@prave/cli 1.1.2 → 1.2.1

package/README.md

@@ -51,6 +51,20 @@ That's enough to be useful. The full vocabulary is below.
 
 > **Multi-agent by default.** `prave install` writes to your primary agent's skills folder (Claude Code by default; configurable via `prave settings`). `prave deploy` then mirrors the Skill to every other agent you've enabled — Cursor, Codex, Gemini, Cline, Amp — converting between their respective rule-file formats automatically.
 
+### `prave sync` in practice
+
+`prave sync` shows you when you last ran it and confirms before doing any work — under 30 minutes ago and the default flips to `n`. Skills then install in parallel (concurrency 4) with a per-Skill progress counter:
+
+```bash
+$ prave sync
+Last sync: 2 hours ago — sync again? [Y/n] y
+Syncing 12 Skills — this takes about 15 seconds.
+✓ 12 / 12 — pr-reviewer
+Synced 12 · failed 0
+```
+
+The `last_sync_at` watermark persists at `~/.prave/state.json`. Pass `--yes` to skip the prompt in CI scripts.
+
 ## Commands
 
 ### Auth & account
@@ -66,7 +80,6 @@ That's enough to be useful. The full vocabulary is below.
 | Command                                                  | What it does                                  |
 | -------------------------------------------------------- | --------------------------------------------- |
 | `prave search <query>`                                   | Search the public Skill registry.             |
-| `prave find <query>` `[--smart\|--local\|--marketplace]` | Cross-source smart search.                    |
 | `prave install <slug>` `[--no-deps]`                     | Install into your agent's skills folder.      |
 | `prave uninstall <slug>`                                 | Remove a locally installed Skill.             |
 | `prave list` `[--remote] [--verbose]`                    | What's installed locally (or remote).         |
@@ -74,13 +87,13 @@ That's enough to be useful. The full vocabulary is below.
 
 ### Authoring & sync
 
-| Command                                         | What it does                                                            |
-| ----------------------------------------------- | ----------------------------------------------------------------------- |
-| `prave import` `[--upload --public\|--private]` | Scan your agent's skills folder, optionally publish to Prave.           |
+| Command                                         | What it does                                                                           |
+| ----------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `prave import` `[--upload --public\|--private]` | Scan your agent's skills folder, optionally publish to Prave.                          |
 | `prave deploy <slug>` `[--agent <name>]`        | Mirror a Skill across enabled agents (Claude / Cursor / Codex / Gemini / Cline / Amp). |
-| `prave sync`                                    | Pull updates for every locally installed Skill.                         |
-| `prave update [<slug>]` `[--dry-run]`           | Diff installed Skills against the registry, pull what's outdated.       |
-| `prave diff <slug>`                             | Local vs registry side-by-side diff.                                    |
+| `prave sync`                                    | Pull updates for every locally installed Skill.                                        |
+| `prave update [<slug>]` `[--dry-run]`           | Diff installed Skills against the registry, pull what's outdated.                      |
+| `prave diff <slug>`                             | Local vs registry side-by-side diff.                                                   |
 
 ### Intelligence
 
@@ -93,12 +106,12 @@ That's enough to be useful. The full vocabulary is below.
 
 ### Usage tracking _(Pro+)_
 
-| Command                           | What it does                                                 |
-| --------------------------------- | ------------------------------------------------------------ |
-| `prave usage hook install`        | Real-time invocation tracking for agents that support it.    |
-| `prave usage hook uninstall`      | Remove the real-time hook.                                   |
-| `prave usage scan` `[--since 7d]` | Transcript scanner — backfill recent invocations.            |
-| `prave usage status`              | Hook health, recent counts, and top Skills.                  |
+| Command                           | What it does                                              |
+| --------------------------------- | --------------------------------------------------------- |
+| `prave usage hook install`        | Real-time invocation tracking for agents that support it. |
+| `prave usage hook uninstall`      | Remove the real-time hook.                                |
+| `prave usage scan` `[--since 7d]` | Transcript scanner — backfill recent invocations.         |
+| `prave usage status`              | Hook health, recent counts, and top Skills.               |
 
 > **Coverage today:** Real-time tracking lives natively on Claude Code via its plugin contract. For every other agent, the **transcript scanner** auto-runs at the tail of `prave sync` and reads the agent's local conversation history to extract Skill invocations — so Intelligence and the optimiser stay accurate everywhere. Real-time hooks for Cursor / Codex / Gemini / Cline / Amp ship as soon as those agents expose an equivalent contract.
 

package/dist/commands/conflicts.js

@@ -1,9 +1,47 @@
+import { stat } from 'node:fs/promises';
+import { join } from 'node:path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { track } from '../lib/analytics.js';
 import { api, ApiError } from '../lib/api.js';
+import { CONFIG } from '../lib/config.js';
 import { requireAuth } from '../lib/credentials.js';
+import { checkboxPrompt } from '../lib/prompt.js';
+import { isValidSlug } from '../lib/slug.js';
 import { log } from '../utils/logger.js';
+import { uninstallCommand } from './uninstall.js';
+/**
+ * Resolve a `skill_metadata` row back to its on-disk slug, mirroring
+ * the canonical `~/.claude/skills/<slug>/SKILL.md` layout used by
+ * `prave optimize --remove-unused`. Returns `null` when the slug
+ * fails the registry regex (defence against `..` injection via a
+ * malformed `file_path`).
+ */
+function slugOf(s) {
+    const segs = s.file_path?.split('/').filter(Boolean) ?? [];
+    let candidate = null;
+    if (segs.length >= 2) {
+        const last = segs[segs.length - 1];
+        const parent = segs[segs.length - 2];
+        if (last.toLowerCase().endsWith('skill.md'))
+            candidate = parent;
+    }
+    if (!candidate && s.name) {
+        candidate = s.name.trim().toLowerCase().replace(/\s+/g, '-');
+    }
+    if (!candidate)
+        return null;
+    return isValidSlug(candidate) ? candidate : null;
+}
+async function existsOnDisk(slug) {
+    try {
+        const st = await stat(join(CONFIG.skillsDir, slug));
+        return st.isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
 function describe(c) {
     const a = c.skill_a_name ?? c.skill_a_id;
     const b = c.skill_b_name ?? c.skill_b_id;
@@ -44,8 +82,70 @@ export async function conflictsCommand(opts = {}) {
             console.log(`${chalk.yellow('⚠️ ')} ${describe(c)}`);
         }
         if (opts.fix) {
+            // Interactive resolution: the most common (and safest) fix for a
+            // conflict is uninstalling one of the two competing Skills. We
+            // build a checkbox list of the unique slugs that appear in the
+            // conflict set, restricted to ones we can resolve back to a real
+            // on-disk folder (so we never offer to "uninstall" something the
+            // user hasn't actually got installed).
+            let metadata = [];
+            try {
+                const { data } = await api.get('/api/v1/intelligence/skills', true);
+                metadata = data;
+            }
+            catch (err) {
+                log.warn(`Could not fetch skill metadata — ${err.message}`);
+            }
+            // Tally how many conflicts each Skill participates in. Heuristic:
+            // a skill that conflicts with two others is the strongest fix
+            // candidate (uninstalling it resolves multiple rows at once), so
+            // we surface it first.
+            const conflictCount = new Map();
+            for (const c of conflicts) {
+                conflictCount.set(c.skill_a_id, (conflictCount.get(c.skill_a_id) ?? 0) + 1);
+                conflictCount.set(c.skill_b_id, (conflictCount.get(c.skill_b_id) ?? 0) + 1);
+            }
+            const candidates = [];
+            const seen = new Set();
+            for (const m of metadata) {
+                if (!conflictCount.has(m.id))
+                    continue;
+                const slug = slugOf(m);
+                if (!slug || seen.has(slug))
+                    continue;
+                if (!(await existsOnDisk(slug)))
+                    continue;
+                seen.add(slug);
+                candidates.push({
+                    slug,
+                    name: m.name ?? slug,
+                    count: conflictCount.get(m.id) ?? 1,
+                });
+            }
+            candidates.sort((a, b) => b.count - a.count || a.slug.localeCompare(b.slug));
+            if (candidates.length === 0) {
+                console.log();
+                log.dim('Nothing to auto-fix — no conflicting Skills are installed under ~/.claude/skills/. ' +
+                    'Run `prave whatdoes <skill>` to inspect frontmatter and resolve manually.');
+                return;
+            }
+            console.log();
+            const picks = await checkboxPrompt('Select Skills to uninstall:', candidates.map((c) => ({
+                value: c.slug,
+                label: c.name,
+                hint: c.count > 1
+                    ? `${c.count} conflicts · ${c.slug}`
+                    : `1 conflict · ${c.slug}`,
+            })));
+            if (!picks || picks.length === 0) {
+                log.dim('Aborted — nothing removed.');
+                return;
+            }
+            for (const slug of picks) {
+                await uninstallCommand(slug);
+            }
             console.log();
-            log.dim('Interactive fix coming soon — for now run `prave whatdoes <skill>` and adjust frontmatter manually.');
+            log.dim(`Removed ${picks.length} skill(s). Run ${chalk.cyan('prave sync')} to refresh server-side metadata.`);
         }
     }
     catch (err) {

