@anytio/pspm 0.2.0 → 0.3.2

package/dist/index.js

@@ -63,13 +63,16 @@ var init_generated = __esm({
     "use strict";
     init_fetcher();
     getMeUrl = () => {
-      return "/api/skills/me";
+      return `/api/skills/me`;
     };
     me = async (options) => {
-      return customFetch(getMeUrl(), {
-        ...options,
-        method: "GET"
-      });
+      return customFetch(
+        getMeUrl(),
+        {
+          ...options,
+          method: "GET"
+        }
+      );
     };
     getListSkillVersionsUrl = (username, name) => {
       return `/api/skills/@user/${username}/${name}/versions`;
@@ -96,24 +99,32 @@ var init_generated = __esm({
       );
     };
     getPublishSkillUrl = () => {
-      return "/api/skills/publish";
+      return `/api/skills/publish`;
     };
     publishSkill = async (publishSkillInput, options) => {
-      return customFetch(getPublishSkillUrl(), {
-        ...options,
-        method: "POST",
-        headers: { "Content-Type": "application/json", ...options?.headers },
-        body: JSON.stringify(publishSkillInput)
-      });
+      return customFetch(
+        getPublishSkillUrl(),
+        {
+          ...options,
+          method: "POST",
+          headers: { "Content-Type": "application/json", ...options?.headers },
+          body: JSON.stringify(
+            publishSkillInput
+          )
+        }
+      );
     };
     getDeleteSkillUrl = (name) => {
       return `/api/skills/${name}`;
     };
     deleteSkill = async (name, options) => {
-      return customFetch(getDeleteSkillUrl(name), {
-        ...options,
-        method: "DELETE"
-      });
+      return customFetch(
+        getDeleteSkillUrl(name),
+        {
+          ...options,
+          method: "DELETE"
+        }
+      );
     };
     getDeleteSkillVersionUrl = (name, version2) => {
       return `/api/skills/${name}/${version2}`;
@@ -609,6 +620,91 @@ var init_integrity = __esm({
   }
 });
 
+// src/lib/local.ts
+import { access, stat as stat2 } from "fs/promises";
+import { isAbsolute, join as join2, resolve } from "path";
+function isLocalSpecifier(specifier) {
+  return specifier.startsWith("file:");
+}
+function isBareLocalPath(specifier) {
+  return specifier.startsWith("./") || specifier.startsWith("../");
+}
+function parseLocalSpecifier(specifier) {
+  const match = specifier.match(LOCAL_SPECIFIER_PATTERN);
+  if (!match) {
+    return null;
+  }
+  const path = match[1];
+  if (!path || path.trim() === "") {
+    return null;
+  }
+  return {
+    path,
+    isAbsolute: isAbsolute(path)
+  };
+}
+function getLocalSkillName(spec) {
+  const normalizedPath = spec.path.replace(/\/+$/, "");
+  const segments = normalizedPath.split("/").filter(Boolean);
+  return segments[segments.length - 1] || spec.path;
+}
+function normalizeToFileSpecifier(path) {
+  if (isLocalSpecifier(path)) {
+    return path;
+  }
+  return `file:${path}`;
+}
+function resolveLocalPath(spec, basePath = process.cwd()) {
+  if (spec.isAbsolute) {
+    return resolve(spec.path);
+  }
+  return resolve(basePath, spec.path);
+}
+async function validateLocalSkill(absolutePath) {
+  try {
+    const stats = await stat2(absolutePath);
+    if (!stats.isDirectory()) {
+      return { valid: false, error: `Not a directory: ${absolutePath}` };
+    }
+  } catch {
+    return { valid: false, error: `Directory not found: ${absolutePath}` };
+  }
+  const manifestPath = join2(absolutePath, "pspm.json");
+  try {
+    await access(manifestPath);
+  } catch {
+    return {
+      valid: false,
+      error: `No pspm.json found in ${absolutePath}`
+    };
+  }
+  try {
+    const { readFile: readFile7 } = await import("fs/promises");
+    const content = await readFile7(manifestPath, "utf-8");
+    const manifest = JSON.parse(content);
+    if (!manifest.name) {
+      return {
+        valid: false,
+        error: `Manifest in ${absolutePath} is missing 'name' field`
+      };
+    }
+    return { valid: true, manifest };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      valid: false,
+      error: `Failed to read manifest in ${absolutePath}: ${message}`
+    };
+  }
+}
+var LOCAL_SPECIFIER_PATTERN;
+var init_local = __esm({
+  "src/lib/local.ts"() {
+    "use strict";
+    LOCAL_SPECIFIER_PATTERN = /^file:(.+)$/;
+  }
+});
+
 // src/lib/manifest.ts
 function validateManifest(manifest) {
   if (!manifest.name) {
@@ -645,6 +741,349 @@ var init_manifest = __esm({
   }
 });
 
+// src/lib/version.ts
+import * as semver from "semver";
+function resolveVersion(range, availableVersions) {
+  const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
+  if (!range || range === "latest" || range === "*") {
+    return sorted[0] ?? null;
+  }
+  return semver.maxSatisfying(sorted, range);
+}
+function findHighestSatisfying(ranges, availableVersions) {
+  const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
+  if (sorted.length === 0) return null;
+  const normalizedRanges = ranges.map(
+    (r) => !r || r === "latest" || r === "*" ? "*" : r
+  );
+  for (const version2 of sorted) {
+    const satisfiesAll = normalizedRanges.every(
+      (range) => semver.satisfies(version2, range)
+    );
+    if (satisfiesAll) {
+      return version2;
+    }
+  }
+  return null;
+}
+var init_version = __esm({
+  "src/lib/version.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/resolver.ts
+async function resolveRecursive(rootDeps, config2) {
+  const graph = {
+    nodes: /* @__PURE__ */ new Map(),
+    roots: Object.keys(rootDeps),
+    errors: [],
+    conflicts: []
+  };
+  configure2({
+    registryUrl: config2.registryUrl,
+    apiKey: config2.apiKey ?? ""
+  });
+  const rangesByPackage = /* @__PURE__ */ new Map();
+  const queue = [];
+  for (const [name, range] of Object.entries(rootDeps)) {
+    queue.push({
+      name,
+      versionRange: range,
+      depth: 0,
+      dependent: "root",
+      path: []
+    });
+  }
+  const processing = /* @__PURE__ */ new Set();
+  while (queue.length > 0) {
+    const item = queue.shift();
+    if (!item) continue;
+    const { name, versionRange, depth, dependent, path } = item;
+    if (depth > config2.maxDepth) {
+      graph.errors.push({
+        type: "max_depth_exceeded",
+        package: name,
+        message: `Maximum dependency depth (${config2.maxDepth}) exceeded at: ${[...path, name].join(" -> ")}`,
+        path: [...path, name]
+      });
+      continue;
+    }
+    if (path.includes(name)) {
+      graph.errors.push({
+        type: "circular_dependency",
+        package: name,
+        message: `Circular dependency detected: ${[...path, name].join(" -> ")}`,
+        path: [...path, name]
+      });
+      continue;
+    }
+    if (!rangesByPackage.has(name)) {
+      rangesByPackage.set(name, []);
+    }
+    rangesByPackage.get(name)?.push({
+      range: versionRange,
+      dependent,
+      depth
+    });
+    if (processing.has(name)) {
+      continue;
+    }
+    processing.add(name);
+    const match = name.match(/^@user\/([^/]+)\/([^/]+)$/);
+    if (!match) {
+      graph.errors.push({
+        type: "package_not_found",
+        package: name,
+        message: `Invalid package name format: ${name}`
+      });
+      continue;
+    }
+    const [, username, skillName] = match;
+    try {
+      const versionsResponse = await listSkillVersions(username, skillName);
+      if (versionsResponse.status !== 200) {
+        graph.errors.push({
+          type: "package_not_found",
+          package: name,
+          message: `Package ${name} not found in registry`
+        });
+        continue;
+      }
+      const versions = versionsResponse.data;
+      if (versions.length === 0) {
+        graph.errors.push({
+          type: "package_not_found",
+          package: name,
+          message: `Package ${name} has no versions`
