@dayofweek/dcli 1.6.0 → 1.7.0

package/README.md

@@ -72,6 +72,34 @@ Updates overwrite only files whose installed hash still matches the managed mani
 
 The legacy entity/proposal Agent Skill remains available through `dcli skill install` without a bundle name.
 
+### Shared skills
+
+Beyond the named bundles above, users can publish their own skills into a shared knowledge area. Anyone who can read the area — or, with `--visibility company`, anyone in the publishing area's organization — can then discover, install, and update the skill. Service administrators can additionally publish with `--visibility global`, making a skill a shared starter for every user of the service; the desktop app syncs global skills into managed wikis automatically.
+
+```bash
+# Publish a local skill directory (name/version come from SKILL.md frontmatter)
+dcli skill publish --area <areaId> --dir .agents/skills/meeting-notes --visibility company
+
+# Discover: --shared adds skills shared with you to the bundle listing
+dcli skill list --shared --json
+
+# Install by canonical URI, or by name + area
+dcli skill install 'dayofweek://brain/<areaId>/skill/<skillId>'
+dcli skill install meeting-notes --area <areaId>
+
+# Update goes back to wherever the install came from
+dcli skill update meeting-notes --area <areaId>
+dcli skill update --dir .agents/skills/meeting-notes
+
+# Check for newer versions without writing anything
+dcli skill status meeting-notes --dir .agents/skills/meeting-notes --check
+
+# Retire a shared skill you own
+dcli skill archive 'dayofweek://brain/<areaId>/skill/<skillId>'
+```
+
+Shared skills go through the same integrity pipeline as named bundles: per-file SHA-256 plus a manifest hash computed server-side and re-verified locally before anything touches disk, the same path-safety rules, and the same conflict handling — locally edited files are never overwritten. The install origin is recorded in `.dayofweek-skill.json`, so `skill update` and `skill status --check` know whether to ask the bundle endpoint or the shared-skill endpoint. Publishing requires write access to the area; `--visibility company` and `skill archive` require ownership.
+
 ## URI contract
 
 `dcli` accepts only exact canonical resource forms:

package/dist/bin/dcli.js

@@ -4,13 +4,13 @@ import { ApiError, DayOfWeekClient, toArrayBuffer } from "../client.js";
 import { getToken, getApiUrl, saveConfig, loadConfig, saveCredential, deleteCredential } from "../config.js";
 import { browserLogin } from "../auth/login.js";
 import { parseBrainResource } from "../uri.js";
-import { accessSync, constants, mkdirSync, readFileSync, existsSync, statSync, writeFileSync } from "node:fs";
+import { accessSync, constants, mkdirSync, readdirSync, readFileSync, existsSync, statSync, writeFileSync } from "node:fs";
 import { join, basename, resolve, relative, sep } from "node:path";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import pkg from "../../package.json" with { type: "json" };
 import { createHash } from "node:crypto";
-import { validateSkillBundle, writeSkillBundle } from "../skills.js";
+import { readInstalledSkill, validateSkillBundle, writeSkillBundle } from "../skills.js";
 const program = new Command()
     .name("dcli")
     .description("CLI for the Day of Week AgTech platform")
@@ -768,53 +768,207 @@ function parseTarget(value) {
     }
     return v;
 }
+function sharedToBundle(shared) {
+    return {
+        bundle: { name: shared.name, version: shared.version, hash: shared.hash, files: shared.files },
+        origin: { source: "shared", skillId: shared.id, areaId: shared.areaId, uri: shared.uri },
+    };
+}
+async function fetchSkillByOrigin(client, nameOrUri, areaId) {
+    if (nameOrUri?.includes("://")) {
+        const resource = parseBrainResource(nameOrUri);
+        if (resource.resourceType !== "skill" || !resource.resourceId)
+            throw new Error("A shared skill URI is required");
+        const shared = await client.getSharedSkill(resource.resourceId);
+        if (shared.areaId !== resource.areaId)
+            throw new Error("Server returned a mismatched area");
+        return sharedToBundle(shared);
+    }
+    if (areaId) {
+        if (!nameOrUri)
+            throw new Error("A skill name is required together with --area");
+        const match = (await client.listSharedSkills()).find((candidate) => candidate.areaId === areaId && candidate.name === nameOrUri);
+        if (!match)
+            throw new Error("Shared skill not found in that area");
+        return sharedToBundle(await client.getSharedSkill(match.id));
+    }
+    return { bundle: await client.getSkillBundle(nameOrUri), origin: { source: "platform" } };
+}
+async function installOrUpdateSkill(action, name, opts) {
+    const client = getClient();
+    let resolved;
+    if (action === "update" && !name && !opts.area && opts.dir) {
+        // Bare `skill update --dir …`: go back to wherever this install came from.
+        const installed = readInstalledSkill(opts.dir);
+        if (installed) {
+            resolved = installed.origin?.source === "shared"
+                ? sharedToBundle(await client.getSharedSkill(installed.origin.skillId))
+                : { bundle: await client.getSkillBundle(installed.name), origin: { source: "platform" } };
+        }
+    }
+    resolved = resolved ?? await fetchSkillByOrigin(client, name, opts.area);
+    const bundle = validateSkillBundle(resolved.bundle);
+    const dirs = resolveTargetDirs(parseTarget(opts.target), bundle.name, opts.dir);
+    const installations = [];
+    for (const dir of dirs) {
+        const result = writeSkillBundle(bundle, dir, resolved.origin);
+        installations.push({ directory: dir, ...result });
+    }
+    output({
+        action,
+        bundle: bundle.name,
+        version: bundle.version,
+        hash: bundle.hash,
+        origin: resolved.origin.source,
+        ...(resolved.origin.source === "shared" ? { uri: resolved.origin.uri } : {}),
+        installations,
+    });
+}
+/** Read a skill directory into bundle files: relative paths, utf-8 content. */
+function collectSkillFiles(dir) {
+    const root = resolve(dir);
+    if (!existsSync(root) || !statSync(root).isDirectory())
+        throw new Error("Skill directory not found");
+    const files = [];
+    const walk = (current, prefix) => {
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            // Hidden entries (including the .dayofweek-skill.json install manifest)
+            // and update-conflict artifacts never belong in a published bundle.
+            if (entry.name.startsWith(".") || /\.new(\.\d+)?$/.test(entry.name))
+                continue;
+            if (entry.isSymbolicLink())
+                throw new Error("Symlinks are not allowed in a skill directory");
+            const full = join(current, entry.name);
+            const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (entry.isDirectory())
+                walk(full, relativePath);
+            else if (entry.isFile())
+                files.push({ path: relativePath, content: readFileSync(full, "utf8") });
+        }
+    };
+    walk(root, "");
+    return files.sort((left, right) => left.path.localeCompare(right.path));
+}
 skill
     .command("list")
-    .description("List authenticated named skill bundles")
-    .action(async () => output(await getClient().listSkillBundles()));
+    .description("List installable named skill bundles; --shared adds skills shared with you")
+    .option("--shared", "Include skills other users shared with you")
+    .action(async (opts) => {
+    const client = getClient();
+    // The bare listing stays exactly the named bundles: managed installers
+    // iterate it and fetch every entry by plain name, so shared skills (which
+    // resolve by URI) only appear when explicitly asked for.
+    const listings = (await client.listSkillBundles()).map((bundle) => ({
+        ...bundle,
+        source: "platform",
+    }));
+    if (opts.shared) {
+        try {
+            for (const shared of await client.listSharedSkills()) {
+                listings.push({
+                    name: shared.name,
+                    version: shared.version,
+                    hash: shared.hash,
+                    source: "shared",
+                    areaId: shared.areaId,
+                    areaName: shared.areaName,
+                    visibility: shared.visibility,
+                    description: shared.description,
+                    uri: shared.uri,
+                    updatedAt: shared.updatedAt,
+                });
+            }
+        }
+        catch (error) {
+            // Older servers or tokens without knowledge scopes have no shared-skill
+            // surface — the named bundles are still worth listing.
+            console.error(`Shared skills unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    output(listings.sort((left, right) => left.name.localeCompare(right.name)));
+});
 skill
-    .command("bundle <name>")
-    .description("Fetch and verify a named skill bundle for a managed installer")
-    .action(async (name) => output(validateSkillBundle(await getClient().getSkillBundle(name))));
+    .command("bundle <nameOrUri>")
+    .description("Fetch and verify a skill bundle (by name, or shared-skill URI) for a managed installer")
+    .action(async (nameOrUri) => {
+    if (nameOrUri.includes("://")) {
+        const resource = parseBrainResource(nameOrUri);
+        if (resource.resourceType !== "skill" || !resource.resourceId)
+            throw new Error("A shared skill URI is required");
+        const shared = await getClient().getSharedSkill(resource.resourceId);
+        if (shared.areaId !== resource.areaId)