package/dist/commands/import.js

@@ -1,5 +1,6 @@
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
+import { createInterface } from 'node:readline/promises';
 import chalk from 'chalk';
 import ora from 'ora';
 import { track } from '../lib/analytics.js';
@@ -74,8 +75,42 @@ export async function importCommand(opts) {
         }
         return;
     }
-    // Visibility is required on every upload — no silent default.
-    if (opts.public === opts.private) {
+    // Visibility resolution. Order:
+    //   1. Explicit flags win — covers CI / scripted usage.
+    //   2. Interactive TTY with no flags → prompt the user (default: private,
+    //      because mistakenly making private notes public is far worse than
+    //      mistakenly keeping public ones private).
+    //   3. Non-TTY with no flags → hard error so a script never silently
+    //      uploads to the wrong visibility.
+    let visibility;
+    if (opts.public !== opts.private) {
+        visibility = opts.private ? 'private' : 'public';
+    }
+    else if (process.stdin.isTTY && skills.length > 0) {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            const ans = (await rl.question(`\nUpload ${skills.length} local Skill${skills.length === 1 ? '' : 's'} as PUBLIC (visible in marketplace) or PRIVATE (only your account)? [public/private/cancel] `))
+                .trim()
+                .toLowerCase();
+            if (ans === 'cancel' || ans === 'c' || ans === 'q' || ans === 'quit') {
+                log.dim('Upload cancelled.');
+                return;
+            }
+            if (ans === 'public' || ans === 'pub') {
+                visibility = 'public';
+            }
+            else {
+                // Default to private on blank input or anything else (including
+                // ambiguous abbreviations like "p"). Better to upload-private and
+                // re-publish than to leak.
+                visibility = 'private';
+            }
+        }
+        finally {
+            rl.close();
+        }
+    }
+    else {
         log.warn('Specify visibility: --public or --private (one is required on upload).');
         log.dim('Examples:');
         log.dim('  prave import --upload --private    # only you can see them');
@@ -83,7 +118,6 @@ export async function importCommand(opts) {
         process.exitCode = 1;
         return;
     }
-    const visibility = opts.private ? 'private' : 'public';
     // Plan gate: authoring (public + private) is Pro+. Free is read-only on
     // the registry side — discover, install, bookmark, but no upload.
     const me = await fetchMyPlan();

package/dist/commands/install.js

@@ -73,7 +73,13 @@ export async function installCommand(slug, opts = {}) {
             await pullOne(s, { hasSession: true, force: Boolean(opts.force) });
         }
         installedSlugs = slugs;
-        spinner.succeed(`Installed ${slugs.length} skill${slugs.length === 1 ? '' : 's'} → ${CONFIG.skillsDir}`);
+        // Root slug = the user-requested one (last item by depth-sort), deps are
+        // the remaining ones. If `--no-deps` was passed, slugs is just [slug].
+        const depCount = slugs.length - 1;
+        const summary = depCount > 0
+            ? `Installed ${slug} + ${depCount} dep${depCount === 1 ? '' : 's'} → ${CONFIG.skillsDir}`
+            : `Installed ${slug} → ${CONFIG.skillsDir}`;
+        spinner.succeed(summary);
         if (slugs.length > 1) {
             log.dim(`   chain: ${slugs.join(' → ')}`);
         }

package/dist/commands/optimize.js

@@ -1,9 +1,13 @@
+import { stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import readline from 'node:readline/promises';
 import chalk from 'chalk';
 import ora from 'ora';
-import readline from 'node:readline/promises';
 import { track } from '../lib/analytics.js';
 import { api, ApiError } from '../lib/api.js';
+import { CONFIG } from '../lib/config.js';
 import { requireAuth } from '../lib/credentials.js';
+import { checkboxPrompt } from '../lib/prompt.js';
 import { isValidSlug } from '../lib/slug.js';
 import { log } from '../utils/logger.js';
 import { uninstallCommand } from './uninstall.js';
@@ -40,6 +44,15 @@ function slugOf(s) {
     // injected via a malformed `file_path`.
     return isValidSlug(candidate) ? candidate : null;
 }
+async function existsOnDisk(slug) {
+    try {
+        const st = await stat(join(CONFIG.skillsDir, slug));
+        return st.isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
 async function confirmYesNo(question) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     try {
@@ -121,10 +134,57 @@ export async function optimizeCommand(opts = {}) {
             log.dim(`Removed ${candidates.length} skill(s). Run ${chalk.cyan('prave sync')} to update server-side metadata.`);
         }
         else if (opts.apply) {
+            // `--apply` is the unified interactive cleanup: pick from the
+            // *underused* + *heavy* lists at once and uninstall whatever the
+            // user agrees to. This is strictly safer than blanket-deleting
+            // because every selection is opt-in.
+            //
+            // Merge candidates are intentionally NOT auto-actionable — merging
+            // two Skills is a content-rewrite that the user has to do by hand.
+            // We surface them above and leave them for the suggestions panel.
+            const offer = [];
+            const seen = new Set();
+            const push = (skill, bucket) => {
+                const slug = slugOf(skill);
+                if (!slug || seen.has(slug))
+                    return;
+                seen.add(slug);
+                offer.push({ slug, skill, bucket });
+            };
+            for (const s of data.underused)
+                push(s, 'underused');
+            for (const s of data.heavy)
+                push(s, 'heavy');
+            // Filter to ones actually present on disk — the API returns
+            // metadata for slug-keyed self-heal stubs that may not have a
+            // matching folder.
+            const installed = [];
+            for (const item of offer) {
+                if (await existsOnDisk(item.slug))
+                    installed.push(item);
+            }
+            if (installed.length === 0) {
+                console.log();
+                log.dim('Nothing on disk to clean up — every flagged skill is either uninstalled already or only relevant to merge candidates (which need a manual rewrite).');
+                return;
+            }
+            console.log();
+            const picks = await checkboxPrompt('Pick skills to uninstall:', installed.map((i) => ({
+                value: i.slug,
+                label: nameOf(i.skill),
+                hint: i.bucket === 'underused'
+                    ? `underused · ${formatTokens(i.skill.estimated_tokens)} · ${i.slug}`
+                    : `heavy · ${formatTokens(i.skill.estimated_tokens)} · ${i.slug}`,
+            })));
+            if (!picks || picks.length === 0) {
+                log.dim('Aborted — nothing removed.');
+                return;
+            }
+            for (const slug of picks) {
+                await uninstallCommand(slug);
+            }
             console.log();
-            log.dim('Auto-apply not available — use ' +
-                chalk.cyan('prave optimize --remove-unused') +
-                ' to delete underused skills, or review the suggestions and adjust manually.');
+            log.dim(`Removed ${picks.length} skill(s). Run ${chalk.cyan('prave sync')} to refresh server-side metadata.`);
         }
     }
     catch (err) {

