@skaile/workspaces 6.6.0 → 6.7.0

package/dist/{chunk-JRVQV7WC.js → chunk-ZDTDS62B.js}

@@ -1,18 +1,18 @@
-import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-MMOWIRHP.js';
-import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-J4WKNJHO.js';
+import { unregisteredLibraryNames, libraryDirMissing, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-G44FFUMA.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-O5Y7VMVQ.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
-import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, entriesNeedingDeploy, assertNoLibrarySymlinks, deployAll, removeAsset, composedDriftRefs, sourceComposedFiles, cachedComposedFiles, createScaffold, installAgent } from './chunk-DI6J2PJB.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, entriesNeedingDeploy, resetMissingParentWarnings, assertNoLibrarySymlinks, composedDriftRefs, deployAll, removeAsset, sourceComposedFiles, cachedComposedFiles, createScaffold, composedAgentNamesOf, installAgent } from './chunk-KO3VSZQP.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-DS6UUCFG.js';
+import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-4CD2R4MJ.js';
 import { isScaffoldBody, isScaffoldDescription } from './chunk-VT6G5AJV.js';
-import { resolveConfiguredHarnessName, FACTORY_SOURCE_URL, isFactoryMemorySource, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, computeHash, buildLockFile, readLock, LockParseError, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-6ARPZHOV.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-JIQUF3X2.js';
-import { deployedBase, isDeployed, deployedPaths, deployedDir } from './chunk-5KRMNUL4.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveSourcePublisher, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, DEFAULT_AGENT_INSTANCE_ID, MAX_PRESET_DEPTH, PresetDepthError } from './chunk-6SXSVKQY.js';
+import { resolveConfiguredHarnessName, computeHash, FACTORY_SOURCE_URL, isFactoryMemorySource, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, buildLockFile, readLock, LockParseError, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, ensureRunStateIgnored, LOCK_SCHEMA_VERSION } from './chunk-TMJBEGS4.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-G7NMF5WQ.js';
+import { deployedBase, deployedPaths, deployedDir, isDeployed } from './chunk-5KRMNUL4.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveSourcePublisher, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, cloneOriginMismatch, DEFAULT_AGENT_INSTANCE_ID, MAX_PRESET_DEPTH, PresetDepthError } from './chunk-O7ADRMCR.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { HARNESS_TARGETS, SUPPORTED_HARNESSES } from './chunk-VTETQCR6.js';
-import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-E2EC6SAX.js';
+import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-QC5BYUED.js';
 import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-GNUA7XT2.js';
 import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-V5KG6CCV.js';
 import { spawnSync } from 'child_process';
@@ -40,6 +40,7 @@ function writeLedger(projectDir, ledger) {
   mkdirSync(dirname(p), { recursive: true });
   writeFileSync(p, `${JSON.stringify(ledger, null, 2)}
 `, "utf-8");
+  ensureRunStateIgnored(projectDir);
 }
 function renderedInstanceFiles(projectDir, harness) {
   const recorded = readLedger(projectDir).targets[harness];
@@ -52,6 +53,71 @@ function renderedInstanceFiles(projectDir, harness) {
   }
   return Object.entries(instances).filter(([id]) => recorded[id]?.length).map(([id, instance]) => ({ id, ref: instance.ref, files: recorded[id] }));
 }
+function agentOfRef(ref) {
+  if (!ref.startsWith("agent:")) return void 0;
+  const body = (ref.slice("agent:".length).split("#")[0] ?? "").trim();
+  const slash = body.lastIndexOf("/");
+  const name = slash < 0 ? body : body.slice(slash + 1);
+  if (!name) return void 0;
+  const publisher = slash < 0 ? void 0 : body.slice(0, slash).replace(/^@/, "");
+  return { name, ...publisher ? { publisher } : {} };
+}
+function instancesBoundToAgent(projectDir, name, publisher) {
+  let instances;
+  try {
+    instances = effectiveAgentInstances(resolveSkWorkspaceConfig(projectDir));
+  } catch {
+    return [];
+  }
+  return Object.entries(instances).filter(([, instance]) => {
+    const bound = agentOfRef(instance.ref);
+    return bound !== void 0 && bound.name === name && (true);
+  }).map(([id]) => id);
+}
+function boundAgentNames(projectDir) {
+  try {
+    return new Set(
+      Object.values(effectiveAgentInstances(resolveSkWorkspaceConfig(projectDir))).map((instance) => agentOfRef(instance.ref)?.name).filter((name) => name !== void 0)
+    );
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function isAgentInstanceRendered(projectDir, harness, name) {
+  if (!harnessTargetSupportsAgents(harness)) return false;
+  const recorded = readLedger(projectDir).targets[harness];
+  if (!recorded) return false;
+  return instancesBoundToAgent(projectDir, name).some((id) => {
+    const files = recorded[id] ?? [];
+    return files.length > 0 && files.every((rel) => {
+      try {
+        return lstatSync(resolve(projectDir, rel)) !== void 0;
+      } catch {
+        return false;
+      }
+    });
+  });
+}
+function runRoleAgentNames(projectDir) {
+  const run = /* @__PURE__ */ new Set();
+  const delegate = /* @__PURE__ */ new Set();
+  const cache = agentSourceCacheDir(projectDir);
+  if (!existsSync(cache)) return run;
+  for (const dir of readdirSync(cache, { withFileTypes: true })) {
+    if (!dir.isDirectory()) continue;
+    const composed = composedAgentNamesOf(join(cache, dir.name));
+    for (const name of composed.run) run.add(name);
+    for (const name of composed.delegate) delegate.add(name);
+  }
+  for (const name of delegate) run.delete(name);
+  return run;
+}
+function isAssetDeployed(kind, name, harness, global, projectDir) {
+  if (isDeployed(kind, name, harness, global, projectDir)) return true;
+  if (kind !== "agent" || global || projectDir === void 0) return false;
+  if (isAgentInstanceRendered(projectDir, harness, name)) return true;
+  return runRoleAgentNames(projectDir).has(name) && existsSync(join(agentSourceCacheDir(projectDir), name));
+}
 function instanceRenderedAgentNames(projectDir, harness) {
   const names = /* @__PURE__ */ new Set();
   if (!harnessTargetSupportsAgents(harness)) return names;
@@ -325,7 +391,7 @@ async function extraPayloadEntries(dir, dest) {
     return [];
   }
   if (entries.some((e) => e.name === "MCP.md")) return [];
-  return entries.filter((e) => e.name !== dest && e.name !== "package.json").filter((e) => !(e.isDirectory() ? isNonAssetDir(e.name) : isNonAssetFile(e.name))).map((e) => e.name).sort();
+  return entries.filter((e) => e.name !== dest && e.name !== "package.json").filter((e) => !(e.isDirectory() ? isNonAssetDir(e.name, true) : isNonAssetFile(e.name))).map((e) => e.name).sort();
 }
 async function pruneExtraPayloadFiles(dir, dest) {
   for (const name of await extraPayloadEntries(dir, dest)) {
@@ -1127,7 +1193,7 @@ function parseCanonicalLockKey(key) {
   }
 }
 function labelDiffHeaders(diff, from, to) {
-  const stamp = "\\t(?:\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)? [+-]\\d{4}|[A-Z][a-z]{2} [A-Z][a-z]{2} [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4})";
+  const stamp = "\\t(?:\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?: [+-]\\d{4})?|[A-Z][a-z]{2} [A-Z][a-z]{2} [ \\d]\\d \\d{2}:\\d{2}:\\d{2} \\d{4})";
   return diff.replace(
     new RegExp(`^(---|\\+\\+\\+) (.*?)${stamp}$`, "gm"),
     (_m, mark, file) => `${mark} ${file} (${mark === "---" ? from : to})`
@@ -1159,10 +1225,8 @@ function parseRefTolerant(ref) {
   }
 }
 var LibraryEntryError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "LibraryEntryError";
-  }
+  // The name stays `Error`: a failure prints as `Error: <message>` like every other `add` failure,
+  // never with the class name.
