@rayul/kordis 0.1.14 → 0.1.16

package/dist/index.js

@@ -821,10 +821,19 @@ var init_client = __esm({
       revokeAllSessions() {
         return this.request("/auth/sessions/revoke-all", { method: "POST" });
       }
-      // ─── users ─────────────────────────────────────────────────────────────
+      // ─── authenticated user ────────────────────────────────────────────────
       me() {
         return this.request("/api/me");
       }
+      listMyPackages(opts = {}) {
+        return this.request("/api/me/packages", {
+          query: {
+            ...opts.page !== void 0 ? { page: opts.page } : {},
+            ...opts.limit !== void 0 ? { limit: opts.limit } : {},
+            ...opts.sort !== void 0 ? { sort: opts.sort } : {}
+          }
+        });
+      }
       // ─── packages ──────────────────────────────────────────────────────────
       publish(body, opts = {}) {
         return this.request("/api/packages", {
@@ -975,7 +984,7 @@ var init_src2 = __esm({
 
 // src/index.ts
 init_src2();
-import { Command as Command13 } from "commander";
+import { Command as Command18 } from "commander";
 
 // src/commands/login.ts
 import { Command } from "commander";
@@ -1593,8 +1602,8 @@ async function bundleSkillZip(zipPath) {
 
 // src/commands/pull.ts
 import { Command as Command5 } from "commander";
-import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname2, join as join5 } from "path";
+import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname2, join as join6 } from "path";
 
 // ../../packages/harness-schema/src/deps.ts
 init_src();
@@ -2421,15 +2430,106 @@ function getTranslator(type, format) {
   return fn;
 }
 
+// src/lockfile.ts
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
+import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
+var LOCKFILE_PATH = join5(homedir3(), ".kordis", "installed.json");
+async function readLockfile() {
+  try {
+    const raw = await readFile4(LOCKFILE_PATH, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return { packages: {} };
+  }
+}
+async function writeLockfile(lf) {
+  await mkdir3(join5(homedir3(), ".kordis"), { recursive: true });
+  await writeFile3(LOCKFILE_PATH, JSON.stringify(lf, null, 2) + "\n", "utf8");
+}
+async function recordInstalled(fullSlug, entry) {
+  const lf = await readLockfile();
+  lf.packages[fullSlug] = entry;
+  await writeLockfile(lf);
+}
+
 // src/commands/pull.ts
+async function doPullInstall(fullSlug, tool, installRoot, version) {
+  const [username, slug] = fullSlug.split("/");
+  if (!username || !slug) throw new Error('full_slug must be "{username}/{slug}"');
+  const bundle = await useClient();
+  const detail = await bundle.api.getPackage(username, slug);
+  await bundle.api.pull(username, slug);
+  const contentRes = await bundle.api.getContent(username, slug, {
+    format: "canonical",
+    ...version ? { version } : {}
+  });
+  const parsed = validatePackageSource(contentRes.content);
+  if (!parsed.ok || !parsed.type || !parsed.frontmatter) {
+    throw new Error("package stored content is not currently valid");
+  }
+  const written = [];
+  const notes = [];
+  const format = tool;
+  try {
+    const translator = getTranslator(parsed.type, format);
+    const result = translator({
+      fullSlug,
+      frontmatter: parsed.frontmatter.data,
+      body: parsed.body,
+      version: contentRes.version,
+      assets: contentRes.assets
+    });
+    for (const f of result.files) {
+      const abs = join6(installRoot, f.path);
+      await mkdir4(dirname2(abs), { recursive: true });
+      await writeEmittedFile(abs, f.content, f.encoding);
+      written.push(abs);
+    }
+    notes.push(...result.notes);
+  } catch (err) {
+    if (err instanceof TranslatorNotSupportedError) {
+      const canonical = getTranslator(parsed.type, "canonical");
+      const result = canonical({
+        fullSlug,
+        frontmatter: parsed.frontmatter.data,
+        body: parsed.body,