package/dist/commands/search.js

@@ -2,6 +2,18 @@ import chalk from 'chalk';
 import { track } from '../lib/analytics.js';
 import { api } from '../lib/api.js';
 import { log } from '../utils/logger.js';
+const SLUG_COL = 32;
+function formatInstalls(n) {
+    // Thousands separator. Locale-pinned to en-US so CI snapshots stay stable.
+    return n.toLocaleString('en-US');
+}
+function truncate(text, max) {
+    if (text.length <= max)
+        return text;
+    if (max <= 1)
+        return '…';
+    return text.slice(0, max - 1) + '…';
+}
 export async function searchCommand(query) {
     track('cli_search', { length: query.length });
     const { data: skills } = await api.get(`/api/v1/skills?q=${encodeURIComponent(query)}&limit=25`);
@@ -9,7 +21,24 @@ export async function searchCommand(query) {
         log.dim(`No skills match "${query}".`);
         return;
     }
+    console.log(chalk.dim(`  ${skills.length} results`));
+    const cols = process.stdout.columns ?? 80;
+    // Description is indented 4 spaces. Reserve 1 char for the trailing
+    // ellipsis, leave the rest for content.
+    const descBudget = Math.max(20, cols - 4);
     for (const s of skills) {
-        console.log(`  ${chalk.cyan('•')} ${s.slug}  ${chalk.dim(s.description ?? '')}  ${chalk.magenta(`↓ ${s.install_count}`)}`);
+        const installsText = `↓ ${formatInstalls(s.install_count)}`;
+        const slugCell = s.slug.padEnd(SLUG_COL, ' ');
+        console.log(`  ${chalk.cyan('•')} ${slugCell}${chalk.magenta(installsText)}`);
+        const desc = s.description?.trim();
+        if (desc) {
+            console.log(`    ${chalk.dim(truncate(desc, descBudget))}`);
+        }
+        else {
+            console.log(`    ${chalk.dim('(no description)')}`);
+        }
+    }
+    if (skills.length > 0) {
+        console.log(chalk.dim('  → prave install <slug>'));
     }
 }

package/dist/commands/settings.js

@@ -100,14 +100,6 @@ async function configureOs(rl, current) {
     log.success(`OS set to ${updated.detected_os}`);
     return updated;
 }
-async function showAccount() {
-    console.log();
-    log.dim('Account info:');
-    log.dim(`  API: ${CONFIG.apiUrl}`);
-    log.dim(`  Credentials: ${CONFIG.credentialsPath}`);
-    log.dim(`  Local config: ${CONFIG.configPath}`);
-    log.dim('Run `prave whoami` for full identity, or `prave logout` to sign out.');
-}
 export async function settingsCommand() {
     const _session = await requireAuth("prave settings");
     if (!_session)
@@ -129,9 +121,8 @@ export async function settingsCommand() {
             console.log(`  ${chalk.cyan('1)')} Agent Configuration`);
             console.log(`  ${chalk.cyan('2)')} Skill Paths`);
             console.log(`  ${chalk.cyan('3)')} OS Settings`);
-            console.log(`  ${chalk.cyan('4)')} Account`);
-            console.log(`  ${chalk.cyan('5)')} Exit`);
-            const ans = (await rl.question('\nChoose [1-5]: ')).trim();
+            console.log(`  ${chalk.cyan('4)')} Exit`);
+            const ans = (await rl.question('\nChoose [1-4]: ')).trim();
             try {
                 if (ans === '1')
                     current = await configureAgents(rl, current);
@@ -139,9 +130,7 @@ export async function settingsCommand() {
                     current = await configurePaths(rl, current);
                 else if (ans === '3')
                     current = await configureOs(rl, current);
-                else if (ans === '4')
-                    await showAccount();
-                else if (ans === '5' || ans === '' || ans.toLowerCase() === 'exit') {
+                else if (ans === '4' || ans === '' || ans.toLowerCase() === 'exit') {
                     break;
                 }
                 else {

