@skaile/workspaces 6.4.0 → 6.6.0

package/dist/{chunk-TGB4E5Z6.js → chunk-JRVQV7WC.js}

@@ -1,24 +1,24 @@
-import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-GBXQFJ4G.js';
-import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-WENTJ5KP.js';
+import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-MMOWIRHP.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-J4WKNJHO.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
-import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, assertNoLibrarySymlinks, deployAll, removeAsset, composedDriftRefs, sourceComposedFiles, cachedComposedFiles, createScaffold, installAgent } from './chunk-YJNE4V2M.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, entriesNeedingDeploy, assertNoLibrarySymlinks, deployAll, removeAsset, composedDriftRefs, sourceComposedFiles, cachedComposedFiles, createScaffold, installAgent } from './chunk-DI6J2PJB.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-V4OXHEWY.js';
-import { isScaffoldBody, isScaffoldDescription } from './chunk-76FLBODK.js';
-import { resolveConfiguredHarnessName, FACTORY_SOURCE_URL, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-ABVWUM2E.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-3ENE6ZOF.js';
+import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-DS6UUCFG.js';
+import { isScaffoldBody, isScaffoldDescription } from './chunk-VT6G5AJV.js';
+import { resolveConfiguredHarnessName, FACTORY_SOURCE_URL, isFactoryMemorySource, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, LockParseError, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-6ARPZHOV.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-JIQUF3X2.js';
 import { deployedBase, isDeployed, deployedPaths, deployedDir } from './chunk-5KRMNUL4.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-6WQGJF65.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveSourcePublisher, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, DEFAULT_AGENT_INSTANCE_ID, MAX_PRESET_DEPTH, PresetDepthError } from './chunk-6SXSVKQY.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { HARNESS_TARGETS, SUPPORTED_HARNESSES } from './chunk-VTETQCR6.js';
-import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-U6S5CXKB.js';
-import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-VV2DJT4I.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-IZQOO6MN.js';
+import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-E2EC6SAX.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-GNUA7XT2.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-V5KG6CCV.js';
 import { spawnSync } from 'child_process';
-import { existsSync, rmSync, readFileSync, writeFileSync, readdirSync, lstatSync, statSync, unlinkSync, mkdirSync } from 'fs';
+import { existsSync, rmSync, readFileSync, writeFileSync, readdirSync, lstatSync, statSync, realpathSync, unlinkSync, mkdirSync } from 'fs';
 import { homedir } from 'os';
-import path, { resolve, dirname, sep, join, relative, posix } from 'path';
+import path, { resolve, dirname, sep, join, relative, isAbsolute, posix } from 'path';
 import { gt } from 'semver';
 import { parse, stringify } from 'yaml';
 import { createHash } from 'crypto';
@@ -821,6 +821,10 @@ function lockedAssetFiles(kind, files) {
   });
 }
 var GITHUB_REPO_URL = /github\.com[/:]/i;
+function isBundledFactoryEntry(entry) {
+  if (isFactoryMemorySource(entry.source)) return true;
+  return entry.origin === void 0 && entry.source !== void 0 && normalizeRepoUrl(entry.source.url) === normalizeRepoUrl(FACTORY_SOURCE_URL);
+}
 var GIT_URL = /^(?:[a-z][a-z0-9+.-]*:\/\/|[\w.-]+@[\w.-]+:)/i;
 function indexLockByKindName(lock) {
   const lockByKindName = /* @__PURE__ */ new Map();
@@ -1421,6 +1425,8 @@ var AssetManager = class {
   warnedStoreVersionLookups = /* @__PURE__ */ new Set();
   /** Stores a lookup could not reach (store URL -> one line why); `add` reports them instead of "not found". */
   storeFailures = /* @__PURE__ */ new Map();
+  /** Source origins `outdated` could not fetch; read once through {@link takeUnreachableSources}. */
+  unreachableSources = [];
   /** Store URLs a lookup failed on because the client is air-gapped (`cache_ttl: 0`), not because the store is down. */
   airGappedStores = /* @__PURE__ */ new Set();
   /** Sources a provenance walk had to skip (source URL → why); one warning per source. */
@@ -1522,13 +1528,38 @@ var AssetManager = class {
     });
   }
   /**
-   * A 5.12.0 global record has no `global_asset_harnesses:` key, yet `add --global --harness`
-   * wrote one copy only. On the first global `install`, an entry with exactly one existing copy
-   * among several default harnesses is that harness's subset (OQ6): record it, so the install
-   * does not fan the asset out to harnesses the user never asked for (p1442). A copy under the
-   * 5.12.0 omp folder (`~/.omp/skills`) counts as an omp copy. Nothing is inferred once the key
-   * exists (an entry without a row then means "every harness"), with one default harness, or
-   * with no copy yet. Global mode only; returns the rows written.
+   * The harness a 5.12.0 `add --global --harness omp` left as the asset's only copy: the copy sits
+   * under the 5.12.0 omp folder (`~/.omp/skills`) and no other default harness holds one. That
+   * folder is the only real 5.12.0 evidence: a current `add --global` writes no row either, so a
+   * lone copy elsewhere may be a copy the user deleted or a harness added later (p1442).
+   */
+  legacySingleCopyHarness(component, name, all) {
+    if (!all.includes("omp") || legacyOmpPaths(component, name).length === 0) return [];
+    const others = all.filter((h) => h !== "omp" && isDeployed(component, name, h, true));
+    return others.length === 0 ? ["omp"] : [];
+  }
+  /**
+   * Whether `~/.skaile/skaile.yaml` is a 5.12.0 record: it exists and has no
+   * `global_asset_harnesses:` key yet, so {@link inferLegacyHarnessSubsets} has not run.
