@skaile/workspaces 6.9.0 → 6.10.0

package/dist/{chunk-23Q5LT4U.js → chunk-4I4SBOCS.js}

@@ -1,23 +1,23 @@
-import { StoreProbe, unregisteredLibraryNames, libraryDirMissing, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-GZL6RN4Z.js';
-import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-5KWQMCH7.js';
+import { processStoreProbe, unregisteredLibraryNames, libraryDirMissing, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, missingRootAssets, storeManifestFile, missingLibraryDirMessage, lastLibraryName, filesEntryPaths } from './chunk-FXBKBOI5.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, computeDeterministicHash, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-RZ5R6GDJ.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
-import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, entriesNeedingDeploy, resetMissingParentWarnings, assertNoLibrarySymlinks, composedDriftRefs, deployAll, removeAsset, sourceComposedFiles, cachedComposedFiles, createScaffold, composedAgentNamesOf, installAgent } from './chunk-NDBHEOIA.js';
-import { appendHistory, getRecentHistory, clearHistory } from './chunk-7QYBKUAS.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, entriesNeedingDeploy, resetMissingParentWarnings, assertNoLibrarySymlinks, composedDriftRefs, deployAll, removeAsset, sourceComposedFiles, cachedComposedFiles, createScaffold, composedAgentNamesOf, installAgent } from './chunk-KRL53RZB.js';
+import { appendHistory, getRecentHistory, clearHistory } from './chunk-LKBRBVVS.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-QBUJTVMY.js';
+import { harnessTargetSupportsAgents, CODEX_IDENTITY_DIR, agentRenderFiles } from './chunk-R3ZNAPBV.js';
 import { isScaffoldBody, isScaffoldDescription } from './chunk-WS3BOCAT.js';
-import { resolveConfiguredHarnessName, computeHash, FACTORY_SOURCE_URL, isFactoryMemorySource, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, buildLockFile, readLock, LockParseError, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-4KPQ6ILH.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-4ROXSQEG.js';
+import { resolveConfiguredHarnessName, computeHash, FACTORY_SOURCE_URL, isFactoryMemorySource, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, writeLock, buildLockFile, cloneBackedSources, readLock, LockParseError, assertLockHashes, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-MEU2HHGV.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-CJO3XKO7.js';
 import { deployedBase, deployedPaths, deployedDir, isDeployed } from './chunk-5KRMNUL4.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, isSourceCloned, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveSourcePublisher, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, cloneOriginMismatch, DEFAULT_AGENT_INSTANCE_ID, MAX_PRESET_DEPTH, PresetDepthError } from './chunk-FZO64PLQ.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, mcpDeclarationFromMdContent, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, isSourceCloned, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, findWorkspaceRoot, resolveSourcePublisher, resolveAll, agentSourceCacheDir, ensureRepo, resolveAgentDefinitionDir, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, unpublishedCommitAdvice, resolveAsset, cloneOriginMismatch, cloneIsOnPin, missingPinMessage, DEFAULT_AGENT_INSTANCE_ID, MAX_PRESET_DEPTH, PresetDepthError } from './chunk-BNLXZXZN.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
 import { HARNESS_TARGETS, SUPPORTED_HARNESSES } from './chunk-VTETQCR6.js';
-import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, isNonAssetDir, isNonAssetFile } from './chunk-QC5BYUED.js';
-import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-GNUA7XT2.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-V5KG6CCV.js';
-import { ensureRunStateIgnored } from './chunk-MDCI4RSG.js';
+import { listAssetFiles, loadSkPublishManifest, decodeSkaileManifest, compositeSha256, isNonAssetDir, isNonAssetFile } from './chunk-MS2IXLTC.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-VS6XC5JE.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-7HRZACI4.js';
+import { ensureRunStateIgnored } from './chunk-RZL4TOK3.js';
 import { spawnSync } from 'child_process';
-import { existsSync, rmSync, readFileSync, writeFileSync, readdirSync, lstatSync, statSync, realpathSync, unlinkSync, mkdirSync } from 'fs';
+import { existsSync, rmSync, readFileSync, mkdirSync, writeFileSync, readdirSync, lstatSync, statSync, realpathSync, unlinkSync } from 'fs';
 import { homedir } from 'os';
 import path, { resolve, dirname, sep, join, relative, isAbsolute, posix } from 'path';
 import { gt } from 'semver';
