@anytio/pspm 0.3.0 → 0.3.2

package/dist/index.js

@@ -1,21 +1,4 @@
 #!/usr/bin/env node
-import { stat, writeFile, readdir, mkdir, rm, rename, access as access$1, readFile, lstat, unlink, cp, readlink, symlink } from 'fs/promises';
-import { homedir } from 'os';
-import { dirname, join, basename, relative } from 'path';
-import * as ini from 'ini';
-import ignore from 'ignore';
-import { createHash, randomBytes } from 'crypto';
-import * as semver from 'semver';
-import { checkbox } from '@inquirer/prompts';
-import { readFileSync } from 'fs';
-import { fileURLToPath, URL as URL$1 } from 'url';
-import { Command } from 'commander';
-import { createInterface } from 'readline';
-import http from 'http';
-import open from 'open';
-import { exec as exec$1 } from 'child_process';
-import { promisify } from 'util';
-
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -26,7 +9,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// ../../packages/shared/sdk/src/fetcher.ts
+// src/sdk/fetcher.ts
 function configure(options) {
   config = options;
 }
@@ -67,15 +50,17 @@ async function customFetch(url, options) {
 }
 var config;
 var init_fetcher = __esm({
-  "../../packages/shared/sdk/src/fetcher.ts"() {
+  "src/sdk/fetcher.ts"() {
+    "use strict";
     config = null;
   }
 });
 
-// ../../packages/shared/sdk/src/generated/index.ts
+// src/sdk/generated/index.ts
 var getMeUrl, me, getListSkillVersionsUrl, listSkillVersions, getGetSkillVersionUrl, getSkillVersion, getPublishSkillUrl, publishSkill, getDeleteSkillUrl, deleteSkill, getDeleteSkillVersionUrl, deleteSkillVersion;
 var init_generated = __esm({
-  "../../packages/shared/sdk/src/generated/index.ts"() {
+  "src/sdk/generated/index.ts"() {
+    "use strict";
     init_fetcher();
     getMeUrl = () => {
       return `/api/skills/me`;
@@ -156,14 +141,6 @@ var init_generated = __esm({
   }
 });
 
-// ../../packages/shared/sdk/src/index.ts
-var init_src = __esm({
-  "../../packages/shared/sdk/src/index.ts"() {
-    init_fetcher();
-    init_generated();
-  }
-});
-
 // src/api-client.ts
 function registryUrlToBaseUrl(registryUrl) {
   return registryUrl.replace(/\/api\/skills\/?$/, "");
@@ -286,7 +263,9 @@ async function changeSkillAccess(skillName, input) {
 }
 var init_api_client = __esm({
   "src/api-client.ts"() {
-    init_src();
+    "use strict";
+    init_fetcher();
+    init_generated();
   }
 });
 
@@ -328,6 +307,7 @@ ${issueMessages}`;
 var ConfigError, NotLoggedInError;
 var init_errors = __esm({
   "src/errors.ts"() {
+    "use strict";
     ConfigError = class extends Error {
       constructor(message) {
         super(message);
@@ -344,6 +324,12 @@ var init_errors = __esm({
     };
   }
 });
+
+// src/config.ts
+import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import * as ini from "ini";
 function getConfigPath() {
   return join(homedir(), ".pspmrc");
 }
@@ -616,55 +602,106 @@ async function getRegistryUrl() {
 var DEFAULT_REGISTRY_URL;
 var init_config = __esm({
   "src/config.ts"() {
+    "use strict";
     init_errors();
     DEFAULT_REGISTRY_URL = "https://pspm.dev";
   }
 });
-async function loadIgnorePatterns(cwd = process.cwd()) {
-  const ig = ignore();
-  ig.add(ALWAYS_IGNORED);
-  const pspmIgnorePath = join(cwd, ".pspmignore");
+
+// src/lib/integrity.ts
+import { createHash } from "crypto";
+function calculateIntegrity(data) {
+  const hash = createHash("sha256").update(data).digest("base64");
+  return `sha256-${hash}`;
+}
+var init_integrity = __esm({
+  "src/lib/integrity.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/local.ts
+import { access, stat as stat2 } from "fs/promises";
+import { isAbsolute, join as join2, resolve } from "path";
+function isLocalSpecifier(specifier) {
+  return specifier.startsWith("file:");
+}
+function isBareLocalPath(specifier) {
+  return specifier.startsWith("./") || specifier.startsWith("../");
+}
+function parseLocalSpecifier(specifier) {
+  const match = specifier.match(LOCAL_SPECIFIER_PATTERN);
+  if (!match) {
+    return null;
+  }
+  const path = match[1];
+  if (!path || path.trim() === "") {
+    return null;
+  }
+  return {
+    path,
+    isAbsolute: isAbsolute(path)
+  };
+}
+function getLocalSkillName(spec) {
+  const normalizedPath = spec.path.replace(/\/+$/, "");
+  const segments = normalizedPath.split("/").filter(Boolean);
+  return segments[segments.length - 1] || spec.path;
+}
+function normalizeToFileSpecifier(path) {
+  if (isLocalSpecifier(path)) {
+    return path;
+  }
+  return `file:${path}`;
+}
+function resolveLocalPath(spec, basePath = process.cwd()) {
+  if (spec.isAbsolute) {
+    return resolve(spec.path);
+  }
+  return resolve(basePath, spec.path);
+}
+async function validateLocalSkill(absolutePath) {
   try {
-    const content = await readFile(pspmIgnorePath, "utf-8");
-    const patterns = parseIgnorePatterns(content);
-    ig.add(patterns);
-    return { ig, source: ".pspmignore", patterns };
+    const stats = await stat2(absolutePath);
+    if (!stats.isDirectory()) {
+      return { valid: false, error: `Not a directory: ${absolutePath}` };
+    }
   } catch {
+    return { valid: false, error: `Directory not found: ${absolutePath}` };
   }
-  const gitIgnorePath = join(cwd, ".gitignore");
+  const manifestPath = join2(absolutePath, "pspm.json");
   try {
-    const content = await readFile(gitIgnorePath, "utf-8");
-    const patterns = parseIgnorePatterns(content);
-    ig.add(patterns);
-    return { ig, source: ".gitignore", patterns };
+    await access(manifestPath);
   } catch {
+    return {
+      valid: false,
+      error: `No pspm.json found in ${absolutePath}`
+    };
   }
-  return { ig, source: null, patterns: [] };
-}
-function getExcludeArgsForRsync(patterns) {
-  const allPatterns = [.../* @__PURE__ */ new Set([...ALWAYS_IGNORED, ...patterns])];
-  return allPatterns.map((p) => `--exclude='${p}'`).join(" ");
-}
-function parseIgnorePatterns(content) {
-  return content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
-}
-var ALWAYS_IGNORED;
-var init_ignore = __esm({
-  "src/lib/ignore.ts"() {
-    ALWAYS_IGNORED = [
-      "node_modules",
-      ".git",
-      ".pspm-publish"
-      // temp directory used during publish
-    ];
+  try {
+    const { readFile: readFile7 } = await import("fs/promises");
+    const content = await readFile7(manifestPath, "utf-8");
+    const manifest = JSON.parse(content);
+    if (!manifest.name) {
+      return {
+        valid: false,
+        error: `Manifest in ${absolutePath} is missing 'name' field`
+      };
+    }
+    return { valid: true, manifest };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      valid: false,
+      error: `Failed to read manifest in ${absolutePath}: ${message}`
+    };
   }
-});
-function calculateIntegrity(data) {
-  const hash = createHash("sha256").update(data).digest("base64");
-  return `sha256-${hash}`;
 }
-var init_integrity = __esm({
-  "src/lib/integrity.ts"() {
+var LOCAL_SPECIFIER_PATTERN;
+var init_local = __esm({
+  "src/lib/local.ts"() {
+    "use strict";
+    LOCAL_SPECIFIER_PATTERN = /^file:(.+)$/;
   }
 });
 
@@ -693,6 +730,7 @@ function validateManifest(manifest) {
 var DEFAULT_SKILL_FILES, PSPM_SCHEMA_URL;
 var init_manifest = __esm({
   "src/lib/manifest.ts"() {
+    "use strict";
     DEFAULT_SKILL_FILES = [
       "SKILL.md",
       "runtime",
@@ -702,6 +740,9 @@ var init_manifest = __esm({
