@skillsmith/cli 0.7.3 → 0.7.4

package/dist/cli.js

@@ -1443,7 +1443,7 @@ var init_open = __esm({
 import { Command as Command28 } from "commander";
 
 // src/commands/search.ts
-import { Command } from "commander";
+import { Command as Command2 } from "commander";
 
 // src/config.ts
 import { join as join3 } from "path";
@@ -2145,7 +2145,7 @@ var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
 // src/commands/search.action.ts
-import ora from "ora";
+import ora2 from "ora";
 import { input, checkbox, number as number4, select } from "@inquirer/prompts";
 
 // ../core/dist/src/repositories/CacheRepository.js
@@ -18514,6 +18514,164 @@ function scanSsrfPatterns(content, lineContexts) {
   return findings;
 }
 
+// ../core/dist/src/security/scanner/SecurityScanner.pii.js
+var CREDENTIAL_PII_INDICES = /* @__PURE__ */ new Set([0, 1, 2, 3, 4, 5, 6, 10]);
+var PLACEHOLDER_SECRET_RE = /EXAMPLE|(?<![A-Za-z0-9])YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|(?<![A-Za-z0-9])DUMMY|(?<![A-Za-z0-9])FAKE|(?<![A-Za-z0-9])SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
+var SECRET_ENTROPY_FLOOR = 3;
+function shannonEntropy(s) {
+  if (!s)
+    return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of s)
+    freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const c of freq.values()) {
+    const p = c / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+function extractSecretValue(match) {
+  return match.replace(/^[^:=]*[:=]\s*/, "").replace(/^['"]|['"]$/g, "").trim();
+}
+function looksLikePlaceholderSecret(match) {
+  if (PLACEHOLDER_SECRET_RE.test(match))
+    return true;
+  const value = extractSecretValue(match);
+  if (value.length === 0)
+    return false;
+  if (/^(.)\1+$/.test(value))
+    return true;
+  return shannonEntropy(value) < SECRET_ENTROPY_FLOOR;
+}
+function scanPiiPatterns(content, lineContexts) {
+  const findings = [];
+  const lines = content.split("\n");
+  const contexts = lineContexts ?? analyzeMarkdownContext(content);
+  let frontmatterEnd = -1;
+  if (lines[0]?.trim() === "---") {
+    for (let i = 1; i < lines.length; i++) {
+      if (lines[i].trim() === "---") {
+        frontmatterEnd = i;
+        break;
+      }
+    }
+  }
+  const emailPatternIndex = 7;
+  lines.forEach((line, index) => {
+    const ctx = contexts[index];
+    const inFrontmatter = index > 0 && index < frontmatterEnd;
+    for (let pi = 0; pi < PII_PATTERNS.length; pi++) {
+      const pattern = PII_PATTERNS[pi];
+      const match = safeRegexTest(pattern, line);
+      if (match) {
+        const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+        const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+        const isEmailPattern = pi === emailPatternIndex;
+        const isAuthorLine = /^\s*(?:author|contact|support|email)\s*:/i.test(line);
+        const inEmailSafeContext = isEmailPattern && (inFrontmatter || isAuthorLine);
+        let severity;
+        if (inEmailSafeContext)
+          severity = "low";
+        else if (inDocContext)
+          severity = "medium";
+        else if (pi <= 2 || pi === 9)
+          severity = "critical";
+        else
+          severity = "high";
+        let confidence = inDocContext || inEmailSafeContext ? "low" : "high";
+        if (CREDENTIAL_PII_INDICES.has(pi) && looksLikePlaceholderSecret(match[0])) {
+          severity = "low";
+          confidence = "low";
+        }
+        findings.push({
+          type: "pii",
+          severity,
+          message: `PII detected: ${match[0].slice(0, 40)}${match[0].length > 40 ? "..." : ""}`,
+          location: line.trim().slice(0, 100),
+          lineNumber: index + 1,
+          category: "pii",
+          inDocumentationContext: inDocContext || inEmailSafeContext,
+          confidence
+        });
+        break;
+      }
+    }
+  });
+  return findings;
+}
+
+// ../core/dist/src/security/scanner/SecurityScanner.compound.js
+var OWNER_PERM_CHMOD = /\bchmod\s+(?:-[A-Za-z]+\s+)?(?:[0-7]{3,4}|[ugoa]*(?:[+\-=][rwxXstugo]+(?:,[ugoa]*[+\-=][rwxXstugo]*)*)+)/i;
+var CHMOD_FETCH_CONTEXT = /\b(?:curl|wget)\b|\bgit\s+clone\b|\bnpx\b[^\n]{0,80}https?:\/\//i;
+var CHMOD_TARGET = /\bchmod\s+(?:-[A-Za-z]+\s+)?(?:[0-7]{3,4}|[ugoa]*(?:[+\-=][rwxXstugo]+(?:,[ugoa]*[+\-=][rwxXstugo]*)*)+)\s+(\S+)/i;
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function implicitDownloadBasename(line) {
+  const lastSegment = (urlAfterScheme) => {
+    const noFrag = urlAfterScheme.split(/[?#]/)[0];
+    const slash = noFrag.indexOf("/");
+    if (slash < 0)
+      return "";
+    const path22 = noFrag.slice(slash + 1).replace(/\/+$/, "");
+    return path22 === "" ? "" : path22.split("/").pop() ?? "";
+  };
+  const wget = line.match(/\bwget\b(?![^\n]{0,200}\s-[oO]\b)[^\n]{0,200}?https?:\/\/(\S{1,400})/i);
+  if (wget)
+    return lastSegment(wget[1]);
+  const clone2 = line.match(/\bgit\s+clone\b[^\n]{0,200}?https?:\/\/(\S{1,400})/i);
+  if (clone2)
+    return lastSegment(clone2[1]).replace(/\.git$/i, "");
+  const curlEq = line.match(/\bcurl\b[^\n]{0,200}?--output=['"]?(\S{1,400})/i);
+  if (curlEq)
+    return curlEq[1].replace(/['"]/g, "").split("/").pop() ?? "";
+  return "";
+}
+function scanChmodFetchCompound(content, alreadyFlaggedLines, lineContexts) {
+  const findings = [];
+  const lines = content.split("\n");
+  const contexts = lineContexts ?? analyzeMarkdownContext(content);
+  const fetchLines = lines.filter((l) => safeRegexTest(CHMOD_FETCH_CONTEXT, l) !== null);
+  lines.forEach((line, index) => {
+    const lineNumber = index + 1;
+    if (alreadyFlaggedLines.has(lineNumber))
+      return;
+    const match = safeRegexTest(OWNER_PERM_CHMOD, line);
+    if (!match)
+      return;
+    const window2 = [lines[index - 1] ?? "", line, lines[index + 1] ?? ""].join("\n");
+    const adjacentFetch = safeRegexTest(CHMOD_FETCH_CONTEXT, window2) !== null;
+    let correlated = false;
+    const tm = safeRegexTest(CHMOD_TARGET, line);
+    if (tm) {
+      const base = tm[1].replace(/['"]/g, "").split("/").pop() ?? "";
+      if (base.length >= 3) {
+        const re = new RegExp(`(?:-o|-O|--output|>>?)\\s*['"]?(?:[^\\s'"]*/)?${escapeRegExp(base)}(?:[\\s'"?]|$)`);
+        correlated = fetchLines.some((l) => re.test(l) || implicitDownloadBasename(l) === base);
+      }
+    }
+    if (!adjacentFetch && !correlated)
+      return;
+    const ctx = contexts[index];
+    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+    findings.push({
+      type: "privilege_escalation",
+      // HIGH (not critical): enough to trip Gate-A AND serve as an
+      // escalateCodeExecution co-signal, without re-introducing a critical FP.
+      severity: inDocContext ? "low" : "high",
+      message: `chmod of a fetched/downloaded file (compound with a download verb): "${match[0]}"`,
+      location: line.trim().slice(0, 100),
+      lineNumber,
+      category: "privilege_escalation",
+      inDocumentationContext: inDocContext,
+      confidence: inDocContext ? "low" : "high"
+    });
+  });
+  return findings;
+}
+
 // ../core/dist/src/security/scanner/SecurityScanner.scanners.js
 var ENV_EXFIL_CONTEXT = /\b(?:cat|cp|mv|scp|rsync|source|curl|wget|fetch|less|more|head|tail|tee|upload|tar|zip|gzip|base64|xxd|dd|nc|netcat)\b|[|>]/i;
 var CREDENTIAL_ASSIGNMENT = /(?:api[_-]?key|apikey|auth[_-]?token|authtoken)\s*[:=]\s*.+$/i;
@@ -18673,234 +18831,80 @@ function scanPrivilegeEscalation(content, lineContexts) {
   });
   return findings;
 }
-var OWNER_PERM_CHMOD = /\bchmod\s+(?:[0-7]{3,4}|[ugoa]*\+x)\b/i;
-var CHMOD_FETCH_CONTEXT = /\b(?:curl|wget)\b|\bgit\s+clone\b|\bnpx\b[^\n]{0,80}https?:\/\//i;
-var CHMOD_TARGET = /\bchmod\s+(?:[0-7]{3,4}|[ugoa]*\+x)\s+(\S+)/i;
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// ../core/dist/src/security/scanner/SecurityScanner.exec.js
+var INVISIBLE_RANGE = "\\u0300-\\u036F\\u00AD\\u061C\\u180E\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u206F\\uFEFF";
+var INVISIBLE_TEST = new RegExp("[" + INVISIBLE_RANGE + "]|[\\u{E0000}-\\u{E007F}]", "u");
+var INVISIBLE_STRIP = new RegExp("[" + INVISIBLE_RANGE + "]|[\\u{E0000}-\\u{E007F}]", "gu");
+var CONFUSABLES = {
+  // Cyrillic -> Latin
+  \u0430: "a",
+  \u0435: "e",
+  \u043E: "o",
+  \u0440: "p",
+  \u0441: "c",
+  \u0443: "y",
+  \u0445: "x",
+  \u0456: "i",
+  \u0458: "j",
+  \u0455: "s",
+  "\u0501": "d",
+  \u04BB: "h",
+  \u043A: "k",
+  \u043C: "m",
+  \u0442: "t",
+  \u0432: "b",
+  \u043D: "h",
+  // Greek -> Latin
+  \u03BF: "o",
+  \u03B1: "a",
+  \u03C1: "p",
+  \u03B5: "e",
+  \u03C4: "t",
+  \u03B9: "i",
+  \u03BA: "k",
+  \u03C5: "u",
+  \u03C7: "x",
+  \u03BD: "v",
+  \u03F2: "c",
+  \u03B2: "b"
+};
+function isFullwidthLatin(cp) {
+  return cp >= 65313 && cp <= 65338 || cp >= 65345 && cp <= 65370;
 }
-function implicitDownloadBasename(line) {
-  const lastSegment = (urlAfterScheme) => {
-    const noFrag = urlAfterScheme.split(/[?#]/)[0];
-    const slash = noFrag.indexOf("/");
-    if (slash < 0)
-      return "";
-    const path22 = noFrag.slice(slash + 1).replace(/\/+$/, "");
-    return path22 === "" ? "" : path22.split("/").pop() ?? "";
-  };
-  const wget = line.match(/\bwget\b(?![^\n]{0,200}\s-[oO]\b)[^\n]{0,200}?https?:\/\/(\S{1,400})/i);
-  if (wget)
-    return lastSegment(wget[1]);
-  const clone2 = line.match(/\bgit\s+clone\b[^\n]{0,200}?https?:\/\/(\S{1,400})/i);
-  if (clone2)
-    return lastSegment(clone2[1]).replace(/\.git$/i, "");
-  const curlEq = line.match(/\bcurl\b[^\n]{0,200}?--output=['"]?(\S{1,400})/i);
-  if (curlEq)
-    return curlEq[1].replace(/['"]/g, "").split("/").pop() ?? "";
-  return "";
+function isMathAlphanumeric(cp) {
+  return cp >= 119808 && cp <= 120831;
 }
-function scanChmodFetchCompound(content, alreadyFlaggedLines, lineContexts) {
-  const findings = [];
-  const lines = content.split("\n");
-  const contexts = lineContexts ?? analyzeMarkdownContext(content);
-  const fetchLines = lines.filter((l) => CHMOD_FETCH_CONTEXT.test(l));
-  lines.forEach((line, index) => {
-    const lineNumber = index + 1;
-    if (alreadyFlaggedLines.has(lineNumber))
-      return;
-    const match = safeRegexTest(OWNER_PERM_CHMOD, line);
-    if (!match)
-      return;
-    const window2 = [lines[index - 1] ?? "", line, lines[index + 1] ?? ""].join("\n");
-    const adjacentFetch = CHMOD_FETCH_CONTEXT.test(window2);
-    let correlated = false;
-    const tm = line.match(CHMOD_TARGET);
-    if (tm) {
-      const base = tm[1].replace(/['"]/g, "").split("/").pop() ?? "";
-      if (base.length >= 3) {
-        const re = new RegExp(`(?:-o|-O|--output|>>?)\\s*['"]?(?:[^\\s'"]*/)?${escapeRegExp(base)}(?:[\\s'"?]|$)`);
-        correlated = fetchLines.some((l) => re.test(l) || implicitDownloadBasename(l) === base);
-      }
-    }
-    if (!adjacentFetch && !correlated)
-      return;
-    const ctx = contexts[index];
-    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
-    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-    findings.push({
-      type: "privilege_escalation",
-      // HIGH (not critical): enough to trip Gate-A AND serve as an
-      // escalateCodeExecution co-signal, without re-introducing a critical FP.
-      severity: inDocContext ? "low" : "high",
-      message: `chmod of a fetched/downloaded file (compound with a download verb): "${match[0]}"`,
-      location: line.trim().slice(0, 100),
-      lineNumber,
-      category: "privilege_escalation",
-      inDocumentationContext: inDocContext,
-      confidence: inDocContext ? "low" : "high"
-    });
-  });
-  return findings;
-}
-var CREDENTIAL_PII_INDICES = /* @__PURE__ */ new Set([0, 1, 2, 3, 4, 5, 6, 10]);
-var PLACEHOLDER_SECRET_RE = /EXAMPLE|(?<![A-Za-z0-9])YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|(?<![A-Za-z0-9])DUMMY|(?<![A-Za-z0-9])FAKE|(?<![A-Za-z0-9])SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
-var SECRET_ENTROPY_FLOOR = 3;
-function shannonEntropy(s) {
-  if (!s)
-    return 0;
-  const freq = /* @__PURE__ */ new Map();
-  for (const ch of s)
-    freq.set(ch, (freq.get(ch) ?? 0) + 1);
-  let h = 0;
-  for (const c of freq.values()) {
-    const p = c / s.length;
-    h -= p * Math.log2(p);
-  }
-  return h;
-}
-function extractSecretValue(match) {
-  return match.replace(/^[^:=]*[:=]\s*/, "").replace(/^['"]|['"]$/g, "").trim();
-}
-function looksLikePlaceholderSecret(match) {
-  if (PLACEHOLDER_SECRET_RE.test(match))
-    return true;
-  const value = extractSecretValue(match);
-  if (value.length === 0)
-    return false;
-  if (/^(.)\1+$/.test(value))
-    return true;
-  return shannonEntropy(value) < SECRET_ENTROPY_FLOOR;
-}
-function scanPiiPatterns(content, lineContexts) {
-  const findings = [];
-  const lines = content.split("\n");
-  const contexts = lineContexts ?? analyzeMarkdownContext(content);
-  let frontmatterEnd = -1;
-  if (lines[0]?.trim() === "---") {
-    for (let i = 1; i < lines.length; i++) {
-      if (lines[i].trim() === "---") {
-        frontmatterEnd = i;
-        break;
-      }
-    }
-  }
-  const emailPatternIndex = 7;
-  lines.forEach((line, index) => {
-    const ctx = contexts[index];
-    const inFrontmatter = index > 0 && index < frontmatterEnd;
-    for (let pi = 0; pi < PII_PATTERNS.length; pi++) {
-      const pattern = PII_PATTERNS[pi];
-      const match = safeRegexTest(pattern, line);
-      if (match) {
-        const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
-        const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-        const isEmailPattern = pi === emailPatternIndex;
-        const isAuthorLine = /^\s*(?:author|contact|support|email)\s*:/i.test(line);
-        const inEmailSafeContext = isEmailPattern && (inFrontmatter || isAuthorLine);
-        let severity;
-        if (inEmailSafeContext)
-          severity = "low";
-        else if (inDocContext)
-          severity = "medium";
-        else if (pi <= 2 || pi === 9)
-          severity = "critical";
-        else
-          severity = "high";
-        let confidence = inDocContext || inEmailSafeContext ? "low" : "high";
-        if (CREDENTIAL_PII_INDICES.has(pi) && looksLikePlaceholderSecret(match[0])) {
-          severity = "low";
-          confidence = "low";
-        }
-        findings.push({
-          type: "pii",
-          severity,
-          message: `PII detected: ${match[0].slice(0, 40)}${match[0].length > 40 ? "..." : ""}`,
-          location: line.trim().slice(0, 100),
-          lineNumber: index + 1,
-          category: "pii",
-          inDocumentationContext: inDocContext || inEmailSafeContext,
-          confidence
-        });
-        break;
-      }
-    }
-  });
-  return findings;
-}
-
-// ../core/dist/src/security/scanner/SecurityScanner.exec.js
-var INVISIBLE_RANGE = "\\u0300-\\u036F\\u00AD\\u061C\\u180E\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u206F\\uFEFF";
-var INVISIBLE_TEST = new RegExp("[" + INVISIBLE_RANGE + "]|[\\u{E0000}-\\u{E007F}]", "u");
-var INVISIBLE_STRIP = new RegExp("[" + INVISIBLE_RANGE + "]|[\\u{E0000}-\\u{E007F}]", "gu");
-var CONFUSABLES = {
-  // Cyrillic -> Latin
-  \u0430: "a",
-  \u0435: "e",
-  \u043E: "o",
-  \u0440: "p",
-  \u0441: "c",
-  \u0443: "y",
-  \u0445: "x",
-  \u0456: "i",
-  \u0458: "j",
-  \u0455: "s",
-  "\u0501": "d",
-  \u04BB: "h",
-  \u043A: "k",
-  \u043C: "m",
-  \u0442: "t",
-  \u0432: "b",
-  \u043D: "h",
-  // Greek -> Latin
-  \u03BF: "o",
-  \u03B1: "a",
-  \u03C1: "p",
-  \u03B5: "e",
-  \u03C4: "t",
-  \u03B9: "i",
-  \u03BA: "k",
-  \u03C5: "u",
-  \u03C7: "x",
-  \u03BD: "v",
-  \u03F2: "c",
-  \u03B2: "b"
-};
-function isFullwidthLatin(cp) {
-  return cp >= 65313 && cp <= 65338 || cp >= 65345 && cp <= 65370;
-}
-function isMathAlphanumeric(cp) {
-  return cp >= 119808 && cp <= 120831;
-}
-function stripInvisible(s) {
-  return s.replace(INVISIBLE_STRIP, "");
-}
-function confusableSkeleton(s) {
-  let out = "";
-  for (const ch of s) {
-    const cp = ch.codePointAt(0) ?? 0;
-    if (isFullwidthLatin(cp)) {
-      out += String.fromCodePoint(cp - 65248);
-    } else if (isMathAlphanumeric(cp)) {
-      const folded = ch.normalize("NFKC");
-      out += CONFUSABLES[folded] ?? folded;
-    } else if (CONFUSABLES[ch]) {
-      out += CONFUSABLES[ch];
-    } else {
-      out += ch;
-    }
-  }
-  return out;
-}
-function hasConfusable(s) {
-  for (const ch of s) {
-    const cp = ch.codePointAt(0) ?? 0;
-    if (isFullwidthLatin(cp) || isMathAlphanumeric(cp) || CONFUSABLES[ch])
-      return true;
-  }
-  return false;
-}
-var OBFUSCATION_DIRECTIVE_PATTERN = /(?:ignore|disregard|forget)\s+(?:all\s+|the\s+)?(?:previous|prior|above|earlier)\s+(?:instruction|prompt|rule|direction)|bypass\s+(?:all\s+)?(?:restriction|filter|safety|guard|security)|(?:reveal|show|print|dump|leak)\s+(?:me\s+)?(?:your\s+|the\s+)?(?:system\s+)?(?:prompt|instruction)|(?:curl|wget)\b[^\n|]{0,120}?(?:https?:\/\/|\d{1,3}(?:\.\d{1,3}){3}|[\w-]{2,}\.[a-z]{2,})[^\n|]{0,120}?\|\s*(?:ba|z)?sh\b/i;
-function scanCodeExecution(content, lineContexts) {
+function stripInvisible(s) {
+  return s.replace(INVISIBLE_STRIP, "");
+}
+function confusableSkeleton(s) {
+  let out = "";
+  for (const ch of s) {
+    const cp = ch.codePointAt(0) ?? 0;
+    if (isFullwidthLatin(cp)) {
+      out += String.fromCodePoint(cp - 65248);
+    } else if (isMathAlphanumeric(cp)) {
+      const folded = ch.normalize("NFKC");
+      out += CONFUSABLES[folded] ?? folded;
+    } else if (CONFUSABLES[ch]) {
+      out += CONFUSABLES[ch];
+    } else {
+      out += ch;
+    }
+  }
+  return out;
+}
+function hasConfusable(s) {
+  for (const ch of s) {
+    const cp = ch.codePointAt(0) ?? 0;
+    if (isFullwidthLatin(cp) || isMathAlphanumeric(cp) || CONFUSABLES[ch])
+      return true;
+  }
+  return false;
+}
+var OBFUSCATION_DIRECTIVE_PATTERN = /(?:ignore|disregard|forget)\s+(?:all\s+|the\s+)?(?:previous|prior|above|earlier)\s+(?:instruction|prompt|rule|direction)|bypass\s+(?:all\s+)?(?:restriction|filter|safety|guard|security)|(?:reveal|show|print|dump|leak)\s+(?:me\s+)?(?:your\s+|the\s+)?(?:system\s+)?(?:prompt|instruction)|(?:curl|wget)\b[^\n|]{0,120}?(?:https?:\/\/|\d{1,3}(?:\.\d{1,3}){3}|[\w-]{2,}\.[a-z]{2,})[^\n|]{0,120}?\|\s*(?:ba|z)?sh\b/i;
+function scanCodeExecution(content, lineContexts) {
   const lines = content.split("\n");
   const contexts = lineContexts ?? analyzeMarkdownContext(content);
   for (let i = 0; i < lines.length; i++) {
@@ -29803,61 +29807,9 @@ async function openCliDatabase(path22, options) {
   }
 }
 
-// src/commands/search.helpers.ts
-async function searchRemoteOrLocal(searchOptions, db) {
-  try {
-    const jwtToken = await loadStoredAccessToken();
-    const apiClient = createApiClient(jwtToken ? { jwtToken } : {});
-    if (!apiClient.isOffline()) {
-      const response = await apiClient.search(searchOptions);
-      const items = response.data.map((r, i) => ({
-        skill: SkillsmithApiClient.toSkill(r),
-        rank: i,
-        highlights: {}
-      }));
-      const limit = searchOptions.limit ?? 10;
-      const offset = searchOptions.offset ?? 0;
-      const hasMore = items.length >= limit;
-      const totalHint = offset + items.length + (hasMore ? 1 : 0);
-      return { kind: "results", items, hasMore, totalHint };
-    }
-  } catch (error46) {
-    if (error46 instanceof SkillsmithError && error46.code === ErrorCodes.NETWORK_QUOTA_EXCEEDED) {
-      return { kind: "quota", message: error46.message };
-    }
-    if (error46 instanceof ApiClientError && (error46.statusCode === 401 || error46.statusCode === 403)) {
-      return { kind: "auth" };
-    }
-    if (!isNetworkError(error46)) {
-      throw error46;
-    }
-  }
-  if (new SkillRepository(db).count() === 0) {
-    return { kind: "empty" };
-  }
-  const local = new SearchService(db).search(searchOptions);
-  return {
-    kind: "results",
-    items: local.items,
-    hasMore: local.hasMore,
-    totalHint: local.total
-  };
-}
-function isLocalIndexEmpty(db) {
-  return new SkillRepository(db).count() === 0;
-}
-function formatEmptyIndexHint() {
-  return source_default.yellow(
-    "\n\u2139 Skillsmith is offline and your local skill index is empty. Check your connection and try again.\n"
-  );
-}
-function isNetworkError(error46) {
-  if (error46 instanceof TypeError) return true;
-  if (error46 instanceof Error) {
-    return /ENOTFOUND|ECONNREFUSED|AbortError|ETIMEDOUT|ENETUNREACH/.test(error46.message);
-  }
-  return false;
-}
+// src/commands/install.ts
+import { Command } from "commander";
+import ora from "ora";
 
 // src/utils/sanitize.ts
 import { homedir as homedir13 } from "os";
@@ -29872,12 +29824,330 @@ function sanitizeError(error46) {
   return sanitized;
 }
 
-// src/commands/search-types.ts
-var PAGE_SIZE = 10;
-
-// src/commands/search-formatters.ts
-import Table from "cli-table3";
-var TRUST_TIER_COLORS = {
+// src/commands/install.ts
+var VALID_CLIENT_HINT = "Valid IDs: claude-code | cursor | copilot | windsurf | agents (Codex users pass --client agents).";
+function parseAlsoLink(raw, defaultClient) {
+  if (!raw || raw.trim() === "") return [];
+  const ids = raw.split(",").map((s) => s.trim()).filter((s) => s !== "");
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const id of ids) {
+    assertClientId(id);
+    if (id === defaultClient) {
+      throw new Error(
+        `--also-link target '${id}' is the same as --client; pick a different client or drop it from --also-link.`
+      );
+    }
+    if (seen.has(id)) {
+      throw new Error(`--also-link target '${id}' is listed more than once`);
+    }
+    seen.add(id);
+    out.push(id);
+  }
+  return out;
+}
+function isValidSkillId(skillId) {
+  if (isGitHubUrl(skillId)) return true;
+  return /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9_.-]+$/.test(skillId);
+}
+function createDbRegistryLookup(skillRepo, db) {
+  let quarantineRepo;
+  return {
+    async lookup(skillId) {
+      const skill = skillRepo.findById(skillId);
+      if (!skill) return null;
+      if (!skill.repoUrl) return null;
+      quarantineRepo ??= new QuarantineRepository(db);
+      return {
+        repoUrl: skill.repoUrl,
+        name: skill.name,
+        trustTier: skill.trustTier,
+        quarantined: quarantineRepo.isQuarantined(skill.id || skillId)
+      };
+    }
+  };
+}
+async function createApiBackedRegistryLookup(skillRepo, db) {
+  const dbLookup = createDbRegistryLookup(skillRepo, db);
+  const jwtToken = await loadStoredAccessToken();
+  const apiClient = createApiClient(jwtToken ? { jwtToken } : {});
+  return {
+    async lookup(skillId) {
+      const local = await dbLookup.lookup(skillId);
+      if (local) return local;
+      if (apiClient.isOffline()) return null;
+      try {
+        const response = await apiClient.getSkill(skillId);
+        const r = response.data;
+        if (!r.repo_url) return null;
+        return {
+          repoUrl: r.repo_url,
+          name: r.name,
+          trustTier: SkillsmithApiClient.toSkill(r).trustTier,
+          quarantined: r.quarantined === true || r.installable === false
+        };
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+function formatJsonResult(result) {
+  return JSON.stringify(
+    {
+      success: result.success,
+      skillId: result.skillId,
+      installPath: result.installPath,
+      error: result.error,
+      trustTier: result.trustTier,
+      optimization: result.optimization,
+      tips: result.tips
+    },
+    null,
+    2
+  );
+}
+function displayResult(result, quiet) {
+  if (result.success) {
+    console.log(source_default.green("\nSkill installed successfully!"));
+    console.log(source_default.dim(`  Path: ${result.installPath}`));
+    if (result.trustTier) {
+      console.log(source_default.dim(`  Trust tier: ${result.trustTier}`));
+    }
+    if (result.optimization?.optimized && !quiet) {
+      console.log(source_default.dim(`  Optimized: ${result.optimization.tokenReductionPercent}% reduction`));
+      if (result.optimization.subSkills && result.optimization.subSkills.length > 0) {
+        console.log(source_default.dim(`  Sub-skills: ${result.optimization.subSkills.join(", ")}`));
+      }
+      if (result.optimization.subagentGenerated) {
+        console.log(source_default.dim(`  Companion subagent generated`));
+      }
+    }
+    if (result.contentHashMismatch) {
+      console.log(source_default.yellow("\n  Warning: Content has changed since last indexed."));
+      console.log(source_default.yellow("  Review recent changes at the skill's repository before using."));
+    }
+    if (result.tips && result.tips.length > 0 && !quiet) {
+      const startIndex = result.contentHashMismatch ? 1 : 0;
+      if (startIndex < result.tips.length) {
+        console.log();
+        for (let i = startIndex; i < result.tips.length; i++) {
+          console.log(source_default.dim(`  Tip: ${result.tips[i]}`));
+        }
+      }
+    }
+  } else {
+    console.error(source_default.red(`
+Installation failed: ${result.error}`));
+    if (result.securityReport && !result.securityReport.passed) {
+      console.error(source_default.red("  Security scan failed."));
+      for (const finding of result.securityReport.findings) {
+        if (finding.severity === "critical" || finding.severity === "high") {
+          console.error(source_default.red(`  [${finding.severity}] ${finding.message}`));
+        }
+      }
+    }
+    if (result.tips && result.tips.length > 0 && !quiet) {
+      console.log();
+      for (const tip of result.tips) {
+        console.log(source_default.dim(`  ${tip}`));
+      }
+    }
+  }
+}
+async function installActionImpl(skillId, opts) {
+  const quiet = opts.quiet ?? false;
+  const jsonOutput = opts.json ?? false;
+  try {
+    const rawClient = opts.client ?? "claude-code";
+    if (rawClient.includes(",")) {
+      throw new Error(
+        `--client takes a single value (got '${rawClient}'). Pass --also-link <ids> to fan-out into additional clients.`
+      );
+    }
+    assertClientId(rawClient);
+    const client = rawClient;
+    const alsoLinkClients = parseAlsoLink(opts.alsoLink, client);
+    const skillsDir = getInstallPath(client);
+    if (!isValidSkillId(skillId)) {
+      const errorMsg = 'Invalid skill ID format. Expected "author/name" or a GitHub URL.\n  Examples:\n    skillsmith install getsentry/commit\n    skillsmith install https://github.com/owner/repo';
+      if (jsonOutput) {
+        console.log(JSON.stringify({ success: false, skillId, error: errorMsg }, null, 2));
+      } else {
+        console.error(source_default.red(errorMsg));
+      }
+      process.exit(1);
+      return;
+    }
+    const dbPath = opts.db ?? DEFAULT_DB_PATH;
+    const db = await openCliDatabase(dbPath);
+    const spinner = jsonOutput ? null : ora("Installing skill...").start();
+    try {
+      const skillRepo = new SkillRepository(db);
+      const skillDependencyRepo = new SkillDependencyRepository(db);
+      const registryLookup = await createApiBackedRegistryLookup(skillRepo, db);
+      const service = new SkillInstallationService({
+        db,
+        skillRepo,
+        skillDependencyRepo,
+        skillsDir,
+        manifestPath: DEFAULT_MANIFEST_PATH,
+        registryLookup,
+        onProgress: (_stage, detail) => {
+          if (spinner) {
+            spinner.text = detail;
+          }
+        }
+      });
+      const installOptions = {};
+      if (opts.force !== void 0) {
+        installOptions.force = opts.force;
+      }
+      if (opts.skipScan !== void 0) {
+        installOptions.skipScan = opts.skipScan;
+      }
+      if (opts.skipOptimize !== void 0) {
+        installOptions.skipOptimize = opts.skipOptimize;
+      }
+      const installStart = Date.now();
+      const result = await service.install(skillId, installOptions);
+      void emitInstallEvent({
+        skillId,
+        source: "cli",
+        success: result.success,
+        durationMs: Date.now() - installStart,
+        ...result.trustTier !== void 0 && { trustTier: result.trustTier },
+        ...!result.success && result.errorCode !== void 0 && { errorCode: result.errorCode }
+      });
+      if (result.success && alsoLinkClients.length > 0) {
+        for (const target of alsoLinkClients) {
+          try {
+            const linked = await addLink({
+              skillId,
+              fromClient: client,
+              toClient: target,
+              preferSymlink: opts.symlink ?? false,
+              force: opts.force ?? false
+            });
+            if (!quiet && !jsonOutput) {
+              const note = linked.fellBackToCopy ? " (fell back to copy)" : "";
+              console.log(source_default.dim(`  Linked into ${target} as ${linked.record.kind}${note}`));
+            }
+          } catch (linkErr) {
+            if (!jsonOutput) {
+              console.warn(
+                source_default.yellow(`  Warning: could not link to ${target}: ${sanitizeError(linkErr)}`)
+              );
+            }
+          }
+        }
+      }
+      if (spinner) {
+        if (result.success) {
+          spinner.succeed("Skill installed");
+        } else {
+          spinner.fail("Installation failed");
+        }
+      }
+      if (jsonOutput) {
+        console.log(formatJsonResult(result));
+      } else {
+        displayResult(result, quiet);
+      }
+      if (!result.success) {
+        process.exit(1);
+      }
+    } finally {
+      db.close();
+    }
+  } catch (error46) {
+    if (jsonOutput) {
+      console.log(JSON.stringify({ success: false, skillId, error: sanitizeError(error46) }, null, 2));
+    } else {
+      console.error(source_default.red("Install error:"), sanitizeError(error46));
+    }
+    process.exit(1);
+  }
+}
+var installAction = withTelemetry(installActionImpl, {
+  source: "cli",
+  extractSkillId: () => "install",
+  extractFramework: () => "cli"
+});
+function createInstallCommand() {
+  return new Command("install").description("Install a skill from the registry or GitHub URL").argument("<skillId>", "Skill ID (author/name) or GitHub URL").option("-f, --force", "Force reinstall if already installed").option("--skip-scan", "Skip security scan (not recommended)").option("--skip-optimize", "Skip Skillsmith optimization").option("-q, --quiet", "Suppress advisory output").option("--json", "Output structured JSON result").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--client <id>", `install for a specific agent (${VALID_CLIENT_HINT})`, "claude-code").option(
+    "--also-link <ids>",
+    "comma-separated additional clients to fan-out into (default: copy; pair with --symlink for POSIX symlinks)",
+    ""
+  ).option(
+    "--symlink",
+    "use relative symlinks instead of file copies for --also-link (POSIX only; falls back to copy on Windows EPERM)",
+    false
+  ).action(installAction);
+}
+
+// src/commands/search.helpers.ts
+async function searchRemoteOrLocal(searchOptions, db) {
+  try {
+    const jwtToken = await loadStoredAccessToken();
+    const apiClient = createApiClient(jwtToken ? { jwtToken } : {});
+    if (!apiClient.isOffline()) {
+      const response = await apiClient.search(searchOptions);
+      const items = response.data.map((r, i) => ({
+        skill: SkillsmithApiClient.toSkill(r),
+        rank: i,
+        highlights: {}
+      }));
+      const limit = searchOptions.limit ?? 10;
+      const offset = searchOptions.offset ?? 0;
+      const hasMore = items.length >= limit;
+      const totalHint = offset + items.length + (hasMore ? 1 : 0);
+      return { kind: "results", items, hasMore, totalHint };
+    }
+  } catch (error46) {
+    if (error46 instanceof SkillsmithError && error46.code === ErrorCodes.NETWORK_QUOTA_EXCEEDED) {
+      return { kind: "quota", message: error46.message };
+    }
+    if (error46 instanceof ApiClientError && (error46.statusCode === 401 || error46.statusCode === 403)) {
+      return { kind: "auth" };
+    }
+    if (!isNetworkError(error46)) {
+      throw error46;
+    }
+  }
+  if (new SkillRepository(db).count() === 0) {
+    return { kind: "empty" };
+  }
+  const local = new SearchService(db).search(searchOptions);
+  return {
+    kind: "results",
+    items: local.items,
+    hasMore: local.hasMore,
+    totalHint: local.total
+  };
+}
+function isLocalIndexEmpty(db) {
+  return new SkillRepository(db).count() === 0;
+}
+function formatEmptyIndexHint() {
+  return source_default.yellow(
+    "\n\u2139 Skillsmith is offline and your local skill index is empty. Check your connection and try again.\n"
+  );
+}
+function isNetworkError(error46) {
+  if (error46 instanceof TypeError) return true;
+  if (error46 instanceof Error) {
+    return /ENOTFOUND|ECONNREFUSED|AbortError|ETIMEDOUT|ENETUNREACH/.test(error46.message);
+  }
+  return false;
+}
+
+// src/commands/search-types.ts
+var PAGE_SIZE = 10;
+
+// src/commands/search-formatters.ts
+import Table from "cli-table3";
+var TRUST_TIER_COLORS = {
   official: source_default.magenta,
   // SMI-5205: Platform/partner — magenta to stand out from verified
   verified: source_default.green,
@@ -30116,11 +30386,11 @@ ${outcome.message}`));
               ]
             });
             if (nextAction === "install") {
-              const installSpinner = ora("Installing skill...").start();
+              const installSpinner = ora2("Installing skill...").start();
               try {
                 const skillRepo = new SkillRepository(db);
                 const skillDependencyRepo = new SkillDependencyRepository(db);
-                const registryLookup = buildRegistryLookupWithApiFallback(skillRepo);
+                const registryLookup = await createApiBackedRegistryLookup(skillRepo, db);
                 const installService = new SkillInstallationService({
                   db,
                   skillRepo,
@@ -30160,41 +30430,10 @@ ${outcome.message}`));
   }
   console.log(source_default.dim("\nGoodbye!\n"));
 }
-function buildRegistryLookupWithApiFallback(skillRepo) {
-  return {
-    async lookup(sid) {
-      const s = skillRepo.findById(sid);
-      if (s?.repoUrl) {
-        return {
-          repoUrl: s.repoUrl,
-          name: s.name,
-          trustTier: s.trustTier,
-          quarantined: false
-        };
-      }
-      try {
-        const jwtToken = await loadStoredAccessToken();
-        const apiClient = createApiClient(jwtToken ? { jwtToken } : {});
-        if (apiClient.isOffline()) return null;
-        const response = await apiClient.getSkill(sid);
-        const r = response.data;
-        if (!r.repo_url) return null;
-        return {
-          repoUrl: r.repo_url,
-          name: r.name,
-          trustTier: SkillsmithApiClient.toSkill(r).trustTier,
-          quarantined: false
-        };
-      } catch {
-        return null;
-      }
-    }
-  };
-}
 async function runSearch(query, options) {
   const db = await openCliDatabase(options.db);
   const suppress = options.quiet || options.noProgress || process.env["SKILLSMITH_QUIET"] === "true";
-  const spinner = suppress ? null : ora("Searching Skillsmith registry...").start();
+  const spinner = suppress ? null : ora2("Searching Skillsmith registry...").start();
   try {
     const searchOptions = {
       query,
@@ -30301,7 +30540,7 @@ var searchAction = withTelemetry(searchActionImpl, {
 
 // src/commands/search.ts
 function createSearchCommand() {
-  const cmd = new Command("search").description(
+  const cmd = new Command2("search").description(
     `Search for skills
 
 Quality Score Formula:
@@ -30331,10 +30570,10 @@ Quality Score Formula:
 }
 
 // src/commands/manage.ts
-import { Command as Command2 } from "commander";
+import { Command as Command3 } from "commander";
 import { confirm } from "@inquirer/prompts";
 import Table2 from "cli-table3";
-import ora2 from "ora";
+import ora3 from "ora";
 import { mkdir as mkdir4 } from "fs/promises";
 import { dirname as dirname9 } from "path";
 
@@ -30607,7 +30846,7 @@ async function getSkillDiff(skillName, dbPath) {
   }
 }
 async function updateSkill(skillName, dbPath) {
-  const spinner = ora2(`Checking updates for ${skillName}...`).start();
+  const spinner = ora3(`Checking updates for ${skillName}...`).start();
   try {
     const diff = await getSkillDiff(skillName, dbPath);
     if (!diff) {
@@ -30633,7 +30872,7 @@ Changes for ${skillName}:`));
       console.log(source_default.yellow("Update cancelled"));
       return false;
     }
-    const updateSpinner = ora2(`Updating ${skillName}...`).start();
+    const updateSpinner = ora3(`Updating ${skillName}...`).start();
     updateSpinner.stop();
     throw new Error("updateSkill not yet implemented");
   } catch (error46) {
@@ -30690,7 +30929,7 @@ Skill to remove:`));
       return false;
     }
   }
-  const spinner = ora2(`Removing ${skillName}...`).start();
+  const spinner = ora3(`Removing ${skillName}...`).start();
   await mkdir4(dirname9(dbPath), { recursive: true });
   const db = await openCliDatabase(dbPath);
   try {
@@ -30761,7 +31000,7 @@ var listAction = withTelemetry(listActionImpl, {
   extractFramework: () => "cli"
 });
 function createListCommand() {
-  return new Command2("list").alias("ls").description("List all installed skills").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--outdated", "Show only skills with available updates (requires Individual tier)").action(listAction);
+  return new Command3("list").alias("ls").description("List all installed skills").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--outdated", "Show only skills with available updates (requires Individual tier)").action(listAction);
 }
 async function updateActionImpl(skillName, opts) {
   const dbPath = opts["db"];
@@ -30783,7 +31022,7 @@ var updateAction = withTelemetry(updateActionImpl, {
   extractFramework: () => "cli"
 });
 function createUpdateCommand() {
-  return new Command2("update").description("Update installed skills").argument("[skill]", "Skill name to update (omit for all)").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("-a, --all", "Update all installed skills").action(updateAction);
+  return new Command3("update").description("Update installed skills").argument("[skill]", "Skill name to update (omit for all)").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("-a, --all", "Update all installed skills").action(updateAction);
 }
 async function removeActionImpl(skillName, opts) {
   const force = opts["force"] ?? false;
@@ -30802,11 +31041,11 @@ var removeAction = withTelemetry(removeActionImpl, {
   extractFramework: () => "cli"
 });
 function createRemoveCommand() {
-  return new Command2("remove").alias("rm").alias("uninstall").description("Remove an installed skill").argument("<skill>", "Skill name to remove").option("-f, --force", "Skip confirmation prompt and force removal of modified/orphan skills").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).action(removeAction);
+  return new Command3("remove").alias("rm").alias("uninstall").description("Remove an installed skill").argument("<skill>", "Skill name to remove").option("-f, --force", "Skip confirmation prompt and force removal of modified/orphan skills").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).action(removeAction);
 }
 
 // src/commands/author/init.action.ts
-import { Command as Command3 } from "commander";
+import { Command as Command4 } from "commander";
 
 // src/utils/errors.ts
 var InitSkillError = class _InitSkillError extends Error {
@@ -30826,7 +31065,7 @@ var InitSkillError = class _InitSkillError extends Error {
 
 // src/commands/author/init.ts
 import { input as input2, confirm as confirm2, select as select2 } from "@inquirer/prompts";
-import ora3 from "ora";
+import ora4 from "ora";
 import { mkdir as mkdir7, writeFile as writeFile5, readFile as readFile7, stat as stat6, readdir as readdir6 } from "fs/promises";
 import { dirname as dirname10, join as join25, resolve as resolve9 } from "path";
 import { createHash as createHash8 } from "crypto";
@@ -31882,7 +32121,7 @@ async function initSkill(name, targetPath, options = {}) {
     }
   } catch {
   }
-  const spinner = ora3("Creating skill structure...").start();
+  const spinner = ora4("Creating skill structure...").start();
   let createdFresh = false;
   try {
     await mkdir7(skillDir, { recursive: true });
@@ -31915,7 +32154,7 @@ async function initSkill(name, targetPath, options = {}) {
   console.log();
 }
 async function validateSkill(skillPath) {
-  const spinner = ora3("Validating skill...").start();
+  const spinner = ora4("Validating skill...").start();
   try {
     let filePath = resolve9(skillPath);
     try {
@@ -31960,7 +32199,7 @@ async function validateSkill(skillPath) {
   }
 }
 async function publishSkill(skillPath, options = {}) {
-  const spinner = ora3("Preparing skill for publishing...").start();
+  const spinner = ora4("Preparing skill for publishing...").start();
   try {
     let dirPath = resolve9(skillPath || ".");
     try {
@@ -32100,7 +32339,7 @@ var initAction = withTelemetry(initActionImpl, {
   extractFramework: () => "cli"
 });
 function createInitCommand() {
-  return new Command3("init").description("Initialize a new skill directory").argument("[name]", "Skill name").option("-p, --path <path>", "Target directory", ".").option("-d, --description <description>", "Skill description (non-interactive)").option("-a, --author <author>", "Skill author (non-interactive)").option(
+  return new Command4("init").description("Initialize a new skill directory").argument("[name]", "Skill name").option("-p, --path <path>", "Target directory", ".").option("-d, --description <description>", "Skill description (non-interactive)").option("-a, --author <author>", "Skill author (non-interactive)").option(
     "-c, --category <category>",
     "Skill category: development|productivity|communication|data|security|other (non-interactive)"
   ).option("-y, --yes", "Auto-confirm overwrite (non-interactive)").action(initAction);
@@ -32120,7 +32359,7 @@ var validateAction = withTelemetry(validateActionImpl, {
   extractFramework: () => "cli"
 });
 function createValidateCommand() {
-  return new Command3("validate").description("Validate a local SKILL.md file").argument("[path]", "Path to SKILL.md or skill directory", ".").action(validateAction);
+  return new Command4("validate").description("Validate a local SKILL.md file").argument("[path]", "Path to SKILL.md or skill directory", ".").action(validateAction);
 }
 async function publishActionImpl(skillPath, opts) {
   try {
@@ -32143,15 +32382,15 @@ var publishAction = withTelemetry(publishActionImpl, {
   extractFramework: () => "cli"
 });
 function createPublishCommand() {
-  return new Command3("publish").description("Prepare skill for sharing").argument("[path]", "Path to skill directory", ".").option("--check-references", "Scan for project-specific references before publishing").option(
+  return new Command4("publish").description("Prepare skill for sharing").argument("[path]", "Path to skill directory", ".").option("--check-references", "Scan for project-specific references before publishing").option(
     "--reference-patterns <patterns>",
     "Additional regex patterns to check (comma-separated)"
   ).action(publishAction);
 }
 
 // src/commands/author/subagent.ts
-import { Command as Command4 } from "commander";
-import ora4 from "ora";
+import { Command as Command5 } from "commander";
+import ora5 from "ora";
 import { readFile as readFile8, writeFile as writeFile6, stat as stat7 } from "fs/promises";
 import { basename as basename4, dirname as dirname11, join as join26, resolve as resolve10 } from "path";
 
@@ -32274,7 +32513,7 @@ function validateTools(tools) {
 
 // src/commands/author/subagent.ts
 async function generateSubagent2(skillPath, options) {
-  const spinner = ora4("Generating subagent...").start();
+  const spinner = ora5("Generating subagent...").start();
   try {
     let dirPath = resolve10(skillPath || ".");
     let skillMdPath;
@@ -32394,17 +32633,17 @@ var subagentAction = withTelemetry(subagentActionImpl, {
   extractFramework: () => "cli"
 });
 function createSubagentCommand() {
-  return new Command4("subagent").description("Generate a companion subagent for a skill").argument("[path]", "Path to skill directory", ".").option("-o, --output <path>", "Output directory", "~/.claude/agents").option("--tools <tools>", "Override detected tools (comma-separated)").option("--model <model>", "Model for subagent: sonnet|opus|haiku", "sonnet").option("--skip-claude-md", "Skip CLAUDE.md snippet generation").option("--force", "Overwrite existing subagent definition").action(subagentAction);
+  return new Command5("subagent").description("Generate a companion subagent for a skill").argument("[path]", "Path to skill directory", ".").option("-o, --output <path>", "Output directory", "~/.claude/agents").option("--tools <tools>", "Override detected tools (comma-separated)").option("--model <model>", "Model for subagent: sonnet|opus|haiku", "sonnet").option("--skip-claude-md", "Skip CLAUDE.md snippet generation").option("--force", "Overwrite existing subagent definition").action(subagentAction);
 }
 
 // src/commands/author/transform.ts
-import { Command as Command5 } from "commander";
-import ora5 from "ora";
+import { Command as Command6 } from "commander";
+import ora6 from "ora";
 import { readFile as readFile9, readdir as readdir7 } from "fs/promises";
 import { join as join27, resolve as resolve11 } from "path";
 import { homedir as homedir15 } from "os";
 async function transformSkill2(skillPath, options) {
-  const spinner = ora5("Transforming skill...").start();
+  const spinner = ora6("Transforming skill...").start();
   try {
     const dirPath = resolve11(skillPath || ".");
     if (options.batch) {
@@ -32505,13 +32744,13 @@ var transformAction = withTelemetry(transformActionImpl, {
   extractFramework: () => "cli"
 });
 function createTransformCommand() {
-  return new Command5("transform").description("Upgrade existing skill with subagent configuration").argument("[path]", "Path to skill directory", ".").option("--dry-run", "Preview what would be generated").option("--force", "Overwrite existing subagent").option("--batch", "Process directory of skills").option("--tools <tools>", "Override detected tools (comma-separated)").option("--model <model>", "Model for subagent: sonnet|opus|haiku", "sonnet").action(transformAction);
+  return new Command6("transform").description("Upgrade existing skill with subagent configuration").argument("[path]", "Path to skill directory", ".").option("--dry-run", "Preview what would be generated").option("--force", "Overwrite existing subagent").option("--batch", "Process directory of skills").option("--tools <tools>", "Override detected tools (comma-separated)").option("--model <model>", "Model for subagent: sonnet|opus|haiku", "sonnet").action(transformAction);
 }
 
 // src/commands/author/mcp-init.ts
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 import { input as input3, confirm as confirm3 } from "@inquirer/prompts";
-import ora6 from "ora";
+import ora7 from "ora";
 import { mkdir as mkdir8, writeFile as writeFile7, stat as stat8 } from "fs/promises";
 import { dirname as dirname12, join as join28, resolve as resolve12 } from "path";
 async function initMcpServer(name, options) {
@@ -32616,7 +32855,7 @@ async function initMcpServer(name, options) {
     }
   } catch {
   }
-  const spinner = ora6("Creating MCP server...").start();
+  const spinner = ora7("Creating MCP server...").start();
   try {
     const files = renderMcpServerTemplates({
       name: serverName,
@@ -32678,11 +32917,11 @@ var mcpInitAction = withTelemetry(mcpInitActionImpl, {
   extractFramework: () => "cli"
 });
 function createMcpInitCommand() {
-  return new Command6("mcp-init").description("Scaffold a new MCP server project").argument("[name]", "MCP server name").option("-o, --output <path>", "Output directory").option("--tools <tools>", "Initial tools (comma-separated)").option("--force", "Overwrite existing directory").action(mcpInitAction);
+  return new Command7("mcp-init").description("Scaffold a new MCP server project").argument("[name]", "MCP server name").option("-o, --output <path>", "Output directory").option("--tools <tools>", "Initial tools (comma-separated)").option("--force", "Overwrite existing directory").action(mcpInitAction);
 }
 
 // src/commands/analyze.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 function formatAnalysisResults(context, analyzer) {
   const lines = [];
   lines.push("");
@@ -32819,13 +33058,13 @@ var analyzeAction = withTelemetry(analyzeActionImpl, {
   extractFramework: () => "cli"
 });
 function createAnalyzeCommand() {
-  const cmd = new Command7("analyze").description("Analyze a codebase to detect frameworks, dependencies, and patterns").argument("[path]", "Path to the codebase to analyze", ".").option("-m, --max-files <number>", "Maximum files to analyze", "1000").option("-e, --exclude <dirs...>", "Directories to exclude (in addition to defaults)").option("--no-dev-deps", "Exclude dev dependencies from analysis").option("-j, --json", "Output results as JSON").action(analyzeAction);
+  const cmd = new Command8("analyze").description("Analyze a codebase to detect frameworks, dependencies, and patterns").argument("[path]", "Path to the codebase to analyze", ".").option("-m, --max-files <number>", "Maximum files to analyze", "1000").option("-e, --exclude <dirs...>", "Directories to exclude (in addition to defaults)").option("--no-dev-deps", "Exclude dev dependencies from analysis").option("-j, --json", "Output results as JSON").action(analyzeAction);
   return cmd;
 }
 
 // src/commands/recommend.ts
-import { Command as Command8 } from "commander";
-import ora7 from "ora";
+import { Command as Command9 } from "commander";
+import ora8 from "ora";
 
 // src/commands/recommend.helpers.ts
 import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync9, statSync as statSync2 } from "node:fs";
@@ -33188,7 +33427,7 @@ function getInstalledSkills2() {
 
 // src/commands/recommend.ts
 async function runRecommend(targetPath, options) {
-  const spinner = ora7();
+  const spinner = ora8();
   let codebaseContext = null;
   try {
     spinner.start("Analyzing codebase...");
@@ -33329,7 +33568,7 @@ var recommendAction = withTelemetry(recommendActionImpl, {
   extractFramework: () => "cli"
 });
 function createRecommendCommand() {
-  const cmd = new Command8("recommend").description("Analyze a codebase and recommend relevant skills based on detected patterns").argument("[path]", "Path to the codebase to analyze", ".").option("-l, --limit <number>", "Maximum recommendations to return", "5").option("-j, --json", "Output results as JSON").option("-c, --context <text>", "Additional context for recommendations").option("-i, --installed <skills...>", "Currently installed skill IDs").option("--no-overlap", "Disable overlap detection").option("-m, --max-files <number>", "Maximum files to analyze", "1000").option(
+  const cmd = new Command9("recommend").description("Analyze a codebase and recommend relevant skills based on detected patterns").argument("[path]", "Path to the codebase to analyze", ".").option("-l, --limit <number>", "Maximum recommendations to return", "5").option("-j, --json", "Output results as JSON").option("-c, --context <text>", "Additional context for recommendations").option("-i, --installed <skills...>", "Currently installed skill IDs").option("--no-overlap", "Disable overlap detection").option("-m, --max-files <number>", "Maximum files to analyze", "1000").option(
     "-r, --role <role>",
     `SMI-1631: Filter by skill role (${SKILL_ROLES.join(", ")}). Skills matching the role get a +30 score boost.`
   ).action(recommendAction);
@@ -33337,10 +33576,10 @@ function createRecommendCommand() {
 }
 
 // src/commands/sync.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 
 // src/commands/sync.action.ts
-import ora8 from "ora";
+import ora9 from "ora";
 import Table3 from "cli-table3";
 
 // src/commands/run-registry-sync.ts
@@ -33434,7 +33673,7 @@ function formatAdapterWarnings(warnings) {
 
 // src/commands/sync.action.ts
 async function syncActionImpl(options) {
-  const spinner = ora8();
+  const spinner = ora9();
   try {
     spinner.start("Opening database...");
     const db = await openCliDatabase(options.dbPath);
@@ -33725,7 +33964,7 @@ var syncConfigAction = withTelemetry(syncConfigActionImpl, {
 
 // src/commands/sync.ts
 function createStatusCommand() {
-  return new Command9("status").description("Show sync status and statistics").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--json", "Output as JSON").action(async (opts) => {
+  return new Command10("status").description("Show sync status and statistics").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--json", "Output as JSON").action(async (opts) => {
     await syncStatusAction({
       dbPath: opts["db"],
       json: opts["json"] ?? false
@@ -33733,7 +33972,7 @@ function createStatusCommand() {
   });
 }
 function createHistoryCommand() {
-  return new Command9("history").description("Show sync history").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("-l, --limit <number>", "Number of entries to show", "10").option("--json", "Output as JSON").action(async (opts) => {
+  return new Command10("history").description("Show sync history").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("-l, --limit <number>", "Number of entries to show", "10").option("--json", "Output as JSON").action(async (opts) => {
     await syncHistoryAction({
       dbPath: opts["db"],
       limit: parseInt(opts["limit"], 10),
@@ -33742,7 +33981,7 @@ function createHistoryCommand() {
   });
 }
 function createConfigCommand() {
-  return new Command9("config").description("Configure automatic sync settings").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--enable", "Enable automatic background sync").option("--disable", "Disable automatic background sync").option("--frequency <freq>", "Set sync frequency (daily|weekly)").option("--show", "Show current configuration").option("--json", "Output as JSON").action(async (opts) => {
+  return new Command10("config").description("Configure automatic sync settings").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--enable", "Enable automatic background sync").option("--disable", "Disable automatic background sync").option("--frequency <freq>", "Set sync frequency (daily|weekly)").option("--show", "Show current configuration").option("--json", "Output as JSON").action(async (opts) => {
     await syncConfigAction({
       dbPath: opts["db"],
       enable: opts["enable"],
@@ -33754,7 +33993,7 @@ function createConfigCommand() {
   });
 }
 function createSyncCommand() {
-  const cmd = new Command9("sync").description("Synchronize skills from the Skillsmith registry").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("-f, --force", "Force full sync (ignore last sync time)").option("--dry-run", "Show what would be synced without making changes").option("--json", "Output results as JSON").action(async (opts) => {
+  const cmd = new Command10("sync").description("Synchronize skills from the Skillsmith registry").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("-f, --force", "Force full sync (ignore last sync time)").option("--dry-run", "Show what would be synced without making changes").option("--json", "Output results as JSON").action(async (opts) => {
     await syncAction({
       dbPath: opts["db"],
       force: opts["force"] ?? false,
@@ -33769,389 +34008,125 @@ function createSyncCommand() {
 }
 
 // src/commands/merge.ts
-import { Command as Command10 } from "commander";
-import { resolve as resolve13 } from "path";
-import { existsSync as existsSync12 } from "fs";
-function formatMergeResult(result) {
-  const lines = [
-    "",
-    "\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557",
-    "\u2551                    Merge Results                             \u2551",
-    "\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563",
-    `\u2551  Skills added:    ${result.skillsAdded.toString().padStart(8)}                           \u2551`,
-    `\u2551  Skills updated:  ${result.skillsUpdated.toString().padStart(8)}                           \u2551`,
-    `\u2551  Skills skipped:  ${result.skillsSkipped.toString().padStart(8)}                           \u2551`,
-    `\u2551  Conflicts:       ${result.conflicts.length.toString().padStart(8)}                           \u2551`,
-    `\u2551  Duration:        ${(result.duration / 1e3).toFixed(2).padStart(8)}s                          \u2551`,
-    "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D",
-    ""
-  ];
-  return lines.join("\n");
-}
-async function mergeActionImpl(sourcePath, targetPath, options) {
-  const { strategy, dryRun, verbose, quiet, force } = options;
-  const validStrategies = [
-    "keep_target",
-    "keep_source",
-    "keep_newer",
-    "merge_fields"
-  ];
-  if (!validStrategies.includes(strategy)) {
-    console.error(`Invalid strategy: ${strategy}`);
-    console.error(`Valid strategies: ${validStrategies.join(", ")}`);
-    process.exit(1);
-  }
-  const resolvedSource = resolve13(sourcePath);
-  const resolvedTarget = targetPath ? resolve13(targetPath) : getDefaultDbPath();
-  if (!existsSync12(resolvedSource)) {
-    console.error(`Source database not found: ${resolvedSource}`);
-    process.exit(1);
-  }
-  if (!existsSync12(resolvedTarget)) {
-    console.error(`Target database not found: ${resolvedTarget}`);
-    console.error("Create a new database first with: skillsmith init");
-    process.exit(1);
-  }
-  if (!quiet) {
-    console.log("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557");
-    console.log("\u2551              Skillsmith Database Merge                       \u2551");
-    console.log("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
-    console.log(`\u2551  Source:   ${resolvedSource.slice(-48).padEnd(48)} \u2551`);
-    console.log(`\u2551  Target:   ${resolvedTarget.slice(-48).padEnd(48)} \u2551`);
-    console.log(`\u2551  Strategy: ${strategy.padEnd(48)} \u2551`);
-    console.log(`\u2551  Dry Run:  ${(dryRun ? "Yes" : "No").padEnd(48)} \u2551`);
-    console.log("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D");
-    console.log("");
-  }
-  let sourceDb = null;
-  let targetDb = null;
-  try {
-    sourceDb = openDatabase(resolvedSource);
-    targetDb = openDatabase(resolvedTarget);
-    if (!force) {
-      const sourceCompat = checkSchemaCompatibility(sourceDb);
-      const targetCompat = checkSchemaCompatibility(targetDb);
-      if (!sourceCompat.isCompatible) {
-        console.error(`Source database: ${sourceCompat.message}`);
-        process.exit(1);
-      }
-      if (!targetCompat.isCompatible) {
-        console.error(`Target database: ${targetCompat.message}`);
-        process.exit(1);
-      }
-      if (!quiet && sourceCompat.action !== "none") {
-        console.log(`Source: ${sourceCompat.message}`);
-      }
-      if (!quiet && targetCompat.action !== "none") {
-        console.log(`Target: ${targetCompat.message}`);
-      }
-    }
-    const mergeOptions = {
-      strategy,
-      dryRun,
-      skipInvalid: true,
-      ...verbose && {
-        onConflict: (conflict) => {
-          console.log(`  Conflict: ${conflict.skillId} (${conflict.reason})`);
-          return strategy;
-        }
-      }
-    };
-    if (!quiet) {
-      console.log("Merging databases...");
-    }
-    const result = mergeSkillDatabases(targetDb, sourceDb, mergeOptions);
-    if (!quiet) {
-      console.log(formatMergeResult(result));
-      if (dryRun) {
-        console.log("\u26A0\uFE0F  DRY RUN: No changes were made to the target database.");
-        console.log("   Remove --dry-run to apply these changes.");
-      } else {
-        console.log("\u2705 Merge complete!");
-      }
-    }
-    if (result.skillsAdded === 0 && result.skillsUpdated === 0) {
-      if (!quiet) {
-        console.log("\nNo new skills to merge.");
-      }
-    }
-  } catch (error46) {
-    console.error("Merge failed:", error46 instanceof Error ? error46.message : error46);
-    process.exit(1);
-  } finally {
-    sourceDb?.close();
-    targetDb?.close();
-  }
-}
-var mergeAction = withTelemetry(mergeActionImpl, {
-  source: "cli",
-  extractSkillId: () => "merge",
-  extractFramework: () => "cli"
-});
-
-// src/commands/install.ts
-import { Command as Command11 } from "commander";
-import ora9 from "ora";
-var VALID_CLIENT_HINT = "Valid IDs: claude-code | cursor | copilot | windsurf | agents (Codex users pass --client agents).";
-function parseAlsoLink(raw, defaultClient) {
-  if (!raw || raw.trim() === "") return [];
-  const ids = raw.split(",").map((s) => s.trim()).filter((s) => s !== "");
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const id of ids) {
-    assertClientId(id);
-    if (id === defaultClient) {
-      throw new Error(
-        `--also-link target '${id}' is the same as --client; pick a different client or drop it from --also-link.`
-      );
-    }
-    if (seen.has(id)) {
-      throw new Error(`--also-link target '${id}' is listed more than once`);
-    }
-    seen.add(id);
-    out.push(id);
-  }
-  return out;
-}
-function isValidSkillId(skillId) {
-  if (isGitHubUrl(skillId)) return true;
-  return /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9_.-]+$/.test(skillId);
-}
-function createDbRegistryLookup(skillRepo, db) {
-  let quarantineRepo;
-  return {
-    async lookup(skillId) {
-      const skill = skillRepo.findById(skillId);
-      if (!skill) return null;
-      if (!skill.repoUrl) return null;
-      quarantineRepo ??= new QuarantineRepository(db);
-      return {
-        repoUrl: skill.repoUrl,
-        name: skill.name,
-        trustTier: skill.trustTier,
-        quarantined: quarantineRepo.isQuarantined(skill.id || skillId)
-      };
-    }
-  };
-}
-async function createApiBackedRegistryLookup(skillRepo, db) {
-  const dbLookup = createDbRegistryLookup(skillRepo, db);
-  const jwtToken = await loadStoredAccessToken();
-  const apiClient = createApiClient(jwtToken ? { jwtToken } : {});
-  return {
-    async lookup(skillId) {
-      const local = await dbLookup.lookup(skillId);
-      if (local) return local;
-      if (apiClient.isOffline()) return null;
-      try {
-        const response = await apiClient.getSkill(skillId);
-        const r = response.data;
-        if (!r.repo_url) return null;
-        return {
-          repoUrl: r.repo_url,
-          name: r.name,
-          trustTier: SkillsmithApiClient.toSkill(r).trustTier,
-          quarantined: r.quarantined === true || r.installable === false
-        };
-      } catch {
-        return null;
-      }
-    }
-  };
-}
-function formatJsonResult(result) {
-  return JSON.stringify(
-    {
-      success: result.success,
-      skillId: result.skillId,
-      installPath: result.installPath,
-      error: result.error,
-      trustTier: result.trustTier,
-      optimization: result.optimization,
-      tips: result.tips
-    },
-    null,
-    2
-  );
+import { Command as Command11 } from "commander";
+import { resolve as resolve13 } from "path";
+import { existsSync as existsSync12 } from "fs";
+function formatMergeResult(result) {
+  const lines = [
+    "",
+    "\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557",
+    "\u2551                    Merge Results                             \u2551",
+    "\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563",
+    `\u2551  Skills added:    ${result.skillsAdded.toString().padStart(8)}                           \u2551`,
+    `\u2551  Skills updated:  ${result.skillsUpdated.toString().padStart(8)}                           \u2551`,
+    `\u2551  Skills skipped:  ${result.skillsSkipped.toString().padStart(8)}                           \u2551`,
+    `\u2551  Conflicts:       ${result.conflicts.length.toString().padStart(8)}                           \u2551`,
+    `\u2551  Duration:        ${(result.duration / 1e3).toFixed(2).padStart(8)}s                          \u2551`,
+    "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D",
+    ""
+  ];
+  return lines.join("\n");
 }
-function displayResult(result, quiet) {
-  if (result.success) {
-    console.log(source_default.green("\nSkill installed successfully!"));
-    console.log(source_default.dim(`  Path: ${result.installPath}`));
-    if (result.trustTier) {
-      console.log(source_default.dim(`  Trust tier: ${result.trustTier}`));
-    }
-    if (result.optimization?.optimized && !quiet) {
-      console.log(source_default.dim(`  Optimized: ${result.optimization.tokenReductionPercent}% reduction`));
-      if (result.optimization.subSkills && result.optimization.subSkills.length > 0) {
-        console.log(source_default.dim(`  Sub-skills: ${result.optimization.subSkills.join(", ")}`));
-      }
-      if (result.optimization.subagentGenerated) {
-        console.log(source_default.dim(`  Companion subagent generated`));
-      }
-    }
-    if (result.contentHashMismatch) {
-      console.log(source_default.yellow("\n  Warning: Content has changed since last indexed."));
-      console.log(source_default.yellow("  Review recent changes at the skill's repository before using."));
-    }
-    if (result.tips && result.tips.length > 0 && !quiet) {
-      const startIndex = result.contentHashMismatch ? 1 : 0;
-      if (startIndex < result.tips.length) {
-        console.log();
-        for (let i = startIndex; i < result.tips.length; i++) {
-          console.log(source_default.dim(`  Tip: ${result.tips[i]}`));
-        }
-      }
-    }
-  } else {
-    console.error(source_default.red(`
-Installation failed: ${result.error}`));
-    if (result.securityReport && !result.securityReport.passed) {
-      console.error(source_default.red("  Security scan failed."));
-      for (const finding of result.securityReport.findings) {
-        if (finding.severity === "critical" || finding.severity === "high") {
-          console.error(source_default.red(`  [${finding.severity}] ${finding.message}`));
-        }
-      }
-    }
-    if (result.tips && result.tips.length > 0 && !quiet) {
-      console.log();
-      for (const tip of result.tips) {
-        console.log(source_default.dim(`  ${tip}`));
-      }
-    }
+async function mergeActionImpl(sourcePath, targetPath, options) {
+  const { strategy, dryRun, verbose, quiet, force } = options;
+  const validStrategies = [
+    "keep_target",
+    "keep_source",
+    "keep_newer",
+    "merge_fields"
+  ];
+  if (!validStrategies.includes(strategy)) {
+    console.error(`Invalid strategy: ${strategy}`);
+    console.error(`Valid strategies: ${validStrategies.join(", ")}`);
+    process.exit(1);
   }
-}
-async function installActionImpl(skillId, opts) {
-  const quiet = opts.quiet ?? false;
-  const jsonOutput = opts.json ?? false;
+  const resolvedSource = resolve13(sourcePath);
+  const resolvedTarget = targetPath ? resolve13(targetPath) : getDefaultDbPath();
+  if (!existsSync12(resolvedSource)) {
+    console.error(`Source database not found: ${resolvedSource}`);
+    process.exit(1);
+  }
+  if (!existsSync12(resolvedTarget)) {
+    console.error(`Target database not found: ${resolvedTarget}`);
+    console.error("Create a new database first with: skillsmith init");
+    process.exit(1);
+  }
+  if (!quiet) {
+    console.log("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557");
+    console.log("\u2551              Skillsmith Database Merge                       \u2551");
+    console.log("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
+    console.log(`\u2551  Source:   ${resolvedSource.slice(-48).padEnd(48)} \u2551`);
+    console.log(`\u2551  Target:   ${resolvedTarget.slice(-48).padEnd(48)} \u2551`);
+    console.log(`\u2551  Strategy: ${strategy.padEnd(48)} \u2551`);
+    console.log(`\u2551  Dry Run:  ${(dryRun ? "Yes" : "No").padEnd(48)} \u2551`);
+    console.log("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D");
+    console.log("");
+  }
+  let sourceDb = null;
+  let targetDb = null;
   try {
-    const rawClient = opts.client ?? "claude-code";
-    if (rawClient.includes(",")) {
-      throw new Error(
-        `--client takes a single value (got '${rawClient}'). Pass --also-link <ids> to fan-out into additional clients.`
-      );
-    }
-    assertClientId(rawClient);
-    const client = rawClient;
-    const alsoLinkClients = parseAlsoLink(opts.alsoLink, client);
-    const skillsDir = getInstallPath(client);
-    if (!isValidSkillId(skillId)) {
-      const errorMsg = 'Invalid skill ID format. Expected "author/name" or a GitHub URL.\n  Examples:\n    skillsmith install getsentry/commit\n    skillsmith install https://github.com/owner/repo';
-      if (jsonOutput) {
-        console.log(JSON.stringify({ success: false, skillId, error: errorMsg }, null, 2));
-      } else {
-        console.error(source_default.red(errorMsg));
-      }
-      process.exit(1);
-      return;
-    }
-    const dbPath = opts.db ?? DEFAULT_DB_PATH;
-    const db = await openCliDatabase(dbPath);
-    const spinner = jsonOutput ? null : ora9("Installing skill...").start();
-    try {
-      const skillRepo = new SkillRepository(db);
-      const skillDependencyRepo = new SkillDependencyRepository(db);
-      const registryLookup = await createApiBackedRegistryLookup(skillRepo, db);
-      const service = new SkillInstallationService({
-        db,
-        skillRepo,
-        skillDependencyRepo,
-        skillsDir,
-        manifestPath: DEFAULT_MANIFEST_PATH,
-        registryLookup,
-        onProgress: (_stage, detail) => {
-          if (spinner) {
-            spinner.text = detail;
-          }
-        }
-      });
-      const installOptions = {};
-      if (opts.force !== void 0) {
-        installOptions.force = opts.force;
+    sourceDb = openDatabase(resolvedSource);
+    targetDb = openDatabase(resolvedTarget);
+    if (!force) {
+      const sourceCompat = checkSchemaCompatibility(sourceDb);
+      const targetCompat = checkSchemaCompatibility(targetDb);
+      if (!sourceCompat.isCompatible) {
+        console.error(`Source database: ${sourceCompat.message}`);
+        process.exit(1);
       }
-      if (opts.skipScan !== void 0) {
-        installOptions.skipScan = opts.skipScan;
+      if (!targetCompat.isCompatible) {
+        console.error(`Target database: ${targetCompat.message}`);
+        process.exit(1);
       }
-      if (opts.skipOptimize !== void 0) {
-        installOptions.skipOptimize = opts.skipOptimize;
+      if (!quiet && sourceCompat.action !== "none") {
+        console.log(`Source: ${sourceCompat.message}`);
       }
-      const installStart = Date.now();
-      const result = await service.install(skillId, installOptions);
-      void emitInstallEvent({
-        skillId,
-        source: "cli",
-        success: result.success,
-        durationMs: Date.now() - installStart,
-        ...result.trustTier !== void 0 && { trustTier: result.trustTier },
-        ...!result.success && result.errorCode !== void 0 && { errorCode: result.errorCode }
-      });
-      if (result.success && alsoLinkClients.length > 0) {
-        for (const target of alsoLinkClients) {
-          try {
-            const linked = await addLink({
-              skillId,
-              fromClient: client,
-              toClient: target,
-              preferSymlink: opts.symlink ?? false,
-              force: opts.force ?? false
-            });
-            if (!quiet && !jsonOutput) {
-              const note = linked.fellBackToCopy ? " (fell back to copy)" : "";
-              console.log(source_default.dim(`  Linked into ${target} as ${linked.record.kind}${note}`));
-            }
-          } catch (linkErr) {
-            if (!jsonOutput) {
-              console.warn(
-                source_default.yellow(`  Warning: could not link to ${target}: ${sanitizeError(linkErr)}`)
-              );
-            }
-          }
-        }
+      if (!quiet && targetCompat.action !== "none") {
+        console.log(`Target: ${targetCompat.message}`);
       }
-      if (spinner) {
-        if (result.success) {
-          spinner.succeed("Skill installed");
-        } else {
-          spinner.fail("Installation failed");
+    }
+    const mergeOptions = {
+      strategy,
+      dryRun,
+      skipInvalid: true,
+      ...verbose && {
+        onConflict: (conflict) => {
+          console.log(`  Conflict: ${conflict.skillId} (${conflict.reason})`);
+          return strategy;
         }
       }
-      if (jsonOutput) {
-        console.log(formatJsonResult(result));
+    };
+    if (!quiet) {
+      console.log("Merging databases...");
+    }
+    const result = mergeSkillDatabases(targetDb, sourceDb, mergeOptions);
+    if (!quiet) {
+      console.log(formatMergeResult(result));
+      if (dryRun) {
+        console.log("\u26A0\uFE0F  DRY RUN: No changes were made to the target database.");
+        console.log("   Remove --dry-run to apply these changes.");
       } else {
-        displayResult(result, quiet);
+        console.log("\u2705 Merge complete!");
       }
-      if (!result.success) {
-        process.exit(1);
+    }
+    if (result.skillsAdded === 0 && result.skillsUpdated === 0) {
+      if (!quiet) {
+        console.log("\nNo new skills to merge.");
       }
-    } finally {
-      db.close();
     }
   } catch (error46) {
-    if (jsonOutput) {
-      console.log(JSON.stringify({ success: false, skillId, error: sanitizeError(error46) }, null, 2));
-    } else {
-      console.error(source_default.red("Install error:"), sanitizeError(error46));
-    }
+    console.error("Merge failed:", error46 instanceof Error ? error46.message : error46);
     process.exit(1);
+  } finally {
+    sourceDb?.close();
+    targetDb?.close();
   }
 }
-var installAction = withTelemetry(installActionImpl, {
+var mergeAction = withTelemetry(mergeActionImpl, {
   source: "cli",
-  extractSkillId: () => "install",
+  extractSkillId: () => "merge",
   extractFramework: () => "cli"
 });
-function createInstallCommand() {
-  return new Command11("install").description("Install a skill from the registry or GitHub URL").argument("<skillId>", "Skill ID (author/name) or GitHub URL").option("-f, --force", "Force reinstall if already installed").option("--skip-scan", "Skip security scan (not recommended)").option("--skip-optimize", "Skip Skillsmith optimization").option("-q, --quiet", "Suppress advisory output").option("--json", "Output structured JSON result").option("-d, --db <path>", "Database file path", DEFAULT_DB_PATH).option("--client <id>", `install for a specific agent (${VALID_CLIENT_HINT})`, "claude-code").option(
-    "--also-link <ids>",
-    "comma-separated additional clients to fan-out into (default: copy; pair with --symlink for POSIX symlinks)",
-    ""
-  ).option(
-    "--symlink",
-    "use relative symlinks instead of file copies for --also-link (POSIX only; falls back to copy on Windows EPERM)",
-    false
-  ).action(installAction);
-}
 
 // src/commands/install-skill.ts
 import { Command as Command12 } from "commander";