@groupby/ai-dev 0.5.20 → 0.5.22

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import fs4 from "fs";
-import path5 from "path";
+import fs7 from "fs";
+import path7 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 
@@ -11,10 +11,10 @@ import chalk from "chalk";
 import fg2 from "fast-glob";
 
 // src/lib/discovery.ts
-import path from "path";
+import path2 from "path";
 import { fileURLToPath } from "url";
 import fg from "fast-glob";
-import fs from "fs-extra";
+import fs2 from "fs-extra";
 
 // src/lib/frontmatter.ts
 import matter from "gray-matter";
@@ -32,44 +32,128 @@ See \`${aiDir}/skills/${skillName}/SKILL.md\` and follow closely.
   return matter.stringify(body, frontmatter);
 }
 
+// src/lib/skill-meta.ts
+import path from "path";
+import fs from "fs-extra";
+import matter2 from "gray-matter";
+var SKILL_META_FILENAME = "skill-meta.yml";
+var VALID_STATUSES = [
+  "evaluating",
+  "recommended",
+  "deprecated"
+];
+var META_DELIMITER = "~~~skill-meta~~~";
+function parseSkillMeta(yamlText) {
+  const parsed = matter2(
+    `${META_DELIMITER}
+${yamlText.trim()}
+${META_DELIMITER}
+`,
+    { delimiters: META_DELIMITER }
+  );
+  return parsed.data;
+}
+var META_FIELD_ORDER = [
+  "source",
+  "upstreamName",
+  "pinnedCommit",
+  "vendoredOn",
+  "status",
+  "agents",
+  "reviewedBy",
+  "notes"
+];
+function serializeSkillMeta(meta) {
+  const lines = [];
+  for (const key of META_FIELD_ORDER) {
+    const value = meta[key];
+    if (value === void 0 || value === null) continue;
+    if (key === "agents") {
+      const agents = value;
+      if (agents.length === 0) continue;
+      lines.push(`agents: [${agents.map(yamlScalar).join(", ")}]`);
+      continue;
+    }
+    if (typeof value === "string" && value.length === 0) continue;
+    lines.push(`${key}: ${yamlScalar(value)}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function yamlScalar(value) {
+  const text = String(value);
+  const isPlainToken = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(text);
+  const looksBoolOrNull = /^(true|false|null|yes|no|on|off)$/i.test(text);
+  const looksDate = /^\d{4}-\d{2}-\d{2}/.test(text);
+  const looksNumber = /^[-+]?(\d[\d_]*\.?\d*|\.\d+)([eE][-+]?\d+)?$/.test(text) || /^0x[0-9a-fA-F_]+$/.test(text) || /^0o[0-7_]+$/.test(text) || /^[-+]?\.(inf|nan)$/i.test(text);
+  if (isPlainToken && !looksBoolOrNull && !looksDate && !looksNumber) {
+    return text;
+  }
+  return JSON.stringify(text);
+}
+async function readSkillMeta(skillFolder) {
+  const metaPath = path.join(skillFolder, SKILL_META_FILENAME);
+  if (!await fs.pathExists(metaPath)) return void 0;
+  const text = await fs.readFile(metaPath, "utf-8");
+  try {
+    return parseSkillMeta(text);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    console.warn(`Failed to parse ${metaPath}: ${reason}`);
+    return void 0;
+  }
+}
+
 // src/lib/discovery.ts
-var __dirname = path.dirname(fileURLToPath(import.meta.url));
-var PACKAGE_ROOT = path.resolve(__dirname, "..");
+var __dirname = path2.dirname(fileURLToPath(import.meta.url));
+var PACKAGE_ROOT = path2.resolve(__dirname, "..");
 async function discoverSkills() {
   const libraryPattern = "skills/library/*/SKILL.md";
   const teamPattern = "teams/*/skills/*/SKILL.md";
   const toolsetPattern = "toolsets/*/skills/*/SKILL.md";
-  const matches = await fg([libraryPattern, teamPattern, toolsetPattern], {
-    cwd: PACKAGE_ROOT,
-    absolute: true
-  });
+  const thirdPartyPattern = "teams/*/third-party/*/*/SKILL.md";
+  const matches = await fg(
+    [libraryPattern, teamPattern, toolsetPattern, thirdPartyPattern],
+    {
+      cwd: PACKAGE_ROOT,
+      absolute: true
+    }
+  );
   const skills = [];
   for (const match of matches) {
-    const content = await fs.readFile(match, "utf-8");
+    const content = await fs2.readFile(match, "utf-8");
     const { data } = parseFrontmatter(content);
-    const skillFolder = path.dirname(match);
-    const relativePath = path.relative(PACKAGE_ROOT, match);
+    const skillFolder = path2.dirname(match);
+    const relativePath = path2.relative(PACKAGE_ROOT, match);
+    const parts = relativePath.split(path2.sep);
     let sourceType;
     let teamName;
     let toolsetName;
+    let lib;
+    let meta;
     if (relativePath.startsWith("skills/library/")) {
       sourceType = "library";
     } else if (relativePath.startsWith("toolsets/")) {
       sourceType = "toolset";
-      const parts = relativePath.split(path.sep);
       toolsetName = parts[1];
+    } else if (parts[2] === "third-party") {
+      sourceType = "third-party";
+      teamName = parts[1];
+      lib = parts[3];
+      meta = await readSkillMeta(skillFolder);
     } else {
       sourceType = "team";
-      const parts = relativePath.split(path.sep);
       teamName = parts[1];
     }
     skills.push({
-      name: data.name || path.basename(skillFolder),
+      name: data.name || path2.basename(skillFolder),
       description: data.description || "",
       sourcePath: skillFolder,
       sourceType,
       teamName,
       toolsetName,
+      lib,
+      meta,
       frontmatter: data
     });
   }
@@ -83,13 +167,13 @@ async function discoverTeamAssetFolders() {
   });
   const assetFolders = [];
   for (const teamDir of teamDirs) {
-    const teamName = path.basename(teamDir);
-    const entries = await fs.readdir(teamDir, { withFileTypes: true });
+    const teamName = path2.basename(teamDir);
+    const entries = await fs2.readdir(teamDir, { withFileTypes: true });
     for (const entry of entries) {
-      if (!entry.isDirectory() || entry.name === "skills") continue;
+      if (!entry.isDirectory() || entry.name === "skills" || entry.name === "third-party") continue;
       assetFolders.push({
         name: entry.name,
-        sourcePath: path.join(teamDir, entry.name),
+        sourcePath: path2.join(teamDir, entry.name),
         teamName
       });
     }
@@ -107,13 +191,16 @@ async function discoverTeams() {
   const ensureTeam = (name) => {
     const existing = teamMap.get(name);
     if (existing) return existing;
-    const team = { name, skills: [], assetFolders: [] };
+    const team = { name, skills: [], thirdPartySkills: [], assetFolders: [] };
     teamMap.set(name, team);
     return team;
   };
   for (const skill of skills) {
-    if (skill.sourceType === "team" && skill.teamName) {
+    if (!skill.teamName) continue;
+    if (skill.sourceType === "team") {
       ensureTeam(skill.teamName).skills.push(skill);
+    } else if (skill.sourceType === "third-party") {
+      ensureTeam(skill.teamName).thirdPartySkills.push(skill);
     }
   }
   for (const folder of assetFolders) {
@@ -133,9 +220,9 @@ async function discoverToolsets() {
   }
   const toolsets = [];
   for (const [name, toolsetSkills] of toolsetMap) {
-    const resourcesPath = path.join(PACKAGE_ROOT, "toolsets", name, "resources");
+    const resourcesPath = path2.join(PACKAGE_ROOT, "toolsets", name, "resources");
     let hasResources = false;
-    if (await fs.pathExists(resourcesPath)) {
+    if (await fs2.pathExists(resourcesPath)) {
       const resourceFiles = await fg("**/*", {
         cwd: resourcesPath,
         onlyFiles: true
@@ -146,9 +233,26 @@ async function discoverToolsets() {
   }
   return toolsets;
 }
-async function findSkill(name) {
+var SKILL_TIER_ORDER = [
+  "library",
+  "team",
+  "toolset",
+  "third-party"
+];
+function resolveSkillMatches(matches) {
+  for (const tier of SKILL_TIER_ORDER) {
+    const inTier = matches.filter((m) => m.sourceType === tier);
+    if (inTier.length === 1) return { kind: "found", skill: inTier[0] };
