agentinit 1.19.0 → 1.20.1

package/dist/cli.js

@@ -8347,6 +8347,159 @@ var require_prompts3 = __commonJS((exports, module) => {
   module.exports = isNodeLT("8.6.0") ? require_dist() : require_lib();
 });
 
+// node_modules/kleur/colors.mjs
+var init, FORCE_COLOR, NODE_DISABLE_COLORS, NO_COLOR, TERM, isTTY, $, reset, bold, dim, italic, underline, inverse, hidden, strikethrough, black, red, green, yellow, blue, magenta, cyan, white, gray, grey, bgBlack, bgRed, bgGreen, bgYellow, bgBlue, bgMagenta, bgCyan, bgWhite;
+var init_colors = __esm(() => {
+  init = function(x, y) {
+    let rgx = new RegExp(`\\x1b\\[${y}m`, "g");
+    let open = `\x1B[${x}m`, close = `\x1B[${y}m`;
+    return function(txt) {
+      if (!$.enabled || txt == null)
+        return txt;
+      return open + (~("" + txt).indexOf(close) ? txt.replace(rgx, close + open) : txt) + close;
+    };
+  };
+  isTTY = true;
+  if (typeof process !== "undefined") {
+    ({ FORCE_COLOR, NODE_DISABLE_COLORS, NO_COLOR, TERM } = process.env || {});
+    isTTY = process.stdout && process.stdout.isTTY;
+  }
+  $ = {
+    enabled: !NODE_DISABLE_COLORS && NO_COLOR == null && TERM !== "dumb" && (FORCE_COLOR != null && FORCE_COLOR !== "0" || isTTY)
+  };
+  reset = init(0, 0);
+  bold = init(1, 22);
+  dim = init(2, 22);
+  italic = init(3, 23);
+  underline = init(4, 24);
+  inverse = init(7, 27);
+  hidden = init(8, 28);
+  strikethrough = init(9, 29);
+  black = init(30, 39);
+  red = init(31, 39);
+  green = init(32, 39);
+  yellow = init(33, 39);
+  blue = init(34, 39);
+  magenta = init(35, 39);
+  cyan = init(36, 39);
+  white = init(37, 39);
+  gray = init(90, 39);
+  grey = init(90, 39);
+  bgBlack = init(40, 49);
+  bgRed = init(41, 49);
+  bgGreen = init(42, 49);
+  bgYellow = init(43, 49);
+  bgBlue = init(44, 49);
+  bgMagenta = init(45, 49);
+  bgCyan = init(46, 49);
+  bgWhite = init(47, 49);
+});
+
+// dist/utils/symbols.js
+var STATUS, TREE, BOX;
+var init_symbols = __esm(() => {
+  STATUS = {
+    success: "\u2713",
+    error: "\u2717",
+    warning: "\u26A0",
+    info: "\u2139",
+    debug: "\u2022"
+  };
+  TREE = {
+    branch: "\u251C\u2500",
+    last: "\u2514\u2500"
+  };
+  BOX = {
+    topLeft: "\u250C",
+    topRight: "\u2510",
+    bottomLeft: "\u2514",
+    bottomRight: "\u2518",
+    horizontal: "\u2500",
+    vertical: "\u2502"
+  };
+});
+
+// dist/utils/logger.js
+class Logger {
+  static instance;
+  static getInstance() {
+    if (!Logger.instance) {
+      Logger.instance = new Logger;
+    }
+    return Logger.instance;
+  }
+  info(message) {
+    console.log(cyan(STATUS.info), message);
+  }
+  success(message) {
+    console.log(green(STATUS.success), message);
+  }
+  warning(message) {
+    console.log(yellow(STATUS.warning), message);
+  }
+  warn(message) {
+    this.warning(message);
+  }
+  error(message) {
+    console.log(red(STATUS.error), message);
+  }
+  debug(message) {
+    console.log(dim(STATUS.debug), dim(message));
+  }
+  title(message) {
+    console.log(bold(cyan(message)));
+  }
+  subtitle(message) {
+    console.log(bold(message));
+  }
+  titleBox(message) {
+    const w = getTerminalWidth();
+    if (w < 8) {
+      console.log(bold(cyan(truncateText(message, w))));
+      return;
+    }
+    const maxInner = Math.max(4, w - 2);
+    const inner = Math.min(Math.max(message.length + 4, 40), maxInner);
+    const visibleMessage = truncateText(message, inner - 2);
+    const padR = Math.max(0, inner - visibleMessage.length - 2);
+    console.log(dim(BOX.topLeft + BOX.horizontal.repeat(inner) + BOX.topRight));
+    console.log(dim(BOX.vertical) + " " + bold(cyan(visibleMessage)) + " ".repeat(padR) + " " + dim(BOX.vertical));
+    console.log(dim(BOX.bottomLeft + BOX.horizontal.repeat(inner) + BOX.bottomRight));
+  }
+  section(title) {
+    const w = getTerminalWidth();
+    const lineLen = Math.max(0, w - title.length - 5);
+    console.log("");
+    console.log(bold(`${BOX.horizontal}${BOX.horizontal} ${title} ${BOX.horizontal.repeat(lineLen)}`));
+  }
+  tree(message, isLast) {
+    const connector = isLast ? TREE.last : TREE.branch;
+    console.log(`${connector} ${message}`);
+  }
+}
+var getTerminalWidth, truncateText, logger;
+var init_logger = __esm(() => {
+  init_colors();
+  init_symbols();
+  getTerminalWidth = function() {
+    const columns = process.stdout.columns;
+    return typeof columns === "number" && columns > 0 ? columns : 80;
+  };
+  truncateText = function(text, maxLength) {
+    if (maxLength <= 0) {
+      return "";
+    }
+    if (text.length <= maxLength) {
+      return text;
+    }
+    if (maxLength <= 3) {
+      return ".".repeat(maxLength);
+    }
+    return `${text.slice(0, maxLength - 3)}...`;
+  };
+  logger = Logger.getInstance();
+});
+
 // dist/utils/fs.js
 import {promises as fs} from "fs";
 import {platform} from "os";
@@ -16945,6 +17098,174 @@ var init_marketplaceRegistry = __esm(() => {
   CUSTOM_MARKETPLACE_CACHE_TTL_MS = 3600000;
 });
 
+// dist/core/skillSecurityScanner.js
+import {promises as fs22} from "fs";
+import {join as join4, relative as relative2} from "path";
+
+class SkillSecurityScanner {
+  async scanSkill(skill) {
+    const findings = skill.generatedContent ? this.scanText(skill.generatedContent, "SKILL.md") : await this.scanDirectory(skill.path);
+    const stats = findings.reduce((acc, finding) => {
+      acc[finding.severity] += 1;
+      return acc;
+    }, { high: 0, medium: 0, low: 0 });
+    return {
+      blocked: findings.some((finding) => finding.blocking),
+      findings,
+      stats
+    };
+  }
+  formatShortSummary(result) {
+    const parts = [
+      result.stats.high ? `${result.stats.high} high` : null,
+      result.stats.medium ? `${result.stats.medium} medium` : null,
+      result.stats.low ? `${result.stats.low} low` : null
+    ].filter((value) => !!value);
+    return parts.length > 0 ? parts.join(", ") : "no findings";
+  }
+  formatBlockingReason(result) {
+    const finding = result.findings.find((entry) => entry.blocking) || result.findings.find((entry) => entry.severity === "high") || result.findings[0];
+    if (!finding) {
+      return "Security scan failed";
+    }
+    return `Security scan failed: ${finding.title} (${finding.ruleId}) at ${finding.filePath}:${finding.line}`;
+  }
+  async scanDirectory(rootPath) {
+    const findings = [];
+    await this.walk(rootPath, rootPath, findings);
+    return findings;
+  }
+  async walk(rootPath, currentPath, findings) {
+    const entries = await fs22.readdir(currentPath, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name === ".git" || entry.name === "node_modules") {
+        continue;
+      }
+      const entryPath = join4(currentPath, entry.name);
+      if (entry.isDirectory()) {
+        await this.walk(rootPath, entryPath, findings);
+        continue;
+      }
+      const relativePath = relative2(rootPath, entryPath).replace(/\\/g, "/");
+      const content = await this.readTextFile(entryPath);
+      if (content === null) {
+        continue;
+      }
+      findings.push(...this.scanText(content, relativePath, {
+        blockHighRisk: this.isExecutableTextFile(entryPath, content)
+      }));
+    }
+  }
+  async readTextFile(filePath) {
+    const extension = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")).toLowerCase() : "";
+    if (!SCANNED_TEXT_EXTENSIONS.has(extension)) {
+      return null;
+    }
+    const buffer = await fs22.readFile(filePath);
+    if (buffer.length > MAX_TEXT_FILE_BYTES || buffer.includes(0)) {
+      return null;
+    }
+    return buffer.toString("utf8");
+  }
+  isExecutableTextFile(filePath, content) {
+    const extension = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")).toLowerCase() : "";
+    return EXECUTABLE_TEXT_EXTENSIONS.has(extension) || content.startsWith("#!");
+  }
+  scanText(content, filePath, options2 = {}) {
+    const findings = [];
+    const lines = content.split(/\r?\n/);
+    lines.forEach((line, index) => {
+      for (const rule of SCAN_RULES) {
+        rule.regex.lastIndex = 0;
+        if (!rule.regex.test(line)) {
+          continue;
+        }
+        findings.push({
+          ruleId: rule.id,
+          title: rule.title,
+          severity: rule.severity,
+          filePath,
+          line: index + 1,
+          snippet: line.trim().slice(0, 160),
+          blocking: rule.severity === "high" && options2.blockHighRisk === true
+        });
+      }
+    });
+    return findings;
+  }
+}
+var SCAN_RULES, MAX_TEXT_FILE_BYTES, SCANNED_TEXT_EXTENSIONS, EXECUTABLE_TEXT_EXTENSIONS;
+var init_skillSecurityScanner = __esm(() => {
+  SCAN_RULES = [
+    {
+      id: "AI001",
+      title: "Prompt override language",
+      severity: "medium",
+      regex: /\b(ignore|disregard|override|bypass)\b.{0,40}\b(previous|prior|system|safety|guardrails?|instructions?)\b/i
+    },
+    {
+      id: "AI002",
+      title: "Secret or credential exfiltration",
+      severity: "high",
+      regex: /\b(exfiltrat\w*|upload|send|post|curl|wget)\b.{0,80}\b(secret|token|key|credential|cookie|session|\.ssh|id_rsa|env(?:ironment)? variables?)\b/i
+    },
+    {
+      id: "AI003",
+      title: "Destructive shell command",
+      severity: "high",
+      regex: /\b(rm\s+-rf\s+\/|sudo\s+rm\s+-rf|mkfs\b|dd\s+if=\/dev\/zero|chmod\s+-R\s+777\s+\/)\b/i
+    },
+    {
+      id: "AI004",
+      title: "Remote shell execution pipeline",
+      severity: "high",
+      regex: /\b(curl|wget)\b[^\n|]{0,160}\|\s*(sh|bash|zsh)\b/i
+    },
+    {
+      id: "AI005",
+      title: "Hardcoded credential material",
+      severity: "low",
+      regex: /\b(api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{8,}['"]/i
+    },
+    {
+      id: "AI006",
+      title: "Unicode bidi control characters",
+      severity: "low",
+      regex: /[\u202A-\u202E\u2066-\u2069]/
+    }
+  ];
+  MAX_TEXT_FILE_BYTES = 1024 * 1024;
+  SCANNED_TEXT_EXTENSIONS = new Set([
+    "",
+    ".md",
+    ".txt",
+    ".json",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".js",
+    ".ts",
+    ".mjs",
+    ".cjs",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".py",
+    ".ps1"
+  ]);
+  EXECUTABLE_TEXT_EXTENSIONS = new Set([
+    ".js",
+    ".ts",
+    ".mjs",
+    ".cjs",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".py",
+    ".ps1"
+  ]);
+});
+
 // dist/types/skills.js
 var SHARED_SKILLS_TARGET_ID, SHARED_SKILLS_TARGET_NAME;
 var init_skills = __esm(() => {
@@ -16952,6 +17273,280 @@ var init_skills = __esm(() => {
   SHARED_SKILLS_TARGET_NAME = "AGENTS.md ecosystem";
 });
 
+// dist/core/installLock.js
+import {promises as fs23} from "fs";
+import {homedir as homedir4} from "os";
+import {dirname as dirname2, join as join5, resolve as resolve7} from "path";
+import {createHash, randomUUID} from "crypto";
+function getLockEntryTargetLabel(entry) {
+  return entry.scope === "global" ? "Global scope" : entry.projectPath;
+}
+function logLockWriteWarning(context, error) {
+  const detail = error instanceof Error ? error.message : "unknown error";
+  logger.warn(`${context}, but failed to update the install lock: ${detail}`);
+}
+async function hashDirectory(rootPath) {
+  if (!await fileExists(rootPath))
+    return null;
+  const hash = createHash("sha256");
+  const walk = async (currentPath, relativePath) => {
+    const stat = await fs23.stat(currentPath);
+    if (stat.isDirectory()) {
+      hash.update(`dir:${relativePath}\n`);
+      const entries = await fs23.readdir(currentPath);
+      entries.sort();
+      for (const entry of entries) {
+        await walk(join5(currentPath, entry), `${relativePath}/${entry}`);
+      }
+    } else {
+      const content = await fs23.readFile(currentPath);
+      hash.update(`file:${relativePath}\n`);
+      hash.update(content);
+      hash.update("\n");
+    }
+  };
+  await walk(rootPath, ".");
+  return hash.digest("hex");
+}
+
+class InstallLock {
+  state = null;
+  async load() {
+    if (this.state)
+      return this.state;
+    const content = await readFileIfExists(getLockPath());
+    if (!content) {
+      this.state = { version: 1, entries: [] };
+      return this.state;
+    }
+    try {
+      const parsed = JSON.parse(content);
+      if (parsed?.version === 1 && Array.isArray(parsed.entries)) {
+        this.state = parsed;
+      } else {
+        this.state = { version: 1, entries: [] };
+      }
+    } catch {
+      this.state = { version: 1, entries: [] };
+    }
+    return this.state;
+  }
+  async save() {
+    if (!this.state)
+      return;
+    const lockPath = getLockPath();
+    await fs23.mkdir(dirname2(lockPath), { recursive: true });
+    await fs23.writeFile(lockPath, JSON.stringify(this.state, null, 2) + "\n", {
+      encoding: "utf8",
+      mode: 384
+    });
+    await fs23.chmod(lockPath, 384).catch(() => {
+    });
+  }
+  async recordSkill(params) {
+    const state = await this.load();
+    const metadata = {
+      kind: "skill",
+      installPath: params.installPath,
+      ...params.canonicalPath ? { canonicalPath: params.canonicalPath } : {},
+      mode: params.mode
+    };
+    const entry = createEntry({
+      kind: "skill",
+      action: params.action,
+      name: params.name,
+      projectPath: resolve7(params.projectPath),
+      agents: params.agents,
+      scope: params.scope,
+      source: params.source,
+      ...params.contentHash ? { contentHash: params.contentHash } : {},
+      metadata
+    });
+    state.entries.push(entry);
+    await this.save();
+    return entry;
+  }
+  async recordMcp(params) {
+    const state = await this.load();
+    const metadata = {
+      kind: "mcp",
+      configPath: params.configPath,
+      serverType: params.serverType,
+      ...params.command ? { command: params.command } : {},
+      ...params.url ? { url: sanitizeUrlForLock(params.url) } : {}
+    };
+    const entry = createEntry({
+      kind: "mcp",
+      action: params.action,
+      name: params.name,
+      projectPath: resolve7(params.projectPath),
+      agents: params.agents,
+      scope: params.scope,
+      source: params.source,
+      metadata
+    });
+    state.entries.push(entry);
+    await this.save();
+    return entry;
+  }
+  async recordRules(params) {
+    const state = await this.load();
+    const metadata = {
+      kind: "rules",
+      configPath: params.configPath,
+      templateIds: params.templateIds,
+      ruleCount: params.ruleCount
+    };
+    const entry = createEntry({
+      kind: "rules",
+      action: params.action,
+      name: params.name,
+      projectPath: resolve7(params.projectPath),
+      agents: params.agents,
+      scope: params.scope,
+      source: params.source,
+      metadata
+    });
+    state.entries.push(entry);
+    await this.save();
+    return entry;
+  }
+  async query(options2 = {}) {
+    const state = await this.load();
+    return state.entries.filter((entry) => {
+      if (options2.kind && entry.kind !== options2.kind)
+        return false;
+      if (options2.name && entry.name.toLowerCase() !== options2.name.toLowerCase())
+        return false;
+      if (options2.projectPath && entry.projectPath !== resolve7(options2.projectPath))
+        return false;
+      if (options2.agent && !entry.agents.includes(options2.agent))
+        return false;
+      if (options2.scope && entry.scope !== options2.scope)
+        return false;
+      if (options2.action && entry.action !== options2.action)
+        return false;
+      return true;
+    });
+  }
+  async getCurrentState(options2 = {}) {
+    const entries = await this.query(options2);
+    const groups = new Map;
+    for (const entry of entries) {
+      const key = this.getCurrentStateKey(entry);
+      groups.set(key, entry);
+    }
+    return [...groups.values()].filter((e) => e.action !== "remove");
+  }
+  getCurrentStateKey(entry) {
+    const agents = [...entry.agents].sort().join(",");
+    return [
+      entry.kind,
+      entry.name.toLowerCase(),
+      getEntryTargetKey(entry),
+      entry.scope,
+      agents,
+      this.getLocationKey(entry)
+    ].join(":");
+  }
+  getLocationKey(entry) {
+    switch (entry.metadata.kind) {
+      case "skill":
+        return entry.metadata.canonicalPath || entry.metadata.installPath;
+      case "mcp":
+        return entry.metadata.configPath;
+      case "rules":
+        return `${entry.metadata.configPath}:${entry.metadata.templateIds.join(",")}`;
+    }
+  }
+  async getProjectPaths() {
+    const state = await this.load();
+    return [...new Set(state.entries.filter((entry) => entry.scope === "project").map((entry) => entry.projectPath))];
+  }
+  async findProjectsWithSkill(skillName) {
+    return this.getCurrentState({ kind: "skill", name: skillName });
+  }
+  async findStaleProjects() {
+    const projectPaths = await this.getProjectPaths();
+    const stale = [];
+    for (const projectPath of projectPaths) {
+      if (!await fileExists(projectPath)) {
+        stale.push(projectPath);
+      }
+    }
+    return stale;
+  }
+  async pruneStaleEntries() {
+    const stale = await this.findStaleProjects();
+    let entriesRemoved = 0;
+    if (stale.length === 0) {
+      return { prunedProjects: [], entriesRemoved: 0 };
+    }
+    const state = await this.load();
+    const staleSet = new Set(stale);
+    const before = state.entries.length;
+    state.entries = state.entries.filter((e) => !staleSet.has(e.projectPath));
+    entriesRemoved = before - state.entries.length;
+    if (entriesRemoved > 0) {
+      await this.save();
+    }
+    return { prunedProjects: stale, entriesRemoved };
+  }
+  async checkDrift(entry) {
+    if (!entry.contentHash) {
+      return { entry, status: "match" };
+    }
+    if (entry.metadata.kind !== "skill") {
+      return { entry, status: "match" };
+    }
+    const installPath = entry.metadata.installPath;
+    if (!await fileExists(installPath)) {
+      return { entry, status: "missing" };
+    }
+    const currentHash = await hashDirectory(installPath);
+    if (!currentHash) {
+      return { entry, status: "missing" };
+    }
+    return {
+      entry,
+      status: currentHash === entry.contentHash ? "match" : "drift",
+      currentHash
+    };
+  }
+}
+var getLockPath, getEntryTargetKey, createEntry, sanitizeUrlForLock, LOCK_FILE, GLOBAL_TARGET_KEY;
+var init_installLock = __esm(() => {
+  init_fs();
+  init_logger();
+  getLockPath = function() {
+    return join5(homedir4(), ".agentinit", LOCK_FILE);
+  };
+  getEntryTargetKey = function(entry) {
+    return entry.scope === "global" ? GLOBAL_TARGET_KEY : entry.projectPath;
+  };
+  createEntry = function(base) {
+    return {
+      id: randomUUID(),
+      timestamp: new Date().toISOString(),
+      ...base
+    };
+  };
+  sanitizeUrlForLock = function(url) {
+    try {
+      const parsed = new URL(url);
+      parsed.username = "";
+      parsed.password = "";
+      parsed.search = "";
+      parsed.hash = "";
+      return parsed.toString();
+    } catch {
+      return url.split(/[?#]/)[0] || url;
+    }
+  };
+  LOCK_FILE = "lock.json";
+  GLOBAL_TARGET_KEY = "__agentinit_global__";
+});
+
 // dist/core/mcpFilter.js
 class MCPFilter {
   static filterForAgent(agent, servers) {
@@ -17066,9 +17661,9 @@ __export(exports_pluginManager, {
     }
   }
 });
-import {resolve as resolve7, join as join4, basename as basename2, relative as relative2, dirname as dirname2} from "path";
-import {promises as fs22} from "fs";
-import {homedir as homedir4} from "os";
+import {resolve as resolve8, join as join6, basename as basename2, relative as relative3, dirname as dirname3} from "path";
+import {promises as fs25} from "fs";
+import {homedir as homedir5} from "os";
 