+        version: contentRes.version,
+        assets: contentRes.assets
+      });
+      notes.push(
+        `Tool "${format}" is not supported for type "${parsed.type}"; installed canonical form instead.`
+      );
+      for (const f of result.files) {
+        const abs = join6(installRoot, f.path);
+        await mkdir4(dirname2(abs), { recursive: true });
+        await writeEmittedFile(abs, f.content, f.encoding);
+        written.push(abs);
+      }
+    } else {
+      throw err;
+    }
+  }
+  const installedVersion = contentRes.version;
+  await recordInstalled(fullSlug, {
+    version: installedVersion,
+    tool,
+    target: installRoot,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return { version: installedVersion, tool, installRoot, written, notes };
+}
 function pullCommand() {
-  return new Command5("pull").description("install a package into the current project").argument("<full_slug>", "package identifier {username}/{slug}").option("--tool <name>", "target tool format (default: auto-detect)").option("--target <path>", "install into a subdirectory (default: cwd)").option("--with-recommends", "also install recommended dependencies", false).action(
-    async (fullSlug, opts) => {
+  return new Command5("pull").description("install a package into the current project").argument("<full_slug>", "package identifier {username}/{slug} or {username}/{slug}@{version}").option("--tool <name>", "target tool format (default: auto-detect)").option("--target <path>", "install into a subdirectory (default: cwd)").option("--with-recommends", "also install recommended dependencies", false).action(
+    async (fullSlugArg, opts) => {
+      const atIdx = fullSlugArg.lastIndexOf("@");
+      const hasPinnedVersion = atIdx > fullSlugArg.indexOf("/");
+      const fullSlug = hasPinnedVersion ? fullSlugArg.slice(0, atIdx) : fullSlugArg;
+      const pinnedVersion = hasPinnedVersion ? fullSlugArg.slice(atIdx + 1) : void 0;
       const [username, slug] = fullSlug.split("/");
       if (!username || !slug) {
-        throw new Error('full_slug must be "{username}/{slug}"');
+        throw new Error('full_slug must be "{username}/{slug}" or "{username}/{slug}@{version}"');
       }
-      const bundle = await useClient();
       const userCwd = process.env["INIT_CWD"] ?? process.cwd();
       const installRoot = opts.target ?? userCwd;
       const detected = opts.tool ?? await detectTool(installRoot);
@@ -2438,74 +2538,25 @@ function pullCommand() {
           "Cannot detect target tool from the current directory.\n  Pass --tool <name> explicitly. Valid: claude-code, codex, cursor,\n  continue, windsurf, antigravity, copilot.\n  Or run `kordis pull` inside a project that already has one of:\n  .claude/, .codex/, .cursor/, AGENTS.md, CLAUDE.md, .cursorrules,\n  .continue/, .windsurf/, .antigravity/, .github/copilot-instructions.md"
         );
       }
-      const spin = spinner(`Pulling ${fullSlug}`);
-      const detail = await bundle.api.getPackage(username, slug);
-      await bundle.api.pull(username, slug);
-      const contentRes = await bundle.api.getContent(username, slug, {
-        format: "canonical"
-      });
+      const spinLabel = pinnedVersion ? `Pulling ${fullSlug}@${pinnedVersion}` : `Pulling ${fullSlug}`;
+      const spin = spinner(spinLabel);
+      const result = await doPullInstall(fullSlug, detected, installRoot, pinnedVersion);
       spin.succeed();
-      const parsed = validatePackageSource(contentRes.content);
-      if (!parsed.ok || !parsed.type || !parsed.frontmatter) {
-        throw new Error("package stored content is not currently valid");
-      }
-      const written = [];
-      const notes = [];
-      const format = detected;
-      try {
-        const translator = getTranslator(parsed.type, format);
-        const result = translator({
-          fullSlug,
-          frontmatter: parsed.frontmatter.data,
-          body: parsed.body,
-          version: contentRes.version,
