1lev1-mcp 1.0.2 → 2.0.0

package/README.md

@@ -13,12 +13,41 @@ By connecting, your AI agent gains "superpowers" within the 1lev1 system:
 
 ## Installation & Usage
 
-Once the package is published to NPM, no prior installation is needed. Simply run:
+No prior installation is needed. Simply run:
 
 ```bash
 npx 1lev1-mcp
 ```
 
+This does two things:
+
+1. **Connects** — opens 1lev1.com, you log in and approve, and the API key is
+   written into every AI agent you actually have installed.
+2. **Installs the skill** — the standing instructions that teach the agent what
+   a rikma is, that logged hours are ownership, and that it must never vote or
+   sign a profit-split on somebody else's behalf. The connection gives the agent
+   hands; the skill gives it judgement.
+
+Restart your agent afterwards to pick up the new config.
+
+To undo everything:
+
+```bash
+npx 1lev1-mcp remove
+```
+
+That removes the server entry and the skill from every agent config. The API key
+itself stays valid until you revoke it at **1lev1.com → Settings → API keys**.
+
+### What it will not touch
+
+- Config files that are not plain JSON (VS Code `settings.json` with comments,
+  for example) are **left alone** and reported, never rewritten.
+- Agents you have not installed are skipped — no directories are created and no
+  API key is written for a tool you do not use.
+- Every file it does modify is backed up once to `<file>.1lev1.bak` first, and
+  written atomically.
+
 ## Customization (for Developers)
 
 To use this tool for your own MCP project, follow these two simple steps:

package/bin/cli.js

@@ -1,20 +1,37 @@
-#!/usr/bin/env node
-import { Command } from 'commander';
-import { runSetup } from '../src/auth-flow.js';
-import { APP_CONFIG } from '../src/app-config.js';
-
-const program = new Command();
-
-program
-    .name(APP_CONFIG.serviceName)
-    .description('Connect your MCP server to AI coding agents')
-    .version('1.0.0');
-
-program
-    .command('setup', { isDefault: true })
-    .description('Authenticate and configure all supported agents')
-    .option('--url <url>', 'MCP server URL', APP_CONFIG.mcpUrl)
-    .option('--port <port>', 'Local callback port', APP_CONFIG.defaultPort.toString())
-    .action(runSetup);
-
-program.parse();
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Command } from 'commander';
+import { runSetup, runRemove } from '../src/auth-flow.js';
+import { APP_CONFIG } from '../src/app-config.js';
+
+// Read the real version from package.json rather than repeating it here — the
+// hardcoded '1.0.0' had drifted two releases behind what npm was serving.
+const pkg = JSON.parse(
+    fs.readFileSync(
+        path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'package.json'),
+        'utf-8'
+    )
+);
+
+const program = new Command();
+
+program
+    .name(APP_CONFIG.serviceName)
+    .description('Connect 1lev1 to your AI coding agents')
+    .version(pkg.version);
+
+program
+    .command('setup', { isDefault: true })
+    .description('Authenticate and configure all supported agents')
+    .option('--url <url>', 'MCP server URL', APP_CONFIG.mcpUrl)
+    .option('--port <port>', 'Local callback port', APP_CONFIG.defaultPort.toString())
+    .action(runSetup);
+
+program
+    .command('remove')
+    .description('Remove the 1lev1 server and skill from every agent config')
+    .action(runRemove);
+
+program.parse();

package/package.json

@@ -1,32 +1,41 @@
-{
-  "name": "1lev1-mcp",
-  "version": "1.0.2",
-  "description": "Connect 1lev1 to your AI coding agents",
-  "type": "module",
-  "bin": {
-    "1lev1-mcp": "./bin/cli.js"
-  },
-  "files": [
-    "bin/",
-    "src/"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "mcp",
-    "ai",
-    "claude",
-    "cursor"
-  ],
-  "license": "MIT",
-  "dependencies": {
-    "commander": "^12.0.0",
-    "open": "^10.0.0",
-    "chalk": "^5.0.0",
-    "ora": "^8.0.0"
-  },
-  "engines": {
-    "node": ">=18"
-  }
-}
+{
+  "name": "1lev1-mcp",
+  "version": "2.0.0",
+  "description": "Connect 1lev1 to your AI coding agents",
+  "type": "module",
+  "bin": {
+    "1lev1-mcp": "./bin/cli.js"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "skills/"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "ai",
+    "claude",
+    "cursor"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "commander": "^12.0.0",
+    "open": "^10.0.0",
+    "chalk": "^5.0.0",
+    "ora": "^8.0.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Avi-ADAM/1lev1-mcp.git"
+  },
+  "homepage": "https://1lev1.com",
+  "scripts": {
+    "sync:skill": "node -e \"const fs=require('fs');const s=process.env.SKILL_SRC||'../1lev1-agent/plugins/1lev1/skills/1lev1-platform';fs.rmSync('skills/1lev1-platform',{recursive:true,force:true});fs.cpSync(s,'skills/1lev1-platform',{recursive:true});console.log('skill synced from '+s)\""
+  }
+}