 class MultipleBundlePluginsError extends Error {
   entries;
@@ -17112,7 +17707,7 @@ class PluginManager {
   }
   async cleanupLoadedPluginContext(context) {
     if (context?.tempDir) {
-      await fs22.rm(context.tempDir, { recursive: true, force: true }).catch(() => {
+      await fs25.rm(context.tempDir, { recursive: true, force: true }).catch(() => {
       });
     }
   }
@@ -17190,7 +17785,7 @@ class PluginManager {
     return "unverified";
   }
   async resolvePreparedPluginDir(pluginDir, source) {
-    const claudeMarketplaceManifestPath = join4(pluginDir, ".claude-plugin", "marketplace.json");
+    const claudeMarketplaceManifestPath = join6(pluginDir, ".claude-plugin", "marketplace.json");
     if (!await fileExists(claudeMarketplaceManifestPath)) {
       return { pluginDir, warnings: [] };
     }
@@ -17225,8 +17820,8 @@ class PluginManager {
       }
       selectedEntry = matched;
     }
-    const selectedPluginDir = resolve7(pluginDir, selectedEntry.source);
-    const relativePath = relative2(resolve7(pluginDir), selectedPluginDir);
+    const selectedPluginDir = resolve8(pluginDir, selectedEntry.source);
+    const relativePath = relative3(resolve8(pluginDir), selectedPluginDir);
     if (relativePath.startsWith("..") || relativePath.includes("/../") || relativePath.includes("\\..\\")) {
       throw new Error(`Invalid bundled plugin source path "${selectedEntry.source}" in ${claudeMarketplaceManifestPath}`);
     }
@@ -17293,7 +17888,7 @@ class PluginManager {
       tempDir = await this.skillsManager.cloneRepo(resolved.url);
       pluginDir = tempDir;
     } else {
-      pluginDir = resolve7(resolved.path || source);
+      pluginDir = resolve8(resolved.path || source);
       if (!await fileExists(pluginDir)) {
         throw new Error(`Local path not found: ${pluginDir}`);
       }
@@ -17338,15 +17933,15 @@ class PluginManager {
   }
   async getClaudeNativeFeatureKinds(pluginDir, manifest) {
     const featureChecks = await Promise.all([
-      (async () => !!manifest.commands || await isDirectory(join4(pluginDir, "commands")))(),
-      (async () => !!manifest.hooks || await isDirectory(join4(pluginDir, "hooks")))(),
-      (async () => !!manifest.agents || await isDirectory(join4(pluginDir, "agents")))(),
-      isDirectory(join4(pluginDir, "skills")),
-      (async () => !!manifest.mcpServers || await fileExists(join4(pluginDir, ".mcp.json")))(),
-      isDirectory(join4(pluginDir, "prompts")),
-      isDirectory(join4(pluginDir, "schemas")),
-      isDirectory(join4(pluginDir, "scripts")),
-      isDirectory(join4(pluginDir, "templates"))
+      (async () => !!manifest.commands || await isDirectory(join6(pluginDir, "commands")))(),
+      (async () => !!manifest.hooks || await isDirectory(join6(pluginDir, "hooks")))(),
+      (async () => !!manifest.agents || await isDirectory(join6(pluginDir, "agents")))(),
+      isDirectory(join6(pluginDir, "skills")),
+      (async () => !!manifest.mcpServers || await fileExists(join6(pluginDir, ".mcp.json")))(),
+      isDirectory(join6(pluginDir, "prompts")),
+      isDirectory(join6(pluginDir, "schemas")),
+      isDirectory(join6(pluginDir, "scripts")),
+      isDirectory(join6(pluginDir, "templates"))
     ]);
     return [
       ...featureChecks[0] ? ["commands"] : [],
@@ -17364,7 +17959,7 @@ class PluginManager {
     if (plugin.format !== "claude") {
       return null;
     }
-    const manifestContent = await readFileIfExists(join4(pluginDir, ".claude-plugin", "plugin.json"));
+    const manifestContent = await readFileIfExists(join6(pluginDir, ".claude-plugin", "plugin.json"));
     if (!manifestContent) {
       return null;
     }
@@ -17384,7 +17979,7 @@ class PluginManager {
     return {
       namespace,
       pluginKey: `${plugin.name}@${namespace}`,
-      installPath: join4(homedir4(), ".claude", "plugins", "cache", namespace, plugin.name, versionDir),
+      installPath: join6(homedir5(), ".claude", "plugins", "cache", namespace, plugin.name, versionDir),
       marketplacePath: getClaudeMarketplaceInstallPath(namespace),
       features
     };
@@ -17448,12 +18043,12 @@ class PluginManager {
     await writeFile(getClaudeSettingsPath(), JSON.stringify(state, null, 2));
   }
   async findClaudeMarketplaceRoot(pluginDir) {
-    let currentDir = resolve7(pluginDir);
+    let currentDir = resolve8(pluginDir);
     while (true) {
-      if (await fileExists(join4(currentDir, ".claude-plugin", "marketplace.json"))) {
+      if (await fileExists(join6(currentDir, ".claude-plugin", "marketplace.json"))) {
         return currentDir;
       }
-      const parentDir = dirname2(currentDir);
+      const parentDir = dirname3(currentDir);
       if (parentDir === currentDir) {
         return null;
       }
@@ -17461,7 +18056,7 @@ class PluginManager {
     }
   }
   async readClaudeMarketplaceManifest(marketplaceDir) {
-    const manifestContent = await readFileIfExists(join4(marketplaceDir, ".claude-plugin", "marketplace.json"));
+    const manifestContent = await readFileIfExists(join6(marketplaceDir, ".claude-plugin", "marketplace.json"));
     if (!manifestContent) {
       return null;
     }
@@ -17480,19 +18075,19 @@ class PluginManager {
     }
   }
   async saveClaudeMarketplaceManifest(marketplaceDir, manifest) {
-    await fs22.mkdir(join4(marketplaceDir, ".claude-plugin"), { recursive: true });
-    await writeFile(join4(marketplaceDir, ".claude-plugin", "marketplace.json"), JSON.stringify(manifest, null, 2));
+    await fs25.mkdir(join6(marketplaceDir, ".claude-plugin"), { recursive: true });
+    await writeFile(join6(marketplaceDir, ".claude-plugin", "marketplace.json"), JSON.stringify(manifest, null, 2));
   }
   resolveMarketplaceSourcePath(baseDir, relativePath) {
-    const resolvedPath = resolve7(baseDir, relativePath);
-    const relativePathFromBase = relative2(resolve7(baseDir), resolvedPath);
+    const resolvedPath = resolve8(baseDir, relativePath);
+    const relativePathFromBase = relative3(resolve8(baseDir), resolvedPath);
     if (relativePathFromBase.startsWith("..") || relativePathFromBase.includes("/../") || relativePathFromBase.includes("\\..\\")) {
       throw new Error(`Invalid marketplace source path "${relativePath}" in ${baseDir}`);
     }
     return resolvedPath;
   }
   async readClaudePluginMetadata(pluginDir) {
-    const manifestContent = await readFileIfExists(join4(pluginDir, ".claude-plugin", "plugin.json"));
+    const manifestContent = await readFileIfExists(join6(pluginDir, ".claude-plugin", "plugin.json"));
     if (!manifestContent) {
       return {};
     }
@@ -17508,11 +18103,11 @@ class PluginManager {
     }
   }
   async copyClaudeMarketplacePlugin(sourcePluginDir, marketplacePath, pluginName) {
-    const marketplacePluginPath = join4(marketplacePath, "plugins", pluginName);
-    await fs22.mkdir(dirname2(marketplacePluginPath), { recursive: true });
-    await fs22.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
+    const marketplacePluginPath = join6(marketplacePath, "plugins", pluginName);
+    await fs25.mkdir(dirname3(marketplacePluginPath), { recursive: true });
+    await fs25.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
     });
-    await fs22.cp(sourcePluginDir, marketplacePluginPath, { recursive: true, dereference: true });
+    await fs25.cp(sourcePluginDir, marketplacePluginPath, { recursive: true, dereference: true });
     return marketplacePluginPath;
   }
   getClaudeMarketplaceSource(plugin, marketplaceRoot, marketplacePath) {
@@ -17533,7 +18128,7 @@ class PluginManager {
     if (plugin.source.type === "local") {
       return {
         source: "directory",
-        path: resolve7(marketplaceRoot || plugin.source.path || marketplacePath)
+        path: resolve8(marketplaceRoot || plugin.source.path || marketplacePath)
       };
     }
     return {
@@ -17544,7 +18139,7 @@ class PluginManager {
   async materializeClaudeMarketplace(plugin, pluginDir, target) {
     const marketplaceRoot = await this.findClaudeMarketplaceRoot(pluginDir);
     const marketplaceSource = this.getClaudeMarketplaceSource(plugin, marketplaceRoot, target.marketplacePath);
-    await fs22.mkdir(target.marketplacePath, { recursive: true });
+    await fs25.mkdir(target.marketplacePath, { recursive: true });
     const existingManifest = await this.readClaudeMarketplaceManifest(target.marketplacePath);
     const sourceManifest = marketplaceRoot ? await this.readClaudeMarketplaceManifest(marketplaceRoot) : null;
     const mergedManifest = {
@@ -17616,10 +18211,10 @@ class PluginManager {
       warnings.push(`Skipped native Claude plugin install because Claude already has "${plugin.name}" installed as ${conflictingKey}.`);
       return { installed, skipped, warnings };
     }
-    await fs22.rm(nativeTarget.installPath, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(nativeTarget.installPath, { recursive: true, force: true }).catch(() => {
     });
-    await fs22.mkdir(dirname2(nativeTarget.installPath), { recursive: true });
-    await fs22.cp(pluginDir, nativeTarget.installPath, { recursive: true, dereference: true });
+    await fs25.mkdir(dirname3(nativeTarget.installPath), { recursive: true });
+    await fs25.cp(pluginDir, nativeTarget.installPath, { recursive: true, dereference: true });
     const marketplace = await this.materializeClaudeMarketplace(plugin, pluginDir, nativeTarget);
     const now = new Date().toISOString();
     claudeInstalled.plugins[nativeTarget.pluginKey] = [{
@@ -17659,7 +18254,7 @@ class PluginManager {
     };
     await this.saveClaudeKnownMarketplaces(knownMarketplaces);
     for (const entry of legacyEntries) {
-      await fs22.rm(entry.installPath, { recursive: true, force: true }).catch(() => {
+      await fs25.rm(entry.installPath, { recursive: true, force: true }).catch(() => {
       });
     }
     for (const legacyKey of legacyKeys) {
@@ -17707,7 +18302,7 @@ class PluginManager {
         delete knownMarketplaces[marketplaceNamespace];
         await this.saveClaudeKnownMarketplaces(knownMarketplaces);
       }
-      await fs22.rm(getClaudeMarketplaceInstallPath(marketplaceNamespace), { recursive: true, force: true }).catch(() => {
+      await fs25.rm(getClaudeMarketplaceInstallPath(marketplaceNamespace), { recursive: true, force: true }).catch(() => {
       });
     } else if (marketplaceNamespace) {
       const pluginName = component.pluginKey.split("@")[0] || "";
@@ -17715,14 +18310,14 @@ class PluginManager {
       const manifest = await this.readClaudeMarketplaceManifest(marketplacePath);
       if (pluginName && manifest) {
         manifest.plugins = (manifest.plugins || []).filter((entry) => entry.name !== pluginName);
-        const marketplacePluginPath = join4(marketplacePath, "plugins", pluginName);
-        await fs22.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
+        const marketplacePluginPath = join6(marketplacePath, "plugins", pluginName);
+        await fs25.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
         });
         await this.saveClaudeMarketplaceManifest(marketplacePath, manifest);
       }
     }
     await this.saveClaudeSettings(claudeSettings);
-    await fs22.rm(component.installPath, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(component.installPath, { recursive: true, force: true }).catch(() => {
     });
     return true;
   }
@@ -17795,7 +18390,7 @@ class PluginManager {
       throw new Error(`Unknown marketplace: ${registryId}. Available: ${this.getMarketplaceIds().join(", ")}`);
     }
     const cacheDir = getMarketplaceCacheDir(registryId);
-    const cacheMetaPath = join4(cacheDir, ".agentinit-cache-meta.json");
+    const cacheMetaPath = join6(cacheDir, ".agentinit-cache-meta.json");
     const cacheMeta = await this.readMarketplaceCacheMeta(cacheMetaPath);
     if (cacheMeta?.repoUrl === registry.repoUrl) {
       const age = Date.now() - cacheMeta.fetchedAt;
@@ -17803,10 +18398,10 @@ class PluginManager {
         return cacheDir;
       }
     }
-    if (await fileExists(join4(cacheDir, ".git"))) {
+    if (await fileExists(join6(cacheDir, ".git"))) {
       const originUrl = await this.getMarketplaceCacheOriginUrl(cacheDir);
       if (originUrl !== registry.repoUrl) {
-        await fs22.rm(cacheDir, { recursive: true, force: true });
+        await fs25.rm(cacheDir, { recursive: true, force: true });
         await this.cloneMarketplace(registry.repoUrl, cacheDir);
       } else {
         const { execFile } = await import("child_process");
@@ -17815,15 +18410,15 @@ class PluginManager {
         try {
           await exec("git", ["pull", "--ff-only"], { cwd: cacheDir, timeout: 30000 });
         } catch {
-          await fs22.rm(cacheDir, { recursive: true, force: true });
+          await fs25.rm(cacheDir, { recursive: true, force: true });
           await this.cloneMarketplace(registry.repoUrl, cacheDir);
         }
       }
     } else {
       await this.cloneMarketplace(registry.repoUrl, cacheDir);
     }
-    await fs22.mkdir(cacheDir, { recursive: true });
-    await fs22.writeFile(cacheMetaPath, JSON.stringify({
+    await fs25.mkdir(cacheDir, { recursive: true });
+    await fs25.writeFile(cacheMetaPath, JSON.stringify({
       fetchedAt: Date.now(),
       repoUrl: registry.repoUrl
     }));
@@ -17834,7 +18429,7 @@ class PluginManager {
       return null;
     }
     try {
-      const meta = JSON.parse(await fs22.readFile(cacheMetaPath, "utf8"));
+      const meta = JSON.parse(await fs25.readFile(cacheMetaPath, "utf8"));
       if (typeof meta.fetchedAt !== "number") {
         return null;
       }
@@ -17862,11 +18457,11 @@ class PluginManager {
     }
   }
   async cloneMarketplace(repoUrl, dest) {
-    await fs22.mkdir(dest, { recursive: true });
+    await fs25.mkdir(dest, { recursive: true });
     const { execFile } = await import("child_process");
     const { promisify } = await import("util");
     const exec = promisify(execFile);
-    await fs22.rm(dest, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(dest, { recursive: true, force: true }).catch(() => {
     });
     await exec("git", ["clone", "--depth", "1", repoUrl, dest], { timeout: 60000 });
   }
@@ -17876,7 +18471,7 @@ class PluginManager {
       throw new Error(`Unknown marketplace: ${registryId}`);
     const cacheDir = await this.ensureMarketplaceCache(registryId);
     for (const dir of registry.pluginDirs) {
-      const pluginPath = join4(cacheDir, dir, name);
+      const pluginPath = join6(cacheDir, dir, name);
       if (await isDirectory(pluginPath)) {
         return pluginPath;
       }
@@ -17892,7 +18487,7 @@ class PluginManager {
     const cacheDir = await this.ensureMarketplaceCache(registryId);
     const results = [];
     for (const dir of registry.pluginDirs) {
-      const fullDir = join4(cacheDir, dir);
+      const fullDir = join6(cacheDir, dir);
       if (!await isDirectory(fullDir))
         continue;
       const cat = getMarketplaceCategoryForDir(dir);
@@ -17902,26 +18497,26 @@ class PluginManager {
       for (const entry of entries) {
         if (entry.startsWith("."))
           continue;
-        const entryPath = join4(fullDir, entry);
+        const entryPath = join6(fullDir, entry);
         if (!await isDirectory(entryPath))
           continue;
-        const manifestPath = join4(entryPath, ".claude-plugin", "plugin.json");
+        const manifestPath = join6(entryPath, ".claude-plugin", "plugin.json");
         let name = entry;
         let description = "";
         let version = "0.0.0";
         if (await fileExists(manifestPath)) {
           try {
-            const manifest = JSON.parse(await fs22.readFile(manifestPath, "utf8"));
+            const manifest = JSON.parse(await fs25.readFile(manifestPath, "utf8"));
             name = manifest.name || entry;
             description = manifest.description || "";
             version = manifest.version || "0.0.0";
           } catch {
           }
         } else {
-          const skillMdPath = join4(entryPath, "SKILL.md");
+          const skillMdPath = join6(entryPath, "SKILL.md");
           if (await fileExists(skillMdPath)) {
             try {
-              const parsed = import_gray_matter.default(await fs22.readFile(skillMdPath, "utf8"));
+              const parsed = import_gray_matter.default(await fs25.readFile(skillMdPath, "utf8"));
               if (parsed.data.name)
                 name = parsed.data.name;
               if (parsed.data.description)
@@ -17929,10 +18524,10 @@ class PluginManager {
             } catch {
             }
           } else {
-            const mcpPath = join4(entryPath, ".mcp.json");
+            const mcpPath = join6(entryPath, ".mcp.json");
             if (await fileExists(mcpPath)) {
               try {
-                const mcpConfig = JSON.parse(await fs22.readFile(mcpPath, "utf8"));
+                const mcpConfig = JSON.parse(await fs25.readFile(mcpPath, "utf8"));
                 const serverNames = Object.keys(mcpConfig.mcpServers || mcpConfig);
                 if (serverNames.length > 0) {
                   description = `MCP server(s): ${serverNames.join(", ")}`;
@@ -17954,10 +18549,10 @@ class PluginManager {
     return results.sort((a, b) => a.name.localeCompare(b.name));
   }
   async detectFormat(pluginDir) {
-    if (await fileExists(join4(pluginDir, ".claude-plugin", "plugin.json"))) {
+    if (await fileExists(join6(pluginDir, ".claude-plugin", "plugin.json"))) {
       return "claude";
     }
-    if (await fileExists(join4(pluginDir, ".cursor-plugin", "plugin.json"))) {
+    if (await fileExists(join6(pluginDir, ".cursor-plugin", "plugin.json"))) {
       return "cursor";
     }
     return "generic";
@@ -17974,7 +18569,7 @@ class PluginManager {
     }
   }
   async parseClaudePlugin(pluginDir, source) {
-    const manifestPath = join4(pluginDir, ".claude-plugin", "plugin.json");
+    const manifestPath = join6(pluginDir, ".claude-plugin", "plugin.json");
     const manifestContent = await readFileIfExists(manifestPath);
     if (!manifestContent) {
       throw new Error(`Missing .claude-plugin/plugin.json in ${pluginDir}`);
@@ -17985,10 +18580,10 @@ class PluginManager {
     const convertedSkills = await this.convertCommandsToSkills(pluginDir, manifest);
     skills.push(...convertedSkills);
     const mcpServers = await this.parseMcpJson(pluginDir);
-    if (await isDirectory(join4(pluginDir, "hooks")) || manifest.hooks) {
+    if (await isDirectory(join6(pluginDir, "hooks")) || manifest.hooks) {
       warnings.push("Hooks (hooks/) are Claude Code-specific");
     }
-    if (await isDirectory(join4(pluginDir, "agents")) || manifest.agents) {
+    if (await isDirectory(join6(pluginDir, "agents")) || manifest.agents) {
       warnings.push("Agent definitions (agents/) are Claude Code-specific");
     }
     return {
@@ -18003,7 +18598,7 @@ class PluginManager {
     };
   }
   async parseCursorPlugin(pluginDir, source) {
-    const manifestPath = join4(pluginDir, ".cursor-plugin", "plugin.json");
+    const manifestPath = join6(pluginDir, ".cursor-plugin", "plugin.json");
     const manifestContent = await readFileIfExists(manifestPath);
     if (!manifestContent) {
       throw new Error(`Missing .cursor-plugin/plugin.json in ${pluginDir}`);
@@ -18042,7 +18637,7 @@ class PluginManager {
     };
   }
   async parseMcpJson(pluginDir) {
-    const mcpPath = join4(pluginDir, ".mcp.json");
+    const mcpPath = join6(pluginDir, ".mcp.json");
     const content = await readFileIfExists(mcpPath);
     if (!content)
       return [];
@@ -18086,10 +18681,10 @@ class PluginManager {
     if (manifest.commands) {
       const cmds = Array.isArray(manifest.commands) ? manifest.commands : [manifest.commands];
       for (const cmd of cmds) {
-        commandsDirs.push(resolve7(pluginDir, cmd));
+        commandsDirs.push(resolve8(pluginDir, cmd));
       }
     } else {
-      commandsDirs.push(join4(pluginDir, "commands"));
+      commandsDirs.push(join6(pluginDir, "commands"));
     }
     for (const commandsDir of commandsDirs) {
       if (!await isDirectory(commandsDir))
@@ -18098,7 +18693,7 @@ class PluginManager {
       for (const entry of entries) {
         if (!entry.endsWith(".md"))
           continue;
-        const cmdPath = join4(commandsDir, entry);
+        const cmdPath = join6(commandsDir, entry);
         const skill = await this.convertSingleCommandToSkill(cmdPath, manifest.name);
         if (skill)
           skills.push(skill);
@@ -18412,7 +19007,7 @@ ${body.trim()}
       }
       if (!removedSkillPaths.has(skill.path)) {
         try {
-          await fs22.rm(skill.path, { recursive: true, force: true });
+          await fs25.rm(skill.path, { recursive: true, force: true });
           removedSkillPaths.add(skill.path);
         } catch {
           details.push(`Could not remove skill path: ${skill.path}`);
@@ -18421,7 +19016,7 @@ ${body.trim()}
       }
       if (skill.canonicalPath && skill.canonicalPath !== skill.path && !removedCanonicalPaths.has(skill.canonicalPath) && !sharedCanonicalPath) {
         try {
-          await fs22.rm(skill.canonicalPath, { recursive: true, force: true });
+          await fs25.rm(skill.canonicalPath, { recursive: true, force: true });
           removedCanonicalPaths.add(skill.canonicalPath);
         } catch {
           details.push(`Could not remove canonical skill path: ${skill.canonicalPath}`);
@@ -18527,39 +19122,40 @@ var init_pluginManager = __esm(() => {
   init_skillsManager();
   init_userConfig();
   getMarketplaceCacheDir = function(registryId) {
-    return join4(homedir4(), ".agentinit", "marketplace-cache", registryId);
+    return join6(homedir5(), ".agentinit", "marketplace-cache", registryId);
   };
   getRegistryPath = function(projectPath, global3) {
     if (global3) {
-      return join4(homedir4(), ".agentinit", "plugins.json");
+      return join6(homedir5(), ".agentinit", "plugins.json");
     }
-    return join4(projectPath, ".agentinit", "plugins.json");
+    return join6(projectPath, ".agentinit", "plugins.json");
   };
   getClaudeInstalledPluginsPath = function() {
-    return join4(homedir4(), ".claude", "plugins", "installed_plugins.json");
+    return join6(homedir5(), ".claude", "plugins", "installed_plugins.json");
   };
   getClaudeKnownMarketplacesPath = function() {
-    return join4(homedir4(), ".claude", "plugins", "known_marketplaces.json");
+    return join6(homedir5(), ".claude", "plugins", "known_marketplaces.json");
   };
   getClaudeMarketplaceInstallPath = function(namespace) {
-    return join4(homedir4(), ".claude", "plugins", "marketplaces", namespace);
+    return join6(homedir5(), ".claude", "plugins", "marketplaces", namespace);
   };
   getClaudeSettingsPath = function() {
-    return join4(homedir4(), ".claude", "settings.json");
+    return join6(homedir5(), ".claude", "settings.json");
   };
 });
 
