@hasna/skills 0.1.31 → 0.1.32

package/bin/index.js

@@ -1910,7 +1910,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.1.31",
+    version: "0.1.32",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -6863,6 +6863,130 @@ var init_discovery = __esm(() => {
   vendorPattern = new RegExp(`\\b(${VENDOR_TERMS.map(escapeRegExp).join("|")})\\b`, "gi");
 });
 
+// src/lib/config.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, copyFileSync } from "fs";
+import { join as join4, dirname as dirname2 } from "path";
+import { homedir as homedir3 } from "os";
+function validKeys() {
+  return ["mode", ...Object.keys(ENUM_KEYS), ...STRING_KEYS];
+}
+function allowedValues(key) {
+  if (key === "mode")
+    return MODE_VALUES;
+  return ENUM_KEYS[key];
+}
+function normalizeConfigValue(key, value) {
+  if (typeof value !== "string")
+    return;
+  if (key === "mode")
+    return MODE_ALIASES[value.trim().toLowerCase()];
+  const allowed = allowedValues(key);
+  if (allowed)
+    return allowed.includes(value) ? value : undefined;
+  if (key === "apiUrl") {
+    try {
+      const url = new URL(value);
+      if (url.protocol !== "http:" && url.protocol !== "https:")
+        return;
+      return value.replace(/\/+$/, "");
+    } catch {
+      return;
+    }
+  }
+  return;
+}
+function getDataDir() {
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
+  const newDir = join4(home, ".hasna", "skills");
+  const oldConfigFile = join4(home, ".skillsrc");
+  if (existsSync4(oldConfigFile) && !existsSync4(join4(newDir, "config.json"))) {
+    mkdirSync2(newDir, { recursive: true });
+    try {
+      copyFileSync(oldConfigFile, join4(newDir, "config.json"));
+    } catch {}
+  }
+  mkdirSync2(newDir, { recursive: true });
+  return newDir;
+}
+function getConfigPath(scope) {
+  if (scope === "global") {
+    return join4(getDataDir(), "config.json");
+  }
+  return join4(process.cwd(), "skills.config.json");
+}
+function readConfigFile(path) {
+  if (!existsSync4(path))
+    return {};
+  try {
+    const raw = readFileSync4(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+      return {};
+    const config = {};
+    for (const key of validKeys()) {
+      const value = normalizeConfigValue(key, parsed[key]);
+      if (value !== undefined)
+        config[key] = value;
+    }
+    return config;
+  } catch {
+    return {};
+  }
+}
+function loadConfig() {
+  const globalConfig = readConfigFile(getConfigPath("global"));
+  const projectConfig = readConfigFile(getConfigPath("project"));
+  return { ...globalConfig, ...projectConfig };
+}
+function saveConfig(key, value, scope = "project") {
+  if (!validKeys().includes(key)) {
+    throw new Error(`Unknown config key: ${key}. Valid keys: ${validKeys().join(", ")}`);
+  }
+  const normalized = normalizeConfigValue(key, value);
+  if (normalized === undefined) {
+    const allowed = allowedValues(key);
+    throw new Error(allowed ? `Invalid value '${value}' for ${key}. Allowed: ${allowed.join(", ")}` : `Invalid value '${value}' for ${key}. Expected an http(s) URL`);
+  }
+  const filePath = getConfigPath(scope);
+  let existing = {};
+  if (existsSync4(filePath)) {
+    try {
+      existing = JSON.parse(readFileSync4(filePath, "utf-8"));
+      if (typeof existing !== "object" || existing === null || Array.isArray(existing)) {
+        existing = {};
+      }
+    } catch {
+      existing = {};
+    }
+  } else {
+    const dir = dirname2(filePath);
+    if (!existsSync4(dir)) {
+      mkdirSync2(dir, { recursive: true });
+    }
+  }
+  existing[key] = normalized;
+  writeFileSync2(filePath, JSON.stringify(existing, null, 2) + `
+`);
+}
+var ENUM_KEYS, STRING_KEYS, MODE_VALUES, MODE_ALIASES;
+var init_config = __esm(() => {
+  ENUM_KEYS = {
+    defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
+    defaultScope: ["global", "project"],
+    format: ["compact", "json", "csv"]
+  };
+  STRING_KEYS = ["apiUrl"];
+  MODE_VALUES = ["local", "hosted"];
+  MODE_ALIASES = {
+    local: "local",
+    offline: "local",
+    hosted: "hosted",
+    remote: "hosted",
+    "skills.md": "hosted",
+    skillsmd: "hosted"
+  };
+});
+
 // node_modules/zod/v4/core/core.js
 function $constructor(name, initializer, params) {
   function init(inst, def) {
@@ -20729,115 +20853,6 @@ var init_zod = __esm(() => {
   init_external();
 });
 
-// src/lib/config.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, copyFileSync } from "fs";
-import { join as join4, dirname as dirname2 } from "path";
-import { homedir as homedir3 } from "os";
-function validKeys() {
-  return [...Object.keys(ENUM_KEYS), ...STRING_KEYS];
-}
-function normalizeConfigValue(key, value) {
-  if (typeof value !== "string")
-    return;
-  const allowed = ENUM_KEYS[key];
-  if (allowed)
-    return allowed.includes(value) ? value : undefined;
-  if (key === "apiUrl") {
-    try {
-      const url2 = new URL(value);
-      if (url2.protocol !== "http:" && url2.protocol !== "https:")
-        return;
-      return value.replace(/\/+$/, "");
-    } catch {
-      return;
-    }
-  }
-  return;
-}
-function getDataDir() {
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
-  const newDir = join4(home, ".hasna", "skills");
-  const oldConfigFile = join4(home, ".skillsrc");
-  if (existsSync4(oldConfigFile) && !existsSync4(join4(newDir, "config.json"))) {
-    mkdirSync2(newDir, { recursive: true });
-    try {
-      copyFileSync(oldConfigFile, join4(newDir, "config.json"));
-    } catch {}
-  }
-  mkdirSync2(newDir, { recursive: true });
-  return newDir;
-}
-function getConfigPath(scope) {
-  if (scope === "global") {
-    return join4(getDataDir(), "config.json");
-  }
-  return join4(process.cwd(), "skills.config.json");
-}
-function readConfigFile(path) {
-  if (!existsSync4(path))
-    return {};
-  try {
-    const raw = readFileSync4(path, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
-      return {};
-    const config2 = {};
-    for (const key of validKeys()) {
-      const value = normalizeConfigValue(key, parsed[key]);
-      if (value !== undefined)
-        config2[key] = value;
-    }
-    return config2;
-  } catch {
-    return {};
-  }
-}
-function loadConfig() {
-  const globalConfig2 = readConfigFile(getConfigPath("global"));
-  const projectConfig = readConfigFile(getConfigPath("project"));
-  return { ...globalConfig2, ...projectConfig };
-}
-function saveConfig(key, value, scope = "project") {
-  if (!validKeys().includes(key)) {
-    throw new Error(`Unknown config key: ${key}. Valid keys: ${validKeys().join(", ")}`);
-  }
-  const normalized = normalizeConfigValue(key, value);
-  if (normalized === undefined) {
-    const allowed = ENUM_KEYS[key];
-    throw new Error(allowed ? `Invalid value '${value}' for ${key}. Allowed: ${allowed.join(", ")}` : `Invalid value '${value}' for ${key}. Expected an http(s) URL`);
-  }
-  const filePath = getConfigPath(scope);
-  let existing = {};