package/skills/1lev1-platform/SKILL.md

@@ -0,0 +1,149 @@
+---
+name: 1lev1-platform
+description: Work with 1lev1.com partnerships ("rikmot") from the agent - list and search missions, start/stop mission timers, log and review work hours, see open votes and pending profit-splits, and prepare new partnerships, missions and tasks for human approval. Use whenever the user mentions 1lev1, a rikma/partnership, "my missions", mission timers, hour logging, consensus votes, halukot/profit-split, or asks to turn repo work (issues, PRs, TODOs) into shared, equity-bearing work.
+---
+
+# 1lev1 platform
+
+1lev1 (1lev1.com) is a platform for **consent-based partnerships**. A partnership
+is called a **rikma** (רקמה, "tissue/weave"). People contribute work to a rikma
+through **missions**, the hours they log become their share of the rikma's value,
+and money the rikma earns is split by **halukot** (profit-split agreements) that
+every affected member signs.
+
+This skill lets an agent operate a user's 1lev1 account through the 1lev1 MCP
+server, and - crucially - operate it *the way the platform expects*: nothing that
+affects another person happens without that person's explicit consent.
+
+## Before anything else: check the connection
+
+The MCP server has two modes. Call `tools/list` (or just look at which `1lev1`
+tools you have):
+
+- **Only `getPlatformInfo` and `howToConnect` are present** -> the user is not
+  connected. Do not guess or fabricate data. Tell them, and offer the one-liner:
+
+  ```bash
+  npx 1lev1-mcp
+  ```
+
+  That opens 1lev1.com, has them log in (or register), asks them to approve the
+  connection, and writes the API key into their MCP config. Then the client must
+  be restarted for the authenticated tools to appear.
+
+- **Mission/timer/project tools are present** -> the user is connected. Every
+  call is scoped to the API key's owner; you cannot see or touch anyone else's
+  data, and you should never claim otherwise.
+
+If the user has never heard of 1lev1, call `getPlatformInfo` and explain it in
+their language before pushing them to register.
+
+## The rule that governs everything: no unilateral writes
+
+1lev1's core principle is that **a decision that affects another person needs
+that person's consent**, and that there is no hard "no" - the choices are
+approve, discuss, or counter-propose. Two consequences for you:
+
+1. **Never** submit a vote, sign a haluka, accept an offer, or change another
+   member's standing on the user's behalf without the user explicitly asking for
+   that exact act in that exact turn.
+2. For anything that creates or changes a shared object, prefer the tools that
+   return a **prepared URL** over tools that write directly. Show the user the
+   link, let them review the filled-in form on the site, and let them press the
+   button. `createProjectTool` and `prepareMissionTool` are built for this.
+
+When you are unsure whether an act is "yours to do", it is not. Describe it and
+hand over the link.
+
+## Capability map
+
+Discover exact tool names from `tools/list`; the groups below are stable.
+
+| You want to | Use |
+|---|---|
+| Find the user's rikmot | `findUserProjectsTool` |
+| Find a mission by name | `findMissionTool` |
+| List the user's missions | `listUserMissionsTool` |
+| Full detail on one mission | `getMissionDetailsTool` |
+| Start / stop / edit a mission timer | `timerActionTool` |
+| What is running right now | `getActiveTimersTool` |
+| Past sessions on a mission | `getTimerHistoryTool` |
+| Hours totals and trends | `getMissionStatsTool` |
+| Who is in a rikma | `getProjectMembersTool` |
+| What a given member is working on | `getMemberMissionsTool` |
+| Draft a new rikma (returns a review URL) | `createProjectTool` |
+| Draft a mission from a rough description | `prepareMissionTool` |
+| Create a mission / task | `createMissionTool`, `createTaskTool` |
+| Plan the next work in a rikma | `planProjectWorkTool`, `scanProjectDirectionsTool` |
+| Where to send the user on the site | `getSitePagesTool`, `navigateToPageTool` |
+| Explain what page they are on | `getPageContextTool` |
+
+Read `references/tools.md` for argument shapes, gotchas and which of these
+write versus only prepare.
+
+## Recipes
+
+### "What should I be doing?" (daily briefing)
+
+1. `findUserProjectsTool` -> the user's rikmot.
+2. `listUserMissionsTool` -> what is assigned and in progress.
+3. `getActiveTimersTool` -> is a timer still running from yesterday?
+4. Report grouped **by rikma**, newest commitment first, and end with anything
+   waiting on the user's consent (open votes, pending halukot) with a link.
+
+Keep it short. A briefing longer than the work it describes is a failed briefing.
+
+### "Start working on X" / "I'm done"
+
+1. `findMissionTool` with the name the user used. If several match, list them and
+   ask - never guess which mission gets the hours; hours are equity.
+2. `timerActionTool` to start. On stop, report the session length and the new
+   total from `getMissionStatsTool`.
+3. If a timer was already running on a different mission, say so before starting
+   a new one instead of silently switching.
+
+### "Log the time I spent" (retroactive)
+
+Use `timerActionTool`'s edit/manual path. Always echo back the exact interval you
+are about to record and get a yes. Hours are the unit of ownership on this
+platform - a wrong number is a wrong equity share, and correcting it later needs
+another member's consent.
+
+### Turning repo work into a rikma (the developer path)
+
+For a user with an open-source repo or a side project and collaborators:
+
+1. Read the repo yourself - README, contributors, open issues, roadmap.
+2. `createProjectTool` with a proposed name, description, values and roles ->
+   returns a prefilled URL. Send them there; they review and create.
+3. Once the rikma exists, use `prepareMissionTool` per meaningful workstream
+   (not per issue - a rikma of 200 one-line missions is unusable).
+4. Explain the payoff in one sentence: hours logged against those missions become
+   each contributor's documented share, so when the project earns anything the
+   split is already agreed rather than argued.
+
+### Planning
+
+`planProjectWorkTool` and `scanProjectDirectionsTool` produce proposals, not
+commitments. Present their output as a draft and route anything the user likes
+through the prepare-then-approve path above.
+
+## Language and naming
+
+- Answer in the user's language. Most of the platform's users write Hebrew; the
+  UI ships in he, en, ar, ru and es.
+- Use the platform's own words with a gloss on first use: rikma (partnership),
+  mission (משימה), haluka (profit-split), moach (the rikma's management area),
+  lev (the personal home feed). See `references/concepts.md`.
+- Never invent a Hebrew name for an entity. Echo names exactly as the tools
+  return them - Hebrew strings from some surfaces are stored pre-reversed for
+  rendering and must not be re-typed by hand.
+
+## Reference files
+
+- `references/concepts.md` - domain glossary and the consent model. Read before
+  explaining anything about how ownership or decisions work.
+- `references/tools.md` - per-tool argument shapes, read/write classification,
+  and known sharp edges.
+- `references/connect.md` - connection, API keys, scopes, revocation and
+  troubleshooting when tools are missing or return 401.

