@skaile/workspaces 5.7.0 → 5.9.0

package/CHANGELOG.md

@@ -1,5 +1,125 @@
 # Changelog
 
+## 5.9.0
+
+### Minor Changes
+
+- [#1048](https://github.com/skaile-ai/workspaces/pull/1048) [`dde2065`](https://github.com/skaile-ai/workspaces/commit/dde20655e419552b9a2dc46bfaf26b758e0cc188) Thanks [@peteralbert](https://github.com/peteralbert)! - Typed platform blocks and a per-turn tool allowlist on the `prompt` command (protocol 4.18.0, runtime feature `platformBlocks.v1`). A host can attach `platformBlocks` (`{ kind, id, text, attrs? }`, kinds `platform_notice`, `skaile_research`, `platform_research_complete`) and a `toolAllowlist` to a prompt. The runner renders the blocks in reserved tags (`<PLATFORM_NOTICE>`, `<SKAILE_RESEARCH>`, `<PLATFORM_RESEARCH_COMPLETE>`) at the very start of the turn, each block id once per runner process, and escapes those tag names everywhere else it hands text to the agent (prompt text, a reply, a flow turn), so a message that imitates a platform block reaches the model visibly escaped. A new system-prompt section (`platform-blocks`) tells the agent that only those tags at the start of a turn come from Skaile. With a `toolAllowlist`, the Claude SDK driver lets that turn, and every subagent it starts, call only the listed tools, enforced in a `PreToolUse` hook because the query runs under `bypassPermissions`. A driver that cannot enforce an allowlist (every other built-in), an unknown tool name, or a flow-routed prompt refuses the prompt with a non-fatal `error` (`category: "validation"`) instead of running it unrestricted. `AgentClient.prompt` takes `{ platformBlocks, toolAllowlist }`, and a `SessionDispatcher` `transformPrompt` may return `{ prompt, platformBlocks, toolAllowlist }`. The runner now lists `platformBlocks.v1` in `protocol_info.runtimeFeatures` on every host.
+
+## 5.8.0
+
+### Minor Changes
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - `codexDriverTarget.create` and `.listModels` now choose between the standalone SDK adapter (`CodexDriver`) and the managed App Server adapter (`ManagedCodexDriver`) once, through the new exported predicate `isManagedCodexConfig(config)` (`@skaile/workspaces/drivers/codex`). `CodexDriver` no longer wraps a managed adapter and forwards to it: it is the standalone adapter only, and its constructor throws `CODEX_MANAGED_REQUIRES_FACTORY` for a managed config, so managed auth fails closed instead of falling back to local credentials. The managed adapter's `driverInfo` now carries the catalog `capabilities`, so both adapters report the same `driverInfo`. Host-visible behaviour of `createDriver("codex", config)` does not change. Breaking only for code that called `new CodexDriver(managedConfig)`: see `MIGRATION.md`.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `library create` and `asset import` refuse a kind and name that the manifest already lists under another directory (`create skill x --dir fun/skills2` while `fun/skills/x` exists). They exit 1, write nothing and name the existing root, so the first asset no longer drops out of the publish list. `library index` and `validate` report two directories with the same kind and name (exit 1).
+
+  - `asset import --publisher "a b"` / `"Bad Pub!"` exit 1 with the same hint as `library create`.
+  - `library init <name> --path <dir>` writes the resolved publisher into `skaile.manifest.yaml` before its first index, so the refs `search --local` shows right after `init` stay the same after the next `library index`.
+  - `library publish --dry-run` plans the version in the asset's own file (the source of truth) and prints the same version-mismatch warning as `validate`. The `skaile-author-asset` skill no longer teaches a per-asset version override.
+  - `library init Installed` / `INSTALLED` (also `rename`, `set name=`, `--path`) are refused like `installed`, which is the same folder on macOS and Windows.
+  - `library index` now reports a duplicate directory whatever its sort order: a copy at `fun/a-skills/x` next to the manifest's `fun/skills/x` exits 1 and is named, as the reverse order already was. In a fresh library with two copies of one asset, `index` skips both, names both and exits 1 instead of silently keeping one.
+  - `library init --path <dir>` is refused for a not-yet-existing directory inside `<libraries>/installed` also when `SKAILE_HOME` is reached through a symlink (`/tmp` → `/private/tmp`).
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile library index` now drops a `skaile.manifest.yaml` entry whose kind is no longer registered (for example the `kind: bundle` entry of a 5.4.0 library) and prints a warning naming it. After `skaile migrate assets <dir> --write` the library lists only the `preset:` entry, not a second `bundle:` one.
+
+  - `skaile library index` and `skaile validate` warn about every leftover `*.bundle.yaml` file (they are not scanned) and name `skaile migrate assets <dir> --write` as the fix.
+  - The library upgrade steps in the docs now include the bundle → preset migration. The docs and the 5.7.0 migration entry list `preset`, not `bundle`, as a `library create` kind.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - A library asset can now depend on an asset of another publisher. `dependencies: ["skill:@skaile-ai/report-html"]` on a `skaile.manifest.yaml` entry used to pass `library index` and `validate` but was ignored; now `skaile add`, `install`, `info`, `check` and `doctor` all see it, and `add` deploys that asset from its library.
+
+  - `metadata.requires: "skill:@skaile-ai/report-html, speak-like-a-pirate"` in a SKILL.md no longer fails `add` with `invalid asset name "@skaile-ai/report-html" in ref "skill:@mortegro/@skaile-ai/report-html"`. `kind:@publisher/name` and `@publisher/name` (with an optional `#version`) are read as another publisher's asset; a bare name still means the asset's own publisher.
+  - `info` prints a cross-publisher requirement with its publisher (`skill:@skaile-ai/report-html`).
+  - The docs ([Declaring dependencies](docs/sections/discovery/author-manifest.md#declaring-dependencies)) list which forms `requires` and `dependencies` accept.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile why skill:@mortegro/speak-like-a-pirate` after `add skill:@mortegro/shanty-writer` prints the real chain (`speak-like-a-pirate ← shanty-writer ← direct (skaile.yaml)`). `direct (skaile.yaml)` now ends the chain only for assets `skaile.yaml` declares; an asset no declared dependency reaches says so. `skaile tree` nests each asset under the asset that requires it instead of listing everything at one level. Both read each locked asset's `requires` (and manifest `dependencies`, and a preset's items), so the lock file is unchanged.
+
+  - `skaile remove` also removes the dependencies the removal leaves orphaned: assets that nothing in `skaile.yaml` declares and no remaining locked asset requires any more. They are deleted from disk and the lock and listed in the output (`Removed skill:@mortegro/speak-like-a-pirate (no longer required by anything declared in skaile.yaml)`). This covers a preset's items too. A dependency that is still declared, or required by another asset, stays. `AssetManager.removeWithDependencies(ref)` is the programmatic form; `remove(ref)` still removes only the one asset.
+  - `skaile remove skill:speak-like-a-pirate`, `remove speak-like-a-pirate` and `remove skill:nope` no longer print a Node stack trace. A short ref that names exactly one declared, locked or deployed asset removes it; an unknown one prints `✗ Not deployed or declared`, and one that matches several (two publishers) prints one line naming them. All exit 1 on refusal.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - Agents from a library bind as instances and deploy in one form.
+
+  - `agents.<id>.ref: agent:@acme/helper-bot` in `skaile.yaml` now resolves an agent you added with `skaile add`. `skaile validate` accepts it and `skaile install` renders the instance, so you no longer copy the agent to `agents/<dir>/` first. The agent's source is kept under `.skaile/cache/agents/<name>/` (not committed, rebuilt by `skaile install`, removed by `skaile remove`).
+  - `skaile add` of an `AGENT.md` agent now writes `.claude/agents/<name>.md`, the same file an `agent.yaml` agent gets, instead of `.claude/agents/<name>/AGENT.md` (a copy of the old layout is replaced on the next `add` / `install`). Codex and omp keep their layouts (`.codex/agents/<name>.toml`, `.omp/agents/<name>/`).