+   */
+  isLegacyHarnessRecord() {
+    if (!this.global) return false;
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return false;
+    try {
+      const raw = parse(readFileSync(configPath, "utf8"));
+      return !!raw && typeof raw === "object" && !(ENTRY_HARNESSES_KEY in raw);
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * A 5.12.0 global record has no `global_asset_harnesses:` key, yet `add --global --harness omp`
+   * wrote one copy only, under `~/.omp/skills`. On the first global `install`, an entry whose only
+   * copy sits there (see {@link legacySingleCopyHarness}) is omp's subset (OQ6): record it, so the
+   * install does not fan the asset out to harnesses the user never asked for (p1442). Nothing is
+   * inferred without that evidence, once the key exists (an entry without a row then means "every
+   * harness"), or with one default harness. Global mode only; returns the rows written.
    */
   inferLegacyHarnessSubsets(entries) {
     if (!this.global) return [];
@@ -1547,9 +1578,7 @@ var AssetManager = class {
     for (const e of entries) {
       const component = this.installTarget(e.kind);
       if (!component || !e.name) continue;
-      const holding = all.filter(
-        (h) => isDeployed(component, e.name, h, true) || h === "omp" && legacyOmpPaths(component, e.name).length > 0
-      );
+      const holding = this.legacySingleCopyHarness(component, e.name, all);
       if (holding.length !== 1) continue;
       const publisher = e.publisher?.replace(/^@/, "");
       const ref = `${e.kind}:${publisher ? `@${publisher}/` : ""}${e.name}`;
@@ -1720,6 +1749,13 @@ var AssetManager = class {
   takeLegacyCopiesRemoved() {
     return this.legacyCopiesRemoved.splice(0);
   }
+  /**
+   * The source origins the last {@link outdated} call could not fetch (name, URL, why). Their
+   * behind count was not checked, so the CLI must not call the project up to date (p1820).
+   */
+  takeUnreachableSources() {
+    return this.unreachableSources.splice(0);
+  }
   /**
    * The harnesses `add` / `install` deploy into: `[harness]` for a project, the global
    * harness set (see {@link AssetManager.targetHarnesses}) for a global manager.
@@ -1969,11 +2005,7 @@ var AssetManager = class {
       };
     }
     const factory = resolveFactorySource();
-    const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
-    const alreadyDeclared = Object.values(repositories).some(
-      (d) => d.url !== void 0 && normalizeRepoUrl(d.url) === factoryUrl
-    );
-    if (factory && !alreadyDeclared && !repositories[factory.publisher]) {
+    if (factory && !repositories[factory.publisher]) {
       repositories[factory.publisher] = {
         path: factory.dir,
         url: FACTORY_SOURCE_URL,
@@ -1988,7 +2020,7 @@ var AssetManager = class {
     for (const [slug, decl] of Object.entries(repositories)) {
       const localPath = this.resolveRepoDir(decl, slug);
       if (!localPath || !existsSync(localPath)) continue;
-      if (decl.url && normalizeRepoUrl(decl.url) !== normalizeRepoUrl(FACTORY_SOURCE_URL) && !existsSync(join(localPath, ".git"))) {
+      if (decl.url && !decl.factory && !existsSync(join(localPath, ".git"))) {
         this.reportSourceError(
           { localPath, sourceUrl: decl.url, commit: "" },
           new Error(
@@ -2085,8 +2117,8 @@ var AssetManager = class {
     const { publisher, kind, name, version } = parseCanonicalLockKey(key);
     if (!publisher || !kind || !name) return null;
     const url = entry.source.url;
-    const factory = Object.values(repositories).find((d) => d.factory);
-    const declared = factory?.url !== void 0 && normalizeRepoUrl(url) === normalizeRepoUrl(factory.url) ? factory : repositories[sourceCacheKey(url)];
+    const factory = isFactoryMemorySource(entry.source) ? Object.values(repositories).find((d) => d.factory) : void 0;
+    const declared = factory ?? repositories[sourceCacheKey(url)];
     return {
       publisher,
       kind,
@@ -2397,7 +2429,6 @@ var AssetManager = class {
       knownKinds: this.knownKinds,
       onSourceError: this.reportSourceError
     });
-    const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
     const hasFactory = Object.values(repositories).some((d) => d.factory);
     const out = /* @__PURE__ */ new Map();
     const originsOf = (key) => {
@@ -2421,7 +2452,7 @@ var AssetManager = class {
         return a.sourceUrl.localeCompare(b.sourceUrl);
       });
       for (const c of held) {
-        const factory = hasFactory && normalizeRepoUrl(c.sourceUrl) === factoryUrl;
+        const factory = hasFactory && isFactoryMemorySource({ url: c.sourceUrl, commit: c.commit });
         originsOf(key).push({
           kind: factory ? "factory" : "source",
           label: factory ? "factory" : sourceShortName(c.sourceUrl),
@@ -2845,7 +2876,8 @@ var AssetManager = class {
     });
   }
   /**
-   * Open the local index and snapshot its libraries + asset definitions.
+   * Open the local index and snapshot its libraries + asset definitions, scoped to this
+   * project's `sources:` ({@link scopeLibraryIndex}).
    * Best-effort: no index file (never indexed), or any open/guard failure,
    * yields `null` — a lock/outdated read must never create `index.db` or throw.
    */
@@ -2856,14 +2888,7 @@ var AssetManager = class {
       if (!existsSync(indexPath)) return null;
       const index = new LocalIndex({ indexPath });
       try {
-        const libraries = await index.listSources();
-        const defs = await index.listAssetDefs();
-        const hidden = this.undeclaredSourceClones(libraries);
-        if (hidden.size === 0) return { libraries, defs };
-        return {
-          libraries: libraries.filter((l) => !hidden.has(l.id)),
-          defs: defs.filter((d) => !d.libraryId || !hidden.has(d.libraryId))
-        };
+        return this.scopeLibraryIndex(await index.listSources(), await index.listAssetDefs());
       } finally {
         index.close();
       }
@@ -2871,32 +2896,85 @@ var AssetManager = class {
       return null;
     }
   }
+  /**
+   * The `sources:` this project declares by clone key, or `undefined` outside a project (no
+   * `skaile.yaml` in `projectDir` or a parent) or when the file does not parse. Outside a
+   * project nothing declares sources, so the machine-wide search reads every clone.
