@skaile/workspaces 5.18.0 → 5.19.0

package/dist/cli/index.js

@@ -1,86 +1,88 @@
 #!/usr/bin/env node
+import { makeValidateCommand, scanIdentities, isRecord } from '../chunk-ZQSOJH6I.js';
 import { storeNotInstallableReason } from '../chunk-PUK7TQT4.js';
-import { makeProvidersCommand, loadRegistryView, addProviderEntry, ProviderRegistryWriteError } from '../chunk-FHIMIXT3.js';
-import { makeInstallCommand, makeCheckCommand, makeCleanCommand, reportRewritten, reportReplaced, reportRelocked, reportMoved, reportStoreNotChecked, globalProblems, editedConventionFiles, supportsInstallManifest, REF_HINT, reportInstalledSoftDeps } from '../chunk-EZVZDCHZ.js';
+import { makeProvidersCommand, loadRegistryView, addProviderEntry, ProviderRegistryWriteError, removeProviderEntry } from '../chunk-WG6V4ISA.js';
+import { makeInstallCommand, makeCheckCommand, makeCleanCommand, pinComposedAgents, reportRewritten, reportReplaced, reportRelocked, reportMoved, reportStoreNotChecked, globalProblems, editedConventionFiles, supportsInstallManifest, REF_HINT, reportInstalledSoftDeps } from '../chunk-FPHNJE4M.js';
 import { createSpinner } from '../chunk-NESV47MF.js';
-import { makeSourceCommand, syncProjectSources, divergedSourceClones } from '../chunk-JY7GVNYU.js';
-import { loadDeclaredPlugins } from '../chunk-JYWW32JI.js';
-import { makeValidateCommand, scanIdentities, isRecord } from '../chunk-24AXETE3.js';
-import { getStoreConfig, storeFetch, isStoreAuthenticated, getStoreToken } from '../chunk-E5YNGE3I.js';
-import { deviceLogin, loadStoreAuthConfig, logout, hasStoredAuth, exitOnLibrarySymlinks, resolveLibraryPublisherDetailed, getStoreIdentity, warnLibraryNameFallback, indexLibrary, warnIgnoredDomainFiles, removedDomainOption, rejectRemovedDomainOption, requireValidPublisherOrExit, exitOnManifestPublisherProblems, registerLibraryAsset, DOMAIN_REMOVED_HINT, reportLibrarySymlinks, checkAsset, manifestPublisherProblems, exitOnManifestRootProblems, manifestRequiresProblems, composeRefContext, registeredAssetKeys, checkAssetFile, assetEntryRef, duplicateAssetMessage, unresolvedManifestDependencies, warnLegacyBundleFiles, checkComposeKinds } from '../chunk-DA2MCPFN.js';
-import { openCatalogSource, LocalCatalogDisabledError, openLibraryManager, openLibrary } from '../chunk-FV2MSBVA.js';
-import { AI_RESOURCES } from '../chunk-CKBCX3HQ.js';
-import { logErr, S, logOk, logInfo, logWarn, TARGET_DEFAULT_HINT, parseHarnessFilter, requireProjectConfig, deferredWarnings, warnPlaceholderBodies, warnFilesOnlyDelegates, reportLegacyOmpCopies, logNoProject, warnLegacyClaudeCopies, kindColorPad, kindColor, colorRef, formatSoftDepSection, bareSoftDepName, formatSoftDepHint, formatRelativeTime, formatSoftDepRemovePreview, formatSoftDepAddPreview, fitWidth, KIND_COL_WIDTH } from '../chunk-K5LVU2MN.js';
-import { getKindRegistry, getKnownKinds } from '../chunk-WJLYL6RY.js';
+import { getStoreConfig, storeFetch, isStoreAuthenticated, getStoreToken } from '../chunk-25ZVWL2R.js';
+import { makeSourceCommand, syncProjectSources, divergedSourceClones } from '../chunk-RO6VOM6Z.js';
+import { deviceLogin, loadStoreAuthConfig, logout, hasStoredAuth, exitOnLibrarySymlinks, resolveLibraryPublisherDetailed, getStoreIdentity, warnLibraryNameFallback, indexLibrary, warnIgnoredDomainFiles, removedDomainOption, rejectRemovedDomainOption, requireValidPublisherOrExit, exitOnManifestPublisherProblems, findAssetManifestFile, checkAssetFile, registerLibraryAsset, DOMAIN_REMOVED_HINT, reportLibrarySymlinks, checkAsset, manifestPublisherProblems, exitOnManifestRootProblems, manifestRequiresProblems, composeRefContext, registeredAssetKeys, assetEntryRef, duplicateAssetMessage, unresolvedManifestDependencies, findEntryManifestFile, unheldRequiresOfFile, warnLegacyBundleFiles, checkComposeKinds } from '../chunk-WOIRYY5L.js';
+import { openCatalogSource, LocalCatalogDisabledError, openLibraryManager, openLibrary } from '../chunk-X4ZZTHU3.js';
+import { AI_RESOURCES } from '../chunk-2PBSAH3Z.js';
+import { loadDeclaredPlugins } from '../chunk-ZX4KRWRB.js';
+import { status, enable, disable, install, uninstall } from '../chunk-HU5HVKY7.js';
+import { logErr, S, logOk, logInfo, logWarn, TARGET_DEFAULT_HINT, parseHarnessFilter, requireProjectConfig, deferredWarnings, warnPlaceholderBodies, warnFilesOnlyDelegates, reportLegacyOmpCopies, logNoProject, warnLegacyClaudeCopies, kindColorPad, kindColor, colorRef, formatSoftDepSection, bareSoftDepName, formatSoftDepHint, formatRelativeTime, formatSoftDepRemovePreview, formatSoftDepAddPreview, fitWidth, KIND_COL_WIDTH } from '../chunk-QG6GHTRM.js';
+import { getKindRegistry, getKnownKinds } from '../chunk-F6AA42GW.js';
 import { LocalSecretsProvider } from '../chunk-ILFGVSTJ.js';
-import { resolveInstanceAgentDir, instanceSessionOverrides, runAgentChat, isCompositionError, resolveSessionId, loadSessionById, loadSession, listSessions, setCurrentSession, deleteSession, clearSession, loadAgentManifest, hashAgentFiles, createCompositionContentSource, compileComposition, manifestModelForDriver, instanceForSession, resolveAgentInstance, describeComposition, MarkdownStreamer, createFinalTextFallback } from '../chunk-V4RV2NJF.js';
-import { buildClaudePluginFiles } from '../chunk-ZNN7ONJX.js';
-import '../chunk-JJ7LDI3S.js';
-import '../chunk-RO2BPKXK.js';
-import '../chunk-RD6N2D7I.js';
+import { resolveInstanceAgentDir, instanceSessionOverrides, runAgentChat, isCompositionError, resolveSessionId, loadSessionById, loadSession, listSessions, setCurrentSession, deleteSession, clearSession, loadAgentManifest, hashAgentFiles, createCompositionContentSource, compileComposition, manifestModelForDriver, instanceForSession, resolveAgentInstance, describeComposition, MarkdownStreamer, createFinalTextFallback } from '../chunk-7NT4F6SR.js';
+import '../chunk-A6SMCEEE.js';
+import '../chunk-WST6UITC.js';
+import '../chunk-2LSDMJI2.js';
+import '../chunk-R4I3VBSS.js';
 import '../chunk-R6O6YWU7.js';
-import '../chunk-CD7SVH6W.js';
+import '../chunk-PYJS5K7V.js';
 import '../chunk-6Z5KTFJT.js';
 import '../chunk-4ZTPYIBE.js';
 import '../chunk-X5YPJV4N.js';
-import '../chunk-PZ6NF5DE.js';
+import '../chunk-XJVBUDDJ.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
 import '../chunk-O2SYFJWP.js';
-import '../chunk-LW7ZI6EQ.js';
+import '../chunk-Y5MBW5EU.js';
 import '../chunk-32NA4TVC.js';
 import '../chunk-W3UDISS2.js';
 import '../chunk-PHRNUTSG.js';
-import '../chunk-GRKU3S5V.js';
-import { runFlow, resumeFlow } from '../chunk-ODDATIII.js';
+import { runFlow, resumeFlow } from '../chunk-J24CY3PF.js';
 import '../chunk-4R6DROGN.js';
 import { parseSkillRequirements, validateRequirements } from '../chunk-FKU57Q5Q.js';
 import '../chunk-H6UVIKQ2.js';
-import '../chunk-EELKR2WP.js';
+import '../chunk-HT35SQZD.js';
 import '../chunk-YIF2IJUA.js';
-import '../chunk-WJCQFNF6.js';
-import { checkModelProvider, checkDriverModel } from '../chunk-L6IFN6ER.js';
-import '../chunk-3KMREAR2.js';
-import '../chunk-6HK6RUFM.js';
+import '../chunk-I7TWVK6N.js';
+import { checkModelProvider, checkDriverModel } from '../chunk-7SCS64BG.js';
+import '../chunk-COJIL7G4.js';
+import '../chunk-VJ7NU7GD.js';
+import '../chunk-VSZWNUZC.js';
 import '../chunk-LOO5CB5M.js';
 import '../chunk-AJ7EGIFR.js';
-import '../chunk-L5XUEC2W.js';
-import '../chunk-B4X2N7JQ.js';
+import '../chunk-MKRWN7XP.js';
+import '../chunk-2GXSSZAM.js';
+import '../chunk-RPZVHXQ3.js';
 import '../chunk-YROR332M.js';
-import '../chunk-YU6AURJY.js';
-import { listDrivers, getProviderPreset, AI_PROVIDER_PRESETS } from '../chunk-X54YR4AW.js';
+import '../chunk-XWOPZW26.js';
+import { listDrivers, getProviderPreset, AI_PROVIDER_PRESETS } from '../chunk-CQJH4G2K.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-IFGTRL2I.js';
-import { projectAiAssetsRoots, loadFlow, loadAllFlowEntries, findFlowFileInRoots } from '../chunk-D6UBEYQH.js';
+import { loadFlow, flowLookupRoots, findFlowFileInRoots, loadAllFlowEntries } from '../chunk-IF6IA3PZ.js';
 import '../chunk-M3WPBTGJ.js';
 import { nodeLabel, nodeSkillAsset, nodeIsInert, nodeIsOptional, nodeRunKind } from '../chunk-7RGTAEG6.js';
 import '../chunk-Y56YIT6J.js';
-import { LibraryEntryError, AssetManager, parseRefTolerant, MissingManifestError, normalizeRepoUrl, FACTORY_SOURCE_URL, parseCanonicalLockKey } from '../chunk-TDQ2ERCM.js';
-import { CatalogHttpError, libraryDirMissing, missingLibraryDirMessage, cloneOrInitGitRepo, trackOriginBranch, stampManifestPublisher, isGitRepo, ensureGitRepo, conflictingAssetRoot, setManifestPublisher, LIBRARY_OWNERSHIPS, assertManifestEditable, installLibraryAsset, getStoreManifestsDir, assertValidLibraryName, unparsableAssetFiles, syncManifestWithDisk, storeManifestFile, getDefaultValue, isSecretPlaceholder } from '../chunk-VKPBUPH7.js';
-import { flowFileNameError, SEMVER_RE } from '../chunk-HPVMTX6M.js';
-import '../chunk-U2FI547Z.js';
+import { LibraryEntryError, AssetManager, parseRefTolerant, MissingManifestError, parseCanonicalLockKey, normalizeRepoUrl, FACTORY_SOURCE_URL } from '../chunk-MRHVPQNO.js';
+import { CatalogHttpError, libraryDirMissing, missingLibraryDirMessage, cloneOrInitGitRepo, trackOriginBranch, stampManifestPublisher, isGitRepo, ensureGitRepo, conflictingAssetRoot, scanUnlistedAssets, setManifestPublisher, LIBRARY_OWNERSHIPS, assertManifestEditable, installLibraryAsset, getStoreManifestsDir, assertValidLibraryName, unparsableAssetFiles, syncManifestWithDisk, renamedLibraryName, storeManifestFile, getDefaultValue, isSecretPlaceholder } from '../chunk-XM6T2AZ2.js';
+import { flowFileNameError, SEMVER_RE } from '../chunk-I37INEWE.js';
+import '../chunk-7XSAW5OC.js';
 import '../chunk-BFMYYNDT.js';
 import '../chunk-3TXEJN4W.js';
 import '../chunk-ISHJITXJ.js';
 import '../chunk-LNFKL23K.js';
 import '../chunk-X3RMRJNR.js';
 import '../chunk-NUELZWCF.js';
-import { installTargetOf, SCAFFOLD_KINDS } from '../chunk-YZ3N7IUU.js';
+import { installTargetOf, SCAFFOLD_KINDS } from '../chunk-JTOWA6RS.js';
 import '../chunk-NOA6EJXE.js';
 import '../chunk-KTBKW2FI.js';
 import '../chunk-UQ6LFBPZ.js';
-import '../chunk-SRNCN4X2.js';
-import { effectiveComposes, validatePreset, validateAgent, composeSlotDiagnostics, agentDeprecationDiagnostics, SLOT_ID_PATTERN } from '../chunk-CKNIYIV2.js';
-import { loadSettings, globalSettingsPath, resolveSettings, projectSettingsPath, saveSettings, WorkspaceYamlEditor, resolveLibraryDir, checkAgentSkillConformance, resolveSettingsWithSources, readLock, globalInstallDir, GLOBAL_INSTALL_DIR_NAME, aiResourceRoots, workspaceProviderRegistryPath, userProviderRegistryPath, loadProviderRegistryFile } from '../chunk-T2TQAH2X.js';
