@skaile/workspaces 6.1.0 → 6.3.0

package/dist/{chunk-HWNK3F3X.js → chunk-KGHYXXXV.js}

@@ -1,20 +1,20 @@
-import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, filesEntryPaths, lastLibraryName } from './chunk-S2XHGWQC.js';
-import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-UI745XC3.js';
+import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-Y3I4KGLX.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-XEVFSDIF.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
-import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, assertNoLibrarySymlinks, deployAll, removeAsset, sourceComposedFiles, cachedComposedFiles, createScaffold, installAgent } from './chunk-NUA33BYO.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, assertNoLibrarySymlinks, deployAll, removeAsset, composedDriftRefs, sourceComposedFiles, cachedComposedFiles, createScaffold, installAgent } from './chunk-MYXFR27L.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-ABFPSVIS.js';
-import { isScaffoldBody, isScaffoldDescription } from './chunk-E572OHGY.js';
-import { resolveConfiguredHarnessName, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-VMVDAZLA.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-ZDLUQLI6.js';
+import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-LD6O6QKU.js';
+import { isScaffoldBody, isScaffoldDescription } from './chunk-76FLBODK.js';
+import { resolveConfiguredHarnessName, FACTORY_SOURCE_URL, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-J5JRGBKK.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-6WH2WE4B.js';
 import { deployedBase, isDeployed, deployedPaths, deployedDir } from './chunk-5KRMNUL4.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-ZHGKAZJ7.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-XBQTXGY4.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { HARNESS_TARGETS, SUPPORTED_HARNESSES } from './chunk-VTETQCR6.js';
-import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-ZBHZLWV3.js';
-import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-RHN5MRQO.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-LSSYC5IC.js';
+import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-KPKGWXUJ.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-JMIKGAUA.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-IZQOO6MN.js';
 import { spawnSync } from 'child_process';
 import { existsSync, rmSync, readFileSync, writeFileSync, readdirSync, lstatSync, statSync, unlinkSync, mkdirSync } from 'fs';
 import { homedir } from 'os';
@@ -902,6 +902,10 @@ var libraryAssetCheck;
 function setLibraryAssetCheck(check) {
   libraryAssetCheck = check;
 }
+var renamedEntryLookup;
+function setRenamedEntryLookup(lookup) {
+  renamedEntryLookup = lookup;
+}
 function isUnlistedLibraryAsset(entry, libPath) {
   const manifest = loadSkPublishManifest(libPath);
   const listed = manifest?.assets ?? [];
@@ -1100,6 +1104,13 @@ function parseCanonicalLockKey(key) {
     };
   }
 }
+function labelDiffHeaders(diff, from, to) {
+  const stamp = "\\t(?:\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)? [+-]\\d{4}|[A-Z][a-z]{2} [A-Z][a-z]{2} [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4})";
+  return diff.replace(
+    new RegExp(`^(---|\\+\\+\\+) (.*?)${stamp}$`, "gm"),
+    (_m, mark, file) => `${mark} ${file} (${mark === "---" ? from : to})`
+  );
+}
 function softDepName(ref) {
   const at = ref.lastIndexOf("@");
   const base = at > 0 ? ref.slice(0, at) : ref;
@@ -1190,6 +1201,9 @@ function relockedRefs(prev, next) {
   }
   return out;
 }
+function planPaths(folders, renders, files) {
+  return renders.length > 0 ? { folders: [], files: [], renders } : { folders, files, renders: [] };
+}
 function libraryMoves(prev, next) {
   if (!prev) return [];
   const out = [];
@@ -1303,7 +1317,6 @@ function isSymlink(p) {
     return false;
   }
 }
-var FACTORY_SOURCE_URL = "https://github.com/skaile-ai/ai-assets";
 function resolveFactoryAssetsDir() {
   for (const dir of factoryAssetRoots()) {
     if (existsSync(join(dir, "skaile.manifest.yaml"))) return dir;
@@ -1554,6 +1567,78 @@ var AssetManager = class {
     else raw[ENTRY_HARNESSES_KEY] = rows;
     return true;
   }
+  /** The harness row of `kind:name` (publisher must agree when both sides have one) in the parsed `raw`. */
+  harnessRowIn(raw, id) {
+    const wantPub = id.publisher?.replace(/^@/, "");
+    for (const [key, harnesses] of Object.entries(decodeEntryHarnesses(raw[ENTRY_HARNESSES_KEY]))) {
+      const other = parseAssetRefLoose(key);
+      if (!other || other.kind !== id.kind || other.name !== id.name) continue;
+      const havePub = other.publisher?.replace(/^@/, "");
+      if (wantPub === void 0 || havePub === void 0 || havePub === wantPub) return harnesses;
+    }
+    return void 0;
+  }
+  /**
+   * The harness row `add --global --harness <requested>` leaves for `ref`: the recorded set plus
+   * `requested`. An asset declared with no row goes to every global harness, so its set is that
+   * default; `undefined` (no row) when `requested` is already part of it. A new asset gets
+   * `requested` alone.
+   */
+  widenedHarnessRow(raw, ref, requested, declared) {
+    const id = parseAssetRefLoose(ref);
+    if (!id) return [...requested];
+    const recorded = this.harnessRowIn(raw, id);
+    if (!recorded && !declared) return [...requested];
+    const current = recorded ?? this.defaultGlobalHarnesses();
+    const union = [.../* @__PURE__ */ new Set([...current, ...requested])];
+    if (!recorded && union.length === current.length) return void 0;
+    return union;
+  }
+  /**
+   * After `add --global --harness X`: widen the row of every other entry of the add that has one
+   * (a requirement declared on its own with `--harness`), so the copy now deployed into X stays
+   * managed. Entries with no row already go to every harness.
+   */
+  widenDependencyRows(entries, requested) {
+    const named = this.harnessesOverride;
+    if (!this.global || !named?.length) return;
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return;
+    const raw = parse(readFileSync(configPath, "utf8")) ?? {};
+    let changed = false;
+    for (const e of entries) {
+      if (!e.name || e.kind === requested.kind && e.name === requested.name) continue;
+      const recorded = this.harnessRowIn(raw, e);
+      if (!recorded) continue;
+      const union = [.../* @__PURE__ */ new Set([...recorded, ...named])];
+      if (union.length === recorded.length) continue;
+      const publisher = e.publisher?.replace(/^@/, "");
+      const ref = `${e.kind}:${publisher ? `@${publisher}/` : ""}${e.name}`;
+      if (this.setEntryHarnessRow(raw, ref, union)) changed = true;
+    }
+    if (changed) writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+  }
+  /**
+   * `add --global --harness X --only`: name each harness that leaves the asset's set but still
+   * holds a copy. The copy stays on disk; `remove --global --harness <h>` deletes it.