+   */
+  declaredSourceEntries() {
+    if (!this.global && !findWorkspaceRoot(this.projectDir)) return void 0;
+    try {
+      return new Map(this.loadConfig().sources.map((s) => [sourceCacheKey(s.url), s]));
+    } catch {
+      return void 0;
+    }
+  }
+  /** The clone-cache key a source-clone reader row stands for, or `undefined` for any other library. */
+  sourceCloneKey(l) {
+    if (l.ownership !== "reader" || !("url" in l.backendConfig)) return void 0;
+    const cloneRoots = [
+      join(globalCacheRoot(), "sources"),
+      join(globalSkaileDir(), "sources"),
+      this.reposDir
+    ].map((d) => resolve(d));
+    const at = resolve(l.path);
+    return cloneRoots.some((root) => at.startsWith(root + sep)) ? sourceCacheKey(l.backendConfig.url) : void 0;
+  }
   /**
    * Ids of the registered libraries that are the clone of a source this project does not
    * declare. `source add` registers the clone as a machine-wide reader library so `search`
    * and the indexer can read it, but a `sources:` clone belongs to the projects that declare
-   * it (OQ12, p321): another project neither resolves it, nor ties with it by name, nor has
+   * it (OQ4, p321): another project neither resolves it, nor ties with it by name, nor has
    * `update` re-pin its locked assets to it. A reader library the user registered by hand
    * (`library init --reader --git`) lives outside the sources cache and is never hidden.
    */
   undeclaredSourceClones(libraries) {
     const hidden = /* @__PURE__ */ new Set();
-    if (!this.global && !findWorkspaceRoot(this.projectDir)) return hidden;
-    let declared;
-    try {
-      declared = new Set(this.loadConfig().sources.map((s) => sourceCacheKey(s.url)));
-    } catch {
-      return hidden;
-    }
-    const cloneRoots = [join(globalCacheRoot(), "sources"), this.reposDir].map((d) => resolve(d));
+    const declared = this.declaredSourceEntries();
+    if (!declared) return hidden;
     for (const l of libraries) {
-      if (l.ownership !== "reader" || !("url" in l.backendConfig)) continue;
-      const at = resolve(l.path);
-      if (!cloneRoots.some((root) => at.startsWith(root + sep))) continue;
-      if (!declared.has(sourceCacheKey(l.backendConfig.url))) hidden.add(l.id);
+      const key = this.sourceCloneKey(l);
+      if (key !== void 0 && !declared.has(key)) hidden.add(l.id);
     }
     return hidden;
   }
+  /**
+   * The index as this project sees it: the source clones of other projects are dropped
+   * ({@link undeclaredSourceClones}) and the assets of a declared source carry the publisher
+   * this project's `sources:` entry names. The clone and its index rows are shared by every
+   * project that declares the source, so a project that declares another `--publisher` is
+   * re-labelled here, at read time, and never changes what the others see (p1822).
+   */
+  scopeLibraryIndex(libraries, defs) {
+    const hidden = this.undeclaredSourceClones(libraries);
+    const declared = this.declaredSourceEntries();
+    const relabel = /* @__PURE__ */ new Map();
+    for (const l of libraries) {
+      const key = this.sourceCloneKey(l);
+      const entry = key === void 0 ? void 0 : declared?.get(key);
+      if (!entry?.publisher || hidden.has(l.id) || !("url" in l.backendConfig)) continue;
+      const indexed = resolveSourcePublisher(l.path, l.backendConfig.publisher);
+      const mine = resolveSourcePublisher(l.path, entry.publisher);
+      if (indexed && mine && indexed !== mine) relabel.set(l.id, { from: indexed, to: mine });
+    }
+    if (hidden.size === 0 && relabel.size === 0) return { libraries, defs };
+    const bare = (publisher) => publisher.replace(/^@/, "");
+    return {
+      libraries: libraries.filter((l) => !hidden.has(l.id)).map((l) => {
+        const r = relabel.get(l.id);
+        return r && "url" in l.backendConfig ? { ...l, backendConfig: { ...l.backendConfig, publisher: r.to } } : l;
+      }),
+      defs: defs.filter((d) => !d.libraryId || !hidden.has(d.libraryId)).map((d) => {
+        const r = d.libraryId ? relabel.get(d.libraryId) : void 0;
+        if (!r || bare(d.publisher) !== r.from) return d;
+        return {
+          ...d,
+          publisher: d.publisher.startsWith("@") ? `@${r.to}` : r.to,
+          id: d.id.replace(`@${r.from}/`, `@${r.to}/`)
+        };
+      })
+    };
+  }
   /**
    * Library-origin lock entries for the assets {@link resolveLibraryEntries}
    * matched. The locked version is the one actually deployed: the on-disk
@@ -2971,6 +3049,82 @@ var AssetManager = class {
       })
     );
   }
+  /**
+   * The entries a deploy would write into some target harness: those without a current deployed
+   * copy. An intact copy stays as it is, so a library change that does not reach it (a symlink
+   * added next to the files) stops no `install` or `update` (p1857).
+   */
+  needingDeploy(entries, link = false) {
+    const targets = this.targetHarnesses();
+    return entries.filter(
+      (e) => targets.some((t) => entriesNeedingDeploy([e], this.deployOptsFor(t, link)).length > 0)
+    );
+  }
+  /**
+   * The files of a library asset that git has not committed (edited, new or staged only), as
+   * paths relative to the library root. The asset's own folder, or its one manifest file when it
+   * shares the folder with other assets. Empty when the asset is not in a git work tree.
