@skaile/workspaces 6.8.0 → 6.9.0

package/dist/{chunk-757G6TTZ.js → chunk-23Q5LT4U.js}

@@ -1,20 +1,21 @@
-import { unregisteredLibraryNames, libraryDirMissing, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-G44FFUMA.js';
-import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-O5Y7VMVQ.js';
+import { StoreProbe, unregisteredLibraryNames, libraryDirMissing, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-GZL6RN4Z.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-5KWQMCH7.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
-import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, entriesNeedingDeploy, resetMissingParentWarnings, assertNoLibrarySymlinks, composedDriftRefs, deployAll, removeAsset, sourceComposedFiles, cachedComposedFiles, createScaffold, composedAgentNamesOf, installAgent } from './chunk-KO3VSZQP.js';
-import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, entriesNeedingDeploy, resetMissingParentWarnings, assertNoLibrarySymlinks, composedDriftRefs, deployAll, removeAsset, sourceComposedFiles, cachedComposedFiles, createScaffold, composedAgentNamesOf, installAgent } from './chunk-NDBHEOIA.js';
+import { appendHistory, getRecentHistory, clearHistory } from './chunk-7QYBKUAS.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-4CD2R4MJ.js';
-import { isScaffoldBody, isScaffoldDescription } from './chunk-VT6G5AJV.js';
-import { resolveConfiguredHarnessName, computeHash, FACTORY_SOURCE_URL, isFactoryMemorySource, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, buildLockFile, readLock, LockParseError, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, ensureRunStateIgnored, LOCK_SCHEMA_VERSION } from './chunk-TMJBEGS4.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-G7NMF5WQ.js';
+import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-QBUJTVMY.js';
+import { isScaffoldBody, isScaffoldDescription } from './chunk-WS3BOCAT.js';
+import { resolveConfiguredHarnessName, computeHash, FACTORY_SOURCE_URL, isFactoryMemorySource, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, buildLockFile, readLock, LockParseError, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-4KPQ6ILH.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-4ROXSQEG.js';
 import { deployedBase, deployedPaths, deployedDir, isDeployed } from './chunk-5KRMNUL4.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveSourcePublisher, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, cloneOriginMismatch, DEFAULT_AGENT_INSTANCE_ID, MAX_PRESET_DEPTH, PresetDepthError } from './chunk-O7ADRMCR.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, isSourceCloned, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveSourcePublisher, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, cloneOriginMismatch, DEFAULT_AGENT_INSTANCE_ID, MAX_PRESET_DEPTH, PresetDepthError } from './chunk-FZO64PLQ.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { HARNESS_TARGETS, SUPPORTED_HARNESSES } from './chunk-VTETQCR6.js';
 import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-QC5BYUED.js';
 import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-GNUA7XT2.js';
 import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-V5KG6CCV.js';
+import { ensureRunStateIgnored } from './chunk-MDCI4RSG.js';
 import { spawnSync } from 'child_process';
 import { existsSync, rmSync, readFileSync, writeFileSync, readdirSync, lstatSync, statSync, realpathSync, unlinkSync, mkdirSync } from 'fs';
 import { homedir } from 'os';
@@ -1330,6 +1331,7 @@ function unregisteredLibraryFix(origin, ref) {
 function declaredNoHolderReason(ref) {
   return `is declared but no library or source holds it \u2014 register the library that holds it with \`skaile library init <name> --path <dir>\`, or drop it with \`skaile remove ${ref.split("#")[0]}\``;
 }
+var RUN_SOURCE_SYNC = "run `skaile source sync` to clone it again";
 var REGISTER_HOLDER = "register the library that holds it with `skaile library init <name> --path <dir>`";
 function requirementNoHolderFix(asset) {
   return `${REGISTER_HOLDER}, or drop ${asset} with \`skaile remove ${asset}\``;
@@ -1463,6 +1465,19 @@ function sameBytes(a, b) {
     return false;
   }
 }
+function matchesRecordedHashes(path2, recorded) {
+  try {
+    const st = lstatSync(path2);
+    if (st.isSymbolicLink()) return false;
+    if (st.isDirectory()) {
+      return readdirSync(path2).every((n) => matchesRecordedHashes(join(path2, n), recorded));
+    }
+    const want = recorded.get(resolve(path2));
+    return want !== void 0 && computeHash(path2) === want;
+  } catch {
+    return false;
+  }
+}
 var ENTRY_HARNESSES_KEY = "global_asset_harnesses";
 function sameList(a, b) {
   return a.length === b.length && a.every((v, i) => v === b[i]);
@@ -1507,6 +1522,8 @@ var AssetManager = class {
   verboseCollisions;
   /** Store URLs whose failed version lookup was already reported (one warning per URL). */
   warnedStoreVersionLookups = /* @__PURE__ */ new Set();