     PSPM_SCHEMA_URL = "https://pspm.dev/schema/v1/pspm.json";
   }
 });
+
+// src/lib/version.ts
+import * as semver from "semver";
 function resolveVersion(range, availableVersions) {
   const sorted = availableVersions.filter((v) => semver.valid(v)).sort((a, b) => semver.rcompare(a, b));
   if (!range || range === "latest" || range === "*") {
@@ -727,6 +768,7 @@ function findHighestSatisfying(ranges, availableVersions) {
 }
 var init_version = __esm({
   "src/lib/version.ts"() {
+    "use strict";
   }
 });
 
@@ -1035,6 +1077,7 @@ function printResolutionErrors(errors, conflicts = []) {
 var MAX_DEPENDENCY_DEPTH;
 var init_resolver = __esm({
   "src/lib/resolver.ts"() {
+    "use strict";
     init_api_client();
     init_version();
     MAX_DEPENDENCY_DEPTH = 5;
@@ -1047,14 +1090,9 @@ function parseSkillSpecifier(specifier) {
   if (!match) {
     return null;
   }
-  const username = match[1];
-  const name = match[2];
-  if (!username || !name) {
-    return null;
-  }
   return {
-    username,
-    name,
+    username: match[1],
+    name: match[2],
     versionRange: match[3]
   };
 }
@@ -1064,9 +1102,6 @@ function parseGitHubSpecifier(specifier) {
     return null;
   }
   const [, owner, repo, pathWithSlash, ref] = match;
-  if (!owner || !repo) {
-    return null;
-  }
   return {
     owner,
     repo,
@@ -1088,10 +1123,7 @@ function formatGitHubSpecifier(spec) {
 function getGitHubSkillName(spec) {
   if (spec.path) {
     const segments = spec.path.split("/").filter(Boolean);
-    const lastSegment = segments[segments.length - 1];
-    if (lastSegment) {
-      return lastSegment;
-    }
+    return segments[segments.length - 1];
   }
   return spec.repo;
 }
@@ -1101,6 +1133,7 @@ function isGitHubSpecifier(specifier) {
 var SPECIFIER_PATTERN, GITHUB_SPECIFIER_PATTERN;
 var init_specifier = __esm({
   "src/lib/specifier.ts"() {
+    "use strict";
     SPECIFIER_PATTERN = /^@user\/([a-zA-Z0-9_-]+)\/([a-z][a-z0-9_-]*)(?:@(.+))?$/;
     GITHUB_SPECIFIER_PATTERN = /^github:([a-zA-Z0-9_-]+)\/([a-zA-Z0-9_.-]+)(\/[^@]+)?(?:@(.+))?$/;
   }
@@ -1109,14 +1142,18 @@ var init_specifier = __esm({
 // src/lib/index.ts
 var init_lib = __esm({
   "src/lib/index.ts"() {
-    init_ignore();
+    "use strict";
     init_integrity();
+    init_local();
     init_manifest();
     init_resolver();
     init_specifier();
     init_version();
   }
 });
+
+// src/agents.ts
+import { checkbox } from "@inquirer/prompts";
 function resolveAgentConfig(name, overrides) {
   if (overrides?.[name]) {
     return overrides[name];
@@ -1159,6 +1196,7 @@ async function promptForAgents() {
 var AGENT_INFO, DEFAULT_AGENT_CONFIGS, ALL_AGENTS;
 var init_agents = __esm({
   "src/agents.ts"() {
+    "use strict";
     AGENT_INFO = {
       "claude-code": {
         displayName: "Claude Code",
@@ -1203,6 +1241,10 @@ var init_agents = __esm({
     ];
   }
 });
+
+// src/github.ts
+import { cp, lstat, mkdir as mkdir2, readdir, rm, writeFile as writeFile2 } from "fs/promises";
+import { join as join3 } from "path";
 function getGitHubHeaders() {
   const headers = {
     Accept: "application/vnd.github+json",
@@ -1278,14 +1320,14 @@ async function downloadGitHubPackage(spec) {
   return { buffer, commit, integrity };
 }
 async function extractGitHubPackage(spec, buffer, skillsDir) {
-  const destPath = spec.path ? join(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join(skillsDir, "_github", spec.owner, spec.repo);
-  const tempDir = join(skillsDir, "_github", ".temp", `${Date.now()}`);
-  await mkdir(tempDir, { recursive: true });
-  const tempFile = join(tempDir, "archive.tgz");
+  const destPath = spec.path ? join3(skillsDir, "_github", spec.owner, spec.repo, spec.path) : join3(skillsDir, "_github", spec.owner, spec.repo);
+  const tempDir = join3(skillsDir, "_github", ".temp", `${Date.now()}`);
+  await mkdir2(tempDir, { recursive: true });
+  const tempFile = join3(tempDir, "archive.tgz");
   try {
-    await writeFile(tempFile, buffer);
-    const { exec: exec2 } = await import('child_process');
-    const { promisify: promisify2 } = await import('util');
+    await writeFile2(tempFile, buffer);
+    const { exec: exec2 } = await import("child_process");
+    const { promisify: promisify2 } = await import("util");
     const execAsync = promisify2(exec2);
     await execAsync(`tar -xzf "${tempFile}" -C "${tempDir}"`);
     const entries = await readdir(tempDir);
@@ -1295,16 +1337,16 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
     if (!extractedDir) {
       throw new Error("Failed to find extracted directory in tarball");
     }
-    const sourcePath = join(tempDir, extractedDir);
-    const copySource = spec.path ? join(sourcePath, spec.path) : sourcePath;
+    const sourcePath = join3(tempDir, extractedDir);
+    const copySource = spec.path ? join3(sourcePath, spec.path) : sourcePath;
     if (spec.path) {
       const pathExists = await lstat(copySource).catch(() => null);
       if (!pathExists) {
         const rootEntries = await readdir(sourcePath);
         const dirs = [];
         for (const entry of rootEntries) {
-          const stat7 = await lstat(join(sourcePath, entry)).catch(() => null);
-          if (stat7?.isDirectory() && !entry.startsWith(".")) {
+          const stat8 = await lstat(join3(sourcePath, entry)).catch(() => null);
+          if (stat8?.isDirectory() && !entry.startsWith(".")) {
             dirs.push(entry);
           }
         }
@@ -1312,7 +1354,7 @@ async function extractGitHubPackage(spec, buffer, skillsDir) {
       }
     }
     await rm(destPath, { recursive: true, force: true });
-    await mkdir(destPath, { recursive: true });
+    await mkdir2(destPath, { recursive: true });
     await cp(copySource, destPath, { recursive: true });
     return spec.path ? `.pspm/skills/_github/${spec.owner}/${spec.repo}/${spec.path}` : `.pspm/skills/_github/${spec.owner}/${spec.repo}`;
   } finally {
@@ -1326,13 +1368,15 @@ function getGitHubDisplayName(spec, commit) {
   }
   if (spec.ref || commit) {
     const ref = spec.ref || "HEAD";
-    name += ` (${ref}${""})`;
+    const shortCommit = commit ? commit.slice(0, 7) : "";
+    name += ` (${ref}${shortCommit ? `@${shortCommit}` : ""})`;
   }
   return name;
 }
 var GitHubRateLimitError, GitHubNotFoundError, GitHubPathNotFoundError;
 var init_github = __esm({
   "src/github.ts"() {
+    "use strict";
     init_lib();
     GitHubRateLimitError = class extends Error {
       constructor() {
@@ -1365,9 +1409,13 @@ Available paths in repository root:
     };
   }
 });
+
+// src/lockfile.ts
+import { mkdir as mkdir3, readFile as readFile2, stat as stat3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname2 } from "path";
 async function hasLegacyLockfile() {
   try {
-    await stat(getLegacyLockfilePath());
+    await stat3(getLegacyLockfilePath());
     return true;
   } catch {
     return false;
@@ -1377,24 +1425,24 @@ async function migrateLockfileIfNeeded() {
   const legacyPath = getLegacyLockfilePath();
   const newPath = getLockfilePath();
   try {
-    await stat(legacyPath);
+    await stat3(legacyPath);
   } catch {
     return false;
   }
   try {
-    await stat(newPath);
+    await stat3(newPath);
     return false;
   } catch {
   }
   try {
-    const content = await readFile(legacyPath, "utf-8");
+    const content = await readFile2(legacyPath, "utf-8");
