@skaile/workspaces 5.6.1 → 5.7.0

package/dist/{chunk-PTO2YDDG.js → chunk-D5HOETOB.js}

@@ -1,17 +1,17 @@
-import { getStoreManifestsDir } from './chunk-MX3UQXLU.js';
-import { readManifestSourceConfig, discoverAssetsInTree } from './chunk-XOGG7VDZ.js';
-import { installAgent, installTargetOf, deployAll, removeAsset, canonicalEntryRef, createScaffold } from './chunk-2KOKBTR4.js';
+import { getStoreManifestsDir } from './chunk-DFFD4BFG.js';
+import { readManifestSourceConfig, discoverAssetsInTree } from './chunk-6VRJH4MR.js';
+import { installAgent, installTargetOf, deployAll, removeAsset, canonicalEntryRef, createScaffold } from './chunk-74EEFB52.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-VKSXST23.js';
-import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, buildLockFile, readLock, verifyLock, mergeLockFile, extractForPatch, generatePatch, savePatch, applyPatch } from './chunk-TZCQ7ZWQ.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-BF33SCLY.js';
-import { deployedBase, deployedDir, isDeployed } from './chunk-46OVMT76.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, resolveAgentDefinitionDir, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, coerceVersion, resolveAll, buildProvenanceIndex, ensureRepo, sourceShortName, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, readLinks, storeManifestSlug } from './chunk-2W4LBLIN.js';
-import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-MFHKHXDE.js';
+import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-AVCUPPG6.js';
+import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, buildLockFile, readLock, verifyLock, mergeLockFile, extractForPatch, generatePatch, savePatch, applyPatch } from './chunk-OOLT6HGP.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-SWO25LTO.js';
+import { deployedBase, deployedDir, isDeployed } from './chunk-G67BOI2J.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, resolveAgentDefinitionDir, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, coerceVersion, resolveAll, buildProvenanceIndex, ensureRepo, sourceShortName, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, readLinks, storeManifestSlug } from './chunk-LCU5U5IW.js';
+import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { DRIVER_TARGETS } from './chunk-CPSIPIX7.js';
-import { scanDirectory, parseRequires } from './chunk-PA7WLID3.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName } from './chunk-AO7VJ6G6.js';
+import { scanDirectory, parseRequires } from './chunk-TTPSDC2G.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName } from './chunk-O7VPNKYN.js';
 import { spawnSync } from 'child_process';
 import { existsSync, rmSync, readdirSync, lstatSync, unlinkSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import path, { join, resolve, dirname, sep, posix } from 'path';
@@ -336,6 +336,25 @@ function indexLockByKindName(lock) {
   }
   return lockByKindName;
 }
+function commitsBetween(repoDir, from, to, cache) {
+  const key = `${from}..${to}`;
+  const hit = cache.get(key);
+  if (hit !== void 0) return hit;
+  let count = 1;
+  if (COMMIT_ID.test(from) && COMMIT_ID.test(to)) {
+    const r = spawnSync("git", ["-C", repoDir, "rev-list", "--count", key], {
+      encoding: "utf8",
+      stdio: "pipe"
+    });
+    if (r.status === 0) {
+      const n = Number.parseInt(r.stdout.trim(), 10);
+      if (Number.isFinite(n) && n >= 0) count = n;
+    }
+  }
+  cache.set(key, count);
+  return count;
+}
+var COMMIT_ID = /^[0-9a-f]{7,64}$/;
 function libraryDiskHashes(libPath, cache, registry) {
   let hashes = cache.get(libPath);
   if (!hashes) {
@@ -367,6 +386,39 @@ function newestLibraryDef(snap, libraryName, id) {
   }
   return best;
 }
+function qualifyDepRef(ref, fallback) {
+  const hash = ref.indexOf("#");
+  const head = hash === -1 ? ref : ref.slice(0, hash);
+  if (head.includes("@") || !fallback) return ref;
+  const pin = hash === -1 ? void 0 : ref.slice(hash + 1) || void 0;
+  const colon = head.indexOf(":");
+  return assetRefToStr({
+    kind: colon === -1 ? "skill" : head.slice(0, colon),
+    name: colon === -1 ? head : head.slice(colon + 1),
+    publisher: fallback,
+    pin
+  });
+}
+function libraryEntryDepRefs(e) {
+  const publisher = e.publisher ?? "";
+  const refs = /* @__PURE__ */ new Set();
+  for (const d of e.dependencies ?? []) {
+    if (d) refs.add(qualifyDepRef(d, publisher));
+  }
+  for (const r of e.requires ?? []) {
+    const p = r.publisher ?? publisher;
+    if (p) refs.add(assetRefToStr({ kind: r.kind, name: r.name, publisher: p }));
+  }
+  return [...refs];
+}
+function refIdentity(ref) {
+  try {
+    const p = parseAssetRef(ref);
+    return p.publisher ? `${p.publisher}/${p.kind}:${p.name}` : null;
+  } catch {
+    return null;
+  }
+}
 function computeSyncStatus(repoStatus) {
   if (!repoStatus) return "unknown";
   if (repoStatus.kind === "local") return "local";
@@ -517,6 +569,8 @@ var AssetManager = class {
   indexPathOverride;
   /** Sink for cross-library collision warnings; else `console.warn`. */
   onLibraryCollision;
+  /** Store URLs whose failed version lookup was already reported (one warning per URL). */
+  warnedStoreVersionLookups = /* @__PURE__ */ new Set();
   constructor(opts) {
     this.projectDir = resolve(opts.projectDir);
     this.global = opts.global ?? false;
@@ -765,10 +819,12 @@ var AssetManager = class {
    * content. The returned `libraryOf` map names the library each entry came from
    * so callers can lock it as library-origin (see {@link libraryLockEntries}).