+    if (inTier.length > 1) return { kind: "ambiguous", matches: inTier };
+  }
+  return { kind: "none" };
+}
+async function findSkillMatches(name, team) {
   const skills = await discoverSkills();
-  return skills.find((s) => s.name === name && s.sourceType === "library") || skills.find((s) => s.name === name && s.sourceType === "team") || skills.find((s) => s.name === name);
+  const teamLc = team?.toLowerCase();
+  return skills.filter(
+    (s) => s.name === name && (!teamLc || s.teamName?.toLowerCase() === teamLc)
+  );
 }
 async function findToolset(name) {
   const toolsets = await discoverToolsets();
@@ -168,6 +272,9 @@ function isResourceFolder(folderName) {
 }
 function formatTeamContents(team) {
   const parts = [`${team.skills.length} skill${team.skills.length !== 1 ? "s" : ""}`];
+  if (team.thirdPartySkills.length > 0) {
+    parts.push(`${team.thirdPartySkills.length} third-party`);
+  }
   const promptCount = team.assetFolders.filter((folder) => isPromptFolder(folder.name)).length;
   const resourceCount = team.assetFolders.filter((folder) => isResourceFolder(folder.name)).length;
   const genericCount = team.assetFolders.length - promptCount - resourceCount;
@@ -207,6 +314,24 @@ function truncate(str, max) {
   if (str.length <= max) return str;
   return str.slice(0, max - 3) + "...";
 }
+function formatStatus(status) {
+  switch (status) {
+    case "recommended":
+      return chalk.green("recommended");
+    case "evaluating":
+      return chalk.yellow("evaluating");
+    case "deprecated":
+      return chalk.red("deprecated");
+    default:
+      return chalk.dim("no status");
+  }
+}
+function formatProvenance(skill) {
+  const meta = skill.meta;
+  const sha = meta?.pinnedCommit ? meta.pinnedCommit.slice(0, 7) : "unpinned";
+  const source = meta?.source ? `${meta.source}@${sha}` : "unknown source";
+  return `[${formatStatus(meta?.status)}] ${chalk.dim(source)}`;
+}
 async function countResourceFiles(resourcesPath) {
   const files = await fg2("**/*", {
     cwd: resourcesPath,
@@ -223,6 +348,7 @@ async function listSkills() {
   const librarySkills = skills.filter((s) => s.sourceType === "library");
   const teamSkills = skills.filter((s) => s.sourceType === "team");
   const toolsetSkills = skills.filter((s) => s.sourceType === "toolset");
+  const thirdPartySkills = skills.filter((s) => s.sourceType === "third-party");
   if (librarySkills.length > 0) {
     console.log(chalk.bold("\nLibrary"));
     for (const s of librarySkills) {
@@ -236,12 +362,27 @@ async function listSkills() {
     existing.push(s);
     teamMap.set(team, existing);
   }
-  for (const [team, skillList] of teamMap) {
+  const thirdPartyMap = /* @__PURE__ */ new Map();
+  for (const s of thirdPartySkills) {
+    const team = s.teamName || "unknown";
+    const existing = thirdPartyMap.get(team) || [];
+    existing.push(s);
+    thirdPartyMap.set(team, existing);
+  }
+  const teamNames = /* @__PURE__ */ new Set([...teamMap.keys(), ...thirdPartyMap.keys()]);
+  for (const team of teamNames) {
     console.log(chalk.bold(`
 ${formatTeamName(team)}`));
-    for (const s of skillList) {
+    for (const s of teamMap.get(team) || []) {
       console.log(`  ${chalk.cyan(s.name.padEnd(24))} ${truncate(s.description, 60)}`);
     }
+    const teamThirdParty = thirdPartyMap.get(team) || [];
+    if (teamThirdParty.length > 0) {
+      console.log(`  ${chalk.dim("third-party:")}`);
+      for (const s of teamThirdParty) {
+        console.log(`    ${chalk.cyan(s.name.padEnd(22))} ${formatProvenance(s)}`);
+      }
+    }
   }
   const toolsetMap = /* @__PURE__ */ new Map();
   for (const s of toolsetSkills) {
@@ -273,6 +414,50 @@ async function listTeams() {
   }
   console.log();
 }
+function formatTeamDetail(team) {
+  const lines = [];
+  lines.push(`${chalk.bold(formatTeamName(team.name))} ${chalk.dim(`(${formatTeamContents(team)})`)}`);
+  if (team.skills.length > 0) {
+    lines.push(chalk.bold("\n  Skills"));
+    for (const s of team.skills) {
+      lines.push(`    ${chalk.cyan(s.name.padEnd(24))} ${truncate(s.description, 56)}`);
+    }
+  }
+  if (team.thirdPartySkills.length > 0) {
+    lines.push(`${chalk.bold("\n  Third-party skills")} ${chalk.dim("(vendored)")}`);
+    for (const s of team.thirdPartySkills) {
+      lines.push(`    ${chalk.cyan(s.name.padEnd(24))} ${formatProvenance(s)}`);
+      if (s.description) {
+        lines.push(`    ${" ".repeat(24)} ${chalk.dim(truncate(s.description, 56))}`);
+      }
+    }
+  }
+  if (team.assetFolders.length > 0) {
+    lines.push(chalk.bold("\n  Content"));
+    for (const f of team.assetFolders) {
+      lines.push(`    ${chalk.cyan(f.name)}`);
+    }
+  }
+  return lines;
+}
+async function listTeam(name) {
+  const teams = await discoverTeams();
+  const team = teams.find(
+    (t) => t.name === name || t.name.toLowerCase() === name.toLowerCase()
+  );
+  if (!team) {
+    console.log(chalk.yellow(`Team "${name}" not found.`));
+    if (teams.length > 0) {
+      console.log(`Available teams: ${teams.map((t) => t.name).join(", ")}`);
+    }
+    process.exit(1);
+  }
+  console.log();
+  for (const line of formatTeamDetail(team)) {
+    console.log(line);
+  }
+  console.log();
+}
 async function listToolsets() {
   const toolsets = await discoverToolsets();
   if (toolsets.length === 0) {
@@ -320,17 +505,19 @@ function registerListCommand(program2) {
   const list = program2.command("list").description("List available skills, teams, and toolsets");
   list.command("skills").description("List all available skills").action(listSkills);
   list.command("teams").description("List teams with skill and content counts").action(listTeams);
+  list.command("team <name>").description("List one team's skills, vendored third-party skills, and content").action(listTeam);
   list.command("toolsets").description("List toolsets with skill and resource counts").action(listToolsets);
   list.action(listAll);
 }
 
 // src/commands/install.ts
-import path4 from "path";
+import path5 from "path";
+import fs5 from "fs-extra";
 import chalk3 from "chalk";
 
 // src/lib/clients.ts
-import path2 from "path";
-import fs2 from "fs-extra";
+import path3 from "path";
+import fs3 from "fs-extra";
 var ALL_CLIENTS = [
   { name: "Copilot", skillsDir: ".github/skills", detectDir: ".github" },
   { name: "Claude Code", skillsDir: ".claude/skills", detectDir: ".claude" },
@@ -339,32 +526,59 @@ var ALL_CLIENTS = [
 async function detectClients(targetDir) {
   const detected = [];
   for (const client of ALL_CLIENTS) {
-    const dirPath = path2.join(targetDir, client.detectDir);
-    if (await fs2.pathExists(dirPath)) {
+    const dirPath = path3.join(targetDir, client.detectDir);
+    if (await fs3.pathExists(dirPath)) {
       detected.push(client);
     }
   }
   return detected;
 }
+var CLIENT_ALIASES = {
+  copilot: ALL_CLIENTS[0],
+  claude: ALL_CLIENTS[1],
+  "claude code": ALL_CLIENTS[1],
+  "claude-code": ALL_CLIENTS[1],
+  codex: ALL_CLIENTS[2]
+};
+function resolveClients(list) {
+  const tokens = list.split(",").map((t) => t.trim().toLowerCase()).filter(Boolean);
+  if (tokens.includes("all")) return [...ALL_CLIENTS];
+  const result = [];
+  for (const token of tokens) {
+    const client = CLIENT_ALIASES[token];
+    if (!client) {
+      throw new Error(
+        `Unknown client "${token}". Valid values: copilot, claude, codex, all.`
+      );
+    }
+    if (!result.includes(client)) result.push(client);
+  }
+  if (result.length === 0) {
+    throw new Error(
+      "--clients requires at least one of: copilot, claude, codex, all."
