every install is recorded in .agents/rosie.lock — small, line-oriented, diffs cleanly. check it into git.

$ cat .agents/rosie.lock
# rosie-lock v1
slack-gif-creator anthropics/skills    main   5128e186… 2026-05-02T14:32:18Z auto skill
theme-factory     anthropics/skills    v1.0.0 a1b2c3d4… 2026-05-02T14:35:01Z pin  skill
vite              antfu/skills         main   f4d2e9c1… 2026-05-02T14:38:44Z auto skill
house-style       file://./house-style -      -         2026-05-02T14:41:09Z pin  skill
vercel-next.js    vercel/next.js       v15.1.0 9f8e7d6c… 2026-05-09T10:00:00Z auto ref

one line per entry, space-separated: <name> <source> <ref> <sha> <installed-at> <pin|auto> <skill|ref>. rosie-lock v1 is the header marker; legacy v0 files (no header, skill-only) are read transparently and rewritten on the next mutating command.

• ▸ auto installed without a ref · rosie update advances to the latest semver tag
• ▸ pin installed with @ref · ref stays put, only the SHA refreshes
• ▸ skill directory installed into .agents/skills/ with per-agent symlinks
• ▸ ref single markdown doc indexed in the project's AGENTS.md / CLAUDE.md / etc.
• ▸ file:// rosie install ./my-skill writes a file:// source · hand-authored skills in your repo travel with it · with --global, the same form lands in ~/.agents/rosie.lock with an absolute path
• ▸ npm: --npm refs use npm:<pkg>#<file> as the source · sha column holds the installed npm version