@anytio/pspm 0.0.5 → 0.1.0

package/dist/index.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import { readFileSync } from 'fs';
-import { dirname, join, relative } from 'path';
-import { fileURLToPath, URL } from 'url';
+import { dirname, join, basename, relative } from 'path';
+import { fileURLToPath, URL as URL$1 } from 'url';
 import { Command } from 'commander';
-import { stat, writeFile, mkdir, rm, access, readFile, readdir, unlink } from 'fs/promises';
 import { createHash, randomBytes } from 'crypto';
 import * as semver from 'semver';
+import { stat, writeFile, readdir, mkdir, rm, rename, access as access$1, readFile, lstat, cp, unlink, readlink, symlink } from 'fs/promises';
 import { homedir } from 'os';
 import * as ini from 'ini';
+import { checkbox } from '@inquirer/prompts';
+import { createInterface } from 'readline';
 import http from 'http';
 import open from 'open';
 import { exec as exec$1 } from 'child_process';
@@ -18,6 +20,36 @@ function calculateIntegrity(data) {
   return `sha256-${hash}`;
 }
 
+// ../../packages/shared/pspm-types/src/manifest.ts
+var DEFAULT_SKILL_FILES = [
+  "SKILL.md",
+  "runtime",
+  "scripts",
+  "data"
+];
+var PSPM_SCHEMA_URL = "https://pspm.dev/schema/v1/pspm.json";
+function validateManifest(manifest) {
+  if (!manifest.name) {
+    return { valid: false, error: "Manifest must have a 'name' field" };
+  }
+  if (!manifest.version) {
+    return { valid: false, error: "Manifest must have a 'version' field" };
+  }
+  if (!/^[a-z][a-z0-9_-]*$/.test(manifest.name)) {
+    return {
+      valid: false,
+      error: "Name must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores"
+    };
+  }
+  if (!/^\d+\.\d+\.\d+/.test(manifest.version)) {
+    return {
+      valid: false,
+      error: "Version must be a valid semantic version (e.g., 1.0.0)"
+    };
+  }
+  return { valid: true };
+}
+
 // ../../packages/shared/pspm-types/src/specifier.ts
 var SPECIFIER_PATTERN = /^@user\/([a-zA-Z0-9_-]+)\/([a-z][a-z0-9_-]*)(?:@(.+))?$/;
 function parseSkillSpecifier(specifier) {
@@ -31,6 +63,41 @@ function parseSkillSpecifier(specifier) {
     versionRange: match[3]
   };
 }
+var GITHUB_SPECIFIER_PATTERN = /^github:([a-zA-Z0-9_-]+)\/([a-zA-Z0-9_.-]+)(\/[^@]+)?(?:@(.+))?$/;
+function parseGitHubSpecifier(specifier) {
+  const match = specifier.match(GITHUB_SPECIFIER_PATTERN);
+  if (!match) {
+    return null;
+  }
+  const [, owner, repo, pathWithSlash, ref] = match;
+  return {
+    owner,
+    repo,
+    // Remove leading slash from path
+    path: pathWithSlash ? pathWithSlash.slice(1) : void 0,
+    ref: ref || void 0
+  };
+}
+function formatGitHubSpecifier(spec) {
+  let result = `github:${spec.owner}/${spec.repo}`;
+  if (spec.path) {
+    result += `/${spec.path}`;
+  }
+  if (spec.ref) {
+    result += `@${spec.ref}`;
+  }
+  return result;
+}
+function getGitHubSkillName(spec) {
+  if (spec.path) {
+    const segments = spec.path.split("/").filter(Boolean);
+    return segments[segments.length - 1];
+  }
+  return spec.repo;
+}
+function isGitHubSpecifier(specifier) {
+  return specifier.startsWith("github:");
+}
 function resolveVersion(range, availableVersions) {
   const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
   if (!range || range === "latest" || range === "*") {
@@ -53,13 +120,16 @@ function getConfig() {
 async function customFetch(url, options) {
   const { baseUrl, apiKey } = getConfig();
   const fullUrl = `${baseUrl}${url}`;
+  const headers = {
+    ...options.headers ?? {},
+    "Content-Type": "application/json"
+  };
+  if (apiKey) {
+    headers.Authorization = `Bearer ${apiKey}`;
+  }
   const response = await fetch(fullUrl, {
     ...options,
-    headers: {
-      ...options.headers,
-      Authorization: `Bearer ${apiKey}`,
-      "Content-Type": "application/json"
-    }
+    headers
   });
   const text = await response.text();
   let data = null;
@@ -179,6 +249,102 @@ async function whoamiRequest(registryUrl, apiKey) {
     return null;
   }
 }
+async function deprecateSkillVersion(skillName, version2, message) {
+  const config2 = getConfig();
+  if (!config2) {
+    return { status: 401, error: "SDK not configured" };
+  }
+  try {
+    const response = await fetch(
+      `${config2.baseUrl}/api/skills/${skillName}/${version2}/deprecate`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${config2.apiKey}`
+        },
+        body: JSON.stringify({ message })
+      }
+    );
+    if (!response.ok) {
+      const error = await response.text();
+      return { status: response.status, error };
+    }
+    const data = await response.json();
+    return { status: response.status, data };
+  } catch (error) {
+    return {
+      status: 500,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
+async function undeprecateSkillVersion(skillName, version2) {
+  const config2 = getConfig();
+  if (!config2) {
+    return { status: 401, error: "SDK not configured" };
+  }
+  try {
+    const response = await fetch(
+      `${config2.baseUrl}/api/skills/${skillName}/${version2}/deprecate`,
+      {
+        method: "DELETE",
+        headers: {
+          Authorization: `Bearer ${config2.apiKey}`
+        }
+      }
+    );
+    if (!response.ok) {
+      const error = await response.text();
+      return { status: response.status, error };
+    }
+    const data = await response.json();
+    return { status: response.status, data };
+  } catch (error) {
+    return {
+      status: 500,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
+async function changeSkillAccess(skillName, input) {
+  const config2 = getConfig();
+  if (!config2) {
+    return { status: 401, error: "SDK not configured" };
+  }
+  try {
+    const response = await fetch(
+      `${config2.baseUrl}/api/skills/${skillName}/access`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${config2.apiKey}`
+        },
+        body: JSON.stringify(input)
+      }
+    );
+    if (!response.ok) {
+      const error = await response.text();
+      try {
+        const errorJson = JSON.parse(error);
+        return {
+          status: response.status,
+          error: errorJson.message || errorJson.error || error
+        };
+      } catch {
+        return { status: response.status, error };
+      }
+    }
+    const data = await response.json();
+    return { status: response.status, data };
+  } catch (error) {
+    return {
+      status: 500,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
 
 // src/errors.ts
 var ConfigError = class extends Error {
@@ -238,12 +404,24 @@ function getConfigPath() {
 function getLegacyConfigPath() {
   return join(homedir(), ".pspm", "config.json");
 }
+function getPspmDir() {
+  return join(process.cwd(), ".pspm");
+}
 function getSkillsDir() {
-  return join(process.cwd(), ".skills");
+  return join(process.cwd(), ".pspm", "skills");
+}
+function getCacheDir() {
+  return join(process.cwd(), ".pspm", "cache");
 }
 function getLockfilePath() {
+  return join(process.cwd(), "pspm-lock.json");
+}
+function getLegacyLockfilePath() {
   return join(process.cwd(), "skill-lock.json");
 }
+function getLegacySkillsDir() {
+  return join(process.cwd(), ".skills");
+}
 async function readUserConfig() {
   const configPath = getConfigPath();
   if (process.env.PSPM_DEBUG) {
@@ -255,10 +433,35 @@ async function readUserConfig() {
     if (process.env.PSPM_DEBUG) {
       console.log(`[config] Parsed config:`, JSON.stringify(parsed, null, 2));
     }
+    const scopedRegistries = {};
+    for (const key of Object.keys(parsed)) {
+      const scopeMatch = key.match(/^(@[^:]+):registry$/);
+      if (scopeMatch) {
+        const scope = scopeMatch[1];
+        scopedRegistries[scope] = parsed[key];
+      }
+    }
+    const registryTokens = {};
+    for (const key of Object.keys(parsed)) {
+      const tokenMatch = key.match(/^\/\/([^:]+):authToken$/);
+      if (tokenMatch) {
+        const host = tokenMatch[1];
+        registryTokens[host] = parsed[key];
+      }
+      if (key.startsWith("//") && typeof parsed[key] === "object") {
+        const host = key.slice(2);
+        const section = parsed[key];
+        if (section.authToken) {
+          registryTokens[host] = section.authToken;
+        }
+      }
+    }
     return {
       registry: parsed.registry,
       authToken: parsed.authToken,
-      username: parsed.username
+      username: parsed.username,
+      scopedRegistries: Object.keys(scopedRegistries).length > 0 ? scopedRegistries : void 0,
+      registryTokens: Object.keys(registryTokens).length > 0 ? registryTokens : void 0
     };
   } catch (error) {
     if (process.env.PSPM_DEBUG) {
@@ -374,6 +577,8 @@ async function resolveConfig() {
   let registryUrl = DEFAULT_REGISTRY_URL;
   let apiKey = userConfig.authToken;
   const username = userConfig.username;
+  const scopedRegistries = userConfig.scopedRegistries ?? {};
+  const registryTokens = userConfig.registryTokens ?? {};
   if (userConfig.registry) {
     registryUrl = userConfig.registry;
   }
@@ -391,13 +596,33 @@ async function resolveConfig() {
     console.log(`[config]   registryUrl: ${registryUrl}`);
     console.log(`[config]   apiKey: ${apiKey ? "***" : "(not set)"}`);
     console.log(`[config]   username: ${username || "(not set)"}`);
+    console.log(
+      `[config]   scopedRegistries: ${JSON.stringify(scopedRegistries)}`
+    );
+    console.log(
+      `[config]   registryTokens: ${Object.keys(registryTokens).length} configured`
+    );
   }
   return {
     registryUrl,
     apiKey,
-    username
+    username,
+    scopedRegistries,
+    registryTokens
   };
 }
+function getTokenForRegistry(config2, registryUrl) {
+  try {
+    const url = new URL(registryUrl);
+    const host = url.host;
+    if (config2.registryTokens[host]) {
+      return config2.registryTokens[host];
+    }
+    return config2.apiKey;
+  } catch {
+    return config2.apiKey;
+  }
+}
 async function setCredentials(authToken, username, registry) {
   const config2 = await readUserConfig();
   config2.authToken = authToken;
@@ -442,43 +667,438 @@ async function getRegistryUrl() {
   const resolved = await resolveConfig();
   return resolved.registryUrl;
 }
+
+// src/commands/access.ts
+async function access(specifier, options) {
+  try {
+    const apiKey = await requireApiKey();
+    const registryUrl = await getRegistryUrl();
+    if (options.public && options.private) {
+      console.error("Error: Cannot specify both --public and --private");
+      process.exit(1);
+    }
+    if (!options.public && !options.private) {
+      console.error("Error: Must specify either --public or --private");
+      process.exit(1);
+    }
+    const visibility = options.public ? "public" : "private";
+    let packageName;
+    if (specifier) {
+      const parsed = parseSkillSpecifier(specifier);
+      if (!parsed) {
+        console.error(
+          `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}`
+        );
+        process.exit(1);
+      }
+      packageName = parsed.name;
+    } else {
+      const { readFile: readFile7 } = await import('fs/promises');
+      const { join: join13 } = await import('path');
+      let manifest = null;
+      try {
+        const content = await readFile7(
+          join13(process.cwd(), "pspm.json"),
+          "utf-8"
+        );
+        manifest = JSON.parse(content);
+      } catch {
+        try {
+          const content = await readFile7(
+            join13(process.cwd(), "package.json"),
+            "utf-8"
+          );
+          manifest = JSON.parse(content);
+        } catch {
+          console.error(
+            "Error: No pspm.json or package.json found in current directory"
+          );
+          console.error(
+            "Either run this command in a package directory or specify a package name"
+          );
+          process.exit(1);
+        }
+      }
+      if (!manifest?.name) {
+        console.error("Error: Package manifest is missing 'name' field");
+        process.exit(1);
+      }
+      packageName = manifest.name;
+    }
+    configure2({ registryUrl, apiKey });
+    console.log(`Setting ${packageName} to ${visibility}...`);
+    const response = await changeSkillAccess(packageName, { visibility });
+    if (response.status !== 200 || !response.data) {
+      const errorMessage = response.error ?? "Failed to change visibility";
+      console.error(`Error: ${errorMessage}`);
+      process.exit(1);
+    }
+    const result = response.data;
+    console.log(
+      `+ @user/${result.username}/${result.name} is now ${result.visibility}`
+    );
+    if (visibility === "public") {
+      console.log("");
+      console.log(
+        "Note: This action is irreversible. Public packages cannot be made private."
