@aipm-registry/cli 0.4.1 → 0.4.8

package/dist/bin.cjs

@@ -6,8 +6,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -3837,7 +3842,7 @@ var init_types = __esm({
         ...processCreateParams(params)
       });
     };
-    BRAND = Symbol("zod_brand");
+    BRAND = /* @__PURE__ */ Symbol("zod_brand");
     ZodBranded = class extends ZodType {
       _parse(input2) {
         const { ctx } = this._processInputParams(input2);
@@ -4011,14 +4016,14 @@ var init_types = __esm({
     onumber = () => numberType().optional();
     oboolean = () => booleanType().optional();
     coerce = {
-      string: (arg) => ZodString.create({ ...arg, coerce: true }),
-      number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
-      boolean: (arg) => ZodBoolean.create({
+      string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+      number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+      boolean: ((arg) => ZodBoolean.create({
         ...arg,
         coerce: true
-      }),
-      bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
-      date: (arg) => ZodDate.create({ ...arg, coerce: true })
+      })),
+      bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+      date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
     };
     NEVER = INVALID;
   }
@@ -4314,7 +4319,7 @@ var init_dist = __esm({
 // ../../packages/engine/dist/detect-tools.js
 async function pathExists(path2) {
   try {
-    await (0, import_promises.access)(path2);
+    await (0, import_promises4.access)(path2);
     return true;
   } catch {
     return false;
@@ -4322,11 +4327,11 @@ async function pathExists(path2) {
 }
 async function detectToolsInProject(projectRoot) {
   const detected = [];
-  if (await pathExists((0, import_node_path2.join)(projectRoot, ".cursor")))
+  if (await pathExists((0, import_node_path5.join)(projectRoot, ".cursor")))
     detected.push("cursor");
-  if (await pathExists((0, import_node_path2.join)(projectRoot, ".claude")))
+  if (await pathExists((0, import_node_path5.join)(projectRoot, ".claude")))
     detected.push("claude");
-  if (await pathExists((0, import_node_path2.join)(projectRoot, ".codex")))
+  if (await pathExists((0, import_node_path5.join)(projectRoot, ".codex")))
     detected.push("codex");
   return detected;
 }
@@ -4337,7 +4342,6 @@ function manifestAllowsTool(manifest, tool) {
 }
 async function resolveInstallTools(options) {
   const { manifest } = options;
-  const expandedAllowed = expandTargets(manifest.targets);
   if (options.explicitTarget) {
     if (options.explicitTarget === "*") {
       return [...ALL_TOOLS];
@@ -4358,37 +4362,69 @@ async function resolveInstallTools(options) {
   const preferred = expandTargets(options.preferredTools ?? []).filter((t) => manifestAllowsTool(manifest, t));
   if (preferred.length > 0)
     return preferred;
-  if (manifest.targets.includes("*"))
-    return expandedAllowed;
   return [];
 }
-var import_promises, import_node_path2;
+var import_promises4, import_node_path5;
 var init_detect_tools = __esm({
   "../../packages/engine/dist/detect-tools.js"() {
     "use strict";
-    import_promises = require("node:fs/promises");
-    import_node_path2 = require("node:path");
+    import_promises4 = require("node:fs/promises");
+    import_node_path5 = require("node:path");
     init_dist();
   }
 });
 
-// ../../packages/adapter-claude/dist/index.js
-var import_promises2, import_node_path3, ClaudeSkillAdapter, claudeSkillAdapter;
+// ../../packages/adapter-sdk/dist/index.js
+async function writeSkillDirectory(skillDir, input2) {
+  const entryPath = (0, import_node_path6.join)(skillDir, "SKILL.md");
+  const seen = /* @__PURE__ */ new Set(["skill.md"]);
+  const files = (input2.supportingFiles ?? []).map((file) => {
+    const normalized = (0, import_node_path6.normalize)(file.path);
+    const target = (0, import_node_path6.resolve)(skillDir, normalized);
+    const fromSkillDir = (0, import_node_path6.relative)(skillDir, target);
+    return { file, normalized, target, fromSkillDir, key: fromSkillDir.toLowerCase() };
+  });
+  for (const { file, normalized, fromSkillDir, key } of files) {
+    if (!normalized || normalized === "." || (0, import_node_path6.isAbsolute)(normalized) || fromSkillDir === ".." || fromSkillDir.startsWith(`..${import_node_path6.sep}`) || (0, import_node_path6.isAbsolute)(fromSkillDir) || seen.has(key)) {
+      throw new Error(`Unsafe or duplicate skill supporting file path: ${file.path}`);
+    }
+    seen.add(key);
+  }
+  await (0, import_promises5.mkdir)(skillDir, { recursive: true });
+  await (0, import_promises5.writeFile)(entryPath, input2.skillMarkdown, "utf8");
+  const writtenPaths = [entryPath];
+  for (const { file, target } of files) {
+    await (0, import_promises5.mkdir)((0, import_node_path6.dirname)(target), { recursive: true });
+    await (0, import_promises5.writeFile)(target, file.content);
+    if (file.mode !== void 0)
+      await (0, import_promises5.chmod)(target, file.mode & 511);
+    writtenPaths.push(target);
+  }
+  return { writtenPaths };
+}
+var import_promises5, import_node_path6;
 var init_dist2 = __esm({
+  "../../packages/adapter-sdk/dist/index.js"() {
+    "use strict";
+    import_promises5 = require("node:fs/promises");
+    import_node_path6 = require("node:path");
+  }
+});
+
+// ../../packages/adapter-claude/dist/index.js
+var import_node_path7, ClaudeSkillAdapter, claudeSkillAdapter;
+var init_dist3 = __esm({
   "../../packages/adapter-claude/dist/index.js"() {
     "use strict";
-    import_promises2 = require("node:fs/promises");
-    import_node_path3 = require("node:path");
+    import_node_path7 = require("node:path");
+    init_dist2();
     init_dist();
     ClaudeSkillAdapter = class {
       tool = "claude";
       async installSkill(input2) {
         const short = shortNameFromScopeName(input2.packageName);
-        const skillDir = (0, import_node_path3.join)(input2.projectRoot, ".claude", "aipm", "skills", short);
-        await (0, import_promises2.mkdir)(skillDir, { recursive: true });
-        const filePath = (0, import_node_path3.join)(skillDir, "SKILL.md");
-        await (0, import_promises2.writeFile)(filePath, input2.skillMarkdown, "utf8");
-        return { writtenPaths: [filePath] };
+        const skillDir = (0, import_node_path7.join)(input2.projectRoot, ".claude", "skills", short);
+        return writeSkillDirectory(skillDir, input2);
       }
     };
     claudeSkillAdapter = new ClaudeSkillAdapter();
@@ -4396,21 +4432,21 @@ var init_dist2 = __esm({
 });
 
 // ../../packages/adapter-cursor/dist/index.js
-var import_promises3, import_node_path4, CursorSkillAdapter, cursorSkillAdapter;
-var init_dist3 = __esm({
+var import_promises6, import_node_path8, CursorSkillAdapter, cursorSkillAdapter;
+var init_dist4 = __esm({
   "../../packages/adapter-cursor/dist/index.js"() {
     "use strict";
-    import_promises3 = require("node:fs/promises");
-    import_node_path4 = require("node:path");
+    import_promises6 = require("node:fs/promises");
+    import_node_path8 = require("node:path");
     init_dist();
     CursorSkillAdapter = class {
       tool = "cursor";
       async installSkill(input2) {
         const short = shortNameFromScopeName(input2.packageName);
-        const skillsDir = (0, import_node_path4.join)(input2.projectRoot, ".cursor", "aipm", "skills");
-        await (0, import_promises3.mkdir)(skillsDir, { recursive: true });
-        const filePath = (0, import_node_path4.join)(skillsDir, `${short}.md`);
-        await (0, import_promises3.writeFile)(filePath, input2.skillMarkdown, "utf8");
+        const skillsDir = (0, import_node_path8.join)(input2.projectRoot, ".cursor", "aipm", "skills");
+        await (0, import_promises6.mkdir)(skillsDir, { recursive: true });
+        const filePath = (0, import_node_path8.join)(skillsDir, `${short}.md`);
+        await (0, import_promises6.writeFile)(filePath, input2.skillMarkdown, "utf8");
         return { writtenPaths: [filePath] };
       }
     };
@@ -4419,22 +4455,19 @@ var init_dist3 = __esm({
 });
 
 // ../../packages/adapter-codex/dist/index.js
-var import_promises4, import_node_path5, CodexSkillAdapter, codexSkillAdapter;
-var init_dist4 = __esm({
+var import_node_path9, CodexSkillAdapter, codexSkillAdapter;
+var init_dist5 = __esm({
   "../../packages/adapter-codex/dist/index.js"() {
     "use strict";
-    import_promises4 = require("node:fs/promises");
-    import_node_path5 = require("node:path");
+    import_node_path9 = require("node:path");
+    init_dist2();
     init_dist();
     CodexSkillAdapter = class {
       tool = "codex";
       async installSkill(input2) {
         const short = shortNameFromScopeName(input2.packageName);
-        const skillDir = (0, import_node_path5.join)(input2.projectRoot, ".agents", "skills", short);
-        await (0, import_promises4.mkdir)(skillDir, { recursive: true });
-        const filePath = (0, import_node_path5.join)(skillDir, "SKILL.md");
-        await (0, import_promises4.writeFile)(filePath, input2.skillMarkdown, "utf8");
-        return { writtenPaths: [filePath] };
+        const skillDir = (0, import_node_path9.join)(input2.projectRoot, ".agents", "skills", short);
+        return writeSkillDirectory(skillDir, input2);
       }
     };
     codexSkillAdapter = new CodexSkillAdapter();
@@ -4459,6 +4492,7 @@ async function installSkillPackage(options) {
       packageName: options.manifest.name,
       version: options.manifest.version,
       skillMarkdown: options.skillMarkdown,
+      supportingFiles: options.supportingFiles,
       projectRoot: options.projectRoot
     });
     installed[tool] = result.writtenPaths;
@@ -4469,9 +4503,9 @@ var adapters;
 var init_install_skill = __esm({
   "../../packages/engine/dist/install-skill.js"() {
     "use strict";
-    init_dist2();
     init_dist3();
     init_dist4();
+    init_dist5();
     init_detect_tools();
     adapters = {
       cursor: cursorSkillAdapter,
@@ -4488,7 +4522,7 @@ __export(dist_exports, {
   installSkillPackage: () => installSkillPackage,
   resolveInstallTools: () => resolveInstallTools
 });
-var init_dist5 = __esm({
+var init_dist6 = __esm({
   "../../packages/engine/dist/index.js"() {
     "use strict";
     init_detect_tools();
@@ -7868,25 +7902,107 @@ var program = new Command();
 var import_node_crypto3 = require("node:crypto");
 var import_node_child_process4 = require("node:child_process");
 var import_node_http = require("node:http");
-var import_promises12 = require("node:fs/promises");
-var import_node_path15 = require("node:path");
-var import_node_process5 = require("node:process");
+var import_promises14 = require("node:fs/promises");
+var import_node_path18 = require("node:path");
+var import_node_process6 = require("node:process");
 init_dist();
-init_dist5();
 
 // src/pack.ts
 var import_node_child_process2 = require("node:child_process");
 var import_node_util3 = require("node:util");
-var import_promises6 = require("node:fs/promises");
-var import_node_path7 = require("node:path");
+var import_promises2 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
 var import_node_os = require("node:os");
 