+  - `skaile library create agent <name>` scaffolds `agent.yaml` (spec 0.2) plus `SOUL.md` instead of `AGENT.md`. `skaile validate` and `library publish` still flag the untouched `SOUL.md` body and `TODO:` description as scaffold placeholders.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile add skill:@pub/name` from a library now copies every file under the asset's manifest `root:` — `build.py`, `template.html`, `example.data/` and the rest — not only `SKILL.md` (a regression since 5.6.0).
+
+  - `skaile diff <ref>` compares that whole file set, so an edited or deleted helper shows up instead of `No differences.`.
+  - `skaile check` fails when a library asset is deployed without one of its files and names the missing ones; `skaile install` and `skaile install --locked` restore them.
+  - An asset your library's `skaile.manifest.yaml` does not list deploys as before.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile library commit` works again as soon as a rebase is finished. It only refuses while git's rebase is really still in progress, so the `REBASE_HEAD` file that git leaves behind after `rebase --continue` no longer blocks it.
+
+  - `skaile library push` on diverged history prints one `✗` line that names `skaile library git <name> pull --rebase origin <branch>`, the same as `pull` and `sync`, instead of git's multi-line rejection.
+  - `skaile library pull` and `skaile library sync` re-index the library when they applied remote changes, so `search --local` and `asset show` show new or edited assets without a manual `skaile library index`. They only re-index: `skaile.manifest.yaml` is never edited, so the clone stays clean, `sync` has nothing unpushed, and the next fast-forward pull is not blocked. Problems in upstream content are warnings and do not make a successful pull exit 1.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - `skaile install --locked` now fails on drift as documented, and `skaile add` no longer moves a pinned dependency:
+
+  - `install --locked` exits 1 with one `Missing:` line per gap, where it used to print `Nothing to install (already up to date)` and exit 0: a dependency declared in `skaile.yaml` that has no lock entry (or does not resolve), an installed asset's `requires` that is neither deployed nor locked (for example a project locked by 5.4.0 before `report-html` required six more skills), and a lock entry whose version contradicts a `#version` pin in `skaile.yaml`. Run `skaile install` once without `--locked` and commit the new lock.
+  - `skaile outdated` lists the same gaps as problem rows, and `skaile check` reports the same set. `check` also prints the `did you mean …` hint that `skaile add` prints when a ref missed because its publisher changed.
+  - `skaile add skill:@acme/shanty-writer` resolves its dependency `skill:@acme/speak-like-a-pirate` at the ref `skaile.yaml` already declares for it, pin included. It used to deploy and lock the newest version (0.8.0 from another library) over the declared `#0.1.0`. `install` and `lock` resolve a pinned dependency the same way.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - Same-name assets no longer collide silently:
+
+  - `skaile add skill:@otherorg/x` in a project that already holds `skill:@mortegro/x` now refuses (exit 1, nothing written) with one line that names the shared folder (`.claude/skills/x`) and the asset that holds it. Before, the second asset overwrote the first and `list`/`check` reported both as installed. `skaile install` refuses a `skaile.yaml` that declares both, and `install --locked` refuses a lock that holds both. Run `skaile remove` on the first asset to switch.
+  - `skaile search --local` now prints one row per library when two libraries hold the same ref at the same version, and marks the row `skaile add` deploys with `(used by add)` in the library column. Before, it printed one row, sometimes naming the library `add` does not use.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile add preset:@pub/name` now exits 1 and records nothing when one of the preset's items does not resolve (for example the `skill:@your-publisher/example-skill` placeholder that `library create preset` writes). The error names the item.
+
+  - The items of a declared preset count as declared dependencies: `skaile check` exits 1, `skaile doctor` and `skaile list` report the unresolved item, and `skaile install --locked` fails instead of passing against a partial lock.
+  - A preset held by a library is expanded like a store preset: `skaile.lock.yaml` records only its items (no `preset:` row), `skaile install` prints `preset <ref>: N assets, M instance items skipped …`, and `skaile add` names the library when the preset deploys nothing instead of talking about the store cache. An older lock's `preset:` row for a library preset is dropped on the next `skaile install`.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile library publish` / `register` now apply the same checks to presets as to every other asset kind: a preset with a non-semver `version` or an empty or unparseable `*.preset.yaml` is refused with a one-line reason, and a preset that is still the `library create preset` scaffold is reported before anything is pushed.
+
+  - `skaile validate` prints the `manifest version … differs` warning for presets, and flags an untouched preset scaffold (`description` still `A curated set of assets`, an item still `skill:@your-publisher/example-skill`) as `[preset] … is still the scaffold placeholder`.
+  - The prompt scaffold warning reads `write the prompt` instead of `write the prompt prompt`.
+  - `skaile library publish` now publishes the version each asset file declares, as `--dry-run` already planned it. The store records the versions of the manifest in the pushed repo, so a stale `version` in `skaile.manifest.yaml` used to be published instead of the file's. `publish` rewrites such entries before it commits and prints `Updated the manifest: <ref>: manifest version <old> → <new>`; `--dry-run` lists them as `would update the manifest` and writes nothing. `skaile library register` pushes nothing, so it exits 1 (with `--dry-run` too) and points at `skaile library index <lib>` when an entry's version differs from its file.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile run <flow>` and `skaile run mvp` no longer print internal capability-registry events (raw JSON lines on stdout plus a second copy); they are debug-level now, visible with `SKAILE_LOG_LEVEL=debug`. The flow's own output is printed once.
+
+  - `skaile run --dry-run` no longer creates a session, so `skaile session list` does not fill with `running` dry runs.
+  - `skaile session delete <id>` and `skaile session switch <id>` on an unknown id now exit 1 with `✗ Session not found: <id>` (delete used to report success, switch printed a stack trace).
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - - `skaile source sync` and `skaile update` pull again after `skaile add` or `skaile install --locked` checked a source out at its locked commit. They put the shared clone back on its branch first, instead of printing git's `You are not currently on a branch` and skipping the source.
+
+  - A failed pull now prints one line (`<source>: git pull failed: <reason>`) and `skaile source sync` and `skaile update` exit 1. Before, `skaile update` printed `Synced 0/1 source(s) (1 failed)` and exited 0.
+  - `skaile outdated` and `skaile show` report new commits for a source when git rewrites its URL (`git config --global url.<other>.insteadOf <url>`). They used to say `All assets are up to date.`.
+  - Sources whose URL is not `<host>/<owner>/<repo>` (a `file://` path, a GitLab subgroup) get their own clone, `<repo>-<hash of the URL>`. Two repos with the same name no longer share one clone and index. Clones of such sources made by an older version are not reused: the next `skaile source sync` clones them again, moves the source's existing library row to the new clone (so `skaile add` does not warn that the asset exists in 2 libraries) and prints one line saying the old directory under `~/.skaile/cache/sources/` can be deleted. GitHub-shaped sources keep their clone.
+
+- [#1043](https://github.com/skaile-ai/workspaces/pull/1043) [`079877a`](https://github.com/skaile-ai/workspaces/commit/079877aafc91f60dc0aed2f4c80fbcaa848cf173) Thanks [@mortegro](https://github.com/mortegro)! - `skaile install` no longer deletes an asset whose library is gone, and `update` says when it re-locks:
+