 // dist/core/skillsManager.js
-import {resolve as resolve8, join as join5, relative as relative3, basename as basename3, dirname as dirname3} from "path";
-import {promises as fs24} from "fs";
-import {homedir as homedir5, tmpdir} from "os";
+import {resolve as resolve9, join as join7, relative as relative4, basename as basename3, dirname as dirname4} from "path";
+import {promises as fs27} from "fs";
+import {homedir as homedir6, tmpdir} from "os";
 import {execFile} from "child_process";
-import {createHash} from "crypto";
+import {createHash as createHash2} from "crypto";
 import {promisify} from "util";
 
 class SkillsManager {
   agentManager;
   preparedSourceContexts = new Map;
+  skillScanner = new SkillSecurityScanner;
   constructor(agentManager3) {
     this.agentManager = agentManager3 || new AgentManager;
   }
@@ -18567,11 +19163,15 @@ class SkillsManager {
     if (source.startsWith(".") || source.startsWith("/") || source.startsWith("~")) {
       return { type: "local", path: source };
     }
-    const githubUrlSource = this.parseGitHubHttpSource(source);
-    if (githubUrlSource) {
-      return githubUrlSource;
+    const httpSource = this.parseHttpRepositorySource(source);
+    if (httpSource) {
+      return httpSource;
     }
-    if (source.startsWith("git@") || source.endsWith(".git")) {
+    const sshSource = this.parseSshRepositorySource(source);
+    if (sshSource) {
+      return sshSource;
+    }
+    if (source.endsWith(".git")) {
       return { type: "github", url: source };
     }
     if (options2?.from) {
@@ -18584,6 +19184,14 @@ class SkillsManager {
         pluginName: source
       };
     }
+    const gitLabShorthandSource = this.parseGitLabShorthandSource(source);
+    if (gitLabShorthandSource) {
+      return gitLabShorthandSource;
+    }
+    const bitbucketShorthandSource = this.parseBitbucketShorthandSource(source);
+    if (bitbucketShorthandSource) {
+      return bitbucketShorthandSource;
+    }
     const githubShorthandSource = this.parseGitHubShorthandSource(source);
     if (githubShorthandSource?.subpath) {
       return githubShorthandSource;
@@ -18673,6 +19281,106 @@ class SkillsManager {
       return null;
     }
   }
+  parseGitLabHttpSource(source) {
+    if (!source.startsWith("https://gitlab.com/") && !source.startsWith("http://gitlab.com/")) {
+      return null;
+    }
+    try {
+      const parsedUrl = new URL(source);
+      const segments = parsedUrl.pathname.replace(/\/+$/, "").split("/").filter(Boolean);
+      const dashIndex = segments.indexOf("-");
+      const repoBoundary = dashIndex >= 0 ? dashIndex : segments.length;
+      if (repoBoundary < 2) {
+        return null;
+      }
+      const repo = segments[repoBoundary - 1];
+      const owner = segments.slice(0, repoBoundary - 1).join("/");
+      if (!owner || !repo) {
+        return null;
+      }
+      let subpath;
+      if (dashIndex >= 0) {
+        const marker = segments[dashIndex + 1];
+        if ((marker === "tree" || marker === "blob") && segments.length > dashIndex + 3) {
+          subpath = segments.slice(dashIndex + 3).join("/");
+        }
+      }
+      return {
+        type: "gitlab",
+        url: `https://gitlab.com/${owner}/${repo}.git`,
+        owner,
+        repo,
+        ...subpath ? { subpath } : {}
+      };
+    } catch {
+      return null;
+    }
+  }
+  parseBitbucketHttpSource(source) {
+    if (!source.startsWith("https://bitbucket.org/") && !source.startsWith("http://bitbucket.org/")) {
+      return null;
+    }
+    try {
+      const parsedUrl = new URL(source);
+      const segments = parsedUrl.pathname.replace(/\/+$/, "").split("/").filter(Boolean);
+      if (segments.length < 2) {
+        return null;
+      }
+      const [owner, repo, marker, _commitish, ...rest] = segments;
+      if (!owner || !repo) {
+        return null;
+      }
+      let subpath;
+      if (marker === "src" && rest.length > 0) {
+        subpath = rest.join("/");
+      }
+      return {
+        type: "bitbucket",
+        url: `https://bitbucket.org/${owner}/${repo}.git`,
+        owner,
+        repo,
+        ...subpath ? { subpath } : {}
+      };
+    } catch {
+      return null;
+    }
+  }
+  parseHttpRepositorySource(source) {
+    return this.parseGitHubHttpSource(source) || this.parseGitLabHttpSource(source) || this.parseBitbucketHttpSource(source);
+  }
+  parseSshRepositorySource(source) {
+    const githubMatch = source.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (githubMatch) {
+      const [, owner, repo] = githubMatch;
+      return {
+        type: "github",
+        url: `git@github.com:${owner}/${repo}.git`,
+        owner,
+        repo
+      };
+    }
+    const gitlabMatch = source.match(/^git@gitlab\.com:(.+)\/([^/]+?)(?:\.git)?$/);
+    if (gitlabMatch) {
+      const [, owner, repo] = gitlabMatch;
+      return {
+        type: "gitlab",
+        url: `git@gitlab.com:${owner}/${repo}.git`,
+        owner,
+        repo
+      };
+    }
+    const bitbucketMatch = source.match(/^git@bitbucket\.org:([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (bitbucketMatch) {
+      const [, owner, repo] = bitbucketMatch;
+      return {
+        type: "bitbucket",
+        url: `git@bitbucket.org:${owner}/${repo}.git`,
+        owner,
+        repo
+      };
+    }
+    return null;
+  }
   parseGitHubShorthandSource(source) {
     const githubShorthandMatch = source.match(/^([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+)(?:\/(.+))?$/);
     if (!githubShorthandMatch) {
@@ -18687,6 +19395,50 @@ class SkillsManager {
       ...subpath ? { subpath } : {}
     };
   }
+  parseGitLabShorthandSource(source) {
+    const normalized = source.startsWith("gitlab:") ? source.slice("gitlab:".length) : source.startsWith("gitlab.com/") ? source.slice("gitlab.com/".length) : null;
+    if (!normalized) {
+      return null;
+    }
+    const [repoSpec = normalized, subpathSpec] = normalized.split("//", 2);
+    const segments = repoSpec.split("/").filter(Boolean);
+    if (segments.length < 2) {
+      return null;
+    }
+    const repo = segments[segments.length - 1];
+    const owner = segments.slice(0, segments.length - 1).join("/");
+    if (!owner || !repo) {
+      return null;
+    }
+    return {
+      type: "gitlab",
+      url: `https://gitlab.com/${owner}/${repo}.git`,
+      owner,
+      repo,
+      ...subpathSpec ? { subpath: subpathSpec } : {}
+    };
+  }
+  parseBitbucketShorthandSource(source) {
+    const normalized = source.startsWith("bitbucket:") ? source.slice("bitbucket:".length) : source.startsWith("bitbucket.org/") ? source.slice("bitbucket.org/".length) : null;
+    if (!normalized) {
+      return null;
+    }
+    const segments = normalized.split("/").filter(Boolean);
+    if (segments.length < 2) {
+      return null;
+    }
+    const [owner, repo, ...rest] = segments;
+    if (!owner || !repo) {
+      return null;
+    }
+    return {
+      type: "bitbucket",
+      url: `https://bitbucket.org/${owner}/${repo}.git`,
+      owner,
+      repo,
+      ...rest.length > 0 ? { subpath: rest.join("/") } : {}
+    };
+  }
   async parseSkillMd(filePath) {
     const content = await readFileIfExists(filePath);
     if (!content)
@@ -18705,34 +19457,34 @@ class SkillsManager {
     const skills2 = [];
     const seen = new Set;
     for (const searchDir of SKILL_SEARCH_DIRS) {
-      const fullDir = resolve8(repoPath, searchDir);
+      const fullDir = resolve9(repoPath, searchDir);
       if (!await fileExists(fullDir))
         continue;
-      const directSkillMd = join5(fullDir, "SKILL.md");
+      const directSkillMd = join7(fullDir, "SKILL.md");
       if (await fileExists(directSkillMd)) {
         const parsed = await this.parseSkillMd(directSkillMd);
         if (parsed && !seen.has(parsed.name)) {
           seen.add(parsed.name);
-          skills2.push({ ...parsed, path: resolve8(fullDir) });
+          skills2.push({ ...parsed, path: resolve9(fullDir) });
         }
       }
-      const directSkillMdLower = join5(fullDir, "skill.md");
+      const directSkillMdLower = join7(fullDir, "skill.md");
       if (await fileExists(directSkillMdLower)) {
         const parsed = await this.parseSkillMd(directSkillMdLower);
         if (parsed && !seen.has(parsed.name)) {
           seen.add(parsed.name);
-          skills2.push({ ...parsed, path: resolve8(fullDir) });
+          skills2.push({ ...parsed, path: resolve9(fullDir) });
         }
       }
       if (!await isDirectory(fullDir))
         continue;
       const entries = await listFiles(fullDir);
       for (const entry of entries) {
-        const entryPath = join5(fullDir, entry);
+        const entryPath = join7(fullDir, entry);
         if (!await isDirectory(entryPath))
           continue;
-        const skillMdPath = join5(entryPath, "SKILL.md");
-        const skillMdPathLower = join5(entryPath, "skill.md");
+        const skillMdPath = join7(entryPath, "SKILL.md");
+        const skillMdPathLower = join7(entryPath, "skill.md");
         const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
         if (!skillFile)
           continue;
@@ -18746,14 +19498,14 @@ class SkillsManager {
     return skills2;
   }
   async cloneRepo(url) {
-    const tempDir = await fs24.mkdtemp(join5(tmpdir(), "agentinit-skills-"));
-    await fs24.rm(tempDir, { recursive: true, force: true });
+    const tempDir = await fs27.mkdtemp(join7(tmpdir(), "agentinit-skills-"));
+    await fs27.rm(tempDir, { recursive: true, force: true });
     try {
       await execFileAsync("git", ["clone", "--depth", "1", url, tempDir], {
         timeout: 60000
       });
     } catch (error) {
-      await fs24.rm(tempDir, { recursive: true, force: true }).catch(() => {
+      await fs27.rm(tempDir, { recursive: true, force: true }).catch(() => {
       });
       throw new Error(`Failed to clone ${url}: ${error.message}`);
     }
@@ -18811,15 +19563,15 @@ class SkillsManager {
     if (!tempDir) {
       return;
     }
-    await fs24.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    await fs27.rm(tempDir, { recursive: true, force: true }).catch(() => {
     });
   }
   async resolveDiscoveryRoot(repoPath, source, sourceLabel) {
-    const resolvedRepoPath = resolve8(repoPath);
-    if (source.type !== "github" || !source.subpath) {
+    const resolvedRepoPath = resolve9(repoPath);
+    if (source.type !== "github" && source.type !== "gitlab" && source.type !== "bitbucket" || !source.subpath) {
       return resolvedRepoPath;
     }
-    const discoveryRoot = resolve8(resolvedRepoPath, source.subpath);
+    const discoveryRoot = resolve9(resolvedRepoPath, source.subpath);
     if (!this.isWithinPath(resolvedRepoPath, discoveryRoot)) {
       throw new Error(`Invalid GitHub source path "${source.subpath}" in ${sourceLabel}`);
     }
@@ -18837,7 +19589,7 @@ class SkillsManager {
       return realDiscoveryRoot;
     }
     if (basename3(realDiscoveryRoot).toLowerCase() === "skill.md") {
-      return dirname3(realDiscoveryRoot);
+      return dirname4(realDiscoveryRoot);
     }
     throw new Error(`GitHub source must reference a skill directory or SKILL.md: ${sourceLabel}`);
   }
@@ -18861,14 +19613,14 @@ class SkillsManager {
         };
       }
       let repoPath;
-      if (resolved.type === "github") {
+      if (resolved.type === "github" || resolved.type === "gitlab" || resolved.type === "bitbucket") {
         if (!resolved.url) {
           throw new Error(`Invalid source: ${source}`);
         }
         tempDir = await this.cloneRepo(resolved.url);
         repoPath = tempDir;
       } else {
-        repoPath = resolve8(resolved.path || source);
+        repoPath = resolve9(resolved.path || source);
         if (!await fileExists(repoPath)) {
           throw this.getMissingLocalPathError(source, repoPath);
         }
@@ -18955,30 +19707,30 @@ class SkillsManager {
   async installSkill(skillPath, skillName, targetDir, copy = false) {
     const normalizedSkillName = this.normalizeSkillName(skillName);
     const destPath = this.resolveInstallPath(targetDir, normalizedSkillName);
-    await fs24.mkdir(resolve8(targetDir), { recursive: true });
+    await fs27.mkdir(resolve9(targetDir), { recursive: true });
     if (await fileExists(destPath)) {
-      await fs24.rm(destPath, { recursive: true, force: true });
+      await fs27.rm(destPath, { recursive: true, force: true });
     }
     if (copy) {
       await this.copyDir(skillPath, destPath);
     } else {
-      await fs24.symlink(skillPath, destPath, "dir");
+      await fs27.symlink(skillPath, destPath, "dir");
     }
     return destPath;
   }
   async installSkillFromContent(skillName, skillContent, targetDir) {
     const normalizedSkillName = this.normalizeSkillName(skillName);
     const destPath = this.resolveInstallPath(targetDir, normalizedSkillName);
-    await fs24.mkdir(resolve8(targetDir), { recursive: true });
+    await fs27.mkdir(resolve9(targetDir), { recursive: true });
     if (await fileExists(destPath)) {
-      await fs24.rm(destPath, { recursive: true, force: true });
+      await fs27.rm(destPath, { recursive: true, force: true });
     }
-    await fs24.mkdir(destPath, { recursive: true });
-    await fs24.writeFile(join5(destPath, "SKILL.md"), skillContent, "utf8");
+    await fs27.mkdir(destPath, { recursive: true });
+    await fs27.writeFile(join7(destPath, "SKILL.md"), skillContent, "utf8");
     return destPath;
   }
   getCanonicalSkillsDir(projectPath, global3 = false) {
-    return global3 ? resolve8(homedir5(), ".agents/skills") : resolve8(projectPath, ".agents/skills");
+    return global3 ? resolve9(homedir6(), ".agents/skills") : resolve9(projectPath, ".agents/skills");
   }
   async getInstallPlan(skillName, agent, projectPath, options2 = {}) {
     const normalizedSkillName = this.normalizeSkillName(skillName);
@@ -19021,7 +19773,7 @@ class SkillsManager {
       ...options2.global !== undefined ? { global: options2.global } : {},
       ...options2.copy !== undefined ? { copy: options2.copy } : {}
     });
-    return this.compareSkillSnapshot(skill, plan.canonicalPath || plan.path);
+    return this.compareSkillInstallStatus(skill, plan);
   }
   async installSkillForAgent(skillPath, skillName, agent, projectPath, options2 = {}) {
     const plan = await this.getInstallPlan(skillName, agent, projectPath, options2);
@@ -19068,7 +19820,7 @@ class SkillsManager {
       throw new Error(`Missing canonical path for ${skillName}`);
     }
     await this.cleanAndCreateDirectory(canonicalPath);
-    await fs24.writeFile(join5(canonicalPath, "SKILL.md"), skillContent, "utf8");
+    await fs27.writeFile(join7(canonicalPath, "SKILL.md"), skillContent, "utf8");
     if (plan.path === canonicalPath) {
       return plan;
     }
@@ -19091,7 +19843,7 @@ class SkillsManager {
   async installSkillFromContentToCanonicalStore(skillName, skillContent, projectPath, options2 = {}) {
     const plan = this.getCanonicalInstallPlan(skillName, projectPath, options2);
     await this.cleanAndCreateDirectory(plan.path);
-    await fs24.writeFile(join5(plan.path, "SKILL.md"), skillContent, "utf8");
+    await fs27.writeFile(join7(plan.path, "SKILL.md"), skillContent, "utf8");
     return plan;
   }
   getCanonicalInstallPlan(skillName, projectPath, options2 = {}) {
@@ -19103,6 +19855,76 @@ class SkillsManager {
       mode: "symlink"
     };
   }
+  normalizeSkillPrefix(prefix) {
+    const normalized = prefix?.trim() ?? "";
+    if (normalized.includes("/") || normalized.includes("\\")) {
+      throw new Error(`Invalid skill prefix: ${prefix}`);
+    }
+    return normalized;
+  }
+  withSkillPrefix(skillName, prefix) {
+    const normalizedPrefix = this.normalizeSkillPrefix(prefix);
+    return normalizedPrefix ? `${normalizedPrefix}${skillName}` : skillName;
+  }
+  async rewriteSkillFileName(filePath, skillName) {
+    const content = await fs27.readFile(filePath, "utf8");
+    const parsed = import_gray_matter2.default(content);
+    const nextContent = import_gray_matter2.default.stringify(parsed.content, {
+      ...parsed.data,
+      name: skillName
+    });
+    await fs27.writeFile(filePath, nextContent, "utf8");
+  }
+  async applyPrefixToSkills(skills2, prefix) {
+    const normalizedPrefix = this.normalizeSkillPrefix(prefix);
+    if (!normalizedPrefix) {
+      return { skills: skills2, cleanup: async () => {
+      } };
+    }
+    const tempDirs = [];
+    try {
+      const prefixedSkills = await Promise.all(skills2.map(async (skill) => {
+        const name = this.withSkillPrefix(skill.name, normalizedPrefix);
+        if (skill.generatedContent) {
+          return {
+            ...skill,
+            name,
+            generatedContent: import_gray_matter2.default.stringify(import_gray_matter2.default(skill.generatedContent).content, {
+              ...import_gray_matter2.default(skill.generatedContent).data,
+              name
+            })
+          };
+        }
+        const tempRoot = await fs27.mkdtemp(join7(tmpdir(), "agentinit-prefixed-skill-"));
+        const tempSkillPath = join7(tempRoot, basename3(skill.path));
+        tempDirs.push(tempRoot);
+        await this.copyDir(skill.path, tempSkillPath);
+        const skillMdPath = join7(tempSkillPath, "SKILL.md");
+        const skillMdPathLower = join7(tempSkillPath, "skill.md");
+        const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
+        if (!skillFile) {
+          throw new Error(`Skill "${skill.name}" is missing SKILL.md`);
+        }
+        await this.rewriteSkillFileName(skillFile, name);
+        return {
+          ...skill,
+          name,
+          path: tempSkillPath
+        };
+      }));
+      return {
+        skills: prefixedSkills,
+        cleanup: async () => {
+          await Promise.all(tempDirs.map((dir) => fs27.rm(dir, { recursive: true, force: true }).catch(() => {
+          })));
+        }
+      };
+    } catch (error) {
+      await Promise.all(tempDirs.map((dir) => fs27.rm(dir, { recursive: true, force: true }).catch(() => {
+      })));
+      throw error;
+    }
+  }
   normalizeSkillName(skillName) {
     const normalized = skillName.trim();
     if (!normalized) {
@@ -19114,9 +19936,9 @@ class SkillsManager {
     return normalized;
   }
   resolveInstallPath(targetDir, skillName) {
-    const resolvedTargetDir = resolve8(targetDir);
-    const destPath = resolve8(resolvedTargetDir, skillName);
-    const relativePath = relative3(resolvedTargetDir, destPath);
+    const resolvedTargetDir = resolve9(targetDir);
+    const destPath = resolve9(resolvedTargetDir, skillName);
+    const relativePath = relative4(resolvedTargetDir, destPath);
     if (relativePath === "" || relativePath.startsWith("..") || relativePath.includes("/../") || relativePath.includes("\\..\\")) {
       throw new Error(`Refusing to install skill outside target directory: ${skillName}`);
     }
@@ -19133,18 +19955,18 @@ class SkillsManager {
   async createDirectorySnapshot(rootPath) {
     if (!await fileExists(rootPath))
       return null;
-    const hash = createHash("sha256");
+    const hash = createHash2("sha256");
     const walk = async (currentPath, relativePath) => {
-      const stat = await fs24.stat(currentPath);
+      const stat = await fs27.stat(currentPath);
       if (!stat.isDirectory()) {
-        const content = await fs24.readFile(currentPath);
+        const content = await fs27.readFile(currentPath);
         this.updateSnapshotWithFile(hash, relativePath, content);