+    );
+  }
+  return result;
+}
 
 // src/lib/installer.ts
-import path3 from "path";
-import fs3 from "fs-extra";
+import path4 from "path";
+import fs4 from "fs-extra";
 import fg3 from "fast-glob";
 var DEFAULT_AI_DIR = "docs/ai";
 async function handleFile(srcPath, destPath, options, result, onConflict, contentOverride) {
-  const relativeDest = path3.relative(options.targetDir, destPath);
-  if (await fs3.pathExists(destPath)) {
-    const existingContent = await fs3.readFile(destPath, "utf-8");
-    const newContent = contentOverride ?? await fs3.readFile(srcPath, "utf-8");
+  const relativeDest = path4.relative(options.targetDir, destPath);
+  if (await fs4.pathExists(destPath)) {
+    const existingContent = await fs4.readFile(destPath, "utf-8");
+    const newContent = contentOverride ?? await fs4.readFile(srcPath, "utf-8");
     if (existingContent === newContent) {
       result.skipped.push(relativeDest);
       return;
     }
     if (options.force) {
       if (!options.dryRun) {
-        await fs3.ensureDir(path3.dirname(destPath));
-        await fs3.writeFile(destPath, newContent);
+        await fs4.ensureDir(path4.dirname(destPath));
+        await fs4.writeFile(destPath, newContent);
       }
       result.overwritten.push(relativeDest);
     } else if (options.skipExisting) {
@@ -373,8 +587,8 @@ async function handleFile(srcPath, destPath, options, result, onConflict, conten
       const choice = await onConflict(relativeDest);
       if (choice === "overwrite") {
         if (!options.dryRun) {
-          await fs3.ensureDir(path3.dirname(destPath));
-          await fs3.writeFile(destPath, newContent);
+          await fs4.ensureDir(path4.dirname(destPath));
+          await fs4.writeFile(destPath, newContent);
         }
         result.overwritten.push(relativeDest);
       } else {
@@ -385,11 +599,11 @@ async function handleFile(srcPath, destPath, options, result, onConflict, conten
     }
   } else {
     if (!options.dryRun) {
-      await fs3.ensureDir(path3.dirname(destPath));
+      await fs4.ensureDir(path4.dirname(destPath));
       if (contentOverride) {
-        await fs3.writeFile(destPath, contentOverride);
+        await fs4.writeFile(destPath, contentOverride);
       } else {
-        await fs3.copy(srcPath, destPath);
+        await fs4.copy(srcPath, destPath);
       }
     }
     result.created.push(relativeDest);
@@ -398,7 +612,7 @@ async function handleFile(srcPath, destPath, options, result, onConflict, conten
 async function patchContent(srcPath, aiDir) {
   if (aiDir === DEFAULT_AI_DIR) return void 0;
   if (!srcPath.endsWith(".md")) return void 0;
-  const content = await fs3.readFile(srcPath, "utf-8");
+  const content = await fs4.readFile(srcPath, "utf-8");
   return content.replaceAll(`${DEFAULT_AI_DIR}/`, `${aiDir}/`);
 }
 async function installDirectoryFiles(sourceDir, destDir, options, result, onConflict) {
@@ -408,8 +622,8 @@ async function installDirectoryFiles(sourceDir, destDir, options, result, onConf
     dot: true
   });
   for (const file of files) {
-    const srcFile = path3.join(sourceDir, file);
-    const destFile = path3.join(destDir, file);
+    const srcFile = path4.join(sourceDir, file);
+    const destFile = path4.join(destDir, file);
     const contentOverride = await patchContent(srcFile, options.aiDir);
     await handleFile(srcFile, destFile, options, result, onConflict, contentOverride);
   }
@@ -421,19 +635,19 @@ async function installSkill(skill, options, onConflict) {
     skipped: [],
     overwritten: []
   };
-  const destFolder = path3.join(options.targetDir, options.aiDir, "skills", skill.name);
-  const sourceFiles = await fs3.readdir(skill.sourcePath);
+  const destFolder = path4.join(options.targetDir, options.aiDir, "skills", skill.name);
+  const sourceFiles = await fs4.readdir(skill.sourcePath);
   for (const file of sourceFiles) {
-    const srcFile = path3.join(skill.sourcePath, file);
-    const stat = await fs3.stat(srcFile);
+    const srcFile = path4.join(skill.sourcePath, file);
+    const stat = await fs4.stat(srcFile);
     if (stat.isFile()) {
-      const destFile = path3.join(destFolder, file);
+      const destFile = path4.join(destFolder, file);
       const contentOverride = await patchContent(srcFile, options.aiDir);
       await handleFile(srcFile, destFile, options, result, onConflict, contentOverride);
     }
   }
   for (const client of options.clients) {
-    const stubPath = path3.join(
+    const stubPath = path4.join(
       options.targetDir,
       client.skillsDir,
       skill.name,
@@ -461,7 +675,7 @@ async function installTeamAssetFolders(assetFolders, options, onConflict) {
       skipped: [],
       overwritten: []
     };
-    const destFolder = path3.join(options.targetDir, options.aiDir, folder.name);
+    const destFolder = path4.join(options.targetDir, options.aiDir, folder.name);
     await installDirectoryFiles(folder.sourcePath, destFolder, options, result, onConflict);
     results.push(result);
   }
@@ -475,7 +689,7 @@ async function installResources(toolset, options, onConflict) {
     overwritten: []
   };
   if (!toolset.hasResources) return result;
-  const destDir = path3.join(options.targetDir, options.aiDir, "resources");
+  const destDir = path4.join(options.targetDir, options.aiDir, "resources");
   const fileResult = { created: [], skipped: [], overwritten: [] };
   await installDirectoryFiles(toolset.resourcesPath, destDir, options, fileResult, onConflict);
   result.created = fileResult.created;
@@ -653,12 +867,137 @@ function formatTeamName2(name) {
 // src/commands/install.ts
 function normalizeAiDir(raw) {
   const trimmed = raw.replace(/\/+$/, "") || DEFAULT_AI_DIR;
-  if (path4.isAbsolute(trimmed)) {
+  if (path5.isAbsolute(trimmed)) {
     console.log(chalk3.red(`--ai-dir must be a relative path, got: ${trimmed}`));
     process.exit(1);
   }
   return trimmed;
 }
+async function resolveClientSelection(parentOpts, targetDir, force) {
+  if (parentOpts.clients) {
+    try {
+      return resolveClients(String(parentOpts.clients));
+    } catch (err) {
+      console.log(chalk3.red(err.message));
+      process.exit(1);
+    }
+  }
+  const detected = await detectClients(targetDir);
+  if (force || !process.stdin.isTTY) {
+    const fallback = detected.length > 0 ? detected : ALL_CLIENTS;
+    if (!force) {
+      console.log(
+        chalk3.dim(
+          `Non-interactive terminal: writing stubs for ${fallback.map((c) => c.name).join(", ")}. Pass --clients to choose explicitly.`
+        )
+      );
+    }
+    return fallback;
+  }
+  return promptSelectClients(ALL_CLIENTS, detected);
+}
+function gateSkillStatus(skill, opts) {
+  if (skill.sourceType !== "third-party") return { allowed: true };
+  const status = skill.meta?.status;
+  switch (status) {
+    case "recommended":
+      return { allowed: true };
+    case "evaluating":
+      return opts.includeEvaluating ? { allowed: true } : {
+        allowed: false,
+        message: `Third-party skill "${skill.name}" is evaluating. Re-run with --include-evaluating to install it.`
+      };
+    case "deprecated":
+      return opts.includeDeprecated ? { allowed: true } : {
+        allowed: false,
+        message: `Third-party skill "${skill.name}" is deprecated. Re-run with --include-deprecated to install it.`
+      };
+    default:
+      return {
+        allowed: false,
+        message: `Third-party skill "${skill.name}" has no valid status in skill-meta.yml; refusing to install.`
+      };
+  }
+}
+function describeExplicitSkillStatus(skill) {
+  if (skill.sourceType !== "third-party") return void 0;
+  switch (skill.meta?.status) {
+    case "recommended":
+      return void 0;
+    case "evaluating":
+      return chalk3.yellow(`Note: "${skill.name}" is a third-party skill still under evaluation.`);
+    case "deprecated":
+      return chalk3.yellow(`Note: "${skill.name}" is a deprecated third-party skill.`);
+    default:
+      return chalk3.yellow(`Note: "${skill.name}" is a third-party skill with no recorded status.`);
+  }
+}
+function canonicalSkillPath(targetDir, aiDir, skillName) {
