acp-vscode 0.3.9 → 0.4.0

package/__tests__/commands-actions.test.js

@@ -5,6 +5,7 @@ function makeCli() {
     _action: null,
     command() { return cli; },
     option() { return cli; },
+    example() { return cli; },
     action(fn) { cli._action = fn; return cli; }
   };
   return cli;

package/__tests__/installer-skills.test.js

@@ -0,0 +1,266 @@
+const fs = require('fs-extra');
+const path = require('path');
+const os = require('os');
+const { installFiles, removeFiles } = require('../src/installer');
+
+describe('skills as folders', () => {
+  test('installFiles installs skills as folders in workspace', async () => {
+    const tmp = path.join(os.tmpdir(), `acp-skills-${Date.now()}`);
+    await fs.ensureDir(tmp);
+
+    const skillContent = `---
+name: test-skill
+description: A test skill for demonstration
+---
+
+# Test Skill
+
+This is a test skill.`;
+
+    const items = [
+      { id: 'test-skill', name: 'Test Skill', content: skillContent }
+    ];
+    
+    const dest = await installFiles({ items, type: 'skills', target: 'workspace', workspaceDir: tmp });
+    
+    // Verify the destination is .github/skills
+    expect(dest).toBe(path.join(tmp, '.github', 'skills'));
+    expect(await fs.pathExists(dest)).toBe(true);
+    
+    // Verify the skill folder was created
+    const skillFolder = path.join(dest, 'test-skill');
+    expect(await fs.pathExists(skillFolder)).toBe(true);
+    expect((await fs.stat(skillFolder)).isDirectory()).toBe(true);
+    
+    // Verify SKILL.md exists in the skill folder
+    const skillMdPath = path.join(skillFolder, 'SKILL.md');
+    expect(await fs.pathExists(skillMdPath)).toBe(true);
+    
+    // Verify the content is correct
+    const content = await fs.readFile(skillMdPath, 'utf8');
+    expect(content).toBe(skillContent);
+    
+    await fs.remove(tmp);
+  });
+
+  test('installFiles installs skills as folders in user profile', async () => {
+    const tmp = path.join(os.tmpdir(), `acp-skills-user-${Date.now()}`);
+    await fs.ensureDir(tmp);
+    const origHome = process.env.HOME;
+    process.env.HOME = tmp;
+
+    const skillContent = `---
+name: user-skill
+description: A user skill
+---
+
+# User Skill
+
+This skill is for the user profile.`;
+
+    try {
+      const items = [
+        { id: 'user-skill', name: 'User Skill', content: skillContent }
+      ];
+      
+      const dest = await installFiles({ items, type: 'skills', target: 'user' });
+      
+      // Verify the destination is ~/.copilot/skills
+      expect(dest).toBe(path.join(tmp, '.copilot', 'skills'));
+      expect(await fs.pathExists(dest)).toBe(true);
+      
+      // Verify the skill folder was created
+      const skillFolder = path.join(dest, 'user-skill');
+      expect(await fs.pathExists(skillFolder)).toBe(true);
+      const skillFolderStat = await fs.stat(skillFolder);
+      expect(skillFolderStat.isDirectory()).toBe(true);
+      
+      // Verify SKILL.md exists
+      const skillMdPath = path.join(skillFolder, 'SKILL.md');
+      expect(await fs.pathExists(skillMdPath)).toBe(true);
+      
+      // Verify the content is correct
+      const content = await fs.readFile(skillMdPath, 'utf8');
+      expect(content).toBe(skillContent);
+    } finally {
+      if (origHome === undefined) delete process.env.HOME;
+      else process.env.HOME = origHome;
+      await fs.remove(tmp);
+    }
+  });
+
+  test('installFiles handles duplicate skill IDs with repo prefixing', async () => {
+    const tmp = path.join(os.tmpdir(), `acp-skills-dupe-${Date.now()}`);
+    await fs.ensureDir(tmp);
+
+    const items = [
+      { id: 'shared', name: 'Shared One', repo: 'r1', content: 'Content from r1' },
+      { id: 'shared', name: 'Shared Two', repo: 'r2', content: 'Content from r2' }
+    ];
+    
+    const dest = await installFiles({ items, type: 'skills', target: 'workspace', workspaceDir: tmp });
+    
+    // Verify both skill folders exist with repo prefixes
+    expect(await fs.pathExists(path.join(dest, 'r1-shared'))).toBe(true);
+    expect(await fs.pathExists(path.join(dest, 'r2-shared'))).toBe(true);
+    
+    // Verify the content is different for each
+    const content1 = await fs.readFile(path.join(dest, 'r1-shared', 'SKILL.md'), 'utf8');
+    const content2 = await fs.readFile(path.join(dest, 'r2-shared', 'SKILL.md'), 'utf8');
+    
+    expect(content1).not.toBe(content2);
+    expect(content1).toContain('Content from r1');
+    expect(content2).toContain('Content from r2');
+    
+    await fs.remove(tmp);
+  });
+
+  test('removeFiles removes skill folders from workspace', async () => {
+    const tmp = path.join(os.tmpdir(), `acp-skills-remove-${Date.now()}`);
+    const base = path.join(tmp, '.github', 'skills');
+    await fs.ensureDir(base);
+    
+    // Create skill folders
+    const skill1Dir = path.join(base, 'skill1');
+    const skill2Dir = path.join(base, 'skill2');
+    await fs.ensureDir(skill1Dir);
+    await fs.ensureDir(skill2Dir);
+    await fs.writeFile(path.join(skill1Dir, 'SKILL.md'), 'Skill 1');
+    await fs.writeFile(path.join(skill2Dir, 'SKILL.md'), 'Skill 2');
+
+    // Remove skill1
+    const removed = await removeFiles({ names: ['skill1'], type: 'skills', target: 'workspace', workspaceDir: tmp });
+    