 // src/publish-state.ts
 var import_node_crypto = require("node:crypto");
-var import_promises5 = require("node:fs/promises");
-var import_node_path6 = require("node:path");
+var import_promises = require("node:fs/promises");
+var import_node_path2 = require("node:path");
 init_dist();
-var STATE_PATH = (0, import_node_path6.join)(".aipm", "publish-state.json");
+
+// src/ui/theme.ts
+var brand = {
+  /** Primary accent — dark-mode site --accent / close to logo mint */
+  accent: { r: 72, g: 185, b: 141 },
+  // #48b98d
+  /** Stronger / hover — dark --accent-strong */
+  accentStrong: { r: 123, g: 217, b: 173 },
+  // #7bd9ad
+  /** Logo mint (slightly brighter) */
+  mint: { r: 79, g: 196, b: 154 },
+  // #4FC49A
+  /** On-accent text (dark green-black) */
+  onAccent: { r: 7, g: 17, b: 13 },
+  // #07110d
+  /** Muted secondary text */
+  muted: { r: 157, g: 175, b: 170 },
+  // #9dafaa
+  /** Warning */
+  warning: { r: 245, g: 165, b: 36 },
+  // #f5a524
+  /** Danger */
+  danger: { r: 249, g: 112, b: 102 }
+  // #f97066
+};
+function fgTruecolor({ r, g, b }) {
+  return `\x1B[38;2;${r};${g};${b}m`;
+}
+function bgTruecolor({ r, g, b }) {
+  return `\x1B[48;2;${r};${g};${b}m`;
+}
+function envValue(env2, key) {
+  return env2[key];
+}
+function supportsColor(stream, env2 = process.env) {
+  const noColor = envValue(env2, "NO_COLOR");
+  if (noColor != null && noColor !== "") return false;
+  const force = envValue(env2, "FORCE_COLOR");
+  if (force === "0") return false;
+  if (force != null && force !== "") return true;
+  return Boolean(stream.isTTY);
+}
+function supportsTruecolor(stream, env2 = process.env) {
+  if (!supportsColor(stream, env2)) return false;
+  const force = envValue(env2, "FORCE_COLOR");
+  if (force === "3") return true;
+  const colorterm = (envValue(env2, "COLORTERM") ?? "").toLowerCase();
+  if (colorterm.includes("truecolor") || colorterm.includes("24bit")) return true;
+  return Boolean(stream.isTTY);
+}
+function createTheme(stream, env2 = process.env) {
+  const color = supportsColor(stream, env2);
+  const truecolor = supportsTruecolor(stream, env2);
+  const accentFg = !color ? "" : truecolor ? fgTruecolor(brand.accent) : "\x1B[32m";
+  const accentStrongFg = !color ? "" : truecolor ? fgTruecolor(brand.accentStrong) : "\x1B[32m";
+  const mutedFg = !color ? "" : truecolor ? fgTruecolor(brand.muted) : "\x1B[2m";
+  const onAccentFg = !color ? "" : truecolor ? fgTruecolor(brand.onAccent) : "\x1B[30m";
+  const accentBg = !color ? "" : truecolor ? bgTruecolor(brand.accent) : "\x1B[42m";
+  return {
+    color,
+    truecolor,
+    reset: color ? "\x1B[0m" : "",
+    bold: color ? "\x1B[1m" : "",
+    dim: color ? "\x1B[2m" : "",
+    accent: accentFg,
+    accentStrong: accentStrongFg,
+    muted: mutedFg,
+    /** Selected row: mint background + dark text (site on-accent). */
+    highlight: color ? `${accentBg}${onAccentFg}\x1B[1m` : "",
+    warning: color ? truecolor ? fgTruecolor(brand.warning) : "\x1B[33m" : "",
+    danger: color ? truecolor ? fgTruecolor(brand.danger) : "\x1B[31m" : ""
+  };
+}
+
+// src/recommend-cmd.ts
+function recommendCmd(command, stream = process.stderr, env2) {
+  const quoted = `"${command}"`;
+  const theme = createTheme(stream, env2);
+  if (!theme.color) return quoted;
+  return `${theme.accent}${quoted}${theme.reset}`;
+}
+
+// src/publish-state.ts
+var STATE_PATH = (0, import_node_path2.join)(".aipm", "publish-state.json");
 var IGNORE_FILE = ".aipmignore";
 var MAX_PACKAGE_BYTES = 50 * 1024 * 1024;
 var EXCLUDED_SEGMENTS = /* @__PURE__ */ new Set([".aipm", ".git", "node_modules", "dist", ".next"]);
@@ -7901,11 +8017,11 @@ var SECRET_PATTERNS = [
   /<publishData/i
 ];
 function publishStatePath(root) {
-  return (0, import_node_path6.join)(root, STATE_PATH);
+  return (0, import_node_path2.join)(root, STATE_PATH);
 }
 function normalizePublishPath(root, filePath) {
-  const abs = (0, import_node_path6.resolve)(root, filePath);
-  const rel = (0, import_node_path6.normalize)((0, import_node_path6.relative)(root, abs)).split(import_node_path6.sep).join("/");
+  const abs = (0, import_node_path2.resolve)(root, filePath);
+  const rel = (0, import_node_path2.normalize)((0, import_node_path2.relative)(root, abs)).split(import_node_path2.sep).join("/");
   if (!rel || rel === ".") return ".";
   if (rel.startsWith("../") || rel === ".." || rel.startsWith("/")) {
     throw new Error(`Path is outside the skill folder: ${filePath}`);
@@ -7922,7 +8038,7 @@ function isExcludedPublishPath(rel) {
 }
 async function readAipmIgnore(root) {
   try {
-    const raw = await (0, import_promises5.readFile)((0, import_node_path6.join)(root, IGNORE_FILE), "utf8");
+    const raw = await (0, import_promises.readFile)((0, import_node_path2.join)(root, IGNORE_FILE), "utf8");
     return raw.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   } catch {
     return [];
@@ -7943,7 +8059,7 @@ async function isIgnoredByAipmIgnore(root, rel) {
   return rules.some((rule) => matchesIgnoreRule(rel, rule));
 }
 async function assertNoObviousSecrets(path2, rel) {
-  const data = await (0, import_promises5.readFile)(path2);
+  const data = await (0, import_promises.readFile)(path2);
   if (data.includes(0)) return;
   const text = data.toString("utf8");
   if (SECRET_PATTERNS.some((pattern) => pattern.test(text))) {
@@ -7951,7 +8067,7 @@ async function assertNoObviousSecrets(path2, rel) {
   }
 }
 async function fileHash(path2) {
-  const data = await (0, import_promises5.readFile)(path2);
+  const data = await (0, import_promises.readFile)(path2);
   return {
     hash: (0, import_node_crypto.createHash)("sha256").update(data).digest("hex"),
     size: data.length
@@ -7959,7 +8075,7 @@ async function fileHash(path2) {
 }
 async function readPublishState(root) {
   try {
-    const raw = await (0, import_promises5.readFile)(publishStatePath(root), "utf8");
+    const raw = await (0, import_promises.readFile)(publishStatePath(root), "utf8");
     const parsed = JSON.parse(raw);
     return {
       schemaVersion: "0.1",
@@ -7971,18 +8087,18 @@ async function readPublishState(root) {
 }
 async function writePublishState(root, state) {
   const path2 = publishStatePath(root);
-  await (0, import_promises5.mkdir)((0, import_node_path6.dirname)(path2), { recursive: true });
+  await (0, import_promises.mkdir)((0, import_node_path2.dirname)(path2), { recursive: true });
   const files = [...state.files].sort((a, b) => a.path.localeCompare(b.path));
-  await (0, import_promises5.writeFile)(path2, JSON.stringify({ schemaVersion: "0.1", files }, null, 2) + "\n", "utf8");
+  await (0, import_promises.writeFile)(path2, JSON.stringify({ schemaVersion: "0.1", files }, null, 2) + "\n", "utf8");
 }
 async function expandPublishPath(root, rel) {
   if (isExcludedPublishPath(rel)) return [];
   if (await isIgnoredByAipmIgnore(root, rel)) return [];
-  const abs = (0, import_node_path6.join)(root, rel);
-  const info = await (0, import_promises5.stat)(abs);
+  const abs = (0, import_node_path2.join)(root, rel);
+  const info = await (0, import_promises.stat)(abs);
   if (info.isFile()) return [rel];
   if (!info.isDirectory()) return [];
-  const entries = await (0, import_promises5.readdir)(abs);
+  const entries = await (0, import_promises.readdir)(abs);
   const nested = await Promise.all(
     entries.map((entry) => expandPublishPath(root, `${rel === "." ? "" : `${rel}/`}${entry}`))
   );
@@ -7998,7 +8114,7 @@ async function addPublishFiles(root, paths) {
     for (const rel of files) {
       if (isExcludedPublishPath(rel)) continue;
       if (await isIgnoredByAipmIgnore(root, rel)) continue;
-      const hashed = await fileHash((0, import_node_path6.join)(root, rel));
+      const hashed = await fileHash((0, import_node_path2.join)(root, rel));
       byPath.set(rel, { path: rel, ...hashed });
     }
   }
@@ -8017,15 +8133,17 @@ async function removePublishFiles(root, paths) {
   return next;
 }
 async function resetPublishState(root) {
-  await (0, import_promises5.rm)(publishStatePath(root), { force: true });
+  await (0, import_promises.rm)(publishStatePath(root), { force: true });
 }
 async function readManifest(root) {
   try {
-    const raw = await (0, import_promises5.readFile)((0, import_node_path6.join)(root, "aipm.manifest.json"), "utf8");
+    const raw = await (0, import_promises.readFile)((0, import_node_path2.join)(root, "aipm.manifest.json"), "utf8");
     return PackageManifestSchema.parse(JSON.parse(raw));
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
-      throw new Error("No aipm.manifest.json found. Run aipm publish init --name @org/skill.");
+      throw new Error(
+        `No aipm.manifest.json found. Run ${recommendCmd("aipm publish init --name <@org/skill>")}.`
+      );
     }
     throw error;
   }
@@ -8041,7 +8159,9 @@ function installReferencedFiles(manifest) {
 async function validatePublishState(root) {
   const manifest = await readManifest(root);
   const state = await readPublishState(root);
-  if (state.files.length === 0) throw new Error("No files staged. Run aipm publish add <files...>.");
+  if (state.files.length === 0) {
+    throw new Error(`No files staged. Run ${recommendCmd("aipm publish add <files...>")}.`);
+  }
   const staged = new Set(state.files.map((entry) => entry.path));
   if (!staged.has("aipm.manifest.json")) throw new Error("aipm.manifest.json must be staged.");
   if (!staged.has(manifest.entry)) throw new Error(`Manifest entry must be staged: ${manifest.entry}`);
@@ -8054,12 +8174,14 @@ async function validatePublishState(root) {
     if (await isIgnoredByAipmIgnore(root, entry.path)) {
       throw new Error(`Refusing to publish ignored path: ${entry.path}`);
     }
-    const abs = (0, import_node_path6.join)(root, entry.path);
-    const info = await (0, import_promises5.stat)(abs).catch(() => null);
+    const abs = (0, import_node_path2.join)(root, entry.path);
+    const info = await (0, import_promises.stat)(abs).catch(() => null);
     if (!info?.isFile()) throw new Error(`Staged file is missing: ${entry.path}`);
     const hashed = await fileHash(abs);
     if (hashed.hash !== entry.hash) {
-      throw new Error(`Staged file changed after add: ${entry.path}. Run aipm publish add ${entry.path}`);
+      throw new Error(
+        `Staged file changed after add: ${entry.path}. Run ${recommendCmd(`aipm publish add ${entry.path}`)}.`
+      );
     }
     await assertNoObviousSecrets(abs, entry.path);
     size += hashed.size;
@@ -8071,7 +8193,7 @@ async function statusPublishState(root) {
   const state = await readPublishState(root);
   const rows = [];
   for (const entry of state.files) {
-    const current = await fileHash((0, import_node_path6.join)(root, entry.path)).catch(() => null);
+    const current = await fileHash((0, import_node_path2.join)(root, entry.path)).catch(() => null);
     rows.push({ ...entry, changed: !current || current.hash !== entry.hash });
   }
   return rows;
@@ -8079,9 +8201,9 @@ async function statusPublishState(root) {
 async function copyStagedFiles(root, destination) {
   const state = await readPublishState(root);
   for (const entry of state.files) {
-    const target = (0, import_node_path6.join)(destination, entry.path);
-    await (0, import_promises5.mkdir)((0, import_node_path6.dirname)(target), { recursive: true });
-    await (0, import_promises5.cp)((0, import_node_path6.join)(root, entry.path), target);
+    const target = (0, import_node_path2.join)(destination, entry.path);
+    await (0, import_promises.mkdir)((0, import_node_path2.dirname)(target), { recursive: true });
+    await (0, import_promises.cp)((0, import_node_path2.join)(root, entry.path), target);
   }
 }
 
@@ -8095,21 +8217,21 @@ async function packDirectory(dir) {
   return Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout);
 }
 async function packStagedFiles(root) {
-  const tempDir = await (0, import_promises6.mkdtemp)((0, import_node_path7.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
+  const tempDir = await (0, import_promises2.mkdtemp)((0, import_node_path3.join)((0, import_node_os.tmpdir)(), "aipm-publish-stage-"));
   try {
     await copyStagedFiles(root, tempDir);
     return await packDirectory(tempDir);
   } finally {
-    await (0, import_promises6.rm)(tempDir, { recursive: true, force: true });
+    await (0, import_promises2.rm)(tempDir, { recursive: true, force: true });
   }
 }
 async function unpackTarballToDirectory(tarball) {
-  const { mkdtemp: mkdtemp2, writeFile: writeFile9 } = await import("node:fs/promises");
-  const { join: join15 } = await import("node:path");
+  const { mkdtemp: mkdtemp2, writeFile: writeFile8 } = await import("node:fs/promises");
+  const { join: join17 } = await import("node:path");
   const { tmpdir: tmpdir2 } = await import("node:os");
-  const tempDir = await mkdtemp2(join15(tmpdir2(), "aipm-install-"));
-  const tgzPath = join15(tempDir, "pkg.tgz");
-  await writeFile9(tgzPath, tarball);
+  const tempDir = await mkdtemp2(join17(tmpdir2(), "aipm-install-"));
+  const tgzPath = join17(tempDir, "pkg.tgz");
+  await writeFile8(tgzPath, tarball);
   await execFileAsync("tar", ["-xzf", tgzPath, "-C", tempDir]);
   return tempDir;
 }
@@ -8122,7 +8244,7 @@ function registryFetchError(registry, cause) {
   const msg = cause instanceof Error ? cause.message : String(cause);
   if (msg === "fetch failed" || msg.includes("ECONNREFUSED") || msg.includes("ENOTFOUND") || msg.includes("timed out") || msg.includes("aborted")) {
     return new Error(
-      `Cannot reach registry at ${registry}. Check your connection or pass --registry <url>.`
+      `Cannot reach registry at ${registry}. Check your connection or pass ${recommendCmd("--registry <url>")}.`
     );
   }
   return new Error(`Registry request failed (${registry}): ${msg}`);
@@ -8143,13 +8265,13 @@ function privateInstallHint(name, status, token) {
   if (status !== 404 || !name.startsWith("@") || token) {
     return `Package not found: ${name} (${status})`;
   }
-  return `Package not found: ${name} (${status}). If @org/pkg is private, run aipm login, or set AIPM_TOKEN for CI.`;
+  return `Package not found: ${name} (${status}). If @org/pkg is private, run ${recommendCmd("aipm login")}, or set AIPM_TOKEN for CI.`;
 }
 function publishTokenHint(name, error) {
   if (error === "Publish token required") {
     return [
       `Publish token required for ${name}.`,
-      `Generate a fresh 5-minute publish token for ${name} from the package dashboard, then retry with AIPM_TOKEN=<token> aipm publish push --yes.`
+      `Generate a fresh 5-minute publish token for ${name} from the package dashboard, then retry with ${recommendCmd("AIPM_TOKEN=<token> aipm publish push --yes")}.`
     ].join(" ");
   }
   if (error === "Invalid publish token") {
@@ -8170,7 +8292,7 @@ async function assertRegistryReachable(registry) {
 }
 async function publishPackage(registry, name, tarball, token) {
   const base = registry.replace(/\/$/, "");
-  const url = `${base}/v1/packages/${encodePackageName(name)}/versions`;
+  const url = `${base}/v1/skills/${encodePackageName(name)}/versions`;
   const form = new FormData();
   form.append("tarball", new Blob([tarball]), "package.tgz");
   const headers = token ? { Authorization: `Bearer ${token}` } : void 0;
@@ -8187,12 +8309,12 @@ async function searchPackages(registry, query, limit = 20, token) {
   if (query) params.set("q", query);
   params.set("limit", String(limit));
   if (token) params.set("includePrivate", "true");
-  const res = await registryFetch(`${base}/v1/packages?${params}`, base, {
+  const res = await registryFetch(`${base}/v1/skills?${params}`, base, {
     headers: registryAuthHeaders(token)
   });
   if (!res.ok) throw new Error(`Search failed: ${res.status}`);
   const data = await res.json();
-  return data.packages ?? [];
+  return data.skills ?? data.packages ?? [];
 }
 async function exchangeCliAuthCode(registry, input2) {
   const base = registry.replace(/\/$/, "");
@@ -8241,7 +8363,7 @@ async function logoutCliAuth(registry, refreshToken) {
 }
 async function fetchPackageMetadata(registry, name, version, token) {
   const base = registry.replace(/\/$/, "");
-  const url = `${base}/v1/packages/${encodePackageName(name)}/versions/${version}`;
+  const url = `${base}/v1/skills/${encodePackageName(name)}/versions/${version}`;
   const res = await registryFetch(url, base, { headers: registryAuthHeaders(token) });
   if (!res.ok) throw new Error(privateInstallHint(`${name}@${version}`, res.status, token));
   const data = await res.json();
@@ -8249,7 +8371,7 @@ async function fetchPackageMetadata(registry, name, version, token) {
 }
 async function fetchPackageTarball(registry, name, version, token) {
   const base = registry.replace(/\/$/, "");
-  const url = `${base}/v1/packages/${encodePackageName(name)}/versions/${version}/tarball`;
+  const url = `${base}/v1/skills/${encodePackageName(name)}/versions/${version}/tarball`;
   const res = await registryFetch(url, base, { headers: registryAuthHeaders(token) });
   if (!res.ok) throw new Error(privateInstallHint(`${name}@${version}`, res.status, token));
   const ab = await res.arrayBuffer();
@@ -8257,7 +8379,7 @@ async function fetchPackageTarball(registry, name, version, token) {
 }
 async function recordPackageInstall(registry, name, token) {
   const base = registry.replace(/\/$/, "");
-  const url = `${base}/v1/packages/${encodePackageName(name)}/installs`;
+  const url = `${base}/v1/skills/${encodePackageName(name)}/installs`;
   const res = await registryFetch(url, base, {
     method: "POST",
     headers: registryAuthHeaders(token)
@@ -8305,16 +8427,16 @@ async function publishPrompt(registry, input2, accessToken, sampleImage) {
 }
 
