@aipm-registry/cli 0.3.1 → 0.3.4

package/dist/bin.cjs

@@ -4160,7 +4160,19 @@ function expandTargets(targets) {
     return [...ALL_TOOLS];
   return targets.filter((t) => t !== "*");
 }
-var AiToolSchema, ALL_TOOLS, PackageExampleSchema, PackageManifestSchema;
+function isSafeRelativePath(value) {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.startsWith("/") || trimmed.startsWith("\\") || /^[A-Za-z]:/.test(trimmed)) {
+    return false;
+  }
+  const normalized = trimmed.replace(/\\/g, "/");
+  return normalized.split("/").filter(Boolean).every((segment) => segment !== "." && segment !== "..");
+}
+function basename(value) {
+  const parts = value.replace(/\\/g, "/").split("/").filter(Boolean);
+  return parts[parts.length - 1] ?? value;
+}
+var AiToolSchema, ALL_TOOLS, PackageExampleSchema, unsafePathMessage, InstallPathSchema, InstallOverwriteSchema, PackageInstallSchema, PackageManifestSchema;
 var init_manifest = __esm({
   "../../packages/schemas/dist/manifest.js"() {
     "use strict";
@@ -4173,6 +4185,36 @@ var init_manifest = __esm({
       description: external_exports.string().trim().min(1).max(240).optional(),
       prompt: external_exports.string().trim().min(1).max(1e3)
     });
+    unsafePathMessage = "path must be relative and must not contain .. segments";
+    InstallPathSchema = external_exports.string().trim().min(1).refine(isSafeRelativePath, unsafePathMessage);
+    InstallOverwriteSchema = external_exports.enum(["fail", "skip", "replace"]);
+    PackageInstallSchema = external_exports.object({
+      mainFiles: external_exports.array(external_exports.object({
+        from: InstallPathSchema,
+        to: InstallPathSchema,
+        overwrite: InstallOverwriteSchema.optional()
+      })).optional(),
+      helperFiles: external_exports.array(external_exports.object({
+        from: InstallPathSchema,
+        to: InstallPathSchema.optional()
+      })).optional(),
+      postInstall: external_exports.object({
+        mode: external_exports.literal("manual_prompt"),
+        promptFile: InstallPathSchema,
+        cleanup: external_exports.enum(["manual", "after_user_confirmation"]).optional()
+      }).optional()
+    }).superRefine((install, ctx) => {
+      if (!install.postInstall)
+        return;
+      const helperTargets = new Set((install.helperFiles ?? []).map((file) => file.to ?? basename(file.from)));
+      if (!helperTargets.has(install.postInstall.promptFile)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["postInstall", "promptFile"],
+          message: "postInstall.promptFile must point to an installed helper file"
+        });
+      }
+    });
     PackageManifestSchema = external_exports.object({
       schemaVersion: external_exports.literal("0.1"),
       name: external_exports.string().regex(SCOPE_NAME_REGEX, "name must be @scope/name"),
@@ -4183,11 +4225,13 @@ var init_manifest = __esm({
       targets: external_exports.array(AiToolSchema).min(1),
       license: external_exports.string().optional(),
       usage: external_exports.string().trim().min(1).max(2e3).optional(),
+      agentDescription: external_exports.string().trim().min(1).max(12e3).optional(),
       tags: external_exports.array(external_exports.string().trim().min(1).max(40)).max(12).optional(),
       categories: external_exports.array(external_exports.string().trim().min(1).max(40)).max(4).optional(),
       sourceUrl: external_exports.string().trim().url().max(500).optional(),
       examples: external_exports.array(PackageExampleSchema).max(5).optional(),
-      releaseNotes: external_exports.string().trim().min(1).max(2e3).optional()
+      releaseNotes: external_exports.string().trim().min(1).max(2e3).optional(),
+      install: PackageInstallSchema.optional()
     });
   }
 });
@@ -4225,7 +4269,17 @@ var init_lockfile = __esm({
       integrity: external_exports.string(),
       registry: external_exports.string().url(),
       resolvedTools: external_exports.array(AiToolSchema),
-      installed: InstalledPathsSchema
+      installed: InstalledPathsSchema,
+      installedAssets: external_exports.object({
+        main: external_exports.array(external_exports.string()),
+        helper: external_exports.array(external_exports.string())
+      }).optional(),
+      postInstall: external_exports.object({
+        mode: external_exports.literal("manual_prompt"),
+        status: external_exports.enum(["pending", "cleaned"]),
+        promptFile: external_exports.string(),
+        cleanup: external_exports.enum(["manual", "after_user_confirmation"])
+      }).optional()
     });
     LockfileSchema = external_exports.object({
       schemaVersion: external_exports.literal("0.1"),
