readFile } from "node:fs/promises";
+import { lstat, readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
+import { canonicalizeGitSourceUrl } from "./git-source.js";
+import { assertNoSymlinkPath } from "./path-safety.js";
+import { runProcess } from "./process-runner.js";
 /**
  * Reads the `packages` setting, or a bare `packages` array, into records.
  * Nothing here throws: an unknown entry shape becomes a drifted record so the
@@ -44,13 +47,15 @@ export function parseClaudeMarketplaceState(value) {
  */
 export async function readHostInstallView(env = {}) {
     const home = env.homeDirectory ?? homedir();
+    const piAgentDirectory = path.resolve(env.piAgentDirectory ?? process.env.PI_CODING_AGENT_DIR ?? path.join(home, ".pi", "agent"));
     const reader = env.readHostStateFile ?? ((filePath) => readFile(filePath, "utf8"));
     const [pi, claudePlugins, claudeMarketplaces] = await Promise.all([
-        readSection("pi-settings", path.join(home, ".pi", "agent", "settings.json"), reader, parsePiSettingsFile),
+        readSection("pi-settings", path.join(piAgentDirectory, "settings.json"), reader, parsePiSettingsFile),
         readSection("claude-installed-plugins", path.join(home, ".claude", "plugins", "installed_plugins.json"), reader, parseClaudePluginsFile),
         readSection("claude-known-marketplaces", path.join(home, ".claude", "plugins", "known_marketplaces.json"), reader, parseClaudeMarketplacesFile),
     ]);
-    return Object.freeze({ pi, claudePlugins, claudeMarketplaces });
+    const verifiedPi = await attachPiCheckoutEvidence(pi, piAgentDirectory, env.readPiCheckout ?? readPiCheckoutEvidence);
+    return Object.freeze({ pi: verifiedPi, claudePlugins, claudeMarketplaces });
 }
 /**
  * What the host says about one bundle. Pi identity is the repository URL without
@@ -62,6 +67,9 @@ export function findInstalledBundle(view, descriptor, selection) {
     if (descriptor.host !== selection.host) {
         return unknownEvidence("the bundle descriptor and the selection disagree on the host");
     }
+    if (selection.host === "pi" && (descriptor.coordinates.host !== "pi" || descriptor.coordinates.root !== selection.root)) {
+        return unknownEvidence("the Pi bundle root and the selection disagree");
+    }
     return selection.host === "pi"
         ? findPiInstalled(view.pi, selection)
         : findClaudeInstalled(view, descriptor, selection);
@@ -126,7 +134,16 @@ function findPiInstalled(section, selection) {
     const wanted = normalizeRepository(identity);
     const match = section.records.find((record) => !record.drifted && normalizeRepository(record.identity) === wanted);
     if (match !== undefined) {
-        return installedEvidence(undefined, match.commit);
+        if (selection.root !== "") {
+            return unknownEvidence("Pi project-scoped and subdirectory package checkouts are not supported for version evidence");
+        }
+        if (match.checkoutIssue !== undefined) {
+            return installedEvidence(undefined, undefined, match.checkoutIssue);
+        }
+        if (match.checkoutCommit === undefined) {
+            return installedEvidence(undefined, undefined, `Pi reports this Package installed, but its checkout could not be verified. Version and update assessment are unavailable; inspect the configured checkout before updating.`);
+        }
+        return installedEvidence(match.checkoutVersion, match.checkoutCommit);
     }
     if (section.records.some((record) => record.drifted)) {
         return unknownEvidence(`${section.path} holds an entry whose shape could not be read, so the install cannot be verified`);
@@ -158,12 +175,119 @@ function findClaudeInstalled(view, descriptor, selection) {
     }
     return Object.freeze({ kind: "absent" });
 }
-function installedEvidence(version, commit) {
+function installedEvidence(version, commit, reason) {
     return Object.freeze({
         kind: "installed",
         ...(version === undefined || version === "" ? {} : { version }),
         ...(commit === undefined || commit === "" ? {} : { commit }),
+        ...(reason === undefined ? {} : { reason }),
+    });
+}
+async function attachPiCheckoutEvidence(section, agentDirectory, reader) {
+    const records = await Promise.all(section.records.map(async (record) => {
+        if (record.drifted || !record.identity.startsWith("git:"))
+            return record;
+        try {
+            const checkoutPath = piGitInstallPath(agentDirectory, record.identity);
+            const evidence = await reader(checkoutPath, record.identity);
+            return Object.freeze({
+                ...record,
+                ...(evidence.commit === undefined ? {} : { checkoutCommit: evidence.commit }),
+                ...(evidence.version === undefined ? {} : { checkoutVersion: evidence.version }),