    *
+   * @param opts.quiet - Skip the cross-library collision warning (a lookup that only
+   *   builds an error hint must not warn).
    * @returns the matched deploy entries, the set of `missing` refs covered, and
    *   each entry's originating library name.
    */
-  async resolveLibraryEntries(missing) {
+  async resolveLibraryEntries(missing, opts = {}) {
     const resolved = /* @__PURE__ */ new Set();
     const libraryOf = /* @__PURE__ */ new Map();
     if (missing.length === 0) return { entries: [], resolved, libraryOf };
@@ -807,18 +863,15 @@ var AssetManager = class {
     }
     if (byKey.size === 0) return { entries: [], resolved, libraryOf };
     const entries = [];
+    const allCandidates = [...byKey.values()].flat();
     for (const ref of missing) {
-      let parsed;
-      try {
-        parsed = parseAssetRef(ref);
-      } catch {
-        continue;
-      }
-      if (!parsed.publisher) continue;
-      const key = `${parsed.kind}:@${parsed.publisher}/${parsed.name}`;
-      const candidates = (byKey.get(key) ?? []).filter(
-        (c) => !parsed.pin || matchPin(parsed.pin, c.entry.version ?? "")
-      );
+      const parsed = parseRefTolerant(ref);
+      if (!parsed) continue;
+      const hash = ref.indexOf("#");
+      const pin = parsed.pin ?? (hash >= 0 ? ref.slice(hash + 1) : void 0);
+      const key = parsed.publisher ? `${parsed.kind}:@${parsed.publisher}/${parsed.name}` : void 0;
+      const pool = key ? byKey.get(key) ?? [] : allCandidates.filter((c) => c.entry.kind === parsed.kind && c.entry.name === parsed.name);
+      const candidates = pool.filter((c) => !pin || matchPin(pin, c.entry.version ?? ""));
       if (candidates.length === 0) continue;
       candidates.sort((a, b) => {
         const va = coerceVersion(a.entry.version ?? "");
@@ -830,13 +883,65 @@ var AssetManager = class {
         return da - db || a.library.localeCompare(b.library);
       });
       const hit = candidates[0];
-      this.warnLibraryCollision(key, candidates, hit);
+      if (!opts.quiet) {
+        this.warnLibraryCollision(
+          `${hit.entry.kind}:@${hit.entry.publisher}/${hit.entry.name}`,
+          candidates,
+          hit
+        );
+      }
       entries.push(hit.entry);
       libraryOf.set(hit.entry, hit.library);
       resolved.add(ref);
     }
     return { entries, resolved, libraryOf };
   }
+  /**
+   * Explain misses caused by a publisher change, for every missed publisher-qualified
+   * ref at once (one library scan, one lock read). Per ref:
+   * - `did you mean <ref>?` when a registered library holds the same kind + name
+   *   under another publisher;
+   * - `locked as <lockRef>; run skaile install to re-resolve` when the lock holds the
+   *   same kind + name under another publisher, records the library it came from, and
+   *   that library now holds the asset under yet another publisher than the locked
+   *   one. An unrelated asset that merely shares kind + name does not qualify.
+   *
+   * @param refs - Missed refs; a trailing `(reason)` after the first space is ignored.
+   * @returns hint text per ref, only for refs that have one. Never warns.
