@lpm-registry/cli 0.2.6 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.4.0] - 2026-03-24
+
+### Added
+
+- **Rust binary drop-in replacement** — `lpm` now automatically downloads and runs the native Rust binary on postinstall. 9x faster warm installs than pnpm, 24x faster than npm. Falls back to JS CLI if binary is unavailable.
+- **GitHub Releases distribution** — Platform-specific binaries (macOS arm64/x64, Linux arm64/x64, Windows x64) hosted on GitHub Releases, downloaded automatically during `npm install -g @lpm-registry/cli`.
+- **Auto-integrate Agent Skills with AI editors** — After `lpm skills install`, skills are automatically wired into detected AI editor configs (Claude Code `CLAUDE.md`, Cursor `.cursorrules`, etc.). Use `--no-editor-setup` to skip.
+- **`--no-editor-setup` flag** for `lpm install` and `lpm skills install` — Skip auto-configuring AI editor integration for skills.
+
+### Changed
+
+- Binary download URL updated from `lpm.dev/releases` to GitHub Releases (`github.com/lpm-dev/rust-client/releases`)
+- Skills install now passes `editorSetup` option through from `lpm install` to `lpm skills install`
+- Fixed unused variable lint warning in `bin/lpm.js`
+
+## [0.3.0] - 2026-03-22
+
+### Added
+
+- **Upstream npm proxy mode (default)** — `lpm npmrc` and `lpm setup` now configure LPM as the default registry. All packages (LPM + npm) are fetched through LPM for faster, edge-cached installs via Cloudflare R2.
+- **`--scoped` flag** — Use `lpm npmrc --scoped` or `lpm setup --scoped` to only route `@lpm.dev` packages through LPM (old behavior).
+- **Custom registry detection** — If `.npmrc` already has a custom default registry (e.g., Artifactory), the CLI warns and automatically falls back to `--scoped` mode to avoid overriding it.
+- **Pre-publish skills staleness warning** — When Agent Skills haven't changed since the previous version, the warning now appears before the publish confirmation prompt (instead of after), so you can cancel and update skills before publishing.
+
+### Changed
+
+- `lpm npmrc` default output changed from `@lpm.dev:registry=...` (scoped) to `registry=...` (proxy mode)
+- `lpm setup` and `lpm setup --oidc` default output changed to proxy mode
+- Updated CLI output messaging to indicate proxy vs scoped mode
+- Updated README with new default behavior and `--scoped` flag
+
 ## [0.2.6] - 2026-03-21
 
 ### Added

package/README.md

@@ -1,11 +1,15 @@
 # LPM CLI
 
-The command-line interface for the Licensed Package Manager (LPM).
+The command-line interface for the Licensed Package Manager (LPM). Ships with a native Rust binary for fast installs — 9x faster than pnpm, 24x faster than npm.
 
 ## Installation
 
 ```bash
+# npm (recommended — auto-downloads native binary)
 npm install -g @lpm-registry/cli
+
+# curl (standalone, no Node required)
+curl -fsSL https://raw.githubusercontent.com/lpm-dev/rust-client/main/install.sh | sh
 ```
 
 ## Command Shortcuts
@@ -69,10 +73,13 @@ lpm whoami
 
 Generate a 30-day read-only token for your project. Makes `npm install` work with LPM packages.
 
+By default, LPM is configured as your default registry — all packages (LPM + npm) are fetched through LPM for faster, edge-cached installs.
+
 ```bash
-lpm npmrc                  # 30-day token (default)
+lpm npmrc                  # 30-day token, proxy mode (default)
 lpm npmrc --days 7         # 7-day token
 lpm npmrc --days 90        # 90-day token
+lpm npmrc --scoped         # Only route @lpm.dev packages through LPM
 ```
 
 Automatically adds `.npmrc` to `.gitignore` to prevent token leaks.
@@ -82,8 +89,9 @@ Automatically adds `.npmrc` to `.gitignore` to prevent token leaks.
 Configure `.npmrc` for CI/CD environments.
 
 ```bash
-lpm setup                  # Writes ${LPM_TOKEN} placeholder
+lpm setup                  # Writes ${LPM_TOKEN} placeholder (proxy mode)
 lpm setup --oidc           # OIDC — no secrets needed (GitHub Actions, GitLab CI)
+lpm setup --scoped         # Only route @lpm.dev packages through LPM
 ```
 
 For deployment platforms (Vercel, Netlify), set the `LPM_TOKEN` environment variable.

