cue-ai 0.4.0 → 0.5.0

package/src/commands/security.ts

@@ -14,12 +14,14 @@
 import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
 
 import { listAllSkillIds } from "../lib/resolver-local";
 import { loadProfile, listProfiles } from "../lib/profile-loader";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const SKILLS_ROOT = join(REPO_ROOT, "resources", "skills", "skills");
+const GLOBAL_SKILLS_ROOT = join(homedir(), ".claude", "skills");
 
 interface SecurityIssue {
   code: string;
@@ -123,24 +125,37 @@ const RULES: { code: string; severity: "critical" | "high" | "medium"; patterns:
 ];
 
 function scanSkill(id: string): SecurityIssue[] {
-  const path = join(SKILLS_ROOT, id, "SKILL.md");
+  // Try both local repo skills and global ~/.claude/skills
+  let path = join(SKILLS_ROOT, id, "SKILL.md");
+  if (!existsSync(path)) path = join(GLOBAL_SKILLS_ROOT, id, "SKILL.md");
   if (!existsSync(path)) return [];
 
   const content = readFileSync(path, "utf8");
   const lines = content.split("\n");
   const issues: SecurityIssue[] = [];
 
-  // Context-aware skipping: many skills are documentation/examples, not instructions
-  const isSecuritySkill = /security|review|audit|pentest|vuln/i.test(id);
-  const isMetaSkill = /skill-evolution|builtin-manager|doctor|help|omx|plugin-creator|save-profile/i.test(id);
+  // Context-aware skipping: determine skill category from its frontmatter
+  const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+  const frontmatter = fmMatch?.[1] ?? "";
+  const description = (frontmatter.match(/^description:\s*(.+)/m)?.[1] ?? "").toLowerCase();
+  const tags = (frontmatter.match(/^tags:\s*\[([^\]]*)\]/m)?.[1] ?? "").toLowerCase();
+  const category = (frontmatter.match(/^category:\s*(.+)/m)?.[1] ?? "").toLowerCase();
+  const allMeta = `${id} ${description} ${tags} ${category}`;
+
+  const isSecuritySkill = /security|pentest|vuln|incident|forensic|malware|threat|exploit|dfir|siem|red.?team|blue.?team|cybersecurity|infosec|soc|hardening|compliance|review\//i.test(allMeta);
+  const isMetaSkill = /^meta\/|category:\s*meta/i.test(`${id}\n${frontmatter}`);
   const isApiDocSkill = /hostinger|medusa|stripe|coolify|deployment|kiro/i.test(id);
   const isDesignSkill = /design|remotion|higgsfield|imagegen/i.test(id);
   const isOrchSkill = /colony|pipeline|fleet|orchestration|worker/i.test(id);
   const isResearchSkill = /research|find-skills|openai-docs/i.test(id);
+  // Global skills (in ~/.claude/skills but not in repo) are typically from
+  // curated packs (cybersecurity, etc) — treat as educational content
+  const isGlobalPack = existsSync(join(GLOBAL_SKILLS_ROOT, id, "SKILL.md")) &&
+    !existsSync(join(SKILLS_ROOT, id, "SKILL.md"));
 
   for (const rule of RULES) {
     // Skip rules for skill categories where these patterns are expected documentation
-    if (isSecuritySkill && ["SEC1", "SEC4", "SEC5"].includes(rule.code)) continue;
+    if ((isSecuritySkill || isGlobalPack) && ["SEC1", "SEC2", "SEC3", "SEC4", "SEC5"].includes(rule.code)) continue;
     if (isMetaSkill && ["SEC4", "SEC5"].includes(rule.code)) continue;
     if (isApiDocSkill && ["SEC1", "SEC2", "SEC5"].includes(rule.code)) continue;
     if (isDesignSkill && ["SEC2"].includes(rule.code)) continue;
@@ -151,8 +166,12 @@ function scanSkill(id: string): SecurityIssue[] {
       const line = lines[i]!;
 
