@braid-cloud/cli 0.1.16 → 0.1.17

package/dist/index.js

@@ -20,7 +20,7 @@ var init_esm_shims = __esm({
 
 // src/lib/braid-workspace.ts
 import { existsSync, readFileSync } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join2 } from "path";
 import process3 from "process";
 function readPackageName(packagePath) {
   if (!existsSync(packagePath)) {
@@ -44,7 +44,7 @@ function findBraidWorkspaceRoot(startDir = process3.cwd()) {
     if (isBraidWorkspaceRoot(currentDir)) {
       return currentDir;
     }
-    const parentDir = dirname2(currentDir);
+    const parentDir = dirname3(currentDir);
     if (parentDir === currentDir) {
       return void 0;
     }
@@ -107,7 +107,7 @@ __export(config_exports, {
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3, parse } from "path";
+import { dirname as dirname4, join as join3, parse } from "path";
 import process4 from "process";
 import { Data as Data2, Effect as Effect3, pipe as pipe3 } from "effect";
 var CONFIG_DIR, CONFIG_FILE, PROJECT_CONFIG_FILENAME, USER_CONFIG_FILENAME, CONVEX_CLOUD_SUFFIX_REGEX, LOCAL_CONVEX_PORT_REGEX, LOCAL_SERVER_ENV_FILES, LOOPBACK_HOSTS, NEWLINE_REGEX, TRAILING_SLASHES, ConfigReadError, ConfigWriteError, findConfigFile, findProjectConfigFile, findUserConfigFile, stripQuotes, parseDotenv, normalizeBaseUrl, resolveConvexSiteUrl, resolveLocalServerUrlFromEnv, resolveLocalServerUrlFromFiles, resolveLocalServerUrl, loadProjectConfig, loadUserConfig, resolveUserConfigWritePath, resolveProjectConfigWritePath, saveUserConfig, saveProjectConfig, isValidServerUrl, resolveServerUrlFromConfig, applyConfigSource, applyEnvOverrides, createDefaultMergedConfig, loadMergedConfig, loadConfig, saveConfig, getApiKey, setApiKey, getServerUrl, clearApiKey, getDemoContext, setDemoContext, clearDemoContext, loadConfigAsync, loadProjectConfigAsync, loadUserConfigAsync, loadMergedConfigAsync, findProjectConfigFileAsync, findUserConfigFileAsync, saveConfigAsync, saveUserConfigAsync, saveProjectConfigAsync, getApiKeyAsync, setApiKeyAsync, persistApiKeyAsync, getServerUrlAsync, clearApiKeyAsync, getDemoContextAsync, setDemoContextAsync, clearDemoContextAsync;
@@ -256,7 +256,7 @@ var init_config = __esm({
       return pipe3(
         Effect3.tryPromise({
           try: async () => {
-            await mkdir2(dirname3(targetPath), { recursive: true, mode: 448 });
+            await mkdir2(dirname4(targetPath), { recursive: true, mode: 448 });
             await writeFile2(targetPath, JSON.stringify(config, null, 2), {
               encoding: "utf-8",
               mode: 384
@@ -272,7 +272,7 @@ var init_config = __esm({
       return pipe3(
         Effect3.tryPromise({
           try: async () => {
-            await mkdir2(dirname3(targetPath), { recursive: true, mode: 448 });
+            await mkdir2(dirname4(targetPath), { recursive: true, mode: 448 });
             await writeFile2(targetPath, JSON.stringify(config, null, 2), {
               encoding: "utf-8",
               mode: 384
@@ -392,7 +392,7 @@ var init_config = __esm({
     saveConfig = (config) => pipe3(
       Effect3.tryPromise({
         try: async () => {
-          await mkdir2(dirname3(CONFIG_FILE), { recursive: true, mode: 448 });
+          await mkdir2(dirname4(CONFIG_FILE), { recursive: true, mode: 448 });
           await writeFile2(CONFIG_FILE, JSON.stringify(config, null, 2), {
             encoding: "utf-8",
             mode: 384
@@ -1941,7 +1941,7 @@ var writeAgentsForPlatformAsync = (platform2, specs, installPath) => Effect.runP
 init_esm_shims();
 import { access, constants } from "fs/promises";
 import { homedir } from "os";
-import { join } from "path";
+import { dirname as dirname2, join } from "path";
 import process2 from "process";
 import { Effect as Effect2, pipe as pipe2 } from "effect";
 var home = homedir();
@@ -2585,7 +2585,7 @@ var DeviceAuthExpiredError = class extends Error {
     this.name = "DeviceAuthExpiredError";
   }
 };
-var sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
+var sleep = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
 var normalizeBaseUrl2 = (rawUrl) => {
   const trimmed = rawUrl.replace(TRAILING_SLASHES2, "");
   try {
@@ -3288,7 +3288,7 @@ import {
   writeFile as writeFile3
 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { basename, dirname as dirname4, join as join5, resolve as resolve2 } from "path";
+import { basename, dirname as dirname5, join as join5, resolve as resolve2 } from "path";
 var BRAID_CONFIG_DIR = join5(homedir3(), ".config", "braid");
 var DEFAULT_STORE_ROOT = join5(BRAID_CONFIG_DIR, "store", "skills");
 var DEFAULT_DISABLED_ROOT = join5(BRAID_CONFIG_DIR, ".disabled");
@@ -3397,7 +3397,7 @@ var enableBundleAsync = async (originalPath, options = {}) => {
   if (!record) {
     throw new Error(`No disabled bundle found for ${originalPath}`);
   }
-  await mkdir3(dirname4(record.originalPath), { recursive: true });