package/bin/lpm.js

@@ -1,8 +1,33 @@
 #!/usr/bin/env node
 
+import { execFileSync } from "node:child_process"
 import fs from "node:fs"
 import path from "node:path"
 import { fileURLToPath } from "node:url"
+
+// ─── Try Rust binary first ──────────────────────────────────────────
+const __dirname_early = path.dirname(fileURLToPath(import.meta.url))
+const binaryName = process.platform === "win32" ? "lpm-bin.exe" : "lpm-bin"
+const binaryPath = path.join(__dirname_early, binaryName)
+
+if (fs.existsSync(binaryPath)) {
+	try {
+		// Delegate to Rust binary with all args
+		execFileSync(binaryPath, process.argv.slice(2), {
+			stdio: "inherit",
+			env: process.env,
+		})
+		process.exit(0)
+	} catch (err) {
+		// execFileSync throws on non-zero exit — propagate the exit code
+		if (err.status != null) {
+			process.exit(err.status)
+		}
+		// Binary failed to execute — fall through to JS CLI
+	}
+}
+
+// ─── JS CLI fallback ────────────────────────────────────────────────
 import { Command } from "commander"
 import updateNotifier from "update-notifier"
 import { add } from "../lib/commands/add.js"
@@ -94,6 +119,10 @@ program
 	.description("Install packages with automatic registry authentication")
 	.option("--json", "Machine-readable JSON output")
 	.option("--no-skills", "Skip fetching Agent Skills after install")
+	.option(
+		"--no-editor-setup",
+		"Skip auto-configuring AI editor integration for skills",
+	)
 	.option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)")
 	.action(install)
 
@@ -210,18 +239,26 @@ program
 
 program
 	.command("setup")
-	.description("Configure .npmrc for LPM packages (@lpm.dev scope)")
+	.description("Configure .npmrc for LPM registry")
 	.option("-r, --registry <url>", "Custom registry URL")
 	.option(
 		"--oidc",
 		"Exchange CI OIDC token for install access (no secrets needed)",
 	)
+	.option(
+		"--scoped",
+		"Only route @lpm.dev packages through LPM (don't proxy npm)",
+	)
 	.action(setup)
 
 program
 	.command("npmrc")
 	.description("Generate a read-only .npmrc token for local development")
 	.option("-d, --days <number>", "Token expiry in days (default: 30)")
+	.option(
+		"--scoped",
+		"Only route @lpm.dev packages through LPM (don't proxy npm)",
+	)
 	.action(npmrc)
 
 program
@@ -323,6 +360,10 @@ skills
 		"Fetch and install skills from the registry (all deps or specific package)",
 	)
 	.option("--json", "Output in JSON format")
+	.option(
+		"--no-editor-setup",
+		"Skip auto-configuring AI editor integration for skills",
+	)
 	.action(skillsInstall)
 
 skills

package/lib/commands/install.js

@@ -180,6 +180,7 @@ export async function install(packages, options) {
 	}
 
 	const fetchSkills = options?.skills !== false
+	const editorSetup = options?.editorSetup !== false
 
 	if (isJson) {
 		let stdout = ""
@@ -203,12 +204,13 @@ export async function install(packages, options) {
 			process.stdout.write(`${JSON.stringify(output, null, 2)}\n`)
 			if (code !== 0) process.exit(code)
 			if (fetchSkills) {
+				const skillOpts = { json: true, editorSetup }
 				if (explicitPackages) {
 					for (const pkg of packages.filter(isLpmPackage)) {
-						await skillsInstall(pkg, { json: true })
+						await skillsInstall(pkg, skillOpts)
 					}
 				} else {
-					await skillsInstall(null, { json: true })
+					await skillsInstall(null, skillOpts)
 				}
 			}
 		})
@@ -235,12 +237,13 @@ export async function install(packages, options) {
 				log.success("Packages installed successfully.")
 				if (fetchSkills) {
 					console.log("")
+					const skillOpts = { editorSetup }
 					if (explicitPackages) {
 						for (const pkg of packages.filter(isLpmPackage)) {
-							await skillsInstall(pkg)
+							await skillsInstall(pkg, skillOpts)
 						}
 					} else {
-						await skillsInstall(null)
+						await skillsInstall(null, skillOpts)
 					}
 				}
 			}

package/lib/commands/npmrc.js

@@ -82,15 +82,41 @@ export async function npmrc(options) {
 		: `${registryUrl}/api/registry`
 	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
 
