activate-agentmd 2.4.0

package/src/commands/install.js

@@ -0,0 +1,216 @@
+/**
+ * install.js
+ *
+ * Handles: agentmd install <model/category[/preset]>
+ *
+ *   claude/Security/owasp   → install one preset
+ *   claude/Security/        → install every preset in the category
+ *   claude/                 → refused (see below)
+ *
+ * Whole-model installs are refused on purpose. A model has ~287 presets and
+ * roughly 2 MB of instructions; dropping all of it into a project would blow
+ * past any agent's usable context and make the rules contradict each other.
+ * Categories are the largest unit that stays coherent.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const pc = require("picocolors");
+const { listModels, getPreset, getCategoryPresets, listCategories } = require("../lib/registry");
+const { fetchText } = require("../lib/fetcher");
+const {
+  readManifest,
+  writeManifest,
+  ensurePresetsDir,
+  upsertPreset,
+  isInstalled,
+  findPreset,
+  resolvePresetPath,
+  presetFilename,
+  checksum,
+  PRESETS_DIR,
+} = require("../lib/manifest");
+const { parseCoordinates, suggest } = require("../lib/coordinates");
+const { cmd } = require("../lib/invocation");
+
+/** How the user invoked us — "npx activate-agentmd" or "agentmd". */
+const A = cmd();
+
+const ISSUES_URL = "https://github.com/Aaditya1273/Agent.md/issues";
+
+/**
+ * A package with no substance. The registry has served one before
+ * (Community/maintainers was a 0-byte file, and in three models nothing but a
+ * frontmatter block), and writing it looks like a successful install while
+ * giving the agent no guidance at all.
+ */
+function isEmptyPackage(content) {
+  if (typeof content !== "string") return true;
+  // Strip a leading frontmatter block before judging emptiness.
+  const body = content.replace(/^---\r?\n[\s\S]*?\r?\n---/, "");
+  return body.trim().length === 0;
+}
+
+/** Fetch one preset, write it, record it. Returns "installed" | "skipped" | "failed". */
+async function installOne(entry, cwd, manifest, opts) {
+  ensurePresetsDir(cwd);
+
+  if (!opts.force && isInstalled(manifest, entry.model, entry.category, entry.preset)) {
+    console.log(pc.dim(`  skip  ${entry.id} ${pc.dim("(already installed — use --force to overwrite)")}`));
+    return "skipped";
+  }
+
+  process.stdout.write(pc.cyan(`  ↓  ${entry.id} …`));
+
+  let content;
+  try {
+    content = await fetchText(entry.url);
+  } catch (err) {
+    process.stdout.write("\n");
+    console.error(pc.red(`  ✗  ${entry.id} — ${err.message}`));
+    return "failed";
+  }
+
+  // An empty package is worse than a missing one: the install looks like it
+  // succeeded and the agent silently gets no guidance. Treat it as a failure
+  // rather than writing a 0-byte file.
+  if (isEmptyPackage(content)) {
+    process.stdout.write("\n");
+    console.error(pc.red(`  ✗  ${entry.id} — the registry returned an empty package`));
+    console.error(pc.dim(`     Nothing was written. Please report it: ${ISSUES_URL}`));
+    return "failed";
+  }
+
+  const filename = presetFilename(entry.model, entry.category, entry.preset);
+
+  // A package installed before filenames included the model lives at the old
+  // path. Remove it so the upgrade doesn't leave an orphan behind.
+  const previous = findPreset(manifest, entry.id);
+  if (previous && previous.file && previous.file !== `${PRESETS_DIR}/${filename}`) {
+    const stale = path.resolve(cwd, previous.file);
+    if (stale.startsWith(path.resolve(cwd, PRESETS_DIR) + path.sep) && fs.existsSync(stale)) {
+      fs.unlinkSync(stale);
+    }
+  }
+
+  fs.writeFileSync(resolvePresetPath(cwd, filename), content, "utf-8");
+
+  upsertPreset(manifest, {
+    ...entry,
+    checksum: checksum(content),
+    file: `${PRESETS_DIR}/${filename}`,
+  });
+
+  process.stdout.write(" " + pc.green("✓") + "\n");
+  return "installed";
+}
+
+/**
+ * Install a resolved list of registry entries, printing progress.
