@victortomaili/skill-cli 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -11,6 +11,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Cursor adapter (`.cursor/rules` format) for `init -g` bootstrap.
 - Per-agent hook adapters for automatic `/X` triggering (push model).
 
+## [0.2.0] - 2026-07-07
+
+### Added
+- `skill remove <name>... [-y]` (aliases `rm`, `uninstall`) — removes skill(s) from the store and cleans up the global enabled list + current project allow-list. Interactive `y/N` confirmation on a TTY (default **N** = keep); non-interactive for agents, CI, and pipes (non-TTY), or when `-y`/`--yes`/`-f`/`--force` is passed. Destination names are canonicalized via the store (case-insensitive; an unknown/`../x` name can't reach the store path). Duplicate and case-variant names are de-duplicated (one removal, accurate count).
+
 ## [0.1.1] - 2026-07-07
 
 ### Fixed
@@ -48,6 +53,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Windows `npx` spawn runs with `shell:false` + an args array and rejects sources
   containing shell metacharacters (`& | < > ^`).
 
-[Unreleased]: https://github.com/victortomaili/skill-cli/compare/v0.1.1...HEAD
+[Unreleased]: https://github.com/victortomaili/skill-cli/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/victortomaili/skill-cli/compare/v0.1.1...v0.2.0
 [0.1.1]: https://github.com/victortomaili/skill-cli/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/victortomaili/skill-cli/releases/tag/v0.1.0

package/README.md

@@ -78,10 +78,11 @@ short bootstrap block telling it to run `skill` on `/X`.
 | `skill list` | Show installed + active skills (cwd-aware) |
 | `skill show <name>` | Skill metadata (path, triggers, version) |
 | `skill cat <name>` | Dump skill content into context |
-| `skill trigger <keyword>` | `/X` trigger: single→content, multi→candidates, none→info |
+| `skill trigger <keyword\|name>` | `/X` trigger or skill name → content (single), candidates (multi) |
 | `skill update [name…\|--all]` | Re-fetch from source, update changed skills |
+| `skill remove <name> [-y]` | Remove from store (prompts on TTY; agents / CI / `-y` skip) |
 
-Aliases: `ls` (list), `add` (install), `info` (show).
+Aliases: `ls` (list), `add` (install), `info` (show), `rm`/`uninstall` (remove).
 
 ## Install sources
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@victortomaili/skill-cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Cross-agent skill manager — one global store, clean agent folders, activation via skill.config",
   "license": "MIT",
   "author": "Victor Tomaili <victor@tomaili.com>",

package/src/cli.js

@@ -9,6 +9,7 @@ import { cmdEnable } from './commands/enable.js'
 import { cmdDisable } from './commands/disable.js'
 import { cmdInstall } from './commands/install.js'
 import { cmdUpdate } from './commands/update.js'
+import { cmdRemove } from './commands/remove.js'
 import { VERSION } from './lib/version.js'
 
 const HELP = `${c.bold('skill')} ${c.gray('v' + VERSION)} — cross-agent skill manager
@@ -33,6 +34,7 @@ ${c.bold('Usage (agent)')}
 
 ${c.bold('Maintenance')}
   ${c.cyan('skill update')} ${c.gray('[name|--all]')} refresh store from source
+  ${c.cyan('skill remove')} ${c.gray('<name> [-y]')}  remove from store (prompt unless -y / non-TTY)
 
 ${c.gray('Source formats (install): owner/repo | github/gitlab URL | git URL | local path | npm package')}
 ${c.gray('Test (no real ~ touched): SKILL_CLI_HOME=/tmp/sktest skill init -g')}
@@ -58,6 +60,7 @@ try {
     case 'cat': cmdCat(rest); break
     case 'trigger': cmdTrigger(rest); break
     case 'update': cmdUpdate(rest); break
+    case 'remove': case 'rm': case 'uninstall': cmdRemove(rest); break
     case '-v': case '--version':
       console.log('skill-cli ' + VERSION); break
     default:

package/src/commands/remove.js

@@ -0,0 +1,113 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import c from 'picocolors'
+import { STORE_DIR } from '../lib/paths.js'
+import { listStore } from '../lib/store.js'
+import { readGlobalConfig, writeGlobalConfig, readProjectConfig, writeProjectConfig } from '../lib/config.js'
+import { pad } from '../lib/format.js'
+
+// Read one line from stdin (fd 0) synchronously. Only ever called when stdin is
+// a TTY (or SKILL_CLI_FORCE_TTY is set), so it blocks for the user's keystrokes.
+function readLine() {
+  let line = ''
+  const buf = Buffer.alloc(1)
+  while (true) {
+    let n
+    try { n = fs.readSync(0, buf, 0, 1, null) } catch { return line }
+    if (n === 0) break                       // EOF
+    const ch = buf[0]
+    if (ch === 0x0A || ch === 0x0D) break    // \n or \r — end of line
+    if (ch === 0x03) process.exit(130)       // Ctrl-C
+    line += String.fromCharCode(ch)
+  }
+  return line.trim()
+}
+
+function confirm(question) {
+  process.stdout.write(question)
+  const a = readLine().toLowerCase()
+  return a === 'y' || a === 'yes'
+}
+
+// Are we talking to a human at a terminal? Agents, CI, and pipes have a non-TTY
+// stdin and must NOT be prompted (they would hang waiting for input that never
+// arrives). SKILL_CLI_FORCE_TTY lets tests exercise the prompt branch by piping
+// an answer on a non-TTY stdin.
+function isInteractive() {
+  return process.stdin.isTTY === true || process.env.SKILL_CLI_FORCE_TTY === '1'
+}
+
+// `skill remove <name>... [-y|--yes|-f|--force]`
+//
+//   TTY + no --yes  → y/N confirmation prompt (default keeps the skill)
+//   non-TTY (agent/CI/pipe) OR --yes → remove without prompting
+//
+// The destination name is canonicalized via listStore (case-insensitive, and an
+// unknown/`../x` name can never reach path.join(STORE_DIR, name)). Also drops the
+// skill from the global enabled list and the current project's allow-list; other
+// projects may keep a now-dangling allow entry, but computeEffective filters
+// those out (harmless).
+export function cmdRemove(args) {
+  const assumeYes = args.some(a => ['-y', '--yes', '-f', '--force'].includes(a))
+  const requested = args.filter(a => !a.startsWith('-'))
+
+  if (requested.length === 0) {
+    console.error(c.red('Usage: skill remove <name>... [-y]'))
+    console.error(c.gray('  Removes skill(s) from the store. Agents/CI auto-skip the prompt, or pass -y.'))
+    process.exit(1)
+  }
+
+  const installed = listStore()
+  const byLower = new Map(installed.map(s => [s.name.toLowerCase(), s.name]))
+  const targets = []
+  const seen = new Set()
+  for (const a of requested) {
+    const canon = byLower.get(a.toLowerCase())
+    if (!canon) { console.log(c.yellow('  · ' + pad(a)) + c.yellow('not installed — skipping')); continue }
+    // dedupe exact + case-variant duplicates (foo, FOO, foo → a single removal,
+    // not three, so the count and prompt list stay accurate)
+    const key = canon.toLowerCase()
+    if (seen.has(key)) continue
+    seen.add(key)
+    targets.push(canon)
+  }
+
+  if (targets.length === 0) {
+    console.log(c.gray('Nothing to remove.'))
+    return
+  }
+
+  if (isInteractive() && !assumeYes) {
+    const what = targets.length === 1 ? `skill ${c.bold(targets[0])}` : `${targets.length} skills`
+    const list = targets.map(t => '  • ' + t).join('\n')
+    if (!confirm(c.yellow(`About to remove ${what}:\n${list}\n`) + c.bold('Remove? [y/N] '))) {
+      console.log(c.gray('Aborted. Nothing removed.'))
+      return
+    }
+  }
+
+  let removed = 0
+  for (const name of targets) {
+    fs.rmSync(path.join(STORE_DIR, name), { recursive: true, force: true })
+    cleanConfig(name)
+    console.log(c.green('  ✓ ') + c.bold(pad(name)) + c.gray('removed'))
+    removed++
+  }
+  console.log()
+  console.log(c.green(`✓ ${removed} skill(s) removed`))
+}
+
+// Drop the skill from the global enabled list and the current project allow-list.
+function cleanConfig(name) {
+  const g = readGlobalConfig()
+  if ((g.enabled_global || []).some(a => a.toLowerCase() === name.toLowerCase())) {
+    g.enabled_global = (g.enabled_global || []).filter(a => a.toLowerCase() !== name.toLowerCase())
+    writeGlobalConfig(g)
+  }
+  const cwd = process.cwd()
+  const p = readProjectConfig(cwd)
+  if (p && (p.allow || []).some(a => a.toLowerCase() === name.toLowerCase())) {
+    p.allow = (p.allow || []).filter(a => a.toLowerCase() !== name.toLowerCase())
+    writeProjectConfig(cwd, p)
+  }
+}