@dreamlogic-ai/cli 1.0.0 → 2.0.1

package/dist/commands/install.js

@@ -2,10 +2,12 @@
  * install command — download and install skills
  * Supports: interactive multi-select, single skill by name, --from-file
  */
-import { checkbox, confirm } from "@inquirer/prompts";
+import * as clack from "@clack/prompts";
+import { join } from "path";
 import { ApiClient } from "../lib/api-client.js";
 import { getServer, getInstallDir, loadInstalled } from "../lib/config.js";
 import { installSkill } from "../lib/installer.js";
+import { detectAgents, registerSkillWithAgents } from "../lib/agents.js";
 import { ui } from "../lib/ui.js";
 import { requireAuth } from "./helpers.js";
 import chalk from "chalk";
@@ -36,31 +38,37 @@ export async function installCommand(skillIds, opts) {
             ui.info("No skills available yet.");
             return;
         }
-        const choices = skills.map((s) => {
+        const options = skills.map((s) => {
             const isInstalled = !!installed[s.id];
             const ver = s.latest_version || "unknown";
             const currentVer = installed[s.id]?.version;
-            let tag = "";
+            let hint = "";
             if (!isInstalled) {
-                tag = chalk.green(" [NEW]");
+                hint = chalk.green("NEW");
             }
             else if (currentVer && s.latest_version && currentVer !== s.latest_version) {
-                tag = chalk.yellow(` [UPDATE: ${currentVer} → ${s.latest_version}]`);
+                hint = chalk.yellow(`UPDATE: ${currentVer} → ${s.latest_version}`);
             }
             else {
-                tag = chalk.dim(" [INSTALLED]");
+                hint = chalk.dim("installed");
             }
             return {
-                name: `${s.name} (${ver}) — ${s.description}${tag}`,
+                label: `${s.name} (${ver})`,
                 value: s.id,
-                checked: !isInstalled, // auto-check new skills
+                hint: `${s.description} ${hint}`,
             };
         });
         console.log();
-        selectedIds = await checkbox({
-            message: "Select skills to install (Space to select, Enter to confirm):",
-            choices,
+        const selected = await clack.multiselect({
+            message: "Select skills to install:",
+            options,
+            required: true,
         });
+        if (clack.isCancel(selected)) {
+            clack.cancel("Installation cancelled.");
+            return;
+        }
+        selectedIds = selected;
         if (selectedIds.length === 0) {
             ui.info("Nothing selected.");
             return;
@@ -85,21 +93,20 @@ export async function installCommand(skillIds, opts) {
     }
     // Confirm
     if (!opts.yes) {
-        console.log();
-        ui.header("Installation Plan");
-        for (const id of selectedIds) {
+        const planLines = selectedIds.map((id) => {
             const s = skills.find((s) => s.id === id);
             if (!s)
-                continue; // R1-19: guard
+                return `  ${id}`;
             const ver = s.latest_version || "unknown";
-            const size = s.package_size ? ui.fileSize(s.package_size) : "unknown";
-            ui.line(`  📦 ${chalk.bold(s.name)} ${ver} (${size})`);
-        }
-        ui.line(`  📂 Install to: ${getInstallDir()}`);
-        console.log();
-        const ok = await confirm({ message: "Proceed?", default: true });
-        if (!ok) {
-            ui.info("Cancelled.");
+            const size = s.package_size ? ui.fileSize(s.package_size) : "?";
+            return `${chalk.bold(s.name)} ${chalk.dim(ver)} (${size})`;
+        });
+        planLines.push("");
+        planLines.push(`${chalk.dim("Install to:")} ${getInstallDir()}`);
+        ui.panel("Installation Plan", planLines.join("\n"));
+        const ok = await clack.confirm({ message: "Proceed?", initialValue: true });
+        if (clack.isCancel(ok) || !ok) {
+            clack.cancel("Cancelled.");
             return;
         }
     }
@@ -110,7 +117,7 @@ export async function installCommand(skillIds, opts) {
         if (!s) {
             ui.err(`Skill '${id}' no longer in catalog`);
             continue;
-        } // R1-19
+        }
         console.log();
         ui.header(`Installing ${s.name}`);
         try {
@@ -124,15 +131,65 @@ export async function installCommand(skillIds, opts) {
     }
     console.log();
     if (successCount === selectedIds.length) {
-        ui.ok(`All ${successCount} skill(s) installed successfully! 🎉`);
+        ui.ok(`All ${successCount} skill(s) installed successfully!`);
     }
     else {
         ui.warning(`${successCount}/${selectedIds.length} installed. Check errors above.`);
     }
+    // ── Agent Registration Step ──
+    if (successCount > 0 && !opts.yes) {
+        console.log();
+        const { universal, detected } = detectAgents();
+        const totalAgents = universal.length + detected.length;
+        if (totalAgents > 0) {
+            // Build options grouped by category
+            const agentOptions = [];
+            // Universal agents header
+            for (const agent of universal) {
+                agentOptions.push({
+                    label: agent.name,
+                    value: `u:${agent.name}`,
+                    hint: "universal (.agents/skills)",
+                });
+            }
+            // Detected additional agents
+            for (const agent of detected) {
+                agentOptions.push({
+                    label: agent.name,
+                    value: `a:${agent.name}`,
+                    hint: `detected (${agent.skillsDir})`,
+                });
+            }
+            const agentChoice = await clack.multiselect({
+                message: `Register skills with AI agents? (${totalAgents} agents available)`,
+                options: agentOptions,
+                required: false,
+            });
+            if (!clack.isCancel(agentChoice) && agentChoice.length > 0) {
+                const chosenNames = agentChoice.map(v => v.replace(/^[ua]:/, ""));
+                const allAgents = [...universal, ...detected];
+                const chosenAgents = allAgents.filter(a => chosenNames.includes(a.name));
+                // Register each installed skill with chosen agents
+                const installDir = getInstallDir();
+                for (const id of selectedIds) {
+                    const skillPath = join(installDir, id);
+                    const results = registerSkillWithAgents(id, skillPath, chosenAgents);
+                    const created = results.filter(r => r.status === "created").length;
+                    const errors = results.filter(r => r.status === "error");
+                    if (created > 0) {
+                        ui.ok(`${id}: registered with ${created} agent location(s)`);
+                    }
+                    for (const e of errors) {
+                        ui.warning(`${e.agent}: ${e.error}`);
+                    }
+                }
+            }
+        }
+    }
     // Suggest MCP setup
     if (successCount > 0) {
         console.log();
         ui.info("To configure MCP for your AI agent, run:");
-        ui.line(`  ${chalk.cyan("dreamlogic setup-mcp")}`);
+        ui.line(chalk.cyan("dreamlogic setup-mcp"));
     }
 }