       // Skip lines that are clearly safe contexts
-      if (/\b(MUST NOT|must not|do not|don't|never|avoid|reject)\b/i.test(line)) continue;
+      if (/\b(MUST NOT|must not|do not|don't|never|avoid|reject|block|forbid|disallow|detect|flag|warn|alert)\b/i.test(line)) continue;
       if (/^#|^\/\/|^\s*\*|NEVER|prohibited/i.test(line.trim())) continue;
+      // Skip lines that list things to detect/block/remove (security documentation)
+      if (/^-\s*(Remove|Add|Block|Detect|Flag|Check|Scan|Verify|Validate|Ensure)/i.test(line.trim())) continue;
+      // Skip lines about checking/testing for vulnerabilities (security review tools)
+      if (/\b(check|test|scan|verify|detect|audit|review|validate|ensure|confirm)\b.*\b(key|secret|token|credential|exposed|leak)/i.test(line)) continue;
       // Skip lines inside code blocks (``` fenced) — these are examples
       if (/^```/.test(line.trim())) continue;
       // Skip lines that are curl examples showing API usage (documentation)
@@ -228,6 +247,17 @@ Examples:
 
   if (all) {
     skillIds = await listAllSkillIds();
+    // Also include global skills from ~/.claude/skills/
+    if (existsSync(GLOBAL_SKILLS_ROOT)) {
+      try {
+        const globalDirs = readdirSync(GLOBAL_SKILLS_ROOT, { withFileTypes: true });
+        for (const d of globalDirs) {
+          if (d.isDirectory() && existsSync(join(GLOBAL_SKILLS_ROOT, d.name, "SKILL.md"))) {
+            if (!skillIds.includes(d.name)) skillIds.push(d.name);
+          }
+        }
+      } catch { /* skip */ }
+    }
   } else if (profileName) {
     try {
       const profile = await loadProfile(profileName);
@@ -237,8 +267,18 @@ Examples:
       return 1;
     }
   } else {
-    // Default: scan all
+    // Default: scan all (local + global)
     skillIds = await listAllSkillIds();
+    if (existsSync(GLOBAL_SKILLS_ROOT)) {
+      try {
+        const globalDirs = readdirSync(GLOBAL_SKILLS_ROOT, { withFileTypes: true });
+        for (const d of globalDirs) {
+          if (d.isDirectory() && existsSync(join(GLOBAL_SKILLS_ROOT, d.name, "SKILL.md"))) {
+            if (!skillIds.includes(d.name)) skillIds.push(d.name);
+          }
+        }
+      } catch { /* skip */ }
+    }
   }
 
   process.stderr.write(`🔒 Scanning ${skillIds.length} skills for security issues...\n\n`);

package/src/commands/shell.ts

@@ -183,6 +183,23 @@ exec "${cueBin}" launch codex "$@"
 
     process.stdout.write(`\nAdd the shell hook to auto-switch profiles on cd:\n`);
     process.stdout.write(`  echo 'eval "$(cue shell hook)"' >> ~/.bashrc\n`);
+
+    // Auto-install completions
+    const shell = process.env.SHELL ?? "/bin/bash";
+    const { completionScript } = await import("./completions");
+    if (shell.includes("zsh")) {
+      const compDir = join(homedir(), ".zsh", "completions");
+      mkdirSync(compDir, { recursive: true });
+      writeFileSync(join(compDir, "_cue"), completionScript("zsh"));
+      process.stdout.write(`✅ Installed zsh completions → ${compDir}/_cue\n`);
+      process.stdout.write(`   Add to .zshrc: fpath=(~/.zsh/completions $fpath); autoload -Uz compinit && compinit\n`);
+    } else if (shell.includes("bash")) {
+      const compDir = join(homedir(), ".local", "share", "bash-completion", "completions");
+      mkdirSync(compDir, { recursive: true });
+      writeFileSync(join(compDir, "cue"), completionScript("bash"));
+      process.stdout.write(`✅ Installed bash completions → ${compDir}/cue\n`);
+    }
+
     return 0;
   }
 

package/src/commands/skills.ts

@@ -824,10 +824,10 @@ async function cmdRank(args: string[]): Promise<number> {
   // Scan session transcripts for skill reads
   const usage = new Map<string, number>();
   try {
-    const res = spawnSync("grep", ["-roh", "skills/[a-z][a-z0-9-]*/SKILL.md", projectsDir], {
+    const res = spawnSync("grep", ["-roh", "--include=*.jsonl", "-m", "500", "skills/[a-z][a-z0-9-]*/SKILL.md", projectsDir], {
       stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8",
-      timeout: 15000,
+      timeout: 3000,
     });
     if (res.status === 0 && res.stdout) {
       for (const line of res.stdout.split("\n")) {

package/src/commands/status.ts

@@ -142,6 +142,19 @@ export async function run(args: string[]): Promise<number> {
   const yellow = (s: string) => `\x1b[33m${s}\x1b[0m`;
   const red = (s: string) => `\x1b[31m${s}\x1b[0m`;
 