 // src/auth-store.ts
-var import_promises7 = require("node:fs/promises");
+var import_promises3 = require("node:fs/promises");
 var import_node_os2 = require("node:os");
-var import_node_path8 = require("node:path");
-var AUTH_FILE = (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
+var import_node_path4 = require("node:path");
+var AUTH_FILE = (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".aipm", "auth.json");
 function normalizeRegistry(registry) {
   return registry.replace(/\/$/, "");
 }
 async function readAuthStore() {
   try {
-    const raw = await (0, import_promises7.readFile)(AUTH_FILE, "utf8");
+    const raw = await (0, import_promises3.readFile)(AUTH_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return { registries: parsed.registries ?? {} };
   } catch {
@@ -8322,9 +8444,9 @@ async function readAuthStore() {
   }
 }
 async function writeAuthStore(store) {
-  await (0, import_promises7.mkdir)((0, import_node_path8.dirname)(AUTH_FILE), { recursive: true });
-  await (0, import_promises7.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
-  await (0, import_promises7.chmod)(AUTH_FILE, 384).catch(() => void 0);
+  await (0, import_promises3.mkdir)((0, import_node_path4.dirname)(AUTH_FILE), { recursive: true });
+  await (0, import_promises3.writeFile)(AUTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf8");
+  await (0, import_promises3.chmod)(AUTH_FILE, 384).catch(() => void 0);
 }
 async function getStoredRegistryAuth(registry) {
   const store = await readAuthStore();
@@ -8353,41 +8475,41 @@ function isAccessTokenFresh(auth, skewMs = 6e4) {
 }
 
 // src/install-one.ts
-init_dist5();
-var import_promises9 = require("node:fs/promises");
-var import_node_path10 = require("node:path");
+init_dist6();
+var import_promises8 = require("node:fs/promises");
+var import_node_path11 = require("node:path");
 
 // src/project-files.ts
-var import_promises8 = require("node:fs/promises");
-var import_node_path9 = require("node:path");
+var import_promises7 = require("node:fs/promises");
+var import_node_path10 = require("node:path");
 init_dist();
 var PACKAGE_JSON = "aipm.package.json";
 var LOCKFILE = "aipm-lock.json";
 async function readProjectPackageJson(projectRoot) {
   try {
-    const raw = await (0, import_promises8.readFile)((0, import_node_path9.join)(projectRoot, PACKAGE_JSON), "utf8");
+    const raw = await (0, import_promises7.readFile)((0, import_node_path10.join)(projectRoot, PACKAGE_JSON), "utf8");
     return ProjectPackageJsonSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeProjectPackageJson(projectRoot, data) {
-  await (0, import_promises8.writeFile)(
-    (0, import_node_path9.join)(projectRoot, PACKAGE_JSON),
+  await (0, import_promises7.writeFile)(
+    (0, import_node_path10.join)(projectRoot, PACKAGE_JSON),
     JSON.stringify(data, null, 2) + "\n",
     "utf8"
   );
 }
 async function readLockfile(projectRoot) {
   try {
-    const raw = await (0, import_promises8.readFile)((0, import_node_path9.join)(projectRoot, LOCKFILE), "utf8");
+    const raw = await (0, import_promises7.readFile)((0, import_node_path10.join)(projectRoot, LOCKFILE), "utf8");
     return LockfileSchema.parse(JSON.parse(raw));
   } catch {
     return null;
   }
 }
 async function writeLockfile(projectRoot, data) {
-  await (0, import_promises8.writeFile)((0, import_node_path9.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
+  await (0, import_promises7.writeFile)((0, import_node_path10.join)(projectRoot, LOCKFILE), JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 function upsertLockEntry(lock, name, entry) {
   return {
@@ -8429,40 +8551,392 @@ function parseTargetsFlag(value) {
   return unique;
 }
 
-// src/prompt.ts
-var readline = __toESM(require("node:readline/promises"), 1);
+// src/ui/select.ts
 var import_node_process2 = require("node:process");
-async function promptForTool() {
-  const rl = readline.createInterface({ input: import_node_process2.stdin, output: import_node_process2.stdout });
+
+// src/ui/ansi.ts
+var ansi = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  hideCursor: "\x1B[?25l",
+  showCursor: "\x1B[?25h",
+  clearLine: "\x1B[2K",
+  cursorTo(col) {
+    return `\x1B[${Math.max(1, col)}G`;
+  },
+  /** Move cursor up `n` lines (0 = no-op). */
+  cursorUp(n) {
+    return n > 0 ? `\x1B[${n}A` : "";
+  }
+};
+
+// src/ui/select.ts
+var SelectCancelledError = class extends Error {
+  constructor(message = "Selection cancelled") {
+    super(message);
+    this.name = "SelectCancelledError";
+  }
+};
+function assertSelectable(options) {
+  if (options.length === 0) {
+    throw new Error("selectPrompt requires at least one option");
+  }
+}
+function wrap(open, text, reset) {
+  return open ? `${open}${text}${reset}` : text;
+}
+function renderFrame(output2, opts) {
+  const { message, options, index, theme } = opts;
+  const lines = [];
+  lines.push("");
+  lines.push(
+    `${wrap(theme.accent + theme.bold, "?", theme.reset)} ${wrap(theme.bold, message, theme.reset)}`
+  );
+  lines.push("");
+  for (let i = 0; i < options.length; i++) {
+    const option = options[i];
+    const selected = i === index;
+    const pointer = selected ? "\u276F" : " ";
+    if (selected && theme.color) {
+      lines.push(`${theme.highlight} ${pointer} ${option.label} ${theme.reset}`);
+      if (option.hint) {
+        lines.push(`${theme.highlight}     ${option.hint} ${theme.reset}`);
+      }
+    } else if (selected) {
+      lines.push(` ${pointer} ${option.label}`);
+      if (option.hint) lines.push(`     ${option.hint}`);
+    } else {
+      lines.push(` ${pointer} ${wrap(theme.muted, option.label, theme.reset)}`);
+      if (option.hint) {
+        lines.push(`     ${wrap(theme.muted, option.hint, theme.reset)}`);
+      }
+    }
+    lines.push("");
+  }
+  lines.push(wrap(theme.muted, "  \u2191\u2193 navigate \xB7 enter select \xB7 esc cancel", theme.reset));
+  lines.push("");
+  if (opts.previous && opts.previous.lines > 0) {
+    output2.write(ansi.cursorUp(opts.previous.lines));
+  }
+  for (const line of lines) {
+    output2.write(`${ansi.clearLine}${ansi.cursorTo(1)}${line}
+`);
+  }
+  const prev = opts.previous?.lines ?? 0;
+  for (let i = lines.length; i < prev; i++) {
+    output2.write(`${ansi.clearLine}${ansi.cursorTo(1)}
+`);
+  }
+  if (prev > lines.length) {
+    output2.write(ansi.cursorUp(prev - lines.length));
+  }
+  return { lines: Math.max(lines.length, prev) };
+}
+function clearFrame(output2, state) {
+  if (state.lines <= 0) return;
+  output2.write(ansi.cursorUp(state.lines));
+  for (let i = 0; i < state.lines; i++) {
+    output2.write(`${ansi.clearLine}${ansi.cursorTo(1)}
+`);
+  }
+  output2.write(ansi.cursorUp(state.lines));
+}
+function writeDone(output2, message, option, theme) {
+  const prefix = wrap(theme.accent + theme.bold, "\u2714", theme.reset);
+  const msg = wrap(theme.bold, message, theme.reset);
+  const value = wrap(theme.accentStrong, option.label, theme.reset);
+  output2.write("\n");
+  output2.write(
+    `${prefix} ${msg} ${wrap(theme.muted, "\xB7", theme.reset)} ${value}
+`
+  );
+  output2.write("\n");
+}
+function readKey(chunk) {
+  if (chunk === "" || chunk === "\x1B") return "cancel";
+  if (chunk === "\r" || chunk === "\n") return "enter";
+  if (chunk === "\x1B[A" || chunk === "\x1BOA" || chunk === "k") return "up";
+  if (chunk === "\x1B[B" || chunk === "\x1BOB" || chunk === "j") return "down";
+  if (chunk.startsWith("\x1B")) return "ignore";
+  return "ignore";
+}
+async function selectPrompt(options) {
+  assertSelectable(options.options);
+  const input2 = options.input ?? import_node_process2.stdin;
+  const output2 = options.output ?? import_node_process2.stdout;
+  const theme = createTheme(output2);
+  if (!input2.isTTY || !output2.isTTY || typeof input2.setRawMode !== "function") {
+    throw new Error(
+      "Interactive selection requires a TTY. Pass an explicit flag (e.g. --target / --ci) or run in a terminal."
+    );
+  }
+  const initial = Math.min(
+    Math.max(options.initialIndex ?? 0, 0),
+    options.options.length - 1
+  );
+  let index = initial;
+  let frame = { lines: 0 };
+  const wasRaw = input2.isRaw;
+  input2.setRawMode(true);
+  input2.resume();
+  output2.write(ansi.hideCursor);
+  const redraw = () => {
+    frame = renderFrame(output2, {
+      message: options.message,
+      options: options.options,
+      index,
+      theme,
+      previous: frame
+    });
+  };
+  redraw();
   try {
-    while (true) {
-      const answer = await rl.question(
-        "Which AI tool should this skill be installed for? (cursor/claude/codex): "
+    return await new Promise((resolve6, reject) => {
+      const onData = (chunk) => {
+        const key = readKey(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+        if (key === "ignore") return;
+        if (key === "up") {
+          index = (index - 1 + options.options.length) % options.options.length;
+          redraw();
+          return;
+        }
+        if (key === "down") {
+          index = (index + 1) % options.options.length;
+          redraw();
+          return;
+        }
+        if (key === "cancel") {
+          cleanup();
+          clearFrame(output2, frame);
+          reject(new SelectCancelledError());
+          return;
+        }
+        const selected = options.options[index];
+        cleanup();
+        clearFrame(output2, frame);
+        writeDone(output2, options.message, selected, theme);
+        resolve6(selected.value);
+      };
+      const cleanup = () => {
+        input2.off("data", onData);
+      };
+      input2.on("data", onData);
+    });
+  } finally {
+    output2.write(ansi.showCursor);
+    if (typeof input2.setRawMode === "function") {
+      input2.setRawMode(wasRaw);
+    }
+    if (typeof input2.pause === "function") {
+      input2.pause();
+    }
+  }
+}
+
+// src/ui/confirm.ts
+async function confirmPrompt(options) {
+  return selectPrompt({
+    message: options.message,
+    initialIndex: options.initialConfirm ? 0 : 1,
+    input: options.input,
+    output: options.output,
+    options: [
+      { value: true, label: options.activeLabel ?? "Yes" },
+      { value: false, label: options.inactiveLabel ?? "No" }
+    ]
+  });
+}
+
+// src/ui/note.ts
+function symbolFor(type) {
+  switch (type) {
+    case "success":
+      return "\u2714";
+    case "warn":
+      return "\u26A0";
+    case "error":
+      return "\u2716";
+    default:
+      return "\u2139";
+  }
+}
+function colorFor(type, theme) {
+  switch (type) {
+    case "success":
+      return theme.accent;
+    case "warn":
+      return theme.warning;
+    case "error":
+      return theme.danger;
+    default:
+      return theme.accentStrong;
+  }
+}
+function printNote(options) {
+  const stream = options.stream ?? process.stderr;
+  const theme = createTheme(stream);
+  const type = options.type ?? "info";
+  const symbol = symbolFor(type);
+  const color = colorFor(type, theme);
+  stream.write("\n");
+  if (options.title) {
+    stream.write(
+      `${color}${theme.bold}${symbol} ${options.title}${theme.reset}
+`
+    );
+    stream.write(`  ${theme.muted}${options.message}${theme.reset}
+`);
+  } else {
+    stream.write(
+      `${color}${theme.bold}${symbol}${theme.reset} ${options.message}
+`
+    );
+  }
+  stream.write("\n");
+}
+
+// src/ui/spinner.ts
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+function createSpinner(options) {
+  const stream = options.stream ?? process.stderr;
+  const theme = createTheme(stream);
+  const disabled = options.disabled || !stream.isTTY || !theme.color;
+  let text = options.text;
+  let frame = 0;
+  let timer;
+  let active = false;
+  const clearLine = () => {
+    if (!stream.isTTY) return;
+    stream.write("\r\x1B[2K");
+  };
+  const render = () => {
+    if (disabled || !active) return;
+    const spin = FRAMES[frame % FRAMES.length];
+    stream.write(`\r\x1B[2K${theme.accent}${spin}${theme.reset} ${text}`);
+    frame += 1;
+  };
+  return {
+    start(nextText) {
+      if (nextText) text = nextText;
+      if (disabled) return;
+      if (active) return;
+      active = true;
+      render();
+      timer = setInterval(render, 80);
+      timer.unref?.();
+    },
+    update(nextText) {
+      text = nextText;
+      if (disabled || !active) return;
+      render();
+    },
+    succeed(finalText = text) {
+      stop();
+      if (disabled) return;
+      stream.write(
+        `${theme.accent}${theme.bold}\u2714${theme.reset} ${finalText}
+`
       );
-      const normalized = answer.trim().toLowerCase();
-      if (normalized === "cursor" || normalized === "claude" || normalized === "codex") {
-        return normalized;
+    },
+    fail(finalText = text) {
+      stop();
+      if (disabled) {
+        stream.write(`${finalText}
+`);
+        return;
       }
-      console.log('Please enter "cursor", "claude", or "codex".');
+      stream.write(`${theme.danger}${theme.bold}\u2716${theme.reset} ${finalText}
+`);
+    },
+    stop() {
+      stop();
+    }
+  };
+  function stop() {
+    if (timer) {
+      clearInterval(timer);
+      timer = void 0;
+    }
+    if (active) {
+      clearLine();
+      active = false;
     }
-  } finally {
-    rl.close();
   }
 }
-async function promptForConfirmation(question) {
-  const rl = readline.createInterface({ input: import_node_process2.stdin, output: import_node_process2.stdout });
+
+// src/ui/recover.ts
+var import_node_process3 = require("node:process");
+function canPromptInteractively(ci) {
+  if (ci) return false;
+  return Boolean(import_node_process3.stdin.isTTY && import_node_process3.stdout.isTTY);
+}
+var RecoveryCancelledError = class extends Error {
+  constructor(message = "Cancelled.") {
+    super(message);
+    this.name = "RecoveryCancelledError";
+  }
+};
+async function offerChoices(options) {
+  if (!canPromptInteractively(options.ci)) {
+    throw new Error(options.fallbackError);
+  }
+  if (options.note) {
+    printNote({
+      type: options.note.type ?? "warn",
+      title: options.note.title,
+      message: options.note.message
+    });
+  }
   try {
-    const answer = await rl.question(`${question} (y/N): `);
-    const normalized = answer.trim().toLowerCase();
-    return normalized === "y" || normalized === "yes";
-  } finally {
-    rl.close();
+    return await selectPrompt({
+      message: options.message,
+      options: options.choices
+    });
+  } catch (error) {
+    if (error instanceof SelectCancelledError) {
+      throw new RecoveryCancelledError();
+    }
+    throw error;
   }
 }
 
