@kwonye/mcpx 0.1.104 → 0.1.105

package/dist/{chunk-wq4zd3t7.js → chunk-01s7rhx3.js}

@@ -3,7 +3,7 @@ import {
   getConfigPath,
   readJsonFile,
   writeJsonAtomic
-} from "./chunk-cqenqnxk.js";
+} from "./chunk-4y0t0tfj.js";
 import {
   normalizeServerSpecEnabled
 } from "./chunk-bjw71y54.js";
@@ -508,6 +508,8 @@ var managedPluginSchema = z.object({
     sourceFingerprint: z.string()
   }).optional(),
   updateError: z.string().optional(),
+  pinned: z.boolean().default(false),
+  previous: z.object({ version: z.string(), resolvedSha: z.string(), root: z.string() }).optional(),
   projectOverrides: z.record(z.string(), z.object({
     enabled: z.boolean().optional(),
     components: z.record(pluginComponentSchema, z.boolean()).optional(),
@@ -735,4 +737,4 @@ function resolveActiveConfig(options = {}) {
 
 export { tokenizeCommandLine, parseCliAddCommand, ConfigLoadError, defaultConfig, loadConfig, saveConfig, loadProjectConfig, saveProjectConfig, loadMergedConfig, migrateProjectServers, resolveActiveConfig };
 
-//# debugId=83D38E071988634664756E2164756E21
+//# debugId=5F19AEF9E1E9E38564756E2164756E21

package/dist/{chunk-cqenqnxk.js → chunk-4y0t0tfj.js}

@@ -30,6 +30,12 @@ function getTelemetryPath() {
 function getSkillsDir() {
   return path.join(getConfigRoot(), "mcpx", "skills");
 }
+function getSkillPackagesRoot() {
+  return path.join(getDataRoot(), "mcpx", "skills", "packages");
+}
+function getSkillStatePath() {
+  return path.join(getDataRoot(), "mcpx", "skills", "state.json");
+}
 function getManagedIndexPath() {
   return path.join(getDataRoot(), "mcpx", "managed-index.json");
 }
@@ -132,6 +138,6 @@ function sha256(value) {
   return crypto2.createHash("sha256").update(value).digest("hex");
 }
 
-export { homeDir, getConfigPath, getTelemetryPath, getSkillsDir, getManagedIndexPath, getSecretsStorePath, getSecretsKeyPath, getPidPath, getLogPath, getGatewayTokenPath, getUpdatesDir, getStagedVersionPath, getUpdateLockPath, getOAuthLockPath, getPluginCacheRoot, getPluginDataRoot, getMarketplaceCacheRoot, getMarketplaceUpdateStatePath, getMarketplaceUpdateLockPath, ensureDir, ensureParentDir, findProjectConfigPath, readJsonFile, writeJsonAtomic, sha256 };
+export { homeDir, getConfigPath, getTelemetryPath, getSkillsDir, getSkillPackagesRoot, getSkillStatePath, getManagedIndexPath, getSecretsStorePath, getSecretsKeyPath, getPidPath, getLogPath, getGatewayTokenPath, getUpdatesDir, getStagedVersionPath, getUpdateLockPath, getOAuthLockPath, getPluginCacheRoot, getPluginDataRoot, getMarketplaceCacheRoot, getMarketplaceUpdateStatePath, getMarketplaceUpdateLockPath, ensureDir, ensureParentDir, findProjectConfigPath, readJsonFile, writeJsonAtomic, sha256 };
 
-//# debugId=96DE5993BD5A6D3864756E2164756E21
+//# debugId=BCB55F79AB94B71A64756E2164756E21