 };
 function keptLockEntries(prev, missing) {
   const out = { assets: {}, sources: [], refs: /* @__PURE__ */ new Set(), keysByRef: /* @__PURE__ */ new Map() };
@@ -1199,6 +1263,16 @@ function withKeptLockEntries(lock, kept) {
     sources: [...sources.values()].sort((a, b) => a.url.localeCompare(b.url))
   };
 }
+function withUnchangedSourceCommits(lock, prev) {
+  if (!prev) return lock;
+  for (const [key, entry] of Object.entries(lock.assets)) {
+    const before = prev.assets[key];
+    if (!entry.source || entry.library || !before?.source || before.library) continue;
+    if (before.sha256 !== entry.sha256 || before.source.url !== entry.source.url) continue;
+    if (before.source.commit) entry.source.commit = before.source.commit;
+  }
+  return lock;
+}
 function relockedRefs(prev, next) {
   if (!prev) return [];
   const fingerprint = (e, key) => [
@@ -1320,9 +1394,19 @@ var MissingManifestError = class extends Error {
 };
 function unlistedAssetMessage(ref, library, libPath, ownership) {
   const head = `${ref} is in library "${library}" but not listed in its skaile.manifest.yaml, so only part of its files would be deployed.`;
+  return isReadOnlyLibrary(libPath, ownership) ? `${head} "${library}" is a read-only source clone: add it to skaile.manifest.yaml in the source repo and push, then run \`skaile source sync\`.` : `${head} Run \`skaile library index ${library}\`, then add it again.`;
+}
+function isSourceCacheClone(libPath) {
   const segments = libPath.split(/[\\/]/);
-  const isReader = ownership === "reader" || segments.some((s, i) => s === "cache" && segments[i + 1] === "sources");
-  return isReader ? `${head} "${library}" is a read-only source clone: add it to skaile.manifest.yaml in the source repo and push, then run \`skaile source sync\`.` : `${head} Run \`skaile library index ${library}\`, then add it again.`;
+  return segments.some((s, i) => s === "cache" && segments[i + 1] === "sources");
+}
+function isReadOnlyLibrary(libPath, ownership) {
+  return ownership === "reader" || isSourceCacheClone(libPath);
+}
+function libraryFixAdvice(library, libPath, ownership, ownerAdvice, readOnlyAdvice) {
+  if (!isReadOnlyLibrary(libPath, ownership)) return ownerAdvice;
+  const refresh = isSourceCacheClone(libPath) ? "skaile source sync" : `skaile library pull ${library}`;
+  return `${readOnlyAdvice}, then run \`${refresh}\`.`;
 }
 function pathEntryExists(p) {
   try {
@@ -1425,8 +1509,16 @@ var AssetManager = class {
   warnedStoreVersionLookups = /* @__PURE__ */ new Set();
   /** Stores a lookup could not reach (store URL -> one line why); `add` reports them instead of "not found". */
   storeFailures = /* @__PURE__ */ new Map();
+  /** The agent `add` is about to bind to an instance: its deploy writes no file named after the asset. */
+  pendingAgentBinding;
   /** Source origins `outdated` could not fetch; read once through {@link takeUnreachableSources}. */
   unreachableSources = [];
+  /** Store-origin refs `outdated` could not check; read once through {@link takeStoreNotChecked}. */
+  storeUnchecked = [];
+  /** How many store lookups failed so far; a lookup that moved it failed. */
+  storeFailureCount = 0;
+  /** Set while a lookup reports its own failure: the generic one-line warning stays off. */
+  quietStoreLookups = false;
   /** Store URLs a lookup failed on because the client is air-gapped (`cache_ttl: 0`), not because the store is down. */
   airGappedStores = /* @__PURE__ */ new Set();
   /** Sources a provenance walk had to skip (source URL → why); one warning per source. */
@@ -1535,7 +1627,7 @@ var AssetManager = class {
    */
   legacySingleCopyHarness(component, name, all) {
     if (!all.includes("omp") || legacyOmpPaths(component, name).length === 0) return [];
-    const others = all.filter((h) => h !== "omp" && isDeployed(component, name, h, true));
+    const others = all.filter((h) => h !== "omp" && isAssetDeployed(component, name, h, true));
     return others.length === 0 ? ["omp"] : [];
   }
   /**
@@ -1681,7 +1773,7 @@ var AssetManager = class {
     if (!declared) return;
     const current = this.harnessRowIn(raw, target) ?? this.defaultGlobalHarnesses();
     for (const h of current) {
-      if (named.includes(h) || !isDeployed(component, target.name, h, true)) continue;
+      if (named.includes(h) || !isAssetDeployed(component, target.name, h, true)) continue;
       const where = deployedPaths(component, target.name, h, true)[0];
       onDropped(ref, h, where ?? deployedDir(component, target.name, h, true));
     }
@@ -1698,7 +1790,7 @@ var AssetManager = class {
     for (const entry of entries) {
       const component = this.installTarget(entry.kind);
       if (!component || !entry.name) continue;
-      if (!isDeployed(component, entry.name, "omp", true)) continue;
+      if (!isAssetDeployed(component, entry.name, "omp", true)) continue;
       const modern = deployedPaths(component, entry.name, "omp", true).filter(
         (p) => p.includes(`${sep}.omp${sep}agent${sep}`)
       );
@@ -1756,6 +1848,14 @@ var AssetManager = class {
   takeUnreachableSources() {
     return this.unreachableSources.splice(0);
   }
+  /**
+   * The refs the last {@link outdated} call could not check because their store did not answer
+   * (`unreachable`) or the client is air-gapped (`air-gapped`): `outdated`, `check` and `doctor`
+   * name them and fail on `unreachable` instead of calling the project up to date.
+   */
+  takeStoreNotChecked() {
+    return this.storeUnchecked.splice(0);
+  }
   /**
    * The harnesses `add` / `install` deploy into: `[harness]` for a project, the global
    * harness set (see {@link AssetManager.targetHarnesses}) for a global manager.