+// src/prompt.ts
+async function promptForTool(tools = ["cursor", "claude", "codex"]) {
+  const options = tools.map((tool) => ({
+    value: tool,
+    label: tool,
+    hint: tool === "cursor" ? ".cursor/" : tool === "claude" ? ".claude/" : ".agents/ (Codex)"
+  }));
+  return selectPrompt({
+    message: "Which AI tool should this skill be installed for?",
+    options
+  });
+}
+async function promptForConfirmation(question) {
+  return confirmPrompt({ message: question, initialConfirm: false });
+}
+async function promptForNoInitConflict() {
+  return selectPrompt({
+    message: "Project already has aipm.package.json. How do you want to continue?",
+    options: [
+      {
+        value: "no-init",
+        label: "Continue without project tracking",
+        hint: "keep --no-init"
+      },
+      {
+        value: "tracked",
+        label: "Use normal project mode",
+        hint: "drop --no-init for this run"
+      }
+    ]
+  });
+}
+
 // src/install-one.ts
 function normalizeRelativePath(path2) {
-  return (0, import_node_path10.normalize)(path2).split(import_node_path10.sep).join("/");
+  return (0, import_node_path11.normalize)(path2).split(import_node_path11.sep).join("/");
 }
 function assertSafeRelativePath(path2) {
   const rel = normalizeRelativePath(path2.trim());
@@ -8473,8 +8947,8 @@ function assertSafeRelativePath(path2) {
 }
 function safeJoin(root, relPath) {
   const rel = assertSafeRelativePath(relPath);
-  const target = (0, import_node_path10.resolve)(root, rel);
-  const fromRoot = normalizeRelativePath((0, import_node_path10.relative)(root, target));
+  const target = (0, import_node_path11.resolve)(root, rel);
+  const fromRoot = normalizeRelativePath((0, import_node_path11.relative)(root, target));
   if (fromRoot === ".." || fromRoot.startsWith("../") || fromRoot.startsWith("/")) {
     throw new Error(`Unsafe install path: ${relPath}`);
   }
@@ -8485,33 +8959,98 @@ function packageHelperSlug(name) {
   return `${scope}__${pkg}`;
 }
 function helperRootFor(configRoot, packageName, version) {
-  const base = (0, import_node_path10.basename)(configRoot) === ".aipm" ? (0, import_node_path10.join)(configRoot, "helpers") : (0, import_node_path10.join)(configRoot, ".aipm", "helpers");
-  return (0, import_node_path10.join)(base, packageHelperSlug(packageName), version);
+  const base = (0, import_node_path11.basename)(configRoot) === ".aipm" ? (0, import_node_path11.join)(configRoot, "helpers") : (0, import_node_path11.join)(configRoot, ".aipm", "helpers");
+  return (0, import_node_path11.join)(base, packageHelperSlug(packageName), version);
 }
 async function assertSourceFile(packageRoot, relPath) {
   const source = safeJoin(packageRoot, relPath);
-  const info = await (0, import_promises9.stat)(source).catch(() => null);
+  const info = await (0, import_promises8.stat)(source).catch(() => null);
   if (!info?.isFile()) throw new Error(`Package install file not found: ${relPath}`);
   return source;
 }
+function installReferencedFiles2(install) {
+  return [
+    ...(install?.mainFiles ?? []).map((file) => file.from),
+    ...(install?.helperFiles ?? []).map((file) => file.from)
+  ];
+}
+function isRootLicenseOrNotice(path2) {
+  return !path2.includes("/") && /^(?:licen[cs]e|notice|copying)(?:$|[._-])/i.test(path2);
+}
+async function listRegularPackageFiles(root, current = root) {
+  const files = [];
+  for (const entry of await (0, import_promises8.readdir)(current, { withFileTypes: true })) {
+    const absolute = (0, import_node_path11.join)(current, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await listRegularPackageFiles(root, absolute));
+    } else if (entry.isFile()) {
+      files.push(normalizeRelativePath((0, import_node_path11.relative)(root, absolute)));
+    }
+  }
+  return files;
+}
+async function collectSkillSupportingFiles(packageRoot, manifest) {
+  const entry = assertSafeRelativePath(manifest.entry);
+  const entryDirectory = (0, import_node_path11.dirname)(entry);
+  const excluded = /* @__PURE__ */ new Set([
+    entry,
+    "aipm.manifest.json",
+    "pkg.tgz",
+    ...installReferencedFiles2(manifest.install).map(assertSafeRelativePath)
+  ]);
+  const supportingFiles = [];
+  for (const sourcePath of await listRegularPackageFiles(packageRoot)) {
+    if (excluded.has(sourcePath)) continue;
+    const fromEntryDirectory = normalizeRelativePath((0, import_node_path11.relative)(entryDirectory, sourcePath));
+    const isEntrySibling = fromEntryDirectory !== ".." && !fromEntryDirectory.startsWith("../") && !fromEntryDirectory.startsWith("/");
+    if (!isEntrySibling && !isRootLicenseOrNotice(sourcePath)) continue;
+    const destinationPath = isEntrySibling ? fromEntryDirectory : (0, import_node_path11.basename)(sourcePath);
+    if (destinationPath.toLowerCase() === "skill.md") {
+      throw new Error(`Package supporting file conflicts with installed SKILL.md: ${sourcePath}`);
+    }
+    const source = safeJoin(packageRoot, sourcePath);
+    supportingFiles.push({
+      path: destinationPath,
+      content: await (0, import_promises8.readFile)(source),
+      mode: (await (0, import_promises8.stat)(source)).mode
+    });
+  }
+  return supportingFiles.sort((a, b) => a.path.localeCompare(b.path));
+}
 async function copyMainFile(input2) {
   const source = await assertSourceFile(input2.packageRoot, input2.file.from);
   const target = safeJoin(input2.installRoot, input2.file.to);
-  const overwrite = input2.file.overwrite ?? "fail";
-  const exists = await (0, import_promises9.stat)(target).catch(() => null);
+  let overwrite = input2.file.overwrite ?? "fail";
+  const exists = await (0, import_promises8.stat)(target).catch(() => null);
   if (exists) {
     if (overwrite === "skip") return null;
-    if (overwrite === "fail") throw new Error(`Install target already exists: ${target}`);
+    if (overwrite === "fail") {
+      overwrite = await offerChoices({
+        ci: input2.ci,
+        note: {
+          type: "warn",
+          title: "File already exists",
+          message: target
+        },
+        message: "How do you want to continue?",
+        choices: [
+          { value: "replace", label: "Overwrite the existing file" },
+          { value: "skip", label: "Skip this file" }
+        ],
+        fallbackError: `Install target already exists: ${target}`
+      });
+      if (overwrite === "skip") return null;
+    }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path10.dirname)(target), { recursive: true });
-  await (0, import_promises9.cp)(source, target, { force: overwrite === "replace" });
+  await (0, import_promises8.mkdir)((0, import_node_path11.dirname)(target), { recursive: true });
+  await (0, import_promises8.cp)(source, target, { force: overwrite === "replace" });
   return target;
 }
 async function copyHelperFile(input2) {
   const source = await assertSourceFile(input2.packageRoot, input2.file.from);
-  const target = safeJoin(input2.helperRoot, input2.file.to ?? (0, import_node_path10.basename)(input2.file.from));
-  await (0, import_promises9.mkdir)((0, import_node_path10.dirname)(target), { recursive: true });
-  await (0, import_promises9.cp)(source, target, { force: true });
+  const target = safeJoin(input2.helperRoot, input2.file.to ?? (0, import_node_path11.basename)(input2.file.from));
+  await (0, import_promises8.mkdir)((0, import_node_path11.dirname)(target), { recursive: true });
+  await (0, import_promises8.cp)(source, target, { force: true });
   return target;
 }
 async function installPackageAssets(options) {
@@ -8522,13 +9061,14 @@ async function installPackageAssets(options) {
     const copied = await copyMainFile({
       packageRoot: options.packageRoot,
       installRoot: options.installRoot,
-      file
+      file,
+      ci: options.ci
     });
     if (copied) assets.main.push(copied);
   }
   const helperRoot = helperRootFor(options.configRoot, options.packageName, options.version);
   if ((install.helperFiles ?? []).length > 0) {
-    await (0, import_promises9.rm)(helperRoot, { recursive: true, force: true });
+    await (0, import_promises8.rm)(helperRoot, { recursive: true, force: true });
   }
   for (const file of install.helperFiles ?? []) {
     assets.helper.push(await copyHelperFile({ packageRoot: options.packageRoot, helperRoot, file }));
@@ -8559,121 +9099,163 @@ function printPostInstallNotice(name, postInstall) {
 async function installOnePackage(options) {
   const configRoot = options.configRoot;
   const installRoot = options.installRoot ?? configRoot;
-  await assertRegistryReachable(options.registry);
-  const { manifest, integrity: remoteIntegrity, deprecated } = await fetchPackageMetadata(
-    options.registry,
-    options.name,
-    options.version,
-    options.token
-  );
-  if (deprecated) {
-    console.warn(
-      `Warning: ${options.name} is deprecated${deprecated.message ? `: ${deprecated.message}` : ""}.`
-    );
-  }
-  let explicitTarget = options.explicitTarget;
-  let preferredTools = options.project.preferredTools;
-  const { resolveInstallTools: resolveInstallTools2 } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
-  let tools = await resolveInstallTools2({
-    projectRoot: installRoot,
-    manifest,
-    preferredTools,
-    explicitTarget
+  const spinner = createSpinner({
+    text: `Fetching ${options.name}@${options.version}`,
+    disabled: options.ci
   });
-  if (tools.length === 0) {
-    if (options.ci) {
-      throw new Error(
-        "No tool detected. Use --target cursor|claude|codex|* in CI mode."
-      );
-    }
-    const choice = await promptForTool();
-    explicitTarget = choice;
-    preferredTools = [choice];
-    tools = await resolveInstallTools2({
-      projectRoot: installRoot,
-      manifest,
-      preferredTools,
-      explicitTarget
-    });
-  }
-  const tarball = await fetchPackageTarball(
-    options.registry,
-    options.name,
-    options.version,
-    options.token
-  );
-  const packageRoot = await unpackTarballToDirectory(tarball);
+  spinner.start();
   try {
-    const skillMarkdown = await (0, import_promises9.readFile)(safeJoin(packageRoot, manifest.entry), "utf8");
-    const result = await installSkillPackage({
+    await assertRegistryReachable(options.registry);
+    const { manifest, integrity: remoteIntegrity, deprecated } = await fetchPackageMetadata(
+      options.registry,
+      options.name,
+      options.version,
+      options.token
+    );
+    if (deprecated) {
+      spinner.stop();
+      printNote({
+        type: "warn",
+        title: "Deprecated package",
+        message: `${options.name}${deprecated.message ? `: ${deprecated.message}` : ""}`
+      });
+      spinner.start(`Installing ${options.name}@${options.version}`);
+    }
+    let explicitTarget = options.explicitTarget;
+    let preferredTools = options.project.preferredTools;
+    const { resolveInstallTools: resolveInstallTools2 } = await Promise.resolve().then(() => (init_dist6(), dist_exports));
+    let tools = await resolveInstallTools2({
       projectRoot: installRoot,
       manifest,
-      skillMarkdown,
       preferredTools,
       explicitTarget
     });
-    const { assets, postInstall } = await installPackageAssets({
-      configRoot,
-      installRoot,
-      packageRoot,
-      packageName: options.name,
-      version: options.version,
-      install: manifest.install
-    });
-    const lock = await readLockfile(configRoot) ?? {
-      schemaVersion: "0.1",
-      packages: {},
-      prompts: {}
-    };
-    const installed = {};
-    for (const tool of result.resolvedTools) {
-      const paths = result.installed[tool];
-      if (paths) installed[tool] = paths;
-    }
-    await writeLockfile(
-      configRoot,
-      upsertLockEntry(lock, options.name, {
-        version: options.version,
-        integrity: remoteIntegrity,
-        registry: options.registry,
-        resolvedTools: result.resolvedTools,
-        installed,
-        ...assets.main.length || assets.helper.length ? { installedAssets: assets } : {},
-        ...postInstall ? { postInstall } : {}
-      })
+    if (tools.length === 0) {
+      spinner.stop();
+      if (options.ci) {
+        throw new Error(
+          "No tool detected. Use --target cursor|claude|codex|* in CI mode."
+        );
+      }
+      printNote({
+        type: "info",
+        title: "No AI tool folder found",
+        message: "Could not find .cursor, .claude, or .codex in this project."
+      });
+      const choice = await promptForTool();
+      explicitTarget = choice;
+      preferredTools = [choice];
+      tools = await resolveInstallTools2({
+        projectRoot: installRoot,
+        manifest,
+        preferredTools,
+        explicitTarget
+      });
+      spinner.start(`Installing ${options.name}@${options.version}`);
+    } else if (tools.length > 1 && !explicitTarget && !options.ci) {
+      spinner.stop();
+      printNote({
+        type: "info",
+        title: "Multiple AI tools found",
+        message: `Detected: ${tools.join(", ")}`
+      });
+      const choice = await promptForTool(tools);
+      explicitTarget = choice;
+      preferredTools = [choice];
+      tools = [choice];
+      spinner.start(`Installing ${options.name}@${options.version}`);
+    }
+    spinner.update(`Downloading ${options.name}@${options.version}`);
+    const tarball = await fetchPackageTarball(
+      options.registry,
+      options.name,
+      options.version,
+      options.token
     );
-    console.log(`Installed ${options.name}@${options.version} \u2192 ${result.resolvedTools.join(", ")}`);
-    printPostInstallNotice(options.name, postInstall);
-  } finally {
-    await (0, import_promises9.rm)(packageRoot, { recursive: true, force: true });
+    const packageRoot = await unpackTarballToDirectory(tarball);
+    try {
+      spinner.update(`Installing ${options.name}@${options.version}`);
+      const skillMarkdown = await (0, import_promises8.readFile)(safeJoin(packageRoot, manifest.entry), "utf8");
+      const supportingFiles = await collectSkillSupportingFiles(packageRoot, manifest);
+      const result = await installSkillPackage({
+        projectRoot: installRoot,
+        manifest,
+        skillMarkdown,
+        supportingFiles,
+        preferredTools,
+        explicitTarget
+      });
+      const { assets, postInstall } = await installPackageAssets({
+        configRoot,
+        installRoot,
+        packageRoot,
+        packageName: options.name,
+        version: options.version,
+        install: manifest.install,
+        ci: options.ci
+      });
+      const track = options.track !== false;
+      if (track) {
+        const lock = await readLockfile(configRoot) ?? {
+          schemaVersion: "0.1",
+          packages: {},
+          prompts: {}
+        };
+        const installed = {};
+        for (const tool of result.resolvedTools) {
+          const paths = result.installed[tool];
+          if (paths) installed[tool] = paths;
+        }
+        await writeLockfile(
+          configRoot,
+          upsertLockEntry(lock, options.name, {
+            version: options.version,
+            integrity: remoteIntegrity,
+            registry: options.registry,
+            resolvedTools: result.resolvedTools,
+            installed,
+            ...assets.main.length || assets.helper.length ? { installedAssets: assets } : {},
+            ...postInstall ? { postInstall } : {}
+          })
+        );
+      }
+      spinner.stop();
+      console.log(`Installed ${options.name}@${options.version} \u2192 ${result.resolvedTools.join(", ")}`);
+      printPostInstallNotice(options.name, postInstall);
+    } finally {
+      await (0, import_promises8.rm)(packageRoot, { recursive: true, force: true });
+    }
+  } catch (error) {
+    spinner.fail(`Failed to install ${options.name}@${options.version}`);
+    throw error;
   }
 }
 