-  if (existsSync4(filePath)) {
-    try {
-      existing = JSON.parse(readFileSync4(filePath, "utf-8"));
-      if (typeof existing !== "object" || existing === null || Array.isArray(existing)) {
-        existing = {};
-      }
-    } catch {
-      existing = {};
-    }
-  } else {
-    const dir = dirname2(filePath);
-    if (!existsSync4(dir)) {
-      mkdirSync2(dir, { recursive: true });
-    }
-  }
-  existing[key] = normalized;
-  writeFileSync2(filePath, JSON.stringify(existing, null, 2) + `
-`);
-}
-var ENUM_KEYS, STRING_KEYS;
-var init_config = __esm(() => {
-  ENUM_KEYS = {
-    mode: ["local", "skills.md"],
-    defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
-    defaultScope: ["global", "project"],
-    format: ["compact", "json", "csv"]
-  };
-  STRING_KEYS = ["apiUrl"];
-});
-
 // src/lib/auth-store.ts
 var exports_auth_store = {};
 __export(exports_auth_store, {
@@ -20848,14 +20863,14 @@ __export(exports_auth_store, {
   getApiKey: () => getApiKey,
   clearAuthConfig: () => clearAuthConfig
 });
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, unlinkSync } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, unlinkSync } from "fs";
 import { join as join5 } from "path";
 import { homedir as homedir4 } from "os";
 function getAuthConfig() {
   if (cachedConfig !== undefined)
     return cachedConfig;
   try {
-    const raw = readFileSync5(AUTH_FILE, "utf-8");
+    const raw = readFileSync5(existsSync5(AUTH_FILE) ? AUTH_FILE : LEGACY_AUTH_FILE, "utf-8");
     const config2 = JSON.parse(raw);
     if (!config2.apiKey || !config2.email) {
       cachedConfig = null;
@@ -20869,7 +20884,7 @@ function getAuthConfig() {
   }
 }
 function saveAuthConfig(config2) {
-  mkdirSync3(AUTH_DIR, { recursive: true });
+  mkdirSync3(AUTH_DIR, { recursive: true, mode: 448 });
   writeFileSync3(AUTH_FILE, JSON.stringify(config2, null, 2) + `
 `, { mode: 384 });
   cachedConfig = config2;
@@ -20878,6 +20893,9 @@ function clearAuthConfig() {
   try {
     unlinkSync(AUTH_FILE);
   } catch {}
+  try {
+    unlinkSync(LEGACY_AUTH_FILE);
+  } catch {}
   cachedConfig = null;
 }
 function getApiKey() {
@@ -20900,11 +20918,12 @@ function normalizeSkillsApiOrigin(apiUrl) {
 function getApiUrl() {
   return normalizeSkillsApiOrigin(process.env.SKILLS_API_URL || loadConfig().apiUrl || "https://skills.md");
 }
-var AUTH_DIR, AUTH_FILE, cachedConfig;
+var AUTH_DIR, AUTH_FILE, LEGACY_AUTH_FILE, cachedConfig;
 var init_auth_store = __esm(() => {
   init_config();
-  AUTH_DIR = join5(homedir4(), ".skills");
+  AUTH_DIR = join5(homedir4(), ".hasna", "skills");
   AUTH_FILE = join5(AUTH_DIR, "auth.json");
+  LEGACY_AUTH_FILE = join5(homedir4(), ".skills", "auth.json");
 });
 
 // src/lib/remote-registry.ts
@@ -21543,11 +21562,11 @@ __export(exports_skillinfo, {
   generateEnvExample: () => generateEnvExample,
   detectProjectSkills: () => detectProjectSkills
 });
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
 import { join as join6 } from "path";
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync5(skillPath))
+  if (!existsSync6(skillPath))
     return null;
   return {
     skillMd: readIfExists(join6(skillPath, "SKILL.md")),
@@ -21563,7 +21582,7 @@ function getSkillBestDoc(name) {
 }
 function getSkillRequirements(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync5(skillPath))
+  if (!existsSync6(skillPath))
     return null;
   const texts = [];
   for (const file2 of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
@@ -21606,7 +21625,7 @@ function getSkillRequirements(name) {
   let cliCommand = `skills run ${skillName}`;
   let dependencies = {};
   const pkgPath = join6(skillPath, "package.json");
-  if (existsSync5(pkgPath)) {
+  if (existsSync6(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
       dependencies = pkg.dependencies || {};
@@ -21625,11 +21644,11 @@ function isHostedPremiumSkill(skillName, meta3) {
 async function runSkill(name, args, options = {}) {
   const canonicalName = getSkill(name)?.name ?? name;
   const skillPath = getSkillPath(canonicalName);
-  if (!existsSync5(skillPath)) {
+  if (!existsSync6(skillPath)) {
     return { exitCode: 1, error: `Skill '${name}' not found` };
   }
   const pkgPath = join6(skillPath, "package.json");
-  if (!existsSync5(pkgPath)) {
+  if (!existsSync6(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint;
@@ -21649,11 +21668,11 @@ async function runSkill(name, args, options = {}) {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
   const entryPath = join6(skillPath, entryPoint);
-  if (!existsSync5(entryPath)) {
+  if (!existsSync6(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
   const nodeModules = join6(skillPath, "node_modules");
-  if (!existsSync5(nodeModules)) {
+  if (!existsSync6(nodeModules)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skillPath,
       stdout: "pipe",
@@ -21681,7 +21700,7 @@ async function runSkill(name, args, options = {}) {
 }
 function detectProjectSkills(cwd = process.cwd()) {
   const pkgPath = join6(cwd, "package.json");
-  if (!existsSync5(pkgPath)) {
+  if (!existsSync6(pkgPath)) {
     const alwaysRecommend = ["implementation-plan", "write", "deepresearch"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
     return { detected: [], recommended: recommended2 };
@@ -21812,7 +21831,7 @@ function generateSkillMd(name) {
   if (!meta3)
     return null;
   const skillPath = getSkillPath(name);
-  if (!existsSync5(skillPath))
+  if (!existsSync6(skillPath))
     return null;
   const frontmatter = [
     "---",
@@ -21825,7 +21844,7 @@ function generateSkillMd(name) {
   const claudeMd = readIfExists(join6(skillPath, "CLAUDE.md"));
   let cliCommand = null;
   const pkgPath = join6(skillPath, "package.json");
-  if (existsSync5(pkgPath)) {
+  if (existsSync6(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
       if (pkg.bin) {
@@ -21900,7 +21919,7 @@ function extractEnvVars(text) {
 }
 function readIfExists(path) {
   try {
-    if (existsSync5(path)) {
+    if (existsSync6(path)) {
       return readFileSync6(path, "utf-8");
     }
   } catch {}
@@ -21932,7 +21951,7 @@ var init_skillinfo = __esm(() => {
 });
 
 // src/lib/skill-validation.ts
-import { existsSync as existsSync6, lstatSync, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync } from "fs";
+import { existsSync as existsSync7, lstatSync, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync } from "fs";
 import { isAbsolute, join as join7, normalize } from "path";
 function add(target, code, message) {
   target.push({ code, message });
@@ -22005,7 +22024,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     binCommands: [],
     docFiles: []
   };
-  if (!existsSync6(skillPath)) {
+  if (!existsSync7(skillPath)) {
     add(issues, "skill.dir_missing", `Skill directory not found: ${skillPath}`);
     return {
       name: bareName,
@@ -22032,14 +22051,14 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     }