-	// Read existing .npmrc and remove old LPM config lines
+	// Determine proxy vs scoped mode
+	let useScoped = !!options?.scoped
+
+	// Read existing .npmrc and check for custom default registry
 	let npmrcContent = ""
 	if (fs.existsSync(npmrcPath)) {
-		npmrcContent = fs
-			.readFileSync(npmrcPath, "utf8")
+		const existingContent = fs.readFileSync(npmrcPath, "utf8")
+
+		// Detect custom default registry (not npmjs.org and not lpm.dev)
+		if (!useScoped) {
+			const registryLine = existingContent
+				.split("\n")
+				.find(
+					line =>
+						line.match(/^registry=/) &&
+						!line.includes("registry.npmjs.org") &&
+						!line.includes("lpm.dev"),
+				)
+			if (registryLine) {
+				log.warn(`Found existing default registry: ${registryLine.trim()}`)
+				log.warn("Using --scoped mode to avoid overriding it.")
+				log.warn(
+					"To use LPM as your default registry, remove the existing registry= line first.",
+				)
+				useScoped = true
+			}
+		}
+
+		// Remove old LPM config lines (both scoped and unscoped formats)
+		npmrcContent = existingContent
 			.split("\n")
 			.filter(line => {
 				return (
 					!line.includes("@lpm.dev:registry") &&
+					!line.match(/^registry=.*lpm\.dev/) &&
 					!line.includes("lpm.dev/api/registry/:_authToken") &&
 					!line.includes("_authToken=lpm_") &&
 					// biome-ignore lint/suspicious/noTemplateCurlyInString: matching literal npm token placeholder
@@ -102,8 +128,12 @@ export async function npmrc(options) {
 			.trim()
 	}
 
+	const registryLine = useScoped
+		? `@lpm.dev:registry=${fullRegistryUrl}`
+		: `registry=${fullRegistryUrl}`
+
 	const lpmConfig = `# LPM Registry (generated by lpm npmrc — do not commit)
-@lpm.dev:registry=${fullRegistryUrl}
+${registryLine}
 ${registryHost}/:_authToken=${readToken}`
 
 	npmrcContent = npmrcContent ? `${npmrcContent}\n\n${lpmConfig}` : lpmConfig
@@ -129,6 +159,13 @@ ${registryHost}/:_authToken=${readToken}`
 		log.info(".npmrc added to .gitignore to prevent token leaks.")
 	}
 
+	if (useScoped) {
+		log.info("Only @lpm.dev packages will route through lpm.dev.")
+	} else {
+		log.info("All packages (LPM + npm) will route through lpm.dev.")
+		log.info("Note: First install may update resolved URLs in your lockfile.")
+	}
+
 	const expiryDate = new Date(expiresAt).toLocaleDateString("en-US", {
 		year: "numeric",
 		month: "long",

package/lib/commands/publish.js

@@ -522,8 +522,63 @@ export async function publish(options = {}) {
 			swiftManifest,
 		})
 
+		// 7b. Check for stale skills (compare local with published)
+		spinner.text = "Checking skills..."
+		const prePublishWarnings = []
+		try {
+			const localSkillsDir = path.join(process.cwd(), ".lpm", "skills")
+			if (fs.existsSync(localSkillsDir)) {
+				const skillFiles = fs
+					.readdirSync(localSkillsDir)
+					.filter(f => f.endsWith(".md"))
+					.sort()
+
+				if (skillFiles.length > 0) {
+					// Read local skills content
+					const localSkills = skillFiles.map(f => ({
+						name: f.replace(/\.md$/, ""),
+						rawContent: fs.readFileSync(path.join(localSkillsDir, f), "utf8"),
+					}))
+
+					// Fetch published skills for comparison
+					const cleanedName = name.startsWith("@lpm.dev/")
+						? name.replace("@lpm.dev/", "")
+						: `${owner}.${packageName}`
+					const skillsResponse = await request(
+						`/skills?name=${encodeURIComponent(cleanedName)}`,
+						{ method: "GET" },
+					).catch(() => null)
+
+					if (skillsResponse?.ok) {
+						const published = await skillsResponse.json()
+						if (published.available && published.skills?.length > 0) {
+							const pubSorted = [...published.skills]
+								.map(s => ({ name: s.name, rawContent: s.rawContent }))
+								.sort((a, b) => a.name.localeCompare(b.name))
+
+							const isIdentical =
+								localSkills.length === pubSorted.length &&
+								localSkills.every(
+									(local, i) =>
+										local.name === pubSorted[i].name &&
+										local.rawContent === pubSorted[i].rawContent,
+								)
+
+							if (isIdentical) {
+								prePublishWarnings.push(
+									`Agent Skills haven't changed since v${published.version} - consider reviewing them for accuracy`,
+								)
+							}
+						}
+					}
+				}
+			}
+		} catch {
+			// Non-critical — skip skills staleness check
+		}
+
 		spinner.stop()
-		displayQualityReport(qualityResult)
+		displayQualityReport({ ...qualityResult, warnings: prePublishWarnings })
 
 		// --dry-run: print summary and exit without uploading
 		if (dryRun) {
@@ -848,11 +903,16 @@ export async function publish(options = {}) {
 			)
 		}
 