+      );
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
+var AGENT_INFO = {
+  "claude-code": {
+    displayName: "Claude Code",
+    skillsDir: ".claude/skills"
+  },
+  codex: {
+    displayName: "Codex",
+    skillsDir: ".codex/skills"
+  },
+  cursor: {
+    displayName: "Cursor",
+    skillsDir: ".cursor/skills"
+  },
+  gemini: {
+    displayName: "Gemini CLI",
+    skillsDir: ".gemini/skills"
+  },
+  kiro: {
+    displayName: "Kiro CLI",
+    skillsDir: ".kiro/skills"
+  },
+  opencode: {
+    displayName: "OpenCode",
+    skillsDir: ".opencode/skills"
+  }
+};
+var DEFAULT_AGENT_CONFIGS = {
+  "claude-code": { skillsDir: AGENT_INFO["claude-code"].skillsDir },
+  codex: { skillsDir: AGENT_INFO.codex.skillsDir },
+  cursor: { skillsDir: AGENT_INFO.cursor.skillsDir },
+  gemini: { skillsDir: AGENT_INFO.gemini.skillsDir },
+  kiro: { skillsDir: AGENT_INFO.kiro.skillsDir },
+  opencode: { skillsDir: AGENT_INFO.opencode.skillsDir }
+};
+var DEFAULT_AGENT = "claude-code";
+var ALL_AGENTS = [
+  "claude-code",
+  "codex",
+  "cursor",
+  "gemini",
+  "kiro",
+  "opencode"
+];
+function resolveAgentConfig(name, overrides) {
+  if (overrides?.[name]) {
+    return overrides[name];
+  }
+  if (name in DEFAULT_AGENT_CONFIGS) {
+    return DEFAULT_AGENT_CONFIGS[name];
+  }
+  return null;
+}
+function parseAgentArg(agentArg) {
+  if (!agentArg) {
+    return [DEFAULT_AGENT];
+  }
+  if (agentArg === "none") {
+    return ["none"];
+  }
+  return agentArg.split(",").map((a) => a.trim()).filter(Boolean);
+}
+function getAvailableAgents(overrides) {
+  const builtIn = Object.keys(DEFAULT_AGENT_CONFIGS);
+  const custom = overrides ? Object.keys(overrides) : [];
+  return [.../* @__PURE__ */ new Set([...builtIn, ...custom])];
+}
+async function promptForAgents() {
+  const choices = ALL_AGENTS.map((agent) => ({
+    name: `${AGENT_INFO[agent].displayName} (${AGENT_INFO[agent].skillsDir})`,
+    value: agent,
+    checked: true
+    // All selected by default
+  }));
+  const selected = await checkbox({
+    message: "Select agents to install skills to",
+    choices
+  });
+  if (selected.length === 0) {
+    return ["none"];
+  }
+  return selected;
+}
+var GitHubRateLimitError = class extends Error {
+  constructor() {
+    super(
+      "GitHub API rate limit exceeded. Set GITHUB_TOKEN environment variable for higher limits."
+    );
+    this.name = "GitHubRateLimitError";
+  }
+};
+var GitHubNotFoundError = class extends Error {
+  constructor(spec) {
+    const path = spec.path ? `/${spec.path}` : "";
+    const ref = spec.ref ? `@${spec.ref}` : "";
+    super(
+      `GitHub repository not found: ${spec.owner}/${spec.repo}${path}${ref}`
+    );
+    this.name = "GitHubNotFoundError";
+  }
+};
+var GitHubPathNotFoundError = class extends Error {
+  constructor(spec, availablePaths) {
+    const pathInfo = availablePaths?.length ? `
+Available paths in repository root:
+  ${availablePaths.join("\n  ")}` : "";
+    super(
+      `Path "${spec.path}" not found in ${spec.owner}/${spec.repo}${pathInfo}`
+    );
+    this.name = "GitHubPathNotFoundError";
+  }
+};
+function getGitHubHeaders() {
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "pspm-cli"
+  };
+  const token = process.env.GITHUB_TOKEN;
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+async function resolveGitHubRef(owner, repo, ref) {
+  const headers = getGitHubHeaders();
+  if (!ref || ref === "latest") {
+    const repoUrl = `https://api.github.com/repos/${owner}/${repo}`;
+    const repoResponse = await fetch(repoUrl, { headers });
+    if (repoResponse.status === 404) {
+      throw new GitHubNotFoundError({ owner, repo });
+    }
+    if (repoResponse.status === 403) {
+      const remaining = repoResponse.headers.get("x-ratelimit-remaining");
+      if (remaining === "0") {
+        throw new GitHubRateLimitError();
+      }
+    }
+    if (!repoResponse.ok) {
+      throw new Error(`GitHub API error: ${repoResponse.status}`);
+    }
+    const repoData = await repoResponse.json();
+    ref = repoData.default_branch;
+  }
+  const commitUrl = `https://api.github.com/repos/${owner}/${repo}/commits/${ref}`;
+  const commitResponse = await fetch(commitUrl, { headers });
+  if (commitResponse.status === 404) {
+    throw new GitHubNotFoundError({ owner, repo, ref });
+  }
+  if (commitResponse.status === 403) {
+    const remaining = commitResponse.headers.get("x-ratelimit-remaining");
+    if (remaining === "0") {
+      throw new GitHubRateLimitError();
+    }
+  }
+  if (!commitResponse.ok) {
+    throw new Error(`GitHub API error: ${commitResponse.status}`);
+  }
+  const commitData = await commitResponse.json();
+  return commitData.sha;
+}
+async function downloadGitHubPackage(spec) {
+  const headers = getGitHubHeaders();
+  const commit = await resolveGitHubRef(spec.owner, spec.repo, spec.ref);
+  const tarballUrl = `https://api.github.com/repos/${spec.owner}/${spec.repo}/tarball/${commit}`;
+  const response = await fetch(tarballUrl, {
+    headers,
+    redirect: "follow"
+  });
+  if (response.status === 404) {
+    throw new GitHubNotFoundError(spec);
+  }
+  if (response.status === 403) {
+    const remaining = response.headers.get("x-ratelimit-remaining");
+    if (remaining === "0") {
+      throw new GitHubRateLimitError();
+    }
+  }
+  if (!response.ok) {
+    throw new Error(`Failed to download GitHub tarball: ${response.status}`);
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const integrity = calculateIntegrity(buffer);
+  return { buffer, commit, integrity };
+}
+async function extractGitHubPackage(spec, buffer, skillsDir) {
+  const destPath = spec.path ? join(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join(skillsDir, "_github", spec.owner, spec.repo);
+  const tempDir = join(skillsDir, "_github", ".temp", `${Date.now()}`);
+  await mkdir(tempDir, { recursive: true });
+  const tempFile = join(tempDir, "archive.tgz");
+  try {
+    await writeFile(tempFile, buffer);
+    const { exec: exec2 } = await import('child_process');
+    const { promisify: promisify2 } = await import('util');
+    const execAsync = promisify2(exec2);
+    await execAsync(`tar -xzf "${tempFile}" -C "${tempDir}"`);
+    const entries = await readdir(tempDir);
+    const extractedDir = entries.find(
+      (e) => e !== "archive.tgz" && !e.startsWith(".")
+    );
+    if (!extractedDir) {
+      throw new Error("Failed to find extracted directory in tarball");
+    }
+    const sourcePath = join(tempDir, extractedDir);
+    const copySource = spec.path ? join(sourcePath, spec.path) : sourcePath;
+    if (spec.path) {
+      const pathExists = await lstat(copySource).catch(() => null);
+      if (!pathExists) {
+        const rootEntries = await readdir(sourcePath);
+        const dirs = [];
+        for (const entry of rootEntries) {
+          const stat7 = await lstat(join(sourcePath, entry)).catch(() => null);
+          if (stat7?.isDirectory() && !entry.startsWith(".")) {
+            dirs.push(entry);
+          }
+        }
+        throw new GitHubPathNotFoundError(spec, dirs);
+      }
+    }
+    await rm(destPath, { recursive: true, force: true });
+    await mkdir(destPath, { recursive: true });
+    await cp(copySource, destPath, { recursive: true });
+    return spec.path ? `.pspm/skills/_github/${spec.owner}/${spec.repo}/${spec.path}` : `.pspm/skills/_github/${spec.owner}/${spec.repo}`;
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+}
+function getGitHubDisplayName(spec, commit) {
+  let name = `github:${spec.owner}/${spec.repo}`;
+  if (spec.path) {
+    name += `/${spec.path}`;
+  }
+  if (spec.ref || commit) {
+    const ref = spec.ref || "HEAD";
+    name += ` (${ref}${""})`;
+  }
+  return name;
+}
+async function hasLegacyLockfile() {
+  try {
+    await stat(getLegacyLockfilePath());
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function migrateLockfileIfNeeded() {
+  const legacyPath = getLegacyLockfilePath();
+  const newPath = getLockfilePath();
+  try {
+    await stat(legacyPath);
+  } catch {
+    return false;
+  }
+  try {
+    await stat(newPath);
+    return false;
+  } catch {
+  }
+  try {
+    const content = await readFile(legacyPath, "utf-8");
+    const oldLockfile = JSON.parse(content);
+    const newLockfile = {
+      lockfileVersion: 2,
+      registryUrl: oldLockfile.registryUrl,
+      packages: oldLockfile.skills ?? {}
+    };
+    await writeFile(newPath, `${JSON.stringify(newLockfile, null, 2)}
+`);
+    console.log(`Migrated lockfile: skill-lock.json \u2192 pspm-lock.json`);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function readLockfile() {
   const lockfilePath = getLockfilePath();
   try {
     const content = await readFile(lockfilePath, "utf-8");
-    return JSON.parse(content);
+    const lockfile = JSON.parse(content);
+    if (lockfile.lockfileVersion === 1 && lockfile.skills && !lockfile.packages) {
+      return {
+        ...lockfile,
+        lockfileVersion: 2,
+        packages: lockfile.skills
+      };
+    }
+    return lockfile;
   } catch {
+    if (await hasLegacyLockfile()) {
+      try {
+        const content = await readFile(getLegacyLockfilePath(), "utf-8");
+        const legacyLockfile = JSON.parse(content);
+        return {
+          lockfileVersion: 2,
+          registryUrl: legacyLockfile.registryUrl,
+          packages: legacyLockfile.skills ?? {}
+        };
+      } catch {
+        return null;
+      }
+    }
     return null;
   }
 }
 async function writeLockfile(lockfile) {
   const lockfilePath = getLockfilePath();
   await mkdir(dirname(lockfilePath), { recursive: true });
-  await writeFile(lockfilePath, `${JSON.stringify(lockfile, null, 2)}
+  const normalized = {
+    lockfileVersion: 3,
+    registryUrl: lockfile.registryUrl,
+    packages: lockfile.packages ?? lockfile.skills ?? {}
+  };
+  if (lockfile.githubPackages && Object.keys(lockfile.githubPackages).length > 0) {
+    normalized.githubPackages = lockfile.githubPackages;
+  }
+  await writeFile(lockfilePath, `${JSON.stringify(normalized, null, 2)}
 `);
 }
 async function createEmptyLockfile() {
   const registryUrl = await getRegistryUrl();
   return {
-    lockfileVersion: 1,
+    lockfileVersion: 3,
     registryUrl,
-    skills: {}
+    packages: {}
   };
 }
+function getPackages(lockfile) {
+  return lockfile.packages ?? lockfile.skills ?? {};
+}
 async function addToLockfile(fullName, entry) {
   let lockfile = await readLockfile();
   if (!lockfile) {
     lockfile = await createEmptyLockfile();
   }
-  lockfile.skills[fullName] = entry;
+  const packages = getPackages(lockfile);
+  packages[fullName] = entry;
+  lockfile.packages = packages;
   await writeLockfile(lockfile);
 }
 async function removeFromLockfile(fullName) {
   const lockfile = await readLockfile();
-  if (!lockfile || !lockfile.skills[fullName]) {
+  if (!lockfile) {
     return false;
   }
-  delete lockfile.skills[fullName];
+  const packages = getPackages(lockfile);
+  if (!packages[fullName]) {
+    return false;
+  }
+  delete packages[fullName];
+  lockfile.packages = packages;