+ * Shared by `install` and `init` so a 15-package `init` prints one report
+ * rather than fifteen.
+ */
+async function installEntries(entries, opts = {}) {
+  const cwd = process.cwd();
+  const manifest = readManifest(cwd);
+
+  const tally = { installed: 0, skipped: 0, failed: 0 };
+  for (const entry of entries) {
+    tally[await installOne(entry, cwd, manifest, opts)]++;
+  }
+
+  if (tally.installed > 0) writeManifest(cwd, manifest);
+
+  console.log("");
+  if (tally.installed > 0) {
+    console.log(pc.green(`✓ ${tally.installed} package${tally.installed !== 1 ? "s" : ""} installed`) + pc.dim(` → ${PRESETS_DIR}/`));
+  }
+  if (tally.skipped > 0) console.log(pc.dim(`  ${tally.skipped} already installed`));
+  if (tally.failed > 0) console.log(pc.red(`  ${tally.failed} failed`));
+
+  if (tally.installed > 0) {
+    console.log("");
+    console.log(pc.bold("Next:"));
+    console.log(pc.dim(`  ${A} link              wire these into CLAUDE.md / AGENTS.md / .cursor/rules`));
+    console.log(pc.dim(`  ${A} list --installed  see what this project has`));
+    console.log("");
+  }
+
+  if (tally.failed > 0) process.exitCode = 1;
+  return tally;
+}
+
+async function install(args) {
+  const positional = (args || []).filter((a) => !a.startsWith("--"));
+  const opts = { force: (args || []).includes("--force") };
+
+  if (positional.length === 0) {
+    console.error(pc.red(`Usage: ${A} install <model/category[/preset]>`));
+    console.error(pc.dim(`  ${A} install claude/Security/owasp   install one preset`));
+    console.error(pc.dim(`  ${A} install claude/Security/        install the whole category`));
+    console.error(pc.dim(`\n  Not sure what you want? Run '${A} init' to get recommendations.`));
+    process.exit(1);
+  }
+
+  // One or many ids: `install claude/Security/owasp claude/AI/spec-driven`.
+  // Passing several used to install only the first and say nothing.
+  const resolve = (raw) => {
+  const coords = parseCoordinates(raw);
+
+  if (!coords.model || !listModels().includes(coords.model)) {
+    console.error(pc.red(`Unknown model: "${coords.raw.split("/")[0] || coords.raw}"`));
+    console.error(pc.dim(`  Available: ${listModels().join(", ")}`));
+    process.exit(1);
+  }
+
+  if (!coords.category) {
+    console.error(pc.yellow(`⚠  "${coords.model}" has ${listCategories(coords.model).length} categories and hundreds of presets.`));
+    console.error(pc.dim("   Installing all of them would exceed any agent's usable context, so pick a category.\n"));
+    console.error(pc.dim(`   See categories:   ${A} list ${coords.model}`));
+    console.error(pc.dim(`   Install one:      ${A} install ${coords.model}/Security/owasp`));
+    console.error(pc.dim(`   Get suggestions:  ${A} init`));
+    process.exit(1);
+  }
+
+  if (coords.preset) {
+    const entry = getPreset(coords.model, coords.category, coords.preset);
+    if (!entry) {
+      console.error(pc.red(`Package not found: ${coords.model}/${coords.category}/${coords.preset}`));
+      const near = suggest(coords.model, coords.preset);
+      if (near.length) {
+        console.error(pc.dim("\n  Did you mean:"));
+        for (const n of near) console.error(pc.dim(`    ${A} install ${n.id}`));
+      }
+      console.error(pc.dim(`\n  Search:  ${A} search ${coords.preset}`));
+      console.error(pc.dim(`  Browse:  ${A} list ${coords.model}/${coords.category}`));