+  return path5.join(targetDir, aiDir, "skills", skillName);
+}
+function planTeamThirdPartySkills(skills, opts) {
+  const toInstall = [];
+  const evaluatingRefused = [];
+  const deprecated = [];
+  for (const skill of skills) {
+    const gate = gateSkillStatus(skill, opts);
+    if (gate.allowed) {
+      toInstall.push(skill);
+      continue;
+    }
+    const status = skill.meta?.status;
+    if (status === "evaluating") {
+      evaluatingRefused.push(skill);
+    } else if (status === "deprecated") {
+      deprecated.push(skill);
+    }
+  }
+  return { toInstall, evaluatingRefused, deprecated };
+}
+async function resolveTeamThirdPartyNotices(plan, options) {
+  const evaluating = [];
+  for (const skill of plan.evaluatingRefused) {
+    const alreadyInstalled = await fs5.pathExists(
+      canonicalSkillPath(options.targetDir, options.aiDir, skill.name)
+    );
+    evaluating.push({ skill, alreadyInstalled });
+  }
+  const deprecatedPresent = [];
+  for (const skill of plan.deprecated) {
+    if (await fs5.pathExists(
+      canonicalSkillPath(options.targetDir, options.aiDir, skill.name)
+    )) {
+      deprecatedPresent.push(skill);
+    }
+  }
+  return { evaluating, deprecatedPresent };
+}
+function printTeamThirdPartyNotices(notices, teamName, aiDir) {
+  if (notices.evaluating.length > 0) {
+    console.log(chalk3.bold("Third-party skills in evaluation (not installed by default)"));
+    for (const { skill, alreadyInstalled } of notices.evaluating) {
+      const state = alreadyInstalled ? chalk3.dim("installed, not updated (re-run with --include-evaluating)") : chalk3.dim("not installed");
+      console.log(`  ${chalk3.yellow(skill.name.padEnd(24))} ${state}`);
+    }
+    console.log(`
+  These skills are still being evaluated. To install them and help evaluate, run:`);
+    console.log(chalk3.cyan(`    npx @groupby/ai-dev install team ${teamName} --include-evaluating`));
+    console.log();
+  }
+  if (notices.deprecatedPresent.length > 0) {
+    console.log(chalk3.yellow("Deprecated third-party skills"));
+    for (const skill of notices.deprecatedPresent) {
+      const canonicalRel = path5.join(aiDir, "skills", skill.name);
+      const stubPaths = ALL_CLIENTS.map((c) => path5.join(c.skillsDir, skill.name));
+      console.log(`  ${chalk3.yellow(skill.name)} is now deprecated and was not updated.`);
+      console.log(`    To stop agents from using it, remove these folders:`);
+      for (const p of [canonicalRel, ...stubPaths]) {
+        console.log(`      ${chalk3.cyan(p)}`);
+      }
+    }
+    console.log();
+  }
+}
 function formatFileCounts(result, options) {
   const createdWord = options.dryRun ? "would create" : "created";
   const skippedWord = "up to date";
@@ -722,29 +1061,81 @@ ${prefix}${chalk3.bold("Install complete")}
   console.log(`  Clients: ${options.clients.map((c) => c.name).join(", ") || chalk3.dim("none")}`);
   console.log();
 }
-async function installSkillCmd(name, _opts, cmd) {
+function skillScopeLabel(skill) {
+  return skill.teamName ?? skill.toolsetName ?? "library";
+}
+function describeSkillOrigin(skill) {
+  if (skill.sourceType === "third-party") {
+    const meta = skill.meta;
+    const sha = meta?.pinnedCommit ? meta.pinnedCommit.slice(0, 7) : "unpinned";
+    const source = meta?.source ? `${meta.source}@${sha}` : "unknown source";
+    const status = meta?.status ?? "no status";
+    const vendored = meta?.vendoredOn ? `, vendored ${meta.vendoredOn}` : "";
+    return `third-party [${status}] ${source}${vendored}`;
+  }
+  if (skill.sourceType === "toolset") return `toolset ${skill.toolsetName}`;
+  if (skill.sourceType === "library") return "library skill";
+  return "team skill";
+}
+function parseSkillRef(raw) {
+  const slash = raw.indexOf("/");
+  if (slash === -1) return { name: raw };
+  return { team: raw.slice(0, slash) || void 0, name: raw.slice(slash + 1) };
+}
+async function installSkillCmd(name, opts, cmd) {
   const parentOpts = cmd.parent.opts();
   const force = Boolean(parentOpts.force);
   const skipExisting = Boolean(parentOpts.skipExisting);
   const dryRun = Boolean(parentOpts.dryRun);
-  const targetDir = path4.resolve(
+  const targetDir = path5.resolve(
     parentOpts.target || process.cwd()
   );
   const aiDir = normalizeAiDir(parentOpts.aiDir || DEFAULT_AI_DIR);
-  const skill = await findSkill(name);
-  if (!skill) {
+  const ref = parseSkillRef(name);
+  const teamOpt = typeof opts.team === "string" ? opts.team : void 0;
+  if (ref.team && teamOpt && ref.team.toLowerCase() !== teamOpt.toLowerCase()) {
+    console.log(
+      chalk3.red(
+        `Conflicting team scope: "${ref.team}" in the name vs "${teamOpt}" from --team.`
+      )
+    );
+    process.exit(1);
+  }
+  const teamScope = ref.team ?? teamOpt;
+  const skillName = ref.name;
+  const matches = await findSkillMatches(skillName, teamScope);
+  const resolution = resolveSkillMatches(matches);
+  if (resolution.kind === "none") {
     const all = await discoverSkills();
-    console.log(chalk3.red(`Skill "${name}" not found.`));
+    console.log(
+      chalk3.red(
+        teamScope ? `Skill "${skillName}" not found in team "${teamScope}".` : `Skill "${skillName}" not found.`
+      )
+    );
     console.log(`Available skills: ${all.map((s) => s.name).join(", ")}`);
     process.exit(1);
   }
-  const detected = await detectClients(targetDir);
-  let clients;
-  if (force) {
-    clients = detected.length > 0 ? detected : ALL_CLIENTS;
-  } else {
-    clients = await promptSelectClients(ALL_CLIENTS, detected);
+  if (resolution.kind === "ambiguous") {
+    console.log(
+      chalk3.red(
+        `Skill "${skillName}" is ambiguous \u2014 ${resolution.matches.length} skills match:`
+      )
+    );
+    for (const m of resolution.matches) {
+      console.log(
+        `  ${chalk3.cyan(`${skillScopeLabel(m)}/${m.name}`)}  ${chalk3.dim(describeSkillOrigin(m))}`
+      );
+    }
+    const example = resolution.matches[0];
+    console.log("Disambiguate with a team scope, e.g.:");
+    console.log(`  ai-dev install skill ${skillScopeLabel(example)}/${example.name}`);
+    console.log(`  ai-dev install skill ${example.name} --team ${skillScopeLabel(example)}`);
+    process.exit(1);
   }
+  const skill = resolution.skill;
+  const statusNotice = describeExplicitSkillStatus(skill);
+  if (statusNotice) console.log(statusNotice);
+  const clients = await resolveClientSelection(parentOpts, targetDir, force);
   const options = {
     targetDir,
     aiDir,
@@ -763,7 +1154,7 @@ async function installTeamCmd(name, _opts, cmd) {
   const force = Boolean(parentOpts.force);
   const skipExisting = Boolean(parentOpts.skipExisting);
   const dryRun = Boolean(parentOpts.dryRun);
-  const targetDir = path4.resolve(
+  const targetDir = path5.resolve(
     parentOpts.target || process.cwd()
   );
   const aiDir = normalizeAiDir(parentOpts.aiDir || DEFAULT_AI_DIR);
@@ -777,19 +1168,19 @@ async function installTeamCmd(name, _opts, cmd) {
     process.exit(1);
   }
   let skillsToInstall = [...team.skills];
-  const includeLibrary = await promptIncludeLibrary();
+  const thirdPartyPlan = planTeamThirdPartySkills(team.thirdPartySkills, {
+    includeEvaluating: Boolean(parentOpts.includeEvaluating),
+    includeDeprecated: Boolean(parentOpts.includeDeprecated)
+  });
+  skillsToInstall.push(...thirdPartyPlan.toInstall);
+  const nonInteractive = Boolean(parentOpts.clients) || force || !process.stdin.isTTY;
+  const includeLibrary = parentOpts.includeLibrary ? true : nonInteractive ? false : await promptIncludeLibrary();
   if (includeLibrary) {
     const allSkills = await discoverSkills();
     const librarySkills = allSkills.filter((s) => s.sourceType === "library");
     skillsToInstall.push(...librarySkills);
   }
-  const detected = await detectClients(targetDir);
-  let clients;
-  if (force) {
-    clients = detected.length > 0 ? detected : ALL_CLIENTS;
-  } else {
-    clients = await promptSelectClients(ALL_CLIENTS, detected);
-  }
+  const clients = await resolveClientSelection(parentOpts, targetDir, force);
   const options = {
     targetDir,
     aiDir,