   }
   for (const docFile of DOC_FILES) {
-    if (existsSync6(join7(skillPath, docFile)))
+    if (existsSync7(join7(skillPath, docFile)))
       metadata.docFiles.push(docFile);
   }
   if (metadata.docFiles.length === 0) {
     add(issues, "skill.docs_missing", "Missing documentation file: expected SKILL.md, README.md, or CLAUDE.md");
   }
   const skillMdPath = join7(skillPath, "SKILL.md");
-  if (existsSync6(skillMdPath)) {
+  if (existsSync7(skillMdPath)) {
     const frontmatter = parseSkillFrontmatter(readFileSync7(skillMdPath, "utf-8"));
     if (!frontmatter) {
       add(warnings, "skill.frontmatter_missing", "SKILL.md has no YAML frontmatter");
@@ -22074,7 +22093,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     add(warnings, "skill.skill_md_missing", "Missing SKILL.md; registry docs may need generated agent-facing instructions");
   }
   const pkgPath = join7(skillPath, "package.json");
-  if (!existsSync6(pkgPath)) {
+  if (!existsSync7(pkgPath)) {
     add(issues, "package.missing", "Missing package.json");
   } else {
     try {
@@ -22119,7 +22138,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
               continue;
             }
             const targetPath = join7(skillPath, target);
-            if (!existsSync6(targetPath)) {
+            if (!existsSync7(targetPath)) {
               add(warnings, "package.bin_target_missing", `package.json bin '${command}' target '${target}' is not present before build`);
             } else if (statSync(targetPath).isDirectory()) {
               add(issues, "package.bin_target_directory", `package.json bin '${command}' target '${target}' must point to a file, not a directory`);
@@ -22132,12 +22151,12 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     }
   }
   const srcDir = join7(skillPath, "src");
-  if (!existsSync6(srcDir)) {
+  if (!existsSync7(srcDir)) {
     add(issues, "skill.src_missing", "Missing src/ directory");
-  } else if (!existsSync6(join7(srcDir, "index.ts")) && !existsSync6(join7(srcDir, "index.js"))) {
+  } else if (!existsSync7(join7(srcDir, "index.ts")) && !existsSync7(join7(srcDir, "index.js"))) {
     add(issues, "skill.src_index_missing", "Missing src/index.ts or src/index.js");
   } else {
-    const indexPath = existsSync6(join7(srcDir, "index.ts")) ? join7(srcDir, "index.ts") : join7(srcDir, "index.js");
+    const indexPath = existsSync7(join7(srcDir, "index.ts")) ? join7(srcDir, "index.ts") : join7(srcDir, "index.js");
     const size = statSync(indexPath).size;
     if (size < 50)
       add(warnings, "skill.src_index_minimal", `Source entry point is very small (${size}B)`);
@@ -22205,7 +22224,7 @@ __export(exports_introspect, {
   registerIntrospect: () => registerIntrospect
 });
 import chalk4 from "chalk";
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
 import { join as join8 } from "path";
 import { execSync } from "child_process";
 function registerIntrospect(parent) {
@@ -22417,7 +22436,7 @@ function handleValidate(name, options) {
 function handleDiff(name, options) {
   const bare = name;
   const sourcePath = getSkillPath(bare);
-  if (!existsSync7(sourcePath)) {
+  if (!existsSync8(sourcePath)) {
     if (options.json)
       console.log(JSON.stringify({ error: `Skill '${bare}' not found in registry` }));
     else
@@ -22436,7 +22455,7 @@ function handleDiff(name, options) {
   const installedVersion = installMeta.skills[bare]?.version ?? "unknown";
   const registryPkgPath = join8(sourcePath, "package.json");
   let registryVersion = "unknown";
-  if (existsSync7(registryPkgPath)) {
+  if (existsSync8(registryPkgPath)) {
     try {
       registryVersion = JSON.parse(readFileSync8(registryPkgPath, "utf-8")).version || "unknown";
     } catch {}
@@ -22469,7 +22488,7 @@ __export(exports_init, {
   registerSetup: () => registerSetup
 });
 import chalk5 from "chalk";
-import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync4, appendFileSync } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync4, appendFileSync } from "fs";
 import { join as join9 } from "path";
 function registerSetup(parent) {
   parent.command("init").option("--json", "Output as JSON", false).option("--for <agent>", "Detect project type and show MCP registration guidance for agent").option("--scope <scope>", "Deprecated; agent skill-folder installs are disabled", "global").description("Initialize project for pinned skills (.env.example, .gitignore)").action((options) => handleInit(options));
@@ -22564,7 +22583,7 @@ Use: skills mcp --register ${options.for}`));
     console.log(chalk5.dim("  No environment variables detected across pinned skills"));
   const gitignorePath = join9(cwd, ".gitignore");
   const gitignoreEntries = [".skills/runs/", ".skills/exports/", ".skills/tmp/"];
-  let gitignoreContent = existsSync8(gitignorePath) ? readFileSync9(gitignorePath, "utf-8") : "";
+  let gitignoreContent = existsSync9(gitignorePath) ? readFileSync9(gitignorePath, "utf-8") : "";
   let gitignoreUpdated = false;
   const missingEntries = gitignoreEntries.filter((entry) => !gitignoreContent.includes(entry));
   if (missingEntries.length > 0) {
@@ -22610,7 +22629,7 @@ async function handleImport(file2, options) {
     if (file2 === "-")
       raw = await new Response(process.stdin).text();
     else {
-      if (!existsSync8(file2)) {
+      if (!existsSync9(file2)) {
         const error48 = `File not found: ${file2}`;
         if (options.json)
           console.log(JSON.stringify({ imported: 0, error: error48 }));
@@ -22720,7 +22739,7 @@ __export(exports_diagnostic, {
   registerDiagnostic: () => registerDiagnostic
 });
 import chalk6 from "chalk";
-import { existsSync as existsSync9, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
 import { join as join10 } from "path";
 import { execSync as execSync2 } from "child_process";
 function registerDiagnostic(parent) {
@@ -22856,7 +22875,7 @@ function handleAuth(name, options) {
       process.exitCode = 1;
       return;
     }
-    let existing = existsSync9(envFilePath) ? readFileSync10(envFilePath, "utf-8") : "";
+    let existing = existsSync10(envFilePath) ? readFileSync10(envFilePath, "utf-8") : "";
     const keyPattern = new RegExp(`^${key}=.*$`, "m");
     const updated = keyPattern.test(existing) ? existing.replace(keyPattern, `${key}=${value}`) : existing.endsWith(`
 `) || existing === "" ? existing + `${key}=${value}
@@ -22922,7 +22941,7 @@ function handleWhoami(options) {
   const agentConfigs = [];
   for (const agent of AGENT_TARGETS) {
     const agentSkillsPath = getAgentSkillsDir(agent, "global");
-    const exists = existsSync9(agentSkillsPath);
+    const exists = existsSync10(agentSkillsPath);
     let skillCount = 0;
     if (exists)
       try {
@@ -22967,7 +22986,7 @@ function handleOutdated(options) {
     const registryPath = getSkillPath(name);
     const registryPkgPath = join10(registryPath, "package.json");