+      process.exit(1);
+    }
+    return [entry];
+  } else {
+    const all = getCategoryPresets(coords.model, coords.category);
+    if (all.length === 0) {
+      console.error(pc.red(`Category not found: ${coords.model}/${coords.category}`));
+      console.error(pc.dim(`\n  Available categories in ${coords.model}:`));
+      console.error(pc.dim("    " + listCategories(coords.model).join(", ")));
+      process.exit(1);
+    }
+  }
+
+    return all;
+  };
+
+  const toInstall = [];
+  for (const raw of positional) for (const e of resolve(raw)) if (!toInstall.some((x) => x.id === e.id)) toInstall.push(e);
+
+  console.log(
+    toInstall.length > 1
+      ? pc.bold(`\nInstalling ${pc.cyan(toInstall.length + " packages")}${positional.length === 1 ? ` from ${pc.white(positional[0].replace(/\/$/, ""))}` : ""}\n`)
+      : pc.bold(`\nInstalling ${pc.cyan(toInstall[0].id)}\n`)
+  );
+
+  await installEntries(toInstall, opts);
+}
+
+module.exports = { install, installEntries, isEmptyPackage };

package/src/commands/link.js

@@ -0,0 +1,206 @@
+/**
+ * link.js
+ *
+ * Handles: agentmd link [--agent=claude,cursor,…] [--dry]
+ *
+ * Downloading a preset is only half the job — the agent has to be told to
+ * read it. `link` writes the installed package list into each agent's own
+ * config convention, inside a delimited block so it can be regenerated
+ * without clobbering anything hand-written.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const pc = require("picocolors");
+const { TARGETS, REFERENCE_DIRS, applyToFile, planAlwaysOn, referenceRules } = require("../lib/agents");
+const { findWorkspaces, scanOne, RECOMMENDATIONS } = require("../lib/detect");
+const { readManifest, resolvePresetPath, resolveInProject } = require("../lib/manifest");
+const { detectVersions } = require("../lib/versions");
+const { cmd } = require("../lib/invocation");
+
+/** How the user invoked us — "npx activate-agentmd" or "agentmd". */
+const A = cmd();
+
+function flagValue(args, name) {
+  const hit = (args || []).find((a) => a.startsWith(`--${name}=`));
+  return hit ? hit.slice(name.length + 3) : null;
+}
+
+/** Signs a tool is in use, checked only when no agent file exists yet. */
+const ENV_SIGNALS = [
+  { agent: "cursor", via: ".cursor/", test: (cwd) => fs.existsSync(path.join(cwd, ".cursor")) },
+  { agent: "claude", via: ".claude/", test: (cwd) => fs.existsSync(path.join(cwd, ".claude")) },
+  { agent: "claude", via: "claude on PATH", test: (cwd, env) => onPath("claude", env) },
+  { agent: "gemini", via: ".gemini/", test: (cwd) => fs.existsSync(path.join(cwd, ".gemini")) },
+  { agent: "copilot", via: ".github/copilot-instructions.md", test: (cwd) => fs.existsSync(path.join(cwd, ".github", "copilot-instructions.md")) },
+];
+
+/** Is `bin` somewhere on PATH? Windows binaries carry an extension. */
+function onPath(bin, env = process.env) {
+  const dirs = String(env.PATH || env.Path || "").split(path.delimiter).filter(Boolean);
+  const names = process.platform === "win32" ? [`${bin}.exe`, `${bin}.cmd`, `${bin}.bat`, bin] : [bin];
+  return dirs.some((d) => names.some((n) => fs.existsSync(path.join(d, n))));
+}
+
+/**
+ * Which agent configs to write, and why.
+ *
+ * 1. `--agent=` wins.
+ * 2. Every convention already present in the project (an existing CLAUDE.md,
+ *    .cursor/rules/agentmd.mdc, …) is regenerated.
