@imfusion/web-ui 0.5.1-dev.6.gece7a7b5 → 0.6.0

package/README.md

@@ -2,6 +2,11 @@
 
 `@imfusion/web-ui` — the official shared Web UI library for ImFusion web apps, built on Base UI.
 
+- [Usage](#usage) — install, wire up, and keep the version current
+- [Documentation](#documentation) — Storybook and the developer docs
+- [Development](#development) — working on the library itself, including the Agent Skills
+- [Releasing](#releasing) — how versions are derived and how to cut one
+
 ## Usage
 
 The packages are private on npmjs.com.
@@ -33,8 +38,41 @@ import "@imfusion/web-ui/styles.css";
 import { WebUIProvider } from "@imfusion/web-ui";
 ```
 
-**There is also an AI skill to help you set up the Web UI library in your project:
-[`/imf-web-ui-setup`](./src/llms/skills/imf-web-ui-setup/SKILL.md). **
+### LLM integration
+
+The `web-ui` package does offer first-class support for LLMs, but it's not wired up by default.
+
+To install the skills, run this command after the package is installed:
+
+```bash
+npx web-ui-install
+```
+
+The binary asks which LLM client you use and installs everything it needs. Run it again after a version bump and it refreshes
+the directories it already installed into, without asking again — `--reconfigure` re-opens that choice.
+
+The optional `--hooks` flag also installs the agent lifecycle hooks and registers them for both hosts, in
+`.claude/settings.json` (Claude Code) and `.codex/hooks.json` (Codex). Three hooks inject one fixed line each: `SessionStart`
+and `SubagentStart` point the agent at the `imf-web-ui` skills router, and `UserPromptSubmit` names the companion skills to
+consult per task. A fourth, the `Stop` gate, blocks a turn that edited source files once, until the agent has addressed the
+project's verification. Re-running the installer refreshes the scripts and prunes retired ones along with their
+registrations. Without `--hooks`, the skills are still available but no lifecycle hook runs. The full flow is documented in
+the shipped [`agent-tooling` topic](./src/llms/skills/imf-web-ui-conventions/topics/agent-tooling.md) of the conventions
+skill.
+
+**Available consumer skills - `/imf-web-ui-*`**
+
+| Skill                     | What it does                                                                   |
+| ------------------------- | ------------------------------------------------------------------------------ |
+| `/imf-web-ui`             | The router: decides whether guidance is needed, then which companion to open.  |
+| `/imf-web-ui-setup`       | Plan and, after approval, bootstrap a consumer project by topic.               |
+| `/imf-web-ui-components`  | Component and icon reference — what exists and how it's meant to be used.      |
+| `/imf-web-ui-ux`          | UX guidance for building interfaces with the library.                          |
+| `/imf-web-ui-conventions` | The frontend conventions baseline, including the sanctioned styling seams.     |
+| `/imf-web-ui-audit`       | Read-only health check for a consumer project, ending in a plan you approve.   |
+| `/imf-web-ui-update`      | Update the library, skills, and optional hooks, then verify before committing. |
+
+Start at `/imf-web-ui` — it routes to the rest. Storybook's **User Guide → AI Agents** page covers the whole family.
 
 ### Versions and updates
 
@@ -58,20 +96,6 @@ Every merge to master publishes a new build under the `dev` dist-tag. Which spec
 - **A `file:` tarball never updates.** npm copies the archive into `node_modules` and re-copies the same one on every
   install. Switch to `dev` or a version range to get updates.
 
-### Consumer skills — `imf-web-ui-*`
-
-These skills are shipped with a `imf-web-ui` prefix, so to make their names identifiable and not pollute the skill namespace
-of the user.