+import '../chunk-C7WBGSBV.js';
+import { effectiveComposes, validatePreset, validateAgent, composeSlotDiagnostics, agentDeprecationDiagnostics, SLOT_ID_PATTERN } from '../chunk-335ENCCS.js';
+import { loadSettings, globalSettingsPath, resolveSettings, projectSettingsPath, saveSettings, WorkspaceYamlEditor, resolveLibraryDir, checkAgentSkillConformance, resolveSettingsWithSources, readLock, globalInstallDir, GLOBAL_INSTALL_DIR_NAME, workspaceProviderRegistryPath, userProviderRegistryPath, loadProviderRegistryFile, aiResourceRoots } from '../chunk-N46LQR46.js';
 import '../chunk-4GY63JU6.js';
-import { factoryAssetRoots } from '../chunk-KC6HGWXN.js';
+import { factoryAssetRoots } from '../chunk-TIIXG3PN.js';
 import { deployedDir } from '../chunk-5TBFN46Z.js';
 import { DEFAULT_DRIVER_ID, DRIVER_DEFAULTS } from '../chunk-5BEFNLOR.js';
-import { findKindDirs } from '../chunk-A2ULN3KX.js';
-import { SourceEntryError, resolveSkWorkspaceConfig, sourceCacheKey, getGlobalCacheDir, resolveAgentDir, AgentRefResolutionError, resolveAgentDefinitionDir, effectiveAgentInstances, matchPin, coerceVersion, loadSkWorkspaceConfig, isWorkspaceConfigFilename } from '../chunk-2NOLF7B2.js';
+import { findKindDirs } from '../chunk-MWXYN6NY.js';
+import { SourceEntryError, LegacyKeyError, resolveSkWorkspaceConfig, sourceCacheKey, getGlobalCacheDir, resolveAgentDir, AgentRefResolutionError, resolveAgentDefinitionDir, effectiveAgentInstances, matchPin, coerceVersion, loadSkWorkspaceConfig, isWorkspaceConfigFilename } from '../chunk-V257LUBM.js';
 import { globalCacheRoot, globalSkaileDir, userConfigPath } from '../chunk-L5VSIPQD.js';
 import { DRIVER_TARGETS, SUPPORTED_DRIVER_TARGETS, driverTargetForDriver } from '../chunk-IG5LZ3WU.js';
-import { SKAILE_MANIFEST_FILENAME, loadSkPublishManifest, decodeSkaileManifest, LIBRARY_GITIGNORE, librarySymlinkMessage, isNonAssetPath, isNonAssetDir, encodeSkaileManifest } from '../chunk-CKICWXMU.js';
+import { SKAILE_MANIFEST_FILENAME, loadSkPublishManifest, decodeSkaileManifest, LIBRARY_GITIGNORE, librarySymlinkMessage, isNonAssetPath, isNonAssetDir, encodeSkaileManifest } from '../chunk-UQ33Y4DM.js';
 import { pluginTitle } from '../chunk-RVRB27AN.js';
 import { dedupeRequirements, parseFrontmatter, scanDirectory, parseRequires } from '../chunk-GOCWM7FN.js';
 import { parseAssetRef, isValidPublisher, PUBLISHER_HINT, isValidAssetName, ASSET_NAME_HINT, depToStr, assetRefToStr, slugifyAssetName, parseAssetRefLoose } from '../chunk-WDXZA7QW.js';
@@ -90,8 +92,8 @@ import { parseModelRef, resolveEntryBaseUrl } from '../chunk-MJHSLODD.js';
 import '../chunk-C3CAXQMA.js';
 import { registerLogStore, LogStore, StdoutSink } from '../chunk-BOFL7GIF.js';
 import '../chunk-NSBPE2FW.js';
-import * as fs9 from 'fs';
-import fs9__default, { readFileSync, existsSync, mkdirSync, writeFileSync, lstatSync, rmSync, readdirSync, statSync } from 'fs';
+import * as fs8 from 'fs';
+import fs8__default, { readFileSync, existsSync, mkdirSync, writeFileSync, lstatSync, rmSync, readdirSync, statSync } from 'fs';
 import * as path18 from 'path';
 import path18__default, { resolve, join } from 'path';
 import { fileURLToPath } from 'url';
@@ -231,7 +233,7 @@ async function runSearch(kind, query, opts) {
   }
 }
 async function searchIndex(query, kind) {
-  const { openLibrary: openLibrary2 } = await import('../open-library-JP5TC5UX.js');
+  const { openLibrary: openLibrary2 } = await import('../open-library-PVTIUQUF.js');
   const library = await openLibrary2();
   try {
     const { libraryDirMissing: libraryDirMissing2 } = await import('../library/index.js');
@@ -383,14 +385,14 @@ async function expandCompetingOrigins(entries, projectDir) {
 }
 async function searchLocal(query, kind, opts, showStore, airGapped) {
   const projectDir = path18__default.resolve(opts.projectDir);
-  const { restoreSourceReaders } = await import('../source-FPLHY3DP.js');
+  const { restoreSourceReaders } = await import('../source-DGPCT5IC.js');
   for (const name of await restoreSourceReaders(projectDir)) {
     logInfo(`Re-registered source "${name}" (its library entry was removed elsewhere).`);
   }
   const factory = await searchFactory(projectDir, query, kind);
   let entries = unionEntries(await searchIndex(query, kind), factory);
   if (entries.length === 0 && !query && !kind && !airGapped) {
-    const { autoSyncForSearch } = await import('../source-FPLHY3DP.js');
+    const { autoSyncForSearch } = await import('../source-DGPCT5IC.js');
     if (await autoSyncForSearch(projectDir)) {
       entries = unionEntries(await searchIndex(query, kind), factory);
     }
@@ -504,7 +506,7 @@ async function searchStore(query, kind, opts, airGapped) {
     logInfo("air-gapped (cache_ttl: 0) \u2014 local sources only");
     return;
   }
-  const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-JP5TC5UX.js');
+  const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-PVTIUQUF.js');
   try {
     const remote = await openCatalogSource2({ projectDir: path18__default.resolve(opts.projectDir) });
     const assets = await remote.listAssets(kind ? { kind } : {});
@@ -673,6 +675,7 @@ function makeAddCommand() {
       });
       spinner.stop("Done");
       warnings.flush();
+      if (!am2.global) await pinComposedAgents(am2.projectDir);
       await promptSoftDepAdds(am2, ref, {
         isTTY: !!process.stdin.isTTY,
         link: opts.link,
@@ -685,10 +688,23 @@ function makeAddCommand() {
         onHint: (line) => logInfo(S.dim(line))
       });
       if (added.length === 0) {
-        const kind = parseAssetRef(ref).kind;
+        const parsedRef = parseAssetRef(ref);
+        const kind = parsedRef.kind;
         const presetNote = presetAddNote(ref, presets);
+        const mcpFootprint = kind === "mcp-server" ? await am2.mcpRenderFootprint(parsedRef.name) : void 0;
         if (presetNote) logInfo(presetNote);
-        else if (!installTargetOf(getKindRegistry(), kind))
+        else if (mcpFootprint?.written)
+          logInfo(
+            `Wrote ${S.cmd(`${mcpFootprint.file} entry "${parsedRef.name}"`)}${mcpFootprint.payloadDir ? ` and ${S.cmd(mcpFootprint.payloadDir)}` : ""}`
+          );
+        else if (mcpFootprint) {
+          const why = (await am2.mcpNotices()).find(
+            (n) => n.kind === "skipped" && n.id === parsedRef.name
+          );
+          logInfo(
+            `Recorded in skaile.yaml; ${mcpFootprint.file} has no entry for "${parsedRef.name}"${why?.reason ? ` (${why.reason})` : ""}.`
+          );
+        } else if (!installTargetOf(getKindRegistry(), kind))
           logInfo(
             `Recorded in skaile.yaml (store bytes are fetched + verified into .skaile/cache/store). ${kind} assets are not deployed into the driver target \u2014 they are composed when skaile runs the agent.`
           );
@@ -949,12 +965,21 @@ function readTextOrEmpty(file) {
     return "";
   }
 }
-function lockedVersionOf(projectDir, kind, name) {
+function infoShowsLocked(locked, latest) {
+  return locked !== void 0 && !locked.startsWith("0.0.0-sha") && latest !== void 0 && latest !== locked;
+}
+function infoVersionLine(locked, latest) {
+  if (infoShowsLocked(locked, latest)) return `locked ${locked} (latest ${latest})`;
+  return latest || void 0;
+}
+function lockedVersionOf(projectDir, kind, name, publisher) {
   try {
     const lock = readLock(path18__default.join(projectDir, "skaile.lock.yaml"));
     for (const key of Object.keys(lock?.assets ?? {})) {
       const id = parseCanonicalLockKey(key);
-      if (id.kind === kind && id.name === name && id.version) return id.version;
+      if (id.kind !== kind || id.name !== name || !id.version) continue;
+      if (publisher && id.publisher && id.publisher !== publisher.replace(/^@/, "")) continue;
+      return id.version;
     }
   } catch {
   }
@@ -989,7 +1014,7 @@ async function resolveInfoEntry(am2, ref, opts) {
     return { entry: match ?? deployed };
   }
   const lookup = opts.storeLookup ?? (async (filter) => {
-    const { resolveCatalogSource } = await import('../open-library-JP5TC5UX.js');
+    const { resolveCatalogSource } = await import('../open-library-PVTIUQUF.js');
     const { source, close } = await resolveCatalogSource({ projectDir: opts.projectDir });
     try {
       return await source.listAssets(filter);
@@ -1005,7 +1030,7 @@ async function resolveInfoEntry(am2, ref, opts) {
     );
     return { entry: hit ? catalogAssetToEntry(hit) : null };
   } catch (err) {
-    const { LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-JP5TC5UX.js');
+    const { LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-PVTIUQUF.js');
     const storeNote = err instanceof Error ? err.message : String(err);
     const disabled = err instanceof LocalCatalogDisabledError2 || /catalog\.url/i.test(storeNote);
     return { entry: null, storeNote, ...disabled ? { storeDisabled: true } : {} };
@@ -1041,10 +1066,19 @@ function makeInfoCommand() {
     console.log(`  ${S.heading(entry.name)}`);
     console.log(`  ${S.rule(40)}`);
     console.log(`  kind:        ${kindColor(entry.kind)}`);
-    if (entry.version) console.log(`  version:     ${entry.version}`);
+    const infoLocked = lockedVersionOf(
+      projectDir,
+      entry.kind,
+      entry.name,
+      parseRefTolerant(ref)?.publisher
+    );
+    const showLocked = infoShowsLocked(infoLocked, entry.version);
+    const infoVersionText = infoVersionLine(infoLocked, entry.version);
+    if (infoVersionText) console.log(`  version:     ${infoVersionText}`);
     if (entry.description) console.log(`  description: ${entry.description}`);
     if (entry.publisher) console.log(`  repository:  ${S.dim(entry.publisher)}`);
-    console.log(`  source:      ${S.dim(entry.source)}`);
+    const infoSource = showLocked && entry.source.endsWith(`#${entry.version}`) ? `${entry.source.slice(0, -`#${entry.version}`.length)}#${infoLocked}` : entry.source;
+    console.log(`  source:      ${S.dim(infoSource)}`);
     if (entry.kind === "mcp-server") {
       const skipped = (await am2.mcpNotices()).find(
         (n) => n.kind === "skipped" && (n.id === entry.name || n.id.endsWith(`/${entry.name}`))
@@ -1118,13 +1152,17 @@ function makeDoctorCommand() {
     });
     const { gaps } = await am2.projectState();
     const edited = await editedConventionFiles(path18__default.resolve(opts.projectDir));
-    const notices = await am2.mcpNotices();
+    const notices = [
+      ...(await am2.mcpNotices()).map((n) => n.text),
+      // A library that went back past the lock is no drift either (p1257).
