takomi 2.1.34 → 2.1.36

package/src/cli.js

@@ -23,6 +23,7 @@ import {
   downloadDirectoryFromGitHub,
 } from './utils.js';
 import {
+  HARNESS_MAP,
   detectHarnesses,
   printHarnessStatus,
   syncToAllHarnesses,
@@ -393,6 +394,43 @@ async function promptSkillsInstallSelection() {
   return { mode: response.mode, selectedSkills };
 }
 
+function normalizeHarnessSyncMode(value) {
+  return ['copy', 'symlink', 'auto'].includes(value) ? value : 'copy';
+}
+
+async function promptHarnessSyncMode(initial = 'auto') {
+  const normalizedInitial = normalizeHarnessSyncMode(initial);
+  const choices = [
+    { title: 'Auto (try symlink, copy if blocked)', value: 'auto', description: 'Best fallback when Windows permissions or filesystems block symlinks.' },
+    { title: 'Symlink / Junction (single source of truth)', value: 'symlink', description: 'Each managed skill/workflow points back to ~/.takomi; edits update one canonical copy.' },
+    { title: 'Copy (independent files)', value: 'copy', description: 'Most compatible; changes do not flow back to ~/.takomi.' },
+  ];
+  const response = await prompts({
+    type: 'select',
+    name: 'syncMode',
+    message: 'How should Takomi sync store resources into harness folders?',
+    choices,
+    initial: Math.max(0, choices.findIndex((choice) => choice.value === normalizedInitial)),
+  });
+  if (!response.syncMode) return null;
+  return normalizeHarnessSyncMode(response.syncMode);
+}
+
+function collectSyncFailures(syncSummary) {
+  return Object.entries(syncSummary || {})
+    .filter(([, result]) => result?.ok === false)
+    .map(([id, result]) => ({ id, errors: result.errors?.length ? result.errors : ['unknown sync error'] }));
+}
+
+function printSyncFailures(failures) {
+  if (!failures.length) return;
+  console.log(pc.yellow('\nSome harnesses did not fully sync:'));
+  for (const failure of failures) {
+    console.log(pc.dim(`  - ${failure.id}: ${failure.errors.join('; ')}`));
+  }
+  process.exitCode = 1;
+}
+
 async function installSkillsTarget() {
   console.log(pc.magenta('🧰 Takomi Skills Install\n'));
   try {
@@ -411,7 +449,7 @@ async function installSkillsTarget() {
     const result = await installBundledSkills(program.version(), selection);
     const validation = await validateSkillsInstall(selection.selectedSkills);
     printSkillsInstallSummary(result, validation);
-    console.log(pc.dim('\nGlobal skills are ready for Pi or other supported harnesses.\n'));
+    console.log(pc.dim('\nShared skills target is ready. For per-harness global paths, run "takomi setup" or "takomi sync".\n'));
   } catch (error) {
     console.log(pc.red('\nSkills install failed.'));
     console.log(pc.dim(String(error?.message || error)));
@@ -622,7 +660,7 @@ async function install(target) {
 
   if (detected.length === 0) {
     console.log(pc.yellow('  No AI harnesses detected on this machine.'));
-    console.log(pc.dim('  We support: Antigravity, KiloCode, Windsurf, Codex, Cursor, Gemini CLI'));
+    console.log(pc.dim(`  We support: ${Object.values(HARNESS_MAP).map(h => h.name).join(', ')}`));
     console.log(pc.dim('  Run "takomi init" instead for per-project setup.\n'));
     return;
   }
@@ -715,6 +753,11 @@ async function install(target) {
 
   if (!contentResponse.content) return;
 
+  const syncMode = await promptHarnessSyncMode(
+    (hasExistingStoreSkills || hasExistingStoreWorkflows) ? existingStoreManifest.syncMode : 'auto'
+  );
+  if (!syncMode) return;
+
   try {
     // 4. Initialize global store
     console.log(pc.cyan(`\n📦 Creating global store (${STORE_PATH})...\n`));
@@ -802,11 +845,15 @@ async function install(target) {
     const syncSummary = await syncToAllHarnesses(selectedHarnesses, STORE_PATH, {
       useOwnership: true,
       owned: manifest.harnessOwned,
+      linkMode: syncMode,
     });
 