+ * 3. Otherwise the environment decides: a `.cursor/` dir means Cursor, a
+ *    `.claude/` dir or the `claude` binary means Claude Code, and so on.
+ * 4. When nothing is detectable, both CLAUDE.md and AGENTS.md are written —
+ *    the two files the most agents read — and the output says so. Writing
+ *    only AGENTS.md left Claude Code and Cursor users thinking nothing happened.
+ */
+function resolveTargets(cwd, requested, env = process.env) {
+  if (requested) {
+    const names = requested.split(",").map((s) => s.trim()).filter(Boolean);
+    if (names.includes("all")) return { names: Object.keys(TARGETS), reason: "--agent=all" };
+    const unknown = names.filter((n) => !Object.prototype.hasOwnProperty.call(TARGETS, n));
+    if (unknown.length) {
+      console.error(pc.red(`Unknown agent: ${unknown.join(", ")}`));
+      console.error(pc.dim(`  Available: ${Object.keys(TARGETS).join(", ")}, all`));
+      process.exit(1);
+    }
+    return { names, reason: "--agent" };
+  }
+
+  const present = Object.keys(TARGETS).filter((name) => fs.existsSync(path.join(cwd, TARGETS[name].file)));
+  if (present.length > 0) return { names: present, reason: `found ${present.map((n) => TARGETS[n].file).join(", ")}` };
+
+  const detected = [];
+  const via = [];
+  for (const sig of ENV_SIGNALS) {
+    if (detected.includes(sig.agent) || !sig.test(cwd, env)) continue;
+    detected.push(sig.agent);
+    via.push(sig.via);
+  }
+  if (detected.length > 0) return { names: detected, reason: `detected ${via.join(", ")}` };
+
+  return { names: ["claude", "agents"], reason: "no agent detected — writing the two files most agents read" };
+}
+
+function link(args) {
+  args = args || [];
+  const dry = args.includes("--dry");
+  const cwd = process.cwd();
+  const manifest = readManifest(cwd);
+
+  if (manifest.presets.length === 0) {
+    console.log(pc.yellow("\nNo packages installed — nothing to link."));
+    console.log(pc.dim(`  Run '${A} init' to get recommendations for this project.\n`));
+    return;
+  }
+
+  const { names, reason } = resolveTargets(cwd, flagValue(args, "agent"));
+  // Version pins are re-read on every link so a bumped dependency updates
+  // the agent file the next time someone links.
+  const pins = detectVersions(cwd);
+
+  console.log(
+    pc.bold(`\nLinking ${pc.cyan(manifest.presets.length)} package${manifest.presets.length === 1 ? "" : "s"}${pins.length ? ` + ${pc.cyan(pins.length)} version pin${pins.length === 1 ? "" : "s"}` : ""} into ${names.length} agent config${names.length === 1 ? "" : "s"}\n`)
+  );
+  for (const p of pins) console.log(`  ${pc.dim("pin")}  ${pc.white(`${p.label} ${p.version}`.padEnd(22))} ${pc.dim(p.via)}`);
+  if (pins.length) console.log("");
+  console.log(pc.dim(`  targets: ${names.map((n) => TARGETS[n].file).join(", ")} (${reason})`));
+
+  /**
+   * A preset's text, with the project's own override winning. Drop a file at
+   * .agentmd/overrides/<preset-file> to replace a registry standard for the
+   * whole project; a workspace-level overrides/ dir replaces it for that
+   * workspace only (see below).