package/skills/1lev1-platform/references/concepts.md

@@ -0,0 +1,42 @@
+# 1lev1 concepts
+
+Use these words with the user, glossed once. Getting them wrong makes the agent
+sound like it has never seen the platform.
+
+## Entities
+
+| Term | Meaning |
+|---|---|
+| **rikma** (רקמה) | A partnership. The unit of collaboration - members, missions, resources, money. Sometimes rendered "project" or "embroidery" in older strings. |
+| **mission** (משימה) | A piece of committed work inside a rikma. Hours are logged against it. `mesimabetahalich` = a mission in progress. |
+| **task / act** (מטלה) | A smaller item hanging off a mission. Can arrive from an external system through the tasks API. |
+| **haluka** (חלוקה) | A profit-split agreement: who receives what share of a given income, signed by everyone affected. |
+| **sale** | Income recorded for a rikma. Only counts toward balances once the person holding the money has confirmed they hold it. |
+| **moach** (מוח, "brain") | A rikma's management area on the site: members, missions, votes, money. |
+| **lev** (לב, "heart") | The user's personal home: everything waiting on them across all their rikmot. |
+| **consensus** | The separate discussion space where a contested decision gets talked through rather than voted down. |
+
+## The consent model
+
+This is the part an agent most often gets wrong.
+
+- **There is no unilateral "no".** A member facing a proposal may approve it,
+  open a discussion, or counter-propose - but not veto. "I got nothing" is
+  expressed as a counter-proposal of amount zero, not as a rejection.
+- **Silence is consent, on a clock.** Every open proposal carries the rikma's
+  response time. If nobody answers within it, the standing version is approved
+  automatically. A counter-proposal restarts the clock.
+- **Consent scope varies.** Most decisions are rikma-wide. Some are bilateral -
+  only the two people actually affected sign. Do not tell a user that "everyone
+  has to approve" without checking which kind of decision it is.
+- **Hours are ownership.** Approved hours on a mission become the contributor's
+  share of the rikma's value. This is why a mistyped timer entry is not a
+  cosmetic error.
+- **Money moves only when confirmed.** A sale whose holder has not confirmed, or
+  a payment not yet marked confirmed, does not count in anyone's balance.
+
+## What this means for you
+
+When the user asks you to "just approve it", "vote yes for me", or "add Dana to
+the split", you are being asked to act inside another person's consent. Prepare
+it, show it, and let the human press the button on the site.

package/skills/1lev1-platform/references/connect.md

@@ -0,0 +1,62 @@
+# Connecting to 1lev1
+
+## The flow
+
+```bash
+npx 1lev1-mcp
+```
+
+The CLI opens `https://1lev1.com/mcp-connect?callback=http://localhost:<port>`.
+The user logs in (or registers), sees exactly what they are approving, and hits
+approve. 1lev1 mints an API key and redirects it back to the CLI, which writes
+the MCP server entry into the client config. **The client must be restarted**
+before the authenticated tools appear.
+
+Manual alternative: log in, go to Settings -> API keys, create a key named `MCP`,
+then add to `.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "1lev1": {
+      "type": "http",
+      "url": "https://api.1lev1.com/api/mcp",
+      "headers": { "Authorization": "Bearer 1lev1_..." }
+    }
+  }
+}
+```
+
+## Key facts
+
+- Keys look like `1lev1_<base36 user id>_<48 hex chars>`. The user id is encoded
+  in the key; the server stores only an HMAC of it, never the key itself.
+- One key per approval. Re-approving from `/mcp-connect` **replaces** the
+  previous MCP key and revokes the old one - warn the user before they re-run
+  the CLI on a machine where a working key already exists.
+- Keys can carry scopes (a set of rikmot, a set of allowed operations). A scoped
+  key silently sees less; if a rikma the user expects is missing, check the key's
+  scopes before assuming a bug.
+- Revoke from Settings -> API keys. Revocation is honoured on the server within
+  the key cache TTL (5 minutes).
+- A key is a bearer credential for a real person's account. Never echo it into
+  chat, a commit, a log line, or a file the user did not ask for.
+
+## Troubleshooting
+
+**Only `getPlatformInfo` and `howToConnect` are listed.**
+The request reached the server without a valid key. Either no `Authorization`
+header is being sent, or the key was rejected. Re-run `npx 1lev1-mcp`.
+
+**401 on every call.**
+The key is revoked, or it was minted against a different deployment. Keys are
+HMAC'd with a per-environment secret, so a key created against one environment
+will not verify against another. Mint a fresh key from the environment you are
+actually pointing at.
+
+**Tools appear but return empty lists.**
+The account is real but has no rikmot yet, or the key is scoped to rikmot the
+user is not in. Confirm with `findUserProjectsTool` before reporting a failure.
+
+**Do not** work around auth problems by falling back to scraping 1lev1.com or by
+inventing data. Say the connection is broken and stop.