package/dist/commands/list.js

@@ -12,7 +12,7 @@ export function listCommand() {
         return;
     }
     console.log();
-    ui.line(`📂 Install directory: ${getInstallDir()}`);
+    ui.line(`Install directory: ${getInstallDir()}`);
     console.log();
     for (const [id, info] of entries) {
         ui.line(`  ${chalk.green("●")} ${chalk.bold(id)}`);

package/dist/commands/login.js

@@ -1,7 +1,7 @@
 /**
  * login command — authenticate and save API key
  */
-import { password, confirm } from "@inquirer/prompts";
+import * as clack from "@clack/prompts";
 import { ApiClient, ApiError } from "../lib/api-client.js";
 import { loadConfig, saveConfig, getApiKey, getServer, maskKey, getDefaultInstallDir, } from "../lib/config.js";
 import { DEFAULT_SERVER } from "../types.js";
@@ -11,11 +11,11 @@ export async function loginCommand(opts) {
     const existingKey = getApiKey();
     if (existingKey && !opts.key) {
         ui.info(`Already logged in as ${maskKey(existingKey)}`);
-        const relogin = await confirm({
+        const relogin = await clack.confirm({
             message: "Re-authenticate with a different key?",
-            default: false,
+            initialValue: false,
         });
-        if (!relogin)
+        if (clack.isCancel(relogin) || !relogin)
             return;
     }
     let apiKey = opts.key || "";
@@ -25,11 +25,19 @@ export async function loginCommand(opts) {
         ui.info("Prefer: dreamlogic login (interactive) or DREAMLOGIC_API_KEY env var");
     }
     if (!apiKey) {
-        apiKey = await password({
+        const keyInput = await clack.password({
             message: "Enter your Dreamlogic API Key:",
             mask: "*",
-            validate: (v) => KEY_RE.test(v) || "Key must match format: sk-user-xxxx... or sk-admin-xxxx...",
+            validate: (v) => {
+                if (!v || !KEY_RE.test(v))
+                    return "Key must match format: sk-user-xxxx... or sk-admin-xxxx...";
+            },
         });
+        if (clack.isCancel(keyInput)) {
+            clack.cancel("Login cancelled.");
+            return;
+        }
+        apiKey = keyInput;
     }
     if (!KEY_RE.test(apiKey)) {
         ui.err("Invalid key format. Expected: sk-user-xxxx... or sk-admin-xxxx...");

package/dist/commands/logout.js

@@ -1,7 +1,7 @@
 /**
  * logout command — clear saved credentials
  */
-import { confirm } from "@inquirer/prompts";
+import * as clack from "@clack/prompts";
 import { clearConfig, maskKey, getApiKey } from "../lib/config.js";
 import { ui } from "../lib/ui.js";
 export async function logoutCommand() {
@@ -11,9 +11,9 @@ export async function logoutCommand() {
         return;
     }
     ui.info(`Current key: ${maskKey(key)}`);
-    const ok = await confirm({ message: "Clear saved credentials?", default: true });
-    if (ok) {
-        clearConfig();
-        ui.ok("Credentials cleared.");
-    }
+    const ok = await clack.confirm({ message: "Clear saved credentials?", initialValue: true });
+    if (clack.isCancel(ok) || !ok)
+        return;
+    clearConfig();
+    ui.ok("Credentials cleared.");
 }

package/dist/commands/rollback.js

@@ -1,7 +1,7 @@
 /**
  * rollback command — restore previous version of a skill (D-13)
  */
-import { confirm } from "@inquirer/prompts";
+import * as clack from "@clack/prompts";
 import { rollbackSkill } from "../lib/installer.js";
 import { loadInstalled } from "../lib/config.js";
 import { ui } from "../lib/ui.js";
@@ -20,9 +20,9 @@ export async function rollbackCommand(skillId) {
     }
     ui.info(`Current: ${info.version}`);
     ui.info(`Rollback to: ${info.previous_version}`);
-    const ok = await confirm({ message: "Proceed with rollback?", default: true });
-    if (!ok) {
-        ui.info("Cancelled.");
+    const ok = await clack.confirm({ message: "Proceed with rollback?", initialValue: true });
+    if (clack.isCancel(ok) || !ok) {
+        clack.cancel("Cancelled.");
         return;
     }
     const spinner = ui.spinner("Rolling back...");

package/dist/commands/setup-mcp.js

@@ -8,7 +8,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "f
 import { join } from "path";
 import { homedir, platform } from "os";
 import { execFileSync } from "child_process";
-import { confirm } from "@inquirer/prompts";
+import * as clack from "@clack/prompts";
 import { getServer, maskKey } from "../lib/config.js";
 import { ui } from "../lib/ui.js";
 import { requireAuth } from "./helpers.js";
@@ -181,11 +181,11 @@ export async function setupMcpCommand(opts) {
             ui.info("(dry-run — no changes made)");
             continue;
         }
-        const ok = await confirm({
+        const ok = await clack.confirm({
             message: `Apply configuration for ${agent.name}?`,
-            default: true,
+            initialValue: true,
         });
-        if (!ok) {
+        if (clack.isCancel(ok) || !ok) {
             ui.info("Skipped.");
             continue;
         }