-
-| Skill                                 | What it does                                                                         |
-| ------------------------------------- | ------------------------------------------------------------------------------------ |
-| `/imf-web-ui`                         | The router: decides whether guidance is needed, then which companion to open.        |
-| `/imf-web-ui-setup`                   | One-time wiring in a consumer project — the styles import and the provider.          |
-| `/imf-web-ui-components`              | Component reference — what exists and how it's meant to be used.                     |
-| `/imf-web-ui-ux`                      | UX guidance for building interfaces with the library.                                |
-| `/imf-web-ui-frontend-patterns`       | Frontend patterns, including the sanctioned styling seams (tokens, data attributes). |
-| `/imf-web-ui-imfusion-frontend-setup` | Set up or audit an ImFusion frontend's tooling against the house baseline.           |
-
 ## Documentation
 
 **[Storybook](https://storybook.js.org/)** is the documentation platform — the component catalog, every prop, and the setup
@@ -94,27 +118,35 @@ npm run git:config   # hooks path + rebase-only pull/merge
 
 **Try out **`/web-ui-dev-getting-started`** for an ai assisted start.**
 
-### Development skills — `web-ui-dev-*`
-
-These skills are shipped with a `web-ui-dev` prefix, so to make their names identifiable and not pollute the skill namespace.
-
-| Skill                                     | What it does                                                                          |
-| ----------------------------------------- | ------------------------------------------------------------------------------------- |
-| `/web-ui-dev-getting-started`             | Interactive intro — gauges your experience, works out your goal, routes you.          |
-| `/web-ui-dev-start`                       | Starting ritual for any task: Jira context, `master` vs. a worktree, context summary. |
-| `/web-ui-dev-new-component`               | Scaffolds an architecture-compliant primitive (adapted or absorbed).                  |
-| `/web-ui-dev-update-component`            | Pointers to every file a prop, variant, or sub-component change touches.              |
-| `/web-ui-dev-design-component`            | Brand design pass for a component that works but isn't styled yet.                    |
-| `/web-ui-dev-story`                       | Author or update a Storybook story.                                                   |
-| `/web-ui-dev-commit`                      | Commit workflow: staged docs audit, CI-parity checks, house commit format.            |
-| `/web-ui-dev-audit-docs`                  | Audit docs against staged or recent changes for staleness, gaps, and drift.           |
-| `/web-ui-dev-audit-pass-through-defaults` | Check `@default` annotations on pass-through props against Base UI upstream.          |
-| `/web-ui-dev-manage-worktrees`            | Create, close, or discard a worktree in `.workspaces/`.                               |
-| `/web-ui-dev-refresh-design-reference`    | Refresh the committed brand snapshots in `design/` from the Figma styleguide.         |
-| `/web-ui-dev-mcp`                         | Set up or recover Storybook, DevTools, Atlassian, or Figma MCP access.                |
+### LLM integration
+
+Web UI development skills use a `/web-ui-dev-*` prefix. `documentation-writer` comes from `npx skills`; it is not a native
+Web UI skill.