+  /** Whether each store answers: one command asks a dead store once ({@link StoreProbe}). */
+  storeProbe = new StoreProbe();
   /** Stores a lookup could not reach (store URL -> one line why); `add` reports them instead of "not found". */
   storeFailures = /* @__PURE__ */ new Map();
   /** The agent `add` is about to bind to an instance: its deploy writes no file named after the asset. */
@@ -2182,18 +2199,16 @@ var AssetManager = class {
     }
     return { repositories, sources, stores, dependencies, overrides, patches, config };
   }
-  /** Build provenance-index clones from the resolved source declarations. */
-  buildClones(repositories) {
+  /** Build provenance-index clones from the resolved source declarations; a clone folder with no git checkout goes to `onSourceError`. */
+  buildClones(repositories, onSourceError = this.reportSourceError) {
     const clones = [];
     for (const [slug, decl] of Object.entries(repositories)) {
       const localPath = this.resolveRepoDir(decl, slug);
       if (!localPath || !existsSync(localPath)) continue;
-      if (decl.url && !decl.factory && !existsSync(join(localPath, ".git"))) {
-        this.reportSourceError(
+      if (decl.url && !decl.factory && !isSourceCloned(localPath)) {
+        onSourceError(
           { localPath, sourceUrl: decl.url, commit: "" },
-          new Error(
-            `${decl.url}: its clone ${localPath} is not a git repository, so git pull fails - run \`skaile source sync\` to clone it again`
-          )
+          new Error(`${decl.url}: its clone is not a git checkout - ${RUN_SOURCE_SYNC}`)
         );
         continue;
       }
@@ -2913,8 +2928,9 @@ var AssetManager = class {
       if (!hit || links[hit[0]]) continue;
       const dir = this.resolveRepoDir(hit[1], hit[0]);
       if (!dir || isCommitOnRemote(dir, c.commit)) continue;
+      const branch = hit[1].branch ?? "main";
       throw new Error(
-        `${c.sourceUrl} clone has unpublished commit ${c.commit.slice(0, 7)} - push it, or reset the clone (git -C ${dir} reset --hard origin/${hit[1].branch ?? "main"}) - nothing was locked`
+        `${c.sourceUrl} clone has unpublished commit ${c.commit.slice(0, 7)} - push it, or reset the clone (git -C ${dir} checkout -B ${branch} origin/${branch}) - nothing was locked`
       );
     }
   }
@@ -3674,6 +3690,31 @@ var AssetManager = class {
     const holder = asset && origin.sha256 ? this.libraryHoldingLockedBytes(origin.sha256, asset, snap) : void 0;
     return holder ? { state: "ok", path: holder.path, name: holder.name, matched: "content" } : byName;
   }
+  /**
+   * Why `install --locked` cannot restore a locked library asset from its library: the library
+   * holds another version than the lock (`library "x" is at 0.1.1, locked 0.1.0`) or the locked
+   * version with other bytes (`library "x" content changed since lock`). Only `update` moves
+   * the lock to it. `undefined` when the library is not here, no longer holds the asset, or
+   * still holds the locked files (the other gaps say what is wrong then).
+   */
+  async libraryAheadOfLock(origin, asset) {
+    const snap = await this.loadLibraryIndex();
+    const lookup = this.lockedLibrary(origin, snap, asset);
+    if (lookup.state !== "ok" || !origin.version) return void 0;
+    const found = (await scanDirectory(lookup.path, asset.publisher, { knownKinds: this.knownKinds })).find((x) => x.kind === asset.kind && x.name === asset.name);
+    if (!found) return void 0;
+    const current = libraryAssetVersion(snap, lookup.name, asset, found.version) || "0.0.0";
+    const sameVersion = current === origin.version || isPseudoVersion(current) && isPseudoVersion(origin.version);
+    if (!sameVersion) {
+      const comparable = !isPseudoVersion(current) && !isPseudoVersion(origin.version);
+      return comparable ? `library "${lookup.name}" is at ${current}, locked ${origin.version}` : void 0;
+    }
+    if (!origin.sha256) return void 0;
+    const onDisk = libraryDiskHashes(lookup.path, /* @__PURE__ */ new Map(), this.registry).get(
+      `${asset.kind}:${asset.name}`
+    );
+    return onDisk !== void 0 && onDisk !== origin.sha256 ? `library "${lookup.name}" content changed since lock` : void 0;
+  }
   /** The registered library whose files for `asset` hash to `sha256` (the locked bytes), if any. */
   libraryHoldingLockedBytes(sha256, asset, snap) {
     if (!snap) return void 0;
@@ -3830,6 +3871,33 @@ var AssetManager = class {
     }
     return out;
   }
+  /**
+   * The locked assets whose entry says `origin: store`, by identity -> the store URL. A store
+   * origin is a pin: no source that holds the same ref takes the asset until `skaile remove`
+   * and `skaile add` move it (`update`, `install`, `add`). A declared ref whose `#pin` the
+   * locked version does not satisfy is the user asking for another version: it is not pinned.
+   *
+   * @param declared - The `dependencies:` refs of `skaile.yaml`.
+   * @param asked - Refs being resolved now.