package/dist/commands/status.js

@@ -42,7 +42,7 @@ export async function statusCommand() {
     // Installed skills
     const entries = Object.entries(installed);
     console.log();
-    ui.line(`📦 Installed: ${entries.length} skill(s)`);
+    ui.line(`Installed: ${entries.length} skill(s)`);
     if (entries.length > 0) {
         // Check for updates if authenticated
         const apiKey = getApiKey();

package/dist/commands/update.js

@@ -1,7 +1,7 @@
 /**
  * update command — check for and apply skill updates
  */
-import { confirm, checkbox } from "@inquirer/prompts";
+import * as clack from "@clack/prompts";
 import { ApiClient } from "../lib/api-client.js";
 import { getServer, loadInstalled } from "../lib/config.js";
 import { installSkill } from "../lib/installer.js";
@@ -39,20 +39,19 @@ export async function updateCommand(opts) {
         const local = installed[id];
         const remote = skills.find((s) => s.id === id);
         if (!remote) {
-            ui.line(`  ${ui.warn("?")} ${id} — not found on server (removed?)`);
+            ui.line(`${ui.warn("?")} ${id} — not found on server (removed?)`);
             continue;
         }
         if (!remote.latest_version) {
-            ui.line(`  ${ui.dim("–")} ${remote.name} — no version info`);
+            ui.line(`${ui.muted("–")} ${remote.name} — no version info`);
             continue;
         }
-        // R1-16: Normalize version comparison (strip leading 'v')
         const normalizeVer = (v) => v.replace(/^v/, "");
         if (normalizeVer(local.version) === normalizeVer(remote.latest_version)) {
-            ui.line(`  ${chalk.green("✓")} ${remote.name} ${local.version} — up to date`);
+            ui.line(`${chalk.green("✓")} ${remote.name} ${local.version} — up to date`);
         }
         else {
-            ui.line(`  ${chalk.yellow("⬆")} ${chalk.bold(remote.name)} ${local.version} → ${chalk.green(remote.latest_version)}`);
+            ui.line(`${chalk.yellow("⬆")} ${chalk.bold(remote.name)} ${local.version} → ${chalk.green(remote.latest_version)}`);
             updates.push({
                 id: remote.id,
                 name: remote.name,
@@ -66,7 +65,7 @@ export async function updateCommand(opts) {
     }
     if (updates.length === 0) {
         console.log();
-        ui.ok("All skills are up to date! ✨");
+        ui.ok("All skills are up to date!");
         return;
     }
     console.log();
@@ -77,21 +76,26 @@ export async function updateCommand(opts) {
         selectedIds = updates.map((u) => u.id);
     }
     else if (updates.length === 1) {
-        const ok = await confirm({
+        const ok = await clack.confirm({
             message: `Update ${updates[0].name} to ${updates[0].latestVersion}?`,
-            default: true,
+            initialValue: true,
         });
-        selectedIds = ok ? [updates[0].id] : [];
+        selectedIds = (clack.isCancel(ok) || !ok) ? [] : [updates[0].id];
     }
     else {
-        selectedIds = await checkbox({
+        const selected = await clack.multiselect({
             message: "Select updates to apply:",
-            choices: updates.map((u) => ({
-                name: `${u.name} ${u.currentVersion} → ${u.latestVersion}${u.size ? ` (${ui.fileSize(u.size)})` : ""}`,
+            options: updates.map((u) => ({
+                label: `${u.name} ${u.currentVersion} → ${u.latestVersion}${u.size ? ` (${ui.fileSize(u.size)})` : ""}`,
                 value: u.id,
-                checked: true,
             })),
+            required: true,
         });
+        if (clack.isCancel(selected)) {
+            clack.cancel("Cancelled.");
+            return;
+        }
+        selectedIds = selected;
     }
     if (selectedIds.length === 0) {
         ui.info("No updates selected.");
@@ -102,10 +106,10 @@ export async function updateCommand(opts) {
     for (const id of selectedIds) {
         const u = updates.find((u) => u.id === id);
         if (!u)
-            continue; // R1-19
+            continue;
         console.log();
         ui.header(`Updating ${u.name}`);
-        ui.line(`  ${u.currentVersion} → ${chalk.green(u.latestVersion)}`);
+        ui.line(`${u.currentVersion} → ${chalk.green(u.latestVersion)}`);
         try {
             await installSkill(client, u.id, u.packageFile, u.sha256, u.latestVersion);
             ui.ok(`Updated to ${u.latestVersion}`);
@@ -118,7 +122,7 @@ export async function updateCommand(opts) {
     }
     console.log();
     if (successCount === selectedIds.length) {
-        ui.ok(`All ${successCount} update(s) applied! 🎉`);
+        ui.ok(`All ${successCount} update(s) applied!`);
     }
     else {
         ui.warning(`${successCount}/${selectedIds.length} updated. Check errors above.`);