     const oldLockfile = JSON.parse(content);
     const newLockfile = {
       lockfileVersion: 2,
       registryUrl: oldLockfile.registryUrl,
       packages: oldLockfile.skills ?? {}
     };
-    await writeFile(newPath, `${JSON.stringify(newLockfile, null, 2)}
+    await writeFile3(newPath, `${JSON.stringify(newLockfile, null, 2)}
 `);
     console.log("Migrated lockfile: skill-lock.json \u2192 pspm-lock.json");
     return true;
@@ -1405,7 +1453,7 @@ async function migrateLockfileIfNeeded() {
 async function readLockfile() {
   const lockfilePath = getLockfilePath();
   try {
-    const content = await readFile(lockfilePath, "utf-8");
+    const content = await readFile2(lockfilePath, "utf-8");
     const lockfile = JSON.parse(content);
     if (lockfile.lockfileVersion === 1 && lockfile.skills && !lockfile.packages) {
       return {
@@ -1418,7 +1466,7 @@ async function readLockfile() {
   } catch {
     if (await hasLegacyLockfile()) {
       try {
-        const content = await readFile(getLegacyLockfilePath(), "utf-8");
+        const content = await readFile2(getLegacyLockfilePath(), "utf-8");
         const legacyLockfile = JSON.parse(content);
         return {
           lockfileVersion: 2,
@@ -1434,12 +1482,18 @@ async function readLockfile() {
 }
 async function writeLockfile(lockfile) {
   const lockfilePath = getLockfilePath();
-  await mkdir(dirname(lockfilePath), { recursive: true });
+  await mkdir3(dirname2(lockfilePath), { recursive: true });
   const packages = lockfile.packages ?? lockfile.skills ?? {};
   const hasDependencies = Object.values(packages).some(
     (pkg) => pkg.dependencies && Object.keys(pkg.dependencies).length > 0
   );
-  const version2 = hasDependencies ? 4 : 3;
+  const hasLocalPackages = lockfile.localPackages && Object.keys(lockfile.localPackages).length > 0;
+  let version2 = 3;
+  if (hasLocalPackages) {
+    version2 = 5;
+  } else if (hasDependencies) {
+    version2 = 4;
+  }
   const normalized = {
     lockfileVersion: version2,
     registryUrl: lockfile.registryUrl,
@@ -1448,7 +1502,10 @@ async function writeLockfile(lockfile) {
   if (lockfile.githubPackages && Object.keys(lockfile.githubPackages).length > 0) {
     normalized.githubPackages = lockfile.githubPackages;
   }
-  await writeFile(lockfilePath, `${JSON.stringify(normalized, null, 2)}
+  if (hasLocalPackages) {
+    normalized.localPackages = lockfile.localPackages;
+  }
+  await writeFile3(lockfilePath, `${JSON.stringify(normalized, null, 2)}
 `);
 }
 async function createEmptyLockfile() {
@@ -1541,17 +1598,52 @@ async function listLockfileGitHubPackages() {
     entry
   }));
 }
+async function addLocalToLockfile(specifier, entry) {
+  let lockfile = await readLockfile();
+  if (!lockfile) {
+    lockfile = await createEmptyLockfile();
+  }
+  if (!lockfile.localPackages) {
+    lockfile.localPackages = {};
+  }
+  lockfile.localPackages[specifier] = entry;
+  await writeLockfile(lockfile);
+}
+async function removeLocalFromLockfile(specifier) {
+  const lockfile = await readLockfile();
+  if (!lockfile?.localPackages?.[specifier]) {
+    return false;
+  }
+  delete lockfile.localPackages[specifier];
+  await writeLockfile(lockfile);
+  return true;
+}
+async function listLockfileLocalPackages() {
+  const lockfile = await readLockfile();
+  if (!lockfile?.localPackages) {
+    return [];
+  }
+  return Object.entries(lockfile.localPackages).map(([specifier, entry]) => ({
+    specifier,
+    entry
+  }));
+}
 var init_lockfile = __esm({
   "src/lockfile.ts"() {
+    "use strict";
     init_config();
   }
 });
+
+// src/manifest.ts
+import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import { join as join4 } from "path";
 function getManifestPath() {
-  return join(process.cwd(), "pspm.json");
+  return join4(process.cwd(), "pspm.json");
 }
 async function readManifest() {
   try {
-    const content = await readFile(getManifestPath(), "utf-8");
+    const content = await readFile3(getManifestPath(), "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -1559,7 +1651,7 @@ async function readManifest() {
 }
 async function writeManifest(manifest) {
   const content = JSON.stringify(manifest, null, 2);
-  await writeFile(getManifestPath(), `${content}
+  await writeFile4(getManifestPath(), `${content}
 `);
 }
 async function createMinimalManifest() {
@@ -1617,10 +1709,36 @@ async function removeGitHubDependency(specifier) {
   await writeManifest(manifest);
   return true;
 }
+async function getLocalDependencies() {
+  const manifest = await readManifest();
+  return manifest?.localDependencies ?? {};
+}
+async function addLocalDependency(specifier, version2 = "*") {
+  const manifest = await ensureManifest();
+  if (!manifest.localDependencies) {
+    manifest.localDependencies = {};
+  }
+  manifest.localDependencies[specifier] = version2;
+  await writeManifest(manifest);
+}
+async function removeLocalDependency(specifier) {
+  const manifest = await readManifest();
+  if (!manifest?.localDependencies?.[specifier]) {
+    return false;
+  }
+  delete manifest.localDependencies[specifier];
+  await writeManifest(manifest);
+  return true;
+}
 var init_manifest2 = __esm({
   "src/manifest.ts"() {
+    "use strict";
   }
 });
+
+// src/symlinks.ts
+import { lstat as lstat2, mkdir as mkdir4, readlink, rm as rm2, symlink } from "fs/promises";
+import { dirname as dirname3, join as join5, relative } from "path";
 async function createAgentSymlinks(skills, options) {
   const { agents, projectRoot, agentConfigs } = options;
   if (agents.length === 1 && agents[0] === "none") {
@@ -1632,26 +1750,26 @@ async function createAgentSymlinks(skills, options) {
       console.warn(`Warning: Unknown agent "${agentName}", skipping symlinks`);
       continue;
     }
-    const agentSkillsDir = join(projectRoot, config2.skillsDir);
-    await mkdir(agentSkillsDir, { recursive: true });
+    const agentSkillsDir = join5(projectRoot, config2.skillsDir);
+    await mkdir4(agentSkillsDir, { recursive: true });
     for (const skill of skills) {
-      const symlinkPath = join(agentSkillsDir, skill.name);
-      const targetPath = join(projectRoot, skill.sourcePath);
-      const relativeTarget = relative(dirname(symlinkPath), targetPath);
+      const symlinkPath = join5(agentSkillsDir, skill.name);
+      const targetPath = join5(projectRoot, skill.sourcePath);
+      const relativeTarget = relative(dirname3(symlinkPath), targetPath);
       await createSymlink(symlinkPath, relativeTarget, skill.name);
     }
   }
 }
 async function createSymlink(symlinkPath, target, skillName) {
   try {
-    const stats = await lstat(symlinkPath).catch(() => null);
+    const stats = await lstat2(symlinkPath).catch(() => null);
     if (stats) {
       if (stats.isSymbolicLink()) {
         const existingTarget = await readlink(symlinkPath);
         if (existingTarget === target) {
           return;
         }
-        await rm(symlinkPath);
+        await rm2(symlinkPath);
       } else {
         console.warn(
           `Warning: File exists at symlink path for "${skillName}", skipping: ${symlinkPath}`
@@ -1677,11 +1795,11 @@ async function removeAgentSymlinks(skillName, options) {
     if (!config2) {
       continue;
     }
-    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join5(projectRoot, config2.skillsDir, skillName);
     try {
