@iseoane/agent-depot 0.6.5 → 0.6.7

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.7] - 2026-11-04
+
+### Fixed
+
+- Claude Skill installations on Windows now use directory junctions instead of
+  privilege-sensitive directory symlinks. Installation, additional Host exposure
+  and overwrite share the same creation policy; POSIX directory symlinks remain
+  unchanged. Rollback removes the managed link without following its target.
+- User-global Skill removal can now explicitly forget a missing installation
+  record, without removing files, so the Skill can be selected again in Catalog.
+  Recovery refuses unsafe paths, remaining Claude locations, overlapping records
+  and changes to the confirmed installation state. CLI and TUI previews and
+  completion messages distinguish record-only recovery from file removal.
+
+## [0.6.6] - 2026-10-29
+
+### Fixed
+
+- `self update` no longer reports every Windows install as unsupported: an
+  `npm.cmd` shim is now accepted when the `npm/bin/npm-cli.js` that ships next
+  to it is present, and the global-root provenance checks still apply (#70).
+
 ## [0.6.5] - 2026-10-29
 
 ### Added

package/README.md

@@ -184,21 +184,28 @@ segment when that is unique; unknown or ambiguous selections fail before anythin
 changes. It previews every deletion (with adopted/modified warnings), requires
 `--yes`, rechecks the targets, then deletes the files and their installation
 records. It is user-global only: project installations and manifests are never
-read or changed, and the Git cache is retained.
+read or changed, and the Git cache is retained. If a managed Skill's recorded
+installation is verified absent, the preview instead offers an explicit
+`forget missing installation record` action. Confirming removes only that stale
+record; it never removes files. Existing files, including any Claude location,
+unsafe ancestors, ambiguous overlapping records, or filesystem errors fail
+closed. After the record is forgotten, the Skill can be selected and installed
+again through the normal flow.
 
 `skill host add <id|path> --host <host>... [--yes] [--confirm-additional-host]`
 exposes an already installed user-global Skill to more Hosts without changing its
 content or version, then records the new Hosts. Non-Claude Hosts share the
-canonical `~/.agents/skills/<skill>` location and Claude is a symlink to it, so
-only a missing Claude symlink is ever created. The preview lists the new
-locations; because it exposes the Skill to more Hosts it needs both `--yes` and
+canonical `~/.agents/skills/<skill>` location and Claude uses a managed directory
+link to it (relative symlink on POSIX; absolute-target junction on Windows), so
+only a missing Claude link is ever created. The preview lists the new locations;
+because it exposes the Skill to more Hosts it needs both `--yes` and
 `--confirm-additional-host`. It refuses a Claude location that already holds
-anything other than the managed symlink, and a Skill that is not installed at the
+anything other than the managed link, and a Skill that is not installed at the
 canonical location (exposing it would require copying it).
 
 `skill remove <id|path> --host <host>... [--yes]` removes only those Hosts. Only
-the managed Claude symlink can be deleted this way; the canonical directory backs
-every remaining Host (including the Claude symlink) and stays until the last Host
+the managed Claude directory link can be deleted this way; the canonical directory
+backs every remaining Host (including the Claude link) and stays until the last Host
 is removed. Removing every recorded Host is a full removal with the usual
 adopted/modified warnings. The targets are rechecked before deleting and the
 record is updated afterwards. Project installations are not affected.
@@ -310,8 +317,9 @@ select candidates, or install anything automatically.
 ## User-global installation
 
 User-global installations use the same canonical Host locations under the user
-home directory (`.agents/skills/<skill>` and, when requested, a Claude symlink
-at `.claude/skills/<skill>`). They are independent from project manifests and
+home directory (`.agents/skills/<skill>` and, when requested, a Claude directory
+link at `.claude/skills/<skill>`: relative symlink on POSIX, absolute-target
+junction on Windows). They are independent from project manifests and
 are recorded in the shared per-user Source state, so separate CLI invocations
 reuse the same installation records. The selected Source, Skill, Hosts, and
 actual adopted or installed location are previewed before `--yes` confirmation.
@@ -403,8 +411,9 @@ process crash after the original is moved can leave the retained
 inspect the backup and target, and manually rename the retained backup back to the intended installation path when recovery is needed;
 then rerun the install. External installation methods run only after the filesystem
 and selected-scope state transaction succeeds.
-Claude is exposed through a symlink to the canonical `.agents/skills/<skill>`
-installation.
+Claude is exposed through a managed directory link to the canonical
+`.agents/skills/<skill>` installation (relative symlink on POSIX, absolute-target
+junction on Windows).
 