package/dist/index.js

@@ -6,7 +6,7 @@
  * Install, update and manage AI agent skills for your team.
  */
 import { Command } from "commander";
-import { select } from "@inquirer/prompts";
+import * as clack from "@clack/prompts";
 import { CLI_VERSION, CLI_NAME, CLI_AUTHOR } from "./types.js";
 import { ui } from "./lib/ui.js";
 import { getApiKey } from "./lib/config.js";
@@ -81,28 +81,31 @@ program.action(async () => {
     ui.banner();
     const isLoggedIn = !!getApiKey();
     if (!isLoggedIn) {
-        ui.info("First time? Let's get you set up!");
+        ui.info("Welcome! Let's get you set up.");
         console.log();
         await loginCommand({});
         if (!getApiKey())
-            return; // login failed
+            return;
         console.log();
     }
-    // Interactive menu
+    // Interactive menu with @clack/prompts
     while (true) {
-        console.log();
-        const action = await select({
+        const action = await clack.select({
             message: "What would you like to do?",
-            choices: [
-                { name: "📦 Install skills", value: "install" },
-                { name: "🔄 Check for updates", value: "update" },
-                { name: "📋 List installed skills", value: "list" },
-                { name: "⚙️  Configure MCP for Agent", value: "setup-mcp" },
-                { name: "📊 Status overview", value: "status" },
-                { name: "📚 Browse skill catalog", value: "catalog" },
-                { name: "🚪 Exit", value: "exit" },
+            options: [
+                { value: "install", label: "Install skills", hint: "download new skills from server" },
+                { value: "update", label: "Check for updates", hint: "update installed skills" },
+                { value: "list", label: "List installed skills", hint: "show local installations" },
+                { value: "setup-mcp", label: "Configure MCP for Agent", hint: "auto-setup Claude/Cursor/Cline" },
+                { value: "status", label: "Status overview", hint: "full system status" },
+                { value: "catalog", label: "Browse skill catalog", hint: "see all available skills" },
+                { value: "exit", label: "Exit" },
             ],
         });
+        if (clack.isCancel(action)) {
+            ui.goodbye();
+            return;
+        }
         switch (action) {
             case "install":
                 await installCommand([], {});
@@ -131,21 +134,26 @@ program.action(async () => {
 // Handle errors gracefully
 program.exitOverride();
 async function main() {
+    // BUG-2: Warn if TLS verification is disabled
+    if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
+        ui.warning("NODE_TLS_REJECT_UNAUTHORIZED=0 detected — TLS verification disabled.");
+        ui.warning("This is a security risk. Remove it: set NODE_TLS_REJECT_UNAUTHORIZED=");
+    }
     try {
         await program.parseAsync(process.argv);
     }
     catch (err) {
         if (err && typeof err === "object" && "code" in err) {
             const code = err.code;
-            // Commander built-in exit (help, version)
             if (code === "commander.helpDisplayed" || code === "commander.version") {
                 return;
             }
         }
-        // User cancelled (Ctrl+C on inquirer)
-        if (err && typeof err === "object" && "name" in err && err.name === "ExitPromptError") {
+        // CLI-001: clack returns isCancel symbol (handled at each prompt site)
+        // Catch any remaining cancellation-like errors gracefully
+        if (err instanceof Error && /cancel/i.test(err.message)) {
             console.log();
-            ui.dim("  Cancelled.");
+            clack.cancel("Cancelled.");
             return;
         }
         ui.err(`Unexpected error: ${err.message}`);

package/dist/lib/agents.d.ts

@@ -0,0 +1,40 @@
+export interface AgentConfig {
+    name: string;
+    skillsDir: string;
+    envOverride?: string;
+    group: "universal" | "additional";
+    detect?: string;
+}
+/**
+ * Detect which agents are installed on this system
+ */
+export declare function detectAgents(): {
+    universal: AgentConfig[];
+    detected: AgentConfig[];
+};
+/**
+ * Get all available agents (universal + detected)
+ */
+export declare function getAllAgents(): AgentConfig[];
+/**
+ * Register a skill with specific agents by creating symlinks
+ * Returns array of { agent, path, status } results
+ */
+export declare function registerSkillWithAgents(skillId: string, skillPath: string, agents: AgentConfig[]): Array<{
+    agent: string;
+    path: string;
+    status: "created" | "updated" | "exists" | "error";
+    error?: string;
+}>;
+/**
+ * Unregister a skill from all agents (remove symlinks only)
+ */
+export declare function unregisterSkillFromAgents(skillId: string): number;
+/**
+ * List which agents have a specific skill registered
+ */
+export declare function getSkillAgentStatus(skillId: string): Array<{
+    agent: string;
+    registered: boolean;
+    path: string;
+}>;

