@annals/agent-mesh 0.16.0 → 0.16.2

package/dist/index.js

@@ -2562,7 +2562,7 @@ var ERROR_HINTS = {
   agent_offline: "Agent must be online for first publish. Run `agent-mesh connect` first.",
   email_required: "Email required. Visit https://agents.hot/settings to add one.",
   github_required: "GitHub account required. Visit https://agents.hot/settings to link one.",
-  validation_error: "Invalid input. Check your skill.json or command flags.",
+  validation_error: "Invalid input. Check your SKILL.md frontmatter or command flags.",
   permission_denied: "You don't have permission to modify this skill.",
   file_too_large: "Package file exceeds the 50MB limit.",
   subscription_required: "This is a private agent. Subscribe first: agent-mesh subscribe <author-login>"
@@ -2593,6 +2593,31 @@ var PlatformClient = class {
   async del(path, body) {
     return this.request("DELETE", path, body);
   }
+  async getRaw(path) {
+    const url = `${this.baseUrl}${path}`;
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${this.token}` }
+      });
+    } catch (err) {
+      throw new PlatformApiError(0, "network_error", `Network error: ${err.message}`);
+    }
+    if (!res.ok) {
+      let errorCode = "unknown";
+      let message = `HTTP ${res.status}`;
+      try {
+        const data = await res.json();
+        errorCode = data.error ?? errorCode;
+        message = data.error_description ?? data.message ?? message;
+      } catch {
+      }
+      const hint = ERROR_HINTS[errorCode];
+      throw new PlatformApiError(res.status, errorCode, hint ?? message);
+    }
+    return res;
+  }
   async postFormData(path, formData) {
     const url = `${this.baseUrl}${path}`;
     let res;
@@ -3127,11 +3152,11 @@ function registerChatCommand(program2) {
 }
 
 // src/commands/skills.ts
-import { readFile as readFile4, writeFile as writeFile2, readdir as readdir2, stat as stat3, mkdir as mkdir2 } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile3, readdir as readdir2, mkdir as mkdir2, rm } from "fs/promises";
 import { join as join8, resolve, relative as relative4 } from "path";
 
 // src/utils/skill-parser.ts
-import { readFile as readFile3, stat as stat2 } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile2, stat as stat2 } from "fs/promises";
 import { join as join7 } from "path";
 function parseSkillMd(raw) {
   const trimmed = raw.trimStart();
@@ -3192,36 +3217,13 @@ function parseSkillMd(raw) {
   return { frontmatter, content };
 }
 async function loadSkillManifest(dir) {
-  const skillJsonPath = join7(dir, "skill.json");
-  try {
-    const raw = await readFile3(skillJsonPath, "utf-8");
-    const data = JSON.parse(raw);
-    if (!data.name) throw new Error("skill.json missing required field: name");
-    if (!data.version) throw new Error("skill.json missing required field: version");
-    return {
-      name: data.name,
-      version: data.version,
-      description: data.description,
-      main: data.main || "SKILL.md",
-      category: data.category,
-      tags: data.tags,
-      author: data.author,
-      source_url: data.source_url,
-      private: data.private,
-      files: data.files
-    };
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      throw err;
-    }
-  }
   const skillMdPath = join7(dir, "SKILL.md");
   try {
     const raw = await readFile3(skillMdPath, "utf-8");
     const { frontmatter } = parseSkillMd(raw);
     const name = frontmatter.name;
     if (!name) {
-      throw new Error('No skill.json found and SKILL.md has no "name" in frontmatter');
+      throw new Error('SKILL.md has no "name" in frontmatter');
     }
     return {
       name,
@@ -3236,7 +3238,7 @@ async function loadSkillManifest(dir) {
