hngr 0.9.0 → 0.10.0

package/dist/{commands-Bjui8-Nt.mjs → commands-UsF7HECR.mjs}

@@ -1,4 +1,4 @@
-import { t as commandCatalog } from "./catalog-CmtREMFr.mjs";
+import { t as commandCatalog } from "./catalog-CfpeEevk.mjs";
 // src/commands/commands.ts
 function run(ctx) {
 	const catalog = commandCatalog();

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-CmtREMFr.mjs";
+import { a as kebabCase, i as normalizeCommandName, n as COMMANDS, o as COMMAND_ALIASES, r as findCommand, t as commandCatalog } from "./catalog-CfpeEevk.mjs";
 import { C as HngrError, S as CancelledError, c as redactUrlForDisplay, g as resolveConnection, i as buildRequestUrl, o as redactQuery, r as apiRequest, s as redactSensitive, u as DEFAULT_SERVER_URL, w as renderError } from "./http-CLG2jrIE.mjs";
 import { t as collectPages } from "./pagination-DtoXmj2F.mjs";
 import { createRequire } from "node:module";
@@ -5279,7 +5279,7 @@ function isYargsInstance(y) {
 // ../../node_modules/.pnpm/yargs@18.2.0/node_modules/yargs/index.mjs
 const Yargs = YargsFactory(esm_default);
 // package.json
-var version = "0.9.0";
+var version = "0.10.0";
 // src/generated/completion.ts
 function isCompletionShell(value) {
 	return value === "bash" || value === "zsh" || value === "fish";
@@ -7228,7 +7228,7 @@ function buildParser(onMatched) {
 	parser.command("commands", "Print the command catalog", () => {}, (argv) => {
 		onMatched({
 			argv,
-			run: async (ctx) => (await import("./commands-Bjui8-Nt.mjs")).run(ctx)
+			run: async (ctx) => (await import("./commands-UsF7HECR.mjs")).run(ctx)
 		});
 	});
 	parser.command("auth", "Manage credentials", (auth) => {
@@ -7280,6 +7280,114 @@ function buildParser(onMatched) {
 		registerGeneratedAuth(auth, onMatched);
 		return auth.demandCommand(1);
 	});
+	parser.command("sync", "Manage seek sync tasks", (sync) => {
+		sync.command("list", "List sync tasks", (list) => list.option("include-deleted", {
+			type: "boolean",
+			default: false,
+			describe: "Include soft-deleted tasks and their retained history"
+		}).option("limit", {
+			type: "number",
+			describe: "Maximum tasks per page"
+		}), (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).list(ctx, matchedArgv)
+			});
+		});
+		sync.command("create", "Create a sync task (disabled unless --enable)", (create) => create.option("namespace", {
+			type: "string",
+			demandOption: true,
+			describe: "Target Namespace name"
+		}).option("interval", {
+			type: "string",
+			describe: "5m, 15m, 1h, 6h, 24h or minutes (default: 1h)"
+		}).option("visibility", {
+			type: "string",
+			describe: "public | internal | private (default: internal)"
+		}).option("enable", {
+			type: "boolean",
+			default: false,
+			describe: "Enable the task immediately; a dry-run first is recommended"
+		}), (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).create(ctx, matchedArgv)
+			});
+		});
+		sync.command("show <task-id>", "Show one sync task", () => {}, (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).show(ctx, matchedArgv)
+			});
+		});
+		sync.command("update <task-id>", "Change a task's enabled state, interval or default visibility", (update) => update.option("enable", {
+			type: "boolean",
+			describe: "Enable the task"
+		}).option("disable", {
+			type: "boolean",
+			describe: "Disable the task"
+		}).option("interval", {
+			type: "string",
+			describe: "5m, 15m, 1h, 6h, 24h or minutes"
+		}).option("visibility", {
+			type: "string",
+			describe: "public | internal | private"
+		}).conflicts("enable", "disable"), (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).update(ctx, matchedArgv)
+			});
+		});
+		sync.command("delete <task-id>", "Soft-delete a task; Capabilities are kept", () => {}, (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).remove(ctx, matchedArgv)
+			});
+		});
+		sync.command("run <task-id>", "Start a manual run; --dry-run plans without writing", (run) => run.option("wait", {
+			type: "boolean",
+			default: false,
+			describe: "Wait for completion and print the per-Skill results"
+		}), (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).run(ctx, matchedArgv)
+			});
+		});
+		sync.command("runs", "Inspect a task's runs", (runs) => {
+			runs.command("list <task-id>", "List runs, newest first", (list) => list.option("limit", {
+				type: "number",
+				describe: "Maximum runs per page"
+			}), (argv) => {