+   */
+  reportDroppedCopies(target, onDropped) {
+    const named = this.harnessesOverride;
+    const component = this.installTarget(target.kind);
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!named?.length || !component || !existsSync(configPath)) return;
+    const raw = parse(readFileSync(configPath, "utf8")) ?? {};
+    const publisher = target.publisher?.replace(/^@/, "");
+    const ref = `${target.kind}:${publisher ? `@${publisher}/` : ""}${target.name}`;
+    const declared = Array.isArray(raw.dependencies) && raw.dependencies.some((d) => this.sameDeclaredAsset(d, ref));
+    if (!declared) return;
+    const current = this.harnessRowIn(raw, target) ?? this.defaultGlobalHarnesses();
+    for (const h of current) {
+      if (named.includes(h) || !isDeployed(component, target.name, h, true)) continue;
+      const where = deployedPaths(component, target.name, h, true)[0];
+      onDropped(ref, h, where ?? deployedDir(component, target.name, h, true));
+    }
+  }
   /**
    * Delete the copies a 5.12.0 global install left in `~/.omp/skills`, `~/.omp/agents`,
    * `~/.omp/prompts` and `~/.omp/contracts` (omp reads `~/.omp/agent/<dir>`) for the assets just
@@ -1893,7 +1978,7 @@ var AssetManager = class {
         );
         continue;
       }
-      const commit = getRepoCommit(localPath) ?? "0".repeat(40);
+      const commit = decl.factory ? "0".repeat(40) : getRepoCommit(localPath) ?? "0".repeat(40);
       clones.push({
         localPath,
         sourceUrl: decl.url ?? localPath,
@@ -3011,6 +3096,29 @@ var AssetManager = class {
     }
     return { entries, missing, viaStore };
   }
+  /**
+   * Whether a library-origin lock entry was restored from its lock url: its library is not
+   * registered here, and the project's store cache holds the locked version (`install --locked`
+   * fetched and SHA-verified it there against the sha256 the lock recorded). Such an entry is
+   * as restorable as a source- or store-origin one: `check` and `doctor` read its requirements
+   * from the deployed copy and do not ask for the library (OQ8, p1655). An unregistered library
+   * that never restored anything here stays a gap.
+   */
+  async restoredFromLockUrl(key, entry, snap) {
+    const origin = entry.library;
+    if (!origin || origin.installed || !origin.sha256 || !origin.version) return false;
+    if (isPseudoVersion(origin.version)) return false;
+    const { publisher, kind, name } = parseCanonicalLockKey(key);
+    if (!publisher || !kind || !name) return false;
+    if (this.lockedLibrary(origin, snap, { kind, publisher, name }).state !== "unregistered") {
+      return false;
+    }
+    try {
+      return readdirSync(join(this.storeCacheDir, publisher, kind, name, origin.version)).length > 0;
+    } catch {
+      return false;
+    }
+  }
   /**
    * The store's copy of a library-origin lock entry whose library is not registered here: a
    * store (project `stores:` or the global catalog) that serves `kind:@publisher/name#version`
@@ -3680,6 +3788,13 @@ var AssetManager = class {
         }
       });
       if (intact) {
+        const { restoreScriptModes } = await import('./library/index.js');
+        restoreScriptModes(
+          targetDir,
+          c.files.map(
+            (f) => root && f.path.startsWith(`${root}/`) ? f.path.slice(root.length + 1) : f.path
+          )
+        );
         staged.set(this.candidateKey(c), join(targetDir, this.stagedManifestRel(c)));
         continue;
       }
@@ -3972,6 +4087,14 @@ var AssetManager = class {
       lib.libraryOf
     );
     if (!opts?.force) this.assertNoUnrecordedAgentOverwrite(entries, prevLock, forceCommand);
+    if (!opts?.force) {
+      await this.assertNoHandEditsOverwritten(
+        entries,
+        prevLock,
+        withKeptLockEntries(freshLock, kept),
+        forceCommand
+      );
+    }
     const inferredHarnesses = this.inferLegacyHarnessSubsets(entries);
     const { removed, replaced } = this.reconcileRemovedAssets(
       resolved,
@@ -4010,9 +4133,12 @@ var AssetManager = class {
     let relocked = [];
     let moved = [];
     if (lockWanted) {
-      const lockData = this.withRenderedAgents(
-        withKeptLockEntries(freshLock, kept),
-        opts?.moveLibraries ? void 0 : prevLock
+      const lockData = this.withCopiedFiles(
+        this.withRenderedAgents(
+          withKeptLockEntries(freshLock, kept),
+          opts?.moveLibraries ? void 0 : prevLock
+        ),
+        prevLock
       );
       moved = libraryMoves(prevLock, libraryLock);
       const movedRefs = new Set(moved.map((m) => m.ref));
@@ -4403,6 +4529,50 @@ Nothing was changed. Copy what you need, or run \`${forceCommand}\` to delete th
 Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwrite the file.`
     );
   }
+  /**
+   * Stop a re-lock from replacing a hand edit of a deployed copy (OQ6, p1641): the asset is locked
+   * already, its library or source now holds other content (`next` re-locks it), and a deployed
+   * file differs from what the lock covers and from the new content. The deploy would replace
+   * the file without a word. Throws one error naming each file and changes nothing; `--force`
+   * (the caller skips this check) replaces them. An agent's rendered files are compared with the
+   * hashes the lock records. A file the new content brings back byte for byte loses nothing.
+   * Project mode only.