-          assets: contentRes.assets
-        });
-        for (const f of result.files) {
-          const abs = join5(installRoot, f.path);
-          await mkdir3(dirname2(abs), { recursive: true });
-          await writeEmittedFile(abs, f.content, f.encoding);
-          written.push(abs);
-        }
-        notes.push(...result.notes);
-      } catch (err) {
-        if (err instanceof TranslatorNotSupportedError) {
-          const canonical = getTranslator(parsed.type, "canonical");
-          const result = canonical({
-            fullSlug,
-            frontmatter: parsed.frontmatter.data,
-            body: parsed.body,
-            version: contentRes.version,
-            assets: contentRes.assets
-          });
-          notes.push(
-            `Tool "${format}" is not supported for type "${parsed.type}"; installed canonical form instead.`
-          );
-          for (const f of result.files) {
-            const abs = join5(installRoot, f.path);
-            await mkdir3(dirname2(abs), { recursive: true });
-            await writeEmittedFile(abs, f.content, f.encoding);
-            written.push(abs);
-          }
-        } else {
-          throw err;
-        }
-      }
       printDual({
         json: {
           status: "installed",
           full_slug: fullSlug,
-          version: detail.current_version,
-          tool_detected: detected ?? null,
-          installed_paths: written,
-          notes
+          version: result.version,
+          tool_detected: result.tool,
+          installed_paths: result.written,
+          notes: result.notes
         },
         human: () => {
           printHuman(
-            c.green(`\u2713 Installed ${c.bold(fullSlug)} v${detail.current_version}`)
+            c.green(`\u2713 Installed ${c.bold(fullSlug)} v${result.version}`)
           );
-          for (const w of written) printHuman(`  ${c.gray("wrote")} ${w}`);
-          for (const n of notes) printHuman(c.yellow(`  ! ${n}`));
+          for (const w of result.written) printHuman(`  ${c.gray("wrote")} ${w}`);
+          for (const n of result.notes) printHuman(c.yellow(`  ! ${n}`));
         }
       });
     }
@@ -2528,7 +2579,7 @@ async function detectTool(root) {
   ];
   for (const [path, tool] of checks) {
     try {
-      await stat2(join5(root, path));
+      await stat2(join6(root, path));
       return tool;
     } catch {
     }
@@ -2537,9 +2588,9 @@ async function detectTool(root) {
 }
 async function writeEmittedFile(abs, content, encoding) {
   if (encoding === "base64") {
-    await writeFile3(abs, Buffer.from(content, "base64"));
+    await writeFile4(abs, Buffer.from(content, "base64"));
   } else {
-    await writeFile3(abs, content, "utf8");
+    await writeFile4(abs, content, "utf8");
   }
 }
 
@@ -2639,9 +2690,9 @@ function logoutCommand() {
 }
 
 // src/commands/setup.ts
-import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir4, access } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join6, dirname as dirname3 } from "path";
+import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5, access } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join7, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command9 } from "commander";
 var MARKER_START = "<!-- kordis-start -->";
@@ -2674,18 +2725,18 @@ function assetRoots() {
   const __dir2 = dirname3(fileURLToPath2(import.meta.url));
   return {
     // Built binary: bin/kordis.js → assets/ is one level up
-    bundled: join6(__dir2, "..", "assets"),
+    bundled: join7(__dir2, "..", "assets"),
     // Dev mode: src/commands/setup.ts → 4 levels up to repo root, then packages/skills/
-    source: join6(__dir2, "..", "..", "..", "..", "packages", "skills")
+    source: join7(__dir2, "..", "..", "..", "..", "packages", "skills")
   };
 }
 async function pickAssetRoot() {
   const { bundled, source } = assetRoots();
-  return await exists(join6(bundled, "KORDIS.md")) ? bundled : source;
