@lpm-registry/cli 0.2.5 → 0.3.0

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.3.0] - 2026-03-22
+
+### Added
+
+- **Upstream npm proxy mode (default)** — `lpm npmrc` and `lpm setup` now configure LPM as the default registry. All packages (LPM + npm) are fetched through LPM for faster, edge-cached installs via Cloudflare R2.
+- **`--scoped` flag** — Use `lpm npmrc --scoped` or `lpm setup --scoped` to only route `@lpm.dev` packages through LPM (old behavior).
+- **Custom registry detection** — If `.npmrc` already has a custom default registry (e.g., Artifactory), the CLI warns and automatically falls back to `--scoped` mode to avoid overriding it.
+- **Pre-publish skills staleness warning** — When Agent Skills haven't changed since the previous version, the warning now appears before the publish confirmation prompt (instead of after), so you can cancel and update skills before publishing.
+
+### Changed
+
+- `lpm npmrc` default output changed from `@lpm.dev:registry=...` (scoped) to `registry=...` (proxy mode)
+- `lpm setup` and `lpm setup --oidc` default output changed to proxy mode
+- Updated CLI output messaging to indicate proxy vs scoped mode
+- Updated README with new default behavior and `--scoped` flag
+
+## [0.2.6] - 2026-03-21
+
+### Added
+
+- **`lpm uninstall` command** — Mirrors `npm uninstall` with automatic registry auth. Aliases: `lpm un`, `lpm unlink`.
+- **`--pm` flag for install/uninstall** — Choose package manager: `lpm install --pm pnpm`. Supports npm (default), pnpm, yarn, bun.
+- **`lpm config set packageManager`** — Set default package manager globally. Also available via `LPM_PACKAGE_MANAGER` env var.
+
+### Changed
+
+- `lpm install` now shows package list before install: "Found 15 LPM packages in package.json"
+- Skills install now scoped to explicit packages when specified (`lpm install @lpm.dev/pkg` only fetches skills for that package)
+- Skills install skips `file:`, `link:`, `workspace:` dependencies (local packages)
+- `lpm doctor` registry check fixed — uses `/-/whoami` endpoint instead of non-existent `/health`
+- Publish script updated with version bumping, git commit/tag/push, and `--dry-run` support
+
+### Fixed
+
+- pnpm/yarn/bun compatibility — no longer passes npm-specific `--userconfig` flag. Uses project `.npmrc` with backup/restore for non-npm package managers.
+
 ## [0.2.5] - 2026-03-19
 
 ### Added

package/README.md

@@ -65,23 +65,32 @@ lpm whoami
 
 ### Project Setup
 
-#### Setup .npmrc
+#### Generate .npmrc Token (Local Dev)
 
-Configure your project's `.npmrc` for LPM packages. Required for CI/CD deployments.
+Generate a 30-day read-only token for your project. Makes `npm install` work with LPM packages.
+
+By default, LPM is configured as your default registry — all packages (LPM + npm) are fetched through LPM for faster, edge-cached installs.
 
 ```bash
-lpm setup
+lpm npmrc                  # 30-day token, proxy mode (default)
+lpm npmrc --days 7         # 7-day token
+lpm npmrc --days 90        # 90-day token
+lpm npmrc --scoped         # Only route @lpm.dev packages through LPM
 ```
 
-This creates a `.npmrc` file with the LPM registry configuration:
+Automatically adds `.npmrc` to `.gitignore` to prevent token leaks.
+
+#### Setup .npmrc (CI/CD)
+
+Configure `.npmrc` for CI/CD environments.
 
-```ini
-# LPM Registry
-@lpm.dev:registry=https://lpm.dev/api/registry
-//lpm.dev/api/registry/:_authToken=${LPM_TOKEN}
+```bash
+lpm setup                  # Writes ${LPM_TOKEN} placeholder (proxy mode)
+lpm setup --oidc           # OIDC — no secrets needed (GitHub Actions, GitLab CI)
+lpm setup --scoped         # Only route @lpm.dev packages through LPM
 ```
 
-For deployment, set the `LPM_TOKEN` environment variable on your platform (Vercel, Netlify, etc.).
+For deployment platforms (Vercel, Netlify), set the `LPM_TOKEN` environment variable.
 
 ### Package Management
 
@@ -120,6 +129,7 @@ lpm install @lpm.dev/owner.package-name
 lpm install @lpm.dev/tolgaergin.utils @lpm.dev/acme.helpers
 lpm install                 # Install all @lpm.dev packages from package.json
 lpm install --no-skills     # Skip fetching Agent Skills
+lpm install --pm pnpm       # Use pnpm instead of npm
 lpm i                       # Shortcut
 ```
 