+   */
+  async publisherChangeHints(refs) {
+    const out = {};
+    const wanted = /* @__PURE__ */ new Map();
+    for (const ref of refs) {
+      const parsed = parseRefTolerant(ref.split(" ")[0] ?? ref);
+      if (parsed?.publisher) {
+        wanted.set(ref, { kind: parsed.kind, name: parsed.name, publisher: parsed.publisher });
+      }
+    }
+    if (wanted.size === 0) return out;
+    const lockEntries = Object.entries(this.tryReadLock()?.assets ?? {});
+    const bare = [...new Set([...wanted.values()].map((w) => `${w.kind}:${w.name}`))];
+    const lib = await this.resolveLibraryEntries(bare, { quiet: true });
+    for (const [ref, w] of wanted) {
+      const moved = lib.entries.find((e) => e.kind === w.kind && e.name === w.name);
+      const movedLibrary = moved ? lib.libraryOf.get(moved) : void 0;
+      const hints = [];
+      for (const [key, entry] of lockEntries) {
+        const id = parseCanonicalLockKey(key);
+        if (id.kind === w.kind && id.name === w.name && id.publisher && id.publisher !== w.publisher && entry.library && moved && movedLibrary === entry.library.name && moved.publisher !== id.publisher) {
+          hints.push(
+            `locked as ${id.kind}:@${id.publisher}/${id.name}; run skaile install to re-resolve`
+          );
+          break;
+        }
+      }
+      if (moved && moved.publisher !== w.publisher) {
+        hints.push(`did you mean ${moved.kind}:@${moved.publisher}/${moved.name}?`);
+      }
+      if (hints.length > 0) out[ref] = hints.map((h) => ` (${h})`).join("");
+    }
+    return out;
+  }
   /** Collision messages already printed by this instance (one warning per ref + library set). */
   warnedLibraryCollisions = /* @__PURE__ */ new Set();
   /**
@@ -875,10 +980,12 @@ var AssetManager = class {
   }
   /**
    * Library-origin lock entries for the assets {@link resolveLibraryEntries}
-   * matched. The locked version comes from the library index when it knows the
-   * asset (its manifest-declared version is authoritative), else from the
-   * on-disk asset. The hash is computed from the files on disk, so it matches
-   * what `install --locked` re-hashes.
+   * matched. The locked version is the one actually deployed: the on-disk
+   * entry's version, falling back to the library index only when the disk entry
+   * carries none — the index lags until the next `skaile library index`, so
+   * preferring it would lock a stale version after an in-place bump. The hash is
+   * computed from the files on disk, so it matches what `install --locked`
+   * re-hashes.
    */
   async libraryLockEntries(lib) {
     if (lib.entries.length === 0) return {};
@@ -895,7 +1002,7 @@ var AssetManager = class {
           kind: e.kind,
           publisher,
           name: e.name,
-          library: { name, version: def?.version || e.version || "0.0.0", sha256 }
+          library: { name, version: e.version || def?.version || "0.0.0", sha256 }
         };
       })
     );
@@ -937,7 +1044,7 @@ var AssetManager = class {
         continue;
       }
       const def = newestLibraryDef(snap, origin.name, { kind, publisher, name });
-      const current = def?.version || found.version || "0.0.0";
+      const current = found.version || def?.version || "0.0.0";
       if (current !== origin.version) {
         missing.push(
           `${ref} (library "${origin.name}" is at ${current}, locked ${origin.version})`
@@ -1012,6 +1119,93 @@ var AssetManager = class {
       return first;
     }
   }
+  /**
+   * Resolve `deps` library-first, then walk the dependencies of every library
+   * asset it picks.
+   *
+   * A publisher-qualified ref that no project source declares is looked up in the
+   * registered **libraries** before any store is asked, so a locally authored
+   * asset resolves (and deploys) with the store unreachable and without a
+   * version-discovery round trip. Only refs the libraries did not satisfy go to
+   * {@link resolveWithStores}; its misses get one more library try (a ref a source
+   * knows only under another version). A `#version` pin still selects through
+   * `matchPin` inside {@link resolveLibraryEntries}.
+   *
+   * Library assets declare `dependencies` / `requires`. Those are fed back through
+   * the same resolution with a `seen` identity set (mirrors `resolveAll`), so deps
+   * deploy, get lock entries, and a dependency cycle terminates.
+   *
+   * @returns source/store candidates, still-unresolved refs, applied overrides,
+   *   expanded presets, and the library leg (entries + originating library per entry).