+            throw new Error("Server returned a mismatched area");
+        // Emit the plain bundle shape managed installers expect.
+        output(validateSkillBundle({ name: shared.name, version: shared.version, hash: shared.hash, files: shared.files }));
+        return;
+    }
+    output(validateSkillBundle(await getClient().getSkillBundle(nameOrUri)));
+});
 skill
     .command("install [name]")
-    .description("Install the agent skill (requires valid auth)")
+    .description("Install a skill by bundle name, shared-skill URI, or name + --area")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Install target: agents, claude, or all (default: all)")
-    .action(async (name, opts) => {
-    const client = getClient();
-    const bundle = await client.getSkillBundle(name);
-    const target = parseTarget(opts.target);
-    const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
-    const installations = [];
-    for (const dir of dirs) {
-        const result = writeSkillBundle(bundle, dir);
-        installations.push({ directory: dir, ...result });
-    }
-    output({ action: "install", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
-});
+    .option("--area <areaId>", "Install a shared skill from this area")
+    .action(async (name, opts) => installOrUpdateSkill("install", name, opts));
 skill
     .command("update [name]")
-    .description("Update the skill to the latest version")
+    .description("Update a skill to the latest version from its origin")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Install target: agents, claude, or all (default: all)")
-    .action(async (name, opts) => {
-    const client = getClient();
-    const bundle = await client.getSkillBundle(name);
-    const target = parseTarget(opts.target);
-    const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
-    const installations = [];
-    for (const dir of dirs) {
-        const result = writeSkillBundle(bundle, dir);
-        installations.push({ directory: dir, ...result });
+    .option("--area <areaId>", "Update a shared skill from this area")
+    .action(async (name, opts) => installOrUpdateSkill("update", name, opts));
+skill
+    .command("publish")
+    .description("Share a skill directory to a knowledge area so teammates can install it")
+    .requiredOption("--area <areaId>", "Owning area (see: dcli brain list)")
+    .requiredOption("--dir <path>", "Skill directory containing SKILL.md")
+    .option("--name <name>", "Skill name (default: SKILL.md frontmatter, else the directory name)")
+    .option("--skill-version <version>", "Version string (default: SKILL.md frontmatter version)")
+    .option("--visibility <visibility>", "Who can discover it: area (members only), company, or global (admins; every user)")
+    .option("--description <text>", "Short description shown in listings")
+    .action(async (opts) => {
+    const visibility = (opts.visibility ?? "area").toLowerCase();
+    if (visibility !== "area" && visibility !== "company" && visibility !== "global") {
+        throw new Error("Invalid --visibility: use area, company, or global");
     }
-    output({ action: "update", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
+    const files = collectSkillFiles(opts.dir);
+    const skillMd = files.find((file) => file.path === "SKILL.md");
+    if (!skillMd)
+        throw new Error("The skill directory must contain SKILL.md");
+    const name = opts.name
+        ?? skillMd.content.match(/^name:\s*"?([a-z0-9][a-z0-9-]*)"?\s*$/m)?.[1]
+        ?? basename(resolve(opts.dir));
+    const version = opts.skillVersion ?? skillMd.content.match(/version:\s*"([^"]+)"/)?.[1] ?? "1.0.0";
+    validateSkillBundle({ name, version, files });
+    const result = await getClient().publishSharedSkill({
+        areaId: opts.area,
+        name,
+        version,
+        description: opts.description,
+        visibility,
+        files,
+    });
+    output({ action: "publish", ...result });
+});
+skill
+    .command("archive <uri>")
+    .description("Archive a shared skill you own (removes it from listing and install)")
+    .action(async (uri) => {
+    const resource = parseBrainResource(uri);
+    if (resource.resourceType !== "skill" || !resource.resourceId)
+        throw new Error("A shared skill URI is required");
+    const result = await getClient().archiveSharedSkill(resource.resourceId);
+    if (result.areaId !== resource.areaId)
+        throw new Error("Server returned a mismatched area");
+    output({ action: "archive", ...result });
 });
 skill
     .command("status [name]")
-    .description("Check if the skill is installed")
+    .description("Check if the skill is installed; --check compares against its origin")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Check target: agents, claude, or all (default: all)")
+    .option("--check", "Also ask the server whether a newer version exists")
     .action(async (name, opts) => {
     const bundleName = name ?? "dayofweek-platform";
     const target = parseTarget(opts.target);
@@ -823,6 +977,7 @@ skill
         : target === "all"
             ? [join(homedir(), ".agents", "skills", bundleName), join(homedir(), ".claude", "skills", bundleName)]
             : resolveTargetDirs(target, bundleName);
+    let platformBundles;
     const installations = [];
     for (const dir of dirs) {
         const skillPath = join(dir, "SKILL.md");
@@ -830,9 +985,40 @@ skill
             installations.push({ installed: false, directory: dir, name: bundleName });
             continue;
         }
+        const metadata = readInstalledSkill(dir);
         const content = readFileSync(skillPath, "utf-8");
         const versionMatch = content.match(/version:\s*"([^"]+)"/);
-        installations.push({ installed: true, directory: dir, name: bundleName, version: versionMatch?.[1] ?? "unknown", sha256: sha256(content) });
+        const entry = {
+            installed: true,
+            directory: dir,
+            name: metadata?.name ?? bundleName,
+            version: metadata?.version ?? versionMatch?.[1] ?? "unknown",
+            sha256: sha256(content),
+            origin: metadata?.origin?.source ?? "platform",
+        };
+        if (opts.check) {
+            try {
+                if (metadata?.origin?.source === "shared") {
+                    const latest = await getClient().getSharedSkill(metadata.origin.skillId);
+                    entry.latestVersion = latest.version;
+                    entry.upToDate = metadata.hash === latest.hash;
+                }
+                else {
+                    platformBundles ??= await getClient().listSkillBundles();
+                    const latest = platformBundles.find((candidate) => candidate.name === entry.name);
+                    if (latest) {
+                        entry.latestVersion = latest.version;
+                        // Pre-origin installs have no recorded manifest hash; fall back
+                        // to comparing the declared versions.
+                        entry.upToDate = metadata ? metadata.hash === latest.hash : latest.version === entry.version;
+                    }
+                }
+            }
+            catch (error) {
+                entry.checkError = error instanceof Error ? error.message : String(error);
+            }
+        }
+        installations.push(entry);
     }
     const installed = installations.some((entry) => entry.installed);
     output({ installed, bundle: bundleName, installations });