@@ -128,6 +138,19 @@ Agent Skills are fetched by default for packages that include them.
 | Option        | Description                              |
 | ------------- | ---------------------------------------- |
 | `--no-skills` | Skip fetching Agent Skills after install |
+| `--pm <name>` | Package manager: npm (default), pnpm, yarn, bun |
+
+Set a default package manager: `lpm config set packageManager pnpm`
+
+#### Uninstall
+
+Uninstall packages with automatic registry authentication.
+
+```bash
+lpm uninstall @lpm.dev/owner.package-name
+lpm uninstall --pm pnpm     # Use pnpm
+lpm un                      # Shortcut
+```
 
 #### Add (Source Code)
 

package/bin/lpm.js

@@ -36,6 +36,7 @@ import {
 	skillsValidate,
 } from "../lib/commands/skills.js"
 import { rotateToken } from "../lib/commands/token-rotate.js"
+import { uninstall } from "../lib/commands/uninstall.js"
 import { whoami } from "../lib/commands/whoami.js"
 
 // Load package.json
@@ -93,8 +94,16 @@ program
 	.description("Install packages with automatic registry authentication")
 	.option("--json", "Machine-readable JSON output")
 	.option("--no-skills", "Skip fetching Agent Skills after install")
+	.option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)")
 	.action(install)
 
+program
+	.command("uninstall <packages...>")
+	.aliases(["un", "unlink"])
+	.description("Uninstall packages via package manager")
+	.option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)")
+	.action(uninstall)
+
 program
 	.command("publish")
 	.alias("p")
@@ -201,18 +210,26 @@ program
 
 program
 	.command("setup")
-	.description("Configure .npmrc for LPM packages (@lpm.dev scope)")
+	.description("Configure .npmrc for LPM registry")
 	.option("-r, --registry <url>", "Custom registry URL")
 	.option(
 		"--oidc",
 		"Exchange CI OIDC token for install access (no secrets needed)",
 	)
+	.option(
+		"--scoped",
+		"Only route @lpm.dev packages through LPM (don't proxy npm)",
+	)
 	.action(setup)
 
 program
 	.command("npmrc")
 	.description("Generate a read-only .npmrc token for local development")
 	.option("-d, --days <number>", "Token expiry in days (default: 30)")
+	.option(
+		"--scoped",
+		"Only route @lpm.dev packages through LPM (don't proxy npm)",
+	)
 	.action(npmrc)
 
 program

package/lib/commands/doctor.js

@@ -24,16 +24,14 @@ export async function doctor() {
 	// 2. Check Registry Reachability
 	const spinnerApi = createSpinner("Checking registry connection...").start()
 	try {
-		// Assuming we have a health endpoint or similar. Using the registry URL from config or default.
 		const registryUrl = getRegistryUrl()
-		const res = await fetch(`${registryUrl}/api/registry/health`)
-		if (res.ok) {
-			spinnerApi.succeed(`Registry reachable at ${registryUrl}`)
-			checks.push({ name: "Registry API", status: "ok" })
-		} else {
-			spinnerApi.fail(`Registry returned status ${res.status}`)
-			checks.push({ name: "Registry API", status: "fail" })
-		}
+		// Use /-/whoami without a token — a 401 "Missing token" proves the registry is reachable.
+		// Only network errors (ECONNREFUSED, timeout) indicate the registry is down.
+		await fetch(`${registryUrl}/api/registry/-/whoami`, {
+			signal: AbortSignal.timeout(10000),
+		})
+		spinnerApi.succeed(`Registry reachable at ${registryUrl}`)
+		checks.push({ name: "Registry API", status: "ok" })
 	} catch (err) {
 		spinnerApi.fail(`Could not connect to registry: ${err.message}`)
 		checks.push({ name: "Registry API", status: "fail" })

package/lib/commands/install.js

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process"
 import fs from "node:fs"
 import path from "node:path"
-import { getRegistryUrl, getToken } from "../config.js"
+import { getPackageManager, getRegistryUrl, getToken } from "../config.js"
 import { createSpinner, log, printHeader } from "../ui.js"
 import { skillsInstall } from "./skills.js"
 
@@ -44,6 +44,9 @@ export async function install(packages, options) {
 		process.exit(1)
 	}
 