     let registryVersion = "unknown";
-    if (existsSync9(registryPkgPath))
+    if (existsSync10(registryPkgPath))
       try {
         registryVersion = JSON.parse(readFileSync10(registryPkgPath, "utf-8")).version || "unknown";
       } catch {}
@@ -23058,7 +23077,7 @@ var REMOTE_SKILL_RUN_CONTRACT_VERSION = 1;
 
 // src/lib/run-state.ts
 import { createHash, randomBytes } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync11, readdirSync as readdirSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync11, readdirSync as readdirSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
 import { extname, join as join11, relative } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
@@ -23125,12 +23144,12 @@ function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
   const path = join11(context.runDir, "events.ndjson");
-  const previous = existsSync10(path) ? readFileSync11(path, "utf-8") : "";
+  const previous = existsSync11(path) ? readFileSync11(path, "utf-8") : "";
   writeFileSync6(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   const runsRoot = join11(getProjectStateDir(targetDir), "runs");
-  if (!existsSync10(runsRoot))
+  if (!existsSync11(runsRoot))
     return [];
   const records = [];
   for (const day of readdirSync4(runsRoot).sort().reverse()) {
@@ -23149,7 +23168,7 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
   const runsRoot = join11(getProjectStateDir(targetDir), "runs");
-  if (!existsSync10(runsRoot))
+  if (!existsSync11(runsRoot))
     return null;
   for (const day of readdirSync4(runsRoot)) {
     const record2 = readRunRecord(join11(runsRoot, day, runId));
@@ -23170,7 +23189,7 @@ function writeArtifactsManifest(context, artifacts) {
 `);
 }
 function collectRunArtifacts(context) {
-  if (!existsSync10(context.exportDir))
+  if (!existsSync11(context.exportDir))
     return [];
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
@@ -23187,7 +23206,7 @@ function collectRunArtifacts(context) {
 }
 function readRunRecord(runDir) {
   const path = join11(runDir, "run.json");
-  if (!existsSync10(path))
+  if (!existsSync11(path))
     return null;
   try {
     return JSON.parse(readFileSync11(path, "utf-8"));
@@ -39276,7 +39295,7 @@ var init_remote_client = __esm(() => {
 });
 
 // src/mcp/operation-tools.ts
-import { existsSync as existsSync11, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
+import { existsSync as existsSync12, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
 import { join as join12 } from "path";
 function registerOperationTools(server) {
   server.registerTool("pin_skill", {
@@ -39497,7 +39516,7 @@ function registerOperationTools(server) {
     });
     if (isPremiumSkill2(skillName) && !apiKey) {
       const cost = formatCost2(costCents ?? 0);
-      const error48 = `${skillName} is a hosted skill (${cost}). Run: skills setup --mode skills.md && skills auth login`;
+      const error48 = `${skillName} is a hosted skill (${cost}). Run: skills setup --mode hosted && skills auth login`;
       writeRunLogs(runContext, "", error48 + `
 `);
       const run = completeSkillRun(runContext, { status: "failed", error: error48, costCents });
@@ -39533,9 +39552,9 @@ function registerOperationTools(server) {
           nextActions: remoteRunNextActions(remoteRunId)
         });
       } catch (err) {
-        console.error(`[skills] skills.md API failed for ${skillName}, falling back to local:`, err.message);
+        console.error(`[skills] hosted API failed for ${skillName}, falling back to local:`, err.message);
         if (isPremiumSkill2(skillName)) {
-          const error48 = `Hosted skill ${skillName} requires skills.md access: ${err.message}`;
+          const error48 = `Hosted skill ${skillName} requires hosted access: ${err.message}`;
           writeRunLogs(runContext, "", error48 + `
 `);
           const localRun2 = completeSkillRun(runContext, { status: "failed", error: error48 });
@@ -39576,7 +39595,7 @@ function registerOperationTools(server) {
     const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
     const apiKey = getApiKey2();
     if (!apiKey) {
-      return mcpError("AUTH_REQUIRED", "Remote run status requires skills.md access. Run: skills auth login", ["skills auth login"]);
+      return mcpError("AUTH_REQUIRED", "Remote run status requires hosted access. Run: skills auth login", ["skills auth login"]);
     }
     const localRun = findSkillRun(run_id);
     const remoteRunId = localRun?.remoteRunId || run_id;
@@ -39662,7 +39681,7 @@ function registerOperationTools(server) {
     const agents = [];
     for (const agent of AGENT_TARGETS) {
       const agentSkillsPath = getAgentSkillsDir(agent, "global");
-      const exists = existsSync11(agentSkillsPath);
+      const exists = existsSync12(agentSkillsPath);
       let skillCount = 0;
       if (exists) {
         try {
@@ -39697,7 +39716,7 @@ var init_operation_tools = __esm(() => {
 });
 
 // src/lib/feedback.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5 } from "fs";
 import { homedir as homedir5 } from "os";
 import { dirname as dirname3, join as join13 } from "path";
 import { Database } from "bun:sqlite";
@@ -39707,7 +39726,7 @@ function getFeedbackDbPath() {
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname3(dbPath);
-  if (!existsSync12(dir))
+  if (!existsSync13(dir))
     mkdirSync5(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
@@ -39868,14 +39887,14 @@ var init_resource_meta_tools = __esm(() => {
 });
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6 } from "fs";
 import { join as join14 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join14(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync13(path)) {
+  if (existsSync14(path)) {
     try {
       return JSON.parse(readFileSync12(path, "utf-8"));
     } catch {}
@@ -39885,7 +39904,7 @@ function loadSchedules(targetDir = process.cwd()) {
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   const dir = join14(targetDir, ".skills");
-  if (!existsSync13(dir))
+  if (!existsSync14(dir))
     mkdirSync6(dir, { recursive: true });
   writeFileSync7(path, JSON.stringify(data, null, 2));
 }
@@ -40430,7 +40449,7 @@ var init_mcp2 = __esm(() => {
 
 // src/cli/commands/runtime-mcp.ts
 import chalk7 from "chalk";
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir6 } from "os";
 import { dirname as dirname4, join as join15 } from "path";
 async function handleMcp(options) {
@@ -40540,7 +40559,7 @@ function registerCodexMcp(command) {
   const config2 = `[mcp_servers.${MCP_SERVER_NAME}]
 command = ${JSON.stringify(command)}`;
   try {
-    const current = existsSync14(path) ? readFileSync13(path, "utf-8") : "";
+    const current = existsSync15(path) ? readFileSync13(path, "utf-8") : "";
     writeTextFile(path, upsertTomlSection(current, `[mcp_servers.${MCP_SERVER_NAME}]`, `command = ${JSON.stringify(command)}`));
     return { agent: "codex", success: true, path, config: config2 };