   await writeLockfile(lockfile);
   return true;
 }
@@ -487,29 +1107,255 @@ async function listLockfileSkills() {
   if (!lockfile) {
     return [];
   }
-  return Object.entries(lockfile.skills).map(([name, entry]) => ({
+  const packages = getPackages(lockfile);
+  return Object.entries(packages).map(([name, entry]) => ({
     name,
     entry
   }));
 }
-
-// src/commands/add.ts
-async function add(specifier, _options) {
+async function addGitHubToLockfile(specifier, entry) {
+  let lockfile = await readLockfile();
+  if (!lockfile) {
+    lockfile = await createEmptyLockfile();
+  }
+  if (!lockfile.githubPackages) {
+    lockfile.githubPackages = {};
+  }
+  lockfile.githubPackages[specifier] = entry;
+  await writeLockfile(lockfile);
+}
+async function removeGitHubFromLockfile(specifier) {
+  const lockfile = await readLockfile();
+  if (!lockfile?.githubPackages?.[specifier]) {
+    return false;
+  }
+  delete lockfile.githubPackages[specifier];
+  await writeLockfile(lockfile);
+  return true;
+}
+async function listLockfileGitHubPackages() {
+  const lockfile = await readLockfile();
+  if (!lockfile?.githubPackages) {
+    return [];
+  }
+  return Object.entries(lockfile.githubPackages).map(([specifier, entry]) => ({
+    specifier,
+    entry
+  }));
+}
+function getManifestPath() {
+  return join(process.cwd(), "pspm.json");
+}
+async function readManifest() {
   try {
-    const apiKey = await requireApiKey();
-    const registryUrl = await getRegistryUrl();
-    const parsed = parseSkillSpecifier(specifier);
-    if (!parsed) {
+    const content = await readFile(getManifestPath(), "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+async function writeManifest(manifest) {
+  const content = JSON.stringify(manifest, null, 2);
+  await writeFile(getManifestPath(), `${content}
+`);
+}
+async function createMinimalManifest() {
+  return {
+    dependencies: {}
+  };
+}
+async function ensureManifest() {
+  let manifest = await readManifest();
+  if (!manifest) {
+    manifest = await createMinimalManifest();
+    await writeManifest(manifest);
+  }
+  return manifest;
+}
+async function addDependency(skillName, versionRange) {
+  const manifest = await ensureManifest();
+  if (!manifest.dependencies) {
+    manifest.dependencies = {};
+  }
+  manifest.dependencies[skillName] = versionRange;
+  await writeManifest(manifest);
+}
+async function removeDependency(skillName) {
+  const manifest = await readManifest();
+  if (!manifest?.dependencies?.[skillName]) {
+    return false;
+  }
+  delete manifest.dependencies[skillName];
+  await writeManifest(manifest);
+  return true;
+}
+async function getDependencies() {
+  const manifest = await readManifest();
+  return manifest?.dependencies ?? {};
+}
+async function getGitHubDependencies() {
+  const manifest = await readManifest();
+  return manifest?.githubDependencies ?? {};
+}
+async function addGitHubDependency(specifier, ref) {
+  const manifest = await ensureManifest();
+  if (!manifest.githubDependencies) {
+    manifest.githubDependencies = {};
+  }
+  manifest.githubDependencies[specifier] = ref;
+  await writeManifest(manifest);
+}
+async function removeGitHubDependency(specifier) {
+  const manifest = await readManifest();
+  if (!manifest?.githubDependencies?.[specifier]) {
+    return false;
+  }
+  delete manifest.githubDependencies[specifier];
+  await writeManifest(manifest);
+  return true;
+}
+async function createAgentSymlinks(skills, options) {
+  const { agents, projectRoot, agentConfigs } = options;
+  if (agents.length === 1 && agents[0] === "none") {
+    return;
+  }
+  for (const agentName of agents) {
+    const config2 = resolveAgentConfig(agentName, agentConfigs);
+    if (!config2) {
+      console.warn(`Warning: Unknown agent "${agentName}", skipping symlinks`);
+      continue;
+    }
+    const agentSkillsDir = join(projectRoot, config2.skillsDir);
+    await mkdir(agentSkillsDir, { recursive: true });
+    for (const skill of skills) {
+      const symlinkPath = join(agentSkillsDir, skill.name);
+      const targetPath = join(projectRoot, skill.sourcePath);
+      const relativeTarget = relative(dirname(symlinkPath), targetPath);
+      await createSymlink(symlinkPath, relativeTarget, skill.name);
+    }
+  }
+}
+async function createSymlink(symlinkPath, target, skillName) {
+  try {
+    const stats = await lstat(symlinkPath).catch(() => null);
+    if (stats) {
+      if (stats.isSymbolicLink()) {
+        const existingTarget = await readlink(symlinkPath);
+        if (existingTarget === target) {
+          return;
+        }
+        await rm(symlinkPath);
+      } else {
+        console.warn(
+          `Warning: File exists at symlink path for "${skillName}", skipping: ${symlinkPath}`
+        );
+        return;
+      }
+    }
+    await symlink(target, symlinkPath);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(
+      `Warning: Failed to create symlink for "${skillName}": ${message}`
+    );
+  }
+}
+async function removeAgentSymlinks(skillName, options) {
+  const { agents, projectRoot, agentConfigs } = options;
+  if (agents.length === 1 && agents[0] === "none") {
+    return;
+  }
+  for (const agentName of agents) {
+    const config2 = resolveAgentConfig(agentName, agentConfigs);
+    if (!config2) {
+      continue;
+    }
+    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
+    try {
+      const stats = await lstat(symlinkPath).catch(() => null);
+      if (stats?.isSymbolicLink()) {
+        await rm(symlinkPath);
+      }
+    } catch {
+    }
+  }
+}
+function getRegistrySkillPath(username, skillName) {
+  return `.pspm/skills/${username}/${skillName}`;
+}
+function getGitHubSkillPath(owner, repo, path) {
+  if (path) {
+    return `.pspm/skills/_github/${owner}/${repo}/${path}`;
+  }
+  return `.pspm/skills/_github/${owner}/${repo}`;
+}
+async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
+  const linkedAgents = [];
+  for (const agentName of agents) {
+    const config2 = resolveAgentConfig(agentName, agentConfigs);
+    if (!config2) continue;
+    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
+    try {
+      const stats = await lstat(symlinkPath);
+      if (stats.isSymbolicLink()) {
+        linkedAgents.push(agentName);
+      }
+    } catch {
+    }
+  }
+  return linkedAgents;
+}
+
+// src/commands/add.ts
+async function add(specifier, options) {
+  let agents;
+  const manifest = await readManifest();
+  if (options.agent) {
+    agents = parseAgentArg(options.agent);
+  } else if (manifest) {
+    agents = parseAgentArg(void 0);
+  } else if (options.yes) {
+    agents = parseAgentArg(void 0);
+  } else {
+    console.log("No pspm.json found. Let's set up your project.\n");
+    agents = await promptForAgents();
+  }
+  if (isGitHubSpecifier(specifier)) {
+    await addGitHub(specifier, { ...options, resolvedAgents: agents });
+  } else {
+    await addRegistry(specifier, { ...options, resolvedAgents: agents });
+  }
+}
+async function addRegistry(specifier, options) {
+  try {
+    const config2 = await resolveConfig();
+    const registryUrl = config2.registryUrl;
+    const apiKey = getTokenForRegistry(config2, registryUrl);
+    const parsed = parseSkillSpecifier(specifier);
+    if (!parsed) {
       console.error(
         `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}[@{version}]`
       );
       process.exit(1);
     }
     const { username, name, versionRange } = parsed;
-    configure2({ registryUrl, apiKey });
+    configure2({ registryUrl, apiKey: apiKey ?? "" });
     console.log(`Resolving ${specifier}...`);
     const versionsResponse = await listSkillVersions(username, name);
     if (versionsResponse.status !== 200) {
+      if (versionsResponse.status === 401) {
+        if (!apiKey) {
+          console.error(
+            `Error: Package @user/${username}/${name} requires authentication`
+          );
+          console.error("Please run 'pspm login' to authenticate");
+        } else {
+          console.error(
+            `Error: Access denied to @user/${username}/${name}. You may not have permission to access this private package.`
+          );
+        }
+        process.exit(1);
+      }
       const errorMessage = extractApiErrorMessage(
         versionsResponse,
         `Skill @user/${username}/${name} not found`
@@ -543,10 +1389,12 @@ async function add(specifier, _options) {
     }
     const versionInfo = versionResponse.data;
     const isPresignedUrl = versionInfo.downloadUrl.includes(".r2.cloudflarestorage.com") || versionInfo.downloadUrl.includes("X-Amz-Signature");
+    const downloadHeaders = {};
+    if (!isPresignedUrl && apiKey) {
+      downloadHeaders.Authorization = `Bearer ${apiKey}`;
+    }
     const tarballResponse = await fetch(versionInfo.downloadUrl, {
-      headers: isPresignedUrl ? {} : {
-        Authorization: `Bearer ${apiKey}`
-      },
+      headers: downloadHeaders,
       redirect: "follow"
     });
     if (!tarballResponse.ok) {
@@ -565,60 +1413,842 @@ async function add(specifier, _options) {
     const skillsDir = getSkillsDir();
     const destDir = join(skillsDir, username, name);
     await mkdir(destDir, { recursive: true });
-    const { writeFile: writeFile4 } = await import('fs/promises');
+    const { writeFile: writeFile8 } = await import('fs/promises');
     const tempFile = join(destDir, ".temp.tgz");
-    await writeFile4(tempFile, tarballBuffer);
+    await writeFile8(tempFile, tarballBuffer);
     const { exec: exec2 } = await import('child_process');
     const { promisify: promisify2 } = await import('util');
     const execAsync = promisify2(exec2);
     try {
       await rm(destDir, { recursive: true, force: true });
       await mkdir(destDir, { recursive: true });
-      await writeFile4(tempFile, tarballBuffer);
+      await writeFile8(tempFile, tarballBuffer);
       await execAsync(
         `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
       );
     } finally {
       await rm(tempFile, { force: true });
     }
-    const fullName = `@user/${username}/${name}`;
-    await addToLockfile(fullName, {
-      version: resolved,
-      resolved: versionInfo.downloadUrl,
-      integrity
-    });
-    console.log(`Installed @user/${username}/${name}@${resolved}`);
-    console.log(`Location: ${destDir}`);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Unknown error";
-    console.error(`Error: ${message}`);
-    process.exit(1);
-  }
-}
-async function configInit(options) {
-  try {
-    const configPath = join(process.cwd(), ".pspmrc");
-    try {
-      await stat(configPath);
-      console.error("Error: .pspmrc already exists in this directory.");
-      process.exit(1);
-    } catch {
+    const fullName = `@user/${username}/${name}`;
+    await addToLockfile(fullName, {
+      version: resolved,
+      resolved: versionInfo.downloadUrl,
+      integrity
+    });
+    const dependencyRange = versionRange || `^${resolved}`;
+    await addDependency(fullName, dependencyRange);
+    const agents = options.resolvedAgents;
+    if (agents[0] !== "none") {