+  return await exists(join7(bundled, "KORDIS.md")) ? bundled : source;
 }
 async function loadHubContent() {
   const root = await pickAssetRoot();
-  const raw = await readFile4(join6(root, "KORDIS.md"), "utf-8");
+  const raw = await readFile5(join7(root, "KORDIS.md"), "utf-8");
   if (raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 4);
     if (end !== -1) return raw.slice(end + 4).trimStart();
@@ -2694,7 +2745,7 @@ async function loadHubContent() {
 }
 async function loadSubSkillContent(name) {
   const root = await pickAssetRoot();
-  return readFile4(join6(root, name, "SKILL.md"), "utf-8");
+  return readFile5(join7(root, name, "SKILL.md"), "utf-8");
 }
 async function injectBlock(filePath, content, dryRun) {
   const block = `${MARKER_START}
@@ -2703,14 +2754,14 @@ ${MARKER_END}`;
   let existing = "";
   let fileExists = true;
   try {
-    existing = await readFile4(filePath, "utf-8");
+    existing = await readFile5(filePath, "utf-8");
   } catch {
     fileExists = false;
   }
   if (!fileExists) {
     if (!dryRun) {
-      await mkdir4(dirname3(filePath), { recursive: true });
-      await writeFile4(filePath, block + "\n", "utf-8");
+      await mkdir5(dirname3(filePath), { recursive: true });
+      await writeFile5(filePath, block + "\n", "utf-8");
     }
     return "injected";
   }
@@ -2721,31 +2772,31 @@ ${MARKER_END}`;
     if (current === block) return "unchanged";
     if (!dryRun) {
       const updated = existing.slice(0, startIdx) + block + existing.slice(endIdx + MARKER_END.length);
-      await writeFile4(filePath, updated, "utf-8");
+      await writeFile5(filePath, updated, "utf-8");
     }
     return "updated";
   }
   if (!dryRun) {
-    await writeFile4(filePath, existing.trimEnd() + "\n\n" + block + "\n", "utf-8");
+    await writeFile5(filePath, existing.trimEnd() + "\n\n" + block + "\n", "utf-8");
   }
   return "injected";
 }
 async function copyBundledSkill(filePath, content, dryRun) {
   let existing = null;
   try {
-    existing = await readFile4(filePath, "utf-8");
+    existing = await readFile5(filePath, "utf-8");
   } catch {
   }
   if (existing === content) return "unchanged";
   if (!dryRun) {
-    await mkdir4(dirname3(filePath), { recursive: true });
-    await writeFile4(filePath, content, "utf-8");
+    await mkdir5(dirname3(filePath), { recursive: true });
+    await writeFile5(filePath, content, "utf-8");
   }
   return existing === null ? "injected" : "updated";
 }
 function setupCommand() {
   return new Command9("setup").description("inject kordis usage guide into global agent instruction files").option("--silent", "suppress errors \u2014 safe for postinstall").option("--dry-run", "detect installed tools without writing any files").action(async (opts) => {
-    const home = homedir3();
+    const home = homedir4();
     const dryRun = opts.dryRun ?? false;
     let hubContent;
     let subSkillContents;
@@ -2762,8 +2813,8 @@ function setupCommand() {
     let anyFound = false;
     const changedTools = /* @__PURE__ */ new Set();
     for (const target of HUB_TARGETS) {
-      const dirPath = join6(home, target.dir);
-      const filePath = join6(home, target.file);
+      const dirPath = join7(home, target.dir);
+      const filePath = join7(home, target.file);
       if (!await exists(dirPath)) {
         if (!opts.silent) {
           printHuman(c.gray(`  - ${target.tool.padEnd(12)} not installed, skipped`));
@@ -2790,10 +2841,10 @@ function setupCommand() {
       }
     }
     for (const target of SKILL_TARGETS) {
-      const dirPath = join6(home, target.dir);
+      const dirPath = join7(home, target.dir);
       if (!await exists(dirPath)) continue;
       for (const subName of SUB_SKILLS) {
-        const filePath = join6(home, target.skillsDir, subName, "SKILL.md");
+        const filePath = join7(home, target.skillsDir, subName, "SKILL.md");
         const dest = `~/${target.skillsDir}/${subName}/SKILL.md`;
         try {