@@ -7776,16 +7830,15 @@ var import_node_crypto2 = require("node:crypto");
 var import_node_child_process4 = require("node:child_process");
 var import_node_http = require("node:http");
 var import_promises10 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_node_path13 = require("node:path");
 var import_node_process5 = require("node:process");
 init_dist();
 init_dist4();
 
 // src/pack.ts
 var import_node_child_process2 = require("node:child_process");
-var import_promises5 = require("node:fs/promises");
 var import_node_util3 = require("node:util");
-var import_promises6 = require("node:fs/promises");
+var import_promises5 = require("node:fs/promises");
 var import_node_path6 = require("node:path");
 var import_node_os = require("node:os");
 
@@ -7938,6 +7991,14 @@ async function readManifest(root) {
     throw error;
   }
 }
+function installReferencedFiles(manifest) {
+  const install = manifest.install;
+  if (!install) return [];
+  return [
+    ...(install.mainFiles ?? []).map((file) => file.from),
+    ...(install.helperFiles ?? []).map((file) => file.from)
+  ];
+}
 async function validatePublishState(root) {
   const manifest = await readManifest(root);
   const state = await readPublishState(root);
@@ -7945,6 +8006,9 @@ async function validatePublishState(root) {
   const staged = new Set(state.files.map((entry) => entry.path));
   if (!staged.has("aipm.manifest.json")) throw new Error("aipm.manifest.json must be staged.");
   if (!staged.has(manifest.entry)) throw new Error(`Manifest entry must be staged: ${manifest.entry}`);
+  for (const file of installReferencedFiles(manifest)) {
+    if (!staged.has(file)) throw new Error(`Manifest install file must be staged: ${file}`);
+  }
   let size = 0;
   for (const entry of state.files) {
     if (isExcludedPublishPath(entry.path)) throw new Error(`Refusing to publish excluded path: ${entry.path}`);
@@ -7992,27 +8056,23 @@ async function packDirectory(dir) {
   return Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout);
 }
 async function packStagedFiles(root) {
-  const tempDir = await (0, import_promises6.mkdtemp)((0, import_node_path6.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
+  const tempDir = await (0, import_promises5.mkdtemp)((0, import_node_path6.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
   try {
     await copyStagedFiles(root, tempDir);
     return await packDirectory(tempDir);
   } finally {
-    await (0, import_promises6.rm)(tempDir, { recursive: true, force: true });
+    await (0, import_promises5.rm)(tempDir, { recursive: true, force: true });
   }
 }
-async function unpackTarballToBuffer(tarball, entry) {
-  const { mkdtemp: mkdtemp2, rm: rm3, writeFile: writeFile7 } = await import("node:fs/promises");
-  const { join: join12 } = await import("node:path");
+async function unpackTarballToDirectory(tarball) {
+  const { mkdtemp: mkdtemp2, writeFile: writeFile7 } = await import("node:fs/promises");
+  const { join: join13 } = await import("node:path");
   const { tmpdir: tmpdir2 } = await import("node:os");
-  const tempDir = await mkdtemp2(join12(tmpdir2(), "aipm-install-"));
-  const tgzPath = join12(tempDir, "pkg.tgz");
-  try {
-    await writeFile7(tgzPath, tarball);
-    await execFileAsync("tar", ["-xzf", tgzPath, "-C", tempDir]);
-    return (0, import_promises5.readFile)(join12(tempDir, entry), "utf8");
-  } finally {
-    await rm3(tempDir, { recursive: true, force: true });
-  }
+  const tempDir = await mkdtemp2(join13(tmpdir2(), "aipm-install-"));
+  const tgzPath = join13(tempDir, "pkg.tgz");
+  await writeFile7(tgzPath, tarball);
+  await execFileAsync("tar", ["-xzf", tgzPath, "-C", tempDir]);
+  return tempDir;
 }
 
 // src/registry-client.ts
@@ -8046,6 +8106,22 @@ function privateInstallHint(name, status, token) {
   }
   return `Package not found: ${name} (${status}). If @org/pkg is private, run aipm login, or set AIPM_TOKEN for CI.`;
 }
+function publishTokenHint(name, error) {
+  if (error === "Publish token required") {
+    return [
+      `Publish token required for ${name}.`,
+      `Generate a fresh 5-minute publish token for ${name} from the package dashboard, then retry with AIPM_TOKEN=<token> aipm publish push --yes.`
+    ].join(" ");
+  }
+  if (error === "Invalid publish token") {
+    return [
+      `Publish token was rejected for ${name}.`,
+      `Generate a fresh 5-minute token for this exact package name, make sure aipm.manifest.json still says "${name}", and confirm your account can publish to that reserved package.`,
+      "If you recently renamed the package or generated the token from another package page, create a new token from the matching package dashboard."