+   */
+  const overridesAt = (dir) => (p) => {
+    const o = path.join(dir, ".agentmd", "overrides", path.basename(p.file));
+    return fs.existsSync(o) ? fs.readFileSync(o, "utf-8") : null;
+  };
+  const rootOverride = overridesAt(cwd);
+  const readPreset = (p) => {
+    const o = rootOverride(p);
+    if (o !== null) return o;
+    try { return fs.readFileSync(resolvePresetPath(cwd, path.basename(p.file)), "utf-8"); } catch { return null; }
+  };
+
+  const plan = planAlwaysOn(manifest.presets, pins, readPreset);
+  console.log(pc.dim(`  always-on: ~${plan.used} of ${plan.budget} tokens · ${plan.core.length} package${plan.core.length === 1 ? "" : "s"} in core · ${plan.demoted.length} on demand\n`));
+
+  for (const name of names) {
+    const target = TARGETS[name];
+    const filePath = resolveInProject(cwd, target.file);
+    const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf-8") : null;
+    const next = applyToFile(target, existing, manifest.presets, pins, { readPreset });
+
+    if (existing === next) {
+      console.log(`  ${pc.dim("=")}  ${pc.white(target.file.padEnd(38))} ${pc.dim("already up to date")}`);
+    } else if (dry) {
+      console.log(`  ${pc.yellow("~")}  ${pc.white(target.file.padEnd(38))} ${pc.dim(existing ? "would update" : "would create")}`);
+    } else {
+      fs.mkdirSync(path.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, next, "utf-8");
+      console.log(`  ${pc.green("✓")}  ${pc.white(target.file.padEnd(38))} ${pc.dim(existing ? "updated" : "created")} ${pc.dim("— " + target.label)}`);
+    }
+
+    // On-demand references in the target's own convention. Stale files from
+    // removed packages are deleted so the directory mirrors the manifest.
+    const ref = REFERENCE_DIRS[name];
+    if (!ref || dry) continue;
+    const rules = referenceRules(manifest.presets, readPreset, name);
+    const dir = resolveInProject(cwd, ref.dir);
+    fs.mkdirSync(dir, { recursive: true });
+    const keep = new Set(rules.map((r) => path.basename(r.file)));
+    for (const r of rules) fs.writeFileSync(resolveInProject(cwd, r.file), r.content, "utf-8");
+    let removed = 0;
+    for (const f of fs.readdirSync(dir)) {
+      if (ref.pattern.test(f) && !keep.has(f)) { fs.unlinkSync(path.join(dir, f)); removed++; }
+    }
+    const shown = `${ref.dir.split(path.sep).join("/")}/agentmd-*`;
+    console.log(`  ${pc.green("✓")}  ${pc.white(shown.padEnd(38))} ${pc.dim(`${rules.length} on-demand reference${rules.length === 1 ? "" : "s"}${removed ? `, ${removed} stale removed` : ""}`)}`);
+  }
+
+  // Nested workspaces: a monorepo package gets its own file carrying only the
+  // standards its stack selects, so apps/web reads the Next.js core and
+  // services/api the Go one. Agents read the nearest file, so this overrides
+  // the root for everything under the workspace.
+  if (!dry) {
+    for (const ws of findWorkspaces(cwd).filter((w) => w !== ".")) {
+      const found = scanOne(path.join(cwd, ws));
+      const wanted = new Set([...found.keys()].flatMap((sig) => RECOMMENDATIONS[sig] || []));
+      const wsOverride = overridesAt(path.join(cwd, ws));
+      const relevant = manifest.presets.filter((p) => wanted.has(`${p.category}/${p.preset}`) || wsOverride(p) !== null);
+      if (!relevant.length) continue;
+
+      const up = path.posix.relative(ws.split(path.sep).join("/"), ".") || ".";
+      const scoped = relevant.map((p) => ({
+        ...p,