         return;
       }
       hash.update(`dir:${relativePath || "."}\n`);
-      const entries = (await fs24.readdir(currentPath)).sort((left, right) => left.localeCompare(right));
+      const entries = (await fs27.readdir(currentPath)).sort((left, right) => left.localeCompare(right));
       for (const entry of entries) {
-        await walk(join5(currentPath, entry), relativePath ? join5(relativePath, entry) : entry);
+        await walk(join7(currentPath, entry), relativePath ? join7(relativePath, entry) : entry);
       }
     };
     await walk(rootPath, "");
@@ -19155,7 +19977,7 @@ class SkillsManager {
   }
   async getNewSkillSnapshot(skill) {
     if (skill.generatedContent) {
-      const hash = createHash("sha256");
+      const hash = createHash2("sha256");
       hash.update("dir:.\n");
       this.updateSnapshotWithFile(hash, "SKILL.md", skill.generatedContent.trim());
       return hash.digest("hex");
@@ -19171,23 +19993,43 @@ class SkillsManager {
       return "new";
     return existing === incoming ? "unchanged" : "changed";
   }
+  async compareSkillInstallStatus(skill, plan) {
+    const incoming = await this.getNewSkillSnapshot(skill);
+    if (incoming === null)
+      return "new";
+    const existingAtTarget = await this.readExistingSkillSnapshot(plan.path);
+    if (existingAtTarget !== null) {
+      return existingAtTarget === incoming ? "unchanged" : "changed";
+    }
+    if (!plan.canonicalPath || plan.canonicalPath === plan.path) {
+      return "new";
+    }
+    const existingAtCanonical = await this.readExistingSkillSnapshot(plan.canonicalPath);
+    if (existingAtCanonical === null) {
+      return "new";
+    }
+    return existingAtCanonical === incoming ? "new" : "changed";
+  }
   async cleanAndCreateDirectory(path) {
-    await fs24.rm(path, { recursive: true, force: true }).catch(() => {
+    await fs27.rm(path, { recursive: true, force: true }).catch(() => {
     });
-    await fs24.mkdir(path, { recursive: true });
+    await fs27.mkdir(path, { recursive: true });
   }
   isWithinPath(basePath, targetPath) {
-    const relativePath = relative3(resolve8(basePath), resolve8(targetPath));
+    const relativePath = relative4(resolve9(basePath), resolve9(targetPath));
     return relativePath === "" || !relativePath.startsWith("..") && !relativePath.includes("/../") && !relativePath.includes("\\..\\");
   }
   async copyDir(src, dest) {
-    await fs24.cp(src, dest, { recursive: true, dereference: true });
+    await fs27.cp(src, dest, { recursive: true, dereference: true });
   }
   async addFromSource(source, projectPath, options2 = {}) {
+    const normalizedPrefix = this.normalizeSkillPrefix(options2.prefix);
     const context = this.takePreparedSourceContext(source, projectPath, options2.from) || await this.loadDiscoveredSkillsContext(source, projectPath, {
       ...options2.from !== undefined ? { from: options2.from } : {},
       ...options2.pluginName !== undefined ? { pluginName: options2.pluginName } : {}
     });
+    let prefixedCleanup = async () => {
+    };
     try {
       let skills2 = context.skills;
       if (skills2.length === 0) {
@@ -19195,7 +20037,34 @@ class SkillsManager {
       }
       if (options2.skills && options2.skills.length > 0) {
         const names = new Set(options2.skills.map((skill) => skill.toLowerCase()));
-        skills2 = skills2.filter((skill) => names.has(skill.name.toLowerCase()));
+        skills2 = skills2.filter((skill) => names.has(skill.name.toLowerCase()) || names.has(this.withSkillPrefix(skill.name, normalizedPrefix).toLowerCase()));
+      }
+      const prefixed = await this.applyPrefixToSkills(skills2, normalizedPrefix);
+      skills2 = prefixed.skills;
+      prefixedCleanup = prefixed.cleanup;
+      const result = { installed: [], updated: [], unchanged: [], skipped: [], warnings: [...context.warnings] };
+      if (options2.scan !== false) {
+        const scannedWarnings = new Set;
+        const scannableSkills = [];
+        for (const skill of skills2) {
+          const scan = await this.skillScanner.scanSkill(skill);
+          if (scan.findings.length === 0) {
+            scannableSkills.push(skill);
+            continue;
+          }
+          if (scan.blocked && !options2.allowRisky) {
+            result.skipped.push({
+              skill,
+              reason: this.skillScanner.formatBlockingReason(scan)
+            });
+            continue;
+          }
+          const summary = this.skillScanner.formatShortSummary(scan);
+          scannedWarnings.add(scan.blocked ? `Proceeding with "${skill.name}" despite high-risk findings: ${summary}` : `Security warnings for "${skill.name}": ${summary}`);
+          scannableSkills.push(skill);
+        }
+        skills2 = scannableSkills;
+        result.warnings.push(...scannedWarnings);
       }
       const installToSharedStore = options2.agents?.includes(SHARED_SKILLS_TARGET_ID) ?? false;
       const agents = await this.getTargetAgents(projectPath, options2);
@@ -19204,11 +20073,13 @@ class SkillsManager {
           installed: [],
           updated: [],
           unchanged: [],
-          skipped: skills2.map((skill) => ({ skill, reason: "No target agents found" })),
-          warnings: context.warnings
+          skipped: [
+            ...result.skipped,
+            ...skills2.map((skill) => ({ skill, reason: "No target agents found" }))
+          ],
+          warnings: result.warnings
         };
       }
-      const result = { installed: [], updated: [], unchanged: [], skipped: [], warnings: context.warnings };
       const installableAgents = [];
       const comparisonCache = new Map;
       const pendingUpdates = [];
@@ -19260,10 +20131,10 @@ class SkillsManager {
               ...options2.copy !== undefined ? { copy: options2.copy } : {}
             };
             const plan = await this.getInstallPlan(skill.name, agent, projectPath, installOptions);
-            const comparisonPath = plan.canonicalPath || plan.path;
+            const comparisonPath = plan.path;
             let comparison = comparisonCache.get(comparisonPath);
             if (comparison === undefined) {
-              comparison = await this.compareSkillSnapshot(skill, comparisonPath);
+              comparison = await this.compareSkillInstallStatus(skill, plan);
               comparisonCache.set(comparisonPath, comparison);
             }
             if (comparison === "unchanged") {
@@ -19310,8 +20181,47 @@ class SkillsManager {
           }
         }
       }
+      try {
+        const lock = new InstallLock;
+        const fromOption = options2.from;
+        const { source: resolvedSource } = this.resolveSourceRequest(source, ...fromOption ? [{ from: fromOption }] : []);
+        const lockSource = {
+          type: resolvedSource.type,
+          ...resolvedSource.marketplace ? { marketplace: resolvedSource.marketplace } : {},
+          ...resolvedSource.pluginName ? { pluginName: resolvedSource.pluginName } : {},
+          ...normalizedPrefix ? { prefix: normalizedPrefix } : {},
+          ...resolvedSource.url ? { url: resolvedSource.url } : {},
+          ...resolvedSource.path ? { path: resolve9(projectPath, expandTilde(resolvedSource.path)) } : {},
+          ...resolvedSource.owner ? { owner: resolvedSource.owner } : {},
+          ...resolvedSource.repo ? { repo: resolvedSource.repo } : {},
+          ...resolvedSource.subpath ? { subpath: resolvedSource.subpath } : {}
+        };
+        const recordEntries = async (entries, action) => {
+          for (const entry of entries) {
+            const hashPath = entry.canonicalPath || entry.path;
+            const contentHash = await hashDirectory(hashPath);
+            await lock.recordSkill({
+              action,
+              name: entry.skill.name,
+              projectPath: resolve9(projectPath),
+              agents: [entry.agent],
+              scope: options2.global ? "global" : "project",
+              source: lockSource,
+              installPath: entry.path,
+              mode: entry.mode,
+              ...entry.canonicalPath ? { canonicalPath: entry.canonicalPath } : {},
+              ...contentHash ? { contentHash } : {}
+            });
+          }
+        };
+        await recordEntries(result.installed, "install");
+        await recordEntries(result.updated, "update");
+      } catch (error) {
+        logLockWriteWarning("Skills changed successfully", error);
+      }
       return result;
     } finally {
+      await prefixedCleanup();
       await context.cleanup();
     }
   }
@@ -19334,11 +20244,11 @@ class SkillsManager {
           continue;
         const entries = await listFiles(dir);
         for (const entry of entries) {
-          const entryPath = join5(dir, entry);
+          const entryPath = join7(dir, entry);
           if (!await isDirectory(entryPath))
             continue;
-          const skillMdPath = join5(entryPath, "SKILL.md");
-          const skillMdPathLower = join5(entryPath, "skill.md");
+          const skillMdPath = join7(entryPath, "SKILL.md");
+          const skillMdPathLower = join7(entryPath, "skill.md");
           const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
           if (!skillFile)
             continue;
@@ -19348,7 +20258,7 @@ class SkillsManager {
           let isSymlink = false;
           let canonicalPath;
           try {
-            const stat = await fs24.lstat(entryPath);
+            const stat = await fs27.lstat(entryPath);
             isSymlink = stat.isSymbolicLink();
             const canonicalBase = this.getCanonicalSkillsDir(projectPath, scope === "global");
             const [resolvedEntryPath, resolvedCanonicalBase] = await Promise.all([
@@ -19358,7 +20268,7 @@ class SkillsManager {
             if (this.isWithinPath(resolvedCanonicalBase, resolvedEntryPath)) {
               canonicalPath = resolvedEntryPath;
             } else if (this.isWithinPath(canonicalBase, entryPath)) {
-              canonicalPath = resolve8(entryPath);
+              canonicalPath = resolve9(entryPath);
             }
           } catch {
           }
@@ -19378,21 +20288,21 @@ class SkillsManager {
     const includeSharedTarget = !options2.agents || options2.agents.includes(SHARED_SKILLS_TARGET_ID);
     if (includeSharedTarget) {
       const scopes = options2.global ? ["global"] : ["project", "global"];
-      const referencedCanonicalPaths = new Set(installed.map((entry) => entry.canonicalPath).filter((value) => !!value).map((value) => resolve8(value)));
+      const referencedCanonicalPaths = new Set(installed.map((entry) => entry.canonicalPath).filter((value) => !!value).map((value) => resolve9(value)));
       for (const scope of scopes) {
         const canonicalDir = this.getCanonicalSkillsDir(projectPath, scope === "global");
         if (!await fileExists(canonicalDir))
           continue;
         const entries = await listFiles(canonicalDir);
         for (const entry of entries) {
-          const entryPath = join5(canonicalDir, entry);
+          const entryPath = join7(canonicalDir, entry);
           if (!await isDirectory(entryPath))
             continue;
-          const resolvedEntryPath = resolve8(entryPath);
+          const resolvedEntryPath = resolve9(entryPath);
           if (referencedCanonicalPaths.has(resolvedEntryPath))
             continue;
-          const skillMdPath = join5(entryPath, "SKILL.md");
-          const skillMdPathLower = join5(entryPath, "skill.md");
+          const skillMdPath = join7(entryPath, "SKILL.md");
+          const skillMdPathLower = join7(entryPath, "skill.md");
           const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
           if (!skillFile)
             continue;
@@ -19459,7 +20369,7 @@ class SkillsManager {
       }
       if (!removedPaths.has(entry.path)) {
         try {
-          await fs24.rm(entry.path, { recursive: true, force: true });
+          await fs27.rm(entry.path, { recursive: true, force: true });
           removedPaths.add(entry.path);
         } catch {
           skipped.push({
@@ -19472,7 +20382,7 @@ class SkillsManager {
       if (entry.canonicalPath && entry.canonicalPath !== entry.path && !removedCanonicalPaths.has(entry.canonicalPath)) {
         const stillReferenced = remainingEntries.some((other) => other.name.toLowerCase() === entry.name.toLowerCase() && other.canonicalPath === entry.canonicalPath);
         if (!stillReferenced) {
-          await fs24.rm(entry.canonicalPath, { recursive: true, force: true }).catch(() => {
+          await fs27.rm(entry.canonicalPath, { recursive: true, force: true }).catch(() => {
           });
           removedCanonicalPaths.add(entry.canonicalPath);
         }
@@ -19485,6 +20395,29 @@ class SkillsManager {
         notFound.push(name);
       }
     }
+    try {
+      if (targetedEntries.length > 0) {
+        const lock = new InstallLock;
+        for (const entry of targetedEntries) {
+          const entryKey = `${entry.agent}:${entry.name}`;
+          if (!removed.includes(entryKey))
+            continue;
+          await lock.recordSkill({
+            action: "remove",
+            name: entry.name,
+            projectPath: resolve9(projectPath),
+            agents: [entry.agent],
+            scope: entry.scope,
+            source: { type: "local", path: entry.path },
+            installPath: entry.path,
+            mode: entry.mode,
+            ...entry.canonicalPath ? { canonicalPath: entry.canonicalPath } : {}
+          });
+        }
+      }
+    } catch (error) {
+      logLockWriteWarning("Skills removed successfully", error);
+    }
     return { removed, notFound, skipped };
   }
 }
@@ -19492,9 +20425,12 @@ var import_gray_matter2, execFileAsync, DEFAULT_SKILLS_CATALOG, SKILL_SEARCH_DIR
 var init_skillsManager = __esm(() => {
   import_gray_matter2 = __toESM(require_gray_matter(), 1);
   init_fs();
+  init_paths();
   init_agentManager();
   init_marketplaceRegistry();
+  init_skillSecurityScanner();
   init_skills();
+  init_installLock();
   execFileAsync = promisify(execFile);
   DEFAULT_SKILLS_CATALOG = {
     owner: "vercel-labs",
@@ -20378,51 +21314,51 @@ var require_uri_all = __commonJS((exports, module) => {
       }
       return uriTokens.join("");
     }
-    function resolveComponents(base2, relative6) {
+    function resolveComponents(base2, relative7) {
       var options2 = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
       var skipNormalization = arguments[3];
       var target = {};
       if (!skipNormalization) {
         base2 = parse4(serialize(base2, options2), options2);
-        relative6 = parse4(serialize(relative6, options2), options2);
+        relative7 = parse4(serialize(relative7, options2), options2);
       }
       options2 = options2 || {};
-      if (!options2.tolerant && relative6.scheme) {
-        target.scheme = relative6.scheme;
-        target.userinfo = relative6.userinfo;
-        target.host = relative6.host;
-        target.port = relative6.port;
-        target.path = removeDotSegments(relative6.path || "");
-        target.query = relative6.query;
+      if (!options2.tolerant && relative7.scheme) {
+        target.scheme = relative7.scheme;
+        target.userinfo = relative7.userinfo;
+        target.host = relative7.host;
+        target.port = relative7.port;
+        target.path = removeDotSegments(relative7.path || "");
+        target.query = relative7.query;
       } else {
-        if (relative6.userinfo !== undefined || relative6.host !== undefined || relative6.port !== undefined) {
-          target.userinfo = relative6.userinfo;
-          target.host = relative6.host;
-          target.port = relative6.port;
-          target.path = removeDotSegments(relative6.path || "");
-          target.query = relative6.query;
+        if (relative7.userinfo !== undefined || relative7.host !== undefined || relative7.port !== undefined) {
+          target.userinfo = relative7.userinfo;
+          target.host = relative7.host;
+          target.port = relative7.port;
+          target.path = removeDotSegments(relative7.path || "");
+          target.query = relative7.query;
         } else {
-          if (!relative6.path) {
+          if (!relative7.path) {
             target.path = base2.path;
-            if (relative6.query !== undefined) {
-              target.query = relative6.query;
+            if (relative7.query !== undefined) {
+              target.query = relative7.query;
             } else {
               target.query = base2.query;
             }
           } else {
-            if (relative6.path.charAt(0) === "/") {
-              target.path = removeDotSegments(relative6.path);
+            if (relative7.path.charAt(0) === "/") {
+              target.path = removeDotSegments(relative7.path);
             } else {
               if ((base2.userinfo !== undefined || base2.host !== undefined || base2.port !== undefined) && !base2.path) {
-                target.path = "/" + relative6.path;
+                target.path = "/" + relative7.path;
               } else if (!base2.path) {
-                target.path = relative6.path;
+                target.path = relative7.path;
               } else {
-                target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative6.path;
+                target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative7.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative6.query;
+            target.query = relative7.query;
           }
           target.userinfo = base2.userinfo;
           target.host = base2.host;
@@ -20430,10 +21366,10 @@ var require_uri_all = __commonJS((exports, module) => {
         }
         target.scheme = base2.scheme;
       }
-      target.fragment = relative6.fragment;
+      target.fragment = relative7.fragment;
       return target;
     }
-    function resolve12(baseURI, relativeURI, options2) {
+    function resolve13(baseURI, relativeURI, options2) {
       var schemelessOptions = assign({ scheme: "null" }, options2);
       return serialize(resolveComponents(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true), schemelessOptions);
     }
@@ -20701,7 +21637,7 @@ var require_uri_all = __commonJS((exports, module) => {
     exports2.removeDotSegments = removeDotSegments;
     exports2.serialize = serialize;
     exports2.resolveComponents = resolveComponents;
-    exports2.resolve = resolve12;
+    exports2.resolve = resolve13;
     exports2.normalize = normalize;
     exports2.equal = equal;
     exports2.escapeComponent = escapeComponent;
@@ -20887,7 +21823,7 @@ var require_util3 = __commonJS((exports, module) => {
     var path = jsonPointers ? toQuotedString("/" + escapeJsonPointer(prop)) : toQuotedString(getProperty(prop));
     return joinPaths(currentPath, path);
   };
-  var getData = function($data, lvl, paths5) {
+  var getData = function($data, lvl, paths6) {
     var up, jsonPointer, data, matches;
     if ($data === "")
       return "rootData";
@@ -20905,7 +21841,7 @@ var require_util3 = __commonJS((exports, module) => {
       if (jsonPointer == "#") {
         if (up >= lvl)
           throw new Error("Cannot access property/index " + up + " levels up, current level is " + lvl);
-        return paths5[lvl - up];
+        return paths6[lvl - up];
       }
       if (up > lvl)
         throw new Error("Cannot access data " + up + " levels up, current level is " + lvl);
@@ -21064,13 +22000,13 @@ var require_json_schema_traverse = __commonJS((exports, module) => {
 