+   */
+  async assertNoHandEditsOverwritten(entries, prevLock, next, forceCommand) {
+    if (this.global || !prevLock) return;
+    const relocked = relockedRefs(prevLock, next).map((k) => parseCanonicalLockKey(k));
+    if (relocked.length === 0) return;
+    const opts = this.deployOptsFor(this.harness);
+    const lines = [];
+    for (const d of await this.lockedCopyDrift()) {
+      const id = parseCanonicalLockKey(d.key);
+      if (!relocked.some(
+        (r) => r.kind === id.kind && r.name === id.name && r.publisher === id.publisher
+      )) {
+        continue;
+      }
+      let files = d.modified;
+      if (!d.rendered) {
+        const component = id.kind ? this.installTarget(id.kind) : void 0;
+        if (!id.kind || !id.name || !component) continue;
+        const entry = entries.find((e) => e.kind === id.kind && e.name === id.name);
+        const differs = entry ? deployedAssetDrift(entry, opts)?.modified : void 0;
+        if (differs) files = files.filter((f) => differs.includes(f));
+        const dir = relative(
+          this.projectDir,
+          deployedDir(component, id.name, this.harness, this.global, this.projectDir)
+        ).split(sep).join("/");
+        files = files.map((f) => `${dir}/${f}`);
+      }
+      if (files.length > 0) lines.push(`${d.ref} (${files.join(", ")} was edited)`);
+    }
+    if (lines.length === 0) return;
+    throw new Error(
+      `Not re-locked: the new content would replace ${lines.length === 1 ? "a file" : "files"} you edited in the deployed copy:
+  ${lines.join("\n  ")}
+Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace them.`
+    );
+  }
   /**
    * Remove stale assets — those recorded in the old lock but absent from the
    * newly resolved set (`resolved` source candidates plus `keep`, the canonical
@@ -4707,6 +4877,28 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
     assertFlowsLoad([...resolved, ...library.entries], "installed");
     assertNoLibrarySymlinks([...resolved, ...library.entries], this.registry, repositories);
     const inferredHarnesses = this.inferLegacyHarnessSubsets([...resolved, ...library.entries]);
+    const composedPre = /* @__PURE__ */ new Set();
+    if (!this.global) {
+      for (const e of [...resolved, ...library.entries]) {
+        if (this.installTarget(e.kind) !== "agent") continue;
+        try {
+          for (const composeRef of composedDriftRefs(e, this.deployOptsFor(this.harness))) {
+            composedPre.add(this.composedDriftLine(canonicalEntryRef(e), composeRef));
+          }
+        } catch {
+        }
+      }
+    }
+    if (library.missing.length > 0 || composedPre.size > 0) {
+      return {
+        deployed: [],
+        removed: [],
+        missing: [...library.missing, ...composedPre],
+        lockWritten: false,
+        npmInstalled: [],
+        npmFailed: []
+      };
+    }
     const copyDrift = await this.lockedCopyDrift();
     const missingCopies = await this.incompleteDeploys();
     const unrecordedAgents = this.unrecordedAgentFiles(lock);
@@ -4737,13 +4929,17 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
         return p ? `${p.kind}:${p.name}` : m;
       })
     );
+    const viaStoreIds = new Set(library.viaStore.map(gapIdentity));
     const gaps = (await this.projectState()).gaps.filter((g) => {
       if (g.type === "agent") return false;
       if (g.unreadableSource) return false;
-      if (g.type === "library" && library.viaStore.includes(g.ref)) return false;
+      if ((g.type === "library" || g.type === "unresolved") && viaStoreIds.has(gapIdentity(g.ref))) {
+        return false;
+      }
       const p = parseRefTolerant(g.ref);
       return !(p && alreadyMissing.has(`${p.kind}:${p.name}`));
     }).map((g) => g.message);
+    const libraryNotices = this.lockUrlRestoreNotices(lock, library.viaStore);
     const placeholderBodies = scaffoldBodyRefs(library.entries, deployed);
     const placeholderDescriptions = scaffoldDescriptionRefs(library.entries, deployed);
     return {
@@ -4756,9 +4952,30 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
       ...inferredHarnesses.length > 0 ? { inferredHarnesses } : {},
       ...restored.length > 0 ? { restored } : {},
       ...rewritten.length > 0 ? { rewritten } : {},
+      ...libraryNotices.length > 0 ? { libraryNotices } : {},
       ...agentRender
     };
   }
+  /**
+   * One notice line per locked library that is not registered here and whose assets
+   * `install --locked` restored from the lock url: names the library, how many assets came from
+   * the url, and how to register the library to move the lock later (OQ8, p1655).
+   */
+  lockUrlRestoreNotices(lock, viaStore) {
+    const byLibrary = /* @__PURE__ */ new Map();
+    for (const key of viaStore) {
+      const origin = lock.assets[key]?.library;
+      if (!origin) continue;
+      const name = unregisteredLibraryName(origin);
+      const row = byLibrary.get(name) ?? { ...origin.url ? { url: origin.url } : {}, refs: [] };
+      row.refs.push(key);
+      byLibrary.set(name, row);
+    }
+    return [...byLibrary].map(([name, { url, refs }]) => {
+      const register = url ? `skaile library init ${name} --git ${url}` : `skaile library init ${name} --path <dir>`;
+      return `Library "${name}" is not registered here: restored ${refs.length} asset${refs.length === 1 ? "" : "s"} from the lock url${url ? ` ${url}` : ""}. Register it with \`${register}\` to move the lock later.`;
+    });
+  }
   /**
    * The versions of `parsed`'s name that a source, a library or a store holds, newest first,
    * for the `Asset not found` of a pinned ref. Empty for an unpinned ref (nothing was ruled
@@ -4800,6 +5017,40 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
     }
     return found;
   }
+  /**
+   * The `Did you mean agent:@pub/name?` sentence for a ref written without a kind (`@pub/name`,
+   * which means `skill`) that names no asset: the refs of other kinds under the same name that
+   * a source, a library, the lock or `skaile.yaml` holds (p1425). `undefined` when the ref has a
+   * kind or nothing of another kind answers to it. `add`, `diff`, `update`, `info`, `remove` and
+   * `why` end their not-found line with it.
