@skaile/workspaces 5.12.0 → 5.14.0

package/dist/{chunk-TVAR4JHA.js → chunk-QAYL3PYY.js}

@@ -1,20 +1,20 @@
-import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, getStoreManifestsDir, missingLibraryDirMessage } from './chunk-C3BMXXTN.js';
-import { readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-7CR2OZPA.js';
-import { installTargetOf, canonicalEntryRef, deployAll, removeAsset, diffDeployedAgent, removeExcludedLeftovers, deployedAssetDrift, createScaffold, installAgent } from './chunk-NJV5SLEK.js';
+import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, getStoreManifestsDir, missingLibraryDirMessage } from './chunk-ODQGLELI.js';
+import { readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-NVO6WECE.js';
+import { installTargetOf, canonicalEntryRef, deployedAssetDrift, deployAll, removeAsset, diffDeployedAgent, createScaffold, installAgent } from './chunk-FD2IPIE2.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-7QWQTA5S.js';
-import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, computeHash, buildLockFile, writeLock, readLock, verifyLock, mergeLockFile, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-T5TSLSRO.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-SHQMPGOL.js';
-import { deployedBase, deployedDir, isDeployed, deployedPaths } from './chunk-PMECEZK3.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID, resolveAgentDefinitionDir, storeManifestSlug } from './chunk-PNOGX36L.js';
+import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-CNZI37HV.js';
+import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, computeHash, buildLockFile, writeLock, readLock, verifyLock, mergeLockFile, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-OX2W5YF3.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-TYUJPQNX.js';
+import { deployedBase, deployedDir, isDeployed, deployedPaths } from './chunk-D54T2F54.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID, resolveAgentDefinitionDir, storeManifestSlug } from './chunk-CAPKENNF.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
-import { DRIVER_TARGETS } from './chunk-CPSIPIX7.js';
-import { loadSkPublishManifest } from './chunk-CTP3XBMF.js';
-import { scanDirectory, parseRequires, dedupeRequirements } from './chunk-XTVSNWLL.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-PNTXHTBC.js';
+import { DRIVER_TARGETS } from './chunk-IG5LZ3WU.js';
+import { loadSkPublishManifest } from './chunk-IY5E7Y5W.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements } from './chunk-M3P4BYRK.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-J4OYIYFQ.js';
 import { spawnSync } from 'child_process';
-import { existsSync, rmSync, readdirSync, lstatSync, unlinkSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
+import { existsSync, rmSync, readdirSync, lstatSync, readFileSync, unlinkSync, mkdirSync, writeFileSync } from 'fs';
 import path, { resolve, dirname, sep, join, relative, posix } from 'path';
 import { gt } from 'semver';
 import { stringify, parse } from 'yaml';
@@ -693,7 +693,11 @@ function withKeptLockEntries(lock, kept) {
 }
 function relockedRefs(prev, next) {
   if (!prev) return [];
-  const fingerprint = (e) => [e.library?.version ?? "", e.library?.sha256 ?? e.sha256, e.source?.commit ?? ""].join("\0");
+  const fingerprint = (e, key) => [
+    e.library?.version ?? "",
+    e.library?.sha256 ?? e.sha256,
+    key.includes("#0.0.0-sha.") ? "" : e.source?.commit ?? ""
+  ].join("\0");
   const out = [];
   for (const [key, entry] of Object.entries(next.assets)) {
     if (entry.library?.installed) continue;
@@ -703,7 +707,8 @@ function relockedRefs(prev, next) {
       return o.kind === id.kind && o.name === id.name && o.publisher === id.publisher;
     });
     if (!before) continue;
-    if (before[0] !== key || fingerprint(before[1]) !== fingerprint(entry)) out.push(key);
+    if (before[0] !== key || fingerprint(before[1], before[0]) !== fingerprint(entry, key))
+      out.push(key);
   }
   return out;
 }
@@ -1001,7 +1006,11 @@ var AssetManager = class {
     for (const s of sources) {
       const slug = sourceCacheKey(s.url);
       if (repositories[slug]) continue;
-      repositories[slug] = { path: join(sourcesDir, slug), url: s.url };
+      repositories[slug] = {
+        path: join(sourcesDir, slug),
+        url: s.url,
+        ...s.publisher ? { publisher: s.publisher } : {}
+      };
     }
     const factory = resolveFactorySource();
     const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
@@ -1029,6 +1038,7 @@ var AssetManager = class {
         sourceUrl: decl.url ?? localPath,
         commit,
         tag: decl.branch,
+        ...decl.publisher ? { publisher: decl.publisher } : {},
         // A curated store manifest (`source manifest init` → the flat
         // `~/.skaile/store/manifests/<slug>.yaml`) is the authoritative inventory
         // for a foreign source. Point the walker at it so `add`/resolve honor the
@@ -1630,6 +1640,83 @@ var AssetManager = class {
       );
     }
   }
+  /**
+   * Refuse to deploy over a folder (or agent file) the project did not put there: it is on disk,
+   * but no lock entry of the same kind and name owns it, so it is the user's own work and the
+   * deploy would replace it and `remove` would delete it. Throws one line naming the folder.