+   */
+  async resolveLibraryFirst(deps, opts) {
+    const resolved = [];
+    const overridesApplied = /* @__PURE__ */ new Set();
+    const presets = [];
+    const lib = { entries: [], resolved: /* @__PURE__ */ new Set(), libraryOf: /* @__PURE__ */ new Map() };
+    const missing = /* @__PURE__ */ new Set();
+    const seen = /* @__PURE__ */ new Set();
+    const covered = /* @__PURE__ */ new Set();
+    const absorb = (hit) => {
+      const next = [];
+      for (const e of hit.entries) {
+        lib.entries.push(e);
+        const origin = hit.libraryOf.get(e);
+        if (origin) lib.libraryOf.set(e, origin);
+        const id = `${e.publisher}/${e.kind}:${e.name}`;
+        seen.add(id);
+        covered.add(id);
+        next.push(...libraryEntryDepRefs(e));
+      }
+      for (const r of hit.resolved) lib.resolved.add(r);
+      return next;
+    };
+    let wave = deps;
+    while (wave.length > 0) {
+      const fresh = [];
+      for (const ref of wave) {
+        const id = refIdentity(ref);
+        if (id !== null) {
+          if (seen.has(id)) continue;
+          seen.add(id);
+        }
+        fresh.push(ref);
+      }
+      if (fresh.length === 0) break;
+      const libraryTried = new Set(
+        fresh.filter((ref) => {
+          const id = refIdentity(ref);
+          return id !== null && !id.includes("/preset:") && (opts.provenanceIndex.get(id)?.length ?? 0) === 0;
+        })
+      );
+      const hit = await this.resolveLibraryEntries([...libraryTried]);
+      const next = absorb(hit);
+      const rest = fresh.filter((ref) => !hit.resolved.has(ref));
+      if (rest.length > 0) {
+        const r = await this.resolveWithStores(rest, opts);
+        for (const c of r.resolved) {
+          const id = `${c.publisher}/${c.kind}:${c.name}`;
+          if (covered.has(id)) continue;
+          seen.add(id);
+          covered.add(id);
+          resolved.push(c);
+        }
+        for (const o of r.overridesApplied) overridesApplied.add(o);
+        presets.push(...r.presets);
+        const hit2 = await this.resolveLibraryEntries(
+          r.missing.filter((m) => !libraryTried.has(m))
+        );
+        next.push(...absorb(hit2));
+        for (const m of r.missing) if (!hit2.resolved.has(m)) missing.add(m);
+      }
+      wave = next;
+    }
+    const stillMissing = [...missing].filter((m) => {
+      const id = refIdentity(m);
+      return !lib.resolved.has(m) && !(id !== null && covered.has(id));
+    });
+    return { resolved, missing: stillMissing, overridesApplied, lib, presets };
+  }
   /** The catalog fetcher to use: an injected one, else built from `stores`. */
   storeFetcherFor(stores) {
     return this.injectedStoreFetcher ?? this.buildStoreFetcher(stores);
@@ -1185,15 +1379,12 @@ var AssetManager = class {
       projectDir: this.projectDir,
       knownKinds: this.knownKinds
     });
-    const { resolved, missing, overridesApplied, presets } = await this.resolveWithStores(
+    const { resolved, missing, overridesApplied, lib, presets } = await this.resolveLibraryFirst(
       dependencies,
-      {
-        provenanceIndex,
-        overrides,
-        stores
-      }
+      { provenanceIndex, overrides, stores }
     );
-    const lib = await this.resolveLibraryEntries(missing);
+    const stillMissing = missing.filter((m) => !lib.resolved.has(m));
+    const missingHints = await this.publisherChangeHints(stillMissing);
     const directLock = this.directInstallLockEntries();
     const libraryLock = { ...directLock, ...await this.libraryLockEntries(lib) };
     const removed = this.reconcileRemovedAssets(resolved, new Set(Object.keys(libraryLock)));
@@ -1213,11 +1404,11 @@ var AssetManager = class {
     }
     this.recordInstallHistory(deployed, removed);
     const { npmInstalled, npmFailed } = await this.installRuntimeAssetDeps();
-    const stillMissing = missing.filter((m) => !lib.resolved.has(m));
     return {
       deployed,
       removed,
       missing: stillMissing,
+      ...Object.keys(missingHints).length > 0 ? { missingHints } : {},
       lockWritten,
       npmInstalled,
       npmFailed,
@@ -1374,7 +1565,10 @@ var AssetManager = class {
         try {
           return await src.listVersions(ref);
         } catch (err) {
-          console.warn(`skaile: store ${storeUrl} version lookup for ${ref} failed \u2014 ${err}`);
+          if (!this.warnedStoreVersionLookups.has(storeUrl)) {
+            this.warnedStoreVersionLookups.add(storeUrl);
+            console.warn(`skaile: store ${storeUrl} version lookup for ${ref} failed \u2014 ${err}`);
+          }
           return [];
         }
       }
@@ -1510,15 +1704,19 @@ var AssetManager = class {
       projectDir: this.projectDir,
       knownKinds: this.knownKinds
     });
-    const { resolved, missing, overridesApplied } = await this.resolveWithStores([ref], {
+    const { resolved, missing, overridesApplied, lib } = await this.resolveLibraryFirst([ref], {
       provenanceIndex,
       overrides,
       stores
     });
-    const lib = await this.resolveLibraryEntries(missing);
     if (resolved.length === 0 && lib.entries.length === 0) {
       throw new Error(
-        `Asset not found: ${ref}${missing.length ? ` (missing: ${missing.join(", ")})` : ""}`
+        `Asset not found: ${ref}${(await this.publisherChangeHints([ref]))[ref] ?? ""}${missing.length ? ` (missing: ${missing.join(", ")})` : ""}`
+      );
+    }
+    if (missing.length > 0) {
+      console.warn(
+        `skaile: ${ref} was added without unresolved dependencies: ${missing.join(", ")}`
       );
     }
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
@@ -1784,7 +1982,11 @@ var AssetManager = class {
     return refs;
   }
   /**
-   * Remove a deployed asset and unregister it from `skaile.yaml`.