 // node_modules/ajv/lib/compile/resolve.js
 var require_resolve = __commonJS((exports, module) => {
-  var resolve12 = function(compile, root, ref) {
+  var resolve13 = function(compile, root, ref) {
     var refVal = this._refs[ref];
     if (typeof refVal == "string") {
       if (this._refs[refVal])
         refVal = this._refs[refVal];
       else
-        return resolve12.call(this, compile, root, refVal);
+        return resolve13.call(this, compile, root, refVal);
     }
     refVal = refVal || this._schemas[ref];
     if (refVal instanceof SchemaObject) {
@@ -21275,13 +22211,13 @@ var require_resolve = __commonJS((exports, module) => {
   var util6 = require_util3();
   var SchemaObject = require_schema_obj();
   var traverse = require_json_schema_traverse();
-  module.exports = resolve12;
-  resolve12.normalizeId = normalizeId;
-  resolve12.fullPath = getFullPath;
-  resolve12.url = resolveUrl;
-  resolve12.ids = resolveIds;
-  resolve12.inlineRef = inlineRef;
-  resolve12.schema = resolveSchema;
+  module.exports = resolve13;
+  resolve13.normalizeId = normalizeId;
+  resolve13.fullPath = getFullPath;
+  resolve13.url = resolveUrl;
+  resolve13.ids = resolveIds;
+  resolve13.inlineRef = inlineRef;
+  resolve13.schema = resolveSchema;
   var PREVENT_SCOPE_CHANGE = util6.toHash(["properties", "patternProperties", "enum", "dependencies", "definitions"]);
   var SIMPLE_INLINED = util6.toHash([
     "type",
@@ -21312,15 +22248,15 @@ var require_error_classes = __commonJS((exports, module) => {
   };
   var MissingRefError = function(baseId, ref, message) {
     this.message = message || MissingRefError.message(baseId, ref);
-    this.missingRef = resolve12.url(baseId, ref);
-    this.missingSchema = resolve12.normalizeId(resolve12.fullPath(this.missingRef));
+    this.missingRef = resolve13.url(baseId, ref);
+    this.missingSchema = resolve13.normalizeId(resolve13.fullPath(this.missingRef));
   };
   var errorSubclass = function(Subclass) {
     Subclass.prototype = Object.create(Error.prototype);
     Subclass.prototype.constructor = Subclass;
     return Subclass;
   };
-  var resolve12 = require_resolve();
+  var resolve13 = require_resolve();
   module.exports = {
     Validation: errorSubclass(ValidationError),
     MissingRef: errorSubclass(MissingRefError)
@@ -21914,7 +22850,7 @@ var require_compile = __commonJS((exports, module) => {
         RULES,
         validate: validateGenerator,
         util: util6,
-        resolve: resolve12,
+        resolve: resolve13,
         resolveRef,
         usePattern,
         useDefault,
@@ -21953,7 +22889,7 @@ var require_compile = __commonJS((exports, module) => {
       return validate2;
     }
     function resolveRef(baseId2, ref, isRoot) {
-      ref = resolve12.url(baseId2, ref);
+      ref = resolve13.url(baseId2, ref);
       var refIndex = refs[ref];
       var _refVal, refCode;
       if (refIndex !== undefined) {
@@ -21970,11 +22906,11 @@ var require_compile = __commonJS((exports, module) => {
         }
       }
       refCode = addLocalRef(ref);
-      var v2 = resolve12.call(self, localCompile, root, ref);
+      var v2 = resolve13.call(self, localCompile, root, ref);
       if (v2 === undefined) {
         var localSchema = localRefs && localRefs[ref];
         if (localSchema) {
-          v2 = resolve12.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self, localSchema, root, localRefs, baseId2);
+          v2 = resolve13.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self, localSchema, root, localRefs, baseId2);
         }
       }
       if (v2 === undefined) {
@@ -22116,7 +23052,7 @@ var require_compile = __commonJS((exports, module) => {
       code += statement(i, arr);
     return code;
   };
-  var resolve12 = require_resolve();
+  var resolve13 = require_resolve();
   var util6 = require_util3();
   var errorClasses = require_error_classes();
   var stableStringify = require_fast_json_stable_stringify();
@@ -25365,7 +26301,7 @@ var require_ajv = __commonJS((exports, module) => {
     var id = this._getId(schema2);
     if (id !== undefined && typeof id != "string")
       throw new Error("schema id must be string");
-    key = resolve12.normalizeId(key || id);
+    key = resolve13.normalizeId(key || id);
     checkUnique(this, key);
     this._schemas[key] = this._addSchema(schema2, _skipValidation, _meta, true);
     return this;
@@ -25411,7 +26347,7 @@ var require_ajv = __commonJS((exports, module) => {
     }
   };
   var _getSchemaFragment = function(self, ref) {
-    var res = resolve12.schema.call(self, { schema: {} }, ref);
+    var res = resolve13.schema.call(self, { schema: {} }, ref);
     if (res) {
       var { schema: schema2, root, baseId } = res;
       var v = compileSchema.call(self, schema2, root, undefined, baseId);
@@ -25427,7 +26363,7 @@ var require_ajv = __commonJS((exports, module) => {
     }
   };
   var _getSchemaObj = function(self, keyRef) {
-    keyRef = resolve12.normalizeId(keyRef);
+    keyRef = resolve13.normalizeId(keyRef);
     return self._schemas[keyRef] || self._refs[keyRef] || self._fragments[keyRef];
   };
   var removeSchema = function(schemaKeyRef) {
@@ -25455,7 +26391,7 @@ var require_ajv = __commonJS((exports, module) => {
         this._cache.del(cacheKey);
         var id = this._getId(schemaKeyRef);
         if (id) {
-          id = resolve12.normalizeId(id);
+          id = resolve13.normalizeId(id);
           delete this._schemas[id];
           delete this._refs[id];
         }
@@ -25480,14 +26416,14 @@ var require_ajv = __commonJS((exports, module) => {
     if (cached)
       return cached;
     shouldAddSchema = shouldAddSchema || this._opts.addUsedSchema !== false;
-    var id = resolve12.normalizeId(this._getId(schema2));
+    var id = resolve13.normalizeId(this._getId(schema2));
     if (id && shouldAddSchema)
       checkUnique(this, id);
     var willValidate = this._opts.validateSchema !== false && !skipValidation;
     var recursiveMeta;
-    if (willValidate && !(recursiveMeta = id && id == resolve12.normalizeId(schema2.$schema)))
+    if (willValidate && !(recursiveMeta = id && id == resolve13.normalizeId(schema2.$schema)))
       this.validateSchema(schema2, true);
-    var localRefs = resolve12.ids.call(this, schema2);
+    var localRefs = resolve13.ids.call(this, schema2);
     var schemaObj = new SchemaObject({
       id,
       schema: schema2,
@@ -25634,21 +26570,21 @@ var require_ajv = __commonJS((exports, module) => {
     return metaOpts;
   };
   var setLogger = function(self) {
-    var logger5 = self._opts.logger;
-    if (logger5 === false) {
+    var logger6 = self._opts.logger;
+    if (logger6 === false) {
       self.logger = { log: noop, warn: noop, error: noop };
     } else {
-      if (logger5 === undefined)
-        logger5 = console;
-      if (!(typeof logger5 == "object" && logger5.log && logger5.warn && logger5.error))
+      if (logger6 === undefined)
+        logger6 = console;
+      if (!(typeof logger6 == "object" && logger6.log && logger6.warn && logger6.error))
         throw new Error("logger must implement log, warn and error methods");
-      self.logger = logger5;
+      self.logger = logger6;
     }
   };
   var noop = function() {
   };
   var compileSchema = require_compile();
-  var resolve12 = require_resolve();
+  var resolve13 = require_resolve();
   var Cache = require_cache();
   var SchemaObject = require_schema_obj();
   var stableStringify = require_fast_json_stable_stringify();
@@ -25709,27 +26645,27 @@ var require_windows = __commonJS((exports, module) => {
     return checkPathExt(path, options2);
   };
   var isexe = function(path, options2, cb) {
-    fs31.stat(path, function(er, stat) {
+    fs34.stat(path, function(er, stat) {
       cb(er, er ? false : checkStat(stat, path, options2));
     });
   };
   var sync = function(path, options2) {
-    return checkStat(fs31.statSync(path), path, options2);
+    return checkStat(fs34.statSync(path), path, options2);
   };
   module.exports = isexe;
   isexe.sync = sync;
-  var fs31 = __require("fs");
+  var fs34 = __require("fs");
 });
 
 // node_modules/isexe/mode.js
 var require_mode = __commonJS((exports, module) => {
   var isexe = function(path, options2, cb) {
-    fs31.stat(path, function(er, stat) {
+    fs34.stat(path, function(er, stat) {
       cb(er, er ? false : checkStat(stat, options2));
     });
   };
   var sync = function(path, options2) {
-    return checkStat(fs31.statSync(path), options2);
+    return checkStat(fs34.statSync(path), options2);
   };
   var checkStat = function(stat, options2) {
     return stat.isFile() && checkMode(stat, options2);
@@ -25749,7 +26685,7 @@ var require_mode = __commonJS((exports, module) => {
   };
   module.exports = isexe;
   isexe.sync = sync;
-  var fs31 = __require("fs");
+  var fs34 = __require("fs");
 });
 
 // node_modules/isexe/index.js
@@ -25763,12 +26699,12 @@ var require_isexe = __commonJS((exports, module) => {
       if (typeof Promise !== "function") {
         throw new TypeError("callback not provided");
       }
-      return new Promise(function(resolve12, reject) {
+      return new Promise(function(resolve13, reject) {
         isexe(path, options2 || {}, function(er, is) {
           if (er) {
             reject(er);
           } else {
-            resolve12(is);
+            resolve13(is);
           }
         });
       });
@@ -25794,7 +26730,7 @@ var require_isexe = __commonJS((exports, module) => {
       }
     }
   };
-  var fs31 = __require("fs");
+  var fs34 = __require("fs");
   var core2;
   if (process.platform === "win32" || global.TESTING_WINDOWS) {
     core2 = require_windows();
@@ -25839,27 +26775,27 @@ var require_which = __commonJS((exports, module) => {
       opt = {};
     const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
     const found = [];
-    const step = (i) => new Promise((resolve12, reject) => {
+    const step = (i) => new Promise((resolve13, reject) => {
       if (i === pathEnv.length)
-        return opt.all && found.length ? resolve12(found) : reject(getNotFoundError(cmd));
+        return opt.all && found.length ? resolve13(found) : reject(getNotFoundError(cmd));
       const ppRaw = pathEnv[i];
       const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
       const pCmd = path.join(pathPart, cmd);
       const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
-      resolve12(subStep(p, i, 0));
+      resolve13(subStep(p, i, 0));
     });
-    const subStep = (p, i, ii) => new Promise((resolve12, reject) => {
+    const subStep = (p, i, ii) => new Promise((resolve13, reject) => {
       if (ii === pathExt.length)
-        return resolve12(step(i + 1));
+        return resolve13(step(i + 1));
       const ext = pathExt[ii];
       isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
         if (!er && is) {
           if (opt.all)
             found.push(p + ext);
           else
-            return resolve12(p + ext);
+            return resolve13(p + ext);
         }
-        return resolve12(subStep(p, i, ii + 1));
+        return resolve13(subStep(p, i, ii + 1));
       });
     });
     return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
@@ -26001,14 +26937,14 @@ var require_readShebang = __commonJS((exports, module) => {
     const buffer = Buffer.alloc(size);
     let fd;
     try {
-      fd = fs31.openSync(command, "r");
-      fs31.readSync(fd, buffer, 0, size, 0);
-      fs31.closeSync(fd);
+      fd = fs34.openSync(command, "r");
+      fs34.readSync(fd, buffer, 0, size, 0);
+      fs34.closeSync(fd);
     } catch (e) {
     }
     return shebangCommand(buffer.toString());
   };
-  var fs31 = __require("fs");
+  var fs34 = __require("fs");
   var shebangCommand = require_shebang_command();
   module.exports = readShebang;
 });
@@ -27461,155 +28397,7 @@ function ora(options2) {
 
 // dist/commands/init.js
 var import_prompts = __toESM(require_prompts3(), 1);
-
-// node_modules/kleur/colors.mjs
-var init = function(x, y) {
-  let rgx = new RegExp(`\\x1b\\[${y}m`, "g");
-  let open = `\x1B[${x}m`, close = `\x1B[${y}m`;
-  return function(txt) {
-    if (!$.enabled || txt == null)
-      return txt;
-    return open + (~("" + txt).indexOf(close) ? txt.replace(rgx, close + open) : txt) + close;
-  };
-};
-var FORCE_COLOR;
-var NODE_DISABLE_COLORS;
-var NO_COLOR;
-var TERM;
-var isTTY = true;
-if (typeof process !== "undefined") {
-  ({ FORCE_COLOR, NODE_DISABLE_COLORS, NO_COLOR, TERM } = process.env || {});
-  isTTY = process.stdout && process.stdout.isTTY;
-}
-var $ = {
-  enabled: !NODE_DISABLE_COLORS && NO_COLOR == null && TERM !== "dumb" && (FORCE_COLOR != null && FORCE_COLOR !== "0" || isTTY)
-};
-var reset = init(0, 0);
-var bold = init(1, 22);
-var dim = init(2, 22);
-var italic = init(3, 23);
-var underline = init(4, 24);
-var inverse = init(7, 27);
-var hidden = init(8, 28);
-var strikethrough = init(9, 29);
-var black = init(30, 39);
-var red = init(31, 39);
-var green = init(32, 39);
-var yellow = init(33, 39);
-var blue = init(34, 39);
-var magenta = init(35, 39);
-var cyan = init(36, 39);
-var white = init(37, 39);
-var gray = init(90, 39);
-var grey = init(90, 39);
-var bgBlack = init(40, 49);
-var bgRed = init(41, 49);
-var bgGreen = init(42, 49);
-var bgYellow = init(43, 49);
-var bgBlue = init(44, 49);
-var bgMagenta = init(45, 49);
-var bgCyan = init(46, 49);
-var bgWhite = init(47, 49);
-
-// dist/utils/symbols.js
-var STATUS = {
-  success: "\u2713",
-  error: "\u2717",
-  warning: "\u26A0",
-  info: "\u2139",
-  debug: "\u2022"
-};
-var TREE = {
-  branch: "\u251C\u2500",
-  last: "\u2514\u2500"
-};
-var BOX = {
-  topLeft: "\u250C",
-  topRight: "\u2510",
-  bottomLeft: "\u2514",
-  bottomRight: "\u2518",
-  horizontal: "\u2500",
-  vertical: "\u2502"
-};
-
-// dist/utils/logger.js
-var getTerminalWidth = function() {
-  const columns = process.stdout.columns;
-  return typeof columns === "number" && columns > 0 ? columns : 80;
-};
-var truncateText = function(text, maxLength) {
-  if (maxLength <= 0) {
-    return "";
-  }
-  if (text.length <= maxLength) {
-    return text;
-  }
-  if (maxLength <= 3) {
-    return ".".repeat(maxLength);
-  }
-  return `${text.slice(0, maxLength - 3)}...`;
-};
-
-class Logger {
-  static instance;
-  static getInstance() {
-    if (!Logger.instance) {
-      Logger.instance = new Logger;
-    }
-    return Logger.instance;
-  }
-  info(message) {
-    console.log(cyan(STATUS.info), message);
-  }
-  success(message) {
-    console.log(green(STATUS.success), message);
-  }
-  warning(message) {
-    console.log(yellow(STATUS.warning), message);
-  }
-  warn(message) {
-    this.warning(message);
-  }
-  error(message) {
-    console.log(red(STATUS.error), message);
-  }
-  debug(message) {
-    console.log(dim(STATUS.debug), dim(message));
-  }
-  title(message) {
-    console.log(bold(cyan(message)));
-  }
-  subtitle(message) {
-    console.log(bold(message));
-  }
-  titleBox(message) {
-    const w = getTerminalWidth();
-    if (w < 8) {
-      console.log(bold(cyan(truncateText(message, w))));
-      return;
-    }
-    const maxInner = Math.max(4, w - 2);
-    const inner = Math.min(Math.max(message.length + 4, 40), maxInner);
-    const visibleMessage = truncateText(message, inner - 2);
-    const padR = Math.max(0, inner - visibleMessage.length - 2);
-    console.log(dim(BOX.topLeft + BOX.horizontal.repeat(inner) + BOX.topRight));
-    console.log(dim(BOX.vertical) + " " + bold(cyan(visibleMessage)) + " ".repeat(padR) + " " + dim(BOX.vertical));
-    console.log(dim(BOX.bottomLeft + BOX.horizontal.repeat(inner) + BOX.bottomRight));
-  }
-  section(title) {
-    const w = getTerminalWidth();
-    const lineLen = Math.max(0, w - title.length - 5);
-    console.log("");
-    console.log(bold(`${BOX.horizontal}${BOX.horizontal} ${title} ${BOX.horizontal.repeat(lineLen)}`));
-  }
-  tree(message, isLast) {
-    const connector = isLast ? TREE.last : TREE.branch;
-    console.log(`${connector} ${message}`);
-  }
-}
-var logger = Logger.getInstance();
-
-// dist/commands/init.js
+init_logger();
 init_fs();
 
 // dist/core/agentDetector.js
@@ -28270,6 +29058,7 @@ var getProjectName = function(cwd) {
 };
 
 // dist/commands/detect.js
+init_logger();
 init_skillsManager();
 init_agentManager();
 async function detectCommand(options2) {
@@ -28338,12 +29127,13 @@ async function detectCommand(options2) {
 }
 
 // dist/commands/sync.js
-import {relative as relative5} from "path";
+init_logger();
+import {relative as relative6} from "path";
 
 // dist/core/propagator.js
 var import_gray_matter3 = __toESM(require_gray_matter(), 1);
-import {promises as fs26} from "fs";
-import {resolve as resolve9} from "path";
+import {promises as fs29} from "fs";
+import {resolve as resolve10} from "path";
 
 // node_modules/js-yaml/dist/js-yaml.mjs
 var isNothing = function(subject) {
@@ -30990,7 +31780,7 @@ class Propagator {
       warnings: [],
       resolvedTargets: []
     };
-    const agentsPath = resolve9(projectPath, "agents.md");
+    const agentsPath = resolve10(projectPath, "agents.md");
     if (!await fileExists(agentsPath)) {
       result.success = false;
       result.errors.push("agents.md not found. Run `agentinit init` first.");
@@ -31075,7 +31865,7 @@ class Propagator {
     return [...generatedFiles.values()];
   }
   mergeGeneratedFile(projectPath, generatedFiles, output, agentId) {
-    const outputPath = resolve9(projectPath, output.path);
+    const outputPath = resolve10(projectPath, output.path);
     const nextKind = output.kind ?? "file";
     const nextContent = nextKind === "file" || output.content !== undefined ? normalizeContent(output.content || "") : undefined;
     const existing = generatedFiles.get(outputPath);
@@ -31110,14 +31900,14 @@ class Propagator {
       resolvedTargets: []
     };
     const exists = await fileExists(generatedFile.path);
-    const existingStats = exists ? await fs26.lstat(generatedFile.path).catch(() => null) : null;
+    const existingStats = exists ? await fs29.lstat(generatedFile.path).catch(() => null) : null;
     const existingContent = exists && !existingStats?.isSymbolicLink() ? await readFileIfExists(generatedFile.path) : null;
     const existingTarget = existingStats?.isSymbolicLink() ? await readSymlinkTarget(generatedFile.path) : null;
     if (options2.managedState && !options2.dryRun) {
       await options2.managedState.trackGeneratedPath(generatedFile.path, {
         kind: "file",
         source: "sync",
-        ignorePath: resolve9(projectPath, generatedFile.ignorePath)
+        ignorePath: resolve10(projectPath, generatedFile.ignorePath)
       });
     }
     if (generatedFile.kind === "file" && exists && !existingStats?.isSymbolicLink() && existingContent === generatedFile.content) {
@@ -31141,12 +31931,12 @@ class Propagator {
     if (!options2.dryRun) {
       if (generatedFile.kind === "file") {
         if (existingStats?.isSymbolicLink()) {
-          await fs26.rm(generatedFile.path, { force: true }).catch(() => {
+          await fs29.rm(generatedFile.path, { force: true }).catch(() => {
           });
         }
         await writeFile(generatedFile.path, generatedFile.content || "");
       } else {
-        const symlinkCreated = await createRelativeSymlink(resolve9(projectPath, generatedFile.target || ""), generatedFile.path);
+        const symlinkCreated = await createRelativeSymlink(resolve10(projectPath, generatedFile.target || ""), generatedFile.path);
         if (!symlinkCreated) {
           await writeFile(generatedFile.path, generatedFile.content || "");
           result.warnings.push(`Could not create symlink for ${generatedFile.path}; wrote a copied file instead.`);
@@ -31251,7 +32041,7 @@ class Propagator {
     });
   }
   async buildAiderConfig(projectPath) {
-    const configPath = resolve9(projectPath, ".aider.conf.yml");
+    const configPath = resolve10(projectPath, ".aider.conf.yml");
     const existingContent = await readFileIfExists(configPath);
     let document = {};
     if (existingContent) {
@@ -31318,14 +32108,14 @@ ${content}
 