+   */
+  async otherKindHint(ref) {
+    if (/^[^@/#\s]+:/.test(ref.trim())) return void 0;
+    const parsed = parseRefTolerant(ref);
+    if (!parsed) return void 0;
+    const wantPublisher = parsed.publisher?.replace(/^@/, "");
+    const found = new Set(await this.otherKindRefs(parsed));
+    const note = (id) => {
+      if (!id.kind || !id.name || id.kind === parsed.kind || id.name !== parsed.name) return;
+      const publisher = id.publisher?.replace(/^@/, "");
+      if (wantPublisher && publisher !== wantPublisher) return;
+      found.add(
+        assetRefToStr({ kind: id.kind, name: id.name, ...publisher ? { publisher } : {} })
+      );
+    };
+    for (const key of Object.keys(this.tryReadLock()?.assets ?? {})) {
+      note(parseCanonicalLockKey(key));
+    }
+    try {
+      for (const dep of resolveSkWorkspaceConfig(this.projectDir).dependencies ?? []) {
+        if (typeof dep === "string") note(parseRefTolerant(dep) ?? {});
+      }
+    } catch {
+    }
+    const refs = [...found].sort();
+    if (refs.length === 0) return void 0;
+    return refs.length === 1 ? `Did you mean ${refs[0]}?` : `Did you mean one of: ${refs.join(", ")}?`;
+  }
   /**
    * What `add` would deploy for the resolved candidates and library entries, without touching
    * the project: one item per asset with its origin, version, deploy folders and files.
@@ -4807,15 +5058,26 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
   planAddItems(resolved, lib, stores, parsed) {
     const storeUrls = new Set(stores.map((s) => normalizeRepoUrl(s.url)));
     const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
+    const shownPath = (dir) => {
+      const rel = relative(this.projectDir, dir);
+      return this.global || rel.startsWith("..") ? dir.replace(homedir(), "~") : `${rel}${dir.endsWith(sep) ? sep : ""}`;
+    };
     const folders = (kind, name) => {
       const component = this.installTarget(kind);
       if (!component) return [];
-      return this.targetHarnesses().map((t) => {
-        const dir = deployedDir(component, name, t, this.global, this.projectDir);
-        const rel = relative(this.projectDir, dir);
-        const shown = this.global || rel.startsWith("..") ? dir.replace(homedir(), "~") : `${rel}${dir.endsWith(sep) ? sep : ""}`;
-        return shown;
-      });
+      return this.targetHarnesses().map(
+        (t) => shownPath(deployedDir(component, name, t, this.global, this.projectDir))
+      );
+    };
+    const renders = (kind, name) => {
+      if (this.installTarget(kind) !== "agent") return [];
+      return this.targetHarnesses().flatMap(
+        (t) => agentRenderFiles(
+          t,
+          dirname(deployedDir("agent", name, t, this.global, this.projectDir)),
+          name
+        ).map(shownPath)
+      );
     };
     const asked = (kind, name, publisher) => kind === parsed.kind && name === parsed.name && (!parsed.publisher || (publisher ?? "").replace(/^@/, "") === parsed.publisher.replace(/^@/, ""));
     const items = [];
@@ -4830,19 +5092,22 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
         version: c.version,
         origin: storeUrls.has(url) ? `store ${c.sourceUrl}` : url === factoryUrl ? "factory" : `source ${sourceShortName(c.sourceUrl)}`,
         requested: asked(c.kind, c.name, c.publisher),
-        folders: folders(c.kind, c.name),
-        files: c.files.map((f) => f.path)
+        ...planPaths(
+          folders(c.kind, c.name),
+          renders(c.kind, c.name),
+          c.files.map((f) => f.path)
+        )
       });
     }
     for (const e of lib.entries) {
       const id = this.entryIdentity(e);
       items.push({
-        ref: canonicalEntryRef(e),
+        // The ref is printed once: `canonicalEntryRef` carries the version as a pin, `version` has it.
+        ref: canonicalEntryRef(e).replace(/#.*$/, ""),
         version: e.version ?? "",
         origin: `library ${lib.libraryOf.get(e) ?? ""}`.trim(),
         requested: asked(e.kind, e.name, id.publisher),
-        folders: folders(e.kind, e.name),
-        files: [...e.files ?? []]
+        ...planPaths(folders(e.kind, e.name), renders(e.kind, e.name), [...e.files ?? []])
       });
     }
     return items.sort((a, b) => Number(b.requested) - Number(a.requested));
@@ -4982,6 +5247,25 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
           );
         }
       }
+      if (renamedEntryLookup) {
+        for (const l of snap?.libraries ?? []) {
+          const libPath = this.libraryPath({ name: l.name }, snap);
+          if (!libPath) continue;
+          const renamed = renamedEntryLookup(libPath).find(
+            (r) => r.kind === parsed.kind && r.name === parsed.name && (!parsed.publisher || bare(r.publisher) === bare(parsed.publisher))
+          );
+          if (renamed) {
+            const shown = renamed.publisher ? assetRefToStr({
+              kind: renamed.kind,
+              name: renamed.name,
+              publisher: bare(renamed.publisher)
+            }) : `${renamed.kind}:${renamed.name}`;
+            throw new Error(
+              `${shown}: ${renamed.file} now names "${renamed.now}", so the library entry is a ref \`add\` cannot resolve. Run \`skaile library index ${l.name}\` to rename the entry, or restore the name.`
+            );
+          }
+        }
+      }
       const unreachable = [...this.storeFailures.values()];
       if (unreachable.length > 0) {
         throw new Error(
@@ -4989,9 +5273,13 @@ Nothing was changed. Move your edits away, or run \`${forceCommand}\` to overwri
         );
       }
       const available = await this.availableVersions(parsed, stores);
-      const otherKinds = /^[^@/#\s]+:/.test(ref.trim()) ? [] : await this.otherKindRefs(parsed);
+      const otherKind = await this.otherKindHint(ref);
+      const others = missing.filter((m) => {
+        const id = parseRefTolerant(m);
+        return !(id && id.kind === parsed.kind && id.name === parsed.name && (id.publisher ?? "") === (parsed.publisher ?? ""));
+      });
       throw new Error(
-        `Asset not found: ${ref}${(await this.publisherChangeHints([ref]))[ref] ?? ""}${missing.length ? ` (missing: ${missing.join(", ")})` : ""}${available.length ? `; ${parsed.name} has version(s): ${available.join(", ")}` : ""}` + (otherKinds.length === 0 ? "" : otherKinds.length === 1 ? `. Did you mean ${otherKinds[0]}?` : `. Did you mean one of: ${otherKinds.join(", ")}?`)
+        `Asset not found: ${ref}${(await this.publisherChangeHints([ref]))[ref] ?? ""}${others.length ? ` (missing: ${others.join(", ")})` : ""}${available.length ? `; ${parsed.name} has version(s): ${available.join(", ")}` : ""}` + (otherKind ? `. ${otherKind}` : "")
       );
     }
     if (parsed.kind === "preset" && missing.length > 0) {