+
+| Skill                                     | What it does                                                                                                            |
+| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `/documentation-writer`                   | External `npx skills` workflow for Diátaxis documentation.                                                              |
+| `/web-ui-dev-getting-started`             | Interactive intro — gauges your experience, works out your goal, routes you.                                            |
+| `/web-ui-dev-start`                       | Starting ritual for any task: Jira context, `master` vs. a worktree, context summary.                                   |
+| `/web-ui-dev-new-component`               | Scaffolds an architecture-compliant primitive (adapted or absorbed).                                                    |
+| `/web-ui-dev-update-component`            | Pointers to every file a prop, variant, or sub-component change touches.                                                |
+| `/web-ui-dev-design-component`            | Brand design pass for a component that works but isn't styled yet.                                                      |
+| `/web-ui-dev-story`                       | Author or update a Storybook story.                                                                                     |
+| `/web-ui-dev-commit`                      | Commit workflow: changelog skill, staged docs audit, CI-parity checks, house commit format.                             |
+| `/web-ui-dev-release`                     | Prepare release highlights, commit release notes, verify, and create an annotated local tag.                            |
+| `/web-ui-dev-changelog`                   | Generate and validate the required one-line CHANGELOG.md entry for a web-ui change, including direct commits to master. |
+| `/web-ui-dev-audit-docs`                  | Audit docs against staged or recent changes for staleness, gaps, and drift.                                             |
+| `/web-ui-dev-audit-pass-through-defaults` | Check `@default` annotations on pass-through props against Base UI upstream.                                            |
+| `/web-ui-dev-teardown-worktree`           | Tear down a worktree, wherever it lives — merging its branch first or dropping it.                                      |
+| `/web-ui-dev-refresh-design-reference`    | Refresh the committed brand snapshots in `design/` from the Figma styleguide.                                           |
+| `/web-ui-dev-mcp`                         | Set up or recover Storybook, DevTools, Atlassian, or Figma MCP access.                                                  |
 
 ## Releasing
 
+Release-facing changes are recorded as one-line entries in [`CHANGELOG.md`](./CHANGELOG.md) under `## [Unreleased]`. The
+commit workflow requires an entry for pull-request commits and direct commits to `master`, with only narrow mechanical
+exceptions. Each entry ends with its author as ` — Name <email>`, taken from the committer's git config.
+
 The published version is derived from git tags, not from `package.json`.
 
 The `version` field stays at `0.0.0` in the repository and he CI computes the real number with
@@ -131,8 +163,18 @@ Given the tag `web-ui/v0.5.0`:
 | Exactly on `web-ui/v0.5.0` | `0.5.0`                 | `latest` |
 | 5 commits after that tag   | `0.5.1-dev.5.gb4de52d7` | `dev`    |
 
-where `5` is the number of commits since the tag and `b4de52d7` the abbreviated hash. Off-tag builds bump the patch, so a dev
-build always sorts above the release it follows and below the next one.
+The off-tag string breaks down as:
+
+```
+0.5.1-dev.5.gb4de52d7
+└─┬─┘ └┬┘ │ └───┬────┘
+  │    │  │     └── commit hash, abbreviated; the leading g means "git"
+  │    │  └──────── commits since the tag
+  │    └─────────── pre-release marker, which is what puts it on the dev tag
+  └──────────────── the tag's version, patch bumped
+```
+
+Bumping the patch is what makes a dev build sort above the release it follows and below the next one.
 
 Every build of `master` publishes a `dev` version automatically. To check what the current checkout would publish:
 
@@ -142,18 +184,23 @@ npx tsx scripts/version.ts        # prints, changes nothing
 
 ### Cutting a release
 
-Tag the commit you want to ship and push the tag:
+The detailed Unreleased entries are the release record. Before cutting a version, add one to three titled `Highlights` blocks
+at the top for people deciding whether to update. Start each with the outcome; include a small usage example or link when it
+helps someone explore the feature. Then prepare the dated release section:
 
 ```bash
-git tag -a web-ui/v0.5.1 -m "web-ui 0.5.1"
-git push origin web-ui/v0.5.1
+npm run release:prepare -- --version 0.5.1
 ```
 
-The tag triggers a build that publishes `0.5.1` as `latest` and repoints the `dev` dist-tag at the same version.
+Commit that change through `/web-ui-dev-release`, then create the local annotated tag:
+
+```bash
+npm run release:tag -- --version 0.5.1
+```
 
-**The tag must be annotated (`-a`).** `git describe` ignores lightweight tags, so a tag pushed without `-a` is invisible to
-the version script — the build reads through it to the previous release tag and publishes another `dev` version instead of
-the release.
+The tag command requires a clean working tree, runs full verification, and creates `web-ui/v0.5.1`. It never pushes. Push
+that tag only after explicit approval. The tag triggers a build that publishes `0.5.1` as `latest` and repoints the `dev`
+dist-tag at the same version.