+   * Remove a deployed asset and unregister it from `skaile.yaml` and the lock.
+   *
+   * A declared asset is always unregistered, even when nothing is deployed any
+   * more (e.g. its library file was deleted): the declaration and lock entry
+   * would otherwise be stuck behind a "not deployed" refusal.
    *
    * Deliberately does NOT re-render the driver target's MCP config: the render
    * step is async (the declaration resolver is), and making this synchronous
@@ -1793,37 +1995,40 @@ var AssetManager = class {
    * {@link renderMcpServerConfig}.
    *
    * @param ref - Asset ref in `kind:name` form (e.g. `skill:my-skill`).
-   * @returns `true` if the asset was found and removed, `false` if it was not deployed.
-   *   A `preset:` ref has no deployed files: it is found when declared in `skaile.yaml`, and
-   *   only its declaration goes — its expanded items leave with the next `skaile install`.
+   * @returns `true` if anything changed (files undeployed, declaration or lock
+   *   entry removed), `false` if the asset was neither deployed nor declared.
+   *   A `preset:` ref has no deployed files: only its declaration goes — its
+   *   expanded items leave with the next `skaile install`.
    */
   remove(ref) {
     const parsed = parseAssetRef(ref);
-    let ok = parsed.kind === "preset" ? this.removeDependencyFromConfig(parsed) : false;
+    let undeployed = false;
     for (const t of this.targetHarnesses()) {
-      if (removeAsset(parsed.kind, parsed.name, this.deployOptsFor(t))) ok = true;
+      if (removeAsset(parsed.kind, parsed.name, this.deployOptsFor(t))) undeployed = true;
     }
-    if (ok) {
-      const depRef = `${parsed.kind}:${parsed.name}`;
-      this.removeDependencyFromConfig(parsed);
-      this.pruneLockEntry(parsed);
+    const undeclared = this.removeDependencyFromConfig(parsed);
+    const unlocked = undeployed || undeclared ? this.pruneLockEntry(parsed) : false;
+    const changed = undeployed || undeclared || unlocked;
+    if (changed) {
       appendHistory(this.projectDir, {
-        ref: depRef,
+        ref: `${parsed.kind}:${parsed.name}`,
         action: "remove",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         context: this.global ? "global" : "project"
       });
     }
-    return ok;
+    return changed;
   }
   /**
    * Drop every lock entry matching a removed asset's identity, version-agnostic so
    * a content-sha pseudo-version key is pruned too. Symmetric with {@link add}'s
    * lock-merge — stops a stale entry reporting a phantom "removed" on next install.
+   *
+   * @returns `true` when at least one lock entry was dropped.