+      ...await am2.libraryOlderNotices()
+    ];
     if (gaps.length === 0 && edited.length === 0) {
       logOk("No missing dependencies.");
-      for (const n of notices) logWarn(n.text);
+      for (const n of notices) logWarn(n);
       return;
     }
-    for (const n of notices) logWarn(n.text);
+    for (const n of notices) logWarn(n);
     process.exitCode = 1;
     for (const e of edited) logErr(e);
     for (const g of gaps) if (g.type !== "requires") logErr(g.message);
@@ -1156,16 +1194,16 @@ function claudeSkillRoots() {
 }
 function resolveImportSource(nameOrPath) {
   const asPath = path18.resolve(nameOrPath);
-  if (fs9.existsSync(asPath)) {
-    const dir = fs9.statSync(asPath).isDirectory() ? asPath : path18.dirname(asPath);
+  if (fs8.existsSync(asPath)) {
+    const dir = fs8.statSync(asPath).isDirectory() ? asPath : path18.dirname(asPath);
     const skillFile = path18.join(dir, "SKILL.md");
-    if (fs9.existsSync(skillFile)) return { dir, skillFile, via: "path" };
+    if (fs8.existsSync(skillFile)) return { dir, skillFile, via: "path" };
   }
   if (!nameOrPath.includes(path18.sep) && !nameOrPath.startsWith(".")) {
     for (const root of claudeSkillRoots()) {
       const dir = path18.join(root, nameOrPath);
       const skillFile = path18.join(dir, "SKILL.md");
-      if (fs9.existsSync(skillFile)) return { dir, skillFile, via: "claude-skills" };
+      if (fs8.existsSync(skillFile)) return { dir, skillFile, via: "claude-skills" };
     }
   }
   return null;
@@ -1304,7 +1342,7 @@ function makeAssetCommand() {
           );
           process.exit(1);
         }
-        const rawSkill = fs9.readFileSync(src.skillFile, "utf8");
+        const rawSkill = fs8.readFileSync(src.skillFile, "utf8");
         const norm = opts.normalize ? normalizeSkillContent(rawSkill, {
           fallbackName: path18.basename(src.dir),
           version: opts.version,
@@ -1316,7 +1354,7 @@ function makeAssetCommand() {
           );
         }
         const destDir = path18.join(target.path, norm.name);
-        if (fs9.existsSync(destDir)) {
+        if (fs8.existsSync(destDir)) {
           logErr(`Destination already exists: ${destDir}`);
           process.exit(1);
         }
@@ -1346,8 +1384,8 @@ function makeAssetCommand() {
         for (const f of checked.advisories) {
           logWarn(`${norm.name}/SKILL.md [${f.tag}] \u2014 ${f.text}`);
         }
-        fs9.cpSync(src.dir, destDir, { recursive: true, filter: copyFilter(src.dir) });
-        fs9.writeFileSync(path18.join(destDir, "SKILL.md"), norm.content, "utf8");
+        fs8.cpSync(src.dir, destDir, { recursive: true, filter: copyFilter(src.dir) });
+        fs8.writeFileSync(path18.join(destDir, "SKILL.md"), norm.content, "utf8");
         for (const note of norm.notes) logInfo(`  \u2022 ${note}`);
         const fm = parseFrontmatter(norm.content).data;
         for (const f of checkAgentSkillConformance(fm, { dirName: norm.name })) {
@@ -1387,7 +1425,7 @@ function makeAssetCommand() {
         logErr(`Invalid --mode "${opts.mode}". Expected: copy | move.`);
         process.exit(1);
       }
-      if (!fs9.existsSync(srcPath)) {
+      if (!fs8.existsSync(srcPath)) {
         logErr(`Source path does not exist: ${srcPath}`);
         process.exit(1);
       }
@@ -1415,9 +1453,9 @@ function makeAssetCommand() {
         }
         const basename3 = path18.basename(srcPath);
         const destDir = target.path;
-        fs9.mkdirSync(destDir, { recursive: true });
+        fs8.mkdirSync(destDir, { recursive: true });
         const destPath = path18.join(destDir, basename3);
-        if (fs9.existsSync(destPath)) {
+        if (fs8.existsSync(destPath)) {
           logErr(`Destination already exists: ${destPath}`);
           process.exit(1);
         }
@@ -1429,10 +1467,10 @@ function makeAssetCommand() {
         }
         switch (opts.mode) {
           case "copy":
-            fs9.cpSync(srcPath, destPath, { recursive: true, filter: copyFilter(srcPath) });
+            fs8.cpSync(srcPath, destPath, { recursive: true, filter: copyFilter(srcPath) });
             break;
           case "move":
-            fs9.renameSync(srcPath, destPath);
+            fs8.renameSync(srcPath, destPath);
             break;
         }
         if (target.backend === "git" && opts.commit) {
@@ -1448,7 +1486,7 @@ function makeAssetCommand() {
         }
         logOk(`Migrated ${basename3} \u2192 ${target.name} (${opts.mode})`);
         const publisher = loadSkPublishManifest(target.path)?.publisher ?? "<publisher>";
-        const migratedKind = fs9.existsSync(path18.join(destPath, "SKILL.md")) ? "skill" : "<kind>";
+        const migratedKind = fs8.existsSync(path18.join(destPath, "SKILL.md")) ? "skill" : "<kind>";
         logInfo(
           `Not addable yet: run ${S.cmd(`skaile library index ${target.name}`)}, then ${S.cmd(`skaile add ${migratedKind}:@${publisher.replace(/^@/, "")}/${basename3}`)}`
         );
@@ -1703,7 +1741,7 @@ function makeCatalogCommand() {
   return catalog;
 }
 async function runLocalCatalogTest(projectDir) {
-  const { resolveCatalogSource } = await import('../open-library-JP5TC5UX.js');
+  const { resolveCatalogSource } = await import('../open-library-PVTIUQUF.js');
   let resolved;
   try {
     resolved = await resolveCatalogSource({ projectDir });
@@ -1850,17 +1888,23 @@ complete -F _${bin}_completion ${bin}`,
 end
 complete -c ${bin} -f -a '(__${bin}_complete)'`
 };
-function discoverFlows(projectDir) {
+function flowsOfRoots(roots) {
   const byId = /* @__PURE__ */ new Map();
-  for (const root of aiResourceRoots(projectDir)) {
+  for (const root of roots) {
     for (const { flow } of loadAllFlowEntries(root)) {
       if (!byId.has(flow.id)) byId.set(flow.id, flow);
     }
   }
   return [...byId.values()];
 }
-function findFlowFile(flowId, priorityRoots = [], projectDir) {
-  return findFlowFileInRoots(flowId, [...priorityRoots, ...aiResourceRoots(projectDir)]);
+function discoverProjectFlows(projectDir) {
+  return flowsOfRoots(flowLookupRoots(projectDir));
+}
+function findProjectFlowFile(flowId, projectDir) {
+  return findFlowFileInRoots(flowId, flowLookupRoots(projectDir));
+}
+function discoverFlows(projectDir) {
+  return flowsOfRoots(aiResourceRoots(projectDir));
 }
 var libraryFlowEntriesCache;
 function libraryFlowEntries() {
@@ -1873,15 +1917,23 @@ async function scanLibraryFlowEntries() {
     const { LocalIndex, resolveIndexPath, scanAuthoringLibraries } = await import('../library/index.js');
     const indexPath = resolveIndexPath();
     if (!existsSync(indexPath)) return entries;
-    const { getKindRegistry: getKindRegistry2 } = await import('../open-registry-RBELV5YH.js');
+    const { getKindRegistry: getKindRegistry2 } = await import('../open-registry-SOIS3TA2.js');
     const index = new LocalIndex({ indexPath });
     try {
-      for (const { assets } of await scanAuthoringLibraries(index, getKindRegistry2())) {
+      for (const { library, assets } of await scanAuthoringLibraries(index, getKindRegistry2())) {
         for (const asset of assets) {
           if (asset.kind !== "flow") continue;
+          if (flowFileNameError(asset.manifest, path18__default.basename(asset.manifestPath))) continue;
           try {
             const flow = loadFlow(asset.manifestPath);
-            if (flow.id) entries.push({ flow, path: asset.manifestPath });
+            if (flow.id) {
+              entries.push({
+                flow,
+                path: asset.manifestPath,
+                ref: `flow:@${asset.publisher}/${asset.name}`,
+                library: library.name
+              });
+            }
           } catch {
           }
         }
@@ -1901,10 +1953,25 @@ async function discoverFlowsWithLibraries(projectDir) {
   }
   return [...byId.values()];
 }
-async function findFlowFileWithLibraries(flowId, priorityRoots = [], projectDir) {
-  const inRoots = findFlowFile(flowId, priorityRoots, projectDir);
-  if (inRoots) return inRoots;
-  return (await libraryFlowEntries()).find((e) => e.flow.id === flowId)?.path;
+async function discoverOtherFlows(projectDir) {
+  const inProject = new Set(discoverProjectFlows(projectDir).map((f) => f.id));
+  const libraryById = /* @__PURE__ */ new Map();
+  for (const entry of await libraryFlowEntries()) {
+    if (!libraryById.has(entry.flow.id)) libraryById.set(entry.flow.id, entry);
+  }
+  const others = [];
+  for (const flow of await discoverFlowsWithLibraries(projectDir)) {
+    if (inProject.has(flow.id)) continue;
+    const lib = libraryById.get(flow.id);
+    others.push({
+      flow,
+      ...lib ? { addRef: lib.ref, library: lib.library } : {}
+    });
+  }
+  return others;
+}
+async function findLibraryFlow(flowId) {
+  return (await libraryFlowEntries()).find((e) => e.flow.id === flowId);
 }
 function findSkills() {
   const found = [];
@@ -1923,11 +1990,11 @@ function findSkills() {
   return deduped;
 }
 function walkSkills(dir, out) {
-  for (const entry of fs9__default.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs8__default.readdirSync(dir, { withFileTypes: true })) {
     const full = path18__default.join(dir, entry.name);
     if (entry.isDirectory()) {
       const skillMd = path18__default.join(full, "SKILL.md");
-      if (fs9__default.existsSync(skillMd)) {
+      if (fs8__default.existsSync(skillMd)) {
         out.push({ name: entry.name, path: full, skillPath: skillMd });
       } else {
         walkSkills(full, out);
@@ -1942,16 +2009,16 @@ function resolveSkillNames() {
 }
 function resolveFlowIds() {
   try {
-    return discoverFlows().map((f) => f.id);
+    return discoverProjectFlows().map((f) => f.id);
   } catch {
     return [];
   }
 }
 function resolveSessionIds(projectDir) {
   const sessionsDir = path18__default.join(projectDir, ".skaile", "sessions");
-  if (!fs9__default.existsSync(sessionsDir)) return [];
+  if (!fs8__default.existsSync(sessionsDir)) return [];
   try {
-    return fs9__default.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -".json".length));
+    return fs8__default.readdirSync(sessionsDir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -".json".length));
   } catch {
     return [];
   }
@@ -2003,6 +2070,38 @@ function resolveDynamic(words, cword) {
   if (cmd === "config" && ["get", "set"].includes(sub) && isLast(3)) return CONFIG_KEYS;
   return null;
 }
+
+// cli/src/driver-error.ts
+function unknownDriverMessage(driver) {
+  const known = listDrivers().map((d) => d.id);
+  if (known.includes(driver)) return void 0;
+  return `Unknown agent driver: "${driver}". Available: ${known.join(", ")}`;
+}
+function friendlyDriverError(err) {
+  const e = err;
+  if (!e) return null;
+  const isSpawnEnoent = e.code === "ENOENT" && (e.syscall?.startsWith("spawn") === true || /^spawn .*ENOENT/.test(e.message ?? ""));
+  const isConfig = e.category === "config" || e.detail?.category === "config";
+  if (!isSpawnEnoent && !isConfig) return null;
+  const hint = e.hint ?? e.detail?.hint;
+  const base = hint ?? "The configured agent binary is not installed or not on your PATH.";
+  return `${base}
+Try a different harness with \`--driver claude-sdk\`.`;
+}
+function driverErrorNotes(err) {
+  const e = err;
+  const notes = [];
+  const category = e?.category ?? e?.detail?.category;
+  const hint = e?.hint ?? e?.detail?.hint;
+  if (hint && category !== "config") notes.push(hint);
+  else if (category === "auth") notes.push("Check your API key or login.");
+  if (e?.logSessionId) {
+    notes.push(`Full records: .skaile/logs.db (skaile session logs ${e.logSessionId}).`);
+  }
+  return notes;
+}
+
+// cli/src/commands/config.ts
 var PERSONAL_KEYS = /* @__PURE__ */ new Set(["driver", "model"]);
 var CATALOG_KEYS = /* @__PURE__ */ new Set(["catalog.url", "catalog.cache_ttl", "catalog.framing"]);
 async function setCatalogKey(key, raw) {
@@ -2017,10 +2116,10 @@ async function setCatalogKey(key, raw) {
     process.exit(1);
   }
   const filePath = userConfigPath();
-  const fs12 = await import('fs');
+  const fs11 = await import('fs');
   let existing = {};
-  if (fs12.existsSync(filePath)) {
-    const parsed = parseYaml3(fs12.readFileSync(filePath, "utf-8"));
+  if (fs11.existsSync(filePath)) {
+    const parsed = parseYaml3(fs11.readFileSync(filePath, "utf-8"));
     if (parsed && typeof parsed === "object") existing = parsed;
   }
   const catalog = {
@@ -2031,6 +2130,31 @@ async function setCatalogKey(key, raw) {
   logOk(`Set ${pc5.bold(key)} = ${String(checked.data[field])}`);
   console.log(S.dim(`  \u2192 ${filePath}`));
 }
+async function unsetCatalogKey(key) {
+  const { saveConfig } = await import('../library/index.js');
+  const { parse: parseYaml3 } = await import('yaml');
+  const field = key.slice("catalog.".length);
+  const filePath = userConfigPath();
+  const fs11 = await import('fs');
+  let existing = {};
+  if (fs11.existsSync(filePath)) {
+    const parsed = parseYaml3(fs11.readFileSync(filePath, "utf-8"));
+    if (parsed && typeof parsed === "object") existing = parsed;
+  }
+  const catalog = existing.catalog ?? {};
+  if (!(field in catalog)) {
+    logInfo(`${key} is not set in ${filePath}`);
+    return;
+  }
+  const { [field]: _removed, ...restCatalog } = catalog;
+  const { catalog: _catalog, ...rest } = existing;
+  saveConfig(
+    filePath,
+    Object.keys(restCatalog).length > 0 ? { ...rest, catalog: restCatalog } : rest
+  );
+  logOk(`Unset ${pc5.bold(key)} (the default applies again)`);
+  console.log(S.dim(`  \u2192 ${filePath}`));
+}
 var API_KEY_PREFIX = "apiKey.";
 function collectWorkspaceDefaults(projectDir) {
   const wsDefaults = {};
@@ -2162,6 +2286,26 @@ function setApiKeySugar(provider, value, projectDir) {
   );
   console.log(`  ${S.dim("Verify with:")} ${S.cmd(`skaile providers test ${provider}`)}`);
 }
+function unsetApiKeySugar(provider, projectDir) {
+  try {
+    const removed = removeProviderEntry(provider, { projectDir });
+    if (!removed) {
+      logInfo(`apiKey.${provider} is not set: the user registry has no provider '${provider}'`);
+      return;
+    }
+    logOk(
+      `Unset ${pc5.bold(`apiKey.${provider}`)}: removed ${pc5.bold(provider)} from the user registry`
+    );
+    console.log(S.dim(`  \u2192 ${removed.path}`));
+    if (removed.stillDefinedElsewhere) {
+      logInfo(`'${provider}' is still defined in another layer: run skaile providers list`);
+    }
+  } catch (error) {
+    if (!(error instanceof ProviderRegistryWriteError)) throw error;
+    logErr(error.message);
+    process.exit(1);
+  }
+}
 function makeConfigCommand() {
   const cmd = new Command("config").description("Manage personal config (.skaile/settings.json)");
   cmd.command("show").description("Show effective config with sources").option("--project-dir <path>", "Project directory").action((opts) => showConfig(opts));
@@ -2178,7 +2322,7 @@ function makeConfigCommand() {
     console.log(value ?? S.dim("(not set)"));
   });
   cmd.command("set <key> <value>").description(
-    "Set a personal config value (driver, model, apiKey.<provider>) or a catalog setting (catalog.url, catalog.cache_ttl, catalog.framing)"
+    "Set a personal config value (driver, model, apiKey.<provider>) or a catalog setting (catalog.url, catalog.cache_ttl, catalog.framing). `config unset <key>` removes every one of them again"
   ).option("--project-dir <path>", "Project directory").option("--global", "Write to ~/.skaile/settings.json instead of project-local").action(async (key, value, opts) => {
     const projectDir = opts.projectDir ? path18__default.resolve(opts.projectDir) : process.cwd();
     if (CATALOG_KEYS.has(key)) {
@@ -2208,9 +2352,9 @@ function makeConfigCommand() {
     }
     if (key === "driver") {
       await loadDeclaredPlugins(projectDir);
-      const known = listDrivers().map((d) => d.id);
-      if (!known.includes(value)) {
-        logErr(`Unknown agent driver: "${value}". Available: ${known.join(", ")}`);
+      const unknown = unknownDriverMessage(value);
+      if (unknown) {
+        logErr(unknown);
         process.exit(1);
       }
     }
@@ -2243,12 +2387,22 @@ function makeConfigCommand() {
       }
     }
   });
-  cmd.command("unset <key>").description("Remove a personal config value (driver, model) from the settings file").option("--project-dir <path>", "Project directory").option("--global", "Remove from ~/.skaile/settings.json instead of project-local").action(async (key, opts) => {
+  cmd.command("unset <key>").description(
+    "Remove a value that `config set` wrote: driver, model, apiKey.<provider> (removes the provider entry) or catalog.url, catalog.cache_ttl, catalog.framing (the default applies again)"
+  ).option("--project-dir <path>", "Project directory").option("--global", "Remove from ~/.skaile/settings.json instead of project-local").action(async (key, opts) => {
     const projectDir = opts.projectDir ? path18__default.resolve(opts.projectDir) : process.cwd();
+    if (CATALOG_KEYS.has(key)) {
+      await unsetCatalogKey(key);
+      return;
+    }
+    if (key.startsWith(API_KEY_PREFIX) && key.length > API_KEY_PREFIX.length) {
+      unsetApiKeySugar(key.slice(API_KEY_PREFIX.length), projectDir);
+      return;
+    }
     if (!PERSONAL_KEYS.has(key)) {
       logErr(
-        `'${key}' is not a personal setting that can be unset.