package/dist/commands/sync.js

@@ -7,18 +7,64 @@ import { track } from '../lib/analytics.js';
 import { CONFIG } from '../lib/config.js';
 import { requireAuth } from '../lib/credentials.js';
 import { fetchMyPlan, formatUpgradeHint } from '../lib/plan.js';
+import { readState, writeState } from '../lib/state.js';
+import { formatRelative, msSince } from '../lib/time.js';
 import { log } from '../utils/logger.js';
 import { installCommand } from './install.js';
+/**
+ * Empirical per-skill timing — `installCommand` does ~1 registry GET +
+ * ~1 file write + ~1 best-effort POST analyze, which clocks in around
+ * 0.4s on a warm connection. With concurrency=4 we approximate effective
+ * ~0.4s per skill / 4 ≈ 0.1s, but include a safety multiplier so the
+ * estimate doesn't oversell. End result: estimate ~ 0.15s/skill, rounded
+ * to nearest 5s with a 5s floor.
+ */
+const SECONDS_PER_SKILL = 0.15;
+const SYNC_CONCURRENCY = 4;
+function estimateSeconds(count) {
+    const raw = count * SECONDS_PER_SKILL;
+    const rounded = Math.round(raw / 5) * 5;
+    return Math.max(5, rounded);
+}
+/**
+ * Inline concurrency limiter — runs `fn(item)` for each item, never letting
+ * more than `limit` promises be in-flight at once. Returns when all settle.
+ *
+ * We deliberately avoid `Promise.all` over the full list to keep the agent
+ * gentle on the API and on the user's disk; ~3-4x throughput vs sequential
+ * is the goal, not "fire 200 requests at once".
+ */
+async function runWithConcurrency(items, limit, fn) {
+    const results = new Array(items.length);
+    let cursor = 0;
+    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (true) {
+            const i = cursor++;
+            if (i >= items.length)
+                return;
+            results[i] = await fn(items[i], i);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}
 /**
  * `prave sync` — re-pulls every locally installed Skill from the
  * registry. Picks up SKILL.md edits without the user having to remember
  * each slug.
  *
- * The deploy-to-all-agents question is asked ONCE up-front for the entire
- * queue (regression fix: it used to fire per Skill, forcing the user to
- * mash `y` 30 times). The answer is then threaded into every
- * `installCommand` invocation via `skipDeployPrompt: true` and we run a
- * single batched deploy at the end.
+ * Behaviours layered on top of the basic loop:
+ *   • Last-sync timestamp persisted to ~/.prave/state.json — used to nudge
+ *     against accidental rapid re-syncs (<30 min) and to skip the prompt
+ *     entirely on the first ever run.
+ *   • Concurrency-limited parallel pulls (4 in flight) — ~3-4x faster than
+ *     the previous sequential loop.
+ *   • Per-skill progress: spinner text ticks "Installed N / M — slug" so
+ *     the user can see actual liveness on slow connections.
+ *   • The deploy-to-all-agents question is asked ONCE up-front for the
+ *     entire queue and threaded into every `installCommand` invocation
+ *     via `skipDeployPrompt: true`. A single batched deploy runs at the
+ *     end.
  */
 export async function syncCommand() {
     track('cli_sync');
@@ -33,6 +79,38 @@ export async function syncCommand() {
         log.dim(formatUpgradeHint('explorer'));
         return;
     }
+    // Last-sync nudge. We read state up-front because if the user bails on
+    // the prompt we don't want to overwrite their last-sync timestamp.
+    const state = await readState();
+    if (state.last_sync_at) {
+        const since = msSince(state.last_sync_at);
+        const pretty = formatRelative(state.last_sync_at);
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        let proceed = true;
+        try {
+            // Stronger nudge when the user just synced (<30 min). Default flips
+            // to "no" — they almost certainly hit the wrong command.
+            if (since !== null && since < 30 * 60 * 1000) {
+                const ans = (await rl.question(`Last sync: ${pretty}. Sync again? [y/N] `))
+                    .trim()
+                    .toLowerCase();
+                proceed = ans === 'y' || ans === 'yes';
+            }
+            else {
+                const ans = (await rl.question(`Last sync: ${pretty}. Sync again? [Y/n] `))
+                    .trim()
+                    .toLowerCase();
+                proceed = ans === '' || ans === 'y' || ans === 'yes';
+            }
+        }
+        finally {
+            rl.close();
+        }
+        if (!proceed) {
+            log.dim('Sync cancelled.');
+            return;
+        }
+    }
     const spinner = ora('Scanning local Skills…').start();
     let entries = [];
     try {
@@ -53,6 +131,9 @@ export async function syncCommand() {
         return;
     }
     spinner.succeed(`Found ${slugs.length} installed Skill${slugs.length === 1 ? '' : 's'}.`);
+    // Pre-flight time estimate — sets expectations before the user hits Y.
+    const estSeconds = estimateSeconds(slugs.length);
+    console.log(chalk.dim(`Syncing ${slugs.length} Skill${slugs.length === 1 ? '' : 's'} — this takes about ${estSeconds} seconds.`));
     // Ask the deploy question ONCE for the whole batch.
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     let deployAfter = false;
@@ -65,19 +146,34 @@ export async function syncCommand() {
     finally {
         rl.close();
     }
+    // Parallel install with live progress counter.
+    const progress = ora(`Installed 0 / ${slugs.length}`).start();
+    let done = 0;
     let updated = 0;
     let failed = 0;
-    for (const slug of slugs) {
+    await runWithConcurrency(slugs, SYNC_CONCURRENCY, async (slug) => {
         try {
             await installCommand(slug, { noDeps: true, skipDeployPrompt: true });
             updated++;
         }
         catch {
             failed++;
-            console.log(chalk.red(`  ✗ ${slug}`));
         }
+        finally {
+            done++;
+            progress.text = `Installed ${done} / ${slugs.length} — ${slug}`;
+        }
+    });
+    if (failed === 0) {
+        progress.succeed(`Synced ${updated} / ${slugs.length}`);
+    }
+    else {
+        progress.warn(`Synced ${updated} · failed ${failed}`);
     }
-    log.dim(`\nSynced ${updated} · failed ${failed}`);
+    // Persist last-sync timestamp regardless of partial failures — the user
+    // *did* attempt a sync, and we want the cooldown to apply to retries
+    // just as much as to the happy path.
+    await writeState({ last_sync_at: new Date().toISOString() }).catch(() => { });
     if (deployAfter && updated > 0) {
         const { deployCommand } = await import('./deploy.js');
         log.info(`\nDeploying ${updated} Skills to configured agents…`);