    */
   pruneLockEntry(parsed) {
     const lock = this.tryReadLock();
-    if (!lock) return;
+    if (!lock) return false;
     let changed = false;
     for (const key of Object.keys(lock.assets)) {
       const id = parseCanonicalLockKey(key);
@@ -1833,6 +2038,7 @@ var AssetManager = class {
       }
     }
     if (changed) writeLock(this.lockPath, lock);
+    return changed;
   }
   // ── Query ──────────────────────────────────────────────────────────────
   /**
@@ -2202,7 +2408,14 @@ var AssetManager = class {
     const lock = this.tryReadLock();
     if (!lock) return [];
     const bare = (s) => s.includes("#") ? s.slice(0, s.indexOf("#")) : s;
-    const key = lock.assets[ref] ? ref : Object.keys(lock.assets).find((k) => bare(k) === bare(ref));
+    const asked = parseRefTolerant(ref);
+    const matchesIdentity = (k) => {
+      if (bare(k) === bare(ref)) return true;
+      if (!asked || asked.publisher) return false;
+      const locked = parseCanonicalLockKey(k);
+      return locked.kind === asked.kind && locked.name === asked.name;
+    };
+    const key = lock.assets[ref] ? ref : Object.keys(lock.assets).find(matchesIdentity);
     if (!key) return [];
     return [key, "direct (skaile.yaml)"];
   }
@@ -2211,10 +2424,13 @@ var AssetManager = class {
    *
    * Two kinds of staleness are reported:
    * - **Source assets** — only remote repositories (not local paths) are checked;
-   *   `behind` is the number of commits the local clone is missing.
-   * - **Library assets** — a library-origin lock entry whose library index now
-   *   offers a newer version than the locked one; `behind` is 0, `latestVersion`
-   *   and `library` are set. A library not indexed (or removed) is not reported.
+   *   `behind` counts the commits the clone is missing from the remote plus the
+   *   commits the clone moved past the locked commit (`source sync` after `add`).
+   * - **Library assets** — a library-origin lock entry whose library files on disk
+   *   (not the index, which lags until `skaile library index`) hold a newer version
+   *   than the locked one (`latestVersion`, `library` set), or the same version with
+   *   different bytes (`contentChanged`). `behind` is 0. An unregistered library is a
+   *   `problem` row.
    *
    * @returns Array of {@link OutdatedEntry} objects.
    */
@@ -2224,22 +2440,28 @@ var AssetManager = class {
     if (!lock) return [];
     const result = [];
     const reported = /* @__PURE__ */ new Set();
+    const commitCounts = /* @__PURE__ */ new Map();
     for (const src of lock.sources) {
       const slug = sourceCacheKey(src.url);
       const decl = repositories[slug];
       if (!decl) continue;
       const status = checkRepoStatus(decl, slug, this.reposDir);
-      if (status.behind <= 0) continue;
+      if (status.kind !== "remote" || !status.localHead) continue;
+      const clone = decl.path ?? join(this.reposDir, slug);
       for (const [ref, entry] of Object.entries(lock.assets)) {
         if (entry.source?.url !== src.url) continue;
         const { publisher, kind, name, version } = parseCanonicalLockKey(ref);
         if (!kind || !name) continue;
+        const lockedCommit = entry.source.commit || src.commit;
+        const moved = lockedCommit && !/^0+$/.test(lockedCommit) && lockedCommit !== status.localHead ? commitsBetween(clone, lockedCommit, status.localHead, commitCounts) : 0;
+        const behind = status.behind + moved;
+        if (behind <= 0) continue;
         result.push({
           kind,
           name,
           publisher: publisher ?? sourceShortName(src.url),
           currentVersion: version ?? "",
-          behind: status.behind
+          behind
         });
         reported.add(ref);
       }
@@ -2249,11 +2471,14 @@ var AssetManager = class {
     );
     if (libraryAssets.length > 0) {
       const snap = await this.loadLibraryIndex();
+      const diskHashes = /* @__PURE__ */ new Map();
+      const scans = /* @__PURE__ */ new Map();
       for (const [ref, entry] of libraryAssets) {
         const origin = entry.library;
         const { publisher, kind, name } = parseCanonicalLockKey(ref);
         if (!publisher || !kind || !name) continue;
-        if (!this.libraryPath(origin.name, snap)) {
+        const libPath = this.libraryPath(origin.name, snap);
+        if (!libPath) {
           result.push({
             kind,
             name,
@@ -2266,18 +2491,45 @@ var AssetManager = class {
           reported.add(ref);
           continue;
         }
-        const def = newestLibraryDef(snap, origin.name, { kind, publisher, name });
-        if (!def || !gt(coerceVersion(def.version), coerceVersion(origin.version))) continue;
-        result.push({
-          kind,
-          name,
-          publisher,
-          currentVersion: origin.version,
-          behind: 0,
-          latestVersion: def.version,
-          library: origin.name
-        });
-        reported.add(ref);
+        const scanKey = `${libPath}\0${publisher}`;
+        let scanned = scans.get(scanKey);
+        if (!scanned) {
+          scanned = await scanDirectory(libPath, publisher, { knownKinds: this.knownKinds });
+          scans.set(scanKey, scanned);
+        }
+        const found = scanned.find((x) => x.kind === kind && x.name === name);
+        if (!found) continue;
+        const diskVersion = found.version || newestLibraryDef(snap, origin.name, { kind, publisher, name })?.version;
+        if (diskVersion && gt(coerceVersion(diskVersion), coerceVersion(origin.version))) {
+          result.push({
+            kind,
+            name,
+            publisher,
+            currentVersion: origin.version,
+            behind: 0,
+            latestVersion: diskVersion,
+            library: origin.name
+          });
+          reported.add(ref);
+          continue;
+        }
+        if (origin.sha256) {
+          const onDisk = libraryDiskHashes(libPath, diskHashes, this.registry).get(
+            `${kind}:${name}`
+          );
+          if (onDisk !== void 0 && onDisk !== origin.sha256) {
+            result.push({
+              kind,
+              name,
+              publisher,
+              currentVersion: origin.version,
+              behind: 0,
+              library: origin.name,
+              contentChanged: true
+            });
+            reported.add(ref);
+          }
+        }
       }
     }
     for (const [ref, entry] of Object.entries(lock.assets)) {
@@ -2315,7 +2567,8 @@ var AssetManager = class {
    * @throws When `diff(1)` itself fails (exit status other than 0/1).
