@aipm-registry/cli 0.4.1 → 0.4.3

package/dist/bin.cjs

@@ -6,8 +6,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -3837,7 +3842,7 @@ var init_types = __esm({
         ...processCreateParams(params)
       });
     };
-    BRAND = Symbol("zod_brand");
+    BRAND = /* @__PURE__ */ Symbol("zod_brand");
     ZodBranded = class extends ZodType {
       _parse(input2) {
         const { ctx } = this._processInputParams(input2);
@@ -4011,14 +4016,14 @@ var init_types = __esm({
     onumber = () => numberType().optional();
     oboolean = () => booleanType().optional();
     coerce = {
-      string: (arg) => ZodString.create({ ...arg, coerce: true }),
-      number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
-      boolean: (arg) => ZodBoolean.create({
+      string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+      number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+      boolean: ((arg) => ZodBoolean.create({
         ...arg,
         coerce: true
-      }),
-      bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
-      date: (arg) => ZodDate.create({ ...arg, coerce: true })
+      })),
+      bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+      date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
     };
     NEVER = INVALID;
   }
@@ -4372,23 +4377,57 @@ var init_detect_tools = __esm({
   }
 });
 
-// ../../packages/adapter-claude/dist/index.js
-var import_promises2, import_node_path3, ClaudeSkillAdapter, claudeSkillAdapter;
+// ../../packages/adapter-sdk/dist/index.js
+async function writeSkillDirectory(skillDir, input2) {
+  const entryPath = (0, import_node_path3.join)(skillDir, "SKILL.md");
+  const seen = /* @__PURE__ */ new Set(["skill.md"]);
+  const files = (input2.supportingFiles ?? []).map((file) => {
+    const normalized = (0, import_node_path3.normalize)(file.path);
+    const target = (0, import_node_path3.resolve)(skillDir, normalized);
+    const fromSkillDir = (0, import_node_path3.relative)(skillDir, target);
+    return { file, normalized, target, fromSkillDir, key: fromSkillDir.toLowerCase() };
+  });
+  for (const { file, normalized, fromSkillDir, key } of files) {
+    if (!normalized || normalized === "." || (0, import_node_path3.isAbsolute)(normalized) || fromSkillDir === ".." || fromSkillDir.startsWith(`..${import_node_path3.sep}`) || (0, import_node_path3.isAbsolute)(fromSkillDir) || seen.has(key)) {
+      throw new Error(`Unsafe or duplicate skill supporting file path: ${file.path}`);
+    }
+    seen.add(key);
+  }
+  await (0, import_promises2.mkdir)(skillDir, { recursive: true });
+  await (0, import_promises2.writeFile)(entryPath, input2.skillMarkdown, "utf8");
+  const writtenPaths = [entryPath];
+  for (const { file, target } of files) {
+    await (0, import_promises2.mkdir)((0, import_node_path3.dirname)(target), { recursive: true });
+    await (0, import_promises2.writeFile)(target, file.content);
+    if (file.mode !== void 0)
+      await (0, import_promises2.chmod)(target, file.mode & 511);
+    writtenPaths.push(target);
+  }
+  return { writtenPaths };
+}
+var import_promises2, import_node_path3;
 var init_dist2 = __esm({
-  "../../packages/adapter-claude/dist/index.js"() {
+  "../../packages/adapter-sdk/dist/index.js"() {
     "use strict";
     import_promises2 = require("node:fs/promises");
     import_node_path3 = require("node:path");
+  }
+});
+
+// ../../packages/adapter-claude/dist/index.js
+var import_node_path4, ClaudeSkillAdapter, claudeSkillAdapter;
+var init_dist3 = __esm({
+  "../../packages/adapter-claude/dist/index.js"() {
+    "use strict";
+    import_node_path4 = require("node:path");
+    init_dist2();
     init_dist();
     ClaudeSkillAdapter = class {
       tool = "claude";
       async installSkill(input2) {
         const short = shortNameFromScopeName(input2.packageName);
-        const skillDir = (0, import_node_path3.join)(input2.projectRoot, ".claude", "aipm", "skills", short);
-        await (0, import_promises2.mkdir)(skillDir, { recursive: true });
-        const filePath = (0, import_node_path3.join)(skillDir, "SKILL.md");
-        await (0, import_promises2.writeFile)(filePath, input2.skillMarkdown, "utf8");
-        return { writtenPaths: [filePath] };
+        const skillDir = (0, import_node_path4.join)(input2.projectRoot, ".claude", "skills", short);
+        return writeSkillDirectory(skillDir, input2);
       }
     };
     claudeSkillAdapter = new ClaudeSkillAdapter();
@@ -4396,20 +4435,20 @@ var init_dist2 = __esm({
 });
 
 // ../../packages/adapter-cursor/dist/index.js
-var import_promises3, import_node_path4, CursorSkillAdapter, cursorSkillAdapter;
-var init_dist3 = __esm({
+var import_promises3, import_node_path5, CursorSkillAdapter, cursorSkillAdapter;
+var init_dist4 = __esm({
   "../../packages/adapter-cursor/dist/index.js"() {
     "use strict";
     import_promises3 = require("node:fs/promises");
-    import_node_path4 = require("node:path");
+    import_node_path5 = require("node:path");
     init_dist();
     CursorSkillAdapter = class {
       tool = "cursor";
       async installSkill(input2) {
         const short = shortNameFromScopeName(input2.packageName);
-        const skillsDir = (0, import_node_path4.join)(input2.projectRoot, ".cursor", "aipm", "skills");
+        const skillsDir = (0, import_node_path5.join)(input2.projectRoot, ".cursor", "aipm", "skills");
         await (0, import_promises3.mkdir)(skillsDir, { recursive: true });
-        const filePath = (0, import_node_path4.join)(skillsDir, `${short}.md`);
+        const filePath = (0, import_node_path5.join)(skillsDir, `${short}.md`);
         await (0, import_promises3.writeFile)(filePath, input2.skillMarkdown, "utf8");
         return { writtenPaths: [filePath] };
       }
@@ -4419,22 +4458,19 @@ var init_dist3 = __esm({
 });
 