package/skills/1lev1-platform/references/tools.md

@@ -0,0 +1,77 @@
+# 1lev1 MCP tools
+
+Names below are the tool names the server exposes. Always confirm against
+`tools/list` - the set depends on the key's scopes.
+
+## Read
+
+| Tool | Input | Notes |
+|---|---|---|
+| `findUserProjectsTool` | `query?` (and `userId?`, which you should omit) | Returns `{ id, idPr, name }[]`. `id` is the internal id; `idPr` is what site URLs use. Omit `userId` — it defaults to the key's owner, and naming anyone else is refused. |
+| `findMissionTool` | `missionName` | Substring match across the user's missions. Returns `projectId` and `projectName` too - use it to disambiguate. |
+| `listUserMissionsTool` | - | The caller's missions. |
+| `getMissionDetailsTool` | mission id | Full record incl. skills, roles, hours. |
+| `getActiveTimersTool` | - | Currently running timers. Check this before starting a new one. |
+| `getTimerHistoryTool` | mission id | Past sessions. |
+| `getMissionStatsTool` | mission id | Totals and trends. |
+| `getProjectMembersTool` | `projectId`, `query?` | Returns `people[{id,username}]` **and** `roles[{id,roleDescription}]`. This is the only way to turn a name into an id. |
+| `getMemberMissionsTool` | `projectId`, `userId` | Another member's in-progress missions in that rikma. |
+| `getSitePagesTool` | - | The site's URL map. |
+| `getPageContextTool` | path | What a given page is for. |
+| `getPlatformInfo` | - | Public. Available even unauthenticated. |
+| `howToConnect` | - | Public. The connect instructions. |
+
+## Prepare (safe - returns a URL, writes nothing)
+
+| Tool | Input | Returns |
+|---|---|---|
+| `createProjectTool` | `name`, `desc?`, `details?` (HTML), `url?`, `vals?` (value names), `res?` (`feh` 48h / `sth` 72h / `nsh` 96h / `sevend` 1 week), `profit?`, `ont?` (continuous vs one-off) | A prefilled rikma-creation URL. **This is the preferred way to create a rikma.** |
+| `prepareMissionTool` | `projectId`, `name`, `descrip?`, `skills?`, `roles?`, `workways?`, `nhours?`, `valph?` | A prefilled mission-creation URL. Prefer over `createMissionTool` unless the user asked for direct creation. |
+| `navigateToPageTool` | page | A link to send the user to. |
+| `planProjectWorkTool`, `scanProjectDirectionsTool` | project context | Drafts. Proposals, never commitments. |
+
+## Write (changes state - require an explicit ask)
+
+`timerActionTool` is available to every key: it only ever touches the caller's
+own timers and hours.
+
+| Tool | Input | Notes |
+|---|---|---|
+| `timerActionTool` | `action`: `start` / `stop` / `pause` / `resume`, `missionId?` | Without `missionId` it acts on the currently active timer. **Always pass `missionId` on `start`** - an omitted id on an ambiguous account is how hours land on the wrong mission. |
+
+## Shared write (needs the `mcp:write` scope)
+
+These create work and obligations for **other** members, so a default key does
+not get them - they appear in `tools/list` only when the key was granted
+`mcp:write`. If a user asks for one and you do not have the tool, say the key
+needs that scope rather than improvising a workaround.
+
+| Tool | Input | Notes |
+|---|---|---|
+| `createMissionTool` | `projectId`, `missionName`, plus `descrip?`, `skills?`, `roles?`, `workways?`, `nhours?`, `valph?`, `iskvua?` (recurring monthly), `dateStart?`, `dateEnd?`, `assignedUserId?`, `checklist?` | Omit `assignedUserId` to leave the mission open for anyone in the rikma to take. |
+| `createTaskTool` | `projectId`, `name`, `description?`, `link?`, `missionId?`, `hashivut` (`white`/`green`/`yellow`/`red`), `dateS?`, `dateF?`, and **either** `assignedUserId` **or** `tafkidims` (role ids) - never both | Resolve names to ids with `getProjectMembersTool` first. Assigning to a role means "whoever holds it sees it". |
+
+Prefer `prepareMissionTool` even when you do hold `mcp:write`: a prefilled form
+the human approves is the platform's own pattern, and it costs one click.
+
+## Agent and workflow tools
+
+Older deployments also exposed `ask_*` and `run_*` tools proxying 1lev1's own
+in-app assistant. They are no longer served, and if you ever see one, do not use
+it: calling it puts a second, less-informed agent inside your own loop. Use the
+concrete tools above.
+
+## Sharp edges
+
+- **`id` vs `idPr`.** Site URLs use `idPr`. Tool inputs want `id`. Mixing them
+  produces a 404 or an empty result rather than an error.
+- **`createTaskTool` writes immediately** with a service token, not through the
+  user's session. Treat it as a real write: confirm the target rikma, mission and
+  assignee with the user before calling it.
+- **Hebrew names may be stored pre-reversed** for canvas rendering on some
+  surfaces. Echo what the tool returned; do not retype or "fix" it.
+- **A timer left running accrues hours.** If `getActiveTimersTool` shows one from
+  a previous day, surface it before doing anything else.
+- **You cannot read another user's data.** Tools that take a `userId` refuse one
+  that is not the key's owner. If the user wants a teammate's status, use
+  `getProjectMembersTool` + `getMemberMissionsTool` within a shared rikma.

package/src/auth-flow.js

@@ -2,9 +2,19 @@ import http from 'node:http';
 import open from 'open';
 import chalk from 'chalk';
 import ora from 'ora';
-import { writeAllConfigs } from './config-writers.js';
+import { writeAllConfigs, removeAllConfigs } from './config-writers.js';
+import { writeAllSkills, removeAllSkills } from './skill-writer.js';
 import { APP_CONFIG } from './app-config.js';
 