-      const stats = await lstat(symlinkPath).catch(() => null);
+      const stats = await lstat2(symlinkPath).catch(() => null);
       if (stats?.isSymbolicLink()) {
-        await rm(symlinkPath);
+        await rm2(symlinkPath);
       }
     } catch {
     }
@@ -1696,14 +1814,17 @@ function getGitHubSkillPath(owner, repo, path) {
   }
   return `.pspm/skills/_github/${owner}/${repo}`;
 }
+function getLocalSkillPath(skillName) {
+  return `.pspm/skills/_local/${skillName}`;
+}
 async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
   const linkedAgents = [];
   for (const agentName of agents) {
     const config2 = resolveAgentConfig(agentName, agentConfigs);
     if (!config2) continue;
-    const symlinkPath = join(projectRoot, config2.skillsDir, skillName);
+    const symlinkPath = join5(projectRoot, config2.skillsDir, skillName);
     try {
-      const stats = await lstat(symlinkPath);
+      const stats = await lstat2(symlinkPath);
       if (stats.isSymbolicLink()) {
         linkedAgents.push(agentName);
       }
@@ -1714,6 +1835,7 @@ async function getLinkedAgents(skillName, agents, projectRoot, agentConfigs) {
 }
 var init_symlinks = __esm({
   "src/symlinks.ts"() {
+    "use strict";
     init_agents();
   }
 });
@@ -1723,13 +1845,21 @@ var add_exports = {};
 __export(add_exports, {
   add: () => add
 });
+import { mkdir as mkdir5, rm as rm3, symlink as symlink2 } from "fs/promises";
+import { dirname as dirname4, join as join6 } from "path";
 async function add(specifiers, options) {
   console.log("Resolving packages...\n");
   const resolvedPackages = [];
   const validationErrors = [];
-  for (const specifier of specifiers) {
+  for (let specifier of specifiers) {
     try {
-      if (isGitHubSpecifier(specifier)) {
+      if (isBareLocalPath(specifier)) {
+        specifier = normalizeToFileSpecifier(specifier);
+      }
+      if (isLocalSpecifier(specifier)) {
+        const resolved = await validateLocalPackage(specifier);
+        resolvedPackages.push(resolved);
+      } else if (isGitHubSpecifier(specifier)) {
         const resolved = await validateGitHubPackage(specifier);
         resolvedPackages.push(resolved);
       } else {
@@ -1761,6 +1891,9 @@ async function add(specifiers, options) {
   const githubPackages = resolvedPackages.filter(
     (p) => p.type === "github"
   );
+  const localPackages = resolvedPackages.filter(
+    (p) => p.type === "local"
+  );
   let resolutionResult = null;
   if (registryPackages.length > 0) {
     const rootDeps = {};
@@ -1845,6 +1978,24 @@ async function add(specifiers, options) {
         error: message
       });
       console.error(`Failed to install ${resolved.specifier}: ${message}
+`);
+    }
+  }
+  for (const resolved of localPackages) {
+    try {
+      await installLocalPackage(resolved, {
+        ...options,
+        resolvedAgents: agents
+      });
+      results.push({ specifier: resolved.specifier, success: true });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      results.push({
+        specifier: resolved.specifier,
+        success: false,
+        error: message
+      });
+      console.error(`Failed to install ${resolved.specifier}: ${message}
 `);
     }
   }
@@ -1885,23 +2036,23 @@ async function installFromNode(node, options) {
     throw new Error("Checksum verification failed");
   }
   const skillsDir = getSkillsDir();
-  const destDir = join(skillsDir, username, name);
-  await mkdir(destDir, { recursive: true });
-  const { writeFile: writeFile8 } = await import('fs/promises');
-  const tempFile = join(destDir, ".temp.tgz");
+  const destDir = join6(skillsDir, username, name);
+  await mkdir5(destDir, { recursive: true });
+  const { writeFile: writeFile8 } = await import("fs/promises");
+  const tempFile = join6(destDir, ".temp.tgz");
   await writeFile8(tempFile, tarballBuffer);
-  const { exec: exec2 } = await import('child_process');
-  const { promisify: promisify2 } = await import('util');
+  const { exec: exec2 } = await import("child_process");
+  const { promisify: promisify2 } = await import("util");
   const execAsync = promisify2(exec2);
   try {
-    await rm(destDir, { recursive: true, force: true });
-    await mkdir(destDir, { recursive: true });
+    await rm3(destDir, { recursive: true, force: true });
+    await mkdir5(destDir, { recursive: true });
     await writeFile8(tempFile, tarballBuffer);
     await execAsync(
       `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
     );
   } finally {
-    await rm(tempFile, { force: true });
+    await rm3(tempFile, { force: true });
   }
   const resolvedDeps = {};
   for (const [depName, _range] of Object.entries(node.dependencies)) {
@@ -2069,8 +2220,70 @@ async function installGitHubPackage(resolved, options) {
   );
   console.log(`Location: ${destPath}`);
 }
+async function validateLocalPackage(specifier) {
+  const parsed = parseLocalSpecifier(specifier);
+  if (!parsed) {
+    throw new Error(
+      `Invalid local specifier "${specifier}". Use format: file:../path or file:/absolute/path`
+    );
+  }
+  console.log(`Resolving ${specifier}...`);
+  const resolvedPath = resolveLocalPath(parsed);
+  const validation = await validateLocalSkill(resolvedPath);
+  if (!validation.valid) {
+    throw new Error(validation.error);
+  }
+  const name = validation.manifest?.name || getLocalSkillName(parsed);
+  console.log(`Resolved ${specifier} -> ${name} (local)`);
+  return {
+    type: "local",
+    specifier,
+    parsed,
+    name,
+    resolvedPath
+  };
+}
+async function installLocalPackage(resolved, options) {
+  const { specifier, name, resolvedPath, parsed } = resolved;
+  console.log(`Installing ${specifier} (local symlink)...`);
+  const skillsDir = getSkillsDir();
+  const localDir = join6(skillsDir, "_local");
+  await mkdir5(localDir, { recursive: true });
+  const symlinkPath = join6(localDir, name);
+  try {
+    await rm3(symlinkPath, { force: true });
+  } catch {
+  }
+  const { relative: relativePath } = await import("path");
+  const relativeTarget = relativePath(dirname4(symlinkPath), resolvedPath);
+  await symlink2(relativeTarget, symlinkPath);
+  const entry = {
+    version: "local",
+    path: parsed.path,
+    resolvedPath,
+    name
+  };
+  await addLocalToLockfile(specifier, entry);
+  await addLocalDependency(specifier, "*");
+  const agents = options.resolvedAgents;
+  if (agents[0] !== "none") {
+    const manifest = await readManifest();
+    const skillInfo = {
+      name,
+      sourcePath: getLocalSkillPath(name)
+    };
+    await createAgentSymlinks([skillInfo], {
+      agents,
+      projectRoot: process.cwd(),
+      agentConfigs: manifest?.agents
+    });
+  }
+  console.log(`Installed ${specifier} (local)`);
+  console.log(`Location: ${symlinkPath} -> ${resolvedPath}`);
+}
 var init_add = __esm({
   "src/commands/add.ts"() {
+    "use strict";
     init_agents();
     init_api_client();
     init_config();
@@ -2083,11 +2296,17 @@ var init_add = __esm({
   }
 });
 
+// src/index.ts
+import { readFileSync } from "fs";
+import { dirname as dirname6, join as join13 } from "path";
+import { fileURLToPath } from "url";
+import { Command } from "commander";
+
 // src/commands/access.ts
 init_api_client();
 init_config();
 init_lib();
-async function access(specifier, options) {
+async function access2(specifier, options) {
   try {