     // 7. Update manifest
+    const syncFailures = collectSyncFailures(syncSummary);
+    const successfulHarnesses = selectedHarnesses.filter(h => !syncFailures.some(failure => failure.id === h.id));
     manifest = await getManifest();
-    manifest.linkedHarnesses = selectedHarnesses.map(h => h.id);
+    manifest.linkedHarnesses = successfulHarnesses.map(h => h.id);
+    manifest.syncMode = syncMode;
     manifest.installed.skills = await getStoreSkills();
     manifest.installed.workflows = await getStoreWorkflows();
     manifest.harnessOwned = manifest.harnessOwned || {};
@@ -814,11 +861,13 @@ async function install(target) {
       manifest.harnessOwned[harness.id] = syncSummary[harness.id]?.owned || manifest.harnessOwned[harness.id] || {};
     }
     await writeManifest(manifest);
+    printSyncFailures(syncFailures);
 
     // 8. Summary
-    console.log(pc.magenta('\n✨ Your command center is live. ✨'));
+    console.log(pc.magenta(syncFailures.length ? '\n⚠ Your command center is partially synced. ⚠' : '\n✨ Your command center is live. ✨'));
     console.log(pc.white(`\n  Store:     ${STORE_PATH}`));
-    console.log(pc.white(`  Connected: ${selectedHarnesses.map(h => h.name).join(', ')}`));
+    console.log(pc.white(`  Sync mode: ${syncMode}`));
+    console.log(pc.white(`  Connected: ${successfulHarnesses.map(h => h.name).join(', ') || 'none'}`));
     console.log(pc.dim(`\n  Add skills:    takomi add <github-url>`));
     console.log(pc.dim(`  Sync updates:  takomi sync\n`));
 
@@ -882,23 +931,33 @@ async function sync(target) {
 
   const selectedHarnesses = detected.filter(h => response.harnesses.includes(h.id));
 
-  console.log(pc.cyan('\n📡 Syncing from global store...\n'));
+  const envSyncMode = process.env.TAKOMI_HARNESS_SYNC_MODE;
+  const syncMode = normalizeHarnessSyncMode(envSyncMode || manifest.syncMode || 'copy');
+  console.log(pc.cyan(`\n📡 Syncing from global store (${syncMode})...\n`));
   const syncSummary = await syncToAllHarnesses(selectedHarnesses, STORE_PATH, {
     useOwnership: true,
     owned: manifest.harnessOwned,
+    linkMode: syncMode,
   });
 
   // Update manifest with current harnesses
-  manifest.linkedHarnesses = [...new Set([...manifest.linkedHarnesses, ...response.harnesses])];
+  const syncFailures = collectSyncFailures(syncSummary);
+  const successfulHarnessIds = response.harnesses.filter(id => !syncFailures.some(failure => failure.id === id));
+  manifest.linkedHarnesses = [...new Set([...manifest.linkedHarnesses, ...successfulHarnessIds])];
+  if (!envSyncMode) manifest.syncMode = syncMode;
   manifest.harnessOwned = manifest.harnessOwned || {};
   for (const harness of selectedHarnesses) {
     manifest.harnessOwned[harness.id] = syncSummary[harness.id]?.owned || manifest.harnessOwned[harness.id] || {};
   }
   await writeManifest(manifest);
+  printSyncFailures(syncFailures);
 
   const skills = await getStoreSkills();
   const workflows = await getStoreWorkflows();
-  console.log(pc.magenta(`\n✨ ${skills.length} skills and ${workflows.length} workflows synced to ${selectedHarnesses.length} IDE(s). Ready to build.\n`));
+  const syncedCount = successfulHarnessIds.length;
+  console.log(pc.magenta(syncFailures.length
+    ? `\n⚠ ${skills.length} skills and ${workflows.length} workflows partially synced to ${syncedCount}/${selectedHarnesses.length} IDE(s).\n`
+    : `\n✨ ${skills.length} skills and ${workflows.length} workflows synced to ${syncedCount} IDE(s). Ready to build.\n`));
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -928,11 +987,14 @@ async function add(url) {
   console.log(pc.cyan('📡 Fetching from GitHub...\n'));
 
   // Try assets/.agent/skills/ first (Takomi structure)
+  const githubOptions = { repo: repoSlug };
+
   let skillCount = await downloadDirectoryFromGitHub(
     'assets/.agent/skills',
     skillsDest,
     null,
-    250
+    250,
+    githubOptions
   );
 