+  // First-run detection
+  const isFirstRun = !existsSync(RUNTIME_ROOT) && !hasProfile && totalSessions === 0;
+  if (isFirstRun) {
+    process.stdout.write("\n");
+    process.stdout.write(`  ${bold("Welcome to cue!")} Agent Profile Manager for Claude Code & Codex\n\n`);
+    process.stdout.write(`  Get started:\n`);
+    process.stdout.write(`    ${bold("cue init")}           Set up a profile for this project\n`);
+    process.stdout.write(`    ${bold("cue list")}           See all available profiles\n`);
+    process.stdout.write(`    ${bold("cue shell install")}  Install shims so \`claude\` uses cue\n`);
+    process.stdout.write(`\n  ${dim("Run cue --help for all commands.")}\n\n`);
+    return 0;
+  }
+
   process.stdout.write("\n");
 
   // Profile section
@@ -153,6 +166,7 @@ export async function run(args: string[]): Promise<number> {
     }
   } else {
     process.stdout.write(`  ${bold("Profile")}  ${dim("none pinned for this directory")}\n`);
+    process.stdout.write(`  ${dim("→ Run")} ${bold("cue init")} ${dim("to set up a profile for this project")}\n`);
   }
 
   process.stdout.write("\n");

package/src/commands/suggest.ts

@@ -0,0 +1,170 @@
+/**
+ * `cue suggest` — profile recommendations based on usage patterns.
+ */
+
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+
+import { loadProfile, listProfiles } from "../lib/profile-loader";
+import { resolveProfileForCwd } from "../lib/cwd-resolver";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const SKILLS_ROOT = join(REPO_ROOT, "resources", "skills", "skills");
+
+export async function run(args: string[]): Promise<number> {
+  if (args.includes("-h") || args.includes("--help")) {
+    process.stdout.write(`cue suggest — profile recommendations based on your usage
+
+Usage:
+  cue suggest              Analyze current profile and suggest improvements
+  cue suggest --json       Machine-readable output
+`);
+    return 0;
+  }
+
+  const json = args.includes("--json");
+  let profileName: string | undefined;
+  try {
+    const result = await resolveProfileForCwd({ cwd: process.cwd(), homeDir: homedir(), configDir: join(homedir(), ".config", "cue") });
+    if (result.source !== "none") profileName = result.profile;
+  } catch {}
+
+  if (!profileName) {
+    process.stderr.write("No active profile. Pin one first: cue use <profile>\n");
+    return 1;
+  }
+
+  const profile = await loadProfile(profileName);
+  const skillIds = profile.skills.local.map(s => s.id).filter(s => !s.includes("*"));
+
+  const bold = (s: string) => `\x1b[1m${s}\x1b[0m`;
+  const green = (s: string) => `\x1b[32m${s}\x1b[0m`;
+  const yellow = (s: string) => `\x1b[33m${s}\x1b[0m`;
+  const dim = (s: string) => `\x1b[2m${s}\x1b[0m`;
+
+  const suggestions: { type: string; message: string; action: string }[] = [];
+
+  // 1. Find unused skills (not referenced in recent sessions)
+  const usedSkills = scanRecentUsage(skillIds);
+  const unused = skillIds.filter(id => !usedSkills.has(id));
+  if (unused.length > 0) {
+    suggestions.push({
+      type: "remove",
+      message: `${unused.length} skill(s) loaded but never used in recent sessions`,
+      action: `cue skills remove-from-profile ${unused[0]}`,
+    });
+  }
+
+  // 2. Find skills used in sessions but NOT in the profile
+  const allSkillSlugs = getAllSkillSlugs();
+  const missingSkills = findMissingSkills(skillIds, allSkillSlugs);
+  if (missingSkills.length > 0) {
+    suggestions.push({
+      type: "add",
+      message: `${missingSkills.length} skill(s) used in sessions but not in your profile`,
+      action: `cue skills add-to-profile ${missingSkills[0]}`,
+    });
+  }
+
+  // 3. Check if a different profile would be a better fit
+  const allProfiles = await listProfiles();