package/dist/{chunk-z1k63fa3.js → chunk-56whm3hm.js}

@@ -3,11 +3,11 @@ import {
   loadProjectConfig,
   saveConfig,
   saveProjectConfig
-} from "./chunk-wq4zd3t7.js";
+} from "./chunk-01s7rhx3.js";
 import {
   SecretsManager,
   ensureGatewayToken
-} from "./chunk-cz8cdmw1.js";
+} from "./chunk-fw8dyt89.js";
 import {
   ensureDir,
   findProjectConfigPath,
@@ -15,12 +15,14 @@ import {
   getManagedIndexPath,
   getPluginCacheRoot,
   getPluginDataRoot,
+  getSkillPackagesRoot,
+  getSkillStatePath,
   getSkillsDir,
   homeDir,
   readJsonFile,
   sha256,
   writeJsonAtomic
-} from "./chunk-cqenqnxk.js";
+} from "./chunk-4y0t0tfj.js";
 import {
   isServerEnabled
 } from "./chunk-bjw71y54.js";
@@ -35,6 +37,7 @@ import path21 from "node:path";
 // src/core/plugin-cache.ts
 import fs from "node:fs";
 import path from "node:path";
+import crypto from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 var TMP_PREFIX = "mcpx-acquire-";
@@ -83,7 +86,13 @@ class PluginCache {
       return computeTreeHash(resolved);
     }
     if (source.type === "npm") {
-      throw new Error("npm source SHA resolution not yet implemented");
+      const pkg = source.original.replace(/^npm:/, "");
+      const spec = source.ref ? `${pkg}@${source.ref}` : pkg;
+      const { stdout } = await execFileAsync("npm", ["view", spec, "version", "dist.integrity", "--json"], { timeout: 30000 });
+      const metadata = JSON.parse(stdout);
+      if (!metadata.version)
+        throw new Error(`Could not resolve npm package ${spec}`);
+      return `npm-${metadata.version}-${metadata.dist?.integrity ?? metadata["dist.integrity"] ?? "unverified"}`;
     }
     throw new Error(`Cannot resolve SHA for source type: ${source.type}`);
   }
@@ -161,7 +170,27 @@ class PluginCache {
       return { source: source.original, name: pluginName, sha, root: destDir };
     }
     if (source.type === "npm") {
-      throw new Error("npm source fetch not yet implemented");
+      const pkg = source.original.replace(/^npm:/, "");
+      const spec = source.ref ? `${pkg}@${source.ref}` : pkg;
+      const tmpDir = fs.mkdtempSync(path.join(this.cacheRoot, TMP_PREFIX));
+      try {
+        const { stdout } = await execFileAsync("npm", ["pack", spec, "--ignore-scripts", "--json", "--pack-destination", tmpDir], { timeout: 120000 });
+        const packed = JSON.parse(stdout);
+        const filename = packed[0]?.filename;
+        if (!filename)
+          throw new Error(`npm did not produce an archive for ${spec}`);
+        const archive = path.join(tmpDir, filename);
+        const actualSha = `npm-${packed[0]?.version ?? source.ref ?? "latest"}-${crypto.createHash("sha256").update(fs.readFileSync(archive)).digest("hex")}`;
+        const finalDest = this.shaDir(srcDir, actualSha);
+        if (!fs.existsSync(finalDest)) {
+          ensureDir(finalDest);
+          await execFileAsync("tar", ["-xzf", archive, "--strip-components=1", "-C", finalDest], { timeout: 30000 });
+        }
+        this.updateRef(srcDir, actualSha);
+        return { source: source.original, name: pluginName, sha: actualSha, root: finalDest };
+      } finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+      }
     }
     throw new Error(`Cannot fetch source type: ${source.type}`);
   }
@@ -224,7 +253,6 @@ class PluginCache {
 }
 function computeTreeHash(dir) {
   const entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
-  const crypto = __require("node:crypto");
   const hash = crypto.createHash("sha256");
   for (const entry of entries) {
     if (entry.name.startsWith(".git"))
@@ -1280,6 +1308,29 @@ function copyPluginDir(src, dest, exclude = [], errors) {
 }
 function copyFileOrDir(src, dest, errors) {
   try {
+    if (path6.basename(src).toLowerCase() === "skill.md") {
+      const sourceRoot = path6.dirname(src);
+      const targetRoot = path6.dirname(dest);
+      ensureDir(path6.dirname(targetRoot));
+      if (fs6.existsSync(targetRoot)) {
+        const stat = fs6.lstatSync(targetRoot);
+        if (stat.isSymbolicLink())
+          fs6.rmSync(targetRoot, { force: true });
+        else if (stat.isDirectory() && fs6.readdirSync(targetRoot).length === 0)
+          fs6.rmSync(targetRoot, { recursive: true, force: true });
+      }
+      if (!fs6.existsSync(targetRoot)) {
+        const relativeTarget = path6.relative(path6.dirname(targetRoot), path6.resolve(sourceRoot));
+        try {
+          fs6.symlinkSync(relativeTarget, targetRoot, process.platform === "win32" ? "junction" : "dir");
+        } catch {
+          fs6.cpSync(sourceRoot, targetRoot, { recursive: true, dereference: true });
+        }
+      } else {
+        fs6.cpSync(sourceRoot, targetRoot, { recursive: true, dereference: true });
+      }
+      return;
+    }
     ensureDir(path6.dirname(dest));
     if (fs6.statSync(src).isDirectory()) {
       copyPluginDir(src, dest, [], errors);
@@ -1334,8 +1385,9 @@ function loadOwnership2(targetDir) {
   }
   try {
     const parsed = ownershipSchema.safeParse(JSON.parse(fs7.readFileSync(manifestPath2, "utf8")));
-    if (parsed.success)
-      return parsed.data;
+    if (parsed.success) {
+      return { ...parsed.data, paths: parsed.data.paths.map((ownedPath) => ownedPath.endsWith("/SKILL.md") ? path7.dirname(ownedPath) : ownedPath) };
+    }
   } catch {
     console.error(`[mcpx] Warning: corrupt ownership manifest at ${manifestPath2}, resetting`);
     return { version: 1, paths: [] };
@@ -1348,7 +1400,7 @@ function saveOwnership2(targetDir, manifest) {
 }
 function projectSkillsToDir(targetDir, skills, layout) {
   const owned = loadOwnership2(targetDir);
-  const newPaths = new Set(skills.map((s) => layout === "dir" ? `${s.id}/SKILL.md` : `${s.id}.md`));
+  const newPaths = new Set(skills.map((s) => layout === "dir" ? s.id : `${s.id}.md`));
   for (const ownedPath of owned.paths) {
     if (!newPaths.has(ownedPath)) {
       const fullPath = path7.join(targetDir, ownedPath);
@@ -1374,10 +1426,46 @@ function projectSkillsToDir(targetDir, skills, layout) {
   }
   for (const skill of skills) {
     validateSkillId(skill.id);
-    const filePath = layout === "dir" ? path7.join(targetDir, skill.id, "SKILL.md") : path7.join(targetDir, `${skill.id}.md`);
-    assertWithinBase2(targetDir, filePath);
-    ensureDir(path7.dirname(filePath));
-    fs7.writeFileSync(filePath, skill.content, "utf-8");
+    const ownedTarget = layout === "dir" ? skill.id : `${skill.id}.md`;
+    if ((fs7.existsSync(path7.join(targetDir, ownedTarget)) || (() => {
+      try {
+        fs7.lstatSync(path7.join(targetDir, ownedTarget));
+        return true;
+      } catch {
+        return false;
+      }
+    })()) && !owned.paths.includes(ownedTarget)) {
+      console.error(`[mcpx] Warning: preserving unowned skill projection: ${path7.join(targetDir, ownedTarget)}`);
+      continue;
+    }
+    if (layout === "dir" && skill.root && fs7.existsSync(skill.root)) {
+      const targetPath = path7.join(targetDir, skill.id);
+      assertWithinBase2(targetDir, targetPath);
+      if (path7.resolve(targetPath) !== path7.resolve(skill.root)) {
+        if (fs7.existsSync(targetPath) || (() => {
+          try {
+            fs7.lstatSync(targetPath);
+            return true;
+          } catch {
+            return false;
+          }
+        })()) {
+          fs7.rmSync(targetPath, { recursive: true, force: true });
+        }
+        ensureDir(path7.dirname(targetPath));
+        const relativeTarget = path7.relative(path7.dirname(targetPath), path7.resolve(skill.root));
+        try {
+          fs7.symlinkSync(relativeTarget, targetPath, process.platform === "win32" ? "junction" : "dir");
+        } catch {
+          fs7.cpSync(skill.root, targetPath, { recursive: true, dereference: true });
+        }
+      }
+    } else {
+      const filePath = layout === "dir" ? path7.join(targetDir, skill.id, "SKILL.md") : path7.join(targetDir, `${skill.id}.md`);
+      assertWithinBase2(targetDir, filePath);
+      ensureDir(path7.dirname(filePath));
+      fs7.writeFileSync(filePath, skill.content, "utf-8");
+    }
   }
   saveOwnership2(targetDir, { version: 1, paths: Array.from(newPaths) });
 }
@@ -2969,50 +3057,222 @@ function saveManagedIndex(index, filePath = getManagedIndexPath()) {
 // src/core/skills.ts
 import fs13 from "node:fs";
 import path19 from "node:path";
+import { z as z15 } from "zod";
+var skillStateSchema = z15.record(z15.string(), z15.object({ source: z15.string(), skillName: z15.string().optional(), pinned: z15.boolean().default(false), previousPath: z15.string().optional() }));
+function readSkillState() {
+  const statePath = getSkillStatePath();
+  if (!fs13.existsSync(statePath))
+    return {};
+  try {
+    return skillStateSchema.parse(JSON.parse(fs13.readFileSync(statePath, "utf8")));
+  } catch {
+    return {};
+  }
+}
+function writeSkillState(state) {
+  ensureDir(path19.dirname(getSkillStatePath()));
+  fs13.writeFileSync(getSkillStatePath(), JSON.stringify(state, null, 2) + `
+`, "utf8");
+}
+function validateSkillPackage(root) {
+  const skillPath = path19.join(root, "SKILL.md");
+  if (!fs13.existsSync(skillPath))
+    throw new Error(`Agent Skill is missing SKILL.md: ${root}`);
+  const content = fs13.readFileSync(skillPath, "utf8");
+  const match = content.match(/^---\s*[\s\S]*?^name:\s*([^\r\n]+)[\s\S]*?^description:\s*([^\r\n]+)[\s\S]*?^---/m);
+  if (!match || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(match[1].trim()) || !match[2].trim()) {
+    throw new Error(`Invalid Agent Skill frontmatter in ${skillPath}; name and description are required`);
+  }
+}
+function installedSkills() {
+  const root = getSkillPackagesRoot();
+  if (!fs13.existsSync(root))
+    return [];
+  return fs13.readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
+    if (!entry.isDirectory())
+      return [];
+    const packageRoot = path19.join(root, entry.name);
+    const skillFile = path19.join(packageRoot, "SKILL.md");
+    if (!fs13.existsSync(skillFile))
+      return [];
+    return [{ id: entry.name, content: fs13.readFileSync(skillFile, "utf8"), root: packageRoot, source: "installed", readOnly: true }];
+  });
+}
 function listSkills() {
   const skillsDir = getSkillsDir();
-  if (!fs13.existsSync(skillsDir)) {
-    return [];
-  }
-  const files = fs13.readdirSync(skillsDir);
   const skills = [];
+  const files = fs13.existsSync(skillsDir) ? fs13.readdirSync(skillsDir, { withFileTypes: true }) : [];
+  const authoredDirectories = new Set(files.filter((file) => file.isDirectory()).map((file) => file.name));
   for (const file of files) {
-    if (file.endsWith(".md")) {
-      const id = path19.basename(file, ".md");
+    const id = file.isDirectory() ? file.name : file.name.endsWith(".md") ? path19.basename(file.name, ".md") : null;
+    if (id && (file.isDirectory() || !authoredDirectories.has(id))) {
       try {
-        const content = fs13.readFileSync(path19.join(skillsDir, file), "utf-8");
-        skills.push({ id, content });
+        const root = file.isDirectory() ? path19.join(skillsDir, id) : skillsDir;
+        const filePath = file.isDirectory() ? path19.join(root, "SKILL.md") : path19.join(skillsDir, file.name);
+        if (!fs13.existsSync(filePath))
+          continue;
+        const content = fs13.readFileSync(filePath, "utf-8");
+        skills.push({ id, content, root: file.isDirectory() ? root : undefined, source: "authored" });
       } catch {
-        console.error(`[mcpx] Warning: could not read skill ${file}`);
+        console.error(`[mcpx] Warning: could not read skill ${file.name}`);
       }
     }
   }
-  return skills;
+  const authoredIds = new Set(skills.map((skill) => skill.id));
+  return [...skills, ...installedSkills().filter((skill) => !authoredIds.has(skill.id))];
 }
 function getSkill(id) {
   validateSkillId(id);
   const skillsDir = getSkillsDir();
-  const filePath = path19.join(skillsDir, `${id}.md`);
+  const directory = path19.join(skillsDir, id);
+  const packagePath = path19.join(directory, "SKILL.md");
+  const legacyPath = path19.join(skillsDir, `${id}.md`);
+  const filePath = fs13.existsSync(packagePath) ? packagePath : legacyPath;
   if (!fs13.existsSync(filePath)) {
-    return null;
+    const installedPath = path19.join(getSkillPackagesRoot(), id, "SKILL.md");
+    if (!fs13.existsSync(installedPath))
+      return null;
+    const installedRoot = path19.dirname(installedPath);
+    return { id, content: fs13.readFileSync(installedPath, "utf8"), root: installedRoot, source: "installed", readOnly: true };
   }
   const content = fs13.readFileSync(filePath, "utf-8");
-  return { id, content };
+  return { id, content, root: fs13.existsSync(packagePath) ? directory : undefined, source: "authored" };
 }
 function saveSkill(id, content) {
   validateSkillId(id);
   const skillsDir = getSkillsDir();
   ensureDir(skillsDir);
-  const filePath = path19.join(skillsDir, `${id}.md`);
+  const directory = path19.join(skillsDir, id);
+  const filePath = path19.join(directory, "SKILL.md");
+  ensureDir(directory);
   fs13.writeFileSync(filePath, content, "utf-8");
+  const legacyPath = path19.join(skillsDir, `${id}.md`);
+  if (fs13.existsSync(legacyPath)) {
+    if (fs13.readFileSync(filePath, "utf-8") === fs13.readFileSync(legacyPath, "utf-8"))
+      fs13.unlinkSync(legacyPath);
+    else
+      console.error(`[mcpx] Warning: preserving conflicting legacy skill file: ${legacyPath}`);
+  }
 }
 function deleteSkill(id) {
   validateSkillId(id);
   const skillsDir = getSkillsDir();
-  const filePath = path19.join(skillsDir, `${id}.md`);
-  if (fs13.existsSync(filePath)) {
-    fs13.unlinkSync(filePath);
-  }
+  const directory = path19.join(skillsDir, id);
+  const filePath = path19.join(directory, "SKILL.md");
+  const legacyPath = path19.join(skillsDir, `${id}.md`);
+  const hadAuthored = fs13.existsSync(directory) || fs13.existsSync(legacyPath);
+  if (fs13.existsSync(directory))
+    fs13.rmSync(directory, { recursive: true, force: true });
+  if (fs13.existsSync(legacyPath))
+    fs13.unlinkSync(legacyPath);
+  if (!hadAuthored) {
+    const installedPath = path19.join(getSkillPackagesRoot(), id);
+    if (fs13.existsSync(installedPath))
+      fs13.rmSync(installedPath, { recursive: true, force: true });
+    const state = readSkillState();
+    delete state[id];
+    writeSkillState(state);
+  }
+}
+function customizeSkill(id, targetId = id) {
+  validateSkillId(id);
+  validateSkillId(targetId);
+  const existing = getSkill(id);
+  if (!existing)
+    throw new Error(`Skill "${id}" not found`);
+  saveSkill(targetId, existing.content);
+  return getSkill(targetId);
+}
+async function installSkillFromSource(source, skillName) {
+  const parsed = parseSource(source);
+  const cache = new PluginCache;
+  const cached = await cache.fetch(parsed, skillName ?? "skill");
+  const candidates = [];
+  const declaredName = (root) => {
+    try {
+      const content = fs13.readFileSync(path19.join(root, "SKILL.md"), "utf8");
+      const frontmatter = content.match(/^---\s*[\s\S]*?^name:\s*([^\r\n]+)[\s\S]*?^---/m)?.[1]?.trim();
+      return frontmatter && /^[a-z0-9][a-z0-9-]*$/.test(frontmatter) ? frontmatter : undefined;
+    } catch {
+      return;
+    }
+  };
+  const addCandidate = (root, id = path19.basename(root)) => {
+    if (fs13.existsSync(path19.join(root, "SKILL.md"))) {
+      validateSkillPackage(root);
+      candidates.push({ id: declaredName(root) ?? id, root });
+    }
+  };
+  addCandidate(cached.root);
+  const skillsRoot = path19.join(cached.root, "skills");
+  if (fs13.existsSync(skillsRoot)) {
+    for (const entry of fs13.readdirSync(skillsRoot, { withFileTypes: true })) {
+      if (entry.isDirectory())
+        addCandidate(path19.join(skillsRoot, entry.name), entry.name);
+    }
+  }
+  if (candidates.length === 0)
+    throw new Error(`No Agent Skill package found in ${source}`);
+  const selected = skillName ? candidates.find((candidate) => candidate.id === skillName) : candidates[0];
+  if (!selected)
+    throw new Error(`Skill "${skillName}" was not found in ${source}`);
+  validateSkillId(selected.id);
+  const destination = path19.join(getSkillPackagesRoot(), selected.id);
+  ensureDir(path19.dirname(destination));
+  const state = readSkillState();
+  const stateSource = parsed.type === "local" ? path19.resolve(source) : source;
+  if (fs13.existsSync(destination)) {
+    if (state[selected.id]?.pinned)
+      throw new Error(`Skill "${selected.id}" is pinned; unpin it before updating`);
+    const previousPath = `${destination}.previous`;
+    if (fs13.existsSync(previousPath))
+      fs13.rmSync(previousPath, { recursive: true, force: true });
+    fs13.renameSync(destination, previousPath);
+    state[selected.id] = { ...state[selected.id], source: stateSource, skillName: selected.id, pinned: false, previousPath };
+  } else {
+    state[selected.id] = { source: stateSource, skillName: selected.id, pinned: false };
+  }
+  fs13.cpSync(selected.root, destination, { recursive: true, dereference: true });
+  writeSkillState(state);
+  return { id: selected.id, content: fs13.readFileSync(path19.join(destination, "SKILL.md"), "utf8"), root: destination, source: "installed", readOnly: true };
+}
+function pinSkill(id) {
+  const state = readSkillState();
+  if (!state[id])
+    throw new Error(`Skill "${id}" is not installed`);
+  state[id].pinned = true;
+  writeSkillState(state);
+}
+function unpinSkill(id) {
+  const state = readSkillState();
+  if (!state[id])
+    throw new Error(`Skill "${id}" is not installed`);
+  state[id].pinned = false;
+  writeSkillState(state);
+}
+async function updateSkill(id) {
+  const state = readSkillState();
+  const entry = state[id];
+  if (!entry)
+    throw new Error(`Skill "${id}" is not installed`);
+  if (entry.pinned)
+    throw new Error(`Skill "${id}" is pinned; unpin it before updating`);
+  return installSkillFromSource(entry.source, entry.skillName ?? id);
+}
+function rollbackSkill(id) {
+  const state = readSkillState();
+  const entry = state[id];
+  if (!entry?.previousPath || !fs13.existsSync(entry.previousPath))
+    throw new Error(`Skill "${id}" has no previous revision`);
+  const destination = path19.join(getSkillPackagesRoot(), id);
+  const failedPath = `${destination}.failed`;
+  if (fs13.existsSync(failedPath))
+    fs13.rmSync(failedPath, { recursive: true, force: true });
+  fs13.renameSync(destination, failedPath);
+  fs13.renameSync(entry.previousPath, destination);
+  entry.previousPath = failedPath;
+  writeSkillState(state);
+  return { id, content: fs13.readFileSync(path19.join(destination, "SKILL.md"), "utf8"), root: destination, source: "installed", readOnly: true };
 }
 
 // src/core/managed-index-lock.ts
@@ -3444,6 +3704,8 @@ class PluginManager {
     const current = loadConfig(this.configPath).plugins?.[pluginId];
     if (!current)
       throw new Error(`Plugin ${pluginId} not found`);
+    if (current.pinned)
+      throw new Error(`Plugin ${pluginId} is pinned; unpin it before updating`);
     const info = await this.inspectSource(current.source);
     return this.applyPluginUpdate(pluginId, info, undefined, true);
   }
@@ -3466,6 +3728,7 @@ class PluginManager {
       for (const oldName of current.serverNames) {
         delete config.servers[oldName];
       }
+      current.previous = { version: current.version, resolvedSha: current.resolvedSha, root: current.root };
       current.version = info.manifest?.version || current.version;
       current.resolvedSha = info.sha;
       current.root = info.root;
@@ -3614,12 +3877,44 @@ async function updatePlugin(nameOrId) {
   const manager = new PluginManager;
   const config = loadConfig(manager["configPath"]);
   const id = resolvePluginId(config, nameOrId);
+  if (config.plugins?.[id]?.pinned)
+    throw new Error(`Plugin ${nameOrId} is pinned; unpin it before updating`);
   if (config.plugins?.[id]?.marketplace) {
-    const { updateMarketplaceInstalledPlugin } = await import("./chunk-02r7k4ax.js");
+    const { updateMarketplaceInstalledPlugin } = await import("./chunk-d2v9rxy0.js");
     return updateMarketplaceInstalledPlugin(id);
   }
   return manager.updatePlugin(id);
 }
+async function pinPlugin(nameOrId) {
+  await mutateConfig((config) => {
+    const id = resolvePluginId(config, nameOrId);
+    const plugin = config.plugins?.[id];
+    if (!plugin)
+      throw new Error(`Plugin ${nameOrId} not found`);
+    plugin.pinned = true;
+  });
+}
+async function unpinPlugin(nameOrId) {
+  await mutateConfig((config) => {
+    const id = resolvePluginId(config, nameOrId);
+    const plugin = config.plugins?.[id];
+    if (!plugin)
+      throw new Error(`Plugin ${nameOrId} not found`);
+    plugin.pinned = false;
+  });
+}
+async function rollbackPlugin(nameOrId) {
+  const manager = new PluginManager;
+  const config = loadConfig(manager["configPath"]);
+  const id = resolvePluginId(config, nameOrId);
+  const current = config.plugins?.[id];
+  if (!current?.previous)
+    throw new Error(`Plugin ${nameOrId} has no previous revision`);
+  const source = parseSource(current.source);
+  source.resolvedSha = current.previous.resolvedSha;
+  const info = await manager.inspectResolvedSource(source, current.source);
+  return manager["applyPluginUpdate"](id, info, undefined, true);
+}
 async function uninstallPlugin(nameOrId, keepData) {
   const manager = new PluginManager;
   const config = loadConfig(manager["configPath"]);
@@ -3755,6 +4050,6 @@ async function preparePlugin(name) {
   await manager.preparePlugin(name);
 }
 
-export { mutateConfig, mutateProjectConfig, mutateActiveConfig, listSkills, getSkill, saveSkill, deleteSkill, prunePluginProjections, pruneAllPluginProjections, syncPluginsToClient, APP_VERSION, getAdapters, loadManagedIndex, getGatewayUrl, getGatewayInternalUrl, syncAllClients, persistSyncState, PluginCache, readManifest, discoverComponents, hasManifest, resolvePluginVars, PluginDataManager, PluginLifecycle, parseSource, PluginManager, inspectPlugin, installPlugin, updatePlugin, uninstallPlugin, enablePlugin, disablePlugin, setPluginProjectOverride, resetPluginProjectOverride, approvePluginComponent, getPluginStatus, listPlugins, resolvePluginId, pluginConfigSet, pluginSync, preparePlugin };
+export { mutateConfig, mutateProjectConfig, mutateActiveConfig, validateSkillId, parseSource, PluginCache, validateSkillPackage, listSkills, getSkill, saveSkill, deleteSkill, customizeSkill, installSkillFromSource, pinSkill, unpinSkill, updateSkill, rollbackSkill, prunePluginProjections, pruneAllPluginProjections, syncPluginsToClient, APP_VERSION, getAdapters, loadManagedIndex, getGatewayUrl, getGatewayInternalUrl, syncAllClients, persistSyncState, readManifest, discoverComponents, hasManifest, resolvePluginVars, PluginDataManager, PluginLifecycle, PluginManager, inspectPlugin, installPlugin, updatePlugin, pinPlugin, unpinPlugin, rollbackPlugin, uninstallPlugin, enablePlugin, disablePlugin, setPluginProjectOverride, resetPluginProjectOverride, approvePluginComponent, getPluginStatus, listPlugins, resolvePluginId, pluginConfigSet, pluginSync, preparePlugin };
 
-//# debugId=3872A3A17F73C93764756E2164756E21
+//# debugId=250A96A4D45E61A664756E2164756E21

package/dist/{chunk-31brdz5s.js → chunk-6mxr34tc.js}

@@ -8,8 +8,8 @@ import {
   resolveActiveConfig,
   saveConfig,
   saveProjectConfig
-} from "./chunk-wq4zd3t7.js";
-import"./chunk-cqenqnxk.js";
+} from "./chunk-01s7rhx3.js";
+import"./chunk-4y0t0tfj.js";
 import"./chunk-bjw71y54.js";
 import"./chunk-wj4tjacg.js";
 export {

package/dist/{chunk-b58zsdp4.js → chunk-am903qjk.js}

@@ -7,18 +7,21 @@ import {
   inspectPlugin,
   installPlugin,
   listPlugins,
+  pinPlugin,
   pluginConfigSet,
   pluginSync,
   preparePlugin,
   resetPluginProjectOverride,
   resolvePluginId,
+  rollbackPlugin,
   setPluginProjectOverride,
   uninstallPlugin,
+  unpinPlugin,
   updatePlugin
-} from "./chunk-z1k63fa3.js";
-import"./chunk-wq4zd3t7.js";
-import"./chunk-cz8cdmw1.js";
-import"./chunk-cqenqnxk.js";
+} from "./chunk-56whm3hm.js";
+import"./chunk-01s7rhx3.js";
+import"./chunk-fw8dyt89.js";
+import"./chunk-4y0t0tfj.js";
 import"./chunk-bjw71y54.js";
 import"./chunk-wj4tjacg.js";
 export {
@@ -30,14 +33,17 @@ export {
   inspectPlugin,
   installPlugin,
   listPlugins,
+  pinPlugin,
   pluginConfigSet,
   pluginSync,
   preparePlugin,
   resetPluginProjectOverride,
   resolvePluginId,
+  rollbackPlugin,
   setPluginProjectOverride,
   uninstallPlugin,
+  unpinPlugin,
   updatePlugin
 };
 
-//# debugId=11040DF9544111AB64756E2164756E21
+//# debugId=F3AE0823719415BE64756E2164756E21

package/dist/{chunk-s9v1epnk.js → chunk-btbww96n.js}

@@ -6,14 +6,14 @@ import {
   mutateConfig,
   readManifest,
   uninstallPlugin
-} from "./chunk-z1k63fa3.js";
+} from "./chunk-56whm3hm.js";
 import {
   loadConfig
-} from "./chunk-wq4zd3t7.js";
+} from "./chunk-01s7rhx3.js";
 import {
   ensureDir,
   getMarketplaceCacheRoot
-} from "./chunk-cqenqnxk.js";
+} from "./chunk-4y0t0tfj.js";
 import {
   __require
 } from "./chunk-wj4tjacg.js";
@@ -537,6 +537,8 @@ async function updateMarketplaceInstalledPlugin(pluginId, sync = true) {
   const plugin = loadConfig().plugins?.[pluginId];
   if (!plugin?.marketplace)
     throw new Error(`Plugin ${pluginId} is not marketplace-managed`);
+  if (plugin.pinned)
+    throw new Error(`Plugin ${pluginId} is pinned; unpin it before updating`);
   const qualified = `${plugin.marketplace.pluginName}@${plugin.marketplace.name}`;
   try {
     const detail = await inspectMarketplacePlugin(qualified);
@@ -578,7 +580,7 @@ async function refreshMarketplaceWithPlugins(name) {
     }
   }
   if (updated.length > 0) {
-    const { pluginSync } = await import("./chunk-b58zsdp4.js");
+    const { pluginSync } = await import("./chunk-am903qjk.js");
     await pluginSync();
   }
   return { marketplace, updated, errors };
@@ -600,4 +602,4 @@ async function refreshAutoUpdateMarketplaces() {
 
 export { resolveMarketplacePluginSource, listMarketplaces, addMarketplace, refreshMarketplace, setMarketplaceAutoUpdate, removeMarketplace, listMarketplacePlugins, inspectMarketplacePlugin, installMarketplacePlugin, updateMarketplaceInstalledPlugin, refreshMarketplaceWithPlugins, refreshAutoUpdateMarketplaces };
 
-//# debugId=95199795C0DBE5F464756E2164756E21
+//# debugId=347C06BDB5A3194064756E2164756E21

package/dist/{chunk-02r7k4ax.js → chunk-d2v9rxy0.js}

@@ -11,11 +11,11 @@ import {
   resolveMarketplacePluginSource,
   setMarketplaceAutoUpdate,
   updateMarketplaceInstalledPlugin
-} from "./chunk-s9v1epnk.js";
-import"./chunk-z1k63fa3.js";
-import"./chunk-wq4zd3t7.js";
-import"./chunk-cz8cdmw1.js";
-import"./chunk-cqenqnxk.js";
+} from "./chunk-btbww96n.js";
+import"./chunk-56whm3hm.js";
+import"./chunk-01s7rhx3.js";
+import"./chunk-fw8dyt89.js";
+import"./chunk-4y0t0tfj.js";
 import"./chunk-bjw71y54.js";
 import"./chunk-wj4tjacg.js";
 export {

package/dist/{chunk-cz8cdmw1.js → chunk-fw8dyt89.js}

@@ -5,7 +5,7 @@ import {
   getSecretsStorePath,
   readJsonFile,
   writeJsonAtomic
-} from "./chunk-cqenqnxk.js";
+} from "./chunk-4y0t0tfj.js";
 import {
   isServerEnabled,
   normalizeServerSpecEnabled