@drawcall/market 0.1.26 → 0.1.28

package/src/install.ts

@@ -4,11 +4,13 @@
  * 1. Downloads public asset files into ./public/... via the oRPC client.
  * 2. Merges npm dependencies into package.json.
  * 3. Runs the package manager to install npm deps.
+ * 4. Installs skill dependencies via the `skills` CLI (`skills add <source>`).
  *
- * NOTE: This module uses Node.js APIs (fs, path, nypm) and is only
- * used by the CLI binary; it is NOT exported from the package index.
+ * NOTE: This module uses Node.js APIs (fs, path, nypm, child_process) and is
+ * only used by the CLI binary; it is NOT exported from the package index.
  */
 
+import { execFile } from 'child_process'
 import * as fs from 'fs/promises'
 import * as path from 'path'
 import { unzipSync } from 'fflate'
@@ -28,6 +30,12 @@ export interface InstallOptions {
   cwd?: string
   /** Log progress */
   onProgress?: (message: string) => void
+  /**
+   * Override how a single resolved skill source is installed. The default
+   * shells out to `npx skills add <source> -y`. Exposed for tests and for
+   * callers that want to drive a different skills runner.
+   */
+  runSkillAdd?: (source: string, cwd: string) => Promise<void>
 }
 
 export interface InstalledAsset {
@@ -39,6 +47,8 @@ export interface InstalledAsset {
 export interface InstallResult {
   assets: InstalledAsset[]
   npmDependencies: Record<string, string>
+  /** Installed skills, keyed by label, with the source passed to `skills add`. */
+  skillDependencies: Record<string, string>
 }
 
 export async function install(
@@ -54,28 +64,34 @@ export async function install(
     installNpmDeps(resolution, installRoot, log),
   ])
 
+  // Skills are installed after asset files land on disk: a skill source may be
+  // a local path pointing at a skill directory shipped inside an installed
+  // asset, which only exists once downloadAssets has completed.
+  const skillDependencies = await installSkills(
+    resolution,
+    installRoot,
+    log,
+    opts.runSkillAdd ?? defaultRunSkillAdd,
+  )
+
   return {
     assets,
     npmDependencies: resolution.npmDependencies,
+    skillDependencies,
   }
 }
 
 export async function findInstallRoot(cwd: string = process.cwd()): Promise<string> {
   const start = path.resolve(cwd)
-  let packageRoot: string | null = null
 
-  let dir = start
-  while (true) {
+  for (let dir = start; ; dir = path.dirname(dir)) {
     if (await isFile(path.join(dir, 'package.json'))) {
-      packageRoot = dir
+      return dir
+    }
+    if (path.dirname(dir) === dir) {
+      return start
     }
-
-    const parent = path.dirname(dir)
-    if (parent === dir) break
-    dir = parent
   }
-
-  return packageRoot ?? start
 }
 
 async function downloadAssets(
@@ -147,22 +163,82 @@ async function installNpmDeps(
   if (Object.keys(deps).length === 0) return
 
   const pkgPath = path.join(projectRoot, 'package.json')
-  let pkg: PackageJson
-  try {
-    pkg = JSON.parse(await fs.readFile(pkgPath, 'utf-8')) as PackageJson
-  } catch {
-    pkg = { name: 'my-project', private: true, dependencies: {} }
-  }
+  // Only synthesize a package.json when none exists. A malformed existing file
+  // is a real error that must surface — never silently overwrite it.
+  const pkg: PackageJson = (await isFile(pkgPath))
+    ? (JSON.parse(await fs.readFile(pkgPath, 'utf-8')) as PackageJson)
+    : { name: 'my-project', private: true, dependencies: {} }
 
   pkg.dependencies = { ...pkg.dependencies, ...deps }
   await fs.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n')
 
   log(`Installing npm dependencies: ${Object.keys(deps).join(', ')}`)
 