+				onMatched({
+					argv,
+					run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).runs(ctx, matchedArgv)
+				});
+			});
+			runs.command("show <task-id> <run-id>", "Show one run and its per-Skill results", () => {}, (argv) => {
+				onMatched({
+					argv,
+					run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).runShow(ctx, matchedArgv)
+				});
+			});
+			return runs.demandCommand(1);
+		});
+		sync.command("items <task-id>", "Show the task's current per-Skill state", (items) => items.option("state", {
+			type: "string",
+			array: true,
+			nargs: 1,
+			describe: "Filter by state (repeatable): active, conflict, missing, orphaned, deleted_locally, error"
+		}).option("limit", {
+			type: "number",
+			describe: "Maximum items per page (default 50)"
+		}), (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./sync-D25awtDG.mjs")).items(ctx, matchedArgv)
+			});
+		});
+		return sync.demandCommand(1);
+	});
 	registerGeneratedCommands(parser, onMatched);
 	parser.command("skills", "Install skills into coding agent targets", (skills) => {
 		skills.command("add <paths..>", "Install skills from the catalog into agent targets", (add) => add.option("agent", {
@@ -7312,7 +7420,30 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-CqHGxo_M.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-gJqYAVg2.mjs")).add(ctx, matchedArgv)
+			});
+		});
+		skills.command("restore [names..]", "Reinstall skills recorded in the lock file", (restore) => restore.option("global", {
+			type: "boolean",
+			default: false,
+			describe: "Read the user-level lock file instead of the project one"
+		}).option("agent", {
+			type: "string",
+			array: true,
+			nargs: 1,
+			describe: "Agent target id (repeatable), e.g. claude-code"
+		}).option("all", {
+			type: "boolean",
+			default: false,
+			describe: "Install to every known agent target"
+		}).option("copy", {
+			type: "boolean",
+			default: false,
+			describe: "Copy into each target instead of canonical plus symlink"
+		}), (argv) => {
+			onMatched({
+				argv,
+				run: async (ctx, matchedArgv) => (await import("./skills-gJqYAVg2.mjs")).restore(ctx, matchedArgv)
 			});
 		});
 		skills.command("publish <paths..>", "Publish a local skill directory as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7340,7 +7471,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./skills-CqHGxo_M.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./skills-gJqYAVg2.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return skills.demandCommand(1);
@@ -7362,7 +7493,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-C-oJ6J5B.mjs")).add(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-BKyfjqcx.mjs")).add(ctx, matchedArgv)
 			});
 		});
 		mcp.command("publish <paths..>", "Publish an MCP snapshot as a capability or a new version", (publish) => publish.option("namespace", {
@@ -7390,7 +7521,7 @@ function buildParser(onMatched) {
 		}), (argv) => {
 			onMatched({
 				argv,
-				run: async (ctx, matchedArgv) => (await import("./mcp-C-oJ6J5B.mjs")).publish(ctx, matchedArgv)
+				run: async (ctx, matchedArgv) => (await import("./mcp-BKyfjqcx.mjs")).publish(ctx, matchedArgv)
 			});
 		});
 		return mcp.demandCommand(1);

package/dist/{mcp-C-oJ6J5B.mjs → mcp-BKyfjqcx.mjs}

@@ -1,5 +1,5 @@
 import { C as HngrError, g as resolveConnection, s as redactSensitive, t as apiFetch, x as writeFileAtomically } from "./http-CLG2jrIE.mjs";
-import { S as parseCapabilityPath, T as resolveCapabilityVersion, _ as downloadContent, a as errorBody, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND, w as resolveCapability } from "./scope-8BZjgIXy.mjs";
+import { C as parseCapabilityPath, E as resolveCapabilityVersion, T as resolveCapability, _ as downloadContent, a as errorBody, c as runBatch, h as findAgentDefinition, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, v as MCP_KIND } from "./scope-DRg-ddFn.mjs";
 import { constants } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

package/dist/{scope-8BZjgIXy.mjs → scope-DRg-ddFn.mjs}

@@ -156,6 +156,21 @@ async function resolveCapability(connection, parsed, kind, signal) {
 	}
 	return capability;
 }
+/**
+* Reads one Capability by id. A lock entry records only the Content URL, so
+* restoring it needs the Capability's namespace and name; a 404 means the
+* Capability is gone (or not readable), which callers report as a skip.