@@ -810,13 +1201,15 @@ async function installTeamCmd(name, _opts, cmd) {
     conflictHandler
   );
   printResults(results, options, [], assetResults);
+  const notices = await resolveTeamThirdPartyNotices(thirdPartyPlan, options);
+  printTeamThirdPartyNotices(notices, team.name, options.aiDir);
 }
 async function installToolsetCmd(name, _opts, cmd) {
   const parentOpts = cmd.parent.opts();
   const force = Boolean(parentOpts.force);
   const skipExisting = Boolean(parentOpts.skipExisting);
   const dryRun = Boolean(parentOpts.dryRun);
-  const targetDir = path4.resolve(
+  const targetDir = path5.resolve(
     parentOpts.target || process.cwd()
   );
   const aiDir = normalizeAiDir(parentOpts.aiDir || DEFAULT_AI_DIR);
@@ -829,13 +1222,7 @@ async function installToolsetCmd(name, _opts, cmd) {
     }
     process.exit(1);
   }
-  const detected = await detectClients(targetDir);
-  let clients;
-  if (force) {
-    clients = detected.length > 0 ? detected : ALL_CLIENTS;
-  } else {
-    clients = await promptSelectClients(ALL_CLIENTS, detected);
-  }
+  const clients = await resolveClientSelection(parentOpts, targetDir, force);
   const options = {
     targetDir,
     aiDir,
@@ -854,41 +1241,407 @@ async function installToolsetCmd(name, _opts, cmd) {
 }
 var INHERITED_OPTIONS_HELP = `
 Parent options (pass before subcommand):
-  --force            Overwrite existing files without prompting
-  --skip-existing    Skip files that already exist without prompting
-  --dry-run          Show what would be installed without writing files
-  --target <dir>     Install to a different directory (default: CWD)
-  --ai-dir <path>    Override the AI content directory (default: docs/ai)`;
+  --force               Overwrite existing files without prompting
+  --skip-existing       Skip files that already exist without prompting
+  --dry-run             Show what would be installed without writing files
+  --include-evaluating  Include evaluating third-party skills in a team install (a named skill always installs)
+  --include-deprecated  Include deprecated third-party skills in a team install (a named skill always installs)
+  --clients <list>      Client stubs to write non-interactively: copilot,claude,codex, or all
+  --include-library     Include shared library skills without prompting (use with --clients)
+  --target <dir>        Install to a different directory (default: CWD)
+  --ai-dir <path>       Override the AI content directory (default: docs/ai)`;
 function registerInstallCommand(program2) {
-  const install = program2.command("install").description("Install AI content").option("--force", "Overwrite existing files without prompting").option("--skip-existing", "Skip files that already exist without prompting").option("--dry-run", "Show what would be installed without writing files").option("--target <dir>", "Install to a different directory (default: CWD)").option("--ai-dir <path>", "Override the AI content directory (default: docs/ai)");
-  install.command("skill <name>").description("Install a specific skill").addHelpText("after", INHERITED_OPTIONS_HELP).action(installSkillCmd);
+  const install = program2.command("install").description("Install AI content").option("--force", "Overwrite existing files without prompting").option("--skip-existing", "Skip files that already exist without prompting").option("--dry-run", "Show what would be installed without writing files").option("--include-evaluating", "Include evaluating third-party skills in a team install (a named skill always installs)").option("--include-deprecated", "Include deprecated third-party skills in a team install (a named skill always installs)").option("--clients <list>", "Client stubs to write non-interactively: copilot,claude,codex, or all").option("--include-library", "Include shared library skills without prompting (use with --clients)").option("--target <dir>", "Install to a different directory (default: CWD)").option("--ai-dir <path>", "Override the AI content directory (default: docs/ai)");
+  install.command("skill <name>").description("Install a specific skill (use <team>/<name> or --team to disambiguate)").option("--team <team>", "Scope the skill to a specific team when the name is ambiguous").addHelpText("after", INHERITED_OPTIONS_HELP).action(installSkillCmd);
   install.command("team <name>").description("Install all skills, prompts, and content folders for a team").addHelpText("after", INHERITED_OPTIONS_HELP).action(installTeamCmd);
   install.command("toolset <name>").description("Install all skills and resources for a toolset").addHelpText("after", INHERITED_OPTIONS_HELP).action(installToolsetCmd);
 }
 
+// src/commands/vendor.ts
+import { execFileSync } from "child_process";
+import chalk4 from "chalk";
+
+// src/lib/vendor.ts
+import path6 from "path";
+import fs6 from "fs-extra";
+
+// src/lib/github.ts
+var URL_HOST_ALLOWLIST = /* @__PURE__ */ new Set(["github.com", "www.github.com"]);
+var FETCH_HOST_ALLOWLIST = /* @__PURE__ */ new Set(["api.github.com", "raw.githubusercontent.com"]);
+var SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
+var SHA_RE = /^[0-9a-f]{40}$/i;
+function parseGitHubUrl(input2) {
+  let url;
+  try {
+    url = new URL(input2);
+  } catch {
+    throw new Error(`Invalid URL: ${input2}`);
+  }
+  if (url.protocol !== "https:") {
+    throw new Error(`Only https:// GitHub URLs are supported (got ${url.protocol}).`);
+  }
+  if (!URL_HOST_ALLOWLIST.has(url.hostname)) {
+    throw new Error(`Only github.com URLs are supported (got ${url.hostname}).`);
+  }
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments.length < 5) {
+    throw new Error(
+      "URL must point to a skill folder: https://github.com/<owner>/<repo>/tree/<ref>/<path>/<skill>"
+    );
+  }
+  const [owner, repo, kind, ref, ...rest] = segments;
+  if (kind !== "tree" && kind !== "blob") {
+    throw new Error(`URL must contain /tree/ or /blob/ (got /${kind}/).`);
+  }
+  let pathSegments = rest;
+  if (kind === "blob") {
+    if (pathSegments[pathSegments.length - 1] !== "SKILL.md") {
+      throw new Error("Blob URLs must point to a SKILL.md file.");
+    }
+    pathSegments = pathSegments.slice(0, -1);
+  }
+  if (pathSegments.length === 0) {
+    throw new Error("URL must include a skill folder path after the ref.");
+  }
+  for (const seg of [owner, repo, ref, ...pathSegments]) {
+    if (!SEGMENT_RE.test(seg)) {
+      throw new Error(`Unsafe path segment "${seg}" in URL.`);
+    }
+  }
+  return {
+    owner,
+    repo,
+    ref,
+    path: pathSegments.join("/"),
+    skill: pathSegments[pathSegments.length - 1],
+    source: `${owner}/${repo}`
+  };
+}
+async function resolveCommitSha(parsed, token) {
+  if (SHA_RE.test(parsed.ref)) {
+    return parsed.ref.toLowerCase();
+  }
+  const { owner, repo, ref, path: path8 } = parsed;
+  const commitsUrl = `https://api.github.com/repos/${owner}/${repo}/commits?path=${encodePath(path8)}&sha=${encodeURIComponent(ref)}&per_page=1`;
+  const commits = await fetchJson(commitsUrl, token, { allowNotFound: true });
+  if (Array.isArray(commits) && typeof commits[0]?.sha === "string" && SHA_RE.test(commits[0].sha)) {
+    return commits[0].sha;
+  }
+  for (const refType of ["heads", "tags"]) {
+    const refUrl = `https://api.github.com/repos/${owner}/${repo}/git/refs/${refType}/${encodeURIComponent(ref)}`;
+    const data = await fetchJson(refUrl, token, { allowNotFound: true });
+    const sha = data?.object?.sha;
+    if (typeof sha === "string" && SHA_RE.test(sha)) return sha;
+  }
+  throw new Error(`Could not resolve "${ref}" to a commit SHA in ${owner}/${repo}.`);
+}
+async function fetchFolderContents(parsed, sha, subPath, token) {
+  const folderPath = subPath ? `${parsed.path}/${subPath}` : parsed.path;
+  const url = `https://api.github.com/repos/${parsed.owner}/${parsed.repo}/contents/${encodePath(folderPath)}?ref=${encodeURIComponent(sha)}`;
+  const data = await fetchJson(url, token);
+  if (!Array.isArray(data)) {
+    throw new Error(`Expected a folder at ${folderPath}, but got a single file.`);
+  }
+  return data.map((entry) => ({
+    name: String(entry.name),
+    type: entry.type === "dir" ? "dir" : "file",