+        });
+        continue;
+      }
+      const availableVersions = versions.map((v) => v.version);
+      const resolvedVersion = findHighestSatisfying(
+        [versionRange],
+        availableVersions
+      );
+      if (!resolvedVersion) {
+        graph.errors.push({
+          type: "no_satisfying_version",
+          package: name,
+          message: `No version of ${name} satisfies: ${versionRange}`
+        });
+        continue;
+      }
+      const versionResponse = await getSkillVersion(
+        username,
+        skillName,
+        resolvedVersion
+      );
+      if (versionResponse.status !== 200 || !versionResponse.data) {
+        graph.errors.push({
+          type: "fetch_error",
+          package: name,
+          message: `Failed to fetch ${name}@${resolvedVersion}`
+        });
+        continue;
+      }
+      const versionInfo = versionResponse.data;
+      const manifest = versionInfo.manifest;
+      const dependencies = manifest?.dependencies ?? {};
+      const node = {
+        name,
+        version: resolvedVersion,
+        versionRange,
+        downloadUrl: versionInfo.downloadUrl,
+        integrity: `sha256-${Buffer.from(versionInfo.checksum, "hex").toString("base64")}`,
+        depth,
+        dependencies,
+        dependents: [dependent],
+        isDirect: depth === 0,
+        deprecated: versionInfo.deprecationMessage ?? void 0
+      };
+      graph.nodes.set(name, node);
+      for (const [depName, depRange] of Object.entries(dependencies)) {
+        queue.push({
+          name: depName,
+          versionRange: depRange,
+          depth: depth + 1,
+          dependent: name,
+          path: [...path, name]
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      graph.errors.push({
+        type: "fetch_error",
+        package: name,
+        message: `Error fetching ${name}: ${message}`
+      });
+    }
+  }
+  for (const [name, ranges] of rangesByPackage.entries()) {
+    const node = graph.nodes.get(name);
+    if (!node) continue;
+    const uniqueDependents = [...new Set(ranges.map((r) => r.dependent))];
+    node.dependents = uniqueDependents;
+    const allRanges = ranges.map((r) => r.range);
+    const match = name.match(/^@user\/([^/]+)\/([^/]+)$/);
+    if (!match) continue;
+    const [, username, skillName] = match;
+    try {
+      const versionsResponse = await listSkillVersions(username, skillName);
+      if (versionsResponse.status !== 200) continue;
+      const versions = versionsResponse.data;
+      const availableVersions = versions.map((v) => v.version);
+      const finalVersion = findHighestSatisfying(allRanges, availableVersions);
+      if (!finalVersion) {
+        graph.conflicts.push({
+          package: name,
+          ranges: ranges.map((r) => ({
+            dependent: r.dependent,
+            range: r.range
+          })),
+          availableVersions
+        });
+        graph.errors.push({
+          type: "no_satisfying_version",
+          package: name,
+          message: `No version of ${name} satisfies all requirements: ${allRanges.join(", ")}`
+        });
+        continue;
+      }
+      if (finalVersion !== node.version) {
+        const versionResponse = await getSkillVersion(
+          username,
+          skillName,
+          finalVersion
+        );
+        if (versionResponse.status === 200 && versionResponse.data) {
+          const versionInfo = versionResponse.data;
+          node.version = finalVersion;
+          node.downloadUrl = versionInfo.downloadUrl;
+          node.integrity = `sha256-${Buffer.from(versionInfo.checksum, "hex").toString("base64")}`;
+          node.deprecated = versionInfo.deprecationMessage ?? void 0;
+          const manifest = versionInfo.manifest;
+          node.dependencies = manifest?.dependencies ?? {};
+        }
+      }
+    } catch {
+    }
+  }
+  const installOrder = topologicalSort(graph);
+  const success = graph.errors.length === 0 && graph.conflicts.length === 0;
+  return {
+    success,
+    graph,
+    installOrder
+  };
+}
+function topologicalSort(graph) {
+  const inDegree = /* @__PURE__ */ new Map();
+  const dependents = /* @__PURE__ */ new Map();
+  for (const name of graph.nodes.keys()) {
+    inDegree.set(name, 0);
+    dependents.set(name, []);
+  }
+  for (const [name, node] of graph.nodes.entries()) {
+    for (const depName of Object.keys(node.dependencies)) {
+      if (graph.nodes.has(depName)) {
+        inDegree.set(name, (inDegree.get(name) ?? 0) + 1);
+        if (!dependents.has(depName)) {
+          dependents.set(depName, []);
+        }
+        dependents.get(depName)?.push(name);
+      }
+    }
+  }
+  const queue = [];
+  for (const [name, degree] of inDegree.entries()) {
+    if (degree === 0) {
+      queue.push(name);
+    }
+  }
+  const sorted = [];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    if (!current) continue;
+    sorted.push(current);
+    const deps = dependents.get(current) ?? [];
+    for (const dependent of deps) {
+      const newDegree = (inDegree.get(dependent) ?? 1) - 1;
+      inDegree.set(dependent, newDegree);
+      if (newDegree === 0 && !sorted.includes(dependent)) {
+        queue.push(dependent);
+      }
+    }
+  }
+  return sorted;
+}
+function computeInstallOrder(packages) {
+  const visited = /* @__PURE__ */ new Set();
+  const order = [];
+  function visit(name) {
+    if (visited.has(name)) return;
+    visited.add(name);
+    const entry = packages[name];
+    if (entry?.dependencies) {
+      for (const dep of Object.keys(entry.dependencies)) {
+        visit(dep);
+      }
+    }
+    order.push(name);
+  }
+  for (const name of Object.keys(packages)) {
+    visit(name);
+  }
+  return order;
+}
+function formatResolutionErrors(errors) {
+  return errors.map((error) => {
+    switch (error.type) {
+      case "circular_dependency":
+        return `Circular dependency: ${error.path?.join(" -> ") ?? error.package}`;
+      case "max_depth_exceeded":
+        return `Max depth exceeded at: ${error.path?.join(" -> ") ?? error.package}`;
+      case "no_satisfying_version":
+        return error.message;
+      case "package_not_found":
+        return `Package not found: ${error.package}`;
+      case "fetch_error":
+        return error.message;
+      default:
+        return error.message;
+    }
+  });
+}
+function formatVersionConflicts(conflicts) {
+  return conflicts.map((conflict) => {
+    const requirements = conflict.ranges.map((r) => `${r.dependent} needs ${r.range}`).join(", ");
+    return `No version of ${conflict.package} satisfies: ${requirements}`;
+  });
+}
+function printResolutionErrors(errors, conflicts = []) {
+  if (errors.length > 0) {
+    console.error("\nResolution errors:");
+    for (const msg of formatResolutionErrors(errors)) {
+      console.error(`  - ${msg}`);
+    }
+  }
+  if (conflicts.length > 0) {
+    console.error("\nVersion conflicts:");
+    for (const msg of formatVersionConflicts(conflicts)) {
+      console.error(`  - ${msg}`);
+    }
+  }
+}
+var MAX_DEPENDENCY_DEPTH;
+var init_resolver = __esm({
+  "src/lib/resolver.ts"() {
+    "use strict";
+    init_api_client();
+    init_version();
+    MAX_DEPENDENCY_DEPTH = 5;
+  }
+});
+
 // src/lib/specifier.ts
 function parseSkillSpecifier(specifier) {
   const match = specifier.match(SPECIFIER_PATTERN);
@@ -700,27 +1139,14 @@ var init_specifier = __esm({
   }
 });
 
-// src/lib/version.ts
-import * as semver from "semver";
-function resolveVersion(range, availableVersions) {
-  const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
-  if (!range || range === "latest" || range === "*") {
-    return sorted[0] ?? null;
-  }
-  return semver.maxSatisfying(sorted, range);
-}
-var init_version = __esm({