+*/
+async function lookupCapabilityById(connection, id, signal) {
+	try {
+		const body = await apiGet(connection, `${CAPABILITIES_PATH}/${encodeURIComponent(id)}`, void 0, { signal });
+		if (body === null || typeof body !== "object") return null;
+		return body;
+	} catch (err) {
+		if (err instanceof HngrError && err.body.status === 404) return null;
+		throw err;
+	}
+}
 /** The pinned version, or the capability's Current Version. */
 function resolveCapabilityVersion(capability, parsed, kind) {
 	if (parsed.version) return parsed.version;
@@ -681,4 +696,4 @@ async function resolveInstallScope(ctx, global) {
 	if (!select || ctx.flags.json || !ctx.io.stdin.isTTY || !ctx.io.stdout.isTTY) return "project";
 	return await select("Install scope", SCOPE_OPTIONS, "project") === "global" ? "global" : "project";
 }
-export { parseCapabilityTarget as C, parseCapabilityPath as S, resolveCapabilityVersion as T, downloadContent as _, errorBody as a, findCapability as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, resolveCapability as w, listCapabilityNamespace as x, SKILL_KIND as y };
+export { parseCapabilityPath as C, resolveCapabilityVersion as E, lookupCapabilityById as S, resolveCapability as T, downloadContent as _, errorBody as a, findCapability as b, runBatch as c, installAtomically as d, linkAtomically as f, homeDir as g, findAgentDefinition as h, runPublish as i, stringValues as l, AGENTS as m, explicitName as n, failedResult as o, pathExists as p, readPublishFlags as r, positionalPaths as s, resolveInstallScope as t, copyAtomically as u, MCP_KIND as v, parseCapabilityTarget as w, listCapabilityNamespace as x, SKILL_KIND as y };

package/dist/{skills-CqHGxo_M.mjs → skills-gJqYAVg2.mjs}

@@ -1,8 +1,8 @@
-import { C as HngrError, g as resolveConnection, r as apiRequest } from "./http-CLG2jrIE.mjs";
-import { C as parseCapabilityTarget, S as parseCapabilityPath, T as resolveCapabilityVersion, _ as downloadContent, a as errorBody, b as findCapability, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, w as resolveCapability, x as listCapabilityNamespace, y as SKILL_KIND } from "./scope-8BZjgIXy.mjs";
+import { C as HngrError, g as resolveConnection, r as apiRequest, x as writeFileAtomically } from "./http-CLG2jrIE.mjs";
+import { C as parseCapabilityPath, E as resolveCapabilityVersion, S as lookupCapabilityById, T as resolveCapability, _ as downloadContent, a as errorBody, b as findCapability, c as runBatch, d as installAtomically, f as linkAtomically, g as homeDir, i as runPublish, l as stringValues, m as AGENTS, n as explicitName, o as failedResult, p as pathExists, r as readPublishFlags, s as positionalPaths, t as resolveInstallScope, u as copyAtomically, w as parseCapabilityTarget, x as listCapabilityNamespace, y as SKILL_KIND } from "./scope-DRg-ddFn.mjs";
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
 // src/http-multipart.ts
 function isFile(part) {
@@ -88,6 +88,192 @@ function isReservedDirName(name) {
 function downloadSkillPackage(connection, capabilityId, version, signal) {
 	return downloadContent(connection, capabilityId, version, "application/zip", signal);
 }
+function projectLockPath(cwd) {
+	return join(cwd, "skills-lock.json");
+}
+/** `$XDG_STATE_HOME/skills/.skill-lock.json`, or `~/.agents/.skill-lock.json`. */
+function globalLockPath(env) {
+	const state = env.XDG_STATE_HOME;
+	return state && state.length > 0 ? join(state, "skills", ".skill-lock.json") : join(homeDir(env), ".agents", ".skill-lock.json");
+}
+/**
+* Reads a lock file. An absent file is not an error. A malformed file, or one
+* whose schema version this CLI does not write, is reported instead of being
+* replaced: another tool owns that file, and clobbering it would lose entries.