-  const pm = await detectPackageManager(projectRoot).catch(() => null)
+  const pm = await detectPackageManager(projectRoot)
   const pmName = pm?.name ?? 'npm'
 
   log(`Using ${pmName}...`)
   await installDependencies({ cwd: projectRoot, packageManager: { name: pmName, command: pmName } })
   log('npm dependencies installed.')
 }
+
+async function installSkills(
+  resolution: ResolveResult,
+  projectRoot: string,
+  log: (msg: string) => void,
+  runSkillAdd: (source: string, cwd: string) => Promise<void>,
+): Promise<Record<string, string>> {
+  const skills = resolution.skillDependencies ?? {}
+  const entries = Object.entries(skills)
+  if (entries.length === 0) return {}
+
+  for (const [label, source] of entries) {
+    const resolvedSource = resolveSkillSource(source, projectRoot)
+    log(`Installing skill ${label} (${source})...`)
+    await runSkillAdd(resolvedSource, projectRoot)
+  }
+
+  log(`Skills installed: ${entries.map(([label]) => label).join(', ')}`)
+  return skills
+}
+
+/**
+ * Resolve a skill source to the argument passed to `skills add`. Local paths
+ * (`./`, `../`, `.`, `..`, or absolute) are resolved against the install root
+ * so they point at a skill directory shipped inside an installed asset; every
+ * other form (GitHub shorthand, git/HTTP(S) URL, `tree/<branch>/<subpath>`) is
+ * a remote ref and is passed through untouched.
+ */
+function resolveSkillSource(source: string, projectRoot: string): string {
+  return isLocalSkillPath(source) ? path.resolve(projectRoot, source) : source
+}
+
+function isLocalSkillPath(source: string): boolean {
+  return (
+    path.isAbsolute(source) ||
+    source === '.' ||
+    source === '..' ||
+    source.startsWith('./') ||
+    source.startsWith('../') ||
+    /^[a-zA-Z]:[/\\]/.test(source)
+  )
+}
+
+/**
+ * Install one skill via `npx skills add <source> -y`. When run inside a coding
+ * agent the `skills` CLI auto-detects the agent and installs non-interactively;
+ * `-y` keeps it non-interactive everywhere else. npx resolves (and caches) the
+ * `skills` package on first use.
+ */
+function defaultRunSkillAdd(source: string, cwd: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    execFile('npx', ['--yes', 'skills', 'add', source, '-y'], { cwd }, (error, _stdout, stderr) => {
+      if (error) {
+        const detail = stderr.trim() || error.message
+        reject(new Error(`Failed to install skill "${source}": ${detail}`))
+        return
+      }
+      resolve()
+    })
+  })
+}

package/src/output.ts

@@ -57,6 +57,15 @@ export function installResult(result: InstallResult): string {
     )
   }
 
+  const skillDependencies = Object.entries(result.skillDependencies ?? {})
+  if (skillDependencies.length > 0) {
+    lines.push(
+      ...skillDependencies
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([label, source]) => `- ${label} ← ${source} (skill)`),
+    )
+  }
+
   return lines.join('\n')
 }
 

package/src/resolve.ts

@@ -2,9 +2,10 @@
  * Dependency resolver for market assets.
  *
  * 1. Collects the target assets and all transitive asset dependencies.
- * 2. For each asset, finds a version that satisfies ALL constraints from
- *    every dependent.
- * 3. Merges npm dependency ranges across all resolved assets and checks
+ * 2. For each asset, takes the latest published version and verifies it
+ *    satisfies ALL constraints from every dependent. (Only the latest
+ *    version is resolved; older versions are not considered.)
+ * 3. Intersects npm dependency ranges across all resolved assets and checks
  *    that they are compatible.
  */
 
@@ -17,11 +18,13 @@ export interface ResolvedAsset {
   version: string
   npmDependencies: Record<string, string>
   assetDependencies: Record<string, string>
+  skillDependencies: Record<string, string>
 }
 
 export interface ResolveResult {
   assets: ResolvedAsset[]
   npmDependencies: Record<string, string>
+  skillDependencies: Record<string, string>
 }
 
 interface AssetRequest {
@@ -58,30 +61,34 @@ export async function resolve(
       }
 
       if (!opts.includeUnapproved && !meta.approved) {
-        throw new ResolutionError(
-          `Asset "${assetName}" has no ${opts.includeUnapproved ? '' : 'approved '}versions.`,
-        )
+        throw new ResolutionError(`Asset "${assetName}" has no approved versions.`)
       }
 
+      // The market publishes immutable versions and resolution targets the
+      // latest published version of each asset. A range that excludes the
+      // latest version is therefore unsatisfiable (older versions are not
+      // resolved), which this message makes explicit.
       const assetConstraints = constraints.get(assetName) ?? []
       if (!assetConstraints.every((c) => semver.satisfies(meta.latestVersion, c.range))) {
         const constraintDesc = assetConstraints
           .map((c) => `  ${c.range} (from ${c.from})`)
           .join('\n')
         throw new ResolutionError(
-          `No version of "${assetName}" satisfies all constraints:\n${constraintDesc}\n` +
-            `Available${opts.includeUnapproved ? '' : ' approved'}: ${meta.latestVersion}`,
+          `The latest${opts.includeUnapproved ? '' : ' approved'} version of "${assetName}" ` +
+            `(${meta.latestVersion}) does not satisfy all constraints:\n${constraintDesc}`,
         )
       }
 