+    ].join(" ");
+  }
+  return error;
+}
 async function assertRegistryReachable(registry) {
   const base = registry.replace(/\/$/, "");
   const res = await registryFetch(`${base}/health`, base);
@@ -8062,7 +8138,7 @@ async function publishPackage(registry, name, tarball, token) {
   const res = await registryFetch(url, base, { method: "POST", body: form, headers });
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
-    throw new Error(err.error ?? `Publish failed: ${res.status}`);
+    throw new Error(err.error ? publishTokenHint(name, err.error) : `Publish failed: ${res.status}`);
   }
   return res.json();
 }
@@ -8155,7 +8231,7 @@ async function recordPackageInstall(registry, name, token) {
 }
 
 // src/auth-store.ts
-var import_promises7 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var import_node_os2 = require("node:os");
 var import_node_path7 = require("node:path");
 var AUTH_FILE = (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
@@ -8164,7 +8240,7 @@ function normalizeRegistry(registry) {
 }
 async function readAuthStore() {
   try {
-    const raw = await (0, import_promises7.readFile)(AUTH_FILE, "utf8");
+    const raw = await (0, import_promises6.readFile)(AUTH_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return { registries: parsed.registries ?? {} };
   } catch {
@@ -8172,9 +8248,9 @@ async function readAuthStore() {
   }
 }
 async function writeAuthStore(store) {
-  await (0, import_promises7.mkdir)((0, import_node_path7.dirname)(AUTH_FILE), { recursive: true });
-  await (0, import_promises7.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
-  await (0, import_promises7.chmod)(AUTH_FILE, 384).catch(() => void 0);
+  await (0, import_promises6.mkdir)((0, import_node_path7.dirname)(AUTH_FILE), { recursive: true });
+  await (0, import_promises6.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
+  await (0, import_promises6.chmod)(AUTH_FILE, 384).catch(() => void 0);
 }
 async function getStoredRegistryAuth(registry) {
   const store = await readAuthStore();
@@ -8204,23 +8280,25 @@ function isAccessTokenFresh(auth, skewMs = 6e4) {
 
 // src/install-one.ts
 init_dist4();
+var import_promises8 = require("node:fs/promises");
+var import_node_path9 = require("node:path");
 
 // src/project-files.ts
-var import_promises8 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_path8 = require("node:path");
 init_dist();
 var PACKAGE_JSON = "aipm.package.json";
 var LOCKFILE = "aipm-lock.json";
 async function readProjectPackageJson(projectRoot) {
   try {
-    const raw = await (0, import_promises8.readFile)((0, import_node_path8.join)(projectRoot, PACKAGE_JSON), "utf8");
+    const raw = await (0, import_promises7.readFile)((0, import_node_path8.join)(projectRoot, PACKAGE_JSON), "utf8");
     return ProjectPackageJsonSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeProjectPackageJson(projectRoot, data) {
-  await (0, import_promises8.writeFile)(
+  await (0, import_promises7.writeFile)(
     (0, import_node_path8.join)(projectRoot, PACKAGE_JSON),
     JSON.stringify(data, null, 2) + "\n",
     "utf8"
@@ -8228,14 +8306,14 @@ async function writeProjectPackageJson(projectRoot, data) {
 }
 async function readLockfile(projectRoot) {
   try {
-    const raw = await (0, import_promises8.readFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), "utf8");
+    const raw = await (0, import_promises7.readFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), "utf8");
     return LockfileSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeLockfile(projectRoot, data) {
-  await (0, import_promises8.writeFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
+  await (0, import_promises7.writeFile)((0, import_node_path8.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 function upsertLockEntry(lock, name, entry) {
   return {
@@ -8289,8 +8367,113 @@ async function promptForTool() {
     rl.close();
   }
 }
+async function promptForConfirmation(question) {
+  const rl = readline.createInterface({ input: import_node_process2.stdin, output: import_node_process2.stdout });
+  try {
+    const answer = await rl.question(`${question} (y/N): `);
+    const normalized = answer.trim().toLowerCase();
+    return normalized === "y" || normalized === "yes";
+  } finally {
+    rl.close();
+  }
+}
 
 // src/install-one.ts
+function normalizeRelativePath(path2) {
+  return (0, import_node_path9.normalize)(path2).split(import_node_path9.sep).join("/");
+}
+function assertSafeRelativePath(path2) {