-  "src/lib/version.ts"() {
-    "use strict";
-  }
-});
-
 // src/lib/index.ts
 var init_lib = __esm({
   "src/lib/index.ts"() {
     "use strict";
     init_integrity();
+    init_local();
     init_manifest();
+    init_resolver();
     init_specifier();
     init_version();
   }
@@ -818,7 +1244,7 @@ var init_agents = __esm({
 
 // src/github.ts
 import { cp, lstat, mkdir as mkdir2, readdir, rm, writeFile as writeFile2 } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 function getGitHubHeaders() {
   const headers = {
     Accept: "application/vnd.github+json",
@@ -894,10 +1320,10 @@ async function downloadGitHubPackage(spec) {
   return { buffer, commit, integrity };
 }
 async function extractGitHubPackage(spec, buffer, skillsDir) {
-  const destPath = spec.path ? join2(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join2(skillsDir, "_github", spec.owner, spec.repo);
-  const tempDir = join2(skillsDir, "_github", ".temp", `${Date.now()}`);
+  const destPath = spec.path ? join3(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join3(skillsDir, "_github", spec.owner, spec.repo);
+  const tempDir = join3(skillsDir, "_github", ".temp", `${Date.now()}`);
   await mkdir2(tempDir, { recursive: true });
-  const tempFile = join2(tempDir, "archive.tgz");
+  const tempFile = join3(tempDir, "archive.tgz");
   try {
     await writeFile2(tempFile, buffer);
     const { exec: exec2 } = await import("child_process");
@@ -911,16 +1337,16 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
     if (!extractedDir) {
       throw new Error("Failed to find extracted directory in tarball");
     }
-    const sourcePath = join2(tempDir, extractedDir);
-    const copySource = spec.path ? join2(sourcePath, spec.path) : sourcePath;
+    const sourcePath = join3(tempDir, extractedDir);
+    const copySource = spec.path ? join3(sourcePath, spec.path) : sourcePath;
     if (spec.path) {
       const pathExists = await lstat(copySource).catch(() => null);
       if (!pathExists) {
         const rootEntries = await readdir(sourcePath);
         const dirs = [];
         for (const entry of rootEntries) {
-          const stat7 = await lstat(join2(sourcePath, entry)).catch(() => null);
-          if (stat7?.isDirectory() && !entry.startsWith(".")) {
+          const stat8 = await lstat(join3(sourcePath, entry)).catch(() => null);
+          if (stat8?.isDirectory() && !entry.startsWith(".")) {
             dirs.push(entry);
           }
         }
@@ -985,11 +1411,11 @@ Available paths in repository root:
 });
 
 // src/lockfile.ts
-import { mkdir as mkdir3, readFile as readFile2, stat as stat2, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir3, readFile as readFile2, stat as stat3, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname2 } from "path";
 async function hasLegacyLockfile() {
   try {
-    await stat2(getLegacyLockfilePath());
+    await stat3(getLegacyLockfilePath());
     return true;
   } catch {
     return false;
@@ -999,12 +1425,12 @@ async function migrateLockfileIfNeeded() {
   const legacyPath = getLegacyLockfilePath();
   const newPath = getLockfilePath();
   try {
-    await stat2(legacyPath);
+    await stat3(legacyPath);
   } catch {
     return false;
   }
   try {
-    await stat2(newPath);
+    await stat3(newPath);
     return false;
   } catch {
   }
@@ -1057,21 +1483,35 @@ async function readLockfile() {
 async function writeLockfile(lockfile) {
   const lockfilePath = getLockfilePath();
   await mkdir3(dirname2(lockfilePath), { recursive: true });
+  const packages = lockfile.packages ?? lockfile.skills ?? {};
+  const hasDependencies = Object.values(packages).some(
+    (pkg) => pkg.dependencies && Object.keys(pkg.dependencies).length > 0
+  );
+  const hasLocalPackages = lockfile.localPackages && Object.keys(lockfile.localPackages).length > 0;
+  let version2 = 3;
+  if (hasLocalPackages) {
+    version2 = 5;
+  } else if (hasDependencies) {
+    version2 = 4;
+  }
   const normalized = {
-    lockfileVersion: 3,
+    lockfileVersion: version2,
     registryUrl: lockfile.registryUrl,
-    packages: lockfile.packages ?? lockfile.skills ?? {}
+    packages
   };
   if (lockfile.githubPackages && Object.keys(lockfile.githubPackages).length > 0) {
     normalized.githubPackages = lockfile.githubPackages;
   }
+  if (hasLocalPackages) {
+    normalized.localPackages = lockfile.localPackages;
+  }
   await writeFile3(lockfilePath, `${JSON.stringify(normalized, null, 2)}
 `);
 }
 async function createEmptyLockfile() {
   const registryUrl = await getRegistryUrl();
   return {
-    lockfileVersion: 3,
+    lockfileVersion: 4,
     registryUrl,
     packages: {}
   };
@@ -1089,6 +1529,20 @@ async function addToLockfile(fullName, entry) {
   lockfile.packages = packages;
   await writeLockfile(lockfile);
 }
+async function addToLockfileWithDeps(fullName, entry, dependencies) {
+  let lockfile = await readLockfile();
+  if (!lockfile) {
+    lockfile = await createEmptyLockfile();
+  }
+  const packages = getPackages(lockfile);
+  const entryWithDeps = { ...entry };
+  if (dependencies && Object.keys(dependencies).length > 0) {
+    entryWithDeps.dependencies = dependencies;
+  }
+  packages[fullName] = entryWithDeps;
+  lockfile.packages = packages;
+  await writeLockfile(lockfile);
+}
 async function removeFromLockfile(fullName) {
   const lockfile = await readLockfile();
   if (!lockfile) {
@@ -1144,6 +1598,36 @@ async function listLockfileGitHubPackages() {
     entry
   }));
 }
+async function addLocalToLockfile(specifier, entry) {
+  let lockfile = await readLockfile();
+  if (!lockfile) {
+    lockfile = await createEmptyLockfile();
+  }
+  if (!lockfile.localPackages) {
+    lockfile.localPackages = {};
+  }
+  lockfile.localPackages[specifier] = entry;
+  await writeLockfile(lockfile);
+}
+async function removeLocalFromLockfile(specifier) {
+  const lockfile = await readLockfile();
+  if (!lockfile?.localPackages?.[specifier]) {
+    return false;
+  }
+  delete lockfile.localPackages[specifier];
+  await writeLockfile(lockfile);
+  return true;
+}
+async function listLockfileLocalPackages() {
+  const lockfile = await readLockfile();
+  if (!lockfile?.localPackages) {
+    return [];
+  }
+  return Object.entries(lockfile.localPackages).map(([specifier, entry]) => ({
+    specifier,
+    entry
+  }));
+}
 var init_lockfile = __esm({
   "src/lockfile.ts"() {
     "use strict";
@@ -1153,9 +1637,9 @@ var init_lockfile = __esm({
 
 // src/manifest.ts
 import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function getManifestPath() {
-  return join3(process.cwd(), "pspm.json");
+  return join4(process.cwd(), "pspm.json");
 }
 async function readManifest() {
   try {
@@ -1225,6 +1709,27 @@ async function removeGitHubDependency(specifier) {
   await writeManifest(manifest);
   return true;
 }
+async function getLocalDependencies() {
+  const manifest = await readManifest();
+  return manifest?.localDependencies ?? {};
+}
+async function addLocalDependency(specifier, version2 = "*") {
+  const manifest = await ensureManifest();
+  if (!manifest.localDependencies) {
+    manifest.localDependencies = {};
+  }
+  manifest.localDependencies[specifier] = version2;
+  await writeManifest(manifest);
+}
+async function removeLocalDependency(specifier) {
+  const manifest = await readManifest();
+  if (!manifest?.localDependencies?.[specifier]) {
+    return false;
+  }
+  delete manifest.localDependencies[specifier];
+  await writeManifest(manifest);
+  return true;
+}
 var init_manifest2 = __esm({
   "src/manifest.ts"() {
     "use strict";
@@ -1233,7 +1738,7 @@ var init_manifest2 = __esm({
 
 // src/symlinks.ts
 import { lstat as lstat2, mkdir as mkdir4, readlink, rm as rm2, symlink } from "fs/promises";
-import { dirname as dirname3, join as join4, relative } from "path";