   // Fallback: try .agent/skills/
@@ -941,7 +1003,8 @@ async function add(url) {
       '.agent/skills',
       skillsDest,
       null,
-      250
+      250,
+      githubOptions
     );
   }
 
@@ -950,7 +1013,8 @@ async function add(url) {
     'assets/.agent/workflows',
     workflowsDest,
     (item) => item.name.endsWith('.md'),
-    250
+    250,
+    githubOptions
   );
 
   if (workflowCount === 0) {
@@ -958,7 +1022,8 @@ async function add(url) {
       '.agent/workflows',
       workflowsDest,
       (item) => item.name.endsWith('.md'),
-      250
+      250,
+      githubOptions
     );
   }
 
@@ -988,8 +1053,21 @@ async function add(url) {
     if (syncResponse.doSync) {
       const detected = detectHarnesses();
       const linked = detected.filter(h => manifest.linkedHarnesses.includes(h.id));
-      await syncToAllHarnesses(linked, STORE_PATH);
-      console.log(pc.magenta(`\n✨ Live on ${linked.length} IDE(s). You're armed and ready.\n`));
+      const syncSummary = await syncToAllHarnesses(linked, STORE_PATH, {
+        useOwnership: true,
+        owned: manifest.harnessOwned,
+        linkMode: normalizeHarnessSyncMode(process.env.TAKOMI_HARNESS_SYNC_MODE || manifest.syncMode || 'copy'),
+      });
+      const syncFailures = collectSyncFailures(syncSummary);
+      manifest.harnessOwned = manifest.harnessOwned || {};
+      for (const harness of linked) {
+        manifest.harnessOwned[harness.id] = syncSummary[harness.id]?.owned || manifest.harnessOwned[harness.id] || {};
+      }
+      await writeManifest(manifest);
+      printSyncFailures(syncFailures);
+      console.log(pc.magenta(syncFailures.length
+        ? `\n⚠ Live on ${linked.length - syncFailures.length}/${linked.length} IDE(s); some harnesses need attention.\n`
+        : `\n✨ Live on ${linked.length} IDE(s). You're armed and ready.\n`));
     }
   } else {
     console.log(pc.dim('\n  Run "takomi sync" when you want to push these to your IDEs.\n'));
@@ -1016,6 +1094,7 @@ async function harnesses() {
     console.log(pc.white(`  Location:  ${STORE_PATH}`));
     console.log(pc.white(`  Skills:    ${skills.length} ready to deploy`));
     console.log(pc.white(`  Workflows: ${workflows.length} available`));
+    console.log(pc.white(`  Sync mode: ${manifest.syncMode || 'copy'}`));
     console.log(pc.white(`  Connected: ${manifest.linkedHarnesses.join(', ') || 'none'}`));
     console.log(pc.dim(`  Updated:   ${manifest.updatedAt}\n`));
   } else {
@@ -1050,19 +1129,30 @@ async function updateProjectResources() {
   if (!response.components || response.components.length === 0) return;
 
   const destRoot = process.cwd();
+  let remoteDownloadCount = 0;
+  let remoteUpdateRequested = false;
+  const remoteFailures = [];
+  const runRemoteUpdate = async (label, updater) => {
+    remoteUpdateRequested = true;
+    try {
+      remoteDownloadCount += await updater();
+    } catch (error) {
+      remoteFailures.push(`${label}: ${error.message}`);
+    }
+  };
 
   if (response.components.includes('agent')) {
     const agentDest = path.join(destRoot, '.agent');
-    await updateWorkflows(path.join(agentDest, 'workflows'));
-    await updateSkills(path.join(agentDest, 'skills'));
+    await runRemoteUpdate('workflows', () => updateWorkflows(path.join(agentDest, 'workflows')));
+    await runRemoteUpdate('skills', () => updateSkills(path.join(agentDest, 'skills')));
   }
 
   if (response.components.includes('yamls')) {
-    await updateAgentYamls(path.join(destRoot, 'Takomi-Agents'));
+    await runRemoteUpdate('agent YAMLs', () => updateAgentYamls(path.join(destRoot, 'Takomi-Agents')));
   }
 
   if (response.components.includes('legacy')) {
-    await updateLegacyManual(path.join(destRoot, 'Legacy-Protocols'));
+    await runRemoteUpdate('legacy protocols', () => updateLegacyManual(path.join(destRoot, 'Legacy-Protocols')));
   }
 