+      const skillManifest = await readManifest();
+      const skillInfo = {
+        name,
+        sourcePath: getRegistrySkillPath(username, name)
+      };
+      await createAgentSymlinks([skillInfo], {
+        agents,
+        projectRoot: process.cwd(),
+        agentConfigs: skillManifest?.agents
+      });
+    }
+    console.log(`Installed @user/${username}/${name}@${resolved}`);
+    console.log(`Location: ${destDir}`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
+async function addGitHub(specifier, options) {
+  try {
+    const parsed = parseGitHubSpecifier(specifier);
+    if (!parsed) {
+      console.error(
+        `Error: Invalid GitHub specifier "${specifier}". Use format: github:{owner}/{repo}[/{path}][@{ref}]`
+      );
+      process.exit(1);
+    }
+    const ref = parsed.ref || "HEAD";
+    console.log(`Resolving ${getGitHubDisplayName(parsed)}...`);
+    const result = await downloadGitHubPackage(parsed);
+    console.log(
+      `Installing ${specifier} (${ref}@${result.commit.slice(0, 7)})...`
+    );
+    const skillsDir = getSkillsDir();
+    const destPath = await extractGitHubPackage(
+      parsed,
+      result.buffer,
+      skillsDir
+    );
+    const lockfileSpecifier = formatGitHubSpecifier({
+      owner: parsed.owner,
+      repo: parsed.repo,
+      path: parsed.path
+      // Don't include ref in the specifier key, it's stored in gitRef
+    });
+    const entry = {
+      version: result.commit.slice(0, 7),
+      resolved: `https://github.com/${parsed.owner}/${parsed.repo}`,
+      integrity: result.integrity,
+      gitCommit: result.commit,
+      gitRef: ref
+    };
+    await addGitHubToLockfile(lockfileSpecifier, entry);
+    await addGitHubDependency(lockfileSpecifier, ref);
+    const agents = options.resolvedAgents;
+    if (agents[0] !== "none") {
+      const manifest = await readManifest();
+      const skillName = getGitHubSkillName(parsed);
+      const skillInfo = {
+        name: skillName,
+        sourcePath: getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path)
+      };
+      await createAgentSymlinks([skillInfo], {
+        agents,
+        projectRoot: process.cwd(),
+        agentConfigs: manifest?.agents
+      });
+    }
+    console.log(`Installed ${specifier} (${ref}@${result.commit.slice(0, 7)})`);
+    console.log(`Location: ${destPath}`);
+  } catch (error) {
+    if (error instanceof GitHubRateLimitError) {
+      console.error(`Error: ${error.message}`);
+    } else if (error instanceof GitHubPathNotFoundError) {
+      console.error(`Error: ${error.message}`);
+    } else if (error instanceof GitHubNotFoundError) {
+      console.error(`Error: ${error.message}`);
+    } else {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      console.error(`Error: ${message}`);
+    }
+    process.exit(1);
+  }
+}
+async function configInit(options) {
+  try {
+    const configPath = join(process.cwd(), ".pspmrc");
+    try {
+      await stat(configPath);
+      console.error("Error: .pspmrc already exists in this directory.");
+      process.exit(1);
+    } catch {
+    }
+    const lines = ["; Project-specific PSPM configuration", ""];
+    if (options.registry) {
+      lines.push(`registry = ${options.registry}`);
+    } else {
+      lines.push("; Uncomment to use a custom registry:");
+      lines.push("; registry = https://custom-registry.example.com");
+    }
+    lines.push("");
+    await writeFile(configPath, lines.join("\n"));
+    console.log("Created .pspmrc");
+    console.log("");
+    console.log("Contents:");
+    console.log(lines.join("\n"));
+    console.log("Note: .pspmrc should be committed to version control.");
+    console.log("API keys should NOT be stored here - use pspm login instead.");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
+
+// src/commands/config/show.ts
+async function configShow() {
+  try {
+    const resolved = await resolveConfig();
+    const projectConfig = await findProjectConfig();
+    const configPath = getConfigPath();
+    console.log("Resolved Configuration:\n");
+    console.log(`  Registry URL:   ${resolved.registryUrl}`);
+    console.log(`  API Key:        ${resolved.apiKey ? "***" : "(not set)"}`);
+    console.log(`  Username:       ${resolved.username || "(not set)"}`);
+    console.log("");
+    console.log("Config Locations:");
+    console.log(`  User config:    ${configPath}`);
+    console.log(`  Project config: ${projectConfig ? ".pspmrc" : "(none)"}`);
+    console.log("");
+    console.log("Environment Variables:");
+    console.log(
+      `  PSPM_REGISTRY_URL: ${process.env.PSPM_REGISTRY_URL || "(not set)"}`
+    );
+    console.log(
+      `  PSPM_API_KEY:      ${process.env.PSPM_API_KEY ? "***" : "(not set)"}`
+    );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
+
+// src/commands/deprecate.ts
+async function deprecate(specifier, message, options) {
+  try {
+    const apiKey = await requireApiKey();
+    const registryUrl = await getRegistryUrl();
+    const parsed = parseSkillSpecifier(specifier);
+    if (!parsed) {
+      console.error(
+        `Error: Invalid skill specifier "${specifier}". Use format: @user/{username}/{name}@{version}`
+      );
+      process.exit(1);
+    }
+    const { username, name, versionRange } = parsed;
+    if (!versionRange) {
+      console.error(
+        "Error: Version is required for deprecation. Use format: @user/{username}/{name}@{version}"
+      );
+      process.exit(1);
+    }
+    configure2({ registryUrl, apiKey });
+    if (options.undo) {
+      console.log(
+        `Removing deprecation from @user/${username}/${name}@${versionRange}...`
+      );
+      const response = await undeprecateSkillVersion(name, versionRange);
+      if (response.status !== 200) {
+        console.error(
+          `Error: ${response.error || "Failed to remove deprecation"}`
+        );
+        process.exit(1);
+      }
+      console.log(
+        `Removed deprecation from @user/${username}/${name}@${versionRange}`
+      );
+    } else {
+      if (!message) {
+        console.error(
+          "Error: Deprecation message is required. Usage: pspm deprecate <specifier> <message>"
+        );
+        process.exit(1);
+      }
+      console.log(`Deprecating @user/${username}/${name}@${versionRange}...`);
+      const response = await deprecateSkillVersion(name, versionRange, message);
+      if (response.status !== 200) {
+        console.error(
+          `Error: ${response.error || "Failed to deprecate version"}`
+        );
+        process.exit(1);
+      }
+      console.log(`Deprecated @user/${username}/${name}@${versionRange}`);
+      console.log(`Message: ${message}`);
+      console.log("");
+      console.log(
+        "Users installing this version will see a deprecation warning."
+      );
+      console.log("The package is still available for download.");
+    }
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${errorMessage}`);
+    process.exit(1);
+  }
+}
+function prompt(rl, question, defaultValue) {
+  return new Promise((resolve) => {
+    const displayDefault = defaultValue ? ` (${defaultValue})` : "";
+    rl.question(`${question}${displayDefault} `, (answer) => {
+      resolve(answer.trim() || defaultValue);
+    });
+  });
+}
+async function readExistingPackageJson() {
+  try {
+    const content = await readFile(
+      join(process.cwd(), "package.json"),
+      "utf-8"
+    );
+    const pkg = JSON.parse(content);
+    return {
+      name: pkg.name,
+      version: pkg.version,
+      description: pkg.description,
+      author: typeof pkg.author === "string" ? pkg.author : pkg.author?.name,
+      license: pkg.license
+    };
+  } catch {
+    return null;
+  }
+}
+async function getGitAuthor() {
+  try {
+    const { exec: exec2 } = await import('child_process');
+    const { promisify: promisify2 } = await import('util');
+    const execAsync = promisify2(exec2);
+    const [nameResult, emailResult] = await Promise.all([
+      execAsync("git config user.name").catch(() => ({ stdout: "" })),
+      execAsync("git config user.email").catch(() => ({ stdout: "" }))
+    ]);
+    const name = nameResult.stdout.trim();
+    const email = emailResult.stdout.trim();
+    if (name && email) {
+      return `${name} <${email}>`;
+    }
+    if (name) {
+      return name;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function sanitizeName(name) {
+  const withoutScope = name.replace(/^@[^/]+\//, "");
+  return withoutScope.toLowerCase().replace(/[^a-z0-9_-]/g, "-").replace(/^-+|-+$/g, "").replace(/-+/g, "-");
+}
+function isValidName(name) {
+  return /^[a-z][a-z0-9_-]*$/.test(name);
+}
+function isValidVersion(version2) {
+  return /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/.test(version2);
+}
+async function init(options) {
+  try {
+    const pspmJsonPath = join(process.cwd(), "pspm.json");
+    let exists = false;
+    try {
+      await stat(pspmJsonPath);
+      exists = true;
+    } catch {
+    }
+    if (exists && !options.force) {
+      console.error("Error: pspm.json already exists in this directory.");
+      console.error("Use --force to overwrite.");
+      process.exit(1);
+    }
+    const existingPkg = await readExistingPackageJson();
+    const gitAuthor = await getGitAuthor();
+    const defaultName = sanitizeName(
+      options.name || existingPkg?.name || basename(process.cwd())
+    );
+    const defaultVersion = existingPkg?.version || "0.1.0";
+    const defaultDescription = options.description || existingPkg?.description || "";
+    const defaultAuthor = options.author || existingPkg?.author || gitAuthor || "";
+    const defaultLicense = existingPkg?.license || "MIT";
+    const defaultMain = "SKILL.md";
+    const defaultCapabilities = "";
+    let manifest;
+    if (options.yes) {
+      manifest = {
+        $schema: PSPM_SCHEMA_URL,
+        name: defaultName,
+        version: defaultVersion,
+        description: defaultDescription || void 0,
+        author: defaultAuthor || void 0,
+        license: defaultLicense,
+        type: "skill",
+        capabilities: [],
+        main: defaultMain,
+        requirements: {
+          pspm: ">=0.1.0"
+        },
+        files: [...DEFAULT_SKILL_FILES],
+        dependencies: {},
+        private: false
+      };
+    } else {
+      console.log(
+        "This utility will walk you through creating a pspm.json file."
+      );
+      console.log(
+        "It only covers the most common items, and tries to guess sensible defaults."
+      );
+      console.log("");
+      console.log(
+        "See `pspm init --help` for definitive documentation on these fields"
+      );
+      console.log("and exactly what they do.");
+      console.log("");
+      console.log("Press ^C at any time to quit.");
+      const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      try {
+        let name = await prompt(rl, "skill name:", defaultName);
+        while (!isValidName(name)) {
+          console.log(
+            "  Name must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores."