   } catch (err) {
@@ -40590,7 +40609,7 @@ function registerJsonMcpServer(agent, path, containerKey, server2) {
   }
 }
 function readJsonObject(path) {
-  if (!existsSync14(path))
+  if (!existsSync15(path))
     return {};
   const raw = readFileSync13(path, "utf-8").trim();
   if (!raw)
@@ -40637,7 +40656,7 @@ function findCommandOnPath(command) {
     if (!dir)
       continue;
     const candidate = join15(dir, command);
-    if (existsSync14(candidate))
+    if (existsSync15(candidate))
       return candidate;
   }
   return command;
@@ -40670,7 +40689,7 @@ function registerRuntime(parent) {
   exportsCommand.command("open").argument("<run-id>", "Run id").option("--json", "Output as JSON", false).description("Open the export directory for a run").action((runId, options) => handleExportsOpen(runId, options));
   exportsCommand.command("download").argument("<run-id>", "Remote run id").option("--json", "Output as JSON", false).description("Download remote run artifacts into .skills/exports").action((runId, options) => handleExportsDownload(runId, options));
   parent.command("mcp").option("--register <agent>", "Register MCP server with agent").option("--json", "Output registration result as JSON", false).description("Start MCP server (stdio) or register with an agent").action(async (options) => handleMcp(options));
-  const setup = parent.command("setup").description("Choose local-only mode, skills.md mode, or agent integrations").option("--mode <mode>", "Runtime mode: local or skills.md").option("--api-url <url>", "skills.md-compatible API origin for hosted mode").option("--global", "Save setup choice globally", false).option("--json", "Output setup result as JSON", false).action(async (options) => handleSetup(options));
+  const setup = parent.command("setup").description("Choose hosted mode, local-only mode, or agent integrations").option("--mode <mode>", "Runtime mode: hosted or local").option("--api-url <url>", "Hosted API origin").option("--global", "Save setup choice globally", false).option("--json", "Output setup result as JSON", false).action(async (options) => handleSetup(options));
   setup.command("agents").option("--json", "Output registration result as JSON", false).description("Register the Skills MCP server with all supported agents").action(async (options) => handleMcp({ register: "all", json: options.json }));
   parent.command("self-update").description("Update @hasna/skills to the latest version").option("--json", "Output result as JSON", false).action(async (options) => {
     if (process.env.SKILLS_TEST_MODE === "1") {
@@ -40719,15 +40738,15 @@ async function handleSetup(options) {
   const scope = options.global ? "global" : "project";
   let mode = normalizeSetupMode(options.mode);
   if (!mode && process.stdin.isTTY && process.stdout.isTTY) {
-    mode = normalizeSetupMode(await promptLine("Use Skills locally or with skills.md? [local/skills.md] "));
+    mode = normalizeSetupMode(await promptLine("Use hosted Skills or local-only mode? [hosted/local] ")) ?? "hosted";
   }
   mode = mode ?? "local";
   saveConfig("mode", mode, scope);
-  if (mode === "skills.md") {
+  if (mode === "hosted") {
     saveConfig("apiUrl", options.apiUrl || "https://skills.md", scope);
   }
   const config2 = loadConfig();
-  const next = mode === "skills.md" ? ["skills auth login", "skills list --remote"] : ["skills list", "skills run <skill>"];
+  const next = mode === "hosted" ? ["skills auth login", "skills list --remote"] : ["skills list", "skills run <skill>"];
   const payload = {
     mode,
     scope,
@@ -40740,7 +40759,7 @@ async function handleSetup(options) {
   }
   console.log(chalk8.green(`Set Skills mode to ${mode}`));
   console.log(chalk8.dim(`  Scope: ${scope}`));
-  if (mode === "skills.md") {
+  if (mode === "hosted") {
     console.log(chalk8.dim(`  API: ${config2.apiUrl || "https://skills.md"}`));
     console.log(chalk8.dim("  Next: skills auth login"));
   } else {
@@ -40755,8 +40774,8 @@ function normalizeSetupMode(value) {
   if (normalized === "local" || normalized === "offline")
     return "local";
   if (normalized === "skills.md" || normalized === "skillsmd" || normalized === "remote" || normalized === "hosted")
-    return "skills.md";
-  throw new Error("Invalid setup mode. Use local or skills.md.");
+    return "hosted";
+  throw new Error("Invalid setup mode. Use hosted or local.");
 }
 function promptLine(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -40845,7 +40864,7 @@ async function handleRun(name, args2, options) {
     const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
     const apiKey = getApiKey2();
     if (!apiKey) {
-      const error48 = `${skill.name} is a hosted skill (${pricing.formatCost(costCents ?? 0)}). Run: skills setup --mode skills.md && skills auth login`;
+      const error48 = `${skill.name} is a hosted skill (${pricing.formatCost(costCents ?? 0)}). Run: skills setup --mode hosted && skills auth login`;
       writeRunLogs(runContext, "", error48 + `
 `);
       const run = completeSkillRun(runContext, { status: "failed", error: error48, costCents });
@@ -40927,7 +40946,7 @@ async function handleRun(name, args2, options) {
       process.exitCode = exitCode;
       return;
     } catch (err) {
-      const error48 = `Hosted skill ${skill.name} requires skills.md access: ${err.message}`;
+      const error48 = `Hosted skill ${skill.name} requires hosted access: ${err.message}`;
       writeRunLogs(runContext, "", error48 + `
 `);
       const run = completeSkillRun(runContext, { status: "failed", error: error48, costCents });
@@ -41033,7 +41052,7 @@ async function handleRunsStatus(runId, options) {
   const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
   const apiKey = getApiKey2();
   if (!apiKey) {
-    const error48 = "Remote run status requires skills.md access. Run: skills auth login";
+    const error48 = "Remote run status requires hosted access. Run: skills auth login";
     if (options.json)
       console.log(JSON.stringify({ contractVersion: REMOTE_SKILL_RUN_CONTRACT_VERSION, error: error48 }, null, 2));
     else
@@ -41134,7 +41153,7 @@ async function handleExportsDownload(runId, options) {
   const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
   const apiKey = getApiKey2();
   if (!apiKey) {
-    const error48 = "Remote artifact downloads require skills.md access. Run: skills auth login";
+    const error48 = "Remote artifact downloads require hosted access. Run: skills auth login";
     if (options.json)
       console.log(JSON.stringify({ error: error48 }, null, 2));
     else
@@ -41537,6 +41556,8 @@ var init_completion = __esm(() => {
     "import",
     "doctor",
     "auth",
+    "billing",
+    "credits",
     "env-check",
     "setup-info",
     "test",
@@ -41562,7 +41583,7 @@ __export(exports_create_sync_config, {
   registerCreateSync: () => registerCreateSync
 });
 import chalk9 from "chalk";