-  Personal keys: ${[...PERSONAL_KEYS].join(", ")}`
+        `'${key}' is not a setting that can be unset.
+  Keys: ${[...PERSONAL_KEYS].join(", ")}, ${API_KEY_PREFIX}<provider>, ${[...CATALOG_KEYS].join(", ")}`
       );
       process.exit(1);
     }
@@ -2904,7 +3058,7 @@ async function ensureTargetsRegistered(projectDir) {
   const { resolveSkWorkspaceConfig: resolveSkWorkspaceConfig2 } = await import('../core/index.js');
   const config = resolveSkWorkspaceConfig2(projectDir);
   if (config.plugins && config.plugins.length > 0) {
-    const { ensurePluginsLoaded } = await import('../plugin-store-QOQDM24E.js');
+    const { ensurePluginsLoaded } = await import('../plugin-store-G2GWAHSD.js');
     const result = await ensurePluginsLoaded(projectDir, config.plugins, pluginRegistry);
     for (const f of result.failed) logWarn(f.error);
   }
@@ -3056,7 +3210,7 @@ function makeDiffCommand() {
     }
     const result = await am2.diff(ref);
     const problems = gaps.filter(
-      (g) => !(result.status === "differs" && (g.type === "content" || g.type === "modified"))
+      (g) => !(result.status === "differs" && !result.fileSetDiffers && (g.type === "content" || g.type === "modified"))
     );
     switch (result.status) {
       case "not-found":
@@ -3088,26 +3242,52 @@ function makeDiffCommand() {
 }
 function makeFlowCommand() {
   const cmd = new Command("flow").description("Manage flows");
-  cmd.command("list").description("List available flows").option("--project-dir <path>", "Project directory", process.cwd()).action(async (opts) => {
-    const flows = await discoverFlowsWithLibraries(path18__default.resolve(opts.projectDir));
-    if (flows.length === 0) {
+  cmd.command("list").description("List the flows of this project").option("--project-dir <path>", "Project directory", process.cwd()).option("--all", "Also list the flows of registered libraries and cached sources").action(async (opts) => {
+    const projectDir = path18__default.resolve(opts.projectDir);
+    const flows = discoverProjectFlows(projectDir);
+    const others = opts.all ? await discoverOtherFlows(projectDir) : [];
+    if (flows.length === 0 && others.length === 0) {
       logInfo("No flows found.");
+      console.log(
+        `  ${S.dim(
+          opts.all ? "No registered library or source holds a flow either." : "Add one with skaile add flow:@<publisher>/<name>; skaile flow list --all also shows the flows of your libraries."
+        )}`
+      );
       return;
     }
+    const row = (id, name, description) => {
+      console.log(`  ${S.cmd(id.padEnd(24))} ${name}`);
+      if (description) console.log(`  ${"".padEnd(24)} ${S.dim(description)}`);
+    };
     console.log();
-    console.log(S.heading("  Available Flows"));
-    console.log(`  ${S.rule(50)}`);
-    for (const f of flows) {
-      console.log(`  ${S.cmd(f.id.padEnd(24))} ${f.name}`);
-      if (f.description) console.log(`  ${"".padEnd(24)} ${S.dim(f.description)}`);
+    if (flows.length > 0 || !opts.all) {
+      console.log(S.heading("  Available Flows"));
+      console.log(`  ${S.rule(50)}`);
+      for (const f of flows) row(f.id, f.name, f.description);
+      if (flows.length === 0) console.log(`  ${S.dim("No flow in this project.")}`);
+      console.log();
+    }
+    if (others.length > 0) {
+      console.log(S.heading("  Not in this project"));
+      console.log(`  ${S.rule(50)}`);
+      for (const o of others) {
+        row(o.flow.id, o.flow.name, o.flow.description);
+        const how = o.addRef ? `skaile add ${o.addRef}  (library ${o.library})` : "in a cached source or the global root; add it from its source";
+        console.log(`  ${"".padEnd(24)} ${S.dim(how)}`);
+      }
+      console.log();
     }
-    console.log();
   });
-  cmd.command("show <id>").description("Show flow details and node graph").option("--project-dir <path>", "Project directory", process.cwd()).action(async (id, opts) => {
-    const flows = await discoverFlowsWithLibraries(path18__default.resolve(opts.projectDir));
-    const flow = flows.find((f) => f.id === id);
+  cmd.command("show <id>").description("Show flow details and node graph").option("--project-dir <path>", "Project directory", process.cwd()).option("--all", "Also look in registered libraries and cached sources").action(async (id, opts) => {
+    const projectDir = path18__default.resolve(opts.projectDir);
+    const flow = discoverProjectFlows(projectDir).find((f) => f.id === id) ?? (opts.all ? (await discoverOtherFlows(projectDir)).find((o) => o.flow.id === id)?.flow : void 0);
     if (!flow) {
       logErr(`Flow not found: ${id}`);
+      if (!opts.all) {
+        console.log(
+          `  ${S.dim("Not in this project. skaile flow show <id> --all also looks in your libraries.")}`
+        );
+      }
       process.exit(1);
     }
     console.log();
@@ -3169,236 +3349,6 @@ function makeHistoryCommand() {
   return cmd;
 }
 var SKAILE_MCP_NAME = "skaile-workspace";
-var MCP_SERVER_ENTRY = {
-  command: "skaile",
-  args: ["mcp-server"],
-  env: {}
-};
-function mcpFilePath(projectDir) {
-  return path18__default.join(projectDir, ".mcp.json");
-}
-function legacyMcpFilePath(projectDir) {
-  return path18__default.join(projectDir, ".claude", "mcp.json");
-}
-async function removeSkaileMcpEntry(mcpPath) {
-  const mcp = await readJsonStrict(mcpPath);
-  if (!mcp?.mcpServers || !(SKAILE_MCP_NAME in mcp.mcpServers)) return false;
-  const { [SKAILE_MCP_NAME]: _removed, ...rest } = mcp.mcpServers;
-  const updated = { ...mcp, mcpServers: rest };
-  if (Object.keys(rest).length === 0) delete updated.mcpServers;
-  if (Object.keys(updated).length === 0) await fs5.unlink(mcpPath);
-  else await writeJson(mcpPath, updated);
-  return true;
-}
-function pluginDir(projectDir) {
-  return path18__default.join(projectDir, ".claude", "plugins", "skaile");
-}
-async function readJsonStrict(p6) {
-  let raw;
-  try {
-    raw = await fs5.readFile(p6, "utf-8");
-  } catch {
-    return null;
-  }
-  try {
-    return JSON.parse(raw);
-  } catch (e) {
-    throw new Error(
-      `cannot parse ${p6}: ${e instanceof Error ? e.message : String(e)}; please fix or remove`
-    );
-  }
-}
-async function writeJson(p6, value) {
-  await fs5.mkdir(path18__default.dirname(p6), { recursive: true });
-  await fs5.writeFile(p6, `${JSON.stringify(value, null, 2)}
-`);
-}
-var SKIPPED_IN_SKILL = /* @__PURE__ */ new Set(["__pycache__", "node_modules", ".DS_Store"]);
-async function copyInstalledSkills(projectDir, skillsDir) {
-  for (const entry of await fs5.readdir(skillsDir).catch(() => [])) {
-    if (entry !== ".gitkeep")
-      await fs5.rm(path18__default.join(skillsDir, entry), { recursive: true, force: true });
-  }
-  for (const root of [
-    path18__default.join(projectDir, ".claude", "skills"),
-    path18__default.join(projectDir, ".skaile", "skills")
-  ]) {
-    for (const name of await fs5.readdir(root).catch(() => [])) {
-      const from = path18__default.join(root, name);
-      if (!existsSync(path18__default.join(from, "SKILL.md"))) continue;
-      const to = path18__default.join(skillsDir, name);
-      await fs5.rm(to, { recursive: true, force: true });
-      await fs5.cp(from, to, {
-        recursive: true,
-        dereference: true,
-        filter: (src) => !SKIPPED_IN_SKILL.has(path18__default.basename(src))
-      });
-    }
-  }
-}
-async function install(projectDir, opts) {
-  return opts?.full ? installFullPlugin(projectDir) : installMcp(projectDir);
-}
-async function installMcp(projectDir) {
-  const mcpPath = mcpFilePath(projectDir);
-  const existing = await readJsonStrict(mcpPath) ?? {};
-  const mcpServers = { ...existing.mcpServers ?? {} };
-  const previous = mcpServers[SKAILE_MCP_NAME];
-  const matches = previous && JSON.stringify(previous) === JSON.stringify(MCP_SERVER_ENTRY);
-  let warning;
-  if (previous && !matches) {
-    warning = `overwrote existing ${SKAILE_MCP_NAME} entry in ${path18__default.relative(projectDir, mcpPath)}`;
-  }
-  mcpServers[SKAILE_MCP_NAME] = MCP_SERVER_ENTRY;
-  await writeJson(mcpPath, { ...existing, mcpServers });
-  const migrated = await removeSkaileMcpEntry(legacyMcpFilePath(projectDir));
-  return { changed: !matches || migrated, method: "mcp", warning };
-}
-async function dropSymlink(p6) {
-  const stat = await fs5.lstat(p6).catch(() => void 0);
-  if (stat?.isSymbolicLink()) await fs5.unlink(p6);
-}
-async function installFullPlugin(projectDir) {
-  const dir = pluginDir(projectDir);
-  await dropSymlink(dir);
-  await dropSymlink(path18__default.join(dir, "skills"));
-  for (const [rel, content] of Object.entries(buildClaudePluginFiles())) {
-    const dest = path18__default.join(dir, rel);
-    await fs5.mkdir(path18__default.dirname(dest), { recursive: true });
-    await fs5.writeFile(dest, content);
-  }
-  await copyInstalledSkills(projectDir, path18__default.join(dir, "skills"));
-  const settingsPath = path18__default.join(projectDir, ".claude", "settings.json");
-  const settings = await readJsonStrict(settingsPath) ?? {};
-  const plugins = settings.plugins ?? [];
-  if (!plugins.includes(dir)) plugins.push(dir);
-  await writeJson(settingsPath, { ...settings, plugins });
-  return { changed: true, method: "plugin" };
-}
-async function uninstall(projectDir) {
-  const settingsPath = path18__default.join(projectDir, ".claude", "settings.json");
-  const mcpPath = mcpFilePath(projectDir);
-  const dir = pluginDir(projectDir);
-  const rel = (p6) => path18__default.relative(projectDir, p6);
-  const files = [];
-  const settings = await readJsonStrict(settingsPath);
-  if (settings && Array.isArray(settings.plugins)) {
-    const next = settings.plugins.filter((p6) => p6 !== dir);
-    if (next.length !== settings.plugins.length) {
-      files.push(rel(settingsPath));
-      const updated = { ...settings, plugins: next };
-      if (next.length === 0) delete updated.plugins;
-      if (Object.keys(updated).length === 0) await fs5.unlink(settingsPath);
-      else await writeJson(settingsPath, updated);
-    }
-  }
-  if (existsSync(dir)) {
-    await fs5.rm(dir, { recursive: true, force: true });
-    files.push(rel(dir));
-  }
-  if (await removeSkaileMcpEntry(mcpPath)) files.push(rel(mcpPath));
-  const legacyPath = legacyMcpFilePath(projectDir);
-  if (await removeSkaileMcpEntry(legacyPath)) files.push(rel(legacyPath));
-  for (const emptyDir of [path18__default.dirname(dir), path18__default.join(projectDir, ".claude")]) {
-    await fs5.rmdir(emptyDir).catch(() => void 0);
-  }
-  return { changed: files.length > 0, files };
-}
-async function detectInstall(projectDir) {
-  const dir = pluginDir(projectDir);
-  const settings = await readJsonStrict(
-    path18__default.join(projectDir, ".claude", "settings.json")
-  );
-  if (existsSync(path18__default.join(dir, ".claude-plugin", "plugin.json")) && settings?.plugins?.includes(dir)) {
-    return { method: "plugin", pluginPath: dir };
-  }
-  const mcp = await readJsonStrict(mcpFilePath(projectDir));
-  if (mcp?.mcpServers && SKAILE_MCP_NAME in mcp.mcpServers) {
-    return { method: "mcp" };
-  }
-  return null;
-}
-async function enable(projectDir) {
-  const detected = await detectInstall(projectDir);
-  if (!detected) throw new Error("plugin not installed for claude-code");
-  const settingsPath = path18__default.join(projectDir, ".claude", "settings.json");
-  const settings = await readJsonStrict(settingsPath) ?? {};
-  if (detected.method === "plugin") {
-    const disabled2 = settings.disabledPlugins ?? [];
-    const next2 = disabled2.filter((p6) => p6 !== detected.pluginPath);
-    if (next2.length === disabled2.length) return { changed: false };
-    const updated2 = { ...settings, disabledPlugins: next2 };
-    if (next2.length === 0) delete updated2.disabledPlugins;
-    await writeJson(settingsPath, updated2);
-    return { changed: true };
-  }
-  const disabled = settings.disabledMcpjsonServers ?? [];
-  const next = disabled.filter((n) => n !== SKAILE_MCP_NAME);
-  if (next.length === disabled.length) return { changed: false };
-  const updated = { ...settings, disabledMcpjsonServers: next };
-  if (next.length === 0) delete updated.disabledMcpjsonServers;
-  await writeJson(settingsPath, updated);
-  return { changed: true };
-}
-async function disable(projectDir) {
-  const detected = await detectInstall(projectDir);
-  if (!detected) throw new Error("plugin not installed for claude-code");
-  const settingsPath = path18__default.join(projectDir, ".claude", "settings.json");
-  const settings = await readJsonStrict(settingsPath) ?? {};
-  if (detected.method === "plugin") {
-    const list2 = settings.disabledPlugins ?? [];
-    if (list2.includes(detected.pluginPath)) return { changed: false };
-    await writeJson(settingsPath, {
-      ...settings,
-      disabledPlugins: [...list2, detected.pluginPath]
-    });
-    return { changed: true };
-  }
-  const list = settings.disabledMcpjsonServers ?? [];
-  if (list.includes(SKAILE_MCP_NAME)) return { changed: false };
-  await writeJson(settingsPath, {
-    ...settings,
-    disabledMcpjsonServers: [...list, SKAILE_MCP_NAME]
-  });
-  return { changed: true };
-}
-async function status(projectDir) {
-  const settingsPath = path18__default.join(projectDir, ".claude", "settings.json");
-  const mcpPath = mcpFilePath(projectDir);
-  const dir = pluginDir(projectDir);