     };
   } catch (err) {
     if (err.code === "ENOENT") {
-      throw new Error(`No skill.json or SKILL.md found in ${dir}`);
+      throw new Error(`No SKILL.md found in ${dir}`);
     }
     throw err;
   }
@@ -3249,9 +3251,33 @@ async function pathExists(p) {
     return false;
   }
 }
+async function updateFrontmatterField(filePath, field, value) {
+  const raw = await readFile3(filePath, "utf-8");
+  const trimmed = raw.trimStart();
+  if (!trimmed.startsWith("---")) {
+    throw new Error("SKILL.md has no frontmatter block");
+  }
+  const endIdx = trimmed.indexOf("\n---", 3);
+  if (endIdx === -1) {
+    throw new Error("SKILL.md has no frontmatter block");
+  }
+  const yamlBlock = trimmed.slice(4, endIdx);
+  const after = trimmed.slice(endIdx);
+  const fieldRegex = new RegExp(`^(${field}\\s*:\\s*)(.*)$`, "m");
+  if (fieldRegex.test(yamlBlock)) {
+    const updated = yamlBlock.replace(fieldRegex, `$1${value}`);
+    await writeFile2(filePath, `---
+${updated}${after}`);
+  } else {
+    const updated = `${yamlBlock}
+${field}: ${value}`;
+    await writeFile2(filePath, `---
+${updated}${after}`);
+  }
+}
 
 // src/utils/zip.ts
-import { deflateRawSync } from "zlib";
+import { deflateRawSync, inflateRawSync } from "zlib";
 function dosTime(date) {
   return {
     time: date.getHours() << 11 | date.getMinutes() << 5 | date.getSeconds() >> 1,
@@ -3347,6 +3373,55 @@ function createZipBuffer(entries) {
   chunks.push(eocd);
   return Buffer.concat(chunks);
 }
+function extractZipBuffer(buf) {
+  const entries = [];
+  let eocdOffset = -1;
+  for (let i = buf.length - 22; i >= 0; i--) {
+    if (buf.readUInt32LE(i) === 101010256) {
+      eocdOffset = i;
+      break;
+    }
+  }
+  if (eocdOffset === -1) {
+    throw new Error("Invalid ZIP: EOCD not found");
+  }
+  const entryCount = buf.readUInt16LE(eocdOffset + 10);
+  const centralDirOffset = buf.readUInt32LE(eocdOffset + 16);
+  let offset = centralDirOffset;
+  for (let i = 0; i < entryCount; i++) {
+    if (buf.readUInt32LE(offset) !== 33639248) {
+      throw new Error(`Invalid ZIP: bad central directory signature at ${offset}`);
+    }
+    const compressionMethod = buf.readUInt16LE(offset + 10);
+    const compressedSize = buf.readUInt32LE(offset + 20);
+    const uncompressedSize = buf.readUInt32LE(offset + 24);
+    const nameLen = buf.readUInt16LE(offset + 28);
+    const extraLen = buf.readUInt16LE(offset + 30);
+    const commentLen = buf.readUInt16LE(offset + 32);
+    const localHeaderOffset = buf.readUInt32LE(offset + 42);
+    const name = buf.subarray(offset + 46, offset + 46 + nameLen).toString("utf-8");
+    if (!name.endsWith("/")) {
+      const localNameLen = buf.readUInt16LE(localHeaderOffset + 26);
+      const localExtraLen = buf.readUInt16LE(localHeaderOffset + 28);
+      const dataOffset = localHeaderOffset + 30 + localNameLen + localExtraLen;
+      const compressedData = buf.subarray(dataOffset, dataOffset + compressedSize);
+      let data;
+      if (compressionMethod === 0) {
+        data = Buffer.from(compressedData);
+      } else if (compressionMethod === 8) {
+        data = inflateRawSync(compressedData);
+      } else {
+        throw new Error(`Unsupported compression method: ${compressionMethod}`);
+      }
+      if (data.length !== uncompressedSize) {
+        throw new Error(`Size mismatch for ${name}: expected ${uncompressedSize}, got ${data.length}`);
+      }
+      entries.push({ path: name, data });
+    }
+    offset += 46 + nameLen + extraLen + commentLen;
+  }
+  return entries;
+}
 
 // src/commands/skills.ts
 var slog = {
@@ -3379,31 +3454,37 @@ function outputError(error, message, hint) {