+import { dirname as dirname3, join as join5, relative } from "path";
 async function createAgentSymlinks(skills, options) {
   const { agents, projectRoot, agentConfigs } = options;
   if (agents.length === 1 && agents[0] === "none") {
@@ -1245,11 +1750,11 @@ async function createAgentSymlinks(skills, options) {
       console.warn(`Warning: Unknown agent "${agentName}", skipping symlinks`);
       continue;
     }
-    const agentSkillsDir = join4(projectRoot, config2.skillsDir);
+    const agentSkillsDir = join5(projectRoot, config2.skillsDir);
     await mkdir4(agentSkillsDir, { recursive: true });
     for (const skill of skills) {
-      const symlinkPath = join4(agentSkillsDir, skill.name);
-      const targetPath = join4(projectRoot, skill.sourcePath);
+      const symlinkPath = join5(agentSkillsDir, skill.name);
+      const targetPath = join5(projectRoot, skill.sourcePath);
       const relativeTarget = relative(dirname3(symlinkPath), targetPath);
       await createSymlink(symlinkPath, relativeTarget, skill.name);
     }
@@ -1290,7 +1795,7 @@ async function removeAgentSymlinks(skillName, options) {
     if (!config2) {
       continue;
     }
-    const symlinkPath = join4(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join5(projectRoot, config2.skillsDir, skillName);
     try {
       const stats = await lstat2(symlinkPath).catch(() => null);
       if (stats?.isSymbolicLink()) {
@@ -1309,12 +1814,15 @@ function getGitHubSkillPath(owner, repo, path) {
   }
   return `.pspm/skills/_github/${owner}/${repo}`;
 }
+function getLocalSkillPath(skillName) {
+  return `.pspm/skills/_local/${skillName}`;
+}
 async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
   const linkedAgents = [];
   for (const agentName of agents) {
     const config2 = resolveAgentConfig(agentName, agentConfigs);
     if (!config2) continue;
-    const symlinkPath = join4(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join5(projectRoot, config2.skillsDir, skillName);
     try {
       const stats = await lstat2(symlinkPath);
       if (stats.isSymbolicLink()) {
@@ -1337,15 +1845,21 @@ var add_exports = {};
 __export(add_exports, {
   add: () => add
 });
-import { mkdir as mkdir5, rm as rm3 } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir as mkdir5, rm as rm3, symlink as symlink2 } from "fs/promises";
+import { dirname as dirname4, join as join6 } from "path";
 async function add(specifiers, options) {
   console.log("Resolving packages...\n");
   const resolvedPackages = [];
   const validationErrors = [];
-  for (const specifier of specifiers) {
+  for (let specifier of specifiers) {
     try {
-      if (isGitHubSpecifier(specifier)) {
+      if (isBareLocalPath(specifier)) {
+        specifier = normalizeToFileSpecifier(specifier);
+      }
+      if (isLocalSpecifier(specifier)) {
+        const resolved = await validateLocalPackage(specifier);
+        resolvedPackages.push(resolved);
+      } else if (isGitHubSpecifier(specifier)) {
         const resolved = await validateGitHubPackage(specifier);
         resolvedPackages.push(resolved);
       } else {
@@ -1369,6 +1883,49 @@ async function add(specifiers, options) {
 `
     );
   }
+  const config2 = await resolveConfig();
+  const apiKey = getTokenForRegistry(config2, config2.registryUrl);
+  const registryPackages = resolvedPackages.filter(
+    (p) => p.type === "registry"
+  );
+  const githubPackages = resolvedPackages.filter(
+    (p) => p.type === "github"
+  );
+  const localPackages = resolvedPackages.filter(
+    (p) => p.type === "local"
+  );
+  let resolutionResult = null;
+  if (registryPackages.length > 0) {
+    const rootDeps = {};
+    for (const pkg of registryPackages) {
+      const fullName = `@user/${pkg.username}/${pkg.name}`;
+      rootDeps[fullName] = pkg.versionRange || `^${pkg.resolvedVersion}`;
+    }
+    console.log("Resolving dependencies...");
+    resolutionResult = await resolveRecursive(rootDeps, {
+      maxDepth: MAX_DEPENDENCY_DEPTH,
+      registryUrl: config2.registryUrl,
+      apiKey
+    });
+    if (!resolutionResult.success) {
+      printResolutionErrors(
+        resolutionResult.graph.errors,
+        resolutionResult.graph.conflicts
+      );
+      process.exit(1);
+    }
+    const transitiveDeps = resolutionResult.installOrder.filter(
+      (name) => !rootDeps[name]
+    );
+    if (transitiveDeps.length > 0) {
+      console.log(
+        `Resolved ${transitiveDeps.length} transitive dependencies.
+`
+      );
+    } else {
+      console.log();
+    }
+  }
   let agents;
   const manifest = await readManifest();
   if (options.agent) {
@@ -1383,19 +1940,53 @@ async function add(specifiers, options) {
     console.log();
   }
   const results = [];
-  for (const resolved of resolvedPackages) {
-    try {
-      if (resolved.type === "github") {
-        await installGitHubPackage(resolved, {
+  if (resolutionResult) {
+    for (const name of resolutionResult.installOrder) {
+      const node = resolutionResult.graph.nodes.get(name);
+      if (!node) continue;
+      try {
+        await installFromNode(node, {
           ...options,
-          resolvedAgents: agents
+          resolvedAgents: agents,
+          isDirect: node.isDirect
         });
-      } else {
-        await installRegistryPackage(resolved, {
-          ...options,
-          resolvedAgents: agents
+        results.push({ specifier: name, success: true });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown error";
+        results.push({
+          specifier: name,
+          success: false,
+          error: message
         });
+        console.error(`Failed to install ${name}: ${message}
+`);
       }
+    }
+  }
+  for (const resolved of githubPackages) {
+    try {
+      await installGitHubPackage(resolved, {
+        ...options,
+        resolvedAgents: agents
+      });
+      results.push({ specifier: resolved.specifier, success: true });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      results.push({
+        specifier: resolved.specifier,
+        success: false,
+        error: message
+      });
+      console.error(`Failed to install ${resolved.specifier}: ${message}
+`);
+    }
+  }
+  for (const resolved of localPackages) {
+    try {
+      await installLocalPackage(resolved, {
+        ...options,
+        resolvedAgents: agents
+      });
       results.push({ specifier: resolved.specifier, success: true });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
@@ -1418,6 +2009,85 @@ Summary: ${succeeded} added, ${failed} failed`);
     }
   }
 }
+async function installFromNode(node, options) {
+  const match = node.name.match(/^@user\/([^/]+)\/([^/]+)$/);
+  if (!match) {
+    throw new Error(`Invalid package name: ${node.name}`);
+  }
+  const [, username, name] = match;
+  console.log(`Installing ${node.name}@${node.version}...`);
+  const config2 = await resolveConfig();
+  const apiKey = getTokenForRegistry(config2, config2.registryUrl);
+  const isPresignedUrl = node.downloadUrl.includes(".r2.cloudflarestorage.com") || node.downloadUrl.includes("X-Amz-Signature");
+  const downloadHeaders = {};
+  if (!isPresignedUrl && apiKey) {
+    downloadHeaders.Authorization = `Bearer ${apiKey}`;
+  }
+  const tarballResponse = await fetch(node.downloadUrl, {
+    headers: downloadHeaders,
+    redirect: "follow"
+  });
+  if (!tarballResponse.ok) {
+    throw new Error(`Failed to download tarball (${tarballResponse.status})`);
+  }
+  const tarballBuffer = Buffer.from(await tarballResponse.arrayBuffer());
+  const integrity = calculateIntegrity(tarballBuffer);
+  if (integrity !== node.integrity) {
+    throw new Error("Checksum verification failed");
+  }
+  const skillsDir = getSkillsDir();
+  const destDir = join6(skillsDir, username, name);
