@skaile/workspaces 5.18.1 → 6.0.0

package/dist/{chunk-VM3PH7BB.js → chunk-OAHVKSQJ.js}

@@ -1,18 +1,18 @@
-import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, storeManifestFile, missingLibraryDirMessage } from './chunk-VKPBUPH7.js';
-import { SEMVER_RE, invalidSemverMessage, flowFileNameError, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-HPVMTX6M.js';
+import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, filesEntryPaths } from './chunk-UL22SDGR.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-QOM5Z62G.js';
 import { parseFlowDefinition } from './chunk-X3RMRJNR.js';
-import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, assertNoLibrarySymlinks, deployAll, removeAsset, createScaffold, installAgent } from './chunk-YZ3N7IUU.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, assertNoLibrarySymlinks, deployAll, removeAsset, createScaffold, installAgent } from './chunk-3JKGY2YC.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-SRNCN4X2.js';
-import { isScaffoldBody, isScaffoldDescription } from './chunk-CKNIYIV2.js';
-import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, computeHash, buildLockFile, writeLock, readLock, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-T2TQAH2X.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-KC6HGWXN.js';
-import { deployedBase, isDeployed, deployedPaths, deployedDir } from './chunk-5TBFN46Z.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAgentDefinitionDir, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-2NOLF7B2.js';
+import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-DUMTLYSO.js';
+import { isScaffoldBody, isScaffoldDescription } from './chunk-E572OHGY.js';
+import { resolveConfiguredHarnessName, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-L4YKW5AY.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-OTIB4D2K.js';
+import { deployedBase, isDeployed, deployedPaths, deployedDir } from './chunk-5KRMNUL4.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAgentDefinitionDir, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-OHNKYHRR.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
-import { DRIVER_TARGETS, SUPPORTED_DRIVER_TARGETS } from './chunk-IG5LZ3WU.js';
-import { listAssetFiles, loadSkPublishManifest, isNonAssetDir, isNonAssetFile } from './chunk-CKICWXMU.js';
+import { HARNESS_TARGETS, SUPPORTED_HARNESSES } from './chunk-VTETQCR6.js';
+import { loadSkPublishManifest, listAssetFiles, isNonAssetDir, isNonAssetFile } from './chunk-UQ33Y4DM.js';
 import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-GOCWM7FN.js';
 import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-WDXZA7QW.js';
 import { spawnSync } from 'child_process';
@@ -40,8 +40,8 @@ function writeLedger(projectDir, ledger) {
   writeFileSync(p, `${JSON.stringify(ledger, null, 2)}
 `, "utf-8");
 }
-function renderedInstanceFiles(projectDir, driverTarget) {
-  const recorded = readLedger(projectDir).targets[driverTarget];
+function renderedInstanceFiles(projectDir, harness) {
+  const recorded = readLedger(projectDir).targets[harness];
   if (!recorded) return [];
   let instances;
   try {
@@ -51,11 +51,11 @@ function renderedInstanceFiles(projectDir, driverTarget) {
   }
   return Object.entries(instances).filter(([id]) => recorded[id]?.length).map(([id, instance]) => ({ id, ref: instance.ref, files: recorded[id] }));
 }
-function instanceRenderedAgentNames(projectDir, driverTarget) {
+function instanceRenderedAgentNames(projectDir, harness) {
   const names = /* @__PURE__ */ new Set();
-  if (!driverTargetSupportsAgents(driverTarget)) return names;
-  const agentDir = resolve(deployedBase("agent", driverTarget, false, projectDir));
-  for (const files of Object.values(readLedger(projectDir).targets[driverTarget] ?? {})) {
+  if (!harnessTargetSupportsAgents(harness)) return names;
+  const agentDir = resolve(deployedBase("agent", harness, false, projectDir));
+  for (const files of Object.values(readLedger(projectDir).targets[harness] ?? {})) {
     for (const rel of files) {
       const abs = resolve(projectDir, rel);
       if (!abs.startsWith(agentDir + sep)) continue;
@@ -80,8 +80,8 @@ function bindInstance(projectDir, id, instance) {
   }
   return { srcDir, errors };
 }
-function unboundAgentInstances(projectDir, driverTarget) {
-  if (!driverTargetSupportsAgents(driverTarget)) return [];
+function unboundAgentInstances(projectDir, harness) {
+  if (!harnessTargetSupportsAgents(harness)) return [];
   let instances;
   try {
     instances = effectiveAgentInstances(resolveSkWorkspaceConfig(projectDir));
@@ -96,16 +96,16 @@ function unboundAgentInstances(projectDir, driverTarget) {
   return out;
 }
 function removeAgentInstanceRenderings(opts) {
-  const { projectDir, driverTarget, ids } = opts;
-  if (!driverTargetSupportsAgents(driverTarget) || ids.length === 0) return [];
+  const { projectDir, harness, ids } = opts;
+  if (!harnessTargetSupportsAgents(harness) || ids.length === 0) return [];
   const ledger = readLedger(projectDir);
-  const previous = ledger.targets[driverTarget];
+  const previous = ledger.targets[harness];
   if (!previous) return [];
   const gone = new Set(ids);
   const claimed = new Set(
     Object.entries(previous).filter(([id]) => !gone.has(id)).flatMap(([, files]) => files)
   );
-  const agentDeployDir = deployedBase("agent", driverTarget, false, projectDir);
+  const agentDeployDir = deployedBase("agent", harness, false, projectDir);
   const removable = [resolve(agentDeployDir), resolve(dirname(agentDeployDir), CODEX_IDENTITY_DIR)];
   const root = resolve(projectDir);
   const removed = [];
@@ -120,28 +120,28 @@ function removeAgentInstanceRenderings(opts) {
   }
   const owned = Object.fromEntries(Object.entries(previous).filter(([id]) => !gone.has(id)));
   const nextTargets = { ...ledger.targets };
-  if (Object.keys(owned).length > 0) nextTargets[driverTarget] = owned;
-  else delete nextTargets[driverTarget];
+  if (Object.keys(owned).length > 0) nextTargets[harness] = owned;
+  else delete nextTargets[harness];
   if (JSON.stringify(nextTargets) !== JSON.stringify(ledger.targets)) {
     writeLedger(projectDir, { version: 1, targets: nextTargets });
   }
   return removed;
 }
 function installAgentInstances(opts) {
-  const { projectDir, driverTarget, log } = opts;
+  const { projectDir, harness, log } = opts;
   const result = {
     instances: [],
     removed: [],
     warnings: [],
     errors: []
   };
-  if (!driverTargetSupportsAgents(driverTarget)) return result;
+  if (!harnessTargetSupportsAgents(harness)) return result;
   const wsConfig = opts.wsConfig ?? resolveSkWorkspaceConfig(projectDir);
   const instances = effectiveAgentInstances(wsConfig);
-  const agentDeployDir = deployedBase("agent", driverTarget, false, projectDir);
-  const skillsRelDir = DRIVER_TARGETS[driverTarget]?.local.skill ?? "";
+  const agentDeployDir = deployedBase("agent", harness, false, projectDir);
+  const skillsRelDir = HARNESS_TARGETS[harness]?.local.skill ?? "";
   const ledger = readLedger(projectDir);
-  const previous = ledger.targets[driverTarget] ?? {};
+  const previous = ledger.targets[harness] ?? {};
   const owned = {};
   for (const [id, instance] of Object.entries(instances)) {
     const { srcDir, errors } = bindInstance(projectDir, id, instance);
@@ -154,7 +154,7 @@ function installAgentInstances(opts) {
       srcDir,
       agentDeployDir,
       projectDir,
-      driverTarget,
+      harness,
       skillsRelDir,
       id,
       /* includeSubAgents */
@@ -180,8 +180,8 @@ function installAgentInstances(opts) {
     result.removed.push(rel);
   }
   const nextTargets = { ...ledger.targets };
-  if (Object.keys(owned).length > 0) nextTargets[driverTarget] = owned;
-  else delete nextTargets[driverTarget];
+  if (Object.keys(owned).length > 0) nextTargets[harness] = owned;
+  else delete nextTargets[harness];
   if (JSON.stringify(nextTargets) !== JSON.stringify(ledger.targets)) {
     writeLedger(projectDir, { version: 1, targets: nextTargets });
   }
@@ -208,17 +208,17 @@ var UNSUPPORTED_SECRET_PREFIXES = [
 var TEMPLATE_PLACEHOLDER = /<[^<>\s/]+>/;
 var PAYLOAD_FETCH_TIMEOUT_MS = 6e4;
 var WORKSPACE_MARKER = /\$\{workspace\}/g;
-function substituteWorkspace(value, projectDir) {
-  return value.replace(WORKSPACE_MARKER, projectDir);
+function substituteWorkspace(value, absoluteRoot) {
+  return value.replace(WORKSPACE_MARKER, absoluteRoot ?? ".");
 }
 function renderSecretRef(value) {
   return value.startsWith("env:") ? `\${${value.slice(4)}}` : value;
 }
-function renderValueMap(map, projectDir) {
+function renderValueMap(map, substitute) {
   if (!map) return void 0;
   const out = {};
   for (const [k, v] of Object.entries(map)) {
-    out[k] = renderSecretRef(projectDir ? substituteWorkspace(v, projectDir) : v);
+    out[k] = renderSecretRef(substitute ? substitute(v) : v);
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
@@ -226,6 +226,12 @@ function findUnsupportedSecretRef(decl) {
   const values = [...Object.values(decl.env ?? {}), ...Object.values(decl.headers ?? {})];
   return values.find((v) => UNSUPPORTED_SECRET_PREFIXES.some((p) => v.startsWith(p)));
 }
+function literalSecretField(decl) {
+  return (decl.fields ?? []).filter((f) => f.sensitive === true || f.type === "password").map((f) => f.key).find((key) => {
+    const value = decl.env?.[key];
+    return value !== void 0 && value !== "" && !value.startsWith("env:");
+  });
+}
 function skipReason(decl) {
   if (RESERVED_MCP_SERVER_IDS.has(decl.id)) return "reserved id";
   if (decl.launcher === "recipe" || decl.launcher == null && decl.recipe != null) {
@@ -243,6 +249,10 @@ function skipReason(decl) {