+   */
+  uncommittedAssetFiles(entry, libPath) {
+    const provider = this.registry.getProvider(entry.kind);
+    if (!provider) return [];
+    let scope;
+    try {
+      const manifest = statSync(entry.source).isDirectory() ? readdirSync(entry.source).find((f) => provider.matchesPath(f)) : entry.source;
+      if (!manifest) return [];
+      const manifestPath = isAbsolute(manifest) ? manifest : join(entry.source, manifest);
+      const filter = provider.defaultFileFilter(manifestPath);
+      const rootName = relative(dirname(filter.assetRoot), filter.assetRoot);
+      scope = filter.files.length > 1 || rootName === entry.name ? filter.assetRoot : manifestPath;
+    } catch {
+      return [];
+    }
+    const cwd = statSync(scope).isDirectory() ? scope : dirname(scope);
+    const top = spawnSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8"
+    });
+    if (top.status !== 0) return [];
+    const status = spawnSync(
+      "git",
+      ["-C", cwd, "status", "--porcelain", "--untracked-files=all", "--", scope],
+      { encoding: "utf8" }
+    );
+    if (status.status !== 0) return [];
+    const root = top.stdout.trim();
+    return status.stdout.split("\n").filter((l) => l.trim() !== "").map(
+      (l) => relative(realpathSync(libPath), join(root, l.slice(3).trim().replace(/^"|"$/g, "")))
+    );
+  }
+  /**
+   * Warn when a library with a git remote has uncommitted changes in the folders of the assets
+   * `add` or `install` lock: the lock records the bytes on this disk, which no clone of the
+   * remote holds, so a teammate (or CI) cannot restore them. One line per library naming the
+   * files; the command goes on (OQ5, p1859).
+   */
+  async warnUncommittedLibraryAssets(lib) {
+    if (lib.entries.length === 0) return;
+    const snap = await this.loadLibraryIndex();
+    const files = /* @__PURE__ */ new Map();
+    for (const e of lib.entries) {
+      const name = lib.libraryOf.get(e);
+      const registered = name ? snap?.libraries.find((l) => l.name === name) : void 0;
+      if (!name || !registered || !libraryRemoteUrl(registered)) continue;
+      const libPath = this.libraryPath({ name }, snap);
+      if (!libPath) continue;
+      const set = files.get(name) ?? /* @__PURE__ */ new Set();
+      for (const f of this.uncommittedAssetFiles(e, libPath)) set.add(f);
+      if (set.size > 0) files.set(name, set);
+    }
+    for (const [name, set] of files) {
+      const list = [...set].sort();
+      const shown = list.slice(0, 5).join(", ");
+      const more = list.length > 5 ? `, +${list.length - 5} more` : "";
+      this.emitLibraryCollision(
+        `library "${name}" has uncommitted changes (${shown}${more}): other machines cannot restore those bytes from its remote. Commit and push them.`,
+        []
+      );
+    }
+  }
   /**
    * Whether every declared ref is locked and no declared pin differs from the locked version:
    * `skaile.yaml` asks for nothing the lock does not hold. A declared preset counts when the
@@ -3144,7 +3298,7 @@ var AssetManager = class {
         const onDisk = libraryDiskHashes(libPath, diskHashes, this.registry).get(`${kind}:${name}`);
         if (onDisk !== void 0 && onDisk !== origin.sha256) {
           missing.push(
-            `${ref} (library "${lookup.name}" content changed since lock \u2014 or the lock predates the one shared asset hash; re-lock with \`skaile install\`)`
+            `${ref} (library "${lookup.name}" content changed since lock \u2014 or the lock predates the one shared asset hash; re-lock with \`skaile update\`)`
           );
           continue;
         }
@@ -3266,12 +3420,21 @@ var AssetManager = class {
   async keepLockedLibraryEntries(lock) {
     if (!lock) return void 0;
     const out = /* @__PURE__ */ new Map();
+    const snap = await this.loadLibraryIndex();
+    const diskHashes = /* @__PURE__ */ new Map();
     for (const [key, entry] of Object.entries(lock.assets)) {
       if (!entry.library || entry.library.installed || !entry.library.version) continue;
       const id = parseCanonicalLockKey(key);
       if (!id.publisher || !id.kind || !id.name) continue;
       const requires = entry.requires ?? await this.deployedRequirementsOf(id);
-      out.set(`${id.publisher}/${id.kind}:${id.name}`, { key, entry, requires });
+      const lookup = this.lockedLibrary(entry.library, snap, {
+        kind: id.kind,
+        publisher: id.publisher,
+        name: id.name
+      });
+      const onDisk = lookup.state === "ok" && entry.library.sha256 ? libraryDiskHashes(lookup.path, diskHashes, this.registry).get(`${id.kind}:${id.name}`) : void 0;
+      const contentChanged = onDisk !== void 0 && onDisk !== entry.library.sha256;
+      out.set(`${id.publisher}/${id.kind}:${id.name}`, { key, entry, requires, contentChanged });
     }
     return out.size > 0 ? out : void 0;
   }
@@ -3582,6 +3745,7 @@ var AssetManager = class {
     const requiredBy = /* @__PURE__ */ new Map();
     const keptVersions = {};
     const versionBlocked = [];
+    const contentHeld = [];
     const lib = { entries: [], resolved: /* @__PURE__ */ new Set(), libraryOf: /* @__PURE__ */ new Map() };
     const missing = /* @__PURE__ */ new Set();
     const seen = /* @__PURE__ */ new Set();
@@ -3596,6 +3760,9 @@ var AssetManager = class {
       const locked = opts.keepLocked?.get(id);
       const lockedVersion = locked?.entry.library?.version;
       if (!locked || !lockedVersion || !e.version) return void 0;