     const apiKey = await requireApiKey();
     const registryUrl = await getRegistryUrl();
@@ -2111,18 +2330,18 @@ async function access(specifier, options) {
       }
       packageName = parsed.name;
     } else {
-      const { readFile: readFile8 } = await import('fs/promises');
-      const { join: join14 } = await import('path');
+      const { readFile: readFile7 } = await import("fs/promises");
+      const { join: join14 } = await import("path");
       let manifest = null;
       try {
-        const content = await readFile8(
+        const content = await readFile7(
           join14(process.cwd(), "pspm.json"),
           "utf-8"
         );
         manifest = JSON.parse(content);
       } catch {
         try {
-          const content = await readFile8(
+          const content = await readFile7(
             join14(process.cwd(), "package.json"),
             "utf-8"
           );
@@ -2170,11 +2389,15 @@ async function access(specifier, options) {
 
 // src/commands/index.ts
 init_add();
+
+// src/commands/config/init.ts
+import { stat as stat4, writeFile as writeFile5 } from "fs/promises";
+import { join as join7 } from "path";
 async function configInit(options) {
   try {
-    const configPath = join(process.cwd(), ".pspmrc");
+    const configPath = join7(process.cwd(), ".pspmrc");
     try {
-      await stat(configPath);
+      await stat4(configPath);
       console.error("Error: .pspmrc already exists in this directory.");
       process.exit(1);
     } catch {
@@ -2187,7 +2410,7 @@ async function configInit(options) {
       lines.push("; registry = https://custom-registry.example.com");
     }
     lines.push("");
-    await writeFile(configPath, lines.join("\n"));
+    await writeFile5(configPath, lines.join("\n"));
     console.log("Created .pspmrc");
     console.log("");
     console.log("Contents:");
@@ -2300,18 +2523,21 @@ async function deprecate(specifier, message, options) {
 
 // src/commands/init.ts
 init_lib();
+import { readFile as readFile4, stat as stat5, writeFile as writeFile6 } from "fs/promises";
+import { basename, join as join8 } from "path";
+import { createInterface } from "readline";
 function prompt(rl, question, defaultValue) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const displayDefault = defaultValue ? ` (${defaultValue})` : "";
     rl.question(`${question}${displayDefault} `, (answer) => {
-      resolve(answer.trim() || defaultValue);
+      resolve2(answer.trim() || defaultValue);
     });
   });
 }
 async function readExistingPackageJson() {
   try {
-    const content = await readFile(
-      join(process.cwd(), "package.json"),
+    const content = await readFile4(
+      join8(process.cwd(), "package.json"),
       "utf-8"
     );
     const pkg = JSON.parse(content);
@@ -2328,8 +2554,8 @@ async function readExistingPackageJson() {
 }
 async function getGitAuthor() {
   try {
-    const { exec: exec2 } = await import('child_process');
-    const { promisify: promisify2 } = await import('util');
+    const { exec: exec2 } = await import("child_process");
+    const { promisify: promisify2 } = await import("util");
     const execAsync = promisify2(exec2);
     const [nameResult, emailResult] = await Promise.all([
       execAsync("git config user.name").catch(() => ({ stdout: "" })),
@@ -2360,10 +2586,10 @@ function isValidVersion(version2) {
 }
 async function init(options) {
   try {
-    const pspmJsonPath = join(process.cwd(), "pspm.json");
+    const pspmJsonPath = join8(process.cwd(), "pspm.json");
     let exists = false;
     try {
-      await stat(pspmJsonPath);
+      await stat5(pspmJsonPath);
       exists = true;
     } catch {
     }
@@ -2495,10 +2721,10 @@ async function init(options) {
         process.exit(0);
       }
     }
-    await writeFile(pspmJsonPath, `${content}
+    await writeFile6(pspmJsonPath, `${content}
 `);
     try {
-      await stat(join(process.cwd(), "SKILL.md"));
+      await stat5(join8(process.cwd(), "SKILL.md"));
     } catch {
       console.log(
         "Note: Create a SKILL.md file with your skill's prompt content."
@@ -2526,6 +2752,16 @@ init_lib();
 init_lockfile();
 init_manifest2();
 init_symlinks();
+import { createHash as createHash2 } from "crypto";
+import {
+  lstat as lstat3,
+  mkdir as mkdir6,
+  readFile as readFile5,
+  rm as rm4,
+  symlink as symlink3,
+  writeFile as writeFile7
+} from "fs/promises";
+import { dirname as dirname5, join as join9, relative as relative2 } from "path";
 function getCacheFilePath(cacheDir, integrity) {
   const match = integrity.match(/^sha256-(.+)$/);
   if (!match) {
@@ -2533,15 +2769,15 @@ function getCacheFilePath(cacheDir, integrity) {
   }
   const base64Hash = match[1];
   const hexHash = Buffer.from(base64Hash, "base64").toString("hex");
-  return join(cacheDir, `sha256-${hexHash}.tgz`);
+  return join9(cacheDir, `sha256-${hexHash}.tgz`);
 }
 async function readFromCache(cacheDir, integrity) {
   try {
     const cachePath = getCacheFilePath(cacheDir, integrity);
-    const data = await readFile(cachePath);
-    const actualIntegrity = `sha256-${createHash("sha256").update(data).digest("base64")}`;
+    const data = await readFile5(cachePath);
+    const actualIntegrity = `sha256-${createHash2("sha256").update(data).digest("base64")}`;
     if (actualIntegrity !== integrity) {
-      await rm(cachePath, { force: true });
+      await rm4(cachePath, { force: true });
       return null;
     }
     return data;
@@ -2551,9 +2787,9 @@ async function readFromCache(cacheDir, integrity) {
 }
 async function writeToCache(cacheDir, integrity, data) {
   try {
-    await mkdir(cacheDir, { recursive: true });
+    await mkdir6(cacheDir, { recursive: true });
     const cachePath = getCacheFilePath(cacheDir, integrity);
-    await writeFile(cachePath, data);
+    await writeFile7(cachePath, data);
   } catch {
   }
 }
@@ -2580,8 +2816,10 @@ async function installFromLockfile(options) {
     let lockfile = await readLockfile();
     const manifestDeps = await getDependencies();
     const manifestGitHubDeps = await getGitHubDependencies();
+    const manifestLocalDeps = await getLocalDependencies();
     const lockfilePackages = lockfile?.packages ?? lockfile?.skills ?? {};
     const lockfileGitHubPackages = lockfile?.githubPackages ?? {};
+    const lockfileLocalPackages = lockfile?.localPackages ?? {};
     const installedSkills = [];
     const missingDeps = [];
     for (const [fullName, versionRange] of Object.entries(manifestDeps)) {
@@ -2732,6 +2970,53 @@ Resolving ${missingGitHubDeps.length} GitHub dependency(ies)...
       }
       lockfile = await readLockfile();
     }
+    const missingLocalDeps = [];
+    for (const [specifier] of Object.entries(manifestLocalDeps)) {
+      if (!lockfileLocalPackages[specifier]) {
+        missingLocalDeps.push({ specifier });
+      }
+    }
+    if (missingLocalDeps.length > 0) {
+      if (options.frozenLockfile) {
+        console.error(
+          "Error: Local dependencies in pspm.json are not in lockfile. Cannot install with --frozen-lockfile"
+        );
+        console.error("Missing local dependencies:");
+        for (const dep of missingLocalDeps) {
+          console.error(`  - ${dep.specifier}`);
+        }
+        process.exit(1);
+      }
+      console.log(
+        `
+Resolving ${missingLocalDeps.length} local dependency(ies)...
+`
+      );
+      for (const { specifier } of missingLocalDeps) {
+        const parsed = parseLocalSpecifier(specifier);
+        if (!parsed) {
+          console.error(`Error: Invalid local specifier: ${specifier}`);
+          continue;
+        }
+        console.log(`Resolving ${specifier}...`);
+        const resolvedPath = resolveLocalPath(parsed);
+        const validation = await validateLocalSkill(resolvedPath);
+        if (!validation.valid) {
+          console.error(`Error: ${validation.error}`);
+          continue;
+        }
+        const name = validation.manifest?.name || parsed.path.split("/").pop() || "unknown";
+        const entry = {
+          version: "local",
+          path: parsed.path,
+          resolvedPath,
+          name
+        };
+        await addLocalToLockfile(specifier, entry);
+        console.log(`  Resolved ${specifier} -> ${name} (local)`);
+      }
+      lockfile = await readLockfile();
+    }
     const manifest = await readManifest();
     const agentConfigs = manifest?.agents;
     let agents;
@@ -2797,7 +3082,7 @@ Installing ${packageCount} registry skill(s)...
             continue;
           }
           tarballBuffer = Buffer.from(await response.arrayBuffer());
-          const actualIntegrity = `sha256-${createHash("sha256").update(tarballBuffer).digest("base64")}`;
+          const actualIntegrity = `sha256-${createHash2("sha256").update(tarballBuffer).digest("base64")}`;
           if (actualIntegrity !== entry.integrity) {
             console.error(
               `  Error: Checksum verification failed for ${fullName}`
@@ -2809,20 +3094,20 @@ Installing ${packageCount} registry skill(s)...
           }
           await writeToCache(cacheDir, entry.integrity, tarballBuffer);
         }
-        const destDir = join(skillsDir, username, name);
-        await rm(destDir, { recursive: true, force: true });
-        await mkdir(destDir, { recursive: true });
-        const tempFile = join(destDir, ".temp.tgz");
-        await writeFile(tempFile, tarballBuffer);
-        const { exec: exec2 } = await import('child_process');
-        const { promisify: promisify2 } = await import('util');
+        const destDir = join9(skillsDir, username, name);
+        await rm4(destDir, { recursive: true, force: true });
+        await mkdir6(destDir, { recursive: true });
+        const tempFile = join9(destDir, ".temp.tgz");
+        await writeFile7(tempFile, tarballBuffer);
+        const { exec: exec2 } = await import("child_process");
+        const { promisify: promisify2 } = await import("util");
         const execAsync = promisify2(exec2);
         try {
           await execAsync(
             `tar -xzf "${tempFile}" -C "${destDir}" --strip-components=1`
           );
         } finally {
-          await rm(tempFile, { force: true });
+          await rm4(tempFile, { force: true });
         }
         console.log(
           `  Installed to ${destDir}${fromCache ? " (from cache)" : ""}`
@@ -2910,6 +3195,52 @@ Installing ${githubCount} GitHub skill(s)...
         }
       }
     }
+    const localPackages = lockfile?.localPackages ?? {};
+    const localCount = Object.keys(localPackages).length;
+    if (localCount > 0) {
+      console.log(`
+Installing ${localCount} local skill(s)...
+`);
+      for (const [specifier, entry] of Object.entries(localPackages)) {
+        const localEntry = entry;
+        console.log(`Installing ${specifier} (local symlink)...`);
+        const validation = await validateLocalSkill(localEntry.resolvedPath);
+        if (!validation.valid) {
+          console.error(`  Error: ${validation.error}`);
+          console.error(
+            `  Hint: The local skill at ${localEntry.resolvedPath} may have been moved or deleted.`
+          );
+          continue;
+        }
+        const localDir = join9(skillsDir, "_local");
+        await mkdir6(localDir, { recursive: true });
+        const symlinkPath = join9(localDir, localEntry.name);
+        try {
+          const stats = await lstat3(symlinkPath);
+          if (stats.isSymbolicLink()) {
+            await rm4(symlinkPath);
+          }
+        } catch {
+        }
+        const relativeTarget = relative2(
+          dirname5(symlinkPath),
+          localEntry.resolvedPath
+        );
+        try {
+          await symlink3(relativeTarget, symlinkPath);
+          console.log(
+            `  Installed to ${symlinkPath} -> ${localEntry.resolvedPath}`
+          );
+          installedSkills.push({
+            name: localEntry.name,
+            sourcePath: getLocalSkillPath(localEntry.name)
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          console.error(`  Error creating symlink: ${message}`);
+        }
+      }
+    }
     if (installedSkills.length > 0 && agents[0] !== "none") {
       console.log(`
 Creating symlinks for agent(s): ${agents.join(", ")}...`);
@@ -2920,7 +3251,7 @@ Creating symlinks for agent(s): ${agents.join(", ")}...`);
       });
       console.log("  Symlinks created.");
     }
-    const totalCount = packageCount + githubCount;
+    const totalCount = packageCount + githubCount + localCount;
     if (totalCount === 0) {
       console.log("No skills to install.");
     } else {
@@ -3017,6 +3348,8 @@ init_lib();
 init_lockfile();
 init_manifest2();
 init_symlinks();
+import { access as access3 } from "fs/promises";
+import { join as join10 } from "path";
 async function list(options) {
   try {
     const registrySkills = await listLockfileSkills();
@@ -3031,10 +3364,10 @@ async function list(options) {
       if (!match) continue;
       const [, username, skillName] = match;
       const sourcePath = getRegistrySkillPath(username, skillName);
-      const absolutePath = join(projectRoot, sourcePath);
+      const absolutePath = join10(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access$1(absolutePath);
+        await access3(absolutePath);
       } catch {
         status = "missing";
       }
@@ -3064,10 +3397,10 @@ async function list(options) {
         parsed.repo,
         parsed.path
       );
-      const absolutePath = join(projectRoot, sourcePath);
+      const absolutePath = join10(projectRoot, sourcePath);
       let status = "installed";
       try {
-        await access$1(absolutePath);
+        await access3(absolutePath);
       } catch {
         status = "missing";
       }
@@ -3089,6 +3422,35 @@ async function list(options) {
         gitCommit: ghEntry.gitCommit
       });
     }
+    const localSkills = await listLockfileLocalPackages();
+    for (const { specifier, entry } of localSkills) {
+      const localEntry = entry;
+      const skillName = localEntry.name;
+      const sourcePath = getLocalSkillPath(skillName);
+      const absolutePath = join10(projectRoot, sourcePath);
+      let status = "installed";
+      try {
+        await access3(absolutePath);
+      } catch {
+        status = "missing";
+      }
+      const linkedAgents = await getLinkedAgents(
+        skillName,
+        availableAgents,
+        projectRoot,
+        agentConfigs
+      );
+      skills.push({
+        name: skillName,
+        fullName: specifier,
+        version: "local",
+        source: "local",
+        sourcePath,
+        status,
+        linkedAgents,
+        localPath: localEntry.resolvedPath
+      });
+    }
     if (skills.length === 0) {
       console.log("No skills installed.");
       return;
@@ -3101,9 +3463,14 @@ async function list(options) {
     for (const skill of skills) {
       if (skill.source === "registry") {
         console.log(`  ${skill.fullName}@${skill.version} (registry)`);
-      } else {
+      } else if (skill.source === "github") {
         const refInfo = skill.gitRef ? `${skill.gitRef}@${skill.gitCommit?.slice(0, 7)}` : skill.version;
         console.log(`  ${skill.fullName} (${refInfo})`);
+      } else {
+        console.log(`  ${skill.fullName} [local]`);
+        if (skill.localPath) {
+          console.log(`    Path: ${skill.localPath}`);
+        }
       }
       if (skill.status === "missing") {
         console.log(`    Status: MISSING (run 'pspm install' to restore)`);
@@ -3119,9 +3486,11 @@ async function list(options) {
     }
     const registryCount = skills.filter((s) => s.source === "registry").length;
     const githubCount = skills.filter((s) => s.source === "github").length;
+    const localCount = skills.filter((s) => s.source === "local").length;
     const parts = [];
     if (registryCount > 0) parts.push(`${registryCount} registry`);
     if (githubCount > 0) parts.push(`${githubCount} github`);
+    if (localCount > 0) parts.push(`${localCount} local`);
     console.log(`
 Total: ${skills.length} skill(s) (${parts.join(", ")})`);
   } catch (error) {
@@ -3134,13 +3503,17 @@ Total: ${skills.length} skill(s) (${parts.join(", ")})`);
 // src/commands/login.ts
 init_api_client();
 init_config();
+import { randomBytes } from "crypto";
+import http from "http";
+import { URL as URL2 } from "url";
+import open from "open";
 var DEFAULT_WEB_APP_URL = "https://pspm.dev";
 function getWebAppUrl(registryUrl) {
   if (process.env.PSPM_WEB_URL) {
     return process.env.PSPM_WEB_URL.replace(/\/$/, "");
   }
   try {
-    const url = new URL$1(registryUrl);
+    const url = new URL2(registryUrl);
     return `${url.protocol}//${url.host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
@@ -3148,7 +3521,7 @@ function getWebAppUrl(registryUrl) {
 }
 function getServerUrl(registryUrl) {
   try {
-    const url = new URL$1(registryUrl);
+    const url = new URL2(registryUrl);
     return `${url.protocol}//${url.host}`;
   } catch {
     return DEFAULT_WEB_APP_URL;
@@ -3175,12 +3548,12 @@ function startCallbackServer(expectedState) {
     let resolveToken;
     let rejectToken;
     let timeoutId;
-    const tokenPromise = new Promise((resolve, reject) => {
-      resolveToken = resolve;
+    const tokenPromise = new Promise((resolve2, reject) => {
+      resolveToken = resolve2;
       rejectToken = reject;
     });
     const server = http.createServer((req, res) => {
-      const url = new URL$1(req.url || "/", "http://localhost");
+      const url = new URL2(req.url || "/", "http://localhost");
       if (url.pathname === "/callback") {
         const token = url.searchParams.get("token");
         const state = url.searchParams.get("state");
@@ -3331,6 +3704,7 @@ async function logout() {
 // src/commands/migrate.ts
 init_config();
 init_lockfile();
+import { mkdir as mkdir7, readdir as readdir2, rename, rm as rm5, stat as stat6 } from "fs/promises";
 async function migrate(options) {
   try {
     const legacySkillsDir = getLegacySkillsDir();
@@ -3341,9 +3715,9 @@ async function migrate(options) {
     let migrationNeeded = false;
     const actions = [];
     try {
-      const legacyStats = await stat(legacySkillsDir);
+      const legacyStats = await stat6(legacySkillsDir);
       if (legacyStats.isDirectory()) {
-        const contents = await readdir(legacySkillsDir);
+        const contents = await readdir2(legacySkillsDir);
         if (contents.length > 0) {
           migrationNeeded = true;
           actions.push("Move .skills/ \u2192 .pspm/skills/");
@@ -3352,9 +3726,9 @@ async function migrate(options) {
     } catch {
     }
     try {
-      await stat(legacyLockfilePath);
+      await stat6(legacyLockfilePath);
       try {
-        await stat(newLockfilePath);
+        await stat6(newLockfilePath);
         actions.push(
           "Note: Both skill-lock.json and pspm-lock.json exist. Manual merge may be needed."
         );
@@ -3386,21 +3760,21 @@ async function migrate(options) {
       console.log("  \u2713 Migrated skill-lock.json \u2192 pspm-lock.json");
     }
     try {
-      const legacyStats = await stat(legacySkillsDir);
+      const legacyStats = await stat6(legacySkillsDir);
       if (legacyStats.isDirectory()) {
-        const contents = await readdir(legacySkillsDir);
+        const contents = await readdir2(legacySkillsDir);
         if (contents.length > 0) {
-          await mkdir(pspmDir, { recursive: true });
+          await mkdir7(pspmDir, { recursive: true });
           try {
-            const newStats = await stat(newSkillsDir);
+            const newStats = await stat6(newSkillsDir);
             if (newStats.isDirectory()) {
-              const newContents = await readdir(newSkillsDir);
+              const newContents = await readdir2(newSkillsDir);
               if (newContents.length > 0) {
                 console.log(
                   "  ! Both .skills/ and .pspm/skills/ have content. Manual merge required."
                 );
               } else {
-                await rm(newSkillsDir, { recursive: true, force: true });
+                await rm5(newSkillsDir, { recursive: true, force: true });
                 await rename(legacySkillsDir, newSkillsDir);
                 console.log("  \u2713 Moved .skills/ \u2192 .pspm/skills/");
               }
@@ -3436,19 +3810,24 @@ init_api_client();
 init_config();
 init_errors();
 init_lib();
-var exec = promisify(exec$1);
+import { exec as execCb } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { readdir as readdir3, readFile as readFile6, stat as stat7 } from "fs/promises";
+import { join as join11, relative as relative3 } from "path";
+import { promisify } from "util";
+var exec = promisify(execCb);
 async function detectManifest() {
   const cwd = process.cwd();
-  const pspmJsonPath = join(cwd, "pspm.json");
+  const pspmJsonPath = join11(cwd, "pspm.json");
   try {
-    const content = await readFile(pspmJsonPath, "utf-8");
+    const content = await readFile6(pspmJsonPath, "utf-8");
     const manifest = JSON.parse(content);
     return { type: "pspm.json", manifest, path: pspmJsonPath };
   } catch {
   }
-  const packageJsonPath = join(cwd, "package.json");
+  const packageJsonPath = join11(cwd, "package.json");
   try {
-    const content = await readFile(packageJsonPath, "utf-8");
+    const content = await readFile6(packageJsonPath, "utf-8");
     const packageJson2 = JSON.parse(content);
     const manifest = {
       name: packageJson2.name,
@@ -3468,31 +3847,21 @@ function formatBytes(bytes) {
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}kB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
-async function getFilesWithSizes(dir, baseDir, ignoreResult) {
+async function getFilesWithSizes(dir, baseDir) {
   const results = [];
   try {
-    const entries = await readdir(dir, { withFileTypes: true });
+    const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
-      const relativePath = relative(baseDir, fullPath);
-      if (ALWAYS_IGNORED.includes(entry.name)) {
+      const fullPath = join11(dir, entry.name);
+      const relativePath = relative3(baseDir, fullPath);
+      if (entry.name === "node_modules" || entry.name === ".git") {
         continue;
       }
-      if (ignoreResult?.ig) {
-        const pathToCheck = entry.isDirectory() ? `${relativePath}/` : relativePath;
-        if (ignoreResult.ig.ignores(pathToCheck)) {
-          continue;
-        }
-      }
       if (entry.isDirectory()) {
-        const subFiles = await getFilesWithSizes(
-          fullPath,
-          baseDir,
-          ignoreResult
-        );
+        const subFiles = await getFilesWithSizes(fullPath, baseDir);
         results.push(...subFiles);
       } else {
-        const fileStat = await stat(fullPath);
+        const fileStat = await stat7(fullPath);
         results.push({ path: relativePath, size: fileStat.size });
       }
     }
@@ -3525,7 +3894,7 @@ async function publishCommand(options) {
       files: manifest.files
     };
     if (options.bump) {
-      const semver2 = await import('semver');
+      const semver2 = await import("semver");
       const newVersion = semver2.default.inc(packageJson2.version, options.bump);
       if (!newVersion) {
         console.error(
@@ -3536,16 +3905,9 @@ async function publishCommand(options) {
       packageJson2.version = newVersion;
       console.log(`Bumped version to ${newVersion}`);
     }
-    const ignoreResult = await loadIgnorePatterns();
-    if (ignoreResult.source) {
-      console.log(
-        `pspm notice Using ${ignoreResult.source} for ignore patterns`
-      );
-    }
-    const excludeArgs = getExcludeArgsForRsync(ignoreResult.patterns);
     const safeName = packageJson2.name.replace(/[@/]/g, "-").replace(/^-+/, "");
     const tarballName = `${safeName}-${packageJson2.version}.tgz`;
-    const tempDir = join(process.cwd(), ".pspm-publish");
+    const tempDir = join11(process.cwd(), ".pspm-publish");
     try {
       await exec(`rm -rf "${tempDir}" && mkdir -p "${tempDir}"`);
       const files = packageJson2.files || [...DEFAULT_SKILL_FILES];
@@ -3553,7 +3915,7 @@ async function publishCommand(options) {
       for (const file of files) {
         try {
           await exec(
-            `rsync -a ${excludeArgs} "${file}" "${tempDir}/package/" 2>/dev/null || true`
+            `rsync -a --exclude='node_modules' --exclude='.git' "${file}" "${tempDir}/package/" 2>/dev/null || true`
           );
         } catch {
         }
@@ -3561,7 +3923,7 @@ async function publishCommand(options) {
       if (detection.type === "pspm.json") {
         await exec(`cp pspm.json "${tempDir}/package/"`);
         try {
-          await stat(join(process.cwd(), "package.json"));
+          await stat7(join11(process.cwd(), "package.json"));
           await exec(
             `cp package.json "${tempDir}/package/" 2>/dev/null || true`
           );
@@ -3570,22 +3932,18 @@ async function publishCommand(options) {
       } else {
         await exec(`cp package.json "${tempDir}/package/"`);
       }
-      const packageDir = join(tempDir, "package");
-      const tarballContents = await getFilesWithSizes(
-        packageDir,
-        packageDir,
-        ignoreResult
-      );
+      const packageDir = join11(tempDir, "package");
+      const tarballContents = await getFilesWithSizes(packageDir, packageDir);
       const unpackedSize = tarballContents.reduce((acc, f) => acc + f.size, 0);
-      const tarballPath = join(tempDir, tarballName);
+      const tarballPath = join11(tempDir, tarballName);
       await exec(
-        `tar -czf "${tarballPath}" -C "${tempDir}" ${excludeArgs} package`
+        `tar -czf "${tarballPath}" -C "${tempDir}" --exclude='node_modules' --exclude='.git' package`
       );
-      const tarballBuffer = await readFile(tarballPath);
+      const tarballBuffer = await readFile6(tarballPath);
       const tarballBase64 = tarballBuffer.toString("base64");
       const tarballSize = tarballBuffer.length;
-      const shasum = createHash("sha1").update(tarballBuffer).digest("hex");
-      const integrityHash = createHash("sha512").update(tarballBuffer).digest("base64");
+      const shasum = createHash3("sha1").update(tarballBuffer).digest("hex");
+      const integrityHash = createHash3("sha512").update(tarballBuffer).digest("base64");
       const integrity = `sha512-${integrityHash}`;
       console.log("");
       console.log("pspm notice");
@@ -3670,12 +4028,16 @@ init_lib();
 init_lockfile();
 init_manifest2();
 init_symlinks();
+import { rm as rm6 } from "fs/promises";
+import { join as join12 } from "path";
 async function remove(nameOrSpecifier) {
   try {
     const manifest = await readManifest();
     const agentConfigs = manifest?.agents;
     const agents = getAvailableAgents(agentConfigs);
-    if (isGitHubSpecifier(nameOrSpecifier)) {
+    if (isLocalSpecifier(nameOrSpecifier)) {
+      await removeLocal(nameOrSpecifier, agents, agentConfigs);
+    } else if (isGitHubSpecifier(nameOrSpecifier)) {
       await removeGitHub(nameOrSpecifier, agents, agentConfigs);
     } else if (nameOrSpecifier.startsWith("@user/")) {
       await removeRegistry(nameOrSpecifier, agents, agentConfigs);
@@ -3710,9 +4072,9 @@ async function removeRegistry(specifier, agents, agentConfigs) {
     agentConfigs
   });
   const skillsDir = getSkillsDir();
-  const destDir = join(skillsDir, username, name);
+  const destDir = join12(skillsDir, username, name);
   try {
-    await rm(destDir, { recursive: true, force: true });
+    await rm6(destDir, { recursive: true, force: true });
   } catch {
   }
   console.log(`Removed ${fullName}`);
@@ -3739,13 +4101,42 @@ async function removeGitHub(specifier, agents, agentConfigs) {
   });
   const skillsDir = getSkillsDir();
   const destPath = getGitHubSkillPath(parsed.owner, parsed.repo, parsed.path);
-  const destDir = join(skillsDir, "..", destPath);
+  const destDir = join12(skillsDir, "..", destPath);
   try {
-    await rm(destDir, { recursive: true, force: true });
+    await rm6(destDir, { recursive: true, force: true });
   } catch {
   }
   console.log(`Removed ${lockfileKey}`);
 }
+async function removeLocal(specifier, agents, agentConfigs) {
+  const parsed = parseLocalSpecifier(specifier);
+  if (!parsed) {
+    console.error(`Error: Invalid local specifier: ${specifier}`);
+    process.exit(1);
+  }
+  console.log(`Removing ${specifier}...`);
+  const removedFromLockfile = await removeLocalFromLockfile(specifier);
+  const removedFromManifest = await removeLocalDependency(specifier);
+  if (!removedFromLockfile && !removedFromManifest) {
+    console.error(`Error: ${specifier} not found in lockfile or pspm.json`);
+    process.exit(1);
+  }
+  const localSkills = await listLockfileLocalPackages();
+  const foundLocal = localSkills.find((s) => s.specifier === specifier);
+  const skillName = foundLocal?.entry.name || parsed.path.split("/").filter(Boolean).pop() || "unknown";
+  await removeAgentSymlinks(skillName, {
+    agents,
+    projectRoot: process.cwd(),
+    agentConfigs
+  });
+  const skillsDir = getSkillsDir();
+  const symlinkPath = join12(skillsDir, "_local", skillName);
+  try {
+    await rm6(symlinkPath, { force: true });
+  } catch {
+  }
+  console.log(`Removed ${specifier}`);
+}
 async function removeByShortName(shortName, agents, agentConfigs) {
   const registrySkills = await listLockfileSkills();
   const foundRegistry = registrySkills.find((s) => {
@@ -3766,6 +4157,12 @@ async function removeByShortName(shortName, agents, agentConfigs) {
     await removeGitHub(foundGitHub.specifier, agents, agentConfigs);
     return;
   }
+  const localSkills = await listLockfileLocalPackages();
+  const foundLocal = localSkills.find((s) => s.entry.name === shortName);
+  if (foundLocal) {
+    await removeLocal(foundLocal.specifier, agents, agentConfigs);
+    return;
+  }
   console.error(`Error: Skill "${shortName}" not found in lockfile`);
   process.exit(1);
 }
@@ -3938,9 +4335,9 @@ async function whoami() {
 }
 
 // src/index.ts
-var __dirname$1 = dirname(fileURLToPath(import.meta.url));
+var __dirname = dirname6(fileURLToPath(import.meta.url));
 var packageJson = JSON.parse(
-  readFileSync(join(__dirname$1, "..", "package.json"), "utf-8")
+  readFileSync(join13(__dirname, "..", "package.json"), "utf-8")
 );
 var version = packageJson.version;
 var program = new Command();
@@ -4033,7 +4430,7 @@ program.command("unpublish <specifier>").description(
   await unpublish(specifier, { force: options.force });
 });
 program.command("access [specifier]").description("Change package visibility (public/private)").option("--public", "Make the package public (irreversible)").option("--private", "Make the package private (only for private packages)").action(async (specifier, options) => {
-  await access(specifier, {
+  await access2(specifier, {
     public: options.public,
     private: options.private
   });
@@ -4044,5 +4441,4 @@ program.command("deprecate <specifier> [message]").description(
   await deprecate(specifier, message, { undo: options.undo });
 });
 program.parse();
-//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map