           const result = await copyBundledSkill(filePath, subSkillContents[subName], dryRun);
@@ -2962,9 +3013,386 @@ function deleteCommand() {
   });
 }
 
+// src/commands/list.ts
+import { Command as Command13 } from "commander";
+function listCommand() {
+  return new Command13("list").description("list your own packages (requires login)").option("--limit <n>", "max results per page", (v) => parseInt(v, 10), 20).option("--page <n>", "page number (1-based)", (v) => parseInt(v, 10), 1).option("--sort <mode>", "sort: latest|popular", "latest").action(async (opts) => {
+    const sort = opts.sort === "popular" ? "popular" : "latest";
+    const bundle = await useClient();
+    if (!bundle.username) {
+      throw new Error("Not logged in. Run `kordis login` first.");
+    }
+    const spin = spinner("Fetching your packages");
+    const res = await bundle.authedRequest(
+      (api) => api.listMyPackages({ page: opts.page, limit: opts.limit, sort })
+    );
+    spin.succeed();
+    printDual({
+      json: res,
+      human: () => {
+        if (res.packages.length === 0) {
+          printHuman(c.yellow("(no packages yet \u2014 use `kordis push` to publish your first)"));
+          return;
+        }
+        printHuman(
+          c.gray(
+            `Showing ${res.packages.length} of ${res.total} package${res.total !== 1 ? "s" : ""} (page ${res.page})`
+          )
+        );
+        printHuman("");
+        for (const p of res.packages) {
+          const desc = p.description.length > 60 ? p.description.slice(0, 57) + "..." : p.description;
+          printHuman(
+            `${c.bold(p.full_slug)} ${c.gray(`v${p.current_version}`)} ${c.cyan(`[${p.type}]`)}`
+          );
+          printHuman(`  ${desc}`);
+          printHuman(
+            c.gray(`  \u2605 ${p.stars}  \u21E3 ${p.downloads}  ${p.visibility}`)
+          );
+          printHuman("");
+        }
+        if (res.page * res.limit < res.total) {
+          printHuman(
+            c.gray(`(more available \u2014 pass --page ${res.page + 1})`)
+          );
+        }
+      }
+    });
+  });
+}
+
+// src/commands/versions.ts
+import { Command as Command14 } from "commander";
+function versionsCommand() {
+  return new Command14("versions").description("list all versions of a package").argument("<full_slug>", "package identifier {username}/{slug}").action(async (fullSlug) => {
+    const [username, slug] = fullSlug.split("/");
+    if (!username || !slug) {
+      throw new Error('full_slug must be "{username}/{slug}"');
+    }
+    const bundle = await useClient();
+    const spin = spinner(`Fetching versions for ${fullSlug}`);
+    const res = await bundle.api.versions(username, slug);
+    spin.succeed();
+    printDual({
+      json: res,
+      human: () => {
+        printHuman(
+          `${c.bold(res.full_slug)} \u2014 ${res.versions.length} version${res.versions.length !== 1 ? "s" : ""}  (current: ${c.green(res.current_version)})`
+        );
+        printHuman("");
+        for (const v of res.versions) {
+          const statusColor = v.review_status === "passed" ? c.green(v.review_status) : v.review_status === "rejected" ? c.red(v.review_status) : c.yellow(v.review_status);
+          const age = relativeTime(v.published_at);
+          const isCurrent = v.version === res.current_version;
+          printHuman(
+            `  ${c.bold(v.version)}${isCurrent ? c.cyan(" (current)") : ""}  ${statusColor}  ${c.gray(age)}`
+          );
+        }
+      }
+    });
+  });
+}
+function relativeTime(isoString) {
+  const then = new Date(isoString).getTime();
+  const now = Date.now();
+  const diffSec = Math.floor((now - then) / 1e3);
+  if (diffSec < 60) return "just now";
+  if (diffSec < 3600) {
+    const m = Math.floor(diffSec / 60);
+    return `${m} minute${m !== 1 ? "s" : ""} ago`;
+  }
+  if (diffSec < 86400) {
+    const h = Math.floor(diffSec / 3600);
+    return `${h} hour${h !== 1 ? "s" : ""} ago`;