+  - When the only library that holds a declared, locked asset is removed or renamed, or its publisher changed, `skaile install` used to print `! Removed: skill:@acme/pirate#0.1.0`, delete the deployed skill and drop its lock entry while `skaile.yaml` still declared it. It now keeps the deployed files and the lock entry, still exits 1 and lists the ref as `Missing:`, and names the fix: `register library "x" again with skaile library init x --path <dir>`, or for a changed publisher `did you mean skill:@new/pirate?` with the new ref and `skaile library set x publisher=<old>`. A lock entry that `skaile.yaml` no longer declares is still pruned.
+  - The assets a kept asset requires are kept too. With `a` (requires `b`) and `c` declared from a library you then remove, `skaile install` used to keep `a` and `c` but print `! Removed: skill:@mortegro/b#0.1.0` and delete `b`, which `a` needs. `b` now stays deployed and locked, and `install` still lists only `a` and `c` as `Missing:`. A dependency nothing kept requires is still pruned.
+  - `skaile check` and `skaile outdated` print that same fix for such an asset instead of `run skaile install` (which cannot restore it). `outdated` no longer prints the `Run skaile install to restore or re-lock the broken assets` line when every problem row names its own fix.
+  - For a library asset whose files changed since the lock (`content changed since lock`), `skaile update` used to print `Nothing to update.` while it silently rewrote the lock hash. `skaile update` and `skaile install` now print `Re-locked <ref>` and `Lock file written` for every rewritten lock entry, and `outdated` says `Run skaile update to re-lock and re-deploy.`
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - `AgentDriver.reconfigure()` now returns `Promise<ReconfigureOutcome>`, and `runner.reconfigure` answers the host from it instead of from `driver.getModel()`. `ok: true` means the next turn runs on the new settings (live switch, query recycle or respawn); a driver that cannot promise that answers `not_supported`, a model the session's AI provider entry does not list answers `model_not_on_provider`, and a change the running process refuses answers `rejected` and rolls the config back. One `ReconfigureLedger` (exported from the bridge) now owns drift, serial ordering of patches, the provider-entry scope rule, rollback and the outcome for every driver (claude-sdk, omp, codex, the one-shot CLI drivers); each driver supplies one apply hook. A patch answered `ok` mid-turn that the process refuses at the turn boundary rolls the driver back and emits the driver event `reconfigure-rollback`; the runner takes it out of the state a driver recreate starts from. Removes the runner-internal `driverAppliesReconfigure` and `getModelSelection`. omp now answers `rejected` for a bare model name (no `provider/` prefix) instead of keeping it for the next spawn. See `MIGRATION.md`.
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - New transient `reconfigure_rejected` agent event (protocol 4.17.0): a live `runner.reconfigure` the runner answered `ok` (the patch landed while a turn was running) and the harness then refused at the turn boundary. The event carries `fields`, `code`, `message` and the `model` the driver runs after the rollback. The runner drops the patch from its recreate state before it sends the event, so a recreate starts on the rolled-back settings, and omp no longer also emits an `error` event for the same refusal. A refusal while the session is idle is still answered on the capability call and sends no event. A host maps the event to its restart-required cue for the session.
+
+### Patch Changes
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - Add `resolveAccessPolicy(declaration)` to the `@skaile/workspaces/connectors` subpath. It returns `{ writable, enforcedReadOnly, required, watch }` for a connector declaration. The connector manager (failure-record `required`, the `failOnReadWriteError` filter, `watchAll`) and the git connector's read-only mode now read these values instead of spelling the rules out from `access`, `accessDefaulted`, `mount` and `unavailable`. Behaviour does not change.
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - Fix the SDK `AgentSession` state for a multi-question ask. The session stayed `waiting` only until the first `send()` and then reported `active` while the agent was still blocked on the other sub-questions. It now stays `waiting` until every sub-question has an answer, and tool or text events that follow the question no longer move it to `active`. The slot rule (a name from the ask binds to its own sub-question, anything else fills the oldest open one) is now one internal `AskSlots` class shared by the claude-sdk driver, `AgentStore` and `AgentSession`. Driver and store behaviour does not change.
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - `parseFlowDefinition` is now the only place the flow connector checks the static rules of a single flow; the engine no longer re-checks them at run time (ADR 0003). The reserved binding name check, the second tokenize/parse of each expression, and the output-schema compile catch are gone from run time. Expressions are tokenized, parsed and shape-checked once, cached, and reused by evaluation, which now raises only what depends on run data. A flow whose `output.schema` cannot be compiled and whose `output.bindings` resolve it is now refused at parse time (it used to fail only when the flow completed as a sub-flow). The inline sub-flow host parses each resolved child before the cross-flow output check, so a v1 child is compared as normalized v2. Code that builds a `FlowDefinition` in memory and calls the exported engine helpers directly must run it through `parseFlowDefinition` first.
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - `skaile flow list`, `flow show` and `run <flow-id>` now read the flows of registered libraries through one library-owned scan, `scanAuthoringLibraries(index, registry)` (exported from `@skaile/workspaces/library`). When two registered libraries declare the same flow id, the newest registration now wins. Before, the row order of `index.db` decided. A library with a missing path or a failing scan is skipped with a per-library error, and the other libraries still list. Source clones and `dev_paths` assets are still not listed, as before. The authoring-library filter moved from the CLI's `open-library` module into `@skaile/workspaces/library`, where it stays module-internal.
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - The library band of `skaile manage` now reads registered libraries through `scanAuthoringLibraries`, the same scan `library index` and `search --local` use. Three things change on screen:
+
+  - Publishers and refs match `search --local`. The band honours the per-asset publisher (manifest `assets[].publisher`, `publisher_overrides`, `publisher_default`) instead of showing one publisher for the whole library, so selecting a row installs the same asset `skaile add <ref>` installs for the ref `search --local` prints.
+  - Assets under a library's `dev_paths` no longer show.
+  - A library that fails to scan (for example, its path is gone) becomes one `[libraries]` note naming it. The other libraries stay listed. Before, a missing path was skipped silently.
+
+  `authoringLibraries` stays module-internal in `@skaile/workspaces/library` and is not exported.
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - The managed codex harness driver now gates its `account/chatgptAuthTokens/refresh` (401) handler through the same internal recovery policy as the claude-sdk driver, instead of its own `refreshUsed` / `startupRefreshUsed` flags. Behaviour is unchanged: one credential refresh per active turn and one at startup, kept separate; a second refresh is refused with `CODEX_AUTH_UNAVAILABLE`, and a new turn gets a fresh budget. The codex server still replays the turn itself.
+
+- [#1041](https://github.com/skaile-ai/workspaces/pull/1041) [`fe426a5`](https://github.com/skaile-ai/workspaces/commit/fe426a5f824afb9c360c987a256e32c92d4c3a8f) Thanks [@mortegro](https://github.com/mortegro)! - The claude-sdk harness driver now asks one internal recovery policy (`bridge/src/drivers/recovery-policy.ts`) what to do about each failed turn, once, instead of evaluating the stale-resume, poisoned-transcript, auth-refresh and seat-failover conditions in two places (`failTurn` and the `runPrompt` catch) with mirrored budget flags. The policy picks one recovery attempt or fails the turn and owns the per-turn budgets (one attempt per kind, independent across kinds; auth and limit exclude each other). Host-visible behaviour is unchanged: the same `resume_failed`, `retrying` / `retryReason`, `message_retract` and deferred `error` events in the same order.
+
 ## 5.7.0
 
