feat(artifacts): a shared skill follows its owner's folder; installers get Update

A skill in the Hub was a snapshot taken once: the owner changing
~/.claude/skills/<name> changed nothing there, and an installer had to
uninstall and install again to get a newer version.

- syncSkillSources (on GET /api/artifacts, at most every 15 s): a skill row
  taken from a folder — the owner's ~/.claude/skills/<name>, or the
  workspace's .claude/skills/<name> — is brought up to it. Only a folder
  whose names/sizes/mtimes changed is read again, with a pick's checks (no
  symlink, no secret, <= 5 MB, a member's files as theirs); a change is a
  NEW snapshot, the old one dropped, and an artifact_changed broadcast.
- artifacts.version (snapshot content hash) and source_hash (the folder's
  when last taken, additive columns): an upload or a Hub edit records the
  folder as it is then, so only a LATER folder change replaces it.
- A list row's updateAvailable: installed, and the viewer's copy differs
  from version. The page shows Update (a pack: Update N); install with
  {update: true} replaces the copies (old ones moved aside) and is not
  counted as another install.

server/__tests__/artifacts.test.js

@@ -10,8 +10,10 @@
  * junk skipped, nothing stored when one fails) or written in the dialog, a
  * file uploaded, sharing refused in local mode, visibility for a server-mode
  * developer, the admin's installs switch, same-origin writes, Claude Docs
- * docs captured at their birth, documents captured at a session's stop, and
- * unowned rows claimed, declined and assigned.
+ * docs captured at their birth, documents captured at a session's stop,
+ * unowned rows claimed, declined and assigned, and a skill that follows its
+ * source folder (a newer change wins over a Hub edit) with Update offered to
+ * an installed copy that differs.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -338,6 +340,69 @@ describe("skills", () => {
     assert.equal(empty.status, 400);
   });
 
+  it("follows its source folder and offers Update to an installed copy", async () => {
+    const src = path.join(ws, ".claude", "skills", "notes");
+    fs.mkdirSync(src, { recursive: true });
+    fs.writeFileSync(path.join(src, "SKILL.md"), "---\nname: notes\ndescription: v1\n---\nOne.\n");
+    const r = await request("POST", "/api/artifacts/skill", { laneId: lane.id, name: "notes" });
+    assert.equal(r.status, 201, r.text);
+    const id = r.body.item.id;
+    const listed = async () =>
+      (await request("GET", "/api/artifacts?kind=skill")).body.items.find((i) => i.id === id);
+    const raw = async () => (await request("GET", `/api/artifacts/${id}/raw?path=SKILL.md`)).text;
+    assert.equal((await request("POST", `/api/artifacts/${id}/install`, {})).status, 200);
+    let item = await listed();
+    assert.equal(item.installed, true);
+    assert.equal(item.updateAvailable, false);
+    const installs = item.installs;
+
+    // Unchanged folder: nothing taken.
+    assert.deepEqual(artifacts.syncSkillSources({ force: true }), []);
+    // The owner changes it: a new snapshot, and the installed copy is behind.
+    const snapBefore = db.prepare("SELECT snapshot FROM artifacts WHERE id = ?").get(id).snapshot;
+    fs.writeFileSync(path.join(src, "SKILL.md"), "---\nname: notes\ndescription: v2\n---\nTwo.\n");
+    fs.writeFileSync(path.join(src, "extra.md"), "more\n");
+    const changed = artifacts.syncSkillSources({ force: true });
+    assert.deepEqual(
+      changed.map((c) => c.id),
+      [id]
+    );
+    assert.match(await raw(), /Two\./);
+    assert.ok(!fs.existsSync(path.join(process.env.DASHBOARD_DATA_DIR, "artifacts", snapBefore)));
+    item = await listed();
+    assert.equal(item.description, "v2");
+    assert.ok(item.files.some((f) => f.path === "extra.md"));
+    assert.equal(item.updateAvailable, true);
+
+    // Update: the copy is replaced (old one moved aside), not counted again.
+    const up = await request("POST", `/api/artifacts/${id}/install`, { update: true });
+    assert.equal(up.status, 200, up.text);
+    const target = path.join(process.env.CLAUDE_HOME, "skills", "notes");
+    assert.match(fs.readFileSync(path.join(target, "SKILL.md"), "utf8"), /Two\./);
+    item = await listed();
+    assert.equal(item.updateAvailable, false);
+    assert.equal(item.installs, installs);
+
+    // A Hub edit is not undone by the unchanged folder; a newer folder change wins.
+    const edit = await request("PATCH", `/api/artifacts/${id}`, {
+      skill: { name: "notes", description: "hub", content: "Edited in the Hub." },
+    });
+    assert.equal(edit.status, 200, edit.text);
+    artifacts.syncSkillSources({ force: true });
+    assert.match(await raw(), /Edited in the Hub\./);
+    fs.writeFileSync(
+      path.join(src, "SKILL.md"),
+      "---\nname: notes\ndescription: v3\n---\nThree.\n"
+    );
+    artifacts.syncSkillSources({ force: true });
+    assert.match(await raw(), /Three\./);
+
+    // Update needs an installed copy.
+    await request("POST", `/api/artifacts/${id}/uninstall`, {});
+    const none = await request("POST", `/api/artifacts/${id}/install`, { update: true });
+    assert.equal(none.body.error.code, "ENOTINSTALLED");
+  });
+
   it("refuses a skill holding a symlink or a secret-looking file", async () => {
     const bad = path.join(ws, ".claude", "skills", "leaky");
     fs.mkdirSync(bad, { recursive: true });