+  const rel = normalizeRelativePath(path2.trim());
+  if (!rel || rel === "." || rel.startsWith("/") || rel === ".." || rel.startsWith("../") || rel.includes("/../")) {
+    throw new Error(`Unsafe install path: ${path2}`);
+  }
+  return rel;
+}
+function safeJoin(root, relPath) {
+  const rel = assertSafeRelativePath(relPath);
+  const target = (0, import_node_path9.resolve)(root, rel);
+  const fromRoot = normalizeRelativePath((0, import_node_path9.relative)(root, target));
+  if (fromRoot === ".." || fromRoot.startsWith("../") || fromRoot.startsWith("/")) {
+    throw new Error(`Unsafe install path: ${relPath}`);
+  }
+  return target;
+}
+function packageHelperSlug(name) {
+  const [scope = "", pkg = ""] = name.replace(/^@/, "").split("/");
+  return `${scope}__${pkg}`;
+}
+function helperRootFor(configRoot, packageName, version) {
+  const base = (0, import_node_path9.basename)(configRoot) === ".aipm" ? (0, import_node_path9.join)(configRoot, "helpers") : (0, import_node_path9.join)(configRoot, ".aipm", "helpers");
+  return (0, import_node_path9.join)(base, packageHelperSlug(packageName), version);
+}
+async function assertSourceFile(packageRoot, relPath) {
+  const source = safeJoin(packageRoot, relPath);
+  const info = await (0, import_promises8.stat)(source).catch(() => null);
+  if (!info?.isFile()) throw new Error(`Package install file not found: ${relPath}`);
+  return source;
+}
+async function copyMainFile(input2) {
+  const source = await assertSourceFile(input2.packageRoot, input2.file.from);
+  const target = safeJoin(input2.installRoot, input2.file.to);
+  const overwrite = input2.file.overwrite ?? "fail";
+  const exists = await (0, import_promises8.stat)(target).catch(() => null);
+  if (exists) {
+    if (overwrite === "skip") return null;
+    if (overwrite === "fail") throw new Error(`Install target already exists: ${target}`);
+  }
+  await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(target), { recursive: true });
+  await (0, import_promises8.cp)(source, target, { force: overwrite === "replace" });
+  return target;
+}
+async function copyHelperFile(input2) {
+  const source = await assertSourceFile(input2.packageRoot, input2.file.from);
+  const target = safeJoin(input2.helperRoot, input2.file.to ?? (0, import_node_path9.basename)(input2.file.from));
+  await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(target), { recursive: true });
+  await (0, import_promises8.cp)(source, target, { force: true });
+  return target;
+}
+async function installPackageAssets(options) {
+  const assets = { main: [], helper: [] };
+  const install = options.install;
+  if (!install) return { assets };
+  for (const file of install.mainFiles ?? []) {
+    const copied = await copyMainFile({
+      packageRoot: options.packageRoot,
+      installRoot: options.installRoot,
+      file
+    });
+    if (copied) assets.main.push(copied);
+  }
+  const helperRoot = helperRootFor(options.configRoot, options.packageName, options.version);
+  if ((install.helperFiles ?? []).length > 0) {
+    await (0, import_promises8.rm)(helperRoot, { recursive: true, force: true });
+  }
+  for (const file of install.helperFiles ?? []) {
+    assets.helper.push(await copyHelperFile({ packageRoot: options.packageRoot, helperRoot, file }));
+  }
+  if (!install.postInstall) return { assets };
+  const promptFile = safeJoin(helperRoot, install.postInstall.promptFile);
+  if (!assets.helper.includes(promptFile)) {
+    throw new Error(`Post-install prompt was not installed: ${install.postInstall.promptFile}`);
+  }
+  return {
+    assets,
+    postInstall: {
+      mode: "manual_prompt",
+      status: "pending",
+      promptFile,
+      cleanup: install.postInstall.cleanup ?? "manual"
+    }
+  };
+}
+function printPostInstallNotice(name, postInstall) {
+  if (!postInstall || postInstall.mode !== "manual_prompt") return;
+  console.log("");
+  console.log("This package requires AI-assisted setup.");
+  console.log(`Prompt saved to: ${postInstall.promptFile}`);
+  console.log(`Run: aipm show-prompt ${name}`);
+  console.log(`After setup, run: aipm cleanup ${name}`);
+}
 async function installOnePackage(options) {
   const configRoot = options.configRoot;
   const installRoot = options.installRoot ?? configRoot;
@@ -8337,49 +8520,65 @@ async function installOnePackage(options) {
     options.version,
     options.token
   );
-  const skillMarkdown = await unpackTarballToBuffer(tarball, manifest.entry);