 ## User-provided installation methods
 

package/dist/src/cli.js

@@ -15,11 +15,11 @@ import { createProgress, NO_PROGRESS } from "./progress.js";
 import { skillTreeBaseline } from "./skill-discovery.js";
 import { BUILT_IN_SOURCE, BuiltInSourceError, createSourceOperations, resolveProjectSource, SourceMetadataError, SourceNotFoundError, } from "./sources.js";
 import { AGENT_DEPOT_PACKAGE_NAME, AGENT_DEPOT_PACKAGE_VERSION, builtinPinMismatch, defaultProjectManifestPath, parseProjectManifest, ProjectManifestStore, PROJECT_HOSTS, } from "./project-manifest.js";
-import { inspectProjectSkillInstallation, assertNoOverlappingProjectSkillRemovalTargets, } from "./project-installation.js";
+import { inspectAbsentManagedSkillRecord, inspectProjectSkillInstallation, assertNoOverlappingProjectSkillRemovalTargets, } from "./project-installation.js";
 import { selectUpdateBatch, UpdateBatchSelectionError, } from "./update-batch.js";
 import { describeUnmanagedRemoval, removeInspectedUnmanagedSkills } from "./unmanaged-removal.js";
 import { executeHostAddition, executeHostRemoval, planHostAddition, planHostRemoval } from "./skill-hosts.js";
-import { executeSkillRemoval, inspectSkillRemovals, planSkillRemoval, describeSkillRemoval, recheckSkillRemoval, removeSkillFiles, removeSkillsAndRecords, selectUserGlobalSkills, SkillSelectionError, userGlobalRemovalOptions, } from "./skill-removal.js";
+import { executeSkillRemoval, inspectSkillRemovals, planSkillRemoval, describeSkillRemoval, recheckSkillRemoval, removeSkillFiles, removeSkillsAndRecords, assertManagedInstallationRecordsUnchanged, assertRemovalInspectionUnchanged, selectUserGlobalSkills, SkillSelectionError, userGlobalRemovalOptions, } from "./skill-removal.js";
 import { defaultProjectSkillTreeAccess, executeOrRejectMethod, executeSingleInstall, externalMethodFailure, isValidFixedVersion, findSource, installOne, outputInstallationResult, outputInstallPreview, outputSingleInstallPreview, planSingleInstall, refreshResolvedSource, rejectInstallationCollision, resolveSelection, rollbackTransactions, } from "./skill-install.js";
 import { CliUsageError } from "./usage-error.js";
 import { createSelfUpdateOperations } from "./self-update.js";
@@ -239,7 +239,10 @@ async function runSourceRemoval(argv, operations, dependencies, output, progress
     const selected = options.all
         ? dependent
         : resolveRemovalSelections(dependent, options.requested);
-    const removalOptions = userGlobalRemovalOptions(path.resolve(dependencies.homeDirectory ?? homedir()), dependencies.installationOptions);
+    const removalOptions = userGlobalRemovalOptions(path.resolve(dependencies.homeDirectory ?? homedir()), {
+        ...dependencies.installationOptions,
+        otherInstallationPaths: installations.filter((record) => !selected.includes(record)).flatMap((record) => record.installation ? [record.installation.path] : []),
+    });
     output(`Preview: remove Git Source ${source.id} from ${source.url}`);
     output(`Dependent user-global Skills (${dependent.length}):`);
     for (const [index, selection] of dependent.entries()) {
@@ -255,14 +258,33 @@ async function runSourceRemoval(argv, operations, dependencies, output, progress
     requireConfirmation(options.confirmed, "Removal not confirmed; rerun with --yes after reviewing every Source and Skill preview");
     // Recheck every selected target before deleting the first one. A changed later
     // target must never result in a partially removed batch.
-    await progress.run("Removing Skill files", async () => {
-        const rechecked = await recheckSkillRemoval(plan, removalOptions);
-        await removeSkillFiles(plan, rechecked, removalOptions);
+    const rechecked = await progress.run("Removing Skill files", async () => {
+        const current = await recheckSkillRemoval(plan, removalOptions);
+        assertManagedInstallationRecordsUnchanged(installations, await operations.listUserGlobalInstallations());
+        await removeSkillFiles(plan, current, removalOptions);
+        return current;
+    });
+    // Source removal persists records rather than reconciling them one by one.
+    // Revalidate every record-only target and the complete record snapshot just
+    // before that persistence boundary so a stale preview cannot forget a changed record.
+    await progress.run("Revalidating Skill records before Source removal", async () => {
+        for (const [index, inspection] of rechecked.inspections.entries()) {
+            if (!inspection.recordOnly)
+                continue;
+            const latest = await inspectAbsentManagedSkillRecord(rechecked.selections[index], removalOptions);
+            assertRemovalInspectionUnchanged(inspection, latest);
+        }
+        assertManagedInstallationRecordsUnchanged(installations, await operations.listUserGlobalInstallations());
     });
     await progress.run(`Removing Git Source ${source.id}`, () => operations.removeGitSource(source.id, selected));
     output(`Removed Git Source: ${source.id}`);
     if (selected.length > 0) {
-        output(`Removed ${selected.length} dependent user-global Skill${selected.length === 1 ? "" : "s"}; other dependent Skills remain tracked`);
+        const forgotten = plan.inspections.filter((inspection) => inspection.recordOnly).length;
+        const removed = selected.length - forgotten;
+        if (removed > 0)
+            output(`Removed ${removed} dependent user-global Skill${removed === 1 ? "" : "s"}; other dependent Skills remain tracked`);
+        if (forgotten > 0)
+            output(`Forgot ${forgotten} missing dependent Skill installation record${forgotten === 1 ? "" : "s"}; no files were removed`);
     }
 }
 function parseMigrateSourceOptions(argv) {