@@ -1795,12 +1895,19 @@ var AssetManager = class {
    * fan-out target (not the constructor's `harness`, which is project-only). */
   deployOptsFor(target, link, onSecretFile, composed) {
     const records = this.global ? void 0 : this.composedRecords();
+    const bound = this.global ? void 0 : boundAgentNames(this.projectDir);
+    if (bound && this.pendingAgentBinding) bound.add(this.pendingAgentBinding);
+    const lockedAgents = this.global ? void 0 : new Set(
+      Object.keys(this.tryReadLock()?.assets ?? {}).map((k) => parseCanonicalLockKey(k).name)
+    );
     return {
       registry: this.registry,
       harness: target,
       global: this.global,
       cwd: this.projectDir,
       link: link === true,
+      ...bound ? { instanceBoundAgents: bound } : {},
+      ...lockedAgents ? { agentLocked: (name) => lockedAgents.has(name) } : {},
       ...onSecretFile ? { onSecretFile: (entry, p) => onSecretFile(canonicalEntryRef(entry), p) } : {},
       ...records ? { lockedComposed: (agent) => records.get(agent) } : {},
       ...composed ? {
@@ -1948,20 +2055,81 @@ var AssetManager = class {
     }
     return restored;
   }
+  /**
+   * Remove the files named after an agent asset that an earlier CLI rendered and this one does
+   * not: the agent is bound by an instance (its rendering is the instance's file), or
+   * it only runs as a `binding: run` role. Only a file the lock lists for the agent, whose bytes
+   * still equal what the lock recorded, and that no instance of the ledger claims is removed;
+   * an edited one stays (it is the user's now) and is named. The old lock entry is rewritten
+   * by the same install, so the lock never keeps a path that is gone.
+   *
+   * @returns The project-relative paths removed.
+   */
+  pruneAssetNamedAgentFiles() {
+    const lock = this.tryReadLock();
+    if (this.global || !lock || !harnessTargetSupportsAgents(this.harness)) return [];
+    const bound = boundAgentNames(this.projectDir);
+    const runRoles = runRoleAgentNames(this.projectDir);
+    const claimedPaths = renderedInstanceFiles(this.projectDir, this.harness).flatMap(
+      (i) => i.files
+    );
+    const claimed = (rel) => claimedPaths.some((c) => rel === c || rel.startsWith(`${c}/`));
+    const agentDir = resolve(deployedBase("agent", this.harness, false, this.projectDir));
+    const removed = [];
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      const { kind, name } = parseCanonicalLockKey(key);
+      if (!kind || !name || this.installTarget(kind) !== "agent" || !entry.rendered?.length) {
+        continue;
+      }
+      if (!bound.has(name) && !runRoles.has(name)) continue;
+      if (!runRoles.has(name) && !isAgentInstanceRendered(this.projectDir, this.harness, name)) {
+        continue;
+      }
+      const named = new Set(this.renderedAgentFiles(name).map((f) => f.path));
+      for (const f of entry.rendered) {
+        if (!named.has(f.path) || claimed(f.path)) continue;
+        const abs = join(this.projectDir, f.path);
+        if (!existsSync(abs)) continue;
+        let intact = false;
+        try {
+          intact = computeHash(abs) === f.sha256;
+        } catch {
+        }
+        if (!intact) {
+          console.warn(
+            `skaile: ${f.path} is no longer written for ${name} (an instance renders it); it was edited, so it stays`
+          );
+          continue;
+        }
+        rmSync(abs, { force: true });
+        removed.push(f.path);
+        for (let dir = dirname(abs); dir.startsWith(agentDir + sep); dir = dirname(dir)) {
+          if (readdirSync(dir).length > 0) break;
+          rmSync(dir, { recursive: true, force: true });
+        }
+      }
+    }
+    return removed;
+  }
   /**
    * Render every agent instance of `skaile.yaml` into the harness target's native
    * agent files (`.claude/agents/<id>.md`, …) and prune the renderings of
    * instances that left the config. Runs after the skills deploy, so composed
    * skills resolve. Project scope only. An instance whose `ref` resolves to no agent is
    * reported in `agentInstanceErrors`; any other render error is warned and swallowed.
+   *
+   * @param opts.prune - Also remove the files named after the agent assets that an earlier CLI
+   *   rendered and an instance renders now ({@link pruneAssetNamedAgentFiles}). Set by the
+   *   commands that rewrite the lock; `install --locked` leaves the lock, so it leaves them.
    */
-  async renderAgentInstances() {
+  async renderAgentInstances(opts) {
     if (this.global) return {};
     try {
       const result = installAgentInstances({
         projectDir: this.projectDir,
         harness: this.harness
       });
+      if (opts?.prune) result.removed.push(...this.pruneAssetNamedAgentFiles());
       const details = [];
       for (const u of unboundAgentInstances(this.projectDir, this.harness)) {
         if (!u.ref.startsWith("agent:")) continue;
@@ -2782,7 +2950,7 @@ var AssetManager = class {
       );
       if (!holder) continue;
       const target = this.targetHarnesses().find(
-        (t) => isDeployed(component, a.name, t, this.global, this.projectDir)
+        (t) => isAssetDeployed(component, a.name, t, this.global, this.projectDir)
       );
       if (!target) continue;
       const dir = deployedDir(component, a.name, target, this.global, this.projectDir);
@@ -2938,6 +3106,26 @@ var AssetManager = class {
     }
     return hidden;
   }
+  /**
+   * The registered libraries as `library list` shows them in this project. A source clone is
+   * cache: its row is read from the clone, so it is dropped when the clone is gone and
+   * when this project does not declare the source. `sources` holds the ids of the clone rows
+   * that stay, so the list can mark them `(source)`.
+   */
+  scopeLibraryList(libraries) {
+    const hidden = this.undeclaredSourceClones(libraries);
+    const sources = /* @__PURE__ */ new Set();
+    const shown = [];
+    for (const l of libraries) {
+      if (hidden.has(l.id)) continue;
+      if (this.sourceCloneKey(l) !== void 0) {
+        if (libraryDirMissing(l)) continue;
+        sources.add(l.id);
+      }
+      shown.push(l);
+    }
+    return { libraries: shown, sources };
+  }
   /**
    * The index as this project sees it: the source clones of other projects are dropped
    * ({@link undeclaredSourceClones}) and the assets of a declared source carry the publisher
@@ -3216,7 +3404,7 @@ var AssetManager = class {
         continue;
       }
       const component = this.installTarget(kind);
-      const deployed = component !== void 0 && isDeployed(component, name, this.harness, this.global, this.projectDir);
+      const deployed = component !== void 0 && isAssetDeployed(component, name, this.harness, this.global, this.projectDir);
       const problem = lockedLibraryProblem(lookup, e.library, `${kind}:@${publisher}/${name}`);
       const kept = deployed ? "the deployed copy and its lock entry are kept" : "its lock entry is kept; no deployed copy exists";
       lines.push(`${ref} (${problem}; ${kept})`);
@@ -3286,7 +3474,7 @@ var AssetManager = class {
         const component = this.installTarget(kind);
         const newer = gt(coerceVersion(current), coerceVersion(origin.version));
         const comparable = !isPseudoVersion(current) && !isPseudoVersion(origin.version);
-        const intact = (newer || comparable) && (component === void 0 || isDeployed(component, name, this.harness, this.global, this.projectDir));
+        const intact = (newer || comparable) && (component === void 0 || isAssetDeployed(component, name, this.harness, this.global, this.projectDir));
         if (!intact) {
           missing.push(
             `${ref} (library "${lookup.name}" is at ${current}, locked ${origin.version}${newer || comparable ? "; `skaile update` moves the lock to it" : ""})`
@@ -3398,7 +3586,7 @@ var AssetManager = class {
       if (want.publisher && id.publisher !== want.publisher) continue;
       const component = this.installTarget(id.kind);
       if (component !== void 0) {
-        if (isDeployed(component, id.name, this.harness, this.global, this.projectDir)) return true;
+        if (isAssetDeployed(component, id.name, this.harness, this.global, this.projectDir)) return true;
       } else if (id.kind === "mcp-server" && !this.global && await mcpCommittedRenderIntact(this.projectDir, this.harness, id.name)) {
         return true;
       }
@@ -3408,7 +3596,7 @@ var AssetManager = class {
   /** Whether the deployed copy of a library asset is on disk; a kind with no install target has none to check. */
   lockedCopyDeployed(kind, name) {
     const component = this.installTarget(kind);
-    return component === void 0 || isDeployed(component, name, this.harness, this.global, this.projectDir);
+    return component === void 0 || isAssetDeployed(component, name, this.harness, this.global, this.projectDir);
   }
   /**
    * The library-origin lock entries `install` keeps when the library holds a newer version:
@@ -4179,6 +4367,7 @@ var AssetManager = class {
    * @returns {@link InstallResult} summarising what was deployed, what was missing, and any collisions.