@@ -5114,6 +5402,14 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
     assertFlowsLoad(entries, "added");
     assertNoLibrarySymlinks(entries, this.registry, repositories, opts?.link === true);
+    if (!opts?.force && !this.global && (resolved.length > 0 || lib.entries.length > 0)) {
+      await this.assertNoHandEditsOverwritten(
+        entries,
+        this.tryReadLock(),
+        buildLockFile(resolved, overridesApplied, await this.libraryLockEntries(lib)),
+        opts?.preferLockedLibrary ? "skaile update --force" : `skaile add ${ref} --force`
+      );
+    }
     if (parsed.kind === "mcp-server" && !this.global) {
       const decls = await loadMcpServerDeclarations(this.projectDir, { alsoDeclared: [ref] });
       const mine = decls.find(
@@ -5126,11 +5422,14 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         );
       }
     }
+    const harnessNamed = this.global && (this.harnessesOverride?.length ?? 0) > 0;
+    if (harnessNamed && opts?.only && opts.onDroppedCopy)
+      this.reportDroppedCopies(parsed, opts.onDroppedCopy);
     const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
           (t) => deployAll(
-            this.entriesForHarness(entries, t),
+            harnessNamed ? entries : this.entriesForHarness(entries, t),
             repositories,
             patches,
             this.deployOptsFor(t, opts?.link, opts?.onSecretFile, {
@@ -5157,7 +5456,8 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     for (const placeholder of scaffoldDescriptionRefs(lib.entries, deployed)) {
       opts?.onPlaceholderDescription?.(placeholder);
     }
-    this.addDependencyToConfig(ref);
+    this.addDependencyToConfig(ref, opts?.only === true);
+    this.widenDependencyRows(entries, parsed);
     await this.renderHarnessMcpConfig();
     await this.renderAgentInstances();
     if (resolved.length > 0 || lib.entries.length > 0) {
@@ -5172,7 +5472,9 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       }
       writeLock(
         this.lockPath,
-        this.withInstanceRenderings(mergeLockFile(prevLock, this.withRenderedAgents(fresh)))
+        this.withInstanceRenderings(
+          mergeLockFile(prevLock, this.withCopiedFiles(this.withRenderedAgents(fresh), prevLock))
+        )
       );
     }
     for (const d of deployed) {
@@ -5562,6 +5864,25 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       return kind ? { kind, name } : null;
     }
   }
+  /**
+   * The refs among `refs` (`skill:@publisher/name`, `skill:name`, with or without `#version`)
+   * that are not deployed for this manager's harnesses and scope, judged as `check` judges a
+   * requirement. A ref that does not parse or names a kind this build does not install is
+   * never reported. `run <flow> --dry-run` names the node skills a flow still lacks (p1757).
+   */
+  undeployedSkills(refs) {
+    const out = [];
+    for (const ref of refs) {
+      const parsed = parseRefTolerant(ref);
+      if (!parsed) continue;
+      const component = this.installTarget(parsed.kind);
+      if (!component) continue;
+      if (!isDeployed(component, parsed.name, this.harness, this.global, this.projectDir)) {
+        out.push(ref);
+      }
+    }
+    return out;
+  }
   /**
    * The reverse guard of {@link removeWithDependencies}: which other locked assets (and
    * declared presets) require `target`. Their requirements are read the way {@link lockedGraph}
@@ -5935,18 +6256,18 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
   }
   /**
    * Tracked assets (`skaile.lock.yaml` or declared in `skaile.yaml`) whose copy
-   * still sits in the project's `.claude/…` dirs although this manager deploys
-   * to another harness. Before the default followed the configured harness every
-   * project deployed to `.claude/`, so an omp/codex project upgraded from then
-   * holds orphans there that `remove` / `clean` / `list` no longer look at.
+   * still sits in the project dirs of another harness (`.claude/…`, `.omp/…`,
+   * `.codex/…`) although this manager deploys to {@link AssetManager.harness}.
+   * A project that moved with `skaile harness set` holds orphans there that
+   * `remove` / `clean` / `list` no longer look at.
    *
-   * Read-only: nothing is deleted. Empty for `claude-code`, for global mode, and
-   * for kinds whose dir is shared with the active target (flows).
+   * Read-only: nothing is deleted. Empty for global mode and for kinds whose
+   * dir is shared with the active target (flows).
    *
-   * @returns One {@link LegacyDeployedAsset} per stale copy, sorted by kind then name.
+   * @returns One {@link StaleHarnessCopy} per stale copy, sorted by harness, kind, then name.
    */
-  listLegacyClaudeDeployed() {
-    if (this.global || this.harness === "claude-code") return [];
+  listStaleHarnessCopies() {
+    if (this.global) return [];
     const tracked = /* @__PURE__ */ new Map();
     const track = (kind, name) => {
       const component = kind ? this.installTarget(kind) : void 0;
@@ -5972,20 +6293,34 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     } catch {
     }
     const out = [];
-    for (const { kind, name, component: k } of tracked.values()) {
-      const legacy = deployedDir(k, name, "claude-code", false, this.projectDir);
-      if (legacy === deployedDir(k, name, this.harness, false, this.projectDir)) continue;
-      const found = deployedPaths(k, name, "claude-code", false, this.projectDir).find((p) => {
-        try {
-          lstatSync(p);
-          return true;
-        } catch {
-          return false;
+    for (const other of SUPPORTED_HARNESSES) {
+      if (other === this.harness) continue;
+      for (const { kind, name, component: k } of tracked.values()) {
+        if (deployedDir(k, name, other, false, this.projectDir) === deployedDir(k, name, this.harness, false, this.projectDir)) {
+          continue;
         }
-      });
-      if (found) out.push({ kind, name, path: found });
+        const found = deployedPaths(k, name, other, false, this.projectDir).find((p) => {
+          try {
+            lstatSync(p);
+            return true;
+          } catch {
+            return false;
+          }
+        });
+        if (found) out.push({ harness: other, kind, name, path: found });
+      }
     }
-    return out.sort((a, b) => a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name));
+    return out.sort(
+      (a, b) => a.harness.localeCompare(b.harness) || a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name)
+    );
+  }
+  /**
+   * @deprecated Use {@link AssetManager.listStaleHarnessCopies}, which covers every
+   * other harness folder. This returns only its `.claude/` rows (the old default
+   * deploy dir), in the old shape.