+  }
+  if (diffSec < 86400 * 30) {
+    const d = Math.floor(diffSec / 86400);
+    return `${d} day${d !== 1 ? "s" : ""} ago`;
+  }
+  if (diffSec < 86400 * 365) {
+    const mo = Math.floor(diffSec / (86400 * 30));
+    return `${mo} month${mo !== 1 ? "s" : ""} ago`;
+  }
+  const y = Math.floor(diffSec / (86400 * 365));
+  return `${y} year${y !== 1 ? "s" : ""} ago`;
+}
+
+// src/commands/outdated.ts
+import { Command as Command15 } from "commander";
+function isNewer(a, b) {
+  const parse = (v) => {
+    const [maj = 0, min = 0, pat = 0] = v.split("-")[0].split(".").map(Number);
+    return [maj, min, pat];
+  };
+  const [aMaj, aMin, aPat] = parse(a);
+  const [bMaj, bMin, bPat] = parse(b);
+  if (bMaj !== aMaj) return bMaj > aMaj;
+  if (bMin !== aMin) return bMin > aMin;
+  return bPat > aPat;
+}
+function outdatedCommand() {
+  return new Command15("outdated").description("check installed packages for available updates").action(async () => {
+    const lf = await readLockfile();
+    const slugs = Object.keys(lf.packages);
+    if (slugs.length === 0) {
+      printDual({
+        json: [],
+        human: () => printHuman(
+          "No packages tracked. Use `kordis pull` to install packages."
+        )
+      });
+      return;
+    }
+    const bundle = await useClient();
+    const spin = spinner(`Checking ${slugs.length} package${slugs.length !== 1 ? "s" : ""}`);
+    const entries = [];
+    for (const fullSlug of slugs) {
+      const [username, slug] = fullSlug.split("/");
+      if (!username || !slug) continue;
+      const installed = lf.packages[fullSlug].version;
+      try {
+        const detail = await bundle.api.getPackage(username, slug);
+        const latest = detail.current_version;
+        entries.push({ full_slug: fullSlug, installed, latest, outdated: isNewer(installed, latest) });
+      } catch {
+        entries.push({ full_slug: fullSlug, installed, latest: installed, outdated: false });
+      }
+    }
+    spin.succeed();
+    printDual({
+      json: entries,
+      human: () => {
+        const outdatedCount = entries.filter((e) => e.outdated).length;
+        if (outdatedCount === 0) {
+          printHuman(c.green(`\u2713 All ${entries.length} package${entries.length !== 1 ? "s" : ""} are up to date`));
+          return;
+        }
+        printHuman(
+          c.yellow(`${outdatedCount} of ${entries.length} package${entries.length !== 1 ? "s" : ""} can be updated:`)
+        );
+        printHuman("");
+        for (const e of entries) {
+          const status = e.outdated ? c.yellow("Outdated") : c.green("Up to date");
+          const arrow = e.outdated ? c.yellow(` \u2192 ${e.latest}`) : "";
+          printHuman(
+            `  ${c.bold(e.full_slug)}  ${c.gray(e.installed)}${arrow}  ${status}`
+          );
+        }
+        printHuman("");
+        printHuman(c.gray("Run `kordis update` to upgrade all outdated packages."));
+      }
+    });
+  });
+}
+
+// src/commands/update.ts
+import { Command as Command16 } from "commander";
+function isNewer2(a, b) {
+  const parse = (v) => {
+    const [maj = 0, min = 0, pat = 0] = v.split("-")[0].split(".").map(Number);
+    return [maj, min, pat];
+  };
+  const [aMaj, aMin, aPat] = parse(a);
+  const [bMaj, bMin, bPat] = parse(b);
+  if (bMaj !== aMaj) return bMaj > aMaj;
+  if (bMin !== aMin) return bMin > aMin;
+  return bPat > aPat;
+}
+function updateCommand() {
+  return new Command16("update").description("update installed packages to their latest versions").argument("[full_slug]", "package identifier {username}/{slug} (omit to update all)").option("--dry-run", "show what would be updated without doing it", false).action(async (fullSlugArg, opts) => {
+    const lf = await readLockfile();
+    let slugs = Object.keys(lf.packages);
+    if (slugs.length === 0) {
+      printDual({
+        json: [],
+        human: () => printHuman("No packages tracked. Use `kordis pull` to install packages.")