-  const settings = await readJsonStrict(settingsPath);
-  const mcp = await readJsonStrict(mcpPath);
-  const pluginInstalled = !!(existsSync(path18__default.join(dir, ".claude-plugin", "plugin.json")) && settings?.plugins?.includes(dir));
-  const mcpInstalled = !!(mcp?.mcpServers && SKAILE_MCP_NAME in mcp.mcpServers);
-  if (!pluginInstalled && !mcpInstalled) {
-    return {
-      harness: "claude-code",
-      installed: "no",
-      enabled: "n/a",
-      method: "\u2014",
-      location: "\u2014"
-    };
-  }
-  if (pluginInstalled) {
-    const disabled2 = settings?.disabledPlugins?.includes(dir) ?? false;
-    return {
-      harness: "claude-code",
-      installed: "yes",
-      enabled: disabled2 ? "no" : "yes",
-      method: "plugin",
-      location: path18__default.relative(projectDir, dir)
-    };
-  }
-  const disabled = settings?.disabledMcpjsonServers?.includes(SKAILE_MCP_NAME) ?? false;
-  return {
-    harness: "claude-code",
-    installed: "yes",
-    enabled: disabled ? "no" : "yes",
-    method: "mcp",
-    location: path18__default.relative(projectDir, mcpPath)
-  };
-}
-var SKAILE_MCP_NAME2 = "skaile-workspace";
 function buildEntry(projectDir) {
   return {
     command: "skaile",
@@ -3438,14 +3388,14 @@ async function install2(projectDir) {
   const cfg = await readConfig(p6) ?? {};
   const next = buildEntry(projectDir);
   const servers = { ...cfg.mcp_servers ?? {} };
-  const previous = servers[SKAILE_MCP_NAME2];
+  const previous = servers[SKAILE_MCP_NAME];
   const matches = previous && JSON.stringify(previous) === JSON.stringify(next);
   let warning;
   if (previous && !matches) {
-    warning = `overwrote existing ${SKAILE_MCP_NAME2} entry in ${path18__default.relative(projectDir, p6)}`;
+    warning = `overwrote existing ${SKAILE_MCP_NAME} entry in ${path18__default.relative(projectDir, p6)}`;
   }
   if (matches) return { changed: false, method: "toml" };
-  servers[SKAILE_MCP_NAME2] = next;
+  servers[SKAILE_MCP_NAME] = next;
   await writeConfig(p6, { ...cfg, mcp_servers: servers });
   return { changed: true, method: "toml", warning };
 }
@@ -3474,7 +3424,9 @@ async function trustLevel(projects, projectDir) {
   return { root, level: entry?.trust_level, known: entry !== void 0 };
 }
 async function trustEntry(projectDir) {
-  const root = await fs5.realpath(projectDir).catch(() => projectDir);
+  return trustEntryFor(await fs5.realpath(projectDir).catch(() => projectDir));
+}
+function trustEntryFor(root) {
   return `[projects.${JSON.stringify(root)}]
 trust_level = "trusted"`;
 }
@@ -3492,7 +3444,12 @@ async function trustProject(projectDir) {
   }
   await fs5.mkdir(path18__default.dirname(p6), { recursive: true });
   await fs5.writeFile(p6, next);
-  await writeTrustMark(projectDir, true);
+  await writeTrustMark(projectDir, [
+    .../* @__PURE__ */ new Set([
+      ...(await markedRoots(projectDir)).roots,
+      (await trustLevel(projects, projectDir)).root
+    ])
+  ]);
   return "added";
 }
 var TRUST_MARK = "codexTrustAdded";
@@ -3509,51 +3466,80 @@ async function readState(projectDir) {
   }
   return {};
 }
-async function writeTrustMark(projectDir, on) {
+async function markedRoots(projectDir) {
+  const mark = (await readState(projectDir))[TRUST_MARK];
+  if (mark === true) {
+    return { roots: [await fs5.realpath(projectDir).catch(() => projectDir)], legacy: true };
+  }
+  const list = typeof mark === "string" ? [mark] : Array.isArray(mark) ? mark : [];
+  return { roots: list.filter((r) => typeof r === "string"), legacy: false };
+}
+async function writeTrustMark(projectDir, roots) {
   const state2 = await readState(projectDir);
-  if (on) state2[TRUST_MARK] = true;
+  if (roots.length > 0) state2[TRUST_MARK] = roots;
   else delete state2[TRUST_MARK];
   await fs5.mkdir(path18__default.dirname(stateFilePath(projectDir)), { recursive: true });
   await fs5.writeFile(stateFilePath(projectDir), JSON.stringify(state2, null, 2));
 }
 async function untrustProject(projectDir) {
-  if ((await readState(projectDir))[TRUST_MARK] !== true) return "none";
+  const result = { removed: [], kept: [] };
+  const { roots, legacy } = await markedRoots(projectDir);
+  if (roots.length === 0) return result;
   const { path: p6, raw, projects } = await readUserConfig();
-  const kept = async () => {
-    await writeTrustMark(projectDir, false);
-    return "kept";
-  };
-  const { root } = await trustLevel(projects, projectDir);
-  const parsed = projects[root];
-  if (!parsed || Object.keys(parsed).length !== 1 || parsed.trust_level !== "trusted") {
-    return kept();
-  }
-  const entry = `${await trustEntry(projectDir)}
+  const current = await fs5.realpath(projectDir).catch(() => projectDir);
+  let text = raw;
+  for (const root of roots) {
+    const parsed = projects[root];
+    if (!parsed) {
+      if (legacy) result.kept.push({ root, reason: "absent" });
+      continue;
+    }
+    if (root !== current && await fs5.stat(root).then(() => true).catch(() => false)) {
+      result.kept.push({ root, reason: "in-use" });
+      continue;
+    }
+    if (Object.keys(parsed).length !== 1 || parsed.trust_level !== "trusted") {
+      result.kept.push({ root, reason: "edited" });
+      continue;
+    }
+    const entry = `${trustEntryFor(root)}
 `;
-  const at = raw.indexOf(entry);
-  if (at === -1) return kept();
-  const before = raw.slice(0, at).replace(/\n+$/, "");
-  const after = raw.slice(at + entry.length).replace(/^\n+/, "");
-  const next = [before, after].filter((s) => s !== "").join("\n\n");
-  try {
-    const left = parse$1(next).projects ?? {};
-    if (root in left) return kept();
-  } catch {
-    return kept();
+    const at = text.indexOf(entry);
+    if (at === -1) {
+      result.kept.push({ root, reason: "edited" });
+      continue;
+    }
+    const before = text.slice(0, at).replace(/\n+$/, "");
+    const after = text.slice(at + entry.length).replace(/^\n+/, "");
+    const next = [before, after].filter((s) => s !== "").join("\n\n");
+    try {
+      const left = parse$1(next).projects ?? {};
+      if (root in left) {
+        result.kept.push({ root, reason: "edited" });
+        continue;
+      }
+    } catch {
+      result.kept.push({ root, reason: "edited" });
+      continue;
+    }
+    text = next;
+    result.removed.push(root);
   }
-  if (next === "") await fs5.unlink(p6);
-  else await fs5.writeFile(p6, `${next}
+  if (result.removed.length > 0) {
+    if (text === "") await fs5.unlink(p6);
+    else await fs5.writeFile(p6, `${text}
 `);
-  await writeTrustMark(projectDir, false);
-  return "removed";
+  }
+  await writeTrustMark(projectDir, []);
+  return result;
 }
 async function uninstall2(projectDir) {
   const p6 = configPath(projectDir);
   const cfg = await readConfig(p6);
-  if (!cfg?.mcp_servers || !(SKAILE_MCP_NAME2 in cfg.mcp_servers)) {
+  if (!cfg?.mcp_servers || !(SKAILE_MCP_NAME in cfg.mcp_servers)) {
     return { changed: false };
   }
-  const { [SKAILE_MCP_NAME2]: _removed, ...rest } = cfg.mcp_servers;
+  const { [SKAILE_MCP_NAME]: _removed, ...rest } = cfg.mcp_servers;
   const updated = { ...cfg, mcp_servers: rest };
   if (Object.keys(rest).length === 0) delete updated.mcp_servers;
   if (Object.keys(updated).length === 0) {
@@ -3574,7 +3560,7 @@ async function isTrusted(projectDir) {
 async function status2(projectDir) {
   const p6 = configPath(projectDir);
   const cfg = await readConfig(p6);
-  const installed = !!(cfg?.mcp_servers && SKAILE_MCP_NAME2 in cfg.mcp_servers);
+  const installed = !!(cfg?.mcp_servers && SKAILE_MCP_NAME in cfg.mcp_servers);
   if (!installed) {
     return {
       harness: "codex",
@@ -3751,12 +3737,27 @@ async function uninstallCodex(projectDir) {
   else logInfo(`codex: not installed`);
   const trust = await untrustProject(projectDir);
   const userFile = userConfigPath2().replace(homedir(), "~");
-  if (trust === "removed") logOk(`Removed the trust entry skaile added from ${S.cmd(userFile)}`);
-  else if (trust === "kept") {
-    logInfo(
-      `codex: left the project's entry in ${userFile} (it no longer matches what skaile wrote)`
+  const current = await fs5.realpath(projectDir).catch(() => projectDir);
+  for (const root of trust.removed) {
+    logOk(
+      root === current ? `Removed the trust entry skaile added from ${S.cmd(userFile)}` : `Removed the trust entry skaile added for ${S.cmd(root)} (the project was moved from there) from ${S.cmd(userFile)}`
     );
   }
+  for (const { root, reason } of trust.kept) {
+    if (reason === "edited") {
+      logInfo(
+        `codex: left the trust entry for ${root} in ${userFile} (you edited it since install). Remove it there if you do not need it.`
+      );
+    } else if (reason === "in-use") {
+      logInfo(
+        `codex: the trust entry for ${root} stays in ${userFile}: that directory still exists. Remove it there when you no longer use it.`
+      );
+    } else {
+      logInfo(
+        `codex: ${userFile} has no trust entry for ${root}. If the project was moved, the entry for its old path stays; remove it from ${userFile}.`
+      );
+    }
+  }
 }
 async function runUninstall(opts) {
   const projectDir = path18__default.resolve(opts.projectDir);
@@ -4071,7 +4072,7 @@ function unfinishedGitState(dir) {
   for (const [entry, state2] of Object.entries(UNFINISHED_GIT_ENTRIES)) {
     const p6 = spawnSync("git", ["rev-parse", "--git-path", entry], { cwd: dir, encoding: "utf-8" });
     if (p6.status !== 0) return "the git directory could not be read";
-    if (fs9.existsSync(path18.resolve(dir, p6.stdout.trim()))) return state2;
+    if (fs8.existsSync(path18.resolve(dir, p6.stdout.trim()))) return state2;
   }
   return null;
 }
@@ -4143,7 +4144,7 @@ async function reindexLibrary(lib, library, name) {
   const res = await indexLibrary(lib, library, {
     exclude: (a) => skippedKeys.has(`${a.kind}:${a.name}`) || duplicateFiles.has(path18.resolve(a.manifestPath))
   });
-  const unparsable = res.errors.filter((e) => e.includes("ManifestSchemaError:"));
+  const unparsable = res.unparsable;
   for (const e of res.errors) (unparsable.includes(e) ? logErr : logWarn)(e);
   const syncUnparsable = skipped.filter(
     (s) => s.reason === "unparsable" && !unparsable.some((e) => e.includes(s.file))
@@ -4153,6 +4154,15 @@ async function reindexLibrary(lib, library, name) {
   }
   for (const p6 of badRequires) logErr(`${p6.asset}: ${p6.message}`);
   for (const w of await unresolvedManifestDependencies(lib.path)) logWarn(w);
+  const listed = loadSkPublishManifest(lib.path);
+  for (const a of listed?.assets ?? []) {
+    if (a.source) continue;
+    const file = findEntryManifestFile(lib.path, a);
+    if (!file) continue;
+    for (const f of unheldRequiresOfFile(file, a.kind, composeRefs)) {
+      logWarn(`${path18.relative(lib.path, file)} [${f.tag}] \u2014 ${f.text}`);
+    }
+  }
   const skippedUnparsable = unparsable.length + syncUnparsable.length;
   const failing = skippedUnparsable + invalidVersion.length + badRequires.length + failed.length + duplicates.length;
   (failing > 0 ? logWarn : logOk)(`Indexed ${res.assetsUpdated} asset(s) from ${name}.`);
@@ -4218,10 +4228,10 @@ var DEPLOYED_COPY_DIRS = [
 async function refuseUnusableLibraryDir(dir, force = false) {
   const deployed = DEPLOYED_COPY_DIRS.filter((d) => {
     const full = path18.join(dir, d);
-    return fs9.existsSync(full) && fs9.statSync(full).isDirectory() && fs9.readdirSync(full).length > 0;
+    return fs8.existsSync(full) && fs8.statSync(full).isDirectory() && fs8.readdirSync(full).length > 0;
   });
   if (deployed.length > 0 && !force) {
-    const where = fs9.existsSync(path18.join(dir, "skaile.yaml")) ? "skaile.yaml with deployed copies" : "deployed copies";
+    const where = fs8.existsSync(path18.join(dir, "skaile.yaml")) ? "skaile.yaml with deployed copies" : "deployed copies";
     logErr(
       `${dir} is a project folder (${where} in ${deployed.map((d) => `${d}/`).join(", ")}): a library holds asset sources, not the copies \`skaile add\` deployed. Pick another --path for the library, or pass --force when the sources live in those folders.`
     );
@@ -4246,13 +4256,13 @@ function canonicalDir(dir) {
   const abs = path18.resolve(dir);
   const missing = [];
   let existing = abs;
-  while (!fs9.existsSync(existing)) {
+  while (!fs8.existsSync(existing)) {
     const parent = path18.dirname(existing);
     if (parent === existing) return abs;
     missing.unshift(path18.basename(existing));
     existing = parent;
   }
-  return path18.join(fs9.realpathSync(existing), ...missing);
+  return path18.join(fs8.realpathSync(existing), ...missing);
 }
 function refuseGlobalInstallFolder(name, dir) {
   const reserved = globalInstallDir();
@@ -4298,7 +4308,7 @@ async function refuseNestedLibraryPath(manager, dir, exceptId) {
 function assertCreateDirInsideLibrary(libRoot, destDir, given) {
   const exists = (p6) => {
     try {
-      fs9.lstatSync(p6);
+      fs8.lstatSync(p6);
       return true;
     } catch {
       return false;
@@ -4308,12 +4318,12 @@ function assertCreateDirInsideLibrary(libRoot, destDir, given) {
   while (!exists(probe)) probe = path18.dirname(probe);
   let realProbe;
   try {
-    realProbe = fs9.realpathSync(probe);
+    realProbe = fs8.realpathSync(probe);
   } catch {
     logErr(`--dir "${given}" passes through a broken symlink (${probe}).`);
     process.exit(1);
   }