+  let bestAlt: { name: string; overlap: number } | null = null;
+  for (const name of allProfiles) {
+    if (name === profileName || name.startsWith("_")) continue;
+    try {
+      const alt = await loadProfile(name);
+      const altSkills = new Set(alt.skills.local.map(s => s.id));
+      const overlap = [...usedSkills].filter(s => altSkills.has(s)).length;
+      if (!bestAlt || overlap > bestAlt.overlap) bestAlt = { name, overlap };
+    } catch {}
+  }
+  if (bestAlt && bestAlt.overlap > usedSkills.size * 0.8 && bestAlt.name !== profileName) {
+    suggestions.push({
+      type: "switch",
+      message: `Profile "${bestAlt.name}" covers ${bestAlt.overlap}/${usedSkills.size} of your used skills`,
+      action: `cue diff --live ${bestAlt.name}`,
+    });
+  }
+
+  // 4. Token budget warning
+  const tokens = skillIds.reduce((sum, id) => {
+    try { return sum + Math.ceil(readFileSync(join(SKILLS_ROOT, id, "SKILL.md"), "utf8").length / 4); } catch { return sum; }
+  }, 0);
+  if (tokens > 30000) {
+    suggestions.push({
+      type: "optimize",
+      message: `Token budget is ${(tokens / 1000).toFixed(0)}k — consider splitting into focused sub-profiles`,
+      action: `cue cost --compare`,
+    });
+  }
+
+  if (json) {
+    process.stdout.write(JSON.stringify({ profile: profileName, suggestions }, null, 2) + "\n");
+    return 0;
+  }
+
+  process.stdout.write(`\n  💡 Suggestions for ${bold(profileName)}\n\n`);
+
+  if (suggestions.length === 0) {
+    process.stdout.write(`  ${green("✓")} Profile looks well-optimized. No suggestions.\n\n`);
+    return 0;
+  }
+
+  for (const s of suggestions) {
+    const icon = s.type === "remove" ? "🗑️" : s.type === "add" ? "➕" : s.type === "switch" ? "🔄" : "⚡";
+    process.stdout.write(`  ${icon}  ${s.message}\n`);
+    process.stdout.write(`     ${dim("→")} ${s.action}\n\n`);
+  }
+
+  return 0;
+}
+
+function scanRecentUsage(skillIds: string[]): Set<string> {
+  const projectsDir = join(homedir(), ".claude", "projects");
+  const used = new Set<string>();
+  if (!existsSync(projectsDir)) return used;
+
+  const slugs = skillIds.map(id => id.split("/").pop()!);
+  try {
+    const dirs = readdirSync(projectsDir).filter(d => {
+      try { return statSync(join(projectsDir, d)).isDirectory(); } catch { return false; }
+    });
+    for (const dir of dirs.slice(-10)) { // last 10 project dirs
+      const files = readdirSync(join(projectsDir, dir))
+        .filter(f => f.endsWith(".jsonl")).sort().slice(-3);
+      for (const f of files) {
+        try {
+          const fd = require("node:fs").openSync(join(projectsDir, dir, f), "r");
+          const buf = Buffer.alloc(50_000);
+          const n = require("node:fs").readSync(fd, buf, 0, 50_000, 0);
+          require("node:fs").closeSync(fd);
+          const content = buf.toString("utf8", 0, n);
+          for (let i = 0; i < slugs.length; i++) {
+            if (content.includes(slugs[i]!)) used.add(skillIds[i]!);
+          }
+        } catch {}
+      }
+    }
+  } catch {}
+  return used;
+}
+
+function getAllSkillSlugs(): Set<string> {
+  const slugs = new Set<string>();
+  try {
+    const cats = readdirSync(SKILLS_ROOT, { withFileTypes: true }).filter(d => d.isDirectory());
+    for (const cat of cats) {
+      const skills = readdirSync(join(SKILLS_ROOT, cat.name), { withFileTypes: true }).filter(d => d.isDirectory());
+      for (const s of skills) slugs.add(`${cat.name}/${s.name}`);
+    }
+  } catch {}
+  return slugs;
+}
+
+function findMissingSkills(profileSkills: string[], allSlugs: Set<string>): string[] {
+  // This is a simplified version — in production you'd scan sessions for skill refs
+  // that aren't in the profile. For now, return empty.
+  return [];
+}

package/src/commands/upgrade.ts

@@ -0,0 +1,154 @@
+/**
+ * `cue upgrade` — pull new skills/profiles from the registry without a full git pull.
+ *
+ * Checks the remote registry for updates and shows what's new.
+ * With --apply, downloads and installs new skills into profiles.
+ */
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join, resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const REGISTRY_PATH = join(REPO_ROOT, "docs", "registry", "index.json");
+const REGISTRY_URL = "https://recodeee.github.io/cue/registry/index.json";
+const UPGRADE_STATE = join(REPO_ROOT, "profiles", "_cache", "last-upgrade.json");
+
+interface RegistrySkill {
+  id: string; name: string; description: string;
+  repo: string; path: string; tags: string[];
+  requires: string[]; profile: string;
+}
+
+interface Registry {
+  version: number; updated: string;
+  skills: RegistrySkill[];
+  mcps: { id: string; name: string; description: string; repo: string; install: string; tags: string[] }[];
+}
+
+function fetchRemoteRegistry(): Registry | null {
+  const res = spawnSync("curl", ["-sfL", "--max-time", "10", REGISTRY_URL], { encoding: "utf8" });
+  if (res.status === 0 && res.stdout) {
+    try { return JSON.parse(res.stdout); } catch {}
+  }
+  return null;
+}
+
+function loadLocalRegistry(): Registry | null {
+  if (!existsSync(REGISTRY_PATH)) return null;
+  try { return JSON.parse(readFileSync(REGISTRY_PATH, "utf8")); } catch { return null; }
+}
+
+function loadLastUpgrade(): { updated: string; knownSkills: string[] } | null {
+  if (!existsSync(UPGRADE_STATE)) return null;
+  try { return JSON.parse(readFileSync(UPGRADE_STATE, "utf8")); } catch { return null; }
+}
+
+function saveUpgradeState(registry: Registry): void {
+  mkdirSync(dirname(UPGRADE_STATE), { recursive: true });
+  writeFileSync(UPGRADE_STATE, JSON.stringify({
+    updated: registry.updated,
+    knownSkills: registry.skills.map(s => s.id),
+  }, null, 2));
+}
+
+export async function run(args: string[]): Promise<number> {
+  if (args.includes("-h") || args.includes("--help")) {
+    process.stdout.write(`cue upgrade — check for new skills and profiles in the registry
+
+Usage:
+  cue upgrade              Check what's new
+  cue upgrade --apply      Download and install new skills
+  cue upgrade --sync       Update local registry from remote
+
+Options:
+  --apply    Install new skills into their target profiles
+  --sync     Update docs/registry/index.json from remote
+`);
+    return 0;
+  }
+
+  const apply = args.includes("--apply");
+  const sync = args.includes("--sync");
+
+  const bold = (s: string) => `\x1b[1m${s}\x1b[0m`;
+  const green = (s: string) => `\x1b[32m${s}\x1b[0m`;
+  const dim = (s: string) => `\x1b[2m${s}\x1b[0m`;
+
+  // Fetch remote registry
+  process.stdout.write("Checking registry for updates...\n");
+  const remote = fetchRemoteRegistry();
+  const local = loadLocalRegistry();
+
+  if (!remote && !local) {
+    process.stderr.write("Cannot reach registry and no local copy exists.\n");
+    return 1;
+  }
+
+  const registry = remote ?? local!;
+  const lastUpgrade = loadLastUpgrade();
+  const knownSkills = new Set(lastUpgrade?.knownSkills ?? []);
+
+  // Find new skills
+  const newSkills = registry.skills.filter(s => !knownSkills.has(s.id));
+
+  if (sync && remote) {
+    writeFileSync(REGISTRY_PATH, JSON.stringify(remote, null, 2) + "\n");
+    process.stdout.write(`${green("✓")} Updated local registry (${remote.skills.length} skills, ${remote.mcps.length} MCPs)\n`);
+  }
+
+  if (newSkills.length === 0 && knownSkills.size > 0) {
+    process.stdout.write(`${green("✓")} Everything up to date. No new skills available.\n`);
+    saveUpgradeState(registry);
+    return 0;
+  }
+
+  if (knownSkills.size === 0) {
+    // First run — just save state, don't show everything as "new"
+    process.stdout.write(`${green("✓")} Registry indexed: ${registry.skills.length} skills, ${registry.mcps.length} MCPs\n`);
+    saveUpgradeState(registry);
+    return 0;
+  }
+
+  // Show new skills grouped by profile
+  process.stdout.write(`\n${bold(`${newSkills.length} new skill(s) available:`)}\n\n`);
+  const byProfile = new Map<string, RegistrySkill[]>();
+  for (const s of newSkills) {
+    const list = byProfile.get(s.profile) ?? [];
+    list.push(s);
+    byProfile.set(s.profile, list);
+  }
+
+  for (const [profile, skills] of byProfile) {
+    process.stdout.write(`  ${bold(profile)} profile:\n`);
+    for (const s of skills) {
+      process.stdout.write(`    + ${s.name} ${dim(`(${s.repo})`)}\n`);
+      process.stdout.write(`      ${dim(s.description)}\n`);
+    }
+    process.stdout.write("\n");
+  }
+
+  if (!apply) {
+    process.stdout.write(`Run ${bold("cue upgrade --apply")} to install these.\n`);
+  } else {
+    // Install new skills via npx skills add
+    let installed = 0;
+    for (const s of newSkills) {
+      process.stdout.write(`  Installing ${s.name}...`);
+      const res = spawnSync("npx", ["skills", "add", `${s.repo}/${s.path}`, "-a", "claude-code", "-y"], {
+        encoding: "utf8", timeout: 30000,
+      });
+      if (res.status === 0) {
+        process.stdout.write(` ${green("✓")}\n`);
+        installed++;
+      } else {
+        process.stdout.write(` ${dim("skipped")}\n`);
+      }
+    }
+    process.stdout.write(`\n${green("✓")} Installed ${installed}/${newSkills.length} new skills.\n`);
+  }
+
+  saveUpgradeState(registry);
+  return 0;
+}

package/src/index.ts

@@ -70,17 +70,28 @@ function printHelp(): void {
       ["launch", "Resolve + materialize + exec claude/codex"],
       ["shell", "Install/uninstall shims (~/.local/bin)"],
       ["update", "Self-update: git pull + bun install"],
+      ["upgrade", "Pull new skills from the registry"],
+      ["clean", "Prune stale runtimes and cache"],
+      ["migrate", "Auto-migrate profiles to latest schema"],
     ],
     "Multi-Agent": [
       ["colony-dispatch", "Resolve profile for a Colony task"],
       ["handoff", "Pass skill context between agents"],
       ["trace", "Live session inspector"],
       ["replay", "Replay session with different profile"],
+      ["replay --what-if", "Simulate session with alternate profile"],
+    ],
+    "Intelligence": [
+      ["ai", "Create profile from natural language"],
+      ["suggest", "Usage-based profile recommendations"],
+      ["score", "Profile efficiency score (A+ to F)"],
+      ["benchmark", "Measure token usage from transcripts"],
     ],
     "Import / Export": [
       ["import", "Import profile from URL, file, or repo"],
       ["export", "Export profile as portable YAML"],
       ["snapshot", "Export/restore current profile state"],
+      ["share", "Publish/browse community profiles"],
     ],
   };
 
@@ -124,7 +135,19 @@ function similarity(a: string, b: string): number {
 async function main(argv: string[]): Promise<number> {
   const args = argv.slice(2);
 