    */
   async install(opts) {
+    resetMissingParentWarnings();
     const config = this.loadConfig();
     const { repositories, sources, stores, overrides, patches } = config;
     const dependencies = [...config.dependencies, ...this.lockedAgentBindings(config.dependencies)];
@@ -4375,13 +4564,64 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
       );
     }
     const inferredHarnesses = this.inferLegacyHarnessSubsets(entries);
+    const restoredRefs = stillMissing.filter((m) => {
+      const keys = kept.keysByRef.get(m) ?? [];
+      return keys.length > 0 && keys.every((k) => restoredFromStore.has(k));
+    });
+    const reportedMissing = stillMissing.filter(
+      (m) => !storeNotChecked.some((n) => n.ref === m) && !restoredRefs.includes(m)
+    );
+    for (const n of storeNotChecked) delete missingHints[n.ref];
+    for (const m of restoredRefs) delete missingHints[m];
+    const editedHeld = new Set(
+      (await this.lockedCopyDrift()).filter((d) => d.libraryChanged).map((d) => d.ref)
+    );
+    const heldEdits = editedHeld.size > 0 && opts?.moveLibraries !== true ? (await this.projectState()).gaps.filter((g) => g.type === "modified" && editedHeld.has(g.ref)).map((g) => g.message) : [];
+    const composedPre = /* @__PURE__ */ new Set();
+    if (!this.global && opts?.moveLibraries !== true) {
+      for (const e of entries) {
+        if (this.installTarget(e.kind) !== "agent") continue;
+        try {
+          for (const composeRef of composedDriftRefs(e, this.deployOptsFor(this.harness))) {
+            composedPre.add(this.composedDriftLine(canonicalEntryRef(e), composeRef));
+          }
+        } catch {
+        }
+      }
+    }
+    const unbound = this.global ? { errors: [], details: [] } : await this.unboundInstanceErrors(entries);
+    const failing = [
+      ...reportedMissing,
+      ...versionBlocked.filter((b) => !reportedMissing.includes(b)),
+      ...composedPre,
+      ...heldEdits.filter((h) => !reportedMissing.includes(h))
+    ];
+    const storeUnreachable = storeNotChecked.some((n) => n.reason === "unreachable");
+    if (failing.length > 0 || contentHeld.length > 0 || storeUnreachable || unbound.errors.length > 0) {
+      await this.adviseMissing(reportedMissing, missingHints);
+      for (const e of unbound.errors) console.warn(`skaile: ${e}`);
+      return {
+        deployed: [],
+        removed: [],
+        missing: failing,
+        ...storeNotChecked.length > 0 ? { storeNotChecked } : {},
+        ...Object.keys(missingHints).length > 0 ? { missingHints } : {},
+        ...contentHeld.length > 0 ? { contentHeld } : {},
+        ...unbound.errors.length > 0 ? { agentInstanceErrors: unbound.errors } : {},
+        ...unbound.details.length > 0 ? { agentInstanceDetails: unbound.details } : {},
+        lockWritten: false,
+        npmInstalled: [],
+        npmFailed: [],
+        presets
+      };
+    }
     const { removed, replaced } = this.reconcileRemovedAssets(
       resolved,
       /* @__PURE__ */ new Set([...Object.keys(libraryLock), ...Object.keys(kept.assets)])
     );
     const copyDrift = await this.lockedCopyDrift();
     const missingCopies = await this.incompleteDeploys();
-    const unrecordedAgents = this.unrecordedAgentFiles(prevLock);
+    const unrecordedRenderings = this.unrecordedRenderings(prevLock);
     const composedDrift = /* @__PURE__ */ new Set();
     const deployed = [
       ...new Set(
@@ -4400,24 +4640,37 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
     ];
     this.sweepLegacyOmpCopies(entries);
     const mcpRestored = await this.renderHarnessMcpConfig();
-    const agentRender = await this.renderAgentInstances();
+    const agentRender = await this.renderAgentInstances({ prune: true });
+    if (agentRender.agentFilesRemoved?.length) {
+      for (const t of this.targetHarnesses()) {
+        deployAll(
+          this.entriesForHarness(entries, t),
+          repositories,
+          patches,
+          this.deployOptsFor(t, opts?.link, void 0, { refresh: false, onDrift: () => {
+          } })
+        );
+      }
+    }
+    const { rewritten, restored: restoredRenderings } = this.changedRenderings(unrecordedRenderings);
     const restored = [
       ...this.restoredCopies(copyDrift, deployed, missingCopies),
       ...relockRemoved,
-      ...mcpRestored
+      ...mcpRestored,
+      ...restoredRenderings
     ];
-    const rewritten = this.rewrittenAgentFiles(unrecordedAgents);
-    const editedHeld = new Set(copyDrift.filter((d) => d.libraryChanged).map((d) => d.ref));
-    const heldEdits = editedHeld.size > 0 && opts?.moveLibraries !== true ? (await this.projectState()).gaps.filter((g) => g.type === "modified" && editedHeld.has(g.ref)).map((g) => g.message) : [];
     const lockWanted = resolved.length > 0 || lib.entries.length > 0 || existsSync(this.lockPath);
     let lockWritten = false;
     let relocked = [];
     let moved = [];
     if (lockWanted) {
-      const lockData = this.withCopiedFiles(
-        this.withRenderedAgents(
-          withKeptLockEntries(freshLock, kept),
-          opts?.moveLibraries ? void 0 : prevLock
+      const lockData = withUnchangedSourceCommits(
+        this.withCopiedFiles(
+          this.withRenderedAgents(
+            withKeptLockEntries(freshLock, kept),
+            opts?.moveLibraries ? void 0 : prevLock
+          ),
+          prevLock
         ),
         prevLock
       );
@@ -4428,33 +4681,16 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
     }
     this.recordInstallHistory(deployed, removed);
     const { npmInstalled, npmFailed } = await this.installRuntimeAssetDeps();
-    const restoredRefs = stillMissing.filter((m) => {
-      const keys = kept.keysByRef.get(m) ?? [];
-      return keys.length > 0 && keys.every((k) => restoredFromStore.has(k));
-    });
-    const reportedMissing = stillMissing.filter(
-      (m) => !storeNotChecked.some((n) => n.ref === m) && !restoredRefs.includes(m)
-    );
-    for (const n of storeNotChecked) delete missingHints[n.ref];
-    for (const m of restoredRefs) delete missingHints[m];
-    await this.adviseMissing(reportedMissing, missingHints);
     const placeholderBodies = scaffoldBodyRefs(lib.entries, deployed);
     const placeholderDescriptions = scaffoldDescriptionRefs(lib.entries, deployed);
     return {
       deployed,
       removed,
-      missing: [
-        ...reportedMissing,
-        ...versionBlocked.filter((b) => !reportedMissing.includes(b)),
-        ...composedDrift,
-        ...heldEdits.filter((h) => !reportedMissing.includes(h))
-      ],
+      missing: [...composedDrift],
       ...placeholderBodies.length > 0 ? { placeholderBodies } : {},
       ...placeholderDescriptions.length > 0 ? { placeholderDescriptions } : {},
       ...storeNotChecked.length > 0 ? { storeNotChecked } : {},
-      ...Object.keys(missingHints).length > 0 ? { missingHints } : {},
       ...relocked.length > 0 ? { relocked } : {},
-      ...contentHeld.length > 0 ? { contentHeld } : {},
       ...inferredHarnesses.length > 0 ? { inferredHarnesses } : {},
       ...moved.length > 0 ? { moved } : {},
       ...replaced.length > 0 ? { replaced } : {},
@@ -4955,6 +5191,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
    * name), so `add` can say `store unreachable` instead of a bare `Asset not found`.