+      });
+      return;
+    }
+    if (fullSlugArg) {
+      if (!lf.packages[fullSlugArg]) {
+        throw new Error(
+          `Package "${fullSlugArg}" is not in the lockfile. Install it first with \`kordis pull ${fullSlugArg}\`.`
+        );
+      }
+      slugs = [fullSlugArg];
+    }
+    const bundle = await useClient();
+    const spin = spinner(`Checking ${slugs.length} package${slugs.length !== 1 ? "s" : ""} for updates`);
+    const candidates = [];
+    for (const fullSlug of slugs) {
+      const entry = lf.packages[fullSlug];
+      const [username, slug] = fullSlug.split("/");
+      if (!username || !slug) continue;
+      try {
+        const detail = await bundle.api.getPackage(username, slug);
+        if (isNewer2(entry.version, detail.current_version)) {
+          candidates.push({
+            fullSlug,
+            installed: entry.version,
+            latest: detail.current_version,
+            tool: entry.tool,
+            target: entry.target
+          });
+        }
+      } catch {
+      }
+    }
+    spin.stop();
+    if (candidates.length === 0) {
+      printDual({
+        json: [],
+        human: () => printHuman(c.green(`\u2713 All tracked packages are up to date`))
+      });
+      return;
+    }
+    if (opts.dryRun) {
+      const dryEntries = candidates.map((c2) => ({
+        full_slug: c2.fullSlug,
+        from: c2.installed,
+        to: c2.latest,
+        status: "dry_run"
+      }));
+      printDual({
+        json: dryEntries,
+        human: () => {
+          printHuman(
+            c.yellow(
+              `Would update ${candidates.length} package${candidates.length !== 1 ? "s" : ""} (--dry-run):`
+            )
+          );
+          printHuman("");
+          for (const cand of candidates) {
+            printHuman(
+              `  ${c.bold(cand.fullSlug)}  ${c.gray(cand.installed)} \u2192 ${c.green(cand.latest)}`
+            );
+          }
+        }
+      });
+      return;
+    }
+    const summary = [];
+    for (const cand of candidates) {
+      printHuman(
+        `  ${c.cyan("\u2191")} Updating ${c.bold(cand.fullSlug)} ${c.gray(cand.installed)} \u2192 ${c.green(cand.latest)}`
+      );
+      try {
+        const result = await doPullInstall(cand.fullSlug, cand.tool, cand.target);
+        summary.push({
+          full_slug: cand.fullSlug,
+          from: cand.installed,
+          to: result.version,
+          status: "updated"
+        });
+        for (const w of result.written) printHuman(`    ${c.gray("wrote")} ${w}`);
+        for (const n of result.notes) printHuman(c.yellow(`    ! ${n}`));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        summary.push({
+          full_slug: cand.fullSlug,
+          from: cand.installed,
+          to: cand.latest,
+          status: "failed",
+          error: message
+        });
+        printHuman(c.red(`    \u2717 ${message}`));
+      }
+    }
+    const updatedCount = summary.filter((s) => s.status === "updated").length;
+    const failedCount = summary.filter((s) => s.status === "failed").length;
+    printDual({
+      json: summary,
+      human: () => {
+        printHuman("");
+        if (failedCount === 0) {
+          printHuman(
+            c.green(
+              `\u2713 Updated ${updatedCount} package${updatedCount !== 1 ? "s" : ""}`
+            )
+          );
+        } else {
+          printHuman(
+            c.yellow(
+              `Updated ${updatedCount}, failed ${failedCount} package${failedCount !== 1 ? "s" : ""}`
+            )
+          );
+        }
+      }
+    });
+  });
+}
+
+// src/commands/diff.ts
+import { Command as Command17 } from "commander";
+function diffCommand() {