+                ...(evidence.issue === undefined ? {} : { checkoutIssue: evidence.issue }),
+            });
+        }
+        catch (error) {
+            return Object.freeze({
+                ...record,
+                checkoutIssue: error instanceof Error ? error.message : "Pi Git checkout could not be verified",
+            });
+        }
+    }));
+    return Object.freeze({ ...section, records: Object.freeze(records) });
+}
+function piGitInstallPath(agentDirectory, identity) {
+    const source = identity.slice("git:".length);
+    let parsed;
+    try {
+        parsed = new URL(`https://${source}`);
+    }
+    catch {
+        throw new Error("the configured Pi Git source has no safe checkout path");
+    }
+    const segments = parsed.pathname.split("/").filter(Boolean).map((segment) => decodeURIComponent(segment));
+    const lastSegment = segments.at(-1);
+    if (lastSegment?.endsWith(".git"))
+        segments[segments.length - 1] = lastSegment.slice(0, -4);
+    if (segments.length < 2 || segments.some((segment) => segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\"))) {
+        throw new Error("the configured Pi Git source has no safe checkout path");
+    }
+    return path.resolve(agentDirectory, "git", parsed.hostname, ...segments);
+}
+async function readPiCheckoutEvidence(checkoutPath, sourceIdentity) {
+    const unavailable = (reason) => ({
+        issue: `Pi reports this Package installed, but ${reason}. Version and update assessment are unavailable; inspect the checkout before updating.`,
+    });
+    try {
+        await assertNoSymlinkPath(checkoutPath, "Pi package checkout path");
+        const root = await lstat(checkoutPath).catch((error) => {
+            if (isNotFound(error))
+                return undefined;
+            throw error;
+        });
+        if (root === undefined)
+            return unavailable("its configured Git checkout is missing");
+        if (!root.isDirectory())
+            return unavailable("its configured Git checkout is not a directory");
+        const [topLevel, origin, commit, status, manifest] = await Promise.all([
+            runPiGit(checkoutPath, ["rev-parse", "--show-toplevel"]),
+            runPiGit(checkoutPath, ["config", "--get", "remote.origin.url"]),
+            runPiGit(checkoutPath, ["rev-parse", "--verify", "HEAD^{commit}"]),
+            runPiGit(checkoutPath, ["status", "--porcelain", "--untracked-files=all"]),
+            runPiGit(checkoutPath, ["show", "HEAD:package.json"]),
+        ]);
+        const expectedRoot = path.resolve(checkoutPath);
+        if (path.resolve(topLevel) !== expectedRoot)
+            return unavailable("the package path is not the root of its Git checkout");
+        if (normalizeRepository(piSourceIdentityFromUrl(origin)) !== normalizeRepository(sourceIdentity)) {
+            return unavailable("the Git checkout origin does not match the selected Pi package Source");
+        }
+        if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/iu.test(commit))
+            return unavailable("the Pi checkout HEAD is not a full Git commit");
+        if (status !== "")
+            return unavailable("the Pi Git checkout has local modifications");
+        const packageJson = JSON.parse(manifest);
+        if (!isRecord(packageJson) || typeof packageJson.version !== "string" || packageJson.version.trim() === "") {
+            return { commit: commit.toLowerCase() };
+        }
+        return { commit: commit.toLowerCase(), version: packageJson.version };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "";
+        const reason = message.includes("timed out")
+            ? "Git checkout verification timed out"
+            : message.includes("symbolic link")
+                ? "the configured checkout path contains a symbolic link"
+                : "the Pi Git checkout could not be read safely";
+        return unavailable(reason);
+    }
+}
+async function runPiGit(checkoutPath, args) {
+    const result = await runProcess("git", ["-C", checkoutPath, ...args], {
+        captureStdout: true,
+        maxOutputBytes: 1024 * 1024,
+        maxStderrBytes: 8192,
+        timeoutMs: 3000,
     });
+    if (result.timedOut)
+        throw new Error("Pi checkout verification timed out");
+    if (result.outputTooLarge || result.code !== 0 || result.signal !== null)
+        throw new Error("Pi checkout verification command failed");
+    return result.stdout.toString("utf8").trim();
+}
+function piSourceIdentityFromUrl(origin) {
+    const canonical = canonicalizeGitSourceUrl(origin);
+    return `git:${canonical.replace(/^[a-z][a-z0-9+.-]*:\/\//iu, "")}`;
 }
 function unknownEvidence(reason) {
     return Object.freeze({ kind: "unknown", reason });