+  await mkdir5(destDir, { recursive: true });
+  const { writeFile: writeFile8 } = await import("fs/promises");
+  const tempFile = join6(destDir, ".temp.tgz");
+  await writeFile8(tempFile, tarballBuffer);
+  const { exec: exec2 } = await import("child_process");
+  const { promisify: promisify2 } = await import("util");
+  const execAsync = promisify2(exec2);
+  try {
+    await rm3(destDir, { recursive: true, force: true });
+    await mkdir5(destDir, { recursive: true });
+    await writeFile8(tempFile, tarballBuffer);
+    await execAsync(
+      `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
+    );
+  } finally {
+    await rm3(tempFile, { force: true });
+  }
+  const resolvedDeps = {};
+  for (const [depName, _range] of Object.entries(node.dependencies)) {
+    resolvedDeps[depName] = _range;
+  }
+  await addToLockfileWithDeps(
+    node.name,
+    {
+      version: node.version,
+      resolved: node.downloadUrl,
+      integrity,
+      deprecated: node.deprecated
+    },
+    Object.keys(resolvedDeps).length > 0 ? resolvedDeps : void 0
+  );
+  if (options.isDirect) {
+    const dependencyRange = node.versionRange || `^${node.version}`;
+    await addDependency(node.name, dependencyRange);
+  }
+  const agents = options.resolvedAgents;
+  if (agents[0] !== "none") {
+    const skillManifest = await readManifest();
+    const skillInfo = {
+      name,
+      sourcePath: getRegistrySkillPath(username, name)
+    };
+    await createAgentSymlinks([skillInfo], {
+      agents,
+      projectRoot: process.cwd(),
+      agentConfigs: skillManifest?.agents
+    });
+  }
+  console.log(`Installed ${node.name}@${node.version}`);
+  console.log(`Location: ${destDir}`);
+}
 async function validateRegistryPackage(specifier) {
   const config2 = await resolveConfig();
   const registryUrl = config2.registryUrl;
@@ -1505,72 +2175,6 @@ async function validateGitHubPackage(specifier) {
     downloadResult: result
   };
 }
-async function installRegistryPackage(resolved, options) {
-  const { username, name, versionRange, resolvedVersion, versionInfo } = resolved;
-  console.log(`Installing @user/${username}/${name}@${resolvedVersion}...`);
-  const config2 = await resolveConfig();
-  const apiKey = getTokenForRegistry(config2, config2.registryUrl);
-  const isPresignedUrl = versionInfo.downloadUrl.includes(".r2.cloudflarestorage.com") || versionInfo.downloadUrl.includes("X-Amz-Signature");
-  const downloadHeaders = {};
-  if (!isPresignedUrl && apiKey) {
-    downloadHeaders.Authorization = `Bearer ${apiKey}`;
-  }
-  const tarballResponse = await fetch(versionInfo.downloadUrl, {
-    headers: downloadHeaders,
-    redirect: "follow"
-  });
-  if (!tarballResponse.ok) {
-    throw new Error(`Failed to download tarball (${tarballResponse.status})`);
-  }
-  const tarballBuffer = Buffer.from(await tarballResponse.arrayBuffer());
-  const integrity = calculateIntegrity(tarballBuffer);
-  const expectedIntegrity = `sha256-${Buffer.from(versionInfo.checksum, "hex").toString("base64")}`;
-  if (integrity !== expectedIntegrity) {
-    throw new Error("Checksum verification failed");
-  }
-  const skillsDir = getSkillsDir();
-  const destDir = join5(skillsDir, username, name);
-  await mkdir5(destDir, { recursive: true });
-  const { writeFile: writeFile8 } = await import("fs/promises");
-  const tempFile = join5(destDir, ".temp.tgz");
-  await writeFile8(tempFile, tarballBuffer);
-  const { exec: exec2 } = await import("child_process");
-  const { promisify: promisify2 } = await import("util");
-  const execAsync = promisify2(exec2);
-  try {
-    await rm3(destDir, { recursive: true, force: true });
-    await mkdir5(destDir, { recursive: true });
-    await writeFile8(tempFile, tarballBuffer);
-    await execAsync(
-      `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
-    );
-  } finally {
-    await rm3(tempFile, { force: true });
-  }
-  const fullName = `@user/${username}/${name}`;
-  await addToLockfile(fullName, {
-    version: resolvedVersion,
-    resolved: versionInfo.downloadUrl,
-    integrity
-  });
-  const dependencyRange = versionRange || `^${resolvedVersion}`;
-  await addDependency(fullName, dependencyRange);
-  const agents = options.resolvedAgents;
-  if (agents[0] !== "none") {
-    const skillManifest = await readManifest();
-    const skillInfo = {
-      name,
-      sourcePath: getRegistrySkillPath(username, name)
-    };
-    await createAgentSymlinks([skillInfo], {
-      agents,
-      projectRoot: process.cwd(),
-      agentConfigs: skillManifest?.agents
-    });
-  }
-  console.log(`Installed @user/${username}/${name}@${resolvedVersion}`);
-  console.log(`Location: ${destDir}`);
-}
 async function installGitHubPackage(resolved, options) {
   const { specifier, parsed, ref, downloadResult } = resolved;
   console.log(
@@ -1616,6 +2220,67 @@ async function installGitHubPackage(resolved, options) {
   );
   console.log(`Location: ${destPath}`);
 }
+async function validateLocalPackage(specifier) {
+  const parsed = parseLocalSpecifier(specifier);
+  if (!parsed) {
+    throw new Error(
+      `Invalid local specifier "${specifier}". Use format: file:../path or file:/absolute/path`
+    );
+  }
+  console.log(`Resolving ${specifier}...`);
+  const resolvedPath = resolveLocalPath(parsed);
+  const validation = await validateLocalSkill(resolvedPath);
+  if (!validation.valid) {
+    throw new Error(validation.error);
+  }
+  const name = validation.manifest?.name || getLocalSkillName(parsed);
+  console.log(`Resolved ${specifier} -> ${name} (local)`);
+  return {
+    type: "local",
+    specifier,
+    parsed,
+    name,
+    resolvedPath
+  };
+}
+async function installLocalPackage(resolved, options) {
+  const { specifier, name, resolvedPath, parsed } = resolved;
+  console.log(`Installing ${specifier} (local symlink)...`);
+  const skillsDir = getSkillsDir();
+  const localDir = join6(skillsDir, "_local");
+  await mkdir5(localDir, { recursive: true });
+  const symlinkPath = join6(localDir, name);
+  try {
+    await rm3(symlinkPath, { force: true });
+  } catch {
+  }
+  const { relative: relativePath } = await import("path");
+  const relativeTarget = relativePath(dirname4(symlinkPath), resolvedPath);
+  await symlink2(relativeTarget, symlinkPath);
+  const entry = {
+    version: "local",
+    path: parsed.path,
+    resolvedPath,
+    name
+  };
+  await addLocalToLockfile(specifier, entry);
+  await addLocalDependency(specifier, "*");
+  const agents = options.resolvedAgents;
+  if (agents[0] !== "none") {
+    const manifest = await readManifest();
+    const skillInfo = {
+      name,
+      sourcePath: getLocalSkillPath(name)
+    };
+    await createAgentSymlinks([skillInfo], {
+      agents,
+      projectRoot: process.cwd(),
+      agentConfigs: manifest?.agents
+    });
+  }
+  console.log(`Installed ${specifier} (local)`);
+  console.log(`Location: ${symlinkPath} -> ${resolvedPath}`);
+}
 var init_add = __esm({
   "src/commands/add.ts"() {
     "use strict";
@@ -1633,7 +2298,7 @@ var init_add = __esm({
 
 // src/index.ts
 import { readFileSync } from "fs";
-import { dirname as dirname4, join as join12 } from "path";
+import { dirname as dirname6, join as join13 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 
@@ -1641,7 +2306,7 @@ import { Command } from "commander";
 init_api_client();
 init_config();
 init_lib();
-async function access(specifier, options) {
+async function access2(specifier, options) {
   try {
     const apiKey = await requireApiKey();
     const registryUrl = await getRegistryUrl();
@@ -1666,18 +2331,18 @@ async function access(specifier, options) {
       packageName = parsed.name;
     } else {
       const { readFile: readFile7 } = await import("fs/promises");
-      const { join: join13 } = await import("path");