+    expect(removed).toBe(1);
+    expect(await fs.pathExists(skill1Dir)).toBe(false);
+    expect(await fs.pathExists(skill2Dir)).toBe(true);
+    
+    await fs.remove(tmp);
+  });
+
+  test('removeFiles removes skill folders from user profile', async () => {
+    const tmp = path.join(os.tmpdir(), `acp-skills-remove-user-${Date.now()}`);
+    const origHome = process.env.HOME;
+    process.env.HOME = tmp;
+    
+    try {
+      const base = path.join(tmp, '.copilot', 'skills');
+      await fs.ensureDir(base);
+      
+      // Create skill folders
+      const skill1Dir = path.join(base, 'user-skill1');
+      const skill2Dir = path.join(base, 'user-skill2');
+      await fs.ensureDir(skill1Dir);
+      await fs.ensureDir(skill2Dir);
+      await fs.writeFile(path.join(skill1Dir, 'SKILL.md'), 'User Skill 1');
+      await fs.writeFile(path.join(skill2Dir, 'SKILL.md'), 'User Skill 2');
+
+      // Remove skill1
+      const removed = await removeFiles({ names: ['user-skill1'], type: 'skills', target: 'user' });
+      
+      expect(removed).toBe(1);
+      expect(await fs.pathExists(skill1Dir)).toBe(false);
+      expect(await fs.pathExists(skill2Dir)).toBe(true);
+    } finally {
+      if (origHome === undefined) delete process.env.HOME;
+      else process.env.HOME = origHome;
+      await fs.remove(tmp);
+    }
+  });
+
+  test('removeFiles handles repo-qualified skill names', async () => {
+    const tmp = path.join(os.tmpdir(), `acp-skills-remove-qualified-${Date.now()}`);
+    const base = path.join(tmp, '.github', 'skills');
+    await fs.ensureDir(base);
+    
+    // Create repo-prefixed skill folders
+    const skill1Dir = path.join(base, 'r1-shared');
+    const skill2Dir = path.join(base, 'r2-shared');
+    await fs.ensureDir(skill1Dir);
+    await fs.ensureDir(skill2Dir);
+    await fs.writeFile(path.join(skill1Dir, 'SKILL.md'), 'Skill from r1');
+    await fs.writeFile(path.join(skill2Dir, 'SKILL.md'), 'Skill from r2');
+
+    // Remove with repo-qualified name
+    const removed = await removeFiles({ names: ['r1:shared'], type: 'skills', target: 'workspace', workspaceDir: tmp });
+    
+    expect(removed).toBe(1);
+    expect(await fs.pathExists(skill1Dir)).toBe(false);
+    expect(await fs.pathExists(skill2Dir)).toBe(true);
+    
+    await fs.remove(tmp);
+  });
+
+  test('installFiles copies all files in skill folder including supporting files', async () => {
+    const tmp = path.join(os.tmpdir(), `acp-skills-supporting-${Date.now()}`);
+    await fs.ensureDir(tmp);
+
+    const skillContent = `---
+name: complete-skill
+description: A skill with supporting files
+---
+
+# Complete Skill
+
+This skill has supporting files.`;
+
+    const referenceContent = `# Reference Guide
+
+This is detailed reference material.`;
+
+    const scriptContent = `#!/bin/bash
+echo "This is a script"`;
+
+    const items = [
+      {
+        id: 'complete-skill',
+        name: 'Complete Skill',
+        folderPath: 'skills/complete-skill',
+        files: [
+          { path: 'skills/complete-skill/SKILL.md', url: 'http://example.com/skills/complete-skill/SKILL.md' },
+          { path: 'skills/complete-skill/references/REFERENCE.md', url: 'http://example.com/skills/complete-skill/references/REFERENCE.md' },
+          { path: 'skills/complete-skill/scripts/example.sh', url: 'http://example.com/skills/complete-skill/scripts/example.sh' }
+        ]
+      }
+    ];
+
+    // Mock axios to return file contents
+    const axios = require('axios');
+    const originalAxios = axios.get;
+    axios.get = jest.fn((url) => {
+      if (url === 'http://example.com/skills/complete-skill/SKILL.md') {
+        return Promise.resolve({ data: skillContent });
+      } else if (url === 'http://example.com/skills/complete-skill/references/REFERENCE.md') {
+        return Promise.resolve({ data: referenceContent });
+      } else if (url === 'http://example.com/skills/complete-skill/scripts/example.sh') {
+        return Promise.resolve({ data: scriptContent });
+      }
+      return Promise.reject(new Error('Unknown URL'));
+    });
+
+    try {
+      const dest = await installFiles({ items, type: 'skills', target: 'workspace', workspaceDir: tmp });
+
+      // Verify the skill folder was created
+      const skillFolder = path.join(dest, 'complete-skill');
+      expect(await fs.pathExists(skillFolder)).toBe(true);
+
+      // Verify all files exist
+      expect(await fs.pathExists(path.join(skillFolder, 'SKILL.md'))).toBe(true);
+      expect(await fs.pathExists(path.join(skillFolder, 'references', 'REFERENCE.md'))).toBe(true);
+      expect(await fs.pathExists(path.join(skillFolder, 'scripts', 'example.sh'))).toBe(true);
+
+      // Verify content is correct
+      const skillMd = await fs.readFile(path.join(skillFolder, 'SKILL.md'), 'utf8');
+      const refMd = await fs.readFile(path.join(skillFolder, 'references', 'REFERENCE.md'), 'utf8');
+      const script = await fs.readFile(path.join(skillFolder, 'scripts', 'example.sh'), 'utf8');
+
+      expect(skillMd).toContain('complete-skill');
+      expect(refMd).toContain('Reference Guide');
+      expect(script).toContain('This is a script');
+    } finally {
+      axios.get = originalAxios;
+      await fs.remove(tmp);
+    }
+  });
+});