-  const result = await installSkillPackage({
-    projectRoot: installRoot,
-    manifest,
-    skillMarkdown,
-    preferredTools,
-    explicitTarget
-  });
-  const lock = await readLockfile(configRoot) ?? {
-    schemaVersion: "0.1",
-    packages: {}
-  };
-  const installed = {};
-  for (const tool of result.resolvedTools) {
-    const paths = result.installed[tool];
-    if (paths) installed[tool] = paths;
-  }
-  await writeLockfile(
-    configRoot,
-    upsertLockEntry(lock, options.name, {
+  const packageRoot = await unpackTarballToDirectory(tarball);
+  try {
+    const skillMarkdown = await (0, import_promises8.readFile)(safeJoin(packageRoot, manifest.entry), "utf8");
+    const result = await installSkillPackage({
+      projectRoot: installRoot,
+      manifest,
+      skillMarkdown,
+      preferredTools,
+      explicitTarget
+    });
+    const { assets, postInstall } = await installPackageAssets({
+      configRoot,
+      installRoot,
+      packageRoot,
+      packageName: options.name,
       version: options.version,
-      integrity: remoteIntegrity,
-      registry: options.registry,
-      resolvedTools: result.resolvedTools,
-      installed
-    })
-  );
-  console.log(`Installed ${options.name}@${options.version} \u2192 ${result.resolvedTools.join(", ")}`);
+      install: manifest.install
+    });
+    const lock = await readLockfile(configRoot) ?? {
+      schemaVersion: "0.1",
+      packages: {}
+    };
+    const installed = {};
+    for (const tool of result.resolvedTools) {
+      const paths = result.installed[tool];
+      if (paths) installed[tool] = paths;
+    }
+    await writeLockfile(
+      configRoot,
+      upsertLockEntry(lock, options.name, {
+        version: options.version,
+        integrity: remoteIntegrity,
+        registry: options.registry,
+        resolvedTools: result.resolvedTools,
+        installed,
+        ...assets.main.length || assets.helper.length ? { installedAssets: assets } : {},
+        ...postInstall ? { postInstall } : {}
+      })
+    );
+    console.log(`Installed ${options.name}@${options.version} \u2192 ${result.resolvedTools.join(", ")}`);
+    printPostInstallNotice(options.name, postInstall);
+  } finally {
+    await (0, import_promises8.rm)(packageRoot, { recursive: true, force: true });
+  }
 }
 
 // src/doctor.ts
 var import_node_child_process3 = require("node:child_process");
 var import_promises9 = require("node:fs/promises");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 var import_node_util4 = require("node:util");
 
 // src/project-root.ts
 var import_node_os3 = require("node:os");
-var import_node_path9 = require("node:path");
+var import_node_path10 = require("node:path");
 var import_node_process3 = require("node:process");
 function globalConfigDir(env2 = process.env) {
   const fromEnv = env2.AIPM_HOME?.trim();
-  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".aipm");
+  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path10.join)((0, import_node_os3.homedir)(), ".aipm");
 }
 function resolveConfigRoot(options = {}) {
   return options.global ? globalConfigDir() : (0, import_node_process3.cwd)();
@@ -8410,11 +8609,11 @@ async function commandOutput(command, args) {
 }
 function npmGlobalBin(prefix) {
   if (!prefix) return null;
-  return process.platform === "win32" ? prefix : `${prefix}${import_node_path10.sep}bin`;
+  return process.platform === "win32" ? prefix : `${prefix}${import_node_path11.sep}bin`;
 }
 function pathIncludes(pathDir) {
   if (!pathDir) return false;
-  return (process.env.PATH ?? "").split(import_node_path10.delimiter).includes(pathDir);
+  return (process.env.PATH ?? "").split(import_node_path11.delimiter).includes(pathDir);
 }
 function shellPathHint(binDir) {
   if (!binDir) return "Run npm prefix -g and add its bin folder to PATH.";
@@ -8467,11 +8666,11 @@ async function runDoctor(options) {
   if (!options.publish) {
     const configLabel = options.global ? "Global config" : "Project config";
     try {
-      await (0, import_promises9.access)((0, import_node_path10.join)(configRoot, "aipm.package.json"));
+      await (0, import_promises9.access)((0, import_node_path11.join)(configRoot, "aipm.package.json"));
       checks.push({
         name: configLabel,
         ok: true,
-        detail: `${(0, import_node_path10.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
+        detail: `${(0, import_node_path11.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