 ### Minor Changes

package/dist/app-sdk/index.js

@@ -1,4 +1,4 @@
-import { PROTOCOL_VERSION_STRING } from '../chunk-DMLDYFDS.js';
+import { PROTOCOL_VERSION_STRING } from '../chunk-F4NJDSR7.js';
 import '../chunk-NSBPE2FW.js';
 import * as z from 'zod';
 

package/dist/{asset-feeds-K36CR52Q.js → asset-feeds-XMKKUUK6.js}

@@ -1,50 +1,74 @@
-import { getKnownKinds } from './chunk-WIEC3ZE4.js';
-import './chunk-LBQ4BBX4.js';
-import './chunk-QZLWJETK.js';
-import './chunk-NFGRW3L7.js';
-import './chunk-QCI6D7E4.js';
-import './chunk-DFFD4BFG.js';
-import './chunk-6VRJH4MR.js';
-import './chunk-FAP63KV7.js';
+import { getKnownKinds } from './chunk-2FRUUDZY.js';
+import './chunk-FZNG4V4J.js';
+import './chunk-MGGFBZWA.js';
+import './chunk-7RGTAEG6.js';
+import './chunk-NUELZWCF.js';
+import './chunk-4MQS7CAF.js';
+import './chunk-Y7QA2OLD.js';
+import './chunk-CKQEIY43.js';
 import './chunk-R7FOF242.js';
 import './chunk-3TXEJN4W.js';
-import './chunk-FRHE7FFB.js';
-import './chunk-OOLT6HGP.js';
+import './chunk-B6GIW55K.js';
+import './chunk-36AFURKZ.js';
 import './chunk-4GY63JU6.js';
-import { factoryAssetRoots } from './chunk-SWO25LTO.js';
-import './chunk-G67BOI2J.js';
+import { factoryAssetRoots } from './chunk-GB7WDMH2.js';
+import './chunk-PMECEZK3.js';
 import './chunk-5BEFNLOR.js';
 import './chunk-A2ULN3KX.js';
-import { scanRepo } from './chunk-LCU5U5IW.js';
+import { scanRepo } from './chunk-JAKOMFC6.js';
 import './chunk-L5VSIPQD.js';
 import './chunk-CPSIPIX7.js';
-import './chunk-RVIZQ5XD.js';
+import './chunk-BTE2V4IW.js';
 import './chunk-RVRB27AN.js';
-import './chunk-TTPSDC2G.js';
-import './chunk-O7VPNKYN.js';
+import { parseRequires } from './chunk-GTILM2CI.js';
+import './chunk-QVNRCDTV.js';
 import './chunk-ICSCSM5D.js';
-import './chunk-JMKB7IB4.js';
+import './chunk-UMVKJM4Q.js';
 import './chunk-MJHSLODD.js';
 import './chunk-C3CAXQMA.js';
 import './chunk-BOFL7GIF.js';
 import './chunk-NSBPE2FW.js';
-import { existsSync } from 'fs';
 import * as path from 'path';
 
+function libraryEntryOf(asset) {
+  const { manifest } = asset;
+  const nested = manifest.metadata?.requires;
+  const rawRequires = manifest.requires ?? nested;
+  const requireRefs = typeof rawRequires === "string" ? rawRequires : Array.isArray(rawRequires) ? rawRequires.filter((r) => typeof r === "string") : void 0;
+  const deps = manifest.dependencies;
+  return {
+    name: asset.name,
+    kind: asset.kind,
+    description: typeof manifest.description === "string" ? manifest.description : "",
+    source: asset.manifestPath,
+    publisher: asset.publisher,
+    ...asset.plugin ? { plugin: asset.plugin } : {},
+    version: asset.version,
+    requires: requireRefs === void 0 ? [] : parseRequires({ requires: requireRefs }),
+    dependencies: asset.kind === "bundle" && Array.isArray(deps) ? deps.filter((d) => typeof d === "string" && d.length > 0) : []
+  };
+}
 async function libraryAssets() {
   const notes = [];
   try {
-    const { openLibraryManager, authoringLibraries } = await import('./open-library-P3D337NH.js');
-    const { manager, close } = await openLibraryManager();
+    const { openLibraryManager } = await import('./open-library-DB2PNL2X.js');
+    const { getKindRegistry } = await import('./open-registry-ZUZJ7MS7.js');
+    const { scanAuthoringLibraries } = await import('./library/index.js');
+    const { library: index, close } = await openLibraryManager();
     try {
-      const libs = authoringLibraries(await manager.listLibraries());
       const entries = [];
-      for (const lib of libs) {
-        if (!existsSync(lib.path)) continue;
-        const libEntries = [
-          ...await scanRepo(lib.path, lib.name, { knownKinds: getKnownKinds() })
-        ];
-        for (const entry of libEntries) entries.push({ origin: "library", entry, group: lib.name });
+      for (const scan of await scanAuthoringLibraries(index, getKindRegistry())) {
+        if (scan.error !== void 0) {
+          notes.push({ feed: "libraries", message: `${scan.library.name}: ${scan.error}` });
+          continue;
+        }
+        for (const asset of scan.assets) {
+          entries.push({
+            origin: "library",
+            entry: libraryEntryOf(asset),
+            group: scan.library.name
+          });
+        }
       }
       return { entries, notes };
     } finally {
@@ -61,7 +85,7 @@ async function libraryAssets() {
 async function storeAssets(projectDir) {
   const notes = [];
   try {
-    const { resolveCatalogSource } = await import('./open-library-P3D337NH.js');
+    const { resolveCatalogSource } = await import('./open-library-DB2PNL2X.js');
     const { source, close } = await resolveCatalogSource({ projectDir });
     try {
       const assets = await source.listAssets();
@@ -140,5 +164,5 @@ async function gatherAssetFeeds(am, projectDir) {
 }
 
 export { gatherAssetFeeds };
-//# sourceMappingURL=asset-feeds-K36CR52Q.js.map
-//# sourceMappingURL=asset-feeds-K36CR52Q.js.map
+//# sourceMappingURL=asset-feeds-XMKKUUK6.js.map
+//# sourceMappingURL=asset-feeds-XMKKUUK6.js.map