+*/
+async function readLockDocument(path, version) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch (err) {
+		if (isNotFound(err)) return { status: "absent" };
+		return {
+			status: "unusable",
+			reason: errorText(err)
+		};
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		return {
+			status: "unusable",
+			reason: `it is not valid JSON: ${errorText(err)}`
+		};
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {
+		status: "unusable",
+		reason: "its top level is not an object"
+	};
+	const document = parsed;
+	if (document.version !== version) return {
+		status: "unusable",
+		reason: `its version is ${JSON.stringify(document.version)}, but this command writes version ${version}`
+	};
+	if (document.skills === null || typeof document.skills !== "object" || Array.isArray(document.skills)) return {
+		status: "unusable",
+		reason: "its skills field is not an object"
+	};
+	return {
+		status: "ok",
+		document
+	};
+}
+/**
+* Writes a lock file the way `npx skills` does: skill keys sorted, two-space
+* JSON and a trailing newline. Top-level fields and skill entries are
+* preserved; only the entry this install owns is replaced.
+*/
+async function writeLockDocument(path, document) {
+	const skills = {};
+	for (const name of Object.keys(document.skills).sort()) skills[name] = document.skills[name];
+	await writeFileAtomically(path, `${JSON.stringify({
+		...document,
+		skills
+	}, null, 2)}\n`);
+}
+/** Records a project install in `<cwd>/skills-lock.json`. */
+async function recordProjectInstall(cwd, install) {
+	const path = projectLockPath(cwd);
+	const read = await readLockDocument(path, 2);
+	if (read.status === "unusable") return {
+		status: "skipped",
+		reason: `left ${path} alone: ${read.reason}`
+	};
+	const document = read.status === "ok" ? read.document : {
+		version: 2,
+		skills: {}
+	};
+	const existing = document.skills[install.name];
+	document.skills[install.name] = {
+		...existing,
+		...downloadFields(install),
+		computedHash: install.computedHash,
+		installMode: install.copy ? "copy" : void 0
+	};
+	await writeLockDocument(path, document);
+	return { status: "written" };
+}
+/** Records a global install in the user-level lock file. */
+async function recordGlobalInstall(env, install, now) {
+	const path = globalLockPath(env);
+	const read = await readLockDocument(path, 3);
+	if (read.status === "unusable") return {
+		status: "skipped",
+		reason: `left ${path} alone: ${read.reason}`
+	};
+	const document = read.status === "ok" ? read.document : {
+		version: 3,
+		skills: {}
+	};
+	const existing = document.skills[install.name];
+	const timestamp = now.toISOString();
+	document.skills[install.name] = {
+		...existing,
+		...downloadFields(install),
+		skillFolderHash: install.computedHash,
+		installedAt: typeof existing?.installedAt === "string" ? existing.installedAt : timestamp,
+		updatedAt: timestamp,
+		installMode: install.copy ? "copy" : void 0
+	};
+	await writeLockDocument(path, document);
+	return { status: "written" };
+}
+/**
+* The fields `npx skills` writes for a direct download source. `source` and
+* `sourceUrl` both carry the Content URL: it is the exact ZIP the install
+* consumed, so `npx skills update` can re-fetch and compare it.