+    path: String(entry.path),
+    downloadUrl: typeof entry.download_url === "string" ? entry.download_url : null
+  }));
+}
+async function fetchFileText(url, token) {
+  assertAllowedHost(url);
+  const res = await fetch(url, { headers: buildHeaders(token, "text"), redirect: "error" });
+  if (!res.ok) {
+    throw new Error(`Fetch failed (${res.status}) for ${url}`);
+  }
+  const text = await res.text();
+  if (text.includes("\0")) {
+    throw new Error(`Refusing to vendor binary content from ${url}`);
+  }
+  return text;
+}
+async function fetchJson(url, token, opts = {}) {
+  assertAllowedHost(url);
+  const res = await fetch(url, { headers: buildHeaders(token, "json"), redirect: "error" });
+  if (res.status === 404 && opts.allowNotFound) return void 0;
+  if (!res.ok) {
+    throw new Error(`GitHub API request failed (${res.status}) for ${url}`);
+  }
+  return res.json();
+}
+function buildHeaders(token, kind) {
+  const headers = {
+    "User-Agent": "groupby-ai-dev-vendor",
+    Accept: kind === "json" ? "application/vnd.github+json" : "text/plain"
+  };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  return headers;
+}
+function assertAllowedHost(rawUrl) {
+  let host;
+  try {
+    host = new URL(rawUrl).hostname;
+  } catch {
+    throw new Error(`Invalid fetch URL: ${rawUrl}`);
+  }
+  if (!FETCH_HOST_ALLOWLIST.has(host)) {
+    throw new Error(`Refusing to fetch from disallowed host "${host}".`);
+  }
+}
+function encodePath(p) {
+  return p.split("/").map(encodeURIComponent).join("/");
+}
+
+// src/lib/vendor.ts
+var SAFE_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var AGENT_FILE_CLIENT = {
+  openai: "codex",
+  codex: "codex",
+  anthropic: "claude",
+  claude: "claude",
+  copilot: "copilot",
+  github: "copilot"
+};
+async function vendorSkill(options) {
+  const parsed = parseGitHubUrl(options.url);
+  const skill = options.as ?? parsed.skill;
+  if (!SAFE_NAME_RE.test(skill)) {
+    throw new Error(`Unsafe skill name "${skill}".`);
+  }
+  const lib = options.lib ?? parsed.owner;
+  if (!SAFE_NAME_RE.test(lib)) {
+    throw new Error(`Unsafe lib name "${lib}".`);
+  }
+  const status = options.status ?? "evaluating";
+  if (!SAFE_NAME_RE.test(options.team)) {
+    throw new Error(`Unsafe team name "${options.team}".`);
+  }
+  const repoRoot = options.repoRoot ?? await findRepoRoot(process.cwd());
+  const teamDir = path6.join(repoRoot, "teams", options.team);
+  if (!await fs6.pathExists(teamDir)) {
+    throw new Error(`Team "${options.team}" not found at teams/${options.team}.`);
+  }
+  const relativeFolder = path6.join("teams", options.team, "third-party", lib, skill);
+  const skillFolder = path6.join(repoRoot, relativeFolder);
+  const exists = await fs6.pathExists(skillFolder);
+  if (exists && !options.update) {
+    throw new Error(`${relativeFolder} already exists. Pass --update to re-vendor it.`);
+  }
+  if (!exists && options.update) {
+    throw new Error(`${relativeFolder} does not exist. Run without --update to create it.`);
+  }
+  const sha = await resolveCommitSha(parsed, options.token);
+  const entries = await fetchFolderContents(parsed, sha, void 0, options.token);
+  const skillEntry = entries.find((e) => e.type === "file" && e.name === "SKILL.md");
+  if (!skillEntry?.downloadUrl) {
+    throw new Error(`No SKILL.md found in ${parsed.path}.`);
+  }
+  const skillMd = await fetchFileText(skillEntry.downloadUrl, options.token);
+  const { data } = parseFrontmatter(skillMd);
+  if (data.name !== skill) {
+    throw new Error(
+      `SKILL.md frontmatter name "${data.name}" does not match folder "${skill}". Use --as ${data.name} to match, or rename the target.`
+    );
+  }
+  const { agents, droppedAgentsFiles } = await captureAgents(parsed, sha, entries, options.token);
+  const warnings = collectActivationWarnings(data);
+  const existingMeta = exists ? await readSkillMeta(skillFolder) : void 0;
+  const meta = buildMeta({
+    parsed,
+    skill,
+    sha,
+    status,
+    agents,
+    droppedAgentsFiles,
+    reviewedBy: options.reviewedBy,
+    defaultReviewedBy: options.defaultReviewedBy,
+    vendoredOn: options.vendoredOn ?? today(),
+    existing: existingMeta,
+    isUpdate: Boolean(options.update),
+    statusExplicit: options.status !== void 0,
+    reviewedByExplicit: options.reviewedBy !== void 0
+  });
+  let wrote = false;
+  if (!options.dryRun) {
+    await fs6.ensureDir(skillFolder);
+    await fs6.writeFile(path6.join(skillFolder, "SKILL.md"), skillMd);
+    await fs6.writeFile(path6.join(skillFolder, SKILL_META_FILENAME), serializeSkillMeta(meta));
+    wrote = true;
+  }
+  return {
+    relativeFolder,
+    skillFolder,
+    skill,
+    pinnedCommit: sha,
+    status: meta.status,
+    agents: meta.agents ?? [],
+    droppedAgentsFiles,
+    wrote,
+    warnings
+  };
+}
+async function captureAgents(parsed, sha, entries, token) {
+  const agentsDir = entries.find((e) => e.type === "dir" && e.name === "agents");
+  if (!agentsDir) return { agents: [], droppedAgentsFiles: [] };
+  const agentFiles = await fetchFolderContents(parsed, sha, "agents", token);
+  const agents = /* @__PURE__ */ new Set();
+  const droppedAgentsFiles = [];
+  for (const file of agentFiles) {
+    if (file.type !== "file" || !/\.ya?ml$/i.test(file.name)) continue;
+    droppedAgentsFiles.push(`agents/${file.name}`);
+    const stem = file.name.replace(/\.ya?ml$/i, "").toLowerCase();
+    agents.add(AGENT_FILE_CLIENT[stem] ?? stem);
+  }
+  return { agents: Array.from(agents), droppedAgentsFiles };
+}
+function collectActivationWarnings(data) {
+  const warnings = [];
+  const applyTo = data.applyTo;
+  const applyToValues = Array.isArray(applyTo) ? applyTo : [applyTo];
+  if (applyToValues.some((v) => typeof v === "string" && v.includes("**"))) {
+    warnings.push(`frontmatter applyTo: ${JSON.stringify(applyTo)} (broad auto-activation)`);
+  }
+  if (data.alwaysApply === true || data.alwaysApply === "true") {
+    warnings.push("frontmatter alwaysApply: true (auto-activates on every request)");
+  }
+  return warnings;
+}
+function buildMeta(input2) {
+  const dropped = input2.droppedAgentsFiles.length > 0 ? ` Upstream ships nested ${input2.droppedAgentsFiles.join(", ")}; captured into agents and not copied (the installer vendors top-level files only).` : "";
+  const baseNote = `Vendored via \`ai-dev vendor\` from ${input2.parsed.source} at ${input2.parsed.path}.${dropped}`;
+  const meta = {
+    source: input2.parsed.source,
+    upstreamName: input2.parsed.skill,
+    pinnedCommit: input2.sha,
+    vendoredOn: input2.vendoredOn,
+    status: input2.status
+  };
+  if (input2.isUpdate && input2.existing) {
+    if (!input2.statusExplicit && input2.existing.status) meta.status = input2.existing.status;
+    const reviewedBy = input2.reviewedByExplicit ? input2.reviewedBy : input2.existing.reviewedBy;
+    if (reviewedBy) meta.reviewedBy = reviewedBy;
+    const agents = input2.existing.agents?.length ? input2.existing.agents : input2.agents;
+    if (agents.length > 0) meta.agents = agents;
+    const existingNotes = (input2.existing.notes ?? "").replace(/\s*Re-vendored on \d{4}-\d{2}-\d{2}\.?/g, "").trim();
+    const base = existingNotes.length > 0 ? existingNotes : baseNote;
+    meta.notes = `${base} Re-vendored on ${input2.vendoredOn}.`;
+  } else {
+    if (input2.agents.length > 0) meta.agents = input2.agents;
+    const reviewedBy = input2.reviewedBy ?? input2.defaultReviewedBy;
+    if (reviewedBy) meta.reviewedBy = reviewedBy;
+    meta.notes = baseNote;
+  }
+  return meta;
+}
+function today() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+async function findRepoRoot(startDir) {
+  let dir = path6.resolve(startDir);
+  for (; ; ) {
+    const hasTeams = await fs6.pathExists(path6.join(dir, "teams"));
+    const hasConventions = await fs6.pathExists(
+      path6.join(dir, "docs", "content-conventions.md")
+    );
+    if (hasTeams && hasConventions) return dir;
+    const parent = path6.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    "Could not locate the ai-dev-shared repo root. Run this command from within the repo."