-      const npmDeps: Record<string, string> = JSON.parse(meta.npmDependencies)
-      const assetDeps: Record<string, string> = JSON.parse(meta.assetDependencies)
+      const npmDeps = parseDependencies(meta.npmDependencies, assetName, 'npm')
+      const assetDeps = parseDependencies(meta.assetDependencies, assetName, 'asset')
+      const skillDeps = parseDependencies(meta.skillDependencies, assetName, 'skill')
 
       resolved.set(assetName, {
         name: assetName,
         version: meta.latestVersion,
         npmDependencies: npmDeps,
         assetDependencies: assetDeps,
+        skillDependencies: skillDeps,
       })
 
       for (const [depName, depRange] of Object.entries(assetDeps)) {
@@ -106,15 +113,61 @@ export async function resolve(
     }
   }
 
-  // Merge npm dependencies across all resolved assets
+  // Merge npm and skill dependencies across all resolved assets
   const mergedNpm = mergeNpmDependencies(Array.from(resolved.values()))
+  const mergedSkills = mergeSkillDependencies(Array.from(resolved.values()))
 
   return {
     assets: Array.from(resolved.values()),
     npmDependencies: mergedNpm,
+    skillDependencies: mergedSkills,
   }
 }
 
+/**
+ * Merge skill dependencies from all resolved assets. Skills are not versioned
+ * by the resolver — each entry is a label mapped to a `skills add` source — so
+ * the merge is a simple union. The same label declared by two assets must point
+ * at the same source; otherwise installing one would silently shadow the other.
+ */
+function mergeSkillDependencies(assets: ResolvedAsset[]): Record<string, string> {
+  const merged: Record<string, string> = {}
+  const origin: Record<string, string> = {}
+
+  for (const asset of assets) {
+    const from = `${asset.name}@${asset.version}`
+    for (const [label, source] of Object.entries(asset.skillDependencies)) {
+      if (label in merged && merged[label] !== source) {
+        throw new ResolutionError(
+          `skill dependency conflict for "${label}":\n` +
+            `  ${merged[label]} (from ${origin[label]})\n` +
+            `  ${source} (from ${from})`,
+        )
+      }
+      merged[label] = source
+      origin[label] = from
+    }
+  }
+
+  return merged
+}
+
+function parseDependencies(
+  value: string,
+  assetName: string,
+  kind: 'npm' | 'asset' | 'skill',
+): Record<string, string> {
+  try {
+    const parsed = JSON.parse(value || '{}') as unknown
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return parsed as Record<string, string>
+    }
+  } catch {
+    // fall through to a clear error below
+  }
+  throw new ResolutionError(`Asset "${assetName}" has malformed ${kind} dependency metadata.`)
+}
+
 function addConstraint(
   constraints: Map<string, { range: string; from: string }[]>,
   name: string,
@@ -151,7 +204,8 @@ async function fetchMeta(
 /**
  * Merge npm dependency ranges from all resolved assets.
  * For each package, check that all declared ranges are compatible
- * (using semver.intersects). Return the narrowest range.
+ * (using semver.intersects), then return the single declared range that is a
+ * subset of every other — the true intersection.
  */
 function mergeNpmDependencies(assets: ResolvedAsset[]): Record<string, string> {
   // Collect all ranges per package
@@ -181,18 +235,23 @@ function mergeNpmDependencies(assets: ResolvedAsset[]): Record<string, string> {
       }
     }
 
-    // Use the narrowest (most constrained) range.
-    // Simple heuristic: pick the range with the highest minimum version.
-    let narrowest = ranges[0].range
-    for (const r of ranges.slice(1)) {
-      const minCurrent = semver.minVersion(narrowest)
-      const minNew = semver.minVersion(r.range)
-      if (minCurrent && minNew && semver.gt(minNew, minCurrent)) {
-        narrowest = r.range
-      }
+    // Use the single declared range that is contained in every other declared
+    // range — the true intersection of all constraints. Picking by "highest
+    // minimum version" is unsound: a range with a higher minimum can also have
+    // a higher (or open) upper bound, silently dropping another dependent's
+    // upper bound. If no single range represents the intersection, it cannot be
+    // expressed as one package.json range, so fail loudly.
+    const narrowest = ranges.find((candidate) =>
+      ranges.every((other) => semver.subset(candidate.range, other.range)),
+    )
+    if (!narrowest) {
+      throw new ResolutionError(
+        `npm dependency ranges for "${pkg}" overlap but cannot be combined into a single range:\n` +
+          ranges.map((r) => `  ${r.range} (from ${r.from})`).join('\n'),
+      )
     }
 