+   */
+  listLegacyClaudeDeployed() {
+    return this.listStaleHarnessCopies().filter((c) => c.harness === "claude-code").map(({ kind, name, path: path2 }) => ({ kind, name, path: path2 }));
   }
   /**
    * List the **declared** top-level dependencies from `skaile.yaml`, each tagged
@@ -6922,8 +7257,10 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         };
       }
     }
-    const entry = await this.lockedLibraryEntry(parsed) ?? this.lockedSourceEntry(parsed) ?? await this.info(ref);
+    const libraryEntry = await this.lockedLibraryEntry(parsed);
+    const entry = libraryEntry ?? this.lockedSourceEntry(parsed) ?? await this.info(ref);
     if (!entry || !existsSync(entry.source)) return { status: "not-found" };
+    const toLabel = libraryEntry ? "library" : "source";
     const wantPublisher = parsed.publisher?.replace(/^@/, "");
     if (wantPublisher) {
       const lockedHere = Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey).filter((id) => id.kind === parsed.kind && id.name === parsed.name);
@@ -6941,7 +7278,11 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         parts.push(diffDeployedAgent(entry, opts, inst));
       }
       if (parts.every((d) => d === null)) return { status: "not-deployed" };
-      const diff = parts.filter((d) => d !== null).join("");
+      const diff = labelDiffHeaders(
+        parts.filter((d) => d !== null).join(""),
+        "deployed",
+        "rendered"
+      );
       return diff === "" ? { status: "identical" } : { status: "differs", diff };
     }
     const deployedPath = join(
@@ -6962,7 +7303,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         );
       }
     }
-    return diffs.length > 0 ? { status: "differs", diff: diffs.join("") } : { status: "identical" };
+    return diffs.length > 0 ? { status: "differs", diff: labelDiffHeaders(diffs.join(""), "deployed", toLabel) } : { status: "identical" };
   }
   /**
    * The agent instances of `skaile.yaml` whose `ref` names `want` (an `agent:` ref, matched on
@@ -7022,6 +7363,10 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     for (const [key, entry] of Object.entries(lockData.assets)) {
       const rendered = prior?.assets[key]?.rendered;
       if (rendered) entry.rendered = rendered;
+      const copied = prior?.assets[key]?.copied;
+      if (copied && prior?.assets[key]?.library?.sha256 === entry.library?.sha256) {
+        entry.copied = copied;
+      }
       const composed = prior?.assets[key]?.composed;
       if (composed) entry.composed = composed;
     }
@@ -7137,15 +7482,30 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       const { kind, name, publisher } = parseCanonicalLockKey(key);
       if (kind && name && publisher) lockedPublisher[`${kind}:${name}`] = publisher;
     }
+    let librarySnap;
     for (const entry of deployed) {
       const publisher = lockedPublisher[`${entry.kind}:${entry.name}`];
       const full = await this.info(
         publisher ? `${entry.kind}:@${publisher}/${entry.name}` : `${entry.kind}:${entry.name}`
       );
-      const restorable = !full && publisher !== void 0 && Object.entries(lock?.assets ?? {}).some(([key, e]) => {
-        const id = parseCanonicalLockKey(key);
-        return e.source !== void 0 && id.kind === entry.kind && id.name === entry.name && id.publisher === publisher;
-      });
+      let restorable = false;
+      if (!full && publisher !== void 0) {
+        for (const [key, e] of Object.entries(lock?.assets ?? {})) {
+          const id = parseCanonicalLockKey(key);
+          if (id.kind !== entry.kind || id.name !== entry.name || id.publisher !== publisher) {
+            continue;
+          }
+          if (e.source !== void 0) {
+            restorable = true;
+            break;
+          }
+          librarySnap ??= { snap: await this.loadLibraryIndex() };
+          if (await this.restoredFromLockUrl(key, e, librarySnap.snap)) {
+            restorable = true;
+            break;
+          }
+        }
+      }
       if (!full && !restorable) {
         if (publisher) {
           const canonical = `${entry.kind}:@${publisher}/${entry.name}`;
@@ -7328,7 +7688,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       return want !== null && gaps.some((g) => g.type === "library" && sameAsset(g.ref, want));
     };
     gaps = gaps.filter((g) => !(g.type === "requires" && libraryHeld(g.ref)));
-    for (const gap of this.undeployedLockGaps(lock, named)) {
+    for (const gap of await this.undeployedLockGaps(lock, named)) {
       gaps.push(gap);
       named.add(gapIdentity(gap.ref));
     }
@@ -7350,7 +7710,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         }),
         ...d.extra.map((f) => `${f} is not part of the asset`)
       ];
-      const reason = `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
+      const reason = d.libraryChanged ? `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 the library holds other content now: copy your edit away, then run \`skaile update --force\` to replace it` : `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
       gaps.push({ type: "modified", ref: d.ref, reason, message: `${d.ref} ${reason}` });
       named.add(gapIdentity(d.ref));
     }
@@ -7404,6 +7764,22 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       )
     };
   }
+  /**
+   * The first `../` compose folder of the locked library agent `kind:name` whose library copy
+   * changed since the lock, or `undefined` (project scope only). `install --locked` cannot
+   * restore such an agent; `update` moves the lock to the library's copy.
+   */
+  async lockedComposeDrift(lock, kind, name) {
+    if (this.global) return void 0;
+    const { entries } = await this.restoreLibraryLockEntries(lock);
+    const entry = entries.find((x) => x.kind === kind && x.name === name);
+    if (!entry) return void 0;
+    try {
+      return composedDriftRefs(entry, this.deployOptsFor(this.harness))[0];
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Why the `agent:` ref of agent instance `id` binds to nothing, as the phrase that follows
    * the ref in a {@link LockGap}; see {@link AssetManager.unboundAgentAdvice}.