   }
   const badRef = findUnsupportedSecretRef(decl);
   if (badRef) return `unsupported secret reference '${badRef}'`;
+  const literal = literalSecretField(decl);
+  if (literal) {
+    return `${literal} holds a literal secret, and .mcp.json is committed - set ${literal}: env:${literal} in the mcp_servers entry of skaile.yaml and export ${literal}, then run skaile install`;
+  }
   return void 0;
 }
 function payloadDir(projectDir, id) {
@@ -357,7 +367,7 @@ async function removePayloadDir(projectDir, id) {
   }
   await fs.rm(dir, { recursive: true, force: true });
 }
-function buildEntry(decl, projectDir) {
+function buildEntry(decl, absoluteRoot) {
   const transport = decl.transport ?? "stdio";
   if (transport !== "stdio") {
     const entry2 = { type: transport, url: decl.url };
@@ -365,12 +375,13 @@ function buildEntry(decl, projectDir) {
     if (headers) entry2.headers = headers;
     return entry2;
   }
+  const workspace = (value) => substituteWorkspace(value, absoluteRoot);
   const entry = {
-    command: substituteWorkspace(decl.command, projectDir)
+    command: workspace(decl.command)
   };
-  const args = decl.args?.map((a) => substituteWorkspace(a, projectDir));
+  const args = decl.args?.map(workspace);
   if (args && args.length > 0) entry.args = args;
-  const env = renderValueMap(decl.env, projectDir);
+  const env = renderValueMap(decl.env, workspace);
   if (env) entry.env = env;
   return entry;
 }
@@ -419,18 +430,32 @@ async function writeNotedSkips(projectDir, target, before, skipped) {
   else delete targets[target];
   await writeJson(notedSkipsPath(projectDir), { version: 1, targets });
 }
-async function readManagedIds(projectDir, target) {
+async function readManaged(projectDir, target) {
   const state = await readJsonStrict(managedStatePath(projectDir));
   const ids = state?.targets?.[target];
-  return Array.isArray(ids) ? ids : [];
+  const rendered = state?.rendered?.[target];
+  return {
+    ids: Array.isArray(ids) ? ids : [],
+    rendered: rendered && typeof rendered === "object" ? rendered : {}
+  };
 }
-async function writeManagedIds(projectDir, target, ids) {
+async function writeManaged(projectDir, target, record) {
   const p = managedStatePath(projectDir);
   const state = await readJsonStrict(p) ?? { targets: {} };
   const targets = { ...state.targets ?? {} };
-  if (ids.length > 0) targets[target] = ids;
-  else delete targets[target];
-  await writeJson(p, { version: 1, targets });
+  const rendered = { ...state.rendered ?? {} };
+  if (record.ids.length > 0) {
+    targets[target] = record.ids;
+    rendered[target] = record.rendered;
+  } else {
+    delete targets[target];
+    delete rendered[target];
+  }
+  await writeJson(p, {
+    version: 1,
+    targets,
+    ...Object.keys(rendered).length > 0 ? { rendered } : {}
+  });
 }
 async function removeEmptyLedger(projectDir) {
   const p = managedStatePath(projectDir);
@@ -469,12 +494,16 @@ function canonicalJson(value) {
     (_key, v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : v
   );
 }
-async function mcpServerDrift(projectDir, driverTarget, opts = {}) {
-  const relConfig = TARGET_MCP_CONFIG[driverTarget];
+function entryHash(entry) {
+  return createHash("sha256").update(canonicalJson(entry)).digest("hex");
+}
+async function mcpServerDrift(projectDir, harnessTarget, opts = {}) {
+  const relConfig = TARGET_MCP_CONFIG[harnessTarget];
   if (!relConfig) return [];
   const declarations = opts.declarations ?? await loadMcpServerDeclarations(projectDir);
-  const skippedNow = await readNotedSkips(projectDir, driverTarget);
-  const managed = new Set(await readManagedIds(projectDir, driverTarget));
+  const skippedNow = await readNotedSkips(projectDir, harnessTarget);
+  const ledger = await readManaged(projectDir, harnessTarget);
+  const managed = new Set(ledger.ids);
   let servers = {};
   try {
     const file = await readJsonStrict(path.join(projectDir, relConfig));
@@ -486,7 +515,7 @@ async function mcpServerDrift(projectDir, driverTarget, opts = {}) {
   const out = [];
   for (const decl of declarations) {
     if (skippedNow[decl.id] !== void 0 || skipReason(decl)) continue;
-    const drift = { id: decl.id, missing: [], modified: [], extra: [] };
+    const drift = { id: decl.id, missing: [], modified: [], extra: [], stale: [] };
     const dest = decl.payload ? rawPayloadDest(decl.payload) : void 0;
     const dir = payloadDir(projectDir, decl.id);
     if (decl.payload && dest !== void 0 && isPlainName(dest) && dir) {
@@ -510,18 +539,22 @@ async function mcpServerDrift(projectDir, driverTarget, opts = {}) {
     const owned = managed.has(decl.id);
     const lockedHere = opts.locked?.has(decl.id) || opts.locked?.has(decl.id.split("/").pop() ?? "");
     if (owned || lockedHere) {
-      const expected = JSON.parse(JSON.stringify(buildEntry(decl, projectDir)));
+      const expected = JSON.parse(JSON.stringify(buildEntry(decl)));
       const actual = Object.hasOwn(servers, decl.id) ? servers[decl.id] : void 0;
       const label = `${relConfig} entry "${decl.id}"`;
       if (actual === void 0) {
         drift.missing.push(label);
         drift.entry = { expected, actual };
       } else if (owned && canonicalJson(actual) !== canonicalJson(expected)) {
-        drift.modified.push(label);
+        const recorded = ledger.rendered[decl.id];
+        const untouched = recorded !== void 0 ? entryHash(actual) === recorded : entryHash(actual) === entryHash(buildEntry(decl, projectDir));
+        (untouched ? drift.stale : drift.modified).push(label);
         drift.entry = { expected, actual };
       }
     }
-    if (drift.missing.length + drift.modified.length + drift.extra.length > 0) out.push(drift);
+    if (drift.missing.length + drift.modified.length + drift.extra.length + drift.stale.length > 0) {
+      out.push(drift);
+    }
   }
   return out;
 }
@@ -547,7 +580,7 @@ function mcpDriftDiff(drift) {
   for (const f of drift.extra)
     out.push(`--- ${f} (deployed)`, "+++ /dev/null (not part of the asset)");
   if (drift.entry) {
-    const file = drift.missing.concat(drift.modified).find((f) => f.includes(" entry ")) ?? "MCP config entry";
+    const file = drift.missing.concat(drift.modified, drift.stale).find((f) => f.includes(" entry ")) ?? "MCP config entry";
     out.push(`--- ${file} (deployed)`, `+++ ${file} (declared)`);
     out.push(...jsonLineDiff(drift.entry.actual, drift.entry.expected));
   }
@@ -559,17 +592,39 @@ function unsetRequiredFields(decl) {
   return (decl.fields ?? []).filter((f) => f.required === true && f.default === void 0).filter((f) => !(decl.env && Object.hasOwn(decl.env, f.key))).map((f) => f.key);
 }
 function requiredFieldsAdvice(id, keys) {
-  return `needs ${keys.join(", ")} (required): set it with an mcp_servers entry (id: ${id}, env: \u2026) in skaile.yaml`;
+  const setting = keys.map((k) => `${k}: env:${k}`).join(", ");
+  return `needs ${keys.join(", ")} (required): set it with an mcp_servers entry (id: ${id}, env: ${setting}) in skaile.yaml and export the variable, then run skaile install`;
+}
+function mcpConfigFileOf(harnessTarget) {
+  return TARGET_MCP_CONFIG[harnessTarget];
 }
-async function renderMcpServerConfig(projectDir, driverTarget, opts) {
+async function mcpRenderedFootprint(projectDir, harnessTarget, name) {
+  const relConfig = TARGET_MCP_CONFIG[harnessTarget];
+  if (!relConfig) return void 0;
+  const ledger = await readManaged(projectDir, harnessTarget);
+  if (!ledger.ids.includes(name)) return void 0;
+  const dir = payloadDir(projectDir, name);
+  let hasPayload = false;
+  if (dir) {
+    try {
+      hasPayload = (await fs.stat(dir)).isDirectory();
+    } catch {
+    }
+  }
+  return {
+    file: relConfig,
+    ...dir && hasPayload ? { payloadDir: `${path.relative(projectDir, dir).split(path.sep).join("/")}/` } : {}
+  };
+}
+async function renderMcpServerConfig(projectDir, harnessTarget, opts) {
   const warn = opts?.warn ?? ((m) => console.warn(`skaile: ${m}`));
-  const relConfig = TARGET_MCP_CONFIG[driverTarget];
+  const relConfig = TARGET_MCP_CONFIG[harnessTarget];
   if (!relConfig) return { written: false, servers: [], removed: [], skipped: [] };
   const configPath = path.join(projectDir, relConfig);
   const declarations = await loadMcpServerDeclarations(projectDir);
   const skipped = [];
   const renderable = /* @__PURE__ */ new Map();
-  const noted = await readNotedSkips(projectDir, driverTarget);
+  const noted = await readNotedSkips(projectDir, harnessTarget);
   for (const decl of declarations) {
     const reason = skipReason(decl) ?? await ensurePayload(projectDir, decl, opts?.fetchPayload ?? defaultFetchPayload);
     if (reason) {
@@ -579,10 +634,11 @@ async function renderMcpServerConfig(projectDir, driverTarget, opts) {
       }
       continue;
     }
-    renderable.set(decl.id, buildEntry(decl, projectDir));
+    renderable.set(decl.id, buildEntry(decl));
   }
-  await writeNotedSkips(projectDir, driverTarget, noted, skipped);
-  const managedIds = await readManagedIds(projectDir, driverTarget);
+  await writeNotedSkips(projectDir, harnessTarget, noted, skipped);
+  const ledger = await readManaged(projectDir, harnessTarget);
+  const managedIds = ledger.ids;
   const existingFile = await readJsonStrict(configPath);
   if (renderable.size === 0 && managedIds.length === 0 && !existingFile) {
     return { path: configPath, written: false, servers: [], removed: [], skipped };
@@ -602,8 +658,9 @@ async function renderMcpServerConfig(projectDir, driverTarget, opts) {
     const unset = unsetRequiredFields(decl);
     if (unset.length > 0) warn(`MCP server "${decl.id}" ${requiredFieldsAdvice(decl.id, unset)}`);
   }
-  const ledgerStale = JSON.stringify(owned) !== JSON.stringify(managedIds);
-  if (ledgerStale) await writeManagedIds(projectDir, driverTarget, owned);
+  const rendered = Object.fromEntries(owned.map((id) => [id, entryHash(next[id])]));
+  const ledgerStale = JSON.stringify(owned) !== JSON.stringify(managedIds) || canonicalJson(rendered) !== canonicalJson(ledger.rendered);
+  if (ledgerStale) await writeManaged(projectDir, harnessTarget, { ids: owned, rendered });
   if (Object.keys(next).length === 0 && !existingFile) {
     return { path: configPath, written: false, servers: owned, removed, skipped };
   }
@@ -797,7 +854,10 @@ function isUnlistedLibraryAsset(entry, libPath) {
   if (listed.length === 0 && !manifestFileHasAssetsArray(libPath)) return false;
   const file = resolve(entry.source);
   return !listed.some((a) => {
-    if (!a.root || a.source) return false;
+    if (a.source) return false;
+    const filesOnly = filesEntryPaths(libPath, a);
+    if (filesOnly) return filesOnly.some((f) => resolve(libPath, f) === file);
+    if (!a.root) return false;
     const root = resolve(libPath, a.root);
     return file === root || file.startsWith(root + sep);
   });
@@ -807,7 +867,7 @@ function withLibraryFiles(entry, libPath, cache, registry) {
   if (!byManifest) {
     byManifest = /* @__PURE__ */ new Map();
     const sourceConfig = readManifestSourceConfig(libPath, "library");
-    if (sourceConfig && isManifestMode(sourceConfig)) {
+    if (sourceConfig && isManifestMode(sourceConfig) || existsSync(join(libPath, ".git"))) {
       for (const a of discoverAssetsInTree(libPath, { sourceConfig, registry }).assets) {
         const { assetRoot, files: files2 } = a.fileFilter;
         byManifest.set(
@@ -903,27 +963,32 @@ function libraryEntryDepRefs(e) {
   }
   return [...refs];
 }
-function assertFlowsLoad(entries) {
+function flowLoadError(e) {
+  let file = e.source;
+  if (!file) return void 0;
+  let authored;
+  try {
+    if (lstatSync(file).isDirectory()) {
+      const inside = [`${e.name}.flow.yaml`, `${e.name}.flow.yml`, `${e.name}.flow.json`].map((n) => join(file, n)).find((p) => existsSync(p));
+      if (!inside) return void 0;
+      file = inside;
+    }
+    const raw = readFileSync(file, "utf8");
+    authored = /\.json$/i.test(file) ? JSON.parse(raw) : parse(raw);
+  } catch {
+    return void 0;
+  }
+  const parsed = parseFlowDefinition(authored);
+  if (parsed.ok) return void 0;
+  return parsed.errors.slice(0, 3).map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+}
+function assertFlowsLoad(entries, done) {
   for (const e of entries) {
     if (e.kind !== "flow" || !e.source) continue;
-    let file = e.source;
-    let authored;
-    try {
-      if (lstatSync(file).isDirectory()) {
-        const inside = [`${e.name}.flow.yaml`, `${e.name}.flow.yml`, `${e.name}.flow.json`].map((n) => join(file, n)).find((p) => existsSync(p));
-        if (!inside) continue;
-        file = inside;
-      }
-      const raw = readFileSync(file, "utf8");
-      authored = /\.json$/i.test(file) ? JSON.parse(raw) : parse(raw);
-    } catch {
-      continue;
-    }
-    const parsed = parseFlowDefinition(authored);
-    if (parsed.ok) continue;
-    const details = parsed.errors.slice(0, 3).map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+    const details = flowLoadError(e);
+    if (details === void 0) continue;
     throw new Error(
-      `${canonicalEntryRef(e).split("#")[0]} is not a flow the flow engine can load (${details}) \u2014 nothing was added; fix the flow in its library or source`
+      `${canonicalEntryRef(e).split("#")[0]} is not a flow the flow engine can load (${details}) \u2014 nothing was ${done}; fix the flow in its library or source`
     );
   }
 }
@@ -1228,7 +1293,7 @@ function decodeEntryHarnesses(value) {
   for (const [key, list] of Object.entries(value)) {
     if (!Array.isArray(list)) continue;
     const valid = list.filter(
-      (h) => SUPPORTED_DRIVER_TARGETS.includes(h)
+      (h) => SUPPORTED_HARNESSES.includes(h)
     );
     if (valid.length > 0) out[key] = [...new Set(valid)];
   }
@@ -1237,8 +1302,8 @@ function decodeEntryHarnesses(value) {
 var AssetManager = class {
   /** Resolved absolute path to the workspace root. */
   projectDir;
-  /** Agent framework driver target used for all deploy operations. */
-  driverTarget;
+  /** Harness all deploy operations target (a `HarnessName`). */
+  harness;
   /** Whether this instance operates in global-install mode. */
   global;
   /** Asset-kind registry shared with the host (one instance per process). */
@@ -1279,7 +1344,7 @@ var AssetManager = class {
     this.projectDir = resolve(opts.projectDir);
     this.global = opts.global ?? false;
     this.registry = opts.registry;
-    this.driverTarget = opts.driverTarget ?? (this.global ? void 0 : resolveConfiguredDriverTarget(this.projectDir)) ?? "claude-code";
+    this.harness = opts.harness ?? (this.global ? void 0 : resolveConfiguredHarnessName(this.projectDir)) ?? "claude-code";
     this.harnessesOverride = opts.harnesses ?? opts.backends;
     this.injectedStoreFetcher = opts.storeFetcher;
     this.injectedAssetFetcher = opts.assetFetcher;
@@ -1304,7 +1369,7 @@ var AssetManager = class {
   /**
    * Root for this manager's **state** — config SSOT, lock, cache, history.
    * `~/.skaile` in global mode (the cross-harness SSOT), else the project dir.
-   * Deploy dirs are unaffected; they come from `DRIVER_TARGETS[target]`.
+   * Deploy dirs are unaffected; they come from `HARNESS_TARGETS[target]`.
    */
   get stateRoot() {
     return this.global ? globalSkaileDir() : this.projectDir;
@@ -1314,11 +1379,11 @@ var AssetManager = class {
    * filter), else the explicit `global_harnesses:` of `~/.skaile/skaile.yaml`, else every harness
    * whose root dir exists under `~` plus the harness the project is configured for (a project on
    * a harness whose dir does not exist yet still gets its user-scope assets). In project mode
-   * this is exactly `[driverTarget]`, so the shared fan-out loop degenerates to the
+   * this is exactly `[harness]`, so the shared fan-out loop degenerates to the
    * single-target path.
    */
   targetHarnesses() {
-    if (!this.global) return [this.driverTarget];
+    if (!this.global) return [this.harness];
     if (this.harnessesOverride && this.harnessesOverride.length > 0) return this.harnessesOverride;
     return this.defaultGlobalHarnesses();
   }
@@ -1326,7 +1391,7 @@ var AssetManager = class {
   defaultGlobalHarnesses() {
     const resolved = resolveGlobalHarnesses();
     if (resolveGlobalSkWorkspaceConfig().global_harnesses?.length) return resolved;
-    const configured = resolveConfiguredDriverTarget(this.projectDir);
+    const configured = resolveConfiguredHarnessName(this.projectDir);
     return configured && !resolved.includes(configured) ? [...resolved, configured] : resolved;
   }
   /**
@@ -1455,7 +1520,7 @@ var AssetManager = class {
     return this.legacyCopiesRemoved.splice(0);
   }
   /**
-   * The harnesses `add` / `install` deploy into: `[driverTarget]` for a project, the global
+   * The harnesses `add` / `install` deploy into: `[harness]` for a project, the global
    * harness set (see {@link AssetManager.targetHarnesses}) for a global manager.
    */
   deployTargets() {
@@ -1489,12 +1554,12 @@ var AssetManager = class {
   get patchDir() {
     return join(this.projectDir, ".skaile", "patches");
   }
-  /** Deploy options for one harness. In global mode, `driverTarget` is the
-   * fan-out target (not the constructor's `driverTarget`, which is project-only). */
+  /** Deploy options for one harness. In global mode, `harness` is the
+   * fan-out target (not the constructor's `harness`, which is project-only). */
   deployOptsFor(target, link, onSecretFile) {
     return {
       registry: this.registry,
-      driverTarget: target,
+      harness: target,
       global: this.global,
       cwd: this.projectDir,
       link: link === true,
@@ -1523,7 +1588,7 @@ var AssetManager = class {
     if (locked.size === 0) return [];
     let rows;
     try {
-      rows = await mcpServerDrift(this.projectDir, this.driverTarget, { locked });
+      rows = await mcpServerDrift(this.projectDir, this.harness, { locked });
     } catch {
       return [];
     }
@@ -1543,7 +1608,47 @@ var AssetManager = class {
     return out;
   }
   /**
-   * Render the project's declared MCP servers into the driver target's own
+   * What the render wrote for the `mcp-server` asset `name` into the coding agent's MCP
+   * config: the config file and, for a server with a payload, the payload directory
+   * (project-relative). `written` is false when the render left the server out (see
+   * {@link AssetManager.mcpNotices}). `undefined` when the harness has no MCP config skaile
+   * writes (`codex`, `omp`) or for a global manager: the asset is composed at run time only.
+   */
+  async mcpRenderFootprint(name) {
+    if (this.global) return void 0;
+    const file = mcpConfigFileOf(this.harness);
+    if (!file) return void 0;
+    const footprint = await mcpRenderedFootprint(this.projectDir, this.harness, unscopedName(name));
+    return footprint ? { ...footprint, written: true } : { file, written: false };
+  }
+  /**
+   * The declared MCP servers whose `.mcp.json` entry skaile wrote and nothing edited, but that
+   * `skaile.yaml` (or a newer asset) now renders differently: the config waits for
+   * `skaile install`. Covers a locked `mcp-server` and an `mcp_servers:` entry alike; the
+   * server is named by its lock identity when it has one, else `mcp-server:<id>`. Empty for a
+   * global manager.
+   */
+  async mcpPendingRender() {
+    if (this.global) return [];
+    const file = mcpConfigFileOf(this.harness);
+    if (!file) return [];
+    let rows;
+    try {
+      rows = await mcpServerDrift(this.projectDir, this.harness, {
+        locked: this.lockedMcpNames()
+      });
+    } catch {
+      return [];
+    }
+    const keys = Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey);
+    return rows.filter((r) => r.stale.length > 0).map((r) => {
+      const name = unscopedName(r.id);
+      const publisher = keys.find((k) => k.kind === "mcp-server" && k.name === name)?.publisher;
+      return { ref: publisher ? `mcp-server:@${publisher}/${name}` : `mcp-server:${name}`, file };
+    });
+  }
+  /**
+   * Render the project's declared MCP servers into the harness target's own
    * native MCP config (`<project>/.mcp.json` for `claude-code`), so the coding
    * agent sees the same servers skaile's agent loop wires up.
    *
@@ -1556,14 +1661,14 @@ var AssetManager = class {
    *   removed) because they had drifted from the declaration: `install` names them, as it does
    *   a restored skill file.
    */
-  async renderDriverMcpConfig() {
+  async renderHarnessMcpConfig() {
     if (this.global) return [];
     const before = await this.mcpDriftRows();
     try {
-      await renderMcpServerConfig(this.projectDir, this.driverTarget);
+      await renderMcpServerConfig(this.projectDir, this.harness);
     } catch (err) {
       console.warn(
-        `skaile: could not render MCP config for ${this.driverTarget}: ${err instanceof Error ? err.message : String(err)}`
+        `skaile: could not render MCP config for ${this.harness}: ${err instanceof Error ? err.message : String(err)}`
       );
       return [];
     }
@@ -1572,8 +1677,14 @@ var AssetManager = class {
     const restored = [];
     for (const { ref, key, drift } of before) {
       const left = after.find((a) => a.ref === ref)?.drift;
-      const stillWrong = /* @__PURE__ */ new Set([...left?.missing ?? [], ...left?.modified ?? []]);
-      const rewritten = [...drift.missing, ...drift.modified].filter((f) => !stillWrong.has(f));
+      const stillWrong = /* @__PURE__ */ new Set([
+        ...left?.missing ?? [],
+        ...left?.modified ?? [],
+        ...left?.stale ?? []
+      ]);
+      const rewritten = [...drift.missing, ...drift.modified, ...drift.stale].filter(
+        (f) => !stillWrong.has(f)
+      );
       const removed = drift.extra.filter((f) => !left?.extra.includes(f));
       if (rewritten.length > 0 || removed.length > 0)
         restored.push({ ref: key, restored: rewritten, removed });
@@ -1581,7 +1692,7 @@ var AssetManager = class {
     return restored;
   }
   /**
-   * Render every agent instance of `skaile.yaml` into the driver target's native
+   * Render every agent instance of `skaile.yaml` into the harness target's native
    * agent files (`.claude/agents/<id>.md`, …) and prune the renderings of
    * instances that left the config. Runs after the skills deploy, so composed
    * skills resolve. Project scope only. An instance whose `ref` resolves to no agent is
@@ -1592,10 +1703,10 @@ var AssetManager = class {
     try {
       const result = installAgentInstances({
         projectDir: this.projectDir,
-        driverTarget: this.driverTarget
+        harness: this.harness
       });
       const details = [];
-      for (const u of unboundAgentInstances(this.projectDir, this.driverTarget)) {
+      for (const u of unboundAgentInstances(this.projectDir, this.harness)) {
         if (!u.ref.startsWith("agent:")) continue;
         const at = result.errors.findIndex((e) => e.startsWith(`agent instance "${u.id}":`));
         if (at < 0) continue;
@@ -1612,7 +1723,7 @@ var AssetManager = class {
       };
     } catch (err) {
       console.warn(
-        `skaile: could not render agent instances for ${this.driverTarget}: ${err instanceof Error ? err.message : String(err)}`
+        `skaile: could not render agent instances for ${this.harness}: ${err instanceof Error ? err.message : String(err)}`
       );
       return {};
     }
@@ -2116,12 +2227,18 @@ var AssetManager = class {
       const id = refIdentity(d);
       if (id !== null) held.add(id);
     }
+    const declaredSources = new Set(this.loadConfig().sources.map((s) => sourceCacheKey(s.url)));
+    const orphanReaders = new Set(
+      ((await this.loadLibraryIndex())?.libraries ?? []).filter(
+        (l) => l.ownership === "reader" && "url" in l.backendConfig && !declaredSources.has(sourceCacheKey(l.backendConfig.url))
+      ).map((l) => l.name)
+    );
     for (const [ref, w] of wanted) {
       const origin = lockEntries.map(([key, e]) => ({ id: parseCanonicalLockKey(key), library: e.library })).find(
         ({ id, library }) => library && !library.installed && id.kind === w.kind && id.name === w.name && id.publisher === w.publisher
       )?.library?.name;
       const pool = [...scan.byKey.values()].flat().filter(
-        (c) => c.entry.kind === w.kind && c.entry.name === w.name && c.entry.publisher !== w.publisher && (origin ? c.library === origin : !held.has(`${c.entry.publisher}/${c.entry.kind}:${c.entry.name}`))
+        (c) => c.entry.kind === w.kind && c.entry.name === w.name && c.entry.publisher !== w.publisher && !orphanReaders.has(c.library) && (origin ? c.library === origin : !held.has(`${c.entry.publisher}/${c.entry.kind}:${c.entry.name}`))
       );
       const publishers = new Set(pool.map((c) => c.entry.publisher));
       const best = publishers.size === 1 ? pool.sort(libraryPreference(scan.isDefaultLib))[0] : void 0;
@@ -2365,7 +2482,7 @@ var AssetManager = class {
       const slot = `${component}/${a.name}`;
       const prior = seen.get(slot);
       if (prior && differs(prior, a)) {
-        const dir2 = deployedDir(component, a.name, this.driverTarget, this.global, this.projectDir);
+        const dir2 = deployedDir(component, a.name, this.harness, this.global, this.projectDir);
         throw new Error(
           `${refOf(prior)} and ${refOf(a)} both deploy to ${shown(dir2)} \u2014 keep only one of them`
         );
@@ -2437,7 +2554,7 @@ var AssetManager = class {
     }
     const drift = deployedAssetDrift(entry, {
       registry: this.registry,
-      driverTarget: target,
+      harness: target,
       global: this.global,
       cwd: this.projectDir
     });
@@ -2620,7 +2737,7 @@ var AssetManager = class {
       const lookup = this.lockedLibrary(e.library, snap, { kind, publisher, name });
       if (lookup.state === "ok") continue;
       const component = this.installTarget(kind);
-      const deployed = component !== void 0 && isDeployed(component, name, this.driverTarget, this.global, this.projectDir);
+      const deployed = component !== void 0 && isDeployed(component, name, this.harness, this.global, this.projectDir);
       const problem = lockedLibraryProblem(lookup, e.library, `${kind}:@${publisher}/${name}`);
       const kept = deployed ? "the deployed copy and its lock entry are kept" : "its lock entry is kept; no deployed copy exists";
       lines.push(`${ref} (${problem}; ${kept})`);
@@ -2673,10 +2790,11 @@ var AssetManager = class {
       if (!sameVersion) {
         const component = this.installTarget(kind);
         const newer = gt(coerceVersion(current), coerceVersion(origin.version));
-        const intact = newer && (component === void 0 || isDeployed(component, name, this.driverTarget, this.global, this.projectDir));
+        const comparable = !isPseudoVersion(current) && !isPseudoVersion(origin.version);
+        const intact = (newer || comparable) && (component === void 0 || isDeployed(component, name, this.harness, this.global, this.projectDir));
         if (!intact) {
           missing.push(
-            `${ref} (library "${lookup.name}" is at ${current}, locked ${origin.version}${newer ? "; `skaile update` moves the lock to it" : ""})`
+            `${ref} (library "${lookup.name}" is at ${current}, locked ${origin.version}${newer || comparable ? "; `skaile update` moves the lock to it" : ""})`
           );
         }
         continue;
@@ -2707,13 +2825,13 @@ var AssetManager = class {
       if (id.kind !== want.kind || id.name !== want.name) return false;
       if (want.publisher && id.publisher !== want.publisher) return false;
       const component = this.installTarget(id.kind);
-      return component !== void 0 && isDeployed(component, id.name, this.driverTarget, this.global, this.projectDir);
+      return component !== void 0 && isDeployed(component, id.name, this.harness, this.global, this.projectDir);
     });
   }
   /** Whether the deployed copy of a library asset is on disk; a kind with no install target has none to check. */
   lockedCopyDeployed(kind, name) {
     const component = this.installTarget(kind);
-    return component === void 0 || isDeployed(component, name, this.driverTarget, this.global, this.projectDir);
+    return component === void 0 || isDeployed(component, name, this.harness, this.global, this.projectDir);
   }
   /**
    * The library-origin lock entries `install` keeps when the library holds a newer version:
@@ -2799,6 +2917,30 @@ var AssetManager = class {
     const found = this.lockedLibrary(origin, snap);
     return found.state === "ok" ? found.path : null;
   }
+  /**
+   * Rename the library every library-origin lock entry names: `library rename <interim> <old>`
+   * puts a library back under its old name, and an entry locked in between would keep the
+   * interim name, so a later "register library again" advice would name a library nobody knows
+   * any more (p893). Nothing is written when no entry names `from`.
+   *
+   * @returns the number of lock entries renamed.
+   */
+  renameLockedLibrary(from, to) {
+    const lock = this.tryReadLock();
+    if (!lock) return 0;
+    let renamed = 0;
+    const assets = {};
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (entry.library && !entry.library.installed && entry.library.name === from) {
+        assets[key] = { ...entry, library: { ...entry.library, name: to } };
+        renamed++;
+      } else {
+        assets[key] = entry;
+      }
+    }
+    if (renamed > 0) writeLock(this.lockPath, { ...lock, assets });
+    return renamed;
+  }
   /**
    * The `kind:@publisher/name` identities the lock holds for one `kind` and `name`, whatever
    * their publisher. `diff` uses it to accept a ref without a publisher only when it names
@@ -2932,7 +3074,7 @@ var AssetManager = class {
       const lockedVersion = locked?.entry.library?.version;
       if (!locked || !lockedVersion || !e.version) return void 0;
       if (isPseudoVersion(lockedVersion) || isPseudoVersion(e.version)) return void 0;
-      if (!gt(coerceVersion(e.version), coerceVersion(lockedVersion))) return void 0;
+      if (coerceVersion(e.version) === coerceVersion(lockedVersion)) return void 0;
       for (const r of asked) if (refIdentity(r) === id && r.includes("#")) return void 0;
       return locked;
     };
@@ -2969,7 +3111,7 @@ var AssetManager = class {
           keptVersions[keep.key] = keep.entry;
           if (!this.lockedCopyDeployed(e.kind, e.name)) {
             versionBlocked.push(
-              `${keep.key} (library "${origin ?? keep.entry.library?.name}" is at ${e.version}, locked ${keep.entry.library?.version}; the deployed copy is gone and cannot be restored from the newer files \u2014 \`skaile update\` moves the lock to it)`
+              `${keep.key} (library "${origin ?? keep.entry.library?.name}" is at ${e.version}, locked ${keep.entry.library?.version}; the deployed copy is gone and cannot be restored from the ${gt(coerceVersion(e.version ?? ""), coerceVersion(keep.entry.library?.version ?? "")) ? "newer" : "older"} files \u2014 \`skaile update\` moves the lock to it)`
             );
           }
         } else {
@@ -3031,6 +3173,12 @@ var AssetManager = class {
           resolved.push(c);
         }
         for (const o of r.overridesApplied) overridesApplied.add(o);
+        if (opts.readStoreRequires) {
+          const repositories = this.loadConfig().repositories;
+          for (const c of r.resolved) {
+            next.push(...await this.readStoreCandidateRequires(c, repositories));
+          }
+        }
         presets.push(...r.presets);
         const hit2 = await this.resolveLibraryEntries(
           r.missing.filter((m) => !libraryTried.has(m)),
@@ -3103,8 +3251,8 @@ var AssetManager = class {
    * project store should be synthesized — `local` sentinel, already-declared,
    * or no URL. Honours an explicit `catalogUrl` injection (`""` and `"local"` disable it).
    */
-  async globalStoreFallback(projectStores) {
-    let url = this.catalogUrlOverride;
+  async globalStoreFallback(projectStores, honourOverride = true) {
+    let url = honourOverride ? this.catalogUrlOverride : void 0;
     if (url === void 0) {
       try {
         const { resolveConfig: resolveConfig2 } = await import('./library/index.js');
@@ -3194,6 +3342,43 @@ var AssetManager = class {
     }
     return staged;
   }
+  /**
+   * The requirements a store candidate's own manifest declares (`metadata.requires`, a manifest
+   * `dependencies:`) that its catalog row did not list, read from the staged bytes. The catalog
+   * row is the store's own summary and may hold only same-kind ones; the deployed copy is what
+   * `check` reads, so a requirement only the manifest names would be missing right after `add`
+   * (p1221). Each one is added to the candidate's `deps` and `storeRequires` (the lock records
+   * them) and returned so the caller resolves, deploys and locks it like any other dependency.
+   * A candidate whose bytes come from a source clone, or that has none, adds nothing.
+   */
+  async readStoreCandidateRequires(c, repositories) {
+    if (c.kind === "preset") return [];
+    const staged = (await this.stageStoreAssets([c], repositories)).get(this.candidateKey(c));
+    if (!staged) return [];
+    let own;
+    try {
+      const scanned = await scanDirectory(dirname(staged), c.publisher, {
+        knownKinds: this.knownKinds
+      });
+      own = scanned.find((e) => e.kind === c.kind && e.name === c.name);
+    } catch {
+      return [];
+    }
+    if (!own) return [];
+    const known = new Set((c.deps ?? []).map((d) => refIdentity(qualifyDepRef(d, c.publisher))));
+    const added = [];
+    for (const ref of libraryEntryDepRefs(own)) {
+      const id = refIdentity(ref);
+      if (id === null || known.has(id)) continue;
+      known.add(id);
+      added.push(ref);
+    }
+    if (added.length > 0) {
+      c.deps = [...c.deps ?? [], ...added];
+      c.storeRequires = [...c.storeRequires ?? [], ...added];
+    }
+    return added;
+  }
   /** Repo-relative path of a candidate's primary manifest (un-stripped). */
   primaryManifestRel(c) {
     const paths = (c.files ?? []).map((f) => f.path);
@@ -3298,6 +3483,19 @@ var AssetManager = class {
           npmFailed: []
         };
       }
+      const orphans = await this.orphanedSourceGaps(
+        await this.declaredLockKeys(lockForLibraries, dependencies)
+      );
+      if (orphans.size > 0) {
+        return {
+          deployed: [],
+          removed: [],
+          missing: [...orphans.values()].map((g) => g.message),
+          lockWritten: false,
+          npmInstalled: [],
+          npmFailed: []
+        };
+      }
     }
     const cloneError = this.ensureSourceClones(
       repositories,
@@ -3328,7 +3526,8 @@ var AssetManager = class {
       // `install` restores what the lock recorded: a changed default library or a second
       // library holding the same ref does not move a locked asset. `update` re-resolves.
       ...opts?.moveLibraries ? { preferLocked: await this.lockedPreference() } : { lockedLibraries: await this.lockedLibraryNames() },
-      ...keepLocked ? { keepLocked } : {}
+      ...keepLocked ? { keepLocked } : {},
+      readStoreRequires: true
     });
     this.assertNoFolderCollision([...resolved, ...lib.entries.map((e) => this.entryIdentity(e))]);
     if (!opts?.force && !(existsSync(this.lockPath) && this.tryReadLock() === null)) {
@@ -3396,7 +3595,14 @@ var AssetManager = class {
     };
     await this.keepRequiredByKept(prevLock, kept, Object.keys(freshLock.assets));
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
+    assertFlowsLoad(entries, "installed");
     assertNoLibrarySymlinks(entries, this.registry, repositories, opts?.link === true);
+    if (!opts?.force) {
+      await this.assertNoHandEditsPruned(
+        resolved,
+        /* @__PURE__ */ new Set([...Object.keys(libraryLock), ...Object.keys(kept.assets)])
+      );
+    }
     const { removed, replaced } = this.reconcileRemovedAssets(
       resolved,
       /* @__PURE__ */ new Set([...Object.keys(libraryLock), ...Object.keys(kept.assets)])
@@ -3417,7 +3623,7 @@ var AssetManager = class {
       )
     ];
     this.sweepLegacyOmpCopies(entries);
-    const mcpRestored = await this.renderDriverMcpConfig();
+    const mcpRestored = await this.renderHarnessMcpConfig();
     const agentRender = await this.renderAgentInstances();
     const restored = [...this.restoredCopies(copyDrift, deployed, missingCopies), ...mcpRestored];
     const rewritten = this.rewrittenAgentFiles(unrecordedAgents);
@@ -3535,7 +3741,7 @@ var AssetManager = class {
     const locked = this.lockedRequirementsOf(id);
     const withLocked = (scanned) => [.../* @__PURE__ */ new Set([...scanned, ...locked])];
     const keptAgent = kind === "agent" && !this.global ? join(agentSourceCacheDir(this.projectDir), name) : null;
-    const dir = keptAgent && existsSync(keptAgent) ? keptAgent : deployedDir(component, name, this.driverTarget, this.global, this.projectDir);
+    const dir = keptAgent && existsSync(keptAgent) ? keptAgent : deployedDir(component, name, this.harness, this.global, this.projectDir);
     if (!existsSync(dir)) return withLocked([]);
     try {
       const scanned = await scanDirectory(dir, publisher ?? "", { knownKinds: this.knownKinds });
@@ -3620,6 +3826,46 @@ var AssetManager = class {
     const entries = this.tryReadLock()?.assets ?? {};
     return Object.fromEntries(Object.entries(entries).filter(([, e]) => e.library?.installed));
   }
+  /**
+   * Refuse to prune a stale lock entry (in the old lock, not in the new resolved set, with no
+   * other version taking its place) whose deployed folder holds hand edits: the files that differ
+   * from the lock are named, nothing is removed, and `--force` prunes anyway (OQ6).
+   */
+  async assertNoHandEditsPruned(resolved, keep) {
+    const oldLock = this.tryReadLock();
+    if (!oldLock) return;
+    const resolvedRefs = [
+      ...resolved.map((c) => `${c.kind}:@${c.publisher}/${c.name}#${c.version}`),
+      ...keep
+    ];
+    const stale = /* @__PURE__ */ new Set();
+    for (const key of Object.keys(oldLock.assets)) {
+      if (resolvedRefs.includes(key)) continue;
+      const { kind, name, publisher } = parseCanonicalLockKey(key);
+      if (!kind || !name || kind === "preset") continue;
+      const replaced = resolvedRefs.some((r) => {
+        const o = parseCanonicalLockKey(r);
+        return o.kind === kind && o.name === name && o.publisher === publisher;
+      });
+      if (!replaced) stale.add(key);
+    }
+    if (stale.size === 0) return;
+    const lines = [];
+    for (const d of await this.lockedCopyDrift()) {
+      if (!stale.has(d.key)) continue;
+      const files = [
+        ...d.modified.map((f) => `${f} was edited`),
+        ...d.extra.map((f) => `${f} is not part of the asset`)
+      ];
+      lines.push(`${d.ref} (${files.join("; ")})`);
+    }
+    if (lines.length === 0) return;
+    throw new Error(
+      `Not pruned: skaile.yaml no longer declares ${lines.length === 1 ? "an asset" : "assets"} whose deployed copy holds your edits:
+  ${lines.join("\n  ")}
+Nothing was changed. Declare it again to keep it, or run \`skaile install --force\` to prune it with its edits.`
+    );
+  }
   /**
    * Remove stale assets — those recorded in the old lock but absent from the
    * newly resolved set (`resolved` source candidates plus `keep`, the canonical
@@ -3843,7 +4089,15 @@ var AssetManager = class {
       }
       throw new Error("No lock file found. Run `skaile install` first.");
     }
+    assertLockHashes(lock);
     this.assertNoFolderCollision(Object.keys(lock.assets).map(parseCanonicalLockKey));
+    const orphaned = [...(await this.orphanedSourceGaps()).values()];
+    if (orphaned.length > 0) {
+      throw new Error(
+        `Lock file verification failed:
+  ${orphaned.map((g) => g.message).join("\n  ")}`
+      );
+    }
     const declBySlug = new Map(Object.entries(repositories));
     const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
     const factoryDecl = Object.values(repositories).find((d) => d.factory);
@@ -3913,6 +4167,7 @@ var AssetManager = class {
   ${reason}`);
     }
     const library = await this.restoreLibraryLockEntries(lock);
+    assertFlowsLoad([...resolved, ...library.entries], "installed");
     assertNoLibrarySymlinks([...resolved, ...library.entries], this.registry, repositories);
     const copyDrift = await this.lockedCopyDrift();
     const missingCopies = await this.incompleteDeploys();
@@ -3930,7 +4185,7 @@ var AssetManager = class {
       )
     ];
     this.sweepLegacyOmpCopies([...resolved, ...library.entries]);
-    const mcpRestored = await this.renderDriverMcpConfig();
+    const mcpRestored = await this.renderHarnessMcpConfig();
     const agentRender = await this.renderAgentInstances();
     const restored = [...this.restoredCopies(copyDrift, deployed, missingCopies), ...mcpRestored];
     const rewritten = this.rewrittenAgentFiles(unrecordedAgents);
@@ -4079,6 +4334,7 @@ var AssetManager = class {
         stores,
         declaredRefs: dependencies,
         warnCollisions: true,
+        readStoreRequires: true,
         ...opts?.preferLockedLibrary ? { preferLocked: await this.lockedPreference() } : {}
       });
     } finally {
@@ -4101,6 +4357,19 @@ var AssetManager = class {
           );
         }
       }
+      for (const l of snap?.libraries ?? []) {
+        const libPath = this.libraryPath({ name: l.name }, snap);
+        const manifest = libPath ? loadSkPublishManifest(libPath) : null;
+        if (!libPath || !manifest) continue;
+        const gone = missingRootAssets(libPath, manifest).find(
+          (a) => a.kind === parsed.kind && a.name === parsed.name && (!parsed.publisher || bare(a.publisher ?? manifest.publisher) === bare(parsed.publisher))
+        );
+        if (gone) {
+          throw new Error(
+            `library "${l.name}" lists ${parsed.kind}:${parsed.name} but its directory ${gone.root}/ is missing: run \`skaile library index ${l.name}\` to drop the entry, or restore the directory.`
+          );
+        }
+      }
       const unreachable = [...this.storeFailures.values()];
       if (unreachable.length > 0) {
         throw new Error(
@@ -4169,8 +4438,20 @@ var AssetManager = class {
       );
     }
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
-    assertFlowsLoad(entries);
+    assertFlowsLoad(entries, "added");
     assertNoLibrarySymlinks(entries, this.registry, repositories, opts?.link === true);
+    if (parsed.kind === "mcp-server" && !this.global) {
+      const decls = await loadMcpServerDeclarations(this.projectDir, { alsoDeclared: [ref] });
+      const mine = decls.find(
+        (d) => d.id === parsed.name || unscopedName(d.id) === unscopedName(parsed.name)
+      );
+      const literal = mine ? literalSecretField(mine) : void 0;
+      if (mine && literal) {
+        throw new Error(
+          `${ref.split("#")[0]}: ${literal} is set to a literal value, and .mcp.json is committed - write ${literal}: env:${literal} in the mcp_servers entry of skaile.yaml and export ${literal}. Nothing was added`
+        );
+      }
+    }
     const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
@@ -4199,7 +4480,7 @@ var AssetManager = class {
       opts?.onPlaceholderDescription?.(placeholder);
     }
     this.addDependencyToConfig(ref);
-    await this.renderDriverMcpConfig();
+    await this.renderHarnessMcpConfig();
     await this.renderAgentInstances();
     if (resolved.length > 0 || lib.entries.length > 0) {
       const libraryLock = await this.libraryLockEntries(lib);
@@ -4466,7 +4747,7 @@ var AssetManager = class {
    * Removes only `ref` itself; use {@link removeWithDependencies} to also drop the
    * dependencies it leaves orphaned.
    *
-   * Deliberately does NOT re-render the driver target's MCP config: the render
+   * Deliberately does NOT re-render the harness target's MCP config: the render
    * step is async (the declaration resolver is), and making this synchronous
    * method async would break every external caller. {@link removeWithDependencies}
    * (what `skaile remove` runs) does re-render it; a caller of this method gets the
@@ -4542,7 +4823,7 @@ var AssetManager = class {
     };
     const pruned = changed && requiredRefs.length > 0 ? await this.pruneOrphans(requiredRefs) : [];
     if (changed && (target.kind === "mcp-server" || pruned.some((r) => r.startsWith("mcp-server:")))) {
-      await this.renderDriverMcpConfig();
+      await this.renderHarnessMcpConfig();
     }
     return { changed, pruned, ...keptNote };
   }
@@ -4899,7 +5180,7 @@ var AssetManager = class {
     const seen = /* @__PURE__ */ new Set();
     for (const k of kinds) {
       try {
-        const base = deployedBase(k, this.driverTarget, this.global, this.projectDir);
+        const base = deployedBase(k, this.harness, this.global, this.projectDir);
         if (!existsSync(base)) continue;
         for (const item of readdirSync(base, { withFileTypes: true })) {
           let name;
@@ -4941,7 +5222,7 @@ var AssetManager = class {
    * @returns One {@link LegacyDeployedAsset} per stale copy, sorted by kind then name.
    */
   listLegacyClaudeDeployed() {
-    if (this.global || this.driverTarget === "claude-code") return [];
+    if (this.global || this.harness === "claude-code") return [];
     const tracked = /* @__PURE__ */ new Map();
     const track = (kind, name) => {
       const component = kind ? this.installTarget(kind) : void 0;
@@ -4969,7 +5250,7 @@ var AssetManager = class {
     const out = [];
     for (const { kind, name, component: k } of tracked.values()) {
       const legacy = deployedDir(k, name, "claude-code", false, this.projectDir);
-      if (legacy === deployedDir(k, name, this.driverTarget, false, this.projectDir)) continue;
+      if (legacy === deployedDir(k, name, this.harness, false, this.projectDir)) continue;
       const found = deployedPaths(k, name, "claude-code", false, this.projectDir).find((p) => {
         try {
           lstatSync(p);
@@ -5046,10 +5327,10 @@ var AssetManager = class {
         const wired = await wiredMcpNames();
         const isWired = wired.has(parsed.name) || wired.has(unscopedName(parsed.name));
         const skippedReason = Object.entries(
-          await readSkippedMcpServers(this.projectDir, this.driverTarget)
+          await readSkippedMcpServers(this.projectDir, this.harness)
         ).find(([id]) => id === parsed.name || unscopedName(id) === parsed.name)?.[1];
         const drifted = (await this.mcpDriftRows()).some(
-          (r) => unscopedName(r.drift.id) === unscopedName(parsed.name)
+          (r) => unscopedName(r.drift.id) === unscopedName(parsed.name) && r.drift.missing.length + r.drift.modified.length + r.drift.extra.length > 0
         );
         if (isWired && skippedReason !== void 0) {
           state = "skipped";
@@ -5065,7 +5346,7 @@ var AssetManager = class {
           const onDisk = isDeployed(
             component,
             parsed.name,
-            this.driverTarget,
+            this.harness,
             this.global,
             this.projectDir
           );
@@ -5076,6 +5357,22 @@ var AssetManager = class {
     }
     return out;
   }
+  /**
+   * One note per locked library asset whose library went back to an older version than the lock
+   * (`library is at 0.1.0, locked 0.3.0`). Not drift: `install` keeps the lock and only `update`
+   * moves it, so `check` and `doctor` print the note as a `!` line and still exit 0 (p1257).
+   * Empty for a global manager or when the libraries cannot be read.
+   */
+  async libraryOlderNotices() {
+    if (this.global) return [];
+    try {
+      return (await this.outdated()).filter((e) => e.library !== void 0 && e.libraryOlder !== void 0).map(
+        (e) => `${e.kind}:${e.publisher ? `@${e.publisher.replace(/^@/, "")}/` : ""}${e.name}: library is at ${e.libraryOlder}, locked ${e.currentVersion} (library ${e.library}); \`skaile update\` moves the lock to it`
+      );
+    } catch {
+      return [];
+    }
+  }
   /**
    * Notes about the project's `mcp-server`s that are not drift and fail nothing: a declared
    * server skaile does not write to the coding agent's MCP config (`reason` from the last
@@ -5087,7 +5384,7 @@ var AssetManager = class {
   async mcpNotices() {
     if (this.global) return [];
     const out = [];
-    const skipped = await readSkippedMcpServers(this.projectDir, this.driverTarget);
+    const skipped = await readSkippedMcpServers(this.projectDir, this.harness);
     for (const [id, reason] of Object.entries(skipped)) {
       out.push({ id, kind: "skipped", reason, text: `MCP server "${id}" is skipped: ${reason}` });
     }
@@ -5132,22 +5429,24 @@ var AssetManager = class {
       const component = kind ? this.installTarget(kind) : void 0;
       if (!publisher || !kind || !name || !component || component === "agent") continue;
       if (patches[`${kind}:${name}`]) continue;
-      const dest = join(
-        deployedBase(component, this.driverTarget, this.global, this.projectDir),
-        name
-      );
+      const dest = join(deployedBase(component, this.harness, this.global, this.projectDir), name);
       if (!existsSync(dest) || lstatSync(dest).isSymbolicLink()) continue;
       const missing = lockedAssetFiles(kind, entry.files).map((f) => f.rel).filter((rel) => !existsSync(join(dest, rel)));
       if (missing.length > 0) out.push({ ref: `${kind}:@${publisher}/${name}`, missing });
     }
     const locked = Object.entries(lock.assets).filter(([, e]) => e.library !== void 0 && !e.library.installed).map(([key]) => key);
     if (locked.length === 0) return out;
-    const lib = await this.resolveLibraryEntries(locked, { quiet: true });
+    const lockedLibraries = await this.lockedLibraryNames();
+    const lib = await this.resolveLibraryEntries(locked, { quiet: true, lockedLibraries });
     for (const entry of lib.entries) {
+      const lockedIn = lockedLibraries.get(
+        `${entry.kind}:${(entry.publisher ?? "").replace(/^@/, "")}/${entry.name}`
+      );
+      if (lockedIn && lib.libraryOf.get(entry) !== lockedIn) continue;
       const component = this.installTarget(entry.kind);
       if (!entry.files || !component || component === "agent") continue;
       const dest = join(
-        deployedBase(component, this.driverTarget, this.global, this.projectDir),
+        deployedBase(component, this.harness, this.global, this.projectDir),
         entry.name
       );
       if (!existsSync(dest)) continue;
@@ -5225,7 +5524,7 @@ var AssetManager = class {
     const repoStatuses = this.buildRepoStatuses(repositories);
     const lockByKindName = indexLockByKindName(lock);
     const entries = [];
-    const instanceFiles = this.global ? /* @__PURE__ */ new Set() : instanceRenderedAgentNames(this.projectDir, this.driverTarget);
+    const instanceFiles = this.global ? /* @__PURE__ */ new Set() : instanceRenderedAgentNames(this.projectDir, this.harness);
     for (const d of deployed) {
       const lockEntry = lockByKindName.get(`${d.kind}:${d.name}`);
       if (!lockEntry && d.kind === "agent" && instanceFiles.has(d.name)) continue;
@@ -5548,6 +5847,18 @@ var AssetManager = class {
           });
           continue;
         }
+        if (diskVersion && diskVersion !== origin.version && !isPseudoVersion(diskVersion) && !isPseudoVersion(origin.version)) {
+          result.push({
+            kind,
+            name,
+            publisher,
+            currentVersion: origin.version,
+            behind: 0,
+            library: lookup.name,
+            libraryOlder: diskVersion
+          });
+          continue;
+        }
         if (origin.sha256) {
           const onDisk = libraryDiskHashes(libPath, diskHashes, this.registry).get(
             `${kind}:${name}`
@@ -5568,8 +5879,56 @@ var AssetManager = class {
       await this.addLibraryMoves(libraryAssets, result);
     }
     await this.addRekeyRows(lock, result);
+    await this.addPinnedRows(lock, result);
     return this.addLockGapRows(result);
   }
+  /**
+   * List a locked asset whose `skaile.yaml` ref carries a `#version` pin while a source, a
+   * library or a store holds a newer one: `locked 0.7.0 -> 0.9.0 (pinned)`. The pin is the
+   * user's choice, so the row only informs (`pinned`): `update` leaves it, `outdated` does not
+   * fail on it (OQ13, p1291). An asset already listed keeps its own row.
+   */
+  async addPinnedRows(lock, rows) {
+    const { dependencies, stores } = this.loadConfig();
+    for (const dep of dependencies) {
+      let parsed;
+      try {
+        parsed = parseAssetRef(dep);
+      } catch {
+        continue;
+      }
+      if (!parsed.pin || !parsed.publisher) continue;
+      const publisher = parsed.publisher.replace(/^@/, "");
+      const lockedKey = Object.keys(lock.assets).find((k) => {
+        const id = parseCanonicalLockKey(k);
+        return id.kind === parsed.kind && id.name === parsed.name && id.publisher === publisher;
+      });
+      const locked = lockedKey ? parseCanonicalLockKey(lockedKey).version : void 0;
+      if (!locked || isPseudoVersion(locked)) continue;
+      if (rows.some(
+        (r) => r.kind === parsed.kind && r.name === parsed.name && r.publisher.replace(/^@/, "") === publisher
+      )) {
+        continue;
+      }
+      let latest;
+      try {
+        latest = (await this.availableVersions(parsed, stores))[0];
+      } catch {
+        continue;
+      }
+      if (!latest || isPseudoVersion(latest)) continue;
+      if (!gt(coerceVersion(latest), coerceVersion(locked))) continue;
+      rows.push({
+        kind: parsed.kind,
+        name: parsed.name,
+        publisher,
+        currentVersion: locked,
+        behind: 0,
+        latestVersion: latest,
+        pinned: true
+      });
+    }
+  }
   /**
    * List a source asset locked under a `0.0.0-sha.<commit>` key whose file now declares a
    * version: the next `install` or `update` re-keys it (`replaced 0.0.0-sha.7de3555 → 0.2.0`),
@@ -5783,7 +6142,13 @@ var AssetManager = class {
         const row = (await this.mcpDriftRows()).find(
           (r) => unscopedName(r.drift.id) === unscopedName(parsed.name)
         );
-        return row ? { status: "differs", diff: mcpDriftDiff(row.drift) } : { status: "identical" };
+        if (!row) return { status: "identical" };
+        const fileSetDiffers = row.drift.extra.length > 0 || row.drift.missing.some((f) => !f.includes(" entry "));
+        return {
+          status: "differs",
+          diff: mcpDriftDiff(row.drift),
+          ...fileSetDiffers ? { fileSetDiffers: true } : {}
+        };
       }
     }
     const entry = await this.lockedLibraryEntry(parsed) ?? this.lockedSourceEntry(parsed) ?? await this.info(ref);
@@ -5799,7 +6164,7 @@ var AssetManager = class {
     if (parsed.kind === "preset" && this.presetRecorded(parsed)) return { status: "no-files" };
     if (!component) return { status: "not-deployed" };
     if (component === "agent") {
-      const opts = this.deployOptsFor(this.driverTarget);
+      const opts = this.deployOptsFor(this.harness);
       const parts = [diffDeployedAgent(entry, opts)];
       for (const inst of this.instancesBoundTo(parsed)) {
         parts.push(diffDeployedAgent(entry, opts, inst));
@@ -5809,7 +6174,7 @@ var AssetManager = class {
       return diff === "" ? { status: "identical" } : { status: "differs", diff };
     }
     const deployedPath = join(
-      deployedBase(component, this.driverTarget, this.global, this.projectDir),
+      deployedBase(component, this.harness, this.global, this.projectDir),
       parsed.name
     );
     if (!existsSync(deployedPath)) return { status: "not-deployed" };
@@ -6032,7 +6397,7 @@ var AssetManager = class {
         const dep = memberIdentity(depToStr(req));
         if (!dep) continue;
         const depComponent = this.installTarget(dep.kind);
-        if (depComponent && !isDeployed(depComponent, dep.name, this.driverTarget, this.global, this.projectDir)) {
+        if (depComponent && !isDeployed(depComponent, dep.name, this.harness, this.global, this.projectDir)) {
           const inRepos = await resolveAsset({ kind: dep.kind, name: dep.name }, repositories, this.reposDir, {
             knownKinds: this.knownKinds
           }) !== null;
@@ -6193,6 +6558,15 @@ var AssetManager = class {
       gaps.push(gap);
       named.add(gapIdentity(gap.ref));
     }
+    for (const f of this.listDeployed("flow")) {
+      const details = flowLoadError(f);
+      if (details === void 0) continue;
+      const ref = lockIdentity("flow", f.name);
+      if (named.has(gapIdentity(ref))) continue;
+      const reason = `is not a flow the flow engine can load (${details}) \u2014 fix the flow (in its library or source when it came from one), then run skaile install`;
+      gaps.push({ type: "flow", ref, reason, message: `${ref} ${reason}` });
+      named.add(gapIdentity(ref));
+    }
     for (const d of await this.lockedCopyDrift()) {
       if (named.has(gapIdentity(d.ref))) continue;
       const parts = [
@@ -6213,10 +6587,16 @@ var AssetManager = class {
         ...drift.modified.map((f) => `${f} was edited`),
         ...drift.extra.map((f) => `${f} is not part of the asset`)
       ];
+      if (parts.length === 0) continue;
       const reason = `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
       gaps.push({ type: "modified", ref, reason, message: `${ref} ${reason}` });
       named.add(gapIdentity(ref));
     }
+    const pending = await this.mcpPendingRender();
+    if (pending.length > 0) {
+      const reason = `${pending[0].file} is out of date for skaile.yaml - run skaile install`;
+      gaps.push({ type: "render", ref: pending[0].ref, reason, message: reason });
+    }
     gaps.push(...await this.declaredGaps(requirements, named));
     for (const d of await this.incompleteDeploys()) {
       const reason = `is deployed without ${d.missing.join(", ")} \u2014 run \`skaile install --locked\` to restore it`;
@@ -6232,7 +6612,7 @@ var AssetManager = class {
         manualFix: true
       });
     }
-    for (const u of unboundAgentInstances(this.projectDir, this.driverTarget)) {
+    for (const u of unboundAgentInstances(this.projectDir, this.harness)) {
       const reason = u.ref.startsWith("agent:") ? await this.unboundAgentReason(u.id, u.ref) : `is bound by agent instance "${u.id}" but resolves to no agent.yaml \u2014 fix the path, or drop the binding from skaile.yaml`;
       gaps.push({
         type: "agent",
@@ -6267,12 +6647,12 @@ var AssetManager = class {
     const drop = "or drop the binding from skaile.yaml";
     const parsedRef = parseRefTolerant(ref);
     const publisher = parsedRef?.publisher;
-    const lockedAgent = Object.keys(this.tryReadLock()?.assets ?? {}).some((key) => {
+    const lockedAgentKey = Object.keys(this.tryReadLock()?.assets ?? {}).find((key) => {
       const k = parseCanonicalLockKey(key);
       return k.kind === "agent" && k.name === parsedRef?.name && (!publisher || !k.publisher || k.publisher === publisher);
     });
-    if (lockedAgent) {
-      const libraryFix = (await this.unresolvedFixes([ref])).get(ref);
+    if (lockedAgentKey !== void 0) {
+      const libraryFix = await this.lockedAgentLibraryHolds(lockedAgentKey) ? void 0 : (await this.unresolvedFixes([ref])).get(ref);
       if (libraryFix) {
         const register = libraryFix.replace(
           /, or drop the dependency with `skaile remove [^`]*`$/,
@@ -6313,6 +6693,26 @@ var AssetManager = class {
       advice: `register the library that holds it with \`skaile library init <name> --path <dir>\`, ${drop}`
     };
   }
+  /**
+   * Whether the library a locked agent names is here and holds the agent, or the agent comes
+   * from a source or store: `install --locked` restores it, so its missing cache is no fault of
+   * the library.
+   */
+  async lockedAgentLibraryHolds(lockKey) {
+    const entry = this.tryReadLock()?.assets[lockKey];
+    if (!entry) return false;
+    if (!entry.library || entry.library.installed) return true;
+    const { publisher, kind, name } = parseCanonicalLockKey(lockKey);
+    if (!publisher || !kind || !name) return false;
+    const lookup = this.lockedLibrary(entry.library, await this.loadLibraryIndex(), {
+      kind,
+      publisher,
+      name
+    });
+    if (lookup.state !== "ok") return false;
+    const scanned = await scanDirectory(lookup.path, publisher, { knownKinds: this.knownKinds });
+    return scanned.some((x) => x.kind === kind && x.name === name);
+  }
   /** @deprecated Use `(await projectState()).gaps`; removed in the next major. */
   async lockGaps() {
     return (await this.projectState()).gaps;
@@ -6421,7 +6821,7 @@ var AssetManager = class {
               { kind, publisher, name },
               found.version
             );
-            if (!diskVersion || isPseudoVersion(diskVersion) || !gt(coerceVersion(diskVersion), coerceVersion(origin.version))) {
+            if (!diskVersion || isPseudoVersion(diskVersion) || !gt(coerceVersion(diskVersion), coerceVersion(origin.version)) && (isPseudoVersion(origin.version) || diskVersion === origin.version)) {
               const reason2 = `is locked, but library "${lookup.name}" content changed since lock \u2014 or the lock predates the one shared asset hash; run \`skaile install\` to re-lock it`;
               gaps.push({ type: "content", ref, reason: reason2, message: `${ref} ${reason2}` });
             }
@@ -6451,6 +6851,40 @@ var AssetManager = class {
     }
     return gaps;
   }
+  /**
+   * The locked source assets whose source is no longer in `skaile.yaml` `sources:` (`source
+   * remove`, a hand edit), keyed by lock key. ONE sentence for it: `check`, `doctor`, `outdated`,
+   * `install`, `install --locked` and `update` all say it (p1062), and none re-clones the source.
+   * A source of a store-resolved lock entry is not told apart from one, so no GitHub source is
+   * called missing while a `stores:` entry exists.
+   *
+   * @param inScope - Only these lock keys count (`install` prunes an undeclared entry as usual).
+   */
+  async orphanedSourceGaps(inScope) {
+    const out = /* @__PURE__ */ new Map();
+    let config;
+    try {
+      config = this.loadConfig();
+    } catch {
+      return out;
+    }
+    const storeBacked = config.stores.length > 0 || (await this.globalStoreFallback(config.stores, false)).length > 0;
+    const registered = new Set(config.sources.map((s) => sourceCacheKey(s.url)));
+    for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      const url = entry.source?.url;
+      if (!url || entry.library || !GIT_URL.test(url)) continue;
+      if (inScope && !inScope.has(key)) continue;
+      if (normalizeRepoUrl(url) === normalizeRepoUrl(FACTORY_SOURCE_URL)) continue;
+      const { publisher, kind, name } = parseCanonicalLockKey(key);
+      if (!publisher || !kind || !name) continue;
+      if (registered.has(sourceCacheKey(url))) continue;
+      if (storeBacked && GITHUB_REPO_URL.test(url)) continue;
+      const ref = `${kind}:@${publisher}/${name}`;
+      const reason = `is locked, but its source ${url} is not in skaile.yaml sources: any more \u2014 register it again with \`skaile source add ${url}\`, or drop the dependency with \`skaile remove ${ref}\``;
+      out.set(key, { type: "source", ref, reason, message: `${ref} ${reason}`, manualFix: true });
+    }
+    return out;
+  }
   /**
    * Locked source assets whose source cannot supply them any more: the source is no longer in
    * `skaile.yaml` `sources:` (`source remove`, a hand edit), or it is there but now publishes
@@ -6462,14 +6896,7 @@ var AssetManager = class {
    * @param index - What the registered sources publish today.
    */
   async sourceOriginGaps(named, index) {
-    let config;
-    try {
-      config = this.loadConfig();
-    } catch {
-      return [];
-    }
-    const storeBacked = config.stores.length > 0 || (await this.globalStoreFallback(config.stores)).length > 0;
-    const registered = new Set(config.sources.map((s) => sourceCacheKey(s.url)));
+    const orphans = await this.orphanedSourceGaps();
     const published = [...index.values()].flat();
     const gaps = [];
     for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
@@ -6479,10 +6906,9 @@ var AssetManager = class {
       const { publisher, kind, name } = parseCanonicalLockKey(key);
       if (!publisher || !kind || !name || named.has(`${kind}:${name}`)) continue;
       const ref = `${kind}:@${publisher}/${name}`;
-      if (!registered.has(sourceCacheKey(url))) {
-        if (storeBacked && GITHUB_REPO_URL.test(url)) continue;
-        const reason = `is locked, but its source ${url} is not in skaile.yaml sources: any more \u2014 register it again with \`skaile source add ${url}\`, or drop the dependency with \`skaile remove ${ref}\``;
-        gaps.push({ type: "source", ref, reason, message: `${ref} ${reason}`, manualFix: true });
+      const orphan = orphans.get(key);
+      if (orphan) {
+        gaps.push(orphan);
         continue;
       }
       const here = published.filter(
@@ -6550,7 +6976,7 @@ var AssetManager = class {
       ownFiles.set(key, new Set(this.renderedAgentFiles(name).map((f) => f.path)));
     }
     const instanceFiles = /* @__PURE__ */ new Map();
-    for (const instance of renderedInstanceFiles(this.projectDir, this.driverTarget)) {
+    for (const instance of renderedInstanceFiles(this.projectDir, this.harness)) {
       const want = parseRefTolerant(instance.ref);
       if (!want || want.kind !== "agent") continue;
       const wantPublisher = want.publisher?.replace(/^@/, "");
@@ -6605,12 +7031,12 @@ var AssetManager = class {
   /** The files of one agent's rendering for the active harness, project-relative, with sha256. */
   renderedAgentFiles(name) {
     const out = [];
-    for (const path2 of deployedPaths("agent", name, this.driverTarget, false, this.projectDir)) {
+    for (const path2 of deployedPaths("agent", name, this.harness, false, this.projectDir)) {
       this.hashTree(path2, out);
     }
     this.hashTree(
       join(
-        dirname(deployedBase("agent", this.driverTarget, false, this.projectDir)),
+        dirname(deployedBase("agent", this.harness, false, this.projectDir)),
         CODEX_IDENTITY_DIR,
         `${name}.md`
       ),
@@ -6677,7 +7103,7 @@ var AssetManager = class {
       if (!kind || !name || !component) continue;
       const dir = relative(
         this.projectDir,
-        deployedDir(component, name, this.driverTarget, this.global, this.projectDir)
+        deployedDir(component, name, this.harness, this.global, this.projectDir)
       ).split(sep).join("/");
       out.push({
         ref: d.key,
@@ -6694,7 +7120,7 @@ var AssetManager = class {
       if (!kind || !name || !component) continue;
       const dir = relative(
         this.projectDir,
-        deployedDir(component, name, this.driverTarget, this.global, this.projectDir)
+        deployedDir(component, name, this.harness, this.global, this.projectDir)
       ).split(sep).join("/");
       const files = inc.missing.map((f) => `${dir}/${f}`);
       const row = out.find((r) => r.ref.split("#")[0] === bare);
@@ -6728,7 +7154,7 @@ var AssetManager = class {
     const out = [];
     const deployOpts = {
       registry: this.registry,
-      driverTarget: this.driverTarget,
+      harness: this.harness,
       global: this.global,
       cwd: this.projectDir
     };
@@ -6752,7 +7178,7 @@ var AssetManager = class {
       const component = kind ? this.installTarget(kind) : void 0;
       if (!kind || !name || !component || component === "agent") continue;
       if (patches[`${kind}:${name}`]) continue;
-      const dest = deployedDir(component, name, this.driverTarget, this.global, this.projectDir);
+      const dest = deployedDir(component, name, this.harness, this.global, this.projectDir);
       try {
         const deployed = lstatSync(dest);
         if (deployed.isSymbolicLink() || !deployed.isDirectory()) continue;
@@ -6796,7 +7222,7 @@ var AssetManager = class {
       }
       if (modified.length > 0) {
         const instanceOf = /* @__PURE__ */ new Map();
-        for (const inst of renderedInstanceFiles(this.projectDir, this.driverTarget)) {
+        for (const inst of renderedInstanceFiles(this.projectDir, this.harness)) {
           for (const f of inst.files) if (modified.includes(f)) instanceOf.set(f, inst.id);
         }
         out.push({
@@ -6826,7 +7252,7 @@ var AssetManager = class {
       const { publisher, kind, name } = parseCanonicalLockKey(key);
       const component = kind ? this.installTarget(kind) : void 0;
       if (!kind || !name || !component || named.has(`${kind}:${name}`)) continue;
-      if (isDeployed(component, name, this.driverTarget, this.global, this.projectDir)) {
+      if (isDeployed(component, name, this.harness, this.global, this.projectDir)) {
         const renderedGone = component === "agent" && !this.global && (entry.rendered ?? []).some((f) => !existsSync(join(this.projectDir, f.path)));
         if (!renderedGone) continue;
       }
@@ -6834,7 +7260,7 @@ var AssetManager = class {
       const dangling = deployedPaths(
         component,
         name,
-        this.driverTarget,
+        this.harness,
         this.global,
         this.projectDir
       ).find((p) => isSymlink(p) && !existsSync(p));
@@ -7152,7 +7578,7 @@ var AssetManager = class {
       for (const dest of deployedPaths(
         component,
         name,
-        this.driverTarget,
+        this.harness,
         this.global,
         this.projectDir
       )) {
@@ -7373,8 +7799,8 @@ var AssetManager = class {
     }
     if (ids.length === 0) return false;
     writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
-    for (const driverTarget of this.targetHarnesses()) {
-      removeAgentInstanceRenderings({ projectDir: this.projectDir, driverTarget, ids });
+    for (const harness of this.targetHarnesses()) {
+      removeAgentInstanceRenderings({ projectDir: this.projectDir, harness, ids });
     }
     return true;
   }
@@ -7396,5 +7822,5 @@ var AssetManager = class {
 };
 
 export { AssetManager, FACTORY_SOURCE_URL, LibraryEntryError, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName };
-//# sourceMappingURL=chunk-VM3PH7BB.js.map
-//# sourceMappingURL=chunk-VM3PH7BB.js.map
+//# sourceMappingURL=chunk-OAHVKSQJ.js.map
+//# sourceMappingURL=chunk-OAHVKSQJ.js.map