       });
     } catch {
       checks.push({
@@ -8541,9 +8740,9 @@ async function runDoctor(options) {
 
 // src/version.ts
 var import_node_fs2 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_path12 = require("node:path");
 function getCliVersion() {
-  const pkgPath = (0, import_node_path11.join)(__dirname, "..", "package.json");
+  const pkgPath = (0, import_node_path12.join)(__dirname, "..", "package.json");
   const pkg = JSON.parse((0, import_node_fs2.readFileSync)(pkgPath, "utf8"));
   return pkg.version;
 }
@@ -8682,7 +8881,7 @@ async function writeStarterFile(path2, content) {
 }
 async function inferEntryFromSource(source, fallback) {
   const sourceInfo = await (0, import_promises10.stat)(source);
-  if (sourceInfo.isFile()) return (0, import_node_path12.basename)(source);
+  if (sourceInfo.isFile()) return (0, import_node_path13.basename)(source);
   if (!sourceInfo.isDirectory()) return fallback;
   const entries = await (0, import_promises10.readdir)(source);
   if (entries.includes(fallback)) return fallback;
@@ -8694,7 +8893,7 @@ async function copySourceIntoSkillRoot(source, root, sourceLabel) {
   if (sourceInfo.isDirectory()) {
     const entries = await (0, import_promises10.readdir)(source);
     for (const entry of entries) {
-      await (0, import_promises10.cp)((0, import_node_path12.join)(source, entry), (0, import_node_path12.join)(root, entry), {
+      await (0, import_promises10.cp)((0, import_node_path13.join)(source, entry), (0, import_node_path13.join)(root, entry), {
         recursive: true,
         force: false,
         errorOnExist: true
@@ -8703,7 +8902,7 @@ async function copySourceIntoSkillRoot(source, root, sourceLabel) {
     return;
   }
   if (sourceInfo.isFile()) {
-    await (0, import_promises10.cp)(source, (0, import_node_path12.join)(root, (0, import_node_path12.basename)(source)), { force: false, errorOnExist: true });
+    await (0, import_promises10.cp)(source, (0, import_node_path13.join)(root, (0, import_node_path13.basename)(source)), { force: false, errorOnExist: true });
     return;
   }
   throw new Error(`Unsupported source path: ${sourceLabel}`);
@@ -8736,6 +8935,73 @@ function packageDashboardUrl(name) {
   if (!name) return DASHBOARD_URL;
   return `${DASHBOARD_URL}/packages/${name.replace(/^@/, "")}`;
 }
+function helperRootFromTrackedPath(path2) {
+  const parts = path2.split(import_node_path13.sep).filter(Boolean);
+  const helpersIndex = parts.lastIndexOf("helpers");
+  if (helpersIndex === -1 || parts.length <= helpersIndex + 2) return null;
+  const prefix = path2.startsWith(import_node_path13.sep) ? import_node_path13.sep : "";
+  return (0, import_node_path13.join)(prefix, ...parts.slice(0, helpersIndex + 3));
+}
+async function showInstalledPrompt(configRoot, packageArg) {
+  const { name } = parsePackageArg(packageArg);
+  const lock = await readLockfile(configRoot);
+  const entry = lock?.packages[name];
+  if (!entry) throw new Error(`Package is not installed: ${name}`);
+  if (!entry.postInstall || entry.postInstall.mode !== "manual_prompt") {
+    throw new Error(`Package has no setup prompt: ${name}`);
+  }
+  if (entry.postInstall.status === "cleaned") {
+    throw new Error(`Setup helper files were cleaned for ${name}. Reinstall the package to restore them.`);
+  }
+  const content = await (0, import_promises10.readFile)(entry.postInstall.promptFile, "utf8").catch(() => {
+    throw new Error(`Setup prompt file is missing: ${entry.postInstall?.promptFile}`);
+  });
+  console.log(`Prompt file: ${entry.postInstall.promptFile}`);
+  console.log("");
+  console.log(content.trimEnd());
+}
+async function cleanupInstalledHelpers(options) {
+  const { name } = parsePackageArg(options.packageArg);
+  const lock = await readLockfile(options.configRoot);
+  const entry = lock?.packages[name];
+  if (!lock || !entry) throw new Error(`Package is not installed: ${name}`);
+  if (!entry.installedAssets?.helper?.length) {
+    throw new Error(`Package has no helper files to clean: ${name}`);
+  }
+  if (!entry.postInstall) {
+    throw new Error(`Package has no post-install helper state: ${name}`);
+  }
+  if (entry.postInstall.status === "cleaned") {
+    console.log(`Helper files already cleaned for ${name}.`);
+    return;
+  }
+  if (!options.yes) {
+    const confirmed = await promptForConfirmation(`Delete tracked helper files for ${name}?`);
+    if (!confirmed) {
+      console.log("Cleanup cancelled.");
+      return;
+    }
+  }