+	// Track if user specified packages explicitly (for scoped skills fetch)
+	const explicitPackages = packages && packages.length > 0
+
 	if (!packages || packages.length === 0) {
 		// No packages specified - read from package.json
 		const packageJsonPath = path.resolve(process.cwd(), "package.json")
@@ -99,17 +102,16 @@ export async function install(packages, options) {
 		}
 
 		if (!isJson) {
-			log.info(
-				`Installing ${packages.length} LPM packages from package.json...`,
-			)
+			log.info(`Found ${packages.length} LPM packages in package.json:`)
+			for (const pkg of packages) {
+				log.info(`  ${pkg}`)
+			}
 		}
 	}
 
 	let spinner
 	if (!isJson) {
-		spinner = createSpinner(
-			`Preparing to install ${packages.join(", ")}...`,
-		).start()
+		spinner = createSpinner("Configuring registry authentication...").start()
 	}
 
 	const baseRegistryUrl = getRegistryUrl()
@@ -126,26 +128,54 @@ export async function install(packages, options) {
 @lpm.dev:registry=${registryUrl}
 `
 
-	// Write to temp file
-	const tempNpmrcPath = path.resolve(process.cwd(), `.npmrc.lpm-${Date.now()}`)
-	fs.writeFileSync(tempNpmrcPath, npmrcContent)
+	const pm = getPackageManager(options?.pm)
+
+	// For npm we can use --userconfig with a temp file.
+	// For pnpm/yarn/bun we write a temporary project .npmrc (all PMs read it).
+	const projectNpmrcPath = path.resolve(process.cwd(), ".npmrc")
+	let existingNpmrc = null
+	let tempNpmrcPath = null
+
+	if (pm === "npm") {
+		// npm supports --userconfig — use a separate temp file (doesn't touch project .npmrc)
+		tempNpmrcPath = path.resolve(process.cwd(), `.npmrc.lpm-${Date.now()}`)
+		fs.writeFileSync(tempNpmrcPath, npmrcContent)
+	} else {
+		// pnpm/yarn/bun read project .npmrc — back up existing, write temp, restore after
+		if (fs.existsSync(projectNpmrcPath)) {
+			existingNpmrc = fs.readFileSync(projectNpmrcPath, "utf8")
+		}
+		fs.writeFileSync(projectNpmrcPath, npmrcContent)
+	}
 
 	if (!isJson) {
-		spinner.succeed("Configuration generated. Running npm install...")
+		spinner.succeed(`Configuration generated. Running ${pm} install...`)
 	}
 
-	// Run npm install
-	const npmArgs = ["install", ...packages, "--userconfig", tempNpmrcPath]
+	const pmArgs =
+		pm === "npm"
+			? ["install", ...packages, "--userconfig", tempNpmrcPath]
+			: ["install", ...packages]
 
 	// In JSON mode, capture stdout/stderr instead of inheriting
-	const child = spawn("npm", npmArgs, {
+	const child = spawn(pm, pmArgs, {
 		stdio: isJson ? "pipe" : "inherit",
 		env: { ...process.env, LPM_TOKEN: token },
 	})
 
 	const cleanup = () => {
-		if (fs.existsSync(tempNpmrcPath)) {
-			fs.unlinkSync(tempNpmrcPath)
+		if (pm === "npm") {
+			// Remove temp file
+			if (tempNpmrcPath && fs.existsSync(tempNpmrcPath)) {
+				fs.unlinkSync(tempNpmrcPath)
+			}
+		} else {
+			// Restore original .npmrc (or remove if there wasn't one)
+			if (existingNpmrc !== null) {
+				fs.writeFileSync(projectNpmrcPath, existingNpmrc)
+			} else if (fs.existsSync(projectNpmrcPath)) {
+				fs.unlinkSync(projectNpmrcPath)
+			}
 		}
 	}
 