+  return new Command17("diff").description("show changes between two versions of a package").argument("<full_slug>", "package identifier: {username}/{slug}, or {username}/{slug}@{from}..{to}").argument("[from]", "older version (omit to use second-latest)").argument("[to]", "newer version (omit to use latest)").action(async (fullSlugArg, fromArg, toArg) => {
+    let fullSlug = fullSlugArg;
+    let from = fromArg;
+    let to = toArg;
+    const rangeMatch = /^(.+)@([^.]+)\.\.(.+)$/.exec(fullSlugArg);
+    if (rangeMatch) {
+      fullSlug = rangeMatch[1];
+      from = rangeMatch[2];
+      to = rangeMatch[3];
+    }
+    const [username, slug] = fullSlug.split("/");
+    if (!username || !slug) {
+      throw new Error('full_slug must be "{username}/{slug}"');
+    }
+    const bundle = await useClient();
+    if (!from || !to) {
+      const spin2 = spinner(`Fetching versions for ${fullSlug}`);
+      const versionsRes = await bundle.api.versions(username, slug);
+      spin2.stop();
+      const passed = versionsRes.versions.filter((v) => v.review_status === "passed");
+      if (passed.length < 2) {
+        throw new Error(
+          `Need at least 2 published versions to auto-diff. Pass explicit versions: kordis diff ${fullSlug} <from> <to>`
+        );
+      }
+      to = to ?? passed[0].version;
+      from = from ?? passed[1].version;
+    }
+    const spin = spinner(`Diffing ${fullSlug} ${from}..${to}`);
+    const diff = await bundle.api.diff(username, slug, from, to);
+    spin.succeed();
+    printDual({
+      json: diff,
+      human: () => {
+        printHuman(
+          `${c.bold(diff.full_slug)}  ${c.gray(diff.from)} ${c.dim("\u2192")} ${c.green(diff.to)}`
+        );
+        printHuman(
+          c.gray(
+            `  +${diff.stats.additions} \u2212${diff.stats.deletions}  (${diff.stats.files_changed} file${diff.stats.files_changed !== 1 ? "s" : ""} changed)`
+          )
+        );
+        printHuman("");
+        if (!diff.unified_diff) {
+          printHuman(c.dim("(no content changes between these versions)"));
+          return;
+        }
+        for (const line of diff.unified_diff.split("\n")) {
+          if (line.startsWith("+++") || line.startsWith("---")) {
+            printHuman(c.bold(line));
+          } else if (line.startsWith("+")) {
+            printHuman(c.green(line));
+          } else if (line.startsWith("-")) {
+            printHuman(c.red(line));
+          } else if (line.startsWith("@@")) {
+            printHuman(c.cyan(line));
+          } else {
+            printHuman(c.gray(line));
+          }
+        }
+      }
+    });
+  });
+}
+
 // src/index.ts
 function buildProgram() {
-  const program = new Command13("kordis").version(VERSION).description("Kordis \u2014 registry for agentic-coding packages").option("--json", "emit JSON output to stdout (default: human)", false).hook("preAction", (thisCommand) => {
+  const program = new Command18("kordis").version(VERSION).description("Kordis \u2014 registry for agentic-coding packages").option("--json", "emit JSON output to stdout (default: human)", false).hook("preAction", (thisCommand) => {
     const opts = thisCommand.optsWithGlobals();
     if (opts.json) setJsonMode(true);
   });
@@ -2980,6 +3408,11 @@ function buildProgram() {
   program.addCommand(starCommand());
   program.addCommand(unstarCommand());
   program.addCommand(deleteCommand());
+  program.addCommand(listCommand());
+  program.addCommand(versionsCommand());
+  program.addCommand(outdatedCommand());
+  program.addCommand(updateCommand());
+  program.addCommand(diffCommand());
   program.addCommand(setupCommand());
   return program;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rayul/kordis",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "private": false,
   "description": "Command-line client for the Kordis registry — discover, install, and publish agentic-coding packages.",
   "license": "MIT",