happyskills 0.30.1 → 0.31.1

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.31.1] - 2026-04-07
+
+### Fixed
+- Fix `check` and `update --all` ignoring kit dependencies and transitive dependencies — previously only root-level skills were checked, hiding available updates for skills installed via kits or as dependencies of other skills
+- Fix pre-existing test failure in lock reader caused by lazy `require` of `print_warn` breaking under Jest environment teardown
+
+### Added
+- Add `via` field to `check` and `update` JSON output showing which parent skill or kit pulled in each dependency (`null` for directly installed skills)
+- Add "Via" column to `check` table output (only shown when dependencies are present)
+
+## [0.31.0] - 2026-04-06
+
+### Added
+- Add `enable` command (alias: `on`) to restore agent symlinks for previously disabled skills
+- Add `disable` command (alias: `off`) to remove agent symlinks without uninstalling — physical files and lock entries are preserved
+- Add Enabled column to `list` output showing whether each managed skill has active agent symlinks
+- Add `enabled` boolean field to `list --json` output for managed skills
+- Add `--agents` flag to `list` for controlling which agents are checked for enabled/disabled detection
+
+### Changed
+- Install, update, and refresh now respect disabled state — disabled skills are not re-linked after updates
+
 ## [0.30.1] - 2026-04-05
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "0.30.1",
+	"version": "0.31.1",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/agents/index.js

@@ -1,9 +1,11 @@
 const { AGENTS, get_agent, get_all_agent_ids } = require('./registry')
 const { detect_agents, resolve_agents } = require('./detector')
 const { link_to_agents, unlink_from_agents, is_symlink } = require('./linker')
+const { is_skill_enabled, get_skills_enabled_map } = require('./status')
 
 module.exports = {
 	AGENTS, get_agent, get_all_agent_ids,
 	detect_agents, resolve_agents,
-	link_to_agents, unlink_from_agents, is_symlink
+	link_to_agents, unlink_from_agents, is_symlink,
+	is_skill_enabled, get_skills_enabled_map
 }

package/src/agents/linker.test.js

@@ -0,0 +1,202 @@
+'use strict'
+const { describe, it, beforeEach, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+const fs = require('fs')
+const path = require('path')
+const os = require('os')
+
+const { link_to_agents, unlink_from_agents, is_symlink } = require('./linker')
+
+const make_tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'hs-linker-test-'))
+const cleanup = (dir) => fs.rmSync(dir, { recursive: true, force: true })
+
+const make_agent = (id, skills_dir_rel) => ({
+	id,
+	display_name: id,
+	skills_dir: skills_dir_rel,
+	global_skills_dir: skills_dir_rel,
+	detect_paths: []
+})
+
+describe('is_symlink', () => {
+	let tmp
+	beforeEach(() => { tmp = make_tmp() })
+	afterEach(() => { cleanup(tmp) })
+
+	it('returns true for a symlink', async () => {
+		const target = path.join(tmp, 'target')
+		const link = path.join(tmp, 'link')
+		fs.mkdirSync(target)
+		fs.symlinkSync(target, link, 'junction')
+
+		const [errors, result] = await is_symlink(link)
+		assert.equal(errors, null)
+		assert.equal(result, true)
+	})
+
+	it('returns false for a regular directory', async () => {
+		const dir = path.join(tmp, 'regular')
+		fs.mkdirSync(dir)
+
+		const [errors, result] = await is_symlink(dir)
+		assert.equal(errors, null)
+		assert.equal(result, false)
+	})
+
+	it('returns false for a non-existent path', async () => {
+		const [errors, result] = await is_symlink(path.join(tmp, 'nope'))
+		assert.equal(errors, null)
+		assert.equal(result, false)
+	})
+})
+
+describe('link_to_agents', () => {
+	let tmp
+	beforeEach(() => { tmp = make_tmp() })
+	afterEach(() => { cleanup(tmp) })
+
+	it('creates symlinks in agent directories', async () => {
+		const source = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(source, { recursive: true })
+		fs.writeFileSync(path.join(source, 'SKILL.md'), 'test')
+
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, results] = await link_to_agents(source, agents, { global: false, project_root: tmp, skill_name: 'deploy-aws' })
+
+		assert.equal(errors, null)
+		assert.equal(results.length, 1)
+		assert.equal(results[0].agent_id, 'claude')
+		assert.equal(results[0].method, 'symlink')
+
+		const link_path = path.join(tmp, '.claude', 'skills', 'deploy-aws')
+		const stat = fs.lstatSync(link_path)
+		assert.ok(stat.isSymbolicLink())
+		assert.equal(fs.readlinkSync(link_path), source)
+	})
+
+	it('creates symlinks for multiple agents', async () => {
+		const source = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(source, { recursive: true })
+
+		const agents = [
+			make_agent('claude', '.claude/skills'),
+			make_agent('cursor', '.cursor/skills')
+		]
+		const [errors, results] = await link_to_agents(source, agents, { global: false, project_root: tmp, skill_name: 'deploy-aws' })
+
+		assert.equal(errors, null)
+		assert.equal(results.length, 2)
+
+		for (const agent of agents) {
+			const link_path = path.join(tmp, agent.skills_dir, 'deploy-aws')
+			assert.ok(fs.lstatSync(link_path).isSymbolicLink())
+		}
+	})
+
+	it('skips if symlink already points to the correct source', async () => {
+		const source = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(source, { recursive: true })
+
+		const agent_dir = path.join(tmp, '.claude', 'skills')
+		fs.mkdirSync(agent_dir, { recursive: true })
+		fs.symlinkSync(source, path.join(agent_dir, 'deploy-aws'), 'junction')
+
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, results] = await link_to_agents(source, agents, { global: false, project_root: tmp, skill_name: 'deploy-aws' })
+
+		assert.equal(errors, null)
+		assert.equal(results[0].skipped, true)
+	})
+
+	it('replaces stale symlink pointing elsewhere', async () => {
+		const source = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(source, { recursive: true })
+
+		const old_source = path.join(tmp, 'old-location')
+		fs.mkdirSync(old_source, { recursive: true })
+		const agent_dir = path.join(tmp, '.claude', 'skills')
+		fs.mkdirSync(agent_dir, { recursive: true })
+		fs.symlinkSync(old_source, path.join(agent_dir, 'deploy-aws'), 'junction')
+
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, results] = await link_to_agents(source, agents, { global: false, project_root: tmp, skill_name: 'deploy-aws' })
+
+		assert.equal(errors, null)
+		assert.equal(results[0].method, 'symlink')
+		assert.equal(results[0].skipped, undefined)
+
+		const link_path = path.join(tmp, '.claude', 'skills', 'deploy-aws')
+		assert.equal(fs.readlinkSync(link_path), source)
+	})
+})
+
+describe('unlink_from_agents', () => {
+	let tmp
+	beforeEach(() => { tmp = make_tmp() })
+	afterEach(() => { cleanup(tmp) })
+
+	it('removes symlinks from agent directories', async () => {
+		const source = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(source, { recursive: true })
+
+		const agent_dir = path.join(tmp, '.claude', 'skills')
+		fs.mkdirSync(agent_dir, { recursive: true })
+		fs.symlinkSync(source, path.join(agent_dir, 'deploy-aws'), 'junction')
+
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, results] = await unlink_from_agents('deploy-aws', agents, { global: false, project_root: tmp })
+
+		assert.equal(errors, null)
+		assert.equal(results[0].removed, true)
+		assert.ok(!fs.existsSync(path.join(agent_dir, 'deploy-aws')))
+	})
+
+	it('reports removed=false when symlink does not exist', async () => {
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, results] = await unlink_from_agents('deploy-aws', agents, { global: false, project_root: tmp })
+
+		assert.equal(errors, null)
+		assert.equal(results[0].removed, false)
+	})
+
+	it('removes from multiple agents', async () => {
+		const source = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(source, { recursive: true })
+
+		const agents = [
+			make_agent('claude', '.claude/skills'),
+			make_agent('cursor', '.cursor/skills')
+		]
+
+		for (const agent of agents) {
+			const agent_dir = path.join(tmp, agent.skills_dir)
+			fs.mkdirSync(agent_dir, { recursive: true })
+			fs.symlinkSync(source, path.join(agent_dir, 'deploy-aws'), 'junction')
+		}
+
+		const [errors, results] = await unlink_from_agents('deploy-aws', agents, { global: false, project_root: tmp })
+
+		assert.equal(errors, null)
+		assert.ok(results.every(r => r.removed === true))
+		for (const agent of agents) {
+			assert.ok(!fs.existsSync(path.join(tmp, agent.skills_dir, 'deploy-aws')))
+		}
+	})
+
+	it('does not remove the canonical source directory', async () => {
+		const source = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(source, { recursive: true })
+		fs.writeFileSync(path.join(source, 'SKILL.md'), 'test')
+
+		const agent_dir = path.join(tmp, '.claude', 'skills')
+		fs.mkdirSync(agent_dir, { recursive: true })
+		fs.symlinkSync(source, path.join(agent_dir, 'deploy-aws'), 'junction')
+
+		const agents = [make_agent('claude', '.claude/skills')]
+		await unlink_from_agents('deploy-aws', agents, { global: false, project_root: tmp })
+
+		// Canonical source must still exist
+		assert.ok(fs.existsSync(source))
+		assert.ok(fs.existsSync(path.join(source, 'SKILL.md')))
+	})
+})

package/src/agents/status.js

@@ -0,0 +1,42 @@
+const { error: { catch_errors } } = require('puffy-core')
+const { is_symlink } = require('./linker')
+const { agent_skill_install_dir } = require('../config/paths')
+
+/**
+ * Check whether a skill is enabled (has at least one symlink in an agent folder).
+ *
+ * @param {string} skill_name — short name (e.g. "deploy-aws")
+ * @param {Agent[]} agents — detected agent objects
+ * @param {boolean} is_global
+ * @param {string} project_root
+ * @returns {Promise} [errors, boolean]
+ */
+const is_skill_enabled = (skill_name, agents, is_global, project_root) => catch_errors('Skill enabled check failed', async () => {
+	for (const agent of agents) {
+		const target = agent_skill_install_dir(agent, is_global, project_root, skill_name)
+		const [, link] = await is_symlink(target)
+		if (link) return true
+	}
+	return false
+})
+
+/**
+ * Batch-check enabled status for multiple skills.
+ *
+ * @param {string[]} skill_names — array of short names
+ * @param {Agent[]} agents — detected agent objects
+ * @param {boolean} is_global
+ * @param {string} project_root
+ * @returns {Promise} [errors, Map<string, boolean>] — skill_name → enabled
+ */
+const get_skills_enabled_map = (skill_names, agents, is_global, project_root) => catch_errors('Skill enabled map failed', async () => {
+	const map = new Map()
+	const checks = skill_names.map(async (name) => {
+		const [, enabled] = await is_skill_enabled(name, agents, is_global, project_root)
+		map.set(name, enabled === true)
+	})
+	await Promise.all(checks)
+	return map
+})
+
+module.exports = { is_skill_enabled, get_skills_enabled_map }

package/src/agents/status.test.js

@@ -0,0 +1,127 @@
+'use strict'
+const { describe, it, beforeEach, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+const fs = require('fs')
+const path = require('path')
+const os = require('os')
+
+const { is_skill_enabled, get_skills_enabled_map } = require('./status')
+
+const make_tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'hs-status-test-'))
+const cleanup = (dir) => fs.rmSync(dir, { recursive: true, force: true })
+
+/**
+ * Helper: create a fake agent definition for testing.
+ */
+const make_agent = (id, skills_dir_rel) => ({
+	id,
+	display_name: id,
+	skills_dir: skills_dir_rel,
+	global_skills_dir: skills_dir_rel,
+	detect_paths: []
+})
+
+describe('is_skill_enabled', () => {
+	let tmp
+	beforeEach(() => { tmp = make_tmp() })
+	afterEach(() => { cleanup(tmp) })
+
+	it('returns true when a symlink exists in an agent folder', async () => {
+		const canonical = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(canonical, { recursive: true })
+		fs.writeFileSync(path.join(canonical, 'SKILL.md'), '---\nname: deploy-aws\n---\n')
+
+		const agent_dir = path.join(tmp, '.claude', 'skills')
+		fs.mkdirSync(agent_dir, { recursive: true })
+		fs.symlinkSync(canonical, path.join(agent_dir, 'deploy-aws'), 'junction')
+
+		const agent = make_agent('claude', '.claude/skills')
+		const [errors, enabled] = await is_skill_enabled('deploy-aws', [agent], false, tmp)
+		assert.equal(errors, null)
+		assert.equal(enabled, true)
+	})
+
+	it('returns false when no symlink exists in any agent folder', async () => {
+		const canonical = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(canonical, { recursive: true })
+
+		const agent = make_agent('claude', '.claude/skills')
+		const [errors, enabled] = await is_skill_enabled('deploy-aws', [agent], false, tmp)
+		assert.equal(errors, null)
+		assert.equal(enabled, false)
+	})
+
+	it('returns false when agent folder does not exist', async () => {
+		const agent = make_agent('claude', '.claude/skills')
+		const [errors, enabled] = await is_skill_enabled('deploy-aws', [agent], false, tmp)
+		assert.equal(errors, null)
+		assert.equal(enabled, false)
+	})
+
+	it('returns true if any one of multiple agents has the symlink', async () => {
+		const canonical = path.join(tmp, '.agents', 'skills', 'deploy-aws')
+		fs.mkdirSync(canonical, { recursive: true })
+
+		// Only cursor has the symlink, not claude
+		const cursor_dir = path.join(tmp, '.cursor', 'skills')
+		fs.mkdirSync(cursor_dir, { recursive: true })
+		fs.symlinkSync(canonical, path.join(cursor_dir, 'deploy-aws'), 'junction')
+
+		const agents = [
+			make_agent('claude', '.claude/skills'),
+			make_agent('cursor', '.cursor/skills')
+		]
+		const [errors, enabled] = await is_skill_enabled('deploy-aws', agents, false, tmp)
+		assert.equal(errors, null)
+		assert.equal(enabled, true)
+	})
+
+	it('returns false with an empty agents array', async () => {
+		const [errors, enabled] = await is_skill_enabled('deploy-aws', [], false, tmp)
+		assert.equal(errors, null)
+		assert.equal(enabled, false)
+	})
+})
+
+describe('get_skills_enabled_map', () => {
+	let tmp
+	beforeEach(() => { tmp = make_tmp() })
+	afterEach(() => { cleanup(tmp) })
+
+	it('returns a map with correct enabled/disabled status for multiple skills', async () => {
+		const agents_skills = path.join(tmp, '.agents', 'skills')
+		const skill_a = path.join(agents_skills, 'skill-a')
+		const skill_b = path.join(agents_skills, 'skill-b')
+		fs.mkdirSync(skill_a, { recursive: true })
+		fs.mkdirSync(skill_b, { recursive: true })
+
+		// Only skill-a is symlinked (enabled)
+		const claude_dir = path.join(tmp, '.claude', 'skills')
+		fs.mkdirSync(claude_dir, { recursive: true })
+		fs.symlinkSync(skill_a, path.join(claude_dir, 'skill-a'), 'junction')
+
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, map] = await get_skills_enabled_map(['skill-a', 'skill-b'], agents, false, tmp)
+
+		assert.equal(errors, null)
+		assert.equal(map.get('skill-a'), true)
+		assert.equal(map.get('skill-b'), false)
+	})
+
+	it('returns all false when no symlinks exist', async () => {
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, map] = await get_skills_enabled_map(['foo', 'bar'], agents, false, tmp)
+
+		assert.equal(errors, null)
+		assert.equal(map.get('foo'), false)
+		assert.equal(map.get('bar'), false)
+	})
+
+	it('handles empty skill list', async () => {
+		const agents = [make_agent('claude', '.claude/skills')]
+		const [errors, map] = await get_skills_enabled_map([], agents, false, tmp)
+
+		assert.equal(errors, null)
+		assert.equal(map.size, 0)
+	})
+})

package/src/commands/check.js

@@ -1,5 +1,5 @@
 const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
-const { read_lock, get_all_locked_skills } = require('../lock/reader')
+const { read_lock, get_all_locked_skills, get_via } = require('../lock/reader')
 const repos_api = require('../api/repos')
 const { print_help, print_table, print_json, print_info, print_success, print_warn, print_hint, code } = require('../ui/output')
 const { green, yellow, red } = require('../ui/colors')
@@ -44,15 +44,15 @@ const run = (args) => catch_errors('Check failed', async () => {
 
 	const target_skill = args._[0]
 	const to_check = target_skill
-		? entries.filter(([name]) => name === target_skill)
-		: entries.filter(([, data]) => data.requested_by?.includes('__root__'))
+		? entries.filter(([name, data]) => name === target_skill && data !== null)
+		: entries.filter(([, data]) => data !== null)
 
 	if (to_check.length === 0) {
 		if (args.flags.json) {
 			print_json({ data: { results: [], outdated_count: 0, up_to_date_count: 0 } })
 			return
 		}
-		print_info(target_skill ? `${target_skill} is not installed.` : 'No directly installed skills found.')
+		print_info(target_skill ? `${target_skill} is not installed.` : 'No installed skills found.')
 		return
 	}
 
@@ -62,25 +62,26 @@ const run = (args) => catch_errors('Check failed', async () => {
 	const results = []
 	if (batch_err) {
 		for (const [name, data] of to_check) {
-			results.push({ skill: name, installed: data.version, latest: 'error', status: 'error' })
+			results.push({ skill: name, installed: data.version, latest: 'error', status: 'error', via: get_via(data) })
 		}
 	} else {
 		for (const [name, data] of to_check) {
 			const info = batch_data?.results?.[name]
+			const via = get_via(data)
 			const has_conflicts = (data.conflict_files || []).length > 0
 			if (has_conflicts) {
-				results.push({ skill: name, installed: data.version, latest: info?.latest_version || '-', status: 'conflicts' })
+				results.push({ skill: name, installed: data.version, latest: info?.latest_version || '-', status: 'conflicts', via })
 			} else if (info?.access_denied) {
-				results.push({ skill: name, installed: data.version, latest: '-', status: 'no-access' })
+				results.push({ skill: name, installed: data.version, latest: '-', status: 'no-access', via })
 			} else if (!info || !info.latest_version) {
-				results.push({ skill: name, installed: data.version, latest: '-', status: 'unknown' })
+				results.push({ skill: name, installed: data.version, latest: '-', status: 'unknown', via })
 			} else if (data.base_commit && info.commit && data.base_commit !== info.commit) {
-				results.push({ skill: name, installed: data.version, latest: info.latest_version, status: 'outdated' })
+				results.push({ skill: name, installed: data.version, latest: info.latest_version, status: 'outdated', via })
 			} else if (!data.base_commit && info.latest_version !== data.version) {
 				// Fallback to version comparison for old lock files without base_commit
-				results.push({ skill: name, installed: data.version, latest: info.latest_version, status: 'outdated' })
+				results.push({ skill: name, installed: data.version, latest: info.latest_version, status: 'outdated', via })
 			} else {
-				results.push({ skill: name, installed: data.version, latest: info.latest_version, status: 'up-to-date' })
+				results.push({ skill: name, installed: data.version, latest: info.latest_version, status: 'up-to-date', via })
 			}
 		}
 	}
@@ -102,14 +103,21 @@ const run = (args) => catch_errors('Check failed', async () => {
 		'unknown': (s) => s
 	}
 
-	const rows = results.map(r => [
-		r.skill,
-		r.installed,
-		r.latest,
-		(status_colors[r.status] || ((s) => s))(r.status)
-	])
-
-	print_table(['Skill', 'Installed', 'Latest', 'Status'], rows)
+	const has_via = results.some(r => r.via)
+	const rows = results.map(r => {
+		const row = [
+			r.skill,
+			r.installed,
+			r.latest,
+			(status_colors[r.status] || ((s) => s))(r.status)
+		]
+		if (has_via) row.push(r.via || '-')
+		return row
+	})
+
+	const headers = ['Skill', 'Installed', 'Latest', 'Status']
+	if (has_via) headers.push('Via')
+	print_table(headers, rows)
 
 	const outdated = results.filter(r => r.status === 'outdated')
 	const conflicts = results.filter(r => r.status === 'conflicts')
@@ -121,7 +129,7 @@ const run = (args) => catch_errors('Check failed', async () => {
 	}
 	if (outdated.length > 0) {
 		console.log()
-		print_info(`Run ${code('happyskills update')} to upgrade ${outdated.length} skill(s).`)
+		print_info(`Run ${code('happyskills update --all')} to upgrade ${outdated.length} skill(s).`)
 	} else if (conflicts.length === 0 && results.every(r => r.status === 'up-to-date')) {
 		console.log()
 		print_success('All skills are up to date.')

package/src/commands/disable.js

@@ -0,0 +1,105 @@
+const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
+const { read_lock, get_all_locked_skills } = require('../lock/reader')
+const { find_project_root, lock_root, skills_dir, skill_install_dir } = require('../config/paths')
+const { resolve_agents, unlink_from_agents } = require('../agents')
+const { is_skill_enabled } = require('../agents/status')
+const { file_exists } = require('../utils/fs')
+const { print_help, print_json, print_success, print_warn, print_info } = require('../ui/output')
+const { exit_with_error, UsageError } = require('../utils/errors')
+const { EXIT_CODES } = require('../constants')
+
+const HELP_TEXT = `Usage: happyskills disable <skill> [skill2 ...] [options]
+
+Disable one or more skills by removing their agent symlinks.
+The skill files remain in .agents/skills/ and can be re-enabled at any time.
+
+Arguments:
+  skill             One or more skill names (owner/name or short name)
+
+Options:
+  -g, --global      Target globally installed skills
+  --agents <list>   Target specific agents (comma-separated)
+  --json            Output as JSON
+
+Examples:
+  happyskills disable acme/deploy-aws
+  happyskills disable deploy-aws monitoring
+  happyskills disable acme/deploy-aws acme/monitoring -g`
+
+/**
+ * Resolve a skill argument (owner/name or short name) to its full lock key and short name.
+ */
+const resolve_skill_name = (arg, locked_skills) => {
+	if (arg.includes('/')) {
+		const short = arg.split('/')[1]
+		return locked_skills[arg] ? { full: arg, short } : null
+	}
+	// Search by short name
+	for (const key of Object.keys(locked_skills)) {
+		if (key.split('/')[1] === arg) {
+			return { full: key, short: arg }
+		}
+	}
+	return null
+}
+
+const run = (args) => catch_errors('Disable failed', async () => {
+	if (args.flags._show_help) {
+		print_help(HELP_TEXT)
+		return process.exit(EXIT_CODES.SUCCESS)
+	}
+
+	const skills_args = args._
+	if (skills_args.length === 0) {
+		throw new UsageError('Please specify one or more skills to disable (e.g., happyskills disable acme/deploy-aws).')
+	}
+
+	const is_global = args.flags.global || false
+	const project_root = find_project_root()
+
+	const [agents_err, agents_result] = await resolve_agents(args.flags.agents)
+	if (agents_err) throw e('Agent resolution failed', agents_err)
+	const { agents } = agents_result
+
+	const [, lock_data] = await read_lock(lock_root(is_global, project_root))
+	const locked_skills = get_all_locked_skills(lock_data)
+
+	const results = []
+
+	for (const arg of skills_args) {
+		const resolved = resolve_skill_name(arg, locked_skills)
+
+		if (!resolved) {
+			print_warn(`${arg} is not a HappySkills-managed skill — skipping`)
+			results.push({ skill: arg, status: 'not_found' })
+			continue
+		}
+
+		const { full, short } = resolved
+
+		// Check if already disabled
+		const [, enabled] = await is_skill_enabled(short, agents, is_global, project_root)
+		if (!enabled) {
+			print_warn(`${full} is already disabled`)
+			results.push({ skill: full, status: 'already_disabled' })
+			continue
+		}
+
+		// Remove symlinks from all agent folders
+		const [link_err] = await unlink_from_agents(short, agents, { global: is_global, project_root })
+		if (link_err) {
+			print_warn(`Failed to disable ${full}`)
+			results.push({ skill: full, status: 'error', message: link_err[0]?.message })
+			continue
+		}
+
+		print_success(`Disabled ${full}`)
+		results.push({ skill: full, status: 'disabled' })
+	}
+
+	if (args.flags.json) {
+		print_json({ data: { results } })
+	}
+}).then(([errors]) => { if (errors) { exit_with_error(errors); return } })
+
+module.exports = { run }

package/src/commands/enable.js

@@ -0,0 +1,114 @@
+const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
+const { read_lock, get_all_locked_skills } = require('../lock/reader')
+const { find_project_root, lock_root, skills_dir, skill_install_dir } = require('../config/paths')
+const { resolve_agents, link_to_agents } = require('../agents')
+const { is_skill_enabled } = require('../agents/status')
+const { file_exists } = require('../utils/fs')
+const { print_help, print_json, print_success, print_warn, print_info } = require('../ui/output')
+const { exit_with_error, UsageError } = require('../utils/errors')
+const { EXIT_CODES } = require('../constants')
+
+const HELP_TEXT = `Usage: happyskills enable <skill> [skill2 ...] [options]
+
+Enable one or more previously disabled skills by restoring their agent symlinks.
+
+Arguments:
+  skill             One or more skill names (owner/name or short name)
+
+Options:
+  -g, --global      Target globally installed skills
+  --agents <list>   Target specific agents (comma-separated)
+  --json            Output as JSON
+
+Examples:
+  happyskills enable acme/deploy-aws
+  happyskills enable deploy-aws monitoring
+  happyskills enable acme/deploy-aws acme/monitoring -g`
+
+/**
+ * Resolve a skill argument (owner/name or short name) to its full lock key and short name.
+ */
+const resolve_skill_name = (arg, locked_skills) => {
+	if (arg.includes('/')) {
+		const short = arg.split('/')[1]
+		return locked_skills[arg] ? { full: arg, short } : null
+	}
+	// Search by short name
+	for (const key of Object.keys(locked_skills)) {
+		if (key.split('/')[1] === arg) {
+			return { full: key, short: arg }
+		}
+	}
+	return null
+}
+
+const run = (args) => catch_errors('Enable failed', async () => {
+	if (args.flags._show_help) {
+		print_help(HELP_TEXT)
+		return process.exit(EXIT_CODES.SUCCESS)
+	}
+
+	const skills_args = args._
+	if (skills_args.length === 0) {
+		throw new UsageError('Please specify one or more skills to enable (e.g., happyskills enable acme/deploy-aws).')
+	}
+
+	const is_global = args.flags.global || false
+	const project_root = find_project_root()
+	const base_dir = skills_dir(is_global, project_root)
+
+	const [agents_err, agents_result] = await resolve_agents(args.flags.agents)
+	if (agents_err) throw e('Agent resolution failed', agents_err)
+	const { agents } = agents_result
+
+	const [, lock_data] = await read_lock(lock_root(is_global, project_root))
+	const locked_skills = get_all_locked_skills(lock_data)
+
+	const results = []
+
+	for (const arg of skills_args) {
+		const resolved = resolve_skill_name(arg, locked_skills)
+
+		if (!resolved) {
+			print_warn(`${arg} is not a HappySkills-managed skill — skipping`)
+			results.push({ skill: arg, status: 'not_found' })
+			continue
+		}
+
+		const { full, short } = resolved
+
+		// Verify the skill directory exists on disk
+		const dir = skill_install_dir(base_dir, short)
+		const [, exists] = await file_exists(dir)
+		if (!exists) {
+			print_warn(`${full} files not found on disk — run happyskills install to restore`)
+			results.push({ skill: full, status: 'missing' })
+			continue
+		}
+
+		// Check if already enabled
+		const [, enabled] = await is_skill_enabled(short, agents, is_global, project_root)
+		if (enabled) {
+			print_warn(`${full} is already enabled`)
+			results.push({ skill: full, status: 'already_enabled' })
+			continue
+		}
+
+		// Create symlinks to all agent folders
+		const [link_err] = await link_to_agents(dir, agents, { global: is_global, project_root, skill_name: short })
+		if (link_err) {
+			print_warn(`Failed to enable ${full}`)
+			results.push({ skill: full, status: 'error', message: link_err[0]?.message })
+			continue
+		}
+
+		print_success(`Enabled ${full}`)
+		results.push({ skill: full, status: 'enabled' })
+	}
+
+	if (args.flags.json) {
+		print_json({ data: { results } })
+	}
+}).then(([errors]) => { if (errors) { exit_with_error(errors); return } })
+
+module.exports = { run }

package/src/commands/list.js

@@ -4,7 +4,10 @@ const { skills_dir, skill_install_dir, find_project_root, lock_root } = require(
 const { file_exists, read_json } = require('../utils/fs')
 const { scan_skills_dir, scan_agent_orphan_skills } = require('../utils/skill_scanner')
 const { AGENTS } = require('../agents/registry')
+const { resolve_agents } = require('../agents/detector')
+const { get_skills_enabled_map } = require('../agents/status')
 const { print_help, print_table, print_json, print_info } = require('../ui/output')
+const { green, yellow } = require('../ui/colors')
 const { exit_with_error } = require('../utils/errors')
 const { EXIT_CODES, SKILL_JSON, SKILL_TYPES } = require('../constants')
 
@@ -37,8 +40,16 @@ const run = (args) => catch_errors('List failed', async () => {
 	const skills = get_all_locked_skills(lock_data)
 	const managed_entries = Object.entries(skills)
 
+	// Resolve agents and build enabled/disabled map for managed skills
+	const [, agents_result] = await resolve_agents(args.flags.agents)
+	const agents = agents_result?.agents || []
+	const managed_short_names = managed_entries.map(([k]) => k.split('/')[1])
+	const [, enabled_map] = agents.length > 0
+		? await get_skills_enabled_map(managed_short_names, agents, is_global, project_root)
+		: [null, new Map()]
+
 	const [, disk_skills] = await scan_skills_dir(base_dir)
-	const managed_names = new Set(managed_entries.map(([k]) => k.split('/')[1]))
+	const managed_names = new Set(managed_short_names)
 	const external_skills = (disk_skills || []).filter(s => !managed_names.has(s.name))
 
 	// Scan agent-specific dirs for skills placed directly in agent folders (not symlinked from .agents/skills/)
@@ -67,12 +78,14 @@ const run = (args) => catch_errors('List failed', async () => {
 	if (args.flags.json) {
 		const skills_map = {}
 		for (const [name, data] of managed_entries) {
-			const dir = skill_install_dir(base_dir, name.split('/')[1])
+			const short = name.split('/')[1]
+			const dir = skill_install_dir(base_dir, short)
 			const [, exists] = await file_exists(dir)
 			const status = exists ? 'installed' : 'missing'
 			const source = data.requested_by?.includes('__root__') ? 'direct' : 'dep'
 			const type = await resolve_type(name, data)
-			skills_map[name] = { version: data.version, type, source, status }
+			const enabled = enabled_map?.get(short) ?? true
+			skills_map[name] = { version: data.version, type, source, status, enabled }
 		}
 		const external = external_skills.map(s => ({ name: s.name, description: s.description || '' }))
 		const agent_orphan_list = orphan_skills.map(s => ({
@@ -86,25 +99,28 @@ const run = (args) => catch_errors('List failed', async () => {
 
 	const rows = []
 	for (const [name, data] of managed_entries) {
-		const dir = skill_install_dir(base_dir, name.split('/')[1])
+		const short = name.split('/')[1]
+		const dir = skill_install_dir(base_dir, short)
 		const [, exists] = await file_exists(dir)
 		const status = exists ? 'installed' : 'missing'
 		const source = data.requested_by?.includes('__root__') ? 'direct' : 'dep'
 		const type = await resolve_type(name, data)
 		const display_name = type === SKILL_TYPES.KIT ? `${name} [kit]` : name
-		rows.push([display_name, data.version, source, status])
+		const enabled = enabled_map?.get(short) ?? true
+		const enabled_label = enabled ? green('enabled') : yellow('disabled')
+		rows.push([display_name, data.version, source, status, enabled_label])
 	}
 
 	for (const s of external_skills) {
-		rows.push([s.name, '-', 'external', 'installed'])
+		rows.push([s.name, '-', 'external', 'installed', '-'])
 	}
 
 	for (const s of orphan_skills) {
 		const agent_label = s.agents.map(a => a.name).join(', ')
-		rows.push([s.name, '-', `agent-orphan (${agent_label})`, 'installed'])
+		rows.push([s.name, '-', `agent-orphan (${agent_label})`, 'installed', '-'])
 	}
 
-	print_table(['Skill', 'Version', 'Source', 'Status'], rows)
+	print_table(['Skill', 'Version', 'Source', 'Status', 'Enabled'], rows)
 }).then(([errors]) => { if (errors) { exit_with_error(errors); return } })
 
 module.exports = { run }

package/src/commands/update.js

@@ -1,7 +1,6 @@
-const path = require('path')
 const { error: { catch_errors, wrap_errors: e } } = require('puffy-core')
 const { install } = require('../engine/installer')
-const { read_lock, get_all_locked_skills } = require('../lock/reader')
+const { read_lock, get_all_locked_skills, get_via } = require('../lock/reader')
 const { detect_status } = require('../merge/detector')
 const { print_help, print_success, print_info, print_warn, print_json } = require('../ui/output')
 const { exit_with_error, UsageError } = require('../utils/errors')
@@ -48,7 +47,7 @@ const run = (args) => catch_errors('Update failed', async () => {
 
 	const to_update = target_skill
 		? [[target_skill, skills[target_skill]]]
-		: Object.entries(skills).filter(([, data]) => data.requested_by?.includes('__root__'))
+		: Object.entries(skills).filter(([, data]) => data !== null)
 
 	if (to_update.length === 0) {
 		if (args.flags.json) {
@@ -96,9 +95,9 @@ const run = (args) => catch_errors('Update failed', async () => {
 		const [errors, result] = await install(name, options)
 		if (errors) throw e(`Update ${name} failed`, errors)
 		if (!result.no_op) {
-			updated.push({ skill: name, from: before_version, to: result.version })
+			updated.push({ skill: name, from: before_version, to: result.version, via: get_via(data) })
 		} else {
-			already_up_to_date.push({ skill: name, version: result.version })
+			already_up_to_date.push({ skill: name, version: result.version, via: get_via(data) })
 		}
 	}
 

package/src/constants.js

@@ -38,7 +38,9 @@ const COMMAND_ALIASES = {
 	v: 'validate',
 	del: 'delete',
 	vis: 'visibility',
-	grp: 'groups'
+	grp: 'groups',
+	on: 'enable',
+	off: 'disable'
 }
 
 const COMMANDS = [
@@ -68,7 +70,9 @@ const COMMANDS = [
 	'config',
 	'people',
 	'groups',
-	'access'
+	'access',
+	'enable',
+	'disable'
 ]
 
 module.exports = {

package/src/engine/installer.js

@@ -12,6 +12,7 @@ const { skills_dir, tmp_dir, skill_install_dir, lock_root } = require('../config
 const { ensure_dir, remove_dir, file_exists, read_json } = require('../utils/fs')
 const { SKILL_JSON } = require('../constants')
 const { resolve_agents, link_to_agents } = require('../agents')
+const { is_skill_enabled } = require('../agents/status')
 const { create_spinner } = require('../ui/spinner')
 const { print_success, print_warn, print_info } = require('../ui/output')
 
@@ -95,6 +96,20 @@ const install = (skill, options = {}) => catch_errors('Install failed', async ()
 		return { skill, version: packages[0]?.version, no_op: true, installed: [], skipped, warnings: [], forced: [] }
 	}
 
+	// Capture disabled state before modifying disk — disabled skills stay disabled on update
+	const disabled_skills = new Set()
+	if (lock_data && agents.length > 0) {
+		await Promise.all(packages_to_install.map(async (pkg) => {
+			const name = pkg.skill.split('/')[1]
+			const dir = skill_install_dir(base_dir, name)
+			const [, exists] = await file_exists(dir)
+			if (exists) {
+				const [, enabled] = await is_skill_enabled(name, agents, is_global, project_root)
+				if (!enabled) disabled_skills.add(name)
+			}
+		}))
+	}
+
 	spinner.update(`Downloading ${packages_to_install.length} package(s)...`)
 
 	const [cleanup_err] = await remove_dir(temp_dir)
@@ -150,14 +165,23 @@ const install = (skill, options = {}) => catch_errors('Install failed', async ()
 		}
 
 		// Link to detected agents (non-fatal — warnings only)
+		// Skip linking for skills that were disabled before this install/update
 		if (agents.length > 0) {
-			spinner.update(`Linking to ${agents.length} agent(s)...`)
-			for (const { pkg } of downloaded) {
-				const name = pkg.skill.split('/')[1]
-				const source = skill_install_dir(base_dir, name)
-				const [link_errs] = await link_to_agents(source, agents, { global: is_global, project_root, skill_name: name })
-				if (link_errs) {
-					print_warn(`Warning: failed to link ${pkg.skill} to some agents`)
+			const to_link = downloaded.filter(({ pkg }) => !disabled_skills.has(pkg.skill.split('/')[1]))
+			if (to_link.length > 0) {
+				spinner.update(`Linking to ${agents.length} agent(s)...`)
+				for (const { pkg } of to_link) {
+					const name = pkg.skill.split('/')[1]
+					const source = skill_install_dir(base_dir, name)
+					const [link_errs] = await link_to_agents(source, agents, { global: is_global, project_root, skill_name: name })
+					if (link_errs) {
+						print_warn(`Warning: failed to link ${pkg.skill} to some agents`)
+					}
+				}
+			}
+			if (disabled_skills.size > 0) {
+				for (const name of disabled_skills) {
+					print_info(`${name} remains disabled — use happyskills enable to re-enable`)
 				}
 			}
 		}
@@ -196,7 +220,8 @@ const install = (skill, options = {}) => catch_errors('Install failed', async ()
 
 		spinner.succeed(`Installed ${packages_to_install.length} package(s)`)
 
-		if (agents.length > 0) {
+		const linked_count = downloaded.length - disabled_skills.size
+		if (agents.length > 0 && linked_count > 0) {
 			print_info(`Linked to: ${agents.map(a => a.display_name).join(', ')}`)
 		}
 

package/src/index.js

@@ -105,6 +105,8 @@ Commands:
   people <sub>             Manage workspace members (list, add, remove, role, search)
   groups <sub>             Manage workspace groups (list, create, delete, show, add, remove, default)
   access <sub>             Manage group skill access (list, grant, revoke, set)
+  enable <skill> [...]     Enable disabled skills (alias: on)
+  disable <skill> [...]    Disable skills without uninstalling (alias: off)
   login                    Authenticate with the registry
   logout                   Clear stored credentials
   whoami                   Show current user

package/src/integration/cli.test.js

@@ -688,3 +688,264 @@ describe('CLI — delete command', () => {
 		}
 	})
 })
+
+// ---------------------------------------------------------------------------
+// Enable / Disable
+// ---------------------------------------------------------------------------
+
+/**
+ * Helper: scaffold a project directory with a lock file and skill dirs that
+ * mimic a real HappySkills install. Returns { project_root, cleanup }.
+ *
+ * Structure:
+ *   <tmp>/
+ *   ├── skills-lock.json
+ *   ├── .agents/skills/<skill_name>/SKILL.md   (canonical)
+ *   └── .claude/skills/<skill_name> → symlink  (agent link)
+ */
+const scaffold_project = (skills) => {
+	const root = make_tmp()
+	const lock_skills = {}
+
+	for (const s of skills) {
+		const canonical = path.join(root, '.agents', 'skills', s.short)
+		fs.mkdirSync(canonical, { recursive: true })
+		fs.writeFileSync(path.join(canonical, 'SKILL.md'), `---\nname: ${s.short}\ndescription: test skill\n---\nTest`)
+
+		if (s.enabled !== false) {
+			const agent_dir = path.join(root, '.claude', 'skills')
+			fs.mkdirSync(agent_dir, { recursive: true })
+			fs.symlinkSync(canonical, path.join(agent_dir, s.short), 'junction')
+		}
+
+		lock_skills[s.full] = {
+			version: s.version || '1.0.0',
+			type: 'skill',
+			ref: `refs/tags/v${s.version || '1.0.0'}`,
+			commit: 'abc123',
+			integrity: null,
+			base_commit: 'abc123',
+			base_integrity: null,
+			requested_by: ['__root__'],
+			dependencies: {}
+		}
+	}
+
+	fs.writeFileSync(path.join(root, 'skills-lock.json'), JSON.stringify({
+		lockVersion: 2,
+		generatedAt: new Date().toISOString(),
+		skills: lock_skills
+	}, null, '\t'))
+
+	return { root, cleanup: () => fs.rmSync(root, { recursive: true, force: true }) }
+}
+
+describe('enable / disable commands', () => {
+	it('enable --help exits 0', () => {
+		const { code, stdout } = run(['enable', '--help'])
+		assert.strictEqual(code, 0)
+		assert.ok(stdout.includes('Usage: happyskills enable'))
+	})
+
+	it('disable --help exits 0', () => {
+		const { code, stdout } = run(['disable', '--help'])
+		assert.strictEqual(code, 0)
+		assert.ok(stdout.includes('Usage: happyskills disable'))
+	})
+
+	it('"on" alias resolves to enable', () => {
+		const { code, stdout } = run(['on', '--help'])
+		assert.strictEqual(code, 0)
+		assert.ok(stdout.includes('Usage: happyskills enable'))
+	})
+
+	it('"off" alias resolves to disable', () => {
+		const { code, stdout } = run(['off', '--help'])
+		assert.strictEqual(code, 0)
+		assert.ok(stdout.includes('Usage: happyskills disable'))
+	})
+
+	it('disable without arguments exits with usage error', () => {
+		const { code, stderr } = run(['disable', '--json'])
+		assert.strictEqual(code, 2)
+	})
+
+	it('enable without arguments exits with usage error', () => {
+		const { code, stderr } = run(['enable', '--json'])
+		assert.strictEqual(code, 2)
+	})
+
+	it('disable removes agent symlink, enable restores it', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws' }
+		])
+		try {
+			const link_path = path.join(root, '.claude', 'skills', 'deploy-aws')
+
+			// Verify symlink exists before disable
+			assert.ok(fs.lstatSync(link_path).isSymbolicLink())
+
+			// Disable — force agents to claude only (auto-detect won't find .claude in tmp)
+			const d = run(['disable', 'acme/deploy-aws', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(d.code, 0, `disable failed: ${d.stderr}`)
+			assert.ok(!fs.existsSync(link_path), 'symlink should be removed after disable')
+
+			// Canonical dir must still exist
+			assert.ok(fs.existsSync(path.join(root, '.agents', 'skills', 'deploy-aws')))
+
+			// Enable
+			const e = run(['enable', 'acme/deploy-aws', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(e.code, 0, `enable failed: ${e.stderr}`)
+			assert.ok(fs.lstatSync(link_path).isSymbolicLink(), 'symlink should be restored after enable')
+		} finally {
+			clean()
+		}
+	})
+
+	it('disable an already-disabled skill warns but does not fail', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws', enabled: false }
+		])
+		try {
+			const { code, stderr } = run(['disable', 'acme/deploy-aws', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			assert.ok(stderr.includes('already disabled'))
+		} finally {
+			clean()
+		}
+	})
+
+	it('enable an already-enabled skill warns but does not fail', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws', enabled: true }
+		])
+		try {
+			const { code, stderr } = run(['enable', 'acme/deploy-aws', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			assert.ok(stderr.includes('already enabled'))
+		} finally {
+			clean()
+		}
+	})
+
+	it('disable multiple skills at once', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws' },
+			{ full: 'acme/monitoring', short: 'monitoring' }
+		])
+		try {
+			const { code } = run(['disable', 'acme/deploy-aws', 'acme/monitoring', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+
+			assert.ok(!fs.existsSync(path.join(root, '.claude', 'skills', 'deploy-aws')))
+			assert.ok(!fs.existsSync(path.join(root, '.claude', 'skills', 'monitoring')))
+		} finally {
+			clean()
+		}
+	})
+
+	it('disable accepts short names', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws' }
+		])
+		try {
+			const { code } = run(['disable', 'deploy-aws', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			assert.ok(!fs.existsSync(path.join(root, '.claude', 'skills', 'deploy-aws')))
+		} finally {
+			clean()
+		}
+	})
+
+	it('enable accepts short names', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws', enabled: false }
+		])
+		try {
+			const { code } = run(['enable', 'deploy-aws', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			assert.ok(fs.lstatSync(path.join(root, '.claude', 'skills', 'deploy-aws')).isSymbolicLink())
+		} finally {
+			clean()
+		}
+	})
+
+	it('disable a non-existent skill warns but does not fail', () => {
+		const { root, cleanup: clean } = scaffold_project([])
+		try {
+			const { code, stderr } = run(['disable', 'acme/nope', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			assert.ok(stderr.includes('not a HappySkills-managed skill'))
+		} finally {
+			clean()
+		}
+	})
+
+	it('disable --json returns structured results', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws' }
+		])
+		try {
+			const { code, stdout } = run(['disable', 'acme/deploy-aws', '--agents', 'claude', '--json'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			const out = parse_json_output(stdout, 'disable --json')
+			assert.ok(out.data)
+			assert.ok(Array.isArray(out.data.results))
+			assert.strictEqual(out.data.results[0].skill, 'acme/deploy-aws')
+			assert.strictEqual(out.data.results[0].status, 'disabled')
+		} finally {
+			clean()
+		}
+	})
+
+	it('enable --json returns structured results', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws', enabled: false }
+		])
+		try {
+			const { code, stdout } = run(['enable', 'acme/deploy-aws', '--agents', 'claude', '--json'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			const out = parse_json_output(stdout, 'enable --json')
+			assert.ok(out.data)
+			assert.ok(Array.isArray(out.data.results))
+			assert.strictEqual(out.data.results[0].skill, 'acme/deploy-aws')
+			assert.strictEqual(out.data.results[0].status, 'enabled')
+		} finally {
+			clean()
+		}
+	})
+})
+
+describe('list — enabled column', () => {
+	it('list --json includes enabled field for managed skills', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws', enabled: true },
+			{ full: 'acme/monitoring', short: 'monitoring', enabled: false }
+		])
+		try {
+			const { code, stdout } = run(['list', '--json', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			const out = parse_json_output(stdout, 'list --json')
+			assert.strictEqual(out.data.skills['acme/deploy-aws'].enabled, true)
+			assert.strictEqual(out.data.skills['acme/monitoring'].enabled, false)
+		} finally {
+			clean()
+		}
+	})
+
+	it('list table output shows enabled/disabled labels', () => {
+		const { root, cleanup: clean } = scaffold_project([
+			{ full: 'acme/deploy-aws', short: 'deploy-aws', enabled: true },
+			{ full: 'acme/monitoring', short: 'monitoring', enabled: false }
+		])
+		try {
+			const { code, stdout } = run(['list', '--agents', 'claude'], {}, { cwd: root })
+			assert.strictEqual(code, 0)
+			assert.ok(stdout.includes('Enabled'), 'table should have Enabled header')
+			assert.ok(stdout.includes('enabled'), 'should show enabled label')
+			assert.ok(stdout.includes('disabled'), 'should show disabled label')
+		} finally {
+			clean()
+		}
+	})
+})

package/src/lock/reader.js

@@ -2,6 +2,7 @@ const { error: { catch_errors } } = require('puffy-core')
 const { read_json } = require('../utils/fs')
 const { lock_file_path } = require('../config/paths')
 const { LOCK_VERSION } = require('../constants')
+const { print_warn } = require('../ui/output')
 
 const read_lock = (project_root) => catch_errors('Failed to read lock file', async () => {
 	const lock_path = lock_file_path(project_root)
@@ -9,7 +10,6 @@ const read_lock = (project_root) => catch_errors('Failed to read lock file', asy
 	if (errors) return null
 
 	if (data.lockVersion !== LOCK_VERSION) {
-		const { print_warn } = require('../ui/output')
 		print_warn(`Lock file version mismatch (found ${data.lockVersion}, expected ${LOCK_VERSION}). Consider running with --fresh.`)
 	}
 
@@ -26,4 +26,10 @@ const get_all_locked_skills = (lock_data) => {
 	return lock_data.skills
 }
 
-module.exports = { read_lock, get_locked_skill, get_all_locked_skills }
+const get_via = (data) => {
+	const requester = data?.requested_by?.[0]
+	if (!requester || requester === '__root__') return null
+	return requester
+}
+
+module.exports = { read_lock, get_locked_skill, get_all_locked_skills, get_via }

package/src/lock/reader.test.js

@@ -5,7 +5,7 @@ const os = require('os')
 const path = require('path')
 const fs = require('fs')
 
-const { read_lock, get_locked_skill, get_all_locked_skills } = require('./reader')
+const { read_lock, get_locked_skill, get_all_locked_skills, get_via } = require('./reader')
 const { LOCK_VERSION } = require('../constants')
 
 // ─── helpers ──────────────────────────────────────────────────────────────────
@@ -126,3 +126,39 @@ describe('get_all_locked_skills', () => {
 		assert.deepEqual(get_all_locked_skills({ skills: {} }), {})
 	})
 })
+
+// ─── get_via ────────────────────────────────────────────────────────────────
+
+describe('get_via', () => {
+	it('returns null for a directly installed skill (__root__)', () => {
+		assert.strictEqual(get_via({ requested_by: ['__root__'] }), null)
+	})
+
+	it('returns the parent skill name for a dependency', () => {
+		assert.strictEqual(get_via({ requested_by: ['acme/deploy-aws'] }), 'acme/deploy-aws')
+	})
+
+	it('returns the kit name for a kit dependency', () => {
+		assert.strictEqual(get_via({ requested_by: ['acme/_kit-react'] }), 'acme/_kit-react')
+	})
+
+	it('returns the first requester when multiple exist', () => {
+		assert.strictEqual(get_via({ requested_by: ['acme/foo', 'acme/bar'] }), 'acme/foo')
+	})
+
+	it('returns null when requested_by is empty', () => {
+		assert.strictEqual(get_via({ requested_by: [] }), null)
+	})
+
+	it('returns null when requested_by is missing', () => {
+		assert.strictEqual(get_via({}), null)
+	})
+
+	it('returns null when data is null', () => {
+		assert.strictEqual(get_via(null), null)
+	})
+
+	it('returns null when data is undefined', () => {
+		assert.strictEqual(get_via(undefined), null)
+	})
+})