 
 The tag name must match `web-ui/vX.Y.Z` exactly. Both the version script's `--match` and the TeamCity branch filter in
 [`.teamcity/settings.kts`](./.teamcity/settings.kts) key off that shape; a tag in any other form publishes nothing.

package/bin/install.js

@@ -0,0 +1,428 @@
+#!/usr/bin/env node
+
+// Installs this package's agent tooling into the consumer project: the
+// skill family (../src/llms/skills/imf-web-ui*/) and the agent lifecycle
+// hooks in the installer-owned template home. Runs in the
+// CONSUMER's environment, so it may only use this package's real runtime
+// dependencies (@clack/prompts). Never wire this into a postinstall hook:
+// ambient script execution on `npm install` is a live supply-chain attack
+// vector — install stays an explicit, user-run command.
+//
+// The skills cross-reference each other, so they install as one bundle.
+// When both targets are selected, .agents/skills/ holds the real copy and
+// .claude/skills/ symlinks it (this repo's own convention) so the two
+// can't drift apart.
+//
+// Flags: bare = skills only; --hooks adds the agent lifecycle hooks after the
+// consumer checks the repo's existing hooks and still installs the skills.
+// --target claude|agents
+// (repeatable) selects scripted install targets,
+// --reconfigure to re-open the target prompt on an existing install.
+
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs";
+import { spawnSync } from "node:child_process";
+import { dirname, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as p from "@clack/prompts";
+
+const SKILL_PREFIX = "imf-web-ui";
+const VERSION_MARKER = ".imf-web-ui-skill-version.json";
+
+const here = dirname(fileURLToPath(import.meta.url));
+// Source is relative to THIS SCRIPT's location (inside node_modules), not
+// the consumer's cwd — the script is invoked from the consumer's project
+// root, but the skills it copies ship alongside this file in the package.
+const skillsRoot = resolve(here, "..", "src", "llms", "skills");
+const packageJson = JSON.parse(readFileSync(resolve(here, "..", "package.json"), "utf-8"));
+const currentVersion = packageJson.version;
+
+// Destination is relative to the consumer's project root (cwd), since
+// that's where their `.claude/` or `.agents/` directory lives.
+const projectRoot = process.cwd();
+
+const TARGETS = {
+  claude: { label: "Claude Code", root: resolve(projectRoot, ".claude", "skills") },
+  agents: { label: "Vendor-neutral (.agents/)", root: resolve(projectRoot, ".agents", "skills") }
+};
+
+function discoverSkills() {
+  if (!existsSync(skillsRoot)) return [];
+  return readdirSync(skillsRoot, { withFileTypes: true })
+    .filter(entry => entry.isDirectory() && entry.name.startsWith(SKILL_PREFIX))
+    .map(entry => entry.name)
+    .sort();
+}
+
+function displayPath(absPath) {
+  return `./${relative(projectRoot, absPath)}`;
+}
+
+function readInstalledVersion(dir) {
+  const markerPath = resolve(dir, VERSION_MARKER);
+  if (!existsSync(markerPath)) return null;
+  try {
+    return JSON.parse(readFileSync(markerPath, "utf-8")).version ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function writeRealCopy(sourceDir, destDir) {
+  mkdirSync(dirname(destDir), { recursive: true });
+  // force: true makes re-running after a version bump overwrite cleanly.
+  cpSync(sourceDir, destDir, { recursive: true, force: true });
+  writeFileSync(resolve(destDir, VERSION_MARKER), JSON.stringify({ version: currentVersion }, null, 2) + "\n");
+}
+
+function writeSymlink(linkPath, targetPath) {
+  mkdirSync(dirname(linkPath), { recursive: true });
+  // lstat (not existsSync, which follows symlinks) catches a broken/stale
+  // symlink left over from a prior run, not just a real file or directory.