+   */
+  storePinnedIdentities(declared, asked) {
+    const out = /* @__PURE__ */ new Map();
+    const pins = /* @__PURE__ */ new Map();
+    for (const ref of [...declared, ...asked]) {
+      const id = refIdentity(ref);
+      if (id !== null && ref.includes("#")) pins.set(id, ref.slice(ref.indexOf("#") + 1).trim());
+    }
+    for (const [key, e] of Object.entries(this.tryReadLock()?.assets ?? {})) {
+      if (e.origin !== "store" || e.library) continue;
+      const { publisher, kind, name, version } = parseCanonicalLockKey(key);
+      if (!publisher || !kind || !name) continue;
+      const id = `${publisher}/${kind}:${name}`;
+      const pin = pins.get(id);
+      if (pin && version && !matchPin(pin, version)) continue;
+      out.set(id, e.store);
+    }
+    return out;
+  }
   /**
    * Say which registered library holds a ref the lock keeps on its source or the store: the
    * candidate that lost, with the way to switch (p1490). Printed once per `add`.
@@ -3934,6 +4002,7 @@ var AssetManager = class {
     const keptVersions = {};
     const versionBlocked = [];
     const contentHeld = [];
+    const libraryPresets = [];
     const lib = { entries: [], resolved: /* @__PURE__ */ new Set(), libraryOf: /* @__PURE__ */ new Map() };
     const missing = /* @__PURE__ */ new Set();
     const seen = /* @__PURE__ */ new Set();
@@ -3985,6 +4054,7 @@ var AssetManager = class {
             skipped: e.skippedItems ?? 0,
             ...origin ? { library: origin } : {}
           });
+          if (origin) libraryPresets.push({ entry: e, library: origin });
         } else if (keep) {
           keptVersions[keep.key] = keep.entry;
           const sameVersion = coerceVersion(e.version ?? "") === coerceVersion(keep.entry.library?.version ?? "");
@@ -4059,7 +4129,22 @@ var AssetManager = class {
       const next = absorb(hit);
       const rest = fresh.filter((ref) => !hit.resolved.has(ref));
       if (rest.length > 0) {
-        const r = await this.resolveWithStores(rest, opts);
+        const pinnedToStore = this.storePinnedIdentities(opts.declaredRefs ?? [], fresh);
+        let index = opts.provenanceIndex;
+        if (pinnedToStore.size > 0) {
+          index = new Map(index);
+          for (const [id, store] of pinnedToStore) {
+            const losers = index.get(id) ?? [];
+            index.delete(id);
+            if (losers.length === 0 || !(opts.warnCollisions || opts.noteStorePinned)) continue;
+            const plain = id.replace(/^([^/]+)\/([^:]+):(.*)$/, "$2:@$1/$3");
+            this.emitLibraryCollision(
+              `${plain} is locked from the store${store ? ` ${store}` : ""}, which wins; source ${[...new Set(losers.map((c) => c.sourceUrl))].join(", ")} also holds it and is not used. To switch, run \`skaile remove ${plain}\`, then \`skaile add ${plain}\`.`,
+              [plain]
+            );
+          }
+        }
+        const r = await this.resolveWithStores(rest, { ...opts, provenanceIndex: index });
         for (const c of r.resolved) {
           const id = `${c.publisher}/${c.kind}:${c.name}`;
           if (covered.has(id)) continue;
@@ -4102,6 +4187,7 @@ var AssetManager = class {
       requiredBy,
       keptVersions,
       versionBlocked,
+      libraryPresets,
       contentHeld
     };
   }
@@ -4441,7 +4527,8 @@ var AssetManager = class {
       ...opts?.moveLibraries ? { preferLocked: await this.lockedPreference() } : { lockedLibraries: await this.lockedLibraryNames() },
       ...keepLocked ? { keepLocked } : {},
       lockedOrigin: this.lockedOriginVersions(),
-      readStoreRequires: true
+      readStoreRequires: true,
+      noteStorePinned: opts?.moveLibraries === true
     });
     this.assertNoFolderCollision([...resolved, ...lib.entries.map((e) => this.entryIdentity(e))]);
     if (!opts?.force && !(existsSync(this.lockPath) && this.tryReadLock() === null)) {
@@ -4659,7 +4746,7 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
       ...mcpRestored,
       ...restoredRenderings
     ];
-    const lockWanted = resolved.length > 0 || lib.entries.length > 0 || existsSync(this.lockPath);
+    const lockWanted = resolved.length > 0 || lib.entries.length > 0 || presets.length > 0 || existsSync(this.lockPath);
     let lockWritten = false;
     let relocked = [];
     let moved = [];
@@ -4703,6 +4790,18 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
       ...agentRender
     };
   }
+  /**
+   * Why `install` asks no store, or `undefined` when it does: `--no-catalog`, or `catalog.url:
+   * local` with no `stores:` entry in `skaile.yaml`. A locked store asset is then kept as it is,
+   * as for an air-gapped client.