@@ -70,9 +70,10 @@ function instancesBoundToAgent(projectDir, name, publisher) {
   } catch {
     return [];
   }
+  const want = publisher?.replace(/^@/, "");
   return Object.entries(instances).filter(([, instance]) => {
     const bound = agentOfRef(instance.ref);
-    return bound !== void 0 && bound.name === name && (true);
+    return bound !== void 0 && bound.name === name && (!want || !bound.publisher || bound.publisher === want);
   }).map(([id]) => id);
 }
 function boundAgentNames(projectDir) {
@@ -273,6 +274,54 @@ function installAgentInstances(opts) {
   }
   return result;
 }
+function harnessSwitchStateFile(projectDir) {
+  return join(projectDir, ".skaile", "harness-switch-hashes.json");
+}
+function harnessSwitchKeptKey(projectDir, path2) {
+  return relative(resolve(projectDir), resolve(path2)).split(sep).join("/");
+}
+function stringMap(value) {
+  const out = /* @__PURE__ */ new Map();
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    for (const [k, v] of Object.entries(value)) if (typeof v === "string") out.set(k, v);
+  }
+  return out;
+}
+function readHarnessSwitchState(projectDir) {
+  const state = { hashes: /* @__PURE__ */ new Map(), kept: /* @__PURE__ */ new Set() };
+  try {
+    const parsed = JSON.parse(readFileSync(harnessSwitchStateFile(projectDir), "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return state;
+    const record = parsed;
+    if (Array.isArray(record.kept) || record.hashes && typeof record.hashes === "object") {
+      state.hashes = stringMap(record.hashes);
+      for (const k of Array.isArray(record.kept) ? record.kept : []) {
+        if (typeof k === "string") state.kept.add(k);
+      }
+    } else {
+      state.hashes = stringMap(record);
+    }
+  } catch {
+  }
+  return state;
+}
+function writeHarnessSwitchState(projectDir, state) {
+  const file = harnessSwitchStateFile(projectDir);
+  try {
+    if (state.hashes.size === 0 && state.kept.size === 0) {
+      rmSync(file, { force: true });
+      return;
+    }
+    mkdirSync(dirname(file), { recursive: true });
+    const body = {
+      hashes: Object.fromEntries(state.hashes),
+      kept: [...state.kept].sort()
+    };
+    writeFileSync(file, `${JSON.stringify(body, null, 2)}
+`);
+  } catch {
+  }
+}
 var TARGET_MCP_CONFIG = {
   "claude-code": ".mcp.json"
 };
@@ -553,16 +602,19 @@ async function removeEmptyLedger(projectDir) {
   } catch {
   }
 }
-function mergeServers(existing, renderable, managedIds, warn, configLabel) {
+function mergeServers(existing, renderable, managedIds, warn, configLabel, keep = /* @__PURE__ */ new Set()) {
   const next = { ...existing };
   const managed = new Set(managedIds);
   const owned = [];
   const removed = [];
   for (const id of managed) {
-    if (!renderable.has(id) && Object.hasOwn(next, id)) {
-      delete next[id];
-      removed.push(id);
+    if (renderable.has(id) || !Object.hasOwn(next, id)) continue;
+    if (keep.has(id)) {
+      owned.push(id);
+      continue;
     }
+    delete next[id];
+    removed.push(id);
   }
   for (const [id, entry] of renderable) {
     if (Object.hasOwn(next, id) && !managed.has(id)) {
@@ -776,7 +828,8 @@ async function renderMcpServerConfig(projectDir, harnessTarget, opts) {
     renderable,
     managedIds,
     warn,
-    relConfig
+    relConfig,
+    opts?.keep
   );
   for (const id of removed) await removePayloadDir(projectDir, id);
   for (const decl of declarations) {
@@ -784,7 +837,12 @@ async function renderMcpServerConfig(projectDir, harnessTarget, opts) {
     const unset = unsetRequiredFields(decl);
     if (unset.length > 0) warn(`MCP server "${decl.id}" ${requiredFieldsAdvice(decl.id, unset)}`);
   }
-  const rendered = Object.fromEntries(owned.map((id) => [id, entryHash(next[id])]));
+  const rendered = Object.fromEntries(
+    owned.map((id) => [
+      id,
+      renderable.has(id) ? entryHash(next[id]) : ledger.rendered[id] ?? entryHash(next[id])
+    ])
+  );
   const ledgerStale = JSON.stringify(owned) !== JSON.stringify(managedIds) || canonicalJson(rendered) !== canonicalJson(ledger.rendered);
   if (ledgerStale) await writeManaged(projectDir, harnessTarget, { ids: owned, rendered });
   if (Object.keys(next).length === 0 && !existingFile) {
@@ -884,8 +942,20 @@ function lockedAssetFiles(kind, files) {
   const manifestDir = posix.dirname(manifestRel);
   return files.flatMap((f) => {
     const rel = posix.relative(manifestDir, f.path);
-    return rel === "" || rel.startsWith("..") ? [] : [{ rel, sha256: f.sha256 }];
+    return rel === "" || rel.startsWith("..") ? [] : [{ rel, path: f.path, sha256: f.sha256 }];
+  });
+}
+function lockRecordsOtherHash(entry, kind, deployed) {