 function resolveSkillDir(pathArg) {
   return pathArg ? resolve(pathArg) : process.cwd();
 }
+function parseSkillRef(ref) {
+  if (!ref.includes("/")) {
+    outputError("validation_error", `Invalid skill reference: "${ref}". Use author/slug format (e.g. kcsx/code-review)`);
+  }
+  const [authorLogin, slug] = ref.split("/", 2);
+  if (!authorLogin || !slug) {
+    outputError("validation_error", `Invalid skill reference: "${ref}". Use author/slug format (e.g. kcsx/code-review)`);
+  }
+  return { authorLogin, slug };
+}
+function skillApiPath(authorLogin, slug) {
+  return `/api/skills/${encodeURIComponent(authorLogin)}/${encodeURIComponent(slug)}`;
+}
+async function resolveSkillsRootAsync(pathArg) {
+  const projectRoot = pathArg ? resolve(pathArg) : process.cwd();
+  const claudeDir = join8(projectRoot, ".claude", "skills");
+  if (await pathExists(claudeDir)) {
+    return { projectRoot, skillsDir: claudeDir, convention: "claude" };
+  }
+  const agentsDir = join8(projectRoot, ".agents", "skills");
+  if (await pathExists(agentsDir)) {
+    return { projectRoot, skillsDir: agentsDir, convention: "agents" };
+  }
+  return { projectRoot, skillsDir: claudeDir, convention: "claude" };
+}
 async function collectPackFiles(dir, manifest) {
   const results = [];
-  if (manifest.files && manifest.files.length > 0) {
-    for (const pattern of manifest.files) {
-      const fullPath = join8(dir, pattern);
-      try {
-        const s = await stat3(fullPath);
-        if (s.isDirectory()) {
-          const sub = await walkDir(fullPath);
-          for (const f of sub) {
-            results.push(relative4(dir, f));
-          }
-        } else {
-          results.push(pattern);
-        }
-      } catch {
-      }
-    }
-  } else {
-    const all = await walkDir(dir);
-    for (const f of all) {
-      const rel = relative4(dir, f);
-      if (rel === "skill.json") continue;
-      results.push(rel);
-    }
+  const all = await walkDir(dir);
+  for (const f of all) {
+    const rel = relative4(dir, f);
+    results.push(rel);
   }
   const mainFile = manifest.main || "SKILL.md";
   if (!results.includes(mainFile)) {
@@ -3474,8 +3555,42 @@ function bumpVersion(current, bump) {
       throw new Error(`Invalid bump type: ${bump}. Use major, minor, patch, or a version string.`);
   }
 }
+async function downloadAndInstallSkill(client, authorLogin, slug, skillsDir) {
+  const meta = await client.get(skillApiPath(authorLogin, slug));
+  const targetDir = join8(skillsDir, slug);
+  await mkdir2(targetDir, { recursive: true });
+  if (meta.has_files) {
+    const res = await client.getRaw(`${skillApiPath(authorLogin, slug)}/download`);
+    const arrayBuf = await res.arrayBuffer();
+    const buf = Buffer.from(arrayBuf);
+    const entries = extractZipBuffer(buf);
+    for (const entry of entries) {
+      const filePath = join8(targetDir, entry.path);
+      const dir = join8(filePath, "..");
+      await mkdir2(dir, { recursive: true });
+      await writeFile3(filePath, entry.data);
+    }
+    return {
+      slug,
+      name: meta.name,
+      version: meta.version || "1.0.0",
+      files_count: entries.length
+    };
+  } else {
+    const res = await client.getRaw(`${skillApiPath(authorLogin, slug)}/raw`);
+    const content = await res.text();
+    await writeFile3(join8(targetDir, "SKILL.md"), content);
+    return {
+      slug,
+      name: meta.name,
+      version: meta.version || "1.0.0",
+      files_count: 1
+    };
+  }
+}
 var SKILL_MD_TEMPLATE = `---
 name: {{name}}
+description: "{{description}}"
 version: 1.0.0
 ---
 
@@ -3487,62 +3602,31 @@ version: 1.0.0
 
 Describe how to use this skill.