-import { existsSync as existsSync15, writeFileSync as writeFileSync10, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync16, writeFileSync as writeFileSync10, mkdirSync as mkdirSync9 } from "fs";
 import { join as join17 } from "path";
 import { homedir as homedir7 } from "os";
 function registerCreateSync(parent) {
@@ -41612,13 +41633,13 @@ function registerCreateSync(parent) {
     const pp = getConfigPath("project");
     if (options.json) {
       console.log(JSON.stringify({
-        global: { path: gp, exists: existsSync15(gp) },
-        project: { path: pp, exists: existsSync15(pp) }
+        global: { path: gp, exists: existsSync16(gp) },
+        project: { path: pp, exists: existsSync16(pp) }
       }, null, 2));
       return;
     }
-    console.log(`${chalk9.cyan("global")}:  ${gp}${existsSync15(gp) ? chalk9.green(" (exists)") : chalk9.dim(" (not found)")}`);
-    console.log(`${chalk9.cyan("project")}: ${pp}${existsSync15(pp) ? chalk9.green(" (exists)") : chalk9.dim(" (not found)")}`);
+    console.log(`${chalk9.cyan("global")}:  ${gp}${existsSync16(gp) ? chalk9.green(" (exists)") : chalk9.dim(" (not found)")}`);
+    console.log(`${chalk9.cyan("project")}: ${pp}${existsSync16(pp) ? chalk9.green(" (exists)") : chalk9.dim(" (not found)")}`);
   });
   parent.command("create").argument("<name>", "Skill name (e.g. my-tool)").option("--category <category>", "Skill category", "Development Tools").option("--description <description>", "Short description of what the skill does").option("--tags <tags>", "Comma-separated tags (e.g. api,testing,automation)").option("--global", "Deprecated; custom skills are always global", false).option("--json", "Output result as JSON", false).description("Scaffold a new custom skill directory").action((name, options) => handleCreate(name, options));
   parent.command("sync").option("--to <agent>", "Deprecated; use skills mcp --register <agent|all>").option("--from <agent>", "Deprecated; agent skill-folder sync is disabled").option("--register", "Deprecated; agent skill-folder imports are disabled", false).option("--scope <scope>", "Deprecated; ignored", "global").option("--json", "Output as JSON", false).description("Disabled legacy agent skill-folder sync").action((options) => handleSync(options));
@@ -41628,7 +41649,7 @@ function handleCreate(name, options) {
   const dirName = bare;
   const baseDir = join17(homedir7(), ".hasna", "skills", "custom");
   const skillDir = join17(baseDir, dirName);
-  if (existsSync15(skillDir)) {
+  if (existsSync16(skillDir)) {
     console.log(options.json ? JSON.stringify({ error: `Skill '${bare}' already exists at ${skillDir}` }) : chalk9.red(`Skill '${bare}' already exists at ${skillDir}`));
     process.exitCode = 1;
     return;
@@ -41840,7 +41861,7 @@ async function executeScheduledSkill(skillName, args2) {
     const { getApiKey: getApiKey2 } = await Promise.resolve().then(() => (init_auth_store(), exports_auth_store));
     const apiKey = getApiKey2();
     if (!apiKey) {
-      throw new Error(`${skill.name} is a hosted skill. Run: skills setup --mode skills.md && skills auth login`);
+      throw new Error(`${skill.name} is a hosted skill. Run: skills setup --mode hosted && skills auth login`);
     }
     const { RemoteSkillsClient: RemoteSkillsClient2 } = await Promise.resolve().then(() => (init_remote_client(), exports_remote_client));
     const client = new RemoteSkillsClient2(apiKey);
@@ -42004,6 +42025,66 @@ async function apiRequest(path, options) {
   });
   return res.json();
 }
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function browserCommand(url2) {
+  if (process.platform === "darwin")
+    return ["open", url2];
+  if (process.platform === "win32")
+    return ["cmd", "/c", "start", "", url2];
+  return ["xdg-open", url2];
+}
+function openBrowser(url2) {
+  const command = browserCommand(url2);
+  if (!command)
+    return;
+  try {
+    Bun.spawn(command, { stdout: "ignore", stderr: "ignore" });
+  } catch {}
+}
+async function ensureApiKey(loginResult) {
+  if (loginResult.apiKey)
+    return loginResult.apiKey;
+  if (!loginResult.token)
+    return;
+  const keyRes = await apiRequest("/api/auth/keys", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${loginResult.token}` },
+    body: JSON.stringify({ name: "cli" })
+  });
+  return keyRes.key;
+}
+async function persistLoginResult(loginResult) {
+  const storedKey = await ensureApiKey(loginResult);
+  if (!storedKey)
+    return;
+  saveAuthConfig({
+    apiKey: storedKey,
+    email: loginResult.user.email,
+    orgId: loginResult.organization.id,
+    orgSlug: loginResult.organization.slug,
+    userId: loginResult.user.id
+  });
+  return storedKey;
+}
+function printLoginSuccess(loginResult, json2) {
+  if (json2 || !isTTY) {
+    console.log(JSON.stringify({
+      status: "authenticated",
+      email: loginResult.user.email,
+      organization: loginResult.organization.slug,
+      firstLogin: loginResult.firstLogin
+    }));
+    return;
+  }
+  console.log(chalk12.green(`
+\u2713 Signed in as ${loginResult.user.email}`));
+  console.log(chalk12.dim(`  Organization: ${loginResult.organization.name}`));
+  if (loginResult.firstLogin) {
+    console.log(chalk12.dim(`  API key saved to ~/.hasna/skills/auth.json`));
+  }
+}
 async function doLogin(email3, code) {
   if (!email3 || !email3.includes("@")) {
     console.error(chalk12.red("Invalid email"));
@@ -42037,41 +42118,99 @@ async function doLogin(email3, code) {
     process.exitCode = 1;
     return;
   }
-  let storedKey = verifyRes.apiKey;
+  const storedKey = await persistLoginResult(verifyRes);
   if (!storedKey) {
-    const keyRes = await apiRequest("/api/auth/keys", {
+    console.error(chalk12.red("Login succeeded but API key creation failed"));
+    process.exitCode = 1;
+    return;
+  }
+  printLoginSuccess(verifyRes, false);
+}
+async function doDeviceLogin(options) {
+  const start = await apiRequest("/api/auth/device/start", {
+    method: "POST",
+    body: JSON.stringify({ client: "skills-cli" })
+  });
+  if (start.error) {
+    console.error(chalk12.red(start.error));
+    process.exitCode = 1;
+    return;
+  }
+  const verificationUrl = start.verificationUriComplete || start.verificationUri;
+  const shouldPoll = Boolean(options.poll || isTTY && !options.json);
+  if (options.open !== false && isTTY && verificationUrl) {
+    openBrowser(verificationUrl);
+  }
+  if (!shouldPoll) {
+    const payload = {
+      status: "pending",
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      verificationUriComplete: start.verificationUriComplete,
+      expiresIn: start.expiresIn,
+      interval: start.interval,
+      poll: "skills auth login --device --poll"
+    };
+    if (options.json || !isTTY)
+      console.log(JSON.stringify(payload, null, 2));
+    else {
+      console.log(chalk12.bold(`
+Sign in in your browser
+`));
+      console.log(`${chalk12.dim("Code:")} ${start.userCode}`);
+      console.log(`${chalk12.dim("URL:")}  ${verificationUrl}`);
+    }
+    return;
+  }
+  if (!options.json) {
+    console.log(chalk12.bold(`
+Sign in in your browser
+`));
+    console.log(`${chalk12.dim("Code:")} ${start.userCode}`);
+    console.log(`${chalk12.dim("URL:")}  ${verificationUrl}`);
+    console.log(chalk12.dim(`
+Waiting for authentication...`));
+  }
+  const intervalMs = Math.max(1000, Number(start.interval || 5) * 1000);
+  const timeoutMs = Number(options.pollTimeoutMs || DEFAULT_DEVICE_POLL_TIMEOUT_MS);
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const tokenRes = await apiRequest("/api/auth/device/token", {
       method: "POST",
-      headers: { Authorization: `Bearer ${verifyRes.token}` },
-      body: JSON.stringify({ name: "cli" })
+      body: JSON.stringify({ deviceCode: start.deviceCode })
     });
-    storedKey = keyRes.key;
-  }
-  saveAuthConfig({
-    apiKey: storedKey,
-    email: verifyRes.user.email,
-    orgId: verifyRes.organization.id,
-    orgSlug: verifyRes.organization.slug,
-    userId: verifyRes.user.id
-  });
-  if (isTTY) {
-    console.log(chalk12.green(`
-\u2713 Signed in as ${verifyRes.user.email}`));
-    console.log(chalk12.dim(`  Organization: ${verifyRes.organization.name}`));
-    if (verifyRes.firstLogin) {
-      console.log(chalk12.dim(`  API key saved to ~/.skills/auth.json`));
+    if (tokenRes.error === "authorization_pending" || tokenRes.status === "pending") {
+      await sleep(intervalMs);
+      continue;
     }
-  } else {
-    console.log(JSON.stringify({
-      status: "authenticated",
-      email: verifyRes.user.email,
-      organization: verifyRes.organization.slug,
-      firstLogin: verifyRes.firstLogin
-    }));
+    if (tokenRes.error) {
+      console.error(chalk12.red(tokenRes.detail || tokenRes.error));
+      process.exitCode = 1;
+      return;
+    }
+    const storedKey = await persistLoginResult(tokenRes);
+    if (!storedKey) {
+      console.error(chalk12.red("Login succeeded but API key creation failed"));
+      process.exitCode = 1;
+      return;
+    }
+    printLoginSuccess(tokenRes, Boolean(options.json));
+    return;
   }
+  const error48 = "Device login timed out before browser authentication completed";
+  if (options.json || !isTTY)
+    console.log(JSON.stringify({ status: "expired", error: error48 }));
+  else
+    console.error(chalk12.red(error48));
+  process.exitCode = 1;
 }
 function registerAuth(parent) {
-  const auth = parent.command("auth").description("Manage your skills.md account");
-  auth.command("login").description("Sign in with your email (passwordless)").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").action(async (options) => {
+  const auth = parent.command("auth").description("Manage hosted account authentication");
+  auth.command("login").description("Sign in with browser/device code or email code").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--device", "Use browser/device-code login", false).option("--no-open", "Do not open a browser for device-code login").option("--poll", "Poll until browser authentication completes in non-interactive mode", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for device-code login").option("--json", "Output result as JSON", false).action(async (options) => {
+    if (options.device || !options.email && !options.code) {
+      await doDeviceLogin(options);
+      return;
+    }
     let email3 = options.email;
     if (!email3 && isTTY) {
       const existing = getAuthConfig();
@@ -42140,79 +42279,137 @@ function registerAuth(parent) {
       console.log(chalk12.dim("(offline \u2014 showing cached info)"));
     }
   });
-  auth.command("status").description("Show billing status and credits").action(async () => {
-    const config2 = getAuthConfig();
-    if (!config2) {
-      console.log(chalk12.dim("Not signed in. Run: skills auth login"));
-      return;
-    }
-    try {
-      const res = await apiRequest("/api/v1/billing/status", {
-        headers: { Authorization: `Bearer ${config2.apiKey}` }
-      });
-      console.log(chalk12.bold("Plan:    ") + res.plan);
-      console.log(chalk12.bold("Balance: ") + res.balance);
-    } catch {
-      console.error(chalk12.red("Failed to fetch billing status"));
-    }
-  });
-  auth.command("checkout").description("Create a Pro checkout session").action(async () => {
-    const config2 = getAuthConfig();
-    if (!config2) {
-      console.log(chalk12.dim("Not signed in. Run: skills auth login"));
-      return;
-    }
-    const res = await apiRequest("/api/v1/billing/checkout", {
-      method: "POST",
+  auth.command("status").description("Show hosted billing status").option("--json", "Output as JSON", false).action(handleBillingStatus);
+  auth.command("checkout").description("Create a Pro checkout session").option("--json", "Output as JSON", false).action(handleCheckout);
+  auth.command("portal").description("Create a customer portal session").option("--json", "Output as JSON", false).action(handlePortal);
+  auth.command("buy-credits").description("Create a credit pack checkout session").argument("<amount>", "Credit pack amount: 1, 5, 20, 50, or 100").option("--json", "Output as JSON", false).action(handleBuyCredits);
+  registerBilling(parent);
+  registerCredits(parent);
+}
+function requireHostedAuth(json2) {
+  const config2 = getAuthConfig();
+  if (config2)
+    return config2;
+  const message = "Not signed in. Run: skills auth login";
+  if (json2)
+    console.log(JSON.stringify({ error: message }));
+  else
+    console.log(chalk12.dim(message));
+  process.exitCode = 1;
+  return null;
+}
+async function handleBillingStatus(options = {}) {
+  const config2 = requireHostedAuth(options.json);
+  if (!config2)
+    return;
+  try {
+    const res = await apiRequest("/api/v1/billing/status", {
       headers: { Authorization: `Bearer ${config2.apiKey}` }
     });
-    if (res.error || !res.url) {
-      console.error(chalk12.red(res.detail || res.error || "Failed to create checkout session"));
-      process.exitCode = 1;
+    if (options.json) {
+      console.log(JSON.stringify(res, null, 2));
       return;
     }
+    console.log(chalk12.bold("Plan:    ") + res.plan);
+    console.log(chalk12.bold("Balance: ") + res.balance);
+  } catch {
+    console.error(chalk12.red("Failed to fetch billing status"));
+    process.exitCode = 1;
+  }
+}
+async function handleCheckout(options = {}) {
+  const config2 = requireHostedAuth(options.json);
+  if (!config2)
+    return;
+  const res = await apiRequest("/api/v1/billing/checkout", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${config2.apiKey}` }
+  });
+  if (res.error || !res.url) {
+    console.error(chalk12.red(res.detail || res.error || "Failed to create checkout session"));
+    process.exitCode = 1;
+    return;
+  }
+  if (options.json)
+    console.log(JSON.stringify(res, null, 2));