+   */
+  async whyNoStoreAsked() {
+    if (this.catalogUrlOverride === "") return "--no-catalog: the store was not asked";
+    if (this.injectedStoreFetcher) return void 0;
+    const { stores } = this.loadConfig();
+    if (stores.length > 0 || (await this.globalStoreFallback(stores)).length > 0) return void 0;
+    return "catalog.url is local: the store was not asked";
+  }
   /**
    * The kept refs whose locked copy came from a store that `install` did not (or could not)
    * ask, and whose deployed copy is still there: nothing says the copy is wrong, so it stays
@@ -4713,7 +4812,8 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
    *   them is that source's, not the store's.
    */
   async storeNotCheckedRefs(kept, declaredSourceUrls) {
-    const skipped = this.catalogUrlOverride === "";
+    const notAsked = await this.whyNoStoreAsked();
+    const skipped = notAsked !== void 0;
     if (!skipped && this.storeFailures.size === 0) return [];
     const declared = new Set(declaredSourceUrls.map(normalizeRepoUrl));
     const out = [];
@@ -4725,7 +4825,7 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
       });
       if (!fromStore || !await this.keptCopyDeployed(kept, ref)) continue;
       if (skipped && this.storeFailures.size === 0) {
-        out.push({ ref, reason: "skipped", detail: "--no-catalog: the store was not asked" });
+        out.push({ ref, reason: "skipped", detail: notAsked });
         continue;
       }
       const urls = [...this.storeFailures.keys()];
@@ -5184,7 +5284,11 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
       cacheTtlMs = resolveConfig({ projectDir: this.projectDir }).catalog.cache_ttl * 1e3;
     } catch {
     }
-    return new RemoteCatalogSource({ baseUrl: storeUrl, cacheTtlMs });
+    return new RemoteCatalogSource({
+      baseUrl: storeUrl,
+      cacheTtlMs,
+      httpClient: this.storeProbe.httpClient(storeUrl)
+    });
   }
   /**
    * Remember why a store could not be asked (store URL → one line without a JS error class
@@ -5229,7 +5333,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
             deps
           };
         } catch (err) {
-          if (err instanceof CatalogHttpError && err.status === 404) return null;
+          if (err instanceof CatalogHttpError && err.status === 404 && !err.notCatalog) return null;
           this.noteStoreFailure(storeUrl, err);
           throw err;
         }
@@ -5333,7 +5437,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     }
     assertLockHashes(lock);
     this.assertNoFolderCollision(Object.keys(lock.assets).map(parseCanonicalLockKey));
-    const orphaned = [...(await this.orphanedSourceGaps(void 0, true)).values()];
+    const orphaned = [...(await this.orphanedSourceGaps(void 0, false)).values()];
     if (orphaned.length > 0) {
       throw new Error(
         `Lock file verification failed:
@@ -5810,7 +5914,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     } finally {
       this.flushLibraryCollisions();
     }
-    const { resolved, missing, overridesApplied, lib, presets } = resolution;
+    const { resolved, missing, overridesApplied, lib, presets, libraryPresets } = resolution;
     if (resolved.length === 0 && lib.entries.length === 0 && presets.length === 0) {
       const snap = await this.loadLibraryIndex();
       const bare = (p) => (p ?? "").replace(/^@/, "");
@@ -5864,7 +5968,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
                 l.name,
                 libPath,
                 l.ownership,
-                `Run \`skaile library index ${l.name}\` to rename the entry, or restore the name.`,
+                renamed.fileFix ? `${renamed.fileFix}, then run \`skaile library index ${l.name}\`.` : `Run \`skaile library index ${l.name}\` to rename the entry, or restore the name.`,
                 `"${l.name}" is a read-only clone: ask the owner to rename the entry in skaile.manifest.yaml or restore the name and push`
               )
             );
@@ -5922,10 +6026,13 @@ ${problems.map((line) => `  ${line}`).join("\n")}
         `Preset ${ref} has items that do not resolve: ${missing.join(", ")} \u2014 nothing was added`
       );
     }
-    if (lib.entries.length > 0) {
+    const checkedEntries = [
+      ...lib.entries.map((e) => ({ e, origin: lib.libraryOf.get(e) })),
+      ...libraryPresets.map((p) => ({ e: p.entry, origin: p.library }))
+    ];
+    if (checkedEntries.length > 0) {
       const snap = await this.loadLibraryIndex();
-      for (const e of lib.entries) {
-        const origin = lib.libraryOf.get(e);
+      for (const { e, origin } of checkedEntries) {
         const libPath = origin ? this.libraryPath({ name: origin }, snap) : null;
         if (origin && libPath && isUnlistedLibraryAsset(e, libPath)) {
           throw new Error(
@@ -6098,7 +6205,9 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     for (const placeholder of scaffoldDescriptionRefs(lib.entries, deployed)) {
       opts?.onPlaceholderDescription?.(placeholder);
     }
-    this.addDependencyToConfig(ref, opts?.only === true);
+    if (!(opts?.preferLockedLibrary && this.boundOnlyByInstance(parsed))) {
+      this.addDependencyToConfig(ref, opts?.only === true);
+    }
     this.widenDependencyRows(entries, parsed);
     if (!opts?.preferLockedLibrary) {
       const bound = this.bindAgentInstance(entries, parsed);
@@ -6107,7 +6216,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     await this.renderHarnessMcpConfig();
     await this.renderAgentInstances({ prune: true });
-    if (resolved.length > 0 || lib.entries.length > 0) {
+    if (resolved.length > 0 || lib.entries.length > 0 || presets.length > 0) {
       await this.warnUncommittedLibraryAssets(lib);
       const libraryLock = await this.libraryLockEntries(lib);
       const fresh = {
@@ -6902,6 +7011,18 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     return result;
   }
+  /**
+   * Absolute path → sha256 of every native agent file the lock records under `rendered:`. A
+   * `harness set` rewrites the lock for the new harness, so a caller that cleans up afterwards
+   * reads this first and hands it to {@link AssetManager.listStaleHarnessCopies}.