-  if (!fs9.statSync(realProbe).isDirectory()) {
+  if (!fs8.statSync(realProbe).isDirectory()) {
     logErr(`--dir "${given}": ${probe} is not a directory.`);
     process.exit(1);
   }
@@ -4332,11 +4342,11 @@ function assertCreateDirInsideLibrary(libRoot, destDir, given) {
     if (part === "" || part === ".") continue;
     walked = path18.join(walked, part);
     if (!exists(walked)) break;
-    if (fs9.lstatSync(walked).isSymbolicLink()) {
+    if (fs8.lstatSync(walked).isSymbolicLink()) {
       logErr(
         librarySymlinkMessage({
           path: relParts.slice(0, i + 1).join("/"),
-          target: fs9.readlinkSync(walked)
+          target: fs8.readlinkSync(walked)
         })
       );
       process.exit(1);
@@ -4344,7 +4354,7 @@ function assertCreateDirInsideLibrary(libRoot, destDir, given) {
   }
 }
 function adoptWritesManifest(libPath) {
-  if (!fs9.existsSync(path18.join(libPath, SKAILE_MANIFEST_FILENAME))) return true;
+  if (!fs8.existsSync(path18.join(libPath, SKAILE_MANIFEST_FILENAME))) return true;
   const manifest = loadSkPublishManifest(libPath);
   if (!manifest || manifest.source || (manifest.assets ?? []).length > 0) return false;
   return manifestPublisherProblems(libPath).length === 0;
@@ -4402,8 +4412,8 @@ function pruneEmptyLibraryParents(libPath) {
   for (; ; ) {
     const rel = path18.relative(root, canonicalDir(dir));
     if (rel === "" || rel.startsWith("..") || path18.isAbsolute(rel)) return;
-    if (!fs9.existsSync(dir) || fs9.readdirSync(dir).length > 0) return;
-    fs9.rmdirSync(dir);
+    if (!fs8.existsSync(dir) || fs8.readdirSync(dir).length > 0) return;
+    fs8.rmdirSync(dir);
     dir = path18.dirname(dir);
   }
 }
@@ -4417,7 +4427,7 @@ function remoteBranches(url) {
   return r.stdout.split("\n").map((line) => line.split("	")[1]?.replace(/^refs\/heads\//, "")).filter((b) => !!b);
 }
 async function warnIfNotGithubRemote(name, url) {
-  const { isGithubRemote, notGithubRemoteMessage } = await import('../library-publish-VBE3X2TH.js');
+  const { isGithubRemote, notGithubRemoteMessage } = await import('../library-publish-RUQTKTJU.js');
   if (!isGithubRemote(url)) logWarn(notGithubRemoteMessage(name, url));
 }
 function scaffoldLibraryFiles(dir, name) {
@@ -4450,8 +4460,8 @@ by the same ref.
   const written = [];
   for (const [file, content] of files) {
     const target = path18.join(dir, file);
-    if (fs9.existsSync(target)) continue;
-    fs9.writeFileSync(target, content, "utf8");
+    if (fs8.existsSync(target)) continue;
+    fs8.writeFileSync(target, content, "utf8");
     written.push(file);
   }
   return written;
@@ -4544,7 +4554,7 @@ function makeLibraryCommand() {
       const ownership = flagged[0] ?? gone?.ownership ?? "owner";
       const libPath = opts.path ? path18.resolve(opts.path) : path18.join(resolveLibraryDir(), name);
       refuseGlobalInstallFolder(name, libPath);
-      if (fs9.existsSync(libPath) && !fs9.statSync(libPath).isDirectory()) {
+      if (fs8.existsSync(libPath) && !fs8.statSync(libPath).isDirectory()) {
         logErr(`${libPath} exists and is not a directory.`);
         process.exit(1);
       }
@@ -4565,7 +4575,7 @@ function makeLibraryCommand() {
         if (existing) await manager.removeLibrary(name);
         await assertLibraryPathFree(manager, libPath);
         await refuseNestedLibraryPath(manager, libPath);
-        if (fs9.existsSync(libPath)) {
+        if (fs8.existsSync(libPath)) {
           exitOnLibrarySymlinks(libPath, `skaile library init ${name} --path ${libPath}`);
           await refuseUnusableLibraryDir(libPath, opts.force);
         }
@@ -4588,9 +4598,9 @@ function makeLibraryCommand() {
           backend = "git";
           backendConfig = { url: adopted.url, branch: adopted.branch, authHint: "ssh" };
         } else {
-          fs9.mkdirSync(libPath, { recursive: true });
+          fs8.mkdirSync(libPath, { recursive: true });
         }
-        const blank = fs9.readdirSync(libPath).every((entry) => entry === ".git");
+        const blank = fs8.readdirSync(libPath).every((entry) => entry === ".git");
         const isDefault = !hasDefault && ownership !== "reader";
         await manager.addLibrary({
           name,
@@ -4754,6 +4764,16 @@ function makeLibraryCommand() {
           );
           process.exit(1);
         }
+        const wanted = path18.relative(libRoot, path18.join(destDir, name));
+        const onDisk = (await scanUnlistedAssets(libRoot, target.name, getKindRegistry())).find(
+          (u) => u.entry.kind === effectiveKind && u.entry.name === name && u.root !== wanted
+        );
+        if (onDisk) {
+          logErr(
+            `${effectiveKind}:${name} already exists at "${onDisk.root}" (not in the manifest yet) \u2014 creating it again under "${path18.relative(libRoot, destDir) || "."}" would be a duplicate. Run \`skaile library index ${target.name}\` first or pick another name.`
+          );
+          process.exit(1);
+        }
         const res = am2.create(name, effectiveKind, destDir, { description: opts.description });
         if (!res.ok) {
           logErr(res.path);
@@ -4765,6 +4785,8 @@ function makeLibraryCommand() {
             `Description is a TODO placeholder \u2014 edit it (what the ${effectiveKind} does and when to use it) or \`skaile validate\` will fail.`
           );
         }
+        const scaffoldFile = findAssetManifestFile(res.path, effectiveKind, name);
+        const scaffoldProblems = scaffoldFile ? checkAssetFile(scaffoldFile, effectiveKind, getKindRegistry()) : [];
         const { ref } = await registerLibraryAsset(target, library, {
           kind: effectiveKind,
           name,
@@ -4772,7 +4794,13 @@ function makeLibraryCommand() {
           version: "0.1.0",
           publisher: opts.publisher
         });
-        logOk(`Indexed \u2014 add it with \`skaile add ${ref}\``);
+        if (scaffoldProblems.length > 0) {
+          logInfo(
+            `Created ${ref}, not ready to add yet: ${scaffoldProblems[0]?.text}. Fix the file, then run \`skaile library index ${target.name}\` and \`skaile validate ${target.path}\`.`
+          );
+        } else {
+          logOk(`Indexed \u2014 add it with \`skaile add ${ref}\``);
+        }
       } finally {
         close();
       }
@@ -4810,12 +4838,19 @@ function makeLibraryCommand() {
     }
     const newPath = path18.join(path18.dirname(lib.path), newName);
     refuseGlobalInstallFolder(newName, newPath);
-    if (fs9.existsSync(newPath)) {
+    if (fs8.existsSync(newPath)) {
       logErr(`Target directory already exists: ${newPath}`);
       process.exit(1);
     }
-    fs9.renameSync(lib.path, newPath);
+    const renamedBack = renamedLibraryName(newName) === lib.name;
+    fs8.renameSync(lib.path, newPath);
     await manager.updateLibrary(lib.id, { name: newName, path: newPath });
+    if (renamedBack) {
+      new AssetManager({
+        registry: getKindRegistry(),
+        projectDir: process.cwd()
+      }).renameLockedLibrary(lib.name, newName);
+    }
     logOk(`Renamed ${lib.name} \u2192 ${newName}`);
   }
   cmd.command("rename <old> <new>").description("Rename a library (also moves the directory)").action(async (oldName, newName) => {
@@ -4895,7 +4930,7 @@ function makeLibraryCommand() {
         patch.isDefault = false;
       } else if (field === "path") {
         const dir = path18.resolve(value);
-        if (!fs9.existsSync(dir) || !fs9.statSync(dir).isDirectory()) {
+        if (!fs8.existsSync(dir) || !fs8.statSync(dir).isDirectory()) {
           logErr(`Directory does not exist: ${dir}. \`library set path=\` does not move files.`);
           process.exit(1);
         }
@@ -5114,16 +5149,16 @@ function makeLibraryCommand() {
     "With --create-repo: create the repo private (the store only accepts public repos)"
   ).option("--ref <gitref>", "Git ref to ingest (default: the library branch or main)").option("--dry-run", "Print the plan; push nothing and call no store endpoint").action(
     async (lib, opts) => {
-      const { runLibraryPublish } = await import('../library-publish-VBE3X2TH.js');
+      const { runLibraryPublish } = await import('../library-publish-RUQTKTJU.js');
       await withStoreErrorHandling(() => runLibraryPublish(lib, opts));
     }
   );
   cmd.command("register <lib>").description("Register the library's manifest without pushing (bytes already on github)").option("--asset <ref>", "Publish only the single asset matching this ref/name").option("--ref <gitref>", "Git ref to ingest (default: the library branch or main)").option("--dry-run", "Print the plan; call no store endpoint").action(async (lib, opts) => {
-    const { runLibraryRegister } = await import('../library-publish-VBE3X2TH.js');
+    const { runLibraryRegister } = await import('../library-publish-RUQTKTJU.js');
     await withStoreErrorHandling(() => runLibraryRegister(lib, opts));
   });
   cmd.command("yank <lib>").description("Retract the library's published assets from the store").option("--asset <ref>", "Yank only the single asset matching this ref/name").action(async (lib, opts) => {
-    const { runLibraryYank } = await import('../library-publish-VBE3X2TH.js');
+    const { runLibraryYank } = await import('../library-publish-RUQTKTJU.js');
     await withStoreErrorHandling(() => runLibraryYank(lib, opts));
   });
   return cmd;
@@ -5783,7 +5818,7 @@ function scheduleSoftDepPreview() {
 }
 async function loadAssets() {
   softDepPreviewCache.clear();
-  const { gatherAssetFeeds } = await import('../asset-feeds-WAKBHGEV.js');
+  const { gatherAssetFeeds } = await import('../asset-feeds-QGLI3AXI.js');
   const { entries, notes } = await gatherAssetFeeds(am, am.projectDir);
   if (notes.length > 0) {
     state.message = notes.map((n) => `[${n.feed}] ${n.message}`).join(" \u2022 ");
@@ -5987,7 +6022,7 @@ function reconcileCollapsedSets(rows) {
 async function loadSourcesAndLibraries() {
   try {
     const [{ openLibraryManager: openLibraryManager2 }, { getGlobalCacheDir: getGlobalCacheDir2, globalSkaileDir: globalSkaileDir2 }] = await Promise.all([
-      import('../open-library-JP5TC5UX.js'),
+      import('../open-library-PVTIUQUF.js'),
       import('../core/index.js')
     ]);
     const { manager, library, close } = await openLibraryManager2();
@@ -7890,13 +7925,22 @@ function repoPublisher(root) {
   }
   return DEFAULT_PUBLISHER;
 }
-function planBundles(root, skaileYamls, publisher, notes, manual) {
+function planBundles(root, skaileYamls, publisher, notes, manual, conflicts) {
   const changes = [];
   const presets = [];
   const handled = /* @__PURE__ */ new Set();
+  const claimed = /* @__PURE__ */ new Map();
   const rel = (p6) => posix2(path18__default.relative(root, p6));
   const convert = (name, bundleFile, dir) => {
     const target = path18__default.join(dir === root ? path18__default.join(dir, name) : dir, `${name}.preset.yaml`);
+    const origin = bundleFile ? rel(bundleFile) : `${rel(path18__default.join(dir, "skills")) || "skills"}/`;
+    const earlier = claimed.get(target);
+    if (earlier !== void 0) {
+      conflicts.push(
+        `${earlier} and ${origin} both become ${rel(target)}: rename one bundle first. Nothing was changed.`
+      );
+      return;
+    }
     if (existsSync(target)) {
       manual.push(`${rel(target)} already exists; bundle ${name} not converted`);
       return;
@@ -7932,6 +7976,7 @@ function planBundles(root, skaileYamls, publisher, notes, manual) {
       );
       return;
     }
+    claimed.set(target, origin);
     const after = presetText(name, description, refs, version);
     if (before !== void 0 && bundleFile) {
       changes.push({ type: "move", from: bundleFile, to: target, before, after });
@@ -8061,6 +8106,7 @@ function planAssetMigration(options) {
   const knownKinds = new Set(options.registry.getAllKinds());
   const notes = [];
   const manual = [];
+  const conflicts = [];
   const unknownTypes = [];
   const { moves, changes: moveChanges } = planMarkdownMoves(root, knownKinds, manual, unknownTypes);
   for (const move of moves) {
@@ -8081,7 +8127,7 @@ function planAssetMigration(options) {
     }
   }
   const publisher = repoPublisher(root);
-  const bundleChanges = planBundles(root, skaileYamls, publisher, notes, manual);
+  const bundleChanges = planBundles(root, skaileYamls, publisher, notes, manual, conflicts);
   const skaileChanges = skaileYamls.flatMap(
     ({ file, source }) => planSkaileYaml(root, file, source, notes, manual)
   );
@@ -8089,6 +8135,7 @@ function planAssetMigration(options) {
     changes: [...moveChanges, ...agentChanges, ...bundleChanges, ...skaileChanges],
     notes,
     manual,
+    conflicts,
     unknownTypes
   };
 }
@@ -8475,7 +8522,8 @@ Rewrites (run on a repo root):
                                    agent persona:/rules: refs to the old path become composes items
   *.bundle.yaml                    <name>.preset.yaml beside it, or <name>/<name>.preset.yaml
                                    for a bundle at the repo root (items: kind:@publisher/name);
-                                   kind: bundle entries of skaile.yaml#assets become kind: preset
+                                   kind: bundle entries of skaile.yaml#assets become kind: preset;
+                                   two bundles with one name are refused (exit 1, nothing written)
   skaile.yaml dependencies         bundle:@... -> preset:@...