package/dist/lib/agents.js

@@ -0,0 +1,173 @@
+/**
+ * Agent Registry — detect installed AI agents and register skills
+ * Inspired by skills.sh (vercel-labs/skills) agent directory mapping
+ *
+ * Pattern: Each agent has a known skills directory. We create symlinks
+ * from the agent's skills dir to the actual skill install location.
+ */
+import { existsSync, mkdirSync, symlinkSync, lstatSync, readlinkSync, unlinkSync } from "fs";
+import { join, resolve } from "path";
+import { homedir, platform } from "os";
+// ===== Agent Directory Map =====
+// Universal agents: always shown (use .agents/skills as shared dir)
+// Additional agents: shown only if detected on the system
+const AGENT_CONFIGS = [
+    // ── Universal (.agents/skills) ──
+    { name: "Amp", skillsDir: ".agents/skills", group: "universal" },
+    { name: "Cline", skillsDir: ".agents/skills", group: "universal" },
+    { name: "Codex", skillsDir: ".agents/skills", group: "universal", envOverride: "CODEX_HOME" },
+    { name: "Cursor", skillsDir: ".agents/skills", group: "universal" },
+    { name: "Deep Agents", skillsDir: ".agents/skills", group: "universal" },
+    { name: "Firebender", skillsDir: ".agents/skills", group: "universal" },
+    { name: "Gemini CLI", skillsDir: ".agents/skills", group: "universal" },
+    { name: "GitHub Copilot", skillsDir: ".agents/skills", group: "universal" },
+    { name: "Kimi Code CLI", skillsDir: ".agents/skills", group: "universal" },
+    { name: "OpenCode", skillsDir: ".agents/skills", group: "universal" },
+    { name: "Warp", skillsDir: ".agents/skills", group: "universal" },
+    // ── Additional agents ──
+    { name: "Augment", skillsDir: ".augment/skills", group: "additional", detect: ".augment" },
+    { name: "Claude Code", skillsDir: ".claude/skills", group: "additional", detect: ".claude", envOverride: "CLAUDE_CONFIG_DIR" },
+    { name: "OpenClaw", skillsDir: "skills", group: "additional", detect: "skills" },
+    { name: "CodeBuddy", skillsDir: ".codebuddy/skills", group: "additional", detect: ".codebuddy" },
+    { name: "Continue", skillsDir: ".continue/skills", group: "additional", detect: ".continue" },
+    { name: "Windsurf", skillsDir: ".codeium/windsurf/skills", group: "additional", detect: ".codeium" },
+    { name: "Goose", skillsDir: ".config/goose/skills", group: "additional", detect: ".config/goose" },
+    { name: "Roo Code", skillsDir: ".roo/skills", group: "additional", detect: ".roo" },
+    { name: "Trae", skillsDir: ".trae/skills", group: "additional", detect: ".trae" },
+    { name: "Void", skillsDir: ".void/skills", group: "additional", detect: ".void" },
+    { name: "Zed", skillsDir: ".config/zed/skills", group: "additional", detect: ".config/zed" },
+    { name: "Aider", skillsDir: ".aider/skills", group: "additional", detect: ".aider" },
+    { name: "Plandex", skillsDir: ".plandex/skills", group: "additional", detect: ".plandex" },
+];
+/**
+ * Resolve the skills directory for an agent (handles env overrides + home expansion)
+ */
+function resolveAgentDir(agent) {
+    const home = homedir();
+    if (agent.envOverride && process.env[agent.envOverride]) {
+        return join(process.env[agent.envOverride], "skills");
+    }
+    return join(home, agent.skillsDir);
+}
+/**
+ * Detect which agents are installed on this system
+ */
+export function detectAgents() {
+    const home = homedir();
+    const universal = AGENT_CONFIGS.filter(a => a.group === "universal");
+    const additional = AGENT_CONFIGS.filter(a => a.group === "additional");
+    const detected = additional.filter(agent => {
+        if (!agent.detect)
+            return false;
+        const checkPath = join(home, agent.detect);
+        return existsSync(checkPath);
+    });
+    return { universal, detected };
+}
+/**
+ * Get all available agents (universal + detected)
+ */
+export function getAllAgents() {
+    const { universal, detected } = detectAgents();
+    return [...universal, ...detected];
+}
+/**
+ * Register a skill with specific agents by creating symlinks
+ * Returns array of { agent, path, status } results
+ */
+export function registerSkillWithAgents(skillId, skillPath, agents) {
+    const results = [];
+    const resolvedSkillPath = resolve(skillPath);
+    // Deduplicate by resolved dir (universal agents share .agents/skills)
+    const seenDirs = new Set();
+    for (const agent of agents) {
+        const agentDir = resolveAgentDir(agent);
+        // Skip duplicates (multiple universal agents → same .agents/skills dir)
+        if (seenDirs.has(agentDir)) {
+            results.push({ agent: agent.name, path: agentDir, status: "exists" });
+            continue;
+        }
+        seenDirs.add(agentDir);
+        const targetLink = join(agentDir, skillId);
+        try {
+            // Ensure parent dir exists
+            mkdirSync(agentDir, { recursive: true });
+            // Check if link already exists
+            if (existsSync(targetLink)) {
+                try {
+                    const stat = lstatSync(targetLink);
+                    if (stat.isSymbolicLink()) {
+                        const existing = readlinkSync(targetLink);
+                        if (resolve(existing) === resolvedSkillPath) {
+                            results.push({ agent: agent.name, path: targetLink, status: "exists" });
+                            continue;
+                        }
+                        // Different target — update
+                        unlinkSync(targetLink);
+                    }
+                    else {
+                        // Not a symlink (real directory) — skip to avoid data loss
+                        results.push({ agent: agent.name, path: targetLink, status: "exists" });
+                        continue;
+                    }
+                }
+                catch {
+                    // Stat failed — try to proceed
+                }
+            }
+            // Create symlink
+            // On Windows, use junction for directories (no admin required)
+            const linkType = platform() === "win32" ? "junction" : "dir";
+            symlinkSync(resolvedSkillPath, targetLink, linkType);
+            results.push({ agent: agent.name, path: targetLink, status: "created" });
+        }
+        catch (err) {
+            results.push({
+                agent: agent.name,
+                path: targetLink,
+                status: "error",
+                error: err.message,
+            });
+        }
+    }
+    return results;
+}
+/**
+ * Unregister a skill from all agents (remove symlinks only)
+ */
+export function unregisterSkillFromAgents(skillId) {
+    const home = homedir();
+    let removed = 0;
+    // Check all known agent dirs
+    const allDirs = new Set(AGENT_CONFIGS.map(a => resolveAgentDir(a)));
+    for (const dir of allDirs) {
+        const targetLink = join(dir, skillId);
+        try {
+            if (existsSync(targetLink) && lstatSync(targetLink).isSymbolicLink()) {
+                unlinkSync(targetLink);
+                removed++;
+            }
+        }
+        catch {
+            // Skip errors
+        }
+    }
+    return removed;
+}
+/**
+ * List which agents have a specific skill registered
+ */
+export function getSkillAgentStatus(skillId) {
+    const results = [];
+    const seenDirs = new Set();
+    for (const agent of AGENT_CONFIGS) {
+        const agentDir = resolveAgentDir(agent);
+        if (seenDirs.has(agentDir))
+            continue;
+        seenDirs.add(agentDir);
+        const targetLink = join(agentDir, skillId);
+        const registered = existsSync(targetLink);
+        results.push({ agent: agent.name, registered, path: targetLink });
+    }
+    return results;
+}