+      if (locked.contentChanged && coerceVersion(e.version) === coerceVersion(lockedVersion)) {
+        return locked;
+      }
       if (isPseudoVersion(lockedVersion) || isPseudoVersion(e.version)) return void 0;
       if (coerceVersion(e.version) === coerceVersion(lockedVersion)) return void 0;
       for (const r of asked) if (refIdentity(r) === id && r.includes("#")) return void 0;
@@ -3632,10 +3799,18 @@ var AssetManager = class {
           });
         } else if (keep) {
           keptVersions[keep.key] = keep.entry;
+          const sameVersion = coerceVersion(e.version ?? "") === coerceVersion(keep.entry.library?.version ?? "");
+          const libraryName = origin ?? keep.entry.library?.name ?? "";
           if (!this.lockedCopyDeployed(e.kind, e.name)) {
             versionBlocked.push(
-              `${keep.key} (library "${origin ?? keep.entry.library?.name}" is at ${e.version}, locked ${keep.entry.library?.version}; the deployed copy is gone and cannot be restored from the ${gt(coerceVersion(e.version ?? ""), coerceVersion(keep.entry.library?.version ?? "")) ? "newer" : "older"} files \u2014 \`skaile update\` moves the lock to it)`
+              sameVersion ? `${keep.key} (library "${libraryName}" content changed since lock; the deployed copy is gone and cannot be restored from the changed files \u2014 \`skaile update\` takes the change)` : `${keep.key} (library "${origin ?? keep.entry.library?.name}" is at ${e.version}, locked ${keep.entry.library?.version}; the deployed copy is gone and cannot be restored from the ${gt(coerceVersion(e.version ?? ""), coerceVersion(keep.entry.library?.version ?? "")) ? "newer" : "older"} files \u2014 \`skaile update\` moves the lock to it)`
             );
+          } else if (sameVersion) {
+            contentHeld.push({
+              ref: keep.key,
+              library: libraryName,
+              version: keep.entry.library?.version ?? ""
+            });
           }
         } else {
           lib.entries.push(e);
@@ -3738,7 +3913,8 @@ var AssetManager = class {
       presets,
       requiredBy,
       keptVersions,
-      versionBlocked
+      versionBlocked,
+      contentHeld
     };
   }
   /**
@@ -4064,7 +4240,8 @@ var AssetManager = class {
       presets,
       requiredBy,
       keptVersions,
-      versionBlocked
+      versionBlocked,
+      contentHeld
     } = await this.resolveLibraryFirst(dependencies, {
       provenanceIndex,
       overrides,
@@ -4132,6 +4309,7 @@ var AssetManager = class {
       missingHints[ref] = `${fix ? "" : missingHints[ref] ?? ""} (${notes.join("; ")})`;
     }
     const directLock = this.directInstallLockEntries();
+    await this.warnUncommittedLibraryAssets(lib);
     const libraryLock = {
       ...directLock,
       ...await this.libraryLockEntries(lib, opts?.moveLibraries === true),
@@ -4144,7 +4322,12 @@ var AssetManager = class {
     await this.keepRequiredByKept(prevLock, kept, Object.keys(freshLock.assets));
     const entries = [...await this.buildCatalogEntries(resolved, repositories), ...lib.entries];
     assertFlowsLoad(entries, "installed");
-    assertNoLibrarySymlinks(entries, this.registry, repositories, opts?.link === true);
+    assertNoLibrarySymlinks(
+      this.needingDeploy(entries, opts?.link === true),
+      this.registry,
+      repositories,
+      opts?.link === true
+    );
     if (libraryAssetCheck && lib.entries.length > 0) {
       const lockedIds = new Set([...lockedKeys].map((k) => k.split("#")[0]));
       const snap = await this.loadLibraryIndex();
@@ -4224,6 +4407,8 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
       ...mcpRestored
     ];
     const rewritten = this.rewrittenAgentFiles(unrecordedAgents);
+    const editedHeld = new Set(copyDrift.filter((d) => d.libraryChanged).map((d) => d.ref));
+    const heldEdits = editedHeld.size > 0 && opts?.moveLibraries !== true ? (await this.projectState()).gaps.filter((g) => g.type === "modified" && editedHeld.has(g.ref)).map((g) => g.message) : [];
     const lockWanted = resolved.length > 0 || lib.entries.length > 0 || existsSync(this.lockPath);
     let lockWritten = false;
     let relocked = [];
@@ -4261,13 +4446,15 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
       missing: [
         ...reportedMissing,
         ...versionBlocked.filter((b) => !reportedMissing.includes(b)),
-        ...composedDrift
+        ...composedDrift,
+        ...heldEdits.filter((h) => !reportedMissing.includes(h))
       ],
       ...placeholderBodies.length > 0 ? { placeholderBodies } : {},
       ...placeholderDescriptions.length > 0 ? { placeholderDescriptions } : {},
       ...storeNotChecked.length > 0 ? { storeNotChecked } : {},
       ...Object.keys(missingHints).length > 0 ? { missingHints } : {},
       ...relocked.length > 0 ? { relocked } : {},
+      ...contentHeld.length > 0 ? { contentHeld } : {},
       ...inferredHarnesses.length > 0 ? { inferredHarnesses } : {},
       ...moved.length > 0 ? { moved } : {},
       ...replaced.length > 0 ? { replaced } : {},
@@ -4739,11 +4926,15 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
       });
     }
   }
-  /** Read the lock, returning null on a legacy v1 lock instead of throwing. */
+  /**
+   * Read the lock, returning null on a legacy v1 lock instead of throwing. A lock that is not
+   * valid YAML throws {@link LockParseError}: it is not an empty lock (p1892).