package/dist/asset-feeds-XMKKUUK6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuEA,SAAS,eAAe,KAAA,EAAsC;AAC5D,EAAA,MAAM,EAAE,UAAS,GAAI,KAAA;AACrB,EAAA,MAAM,MAAA,GAAU,SAAS,QAAA,EAAkD,QAAA;AAC3E,EAAA,MAAM,WAAA,GAAc,SAAS,QAAA,IAAY,MAAA;AACzC,EAAA,MAAM,cACJ,OAAO,WAAA,KAAgB,QAAA,GACnB,WAAA,GACA,MAAM,OAAA,CAAQ,WAAW,CAAA,GACvB,WAAA,CAAY,OAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,CAAA,GAC5D,MAAA;AACR,EAAA,MAAM,OAAO,QAAA,CAAS,YAAA;AACtB,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,aAAa,OAAO,QAAA,CAAS,WAAA,KAAgB,QAAA,GAAW,SAAS,WAAA,GAAc,EAAA;AAAA,IAC/E,QAAQ,KAAA,CAAM,YAAA;AAAA,IACd,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,GAAI,MAAM,MAAA,GAAS,EAAE,QAAQ,KAAA,CAAM,MAAA,KAAW,EAAC;AAAA,IAC/C,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,QAAA,EAAU,gBAAgB,MAAA,GAAY,KAAK,aAAA,CAAc,EAAE,QAAA,EAAU,WAAA,EAAa,CAAA;AAAA,IAClF,cACE,KAAA,CAAM,IAAA,KAAS,YAAY,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,GACzC,IAAA,CAAK,OAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,EAAE,MAAA,GAAS,CAAC,IACrE;AAAC,GACT;AACF;AAWA,eAAe,aAAA,GAGZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AAEF,IAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AAC/D,IAAA,MAAM,EAAE,eAAA,EAAgB,GAAI,MAAM,OAAO,6BAAoB,CAAA;AAC7D,IAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC5E,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AAC3D,IAAA,IAAI;AACF,MAAA,MAAM,UAAyB,EAAC;AAChC,MAAA,KAAA,MAAW,QAAQ,MAAM,sBAAA,CAAuB,KAAA,EAAO,eAAA,EAAiB,CAAA,EAAG;AACzE,QAAA,IAAI,IAAA,CAAK,UAAU,KAAA,CAAA,EAAW;AAC5B,UAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,EAAA,EAAK,IAAA,CAAK,KAAK,IAAI,CAAA;AAChF,UAAA;AAAA,QACF;AACA,QAAA,KAAA,MAAW,KAAA,IAAS,KAAK,MAAA,EAAQ;AAC/B,UAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,YACX,MAAA,EAAQ,SAAA;AAAA,YACR,KAAA,EAAO,eAAe,KAAK,CAAA;AAAA,YAC3B,KAAA,EAAO,KAAK,OAAA,CAAQ;AAAA,WACrB,CAAA;AAAA,QACH;AAAA,MACF;AACA,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAYA,eAAe,YAAY,UAAA,EAGxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AACF,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAaA,eAAe,aAAa,EAAA,EAA8C;AAIxE,EAAA,MAAM,eAAA,GAAkB,iBAAA,EAAkB,CAAE,GAAA,CAAI,CAAC,CAAA,KAAO,CAAA,CAAE,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,CAAA,GAAI,CAAA,GAAS,IAAA,CAAA,GAAI,CAAA;AAChG,EAAA,MAAM,gBAAgB,CAAC,CAAA,KACrB,eAAA,CAAgB,IAAA,CAAK,CAAC,EAAA,KAAO,CAAA,KAAM,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,EAAE,CAAC,CAAA;AAExE,EAAA,MAAM,GAAA,GAAA,CAAO,MAAM,EAAA,CAAG,MAAA,EAAO,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,UAAyB,EAAC;AAMhC,EAAA,KAAA,MAAW,EAAE,QAAA,EAAU,IAAA,EAAK,IAAK,EAAA,CAAG,iBAAgB,EAAG;AACrD,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,OAAO,IAAA,GAAY,IAAA,CAAA,GAAA;AAC5D,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,IAAA,IAAQ,CAAA,CAAE,MAAA,CAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAChF,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACxB,IAAA,MAAM,aAAa,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,QAAA;AAChD,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,EAAE,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,OAAA;AACT;AAUA,eAAe,aAAA,GAGZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,mBAAkB,EAAG;AACtC,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,QAAA,CAAS,IAAA,EAAM,gBAAA,EAAkB,EAAE,UAAA,EAAY,aAAA,EAAc,EAAG,CAAE,CAAA;AAAA,IAC3F;AACA,IAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,EAC1B,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,SAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AASA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,EAAc;AACpC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,EAAE,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA;AAAA,MACH,GAAG,IAAA,CAAK,OAAA;AAAA,MACR,GAAG,GAAA,CAAI,SAAA,EAAW,OAAA,CAAQ,OAAO,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA,IACA,KAAA,EAAO,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,KAAA,CAAM,KAAA,EAAO,GAAG,OAAA,CAAQ,KAAK;AAAA,GACzD;AACF","file":"asset-feeds-XMKKUUK6.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Four feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex`, read through\n *   `scanAuthoringLibraries` (`@skaile/workspaces/library`): the same scan\n *   `library index` / `search --local` use, so publishers and refs match them\n *   (per-asset `publisher_overrides` honoured), `dev_paths` assets are left out,\n *   and a library that fails to scan becomes one note while the rest stay listed.\n * - **Factory assets** — the bundled first-party `factory-assets` tree\n *   (`factoryAssetRoots()`), scanned from disk. Always present; no network.\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport * as path from \"node:path\";\nimport {\n  type AssetKind,\n  type CatalogEntry,\n  factoryAssetRoots,\n  parseRequires,\n  scanRepo,\n} from \"@skaile/workspaces/core\";\nimport { getKnownKinds } from \"./open-registry.ts\";\nimport type { DiscoveredAsset } from \"@skaile/workspaces/discovery\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\" | \"factory\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"factory\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n  /**\n   * Second-level grouping label for the manage tree. Defaults (when unset) to the\n   * entry's `publisher`; the source feed sets it to the source's short repo name\n   * so the Sources band groups by source — \"which repo did this come from\" — not\n   * by the asset-intrinsic publisher.\n   */\n  group?: string;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}\n\n/**\n * Map one discovered library asset to the `CatalogEntry` the manage rows read.\n * `publisher` is the bare per-asset publisher (what `search --local` prints),\n * `source` the manifest path. `repo` is left unset: it only feeds the Sources-tree\n * org grouping. `requires` / `dependencies` come from the manifest the way the\n * scanner fills them — string `requires:` refs parsed to `{kind, name}`, a bundle's\n * string `dependencies:` list verbatim.