package/__tests__/search-index.test.js

@@ -9,6 +9,6 @@ test('searchIndex returns results with repo-qualified ids when conflicts exist',
   };
   const res = searchIndex(idx, 'shared');
   expect(res.length).toBe(1);
-  expect(res[0].id).toBe('r1:shared');
+  expect(res[0].id).toBe('r1:prompt:shared');
   expect(res[0].type).toBe('prompt');
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acp-vscode",
-  "version": "0.3.9",
+  "version": "0.4.0",
   "description": "CLI to install GitHub Awesome Copilot agents, prompts, instructions, and skills into VS Code workspace or user profile",
   "bin": {
     "acp-vscode": "./bin/acp-vscode.js"

package/src/commands/install.js

@@ -66,8 +66,9 @@ async function performInstall({ target, type, names, options, workspaceDir = pro
     const ambiguous = [];
     for (const given of names) {
       const g = (given || '').toLowerCase();
-      // support repo-qualified id: <repo_id>:<file_id>
+      // support repo-qualified id: <repo>:<type>:<id> or <repo>:<id> (legacy)
       const parts = given && given.includes(':') ? given.split(':') : null;
+      const repoTypeQualified = parts && parts.length === 3;
       const repoQualified = parts && parts.length === 2;
       // collect exact matches across types
       // collect exact matches across types, grouping by type
@@ -77,7 +78,12 @@ async function performInstall({ target, type, names, options, workspaceDir = pro
         for (const it of arr) {
           const id = (it.id || it.name || '').toLowerCase();
           const name = (it.name || it.id || '').toLowerCase();
-          if (repoQualified) {
+          if (repoTypeQualified) {
+            const [r, typeStr, fid] = parts;
+            // type from ID should match current type (singular form)
+            const typeSingular = tt === 'chatmodes' ? 'chatmode' : tt === 'agents' ? 'agent' : tt === 'instructions' ? 'instruction' : tt === 'prompts' ? 'prompt' : 'skill';
+            if (it.repo === r && typeStr === typeSingular && (id === fid.toLowerCase() || name === fid.toLowerCase())) exactMatches.push({ type: tt, item: it });
+          } else if (repoQualified) {
             const [r, fid] = parts;
             if (it.repo === r && (id === fid.toLowerCase() || name === fid.toLowerCase())) exactMatches.push({ type: tt, item: it });
           } else {
@@ -115,7 +121,11 @@ async function performInstall({ target, type, names, options, workspaceDir = pro
         for (const it of arr) {
           const id = (it.id || it.name || '').toLowerCase();
           const name = (it.name || it.id || '').toLowerCase();
-          if (repoQualified) {
+          if (repoTypeQualified) {
+            const [r, typeStr, fid] = parts;
+            const typeSingular = tt === 'chatmodes' ? 'chatmode' : tt === 'agents' ? 'agent' : tt === 'instructions' ? 'instruction' : tt === 'prompts' ? 'prompt' : 'skill';
+            if (it.repo === r && typeStr === typeSingular && (id.startsWith(fid.toLowerCase()) || name.startsWith(fid.toLowerCase()))) startsMatches.push({ type: tt, item: it });
+          } else if (repoQualified) {
             const [r, fid] = parts;
             if (it.repo === r && (id.startsWith(fid.toLowerCase()) || name.startsWith(fid.toLowerCase()))) startsMatches.push({ type: tt, item: it });
           } else {
@@ -159,11 +169,16 @@ async function performInstall({ target, type, names, options, workspaceDir = pro
       for (const given of names) {
         const g = (given || '').toLowerCase();
         const parts = given && given.includes(':') ? given.split(':') : null;
+        const repoTypeQualified = parts && parts.length === 3;
         const repoQualified = parts && parts.length === 2;
         const exact = items.filter(it => {
           const id = (it.id || it.name || '').toLowerCase();
           const name = (it.name || it.id || '').toLowerCase();
-          if (repoQualified) {
+          if (repoTypeQualified) {
+            const [r, typeStr, fid] = parts;
+            const typeSingular = t === 'chatmodes' ? 'chatmode' : t === 'agents' ? 'agent' : t === 'instructions' ? 'instruction' : t === 'prompts' ? 'prompt' : 'skill';
+            return it.repo === r && typeStr === typeSingular && (id === fid.toLowerCase() || name === fid.toLowerCase());
+          } else if (repoQualified) {
             const [r, fid] = parts;
             return it.repo === r && (id === fid.toLowerCase() || name === fid.toLowerCase());
           }
@@ -181,7 +196,11 @@ async function performInstall({ target, type, names, options, workspaceDir = pro
         const starts = items.filter(it => {
           const id = (it.id || it.name || '').toLowerCase();
           const name = (it.name || it.id || '').toLowerCase();
-          if (repoQualified) {
+          if (repoTypeQualified) {
+            const [r, typeStr, fid] = parts;
+            const typeSingular = t === 'chatmodes' ? 'chatmode' : t === 'agents' ? 'agent' : t === 'instructions' ? 'instruction' : t === 'prompts' ? 'prompt' : 'skill';
+            return it.repo === r && typeStr === typeSingular && (id.startsWith(fid.toLowerCase()) || name.startsWith(fid.toLowerCase()));
+          } else if (repoQualified) {
             const [r, fid] = parts;
             return it.repo === r && (id.startsWith(fid.toLowerCase()) || name.startsWith(fid.toLowerCase()));
           }
@@ -259,27 +278,41 @@ async function performInstall({ target, type, names, options, workspaceDir = pro
 function installCommand(cli) {
   // Change signature so that names are variadic and type is provided via option to
   // avoid the ambiguity where the second positional arg would be parsed as `type`.
-  cli.command('install <target> [names...]', 'Install items into workspace or user profile. target: workspace|user. type: prompts|chatmodes|agents|instructions|skills|all')
-  .option('-t, --type <type>', 'Specify type: prompts|chatmodes|agents|instructions|skills|all')
+  cli.command('install <target> [names...]', 'Install prompts, chatmodes, agents, instructions, or skills')
+  .option('-t, --type <type>', 'Specify type: prompts|chatmodes|agents|instructions|skills|all (default: all)')
   // Note: --refresh is intentionally not a per-command option for install; use only with list/search
   .option('--referesh', "Alias for --refresh (typo alias)")
-    .option('--dry-run', 'Show what would be installed without writing files')
-    .action(async (target, names, options) => {
-      // names may be undefined or an array. Support legacy positional type in case
-      // the user still passed it as the first name (e.g. `install workspace prompts p1`).
-      const TYPES = ['prompts','chatmodes','agents','instructions','skills','all'];
-      let type = options.type;
-      // Normalize names to an array. Some CLI parsers may provide a single
-      // name as a string instead of a one-element array. Preserve values.
-      let nm;
-      if (names === undefined || names === null) nm = [];
-      else if (Array.isArray(names)) nm = names.slice();
-      else nm = [names];
-      if (!type && nm.length > 0 && TYPES.includes(nm[0])) {
-        type = nm.shift();
-      }
-      await performInstall({ target, type, names: nm, options, workspaceDir: process.cwd() });
-    });
+  .option('--dry-run', 'Show what would be installed without writing files')
+  .example('acp-vscode install workspace               # Install interactively to workspace')
+  .example('acp-vscode install user --type prompts     # Install all prompts to user profile')
+  .example('acp-vscode install prompts                 # Install all prompts to workspace')
+  .example("acp-vscode install workspace 'My Prompt'   # Install specific item to workspace")
+  .example('acp-vscode install my-package-id           # Install package by id to workspace')
+  .example('')
+  .example('<target> can be:')
+  .example('  workspace        Install to current workspace (.github folder) Default if not passed')
+  .example('  user             Install to VS Code user profile')
+  .example('  <type>           One of: prompts|chatmodes|agents|instructions|skills|all')
+  .example('                   (installs all items of that type to workspace)')
+  .example('  <package-name>   Package id/name (installs to workspace; supports repo:id or repo:type:id)')
+  .example('')
+  .example('[names...] optional item names to install (supports partial matching)')
+  .action(async (target, names, options) => {
+    // names may be undefined or an array. Support legacy positional type in case
+    // the user still passed it as the first name (e.g. `install workspace prompts p1`).
+    const TYPES = ['prompts','chatmodes','agents','instructions','skills','all'];
+    let type = options.type;
+    // Normalize names to an array. Some CLI parsers may provide a single
+    // name as a string instead of a one-element array. Preserve values.
+    let nm;
+    if (names === undefined || names === null) nm = [];
+    else if (Array.isArray(names)) nm = names.slice();
+    else nm = [names];
+    if (!type && nm.length > 0 && TYPES.includes(nm[0])) {
+      type = nm.shift();
+    }
+    await performInstall({ target, type, names: nm, options, workspaceDir: process.cwd() });
+  });
 }
 