-  if (args.length === 0 || args[0] === "-h" || args[0] === "--help" || args[0] === "help") {
+  if (args.length === 0) {
+    // Show status dashboard by default (like `git status`)
+    const statusCmd = COMMANDS["status"];
+    try {
+      const mod = await statusCmd.load();
+      return await mod.run([]);
+    } catch {
+      printHelp();
+      return 0;
+    }
+  }
+
+  if (args[0] === "-h" || args[0] === "--help" || args[0] === "help") {
     printHelp();
     return 0;
   }

package/src/lib/analytics.ts

@@ -15,11 +15,12 @@ const ANALYTICS_PATH = join(
 
 export interface SessionEvent {
   ts: string;
-  event: "start" | "end";
+  event: "start" | "end" | "skill_hit";
   profile: string;
   agent: "claude-code" | "codex";
   cwd: string;
   duration_s?: number;
+  skill?: string;
 }
 
 export function recordEvent(event: SessionEvent): void {
@@ -27,6 +28,54 @@ export function recordEvent(event: SessionEvent): void {
   appendFileSync(ANALYTICS_PATH, JSON.stringify(event) + "\n");
 }
 
+/**
+ * Record skill usage from session transcripts.
+ * Scans the most recent session for skill references and logs them.
+ */
+export function recordSkillUsage(profile: string, agent: "claude-code" | "codex"): void {
+  const projectsDir = join(homedir(), ".claude", "projects");
+  if (!existsSync(projectsDir)) return;
+
+  try {
+    const { readdirSync, statSync, openSync, readSync, closeSync } = require("node:fs");
+    const dirs = readdirSync(projectsDir).filter((d: string) => {
+      try { return statSync(join(projectsDir, d)).isDirectory(); } catch { return false; }
+    });
+
+    // Find most recent session (only check last 5 dirs)
+    let latestFile = "";
+    let latestMtime = 0;
+    for (const dir of dirs.slice(-5)) {
+      const files = readdirSync(join(projectsDir, dir)).filter((f: string) => f.endsWith(".jsonl"));
+      for (const f of files.slice(-3)) {
+        const p = join(projectsDir, dir, f);
+        const mt = statSync(p).mtimeMs;
+        if (mt > latestMtime) { latestMtime = mt; latestFile = p; }
+      }
+    }
+
+    if (!latestFile || Date.now() - latestMtime > 300_000) return; // only last 5 min
+
+    // Read only first 50KB
+    const fd = openSync(latestFile, "r");
+    const buf = Buffer.alloc(50_000);
+    const bytesRead = readSync(fd, buf, 0, 50_000, 0);
+    closeSync(fd);
+    const content = buf.toString("utf8", 0, bytesRead);
+    const skillRefs = content.match(/skills\/([a-z][a-z0-9-]*(?:\/[a-z][a-z0-9-]*)?)\/SKILL\.md/g);
+    if (!skillRefs) return;
+
+    const seen = new Set<string>();
+    const ts = new Date().toISOString();
+    for (const ref of skillRefs) {
+      const skill = ref.replace("skills/", "").replace("/SKILL.md", "");
+      if (seen.has(skill)) continue;
+      seen.add(skill);
+      recordEvent({ ts, event: "skill_hit", profile, agent, cwd: process.cwd(), skill });
+    }
+  } catch { /* non-fatal */ }
+}
+
 export function readEvents(since?: Date): SessionEvent[] {
   if (!existsSync(ANALYTICS_PATH)) return [];
   const lines = readFileSync(ANALYTICS_PATH, "utf8").split("\n").filter(Boolean);
@@ -77,3 +126,26 @@ export function computeStats(since?: Date): ProfileStats[] {
     }))
     .sort((a, b) => b.sessions - a.sessions);
 }
+
+export interface SkillUsageStats {
+  skill: string;
+  hits: number;
+  lastUsed: string | null;
+}
+
+export function skillStats(profile?: string, since?: Date): SkillUsageStats[] {
+  const events = readEvents(since).filter(e => e.event === "skill_hit" && e.skill);
+  const filtered = profile ? events.filter(e => e.profile === profile) : events;
+
+  const map = new Map<string, { hits: number; last: string }>();
+  for (const e of filtered) {
+    const entry = map.get(e.skill!) ?? { hits: 0, last: "" };
+    entry.hits++;
+    if (e.ts > entry.last) entry.last = e.ts;
+    map.set(e.skill!, entry);
+  }
+
+  return [...map.entries()]
+    .map(([skill, d]) => ({ skill, hits: d.hits, lastUsed: d.last || null }))
+    .sort((a, b) => b.hits - a.hits);
+}