+  if (lstatSync(linkPath, { throwIfNoEntry: false })) {
+    rmSync(linkPath, { recursive: true, force: true });
+  }
+  symlinkSync(relative(dirname(linkPath), targetPath), linkPath);
+}
+
+function removeOrphanedSkills(selected, skills, both) {
+  const bundledSkills = new Set(skills);
+  const selectedTargets = both ? ["agents", "claude"] : selected;
+
+  for (const key of selectedTargets) {
+    const { root } = TARGETS[key];
+    if (!existsSync(root)) continue;
+
+    const orphanedSkills = readdirSync(root).filter(name => name.startsWith(`${SKILL_PREFIX}-`) && !bundledSkills.has(name));
+    for (const name of orphanedSkills) {
+      rmSync(resolve(root, name), { recursive: true, force: true });
+      // In the two-target layout, .claude/ is a symlinked view of the
+      // canonical .agents/ copy. Remove its matching link along with the
+      // orphaned canonical skill.
+      if (both && key === "agents") {
+        rmSync(resolve(TARGETS.claude.root, name), { recursive: true, force: true });
+      }
+      p.log.info(`Removed orphaned skill: ${name} (no longer in this bundle)`);
+    }
+  }
+}
+
+// A prior install is recoverable from the filesystem, so a re-run doesn't
+// re-ask: a target counts as chosen when any bundled skill is present under
+// it. Symlinks count — they're how the both-targets layout represents
+// .claude/, and lstat avoids following them into the real copy.
+function detectInstalledTargets(skills) {
+  return Object.keys(TARGETS).filter(key =>
+    skills.some(name => lstatSync(resolve(TARGETS[key].root, name), { throwIfNoEntry: false }))
+  );
+}
+
+// Hook templates are installer-owned; the installer copies the scripts into the
+// consumer's .agents/hooks/ and merges the registrations into the host
+// registration files: .claude/settings.json from settings.json, .codex/hooks.json
+// from codex-hooks.json. One pristine template per host, merged verbatim.
+const installTemplatesRoot = resolve(here, "..", "src", "llms", "install-templates");
+const hooksSourceDir = resolve(installTemplatesRoot, "hooks");
+const hooksSettingsTemplate = resolve(installTemplatesRoot, "settings.json");
+const codexHooksTemplate = resolve(installTemplatesRoot, "codex-hooks.json");
+// Installer-owned subdirectory: refreshed wholesale on every run, so a repo's
+// own hooks in .agents/hooks/ are never touched.
+const hooksDestDir = resolve(projectRoot, ".agents", "hooks", "imf-web-ui");
+const settingsPath = resolve(projectRoot, ".claude", "settings.json");
+const codexHooksPath = resolve(projectRoot, ".codex", "hooks.json");
+
+// Serializing the file reflows entries this installer doesn't own; the
+// consumer's own Prettier puts them back. Best-effort: absent, or the path is
+// .prettierignore'd, nothing happens.
+function formatSettings(path) {
+  let toolRoot = projectRoot;
+  while (toolRoot !== dirname(toolRoot) && !existsSync(resolve(toolRoot, "node_modules", ".bin"))) {
+    toolRoot = dirname(toolRoot);
+  }
+  const prettier = resolve(toolRoot, "node_modules", ".bin", "prettier");
+  if (!existsSync(prettier)) return;
+  spawnSync(prettier, ["--write", path], { cwd: projectRoot, stdio: "ignore" });
+}
+
+function installHookScripts() {
+  const scripts = readdirSync(hooksSourceDir).filter(name => name.endsWith(".sh"));
+  mkdirSync(hooksDestDir, { recursive: true });
+  for (const name of scripts) {
+    const dest = resolve(hooksDestDir, name);
+    cpSync(resolve(hooksSourceDir, name), dest, { force: true });
+    chmodSync(dest, 0o755);
+  }
+  // The directory is installer-owned: a script dropped from the template is
+  // removed on refresh, so a stale hook can't keep running after an upgrade.