-    merged[pkg] = narrowest
+    merged[pkg] = narrowest.range
   }
 
   return merged

package/src/schemas.ts

@@ -39,6 +39,11 @@ export const npmDependenciesSchema = z.record(z.string(), z.string()).default({}
 
 export const assetDependenciesSchema = z.record(z.string(), z.string()).default({})
 
+// Maps a skill label to a `skills add` source: a remote ref (owner/repo,
+// git/HTTP URL, tree/<branch>/<subpath>) or a local path to a skill directory
+// shipped inside the asset.
+export const skillDependenciesSchema = z.record(z.string(), z.string()).default({})
+
 export const updateProfileSchema = z.object({
   name: z.string().min(1).max(100).optional(),
   image: z.string().url().optional(),
@@ -66,6 +71,7 @@ export const uploadZipSchema = z.object({
   description: z.string().max(1000).optional(),
   npmDependencies: npmDependenciesSchema,
   assetDependencies: assetDependenciesSchema,
+  skillDependencies: skillDependenciesSchema,
   tags: z.array(z.string()).default([]),
 })
 

package/src/skill.ts

@@ -5,38 +5,45 @@ description: Find, preview, install, generate, and publish Drawcall Market asset
 
 # Drawcall Market
 
-Use the \`market\` CLI. Keep commands short and read the summary line plus asset bullets.
+Use the \`market\` CLI. Keep commands short and read the summary lines.
 
 ## Quick Start
 
 \`\`\`sh
 market search "wooden chair" --type model --limit 3
-market install wooden-chair --type model --cwd "$PWD"
+market install wooden-chair --cwd "$PWD"
 market preview wooden-chair --out /tmp/wooden-chair.png
 \`\`\`
 
 ## Workflow
 
-1. Search first unless the user gave an exact asset name.
-2. Search requires \`--type\`; use \`model\` unless the user names another supported type: \`humanoid-model\`, \`texture\`, \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`, or \`environment\`.
-3. Use \`--limit 1\` for lookup, \`--limit 3\` for choice. Search caps at 5.
-4. Use \`--verbose\` only when the one-line descriptions are not enough.
+1. Search first unless the user already gave an exact asset name. \`search\` requires \`--type\`; use \`model\` unless the user names another supported type: \`humanoid-model\`, \`texture\`, \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`, or \`environment\`.
+2. Use \`--limit 1\` for lookup, \`--limit 3\` for choice. Search caps at 5. Add \`--verbose\` only when the one-line descriptions are not enough.
+3. \`install\` takes one or more exact asset names (optionally \`name@range\`); it does not search or generate. Find names with \`search\` first. No \`--type\` is needed — asset names are unique.
+4. \`preview <name>\` saves the preview image; no \`--type\` is needed. Not every type has previews (e.g. \`humanoid-animation\`, \`template\`, \`sound-effect\`, \`background-music\`); the CLI reports when one is unavailable.
 5. Use \`--unapproved\` only when the user asks for unapproved/private/admin assets. Do not install unapproved assets without explicit acceptance.
-6. Preview before installing when visual fit matters: \`market preview <name> --out <file>\`. Preview is not supported for \`humanoid-animation\`, \`template\`, \`sound-effect\`, or \`background-music\`.
-7. Generate only when the user wants a new asset, auth is available, and the requested asset type supports generation. No asset type currently supports generation.
-8. Upload only when publishing is requested.
-9. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
+6. \`generate --type <type> "<prompt>"\` creates a new asset; it requires login and a type that supports generation. No asset type currently supports generation.
+7. Upload only when publishing is requested: \`market upload <name> <zip> "<description>" --type <type>\`. Declare dependencies with repeatable flags: \`--npm name@range\`, \`--asset name@range\`, \`--skill label=source\` (source is a GitHub/git ref or a local path to a skill directory inside the zip). Example: \`market upload my-scene scene.zip "A scene" --type model --npm three@^0.178.0 --skill web-design=vercel-labs/agent-skills\`.
+8. Installed \`environment\` assets contain \`public/environment/<name>.hdr\` for Three.js IBL lighting and \`public/environment/<name>-background.webp\` for the visible equirectangular background. Use \`market preview\` to fetch the preview image separately.
 