 // dist/core/managedState.js
 init_fs();
-import {promises as fs28} from "fs";
-import {dirname as dirname4, join as join6, relative as relative4, resolve as resolve10} from "path";
+import {promises as fs31} from "fs";
+import {dirname as dirname5, join as join8, relative as relative5, resolve as resolve11} from "path";
 var toPosixPath = function(value) {
   return value.replace(/\\/g, "/");
 };
 async function pathType(targetPath) {
   try {
-    const stat = await fs28.lstat(targetPath);
+    const stat = await fs31.lstat(targetPath);
     if (stat.isSymbolicLink()) {
       return "symlink";
     }
@@ -31335,20 +32125,20 @@ async function pathType(targetPath) {
   }
 }
 async function copyDirectory(src, dest) {
-  await fs28.mkdir(dest, { recursive: true });
-  const entries = await fs28.readdir(src, { withFileTypes: true });
+  await fs31.mkdir(dest, { recursive: true });
+  const entries = await fs31.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = join6(src, entry.name);
-    const destPath = join6(dest, entry.name);
+    const srcPath = join8(src, entry.name);
+    const destPath = join8(dest, entry.name);
     if (entry.isDirectory()) {
       await copyDirectory(srcPath, destPath);
     } else if (entry.isSymbolicLink()) {
-      const target = await fs28.readlink(srcPath);
-      await fs28.mkdir(dirname4(destPath), { recursive: true });
-      await fs28.symlink(target, destPath);
+      const target = await fs31.readlink(srcPath);
+      await fs31.mkdir(dirname5(destPath), { recursive: true });
+      await fs31.symlink(target, destPath);
     } else {
-      await fs28.mkdir(dirname4(destPath), { recursive: true });
-      await fs28.copyFile(srcPath, destPath);
+      await fs31.mkdir(dirname5(destPath), { recursive: true });
+      await fs31.copyFile(srcPath, destPath);
     }
   }
 }
@@ -31357,14 +32147,14 @@ async function copyPath(src, dest) {
   if (!type2) {
     return;
   }
-  await fs28.mkdir(dirname4(dest), { recursive: true });
+  await fs31.mkdir(dirname5(dest), { recursive: true });
   if (type2 === "symlink") {
-    const target = await fs28.readlink(src);
-    await fs28.symlink(target, dest);
+    const target = await fs31.readlink(src);
+    await fs31.symlink(target, dest);
   } else if (type2 === "directory") {
     await copyDirectory(src, dest);
   } else {
-    await fs28.copyFile(src, dest);
+    await fs31.copyFile(src, dest);
   }
 }
 var MANAGED_STATE_FILE = "managed-state.json";
@@ -31378,11 +32168,11 @@ class ManagedStateStore {
     this.state = state;
   }
   static async open(projectPath) {
-    const agentInitDir = join6(projectPath, ".agentinit");
-    const statePath = join6(agentInitDir, MANAGED_STATE_FILE);
+    const agentInitDir = join8(projectPath, ".agentinit");
+    const statePath = join8(agentInitDir, MANAGED_STATE_FILE);
     const emptyState = { version: 1, entries: [] };
     try {
-      const raw = await fs28.readFile(statePath, "utf8");
+      const raw = await fs31.readFile(statePath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed || parsed.version !== 1 || !Array.isArray(parsed.entries)) {
         return new ManagedStateStore(projectPath, emptyState);
@@ -31393,17 +32183,17 @@ class ManagedStateStore {
     }
   }
   get agentInitDir() {
-    return join6(this.projectPath, ".agentinit");
+    return join8(this.projectPath, ".agentinit");
   }
   get stateFilePath() {
-    return join6(this.agentInitDir, MANAGED_STATE_FILE);
+    return join8(this.agentInitDir, MANAGED_STATE_FILE);
   }
   get backupsDir() {
-    return join6(this.agentInitDir, BACKUPS_DIR);
+    return join8(this.agentInitDir, BACKUPS_DIR);
   }
   normalizeRelativePath(targetPath, preserveTrailingSlash = false) {
     const hasTrailingSlash = preserveTrailingSlash && /[\\/]$/.test(targetPath);
-    const relativePath = relative4(this.projectPath, resolve10(targetPath));
+    const relativePath = relative5(this.projectPath, resolve11(targetPath));
     const normalizedPath = toPosixPath(relativePath);
     if (hasTrailingSlash && normalizedPath) {
       return normalizedPath.endsWith("/") ? normalizedPath : `${normalizedPath}/`;
@@ -31421,14 +32211,14 @@ class ManagedStateStore {
     }
     if (type2 === "symlink") {
       try {
-        const backupLinkTarget = await fs28.readlink(targetPath);
+        const backupLinkTarget = await fs31.readlink(targetPath);
         return { backupLinkTarget };
       } catch {
         return {};
       }
     }
     const relativeTargetPath = this.normalizeRelativePath(targetPath);
-    const backupPath = join6(this.backupsDir, relativeTargetPath);
+    const backupPath = join8(this.backupsDir, relativeTargetPath);
     if (!await fileExists(backupPath)) {
       await copyPath(targetPath, backupPath);
     }
@@ -31463,20 +32253,20 @@ class ManagedStateStore {
     if (this.state.entries.length === 0) {
       return [];
     }
-    const paths5 = new Set([
+    const paths6 = new Set([
       ".agentinit/managed-state.json",
       ".agentinit/backups/"
     ]);
     for (const entry of this.state.entries) {
       if (entry.ignorePath) {
-        paths5.add(entry.ignorePath);
+        paths6.add(entry.ignorePath);
       }
     }
-    return [...paths5];
+    return [...paths6];
   }
   async save() {
-    await fs28.mkdir(this.agentInitDir, { recursive: true });
-    await fs28.writeFile(this.stateFilePath, JSON.stringify(this.state, null, 2), "utf8");
+    await fs31.mkdir(this.agentInitDir, { recursive: true });
+    await fs31.writeFile(this.stateFilePath, JSON.stringify(this.state, null, 2), "utf8");
   }
   async revertAll(options2 = {}) {
     const summary = {
@@ -31486,34 +32276,34 @@ class ManagedStateStore {
     };
     const entries = [...this.state.entries].sort((a, b) => b.path.length - a.path.length);
     for (const entry of entries) {
-      const absolutePath = resolve10(this.projectPath, entry.path);
-      const backupPath = entry.backupPath ? resolve10(this.projectPath, entry.backupPath) : null;
+      const absolutePath = resolve11(this.projectPath, entry.path);
+      const backupPath = entry.backupPath ? resolve11(this.projectPath, entry.backupPath) : null;
       const backupLinkTarget = entry.backupLinkTarget;
       if (entry.existedBefore && backupLinkTarget !== undefined) {
         if (!options2.dryRun) {
-          await fs28.rm(absolutePath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(absolutePath, { recursive: true, force: true }).catch(() => {
           });
-          await fs28.mkdir(dirname4(absolutePath), { recursive: true });
-          await fs28.symlink(backupLinkTarget, absolutePath);
+          await fs31.mkdir(dirname5(absolutePath), { recursive: true });
+          await fs31.symlink(backupLinkTarget, absolutePath);
         }
         summary.restored++;
       } else if (entry.existedBefore && backupPath && await fileExists(backupPath)) {
         if (!options2.dryRun) {
-          await fs28.rm(absolutePath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(absolutePath, { recursive: true, force: true }).catch(() => {
           });
           await copyPath(backupPath, absolutePath);
         }
         summary.restored++;
       } else {
         if (!options2.dryRun) {
-          await fs28.rm(absolutePath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(absolutePath, { recursive: true, force: true }).catch(() => {
           });
         }
         summary.removed++;
       }
       if (!options2.keepBackups && backupPath && await fileExists(backupPath)) {
         if (!options2.dryRun) {
-          await fs28.rm(backupPath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(backupPath, { recursive: true, force: true }).catch(() => {
           });
         }
         summary.backupsRemoved++;
@@ -31521,16 +32311,16 @@ class ManagedStateStore {
     }
     if (!options2.dryRun) {
       this.state.entries.length = 0;
-      await fs28.rm(this.stateFilePath, { force: true }).catch(() => {
+      await fs31.rm(this.stateFilePath, { force: true }).catch(() => {
       });
       if (!options2.keepBackups) {
-        await fs28.rm(this.backupsDir, { recursive: true, force: true }).catch(() => {
+        await fs31.rm(this.backupsDir, { recursive: true, force: true }).catch(() => {
         });
       }
       try {
-        const remainingEntries = await fs28.readdir(this.agentInitDir);
+        const remainingEntries = await fs31.readdir(this.agentInitDir);
         if (remainingEntries.length === 0) {
-          await fs28.rm(this.agentInitDir, { recursive: true, force: true });
+          await fs31.rm(this.agentInitDir, { recursive: true, force: true });
         }
       } catch {
       }
@@ -31580,7 +32370,7 @@ async function syncCommand(options2) {
         for (const change of result.changes) {
           const action = change.action === "created" ? "\u2795" : change.action === "updated" ? "\uD83D\uDCDD" : "\uD83D\uDCBE";
           const names = change.agents.map((id) => agentManager5.getAgentById(id)?.name || id).join(", ");
-          logger.info(`  ${action} ${relative5(cwd, change.file) || change.file}`);
+          logger.info(`  ${action} ${relative6(cwd, change.file) || change.file}`);
           logger.info(`     Agents: ${names}`);
         }
         if (options2.backup && result.changes.some((c) => c.action === "backed_up")) {
@@ -31609,7 +32399,9 @@ async function syncCommand(options2) {
 }
 
 // dist/commands/apply.js
-import {relative as relative6} from "path";
+init_colors();
+init_logger();
+import {relative as relative7} from "path";
 
 // dist/types/index.js
 var MCPServerType;
@@ -31875,12 +32667,12 @@ class MCPParser {
 // dist/constants/mcp.js
 import {readFileSync as readFileSync2} from "fs";
 import {fileURLToPath} from "url";
-import {dirname as dirname5, join as join7} from "path";
+import {dirname as dirname6, join as join9} from "path";
 var getPackageVersion = function() {
   try {
     const __filename2 = fileURLToPath(import.meta.url);
-    const __dirname2 = dirname5(__filename2);
-    const packageJsonPath = join7(__dirname2, "../../package.json");
+    const __dirname2 = dirname6(__filename2);
+    const packageJsonPath = join9(__dirname2, "../../package.json");
     const packageJson = JSON.parse(readFileSync2(packageJsonPath, "utf-8"));
     return packageJson.version || "1.0.0";
   } catch {
@@ -31911,17 +32703,17 @@ import {readFileSync as readFileSync4} from "fs";
 
 // dist/core/rulesTemplateLoader.js
 var toml = __toESM(require_toml(), 1);
-import {resolve as resolve11, dirname as dirname6} from "path";
+import {resolve as resolve12, dirname as dirname7} from "path";
 import {fileURLToPath as fileURLToPath2} from "url";
 import {readFileSync as readFileSync3, readdirSync, existsSync as existsSync2} from "fs";
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = dirname6(__filename2);
+var __dirname2 = dirname7(__filename2);
 
 class RulesTemplateLoader {
   templatesPath;
   templates = new Map;
   constructor() {
-    this.templatesPath = resolve11(__dirname2, "../templates/rules");
+    this.templatesPath = resolve12(__dirname2, "../templates/rules");
     this.loadTemplates();
   }
   loadTemplates() {
@@ -31931,7 +32723,7 @@ class RulesTemplateLoader {
     const files = readdirSync(this.templatesPath).filter((file) => file.endsWith(".toml"));
     for (const file of files) {
       try {
-        const filePath = resolve11(this.templatesPath, file);
+        const filePath = resolve12(this.templatesPath, file);
         const content = readFileSync3(filePath, "utf-8");
         const parsed = toml.default.parse(content);
         const template = {
@@ -37503,7 +38295,7 @@ class Protocol {
   }
   request(request, resultSchema, options2) {
     const { relatedRequestId, resumptionToken, onresumptiontoken } = options2 !== null && options2 !== undefined ? options2 : {};
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       var _a, _b, _c, _d, _e, _f;
       if (!this._transport) {
         reject(new Error("Not connected"));
@@ -37554,7 +38346,7 @@ class Protocol {
         }
         try {
           const result = resultSchema.parse(response.result);
-          resolve12(result);
+          resolve13(result);
         } catch (error) {
           reject(error);
         }
@@ -37934,7 +38726,7 @@ class StdioClientTransport {
     if (this._process) {
       throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
     }
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       var _a, _b, _c, _d, _e;
       this._process = import_cross_spawn.default(this._serverParams.command, (_a = this._serverParams.args) !== null && _a !== undefined ? _a : [], {
         env: {
@@ -37957,7 +38749,7 @@ class StdioClientTransport {
         (_b2 = this.onerror) === null || _b2 === undefined || _b2.call(this, error);
       });
       this._process.on("spawn", () => {
-        resolve12();
+        resolve13();
       });
       this._process.on("close", (_code) => {
         var _a2;
@@ -38012,16 +38804,16 @@ class StdioClientTransport {
     this._readBuffer.clear();
   }
   send(message) {
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       var _a;
       if (!((_a = this._process) === null || _a === undefined ? undefined : _a.stdin)) {
         throw new Error("Not connected");
       }
       const json2 = serializeMessage(message);
       if (this._process.stdin.write(json2)) {
-        resolve12();
+        resolve13();
       } else {
-        this._process.stdin.once("drain", resolve12);
+        this._process.stdin.once("drain", resolve13);
       }
     });
   }
@@ -39443,7 +40235,7 @@ class SSEClientTransport {
   _startOrAuth() {
     var _a, _b, _c;
     const fetchImpl = (_c = (_b = (_a = this === null || this === undefined ? undefined : this._eventSourceInit) === null || _a === undefined ? undefined : _a.fetch) !== null && _b !== undefined ? _b : this._fetch) !== null && _c !== undefined ? _c : fetch;
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       this._eventSource = new EventSource(this._url.href, {
         ...this._eventSourceInit,
         fetch: async (url, init2) => {
@@ -39463,7 +40255,7 @@ class SSEClientTransport {
       this._eventSource.onerror = (event) => {
         var _a2;
         if (event.code === 401 && this._authProvider) {
-          this._authThenStart().then(resolve12, reject);
+          this._authThenStart().then(resolve13, reject);
           return;
         }
         const error = new SseError(event.code, event.message, event);
@@ -39486,7 +40278,7 @@ class SSEClientTransport {
           this.close();
           return;
         }
-        resolve12();
+        resolve13();
       });
       this._eventSource.onmessage = (event) => {
         var _a2, _b2;
@@ -39563,8 +40355,11 @@ class SSEClientTransport {
 
 // dist/core/mcpClient.js
 init_lib();
+init_colors();
+init_logger();
 
 // dist/utils/packageVersion.js
+init_logger();
 function extractExplicitVersion(packageSpec) {
   const versionMatch = packageSpec.match(/@([\d]+\.[\d]+\.[\d]+(?:[-+].+)?$)/);
   if (versionMatch && versionMatch[1]) {
@@ -40150,11 +40945,11 @@ class MCPVerifier {
 }
 
 // dist/core/gitignoreManager.js
-import {promises as fs31} from "fs";
-import {dirname as dirname7, join as join8} from "path";
+import {promises as fs34} from "fs";
+import {dirname as dirname8, join as join10} from "path";
 var normalizeIgnorePath = function(projectPath, value) {
-  const relative6 = value.startsWith(projectPath) ? value.slice(projectPath.length + 1) : value;
-  const normalized = relative6.replace(/\\/g, "/").replace(/^\/+/, "");
+  const relative7 = value.startsWith(projectPath) ? value.slice(projectPath.length + 1) : value;
+  const normalized = relative7.replace(/\\/g, "/").replace(/^\/+/, "");
   if (!normalized) {
     return normalized;
   }
@@ -40197,13 +40992,13 @@ var updateManagedBlock = function(existingContent, entries) {
   }
   return content;
 };
-async function updateManagedIgnoreFile(projectPath, paths5, options2 = {}) {
-  const ignoreFile = options2.local ? join8(".git", "info", "exclude") : ".gitignore";
-  const ignoreFilePath = join8(projectPath, ignoreFile);
+async function updateManagedIgnoreFile(projectPath, paths6, options2 = {}) {
+  const ignoreFile = options2.local ? join10(".git", "info", "exclude") : ".gitignore";
+  const ignoreFilePath = join10(projectPath, ignoreFile);
   if (options2.local) {
-    const gitDir = join8(projectPath, ".git");
+    const gitDir = join10(projectPath, ".git");
     try {
-      const stat = await fs31.stat(gitDir);
+      const stat = await fs34.stat(gitDir);
       if (!stat.isDirectory()) {
         throw new Error;
       }
@@ -40211,24 +41006,24 @@ async function updateManagedIgnoreFile(projectPath, paths5, options2 = {}) {
       throw new Error("Cannot update .git/info/exclude because this project is not a Git repository");
     }
   }
-  const normalizedPaths = [...new Set(paths5.map((path) => normalizeIgnorePath(projectPath, path)).filter(Boolean))].sort();
+  const normalizedPaths = [...new Set(paths6.map((path) => normalizeIgnorePath(projectPath, path)).filter(Boolean))].sort();
   let existingContent = "";
   try {
-    existingContent = await fs31.readFile(ignoreFilePath, "utf8");
+    existingContent = await fs34.readFile(ignoreFilePath, "utf8");
   } catch {
     existingContent = "";
   }
   const updatedContent = updateManagedBlock(existingContent, normalizedPaths);
-  await fs31.mkdir(dirname7(ignoreFilePath), { recursive: true });
-  await fs31.writeFile(ignoreFilePath, updatedContent, "utf8");
+  await fs34.mkdir(dirname8(ignoreFilePath), { recursive: true });
+  await fs34.writeFile(ignoreFilePath, updatedContent, "utf8");
   return ignoreFilePath;
 }
 async function removeManagedIgnoreBlock(projectPath, options2 = {}) {
-  const ignoreFile = options2.local ? join8(".git", "info", "exclude") : ".gitignore";
-  const ignoreFilePath = join8(projectPath, ignoreFile);
+  const ignoreFile = options2.local ? join10(".git", "info", "exclude") : ".gitignore";
+  const ignoreFilePath = join10(projectPath, ignoreFile);
   let content;
   try {
-    content = await fs31.readFile(ignoreFilePath, "utf8");
+    content = await fs34.readFile(ignoreFilePath, "utf8");
   } catch {
     return false;
   }
@@ -40244,13 +41039,13 @@ async function removeManagedIgnoreBlock(projectPath, options2 = {}) {
   const afterBlock = content.slice(endIndex + END_MARKER.length).replace(/^\n+/, "");
   let nextContent = `${beforeBlock}${afterBlock}`.replace(/\n{3,}/g, "\n\n").replace(/^\n+/, "");
   if (nextContent.trim() === "") {
-    await fs31.rm(ignoreFilePath, { force: true }).catch(() => {
+    await fs34.rm(ignoreFilePath, { force: true }).catch(() => {
     });
   } else {
     if (!nextContent.endsWith("\n")) {
       nextContent += "\n";
     }
-    await fs31.writeFile(ignoreFilePath, nextContent, "utf8");
+    await fs34.writeFile(ignoreFilePath, nextContent, "utf8");
   }
   return true;
 }
@@ -40261,12 +41056,12 @@ var END_MARKER = "# END AgentInit Generated Files";
 init_agentManager();
 init_skillsManager();
 init_fs();
-import {dirname as dirname8, join as join9} from "path";
+import {dirname as dirname9, join as join11} from "path";
 async function discoverProjectSkills(projectPath, skillsManager4) {
   const sources = [];
   const skills2 = new Map;
   for (const sourceDir of PROJECT_SKILL_SOURCE_DIRS) {
-    const absoluteSourceDir = join9(projectPath, sourceDir);
+    const absoluteSourceDir = join11(projectPath, sourceDir);
     if (!await fileExists(absoluteSourceDir)) {
       continue;
     }
@@ -40339,7 +41134,7 @@ async function applyProjectSkills(projectPath, targetAgentIds, managedState2, op
             await managedState2.trackGeneratedPath(generatedPath, {
               kind: "directory",
               source: "skills",
-              ignorePath: `${dirname8(generatedPath)}/`
+              ignorePath: `${dirname9(generatedPath)}/`
             });
           }
         }
@@ -40450,7 +41245,7 @@ async function applyProjectCommand(options2) {
           if (change.action === "backed_up")
             return;
           const names = change.agents.map((id) => agentManager7.getAgentById(id)?.name || id).join(", ");
-          logger.info(`  ${relative6(cwd, change.file) || change.file}`);
+          logger.info(`  ${relative7(cwd, change.file) || change.file}`);
           logger.info(`    Agents: ${names}`);
         });
       }
@@ -40468,7 +41263,7 @@ async function applyProjectCommand(options2) {
           installsByPath.set(item.path, existing);
         }
         for (const [path, details] of installsByPath) {
-          logger.info(`  ${relative6(cwd, path) || path}`);
+          logger.info(`  ${relative7(cwd, path) || path}`);
           logger.info(`    Agents: ${[...details.agents].join(", ")}`);
           logger.info(`    Skills: ${[...details.skills].join(", ")}`);
         }
@@ -40910,6 +41705,7 @@ var LEGACY_APPLY_FLAGS = new Set([
 ]);
 
 // dist/commands/verifyMcp.js
+init_logger();
 init_agentManager();
 async function verifyMcpCommand(args) {
   const cwd = process.cwd();
@@ -41115,6 +41911,7 @@ async function verifyMcpCommand(args) {
 }
 
 // dist/commands/revert.js
+init_logger();
 async function revertCommand(options2) {
   const cwd = process.cwd();
   logger.titleBox("AgentInit  Revert");
@@ -41159,6 +41956,7 @@ async function revertCommand(options2) {
 }
 
 // dist/utils/colors.js
+init_colors();
 var colorsEnabled = function() {
   const env2 = process.env || {};
   const isTTY2 = !!process.stdout?.isTTY;
@@ -41172,6 +41970,7 @@ function orange(text) {
 }
 
 // dist/commands/config.js
+init_logger();
 init_marketplaceRegistry();
 init_userConfig();
 var sortConfig = function(config) {
@@ -41348,12 +42147,15 @@ var BUILT_IN_VERIFIED_REPOS = new Set(getBuiltInVerifiedGithubRepos());
 