    */
   async diff(ref) {
-    const parsed = parseAssetRef(ref);
+    const parsed = parseRefTolerant(ref);
+    if (!parsed) return { status: "not-found" };
     const entry = await this.info(ref);
     if (!entry || !existsSync(entry.source)) return { status: "not-found" };
     const component = this.installTarget(parsed.kind);
@@ -2346,12 +2599,12 @@ var AssetManager = class {
       projectDir: this.projectDir,
       knownKinds: this.knownKinds
     });
-    const { resolved, missing, overridesApplied } = await this.resolveWithStores(dependencies, {
+    const { resolved, overridesApplied, lib } = await this.resolveLibraryFirst(dependencies, {
       provenanceIndex,
       overrides,
       stores
     });
-    const libraryLock = await this.libraryLockEntries(await this.resolveLibraryEntries(missing));
+    const libraryLock = await this.libraryLockEntries(lib);
     const lockData = buildLockFile(resolved, overridesApplied, libraryLock);
     writeLock(this.lockPath, lockData);
     return lockData;
@@ -2445,7 +2698,13 @@ var AssetManager = class {
    *
    * For each deployed asset, checks that all entries in its `requires` list are
    * also deployed. Returns a list of issues with a flag indicating whether the
-   * missing dependency can be resolved from a configured repository.
+   * missing dependency can be resolved from a configured repository or library.
+   *
+   * A deployed asset is looked up by its publisher-qualified identity taken from
+   * the lock key (`kind:@pub/name`), so library and source assets resolve alike.
+   * A lock-managed asset that no source or library can be found for is reported
+   * as an issue with `unresolved: true` (its `requires` cannot be verified);
+   * unmanaged deployed files carry no declared origin and are skipped.
    *
    * @returns Array of {@link DepIssue} objects. An empty array means the workspace is healthy.
    */
@@ -2453,9 +2712,31 @@ var AssetManager = class {
     const { repositories } = this.loadConfig();
     const deployed = this.listDeployed();
     const issues = [];
+    const lock = this.tryReadLock();
+    const lockedPublisher = {};
+    for (const key of Object.keys(lock?.assets ?? {})) {
+      const { kind, name, publisher } = parseCanonicalLockKey(key);
+      if (kind && name && publisher) lockedPublisher[`${kind}:${name}`] = publisher;
+    }
     for (const entry of deployed) {
-      const full = await this.info(`${entry.kind}:${entry.name}`);
-      if (!full) continue;
+      const publisher = lockedPublisher[`${entry.kind}:${entry.name}`];
+      const full = await this.info(
+        publisher ? `${entry.kind}:@${publisher}/${entry.name}` : `${entry.kind}:${entry.name}`
+      );
+      if (!full) {
+        if (publisher) {
+          issues.push({
+            assetKind: entry.kind,
+            assetName: entry.name,
+            depKind: entry.kind,
+            depName: entry.name,
+            inRepos: false,
+            unresolved: true
+          });
+        }
+        continue;
+      }
+      const gaps = [];
       for (const req of full.requires) {
         const dep = memberIdentity(`${req.kind}:${req.name}`);
         if (!dep) continue;
@@ -2464,15 +2745,19 @@ var AssetManager = class {
           const inRepos = await resolveAsset({ kind: dep.kind, name: dep.name }, repositories, this.reposDir, {
             knownKinds: this.knownKinds
           }) !== null;
-          issues.push({
+          const issue = {
             assetKind: entry.kind,
             assetName: entry.name,
             depKind: req.kind,
             depName: req.name,
             inRepos
-          });
+          };
+          issues.push(issue);
+          if (!inRepos) gaps.push({ issue, ref: `${dep.kind}:${dep.name}` });
         }
       }
+      const inLibrary = await this.resolveLibraryEntries(gaps.map((g) => g.ref));
+      for (const g of gaps) g.issue.inRepos = inLibrary.resolved.has(g.ref);
     }
     return issues;
   }
@@ -2485,7 +2770,7 @@ var AssetManager = class {
    * @param destDir - Parent directory to create the asset in.