+  else
     console.log(res.url);
+}
+async function handlePortal(options = {}) {
+  const config2 = requireHostedAuth(options.json);
+  if (!config2)
+    return;
+  const res = await apiRequest("/api/v1/billing/portal", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${config2.apiKey}` }
   });
-  auth.command("portal").description("Create a customer portal session").action(async () => {
-    const config2 = getAuthConfig();
-    if (!config2) {
-      console.log(chalk12.dim("Not signed in. Run: skills auth login"));
-      return;
-    }
-    const res = await apiRequest("/api/v1/billing/portal", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${config2.apiKey}` }
-    });
-    if (res.error || !res.url) {
-      console.error(chalk12.red(res.detail || res.error || "Failed to create customer portal session"));
-      process.exitCode = 1;
-      return;
-    }
+  if (res.error || !res.url) {
+    console.error(chalk12.red(res.detail || res.error || "Failed to create customer portal session"));
+    process.exitCode = 1;
+    return;
+  }
+  if (options.json)
+    console.log(JSON.stringify(res, null, 2));
+  else
     console.log(res.url);
+}
+async function handleBuyCredits(amount, options = {}) {
+  const config2 = requireHostedAuth(options.json);
+  if (!config2)
+    return;
+  const res = await apiRequest("/api/v1/billing/credits", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${config2.apiKey}` },
+    body: JSON.stringify({ amount })
   });
-  auth.command("buy-credits").description("Create a credit pack checkout session").argument("<amount>", "Credit pack amount: 1, 5, 20, 50, or 100").action(async (amount) => {
-    const config2 = getAuthConfig();
-    if (!config2) {
-      console.log(chalk12.dim("Not signed in. Run: skills auth login"));
-      return;
-    }
-    const res = await apiRequest("/api/v1/billing/credits", {
-      method: "POST",
-      headers: { Authorization: `Bearer ${config2.apiKey}` },
-      body: JSON.stringify({ amount })
-    });
-    if (res.error || !res.url) {
-      console.error(chalk12.red(res.detail || res.error || "Failed to create credit checkout session"));
-      process.exitCode = 1;
-      return;
-    }
+  if (res.error || !res.url) {
+    console.error(chalk12.red(res.detail || res.error || "Failed to create credit checkout session"));
+    process.exitCode = 1;
+    return;
+  }
+  if (options.json)
+    console.log(JSON.stringify(res, null, 2));
+  else
     console.log(res.url);
+}
+async function handleListCreditPacks(options = {}) {
+  const config2 = requireHostedAuth(options.json);
+  if (!config2)
+    return;
+  const res = await apiRequest("/api/v1/billing/credits", {
+    headers: { Authorization: `Bearer ${config2.apiKey}` }
   });
+  if (res.error) {
+    console.error(chalk12.red(res.detail || res.error || "Failed to list credit packs"));
+    process.exitCode = 1;
+    return;
+  }
+  if (options.json) {
+    console.log(JSON.stringify(res, null, 2));
+    return;
+  }
+  const packs = Array.isArray(res) ? res : res.packs;
+  for (const pack of packs ?? []) {
+    console.log(`${pack.amount}: ${pack.amountCents ? `$${(pack.amountCents / 100).toFixed(2)}` : pack.label || ""}`);
+  }
+}
+function registerBilling(parent) {
+  const billing = parent.command("billing").description("Manage hosted billing");
+  billing.command("status").description("Show billing status").option("--json", "Output as JSON", false).action(handleBillingStatus);
+  billing.command("checkout").description("Create a Pro checkout session").option("--json", "Output as JSON", false).action(handleCheckout);
+  billing.command("portal").description("Create a customer portal session").option("--json", "Output as JSON", false).action(handlePortal);
+  billing.command("buy-credits").description("Create a credit pack checkout session").argument("<amount>", "Credit pack amount: 1, 5, 20, 50, or 100").option("--json", "Output as JSON", false).action(handleBuyCredits);
 }
-var isTTY;
+function registerCredits(parent) {
+  const credits = parent.command("credits").description("Manage hosted credit packs");
+  credits.command("buy").description("Create a credit pack checkout session").argument("<amount>", "Credit pack amount: 1, 5, 20, 50, or 100").option("--json", "Output as JSON", false).action(handleBuyCredits);
+  credits.command("packs").description("List available credit packs").option("--json", "Output as JSON", false).action(handleListCreditPacks);
+}
+var isTTY, DEFAULT_DEVICE_POLL_TIMEOUT_MS;
 var init_auth = __esm(() => {
   init_auth_store();
   isTTY = process.stdin.isTTY && process.stdout.isTTY;
+  DEFAULT_DEVICE_POLL_TIMEOUT_MS = 10 * 60 * 1000;
 });
 
 // src/cli/commands/feedback.ts
@@ -43382,6 +43579,58 @@ function App({ initialSkills, overwrite = false }) {
 // src/cli/index.tsx
 init_registry();
 init_discovery();
+
+// src/cli/onboarding.ts
+init_config();
+var SKIP_ONBOARDING_COMMANDS = new Set([
+  "interactive",
+  "setup",
+  "config",
+  "auth",
+  "billing",
+  "credits",
+  "completion",
+  "self-update"
+]);
+function getRootCommandName(actionCommand) {
+  let current = actionCommand;
+  while (current.parent && current.parent.parent)
+    current = current.parent;
+  return current.name();
+}
+function shouldShowFirstRunOnboarding(input) {
+  if (!input.isInteractive || input.testMode)
+    return false;
+  if (input.config.mode)
+    return false;
+  if (input.argv.some((arg) => arg === "--json" || arg === "--help" || arg === "-h" || arg === "--version" || arg === "-V")) {
+    return false;
+  }
+  if (!input.commandName || SKIP_ONBOARDING_COMMANDS.has(input.commandName))
+    return false;
+  return input.argv.length > 0;
+}
+function getFirstRunOnboardingMessage() {
+  return [
+    "No Skills setup found.",
+    "  Hosted: skills setup --mode hosted && skills auth login",
+    "  Local:  skills setup --mode local"
+  ].join(`
+`);
+}
+function maybePrintFirstRunOnboarding(actionCommand, argv, isInteractive) {
+  if (shouldShowFirstRunOnboarding({
+    argv,
+    commandName: getRootCommandName(actionCommand),
+    config: loadConfig(),
+    isInteractive,
+    testMode: process.env.SKILLS_TEST_MODE === "1"
+  })) {
+    console.error(getFirstRunOnboardingMessage());
+  }
+}
+
+// src/cli/index.tsx
 import { jsxDEV as jsxDEV7 } from "react/jsx-dev-runtime";
 var isTTY2 = (process.stdout.isTTY ?? false) && (process.stdin.isTTY ?? false);
 if (process.argv.includes("--no-color")) {
@@ -43422,4 +43671,7 @@ var { registerAuth: registerAuth2 } = await Promise.resolve().then(() => (init_a
 registerAuth2(program2);
 var { registerFeedback: registerFeedback2 } = await Promise.resolve().then(() => (init_feedback2(), exports_feedback));
 registerFeedback2(program2);
+program2.hook("preAction", (_thisCommand, actionCommand) => {
+  maybePrintFirstRunOnboarding(actionCommand, process.argv.slice(2), isTTY2);
+});
 await program2.parseAsync();