package/dist/bundle/dcli.cjs

@@ -4633,6 +4633,23 @@ var DayOfWeekClient = class {
   async listSkillBundles() {
     return this.get("/skill?list=1");
   }
+  // ── Shared skills ─────────────────────────────────────────────────────────
+  //
+  // Skills other users published into shared knowledge areas. Discovery is
+  // server-owned, like the named bundles above: the CLI ships no skill names,
+  // and the server decides which skills this device's user may see.
+  async listSharedSkills() {
+    return this.get("/brain/skills");
+  }
+  async getSharedSkill(skillId) {
+    return this.get(`/brain/skills/${encodeURIComponent(skillId)}`);
+  }
+  async publishSharedSkill(input) {
+    return this.post("/brain/skills", input);
+  }
+  async archiveSharedSkill(skillId) {
+    return this.delete(`/brain/skills/${encodeURIComponent(skillId)}`);
+  }
   // ── Schema ────────────────────────────────────────────────────────────────
   async getSchema() {
     return this.get("/schema");
@@ -5037,7 +5054,7 @@ function parseSegments(pathname) {
   if (segments.length !== 3) throw new Error("Unsupported brain URI form");
   const areaId = assertId(segments[0], "area ID");
   const resourceType = segments[1];
-  if (resourceType !== "note" && resourceType !== "source") {
+  if (resourceType !== "note" && resourceType !== "source" && resourceType !== "skill") {
     throw new Error("Unsupported brain resource type");
   }
   return {
@@ -5081,7 +5098,7 @@ var import_promises4 = require("node:readline/promises");
 // package.json
 var package_default = {
   name: "@dayofweek/dcli",
-  version: "1.6.0",
+  version: "1.7.0",
   description: "CLI for the Day of Week AgTech platform \u2014 read data and submit proposals for review",
   license: "MIT",
   type: "module",
@@ -5141,6 +5158,17 @@ var import_node_crypto4 = require("node:crypto");
 var import_node_crypto3 = require("node:crypto");
 var import_node_fs7 = require("node:fs");
 var import_node_path5 = require("node:path");
+function readInstalledSkill(targetDir) {
+  const metadataPath = (0, import_node_path5.join)(targetDir, ".dayofweek-skill.json");
+  if (!(0, import_node_fs7.existsSync)(metadataPath)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(metadataPath, "utf8"));
+    if (typeof parsed.name !== "string" || typeof parsed.version !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
 function sha256(value) {
   return (0, import_node_crypto3.createHash)("sha256").update(value).digest("hex");
 }
@@ -5164,7 +5192,7 @@ function validateSkillBundle(bundle) {
   if (bundle.hash && bundle.hash !== actualBundleHash) throw new Error("Skill bundle manifest checksum mismatch");
   return { ...bundle, hash: actualBundleHash, files };
 }
-function writeSkillBundle(input, targetDir) {
+function writeSkillBundle(input, targetDir, origin) {
   const bundle = validateSkillBundle(input);
   let filesWritten = 0;
   let unchanged = 0;
@@ -5200,7 +5228,15 @@ function writeSkillBundle(input, targetDir) {
     filesWritten++;
   }
   (0, import_node_fs7.mkdirSync)(targetDir, { recursive: true });
-  (0, import_node_fs7.writeFileSync)(metadataPath, JSON.stringify({ name: bundle.name, version: bundle.version, hash: bundle.hash, files: hashes }, null, 2), "utf8");
+  (0, import_node_fs7.writeFileSync)(
+    metadataPath,
+    JSON.stringify(
+      { name: bundle.name, version: bundle.version, hash: bundle.hash, files: hashes, ...origin ? { origin } : {} },
+      null,
+      2
+    ),
+    "utf8"
+  );
   return { written: filesWritten, unchanged, conflicts };
 }
 
@@ -5699,36 +5735,148 @@ function parseTarget(value) {
   }
   return v;
 }
-skill.command("list").description("List authenticated named skill bundles").action(async () => output(await getClient().listSkillBundles()));
-skill.command("bundle <name>").description("Fetch and verify a named skill bundle for a managed installer").action(async (name) => output(validateSkillBundle(await getClient().getSkillBundle(name))));
-skill.command("install [name]").description("Install the agent skill (requires valid auth)").option("--dir <path>", "Custom install directory (overrides --target)").option("--target <target>", "Install target: agents, claude, or all (default: all)").action(async (name, opts) => {
+function sharedToBundle(shared) {
+  return {
+    bundle: { name: shared.name, version: shared.version, hash: shared.hash, files: shared.files },
+    origin: { source: "shared", skillId: shared.id, areaId: shared.areaId, uri: shared.uri }
+  };
+}
+async function fetchSkillByOrigin(client, nameOrUri, areaId) {
+  if (nameOrUri?.includes("://")) {
+    const resource = parseBrainResource(nameOrUri);
+    if (resource.resourceType !== "skill" || !resource.resourceId) throw new Error("A shared skill URI is required");
+    const shared = await client.getSharedSkill(resource.resourceId);
+    if (shared.areaId !== resource.areaId) throw new Error("Server returned a mismatched area");
+    return sharedToBundle(shared);
+  }
+  if (areaId) {
+    if (!nameOrUri) throw new Error("A skill name is required together with --area");
+    const match = (await client.listSharedSkills()).find(
+      (candidate) => candidate.areaId === areaId && candidate.name === nameOrUri
+    );
+    if (!match) throw new Error("Shared skill not found in that area");
+    return sharedToBundle(await client.getSharedSkill(match.id));
+  }
+  return { bundle: await client.getSkillBundle(nameOrUri), origin: { source: "platform" } };
+}
+async function installOrUpdateSkill(action, name, opts) {
   const client = getClient();
-  const bundle = await client.getSkillBundle(name);
-  const target = parseTarget(opts.target);
-  const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
+  let resolved;
+  if (action === "update" && !name && !opts.area && opts.dir) {
+    const installed = readInstalledSkill(opts.dir);
+    if (installed) {
+      resolved = installed.origin?.source === "shared" ? sharedToBundle(await client.getSharedSkill(installed.origin.skillId)) : { bundle: await client.getSkillBundle(installed.name), origin: { source: "platform" } };
+    }
+  }
+  resolved = resolved ?? await fetchSkillByOrigin(client, name, opts.area);
+  const bundle = validateSkillBundle(resolved.bundle);
+  const dirs = resolveTargetDirs(parseTarget(opts.target), bundle.name, opts.dir);
   const installations = [];
   for (const dir of dirs) {
-    const result = writeSkillBundle(bundle, dir);
+    const result = writeSkillBundle(bundle, dir, resolved.origin);
     installations.push({ directory: dir, ...result });
   }
-  output({ action: "install", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
-});
-skill.command("update [name]").description("Update the skill to the latest version").option("--dir <path>", "Custom install directory (overrides --target)").option("--target <target>", "Install target: agents, claude, or all (default: all)").action(async (name, opts) => {
+  output({
+    action,
+    bundle: bundle.name,
+    version: bundle.version,
+    hash: bundle.hash,
+    origin: resolved.origin.source,
+    ...resolved.origin.source === "shared" ? { uri: resolved.origin.uri } : {},
+    installations
+  });
+}
+function collectSkillFiles(dir) {
+  const root = (0, import_node_path6.resolve)(dir);
+  if (!(0, import_node_fs8.existsSync)(root) || !(0, import_node_fs8.statSync)(root).isDirectory()) throw new Error("Skill directory not found");
+  const files = [];
+  const walk = (current, prefix) => {
+    for (const entry of (0, import_node_fs8.readdirSync)(current, { withFileTypes: true })) {
+      if (entry.name.startsWith(".") || /\.new(\.\d+)?$/.test(entry.name)) continue;
+      if (entry.isSymbolicLink()) throw new Error("Symlinks are not allowed in a skill directory");
+      const full = (0, import_node_path6.join)(current, entry.name);
+      const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) walk(full, relativePath);
+      else if (entry.isFile()) files.push({ path: relativePath, content: (0, import_node_fs8.readFileSync)(full, "utf8") });
+    }
+  };
+  walk(root, "");
+  return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+skill.command("list").description("List installable named skill bundles; --shared adds skills shared with you").option("--shared", "Include skills other users shared with you").action(async (opts) => {
   const client = getClient();
-  const bundle = await client.getSkillBundle(name);
-  const target = parseTarget(opts.target);
-  const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
-  const installations = [];
-  for (const dir of dirs) {
-    const result = writeSkillBundle(bundle, dir);
-    installations.push({ directory: dir, ...result });
+  const listings = (await client.listSkillBundles()).map((bundle) => ({
+    ...bundle,
+    source: "platform"
+  }));
+  if (opts.shared) {
+    try {
+      for (const shared of await client.listSharedSkills()) {
+        listings.push({
+          name: shared.name,
+          version: shared.version,
+          hash: shared.hash,
+          source: "shared",
+          areaId: shared.areaId,
+          areaName: shared.areaName,
+          visibility: shared.visibility,
+          description: shared.description,
+          uri: shared.uri,
+          updatedAt: shared.updatedAt
+        });
+      }
+    } catch (error) {
+      console.error(`Shared skills unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  output(listings.sort((left, right) => left.name.localeCompare(right.name)));
+});
+skill.command("bundle <nameOrUri>").description("Fetch and verify a skill bundle (by name, or shared-skill URI) for a managed installer").action(async (nameOrUri) => {
+  if (nameOrUri.includes("://")) {
+    const resource = parseBrainResource(nameOrUri);
+    if (resource.resourceType !== "skill" || !resource.resourceId) throw new Error("A shared skill URI is required");
+    const shared = await getClient().getSharedSkill(resource.resourceId);
+    if (shared.areaId !== resource.areaId) throw new Error("Server returned a mismatched area");
+    output(validateSkillBundle({ name: shared.name, version: shared.version, hash: shared.hash, files: shared.files }));
+    return;
   }
-  output({ action: "update", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
+  output(validateSkillBundle(await getClient().getSkillBundle(nameOrUri)));
 });
-skill.command("status [name]").description("Check if the skill is installed").option("--dir <path>", "Custom install directory (overrides --target)").option("--target <target>", "Check target: agents, claude, or all (default: all)").action(async (name, opts) => {
+skill.command("install [name]").description("Install a skill by bundle name, shared-skill URI, or name + --area").option("--dir <path>", "Custom install directory (overrides --target)").option("--target <target>", "Install target: agents, claude, or all (default: all)").option("--area <areaId>", "Install a shared skill from this area").action(async (name, opts) => installOrUpdateSkill("install", name, opts));
+skill.command("update [name]").description("Update a skill to the latest version from its origin").option("--dir <path>", "Custom install directory (overrides --target)").option("--target <target>", "Install target: agents, claude, or all (default: all)").option("--area <areaId>", "Update a shared skill from this area").action(async (name, opts) => installOrUpdateSkill("update", name, opts));
+skill.command("publish").description("Share a skill directory to a knowledge area so teammates can install it").requiredOption("--area <areaId>", "Owning area (see: dcli brain list)").requiredOption("--dir <path>", "Skill directory containing SKILL.md").option("--name <name>", "Skill name (default: SKILL.md frontmatter, else the directory name)").option("--skill-version <version>", "Version string (default: SKILL.md frontmatter version)").option("--visibility <visibility>", "Who can discover it: area (members only), company, or global (admins; every user)").option("--description <text>", "Short description shown in listings").action(async (opts) => {
+  const visibility = (opts.visibility ?? "area").toLowerCase();
+  if (visibility !== "area" && visibility !== "company" && visibility !== "global") {
+    throw new Error("Invalid --visibility: use area, company, or global");
+  }
+  const files = collectSkillFiles(opts.dir);
+  const skillMd = files.find((file) => file.path === "SKILL.md");
+  if (!skillMd) throw new Error("The skill directory must contain SKILL.md");
+  const name = opts.name ?? skillMd.content.match(/^name:\s*"?([a-z0-9][a-z0-9-]*)"?\s*$/m)?.[1] ?? (0, import_node_path6.basename)((0, import_node_path6.resolve)(opts.dir));
+  const version = opts.skillVersion ?? skillMd.content.match(/version:\s*"([^"]+)"/)?.[1] ?? "1.0.0";
+  validateSkillBundle({ name, version, files });
+  const result = await getClient().publishSharedSkill({
+    areaId: opts.area,
+    name,
+    version,
+    description: opts.description,
+    visibility,
+    files
+  });
+  output({ action: "publish", ...result });
+});
+skill.command("archive <uri>").description("Archive a shared skill you own (removes it from listing and install)").action(async (uri) => {
+  const resource = parseBrainResource(uri);
+  if (resource.resourceType !== "skill" || !resource.resourceId) throw new Error("A shared skill URI is required");
+  const result = await getClient().archiveSharedSkill(resource.resourceId);
+  if (result.areaId !== resource.areaId) throw new Error("Server returned a mismatched area");
+  output({ action: "archive", ...result });
+});
+skill.command("status [name]").description("Check if the skill is installed; --check compares against its origin").option("--dir <path>", "Custom install directory (overrides --target)").option("--target <target>", "Check target: agents, claude, or all (default: all)").option("--check", "Also ask the server whether a newer version exists").action(async (name, opts) => {
   const bundleName2 = name ?? "dayofweek-platform";
   const target = parseTarget(opts.target);
   const dirs = opts.dir ? [opts.dir] : target === "all" ? [(0, import_node_path6.join)((0, import_node_os5.homedir)(), ".agents", "skills", bundleName2), (0, import_node_path6.join)((0, import_node_os5.homedir)(), ".claude", "skills", bundleName2)] : resolveTargetDirs(target, bundleName2);
+  let platformBundles;
   const installations = [];
   for (const dir of dirs) {
     const skillPath = (0, import_node_path6.join)(dir, "SKILL.md");
@@ -5736,9 +5884,36 @@ skill.command("status [name]").description("Check if the skill is installed").op
       installations.push({ installed: false, directory: dir, name: bundleName2 });
       continue;
     }
+    const metadata = readInstalledSkill(dir);
     const content = (0, import_node_fs8.readFileSync)(skillPath, "utf-8");
     const versionMatch = content.match(/version:\s*"([^"]+)"/);
-    installations.push({ installed: true, directory: dir, name: bundleName2, version: versionMatch?.[1] ?? "unknown", sha256: sha2562(content) });
+    const entry = {
+      installed: true,
+      directory: dir,
+      name: metadata?.name ?? bundleName2,
+      version: metadata?.version ?? versionMatch?.[1] ?? "unknown",
+      sha256: sha2562(content),
+      origin: metadata?.origin?.source ?? "platform"
+    };
+    if (opts.check) {
+      try {
+        if (metadata?.origin?.source === "shared") {
+          const latest = await getClient().getSharedSkill(metadata.origin.skillId);
+          entry.latestVersion = latest.version;
+          entry.upToDate = metadata.hash === latest.hash;
+        } else {
+          platformBundles ??= await getClient().listSkillBundles();
+          const latest = platformBundles.find((candidate) => candidate.name === entry.name);
+          if (latest) {
+            entry.latestVersion = latest.version;
+            entry.upToDate = metadata ? metadata.hash === latest.hash : latest.version === entry.version;
+          }
+        }
+      } catch (error) {
+        entry.checkError = error instanceof Error ? error.message : String(error);
+      }
+    }
+    installations.push(entry);
   }
   const installed = installations.some((entry) => entry.installed);
   output({ installed, bundle: bundleName2, installations });