+  await mkdir3(dirname5(record.originalPath), { recursive: true });
   await rm(record.originalPath, { recursive: true, force: true });
   await rename(record.payloadPath, record.originalPath);
   await rm(record.disabledPath, { recursive: true, force: true });
@@ -3414,9 +3414,9 @@ init_lockfile();
 // src/lib/metadata.ts
 init_esm_shims();
 import { readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
-import { join as join7 } from "path";
+import { dirname as dirname6, join as join7 } from "path";
 import { Data as Data5, Effect as Effect6, pipe as pipe6 } from "effect";
-var METADATA_FILENAME2 = ".braidskills-metadata.json";
+var METADATA_FILENAME2 = ".braid-metadata.json";
 var MetadataReadError = class extends Data5.TaggedError("MetadataReadError") {
 };
 var MetadataWriteError = class extends Data5.TaggedError("MetadataWriteError") {
@@ -3432,7 +3432,7 @@ var normalizeInstalledSkill = (skill) => ({
 var normalizeMetadata = (metadata) => ({
   skills: Array.isArray(metadata?.skills) ? metadata.skills.map(normalizeInstalledSkill) : []
 });
-var getMetadataPath = (skillsDir) => join7(skillsDir, METADATA_FILENAME2);
+var getMetadataPath = (skillsDir) => join7(dirname6(skillsDir), METADATA_FILENAME2);
 var readMetadata = (skillsDir) => {
   const metadataPath = getMetadataPath(skillsDir);
   return pipe6(
@@ -3449,10 +3449,26 @@ var readMetadata = (skillsDir) => {
     Effect6.orElseSucceed(() => normalizeMetadata(void 0))
   );
 };
+var readRawJson = async (path2) => {
+  try {
+    const content = await readFile4(path2, "utf-8");
+    const parsed = JSON.parse(content);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch (_) {
+    return {};
+  }
+  return {};
+};
 var writeMetadata = (skillsDir, metadata) => {
   const metadataPath = getMetadataPath(skillsDir);
   return Effect6.tryPromise({
-    try: () => writeFile5(metadataPath, JSON.stringify(metadata, null, 2), "utf-8"),
+    try: async () => {
+      const existing = await readRawJson(metadataPath);
+      const merged = { ...existing, skills: metadata.skills };
+      await writeFile5(metadataPath, JSON.stringify(merged, null, 2), "utf-8");
+    },
     catch: (e) => new MetadataWriteError({ path: metadataPath, cause: e })
   });
 };
@@ -3497,7 +3513,7 @@ var removeFromMetadataAsync = (skillsDir, skillName) => Effect6.runPromise(remov
 // src/lib/rule-writer.ts
 init_esm_shims();
 import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname5, resolve as resolve3, sep as sep2 } from "path";
+import { dirname as dirname7, resolve as resolve3, sep as sep2 } from "path";
 import { Data as Data6, Effect as Effect7, pipe as pipe7 } from "effect";
 var RuleWriteError = class extends Data6.TaggedError("RuleWriteError") {
 };
@@ -3595,7 +3611,7 @@ ${rule.content}`)
   Effect7.asVoid
 );
 var writeAppendSingleRules = (filePath, rules2) => pipe7(
-  createDirectory(dirname5(filePath)),
+  createDirectory(dirname7(filePath)),
   Effect7.flatMap(
     () => pipe7(
       readTextFile(filePath),
@@ -3658,7 +3674,7 @@ var writeRulesForAgentAsync = (agent, rules2, rulesPath) => Effect7.runPromise(w
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
 import { chmod, mkdir as mkdir5, rm as rm2, symlink, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname6, join as join8, resolve as resolve4, sep as sep3 } from "path";
+import { dirname as dirname8, join as join8, resolve as resolve4, sep as sep3 } from "path";
 import { Data as Data7, Effect as Effect8, pipe as pipe8 } from "effect";
 var WriteError = class extends Data7.TaggedError("WriteError") {
 };
@@ -3739,7 +3755,7 @@ var setExecutableIfScript = (fullPath, file, agentId) => isScriptFile(file.path)
 var writeSkillFile = (basePath, file, agentId) => pipe8(
   assertWithinBase2(basePath, file.path),
   Effect8.flatMap((fullPath) => {
-    const dir = dirname6(fullPath);
+    const dir = dirname8(fullPath);
     return pipe8(
       createDirectory2(dir, fullPath),
       Effect8.flatMap(() => writeFileContent(fullPath, file, agentId)),
@@ -3786,7 +3802,7 @@ var writeSkillSymlink = (basePath, skill, agentId, options) => pipe8(
             disabledRoot: options.disabledRoot
           }
         );
-        await mkdir5(dirname6(destinationPath), { recursive: true });
+        await mkdir5(dirname8(destinationPath), { recursive: true });
         await rm2(destinationPath, { recursive: true, force: true });
         await symlink(
           storedBundlePath,
@@ -4531,17 +4547,17 @@ init_config();
 
 // src/lib/manage-actions.ts
 init_esm_shims();
-import { rm as rm4 } from "fs/promises";
-import { basename as basename2, dirname as dirname8, join as join10, relative } from "path";
+import { rm as rm5 } from "fs/promises";
+import { basename as basename2, dirname as dirname10, join as join11, relative } from "path";
 
 // src/lib/hook-writer.ts
 init_esm_shims();