+      const { join: join14 } = await import("path");
       let manifest = null;
       try {
         const content = await readFile7(
-          join13(process.cwd(), "pspm.json"),
+          join14(process.cwd(), "pspm.json"),
           "utf-8"
         );
         manifest = JSON.parse(content);
       } catch {
         try {
           const content = await readFile7(
-            join13(process.cwd(), "package.json"),
+            join14(process.cwd(), "package.json"),
             "utf-8"
           );
           manifest = JSON.parse(content);
@@ -1726,13 +2391,13 @@ async function access(specifier, options) {
 init_add();
 
 // src/commands/config/init.ts
-import { stat as stat3, writeFile as writeFile5 } from "fs/promises";
-import { join as join6 } from "path";
+import { stat as stat4, writeFile as writeFile5 } from "fs/promises";
+import { join as join7 } from "path";
 async function configInit(options) {
   try {
-    const configPath = join6(process.cwd(), ".pspmrc");
+    const configPath = join7(process.cwd(), ".pspmrc");
     try {
-      await stat3(configPath);
+      await stat4(configPath);
       console.error("Error: .pspmrc already exists in this directory.");
       process.exit(1);
     } catch {
@@ -1858,21 +2523,21 @@ async function deprecate(specifier, message, options) {
 
 // src/commands/init.ts
 init_lib();
-import { readFile as readFile4, stat as stat4, writeFile as writeFile6 } from "fs/promises";
-import { basename, join as join7 } from "path";
+import { readFile as readFile4, stat as stat5, writeFile as writeFile6 } from "fs/promises";
+import { basename, join as join8 } from "path";
 import { createInterface } from "readline";
 function prompt(rl, question, defaultValue) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const displayDefault = defaultValue ? ` (${defaultValue})` : "";
     rl.question(`${question}${displayDefault} `, (answer) => {
-      resolve(answer.trim() || defaultValue);
+      resolve2(answer.trim() || defaultValue);
     });
   });
 }
 async function readExistingPackageJson() {
   try {
     const content = await readFile4(
-      join7(process.cwd(), "package.json"),
+      join8(process.cwd(), "package.json"),
       "utf-8"
     );
     const pkg = JSON.parse(content);
@@ -1921,10 +2586,10 @@ function isValidVersion(version2) {
 }
 async function init(options) {
   try {
-    const pspmJsonPath = join7(process.cwd(), "pspm.json");
+    const pspmJsonPath = join8(process.cwd(), "pspm.json");
     let exists = false;
     try {
-      await stat4(pspmJsonPath);
+      await stat5(pspmJsonPath);
       exists = true;
     } catch {
     }
@@ -2059,7 +2724,7 @@ async function init(options) {
     await writeFile6(pspmJsonPath, `${content}
 `);
     try {
-      await stat4(join7(process.cwd(), "SKILL.md"));
+      await stat5(join8(process.cwd(), "SKILL.md"));
     } catch {
       console.log(
         "Note: Create a SKILL.md file with your skill's prompt content."
@@ -2088,8 +2753,15 @@ init_lockfile();
 init_manifest2();
 init_symlinks();
 import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir6, readFile as readFile5, rm as rm4, writeFile as writeFile7 } from "fs/promises";
-import { join as join8 } from "path";
+import {
+  lstat as lstat3,
+  mkdir as mkdir6,
+  readFile as readFile5,
+  rm as rm4,
+  symlink as symlink3,
+  writeFile as writeFile7
+} from "fs/promises";
+import { dirname as dirname5, join as join9, relative as relative2 } from "path";
 function getCacheFilePath(cacheDir, integrity) {
   const match = integrity.match(/^sha256-(.+)$/);
   if (!match) {
@@ -2097,7 +2769,7 @@ function getCacheFilePath(cacheDir, integrity) {
   }
   const base64Hash = match[1];
   const hexHash = Buffer.from(base64Hash, "base64").toString("hex");
-  return join8(cacheDir, `sha256-${hexHash}.tgz`);
+  return join9(cacheDir, `sha256-${hexHash}.tgz`);
 }
 async function readFromCache(cacheDir, integrity) {
   try {
@@ -2144,8 +2816,10 @@ async function installFromLockfile(options) {
     let lockfile = await readLockfile();
     const manifestDeps = await getDependencies();
     const manifestGitHubDeps = await getGitHubDependencies();
+    const manifestLocalDeps = await getLocalDependencies();
     const lockfilePackages = lockfile?.packages ?? lockfile?.skills ?? {};
     const lockfileGitHubPackages = lockfile?.githubPackages ?? {};
+    const lockfileLocalPackages = lockfile?.localPackages ?? {};
     const installedSkills = [];
     const missingDeps = [];
     for (const [fullName, versionRange] of Object.entries(manifestDeps)) {
@@ -2296,6 +2970,53 @@ Resolving ${missingGitHubDeps.length} GitHub dependency(ies)...
       }
       lockfile = await readLockfile();
     }
+    const missingLocalDeps = [];
+    for (const [specifier] of Object.entries(manifestLocalDeps)) {
+      if (!lockfileLocalPackages[specifier]) {
+        missingLocalDeps.push({ specifier });
+      }
+    }
+    if (missingLocalDeps.length > 0) {
+      if (options.frozenLockfile) {
+        console.error(
+          "Error: Local dependencies in pspm.json are not in lockfile. Cannot install with --frozen-lockfile"
+        );
+        console.error("Missing local dependencies:");
+        for (const dep of missingLocalDeps) {
+          console.error(`  - ${dep.specifier}`);
+        }
+        process.exit(1);
+      }
+      console.log(
+        `
+Resolving ${missingLocalDeps.length} local dependency(ies)...
+`
+      );
+      for (const { specifier } of missingLocalDeps) {
+        const parsed = parseLocalSpecifier(specifier);
+        if (!parsed) {
+          console.error(`Error: Invalid local specifier: ${specifier}`);
+          continue;
+        }
+        console.log(`Resolving ${specifier}...`);
+        const resolvedPath = resolveLocalPath(parsed);
+        const validation = await validateLocalSkill(resolvedPath);
+        if (!validation.valid) {
+          console.error(`Error: ${validation.error}`);
+          continue;
+        }
+        const name = validation.manifest?.name || parsed.path.split("/").pop() || "unknown";
+        const entry = {
+          version: "local",
+          path: parsed.path,
+          resolvedPath,
+          name
+        };
+        await addLocalToLockfile(specifier, entry);
+        console.log(`  Resolved ${specifier} -> ${name} (local)`);
+      }
+      lockfile = await readLockfile();
+    }
     const manifest = await readManifest();
     const agentConfigs = manifest?.agents;
     let agents;
@@ -2316,7 +3037,8 @@ Resolving ${missingGitHubDeps.length} GitHub dependency(ies)...
       console.log(`
 Installing ${packageCount} registry skill(s)...
 `);
-      const entries = Object.entries(packages);
+      const installOrder = computeInstallOrder(packages);
+      const entries = installOrder.filter((name) => packages[name]).map((name) => [name, packages[name]]);
       for (const [fullName, entry] of entries) {
         const match = fullName.match(/^@user\/([^/]+)\/([^/]+)$/);
         if (!match) {
@@ -2372,10 +3094,10 @@ Installing ${packageCount} registry skill(s)...
           }
           await writeToCache(cacheDir, entry.integrity, tarballBuffer);
         }
-        const destDir = join8(skillsDir, username, name);
+        const destDir = join9(skillsDir, username, name);
         await rm4(destDir, { recursive: true, force: true });
         await mkdir6(destDir, { recursive: true });
-        const tempFile = join8(destDir, ".temp.tgz");
+        const tempFile = join9(destDir, ".temp.tgz");
         await writeFile7(tempFile, tarballBuffer);
         const { exec: exec2 } = await import("child_process");
         const { promisify: promisify2 } = await import("util");
@@ -2473,6 +3195,52 @@ Installing ${githubCount} GitHub skill(s)...