+   */
+  lockedRenderedHashes() {
+    const out = /* @__PURE__ */ new Map();
+    for (const entry of Object.values(this.tryReadLock()?.assets ?? {})) {
+      for (const f of entry.rendered ?? []) out.set(resolve(this.projectDir, f.path), f.sha256);
+    }
+    return out;
+  }
   /**
    * Tracked assets (`skaile.lock.yaml` or declared in `skaile.yaml`) whose copy
    * still sits in the project dirs of another harness (`.claude/…`, `.omp/…`,
@@ -6912,10 +7033,17 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    * Read-only: nothing is deleted. Empty for global mode and for kinds whose
    * dir is shared with the active target (flows).
    *
+   * @param opts.renderedBefore - {@link AssetManager.lockedRenderedHashes} of the lock as it was
+   *   before the move to this harness. An agent copy counts as skaile's only when it matches a
+   *   hash the lock (now or then) recorded for its path.
    * @returns One {@link StaleHarnessCopy} per stale copy, sorted by harness, kind, then name.
    */
-  listStaleHarnessCopies() {
+  listStaleHarnessCopies(opts = {}) {
     if (this.global) return [];
+    const recordedHashes = new Map([
+      ...this.lockedRenderedHashes(),
+      ...opts.renderedBefore ?? []
+    ]);
     const tracked = /* @__PURE__ */ new Map();
     const track = (kind, name, locked = false) => {
       const component = kind ? this.installTarget(kind) : void 0;
@@ -6967,7 +7095,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
             continue;
           }
           const twin = join(activeBase, relative(otherBase, p));
-          const skaileWrote = k === "agent" ? locked : !relative(otherBase, p).startsWith("..") && sameBytes(p, twin);
+          const skaileWrote = k === "agent" ? locked && matchesRecordedHashes(p, recordedHashes) : !relative(otherBase, p).startsWith("..") && sameBytes(p, twin);
           out.push({ harness: other, kind, name, path: p, skaileWrote });
         }
       }
@@ -7003,7 +7131,8 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    * set is walked, so a lock entry with no matching `dependencies:` ref never shows.
    *
    * @param kind - Filter by asset kind. Omit to return all kinds.
-   * @returns One {@link DeclaredAsset} per declared dep (after the optional kind filter).
+   * @returns One {@link DeclaredAsset} per declared dep (after the optional kind filter), plus
+   *   one per locked agent that only an agent instance of `skaile.yaml` binds.
    * @throws {MissingManifestError} when the project has no `skaile.yaml`.
    * @throws {Error} with a `migrate-skaile-manifest` hint on legacy `repositories:` / `ai_resources:` keys.
    */
@@ -7011,7 +7140,8 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     if (!existsSync(join(this.projectDir, SKAILE_YAML_DEFAULT))) {
       throw new MissingManifestError(this.projectDir);
     }
-    const dependencies = resolveSkWorkspaceConfig(this.projectDir).dependencies ?? [];
+    const declaredLines = resolveSkWorkspaceConfig(this.projectDir).dependencies ?? [];
+    const dependencies = [...declaredLines, ...this.lockedAgentBindings(declaredLines)];
     const lock = this.tryReadLock();
     const lockKeys = lock ? Object.keys(lock.assets).map(parseCanonicalLockKey) : [];
     const presetGaps = await this.declaredPresetGaps(dependencies, lock);
@@ -7256,14 +7386,34 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     const lockByKindName = indexLockByKindName(lock);
     const entries = [];
     const instanceFiles = this.global ? /* @__PURE__ */ new Set() : instanceRenderedAgentNames(this.projectDir, this.harness);
+    const syncOf = (lockEntry) => {
+      if (lockEntry?.library) return "local";
+      const slug = lockEntry ? sourceCacheKey(lockEntry.url) : "";
+      return slug ? computeSyncStatus(repoStatuses.get(slug)) : "unknown";
+    };
     for (const d of deployed) {
       const lockEntry = lockByKindName.get(`${d.kind}:${d.name}`);
       if (!lockEntry && d.kind === "agent" && instanceFiles.has(d.name)) continue;
-      const publisher = lockEntry?.publisher || "unknown";
-      const version = lockEntry?.version ?? "";
-      const slug = lockEntry && !lockEntry.library ? sourceCacheKey(lockEntry.url) : "";
-      const syncStatus = lockEntry?.library ? "local" : slug ? computeSyncStatus(repoStatuses.get(slug)) : "unknown";
-      entries.push({ kind: d.kind, name: d.name, publisher, version, syncStatus });
+      entries.push({
+        kind: d.kind,
+        name: d.name,
+        publisher: lockEntry?.publisher || "unknown",
+        version: lockEntry?.version ?? "",
+        syncStatus: syncOf(lockEntry)
+      });
+    }
+    const seen = new Set(entries.map((e) => `${e.kind}:${e.name}`));
+    for (const [key, lockEntry] of lockByKindName) {
+      if (seen.has(key) || !key.startsWith("agent:")) continue;
+      const name = key.slice("agent:".length);
+      if (!isAssetDeployed("agent", name, this.harness, this.global, this.projectDir)) continue;
+      entries.push({
+        kind: "agent",
+        name,
+        publisher: lockEntry.publisher,
+        version: lockEntry.version,
+        syncStatus: syncOf(lockEntry)
+      });
     }
     return {
       byPublisher: groupAndSortByPublisher(entries),
@@ -7500,12 +7650,16 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    * @returns Array of {@link OutdatedEntry} objects.