+   */
   tryReadLock() {
     try {
       return readLock(this.lockPath);
-    } catch {
+    } catch (err) {
+      if (err instanceof LockParseError) throw err;
       return null;
     }
   }
@@ -4913,13 +5104,11 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
       );
     }
     const declBySlug = new Map(Object.entries(repositories));
-    const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
     const factoryDecl = Object.values(repositories).find((d) => d.factory);
     const factoryDir = factoryDecl?.path ?? null;
-    const isFactoryUrl = (url) => factoryDir !== null && normalizeRepoUrl(url) === factoryUrl;
     const unavailable = [];
     for (const src of lock.sources) {
-      if (isFactoryUrl(src.url)) continue;
+      if (factoryDir !== null && isFactoryMemorySource(src)) continue;
       const slug = sourceCacheKey(src.url);
       const declared = declBySlug.get(slug);
       if (!declared && GITHUB_REPO_URL.test(src.url)) continue;
@@ -4949,8 +5138,8 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
         cloneOrigin[key] = entry;
       }
     }
-    const verification = verifyLock({ ...lock, assets: cloneOrigin }, (sourceUrl) => {
-      if (isFactoryUrl(sourceUrl)) return factoryDir;
+    const verification = verifyLock({ ...lock, assets: cloneOrigin }, (sourceUrl, entry) => {
+      if (factoryDir !== null && isFactoryMemorySource(entry.source)) return factoryDir;
       const slug = sourceCacheKey(sourceUrl);
       return this.resolveRepoDir(repositories[slug] ?? { url: sourceUrl }, slug);
     });
@@ -4982,7 +5171,11 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     }
     const library = await this.restoreLibraryLockEntries(lock, { storeFallback: true });
     assertFlowsLoad([...resolved, ...library.entries], "installed");
-    assertNoLibrarySymlinks([...resolved, ...library.entries], this.registry, repositories);
+    assertNoLibrarySymlinks(
+      this.needingDeploy([...resolved, ...library.entries]),
+      this.registry,
+      repositories
+    );
     const inferredHarnesses = this.inferLegacyHarnessSubsets([...resolved, ...library.entries]);
     const composedPre = /* @__PURE__ */ new Set();
     if (!this.global) {
@@ -5046,7 +5239,12 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
       const p = parseRefTolerant(g.ref);
       return !(p && alreadyMissing.has(`${p.kind}:${p.name}`));
     }).map((g) => g.message);
-    const libraryNotices = this.storeRestoreNotices(lock, library.viaStore, library.storeOrigins);
+    const libraryNotices = this.storeRestoreNotices(
+      lock,
+      library.viaStore,
+      library.storeOrigins,
+      deployed.length > 0 || restored.length > 0
+    );
     const placeholderBodies = scaffoldBodyRefs(library.entries, deployed);
     const placeholderDescriptions = scaffoldDescriptionRefs(library.entries, deployed);
     return {
@@ -5070,7 +5268,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
    * the library to move the lock later (OQ8, p1655). Every file was SHA-verified against the
    * hash the lock recorded.
    */
-  storeRestoreNotices(lock, viaStore, storeOrigins) {
+  storeRestoreNotices(lock, viaStore, storeOrigins, wroteFiles) {
     const byLibrary = /* @__PURE__ */ new Map();
     for (const key of viaStore) {
       const origin = lock.assets[key]?.library;
@@ -5088,7 +5286,20 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     }
     return [...byLibrary].map(([name, { url, refs, from }]) => {
       const register = url ? `skaile library init ${name} --git ${url}` : `skaile library init ${name} --path <dir>`;
-      const where = from.size > 0 ? ` from the store ${[...from].join(", ")}` : " from a store";
+      if (!wroteFiles) {
+        return `Library "${name}" is not registered here. Register it with \`${register}\` to move the lock later.`;
+      }
+      const byStore = /* @__PURE__ */ new Map();
+      for (const f of from) {
+        const storeUrl = f.split(" (")[0] ?? f;
+        const pointers = byStore.get(storeUrl) ?? /* @__PURE__ */ new Set();
+        pointers.add(f);
+        byStore.set(storeUrl, pointers);
+      }
+      const stores = [...byStore].map(
+        ([storeUrl, pointers]) => pointers.size === 1 ? [...pointers][0] : storeUrl
+      );
+      const where = stores.length > 0 ? ` from the store ${stores.join(", ")}` : " from a store";
       return `Library "${name}" is not registered here: restored ${refs.length} asset${refs.length === 1 ? "" : "s"}${where}, every file checked against the lock. Register it with \`${register}\` to move the lock later.`;
     });
   }
@@ -5173,7 +5384,6 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
    */
   planAddItems(resolved, lib, stores, parsed) {
     const storeUrls = new Set(stores.map((s) => normalizeRepoUrl(s.url)));
-    const factoryUrl = normalizeRepoUrl(FACTORY_SOURCE_URL);
     const shownPath = (dir) => {
       const rel = relative(this.projectDir, dir);
       return this.global || rel.startsWith("..") ? dir.replace(homedir(), "~") : `${rel}${dir.endsWith(sep) ? sep : ""}`;
@@ -5206,7 +5416,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
           publisher: c.publisher.replace(/^@/, "")
         }),
         version: c.version,
-        origin: storeUrls.has(url) ? `store ${c.sourceUrl}` : url === factoryUrl ? "factory" : `source ${sourceShortName(c.sourceUrl)}`,
+        origin: storeUrls.has(url) ? `store ${c.sourceUrl}` : isFactoryMemorySource({ url: c.sourceUrl, commit: c.commit }) ? "factory" : `source ${sourceShortName(c.sourceUrl)}`,
         requested: asked(c.kind, c.name, c.publisher),
         ...planPaths(
           folders(c.kind, c.name),
@@ -5382,6 +5592,30 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
           }
         }
       }
+      if (libraryAssetCheck) {
+        for (const l of snap?.libraries ?? []) {
+          const libPath = this.libraryPath({ name: l.name }, snap);
+          const manifest = libPath ? loadSkPublishManifest(libPath) : null;
+          if (!libPath || !manifest || manifest.source) continue;
+          const entry = (manifest.assets ?? []).find(
+            (a) => a.kind === parsed.kind && a.name === parsed.name && !a.source && (!parsed.publisher || bare(a.publisher ?? manifest.publisher) === bare(parsed.publisher))
+          );
+          if (!entry?.root || isAbsolute(entry.root) || entry.root.split(/[\\/]+/).includes("..")) {
+            continue;
+          }
+          const problems = libraryAssetCheck(
+            { kind: entry.kind, name: entry.name, source: join(libPath, entry.root) },
+            libPath
+          );
+          if (problems.length > 0) {
+            throw new Error(
+              `${parsed.kind}:${parsed.name} in library "${l.name}" fails the checks of \`skaile validate\` - nothing was added:
+${problems.map((line) => `  ${line}`).join("\n")}
+Fix the asset, then run \`skaile library index ${l.name}\` and add it again.`
+            );
+          }
+        }
+      }
       const unreachable = [...this.storeFailures.values()];
       if (unreachable.length > 0) {
         throw new Error(
@@ -5574,9 +5808,15 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     this.addDependencyToConfig(ref, opts?.only === true);
     this.widenDependencyRows(entries, parsed);
+    if (!opts?.preferLockedLibrary) {
+      const bound = this.bindAgentInstance(entries, parsed);
+      if (bound?.keptRef !== void 0) opts?.onAgentBindingKept?.(bound.id, bound.keptRef);
+      else if (bound) opts?.onAgentBound?.(bound.id, bound.ref);
+    }