 import { mkdir as mkdir6, readFile as readFile6, rm as rm3, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname7, join as join9 } from "path";
+import { dirname as dirname9, join as join9 } from "path";
 import { Data as Data8, Effect as Effect9 } from "effect";
 var HookConfigWriteError = class extends Data8.TaggedError("HookConfigWriteError") {
 };
-var HOOK_METADATA_FILENAME = ".braid-hooks-metadata.json";
+var HOOK_METADATA_FILENAME = ".braid-metadata.json";
 function stableStringify(value) {
   return JSON.stringify(value, (_key, currentValue) => {
     if (currentValue && typeof currentValue === "object" && !Array.isArray(currentValue)) {
@@ -4582,7 +4598,7 @@ async function readJsonFile(path2) {
   }
 }
 async function writeJsonFile(path2, value) {
-  await mkdir6(dirname7(path2), { recursive: true, mode: 448 });
+  await mkdir6(dirname9(path2), { recursive: true, mode: 448 });
   await writeFile8(path2, `${JSON.stringify(value, null, 2)}
 `, {
     encoding: "utf-8",
@@ -4681,7 +4697,7 @@ function addHookHandlers(config, hook) {
   return writeMatcherGroups(config, hook.event, groups);
 }
 function getHookMetadataPath(settingsPath) {
-  return join9(dirname7(settingsPath), HOOK_METADATA_FILENAME);
+  return join9(dirname9(settingsPath), HOOK_METADATA_FILENAME);
 }
 async function readHookMetadata(settingsPath) {
   const metadataPath = getHookMetadataPath(settingsPath);
@@ -4690,9 +4706,9 @@ async function readHookMetadata(settingsPath) {
   return { hooks };
 }
 async function writeHookMetadata(settingsPath, metadata) {
-  await writeJsonFile(getHookMetadataPath(settingsPath), {
-    hooks: metadata.hooks
-  });
+  const metadataPath = getHookMetadataPath(settingsPath);
+  const existing = await readJsonFile(metadataPath);
+  await writeJsonFile(metadataPath, { ...existing, hooks: metadata.hooks });
 }
 function buildMarketplaceHookSource(sourceSlug) {
   return {
@@ -4790,7 +4806,7 @@ async function listInstalledMarketplaceHookSources(settingsPath) {
   );
 }
 function buildMarketplaceHookBundlePath(settingsPath, sourceSlug) {
-  return join9(dirname7(settingsPath), ".braid-hooks", `${sourceSlug}.json`);
+  return join9(dirname9(settingsPath), ".braid-hooks", `${sourceSlug}.json`);
 }
 function buildMarketplaceHookBundle(hooks, options) {
   return {
@@ -5042,6 +5058,8 @@ var fetchMarketplaceInstallManifestAsync = (slug, options) => Effect10.runPromis
 
 // src/lib/marketplace-installer.ts
 init_esm_shims();
+import { rm as rm4 } from "fs/promises";
+import { join as join10 } from "path";
 function parseAgentIds(value) {
   if (!value) {
     return [];
@@ -5184,6 +5202,58 @@ async function installHooksForAgent(args) {
   args.targets.push(`${args.agent.name} hooks -> ${hookConfigPath}`);
   return true;
 }
+async function pruneStaleMarketplaceSkills(installPath, slug, currentSkillNames) {
+  const metadata = await readMetadataAsync(installPath);
+  const stale = metadata.skills.filter(
+    (skill) => skill.source.type === "marketplace" && skill.source.slug === slug && !currentSkillNames.has(skill.name)
+  );
+  for (const skill of stale) {
+    const skillPath = join10(installPath, skill.name);
+    await rm4(skillPath, { recursive: true, force: true });
+    await removeFromMetadataAsync(installPath, skill.name);
+  }
+}
+async function installAllForAgent(args) {
+  await installSkillsForAgent({
+    agent: args.agent,
+    manifest: args.manifest,
+    slug: args.slug,
+    skills: args.skills,
+    global: args.global,
+    installedSkills: args.installedSkills,
+    targets: args.targets
+  });
+  await installRulesForAgent({
+    agent: args.agent,
+    rules: args.rules,
+    global: args.global,
+    targets: args.targets
+  });
+  await installAgentsForAgent({
+    agent: args.agent,
+    agents: args.agents,
+    global: args.global,
+    targets: args.targets
+  });
+  if (args.installHooks) {
+    await installHooksForAgent({
+      agent: args.agent,
+      hooks: args.hooks,
+      slug: args.slug,
+      manifest: args.manifest,
+      global: args.global,
+      targets: args.targets
+    });
+  }
+  const installPath = resolveInstallPath(args.agent, { global: args.global });
+  if (installPath) {
+    await pruneStaleMarketplaceSkills(
+      installPath,
+      args.slug,
+      args.installedSkills
+    );
+  }
+}
 async function installMarketplaceSkillSet(options) {
   if (options.manifest.blocked) {
     throw new Error(
@@ -5195,12 +5265,8 @@ async function installMarketplaceSkillSet(options) {
   const hooks = options.manifest.manifest?.hooks ?? [];
   const agents2 = options.manifest.manifest?.agents ?? [];
   const workflows = options.manifest.manifest?.workflows ?? [];
-  if (hooks.length > 0 && !options.allowHooks) {
-    throw new Error(
-      "Marketplace packs with hooks require explicit opt-in. Re-run with --allow-hooks after reviewing the hook commands."