package/dist/commands/usage.js

@@ -104,45 +104,59 @@ export async function usageScanCommand(opts) {
     }
 }
 /**
- * `prave usage report` — invoked by the Claude Code `PostToolUse` hook.
+ * `prave usage report` — invoked by the Claude Code `PostToolUse` hook
+ * (and, when `--source=prompt`, the companion `UserPromptSubmit` hook).
  * Reads the hook payload from stdin, extracts the Skill name, and fires
  * a single-event POST against the slug-keyed self-healing endpoint.
  * Errors are silent (we never want a hook failure to disturb the user's
- * workflow); set `PRAVE_DEBUG=1` to see what's happening in
- * `~/.prave/usage.log`.
+ * workflow); a rotated `~/.prave/hook.log` always captures the last 200
+ * fires so users can verify telemetry without flipping `PRAVE_DEBUG=1`.
+ *
+ * Hook discipline:
+ *   - reads stdin with a 250 ms cap so we never block Claude Code
+ *   - one POST attempt with a hard 4 s deadline (background-friendly)
+ *   - on auth/network failure we log + bail; never throw
  */
-export async function usageReportCommand() {
+export async function usageReportCommand(opts = {}) {
     const debug = process.env.PRAVE_DEBUG === '1' || process.env.PRAVE_DEBUG === 'true';
+    const source = opts.source === 'prompt' ? 'prompt' : 'tool';
+    await rotateHookLog();
     const stdinPayload = await readStdin();
     if (!stdinPayload) {
+        await hookLog(`${source}:no-stdin`);
         if (debug)
             await debugLog('no stdin payload');
         return;
     }
     if (debug)
-        await debugLog(`stdin len=${stdinPayload.length}`);
+        await debugLog(`stdin len=${stdinPayload.length} source=${source}`);
     // Claude Code's PostToolUse payload is documented as `{tool_name,
-    // tool_input, tool_response, ...}`, but we still defend against
-    // alternate shapes (capitalisation, future schema drift) so the hook
-    // doesn't silently break on a single field rename.
+    // tool_input, tool_response, ...}`. UserPromptSubmit ships
+    // `{ prompt, ... }`. We defend against alternate shapes (capitalisation,
+    // future schema drift) so the hook doesn't silently break on a single
+    // field rename.
     let parsed = {};
     try {
         parsed = JSON.parse(stdinPayload);
     }
     catch {
+        await hookLog(`${source}:bad-json`);
         if (debug)
             await debugLog('payload is not valid JSON');
         return;
     }
-    const rawSlug = extractSkillSlug(parsed);
+    const rawSlug = source === 'prompt' ? extractSlashCommand(parsed) : extractSkillSlug(parsed);
     if (!rawSlug) {
+        await hookLog(`${source}:no-slug`);
         if (debug)
             await debugLog(`no skill slug in payload: ${stdinPayload.slice(0, 200)}`);
         return;
     }
     const slug = rawSlug.toLowerCase().split(':').pop()?.trim().replace(/[^a-z0-9_-]+/g, '-');
-    if (!slug)
+    if (!slug) {
+        await hookLog(`${source}:empty-slug`);
         return;
+    }
     if (debug)
         await debugLog(`slug=${slug}`);
     const session = await requireAuthSilent();
@@ -183,18 +197,46 @@ export async function usageReportCommand() {
             slug,
             agent_type: 'claude',
             triggered_at: new Date().toISOString(),
-            meta,
+            meta: { ...meta, source },
         }, true);
+        await hookLog(`${source}:ok slug=${slug} recorded=${data.recorded} stub=${data.created_stub}`);
         if (debug) {
             await debugLog(`ok recorded=${data.recorded} stub=${data.created_stub} meta=${JSON.stringify(meta)}`);
         }
     }
     catch (err) {
+        const msg = err.message;
+        await hookLog(`${source}:err slug=${slug} ${msg.slice(0, 120)}`);
         if (debug)
-            await debugLog(`error: ${err.message}`);
+            await debugLog(`error: ${msg}`);
         /* silent — never break the host shell */
     }
 }
+/**
+ * Extract a slash-command name from a UserPromptSubmit payload. Claude
+ * Code ships `{ prompt: '/graphify ...' }` (and tolerates leading
+ * whitespace). We treat the first whitespace-separated token after `/`
+ * as the slug. Returns `null` for non-slash prompts so we don't waste
+ * an API hop on every keystroke.
+ */
+function extractSlashCommand(payload) {
+    const candidates = [
+        payload.prompt,
+        payload.user_prompt,
+        payload.input,
+    ];
+    for (const c of candidates) {
+        if (typeof c !== 'string')
+            continue;
+        const trimmed = c.trimStart();
+        if (!trimmed.startsWith('/'))
+            continue;
+        const token = trimmed.slice(1).split(/[\s\n\r]/, 1)[0] ?? '';
+        if (token)
+            return token;
+    }
+    return null;
+}
 /**
  * Walk the hook payload looking for the invoked Skill's slug. Tries the
  * documented Claude Code path first, then several plausible aliases so
@@ -226,6 +268,45 @@ async function debugLog(line) {
         /* swallow — debug is best-effort */
     }
 }
+/**
+ * Always-on per-fire breadcrumb log so users can answer "did the hook
+ * run?" without flipping `PRAVE_DEBUG=1`. Capped at 200 lines (rotated
+ * lazily by `rotateHookLog`). Lives at `~/.prave/hook.log`.
+ */
+async function hookLog(line) {
+    try {
+        const { mkdir, appendFile } = await import('node:fs/promises');
+        const { join } = await import('node:path');
+        await mkdir(CONFIG.praveDir, { recursive: true });
+        const stamp = new Date().toISOString();
+        await appendFile(join(CONFIG.praveDir, 'hook.log'), `${stamp} ${line}\n`);
+    }
+    catch {
+        /* swallow */
+    }
+}
+const HOOK_LOG_MAX_LINES = 200;
+async function rotateHookLog() {
+    try {
+        const { stat, readFile, writeFile } = await import('node:fs/promises');
+        const { join } = await import('node:path');
+        const path = join(CONFIG.praveDir, 'hook.log');
+        const info = await stat(path).catch(() => null);
+        // Only do the read-rewrite dance occasionally — when the file gets
+        // big enough that we suspect overflow. 32 KB ≈ 200 short lines.
+        if (!info || info.size < 32 * 1024)
+            return;
+        const raw = await readFile(path, 'utf8');
+        const lines = raw.split('\n');
+        if (lines.length <= HOOK_LOG_MAX_LINES)
+            return;
+        const trimmed = lines.slice(-HOOK_LOG_MAX_LINES).join('\n');
+        await writeFile(path, trimmed, 'utf8');
+    }
+    catch {
+        /* swallow */
+    }
+}
 export async function usageHookInstallCommand() {
     track('cli_usage_hook_install');
     const session = await requireAuth('prave usage hook install');
@@ -269,16 +350,22 @@ export async function usageStatusCommand() {
     const { readFile } = await import('node:fs/promises');
     const { join } = await import('node:path');
     const { homedir } = await import('node:os');
-    // 1. Hook installed?
+    // 1. Hook installed? Check both channels we manage.
     const settingsPath = join(homedir(), '.claude', 'settings.json');
-    let hookInstalled = false;
+    let toolHookInstalled = false;
+    let promptHookInstalled = false;
     try {
         const raw = await readFile(settingsPath, 'utf8');
-        hookInstalled = raw.includes('__prave_managed') && raw.includes('Skill');
+        const parsed = JSON.parse(raw);
+        toolHookInstalled =
+            (parsed.hooks?.PostToolUse ?? []).some((b) => b.matcher === 'Skill' && (b.hooks ?? []).some((h) => h.__prave_managed === true));
+        promptHookInstalled =
+            (parsed.hooks?.UserPromptSubmit ?? []).some((b) => (b.hooks ?? []).some((h) => h.__prave_managed === true));
     }
     catch {
         /* no settings.json yet */
     }
+    const hookInstalled = toolHookInstalled && promptHookInstalled;
     // 2. Last 7 days of recorded events from the API.
     let recent7 = 0;
     let topSlugs = [];
@@ -300,14 +387,33 @@ export async function usageStatusCommand() {
     catch {
         /* never scanned */
     }
-    // 4. Debug log tail.
-    const logPath = join(CONFIG.praveDir, 'usage.log');
-    const debugAvailable = existsSync(logPath);
+    // 4. Debug log + hook log tails.
+    const debugLogPath = join(CONFIG.praveDir, 'usage.log');
+    const hookLogPath = join(CONFIG.praveDir, 'hook.log');
+    const debugAvailable = existsSync(debugLogPath);
+    const hookLogAvailable = existsSync(hookLogPath);
+    // 5. API reachability — token-validating ping. We already passed
+    // `requireAuth` above so the credentials file exists; this round-trip
+    // just confirms the access_token is still accepted server-side. If the
+    // hook has been silently 401-ing for a week, this is the only way the
+    // user finds out without flipping `PRAVE_DEBUG=1`.
+    let apiReachable = false;
+    let apiMessage = '';
+    try {
+        await api.get('/api/v1/intelligence/usage/recent?days=1', true);
+        apiReachable = true;
+    }
+    catch (err) {
+        apiMessage =
+            err instanceof ApiError ? `${err.status} ${err.message}` : err.message;
+    }
     // Render.
-    const checkmark = (ok) => (ok ? chalk.green('✓') : chalk.dim('—'));
+    const checkmark = (ok) => (ok ? chalk.green('✓') : chalk.red('✗'));
     log.info(chalk.bold('Usage tracking status'));
     console.log();
-    console.log(`  ${checkmark(hookInstalled)} Real-time hook (Claude Code): ${hookInstalled ? chalk.green('installed') : chalk.yellow('not installed — `prave usage hook install`')}`);
+    console.log(`  ${checkmark(toolHookInstalled)} PostToolUse hook (Skill tool fires): ${toolHookInstalled ? chalk.green('installed') : chalk.yellow('missing — `prave usage hook install`')}`);
+    console.log(`  ${checkmark(promptHookInstalled)} UserPromptSubmit hook (slash commands like /graphify): ${promptHookInstalled ? chalk.green('installed') : chalk.yellow('missing — `prave usage hook install`')}`);
+    console.log(`  ${checkmark(apiReachable)} API reachable + auth valid: ${apiReachable ? chalk.green('yes') : chalk.red(apiMessage || 'no')}`);
     console.log(`  ${checkmark(Boolean(lastScanAt))} Transcript scanner watermark: ${lastScanAt ?? chalk.dim('never run — `prave sync` includes it')}`);
     console.log(`  ${checkmark(recent7 > 0)} Events in last 7 days: ${chalk.cyan(String(recent7))}`);
     if (topSlugs.length) {
@@ -317,20 +423,41 @@ export async function usageStatusCommand() {
             console.log(`    ${chalk.cyan(s.count.toString().padStart(4))}  ${s.name}`);
         }
     }
-    console.log();
-    if (debugAvailable) {
-        log.dim(`Debug log: ${logPath}`);
-        log.dim('Set PRAVE_DEBUG=1 in your shell to enable verbose hook logging.');
-    }
-    else {
-        log.dim('No debug log yet. Set PRAVE_DEBUG=1 to capture every hook fire to ~/.prave/usage.log');
+    // Last 5 hook fires — the breadcrumb trail that answers "did the hook
+    // even run when I typed /graphify?". Read the bottom of hook.log.
+    if (hookLogAvailable) {
+        try {
+            const raw = await readFile(hookLogPath, 'utf8');
+            const tail = raw.trimEnd().split('\n').slice(-5);
+            if (tail.length) {
+                console.log();
+                console.log(chalk.dim('  Last hook fires:'));
+                for (const line of tail)
+                    console.log(`    ${chalk.dim(line)}`);
+            }
+        }
+        catch {
+            /* swallow */
+        }
     }
-    if (recent7 === 0) {
+    console.log();
+    log.dim(`Hook breadcrumb log: ${hookLogPath}`);
+    if (debugAvailable)
+        log.dim(`Verbose debug log:    ${debugLogPath}`);
+    log.dim('Set PRAVE_DEBUG=1 in your shell to enable verbose hook logging.');
+    if (!hookInstalled || !apiReachable || recent7 === 0) {
         console.log();
-        log.warn('No events recorded yet. Quick checks:');
-        log.dim('  1. Is the hook installed? See checkmarks above.');
-        log.dim('  2. Run a Skill in Claude Code, then `tail ~/.prave/usage.log` (with PRAVE_DEBUG=1)');
-        log.dim('  3. Or run `prave usage scan --since 7d` to backfill from transcripts.');
+        log.warn('Telemetry may be incomplete. Suggested fixes:');
+        if (!toolHookInstalled || !promptHookInstalled) {
+            log.dim('  • Run `prave usage hook install` to wire BOTH PostToolUse and UserPromptSubmit.');
+        }
+        if (!apiReachable) {
+            log.dim('  • Run `prave login` — your access token may have expired (silently 401-ing).');
+        }
+        if (recent7 === 0 && hookInstalled && apiReachable) {
+            log.dim('  • Run a Skill in Claude Code, then re-run `prave usage status`.');
+            log.dim('  • Or run `prave usage scan --since 7d` to backfill from transcripts.');
+        }
     }
 }
 async function fetchEnabledAgents() {
@@ -414,13 +541,37 @@ function parseSinceFlag(raw) {
 async function readStdin() {
     if (process.stdin.isTTY)
         return '';
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
-        if (Buffer.concat(chunks).length > 1_000_000)
-            break;
-    }
-    return Buffer.concat(chunks).toString('utf8');
+    // Hard 1.5 s cap so a stuck pipe never blocks Claude Code's tool flow.
+    // 1 MB payload cap so a runaway stream can't OOM the hook either.
+    return new Promise((resolve) => {
+        const chunks = [];
+        let total = 0;
+        let settled = false;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(Buffer.concat(chunks).toString('utf8'));
+        };
+        const timer = setTimeout(finish, 1500);
+        process.stdin.on('data', (chunk) => {
+            const buf = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+            chunks.push(buf);
+            total += buf.length;
+            if (total > 1_000_000) {
+                clearTimeout(timer);
+                finish();
+            }
+        });
+        process.stdin.once('end', () => {
+            clearTimeout(timer);
+            finish();
+        });
+        process.stdin.once('error', () => {
+            clearTimeout(timer);
+            finish();
+        });
+    });
 }
 /**
  * Auth check with no UX side-effects. Used by the hook so a logged-out