 `;
-var SKILL_JSON_TEMPLATE = (name, description) => ({
-  name,
-  version: "1.0.0",
-  description,
-  main: "SKILL.md",
-  category: "general",
-  tags: [],
-  files: ["SKILL.md"]
-});
 function registerSkillsCommand(program2) {
-  const skills = program2.command("skills").description("Manage skill packages (publish, pack, version)");
+  const skills = program2.command("skills").description("Manage skill packages (publish, install, pack, version)");
   skills.command("init [path]").description("Initialize a new skill project").option("--name <name>", "Skill name").option("--description <desc>", "Skill description").action(async (pathArg, opts) => {
     try {
       const dir = resolveSkillDir(pathArg);
       await mkdir2(dir, { recursive: true });
-      let name = opts.name;
-      let description = opts.description || "";
       const skillMdPath = join8(dir, "SKILL.md");
-      const skillJsonPath = join8(dir, "skill.json");
-      if (await pathExists(skillJsonPath)) {
-        outputError("already_exists", "skill.json already exists in this directory");
-      }
       if (await pathExists(skillMdPath)) {
         const raw = await readFile4(skillMdPath, "utf-8");
         const { frontmatter } = parseSkillMd(raw);
         if (frontmatter.name) {
-          name = name || frontmatter.name;
-          description = description || frontmatter.description || "";
-          const manifest2 = {
-            name,
-            version: frontmatter.version || "1.0.0",
-            description,
-            main: "SKILL.md",
-            category: frontmatter.category || "general",
-            tags: frontmatter.tags || [],
-            author: frontmatter.author,
-            source_url: frontmatter.source_url,
-            files: ["SKILL.md"]
-          };
-          await writeFile2(skillJsonPath, JSON.stringify(manifest2, null, 2) + "\n");
-          slog.info(`Migrated frontmatter from SKILL.md to skill.json`);
-          outputJson({ success: true, path: skillJsonPath, migrated: true });
+          slog.info(`SKILL.md already exists with name: ${frontmatter.name}`);
+          outputJson({ success: true, exists: true, path: skillMdPath });
           return;
         }
       }
+      let name = opts.name;
+      const description = opts.description || "";
       if (!name) {
         name = dir.split("/").pop()?.replace(/[^a-z0-9-]/gi, "-").toLowerCase() || "my-skill";
       }
-      const manifest = SKILL_JSON_TEMPLATE(name, description);
-      await writeFile2(skillJsonPath, JSON.stringify(manifest, null, 2) + "\n");
-      if (!await pathExists(skillMdPath)) {
-        const content = SKILL_MD_TEMPLATE.replace(/\{\{name\}\}/g, name).replace(/\{\{description\}\}/g, description || "A new skill.");
-        await writeFile2(skillMdPath, content);
-      }
+      const content = SKILL_MD_TEMPLATE.replace(/\{\{name\}\}/g, name).replace(/\{\{description\}\}/g, description || "A new skill.");
+      await writeFile3(skillMdPath, content);
       slog.info(`Initialized skill: ${name}`);
-      outputJson({ success: true, path: skillJsonPath });
+      outputJson({ success: true, path: skillMdPath });
     } catch (err) {
       if (err instanceof Error && err.message.includes("already_exists")) throw err;
       outputError("init_failed", err.message);
@@ -3554,7 +3638,7 @@ function registerSkillsCommand(program2) {
       const manifest = await loadSkillManifest(dir);
       const result = await packSkill(dir, manifest);
       const outPath = join8(dir, result.filename);
-      await writeFile2(outPath, result.buffer);
+      await writeFile3(outPath, result.buffer);
       slog.info(`Packed ${result.files.length} files \u2192 ${result.filename} (${result.size} bytes)`);
       outputJson({
         success: true,
@@ -3624,11 +3708,13 @@ function registerSkillsCommand(program2) {
       const client = createClient();
       const result = await client.postFormData("/api/skills/publish", formData);
       slog.success(`Skill ${result.action}: ${manifest.name}`);
+      const authorLogin = result.skill.author_login;
+      const skillUrl = authorLogin ? `https://agents.hot/skills/${authorLogin}/${result.skill.slug}` : `https://agents.hot/skills/${result.skill.slug}`;
       outputJson({
         success: true,
         action: result.action,
         skill: result.skill,
-        url: `https://agents.hot/skills/${result.skill.slug}`
+        url: skillUrl
       });
     } catch (err) {
       if (err instanceof PlatformApiError) {