+*/
+function downloadFields(install) {
+	return {
+		source: install.contentUrl,
+		sourceUrl: install.contentUrl,
+		sourceType: "download",
+		skillPath: install.skillPath
+	};
+}
+/** The Hangar Content URL for one Capability Version. */
+function hangarContentUrl(server, capabilityId, version) {
+	return `${server}/api/v1/capabilities/${encodeURIComponent(capabilityId)}/versions/${encodeURIComponent(version)}/content`;
+}
+/**
+* Reads a Hangar Content URL recorded in a lock entry. Only URLs under the
+* configured server match: an entry another installation wrote belongs to
+* that installation, not this one.
+*/
+function parseHangarContentUrl(sourceUrl, server) {
+	if (!sourceUrl) return null;
+	const prefix = `${server}/api/v1/capabilities/`;
+	if (!sourceUrl.startsWith(prefix)) return null;
+	const match = /^([^/]+)\/versions\/([^/]+)\/content$/.exec(sourceUrl.slice(prefix.length));
+	if (!match) return null;
+	return {
+		capabilityId: decodeURIComponent(match[1]),
+		version: decodeURIComponent(match[2])
+	};
+}
+/**
+* The portable content hash `npx skills` records as `computedHash` (v2) and
+* `skillFolderHash` (v3): files sorted by the UTF-8 bytes of their paths, each
+* framed as `path NUL length NUL content`, with CRLF normalized to LF in text
+* files and build metadata excluded. It must match byte for byte, or
+* `npx skills list` reports the install as modified.
+*/
+function portableSkillHash(entries) {
+	const files = entries.filter((entry) => !isExcludedPath(entry.path)).map((entry) => ({
+		path: Buffer.from(entry.path.split("\\").join("/"), "utf8"),
+		content: normalizeLineEndings(entry.data)
+	})).sort((left, right) => Buffer.compare(left.path, right.path));
+	const hash = createHash("sha256");
+	for (const file of files) {
+		hash.update(file.path);
+		hash.update("\0");
+		hash.update(String(file.content.length));
+		hash.update("\0");
+		hash.update(file.content);
+	}
+	return hash.digest("hex");
+}
+/** npx skills' exclusions, applied to the same relative paths. */
+function isExcludedPath(path) {
+	const parts = path.split(/[\\/]/).filter(Boolean);
+	return parts.some((part, index) => isExcluded(part, index < parts.length - 1));
+}
+function isExcluded(name, isDirectory) {
+	if (name === "metadata.json") return true;
+	return isDirectory && (name === ".git" || name === "__pycache__" || name === "__pypackages__");
+}
+/** Text files get CRLF replaced by LF; a NUL byte marks a binary file. */
+function normalizeLineEndings(content) {
+	if (content.includes(0) || !content.includes("\r\n")) return content;
+	return Buffer.from(content.toString("latin1").replaceAll("\r\n", "\n"), "latin1");
+}
+function isNotFound(err) {
+	return err instanceof Error && "code" in err && err.code === "ENOENT";
+}
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
 // src/skills/resolve.ts
 /** Parses `<name>` or `<namespace>/<name>`, with an optional `@YYYY.MM.DD.N`. */
 function parseSkillPath(raw) {
@@ -265,7 +451,8 @@ function readSkillPackage(buffer) {
 	if (!manifest) throw invalid$1("the package has no SKILL.md");
 	return {
 		entries,
-		manifest
+		manifest,
+		skillPath: `${root}SKILL.md`
 	};
 }
 // src/skills/zip-write.ts
@@ -877,6 +1064,27 @@ function installSummary(outcome, canonicalPath) {
 	if (failed.length > 0) lines.push(`  failed: ${failed.map((target) => target.path).join(", ")}`);
 	return lines.join("\n");
 }
+/**
+* Records the install in the lock file `npx skills` reads, so either tool can
+* list, update and remove it. A lock file another schema version owns is left
+* alone, and a write failure only warns: the skill is already on disk.