+  const roots = new Set(
+    entry.installedAssets.helper.map((path2) => helperRootFromTrackedPath(path2)).filter((path2) => Boolean(path2))
+  );
+  if (roots.size > 0) {
+    for (const root of roots) await (0, import_promises10.rm)(root, { recursive: true, force: true });
+  } else {
+    for (const helperPath of entry.installedAssets.helper) await (0, import_promises10.rm)(helperPath, { force: true });
+  }
+  await writeLockfile(options.configRoot, {
+    ...lock,
+    packages: {
+      ...lock.packages,
+      [name]: {
+        ...entry,
+        postInstall: { ...entry.postInstall, status: "cleaned" }
+      }
+    }
+  });
+  console.log(`Cleaned helper files for ${name}.`);
+}
 async function openUrl(url) {
   const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
@@ -8874,6 +9140,11 @@ async function printPublishPreview(root, json) {
     description: manifest.description,
     targets: manifest.targets,
     entry: manifest.entry,
+    install: manifest.install ? {
+      mainFiles: manifest.install.mainFiles ?? [],
+      helperFiles: manifest.install.helperFiles ?? [],
+      postInstall: manifest.install.postInstall ?? null
+    } : null,
     files: rows.map((row) => ({ path: row.path, size: row.size, changed: row.changed })),
     totalBytes: size,
     warnings: [
@@ -8891,6 +9162,13 @@ async function printPublishPreview(root, json) {
   console.log(`Description: ${preview.description}`);
   console.log(`Targets: ${preview.targets.join(", ")}`);
   console.log(`Entry: ${preview.entry}`);
+  if (preview.install) {
+    console.log(`Main files: ${preview.install.mainFiles.length}`);
+    console.log(`Helper files: ${preview.install.helperFiles.length}`);
+    if (preview.install.postInstall) {
+      console.log(`Post-install: ${preview.install.postInstall.mode} (${preview.install.postInstall.promptFile})`);
+    }
+  }
   console.log(`Total: ${preview.files.length} file${preview.files.length === 1 ? "" : "s"}, ${preview.totalBytes} bytes`);
   for (const file of preview.files) {
     console.log(`${file.changed ? "modified" : "staged"} ${file.path} (${file.size} bytes)`);
@@ -9004,9 +9282,9 @@ function buildStarterQualityMetadata(options) {
 }
 async function initSkill(opts) {
   if (!isValidScopeName(opts.name)) throw new Error("Invalid @scope/name");
-  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path12.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
+  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path13.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
   const cdTarget = opts.here ? null : opts.dir ?? skillFolderName(opts.name);
-  const source = opts.from ? (0, import_node_path12.resolve)(opts.from) : null;
+  const source = opts.from ? (0, import_node_path13.resolve)(opts.from) : null;
   const entry = source ? await inferEntryFromSource(source, opts.entry) : opts.entry;
   const template = parseSkillTemplate(opts.template ?? "blank");
   const manifest = PackageManifestSchema.parse({
@@ -9029,15 +9307,15 @@ async function initSkill(opts) {
   } else {
     await (0, import_promises10.mkdir)(root, { recursive: true });
   }
-  await writeStarterFile((0, import_node_path12.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+  await writeStarterFile((0, import_node_path13.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
   if (!opts.from) {
     await writeStarterFile(
-      (0, import_node_path12.join)(root, entry),
+      (0, import_node_path13.join)(root, entry),
       SKILL_TEMPLATES[template](opts.name)
     );
   }
   await writeStarterFile(
-    (0, import_node_path12.join)(root, ".aipmignore"),
+    (0, import_node_path13.join)(root, ".aipmignore"),
     [
       "# Files that should never be published with this skill",
       ".env*",
@@ -9055,7 +9333,7 @@ async function initSkill(opts) {
       ""
     ].join("\n")
   );
-  await (0, import_promises10.mkdir)((0, import_node_path12.join)(root, ".aipm"), { recursive: true });
+  await (0, import_promises10.mkdir)((0, import_node_path13.join)(root, ".aipm"), { recursive: true });
   console.log(`Created ${opts.name} skill folder: ${root}`);
   printPublishGuide(
     opts.from ? `Copied ${opts.from} into ${root} and created aipm.manifest.json, .aipmignore, and the local publish state folder.` : `Created ${root} with aipm.manifest.json, ${entry}, .aipmignore, and the local publish state folder.`,
@@ -9254,6 +9532,16 @@ program2.command("install").description("Install all packages from aipm.package.