    */
   noteStoreFailure(storeUrl, err) {
+    this.storeFailureCount++;
     const text = err instanceof OfflineError ? `${storeUrl}: air-gapped (catalog.cache_ttl: 0), the store was not asked` : describeCatalogError(err, storeUrl);
     this.storeFailures.set(storeUrl, text);
     if (err instanceof OfflineError) this.airGappedStores.add(storeUrl);
@@ -5007,7 +5244,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
           return await src.listVersions(ref);
         } catch (err) {
           const text = this.noteStoreFailure(storeUrl, err);
-          if (!this.warnedStoreVersionLookups.has(storeUrl)) {
+          if (!this.quietStoreLookups && !this.warnedStoreVersionLookups.has(storeUrl)) {
             this.warnedStoreVersionLookups.add(storeUrl);
             console.warn(`skaile: store lookup of ${ref} failed: ${text}`);
           }
@@ -5199,9 +5436,39 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
         npmFailed: []
       };
     }
+    const alreadyMissing = new Set(
+      library.missing.map((m) => {
+        const p = parseRefTolerant(m.split(" ")[0] ?? m);
+        return p ? `${p.kind}:${p.name}` : m;
+      })
+    );
+    const viaStoreIds = new Set(library.viaStore.map(gapIdentity));
+    const lockGaps = async (only) => (await this.projectState()).gaps.filter((g) => {
+      if (only && !only.has(g.type)) return false;
+      if (g.type === "agent") return false;
+      if (g.unreadableSource) return false;
+      if ((g.type === "library" || g.type === "unresolved") && viaStoreIds.has(gapIdentity(g.ref))) {
+        return false;
+      }
+      const p = parseRefTolerant(g.ref);
+      return !(p && alreadyMissing.has(`${p.kind}:${p.name}`));
+    }).map((g) => g.message);
+    const unfixable = await lockGaps(
+      /* @__PURE__ */ new Set(["declared", "invalid", "pin", "library", "content", "source"])
+    );
+    if (unfixable.length > 0) {
+      return {
+        deployed: [],
+        removed: [],
+        missing: unfixable,
+        lockWritten: false,
+        npmInstalled: [],
+        npmFailed: []
+      };
+    }
     const copyDrift = await this.lockedCopyDrift();
     const missingCopies = await this.incompleteDeploys();
-    const unrecordedAgents = this.unrecordedAgentFiles(lock);
+    const unrecordedRenderings = this.unrecordedRenderings(lock);
     const composedDrift = /* @__PURE__ */ new Set();
     const deployed = [
       ...new Set(
@@ -5221,24 +5488,13 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     this.sweepLegacyOmpCopies([...resolved, ...library.entries]);
     const mcpRestored = await this.renderHarnessMcpConfig();
     const agentRender = await this.renderAgentInstances();
-    const restored = [...this.restoredCopies(copyDrift, deployed, missingCopies), ...mcpRestored];
-    const rewritten = this.rewrittenAgentFiles(unrecordedAgents);
-    const alreadyMissing = new Set(
-      library.missing.map((m) => {
-        const p = parseRefTolerant(m.split(" ")[0] ?? m);
-        return p ? `${p.kind}:${p.name}` : m;
-      })
-    );
-    const viaStoreIds = new Set(library.viaStore.map(gapIdentity));
-    const gaps = (await this.projectState()).gaps.filter((g) => {
-      if (g.type === "agent") return false;
-      if (g.unreadableSource) return false;
-      if ((g.type === "library" || g.type === "unresolved") && viaStoreIds.has(gapIdentity(g.ref))) {
-        return false;
-      }
-      const p = parseRefTolerant(g.ref);
-      return !(p && alreadyMissing.has(`${p.kind}:${p.name}`));
-    }).map((g) => g.message);
+    const { rewritten, restored: restoredRenderings } = this.changedRenderings(unrecordedRenderings);
+    const restored = [
+      ...this.restoredCopies(copyDrift, deployed, missingCopies),
+      ...mcpRestored,
+      ...restoredRenderings
+    ];
+    const gaps = await lockGaps();
     const libraryNotices = this.storeRestoreNotices(
       lock,
       library.viaStore,
@@ -5345,14 +5601,16 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     return found;
   }
   /**
-   * The `Did you mean agent:@pub/name?` sentence for a ref written without a kind (`@pub/name`,
-   * which means `skill`) that names no asset: the refs of other kinds under the same name that
-   * a source, a library, the lock or `skaile.yaml` holds (p1425). `undefined` when the ref has a
-   * kind or nothing of another kind answers to it. `add`, `diff`, `update`, `info`, `remove` and
+   * The sentence that ends the not-found line of a ref that names no asset but whose name exists
+   * under another kind: refs of other kinds under the same name that a source, a library, the
+   * lock or `skaile.yaml` holds. For a ref written without a kind (`@pub/name`, which means
+   * `skill`) it is `Did you mean agent:@pub/name?`; for a kind-qualified ref of the wrong
+   * kind (`skill:@pub/captain`) it is `It is an agent: agent:@pub/captain.`. `undefined`
+   * when nothing of another kind answers to it. `add`, `diff`, `update`, `info`, `remove` and
    * `why` end their not-found line with it.
    */
   async otherKindHint(ref) {
-    if (/^[^@/#\s]+:/.test(ref.trim())) return void 0;
+    const kinded = /^[^@/#\s]+:/.test(ref.trim());
     const parsed = parseRefTolerant(ref);
     if (!parsed) return void 0;
     const wantPublisher = parsed.publisher?.replace(/^@/, "");
@@ -5376,6 +5634,14 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     }
     const refs = [...found].sort();
     if (refs.length === 0) return void 0;
+    if (kinded) {
+      try {
+        if (await this.info(ref) !== null) return void 0;
+      } catch {
+      }
+      const kinds = refs.map((r) => parseRefTolerant(r)?.kind ?? "");
+      return refs.length === 1 ? `It is ${/^[aeiou]/.test(kinds[0]) ? "an" : "a"} ${kinds[0]}: ${refs[0]}.` : `It exists as another kind: ${refs.join(", ")}.`;
+    }
     return refs.length === 1 ? `Did you mean ${refs[0]}?` : `Did you mean one of: ${refs.join(", ")}?`;
   }
   /**
@@ -5519,6 +5785,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
    *   preset's items do not all resolve (nothing is deployed or recorded then).