 module.exports = { installCommand, performInstall };

package/src/commands/search.js

@@ -51,7 +51,8 @@ function searchCommand(cli) {
           if (name.includes(q) || JSON.stringify(item).toLowerCase().includes(q)) {
             const rawId = item.id || item.name;
             const conflicts = (index && index._conflicts) ? new Set(index._conflicts) : new Set();
-            const id = (conflicts.has(rawId) && item.repo) ? `${item.repo}:${rawId}` : rawId;
+            // Use hierarchical ID format (repo:type:id) when there's a conflict
+            const id = (conflicts.has(rawId) && item.repo) ? `${item.repo}:${cat.slice(0,-1)}:${rawId}` : rawId;
             const res = { type: cat.slice(0,-1), id, name: item.name };
             if (options && options.verbose) console.log('verbose: match', res);
             results.push(res);
@@ -80,7 +81,8 @@ function searchIndex(index, query) {
       if (name.includes(q) || JSON.stringify(item).toLowerCase().includes(q)) {
         const rawId = item.id || item.name;
         const conflicts = (index && index._conflicts) ? new Set(index._conflicts) : new Set();
-        const id = (conflicts.has(rawId) && item.repo) ? `${item.repo}:${rawId}` : rawId;
+        // Use hierarchical ID format (repo:type:id) when there's a conflict
+        const id = (conflicts.has(rawId) && item.repo) ? `${item.repo}:${cat.slice(0,-1)}:${rawId}` : rawId;
         results.push({ type: cat.slice(0,-1), id, name: item.name });
       }
     });

package/src/fetcher.js

@@ -242,7 +242,8 @@ async function fetchIndex(options) {
         log('repo ' + repo.id + ' response does not contain tree array, skipping', verbose);
         continue;
       }
-      const tree = res.data.tree.filter(t => t.type === 'blob');
+      // Filter for blob entries, excluding symlinks (mode 120000) which would create duplicates
+      const tree = res.data.tree.filter(t => t.type === 'blob' && t.mode !== '120000');
       log('repo ' + repo.id + ' has ' + tree.length + ' blob items', verbose);
 
       const makeEntriesForRepo = async prefix => {
@@ -275,31 +276,116 @@ async function fetchIndex(options) {
         return parts;
       };
 