+        file: wsOverride(p) !== null ? `.agentmd/overrides/${path.basename(p.file)}` : path.posix.join(up, p.file.split(path.sep).join("/")),
+      }));
+      const wsRead = (p) => wsOverride(p) ?? readPreset(p);
+
+      for (const name of names) {
+        const target = TARGETS[name];
+        if (target.format !== "markdown" || name === "copilot") continue; // Copilot reads the root file only
+        const filePath = resolveInProject(cwd, path.join(ws, target.file));
+        const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf-8") : null;
+        const next = applyToFile(target, existing, scoped, [], { readPreset: wsRead, scope: ws.split(path.sep).join("/") });
+        if (existing === next) continue;
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, next, "utf-8");
+        console.log(`  ${pc.green("✓")}  ${pc.white(path.posix.join(ws.split(path.sep).join("/"), target.file).padEnd(38))} ${pc.dim(`${existing ? "updated" : "created"} — workspace, ${scoped.length} package${scoped.length === 1 ? "" : "s"}`)}`);
+      }
+    }
+  }
+
+  console.log("");
+  if (dry) {
+    console.log(pc.dim(`  --dry: nothing written. Run '${A} link' to apply.\n`));
+  } else {
+    console.log(pc.dim("  Your agent will pick these up on its next run."));
+    console.log(pc.dim(`  Add another target with: ${A} link --agent=cursor,gemini\n`));
+  }
+}
+
+module.exports = { link, resolveTargets };

package/src/commands/list.js

@@ -0,0 +1,99 @@
+/**
+ * list.js
+ *
+ * Handles: agentmd list [model[/category]] [--installed]
+ */
+
+"use strict";
+
+const pc = require("picocolors");
+const { listModels, listCategories, getCategoryPresets, getAllPresets, getPreset } = require("../lib/registry");
+const { parseCoordinates } = require("../lib/coordinates");
+const { readManifest } = require("../lib/manifest");
+const { cmd } = require("../lib/invocation");
+
+/** How the user invoked us — "npx activate-agentmd" or "agentmd". */
+const A = cmd();
+
+function listInstalled() {
+  const manifest = readManifest(process.cwd());
+
+  if (manifest.presets.length === 0) {
+    console.log(pc.yellow("\nNo packages installed in this project."));
+    console.log(pc.dim(`  Run '${A} init' to get recommendations.\n`));
+    return;
+  }
+
+  console.log(pc.bold(`\n${manifest.presets.length} package${manifest.presets.length === 1 ? "" : "s"} installed\n`));
+  const width = Math.max(...manifest.presets.map((p) => p.id.length));
+  for (const p of manifest.presets) {
+    const stale = getPreset(p.model, p.category, p.preset) ? "" : pc.red("  (not in registry)");
+    console.log(`  ${pc.white(p.id.padEnd(width))}  ${pc.dim("v" + (p.version || "?"))}${stale}`);
+  }
+  console.log("");
+  console.log(pc.dim(`  Check for updates:  ${A} outdated`));
+  console.log(pc.dim(`  Wire into agents:   ${A} link\n`));
+}
+
+function list(args) {
+  args = args || [];
+  if (args.includes("--installed") || args.includes("-i")) return listInstalled();
+
+  const raw = args.find((a) => !a.startsWith("--")) || "";
+
+  if (!raw) {
+    console.log(pc.bold("\nModels in the registry:\n"));
+    for (const model of listModels()) {
+      const categories = listCategories(model);
+      const total = getAllPresets(model).length;
+      console.log(`  ${pc.cyan(model.padEnd(10))} ${pc.dim(`${categories.length} categories · ${total} packages`)}`);
+    }
+    console.log("");
+    console.log(pc.dim(`  Categories:      ${A} list claude`));
+    console.log(pc.dim(`  This project:    ${A} list --installed`));