+/** Render one { agent: {success, skipped, reason, path} } map as aligned lines. */
+function report(results) {
+    for (const [agent, status] of Object.entries(results)) {
+        const icon = status.success ? chalk.green('✓') : (status.skipped ? chalk.dim('–') : chalk.yellow('!'));
+        const msg = status.success ? chalk.dim(status.path) : chalk.dim(status.reason);
+        console.log(`  ${icon}  ${agent.padEnd(18)} ${msg}`);
+    }
+}
+
 export async function runSetup({ url, port }) {
     console.log(chalk.bold('\n  MCP Setup ' + url + ' ' + port + '\n'));
 
@@ -26,14 +36,40 @@ export async function runSetup({ url, port }) {
     const writeSpinner = ora('Writing agent configs...').start();
     const results = await writeAllConfigs({ mcpUrl: url, apiKey: key });
     writeSpinner.stop();
+    console.log(chalk.bold('\n  Connection'));
+    report(results);
 
-    for (const [agent, status] of Object.entries(results)) {
-        const icon = status.success ? chalk.green('✓') : chalk.yellow('–');
-        const msg = status.success ? chalk.dim(status.path) : chalk.dim(status.reason);
-        console.log(`  ${icon}  ${agent.padEnd(18)} ${msg}`);
+    // The connection alone is not enough — install the skill that teaches the
+    // agent what a rikma is and what it must not do on somebody else's behalf.
+    const skillSpinner = ora('Installing 1lev1 skill...').start();
+    const skillResults = await writeAllSkills();
+    skillSpinner.stop();
+    console.log(chalk.bold('\n  Skill'));
+    report(skillResults);
+
+    const wrote = Object.values(results).filter((r) => r.success).length;
+    if (wrote === 0) {
+        console.log('\n' + chalk.yellow('  No agent config was written.'));
+        console.log(chalk.dim('  Add the server manually:'));
+        console.log(chalk.dim(`    { "mcpServers": { "${APP_CONFIG.serviceName}": { "type": "http", "url": "${url}", "headers": { "Authorization": "Bearer <your key>" } } } }`));
     }
 
-    console.log('\n' + chalk.bold('  Done!') + ' Restart your agent to pick up the new config.\n');
+    console.log('\n' + chalk.bold('  Done!') + ' Restart your agent to pick up the new config.');
+    console.log(chalk.dim('  Undo any time with: 1lev1-mcp remove\n'));
+}
+
+/** Removes our entry from every agent config and deletes the installed skill. */
+export async function runRemove() {
+    console.log(chalk.bold('\n  Removing 1lev1 from your agents\n'));
+
+    console.log(chalk.bold('  Connection'));
+    report(await removeAllConfigs({}));
+
+    console.log(chalk.bold('\n  Skill'));
+    report(await removeAllSkills());
+
+    console.log('\n' + chalk.dim('  The API key itself stays valid until you revoke it at'));
+    console.log(chalk.dim('  https://1lev1.com → Settings → API keys\n'));
 }
 