 ## Output
 
-Commands print concise summaries:
+Commands print concise, line-oriented summaries:
 
 \`\`\`text
 Results: 2/8 query="wooden chair" type=model approval=approved
 - wooden-chair@1.0.0 | model | approved | Low-poly wooden chair
-Installed 1 asset: wooden-chair@1.0.0
+Installed:
+- wooden-chair@1.0.0 (asset)
+  files:
+    public/model
+    └─ wooden-chair.glb
+- three@^0.178.0 (npm)
+- web-design-guidelines ← vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)
 Saved preview for wooden-chair@1.0.0: /tmp/wooden-chair.png
 \`\`\`
 
+Assets may also declare \`skill\` dependencies, installed for you via the \`skills\` CLI (\`skills add\`) during \`install\`. Sources are either a GitHub/git ref or a local path to a skill directory shipped inside the asset. This requires \`npx\` to be available.
+
 If search returns no results, try one broader noun phrase. If a command returns \`Error: Not logged in...\`, ask before running \`market login\`.
 `

package/tests/install-command.test.ts

@@ -2,17 +2,10 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 import { resolveArg } from '../src/commands/install.js'
 
-test('resolveArg reports unapproved explicit assets instead of falling through to generation', async () => {
-  let searchCalls = 0
+test('resolveArg reports unapproved explicit assets clearly', async () => {
   const client = {
     asset: {
-      exact: async ({
-        includeUnapproved,
-      }: {
-        name: string
-        type?: string
-        includeUnapproved: boolean
-      }) =>
+      exact: async ({ includeUnapproved }: { name: string; includeUnapproved: boolean }) =>
         includeUnapproved
           ? {
               name: 'qwantani-moon-noon-puresky',
@@ -20,59 +13,33 @@ test('resolveArg reports unapproved explicit assets instead of falling through t
               approved: false,
             }
           : null,
-      search: async () => {
-        searchCalls += 1
-        return { items: [], total: 0, page: 1, limit: 1, totalPages: 0 }
-      },
     },
   } as never
 
   await assert.rejects(
-    resolveArg(
-      client,
-      'qwantani-moon-noon-puresky@1.0.2',
-      'environment',
-      silentSpinner(),
-      true,
-      false,
-    ),
+    resolveArg(client, 'qwantani-moon-noon-puresky@1.0.2', false),
     /has no approved versions/u,
   )
-
-  assert.equal(searchCalls, 0)
 })
 
-test('resolveArg keeps explicit versioned asset refs exact when nothing matches yet', async () => {
-  let searchCalls = 0
+test('resolveArg keeps explicit versioned refs exact when the asset exists', async () => {
   const client = {
     asset: {
-      exact: async () => null,
-      search: async () => {
-        searchCalls += 1
-        return { items: [], total: 0, page: 1, limit: 1, totalPages: 0 }
-      },
+      exact: async () => ({ name: 'fresh-sky', latestVersion: '1.2.3', approved: true }),
     },
   } as never
 
-  const request = await resolveArg(
-    client,
-    'fresh-sky@1.2.3',
-    'environment',
-    silentSpinner(),
-    true,
-    false,
-  )
+  const request = await resolveArg(client, 'fresh-sky@1.2.3', false)
 
   assert.deepEqual(request, { name: 'fresh-sky', range: '1.2.3' })
-  assert.equal(searchCalls, 0)
 })
 
-function silentSpinner() {
-  return {
-    text: '',
-    info() {},
-    start() {
-      return this
+test('resolveArg errors when the asset does not exist instead of deferring', async () => {
+  const client = {
+    asset: {
+      exact: async () => null,
     },
   } as never
-}
+
+  await assert.rejects(resolveArg(client, 'does-not-exist@1.2.3', false), /not found/u)
+})

package/tests/install-layout.test.ts

@@ -30,9 +30,11 @@ test('install writes zip files into the package root', async () => {
           version: '1.0.0',
           npmDependencies: {},
           assetDependencies: {},
+          skillDependencies: {},
         },
       ],
       npmDependencies: {},
+      skillDependencies: {},
     },
     { cwd },
   )
@@ -46,6 +48,7 @@ test('install writes zip files into the package root', async () => {
       },
     ],
     npmDependencies: {},
+    skillDependencies: {},
   })
   assert.equal(
     await fs.readFile(path.join(appRoot, 'public', 'humanoid-animation', 'idle-loop.glb'), 'utf-8'),
@@ -75,9 +78,11 @@ test('install rejects zip paths that escape through parent segments', async () =
             version: '1.0.0',
             npmDependencies: {},
             assetDependencies: {},
+            skillDependencies: {},
           },
         ],
         npmDependencies: {},
+        skillDependencies: {},
       },
       { cwd: tempDir },
     ),
@@ -85,7 +90,60 @@ test('install rejects zip paths that escape through parent segments', async () =
   )
 })
 