+          );
+          name = await prompt(rl, "skill name:", sanitizeName(name));
+        }
+        let version2 = await prompt(rl, "version:", defaultVersion);
+        while (!isValidVersion(version2)) {
+          console.log("  Version must be valid semver (e.g., 1.0.0)");
+          version2 = await prompt(rl, "version:", "0.1.0");
+        }
+        const description = await prompt(
+          rl,
+          "description:",
+          defaultDescription
+        );
+        const main = await prompt(rl, "entry point:", defaultMain);
+        const capabilitiesStr = await prompt(
+          rl,
+          "capabilities (comma-separated):",
+          defaultCapabilities
+        );
+        const author = await prompt(rl, "author:", defaultAuthor);
+        const license = await prompt(rl, "license:", defaultLicense);
+        rl.close();
+        const capabilities = capabilitiesStr ? capabilitiesStr.split(",").map((s) => s.trim()).filter(Boolean) : [];
+        manifest = {
+          $schema: PSPM_SCHEMA_URL,
+          name,
+          version: version2,
+          description: description || void 0,
+          author: author || void 0,
+          license,
+          type: "skill",
+          capabilities,
+          main,
+          requirements: {
+            pspm: ">=0.1.0"
+          },
+          files: [...DEFAULT_SKILL_FILES],
+          dependencies: {},
+          private: false
+        };
+      } catch (error) {
+        rl.close();
+        if (error instanceof Error && error.message.includes("readline was closed")) {
+          console.log("\nAborted.");
+          process.exit(0);
+        }
+        throw error;
+      }
+    }
+    if (!manifest.description) delete manifest.description;
+    if (!manifest.author) delete manifest.author;
+    if (manifest.capabilities?.length === 0) delete manifest.capabilities;
+    const content = JSON.stringify(manifest, null, 2);
+    console.log("");
+    console.log(`About to write to ${pspmJsonPath}:`);
+    console.log("");
+    console.log(content);
+    console.log("");
+    if (!options.yes) {
+      const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const confirm = await prompt(rl, "Is this OK?", "yes");
+      rl.close();
+      if (confirm.toLowerCase() !== "yes" && confirm.toLowerCase() !== "y") {
+        console.log("Aborted.");
+        process.exit(0);
+      }
+    }
+    await writeFile(pspmJsonPath, `${content}
+`);
+    try {
+      await stat(join(process.cwd(), "SKILL.md"));
+    } catch {
+      console.log(
+        "Note: Create a SKILL.md file with your skill's prompt content."
+      );
+    }
+    if (existingPkg) {
+      console.log("Note: Values were derived from existing package.json.");
+      console.log("      pspm.json is for publishing to PSPM registry.");
+      console.log("      package.json can still be used for npm dependencies.");
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
+function getCacheFilePath(cacheDir, integrity) {
+  const match = integrity.match(/^sha256-(.+)$/);
+  if (!match) {
+    throw new Error(`Invalid integrity format: ${integrity}`);
+  }
+  const base64Hash = match[1];
+  const hexHash = Buffer.from(base64Hash, "base64").toString("hex");
+  return join(cacheDir, `sha256-${hexHash}.tgz`);
+}
+async function readFromCache(cacheDir, integrity) {
+  try {
+    const cachePath = getCacheFilePath(cacheDir, integrity);
+    const data = await readFile(cachePath);
+    const actualIntegrity = `sha256-${createHash("sha256").update(data).digest("base64")}`;
+    if (actualIntegrity !== integrity) {
+      await rm(cachePath, { force: true });
+      return null;
+    }
+    return data;
+  } catch {
+    return null;
+  }
+}
+async function writeToCache(cacheDir, integrity, data) {
+  try {
+    await mkdir(cacheDir, { recursive: true });
+    const cachePath = getCacheFilePath(cacheDir, integrity);
+    await writeFile(cachePath, data);
+  } catch {
+  }
+}
+async function install(options) {
+  try {
+    const config2 = await resolveConfig();
+    const registryUrl = config2.registryUrl;
+    const apiKey = getTokenForRegistry(config2, registryUrl);
+    const skillsDir = options.dir || getSkillsDir();
+    const cacheDir = getCacheDir();
+    const manifest = await readManifest();
+    const agentConfigs = manifest?.agents;
+    let agents;
+    if (options.agent) {
+      agents = parseAgentArg(options.agent);
+    } else if (manifest) {
+      agents = parseAgentArg(void 0);
+    } else if (options.yes) {
+      agents = parseAgentArg(void 0);
+    } else {
+      console.log("No pspm.json found. Let's set up your project.\n");
+      agents = await promptForAgents();
+    }
+    await migrateLockfileIfNeeded();
+    let lockfile = await readLockfile();
+    const manifestDeps = await getDependencies();
+    const manifestGitHubDeps = await getGitHubDependencies();
+    const lockfilePackages = lockfile?.packages ?? lockfile?.skills ?? {};
+    const lockfileGitHubPackages = lockfile?.githubPackages ?? {};
+    const installedSkills = [];
+    const missingDeps = [];
+    for (const [fullName, versionRange] of Object.entries(manifestDeps)) {
+      if (!lockfilePackages[fullName]) {
+        missingDeps.push({ fullName, versionRange });
+      }
+    }
+    if (missingDeps.length > 0) {
+      if (options.frozenLockfile) {
+        console.error(
+          "Error: Dependencies in pspm.json are not in lockfile. Cannot install with --frozen-lockfile"
+        );
+        console.error("Missing dependencies:");
+        for (const dep of missingDeps) {
+          console.error(`  - ${dep.fullName}@${dep.versionRange}`);
+        }
+        process.exit(1);
+      }
+      console.log(`Resolving ${missingDeps.length} new dependency(ies)...
+`);
+      configure2({ registryUrl, apiKey: apiKey ?? "" });
+      for (const { fullName, versionRange } of missingDeps) {
+        const parsed = parseSkillSpecifier(fullName);
+        if (!parsed) {
+          console.error(`Error: Invalid dependency specifier: ${fullName}`);
+          continue;
+        }
+        const { username, name } = parsed;
+        console.log(`Resolving ${fullName}@${versionRange}...`);
+        const versionsResponse = await listSkillVersions(username, name);
+        if (versionsResponse.status !== 200) {
+          const errorMessage = extractApiErrorMessage(
+            versionsResponse,
+            `Skill ${fullName} not found`
+          );
+          console.error(`Error: ${errorMessage}`);
+          continue;
+        }
+        const versions = versionsResponse.data;
+        if (versions.length === 0) {
+          console.error(`Error: Skill ${fullName} not found`);
+          continue;
+        }
+        const versionStrings = versions.map(
+          (v) => v.version
+        );
+        const resolved = resolveVersion(versionRange || "*", versionStrings);
+        if (!resolved) {
+          console.error(
+            `Error: No version matching "${versionRange}" for ${fullName}`
+          );
+          continue;
+        }
+        const versionResponse = await getSkillVersion(username, name, resolved);
+        if (versionResponse.status !== 200 || !versionResponse.data) {
+          const errorMessage = extractApiErrorMessage(
+            versionResponse,
+            `Version ${resolved} not found`
+          );
+          console.error(`Error: ${errorMessage}`);
+          continue;
+        }
+        const versionInfo = versionResponse.data;
+        const isPresignedUrl = versionInfo.downloadUrl.includes(".r2.cloudflarestorage.com") || versionInfo.downloadUrl.includes("X-Amz-Signature");
+        const downloadHeaders = {};
+        if (!isPresignedUrl && apiKey) {
+          downloadHeaders.Authorization = `Bearer ${apiKey}`;
+        }
+        const tarballResponse = await fetch(versionInfo.downloadUrl, {
+          headers: downloadHeaders,
+          redirect: "follow"
+        });
+        if (!tarballResponse.ok) {
+          console.error(
+            `Error: Failed to download tarball for ${fullName} (${tarballResponse.status})`
+          );
+          continue;
+        }
+        const tarballBuffer = Buffer.from(await tarballResponse.arrayBuffer());
+        const integrity = calculateIntegrity(tarballBuffer);
+        await addToLockfile(fullName, {
+          version: resolved,
+          resolved: versionInfo.downloadUrl,
+          integrity
+        });
+        await writeToCache(cacheDir, integrity, tarballBuffer);
+        console.log(`  Resolved ${fullName}@${resolved}`);
+      }
+      lockfile = await readLockfile();
+    }
+    const missingGitHubDeps = [];
+    for (const [specifier, ref] of Object.entries(manifestGitHubDeps)) {
+      if (!lockfileGitHubPackages[specifier]) {
+        missingGitHubDeps.push({ specifier, ref });
+      }
+    }
+    if (missingGitHubDeps.length > 0) {
+      if (options.frozenLockfile) {
+        console.error(
+          "Error: GitHub dependencies in pspm.json are not in lockfile. Cannot install with --frozen-lockfile"
+        );
+        console.error("Missing GitHub dependencies:");
+        for (const dep of missingGitHubDeps) {
+          console.error(`  - ${dep.specifier}@${dep.ref}`);
+        }
+        process.exit(1);
+      }
+      console.log(
+        `
+Resolving ${missingGitHubDeps.length} GitHub dependency(ies)...
+`
+      );
+      for (const { specifier, ref } of missingGitHubDeps) {
+        const parsed = parseGitHubSpecifier(specifier);
+        if (!parsed) {
+          console.error(`Error: Invalid GitHub specifier: ${specifier}`);
+          continue;
+        }
+        parsed.ref = parsed.ref || ref;
+        console.log(`Resolving ${getGitHubDisplayName(parsed)}...`);
+        try {
+          const result = await downloadGitHubPackage(parsed);
+          await extractGitHubPackage(parsed, result.buffer, skillsDir);
+          const entry = {
+            version: result.commit.slice(0, 7),
+            resolved: `https://github.com/${parsed.owner}/${parsed.repo}`,
+            integrity: result.integrity,
+            gitCommit: result.commit,
+            gitRef: ref || "HEAD"
+          };
+          await addGitHubToLockfile(specifier, entry);
+          await writeToCache(cacheDir, result.integrity, result.buffer);
+          console.log(
+            `  Resolved ${specifier} (${ref}@${result.commit.slice(0, 7)})`
+          );
+        } catch (error) {
+          if (error instanceof GitHubRateLimitError) {
+            console.error(`Error: ${error.message}`);
+          } else if (error instanceof GitHubPathNotFoundError) {
+            console.error(`Error: ${error.message}`);
+          } else if (error instanceof GitHubNotFoundError) {
+            console.error(`Error: ${error.message}`);
+          } else {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(`Error resolving ${specifier}: ${message}`);
+          }
+        }
+      }
+      lockfile = await readLockfile();
+    }
+    const packages = lockfile?.packages ?? lockfile?.skills ?? {};
+    const packageCount = Object.keys(packages).length;
+    if (packageCount > 0) {
+      console.log(`
+Installing ${packageCount} registry skill(s)...
