dryai 2.0.0 → 2.2.0

package/README.md

@@ -2,15 +2,17 @@
 
 Installs command, rule, and skill sources from `~/.config/dryai` by default into Copilot and Cursor targets.
 
-Pass `--config-root <path>` to read configs from a different root such as `./config`.
+Global CLI options:
 
-Pass `--output-root <path>` to write generated output somewhere other than your home directory.
+- `--config-root <path>` reads configs from a different root such as `./config`.
+- `--output-root <path>` writes generated output somewhere other than your home directory.
+- `--test` is a shortcut for `--output-root ./output-test`, and if both are provided, `--output-root` wins.
 
-`--test` is a shortcut for `--output-root ./output-test`, and if both are provided, `--output-root` wins.
+These are root-level options for the CLI. They modify command behavior for any given command.
 
-## Input
+## Config Layout
 
-Input config files live under the selected input root:
+Input config files live under the selected config root:
 
 - `commands`
 - `rules`
@@ -24,9 +26,7 @@ Live output is written to:
 - `~/.cursor/rules`
 - `~/.cursor/skills`
 
-## Example Configs
-
-One input root can contain all three source types:
+One config root can contain all three source types:
 
 ```text
 ~/.config/dryai/
@@ -39,6 +39,106 @@ One input root can contain all three source types:
         └── SKILL.md
 ```
 
+See VS Code editor setup note below.
+
+## Commands
+
+### `install`
+
+- Purpose: Install commands, rules, and skills from the selected config root into the Copilot and Cursor target directories.
+- Input roots: Reads from `commands`, `rules`, and `skills` under the selected config root.
+- Output roots: Writes to `~/.copilot/prompts`, `~/.copilot/instructions`, `~/.copilot/skills`, `~/.cursor/rules`, and `~/.cursor/skills` by default.
+
+### `skills add`
+
+- Purpose: Import one or more managed skills from a remote repository.
+- Repository argument: `<repo>` may be a full git remote URL or a GitHub `owner/repo` shorthand such as `anthropics/skills`.
+- Storage: Imported skills are copied into `config/skills/<name>/` and tracked in `skills.lock.json`.
+- Config root: Local skill directories and `skills.lock.json` are read from and written to the selected config root.
+- Required: `--skill <name>` is required at least once.
+- Default resolution: Each requested skill resolves from `<repo root>/skills/<name>`.
+- `--path <repoPath>`: Resolves each requested skill from a different base directory.
+- `--path .`: Resolves each requested skill from the repository root itself.
+- `--as <name>`: Stores the imported skill under a different local managed name when importing exactly one skill.
+- `--ref <gitRef>`: Fetches a specific branch, tag, or commit instead of the remote default branch.
+- `--pin`: Stores the resolved commit instead of tracking a moving ref.
+- Examples:
+
+```sh
+# Resolves from <repo root>/skills/skill-creator
+dryai skills add anthropics/skills --skill skill-creator
+
+# Resolves from <repo root>/review-helper
+dryai skills add anthropics/skills --path . --skill review-helper
+
+# Resolves from <repo root>/tools/review-helper
+dryai skills add anthropics/skills --path tools --skill review-helper
+
+# Resolves from <repo root>/skills/pr-review and <repo root>/skills/commit
+dryai skills add vercel-labs/agent-skills --skill pr-review commit
+
+# Resolves from <repo root>/skills/pr-review and <repo root>/skills/commit
+dryai skills add https://github.com/vercel-labs/agent-skills.git --skill pr-review commit
+```
+
+By default, imports track the requested ref. With no `--ref`, that means the remote default branch `HEAD` is tracked.
+
+### `skills update`
+
+- Purpose: Re-fetch one managed skill from its tracked source and replace the local copied directory.
+- `--force`: Overwrites local edits instead of skipping the update.
+
+### `skills update-all`
+
+- Purpose: Re-fetch all managed skills from their tracked sources and replace the local copied directories.
+- `--force`: Overwrites local edits instead of skipping the update.
+
+### `skills rehash`
+
+- Purpose: Refresh the stored file hashes for one managed skill using its current local contents.
+
+### `skills rehash-all`
+
+- Purpose: Refresh the stored file hashes for every managed skill using their current local contents.
+- Behavior: Skips managed entries whose local directory is missing.
+
+### `skills remove`
+
+- Purpose: Delete a managed skill's local copied directory and remove its lockfile entry.
+
+### `skills list`
+
+- Purpose: Report local skill directories, annotate managed entries from the lockfile, and flag managed entries whose local directory is missing.
+
+### `skills` lockfile
+
+The lockfile records:
+
+- the local skill name
+- the source repository
+- the source path within that repository
+- the requested git ref, when one was provided
+- the resolved commit that was imported
+- the last installed content hash for each file in the managed skill directory
+
+Before replacing a managed skill, `dryai` compares the current local files against the hashes stored in `skills.lock.json`. If any file was added, removed, or edited locally, the update is skipped and a warning is printed so you do not lose your customizations by accident.
+
+For skills imported before hash tracking existed, use these commands to store hashes from the current local directory without fetching from the remote source:
+
+```sh
+dryai skills rehash review-helper
+dryai skills rehash-all
+```
+
+Use these commands to intentionally overwrite local edits:
+
+```sh
+dryai skills update review-helper --force
+dryai skills update-all --force
+```
+
+## Example Configs
+
 ### Example Rule
 
 Rules are markdown files under `rules/`. `dryai` recognizes these rule frontmatter fields:
@@ -112,56 +212,9 @@ Focus on findings first.
 - Keep the overview brief unless the user asks for a deeper walkthrough.
 ```
 
-## Commands
-
-```sh
-dryai install
-dryai skills list                                 List local skills
-dryai skills add [options] <repo>                 Add managed skills from a remote repository
-dryai skills remove <name>                        Remove a managed skill
-dryai skills update <name>                        Update a managed skill from its tracked source
-dryai skills update-all                           Update all managed skills from their tracked sources
-```
-
-`<repo>` may be a full git remote URL or a GitHub `owner/repo` shorthand such as `anthropics/skills`.
-
-## Managed Skills
-
-Imported skills are copied into `config/skills/<name>/` and tracked in `skills.lock.json`.
-
-When you run `skills` commands, local skill directories and `skills.lock.json` are read from and written to the selected config root.
-
-`skills add` requires at least one `--skill <name>` value. Each requested skill is always resolved from `<repo root>/skills/<name>`.
-
-Use `--as <name>` to choose a different local managed skill name when importing exactly one skill.
-
-Examples:
-
-```sh
-dryai skills add anthropics/skills --skill skill-creator
-dryai skills add vercel-labs/agent-skills --skill pr-review commit
-dryai skills add https://github.com/vercel-labs/agent-skills.git --skill pr-review commit
-```
-
-By default, imports track the requested ref. With no `--ref`, that means the remote default branch `HEAD` is tracked. Use `--pin` to store the currently resolved commit instead, so later `skills update` operations stay pinned to that commit.
-
-The lockfile records:
-
-- the local skill name
-- the source repository
-- the source path within that repository
-- the requested git ref, when one was provided
-- the resolved commit that was imported
-
-`skills update` and `skills update-all` re-fetch the tracked repository snapshot and replace the local copied skill directory.
-
-`skills remove` deletes the local copied skill directory and removes its lockfile entry.
-
-`skills list` reports local skill directories, annotating managed entries from the lockfile and flagging managed entries whose local directory is missing.
-
 ## Development
 
-For development, use `pnpm dev` to rebuild into `dest/` on change and `pnpm dev:dryai --test install` to run the built CLI.
+For development, use `pnpm dev` to rebuild into `dest/` on change and `pnpm dev:dryai <...>` to run the built CLI.
 
 Run `pnpm run setup:editor` after installing dependencies if you want the Effect language service workspace patch applied locally.
 
@@ -172,39 +225,21 @@ pnpm run dev
 pnpm run test
 pnpm run test:watch
 
-pnpm dev:dryai install
-pnpm dev:dryai --test install
-pnpm dev:dryai --output-root ./tmp/install-root install
-pnpm dev:dryai --config-root ./config install
+pnpm dev:dryai <...>
 ```
 
-## CI and Release
-
-- On pull request open or update
-  - Run CI validation with build, test, and `npm pack --dry-run`.
-- On changes landing on `main`
-  - Run the same CI validation with build, test, and `npm pack --dry-run`.
+---
 
-- On `v*` tag pushed to `main`, the release workflow will:
-  - Verify the tag matches the checked-in `package.json` version.
-  - Verify the tagged commit is on `main`.
-  - Build and test the CLI.
-  - Create a tarball with `npm pack`.
-  - Create or update the matching GitHub Release.
-  - Upload the tarball as a release asset.
-- After the release workflow succeeds, the publish workflow will:
-  - Download the tarball artifact produced by the release workflow.
-  - Publish that exact tarball to npm using npm trusted publishing.
+## VS Code Setup
 
-Example release flow:
+VS Code Copilot does not automatically discover prompt files from `~/.copilot/prompts`.
 
-```sh
-git tag v0.1.0
-git push origin v0.1.0
-```
+Add this to your VS Code user settings so prompt files installed by `dryai` are picked up:
 
-Install from the release tarball with:
-
-```sh
-npm install -g https://github.com/willmruzek/share-ai-config/releases/download/v0.1.0/share-ai-config-0.1.0.tgz
+```json
+{
+  "chat.promptFilesLocations": {
+    "~/.copilot/prompts": true
+  }
+}
 ```

package/dest/commands/skills/add.d.ts

@@ -1,9 +1,10 @@
 import type { AgentsContext } from '../../lib/context.js';
 /**
- * Imports one or more managed skills from a remote repository `skills/` directory into the local skills directory.
+ * Imports one or more managed skills from a remote repository into the local skills directory.
  */
 export declare function runSkillsAddCommand(context: AgentsContext, input: {
     repo: string;
+    repoPath: string | undefined;
     skillNames: string[];
     asName: string | undefined;
     pin: boolean;

package/dest/commands/skills/add.js

@@ -1,5 +1,5 @@
 import fs from 'fs-extra';
-import { cloneRemoteRepo, createImportedSkillRecord, ensureSkillsLockfile, ensureSkillsRoot, findManagedSkill, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, normalizeRemoteRepo, replaceManagedSkillDirectory, resolveManagedSkillImportPath, resolveSkillSourceDir, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
+import { cloneRemoteRepo, computeDirectoryHashes, createImportedSkillRecord, deriveSkillName, ensureSkillsLockfile, ensureSkillsRoot, findManagedSkill, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, normalizeImportedSkillPath, normalizeRemoteRepo, replaceManagedSkillDirectory, resolveManagedSkillImportPath, resolveManagedSkillImportPathFromBase, resolveSkillSourceDirByPath, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
 /**
  * Normalizes and de-duplicates requested skill names while preserving their input order.
  */
@@ -20,10 +20,21 @@ function normalizeRequestedSkillNames(skillNames) {
     return uniqueSkillNames;
 }
 /**
- * Imports one or more managed skills from a remote repository `skills/` directory into the local skills directory.
+ * Resolves the remote repository path for one managed skill import request.
+ */
+function resolveRequestedImportPath(input) {
+    const importPath = resolveManagedSkillImportPathFromBase({
+        basePath: input.basePath,
+        skillName: input.requestedSkillName,
+    });
+    return normalizeImportedSkillPath(importPath) ?? importPath;
+}
+/**
+ * Imports one or more managed skills from a remote repository into the local skills directory.
  */
 export async function runSkillsAddCommand(context, input) {
     const repo = normalizeRemoteRepo(input.repo);
+    const normalizedBasePath = normalizeImportedSkillPath(input.repoPath);
     if (input.skillNames.length === 0) {
         throw new Error('At least one skill name must be provided with --skill');
     }
@@ -45,9 +56,14 @@ export async function runSkillsAddCommand(context, input) {
     const importedSkillSummaries = [];
     try {
         for (const requestedSkillName of requestedSkillNames) {
-            const skillName = input.asName ?? requestedSkillName;
-            const importedSkillPath = resolveManagedSkillImportPath({
-                skillName: requestedSkillName,
+            const importedSkillPath = resolveRequestedImportPath({
+                basePath: normalizedBasePath,
+                requestedSkillName,
+            });
+            const skillName = deriveSkillName({
+                repo,
+                skillPath: importedSkillPath,
+                explicitName: input.asName,
             });
             const existingManagedSkill = findManagedSkill(lockfile, {
                 name: skillName,
@@ -60,17 +76,19 @@ export async function runSkillsAddCommand(context, input) {
             if (await fs.pathExists(targetDir)) {
                 throw new Error(`A local skill directory already exists: ${targetDir}`);
             }
-            const sourceDir = await resolveSkillSourceDir({
+            const sourceDir = await resolveSkillSourceDirByPath({
                 checkoutDir: checkout.checkoutDir,
                 repo,
-                skillName: requestedSkillName,
+                skillPath: importedSkillPath,
             });
             await replaceManagedSkillDirectory({
                 targetDir,
                 sourceDir,
             });
+            const installedFiles = await computeDirectoryHashes(targetDir);
             const importedSkill = createImportedSkillRecord({
                 commit: checkout.commit,
+                files: installedFiles,
                 importedAt: timestampNow(),
                 name: skillName,
                 path: importedSkillPath,

package/dest/commands/skills/index.js

@@ -5,6 +5,8 @@ import { nonEmptyOptionStringSchema, parseOptionsObject, parseOptionValue, } fro
 import {} from '../../lib/context.js';
 import { runSkillsAddCommand } from './add.js';
 import { runSkillsListCommand } from './list.js';
+import { runSkillsRehashAllCommand } from './rehash-all.js';
+import { runSkillsRehashCommand } from './rehash.js';
 import { runSkillsRemoveCommand } from './remove.js';
 import { runSkillsUpdateAllCommand } from './update-all.js';
 import { runSkillsUpdateCommand } from './update.js';
@@ -12,8 +14,12 @@ const skillsImportOptionsSchema = z.object({
     skill: z.array(z.string()).optional(),
     as: nonEmptyOptionStringSchema.optional(),
     pin: z.boolean().optional().default(false),
+    path: nonEmptyOptionStringSchema.optional(),
     ref: nonEmptyOptionStringSchema.optional(),
 });
+const skillsUpdateOptionsSchema = z.object({
+    force: z.boolean().optional().default(false),
+});
 /**
  * Registers the managed skills command tree on the parent CLI program.
  */
@@ -29,7 +35,10 @@ export function addSkillsCommand(input) {
         Examples:
           ${commandName} list
           ${commandName} add anthropics/skills --skill skill-creator
+          ${commandName} add anthropics/skills --path . --skill review-helper
+          ${commandName} add anthropics/skills --path tools --skill review-helper
           ${commandName} add vercel-labs/agent-skills --skill pr-review commit
+          ${commandName} rehash skill-creator
           ${commandName} update skill-creator
       `)
         .action(() => {
@@ -44,7 +53,11 @@ export function addSkillsCommand(input) {
     skills
         .command('add <repo>')
         .description('Add managed skills from a remote repository')
-        .option('--skill <names...>', 'Import one or more skills from the repository root skills/ directory')
+        .option('--skill <names...>', 'Import one or more skills by directory name')
+        .option('--path <repoPath>', 'Resolve each --skill from a different repository subdirectory; use . for the repository root instead of the default skills/ directory', parseOptionValue({
+        schema: nonEmptyOptionStringSchema,
+        optionLabel: '--path',
+    }))
         .option('--as <name>', 'Store the imported skill under a different local managed name', parseOptionValue({
         schema: nonEmptyOptionStringSchema,
         optionLabel: '--as',
@@ -62,6 +75,7 @@ export function addSkillsCommand(input) {
         });
         await runSkillsAddCommand(resolveContext(), {
             repo,
+            repoPath: parsedOptions.path,
             skillNames: parsedOptions.skill ?? [],
             asName: parsedOptions.as,
             pin: parsedOptions.pin,
@@ -74,17 +88,46 @@ export function addSkillsCommand(input) {
         .action(async (skillName) => {
         await runSkillsRemoveCommand(resolveContext(), { skillName });
     });
+    skills
+        .command('rehash <name>')
+        .description('Refresh stored file hashes for one managed skill')
+        .action(async (skillName) => {
+        await runSkillsRehashCommand(resolveContext(), { skillName });
+    });
+    skills
+        .command('rehash-all')
+        .description('Refresh stored file hashes for all managed skills')
+        .action(async () => {
+        await runSkillsRehashAllCommand(resolveContext());
+    });
     skills
         .command('update <name>')
         .description('Update a managed skill from its tracked source')
-        .action(async (skillName) => {
-        await runSkillsUpdateCommand(resolveContext(), { skillName });
+        .option('--force', 'Overwrite local skill edits with the fetched remote copy')
+        .action(async (skillName, options) => {
+        const parsedOptions = parseOptionsObject({
+            schema: skillsUpdateOptionsSchema,
+            options,
+            optionsLabel: 'skills update options',
+        });
+        await runSkillsUpdateCommand(resolveContext(), {
+            force: parsedOptions.force,
+            skillName,
+        });
     });
     skills
         .command('update-all')
         .description('Update all managed skills from their tracked sources')
-        .action(async () => {
-        await runSkillsUpdateAllCommand(resolveContext());
+        .option('--force', 'Overwrite local skill edits with the fetched remote copy')
+        .action(async (options) => {
+        const parsedOptions = parseOptionsObject({
+            schema: skillsUpdateOptionsSchema,
+            options,
+            optionsLabel: 'skills update-all options',
+        });
+        await runSkillsUpdateAllCommand(resolveContext(), {
+            force: parsedOptions.force,
+        });
     });
     return skills;
 }

package/dest/commands/skills/rehash-all.d.ts

@@ -0,0 +1,6 @@
+import type { AgentsContext } from '../../lib/context.js';
+/**
+ * Refreshes the stored file hashes for every managed skill using current local directory contents.
+ */
+export declare function runSkillsRehashAllCommand(context: AgentsContext): Promise<void>;
+//# sourceMappingURL=rehash-all.d.ts.map

package/dest/commands/skills/rehash-all.js

@@ -0,0 +1,42 @@
+import fs from 'fs-extra';
+import { computeDirectoryHashes, createUpdatedSkillRecord, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
+/**
+ * Refreshes the stored file hashes for every managed skill using current local directory contents.
+ */
+export async function runSkillsRehashAllCommand(context) {
+    let lockfile = await loadSkillsLockfile(context);
+    if (lockfile.skills.length === 0) {
+        console.log('No managed skills to rehash.');
+        return;
+    }
+    const rehashedLines = [];
+    const skippedLines = [];
+    for (const managedSkill of lockfile.skills) {
+        const targetDir = getManagedSkillDirectory(context, {
+            skillName: managedSkill.name,
+        });
+        if (!(await fs.pathExists(targetDir))) {
+            skippedLines.push(`- ${formatManagedSkillSummary(managedSkill)} missing-local-directory`);
+            continue;
+        }
+        const installedFiles = await computeDirectoryHashes(targetDir);
+        const updatedSkill = createUpdatedSkillRecord({
+            commit: managedSkill.commit,
+            existingSkill: managedSkill,
+            files: installedFiles,
+            updatedAt: timestampNow(),
+        });
+        lockfile = upsertManagedSkill(lockfile, { updatedSkill });
+        rehashedLines.push(`- ${formatManagedSkillSummary(updatedSkill)}`);
+    }
+    await saveSkillsLockfile(context, { lockfile });
+    if (rehashedLines.length > 0) {
+        console.log(`Rehashed ${rehashedLines.length} managed skills:\n${rehashedLines.join('\n')}`);
+    }
+    else {
+        console.log('No managed skills were rehashed.');
+    }
+    if (skippedLines.length > 0) {
+        console.warn(`Skipped ${skippedLines.length} managed skills because the local directory is missing:\n${skippedLines.join('\n')}`);
+    }
+}

package/dest/commands/skills/rehash.d.ts

@@ -0,0 +1,8 @@
+import type { AgentsContext } from '../../lib/context.js';
+/**
+ * Refreshes the stored file hashes for one managed skill using the current local directory contents.
+ */
+export declare function runSkillsRehashCommand(context: AgentsContext, input: {
+    skillName: string;
+}): Promise<void>;
+//# sourceMappingURL=rehash.d.ts.map

package/dest/commands/skills/rehash.js

@@ -0,0 +1,28 @@
+import fs from 'fs-extra';
+import { computeDirectoryHashes, createUpdatedSkillRecord, findManagedSkill, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
+/**
+ * Refreshes the stored file hashes for one managed skill using the current local directory contents.
+ */
+export async function runSkillsRehashCommand(context, input) {
+    const { skillName } = input;
+    const lockfile = await loadSkillsLockfile(context);
+    const managedSkill = findManagedSkill(lockfile, { name: skillName });
+    if (!managedSkill) {
+        throw new Error(`Managed skill not found: ${skillName}`);
+    }
+    const targetDir = getManagedSkillDirectory(context, { skillName });
+    if (!(await fs.pathExists(targetDir))) {
+        throw new Error(`Managed skill directory not found: ${targetDir}`);
+    }
+    const installedFiles = await computeDirectoryHashes(targetDir);
+    const updatedSkill = createUpdatedSkillRecord({
+        commit: managedSkill.commit,
+        existingSkill: managedSkill,
+        files: installedFiles,
+        updatedAt: timestampNow(),
+    });
+    await saveSkillsLockfile(context, {
+        lockfile: upsertManagedSkill(lockfile, { updatedSkill }),
+    });
+    console.log(`Rehashed ${formatManagedSkillSummary(updatedSkill)}`);
+}

package/dest/commands/skills/update-all.d.ts

@@ -2,5 +2,7 @@ import type { AgentsContext } from '../../lib/context.js';
 /**
  * Updates every managed skill from its tracked remote source and saves the refreshed lockfile.
  */
-export declare function runSkillsUpdateAllCommand(context: AgentsContext): Promise<void>;
+export declare function runSkillsUpdateAllCommand(context: AgentsContext, input: {
+    force: boolean;
+}): Promise<void>;
 //# sourceMappingURL=update-all.d.ts.map

package/dest/commands/skills/update-all.js

@@ -1,15 +1,27 @@
-import { createUpdatedSkillRecord, fetchRemoteSkillSnapshot, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, replaceManagedSkillDirectory, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
+import { computeDirectoryHashes, createUpdatedSkillRecord, detectLocalSkillEdits, fetchRemoteSkillSnapshot, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, replaceManagedSkillDirectory, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
 /**
  * Updates every managed skill from its tracked remote source and saves the refreshed lockfile.
  */
-export async function runSkillsUpdateAllCommand(context) {
+export async function runSkillsUpdateAllCommand(context, input) {
     let lockfile = await loadSkillsLockfile(context);
     if (lockfile.skills.length === 0) {
         console.log('No managed skills to update.');
         return;
     }
     const updatedLines = [];
+    const skippedLines = [];
     for (const managedSkill of lockfile.skills) {
+        const targetDir = getManagedSkillDirectory(context, {
+            skillName: managedSkill.name,
+        });
+        const localEditState = await detectLocalSkillEdits({
+            skillDir: targetDir,
+            storedFiles: managedSkill.files,
+        });
+        if (localEditState.modified && !input.force) {
+            skippedLines.push(`- ${managedSkill.name} local edits detected in ${localEditState.changedFiles.join(', ')}`);
+            continue;
+        }
         const snapshot = await fetchRemoteSkillSnapshot({
             ref: managedSkill.ref,
             repo: managedSkill.repo,
@@ -17,23 +29,31 @@ export async function runSkillsUpdateAllCommand(context) {
         });
         try {
             await replaceManagedSkillDirectory({
-                targetDir: getManagedSkillDirectory(context, {
-                    skillName: managedSkill.name,
-                }),
+                targetDir,
                 sourceDir: snapshot.sourceDir,
             });
+            const installedFiles = await computeDirectoryHashes(targetDir);
+            const updatedSkill = createUpdatedSkillRecord({
+                commit: snapshot.commit,
+                existingSkill: managedSkill,
+                files: installedFiles,
+                updatedAt: timestampNow(),
+            });
+            lockfile = upsertManagedSkill(lockfile, { updatedSkill });
+            updatedLines.push(`- ${formatManagedSkillSummary(updatedSkill)}`);
         }
         finally {
             await snapshot.cleanup();
         }
-        const updatedSkill = createUpdatedSkillRecord({
-            commit: snapshot.commit,
-            existingSkill: managedSkill,
-            updatedAt: timestampNow(),
-        });
-        lockfile = upsertManagedSkill(lockfile, { updatedSkill });
-        updatedLines.push(`- ${formatManagedSkillSummary(updatedSkill)}`);
     }
     await saveSkillsLockfile(context, { lockfile });
-    console.log(`Updated ${updatedLines.length} managed skills:\n${updatedLines.join('\n')}`);
+    if (updatedLines.length > 0) {
+        console.log(`Updated ${updatedLines.length} managed skills:\n${updatedLines.join('\n')}`);
+    }
+    else {
+        console.log('No managed skills were updated.');
+    }
+    if (skippedLines.length > 0) {
+        console.warn(`Skipped ${skippedLines.length} managed skills due to local edits. Re-run with --force to overwrite local changes:\n${skippedLines.join('\n')}`);
+    }
 }

package/dest/commands/skills/update.d.ts

@@ -3,6 +3,7 @@ import type { AgentsContext } from '../../lib/context.js';
  * Updates one managed skill from its tracked remote source and refreshes the lockfile.
  */
 export declare function runSkillsUpdateCommand(context: AgentsContext, input: {
+    force: boolean;
     skillName: string;
 }): Promise<void>;
 //# sourceMappingURL=update.d.ts.map

package/dest/commands/skills/update.js

@@ -1,14 +1,23 @@
-import { createUpdatedSkillRecord, fetchRemoteSkillSnapshot, findManagedSkill, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, replaceManagedSkillDirectory, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
+import { computeDirectoryHashes, createUpdatedSkillRecord, detectLocalSkillEdits, fetchRemoteSkillSnapshot, findManagedSkill, formatManagedSkillSummary, getManagedSkillDirectory, loadSkillsLockfile, replaceManagedSkillDirectory, saveSkillsLockfile, timestampNow, upsertManagedSkill, } from '../../lib/skills.js';
 /**
  * Updates one managed skill from its tracked remote source and refreshes the lockfile.
  */
 export async function runSkillsUpdateCommand(context, input) {
-    const { skillName } = input;
+    const { force, skillName } = input;
     const lockfile = await loadSkillsLockfile(context);
     const managedSkill = findManagedSkill(lockfile, { name: skillName });
     if (!managedSkill) {
         throw new Error(`Managed skill not found: ${skillName}`);
     }
+    const targetDir = getManagedSkillDirectory(context, { skillName });
+    const localEditState = await detectLocalSkillEdits({
+        skillDir: targetDir,
+        storedFiles: managedSkill.files,
+    });
+    if (localEditState.modified && !force) {
+        console.warn(`Skipped ${skillName} because local edits were detected in: ${localEditState.changedFiles.join(', ')}. Re-run with --force to overwrite local changes.`);
+        return;
+    }
     const snapshot = await fetchRemoteSkillSnapshot({
         ref: managedSkill.ref,
         repo: managedSkill.repo,
@@ -16,20 +25,22 @@ export async function runSkillsUpdateCommand(context, input) {
     });
     try {
         await replaceManagedSkillDirectory({
-            targetDir: getManagedSkillDirectory(context, { skillName }),
+            targetDir,
             sourceDir: snapshot.sourceDir,
         });
+        const installedFiles = await computeDirectoryHashes(targetDir);
+        const updatedSkill = createUpdatedSkillRecord({
+            commit: snapshot.commit,
+            existingSkill: managedSkill,
+            files: installedFiles,
+            updatedAt: timestampNow(),
+        });
+        await saveSkillsLockfile(context, {
+            lockfile: upsertManagedSkill(lockfile, { updatedSkill }),
+        });
+        console.log(`Updated ${formatManagedSkillSummary(updatedSkill)}`);
     }
     finally {
         await snapshot.cleanup();
     }
-    const updatedSkill = createUpdatedSkillRecord({
-        commit: snapshot.commit,
-        existingSkill: managedSkill,
-        updatedAt: timestampNow(),
-    });
-    await saveSkillsLockfile(context, {
-        lockfile: upsertManagedSkill(lockfile, { updatedSkill }),
-    });
-    console.log(`Updated ${formatManagedSkillSummary(updatedSkill)}`);
 }

package/dest/lib/skills.d.ts

@@ -1,11 +1,13 @@
 import { z } from 'zod';
 import type { AgentsContext } from './context.js';
+declare const managedSkillFilesSchema: z.ZodRecord<z.ZodString, z.ZodString>;
 declare const skillLockEntrySchema: z.ZodObject<{
     name: z.ZodString;
     repo: z.ZodString;
     path: z.ZodString;
     ref: z.ZodOptional<z.ZodString>;
     commit: z.ZodString;
+    files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     importedAt: z.ZodString;
     updatedAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -16,6 +18,7 @@ declare const skillLockEntrySchema: z.ZodObject<{
     importedAt: string;
     updatedAt: string;
     ref?: string | undefined;
+    files?: Record<string, string> | undefined;
 }, {
     name: string;
     path: string;
@@ -24,6 +27,7 @@ declare const skillLockEntrySchema: z.ZodObject<{
     importedAt: string;
     updatedAt: string;
     ref?: string | undefined;
+    files?: Record<string, string> | undefined;
 }>;
 declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -33,6 +37,7 @@ declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
         path: z.ZodString;
         ref: z.ZodOptional<z.ZodString>;
         commit: z.ZodString;
+        files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         importedAt: z.ZodString;
         updatedAt: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -43,6 +48,7 @@ declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
         importedAt: string;
         updatedAt: string;
         ref?: string | undefined;
+        files?: Record<string, string> | undefined;
     }, {
         name: string;
         path: string;
@@ -51,6 +57,7 @@ declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
         importedAt: string;
         updatedAt: string;
         ref?: string | undefined;
+        files?: Record<string, string> | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     skills: {
@@ -61,6 +68,7 @@ declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
         importedAt: string;
         updatedAt: string;
         ref?: string | undefined;
+        files?: Record<string, string> | undefined;
     }[];
     version: 1;
 }, {
@@ -72,6 +80,7 @@ declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
         importedAt: string;
         updatedAt: string;
         ref?: string | undefined;
+        files?: Record<string, string> | undefined;
     }[];
     version: 1;
 }>, {
@@ -83,6 +92,7 @@ declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
         importedAt: string;
         updatedAt: string;
         ref?: string | undefined;
+        files?: Record<string, string> | undefined;
     }[];
     version: 1;
 }, {
@@ -94,11 +104,13 @@ declare const skillsLockfileSchema: z.ZodEffects<z.ZodObject<{
         importedAt: string;
         updatedAt: string;
         ref?: string | undefined;
+        files?: Record<string, string> | undefined;
     }[];
     version: 1;
 }>;
 export type ManagedSkill = z.infer<typeof skillLockEntrySchema>;
 export type SkillsLockfile = z.infer<typeof skillsLockfileSchema>;
+export type ManagedSkillFiles = z.infer<typeof managedSkillFilesSchema>;
 export type RemoteSkillSnapshot = {
     cleanup: () => Promise<void>;
     commit: string;
@@ -141,20 +153,52 @@ export declare function normalizeRemoteRepo(repo: string): string;
 export declare function resolveManagedSkillImportPath({ skillName, }: {
     skillName: string;
 }): string;
-export declare function normalizeImportedSkillPath(skillPath: string | undefined): string;
+/**
+ * Normalizes an explicitly provided repository-relative skill path.
+ */
+export declare function normalizeImportedSkillPath(skillPath: string | undefined): string | undefined;
+/**
+ * Joins an optional base repository path with a requested managed skill name.
+ */
+export declare function resolveManagedSkillImportPathFromBase(input: {
+    basePath: string | undefined;
+    skillName: string;
+}): string;
+/**
+ * Creates the lockfile record for a newly imported managed skill.
+ */
 export declare function createImportedSkillRecord(input: {
     commit: string;
+    files: ManagedSkillFiles;
     importedAt: string;
     name: string;
     path: string;
     ref: string | undefined;
     repo: string;
 }): ManagedSkill;
+/**
+ * Creates the next lockfile record for a managed skill after its local contents have been refreshed.
+ */
 export declare function createUpdatedSkillRecord(input: {
     commit: string;
     existingSkill: ManagedSkill;
+    files: ManagedSkillFiles;
     updatedAt: string;
 }): ManagedSkill;
+/**
+ * Computes stable SHA-256 hashes for every file within a managed skill directory.
+ */
+export declare function computeDirectoryHashes(directoryPath: string): Promise<ManagedSkillFiles>;
+/**
+ * Detects whether a managed skill directory has local content changes relative to the lockfile snapshot.
+ */
+export declare function detectLocalSkillEdits(input: {
+    skillDir: string;
+    storedFiles: ManagedSkillFiles | undefined;
+}): Promise<{
+    changedFiles: string[];
+    modified: boolean;
+}>;
 /**
  * Clones a remote repository into a temporary checkout and resolves the fetched commit.
  */
@@ -170,6 +214,14 @@ export declare function resolveSkillSourceDir(input: {
     repo: string;
     skillName: string;
 }): Promise<string>;
+/**
+ * Resolves and validates an arbitrary managed skill directory path from a temporary repository checkout.
+ */
+export declare function resolveSkillSourceDirByPath(input: {
+    checkoutDir: string;
+    repo: string;
+    skillPath: string;
+}): Promise<string>;
 /**
  * Fetches a validated remote skill directory snapshot for a specific repository path.
  */

package/dest/lib/skills.js

@@ -1,14 +1,17 @@
 import fs from 'fs-extra';
+import { createHash } from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 import { simpleGit } from 'simple-git';
 import { z } from 'zod';
+const managedSkillFilesSchema = z.record(z.string(), z.string());
 const skillLockEntrySchema = z.object({
     name: z.string().min(1),
     repo: z.string().min(1),
     path: z.string().min(1),
     ref: z.string().min(1).optional(),
     commit: z.string().min(1),
+    files: managedSkillFilesSchema.optional(),
     importedAt: z.string().datetime({ offset: true }),
     updatedAt: z.string().datetime({ offset: true }),
 });
@@ -136,13 +139,38 @@ export function resolveManagedSkillImportPath({ skillName, }) {
     }
     return `skills/${trimmedSkillName}`;
 }
+/**
+ * Normalizes an explicitly provided repository-relative skill path.
+ */
 export function normalizeImportedSkillPath(skillPath) {
-    const normalizedPath = skillPath && skillPath.length > 0 ? skillPath : '.';
-    return path.normalize(normalizedPath);
+    if (skillPath === undefined) {
+        return undefined;
+    }
+    return path.normalize(skillPath);
 }
+/**
+ * Joins an optional base repository path with a requested managed skill name.
+ */
+export function resolveManagedSkillImportPathFromBase(input) {
+    const normalizedBasePath = normalizeImportedSkillPath(input.basePath);
+    const defaultSkillPath = resolveManagedSkillImportPath({
+        skillName: input.skillName,
+    });
+    if (normalizedBasePath === '.') {
+        return path.normalize(input.skillName);
+    }
+    if (normalizedBasePath === undefined) {
+        return defaultSkillPath;
+    }
+    return path.normalize(path.join(normalizedBasePath, input.skillName));
+}
+/**
+ * Creates the lockfile record for a newly imported managed skill.
+ */
 export function createImportedSkillRecord(input) {
     return {
         commit: input.commit,
+        files: input.files,
         importedAt: input.importedAt,
         name: input.name,
         path: input.path,
@@ -151,13 +179,56 @@ export function createImportedSkillRecord(input) {
         updatedAt: input.importedAt,
     };
 }
+/**
+ * Creates the next lockfile record for a managed skill after its local contents have been refreshed.
+ */
 export function createUpdatedSkillRecord(input) {
     return {
         ...input.existingSkill,
         commit: input.commit,
+        files: input.files,
         updatedAt: input.updatedAt,
     };
 }
+/**
+ * Computes stable SHA-256 hashes for every file within a managed skill directory.
+ */
+export async function computeDirectoryHashes(directoryPath) {
+    const relativeFilePaths = await listRelativeFilePaths(directoryPath);
+    const hashEntries = await Promise.all(relativeFilePaths.map(async (relativeFilePath) => {
+        const fileBuffer = await fs.readFile(path.join(directoryPath, relativeFilePath));
+        return [
+            toPortableRelativePath(relativeFilePath),
+            createHash('sha256').update(fileBuffer).digest('hex'),
+        ];
+    }));
+    return Object.fromEntries(hashEntries);
+}
+/**
+ * Detects whether a managed skill directory has local content changes relative to the lockfile snapshot.
+ */
+export async function detectLocalSkillEdits(input) {
+    if (!input.storedFiles) {
+        return {
+            changedFiles: [],
+            modified: false,
+        };
+    }
+    if (!(await fs.pathExists(input.skillDir))) {
+        return {
+            changedFiles: [],
+            modified: false,
+        };
+    }
+    const currentFiles = await computeDirectoryHashes(input.skillDir);
+    const changedFiles = [...new Set([...Object.keys(input.storedFiles), ...Object.keys(currentFiles)])]
+        .filter((relativeFilePath) => input.storedFiles?.[relativeFilePath] !== currentFiles[relativeFilePath])
+        .sort((left, right) => left.localeCompare(right));
+    return {
+        changedFiles,
+        modified: changedFiles.length > 0,
+    };
+}
 /**
  * Clones a remote repository into a temporary checkout and resolves the fetched commit.
  */
@@ -209,6 +280,25 @@ export async function resolveSkillSourceDir(input) {
     });
     return sourceDir;
 }
+/**
+ * Resolves and validates an arbitrary managed skill directory path from a temporary repository checkout.
+ */
+export async function resolveSkillSourceDirByPath(input) {
+    const normalizedSkillPath = normalizeImportedSkillPath(input.skillPath);
+    if (normalizedSkillPath === undefined) {
+        throw new Error('Skill path may not be empty');
+    }
+    const sourceDir = resolveRemoteSkillDirectory({
+        checkoutDir: input.checkoutDir,
+        skillPath: normalizedSkillPath,
+    });
+    await validateRemoteSkillDirectory({
+        sourceDir,
+        skillPath: normalizedSkillPath,
+        repo: normalizeRemoteRepo(input.repo),
+    });
+    return sourceDir;
+}
 /**
  * Fetches a validated remote skill directory snapshot for a specific repository path.
  */
@@ -268,6 +358,35 @@ export function shortCommit(commit) {
 export function timestampNow() {
     return new Date().toISOString();
 }
+/**
+ * Recursively lists all file paths inside a directory relative to that directory root.
+ */
+async function listRelativeFilePaths(directoryPath) {
+    const directoryEntries = await fs.readdir(directoryPath, {
+        withFileTypes: true,
+    });
+    const relativeFilePaths = [];
+    for (const directoryEntry of directoryEntries) {
+        const entryPath = path.join(directoryPath, directoryEntry.name);
+        if (directoryEntry.isDirectory()) {
+            const nestedFilePaths = await listRelativeFilePaths(entryPath);
+            for (const nestedFilePath of nestedFilePaths) {
+                relativeFilePaths.push(path.join(directoryEntry.name, nestedFilePath));
+            }
+            continue;
+        }
+        if (directoryEntry.isFile()) {
+            relativeFilePaths.push(directoryEntry.name);
+        }
+    }
+    return relativeFilePaths.sort((left, right) => left.localeCompare(right));
+}
+/**
+ * Normalizes a relative path to use forward slashes for lockfile portability.
+ */
+function toPortableRelativePath(relativePath) {
+    return relativePath.split(path.sep).join('/');
+}
 function sortSkillsLockfile(lockfile) {
     return {
         version: lockfile.version,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dryai",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "CLI for installing shared AI commands, rules, and skills into Copilot and Cursor.",
   "type": "module",
   "repository": {
@@ -19,7 +19,8 @@
     "dev:dryai": "node ./dest/main.js",
     "tsc": "tsc -b",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "prepare": "husky"
   },
   "bin": {
     "dryai": "dest/main.js"
@@ -37,10 +38,14 @@
     "zod": "^3.24.1"
   },
   "devDependencies": {
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
+    "@commitlint/types": "^20.5.0",
     "@effect/language-service": "^0.85.0",
     "@effect/vitest": "^0.29.0",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^24.0.0",
+    "husky": "^9.1.7",
     "typescript": "^5.8.3",
     "vitest": "^4.1.4"
   },