@@ -3637,16 +3723,17 @@ function registerSkillsCommand(program2) {
       outputError("publish_failed", err.message);
     }
   });
-  skills.command("info <slug>").description("View skill details").option("--human", "Human-readable output").action(async (slug, opts) => {
+  skills.command("info <ref>").description("View skill details (use author/slug format)").option("--human", "Human-readable output").action(async (ref, opts) => {
     try {
+      const { authorLogin, slug } = parseSkillRef(ref);
       const client = createClient();
-      const data = await client.get(`/api/skills/${encodeURIComponent(slug)}`);
+      const data = await client.get(skillApiPath(authorLogin, slug));
       if (opts.human) {
         console.log("");
         console.log(`  ${BOLD}${data.name}${RESET} v${data.version || "?"}`);
         if (data.description) console.log(`  ${data.description}`);
-        console.log(`  ${GRAY}slug${RESET}      ${data.slug}`);
-        console.log(`  ${GRAY}author${RESET}    ${data.author || "\u2014"}`);
+        console.log(`  ${GRAY}ref${RESET}       ${authorLogin}/${data.slug}`);
+        console.log(`  ${GRAY}author${RESET}    ${data.author_login || data.author || "\u2014"}`);
         console.log(`  ${GRAY}category${RESET}  ${data.category || "\u2014"}`);
         console.log(`  ${GRAY}installs${RESET}  ${data.installs ?? 0}`);
         console.log(`  ${GRAY}private${RESET}   ${data.is_private ? "yes" : "no"}`);
@@ -3675,12 +3762,14 @@ function registerSkillsCommand(program2) {
           const table = renderTable(
             [
               { key: "name", label: "NAME", width: 24 },
+              { key: "author", label: "AUTHOR", width: 16 },
               { key: "version", label: "VERSION", width: 12 },
               { key: "installs", label: "INSTALLS", width: 12, align: "right" },
               { key: "private", label: "PRIVATE", width: 10 }
             ],
             data.owned.map((s) => ({
               name: s.name,
+              author: s.author_login || s.author || "\u2014",
               version: s.version || "\u2014",
               installs: String(s.installs ?? 0),
               private: s.is_private ? "yes" : `${GREEN}no${RESET}`
@@ -3698,7 +3787,7 @@ function registerSkillsCommand(program2) {
             ],
             data.authorized.map((s) => ({
               name: s.name,
-              author: s.author || "\u2014",
+              author: s.author_login || s.author || "\u2014",
               version: s.version || "\u2014"
             }))
           );
@@ -3714,11 +3803,12 @@ function registerSkillsCommand(program2) {
       outputError("list_failed", err.message);
     }
   });
-  skills.command("unpublish <slug>").description("Unpublish a skill").action(async (slug) => {
+  skills.command("unpublish <ref>").description("Unpublish a skill (use author/slug format)").action(async (ref) => {
     try {
+      const { authorLogin, slug } = parseSkillRef(ref);
       const client = createClient();
-      const result = await client.del(`/api/skills/${encodeURIComponent(slug)}`);
-      slog.success(`Skill unpublished: ${slug}`);
+      const result = await client.del(skillApiPath(authorLogin, slug));
+      slog.success(`Skill unpublished: ${authorLogin}/${slug}`);
       outputJson(result);
     } catch (err) {
       if (err instanceof PlatformApiError) {
@@ -3730,16 +3820,15 @@ function registerSkillsCommand(program2) {
   skills.command("version <bump> [path]").description("Bump skill version (patch | minor | major | x.y.z)").action(async (bump, pathArg) => {
     try {
       const dir = resolveSkillDir(pathArg);
-      const skillJsonPath = join8(dir, "skill.json");
-      if (!await pathExists(skillJsonPath)) {
-        outputError("not_found", "No skill.json found. Run `agent-mesh skills init` first.");
+      const skillMdPath = join8(dir, "SKILL.md");
+      if (!await pathExists(skillMdPath)) {
+        outputError("not_found", "No SKILL.md found. Run `agent-mesh skills init` first.");
       }
-      const raw = await readFile4(skillJsonPath, "utf-8");
-      const data = JSON.parse(raw);
-      const oldVersion = data.version || "0.0.0";
+      const raw = await readFile4(skillMdPath, "utf-8");
+      const { frontmatter } = parseSkillMd(raw);
+      const oldVersion = frontmatter.version || "0.0.0";
       const newVersion = bumpVersion(oldVersion, bump);
-      data.version = newVersion;
-      await writeFile2(skillJsonPath, JSON.stringify(data, null, 2) + "\n");