+  if (deployed.size === 0) return [];
+  const byPath = new Map(lockedAssetFiles(kind, entry.files).map((f) => [f.path, f.rel]));
+  const replaced = entry.files.map((f) => {
+    const rel = byPath.get(f.path);
+    return {
+      path: f.path,
+      sha256: (rel === void 0 ? void 0 : deployed.get(rel)) ?? f.sha256
+    };
   });
+  return compositeSha256(replaced) === entry.sha256 ? [...deployed.keys()] : [];
 }
 var GITHUB_REPO_URL = /github\.com[/:]/i;
 function isBundledFactoryEntry(entry) {
@@ -1394,6 +1464,22 @@ var MissingManifestError = class extends Error {
   }
   projectDir;
 };
+function swapNameInPath(rel, name, id) {
+  return rel.split("/").map(
+    (seg) => seg === name ? id : seg.startsWith(`${name}.`) ? id + seg.slice(name.length) : seg
+  ).join("/");
+}
+function sameRenderUnderName(assetFile, instanceFile, id, name) {
+  try {
+    const word = new RegExp(
+      `(?<![\\w-])${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`,
+      "g"
+    );
+    return readFileSync(instanceFile, "utf8").replace(word, name) === readFileSync(assetFile, "utf8");
+  } catch {
+    return false;
+  }
+}
 function unlistedAssetMessage(ref, library, libPath, ownership) {
   const head = `${ref} is in library "${library}" but not listed in its skaile.manifest.yaml, so only part of its files would be deployed.`;
   return isReadOnlyLibrary(libPath, ownership) ? `${head} "${library}" is a read-only source clone: add it to skaile.manifest.yaml in the source repo and push, then run \`skaile source sync\`.` : `${head} Run \`skaile library index ${library}\`, then add it again.`;
@@ -1522,8 +1608,8 @@ var AssetManager = class {
   verboseCollisions;
   /** Store URLs whose failed version lookup was already reported (one warning per URL). */
   warnedStoreVersionLookups = /* @__PURE__ */ new Set();
-  /** Whether each store answers: one command asks a dead store once ({@link StoreProbe}). */
-  storeProbe = new StoreProbe();
+  /** Whether each store answers: one process asks a dead store once (`processStoreProbe`). */
+  storeProbe = processStoreProbe;
   /** Stores a lookup could not reach (store URL -> one line why); `add` reports them instead of "not found". */
   storeFailures = /* @__PURE__ */ new Map();
   /** The agent `add` is about to bind to an instance: its deploy writes no file named after the asset. */
@@ -2046,7 +2132,15 @@ var AssetManager = class {
     if (this.global) return [];
     const before = await this.mcpDriftRows();
     try {
-      await renderMcpServerConfig(this.projectDir, this.harness);
+      const declared = new Set((await loadMcpServerDeclarations(this.projectDir)).map((d) => d.id));
+      const lock = this.tryReadLock();
+      const wanted = new Set(
+        lock ? [...await this.declaredLockKeys(lock, this.loadConfig().dependencies)].map(parseCanonicalLockKey).filter((id) => id.kind === "mcp-server" && id.name).map((id) => id.name) : []
+      );
+      const keep = new Set(
+        [...this.lockedMcpNames()].filter((name) => !declared.has(name) && wanted.has(name))
+      );
+      await renderMcpServerConfig(this.projectDir, this.harness, { keep });
     } catch (err) {
       console.warn(
         `skaile: could not render MCP config for ${this.harness}: ${err instanceof Error ? err.message : String(err)}`
@@ -2073,61 +2167,142 @@ var AssetManager = class {
     return restored;
   }
   /**
-   * Remove the files named after an agent asset that an earlier CLI rendered and this one does
-   * not: the agent is bound by an instance (its rendering is the instance's file), or
-   * it only runs as a `binding: run` role. Only a file the lock lists for the agent, whose bytes
-   * still equal what the lock recorded, and that no instance of the ledger claims is removed;
-   * an edited one stays (it is the user's now) and is named. The old lock entry is rewritten
-   * by the same install, so the lock never keeps a path that is gone.
-   *
-   * @returns The project-relative paths removed.
+   * Whether a project-relative path is a file an agent instance renders (the ledger's files). An
+   * instance claims files and folders (omp renders a folder): a file under a claimed folder is
+   * claimed too.
    */
-  pruneAssetNamedAgentFiles() {
+  instanceClaims() {
+    const claimedPaths = renderedInstanceFiles(this.projectDir, this.harness).flatMap(
+      (i) => i.files
+    );
+    return (rel) => claimedPaths.some((c) => rel === c || rel.startsWith(`${c}/`));
+  }
+  /**
+   * Whether the path `rel` that the lock lists under `rendered:` for the agent `name` is a file
+   * named after the asset that an instance's file (or the `binding: run` role) stands for now.