    */
   async outdated() {
-    const { repositories } = this.loadConfig();
+    const { repositories, sources: declaredSources } = this.loadConfig();
     const lock = this.tryReadLock();
-    if (!lock) return this.addLockGapRows([]);
     const result = [];
     const commitCounts = /* @__PURE__ */ new Map();
-    for (const src of lock.sources) {
+    const lockedUrls = new Set((lock?.sources ?? []).map((s) => s.url));
+    const checked = [
+      ...lock?.sources ?? [],
+      ...declaredSources.filter((s) => !lockedUrls.has(s.url)).map((s) => ({ url: s.url, commit: "" }))
+    ];
+    for (const src of checked) {
       const slug = sourceCacheKey(src.url);
       const decl = repositories[slug];
       if (!decl) continue;
@@ -7537,7 +7691,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         });
       }
       const clone = decl.path ?? join(this.reposDir, slug);
-      for (const [ref, entry] of Object.entries(lock.assets)) {
+      for (const [ref, entry] of Object.entries(lock?.assets ?? {})) {
         if (entry.source?.url !== src.url) continue;
         const { publisher, kind, name, version } = parseCanonicalLockKey(ref);
         if (!kind || !name) continue;
@@ -7564,6 +7718,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         });
       }
     }
+    if (!lock) return this.addLockGapRows([]);
     const libraryAssets = Object.entries(lock.assets).filter(
       ([, e]) => e.library && !e.library.installed
     );
@@ -7971,6 +8126,53 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     return null;
   }
+  /** Whether the lock holds `want` as a store asset (`origin: store`, no library). */
+  isStorePinnedRef(want) {
+    const wantPublisher = want.publisher?.replace(/^@/, "");
+    return Object.entries(this.tryReadLock()?.assets ?? {}).some(([key, e]) => {
+      if (e.origin !== "store" || e.library) return false;
+      const id = parseCanonicalLockKey(key);
+      return id.kind === want.kind && id.name === want.name && (!wantPublisher || id.publisher === wantPublisher);
+    });
+  }
+  /**
+   * {@link AssetManager.diff} for a locked source or store asset whose bytes are not on disk:
+   * the deployed copy against the per-file hashes the lock records. No text to show without the
+   * locked bytes, so an edited file is named and the way to fetch them is. `null` when the lock
+   * has no such entry or the kind is rendered (an agent), not copied.