+      await updateFrontmatterField(skillMdPath, "version", newVersion);
       slog.success(`${oldVersion} \u2192 ${newVersion}`);
       outputJson({ success: true, old: oldVersion, new: newVersion });
     } catch (err) {
@@ -3747,6 +3836,196 @@ function registerSkillsCommand(program2) {
       outputError("version_failed", err.message);
     }
   });
+  skills.command("install <ref> [path]").description("Install a skill from agents.hot (use author/slug format)").option("--force", "Overwrite if already installed").action(async (ref, pathArg, opts) => {
+    try {
+      const { authorLogin, slug } = parseSkillRef(ref);
+      const { skillsDir } = await resolveSkillsRootAsync(pathArg);
+      const targetDir = join8(skillsDir, slug);
+      if (await pathExists(targetDir)) {
+        if (!opts.force) {
+          outputError("already_installed", `Skill "${slug}" is already installed at ${targetDir}. Use --force to overwrite.`);
+        }
+        await rm(targetDir, { recursive: true, force: true });
+      }
+      slog.info(`Installing ${authorLogin}/${slug}...`);
+      const client = createClient();
+      const result = await downloadAndInstallSkill(client, authorLogin, slug, skillsDir);
+      slog.success(`Installed ${result.name} (${result.files_count} files)`);
+      outputJson({
+        success: true,
+        skill: {
+          author: authorLogin,
+          slug: result.slug,
+          name: result.name,
+          version: result.version
+        },
+        installed_to: targetDir,
+        files_count: result.files_count
+      });
+    } catch (err) {
+      if (err instanceof PlatformApiError) {
+        outputError(err.errorCode, err.message);
+      }
+      outputError("install_failed", err.message);
+    }
+  });
+  skills.command("update [ref] [path]").description("Update installed skill(s) from agents.hot").action(async (ref, pathArg) => {
+    try {
+      const { skillsDir } = await resolveSkillsRootAsync(pathArg);
+      const client = createClient();
+      const updated = [];
+      const skipped = [];
+      const failed = [];
+      if (ref) {
+        const { authorLogin, slug } = parseSkillRef(ref);
+        const targetDir = join8(skillsDir, slug);
+        if (!await pathExists(targetDir)) {
+          outputError("not_installed", `Skill "${slug}" is not installed. Use "skills install ${ref}" first.`);
+        }
+        const skillMdPath = join8(targetDir, "SKILL.md");
+        let localVersion = "0.0.0";
+        if (await pathExists(skillMdPath)) {
+          const raw = await readFile4(skillMdPath, "utf-8");
+          const { frontmatter } = parseSkillMd(raw);
+          localVersion = frontmatter.version || "0.0.0";
+        }
+        const remote = await client.get(skillApiPath(authorLogin, slug));
+        const remoteVersion = remote.version || "0.0.0";
+        if (remoteVersion === localVersion) {
+          slog.info(`${slug} is already up to date (v${localVersion})`);
+          skipped.push({ slug, reason: "up_to_date" });
+        } else {
+          slog.info(`Updating ${slug}: v${localVersion} \u2192 v${remoteVersion}...`);
+          await rm(targetDir, { recursive: true, force: true });
+          await downloadAndInstallSkill(client, authorLogin, slug, skillsDir);
+          updated.push({ slug, name: remote.name, old_version: localVersion, new_version: remoteVersion });
+          slog.success(`Updated ${slug} to v${remoteVersion}`);
+        }
+      } else {
+        if (!await pathExists(skillsDir)) {
+          outputError("no_skills_dir", `Skills directory not found: ${skillsDir}`);
+        }
+        const entries = await readdir2(skillsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const slug = entry.name;
+          const skillMdPath = join8(skillsDir, slug, "SKILL.md");
+          if (!await pathExists(skillMdPath)) {
+            skipped.push({ slug, reason: "no_skill_md" });
+            continue;
+          }
+          const raw = await readFile4(skillMdPath, "utf-8");
+          const { frontmatter } = parseSkillMd(raw);
+          const localVersion = frontmatter.version || "0.0.0";
+          const authorLogin = frontmatter.author;
+          if (!authorLogin) {
+            skipped.push({ slug, reason: "no_author_in_frontmatter" });
+            continue;
+          }
+          try {
+            const remote = await client.get(skillApiPath(authorLogin, slug));
+            const remoteVersion = remote.version || "0.0.0";
+            if (remoteVersion === localVersion) {
+              skipped.push({ slug, reason: "up_to_date" });
+            } else {
+              slog.info(`Updating ${slug}: v${localVersion} \u2192 v${remoteVersion}...`);
+              await rm(join8(skillsDir, slug), { recursive: true, force: true });
+              await downloadAndInstallSkill(client, authorLogin, slug, skillsDir);
+              updated.push({ slug, name: remote.name, old_version: localVersion, new_version: remoteVersion });
+            }
+          } catch (err) {
+            failed.push({ slug, error: err.message });
+          }
+        }
+      }
+      slog.success(`Update complete: ${updated.length} updated, ${skipped.length} skipped, ${failed.length} failed`);
+      outputJson({ success: true, updated, skipped, failed });
+    } catch (err) {
+      if (err instanceof PlatformApiError) {
+        outputError(err.errorCode, err.message);
+      }
+      outputError("update_failed", err.message);
+    }
+  });
+  skills.command("remove <slug> [path]").description("Remove a locally installed skill").action(async (slug, pathArg) => {
+    try {
+      const { skillsDir } = await resolveSkillsRootAsync(pathArg);
+      const targetDir = join8(skillsDir, slug);
+      if (!await pathExists(targetDir)) {
+        outputError("not_installed", `Skill "${slug}" is not installed at ${targetDir}`);
+      }
+      await rm(targetDir, { recursive: true, force: true });
+      slog.success(`Removed skill: ${slug}`);
+      outputJson({ success: true, removed: slug, path: targetDir });
+    } catch (err) {
+      outputError("remove_failed", err.message);
+    }
+  });
+  skills.command("installed [path]").description("List locally installed skills").option("--check-updates", "Check for available updates").option("--human", "Human-readable table output").action(async (pathArg, opts) => {
+    try {
+      const { skillsDir } = await resolveSkillsRootAsync(pathArg);
+      if (!await pathExists(skillsDir)) {
+        if (opts.human) {
+          slog.info(`No skills directory found at ${skillsDir}`);
+          return;
+        }
+        outputJson({ skills_dir: skillsDir, skills: [] });
+        return;
+      }
+      const entries = await readdir2(skillsDir, { withFileTypes: true });
+      const skills2 = [];
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const slug = entry.name;
+        const skillMdPath = join8(skillsDir, slug, "SKILL.md");
+        if (!await pathExists(skillMdPath)) continue;
+        const raw = await readFile4(skillMdPath, "utf-8");
+        const { frontmatter } = parseSkillMd(raw);
+        const skillInfo = {
+          slug,
+          name: frontmatter.name || slug,
+          version: frontmatter.version || "0.0.0",
+          author: frontmatter.author
+        };
+        if (opts.checkUpdates && skillInfo.author) {
+          try {
+            const client = createClient();
+            const remote = await client.get(skillApiPath(skillInfo.author, slug));
+            skillInfo.remote_version = remote.version || "0.0.0";
+            skillInfo.has_update = skillInfo.remote_version !== skillInfo.version;
+          } catch {
+          }
+        }
+        skills2.push(skillInfo);
+      }
+      if (opts.human) {
+        if (skills2.length === 0) {
+          slog.info("No skills installed.");
+          return;
+        }
+        const columns = [
+          { key: "name", label: "NAME", width: 24 },
+          { key: "version", label: "VERSION", width: 12 },
+          { key: "author", label: "AUTHOR", width: 16 }
+        ];
+        if (opts.checkUpdates) {
+          columns.push({ key: "update", label: "UPDATE", width: 14 });
+        }
+        const rows = skills2.map((s) => ({
+          name: s.name,
+          version: s.version,
+          author: s.author || "\u2014",
+          update: s.has_update ? `${GREEN}${s.remote_version}${RESET}` : "\u2014"
+        }));
+        slog.banner("Installed Skills");
+        console.log(renderTable(columns, rows));
+        return;
+      }
+      outputJson({ skills_dir: skillsDir, skills: skills2 });
+    } catch (err) {
+      outputError("installed_failed", err.message);
+    }
+  });
 }
 
 // src/commands/discover.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@annals/agent-mesh",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "CLI bridge connecting local AI agents to the Agents.Hot platform",
   "type": "module",
   "bin": {