+   *
+   * A folder the deploy would rewrite with the same content is adopted silently (the way back
+   * from `asset import`: the project's own copy is what the library now holds): every file in
+   * it is shipped by the asset with the same bytes, or the same body and an asset frontmatter
+   * that only adds to the folder's (import normalizes it). Nothing is lost then.
+   *
+   * @param incoming - Assets about to be deployed, with the entry whose bytes would be written
+   *   when there is one.
+   * @param owned - Assets the lock holds; one of the same kind and name, from any publisher,
+   *   owns the folder (a publisher clash is {@link assertNoFolderCollision}'s refusal).
+   */
+  assertNoUnownedFolder(incoming, owned) {
+    for (const { id: a, entry } of incoming) {
+      if (!a.kind || !a.name) continue;
+      const component = installTargetOf(this.registry, a.kind);
+      if (!component) continue;
+      const isOwned = owned.some(
+        (o) => !!o.kind && o.name === a.name && installTargetOf(this.registry, o.kind) === component
+      );
+      if (isOwned) continue;
+      for (const target of this.targetHarnesses()) {
+        const held = deployedPaths(component, a.name, target, this.global, this.projectDir).find(
+          (p) => existsSync(p)
+        );
+        if (!held) continue;
+        if (entry && this.deployWouldOnlyRewriteSame(entry, target)) continue;
+        const shown = this.global ? held : relative(this.projectDir, held);
+        throw new Error(
+          `${assetRefToStr({ kind: a.kind, name: a.name, publisher: a.publisher })} would overwrite ${shown}, which no lock entry owns (your own files?) \u2014 move it away, or pass --force to replace it`
+        );
+      }
+    }
+  }
+  /**
+   * Whether deploying `entry` over the folder already in `target` loses nothing: the folder
+   * holds no file the asset does not ship, and each of its files equals the asset's, or is a
+   * markdown file with the same body whose frontmatter the asset's only extends.
+   */
+  deployWouldOnlyRewriteSame(entry, target) {
+    const drift = deployedAssetDrift(entry, {
+      registry: this.registry,
+      driverTarget: target,
+      global: this.global,
+      cwd: this.projectDir
+    });
+    if (!drift || drift.extra.length > 0) return false;
+    if (drift.modified.length === 0) return true;
+    const component = installTargetOf(this.registry, entry.kind);
+    if (!component) return false;
+    const dest = deployedDir(component, entry.name, target, this.global, this.projectDir);
+    let assetRoot;
+    try {
+      assetRoot = lstatSync(entry.source).isDirectory() ? entry.source : dirname(entry.source);
+    } catch {
+      return false;
+    }
+    return drift.modified.every((rel) => {
+      if (!/\.md$/i.test(rel)) return false;
+      try {
+        const mine = parseFrontmatter(readFileSync(join(dest, rel), "utf8"));
+        const theirs = parseFrontmatter(readFileSync(join(assetRoot, rel), "utf8"));
+        if (mine.body !== theirs.body) return false;
+        const covered = (have, want) => Object.entries(have).every(([k, v]) => {
+          const w = want[k];
+          if (JSON.stringify(v) === JSON.stringify(w)) return true;
+          return k === "metadata" && !!v && typeof v === "object" && !!w && typeof w === "object" && covered(v, w);
+        });
+        return covered(mine.data, theirs.data);
+      } catch {
+        return false;
+      }
+    });
+  }
   /**
    * Open the local index and snapshot its libraries + asset definitions.