-test('findInstallRoot ignores public directories and uses the highest package.json', async () => {
+test('install runs the skills runner per dependency, resolving local paths against the root', async () => {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'market-skills-'))
+  const appRoot = path.join(tempDir, 'app')
+  const cwd = path.join(appRoot, 'src')
+  await fs.mkdir(cwd, { recursive: true })
+  await fs.writeFile(path.join(appRoot, 'package.json'), '{}\n')
+
+  const calls: Array<{ source: string; cwd: string }> = []
+
+  const result = await install(
+    clientWithZip({
+      'public/skills/local-skill/SKILL.md': textEncoder.encode('---\nname: local-skill\n---\n'),
+    }),
+    {
+      assets: [
+        {
+          name: 'with-skills',
+          version: '1.0.0',
+          npmDependencies: {},
+          assetDependencies: {},
+          skillDependencies: {},
+        },
+      ],
+      npmDependencies: {},
+      skillDependencies: {
+        'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+        'local-skill': './public/skills/local-skill',
+      },
+    },
+    {
+      cwd,
+      runSkillAdd: async (source, runnerCwd) => {
+        calls.push({ source, cwd: runnerCwd })
+      },
+    },
+  )
+
+  // Every runner call uses the install root (the dir holding package.json).
+  assert.deepEqual(new Set(calls.map((c) => c.cwd)), new Set([appRoot]))
+
+  const bySource = new Map(calls.map((c) => [c.source, c]))
+  // Remote refs are passed through untouched.
+  assert.ok(bySource.has('vercel-labs/agent-skills/tree/main/skills/web-design-guidelines'))
+  // Local paths are resolved against the install root, not the cwd.
+  assert.ok(bySource.has(path.join(appRoot, 'public', 'skills', 'local-skill')))
+  assert.equal(calls.length, 2)
+
+  assert.deepEqual(result.skillDependencies, {
+    'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+    'local-skill': './public/skills/local-skill',
+  })
+})
+
+test('findInstallRoot uses the nearest package.json, not the monorepo root', async () => {
   const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'market-root-'))
   const repoRoot = path.join(tempDir, 'repo')
   const appRoot = path.join(repoRoot, 'packages', 'app')
@@ -95,7 +153,7 @@ test('findInstallRoot ignores public directories and uses the highest package.js
   await fs.writeFile(path.join(repoRoot, 'package.json'), '{}\n')
   await fs.writeFile(path.join(appRoot, 'package.json'), '{}\n')
 
-  assert.equal(await findInstallRoot(cwd), repoRoot)
+  assert.equal(await findInstallRoot(cwd), appRoot)
 })
 
 test('findInstallRoot falls back to cwd when no package.json exists', async () => {

package/tests/output.test.ts

@@ -18,6 +18,7 @@ test('installResult prints asset and npm lists with a file tree', () => {
         },
       ],
       npmDependencies: { '@react-three/drei': 'latest' },
+      skillDependencies: {},
     }),
     `Installed:
 - wooden-chair@1.2.0 (asset)
@@ -35,3 +36,20 @@ test('installResult prints asset and npm lists with a file tree', () => {
 - @react-three/drei@latest (npm)`,
   )
 })
+
+test('installResult lists installed skills with their source', () => {
+  assert.equal(
+    installResult({
+      assets: [{ name: 'wooden-chair', version: '1.2.0', files: [] }],
+      npmDependencies: {},
+      skillDependencies: {
+        'web-design-guidelines': 'vercel-labs/agent-skills/tree/main/skills/web-design-guidelines',
+        'local-skill': '/abs/public/skills/local-skill',
+      },
+    }),
+    `Installed:
+- wooden-chair@1.2.0 (asset)
+- local-skill ← /abs/public/skills/local-skill (skill)
+- web-design-guidelines ← vercel-labs/agent-skills/tree/main/skills/web-design-guidelines (skill)`,
+  )
+})