+   * Such a path is no part of the rendering the lock expects any more: a lock of 5.13.0 and older
+   * still lists it, `install` drops it at the next lock write, and until then it is neither a
+   * missing nor an edited copy. Always `false` in global mode.
+   */
+  supersededRendering() {
+    if (this.global || !harnessTargetSupportsAgents(this.harness)) return () => false;
+    const bound = boundAgentNames(this.projectDir);
+    const runRoles = runRoleAgentNames(this.projectDir);
+    const claimed = this.instanceClaims();
+    const standsFor = /* @__PURE__ */ new Map();
+    const relOf = (abs) => relative(this.projectDir, abs).split(sep).join("/");
+    return (name, rel) => {
+      if (claimed(rel)) return false;
+      let stands = standsFor.get(name);
+      if (stands === void 0) {
+        stands = runRoles.has(name) || bound.has(name) && isAgentInstanceRendered(this.projectDir, this.harness, name);
+        standsFor.set(name, stands);
+      }
+      if (!stands) return false;
+      const own = [
+        ...deployedPaths("agent", name, this.harness, false, this.projectDir),
+        join(
+          dirname(deployedBase("agent", this.harness, false, this.projectDir)),
+          CODEX_IDENTITY_DIR,
+          `${name}.md`
+        )
+      ].map(relOf);
+      return own.some((o) => rel === o || rel.startsWith(`${o}/`));
+    };
+  }
+  /**
+   * The files named after an agent asset that an earlier CLI rendered and this one does not: the
+   * agent is bound by an instance (its rendering is the instance's file), or it only runs as a
+   * `binding: run` role. A file counts when no instance of the ledger claims it and either the
+   * lock lists it for the agent (`edited` when its bytes differ from the recorded ones), or the
+   * lock records no rendering for the agent at all (5.11.0 and older) and the file is the
+   * instance's render under the asset's name. A file of the second kind that differs from that
+   * render may be the user's own and is not listed. Project mode only.
+   */
+  leftoverAgentFiles() {
     const lock = this.tryReadLock();
     if (this.global || !lock || !harnessTargetSupportsAgents(this.harness)) return [];
     const bound = boundAgentNames(this.projectDir);
     const runRoles = runRoleAgentNames(this.projectDir);
-    const claimedPaths = renderedInstanceFiles(this.projectDir, this.harness).flatMap(
-      (i) => i.files
-    );
-    const claimed = (rel) => claimedPaths.some((c) => rel === c || rel.startsWith(`${c}/`));
-    const agentDir = resolve(deployedBase("agent", this.harness, false, this.projectDir));
-    const removed = [];
+    const claimed = this.instanceClaims();
+    const found = [];
     for (const [key, entry] of Object.entries(lock.assets)) {
-      const { kind, name } = parseCanonicalLockKey(key);
-      if (!kind || !name || this.installTarget(kind) !== "agent" || !entry.rendered?.length) {
-        continue;
-      }
+      const { kind, name, publisher } = parseCanonicalLockKey(key);
+      if (!kind || !name || this.installTarget(kind) !== "agent") continue;
       if (!bound.has(name) && !runRoles.has(name)) continue;
       if (!runRoles.has(name) && !isAgentInstanceRendered(this.projectDir, this.harness, name)) {
         continue;
       }
-      const named = new Set(this.renderedAgentFiles(name).map((f) => f.path));
-      for (const f of entry.rendered) {
-        if (!named.has(f.path) || claimed(f.path)) continue;
-        const abs = join(this.projectDir, f.path);
-        if (!existsSync(abs)) continue;
-        let intact = false;
-        try {
-          intact = computeHash(abs) === f.sha256;
-        } catch {
-        }
-        if (!intact) {
-          console.warn(
-            `skaile: ${f.path} is no longer written for ${name} (an instance renders it); it was edited, so it stays`
-          );
-          continue;
-        }
-        rmSync(abs, { force: true });
-        removed.push(f.path);
-        for (let dir = dirname(abs); dir.startsWith(agentDir + sep); dir = dirname(dir)) {
-          if (readdirSync(dir).length > 0) break;
-          rmSync(dir, { recursive: true, force: true });
+      const named = this.renderedAgentFiles(name).map((f) => f.path);
+      const ids = instancesBoundToAgent(this.projectDir, name, publisher);
+      if (entry.rendered?.length) {
+        for (const f of entry.rendered) {
+          if (!named.includes(f.path) || claimed(f.path)) continue;
+          const abs = join(this.projectDir, f.path);
+          if (!existsSync(abs)) continue;
+          let intact = false;
+          try {
+            intact = computeHash(abs) === f.sha256;
+          } catch {
+          }
+          found.push({ agent: name, path: f.path, ids, edited: !intact });
         }
+        continue;
+      }
+      for (const rel of named) {
+        if (claimed(rel)) continue;
+        const same = ids.some(
+          (id) => sameRenderUnderName(
+            join(this.projectDir, rel),
+            join(this.projectDir, swapNameInPath(rel, name, id)),
+            id,
+            name
+          )
+        );
+        if (same) found.push({ agent: name, path: rel, ids, edited: false });
+      }
+    }
+    return found;
+  }
+  /**
+   * Remove the leftover files {@link leftoverAgentFiles} lists. A file edited since the lock
+   * stays (it is the user's now) and is named. The old lock entry is rewritten by the same
+   * install, so the lock never keeps a path that is gone; `install --locked` leaves the lock,
+   * which `check` does not read for a file that is gone.