+  const removed = readdirSync(hooksDestDir).filter(name => name.endsWith(".sh") && !scripts.includes(name));
+  for (const name of removed) {
+    rmSync(resolve(hooksDestDir, name), { force: true });
+  }
+  return { installed: scripts, removed };
+}
+
+// A registration is identified by the script it runs, not the command string:
+// "$VAR/..." and "${VAR}/..." are the same hook.
+const HOOKS_DIR_SEGMENT = ".agents/hooks/imf-web-ui/";
+
+function hookScriptId(command) {
+  if (typeof command !== "string") return null;
+  const at = command.lastIndexOf(HOOKS_DIR_SEGMENT);
+  if (at === -1) return null;
+  // Only a bare script name (plus an optional closing quote) identifies a
+  // registration as installer-owned. Trailing arguments or redirection mean
+  // the consumer customized the command; that counts as foreign, so the
+  // stale-prune below can never delete it.
+  const match = command.slice(at + HOOKS_DIR_SEGMENT.length).match(/^([\w.-]+)["']?$/);
+  return match ? match[1] : null;
+}
+
+function entryScriptIds(entry) {
+  return (entry.hooks ?? []).map(hook => hookScriptId(hook.command)).filter(Boolean);
+}
+
+// Merge, never clobber: a registration is added only when no existing entry
+// for that event already runs the same script, so re-runs are idempotent and
+// hand-written settings survive. The one exception is entries that only run
+// scripts from the installer-owned directory that are no longer shipped —
+// those are pruned, or they would point at a script the refresh just removed.
+// A run that changes nothing writes nothing.
+function mergeHookRegistrations(targetPath, templateHooks, shippedScripts) {
+  let settings = {};
+  if (existsSync(targetPath)) {
+    try {
+      settings = JSON.parse(readFileSync(targetPath, "utf-8"));
+    } catch {
+      return null;
+    }
+  }
+  settings.hooks ??= {};
+  let added = 0;
+  let removed = 0;
+  // Pruning is per hook, not per entry: only an individual hook that
+  // unambiguously runs a no-longer-shipped installer-owned script goes;
+  // consumer hooks sharing the same entry stay.
+  const emptiedEvents = [];
+  for (const [event, entries] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    let pruned = 0;
+    const kept = entries
+      .map(entry => {
+        if (!Array.isArray(entry.hooks)) return entry;
+        const hooks = entry.hooks.filter(hook => {
+          const script = hookScriptId(hook.command);
+          return script === null || shippedScripts.includes(script);
+        });
+        pruned += entry.hooks.length - hooks.length;
+        return hooks.length === entry.hooks.length ? entry : { ...entry, hooks };
+      })
+      .filter(entry => !Array.isArray(entry.hooks) || entry.hooks.length > 0);
+    if (pruned === 0) continue;
+    removed += pruned;
+    if (kept.length === 0 && !(event in templateHooks)) emptiedEvents.push(event);
+    else settings.hooks[event] = kept;
+  }
+  // An event whose entries were all pruned disappears instead of lingering as [].
+  if (emptiedEvents.length > 0) {
+    settings.hooks = Object.fromEntries(Object.entries(settings.hooks).filter(([event]) => !emptiedEvents.includes(event)));
+  }
+  for (const [event, entries] of Object.entries(templateHooks)) {
+    settings.hooks[event] ??= [];
+    for (const entry of entries) {
+      const scripts = entryScriptIds(entry);
+      const present = settings.hooks[event].some(existing =>
+        entryScriptIds(existing).some(script => scripts.includes(script))
+      );
+      if (!present) {
+        settings.hooks[event].push(entry);
+        added++;
+      }
+    }
+  }
+  if (added === 0 && removed === 0) return { added, removed };
+  mkdirSync(dirname(targetPath), { recursive: true });
+  writeFileSync(targetPath, JSON.stringify(settings, null, 2) + "\n");
+  formatSettings(targetPath);
+  return { added, removed };
+}
+
+// The AGENTS.md baseline note lives inside a fenced block owned by this
+// installer. The template between the markers is the source of truth; an
+// existing AGENTS.md gets the block replaced in place (or appended when
+// absent), everything outside the fence is untouched. No AGENTS.md at all
+// is left alone — scaffolding one is the setup skill's job.