   skaile.yaml publisher/version/assets
                                    -> skaile.manifest.yaml (publisher without "@"); keys removed,
@@ -8553,6 +8601,11 @@ async function runMigrateAssets(root, opts) {
     root: path18__default.resolve(root ?? base),
     registry: getKindRegistry()
   });
+  if (plan.conflicts.length > 0) {
+    for (const conflict of plan.conflicts) logErr(conflict);
+    process.exitCode = 1;
+    return;
+  }
   for (const note of plan.notes) console.log(`  ${note}`);
   for (const note of plan.manual) logWarn(note);
   for (const { file, type } of plan.unknownTypes) {
@@ -8702,6 +8755,12 @@ function outdatedStatus(e) {
   if (e.contentChanged) {
     return `${e.currentVersion} content changed since lock ${S.dim(`(library ${e.library})`)}${moves}`;
   }
+  if (e.pinned && e.latestVersion !== void 0) {
+    return `locked ${e.currentVersion} (latest ${e.latestVersion}, pinned in skaile.yaml)`;
+  }
+  if (e.library !== void 0 && e.libraryOlder !== void 0) {
+    return `library is at ${e.libraryOlder}, locked ${e.currentVersion} ${S.dim(`(library ${e.library})`)}${moves}`;
+  }
   if (e.library !== void 0 && e.latestVersion !== void 0) {
     return `${e.currentVersion} \u2192 ${e.latestVersion} ${S.dim(`(library ${e.library})`)}${moves}`;
   }
@@ -8743,7 +8802,7 @@ function makeOutdatedCommand() {
       );
     }
     console.log();
-    if (filtered.some((e) => e.problem === void 0)) {
+    if (filtered.some((e) => e.problem === void 0 && !e.pinned)) {
       logWarn(`Run ${S.cmd("skaile update")} to re-lock and re-deploy.`);
     }
     if (filtered.some((e) => e.problem !== void 0 && !e.manualFix)) {
@@ -8825,7 +8884,7 @@ function action2(fn) {
   };
 }
 async function reconcileAndReport(projectDir, plugins, opts = {}) {
-  const { reconcilePlugins } = await import('../plugin-store-QOQDM24E.js');
+  const { reconcilePlugins } = await import('../plugin-store-G2GWAHSD.js');
   if (plugins.length === 0) {
     logInfo("No plugins declared \u2014 nothing to reconcile.");
     return;
@@ -8840,7 +8899,7 @@ async function reconcileAndReport(projectDir, plugins, opts = {}) {
   }
 }
 async function verifyPluginLoads(projectDir, spec) {
-  const { loadPlugins } = await import('../plugin-store-QOQDM24E.js');
+  const { loadPlugins } = await import('../plugin-store-G2GWAHSD.js');
   const { createPluginRegistry } = await import('../plugin-registry/index.js');
   const registry = createPluginRegistry();
   const result = await loadPlugins(projectDir, [spec], registry);
@@ -8854,7 +8913,7 @@ async function verifyPluginLoads(projectDir, spec) {
 async function runInstall2(spec, opts) {
   const projectDir = path18__default.resolve(opts.projectDir);
   const { WorkspaceYamlEditor: WorkspaceYamlEditor2 } = await import('../core/index.js');
-  const { specName, rollbackPluginStore } = await import('../plugin-store-QOQDM24E.js');
+  const { specName, rollbackPluginStore } = await import('../plugin-store-G2GWAHSD.js');
   const yamlPath = path18__default.join(projectDir, "skaile.yaml");
   if (!existsSync(yamlPath)) {
     throw new Error(`no skaile.yaml in ${projectDir}; run \`skaile init\` first`);
@@ -8883,7 +8942,7 @@ async function runInstall2(spec, opts) {
 async function runRemove(name, opts) {
   const projectDir = path18__default.resolve(opts.projectDir);
   const { WorkspaceYamlEditor: WorkspaceYamlEditor2 } = await import('../core/index.js');
-  const { specName } = await import('../plugin-store-QOQDM24E.js');
+  const { specName } = await import('../plugin-store-G2GWAHSD.js');
   const yamlPath = path18__default.join(projectDir, "skaile.yaml");
   if (!existsSync(yamlPath)) {
     logInfo(`No plugin matching ${S.cmd(name)}: there is no skaile.yaml in ${projectDir}.`);
@@ -8915,7 +8974,7 @@ async function runList(opts) {
   const registry = createPluginRegistry();
   if (declared.length > 0) {
     try {
-      const { loadPlugins } = await import('../plugin-store-QOQDM24E.js');
+      const { loadPlugins } = await import('../plugin-store-G2GWAHSD.js');
       const result = await loadPlugins(projectDir, declared, registry);
       for (const f of result.failed) logWarn(f.error);
     } catch (err) {
@@ -9529,6 +9588,7 @@ async function runPresetInstall(projectDir) {
     logInfo("Installing new dependencies\u2026");
     const result = await am2.install({});
     for (const d of result.deployed) logOk(d);
+    await pinComposedAgents(projectDir);
     for (const m of result.missing) logErr(`Missing: ${m}${result.missingHints?.[m] ?? ""}`);
     if (reportStoreNotChecked(result.storeNotChecked)) process.exitCode = 1;
     await reportInstalledSoftDeps(am2);
@@ -9764,38 +9824,11 @@ function makeRebuildCommand() {
     logInfo(`Written: ${result.manifestPath}`);
   });
 }
-
-// cli/src/driver-error.ts
-function friendlyDriverError(err) {
-  const e = err;
-  if (!e) return null;
-  const isSpawnEnoent = e.code === "ENOENT" && (e.syscall?.startsWith("spawn") === true || /^spawn .*ENOENT/.test(e.message ?? ""));
-  const isConfig = e.category === "config" || e.detail?.category === "config";
-  if (!isSpawnEnoent && !isConfig) return null;
-  const hint = e.hint ?? e.detail?.hint;
-  const base = hint ?? "The configured agent binary is not installed or not on your PATH.";
-  return `${base}
-Try a different harness with \`--driver claude-sdk\`.`;
-}
-function driverErrorNotes(err) {
-  const e = err;
-  const notes = [];
-  const category = e?.category ?? e?.detail?.category;
-  const hint = e?.hint ?? e?.detail?.hint;
-  if (hint && category !== "config") notes.push(hint);
-  else if (category === "auth") notes.push("Check your API key or login.");
-  if (e?.logSessionId) {
-    notes.push(`Full records: .skaile/logs.db (skaile session logs ${e.logSessionId}).`);
-  }
-  return notes;
-}
-
-// cli/src/commands/run.ts
 function resolveSingleShotAgentDir(projectDir, agentDefinition) {
   if (!agentDefinition) return resolveAgentDir(projectDir);
   const asPath = agentDefinition.endsWith("agent.yaml") ? path18__default.dirname(path18__default.resolve(projectDir, agentDefinition)) : agentDefinition;
   const dir = resolveAgentDefinitionDir(projectDir, asPath);
-  if (!dir || !fs9__default.existsSync(path18__default.join(dir, "agent.yaml"))) {
+  if (!dir || !fs8__default.existsSync(path18__default.join(dir, "agent.yaml"))) {
     throw new Error(
       `--agent-definition "${agentDefinition}" does not resolve to an agent directory with agent.yaml${dir ? ` (looked in ${dir})` : ""}`
     );
@@ -9855,11 +9888,11 @@ async function findSkillFile(projectDir, skill) {
   const name = skill.trim().replace(/^skill:/, "").replace(/^@[^/]+\//, "").replace(/#.*$/, "");
   for (const target of SUPPORTED_DRIVER_TARGETS) {
     const file = path18__default.join(deployedDir("skill", name, target, false, projectDir), "SKILL.md");
-    if (fs9__default.existsSync(file)) return file;
+    if (fs8__default.existsSync(file)) return file;
   }
   const am2 = new AssetManager({ registry: getKindRegistry(), projectDir });
   const entry = await am2.info(`skill:${name}`);
-  return entry?.source && fs9__default.existsSync(entry.source) ? entry.source : void 0;
+  return entry?.source && fs8__default.existsSync(entry.source) ? entry.source : void 0;
 }
 async function printSkillDryRun(projectDir, skill) {
   const file = await findSkillFile(projectDir, skill);
@@ -9869,7 +9902,7 @@ async function printSkillDryRun(projectDir, skill) {
     );
     return false;
   }
-  const content = fs9__default.readFileSync(file, "utf-8");
+  const content = fs8__default.readFileSync(file, "utf-8");
   const { data } = parseFrontmatter(content);
   const meta = data.metadata ?? {};
   console.log(`  ${S.label("Skill:")}       ${S.heading(String(data.name ?? skill))}`);
@@ -9991,9 +10024,11 @@ function makeRunCommand() {
     }
     let flowId = positional[0];
     if (!flowId) {
-      const flows = await discoverFlowsWithLibraries(projectDir);
+      const flows = discoverProjectFlows(projectDir);
       if (flows.length === 0) {
-        logErr("No flows available.");
+        logErr(
+          "No flows available in this project. Add one with `skaile add flow:@<publisher>/<name>`."