@@ -7427,6 +7803,15 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       return k.kind === "agent" && k.name === parsedRef?.name && (!publisher || !k.publisher || k.publisher === publisher);
     });
     if (lockedAgentKey !== void 0) {
+      const lock = this.tryReadLock();
+      const locked = parseCanonicalLockKey(lockedAgentKey);
+      const composeRef = lock && locked.kind && locked.name ? await this.lockedComposeDrift(lock, locked.kind, locked.name) : void 0;
+      if (composeRef) {
+        return {
+          lead: `its agent composes ${composeRef}, whose library copy changed since the lock`,
+          advice: `run \`skaile update\` (it moves the lock to the library's copy), ${drop}`
+        };
+      }
       const libraryFix = await this.lockedAgentLibraryHolds(lockedAgentKey) ? void 0 : (await this.unresolvedFixes([ref])).get(ref);
       if (libraryFix) {
         const register = libraryFix.replace(
@@ -7610,6 +7995,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         continue;
       }
       if (lookup.state === "unregistered") {
+        if (await this.restoredFromLockUrl(key, entry, snap)) continue;
         const reason2 = `is locked, but library "${unregisteredLibraryName(origin)}" is not registered (renamed or removed?) \u2014 ${unregisteredLibraryFix(origin, ref)}`;
         gaps.push({ type: "library", ref, reason: reason2, message: `${ref} ${reason2}`, manualFix: true });
         continue;
@@ -7653,11 +8039,13 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       if (!url || entry.library || !GIT_URL.test(url)) continue;
       if (inScope && !inScope.has(key)) continue;
       if (normalizeRepoUrl(url) === normalizeRepoUrl(FACTORY_SOURCE_URL)) continue;
-      const { publisher, kind, name } = parseCanonicalLockKey(key);
+      const { publisher, kind, name, version } = parseCanonicalLockKey(key);
       if (!publisher || !kind || !name) continue;
       if (registered.has(sourceCacheKey(url))) continue;
       const ref = `${kind}:@${publisher}/${name}`;
-      if (GITHUB_REPO_URL.test(url) && await this.storeListsRef(stores, ref, online)) continue;
+      const locked = version ? `${ref}#${version}` : void 0;
+      if (GITHUB_REPO_URL.test(url) && await this.storeListsRef(stores, ref, online, locked))
+        continue;
       const reason = `is locked, but its source ${url} is not in skaile.yaml sources: any more \u2014 register it again with \`skaile source add ${url}\`, or drop the dependency with \`skaile remove ${ref}\``;
       out.set(key, { type: "source", ref, reason, message: `${ref} ${reason}`, manualFix: true });
     }
@@ -7670,7 +8058,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    * air-gapped, `--no-catalog`) may hold the ref; `check` never asks, so a store lists only what
    * its cached catalog holds.
    */
-  async storeListsRef(stores, ref, online) {
+  async storeListsRef(stores, ref, online, lockedRef) {
     for (const store of stores) {
       try {
         if (this.injectedStoreFetcher) {
@@ -7679,9 +8067,12 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         }
         const remote = this.remoteStore(store.url);
         if (remote.holdsCached(ref)) return true;
-        if (!online) continue;
+        if (!online) {
+          if (lockedRef && remote.holdsCached(lockedRef)) return true;
+          continue;
+        }
         if (this.catalogUrlOverride === "") return true;
-        if (await remote.resolve(ref)) return true;
+        if (await (lockedRef ? remote.revalidate(lockedRef) : remote.resolve(ref))) return true;
       } catch {
         if (online) return true;
       }
@@ -7739,6 +8130,44 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     return out;
   }
+  /**
+   * Record, on every library-origin entry of `lock` that is copied into a harness folder, the
+   * files of the deployed copy and their sha256 (`LockEntry.copied`), so a hand edit is named
+   * even after the library moved past the lock (p1641). Call it after the deploy. An entry that
+   * is unchanged since `prev` keeps its record, or stays without one: the deployed bytes may
+   * carry an edit the deploy did not touch. Project mode only; a `--link` deploy and a patched
+   * asset are not recorded.
+   */
+  withCopiedFiles(lock, prev) {
+    if (this.global) return lock;
+    const { patches } = this.loadConfig();
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (!entry.library || entry.library.installed) continue;
+      const before = prev?.assets[key];
+      if (before && before.library?.sha256 === entry.library.sha256) {
+        if (before.copied) entry.copied = before.copied;
+        else delete entry.copied;
+        continue;
+      }
+      delete entry.copied;
+      const { kind, name } = parseCanonicalLockKey(key);
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!kind || !name || !component || component === "agent") continue;
+      if (patches[`${kind}:${name}`]) continue;
+      const dest = deployedDir(component, name, this.harness, this.global, this.projectDir);
+      try {
+        const st = lstatSync(dest);
+        if (st.isSymbolicLink() || !st.isDirectory()) continue;
+        const rows = listAssetFiles(dest).map((path2) => ({
+          path: path2,
+          sha256: computeHash(join(dest, path2))
+        }));
+        if (rows.length > 0) entry.copied = rows.sort((a, b) => a.path.localeCompare(b.path));
+      } catch {
+      }
+    }
+    return lock;
+  }
   /**
    * Record, on every agent entry of `lock` that has none, the files the agent's harness
    * rendering occupies and their sha256. Call it after the deploy, so the bytes hashed are the
@@ -7948,6 +8377,73 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     return out;
   }
+  /**
+   * Hand edits in the deployed copy of a library asset whose library moved past the lock (a
+   * version bump, or an in-place edit of the same version): {@link restoreLibraryLockEntries}
+   * drops such an entry, so {@link lockedCopyDrift} would not see the edit and `update` would
+   * replace the file without a word (p1641). `covered` holds the `kind:@publisher/name` of the
+   * entries that were compared already. The lock's per-file record (`copied:`) names the edited
+   * files; a lock without one (written before it existed) compares the deployed folder with the
+   * one library hash and names the files that also differ from the library's new content.
+   */
+  async changedLibraryCopyEdits(lock, covered, patches) {
+    const out = [];
+    let snap;
+    const fileSets = /* @__PURE__ */ new Map();
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      const origin = entry.library;
+      if (!origin || origin.installed) continue;
+      const { kind, name, publisher } = parseCanonicalLockKey(key);
+      if (!kind || !name || !publisher) continue;
+      const ref = `${kind}:@${publisher}/${name}`;
+      if (covered.has(ref) || patches[`${kind}:${name}`]) continue;
+      const component = this.installTarget(kind);
+      if (!component || component === "agent") continue;
+      const dest = deployedDir(component, name, this.harness, this.global, this.projectDir);
+      try {
+        const st = lstatSync(dest);
+        if (st.isSymbolicLink() || !st.isDirectory()) continue;
+      } catch {
+        continue;
+      }
+      let modified = [];
+      if (entry.copied && entry.copied.length > 0) {
+        for (const f of entry.copied) {
+          const file = join(dest, f.path);
+          if (!existsSync(file)) continue;
+          try {
+            if (computeHash(file) !== f.sha256) modified.push(f.path);
+          } catch {
+            modified.push(f.path);
+          }
+        }
+      } else if (origin.sha256) {
+        snap ??= await this.loadLibraryIndex();
+        const lookup = this.lockedLibrary(origin, snap, { kind, publisher, name });
+        if (lookup.state !== "ok") continue;
+        const found = (await scanDirectory(lookup.path, publisher, { knownKinds: this.knownKinds })).find((x) => x.kind === kind && x.name === name);
+        if (!found) continue;
+        const current = withLibraryFiles(found, lookup.path, fileSets, this.registry);
+        const assetRoot = statSync(current.source).isDirectory() ? current.source : dirname(current.source);
+        const hash = computeDeterministicHash(
+          dest,
+          listAssetFiles(dest),
+          posix.normalize(relative(lookup.path, assetRoot).split(sep).join("/"))
+        );
+        if (hash === origin.sha256) continue;
+        modified = deployedAssetDrift(current, {
+          registry: this.registry,
+          harness: this.harness,
+          global: this.global,
+          cwd: this.projectDir
+        })?.modified ?? [];
+      }
+      if (modified.length > 0) {
+        out.push({ ref, key, modified, extra: [], library: true, libraryChanged: true });
+      }
+    }
+    return out;
+  }
   /**
    * Locked assets whose deployed copy differs from the bytes the lock covers: a file edited by
    * hand, or a file the asset does not ship. One row per asset, `ref` being `kind:@publisher/name`
@@ -7991,6 +8487,15 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       const ref = `${e.kind}:@${(e.publisher ?? "").replace(/^@/, "")}/${e.name}`;
       out.push({ ref, key: keyOf.get(ref) ?? ref, ...drift, library: true });
     }
+    out.push(
+      ...await this.changedLibraryCopyEdits(
+        lock,
+        new Set(
+          entries.map((e) => `${e.kind}:@${(e.publisher ?? "").replace(/^@/, "")}/${e.name}`)
+        ),
+        patches
+      )
+    );
     for (const [key, entry] of Object.entries(lock.assets)) {
       if (!entry.source || entry.files.length === 0) continue;
       const { kind, name } = parseCanonicalLockKey(key);
@@ -8065,7 +8570,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    *
    * @param named - `kind:name` identities already reported; they are skipped.
    */
-  undeployedLockGaps(lock, named) {
+  async undeployedLockGaps(lock, named) {
     const gaps = [];
     for (const [key, entry] of Object.entries(lock?.assets ?? {})) {
       if (entry.library?.installed) continue;
@@ -8084,7 +8589,8 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         this.global,
         this.projectDir
       ).find((p) => isSymlink(p) && !existsSync(p));
-      const reason = dangling ? `is locked but its deployed copy is a symlink to nothing (${relative(this.projectDir, dangling)}) \u2014 run \`skaile install --locked\`` : "is locked but its deployed copy is missing \u2014 run `skaile install --locked`";
+      const composeDrift = component === "agent" && !dangling && lock ? await this.lockedComposeDrift(lock, kind, name) : void 0;
+      const reason = composeDrift ? `(composes ${composeDrift}: the library's copy changed since the lock; \`skaile update\` moves the lock to it)` : dangling ? `is locked but its deployed copy is a symlink to nothing (${relative(this.projectDir, dangling)}) \u2014 run \`skaile install --locked\`` : "is locked but its deployed copy is missing \u2014 run `skaile install --locked`";
       gaps.push({ type: "drift", ref, reason, message: `${ref} ${reason}` });
     }
     return gaps;
@@ -8474,20 +8980,26 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    * user-scope SSOT `~/.skaile/skaile.yaml`, **bootstrapping** the file (and its
    * parent dir) when absent so `skaile add --global` works on a fresh machine.
    */
-  addDependencyToConfig(ref) {
+  addDependencyToConfig(ref, only = false) {
     const configPath = join(this.stateRoot, "skaile.yaml");
-    const limit = this.global && this.harnessesOverride?.length ? this.harnessesOverride : void 0;
+    const requested = this.global && this.harnessesOverride?.length ? this.harnessesOverride : void 0;
     if (!existsSync(configPath)) {
       if (!this.global) return;
       mkdirSync(this.stateRoot, { recursive: true });
       const fresh = { dependencies: [ref] };
-      if (limit) this.setEntryHarnessRow(fresh, ref, limit);
+      if (requested) this.setEntryHarnessRow(fresh, ref, requested);
       writeFileSync(configPath, stringify(fresh, { lineWidth: 120 }));
       return;
     }
     const raw = parse(readFileSync(configPath, "utf8")) ?? {};
     if (!Array.isArray(raw.dependencies)) raw.dependencies = [];
     const deps = raw.dependencies;
+    const limit = requested ? only ? requested : this.widenedHarnessRow(
+      raw,
+      ref,
+      requested,
+      deps.some((d) => this.sameDeclaredAsset(d, ref))
+    ) : void 0;
     const limitChanged = this.global ? this.setEntryHarnessRow(raw, ref, limit) : false;
     if (deps.includes(ref) && deps.filter((d) => this.sameDeclaredAsset(d, ref)).length === 1) {
       if (limitChanged) writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
@@ -8654,6 +9166,6 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
   }
 };
 
-export { AssetManager, FACTORY_SOURCE_URL, LibraryEntryError, MissingManifestError, installAgentInstances, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, setLibraryAssetCheck, softDepName };
-//# sourceMappingURL=chunk-HWNK3F3X.js.map
-//# sourceMappingURL=chunk-HWNK3F3X.js.map
+export { AssetManager, LibraryEntryError, MissingManifestError, installAgentInstances, labelDiffHeaders, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, setLibraryAssetCheck, setRenamedEntryLookup, softDepName };
+//# sourceMappingURL=chunk-KGHYXXXV.js.map
+//# sourceMappingURL=chunk-KGHYXXXV.js.map