package/dist/index.js

@@ -7,7 +7,6 @@ import { conflictsCommand } from './commands/conflicts.js';
 import { deployCommand } from './commands/deploy.js';
 import { diffCommand } from './commands/diff.js';
 import { exportCommand } from './commands/export.js';
-import { findCommand } from './commands/find.js';
 import { importCommand } from './commands/import.js';
 import { installCommand } from './commands/install.js';
 import { listCommand } from './commands/list.js';
@@ -120,12 +119,12 @@ program
 program
     .command('conflicts')
     .description('Detect overlap, collisions, and missing dependencies')
-    .option('--fix', 'placeholder for interactive fix flow')
+    .option('--fix', 'after listing conflicts, interactively pick installed Skills to uninstall to resolve them')
     .action(conflictsCommand);
 program
     .command('optimize')
     .description('Recommendations: underused, mergeable, and heavy skills')
-    .option('--apply', 'placeholder for auto-apply')
+    .option('--apply', 'after listing recommendations, interactively pick underused + heavy skills to uninstall')
     .option('--remove-unused', 'interactively delete skills that have not fired in 30+ days from ~/.claude/skills/')
     .option('--yes', 'with --remove-unused: skip the confirmation prompt')
     .action(optimizeCommand);
@@ -144,8 +143,9 @@ usage
     .action(usageStatusCommand);
 usage
     .command('report')
-    .description('Internal: invoked by the Claude Code PostToolUse hook (reads stdin)')
-    .action(usageReportCommand);
+    .description('Internal: invoked by the Claude Code PostToolUse / UserPromptSubmit hook (reads stdin)')
+    .option('--source <kind>', 'hook channel that fired this report ("tool" or "prompt")', 'tool')
+    .action((opts) => usageReportCommand(opts));
 const hook = usage.command('hook').description('Install/uninstall the Claude Code real-time usage hook');
 hook
     .command('install')
@@ -155,13 +155,6 @@ hook
     .command('uninstall')
     .description('Remove the Prave-managed hook from ~/.claude/settings.json')
     .action(usageHookUninstallCommand);
-program
-    .command('find <query>')
-    .description('Smart skill search across local and marketplace')
-    .option('--local', 'only search local skills')
-    .option('--marketplace', 'only search the marketplace')
-    .option('--smart', 'use the LLM-assisted search endpoint')
-    .action(findCommand);
 program
     .command('deploy <skillname>')
     .description('Deploy a Skill to every configured agent (Claude Code, Codex, Cursor, Gemini, Cline, Amp). Free plan deploys to Claude Code only; Pro and Max deploy across all six. The skill must already exist locally — use `prave install` first or point to a SKILL.md folder.')
@@ -183,7 +176,6 @@ program
         '',
         'Discover & install',
         '  prave search <q>                   # public skill search',
-        '  prave find <q> [--smart|--local]   # smart cross-source search',
         '  prave install <slug> [--no-deps]   # install into ~/.claude/skills/',
         '  prave uninstall <slug>             # remove a local skill',
         '  prave list [--remote] [--verbose]  # what is installed (or remote)',