+      const makeSkillEntriesForRepo = async () => {
+        // Match SKILL.md files in skills folders at any depth: e.g., "skills/skill-name/SKILL.md"
+        const skillRegex = new RegExp(`(^|/)skills/[^/]+/SKILL\\.md$`, 'i');
+        const matches = tree.filter(t => skillRegex.test(t.path) && t.type === 'blob');
+        log('repo ' + repo.id + ': found ' + matches.length + ' skill folders (searched at any depth)', verbose);
+        const parts = await Promise.all(matches.map(async t => {
+          // Extract the skill folder name from path like "skills/skill-name/SKILL.md" or ".github/skills/skill-name/SKILL.md"
+          const pathParts = t.path.split('/');
+          const skillMdIndex = pathParts.findIndex(p => p.toLowerCase() === 'skill.md');
+          const skillFolderName = pathParts[skillMdIndex - 1];
+          const skillFolderPath = t.path.replace(/SKILL\.md$/i, '').replace(/\/$/, '');
+          const id = skillFolderName;
+          let name = skillFolderName.replace(/[-_]+/g, ' ').replace(/\b\w/g, l => l.toUpperCase());
+          let description = '';
+          const rawBase = (repo.rawBase || repo.url || '').replace(/\/$/, '');
+          const skillMdUrl = rawBase ? `${rawBase}/${t.path}` : null;
+          
+          // Gather all files in the skill folder
+          const skillFiles = tree.filter(file => file.path.startsWith(skillFolderPath + '/') && file.type === 'blob');
+          const files = skillFiles.map(file => ({
+            path: file.path,
+            url: rawBase ? `${rawBase}/${file.path}` : null
+          }));
+          
+          if (skillMdUrl) {
+            try {
+              const r = await axios.get(skillMdUrl, { timeout: 5000, headers: { 'User-Agent': 'acp-vscode-cli' } });
+              const content = r.data;
+              // Parse frontmatter to extract name and description
+              if (content.startsWith('---')) {
+                const endIndex = content.indexOf('\n---', 3);
+                if (endIndex !== -1) {
+                  const frontmatter = content.substring(3, endIndex).trim();
+                  const nameMatch = frontmatter.match(/^name:\s*(.+)$/m);
+                  const descMatch = frontmatter.match(/^description:\s*(.+)$/m);
+                  if (nameMatch) {
+                    name = nameMatch[1].trim();
+                    log('loaded name for skill ' + id + ': ' + name, verbose);
+                  }
+                  if (descMatch) {
+                    description = descMatch[1].trim();
+                    log('loaded description for skill ' + id, verbose);
+                  }
+                }
+              }
+            } catch (e) {
+              log('failed to fetch SKILL.md for ' + id + ': ' + e.message, verbose);
+              // keep fallback name and empty description
+            }
+          }
+          log('collected ' + files.length + ' files for skill ' + id, verbose);
+          // Return skill entry with all files so installer can copy the entire folder structure
+          return { id, name, description, path: t.path, folderPath: skillFolderPath, url: skillMdUrl, repo: repo.id, isFolder: true, files };
+        }));
+        return parts;
+      };
+
       combined.prompts.push(...(await makeEntriesForRepo('prompts')));
       combined.chatmodes.push(...(await makeEntriesForRepo('chatmodes')));
       combined.agents.push(...(await makeEntriesForRepo('agents')));
       combined.instructions.push(...(await makeEntriesForRepo('instructions')));
-      combined.skills.push(...(await makeEntriesForRepo('skills')));
+      combined.skills.push(...(await makeSkillEntriesForRepo()));
     }
 
-    // detect id conflicts across repos
-    log('detecting conflicts across repos...', verbose);
-    const idCounts = new Map();
-    for (const cat of ['prompts','chatmodes','agents','instructions','skills']) {
-      for (const it of combined[cat]) {
-        const k = it.id || it.name || '';
-        if (!k) continue;
-        idCounts.set(k, (idCounts.get(k) || 0) + 1);
+    // detect id conflicts at repo and type levels
+    log('detecting conflicts (repo-level and type-level)...', verbose);
+    const idRepoTypeMap = new Map(); // Maps "id" -> Map of "repo:type" -> count
+    
+    for (const type of ['prompts','chatmodes','agents','instructions','skills']) {
+      for (const item of combined[type]) {
+        const id = item.id || item.name || '';
+        if (!id) continue;
+        
+        const key = `${item.repo}:${type}`;
+        if (!idRepoTypeMap.has(id)) {
+          idRepoTypeMap.set(id, new Map());
+        }
+        idRepoTypeMap.get(id).set(key, (idRepoTypeMap.get(id).get(key) || 0) + 1);
       }
     }
-    const conflicts = [];
-    for (const [key, cnt] of idCounts.entries()) {
-      if (cnt > 1) {
-        conflicts.push(key);
-        log('conflict detected: ' + key + ' appears ' + cnt + ' times', verbose);
+    
+    // Determine which IDs need prefixing (repo-level or type-level conflicts)
+    const conflicts = new Set();
+    for (const [id, repoTypeMap] of idRepoTypeMap.entries()) {
+      // Group by type to check if same type appears in multiple repos
+      const typeToRepos = new Map();
+      for (const repoType of repoTypeMap.keys()) {
+        const [repo, type] = repoType.split(':');
+        if (!typeToRepos.has(type)) {
+          typeToRepos.set(type, new Set());
+        }
+        typeToRepos.get(type).add(repo);
+      }
+      
+      // Check for repo-level conflict: same ID, same type, different repos
+      for (const [type, repos] of typeToRepos.entries()) {
+        if (repos.size > 1) {
+          conflicts.add(id);
+          log(`repo-level conflict: ${id} (${type}) in repos: ${Array.from(repos).join(', ')}`, verbose);
+        }
+      }
+      
+      // Check for type-level conflict: same ID, multiple types
+      if (typeToRepos.size > 1) {
+        conflicts.add(id);
+        const types = Array.from(typeToRepos.keys()).join(', ');
+        log(`type-level conflict: ${id} appears in types: ${types}`, verbose);
       }
     }
-    if (conflicts.length === 0) {
+    if (conflicts.size === 0) {
       log('no conflicts detected', verbose);
     }
 