+const AGENTS_BLOCK_BEGIN = "<!-- imf-web-ui:begin";
+const AGENTS_BLOCK_END = "<!-- imf-web-ui:end -->";
+const agentsTemplatePath = resolve(installTemplatesRoot, "AGENTS.md");
+const agentsPath = resolve(projectRoot, "AGENTS.md");
+
+function extractAgentsBlock(content) {
+  const begin = content.indexOf(AGENTS_BLOCK_BEGIN);
+  const end = content.indexOf(AGENTS_BLOCK_END);
+  if (begin === -1 || end === -1) return null;
+  return content.slice(begin, end + AGENTS_BLOCK_END.length);
+}
+
+function upsertAgentsBlock() {
+  if (!existsSync(agentsPath)) return "absent";
+  const block = extractAgentsBlock(readFileSync(agentsTemplatePath, "utf-8"));
+  if (!block) return "absent";
+  const current = readFileSync(agentsPath, "utf-8");
+  const existing = extractAgentsBlock(current);
+  const next = existing ? current.replace(existing, block) : `${current.trimEnd()}\n\n${block}\n`;
+  if (next === current) return "unchanged";
+  writeFileSync(agentsPath, next);
+  return existing ? "updated" : "added";
+}
+
+// --target claude|agents (repeatable) selects targets without the
+// interactive prompt — for CI and scripted installs.
+function parseTargetFlags(argv) {
+  const targets = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] !== "--target") continue;
+    const value = argv[i + 1];
+    if (!value || !(value in TARGETS)) {
+      console.error(`--target expects one of: ${Object.keys(TARGETS).join(", ")}`);
+      process.exit(1);
+    }
+    targets.push(value);
+    i++;
+  }
+  return targets;
+}
+
+async function main() {
+  const skills = discoverSkills();
+  const argv = process.argv.slice(2);
+  const flagTargets = parseTargetFlags(argv);
+  const reconfigure = argv.includes("--reconfigure");
+  // Every install includes the skill bundle. Hooks are opt-in via --hooks —
+  // the consumer's setup workflow drives that after checking what the repo
+  // already registers, but hooks without their companion skills are invalid.
+  const wantHooks = argv.includes("--hooks");
+  const wantSkills = true;
+
+  const components = [wantSkills && `${skills.length} skills`, wantHooks && "agent hooks"].filter(Boolean);
+  p.intro(`@imfusion/web-ui install — ${components.join(" + ")}`);
+
+  if (wantSkills && skills.length === 0) {
+    p.log.error(`No skills found at ${skillsRoot}. Reinstall @imfusion/web-ui and try again.`);
+    p.outro("Nothing installed.");
+    process.exitCode = 1;
+    return;
+  }
+
+  if (wantHooks) {
+    const { installed, removed } = installHookScripts();
+    p.log.success(`Agent hooks -> ${displayPath(hooksDestDir)} (${installed.length} scripts)`);
+    if (removed.length > 0) {
+      p.log.info(`Removed stale hook script(s): ${removed.join(", ")} (no longer shipped)`);
+    }
+    const registrations = [
+      [settingsPath, JSON.parse(readFileSync(hooksSettingsTemplate, "utf-8")).hooks],
+      [codexHooksPath, JSON.parse(readFileSync(codexHooksTemplate, "utf-8")).hooks]
+    ];
+    for (const [path, hooks] of registrations) {
+      const result = mergeHookRegistrations(path, hooks, installed);
+      if (result === null) {
+        p.log.warn(`${displayPath(path)} is not valid JSON — registrations not merged, fix it and re-run.`);
+      } else if (result.added > 0 || result.removed > 0) {
+        const changes = [