    * Best-effort: no index file (never indexed), or any open/guard failure,
@@ -2124,8 +2211,38 @@ var AssetManager = class {
       const id = refIdentity(m);
       return !lib.resolved.has(m) && !(id !== null && covered.has(id));
     });
+    this.keepUnchangedSourceVersions(resolved, [...deps, ...opts.declaredRefs ?? []]);
     return { resolved, missing: stillMissing, overridesApplied, lib, presets, requiredBy };
   }
+  /**
+   * A source asset without a declared version is keyed `0.0.0-sha.<repo commit>`, so every
+   * commit of its repo would re-key (and re-lock, and report as updated) every asset of
+   * that repo, changed or not. Keep the locked key and version of an asset whose files hash
+   * to what the lock holds: `update` then re-locks only what changed, as `outdated` lists.
+   * The commit stays the clone's, so the lock's `sources:` row still names the bytes' commit.
+   * A ref the user pinned (`#<version>`) keeps the version it names.
+   */
+  keepUnchangedSourceVersions(resolved, requested) {
+    const prev = this.tryReadLock();
+    if (!prev) return;
+    const pinned = /* @__PURE__ */ new Set();
+    for (const ref of requested) {
+      const id = refIdentity(ref);
+      if (id !== null && ref.includes("#")) pinned.add(id);
+    }
+    for (const c of resolved) {
+      if (!c.version.startsWith("0.0.0-sha.")) continue;
+      const id = `${c.publisher}/${c.kind}:${c.name}`;
+      if (pinned.has(id)) continue;
+      for (const [key, entry] of Object.entries(prev.assets)) {
+        const o = parseCanonicalLockKey(key);
+        if (o.kind !== c.kind || o.name !== c.name || o.publisher !== c.publisher) continue;
+        if (!o.version?.startsWith("0.0.0-sha.")) continue;
+        if (entry.source?.url === c.sourceUrl && entry.sha256 === c.sha256) c.version = o.version;
+        break;
+      }
+    }
+  }
   /** The catalog fetcher to use: an injected one, else built from `stores`. */
   storeFetcherFor(stores) {
     return this.injectedStoreFetcher ?? this.buildStoreFetcher(stores);
@@ -2328,7 +2445,11 @@ var AssetManager = class {
         };
       }
     }
-    const cloneError = this.ensureSourceClones(repositories, sources);
+    const cloneError = this.ensureSourceClones(
+      repositories,
+      sources,
+      opts?.moveLibraries ? void 0 : lockForLibraries
+    );
     if (cloneError) return cloneError;
     const provenanceIndex = await buildProvenanceIndex(this.buildClones(repositories), {
       projectDir: this.projectDir,
@@ -2357,7 +2478,8 @@ var AssetManager = class {
       const hints = {};
       for (const [m, parents] of unmetByNew) {
         const requirer = parents.map((p) => p.split("#")[0]).join(", ");
-        hints[m] = ` is required by ${requirer} (not found \u2014 ${REGISTER_HOLDER}, or drop ${requirer} with \`skaile remove ${parents[0].split("#")[0]}\`) \u2014 nothing was installed`;
+        const unreachable = [...this.storeFailures.values()];
+        hints[m] = unreachable.length > 0 ? ` is required by ${requirer} (store unreachable, so it was not looked up: ${unreachable.join("; ")} \u2014 check the URL with \`skaile catalog test\`) \u2014 nothing was installed` : ` is required by ${requirer} (not found \u2014 ${REGISTER_HOLDER}, or drop ${requirer} with \`skaile remove ${parents[0].split("#")[0]}\`) \u2014 nothing was installed`;
       }
       return {
         deployed: [],
@@ -2401,7 +2523,7 @@ var AssetManager = class {
         )
       )
     ];
-    let restored = this.restoredCopies(copyDrift, deployed);
+    const restored = this.restoredCopies(copyDrift, deployed);