package/dist/lib/config.js

@@ -6,6 +6,18 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, statSync
 import { join } from "path";
 import { homedir } from "os";
 import { CONFIG_DIR_NAME, DEFAULT_SERVER, DEFAULT_INSTALL_DIR_NAME, } from "../types.js";
+/** CFG-01 FIX: Strip prototype pollution keys from parsed JSON */
+function sanitize(obj) {
+    if (typeof obj !== "object" || obj === null)
+        return obj;
+    const BANNED = new Set(["__proto__", "constructor", "prototype"]);
+    for (const key of Object.keys(obj)) {
+        if (BANNED.has(key)) {
+            delete obj[key];
+        }
+    }
+    return obj;
+}
 // R1-06: Key format validation applied everywhere
 const KEY_RE = /^sk-(admin|user)-[a-f0-9]{16,}$/;
 function getConfigDir() {
@@ -31,7 +43,7 @@ export function loadConfig() {
     if (!existsSync(path))
         return null;
     try {
-        const data = JSON.parse(readFileSync(path, "utf-8"));
+        const data = sanitize(JSON.parse(readFileSync(path, "utf-8")));
         // R2-13: Basic shape validation
         if (typeof data !== "object" || data === null)
             return null;
@@ -81,7 +93,7 @@ export function loadInstalled() {
     if (!existsSync(path))
         return {};
     try {
-        const data = JSON.parse(readFileSync(path, "utf-8"));
+        const data = sanitize(JSON.parse(readFileSync(path, "utf-8")));
         // R2-13: Basic shape validation
         if (typeof data !== "object" || data === null || Array.isArray(data))
             return {};

package/dist/lib/installer.js

@@ -7,8 +7,8 @@
  * R1-10: SIGINT/SIGTERM cleanup handler
  */
 import { createWriteStream, existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "fs";
-import { join, normalize, resolve as pathResolve } from "path";
-import { pipeline } from "stream/promises";
+import { join, normalize, resolve as pathResolve, sep } from "path";
+import { Transform as TransformStream } from "stream";
 import yauzl from "yauzl";
 import { loadInstalled, saveInstalled, getInstallDir } from "./config.js";
 import { ui } from "./ui.js";
@@ -49,7 +49,7 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
             const result = await client.downloadPackage(packageFile, (dl, total) => {
                 const pct = Math.round((dl / total) * 100);
                 const bar = "█".repeat(Math.round(pct / 4)) + "░".repeat(25 - Math.round(pct / 4));
-                spinner.text = `  📦 ${bar} ${pct}% | ${ui.fileSize(dl)}`;
+                spinner.text = `  ${bar} ${pct}% | ${ui.fileSize(dl)}`;
             });
             buffer = result.buffer;
             actualSha256 = result.sha256;
@@ -155,6 +155,10 @@ export async function installSkill(client, skillId, packageFile, expectedSha256,
  * Rollback a skill to its backup (D-13)
  */
 export function rollbackSkill(skillId) {
+    // INS-03/RBK-01 FIX: Validate skill ID to prevent path traversal
+    if (!SAFE_SKILL_ID.test(skillId)) {
+        return false;
+    }
     const installDir = getInstallDir();
     const skillDir = join(installDir, skillId);
     let entries;
@@ -227,20 +231,30 @@ function extractZip(buffer, targetDir) {
                 }
                 const entryPath = normalize(entry.fileName);
                 // D-03 / Security: reject path traversal
-                if (entryPath.startsWith("..") || entryPath.includes("/../")) {
+                // PH8-01 + CLI-007: comprehensive cross-platform check
+                if (entryPath.startsWith("..") ||
+                    entryPath.endsWith(`${sep}..`) ||
+                    entryPath.includes(`${sep}..${sep}`)) {
                     zipfile.close(); // R2-08
                     reject(new Error(`Unsafe path in ZIP: ${entry.fileName}`));
                     return;
                 }
-                // Reject oversized single files
+                // INS-02 FIX: Reject symlink entries (external attributes bit 0xA000)
+                const externalAttrs = (entry.externalFileAttributes >>> 16) & 0xFFFF;
+                const S_IFLNK = 0xA000;
+                if ((externalAttrs & 0xF000) === S_IFLNK) {
+                    zipfile.close();
+                    reject(new Error(`Symlink entry rejected in ZIP: ${entry.fileName}`));
+                    return;
+                }
+                // R1-03: Pre-check declared size (actual bytes tracked in counting stream below)
                 if (entry.uncompressedSize > MAX_SINGLE_FILE_SIZE) {
                     zipfile.close(); // R2-08
                     reject(new Error(`File too large in ZIP: ${entry.fileName} (${entry.uncompressedSize} bytes)`));
                     return;
                 }
-                // R1-03: Cumulative size limit
-                totalExtracted += entry.uncompressedSize;
-                if (totalExtracted > MAX_TOTAL_EXTRACT_SIZE) {
+                // R1-03: Pre-check cumulative declared size (actual bytes tracked in stream)
+                if (totalExtracted + entry.uncompressedSize > MAX_TOTAL_EXTRACT_SIZE) {
                     zipfile.close(); // R2-08
                     reject(new Error(`Total extracted size exceeds ${MAX_TOTAL_EXTRACT_SIZE / 1024 / 1024}MB — possible zip bomb`));
                     return;
@@ -248,7 +262,8 @@ function extractZip(buffer, targetDir) {
                 const fullPath = join(targetDir, entryPath);
                 const resolvedPath = pathResolve(fullPath);
                 // R2-04: Trailing separator prevents prefix collision
-                const resolvedTarget = pathResolve(targetDir) + "/";
+                // BUG-1 fix: use path.sep (not hardcoded "/") for Windows compatibility
+                const resolvedTarget = pathResolve(targetDir) + sep;
                 if (!resolvedPath.startsWith(resolvedTarget) && resolvedPath !== pathResolve(targetDir)) {
                     zipfile.close(); // R2-08
                     reject(new Error(`Path traversal detected: ${entry.fileName}`));
@@ -268,11 +283,31 @@ function extractZip(buffer, targetDir) {
                             reject(err || new Error("Failed to read ZIP entry"));
                             return;
                         }
-                        const writeStream = createWriteStream(fullPath);
-                        pipeline(readStream, writeStream).then(() => zipfile.readEntry()).catch((e) => {
-                            zipfile.close(); // R2-08
-                            reject(e);
+                        // INS-01 FIX: Track actual bytes written (not declared uncompressedSize)
+                        let fileBytes = 0;
+                        const countingStream = new TransformStream({
+                            transform(chunk, _encoding, callback) {
+                                fileBytes += chunk.length;
+                                totalExtracted += chunk.length;
+                                if (fileBytes > MAX_SINGLE_FILE_SIZE) {
+                                    zipfile.close();
+                                    callback(new Error(`Actual file size exceeds limit: ${entry.fileName}`));
+                                    return;
+                                }
+                                if (totalExtracted > MAX_TOTAL_EXTRACT_SIZE) {
+                                    zipfile.close();
+                                    callback(new Error(`Total extracted size exceeds ${MAX_TOTAL_EXTRACT_SIZE / 1024 / 1024}MB — possible zip bomb`));
+                                    return;
+                                }
+                                callback(null, chunk);
+                            },
                         });
+                        const writeStream = createWriteStream(fullPath);
+                        readStream.pipe(countingStream).pipe(writeStream);
+                        writeStream.on("finish", () => zipfile.readEntry());
+                        writeStream.on("error", (e) => { zipfile.close(); reject(e); });
+                        countingStream.on("error", (e) => { zipfile.close(); reject(e); });
+                        readStream.on("error", (e) => { zipfile.close(); reject(e); });
                     });
                 }
             });