 // נפרד מ-waitForCallback — מחזיר { promise } בלי await

package/src/config-writers.js

@@ -1,214 +1,285 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { APP_CONFIG } from './app-config.js';
-
-const HOME = os.homedir();
-
-// כל agent — איפה הקונפיג שלו ואיך נראה הפורמט
-const AGENTS = {
-    'Claude Desktop': {
-        paths: {
-            darwin: path.join(HOME, 'Library/Application Support/Claude/claude_desktop_config.json'),
-            win32: path.join(process.env.APPDATA ?? '', 'Claude', 'claude_desktop_config.json'),
-            linux: path.join(HOME, '.config/claude/claude_desktop_config.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config.mcpServers ??= {};
-            config.mcpServers[name] = {
-                url: mcpUrl,
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-
-    'Cursor': {
-        paths: {
-            darwin: path.join(HOME, '.cursor/mcp.json'),
-            win32: path.join(HOME, '.cursor/mcp.json'),
-            linux: path.join(HOME, '.cursor/mcp.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config.mcpServers ??= {};
-            config.mcpServers[name] = {
-                url: mcpUrl,
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-
-    'Windsurf': {
-        paths: {
-            darwin: path.join(HOME, '.codeium/windsurf/mcp_config.json'),
-            win32: path.join(HOME, '.codeium/windsurf/mcp_config.json'),
-            linux: path.join(HOME, '.codeium/windsurf/mcp_config.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config.mcpServers ??= {};
-            config.mcpServers[name] = {
-                serverUrl: mcpUrl,          // Windsurf משתמש ב-serverUrl
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-
-    'Claude Code': {
-        // על פי הדוקומנטציה הרשמית, ההגדרות נשמרות בקובץ .claude.json בתיקיית הבית
-        paths: {
-            darwin: path.join(HOME, '.claude.json'),
-            win32: path.join(HOME, '.claude.json'),
-            linux: path.join(HOME, '.claude.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            // אנחנו שומרים תחת אובייקט mcpServers הראשי (User Scope - גלובלי)
-            config.mcpServers ??= {};
-            config.mcpServers[name] = {
-                type: 'http', // חובה ב-Claude Code להגדיר סוג חיבור
-                url: mcpUrl,
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-    'Antigravity': {
-        paths: {
-            darwin: path.join(HOME, '.gemini/antigravity/mcp_config.json'),
-            win32: path.join(HOME, '.gemini/antigravity/mcp_config.json'),
-            linux: path.join(HOME, '.gemini/antigravity/mcp_config.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config.mcpServers ??= {};
-            config.mcpServers[name] = {
-                serverUrl: mcpUrl, // Antigravity משתמש ב-serverUrl לחיבור מרוחק
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-    'VS Code': {
-        // VS Code MCP כותב לworkspace — נכתוב ל-global settings
-        paths: {
-            darwin: path.join(HOME, 'Library/Application Support/Code/User/settings.json'),
-            win32: path.join(process.env.APPDATA ?? '', 'Code', 'User', 'settings.json'),
-            linux: path.join(HOME, '.config/Code/User/settings.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config['mcp.servers'] ??= {};
-            config['mcp.servers'][name] = {
-                url: mcpUrl,
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-    'OpenClaw': {
-        paths: {
-            darwin: path.join(HOME, '.openclaw/config.json'),
-            win32: path.join(HOME, '.openclaw/config.json'), // בחלונות זה לרוב גם בתיקיית הבית
-            linux: path.join(HOME, '.openclaw/config.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            // האובייקט של OpenClaw בנוי בצורה מקוננת: config.mcp.servers
-            config.mcp ??= {};
-            config.mcp.servers ??= {};
-
-            config.mcp.servers[name] = {
-                url: mcpUrl,
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-
-    'Cline': {
-        paths: {
-            darwin: path.join(HOME, 'Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json'),
-            win32: path.join(process.env.APPDATA ?? '', 'Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json'),
-            linux: path.join(HOME, '.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config.mcpServers ??= {};
-            config.mcpServers[name] = {
-                url: mcpUrl,
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-
-    'Roo Code': {
-        paths: {
-            darwin: path.join(HOME, 'Library/Application Support/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json'),
-            win32: path.join(process.env.APPDATA ?? '', 'Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json'),
-            linux: path.join(HOME, '.config/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config.mcpServers ??= {};
-            config.mcpServers[name] = {
-                url: mcpUrl,
-                headers: { Authorization: `Bearer ${apiKey}` },
-            };
-            return config;
-        },
-    },
-
-    'Continue': {
-        paths: {
-            darwin: path.join(HOME, '.continue/config.json'),
-            win32: path.join(HOME, '.continue/config.json'),
-            linux: path.join(HOME, '.continue/config.json'),
-        },
-        write: (config, { mcpUrl, apiKey, name }) => {
-            config.mcpServers ??= {};
-            // Continue.dev משתמש במבנה מעט שונה המגדיר transport
-            config.mcpServers[name] = {
-                transport: {
-                    type: "sse",
-                    url: mcpUrl,
-                    headers: { Authorization: `Bearer ${apiKey}` }
-                }
-            };
-            return config;
-        },
-    },
-
-};
-
-export async function writeAllConfigs({ mcpUrl, apiKey, name = APP_CONFIG.serviceName }) {
-    const platform = process.platform;
-    const results = {};
-
-    for (const [agentName, agent] of Object.entries(AGENTS)) {
-        const filePath = agent.paths[platform] ?? agent.paths['linux'];
-
-        try {
-            // קורא קונפיג קיים (אם יש) או מתחיל ריק
-            let config = {};
-            if (fs.existsSync(filePath)) {
-                const raw = fs.readFileSync(filePath, 'utf-8');
-                try {
-                    config = JSON.parse(raw);
-                } catch (parseError) {
-                    // טיפול למקרה שיש הערות בקובץ JSON (קורה הרבה ב-VS Code)
-                    console.warn(`[Warning] Could not parse JSON for ${agentName}. Creating new config. Error: ${parseError.message}`);
-                }
-            }
-
-            // מעדכן
-            config = agent.write(config, { mcpUrl, apiKey, name });
-
-            // כותב בחזרה
-            fs.mkdirSync(path.dirname(filePath), { recursive: true });
-            fs.writeFileSync(filePath, JSON.stringify(config, null, 2), 'utf-8');
-
-            results[agentName] = { success: true, path: filePath };
-        } catch (err) {
-            results[agentName] = { success: false, reason: err.message };
-        }
-    }
-
-    return results;
-}
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { APP_CONFIG } from './app-config.js';
+
+const HOME = os.homedir();
+const APPDATA = process.env.APPDATA ?? '';
+
+// כל agent — איפה הקונפיג שלו, איך נראה הפורמט, ואיך מזהים שהוא בכלל מותקן.
+//
+// `detect` הוא רשימת נתיבים שקיומם מעיד שהסוכן מותקן. אנחנו לא כותבים קונפיג
+// לסוכן שהמשתמש לא התקין — אחרת כל הרצה של הכלי מפזרת תיקיות ומפתחות API
+// לכלים שאיש לא ביקש.
+const AGENTS = {
+    'Claude Desktop': {
+        paths: {
+            darwin: path.join(HOME, 'Library/Application Support/Claude/claude_desktop_config.json'),
+            win32: path.join(APPDATA, 'Claude', 'claude_desktop_config.json'),
+            linux: path.join(HOME, '.config/claude/claude_desktop_config.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcpServers ??= {};
+            config.mcpServers[name] = {
+                url: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'Cursor': {
+        paths: {
+            darwin: path.join(HOME, '.cursor/mcp.json'),
+            win32: path.join(HOME, '.cursor/mcp.json'),
+            linux: path.join(HOME, '.cursor/mcp.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcpServers ??= {};