@@ -314,7 +400,7 @@ async function fetchIndex(options) {
 
   idx = combined;
   idx._repos = repos.map(r => ({ id: r.id, treeUrl: r.treeUrl, rawBase: r.rawBase || r.url }));
-  idx._conflicts = conflicts;
+  idx._conflicts = Array.from(conflicts); // Convert Set to array for JSON serialization
   cache.set(key, idx);
   await writeDiskCache(idx, verbose);
   log('index successfully built and cached', verbose);

package/src/installer.js

@@ -1,6 +1,7 @@
 const fs = require('fs-extra');
 const path = require('path');
 const os = require('os');
+const axios = require('axios');
 
 function getVsCodeUserDir() {
   const platform = os.platform();
@@ -24,6 +25,43 @@ function getVsCodeUserDir() {
   return path.join(home, '.config', 'Code', 'User');
 }
 
+// Helper to sanitize folder names to prevent path traversal attacks
+function makeSafeFolderName(rawName) {
+  // Ensure rawName is a string
+  if (typeof rawName !== 'string') {
+    rawName = rawName ? String(rawName) : '';
+  }
+  let safe = rawName || '';
+  // Replace any path separators with a dash so we don't create nested or absolute paths
+  safe = safe.replace(/[\\/]+/g, '-');
+  // Remove leading dots so values like "." or ".." don't become special path segments
+  safe = safe.replace(/^\.+/, '');
+  // Strip a leading Windows drive prefix like "C:\" or "D:/"
+  safe = safe.replace(/^[A-Za-z]:[-\\/]?/, '');
+  safe = safe.trim();
+  if (!safe) {
+    safe = 'skill';
+  }
+  return safe;
+}
+
+// Helper to get singular form of type for hierarchical ID matching
+// Note: Assumes regular English plurals (e.g., prompts->prompt, skills->skill)
+// which is appropriate for all current types: prompts, chatmodes, agents, instructions, skills
+function getSingularType(type) {
+  if (!type || typeof type !== 'string') {
+    return type;
+  }
+  return type.endsWith('s') ? type.slice(0, -1) : type;
+}
+
+// Helper to check if a type segment matches the expected type (including singular form)
+function isTypeMatch(typeSegment, expectedType) {
+  if (typeSegment === expectedType) return true;
+  const singularType = getSingularType(expectedType);
+  return typeSegment === singularType;
+}
+
 async function installFiles({ items, type, target, workspaceDir }) {
   // type: prompts|chatmodes|agents|instructions|skills
   // Helper to derive filename and extension
@@ -39,7 +77,7 @@ async function installFiles({ items, type, target, workspaceDir }) {
     if (item.content) return item.content;
     if (item.url) {
       try {
-        const r = await require('axios').get(item.url, { timeout: 10000, headers: { 'User-Agent': 'acp-vscode-cli' } });
+        const r = await axios.get(item.url, { timeout: 10000, headers: { 'User-Agent': 'acp-vscode-cli' } });
         return r.data;
       } catch (e) {
         return null;
@@ -48,6 +86,161 @@ async function installFiles({ items, type, target, workspaceDir }) {
     return null;
   };
 