+        );
         process.exit(1);
       }
       const selected = await p4.select({
@@ -10016,6 +10051,11 @@ function makeRunCommand() {
     });
     const driver = config.driver ?? DEFAULT_DRIVER_ID;
     const model = config.model;
+    const unknownDriver = unknownDriverMessage(driver);
+    if (unknownDriver) {
+      logErr(unknownDriver);
+      process.exit(1);
+    }
     const providerRefusal = checkModelProvider(driver, {
       registry: loadRegistryView({ projectDir }).merged,
       model
@@ -10024,11 +10064,7 @@ function makeRunCommand() {
       logErr(providerRefusal);
       process.exit(1);
     }
-    const flowPath = await findFlowFileWithLibraries(
-      flowId,
-      projectAiAssetsRoots(projectDir),
-      projectDir
-    );
+    const flowPath = findProjectFlowFile(flowId, projectDir);
     if (flowPath && agentDefinition) {
       logErr(
         `--agent-definition cannot be combined with flow "${flowId}": a flow runs on the project's session agent. Drop --agent-definition, or run a single-shot prompt instead.`
@@ -10046,7 +10082,13 @@ function makeRunCommand() {
       const promptOnlyOption = agentDefinition !== void 0 || instanceId2 !== void 0 || opts.skill !== void 0;
       if (!textPrompt.trim() || positional.length === 1 && !/\s/.test(flowId) && !promptOnlyOption) {
         logErr(`Flow not found: ${flowId}`);
-        const available = (await discoverFlowsWithLibraries(projectDir)).map((f) => f.id);
+        const inLibrary = await findLibraryFlow(flowId);
+        if (inLibrary) {
+          console.log(
+            `  The library "${inLibrary.library}" has it, but this project does not: run ${S.cmd(`skaile add ${inLibrary.ref}`)} first.`
+          );
+        }
+        const available = discoverProjectFlows(projectDir).map((f) => f.id);
         const near = available.filter((id) => isNearFlowId(flowId, id));
         const listed = near.length > 0 ? near : available;
         if (listed.length > 0) {
@@ -10247,13 +10289,13 @@ function makeReplCommand() {
         p4.cancel("Cancelled.");
         process.exit(0);
       }
-      const tmpDir = fs9__default.mkdtempSync(path18__default.join(os2.tmpdir(), "skaile-repl-"));
+      const tmpDir = fs8__default.mkdtempSync(path18__default.join(os2.tmpdir(), "skaile-repl-"));
       projectDir = tmpDir;
       agentCwd = userCwd;
       logOk(`Temporary workspace: ${S.cmd(tmpDir)}`);
       if (!driverOverride) {
         const claudeDir = path18__default.join(os2.homedir(), ".claude");
-        if (fs9__default.existsSync(claudeDir)) {
+        if (fs8__default.existsSync(claudeDir)) {
           driverOverride = "claude-sdk";
           logInfo(`Detected ${S.cmd("~/.claude")} \u2192 using ${S.cmd("claude-sdk")} harness`);
         } else {
@@ -10392,7 +10434,18 @@ function makeServeCommand() {
         process.exitCode = 1;
         return;
       }
-      const managedCodex = opts.managedCodexConfig ? loadManagedCodexHostConfig(opts.managedCodexConfig, opts.projectDir) : void 0;
+      let managedCodex;
+      if (opts.managedCodexConfig) {
+        try {
+          managedCodex = loadManagedCodexHostConfig(opts.managedCodexConfig, opts.projectDir);
+        } catch {
+          logErr(
+            `--managed-codex-config: '${opts.managedCodexConfig}' is missing or invalid. Give the absolute path of a private host configuration file (readable by its owner only, outside the project).`
+          );
+          process.exitCode = 1;
+          return;
+        }
+      }
       if (managedCodex) {
         const { resolveSkWorkspaceConfig: resolveSkWorkspaceConfig2 } = await import('../core/index.js');
         if (resolveSkWorkspaceConfig2(opts.projectDir).plugins?.length)
@@ -10402,7 +10455,7 @@ function makeServeCommand() {
       }
       const providers = parseProviderIds(opts.providers);
       const modelEndpoint = parseModelEndpointFlag(opts.modelEndpoint);
-      const { checkDriverSdk, checkModelEndpointPeer } = await import('../serve-preflight-BTGTZUDN.js');
+      const { checkDriverSdk, checkModelEndpointPeer, checkServeModel } = await import('../serve-preflight-QXRKGOI5.js');
       const driverProblem = managedCodex ? null : await checkDriverSdk(opts.projectDir, opts.driver);
       if (driverProblem) {
         logErr(driverProblem);
@@ -10415,6 +10468,16 @@ function makeServeCommand() {
         process.exitCode = 1;
         return;
       }
+      const modelProblem = managedCodex ? null : await checkServeModel(opts.projectDir, {
+        driver: opts.driver,
+        model: opts.model,
+        providers
+      });
+      if (modelProblem) {
+        logErr(modelProblem);
+        process.exitCode = 1;
+        return;
+      }
       try {
         await startAgentServer({
           port,
@@ -10453,12 +10516,12 @@ function makeServeCommand() {
   );
 }
 async function ensurePluginsLoadedForServe(projectDir) {
-  const { logInfo: logInfo2, logWarn: logWarn2 } = await import('../helpers-R22QNPFN.js');
+  const { logInfo: logInfo2, logWarn: logWarn2 } = await import('../helpers-34QNVIGB.js');
   try {
     const { resolveSkWorkspaceConfig: resolveSkWorkspaceConfig2 } = await import('../core/index.js');
     const config = resolveSkWorkspaceConfig2(projectDir);
     if (!config.plugins || config.plugins.length === 0) return;
-    const { ensurePluginsLoaded } = await import('../plugin-store-QOQDM24E.js');
+    const { ensurePluginsLoaded } = await import('../plugin-store-G2GWAHSD.js');
     const { pluginRegistry } = await import('../plugin-registry/index.js');
     const result = await ensurePluginsLoaded(projectDir, config.plugins, pluginRegistry);
     if (result.loaded.length > 0) {
@@ -10472,14 +10535,14 @@ async function ensurePluginsLoadedForServe(projectDir) {
   }
 }
 async function runCompileTest(opts) {
-  const { logOk: logOk2, logErr: logErr2, logInfo: logInfo2, S: S2 } = await import('../helpers-R22QNPFN.js');
+  const { logOk: logOk2, logErr: logErr2, logInfo: logInfo2, S: S2 } = await import('../helpers-34QNVIGB.js');
   const { tmpdir } = await import('os');
   const { dirname: dirname3, join: join6, resolve: resolve4 } = await import('path');
   const { fileURLToPath: fileURLToPath2 } = await import('url');
-  const { unlinkSync, existsSync: existsSync22 } = await import('fs');
+  const { unlinkSync, existsSync: existsSync21 } = await import('fs');
   const { spawn } = await import('child_process');
   const { portableSpawnSync: portableSpawnSync2 } = await import('../core/index.js');
-  const { MONOREPO_ROOT } = await import('../paths-BFM6K2QO.js');
+  const { MONOREPO_ROOT } = await import('../paths-JLNX7Y4X.js');
   if (MONOREPO_ROOT === null) {
     logErr2("--compile-test is only available inside the skaile-dev workspace.");
     logInfo2("Run it from a checkout of skaile-ai/skaile-dev (the monorepo shell).");
@@ -10541,7 +10604,7 @@ async function runCompileTest(opts) {
     } catch {
     }
     try {
-      if (existsSync22(outfile)) unlinkSync(outfile);
+      if (existsSync21(outfile)) unlinkSync(outfile);
     } catch {
     }
   }
@@ -11292,12 +11355,12 @@ async function showAsset(am2, kind, name) {
     logErr(err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
-  if (entry?.source && fs9__default.existsSync(entry.source)) {
+  if (entry?.source && fs8__default.existsSync(entry.source)) {
     console.log();
     console.log(`  ${kindColor(entry.kind)} ${S.heading(entry.name)}`);
     console.log(`  ${S.rule(40)}`);
     console.log();
-    console.log(fs9__default.readFileSync(entry.source, "utf-8"));
+    console.log(fs8__default.readFileSync(entry.source, "utf-8"));
     return;
   }
   logErr(`Asset not found: ${kind}:${name}`);
@@ -11418,8 +11481,8 @@ function makeStoreCommand() {
     "--all",
     `List every match (default: ${STORE_ROW_LIMIT} rows, only what \`skaile add\` can install)`
   ).option("-C, --project-dir <dir>", "Project directory (catalog config overlay)", process.cwd()).action(async (query, opts) => {
-    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-JP5TC5UX.js');
-    const { getKnownKinds: getKnownKinds2 } = await import('../open-registry-RBELV5YH.js');
+    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-PVTIUQUF.js');
+    const { getKnownKinds: getKnownKinds2 } = await import('../open-registry-SOIS3TA2.js');
     const projectDir = path18__default.resolve(opts.projectDir);
     if (opts.kind && !getKnownKinds2().has(opts.kind)) {
       logErr(
@@ -11477,8 +11540,8 @@ function makeStoreCommand() {
     }
   });
   store.command("show <ref>").description("Show a store asset's details + provenance (source, files, integrity)").option("-C, --project-dir <dir>", "Project directory (catalog config overlay)", process.cwd()).action(async (ref, opts) => {
-    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-JP5TC5UX.js');
-    const { supportsInstallManifest: supportsInstallManifest2 } = await import('../project-6ETXGQWD.js');
+    const { openCatalogSource: openCatalogSource2, LocalCatalogDisabledError: LocalCatalogDisabledError2 } = await import('../open-library-PVTIUQUF.js');
+    const { supportsInstallManifest: supportsInstallManifest2 } = await import('../project-EX47PUBN.js');
     try {
       parseAssetRef(ref);
     } catch (e) {
@@ -11740,6 +11803,7 @@ function makeUpdateCommand() {
       reportReplaced(result.replaced);
       reportRelocked(result.relocked);
       reportMoved(result.moved);
+      await pinComposedAgents(projectDir);
       const changed = result.deployed.length > 0 || result.removed.length > 0 || !!result.replaced?.length || !!result.moved?.length || !!result.relocked?.length;
       if (result.lockWritten) {
         logInfo(`Lock file written: ${S.dim("skaile.lock.yaml")}`);
@@ -11871,6 +11935,7 @@ async function updateOne(am2, projectDir, target) {
     return;
   }
   spinner.stop(process.exitCode === 1 ? "Failed" : "Done");
+  await pinComposedAgents(projectDir);
   for (const d of deployed) logOk(`Updated ${d}`);
   if (deployed.length > 0) return;
   if (readText2(lockPath) !== before) logInfo(`Re-locked ${target.ref}`);
@@ -12264,29 +12329,29 @@ async function runInit(projectDir, opts) {
   const resolved = path18__default.resolve(projectDir ?? ".");
   const projectName = path18__default.basename(resolved);
   const created = [];
-  const { existsSync: existsSync22 } = await import('fs');
-  if (!existsSync22(resolved)) {
+  const { existsSync: existsSync21 } = await import('fs');
+  if (!existsSync21(resolved)) {
     mkdirSync5(resolved, { recursive: true });
     created.push(".");
   }
   const skaileDir = path18__default.join(resolved, ".skaile");
-  if (!existsSync22(skaileDir)) {
+  if (!existsSync21(skaileDir)) {
     mkdirSync5(path18__default.join(skaileDir, "sessions"), { recursive: true });
     created.push(".skaile/");
   }
   const settingsPath = path18__default.join(skaileDir, "settings.json");
-  if (!existsSync22(settingsPath)) {
+  if (!existsSync21(settingsPath)) {
     writeFileSync7(settingsPath, "{}\n");
     created.push(".skaile/settings.json");
   }
   const wsConfigPath = path18__default.join(resolved, "skaile.yaml");
-  if (!existsSync22(wsConfigPath)) {
+  if (!existsSync21(wsConfigPath)) {
     writeFileSync7(wsConfigPath, stringify2(buildInitWorkspaceConfig(projectName, harness)));
     created.push("skaile.yaml");
   }
   for (const dir of new Set(Object.values(DRIVER_TARGETS2[harness].local))) {
     const full = path18__default.join(resolved, dir);
-    if (!existsSync22(full)) {
+    if (!existsSync21(full)) {
       mkdirSync5(full, { recursive: true });
       created.push(`${dir}/`);
     }
@@ -12316,7 +12381,7 @@ function buildInitWorkspaceConfig(projectName, harness) {
 }
 async function initGitScaffold(resolved, created) {
   const { execSync: execSync2 } = await import('child_process');
-  const { existsSync: existsSync22, readFileSync: readFileSync13, writeFileSync: writeFileSync7 } = await import('fs');
+  const { existsSync: existsSync21, readFileSync: readFileSync13, writeFileSync: writeFileSync7 } = await import('fs');
   const gitignorePath = path18__default.join(resolved, ".gitignore");
   const entries = [
     "node_modules/",
@@ -12345,11 +12410,14 @@ async function initGitScaffold(resolved, created) {
     // extension: it is committed, so it is not listed here.
     ".codex/config.toml",
     ".skaile/plugin-state.json",
+    // `.mcp.json` and `.skaile/assets/` are committed on purpose, so they are not listed: the
+    // entries use `.` for the project root and secrets are only `${NAME}` references, so the
+    // files read the same in every clone (p1294).
     "*.log",
     ".env",
     ".env.local"
   ];
-  const existing = existsSync22(gitignorePath) ? readFileSync13(gitignorePath, "utf-8") : "";
+  const existing = existsSync21(gitignorePath) ? readFileSync13(gitignorePath, "utf-8") : "";
   const have = new Set(existing.split("\n").map((l) => l.trim()));
   const append = entries.filter((e) => !have.has(e));
   if (append.length > 0) {
@@ -12358,7 +12426,7 @@ async function initGitScaffold(resolved, created) {
 `);
     if (!existing) created.push(".gitignore");
   }
-  if (!existsSync22(path18__default.join(resolved, ".git"))) {
+  if (!existsSync21(path18__default.join(resolved, ".git"))) {
     try {
       execSync2("git init", { cwd: resolved, stdio: "pipe" });
       created.push(".git/");
@@ -12370,10 +12438,10 @@ async function initGitScaffold(resolved, created) {
 }
 async function bootstrapUserConfig() {
   try {
-    const fs12 = await import('fs');
+    const fs11 = await import('fs');
     const { userConfigPath: userConfigPath3, saveConfig, getConfigDefaults } = await import('../library/index.js');
     const userCfgPath = userConfigPath3();
-    if (!fs12.existsSync(userCfgPath)) {
+    if (!fs11.existsSync(userCfgPath)) {
       const defaults = getConfigDefaults();
       saveConfig(userCfgPath, {
         catalog: { url: defaults.catalog.url, cache_ttl: defaults.catalog.cache_ttl }
@@ -12388,7 +12456,7 @@ async function bootstrapUserConfig() {
 }
 async function hydrateInitSources(resolved, created) {
   try {
-    const { ensureSourcesCloned } = await import('../ensure-sources-CEFODJCE.js');
+    const { ensureSourcesCloned } = await import('../ensure-sources-GKVLE6L5.js');
     const hydrate = ensureSourcesCloned(resolved, { quiet: true });
     for (const n of hydrate.cloned) created.push(`~/.skaile/cache/sources/${n}/`);
     if (hydrate.failed.length > 0) {
@@ -12428,7 +12496,7 @@ function printInitSummary(resolved, projectDir, created) {
   console.log();
 }
 program.command("setup").description("Interactive provider setup wizard").action(async () => {
-  const { cmdSetup } = await import('../setup-JQDTYPSD.js');
+  const { cmdSetup } = await import('../setup-AFZQNGKA.js');
   await cmdSetup([], { projectDir: process.cwd() });
 });
 program.addCommand(makeInstallCommand());
@@ -12502,6 +12570,20 @@ program.command("path").description("Show resolved paths (honours SKAILE_HOME an
   console.log();
 });
 program.addCommand(makeCompleteCommand(program));
+program.hook("postAction", async (_thisCommand, actionCommand) => {
+  if (actionCommand.parent !== program) return;
+  if (!["add", "remove", "install", "update"].includes(actionCommand.name())) return;
+  const opts = actionCommand.opts();
+  if (opts.global || opts.dryRun) return;
+  const projectDir = path18__default.resolve(opts.projectDir ?? process.cwd());
+  const { refreshPluginSkills } = await import('../claude-code-2PU7TITZ.js');
+  try {
+    if (await refreshPluginSkills(projectDir)) {
+      logInfo(`Updated ${S.cmd(".claude/plugins/skaile/skills")} (the --full plugin copy)`);
+    }
+  } catch {
+  }
+});
 process.stdout.on("error", (err) => {
   if (err.code === "EPIPE") process.exit(0);
   throw err;
@@ -12521,7 +12603,7 @@ try {
     process.exit(1);
   }
   const { LibrarySyncError } = await import('../library/index.js');
-  if (!(err instanceof LibrarySyncError || err instanceof LibraryEntryError || err instanceof SourceEntryError))
+  if (!(err instanceof LibrarySyncError || err instanceof LibraryEntryError || err instanceof SourceEntryError || err instanceof LegacyKeyError))
     throw err;
   logErr(err.message);
   process.exit(1);