package/dist/lib/ui.d.ts

@@ -6,34 +6,42 @@ export declare const ui: {
     warn: import("chalk").ChalkInstance;
     error: import("chalk").ChalkInstance;
     dim: import("chalk").ChalkInstance;
-    /** Print the welcome banner */
+    muted: import("chalk").ChalkInstance;
+    /** Animated gradient logo banner — block-art style */
     banner(): void;
-    /** Print a section header */
+    /** Section header with gradient bar */
     header(text: string): void;
-    /** Print success message */
+    /** Boxed panel for important information */
+    panel(title: string, content: string): void;
+    /** Success message */
     ok(msg: string): void;
-    /** Print warning */
+    /** Warning message */
     warning(msg: string): void;
-    /** Print error */
+    /** Error message */
     err(msg: string): void;
-    /** Print info line */
+    /** Info line */
     info(msg: string): void;
     /** Indented line */
     line(msg: string): void;
-    /** Create a spinner */
+    /** Dimmed text helper */
+    dimText(msg: string): void;
+    /** Create an ora spinner with brand styling */
     spinner(text: string): Ora;
     /** Format file size */
     fileSize(bytes: number): string;
-    /** Format a skill for display */
+    /** Format a skill for display (rich) */
     skillLine(s: {
         id: string;
         name: string;
         version?: string;
         description: string;
         tag?: string;
+        size?: number;
     }): string;
-    /** Print a key-value table */
+    /** Print a key-value table with alignment */
     table(rows: [string, string][]): void;
     /** Goodbye message */
     goodbye(): void;
+    /** Status badge */
+    badge(text: string, color: "green" | "yellow" | "red" | "blue" | "purple"): string;
 };