package/dist/src/package-owned-skills.js

@@ -21,12 +21,14 @@ export function activeBundles(bundles, selections, hostView) {
             continue;
         }
         const selection = packageSelectionFor(descriptor, source);
-        if (selectedKeys.has(selectionKey(selection))) {
-            active.push({ descriptor, reason: "selected" });
-            continue;
-        }
-        if (findInstalledBundle(hostView, descriptor, selection).kind === "installed") {
-            active.push({ descriptor, reason: "installed" });
+        const selected = selectedKeys.has(selectionKey(selection));
+        const installed = findInstalledBundle(hostView, descriptor, selection).kind === "installed";
+        if (selected || installed) {
+            active.push({
+                descriptor,
+                selection,
+                reason: selected ? (installed ? "selected-and-installed" : "selected") : "installed",
+            });
         }
     }
     return Object.freeze(active);

package/dist/src/process-runner.js

@@ -12,6 +12,12 @@ export function runProcess(command, args, options = {}) {
         let stderr = "";
         let stderrBytes = 0;
         let outputTooLarge = false;
+        let timedOut = false;
+        const timeout = options.timeoutMs === undefined ? undefined : setTimeout(() => {
+            timedOut = true;
+            child.kill();
+        }, options.timeoutMs);
+        timeout?.unref();
         child.stdout?.on("data", (chunk) => {
             stdoutBytes += chunk.length;
             if (options.maxOutputBytes !== undefined && stdoutBytes > options.maxOutputBytes) {
@@ -35,7 +41,9 @@ export function runProcess(command, args, options = {}) {
         });
         child.on("error", reject);
         child.on("close", (code, signal) => {
-            resolve({ code, signal, stdout: Buffer.concat(stdout), stderr, outputTooLarge });
+            if (timeout !== undefined)
+                clearTimeout(timeout);
+            resolve({ code, signal, stdout: Buffer.concat(stdout), stderr, outputTooLarge, ...(timedOut ? { timedOut: true } : {}) });
         });
     });
 }

package/dist/src/skill-discovery.js

@@ -73,6 +73,11 @@ export class NodeSourceContentAccess {
             resolvedVersion: Object.freeze({ kind: "git-commit", commit: snapshot.resolvedVersion }),
         });
     }
+    async isCommitAncestor(source, olderCommit, newerCommit) {
+        if (source.kind === "builtin")
+            return undefined;
+        return this.gitSnapshots.isAncestor(source, olderCommit, newerCommit);
+    }
     async readResolvedVersion(source) {
         if (source.kind === "builtin") {
             return AGENT_DEPOT_PACKAGE_VERSION === undefined