@@ -461,7 +483,10 @@ async function runSkillRemoval(argv, operations, dependencies, output, progress)
     }
     const installations = await operations.listUserGlobalInstallations();
     const selected = selectManagedSkills(installations, requested);
-    const removalOptions = userGlobalRemovalOptions(path.resolve(dependencies.homeDirectory ?? homedir()), dependencies.installationOptions);
+    const removalOptions = userGlobalRemovalOptions(path.resolve(dependencies.homeDirectory ?? homedir()), {
+        ...dependencies.installationOptions,
+        otherInstallationPaths: installations.filter((record) => !selected.includes(record)).flatMap((record) => record.installation ? [record.installation.path] : []),
+    });
     if (hosts.length > 0) {
         await runSkillHostRemoval(selected[0], hosts, installations, confirmed, operations, removalOptions, output, progress);
         return;
@@ -473,7 +498,12 @@ async function runSkillRemoval(argv, operations, dependencies, output, progress)
     output("  Installation records are reconciled after each successful Skill removal");
     requireConfirmation(confirmed, "Removal not confirmed; rerun with --yes after reviewing every Skill preview");
     await progress.run(`Removing ${selected.length} user-global Skill${selected.length === 1 ? "" : "s"}`, () => executeSkillRemoval(plan, operations, removalOptions, installations));
-    output(`Removed ${selected.length} user-global Skill${selected.length === 1 ? "" : "s"}`);
+    const forgotten = plan.inspections.filter((inspection) => inspection.recordOnly).length;
+    const removed = selected.length - forgotten;
+    if (removed > 0)
+        output(`Removed ${removed} user-global Skill${removed === 1 ? "" : "s"}`);
+    if (forgotten > 0)
+        output(`Forgot ${forgotten} missing user-global Skill installation record${forgotten === 1 ? "" : "s"}; no files were removed`);
 }
 /** Resolves `<id|path>` arguments to managed installations, reporting selection problems as usage errors. */
 function selectManagedSkills(installations, requested) {
@@ -488,17 +518,24 @@ function selectManagedSkills(installations, requested) {
 }
 async function runSkillHostRemoval(selection, hosts, installations, confirmed, operations, options, output, progress) {
     const plan = await planHostRemoval(selection, hosts, options).catch(rethrowSelectionError);
+    const recordOnly = plan.kind === "full" && plan.plan.inspections.every((inspection) => inspection.recordOnly);
     output(plan.kind === "full"
-        ? "Preview: remove 1 user-global Skill (every recorded Host is removed)"
+        ? recordOnly
+            ? "Preview: forget 1 missing user-global Skill installation record (every recorded Host is removed)"
+            : "Preview: remove 1 user-global Skill (every recorded Host is removed)"
         : `Preview: remove ${hosts.length} Host${hosts.length === 1 ? "" : "s"} from 1 user-global Skill`);
     for (const line of plan.kind === "full" ? plan.plan.preview : plan.preview)
         output(line);
-    output("  The installation record is reconciled after the locations are removed");
+    output(recordOnly
+        ? "  Only the installation record will be forgotten; no files are removed"
+        : "  The installation record is reconciled after the locations are removed");
     requireConfirmation(confirmed, "Removal not confirmed; rerun with --yes after reviewing the preview");
     await progress.run(plan.kind === "full" ? "Removing 1 user-global Skill" : `Removing Hosts from ${selection.path}`, () => executeHostRemoval(plan, operations, options, installations));
-    output(plan.kind === "full"
-        ? "Removed 1 user-global Skill"
-        : `Removed hosts ${plan.removed.join(", ")} from ${JSON.stringify(selection.path)}`);
+    output(plan.kind === "full" && plan.plan.inspections.every((inspection) => inspection.recordOnly)
+        ? `Forgot missing installation record for ${JSON.stringify(selection.path)}; no files were removed`
+        : plan.kind === "full"
+            ? "Removed 1 user-global Skill"
+            : `Removed hosts ${plan.removed.join(", ")} from ${JSON.stringify(selection.path)}`);
 }
 async function runSkillHostAdd(argv, operations, dependencies, output, progress) {
     const requested = [];
@@ -659,10 +696,13 @@ function assertNoManagedUnmanagedOverlap(managed, unmanaged, message) {
         }
     }
 }
-function outputUninstallSummary(options, removedManagedCount, output) {
-    if (options.skills) {
+function outputUninstallSummary(options, removedManagedCount, forgottenManagedCount, output) {
+    if (options.skills && removedManagedCount > 0) {
         output(`Removed ${removedManagedCount} managed user-global Skill${removedManagedCount === 1 ? "" : "s"}`);
     }
+    if (options.skills && forgottenManagedCount > 0) {
+        output(`Forgot ${forgottenManagedCount} missing managed user-global Skill installation record${forgottenManagedCount === 1 ? "" : "s"}; no files were removed`);
+    }
     if (options.unmanagedSkills.length > 0) {
         output(`Permanently deleted ${options.unmanagedSkills.length} unmanaged user-global Skill${options.unmanagedSkills.length === 1 ? "" : "s"}`);
     }
@@ -723,7 +763,8 @@ async function runUninstall(argv, operations, dependencies, output, progress) {
     if (options.data) {
         await progress.run("Removing catalog data", () => operations.removeCatalogData());
     }
-    outputUninstallSummary(options, selectedInstallations.length, output);
+    const forgottenManagedCount = managedRechecked.inspections.filter((inspection) => inspection.recordOnly).length;
+    outputUninstallSummary(options, selectedInstallations.length - forgottenManagedCount, forgottenManagedCount, output);
 }
 function selfUpdateOperationsFor(dependencies) {
     if (dependencies.selfUpdateOperations !== undefined)

package/dist/src/project-installation.js

@@ -56,7 +56,7 @@ export async function inspectProjectSkillRemoval(selection, options) {
         actualBaseline.digest !== selection.installation.baseline.digest;
     const paths = [targetPath];
     // A Claude exposure created by Agent Depot is removable only when it is the
-    // exact relative symlink to this canonical installation. Never follow or
+    // exact managed directory link to this canonical installation. Never follow or
     // remove an unrelated path merely because the Skill selected Claude.
     const canonicalPath = path.join(projectRoot, ".agents", "skills", skillName);
     const claudePath = path.join(projectRoot, ".claude", "skills", skillName);
@@ -65,11 +65,11 @@ export async function inspectProjectSkillRemoval(selection, options) {
         try {
             const claudeInformation = await fileSystem.lstat(claudePath);
             if (!claudeInformation.isSymbolicLink()) {
-                throw new ProjectInstallationError("unsafe-target", `Cannot remove the tracked Skill because its Claude location is not the managed symlink: ${claudePath}; no path was changed`);
+                throw new ProjectInstallationError("unsafe-target", `Cannot remove the tracked Skill because its Claude location is not the managed directory link: ${claudePath}; no path was changed`);
             }
             const target = await fileSystem.readlink(claudePath);
             if (path.resolve(path.dirname(claudePath), target) !== canonicalPath) {
-                throw new ProjectInstallationError("unsafe-target", `Cannot remove the tracked Skill because its Claude symlink does not point to the canonical installation: ${claudePath}; no path was changed`);
+                throw new ProjectInstallationError("unsafe-target", `Cannot remove the tracked Skill because its Claude directory link does not point to the canonical installation: ${claudePath}; no path was changed`);
             }
             paths.push(claudePath);
         }
@@ -87,6 +87,46 @@ export async function inspectProjectSkillRemoval(selection, options) {
         ...(nonCanonicalPath === undefined ? {} : { nonCanonicalPath }),
     });
 }
+/**
+ * Explicitly inspects a stale user-global record without making it valid for
+ * host exposure/update. Every relevant ancestor and both managed host locations
+ * are checked; only ENOENT is accepted as absence and no filesystem entry is removed.
+ */
+export async function inspectAbsentManagedSkillRecord(selection, options) {
+    if (!selection.installation)
+        throw new ProjectInstallationError("removal-unavailable", "Cannot forget a Skill without a recorded installation");
+    const fileSystem = options.fileSystem ?? nodeFileSystem;
+    const root = path.resolve(options.projectRoot);
+    const target = resolveInstallationPath(root, selection.installation.path);
+    if (!isSafeRelativePath(selection.installation.path) || selection.installation.path.split("/").some((segment) => segment.toLowerCase() === ".git")) {
+        throw new ProjectInstallationError("unsafe-target", `Tracked Skill installation path is unsafe: ${JSON.stringify(selection.installation.path)}; no record was changed`);
+    }
+    await assertNoSymlinkComponents(root, fileSystem);
+    await assertDirectory(root, fileSystem, "user-global root");
+    await assertNoSymlinkAncestors(root, relativeSegments(root, target), fileSystem);
+    const skillName = skillNameFromSelection(selection);
+    const canonical = path.join(root, ".agents", "skills", skillName);
+    const claude = path.join(root, ".claude", "skills", skillName);
+    for (const otherPath of options.otherInstallationPaths ?? []) {
+        const other = resolveInstallationPath(root, otherPath);
+        if (pathsOverlap(target, other) || pathsOverlap(canonical, other) || pathsOverlap(claude, other)) {
+            throw new ProjectInstallationError("overlapping-targets", `Cannot forget ${JSON.stringify(selection.path)} because its recorded path overlaps another managed Skill record; no record was changed`);
+        }
+    }
+    await assertNoSymlinkAncestors(root, [".agents", "skills", skillName], fileSystem);
+    await assertNoSymlinkAncestors(root, [".claude", "skills", skillName], fileSystem);
+    for (const candidate of new Set([target, canonical, claude])) {
+        try {
+            await fileSystem.lstat(candidate);
+            throw new ProjectInstallationError("unsafe-target", `Cannot forget ${JSON.stringify(selection.path)} because a filesystem object exists at ${candidate}; no record was changed`);
+        }
+        catch (error) {
+            if (!isMissing(error))
+                throw error;
+        }
+    }
+    return Object.freeze({ skillName, paths: Object.freeze([]), digest: "absent-record-only", adopted: selection.installation.adopted, modified: false, recordOnly: true });
+}
 /**
  * Removes a previously inspected user-global Skill after rechecking ownership.
  * `deletePaths` narrows the deletion to a subset of the inspected paths (used
@@ -99,6 +139,7 @@ export async function removeProjectSkill(selection, inspection, options, deleteP
         current.paths.length !== inspection.paths.length ||
         current.paths.some((candidate, index) => candidate !== inspection.paths[index]) ||
         current.digest !== inspection.digest ||
+        current.recordOnly !== inspection.recordOnly ||
         current.adopted !== inspection.adopted ||
         current.modified !== inspection.modified ||
         current.nonCanonicalPath !== inspection.nonCanonicalPath) {
@@ -120,9 +161,9 @@ export async function removeProjectSkill(selection, inspection, options, deleteP
     }
 }
 /**
- * Deletes one managed symlink without ever following or recursing into it:
- * look at the path immediately before, require a symlink, then unlink it.
- * Partial Host removal only ever deletes the Claude symlink, so it uses this
+ * Deletes one managed directory link without ever following or recursing into it:
+ * look at the path immediately before, require a link, then unlink it.
+ * Partial Host removal only ever deletes the Claude link, so it uses this
  * instead of the recursive `rm` that full removal needs for the canonical directory.
  */
 async function unlinkManagedSymlink(candidate, fileSystem) {
@@ -135,7 +176,7 @@ async function unlinkManagedSymlink(candidate, fileSystem) {
 /**
  * Inspects what exposing the installed Skill to `hosts` would change without
  * writing. Non-Claude Hosts share the canonical `.agents/skills` location, and
- * Claude is a symlink to it; anything else at a target location is a conflict.
+ * Claude uses a managed directory link to it; anything else at a target location is a conflict.
  */
 export async function inspectProjectSkillHostAddition(selection, hosts, options) {
     const removal = await inspectProjectSkillRemoval(selection, options);
@@ -161,7 +202,7 @@ export async function inspectProjectSkillHostAddition(selection, hosts, options)
         else {
             const target = existing.isSymbolicLink() ? await fileSystem.readlink(claudePath) : undefined;
             if (target === undefined || path.resolve(path.dirname(claudePath), target) !== canonicalPath) {
-                throw new ProjectInstallationError("target-conflict", `Cannot expose ${JSON.stringify(removal.skillName)} to Claude because ${JSON.stringify(claudePath)} already exists and is not the managed symlink to the installed Skill; no path was changed.`);
+                throw new ProjectInstallationError("target-conflict", `Cannot expose ${JSON.stringify(removal.skillName)} to Claude because ${JSON.stringify(claudePath)} already exists and is not the managed directory link to the installed Skill; no path was changed.`);
             }
         }
     }
@@ -446,7 +487,7 @@ async function inspectSkillLocation(candidate, context) {
         ? Object.freeze({ path: candidate, status: "identical", ...evidence })
         : collisionLocation(candidate, comparison.reason ?? "content-mismatch", evidence);
 }
-/** A Claude symlink is an exposure only when it points to the canonical Skill that was itself found identical. */
+/** A Claude directory link is an exposure only when it points to the canonical Skill that was itself found identical. */
 async function isClaudeExposureOfCanonical(candidate, context) {
     if (candidate !== context.claudePath || !context.canonicalIdentical)
         return false;
@@ -523,7 +564,7 @@ export async function installProjectSkillTransaction(request, options) {
         // prevents a later host check from following a pre-existing symlink after
         // the other host's directories have already been created.
         await assertNoSymlinkAncestors(projectRoot, [".agents", "skills", skillName], fileSystem);
-        // A Claude Skill path may be the managed symlink to the canonical tree;
+        // A Claude Skill path may be the managed directory link to the canonical tree;
         // adoption validates that final component before following it.
         await assertNoSymlinkAncestors(projectRoot, [".claude", "skills"], fileSystem);
         const adoption = await adoptExistingProjectSkill(projectRoot, skillName, request.selection.path, files, hosts, fileSystem, request.confirmAdditionalHostExposure === true, createdPaths, uncertainCreates);
@@ -609,15 +650,14 @@ async function writeInstalledFile(canonicalPath, file, createdPaths, uncertainCr
     await fileSystem.chmod(destination, file.source.executable ? 0o755 : 0o644);
 }
 async function createClaudeSkillSymlink(claudePath, canonicalPath, createdPaths, uncertainCreates, fileSystem) {
-    const linkTarget = path.relative(path.dirname(claudePath), canonicalPath);
     uncertainCreates.add(claudePath);
     try {
-        await fileSystem.symlink(linkTarget, claudePath, "dir");
+        await createClaudeDirectoryLink(fileSystem, claudePath, canonicalPath);
     }
     catch (error) {
         const reason = error instanceof Error ? error.message : String(error);
-        throw new ProjectInstallationError("claude-symlink-failed", `Cannot create the Claude Skill symlink at ${JSON.stringify(claudePath)}: ${reason}. ` +
-            "Grant this process permission to create directory symlinks (on Windows, enable Developer Mode or the required symlink privilege) and retry. " +
+        throw new ProjectInstallationError("claude-symlink-failed", `Cannot create the Claude Skill directory link at ${JSON.stringify(claudePath)}: ${reason}. ` +
+            (process.platform === "win32" ? "Windows junctions do not require symlink privileges; check the target path and filesystem instead. " : "Check that this process can create directory symlinks. ") +
             "No duplicate managed copy was created; the canonical installation was rolled back.");
     }
     await recordCreatedClaudeSymlink(claudePath, createdPaths, uncertainCreates, fileSystem);
@@ -625,7 +665,7 @@ async function createClaudeSkillSymlink(claudePath, canonicalPath, createdPaths,
 async function recordCreatedClaudeSymlink(claudePath, createdPaths, uncertainCreates, fileSystem) {
     const information = await fileSystem.lstat(claudePath);
     if (!information.isSymbolicLink()) {
-        throw new ProjectInstallationError("unsafe-target", `Claude installation path is not a symbolic link: ${claudePath}`);
+        throw new ProjectInstallationError("unsafe-target", `Claude installation path is not a directory link: ${claudePath}`);
     }
     createdPaths.push({ path: claudePath, kind: "symlink", identity: pathIdentity(information) });
     uncertainCreates.delete(claudePath);
@@ -651,7 +691,7 @@ function assertOverwriteCollision(inspection) {
     // would make Claude continue reading the old bytes after the canonical move.
     const claudeLocation = inspection.locations.find((location) => location.path === inspection.claudePath);
     if (inspection.targetPath === inspection.canonicalPath && claudeLocation?.status === "identical" && claudeLocation.identity !== undefined) {
-        throw new ProjectInstallationError("ambiguous-target", `Cannot overwrite ${JSON.stringify(inspection.targetPath)} because the Claude location is a separate real directory rather than the managed symlink; no path was changed`);
+        throw new ProjectInstallationError("ambiguous-target", `Cannot overwrite ${JSON.stringify(inspection.targetPath)} because the Claude location is a separate real directory rather than the managed directory link; no path was changed`);
     }
 }
 function targetLocation(inspection) {
@@ -847,9 +887,8 @@ async function overwriteProjectSkillTransaction(request, options, files, hosts,
         const claudeLocation = inspection.locations.find((location) => location.path === inspection.claudePath);
         if (targetPath === inspection.canonicalPath && hosts.includes("claude") && claudeLocation?.status === "missing") {
             await ensureDirectoryTree(projectRoot, [".claude", "skills"], exposureCreated, exposureUncertain, fileSystem);
-            const linkTarget = path.relative(path.dirname(inspection.claudePath), inspection.canonicalPath);
             exposureUncertain.add(inspection.claudePath);
-            await fileSystem.symlink(linkTarget, inspection.claudePath, "dir");
+            await createClaudeDirectoryLink(fileSystem, inspection.claudePath, inspection.canonicalPath);
             const linkInformation = await fileSystem.lstat(inspection.claudePath);
             if (!linkInformation.isSymbolicLink()) {
                 throw new ProjectInstallationError("unsafe-target", `Claude installation path is not a symbolic link: ${inspection.claudePath}`);
@@ -918,15 +957,19 @@ async function assertExistingSkillMatches(candidate, sourceSkillPath, expectedTr
         throw new ProjectInstallationError("adoption-conflict", `Cannot adopt because an existing Skill already exists at ${JSON.stringify(candidate)} with different content (${comparison.reason}); explicit confirmation would be required to overwrite it, but this safe install flow has no overwrite operation. No path was changed.`);
     }
 }
+async function createClaudeDirectoryLink(fileSystem, claudePath, canonicalPath) {
+    const windows = process.platform === "win32";
+    await fileSystem.symlink(windows ? path.resolve(canonicalPath) : path.relative(path.dirname(claudePath), canonicalPath), claudePath, windows ? "junction" : "dir");
+}
 async function createAdditionalClaudeExposure(projectRoot, canonicalPath, claudePath, fileSystem, createdPaths, uncertainCreates) {
     await ensureDirectoryTree(projectRoot, [".claude", "skills"], createdPaths, uncertainCreates, fileSystem);
     await assertMissing(claudePath, fileSystem, claudePath);
     uncertainCreates.add(claudePath);
     try {
-        await fileSystem.symlink(path.relative(path.dirname(claudePath), canonicalPath), claudePath, "dir");
+        await createClaudeDirectoryLink(fileSystem, claudePath, canonicalPath);
     }
     catch (error) {
-        throw new ProjectInstallationError("claude-symlink-failed", `Cannot create the additional Claude Skill symlink at ${JSON.stringify(claudePath)}: ${errorMessage(error)}. No existing path was changed.`);
+        throw new ProjectInstallationError("claude-symlink-failed", `Cannot create the additional Claude Skill directory link at ${JSON.stringify(claudePath)}: ${errorMessage(error)}. No existing path was changed.`);
     }
     await recordCreatedClaudeSymlink(claudePath, createdPaths, uncertainCreates, fileSystem);
 }
@@ -1207,6 +1250,9 @@ async function rollbackCreatedPaths(createdPaths, uncertainCreates, fileSystem)
                 }
                 await fileSystem.rmdir(created.path);
             }
+            else if (created.kind === "symlink") {
+                await unlinkManagedSymlink(created.path, fileSystem);
+            }
             else {
                 await fileSystem.rm(created.path);
             }

package/dist/src/self-update.js

@@ -68,13 +68,18 @@ function successfulStdout(result) {
 }
 export function createSelfUpdateOperations(options) {
     const resolveExecutable = options.resolveExecutable ?? createPortableExecutableResolver();
+    const platform = options.platform ?? process.platform;
     const run = options.run ?? runProcess;
     const fetcher = options.fetch ?? globalThis.fetch;
     async function npmGlobalExecutable() {
         const npm = await resolveExecutable("npm");
         if (npm.blocked || npm.executable === undefined)
             return undefined;
-        const target = await realpath(npm.executable).catch(() => undefined);
+        // On Windows npm resolves to an `npm.cmd` shim; verify the npm-cli.js that ships next to it instead.
+        const verifiedFile = platform === "win32" && path.basename(npm.executable).toLowerCase() === "npm.cmd"
+            ? path.join(path.dirname(npm.executable), "node_modules", "npm", "bin", "npm-cli.js")
+            : npm.executable;
+        const target = await realpath(verifiedFile).catch(() => undefined);
         if (target === undefined || path.basename(target) !== "npm-cli.js" || path.basename(path.dirname(target)) !== "bin" || path.basename(path.dirname(path.dirname(target))) !== "npm")
             return undefined;
         let rootResult;

package/dist/src/skill-removal.js

@@ -1,4 +1,4 @@
-import { assertNoOverlappingProjectSkillRemovalTargets, inspectProjectSkillRemoval, removeProjectSkill, } from "./project-installation.js";
+import { assertNoOverlappingProjectSkillRemovalTargets, inspectAbsentManagedSkillRecord, inspectProjectSkillRemoval, ProjectInstallationError, removeProjectSkill, } from "./project-installation.js";
 /** Result of resolving a user-supplied `<id|path>` against managed installations. */
 export class SkillSelectionError extends Error {
 }
@@ -32,11 +32,13 @@ export function userGlobalRemovalOptions(homeDirectory, overrides) {
 }
 /** Preview lines for one inspected removal, including adopted/modified warnings. */
 export function describeSkillRemoval(selection, inspection, label) {
-    const lines = [`  remove ${label}${JSON.stringify(selection.path)} at ${inspection.paths.join(", ")}`];
-    if (inspection.adopted) {
+    const lines = inspection.recordOnly
+        ? [`  forget missing installation record for ${label}${JSON.stringify(selection.path)} (record only; no files removed)`]
+        : [`  remove ${label}${JSON.stringify(selection.path)} at ${inspection.paths.join(", ")}`];
+    if (!inspection.recordOnly && inspection.adopted) {
         lines.push("    WARNING: this Skill was adopted; removal deletes content that Agent Depot did not create");
     }
-    if (inspection.modified) {
+    if (!inspection.recordOnly && inspection.modified) {
         lines.push("    WARNING: this Skill is locally modified or has no trusted baseline; removal deletes those changes");
     }
     return lines;
@@ -48,7 +50,20 @@ export function describeSkillRemoval(selection, inspection, label) {
 export async function inspectSkillRemovals(selections, options, onInspected) {
     const inspections = [];
     for (const selection of selections) {
-        const inspection = await inspectProjectSkillRemoval(selection, options);
+        const otherInstallationPaths = [
+            ...(options.otherInstallationPaths ?? []),
+            ...selections.filter((candidate) => candidate !== selection)
+                .flatMap((candidate) => candidate.installation ? [candidate.installation.path] : []),
+        ];
+        let inspection;
+        try {
+            inspection = await inspectProjectSkillRemoval(selection, { ...options, otherInstallationPaths });
+        }
+        catch (error) {
+            if (!(error instanceof ProjectInstallationError) || error.code !== "missing-installation" || options.installationTrust !== "user-global-state")
+                throw error;
+            inspection = await inspectAbsentManagedSkillRecord(selection, { ...options, otherInstallationPaths });
+        }
         inspections.push(inspection);
         onInspected?.(selection, inspection);
     }
@@ -70,9 +85,9 @@ export async function recheckSkillRemoval(plan, options) {
     return rechecked;
 }
 export function assertRemovalInspectionUnchanged(before, after) {
-    const unchanged = before.digest === after.digest && before.adopted === after.adopted && before.modified === after.modified &&
-        before.skillName === after.skillName && before.paths.length === after.paths.length &&
-        before.paths.every((candidate, pathIndex) => candidate === after.paths[pathIndex]);
+    const unchanged = before.digest === after.digest && before.recordOnly === after.recordOnly && before.adopted === after.adopted && before.modified === after.modified &&
+        before.skillName === after.skillName && before.nonCanonicalPath === after.nonCanonicalPath &&
+        before.paths.length === after.paths.length && before.paths.every((candidate, pathIndex) => candidate === after.paths[pathIndex]);
     if (!unchanged) {
         throw new Error("The inspected Skill removal target changed before deletion; no path was removed");
     }
@@ -86,8 +101,11 @@ export function assertManagedInstallationRecordsUnchanged(expected, actual) {
 }
 /** Deletes the files of every rechecked selection; records are left to the caller. */
 export async function removeSkillFiles(plan, rechecked, options) {
+    assertRemovalBatchUnchanged(plan, rechecked);
     for (const [index, selection] of plan.selections.entries()) {
         assertRemovalInspectionUnchanged(plan.inspections[index], rechecked.inspections[index]);
+        if (rechecked.inspections[index].recordOnly)
+            continue;
         await removeProjectSkill(selection, rechecked.inspections[index], options);
     }
 }
@@ -102,16 +120,35 @@ export async function removeSkillsAndRecords(plan, rechecked, operations, option
     if (!list || !reconcile) {
         throw new Error("Configured Source operations cannot reconcile removed user-global Skills");
     }
+    assertRemovalBatchUnchanged(plan, rechecked);
     let expected = initialManaged;
     for (const [index, selection] of plan.selections.entries()) {
         assertRemovalInspectionUnchanged(plan.inspections[index], rechecked.inspections[index]);
         assertManagedInstallationRecordsUnchanged(expected, await list.call(operations));
-        await removeProjectSkill(selection, rechecked.inspections[index], options);
+        if (rechecked.inspections[index].recordOnly) {
+            const latest = await inspectAbsentManagedSkillRecord(selection, options);
+            assertRemovalInspectionUnchanged(rechecked.inspections[index], latest);
+        }
+        else {
+            await removeProjectSkill(selection, rechecked.inspections[index], options);
+        }
         await reconcile.call(operations, [selection]);
         expected = await list.call(operations);
     }
     return expected;
 }
+/** Compare the complete confirmed batch before any entry can mutate files or records. */
+function assertRemovalBatchUnchanged(plan, rechecked) {
+    if (plan.selections.length !== rechecked.selections.length || plan.inspections.length !== rechecked.inspections.length) {
+        throw new Error("The inspected Skill removal batch changed before deletion; no path was removed");
+    }
+    for (const [index, inspection] of plan.inspections.entries()) {
+        const current = rechecked.inspections[index];
+        if (!current)
+            throw new Error("The inspected Skill removal batch changed before deletion; no path was removed");
+        assertRemovalInspectionUnchanged(inspection, current);
+    }
+}
 /** Execute step: recheck, then remove files and records. */
 export async function executeSkillRemoval(plan, operations, options, initialManaged) {
     const rechecked = await recheckSkillRemoval(plan, options);

package/dist/src/tui/bulk-actions.js

@@ -92,7 +92,9 @@ export async function runBulkUninstall(plan, operations, env) {
         await runUninstall({ ...item.prepared, installations: expected }, operations, env);
         // Only the record this item removed moves the baseline the next item is checked against.
         expected = expected.filter((record) => !item.prepared.plan.selections.some((removed) => sameRecord(removed, record)));
-        return `Removed ${item.label}`;
+        return item.prepared.plan.inspections.every((inspection) => inspection.recordOnly)
+            ? `Forgot missing installation record for ${item.label}; no files were removed`
+            : `Removed ${item.label}`;
     }, (item, error) => (item.kind === "unmanaged" ? errorText(error) : `Failed ${item.label}: ${errorText(error)}`));
     return resultOf(outcomes, plan.skipped);
 }

package/dist/src/tui/catalog-installs.js

@@ -128,15 +128,24 @@ export async function prepareUninstall(operations, environment, skill, installed
     if (matches.length === 0) {
         return { kind: recordsFor(installed.project, skill, installed.sources).length > 0 ? "project-only" : "not-installed" };
     }
-    const options = userGlobalRemovalOptions(homeOf(environment), environment.installationOptions);
     const record = matches[0];
+    const options = userGlobalRemovalOptions(homeOf(environment), {
+        ...environment.installationOptions,
+        otherInstallationPaths: installations.filter((candidate) => candidate !== record).flatMap((candidate) => candidate.installation ? [candidate.installation.path] : []),
+    });
     const plan = await planSkillRemoval([record], options);
-    const scopeNote = `  removes the whole user-global installation, from hosts: ${record.hosts.join(", ")}`;
+    const scopeNote = plan.inspections[0]?.recordOnly
+        ? `  forgets the missing installation record, from hosts: ${record.hosts.join(", ")}; no files are removed`
+        : `  removes the whole user-global installation, from hosts: ${record.hosts.join(", ")}`;
     return { kind: "ready", plan: { ...plan, preview: [...plan.preview, scopeNote] }, installations };
 }
 /** Execute step: rechecks the plan, then removes files and records. */
 export async function runUninstall(prepared, operations, environment) {
-    const options = userGlobalRemovalOptions(homeOf(environment), environment.installationOptions);
+    const selected = new Set(prepared.plan.selections.map((selection) => JSON.stringify(selection)));
+    const options = userGlobalRemovalOptions(homeOf(environment), {
+        ...environment.installationOptions,
+        otherInstallationPaths: prepared.installations.filter((candidate) => !selected.has(JSON.stringify(candidate))).flatMap((candidate) => candidate.installation ? [candidate.installation.path] : []),
+    });
     await executeSkillRemoval(prepared.plan, operations, options, prepared.installations);
 }
 /** The user-global record of the Skill, when it is installed there. */
@@ -178,16 +187,26 @@ export async function runHostAddition(prepared, operations, environment) {
 /** Plan step for removing some hosts of a user-global Skill; removing all of them is a full removal. */
 export async function prepareHostRemoval(operations, environment, skill, installed, hosts) {
     const { record, installations } = await currentGlobalRecord(operations, skill, installed);
-    const options = userGlobalRemovalOptions(homeOf(environment), environment.installationOptions);
+    const options = userGlobalRemovalOptions(homeOf(environment), {
+        ...environment.installationOptions,
+        otherInstallationPaths: installations.filter((candidate) => JSON.stringify(candidate) !== JSON.stringify(record)).flatMap((candidate) => candidate.installation ? [candidate.installation.path] : []),
+    });
     const plan = await planHostRemoval(record, hosts, options).catch(asMessage);
     return { plan, installations, preview: plan.kind === "full" ? plan.plan.preview : plan.preview };
 }
 /** Execute step: rechecks, removes only the chosen hosts' locations, then reconciles the record. */
 export async function runHostRemoval(prepared, operations, environment, skill) {
-    const options = userGlobalRemovalOptions(homeOf(environment), environment.installationOptions);
+    const selection = prepared.plan.kind === "full" ? prepared.plan.plan.selections[0] : prepared.plan.selection;
+    const options = userGlobalRemovalOptions(homeOf(environment), {
+        ...environment.installationOptions,
+        otherInstallationPaths: prepared.installations.filter((candidate) => selection !== undefined && JSON.stringify(candidate) !== JSON.stringify(selection))
+            .flatMap((candidate) => candidate.installation ? [candidate.installation.path] : []),
+    });
     await executeHostRemoval(prepared.plan, operations, options, prepared.installations);
     const { plan } = prepared;
-    return plan.kind === "full"
-        ? `Removed ${skill.name} (${skill.path})`
-        : `Removed hosts ${plan.removed.join(", ")} from ${plan.selection.path}`;
+    return plan.kind === "full" && plan.plan.inspections.every((inspection) => inspection.recordOnly)
+        ? `Forgot missing installation record for ${plan.plan.selections[0]?.path ?? skill.path}; no files were removed`
+        : plan.kind === "full"
+            ? `Removed ${skill.name} (${skill.path})`
+            : `Removed hosts ${plan.removed.join(", ")} from ${plan.selection.path}`;
 }

package/dist/src/tui/manage-actions.js

@@ -139,7 +139,9 @@ function handleConfirmKey(context, mode, input, key) {
             answerYesNo(input, key, () => {
                 void execute(context, `Removing ${mode.skill.name}…`, async () => {
                     await runUninstall(mode.prepared, operations, env);
-                    return `Removed ${mode.skill.name} (${mode.skill.path})`;
+                    return mode.prepared.plan.inspections.every((inspection) => inspection.recordOnly)
+                        ? `Forgot missing installation record for ${mode.skill.path}; no files were removed`
+                        : `Removed ${mode.skill.name} (${mode.skill.path})`;
                 });
             }, cancelWith("Uninstall cancelled"));
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iseoane/agent-depot",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "A cross-platform catalog for reusable coding-agent skills.",
   "license": "MIT",
   "author": "iseoane",