get-skill 1.0.21

package/dist/cli.js

@@ -0,0 +1,1742 @@
+// ../cli/src/index.ts
+import { Command as Command13 } from "commander";
+import { readFileSync as readFileSync4 } from "fs";
+
+// ../cli/src/commands/lint.ts
+import { Command } from "commander";
+import { writeFileSync } from "fs";
+import { homedir } from "os";
+import { resolve } from "path";
+import pc2 from "picocolors";
+import * as p from "@clack/prompts";
+
+// ../../packages/core/src/parse.ts
+import { parse as parseYaml } from "yaml";
+var MAX_SKILL_BYTES = 256 * 1024;
+var MAX_DESCRIPTION = 1024;
+var MAX_NAME = 120;
+var slugify = (s) => String(s).toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "skill";
+function parseSkillMd(raw, type = "single") {
+  if (!raw || raw.length > MAX_SKILL_BYTES) return { error: "SKILL.md missing or too large (max 256KB)" };
+  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+  if (!m) return { error: "Missing YAML frontmatter (--- ... ---)" };
+  let fm;
+  try {
+    fm = parseYaml(m[1] ?? "") ?? {};
+  } catch {
+    return { error: "Invalid YAML frontmatter" };
+  }
+  const name = String(fm.name ?? "").trim();
+  const description = String(fm.description ?? "").replace(/\s+/g, " ").trim();
+  if (!name) return { error: "frontmatter 'name' is required" };
+  if (!description) return { error: "frontmatter 'description' is required" };
+  if (description.length > MAX_DESCRIPTION) return { error: `description must be <= ${MAX_DESCRIPTION} chars` };
+  return {
+    name: name.slice(0, MAX_NAME),
+    description: description.slice(0, MAX_DESCRIPTION),
+    license: fm.license ? String(fm.license).slice(0, 64) : null,
+    body: m[2] ?? "",
+    type
+  };
+}
+
+// ../../packages/core/src/security.ts
+var UNTRUSTED_INSTALL_RE = new RegExp(
+  [
+    /(?:npx|npm|yarn|pnpm|bun)\b[^\n]*--registry[= ]/.source,
+    // custom npm registry
+    /npm\s+config\s+set\s+registry/.source,
+    /pip3?\s+install\b[^\n]*(?:--index-url|--extra-index-url|-i\s+https?:)/.source,
+    // custom pip index
+    /(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|fi)?sh\b/.source,
+    // curl … | sh
+    /(?:iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n|]*\|\s*iex\b/.source,
+    // PowerShell pipe-to-exec
+    /bash\s+<\(\s*(?:curl|wget)/.source,
+    // bash <(curl …)
+    /(?:pip3?|npm|npx)\s+(?:install|--yes|-y)?\s*[^\n]*https?:\/\/(?!registry\.npmjs\.org|pypi\.org|files\.pythonhosted\.org)[^\s'"`]+\.(?:whl|tar\.gz|tgz|zip)\b/.source
+    // install from raw archive URL
+  ].join("|"),
+  "i"
+);
+var RULES = [
+  ["untrusted_install", UNTRUSTED_INSTALL_RE],
+  ["executes_scripts", /```(?:sh|bash|python|py|js|ts|ruby|rb)\b|\b(subprocess|os\.system|child_process|exec\()/i],
+  ["network_calls", /\b(fetch|requests\.|urllib|axios|curl|wget|https?:\/\/|websocket)\b/i],
+  ["reads_secrets", /\b(api[_-]?key|secret|token|password|os\.environ|process\.env|getenv)\b/i]
+];
+function scanSecurity(body) {
+  const findings = [];
+  body.split(/\r?\n/).forEach((text3, i) => {
+    for (const [flag, re] of RULES) {
+      if (re.test(text3)) findings.push({ flag, line: i + 1, snippet: text3.trim().slice(0, 120) });
+    }
+  });
+  const flags = [...new Set(findings.map((f) => f.flag))];
+  return { flags: flags.length ? flags : ["docs_only"], findings };
+}
+
+// ../../packages/core/src/rules.ts
+function utf8Bytes(s) {
+  let bytes = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 128) bytes += 1;
+    else if (c < 2048) bytes += 2;
+    else if (c >= 55296 && c <= 56319) {
+      bytes += 4;
+      i++;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+var diag = (rule, message, line) => ({
+  id: rule.id,
+  severity: rule.severity,
+  message,
+  ...line !== void 0 ? { line } : {}
+});
+var RULES2 = [
+  {
+    id: "SK002",
+    severity: "error",
+    description: "name must be present and \u2264 120 chars",
+    check(s, _ctx) {
+      const out = [];
+      if (!s.name.trim()) out.push(diag(this, "frontmatter 'name' is required"));
+      else if (s.name.length > MAX_NAME) out.push(diag(this, `name must be \u2264 ${MAX_NAME} chars`));
+      return out;
+    }
+  },
+  {
+    id: "SK003",
+    severity: "error",
+    description: "description must be present and \u2264 1024 chars",
+    check(s, _ctx) {
+      const out = [];
+      if (!s.description.trim()) out.push(diag(this, "frontmatter 'description' is required"));
+      else if (s.description.length > MAX_DESCRIPTION) out.push(diag(this, `description must be \u2264 ${MAX_DESCRIPTION} chars`));
+      return out;
+    }
+  },
+  {
+    id: "SK010",
+    severity: "warn",
+    description: "description should be \u2265 20 chars (not too terse)",
+    check(s, _ctx) {
+      return s.description.trim().length > 0 && s.description.trim().length < 20 ? [diag(this, "description is very terse (< 20 chars); add more detail to help discovery")] : [];
+    }
+  },
+  {
+    id: "SK011",
+    severity: "warn",
+    description: "license should be declared in frontmatter",
+    check(s, _ctx) {
+      return s.license ? [] : [diag(this, "no 'license' declared in frontmatter")];
+    }
+  },
+  {
+    id: "SK020",
+    severity: "warn",
+    description: "body should be \u2265 200 chars (not a stub)",
+    check(s, _ctx) {
+      return s.body.trim().length < 200 ? [diag(this, "body is very short (< 200 chars); this looks like a stub")] : [];
+    }
+  },
+  {
+    id: "SK021",
+    severity: "warn",
+    description: "body should contain at least one Markdown heading",
+    check(s, _ctx) {
+      return /^#{1,6}\s/m.test(s.body) ? [] : [diag(this, "body has no Markdown headings; add structure with '#' headings")];
+    }
+  },
+  {
+    id: "SK030",
+    severity: "error",
+    description: "total SKILL.md size must be \u2264 256KB",
+    check(s, _ctx) {
+      return utf8Bytes(s.body) > MAX_SKILL_BYTES ? [diag(this, "SKILL.md exceeds 256KB")] : [];
+    }
+  },
+  {
+    id: "SK040",
+    severity: "warn",
+    description: "name should match its directory/slug",
+    check(s, ctx) {
+      if (!ctx.slug) return [];
+      const expected = slugify(s.name);
+      return expected === ctx.slug ? [] : [diag(this, `name slug '${expected}' does not match directory '${ctx.slug}'`)];
+    }
+  }
+];
+function runRules(skill, ctx = {}) {
+  return RULES2.flatMap((r) => r.check(skill, ctx));
+}
+
+// ../../packages/core/src/quality.ts
+var WEIGHT = {
+  error: 30,
+  warn: 10,
+  info: 3
+};
+var RISK = {
+  docs_only: 0,
+  reads_secrets: 2,
+  network_calls: 1,
+  executes_scripts: 5,
+  // fetch-and-execute from a non-standard source — the supply-chain pattern the
+  // AI verdict floors to "warning"; the heaviest penalty here for the same reason
+  untrusted_install: 15
+};
+var VERIFIED_FLOOR = 85;
+function qualityScore(diagnostics, security, opts = {}) {
+  let penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+  if (security) {
+    for (const flag of security.flags) penalty += RISK[flag] ?? 0;
+  }
+  const score = Math.max(0, Math.min(100, 100 - penalty));
+  const hasError = diagnostics.some((d) => d.severity === "error");
+  return opts.verified && !hasError ? Math.max(score, VERIFIED_FLOOR) : score;
+}
+
+// ../../packages/core/src/lint.ts
+function lint(raw, opts = {}) {
+  const parsed = parseSkillMd(raw, opts.type ?? "single");
+  if ("error" in parsed) {
+    const diagnostics2 = [{ id: "SK001", severity: "error", message: parsed.error }];
+    const security2 = scanSecurity(raw);
+    return {
+      ok: false,
+      diagnostics: diagnostics2,
+      security: security2,
+      score: qualityScore(diagnostics2, security2, { verified: opts.verified })
+    };
+  }
+  const ctx = opts.slug !== void 0 ? { slug: opts.slug } : {};
+  const diagnostics = runRules(parsed, ctx);
+  const security = scanSecurity(parsed.body);
+  const ok = !diagnostics.some((d) => d.severity === "error");
+  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics, security, { verified: opts.verified }) };
+}
+
+// ../../packages/core/src/format/text.ts
+var BADGE = { error: "ERROR", warn: " WARN", info: " INFO" };
+function toText(results, opts = {}) {
+  const paint = opts.decorate ?? ((t) => t);
+  const out = [];
+  for (const { file, result } of results) {
+    const status = result.ok ? paint("PASS", "ok") : paint("FAIL", "error");
+    out.push(`${status}  ${file}  ${paint(`score ${result.score}/100`, "dim")}`);
+    for (const d of result.diagnostics) {
+      const where = d.line !== void 0 ? `:${d.line}` : "";
+      out.push(`  ${paint(BADGE[d.severity], d.severity)}  ${d.id}${where}  ${d.message}`);
+    }
+    if (result.security.flags.length && result.security.flags[0] !== "docs_only") {
+      out.push(`  ${paint("SEC ", "warn")}  flags: ${result.security.flags.join(", ")}`);
+    }
+    out.push("");
+  }
+  const failed = results.filter((r) => !r.result.ok).length;
+  const summary = failed === 0 ? paint(`\u2713 ${results.length} skill(s) passed`, "ok") : paint(`\u2717 ${failed}/${results.length} skill(s) failed`, "error");
+  out.push(summary);
+  return out.join("\n");
+}
+
+// ../../packages/core/src/format/json.ts
+function toJson(results) {
+  return results.map(({ file, result }) => ({
+    file,
+    ok: result.ok,
+    score: result.score,
+    diagnostics: result.diagnostics,
+    security: result.security
+  }));
+}
+
+// ../../packages/core/src/format/sarif.ts
+var SARIF_LEVEL = { error: "error", warn: "warning", info: "note" };
+function toSarif(results) {
+  const sarifResults = results.flatMap(
+    ({ file, result }) => result.diagnostics.map((d) => ({
+      ruleId: d.id,
+      level: SARIF_LEVEL[d.severity] ?? "note",
+      message: { text: d.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: file },
+            region: { startLine: d.line ?? 1 }
+          }
+        }
+      ]
+    }))
+  );
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "skillmd",
+            informationUri: "https://skillmd.com",
+            rules: RULES2.map((r) => ({
+              id: r.id,
+              shortDescription: { text: r.description },
+              defaultConfiguration: { level: SARIF_LEVEL[r.severity] ?? "note" }
+            }))
+          }
+        },
+        results: sarifResults
+      }
+    ]
+  };
+}
+
+// ../../packages/core/src/format/github.ts
+var LEVEL = { error: "error", warn: "warning", info: "notice" };
+function toGithub(results) {
+  const lines = [];
+  for (const { file, result } of results) {
+    for (const d of result.diagnostics) {
+      const level = LEVEL[d.severity] ?? "notice";
+      const loc = d.line !== void 0 ? `,line=${d.line}` : "";
+      lines.push(`::${level} file=${file}${loc},title=${d.id}::${d.message}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// ../cli/src/source.ts
+import { existsSync, statSync, lstatSync, readFileSync, readdirSync, mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join, basename, dirname, relative, sep } from "path";
+var IGNORE_DIRS = /* @__PURE__ */ new Set([
+  // build/dependency dirs
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "out",
+  ".next",
+  ".wrangler",
+  ".cache",
+  ".npm",
+  ".pnpm-store",
+  ".venv",
+  "venv",
+  "__pycache__",
+  "target",
+  "vendor",
+  // large OS / user dirs (mostly relevant when run from a home directory)
+  "AppData",
+  "Library",
+  "$Recycle.Bin",
+  "System Volume Information",
+  "Windows",
+  "Program Files"
+]);
+var MAX_DEPTH = 12;
+function findSkillFiles(dir, depth = 0) {
+  const out = [];
+  if (depth > MAX_DEPTH) return out;
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IGNORE_DIRS.has(entry.name)) continue;
+      out.push(...findSkillFiles(join(dir, entry.name), depth + 1));
+    } else if (entry.name === "SKILL.md") {
+      out.push(join(dir, entry.name));
+    }
+  }
+  return out;
+}
+function loadLocal(file) {
+  return { path: file, raw: readFileSync(file, "utf8"), slug: basename(dirname(file)), file };
+}
+function isLikelyLocal(arg) {
+  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync(arg);
+}
+async function resolveSource(arg) {
+  if (isLikelyLocal(arg)) {
+    if (!existsSync(arg)) throw new Error(`Path not found: ${arg}`);
+    const st = statSync(arg);
+    if (st.isFile()) return [loadLocal(arg)];
+    const files2 = findSkillFiles(arg);
+    if (files2.length === 0) {
+      throw new Error(`No SKILL.md found under ${arg}. Point at a skill directory, e.g. "skillmd lint ./my-skill", or run "skillmd init" to create one.`);
+    }
+    return files2.map(loadLocal);
+  }
+  const { downloadTemplate } = await import("giget");
+  const input = normalizeGiget(arg);
+  const dir = mkdtempSync(join(tmpdir(), "skillmd-src-"));
+  const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
+  const files = findSkillFiles(out);
+  if (files.length === 0) throw new Error(`No SKILL.md found in ${arg}`);
+  return files.map(loadLocal);
+}
+var MAX_PACK_FILES = 200;
+var MAX_PACK_BYTES = 20 * 1024 * 1024;
+function collectFiles(root, dir, limits = {}) {
+  const maxFiles = limits.maxFiles ?? MAX_PACK_FILES;
+  const maxBytes = limits.maxBytes ?? MAX_PACK_BYTES;
+  const out = [];
+  let bytes = 0;
+  const walk = (d, depth) => {
+    if (depth > MAX_DEPTH) return;
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      const fp = join(d, entry.name);
+      const st = lstatSync(fp);
+      if (st.isSymbolicLink()) continue;
+      if (st.isDirectory()) {
+        if (entry.name === ".git" || entry.name === "node_modules") continue;
+        walk(fp, depth + 1);
+      } else if (st.isFile()) {
+        if (out.length >= maxFiles) throw new Error(`pack too large: > ${maxFiles} files`);
+        bytes += st.size;
+        if (bytes > maxBytes) throw new Error(`pack too large: > ${Math.round(maxBytes / (1024 * 1024))}MB`);
+        out.push({ path: relative(root, fp).split(sep).join("/"), contents: readFileSync(fp) });
+      }
+    }
+  };
+  walk(dir, 0);
+  return out;
+}
+async function resolveTree(sourceUrl, ref) {
+  const { downloadTemplate } = await import("giget");
+  const input = normalizeGiget(sourceUrl) + (ref ? `#${ref}` : "");
+  const dir = mkdtempSync(join(tmpdir(), "skillmd-pack-"));
+  try {
+    const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
+    return collectFiles(out, out);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+function normalizeGiget(arg) {
+  const m = arg.match(/github\.com\/([^/]+)\/([^/]+)(?:\/tree\/[^/]+\/(.+))?/);
+  if (m) return `github:${m[1]}/${m[2]}${m[3] ? "/" + m[3] : ""}`;
+  if (arg.startsWith("github:") || arg.startsWith("gh:")) return arg;
+  return `github:${arg}`;
+}
+
+// ../cli/src/ui.ts
+import pc from "picocolors";
+var decorate = (text3, kind) => {
+  switch (kind) {
+    case "error":
+      return pc.red(text3);
+    case "warn":
+      return pc.yellow(text3);
+    case "info":
+      return pc.cyan(text3);
+    case "ok":
+      return pc.green(text3);
+    case "dim":
+      return pc.dim(text3);
+  }
+};
+var SEV_COLOR = {
+  error: pc.red,
+  warn: pc.yellow,
+  info: pc.cyan
+};
+var GLYPH = {
+  error: "\u2716",
+  warn: "\u26A0",
+  info: "\u2139"
+};
+var SEC_GLYPH = "\u2691";
+var SEV_ORDER = ["error", "warn", "info"];
+function chips(result) {
+  const bySev = { error: [], warn: [], info: [] };
+  for (const d of result.diagnostics) bySev[d.severity].push(d.id);
+  return SEV_ORDER.filter((s) => bySev[s].length).map((s) => `${GLYPH[s]} ${SEV_COLOR[s](bySev[s].join(" "))}`).join("   ");
+}
+var SEC_LABEL = {
+  network_calls: "Calls Network",
+  executes_scripts: "Executes Scripts",
+  reads_secrets: "Reads Secrets"
+};
+var titleCase = (flag) => flag.split("_").map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
+var scoreColor = (s) => s >= 80 ? pc.green : s >= 50 ? pc.yellow : pc.red;
+function label(file) {
+  const parts = file.split(/[\\/]/).filter(Boolean);
+  const i = parts.lastIndexOf("SKILL.md");
+  return i > 0 ? parts[i - 1] : parts[parts.length - 1] || file;
+}
+function securityFlags(result) {
+  return result.security.flags.filter((f) => f !== "docs_only");
+}
+function secLabels(result) {
+  const flags = securityFlags(result);
+  return flags.map((f) => pc.magenta(`${SEC_GLYPH} ${SEC_LABEL[f] ?? titleCase(f)}`)).join("  ");
+}
+function statusDot(result) {
+  if (!result.ok) return pc.red("\u25CF");
+  const attention = result.diagnostics.some((d) => d.severity === "warn") || securityFlags(result).length > 0;
+  return attention ? pc.yellow("\u25CF") : pc.green("\u25CF");
+}
+function failureBlock(file, result) {
+  const lines = [`${pc.red("\u2716")} ${pc.bold(label(file))}`];
+  for (const d of result.diagnostics.filter((x) => x.severity === "error")) {
+    const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
+    lines.push(`    ${SEV_COLOR.error(d.id)}${loc}  ${d.message}`);
+  }
+  lines.push(`    ${pc.dim(file)}`);
+  return lines.join("\n");
+}
+function renderOne(file, result) {
+  const status = result.ok ? pc.green("\u25CF PASS") : pc.red("\u25CF FAIL");
+  const out = [`${status}  ${pc.bold(label(file))}  ${pc.dim("quality")} ${scoreColor(result.score)(`${result.score}/100`)}`];
+  for (const d of result.diagnostics) {
+    const loc = d.line !== void 0 ? pc.dim(`:${d.line}`) : "";
+    out.push(`  ${GLYPH[d.severity]} ${SEV_COLOR[d.severity](d.id)}${loc}  ${d.message}`);
+  }
+  const sec = secLabels(result);
+  if (sec) out.push(`  ${sec}`);
+  return out.join("\n");
+}
+function renderMany(results) {
+  const names = results.map((r) => label(r.file));
+  const w = Math.min(32, Math.max(4, ...names.map((n) => n.length)));
+  const out = [];
+  let anySec = false;
+  results.forEach(({ result }, i) => {
+    const score = scoreColor(result.score)(String(result.score).padStart(3));
+    const nm = names[i];
+    const name = (nm.length > w ? nm.slice(0, w - 1) + "\u2026" : nm).padEnd(w);
+    const secStr = secLabels(result);
+    if (secStr) anySec = true;
+    const sec = secStr ? `   ${secStr}` : "";
+    out.push(`${statusDot(result)} ${score}  ${name}  ${chips(result)}${sec}`.trimEnd());
+  });
+  const failed = results.filter((r) => !r.result.ok).length;
+  const warned = results.filter((r) => r.result.ok && r.result.diagnostics.some((d) => d.severity === "warn")).length;
+  const clean = results.length - failed - warned;
+  const avg = Math.round(results.reduce((s, r) => s + r.result.score, 0) / results.length);
+  out.push("");
+  const parts = [pc.green(`${clean} clean`)];
+  if (warned) parts.push(pc.yellow(`${warned} warn`));
+  if (failed) parts.push(pc.red(`${failed} fail`));
+  out.push(`${parts.join(pc.dim(" \xB7 "))}   ${pc.dim("avg score")} ${scoreColor(avg)(`${avg}/100`)}`);
+  if (anySec) out.push(pc.dim(`${SEC_GLYPH} = risky behaviour, factored into the score alongside spec correctness and completeness`));
+  const fails = results.filter((r) => !r.result.ok);
+  if (fails.length) {
+    out.push("");
+    out.push(pc.red(pc.bold(`Failed (${fails.length}):`)));
+    for (const f of fails.slice(0, 25)) out.push(failureBlock(f.file, f.result));
+    if (fails.length > 25) out.push(pc.dim(`  \u2026and ${fails.length - 25} more \u2014 run with --errors-only to see all`));
+  }
+  return out.join("\n");
+}
+function renderFailuresView(results) {
+  const fails = results.filter((r) => !r.result.ok);
+  if (!fails.length) return pc.green(`\u2713 No failures across ${results.length} skill${results.length === 1 ? "" : "s"}.`);
+  const out = fails.map((f) => failureBlock(f.file, f.result));
+  out.push("");
+  out.push(`${pc.red(`${fails.length} failed`)} ${pc.dim(`of ${results.length}`)}`);
+  return out.join("\n");
+}
+function renderReport(results, opts = {}) {
+  if (results.length === 0) return pc.dim("No skills found.");
+  if (opts.errorsOnly) return renderFailuresView(results);
+  if (results.length === 1) return renderOne(results[0].file, results[0].result);
+  return renderMany(results);
+}
+function exitCodeFor(results, policy = {}) {
+  for (const { result } of results) {
+    const hasError = result.diagnostics.some((d) => d.severity === "error");
+    const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
+    if (hasError) return 1;
+    if ((policy.strict || policy.failOnWarning) && hasWarn) return 1;
+  }
+  return 0;
+}
+
+// ../cli/src/commands/lint.ts
+function applyLicenseFix(raw) {
+  if (/^---[\s\S]*?\blicense:\s*\S+[\s\S]*?^---/m.test(raw)) return null;
+  const m = raw.match(/^(---\r?\n)([\s\S]*?)(\r?\n---)/);
+  if (!m) return null;
+  return `${m[1]}${m[2]}
+license: UNKNOWN${m[3]}${raw.slice(m[0].length)}`;
+}
+async function runLint(target, flags) {
+  let resolved = await resolveSource(target);
+  if (flags.fix) {
+    resolved = resolved.map((r) => {
+      if (!r.file) return r;
+      const fixed = applyLicenseFix(r.raw);
+      if (fixed) {
+        writeFileSync(r.file, fixed, "utf8");
+        return { ...r, raw: fixed };
+      }
+      return r;
+    });
+  }
+  const results = resolved.map((r) => ({ file: r.path, result: lint(r.raw, { slug: r.slug }), resolved: r }));
+  const exitCode = exitCodeFor(results, flags);
+  let output;
+  switch (flags.format) {
+    case "json":
+      output = JSON.stringify(toJson(results), null, 2);
+      break;
+    case "sarif":
+      output = JSON.stringify(toSarif(results), null, 2);
+      break;
+    case "github":
+      output = toGithub(results);
+      break;
+    default:
+      output = renderReport(results, { errorsOnly: flags.errorsOnly });
+  }
+  return { results, output, exitCode };
+}
+function lintCommand() {
+  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").option("--errors-only", "show only skills that failed").action(async (target, opts) => {
+    const ui = Boolean(process.stdout.isTTY) && opts.format === "text";
+    if (resolve(target) === homedir()) {
+      process.stderr.write(pc2.yellow(`Warning: scanning your entire home directory. Pass a narrower path, e.g. skillmd lint ./my-skill
+`));
+    }
+    if (ui) {
+      p.intro(pc2.bgCyan(pc2.black(" skillmd lint ")));
+      const s = p.spinner();
+      s.start(`Scanning ${target}`);
+      try {
+        const run2 = await runLint(target, opts);
+        s.stop(`Scanned ${run2.results.length} skill${run2.results.length === 1 ? "" : "s"}`);
+        console.log(run2.output);
+        const failed = run2.results.filter((r) => !r.result.ok).length;
+        p.outro(failed === 0 ? pc2.green("All good") : pc2.red(`${failed} skill${failed === 1 ? "" : "s"} failed \u2014 details above`));
+        process.exitCode = run2.exitCode;
+      } catch (err) {
+        s.stop(pc2.red("No skills found"));
+        p.outro(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+      }
+      return;
+    }
+    process.stderr.write(`Looking for SKILL.md under ${target} \u2026
+`);
+    const run = await runLint(target, opts);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/scan.ts
+import { Command as Command2 } from "commander";
+import pc3 from "picocolors";
+async function runScan(target, flags) {
+  const resolved = await resolveSource(target);
+  const deny = new Set(flags.deny ?? []);
+  const entries = resolved.map((r) => {
+    const parsed = parseSkillMd(r.raw, "single");
+    const body = "error" in parsed ? r.raw : parsed.body;
+    const security = scanSecurity(body);
+    const denied = security.flags.filter((f) => deny.has(f));
+    return { file: r.path, security, denied };
+  });
+  const exitCode = entries.some((e) => e.denied.length > 0) ? 1 : 0;
+  let output;
+  if (flags.format === "json") {
+    output = JSON.stringify(entries, null, 2);
+  } else {
+    const lines = [];
+    for (const e of entries) {
+      const flagStr = e.security.flags.join(", ");
+      const head = e.denied.length ? pc3.red(`DENY ${e.file}`) : pc3.green(`OK   ${e.file}`);
+      lines.push(`${head}  ${pc3.dim(flagStr)}`);
+      for (const f of e.security.findings) {
+        const mark = deny.has(f.flag) ? pc3.red(f.flag) : pc3.yellow(f.flag);
+        lines.push(`  ${mark}  :${f.line}  ${pc3.dim(f.snippet)}`);
+      }
+    }
+    output = lines.join("\n");
+  }
+  return { entries, exitCode, output };
+}
+function scanCommand() {
+  return new Command2("scan").description("Security-scan SKILL.md file(s) for scripts, network calls and secret access").argument("[target]", "local path or GitHub source", ".").option("--deny <flags...>", "exit non-zero if any of these flags are present (e.g. executes_scripts)").option("--format <fmt>", "text | json", "text").action(async (target, opts) => {
+    const run = await runScan(target, opts);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/rules.ts
+import { Command as Command3 } from "commander";
+import pc4 from "picocolors";
+function rulesCommand() {
+  return new Command3("rules").description("List lint rules, or show detail for one rule id").argument("[id]", "a rule id, e.g. SK010").option("--json", "machine-readable output").action((id, opts) => {
+    const list = id ? RULES2.filter((r) => r.id.toLowerCase() === id.toLowerCase()) : RULES2;
+    if (id && list.length === 0) {
+      console.error(`Unknown rule: ${id}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(list.map((r) => ({ id: r.id, severity: r.severity, description: r.description })), null, 2));
+      return;
+    }
+    const badge = (sev) => sev === "error" ? pc4.bgRed(pc4.white(" error ")) : sev === "warn" ? pc4.bgYellow(pc4.black(" warn  ")) : pc4.bgCyan(pc4.black(" info  "));
+    console.log(pc4.bold("\nLint rules\n"));
+    for (const r of list) console.log(`  ${pc4.bold(r.id)}  ${badge(r.severity)}  ${r.description}`);
+    console.log("");
+  });
+}
+
+// ../cli/src/commands/init.ts
+import { Command as Command4 } from "commander";
+import { mkdirSync, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import * as p2 from "@clack/prompts";
+function skillTemplate(name, description, license) {
+  const desc = description.trim() || `A skill that helps agents with ${name}.`;
+  return `---
+name: ${name}
+description: ${desc}
+license: ${license}
+---
+
+# ${name}
+
+## When to use this skill
+
+Describe the situations where an agent should reach for this skill. Be specific
+about the task, the inputs it expects, and the outcome it produces.
+
+## Instructions
+
+1. First step the agent should take.
+2. Second step, with any commands or file paths it needs.
+3. How to verify the result.
+
+## Notes
+
+Add any constraints, edge cases, or references the agent should keep in mind.
+`;
+}
+function initSkill(name, opts = {}) {
+  const slug = slugify(name);
+  const root = join2(opts.dir ?? process.cwd(), slug);
+  if (existsSync2(join2(root, "SKILL.md"))) throw new Error(`SKILL.md already exists at ${root}`);
+  mkdirSync(root, { recursive: true });
+  const file = join2(root, "SKILL.md");
+  writeFileSync2(file, skillTemplate(name, opts.description ?? "", opts.license ?? "MIT"), "utf8");
+  return file;
+}
+function initCommand() {
+  return new Command4("init").description("Scaffold a new SKILL.md from a template").argument("[name]", "skill name").option("--name <name>", "skill name (non-interactive)").option("--description <text>", "skill description").option("--license <license>", "license identifier", "MIT").option("-y, --yes", "skip prompts").action(async (nameArg, opts) => {
+    let name = nameArg ?? opts.name;
+    if (!name && !opts.yes) {
+      const answer = await p2.text({ message: "Skill name?", placeholder: "my-skill" });
+      if (p2.isCancel(answer)) {
+        p2.cancel("Cancelled.");
+        return;
+      }
+      name = answer;
+    }
+    if (!name) {
+      console.error("A skill name is required (pass a name or --name).");
+      process.exitCode = 1;
+      return;
+    }
+    const file = initSkill(name, { description: opts.description, license: opts.license });
+    console.log(`Created ${file}`);
+  });
+}
+
+// ../cli/src/commands/search.ts
+import { Command as Command5 } from "commander";
+import pc5 from "picocolors";
+
+// ../cli/src/api.ts
+import { createHash } from "crypto";
+import { stringify as stringifyYaml } from "yaml";
+
+// ../cli/src/config.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+var DEFAULT_API = "https://api.skillmd.com";
+function configPath() {
+  return join3(homedir2(), ".skillmd", "config.json");
+}
+function readConfig() {
+  try {
+    return JSON.parse(readFileSync2(configPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeConfig(cfg) {
+  const dir = join3(homedir2(), ".skillmd");
+  mkdirSync2(dir, { recursive: true });
+  writeFileSync3(configPath(), JSON.stringify(cfg, null, 2), { encoding: "utf8", mode: 384 });
+}
+function resolveToken(flags = {}) {
+  return flags.token || process.env.SKILLMD_TOKEN || readConfig().token || void 0;
+}
+function resolveApi(flags = {}) {
+  return flags.api || process.env.SKILLMD_API || readConfig().api || DEFAULT_API;
+}
+
+// ../cli/src/api.ts
+var IntegrityError = class extends Error {
+  integrity = true;
+  constructor(message) {
+    super(message);
+    this.name = "IntegrityError";
+  }
+};
+var RegistryError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "RegistryError";
+  }
+  status;
+};
+var ALLOWED_SOURCE_HOSTS = /* @__PURE__ */ new Set(["raw.githubusercontent.com", "gist.githubusercontent.com"]);
+function isAllowedSourceUrl(u) {
+  try {
+    const parsed = new URL(u);
+    return parsed.protocol === "https:" && ALLOWED_SOURCE_HOSTS.has(parsed.hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+function createClient(flags = {}) {
+  const base = resolveApi(flags);
+  const token = resolveToken(flags);
+  async function api(path, init = {}) {
+    const headers = { accept: "application/json", ...init.headers };
+    if (token) headers.authorization = `Bearer ${token}`;
+    let res;
+    try {
+      res = await fetch(base + path, { ...init, headers });
+    } catch (e) {
+      const cause = e instanceof Error ? e.cause?.message ?? e.message : String(e);
+      throw new RegistryError(`could not reach ${base}: ${cause}`);
+    }
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new RegistryError(`SkillMD API ${res.status} on ${path}: ${detail}`, res.status);
+    }
+    return await res.json();
+  }
+  return { api, base, token, hasToken: Boolean(token) };
+}
+async function fetchBundle(base, slug, token) {
+  const headers = { accept: "application/json" };
+  if (token) headers.authorization = `Bearer ${token}`;
+  const res = await fetch(`${base}/api/skills/${slug}/bundle?format=json`, { headers }).catch(() => null);
+  if (!res || !res.ok) return null;
+  const data = await res.json().catch(() => null);
+  if (!data?.files) return null;
+  const out = [];
+  for (const f of data.files) {
+    if (f.content_base64 != null) {
+      const contents = Buffer.from(f.content_base64, "base64");
+      if (f.sha256) {
+        const got = createHash("sha256").update(contents).digest("hex");
+        if (got !== f.sha256) {
+          throw new IntegrityError(`integrity check failed for "${f.path}" (expected ${f.sha256.slice(0, 12)}\u2026, got ${got.slice(0, 12)}\u2026)`);
+        }
+      }
+      out.push({ path: f.path, contents });
+    } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
+      const r = await fetch(f.source_url).catch(() => null);
+      if (r && r.ok) out.push({ path: f.path, contents: Buffer.from(await r.arrayBuffer()) });
+    }
+  }
+  return out;
+}
+function skillMdFor(skill) {
+  if (skill.raw_md) {
+    return hasFrontmatter(skill.raw_md) ? skill.raw_md : reconstructSkillMd({ ...skill, body_md: skill.raw_md });
+  }
+  return reconstructSkillMd(skill);
+}
+function hasFrontmatter(md) {
+  return /^\uFEFF?\s*---\r?\n/.test(md);
+}
+function reconstructSkillMd(skill) {
+  const name = skill.slug.split("/")[1] || skill.title;
+  const fm = { name, description: String(skill.description).replace(/\n/g, " ") };
+  if (skill.license) fm.license = skill.license;
+  return `---
+${stringifyYaml(fm)}---
+${skill.body_md || ""}`;
+}
+
+// ../cli/src/commands/search.ts
+var MAX_LINE_WIDTH = 100;
+function formatStars(n) {
+  if (n >= 1e6) {
+    const m = Math.round(n / 1e6 * 10) / 10;
+    return `${m % 1 === 0 ? m.toFixed(0) : m.toFixed(1)}M`;
+  }
+  if (n >= 1e3) {
+    const k = Math.round(n / 1e3 * 10) / 10;
+    return `${k % 1 === 0 ? k.toFixed(0) : k.toFixed(1)}k`;
+  }
+  return String(n);
+}
+function truncate(text3, width) {
+  if (text3.length <= width) return text3;
+  if (width <= 1) return "\u2026";
+  return `${text3.slice(0, width - 1).trimEnd()}\u2026`;
+}
+function formatSearchResult(item, width = process.stdout.columns ?? 80) {
+  const stars = item.repo_stars != null ? pc5.dim(`\u2605 ${formatStars(item.repo_stars)}`) : "";
+  const check = item.verified ? pc5.green("\u2713") : "";
+  const pack = item.type === "pack" ? pc5.dim("[pack]") : "";
+  const head = [pc5.bold(item.slug), stars, check, pack].filter(Boolean).join(" ");
+  const indent = "  ";
+  const lineWidth = Math.max(10, Math.min(width, MAX_LINE_WIDTH) - indent.length);
+  const desc = `${indent}${pc5.dim(truncate(item.description ?? "", lineWidth))}`;
+  return `${head}
+${desc}`;
+}
+async function runSearch(query, flags) {
+  const { api } = createClient(flags);
+  const params = new URLSearchParams({ q: query, limit: String(flags.limit ?? 20) });
+  if (flags.category) params.set("category", flags.category);
+  if (flags.verified) params.set("verified", "true");
+  if (flags.type) params.set("type", flags.type);
+  if (flags.minRating != null) params.set("min_rating", String(flags.minRating));
+  const r = await api(`/api/search?${params}`);
+  const items = r.items ?? [];
+  if (flags.json) return { items, output: JSON.stringify(items, null, 2) };
+  const lines = items.map((s) => formatSearchResult(s));
+  return { items, output: lines.join("\n\n") || "No skills found." };
+}
+function searchCommand() {
+  return new Command5("search").description("Search the SkillMD registry").argument("<query>", "search terms").option("--category <slug>", "filter by category").option("--verified", "only verified skills").option("--type <type>", "single | pack").option("--min-rating <n>", "minimum average rating (0-5)").option("--limit <n>", "max results", "20").option("--json", "machine-readable output").action(async (query, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runSearch(query, merged);
+    console.log(run.output);
+  });
+}
+
+// ../cli/src/commands/info.ts
+import { Command as Command6 } from "commander";
+import pc6 from "picocolors";
+async function runInfo(slug, flags) {
+  const [owner, name] = slug.split("/");
+  if (!owner || !name || slug.split("/").length !== 2) {
+    return { ok: false, exitCode: 1, output: pc6.red("Expected owner/name, e.g. anthropic/pdf") };
+  }
+  const { api } = createClient(flags);
+  let s;
+  try {
+    s = await api(`/api/skills/${owner}/${name}`);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/^SkillMD API 404 /.test(message)) {
+      return { ok: false, exitCode: 1, output: pc6.red(`Skill not found on the registry: ${slug}`) };
+    }
+    return { ok: false, exitCode: 1, output: pc6.red(`Could not reach the SkillMD registry: ${message}`) };
+  }
+  if (flags.json) return { ok: true, exitCode: 0, output: JSON.stringify(s, null, 2), skill: s };
+  const lines = [];
+  lines.push(
+    `${pc6.bold(s.slug)} ${pc6.dim(`[${s.type ?? "single"}]`)} ${s.verified ? pc6.green("\u2713 verified") : pc6.yellow("unverified")}`
+  );
+  lines.push(`  ${s.description}`);
+  lines.push(
+    pc6.dim(
+      `  category: ${s.category ?? "-"} \xB7 rating: ${s.avg_rating != null ? s.avg_rating.toFixed(1) : "-"} (${s.rating_count ?? 0}) \xB7 installs: ${s.install_count ?? 0}`
+    )
+  );
+  lines.push(
+    pc6.dim(`  security: ${(s.security_flags ?? []).join(", ") || "unscanned"} \xB7 license: ${s.provenance?.license ?? s.license ?? "unknown"}`)
+  );
+  const sourceRepo = s.provenance?.source_repo ?? s.source_repo;
+  const commitSha = s.provenance?.commit_sha ?? s.commit_sha;
+  if (sourceRepo) lines.push(pc6.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
+  lines.push(pc6.dim(`  page: https://skillmd.com/skills/${s.slug}`));
+  lines.push(pc6.dim(`  install: ${s.install?.cli ?? `npx skillmds add ${s.slug}`}`));
+  return { ok: true, exitCode: 0, output: lines.join("\n"), skill: s };
+}
+function infoCommand() {
+  return new Command6("info").description("Show registry details for a skill: verification, security flags, provenance, rating").argument("<slug>", "owner/name, e.g. anthropic/pdf").action(async (slug, _opts, cmd) => {
+    const flags = { ...cmd.parent?.opts() };
+    const run = await runInfo(slug, flags);
+    if (run.output) (run.ok ? console.log : console.error)(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/add.ts
+import { Command as Command7, Option } from "commander";
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import * as p3 from "@clack/prompts";
+import { join as join5, relative as relative2, resolve as resolve3 } from "path";
+import pc7 from "picocolors";
+
+// ../cli/src/agents.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync as rmSync2, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join4, resolve as resolve2, dirname as dirname2, sep as sep2 } from "path";
+var AGENTS = [
+  { id: "claude-code", project: [".claude", "skills"], global: [".claude", "skills"], detect: [[".claude"]] },
+  { id: "cursor", project: [".cursor", "skills"], global: [".cursor", "skills"], detect: [[".cursor"]] },
+  { id: "codex", project: [".codex", "skills"], global: [".codex", "skills"], detect: [[".codex"]] },
+  { id: "windsurf", project: [".windsurf", "skills"], global: [".codeium", "windsurf", "skills"], detect: [[".codeium", "windsurf"], [".windsurf"]] },
+  { id: "opencode", project: [".opencode", "skills"], global: [".config", "opencode", "skills"], detect: [[".config", "opencode"], [".opencode"]] },
+  { id: "gemini-cli", project: [".agents", "skills"], global: [".gemini", "skills"], detect: [[".gemini"]] },
+  { id: "antigravity", project: [".agents", "skills"], global: [".gemini", "antigravity", "skills"], detect: [[".gemini", "antigravity"], [".antigravity"]] },
+  { id: "kiro", project: [".kiro", "skills"], global: [".kiro", "skills"], detect: [[".kiro"]] },
+  { id: "warp", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".warp"]] },
+  { id: "github-copilot", project: [".agents", "skills"], global: [".copilot", "skills"], detect: [[".copilot"]] },
+  { id: "cline", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".cline"]] },
+  { id: "roo", project: [".roo", "skills"], global: [".roo", "skills"], detect: [[".roo"]] },
+  { id: "goose", project: [".goose", "skills"], global: [".config", "goose", "skills"], detect: [[".config", "goose"]] },
+  { id: "trae", project: [".trae", "skills"], global: [".trae", "skills"], detect: [[".trae"]] },
+  { id: "qwen-code", project: [".qwen", "skills"], global: [".qwen", "skills"], detect: [[".qwen"]] },
+  { id: "amp", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".config", "amp"]] },
+  // — extended registry —
+  { id: "openclaw", project: ["skills"], global: [".openclaw", "skills"], detect: [[".openclaw"], [".clawdbot"], [".moltbot"]] },
+  { id: "kilo", project: [".kilocode", "skills"], global: [".kilocode", "skills"], detect: [[".kilocode"]] },
+  { id: "hermes-agent", project: [".hermes", "skills"], global: [".hermes", "skills"], detect: [[".hermes"]] },
+  { id: "continue", project: [".continue", "skills"], global: [".continue", "skills"], detect: [[".continue"]] },
+  { id: "devin", project: [".devin", "skills"], global: [".config", "devin", "skills"], detect: [[".config", "devin"]] },
+  { id: "openhands", project: [".openhands", "skills"], global: [".openhands", "skills"], detect: [[".openhands"]] },
+  { id: "replit", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".replit"]] },
+  { id: "mistral-vibe", project: [".vibe", "skills"], global: [".vibe", "skills"], detect: [[".vibe"]] },
+  { id: "zed", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".config", "zed"]] },
+  { id: "adal", project: [".adal", "skills"], global: [".adal", "skills"], detect: [[".adal"]] },
+  { id: "aider-desk", project: [".aider-desk", "skills"], global: [".aider-desk", "skills"], detect: [[".aider-desk"]] },
+  { id: "antigravity-cli", project: [".agents", "skills"], global: [".gemini", "antigravity-cli", "skills"], detect: [[".gemini", "antigravity-cli"]] },
+  { id: "augment", project: [".augment", "skills"], global: [".augment", "skills"], detect: [[".augment"]] },
+  { id: "autohand-code", project: [".autohand", "skills"], global: [".autohand", "skills"], detect: [[".autohand"]] },
+  { id: "bob", project: [".bob", "skills"], global: [".bob", "skills"], detect: [[".bob"]] },
+  { id: "codearts-agent", project: [".codeartsdoer", "skills"], global: [".codeartsdoer", "skills"], detect: [[".codeartsdoer"]] },
+  { id: "codebuddy", project: [".codebuddy", "skills"], global: [".codebuddy", "skills"], detect: [[".codebuddy"]] },
+  { id: "codemaker", project: [".codemaker", "skills"], global: [".codemaker", "skills"], detect: [[".codemaker"]] },
+  { id: "codestudio", project: [".codestudio", "skills"], global: [".codestudio", "skills"], detect: [[".codestudio"]] },
+  { id: "command-code", project: [".commandcode", "skills"], global: [".commandcode", "skills"], detect: [[".commandcode"]] },
+  { id: "cortex", project: [".cortex", "skills"], global: [".snowflake", "cortex", "skills"], detect: [[".snowflake", "cortex"]] },
+  { id: "crush", project: [".crush", "skills"], global: [".config", "crush", "skills"], detect: [[".config", "crush"]] },
+  { id: "deepagents", project: [".agents", "skills"], global: [".deepagents", "agent", "skills"], detect: [[".deepagents"]] },
+  { id: "dexto", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".dexto"]] },
+  { id: "droid", project: [".factory", "skills"], global: [".factory", "skills"], detect: [[".factory"]] },
+  { id: "firebender", project: [".agents", "skills"], global: [".firebender", "skills"], detect: [[".firebender"]] },
+  { id: "forgecode", project: [".forge", "skills"], global: [".forge", "skills"], detect: [[".forge"]] },
+  { id: "iflow-cli", project: [".iflow", "skills"], global: [".iflow", "skills"], detect: [[".iflow"]] },
+  { id: "inference-sh", project: [".inferencesh", "skills"], global: [".inferencesh", "skills"], detect: [[".inferencesh"]] },
+  { id: "jazz", project: [".jazz", "skills"], global: [".jazz", "skills"], detect: [[".jazz"]] },
+  { id: "junie", project: [".junie", "skills"], global: [".junie", "skills"], detect: [[".junie"]] },
+  { id: "kimi-code-cli", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".kimi-code"], [".kimi"]] },
+  { id: "kode", project: [".kode", "skills"], global: [".kode", "skills"], detect: [[".kode"]] },
+  { id: "lingma", project: [".lingma", "skills"], global: [".lingma", "skills"], detect: [[".lingma"]] },
+  { id: "loaf", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".loaf"]] },
+  { id: "mcpjam", project: [".mcpjam", "skills"], global: [".mcpjam", "skills"], detect: [[".mcpjam"]] },
+  { id: "moxby", project: [".moxby", "skills"], global: [".moxby", "skills"], detect: [[".moxby"]] },
+  { id: "mux", project: [".mux", "skills"], global: [".mux", "skills"], detect: [[".mux"]] },
+  { id: "neovate", project: [".neovate", "skills"], global: [".neovate", "skills"], detect: [[".neovate"]] },
+  { id: "ona", project: [".ona", "skills"], global: [".ona", "skills"], detect: [[".ona"]] },
+  { id: "pi", project: [".pi", "skills"], global: [".pi", "agent", "skills"], detect: [[".pi", "agent"]] },
+  { id: "pochi", project: [".pochi", "skills"], global: [".pochi", "skills"], detect: [[".pochi"]] },
+  { id: "qoder", project: [".qoder", "skills"], global: [".qoder", "skills"], detect: [[".qoder"]] },
+  { id: "qoder-cn", project: [".qoder", "skills"], global: [".qoder-cn", "skills"], detect: [[".qoder-cn"]] },
+  { id: "reasonix", project: [".reasonix", "skills"], global: [".reasonix", "skills"], detect: [[".reasonix"]] },
+  { id: "rovodev", project: [".rovodev", "skills"], global: [".rovodev", "skills"], detect: [[".rovodev"]] },
+  { id: "tabnine-cli", project: [".tabnine", "agent", "skills"], global: [".tabnine", "agent", "skills"], detect: [[".tabnine"]] },
+  { id: "terramind", project: [".terramind", "skills"], global: [".terramind", "skills"], detect: [[".terramind"]] },
+  { id: "tinycloud", project: [".tinycloud", "skills"], global: [".tinycloud", "skills"], detect: [[".tinycloud"]] },
+  { id: "trae-cn", project: [".trae", "skills"], global: [".trae-cn", "skills"], detect: [[".trae-cn"]] },
+  { id: "zcode", project: [".zcode", "skills"], global: [".zcode", "skills"], detect: [[".zcode"]] },
+  { id: "zencoder", project: [".zencoder", "skills"], global: [".zencoder", "skills"], detect: [[".zencoder"]] }
+];
+function agentDir(agentId, opts = {}) {
+  const agent = AGENTS.find((a) => a.id === agentId);
+  if (!agent) throw new Error(`Unknown agent: ${agentId}. Known: ${AGENTS.map((a) => a.id).join(", ")}`);
+  return opts.global ? join4(opts.home ?? homedir3(), ...agent.global) : join4(opts.cwd ?? process.cwd(), ...agent.project);
+}
+function detectAgents(opts = {}) {
+  const home = opts.home ?? homedir3();
+  return AGENTS.filter((a) => a.detect.some((d) => existsSync3(join4(home, ...d)))).map((a) => a.id);
+}
+function writeSkill(skillName, files, targetDir, opts = {}) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(skillName) || skillName.includes("..")) {
+    throw new Error(`refused unsafe skill name: "${skillName}"`);
+  }
+  const dest = join4(targetDir, skillName);
+  if (opts.mode === "symlink" && opts.canonicalDir) {
+    mkdirSync3(dirname2(dest), { recursive: true });
+    rmSync2(dest, { recursive: true, force: true });
+    symlinkSync(resolve2(opts.canonicalDir), dest, "dir");
+    return dest;
+  }
+  mkdirSync3(dest, { recursive: true });
+  const root = resolve2(dest);
+  for (const f of files) {
+    const fp = resolve2(dest, f.path);
+    if (fp !== root && !fp.startsWith(root + sep2)) {
+      throw new Error(`refused unsafe path in skill "${skillName}": ${f.path}`);
+    }
+    mkdirSync3(dirname2(fp), { recursive: true });
+    writeFileSync4(fp, f.contents);
+  }
+  return dest;
+}
+function installedSkills(opts = {}) {
+  const scope = opts.global ? "global" : "project";
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const agent of AGENTS) {
+    const dir = agentDir(agent.id, opts);
+    if (seen.has(dir)) continue;
+    seen.add(dir);
+    if (!existsSync3(dir)) continue;
+    for (const entry of readdirSync2(dir)) {
+      const skillMd = join4(dir, entry, "SKILL.md");
+      if (!existsSync3(skillMd) || !statSync2(skillMd).isFile()) continue;
+      out.push({ name: entry, agent: agent.id, scope, path: join4(dir, entry), raw: readFileSync3(skillMd, "utf8") });
+    }
+  }
+  return out;
+}
+
+// ../cli/src/commands/add.ts
+var PROJECT_MARKERS = [".git", "package.json", "pyproject.toml", "Cargo.toml", "go.mod", "AGENTS.md", "CLAUDE.md", "skills-lock.json"];
+function looksLikeProject(dir) {
+  if (PROJECT_MARKERS.some((m) => existsSync4(join5(dir, m)))) return true;
+  const agentRoots = new Set(AGENTS.map((a) => a.project[0]).filter((seg) => seg.startsWith(".")));
+  return [...agentRoots].some((seg) => existsSync4(join5(dir, seg)));
+}
+var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+async function promptScopeInteractive(ctx) {
+  const choice = await p3.select({
+    message: "Installation scope",
+    initialValue: ctx.suggestGlobal,
+    options: [
+      { value: false, label: "Project", hint: `install in ${ctx.cwd} (committed with your project)` },
+      { value: true, label: "Global", hint: "install in your home directory (available across all projects)" }
+    ]
+  });
+  return p3.isCancel(choice) ? null : choice;
+}
+async function promptAgentsInteractive(ctx) {
+  if (ctx.detected.length < 2) return ctx.detected;
+  const picked = await p3.multiselect({
+    message: "Which agents do you want to install to?",
+    options: ctx.detected.map((id) => ({ value: id, label: id, hint: ctx.dirFor(id) })),
+    initialValues: ctx.detected,
+    required: true
+  });
+  return p3.isCancel(picked) ? null : picked;
+}
+function isLocalish(arg) {
+  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync4(arg);
+}
+async function resolvePackFiles(skill, fetchTree = resolveTree) {
+  if (!skill.source_repo) return null;
+  const attempts = [{ ref: skill.commit_sha ?? void 0, pinMiss: false }];
+  if (skill.commit_sha) attempts.push({ ref: void 0, pinMiss: true });
+  for (const attempt of attempts) {
+    try {
+      const files = await fetchTree(skill.source_repo, attempt.ref);
+      const sk = files.find((f) => f.path === "SKILL.md");
+      if (sk) return { raw: sk.contents.toString("utf8"), files, pinMiss: attempt.pinMiss };
+    } catch {
+    }
+  }
+  return null;
+}
+function registryFallbackNote(host) {
+  return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
+}
+function registryUnreachableError(arg, host, e) {
+  const why = e.status ? `HTTP ${e.status}` : "network error";
+  return new Error(
+    `could not reach the SkillMD registry at ${host} (${why}), and "${arg}" was not found on GitHub either.
+If this environment restricts network access (sandbox, proxy, CI), ask an administrator to allow ${host} \u2014 or install through the SkillMD MCP server, which many sandboxed agents can already reach.
+Registry error: ${e.message}`
+  );
+}
+var defaultDeps = {
+  async resolve(arg, flags) {
+    if (isLocalish(arg)) {
+      const rs = await resolveSource(arg);
+      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
+    }
+    let registryDown = null;
+    const registryHost = (() => {
+      try {
+        return new URL(createClient(flags).base).host;
+      } catch {
+        return "api.skillmd.com";
+      }
+    })();
+    if (/^[^/\s:]+\/[^/\s:]+$/.test(arg)) {
+      const { api, base: apiBase, token } = createClient(flags);
+      const [owner, name] = arg.split("/");
+      try {
+        const skill = await api(`/api/skills/${owner}/${name}`);
+        const skillName = skill.slug.split("/")[1] || name;
+        const meta = {
+          name: skillName,
+          slug: skillName,
+          registrySlug: arg,
+          verified: skill.verified,
+          type: skill.type,
+          securityFlags: skill.security_flags
+        };
+        if (skill.type === "pack") {
+          const bundle = await fetchBundle(apiBase, arg, token);
+          if (bundle && bundle.length) {
+            const sk = bundle.find((f) => f.path === "SKILL.md");
+            return [{ ...meta, raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill), files: bundle }];
+          }
+          const pack = await resolvePackFiles(skill);
+          if (pack) return [{ ...meta, ...pack }];
+        }
+        return [{ ...meta, raw: skillMdFor(skill) }];
+      } catch (e) {
+        if (e instanceof IntegrityError) throw e;
+        if (e instanceof RegistryError && e.status !== 404) registryDown = e;
+      }
+    }
+    try {
+      const rs = await resolveSource(arg);
+      const note2 = registryDown ? registryFallbackNote(registryHost) : void 0;
+      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug, note: note2 }));
+    } catch (e) {
+      if (registryDown) throw registryUnreachableError(arg, registryHost, registryDown);
+      throw e;
+    }
+  },
+  get promptScope() {
+    return interactive() ? promptScopeInteractive : void 0;
+  },
+  get promptAgents() {
+    return interactive() ? promptAgentsInteractive : void 0;
+  },
+  fireInstall(registrySlug, flags) {
+    const { api } = createClient(flags);
+    const [owner, name] = registrySlug.split("/");
+    void api(`/api/skills/${owner}/${name}/install`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ via: "cli" })
+    }).catch(() => {
+    });
+  }
+};
+async function resolveScope(flags, deps) {
+  const home = resolve3(flags.home ?? homedir4());
+  const cwd = resolve3(flags.cwd ?? process.cwd());
+  const base = { cwd: flags.cwd, home: flags.home };
+  if (flags.global) return { scope: { global: true, ...base } };
+  if (flags.project) return { scope: { global: false, ...base } };
+  if (cwd === home) return { scope: { global: true, ...base } };
+  const isProject = looksLikeProject(cwd);
+  if (deps.promptScope && !flags.yes && !flags.json) {
+    const global = await deps.promptScope({ cwd, suggestGlobal: !isProject });
+    if (global === null) return null;
+    return { scope: { global, ...base } };
+  }
+  if (isProject) return { scope: { global: false, ...base } };
+  return {
+    scope: { global: true, ...base },
+    note: `no project detected in ${cwd} \u2014 installing to your user-level agent folders (pass --project to install here)`
+  };
+}
+var CANCELLED = { written: [], blocked: [], exitCode: 0, cancelled: true, output: pc7.dim("Installation cancelled \u2014 nothing was installed.") };
+async function runAdd(arg, flags, deps = defaultDeps) {
+  let candidates;
+  try {
+    candidates = await deps.resolve(arg, flags);
+  } catch (e) {
+    if (e instanceof IntegrityError) {
+      return {
+        written: [],
+        blocked: [{ name: arg, reason: e.message }],
+        exitCode: 1,
+        output: pc7.red(`\u2717 ${arg} blocked \u2014 ${e.message}`)
+      };
+    }
+    throw e;
+  }
+  if (flags.skill?.length) candidates = candidates.filter((c) => flags.skill.includes(c.name) || flags.skill.includes("*"));
+  const deny = new Set(flags.deny ?? []);
+  const written = [];
+  const blocked = [];
+  const lines = [];
+  const resolved = await resolveScope(flags, deps);
+  if (!resolved) return CANCELLED;
+  const { scope } = resolved;
+  const isGlobal = scope.global;
+  const home = flags.home ?? homedir4();
+  if (resolved.note) lines.push(pc7.dim(`\u2139 ${resolved.note}`));
+  const detected = detectAgents(scope);
+  let targets = flags.agent?.length ? flags.agent : detected.length ? detected : ["claude-code"];
+  if (!flags.agent?.length && deps.promptAgents && !flags.yes && !flags.json) {
+    const picked = await deps.promptAgents({ detected: targets, dirFor: (id) => agentDir(id, scope) });
+    if (picked === null) return CANCELLED;
+    targets = picked;
+  }
+  const dirAgents = /* @__PURE__ */ new Map();
+  for (const agentId of targets) {
+    const dir = agentDir(agentId, scope);
+    dirAgents.set(dir, [...dirAgents.get(dir) ?? [], agentId]);
+  }
+  for (const c of candidates) {
+    const result = lint(c.raw, { slug: c.slug });
+    const allFlags = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
+    const deniedFlags = allFlags.filter((f) => deny.has(f));
+    if (!flags.skipLint && !result.ok) {
+      const errors = result.diagnostics.filter((d) => d.severity === "error");
+      blocked.push({ name: c.name, reason: `lint errors: ${errors.map((d) => d.id).join(", ")}` });
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
+      for (const d of errors) lines.push(pc7.dim(`    ${d.id}  ${d.message}`));
+      continue;
+    }
+    if (deniedFlags.length) {
+      blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 you passed --deny ${deniedFlags.join(", ")}`));
+      continue;
+    }
+    const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
+    const base = isGlobal ? home : resolve3(flags.cwd ?? process.cwd());
+    lines.push(pc7.green(`\u2713 ${c.name}`) + pc7.dim(`  score ${result.score}${allFlags.length ? `  ${allFlags.join(", ")}` : ""}`));
+    for (const [dir, agentIds] of dirAgents) {
+      const out = writeSkill(c.name, files, dir, { mode: "copy" });
+      written.push({ name: c.name, dir: out });
+      const rel = relative2(base, out).split("\\").join("/") || out;
+      lines.push(pc7.dim(`  ${rel.padEnd(28)} ${agentIds.join(", ")}`));
+    }
+    if (c.pinMiss) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
+    }
+    if (c.note) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name}: ${c.note}`));
+    }
+    if (c.type === "pack" && !c.files) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
+    }
+    if (c.registrySlug) deps.fireInstall(c.registrySlug, flags);
+  }
+  const exitCode = written.length === 0 ? 1 : 0;
+  return { written, blocked, exitCode, output: lines.join("\n") };
+}
+function addCommand() {
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to your user-level agent folders (available in every project)").option("-p, --project", "install into the current directory's agent folders (committed with the project)").option("-a, --agent <agents...>", "target specific agents (default: every agent detected on this machine)").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip prompts; scope is auto-detected (project if this folder looks like a project, else global)").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runAdd(source, merged);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/list.ts
+import { Command as Command8 } from "commander";
+import pc8 from "picocolors";
+function listCommand() {
+  return new Command8("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
+    const scope = { global: opts.global };
+    const skills = installedSkills(scope);
+    if (opts.json) {
+      console.log(JSON.stringify(skills.map((s) => ({ name: s.name, agent: s.agent, scope: s.scope, path: s.path })), null, 2));
+      return;
+    }
+    if (skills.length === 0) {
+      console.log("No installed skills found.");
+      return;
+    }
+    for (const s of skills) {
+      const parsed = parseSkillMd(s.raw);
+      const desc = "error" in parsed ? pc8.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc8.dim(parsed.description.slice(0, 80));
+      console.log(`${pc8.bold(s.name)} ${pc8.dim(`[${s.agent}/${s.scope}]`)}
+    ${desc}`);
+    }
+  });
+}
+
+// ../cli/src/commands/remove.ts
+import { Command as Command9 } from "commander";
+import { rmSync as rmSync3 } from "fs";
+import pc9 from "picocolors";
+function runRemove(names, scope = {}) {
+  const installed = installedSkills(scope);
+  const targets = installed.filter((s) => names.includes(s.name));
+  const removed = [];
+  const lines = [];
+  for (const t of targets) {
+    rmSync3(t.path, { recursive: true, force: true });
+    removed.push(t.path);
+    lines.push(pc9.green(`\u2713 removed ${t.name} (${t.agent})`));
+  }
+  for (const n of names) {
+    if (!targets.some((t) => t.name === n)) lines.push(pc9.yellow(`- ${n} not installed`));
+  }
+  return { removed, output: lines.join("\n") };
+}
+function removeCommand() {
+  return new Command9("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
+    const run = runRemove(names, { global: opts.global });
+    console.log(run.output);
+  });
+}
+
+// ../cli/src/commands/update.ts
+import { Command as Command10 } from "commander";
+import { writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
+import pc10 from "picocolors";
+async function runUpdate(names, flags, scope = {}) {
+  const { api } = createClient(flags);
+  const installed = installedSkills(scope).filter((s) => names.length === 0 || names.includes(s.name));
+  const updated = [];
+  const lines = [];
+  for (const s of installed) {
+    const slug = await findRegistrySlug(api, s);
+    if (!slug) {
+      lines.push(pc10.dim(`- ${s.name} skipped (no registry match)`));
+      continue;
+    }
+    try {
+      const [owner, name] = slug.split("/");
+      const skill = await api(`/api/skills/${owner}/${name}`);
+      const next = skillMdFor(skill);
+      if (next.trim() === s.raw.trim()) {
+        lines.push(pc10.dim(`- ${s.name} already up to date`));
+        continue;
+      }
+      const result = lint(next, { slug: s.name });
+      if (!result.ok) {
+        lines.push(pc10.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
+        continue;
+      }
+      writeFileSync5(join6(s.path, "SKILL.md"), next, "utf8");
+      updated.push(s.name);
+      lines.push(pc10.green(`\u2713 updated ${s.name}`));
+    } catch {
+      lines.push(pc10.red(`\u2717 ${s.name} update error`));
+    }
+  }
+  return { updated, output: lines.join("\n") || "Nothing to update." };
+}
+async function findRegistrySlug(api, s) {
+  const r = await api(`/api/search?q=${encodeURIComponent(s.name)}&limit=5`).catch(() => null);
+  const hit = r?.items?.find((it) => it.slug.split("/")[1] === s.name);
+  return hit?.slug ?? null;
+}
+function updateCommand() {
+  return new Command10("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runUpdate(names, merged, { global: opts.global });
+    console.log(run.output);
+  });
+}
+
+// ../cli/src/commands/publish.ts
+import { Command as Command11 } from "commander";
+import pc11 from "picocolors";
+var defaultDeps2 = {
+  resolve: resolveSource,
+  async submit(payload, flags) {
+    const { api, hasToken } = createClient(flags);
+    if (!hasToken) throw new Error("No token. Run `skillmd login` or pass --token.");
+    return api(`/api/skills`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+  }
+};
+async function runPublish(target, flags, deps = defaultDeps2) {
+  const sources = await deps.resolve(target);
+  if (sources.length !== 1) {
+    return { result: lint(""), published: false, exitCode: 1, output: `Expected exactly one SKILL.md, found ${sources.length}.` };
+  }
+  const src = sources[0];
+  const result = lint(src.raw, { slug: src.slug });
+  const report = toText([{ file: src.path, result }], { decorate });
+  if (!result.ok) {
+    return { result, published: false, exitCode: 1, output: `${report}
+${pc11.red("\u2717 Refusing to publish: fix the errors above.")}` };
+  }
+  const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
+  if (hasWarn && !flags.force) {
+    return { result, published: false, exitCode: 1, output: `${report}
+${pc11.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
+  }
+  if (flags.dryRun) {
+    return { result, published: false, exitCode: 0, output: `${report}
+${pc11.green("\u2713 Dry run: would publish.")}` };
+  }
+  const res = await deps.submit({ content: src.raw, type: flags.type ?? "single" }, flags);
+  return { result, published: true, slug: res.slug, exitCode: 0, output: `${report}
+${pc11.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
+}
+function publishCommand() {
+  return new Command11("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runPublish(target, merged);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/login.ts
+import { Command as Command12 } from "commander";
+import * as p4 from "@clack/prompts";
+function loginCommand() {
+  return new Command12("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
+    let token = opts.token;
+    if (!token) {
+      const answer = await p4.password({ message: "Paste your SkillMD token (from your account page)" });
+      if (p4.isCancel(answer)) {
+        p4.cancel("Cancelled.");
+        return;
+      }
+      token = answer;
+    }
+    if (!token) {
+      console.error("A token is required.");
+      process.exitCode = 1;
+      return;
+    }
+    const cfg = readConfig();
+    cfg.token = token;
+    if (opts.api) cfg.api = opts.api;
+    writeConfig(cfg);
+    console.log(`Saved token to ${configPath()}`);
+  });
+}
+function logoutCommand() {
+  return new Command12("logout").description("Remove the stored SkillMD token").action(() => {
+    const cfg = readConfig();
+    delete cfg.token;
+    writeConfig(cfg);
+    console.log("Removed stored token.");
+  });
+}
+
+// ../cli/src/commands/interactive.ts
+import * as p5 from "@clack/prompts";
+import pc12 from "picocolors";
+function bail(v) {
+  if (p5.isCancel(v)) {
+    p5.cancel("Cancelled.");
+    return true;
+  }
+  return false;
+}
+async function browseSearchResults(items) {
+  const cols = process.stdout.columns ?? 80;
+  for (; ; ) {
+    const picked = await p5.select({
+      message: "Search results",
+      options: [
+        ...items.map((item2) => {
+          const starsTxt = item2.repo_stars != null ? ` \u2605${formatStars(item2.repo_stars)}` : "";
+          const checkTxt = item2.verified ? " \u2713" : "";
+          const plainLabel = `${item2.slug}${starsTxt}${checkTxt}`;
+          const label2 = `${pc12.bold(item2.slug)}${starsTxt ? pc12.dim(starsTxt) : ""}${checkTxt ? pc12.green(checkTxt) : ""}`;
+          const hintWidth = Math.max(10, cols - plainLabel.length - 6);
+          return {
+            value: item2.slug,
+            label: label2,
+            hint: truncate(item2.description ?? "", hintWidth)
+          };
+        }),
+        { value: "__back", label: "\u2190 Back to menu" }
+      ]
+    });
+    if (p5.isCancel(picked) || picked === "__back") return;
+    const item = items.find((i) => i.slug === picked);
+    if (!item) continue;
+    await browseOneResult(item);
+  }
+}
+async function browseOneResult(item) {
+  const starsTxt = item.repo_stars != null ? `\u2605 ${formatStars(item.repo_stars)} stars` : "";
+  const meta = [
+    starsTxt,
+    item.verified ? pc12.green("\u2713 verified") : "unverified",
+    item.type === "pack" ? "pack" : ""
+  ].filter(Boolean).join(" \xB7 ");
+  p5.note([item.description ?? "", pc12.dim(meta)].join("\n"), item.slug);
+  for (; ; ) {
+    const action = await p5.select({
+      message: "What next?",
+      options: [
+        { value: "project", label: "Install to this project" },
+        { value: "global", label: "Install globally (user dir)" },
+        { value: "url", label: "Show page URL" },
+        { value: "back", label: "\u2190 Back to results" }
+      ]
+    });
+    if (p5.isCancel(action) || action === "back") return;
+    if (action === "url") {
+      p5.log.message(pc12.dim(`https://skillmd.com/skills/${item.slug}`));
+      continue;
+    }
+    p5.log.step(`Installing ${item.slug}\u2026`);
+    try {
+      const run = await runAdd(item.slug, action === "global" ? { global: true } : { project: true });
+      console.log(run.output);
+      if (run.exitCode === 0) p5.log.success("Installed.");
+      else p5.log.warn("Not installed.");
+    } catch (err) {
+      p5.log.error(err instanceof Error ? err.message : String(err));
+    }
+  }
+}
+async function runInteractive() {
+  p5.intro(pc12.bgCyan(pc12.black(" skillmd ")));
+  for (; ; ) {
+    const action = await p5.select({
+      message: "What would you like to do?",
+      options: [
+        { value: "lint", label: "Lint a skill", hint: "validate a SKILL.md" },
+        { value: "scan", label: "Security scan", hint: "scripts, network, secrets" },
+        { value: "search", label: "Search the registry" },
+        { value: "init", label: "Create a new skill" },
+        { value: "list", label: "List installed skills" },
+        { value: "help", label: "Show all commands" },
+        { value: "quit", label: "Quit" }
+      ]
+    });
+    if (bail(action) || action === "quit") break;
+    switch (action) {
+      case "lint":
+      case "scan": {
+        const path = await p5.text({ message: "Path to a skill or folder", placeholder: ".", defaultValue: "." });
+        if (bail(path)) break;
+        const target = String(path || ".");
+        const s = p5.spinner();
+        s.start(action === "lint" ? "Linting" : "Scanning");
+        try {
+          const run = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
+          s.stop("Done");
+          console.log(run.output);
+          process.exitCode = run.exitCode;
+        } catch (err) {
+          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          process.exitCode = 1;
+        }
+        break;
+      }
+      case "search": {
+        const query = await p5.text({ message: "Search the registry for" });
+        if (bail(query)) break;
+        const verified = await p5.confirm({ message: "Verified skills only?", initialValue: false });
+        if (bail(verified)) break;
+        const s = p5.spinner();
+        s.start("Searching");
+        try {
+          const run = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
+          s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
+          if (run.items.length === 0) {
+            p5.log.info("No results.");
+            break;
+          }
+          await browseSearchResults(run.items);
+        } catch (err) {
+          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          process.exitCode = 1;
+        }
+        break;
+      }
+      case "init": {
+        const name = await p5.text({ message: "Skill name", placeholder: "my-skill" });
+        if (bail(name)) break;
+        const description = await p5.text({ message: "One-line description", placeholder: "What this skill helps an agent do" });
+        if (bail(description)) break;
+        try {
+          const file = initSkill(String(name), { description: String(description || "") });
+          p5.log.success(`Created ${pc12.bold(file)}`);
+        } catch (err) {
+          p5.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        break;
+      }
+      case "list": {
+        const skills = [...installedSkills({}), ...installedSkills({ global: true })];
+        if (skills.length === 0) {
+          p5.log.info("No installed skills found (checked this folder and your user directory).");
+        } else {
+          p5.log.message(
+            skills.map((sk) => {
+              const parsed = parseSkillMd(sk.raw);
+              const desc = "error" in parsed ? pc12.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc12.dim(parsed.description.slice(0, 70));
+              return `${pc12.bold(sk.name)} ${pc12.dim(`[${sk.agent}/${sk.scope}]`)}
+  ${desc}`;
+            }).join("\n")
+          );
+        }
+        break;
+      }
+      case "help": {
+        p5.note(
+          [
+            `${pc12.bold("lint")} [path]      validate SKILL.md + quality score`,
+            `${pc12.bold("scan")} [path]      security scan`,
+            `${pc12.bold("search")} <query>   search the registry`,
+            `${pc12.bold("add")} <source>     install a skill (lints first)`,
+            `${pc12.bold("info")} <slug>      registry details for a skill`,
+            `${pc12.bold("init")} [name]      scaffold a new skill`,
+            `${pc12.bold("list / remove / update")}   manage installed skills`,
+            `${pc12.bold("publish")} [path]   publish (fails on lint errors)`,
+            `${pc12.bold("rules / login")}`
+          ].join("\n"),
+          "Commands (run: skillmd <command>)"
+        );
+        break;
+      }
+    }
+  }
+  p5.outro(pc12.dim("skillmd.com"));
+}
+
+// ../cli/src/index.ts
+var version = "0.0.0";
+try {
+  version = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
+} catch {
+}
+var program = new Command13("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
+program.addCommand(lintCommand());
+program.addCommand(scanCommand());
+program.addCommand(rulesCommand());
+program.addCommand(initCommand());
+program.addCommand(searchCommand());
+program.addCommand(infoCommand());
+program.addCommand(addCommand());
+program.addCommand(listCommand());
+program.addCommand(removeCommand());
+program.addCommand(updateCommand());
+program.addCommand(publishCommand());
+program.addCommand(loginCommand());
+program.addCommand(logoutCommand());
+if (process.argv.slice(2).length === 0) {
+  if (process.stdout.isTTY) {
+    await runInteractive();
+    process.exit(process.exitCode ?? 0);
+  }
+  program.outputHelp();
+  process.exit(0);
+}
+program.parseAsync(process.argv).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exitCode = 1;
+});