package/dist/lib/hook.js

@@ -22,25 +22,50 @@ const HOOK_MARKER = '__prave_managed';
  */
 export const HOOK_SUPPORTED = ['claude'];
 const HOOK_COMMAND = 'prave usage report';
+// Companion command for the UserPromptSubmit channel so a typed-slash
+// `/graphify` is captured even when the Skill tool path doesn't fire a
+// matching PostToolUse with a populated `tool_input.skill` field.
+const PROMPT_HOOK_COMMAND = 'prave usage report --source=prompt';
+/**
+ * Install on BOTH `PostToolUse` (matcher `Skill`) and `UserPromptSubmit`
+ * (catches slash commands like `/graphify` before tool dispatch). The two
+ * channels are deduped server-side by per-minute bucket, so double-fires
+ * for the same Skill in the same minute land as a single row — but every
+ * additional minute of activity is preserved. Idempotent + atomic.
+ */
 export async function installSkillHook() {
     const settings = await readSettings();
     settings.hooks ??= {};
     settings.hooks.PostToolUse ??= [];
-    const blocks = settings.hooks.PostToolUse;
-    const existingIdx = blocks.findIndex((b) => b.matcher === 'Skill' && b.hooks?.some((h) => h[HOOK_MARKER]));
-    const fresh = {
+    settings.hooks.UserPromptSubmit ??= [];
+    const postBlocks = settings.hooks.PostToolUse;
+    const promptBlocks = settings.hooks.UserPromptSubmit;
+    const postFresh = {
         matcher: 'Skill',
         hooks: [{ type: 'command', command: HOOK_COMMAND, [HOOK_MARKER]: true }],
     };
-    if (existingIdx >= 0) {
-        const existingCmd = blocks[existingIdx]?.hooks?.[0]?.command;
-        if (existingCmd === HOOK_COMMAND) {
-            return { installed: false, alreadyPresent: true, settingsPath: SETTINGS_PATH };
+    const promptFresh = {
+        // UserPromptSubmit has no matcher concept in Claude Code today — the
+        // hook script itself filters for `prompt.startsWith('/')` before
+        // doing any work.
+        hooks: [{ type: 'command', command: PROMPT_HOOK_COMMAND, [HOOK_MARKER]: true }],
+    };
+    const upsert = (blocks, fresh, expectedCmd) => {
+        const idx = blocks.findIndex((b) => b.matcher === fresh.matcher && b.hooks?.some((h) => h[HOOK_MARKER]));
+        if (idx >= 0) {
+            const existingCmd = blocks[idx]?.hooks?.[0]?.command;
+            if (existingCmd === expectedCmd)
+                return false;
+            blocks[idx] = fresh;
+            return true;
         }
-        blocks[existingIdx] = fresh;
-    }
-    else {
         blocks.push(fresh);
+        return true;
+    };
+    const changedPost = upsert(postBlocks, postFresh, HOOK_COMMAND);
+    const changedPrompt = upsert(promptBlocks, promptFresh, PROMPT_HOOK_COMMAND);
+    if (!changedPost && !changedPrompt) {
+        return { installed: false, alreadyPresent: true, settingsPath: SETTINGS_PATH };
     }
     await writeSettings(settings);
     return { installed: true, alreadyPresent: false, settingsPath: SETTINGS_PATH };
@@ -93,25 +118,35 @@ export async function uninstallHooksForAgents(agents) {
 }
 export async function uninstallSkillHook() {
     const settings = await readSettings();
-    const blocks = settings.hooks?.PostToolUse;
-    if (!blocks?.length)
+    if (!settings.hooks)
         return { removed: false, settingsPath: SETTINGS_PATH };
-    const before = blocks.length;
-    const filtered = blocks
-        .map((b) => ({
-        ...b,
-        hooks: b.hooks?.filter((h) => !h[HOOK_MARKER]),
-    }))
-        .filter((b) => (b.hooks?.length ?? 0) > 0);
-    if (filtered.length === before && filtered.every((b, i) => b.hooks?.length === blocks[i]?.hooks?.length)) {
+    let touched = false;
+    const stripChannel = (channel) => {
+        const blocks = settings.hooks?.[channel];
+        if (!blocks?.length)
+            return;
+        const beforeCounts = blocks.map((b) => b.hooks?.length ?? 0);
+        const filtered = blocks
+            .map((b) => ({ ...b, hooks: b.hooks?.filter((h) => !h[HOOK_MARKER]) }))
+            .filter((b) => (b.hooks?.length ?? 0) > 0);
+        const lengthChanged = filtered.length !== blocks.length;
+        const innerChanged = !lengthChanged &&
+            filtered.some((b, i) => (b.hooks?.length ?? 0) !== beforeCounts[i]);
+        if (!lengthChanged && !innerChanged)
+            return;
+        touched = true;
+        if (settings.hooks) {
+            settings.hooks[channel] = filtered.length ? filtered : undefined;
+            if (!filtered.length)
+                delete settings.hooks[channel];
+        }
+    };
+    stripChannel('PostToolUse');
+    stripChannel('UserPromptSubmit');
+    if (!touched)
         return { removed: false, settingsPath: SETTINGS_PATH };
-    }
-    if (settings.hooks) {
-        settings.hooks.PostToolUse = filtered;
-        if (!filtered.length)
-            delete settings.hooks.PostToolUse;
-        if (Object.keys(settings.hooks).length === 0)
-            delete settings.hooks;
+    if (settings.hooks && Object.keys(settings.hooks).length === 0) {
+        delete settings.hooks;
     }
     await writeSettings(settings);
     return { removed: true, settingsPath: SETTINGS_PATH };

package/dist/lib/state.js

@@ -0,0 +1,34 @@
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CONFIG } from './config.js';
+const STATE_PATH = join(CONFIG.praveDir, 'state.json');
+export async function readState() {
+    try {
+        const raw = await readFile(STATE_PATH, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object')
+            return parsed;
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Atomic write — write to .tmp, then rename. Prevents partial JSON if the
+ * process dies mid-write (which would otherwise make the next readState()
+ * throw on JSON.parse and quietly reset state to {}).
+ */
+export async function writeState(patch) {
+    await mkdir(CONFIG.praveDir, { recursive: true, mode: 0o700 });
+    const current = await readState();
+    const next = { ...current, ...patch };
+    const tmp = `${STATE_PATH}.tmp`;
+    await writeFile(tmp, JSON.stringify(next, null, 2), { encoding: 'utf8', mode: 0o600 });
+    await rename(tmp, STATE_PATH);
+    // Re-apply mode after rename — defensive: rename preserves the source's
+    // mode, but if a stale state.json exists with looser perms, this brings
+    // it back to user-only.
+    await chmod(STATE_PATH, 0o600);
+    return next;
+}