 // src/doctor.ts
 var import_node_child_process3 = require("node:child_process");
-var import_promises10 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_promises9 = require("node:fs/promises");
+var import_node_path13 = require("node:path");
 var import_node_util4 = require("node:util");
 
 // src/project-root.ts
 var import_node_os3 = require("node:os");
-var import_node_path11 = require("node:path");
-var import_node_process3 = require("node:process");
+var import_node_path12 = require("node:path");
+var import_node_process4 = require("node:process");
 function globalConfigDir(env2 = process.env) {
   const fromEnv = env2.AIPM_HOME?.trim();
-  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".aipm");
+  return fromEnv ? fromEnv.replace(/\/$/, "") : (0, import_node_path12.join)((0, import_node_os3.homedir)(), ".aipm");
 }
 function resolveConfigRoot(options = {}) {
-  return options.global ? globalConfigDir() : (0, import_node_process3.cwd)();
+  return options.global ? globalConfigDir() : (0, import_node_process4.cwd)();
 }
 function resolveInstallRoot(options = {}) {
-  return options.global ? (0, import_node_os3.homedir)() : (0, import_node_process3.cwd)();
+  return options.global ? (0, import_node_os3.homedir)() : (0, import_node_process4.cwd)();
 }
 function scopeLabel(options) {
   return options.global ? "global" : "project";
 }
 function initRequiredMessage(options) {
-  return options.global ? "Run aipm init -g first" : "Run aipm init first";
+  return options.global ? `Run ${recommendCmd("aipm init -g")} first` : `Run ${recommendCmd("aipm init")} first`;
 }
 
 // src/doctor.ts
@@ -8692,11 +9274,11 @@ async function commandOutput(command, args) {
 }
 function npmGlobalBin(prefix) {
   if (!prefix) return null;
-  return process.platform === "win32" ? prefix : `${prefix}${import_node_path12.sep}bin`;
+  return process.platform === "win32" ? prefix : `${prefix}${import_node_path13.sep}bin`;
 }
 function pathIncludes(pathDir) {
   if (!pathDir) return false;
-  return (process.env.PATH ?? "").split(import_node_path12.delimiter).includes(pathDir);
+  return (process.env.PATH ?? "").split(import_node_path13.delimiter).includes(pathDir);
 }
 function shellPathHint(binDir) {
   if (!binDir) return "Run npm prefix -g and add its bin folder to PATH.";
@@ -8749,11 +9331,11 @@ async function runDoctor(options) {
   if (!options.publish) {
     const configLabel = options.global ? "Global config" : "Project config";
     try {
-      await (0, import_promises10.access)((0, import_node_path12.join)(configRoot, "aipm.package.json"));
+      await (0, import_promises9.access)((0, import_node_path13.join)(configRoot, "aipm.package.json"));
       checks.push({
         name: configLabel,
         ok: true,
-        detail: `${(0, import_node_path12.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
+        detail: `${(0, import_node_path13.join)(configRoot, "aipm.package.json")} exists (${scopeLabel(scope)}).`
       });
     } catch {
       checks.push({
@@ -8783,7 +9365,7 @@ async function runDoctor(options) {
     checks.push({
       name: "Publish stage",
       ok: rows.length > 0 && changed.length === 0,
-      detail: rows.length === 0 ? "No files staged. Run aipm publish add ." : changed.length > 0 ? `${changed.length} staged file(s) changed after add. Run aipm publish add . again.` : `${rows.length} file(s) staged.`
+      detail: rows.length === 0 ? `No files staged. Run ${recommendCmd("aipm publish add .")}` : changed.length > 0 ? `${changed.length} staged file(s) changed after add. Run ${recommendCmd("aipm publish add .")} again.` : `${rows.length} file(s) staged.`
     });
   } catch (error) {
     checks.push({
@@ -8823,8 +9405,88 @@ async function runDoctor(options) {
 
 // src/prompt-install.ts
 var import_node_crypto2 = require("node:crypto");
-var import_promises11 = require("node:fs/promises");
-var import_node_path13 = require("node:path");
+var import_promises10 = require("node:fs/promises");
+var import_node_path14 = require("node:path");
+
+// src/cli-recover.ts
+async function resolvePromptRequiresTracking(options) {
+  const choice = await offerChoices({
+    ci: options.ci,
+    note: {
+      type: "warn",
+      title: "Prompt URLs need project tracking",
+      message: "--no-init cannot manage prompts without aipm.package.json."
+    },
+    message: "How do you want to continue?",
+    choices: [
+      {
+        value: "tracked",
+        label: "Continue with project tracking",
+        hint: "drop --no-init for this run"
+      }
+    ],
+    fallbackError: "Prompt URLs require project tracking. Drop --no-init, or run aipm init and continue without --no-init."
+  });
+  return choice;
+}
+async function resolvePrivateInstallFailure(options) {
+  const looksPrivate = /private|login|unauthorized|forbidden|401|403|aipm login/i.test(options.errorMessage);
+  if (!looksPrivate) {
+    throw new Error(options.errorMessage);
+  }
+  const choice = await offerChoices({
+    ci: options.ci,
+    note: {
+      type: "error",
+      title: "Package install needs authentication",
+      message: options.errorMessage
+    },
+    message: "What do you want to do?",
+    choices: [
+      {
+        value: "login-retry",
+        label: "Log in and retry",
+        hint: "aipm login"
+      }
+    ],
+    fallbackError: options.errorMessage
+  });
+  return choice;
+}
+async function resolveLoginRequired(options) {
+  return offerChoices({
+    ci: options.ci,
+    note: {
+      type: "warn",
+      title: "Login required",
+      message: options.purpose
+    },
+    message: "What do you want to do?",
+    choices: [{ value: "login", label: "Log in now", hint: "opens browser" }],
+    fallbackError: `Run ${recommendCmd("aipm login")} first.`
+  });
+}
+async function resolvePromptAliasConflict(options) {
+  return offerChoices({
+    ci: options.ci,
+    note: {
+      type: "warn",
+      title: "Prompt alias already in use",
+      message: `"${options.alias}" currently tracks ${options.currentUrl}`
+    },
+    message: "Replace it with the new prompt URL?",
+    choices: [
+      {
+        value: "replace",
+        label: "Replace and continue",
+        hint: options.nextUrl
+      }
+    ],
+    fallbackError: `Prompt alias "${options.alias}" already tracks ${options.currentUrl}. Remove it first or use a unique slug.`
+  });
+}
+
+// src/prompt-install.ts
 var PROMPT_SITE_ORIGIN = "https://www.aipm-registry.com";
 function parsePromptUrl(value) {
   let url;
@@ -8849,10 +9511,10 @@ function parsePromptUrl(value) {
   };
 }
 function promptDirectory(configRoot) {
-  return (0, import_node_path13.basename)(configRoot) === ".aipm" ? (0, import_node_path13.join)(configRoot, "prompts") : (0, import_node_path13.join)(configRoot, ".aipm", "prompts");
+  return (0, import_node_path14.basename)(configRoot) === ".aipm" ? (0, import_node_path14.join)(configRoot, "prompts") : (0, import_node_path14.join)(configRoot, ".aipm", "prompts");
 }
 function promptSnapshotPath(configRoot, reference) {
-  return (0, import_node_path13.join)(promptDirectory(configRoot), `${reference.publisher}--${reference.slug}.md`);
+  return (0, import_node_path14.join)(promptDirectory(configRoot), `${reference.publisher}--${reference.slug}.md`);
 }
 function canonicalPromptContent(prompt) {
   return JSON.stringify({
@@ -8911,7 +9573,7 @@ function emptyLock() {
   return { schemaVersion: "0.1", packages: {}, prompts: {} };
 }
 function installedRelativePath(configRoot, absolutePath) {
-  return (0, import_node_path13.relative)(configRoot, absolutePath).split("\\").join("/");
+  return (0, import_node_path14.relative)(configRoot, absolutePath).split("\\").join("/");
 }
 async function installTrackedPrompt(input2) {
   const prompt = await fetchPromptDetail(
@@ -8929,18 +9591,21 @@ async function installTrackedPrompt(input2) {
   const contentHash = promptContentHash(prompt);
   const lock = await readLockfile(input2.configRoot) ?? emptyLock();
   const existing = lock.prompts[input2.reference.alias];
-  const fileExists = Boolean(await (0, import_promises11.stat)(outputPath).catch(() => null));
+  const fileExists = Boolean(await (0, import_promises10.stat)(outputPath).catch(() => null));
   const changed = !existing || existing.contentHash !== contentHash || !fileExists;
   if (!input2.updateOnly || changed) {
-    await (0, import_promises11.mkdir)((0, import_node_path13.dirname)(outputPath), { recursive: true });
-    await (0, import_promises11.writeFile)(outputPath, renderPromptMarkdown(prompt, canonicalReference.url), "utf8");
+    await (0, import_promises10.mkdir)((0, import_node_path14.dirname)(outputPath), { recursive: true });
+    await (0, import_promises10.writeFile)(outputPath, renderPromptMarkdown(prompt, canonicalReference.url), "utf8");
   }
   if (input2.track) {
     const currentUrl = input2.project.prompts[input2.reference.alias];
     if (currentUrl && currentUrl !== canonicalReference.url) {
-      throw new Error(
-        `Prompt alias "${input2.reference.alias}" already tracks ${currentUrl}. Remove it first or use a unique slug.`
-      );
+      await resolvePromptAliasConflict({
+        ci: input2.ci,
+        alias: input2.reference.alias,
+        currentUrl,
+        nextUrl: canonicalReference.url
+      });
     }
     await writeProjectPackageJson(input2.configRoot, {
       ...input2.project,
@@ -8975,12 +9640,12 @@ function resolveTrackedPrompt(project, value) {
   return parsed ? { ...parsed, alias: value } : null;
 }
 async function readInstalledPrompt(configRoot, entry) {
-  return (0, import_promises11.readFile)((0, import_node_path13.join)(configRoot, entry.installedPath), "utf8");
+  return (0, import_promises10.readFile)((0, import_node_path14.join)(configRoot, entry.installedPath), "utf8");
 }
 async function removeTrackedPrompt(input2) {
   const lock = await readLockfile(input2.configRoot);
   const entry = lock?.prompts[input2.reference.alias];
-  if (entry) await (0, import_promises11.rm)((0, import_node_path13.join)(input2.configRoot, entry.installedPath), { force: true });
+  if (entry) await (0, import_promises10.rm)((0, import_node_path14.join)(input2.configRoot, entry.installedPath), { force: true });
   const prompts = { ...input2.project.prompts };
   delete prompts[input2.reference.alias];
   await writeProjectPackageJson(input2.configRoot, { ...input2.project, prompts });
@@ -8991,17 +9656,192 @@ async function removeTrackedPrompt(input2) {
   }
 }
 
+// src/remove-package.ts
+var import_promises11 = require("node:fs/promises");
+var import_node_path15 = require("node:path");
+function within(root, path2) {
+  const rel = (0, import_node_path15.relative)((0, import_node_path15.resolve)(root), (0, import_node_path15.resolve)(path2));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path15.isAbsolute)(rel);
+}
+function trackedInstalledPackagePaths(entry) {
+  return [
+    ...Object.values(entry.installed).flat(),
+    ...entry.installedAssets?.main ?? [],
+    ...entry.installedAssets?.helper ?? []
+  ];
+}
+async function pruneEmptyParents(path2, roots) {
+  let current = (0, import_node_path15.dirname)(path2);
+  while (roots.some((root) => within(root, current)) && !roots.some((root) => (0, import_node_path15.resolve)(root) === current)) {
+    try {
+      await (0, import_promises11.rmdir)(current);
+    } catch {
+      return;
+    }
+    current = (0, import_node_path15.dirname)(current);
+  }
+}
+async function removeInstalledPackageFiles(input2) {
+  const roots = [.../* @__PURE__ */ new Set([(0, import_node_path15.resolve)(input2.configRoot), (0, import_node_path15.resolve)(input2.installRoot)])];
+  const realRoots = await Promise.all(roots.map((root) => (0, import_promises11.realpath)(root).catch(() => root)));
+  const requestedPaths = [...new Set(trackedInstalledPackagePaths(input2.entry).map((path2) => (0, import_node_path15.resolve)(path2)))];
+  const protectedPaths = new Set(
+    (input2.otherEntries ?? []).flatMap(trackedInstalledPackagePaths).map((path2) => (0, import_node_path15.resolve)(path2))
+  );
+  const paths = requestedPaths.filter((path2) => !protectedPaths.has(path2));
+  const unsafe = paths.find((path2) => !roots.some((root) => within(root, path2)));
+  if (unsafe) throw new Error(`Refusing to remove an untrusted path from the lockfile: ${unsafe}`);
+  for (const path2 of paths) {
+    const stat6 = await (0, import_promises11.lstat)(path2).catch(() => null);
+    if (!stat6 || stat6.isSymbolicLink()) continue;
+    const canonicalPath = await (0, import_promises11.realpath)(path2);
+    if (!realRoots.some((root) => within(root, canonicalPath))) {
+      throw new Error(`Refusing to remove a path that resolves outside the install roots: ${path2}`);
+    }
+  }
+  let removed = 0;
+  for (const path2 of paths) {
+    if (await (0, import_promises11.lstat)(path2).catch(() => null)) removed += 1;
+    await (0, import_promises11.rm)(path2, { force: true });
+  }
+  for (const path2 of paths.sort((a, b) => b.length - a.length)) {
+    await pruneEmptyParents(path2, roots);
+  }
+  return { removed, retainedShared: requestedPaths.length - paths.length };
+}
+
+// src/no-init.ts
+var import_promises12 = require("node:fs/promises");
+var import_node_path16 = require("node:path");
+init_dist();
+function packageHelperSlug2(name) {
+  const [scope = "", pkg = ""] = name.replace(/^@/, "").split("/");
+  return `${scope}__${pkg}`;
+}
+function helpersBase(configRoot) {
+  return (0, import_node_path16.basename)(configRoot) === ".aipm" ? (0, import_node_path16.join)(configRoot, "helpers") : (0, import_node_path16.join)(configRoot, ".aipm", "helpers");
+}
+async function resolveNoInitMode(options) {
+  if (!options.requested) return false;
+  if (!options.projectExists) return true;
+  if (options.ci) {
+    throw new Error(
+      "Project already initialized (aipm.package.json exists). Drop --no-init, or run interactively to choose whether to continue without tracking."
+    );
+  }
+  console.warn("Warning: aipm.package.json already exists in this project.");
+  console.warn("You requested --no-init (install/manage without project tracking).");
+  const choice = await promptForNoInitConflict();
+  return choice === "no-init";
+}
+function discoverUntrackedPackagePaths(input2) {
+  const short = shortNameFromScopeName(input2.packageName);
+  const slug = packageHelperSlug2(input2.packageName);
+  return [
+    (0, import_node_path16.join)(input2.installRoot, ".cursor", "aipm", "skills", `${short}.md`),
+    (0, import_node_path16.join)(input2.installRoot, ".claude", "skills", short),
+    (0, import_node_path16.join)(input2.installRoot, ".agents", "skills", short),
+    (0, import_node_path16.join)(helpersBase(input2.configRoot), slug)
+  ];
+}
+async function removeUntrackedPackage(input2) {
+  const candidates = discoverUntrackedPackagePaths(input2);
+  const removed = [];
+  for (const path2 of candidates) {
+    const info = await (0, import_promises12.stat)(path2).catch(() => null);
+    if (!info) continue;
+    await (0, import_promises12.rm)(path2, { recursive: true, force: true });
+    removed.push(path2);
+  }
+  if (removed.length === 0) {
+    throw new Error(
+      `No untracked install found for ${input2.packageName}. Nothing to remove under known tool skill paths or .aipm/helpers.`
+    );
+  }
+  return { removed };
+}
+
+// src/ensure-project.ts
+var import_promises13 = require("node:fs/promises");
+init_dist6();
+async function ensureProjectOrOffer(options) {
+  if (options.project) {
+    return { action: "ready", project: options.project };
+  }
+  const fallback = initRequiredMessage(options.scope);
+  const choices = options.allowNoInit ? [
+    {
+      value: "init",
+      label: "Initialize AiPM",
+      hint: `create aipm.package.json (${scopeLabel(options.scope)})`
+    },
+    {
+      value: "no-init",
+      label: "Continue without initializing",
+      hint: "one-time / no project tracking"
+    }
+  ] : [
+    {
+      value: "init",
+      label: "Initialize AiPM",
+      hint: `create aipm.package.json (${scopeLabel(options.scope)})`
+    }
+  ];
+  const choice = await offerChoices({
+    ci: options.ci,
+    note: {
+      type: "warn",
+      title: "AiPM is not initialized",
+      message: `No aipm.package.json found for this ${scopeLabel(options.scope)}.`
+    },
+    message: `How do you want to continue with aipm ${options.command}?`,
+    choices: [...choices],
+    fallbackError: fallback
+  });
+  if (choice === "no-init") {
+    return { action: "no-init" };
+  }
+  const project = await createProjectPackageJson({
+    scope: options.scope,
+    registry: options.registry,
+    target: options.target
+  });
+  return { action: "ready", project };
+}
+async function createProjectPackageJson(options) {
+  const configRoot = resolveConfigRoot(options.scope);
+  const installRoot = resolveInstallRoot(options.scope);
+  if (options.scope.global) await (0, import_promises13.mkdir)(configRoot, { recursive: true });
+  const detected = await detectToolsInProject(installRoot);
+  const parsedTarget = parseTargetFlag(options.target);
+  let preferredTools = parsedTarget ? [parsedTarget] : detected;
+  if (!options.target && detected.length === 0) {
+    const choice = await promptForTool();
+    preferredTools = [choice];
+  }
+  const project = {
+    schemaVersion: "0.1",
+    registry: options.registry,
+    preferredTools: preferredTools.length ? preferredTools : void 0,
+    packages: {},
+    prompts: {}
+  };
+  await writeProjectPackageJson(configRoot, project);
+  console.log(`Created aipm.package.json (${scopeLabel(options.scope)}, registry: ${options.registry})`);
+  return project;
+}
+
 // src/version.ts
 var import_node_fs2 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_path17 = require("node:path");
 function getCliVersion() {
-  const pkgPath = (0, import_node_path14.join)(__dirname, "..", "package.json");
+  const pkgPath = (0, import_node_path17.join)(__dirname, "..", "package.json");
   const pkg = JSON.parse((0, import_node_fs2.readFileSync)(pkgPath, "utf8"));
   return pkg.version;
 }
 
 // src/cli-update-check.ts
-var import_node_process4 = require("node:process");
+var import_node_process5 = require("node:process");
 var CLI_PACKAGE_NAME = "@aipm-registry/cli";
 var CLI_UPDATE_COMMAND = `npm install -g ${CLI_PACKAGE_NAME}`;
 var NPM_REGISTRY = "https://registry.npmjs.org";
@@ -9052,7 +9892,7 @@ function formatCliUpdateNotice(options) {
   return `A new AIPM CLI version is available (${currentVersion} \u2192 ${latestVersion}). Run: ${cmd}`;
 }
 function printCliUpdateNotice(options) {
-  const useColor2 = options.useColor ?? import_node_process4.stderr.isTTY;
+  const useColor2 = options.useColor ?? import_node_process5.stderr.isTTY;
   const writeInfo = options.writeInfo ?? ((message2) => console.log(message2));
   const writeWarn = options.writeWarn ?? ((message2) => console.error(message2));
   const message = formatCliUpdateNotice(options);
@@ -9117,7 +9957,7 @@ function registryFromEnvOrDefault(flag) {
 }
 function packagePageUrl(packageName, version) {
   const [scope, name] = packageName.replace(/^@/, "").split("/");
-  return `${SITE_URL}/packages/${encodeURIComponent(scope ?? "")}/${encodeURIComponent(name ?? "")}/${encodeURIComponent(version)}`;
+  return `${SITE_URL}/skills/${encodeURIComponent(scope ?? "")}/${encodeURIComponent(name ?? "")}/${encodeURIComponent(version)}`;
 }
 function packageBadgeMarkdown(packageName, version) {
   const pageUrl = packagePageUrl(packageName, version);
@@ -9137,23 +9977,23 @@ function skillFolderName(name) {
   return folder;
 }
 async function writeStarterFile(path2, content) {
-  await (0, import_promises12.writeFile)(path2, content, { encoding: "utf8", flag: "wx" });
+  await (0, import_promises14.writeFile)(path2, content, { encoding: "utf8", flag: "wx" });
 }
 async function inferEntryFromSource(source, fallback) {
-  const sourceInfo = await (0, import_promises12.stat)(source);
-  if (sourceInfo.isFile()) return (0, import_node_path15.basename)(source);
+  const sourceInfo = await (0, import_promises14.stat)(source);
+  if (sourceInfo.isFile()) return (0, import_node_path18.basename)(source);
   if (!sourceInfo.isDirectory()) return fallback;
-  const entries = await (0, import_promises12.readdir)(source);
+  const entries = await (0, import_promises14.readdir)(source);
   if (entries.includes(fallback)) return fallback;
   return entries.find((entry) => entry.endsWith(".md")) ?? entries.find((entry) => entry.endsWith(".mdc")) ?? fallback;
 }
 async function copySourceIntoSkillRoot(source, root, sourceLabel) {
-  const sourceInfo = await (0, import_promises12.stat)(source);
-  await (0, import_promises12.mkdir)(root, { recursive: true });
+  const sourceInfo = await (0, import_promises14.stat)(source);
+  await (0, import_promises14.mkdir)(root, { recursive: true });
   if (sourceInfo.isDirectory()) {
-    const entries = await (0, import_promises12.readdir)(source);
+    const entries = await (0, import_promises14.readdir)(source);
     for (const entry of entries) {
-      await (0, import_promises12.cp)((0, import_node_path15.join)(source, entry), (0, import_node_path15.join)(root, entry), {
+      await (0, import_promises14.cp)((0, import_node_path18.join)(source, entry), (0, import_node_path18.join)(root, entry), {
         recursive: true,
         force: false,
         errorOnExist: true
@@ -9162,7 +10002,7 @@ async function copySourceIntoSkillRoot(source, root, sourceLabel) {
     return;
   }
   if (sourceInfo.isFile()) {
-    await (0, import_promises12.cp)(source, (0, import_node_path15.join)(root, (0, import_node_path15.basename)(source)), { force: false, errorOnExist: true });
+    await (0, import_promises14.cp)(source, (0, import_node_path18.join)(root, (0, import_node_path18.basename)(source)), { force: false, errorOnExist: true });
     return;
   }
   throw new Error(`Unsupported source path: ${sourceLabel}`);
@@ -9193,14 +10033,14 @@ function formatBytes(bytes) {
 }
 function packageDashboardUrl(name) {
   if (!name) return DASHBOARD_URL;
-  return `${DASHBOARD_URL}/packages/${name.replace(/^@/, "")}`;
+  return `${DASHBOARD_URL}/skills/${name.replace(/^@/, "")}`;
 }
 function helperRootFromTrackedPath(path2) {
-  const parts = path2.split(import_node_path15.sep).filter(Boolean);
+  const parts = path2.split(import_node_path18.sep).filter(Boolean);
   const helpersIndex = parts.lastIndexOf("helpers");
   if (helpersIndex === -1 || parts.length <= helpersIndex + 2) return null;
-  const prefix = path2.startsWith(import_node_path15.sep) ? import_node_path15.sep : "";
-  return (0, import_node_path15.join)(prefix, ...parts.slice(0, helpersIndex + 3));
+  const prefix = path2.startsWith(import_node_path18.sep) ? import_node_path18.sep : "";
+  return (0, import_node_path18.join)(prefix, ...parts.slice(0, helpersIndex + 3));
 }
 async function showInstalledPrompt(configRoot, packageArg) {
   const { name } = parsePackageArg(packageArg);
@@ -9213,7 +10053,7 @@ async function showInstalledPrompt(configRoot, packageArg) {
   if (entry.postInstall.status === "cleaned") {
     throw new Error(`Setup helper files were cleaned for ${name}. Reinstall the package to restore them.`);
   }
-  const content = await (0, import_promises12.readFile)(entry.postInstall.promptFile, "utf8").catch(() => {
+  const content = await (0, import_promises14.readFile)(entry.postInstall.promptFile, "utf8").catch(() => {
     throw new Error(`Setup prompt file is missing: ${entry.postInstall?.promptFile}`);
   });
   console.log(`Prompt file: ${entry.postInstall.promptFile}`);
@@ -9246,9 +10086,9 @@ async function cleanupInstalledHelpers(options) {
     entry.installedAssets.helper.map((path2) => helperRootFromTrackedPath(path2)).filter((path2) => Boolean(path2))
   );
   if (roots.size > 0) {
-    for (const root of roots) await (0, import_promises12.rm)(root, { recursive: true, force: true });
+    for (const root of roots) await (0, import_promises14.rm)(root, { recursive: true, force: true });
   } else {
-    for (const helperPath of entry.installedAssets.helper) await (0, import_promises12.rm)(helperPath, { force: true });
+    for (const helperPath of entry.installedAssets.helper) await (0, import_promises14.rm)(helperPath, { force: true });
   }
   await writeLockfile(options.configRoot, {
     ...lock,
@@ -9293,20 +10133,76 @@ async function authTokenForRegistry(registry, options = {}) {
     return refreshed.accessToken;
   } catch {
     await clearStoredRegistryAuth(registry);
-    const message = `CLI login for ${registry} expired or was revoked. Run aipm login to access private packages.`;
+    const message = `CLI login for ${registry} expired or was revoked. Run ${recommendCmd("aipm login")} to access private packages.`;
     if (options.throwOnFailure) throw new Error(message);
     if (!options.quiet) console.warn(`Warning: ${message}`);
     return void 0;
   }
 }
 async function tokenForRead(registry, explicitToken, options = {}) {
-  return explicitToken ?? import_node_process5.env.AIPM_TOKEN ?? await authTokenForRegistry(registry, options);
+  return explicitToken ?? import_node_process6.env.AIPM_TOKEN ?? await authTokenForRegistry(registry, options);
+}
+async function installOnePackageWithRecovery(options) {
+  try {
+    await installOnePackage(options);
+  } catch (error) {
+    if (error instanceof RecoveryCancelledError || error instanceof Error && error.name === "SelectCancelledError") {
+      throw error;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    await resolvePrivateInstallFailure({ ci: options.ci, errorMessage: message });
+    await runLoopbackLogin({
+      registry: options.registry,
+      siteUrl: SITE_URL,
+      open: true
+    });
+    const token = await authTokenForRegistry(options.registry, { throwOnFailure: true });
+    await installOnePackage({ ...options, token: token ?? options.token });
+  }
+}
+async function addUntrackedPackage(options) {
+  const { name, version: requestedVersion } = parsePackageArg(options.pkgArg);
+  const token = await tokenForRead(options.registry, options.token);
+  const version = requestedVersion ?? await latestVersionForPackage(options.registry, name, token);
+  if (!version) throw new Error(`Specify version: ${recommendCmd("aipm add <@scope/pkg>@<version>")}`);
+  const syntheticProject = {
+    schemaVersion: "0.1",
+    registry: options.registry,
+    packages: {},
+    prompts: {}
+  };
+  await installOnePackageWithRecovery({
+    configRoot: options.configRoot,
+    installRoot: options.installRoot,
+    registry: options.registry,
+    name,
+    version: version.replace(/^\^/, ""),
+    project: syntheticProject,
+    explicitTarget: parseTargetFlag(options.target),
+    ci: options.ci,
+    token,
+    track: false
+  });
+  try {
+    await recordPackageInstall(options.registry, name, token);
+  } catch (error) {
+    if (!options.ci && !program2.opts().quiet) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`Warning: could not record install count: ${message}`);
+    }
+  }
 }
 async function runLoopbackLogin(options) {
   const state = randomBase64Url(24);
   const verifier = randomBase64Url(48);
   const challenge = sha256Base64Url(verifier);
   const result = await new Promise((resolveLogin, rejectLogin) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      fn();
+    };
     const server = (0, import_node_http.createServer)((request, response) => {
       const host = request.headers.host ?? "127.0.0.1";
       const url = new URL(request.url ?? "/", `http://${host}`);
@@ -9318,29 +10214,33 @@ async function runLoopbackLogin(options) {
       if (url.searchParams.get("state") !== state) {
         response.writeHead(400, { "content-type": "text/html" });
         response.end("<h1>AIPM login failed</h1><p>Invalid state. Return to the terminal and try again.</p>");
-        rejectLogin(new Error("Invalid CLI login state"));
-        server.close();
+        forceCloseServer(server);
+        settle(() => rejectLogin(new Error("Invalid CLI login state")));
         return;
       }
       const code = url.searchParams.get("code");
       if (!code) {
         response.writeHead(400, { "content-type": "text/html" });
         response.end("<h1>AIPM login failed</h1><p>Missing code. Return to the terminal and try again.</p>");
-        rejectLogin(new Error("Missing CLI authorization code"));
-        server.close();
+        forceCloseServer(server);
+        settle(() => rejectLogin(new Error("Missing CLI authorization code")));
         return;
       }
       response.writeHead(200, { "content-type": "text/html" });
       response.end("<h1>AIPM CLI is signed in</h1><p>You can close this window and return to the terminal.</p>");
       const address = server.address();
       if (!address || typeof address === "string") {
-        rejectLogin(new Error("Could not read CLI callback address"));
-      } else {
-        resolveLogin({ code, redirectUri: `http://127.0.0.1:${address.port}/callback` });
+        forceCloseServer(server);
+        settle(() => rejectLogin(new Error("Could not read CLI callback address")));
+        return;
       }
-      server.close();
+      forceCloseServer(server);
+      settle(() => resolveLogin({ code, redirectUri: `http://127.0.0.1:${address.port}/callback` }));
+    });
+    server.once("error", (error) => {
+      forceCloseServer(server);
+      settle(() => rejectLogin(error));
     });
-    server.once("error", rejectLogin);
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       const redirectUri = `http://127.0.0.1:${address.port}/callback`;
@@ -9353,10 +10253,12 @@ async function runLoopbackLogin(options) {
       if (options.open) void openUrl(loginUrl.toString());
       else console.log(`Open: ${loginUrl.toString()}`);
     });
-    server.setTimeout(5 * 60 * 1e3, () => {
-      rejectLogin(new Error("CLI login timed out"));
-      server.close();
-    });
+    const timeout = setTimeout(() => {
+      forceCloseServer(server);
+      settle(() => rejectLogin(new Error("CLI login timed out")));
+    }, 5 * 60 * 1e3);
+    timeout.unref?.();
+    server.once("close", () => clearTimeout(timeout));
   });
   const tokens = await exchangeCliAuthCode(options.registry, {
     code: result.code,
@@ -9375,6 +10277,12 @@ async function runLoopbackLogin(options) {
   console.log(`Logged in as ${label}.`);
   console.log(`Credentials saved to ${authFilePath()}`);
 }
+function forceCloseServer(server) {
+  if (typeof server.closeAllConnections === "function") {
+    server.closeAllConnections();
+  }
+  server.close();
+}
 function printPublishFlow() {
   console.log("AIPM publish flow");
   console.log("1. Create an account and organization in the dashboard.");
@@ -9542,9 +10450,9 @@ function buildStarterQualityMetadata(options) {
 }
 async function initSkill(opts) {
   if (!isValidScopeName(opts.name)) throw new Error("Invalid @scope/name");
-  const root = opts.here ? (0, import_node_process5.cwd)() : (0, import_node_path15.resolve)((0, import_node_process5.cwd)(), opts.dir ?? skillFolderName(opts.name));
+  const root = opts.here ? (0, import_node_process6.cwd)() : (0, import_node_path18.resolve)((0, import_node_process6.cwd)(), opts.dir ?? skillFolderName(opts.name));
   const cdTarget = opts.here ? null : opts.dir ?? skillFolderName(opts.name);
-  const source = opts.from ? (0, import_node_path15.resolve)(opts.from) : null;
+  const source = opts.from ? (0, import_node_path18.resolve)(opts.from) : null;
   const entry = source ? await inferEntryFromSource(source, opts.entry) : opts.entry;
   const template = parseSkillTemplate(opts.template ?? "blank");
   const manifest = PackageManifestSchema.parse({
@@ -9565,17 +10473,17 @@ async function initSkill(opts) {
   if (source) {
     await copySourceIntoSkillRoot(source, root, source);
   } else {
-    await (0, import_promises12.mkdir)(root, { recursive: true });
+    await (0, import_promises14.mkdir)(root, { recursive: true });
   }
-  await writeStarterFile((0, import_node_path15.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+  await writeStarterFile((0, import_node_path18.join)(root, "aipm.manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
   if (!opts.from) {
     await writeStarterFile(
-      (0, import_node_path15.join)(root, entry),
+      (0, import_node_path18.join)(root, entry),
       SKILL_TEMPLATES[template](opts.name)
     );
   }
   await writeStarterFile(
-    (0, import_node_path15.join)(root, ".aipmignore"),
+    (0, import_node_path18.join)(root, ".aipmignore"),
     [
       "# Files that should never be published with this skill",
       ".env*",
@@ -9593,7 +10501,7 @@ async function initSkill(opts) {
       ""
     ].join("\n")
   );
-  await (0, import_promises12.mkdir)((0, import_node_path15.join)(root, ".aipm"), { recursive: true });
+  await (0, import_promises14.mkdir)((0, import_node_path18.join)(root, ".aipm"), { recursive: true });
   console.log(`Created ${opts.name} skill folder: ${root}`);
   printPublishGuide(
     opts.from ? `Copied ${opts.from} into ${root} and created aipm.manifest.json, .aipmignore, and the local publish state folder.` : `Created ${root} with aipm.manifest.json, ${entry}, .aipmignore, and the local publish state folder.`,
@@ -9608,24 +10516,11 @@ program2.command("init").description("Create aipm.package.json in the current pr
     console.log(`aipm.package.json already exists (${scopeLabel(scope)}).`);
     return;
   }
-  if (scope.global) await (0, import_promises12.mkdir)(configRoot, { recursive: true });
-  const installRoot = resolveInstallRoot(scope);
-  const detected = await detectToolsInProject(installRoot);
-  const parsedTarget = parseTargetFlag(opts.target);
-  let preferredTools = parsedTarget ? [parsedTarget] : detected;
-  if (!opts.target && detected.length === 0) {
-    const choice = await promptForTool();
-    preferredTools = [choice];
-  }
-  const registry = registryFromEnvOrDefault(opts.registry);
-  await writeProjectPackageJson(configRoot, {
-    schemaVersion: "0.1",
-    registry,
-    preferredTools: preferredTools.length ? preferredTools : void 0,
-    packages: {},
-    prompts: {}
+  await createProjectPackageJson({
+    scope,
+    registry: registryFromEnvOrDefault(opts.registry),
+    target: opts.target
   });
-  console.log(`Created aipm.package.json (${scopeLabel(scope)}, registry: ${registry})`);
 });
 program2.command("login").description("Sign in and store a local CLI session for private installs").option("--registry <url>", "Registry API base URL").option("--site <url>", "Website base URL", SITE_URL).option("--no-open", "Print the URL without opening a browser").action(async (opts) => {
   const registry = registryFromEnvOrDefault(opts.registry);
@@ -9680,9 +10575,9 @@ program2.command("config").description("Show resolved AIPM CLI and project confi
     scope: scopeLabel(scope),
     configRoot,
     installRoot,
-    cwd: (0, import_node_process5.cwd)(),
+    cwd: (0, import_node_process6.cwd)(),
     registry,
-    envRegistry: import_node_process5.env.AIPM_REGISTRY_URL ?? import_node_process5.env.AIPM_REGISTRY ?? null,
+    envRegistry: import_node_process6.env.AIPM_REGISTRY_URL ?? import_node_process6.env.AIPM_REGISTRY ?? null,
     hasProjectConfig: Boolean(project),
     projectPackages: project ? Object.keys(project.packages) : [],
     hasLockfile: Boolean(lock),
@@ -9711,11 +10606,58 @@ program2.command("config").description("Show resolved AIPM CLI and project confi
   console.log(`Auth file: ${data.authFile}`);
   console.log(`Publish guide: ${data.publishDoc}`);
 });
-program2.command("add <package-or-prompt>").description("Add a skill package or an AIPM prompt URL").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive; fail if prompt needed").action(async (pkgArg, opts) => {
+program2.command("add <package-or-prompt>").description("Add a skill package or an AIPM prompt URL").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive; fail if prompt needed").option("--no-init", "Install without creating or updating aipm.package.json / aipm-lock.json").action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const installRoot = resolveInstallRoot(scope);
   let project = await readProjectPackageJson(configRoot);
+  let useNoInit = await resolveNoInitMode({
+    requested: opts.init === false,
+    projectExists: Boolean(project),
+    ci: opts.ci
+  });
+  if (!useNoInit && !project) {
+    const ensured = await ensureProjectOrOffer({
+      scope,
+      project,
+      ci: opts.ci,
+      registry: resolveRegistryUrl(null, opts.registry, DEFAULT_REGISTRY),
+      target: opts.target,
+      allowNoInit: true,
+      command: "add"
+    });
+    if (ensured.action === "no-init") useNoInit = true;
+    else project = ensured.project;
+  }
+  if (useNoInit) {
+    const promptReference2 = parsePromptUrl(pkgArg);
+    if (promptReference2) {
+      await resolvePromptRequiresTracking({ ci: opts.ci, command: "add" });
+      useNoInit = false;
+      if (!project) {
+        project = await createProjectPackageJson({
+          scope,
+          registry: resolveRegistryUrl(null, opts.registry, DEFAULT_REGISTRY),
+          target: opts.target
+        });
+      }
+    } else {
+      const registry2 = resolveRegistryUrl(null, opts.registry, DEFAULT_REGISTRY);
+      await addUntrackedPackage({
+        configRoot,
+        installRoot,
+        registry: registry2,
+        pkgArg,
+        target: opts.target,
+        token: opts.token,
+        ci: opts.ci
+      });
+      if (!opts.ci && !program2.opts().quiet) {
+        await notifyCliUpdateIfNeeded(CLI_VERSION);
+      }
+      return;
+    }
+  }
   if (!project) throw new Error(initRequiredMessage(scope));
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
   const promptReference = parsePromptUrl(pkgArg);
@@ -9726,7 +10668,8 @@ program2.command("add <package-or-prompt>").description("Add a skill package or
       project,
       reference: promptReference,
       track: true,
-      recordCopy: true
+      recordCopy: true,
+      ci: opts.ci
     });
     console.log(`Installed prompt ${result.prompt.title} \u2192 ${result.path}`);
     return;
@@ -9734,13 +10677,13 @@ program2.command("add <package-or-prompt>").description("Add a skill package or
   const { name, version: requestedVersion } = parsePackageArg(pkgArg);
   const token = await tokenForRead(registry, opts.token);
   const version = requestedVersion ?? project.packages[name] ?? await latestVersionForPackage(registry, name, token);
-  if (!version) throw new Error("Specify version: aipm add @scope/pkg@1.0.0");
+  if (!version) throw new Error(`Specify version: ${recommendCmd("aipm add <@scope/pkg>@<version>")}`);
   project = {
     ...project,
     packages: { ...project.packages, [name]: version.replace(/^\^/, "") }
   };
   await writeProjectPackageJson(configRoot, project);
-  await installOnePackage({
+  await installOnePackageWithRecovery({
     configRoot,
     installRoot,
     registry,
@@ -9768,7 +10711,7 @@ program2.command("search [query]").description("Search public registry packages"
   const token = await tokenForRead(registry, opts.token, { quiet: opts.json });
   const packages = await searchPackages(registry, query, Number(opts.limit), token);
   if (opts.json) {
-    console.log(JSON.stringify({ packages }, null, 2));
+    console.log(JSON.stringify({ skills: packages }, null, 2));
     return;
   }
   if (packages.length === 0) {
@@ -9787,13 +10730,31 @@ program2.command("install").description("Install all packages from aipm.package.
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const installRoot = resolveInstallRoot(scope);
-  const project = await readProjectPackageJson(configRoot);
-  if (!project) throw new Error(initRequiredMessage(scope));
+  let project = await readProjectPackageJson(configRoot);
+  if (!project) {
+    const ensured = await ensureProjectOrOffer({
+      scope,
+      project,
+      ci: opts.ci,
+      registry: resolveRegistryUrl(null, opts.registry, DEFAULT_REGISTRY),
+      target: opts.target,
+      allowNoInit: false,
+      command: "install"
+    });
+    if (ensured.action !== "ready") throw new Error(initRequiredMessage(scope));
+    project = ensured.project;
+    printNote({
+      type: "info",
+      title: "Initialized",
+      message: "aipm.package.json is empty \u2014 add packages with aipm add, then run aipm install."
+    });
+    return;
+  }
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
   const target = parseTargetFlag(opts.target);
   const token = await tokenForRead(registry, opts.token);
   for (const [name, version] of Object.entries(project.packages)) {
-    await installOnePackage({
+    await installOnePackageWithRecovery({
       configRoot,
       installRoot,
       registry,
@@ -9813,20 +10774,33 @@ program2.command("install").description("Install all packages from aipm.package.
       registry,
       project,
       reference: { ...reference, alias },
-      track: false
+      track: false,
+      ci: opts.ci
     });
     console.log(`Restored prompt ${result.prompt.title} \u2192 ${result.path}`);
   }
 });
 program2.command("show <package-or-prompt>").description("Show an installed prompt snapshot or tracked skill details").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (value, opts) => {
-  const configRoot = resolveConfigRoot({ global: opts.global });
-  const project = await readProjectPackageJson(configRoot);
-  if (!project) throw new Error(initRequiredMessage({ global: opts.global }));
+  const scope = { global: opts.global };
+  const configRoot = resolveConfigRoot(scope);
+  let project = await readProjectPackageJson(configRoot);
+  if (!project) {
+    const ensured = await ensureProjectOrOffer({
+      scope,
+      project,
+      ci: opts.ci,
+      registry: DEFAULT_REGISTRY,
+      allowNoInit: false,
+      command: "show"
+    });
+    if (ensured.action !== "ready") throw new Error(initRequiredMessage(scope));
+    project = ensured.project;
+  }
   const reference = resolveTrackedPrompt(project, value);
   if (reference && project.prompts[reference.alias] === reference.url) {
     const lock2 = await readLockfile(configRoot);
     const entry2 = lock2?.prompts[reference.alias];
-    if (!entry2) throw new Error(`Prompt is not installed: ${reference.url}. Run aipm install.`);
+    if (!entry2) throw new Error(`Prompt is not installed: ${reference.url}. Run ${recommendCmd("aipm install")}.`);
     console.log(await readInstalledPrompt(configRoot, entry2));
     return;
   }
@@ -9840,7 +10814,7 @@ program2.command("show-prompt <package>").description("Show the manual setup pro
   await showInstalledPrompt(resolveConfigRoot({ global: opts.global }), pkgArg);
 });
 function promptImageContentType(path2) {
-  const extension = (0, import_node_path15.extname)(path2).toLowerCase();
+  const extension = (0, import_node_path18.extname)(path2).toLowerCase();
   if (extension === ".png") return "image/png";
   if (extension === ".jpg" || extension === ".jpeg") return "image/jpeg";
   if (extension === ".webp") return "image/webp";
@@ -9849,10 +10823,18 @@ function promptImageContentType(path2) {
 var promptCommand = program2.command("prompt").description("Publish prompt listings from structured JSON");
 promptCommand.command("publish <file>").description("Publish one prompt or a batch of prompts from JSON").option("--registry <url>", "Registry API base URL").option("--yes", "Confirm public publishing without an extra reminder").action(async (file, opts) => {
   const registry = registryFromEnvOrDefault(opts.registry);
-  const accessToken = await authTokenForRegistry(registry, { throwOnFailure: true });
-  if (!accessToken) throw new Error("Run aipm login before publishing prompts.");
-  const absoluteFile = (0, import_node_path15.resolve)(file);
-  const parsed = JSON.parse(await (0, import_promises12.readFile)(absoluteFile, "utf8"));
+  let accessToken = await authTokenForRegistry(registry, { throwOnFailure: false });
+  if (!accessToken) {
+    await resolveLoginRequired({
+      ci: opts.ci,
+      purpose: "Publishing prompts requires an AIPM login."
+    });
+    await runLoopbackLogin({ registry, siteUrl: SITE_URL, open: true });
+    accessToken = await authTokenForRegistry(registry, { throwOnFailure: true });
+  }
+  if (!accessToken) throw new Error(`Run ${recommendCmd("aipm login")} before publishing prompts.`);
+  const absoluteFile = (0, import_node_path18.resolve)(file);
+  const parsed = JSON.parse(await (0, import_promises14.readFile)(absoluteFile, "utf8"));
   const rows = Array.isArray(parsed) ? parsed : "prompts" in parsed ? parsed.prompts : [parsed];
   if (rows.length === 0) throw new Error("Prompt publish file contains no prompts.");
   if (!opts.yes) {
@@ -9863,10 +10845,10 @@ promptCommand.command("publish <file>").description("Publish one prompt or a bat
     const { sampleImagePath, ...input2 } = row;
     let sampleImage;
     if (sampleImagePath) {
-      const imagePath = (0, import_node_path15.resolve)((0, import_node_path15.dirname)(absoluteFile), sampleImagePath);
+      const imagePath = (0, import_node_path18.resolve)((0, import_node_path18.dirname)(absoluteFile), sampleImagePath);
       sampleImage = {
-        data: await (0, import_promises12.readFile)(imagePath),
-        filename: (0, import_node_path15.basename)(imagePath),
+        data: await (0, import_promises14.readFile)(imagePath),
+        filename: (0, import_node_path18.basename)(imagePath),
         contentType: promptImageContentType(imagePath)
       };
     }
@@ -9889,12 +10871,12 @@ var publish = program2.command("publish [dir]").description("Stage, validate, an
     publish.help();
     return;
   }
-  const abs = (0, import_node_path15.resolve)(dir);
-  const manifestRaw = await (0, import_promises12.readFile)((0, import_node_path15.join)(abs, "aipm.manifest.json"), "utf8");
+  const abs = (0, import_node_path18.resolve)(dir);
+  const manifestRaw = await (0, import_promises14.readFile)((0, import_node_path18.join)(abs, "aipm.manifest.json"), "utf8");
   const manifest = PackageManifestSchema.parse(JSON.parse(manifestRaw));
   const tarball = await packDirectory(abs);
   const registry = registryFromEnvOrDefault(opts.registry);
-  const result = await publishPackage(registry, manifest.name, tarball, opts.token ?? import_node_process5.env.AIPM_TOKEN);
+  const result = await publishPackage(registry, manifest.name, tarball, opts.token ?? import_node_process6.env.AIPM_TOKEN);
   console.log(`Published ${manifest.name}@${result.version}`);
   console.log(`View: ${packagePageUrl(manifest.name, result.version)}`);
   console.log(`Install: aipm add ${manifest.name}@${result.version} --target ${manifest.targets[0]} --ci`);
@@ -9909,7 +10891,7 @@ publish.command("import <source>").description("Create a package folder from an
   async (source, opts) => initSkill({ ...opts, from: source })
 );
 publish.command("add [files...]").description("Stage files for publishing").action(async (files) => {
-  const state = await addPublishFiles((0, import_node_process5.cwd)(), files);
+  const state = await addPublishFiles((0, import_node_process6.cwd)(), files);
   console.log(`Staged ${state.files.length} file${state.files.length === 1 ? "" : "s"}.`);
   printPublishGuide(
     `Added ${files.length > 0 ? files.join(", ") : "."} to the publish stage, respecting .aipmignore and secret-file exclusions.`,
@@ -9940,7 +10922,7 @@ publish.command("token").description("Open the dashboard page used to generate a
   );
 });
 publish.command("remove <files...>").alias("rm").description("Remove files from the publish stage").action(async (files) => {
-  const state = await removePublishFiles((0, import_node_process5.cwd)(), files);
+  const state = await removePublishFiles((0, import_node_process6.cwd)(), files);
   console.log(`Staged ${state.files.length} file${state.files.length === 1 ? "" : "s"}.`);
   printPublishGuide(
     `Removed ${files.join(", ")} from the publish stage.`,
@@ -9948,7 +10930,7 @@ publish.command("remove <files...>").alias("rm").description("Remove files from
   );
 });
 publish.command("reset").description("Clear staged publish files").action(async () => {
-  await resetPublishState((0, import_node_process5.cwd)());
+  await resetPublishState((0, import_node_process6.cwd)());
   console.log("Cleared publish stage.");
   printPublishGuide(
     "Cleared all staged publish files.",
@@ -9956,7 +10938,7 @@ publish.command("reset").description("Clear staged publish files").action(async
   );
 });
 publish.command("status").description("Show staged publish files").option("--json", "Print machine-readable JSON").action(async (opts) => {
-  const rows = await statusPublishState((0, import_node_process5.cwd)());
+  const rows = await statusPublishState((0, import_node_process6.cwd)());
   if (opts.json) {
     console.log(JSON.stringify({ files: rows }, null, 2));
     return;
@@ -9979,7 +10961,7 @@ publish.command("status").description("Show staged publish files").option("--jso
   );
 });
 publish.command("diff").description("Show staged files that changed since add").action(async () => {
-  const rows = await statusPublishState((0, import_node_process5.cwd)());
+  const rows = await statusPublishState((0, import_node_process6.cwd)());
   const changed = rows.filter((row) => row.changed);
   if (changed.length === 0) {
     console.log("No staged files changed.");
@@ -9996,16 +10978,16 @@ publish.command("diff").description("Show staged files that changed since add").
   );
 });
 publish.command("validate").description("Validate staged files before publish").action(async () => {
-  const result = await validatePublishState((0, import_node_process5.cwd)());
+  const result = await validatePublishState((0, import_node_process6.cwd)());
   console.log(`Valid ${result.manifest.name}@${result.manifest.version} (${result.size} bytes staged).`);
   printPublishGuide(
     `Validated ${result.manifest.name}@${result.manifest.version}; manifest, entry file, staged hashes, ignored paths, package size, and obvious secrets passed.`,
     "Generate a 5-minute token from the dashboard, then run AIPM_TOKEN=<token> aipm publish push."
   );
 });
-publish.command("preview").description("Preview exactly what will be uploaded").option("--json", "Print machine-readable JSON").action((opts) => printPublishPreview((0, import_node_process5.cwd)(), opts.json));
+publish.command("preview").description("Preview exactly what will be uploaded").option("--json", "Print machine-readable JSON").action((opts) => printPublishPreview((0, import_node_process6.cwd)(), opts.json));
 publish.command("push").description("Publish staged files").option("--registry <url>", "Registry base URL").option("--token <token>", "Publish token").option("--yes", "Confirm upload without an extra reminder").option("--verbose", "Print extra diagnostic output").action(async (opts) => {
-  const root = (0, import_node_process5.cwd)();
+  const root = (0, import_node_process6.cwd)();
   const { manifest } = await validatePublishState(root);
   const registry = registryFromEnvOrDefault(opts.registry);
   const tarball = await packStagedFiles(root);
@@ -10020,7 +11002,7 @@ publish.command("push").description("Publish staged files").option("--registry <
     console.log(`Verbose: package ${manifest.name}@${manifest.version}; tarball ${tarball.length} bytes.`);
   }
   for (const entry of staged) console.log(`  ${entry.path}`);
-  const result = await publishPackage(registry, manifest.name, tarball, opts.token ?? import_node_process5.env.AIPM_TOKEN);
+  const result = await publishPackage(registry, manifest.name, tarball, opts.token ?? import_node_process6.env.AIPM_TOKEN);
   console.log(`Published ${manifest.name}@${result.version}`);
   console.log(`View: ${packagePageUrl(manifest.name, result.version)}`);
   console.log(`Install: aipm add ${manifest.name}@${result.version} --target ${manifest.targets[0]} --ci`);
@@ -10052,10 +11034,51 @@ program2.command("list").description("List installed skills and prompts from aip
     }
   }
 });
-program2.command("remove <package-or-prompt>").alias("rm").description("Remove a tracked skill or prompt and its installed files").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).action(async (pkgArg, opts) => {
+program2.command("remove <package-or-prompt>").alias("rm").description("Remove a tracked skill or prompt and its installed files").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--no-init", "Remove by filesystem discovery without reading or writing aipm.package.json / aipm-lock.json").option("--ci", "Non-interactive; fail if --no-init conflicts with an initialized project").action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
-  const project = await readProjectPackageJson(configRoot);
+  const installRoot = resolveInstallRoot(scope);
+  let project = await readProjectPackageJson(configRoot);
+  let useNoInit = await resolveNoInitMode({
+    requested: opts.init === false,
+    projectExists: Boolean(project),
+    ci: opts.ci
+  });
+  if (!useNoInit && !project) {
+    const ensured = await ensureProjectOrOffer({
+      scope,
+      project,
+      ci: opts.ci,
+      registry: DEFAULT_REGISTRY,
+      allowNoInit: true,
+      command: "remove"
+    });
+    if (ensured.action === "no-init") useNoInit = true;
+    else project = ensured.project;
+  }
+  if (useNoInit) {
+    if (parsePromptUrl(pkgArg)) {
+      await resolvePromptRequiresTracking({ ci: opts.ci, command: "remove" });
+      useNoInit = false;
+      if (!project) {
+        project = await createProjectPackageJson({
+          scope,
+          registry: DEFAULT_REGISTRY
+        });
+      }
+    } else {
+      const { name: name2 } = parsePackageArg(pkgArg);
+      const removal = await removeUntrackedPackage({
+        installRoot,
+        configRoot,
+        packageName: name2
+      });
+      console.log(
+        `Removed ${removal.removed.length} untracked ${removal.removed.length === 1 ? "path" : "paths"} for ${name2}.`
+      );
+      return;
+    }
+  }
   if (!project) throw new Error(initRequiredMessage(scope));
   const promptReference = resolveTrackedPrompt(project, pkgArg);
   if (promptReference && project.prompts[promptReference.alias] === promptReference.url) {
@@ -10064,23 +11087,96 @@ program2.command("remove <package-or-prompt>").alias("rm").description("Remove a
     return;
   }
   const { name } = parsePackageArg(pkgArg);
+  const lock = await readLockfile(configRoot);
+  const lockEntry = lock?.packages[name];
+  if (lockEntry) {
+    const otherEntries = Object.entries(lock.packages).filter(([packageName]) => packageName !== name).map(([, entry]) => entry);
+    const removal = await removeInstalledPackageFiles({
+      configRoot,
+      installRoot,
+      entry: lockEntry,
+      otherEntries
+    });
+    console.log(`Deleted ${removal.removed} tracked installed ${removal.removed === 1 ? "file" : "files"}.`);
+    if (removal.retainedShared > 0) {
+      console.log(`Retained ${removal.retainedShared} ${removal.retainedShared === 1 ? "file" : "files"} shared with another installed package.`);
+    }
+  }
   const packages = { ...project.packages };
   delete packages[name];
   await writeProjectPackageJson(configRoot, { ...project, packages });
-  const lock = await readLockfile(configRoot);
   if (lock) {
     const lockPackages = { ...lock.packages };
     delete lockPackages[name];
     await writeLockfile(configRoot, { ...lock, packages: lockPackages });
   }
   console.log(`Removed ${name} from AIPM ${scopeLabel(scope)} files.`);
-  console.log("Adapter-written files are not deleted yet; review your project before committing.");
 });
-program2.command("update [package]").description("Update one installed package, or all installed packages, to the latest registry version").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").action(async (pkgArg, opts) => {
+program2.command("update [package]").description("Update one installed package, or all installed packages, to the latest registry version").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--target <tool>", "cursor, claude, codex, or *").option("--token <token>", "Install token for private packages").option("--ci", "Non-interactive").option("--no-init", "Update without reading or writing aipm.package.json / aipm-lock.json (requires a package arg; always latest)").action(async (pkgArg, opts) => {
   const scope = { global: opts.global };
   const configRoot = resolveConfigRoot(scope);
   const installRoot = resolveInstallRoot(scope);
   let project = await readProjectPackageJson(configRoot);
+  let useNoInit = await resolveNoInitMode({
+    requested: opts.init === false,
+    projectExists: Boolean(project),
+    ci: opts.ci
+  });
+  if (!useNoInit && !project) {
+    const ensured = await ensureProjectOrOffer({
+      scope,
+      project,
+      ci: opts.ci,
+      registry: resolveRegistryUrl(null, opts.registry, DEFAULT_REGISTRY),
+      target: opts.target,
+      allowNoInit: Boolean(pkgArg) && !parsePromptUrl(pkgArg ?? ""),
+      command: "update"
+    });
+    if (ensured.action === "no-init") useNoInit = true;
+    else project = ensured.project;
+  }
+  if (useNoInit) {
+    if (!pkgArg) {
+      throw new Error(
+        `Update with --no-init requires a package: ${recommendCmd("aipm update <@scope/pkg> --no-init")}`
+      );
+    }
+    if (parsePromptUrl(pkgArg)) {
+      await resolvePromptRequiresTracking({ ci: opts.ci, command: "update" });
+      useNoInit = false;
+      if (!project) {
+        project = await createProjectPackageJson({
+          scope,
+          registry: resolveRegistryUrl(null, opts.registry, DEFAULT_REGISTRY),
+          target: opts.target
+        });
+      }
+    } else {
+      const registry2 = resolveRegistryUrl(null, opts.registry, DEFAULT_REGISTRY);
+      const { name } = parsePackageArg(pkgArg);
+      const token2 = await tokenForRead(registry2, opts.token);
+      const version = await latestVersionForPackage(registry2, name, token2);
+      const syntheticProject = {
+        schemaVersion: "0.1",
+        registry: registry2,
+        packages: {},
+        prompts: {}
+      };
+      await installOnePackageWithRecovery({
+        configRoot,
+        installRoot,
+        registry: registry2,
+        name,
+        version,
+        project: syntheticProject,
+        explicitTarget: parseTargetFlag(opts.target),
+        ci: opts.ci,
+        token: token2,
+        track: false
+      });
+      return;
+    }
+  }
   if (!project) throw new Error(initRequiredMessage(scope));
   const registry = resolveRegistryUrl(project, opts.registry, DEFAULT_REGISTRY);
   const requestedPrompt = pkgArg ? resolveTrackedPrompt(project, pkgArg) : null;
@@ -10094,7 +11190,8 @@ program2.command("update [package]").description("Update one installed package,
       project,
       reference: requestedPrompt,
       track: false,
-      updateOnly: true
+      updateOnly: true,
+      ci: opts.ci
     });
     console.log(result.changed ? `Updated prompt ${result.prompt.title} \u2192 ${result.path}` : `Prompt unchanged: ${result.prompt.title}`);
     return;
@@ -10108,7 +11205,7 @@ program2.command("update [package]").description("Update one installed package,
       packages: { ...project.packages, [name]: version }
     };
     await writeProjectPackageJson(configRoot, project);
-    await installOnePackage({
+    await installOnePackageWithRecovery({
       configRoot,
       installRoot,
       registry,
@@ -10130,7 +11227,8 @@ program2.command("update [package]").description("Update one installed package,
         project,
         reference: { ...reference, alias },
         track: false,
-        updateOnly: true
+        updateOnly: true,
+        ci: opts.ci
       });
       console.log(result.changed ? `Updated prompt ${result.prompt.title} \u2192 ${result.path}` : `Prompt unchanged: ${result.prompt.title}`);
     }
@@ -10141,6 +11239,10 @@ program2.command("update [package]").description("Update one installed package,
 });
 program2.command("doctor").description("Check PATH, Node, registry, project config, and publish readiness").option(GLOBAL_OPTION, GLOBAL_OPTION_DESC).option("--registry <url>", "Registry base URL").option("--json", "Print machine-readable JSON").option("--publish", "Only show publish-readiness checks").action((opts) => runDoctor(opts));
 program2.parseAsync(normalizedArgv).catch((err) => {
+  if (err.name === "RecoveryCancelledError" || err.name === "SelectCancelledError") {
+    printNote({ type: "info", title: "Cancelled", message: err.message || "Cancelled." });
+    process.exit(130);
+  }
   console.error(err.message);
   const message = err.message.toLowerCase();
   if (message.includes("token") || message.includes("unauthorized") || message.includes("forbidden")) {