@@ -168,11 +198,19 @@ export async function install(packages, options) {
 				packages: packages.map(p => ({ name: p })),
 				npmOutput: (stdout + stderr).trim(),
 				warnings: [],
-				errors: code !== 0 ? [`npm install failed with code ${code}`] : [],
+				errors: code !== 0 ? [`${pm} install failed with code ${code}`] : [],
 			}
 			process.stdout.write(`${JSON.stringify(output, null, 2)}\n`)
 			if (code !== 0) process.exit(code)
-			if (fetchSkills) await skillsInstall(null, { json: true })
+			if (fetchSkills) {
+				if (explicitPackages) {
+					for (const pkg of packages.filter(isLpmPackage)) {
+						await skillsInstall(pkg, { json: true })
+					}
+				} else {
+					await skillsInstall(null, { json: true })
+				}
+			}
 		})
 
 		child.on("error", err => {
@@ -182,7 +220,7 @@ export async function install(packages, options) {
 				packages: packages.map(p => ({ name: p })),
 				npmOutput: "",
 				warnings: [],
-				errors: [`Failed to start npm: ${err.message}`],
+				errors: [`Failed to start ${pm}: ${err.message}`],
 			}
 			process.stdout.write(`${JSON.stringify(output, null, 2)}\n`)
 			process.exit(1)
@@ -191,19 +229,25 @@ export async function install(packages, options) {
 		child.on("close", async code => {
 			cleanup()
 			if (code !== 0) {
-				log.error(`npm install failed with code ${code}`)
+				log.error(`${pm} install failed with code ${code}`)
 				process.exit(code)
 			} else {
 				log.success("Packages installed successfully.")
 				if (fetchSkills) {
 					console.log("")
-					await skillsInstall(null)
+					if (explicitPackages) {
+						for (const pkg of packages.filter(isLpmPackage)) {
+							await skillsInstall(pkg)
+						}
+					} else {
+						await skillsInstall(null)
+					}
 				}
 			}
 		})
 
 		child.on("error", err => {
-			log.error(`Failed to start npm: ${err.message}`)
+			log.error(`Failed to start ${pm}: ${err.message}`)
 			cleanup()
 			process.exit(1)
 		})

package/lib/commands/npmrc.js

@@ -82,15 +82,41 @@ export async function npmrc(options) {
 		: `${registryUrl}/api/registry`
 	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
 
-	// Read existing .npmrc and remove old LPM config lines
+	// Determine proxy vs scoped mode
+	let useScoped = !!options?.scoped
+
+	// Read existing .npmrc and check for custom default registry
 	let npmrcContent = ""
 	if (fs.existsSync(npmrcPath)) {
-		npmrcContent = fs
-			.readFileSync(npmrcPath, "utf8")
+		const existingContent = fs.readFileSync(npmrcPath, "utf8")
+
+		// Detect custom default registry (not npmjs.org and not lpm.dev)
+		if (!useScoped) {
+			const registryLine = existingContent
+				.split("\n")
+				.find(
+					line =>
+						line.match(/^registry=/) &&
+						!line.includes("registry.npmjs.org") &&
+						!line.includes("lpm.dev"),
+				)
+			if (registryLine) {
+				log.warn(`Found existing default registry: ${registryLine.trim()}`)
+				log.warn("Using --scoped mode to avoid overriding it.")
+				log.warn(
+					"To use LPM as your default registry, remove the existing registry= line first.",
+				)
+				useScoped = true
+			}
+		}
+
+		// Remove old LPM config lines (both scoped and unscoped formats)
+		npmrcContent = existingContent
 			.split("\n")
 			.filter(line => {
 				return (
 					!line.includes("@lpm.dev:registry") &&
+					!line.match(/^registry=.*lpm\.dev/) &&
 					!line.includes("lpm.dev/api/registry/:_authToken") &&
 					!line.includes("_authToken=lpm_") &&
 					// biome-ignore lint/suspicious/noTemplateCurlyInString: matching literal npm token placeholder
@@ -102,8 +128,12 @@ export async function npmrc(options) {
 			.trim()
 	}
 
+	const registryLine = useScoped
+		? `@lpm.dev:registry=${fullRegistryUrl}`
+		: `registry=${fullRegistryUrl}`
+
 	const lpmConfig = `# LPM Registry (generated by lpm npmrc — do not commit)
-@lpm.dev:registry=${fullRegistryUrl}
+${registryLine}
 ${registryHost}/:_authToken=${readToken}`
 
 	npmrcContent = npmrcContent ? `${npmrcContent}\n\n${lpmConfig}` : lpmConfig
@@ -129,6 +159,13 @@ ${registryHost}/:_authToken=${readToken}`
 		log.info(".npmrc added to .gitignore to prevent token leaks.")
 	}
 
+	if (useScoped) {
+		log.info("Only @lpm.dev packages will route through lpm.dev.")
+	} else {
+		log.info("All packages (LPM + npm) will route through lpm.dev.")
+		log.info("Note: First install may update resolved URLs in your lockfile.")
+	}
+
 	const expiryDate = new Date(expiresAt).toLocaleDateString("en-US", {
 		year: "numeric",
 		month: "long",

package/lib/commands/publish.js

@@ -522,8 +522,63 @@ export async function publish(options = {}) {
 			swiftManifest,
 		})
 