     await this.renderDriverMcpConfig();
     const agentRender = await this.renderAgentInstances();
     const lockWanted = resolved.length > 0 || lib.entries.length > 0 || existsSync(this.lockPath);
@@ -2409,9 +2531,8 @@ var AssetManager = class {
     let relocked = [];
     let moved = [];
     if (lockWanted) {
-      const lockData = withKeptLockEntries(freshLock, kept);
+      const lockData = this.withRenderedAgents(withKeptLockEntries(freshLock, kept));
       relocked = relockedRefs(prevLock, lockData);
-      restored = [...restored, ...this.removeExcludedLeftovers(relocked)];
       moved = libraryMoves(prevLock, libraryLock);
       lockWritten = writeLock(this.lockPath, lockData);
     }
@@ -2488,13 +2609,25 @@ var AssetManager = class {
    * {@link InstallResult} describing the failed source on the first error, or
    * `null` when every clone succeeds.
    */
-  ensureSourceClones(repositories, sources) {
+  ensureSourceClones(repositories, sources, lock) {
     const pinBySlug = pinsBySlug(sources);
+    const lockedCommit = /* @__PURE__ */ new Map();
+    for (const s of lock?.sources ?? []) {
+      if (!/^0*$/.test(s.commit)) lockedCommit.set(sourceCacheKey(s.url), s.commit);
+    }
     for (const [name, decl] of Object.entries(repositories)) {
       try {
+        const declaredPin = pinBySlug.get(name);
+        let locked = decl.url && !decl.factory ? lockedCommit.get(name) : void 0;
+        if (locked && declaredPin === void 0) {
+          const dir = this.resolveRepoDir(decl, name);
+          const head = dir ? getRepoCommit(dir) : void 0;
+          if (dir && head && head !== locked && !isCommitOnRemote(dir, head)) locked = void 0;
+        }
         ensureRepo(decl, name, this.reposDir, {
           projectDir: this.projectDir,
-          pin: pinBySlug.get(name)
+          pin: declaredPin ?? locked,
+          ...declaredPin === void 0 && locked ? { strictPin: true } : {}
         });
       } catch (err) {
         return {
@@ -2773,7 +2906,7 @@ var AssetManager = class {
       const candidate = this.lockedCandidate(key, entry, repositories);
       if (!candidate) continue;
       candidates.push(candidate);
-      if (isFactoryUrl(candidate.sourceUrl) || this.candidateHasLocalBytes(candidate, repositories)) {
+      if (this.candidateHasLocalBytes(candidate, repositories)) {
         cloneOrigin[key] = entry;
       }
     }
@@ -2996,7 +3129,28 @@ var AssetManager = class {
         ...dependencies.map((d) => parseAssetRefLoose(d) ?? {})
       ]
     );
+    if (!opts?.force) {
+      this.assertNoUnownedFolder(
+        [
+          ...resolved.map((c) => ({
+            id: c,
+            entry: this.candidateToCatalogEntry(c, repositories)
+          })),
+          ...lib.entries.map((e) => ({ id: this.entryIdentity(e), entry: e }))
+        ],
+        [
+          ...Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey),
+          ...dependencies.map((d) => parseAssetRefLoose(d) ?? {})
+        ]
+      );
+    }
     if (missing.length > 0) {
+      const unreachable = [...this.storeFailures.values()];
+      if (unreachable.length > 0) {
+        throw new Error(
+          `Store unreachable \u2014 ${ref.split("#")[0]} requires ${missing.join(", ")}, which was not looked up: ${unreachable.join("; ")}. Check the URL with \`skaile catalog test\`; a library or source can still hold the requirement \u2014 nothing was added`
+        );
+      }
       throw new Error(
         `${ref.split("#")[0]} requires ${missing.join(", ")} (not found \u2014 ${REGISTER_HOLDER}, or remove the requirement from the asset's manifest) \u2014 nothing was added`