\n */\nfunction libraryEntryOf(asset: DiscoveredAsset): CatalogEntry {\n  const { manifest } = asset;\n  const nested = (manifest.metadata as Record<string, unknown> | undefined)?.requires;\n  const rawRequires = manifest.requires ?? nested;\n  const requireRefs =\n    typeof rawRequires === \"string\"\n      ? rawRequires\n      : Array.isArray(rawRequires)\n        ? rawRequires.filter((r): r is string => typeof r === \"string\")\n        : undefined;\n  const deps = manifest.dependencies;\n  return {\n    name: asset.name,\n    kind: asset.kind as AssetKind,\n    description: typeof manifest.description === \"string\" ? manifest.description : \"\",\n    source: asset.manifestPath,\n    publisher: asset.publisher,\n    ...(asset.plugin ? { plugin: asset.plugin } : {}),\n    version: asset.version,\n    requires: requireRefs === undefined ? [] : parseRequires({ requires: requireRefs }),\n    dependencies:\n      asset.kind === \"bundle\" && Array.isArray(deps)\n        ? deps.filter((d): d is string => typeof d === \"string\" && d.length > 0)\n        : [],\n  };\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/cache/sources/` cache) through\n * `scanAuthoringLibraries`, grouped under the bare library name\n * (`group: <name>`) so the manage TUI shows a clean `<name>` band — no\n * `library:` prefix (mirrors the source feed). Plugin grouping (`entry.plugin`)\n * comes from `DiscoveredAsset.plugin`. A library whose scan fails becomes one\n * `FeedNote`; the outer `catch` covers only opening the index.\n */\nasync function libraryAssets(): Promise<{\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    // Lazy: the library subpath pulls in SQLite, which the other feeds never need.\n    const { openLibraryManager } = await import(\"./open-library.ts\");\n    const { getKindRegistry } = await import(\"./open-registry.ts\");\n    const { scanAuthoringLibraries } = await import(\"@skaile/workspaces/library\");\n    const { library: index, close } = await openLibraryManager();\n    try {\n      const entries: OriginEntry[] = [];\n      for (const scan of await scanAuthoringLibraries(index, getKindRegistry())) {\n        if (scan.error !== undefined) {\n          notes.push({ feed: \"libraries\", message: `${scan.library.name}: ${scan.error}` });\n          continue;\n        }\n        for (const asset of scan.assets) {\n          entries.push({\n            origin: \"library\",\n            entry: libraryEntryOf(asset),\n            group: scan.library.name,\n          });\n        }\n      }\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        plugin: a.plugin,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], notes };\n  }\n}\n\n/** The slice of `AssetManager` the source feed needs (kept narrow for tests). */\ninterface AssetManagerLike {\n  search: () => Promise<CatalogEntry[]>;\n  searchRepoRoots: () => { repoName: string; root: string }[];\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which merges\n * `skaile.yaml`'s `sources:` field into the repositories map. Plugin grouping\n * (`entry.plugin`) is stamped by the scanner, so entries pass through as-is.\n */\nasync function sourceAssets(am: AssetManagerLike): Promise<OriginEntry[]> {\n  // The bundled factory tree is injected into the repositories map as an implicit\n  // source, so `am.search()` returns it too. It has its own `factory` origin band,\n  // so drop it here — otherwise the same first-party skills list twice under Sources.\n  const factoryPrefixes = factoryAssetRoots().map((r) => (r.endsWith(path.sep) ? r : r + path.sep));\n  const isFactoryPath = (p: string) =>\n    factoryPrefixes.some((fp) => p === fp.slice(0, -1) || p.startsWith(fp));\n\n  const all = (await am.search()).filter((e) => !isFactoryPath(e.source));\n  const entries: OriginEntry[] = [];\n  // Group each source's entries under the source node (its short repo name), not\n  // the publisher: under Sources the navigational question is \"which repo did\n  // this come from\". Each entry's `source` (absolute manifest path) lives under\n  // exactly one declared root, so group by prefix. The cache slug is\n  // URL-keyed `github.com/<org>/<repo>` — take the trailing segment.\n  for (const { repoName, root } of am.searchRepoRoots()) {\n    if (isFactoryPath(root)) continue;\n    const prefix = root.endsWith(path.sep) ? root : root + path.sep;\n    const owned = all.filter((e) => e.source === root || e.source.startsWith(prefix));\n    if (owned.length === 0) continue;\n    const sourceName = repoName.split(\"/\").pop() || repoName;\n    for (const entry of owned) entries.push({ origin: \"source\", entry, group: sourceName });\n  }\n  return entries;\n}\n\n/**\n * Factory-asset feed: scan the bundled first-party `factory-assets` tree(s)\n * resolved by `factoryAssetRoots()` (the `SKAILE_FACTORY_ASSETS_DIR` override\n * layer ahead of the bundled tree). Local disk only, no network — the entries are\n * the built-in skills / connectors / bundles that ship with `@skaile/workspaces`.\n * `factoryAssetRoots()` already dedupes, so the env override pointing at the\n * bundled dir collapses to one root.\n */\nasync function factoryAssets(): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const entries: CatalogEntry[] = [];\n    for (const root of factoryAssetRoots()) {\n      entries.push(...(await scanRepo(root, \"skaile-factory\", { knownKinds: getKnownKinds() })));\n    }\n    return { entries, notes };\n  } catch (err) {\n    notes.push({\n      feed: \"factory\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk. The factory\n * scan is local disk only, so it runs inline.\n */\nexport async function gatherAssetFeeds(\n  am: AssetManagerLike,\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  const factory = await factoryAssets();\n  const src = await sourceAssets(am);\n  return {\n    entries: [\n      ...src,\n      ...libs.entries,\n      ...tag(\"factory\", factory.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    notes: [...libs.notes, ...store.notes, ...factory.notes],\n  };\n}\n"]}

package/dist/asset-manager/catalog-deployer.js

@@ -1,19 +1,19 @@
-export { WORKSPACE_MOUNT_ENV_VAR, deployAll, deployCatalogEntry, findAiAssetsRoot, isUnderWorkspaceMount, resolveFlowSkills, undeployCatalogEntry, workspaceMountDirs } from '../chunk-O4Z7MAW7.js';
-import '../chunk-OOLT6HGP.js';
+export { WORKSPACE_MOUNT_ENV_VAR, deployAll, deployCatalogEntry, findAiAssetsRoot, isUnderWorkspaceMount, resolveFlowSkills, undeployCatalogEntry, workspaceMountDirs } from '../chunk-2LWYNQK7.js';
+import '../chunk-36AFURKZ.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-SWO25LTO.js';
-import '../chunk-G67BOI2J.js';
+import '../chunk-GB7WDMH2.js';
+import '../chunk-PMECEZK3.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-LCU5U5IW.js';
+import '../chunk-JAKOMFC6.js';
 import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-RVIZQ5XD.js';
+import '../chunk-BTE2V4IW.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-TTPSDC2G.js';
-import '../chunk-O7VPNKYN.js';
+import '../chunk-GTILM2CI.js';
+import '../chunk-QVNRCDTV.js';
 import '../chunk-ICSCSM5D.js';
-import '../chunk-JMKB7IB4.js';
+import '../chunk-UMVKJM4Q.js';
 import '../chunk-MJHSLODD.js';
 import '../chunk-C3CAXQMA.js';
 import '../chunk-BOFL7GIF.js';