+		// 7b. Check for stale skills (compare local with published)
+		spinner.text = "Checking skills..."
+		const prePublishWarnings = []
+		try {
+			const localSkillsDir = path.join(process.cwd(), ".lpm", "skills")
+			if (fs.existsSync(localSkillsDir)) {
+				const skillFiles = fs
+					.readdirSync(localSkillsDir)
+					.filter(f => f.endsWith(".md"))
+					.sort()
+
+				if (skillFiles.length > 0) {
+					// Read local skills content
+					const localSkills = skillFiles.map(f => ({
+						name: f.replace(/\.md$/, ""),
+						rawContent: fs.readFileSync(path.join(localSkillsDir, f), "utf8"),
+					}))
+
+					// Fetch published skills for comparison
+					const cleanedName = name.startsWith("@lpm.dev/")
+						? name.replace("@lpm.dev/", "")
+						: `${owner}.${packageName}`
+					const skillsResponse = await request(
+						`/skills?name=${encodeURIComponent(cleanedName)}`,
+						{ method: "GET" },
+					).catch(() => null)
+
+					if (skillsResponse?.ok) {
+						const published = await skillsResponse.json()
+						if (published.available && published.skills?.length > 0) {
+							const pubSorted = [...published.skills]
+								.map(s => ({ name: s.name, rawContent: s.rawContent }))
+								.sort((a, b) => a.name.localeCompare(b.name))
+
+							const isIdentical =
+								localSkills.length === pubSorted.length &&
+								localSkills.every(
+									(local, i) =>
+										local.name === pubSorted[i].name &&
+										local.rawContent === pubSorted[i].rawContent,
+								)
+
+							if (isIdentical) {
+								prePublishWarnings.push(
+									`Agent Skills haven't changed since v${published.version} - consider reviewing them for accuracy`,
+								)
+							}
+						}
+					}
+				}
+			}
+		} catch {
+			// Non-critical — skip skills staleness check
+		}
+
 		spinner.stop()
-		displayQualityReport(qualityResult)
+		displayQualityReport({ ...qualityResult, warnings: prePublishWarnings })
 
 		// --dry-run: print summary and exit without uploading
 		if (dryRun) {
@@ -848,11 +903,16 @@ export async function publish(options = {}) {
 			)
 		}
 
-		// Show any server warnings (e.g., stale skills)
+		// Server may still return warnings for edge cases not caught client-side
 		if (publishResult.warnings?.length > 0) {
-			console.log("")
-			for (const warning of publishResult.warnings) {
-				log.warn(warning)
+			const newWarnings = publishResult.warnings.filter(
+				w => !prePublishWarnings.includes(w),
+			)
+			if (newWarnings.length > 0) {
+				console.log("")
+				for (const warning of newWarnings) {
+					log.warn(warning)
+				}
 			}
 		}
 	} catch (error) {

package/lib/commands/setup.js

@@ -8,6 +8,7 @@ import { log, printHeader } from "../ui.js"
 
 /**
  * Remove existing LPM config lines from .npmrc content.
+ * Handles both scoped (@lpm.dev:registry=) and unscoped (registry=...lpm.dev) formats.
  * @param {string} content
  * @returns {string}
  */
@@ -17,6 +18,7 @@ function removeLpmLines(content) {
 		.filter(line => {
 			return (
 				!line.includes("@lpm.dev:registry") &&
+				!line.match(/^registry=.*lpm\.dev/) &&
 				!line.includes("lpm.dev/api/registry/:_authToken") &&
 				!line.includes("_authToken=lpm_") &&
 				// biome-ignore lint/suspicious/noTemplateCurlyInString: matching literal npm token placeholder
@@ -28,6 +30,24 @@ function removeLpmLines(content) {
 		.trim()
 }
 
+/**
+ * Check if .npmrc has a custom default registry that is NOT npmjs.org or lpm.dev.
+ * @param {string} content - Existing .npmrc content
+ * @returns {string|null} The custom registry line, or null if none found
+ */
+function detectCustomRegistry(content) {
+	return (
+		content
+			.split("\n")
+			.find(
+				line =>
+					line.match(/^registry=/) &&
+					!line.includes("registry.npmjs.org") &&
+					!line.includes("lpm.dev"),
+			) || null
+	)
+}
+
 /**
  * Configure .npmrc for LPM packages.
  *
@@ -55,6 +75,9 @@ export async function setup(options) {
 		: `${registryUrl}/api/registry`
 	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
 