+            config.mcpServers[name] = {
+                url: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'Windsurf': {
+        paths: {
+            darwin: path.join(HOME, '.codeium/windsurf/mcp_config.json'),
+            win32: path.join(HOME, '.codeium/windsurf/mcp_config.json'),
+            linux: path.join(HOME, '.codeium/windsurf/mcp_config.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcpServers ??= {};
+            config.mcpServers[name] = {
+                serverUrl: mcpUrl,          // Windsurf משתמש ב-serverUrl
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'Claude Code': {
+        paths: {
+            darwin: path.join(HOME, '.claude.json'),
+            win32: path.join(HOME, '.claude.json'),
+            linux: path.join(HOME, '.claude.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            // User scope גלובלי
+            config.mcpServers ??= {};
+            config.mcpServers[name] = {
+                type: 'http', // חובה ב-Claude Code להגדיר סוג חיבור
+                url: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'Antigravity': {
+        paths: {
+            darwin: path.join(HOME, '.gemini/antigravity/mcp_config.json'),
+            win32: path.join(HOME, '.gemini/antigravity/mcp_config.json'),
+            linux: path.join(HOME, '.gemini/antigravity/mcp_config.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcpServers ??= {};
+            config.mcpServers[name] = {
+                serverUrl: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'VS Code': {
+        paths: {
+            darwin: path.join(HOME, 'Library/Application Support/Code/User/settings.json'),
+            win32: path.join(APPDATA, 'Code', 'User', 'settings.json'),
+            linux: path.join(HOME, '.config/Code/User/settings.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config['mcp.servers'] ??= {};
+            config['mcp.servers'][name] = {
+                url: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'OpenClaw': {
+        paths: {
+            darwin: path.join(HOME, '.openclaw/config.json'),
+            win32: path.join(HOME, '.openclaw/config.json'),
+            linux: path.join(HOME, '.openclaw/config.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcp ??= {};
+            config.mcp.servers ??= {};
+            config.mcp.servers[name] = {
+                url: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'Cline': {
+        paths: {
+            darwin: path.join(HOME, 'Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json'),
+            win32: path.join(APPDATA, 'Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json'),
+            linux: path.join(HOME, '.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcpServers ??= {};
+            config.mcpServers[name] = {
+                url: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'Roo Code': {
+        paths: {
+            darwin: path.join(HOME, 'Library/Application Support/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json'),
+            win32: path.join(APPDATA, 'Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json'),
+            linux: path.join(HOME, '.config/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/cline_mcp_settings.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcpServers ??= {};
+            config.mcpServers[name] = {
+                url: mcpUrl,
+                headers: { Authorization: `Bearer ${apiKey}` },
+            };
+            return config;
+        },
+    },
+
+    'Continue': {
+        paths: {
+            darwin: path.join(HOME, '.continue/config.json'),
+            win32: path.join(HOME, '.continue/config.json'),
+            linux: path.join(HOME, '.continue/config.json'),
+        },
+        write: (config, { mcpUrl, apiKey, name }) => {
+            config.mcpServers ??= {};
+            // השרת הוא streamable HTTP, לא SSE.
+            config.mcpServers[name] = {
+                transport: {
+                    type: 'streamable-http',
+                    url: mcpUrl,
+                    headers: { Authorization: `Bearer ${apiKey}` },
+                },
+            };
+            return config;
+        },
+    },
+};
+
+/** כותב JSON בצורה אטומית: קובץ זמני + rename, כדי שהפסקה באמצע לא תקטע קובץ. */
+function writeJsonAtomic(filePath, data) {
+    const tmp = `${filePath}.1lev1-tmp-${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2), 'utf-8');
+    fs.renameSync(tmp, filePath);
+}
+
+/**
+ * מעדכן קונפיג של סוכן אחד.
+ *
+ * שלושה כללי ברזל, שכל אחד מהם נולד מבאג אמיתי:
+ *  1. אם הקובץ קיים אבל לא נפרס כ-JSON — לא נוגעים בו. קובץ כזה הוא בדרך
+ *     כלל JSONC עם הערות (settings.json של VS Code), והכתיבה הישנה דרסה אותו
+ *     באובייקט חדש ומחקה את כל ההגדרות של המשתמש.
+ *  2. לא יוצרים קונפיג לסוכן שלא מותקן — קודם היינו יוצרים תיקיות לכלים
+ *     שהמשתמש מעולם לא התקין, ומפזרים אליהם מפתח API.
+ *  3. גיבוי לפני דריסה, וכתיבה אטומית.
+ */
+function updateAgentConfig(agentName, agent, { mcpUrl, apiKey, name }) {
+    const filePath = agent.paths[process.platform] ?? agent.paths['linux'];
+    const exists = fs.existsSync(filePath);
+
+    if (!exists && !fs.existsSync(path.dirname(filePath))) {
+        return { success: false, skipped: true, reason: 'not installed' };
+    }
+
+    let config = {};
+    if (exists) {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        if (raw.trim() !== '') {
+            try {
+                config = JSON.parse(raw);
+            } catch {
+                return {
+                    success: false,
+                    reason: 'not plain JSON (comments?) — left untouched, add the server manually',
+                    path: filePath,
+                };
+            }
+        }
+        if (config === null || typeof config !== 'object' || Array.isArray(config)) {
+            return { success: false, reason: 'unexpected config shape — left untouched', path: filePath };
+        }
+        const backup = `${filePath}.1lev1.bak`;
+        if (!fs.existsSync(backup)) fs.copyFileSync(filePath, backup);
+    }
+
+    config = agent.write(config, { mcpUrl, apiKey, name });
+    writeJsonAtomic(filePath, config);
+    return { success: true, path: filePath };
+}
+
+export async function writeAllConfigs({ mcpUrl, apiKey, name = APP_CONFIG.serviceName }) {
+    const results = {};
+    for (const [agentName, agent] of Object.entries(AGENTS)) {
+        try {
+            results[agentName] = updateAgentConfig(agentName, agent, { mcpUrl, apiKey, name });
+        } catch (err) {
+            results[agentName] = { success: false, reason: err.message };
+        }
+    }
+    return results;
+}
+
+/** מסיר את הרשומה שלנו מכל קונפיג — הבסיס ל-`1lev1-mcp remove`. */
+export async function removeAllConfigs({ name = APP_CONFIG.serviceName } = {}) {
+    const results = {};
+    for (const [agentName, agent] of Object.entries(AGENTS)) {
+        const filePath = agent.paths[process.platform] ?? agent.paths['linux'];
+        try {
+            if (!fs.existsSync(filePath)) {
+                results[agentName] = { success: false, skipped: true, reason: 'no config' };
+                continue;
+            }
+            let config;
+            try {
+                config = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+            } catch {
+                results[agentName] = { success: false, reason: 'not plain JSON — left untouched', path: filePath };
+                continue;
+            }
+            const buckets = [config.mcpServers, config['mcp.servers'], config.mcp?.servers];
+            let removed = false;
+            for (const bucket of buckets) {
+                if (bucket && Object.prototype.hasOwnProperty.call(bucket, name)) {
+                    delete bucket[name];
+                    removed = true;
+                }
+            }
+            if (!removed) {
+                results[agentName] = { success: false, skipped: true, reason: 'nothing to remove' };
+                continue;
+            }
+            writeJsonAtomic(filePath, config);
+            results[agentName] = { success: true, path: filePath };
+        } catch (err) {
+            results[agentName] = { success: false, reason: err.message };
+        }
+    }
+    return results;
+}
+
+export { AGENTS };