       );
@@ -3035,7 +3189,7 @@ var AssetManager = class {
       if (opts?.onLibraryMoved) {
         for (const m of libraryMoves(prevLock, libraryLock)) opts.onLibraryMoved(m);
       }
-      writeLock(this.lockPath, mergeLockFile(prevLock, fresh));
+      writeLock(this.lockPath, mergeLockFile(prevLock, this.withRenderedAgents(fresh)));
     }
     for (const d of deployed) {
       appendHistory(this.projectDir, {
@@ -3548,7 +3702,13 @@ var AssetManager = class {
     for (const [name, decl] of Object.entries(repositories)) {
       const repoDir = this.resolveRepoDir(decl, name);
       if (!repoDir) continue;
-      all = [...all, ...await scanRepo(repoDir, name, { knownKinds: this.knownKinds })];
+      all = [
+        ...all,
+        ...await scanRepo(repoDir, name, {
+          knownKinds: this.knownKinds,
+          declaredPublisher: decl.publisher
+        })
+      ];
     }
     if (kind) all = all.filter((e) => e.kind === kind);
     if (query) {
@@ -3593,7 +3753,10 @@ var AssetManager = class {
     for (const [name, decl] of Object.entries(repositories)) {
       const repoDir = this.resolveRepoDir(decl, name);
       if (!repoDir) continue;
-      const entries = await scanRepo(repoDir, name, { knownKinds: this.knownKinds });
+      const entries = await scanRepo(repoDir, name, {
+        knownKinds: this.knownKinds,
+        declaredPublisher: decl.publisher
+      });
       const match = entries.find(
         (e) => e.kind === parsed.kind && e.name === parsed.name && (!parsed.publisher || e.publisher === parsed.publisher)
       );
@@ -4398,8 +4561,14 @@ var AssetManager = class {
       stores,
       declaredRefs: dependencies
     });
+    this.assertSourceCommitsPublished(resolved, repositories);
     const libraryLock = await this.libraryLockEntries(lib);
     const lockData = buildLockFile(resolved, overridesApplied, libraryLock);
+    const prior = this.tryReadLock();
+    for (const [key, entry] of Object.entries(lockData.assets)) {
+      const rendered = prior?.assets[key]?.rendered;
+      if (rendered) entry.rendered = rendered;
+    }
     writeLock(this.lockPath, lockData);
     return lockData;
   }
@@ -4643,7 +4812,19 @@ var AssetManager = class {
       }
       const asset = lockIdentity(i.assetKind, i.assetName);
       const dep = `${i.depKind}:${i.depName}`;
-      if (i.inRepos) {
+      const depId = /^@([^/]+)\/(.+)$/.exec(i.depName);
+      const lockedOnly = lockedIds.some(
+        (id) => id.kind === i.depKind && id.name === (depId ? depId[2] : i.depName) && (!depId || id.publisher === depId[1])
+      );
+      if (lockedOnly) {
+        gaps.push({
+          type: "requires",
+          ref: dep,
+          asset,
+          reason: `is required by ${asset} but locked and not deployed (run skaile install --locked)`,
+          message: `${asset} requires ${dep} (run skaile install --locked)`
+        });
+      } else if (i.inRepos) {
         gaps.push({
           type: "requires",
           ref: dep,
@@ -4916,26 +5097,53 @@ var AssetManager = class {
     return gaps;
   }
   /**
-   * Remove the files a deploy never writes (`.env`, `.venv/`, `.pytest_cache/`, ...) from the
-   * deployed folders of re-locked assets, as {@link RestoredAsset} rows. The lock covers what
-   * the exclusion list leaves; the extras an older release copied are the owner's to drop, and
-   * this is the one point where they are: the lock was just rewritten.
-   *
-   * @param refs - Lock keys the install re-locked (hash or commit changed).