-    );
-  }
-  if (resolvedSkills.length === 0 && rules2.length === 0 && hooks.length === 0 && agents2.length === 0 && workflows.length === 0) {
+  const installHooks = hooks.length > 0 && options.allowHooks === true;
+  if (resolvedSkills.length === 0 && rules2.length === 0 && (!installHooks || hooks.length === 0) && agents2.length === 0 && workflows.length === 0) {
     throw new Error("No installable content found in manifest");
   }
   const targetAgents = await resolveTargetAgents(options.agents);
@@ -5212,33 +5278,17 @@ async function installMarketplaceSkillSet(options) {
   const targets = [];
   const installedSkills = /* @__PURE__ */ new Set();
   for (const agent of targetAgents) {
-    await installSkillsForAgent({
+    await installAllForAgent({
       agent,
       manifest: options.manifest,
       slug: options.slug,
       skills: resolvedSkills,
-      global: options.global,
-      installedSkills,
-      targets
-    });
-    await installRulesForAgent({
-      agent,
       rules: rules2,
-      global: options.global,
-      targets
-    });
-    await installAgentsForAgent({
-      agent,
       agents: agents2,
-      global: options.global,
-      targets
-    });
-    await installHooksForAgent({
-      agent,
       hooks,
-      slug: options.slug,
-      manifest: options.manifest,
+      installHooks,
       global: options.global,
+      installedSkills,
       targets
     });
   }
@@ -5257,12 +5307,12 @@ function isMarketplaceHookBundlePath(originalPath) {
   return getHookBundleRoot(originalPath) !== null;
 }
 function getHookBundleRoot(originalPath) {
-  let currentPath = dirname8(originalPath);
+  let currentPath = dirname10(originalPath);
   while (true) {
     if (basename2(currentPath) === ".braid-hooks") {
-      return dirname8(currentPath);
+      return dirname10(currentPath);
     }
-    const parentPath = dirname8(currentPath);
+    const parentPath = dirname10(currentPath);
     if (parentPath === currentPath) {
       return null;
     }
@@ -5274,7 +5324,7 @@ function getHookBundleRelativePath(originalPath) {
   if (!bundleRoot) {
     throw new Error(`Invalid marketplace hook bundle path: ${originalPath}`);
   }
-  return relative(join10(bundleRoot, ".braid-hooks"), originalPath);
+  return relative(join11(bundleRoot, ".braid-hooks"), originalPath);
 }
 function getHookSourceSlug(originalPath) {
   const relativePath = getHookBundleRelativePath(originalPath);
@@ -5293,7 +5343,7 @@ function getHookSettingsPath(originalPath) {
   if (!bundleRoot) {
     throw new Error(`Invalid marketplace hook bundle path: ${originalPath}`);
   }
-  return join10(bundleRoot, "settings.json");
+  return join11(bundleRoot, "settings.json");
 }
 async function disableManagedBundleAsync(options) {
   if (options.surface === "hooks") {
@@ -5350,7 +5400,7 @@ async function removeManagedBundleAsync(options) {
       }
     );
     await removeMarketplaceHooksBySourceAsync(
-      join10(options.installRoot, "settings.json"),
+      join11(options.installRoot, "settings.json"),
       options.bundleName
     );
     if (disabledRecord2) {
@@ -5364,7 +5414,7 @@ async function removeManagedBundleAsync(options) {
       disabledRoot: options.disabledRoot
     }
   );
-  await rm4(options.originalPath, { recursive: true, force: true });
+  await rm5(options.originalPath, { recursive: true, force: true });
   if (disabledRecord) {
     await removePathAsync(disabledRecord.disabledPath);
   }
@@ -5388,7 +5438,7 @@ async function installLibraryPackAsync(options) {
 // src/lib/manage-inventory.ts
 init_esm_shims();
 import { access as access2, constants as constants2, lstat, readdir as readdir2 } from "fs/promises";
-import { basename as basename3, delimiter, dirname as dirname9, join as join11, resolve as resolve5 } from "path";
+import { basename as basename3, delimiter, dirname as dirname11, join as join12, resolve as resolve5 } from "path";
 var MANAGE_PROVIDER_COMMANDS = {
   amp: ["amp"],
   "claude-code": ["claude"],
@@ -5436,7 +5486,7 @@ function getCommandExtensions() {
 function getCommandCandidates(command, pathValue) {
   return pathValue.split(delimiter).flatMap(
     (segment) => segment ? getCommandExtensions().map(
-      (extension) => join11(segment, `${command}${extension}`)
+      (extension) => join12(segment, `${command}${extension}`)
     ) : []
   );
 }
@@ -5552,9 +5602,9 @@ async function listSurfaceEntries(rootPath, surface) {
     }
     return entry.isDirectory() || entry.isFile() || entry.isSymbolicLink();
   }).map((entry) => ({
-    currentPath: join11(rootPath, entry.name),
+    currentPath: join12(rootPath, entry.name),
     name: entry.name,
-    originalPath: join11(rootPath, entry.name)
+    originalPath: join12(rootPath, entry.name)
   }));
 }
 function toBundleKey(path2) {
@@ -5603,7 +5653,7 @@ async function collectSkillBundles(args) {
     });
   }
   for (const metadataEntry of metadata.skills) {
-    const originalPath = join11(args.rootPath, metadataEntry.name);
+    const originalPath = join12(args.rootPath, metadataEntry.name);
     const bundleKey = toBundleKey(originalPath);
     if (bundles.has(bundleKey)) {
       continue;
@@ -5684,7 +5734,7 @@ async function collectHookBundles(args) {
     return [];
   }
   const settingsPath = args.settingsPath;
-  const installRoot = dirname9(settingsPath);
+  const installRoot = dirname11(settingsPath);
   const sources = await listInstalledMarketplaceHookSourcesAsync(settingsPath);
   const disabledRecords = getDisabledRecordsForSurface({
     agent: args.agent,
@@ -5788,7 +5838,7 @@ async function collectScopeInventory(args) {
       },
       hooks: {
         bundles: hooks,
-        rootPath: hookSettingsPath ? dirname9(hookSettingsPath) : null,
+        rootPath: hookSettingsPath ? dirname11(hookSettingsPath) : null,
         surface: "hooks"
       },
       rules: {
@@ -6389,39 +6439,288 @@ async function manageCommand(options) {
 
 // src/commands/marketplace.ts
 init_esm_shims();
+import { rm as rm6 } from "fs/promises";
+import { join as join13, resolve as resolve7 } from "path";
+import process11 from "process";
 init_tui();
-async function marketplaceLibraryCommand(options) {
-  const items = await fetchMarketplaceLibraryAsync({
-    server: options.server,
-    apiKey: options.apiKey
+async function selectInstallScope(options) {
+  if (options.global != null) {
+    return options.global;
+  }
+  if (options.yes) {
+    return false;
+  }
+  const result = await select({
+    message: "Install location:",
+    options: [
+      { value: false, label: "Project", hint: "local to this directory" },
+      { value: true, label: "Global", hint: "available everywhere" }
+    ],
+    initialValue: false
   });
-  if (items.length === 0) {
-    log.info("No marketplace packs in your library yet.");
-    return;
+  if (isCancel(result)) {
+    cancel("Install cancelled.");
+    process11.exit(0);
   }
-  for (const item of items) {
-    const scan = item.scanVerdict ?? "clean";
-    const commit = item.commitSha ?? "unknown";
-    log.info(
-      `${item.slug} | ${item.title} | scan=${scan} | commit=${commit} | install=braid marketplace install ${item.slug}`
+  return result;
+}
+async function selectInstallAgents(options, global) {
+  const detected = await detectAgentsAsync();
+  const available = detected.map((d) => getAgentById(d.id)).filter((a) => a != null);
+  if (available.length === 0) {
+    throw new Error(
+      "No compatible agents found. Use --agents to specify targets."