-		// Show any server warnings (e.g., stale skills)
+		// Server may still return warnings for edge cases not caught client-side
 		if (publishResult.warnings?.length > 0) {
-			console.log("")
-			for (const warning of publishResult.warnings) {
-				log.warn(warning)
+			const newWarnings = publishResult.warnings.filter(
+				w => !prePublishWarnings.includes(w),
+			)
+			if (newWarnings.length > 0) {
+				console.log("")
+				for (const warning of newWarnings) {
+					log.warn(warning)
+				}
 			}
 		}
 	} catch (error) {

package/lib/commands/setup.js

@@ -8,6 +8,7 @@ import { log, printHeader } from "../ui.js"
 
 /**
  * Remove existing LPM config lines from .npmrc content.
+ * Handles both scoped (@lpm.dev:registry=) and unscoped (registry=...lpm.dev) formats.
  * @param {string} content
  * @returns {string}
  */
@@ -17,6 +18,7 @@ function removeLpmLines(content) {
 		.filter(line => {
 			return (
 				!line.includes("@lpm.dev:registry") &&
+				!line.match(/^registry=.*lpm\.dev/) &&
 				!line.includes("lpm.dev/api/registry/:_authToken") &&
 				!line.includes("_authToken=lpm_") &&
 				// biome-ignore lint/suspicious/noTemplateCurlyInString: matching literal npm token placeholder
@@ -28,6 +30,24 @@ function removeLpmLines(content) {
 		.trim()
 }
 
+/**
+ * Check if .npmrc has a custom default registry that is NOT npmjs.org or lpm.dev.
+ * @param {string} content - Existing .npmrc content
+ * @returns {string|null} The custom registry line, or null if none found
+ */
+function detectCustomRegistry(content) {
+	return (
+		content
+			.split("\n")
+			.find(
+				line =>
+					line.match(/^registry=/) &&
+					!line.includes("registry.npmjs.org") &&
+					!line.includes("lpm.dev"),
+			) || null
+	)
+}
+
 /**
  * Configure .npmrc for LPM packages.
  *
@@ -55,6 +75,9 @@ export async function setup(options) {
 		: `${registryUrl}/api/registry`
 	const registryHost = fullRegistryUrl.replace(/^https?:/, "")
 
+	// Determine proxy vs scoped mode
+	let useScoped = !!options?.scoped
+
 	// ── OIDC mode: exchange CI token for a real short-lived install token ──
 	if (options?.oidc) {
 		let oidcToken
@@ -70,11 +93,29 @@ export async function setup(options) {
 		if (oidcToken) {
 			let npmrcContent = ""
 			if (fs.existsSync(npmrcPath)) {
-				npmrcContent = removeLpmLines(fs.readFileSync(npmrcPath, "utf8"))
+				const existingContent = fs.readFileSync(npmrcPath, "utf8")
+
+				// Detect custom default registry
+				if (!useScoped) {
+					const customRegistry = detectCustomRegistry(existingContent)
+					if (customRegistry) {
+						log.warn(
+							`Found existing default registry: ${customRegistry.trim()}`,
+						)
+						log.warn("Using --scoped mode to avoid overriding it.")
+						useScoped = true
+					}
+				}
+
+				npmrcContent = removeLpmLines(existingContent)
 			}
 
+			const registryLine = useScoped
+				? `@lpm.dev:registry=${fullRegistryUrl}`
+				: `registry=${fullRegistryUrl}`
+
 			const lpmConfig = `# LPM Registry (OIDC — expires in 30 minutes)
-@lpm.dev:registry=${fullRegistryUrl}
+${registryLine}
 ${registryHost}/:_authToken=${oidcToken}`
 
 			npmrcContent = npmrcContent
@@ -83,13 +124,16 @@ ${registryHost}/:_authToken=${oidcToken}`
 			fs.writeFileSync(npmrcPath, `${npmrcContent}\n`)
 
 			p.note(
-				`@lpm.dev:registry=${fullRegistryUrl}\nToken: OIDC read-only (30 min)`,
+				`${registryLine}\nToken: OIDC read-only (30 min)`,
 				".npmrc configuration",
 			)
 
 			console.log("")
 			log.success(".npmrc configured with OIDC read-only token.")
 			log.info("Token expires in 30 minutes. No LPM_TOKEN secret needed.")
+			if (!useScoped) {
+				log.info("All packages (LPM + npm) will route through lpm.dev.")
+			}
 			console.log("")
 
 			p.outro("Setup complete!")
@@ -104,8 +148,24 @@ ${registryHost}/:_authToken=${oidcToken}`
 	if (fs.existsSync(npmrcPath)) {
 		npmrcContent = fs.readFileSync(npmrcPath, "utf8")
 