+   * Record, on every agent entry of `lock` that has none, the files the agent's harness
+   * rendering occupies and their sha256. Call it after the deploy, so the bytes hashed are the
+   * ones `install` just wrote; {@link lockedCopyDrift} compares later edits with them.
+   * Entries that carry a record (kept from an earlier lock) are left as they are.
    */
-  removeExcludedLeftovers(refs) {
-    const out = [];
-    for (const key of refs) {
+  withRenderedAgents(lock) {
+    if (this.global) return lock;
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (entry.rendered || entry.library?.installed) continue;
       const { kind, name } = parseCanonicalLockKey(key);
-      const component = kind ? this.installTarget(kind) : void 0;
-      if (!kind || !name || !component || component === "agent") continue;
-      const dest = deployedDir(component, name, this.driverTarget, this.global, this.projectDir);
-      const removed = removeExcludedLeftovers(dest);
-      if (removed.length === 0) continue;
-      const dir = relative(this.projectDir, dest).split(sep).join("/");
-      out.push({ ref: key, restored: [], removed: removed.map((f) => `${dir}/${f}`) });
+      if (!kind || !name || this.installTarget(kind) !== "agent") continue;
+      const rendered = this.renderedAgentFiles(name);
+      if (rendered.length > 0) entry.rendered = rendered;
     }
-    return out;
+    return lock;
+  }
+  /** The files of one agent's rendering for the active harness, project-relative, with sha256. */
+  renderedAgentFiles(name) {
+    const out = [];
+    const walk = (path2) => {
+      let stat;
+      try {
+        stat = lstatSync(path2);
+      } catch {
+        return;
+      }
+      if (stat.isSymbolicLink()) return;
+      if (stat.isDirectory()) {
+        for (const child of readdirSync(path2).sort()) walk(join(path2, child));
+      } else if (stat.isFile()) {
+        out.push({
+          path: relative(this.projectDir, path2).split(sep).join("/"),
+          sha256: computeHash(path2)
+        });
+      }
+    };
+    for (const path2 of deployedPaths("agent", name, this.driverTarget, false, this.projectDir)) {
+      walk(path2);
+    }
+    walk(
+      join(
+        dirname(deployedBase("agent", this.driverTarget, false, this.projectDir)),
+        CODEX_IDENTITY_DIR,
+        `${name}.md`
+      )
+    );
+    return out.sort((a, b) => a.path.localeCompare(b.path));
   }
   /**
    * The {@link RestoredAsset} rows for the drifted copies (see {@link lockedCopyDrift}) a
@@ -4946,6 +5154,10 @@ var AssetManager = class {
     const out = [];
     for (const d of drifts) {
       if (!rewritten.has(d.ref)) continue;
+      if (d.rendered) {
+        out.push({ ref: d.key, restored: [...d.modified], removed: [] });
+        continue;
+      }
       const { kind, name } = parseCanonicalLockKey(d.key);
       const component = kind ? this.installTarget(kind) : void 0;
       if (!kind || !name || !component) continue;
@@ -4973,8 +5185,10 @@ var AssetManager = class {
    * - A source asset is compared with the per-file hashes the lock records (modified files only:
    *   the lock lists what the source covers, not what the deploy copies).
    *
-   * An agent (rendered, not copied), a `--link` deploy, an asset with a configured patch, and a
-   * copy that is missing are not compared: other gaps cover them. Project mode only.
+   * A `--link` deploy, an asset with a configured patch, and a copy that is missing are not
+   * compared: other gaps cover them. An agent (rendered, not copied) is compared with the
+   * hashes of its rendered files the lock records (`LockEntry.rendered`); its `modified` paths
+   * are project-relative. Project mode only.