+   */
+  async diffAgainstLock(want) {
+    if (this.global) return null;
+    const lock = this.tryReadLock();
+    const wantPublisher = want.publisher?.replace(/^@/, "");
+    for (const [key, e] of Object.entries(lock?.assets ?? {})) {
+      const { kind, name, publisher } = parseCanonicalLockKey(key);
+      if (!e.source || e.library || kind !== want.kind || name !== want.name) continue;
+      if (wantPublisher && publisher !== wantPublisher) continue;
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!component || component === "agent") return null;
+      if (!isAssetDeployed(component, name, this.harness, this.global, this.projectDir)) {
+        return { status: "not-deployed" };
+      }
+      const ref = publisher ? `${kind}:@${publisher}/${name}` : `${kind}:${name}`;
+      const drift = (await this.lockedCopyDrift()).find((d) => d.ref === ref);
+      if (!drift || drift.modified.length === 0 && drift.extra.length === 0) {
+        return { status: "identical" };
+      }
+      const lines = [
+        ...drift.modified.map((f) => `~ ${f}: differs from the locked bytes`),
+        ...drift.extra.map((f) => `+ ${f}: not part of the asset`)
+      ];
+      return {
+        status: "differs",
+        diff: `${lines.join("\n")}
+(the locked bytes are not in .skaile/cache: run \`skaile install --locked\` to fetch them, then diff shows the lines)
+`,
+        ...drift.extra.length > 0 ? { fileSetDiffers: true } : {}
+      };
+    }
+    return null;
+  }
   /**
    * Produce a unified diff from the deployed asset to its catalog source: `-` lines
    * are in the deployed copy only (local edits `update` would overwrite), `+` lines
@@ -8008,8 +8210,9 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       }
     }
     const libraryEntry = await this.lockedLibraryEntry(parsed);
-    const entry = libraryEntry ?? this.lockedSourceEntry(parsed) ?? await this.info(ref);
-    if (!entry || !existsSync(entry.source)) return { status: "not-found" };
+    const entry = libraryEntry ?? this.lockedSourceEntry(parsed) ?? (this.isStorePinnedRef(parsed) ? null : await this.info(ref));
+    if (!entry) return await this.diffAgainstLock(parsed) ?? { status: "not-found" };
+    if (!existsSync(entry.source)) return { status: "not-found" };
     const toLabel = libraryEntry ? "library" : "source";
     const wantPublisher = parsed.publisher?.replace(/^@/, "");
     if (wantPublisher) {
@@ -8418,15 +8621,18 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       named.add(gapIdentity(gap.ref));
     }
     const skipped = [];
+    const onSkipped = (clone, err) => {
+      skipped.push({
+        url: clone.sourceUrl,
+        why: err instanceof Error ? err.message : String(err)
+      });
+    };
     const sourceIndex = await buildProvenanceIndex(
-      this.buildClones(this.loadConfig().repositories),
+      this.buildClones(this.loadConfig().repositories, onSkipped),
       {
         projectDir: this.projectDir,
         knownKinds: this.knownKinds,
-        onSourceError: (clone, err) => skipped.push({
-          url: clone.sourceUrl,
-          why: err instanceof Error ? err.message : String(err)
-        })
+        onSourceError: onSkipped
       }
     );
     for (const gap of await this.sourceOriginGaps(named, sourceIndex)) {
@@ -8491,7 +8697,8 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       gaps.push({ type: "incomplete", ref: d.ref, reason, message: `${d.ref} ${reason}` });
     }
     for (const s of skipped) {
-      const reason = `is skipped: ${s.why.replace(`${s.url}: `, "")} \u2014 fix it or run \`skaile source remove\``;
+      const why = s.why.replace(`${s.url}: `, "");
+      const reason = why.includes(RUN_SOURCE_SYNC) ? `is skipped: ${why}` : `is skipped: ${why} \u2014 fix it or run \`skaile source remove\``;
       gaps.push({
         type: "source",
         ref: s.url,
@@ -8525,8 +8732,30 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         manualFix: true
       });
     }
+    const seenGaps = /* @__PURE__ */ new Set();
+    const unique = gaps.filter((g) => {
+      const id = `${g.type}\0${g.message}`;
+      if (seenGaps.has(id)) return false;
+      seenGaps.add(id);
+      return true;
+    });
+    const changedAgents = /* @__PURE__ */ new Map();
+    for (const g of unique) {
+      if (g.ref.startsWith("agent:") && g.reason.includes("content changed since lock")) {
+        changedAgents.set(g.ref, g.reason);
+      }
+    }
+    const coveredByAgent = /* @__PURE__ */ new Set();
+    for (const [key, entry] of Object.entries(lock?.assets ?? {})) {
+      const id = parseCanonicalLockKey(key);
+      const agentRef = id.publisher ? `agent:@${id.publisher}/${id.name}` : `agent:${id.name}`;
+      if (id.kind !== "agent" || !changedAgents.has(agentRef)) continue;
+      for (const dep of entry.requires ?? []) {
+        coveredByAgent.add(`${dep}\0${changedAgents.get(agentRef)}`);
+      }
+    }
     return {
-      gaps,
+      gaps: unique.filter((g) => !coveredByAgent.has(`${g.ref}\0${g.reason}`)),
       requirements: requirements.filter(
         (i) => i.unresolved || !libraryHeld(`${i.depKind}:${i.depName}`)
       )
@@ -8607,6 +8836,18 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
           advice: `run \`skaile update\` (it moves the lock to the library's copy), ${drop}`
         };
       }
+      const lockedOrigin = lock?.assets[lockedAgentKey]?.library;
+      const ahead = lockedOrigin && !lockedOrigin.installed && locked.publisher && locked.kind && locked.name ? await this.libraryAheadOfLock(lockedOrigin, {
+        kind: locked.kind,
+        publisher: locked.publisher,
+        name: locked.name
+      }) : void 0;