 // dist/commands/skills.js
 var import_prompts3 = __toESM(require_prompts3(), 1);
-import {homedir as homedir6} from "os";
-import {relative as relative7, resolve as resolve12} from "path";
+init_colors();
+init_logger();
+import {homedir as homedir7} from "os";
+import {relative as relative8, resolve as resolve13} from "path";
 
 // dist/utils/promptUtils.js
 var import_prompts2 = __toESM(require_prompts3(), 1);
 import {createRequire as createRequire2} from "module";
+init_logger();
 function enableUppercaseToggleAllForMultiselectPrompt() {
   if (uppercaseToggleAllPatched) {
     return;
@@ -41367,7 +42169,22 @@ function enableUppercaseToggleAllForMultiselectPrompt() {
     }
     const originalHandler = prototype._;
     prototype._ = function agentinitMultiselectHandler(input, key) {
-      return originalHandler.call(this, input === "A" ? "a" : input, key);
+      if (this.__agentinitHotkeyBusy) {
+        return;
+      }
+      const normalizedInput = input === "A" ? "a" : input;
+      const hotkeyHandler = this.__agentinitHotkeys?.[normalizedInput] || this.__agentinitHotkeys?.[input];
+      if (hotkeyHandler) {
+        this.__agentinitHotkeyBusy = true;
+        Promise.resolve(hotkeyHandler(this, normalizedInput, key)).finally(() => {
+          this.__agentinitHotkeyBusy = false;
+          if (typeof this.render === "function") {
+            this.render();
+          }
+        });
+        return;
+      }
+      return originalHandler.call(this, normalizedInput, key);
     };
     Object.defineProperty(prototype, "__agentinitUppercaseToggleAllPatched", {
       value: true,
@@ -41380,12 +42197,52 @@ function enableUppercaseToggleAllForMultiselectPrompt() {
 }
 async function promptMultiselect(options2) {
   enableUppercaseToggleAllForMultiselectPrompt();
-  return import_prompts2.default({
+  const userOnRender = options2.onRenderPrompt;
+  const hint = options2.hint;
+  let requestedAction;
+  let promptInstance;
+  const closeWithCurrentSelection = (prompt) => {
+    if (typeof prompt.close !== "function") {
+      return false;
+    }
+    prompt.done = true;
+    prompt.aborted = false;
+    prompt.fire?.();
+    prompt.render?.();
+    prompt.out?.write("\n");
+    prompt.close();
+    return true;
+  };
+  const hotkeys = options2.hotkeys ? Object.fromEntries(Object.entries(options2.hotkeys).map(([key, handler]) => [
+    key,
+    (prompt, input, pressedKey) => handler({
+      prompt,
+      requestAction: (action) => {
+        requestedAction = action;
+      },
+      closeWithCurrentSelection: () => closeWithCurrentSelection(prompt)
+    }, input, pressedKey)
+  ])) : undefined;
+  const response = await import_prompts2.default({
     ...options2,
     type: "multiselect",
     instructions: options2.instructions ?? false,
-    hint: options2.hint ?? MULTISELECT_TOGGLE_ALL_HINT
+    hint: typeof hint === "function" ? hint() : hint ?? MULTISELECT_TOGGLE_ALL_HINT,
+    onRender() {
+      promptInstance = this;
+      if (hotkeys) {
+        this.__agentinitHotkeys = hotkeys;
+      } else {
+        delete this.__agentinitHotkeys;
+      }
+      this.hint = typeof hint === "function" ? hint() : hint ?? MULTISELECT_TOGGLE_ALL_HINT;
+      userOnRender?.(this);
+    }
   });
+  if (requestedAction) {
+    response.__agentinitAction = requestedAction;
+  }
+  return response;
 }
 async function selectBundlePlugins(entries, actionLabel, options2 = {}) {
   if (options2.selectAll) {
@@ -41418,11 +42275,86 @@ init_skillsManager();
 init_pluginManager();
 init_marketplaceRegistry();
 init_agentManager();
+init_installLock();
+init_fs();
+
+// dist/utils/lockSource.js
+function lockSourceToSpecifier(source) {
+  if (source.type === "marketplace" && source.marketplace && source.pluginName) {
+    return {
+      source: source.pluginName,
+      from: source.marketplace,
+      ...source.prefix ? { prefix: source.prefix } : {}
+    };
+  }
+  if (source.type === "github") {
+    if (source.owner && source.repo) {
+      return {
+        source: source.subpath ? `${source.owner}/${source.repo}/${source.subpath}` : `${source.owner}/${source.repo}`,
+        ...source.prefix ? { prefix: source.prefix } : {}
+      };
+    }
+    if (source.url) {
+      return { source: source.url, ...source.prefix ? { prefix: source.prefix } : {} };
+    }
+  }
+  if (source.type === "gitlab") {
+    if (source.owner && source.repo) {
+      const prefix = `gitlab:${source.owner}/${source.repo}`;
+      return {
+        source: source.subpath ? `${prefix}//${source.subpath}` : prefix,
+        ...source.prefix ? { prefix: source.prefix } : {}
+      };
+    }
+    if (source.url) {
+      return { source: source.url, ...source.prefix ? { prefix: source.prefix } : {} };
+    }
+  }
+  if (source.type === "bitbucket") {
+    if (source.owner && source.repo) {
+      const prefix = `bitbucket:${source.owner}/${source.repo}`;
+      return {
+        source: source.subpath ? `${prefix}/${source.subpath}` : prefix,
+        ...source.prefix ? { prefix: source.prefix } : {}
+      };
+    }
+    if (source.url) {
+      return { source: source.url, ...source.prefix ? { prefix: source.prefix } : {} };
+    }
+  }
+  if (source.type === "local" && source.path) {
+    return { source: source.path, ...source.prefix ? { prefix: source.prefix } : {} };
+  }
+  return null;
+}
+function formatLockSource(source) {
+  const specifier = lockSourceToSpecifier(source);
+  if (!specifier) {
+    return source.type;
+  }
+  const formatted = specifier.from ? `${specifier.from}/${specifier.source}` : specifier.source;
+  return specifier.prefix ? `${formatted} [prefix: ${specifier.prefix}]` : formatted;
+}
+
+// dist/commands/skills.js
 init_skills();
+var normalizeSkillPrefix = function(prefix) {
+  return prefix?.trim() ?? "";
+};
+var matchesSelectedSkillName = function(skillName, selectedNames, prefix) {
+  if (selectedNames.has(skillName.toLowerCase())) {
+    return true;
+  }
+  const normalizedPrefix = normalizeSkillPrefix(prefix);
+  if (!normalizedPrefix) {
+    return false;
+  }
+  return selectedNames.has(`${normalizedPrefix}${skillName}`.toLowerCase());
+};
 function registerSkillsCommand(program2) {
   const marketplaceHelp = getMarketplaceIds().join(", ");
   const skills3 = program2.command("skills").description("Manage agent skills");
-  skills3.command("add <source>").description("Add skills from a marketplace, GitHub repo, or local path").option("--from <marketplace>", `Marketplace source override (available: ${marketplaceHelp})`).option("-g, --global", "Install skills globally").option("-a, --agent <agents...>", "Target specific agent(s)").option("-s, --skill <names...>", "Install only specific skills by name").option("-l, --list", "List available skills from the source without installing").option("--all", "Select all bundled plugins when the source contains multiple plugins").option("--copy", "Copy skill files instead of symlinking").option("-y, --yes", "Skip prompts, auto-detect project-configured agents, and apply available skill updates").action(async (source, options2) => {
+  skills3.command("add <source>").description("Add skills from a marketplace, hosted Git repo, or local path").option("--from <marketplace>", `Marketplace source override (available: ${marketplaceHelp})`).option("-g, --global", "Install skills globally").option("-a, --agent <agents...>", "Target specific agent(s)").option("-s, --skill <names...>", "Install only specific skills by name").option("-l, --list", "List available skills from the source without installing").option("--all", "Select all bundled plugins when the source contains multiple plugins").option("--copy", "Copy skill files instead of symlinking").option("--prefix <prefix>", "Prefix installed skill names").option("--no-scan", "Skip security scanning before installation").option("--allow-risky", "Install even if scanning finds high-risk patterns").option("-y, --yes", "Skip prompts, auto-detect project-configured agents, and apply available skill updates").action(async (source, options2) => {
     logger.titleBox("AgentInit  Skills");
     const agentManager9 = new AgentManager;
     const skillsManager5 = new SkillsManager(agentManager9);
@@ -41501,11 +42433,12 @@ function registerSkillsCommand(program2) {
     let targetAgents = options2.agent;
     let targetGlobal = options2.global;
     let selectedSkillNames = options2.skill;
+    let installPrefix = options2.prefix;
     if (!options2.yes && (!selectedSkillNames || selectedSkillNames.length === 0) && preparedSkills.length > 1) {
       if (selectedPluginNames && selectedPluginNames.length > 1) {
         logger.info("Multiple bundled plugins selected; installing all skills from each selected plugin. Use --skill to filter by skill name.");
       } else {
-        const skillSelection = await resolveInteractiveSkillSelection(preparedSkills);
+        const skillSelection = await resolveInteractiveSkillSelection(preparedSkills, installPrefix);
         if (skillSelection.aborted) {
           await skillsManager5.discardPreparedSource(source, process.cwd(), {
             from: options2.from
@@ -41513,11 +42446,12 @@ function registerSkillsCommand(program2) {
           return;
         }
         selectedSkillNames = skillSelection.skills;
+        installPrefix = skillSelection.prefix;
       }
     }
     if (!targetAgents && !options2.yes) {
       const selectedSkillNameSet = selectedSkillNames && selectedSkillNames.length > 0 ? new Set(selectedSkillNames.map((name) => name.toLowerCase())) : undefined;
-      const filteredPreviewSkills = selectedSkillNameSet ? preparedSkills.filter((skill) => selectedSkillNameSet.has(skill.name.toLowerCase())) : preparedSkills;
+      const filteredPreviewSkills = selectedSkillNameSet ? preparedSkills.filter((skill) => matchesSelectedSkillName(skill.name, selectedSkillNameSet, installPrefix)) : preparedSkills;
       const selection = await resolveInteractiveSkillTargets(skillsManager5, agentManager9, source, process.cwd(), {
         from: options2.from,
         global: options2.global,
@@ -41550,7 +42484,10 @@ function registerSkillsCommand(program2) {
       ...targetGlobal !== undefined ? { global: targetGlobal } : {},
       ...targetAgents !== undefined ? { agents: targetAgents } : {},
       ...selectedSkillNames !== undefined ? { skills: selectedSkillNames } : {},
+      ...installPrefix !== undefined ? { prefix: installPrefix } : {},
       ...options2.copy !== undefined ? { copy: options2.copy } : {},
+      ...options2.scan !== undefined ? { scan: options2.scan } : {},
+      ...options2.allowRisky !== undefined ? { allowRisky: options2.allowRisky } : {},
       ...pluginName !== undefined ? { pluginName } : {},
       ...options2.yes !== undefined ? { yes: options2.yes } : {},
       ...confirmUpdate !== undefined ? { confirmUpdate } : {}
@@ -41609,7 +42546,7 @@ function registerSkillsCommand(program2) {
       const mode = skill.mode === "symlink" ? " (canonical)" : "";
       const scope = skill.scope === "global" ? " [global]" : "";
       logger.info(`\n  ${green(skill.name)} - ${skill.description}${scope}${mode}`);
-      logger.info(`    Path: ${relative7(process.cwd(), skill.path) || skill.path}`);
+      logger.info(`    Path: ${relative8(process.cwd(), skill.path) || skill.path}`);
       logger.info(`    Agents: ${[...skill.agents].join(", ")}`);
     }
   });
@@ -41648,7 +42585,207 @@ function registerSkillsCommand(program2) {
       logger.info("Nothing to remove.");
     }
   });
+  skills3.command("update [name]").description("Update installed skills from their original source").option("--everywhere", "Update across all tracked projects (uses global lockfile)").option("-d, --dry-run", "Show what would be updated without making changes").action(async (name, options2) => {
+    logger.titleBox("AgentInit  Skills");
+    const installLock3 = new InstallLock;
+    if (options2.everywhere) {
+      if (!name) {
+        logger.error("Skill name is required with --everywhere.");
+        logger.info("Usage: agentinit skills update <name> --everywhere");
+        return;
+      }
+      const entries = await installLock3.findProjectsWithSkill(name);
+      if (entries.length === 0) {
+        logger.info(`No tracked installations found for skill "${name}".`);
+        logger.info(dim("Install the skill first, then update with --everywhere."));
+        return;
+      }
+      logger.info(`Found ${cyan(String(entries.length))} tracked target(s) with skill "${green(name)}":\n`);
+      const staleProjects = [];
+      const updateTargets = [];
+      for (const entry of entries) {
+        const targetLabel = getLockEntryTargetLabel(entry);
+        if (entry.scope !== "global" && !await fileExists(entry.projectPath)) {
+          staleProjects.push(entry.projectPath);
+          logger.info(`  ${red("x")} ${targetLabel} ${dim("(missing)")}`);
+        } else {
+          updateTargets.push(entry);
+          logger.info(`  ${green("+")} ${targetLabel} ${dim(`[${entry.agents.join(", ")}]`)}`);
+        }
+      }
+      if (staleProjects.length > 0) {
+        logger.info("");
+        logger.warn(`${staleProjects.length} project(s) no longer exist. Run "agentinit lock prune" to clean up.`);
+      }
+      if (updateTargets.length === 0) {
+        logger.info("\nNo valid projects to update.");
+        return;
+      }
+      if (options2.dryRun) {
+        logger.info(dim(`
+Dry run \u2014 no changes made.`));
+        return;
+      }
+      logger.info("");
+      const spinner = ora("Updating skills across projects...").start();
+      let updatedCount = 0;
+      let unchangedCount = 0;
+      let failedCount = 0;
+      for (const entry of updateTargets) {
+        spinner.text = `Updating in ${getLockEntryTargetLabel(entry)}...`;
+        try {
+          const sourceString = lockSourceToString(entry.source);
+          if (!sourceString) {
+            failedCount++;
+            logger.info(`  ${red("x")} ${getLockEntryTargetLabel(entry)}: cannot reconstruct source`);
+            continue;
+          }
+          const agentManager9 = new AgentManager;
+          const skillsManager5 = new SkillsManager(agentManager9);
+          const result = await skillsManager5.addFromSource(sourceString.source, entry.projectPath, {
+            ...sourceString.from ? { from: sourceString.from } : {},
+            ...sourceString.prefix ? { prefix: sourceString.prefix } : {},
+            agents: entry.agents,
+            global: entry.scope === "global",
+            skills: [name],
+            yes: true
+          });
+          if (result.updated.length > 0) {
+            updatedCount++;
+            logger.info(`  ${green("~")} ${getLockEntryTargetLabel(entry)}: updated`);
+          } else if (result.installed.length > 0) {
+            updatedCount++;
+            logger.info(`  ${green("+")} ${getLockEntryTargetLabel(entry)}: installed`);
+          } else {
+            unchangedCount++;
+            logger.info(`  ${dim("-")} ${getLockEntryTargetLabel(entry)}: ${dim("unchanged")}`);
+          }
+        } catch (error) {
+          failedCount++;
+          logger.info(`  ${red("x")} ${getLockEntryTargetLabel(entry)}: ${error instanceof Error ? error.message : "unknown error"}`);
+        }
+      }
+      if (updatedCount > 0) {
+        spinner.succeed(`Updated "${name}" in ${updatedCount} target(s)`);
+      } else {
+        spinner.info(`"${name}" is already up to date in all tracked targets`);
+      }
+      if (unchangedCount > 0)
+        logger.info(dim(`  ${unchangedCount} unchanged`));
+      if (failedCount > 0)
+        logger.info(red(`  ${failedCount} failed`));
+    } else {
+      const cwd = process.cwd();
+      const agentManager9 = new AgentManager;
+      const skillsManager5 = new SkillsManager(agentManager9);
+      if (name) {
+        const entries = await installLock3.getCurrentState({
+          kind: "skill",
+          name,
+          projectPath: resolve13(cwd),
+          scope: "project"
+        });
+        if (entries.length === 0) {
+          logger.info(`Skill "${name}" not tracked in the lockfile for this project.`);
+          logger.info(dim("Try: agentinit skills add <source> or use --everywhere for global installs."));
+          return;
+        }
+        if (options2.dryRun) {
+          logger.info(`Would update "${name}" in ${entries.length} tracked target(s):`);
+          for (const entry of entries) {
+            const sourceString = lockSourceToString(entry.source);
+            logger.info(`  ${green(entry.name)} ${dim(`[${entry.agents.join(", ")}]`)} ${sourceString ? dim(sourceString.source) : red("unavailable source")}`);
+          }
+          return;
+        }
+        const spinner = ora(`Updating skill "${name}"...`).start();
+        let updatedCount = 0;
+        let unchangedCount = 0;
+        let failedCount = 0;
+        for (const entry of entries) {
+          const sourceString = lockSourceToString(entry.source);
+          if (!sourceString) {
+            failedCount++;
+            continue;
+          }
+          try {
+            const result = await skillsManager5.addFromSource(sourceString.source, cwd, {
+              ...sourceString.from ? { from: sourceString.from } : {},
+              ...sourceString.prefix ? { prefix: sourceString.prefix } : {},
+              agents: entry.agents,
+              global: entry.scope === "global",
+              skills: [name],
+              yes: true
+            });
+            if (result.updated.length > 0 || result.installed.length > 0) {
+              updatedCount++;
+            } else {
+              unchangedCount++;
+            }
+          } catch {
+            failedCount++;
+          }
+        }
+        if (updatedCount > 0) {
+          spinner.succeed(`Updated "${name}" in ${updatedCount} target(s)`);
+        } else {
+          spinner.info(`"${name}" is already up to date`);
+        }
+        if (unchangedCount > 0)
+          logger.info(dim(`  ${unchangedCount} unchanged`));
+        if (failedCount > 0)
+          logger.info(red(`  ${failedCount} failed`));
+      } else {
+        const entries = await installLock3.getCurrentState({
+          kind: "skill",
+          projectPath: resolve13(cwd),
+          scope: "project"
+        });
+        if (entries.length === 0) {
+          logger.info("No skills tracked in the lockfile for this project.");
+          return;
+        }
+        if (options2.dryRun) {
+          logger.info(`Would update ${entries.length} skill(s):`);
+          for (const entry of entries) {
+            logger.info(`  ${green(entry.name)} ${dim(`[${entry.agents.join(", ")}]`)}`);
+          }
+          return;
+        }
+        const spinner = ora("Updating all skills...").start();
+        let updatedCount = 0;
+        for (const entry of entries) {
+          const sourceString = lockSourceToString(entry.source);
+          if (!sourceString)
+            continue;
+          spinner.text = `Updating "${entry.name}"...`;
+          try {
+            const result = await skillsManager5.addFromSource(sourceString.source, cwd, {
+              ...sourceString.from ? { from: sourceString.from } : {},
+              ...sourceString.prefix ? { prefix: sourceString.prefix } : {},
+              agents: entry.agents,
+              global: entry.scope === "global",
+              skills: [entry.name],
+              yes: true
+            });
+            if (result.updated.length > 0 || result.installed.length > 0) {
+              updatedCount++;
+            }
+          } catch {
+          }
+        }
+        if (updatedCount > 0) {
+          spinner.succeed(`Updated ${updatedCount} skill(s)`);
+        } else {
+          spinner.info("All skills are up to date");
+        }
+      }
+    }
+  });
 }
+var lockSourceToString = function(source) {
+  return lockSourceToSpecifier(source);
+};
 async function resolveInteractiveSkillTargets(skillsManager5, agentManager9, source, projectPath, options2) {
   let installGlobal = !!options2.global;
   if (!options2.global) {
@@ -41721,23 +42858,57 @@ async function resolveInteractiveSkillTargets(skillsManager5, agentManager9, sou
   }
   return selection;
 }
-async function resolveInteractiveSkillSelection(skills3) {
-  const response = await promptMultiselect({
-    name: "skills",
-    message: `Select skills to install (${skills3.length} found):`,
-    min: 1,
-    choices: skills3.map((skill) => ({
-      title: skill.name,
-      value: skill.name,
-      description: skill.description,
-      selected: true
-    }))
-  });
-  if (!response.skills || response.skills.length === 0) {
-    logger.info("No skills selected. Aborting.");
-    return { aborted: true };
+var formatSkillSelectionHint = function(prefix) {
+  return `Press Space to select, A to select or deselect all, p to edit prefix, then Enter to confirm. Prefix: "${prefix}"`;
+};
+async function resolveInteractiveSkillSelection(skills3, initialPrefix) {
+  let prefix = initialPrefix ?? "";
+  let selectedSkills = new Set(skills3.map((skill) => skill.name));
+  const promptForPrefix = async () => {
+    const response = await import_prompts3.default({
+      type: "text",
+      name: "prefix",
+      message: "Prefix to prepend to installed skill names:",
+      initial: prefix
+    });
+    if (typeof response.prefix === "string") {
+      prefix = response.prefix;
+    }
+  };
+  const requestPrefixEdit = (controls) => {
+    controls.requestAction("edit-prefix");
+    controls.closeWithCurrentSelection();
+  };
+  while (true) {
+    const response = await promptMultiselect({
+      name: "skills",
+      message: `Select skills to install (${skills3.length} found):`,
+      min: 1,
+      hint: () => formatSkillSelectionHint(prefix),
+      hotkeys: {
+        p: requestPrefixEdit,
+        P: requestPrefixEdit
+      },
+      choices: skills3.map((skill) => ({
+        title: skill.name,
+        value: skill.name,
+        description: skill.description,
+        selected: selectedSkills.has(skill.name)
+      }))
+    });
+    if (response.skills && response.skills.length > 0) {
+      selectedSkills = new Set(response.skills);
+    }
+    if (response.__agentinitAction === "edit-prefix") {
+      await promptForPrefix();
+      continue;
+    }
+    if (!response.skills || response.skills.length === 0) {
+      logger.info("No skills selected. Aborting.");
+      return { aborted: true };
+    }
+    return { skills: response.skills, prefix };
   }
-  return { skills: response.skills };
 }
 async function getDetectedSkillGroups(agentManager9, projectPath, global3) {
   const detectedAgents = (await agentManager9.detectAgents(projectPath)).map((entry) => entry.agent);
@@ -41772,7 +42943,7 @@ var buildSkillGroups = function(agents, projectPath, global3) {
     dirToAgents.set(skillsDir, existing);
   }
   return Array.from(dirToAgents.entries()).map(([dir, groupedAgents]) => {
-    const canonicalShared = resolve12(dir) === getCanonicalSkillsDirForScope(projectPath, !!global3) && groupedAgents.every((agent) => agent.getProjectSkillsStandard() === "agents");
+    const canonicalShared = resolve13(dir) === getCanonicalSkillsDirForScope(projectPath, !!global3) && groupedAgents.every((agent) => agent.getProjectSkillsStandard() === "agents");
     return {
       dir,
       displayDir: formatSkillsDir(projectPath, dir),
@@ -41795,7 +42966,7 @@ var prependCanonicalGlobalGroup = function(agentManager9, projectPath, groups) {
   if (sharedAgents.length === 0) {
     return groups;
   }
-  const existingCanonicalIndex = groups.findIndex((group) => resolve12(group.dir) === canonicalDir);
+  const existingCanonicalIndex = groups.findIndex((group) => resolve13(group.dir) === canonicalDir);
   if (existingCanonicalIndex >= 0) {
     const existingCanonical = groups[existingCanonicalIndex];
     const remaining = groups.filter((_, index) => index !== existingCanonicalIndex);
@@ -41831,9 +43002,9 @@ var prependCanonicalGlobalGroup = function(agentManager9, projectPath, groups) {
 var formatSkillsDir = function(projectPath, dir) {
   const normalizedDir = dir.replace(/\\/g, "/").replace(/\/?$/, "/");
   const normalizedProjectPath = projectPath.replace(/\\/g, "/");
-  const normalizedHome = homedir6().replace(/\\/g, "/");
+  const normalizedHome = homedir7().replace(/\\/g, "/");
   if (normalizedDir.startsWith(`${normalizedProjectPath}/`)) {
-    return `${relative7(projectPath, dir).replace(/\\/g, "/").replace(/\/?$/, "/")}`;
+    return `${relative8(projectPath, dir).replace(/\\/g, "/").replace(/\/?$/, "/")}`;
   }
   if (normalizedDir.startsWith(`${normalizedHome}/`)) {
     return normalizedDir.replace(normalizedHome, "~");
@@ -41842,7 +43013,7 @@ var formatSkillsDir = function(projectPath, dir) {
 };
 var formatPromptPath = function(path) {
   const normalizedPath = path.replace(/\\/g, "/").replace(/\/?$/, "/");
-  const normalizedHome = homedir6().replace(/\\/g, "/");
+  const normalizedHome = homedir7().replace(/\\/g, "/");
   if (normalizedPath === `${normalizedHome}/`) {
     return "~/";
   }
@@ -41852,10 +43023,10 @@ var formatPromptPath = function(path) {
   return normalizedPath;
 };
 var getCanonicalGlobalSkillsDir = function() {
-  return resolve12(homedir6(), ".agents/skills");
+  return resolve13(homedir7(), ".agents/skills");
 };
 var getCanonicalSkillsDirForScope = function(projectPath, global3) {
-  return global3 ? getCanonicalGlobalSkillsDir() : resolve12(projectPath, ".agents/skills");
+  return global3 ? getCanonicalGlobalSkillsDir() : resolve13(projectPath, ".agents/skills");
 };
 var getCanonicalGlobalSkillsDisplayPath = function() {
   return formatPromptPath(getCanonicalGlobalSkillsDir());
@@ -42045,7 +43216,7 @@ var displayInstallResult = function(result, spinner, agentManager9, skillsManage
       byPath.set(path, existing);
     }
     for (const [path, details] of byPath) {
-      logger.info(`  ${relative7(process.cwd(), path) || path}`);
+      logger.info(`  ${relative8(process.cwd(), path) || path}`);
       logger.info(`    Agents: ${[...details.agents].join(", ")}`);
       logger.info(`    Skills: ${green(String(details.skills.size))} installed (${[...details.skills].join(", ")})`);
     }
@@ -42061,7 +43232,7 @@ var displayInstallResult = function(result, spinner, agentManager9, skillsManage
       byPathUpdated.set(path, existing);
     }
     for (const [path, details] of byPathUpdated) {
-      logger.info(`  ${relative7(process.cwd(), path) || path}`);
+      logger.info(`  ${relative8(process.cwd(), path) || path}`);
       logger.info(`    Agents: ${[...details.agents].join(", ")}`);
       logger.info(`    Skills: ${yellow(String(details.skills.size))} updated (${[...details.skills].join(", ")})`);
     }
@@ -42089,8 +43260,11 @@ var displayInstallResult = function(result, spinner, agentManager9, skillsManage
 };
 