    * @param opts - Optional scaffold content (`description`).
    * @returns `{ ok: true, path }` on success, `{ ok: false, path: errorMessage }` if the
-   *   directory already exists.
+   *   directory already exists or `kind` has no scaffold template.
    */
   create(name, kind, destDir, opts) {
     return createScaffold(name, kind, destDir, opts);
@@ -2613,15 +2898,44 @@ var AssetManager = class {
       return;
     }
     const raw = parse(readFileSync(configPath, "utf8")) ?? {};
-    if (!raw.dependencies) raw.dependencies = [];
-    if (!raw.dependencies.includes(ref)) {
-      raw.dependencies.push(ref);
-      writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+    if (!Array.isArray(raw.dependencies)) raw.dependencies = [];
+    const deps = raw.dependencies;
+    if (deps.includes(ref) && deps.filter((d) => this.sameDeclaredAsset(d, ref)).length === 1) {
+      return;
     }
+    const next = [];
+    let placed = false;
+    for (const dep of deps) {
+      if (!this.sameDeclaredAsset(dep, ref)) {
+        next.push(dep);
+      } else if (!placed) {
+        next.push(ref);
+        placed = true;
+      }
+    }
+    if (!placed) next.push(ref);
+    raw.dependencies = next;
+    writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+  }
+  /**
+   * Whether the declared `dep` names the same asset (kind, publisher, name) as
+   * `ref`, ignoring the version pin. A publisher must agree on both sides —
+   * unlike {@link removeDependencyFromConfig}, a bare `kind:name` never replaces a
+   * publisher-qualified line. Unparseable entries only match on string equality.
+   */
+  sameDeclaredAsset(dep, ref) {
+    if (typeof dep !== "string") return false;
+    if (dep === ref) return true;
+    const a = parseAssetRefLoose(dep);
+    const b = parseAssetRefLoose(ref);
+    if (!a || !b) return false;
+    return a.kind === b.kind && a.name === b.name && a.publisher?.replace(/^@/, "") === b.publisher?.replace(/^@/, "");
   }
   /**
    * Remove a dependency ref from the manifest `dependencies:`. Targets the same
    * file as {@link addDependencyToConfig} (`~/.skaile/skaile.yaml` in global mode).
+   *
+   * @returns `true` when a declaration was removed.
    */
   removeDependencyFromConfig(target) {
     const configPath = join(this.stateRoot, "skaile.yaml");
@@ -2629,15 +2943,15 @@ var AssetManager = class {
     const raw = parse(readFileSync(configPath, "utf8")) ?? {};
     if (!Array.isArray(raw.dependencies)) return false;
     const wantPub = target.publisher?.replace(/^@/, "");
-    const idx = raw.dependencies.findIndex((dep) => {
-      if (typeof dep !== "string") return false;
+    const before = raw.dependencies.length;
+    raw.dependencies = raw.dependencies.filter((dep) => {
+      if (typeof dep !== "string") return true;
       const p = parseAssetRefLoose(dep);
-      if (!p || p.kind !== target.kind || p.name !== target.name) return false;
+      if (!p || p.kind !== target.kind || p.name !== target.name) return true;
       const havePub = p.publisher?.replace(/^@/, "");
-      return wantPub === void 0 || havePub === void 0 || havePub === wantPub;
+      return !(wantPub === void 0 || havePub === void 0 || havePub === wantPub);
     });
-    if (idx === -1) return false;
-    raw.dependencies.splice(idx, 1);
+    if (raw.dependencies.length === before) return false;
     writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
     return true;
   }
@@ -2659,5 +2973,5 @@ var AssetManager = class {
 };
 
 export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName };
-//# sourceMappingURL=chunk-PTO2YDDG.js.map
-//# sourceMappingURL=chunk-PTO2YDDG.js.map
+//# sourceMappingURL=chunk-D5HOETOB.js.map
+//# sourceMappingURL=chunk-D5HOETOB.js.map