+  );
+}
+
+// src/commands/vendor.ts
+function resolveReviewedBy(explicit) {
+  if (explicit) return explicit;
+  try {
+    const name = execFileSync("git", ["config", "user.name"], { encoding: "utf-8" }).trim();
+    return name || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function printSummary(result, dryRun) {
+  const prefix = dryRun ? chalk4.dim("[dry-run] ") : "";
+  console.log(`
+${prefix}Vendored: ${result.relativeFolder}/`);
+  console.log(`  SKILL.md          (pinned to ${result.pinnedCommit.slice(0, 7)})`);
+  console.log(`  skill-meta.yml    (status: ${result.status})`);
+  console.log(
+    `
+${chalk4.yellow("\u26A0  REVIEW BEFORE USE")} \u2014 vendored content has not been audited.`
+  );
+  for (const warning of result.warnings) {
+    console.log(chalk4.yellow(`   ${warning}`));
+  }
+  console.log(
+    `Next: ai-dev install skill ${result.skill}`
+  );
+}
+async function vendorCmd(url, opts) {
+  if (!opts.team) {
+    console.log(chalk4.red("--team is required."));
+    process.exit(1);
+  }
+  const status = opts.status;
+  if (status && !VALID_STATUSES.includes(status)) {
+    console.log(
+      chalk4.red(`Invalid --status "${status}". Use one of: ${VALID_STATUSES.join(", ")}.`)
+    );
+    process.exit(1);
+  }
+  const options = {
+    url,
+    team: String(opts.team),
+    lib: opts.lib ? String(opts.lib) : void 0,
+    status,
+    as: opts.as ? String(opts.as) : void 0,
+    // Explicit --reviewed-by overrides a stored value; git config is only a
+    // fallback for brand-new vendors, so it must not count as "explicit".
+    reviewedBy: opts.reviewedBy ? String(opts.reviewedBy) : void 0,
+    defaultReviewedBy: resolveReviewedBy(),
+    update: Boolean(opts.update),
+    dryRun: Boolean(opts.dryRun),
+    token: process.env.GITHUB_TOKEN || void 0
+  };
+  try {
+    const result = await vendorSkill(options);
+    printSummary(result, options.dryRun ?? false);
+  } catch (err) {
+    console.log(chalk4.red(err.message));
+    process.exit(1);
+  }
+}
+function registerVendorCommand(program2) {
+  program2.command("vendor <github-url>", { hidden: true }).description("Vendor a third-party skill from a GitHub URL (authoring)").option("--team <team>", "Target team folder (required)").option("--lib <lib>", "Override the <lib> path segment (default: repo owner)").option("--status <status>", "Initial status: evaluating|recommended|deprecated (default: evaluating)").option("--as <name>", "Override the skill folder name (must match SKILL.md name)").option("--reviewed-by <handle>", "Reviewer handle (default: git config user.name)").option("--update", "Re-vendor into an existing folder, refreshing the pinned commit").option("--dry-run", "Print what would be written without creating files").action(vendorCmd);
+}
+
 // src/commands/interactive.ts
 import { select as select2 } from "@inquirer/prompts";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 function formatFileCounts2(result, options) {
   const createdWord = options.dryRun ? "would create" : "created";
   const skippedWord = "up to date";
   const overwrittenWord = options.dryRun ? "would overwrite" : "overwritten";
   const parts = [];
-  if (result.created.length > 0) parts.push(chalk4.green(`${result.created.length} ${createdWord}`));
-  if (result.skipped.length > 0) parts.push(chalk4.dim(`${result.skipped.length} ${skippedWord}`));
-  if (result.overwritten.length > 0) parts.push(chalk4.yellow(`${result.overwritten.length} ${overwrittenWord}`));
+  if (result.created.length > 0) parts.push(chalk5.green(`${result.created.length} ${createdWord}`));
+  if (result.skipped.length > 0) parts.push(chalk5.dim(`${result.skipped.length} ${skippedWord}`));
+  if (result.overwritten.length > 0) parts.push(chalk5.yellow(`${result.overwritten.length} ${overwrittenWord}`));
   return parts.join(", ");
 }
 function printResults2(results, options, resourceResults = [], assetResults = []) {
-  const prefix = options.dryRun ? chalk4.yellow("[DRY RUN] ") : "";
+  const prefix = options.dryRun ? chalk5.yellow("[DRY RUN] ") : "";
   console.log(`
-${prefix}${chalk4.bold("Install complete")}
+${prefix}${chalk5.bold("Install complete")}
 `);
   if (resourceResults.length > 0) {
     console.log("  Toolset resources       Status");
     console.log("  " + "\u2500".repeat(50));
     for (const r of resourceResults) {
-      console.log(`  ${chalk4.cyan(r.toolset.padEnd(24))} ${formatFileCounts2(r, options)}`);
+      console.log(`  ${chalk5.cyan(r.toolset.padEnd(24))} ${formatFileCounts2(r, options)}`);
     }
     console.log();
   }
@@ -898,7 +1651,7 @@ ${prefix}${chalk4.bold("Install complete")}
       console.log("  Prompt                  Status");
       console.log("  " + "\u2500".repeat(50));
       for (const r of prompts) {
-        console.log(`  ${chalk4.cyan(r.folder.padEnd(24))} ${formatFileCounts2(r, options)}`);
+        console.log(`  ${chalk5.cyan(r.folder.padEnd(24))} ${formatFileCounts2(r, options)}`);
       }
       console.log();
     }
@@ -906,7 +1659,7 @@ ${prefix}${chalk4.bold("Install complete")}
       console.log("  Resource                Status");
       console.log("  " + "\u2500".repeat(50));
       for (const r of resources) {
-        console.log(`  ${chalk4.cyan(r.folder.padEnd(24))} ${formatFileCounts2(r, options)}`);
+        console.log(`  ${chalk5.cyan(r.folder.padEnd(24))} ${formatFileCounts2(r, options)}`);
       }
       console.log();
     }
@@ -914,7 +1667,7 @@ ${prefix}${chalk4.bold("Install complete")}
       console.log("  Content folder          Status");
       console.log("  " + "\u2500".repeat(50));
       for (const r of generic) {
-        console.log(`  ${chalk4.cyan(r.folder.padEnd(24))} ${formatFileCounts2(r, options)}`);
+        console.log(`  ${chalk5.cyan(r.folder.padEnd(24))} ${formatFileCounts2(r, options)}`);
       }
       console.log();
     }
@@ -923,20 +1676,20 @@ ${prefix}${chalk4.bold("Install complete")}
     console.log("  Skill                   Status");
     console.log("  " + "\u2500".repeat(50));
     for (const r of results) {
-      console.log(`  ${chalk4.cyan(r.skill.padEnd(24))} ${formatFileCounts2(r, options)}`);
+      console.log(`  ${chalk5.cyan(r.skill.padEnd(24))} ${formatFileCounts2(r, options)}`);
     }
     console.log();
   }
   console.log(`  Target: ${options.targetDir}`);
   console.log(`  AI directory: ${options.aiDir}`);
-  console.log(`  Clients: ${options.clients.map((c) => c.name).join(", ") || chalk4.dim("none")}`);