+   *
+   * @returns The project-relative paths removed.
+   */
+  pruneAssetNamedAgentFiles() {
+    const agentDir = resolve(deployedBase("agent", this.harness, false, this.projectDir));
+    const removed = [];
+    for (const f of this.leftoverAgentFiles()) {
+      if (f.edited) {
+        console.warn(
+          `skaile: ${f.path} is no longer written for ${f.agent} (an instance renders it); it was edited, so it stays`
+        );
+        continue;
+      }
+      const abs = join(this.projectDir, f.path);
+      rmSync(abs, { force: true });
+      removed.push(f.path);
+      for (let dir = dirname(abs); dir.startsWith(agentDir + sep); dir = dirname(dir)) {
+        if (readdirSync(dir).length > 0) break;
+        rmSync(dir, { recursive: true, force: true });
       }
     }
     return removed;
   }
+  /**
+   * The `check`, `doctor` and `outdated` lines for the files {@link leftoverAgentFiles} lists: an
+   * untouched one is removed by the next `install` (and by `install --locked`), an edited one
+   * stays. Empty in global mode and when nothing is left over.
+   */
+  leftoverAgentFileNotices() {
+    return this.leftoverAgentFiles().map((f) => {
+      const by = f.ids.length > 0 ? ` (${f.ids.join(", ")} renders it)` : "";
+      return f.edited ? `${f.path} is no longer written for agent ${f.agent}${by}; it was edited, so it stays: delete it by hand` : `${f.path} is left over from an older skaile${by}: skaile install removes it`;
+    });
+  }
   /**
    * Render every agent instance of `skaile.yaml` into the harness target's native
    * agent files (`.claude/agents/<id>.md`, …) and prune the renderings of
@@ -2137,7 +2312,7 @@ var AssetManager = class {
    *
    * @param opts.prune - Also remove the files named after the agent assets that an earlier CLI
    *   rendered and an instance renders now ({@link pruneAssetNamedAgentFiles}). Set by the
-   *   commands that rewrite the lock; `install --locked` leaves the lock, so it leaves them.
+   *   commands that deploy or re-lock; the lock is left as it is by `install --locked`.
    */
   async renderAgentInstances(opts) {
     if (this.global) return {};
@@ -2310,7 +2485,8 @@ var AssetManager = class {
       sourceUrl: declared?.url ?? url,
       commit: entry.source.commit,
       files: entry.files,
-      sha256: entry.sha256
+      sha256: entry.sha256,
+      ...entry.origin === "store" && entry.store ? { storeUrl: entry.store } : {}
     };
   }
   /**
@@ -2499,8 +2675,9 @@ var AssetManager = class {
   /**
    * Every ref that more than one registered library holds, with one row per holder
    * (all libraries, all versions) in the order `add` prefers them: the first row is
-   * the one `add <ref>` deploys. The local index keeps a single row per ref and
-   * version, so `search` reads this to show equal-version copies in both libraries.
+   * the one `add <ref>` deploys. `search` reads this to group the index rows of a ref
+   * (one per library) and mark the copy `add` deploys; the versions come from the files
+   * themselves, which the index follows only after the next `skaile library index`.
    *
    * @returns `kind:@publisher/name` → holders; refs held by one library are absent.
    */
@@ -2525,8 +2702,8 @@ var AssetManager = class {
   }
   /**
    * Every asset a registered library holds, read from the library directories themselves
-   * (not the local index, which keeps one row per ref and version and loses a ref when
-   * another library re-publishes it). One row per holder, all versions.
+   * (not the local index, which lags behind them until the next `skaile library index`).
+   * One row per holder, all versions.
    *
    * @returns `[]` when no library holds an asset. Never warns.