 // dist/commands/mcp.js
+init_colors();
+init_logger();
 init_mcpFilter();
 init_agentManager();
+init_installLock();
 var filterMcpArgs = function(args) {
   const filtered = [];
   let i = 0;
@@ -42282,6 +43456,28 @@ var registerAddCommand = function(mcp) {
             logger.info(`  ${cyan(server.name)} (${typeLabel}): ${server.url}`);
           }
         });
+        try {
+          const lock = new InstallLock;
+          const lockSource2 = { type: "local" };
+          for (const plan of plans) {
+            for (const server of plan.servers) {
+              await lock.recordMcp({
+                action: "install",
+                name: server.name,
+                projectPath: cwd,
+                agents: [plan.agent.id],
+                scope: plan.isGlobal ? "global" : "project",
+                source: lockSource2,
+                configPath: plan.configPath,
+                serverType: server.type,
+                ...server.command ? { command: server.command } : {},
+                ...server.url ? { url: server.url } : {}
+              });
+            }
+          }
+        } catch (error) {
+          logLockWriteWarning("MCP servers were added successfully", error);
+        }
       }
     } catch (error) {
       spinner.fail("Failed to add MCP servers");
@@ -42375,8 +43571,12 @@ var registerRemoveCommand = function(mcp) {
       }
       let removedCount = 0;
       let failedCount = 0;
+      const removedTargets = [];
       for (const { agent, isGlobal: global3 } of targets) {
         try {
+          const configPath = global3 ? agent.getGlobalMcpPath() : agent.getNativeMcpPath(cwd);
+          const existingServers = global3 ? await agent.getGlobalMCPServers().catch(() => []) : await agent.getMCPServers(cwd).catch(() => []);
+          const existingServer = existingServers.find((server) => server.name.toLowerCase() === name.toLowerCase());
           let removed;
           if (global3) {
             removed = await agent.removeGlobalMCPServer(name);
@@ -42385,6 +43585,14 @@ var registerRemoveCommand = function(mcp) {
           }
           if (removed) {
             removedCount++;
+            if (configPath) {
+              removedTargets.push({
+                agent,
+                isGlobal: global3,
+                configPath,
+                ...existingServer ? { server: existingServer } : {}
+              });
+            }
             logger.info(`  ${green("-")} ${agent.name}: removed "${name}"`);
           } else {
             logger.info(`  ${yellow("~")} ${agent.name}: "${name}" not found`);
@@ -42396,6 +43604,25 @@ var registerRemoveCommand = function(mcp) {
       }
       if (removedCount > 0) {
         spinner.succeed(`Removed "${name}" from ${removedCount} agent(s)`);
+        try {
+          const lock = new InstallLock;
+          for (const { agent, isGlobal: global3, configPath, server } of removedTargets) {
+            await lock.recordMcp({
+              action: "remove",
+              name,
+              projectPath: cwd,
+              agents: [agent.id],
+              scope: global3 ? "global" : "project",
+              source: { type: "local" },
+              configPath,
+              serverType: server?.type || "stdio",
+              ...server?.command ? { command: server.command } : {},
+              ...server?.url ? { url: server.url } : {}
+            });
+          }
+        } catch (error) {
+          logLockWriteWarning("MCP servers were removed successfully", error);
+        }
       } else if (failedCount > 0) {
         spinner.fail(`Failed to remove "${name}"`);
       } else {
@@ -42584,8 +43811,11 @@ var KNOWN_ADD_OPTIONS = {
 };
 
 // dist/commands/rules.js
+init_colors();
+init_logger();
 init_agentManager();
 init_fs();
+init_installLock();
 var colorizeTokenCount2 = function(tokenCount) {
   if (tokenCount <= TOKEN_COUNT_THRESHOLDS.LOW)
     return green(tokenCount.toString());
@@ -42774,6 +44004,29 @@ function registerRulesCommand(program2) {
           }
         }
       }
+      try {
+        const lock = new InstallLock;
+        for (const { agent, result } of results) {
+          if (!result.success || result.rulesApplied === 0)
+            continue;
+          const sections = result.mergedSections || uniqueSections;
+          for (const section of sections) {
+            await lock.recordRules({
+              action: "install",
+              name: section.templateId,
+              projectPath: cwd,
+              agents: [agent.id],
+              scope: isGlobal ? "global" : "project",
+              source: { type: "local" },
+              configPath: result.configPath || "",
+              templateIds: [section.templateId],
+              ruleCount: section.rules.length
+            });
+          }
+        }
+      } catch (error) {
+        logLockWriteWarning("Rules were applied successfully", error);
+      }
     } catch (error) {
       spinner.fail("Failed to apply rules");
       logger.error(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
@@ -42836,6 +44089,7 @@ function registerRulesCommand(program2) {
     const agents = await resolveTargetAgents(agentManager11, options2, cwd);
     const spinner = ora("Removing rules...").start();
     let totalRemoved = 0;
+    const removedSections = [];
     try {
       for (const agent of agents) {
         if (!agent.capabilities.rules) {
@@ -42859,6 +44113,9 @@ function registerRulesCommand(program2) {
         const updatedContent = await agent.applyRulesConfig(configPath, buildAppliedRules(remaining), content);
         await writeFile(configPath, updatedContent);
         totalRemoved += removed.length;
+        for (const section of removed) {
+          removedSections.push({ agent, configPath, section });
+        }
         for (const s of removed) {
           logger.info(`  ${agent.name}: removed ${green(s.templateName)} (${s.rules.length} rules)`);
         }
@@ -42868,6 +44125,24 @@ function registerRulesCommand(program2) {
         logger.info('Run "agentinit rules list" to see current sections.');
       } else {
         spinner.succeed(`Removed ${totalRemoved} rule section${totalRemoved !== 1 ? "s" : ""}`);
+        try {
+          const lock = new InstallLock;
+          for (const { agent, configPath, section } of removedSections) {
+            await lock.recordRules({
+              action: "remove",
+              name: section.templateId,
+              projectPath: cwd,
+              agents: [agent.id],
+              scope: isGlobal ? "global" : "project",
+              source: { type: "local" },
+              configPath,
+              templateIds: [section.templateId],
+              ruleCount: 0
+            });
+          }
+        } catch (error) {
+          logLockWriteWarning("Rules were removed successfully", error);
+        }
       }
     } catch (error) {
       spinner.fail("Failed to remove rules");
@@ -42879,8 +44154,9 @@ function registerRulesCommand(program2) {
 
 // dist/commands/plugins.js
 var import_prompts4 = __toESM(require_prompts3(), 1);
-import {homedir as homedir7} from "os";
-import {dirname as dirname9, relative as relative8, resolve as resolve13} from "path";
+import {homedir as homedir8} from "os";
+import {dirname as dirname10, relative as relative9, resolve as resolve14} from "path";
+init_logger();
 init_pluginManager();
 init_agentManager();
 init_marketplaceRegistry();
@@ -43232,7 +44508,7 @@ function registerPluginsCommand(program2) {
 }
 var formatPathForDisplay = function(pathValue, projectPath) {
   if (pathValue.startsWith(`${projectPath}/`)) {
-    return relative8(projectPath, pathValue) || ".";
+    return relative9(projectPath, pathValue) || ".";
   }
   const homePrefix = `${process.env.HOME || ""}/`;
   if (homePrefix !== "/" && pathValue.startsWith(homePrefix)) {
@@ -43422,7 +44698,7 @@ var renderPluginWarnings = function(previewOrResult, projectPath) {
 var renderInstalledComponents = function(result, agentManager12, projectPath) {
   const skillGroups = new Map;
   for (const item of result.skills.installed) {
-    const targetDir = dirname9(item.path);
+    const targetDir = dirname10(item.path);
     const existing = skillGroups.get(targetDir) || { agents: new Set, skillNames: new Set };
     existing.agents.add(item.agent);
     existing.skillNames.add(item.name);
@@ -43500,7 +44776,7 @@ var buildGlobalPluginGroups = function(agentManager12, projectPath) {
     compatibleAgentNames: [],
     kind: "native"
   }));
-  const canonicalDir = resolve13(homedir7(), ".agents/skills");
+  const canonicalDir = resolve14(homedir8(), ".agents/skills");
   const sharedAgents = agentManager12.getAllAgents().filter((agent) => agent.supportsSkills() && agent.getProjectSkillsStandard() === "agents" && !!agent.getSkillsDir(projectPath, true));
   const claudeGroups = nativeGroups.filter((group) => group.agents.some((agent) => agent.id === "claude"));
   const otherGroups = nativeGroups.filter((group) => !group.agents.some((agent) => agent.id === "claude"));
@@ -43610,7 +44886,148 @@ async function interactiveAgentSelect(pluginManager3, agentManager12, projectPat
   } : undefined;
 }
 
+// dist/commands/lock.js
+init_colors();
+init_logger();
+init_installLock();
+import {resolve as resolve15} from "path";
+var formatTimestamp = function(iso) {
+  const date = new Date(iso);
+  return date.toLocaleDateString("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric"
+  });
+};
+var formatKind = function(kind) {
+  switch (kind) {
+    case "skill":
+      return cyan("skill");
+    case "mcp":
+      return yellow("mcp");
+    case "rules":
+      return green("rules");
+  }
+};
+var formatSource = function(entry) {
+  return formatLockSource(entry.source);
+};
+function registerLockCommand(program2) {
+  const lock = program2.command("lock").description("View and manage the global install lockfile");
+  lock.command("list").alias("ls").description("List all tracked installations across projects").option("--kind <kind>", "Filter by kind: skill, mcp, rules").option("--project <path>", "Filter by project path").option("--agent <agent>", "Filter by agent ID").option("--scope <scope>", "Filter by scope: project or global").action(async (options2) => {
+    const installLock6 = new InstallLock;
+    const queryOptions = {};
+    if (options2.kind)
+      queryOptions.kind = options2.kind;
+    if (options2.project)
+      queryOptions.projectPath = resolve15(options2.project);
+    if (options2.agent)
+      queryOptions.agent = options2.agent;
+    if (options2.scope)
+      queryOptions.scope = options2.scope;
+    const entries = await installLock6.getCurrentState(queryOptions);
+    if (entries.length === 0) {
+      logger.info("No installations tracked in the lockfile.");
+      logger.info(dim("Install skills, MCPs, or rules to start tracking."));
+      return;
+    }
+    const byProject = new Map;
+    for (const entry of entries) {
+      const key = entry.scope === "global" ? "global" : entry.projectPath;
+      const group = byProject.get(key) || { label: getLockEntryTargetLabel(entry), entries: [] };
+      group.entries.push(entry);
+      byProject.set(key, group);
+    }
+    for (const { label, entries: projectEntries } of byProject.values()) {
+      logger.info(`\n${cyan(label)}`);
+      for (const entry of projectEntries) {
+        const kind = formatKind(entry.kind);
+        const scope = entry.scope === "global" ? dim(" (global)") : "";
+        const agents = dim(`[${entry.agents.join(", ")}]`);
+        const date = dim(formatTimestamp(entry.timestamp));
+        const source = dim(formatSource(entry));
+        logger.info(`  ${kind}  ${green(entry.name)}  ${agents}${scope}  ${source}  ${date}`);
+      }
+    }
+    logger.info("");
+    logger.info(dim(`${entries.length} installation(s) across ${byProject.size} target(s)`));
+  });
+  lock.command("status").description("Show summary of tracked installations").option("--check-drift", "Check for modified skill files (compares content hashes)").action(async (options2) => {
+    const installLock6 = new InstallLock;
+    const entries = await installLock6.getCurrentState();
+    if (entries.length === 0) {
+      logger.info("No installations tracked in the lockfile.");
+      return;
+    }
+    const projects = new Set(entries.filter((entry) => entry.scope === "project").map((entry) => entry.projectPath));
+    const globalTargets = entries.filter((entry) => entry.scope === "global");
+    const skills3 = entries.filter((e) => e.kind === "skill");
+    const mcps = entries.filter((e) => e.kind === "mcp");
+    const rules = entries.filter((e) => e.kind === "rules");
+    logger.info(`Projects: ${cyan(projects.size.toString())}`);
+    logger.info(`Global targets: ${cyan(globalTargets.length.toString())}`);
+    logger.info(`Skills:   ${green(skills3.length.toString())}`);
+    logger.info(`MCPs:     ${yellow(mcps.length.toString())}`);
+    logger.info(`Rules:    ${green(rules.length.toString())}`);
+    const stale = await installLock6.findStaleProjects();
+    if (stale.length > 0) {
+      logger.info("");
+      logger.info(`${red("Stale projects:")} ${stale.length}`);
+      for (const path of stale) {
+        logger.info(`  ${red("x")} ${path}`);
+      }
+      logger.info(dim('Run "agentinit lock prune" to clean up.'));
+    }
+    if (options2.checkDrift) {
+      logger.info("");
+      logger.info("Checking for drift...");
+      let driftCount = 0;
+      let missingCount = 0;
+      for (const entry of skills3) {
+        if (!entry.contentHash)
+          continue;
+        const result = await installLock6.checkDrift(entry);
+        if (result.status === "drift") {
+          driftCount++;
+          logger.info(`  ${yellow("~")} ${entry.name} in ${entry.projectPath}`);
+        } else if (result.status === "missing") {
+          missingCount++;
+          logger.info(`  ${red("x")} ${entry.name} in ${entry.projectPath} ${dim("(missing)")}`);
+        }
+      }
+      if (driftCount === 0 && missingCount === 0) {
+        logger.info(`  ${green("All skills match their installed hashes.")}`);
+      } else {
+        if (driftCount > 0)
+          logger.info(`  ${driftCount} skill(s) modified since install`);
+        if (missingCount > 0)
+          logger.info(`  ${missingCount} skill(s) missing from disk`);
+      }
+    }
+  });
+  lock.command("prune").description("Remove entries for projects that no longer exist on disk").option("-d, --dry-run", "Show what would be removed without changing the lockfile").action(async (options2) => {
+    const installLock6 = new InstallLock;
+    const stale = await installLock6.findStaleProjects();
+    if (stale.length === 0) {
+      logger.info("No stale projects found. Lockfile is clean.");
+      return;
+    }
+    logger.info(`Found ${stale.length} stale project(s):`);
+    for (const path of stale) {
+      logger.info(`  ${red("x")} ${path}`);
+    }
+    if (options2.dryRun) {
+      logger.info(dim(`
+Dry run \u2014 no changes made.`));
+      return;
+    }
+    const result = await installLock6.pruneStaleEntries();
+    logger.info(`\nRemoved ${result.entriesRemoved} entries for ${result.prunedProjects.length} stale project(s).`);
+  });
+}
+
 // dist/cli.js
+init_logger();
 var program2 = new Command;
 program2.name("agentinit").description("A CLI tool for managing and configuring AI coding agents").version("1.0.1");
 registerSkillsCommand(program2);
@@ -43618,6 +45035,7 @@ registerMcpCommand(program2);
 registerRulesCommand(program2);
 registerPluginsCommand(program2);
 registerConfigCommand(program2);
+registerLockCommand(program2);
 program2.command("init").description("Initialize agents.md configuration for the current project").option("-f, --force", "Overwrite existing configuration").option("-t, --template <template>", "Use specific template (web, cli, library)").action(initCommand);
 program2.command("detect").description("Detect current project stack and existing agent configurations").option("-v, --verbose", "Show detailed detection results").action(detectCommand);
 program2.command("sync").description("Sync agents.md with agent-specific configuration files").option("-a, --agent <agents...>", "Target specific agent(s)").option("-d, --dry-run", "Show what would be changed without making changes").option("-b, --backup", "Create backup before syncing").action(syncCommand);