package/dist/asset-manager/index.js

@@ -1,30 +1,30 @@
-export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName } from '../chunk-D5HOETOB.js';
-import '../chunk-DFFD4BFG.js';
-import '../chunk-6VRJH4MR.js';
-import '../chunk-FAP63KV7.js';
+export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName } from '../chunk-IMKSM5NL.js';
+import '../chunk-4MQS7CAF.js';
+import '../chunk-Y7QA2OLD.js';
+import '../chunk-CKQEIY43.js';
 import '../chunk-R7FOF242.js';
 import '../chunk-3TXEJN4W.js';
-export { SCAFFOLD_KINDS, createScaffold, deployAll, installAgent, installTargetOf, removeAsset } from '../chunk-74EEFB52.js';
+export { SCAFFOLD_KINDS, createScaffold, deployAll, installAgent, installTargetOf, removeAsset } from '../chunk-YSHVQGUS.js';
 export { BUILT_IN_FRAGMENTS, loadPromptExtensions, resolveFragments } from '../chunk-CGYEHQOX.js';
 export { appendHistory, clearHistory, getRecentHistory, loadHistory } from '../chunk-KTBKW2FI.js';
 import '../chunk-UQ6LFBPZ.js';
-export { AGENT_RENDERERS, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-AVCUPPG6.js';
-import '../chunk-FRHE7FFB.js';
-import '../chunk-OOLT6HGP.js';
+export { AGENT_RENDERERS, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-EF7NPDDU.js';
+import '../chunk-B6GIW55K.js';
+import '../chunk-36AFURKZ.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-SWO25LTO.js';
-import '../chunk-G67BOI2J.js';
+import '../chunk-GB7WDMH2.js';
+import '../chunk-PMECEZK3.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-LCU5U5IW.js';
+import '../chunk-JAKOMFC6.js';
 import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-RVIZQ5XD.js';
+import '../chunk-BTE2V4IW.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-TTPSDC2G.js';
-import '../chunk-O7VPNKYN.js';
+import '../chunk-GTILM2CI.js';
+import '../chunk-QVNRCDTV.js';
 import '../chunk-ICSCSM5D.js';
-import '../chunk-JMKB7IB4.js';
+import '../chunk-UMVKJM4Q.js';
 import '../chunk-MJHSLODD.js';
 import '../chunk-C3CAXQMA.js';
 import '../chunk-BOFL7GIF.js';

package/dist/asset-manager/installer.js

@@ -1,22 +1,22 @@
-export { SCAFFOLD_KINDS, canonicalEntryRef, createScaffold, deployAll, deployAsset, installTargetOf, removeAsset } from '../chunk-74EEFB52.js';
+export { SCAFFOLD_KINDS, canonicalEntryRef, createScaffold, deployAll, deployAsset, installTargetOf, removeAsset } from '../chunk-YSHVQGUS.js';
 import '../chunk-CGYEHQOX.js';
-import '../chunk-AVCUPPG6.js';
-import '../chunk-FRHE7FFB.js';
-import '../chunk-OOLT6HGP.js';
+import '../chunk-EF7NPDDU.js';
+import '../chunk-B6GIW55K.js';
+import '../chunk-36AFURKZ.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-SWO25LTO.js';
-import '../chunk-G67BOI2J.js';
+import '../chunk-GB7WDMH2.js';
+import '../chunk-PMECEZK3.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-LCU5U5IW.js';
+import '../chunk-JAKOMFC6.js';
 import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-RVIZQ5XD.js';
+import '../chunk-BTE2V4IW.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-TTPSDC2G.js';
-import '../chunk-O7VPNKYN.js';
+import '../chunk-GTILM2CI.js';
+import '../chunk-QVNRCDTV.js';
 import '../chunk-ICSCSM5D.js';
-import '../chunk-JMKB7IB4.js';
+import '../chunk-UMVKJM4Q.js';
 import '../chunk-MJHSLODD.js';
 import '../chunk-C3CAXQMA.js';
 import '../chunk-BOFL7GIF.js';

package/dist/asset-manager/renderers.js

@@ -1,20 +1,20 @@
-export { AGENT_RENDERERS, CODEX_IDENTITY_DIR, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-AVCUPPG6.js';
-import '../chunk-FRHE7FFB.js';
-import '../chunk-OOLT6HGP.js';
+export { AGENT_RENDERERS, CODEX_IDENTITY_DIR, claudeCodeRenderer, codexRenderer, driverTargetSupportsAgents, ompRenderer, renderAgentToFramework } from '../chunk-EF7NPDDU.js';
+import '../chunk-B6GIW55K.js';
+import '../chunk-36AFURKZ.js';
 import '../chunk-4GY63JU6.js';
-import '../chunk-SWO25LTO.js';
-import '../chunk-G67BOI2J.js';
+import '../chunk-GB7WDMH2.js';
+import '../chunk-PMECEZK3.js';
 import '../chunk-5BEFNLOR.js';
 import '../chunk-A2ULN3KX.js';
-import '../chunk-LCU5U5IW.js';
+import '../chunk-JAKOMFC6.js';
 import '../chunk-L5VSIPQD.js';
 import '../chunk-CPSIPIX7.js';
-import '../chunk-RVIZQ5XD.js';
+import '../chunk-BTE2V4IW.js';
 import '../chunk-RVRB27AN.js';
-import '../chunk-TTPSDC2G.js';
-import '../chunk-O7VPNKYN.js';
+import '../chunk-GTILM2CI.js';
+import '../chunk-QVNRCDTV.js';
 import '../chunk-ICSCSM5D.js';
-import '../chunk-JMKB7IB4.js';
+import '../chunk-UMVKJM4Q.js';
 import '../chunk-MJHSLODD.js';
 import '../chunk-C3CAXQMA.js';
 import '../chunk-BOFL7GIF.js';