     );
   }
+  if (options.agents) {
+    const ids = options.agents.split(",").map((s) => s.trim());
+    const matched = ids.map((id) => getAgentById(id)).filter((a) => a != null);
+    if (matched.length === 0) {
+      throw new Error(`No agents matched: ${options.agents}`);
+    }
+    return matched;
+  }
+  if (options.yes || available.length === 1) {
+    return available.length === 1 ? available : available;
+  }
+  const selected = await multiselect({
+    message: "Select agents to install to:",
+    options: available.map((agent) => ({
+      value: agent,
+      label: agent.name,
+      hint: global ? agent.globalPath : agent.projectPath
+    })),
+    initialValues: [],
+    required: true
+  });
+  if (isCancel(selected)) {
+    cancel("Install cancelled.");
+    process11.exit(0);
+  }
+  return selected;
 }
-async function marketplaceInstallCommand(slug, options) {
+async function confirmHooksOptIn(hookCount, options) {
+  if (options.allowHooks) {
+    return true;
+  }
+  if (options.yes) {
+    return false;
+  }
+  const result = await confirm({
+    message: `This pack includes ${hookCount} hook${hookCount === 1 ? "" : "s"} that run shell commands. Allow hooks?`,
+    initialValue: false
+  });
+  if (isCancel(result)) {
+    cancel("Install cancelled.");
+    process11.exit(0);
+  }
+  return result;
+}
+async function marketplaceLibraryCommand(options) {
+  try {
+    const items = await fetchMarketplaceLibraryAsync({
+      server: options.server,
+      apiKey: options.apiKey
+    });
+    if (items.length === 0) {
+      log.info("No marketplace packs in your library yet.");
+      return;
+    }
+    for (const item of items) {
+      const scan = item.scanVerdict ?? "clean";
+      const commit = item.commitSha ?? "unknown";
+      log.info(
+        `${item.slug} | ${item.title} | scan=${scan} | commit=${commit} | install=braid marketplace install ${item.slug}`
+      );
+    }
+  } catch (error) {
+    log.error(
+      error instanceof Error ? error.message : "Failed to fetch library"
+    );
+    process11.exit(1);
+  }
+}
+async function resolveAndInstallPack(slug, options, overrides) {
   const manifest = await fetchMarketplaceInstallManifestAsync(slug, {
     server: options.server,
     apiKey: options.apiKey
   });
-  const installResult = await installMarketplaceSkillSet({
+  const global = overrides?.global ?? await selectInstallScope(options);
+  const hooks = manifest.manifest?.hooks ?? [];
+  if (hooks.length > 0) {
+    const allowed = await confirmHooksOptIn(hooks.length, options);
+    if (!allowed) {
+      log.warn("Hooks skipped. Re-run with --allow-hooks to include them.");
+    }
+    options.allowHooks = allowed;
+  }
+  const agents2 = overrides?.agents ?? (await selectInstallAgents(options, global)).map((a) => a.id).join(",");
+  await installMarketplaceSkillSet({
     slug,
     manifest,
-    agents: options.agents,
-    global: options.global,
+    agents: agents2,
+    global,
     allowHooks: options.allowHooks
   });
-  log.success(`Installed marketplace pack ${slug}`);
-  for (const target of installResult.targets) {
-    log.info(`  ${target}`);
+}
+async function marketplaceInstallCommand(slug, options) {
+  try {
+    await resolveAndInstallPack(slug, options);
+    log.success(`Installed marketplace pack ${slug}`);
+  } catch (error) {
+    log.error(
+      error instanceof Error ? error.message : "Failed to install pack"
+    );
+    process11.exit(1);
+  }
+}
+function addSkillToPack(packMap, slug, versionId, skillName, agent, installPath) {
+  let pack = packMap.get(slug);
+  if (!pack) {
+    pack = { slug, versionId, skills: [], agents: [] };
+    packMap.set(slug, pack);
+  }
+  if (!pack.skills.includes(skillName)) {
+    pack.skills.push(skillName);
+  }
+  if (!pack.agents.some((a) => a.agent.id === agent.id)) {
+    pack.agents.push({ agent, installPath });
+  }
+}
+async function findInstalledMarketplacePacks(options) {
+  const detected = await detectAgentsAsync();
+  const agents2 = detected.map((d) => getAgentById(d.id)).filter((a) => a != null);
+  const packMap = /* @__PURE__ */ new Map();
+  for (const agent of agents2) {
+    const installPath = resolveInstallPath(agent, {
+      global: options.global ?? false
+    });
+    if (!installPath) {
+      continue;
+    }
+    const metadata = await readMetadataAsync(installPath);
+    for (const skill of metadata.skills) {
+      if (skill.source.type !== "marketplace") {
+        continue;
+      }
+      addSkillToPack(
+        packMap,
+        skill.source.slug,
+        skill.source.versionId ?? skill.version,
+        skill.name,
+        agent,
+        installPath
+      );
+    }
+  }
+  return [...packMap.values()];
+}
+async function marketplaceUpdateCommand(slug, options) {
+  try {
+    const installed = await findInstalledMarketplacePacks(options);
+    if (installed.length === 0) {
+      log.info("No marketplace packs installed.");
+      return;
+    }
+    const toUpdate = slug ? installed.filter((p) => p.slug === slug) : installed;
+    if (toUpdate.length === 0) {
+      log.error(`Pack "${slug}" is not installed.`);
+      process11.exit(1);
+    }
+    let updated = 0;
+    for (const pack of toUpdate) {
+      const agentIds = pack.agents.map((a) => a.agent.id).join(",");
+      const isGlobal = options.global ?? false;
+      await resolveAndInstallPack(pack.slug, options, {
+        agents: agentIds,
+        global: isGlobal
+      });
+      log.success(`Updated ${pack.slug}`);
+      updated++;
+    }
+    if (updated === 0) {
+      log.info("All packs are up to date.");
+    }
+  } catch (error) {
+    log.error(
+      error instanceof Error ? error.message : "Failed to update packs"
+    );
+    process11.exit(1);
+  }
+}
+async function selectPacksToRemove(installed, slug, options) {
+  if (slug) {
+    const matched = installed.filter((p) => p.slug === slug);
+    if (matched.length === 0) {
+      throw new Error(`Pack "${slug}" is not installed.`);
+    }
+    return matched;
+  }
+  if (options.yes) {
+    return installed;
+  }
+  const selected = await multiselect({
+    message: "Select packs to remove:",
+    options: installed.map((p) => ({
+      value: p,
+      label: p.slug,
+      hint: `${p.skills.length} skill${p.skills.length === 1 ? "" : "s"}`
+    })),
+    initialValues: [],
+    required: true
+  });
+  if (isCancel(selected)) {
+    cancel("Remove cancelled.");
+    process11.exit(0);
+  }
+  return selected;
+}
+async function removePackFiles(pack, options) {
+  for (const { agent, installPath } of pack.agents) {
+    for (const skillName of pack.skills) {
+      const skillPath = resolve7(join13(installPath, skillName));
+      if (!skillPath.startsWith(`${resolve7(installPath)}/`)) {
+        continue;
+      }
+      await rm6(skillPath, { recursive: true, force: true });
+      await removeFromMetadataAsync(installPath, skillName);
+    }
+    const hookConfigPath = resolveHookConfigPath(agent, {
+      global: options.global ?? false
+    });
+    if (hookConfigPath) {
+      await removeMarketplaceHooksBySourceAsync(hookConfigPath, pack.slug);
+    }
+  }
+}
+async function marketplaceRemoveCommand(slug, options) {
+  try {
+    const installed = await findInstalledMarketplacePacks(options);
+    if (installed.length === 0) {
+      log.info("No marketplace packs installed.");
+      return;
+    }
+    const toRemove = await selectPacksToRemove(installed, slug, options);
+    if (!options.yes) {
+      const slugList = toRemove.map((p) => p.slug).join(", ");
+      const confirmed = await confirm({
+        message: `Remove ${toRemove.length} pack${toRemove.length === 1 ? "" : "s"} (${slugList})?`,
+        initialValue: false
+      });
+      if (isCancel(confirmed) || !confirmed) {
+        cancel("Remove cancelled.");
+        process11.exit(0);
+      }
+    }
+    for (const pack of toRemove) {
+      await removePackFiles(pack, options);
+      log.success(`Removed ${pack.slug}`);
+    }
+  } catch (error) {
+    log.error(
+      error instanceof Error ? error.message : "Failed to remove packs"
+    );
+    process11.exit(1);
   }
 }
 
@@ -6429,15 +6728,15 @@ async function marketplaceInstallCommand(slug, options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process11 from "process";
+import process12 from "process";
 var writeJson4 = (value) => {
-  process11.stdout.write(`${JSON.stringify(value, null, 2)}
+  process12.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
 var exitWithError3 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
-  process11.exit(1);
+  process12.exit(1);
 };
 var fail2 = (message) => {
   throw new Error(message);
@@ -6536,9 +6835,9 @@ async function profilesSetDefaultCommand(options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process12 from "process";
+import process13 from "process";
 var writeJson5 = (value) => {
-  process12.stdout.write(`${JSON.stringify(value, null, 2)}
+  process13.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
 var fail3 = (message) => {
@@ -6566,7 +6865,7 @@ var run3 = async (command, args, options) => {
 var exitWithError4 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
-  process12.exit(1);
+  process13.exit(1);
 };
 async function projectsGetCommand(options) {
   try {
@@ -6620,9 +6919,9 @@ async function projectsRemoveCommand(options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process13 from "process";
+import process14 from "process";
 var writeJson6 = (value) => {
-  process13.stdout.write(`${JSON.stringify(value, null, 2)}
+  process14.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
 var parseCsv3 = (input) => {
@@ -6635,7 +6934,7 @@ var parseCsv3 = (input) => {
 var exitWithError5 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
-  process13.exit(1);
+  process14.exit(1);
 };
 var fail4 = (message) => {
   throw new Error(message);
@@ -6722,9 +7021,9 @@ async function referencesReorderCommand(options) {
 
 // src/commands/remove.ts
 init_esm_shims();
-import { rm as rm5 } from "fs/promises";
-import { join as join12, resolve as resolve7 } from "path";
-import process14 from "process";
+import { rm as rm7 } from "fs/promises";
+import { join as join14, resolve as resolve8 } from "path";
+import process15 from "process";
 init_tui();
 async function collectInstalledSkills(detectedAgents, options) {
   const skillsToRemove = [];
@@ -6745,7 +7044,7 @@ async function collectInstalledSkills(detectedAgents, options) {
         name: skill.name,
         agentName: agent.name,
         installPath,
-        skillPath: join12(installPath, skill.name)
+        skillPath: join14(installPath, skill.name)
       });
     }
   }
@@ -6757,7 +7056,7 @@ async function selectSkillsToRemove(skillsToRemove, options) {
     if (selected.length === 0) {
       log.error(`Skill '${options.skill}' not found.`);
       log.info("Run 'braid list' to see installed skills.");
-      process14.exit(1);
+      process15.exit(1);
     }
     return selected;
   }
@@ -6776,7 +7075,7 @@ async function selectSkillsToRemove(skillsToRemove, options) {
   });
   if (isCancel(result)) {
     cancel("Remove cancelled.");
-    process14.exit(0);
+    process15.exit(0);
   }
   return result;
 }
@@ -6790,20 +7089,20 @@ async function confirmRemoval(selectedCount, options) {
   });
   if (isCancel(confirmed) || !confirmed) {
     cancel("Remove cancelled.");
-    process14.exit(0);
+    process15.exit(0);
   }
 }
 async function removeSkill(skill, removeSpinner) {
   removeSpinner.start(`Removing ${skill.name} from ${skill.agentName}...`);
   try {
-    const resolvedSkillPath = resolve7(skill.skillPath);
-    const resolvedInstallPath = resolve7(skill.installPath);
+    const resolvedSkillPath = resolve8(skill.skillPath);
+    const resolvedInstallPath = resolve8(skill.installPath);
     if (!resolvedSkillPath.startsWith(`${resolvedInstallPath}/`)) {
       removeSpinner.stop(`Unsafe path for ${skill.name}`);
       log.warn("  Skill path escapes install directory, skipping.");
       return false;
     }
-    await rm5(resolvedSkillPath, { recursive: true, force: true });
+    await rm7(resolvedSkillPath, { recursive: true, force: true });
     await removeFromMetadataAsync(skill.installPath, skill.name);
     removeSpinner.stop(`Removed ${skill.name} from ${skill.agentName}`);
     return true;
@@ -6854,7 +7153,7 @@ async function removeCommand(options) {
     removeSpinner.stop("Remove failed");
     const message = error instanceof Error ? error.message : String(error);
     log.error(message);
-    process14.exit(1);
+    process15.exit(1);
   }
 }
 
@@ -7052,7 +7351,7 @@ async function rollbackCommand(source, options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process15 from "process";
+import process16 from "process";
 var parseCsv4 = (input) => {
   if (!input) {
     return void 0;
@@ -7061,13 +7360,13 @@ var parseCsv4 = (input) => {
   return values.length > 0 ? values : void 0;
 };
 var writeJson7 = (value) => {
-  process15.stdout.write(`${JSON.stringify(value, null, 2)}
+  process16.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
 var exitWithError6 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
-  process15.exit(1);
+  process16.exit(1);
 };
 var fail5 = (message) => {
   throw new Error(message);
@@ -7246,7 +7545,7 @@ async function rulesSyncNowCommand(options) {
 
 // src/commands/scaffold.ts
 init_esm_shims();
-import process16 from "process";
+import process17 from "process";
 
 // src/lib/scaffold.ts
 init_esm_shims();
@@ -7256,11 +7555,11 @@ import {
   mkdir as mkdir7,
   readdir as readdir3,
   readFile as readFile8,
-  rm as rm6,
+  rm as rm8,
   stat,
   writeFile as writeFile9
 } from "fs/promises";
-import { dirname as dirname10, join as join13 } from "path";
+import { dirname as dirname12, join as join15 } from "path";
 var BRAID_PACK_FILENAME = "braid-pack.json";
 var DEFAULT_TIMEOUT_MS = 3e5;
 var MAX_DURATION_MS = 18e5;
@@ -7392,7 +7691,7 @@ var directoryContainsMatchingFile = async (absoluteDirectoryPath, matcher) => {
     );
   }
   for (const entry of entries) {
-    const absoluteEntryPath = join13(absoluteDirectoryPath, entry.name);
+    const absoluteEntryPath = join15(absoluteDirectoryPath, entry.name);
     if (entry.isDirectory()) {
       if (await directoryContainsMatchingFile(absoluteEntryPath, matcher)) {
         return true;
@@ -7448,19 +7747,19 @@ var directoryContainsHookArtifact = async (absoluteDirectoryPath) => directoryCo
   }
 );
 var hasUnmanifestedPackContent = async (cwd) => {
-  if (await manifestExists(join13(cwd, "SKILL.md"))) {
+  if (await manifestExists(join15(cwd, "SKILL.md"))) {
     return true;
   }
-  if (await directoryContainsSkillArtifact(join13(cwd, "skills"))) {
+  if (await directoryContainsSkillArtifact(join15(cwd, "skills"))) {
     return true;
   }
-  if (await directoryContainsAgentArtifact(join13(cwd, "agents"))) {
+  if (await directoryContainsAgentArtifact(join15(cwd, "agents"))) {
     return true;
   }
-  if (await directoryContainsHookArtifact(join13(cwd, "hooks"))) {
+  if (await directoryContainsHookArtifact(join15(cwd, "hooks"))) {
     return true;
   }
-  return directoryContainsWorkflowArtifact(join13(cwd, "workflows"));
+  return directoryContainsWorkflowArtifact(join15(cwd, "workflows"));
 };
 var parseManifestEntries = (manifest, key, parser) => {
   const value = manifest[key];
@@ -7986,7 +8285,7 @@ var writeTextFile3 = async (absolutePath, relativePath, content) => {
 var restoreManifest = async (absoluteManifestPath, previousContent) => {
   try {
     if (previousContent === void 0) {
-      await rm6(absoluteManifestPath, { force: true });
+      await rm8(absoluteManifestPath, { force: true });
       return;
     }
     await writeFile9(absoluteManifestPath, previousContent, "utf-8");
@@ -8010,8 +8309,8 @@ var prepareScaffoldOperation = async (normalizedInput) => {
     normalizedInput.type,
     normalizedInput.name
   );
-  const absoluteManifestPath = join13(normalizedInput.cwd, BRAID_PACK_FILENAME);
-  const absoluteArtifactPath = join13(normalizedInput.cwd, filePath);
+  const absoluteManifestPath = join15(normalizedInput.cwd, BRAID_PACK_FILENAME);
+  const absoluteArtifactPath = join15(normalizedInput.cwd, filePath);
   const manifestKey = MANIFEST_KEY_BY_TYPE[normalizedInput.type];
   const previousManifestContent = context.state === "manifest-pack" ? await readManifestFile(absoluteManifestPath) : void 0;
   const existingEntry = context.manifest[manifestKey].find(
@@ -8063,7 +8362,7 @@ var writeArtifactWithRollback = async ({
   previousManifestContent
 }) => {
   try {
-    await mkdir7(dirname10(absoluteArtifactPath), { recursive: true });
+    await mkdir7(dirname12(absoluteArtifactPath), { recursive: true });
     await writeTextFile3(absoluteArtifactPath, filePath, artifactContent);
   } catch (error) {
     const artifactError = error instanceof ScaffoldError ? error : toIoError(filePath, error);
@@ -8090,10 +8389,10 @@ var ScaffoldError = class extends Error {
   }
 };
 var inspectScaffoldDirectory = async (cwd) => {
-  const manifestPath = join13(cwd, BRAID_PACK_FILENAME);
+  const manifestPath = join15(cwd, BRAID_PACK_FILENAME);
   const hasManifest = await manifestExists(manifestPath);
   if (!hasManifest) {
-    if (await manifestExists(join13(cwd, "SKILL.md"))) {
+    if (await manifestExists(join15(cwd, "SKILL.md"))) {
       throw new ScaffoldError(
         "invalid_repo_state",
         "Invalid repo state: root SKILL.md requires migration to braid-pack.json before scaffolding."
@@ -8206,11 +8505,11 @@ var normalizeReferenceList = (referenceLabel, availableNamesLabel, values, avail
 };
 var exitCancelled2 = () => {
   cancel("Scaffold cancelled.");
-  process16.exit(0);
+  process17.exit(0);
 };
 var exitWithError7 = (message) => {
   log.error(message);
-  process16.exit(1);
+  process17.exit(1);
 };
 var requirePromptValue = (value) => {
   if (isCancel(value)) {
@@ -8339,7 +8638,7 @@ var resolveOptionalReference = async (label, flagValue, options, availableNames)
   return selected || void 0;
 };
 var buildScaffoldInput = async (options) => {
-  const context = await inspectScaffoldDirectory(process16.cwd());
+  const context = await inspectScaffoldDirectory(process17.cwd());
   const availableSkillNames = context.manifest.skills.map(
     (entry) => entry.name
   );
@@ -8393,7 +8692,7 @@ var buildScaffoldInput = async (options) => {
     availableWorkflowNames
   ) : void 0;
   return {
-    cwd: process16.cwd(),
+    cwd: process17.cwd(),
     type,
     name,
     title,
@@ -8485,8 +8784,8 @@ init_scope();
 
 // src/commands/update.ts
 init_esm_shims();
-import { rm as rm7 } from "fs/promises";
-import { join as join14, resolve as resolve8 } from "path";
+import { rm as rm9 } from "fs/promises";
+import { join as join16, resolve as resolve9 } from "path";
 import {
   cancel as cancel2,
   isCancel as isCancel2,
@@ -8631,12 +8930,12 @@ var areSameSourceProjects = (left, right) => {
 };
 var isSameInstalledSource = (source, target) => source.type === target.type && source.name === target.name && areSameSourceProjects(source.orgProjects, target.orgProjects) && areSameSourceProjects(source.personalProjects, target.personalProjects);
 var removeInstalledBundle = async (installPath, bundleName) => {
-  const resolvedInstallPath = resolve8(installPath);
-  const resolvedBundlePath = resolve8(join14(installPath, bundleName));
+  const resolvedInstallPath = resolve9(installPath);
+  const resolvedBundlePath = resolve9(join16(installPath, bundleName));
   if (!resolvedBundlePath.startsWith(`${resolvedInstallPath}/`)) {
     throw new Error(`Unsafe bundle path for ${bundleName}`);
   }
-  await rm7(resolvedBundlePath, { recursive: true, force: true });
+  await rm9(resolvedBundlePath, { recursive: true, force: true });
   const disabledRecord = await findDisabledBundleByOriginalPathAsync(
     resolvedBundlePath,
     {
@@ -8954,6 +9253,11 @@ marketplace.command("install").description("Install a marketplace pack by slug")
   "--allow-hooks",
   "Allow marketplace packs to install executable Claude Code hooks"
 ).option("-y, --yes", "Skip confirmation prompts").action((slug, options) => marketplaceInstallCommand(slug, options));
+marketplace.command("update").description("Update installed marketplace packs to their latest version").argument("[slug]", "Pack slug (updates all if omitted)").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("-g, --global", "Update packs in global agent directories").option(
+  "--allow-hooks",
+  "Allow marketplace packs to install executable Claude Code hooks"
+).option("-y, --yes", "Skip confirmation prompts").action((slug, options) => marketplaceUpdateCommand(slug, options));
+marketplace.command("remove").description("Remove installed marketplace packs").argument("[slug]", "Pack slug (prompts for selection if omitted)").option("-g, --global", "Remove from global agent directories").option("-y, --yes", "Skip confirmation prompts").action((slug, options) => marketplaceRemoveCommand(slug, options));
 var projects = program.command("projects").description("Discover available projects from braid");
 projects.command("list").description("List available personal and org projects").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(projectsListCommand);
 projects.command("get").description("Get a project by id").requiredOption("--id <id>", "Project ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(projectsGetCommand);