     });
   }
 });
+program2.command("show-prompt <package>").description("Show the manual setup prompt installed with a package").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (pkgArg, opts) => {
+  await showInstalledPrompt(resolveConfigRoot({ global: opts.global }), pkgArg);
+});
+program2.command("cleanup <package>").description("Delete temporary helper files installed with a package").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--yes", "Delete helper files without asking for confirmation").action(async (pkgArg, opts) => {
+  await cleanupInstalledHelpers({
+    configRoot: resolveConfigRoot({ global: opts.global }),
+    packageArg: pkgArg,
+    yes: opts.yes
+  });
+});
 program2.command("skill").description("Create and manage local skill packages").command("init").description("Create aipm.manifest.json and SKILL.md").requiredOption("--name <name>", "Package name, e.g. @org/skill").option("--version <version>", "Initial version", "1.0.0").option("--description <description>", "Skill description", "AIPM skill").option("--targets <targets>", "Comma-separated targets", "cursor").option("--entry <entry>", "Entry file", "SKILL.md").option("--template <template>", "Starter SKILL.md template: blank, code-review, issue-summary, release-notes", "blank").option("--dir <dir>", "Create files in this folder").option("--here", "Create files in the current folder instead of a skill-named folder").option("--from <path>", "Copy an existing AI-tool skill file or folder into the package folder").action(
   async (opts) => initSkill(opts)
 );
@@ -9262,8 +9550,8 @@ var publish = program2.command("publish [dir]").description("Stage, validate, an
     publish.help();
     return;
   }
-  const abs = (0, import_node_path12.resolve)(dir);
-  const manifestRaw = await (0, import_promises10.readFile)((0, import_node_path12.join)(abs, "aipm.manifest.json"), "utf8");
+  const abs = (0, import_node_path13.resolve)(dir);
+  const manifestRaw = await (0, import_promises10.readFile)((0, import_node_path13.join)(abs, "aipm.manifest.json"), "utf8");
   const manifest = PackageManifestSchema.parse(JSON.parse(manifestRaw));
   const tarball = await packDirectory(abs);
   const registry = registryFromEnvOrDefault(opts.registry);
@@ -9376,17 +9664,21 @@ publish.command("validate").description("Validate staged files before publish").
   );
 });
 publish.command("preview").description("Preview exactly what will be uploaded").option("--json", "Print machine-readable JSON").action((opts) => printPublishPreview((0, import_node_process5.cwd)(), opts.json));
-publish.command("push").description("Publish staged files").option("--registry <url>", "Registry base URL").option("--token <token>", "Publish token").option("--yes", "Confirm upload without an extra reminder").action(async (opts) => {
+publish.command("push").description("Publish staged files").option("--registry <url>", "Registry base URL").option("--token <token>", "Publish token").option("--yes", "Confirm upload without an extra reminder").option("--verbose", "Print extra diagnostic output").action(async (opts) => {
   const root = (0, import_node_process5.cwd)();
   const { manifest } = await validatePublishState(root);
   const registry = registryFromEnvOrDefault(opts.registry);
   const tarball = await packStagedFiles(root);
   const staged = await statusPublishState(root);
+  const verbose = Boolean(opts.verbose || program2.opts().verbose);
   if (!opts.yes) {
     console.log("Reminder: this publishes an immutable public package version.");
     console.log("Use --yes to skip this reminder in automation.");
   }
   console.log(`Uploading ${staged.length} file${staged.length === 1 ? "" : "s"} to ${registry}.`);
+  if (verbose) {
+    console.log(`Verbose: package ${manifest.name}@${manifest.version}; tarball ${tarball.length} bytes.`);
+  }
   for (const entry of staged) console.log(`  ${entry.path}`);
   const result = await publishPackage(registry, manifest.name, tarball, opts.token ?? import_node_process5.env.AIPM_TOKEN);
   console.log(`Published ${manifest.name}@${result.version}`);