+          result.added > 0 && `registered ${result.added}`,
+          result.removed > 0 && `removed ${result.removed} stale`
+        ].filter(Boolean);
+        p.log.success(`${changes.join(", ")} hook registration(s) in ${displayPath(path)}`);
+      } else {
+        p.log.info(`Hook registrations already present in ${displayPath(path)}`);
+      }
+    }
+  }
+
+  const installedTargets = detectInstalledTargets(skills);
+
+  const existingVersions = Object.values(TARGETS)
+    .flatMap(({ root }) => skills.map(name => readInstalledVersion(resolve(root, name))))
+    .filter(Boolean);
+  if (existingVersions.length > 0 && existingVersions.every(v => v === currentVersion)) {
+    p.log.info(`Already up to date (v${currentVersion}). Re-running will overwrite with the same content.`);
+  } else if (existingVersions.some(v => v !== currentVersion)) {
+    const from = existingVersions.find(v => v !== currentVersion);
+    p.log.info(`Updating installed skills from v${from} to v${currentVersion}.`);
+  }
+
+  p.log.message(`Skills in this bundle:\n${skills.map(name => `  - ${name}`).join("\n")}`);
+
+  let selected;
+  if (flagTargets.length > 0) {
+    selected = flagTargets;
+    p.log.info(`Targets from --target flags: ${selected.join(", ")}`);
+  } else if (installedTargets.length > 0 && !reconfigure) {
+    selected = installedTargets;
+    p.log.info(
+      `Refreshing the existing install: ${selected.map(key => displayPath(TARGETS[key].root)).join(", ")}` +
+        ` — pass --reconfigure to choose different targets.`
+    );
+  } else {
+    selected = await p.multiselect({
+      message: "Install into which skill directory (or directories)?",
+      options: Object.entries(TARGETS).map(([key, { label, root }]) => ({
+        value: key,
+        label,
+        hint: displayPath(root)
+      })),
+      required: true
+    });
+
+    if (p.isCancel(selected)) {
+      p.cancel("Cancelled — nothing installed.");
+      return;
+    }
+  }
+
+  const both = selected.includes("claude") && selected.includes("agents");
+
+  for (const name of skills) {
+    const sourceDir = resolve(skillsRoot, name);
+    if (both) {
+      // .agents/ is the canonical real copy; .claude/ aliases it via symlink.
+      const realDir = resolve(TARGETS.agents.root, name);
+      writeRealCopy(sourceDir, realDir);
+      writeSymlink(resolve(TARGETS.claude.root, name), realDir);
+    } else {
+      for (const key of selected) {
+        writeRealCopy(sourceDir, resolve(TARGETS[key].root, name));
+      }
+    }
+  }
+
+  removeOrphanedSkills(selected, skills, both);
+
+  if (both) {
+    p.log.success(`Vendor-neutral (.agents/) -> ${displayPath(TARGETS.agents.root)}/${SKILL_PREFIX}*`);
+    p.log.success(`Claude Code -> ${displayPath(TARGETS.claude.root)}/${SKILL_PREFIX}* (symlinks -> .agents/)`);
+  } else {
+    for (const key of selected) {
+      p.log.success(`${TARGETS[key].label} -> ${displayPath(TARGETS[key].root)}/${SKILL_PREFIX}*`);
+    }
+  }
+
+  const agentsResult = upsertAgentsBlock();
+  if (agentsResult === "updated" || agentsResult === "added") {
+    p.log.success(`Refreshed the imf-web-ui block in ${displayPath(agentsPath)}`);
+  }
+
+  p.outro(`Done — ${skills.length} skills installed${wantHooks ? " + agent hooks" : ""}.`);
+}
+
+await main();