         }
       }
     }
+    const localPackages = lockfile?.localPackages ?? {};
+    const localCount = Object.keys(localPackages).length;
+    if (localCount > 0) {
+      console.log(`
+Installing ${localCount} local skill(s)...
+`);
+      for (const [specifier, entry] of Object.entries(localPackages)) {
+        const localEntry = entry;
+        console.log(`Installing ${specifier} (local symlink)...`);
+        const validation = await validateLocalSkill(localEntry.resolvedPath);
+        if (!validation.valid) {
+          console.error(`  Error: ${validation.error}`);
+          console.error(
+            `  Hint: The local skill at ${localEntry.resolvedPath} may have been moved or deleted.`
+          );
+          continue;
+        }
+        const localDir = join9(skillsDir, "_local");
+        await mkdir6(localDir, { recursive: true });
+        const symlinkPath = join9(localDir, localEntry.name);
+        try {
+          const stats = await lstat3(symlinkPath);
+          if (stats.isSymbolicLink()) {
+            await rm4(symlinkPath);
+          }
+        } catch {
+        }
+        const relativeTarget = relative2(
+          dirname5(symlinkPath),
+          localEntry.resolvedPath
+        );
+        try {
+          await symlink3(relativeTarget, symlinkPath);
+          console.log(
+            `  Installed to ${symlinkPath} -> ${localEntry.resolvedPath}`
+          );
+          installedSkills.push({
+            name: localEntry.name,
+            sourcePath: getLocalSkillPath(localEntry.name)
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          console.error(`  Error creating symlink: ${message}`);
+        }
+      }
+    }
     if (installedSkills.length > 0 && agents[0] !== "none") {
       console.log(`
 Creating symlinks for agent(s): ${agents.join(", ")}...`);
@@ -2483,7 +3251,7 @@ Creating symlinks for agent(s): ${agents.join(", ")}...`);
       });
       console.log("  Symlinks created.");
     }
-    const totalCount = packageCount + githubCount;
+    const totalCount = packageCount + githubCount + localCount;
     if (totalCount === 0) {
       console.log("No skills to install.");
     } else {
@@ -2580,8 +3348,8 @@ init_lib();
 init_lockfile();
 init_manifest2();
 init_symlinks();
-import { access as access2 } from "fs/promises";
-import { join as join9 } from "path";
+import { access as access3 } from "fs/promises";
+import { join as join10 } from "path";
 async function list(options) {
   try {
     const registrySkills = await listLockfileSkills();
@@ -2596,10 +3364,10 @@ async function list(options) {
       if (!match) continue;
       const [, username, skillName] = match;
       const sourcePath = getRegistrySkillPath(username, skillName);
-      const absolutePath = join9(projectRoot, sourcePath);
+      const absolutePath = join10(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access2(absolutePath);
+        await access3(absolutePath);
       } catch {
         status = "missing";
       }
@@ -2629,10 +3397,10 @@ async function list(options) {
         parsed.repo,
         parsed.path
       );
-      const absolutePath = join9(projectRoot, sourcePath);
+      const absolutePath = join10(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access2(absolutePath);
+        await access3(absolutePath);
       } catch {
         status = "missing";
       }
@@ -2654,6 +3422,35 @@ async function list(options) {
         gitCommit: ghEntry.gitCommit
       });
     }
+    const localSkills = await listLockfileLocalPackages();
+    for (const { specifier, entry } of localSkills) {
+      const localEntry = entry;
+      const skillName = localEntry.name;
+      const sourcePath = getLocalSkillPath(skillName);
+      const absolutePath = join10(projectRoot, sourcePath);
+      let status = "installed";
+      try {
+        await access3(absolutePath);
+      } catch {
+        status = "missing";
+      }
+      const linkedAgents = await getLinkedAgents(
+        skillName,
+        availableAgents,
+        projectRoot,
+        agentConfigs
+      );
+      skills.push({
+        name: skillName,
+        fullName: specifier,
+        version: "local",
+        source: "local",
+        sourcePath,
+        status,
+        linkedAgents,
+        localPath: localEntry.resolvedPath
+      });
+    }
     if (skills.length === 0) {
       console.log("No skills installed.");
       return;
@@ -2666,9 +3463,14 @@ async function list(options) {
     for (const skill of skills) {
       if (skill.source === "registry") {
         console.log(`  ${skill.fullName}@${skill.version} (registry)`);
-      } else {
+      } else if (skill.source === "github") {
         const refInfo = skill.gitRef ? `${skill.gitRef}@${skill.gitCommit?.slice(0, 7)}` : skill.version;
         console.log(`  ${skill.fullName} (${refInfo})`);
+      } else {
+        console.log(`  ${skill.fullName} [local]`);
+        if (skill.localPath) {
+          console.log(`    Path: ${skill.localPath}`);
+        }
       }
       if (skill.status === "missing") {
         console.log(`    Status: MISSING (run 'pspm install' to restore)`);
@@ -2684,9 +3486,11 @@ async function list(options) {
     }
     const registryCount = skills.filter((s) => s.source === "registry").length;
     const githubCount = skills.filter((s) => s.source === "github").length;
+    const localCount = skills.filter((s) => s.source === "local").length;
     const parts = [];
     if (registryCount > 0) parts.push(`${registryCount} registry`);
     if (githubCount > 0) parts.push(`${githubCount} github`);
+    if (localCount > 0) parts.push(`${localCount} local`);
     console.log(`
 Total: ${skills.length} skill(s) (${parts.join(", ")})`);
   } catch (error) {
@@ -2744,8 +3548,8 @@ function startCallbackServer(expectedState) {
     let resolveToken;
     let rejectToken;
     let timeoutId;
-    const tokenPromise = new Promise((resolve, reject) => {
-      resolveToken = resolve;
+    const tokenPromise = new Promise((resolve2, reject) => {
+      resolveToken = resolve2;
       rejectToken = reject;
     });
     const server = http.createServer((req, res) => {
@@ -2900,7 +3704,7 @@ async function logout() {
 // src/commands/migrate.ts
 init_config();
 init_lockfile();
-import { mkdir as mkdir7, readdir as readdir2, rename, rm as rm5, stat as stat5 } from "fs/promises";
+import { mkdir as mkdir7, readdir as readdir2, rename, rm as rm5, stat as stat6 } from "fs/promises";
 async function migrate(options) {
   try {
     const legacySkillsDir = getLegacySkillsDir();
@@ -2911,7 +3715,7 @@ async function migrate(options) {
     let migrationNeeded = false;
     const actions = [];
     try {
-      const legacyStats = await stat5(legacySkillsDir);
+      const legacyStats = await stat6(legacySkillsDir);
       if (legacyStats.isDirectory()) {
         const contents = await readdir2(legacySkillsDir);
         if (contents.length > 0) {
@@ -2922,9 +3726,9 @@ async function migrate(options) {
     } catch {
     }
     try {
-      await stat5(legacyLockfilePath);
+      await stat6(legacyLockfilePath);
       try {
-        await stat5(newLockfilePath);
+        await stat6(newLockfilePath);
         actions.push(
           "Note: Both skill-lock.json and pspm-lock.json exist. Manual merge may be needed."