     await this.renderHarnessMcpConfig();
     await this.renderAgentInstances();
     if (resolved.length > 0 || lib.entries.length > 0) {
+      await this.warnUncommittedLibraryAssets(lib);
       const libraryLock = await this.libraryLockEntries(lib);
       const fresh = {
         ...buildLockFile(resolved, overridesApplied, libraryLock),
@@ -6385,17 +6625,18 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
   listStaleHarnessCopies() {
     if (this.global) return [];
     const tracked = /* @__PURE__ */ new Map();
-    const track = (kind, name) => {
+    const track = (kind, name, locked = false) => {
       const component = kind ? this.installTarget(kind) : void 0;
       if (kind && name && component) {
-        tracked.set(`${kind}:${name}`, { kind, name, component });
+        const key = `${kind}:${name}`;
+        tracked.set(key, { kind, name, component, locked: locked || !!tracked.get(key)?.locked });
       }
     };
     const lock = this.tryReadLock();
     if (lock) {
       for (const key of Object.keys(lock.assets)) {
         const { kind, name } = parseCanonicalLockKey(key);
-        track(kind, name);
+        track(kind, name, true);
       }
     }
     try {
@@ -6411,23 +6652,36 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     const out = [];
     for (const other of SUPPORTED_HARNESSES) {
       if (other === this.harness) continue;
-      for (const { kind, name, component: k } of tracked.values()) {
+      for (const { kind, name, component: k, locked } of tracked.values()) {
         if (deployedDir(k, name, other, false, this.projectDir) === deployedDir(k, name, this.harness, false, this.projectDir)) {
           continue;
         }
-        const found = deployedPaths(k, name, other, false, this.projectDir).find((p) => {
+        const footprints = deployedPaths(k, name, other, false, this.projectDir);
+        if (k === "agent" && other === "codex") {
+          footprints.push(
+            join(
+              dirname(deployedBase(k, other, false, this.projectDir)),
+              CODEX_IDENTITY_DIR,
+              `${name}.md`
+            )
+          );
+        }
+        const otherBase = deployedBase(k, other, false, this.projectDir);
+        const activeBase = deployedBase(k, this.harness, false, this.projectDir);
+        for (const p of footprints) {
           try {
             lstatSync(p);
-            return true;
           } catch {
-            return false;
+            continue;
           }
-        });
-        if (found) out.push({ harness: other, kind, name, path: found });
+          const twin = join(activeBase, relative(otherBase, p));
+          const skaileWrote = k === "agent" ? locked : !relative(otherBase, p).startsWith("..") && sameBytes(p, twin);
+          out.push({ harness: other, kind, name, path: p, skaileWrote });
+        }
       }
     }
     return out.sort(
-      (a, b) => a.harness.localeCompare(b.harness) || a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name)
+      (a, b) => a.harness.localeCompare(b.harness) || a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name) || a.path.localeCompare(b.path)
     );
   }
   /**
@@ -6674,7 +6928,13 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       const locked = parsed.kind === "preset" ? lock !== null : lockKeys.some(
         (k) => k.kind === parsed.kind && k.name === parsed.name && (!parsed.publisher || k.publisher === parsed.publisher)
       );
-      const recorded = this.entryHarnessRecord(parsed.kind, parsed.name, parsed.publisher);
+      let recorded = this.entryHarnessRecord(parsed.kind, parsed.name, parsed.publisher);
+      if (!recorded && this.isLegacyHarnessRecord()) {
+        const all = this.defaultGlobalHarnesses();
+        const component = this.installTarget(parsed.kind);
+        const holding = all.length >= 2 && component ? this.legacySingleCopyHarness(component, parsed.name, all) : [];
+        if (holding.length === 1) recorded = holding;
+      }
       for (const harness of recorded ? harnesses.filter((h) => recorded.includes(h)) : harnesses) {
         let state;
         if (!locked) {
@@ -6959,6 +7219,13 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       if (!decl) continue;
       const status = checkRepoStatus(decl, slug, this.reposDir);
       if (status.kind !== "remote" || !status.localHead) continue;
+      if (status.error !== void 0) {
+        this.unreachableSources.push({
+          name: sourceShortName(src.url),
+          url: src.url,
+          reason: status.error
+        });
+      }
       const clone = decl.path ?? join(this.reposDir, slug);
       for (const [ref, entry] of Object.entries(lock.assets)) {
         if (entry.source?.url !== src.url) continue;
@@ -8102,7 +8369,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
               found.version
             );
             if (!diskVersion || isPseudoVersion(diskVersion) || !gt(coerceVersion(diskVersion), coerceVersion(origin.version)) && (isPseudoVersion(origin.version) || diskVersion === origin.version)) {
-              const reason2 = `is locked, but library "${lookup.name}" content changed since lock \u2014 or the lock predates the one shared asset hash; run \`skaile install\` to re-lock it`;
+              const reason2 = `is locked, but library "${lookup.name}" content changed since lock \u2014 or the lock predates the one shared asset hash; run \`skaile update\` to re-lock it`;
               gaps.push({ type: "content", ref, reason: reason2, message: `${ref} ${reason2}` });
             }
           }
@@ -8157,16 +8424,19 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
       const url = entry.source?.url;
       if (!url || entry.library || !GIT_URL.test(url)) continue;
+      if (entry.origin === "store" && !online) continue;
       if (inScope && !inScope.has(key)) continue;
-      if (normalizeRepoUrl(url) === normalizeRepoUrl(FACTORY_SOURCE_URL)) continue;
+      if (isBundledFactoryEntry(entry)) continue;
       const { publisher, kind, name, version } = parseCanonicalLockKey(key);
       if (!publisher || !kind || !name) continue;
       if (registered.has(sourceCacheKey(url))) continue;
       const ref = `${kind}:@${publisher}/${name}`;
       const locked = version ? `${ref}#${version}` : void 0;
-      if (GITHUB_REPO_URL.test(url) && await this.storeListsRef(stores, ref, online, locked))
+      const askStores = entry.origin === "store" && entry.store && !stores.some((s) => s.url === entry.store) ? [...stores, { url: entry.store }] : stores;
+      if (GITHUB_REPO_URL.test(url) && await this.storeListsRef(askStores, ref, online, locked))
         continue;
-      const reason = `is locked, but its source ${url} is not in skaile.yaml sources: any more \u2014 register it again with \`skaile source add ${url}\`, or drop the dependency with \`skaile remove ${ref}\``;
+      const base = `is locked, but its source ${url} is not in skaile.yaml sources: any more \u2014 register it again with \`skaile source add ${url}\`, or drop the dependency with \`skaile remove ${ref}\``;
+      const reason = stores.length > 0 && GITHUB_REPO_URL.test(url) && entry.origin !== "store" ? `${base}. If a store supplied it (store unreachable, or its cache is cold), run \`skaile install\` with the store online to record the store as its origin` : base;
       out.set(key, { type: "source", ref, reason, message: `${ref} ${reason}`, manualFix: true });
     }
     return out;
@@ -8179,6 +8449,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    * its cached catalog holds.