+	// Determine proxy vs scoped mode
+	let useScoped = !!options?.scoped
+
 	// ── OIDC mode: exchange CI token for a real short-lived install token ──
 	if (options?.oidc) {
 		let oidcToken
@@ -70,11 +93,29 @@ export async function setup(options) {
 		if (oidcToken) {
 			let npmrcContent = ""
 			if (fs.existsSync(npmrcPath)) {
-				npmrcContent = removeLpmLines(fs.readFileSync(npmrcPath, "utf8"))
+				const existingContent = fs.readFileSync(npmrcPath, "utf8")
+
+				// Detect custom default registry
+				if (!useScoped) {
+					const customRegistry = detectCustomRegistry(existingContent)
+					if (customRegistry) {
+						log.warn(
+							`Found existing default registry: ${customRegistry.trim()}`,
+						)
+						log.warn("Using --scoped mode to avoid overriding it.")
+						useScoped = true
+					}
+				}
+
+				npmrcContent = removeLpmLines(existingContent)
 			}
 
+			const registryLine = useScoped
+				? `@lpm.dev:registry=${fullRegistryUrl}`
+				: `registry=${fullRegistryUrl}`
+
 			const lpmConfig = `# LPM Registry (OIDC — expires in 30 minutes)
-@lpm.dev:registry=${fullRegistryUrl}
+${registryLine}
 ${registryHost}/:_authToken=${oidcToken}`
 
 			npmrcContent = npmrcContent
@@ -83,13 +124,16 @@ ${registryHost}/:_authToken=${oidcToken}`
 			fs.writeFileSync(npmrcPath, `${npmrcContent}\n`)
 
 			p.note(
-				`@lpm.dev:registry=${fullRegistryUrl}\nToken: OIDC read-only (30 min)`,
+				`${registryLine}\nToken: OIDC read-only (30 min)`,
 				".npmrc configuration",
 			)
 
 			console.log("")
 			log.success(".npmrc configured with OIDC read-only token.")
 			log.info("Token expires in 30 minutes. No LPM_TOKEN secret needed.")
+			if (!useScoped) {
+				log.info("All packages (LPM + npm) will route through lpm.dev.")
+			}
 			console.log("")
 
 			p.outro("Setup complete!")
@@ -104,8 +148,24 @@ ${registryHost}/:_authToken=${oidcToken}`
 	if (fs.existsSync(npmrcPath)) {
 		npmrcContent = fs.readFileSync(npmrcPath, "utf8")
 
-		// Check if already configured
-		if (npmrcContent.includes("@lpm.dev:registry")) {
+		// Detect custom default registry
+		if (!useScoped) {
+			const customRegistry = detectCustomRegistry(npmrcContent)
+			if (customRegistry) {
+				log.warn(`Found existing default registry: ${customRegistry.trim()}`)
+				log.warn("Using --scoped mode to avoid overriding it.")
+				log.warn(
+					"To use LPM as your default registry, remove the existing registry= line first.",
+				)
+				useScoped = true
+			}
+		}
+
+		// Check if already configured (both scoped and unscoped formats)
+		if (
+			npmrcContent.includes("@lpm.dev:registry") ||
+			npmrcContent.match(/^registry=.*lpm\.dev/m)
+		) {
 			const overwrite = await p.confirm({
 				message: ".npmrc already has LPM configuration. Overwrite?",
 				initialValue: false,
@@ -120,10 +180,14 @@ ${registryHost}/:_authToken=${oidcToken}`
 		}
 	}
 
+	const registryLine = useScoped
+		? `@lpm.dev:registry=${fullRegistryUrl}`
+		: `registry=${fullRegistryUrl}`
+
 	// Add LPM registry config with placeholder
 	const lpmConfig = `
 # LPM Registry
-@lpm.dev:registry=${fullRegistryUrl}
+${registryLine}
 ${registryHost}/:_authToken=\${LPM_TOKEN}
 `.trim()
 