    */
@@ -2920,6 +3097,7 @@ var AssetManager = class {
     const links = readLinks(this.projectDir);
     const checked = /* @__PURE__ */ new Set();
     for (const c of resolved) {
+      if (c.storeUrl) continue;
       if (!c.commit || /^0+$/.test(c.commit) || checked.has(`${c.sourceUrl}@${c.commit}`)) continue;
       checked.add(`${c.sourceUrl}@${c.commit}`);
       const hit = Object.entries(repositories).find(
@@ -3681,10 +3859,15 @@ var AssetManager = class {
     if (byName.state === "ok") return byName;
     if (origin.url) {
       const wanted = normalizeRepoUrl(origin.url);
-      const byUrl = snap?.libraries.find((l) => {
+      const sameRemote = (snap?.libraries ?? []).filter((l) => {
         const url = libraryRemoteUrl(l);
         return l.name !== name && url !== void 0 && normalizeRepoUrl(url) === wanted && existsSync(l.path);
       });
+      const byUrl = (asset && origin.sha256 ? sameRemote.find(
+        (l) => libraryDiskHashes(l.path, /* @__PURE__ */ new Map(), this.registry).get(
+          `${asset.kind}:${asset.name}`
+        ) === origin.sha256
+      ) : void 0) ?? sameRemote[0];
       if (byUrl) return { state: "ok", path: byUrl.path, name: byUrl.name };
     }
     const holder = asset && origin.sha256 ? this.libraryHoldingLockedBytes(origin.sha256, asset, snap) : void 0;
@@ -4264,6 +4447,32 @@ var AssetManager = class {
     }
     return entries;
   }
+  /**
+   * The tail of a `hash mismatch for <file>: expected <lock>, got <fetched>` failure of a locked
+   * restore when the deployed copy already holds the fetched bytes: the lock records another
+   * hash for the file, and `install` (not `install --locked`) writes the right one. Empty for
+   * any other failure, and when the copy is missing or differs from the fetched bytes.
+   */
+  wrongLockHashHint(candidates, reason) {
+    const m = /hash mismatch for (.+): expected [0-9a-f]{64}, got ([0-9a-f]{64})/.exec(reason);
+    if (!m) return "";
+    const [, file, got] = m;
+    for (const c of candidates) {
+      const component = this.installTarget(c.kind);
+      if (!component || component === "agent" || !c.files) continue;
+      const locked = lockedAssetFiles(c.kind, c.files).find((f) => f.path === file);
+      if (!locked) continue;
+      try {
+        const dest = deployedDir(component, c.name, this.harness, this.global, this.projectDir);
+        if (computeHash(join(dest, locked.rel)) !== got) return "";
+      } catch {
+        return "";
+      }
+      return `
+  the lock records another hash for ${file} (the deployed copy holds the bytes the store returns): run \`skaile install\` to re-lock it`;
+    }
+    return "";
+  }
   /**
    * Fetch + SHA-verify the bytes of every store-resolved candidate that needs
    * bytes on disk into `.skaile/cache/store/`, reusing the same verified-fetch
@@ -4396,6 +4605,7 @@ var AssetManager = class {
    */
   candidateHasLocalBytes(c, repositories) {
     if (!c.sourceUrl) return false;
+    if (c.storeUrl) return false;
     const rel = this.primaryManifestRel(c);
     for (const [slug, decl] of Object.entries(repositories)) {
       if (decl.url === void 0 || decl.url !== c.sourceUrl) continue;
@@ -4913,7 +5123,7 @@ Fix the asset, then run \`skaile library index ${origin}\` and install again.`
   ensureSourceClones(repositories, sources, lock) {
     const pinBySlug = pinsBySlug(sources);
     const lockedCommit = /* @__PURE__ */ new Map();
-    for (const s of lock?.sources ?? []) {
+    for (const s of lock ? cloneBackedSources(lock) : []) {
       if (!/^0*$/.test(s.commit)) lockedCommit.set(sourceCacheKey(s.url), s.commit);
     }
     for (const [name, decl] of Object.entries(repositories)) {
@@ -5448,7 +5658,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     const factoryDecl = Object.values(repositories).find((d) => d.factory);
     const factoryDir = factoryDecl?.path ?? null;
     const unavailable = [];
-    for (const src of lock.sources) {
+    for (const src of cloneBackedSources(lock)) {
       if (factoryDir !== null && isFactoryMemorySource(src)) continue;
       const slug = sourceCacheKey(src.url);
       const declared = declBySlug.get(slug);
@@ -5507,8 +5717,10 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
       resolved = await this.buildCatalogEntries(candidates, repositories);
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
-      throw new Error(`Lock file verification failed:
-  ${reason}`);
+      throw new Error(
+        `Lock file verification failed:
+  ${reason}${this.wrongLockHashHint(candidates, reason)}`
+      );
     }
     const library = await this.restoreLibraryLockEntries(lock, { storeFallback: true });
     assertFlowsLoad([...resolved, ...library.entries], "installed");
@@ -5591,7 +5803,7 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
     ];
     this.sweepLegacyOmpCopies([...resolved, ...library.entries]);
     const mcpRestored = await this.renderHarnessMcpConfig();
-    const agentRender = await this.renderAgentInstances();
+    const agentRender = await this.renderAgentInstances({ prune: true });
     const { rewritten, restored: restoredRenderings } = this.changedRenderings(unrecordedRenderings);
     const restored = [
       ...this.restoredCopies(copyDrift, deployed, missingCopies),
@@ -5825,7 +6037,8 @@ Nothing was changed. Copy your edits away, or run \`${forceCommand}\` to replace
       const plain = err.message.endsWith(advice) ? err.message.slice(0, -advice.length) : err.message;
       if (plain.startsWith("publisher required")) {
         const matches = await this.resolvableMatches(ref, repositories, sources);
-        const hint = matches.length === 0 ? ` Find the publisher with \`skaile store search ${ref.trim().replace(/^[^:@/#\s]+:/, "").replace(/#.*$/, "")}\`.` : matches.length === 1 ? ` Did you mean ${matches[0]}?` : ` Did you mean one of: ${matches.join(", ")}?`;
+        const query = ref.trim().replace(/^[^:@/#\s]+:/, "").replace(/#.*$/, "");
+        const hint = matches.length === 0 ? query === "" ? "" : ` Find the publisher with \`skaile store search ${query}\`.` : matches.length === 1 ? ` Did you mean ${matches[0]}?` : ` Did you mean one of: ${matches.join(", ")}?`;
         throw new Error(`${plain}${hint}`);
       }
       const pinned = /^(.*\/[^@#/]+)@([^@#/]+)$/.exec(ref.trim());
@@ -7040,6 +7253,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    */
   listStaleHarnessCopies(opts = {}) {
     if (this.global) return [];
+    const keptCopies = readHarnessSwitchState(this.projectDir).kept;
     const recordedHashes = new Map([
       ...this.lockedRenderedHashes(),
       ...opts.renderedBefore ?? []
@@ -7096,6 +7310,7 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
           }
           const twin = join(activeBase, relative(otherBase, p));
           const skaileWrote = k === "agent" ? locked && matchesRecordedHashes(p, recordedHashes) : !relative(otherBase, p).startsWith("..") && sameBytes(p, twin);
+          if (keptCopies.has(harnessSwitchKeptKey(this.projectDir, p))) continue;
           out.push({ harness: other, kind, name, path: p, skaileWrote });
         }
       }
@@ -7709,12 +7924,17 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
           if (touching !== null) behind = touching;
         }
         if (behind <= 0) continue;
+        const advice = (status.ahead ?? 0) > 0 ? unpublishedCommitAdvice(clone, status.remoteRef) : "";
         result.push({
           kind,
           name,
           publisher: publisher ?? sourceShortName(src.url),
           currentVersion: version ?? "",
-          behind
+          behind,
+          ...advice ? {
+            problem: `${behind} commit(s) behind${advice.replace(/^ - /, ", but the ")}`,
+            manualFix: true
+          } : {}
         });
       }
     }
@@ -8666,11 +8886,12 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       const parts = [
         ...d.modified.map((f) => {
           const instance = d.instanceOf?.get(f);
-          return instance ? `${f}, the file of agent instance "${instance}", was edited` : d.unrecorded ? `${f} differs from the library's content now (the lock keeps no per-file record: it may be a library change, not your edit)` : `${f} was edited`;
+          return instance ? `${f}, the file of agent instance "${instance}", was edited` : d.lockWrong?.includes(f) ? `the lock records another hash for ${f}` : d.unrecorded ? `${f} differs from the library's content now (the lock keeps no per-file record: it may be a library change, not your edit)` : `${f} was edited`;
         }),
         ...d.extra.map((f) => `${f} is not part of the asset`)
       ];
-      const reason = d.libraryChanged ? `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 the library holds other content now: copy your edit away, then run \`skaile update --force\` to replace it` : `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
+      const onlyLockWrong = d.extra.length === 0 && d.modified.every((f) => d.lockWrong?.includes(f));
+      const reason = onlyLockWrong ? `is locked, but ${parts.join("; ")} (the deployed copy is not edited) \u2014 run \`skaile install\` to re-lock it` : d.libraryChanged ? `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 the library holds other content now: copy your edit away, then run \`skaile update --force\` to replace it` : `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
       gaps.push({ type: "modified", ref: d.ref, reason, message: `${d.ref} ${reason}` });
       named.add(gapIdentity(d.ref));
     }
@@ -8722,6 +8943,22 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
         unreadableSource: true
       });
     }
+    for (const entry of this.loadConfig().sources) {
+      if (!entry.pin) continue;
+      const dest = join(getGlobalCacheDir(), sourceCacheKey(entry.url));
+      if (existsSync(dest) && cloneIsOnPin(dest, entry.pin)) continue;
+      const missing = missingPinMessage(entry.url, entry.pin);
+      if (!missing) continue;
+      const reason = `is skipped: ${missing} - fix the pin in skaile.yaml`;
+      gaps.push({
+        type: "source",
+        ref: entry.url,
+        reason,
+        message: `source ${sourceShortName(entry.url)} ${reason}`,
+        manualFix: true,
+        unreadableSource: true
+      });
+    }
     for (const u of unboundAgentInstances(this.projectDir, this.harness)) {
       const reason = u.ref.startsWith("agent:") ? await this.unboundAgentReason(u.id, u.ref) : `is bound by agent instance "${u.id}" but resolves to no agent.yaml \u2014 fix the path, or drop the binding from skaile.yaml`;
       gaps.push({
@@ -9618,15 +9855,21 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       }
       const modified = [];
       const locked = lockedAssetFiles(kind, entry.files);
+      const deployedHashes = /* @__PURE__ */ new Map();
       for (const f of locked) {
         const deployedFile = join(dest, f.rel);
         if (!existsSync(deployedFile)) continue;
         try {
-          if (computeHash(deployedFile) !== f.sha256) modified.push(f.rel);
+          const actual = computeHash(deployedFile);
+          if (actual !== f.sha256) {
+            modified.push(f.rel);
+            deployedHashes.set(f.rel, actual);
+          }
         } catch {
           modified.push(f.rel);
         }
       }
+      const lockWrong = deployedHashes.size === modified.length ? lockRecordsOtherHash(entry, kind, deployedHashes) : [];
       const covered = new Set(locked.map((f) => f.rel));
       let extra = [];
       try {
@@ -9634,14 +9877,25 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
       } catch {
       }
       if (modified.length > 0 || extra.length > 0)
-        out.push({ ref: refOf(key), key, modified, extra, library: false });
+        out.push({
+          ref: refOf(key),
+          key,
+          modified,
+          extra,
+          library: false,
+          ...lockWrong.length > 0 ? { lockWrong } : {}
+        });
     }
     let snapForAgents;
+    const superseded = this.supersededRendering();
     for (const [key, entry] of Object.entries(lock.assets)) {
-      const recorded = [...entry.rendered ?? [], ...entry.composed ?? []];
-      if (recorded.length === 0 || entry.library?.installed) continue;
       const { kind, name } = parseCanonicalLockKey(key);
       if (!kind || !name || this.installTarget(kind) !== "agent") continue;
+      const recorded = [
+        ...(entry.rendered ?? []).filter((f) => !superseded(name, f.path)),
+        ...entry.composed ?? []
+      ];
+      if (recorded.length === 0 || entry.library?.installed) continue;
       if (patches[`${kind}:${name}`]) continue;
       const modified = [];
       for (const f of recorded) {
@@ -9692,13 +9946,16 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
    */
   async undeployedLockGaps(lock, named) {
     const gaps = [];
+    const superseded = this.supersededRendering();
     for (const [key, entry] of Object.entries(lock?.assets ?? {})) {
       if (entry.library?.installed) continue;
       const { publisher, kind, name } = parseCanonicalLockKey(key);
       const component = kind ? this.installTarget(kind) : void 0;
       if (!kind || !name || !component || named.has(`${kind}:${name}`)) continue;
       if (isAssetDeployed(component, name, this.harness, this.global, this.projectDir)) {
-        const renderedGone = component === "agent" && !this.global && (entry.rendered ?? []).some((f) => !existsSync(join(this.projectDir, f.path)));
+        const renderedGone = component === "agent" && !this.global && (entry.rendered ?? []).some(
+          (f) => !superseded(name, f.path) && !existsSync(join(this.projectDir, f.path))
+        );
         if (!renderedGone) continue;
       }
       const ref = publisher ? `${kind}:@${publisher}/${name}` : `${kind}:${name}`;
@@ -10362,6 +10619,6 @@ Fix the asset in the source repo, then run \`skaile source sync\` and add it aga
   }
 };
 
-export { AssetManager, LibraryEntryError, MissingManifestError, installAgentInstances, labelDiffHeaders, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, setLibraryAssetCheck, setRenamedEntryLookup, softDepName };
-//# sourceMappingURL=chunk-23Q5LT4U.js.map
-//# sourceMappingURL=chunk-23Q5LT4U.js.map
+export { AssetManager, LibraryEntryError, MissingManifestError, harnessSwitchKeptKey, harnessSwitchStateFile, installAgentInstances, labelDiffHeaders, mcpNotRunnableReason, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, readHarnessSwitchState, renderMcpServerConfig, setLibraryAssetCheck, setRenamedEntryLookup, softDepName, writeHarnessSwitchState };
+//# sourceMappingURL=chunk-4I4SBOCS.js.map
+//# sourceMappingURL=chunk-4I4SBOCS.js.map