-		// Check if already configured
-		if (npmrcContent.includes("@lpm.dev:registry")) {
+		// Detect custom default registry
+		if (!useScoped) {
+			const customRegistry = detectCustomRegistry(npmrcContent)
+			if (customRegistry) {
+				log.warn(`Found existing default registry: ${customRegistry.trim()}`)
+				log.warn("Using --scoped mode to avoid overriding it.")
+				log.warn(
+					"To use LPM as your default registry, remove the existing registry= line first.",
+				)
+				useScoped = true
+			}
+		}
+
+		// Check if already configured (both scoped and unscoped formats)
+		if (
+			npmrcContent.includes("@lpm.dev:registry") ||
+			npmrcContent.match(/^registry=.*lpm\.dev/m)
+		) {
 			const overwrite = await p.confirm({
 				message: ".npmrc already has LPM configuration. Overwrite?",
 				initialValue: false,
@@ -120,10 +180,14 @@ ${registryHost}/:_authToken=${oidcToken}`
 		}
 	}
 
+	const registryLine = useScoped
+		? `@lpm.dev:registry=${fullRegistryUrl}`
+		: `registry=${fullRegistryUrl}`
+
 	// Add LPM registry config with placeholder
 	const lpmConfig = `
 # LPM Registry
-@lpm.dev:registry=${fullRegistryUrl}
+${registryLine}
 ${registryHost}/:_authToken=\${LPM_TOKEN}
 `.trim()
 
@@ -131,12 +195,18 @@ ${registryHost}/:_authToken=\${LPM_TOKEN}
 	fs.writeFileSync(npmrcPath, `${npmrcContent}\n`)
 
 	p.note(
-		`@lpm.dev:registry=${fullRegistryUrl}\n${registryHost}/:_authToken=\${LPM_TOKEN}`,
+		`${registryLine}\n${registryHost}/:_authToken=\${LPM_TOKEN}`,
 		".npmrc configuration",
 	)
 
 	console.log("")
-	log.success(".npmrc configured for LPM packages.")
+	log.success(".npmrc configured for LPM registry.")
+	if (useScoped) {
+		log.info("Only @lpm.dev packages will route through lpm.dev.")
+	} else {
+		log.info("All packages (LPM + npm) will route through lpm.dev.")
+		log.info("Note: First install may update resolved URLs in your lockfile.")
+	}
 	log.info("For local development: Run `lpm npmrc` to generate a token.")
 	log.info("For CI/CD: Set the LPM_TOKEN environment variable.")
 	log.info("For CI/CD with OIDC: Run `lpm setup --oidc` (no secrets needed).")

package/lib/commands/skills.js

@@ -12,6 +12,7 @@ import fs from "node:fs"
 import path from "node:path"
 import chalk from "chalk"
 import { get } from "../api.js"
+import { autoIntegrateSkills } from "../editor-skills.js"
 import { createSpinner, log, printHeader } from "../ui.js"
 
 // ============================================================================
@@ -616,12 +617,19 @@ export async function skillsInstall(packageInput, options = {}) {
 	if (spinner) spinner.stop()
 
 	if (isJson) {
+		const hasInstalled = results.some(r => r.status === "installed")
+		let editorSetup = null
+		if (hasInstalled && options.editorSetup !== false) {
+			const result = autoIntegrateSkills({ json: true })
+			editorSetup = result
+		}
 		console.log(
 			JSON.stringify(
 				{
 					installed: results.filter(r => r.status === "installed").length,
 					packages: results,
 					errors,
+					...(editorSetup ? { editorSetup } : {}),
 				},
 				null,
 				2,
@@ -665,7 +673,13 @@ export async function skillsInstall(packageInput, options = {}) {
 	if (installed.length > 0) {
 		console.log("")
 		console.log(chalk.dim(`  Skills saved to ${SKILLS_DIR}/`))
-		printWiringInstructions()
+
+		// Auto-integrate with detected AI editors (unless --no-editor-setup)
+		if (options.editorSetup !== false) {
+			autoIntegrateSkills({ json: false })
+		} else {
+			printWiringInstructions()
+		}
 	}
 
 	console.log("")

package/lib/editor-skills.js

@@ -0,0 +1,321 @@
+/**
+ * Auto-integrate Agent Skills with AI editor config files.
+ *
+ * After `lpm skills install` writes skill files to `.lpm/skills/`,
+ * this module detects which AI editors are configured in the project
+ * and wires the skills in automatically (append reference, symlink, etc.).
+ *
+ * @module cli/lib/editor-skills
+ */
+
+import fs from "node:fs"
+import path from "node:path"
+import chalk from "chalk"
+import { log } from "./ui.js"
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+const SKILLS_DIR = ".lpm/skills"
+
+const SKILLS_REFERENCE_LINE =
+	"See .lpm/skills/ for package-specific Agent Skills and guidelines."
+
+/** Marker comment so we can detect our own additions and avoid duplicates. */
+const LPM_MARKER = "<!-- lpm:skills -->"
+
+/**
+ * The block we append to markdown/text config files.
+ * Contains both a human-readable reference and a machine-detectable marker.
+ */
+function makeReferenceBlock() {
+	return `\n\n${LPM_MARKER}\n## LPM Agent Skills\n\n${SKILLS_REFERENCE_LINE}\n`
+}
+
+// ============================================================================
+// AI Editor definitions (for skills wiring — separate from MCP editors)
+// ============================================================================
+
+/**
+ * @typedef {object} AIEditor
+ * @property {string} id - Unique identifier
+ * @property {string} name - Display name
+ * @property {string} configPath - Relative path to the config file from project root
+ * @property {"append" | "symlink"} action - How to integrate skills
+ * @property {(projectRoot: string) => boolean} detect - Whether this editor is configured in the project
+ */
+
+/** @type {AIEditor[]} */
+const AI_EDITORS = [
+	{
+		id: "claude-code",
+		name: "Claude Code",
+		configPath: "CLAUDE.md",
+		action: "append",
+		detect: projectRoot => fs.existsSync(path.join(projectRoot, "CLAUDE.md")),
+	},
+	{
+		id: "cursor",
+		name: "Cursor",
+		configPath: ".cursor/rules/",
+		action: "symlink",
+		detect: projectRoot =>
+			fs.existsSync(path.join(projectRoot, ".cursor", "rules")),
+	},
+	{
+		id: "cursor-legacy",
+		name: "Cursor (legacy)",
+		configPath: ".cursorrules",
+		action: "append",
+		detect: projectRoot =>
+			fs.existsSync(path.join(projectRoot, ".cursorrules")),
+	},
+	{
+		id: "windsurf",
+		name: "Windsurf",
+		configPath: ".windsurfrules",
+		action: "append",
+		detect: projectRoot =>
+			fs.existsSync(path.join(projectRoot, ".windsurfrules")),
+	},
+	{
+		id: "github-copilot",
+		name: "GitHub Copilot",
+		configPath: ".github/copilot-instructions.md",
+		action: "append",
+		detect: projectRoot =>
+			fs.existsSync(
+				path.join(projectRoot, ".github", "copilot-instructions.md"),
+			),
+	},
+	{
+		id: "augment",
+		name: "Augment",
+		configPath: ".augment/instructions.md",
+		action: "append",
+		detect: projectRoot =>
+			fs.existsSync(path.join(projectRoot, ".augment", "instructions.md")),
+	},
+	{
+		id: "cline",
+		name: "Cline",
+		configPath: ".clinerules",
+		action: "append",
+		detect: projectRoot => fs.existsSync(path.join(projectRoot, ".clinerules")),
+	},
+]
+
+// ============================================================================
+// Core logic
+// ============================================================================
+
+/**
+ * Detect which AI editors are configured in the project.
+ *
+ * @param {string} projectRoot
+ * @returns {AIEditor[]}
+ */
+export function detectAIEditors(projectRoot) {
+	return AI_EDITORS.filter(editor => editor.detect(projectRoot))
+}
+
+/**
+ * Check if a file already references .lpm/skills/.
+ *
+ * @param {string} filePath
+ * @returns {boolean}
+ */
+export function hasSkillsReference(filePath) {
+	if (!fs.existsSync(filePath)) return false
+	const content = fs.readFileSync(filePath, "utf-8")
+	return content.includes(".lpm/skills") || content.includes(LPM_MARKER)
+}
+
+/**
+ * Append a skills reference block to a markdown/text config file.
+ *
+ * @param {string} filePath - Absolute path to the config file
+ * @returns {boolean} Whether the reference was added (false if already present)
+ */
+export function appendSkillsReference(filePath) {
+	if (hasSkillsReference(filePath)) return false
+	fs.appendFileSync(filePath, makeReferenceBlock())
+	return true
+}
+
+/**
+ * Create a new CLAUDE.md with skills reference (fallback when no editor detected).
+ *
+ * @param {string} projectRoot
+ * @returns {boolean} Whether the file was created
+ */
+export function createClaudeMdWithReference(projectRoot) {
+	const claudeMdPath = path.join(projectRoot, "CLAUDE.md")
+	if (fs.existsSync(claudeMdPath)) return false
+
+	const content = `# Project Guidelines\n\n${LPM_MARKER}\n## LPM Agent Skills\n\n${SKILLS_REFERENCE_LINE}\n`