+  const fetchFileContent = async fileInfo => {
+    if (!fileInfo.url) return null;
+    try {
+      const r = await axios.get(fileInfo.url, { timeout: 10000, headers: { 'User-Agent': 'acp-vscode-cli' } });
+      return r.data;
+    } catch (e) {
+      console.warn(`Failed to fetch ${fileInfo.path}: ${e.message}`);
+      return null;
+    }
+  };
+
+  // Special handling for skills: they are folders with SKILL.md inside and supporting files
+  if (type === 'skills') {
+    if (target === 'workspace') {
+      const base = path.join(workspaceDir, '.github', 'skills');
+      await fs.ensureDir(base);
+      // detect duplicate ids so we can disambiguate folder names by prefixing
+      const idCounts = items.reduce((m, it) => { const k = it.id || it.name || ''; m[k] = (m[k] || 0) + 1; return m; }, {});
+      for (const item of items) {
+        const baseName = item.id || item.name || `skill-${Date.now()}`;
+        let folderName = baseName;
+        if (idCounts[baseName] > 1 && item.repo) {
+          // prefix with repo to avoid overwriting folders when multiple repos have the same id
+          folderName = `${item.repo}-${baseName}`;
+        }
+        folderName = makeSafeFolderName(folderName);
+        const skillFolderPath = path.join(base, folderName);
+        await fs.ensureDir(skillFolderPath);
+        
+        // If item has files array (from fetcher), copy all files
+        if (item.files && Array.isArray(item.files) && item.files.length > 0) {
+          const folderPathPrefix = item.folderPath || '';
+          for (const fileInfo of item.files) {
+            // Derive a relative path without using an unsafe RegExp constructed from folderPathPrefix
+            let relativePath = fileInfo.path;
+            if (folderPathPrefix && relativePath.startsWith(`${folderPathPrefix}/`)) {
+              relativePath = relativePath.slice(folderPathPrefix.length + 1);
+            }
+
+            // Normalize and sanitize the relative path to prevent directory traversal or absolute paths
+            let safeRelativePath = path.normalize(relativePath);
+            // Remove any leading path separators so the path remains relative
+            while (safeRelativePath.startsWith(path.sep) || safeRelativePath.startsWith('/')) {
+              safeRelativePath = safeRelativePath.slice(1);
+            }
+            // Check if the path is absolute (including Windows paths like C:\...)
+            if (path.isAbsolute(safeRelativePath)) {
+              console.warn(`Skipping absolute path: ${fileInfo.path}`);
+              continue;
+            }
+            // After normalization, disallow any attempts to escape the skill folder
+            if (
+              safeRelativePath === '..' ||
+              safeRelativePath.startsWith(`..${path.sep}`) ||
+              safeRelativePath.includes(`${path.sep}..${path.sep}`) ||
+              safeRelativePath.endsWith(`${path.sep}..`)
+            ) {
+              console.warn(`Skipping potentially unsafe path outside skill folder: ${fileInfo.path}`);
+              continue;
+            }
+
+            const filePath = path.join(skillFolderPath, safeRelativePath);
+            
+            // Create directory if needed
+            await fs.ensureDir(path.dirname(filePath));
+            
+            // Fetch and write file
+            const fileContent = await fetchFileContent(fileInfo);
+            
+            if (fileContent !== null && fileContent !== undefined) {
+              const contentStr = typeof fileContent !== 'string' ? JSON.stringify(fileContent, null, 2) : fileContent;
+              await fs.writeFile(filePath, contentStr, 'utf8');
+            }
+          }
+        } else {
+          // Fallback: if no files array, just write SKILL.md (for backward compatibility)
+          const skillMdPath = path.join(skillFolderPath, 'SKILL.md');
+          let content = await fetchRawIfNeeded(item) || item.content || JSON.stringify(item, null, 2);
+          if (typeof content !== 'string') content = JSON.stringify(content, null, 2);
+          await fs.writeFile(skillMdPath, content, 'utf8');
+        }
+      }
+      return base;
+    }
+
+    // user target: install skills to ~/.copilot/skills/
+    const home = process.env.HOME || os.homedir();
+    const base = path.join(home, '.copilot', 'skills');
+    await fs.ensureDir(base);
+    // detect duplicates among items to avoid overwriting
+    const idCounts = items.reduce((m, it) => { const k = it.id || it.name || ''; m[k] = (m[k] || 0) + 1; return m; }, {});
+    for (const item of items) {
+      const baseName = item.id || item.name || `skill-${Date.now()}`;
+      let folderName = baseName;
+      if (idCounts[baseName] > 1 && item.repo) folderName = `${item.repo}-${baseName}`;
+      folderName = makeSafeFolderName(folderName);
+      const skillFolderPath = path.join(base, folderName);
+      await fs.ensureDir(skillFolderPath);
+      
+      if (item.files && Array.isArray(item.files) && item.files.length > 0) {
+        const folderPathPrefix = item.folderPath || '';
+        for (const fileInfo of item.files) {
+          // Derive a relative path without using an unsafe RegExp constructed from folderPathPrefix
+          let relativePath = fileInfo.path;
+          if (folderPathPrefix && relativePath.startsWith(`${folderPathPrefix}/`)) {
+            relativePath = relativePath.slice(folderPathPrefix.length + 1);
+          }
+
+          // Normalize and sanitize the relative path to prevent directory traversal or absolute paths
+          let safeRelativePath = path.normalize(relativePath);
+          // Remove any leading path separators so the path remains relative
+          while (safeRelativePath.startsWith(path.sep) || safeRelativePath.startsWith('/')) {
+            safeRelativePath = safeRelativePath.slice(1);
+          }
+          // Check if the path is absolute (including Windows paths like C:\...)
+          if (path.isAbsolute(safeRelativePath)) {
+            console.warn(`Skipping absolute path: ${fileInfo.path}`);
+            continue;
+          }
+          // After normalization, disallow any attempts to escape the skill folder
+          if (
+            safeRelativePath === '..' ||
+            safeRelativePath.startsWith(`..${path.sep}`) ||
+            safeRelativePath.includes(`${path.sep}..${path.sep}`) ||
+            safeRelativePath.endsWith(`${path.sep}..`)
+          ) {
+            console.warn(`Skipping potentially unsafe path outside skill folder: ${fileInfo.path}`);
+            continue;
+          }
+
+          const filePath = path.join(skillFolderPath, safeRelativePath);
+          
+          // Create directory if needed
+          await fs.ensureDir(path.dirname(filePath));
+          
+          // Fetch and write file
+          const fileContent = await fetchFileContent(fileInfo);
+          
+          if (fileContent !== null && fileContent !== undefined) {
+            const contentStr = typeof fileContent !== 'string' ? JSON.stringify(fileContent, null, 2) : fileContent;
+            await fs.writeFile(filePath, contentStr, 'utf8');
+          }
+        }
+      } else {
+        // Fallback: if no files array, just write SKILL.md (for backward compatibility)
+        const skillMdPath = path.join(skillFolderPath, 'SKILL.md');
+        let content = await fetchRawIfNeeded(item) || item.content || JSON.stringify(item, null, 2);
+        if (typeof content !== 'string') content = JSON.stringify(content, null, 2);
+        await fs.writeFile(skillMdPath, content, 'utf8');
+      }
+    }
+    return base;
+  }
+
+  // Standard handling for other types (prompts, agents, chatmodes, instructions)
   if (target === 'workspace') {
     const base = path.join(workspaceDir, '.github', type);
     await fs.ensureDir(base);
@@ -68,7 +261,7 @@ async function installFiles({ items, type, target, workspaceDir }) {
     return base;
   }
 
-  // user target: write all types into the VS Code User 'prompts' folder so user profile
+  // user target: write all types (except skills) into the VS Code User 'prompts' folder so user profile
   // keeps everything together (per user's requested behavior).
   const userDir = getVsCodeUserDir();
   const base = path.join(userDir, 'prompts');
@@ -89,6 +282,78 @@ async function installFiles({ items, type, target, workspaceDir }) {
 
 async function removeFiles({ names, type, target, workspaceDir }) {
   // remove files by id or name from the target
+  // Special handling for skills: they are folders, not files
+  if (type === 'skills') {
+    if (target === 'workspace') {
+      const base = path.join(workspaceDir, '.github', 'skills');
+      if (!(await fs.pathExists(base))) return 0;
+      const dirs = await fs.readdir(base);
+      let removed = 0;
+      for (const d of dirs) {
+        const p = path.join(base, d);
+        const stats = await fs.stat(p).catch(() => null);
+        if (!stats || !stats.isDirectory()) continue; // skip non-directories
+        const matches = names.some(n => {
+          if (typeof n !== 'string') return false;
+          if (n.includes(':')) {
+            // repo-qualified incoming name like "repo:type:skill-id" or "repo:skill-id" (legacy)
+            const parts = n.split(':');
+            if (parts.length === 3) {
+              const [repo, typePart, id] = parts;
+              // For skills, type must match 'skills' or its singular form 'skill'
+              if (!isTypeMatch(typePart, 'skills')) return false;
+              return d === id || d === `${repo}-${id}`;
+            } else if (parts.length === 2) {
+              const [repo, id] = parts;
+              // Check if folder name matches either "skill-id" or "repo-skill-id" pattern
+              return d === id || d === `${repo}-${id}`;
+            }
+          }
+          return n === d; // direct match on folder name
+        });
+        if (matches) {
+          await fs.remove(p);
+          removed++;
+        }
+      }
+      return removed;
+    }
+
+    // user target: skills are in ~/.copilot/skills/
+    const home = process.env.HOME || os.homedir();
+    const base = path.join(home, '.copilot', 'skills');
+    if (!(await fs.pathExists(base))) return 0;
+    const dirs = await fs.readdir(base);
+    let removed = 0;
+    for (const d of dirs) {
+      const p = path.join(base, d);
+      const stats = await fs.stat(p).catch(() => null);
+      if (!stats || !stats.isDirectory()) continue; // skip non-directories
+      const matches = names.some(n => {
+        if (typeof n !== 'string') return false;
+        if (n.includes(':')) {
+          const parts = n.split(':');
+          if (parts.length === 3) {
+            const [repo, typePart, id] = parts;
+            // For skills, type must match 'skills' or its singular form 'skill'
+            if (!isTypeMatch(typePart, 'skills')) return false;
+            return d === id || d === `${repo}-${id}`;
+          } else if (parts.length === 2) {
+            const [repo, id] = parts;
+            return d === id || d === `${repo}-${id}`;
+          }
+        }
+        return n === d;
+      });
+      if (matches) {
+        await fs.remove(p);
+        removed++;
+      }
+    }
+    return removed;
+  }
+
+  // Standard handling for other types (files)
   if (target === 'workspace') {
     const base = path.join(workspaceDir, '.github', type);
     if (!(await fs.pathExists(base))) return 0;
@@ -97,14 +362,33 @@ async function removeFiles({ names, type, target, workspaceDir }) {
     for (const f of files) {
       const p = path.join(base, f);
       const content = await fs.readJson(p).catch(() => null);
-      // allow incoming name formats: 'repo:id' or 'id'
+      // allow incoming name formats: 'repo:type:id', 'repo:id' (legacy), or 'id'
       const fileId = content && (content.id || content.name) ? (content.id || content.name) : f;
-      const strippedFileId = (typeof fileId === 'string' && fileId.includes(':')) ? fileId.split(':')[1] : fileId;
+      // Extract the raw ID from hierarchical format
+      const parseHierarchicalId = (id) => {
+        if (typeof id !== 'string') return id;
+        const parts = id.split(':');
+        if (parts.length === 3) return parts[2]; // repo:type:id -> id
+        if (parts.length === 2) return parts[1]; // repo:id -> id
+        return id;
+      };
+      const strippedFileId = parseHierarchicalId(fileId);
       const matches = names.some(n => {
         if (typeof n !== 'string') return false;
         if (n.includes(':')) {
-          // repo-qualified incoming name
-          return n === fileId || n === `${content && content.repo ? content.repo : ''}:${strippedFileId}`;
+          const parts = n.split(':');
+          if (parts.length === 3) {
+            const [repo, typeSegment, id] = parts;
+            // only match repo:type:id when the type segment matches the current type (or its singular form)
+            if (!isTypeMatch(typeSegment, type)) {
+              return false;
+            }
+            return n === fileId || (content && content.repo === repo && strippedFileId === id);
+          } else if (parts.length === 2) {
+            // Legacy format: repo:id
+            const [repo, id] = parts;
+            return n === fileId || (content && content.repo === repo && (strippedFileId === id));
+          }
         }
         return n === fileId || n === strippedFileId || n === f;
       });
@@ -126,11 +410,29 @@ async function removeFiles({ names, type, target, workspaceDir }) {
     const p = path.join(base, f);
     const content = await fs.readJson(p).catch(() => null);
     const fileId = content && (content.id || content.name) ? (content.id || content.name) : f;
-    const strippedFileId = (typeof fileId === 'string' && fileId.includes(':')) ? fileId.split(':')[1] : fileId;
+    const parseHierarchicalId = (id) => {
+      if (typeof id !== 'string') return id;
+      const parts = id.split(':');
+      if (parts.length === 3) return parts[2]; // repo:type:id -> id
+      if (parts.length === 2) return parts[1]; // repo:id -> id
+      return id;
+    };
+    const strippedFileId = parseHierarchicalId(fileId);
     const matches = names.some(n => {
       if (typeof n !== 'string') return false;
       if (n.includes(':')) {
-        return n === fileId || n === `${content && content.repo ? content.repo : ''}:${strippedFileId}`;
+        const parts = n.split(':');
+        if (parts.length === 3) {
+          const [repo, typeSegment, id] = parts;
+          // only match repo:type:id when the type segment matches the current type (or its singular form)
+          if (!isTypeMatch(typeSegment, type)) {
+            return false;
+          }
+          return n === fileId || (content && content.repo === repo && (strippedFileId === id));
+        } else if (parts.length === 2) {
+          const [repo, id] = parts;
+          return n === fileId || (content && content.repo === repo && (strippedFileId === id));
+        }
       }
       return n === fileId || n === strippedFileId || n === f;
     });