package/dist/lib/ui.js

@@ -1,16 +1,26 @@
 /**
- * UI helpers — branded output, spinners, prompts
+ * UI module — Dreamlogic CLI visual design system
+ * Uses @clack/prompts, gradient-string, figlet, boxen, ora
  */
 import chalk from "chalk";
 import ora from "ora";
+import gradientString from "gradient-string";
+import figlet from "figlet";
+import boxen from "boxen";
 import { CLI_NAME, CLI_AUTHOR, CLI_VERSION } from "../types.js";
-// Brand colors
-const brand = chalk.hex("#7C3AED"); // Purple
-const accent = chalk.hex("#06B6D4"); // Cyan
-const success = chalk.green;
-const warn = chalk.yellow;
-const error = chalk.red;
+// ===== Brand palette =====
+const BRAND_GRADIENT = ["#7C3AED", "#6366F1", "#3B82F6", "#06B6D4"];
+const brand = chalk.hex("#7C3AED");
+const accent = chalk.hex("#06B6D4");
+const success = chalk.hex("#22C55E");
+const warn = chalk.hex("#F59E0B");
+const error = chalk.hex("#EF4444");
 const dim = chalk.dim;
+const muted = chalk.hex("#6B7280");
+// CLI-004: Check truecolor support — fall back to plain on legacy terminals
+const hasTruecolor = chalk.level >= 3;
+// ===== Gradient helper =====
+const brandGradient = gradientString(BRAND_GRADIENT);
 export const ui = {
     brand,
     accent,
@@ -18,46 +28,69 @@ export const ui = {
     warn,
     error,
     dim,
-    /** Print the welcome banner */
+    muted,
+    /** Animated gradient logo banner — block-art style */
     banner() {
+        const dream = figlet.textSync("DREAM", { font: "ANSI Shadow" });
+        const logic = figlet.textSync("LOGIC", { font: "ANSI Shadow" });
+        const fullLogo = dream + logic;
         console.log();
-        console.log(brand("  ╔══════════════════════════════════════════╗"));
-        console.log(brand("  ║") + "  🚀 " + chalk.bold.white(CLI_NAME) + " v" + CLI_VERSION + brand("              ║"));
-        console.log(brand("  ║") + "  " + dim("AI Skill Manager for your team") + brand("           ║"));
-        console.log(brand("  ║") + "  " + dim(CLI_AUTHOR) + brand("       ║"));
-        console.log(brand("  ╚══════════════════════════════════════════╝"));
+        console.log(hasTruecolor ? brandGradient.multiline(fullLogo) : chalk.bold.magenta(fullLogo));
+        console.log(muted("        ") +
+            (hasTruecolor ? brandGradient(`${CLI_NAME} v${CLI_VERSION}`) : chalk.bold(`${CLI_NAME} v${CLI_VERSION}`)) +
+            muted("  |  ") +
+            muted(CLI_AUTHOR));
         console.log();
     },
-    /** Print a section header */
+    /** Section header with gradient bar */
     header(text) {
         console.log();
-        console.log(brand("━".repeat(50)));
-        console.log(brand("  " + text));
-        console.log(brand("━".repeat(50)));
+        console.log(hasTruecolor ? brandGradient("━".repeat(50)) : chalk.magenta("━".repeat(50)));
+        console.log("  " + chalk.bold.white(text));
+        console.log(hasTruecolor ? brandGradient("━".repeat(50)) : chalk.magenta("━".repeat(50)));
     },
-    /** Print success message */
+    /** Boxed panel for important information */
+    panel(title, content) {
+        console.log(boxen(content, {
+            title,
+            titleAlignment: "left",
+            padding: { top: 0, bottom: 0, left: 1, right: 1 },
+            margin: { top: 0, bottom: 0, left: 2, right: 0 },
+            borderStyle: "round",
+            borderColor: "#7C3AED",
+        }));
+    },
+    /** Success message */
     ok(msg) {
-        console.log(success("  ✅ ") + msg);
+        console.log(success("  ✓ ") + msg);
     },
-    /** Print warning */
+    /** Warning message */
     warning(msg) {
-        console.log(warn("  ⚠️  ") + msg);
+        console.log(warn("  ▲ ") + msg);
     },
-    /** Print error */
+    /** Error message */
     err(msg) {
-        console.log(error("  ❌ ") + msg);
+        console.log(error("  ✗ ") + msg);
     },
-    /** Print info line */
+    /** Info line */
     info(msg) {
-        console.log(accent("  ℹ  ") + msg);
+        console.log(accent("  ● ") + msg);
     },
     /** Indented line */
     line(msg) {
-        console.log("  " + msg);
+        console.log("    " + msg);
+    },
+    /** Dimmed text helper */
+    dimText(msg) {
+        console.log(muted("  " + msg));
     },
-    /** Create a spinner */
+    /** Create an ora spinner with brand styling */
     spinner(text) {
-        return ora({ text: "  " + text, color: "cyan" });
+        return ora({
+            text: "  " + text,
+            color: "magenta",
+            spinner: "dots",
+        });
     },
     /** Format file size */
     fileSize(bytes) {
@@ -67,23 +100,39 @@ export const ui = {
             return `${(bytes / 1024).toFixed(1)} KB`;
         return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
     },
-    /** Format a skill for display */
+    /** Format a skill for display (rich) */
     skillLine(s) {
-        const ver = s.version ? dim(` (${s.version})`) : "";
+        const name = chalk.bold.white(s.name);
+        const ver = s.version ? muted(` v${s.version}`) : "";
+        const size = s.size ? muted(` (${ui.fileSize(s.size)})`) : "";
+        const desc = muted(s.description);
         const tag = s.tag ? ` ${s.tag}` : "";
-        return `${chalk.bold(s.name)}${ver} — ${dim(s.description)}${tag}`;
+        return `${name}${ver}${size}\n      ${desc}${tag}`;
     },
-    /** Print a key-value table */
+    /** Print a key-value table with alignment */
     table(rows) {
         const maxKey = Math.max(...rows.map(([k]) => k.length));
         for (const [k, v] of rows) {
-            console.log(`  ${accent(k.padEnd(maxKey))}  ${v}`);
+            console.log(`    ${accent(k.padEnd(maxKey))}  ${v}`);
         }
     },
     /** Goodbye message */
     goodbye() {
         console.log();
-        console.log(dim("  Powered by ") + brand("Dreamlogic-ai") + dim(" · github.com/dreamlogic-ai"));
+        console.log(muted("  ") +
+            (hasTruecolor ? brandGradient("Powered by Dreamlogic-ai") : chalk.bold.magenta("Powered by Dreamlogic-ai")) +
+            muted(" · github.com/dreamlogic-ai"));
         console.log();
     },
+    /** Status badge */
+    badge(text, color) {
+        const colors = {
+            green: success,
+            yellow: warn,
+            red: error,
+            blue: accent,
+            purple: brand,
+        };
+        return (colors[color] || muted)(`[${text}]`);
+    },
 };

package/dist/types.d.ts

@@ -33,6 +33,6 @@ export interface InstalledRegistry {
 export declare const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export declare const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export declare const CONFIG_DIR_NAME = ".dreamlogic";
-export declare const CLI_VERSION = "1.0.0";
+export declare const CLI_VERSION = "2.0.1";
 export declare const CLI_NAME = "Dreamlogic CLI";
 export declare const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/dist/types.js

@@ -2,6 +2,6 @@
 export const DEFAULT_SERVER = "https://skill.dreamlogic-claw.com";
 export const DEFAULT_INSTALL_DIR_NAME = "dreamlogic-skills";
 export const CONFIG_DIR_NAME = ".dreamlogic";
-export const CLI_VERSION = "1.0.0";
+export const CLI_VERSION = "2.0.1";
 export const CLI_NAME = "Dreamlogic CLI";
 export const CLI_AUTHOR = "Dreamlogic-ai by MAJORNINE";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreamlogic-ai/cli",
-  "version": "1.0.0",
+  "version": "2.0.1",
   "description": "Dreamlogic AI Skill Manager — Install, update and manage AI agent skills",
   "type": "module",
   "bin": {
@@ -34,13 +34,18 @@
     "access": "public"
   },
   "dependencies": {
-    "@inquirer/prompts": "^7.10.1",
+    "@clack/prompts": "^1.2.0",
+    "boxen": "^8.0.1",
     "chalk": "^5.6.2",
     "commander": "^12.1.0",
+    "figlet": "^1.11.0",
+    "gradient-string": "^3.0.0",
     "ora": "^8.2.0",
     "yauzl": "^3.3.0"
   },
   "devDependencies": {
+    "@types/figlet": "^1.7.0",
+    "@types/gradient-string": "^1.1.6",
     "@types/node": "^22.19.17",
     "@types/yauzl": "^2.10.3",
     "tsx": "^4.21.0",