    */
   async storeListsRef(stores, ref, online, lockedRef) {
+    if (online && this.catalogUrlOverride === "") return true;
     for (const store of stores) {
       try {
         if (this.injectedStoreFetcher) {
@@ -8215,8 +8486,8 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     const gaps = [];
     for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
       const url = entry.source?.url;
-      if (!url || entry.library || !GIT_URL.test(url)) continue;
-      if (normalizeRepoUrl(url) === normalizeRepoUrl(FACTORY_SOURCE_URL)) continue;
+      if (!url || entry.library || entry.origin === "store" || !GIT_URL.test(url)) continue;
+      if (isBundledFactoryEntry(entry)) continue;
       const { publisher, kind, name } = parseCanonicalLockKey(key);
       if (!publisher || !kind || !name || named.has(`${kind}:${name}`)) continue;
       const ref = `${kind}:@${publisher}/${name}`;
@@ -8244,7 +8515,8 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     const want = sourceCacheKey(url);
     const out = [];
     for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
-      if (entry.library || !entry.source || sourceCacheKey(entry.source.url) !== want) continue;
+      if (entry.library || !entry.source || isFactoryMemorySource(entry.source)) continue;
+      if (sourceCacheKey(entry.source.url) !== want) continue;
       const { publisher, kind, name } = parseCanonicalLockKey(key);
       if (kind && name) out.push(publisher ? `${kind}:@${publisher}/${name}` : `${kind}:${name}`);
     }
@@ -9221,6 +9493,53 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     return out;
   }
+  /**
+   * Bind the agent `skaile add agent:<ref>` just added as an instance `agents.<name>:
+   * {ref: agent:@publisher/name}` of `skaile.yaml`, so `run --instance <name>` and the repl
+   * banner hint work at once. An agent that an instance or `agent:` already binds, or an id
+   * `agents:` already holds, is left as it is. Project mode only.
+   *
+   * @returns the instance id and ref bound; the id with `keptRef` (what that id binds instead)
+   * when the id is taken by another agent; `undefined` when nothing was bound and nothing needs saying.
+   */
+  bindAgentInstance(entries, parsed) {
+    if (this.global || parsed.kind !== "agent") return void 0;
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return void 0;
+    const bare = (p) => p?.replace(/^@/, "");
+    const entry = entries.find(
+      (e) => e.kind === "agent" && e.name === parsed.name && (!parsed.publisher || bare(e.publisher) === bare(parsed.publisher))
+    );
+    const publisher = bare(entry?.publisher ?? parsed.publisher);
+    const ref = publisher ? `agent:@${publisher}/${parsed.name}` : `agent:${parsed.name}`;
+    const id = parsed.name.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[^a-z]+/, "");
+    if (!/^[a-z][a-z0-9_-]*$/.test(id)) return void 0;
+    let raw;
+    try {
+      raw = parse(readFileSync(configPath, "utf8"));
+    } catch {
+      return void 0;
+    }
+    if (!raw || typeof raw !== "object") return void 0;
+    const bound = (value) => {
+      const p = typeof value === "string" ? parseRefTolerant(value) : null;
+      return !!p && p.kind === "agent" && p.name === parsed.name && (!publisher || !p.publisher || bare(p.publisher) === publisher);
+    };
+    const instances = raw.agents && typeof raw.agents === "object" && !Array.isArray(raw.agents) ? raw.agents : {};
+    const primary = raw.agent && typeof raw.agent === "object" ? raw.agent.definition : void 0;
+    if (bound(primary) || Object.values(instances).some((i) => bound(i?.ref))) {
+      return void 0;
+    }
+    const taken = instances[id]?.ref;
+    if (id in instances)
+      return { id, ref, keptRef: typeof taken === "string" ? taken : "another agent" };
+    if (id === DEFAULT_AGENT_INSTANCE_ID && typeof primary === "string") {
+      return { id, ref, keptRef: primary };
+    }
+    raw.agents = { ...instances, [id]: { ref } };
+    writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+    return { id, ref };
+  }
   /** The refs `skaile.yaml` binds agent instances to: every `agents.<id>.ref` and `agent.definition`. Project mode only. */
   declaredAgentInstanceRefs() {
     if (this.global) return [];
@@ -9303,5 +9622,5 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
 };
 
 export { AssetManager, LibraryEntryError, MissingManifestError, installAgentInstances, labelDiffHeaders, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, setLibraryAssetCheck, setRenamedEntryLookup, softDepName };
-//# sourceMappingURL=chunk-TGB4E5Z6.js.map
-//# sourceMappingURL=chunk-TGB4E5Z6.js.map
+//# sourceMappingURL=chunk-JRVQV7WC.js.map
+//# sourceMappingURL=chunk-JRVQV7WC.js.map