package/dist/lib/time.js

@@ -0,0 +1,55 @@
+/**
+ * Human-friendly relative time formatting for CLI output.
+ *
+ * Returns short English phrases like "2 hours ago", "12 minutes ago",
+ * "yesterday". Uses absolute thresholds rather than Intl.RelativeTimeFormat
+ * because we want consistent CLI copy across locales (the rest of the CLI
+ * is English-only).
+ */
+export function formatRelative(date) {
+    const d = date instanceof Date ? date : new Date(date);
+    const now = Date.now();
+    const ms = now - d.getTime();
+    const sec = Math.round(ms / 1000);
+    if (sec < 0)
+        return 'just now';
+    if (sec < 45)
+        return 'just now';
+    const min = Math.round(sec / 60);
+    if (min < 2)
+        return 'a minute ago';
+    if (min < 60)
+        return `${min} minutes ago`;
+    const hr = Math.round(min / 60);
+    if (hr < 2)
+        return 'an hour ago';
+    if (hr < 24)
+        return `${hr} hours ago`;
+    const day = Math.round(hr / 24);
+    if (day < 2)
+        return 'yesterday';
+    if (day < 30)
+        return `${day} days ago`;
+    const month = Math.round(day / 30);
+    if (month < 2)
+        return 'a month ago';
+    if (month < 12)
+        return `${month} months ago`;
+    const year = Math.round(day / 365);
+    if (year < 2)
+        return 'a year ago';
+    return `${year} years ago`;
+}
+/**
+ * Returns the gap (in ms) between `date` and now, or null if undefined.
+ * Convenience wrapper used by callers that need both raw delta and pretty
+ * output without re-parsing the date.
+ */
+export function msSince(date) {
+    if (date == null)
+        return null;
+    const d = date instanceof Date ? date : new Date(date);
+    if (Number.isNaN(d.getTime()))
+        return null;
+    return Date.now() - d.getTime();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prave/cli",
-  "version": "1.1.2",
+  "version": "1.2.1",
   "description": "Prave CLI — discover, install, version, test, and ship Claude Skills. The developer platform for the complete Skill lifecycle.",
   "type": "module",
   "keywords": [
@@ -51,7 +51,7 @@
     "open": "^10.1.0",
     "ora": "^8.0.1",
     "undici": "^6.18.0",
-    "@prave/shared": "1.1.2"
+    "@prave/shared": "1.2.1"
   },
   "devDependencies": {
     "@types/node": "^20.12.7",

package/dist/commands/find.js

@@ -1,103 +0,0 @@
-import { createInterface } from 'node:readline/promises';
-import chalk from 'chalk';
-import ora from 'ora';
-import { tokenTier } from '@prave/shared';
-import { track } from '../lib/analytics.js';
-import { api, ApiError } from '../lib/api.js';
-import { log } from '../utils/logger.js';
-const TIER_EMOJI = {
-    lean: '🟢',
-    medium: '🟡',
-    heavy: '🔴',
-};
-function formatTokens(n) {
-    if (n < 1000)
-        return `~${n}`;
-    return `~${(n / 1000).toFixed(1)}k`;
-}
-function renderResult(r, idx) {
-    const badge = r.source === 'local'
-        ? chalk.cyan('[local]')
-        : chalk.magenta('[marketplace]');
-    const tier = TIER_EMOJI[tokenTier(r.estimated_tokens)];
-    const slash = r.slash_command ? chalk.dim(` ${r.slash_command}`) : '';
-    const installs = r.source === 'marketplace' && typeof r.install_count === 'number'
-        ? chalk.dim(` · ${r.install_count} installs`)
-        : '';
-    console.log(`${chalk.bold(`${idx + 1}.`)} ${badge} ${chalk.bold(r.name)}${slash}  ${tier} ${chalk.dim(formatTokens(r.estimated_tokens))}${installs}`);
-    if (r.description)
-        log.dim(`   ${r.description}`);
-}
-export async function findCommand(query, opts = {}) {
-    track('cli_find', {
-        length: query.length,
-        mode: opts.smart ? 'smart' : opts.local ? 'local' : opts.marketplace ? 'marketplace' : 'both',
-    });
-    const scope = opts.local
-        ? 'local'
-        : opts.marketplace
-            ? 'marketplace'
-            : 'both';
-    const spinner = ora(opts.smart ? 'Smart-searching…' : 'Searching…').start();
-    try {
-        let results;
-        if (opts.smart) {
-            const { data } = await api.post('/api/v1/intelligence/llm-search', { query }, true);
-            spinner.stop();
-            console.log(chalk.dim(`Task: ${data.task}`));
-            if (data.suggested_triggers.length > 0) {
-                log.dim(`Suggested triggers: ${data.suggested_triggers.join(', ')}`);
-            }
-            console.log();
-            results = data.results;
-        }
-        else {
-            const { data } = await api.post('/api/v1/intelligence/search', { query, scope }, true);
-            spinner.stop();
-            results = data;
-        }
-        if (results.length === 0) {
-            log.dim('No matches.');
-            return;
-        }
-        const top = results.slice(0, 5);
-        top.forEach((r, i) => renderResult(r, i));
-        if (opts.local)
-            return; // skip prompt when local-only
-        const installable = top.find((r) => r.source === 'marketplace' && !r.is_installed);
-        if (!installable)
-            return;
-        const rl = createInterface({ input: process.stdin, output: process.stdout });
-        try {
-            const answer = (await rl.question(`\nInstall ${chalk.bold(installable.slug)}? [y/N] `)).trim().toLowerCase();
-            if (answer === 'y' || answer === 'yes') {
-                const { installCommand } = await import('./install.js');
-                await installCommand(installable.slug, {});
-            }
-        }
-        finally {
-            rl.close();
-        }
-    }
-    catch (err) {
-        spinner.stop();
-        if (err instanceof ApiError && err.status === 402) {
-            // Server returned the semantic-search upsell. Render it as a
-            // structured upgrade hint instead of a raw error so the message
-            // reads like guidance, not a crash.
-            log.error(err.message);
-            console.log();
-            console.log(chalk.dim('   Pro · $12/mo includes:'));
-            console.log(chalk.dim('     · `prave search "<natural language>"` ranked by intent'));
-            console.log(chalk.dim('     · Skill Intelligence audit + 30-day trigger telemetry'));
-            console.log(chalk.dim('     · Cross-machine sync · Tester · Authoring'));
-            console.log();
-            console.log(`   ${chalk.bold('→ Upgrade:')} ${chalk.cyan('https://prave.app/#pricing')}`);
-            console.log(chalk.dim('   Or browse the registry without semantic search:'), chalk.cyan('https://prave.app/discover'));
-            process.exitCode = 1;
-            return;
-        }
-        log.error(err instanceof ApiError ? err.message : err.message);
-        process.exitCode = 1;
-    }
-}