package/dist/client.d.ts

@@ -333,6 +333,20 @@ export declare class DayOfWeekClient {
         version: string;
         hash: string;
     }>>;
+    listSharedSkills(): Promise<SharedSkillSummary[]>;
+    getSharedSkill(skillId: string): Promise<SharedSkillBundle>;
+    publishSharedSkill(input: {
+        areaId: string;
+        name: string;
+        version: string;
+        description?: string;
+        visibility: "area" | "company" | "global";
+        files: Array<{
+            path: string;
+            content: string;
+        }>;
+    }): Promise<SharedSkillSummary>;
+    archiveSharedSkill(skillId: string): Promise<SharedSkillSummary>;
     getSchema(): Promise<any>;
     private get;
     private post;
@@ -399,3 +413,26 @@ export type BrainResolvedResource = {
     resourceType: "source";
     source: BrainSource;
 };
+export type SharedSkillSummary = {
+    id: string;
+    areaId: string;
+    areaName: string;
+    name: string;
+    version: string;
+    description?: string;
+    hash: string;
+    visibility: "area" | "company" | "global";
+    revision: number;
+    fileCount: number;
+    byteSize: number;
+    uri: string;
+    httpsUrl: string;
+    updatedAt: number;
+};
+export type SharedSkillBundle = Omit<SharedSkillSummary, "fileCount" | "byteSize"> & {
+    files: Array<{
+        path: string;
+        content: string;
+        sha256: string;
+    }>;
+};

package/dist/client.js

@@ -512,6 +512,23 @@ export class DayOfWeekClient {
     async listSkillBundles() {
         return this.get("/skill?list=1");
     }
+    // ── Shared skills ─────────────────────────────────────────────────────────
+    //
+    // Skills other users published into shared knowledge areas. Discovery is
+    // server-owned, like the named bundles above: the CLI ships no skill names,
+    // and the server decides which skills this device's user may see.
+    async listSharedSkills() {
+        return this.get("/brain/skills");
+    }
+    async getSharedSkill(skillId) {
+        return this.get(`/brain/skills/${encodeURIComponent(skillId)}`);
+    }
+    async publishSharedSkill(input) {
+        return this.post("/brain/skills", input);
+    }
+    async archiveSharedSkill(skillId) {
+        return this.delete(`/brain/skills/${encodeURIComponent(skillId)}`);
+    }
     // ── Schema ────────────────────────────────────────────────────────────────
     async getSchema() {
         return this.get("/schema");

package/dist/skills.d.ts

@@ -8,8 +8,31 @@ export type SkillBundle = {
         sha256?: string;
     }>;
 };
+/**
+ * Where an installed skill came from — recorded in `.dayofweek-skill.json` so
+ * `skill update` and `skill status --check` can go back to the same origin.
+ * "platform" = a named bundle from the built-in endpoint; "shared" = a skill
+ * another user published into a shared knowledge area.
+ */
+export type SkillOrigin = {
+    source: "platform";
+} | {
+    source: "shared";
+    skillId: string;
+    areaId: string;
+    uri: string;
+};
+export type InstalledSkillMetadata = {
+    name: string;
+    version: string;
+    hash: string;
+    files: Record<string, string>;
+    origin?: SkillOrigin;
+};
+/** Parse `<dir>/.dayofweek-skill.json`; null when absent or malformed. */
+export declare function readInstalledSkill(targetDir: string): InstalledSkillMetadata | null;
 export declare function validateSkillBundle(bundle: SkillBundle): SkillBundle;
-export declare function writeSkillBundle(input: SkillBundle, targetDir: string): {
+export declare function writeSkillBundle(input: SkillBundle, targetDir: string, origin?: SkillOrigin): {
     written: number;
     unchanged: number;
     conflicts: string[];

package/dist/skills.js

@@ -1,6 +1,21 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+/** Parse `<dir>/.dayofweek-skill.json`; null when absent or malformed. */
+export function readInstalledSkill(targetDir) {
+    const metadataPath = join(targetDir, ".dayofweek-skill.json");
+    if (!existsSync(metadataPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(metadataPath, "utf8"));
+        if (typeof parsed.name !== "string" || typeof parsed.version !== "string")
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
 function sha256(value) {
     return createHash("sha256").update(value).digest("hex");
 }
@@ -33,7 +48,7 @@ export function validateSkillBundle(bundle) {
         throw new Error("Skill bundle manifest checksum mismatch");
     return { ...bundle, hash: actualBundleHash, files };
 }
-export function writeSkillBundle(input, targetDir) {
+export function writeSkillBundle(input, targetDir, origin) {
     const bundle = validateSkillBundle(input);
     let filesWritten = 0;
     let unchanged = 0;
@@ -72,6 +87,6 @@ export function writeSkillBundle(input, targetDir) {
         filesWritten++;
     }
     mkdirSync(targetDir, { recursive: true });
-    writeFileSync(metadataPath, JSON.stringify({ name: bundle.name, version: bundle.version, hash: bundle.hash, files: hashes }, null, 2), "utf8");
+    writeFileSync(metadataPath, JSON.stringify({ name: bundle.name, version: bundle.version, hash: bundle.hash, files: hashes, ...(origin ? { origin } : {}) }, null, 2), "utf8");
     return { written: filesWritten, unchanged, conflicts };
 }

package/dist/uri.d.ts

@@ -1,7 +1,7 @@
 export type BrainResource = {
     version: 1;
     areaId: string;
-    resourceType: "area" | "note" | "source";
+    resourceType: "area" | "note" | "source" | "skill";
     resourceId?: string;
 };
 export declare function parseBrainResource(input: string): BrainResource;

package/dist/uri.js

@@ -21,7 +21,7 @@ function parseSegments(pathname) {
         throw new Error("Unsupported brain URI form");
     const areaId = assertId(segments[0], "area ID");
     const resourceType = segments[1];
-    if (resourceType !== "note" && resourceType !== "source") {
+    if (resourceType !== "note" && resourceType !== "source" && resourceType !== "skill") {
         throw new Error("Unsupported brain resource type");
     }
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dayofweek/dcli",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "CLI for the Day of Week AgTech platform — read data and submit proposals for review",
   "license": "MIT",
   "type": "module",