+	fs.writeFileSync(claudeMdPath, content, "utf-8")
+	return true
+}
+
+/**
+ * Collect all .md skill files from .lpm/skills/ (recursively through package subdirs).
+ *
+ * @param {string} projectRoot
+ * @returns {{ packageName: string, fileName: string, filePath: string }[]}
+ */
+export function collectSkillFiles(projectRoot) {
+	const skillsDir = path.join(projectRoot, SKILLS_DIR)
+	if (!fs.existsSync(skillsDir)) return []
+
+	const results = []
+	const entries = fs.readdirSync(skillsDir, { withFileTypes: true })
+
+	for (const entry of entries) {
+		if (entry.isDirectory()) {
+			// Package subdirectory (e.g., "neo.colors")
+			const pkgDir = path.join(skillsDir, entry.name)
+			const files = fs.readdirSync(pkgDir).filter(f => f.endsWith(".md"))
+			for (const file of files) {
+				results.push({
+					packageName: entry.name,
+					fileName: file,
+					filePath: path.join(pkgDir, file),
+				})
+			}
+		} else if (entry.name.endsWith(".md")) {
+			// Top-level skill file
+			results.push({
+				packageName: null,
+				fileName: entry.name,
+				filePath: path.join(skillsDir, entry.name),
+			})
+		}
+	}
+
+	return results
+}
+
+/**
+ * Create symlinks for Cursor's .cursor/rules/ directory.
+ * Uses relative symlinks so they work across machines.
+ *
+ * @param {string} projectRoot
+ * @returns {{ created: string[], skipped: string[] }}
+ */
+export function symlinkForCursor(projectRoot) {
+	const rulesDir = path.join(projectRoot, ".cursor", "rules")
+	const skillFiles = collectSkillFiles(projectRoot)
+
+	const created = []
+	const skipped = []
+
+	for (const { packageName, fileName, filePath } of skillFiles) {
+		// Build symlink name: "neo.colors-getting-started.md"
+		const linkName = packageName
+			? `${packageName}-${fileName}`
+			: `lpm-${fileName}`
+
+		const linkPath = path.join(rulesDir, linkName)
+
+		if (fs.existsSync(linkPath)) {
+			skipped.push(linkName)
+			continue
+		}
+
+		// Compute relative path from .cursor/rules/ to the skill file
+		const relativePath = path.relative(rulesDir, filePath)
+
+		try {
+			fs.symlinkSync(relativePath, linkPath)
+			created.push(linkName)
+		} catch {
+			// Fallback: copy if symlink fails (e.g., Windows without developer mode)
+			try {
+				fs.copyFileSync(filePath, linkPath)
+				created.push(linkName)
+			} catch {
+				skipped.push(linkName)
+			}
+		}
+	}
+
+	return { created, skipped }
+}
+
+// ============================================================================
+// Main entry point
+// ============================================================================
+
+/**
+ * Auto-integrate installed skills with detected AI editors.
+ *
+ * @param {object} options
+ * @param {string} [options.projectRoot] - Project root (defaults to cwd)
+ * @param {boolean} [options.json] - Output JSON instead of human-readable
+ * @param {string[]} [options.installedPackages] - Names of packages that had skills installed
+ * @returns {{ configured: { id: string, name: string, configPath: string }[], fallback: boolean }}
+ */
+export function autoIntegrateSkills(options = {}) {
+	const projectRoot = options.projectRoot || process.cwd()
+	const isJson = options.json
+	const configured = []
+	let fallback = false
+
+	const detectedEditors = detectAIEditors(projectRoot)
+
+	if (detectedEditors.length === 0) {
+		// No editor detected — print a helpful hint, don't auto-create files
+		fallback = true
+		if (!isJson) {
+			console.log("")
+			log.info(
+				"To use these skills with your AI coding tool, point your agent to the .lpm/skills/ folder.",
+			)
+		}
+	} else {
+		for (const editor of detectedEditors) {
+			if (editor.action === "symlink" && editor.id === "cursor") {
+				const { created } = symlinkForCursor(projectRoot)
+				if (created.length > 0) {
+					configured.push({
+						id: editor.id,
+						name: editor.name,
+						configPath: editor.configPath,
+						action: "symlinked",
+						files: created,
+					})
+				}
+			} else if (editor.action === "append") {
+				const filePath = path.join(projectRoot, editor.configPath)
+				const added = appendSkillsReference(filePath)
+				if (added) {
+					configured.push({
+						id: editor.id,
+						name: editor.name,
+						configPath: editor.configPath,
+						action: "appended",
+					})
+				}
+			}
+		}
+	}
+
+	// Output
+	if (!isJson && configured.length > 0) {
+		console.log("")
+		console.log(chalk.dim("  Auto-configured for:"))
+		for (const c of configured) {
+			if (c.action === "symlinked") {
+				log.success(
+					`${c.name} (${c.configPath}) — ${c.files.length} file${c.files.length !== 1 ? "s" : ""} linked`,
+				)
+			} else {
+				log.success(`${c.name} (${c.configPath})`)
+			}
+		}
+	}
+
+	return { configured, fallback }
+}