   // Update global store if selected
@@ -1079,8 +1169,19 @@ async function updateProjectResources() {
       const detected = detectHarnesses();
       const linked = detected.filter(h => manifest.linkedHarnesses.includes(h.id));
       if (linked.length > 0) {
-        console.log(pc.cyan('\n📡 Auto-syncing to linked harnesses...\n'));
-        await syncToAllHarnesses(linked, STORE_PATH);
+        const syncMode = normalizeHarnessSyncMode(process.env.TAKOMI_HARNESS_SYNC_MODE || manifest.syncMode || 'copy');
+        console.log(pc.cyan(`\n📡 Auto-syncing to linked harnesses (${syncMode})...\n`));
+        const syncSummary = await syncToAllHarnesses(linked, STORE_PATH, {
+          useOwnership: true,
+          owned: manifest.harnessOwned,
+          linkMode: syncMode,
+        });
+        const syncFailures = collectSyncFailures(syncSummary);
+        manifest.harnessOwned = manifest.harnessOwned || {};
+        for (const harness of linked) {
+          manifest.harnessOwned[harness.id] = syncSummary[harness.id]?.owned || manifest.harnessOwned[harness.id] || {};
+        }
+        printSyncFailures(syncFailures);
       }
     }
 
@@ -1089,6 +1190,19 @@ async function updateProjectResources() {
     await writeManifest(manifest);
   }
 
+  if (remoteFailures.length) {
+    console.log(pc.red('\nSome project resources failed to download from GitHub:'));
+    for (const failure of remoteFailures) console.log(pc.dim(`  - ${failure}`));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (remoteUpdateRequested && remoteDownloadCount === 0) {
+    console.log(pc.red('\nNo project resources were downloaded from GitHub. Check the network or repository paths.'));
+    process.exitCode = 1;
+    return;
+  }
+
   console.log(pc.magenta('\n✨ Your toolkit is fresh and ready to ship.'));
 }
 
@@ -1116,7 +1230,7 @@ Examples:
   takomi refresh pi   Refresh only Pi-related pieces
 
 Legacy aliases still work:
-  install -> setup, sync/upgrade -> refresh, init -> setup project,
+  install -> setup, sync -> sync, upgrade -> refresh, init -> setup project,
   harnesses -> status, update -> refresh project
 `);
 
@@ -1171,8 +1285,8 @@ program
 // Re-sync (legacy alias)
 program
   .command('sync [target]', { hidden: true })
-  .description('Legacy alias: use "takomi refresh [target]"')
-  .action(refresh);
+  .description('Legacy alias for global store sync')
+  .action(sync);
 
 // Add remote skills (NEW)
 program

package/src/harness.js

@@ -1,8 +1,8 @@
 import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
-import crypto from 'crypto';
 import pc from 'picocolors';
+import { hashPath, normalizeOwnedMap, materializeOwnedTree } from './owned-tree.js';
 
 // ─── Cross-Platform Home Directory ───────────────────────────────────────────
 const HOME = os.homedir();
@@ -34,13 +34,26 @@ function getAppData() {
 export const HARNESS_MAP = {
   antigravity: {
     name: 'Antigravity',
-    rootPath: path.join(HOME, '.gemini', 'antigravity'),
+    rootPath: path.join(HOME, '.gemini', 'config'),
     detect() {
       return fs.existsSync(this.rootPath);
     },
     targets: {
-      skills: path.join(HOME, '.gemini', 'antigravity', 'skills'),
-      workflows: path.join(HOME, '.gemini', 'antigravity', 'global_workflows'),
+      skills: path.join(HOME, '.gemini', 'config', 'skills'),
+      workflows: path.join(HOME, '.gemini', 'config', 'global_workflows'),
+      yamls: null,
+    },
+  },
+
+  claude_code: {
+    name: 'Claude Code',
+    rootPath: path.join(HOME, '.claude'),
+    detect() {
+      return fs.existsSync(this.rootPath);
+    },
+    targets: {
+      skills: path.join(HOME, '.claude', 'skills'),
+      workflows: null,
       yamls: null,
     },
   },
@@ -78,7 +91,20 @@ export const HARNESS_MAP = {
     name: 'Codex',
     rootPath: path.join(HOME, '.codex'),
     detect() {
-      return fs.existsSync(this.rootPath);
+      return fs.existsSync(this.rootPath) || fs.existsSync('/etc/codex');
+    },
+    targets: {
+      skills: path.join(HOME, '.codex', 'skills'),
+      workflows: null,
+      yamls: null,
+    },
+  },
+
+  pi: {
+    name: 'Pi / shared Agent Skills',
+    rootPath: path.join(HOME, '.pi'),
+    detect() {
+      return fs.existsSync(this.rootPath) || fs.existsSync(path.join(HOME, '.agents'));
     },
     targets: {
       skills: path.join(HOME, '.agents', 'skills'),
@@ -100,19 +126,7 @@ export const HARNESS_MAP = {
     },
   },
 