@@ -131,12 +195,18 @@ ${registryHost}/:_authToken=\${LPM_TOKEN}
 	fs.writeFileSync(npmrcPath, `${npmrcContent}\n`)
 
 	p.note(
-		`@lpm.dev:registry=${fullRegistryUrl}\n${registryHost}/:_authToken=\${LPM_TOKEN}`,
+		`${registryLine}\n${registryHost}/:_authToken=\${LPM_TOKEN}`,
 		".npmrc configuration",
 	)
 
 	console.log("")
-	log.success(".npmrc configured for LPM packages.")
+	log.success(".npmrc configured for LPM registry.")
+	if (useScoped) {
+		log.info("Only @lpm.dev packages will route through lpm.dev.")
+	} else {
+		log.info("All packages (LPM + npm) will route through lpm.dev.")
+		log.info("Note: First install may update resolved URLs in your lockfile.")
+	}
 	log.info("For local development: Run `lpm npmrc` to generate a token.")
 	log.info("For CI/CD: Set the LPM_TOKEN environment variable.")
 	log.info("For CI/CD with OIDC: Run `lpm setup --oidc` (no secrets needed).")

package/lib/commands/skills.js

@@ -322,7 +322,18 @@ function getLpmDependencies() {
 	const allDeps = { ...pkg.dependencies, ...pkg.devDependencies }
 
 	return Object.entries(allDeps)
-		.filter(([name]) => name.startsWith("@lpm.dev/"))
+		.filter(([name, version]) => {
+			if (!name.startsWith("@lpm.dev/")) return false
+			// Skip local file/link references — they have their own .lpm/skills/
+			if (
+				version.startsWith("file:") ||
+				version.startsWith("link:") ||
+				version.startsWith("workspace:")
+			) {
+				return false
+			}
+			return true
+		})
 		.map(([name, version]) => ({
 			fullName: name,
 			shortName: name.replace("@lpm.dev/", ""),

package/lib/commands/uninstall.js

@@ -0,0 +1,107 @@
+import { spawn } from "node:child_process"
+import fs from "node:fs"
+import path from "node:path"
+import { getPackageManager, getRegistryUrl, getToken } from "../config.js"
+import { createSpinner, log, printHeader } from "../ui.js"
+
+/**
+ * Uninstall LPM packages.
+ * Creates a temporary .npmrc with auth, runs the package manager's uninstall, and cleans up.
+ *
+ * @param {string[]} packages - Package names to uninstall
+ * @param {object} [options]
+ * @param {string} [options.pm] - Package manager override (npm, pnpm, yarn, bun)
+ */
+export async function uninstall(packages, options) {
+	printHeader()
+
+	if (!packages || packages.length === 0) {
+		log.error("Please specify at least one package to uninstall.")
+		log.info("Usage: lpm uninstall @lpm.dev/owner.package-name")
+		process.exit(1)
+	}
+
+	const token = await getToken()
+	if (!token) {
+		log.error(
+			'You must be logged in to uninstall packages. Run "lpm login" first.',
+		)
+		process.exit(1)
+	}
+
+	const pm = getPackageManager(options?.pm)
+	const spinner = createSpinner(
+		`Preparing to uninstall ${packages.join(", ")}...`,
+	).start()
+
+	const baseRegistryUrl = getRegistryUrl()
+	const registryUrl = baseRegistryUrl.endsWith("/api/registry")
+		? baseRegistryUrl
+		: `${baseRegistryUrl}/api/registry`
+	const registryHost = registryUrl.replace(/^https?:/, "")
+
+	const npmrcContent = `${registryHost}/:_authToken=${token}
+@lpm.dev:registry=${registryUrl}
+`
+
+	const projectNpmrcPath = path.resolve(process.cwd(), ".npmrc")
+	let existingNpmrc = null
+	let tempNpmrcPath = null
+
+	if (pm === "npm") {
+		tempNpmrcPath = path.resolve(process.cwd(), `.npmrc.lpm-${Date.now()}`)
+		fs.writeFileSync(tempNpmrcPath, npmrcContent)
+	} else {
+		if (fs.existsSync(projectNpmrcPath)) {
+			existingNpmrc = fs.readFileSync(projectNpmrcPath, "utf8")
+		}
+		fs.writeFileSync(projectNpmrcPath, npmrcContent)
+	}
+
+	spinner.succeed(`Configuration generated. Running ${pm} uninstall...`)
+
+	const pmArgs =
+		pm === "npm"
+			? ["uninstall", ...packages, "--userconfig", tempNpmrcPath]
+			: ["uninstall", ...packages]
+
+	const child = spawn(pm, pmArgs, {
+		stdio: "inherit",
+		env: { ...process.env, LPM_TOKEN: token },
+	})
+
+	const cleanup = () => {
+		if (pm === "npm") {
+			if (tempNpmrcPath && fs.existsSync(tempNpmrcPath)) {
+				fs.unlinkSync(tempNpmrcPath)
+			}
+		} else {
+			if (existingNpmrc !== null) {
+				fs.writeFileSync(projectNpmrcPath, existingNpmrc)
+			} else if (fs.existsSync(projectNpmrcPath)) {
+				fs.unlinkSync(projectNpmrcPath)
+			}
+		}
+	}
+
+	child.on("close", code => {
+		cleanup()
+		if (code !== 0) {
+			log.error(`${pm} uninstall failed with code ${code}`)
+			process.exit(code)
+		} else {
+			log.success("Packages uninstalled successfully.")
+		}
+	})
+
+	child.on("error", err => {
+		log.error(`Failed to start ${pm}: ${err.message}`)
+		cleanup()
+		process.exit(1)
+	})
+
+	process.on("SIGINT", () => {
+		cleanup()
+		process.exit()
+	})
+}