 // ../../packages/adapter-codex/dist/index.js
-var import_promises4, import_node_path5, CodexSkillAdapter, codexSkillAdapter;
-var init_dist4 = __esm({
+var import_node_path6, CodexSkillAdapter, codexSkillAdapter;
+var init_dist5 = __esm({
   "../../packages/adapter-codex/dist/index.js"() {
     "use strict";
-    import_promises4 = require("node:fs/promises");
-    import_node_path5 = require("node:path");
+    import_node_path6 = require("node:path");
+    init_dist2();
     init_dist();
     CodexSkillAdapter = class {
       tool = "codex";
       async installSkill(input2) {
         const short = shortNameFromScopeName(input2.packageName);
-        const skillDir = (0, import_node_path5.join)(input2.projectRoot, ".agents", "skills", short);
-        await (0, import_promises4.mkdir)(skillDir, { recursive: true });
-        const filePath = (0, import_node_path5.join)(skillDir, "SKILL.md");
-        await (0, import_promises4.writeFile)(filePath, input2.skillMarkdown, "utf8");
-        return { writtenPaths: [filePath] };
+        const skillDir = (0, import_node_path6.join)(input2.projectRoot, ".agents", "skills", short);
+        return writeSkillDirectory(skillDir, input2);
       }
     };
     codexSkillAdapter = new CodexSkillAdapter();
@@ -4459,6 +4495,7 @@ async function installSkillPackage(options) {
       packageName: options.manifest.name,
       version: options.manifest.version,
       skillMarkdown: options.skillMarkdown,
+      supportingFiles: options.supportingFiles,
       projectRoot: options.projectRoot
     });
     installed[tool] = result.writtenPaths;
@@ -4469,9 +4506,9 @@ var adapters;
 var init_install_skill = __esm({
   "../../packages/engine/dist/install-skill.js"() {
     "use strict";
-    init_dist2();
     init_dist3();
     init_dist4();
+    init_dist5();
     init_detect_tools();
     adapters = {
       cursor: cursorSkillAdapter,
@@ -4488,7 +4525,7 @@ __export(dist_exports, {
   installSkillPackage: () => installSkillPackage,
   resolveInstallTools: () => resolveInstallTools
 });
-var init_dist5 = __esm({
+var init_dist6 = __esm({
   "../../packages/engine/dist/index.js"() {
     "use strict";
     init_detect_tools();
@@ -7869,24 +7906,33 @@ var import_node_crypto3 = require("node:crypto");
 var import_node_child_process4 = require("node:child_process");
 var import_node_http = require("node:http");
 var import_promises12 = require("node:fs/promises");
-var import_node_path15 = require("node:path");
+var import_node_path17 = require("node:path");
 var import_node_process5 = require("node:process");
 init_dist();
-init_dist5();
+init_dist6();
 
 // src/pack.ts
 var import_node_child_process2 = require("node:child_process");
 var import_node_util3 = require("node:util");
-var import_promises6 = require("node:fs/promises");
-var import_node_path7 = require("node:path");
+var import_promises5 = require("node:fs/promises");
+var import_node_path8 = require("node:path");
 var import_node_os = require("node:os");
 
 // src/publish-state.ts
 var import_node_crypto = require("node:crypto");
-var import_promises5 = require("node:fs/promises");
-var import_node_path6 = require("node:path");
+var import_promises4 = require("node:fs/promises");
+var import_node_path7 = require("node:path");
 init_dist();
-var STATE_PATH = (0, import_node_path6.join)(".aipm", "publish-state.json");
+
+// src/recommend-cmd.ts
+function recommendCmd(command, stream = process.stderr) {
+  const quoted = `"${command}"`;
+  if (!stream.isTTY) return quoted;
+  return `\x1B[36m${quoted}\x1B[39m`;
+}
+
+// src/publish-state.ts
+var STATE_PATH = (0, import_node_path7.join)(".aipm", "publish-state.json");
 var IGNORE_FILE = ".aipmignore";
 var MAX_PACKAGE_BYTES = 50 * 1024 * 1024;
 var EXCLUDED_SEGMENTS = /* @__PURE__ */ new Set([".aipm", ".git", "node_modules", "dist", ".next"]);
@@ -7901,11 +7947,11 @@ var SECRET_PATTERNS = [
   /<publishData/i
 ];
 function publishStatePath(root) {
-  return (0, import_node_path6.join)(root, STATE_PATH);
+  return (0, import_node_path7.join)(root, STATE_PATH);
 }
 function normalizePublishPath(root, filePath) {
-  const abs = (0, import_node_path6.resolve)(root, filePath);
-  const rel = (0, import_node_path6.normalize)((0, import_node_path6.relative)(root, abs)).split(import_node_path6.sep).join("/");
+  const abs = (0, import_node_path7.resolve)(root, filePath);
+  const rel = (0, import_node_path7.normalize)((0, import_node_path7.relative)(root, abs)).split(import_node_path7.sep).join("/");
   if (!rel || rel === ".") return ".";
   if (rel.startsWith("../") || rel === ".." || rel.startsWith("/")) {
     throw new Error(`Path is outside the skill folder: ${filePath}`);
@@ -7922,7 +7968,7 @@ function isExcludedPublishPath(rel) {
 }
 async function readAipmIgnore(root) {
   try {
-    const raw = await (0, import_promises5.readFile)((0, import_node_path6.join)(root, IGNORE_FILE), "utf8");
+    const raw = await (0, import_promises4.readFile)((0, import_node_path7.join)(root, IGNORE_FILE), "utf8");
     return raw.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   } catch {
     return [];
@@ -7943,7 +7989,7 @@ async function isIgnoredByAipmIgnore(root, rel) {
   return rules.some((rule) => matchesIgnoreRule(rel, rule));
 }
 async function assertNoObviousSecrets(path2, rel) {
-  const data = await (0, import_promises5.readFile)(path2);
+  const data = await (0, import_promises4.readFile)(path2);
   if (data.includes(0)) return;
   const text = data.toString("utf8");
   if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) {
@@ -7951,7 +7997,7 @@ async function assertNoObviousSecrets(path2, rel) {
   }
 }
 async function fileHash(path2) {
-  const data = await (0, import_promises5.readFile)(path2);
+  const data = await (0, import_promises4.readFile)(path2);
   return {
     hash: (0, import_node_crypto.createHash)("sha256").update(data).digest("hex"),
     size: data.length
@@ -7959,7 +8005,7 @@ async function fileHash(path2) {
 }
 async function readPublishState(root) {
   try {
-    const raw = await (0, import_promises5.readFile)(publishStatePath(root), "utf8");
+    const raw = await (0, import_promises4.readFile)(publishStatePath(root), "utf8");
     const parsed = JSON.parse(raw);
     return {
       schemaVersion: "0.1",
@@ -7971,18 +8017,18 @@ async function readPublishState(root) {
 }
 async function writePublishState(root, state) {
   const path2 = publishStatePath(root);
-  await (0, import_promises5.mkdir)((0, import_node_path6.dirname)(path2), { recursive: true });
+  await (0, import_promises4.mkdir)((0, import_node_path7.dirname)(path2), { recursive: true });
   const files = [...state.files].sort((a, b) => a.path.localeCompare(b.path));
-  await (0, import_promises5.writeFile)(path2, JSON.stringify({ schemaVersion: "0.1", files }, null, 2) + "\n", "utf8");
+  await (0, import_promises4.writeFile)(path2, JSON.stringify({ schemaVersion: "0.1", files }, null, 2) + "\n", "utf8");
 }
 async function expandPublishPath(root, rel) {
   if (isExcludedPublishPath(rel)) return [];
   if (await isIgnoredByAipmIgnore(root, rel)) return [];
-  const abs = (0, import_node_path6.join)(root, rel);
-  const info = await (0, import_promises5.stat)(abs);
+  const abs = (0, import_node_path7.join)(root, rel);
+  const info = await (0, import_promises4.stat)(abs);
   if (info.isFile()) return [rel];
   if (!info.isDirectory()) return [];
-  const entries = await (0, import_promises5.readdir)(abs);
+  const entries = await (0, import_promises4.readdir)(abs);
   const nested = await Promise.all(
     entries.map((entry) => expandPublishPath(root, `${rel === "." ? "" : `${rel}/`}${entry}`))
   );
@@ -7998,7 +8044,7 @@ async function addPublishFiles(root, paths) {
     for (const rel of files) {
       if (isExcludedPublishPath(rel)) continue;
       if (await isIgnoredByAipmIgnore(root, rel)) continue;
-      const hashed = await fileHash((0, import_node_path6.join)(root, rel));
+      const hashed = await fileHash((0, import_node_path7.join)(root, rel));
       byPath.set(rel, { path: rel, ...hashed });
     }
   }
@@ -8017,15 +8063,17 @@ async function removePublishFiles(root, paths) {
   return next;
 }
 async function resetPublishState(root) {
-  await (0, import_promises5.rm)(publishStatePath(root), { force: true });
+  await (0, import_promises4.rm)(publishStatePath(root), { force: true });
 }
 async function readManifest(root) {
   try {
-    const raw = await (0, import_promises5.readFile)((0, import_node_path6.join)(root, "aipm.manifest.json"), "utf8");
+    const raw = await (0, import_promises4.readFile)((0, import_node_path7.join)(root, "aipm.manifest.json"), "utf8");
     return PackageManifestSchema.parse(JSON.parse(raw));
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
-      throw new Error("No aipm.manifest.json found. Run aipm publish init --name @org/skill.");
+      throw new Error(
+        `No aipm.manifest.json found. Run ${recommendCmd("aipm publish init --name <@org/skill>")}.`
+      );
     }
     throw error;
   }
@@ -8041,7 +8089,9 @@ function installReferencedFiles(manifest) {
 async function validatePublishState(root) {
   const manifest = await readManifest(root);
   const state = await readPublishState(root);
-  if (state.files.length === 0) throw new Error("No files staged. Run aipm publish add <files...>.");
+  if (state.files.length === 0) {
+    throw new Error(`No files staged. Run ${recommendCmd("aipm publish add <files...>")}.`);
+  }
   const staged = new Set(state.files.map((entry) => entry.path));
   if (!staged.has("aipm.manifest.json")) throw new Error("aipm.manifest.json must be staged.");
   if (!staged.has(manifest.entry)) throw new Error(`Manifest entry must be staged: ${manifest.entry}`);
@@ -8054,12 +8104,14 @@ async function validatePublishState(root) {
     if (await isIgnoredByAipmIgnore(root, entry.path)) {
       throw new Error(`Refusing to publish ignored path: ${entry.path}`);
     }
-    const abs = (0, import_node_path6.join)(root, entry.path);
-    const info = await (0, import_promises5.stat)(abs).catch(() => null);
+    const abs = (0, import_node_path7.join)(root, entry.path);
+    const info = await (0, import_promises4.stat)(abs).catch(() => null);
     if (!info?.isFile()) throw new Error(`Staged file is missing: ${entry.path}`);
     const hashed = await fileHash(abs);
     if (hashed.hash !== entry.hash) {
-      throw new Error(`Staged file changed after add: ${entry.path}. Run aipm publish add ${entry.path}`);
+      throw new Error(
+        `Staged file changed after add: ${entry.path}. Run ${recommendCmd(`aipm publish add ${entry.path}`)}.`
+      );
     }
     await assertNoObviousSecrets(abs, entry.path);
     size += hashed.size;
@@ -8071,7 +8123,7 @@ async function statusPublishState(root) {
   const state = await readPublishState(root);
   const rows = [];
   for (const entry of state.files) {
-    const current = await fileHash((0, import_node_path6.join)(root, entry.path)).catch(() => null);
+    const current = await fileHash((0, import_node_path7.join)(root, entry.path)).catch(() => null);
     rows.push({ ...entry, changed: !current || current.hash !== entry.hash });
   }
   return rows;
@@ -8079,9 +8131,9 @@ async function statusPublishState(root) {
 async function copyStagedFiles(root, destination) {
   const state = await readPublishState(root);
   for (const entry of state.files) {
-    const target = (0, import_node_path6.join)(destination, entry.path);
-    await (0, import_promises5.mkdir)((0, import_node_path6.dirname)(target), { recursive: true });
-    await (0, import_promises5.cp)((0, import_node_path6.join)(root, entry.path), target);
+    const target = (0, import_node_path7.join)(destination, entry.path);
+    await (0, import_promises4.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+    await (0, import_promises4.cp)((0, import_node_path7.join)(root, entry.path), target);
   }
 }
 
@@ -8095,21 +8147,21 @@ async function packDirectory(dir) {
   return Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout);
 }
 async function packStagedFiles(root) {
-  const tempDir = await (0, import_promises6.mkdtemp)((0, import_node_path7.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
+  const tempDir = await (0, import_promises5.mkdtemp)((0, import_node_path8.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
   try {
     await copyStagedFiles(root, tempDir);
     return await packDirectory(tempDir);
   } finally {
-    await (0, import_promises6.rm)(tempDir, { recursive: true, force: true });
+    await (0, import_promises5.rm)(tempDir, { recursive: true, force: true });
   }
 }
 async function unpackTarballToDirectory(tarball) {
-  const { mkdtemp: mkdtemp2, writeFile: writeFile9 } = await import("node:fs/promises");
-  const { join: join15 } = await import("node:path");
+  const { mkdtemp: mkdtemp2, writeFile: writeFile8 } = await import("node:fs/promises");
+  const { join: join16 } = await import("node:path");
   const { tmpdir: tmpdir2 } = await import("node:os");
-  const tempDir = await mkdtemp2(join15(tmpdir2(), "aipm-install-"));
-  const tgzPath = join15(tempDir, "pkg.tgz");
-  await writeFile9(tgzPath, tarball);
+  const tempDir = await mkdtemp2(join16(tmpdir2(), "aipm-install-"));
+  const tgzPath = join16(tempDir, "pkg.tgz");
+  await writeFile8(tgzPath, tarball);
   await execFileAsync("tar", ["-xzf", tgzPath, "-C", tempDir]);
   return tempDir;
 }
@@ -8122,7 +8174,7 @@ function registryFetchError(registry, cause) {
   const msg = cause instanceof Error ? cause.message : String(cause);
   if (msg === "fetch failed" || msg.includes("ECONNREFUSED") || msg.includes("ENOTFOUND") || msg.includes("timed out") || msg.includes("aborted")) {
     return new Error(
-      `Cannot reach registry at ${registry}. Check your connection or pass --registry <url>.`
+      `Cannot reach registry at ${registry}. Check your connection or pass ${recommendCmd("--registry <url>")}.`
     );
   }
   return new Error(`Registry request failed (${registry}): ${msg}`);
@@ -8143,13 +8195,13 @@ function privateInstallHint(name, status, token) {
   if (status !== 404 || !name.startsWith("@") || token) {
     return `Package not found: ${name} (${status})`;
   }
-  return `Package not found: ${name} (${status}). If @org/pkg is private, run aipm login, or set AIPM_TOKEN for CI.`;
+  return `Package not found: ${name} (${status}). If @org/pkg is private, run ${recommendCmd("aipm login")}, or set AIPM_TOKEN for CI.`;
 }
 function publishTokenHint(name, error) {
   if (error === "Publish token required") {
     return [
       `Publish token required for ${name}.`,
-      `Generate a fresh 5-minute publish token for ${name} from the package dashboard, then retry with AIPM_TOKEN=<token> aipm publish push --yes.`
+      `Generate a fresh 5-minute publish token for ${name} from the package dashboard, then retry with ${recommendCmd("AIPM_TOKEN=<token> aipm publish push --yes")}.`
     ].join(" ");
   }
   if (error === "Invalid publish token") {
@@ -8305,16 +8357,16 @@ async function publishPrompt(registry, input2, accessToken, sampleImage) {
 }
 
 // src/auth-store.ts
-var import_promises7 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var import_node_os2 = require("node:os");
-var import_node_path8 = require("node:path");
-var AUTH_FILE = (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
+var import_node_path9 = require("node:path");
+var AUTH_FILE = (0, import_node_path9.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
 function normalizeRegistry(registry) {
   return registry.replace(/\/$/, "");
 }
 async function readAuthStore() {
   try {
-    const raw = await (0, import_promises7.readFile)(AUTH_FILE, "utf8");
+    const raw = await (0, import_promises6.readFile)(AUTH_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return { registries: parsed.registries ?? {} };
   } catch {
@@ -8322,9 +8374,9 @@ async function readAuthStore() {
   }
 }
 async function writeAuthStore(store) {
-  await (0, import_promises7.mkdir)((0, import_node_path8.dirname)(AUTH_FILE), { recursive: true });
-  await (0, import_promises7.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
-  await (0, import_promises7.chmod)(AUTH_FILE, 384).catch(() => void 0);
+  await (0, import_promises6.mkdir)((0, import_node_path9.dirname)(AUTH_FILE), { recursive: true });
+  await (0, import_promises6.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
+  await (0, import_promises6.chmod)(AUTH_FILE, 384).catch(() => void 0);
 }
 async function getStoredRegistryAuth(registry) {
   const store = await readAuthStore();
@@ -8353,41 +8405,41 @@ function isAccessTokenFresh(auth, skewMs = 6e4) {
 }
 
 // src/install-one.ts
-init_dist5();
-var import_promises9 = require("node:fs/promises");
-var import_node_path10 = require("node:path");
+init_dist6();
+var import_promises8 = require("node:fs/promises");
+var import_node_path11 = require("node:path");
 
 // src/project-files.ts
-var import_promises8 = require("node:fs/promises");
-var import_node_path9 = require("node:path");
+var import_promises7 = require("node:fs/promises");
+var import_node_path10 = require("node:path");
 init_dist();
 var PACKAGE_JSON = "aipm.package.json";
 var LOCKFILE = "aipm-lock.json";
 async function readProjectPackageJson(projectRoot) {
   try {
-    const raw = await (0, import_promises8.readFile)((0, import_node_path9.join)(projectRoot, PACKAGE_JSON), "utf8");
+    const raw = await (0, import_promises7.readFile)((0, import_node_path10.join)(projectRoot, PACKAGE_JSON), "utf8");
     return ProjectPackageJsonSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeProjectPackageJson(projectRoot, data) {
-  await (0, import_promises8.writeFile)(
-    (0, import_node_path9.join)(projectRoot, PACKAGE_JSON),
+  await (0, import_promises7.writeFile)(
+    (0, import_node_path10.join)(projectRoot, PACKAGE_JSON),
     JSON.stringify(data, null, 2) + "\n",
     "utf8"
   );
 }
 async function readLockfile(projectRoot) {
   try {
-    const raw = await (0, import_promises8.readFile)((0, import_node_path9.join)(projectRoot, LOCKFILE), "utf8");
+    const raw = await (0, import_promises7.readFile)((0, import_node_path10.join)(projectRoot, LOCKFILE), "utf8");
     return LockfileSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeLockfile(projectRoot, data) {
-  await (0, import_promises8.writeFile)((0, import_node_path9.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
+  await (0, import_promises7.writeFile)((0, import_node_path10.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 function upsertLockEntry(lock, name, entry) {
   return {
@@ -8462,7 +8514,7 @@ async function promptForConfirmation(question) {
 
 // src/install-one.ts
 function normalizeRelativePath(path2) {
-  return (0, import_node_path10.normalize)(path2).split(import_node_path10.sep).join("/");
+  return (0, import_node_path11.normalize)(path2).split(import_node_path11.sep).join("/");
 }
 function assertSafeRelativePath(path2) {
   const rel = normalizeRelativePath(path2.trim());
@@ -8473,8 +8525,8 @@ function assertSafeRelativePath(path2) {
 }
 function safeJoin(root, relPath) {
   const rel = assertSafeRelativePath(relPath);
-  const target = (0, import_node_path10.resolve)(root, rel);
-  const fromRoot = normalizeRelativePath((0, import_node_path10.relative)(root, target));
+  const target = (0, import_node_path11.resolve)(root, rel);
+  const fromRoot = normalizeRelativePath((0, import_node_path11.relative)(root, target));
   if (fromRoot === ".." || fromRoot.startsWith("../") || fromRoot.startsWith("/")) {
     throw new Error(`Unsafe install path: ${relPath}`);
   }
@@ -8485,33 +8537,82 @@ function packageHelperSlug(name) {
   return `${scope}__${pkg}`;
 }
 function helperRootFor(configRoot, packageName, version) {
-  const base = (0, import_node_path10.basename)(configRoot) === ".aipm" ? (0, import_node_path10.join)(configRoot, "helpers") : (0, import_node_path10.join)(configRoot, ".aipm", "helpers");
-  return (0, import_node_path10.join)(base, packageHelperSlug(packageName), version);
+  const base = (0, import_node_path11.basename)(configRoot) === ".aipm" ? (0, import_node_path11.join)(configRoot, "helpers") : (0, import_node_path11.join)(configRoot, ".aipm", "helpers");
+  return (0, import_node_path11.join)(base, packageHelperSlug(packageName), version);
 }
 async function assertSourceFile(packageRoot, relPath) {
   const source = safeJoin(packageRoot, relPath);
-  const info = await (0, import_promises9.stat)(source).catch(() => null);
+  const info = await (0, import_promises8.stat)(source).catch(() => null);
   if (!info?.isFile()) throw new Error(`Package install file not found: ${relPath}`);
   return source;
 }
+function installReferencedFiles2(install) {
+  return [
+    ...(install?.mainFiles ?? []).map((file) => file.from),
+    ...(install?.helperFiles ?? []).map((file) => file.from)
+  ];
+}
+function isRootLicenseOrNotice(path2) {
+  return !path2.includes("/") && /^(?:licen[cs]e|notice|copying)(?:$|[._-])/i.test(path2);
+}
+async function listRegularPackageFiles(root, current = root) {
+  const files = [];
+  for (const entry of await (0, import_promises8.readdir)(current, { withFileTypes: true })) {
+    const absolute = (0, import_node_path11.join)(current, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await listRegularPackageFiles(root, absolute));
+    } else if (entry.isFile()) {
+      files.push(normalizeRelativePath((0, import_node_path11.relative)(root, absolute)));
+    }
+  }
+  return files;
+}
+async function collectSkillSupportingFiles(packageRoot, manifest) {
+  const entry = assertSafeRelativePath(manifest.entry);
+  const entryDirectory = (0, import_node_path11.dirname)(entry);
+  const excluded = /* @__PURE__ */ new Set([
+    entry,
+    "aipm.manifest.json",
+    "pkg.tgz",
+    ...installReferencedFiles2(manifest.install).map(assertSafeRelativePath)
+  ]);
+  const supportingFiles = [];
+  for (const sourcePath of await listRegularPackageFiles(packageRoot)) {
+    if (excluded.has(sourcePath)) continue;
+    const fromEntryDirectory = normalizeRelativePath((0, import_node_path11.relative)(entryDirectory, sourcePath));
+    const isEntrySibling = fromEntryDirectory !== ".." && !fromEntryDirectory.startsWith("../") && !fromEntryDirectory.startsWith("/");
+    if (!isEntrySibling && !isRootLicenseOrNotice(sourcePath)) continue;
+    const destinationPath = isEntrySibling ? fromEntryDirectory : (0, import_node_path11.basename)(sourcePath);
+    if (destinationPath.toLowerCase() === "skill.md") {
+      throw new Error(`Package supporting file conflicts with installed SKILL.md: ${sourcePath}`);
+    }
+    const source = safeJoin(packageRoot, sourcePath);
+    supportingFiles.push({
+      path: destinationPath,
+      content: await (0, import_promises8.readFile)(source),
+      mode: (await (0, import_promises8.stat)(source)).mode
+    });
+  }
+  return supportingFiles.sort((a, b) => a.path.localeCompare(b.path));
+}
 async function copyMainFile(input2) {
   const source = await assertSourceFile(input2.packageRoot, input2.file.from);
   const target = safeJoin(input2.installRoot, input2.file.to);
   const overwrite = input2.file.overwrite ?? "fail";
-  const exists = await (0, import_promises9.stat)(target).catch(() => null);
+  const exists = await (0, import_promises8.stat)(target).catch(() => null);
   if (exists) {
     if (overwrite === "skip") return null;
     if (overwrite === "fail") throw new Error(`Install target already exists: ${target}`);
   }
-  await (0, import_promises9.mkdir)((0, import_node_path10.dirname)(target), { recursive: true });
-  await (0, import_promises9.cp)(source, target, { force: overwrite === "replace" });
+  await (0, import_promises8.mkdir)((0, import_node_path11.dirname)(target), { recursive: true });
+  await (0, import_promises8.cp)(source, target, { force: overwrite === "replace" });
   return target;
 }
 async function copyHelperFile(input2) {
   const source = await assertSourceFile(input2.packageRoot, input2.file.from);
-  const target = safeJoin(input2.helperRoot, input2.file.to ?? (0, import_node_path10.basename)(input2.file.from));
-  await (0, import_promises9.mkdir)((0, import_node_path10.dirname)(target), { recursive: true });
-  await (0, import_promises9.cp)(source, target, { force: true });
+  const target = safeJoin(input2.helperRoot, input2.file.to ?? (0, import_node_path11.basename)(input2.file.from));
+  await (0, import_promises8.mkdir)((0, import_node_path11.dirname)(target), { recursive: true });
+  await (0, import_promises8.cp)(source, target, { force: true });
   return target;
 }
 async function installPackageAssets(options) {
@@ -8528,7 +8629,7 @@ async function installPackageAssets(options) {
   }
   const helperRoot = helperRootFor(options.configRoot, options.packageName, options.version);
   if ((install.helperFiles ?? []).length > 0) {
-    await (0, import_promises9.rm)(helperRoot, { recursive: true, force: true });
+    await (0, import_promises8.rm)(helperRoot, { recursive: true, force: true });
   }
   for (const file of install.helperFiles ?? []) {
     assets.helper.push(await copyHelperFile({ packageRoot: options.packageRoot, helperRoot, file }));
@@ -8573,7 +8674,7 @@ async function installOnePackage(options) {
   }
   let explicitTarget = options.explicitTarget;
   let preferredTools = options.project.preferredTools;
-  const { resolveInstallTools: resolveInstallTools2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
+  const { resolveInstallTools: resolveInstallTools2 } = await Promise.resolve().then(() => (init_dist6(), dist_exports));
   let tools = await resolveInstallTools2({
     projectRoot: installRoot,
     manifest,
@@ -8604,11 +8705,13 @@ async function installOnePackage(options) {
   );
   const packageRoot = await unpackTarballToDirectory(tarball);
   try {
-    const skillMarkdown = await (0, import_promises9.readFile)(safeJoin(packageRoot, manifest.entry), "utf8");
+    const skillMarkdown = await (0, import_promises8.readFile)(safeJoin(packageRoot, manifest.entry), "utf8");
+    const supportingFiles = await collectSkillSupportingFiles(packageRoot, manifest);
     const result = await installSkillPackage({
       projectRoot: installRoot,
       manifest,
       skillMarkdown,
+      supportingFiles,
       preferredTools,
       explicitTarget
     });
@@ -8645,23 +8748,23 @@ async function installOnePackage(options) {
     console.log(`Installed ${options.name}@${options.version} \u2192 ${result.resolvedTools.join(", ")}`);
     printPostInstallNotice(options.name, postInstall);
   } finally {
-    await (0, import_promises9.rm)(packageRoot, { recursive: true, force: true });
+    await (0, import_promises8.rm)(packageRoot, { recursive: true, force: true });
   }
 }
 
 // src/doctor.ts
 var import_node_child_process3 = require("node:child_process");
-var import_promises10 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_promises9 = require("node:fs/promises");
+var import_node_path13 = require("node:path");
 var import_node_util4 = require("node:util");
 
 // src/project-root.ts
 var import_node_os3 = require("node:os");
-var import_node_path11 = require("node:path");
+var import_node_path12 = require("node:path");
 var import_node_process3 = require("node:process");
 function globalConfigDir(env2 = process.env) {
   const fromEnv = env2.AIPM_HOME?.trim();
-  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".aipm");
+  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path12.join)((0, import_node_os3.homedir)(), ".aipm");
 }
 function resolveConfigRoot(options = {}) {
   return options.global ? globalConfigDir() : (0, import_node_process3.cwd)();
@@ -8673,7 +8776,7 @@ function scopeLabel(options) {
   return options.global ? "global" : "project";
 }
 function initRequiredMessage(options) {
-  return options.global ? "Run aipm init -g first" : "Run aipm init first";
+  return options.global ? `Run ${recommendCmd("aipm init -g")} first` : `Run ${recommendCmd("aipm init")} first`;
 }
 
 // src/doctor.ts
@@ -8692,11 +8795,11 @@ async function commandOutput(command, args) {
 }
 function npmGlobalBin(prefix) {
   if (!prefix) return null;
-  return process.platform === "win32" ? prefix : `${prefix}${import_node_path12.sep}bin`;
+  return process.platform === "win32" ? prefix : `${prefix}${import_node_path13.sep}bin`;
 }
 function pathIncludes(pathDir) {
   if (!pathDir) return false;
-  return (process.env.PATH ?? "").split(import_node_path12.delimiter).includes(pathDir);
+  return (process.env.PATH ?? "").split(import_node_path13.delimiter).includes(pathDir);
 }
 function shellPathHint(binDir) {
   if (!binDir) return "Run npm prefix -g and add its bin folder to PATH.";
@@ -8749,11 +8852,11 @@ async function runDoctor(options) {
   if (!options.publish) {
     const configLabel = options.global ? "Global config" : "Project config";
     try {
-      await (0, import_promises10.access)((0, import_node_path12.join)(configRoot, "aipm.package.json"));
+      await (0, import_promises9.access)((0, import_node_path13.join)(configRoot, "aipm.package.json"));
       checks.push({
         name: configLabel,
         ok: true,
-        detail: `${(0, import_node_path12.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
+        detail: `${(0, import_node_path13.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
       });
     } catch {
       checks.push({
@@ -8783,7 +8886,7 @@ async function runDoctor(options) {
     checks.push({
       name: "Publish stage",
       ok: rows.length > 0 && changed.length === 0,
-      detail: rows.length === 0 ? "No files staged. Run aipm publish add ." : changed.length > 0 ? `${changed.length} staged file(s) changed after add. Run aipm publish add . again.` : `${rows.length} file(s) staged.`
+      detail: rows.length === 0 ? `No files staged. Run ${recommendCmd("aipm publish add .")}` : changed.length > 0 ? `${changed.length} staged file(s) changed after add. Run ${recommendCmd("aipm publish add .")} again.` : `${rows.length} file(s) staged.`
     });
   } catch (error) {
     checks.push({
@@ -8823,8 +8926,8 @@ async function runDoctor(options) {
 
 // src/prompt-install.ts
 var import_node_crypto2 = require("node:crypto");
-var import_promises11 = require("node:fs/promises");
-var import_node_path13 = require("node:path");
+var import_promises10 = require("node:fs/promises");
+var import_node_path14 = require("node:path");
 var PROMPT_SITE_ORIGIN = "https://www.aipm-registry.com";
 function parsePromptUrl(value) {
   let url;
@@ -8849,10 +8952,10 @@ function parsePromptUrl(value) {
   };
 }
 function promptDirectory(configRoot) {
-  return (0, import_node_path13.basename)(configRoot) === ".aipm" ? (0, import_node_path13.join)(configRoot, "prompts") : (0, import_node_path13.join)(configRoot, ".aipm", "prompts");
+  return (0, import_node_path14.basename)(configRoot) === ".aipm" ? (0, import_node_path14.join)(configRoot, "prompts") : (0, import_node_path14.join)(configRoot, ".aipm", "prompts");
 }
 function promptSnapshotPath(configRoot, reference) {
-  return (0, import_node_path13.join)(promptDirectory(configRoot), `${reference.publisher}--${reference.slug}.md`);
+  return (0, import_node_path14.join)(promptDirectory(configRoot), `${reference.publisher}--${reference.slug}.md`);
 }
 function canonicalPromptContent(prompt) {
   return JSON.stringify({
@@ -8911,7 +9014,7 @@ function emptyLock() {
   return { schemaVersion: "0.1", packages: {}, prompts: {} };
 }
 function installedRelativePath(configRoot, absolutePath) {
-  return (0, import_node_path13.relative)(configRoot, absolutePath).split("\\").join("/");
+  return (0, import_node_path14.relative)(configRoot, absolutePath).split("\\").join("/");
 }
 async function installTrackedPrompt(input2) {
   const prompt = await fetchPromptDetail(
@@ -8929,11 +9032,11 @@ async function installTrackedPrompt(input2) {
   const contentHash = promptContentHash(prompt);
   const lock = await readLockfile(input2.configRoot) ?? emptyLock();
   const existing = lock.prompts[input2.reference.alias];
-  const fileExists = Boolean(await (0, import_promises11.stat)(outputPath).catch(() => null));
+  const fileExists = Boolean(await (0, import_promises10.stat)(outputPath).catch(() => null));
   const changed = !existing || existing.contentHash !== contentHash || !fileExists;
   if (!input2.updateOnly || changed) {
-    await (0, import_promises11.mkdir)((0, import_node_path13.dirname)(outputPath), { recursive: true });
-    await (0, import_promises11.writeFile)(outputPath, renderPromptMarkdown(prompt, canonicalReference.url), "utf8");
+    await (0, import_promises10.mkdir)((0, import_node_path14.dirname)(outputPath), { recursive: true });
+    await (0, import_promises10.writeFile)(outputPath, renderPromptMarkdown(prompt, canonicalReference.url), "utf8");
   }
   if (input2.track) {
     const currentUrl = input2.project.prompts[input2.reference.alias];
@@ -8975,12 +9078,12 @@ function resolveTrackedPrompt(project, value) {
   return parsed ? { ...parsed, alias: value } : null;
 }
 async function readInstalledPrompt(configRoot, entry) {
-  return (0, import_promises11.readFile)((0, import_node_path13.join)(configRoot, entry.installedPath), "utf8");
+  return (0, import_promises10.readFile)((0, import_node_path14.join)(configRoot, entry.installedPath), "utf8");
 }
 async function removeTrackedPrompt(input2) {
   const lock = await readLockfile(input2.configRoot);
   const entry = lock?.prompts[input2.reference.alias];
-  if (entry) await (0, import_promises11.rm)((0, import_node_path13.join)(input2.configRoot, entry.installedPath), { force: true });
+  if (entry) await (0, import_promises10.rm)((0, import_node_path14.join)(input2.configRoot, entry.installedPath), { force: true });
   const prompts = { ...input2.project.prompts };
   delete prompts[input2.reference.alias];
   await writeProjectPackageJson(input2.configRoot, { ...input2.project, prompts });
@@ -8991,11 +9094,65 @@ async function removeTrackedPrompt(input2) {
   }
 }
 
+// src/remove-package.ts
+var import_promises11 = require("node:fs/promises");
+var import_node_path15 = require("node:path");
+function within(root, path2) {
+  const rel = (0, import_node_path15.relative)((0, import_node_path15.resolve)(root), (0, import_node_path15.resolve)(path2));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path15.isAbsolute)(rel);
+}
+function trackedInstalledPackagePaths(entry) {
+  return [
+    ...Object.values(entry.installed).flat(),
+    ...entry.installedAssets?.main ?? [],
+    ...entry.installedAssets?.helper ?? []
+  ];
+}
+async function pruneEmptyParents(path2, roots) {
+  let current = (0, import_node_path15.dirname)(path2);
+  while (roots.some((root) => within(root, current)) && !roots.some((root) => (0, import_node_path15.resolve)(root) === current)) {
+    try {
+      await (0, import_promises11.rmdir)(current);
+    } catch {
+      return;
+    }
+    current = (0, import_node_path15.dirname)(current);
+  }
+}
+async function removeInstalledPackageFiles(input2) {
+  const roots = [.../* @__PURE__ */ new Set([(0, import_node_path15.resolve)(input2.configRoot), (0, import_node_path15.resolve)(input2.installRoot)])];
+  const realRoots = await Promise.all(roots.map((root) => (0, import_promises11.realpath)(root).catch(() => root)));
+  const requestedPaths = [...new Set(trackedInstalledPackagePaths(input2.entry).map((path2) => (0, import_node_path15.resolve)(path2)))];
+  const protectedPaths = new Set(
+    (input2.otherEntries ?? []).flatMap(trackedInstalledPackagePaths).map((path2) => (0, import_node_path15.resolve)(path2))
+  );
+  const paths = requestedPaths.filter((path2) => !protectedPaths.has(path2));
+  const unsafe = paths.find((path2) => !roots.some((root) => within(root, path2)));
+  if (unsafe) throw new Error(`Refusing to remove an untrusted path from the lockfile: ${unsafe}`);
+  for (const path2 of paths) {
+    const stat5 = await (0, import_promises11.lstat)(path2).catch(() => null);
+    if (!stat5 || stat5.isSymbolicLink()) continue;
+    const canonicalPath = await (0, import_promises11.realpath)(path2);
+    if (!realRoots.some((root) => within(root, canonicalPath))) {
+      throw new Error(`Refusing to remove a path that resolves outside the install roots: ${path2}`);
+    }
+  }
+  let removed = 0;
+  for (const path2 of paths) {
+    if (await (0, import_promises11.lstat)(path2).catch(() => null)) removed += 1;
+    await (0, import_promises11.rm)(path2, { force: true });
+  }
+  for (const path2 of paths.sort((a, b) => b.length - a.length)) {
+    await pruneEmptyParents(path2, roots);
+  }
+  return { removed, retainedShared: requestedPaths.length - paths.length };
+}
+
 // src/version.ts
 var import_node_fs2 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_path16 = require("node:path");
 function getCliVersion() {
-  const pkgPath = (0, import_node_path14.join)(__dirname, "..", "package.json");
+  const pkgPath = (0, import_node_path16.join)(__dirname, "..", "package.json");
   const pkg = JSON.parse((0, import_node_fs2.readFileSync)(pkgPath, "utf8"));
   return pkg.version;
 }
@@ -9141,7 +9298,7 @@ async function writeStarterFile(path2, content) {
 }
 async function inferEntryFromSource(source, fallback) {
   const sourceInfo = await (0, import_promises12.stat)(source);
-  if (sourceInfo.isFile()) return (0, import_node_path15.basename)(source);
+  if (sourceInfo.isFile()) return (0, import_node_path17.basename)(source);
   if (!sourceInfo.isDirectory()) return fallback;
   const entries = await (0, import_promises12.readdir)(source);
   if (entries.includes(fallback)) return fallback;
@@ -9153,7 +9310,7 @@ async function copySourceIntoSkillRoot(source, root, sourceLabel) {
   if (sourceInfo.isDirectory()) {
     const entries = await (0, import_promises12.readdir)(source);
     for (const entry of entries) {
-      await (0, import_promises12.cp)((0, import_node_path15.join)(source, entry), (0, import_node_path15.join)(root, entry), {
+      await (0, import_promises12.cp)((0, import_node_path17.join)(source, entry), (0, import_node_path17.join)(root, entry), {
         recursive: true,
         force: false,
         errorOnExist: true
@@ -9162,7 +9319,7 @@ async function copySourceIntoSkillRoot(source, root, sourceLabel) {
     return;
   }
   if (sourceInfo.isFile()) {
-    await (0, import_promises12.cp)(source, (0, import_node_path15.join)(root, (0, import_node_path15.basename)(source)), { force: false, errorOnExist: true });
+    await (0, import_promises12.cp)(source, (0, import_node_path17.join)(root, (0, import_node_path17.basename)(source)), { force: false, errorOnExist: true });
     return;
   }
   throw new Error(`Unsupported source path: ${sourceLabel}`);
@@ -9196,11 +9353,11 @@ function packageDashboardUrl(name) {
   return `${DASHBOARD_URL}/packages/${name.replace(/^@/, "")}`;
 }
 function helperRootFromTrackedPath(path2) {
-  const parts = path2.split(import_node_path15.sep).filter(Boolean);
+  const parts = path2.split(import_node_path17.sep).filter(Boolean);
   const helpersIndex = parts.lastIndexOf("helpers");
   if (helpersIndex === -1 || parts.length <= helpersIndex + 2) return null;
-  const prefix = path2.startsWith(import_node_path15.sep) ? import_node_path15.sep : "";
-  return (0, import_node_path15.join)(prefix, ...parts.slice(0, helpersIndex + 3));
+  const prefix = path2.startsWith(import_node_path17.sep) ? import_node_path17.sep : "";
+  return (0, import_node_path17.join)(prefix, ...parts.slice(0, helpersIndex + 3));
 }
 async function showInstalledPrompt(configRoot, packageArg) {
   const { name } = parsePackageArg(packageArg);
@@ -9293,7 +9450,7 @@ async function authTokenForRegistry(registry, options = {}) {
     return refreshed.accessToken;
   } catch {
     await clearStoredRegistryAuth(registry);
-    const message = `CLI login for ${registry} expired or was revoked. Run aipm login to access private packages.`;
+    const message = `CLI login for ${registry} expired or was revoked. Run ${recommendCmd("aipm login")} to access private packages.`;
     if (options.throwOnFailure) throw new Error(message);
     if (!options.quiet) console.warn(`Warning: ${message}`);
     return void 0;
@@ -9542,9 +9699,9 @@ function buildStarterQualityMetadata(options) {
 }
 async function initSkill(opts) {
   if (!isValidScopeName(opts.name)) throw new Error("Invalid @scope/name");
-  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path15.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
+  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path17.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
   const cdTarget = opts.here ? null : opts.dir ?? skillFolderName(opts.name);
-  const source = opts.from ? (0, import_node_path15.resolve)(opts.from) : null;
+  const source = opts.from ? (0, import_node_path17.resolve)(opts.from) : null;
   const entry = source ? await inferEntryFromSource(source, opts.entry) : opts.entry;
   const template = parseSkillTemplate(opts.template ?? "blank");
   const manifest = PackageManifestSchema.parse({
@@ -9567,15 +9724,15 @@ async function initSkill(opts) {
   } else {
     await (0, import_promises12.mkdir)(root, { recursive: true });
   }
-  await writeStarterFile((0, import_node_path15.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+  await writeStarterFile((0, import_node_path17.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
   if (!opts.from) {
     await writeStarterFile(
-      (0, import_node_path15.join)(root, entry),
+      (0, import_node_path17.join)(root, entry),
       SKILL_TEMPLATES[template](opts.name)
     );
   }
   await writeStarterFile(
-    (0, import_node_path15.join)(root, ".aipmignore"),
+    (0, import_node_path17.join)(root, ".aipmignore"),
     [
       "# Files that should never be published with this skill",
       ".env*",
@@ -9593,7 +9750,7 @@ async function initSkill(opts) {
       ""
     ].join("\n")
   );
-  await (0, import_promises12.mkdir)((0, import_node_path15.join)(root, ".aipm"), { recursive: true });
+  await (0, import_promises12.mkdir)((0, import_node_path17.join)(root, ".aipm"), { recursive: true });
   console.log(`Created ${opts.name} skill folder: ${root}`);
   printPublishGuide(
     opts.from ? `Copied ${opts.from} into ${root} and created aipm.manifest.json, .aipmignore, and the local publish state folder.` : `Created ${root} with aipm.manifest.json, ${entry}, .aipmignore, and the local publish state folder.`,
@@ -9734,7 +9891,7 @@ program2.command("add <package-or-prompt>").description("Add a skill package or
   const { name, version: requestedVersion } = parsePackageArg(pkgArg);
   const token = await tokenForRead(registry, opts.token);
   const version = requestedVersion ?? project.packages[name] ?? await latestVersionForPackage(registry, name, token);
-  if (!version) throw new Error("Specify version: aipm add @scope/pkg@1.0.0");
+  if (!version) throw new Error(`Specify version: ${recommendCmd("aipm add <@scope/pkg>@<version>")}`);
   project = {
     ...project,
     packages: { ...project.packages, [name]: version.replace(/^\^/, "") }
@@ -9826,7 +9983,7 @@ program2.command("show <package-or-prompt>").description("Show an installed prom
   if (reference && project.prompts[reference.alias] === reference.url) {
     const lock2 = await readLockfile(configRoot);
     const entry2 = lock2?.prompts[reference.alias];
-    if (!entry2) throw new Error(`Prompt is not installed: ${reference.url}. Run aipm install.`);
+    if (!entry2) throw new Error(`Prompt is not installed: ${reference.url}. Run ${recommendCmd("aipm install")}.`);
     console.log(await readInstalledPrompt(configRoot, entry2));
     return;
   }
@@ -9840,7 +9997,7 @@ program2.command("show-prompt <package>").description("Show the manual setup pro
   await showInstalledPrompt(resolveConfigRoot({ global: opts.global }), pkgArg);
 });
 function promptImageContentType(path2) {
-  const extension = (0, import_node_path15.extname)(path2).toLowerCase();
+  const extension = (0, import_node_path17.extname)(path2).toLowerCase();
   if (extension === ".png") return "image/png";
   if (extension === ".jpg" || extension === ".jpeg") return "image/jpeg";
   if (extension === ".webp") return "image/webp";
@@ -9850,8 +10007,8 @@ var promptCommand = program2.command("prompt").description("Publish prompt listi
 promptCommand.command("publish <file>").description("Publish one prompt or a batch of prompts from JSON").option("--registry <url>", "Registry API base URL").option("--yes", "Confirm public publishing without an extra reminder").action(async (file, opts) => {
   const registry = registryFromEnvOrDefault(opts.registry);
   const accessToken = await authTokenForRegistry(registry, { throwOnFailure: true });
-  if (!accessToken) throw new Error("Run aipm login before publishing prompts.");
-  const absoluteFile = (0, import_node_path15.resolve)(file);
+  if (!accessToken) throw new Error(`Run ${recommendCmd("aipm login")} before publishing prompts.`);
+  const absoluteFile = (0, import_node_path17.resolve)(file);
   const parsed = JSON.parse(await (0, import_promises12.readFile)(absoluteFile, "utf8"));
   const rows = Array.isArray(parsed) ? parsed : "prompts" in parsed ? parsed.prompts : [parsed];
   if (rows.length === 0) throw new Error("Prompt publish file contains no prompts.");
@@ -9863,10 +10020,10 @@ promptCommand.command("publish <file>").description("Publish one prompt or a bat
     const { sampleImagePath, ...input2 } = row;
     let sampleImage;
     if (sampleImagePath) {
-      const imagePath = (0, import_node_path15.resolve)((0, import_node_path15.dirname)(absoluteFile), sampleImagePath);
+      const imagePath = (0, import_node_path17.resolve)((0, import_node_path17.dirname)(absoluteFile), sampleImagePath);
       sampleImage = {
         data: await (0, import_promises12.readFile)(imagePath),
-        filename: (0, import_node_path15.basename)(imagePath),
+        filename: (0, import_node_path17.basename)(imagePath),
         contentType: promptImageContentType(imagePath)
       };
     }
@@ -9889,8 +10046,8 @@ var publish = program2.command("publish [dir]").description("Stage, validate, an
     publish.help();
     return;
   }
-  const abs = (0, import_node_path15.resolve)(dir);
-  const manifestRaw = await (0, import_promises12.readFile)((0, import_node_path15.join)(abs, "aipm.manifest.json"), "utf8");
+  const abs = (0, import_node_path17.resolve)(dir);
+  const manifestRaw = await (0, import_promises12.readFile)((0, import_node_path17.join)(abs, "aipm.manifest.json"), "utf8");
   const manifest = PackageManifestSchema.parse(JSON.parse(manifestRaw));
   const tarball = await packDirectory(abs);
   const registry = registryFromEnvOrDefault(opts.registry);
@@ -10055,6 +10212,7 @@ program2.command("list").description("List installed skills and prompts from aip
 program2.command("remove <package-or-prompt>").alias("rm").description("Remove a tracked skill or prompt and its installed files").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
+  const installRoot = resolveInstallRoot(scope);
   const project = await readProjectPackageJson(configRoot);
   if (!project) throw new Error(initRequiredMessage(scope));
   const promptReference = resolveTrackedPrompt(project, pkgArg);
@@ -10064,17 +10222,30 @@ program2.command("remove <package-or-prompt>").alias("rm").description("Remove a
     return;
   }
   const { name } = parsePackageArg(pkgArg);
+  const lock = await readLockfile(configRoot);
+  const lockEntry = lock?.packages[name];
+  if (lockEntry) {
+    const otherEntries = Object.entries(lock.packages).filter(([packageName]) => packageName !== name).map(([, entry]) => entry);
+    const removal = await removeInstalledPackageFiles({
+      configRoot,
+      installRoot,
+      entry: lockEntry,
+      otherEntries
+    });
+    console.log(`Deleted ${removal.removed} tracked installed ${removal.removed === 1 ? "file" : "files"}.`);
+    if (removal.retainedShared > 0) {
+      console.log(`Retained ${removal.retainedShared} ${removal.retainedShared === 1 ? "file" : "files"} shared with another installed package.`);
+    }
+  }
   const packages = { ...project.packages };
   delete packages[name];
   await writeProjectPackageJson(configRoot, { ...project, packages });
-  const lock = await readLockfile(configRoot);
   if (lock) {
     const lockPackages = { ...lock.packages };
     delete lockPackages[name];
     await writeLockfile(configRoot, { ...lock, packages: lockPackages });
   }
   console.log(`Removed ${name} from AIPM ${scopeLabel(scope)} files.`);
-  console.log("Adapter-written files are not deleted yet; review your project before committing.");
 });
 program2.command("update [package]").description("Update one installed package, or all installed packages, to the latest registry version").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").action(async (pkgArg, opts) => {
   const scope = { global: opts.global };