+`);
+      const entries = Object.entries(packages);
+      for (const [fullName, entry] of entries) {
+        const match = fullName.match(/^@user\/([^/]+)\/([^/]+)$/);
+        if (!match) {
+          console.warn(`Warning: Invalid skill name in lockfile: ${fullName}`);
+          continue;
+        }
+        const [, username, name] = match;
+        console.log(`Installing ${fullName}@${entry.version}...`);
+        let tarballBuffer;
+        let fromCache = false;
+        const cachedTarball = await readFromCache(cacheDir, entry.integrity);
+        if (cachedTarball) {
+          tarballBuffer = cachedTarball;
+          fromCache = true;
+        } else {
+          const isPresignedUrl = entry.resolved.includes(".r2.cloudflarestorage.com") || entry.resolved.includes("X-Amz-Signature");
+          const downloadHeaders = {};
+          if (!isPresignedUrl && apiKey) {
+            downloadHeaders.Authorization = `Bearer ${apiKey}`;
+          }
+          const response = await fetch(entry.resolved, {
+            headers: downloadHeaders,
+            redirect: "follow"
+          });
+          if (!response.ok) {
+            if (response.status === 401) {
+              if (!apiKey) {
+                console.error(
+                  `  Error: ${fullName} requires authentication. Run 'pspm login' first.`
+                );
+              } else {
+                console.error(
+                  `  Error: Access denied to ${fullName}. You may not have permission to access this private package.`
+                );
+              }
+            } else {
+              console.error(
+                `  Error: Failed to download ${fullName} (${response.status})`
+              );
+            }
+            continue;
+          }
+          tarballBuffer = Buffer.from(await response.arrayBuffer());
+          const actualIntegrity = `sha256-${createHash("sha256").update(tarballBuffer).digest("base64")}`;
+          if (actualIntegrity !== entry.integrity) {
+            console.error(
+              `  Error: Checksum verification failed for ${fullName}`
+            );
+            if (options.frozenLockfile) {
+              process.exit(1);
+            }
+            continue;
+          }
+          await writeToCache(cacheDir, entry.integrity, tarballBuffer);
+        }
+        const destDir = join(skillsDir, username, name);
+        await rm(destDir, { recursive: true, force: true });
+        await mkdir(destDir, { recursive: true });
+        const tempFile = join(destDir, ".temp.tgz");
+        await writeFile(tempFile, tarballBuffer);
+        const { exec: exec2 } = await import('child_process');
+        const { promisify: promisify2 } = await import('util');
+        const execAsync = promisify2(exec2);
+        try {
+          await execAsync(
+            `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
+          );
+        } finally {
+          await rm(tempFile, { force: true });
+        }
+        console.log(
+          `  Installed to ${destDir}${fromCache ? " (from cache)" : ""}`
+        );
+        installedSkills.push({
+          name,
+          sourcePath: getRegistrySkillPath(username, name)
+        });
+      }
+    }
+    const githubPackages = lockfile?.githubPackages ?? {};
+    const githubCount = Object.keys(githubPackages).length;
+    if (githubCount > 0) {
+      console.log(`
+Installing ${githubCount} GitHub skill(s)...
+`);
+      for (const [specifier, entry] of Object.entries(githubPackages)) {
+        const parsed = parseGitHubSpecifier(specifier);
+        if (!parsed) {
+          console.warn(
+            `Warning: Invalid GitHub specifier in lockfile: ${specifier}`
+          );
+          continue;
+        }
+        const ghEntry = entry;
+        console.log(
+          `Installing ${specifier} (${ghEntry.gitRef}@${ghEntry.gitCommit.slice(0, 7)})...`
+        );
+        let tarballBuffer;
+        let fromCache = false;
+        const cachedTarball = await readFromCache(cacheDir, ghEntry.integrity);
+        if (cachedTarball) {
+          tarballBuffer = cachedTarball;
+          fromCache = true;
+        } else {
+          try {
+            const specWithCommit = { ...parsed, ref: ghEntry.gitCommit };
+            const result = await downloadGitHubPackage(specWithCommit);
+            tarballBuffer = result.buffer;
+            if (result.integrity !== ghEntry.integrity) {
+              console.error(
+                `  Error: Checksum verification failed for ${specifier}`
+              );
+              if (options.frozenLockfile) {
+                process.exit(1);
+              }
+              continue;
+            }
+            await writeToCache(cacheDir, ghEntry.integrity, tarballBuffer);
+          } catch (error) {
+            if (error instanceof GitHubRateLimitError) {
+              console.error(`  Error: ${error.message}`);
+            } else if (error instanceof GitHubPathNotFoundError) {
+              console.error(`  Error: ${error.message}`);
+            } else if (error instanceof GitHubNotFoundError) {
+              console.error(`  Error: ${error.message}`);
+            } else {
+              const message = error instanceof Error ? error.message : String(error);
+              console.error(`  Error downloading ${specifier}: ${message}`);
+            }
+            continue;
+          }
+        }
+        try {
+          const destPath = await extractGitHubPackage(
+            parsed,
+            tarballBuffer,
+            skillsDir
+          );
+          console.log(
+            `  Installed to ${destPath}${fromCache ? " (from cache)" : ""}`
+          );
+          const skillName = getGitHubSkillName(parsed);
+          installedSkills.push({
+            name: skillName,
+            sourcePath: getGitHubSkillPath(
+              parsed.owner,
+              parsed.repo,
+              parsed.path
+            )
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          console.error(`  Error extracting ${specifier}: ${message}`);
+        }
+      }
+    }
+    if (installedSkills.length > 0 && agents[0] !== "none") {
+      console.log(`
+Creating symlinks for agent(s): ${agents.join(", ")}...`);
+      await createAgentSymlinks(installedSkills, {
+        agents,
+        projectRoot: process.cwd(),
+        agentConfigs
+      });
+      console.log("  Symlinks created.");
     }
-    const lines = ["; Project-specific PSPM configuration", ""];
-    if (options.registry) {
-      lines.push(`registry = ${options.registry}`);
+    const totalCount = packageCount + githubCount;
+    if (totalCount === 0) {
+      console.log("No skills to install.");
     } else {
-      lines.push("; Uncomment to use a custom registry:");
-      lines.push("; registry = https://custom-registry.example.com");
+      console.log(`
+All ${totalCount} skill(s) installed.`);
     }
-    lines.push("");
-    await writeFile(configPath, lines.join("\n"));
-    console.log("Created .pspmrc");
-    console.log("");
-    console.log("Contents:");
-    console.log(lines.join("\n"));
-    console.log("Note: .pspmrc should be committed to version control.");
-    console.log("API keys should NOT be stored here - use pspm login instead.");
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     console.error(`Error: ${message}`);
@@ -626,109 +2256,71 @@ async function configInit(options) {
   }
 }
 
-// src/commands/config/show.ts
-async function configShow() {
-  try {
-    const resolved = await resolveConfig();
-    const projectConfig = await findProjectConfig();
-    const configPath = getConfigPath();
-    console.log("Resolved Configuration:\n");
-    console.log(`  Registry URL:   ${resolved.registryUrl}`);
-    console.log(`  API Key:        ${resolved.apiKey ? "***" : "(not set)"}`);
-    console.log(`  Username:       ${resolved.username || "(not set)"}`);
-    console.log("");
-    console.log("Config Locations:");
-    console.log(`  User config:    ${configPath}`);
-    console.log(`  Project config: ${projectConfig ? ".pspmrc" : "(none)"}`);
-    console.log("");
-    console.log("Environment Variables:");
-    console.log(
-      `  PSPM_REGISTRY_URL: ${process.env.PSPM_REGISTRY_URL || "(not set)"}`
-    );
-    console.log(
-      `  PSPM_API_KEY:      ${process.env.PSPM_API_KEY ? "***" : "(not set)"}`
-    );
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Unknown error";
-    console.error(`Error: ${message}`);
-    process.exit(1);
-  }
-}
-async function install(options) {
+// src/commands/link.ts
+async function link(options) {
   try {
-    const apiKey = await requireApiKey();
-    await getRegistryUrl();
-    const skillsDir = options.dir || getSkillsDir();
-    const lockfile = await readLockfile();
-    if (!lockfile) {
-      if (options.frozenLockfile) {
-        console.error(
-          "Error: No lockfile found. Cannot install with --frozen-lockfile"
-        );
-        process.exit(1);
-      }
-      console.log("No lockfile found. Nothing to install.");
-      return;
+    const manifest = await readManifest();
+    const agentConfigs = manifest?.agents;
+    let agents;
+    if (options.agent) {
+      agents = parseAgentArg(options.agent);
+    } else if (manifest) {
+      agents = parseAgentArg(void 0);
+    } else if (options.yes) {
+      agents = parseAgentArg(void 0);
+    } else {
+      console.log("No pspm.json found. Let's set up your project.\n");
+      agents = await promptForAgents();
     }
-    const skillCount = Object.keys(lockfile.skills).length;
-    if (skillCount === 0) {
-      console.log("No skills in lockfile. Nothing to install.");
+    if (agents.length === 1 && agents[0] === "none") {
+      console.log("Skipping symlink creation (--agent none)");
       return;
     }
-    console.log(`Installing ${skillCount} skill(s)...
-`);
-    const entries = Object.entries(lockfile.skills);
-    for (const [fullName, entry] of entries) {
-      const match = fullName.match(/^@user\/([^/]+)\/([^/]+)$/);
-      if (!match) {
-        console.warn(`Warning: Invalid skill name in lockfile: ${fullName}`);
+    const skills = [];
+    const registrySkills = await listLockfileSkills();
+    for (const { name } of registrySkills) {
+      const parsed = parseSkillSpecifier(name);
+      if (!parsed) {
+        console.warn(`Warning: Invalid skill name in lockfile: ${name}`);
         continue;
       }
-      const [, username, name] = match;
-      console.log(`Installing ${fullName}@${entry.version}...`);
-      const isPresignedUrl = entry.resolved.includes(".r2.cloudflarestorage.com") || entry.resolved.includes("X-Amz-Signature");
-      const response = await fetch(entry.resolved, {
-        headers: isPresignedUrl ? {} : {
-          Authorization: `Bearer ${apiKey}`
-        },
-        redirect: "follow"
+      skills.push({
+        name: parsed.name,
+        sourcePath: getRegistrySkillPath(parsed.username, parsed.name)
       });
-      if (!response.ok) {
-        console.error(
-          `  Error: Failed to download ${fullName} (${response.status})`
+    }
+    const githubSkills = await listLockfileGitHubPackages();
+    for (const { specifier } of githubSkills) {
+      const parsed = parseGitHubSpecifier(specifier);
+      if (!parsed) {
+        console.warn(
+          `Warning: Invalid GitHub specifier in lockfile: ${specifier}`
         );
         continue;
       }
-      const tarballBuffer = Buffer.from(await response.arrayBuffer());
-      const { createHash: createHash3 } = await import('crypto');
-      const actualIntegrity = `sha256-${createHash3("sha256").update(tarballBuffer).digest("base64")}`;
-      if (actualIntegrity !== entry.integrity) {
-        console.error(`  Error: Checksum verification failed for ${fullName}`);
-        if (options.frozenLockfile) {
-          process.exit(1);
-        }
-        continue;
-      }
-      const destDir = join(skillsDir, username, name);
-      await rm(destDir, { recursive: true, force: true });
-      await mkdir(destDir, { recursive: true });
-      const tempFile = join(destDir, ".temp.tgz");
-      const { writeFile: writeFile4 } = await import('fs/promises');
-      await writeFile4(tempFile, tarballBuffer);
-      const { exec: exec2 } = await import('child_process');
-      const { promisify: promisify2 } = await import('util');
-      const execAsync = promisify2(exec2);
-      try {
-        await execAsync(
-          `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
-        );
-      } finally {
-        await rm(tempFile, { force: true });
-      }
-      console.log(`  Installed to ${destDir}`);
+      const skillName = getGitHubSkillName(parsed);
+      skills.push({
+        name: skillName,
+        sourcePath: getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path)
+      });
+    }
+    if (skills.length === 0) {
+      console.log("No skills found in lockfile. Nothing to link.");
+      return;
+    }
+    console.log(
+      `Creating symlinks for ${skills.length} skill(s) to agent(s): ${agents.join(", ")}...`
+    );
+    await createAgentSymlinks(skills, {
+      agents,
+      projectRoot: process.cwd(),
+      agentConfigs
+    });
+    console.log("Symlinks created successfully.");
+    console.log("\nLinked skills:");
+    for (const skill of skills) {
+      console.log(`  ${skill.name} -> ${skill.sourcePath}`);
     }
-    console.log(`
-All ${skillCount} skill(s) installed.`);
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     console.error(`Error: ${message}`);
@@ -737,7 +2329,76 @@ All ${skillCount} skill(s) installed.`);
 }