    */
   async add(ref, opts) {
+    resetMissingParentWarnings();
     const { repositories, sources, stores, dependencies, overrides, patches } = this.loadConfig();
     const parsed = await this.parseAddRef(ref, repositories, sources);
     this.ensureSourceClonesQuiet(repositories, sources);
@@ -5569,7 +5836,13 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
         );
         if (gone) {
           throw new Error(
-            `library "${l.name}" lists ${parsed.kind}:${parsed.name} but its directory ${gone.root}/ is missing: run \`skaile library index ${l.name}\` to drop the entry, or restore the directory.`
+            `library "${l.name}" lists ${parsed.kind}:${parsed.name} but its directory ${gone.root}/ is missing: ` + libraryFixAdvice(
+              l.name,
+              libPath,
+              l.ownership,
+              `run \`skaile library index ${l.name}\` to drop the entry, or restore the directory.`,
+              `"${l.name}" is a read-only clone: ask the owner to push ${gone.root}/ or drop the entry from skaile.manifest.yaml`
+            )
           );
         }
       }
@@ -5587,7 +5860,13 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
               publisher: bare(renamed.publisher)
             }) : `${renamed.kind}:${renamed.name}`;
             throw new Error(
-              `${shown}: ${renamed.file} now names "${renamed.now}", so the library entry is a ref \`add\` cannot resolve. Run \`skaile library index ${l.name}\` to rename the entry, or restore the name.`
+              `${shown}: ${renamed.file} now names "${renamed.now}", so the library entry is a ref \`add\` cannot resolve. ` + libraryFixAdvice(
+                l.name,
+                libPath,
+                l.ownership,
+                `Run \`skaile library index ${l.name}\` to rename the entry, or restore the name.`,
+                `"${l.name}" is a read-only clone: ask the owner to rename the entry in skaile.manifest.yaml or restore the name and push`
+              )
             );
           }
         }
@@ -5611,7 +5890,13 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
             throw new Error(
               `${parsed.kind}:${parsed.name} in library "${l.name}" fails the checks of \`skaile validate\` - nothing was added:
 ${problems.map((line) => `  ${line}`).join("\n")}
-Fix the asset, then run \`skaile library index ${l.name}\` and add it again.`
+` + libraryFixAdvice(
+                l.name,
+                libPath,
+                l.ownership,
+                `Fix the asset, then run \`skaile library index ${l.name}\` and add it again.`,
+                `Fix the asset in the source repo, or ask the owner to fix it and push`
+              )
             );
           }
         }
@@ -5775,22 +6060,29 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     const harnessNamed = this.global && (this.harnessesOverride?.length ?? 0) > 0;
     if (harnessNamed && opts?.only && opts.onDroppedCopy)
       this.reportDroppedCopies(parsed, opts.onDroppedCopy);
-    const deployed = [
-      ...new Set(
-        this.targetHarnesses().flatMap(
-          (t) => deployAll(
-            harnessNamed ? entries : this.entriesForHarness(entries, t),
-            repositories,
-            patches,
-            this.deployOptsFor(t, opts?.link, opts?.onSecretFile, {
-              refresh: true,
-              onDrift: () => {
-              }
-            })
+    const willBind = opts?.preferLockedLibrary ? void 0 : this.bindAgentInstance(entries, parsed, false);
+    this.pendingAgentBinding = willBind && willBind.keptRef === void 0 ? parsed.name : void 0;
+    let deployed;
+    try {
+      deployed = [
+        ...new Set(
+          this.targetHarnesses().flatMap(
+            (t) => deployAll(
+              harnessNamed ? entries : this.entriesForHarness(entries, t),
+              repositories,
+              patches,
+              this.deployOptsFor(t, opts?.link, opts?.onSecretFile, {
+                refresh: true,
+                onDrift: () => {
+                }
+              })
+            )
           )
         )
-      )
-    ];
+      ];
+    } finally {
+      this.pendingAgentBinding = void 0;
+    }
     this.sweepLegacyOmpCopies(entries);
     if (opts?.onLibraryOrigin) {
       for (const e of lib.entries) {
@@ -5814,7 +6106,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       else if (bound) opts?.onAgentBound?.(bound.id, bound.ref);
     }
     await this.renderHarnessMcpConfig();
-    await this.renderAgentInstances();
+    await this.renderAgentInstances({ prune: true });
     if (resolved.length > 0 || lib.entries.length > 0) {
       await this.warnUncommittedLibraryAssets(lib);
       const libraryLock = await this.libraryLockEntries(lib);
@@ -6233,7 +6525,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       if (!parsed) continue;
       const component = this.installTarget(parsed.kind);
       if (!component) continue;
-      if (!isDeployed(component, parsed.name, this.harness, this.global, this.projectDir)) {
+      if (!isAssetDeployed(component, parsed.name, this.harness, this.global, this.projectDir)) {
         out.push(ref);
       }
     }
@@ -6394,7 +6686,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     if (!component) return void 0;
     const current = this.entryHarnessRecord(target.kind, target.name, target.publisher) ?? this.defaultGlobalHarnesses();
     const left = current.filter((h) => !this.harnessesOverride?.includes(h));
-    const holding = left.filter((h) => isDeployed(component, target.name, h, true));
+    const holding = left.filter((h) => isAssetDeployed(component, target.name, h, true));
     return holding.length > 0 ? holding : void 0;
   }
   /** Limit the declared global entry of `target` to `harnesses` (`~/.skaile/skaile.yaml`). */
@@ -6776,7 +7068,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         if (!component) {
           state = "installed";
         } else {
-          const onDisk = isDeployed(
+          const onDisk = isAssetDeployed(
             component,
             parsed.name,
             this.harness,
@@ -6941,7 +7233,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
           state = "declared";
         } else {
           const component = this.installTarget(parsed.kind);
-          state = !component || isDeployed(component, parsed.name, harness, true) ? "installed" : "drift";
+          state = !component || isAssetDeployed(component, parsed.name, harness, true) ? "installed" : "drift";
         }
         out.push({ ref, kind: parsed.kind, name: parsed.name, state, harness });
       }
@@ -7218,7 +7510,25 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       const decl = repositories[slug];
       if (!decl) continue;
       const status = checkRepoStatus(decl, slug, this.reposDir);
+      if (status.kind === "remote" && !status.localHead && status.error === "Not cloned yet" && decl.path !== void 0 && existsSync(decl.path) && readdirSync(decl.path).length > 0) {
+        this.unreachableSources.push({
+          name: sourceShortName(src.url),
+          url: src.url,
+          reason: "its clone folder holds no git checkout; run `skaile source sync` to clone it again",
+          notCompared: true
+        });
+        continue;
+      }
       if (status.kind !== "remote" || !status.localHead) continue;
+      if (status.cloneOrigin !== void 0) {
+        this.unreachableSources.push({
+          name: sourceShortName(src.url),
+          url: src.url,
+          reason: status.error ?? "clone origin differs from the declared url",
+          notCompared: true
+        });
+        continue;
+      }
       if (status.error !== void 0) {
         this.unreachableSources.push({
           name: sourceShortName(src.url),
@@ -7350,6 +7660,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     await this.addRekeyRows(lock, result);
     await this.addPinnedRows(lock, result);
+    await this.probeStoreOrigins();
     return this.addLockGapRows(result);
   }
   /**
@@ -7398,10 +7709,23 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         continue;
       }
       let latest;
+      const storeOrigin = lockedKey ? lock.assets[lockedKey]?.origin === "store" : false;
+      const failuresBefore = this.storeFailureCount;
+      this.quietStoreLookups = storeOrigin;
       try {
         latest = (await this.availableVersions(parsed, stores))[0];
       } catch {
         continue;
+      } finally {
+        this.quietStoreLookups = false;
+      }
+      if (storeOrigin && this.storeFailureCount !== failuresBefore) {
+        this.storeUnchecked.push({
+          ref: `${parsed.kind}:@${publisher}/${parsed.name}#${parsed.pin}`,
+          reason: [...this.storeFailures.keys()].every((url) => this.airGappedStores.has(url)) ? "air-gapped" : "unreachable",
+          detail: [...this.storeFailures.values()].join("; ")
+        });
+        continue;
       }
       if (!latest || isPseudoVersion(latest)) continue;
       if (!gt(coerceVersion(latest), coerceVersion(locked))) continue;
@@ -7416,6 +7740,49 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       });
     }
   }
+  /**
+   * Ask the stores about every locked asset whose lock entry says `origin: store`, and record
+   * those no store could be asked about (the URL did not answer, or the client is air-gapped)
+   * for {@link takeStoreNotChecked}. `outdated` runs it, and so do `check` and `doctor`, which
+   * otherwise never ask a store: without it a dead store reads as "everything is fine".
+   * A store that answers, and a client that skips the store on purpose
+   * (`catalogUrl: ''`, `--no-catalog`), record nothing. A ref already recorded is not asked again.
+   */
+  async probeStoreOrigins() {
+    const lock = this.tryReadLock();
+    if (!lock) return;
+    const { stores } = this.loadConfig();
+    const seen = new Set(this.storeUnchecked.map((n) => n.ref.split("#")[0]));
+    for (const [key, entry] of Object.entries(lock.assets)) {
+      if (entry.origin !== "store") continue;
+      const id = parseCanonicalLockKey(key);
+      if (!id.version || !id.publisher || isPseudoVersion(id.version)) continue;
+      const identity = `${id.kind}:@${id.publisher.replace(/^@/, "")}/${id.name}`;
+      if (seen.has(identity)) continue;
+      let parsed;
+      try {
+        parsed = parseAssetRef(`${identity}#${id.version}`);
+      } catch {
+        continue;
+      }
+      const failuresBefore = this.storeFailureCount;
+      this.quietStoreLookups = true;
+      try {
+        await this.availableVersions(parsed, stores);
+      } catch {
+        continue;
+      } finally {
+        this.quietStoreLookups = false;
+      }
+      if (this.storeFailureCount === failuresBefore) continue;
+      seen.add(identity);
+      this.storeUnchecked.push({
+        ref: `${identity}#${id.version}`,
+        reason: [...this.storeFailures.keys()].every((url) => this.airGappedStores.has(url)) ? "air-gapped" : "unreachable",
+        detail: [...this.storeFailures.values()].join("; ")
+      });
+    }
+  }
   /**
    * List a source asset locked under a `0.0.0-sha.<commit>` key whose file now declares a
    * version: the next `install` or `update` re-keys it (`replaced 0.0.0-sha.7de3555 → 0.2.0`),
@@ -7914,7 +8281,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         const dep = memberIdentity(depToStr(req));
         if (!dep) continue;
         const depComponent = this.installTarget(dep.kind);
-        if (depComponent && !isDeployed(depComponent, dep.name, this.harness, this.global, this.projectDir)) {
+        if (depComponent && !isAssetDeployed(depComponent, dep.name, this.harness, this.global, this.projectDir)) {
           const inRepos = await resolveAsset({ kind: dep.kind, name: dep.name }, repositories, this.reposDir, {
             knownKinds: this.knownKinds
           }) !== null;
@@ -8134,6 +8501,20 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         unreadableSource: true
       });
     }
+    for (const decl of Object.values(this.loadConfig().repositories)) {
+      if (!decl.url || decl.factory || !decl.path) continue;
+      const actual = cloneOriginMismatch(decl.path, decl.url);
+      if (actual === void 0) continue;
+      const reason = `clone origin ${actual} differs from declared ${decl.url.replace(/[^/\s@]+@/g, "***@")}`;
+      gaps.push({
+        type: "source",
+        ref: decl.url,
+        reason,
+        message: `source ${sourceShortName(decl.url)}: ${reason}`,
+        manualFix: true,
+        unreadableSource: true
+      });
+    }
     for (const u of unboundAgentInstances(this.projectDir, this.harness)) {
       const reason = u.ref.startsWith("agent:") ? await this.unboundAgentReason(u.id, u.ref) : `is bound by agent instance "${u.id}" but resolves to no agent.yaml \u2014 fix the path, or drop the binding from skaile.yaml`;
       gaps.push({
@@ -8167,6 +8548,33 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       return void 0;
     }
   }
+  /**
+   * The agent instances whose `ref` binds to no agent and that the install about to run does not
+   * deploy (`entries`), worded as `renderAgentInstances` words them (`errors`, and the resolver's
+   * own text in `details` for `--verbose`). The install cannot fix them, and its instance render
+   * after the deploy would end the run `Failed` having rewritten files. A ref the `entries` hold
+   * binds once they are deployed, so it is no cause.
+   */
+  async unboundInstanceErrors(entries) {
+    const errors = [];
+    const details = [];
+    for (const u of unboundAgentInstances(this.projectDir, this.harness)) {
+      if (!u.ref.startsWith("agent:")) {
+        errors.push(u.error);
+        continue;
+      }
+      const want = parseRefTolerant(u.ref);
+      const wantPublisher = want?.publisher?.replace(/^@/, "");
+      const deployedNow = entries.some(
+        (e) => e.kind === "agent" && e.name === want?.name && (!wantPublisher || !e.publisher || e.publisher.replace(/^@/, "") === wantPublisher)
+      );
+      if (deployedNow) continue;
+      details.push(u.error);
+      const { lead, advice } = await this.unboundAgentAdvice(u.ref);
+      errors.push(`agent instance "${u.id}" is bound to ${u.ref} but ${lead} \u2014 ${advice}`);
+    }
+    return { errors, details };
+  }
   /**
    * Why the `agent:` ref of agent instance `id` binds to nothing, as the phrase that follows
    * the ref in a {@link LockGap}; see {@link AssetManager.unboundAgentAdvice}.
@@ -8572,10 +8980,14 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    */
   withRenderedAgents(lock, keepComposedOf) {
     if (this.global) return lock;
+    const noAssetFile = /* @__PURE__ */ new Set([
+      ...boundAgentNames(this.projectDir),
+      ...runRoleAgentNames(this.projectDir)
+    ]);
     for (const [key, entry] of Object.entries(lock.assets)) {
       if (entry.rendered || entry.library?.installed) continue;
       const { kind, name } = parseCanonicalLockKey(key);
-      if (!kind || !name || this.installTarget(kind) !== "agent") continue;
+      if (!kind || !name || this.installTarget(kind) !== "agent" || noAssetFile.has(name)) continue;
       const rendered = this.renderedAgentFiles(name);
       if (rendered.length > 0) entry.rendered = rendered;
     }
@@ -8685,37 +9097,94 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     return out.sort((a, b) => a.path.localeCompare(b.path));
   }
   /**
-   * The rendered native files of every locked agent whose lock entry records no `rendered:`
-   * (a lock an older CLI wrote), as path → sha256, taken before a deploy. `check` cannot tell
-   * such a file from a stale one, so {@link rewrittenAgentFiles} compares it afterwards.
-   * Project mode only.
+   * The lock key of the agent entry an agent instance's `ref` names, or `undefined` when no locked
+   * agent matches (a path ref has no entry).
    */
-  unrecordedAgentFiles(lock) {
-    const out = /* @__PURE__ */ new Map();
-    if (this.global || !lock) return out;
+  agentKeyOfRef(agentKeys, ref) {
+    const want = parseRefTolerant(ref);
+    if (!want || want.kind !== "agent") return void 0;
+    const wantPublisher = want.publisher?.replace(/^@/, "");
+    return agentKeys.find((k) => {
+      const p = parseCanonicalLockKey(k);
+      return p.name === want.name && (wantPublisher === void 0 || p.publisher === wantPublisher);
+    });
+  }
+  /**
+   * The rendered native files of every locked agent that the lock does not list under
+   * `rendered:` (a lock an older CLI wrote), as path → sha256 per lock key, taken before a
+   * deploy. `check` cannot tell such a file from a stale one, so {@link changedRenderings}
+   * compares it afterwards. `agent` holds the asset-named files of an entry with no `rendered:`
+   * at all (5.11.0 and older); `instance` the files of agent instances the entry's `rendered:`
+   * does not list yet (5.13.0 and older), which the instance render rewrites. Project mode only.
+   */
+  unrecordedRenderings(lock) {
+    const agent = /* @__PURE__ */ new Map();
+    const instance = /* @__PURE__ */ new Map();
+    if (this.global || !lock) return { agent, instance };
+    const agentKeys = [];
+    const own = /* @__PURE__ */ new Set();
     for (const [key, entry] of Object.entries(lock.assets)) {
-      if (entry.rendered || entry.library?.installed) continue;
+      if (entry.library?.installed) continue;
       const { kind, name } = parseCanonicalLockKey(key);
       if (!kind || !name || this.installTarget(kind) !== "agent") continue;
+      agentKeys.push(key);
       const files = this.renderedAgentFiles(name);
-      if (files.length > 0) out.set(key, new Map(files.map((f) => [f.path, f.sha256])));
+      for (const f of files) own.add(f.path);
+      if (!entry.rendered && files.length > 0) {
+        agent.set(key, new Map(files.map((f) => [f.path, f.sha256])));
+      }
     }
-    return out;
+    for (const bound of renderedInstanceFiles(this.projectDir, this.harness)) {
+      const key = this.agentKeyOfRef(agentKeys, bound.ref);
+      if (!key) continue;
+      const listed = new Set((lock.assets[key]?.rendered ?? []).map((f) => f.path));
+      const files = [];
+      for (const rel of bound.files) this.hashTree(join(this.projectDir, rel), files);
+      const held = instance.get(key) ?? /* @__PURE__ */ new Map();
+      for (const f of files) {
+        if (!listed.has(f.path) && !own.has(f.path)) held.set(f.path, f.sha256);
+      }
+      if (held.size > 0) instance.set(key, held);
+    }
+    return { agent, instance };
   }
   /**
-   * The agent files a deploy changed that {@link unrecordedAgentFiles} saw before it: one row
-   * per locked agent, listing the project-relative paths whose bytes differ now. A render the
-   * CLI changed (the 5.12.0 abilities block) otherwise reaches the user as a silent rewrite.
+   * The notice `check` and `outdated` print for a lock written before it listed the rendered
+   * agent files and the files of agent instances: the next `install`, `add` or `update`
+   * adds the list and rewrites those files from the render, so a hand edit of one is lost.
+   * Empty for a current lock, and in global mode.
    */
-  rewrittenAgentFiles(before) {
-    const out = [];
-    for (const [key, files] of before) {
+  legacyLockNotices() {
+    const before = this.unrecordedRenderings(this.tryReadLock());
+    if (before.agent.size === 0 && before.instance.size === 0) return [];
+    return ["lock predates instance files: run skaile update"];
+  }
+  /**
+   * What a deploy changed among the files {@link unrecordedRenderings} saw before it. `rewritten`
+   * is one row per locked agent whose asset-named files differ now: a render the CLI changed (the
+   * 5.12.0 abilities block) otherwise reaches the user as a silent rewrite. `restored` is one row
+   * per agent whose instance files differ now: the render replaced them, a hand edit included.
+   */
+  changedRenderings(before) {
+    const rewritten = [];
+    const restored = [];
+    for (const [key, files] of before.agent) {
       const { name } = parseCanonicalLockKey(key);
       if (!name) continue;
       const changed = this.renderedAgentFiles(name).filter((f) => files.has(f.path) && files.get(f.path) !== f.sha256).map((f) => f.path);
-      if (changed.length > 0) out.push({ ref: key, files: changed });
+      if (changed.length > 0) rewritten.push({ ref: key, files: changed });
     }
-    return out;
+    for (const [key, files] of before.instance) {
+      const changed = [];
+      for (const [file, sha] of files) {
+        try {
+          if (computeHash(join(this.projectDir, file)) !== sha) changed.push(file);
+        } catch {
+        }
+      }
+      if (changed.length > 0) restored.push({ ref: key, restored: changed.sort(), removed: [] });
+    }
+    return { rewritten, restored };
   }
   /**
    * The {@link RestoredAsset} rows for the drifted copies (see {@link lockedCopyDrift}) a
@@ -8985,7 +9454,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       const { publisher, kind, name } = parseCanonicalLockKey(key);
       const component = kind ? this.installTarget(kind) : void 0;
       if (!kind || !name || !component || named.has(`${kind}:${name}`)) continue;
-      if (isDeployed(component, name, this.harness, this.global, this.projectDir)) {
+      if (isAssetDeployed(component, name, this.harness, this.global, this.projectDir)) {
         const renderedGone = component === "agent" && !this.global && (entry.rendered ?? []).some((f) => !existsSync(join(this.projectDir, f.path)));
         if (!renderedGone) continue;
       }
@@ -9502,7 +9971,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    * @returns the instance id and ref bound; the id with `keptRef` (what that id binds instead)
    * when the id is taken by another agent; `undefined` when nothing was bound and nothing needs saying.
    */
-  bindAgentInstance(entries, parsed) {
+  bindAgentInstance(entries, parsed, write = true) {
     if (this.global || parsed.kind !== "agent") return void 0;
     const configPath = join(this.stateRoot, "skaile.yaml");
     if (!existsSync(configPath)) return void 0;
@@ -9537,7 +10006,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       return { id, ref, keptRef: primary };
     }
     raw.agents = { ...instances, [id]: { ref } };
-    writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+    if (write) writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
     return { id, ref };
   }
   /** The refs `skaile.yaml` binds agent instances to: every `agents.<id>.ref` and `agent.definition`. Project mode only. */
@@ -9622,5 +10091,5 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
 };
 
 export { AssetManager, LibraryEntryError, MissingManifestError, installAgentInstances, labelDiffHeaders, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, setLibraryAssetCheck, setRenamedEntryLookup, softDepName };
-//# sourceMappingURL=chunk-JRVQV7WC.js.map
-//# sourceMappingURL=chunk-JRVQV7WC.js.map
+//# sourceMappingURL=chunk-ZDTDS62B.js.map
+//# sourceMappingURL=chunk-ZDTDS62B.js.map