+    console.log(pc.dim(`  Recommendations: ${A} init\n`));
+    return;
+  }
+
+  const coords = parseCoordinates(raw);
+
+  if (!listModels().includes(coords.model)) {
+    console.error(pc.red(`Unknown model: "${coords.model}"`));
+    console.error(pc.dim(`  Available: ${listModels().join(", ")}`));
+    process.exit(1);
+  }
+
+  if (!coords.category) {
+    const categories = listCategories(coords.model);
+    console.log(pc.bold(`\nCategories in ${pc.cyan(coords.model)}:\n`));
+    for (const category of categories) {
+      const count = getCategoryPresets(coords.model, category).length;
+      console.log(`  ${pc.white(category.padEnd(16))} ${pc.dim(count + " package" + (count === 1 ? "" : "s"))}`);
+    }
+    console.log("");
+    console.log(pc.dim(`  See a category:  ${A} list ${coords.model}/Security`));
+    console.log(pc.dim(`  Install one:     ${A} install ${coords.model}/Security/owasp\n`));
+    return;
+  }
+
+  const entries = getCategoryPresets(coords.model, coords.category);
+  if (entries.length === 0) {
+    console.error(pc.red(`Category not found: ${coords.model}/${coords.category}`));
+    console.error(pc.dim(`\n  Available in ${coords.model}:`));
+    console.error(pc.dim("    " + listCategories(coords.model).join(", ")));
+    process.exit(1);
+  }
+
+  console.log(pc.bold(`\n${entries.length} packages in ${pc.cyan(entries[0].model + "/" + entries[0].category)}\n`));
+  const width = Math.max(...entries.map((e) => e.preset.length));
+  for (const entry of entries) {
+    const description = entry.description ? pc.dim(entry.description.slice(0, 72)) : "";
+    console.log(`  ${pc.white(entry.preset.padEnd(width))}  ${description}`);
+  }
+  console.log("");
+  console.log(pc.dim(`  Details:      ${A} info ${entries[0].id}`));
+  console.log(pc.dim(`  Install one:  ${A} install ${entries[0].id}`));
+  console.log(pc.dim(`  Install all:  ${A} install ${entries[0].model}/${entries[0].category}/\n`));
+}
+
+module.exports = { list };

package/src/commands/outdated.js

@@ -0,0 +1,92 @@
+/**
+ * outdated.js
+ *
+ * Handles: agentmd outdated
+ *
+ * Reports which installed packages have moved on in the registry, which you
+ * have edited locally, and which are both (a conflict `update` won't silently
+ * resolve). Read-only — it never writes.
+ *
+ * Exits 1 when anything needs attention, so CI can gate on it.
+ */
+
+"use strict";
+
+const pc = require("picocolors");
+const { readManifest } = require("../lib/manifest");
+const { checkAll } = require("../lib/status");
+const { cmd } = require("../lib/invocation");
+
+/** How the user invoked us — "npx activate-agentmd" or "agentmd". */
+const A = cmd();
+
+const PRESENTATION = {
+  outdated: { mark: pc.yellow("↑"), note: "update available" },
+  modified: { mark: pc.cyan("✎"), note: "edited locally" },
+  conflict: { mark: pc.red("!"), note: "edited locally AND updated upstream" },
+  missing: { mark: pc.red("?"), note: "file missing from disk" },
+  removed: { mark: pc.red("✗"), note: "no longer in the registry" },
+  failed: { mark: pc.red("✗"), note: "check failed" },
+};
+
+async function outdated() {
+  const cwd = process.cwd();
+  const manifest = readManifest(cwd);
+
+  if (manifest.presets.length === 0) {
+    console.log(pc.yellow("\nNo packages installed."));
+    console.log(pc.dim(`  Run '${A} init' to get recommendations for this project.\n`));
+    return;
+  }
+
+  // Extracted (local/) packages have no registry counterpart; they are yours.