 async function list(options) {
   try {
-    const skills = await listLockfileSkills();
+    const registrySkills = await listLockfileSkills();
+    const githubSkills = await listLockfileGitHubPackages();
+    const manifest = await readManifest();
+    const agentConfigs = manifest?.agents;
+    const availableAgents = getAvailableAgents(agentConfigs);
+    const projectRoot = process.cwd();
+    const skills = [];
+    for (const { name: fullName, entry } of registrySkills) {
+      const match = fullName.match(/^@user\/([^/]+)\/([^/]+)$/);
+      if (!match) continue;
+      const [, username, skillName] = match;
+      const sourcePath = getRegistrySkillPath(username, skillName);
+      const absolutePath = join(projectRoot, sourcePath);
+      let status = "installed";
+      try {
+        await access$1(absolutePath);
+      } catch {
+        status = "missing";
+      }
+      const linkedAgents = await getLinkedAgents(
+        skillName,
+        availableAgents,
+        projectRoot,
+        agentConfigs
+      );
+      skills.push({
+        name: skillName,
+        fullName,
+        version: entry.version,
+        source: "registry",
+        sourcePath,
+        status,
+        linkedAgents
+      });
+    }
+    for (const { specifier, entry } of githubSkills) {
+      const parsed = parseGitHubSpecifier(specifier);
+      if (!parsed) continue;
+      const ghEntry = entry;
+      const skillName = getGitHubSkillName(parsed);
+      const sourcePath = getGitHubSkillPath(
+        parsed.owner,
+        parsed.repo,
+        parsed.path
+      );
+      const absolutePath = join(projectRoot, sourcePath);
+      let status = "installed";
+      try {
+        await access$1(absolutePath);
+      } catch {
+        status = "missing";
+      }
+      const linkedAgents = await getLinkedAgents(
+        skillName,
+        availableAgents,
+        projectRoot,
+        agentConfigs
+      );
+      skills.push({
+        name: skillName,
+        fullName: specifier,
+        version: ghEntry.gitCommit.slice(0, 7),
+        source: "github",
+        sourcePath,
+        status,
+        linkedAgents,
+        gitRef: ghEntry.gitRef,
+        gitCommit: ghEntry.gitCommit
+      });
+    }
     if (skills.length === 0) {
       console.log("No skills installed.");
       return;
@@ -746,26 +2407,33 @@ async function list(options) {
       console.log(JSON.stringify(skills, null, 2));
       return;
     }
-    const skillsDir = getSkillsDir();
     console.log("Installed skills:\n");
-    for (const { name, entry } of skills) {
-      const match = name.match(/^@user\/([^/]+)\/([^/]+)$/);
-      if (!match) continue;
-      const [, username, skillName] = match;
-      const skillPath = join(skillsDir, username, skillName);
-      let status = "installed";
-      try {
-        await access(skillPath);
-      } catch {
-        status = "missing";
+    for (const skill of skills) {
+      if (skill.source === "registry") {
+        console.log(`  ${skill.fullName}@${skill.version} (registry)`);
+      } else {
+        const refInfo = skill.gitRef ? `${skill.gitRef}@${skill.gitCommit?.slice(0, 7)}` : skill.version;
+        console.log(`  ${skill.fullName} (${refInfo})`);
       }
-      console.log(`  ${name}@${entry.version}`);
-      if (status === "missing") {
+      if (skill.status === "missing") {
         console.log(`    Status: MISSING (run 'pspm install' to restore)`);
       }
+      if (skill.linkedAgents.length > 0) {
+        for (const agent of skill.linkedAgents) {
+          const config2 = resolveAgentConfig(agent, agentConfigs);
+          if (config2) {
+            console.log(`    -> ${config2.skillsDir}/${skill.name}`);
+          }
+        }
+      }
     }
+    const registryCount = skills.filter((s) => s.source === "registry").length;
+    const githubCount = skills.filter((s) => s.source === "github").length;
+    const parts = [];
+    if (registryCount > 0) parts.push(`${registryCount} registry`);
+    if (githubCount > 0) parts.push(`${githubCount} github`);
     console.log(`
-Total: ${skills.length} skill(s)`);
+Total: ${skills.length} skill(s) (${parts.join(", ")})`);
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     console.error(`Error: ${message}`);
@@ -778,7 +2446,7 @@ function getWebAppUrl(registryUrl) {
     return process.env.PSPM_WEB_URL.replace(/\/$/, "");
   }
   try {
-    const url = new URL(registryUrl);
+    const url = new URL$1(registryUrl);
     return `${url.protocol}//${url.host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
@@ -786,7 +2454,7 @@ function getWebAppUrl(registryUrl) {
 }
 function getServerUrl(registryUrl) {
   try {
-    const url = new URL(registryUrl);
+    const url = new URL$1(registryUrl);
     return `${url.protocol}//${url.host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
@@ -818,7 +2486,7 @@ function startCallbackServer(expectedState) {
       rejectToken = reject;
     });
     const server = http.createServer((req, res) => {
-      const url = new URL(req.url || "/", `http://localhost`);
+      const url = new URL$1(req.url || "/", `http://localhost`);
       if (url.pathname === "/callback") {
         const token = url.searchParams.get("token");
         const state = url.searchParams.get("state");
@@ -964,7 +2632,132 @@ async function logout() {
     process.exit(1);
   }
 }
+async function migrate(options) {
+  try {
+    const legacySkillsDir = getLegacySkillsDir();
+    const newSkillsDir = getSkillsDir();
+    const legacyLockfilePath = getLegacyLockfilePath();
+    const newLockfilePath = getLockfilePath();
+    const pspmDir = getPspmDir();
+    let migrationNeeded = false;
+    const actions = [];
+    try {
+      const legacyStats = await stat(legacySkillsDir);
+      if (legacyStats.isDirectory()) {
+        const contents = await readdir(legacySkillsDir);
+        if (contents.length > 0) {
+          migrationNeeded = true;
+          actions.push(`Move .skills/ \u2192 .pspm/skills/`);
+        }
+      }
+    } catch {
+    }
+    try {
+      await stat(legacyLockfilePath);
+      try {
+        await stat(newLockfilePath);
+        actions.push(
+          `Note: Both skill-lock.json and pspm-lock.json exist. Manual merge may be needed.`
+        );
+      } catch {
+        migrationNeeded = true;
+        actions.push(`Migrate skill-lock.json \u2192 pspm-lock.json`);
+      }
+    } catch {
+    }
+    if (!migrationNeeded && actions.length === 0) {
+      console.log(
+        "No migration needed. Project is already using the new structure."
+      );
+      return;
+    }
+    if (options.dryRun) {
+      console.log("Migration plan (dry run):");
+      console.log("");
+      for (const action of actions) {
+        console.log(`  - ${action}`);
+      }
+      console.log("");
+      console.log("Run without --dry-run to perform migration.");
+      return;
+    }
+    console.log("Migrating project structure...\n");
+    const lockfileMigrated = await migrateLockfileIfNeeded();
+    if (lockfileMigrated) {
+      console.log("  \u2713 Migrated skill-lock.json \u2192 pspm-lock.json");
+    }
+    try {
+      const legacyStats = await stat(legacySkillsDir);
+      if (legacyStats.isDirectory()) {
+        const contents = await readdir(legacySkillsDir);
+        if (contents.length > 0) {
+          await mkdir(pspmDir, { recursive: true });
+          try {
+            const newStats = await stat(newSkillsDir);
+            if (newStats.isDirectory()) {
+              const newContents = await readdir(newSkillsDir);
+              if (newContents.length > 0) {
+                console.log(
+                  "  ! Both .skills/ and .pspm/skills/ have content. Manual merge required."
+                );
+              } else {
+                await rm(newSkillsDir, { recursive: true, force: true });
+                await rename(legacySkillsDir, newSkillsDir);
+                console.log("  \u2713 Moved .skills/ \u2192 .pspm/skills/");
+              }
+            }
+          } catch {
+            await rename(legacySkillsDir, newSkillsDir);
+            console.log("  \u2713 Moved .skills/ \u2192 .pspm/skills/");
+          }
+        }
+      }
+    } catch {
+    }
+    console.log("");
+    console.log("Migration complete!");
+    console.log("");
+    console.log(
+      "You can safely delete these legacy files if they still exist:"
+    );
+    console.log("  - skill-lock.json (replaced by pspm-lock.json)");
+    console.log("  - .skills/ (replaced by .pspm/skills/)");
+    console.log("");
+    console.log("Update your .gitignore to include:");
+    console.log("  .pspm/cache/");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  }
+}
 var exec = promisify(exec$1);
+async function detectManifest() {
+  const cwd = process.cwd();
+  const pspmJsonPath = join(cwd, "pspm.json");
+  try {
+    const content = await readFile(pspmJsonPath, "utf-8");
+    const manifest = JSON.parse(content);
+    return { type: "pspm.json", manifest, path: pspmJsonPath };
+  } catch {
+  }
+  const packageJsonPath = join(cwd, "package.json");
+  try {
+    const content = await readFile(packageJsonPath, "utf-8");
+    const packageJson2 = JSON.parse(content);
+    const manifest = {
+      name: packageJson2.name,
+      version: packageJson2.version,
+      description: packageJson2.description,
+      author: typeof packageJson2.author === "string" ? packageJson2.author : packageJson2.author?.name,
+      license: packageJson2.license,
+      files: packageJson2.files
+    };
+    return { type: "package.json", manifest, path: packageJsonPath };
+  } catch {
+    throw new Error("No pspm.json or package.json found in current directory");
+  }
+}
 function formatBytes(bytes) {
   if (bytes < 1024) return `${bytes}B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}kB`;
@@ -996,23 +2789,26 @@ async function publishCommand(options) {
   try {
     const apiKey = await requireApiKey();
     const registryUrl = await getRegistryUrl();
-    const packageJsonPath = join(process.cwd(), "package.json");
-    let packageJson2;
-    try {
-      const content = await readFile(packageJsonPath, "utf-8");
-      packageJson2 = JSON.parse(content);
-    } catch {
-      console.error("Error: No package.json found in current directory");
-      process.exit(1);
-    }
-    if (!packageJson2.name) {
-      console.error("Error: package.json must have a 'name' field");
-      process.exit(1);
+    const detection = await detectManifest();
+    const manifest = detection.manifest;
+    if (detection.type === "package.json") {
+      console.log("pspm warn Using package.json instead of pspm.json");
+      console.log(
+        "pspm warn Run 'pspm init' to create a dedicated pspm.json manifest"
+      );
+      console.log("");
     }
-    if (!packageJson2.version) {
-      console.error("Error: package.json must have a 'version' field");
+    const validation = validateManifest(manifest);
+    if (!validation.valid) {
+      console.error(`Error: ${validation.error}`);
       process.exit(1);
     }
+    const packageJson2 = {
+      name: manifest.name,
+      version: manifest.version,
+      description: manifest.description,
+      files: manifest.files
+    };
     if (options.bump) {
       const semver2 = await import('semver');
       const newVersion = semver2.default.inc(packageJson2.version, options.bump);
@@ -1030,13 +2826,7 @@ async function publishCommand(options) {
     const tempDir = join(process.cwd(), ".pspm-publish");
     try {
       await exec(`rm -rf "${tempDir}" && mkdir -p "${tempDir}"`);
-      const files = packageJson2.files || [
-        "package.json",
-        "SKILL.md",
-        "runtime",
-        "scripts",
-        "data"
-      ];
+      const files = packageJson2.files || [...DEFAULT_SKILL_FILES];
       await exec(`mkdir -p "${tempDir}/package"`);
       for (const file of files) {
         try {
@@ -1046,7 +2836,18 @@ async function publishCommand(options) {
         } catch {
         }
       }
-      await exec(`cp package.json "${tempDir}/package/"`);
+      if (detection.type === "pspm.json") {
+        await exec(`cp pspm.json "${tempDir}/package/"`);
+        try {
+          await stat(join(process.cwd(), "package.json"));
+          await exec(
+            `cp package.json "${tempDir}/package/" 2>/dev/null || true`
+          );
+        } catch {
+        }
+      } else {
+        await exec(`cp package.json "${tempDir}/package/"`);
+      }
       const packageDir = join(tempDir, "package");
       const tarballContents = await getFilesWithSizes(packageDir, packageDir);
       const unpackedSize = tarballContents.reduce((acc, f) => acc + f.size, 0);
@@ -1103,6 +2904,25 @@ async function publishCommand(options) {
         `+ @user/${result.skill.username}/${result.skill.name}@${result.version.version}`
       );
       console.log(`Checksum: ${result.version.checksum}`);
+      if (options.access) {
+        console.log(`
+Setting visibility to ${options.access}...`);
+        const accessResponse = await changeSkillAccess(packageJson2.name, {
+          visibility: options.access
+        });
+        if (accessResponse.status !== 200 || !accessResponse.data) {
+          console.warn(
+            `Warning: Failed to set visibility: ${accessResponse.error ?? "Unknown error"}`
+          );
+        } else {
+          console.log(`Package is now ${accessResponse.data.visibility}`);
+          if (options.access === "public") {
+            console.log(
+              "Note: This action is irreversible. Public packages cannot be made private."
+            );
+          }
+        }
+      }
     } finally {
       await exec(`rm -rf "${tempDir}"`).catch(() => {
       });
@@ -1118,59 +2938,103 @@ async function publishCommand(options) {
 }
 async function remove(nameOrSpecifier) {
   try {
-    await requireApiKey();
-    let fullName;
-    let username;
-    let name;
-    if (nameOrSpecifier.startsWith("@user/")) {
-      const match = nameOrSpecifier.match(/^@user\/([^/]+)\/([^@/]+)/);
-      if (!match) {
-        console.error(`Error: Invalid skill specifier: ${nameOrSpecifier}`);
-        process.exit(1);
-      }
-      fullName = `@user/${match[1]}/${match[2]}`;
-      username = match[1];
-      name = match[2];
+    const manifest = await readManifest();
+    const agentConfigs = manifest?.agents;
+    const agents = getAvailableAgents(agentConfigs);
+    if (isGitHubSpecifier(nameOrSpecifier)) {
+      await removeGitHub(nameOrSpecifier, agents, agentConfigs);
+    } else if (nameOrSpecifier.startsWith("@user/")) {
+      await removeRegistry(nameOrSpecifier, agents, agentConfigs);
     } else {
-      const skills = await listLockfileSkills();
-      const found = skills.find((s) => {
-        const match2 = s.name.match(/^@user\/([^/]+)\/([^/]+)$/);
-        return match2 && match2[2] === nameOrSpecifier;
-      });
-      if (!found) {
-        console.error(
-          `Error: Skill "${nameOrSpecifier}" not found in lockfile`
-        );
-        process.exit(1);
-      }
-      fullName = found.name;
-      const match = fullName.match(/^@user\/([^/]+)\/([^/]+)$/);
-      if (!match) {
-        console.error(`Error: Invalid skill name in lockfile: ${fullName}`);
-        process.exit(1);
-      }
-      username = match[1];
-      name = match[2];
-    }
-    console.log(`Removing ${fullName}...`);
-    const removed = await removeFromLockfile(fullName);
-    if (!removed) {
-      console.error(`Error: ${fullName} not found in lockfile`);
-      process.exit(1);
-    }
-    const skillsDir = getSkillsDir();
-    const destDir = join(skillsDir, username, name);
-    try {
-      await rm(destDir, { recursive: true, force: true });
-    } catch {
+      await removeByShortName(nameOrSpecifier, agents, agentConfigs);
     }
-    console.log(`Removed ${fullName}`);
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     console.error(`Error: ${message}`);
     process.exit(1);
   }
 }
+async function removeRegistry(specifier, agents, agentConfigs) {
+  const match = specifier.match(/^@user\/([^/]+)\/([^@/]+)/);
+  if (!match) {
+    console.error(`Error: Invalid skill specifier: ${specifier}`);
+    process.exit(1);
+  }
+  const fullName = `@user/${match[1]}/${match[2]}`;
+  const username = match[1];
+  const name = match[2];
+  console.log(`Removing ${fullName}...`);
+  const removedFromLockfile = await removeFromLockfile(fullName);
+  const removedFromManifest = await removeDependency(fullName);
+  if (!removedFromLockfile && !removedFromManifest) {
+    console.error(`Error: ${fullName} not found in lockfile or pspm.json`);
+    process.exit(1);
+  }
+  await removeAgentSymlinks(name, {
+    agents,
+    projectRoot: process.cwd(),
+    agentConfigs
+  });
+  const skillsDir = getSkillsDir();
+  const destDir = join(skillsDir, username, name);
+  try {
+    await rm(destDir, { recursive: true, force: true });
+  } catch {
+  }
+  console.log(`Removed ${fullName}`);
+}
+async function removeGitHub(specifier, agents, agentConfigs) {
+  const parsed = parseGitHubSpecifier(specifier);
+  if (!parsed) {
+    console.error(`Error: Invalid GitHub specifier: ${specifier}`);
+    process.exit(1);
+  }
+  const lockfileKey = parsed.path ? `github:${parsed.owner}/${parsed.repo}/${parsed.path}` : `github:${parsed.owner}/${parsed.repo}`;
+  console.log(`Removing ${lockfileKey}...`);
+  const removedFromLockfile = await removeGitHubFromLockfile(lockfileKey);
+  const removedFromManifest = await removeGitHubDependency(lockfileKey);
+  if (!removedFromLockfile && !removedFromManifest) {
+    console.error(`Error: ${lockfileKey} not found in lockfile or pspm.json`);
+    process.exit(1);
+  }
+  const skillName = getGitHubSkillName(parsed);
+  await removeAgentSymlinks(skillName, {
+    agents,
+    projectRoot: process.cwd(),
+    agentConfigs
+  });
+  const skillsDir = getSkillsDir();
+  const destPath = getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path);
+  const destDir = join(skillsDir, "..", destPath);
+  try {
+    await rm(destDir, { recursive: true, force: true });
+  } catch {
+  }
+  console.log(`Removed ${lockfileKey}`);
+}
+async function removeByShortName(shortName, agents, agentConfigs) {
+  const registrySkills = await listLockfileSkills();
+  const foundRegistry = registrySkills.find((s) => {
+    const match = s.name.match(/^@user\/([^/]+)\/([^/]+)$/);
+    return match && match[2] === shortName;
+  });
+  if (foundRegistry) {
+    await removeRegistry(foundRegistry.name, agents, agentConfigs);
+    return;
+  }
+  const githubSkills = await listLockfileGitHubPackages();
+  const foundGitHub = githubSkills.find((s) => {
+    const parsed = parseGitHubSpecifier(s.specifier);
+    if (!parsed) return false;
+    return getGitHubSkillName(parsed) === shortName;
+  });
+  if (foundGitHub) {
+    await removeGitHub(foundGitHub.specifier, agents, agentConfigs);
+    return;
+  }
+  console.error(`Error: Skill "${shortName}" not found in lockfile`);
+  process.exit(1);
+}
 
 // src/commands/unpublish.ts
 async function unpublish(specifier, options) {
@@ -1356,8 +3220,31 @@ program.command("logout").description("Log out and clear stored credentials").ac
 program.command("whoami").description("Show current user information").action(async () => {
   await whoami();
 });
-program.command("add <specifier>").description("Add a skill (e.g., @user/bsheng/vite_slides@^2.0.0)").option("--save", "Save to lockfile (default)").action(async (specifier, options) => {
-  await add(specifier, { save: options.save ?? true });
+program.command("init").description("Create a new pspm.json manifest in the current directory").option("-n, --name <name>", "Skill name").option("-d, --description <desc>", "Skill description").option("-a, --author <author>", "Author name").option("-y, --yes", "Skip prompts and use defaults").option("-f, --force", "Overwrite existing pspm.json").action(async (options) => {
+  await init({
+    name: options.name,
+    description: options.description,
+    author: options.author,
+    yes: options.yes,
+    force: options.force
+  });
+});
+program.command("migrate").description(
+  "Migrate from old directory structure (.skills/, skill-lock.json)"
+).option("--dry-run", "Show what would be migrated without making changes").action(async (options) => {
+  await migrate({ dryRun: options.dryRun });
+});
+program.command("add <specifier>").description(
+  "Add a skill (e.g., @user/bsheng/vite_slides@^2.0.0 or github:owner/repo/path@ref)"
+).option("--save", "Save to lockfile (default)").option(
+  "--agent <agents>",
+  'Comma-separated agents for symlinks (default: "claude-code", use "none" to skip)'
+).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (specifier, options) => {
+  await add(specifier, {
+    save: options.save ?? true,
+    agent: options.agent,
+    yes: options.yes
+  });
 });
 program.command("remove <name>").alias("rm").description("Remove an installed skill").action(async (name) => {
   await remove(name);
@@ -1365,24 +3252,49 @@ program.command("remove <name>").alias("rm").description("Remove an installed sk
 program.command("list").alias("ls").description("List installed skills").option("--json", "Output as JSON").action(async (options) => {
   await list({ json: options.json });
 });
-program.command("install").alias("i").description("Install all skills from lockfile").option("--frozen-lockfile", "Fail if lockfile is missing or outdated").option("--dir <path>", "Install skills to a specific directory").action(async (options) => {
+program.command("install").alias("i").description("Install all skills from lockfile").option("--frozen-lockfile", "Fail if lockfile is missing or outdated").option("--dir <path>", "Install skills to a specific directory").option(
+  "--agent <agents>",
+  'Comma-separated agents for symlinks (default: "claude-code", use "none" to skip)'
+).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (options) => {
   await install({
     frozenLockfile: options.frozenLockfile,
-    dir: options.dir
+    dir: options.dir,
+    agent: options.agent,
+    yes: options.yes
   });
 });
+program.command("link").description("Recreate agent symlinks without reinstalling").option(
+  "--agent <agents>",
+  'Comma-separated agents for symlinks (default: "claude-code", use "none" to skip)'
+).option("-y, --yes", "Skip agent selection prompt and use defaults").action(async (options) => {
+  await link({ agent: options.agent, yes: options.yes });
+});
 program.command("update").description("Update all skills to latest compatible versions").option("--dry-run", "Show what would be updated without making changes").action(async (options) => {
   await update({ dryRun: options.dryRun });
 });
-program.command("publish").description("Publish current directory as a skill").option("--bump <level>", "Bump version (major, minor, patch)").option("--tag <tag>", "Tag for the release").action(async (options) => {
+program.command("publish").description("Publish current directory as a skill").option("--bump <level>", "Bump version (major, minor, patch)").option("--tag <tag>", "Tag for the release").option("--access <level>", "Set package visibility (public or private)").action(async (options) => {
   await publishCommand({
     bump: options.bump,
-    tag: options.tag
+    tag: options.tag,
+    access: options.access
   });
 });
-program.command("unpublish <specifier>").description("Remove a published skill version").option("--force", "Confirm destructive action").action(async (specifier, options) => {
+program.command("unpublish <specifier>").description(
+  "Remove a published skill version (only within 72 hours of publishing)"
+).option("--force", "Confirm destructive action").action(async (specifier, options) => {
   await unpublish(specifier, { force: options.force });
 });
+program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public (irreversible)").option("--private", "Make the package private (only for private packages)").action(async (specifier, options) => {
+  await access(specifier, {
+    public: options.public,
+    private: options.private
+  });
+});
+program.command("deprecate <specifier> [message]").description(
+  "Mark a skill version as deprecated (alternative to unpublish after 72 hours)"
+).option("--undo", "Remove deprecation status").action(async (specifier, message, options) => {
+  await deprecate(specifier, message, { undo: options.undo });
+});
 program.parse();
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map