package/dist/src/tui/app.js

@@ -1,5 +1,5 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
-import { Box, Text, useApp, useStdout } from "ink";
+import { Box, Text, useApp, useWindowSize } from "ink";
 import { useCallback, useRef, useState } from "react";
 import { AGENT_DEPOT_PACKAGE_VERSION } from "../project-manifest.js";
 import { CatalogView } from "./catalog-view.js";
@@ -20,7 +20,7 @@ const TABS = [
 function hintsOf(view, catalogFocusedOnSource) {
     switch (view) {
         case "catalog":
-            return `j/k move · Enter expand · space mark · a all · i install · / filter${catalogFocusedOnSource ? " · s all sources" : ""} · q quit`;
+            return `j/k move · Enter expand · space mark · a repo · i install · / filter${catalogFocusedOnSource ? " · s all sources" : ""} · q quit`;
         case "installations":
             return "j/k move · Enter expand · space mark · a all · u uninstall · h add hosts · A adopt · q quit";
         case "profile":
@@ -31,7 +31,7 @@ function hintsOf(view, catalogFocusedOnSource) {
 }
 export function App({ operations, environment, onExit }) {
     const { exit } = useApp();
-    const { stdout } = useStdout();
+    const { columns, rows } = useWindowSize();
     const [capturing, setCapturing] = useState(false);
     // Updated synchronously by the views so keys in the same burst never see a stale capturing state.
     const capturingRef = useRef(false);
@@ -61,8 +61,8 @@ export function App({ operations, environment, onExit }) {
         else if (input === "5")
             showView("profile");
     });
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, color: theme.accent, children: ["Agent Depot", AGENT_DEPOT_PACKAGE_VERSION === undefined ? "" : ` v${AGENT_DEPOT_PACKAGE_VERSION}`] }), _jsx(Text, { children: TABS.map(([name, label], position) => (_jsxs(Text, { color: view === name ? theme.accent : theme.inactive, bold: view === name, children: [position > 0 ? " " : "", view === name ? `[${label}]` : ` ${label} `] }, name))) }), _jsx(Text, { color: theme.muted, children: separatorLine(stdout.columns) }), view === "sources" ? (_jsx(SourcesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange, onHintsChange: setSourcesHints, onOpenCatalog: (source) => {
-                    setCatalogSourceId(source.id);
-                    setView("catalog");
-                } })) : view === "installations" ? (_jsx(InstallationsView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "profile" ? (_jsx(ProfileView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "updates" ? (_jsx(UpdatesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : (_jsx(CatalogView, { operations: operations, sourceId: catalogSourceId, environment: environment, onCapturingChange: onCapturingChange })), _jsx(Text, { color: theme.muted, children: capturing ? "Enter submit · Esc cancel · y/n confirm · space toggle" : view === "sources" ? sourcesHints : hintsOf(view, catalogSourceId !== undefined) })] }));
+    return (_jsxs(Box, { flexDirection: "column", height: rows, children: [_jsxs(Text, { bold: true, color: theme.accent, children: ["Agent Depot", AGENT_DEPOT_PACKAGE_VERSION === undefined ? "" : ` v${AGENT_DEPOT_PACKAGE_VERSION}`] }), _jsx(Text, { children: TABS.map(([name, label], position) => (_jsxs(Text, { color: view === name ? theme.accent : theme.inactive, bold: view === name, children: [position > 0 ? " " : "", view === name ? `[${label}]` : ` ${label} `] }, name))) }), _jsx(Text, { color: theme.muted, children: separatorLine(columns) }), _jsx(Box, { flexDirection: "column", flexGrow: 1, children: view === "sources" ? (_jsx(SourcesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange, onHintsChange: setSourcesHints, onOpenCatalog: (source) => {
+                        setCatalogSourceId(source.id);
+                        setView("catalog");
+                    } })) : view === "installations" ? (_jsx(InstallationsView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "profile" ? (_jsx(ProfileView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "updates" ? (_jsx(UpdatesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : (_jsx(CatalogView, { operations: operations, sourceId: catalogSourceId, environment: environment, onCapturingChange: onCapturingChange })) }), _jsx(Text, { color: theme.muted, children: capturing ? "Enter submit · Esc cancel · y/n confirm · space toggle" : view === "sources" ? sourcesHints : hintsOf(view, catalogSourceId !== undefined) })] }));
 }

package/dist/src/tui/catalog-browse.js

@@ -1,4 +1,5 @@
-import { leavesOf, skillKey } from "./catalog-tree.js";
+import { packageOwnedSkillAction } from "./catalog-ownership.js";
+import { looseLeavesOf, skillKey } from "./catalog-tree.js";
 import { navigateTree } from "./tree-navigation.js";
 import { toggleNode } from "./tree.js";
 import { toggledMark } from "./view-state.js";
@@ -8,19 +9,40 @@ function markRow(context, row) {
         context.setMessage({ kind: "error", text: "Mark skills, not source rows" });
         return;
     }
+    if (row.node.data.ownedBy !== undefined) {
+        context.setMessage({ kind: "error", text: `Package-owned Skills cannot be marked. ${packageOwnedSkillAction(row.node.data.ownedBy)}` });
+        return;
+    }
     context.setMessage(undefined);
     context.marks.setMarked(toggledMark(context.marks.markedRef.current, row.node.id));
 }
-/** `a`: marks every listed Skill, or clears the marks when they are all marked already. */
-function markAllListed(context) {
-    const { markedRef, setMarked } = context.marks;
-    const leaves = leavesOf(context.navigation.latestRoots());
-    if (leaves.length === 0) {
-        context.setMessage({ kind: "error", text: "There are no skills to select" });
+/** `a`: marks the visible loose Skills in the highlighted Source, or clears those marks. */
+function markRepository(context, row, visible) {
+    const byId = new Map(visible.map((candidate) => [candidate.node.id, candidate]));
+    let ancestor = row;
+    while (ancestor !== undefined && ancestor.node.data.kind !== "source") {
+        ancestor = ancestor.parentId === undefined ? undefined : byId.get(ancestor.parentId);
+    }
+    if (ancestor?.node.data.kind !== "source") {
+        context.setMessage({ kind: "error", text: "Move to a Source, group, Package, or Skill row to select repository Skills" });
+        return;
+    }
+    const sourceId = ancestor.node.data.sourceId;
+    const keys = looseLeavesOf(context.navigation.latestRoots())
+        .filter((skill) => skill.sourceId === sourceId)
+        .map(skillKey);
+    if (keys.length === 0) {
+        context.setMessage({ kind: "error", text: "There are no visible loose skills in this repository" });
         return;
     }
     context.setMessage(undefined);
-    setMarked(leaves.every((skill) => markedRef.current.has(skillKey(skill))) ? new Set() : new Set(leaves.map(skillKey)));
+    const { markedRef, setMarked } = context.marks;
+    const next = new Set(markedRef.current);
+    if (keys.every((key) => next.has(key)))
+        keys.forEach((key) => next.delete(key));
+    else
+        keys.forEach((key) => next.add(key));
+    setMarked(next);
 }
 /** `i`: installs the highlighted bundle, or the marked Skills that are listed, or the highlighted one. */
 function chooseHosts(context, row) {
@@ -32,8 +54,12 @@ function chooseHosts(context, row) {
         return;
     }
     // Only what is listed installs: marks on Skills hidden by the filter are ignored.
-    const marked = leavesOf(context.navigation.latestRoots())
+    const marked = looseLeavesOf(context.navigation.latestRoots())
         .filter((skill) => context.marks.markedRef.current.has(skillKey(skill)));
+    if (marked.length === 0 && data.kind === "skill" && data.ownedBy !== undefined) {
+        context.setMessage({ kind: "error", text: packageOwnedSkillAction(data.ownedBy) });
+        return;
+    }
     const highlighted = data.kind === "skill" ? [data.skill] : [];
     const chosen = marked.length > 0 ? marked : highlighted;
     if (chosen.length === 0) {
@@ -60,7 +86,7 @@ export function handleCatalogBrowseKey(context, input, key) {
     else if (input === " " && row)
         markRow(context, row);
     else if (input === "a")
-        markAllListed(context);
+        markRepository(context, row, snapshot.visible);
     else if (input === "i" && context.ready && row)
         chooseHosts(context, row);
 }

package/dist/src/tui/catalog-ownership.js

@@ -0,0 +1,12 @@
+/** Compact badge for a Skill reserved by an active Package. */
+export function packageOwnerBadge(owner) {
+    return `${owner.host}:${owner.name}`;
+}
+/** Full reason shown outside the row so the row can stay one physical line. */
+export function packageOwnedSkillNotice(owner) {
+    return `Package-owned Skill: provided by the ${owner.host} Package ${owner.name}. Install or update the Package from its Package row.`;
+}
+/** Actionable refusal for attempts to install a Package-owned Skill as loose. */
+export function packageOwnedSkillAction(owner) {
+    return `Install or update the ${owner.host} Package ${owner.name} from its Package row.`;
+}

package/dist/src/tui/catalog-panel.js

@@ -1,9 +1,10 @@
 import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import { Box, Text } from "ink";
 import { describeSkills, HOST_CHOICES, SCOPE_CHOICES } from "./catalog-actions.js";
+import { packageOwnedSkillNotice, packageOwnerBadge } from "./catalog-ownership.js";
 import { skillKey } from "./catalog-tree.js";
 import { hasUnmanagedCopy } from "./catalog-installs.js";
-import { describeRow, UNMANAGED_MARKER } from "./catalog-tree.js";
+import { describeRow, truncateDescription, UNMANAGED_MARKER } from "./catalog-tree.js";
 import { isPackageMode, PackagePanel } from "./package-actions.js";
 import { HostChecklist, PreviewLines } from "./panel-parts.js";
 import { rowStyle } from "./theme.js";
@@ -17,10 +18,17 @@ export function CatalogRowLine({ row, selected, marked, installed }) {
     const { data } = row.node;
     const isGroup = data.kind === "source" || data.kind === "group";
     const ownedBy = data.kind === "skill" ? data.ownedBy : undefined;
-    return (_jsxs(Text, { ...rowStyle(selected), color: isGroup ? theme.group : ownedBy === undefined ? undefined : theme.inactive, children: [selected ? "> " : "  ", "  ".repeat(row.depth), data.kind === "skill" ? marked ? "[x] " : "[ ] " : "", describeRow(row), ownedBy === undefined ? null : _jsxs(Text, { color: theme.inactive, children: ["  ", "provided by the ", ownedBy.host, " Package ", ownedBy.name] }), data.kind === "skill" && hasUnmanagedCopy(data.skill, installed)
+    return (_jsxs(Text, { ...rowStyle(selected), color: isGroup ? theme.group : undefined, wrap: "truncate-end", children: [selected ? "> " : "  ", "  ".repeat(row.depth), data.kind === "skill" ? marked ? "[x] " : "[ ] " : "", data.kind === "skill" && ownedBy !== undefined
+                ? _jsxs(_Fragment, { children: [data.skill.name, _jsxs(Text, { color: theme.marker, children: ["  ", "[", packageOwnerBadge(ownedBy), "]"] }), "  ", truncateDescription(data.skill.description)] })
+                : describeRow(row), data.kind === "skill" && hasUnmanagedCopy(data.skill, installed)
                 ? _jsxs(Text, { color: theme.marker, children: ["  ", UNMANAGED_MARKER] })
                 : null] }));
 }
+/** Full Package ownership reason for the highlighted Skill, outside the one-line row. */
+export function CatalogSelectionHelp({ row, height }) {
+    const owner = row?.node.data.kind === "skill" ? row.node.data.ownedBy : undefined;
+    return (_jsx(Box, { flexDirection: "column", minHeight: height, children: owner === undefined ? null : _jsx(Text, { color: theme.marker, children: packageOwnedSkillNotice(owner) }) }));
+}
 /** The prompt of the install flow; browsing shows nothing. */
 export function ActionPanel({ mode }) {
     if (isPackageMode(mode))

package/dist/src/tui/catalog-state.js

@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useReducer, useRef, useState } from "react";
-import { packageSelectionFor } from "../package-model.js";
+import { packageSelectionFor, selectionKey } from "../package-model.js";
 import { projectSourceOf } from "../sources.js";
 import { filterReducer, initialFilter } from "./catalog-filter.js";
 import { loadInstalledSkills, NO_INSTALLED } from "./catalog-installs.js";
@@ -23,7 +23,7 @@ export function useCatalogSkills(operations, sourceId, all, env, reloadKey = 0)
                     : [sourceId];
                 const labels = new Map(sources.map((source) => [source.id, sourceLabel(source)]));
                 const skills = [];
-                const bundles = [];
+                let bundles = [];
                 const discovered = [];
                 const warnings = [];
                 try {
@@ -62,7 +62,12 @@ export function useCatalogSkills(operations, sourceId, all, env, reloadKey = 0)
                 // Ownership is selection- or host-gated, so a loose Skill stays normal until its Package is active.
                 let activeBundles = [];
                 try {
-                    activeBundles = (await packages.activeBundles(discovered)).map(bundle => bundle.descriptor);
+                    const active = await packages.activeBundles(discovered);
+                    const installedKeys = new Set(active
+                        .filter(bundle => bundle.reason === "installed" || bundle.reason === "selected-and-installed")
+                        .map(bundle => selectionKey(bundle.selection)));
+                    bundles = bundles.filter(entry => !installedKeys.has(selectionKey(entry.selection)));
+                    activeBundles = active.map(bundle => bundle.descriptor);
                 }
                 catch (error) {
                     const detail = error instanceof Error ? error.message : String(error);

package/dist/src/tui/catalog-tree.js

@@ -7,7 +7,7 @@ const DESCRIPTION_LIMIT = 60;
 export const UNMANAGED_MARKER = "on disk, unmanaged · adopt it from Installations";
 export const skillKey = (skill) => `skill:${skill.sourceId}:${skill.path}`;
 export const bundleKey = (entry) => `bundle:${entry.sourceId}:${entry.descriptor.host}:${bundleRoot(entry.descriptor.coordinates)}`;
-function truncate(text) {
+export function truncateDescription(text) {
     return text.length > DESCRIPTION_LIMIT ? `${text.slice(0, DESCRIPTION_LIMIT - 3)}...` : text;
 }
 /** A repository name, with directory and ref for scoped GitHub Sources. */
@@ -69,9 +69,13 @@ export function describeRow(row) {
     if (data.kind === "bundle") {
         return `Package ${data.entry.descriptor.name} (${data.entry.descriptor.host})  ${packageVersionLabel(data.entry.descriptor.version)}`;
     }
-    return `${data.skill.name}  ${truncate(data.skill.description)}`;
+    return `${data.skill.name}  ${truncateDescription(data.skill.description)}`;
 }
 /** The Skills under the tree's Sources, in display order. */
 export function leavesOf(roots) {
     return roots.flatMap((root) => (root.children ?? []).flatMap((child) => child.data.kind === "skill" ? [child.data.skill] : []));
 }
+/** Skills that can still be installed as loose Skills, excluding active Package-owned rows. */
+export function looseLeavesOf(roots) {
+    return roots.flatMap((root) => (root.children ?? []).flatMap((child) => child.data.kind === "skill" && child.data.ownedBy === undefined ? [child.data.skill] : []));
+}

package/dist/src/tui/catalog-view.js

@@ -1,12 +1,13 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Box, Text } from "ink";
+import { Box, Text, useWindowSize } from "ink";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { BROWSE } from "./catalog-actions.js";
 import { handleCatalogBrowseKey } from "./catalog-browse.js";
 import { filterSkills } from "./catalog-filter.js";
 import { handleCatalogActionKey } from "./catalog-flow.js";
 import { isInstalled } from "./catalog-installs.js";
-import { ActionPanel, CatalogHeader, CatalogRowLine } from "./catalog-panel.js";
+import { ActionPanel, CatalogHeader, CatalogRowLine, CatalogSelectionHelp } from "./catalog-panel.js";
+import { packageOwnedSkillNotice } from "./catalog-ownership.js";
 import { packageOperationsOf } from "./environment.js";
 import { handlePackageKey, isPackageMode, startPackageAction } from "./package-actions.js";
 import { ListFooter } from "./panel-parts.js";
@@ -18,8 +19,26 @@ import { useMarks, useMounted } from "./view-state.js";
 import { computeWindow, useListHeight } from "./window.js";
 import { useKeys } from "./keys.js";
 const NO_ENVIRONMENT = {};
+function wrappedLineCount(text, columns) {
+    let lines = 1;
+    let used = 0;
+    for (const word of text.split(" ")) {
+        const width = [...word].reduce((total, character) => total + ((character.codePointAt(0) ?? 0) > 0xff ? 2 : 1), 0);
+        if (used > 0 && used + 1 + width <= columns) {
+            used += 1 + width;
+            continue;
+        }
+        if (used > 0) {
+            lines += 1;
+            used = 0;
+        }
+        lines += Math.floor((width - 1) / columns);
+        used = ((width - 1) % columns) + 1;
+    }
+    return lines;
+}
 export function CatalogView({ operations, sourceId, onCapturingChange, environment, listHeight }) {
-    const height = useListHeight(listHeight, 6);
+    const { columns } = useWindowSize();
     const env = environment ?? NO_ENVIRONMENT;
     const [all, setAll] = useState(sourceId === undefined);
     const mounted = useMounted();
@@ -48,6 +67,10 @@ export function CatalogView({ operations, sourceId, onCapturingChange, environme
     const { restart } = navigation;
     useEffect(restart, [operations, sourceId, all, restart]);
     const { rows, index } = navigation;
+    const helpLines = state.status === "ready"
+        ? Math.max(1, ...state.activeBundles.map((owner) => wrappedLineCount(packageOwnedSkillNotice(owner), Math.max(columns, 1))))
+        : 1;
+    const height = useListHeight(listHeight, 6 + helpLines);
     const flow = {
         operations,
         env,
@@ -108,5 +131,5 @@ export function CatalogView({ operations, sourceId, onCapturingChange, environme
         return _jsxs(Text, { color: theme.error, children: ["Error: ", state.message] });
     const window = computeWindow(rows.length, index, height);
     const selectedCount = leavesOf(roots).filter((skill) => marks.marked.has(skillKey(skill))).length;
-    return (_jsxs(Box, { flexDirection: "column", children: [state.warnings.map((warning) => _jsx(Text, { color: theme.warning, children: warning }, warning)), _jsx(CatalogHeader, { scope: scope, listed: visible.length, installable: installable.length, total: skills.length, filter: filter.filter }), rows.slice(window.start, window.end).map((row, offset) => (_jsx(CatalogRowLine, { row: row, selected: window.start + offset === index, marked: marks.marked.has(row.node.id), installed: installed }, row.node.id))), _jsx(ListFooter, { indicator: window.indicator, selectedCount: selectedCount, message: message }), _jsx(ActionPanel, { mode: action })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [state.warnings.map((warning) => _jsx(Text, { color: theme.warning, children: warning }, warning)), _jsx(CatalogHeader, { scope: scope, listed: visible.length, installable: installable.length, total: skills.length, filter: filter.filter }), rows.slice(window.start, window.end).map((row, offset) => (_jsx(CatalogRowLine, { row: row, selected: window.start + offset === index, marked: marks.marked.has(row.node.id), installed: installed }, row.node.id))), _jsx(CatalogSelectionHelp, { row: rows[index], height: helpLines }), _jsx(ListFooter, { indicator: window.indicator, selectedCount: selectedCount, message: message }), _jsx(ActionPanel, { mode: action })] }));
 }

package/dist/src/tui/package-rows.js

@@ -10,6 +10,10 @@ export function packageVersionLabel(evidence) {
 export function installedEvidenceLabel(evidence) {
     switch (evidence.kind) {
         case "installed": {
+            if (evidence.reason !== undefined) {
+                const reason = evidence.reason.includes("local modifications") ? "local changes" : evidence.reason;
+                return `installed (version unavailable: ${reason})`;
+            }
             if (evidence.version !== undefined)
                 return `installed ${evidence.version}`;
             if (evidence.commit !== undefined)
@@ -46,7 +50,7 @@ export function packageRow(record, inspection) {
         name: inspection.descriptor?.name ?? describeCoordinates(record.selection),
         installed: installedEvidenceLabel(inspection.installed),
         available: packageVersionLabel(inspection.available),
-        status: classifyUpdate(inspection.installed, inspection.available),
+        status: classifyUpdate(inspection.installed, inspection.available, inspection.availableCommit, inspection.installedCommitIsAncestor),
         ...(inspection.drift === undefined ? {} : { drift: inspection.drift }),
     };
 }

package/dist/src/tui/render.js

@@ -3,6 +3,6 @@ import { render } from "ink";
 import { App } from "./app.js";
 /** Renders the TUI and resolves once the user exits it. */
 export async function renderTui(operations, environment) {
-    const instance = render(_jsx(App, { operations: operations, environment: environment }));
+    const instance = render(_jsx(App, { operations: operations, environment: environment }), { alternateScreen: true });
     await instance.waitUntilExit();
 }

package/dist/src/tui/window.js

@@ -1,4 +1,4 @@
-import { useStdout } from "ink";
+import { useWindowSize } from "ink";
 /** Rows assumed when the terminal size is unknown (for example under test renderers). */
 export const FALLBACK_TERMINAL_ROWS = 24;
 /** Lines the shell itself uses: title, tab bar, separator and footer hint. */
@@ -23,9 +23,8 @@ export function pageStep(height) {
  * view's own `reserved` lines. `override` fixes the height for tests.
  */
 export function useListHeight(override, reserved) {
-    const { stdout } = useStdout();
+    const { rows } = useWindowSize();
     if (override !== undefined)
         return Math.max(override, 1);
-    const rows = stdout.rows ?? FALLBACK_TERMINAL_ROWS;
-    return Math.max(rows - APP_CHROME_ROWS - reserved, MINIMUM_ROWS);
+    return Math.max((rows || FALLBACK_TERMINAL_ROWS) - APP_CHROME_ROWS - reserved, MINIMUM_ROWS);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iseoane/agent-depot",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "A cross-platform catalog for reusable coding-agent skills.",
   "license": "MIT",
   "author": "iseoane",