+  console.log(`  Clients: ${options.clients.map((c) => c.name).join(", ") || chalk5.dim("none")}`);
   console.log();
 }
 async function listAll2() {
   const skills = await discoverSkills();
   const teams = await discoverTeams();
   if (skills.length === 0) {
-    console.log(chalk4.yellow("No skills found in package. This may indicate a build issue."));
+    console.log(chalk5.yellow("No skills found in package. This may indicate a build issue."));
     return;
   }
   const librarySkills = skills.filter((s) => s.sourceType === "library");
@@ -944,9 +1697,9 @@ async function listAll2() {
   const formatTeamName3 = (name) => name.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
   const truncate3 = (str, max) => str.length <= max ? str : str.slice(0, max - 3) + "...";
   if (librarySkills.length > 0) {
-    console.log(chalk4.bold("\nLibrary"));
+    console.log(chalk5.bold("\nLibrary"));
     for (const s of librarySkills) {
-      console.log(`  ${chalk4.cyan(s.name.padEnd(24))} ${truncate3(s.description, 60)}`);
+      console.log(`  ${chalk5.cyan(s.name.padEnd(24))} ${truncate3(s.description, 60)}`);
     }
   }
   const teamMap = /* @__PURE__ */ new Map();
@@ -957,33 +1710,33 @@ async function listAll2() {
     teamMap.set(team, existing);
   }
   for (const [team, skillList] of teamMap) {
-    console.log(chalk4.bold(`
+    console.log(chalk5.bold(`
 ${formatTeamName3(team)}`));
     for (const s of skillList) {
-      console.log(`  ${chalk4.cyan(s.name.padEnd(24))} ${truncate3(s.description, 60)}`);
+      console.log(`  ${chalk5.cyan(s.name.padEnd(24))} ${truncate3(s.description, 60)}`);
     }
   }
   if (teams.length > 0) {
-    console.log(chalk4.bold("\nTeams"));
+    console.log(chalk5.bold("\nTeams"));
     for (const t of teams) {
       console.log(
-        `  ${chalk4.cyan(formatTeamName3(t.name).padEnd(24))} ${formatTeamContents(t)}`
+        `  ${chalk5.cyan(formatTeamName3(t.name).padEnd(24))} ${formatTeamContents(t)}`
       );
     }
   }
   const toolsets = await discoverToolsets();
   if (toolsets.length > 0) {
-    console.log(chalk4.bold("\nToolsets"));
+    console.log(chalk5.bold("\nToolsets"));
     for (const t of toolsets) {
       console.log(
-        `  ${chalk4.cyan(t.name.padEnd(24))} ${t.skills.length} skill${t.skills.length !== 1 ? "s" : ""}`
+        `  ${chalk5.cyan(t.name.padEnd(24))} ${t.skills.length} skill${t.skills.length !== 1 ? "s" : ""}`
       );
     }
   }
   console.log();
 }
 async function runInteractive() {
-  console.log(chalk4.bold("\n@groupby/ai-dev \u2014 AI Skills Installer\n"));
+  console.log(chalk5.bold("\n@groupby/ai-dev \u2014 AI Skills Installer\n"));
   const action = await select2({
     message: "What would you like to do?",
     choices: [
@@ -1001,7 +1754,7 @@ async function runInteractive() {
   if (action === "install-skills") {
     const allSkills = await discoverSkills();
     if (allSkills.length === 0) {
-      console.log(chalk4.yellow("No skills found in package. This may indicate a build issue."));
+      console.log(chalk5.yellow("No skills found in package. This may indicate a build issue."));
       process.exit(1);
     }
     const selectedSkills = await promptSelectSkills(allSkills);
@@ -1010,7 +1763,7 @@ async function runInteractive() {
     const aiDir = await promptInstallDir();
     const confirmed = await promptConfirmInstall(selectedSkills, clients, targetDir, aiDir);
     if (!confirmed) {
-      console.log(chalk4.dim("Cancelled."));
+      console.log(chalk5.dim("Cancelled."));
       return;
     }
     const options = {
@@ -1027,11 +1780,18 @@ async function runInteractive() {
   } else if (action === "install-team") {
     const teams = await discoverTeams();
     if (teams.length === 0) {
-      console.log(chalk4.yellow("No teams found."));
+      console.log(chalk5.yellow("No teams found."));
       return;
     }
     const team = await promptSelectTeam(teams);
     let skillsToInstall = [...team.skills];
+    if (team.thirdPartySkills.length > 0) {
+      console.log(
+        chalk5.dim(
+          `Note: this team has third-party skills. Interactive mode installs first-party content only; run 'npx @groupby/ai-dev install team ${team.name}' to manage third-party skills.`
+        )
+      );
+    }
     const includeLibrary = await promptIncludeLibrary();
     if (includeLibrary) {
       const allSkills = await discoverSkills();
@@ -1043,7 +1803,7 @@ async function runInteractive() {
     const aiDir = await promptInstallDir();
     const confirmed = await promptConfirmInstall(skillsToInstall, clients, targetDir, aiDir, team.assetFolders);
     if (!confirmed) {
-      console.log(chalk4.dim("Cancelled."));
+      console.log(chalk5.dim("Cancelled."));
       return;
     }
     const options = {
@@ -1060,7 +1820,7 @@ async function runInteractive() {
   } else if (action === "install-toolset") {
     const toolsets = await discoverToolsets();
     if (toolsets.length === 0) {
-      console.log(chalk4.yellow("No toolsets found."));
+      console.log(chalk5.yellow("No toolsets found."));
       return;
     }
     const toolset = await promptSelectToolset(toolsets);
@@ -1069,7 +1829,7 @@ async function runInteractive() {
     const aiDir = await promptInstallDir();
     const confirmed = await promptConfirmInstall(toolset.skills, clients, targetDir, aiDir);
     if (!confirmed) {
-      console.log(chalk4.dim("Cancelled."));
+      console.log(chalk5.dim("Cancelled."));
       return;
     }
     const options = {
@@ -1091,15 +1851,16 @@ async function runInteractive() {
 
 // src/index.ts
 function getPackageVersion() {
-  const packageRoot = path5.resolve(path5.dirname(fileURLToPath2(import.meta.url)), "..");
-  const packageJsonPath = path5.join(packageRoot, "package.json");
-  const packageJson = JSON.parse(fs4.readFileSync(packageJsonPath, "utf-8"));
+  const packageRoot = path7.resolve(path7.dirname(fileURLToPath2(import.meta.url)), "..");
+  const packageJsonPath = path7.join(packageRoot, "package.json");
+  const packageJson = JSON.parse(fs7.readFileSync(packageJsonPath, "utf-8"));
   return packageJson.version || "0.0.0";
 }
 var program = new Command();
 program.name("ai-dev").description("Interactive installer for GroupBy AI development content").version(getPackageVersion()).action(runInteractive);
 registerListCommand(program);
 registerInstallCommand(program);
+registerVendorCommand(program);
 program.addHelpText(
   "after",
   `