+  const local = manifest.presets.filter((p) => p.source === "local");
+  const registryPresets = manifest.presets.filter((p) => p.source !== "local");
+  for (const p of local) console.log(`  ${pc.dim("·")}  ${pc.white(p.id)}  ${pc.dim("local — managed by extract")}`);
+  if (registryPresets.length === 0) {
+    console.log(pc.dim("\nNo registry packages to check.\n"));
+    return;
+  }
+
+  console.log(pc.dim(`\nChecking ${registryPresets.length} package${registryPresets.length === 1 ? "" : "s"} against the registry…\n`));
+
+  const results = await checkAll(cwd, registryPresets);
+  const notable = results.filter((r) => r.state !== "current");
+
+  if (notable.length === 0) {
+    console.log(pc.green(`✓ All ${results.length} packages are up to date.\n`));
+    return;
+  }
+
+  const width = Math.max(...notable.map((r) => r.entry.id.length));
+  for (const result of notable) {
+    const p = PRESENTATION[result.state];
+    const detail = result.error ? `${p.note}: ${result.error}` : p.note;
+    console.log(`  ${p.mark}  ${pc.white(result.entry.id.padEnd(width))}  ${pc.dim(detail)}`);
+  }
+
+  const counts = notable.reduce((acc, r) => ({ ...acc, [r.state]: (acc[r.state] || 0) + 1 }), {});
+  console.log("");
+  console.log(
+    pc.bold(
+      Object.entries(counts)
+        .map(([state, n]) => `${n} ${state}`)
+        .join(", ")
+    ) + pc.dim(`, ${results.length - notable.length} current`)
+  );
+
+  if (counts.outdated || counts.missing) {
+    console.log(pc.dim(`\n  Apply updates:  ${A} update`));
+  }
+  if (counts.conflict) {
+    console.log(pc.dim(`  Conflicts are left alone. Review the diff, then: ${A} update --force`));
+  }
+  if (counts.removed) {
+    console.log(pc.dim(`  Removed packages:  ${A} remove <id>`));
+  }
+  console.log("");
+
+  process.exitCode = 1;
+}
+
+module.exports = { outdated };

package/src/commands/remove.js

@@ -0,0 +1,72 @@
+/**
+ * remove.js
+ *
+ * Handles: agentmd remove <model/category/preset>
+ *
+ * Deletes the installed file and drops the manifest entry. Only ever touches
+ * paths recorded in the manifest and resolved back inside .agentmd/presets/.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const pc = require("picocolors");
+const { cmd } = require("../lib/invocation");
+
+/** How the user invoked us — "npx activate-agentmd" or "agentmd". */
+const A = cmd();
+const {
+  readManifest,
+  writeManifest,
+  removePreset,
+  findPreset,
+  getPresetsDir,
+} = require("../lib/manifest");
+
+function remove(args) {
+  const positional = (args || []).filter((a) => !a.startsWith("--"));
+  if (positional.length === 0) {
+    console.error(pc.red(`Usage: ${A} remove <model/category/preset>`));
+    console.error(pc.dim(`  Example: ${A} remove claude/Security/owasp`));
+    console.error(pc.dim(`  See installed packages: ${A} list --installed`));
+    process.exit(1);
+  }
+
+  const cwd = process.cwd();
+  const manifest = readManifest(cwd);
+  const id = positional[0].replace(/^\/+|\/+$/g, "");
+
+  const entry = findPreset(manifest, id);
+  if (!entry) {
+    console.error(pc.red(`Not installed: ${id}`));
+    if (manifest.presets.length > 0) {
+      console.error(pc.dim("\n  This project has:"));
+      for (const p of manifest.presets.slice(0, 10)) console.error(pc.dim(`    ${p.id}`));
+      if (manifest.presets.length > 10) console.error(pc.dim(`    …and ${manifest.presets.length - 10} more`));
+    } else {
+      console.error(pc.dim("  No packages are installed in this project."));
+    }
+    process.exit(1);
+  }
+
+  // Re-derive the path from the presets dir rather than trusting the manifest
+  // string, so a tampered manifest can't point rm at something outside it.
+  const presetsDir = path.resolve(getPresetsDir(cwd));
+  const filePath = path.resolve(cwd, entry.file);
+  if (!filePath.startsWith(presetsDir + path.sep)) {
+    console.error(pc.red(`Refusing to delete ${entry.file} — it is outside .agentmd/presets/`));
+    process.exit(1);
+  }
+
+  if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+  removePreset(manifest, entry.id);
+  writeManifest(cwd, manifest);
+
+  console.log("");
+  console.log(pc.green(`✓ Removed ${pc.cyan(entry.id)}`) + pc.dim(`  ${entry.file}`));
+  console.log(pc.dim(`  ${manifest.presets.length} package${manifest.presets.length === 1 ? "" : "s"} remain`));
+  console.log(pc.dim(`  Run '${A} link' to update your agent config files.\n`));
+}
+
+module.exports = { remove };