    */
   async lockedCopyDrift() {
     if (this.global) return [];
@@ -5028,6 +5242,24 @@ var AssetManager = class {
       if (modified.length > 0)
         out.push({ ref: refOf(key), key, modified, extra: [], library: false });
     }
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (!entry.rendered || entry.rendered.length === 0 || entry.library?.installed) continue;
+      const { kind, name } = parseCanonicalLockKey(key);
+      if (!kind || !name || this.installTarget(kind) !== "agent") continue;
+      if (patches[`${kind}:${name}`]) continue;
+      const modified = [];
+      for (const f of entry.rendered) {
+        const file = join(this.projectDir, f.path);
+        if (!existsSync(file)) continue;
+        try {
+          if (computeHash(file) !== f.sha256) modified.push(f.path);
+        } catch {
+          modified.push(f.path);
+        }
+      }
+      if (modified.length > 0)
+        out.push({ ref: refOf(key), key, modified, extra: [], library: false, rendered: true });
+    }
     return out;
   }
   /**
@@ -5045,7 +5277,7 @@ var AssetManager = class {
       if (!kind || !name || !component || named.has(`${kind}:${name}`)) continue;
       if (isDeployed(component, name, this.driverTarget, this.global, this.projectDir)) continue;
       const ref = publisher ? `${kind}:@${publisher}/${name}` : `${kind}:${name}`;
-      const reason = "is locked but its deployed copy is missing \u2014 run `skaile install`";
+      const reason = "is locked but its deployed copy is missing \u2014 run `skaile install --locked`";
       gaps.push({ type: "drift", ref, reason, message: `${ref} ${reason}` });
     }
     return gaps;
@@ -5096,7 +5328,12 @@ var AssetManager = class {
             manualFix: true
           };
         } else if (await this.declaredRefResolvable(d.ref)) {
-          gap = { type: "declared", reason: "is declared but not locked \u2014 run `skaile install`" };
+          const unmet = await this.unmetRequirementOf(d.ref);
+          gap = unmet ? {
+            type: "declared",
+            reason: `requires ${unmet} but no library or source holds it \u2014 ${REGISTER_HOLDER}, or drop ${d.ref.split("#")[0]} with \`skaile remove ${d.ref.split("#")[0]}\``,
+            manualFix: true
+          } : { type: "declared", reason: "is declared but not locked \u2014 run `skaile install`" };
         } else {
           gap = {
             type: "declared",
@@ -5138,6 +5375,38 @@ var AssetManager = class {
       return p !== null && p.kind === want.kind && p.name === want.name && (!want.publisher || !p.publisher || p.publisher === want.publisher);
     });
   }
+  /**
+   * The first requirement, direct or transitive, of the declared `ref` that no local source or
+   * library holds and that nothing in the project already provides — the case `install` ends
+   * with `Missing: … nothing was installed`. `undefined` when every requirement is held, when a
+   * store is declared (it may hold the requirement and a check never goes to the network), or
+   * when `ref` itself resolves to nothing.
+   */
+  async unmetRequirementOf(ref) {
+    if (this.loadConfig().stores.length > 0) return void 0;
+    const lockedIds = Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey);
+    const seen = /* @__PURE__ */ new Set();
+    const queue = [ref];
+    for (let cur = queue.shift(); cur !== void 0; cur = queue.shift()) {
+      const id = refIdentity(cur);
+      if (id !== null) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+      }
+      const entry = await this.info(cur);
+      if (!entry) {
+        if (cur === ref) return void 0;
+        const want = parseRefTolerant(cur);
+        const locked = want !== null && lockedIds.some(
+          (l) => l.kind === want.kind && l.name === want.name && (!want.publisher || l.publisher === want.publisher)
+        );
+        if (!locked) return cur;
+        continue;
+      }
+      queue.push(...libraryEntryDepRefs(entry));
+    }
+    return void 0;
+  }
   /**
    * Whether `skaile install` can resolve a declared ref: a source or library holds it, or the
    * project declares a store that may. The global catalog is not asked: a check never goes
@@ -5480,5 +5749,5 @@ var AssetManager = class {
 };
 
 export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName };
-//# sourceMappingURL=chunk-TVAR4JHA.js.map
-//# sourceMappingURL=chunk-TVAR4JHA.js.map
+//# sourceMappingURL=chunk-QAYL3PYY.js.map
+//# sourceMappingURL=chunk-QAYL3PYY.js.map