-  gemini_cli: {
-    name: 'Gemini CLI',
-    rootPath: path.join(HOME, '.gemini'),
-    detect() {
-      // Only match bare Gemini CLI — not Antigravity (which also lives under .gemini)
-      return fs.existsSync(this.rootPath) && !fs.existsSync(path.join(HOME, '.gemini', 'antigravity'));
-    },
-    targets: {
-      skills: path.join(HOME, '.agents', 'skills'),
-      workflows: null,
-      yamls: null,
-    },
-  },
+
 };
 
 // ─── Detection ───────────────────────────────────────────────────────────────
@@ -163,55 +177,14 @@ export function printHarnessStatus(detected) {
 
 /**
  * Syncs a source directory to a harness target path.
- * Uses hard copy (fs.copy) — no symlinks.
+ * Supports copy, symlink/junction, or auto-fallback materialization.
+ * When ownership is supplied, it also prunes previous Takomi-owned items
+ * that are no longer in the source while preserving manual or modified files.
  *
  * @param {string} sourcePath  - Source directory (e.g., ~/.takomi/skills/)
- * @param {string} targetPath  - Destination directory (e.g., ~/.gemini/antigravity/skills/)
+ * @param {string} targetPath  - Destination directory (e.g., ~/.gemini/config/skills/)
  * @param {string} label       - Human-readable label for logging
- * @returns {Promise<number>}  - Number of items copied
- */
-function sha256(value) {
-  return crypto.createHash('sha256').update(value).digest('hex');
-}
-
-async function hashPath(targetPath) {
-  if (!await fs.pathExists(targetPath)) return null;
-  const stat = await fs.stat(targetPath);
-  if (stat.isFile()) return sha256(await fs.readFile(targetPath));
-
-  const entries = [];
-  async function walk(current, prefix = '') {
-    const names = (await fs.readdir(current)).sort();
-    for (const name of names) {
-      const full = path.join(current, name);
-      const rel = path.join(prefix, name).replace(/\\/g, '/');
-      const st = await fs.stat(full);
-      if (st.isDirectory()) {
-        entries.push(`dir:${rel}`);
-        await walk(full, rel);
-      } else {
-        entries.push(`file:${rel}:${sha256(await fs.readFile(full))}`);
-      }
-    }
-  }
-  await walk(targetPath);
-  return sha256(entries.join('\n'));
-}
-
-function normalizeOwnedMap(value) {
-  if (!value || typeof value !== 'object') return {};
-  const normalized = {};
-  for (const [name, entry] of Object.entries(value)) {
-    if (typeof entry === 'string') normalized[name] = { hash: entry };
-    else if (entry?.hash) normalized[name] = entry;
-  }
-  return normalized;
-}
-
-/**
- * Syncs a directory to a target path. When ownership is supplied, it also
- * prunes previous Takomi-owned items that are no longer in the source while
- * preserving manual or modified files.
+ * @returns {Promise<number|object>}  - Number of items materialized, or details
  */
 export async function syncDirectory(sourcePath, targetPath, label = '', options = {}) {
   if (!targetPath) return options.returnDetails ? { copied: 0, pruned: 0, preservedManual: [], preservedModified: [], owned: {} } : 0;
@@ -225,7 +198,10 @@ export async function syncDirectory(sourcePath, targetPath, label = '', options
     const nextOwned = {};
     const preservedManual = [];
     const preservedModified = [];
+    const symlinkFallbacks = [];
+    const linkMode = options.linkMode || process.env.TAKOMI_HARNESS_SYNC_MODE || 'copy';
     let copied = 0;
+    let linked = 0;
     let pruned = 0;
 
     if (options.prune && Object.keys(previousOwned).length > 0) {
@@ -263,29 +239,35 @@ export async function syncDirectory(sourcePath, targetPath, label = '', options
         await fs.remove(dest);
       }
 
-      await fs.copy(src, dest, { overwrite: true });
+      const materialized = await materializeOwnedTree(src, dest, { linkMode });
       nextOwned[item] = {
         hash: await hashPath(dest),
         targetPath: dest,
+        sourcePath: path.resolve(src),
+        syncMethod: materialized.method,
         syncedAt: new Date().toISOString(),
       };
-      copied++;
+      if (materialized.method === 'symlink') linked++;
+      else copied++;
+      if (materialized.fallbackError) symlinkFallbacks.push(`${item}: ${materialized.fallbackError}`);
     }
 
     if (label) {
       const suffix = pruned ? `, removed ${pruned}` : '';
-      console.log(pc.green(`  ✔ ${label} (${copied} items${suffix})`));
+      const methodSummary = linked ? `${linked} linked, ${copied} copied` : `${copied} copied`;
+      console.log(pc.green(`  ✔ ${label} (${methodSummary}${suffix})`));
       if (preservedManual.length) console.log(pc.yellow(`    Preserved manual items: ${preservedManual.join(', ')}`));
       if (preservedModified.length) console.log(pc.yellow(`    Preserved modified Takomi-owned items: ${preservedModified.join(', ')}`));
+      if (symlinkFallbacks.length) console.log(pc.yellow(`    Symlink fallback copies: ${symlinkFallbacks.join('; ')}`));
     }
 
-    const details = { copied, pruned, preservedManual, preservedModified, owned: Object.fromEntries(Object.entries(nextOwned).sort(([a], [b]) => a.localeCompare(b))) };
-    return options.returnDetails ? details : copied;
+    const details = { copied: copied + linked, linked, copyCount: copied, pruned, preservedManual, preservedModified, symlinkFallbacks, owned: Object.fromEntries(Object.entries(nextOwned).sort(([a], [b]) => a.localeCompare(b))) };
+    return options.returnDetails ? details : copied + linked;
   } catch (error) {
     if (label) {
       console.log(pc.red(`  ✗ ${label}: ${error.message}`));
     }
-    return options.returnDetails ? { copied: 0, pruned: 0, preservedManual: [], preservedModified: [], owned: {} } : 0;
+    return options.returnDetails ? { copied: 0, linked: 0, copyCount: 0, pruned: 0, preservedManual: [], preservedModified: [], symlinkFallbacks: [], owned: normalizeOwnedMap(options.owned), ok: false, error: error.message } : 0;
   }
 }
 
@@ -329,8 +311,8 @@ export async function syncFile(sourceFile, targetPaths, label = '') {
  * @returns {Promise<{skills: number, workflows: number, yamls: number}>}
  */
 export async function syncToHarness(harness, storePath, options = {}) {
-  const results = { skills: 0, workflows: 0, yamls: 0, owned: { skills: {}, workflows: {} } };
   const harnessOwned = options.owned?.[harness.id] || {};
+  const results = { skills: 0, workflows: 0, yamls: 0, owned: { skills: normalizeOwnedMap(harnessOwned.skills), workflows: normalizeOwnedMap(harnessOwned.workflows) }, ok: true, errors: [] };
   const useOwnership = Boolean(options.useOwnership);
 
   console.log(pc.cyan(`\n  📡 Syncing to ${harness.name}...`));
@@ -347,11 +329,16 @@ export async function syncToHarness(harness, storePath, options = {}) {
         preserveManual: useOwnership,
         prune: useOwnership,
         returnDetails: useOwnership,
+        linkMode: options.linkMode,
       },
     );
     if (useOwnership) {
       results.skills = skillResult.copied;
       results.owned.skills = skillResult.owned;
+      if (skillResult.ok === false) {
+        results.ok = false;
+        results.errors.push(skillResult.error);
+      }
     } else {
       results.skills = skillResult;
     }
@@ -369,11 +356,16 @@ export async function syncToHarness(harness, storePath, options = {}) {
         preserveManual: useOwnership,
         prune: useOwnership,
         returnDetails: useOwnership,
+        linkMode: options.linkMode,
       },
     );
     if (useOwnership) {
       results.workflows = workflowResult.copied;
       results.owned.workflows = workflowResult.owned;
+      if (workflowResult.ok === false) {
+        results.ok = false;
+        results.errors.push(workflowResult.error);
+      }
     } else {
       results.workflows = workflowResult;
     }

package/src/owned-tree.js

@@ -0,0 +1,114 @@
+import fs from 'fs-extra';
+import path from 'path';
+import crypto from 'crypto';
+import { createReadStream } from 'fs';
+
+export function sha256(value) {
+  return crypto.createHash('sha256').update(value).digest('hex');
+}
+
+async function hashFile(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = createReadStream(filePath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('error', reject);
+    stream.on('end', () => resolve(hash.digest('hex')));
+  });
+}
+
+/**
+ * Hash a file tree without following symlinks.
+ *
+ * Symlinks are represented by their link target string instead of the linked
+ * file contents. This prevents store/harness reconciliation from recursively
+ * reading outside the intended tree or looping through symlink cycles.
+ */
+export async function hashPath(targetPath) {
+  if (!await fs.pathExists(targetPath)) return null;
+
+  const rootStat = await fs.lstat(targetPath);
+  if (rootStat.isSymbolicLink()) return sha256(`symlink:${await fs.readlink(targetPath).catch(() => '')}`);
+  if (rootStat.isFile()) return hashFile(targetPath);
+  if (!rootStat.isDirectory()) return sha256(`other:${rootStat.mode}:${rootStat.size}`);
+
+  const entries = [];
+  async function walk(current, prefix = '') {
+    const names = (await fs.readdir(current)).sort();
+    for (const name of names) {
+      const full = path.join(current, name);
+      const rel = path.join(prefix, name).replace(/\\/g, '/');
+      const stat = await fs.lstat(full);
+      if (stat.isSymbolicLink()) {
+        const linkTarget = await fs.readlink(full).catch(() => '');
+        entries.push(`symlink:${rel}:${linkTarget}`);
+      } else if (stat.isDirectory()) {
+        entries.push(`dir:${rel}`);
+        await walk(full, rel);
+      } else if (stat.isFile()) {
+        entries.push(`file:${rel}:${await hashFile(full)}`);
+      } else {
+        entries.push(`other:${rel}:${stat.mode}:${stat.size}`);
+      }
+    }
+  }
+  await walk(targetPath);
+  return sha256(entries.join('\n'));
+}
+
+export function normalizeOwnedMap(value) {
+  if (!value || typeof value !== 'object') return {};
+  const normalized = {};
+  for (const [name, entry] of Object.entries(value)) {
+    if (typeof entry === 'string') normalized[name] = { hash: entry };
+    else if (entry?.hash) normalized[name] = entry;
+  }
+  return normalized;
+}
+
+export async function copyOwnedTree(src, dest, options = {}) {
+  const { allowSymlinks = false, filter, ...copyOptions } = options;
+  await fs.copy(src, dest, {
+    overwrite: true,
+    errorOnExist: false,
+    dereference: false,
+    ...copyOptions,
+    filter: async (candidate) => {
+      if (filter && !await filter(candidate)) return false;
+      if (allowSymlinks) return true;
+      const stat = await fs.lstat(candidate).catch(() => null);
+      if (stat?.isSymbolicLink()) {
+        throw new Error(`Refusing to copy symlink in managed tree: ${candidate}`);
+      }
+      return true;
+    },
+  });
+}
+
+export async function linkOwnedTree(src, dest) {
+  const resolvedSrc = path.resolve(src);
+  const stat = await fs.lstat(resolvedSrc);
+  const type = stat.isDirectory()
+    ? (process.platform === 'win32' ? 'junction' : 'dir')
+    : 'file';
+  await fs.ensureDir(path.dirname(dest));
+  await fs.symlink(resolvedSrc, dest, type);
+}
+
+export async function materializeOwnedTree(src, dest, options = {}) {
+  const linkMode = options.linkMode || 'copy';
+  if (linkMode === 'symlink' || linkMode === 'auto') {
+    try {
+      await linkOwnedTree(src, dest);
+      return { method: 'symlink' };
+    } catch (error) {
+      if (linkMode === 'symlink') throw error;
+      await fs.remove(dest).catch(() => {});
+      await copyOwnedTree(src, dest, options.copyOptions || {});
+      return { method: 'copy', fallbackError: error.message };
+    }
+  }
+
+  await copyOwnedTree(src, dest, options.copyOptions || {});
+  return { method: 'copy' };
+}