package/lib/quality/display.js

@@ -38,9 +38,9 @@ function progressBar(value, max, width = 18) {
 /**
  * Display quality report in the terminal.
  *
- * @param {{ score: number, checks: Array, meta: object }} result
+ * @param {{ score: number, checks: Array, meta: object, warnings?: string[] }} result
  */
-export function displayQualityReport({ score, checks, meta }) {
+export function displayQualityReport({ score, checks, meta, warnings }) {
 	const tierColor = TIER_COLORS[meta.tier] || chalk.white
 	const tierLabel = TIER_LABELS[meta.tier] || meta.tier
 
@@ -76,6 +76,14 @@ export function displayQualityReport({ score, checks, meta }) {
 		}
 	}
 
+	// Show warnings (e.g., stale skills)
+	if (warnings?.length > 0) {
+		if (failed.length === 0) console.log("")
+		for (const warning of warnings) {
+			console.log(`  ${chalk.yellow("⚠")} ${chalk.yellow(warning)}`)
+		}
+	}
+
 	if (failed.length > 0 && score < 90) {
 		console.log(
 			chalk.dim(

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.2.6",
+	"version": "0.4.0",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {
@@ -29,6 +29,7 @@
 	"files": [
 		"bin",
 		"lib",
+		"scripts",
 		"!lib/__tests__",
 		"index.js",
 		"index.d.ts",
@@ -38,6 +39,7 @@
 	],
 	"scripts": {
 		"prepare": "husky",
+		"postinstall": "node scripts/install-binary.js",
 		"test": "vitest run",
 		"test:watch": "vitest",
 		"lint": "biome check .",

package/scripts/install-binary.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+
+/**
+ * Download the platform-specific LPM Rust binary.
+ *
+ * Runs as a postinstall hook. Downloads the pre-built binary from
+ * lpm.dev/releases and places it in the package's bin/ directory.
+ *
+ * Falls back gracefully to the JS CLI if the binary isn't available
+ * for the current platform.
+ */
+
+import { execSync } from "node:child_process"
+import fs from "node:fs"
+import http from "node:http"
+import https from "node:https"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const pkgDir = path.join(__dirname, "..")
+const binDir = path.join(pkgDir, "bin")
+const binaryPath = path.join(
+	binDir,
+	process.platform === "win32" ? "lpm-bin.exe" : "lpm-bin",
+)
+
+// Platform → binary filename mapping
+const PLATFORM_MAP = {
+	"darwin-arm64": "lpm-darwin-arm64",
+	"darwin-x64": "lpm-darwin-x64",
+	"linux-x64": "lpm-linux-x64",
+	"linux-arm64": "lpm-linux-arm64",
+	"win32-x64": "lpm-win32-x64.exe",
+}
+
+const GITHUB_RELEASES =
+	"https://github.com/lpm-dev/rust-client/releases/download"
+const pkg = JSON.parse(
+	fs.readFileSync(path.join(pkgDir, "package.json"), "utf-8"),
+)
+
+async function main() {
+	const platform = `${process.platform}-${process.arch}`
+	const binaryName = PLATFORM_MAP[platform]
+
+	if (!binaryName) {
+		console.log(`[lpm] No pre-built binary for ${platform}. Using JS CLI.`)
+		return
+	}
+
+	// Skip if binary already exists and is executable
+	if (fs.existsSync(binaryPath)) {
+		try {
+			execSync(`"${binaryPath}" --version`, { stdio: "ignore", timeout: 5000 })
+			return
+		} catch {
+			// Binary exists but broken, re-download
+			fs.unlinkSync(binaryPath)
+		}
+	}
+
+	const url = `${GITHUB_RELEASES}/v${pkg.version}/${binaryName}`
+
+	try {
+		console.log(`[lpm] Downloading native binary for ${platform}...`)
+		await download(url, binaryPath)
+		fs.chmodSync(binaryPath, 0o755)
+		console.log("[lpm] Native binary installed.")
+	} catch (err) {
+		console.log(`[lpm] Binary not available: ${err.message}. Using JS CLI.`)
+		// Clean up partial download
+		if (fs.existsSync(binaryPath)) fs.unlinkSync(binaryPath)
+	}
+}
+
+function download(url, dest, redirects = 0) {
+	if (redirects > 5) return Promise.reject(new Error("Too many redirects"))
+
+	const client = url.startsWith("https") ? https : http
+
+	return new Promise((resolve, reject) => {
+		client
+			.get(url, res => {
+				if (
+					res.statusCode >= 300 &&
+					res.statusCode < 400 &&
+					res.headers.location
+				) {
+					resolve(download(res.headers.location, dest, redirects + 1))
+					return
+				}
+
+				if (res.statusCode !== 200) {
+					reject(new Error(`HTTP ${res.statusCode}`))
+					return
+				}
+
+				const out = fs.createWriteStream(dest)
+				res.pipe(out)
+				out.on("finish", () => {
+					out.close()
+					resolve()
+				})
+				out.on("error", reject)
+			})
+			.on("error", reject)
+	})
+}
+
+main().catch(() => {
+	// Silently fail — JS CLI fallback
+})