package/lib/config.js

@@ -183,6 +183,32 @@ export function setRetries(count) {
 	config.set("retries", count)
 }
 
+// ============================================================================
+// Package Manager Configuration
+// ============================================================================
+
+const VALID_PACKAGE_MANAGERS = new Set(["npm", "pnpm", "yarn", "bun"])
+const DEFAULT_PACKAGE_MANAGER = "npm"
+
+/**
+ * Get the configured package manager for install/uninstall operations.
+ * Priority: --pm flag > LPM_PACKAGE_MANAGER env > config > "npm"
+ * @param {string} [override] - CLI flag override (--pm value)
+ * @returns {string}
+ */
+export function getPackageManager(override) {
+	const pm =
+		override ||
+		process.env.LPM_PACKAGE_MANAGER ||
+		config.get("packageManager", DEFAULT_PACKAGE_MANAGER)
+
+	if (!VALID_PACKAGE_MANAGERS.has(pm)) {
+		return DEFAULT_PACKAGE_MANAGER
+	}
+
+	return pm
+}
+
 // ============================================================================
 // General Configuration Access
 // ============================================================================
@@ -197,6 +223,7 @@ export async function getAllConfig() {
 
 	return {
 		registryUrl: getRegistryUrl(),
+		packageManager: getPackageManager(),
 		timeout: getTimeout(),
 		retries: getRetries(),
 		secureStorage: usingKeychain ? "keychain" : "encrypted-file",
@@ -213,6 +240,7 @@ export function getConfigValue(key) {
 	const configMap = {
 		registry: getRegistryUrl,
 		registryUrl: getRegistryUrl,
+		packageManager: getPackageManager,
 		timeout: getTimeout,
 		retries: getRetries,
 	}
@@ -232,6 +260,15 @@ export function setConfigValue(key, value) {
 	const configMap = {
 		registry: setRegistryUrl,
 		registryUrl: setRegistryUrl,
+		packageManager: val => {
+			if (VALID_PACKAGE_MANAGERS.has(val)) {
+				config.set("packageManager", val)
+			} else {
+				throw new Error(
+					`Invalid package manager "${val}". Valid options: ${[...VALID_PACKAGE_MANAGERS].join(", ")}`,
+				)
+			}
+		},
 		timeout: val => setTimeout(Number(val)),
 		retries: val => setRetries(Number(val)),
 	}

package/lib/quality/display.js

@@ -38,9 +38,9 @@ function progressBar(value, max, width = 18) {
 /**
  * Display quality report in the terminal.
  *
- * @param {{ score: number, checks: Array, meta: object }} result
+ * @param {{ score: number, checks: Array, meta: object, warnings?: string[] }} result
  */
-export function displayQualityReport({ score, checks, meta }) {
+export function displayQualityReport({ score, checks, meta, warnings }) {
 	const tierColor = TIER_COLORS[meta.tier] || chalk.white
 	const tierLabel = TIER_LABELS[meta.tier] || meta.tier
 
@@ -76,6 +76,14 @@ export function displayQualityReport({ score, checks, meta }) {
 		}
 	}
 
+	// Show warnings (e.g., stale skills)
+	if (warnings?.length > 0) {
+		if (failed.length === 0) console.log("")
+		for (const warning of warnings) {
+			console.log(`  ${chalk.yellow("⚠")} ${chalk.yellow(warning)}`)
+		}
+	}
+
 	if (failed.length > 0 && score < 90) {
 		console.log(
 			chalk.dim(

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.2.5",
+	"version": "0.3.0",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {