get-skill 1.0.21 → 1.3.7

package/dist/cli.js

@@ -1,433 +1,55 @@
-// ../cli/src/index.ts
+import {
+  IntegrityError,
+  RegistryError,
+  agentDir,
+  agentSupportsGlobal,
+  canonicalDir,
+  collectFiles,
+  configPath,
+  createClient,
+  detectAgents,
+  digestOf,
+  fetchBundle,
+  gigetInput,
+  hostOf,
+  installSkill,
+  isSkillDirOrLink,
+  listInstalled,
+  looksLikeProject,
+  missingFilesNote,
+  parseSource,
+  readConfig,
+  readLock,
+  resolveApi,
+  resolvePackFiles,
+  resolveSource,
+  resolveTree,
+  safeText,
+  skillMdFor,
+  sourceId,
+  telemetryDisabled,
+  uninstallSkill,
+  upsertEntry,
+  writeConfig
+} from "./chunk-MPBRLZWJ.js";
+
+// src/index.ts
 import { Command as Command13 } from "commander";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
+import pc15 from "picocolors";
 
-// ../cli/src/commands/lint.ts
+// src/commands/lint.ts
 import { Command } from "commander";
 import { writeFileSync } from "fs";
-import { homedir } from "os";
-import { resolve } from "path";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve2 } from "path";
 import pc2 from "picocolors";
 import * as p from "@clack/prompts";
+import { lint, toJson, toSarif, toGithub } from "@skillmds/core";
 
-// ../../packages/core/src/parse.ts
-import { parse as parseYaml } from "yaml";
-var MAX_SKILL_BYTES = 256 * 1024;
-var MAX_DESCRIPTION = 1024;
-var MAX_NAME = 120;
-var slugify = (s) => String(s).toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "skill";
-function parseSkillMd(raw, type = "single") {
-  if (!raw || raw.length > MAX_SKILL_BYTES) return { error: "SKILL.md missing or too large (max 256KB)" };
-  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
-  if (!m) return { error: "Missing YAML frontmatter (--- ... ---)" };
-  let fm;
-  try {
-    fm = parseYaml(m[1] ?? "") ?? {};
-  } catch {
-    return { error: "Invalid YAML frontmatter" };
-  }
-  const name = String(fm.name ?? "").trim();
-  const description = String(fm.description ?? "").replace(/\s+/g, " ").trim();
-  if (!name) return { error: "frontmatter 'name' is required" };
-  if (!description) return { error: "frontmatter 'description' is required" };
-  if (description.length > MAX_DESCRIPTION) return { error: `description must be <= ${MAX_DESCRIPTION} chars` };
-  return {
-    name: name.slice(0, MAX_NAME),
-    description: description.slice(0, MAX_DESCRIPTION),
-    license: fm.license ? String(fm.license).slice(0, 64) : null,
-    body: m[2] ?? "",
-    type
-  };
-}
-
-// ../../packages/core/src/security.ts
-var UNTRUSTED_INSTALL_RE = new RegExp(
-  [
-    /(?:npx|npm|yarn|pnpm|bun)\b[^\n]*--registry[= ]/.source,
-    // custom npm registry
-    /npm\s+config\s+set\s+registry/.source,
-    /pip3?\s+install\b[^\n]*(?:--index-url|--extra-index-url|-i\s+https?:)/.source,
-    // custom pip index
-    /(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|fi)?sh\b/.source,
-    // curl … | sh
-    /(?:iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n|]*\|\s*iex\b/.source,
-    // PowerShell pipe-to-exec
-    /bash\s+<\(\s*(?:curl|wget)/.source,
-    // bash <(curl …)
-    /(?:pip3?|npm|npx)\s+(?:install|--yes|-y)?\s*[^\n]*https?:\/\/(?!registry\.npmjs\.org|pypi\.org|files\.pythonhosted\.org)[^\s'"`]+\.(?:whl|tar\.gz|tgz|zip)\b/.source
-    // install from raw archive URL
-  ].join("|"),
-  "i"
-);
-var RULES = [
-  ["untrusted_install", UNTRUSTED_INSTALL_RE],
-  ["executes_scripts", /```(?:sh|bash|python|py|js|ts|ruby|rb)\b|\b(subprocess|os\.system|child_process|exec\()/i],
-  ["network_calls", /\b(fetch|requests\.|urllib|axios|curl|wget|https?:\/\/|websocket)\b/i],
-  ["reads_secrets", /\b(api[_-]?key|secret|token|password|os\.environ|process\.env|getenv)\b/i]
-];
-function scanSecurity(body) {
-  const findings = [];
-  body.split(/\r?\n/).forEach((text3, i) => {
-    for (const [flag, re] of RULES) {
-      if (re.test(text3)) findings.push({ flag, line: i + 1, snippet: text3.trim().slice(0, 120) });
-    }
-  });
-  const flags = [...new Set(findings.map((f) => f.flag))];
-  return { flags: flags.length ? flags : ["docs_only"], findings };
-}
-
-// ../../packages/core/src/rules.ts
-function utf8Bytes(s) {
-  let bytes = 0;
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 128) bytes += 1;
-    else if (c < 2048) bytes += 2;
-    else if (c >= 55296 && c <= 56319) {
-      bytes += 4;
-      i++;
-    } else bytes += 3;
-  }
-  return bytes;
-}
-var diag = (rule, message, line) => ({
-  id: rule.id,
-  severity: rule.severity,
-  message,
-  ...line !== void 0 ? { line } : {}
-});
-var RULES2 = [
-  {
-    id: "SK002",
-    severity: "error",
-    description: "name must be present and \u2264 120 chars",
-    check(s, _ctx) {
-      const out = [];
-      if (!s.name.trim()) out.push(diag(this, "frontmatter 'name' is required"));
-      else if (s.name.length > MAX_NAME) out.push(diag(this, `name must be \u2264 ${MAX_NAME} chars`));
-      return out;
-    }
-  },
-  {
-    id: "SK003",
-    severity: "error",
-    description: "description must be present and \u2264 1024 chars",
-    check(s, _ctx) {
-      const out = [];
-      if (!s.description.trim()) out.push(diag(this, "frontmatter 'description' is required"));
-      else if (s.description.length > MAX_DESCRIPTION) out.push(diag(this, `description must be \u2264 ${MAX_DESCRIPTION} chars`));
-      return out;
-    }
-  },
-  {
-    id: "SK010",
-    severity: "warn",
-    description: "description should be \u2265 20 chars (not too terse)",
-    check(s, _ctx) {
-      return s.description.trim().length > 0 && s.description.trim().length < 20 ? [diag(this, "description is very terse (< 20 chars); add more detail to help discovery")] : [];
-    }
-  },
-  {
-    id: "SK011",
-    severity: "warn",
-    description: "license should be declared in frontmatter",
-    check(s, _ctx) {
-      return s.license ? [] : [diag(this, "no 'license' declared in frontmatter")];
-    }
-  },
-  {
-    id: "SK020",
-    severity: "warn",
-    description: "body should be \u2265 200 chars (not a stub)",
-    check(s, _ctx) {
-      return s.body.trim().length < 200 ? [diag(this, "body is very short (< 200 chars); this looks like a stub")] : [];
-    }
-  },
-  {
-    id: "SK021",
-    severity: "warn",
-    description: "body should contain at least one Markdown heading",
-    check(s, _ctx) {
-      return /^#{1,6}\s/m.test(s.body) ? [] : [diag(this, "body has no Markdown headings; add structure with '#' headings")];
-    }
-  },
-  {
-    id: "SK030",
-    severity: "error",
-    description: "total SKILL.md size must be \u2264 256KB",
-    check(s, _ctx) {
-      return utf8Bytes(s.body) > MAX_SKILL_BYTES ? [diag(this, "SKILL.md exceeds 256KB")] : [];
-    }
-  },
-  {
-    id: "SK040",
-    severity: "warn",
-    description: "name should match its directory/slug",
-    check(s, ctx) {
-      if (!ctx.slug) return [];
-      const expected = slugify(s.name);
-      return expected === ctx.slug ? [] : [diag(this, `name slug '${expected}' does not match directory '${ctx.slug}'`)];
-    }
-  }
-];
-function runRules(skill, ctx = {}) {
-  return RULES2.flatMap((r) => r.check(skill, ctx));
-}
-
-// ../../packages/core/src/quality.ts
-var WEIGHT = {
-  error: 30,
-  warn: 10,
-  info: 3
-};
-var RISK = {
-  docs_only: 0,
-  reads_secrets: 2,
-  network_calls: 1,
-  executes_scripts: 5,
-  // fetch-and-execute from a non-standard source — the supply-chain pattern the
-  // AI verdict floors to "warning"; the heaviest penalty here for the same reason
-  untrusted_install: 15
-};
-var VERIFIED_FLOOR = 85;
-function qualityScore(diagnostics, security, opts = {}) {
-  let penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
-  if (security) {
-    for (const flag of security.flags) penalty += RISK[flag] ?? 0;
-  }
-  const score = Math.max(0, Math.min(100, 100 - penalty));
-  const hasError = diagnostics.some((d) => d.severity === "error");
-  return opts.verified && !hasError ? Math.max(score, VERIFIED_FLOOR) : score;
-}
-
-// ../../packages/core/src/lint.ts
-function lint(raw, opts = {}) {
-  const parsed = parseSkillMd(raw, opts.type ?? "single");
-  if ("error" in parsed) {
-    const diagnostics2 = [{ id: "SK001", severity: "error", message: parsed.error }];
-    const security2 = scanSecurity(raw);
-    return {
-      ok: false,
-      diagnostics: diagnostics2,
-      security: security2,
-      score: qualityScore(diagnostics2, security2, { verified: opts.verified })
-    };
-  }
-  const ctx = opts.slug !== void 0 ? { slug: opts.slug } : {};
-  const diagnostics = runRules(parsed, ctx);
-  const security = scanSecurity(parsed.body);
-  const ok = !diagnostics.some((d) => d.severity === "error");
-  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics, security, { verified: opts.verified }) };
-}
-
-// ../../packages/core/src/format/text.ts
-var BADGE = { error: "ERROR", warn: " WARN", info: " INFO" };
-function toText(results, opts = {}) {
-  const paint = opts.decorate ?? ((t) => t);
-  const out = [];
-  for (const { file, result } of results) {
-    const status = result.ok ? paint("PASS", "ok") : paint("FAIL", "error");
-    out.push(`${status}  ${file}  ${paint(`score ${result.score}/100`, "dim")}`);
-    for (const d of result.diagnostics) {
-      const where = d.line !== void 0 ? `:${d.line}` : "";
-      out.push(`  ${paint(BADGE[d.severity], d.severity)}  ${d.id}${where}  ${d.message}`);
-    }
-    if (result.security.flags.length && result.security.flags[0] !== "docs_only") {
-      out.push(`  ${paint("SEC ", "warn")}  flags: ${result.security.flags.join(", ")}`);
-    }
-    out.push("");
-  }
-  const failed = results.filter((r) => !r.result.ok).length;
-  const summary = failed === 0 ? paint(`\u2713 ${results.length} skill(s) passed`, "ok") : paint(`\u2717 ${failed}/${results.length} skill(s) failed`, "error");
-  out.push(summary);
-  return out.join("\n");
-}
-
-// ../../packages/core/src/format/json.ts
-function toJson(results) {
-  return results.map(({ file, result }) => ({
-    file,
-    ok: result.ok,
-    score: result.score,
-    diagnostics: result.diagnostics,
-    security: result.security
-  }));
-}
-
-// ../../packages/core/src/format/sarif.ts
-var SARIF_LEVEL = { error: "error", warn: "warning", info: "note" };
-function toSarif(results) {
-  const sarifResults = results.flatMap(
-    ({ file, result }) => result.diagnostics.map((d) => ({
-      ruleId: d.id,
-      level: SARIF_LEVEL[d.severity] ?? "note",
-      message: { text: d.message },
-      locations: [
-        {
-          physicalLocation: {
-            artifactLocation: { uri: file },
-            region: { startLine: d.line ?? 1 }
-          }
-        }
-      ]
-    }))
-  );
-  return {
-    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
-    version: "2.1.0",
-    runs: [
-      {
-        tool: {
-          driver: {
-            name: "skillmd",
-            informationUri: "https://skillmd.com",
-            rules: RULES2.map((r) => ({
-              id: r.id,
-              shortDescription: { text: r.description },
-              defaultConfiguration: { level: SARIF_LEVEL[r.severity] ?? "note" }
-            }))
-          }
-        },
-        results: sarifResults
-      }
-    ]
-  };
-}
-
-// ../../packages/core/src/format/github.ts
-var LEVEL = { error: "error", warn: "warning", info: "notice" };
-function toGithub(results) {
-  const lines = [];
-  for (const { file, result } of results) {
-    for (const d of result.diagnostics) {
-      const level = LEVEL[d.severity] ?? "notice";
-      const loc = d.line !== void 0 ? `,line=${d.line}` : "";
-      lines.push(`::${level} file=${file}${loc},title=${d.id}::${d.message}`);
-    }
-  }
-  return lines.join("\n");
-}
-
-// ../cli/src/source.ts
-import { existsSync, statSync, lstatSync, readFileSync, readdirSync, mkdtempSync, rmSync } from "fs";
-import { tmpdir } from "os";
-import { join, basename, dirname, relative, sep } from "path";
-var IGNORE_DIRS = /* @__PURE__ */ new Set([
-  // build/dependency dirs
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  "out",
-  ".next",
-  ".wrangler",
-  ".cache",
-  ".npm",
-  ".pnpm-store",
-  ".venv",
-  "venv",
-  "__pycache__",
-  "target",
-  "vendor",
-  // large OS / user dirs (mostly relevant when run from a home directory)
-  "AppData",
-  "Library",
-  "$Recycle.Bin",
-  "System Volume Information",
-  "Windows",
-  "Program Files"
-]);
-var MAX_DEPTH = 12;
-function findSkillFiles(dir, depth = 0) {
-  const out = [];
-  if (depth > MAX_DEPTH) return out;
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const entry of entries) {
-    if (entry.isDirectory()) {
-      if (IGNORE_DIRS.has(entry.name)) continue;
-      out.push(...findSkillFiles(join(dir, entry.name), depth + 1));
-    } else if (entry.name === "SKILL.md") {
-      out.push(join(dir, entry.name));
-    }
-  }
-  return out;
-}
-function loadLocal(file) {
-  return { path: file, raw: readFileSync(file, "utf8"), slug: basename(dirname(file)), file };
-}
-function isLikelyLocal(arg) {
-  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync(arg);
-}
-async function resolveSource(arg) {
-  if (isLikelyLocal(arg)) {
-    if (!existsSync(arg)) throw new Error(`Path not found: ${arg}`);
-    const st = statSync(arg);
-    if (st.isFile()) return [loadLocal(arg)];
-    const files2 = findSkillFiles(arg);
-    if (files2.length === 0) {
-      throw new Error(`No SKILL.md found under ${arg}. Point at a skill directory, e.g. "skillmd lint ./my-skill", or run "skillmd init" to create one.`);
-    }
-    return files2.map(loadLocal);
-  }
-  const { downloadTemplate } = await import("giget");
-  const input = normalizeGiget(arg);
-  const dir = mkdtempSync(join(tmpdir(), "skillmd-src-"));
-  const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
-  const files = findSkillFiles(out);
-  if (files.length === 0) throw new Error(`No SKILL.md found in ${arg}`);
-  return files.map(loadLocal);
-}
-var MAX_PACK_FILES = 200;
-var MAX_PACK_BYTES = 20 * 1024 * 1024;
-function collectFiles(root, dir, limits = {}) {
-  const maxFiles = limits.maxFiles ?? MAX_PACK_FILES;
-  const maxBytes = limits.maxBytes ?? MAX_PACK_BYTES;
-  const out = [];
-  let bytes = 0;
-  const walk = (d, depth) => {
-    if (depth > MAX_DEPTH) return;
-    for (const entry of readdirSync(d, { withFileTypes: true })) {
-      const fp = join(d, entry.name);
-      const st = lstatSync(fp);
-      if (st.isSymbolicLink()) continue;
-      if (st.isDirectory()) {
-        if (entry.name === ".git" || entry.name === "node_modules") continue;
-        walk(fp, depth + 1);
-      } else if (st.isFile()) {
-        if (out.length >= maxFiles) throw new Error(`pack too large: > ${maxFiles} files`);
-        bytes += st.size;
-        if (bytes > maxBytes) throw new Error(`pack too large: > ${Math.round(maxBytes / (1024 * 1024))}MB`);
-        out.push({ path: relative(root, fp).split(sep).join("/"), contents: readFileSync(fp) });
-      }
-    }
-  };
-  walk(dir, 0);
-  return out;
-}
-async function resolveTree(sourceUrl, ref) {
-  const { downloadTemplate } = await import("giget");
-  const input = normalizeGiget(sourceUrl) + (ref ? `#${ref}` : "");
-  const dir = mkdtempSync(join(tmpdir(), "skillmd-pack-"));
-  try {
-    const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
-    return collectFiles(out, out);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-function normalizeGiget(arg) {
-  const m = arg.match(/github\.com\/([^/]+)\/([^/]+)(?:\/tree\/[^/]+\/(.+))?/);
-  if (m) return `github:${m[1]}/${m[2]}${m[3] ? "/" + m[3] : ""}`;
-  if (arg.startsWith("github:") || arg.startsWith("gh:")) return arg;
-  return `github:${arg}`;
-}
-
-// ../cli/src/ui.ts
+// src/ui.ts
+import { homedir } from "os";
+import { relative, resolve, sep } from "path";
 import pc from "picocolors";
 var decorate = (text3, kind) => {
   switch (kind) {
@@ -451,7 +73,11 @@ var SEV_COLOR = {
 var GLYPH = {
   error: "\u2716",
   warn: "\u26A0",
-  info: "\u2139"
+  info: "\u2139",
+  ok: "\u2713",
+  skip: "\u21B7",
+  blocked: "\u2717",
+  replaced: "\u26A0"
 };
 var SEC_GLYPH = "\u2691";
 var SEV_ORDER = ["error", "warn", "info"];
@@ -485,7 +111,7 @@ function statusDot(result) {
   return attention ? pc.yellow("\u25CF") : pc.green("\u25CF");
 }
 function failureBlock(file, result) {
-  const lines = [`${pc.red("\u2716")} ${pc.bold(label(file))}`];
+  const lines = [`${pc.red(GLYPH.error)} ${pc.bold(label(file))}`];
   for (const d of result.diagnostics.filter((x) => x.severity === "error")) {
     const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
     lines.push(`    ${SEV_COLOR.error(d.id)}${loc}  ${d.message}`);
@@ -539,7 +165,7 @@ function renderMany(results) {
 }
 function renderFailuresView(results) {
   const fails = results.filter((r) => !r.result.ok);
-  if (!fails.length) return pc.green(`\u2713 No failures across ${results.length} skill${results.length === 1 ? "" : "s"}.`);
+  if (!fails.length) return pc.green(`${GLYPH.ok} No failures across ${results.length} skill${results.length === 1 ? "" : "s"}.`);
   const out = fails.map((f) => failureBlock(f.file, f.result));
   out.push("");
   out.push(`${pc.red(`${fails.length} failed`)} ${pc.dim(`of ${results.length}`)}`);
@@ -560,8 +186,90 @@ function exitCodeFor(results, policy = {}) {
   }
   return 0;
 }
+function shortPath(p7, ctx = {}) {
+  const home = resolve(ctx.home ?? homedir());
+  const cwd = resolve(ctx.cwd ?? process.cwd());
+  const abs = resolve(p7);
+  const norm = (s) => s.split(sep).join("/");
+  if (abs === cwd) return ".";
+  if (abs.startsWith(cwd + sep)) return `./${norm(relative(cwd, abs))}`;
+  if (abs === home) return "~";
+  if (abs.startsWith(home + sep)) return `~/${norm(relative(home, abs))}`;
+  return norm(abs);
+}
+var SGR = /\x1b\[[0-9;]*m/g;
+var SGR_AT = /\x1b\[[0-9;]*m/y;
+var RESET = "\x1B[0m";
+function stripAnsi(s) {
+  return s.replace(SGR, "");
+}
+var visible = (s) => stripAnsi(s).length;
+function truncateVisible(s, max) {
+  if (max <= 0) return "";
+  if (visible(s) <= max) return s;
+  let out = "";
+  let shown = 0;
+  let open = false;
+  for (let i = 0; i < s.length && shown < max - 1; ) {
+    if (s[i] === "\x1B") {
+      SGR_AT.lastIndex = i;
+      const m = SGR_AT.exec(s);
+      if (m) {
+        out += m[0];
+        open = m[0] !== RESET && m[0] !== "\x1B[m";
+        i += m[0].length;
+        continue;
+      }
+    }
+    out += s[i];
+    shown++;
+    i++;
+  }
+  return out + "\u2026" + (open ? RESET : "");
+}
+var termWidth = (w) => w ?? Math.min(process.stdout.columns ?? 100, 120);
+function table(rows, opts = {}) {
+  if (rows.length === 0) return "";
+  const width = termWidth(opts.width);
+  const indent = opts.indent ?? "";
+  const cols = Math.max(...rows.map((r) => r.length));
+  const widths = Array.from({ length: cols }, (_, i) => Math.max(...rows.map((r) => visible(r[i] ?? ""))));
+  return rows.map((r) => {
+    let line = indent;
+    for (let i = 0; i < cols; i++) {
+      const cell = r[i] ?? "";
+      if (i < cols - 1) {
+        line += cell + " ".repeat(widths[i] - visible(cell) + 2);
+        continue;
+      }
+      line += truncateVisible(cell, Math.max(4, width - visible(line)));
+    }
+    line = line.trimEnd();
+    return visible(line) > width ? truncateVisible(line, width) : line;
+  }).join("\n");
+}
+function renderInstallSummary(i, ctx = {}) {
+  const width = termWidth(ctx.width);
+  const src = i.source.startsWith("local:") ? `local:${shortPath(i.source.slice(6), ctx)}` : i.source;
+  const head = truncateVisible(
+    pc.green(`${GLYPH.ok} ${i.name}`) + pc.dim(`  score ${i.score}${i.flags.length ? `  ${i.flags.join(", ")}` : ""}  from ${src}`),
+    width
+  );
+  const byPath = /* @__PURE__ */ new Map();
+  for (const t of i.targets) {
+    const e = byPath.get(t.path);
+    if (e) e.agents.push(t.agent);
+    else byPath.set(t.path, { agents: [t.agent], mode: t.mode });
+  }
+  const rows = [...byPath.entries()].map(([path, e]) => [pc.cyan(e.agents.join(", ")), pc.dim(e.mode), shortPath(path, ctx)]);
+  const body = rows.length ? table(rows, { width, indent: "  " }) : truncateVisible(pc.dim(`  ${shortPath(i.canonical, ctx)}  canonical only`), width);
+  const skipped = i.skipped.map((s) => truncateVisible(pc.dim(`  ${GLYPH.skip} ${s.agent}: ${s.reason}`), width));
+  const replaced = i.replaced ? [truncateVisible(pc.yellow(`  ${GLYPH.replaced} replaced previous install (${i.replaced === "untracked" ? "untracked directory" : i.replaced})`), width)] : [];
+  return [head, body, ...skipped, ...replaced].join("\n");
+}
+var banner = () => pc.bgCyan(pc.black(" skillmd "));
 
-// ../cli/src/commands/lint.ts
+// src/commands/lint.ts
 function applyLicenseFix(raw) {
   if (/^---[\s\S]*?\blicense:\s*\S+[\s\S]*?^---/m.test(raw)) return null;
   const m = raw.match(/^(---\r?\n)([\s\S]*?)(\r?\n---)/);
@@ -601,9 +309,9 @@ async function runLint(target, flags) {
   return { results, output, exitCode };
 }
 function lintCommand() {
-  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").option("--errors-only", "show only skills that failed").action(async (target, opts) => {
+  return new Command("lint").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").option("--errors-only", "show only skills that failed").action(async (target, opts) => {
     const ui = Boolean(process.stdout.isTTY) && opts.format === "text";
-    if (resolve(target) === homedir()) {
+    if (resolve2(target) === homedir2()) {
       process.stderr.write(pc2.yellow(`Warning: scanning your entire home directory. Pass a narrower path, e.g. skillmd lint ./my-skill
 `));
     }
@@ -612,12 +320,12 @@ function lintCommand() {
       const s = p.spinner();
       s.start(`Scanning ${target}`);
       try {
-        const run2 = await runLint(target, opts);
-        s.stop(`Scanned ${run2.results.length} skill${run2.results.length === 1 ? "" : "s"}`);
-        console.log(run2.output);
-        const failed = run2.results.filter((r) => !r.result.ok).length;
+        const run3 = await runLint(target, opts);
+        s.stop(`Scanned ${run3.results.length} skill${run3.results.length === 1 ? "" : "s"}`);
+        console.log(run3.output);
+        const failed = run3.results.filter((r) => !r.result.ok).length;
         p.outro(failed === 0 ? pc2.green("All good") : pc2.red(`${failed} skill${failed === 1 ? "" : "s"} failed \u2014 details above`));
-        process.exitCode = run2.exitCode;
+        process.exitCode = run3.exitCode;
       } catch (err) {
         s.stop(pc2.red("No skills found"));
         p.outro(err instanceof Error ? err.message : String(err));
@@ -627,14 +335,15 @@ function lintCommand() {
     }
     process.stderr.write(`Looking for SKILL.md under ${target} \u2026
 `);
-    const run = await runLint(target, opts);
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runLint(target, opts);
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
-// ../cli/src/commands/scan.ts
+// src/commands/scan.ts
 import { Command as Command2 } from "commander";
+import { scanSecurity, parseSkillMd } from "@skillmds/core";
 import pc3 from "picocolors";
 async function runScan(target, flags) {
   const resolved = await resolveSource(target);
@@ -667,18 +376,19 @@ async function runScan(target, flags) {
 }
 function scanCommand() {
   return new Command2("scan").description("Security-scan SKILL.md file(s) for scripts, network calls and secret access").argument("[target]", "local path or GitHub source", ".").option("--deny <flags...>", "exit non-zero if any of these flags are present (e.g. executes_scripts)").option("--format <fmt>", "text | json", "text").action(async (target, opts) => {
-    const run = await runScan(target, opts);
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runScan(target, opts);
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
-// ../cli/src/commands/rules.ts
+// src/commands/rules.ts
 import { Command as Command3 } from "commander";
+import { RULES } from "@skillmds/core";
 import pc4 from "picocolors";
 function rulesCommand() {
   return new Command3("rules").description("List lint rules, or show detail for one rule id").argument("[id]", "a rule id, e.g. SK010").option("--json", "machine-readable output").action((id, opts) => {
-    const list = id ? RULES2.filter((r) => r.id.toLowerCase() === id.toLowerCase()) : RULES2;
+    const list = id ? RULES.filter((r) => r.id.toLowerCase() === id.toLowerCase()) : RULES;
     if (id && list.length === 0) {
       console.error(`Unknown rule: ${id}`);
       process.exitCode = 1;
@@ -695,11 +405,45 @@ function rulesCommand() {
   });
 }
 
-// ../cli/src/commands/init.ts
+// src/commands/init.ts
 import { Command as Command4 } from "commander";
-import { mkdirSync, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
+import { mkdirSync, writeFileSync as writeFileSync2, existsSync } from "fs";
+import { join } from "path";
+import { slugify } from "@skillmds/core";
 import * as p2 from "@clack/prompts";
+import pc5 from "picocolors";
+
+// src/env.ts
+function detectHostAgent(env = process.env) {
+  if (env.CLAUDECODE) return "claude-code";
+  if (env.CURSOR_AGENT || env.CURSOR_EXTENSION_HOST_ROLE === "agent-exec") return "cursor";
+  if (env.CODEX_SANDBOX || env.CODEX_THREAD_ID) return "codex";
+  if (env.GEMINI_CLI) return "gemini-cli";
+  if (env.CI && env.CI !== "false" && env.CI !== "0") return "ci";
+  return null;
+}
+var realTerminal = () => ({
+  stdinTTY: Boolean(process.stdin.isTTY),
+  stdoutTTY: Boolean(process.stdout.isTTY),
+  env: process.env
+});
+function isInteractive(flags, term = realTerminal()) {
+  if (flags.yes || flags.json) return false;
+  if (!term.stdinTTY || !term.stdoutTTY) return false;
+  return detectHostAgent(term.env) === null;
+}
+function scopesFor(flags) {
+  return flags.global && !flags.project ? [true] : flags.project && !flags.global ? [false] : [false, true];
+}
+function nonInteractiveHint(flags) {
+  return `Interactive prompt required but stdin is not a terminal. Nothing was changed. Re-run with ${flags} to run non-interactively.`;
+}
+function promptIf(flags, prompt) {
+  const term = { stdinTTY: Boolean(process.stdin.isTTY), stdoutTTY: Boolean(process.stdout.isTTY), env: flags.env ?? process.env };
+  return isInteractive(flags, term) ? { prompt } : {};
+}
+
+// src/commands/init.ts
 function skillTemplate(name, description, license) {
   const desc = description.trim() || `A skill that helps agents with ${name}.`;
   return `---
@@ -728,159 +472,54 @@ Add any constraints, edge cases, or references the agent should keep in mind.
 }
 function initSkill(name, opts = {}) {
   const slug = slugify(name);
-  const root = join2(opts.dir ?? process.cwd(), slug);
-  if (existsSync2(join2(root, "SKILL.md"))) throw new Error(`SKILL.md already exists at ${root}`);
+  const root = join(opts.dir ?? process.cwd(), slug);
+  if (existsSync(join(root, "SKILL.md"))) throw new Error(`SKILL.md already exists at ${root}`);
   mkdirSync(root, { recursive: true });
-  const file = join2(root, "SKILL.md");
+  const file = join(root, "SKILL.md");
   writeFileSync2(file, skillTemplate(name, opts.description ?? "", opts.license ?? "MIT"), "utf8");
   return file;
 }
-function initCommand() {
-  return new Command4("init").description("Scaffold a new SKILL.md from a template").argument("[name]", "skill name").option("--name <name>", "skill name (non-interactive)").option("--description <text>", "skill description").option("--license <license>", "license identifier", "MIT").option("-y, --yes", "skip prompts").action(async (nameArg, opts) => {
-    let name = nameArg ?? opts.name;
-    if (!name && !opts.yes) {
-      const answer = await p2.text({ message: "Skill name?", placeholder: "my-skill" });
-      if (p2.isCancel(answer)) {
-        p2.cancel("Cancelled.");
-        return;
-      }
-      name = answer;
-    }
-    if (!name) {
-      console.error("A skill name is required (pass a name or --name).");
-      process.exitCode = 1;
-      return;
+var defaultInitDeps = (flags) => promptIf(flags, async () => {
+  const answer = await p2.text({ message: "Skill name?", placeholder: "my-skill" });
+  return p2.isCancel(answer) ? null : answer;
+});
+function finish(flags, result, doc) {
+  return flags.json ? { ...result, output: JSON.stringify(doc, null, 2) } : result;
+}
+async function runInit(nameArg, flags, deps = defaultInitDeps(flags)) {
+  let name = nameArg ?? flags.name;
+  if (!name) {
+    if (!deps.prompt) {
+      const error = nonInteractiveHint("a name argument or --name <name>");
+      return finish(flags, { exitCode: 1, output: pc5.red(error) }, { ok: false, error });
     }
-    const file = initSkill(name, { description: opts.description, license: opts.license });
-    console.log(`Created ${file}`);
-  });
-}
-
-// ../cli/src/commands/search.ts
-import { Command as Command5 } from "commander";
-import pc5 from "picocolors";
-
-// ../cli/src/api.ts
-import { createHash } from "crypto";
-import { stringify as stringifyYaml } from "yaml";
-
-// ../cli/src/config.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-var DEFAULT_API = "https://api.skillmd.com";
-function configPath() {
-  return join3(homedir2(), ".skillmd", "config.json");
-}
-function readConfig() {
-  try {
-    return JSON.parse(readFileSync2(configPath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-function writeConfig(cfg) {
-  const dir = join3(homedir2(), ".skillmd");
-  mkdirSync2(dir, { recursive: true });
-  writeFileSync3(configPath(), JSON.stringify(cfg, null, 2), { encoding: "utf8", mode: 384 });
-}
-function resolveToken(flags = {}) {
-  return flags.token || process.env.SKILLMD_TOKEN || readConfig().token || void 0;
-}
-function resolveApi(flags = {}) {
-  return flags.api || process.env.SKILLMD_API || readConfig().api || DEFAULT_API;
-}
-
-// ../cli/src/api.ts
-var IntegrityError = class extends Error {
-  integrity = true;
-  constructor(message) {
-    super(message);
-    this.name = "IntegrityError";
+    const answer = await deps.prompt();
+    if (answer === null) return finish(flags, { exitCode: 0, output: pc5.dim("Cancelled.") }, { ok: false, cancelled: true });
+    name = answer;
   }
-};
-var RegistryError = class extends Error {
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "RegistryError";
+  if (!name) {
+    const error = "A skill name is required (pass a name or --name).";
+    return finish(flags, { exitCode: 1, output: pc5.red(error) }, { ok: false, error });
   }
-  status;
-};
-var ALLOWED_SOURCE_HOSTS = /* @__PURE__ */ new Set(["raw.githubusercontent.com", "gist.githubusercontent.com"]);
-function isAllowedSourceUrl(u) {
   try {
-    const parsed = new URL(u);
-    return parsed.protocol === "https:" && ALLOWED_SOURCE_HOSTS.has(parsed.hostname.toLowerCase());
-  } catch {
-    return false;
-  }
-}
-function createClient(flags = {}) {
-  const base = resolveApi(flags);
-  const token = resolveToken(flags);
-  async function api(path, init = {}) {
-    const headers = { accept: "application/json", ...init.headers };
-    if (token) headers.authorization = `Bearer ${token}`;
-    let res;
-    try {
-      res = await fetch(base + path, { ...init, headers });
-    } catch (e) {
-      const cause = e instanceof Error ? e.cause?.message ?? e.message : String(e);
-      throw new RegistryError(`could not reach ${base}: ${cause}`);
-    }
-    if (!res.ok) {
-      const detail = await res.text().catch(() => "");
-      throw new RegistryError(`SkillMD API ${res.status} on ${path}: ${detail}`, res.status);
-    }
-    return await res.json();
-  }
-  return { api, base, token, hasToken: Boolean(token) };
-}
-async function fetchBundle(base, slug, token) {
-  const headers = { accept: "application/json" };
-  if (token) headers.authorization = `Bearer ${token}`;
-  const res = await fetch(`${base}/api/skills/${slug}/bundle?format=json`, { headers }).catch(() => null);
-  if (!res || !res.ok) return null;
-  const data = await res.json().catch(() => null);
-  if (!data?.files) return null;
-  const out = [];
-  for (const f of data.files) {
-    if (f.content_base64 != null) {
-      const contents = Buffer.from(f.content_base64, "base64");
-      if (f.sha256) {
-        const got = createHash("sha256").update(contents).digest("hex");
-        if (got !== f.sha256) {
-          throw new IntegrityError(`integrity check failed for "${f.path}" (expected ${f.sha256.slice(0, 12)}\u2026, got ${got.slice(0, 12)}\u2026)`);
-        }
-      }
-      out.push({ path: f.path, contents });
-    } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
-      const r = await fetch(f.source_url).catch(() => null);
-      if (r && r.ok) out.push({ path: f.path, contents: Buffer.from(await r.arrayBuffer()) });
-    }
-  }
-  return out;
-}
-function skillMdFor(skill) {
-  if (skill.raw_md) {
-    return hasFrontmatter(skill.raw_md) ? skill.raw_md : reconstructSkillMd({ ...skill, body_md: skill.raw_md });
+    const file = initSkill(name, { dir: flags.dir, description: flags.description, license: flags.license });
+    return { exitCode: 0, file, output: flags.json ? JSON.stringify({ ok: true, file }, null, 2) : `Created ${file}` };
+  } catch (e) {
+    const msg2 = e instanceof Error ? e.message : String(e);
+    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg2 }, null, 2) : pc5.red(msg2) };
   }
-  return reconstructSkillMd(skill);
 }
-function hasFrontmatter(md) {
-  return /^\uFEFF?\s*---\r?\n/.test(md);
-}
-function reconstructSkillMd(skill) {
-  const name = skill.slug.split("/")[1] || skill.title;
-  const fm = { name, description: String(skill.description).replace(/\n/g, " ") };
-  if (skill.license) fm.license = skill.license;
-  return `---
-${stringifyYaml(fm)}---
-${skill.body_md || ""}`;
+function initCommand() {
+  return new Command4("init").description("Scaffold a new SKILL.md from a template").argument("[name]", "skill name").option("--name <name>", "skill name (non-interactive)").option("--description <text>", "skill description").option("--license <license>", "license identifier", "MIT").option("--json", "machine-readable output").option("-y, --yes", "skip prompts").action(async (nameArg, opts, cmd) => {
+    const r = await runInit(nameArg, { ...cmd.parent?.opts(), ...opts });
+    console.log(r.output);
+    process.exitCode = r.exitCode;
+  });
 }
 
-// ../cli/src/commands/search.ts
+// src/commands/search.ts
+import { Command as Command5 } from "commander";
+import pc6 from "picocolors";
 var MAX_LINE_WIDTH = 100;
 function formatStars(n) {
   if (n >= 1e6) {
@@ -899,13 +538,13 @@ function truncate(text3, width) {
   return `${text3.slice(0, width - 1).trimEnd()}\u2026`;
 }
 function formatSearchResult(item, width = process.stdout.columns ?? 80) {
-  const stars = item.repo_stars != null ? pc5.dim(`\u2605 ${formatStars(item.repo_stars)}`) : "";
-  const check = item.verified ? pc5.green("\u2713") : "";
-  const pack = item.type === "pack" ? pc5.dim("[pack]") : "";
-  const head = [pc5.bold(item.slug), stars, check, pack].filter(Boolean).join(" ");
+  const stars = item.repo_stars != null ? pc6.dim(`\u2605 ${formatStars(item.repo_stars)}`) : "";
+  const check = item.verified ? pc6.green("\u2713") : "";
+  const pack = item.type === "pack" ? pc6.dim("[pack]") : "";
+  const head = [pc6.bold(safeText(item.slug, 200)), stars, check, pack].filter(Boolean).join(" ");
   const indent = "  ";
   const lineWidth = Math.max(10, Math.min(width, MAX_LINE_WIDTH) - indent.length);
-  const desc = `${indent}${pc5.dim(truncate(item.description ?? "", lineWidth))}`;
+  const desc = `${indent}${pc6.dim(truncate(safeText(item.description ?? ""), lineWidth))}`;
   return `${head}
 ${desc}`;
 }
@@ -925,201 +564,287 @@ async function runSearch(query, flags) {
 function searchCommand() {
   return new Command5("search").description("Search the SkillMD registry").argument("<query>", "search terms").option("--category <slug>", "filter by category").option("--verified", "only verified skills").option("--type <type>", "single | pack").option("--min-rating <n>", "minimum average rating (0-5)").option("--limit <n>", "max results", "20").option("--json", "machine-readable output").action(async (query, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runSearch(query, merged);
-    console.log(run.output);
+    const run2 = await runSearch(query, merged);
+    console.log(run2.output);
   });
 }
 
-// ../cli/src/commands/info.ts
+// src/commands/info.ts
 import { Command as Command6 } from "commander";
-import pc6 from "picocolors";
-async function runInfo(slug, flags) {
+import pc7 from "picocolors";
+async function runInfo(slug, flags, deps = {}) {
   const [owner, name] = slug.split("/");
   if (!owner || !name || slug.split("/").length !== 2) {
-    return { ok: false, exitCode: 1, output: pc6.red("Expected owner/name, e.g. anthropic/pdf") };
+    return { ok: false, exitCode: 1, output: pc7.red("Expected owner/name, e.g. anthropic/pdf") };
   }
-  const { api } = createClient(flags);
+  const api = deps.api ?? createClient(flags).api;
   let s;
   try {
     s = await api(`/api/skills/${owner}/${name}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     if (/^SkillMD API 404 /.test(message)) {
-      return { ok: false, exitCode: 1, output: pc6.red(`Skill not found on the registry: ${slug}`) };
+      return { ok: false, exitCode: 1, output: pc7.red(`Skill not found on the registry: ${slug}`) };
     }
-    return { ok: false, exitCode: 1, output: pc6.red(`Could not reach the SkillMD registry: ${message}`) };
+    return { ok: false, exitCode: 1, output: pc7.red(`Could not reach the SkillMD registry: ${message}`) };
   }
   if (flags.json) return { ok: true, exitCode: 0, output: JSON.stringify(s, null, 2), skill: s };
+  const slugTxt = safeText(s.slug, 200);
   const lines = [];
   lines.push(
-    `${pc6.bold(s.slug)} ${pc6.dim(`[${s.type ?? "single"}]`)} ${s.verified ? pc6.green("\u2713 verified") : pc6.yellow("unverified")}`
+    `${pc7.bold(slugTxt)} ${pc7.dim(`[${safeText(s.type ?? "single", 40)}]`)} ${s.verified ? pc7.green("\u2713 verified") : pc7.yellow("unverified")}`
   );
-  lines.push(`  ${s.description}`);
+  lines.push(`  ${safeText(s.description)}`);
   lines.push(
-    pc6.dim(
-      `  category: ${s.category ?? "-"} \xB7 rating: ${s.avg_rating != null ? s.avg_rating.toFixed(1) : "-"} (${s.rating_count ?? 0}) \xB7 installs: ${s.install_count ?? 0}`
+    pc7.dim(
+      `  category: ${safeText(s.category ?? "-", 100) || "-"} \xB7 rating: ${s.avg_rating != null ? s.avg_rating.toFixed(1) : "-"} (${s.rating_count ?? 0}) \xB7 installs: ${s.install_count ?? 0}`
     )
   );
+  const securityFlags2 = (s.security_flags ?? []).map((f) => safeText(f, 60)).filter(Boolean);
   lines.push(
-    pc6.dim(`  security: ${(s.security_flags ?? []).join(", ") || "unscanned"} \xB7 license: ${s.provenance?.license ?? s.license ?? "unknown"}`)
+    pc7.dim(`  security: ${securityFlags2.join(", ") || "unscanned"} \xB7 license: ${safeText(s.provenance?.license ?? s.license ?? "unknown", 100) || "unknown"}`)
   );
-  const sourceRepo = s.provenance?.source_repo ?? s.source_repo;
-  const commitSha = s.provenance?.commit_sha ?? s.commit_sha;
-  if (sourceRepo) lines.push(pc6.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
-  lines.push(pc6.dim(`  page: https://skillmd.com/skills/${s.slug}`));
-  lines.push(pc6.dim(`  install: ${s.install?.cli ?? `npx skillmds add ${s.slug}`}`));
+  const sourceRepo = safeText(s.provenance?.source_repo ?? s.source_repo, 300);
+  const commitSha = safeText(s.provenance?.commit_sha ?? s.commit_sha, 100);
+  if (sourceRepo) lines.push(pc7.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
+  lines.push(pc7.dim(`  page: https://skillmd.com/skills/${slugTxt}`));
+  lines.push(pc7.dim(`  install: ${safeText(s.install?.cli, 300) || `npx get-skill add ${slugTxt}`}`));
   return { ok: true, exitCode: 0, output: lines.join("\n"), skill: s };
 }
 function infoCommand() {
   return new Command6("info").description("Show registry details for a skill: verification, security flags, provenance, rating").argument("<slug>", "owner/name, e.g. anthropic/pdf").action(async (slug, _opts, cmd) => {
     const flags = { ...cmd.parent?.opts() };
-    const run = await runInfo(slug, flags);
-    if (run.output) (run.ok ? console.log : console.error)(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runInfo(slug, flags);
+    if (run2.output) (run2.ok ? console.log : console.error)(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
-// ../cli/src/commands/add.ts
+// src/commands/add.ts
 import { Command as Command7, Option } from "commander";
-import { existsSync as existsSync4 } from "fs";
 import { homedir as homedir4 } from "os";
 import * as p3 from "@clack/prompts";
-import { join as join5, relative as relative2, resolve as resolve3 } from "path";
-import pc7 from "picocolors";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+import pc8 from "picocolors";
+import { lint as lint2, parseSkillMd as parseSkillMd2 } from "@skillmds/core";
 
-// ../cli/src/agents.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync as rmSync2, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
+// src/claudePlugin.ts
+import { execFile } from "child_process";
+import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join4, resolve as resolve2, dirname as dirname2, sep as sep2 } from "path";
-var AGENTS = [
-  { id: "claude-code", project: [".claude", "skills"], global: [".claude", "skills"], detect: [[".claude"]] },
-  { id: "cursor", project: [".cursor", "skills"], global: [".cursor", "skills"], detect: [[".cursor"]] },
-  { id: "codex", project: [".codex", "skills"], global: [".codex", "skills"], detect: [[".codex"]] },
-  { id: "windsurf", project: [".windsurf", "skills"], global: [".codeium", "windsurf", "skills"], detect: [[".codeium", "windsurf"], [".windsurf"]] },
-  { id: "opencode", project: [".opencode", "skills"], global: [".config", "opencode", "skills"], detect: [[".config", "opencode"], [".opencode"]] },
-  { id: "gemini-cli", project: [".agents", "skills"], global: [".gemini", "skills"], detect: [[".gemini"]] },
-  { id: "antigravity", project: [".agents", "skills"], global: [".gemini", "antigravity", "skills"], detect: [[".gemini", "antigravity"], [".antigravity"]] },
-  { id: "kiro", project: [".kiro", "skills"], global: [".kiro", "skills"], detect: [[".kiro"]] },
-  { id: "warp", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".warp"]] },
-  { id: "github-copilot", project: [".agents", "skills"], global: [".copilot", "skills"], detect: [[".copilot"]] },
-  { id: "cline", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".cline"]] },
-  { id: "roo", project: [".roo", "skills"], global: [".roo", "skills"], detect: [[".roo"]] },
-  { id: "goose", project: [".goose", "skills"], global: [".config", "goose", "skills"], detect: [[".config", "goose"]] },
-  { id: "trae", project: [".trae", "skills"], global: [".trae", "skills"], detect: [[".trae"]] },
-  { id: "qwen-code", project: [".qwen", "skills"], global: [".qwen", "skills"], detect: [[".qwen"]] },
-  { id: "amp", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".config", "amp"]] },
-  // — extended registry —
-  { id: "openclaw", project: ["skills"], global: [".openclaw", "skills"], detect: [[".openclaw"], [".clawdbot"], [".moltbot"]] },
-  { id: "kilo", project: [".kilocode", "skills"], global: [".kilocode", "skills"], detect: [[".kilocode"]] },
-  { id: "hermes-agent", project: [".hermes", "skills"], global: [".hermes", "skills"], detect: [[".hermes"]] },
-  { id: "continue", project: [".continue", "skills"], global: [".continue", "skills"], detect: [[".continue"]] },
-  { id: "devin", project: [".devin", "skills"], global: [".config", "devin", "skills"], detect: [[".config", "devin"]] },
-  { id: "openhands", project: [".openhands", "skills"], global: [".openhands", "skills"], detect: [[".openhands"]] },
-  { id: "replit", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".replit"]] },
-  { id: "mistral-vibe", project: [".vibe", "skills"], global: [".vibe", "skills"], detect: [[".vibe"]] },
-  { id: "zed", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".config", "zed"]] },
-  { id: "adal", project: [".adal", "skills"], global: [".adal", "skills"], detect: [[".adal"]] },
-  { id: "aider-desk", project: [".aider-desk", "skills"], global: [".aider-desk", "skills"], detect: [[".aider-desk"]] },
-  { id: "antigravity-cli", project: [".agents", "skills"], global: [".gemini", "antigravity-cli", "skills"], detect: [[".gemini", "antigravity-cli"]] },
-  { id: "augment", project: [".augment", "skills"], global: [".augment", "skills"], detect: [[".augment"]] },
-  { id: "autohand-code", project: [".autohand", "skills"], global: [".autohand", "skills"], detect: [[".autohand"]] },
-  { id: "bob", project: [".bob", "skills"], global: [".bob", "skills"], detect: [[".bob"]] },
-  { id: "codearts-agent", project: [".codeartsdoer", "skills"], global: [".codeartsdoer", "skills"], detect: [[".codeartsdoer"]] },
-  { id: "codebuddy", project: [".codebuddy", "skills"], global: [".codebuddy", "skills"], detect: [[".codebuddy"]] },
-  { id: "codemaker", project: [".codemaker", "skills"], global: [".codemaker", "skills"], detect: [[".codemaker"]] },
-  { id: "codestudio", project: [".codestudio", "skills"], global: [".codestudio", "skills"], detect: [[".codestudio"]] },
-  { id: "command-code", project: [".commandcode", "skills"], global: [".commandcode", "skills"], detect: [[".commandcode"]] },
-  { id: "cortex", project: [".cortex", "skills"], global: [".snowflake", "cortex", "skills"], detect: [[".snowflake", "cortex"]] },
-  { id: "crush", project: [".crush", "skills"], global: [".config", "crush", "skills"], detect: [[".config", "crush"]] },
-  { id: "deepagents", project: [".agents", "skills"], global: [".deepagents", "agent", "skills"], detect: [[".deepagents"]] },
-  { id: "dexto", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".dexto"]] },
-  { id: "droid", project: [".factory", "skills"], global: [".factory", "skills"], detect: [[".factory"]] },
-  { id: "firebender", project: [".agents", "skills"], global: [".firebender", "skills"], detect: [[".firebender"]] },
-  { id: "forgecode", project: [".forge", "skills"], global: [".forge", "skills"], detect: [[".forge"]] },
-  { id: "iflow-cli", project: [".iflow", "skills"], global: [".iflow", "skills"], detect: [[".iflow"]] },
-  { id: "inference-sh", project: [".inferencesh", "skills"], global: [".inferencesh", "skills"], detect: [[".inferencesh"]] },
-  { id: "jazz", project: [".jazz", "skills"], global: [".jazz", "skills"], detect: [[".jazz"]] },
-  { id: "junie", project: [".junie", "skills"], global: [".junie", "skills"], detect: [[".junie"]] },
-  { id: "kimi-code-cli", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".kimi-code"], [".kimi"]] },
-  { id: "kode", project: [".kode", "skills"], global: [".kode", "skills"], detect: [[".kode"]] },
-  { id: "lingma", project: [".lingma", "skills"], global: [".lingma", "skills"], detect: [[".lingma"]] },
-  { id: "loaf", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".loaf"]] },
-  { id: "mcpjam", project: [".mcpjam", "skills"], global: [".mcpjam", "skills"], detect: [[".mcpjam"]] },
-  { id: "moxby", project: [".moxby", "skills"], global: [".moxby", "skills"], detect: [[".moxby"]] },
-  { id: "mux", project: [".mux", "skills"], global: [".mux", "skills"], detect: [[".mux"]] },
-  { id: "neovate", project: [".neovate", "skills"], global: [".neovate", "skills"], detect: [[".neovate"]] },
-  { id: "ona", project: [".ona", "skills"], global: [".ona", "skills"], detect: [[".ona"]] },
-  { id: "pi", project: [".pi", "skills"], global: [".pi", "agent", "skills"], detect: [[".pi", "agent"]] },
-  { id: "pochi", project: [".pochi", "skills"], global: [".pochi", "skills"], detect: [[".pochi"]] },
-  { id: "qoder", project: [".qoder", "skills"], global: [".qoder", "skills"], detect: [[".qoder"]] },
-  { id: "qoder-cn", project: [".qoder", "skills"], global: [".qoder-cn", "skills"], detect: [[".qoder-cn"]] },
-  { id: "reasonix", project: [".reasonix", "skills"], global: [".reasonix", "skills"], detect: [[".reasonix"]] },
-  { id: "rovodev", project: [".rovodev", "skills"], global: [".rovodev", "skills"], detect: [[".rovodev"]] },
-  { id: "tabnine-cli", project: [".tabnine", "agent", "skills"], global: [".tabnine", "agent", "skills"], detect: [[".tabnine"]] },
-  { id: "terramind", project: [".terramind", "skills"], global: [".terramind", "skills"], detect: [[".terramind"]] },
-  { id: "tinycloud", project: [".tinycloud", "skills"], global: [".tinycloud", "skills"], detect: [[".tinycloud"]] },
-  { id: "trae-cn", project: [".trae", "skills"], global: [".trae-cn", "skills"], detect: [[".trae-cn"]] },
-  { id: "zcode", project: [".zcode", "skills"], global: [".zcode", "skills"], detect: [[".zcode"]] },
-  { id: "zencoder", project: [".zencoder", "skills"], global: [".zencoder", "skills"], detect: [[".zencoder"]] }
-];
-function agentDir(agentId, opts = {}) {
-  const agent = AGENTS.find((a) => a.id === agentId);
-  if (!agent) throw new Error(`Unknown agent: ${agentId}. Known: ${AGENTS.map((a) => a.id).join(", ")}`);
-  return opts.global ? join4(opts.home ?? homedir3(), ...agent.global) : join4(opts.cwd ?? process.cwd(), ...agent.project);
-}
-function detectAgents(opts = {}) {
-  const home = opts.home ?? homedir3();
-  return AGENTS.filter((a) => a.detect.some((d) => existsSync3(join4(home, ...d)))).map((a) => a.id);
-}
-function writeSkill(skillName, files, targetDir, opts = {}) {
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(skillName) || skillName.includes("..")) {
-    throw new Error(`refused unsafe skill name: "${skillName}"`);
-  }
-  const dest = join4(targetDir, skillName);
-  if (opts.mode === "symlink" && opts.canonicalDir) {
-    mkdirSync3(dirname2(dest), { recursive: true });
-    rmSync2(dest, { recursive: true, force: true });
-    symlinkSync(resolve2(opts.canonicalDir), dest, "dir");
-    return dest;
-  }
-  mkdirSync3(dest, { recursive: true });
-  const root = resolve2(dest);
-  for (const f of files) {
-    const fp = resolve2(dest, f.path);
-    if (fp !== root && !fp.startsWith(root + sep2)) {
-      throw new Error(`refused unsafe path in skill "${skillName}": ${f.path}`);
+import { delimiter, join as join2 } from "path";
+import { promisify } from "util";
+import { mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname } from "path";
+var run = promisify(execFile);
+function resolveClaudeBin(env = process.env) {
+  const override = env.SKILLMD_CLAUDE_BIN;
+  if (override) return existsSync2(override) ? override : null;
+  const win = process.platform === "win32";
+  const exts = win ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const dirs = (env.PATH ?? "").split(delimiter).filter(Boolean);
+  const home = env.USERPROFILE || env.HOME || homedir3();
+  dirs.push(join2(home, ".local", "bin"), join2(home, ".claude", "local"));
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = join2(dir, `claude${ext.toLowerCase()}`);
+      if (existsSync2(candidate)) return candidate;
     }
-    mkdirSync3(dirname2(fp), { recursive: true });
-    writeFileSync4(fp, f.contents);
   }
-  return dest;
+  return null;
 }
-function installedSkills(opts = {}) {
-  const scope = opts.global ? "global" : "project";
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const agent of AGENTS) {
-    const dir = agentDir(agent.id, opts);
-    if (seen.has(dir)) continue;
-    seen.add(dir);
-    if (!existsSync3(dir)) continue;
-    for (const entry of readdirSync2(dir)) {
-      const skillMd = join4(dir, entry, "SKILL.md");
-      if (!existsSync3(skillMd) || !statSync2(skillMd).isFile()) continue;
-      out.push({ name: entry, agent: agent.id, scope, path: join4(dir, entry), raw: readFileSync3(skillMd, "utf8") });
+var needsShell = (bin) => /\.(cmd|bat)$/i.test(bin);
+var MARKETPLACE_URL = "https://skillmd.com/.claude-plugin/marketplace.json";
+var MARKETPLACE_NAME = "skillmd";
+var MARKETPLACE_SCHEMA = "https://anthropic.com/claude-code/marketplace.schema.json";
+var TIMEOUT_MS = 12e4;
+function exec(deps) {
+  return deps.exec ?? ((file, args) => {
+    const bin = file === "claude" ? resolveClaudeBin() : file;
+    if (!bin) return Promise.reject(new Error("claude not found on PATH"));
+    return run(bin, args, { timeout: TIMEOUT_MS, windowsHide: true, shell: needsShell(bin) }).then((r) => ({
+      stdout: String(r.stdout ?? ""),
+      stderr: String(r.stderr ?? "")
+    }));
+  });
+}
+function marketplacePluginName(owner, slug) {
+  const clean = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const base = clean(slug) || "plugin";
+  return owner.toLowerCase() === "skillmd" ? base : `${clean(owner)}-${base}`;
+}
+async function claudeCliAvailable(deps = {}) {
+  try {
+    await exec(deps)("claude", ["--version"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function installClaudePlugin(owner, slug, deps = {}) {
+  const sh = exec(deps);
+  const qualified = `${marketplacePluginName(owner, slug)}@${MARKETPLACE_NAME}`;
+  try {
+    await sh("claude", ["plugin", "marketplace", "add", MARKETPLACE_URL]);
+  } catch (e) {
+    return { ok: false, reason: `could not add the SkillMD marketplace: ${msg(e)}` };
+  }
+  try {
+    await sh("claude", ["plugin", "marketplace", "update", MARKETPLACE_NAME]);
+  } catch {
+  }
+  let out;
+  try {
+    const r = await sh("claude", ["plugin", "install", qualified]);
+    out = `${r.stdout}
+${r.stderr}`;
+  } catch (e) {
+    return { ok: false, reason: msg(e) };
+  }
+  if (/Successfully installed plugin/i.test(out)) return { ok: true, name: qualified, marketplace: MARKETPLACE_NAME };
+  const failed = /Failed to install plugin[^:]*:\s*(.+)/i.exec(out);
+  return { ok: false, reason: (failed?.[1] ?? out).trim().split(/\r?\n/)[0] ?? "install did not report success" };
+}
+function msg(e) {
+  if (e && typeof e === "object" && "stderr" in e) {
+    const s = String(e.stderr ?? "").trim();
+    if (s) return s.split(/\r?\n/)[0];
+  }
+  return e instanceof Error ? e.message.split(/\r?\n/)[0] : String(e);
+}
+var SITE_URL = "https://skillmd.com";
+function readJson(path) {
+  let text3;
+  try {
+    text3 = readFileSync(path, "utf8");
+  } catch {
+    return "absent";
+  }
+  try {
+    const v = JSON.parse(text3);
+    return v && typeof v === "object" && !Array.isArray(v) ? v : "unparsable";
+  } catch {
+    return "unparsable";
+  }
+}
+function writeJson(path, value) {
+  mkdirSync2(dirname(path), { recursive: true });
+  writeFileSync3(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+var obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? { ...v } : {};
+async function installPluginNatively(owner, slug, deps = {}) {
+  const home = deps.home ?? (process.env.USERPROFILE || process.env.HOME || homedir3());
+  const claudeDir = join2(home, ".claude");
+  if (!existsSync2(claudeDir)) return { ok: false, reason: "no Claude Code directory on this machine" };
+  const name = marketplacePluginName(owner, slug);
+  const qualified = `${name}@${MARKETPLACE_NAME}`;
+  const doFetch = deps.fetch ?? fetch;
+  let entries;
+  try {
+    const res = await doFetch(`${SITE_URL}/plugins/${owner}/${slug}/plugin.zip`, { headers: { accept: "application/zip" } });
+    if (!res.ok) return { ok: false, reason: `the plugin archive answered ${res.status}` };
+    const { unzipSync } = await import("fflate");
+    entries = unzipSync(new Uint8Array(await res.arrayBuffer()));
+  } catch (e) {
+    return { ok: false, reason: msg(e) };
+  }
+  let version2 = "1.0.0";
+  const manifest = entries[".claude-plugin/plugin.json"];
+  if (manifest) {
+    try {
+      const v = JSON.parse(new TextDecoder().decode(manifest));
+      if (typeof v.version === "string" && v.version) version2 = v.version;
+    } catch {
     }
   }
-  return out;
+  if (!manifest) return { ok: false, reason: "the plugin archive has no .claude-plugin/plugin.json" };
+  const pluginsDir = join2(claudeDir, "plugins");
+  const installPath = join2(pluginsDir, "cache", MARKETPLACE_NAME, name, version2);
+  const knownPath = join2(pluginsDir, "known_marketplaces.json");
+  const installedPath = join2(pluginsDir, "installed_plugins.json");
+  const settingsPath = join2(claudeDir, "settings.json");
+  const known = readJson(knownPath);
+  if (known === "unparsable") return { ok: false, reason: "known_marketplaces.json is not readable JSON \u2014 left untouched" };
+  const installed = readJson(installedPath);
+  if (installed === "unparsable") return { ok: false, reason: "installed_plugins.json is not readable JSON \u2014 left untouched" };
+  const settings = readJson(settingsPath);
+  if (settings === "unparsable") return { ok: false, reason: "settings.json is not readable JSON \u2014 left untouched" };
+  try {
+    for (const [path, data] of Object.entries(entries)) {
+      if (path.endsWith("/")) continue;
+      const dest = join2(installPath, ...path.split("/"));
+      mkdirSync2(dirname(dest), { recursive: true });
+      writeFileSync3(dest, data);
+    }
+    writeFileSync3(join2(installPath, ".in_use"), "");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const source = { source: "url", url: MARKETPLACE_URL };
+    const marketplaceDir = join2(pluginsDir, "marketplaces", MARKETPLACE_NAME);
+    const cachedPath = join2(marketplaceDir, ".claude-plugin", "marketplace.json");
+    const cached = readJson(cachedPath);
+    if (cached === "unparsable") return { ok: false, reason: "the cached marketplace manifest is not readable JSON \u2014 left untouched" };
+    const cachedDoc = cached === "absent" ? {
+      $schema: MARKETPLACE_SCHEMA,
+      name: MARKETPLACE_NAME,
+      owner: { name: "SkillMD", email: "hi@skillmd.com" },
+      description: "Agent Skill plugins from the SkillMD registry.",
+      plugins: []
+    } : cached;
+    const list = Array.isArray(cachedDoc.plugins) ? cachedDoc.plugins : [];
+    cachedDoc.plugins = [
+      ...list.filter((e) => e?.name !== name),
+      {
+        name,
+        version: version2,
+        homepage: `${SITE_URL}/plugins/${owner}/${slug}`,
+        author: { name: owner === "skillmd" ? "SkillMD" : `@${owner}` },
+        source: { source: "archive", url: `${SITE_URL}/plugins/${owner}/${slug}/plugin.zip` }
+      }
+    ];
+    writeJson(cachedPath, cachedDoc);
+    const knownDoc = known === "absent" ? {} : known;
+    if (!knownDoc[MARKETPLACE_NAME]) {
+      knownDoc[MARKETPLACE_NAME] = { source, installLocation: marketplaceDir, lastUpdated: now };
+      writeJson(knownPath, knownDoc);
+    }
+    const installedDoc = installed === "absent" ? { version: 2, plugins: {} } : installed;
+    const plugins = obj(installedDoc.plugins);
+    const prior = Array.isArray(plugins[qualified]) ? plugins[qualified] : [];
+    plugins[qualified] = [
+      ...prior.filter((p7) => p7?.scope !== "user"),
+      { scope: "user", installPath, version: version2, installedAt: now, lastUpdated: now }
+    ];
+    installedDoc.plugins = plugins;
+    if (typeof installedDoc.version !== "number") installedDoc.version = 2;
+    writeJson(installedPath, installedDoc);
+    const settingsDoc = settings === "absent" ? {} : settings;
+    const declared = obj(settingsDoc.extraKnownMarketplaces);
+    if (!declared[MARKETPLACE_NAME]) declared[MARKETPLACE_NAME] = { source };
+    settingsDoc.extraKnownMarketplaces = declared;
+    settingsDoc.enabledPlugins = { ...obj(settingsDoc.enabledPlugins), [qualified]: true };
+    writeJson(settingsPath, settingsDoc);
+  } catch (e) {
+    return { ok: false, reason: msg(e) };
+  }
+  return { ok: true, name: qualified, marketplace: MARKETPLACE_NAME };
 }
 
-// ../cli/src/commands/add.ts
-var PROJECT_MARKERS = [".git", "package.json", "pyproject.toml", "Cargo.toml", "go.mod", "AGENTS.md", "CLAUDE.md", "skills-lock.json"];
-function looksLikeProject(dir) {
-  if (PROJECT_MARKERS.some((m) => existsSync4(join5(dir, m)))) return true;
-  const agentRoots = new Set(AGENTS.map((a) => a.project[0]).filter((seg) => seg.startsWith(".")));
-  return [...agentRoots].some((seg) => existsSync4(join5(dir, seg)));
-}
-var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+// src/commands/add.ts
+var infoNotice = (text3) => ({ text: text3, style: "info" });
+var warnNotice = (text3) => ({ text: text3, style: "warn" });
+var skipNotice = (text3) => ({ text: text3, style: "skip" });
+var replacedNotice = (text3) => ({ text: text3, style: "warn", suppressInSummary: true });
+function noticeLine(n) {
+  switch (n.style) {
+    case "info":
+      return pc8.dim(`${GLYPH.info} ${n.text}`);
+    case "skip":
+      return pc8.dim(`${GLYPH.skip} ${n.text}`);
+    case "warn":
+      return pc8.yellow(`${GLYPH.warn} ${n.text}`);
+  }
+}
 async function promptScopeInteractive(ctx) {
   const choice = await p3.select({
     message: "Installation scope",
@@ -1131,32 +856,28 @@ async function promptScopeInteractive(ctx) {
   });
   return p3.isCancel(choice) ? null : choice;
 }
+function agentsPromptMessage(managed) {
+  return managed ? `Claude Code already has ${managed} as a plugin. Which other agents should get its skills too?` : "Which agents do you want to install to?";
+}
 async function promptAgentsInteractive(ctx) {
   if (ctx.detected.length < 2) return ctx.detected;
+  const remembered = (readConfig().lastAgents ?? []).filter((id) => ctx.detected.includes(id));
   const picked = await p3.multiselect({
-    message: "Which agents do you want to install to?",
+    message: agentsPromptMessage(ctx.managed),
     options: ctx.detected.map((id) => ({ value: id, label: id, hint: ctx.dirFor(id) })),
-    initialValues: ctx.detected,
+    initialValues: remembered.length ? remembered : ctx.detected,
     required: true
   });
   return p3.isCancel(picked) ? null : picked;
 }
-function isLocalish(arg) {
-  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync4(arg);
+function unverifiedFilesNote(n) {
+  const [f, it] = n === 1 ? ["file", "it"] : ["files", "them"];
+  return `${n} companion ${f} came straight from the source repo \u2014 the registry holds no checksum for ${it}, so only the connection was verified`;
 }
-async function resolvePackFiles(skill, fetchTree = resolveTree) {
-  if (!skill.source_repo) return null;
-  const attempts = [{ ref: skill.commit_sha ?? void 0, pinMiss: false }];
-  if (skill.commit_sha) attempts.push({ ref: void 0, pinMiss: true });
-  for (const attempt of attempts) {
-    try {
-      const files = await fetchTree(skill.source_repo, attempt.ref);
-      const sk = files.find((f) => f.path === "SKILL.md");
-      if (sk) return { raw: sk.contents.toString("utf8"), files, pinMiss: attempt.pinMiss };
-    } catch {
-    }
-  }
-  return null;
+function bundleNote(bundle, missing) {
+  const unverified = bundle.filter((file) => file.unverified).length;
+  const notes = [unverified ? unverifiedFilesNote(unverified) : "", missing.length ? missingFilesNote(missing) : ""].filter(Boolean);
+  return notes.length ? notes.join("; ") : void 0;
 }
 function registryFallbackNote(host) {
   return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
@@ -1169,84 +890,218 @@ If this environment restricts network access (sandbox, proxy, CI), ask an admini
 Registry error: ${e.message}`
   );
 }
-var defaultDeps = {
-  async resolve(arg, flags) {
-    if (isLocalish(arg)) {
-      const rs = await resolveSource(arg);
-      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
+function argWithRef(arg, ref) {
+  if (!ref) return arg;
+  try {
+    const spec = parseSource(arg, { ref });
+    return spec.kind === "github" ? sourceId(spec) : arg;
+  } catch {
+    return arg;
+  }
+}
+function provenanceFor(arg) {
+  try {
+    return sourceId(parseSource(arg));
+  } catch {
+    return `unknown:${arg}`;
+  }
+}
+async function registryCandidate(owner, name, source, client) {
+  const registrySlug = `${owner}/${name}`;
+  const skill = await client.api(`/api/skills/${owner}/${name}`);
+  const skillName = skill.slug.split("/")[1] || name;
+  const meta = {
+    name: skillName,
+    slug: skillName,
+    registrySlug,
+    source,
+    commit_sha: skill.commit_sha ?? void 0,
+    verified: skill.verified,
+    type: skill.type,
+    securityFlags: skill.security_flags
+  };
+  if (skill.type === "pack") {
+    const missing = [];
+    const bundle = await fetchBundle(client.base, registrySlug, client.token, { missing });
+    if (bundle && bundle.length) {
+      const sk = bundle.find((file) => file.path === "SKILL.md");
+      const note2 = bundleNote(bundle, missing);
+      return {
+        ...meta,
+        raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill),
+        files: bundle,
+        ...note2 ? { note: note2 } : {}
+      };
     }
-    let registryDown = null;
-    const registryHost = (() => {
-      try {
-        return new URL(createClient(flags).base).host;
-      } catch {
-        return "api.skillmd.com";
-      }
-    })();
-    if (/^[^/\s:]+\/[^/\s:]+$/.test(arg)) {
-      const { api, base: apiBase, token } = createClient(flags);
-      const [owner, name] = arg.split("/");
-      try {
-        const skill = await api(`/api/skills/${owner}/${name}`);
-        const skillName = skill.slug.split("/")[1] || name;
-        const meta = {
-          name: skillName,
-          slug: skillName,
-          registrySlug: arg,
-          verified: skill.verified,
-          type: skill.type,
-          securityFlags: skill.security_flags
-        };
-        if (skill.type === "pack") {
-          const bundle = await fetchBundle(apiBase, arg, token);
-          if (bundle && bundle.length) {
-            const sk = bundle.find((f) => f.path === "SKILL.md");
-            return [{ ...meta, raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill), files: bundle }];
+    const pack = await resolvePackFiles(skill);
+    if (pack) return { ...meta, ...pack };
+  }
+  return { ...meta, raw: skillMdFor(skill) };
+}
+async function fetchPackMembers(api, owner, slug) {
+  const PAGE = 200;
+  const members = [];
+  let name = slug;
+  let total = Infinity;
+  for (let offset = 0; members.length < total; offset += PAGE) {
+    const page = await api(`/api/packs/${owner}/${slug}?limit=${PAGE}&offset=${offset}`);
+    name = page.name || name;
+    total = Number(page.item_total ?? 0);
+    const got = (page.items ?? []).map((i) => ({ slug: String(i.slug ?? ""), type: i.type, verified: Boolean(i.verified) })).filter((i) => i.slug);
+    if (!got.length) break;
+    members.push(...got);
+  }
+  return { name, members };
+}
+function packDirNames(slugs) {
+  const used = /* @__PURE__ */ new Set();
+  return slugs.map((slug) => {
+    const [owner, name] = slug.split("/");
+    let dir = name ?? slug;
+    if (used.has(dir)) dir = `${owner}-${name}`;
+    used.add(dir);
+    return dir;
+  });
+}
+async function fetchPackArchive(base, owner, slug, token, doFetch = fetch) {
+  const headers = { accept: "application/zip" };
+  if (token) headers.authorization = `Bearer ${token}`;
+  const res = await doFetch(`${base}/api/packs/${owner}/${slug}/download`, { headers });
+  if (!res.ok) throw new RegistryError(`SkillMD API ${res.status} on /api/packs/${owner}/${slug}/download`, res.status);
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  const { unzipSync, strFromU8 } = await import("fflate");
+  const entries = unzipSync(bytes);
+  const out = /* @__PURE__ */ new Map();
+  for (const [path, data] of Object.entries(entries)) {
+    const m = /^(.+)\/SKILL\.md$/.exec(path);
+    if (m) out.set(m[1], strFromU8(data));
+  }
+  return out;
+}
+function makeDefaultDeps(flags) {
+  const canPrompt = () => isInteractive(flags, {
+    stdinTTY: Boolean(process.stdin.isTTY),
+    stdoutTTY: Boolean(process.stdout.isTTY),
+    env: flags.env ?? process.env
+  });
+  return {
+    async resolve(arg, f) {
+      const spec = parseSource(arg, { ref: f.ref });
+      const source = sourceId(spec);
+      if (spec.kind === "plugin") {
+        const { api: api2, base: apiBase2, token: token2, fetch: doFetch } = createClient(f);
+        const { name: packName, members } = await fetchPackMembers(api2, spec.owner, spec.slug);
+        if (!members.length) throw new Error(`plugin ${spec.owner}/${spec.slug} has no installable skills`);
+        const archive = await fetchPackArchive(apiBase2, spec.owner, spec.slug, token2, doFetch);
+        const dirs = packDirNames(members.map((m) => m.slug));
+        const out = [];
+        const missing = [];
+        members.forEach((m, i) => {
+          const raw = archive.get(dirs[i]);
+          if (!raw) {
+            missing.push(m.slug);
+            return;
           }
-          const pack = await resolvePackFiles(skill);
-          if (pack) return [{ ...meta, ...pack }];
+          const name = dirs[i];
+          out.push({
+            name,
+            slug: name,
+            registrySlug: m.slug,
+            source,
+            raw,
+            verified: m.verified,
+            type: m.type
+          });
+        });
+        const multi = out.filter((c) => c.type === "pack");
+        if (multi.length) {
+          let n = 0;
+          await Promise.all(Array.from({ length: Math.min(4, multi.length) }, async () => {
+            for (let i = n++; i < multi.length; i = n++) {
+              const c = multi[i];
+              try {
+                const missing2 = [];
+                const bundle = await fetchBundle(apiBase2, c.registrySlug, token2, { missing: missing2 });
+                if (!bundle?.length) continue;
+                const sk = bundle.find((file) => file.path === "SKILL.md");
+                const note2 = bundleNote(bundle, missing2);
+                c.files = bundle;
+                if (sk) c.raw = sk.contents.toString("utf8");
+                if (note2) c.note = note2;
+              } catch {
+              }
+            }
+          }));
+        }
+        if (!out.length) throw new Error(`plugin ${spec.owner}/${spec.slug} returned no readable skills`);
+        const first = out[0];
+        first.note = `${out.length} skill${out.length === 1 ? "" : "s"} from the ${packName} plugin` + (missing.length ? ` (${missing.length} member${missing.length === 1 ? "" : "s"} were not in the archive)` : "");
+        return out;
+      }
+      if (spec.kind !== "slug") {
+        const rs = await resolveSource(argWithRef(arg, f.ref));
+        return rs.map((r) => ({
+          name: r.slug,
+          raw: r.raw,
+          slug: r.slug,
+          source,
+          ...spec.kind === "local" && r.file ? { files: collectFiles(dirname2(r.file), dirname2(r.file)) } : {}
+        }));
+      }
+      let registryDown = null;
+      const { api, base: apiBase, token } = createClient(f);
+      const registryHost = (() => {
+        try {
+          return new URL(apiBase).host;
+        } catch {
+          return "api.skillmd.com";
         }
-        return [{ ...meta, raw: skillMdFor(skill) }];
+      })();
+      const registrySlug = `${spec.owner}/${spec.name}`;
+      try {
+        return [await registryCandidate(spec.owner, spec.name, source, { api, base: apiBase, token })];
       } catch (e) {
         if (e instanceof IntegrityError) throw e;
         if (e instanceof RegistryError && e.status !== 404) registryDown = e;
       }
+      const ghSource = sourceId({ kind: "github", owner: spec.owner, repo: spec.name, display: arg });
+      try {
+        const rs = await resolveSource(arg);
+        const note2 = registryDown ? registryFallbackNote(registryHost) : void 0;
+        return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug, source: ghSource, note: note2 }));
+      } catch (e) {
+        if (registryDown) throw registryUnreachableError(arg, registryHost, registryDown);
+        throw e;
+      }
+    },
+    get promptScope() {
+      return canPrompt() ? promptScopeInteractive : void 0;
+    },
+    get promptAgents() {
+      return canPrompt() ? promptAgentsInteractive : void 0;
+    },
+    fireInstall(registrySlug, f) {
+      const { api } = createClient(f);
+      const [owner, name] = registrySlug.split("/");
+      void api(`/api/skills/${owner}/${name}/install`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ via: "cli" })
+      }).catch(() => {
+      });
     }
-    try {
-      const rs = await resolveSource(arg);
-      const note2 = registryDown ? registryFallbackNote(registryHost) : void 0;
-      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug, note: note2 }));
-    } catch (e) {
-      if (registryDown) throw registryUnreachableError(arg, registryHost, registryDown);
-      throw e;
-    }
-  },
-  get promptScope() {
-    return interactive() ? promptScopeInteractive : void 0;
-  },
-  get promptAgents() {
-    return interactive() ? promptAgentsInteractive : void 0;
-  },
-  fireInstall(registrySlug, flags) {
-    const { api } = createClient(flags);
-    const [owner, name] = registrySlug.split("/");
-    void api(`/api/skills/${owner}/${name}/install`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ via: "cli" })
-    }).catch(() => {
-    });
-  }
-};
+  };
+}
 async function resolveScope(flags, deps) {
   const home = resolve3(flags.home ?? homedir4());
   const cwd = resolve3(flags.cwd ?? process.cwd());
-  const base = { cwd: flags.cwd, home: flags.home };
+  const base = { cwd: flags.cwd, home: flags.home, env: flags.env };
   if (flags.global) return { scope: { global: true, ...base } };
   if (flags.project) return { scope: { global: false, ...base } };
   if (cwd === home) return { scope: { global: true, ...base } };
   const isProject = looksLikeProject(cwd);
-  if (deps.promptScope && !flags.yes && !flags.json) {
+  const hosted = detectHostAgent(flags.env ?? process.env) !== null;
+  if (deps.promptScope && !flags.yes && !flags.json && !hosted) {
     const global = await deps.promptScope({ cwd, suggestGlobal: !isProject });
     if (global === null) return null;
     return { scope: { global, ...base } };
@@ -1257,202 +1112,682 @@ async function resolveScope(flags, deps) {
     note: `no project detected in ${cwd} \u2014 installing to your user-level agent folders (pass --project to install here)`
   };
 }
-var CANCELLED = { written: [], blocked: [], exitCode: 0, cancelled: true, output: pc7.dim("Installation cancelled \u2014 nothing was installed.") };
-async function runAdd(arg, flags, deps = defaultDeps) {
-  let candidates;
-  try {
-    candidates = await deps.resolve(arg, flags);
-  } catch (e) {
-    if (e instanceof IntegrityError) {
+function defaultNeedsPrompt(flags) {
+  const env = flags.env ?? process.env;
+  if (flags.yes || flags.json || flags.global || flags.project || flags.list) return false;
+  if (detectHostAgent(env)) return false;
+  if (resolve3(flags.cwd ?? process.cwd()) === resolve3(flags.home ?? homedir4())) return false;
+  return !isInteractive(flags, { stdinTTY: Boolean(process.stdin.isTTY), stdoutTTY: Boolean(process.stdout.isTTY), env });
+}
+var CANCELLED_TEXT = "installation cancelled \u2014 nothing was installed";
+function finish2(flags, outcome) {
+  const json = Boolean(flags.json);
+  switch (outcome.kind) {
+    case "install": {
+      const installed = outcome.records.flatMap((r) => r.kind === "installed" ? [r.doc] : []);
+      const blocked = outcome.records.flatMap((r) => r.kind === "blocked" ? [{ name: r.name, reason: r.reason }] : []);
+      const written = installed.flatMap((d) => d.targets.map((t) => ({ name: d.name, dir: t.path })));
+      const warnings = [
+        ...outcome.notices,
+        ...outcome.records.flatMap((r) => r.kind === "installed" ? r.notices : [])
+      ].map((n) => n.text);
+      const exitCode = blocked.length > 0 || installed.length === 0 && !outcome.managed ? 1 : 0;
+      const doc = { ok: exitCode === 0, scope: outcome.scope, installed, blocked, warnings };
+      return {
+        written,
+        blocked,
+        exitCode,
+        output: json ? JSON.stringify(doc, null, 2) : renderHuman(outcome.notices, outcome.records, outcome.paths),
+        scope: outcome.scope,
+        agents: [...new Set(installed.flatMap((d) => d.targets.map((t) => t.agent)))]
+      };
+    }
+    case "list": {
+      const human = outcome.skills.length ? outcome.skills.map((s) => `${pc8.bold(s.name)}  ${pc8.dim(s.description)}`).join("\n") : "No skills found.";
+      return { written: [], blocked: [], exitCode: 0, output: json ? JSON.stringify({ ok: true, skills: outcome.skills }, null, 2) : human };
+    }
+    case "cancel": {
+      const doc = { ok: false, error: CANCELLED_TEXT };
       return {
         written: [],
-        blocked: [{ name: arg, reason: e.message }],
-        exitCode: 1,
-        output: pc7.red(`\u2717 ${arg} blocked \u2014 ${e.message}`)
+        blocked: [],
+        exitCode: 0,
+        cancelled: true,
+        output: json ? JSON.stringify(doc, null, 2) : pc8.dim("Installation cancelled \u2014 nothing was installed.")
       };
     }
-    throw e;
-  }
-  if (flags.skill?.length) candidates = candidates.filter((c) => flags.skill.includes(c.name) || flags.skill.includes("*"));
-  const deny = new Set(flags.deny ?? []);
-  const written = [];
-  const blocked = [];
-  const lines = [];
-  const resolved = await resolveScope(flags, deps);
-  if (!resolved) return CANCELLED;
-  const { scope } = resolved;
-  const isGlobal = scope.global;
-  const home = flags.home ?? homedir4();
-  if (resolved.note) lines.push(pc7.dim(`\u2139 ${resolved.note}`));
-  const detected = detectAgents(scope);
-  let targets = flags.agent?.length ? flags.agent : detected.length ? detected : ["claude-code"];
-  if (!flags.agent?.length && deps.promptAgents && !flags.yes && !flags.json) {
-    const picked = await deps.promptAgents({ detected: targets, dirFor: (id) => agentDir(id, scope) });
-    if (picked === null) return CANCELLED;
-    targets = picked;
-  }
-  const dirAgents = /* @__PURE__ */ new Map();
-  for (const agentId of targets) {
-    const dir = agentDir(agentId, scope);
-    dirAgents.set(dir, [...dirAgents.get(dir) ?? [], agentId]);
-  }
-  for (const c of candidates) {
-    const result = lint(c.raw, { slug: c.slug });
-    const allFlags = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
-    const deniedFlags = allFlags.filter((f) => deny.has(f));
-    if (!flags.skipLint && !result.ok) {
-      const errors = result.diagnostics.filter((d) => d.severity === "error");
-      blocked.push({ name: c.name, reason: `lint errors: ${errors.map((d) => d.id).join(", ")}` });
-      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
-      for (const d of errors) lines.push(pc7.dim(`    ${d.id}  ${d.message}`));
-      continue;
+    case "fail": {
+      const warnings = (outcome.notices ?? []).map((n) => n.text);
+      const doc = { ok: false, error: outcome.error };
+      if (outcome.blocked?.length) doc.blocked = outcome.blocked;
+      if (warnings.length) doc.warnings = warnings;
+      const human = [
+        ...(outcome.notices ?? []).map(noticeLine),
+        ...outcome.blocked?.length ? outcome.blocked.map((b) => pc8.red(`${GLYPH.blocked} ${b.name} blocked \u2014 ${b.reason}`)) : [pc8.red(outcome.error)]
+      ].join("\n");
+      return { written: [], blocked: outcome.blocked ?? [], exitCode: 1, output: json ? JSON.stringify(doc, null, 2) : human };
     }
-    if (deniedFlags.length) {
-      blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
-      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 you passed --deny ${deniedFlags.join(", ")}`));
+  }
+}
+function renderHuman(notices, records, paths) {
+  const lines = notices.map(noticeLine);
+  for (const r of records) {
+    if (r.kind === "blocked") {
+      lines.push(pc8.red(r.message));
       continue;
     }
-    const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
-    const base = isGlobal ? home : resolve3(flags.cwd ?? process.cwd());
-    lines.push(pc7.green(`\u2713 ${c.name}`) + pc7.dim(`  score ${result.score}${allFlags.length ? `  ${allFlags.join(", ")}` : ""}`));
-    for (const [dir, agentIds] of dirAgents) {
-      const out = writeSkill(c.name, files, dir, { mode: "copy" });
-      written.push({ name: c.name, dir: out });
-      const rel = relative2(base, out).split("\\").join("/") || out;
-      lines.push(pc7.dim(`  ${rel.padEnd(28)} ${agentIds.join(", ")}`));
+    const { doc } = r;
+    lines.push(renderInstallSummary({
+      name: doc.name,
+      score: r.score,
+      flags: r.securityFlags,
+      source: r.source,
+      canonical: doc.canonical,
+      targets: doc.targets,
+      skipped: doc.skipped,
+      ...r.replaced ? { replaced: r.replaced } : {}
+    }, paths));
+    for (const n of r.notices) if (!n.suppressInSummary) lines.push(noticeLine(n));
+  }
+  return lines.join("\n");
+}
+async function resolveCandidates(arg, flags, deps) {
+  const candidates = await deps.resolve(arg, flags);
+  if (!flags.skill?.length) return candidates;
+  return candidates.filter((c) => flags.skill.includes(c.name) || flags.skill.includes("*"));
+}
+function gate(flags, deps, candidates) {
+  if (flags.list) {
+    return finish2(flags, {
+      kind: "list",
+      skills: candidates.map((c) => {
+        const parsed = parseSkillMd2(c.raw);
+        const description = "error" in parsed ? `(invalid SKILL.md \u2014 ${parsed.error})` : parsed.description;
+        return { name: c.name, description: safeText(description, 80) };
+      })
+    });
+  }
+  if (flags.json && !flags.yes) {
+    return finish2(flags, { kind: "fail", error: "--json requires -y (no prompts can be shown in JSON mode)" });
+  }
+  if (deps.needsPrompt ?? (!deps.promptScope && defaultNeedsPrompt(flags))) {
+    return finish2(flags, { kind: "fail", error: nonInteractiveHint("-y (auto-detects the scope) or -g / -p") });
+  }
+  return null;
+}
+async function chooseTargets(flags, deps, scope, detected, managed) {
+  const notices = [];
+  let targets = flags.agent?.length ? flags.agent : detected.length ? detected : ["claude-code"];
+  if (scope.global) {
+    const kept = [];
+    for (const id of targets) {
+      if (agentSupportsGlobal(id)) kept.push(id);
+      else notices.push(skipNotice(`${id}: project-only agent`));
     }
-    if (c.pinMiss) {
-      lines.push(pc7.yellow(`\u26A0 ${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
+    targets = kept;
+  }
+  if (!flags.agent?.length && deps.promptAgents && !flags.yes && !flags.json && !detectHostAgent(flags.env ?? process.env)) {
+    const picked = await deps.promptAgents({ detected: targets, dirFor: (id) => agentDir(id, scope), ...managed ? { managed } : {} });
+    if (picked === null) return null;
+    targets = picked;
+    if (flags.home === void 0 && picked.length) {
+      try {
+        writeConfig({ ...readConfig(), lastAgents: picked });
+      } catch {
+      }
     }
-    if (c.note) {
-      lines.push(pc7.yellow(`\u26A0 ${c.name}: ${c.note}`));
+  }
+  return { targets, notices };
+}
+async function installOne(c, ctx) {
+  const result = lint2(c.raw, { slug: c.slug });
+  const securityFlags2 = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
+  const deniedFlags = securityFlags2.filter((f) => ctx.deny.has(f));
+  if (!ctx.flags.skipLint && !result.ok) {
+    return {
+      kind: "blocked",
+      name: c.name,
+      reason: `lint errors: ${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}`,
+      message: `${GLYPH.blocked} ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`
+    };
+  }
+  if (deniedFlags.length) {
+    return {
+      kind: "blocked",
+      name: c.name,
+      reason: `denied security flags: ${deniedFlags.join(", ")}`,
+      message: `${GLYPH.blocked} ${c.name} blocked \u2014 you passed --deny ${deniedFlags.join(", ")}`
+    };
+  }
+  const source = c.source ?? (c.registrySlug ? `registry:${c.registrySlug}` : provenanceFor(ctx.arg));
+  let out;
+  try {
+    out = await installSkill({
+      name: c.name,
+      files: c.files ?? [{ path: "SKILL.md", contents: c.raw }],
+      source,
+      commit_sha: c.commit_sha,
+      scope: ctx.scope,
+      agents: ctx.targets,
+      explicitAgents: Boolean(ctx.flags.agent?.length),
+      mode: ctx.flags.mode,
+      force: ctx.flags.force
+    });
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : String(e);
+    return { kind: "blocked", name: c.name, reason, message: `${GLYPH.blocked} ${c.name} \u2014 ${reason}` };
+  }
+  const notices = [];
+  if (out.replaced) notices.push(replacedNotice(`${c.name}: replaced previous install (${out.replaced})`));
+  if (c.pinMiss) notices.push(warnNotice(`${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
+  if (c.note) notices.push(warnNotice(`${c.name}: ${c.note}`));
+  if (c.type === "pack" && !c.files) {
+    notices.push(warnNotice(`${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
+  }
+  if (c.registrySlug && !telemetryDisabled(ctx.env)) ctx.deps.fireInstall(c.registrySlug, ctx.flags);
+  return {
+    kind: "installed",
+    doc: { name: c.name, canonical: out.canonical, targets: out.targets, skipped: out.skipped, digest: out.digest },
+    score: result.score,
+    securityFlags: securityFlags2,
+    notices,
+    source,
+    ...out.replaced ? { replaced: out.replaced } : {}
+  };
+}
+async function tryPluginInstall(arg, flags) {
+  let spec;
+  try {
+    spec = parseSource(arg, { ref: flags.ref });
+  } catch {
+    return null;
+  }
+  if (spec.kind !== "plugin") return null;
+  if (flags.agent?.length || flags.skill?.length || flags.list || flags.mode === "copy") return null;
+  const viaCli = await claudeCliAvailable() ? await installClaudePlugin(spec.owner, spec.slug) : null;
+  const res = viaCli?.ok ? viaCli : await installPluginNatively(spec.owner, spec.slug, { home: flags.home });
+  if (!res.ok) {
+    if (!viaCli && /no Claude Code directory/.test(res.reason)) return null;
+    return { ok: false, reason: viaCli && !viaCli.ok ? viaCli.reason : res.reason };
+  }
+  return {
+    ok: true,
+    agent: "claude-code",
+    name: res.name,
+    note: `installed ${res.name} as a Claude Code plugin \u2014 manage it with \`claude plugin\` or /plugin`
+  };
+}
+async function runAdd(arg, flags, deps) {
+  const d = deps ?? makeDefaultDeps(flags);
+  const env = flags.env ?? process.env;
+  const attempt = await tryPluginInstall(arg, flags);
+  const managed = attempt?.ok ? attempt : null;
+  const managedNotices = !attempt ? [] : attempt.ok ? [infoNotice(attempt.note)] : [warnNotice(`could not install this as a Claude Code plugin (${attempt.reason}) \u2014 installing its skills instead`)];
+  let scopeOnce;
+  const scopeOf = async () => scopeOnce ??= await resolveScope(flags, d);
+  if (managed) {
+    const pre = await scopeOf();
+    if (!pre) return finish2(flags, { kind: "cancel" });
+    const others = detectAgents(pre.scope).filter((id) => id !== managed.agent);
+    if (!others.length) {
+      const paths2 = { home: flags.home ?? homedir4(), cwd: flags.cwd ?? process.cwd() };
+      return finish2(flags, {
+        kind: "install",
+        scope: pre.scope.global ? "global" : "project",
+        records: [],
+        notices: [...pre.note ? [infoNotice(pre.note)] : [], ...managedNotices],
+        paths: paths2,
+        managed: managed.name
+      });
     }
-    if (c.type === "pack" && !c.files) {
-      lines.push(pc7.yellow(`\u26A0 ${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
+  }
+  let candidates;
+  try {
+    candidates = await resolveCandidates(arg, flags, d);
+  } catch (e) {
+    if (e instanceof IntegrityError) {
+      return finish2(flags, { kind: "fail", error: e.message, blocked: [{ name: arg, reason: e.message }] });
     }
-    if (c.registrySlug) deps.fireInstall(c.registrySlug, flags);
+    if (flags.json) return finish2(flags, { kind: "fail", error: e instanceof Error ? e.message : String(e) });
+    throw e;
   }
-  const exitCode = written.length === 0 ? 1 : 0;
-  return { written, blocked, exitCode, output: lines.join("\n") };
+  const early = gate(flags, d, candidates);
+  if (early) return early;
+  const resolved = await scopeOf();
+  if (!resolved) return finish2(flags, { kind: "cancel" });
+  const scope = resolved.scope;
+  const notices = resolved.note ? [infoNotice(resolved.note)] : [];
+  notices.push(...managedNotices);
+  const detected = detectAgents(scope).filter((id) => id !== managed?.agent);
+  const chosen = await chooseTargets(flags, d, scope, detected, managed?.name);
+  if (!chosen) return finish2(flags, { kind: "cancel" });
+  notices.push(...chosen.notices);
+  const ctx = { arg, flags, deny: new Set(flags.deny ?? []), scope, targets: chosen.targets, env, deps: d };
+  const records = [];
+  for (const c of candidates) records.push(await installOne(c, ctx));
+  const paths = { home: flags.home ?? homedir4(), cwd: flags.cwd ?? process.cwd() };
+  return finish2(flags, { kind: "install", scope: scope.global ? "global" : "project", records, notices, paths, ...managed ? { managed: managed.name } : {} });
+}
+function addFlags(opts, parent) {
+  const merged = { ...parent, ...opts };
+  if (opts.copy) merged.mode = "copy";
+  return merged;
 }
 function addCommand() {
-  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to your user-level agent folders (available in every project)").option("-p, --project", "install into the current directory's agent folders (committed with the project)").option("-a, --agent <agents...>", "target specific agents (default: every agent detected on this machine)").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip prompts; scope is auto-detected (project if this folder looks like a project, else global)").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
-    const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runAdd(source, merged);
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to your user-level agent folders (available in every project)").option("-p, --project", "install into the current directory's agent folders (committed with the project)").option("-a, --agent <agents...>", "target specific agents (default: every agent detected on this machine)").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--ref <ref>", "git ref (branch, tag or commit) for GitHub sources").option("-l, --list", "list the skills a source contains without installing").addOption(new Option("--mode <mode>", "link (junction/symlink into each agent dir, default) or copy").choices(["link", "copy"]).default("link")).option("--force", "replace a skill installed from a different source, or an untracked directory").addOption(new Option("--copy", "alias of --mode copy").hideHelp()).option("-y, --yes", "skip prompts; scope is auto-detected (project if this folder looks like a project, else global)").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
+    const merged = addFlags(opts, cmd.parent?.opts());
+    const { run: run2, printed } = await runAddWithUI(source, merged);
+    if (!printed) {
+      if (run2.exitCode === 1 && !merged.json) console.error(run2.output);
+      else console.log(run2.output);
+    }
+    process.exitCode = run2.exitCode;
   });
 }
+var clackUI = {
+  intro: (m) => p3.intro(m),
+  spinner: () => p3.spinner(),
+  message: (m) => p3.log.message(m),
+  outro: (m) => p3.outro(m),
+  cancel: (m) => p3.cancel(m),
+  confirm: async (m) => {
+    const answer = await p3.confirm({ message: m, initialValue: true });
+    return p3.isCancel(answer) ? null : answer;
+  }
+};
+var FIND_SKILLS = "skillmd/find-skills";
+async function offerFindSkills(source, flags, run2, ui, deps) {
+  if (!ui.confirm || run2.exitCode !== 0 || !run2.written.length || !run2.scope || !run2.agents?.length) return;
+  if (source.replace(/^registry:/, "").toLowerCase() === FIND_SKILLS) return;
+  const cfg = readConfig(flags.home);
+  if (cfg.findSkillsOffered) return;
+  const global = run2.scope === "global";
+  const lock = readLock({ global, cwd: flags.cwd, home: flags.home });
+  if (Object.values(lock.skills).some((e) => e.source === `registry:${FIND_SKILLS}`)) return;
+  try {
+    writeConfig({ ...cfg, findSkillsOffered: true }, flags.home);
+  } catch {
+  }
+  const yes = await ui.confirm("Also add find-skills, so your agent can look for more skills on SkillMD when a task needs one?");
+  if (!yes) return;
+  const r = await runAdd(FIND_SKILLS, {
+    ...flags,
+    yes: true,
+    json: false,
+    skill: void 0,
+    list: void 0,
+    ref: void 0,
+    global,
+    project: !global,
+    agent: run2.agents
+  }, deps);
+  ui.message(r.exitCode === 0 ? `${pc8.green(GLYPH.ok)} find-skills added` : pc8.yellow(`${GLYPH.warn} find-skills could not be added. Try later: npx get-skill add ${FIND_SKILLS}`));
+}
+async function runAddWithUI(source, flags, opts = {}) {
+  const term = opts.term ?? { ...realTerminal(), env: flags.env ?? process.env };
+  const base = opts.deps ?? makeDefaultDeps(flags);
+  if (!isInteractive(flags, term)) return { run: await runAdd(source, flags, base), printed: false };
+  const ui = opts.ui ?? clackUI;
+  ui.intro(banner());
+  try {
+    const run2 = await runAdd(source, flags, {
+      // NOTE: spreading `base` reads makeDefaultDeps()'s promptScope/promptAgents
+      // getters right here, freezing their values for this run. That is exactly
+      // what we want (interactivity is decided once, up front), but it does mean
+      // a getter added to AddDeps later stops being lazy the moment it crosses
+      // this spread.
+      ...base,
+      resolve: async (arg, f) => {
+        const s = ui.spinner();
+        s.start(`Resolving ${arg}`);
+        try {
+          const c = await base.resolve(arg, f);
+          s.stop(`${c.length} skill${c.length === 1 ? "" : "s"} found`);
+          return c;
+        } catch (e) {
+          s.stop(pc8.red("Could not resolve the source"));
+          throw e;
+        }
+      }
+    });
+    if (run2.cancelled) {
+      ui.cancel("Installation cancelled \u2014 nothing was installed.");
+      return { run: run2, printed: true };
+    }
+    ui.message(run2.output);
+    await offerFindSkills(source, flags, run2, ui, base);
+    ui.outro(run2.exitCode === 0 ? `Done. Run ${pc8.cyan("npx get-skill list")} to see everything installed.` : pc8.red("Some skills were not installed."));
+    return { run: run2, printed: true };
+  } catch (e) {
+    ui.outro(pc8.red("Nothing was installed."));
+    throw e;
+  }
+}
 
-// ../cli/src/commands/list.ts
+// src/commands/list.ts
 import { Command as Command8 } from "commander";
-import pc8 from "picocolors";
-function listCommand() {
-  return new Command8("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
-    const scope = { global: opts.global };
-    const skills = installedSkills(scope);
-    if (opts.json) {
-      console.log(JSON.stringify(skills.map((s) => ({ name: s.name, agent: s.agent, scope: s.scope, path: s.path })), null, 2));
-      return;
-    }
-    if (skills.length === 0) {
-      console.log("No installed skills found.");
-      return;
-    }
-    for (const s of skills) {
-      const parsed = parseSkillMd(s.raw);
-      const desc = "error" in parsed ? pc8.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc8.dim(parsed.description.slice(0, 80));
-      console.log(`${pc8.bold(s.name)} ${pc8.dim(`[${s.agent}/${s.scope}]`)}
-    ${desc}`);
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join4 } from "path";
+import pc9 from "picocolors";
+import { parseSkillMd as parseSkillMd3 } from "@skillmds/core";
+function runList(flags = {}) {
+  const scopes = scopesFor(flags);
+  let items = [];
+  for (const global of scopes) {
+    for (const s of listInstalled({ global, cwd: flags.cwd, home: flags.home })) {
+      const md = join4(s.path, "SKILL.md");
+      let description = "";
+      if (existsSync3(md)) {
+        const parsed = parseSkillMd3(readFileSync2(md, "utf8"));
+        description = "error" in parsed ? `(invalid SKILL.md \u2014 ${parsed.error})` : parsed.description;
+      }
+      items.push({ ...s, description: safeText(description, 80) });
     }
+  }
+  if (flags.agent?.length) items = items.filter((i) => i.agents.some((a) => flags.agent.includes(a)));
+  items.sort((a, b) => a.name.localeCompare(b.name) || a.scope.localeCompare(b.scope));
+  if (flags.json) {
+    return { items, output: JSON.stringify(items.map(({ name, scope, path, agents, source, mode, tracked, description }) => ({ name, scope, path, agents, source: source ?? null, mode, tracked, description })), null, 2) };
+  }
+  if (items.length === 0) return { items, output: pc9.dim("No installed skills found. Install one with `npx get-skill add owner/name`.") };
+  const w = Math.max(...items.map((i) => i.name.length), 4);
+  const lines = items.map((i) => {
+    const tag = i.tracked ? pc9.dim(i.source ?? "") : pc9.yellow("untracked");
+    const modes = [...new Set(Object.values(i.mode))].join("/");
+    return `${pc9.bold(i.name.padEnd(w))}  ${pc9.cyan(i.scope.padEnd(7))}  ${i.agents.join(", ").padEnd(24)}  ${pc9.dim(modes.padEnd(9))}  ${tag}
+${" ".repeat(w + 2)}${pc9.dim(i.description)}`;
+  });
+  return { items, output: lines.join("\n") };
+}
+function listCommand() {
+  return new Command8("list").alias("ls").description("List installed skills (project and global) with their source and link mode").option("-g, --global", "only user-level skills").option("-p, --project", "only this project's skills").option("-a, --agent <agents...>", "only skills linked into these agents").option("--json", "machine-readable output").action((opts, cmd) => {
+    console.log(runList({ ...cmd.parent?.opts(), ...opts }).output);
   });
 }
 
-// ../cli/src/commands/remove.ts
+// src/commands/remove.ts
 import { Command as Command9 } from "commander";
-import { rmSync as rmSync3 } from "fs";
-import pc9 from "picocolors";
-function runRemove(names, scope = {}) {
-  const installed = installedSkills(scope);
-  const targets = installed.filter((s) => names.includes(s.name));
-  const removed = [];
+import { rmSync } from "fs";
+import { join as join5, resolve as resolve4 } from "path";
+import * as p4 from "@clack/prompts";
+import pc10 from "picocolors";
+var defaultDeps = (flags) => isInteractive(flags) ? {
+  confirm: async (msg2) => {
+    const a = await p4.confirm({ message: msg2, initialValue: false });
+    return !p4.isCancel(a) && a;
+  },
+  pick: async ({ names }) => {
+    const a = await p4.multiselect({ message: "Which skills do you want to remove?", options: names.map((n) => ({ value: n, label: n })), required: true });
+    return p4.isCancel(a) ? null : a;
+  }
+} : {};
+function finish3(flags, result, doc) {
+  return flags.json ? { ...result, output: JSON.stringify(doc, null, 2) } : result;
+}
+var scopeLabel = (scope) => scope.global ? "global" : "project";
+async function runRemove(names, flags, deps = defaultDeps(flags)) {
+  const scopes = scopesFor(flags).map((global) => ({ global, cwd: flags.cwd, home: flags.home }));
+  const where = scopes.map(scopeLabel).join(" and ");
   const lines = [];
-  for (const t of targets) {
-    rmSync3(t.path, { recursive: true, force: true });
-    removed.push(t.path);
-    lines.push(pc9.green(`\u2713 removed ${t.name} (${t.agent})`));
+  if (flags.all && names.length) {
+    const error = "--all cannot be combined with skill names";
+    return finish3(flags, { removed: [], exitCode: 1, output: pc10.red(error) }, { ok: false, error });
   }
-  for (const n of names) {
-    if (!targets.some((t) => t.name === n)) lines.push(pc9.yellow(`- ${n} not installed`));
+  const perScope = scopes.map((scope) => ({ scope, installed: listInstalled(scope) }));
+  const allNames = [...new Set(perScope.flatMap((s) => s.installed.map((i) => i.name)))];
+  const nothingInstalled = `No installed skills found in ${where} scope.`;
+  let targets = names;
+  if (flags.all) {
+    if (allNames.length === 0) {
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.dim(nothingInstalled) }, { ok: false, error: nothingInstalled });
+    }
+    targets = allNames;
+  } else if (targets.length === 0) {
+    if (!deps.pick) {
+      const error = "Give one or more skill names, or --all.";
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.red(`${error} `) + pc10.dim(nonInteractiveHint("skill names and -y")) }, { ok: false, error });
+    }
+    if (allNames.length === 0) {
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.dim(nothingInstalled) }, { ok: false, error: nothingInstalled });
+    }
+    const picked = await deps.pick({ names: allNames });
+    if (!picked) return finish3(flags, { removed: [], exitCode: 0, cancelled: true, output: pc10.dim("Nothing removed.") }, { ok: true, removed: [], cancelled: true });
+    targets = picked;
   }
-  return { removed, output: lines.join("\n") };
+  const known = targets.filter((n) => allNames.includes(n));
+  const missing = targets.filter((n) => !known.includes(n));
+  for (const n of missing) lines.push(pc10.yellow(`- ${n} not installed (${where} scope)`));
+  if (known.length === 0) {
+    const output = lines.join("\n");
+    return finish3(flags, { removed: [], exitCode: 1, output }, { ok: false, error: `not installed: ${missing.join(", ")}`, missing });
+  }
+  if (!flags.yes) {
+    const what = flags.agent?.length ? `from ${flags.agent.join(", ")}` : "from every agent";
+    const ok = deps.confirm ? await deps.confirm(`Remove ${known.length} skill${known.length === 1 ? "" : "s"} (${known.join(", ")}) ${what} in ${where} scope?`) : null;
+    if (ok === null) {
+      const error = nonInteractiveHint("-y");
+      return finish3(flags, { removed: [], exitCode: 1, output: pc10.red(error) }, { ok: false, error });
+    }
+    if (!ok) return finish3(flags, { removed: [], exitCode: 0, cancelled: true, output: pc10.dim("Nothing removed.") }, { ok: true, removed: [], cancelled: true });
+  }
+  const removed = [];
+  const skipped = [];
+  let changed = 0;
+  for (const name of known) {
+    for (const { scope, installed } of perScope) {
+      if (!installed.some((s) => s.name === name)) continue;
+      const tag = scopes.length > 1 ? pc10.dim(` [${scopeLabel(scope)}]`) : "";
+      if (flags.agent?.length) {
+        const lock = readLock({ global: Boolean(scope.global), cwd: scope.cwd, home: scope.home });
+        const entry = lock.skills[name];
+        const canonRoot = resolve4(canonicalDir(scope));
+        let acted = false;
+        for (const a of flags.agent) {
+          let dir;
+          try {
+            dir = agentDir(a, scope);
+          } catch (e) {
+            lines.push(pc10.yellow(`- ${a}: ${e instanceof Error ? e.message : String(e)}`));
+            continue;
+          }
+          if (resolve4(dir) === canonRoot || entry?.mode[a] === "canonical") {
+            lines.push(pc10.dim(`${GLYPH.skip} ${name}: ${a} reads the canonical copy directly \u2014 unlinking is a no-op (use remove without -a to delete the skill)`));
+            skipped.push({ skill: name, agent: a, scope: scopeLabel(scope), reason: "reads the canonical copy directly" });
+            acted = true;
+            continue;
+          }
+          const pth = join5(dir, name);
+          if (isSkillDirOrLink(pth)) {
+            rmSync(pth, { recursive: true, force: true });
+            removed.push(pth);
+            acted = true;
+            lines.push(pc10.green(`${GLYPH.ok} removed ${name} from ${a}`) + tag);
+          }
+        }
+        if (!acted) lines.push(pc10.yellow(`- ${name} is not linked into ${flags.agent.join(", ")}`) + tag);
+        if (entry) {
+          const left = entry.agents.filter((a) => !flags.agent.includes(a));
+          if (left.length) upsertEntry({ global: Boolean(scope.global), cwd: scope.cwd, home: scope.home }, name, { ...entry, agents: left, mode: Object.fromEntries(Object.entries(entry.mode).filter(([a]) => left.includes(a))) });
+          else {
+            const r2 = uninstallSkill(name, scope);
+            removed.push(...r2.removed);
+            lines.push(pc10.dim(`  (no agents left \u2014 removed the canonical copy too)`));
+          }
+        }
+        if (acted) changed++;
+        continue;
+      }
+      const r = uninstallSkill(name, scope);
+      removed.push(...r.removed);
+      changed++;
+      lines.push(pc10.green(`${GLYPH.ok} removed ${name}`) + tag + pc10.dim(` (${r.removed.length} path${r.removed.length === 1 ? "" : "s"}${r.untracked ? ", untracked" : ""})`));
+    }
+  }
+  const exitCode = changed ? 0 : 1;
+  const doc = { ok: exitCode === 0, removed, missing };
+  if (skipped.length) doc.skipped = skipped;
+  return finish3(flags, { removed, exitCode, output: lines.join("\n") }, doc);
 }
 function removeCommand() {
-  return new Command9("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
-    const run = runRemove(names, { global: opts.global });
-    console.log(run.output);
+  return new Command9("remove").alias("rm").description("Remove installed skills (links, canonical copy and lock entry)").argument("[names...]", "skill names (omit to pick interactively)").option("-g, --global", "only user-level skills").option("-p, --project", "only this project's skills").option("-a, --agent <agents...>", "remove only from these agents").option("--all", "remove every skill in the scope").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (names, opts, cmd) => {
+    const run2 = await runRemove(names, { ...cmd.parent?.opts(), ...opts });
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
-// ../cli/src/commands/update.ts
+// src/commands/update.ts
 import { Command as Command10 } from "commander";
-import { writeFileSync as writeFileSync5 } from "fs";
-import { join as join6 } from "path";
-import pc10 from "picocolors";
-async function runUpdate(names, flags, scope = {}) {
-  const { api } = createClient(flags);
-  const installed = installedSkills(scope).filter((s) => names.length === 0 || names.includes(s.name));
+import pc11 from "picocolors";
+import { lint as lint3 } from "@skillmds/core";
+function pickSkillTree(files, want) {
+  const norm = files.map((f) => ({ path: f.path.replace(/\\/g, "/"), contents: f.contents }));
+  const match = norm.find((f) => f.path.endsWith("/SKILL.md") && f.path.split("/").at(-2) === want);
+  if (match) {
+    const prefix = match.path.slice(0, -"SKILL.md".length);
+    return norm.filter((f) => f.path.startsWith(prefix)).map((f) => ({ path: f.path.slice(prefix.length), contents: f.contents }));
+  }
+  if (norm.some((f) => f.path === "SKILL.md")) return norm;
+  return null;
+}
+function makeDefaultUpdateDeps(opts = {}) {
+  const tree = opts.resolveTree ?? ((input) => resolveTree(input));
+  const one = opts.resolveSource ?? ((url) => resolveSource(url));
+  const client = opts.client ?? createClient;
+  return {
+    async fetchLatest(source, flags, name) {
+      if (source.startsWith("registry:")) {
+        const slug = source.slice("registry:".length);
+        const { api, base, token } = client(flags);
+        let skill;
+        try {
+          skill = await api(`/api/skills/${slug}`);
+        } catch (e) {
+          if (e.status === 404) return null;
+          throw e;
+        }
+        if (skill.type === "pack") {
+          const bundle = await fetchBundle(base, slug, token);
+          if (bundle?.length) return { files: bundle, commit_sha: skill.commit_sha ?? void 0 };
+          const pack = await resolvePackFiles(skill);
+          if (pack) return { files: pack.files, commit_sha: skill.commit_sha ?? void 0 };
+        }
+        return { files: [{ path: "SKILL.md", contents: skillMdFor(skill) }], commit_sha: skill.commit_sha ?? void 0 };
+      }
+      if (source.startsWith("github:")) {
+        const spec = parseSource(source);
+        if (spec.kind !== "github") return null;
+        const files = await tree(gigetInput(spec));
+        const picked = pickSkillTree(files, spec.skill ?? name);
+        return picked ? { files: picked } : null;
+      }
+      if (source.startsWith("gist:")) {
+        const [user, id] = source.slice("gist:".length).split("/");
+        const rs = await one(`https://gist.github.com/${user}/${id}`);
+        return rs[0] ? { files: [{ path: "SKILL.md", contents: rs[0].raw }] } : null;
+      }
+      return null;
+    }
+  };
+}
+var defaultUpdateDeps = makeDefaultUpdateDeps();
+async function runUpdate(names, flags, deps = defaultUpdateDeps) {
+  const scopes = scopesFor(flags);
   const updated = [];
+  const available = [];
+  const failed = [];
   const lines = [];
-  for (const s of installed) {
-    const slug = await findRegistrySlug(api, s);
-    if (!slug) {
-      lines.push(pc10.dim(`- ${s.name} skipped (no registry match)`));
-      continue;
-    }
-    try {
-      const [owner, name] = slug.split("/");
-      const skill = await api(`/api/skills/${owner}/${name}`);
-      const next = skillMdFor(skill);
-      if (next.trim() === s.raw.trim()) {
-        lines.push(pc10.dim(`- ${s.name} already up to date`));
+  const seen = /* @__PURE__ */ new Set();
+  for (const global of scopes) {
+    const scope = { global, cwd: flags.cwd, home: flags.home };
+    const lock = readLock(scope);
+    const installed = listInstalled(scope).filter((s) => names.length === 0 || names.includes(s.name));
+    for (const s of installed) {
+      seen.add(s.name);
+      const label2 = `${s.name}${scopes.length > 1 ? pc11.dim(` [${s.scope}]`) : ""}`;
+      const entry = lock.skills[s.name];
+      if (!entry) {
+        lines.push(pc11.dim(`- ${label2} untracked \u2014 reinstall with \`npx get-skill add\` to track updates`));
         continue;
       }
-      const result = lint(next, { slug: s.name });
-      if (!result.ok) {
-        lines.push(pc10.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
+      if (entry.source.startsWith("local:")) {
+        lines.push(pc11.dim(`- ${label2} local source \u2014 not auto-updated`));
         continue;
       }
-      writeFileSync5(join6(s.path, "SKILL.md"), next, "utf8");
-      updated.push(s.name);
-      lines.push(pc10.green(`\u2713 updated ${s.name}`));
-    } catch {
-      lines.push(pc10.red(`\u2717 ${s.name} update error`));
+      try {
+        const latest = await deps.fetchLatest(entry.source, flags, s.name);
+        if (!latest) {
+          failed.push(s.name);
+          lines.push(pc11.red(`${GLYPH.blocked} ${label2} no longer available upstream (${entry.source})`));
+          continue;
+        }
+        if (entry.source.startsWith("registry:") && latest.commit_sha && entry.commit_sha && latest.commit_sha === entry.commit_sha) {
+          lines.push(pc11.dim(`- ${label2} up to date`));
+          continue;
+        }
+        if (digestOf(latest.files) === entry.digest) {
+          lines.push(pc11.dim(`- ${label2} up to date`));
+          continue;
+        }
+        if (flags.check) {
+          available.push(s.name);
+          lines.push(pc11.yellow(`\u2191 ${label2} update available`));
+          continue;
+        }
+        const md = latest.files.find((f) => f.path === "SKILL.md");
+        const raw = md ? typeof md.contents === "string" ? md.contents : md.contents.toString("utf8") : "";
+        const result = lint3(raw, { slug: s.name });
+        if (!result.ok) {
+          failed.push(s.name);
+          lines.push(pc11.red(`${GLYPH.blocked} ${label2} update failed lint (${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}) \u2014 kept the installed version`));
+          continue;
+        }
+        await installSkill({ name: s.name, files: latest.files, source: entry.source, commit_sha: latest.commit_sha, scope, agents: entry.agents, explicitAgents: true, mode: Object.values(entry.mode).includes("copy") ? "copy" : "link" });
+        updated.push(s.name);
+        lines.push(pc11.green(`${GLYPH.ok} ${label2} updated`));
+      } catch (e) {
+        failed.push(s.name);
+        lines.push(pc11.red(`${GLYPH.blocked} ${label2} ${e instanceof Error ? e.message : String(e)}`));
+      }
     }
   }
-  return { updated, output: lines.join("\n") || "Nothing to update." };
+  for (const n of names) {
+    if (seen.has(n)) continue;
+    failed.push(n);
+    lines.push(pc11.yellow(`- ${n} not installed`));
+  }
+  const exitCode = failed.length ? 1 : 0;
+  if (flags.json) return { updated, available, failed, exitCode, output: JSON.stringify({ ok: exitCode === 0, updated: [...new Set(updated)], available: [...new Set(available)], failed: [...new Set(failed)] }, null, 2) };
+  if (lines.length === 0) lines.push(pc11.dim("No installed skills found."));
+  return { updated, available, failed, exitCode, output: lines.join("\n") };
 }
-async function findRegistrySlug(api, s) {
-  const r = await api(`/api/search?q=${encodeURIComponent(s.name)}&limit=5`).catch(() => null);
-  const hit = r?.items?.find((it) => it.slug.split("/")[1] === s.name);
-  return hit?.slug ?? null;
+function scopeOptions(cmd) {
+  return cmd.option("-g, --global", "only user-level skills").option("-p, --project", "only this project's skills").option("--json", "machine-readable output");
 }
 function updateCommand() {
-  return new Command10("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
-    const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runUpdate(names, merged, { global: opts.global });
-    console.log(run.output);
+  return scopeOptions(new Command10("update").description("Update installed skills from the source recorded in the lock file (re-lints before writing)").argument("[names...]", "specific skills (default: all tracked)").option("--check", "only report which skills have updates")).action(async (names, opts, cmd) => {
+    const run2 = await runUpdate(names, { ...cmd.parent?.opts(), ...opts });
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
+  });
+}
+function checkCommand() {
+  return scopeOptions(new Command10("check").description("Report installed skills that have updates (alias of `update --check`)").argument("[names...]", "specific skills (default: all tracked)")).action(async (names, opts, cmd) => {
+    const run2 = await runUpdate(names, { ...cmd.parent?.opts(), ...opts, check: true });
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
-// ../cli/src/commands/publish.ts
+// src/commands/publish.ts
 import { Command as Command11 } from "commander";
-import pc11 from "picocolors";
+import pc12 from "picocolors";
+import { lint as lint4, toText } from "@skillmds/core";
 var defaultDeps2 = {
   resolve: resolveSource,
   async submit(payload, flags) {
     const { api, hasToken } = createClient(flags);
-    if (!hasToken) throw new Error("No token. Run `skillmd login` or pass --token.");
+    if (!hasToken) throw new Error("No token. Run `npx get-skill login` or pass --token.");
     return api(`/api/skills`, {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -1463,78 +1798,114 @@ var defaultDeps2 = {
 async function runPublish(target, flags, deps = defaultDeps2) {
   const sources = await deps.resolve(target);
   if (sources.length !== 1) {
-    return { result: lint(""), published: false, exitCode: 1, output: `Expected exactly one SKILL.md, found ${sources.length}.` };
+    return { result: lint4(""), published: false, exitCode: 1, output: `Expected exactly one SKILL.md, found ${sources.length}.` };
   }
   const src = sources[0];
-  const result = lint(src.raw, { slug: src.slug });
+  const result = lint4(src.raw, { slug: src.slug });
   const report = toText([{ file: src.path, result }], { decorate });
   if (!result.ok) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc11.red("\u2717 Refusing to publish: fix the errors above.")}` };
+${pc12.red("\u2717 Refusing to publish: fix the errors above.")}` };
   }
   const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
   if (hasWarn && !flags.force) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc11.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
+${pc12.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
   }
   if (flags.dryRun) {
     return { result, published: false, exitCode: 0, output: `${report}
-${pc11.green("\u2713 Dry run: would publish.")}` };
+${pc12.green("\u2713 Dry run: would publish.")}` };
   }
   const res = await deps.submit({ content: src.raw, type: flags.type ?? "single" }, flags);
   return { result, published: true, slug: res.slug, exitCode: 0, output: `${report}
-${pc11.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
+${pc12.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
 }
 function publishCommand() {
   return new Command11("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runPublish(target, merged);
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runPublish(target, merged);
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
-// ../cli/src/commands/login.ts
+// src/commands/login.ts
 import { Command as Command12 } from "commander";
-import * as p4 from "@clack/prompts";
-function loginCommand() {
-  return new Command12("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
-    let token = opts.token;
-    if (!token) {
-      const answer = await p4.password({ message: "Paste your SkillMD token (from your account page)" });
-      if (p4.isCancel(answer)) {
-        p4.cancel("Cancelled.");
-        return;
-      }
-      token = answer;
-    }
-    if (!token) {
-      console.error("A token is required.");
-      process.exitCode = 1;
-      return;
+import * as p5 from "@clack/prompts";
+import pc13 from "picocolors";
+var defaultLoginDeps = (flags) => promptIf(flags, async () => {
+  const answer = await p5.password({ message: "Paste your SkillMD token (from your account page)" });
+  return p5.isCancel(answer) ? null : answer;
+});
+function finish4(flags, result, doc) {
+  return flags.json ? { ...result, output: JSON.stringify(doc, null, 2) } : result;
+}
+async function runLogin(flags, deps = defaultLoginDeps(flags)) {
+  const env = flags.env ?? process.env;
+  let token = flags.token;
+  if (!token) {
+    if (!deps.prompt) {
+      const error = nonInteractiveHint("--token <token> (or set SKILLMD_TOKEN)");
+      return finish4(flags, { exitCode: 1, output: pc13.red(error) }, { ok: false, error });
     }
-    const cfg = readConfig();
-    cfg.token = token;
-    if (opts.api) cfg.api = opts.api;
-    writeConfig(cfg);
-    console.log(`Saved token to ${configPath()}`);
+    const answer = await deps.prompt();
+    if (answer === null) return finish4(flags, { exitCode: 0, output: pc13.dim("Cancelled.") }, { ok: false, cancelled: true });
+    token = answer;
+  }
+  if (!token) {
+    const error = "A token is required.";
+    return finish4(flags, { exitCode: 1, output: pc13.red(error) }, { ok: false, error });
+  }
+  const cfg = readConfig(flags.home);
+  let host;
+  try {
+    host = hostOf(resolveApi({ api: flags.api, insecureHttp: flags.insecureHttp }, { env, config: { ...cfg, api: flags.api ?? cfg.api } }));
+  } catch (e) {
+    const msg2 = e instanceof Error ? e.message : String(e);
+    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg2 }, null, 2) : pc13.red(msg2) };
+  }
+  cfg.token = token;
+  if (flags.api) cfg.api = flags.api;
+  cfg.tokenHost = host;
+  writeConfig(cfg, flags.home);
+  const file = configPath(flags.home);
+  return {
+    exitCode: 0,
+    output: flags.json ? JSON.stringify({ ok: true, file, host }, null, 2) : `Saved token for ${host} to ${file}`
+  };
+}
+function runLogout(flags) {
+  const cfg = readConfig(flags.home);
+  const had = Boolean(cfg.token);
+  delete cfg.token;
+  delete cfg.tokenHost;
+  writeConfig(cfg, flags.home);
+  return {
+    exitCode: 0,
+    output: flags.json ? JSON.stringify({ ok: true, removed: had }, null, 2) : had ? "Removed stored token." : "No stored token."
+  };
+}
+function loginCommand() {
+  return new Command12("login").description("Store a SkillMD personal access token for publishing (prefer this or SKILLMD_TOKEN over --token)").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").option("--json", "machine-readable output").action(async (opts, cmd) => {
+    const r = await runLogin({ ...cmd.parent?.opts(), ...opts });
+    console.log(r.output);
+    process.exitCode = r.exitCode;
   });
 }
 function logoutCommand() {
-  return new Command12("logout").description("Remove the stored SkillMD token").action(() => {
-    const cfg = readConfig();
-    delete cfg.token;
-    writeConfig(cfg);
-    console.log("Removed stored token.");
+  return new Command12("logout").description("Remove the stored SkillMD token").option("--json", "machine-readable output").action((opts, cmd) => {
+    const r = runLogout({ ...cmd.parent?.opts(), ...opts });
+    console.log(r.output);
+    process.exitCode = r.exitCode;
   });
 }
 
-// ../cli/src/commands/interactive.ts
-import * as p5 from "@clack/prompts";
-import pc12 from "picocolors";
+// src/commands/interactive.ts
+import * as p6 from "@clack/prompts";
+import pc14 from "picocolors";
 function bail(v) {
-  if (p5.isCancel(v)) {
-    p5.cancel("Cancelled.");
+  if (p6.isCancel(v)) {
+    p6.cancel("Cancelled.");
     return true;
   }
   return false;
@@ -1542,25 +1913,26 @@ function bail(v) {
 async function browseSearchResults(items) {
   const cols = process.stdout.columns ?? 80;
   for (; ; ) {
-    const picked = await p5.select({
+    const picked = await p6.select({
       message: "Search results",
       options: [
         ...items.map((item2) => {
           const starsTxt = item2.repo_stars != null ? ` \u2605${formatStars(item2.repo_stars)}` : "";
           const checkTxt = item2.verified ? " \u2713" : "";
-          const plainLabel = `${item2.slug}${starsTxt}${checkTxt}`;
-          const label2 = `${pc12.bold(item2.slug)}${starsTxt ? pc12.dim(starsTxt) : ""}${checkTxt ? pc12.green(checkTxt) : ""}`;
+          const slugTxt = safeText(item2.slug, 200);
+          const plainLabel = `${slugTxt}${starsTxt}${checkTxt}`;
+          const label2 = `${pc14.bold(slugTxt)}${starsTxt ? pc14.dim(starsTxt) : ""}${checkTxt ? pc14.green(checkTxt) : ""}`;
           const hintWidth = Math.max(10, cols - plainLabel.length - 6);
           return {
             value: item2.slug,
             label: label2,
-            hint: truncate(item2.description ?? "", hintWidth)
+            hint: truncate(safeText(item2.description ?? ""), hintWidth)
           };
         }),
         { value: "__back", label: "\u2190 Back to menu" }
       ]
     });
-    if (p5.isCancel(picked) || picked === "__back") return;
+    if (p6.isCancel(picked) || picked === "__back") return;
     const item = items.find((i) => i.slug === picked);
     if (!item) continue;
     await browseOneResult(item);
@@ -1568,14 +1940,15 @@ async function browseSearchResults(items) {
 }
 async function browseOneResult(item) {
   const starsTxt = item.repo_stars != null ? `\u2605 ${formatStars(item.repo_stars)} stars` : "";
+  const slugTxt = safeText(item.slug, 200);
   const meta = [
     starsTxt,
-    item.verified ? pc12.green("\u2713 verified") : "unverified",
+    item.verified ? pc14.green("\u2713 verified") : "unverified",
     item.type === "pack" ? "pack" : ""
   ].filter(Boolean).join(" \xB7 ");
-  p5.note([item.description ?? "", pc12.dim(meta)].join("\n"), item.slug);
+  p6.note([safeText(item.description ?? ""), pc14.dim(meta)].join("\n"), slugTxt);
   for (; ; ) {
-    const action = await p5.select({
+    const action = await p6.select({
       message: "What next?",
       options: [
         { value: "project", label: "Install to this project" },
@@ -1584,33 +1957,36 @@ async function browseOneResult(item) {
         { value: "back", label: "\u2190 Back to results" }
       ]
     });
-    if (p5.isCancel(action) || action === "back") return;
+    if (p6.isCancel(action) || action === "back") return;
     if (action === "url") {
-      p5.log.message(pc12.dim(`https://skillmd.com/skills/${item.slug}`));
+      p6.log.message(pc14.dim(`https://skillmd.com/skills/${slugTxt}`));
       continue;
     }
-    p5.log.step(`Installing ${item.slug}\u2026`);
+    p6.log.step(`Installing ${slugTxt}\u2026`);
     try {
-      const run = await runAdd(item.slug, action === "global" ? { global: true } : { project: true });
-      console.log(run.output);
-      if (run.exitCode === 0) p5.log.success("Installed.");
-      else p5.log.warn("Not installed.");
+      const run2 = await runAdd(item.slug, action === "global" ? { global: true } : { project: true });
+      console.log(run2.output);
+      if (run2.exitCode === 0) p6.log.success("Installed.");
+      else p6.log.warn("Not installed.");
     } catch (err) {
-      p5.log.error(err instanceof Error ? err.message : String(err));
+      p6.log.error(err instanceof Error ? err.message : String(err));
     }
   }
 }
 async function runInteractive() {
-  p5.intro(pc12.bgCyan(pc12.black(" skillmd ")));
+  p6.intro(banner());
   for (; ; ) {
-    const action = await p5.select({
+    const action = await p6.select({
       message: "What would you like to do?",
       options: [
         { value: "lint", label: "Lint a skill", hint: "validate a SKILL.md" },
         { value: "scan", label: "Security scan", hint: "scripts, network, secrets" },
         { value: "search", label: "Search the registry" },
+        { value: "install", label: "Install a skill", hint: "registry slug, GitHub URL or local path" },
         { value: "init", label: "Create a new skill" },
         { value: "list", label: "List installed skills" },
+        { value: "update", label: "Update installed skills" },
+        { value: "remove", label: "Remove skills" },
         { value: "help", label: "Show all commands" },
         { value: "quit", label: "Quit" }
       ]
@@ -1619,85 +1995,108 @@ async function runInteractive() {
     switch (action) {
       case "lint":
       case "scan": {
-        const path = await p5.text({ message: "Path to a skill or folder", placeholder: ".", defaultValue: "." });
+        const path = await p6.text({ message: "Path to a skill or folder", placeholder: ".", defaultValue: "." });
         if (bail(path)) break;
         const target = String(path || ".");
-        const s = p5.spinner();
+        const s = p6.spinner();
         s.start(action === "lint" ? "Linting" : "Scanning");
         try {
-          const run = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
+          const run2 = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
           s.stop("Done");
-          console.log(run.output);
-          process.exitCode = run.exitCode;
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
         } catch (err) {
-          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          s.stop(pc14.red(err instanceof Error ? err.message : String(err)));
           process.exitCode = 1;
         }
         break;
       }
       case "search": {
-        const query = await p5.text({ message: "Search the registry for" });
+        const query = await p6.text({ message: "Search the registry for" });
         if (bail(query)) break;
-        const verified = await p5.confirm({ message: "Verified skills only?", initialValue: false });
+        const verified = await p6.confirm({ message: "Verified skills only?", initialValue: false });
         if (bail(verified)) break;
-        const s = p5.spinner();
+        const s = p6.spinner();
         s.start("Searching");
         try {
-          const run = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
-          s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
-          if (run.items.length === 0) {
-            p5.log.info("No results.");
+          const run2 = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
+          s.stop(`${run2.items.length} result${run2.items.length === 1 ? "" : "s"}`);
+          if (run2.items.length === 0) {
+            p6.log.info("No results.");
             break;
           }
-          await browseSearchResults(run.items);
+          await browseSearchResults(run2.items);
         } catch (err) {
-          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          s.stop(pc14.red(err instanceof Error ? err.message : String(err)));
           process.exitCode = 1;
         }
         break;
       }
       case "init": {
-        const name = await p5.text({ message: "Skill name", placeholder: "my-skill" });
+        const name = await p6.text({ message: "Skill name", placeholder: "my-skill" });
         if (bail(name)) break;
-        const description = await p5.text({ message: "One-line description", placeholder: "What this skill helps an agent do" });
+        const description = await p6.text({ message: "One-line description", placeholder: "What this skill helps an agent do" });
         if (bail(description)) break;
         try {
           const file = initSkill(String(name), { description: String(description || "") });
-          p5.log.success(`Created ${pc12.bold(file)}`);
+          p6.log.success(`Created ${pc14.bold(file)}`);
         } catch (err) {
-          p5.log.error(err instanceof Error ? err.message : String(err));
+          p6.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        break;
+      }
+      case "install": {
+        const src = await p6.text({ message: "Skill source", placeholder: "owner/name, https://github.com/\u2026, or ./path" });
+        if (bail(src)) break;
+        try {
+          const run2 = await runAdd(String(src), {});
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
+        } catch (err) {
+          p6.log.error(err instanceof Error ? err.message : String(err));
           process.exitCode = 1;
         }
         break;
       }
       case "list": {
-        const skills = [...installedSkills({}), ...installedSkills({ global: true })];
-        if (skills.length === 0) {
-          p5.log.info("No installed skills found (checked this folder and your user directory).");
-        } else {
-          p5.log.message(
-            skills.map((sk) => {
-              const parsed = parseSkillMd(sk.raw);
-              const desc = "error" in parsed ? pc12.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc12.dim(parsed.description.slice(0, 70));
-              return `${pc12.bold(sk.name)} ${pc12.dim(`[${sk.agent}/${sk.scope}]`)}
-  ${desc}`;
-            }).join("\n")
-          );
+        console.log(runList({}).output);
+        break;
+      }
+      case "update": {
+        try {
+          const run2 = await runUpdate([], {});
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
+        } catch (err) {
+          p6.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        break;
+      }
+      case "remove": {
+        try {
+          const run2 = await runRemove([], {});
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
+        } catch (err) {
+          p6.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
         }
         break;
       }
       case "help": {
-        p5.note(
+        p6.note(
           [
-            `${pc12.bold("lint")} [path]      validate SKILL.md + quality score`,
-            `${pc12.bold("scan")} [path]      security scan`,
-            `${pc12.bold("search")} <query>   search the registry`,
-            `${pc12.bold("add")} <source>     install a skill (lints first)`,
-            `${pc12.bold("info")} <slug>      registry details for a skill`,
-            `${pc12.bold("init")} [name]      scaffold a new skill`,
-            `${pc12.bold("list / remove / update")}   manage installed skills`,
-            `${pc12.bold("publish")} [path]   publish (fails on lint errors)`,
-            `${pc12.bold("rules / login")}`
+            `${pc14.bold("lint")} [path]      validate SKILL.md + quality score`,
+            `${pc14.bold("scan")} [path]      security scan`,
+            `${pc14.bold("search")} <query>   search the registry`,
+            `${pc14.bold("add")} <source>     install a skill (lints first)`,
+            `${pc14.bold("info")} <slug>      registry details for a skill`,
+            `${pc14.bold("init")} [name]      scaffold a new skill`,
+            `${pc14.bold("list / remove / update")}   manage installed skills`,
+            `${pc14.bold("publish")} [path]   publish (fails on lint errors)`,
+            `${pc14.bold("rules / login")}`
           ].join("\n"),
           "Commands (run: skillmd <command>)"
         );
@@ -1705,16 +2104,39 @@ async function runInteractive() {
       }
     }
   }
-  p5.outro(pc12.dim("skillmd.com"));
+  p6.outro(pc14.dim("skillmd.com"));
 }
 
-// ../cli/src/index.ts
+// src/index.ts
 var version = "0.0.0";
 try {
-  version = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
+  version = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8")).version;
 } catch {
 }
-var program = new Command13("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
+var program = new Command13("get-skill").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "personal access token (prefer `npx get-skill login` or SKILLMD_TOKEN \u2014 command-line tokens show up in process lists)").option("--api <url>", "override the registry API base URL").option("--insecure-http", "allow an http:// --api base (local development only)");
+program.configureHelp({ sortSubcommands: false });
+program.addHelpText("after", `
+Examples:
+  $ npx get-skill add anthropic/pdf                  install from the registry (asks project vs global)
+  $ npx get-skill add owner/repo/skills/x#main -g    a GitHub subfolder at a ref, into your user dirs
+  $ npx get-skill add ./my-skill -a claude-code -p   a local skill into this project for one agent
+  $ npx get-skill add anthropic/pdf -y --json        non-interactive, machine-readable
+  $ npx get-skill list                               everything installed, project and global
+  $ npx get-skill check                              which installed skills have updates
+  $ npx get-skill update -g                          update your user-level skills
+  $ npx get-skill remove pdf                         remove a skill from every agent
+
+Quality:   lint  scan  rules  init
+Registry:  search  info  add  list  remove  update  check
+Publish:   publish  login  logout
+
+Docs: https://skillmd.com/docs/cli`);
+program.hook("preAction", (thisCmd) => {
+  const opts = thisCmd.opts();
+  if (opts.token && process.stderr.isTTY) {
+    console.error(pc15.yellow("\u26A0 --token is visible in your shell history and process list; prefer `npx get-skill login` or SKILLMD_TOKEN."));
+  }
+});
 program.addCommand(lintCommand());
 program.addCommand(scanCommand());
 program.addCommand(rulesCommand());
@@ -1725,6 +2147,7 @@ program.addCommand(addCommand());
 program.addCommand(listCommand());
 program.addCommand(removeCommand());
 program.addCommand(updateCommand());
+program.addCommand(checkCommand());
 program.addCommand(publishCommand());
 program.addCommand(loginCommand());
 program.addCommand(logoutCommand());