package/src/skill-writer.js

@@ -0,0 +1,115 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const HOME = os.homedir();
+const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKILL_SRC = path.join(PKG_ROOT, 'skills', '1lev1-platform');
+
+/**
+ * Where each agent reads "skills" (standing instructions) from.
+ *
+ * The MCP server gives the agent hands; the skill gives it judgement. Without
+ * it an agent sees ~20 tools with a one-line description each and no idea that
+ * a rikma is a partnership, that logged hours are ownership, or that it must
+ * never vote on somebody else's behalf. Installing the connection without the
+ * skill is what produced most of the bad first impressions.
+ *
+ * Only targets whose parent directory already exists are written — same rule as
+ * the MCP config writer: we never create a tool's home directory for a tool the
+ * user has not installed.
+ */
+const SKILL_TARGETS = {
+    'Claude Code': {
+        dir: path.join(HOME, '.claude', 'skills', '1lev1-platform'),
+        /** Copy the skill folder verbatim (SKILL.md + references/). */
+        kind: 'folder',
+    },
+    'Cursor': {
+        // Cursor reads project/user rules as .mdc files rather than skill folders.
+        dir: path.join(HOME, '.cursor', 'rules'),
+        file: '1lev1.mdc',
+        kind: 'flat',
+    },
+};
+
+/** Recursively copy a directory (Node 16.7+ has fs.cpSync, but keep it explicit). */
+function copyDir(src, dest) {
+    fs.mkdirSync(dest, { recursive: true });
+    for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+        const s = path.join(src, entry.name);
+        const d = path.join(dest, entry.name);
+        if (entry.isDirectory()) copyDir(s, d);
+        else fs.copyFileSync(s, d);
+    }
+}
+
+/**
+ * Flatten SKILL.md + references into a single document, for agents that take
+ * one rules file rather than a skill folder.
+ */
+function flattenSkill() {
+    let out = fs.readFileSync(path.join(SKILL_SRC, 'SKILL.md'), 'utf-8');
+    const refDir = path.join(SKILL_SRC, 'references');
+    if (fs.existsSync(refDir)) {
+        for (const name of fs.readdirSync(refDir).sort()) {
+            out += `\n\n---\n\n# reference: ${name}\n\n`;
+            out += fs.readFileSync(path.join(refDir, name), 'utf-8');
+        }
+    }
+    return out;
+}
+
+export async function writeAllSkills() {
+    const results = {};
+
+    if (!fs.existsSync(SKILL_SRC)) {
+        return { skill: { success: false, reason: 'skill files missing from package' } };
+    }
+
+    for (const [agentName, target] of Object.entries(SKILL_TARGETS)) {
+        try {
+            // The agent's root config dir must already exist (.claude / .cursor).
+            const agentRoot = target.kind === 'folder'
+                ? path.dirname(path.dirname(target.dir))   // ~/.claude
+                : path.dirname(target.dir);                // ~/.cursor
+            if (!fs.existsSync(agentRoot)) {
+                results[agentName] = { success: false, skipped: true, reason: 'not installed' };
+                continue;
+            }
+
+            if (target.kind === 'folder') {
+                copyDir(SKILL_SRC, target.dir);
+                results[agentName] = { success: true, path: target.dir };
+            } else {
+                fs.mkdirSync(target.dir, { recursive: true });
+                const dest = path.join(target.dir, target.file);
+                fs.writeFileSync(dest, flattenSkill(), 'utf-8');
+                results[agentName] = { success: true, path: dest };
+            }
+        } catch (err) {
+            results[agentName] = { success: false, reason: err.message };
+        }
+    }
+
+    return results;
+}
+
+export async function removeAllSkills() {
+    const results = {};
+    for (const [agentName, target] of Object.entries(SKILL_TARGETS)) {
+        try {
+            const dest = target.kind === 'folder' ? target.dir : path.join(target.dir, target.file);
+            if (!fs.existsSync(dest)) {
+                results[agentName] = { success: false, skipped: true, reason: 'nothing to remove' };
+                continue;
+            }
+            fs.rmSync(dest, { recursive: true, force: true });
+            results[agentName] = { success: true, path: dest };
+        } catch (err) {
+            results[agentName] = { success: false, reason: err.message };
+        }
+    }
+    return results;
+}