         );
@@ -2956,13 +3760,13 @@ async function migrate(options) {
       console.log("  \u2713 Migrated skill-lock.json \u2192 pspm-lock.json");
     }
     try {
-      const legacyStats = await stat5(legacySkillsDir);
+      const legacyStats = await stat6(legacySkillsDir);
       if (legacyStats.isDirectory()) {
         const contents = await readdir2(legacySkillsDir);
         if (contents.length > 0) {
           await mkdir7(pspmDir, { recursive: true });
           try {
-            const newStats = await stat5(newSkillsDir);
+            const newStats = await stat6(newSkillsDir);
             if (newStats.isDirectory()) {
               const newContents = await readdir2(newSkillsDir);
               if (newContents.length > 0) {
@@ -3008,20 +3812,20 @@ init_errors();
 init_lib();
 import { exec as execCb } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { readdir as readdir3, readFile as readFile6, stat as stat6 } from "fs/promises";
-import { join as join10, relative as relative2 } from "path";
+import { readdir as readdir3, readFile as readFile6, stat as stat7 } from "fs/promises";
+import { join as join11, relative as relative3 } from "path";
 import { promisify } from "util";
 var exec = promisify(execCb);
 async function detectManifest() {
   const cwd = process.cwd();
-  const pspmJsonPath = join10(cwd, "pspm.json");
+  const pspmJsonPath = join11(cwd, "pspm.json");
   try {
     const content = await readFile6(pspmJsonPath, "utf-8");
     const manifest = JSON.parse(content);
     return { type: "pspm.json", manifest, path: pspmJsonPath };
   } catch {
   }
-  const packageJsonPath = join10(cwd, "package.json");
+  const packageJsonPath = join11(cwd, "package.json");
   try {
     const content = await readFile6(packageJsonPath, "utf-8");
     const packageJson2 = JSON.parse(content);
@@ -3048,8 +3852,8 @@ async function getFilesWithSizes(dir, baseDir) {
   try {
     const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join10(dir, entry.name);
-      const relativePath = relative2(baseDir, fullPath);
+      const fullPath = join11(dir, entry.name);
+      const relativePath = relative3(baseDir, fullPath);
       if (entry.name === "node_modules" || entry.name === ".git") {
         continue;
       }
@@ -3057,7 +3861,7 @@ async function getFilesWithSizes(dir, baseDir) {
         const subFiles = await getFilesWithSizes(fullPath, baseDir);
         results.push(...subFiles);
       } else {
-        const fileStat = await stat6(fullPath);
+        const fileStat = await stat7(fullPath);
         results.push({ path: relativePath, size: fileStat.size });
       }
     }
@@ -3103,7 +3907,7 @@ async function publishCommand(options) {
     }
     const safeName = packageJson2.name.replace(/[@/]/g, "-").replace(/^-+/, "");
     const tarballName = `${safeName}-${packageJson2.version}.tgz`;
-    const tempDir = join10(process.cwd(), ".pspm-publish");
+    const tempDir = join11(process.cwd(), ".pspm-publish");
     try {
       await exec(`rm -rf "${tempDir}" && mkdir -p "${tempDir}"`);
       const files = packageJson2.files || [...DEFAULT_SKILL_FILES];
@@ -3119,7 +3923,7 @@ async function publishCommand(options) {
       if (detection.type === "pspm.json") {
         await exec(`cp pspm.json "${tempDir}/package/"`);
         try {
-          await stat6(join10(process.cwd(), "package.json"));
+          await stat7(join11(process.cwd(), "package.json"));
           await exec(
             `cp package.json "${tempDir}/package/" 2>/dev/null || true`
           );
@@ -3128,10 +3932,10 @@ async function publishCommand(options) {
       } else {
         await exec(`cp package.json "${tempDir}/package/"`);
       }
-      const packageDir = join10(tempDir, "package");
+      const packageDir = join11(tempDir, "package");
       const tarballContents = await getFilesWithSizes(packageDir, packageDir);
       const unpackedSize = tarballContents.reduce((acc, f) => acc + f.size, 0);
-      const tarballPath = join10(tempDir, tarballName);
+      const tarballPath = join11(tempDir, tarballName);
       await exec(
         `tar -czf "${tarballPath}" -C "${tempDir}" --exclude='node_modules' --exclude='.git' package`
       );
@@ -3225,13 +4029,15 @@ init_lockfile();
 init_manifest2();
 init_symlinks();
 import { rm as rm6 } from "fs/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 async function remove(nameOrSpecifier) {
   try {
     const manifest = await readManifest();
     const agentConfigs = manifest?.agents;
     const agents = getAvailableAgents(agentConfigs);
-    if (isGitHubSpecifier(nameOrSpecifier)) {
+    if (isLocalSpecifier(nameOrSpecifier)) {
+      await removeLocal(nameOrSpecifier, agents, agentConfigs);
+    } else if (isGitHubSpecifier(nameOrSpecifier)) {
       await removeGitHub(nameOrSpecifier, agents, agentConfigs);
     } else if (nameOrSpecifier.startsWith("@user/")) {
       await removeRegistry(nameOrSpecifier, agents, agentConfigs);
@@ -3266,7 +4072,7 @@ async function removeRegistry(specifier, agents, agentConfigs) {
     agentConfigs
   });
   const skillsDir = getSkillsDir();
-  const destDir = join11(skillsDir, username, name);
+  const destDir = join12(skillsDir, username, name);
   try {
     await rm6(destDir, { recursive: true, force: true });
   } catch {
@@ -3295,13 +4101,42 @@ async function removeGitHub(specifier, agents, agentConfigs) {
   });
   const skillsDir = getSkillsDir();
   const destPath = getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path);
-  const destDir = join11(skillsDir, "..", destPath);
+  const destDir = join12(skillsDir, "..", destPath);
   try {
     await rm6(destDir, { recursive: true, force: true });
   } catch {
   }
   console.log(`Removed ${lockfileKey}`);
 }
+async function removeLocal(specifier, agents, agentConfigs) {
+  const parsed = parseLocalSpecifier(specifier);
+  if (!parsed) {
+    console.error(`Error: Invalid local specifier: ${specifier}`);
+    process.exit(1);
+  }
+  console.log(`Removing ${specifier}...`);
+  const removedFromLockfile = await removeLocalFromLockfile(specifier);
+  const removedFromManifest = await removeLocalDependency(specifier);
+  if (!removedFromLockfile && !removedFromManifest) {
+    console.error(`Error: ${specifier} not found in lockfile or pspm.json`);
+    process.exit(1);
+  }
+  const localSkills = await listLockfileLocalPackages();
+  const foundLocal = localSkills.find((s) => s.specifier === specifier);
+  const skillName = foundLocal?.entry.name || parsed.path.split("/").filter(Boolean).pop() || "unknown";
+  await removeAgentSymlinks(skillName, {
+    agents,
+    projectRoot: process.cwd(),
+    agentConfigs
+  });
+  const skillsDir = getSkillsDir();
+  const symlinkPath = join12(skillsDir, "_local", skillName);
+  try {
+    await rm6(symlinkPath, { force: true });
+  } catch {
+  }
+  console.log(`Removed ${specifier}`);
+}
 async function removeByShortName(shortName, agents, agentConfigs) {
   const registrySkills = await listLockfileSkills();
   const foundRegistry = registrySkills.find((s) => {
@@ -3322,6 +4157,12 @@ async function removeByShortName(shortName, agents, agentConfigs) {
     await removeGitHub(foundGitHub.specifier, agents, agentConfigs);
     return;
   }
+  const localSkills = await listLockfileLocalPackages();
+  const foundLocal = localSkills.find((s) => s.entry.name === shortName);
+  if (foundLocal) {
+    await removeLocal(foundLocal.specifier, agents, agentConfigs);
+    return;
+  }
   console.error(`Error: Skill "${shortName}" not found in lockfile`);
   process.exit(1);
 }
@@ -3494,9 +4335,9 @@ async function whoami() {
 }
 
 // src/index.ts
-var __dirname = dirname4(fileURLToPath(import.meta.url));
+var __dirname = dirname6(fileURLToPath(import.meta.url));
 var packageJson = JSON.parse(
-  readFileSync(join12(__dirname, "..", "package.json"), "utf-8")
+  readFileSync(join13(__dirname, "..", "package.json"), "utf-8")
 );
 var version = packageJson.version;
 var program = new Command();
@@ -3589,7 +4430,7 @@ program.command("unpublish <specifier>").description(
   await unpublish(specifier, { force: options.force });
 });
 program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public (irreversible)").option("--private", "Make the package private (only for private packages)").action(async (specifier, options) => {
-  await access(specifier, {
+  await access2(specifier, {
     public: options.public,
     private: options.private
   });