+      if (ahead) {
+        return {
+          lead: `its agent is locked, but ${ahead}`,
+          advice: `run \`skaile update\` (it moves the lock to the library's copy), ${drop}`
+        };
+      }
       const libraryFix = await this.lockedAgentLibraryHolds(lockedAgentKey) ? void 0 : (await this.unresolvedFixes([ref])).get(ref);
       if (libraryFix) {
         const register = libraryFix.replace(
@@ -8829,9 +9070,11 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     }
     const stores = [...config.stores, ...await this.globalStoreFallback(config.stores, false)];
     const registered = new Set(config.sources.map((s) => sourceCacheKey(s.url)));
+    const storeNotAsked = online && await this.whyNoStoreAsked() !== void 0;
     for (const [key, entry] of Object.entries(this.tryReadLock()?.assets ?? {})) {
       const url = entry.source?.url;
       if (!url || entry.library || !GIT_URL.test(url)) continue;
+      if (entry.origin === "store" && storeNotAsked) continue;
       if (entry.origin === "store" && !online) continue;
       if (inScope && !inScope.has(key)) continue;
       if (isBundledFactoryEntry(entry)) continue;
@@ -9467,11 +9710,21 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         this.projectDir
       ).find((p) => isSymlink(p) && !existsSync(p));
       const composeDrift = component === "agent" && !dangling && lock ? await this.lockedComposeDrift(lock, kind, name) : void 0;
-      const reason = composeDrift ? `(composes ${composeDrift}: the library's copy changed since the lock; \`skaile update\` moves the lock to it)` : dangling ? `is locked but its deployed copy is a symlink to nothing (${relative(this.projectDir, dangling)}) \u2014 run \`skaile install --locked\`` : "is locked but its deployed copy is missing \u2014 run `skaile install --locked`";
+      const ahead = entry.library && publisher && !composeDrift ? await this.libraryAheadOfLock(entry.library, { kind, publisher, name }) : void 0;
+      const reason = composeDrift ? `(composes ${composeDrift}: the library's copy changed since the lock; \`skaile update\` moves the lock to it)` : ahead ? `is locked but its deployed copy is missing, and ${ahead} \u2014 run \`skaile update\` (it moves the lock to the library's copy)` : dangling ? `is locked but its deployed copy is a symlink to nothing (${relative(this.projectDir, dangling)}) \u2014 run \`skaile install --locked\`` : "is locked but its deployed copy is missing \u2014 run `skaile install --locked`";
       gaps.push({ type: "drift", ref, reason, message: `${ref} ${reason}` });
     }
     return gaps;
   }
+  /**
+   * {@link declaredNoHolderReason} plus, when the name exists under another kind, the same
+   * `It is a skill: skill:@pub/name.` tail `add` and `update` end their not-found line with.
+   */
+  async declaredNoHolderLine(ref) {
+    const base = declaredNoHolderReason(ref);
+    const hint = await this.otherKindHint(ref.split("#")[0]);
+    return hint ? `${base}. ${hint}` : base;
+  }
   /**
    * The `skaile.yaml` side of {@link AssetManager.projectState}: declared refs that do not
    * parse, never resolved into the lock, are not materialized, or contradict a `#pin`.
@@ -9527,7 +9780,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         } else {
           gap = {
             type: "declared",
-            reason: declaredNoHolderReason(d.ref),
+            reason: await this.declaredNoHolderLine(d.ref),
             manualFix: true
           };
         }
@@ -9537,7 +9790,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
           if (this.presetRecorded(want) || await this.info(d.ref) !== null) continue;
           gap = await this.declaredRefResolvable(d.ref) ? { type: "declared", reason: "is declared but not locked \u2014 run `skaile install`" } : {
             type: "declared",
-            reason: declaredNoHolderReason(d.ref),
+            reason: await this.declaredNoHolderLine(d.ref),
             manualFix: true
           };
           gaps.push({ ...gap, ref: d.ref, message: `${d.ref} ${gap.reason}` });
@@ -9935,6 +10188,25 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
     writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
     return true;
   }
+  /**
+   * Whether `target` is an agent that an agent instance of `skaile.yaml` binds and no
+   * `dependencies:` line names. Project mode only.
+   */
+  boundOnlyByInstance(target) {
+    if (this.global || target.kind !== "agent") return false;
+    const bare = (p) => p?.replace(/^@/, "");
+    const names = (ref) => {
+      const p = typeof ref === "string" ? parseAssetRefLoose(ref) : void 0;
+      return !!p && p.kind === "agent" && p.name === target.name && (!target.publisher || !p.publisher || bare(p.publisher) === bare(target.publisher));
+    };
+    let lines = [];
+    try {
+      lines = resolveSkWorkspaceConfig(this.projectDir).dependencies ?? [];
+    } catch {
+      return false;
+    }
+    return !lines.some(names) && this.declaredAgentInstanceRefs().some(names);
+  }
   /**
    * The locked agents an agent instance binds (`agents.<id>.ref`, `agent.definition`) that
    * `declared` does not name, as version-less `agent:@publisher/name`. An agent no lock entry
@@ -10091,5 +10363,5 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
 };
 
 export { AssetManager, LibraryEntryError, MissingManifestError, installAgentInstances, labelDiffHeaders, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, setLibraryAssetCheck, setRenamedEntryLookup, softDepName };
-//# sourceMappingURL=chunk-757G6TTZ.js.map
-//# sourceMappingURL=chunk-757G6TTZ.js.map
+//# sourceMappingURL=chunk-23Q5LT4U.js.map
+//# sourceMappingURL=chunk-23Q5LT4U.js.map