+*/
+async function recordLockEntry(ctx, connection, name, capabilityId, version, pkg, global, copy) {
+	const install = {
+		name,
+		contentUrl: hangarContentUrl(connection.server, capabilityId, version),
+		skillPath: pkg.skillPath,
+		computedHash: portableSkillHash(pkg.entries),
+		copy
+	};
+	try {
+		const outcome = global ? await recordGlobalInstall(ctx.env, install, /* @__PURE__ */ new Date()) : await recordProjectInstall(process.cwd(), install);
+		if (outcome.status === "skipped") ctx.summary(`warning: ${outcome.reason}`);
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		ctx.summary(`warning: could not update the skills lock file: ${detail}`);
+	}
+}
 async function addOne(ctx, connection, parsed, destName, agents, dir, global, copy, state, resolved) {
 	const capability = resolved ?? await resolveSkill(connection, parsed);
 	const version = resolveVersion(capability, parsed);
@@ -910,6 +1118,7 @@ async function addOne(ctx, connection, parsed, destName, agents, dir, global, co
 	const declaredName = frontmatterName(pkg.manifest);
 	if (declaredName !== void 0 && declaredName !== destName) ctx.summary(`warning: SKILL.md declares name ${JSON.stringify(declaredName)} but the directory is ${JSON.stringify(destName)}`);
 	const outcome = await install(ctx, plan, pkg.entries);
+	if (dir === void 0 && outcome.targets.some((target) => target.status === "installed")) await recordLockEntry(ctx, connection, destName, capability.id, version, pkg, global, copy);
 	const verb = outcome.failure ? "Partially installed" : "Installed";
 	const note = ctx.io.prompts?.note;
 	if (!ctx.flags.json && !ctx.flags.quiet && ctx.io.stderr.isTTY && note) note(installSummary(outcome, canonicalPath), `${verb} ${capability.namespace}/${capability.name}@${version}`);
@@ -1109,4 +1318,50 @@ async function add(ctx, argv) {
 	if (!ctx.flags.json && !ctx.flags.dryRun && !ctx.flags.quiet && !failed && ctx.io.stderr.isTTY) ctx.io.prompts?.outro?.("Done! Review skills before use; they run with full agent permissions.");
 	return failed ? 1 : 0;
 }
-export { add, publish };
+/**
+* Reinstalls the skills a lock file records. Only entries this CLI wrote —
+* a Hangar Content URL under the configured server — are restored; entries
+* another tool owns are reported and left untouched. The normal `add` path
+* performs the install, so agent selection, `--copy` and scope behave alike.
+*/
+async function restore(ctx, argv) {
+	const global = argv.global === true;
+	const connection = await resolveConnection(ctx.flags, ctx.env);
+	const path = global ? globalLockPath(ctx.env) : projectLockPath(process.cwd());
+	const shown = displayPath(path, process.cwd());
+	const read = await readLockDocument(path, global ? 3 : 2);
+	if (read.status === "absent") {
+		ctx.detail(`No lock file at ${shown}.`);
+		return 0;
+	}
+	if (read.status === "unusable") throw usage("Cannot read the lock file", `${shown}: ${read.reason}`);
+	const names = positionalPaths(argv.names);
+	const wanted = names.length > 0 ? new Set(names) : null;
+	const refs = [];
+	const skipped = [];
+	for (const name of Object.keys(read.document.skills).sort()) {
+		if (wanted !== null && !wanted.has(name)) continue;
+		const entry = read.document.skills[name];
+		const reference = parseHangarContentUrl(entry.sourceUrl ?? entry.source, connection.server);
+		if (reference === null) {
+			skipped.push(name);
+			continue;
+		}
+		const capability = await lookupCapabilityById(connection, reference.capabilityId);
+		if (capability === null || capability.kind !== "skill" || capability.name !== name) {
+			skipped.push(name);
+			continue;
+		}
+		refs.push(`${capability.namespace}/${capability.name}@${reference.version}`);
+	}
+	if (skipped.length > 0) ctx.summary(`warning: skipped ${skipped.join(", ")}: not installed from ${connection.server}`);
+	if (refs.length === 0) {
+		ctx.detail(`Nothing to restore from ${shown}.`);
+		return 0;
+	}
+	return add(ctx, {
+		...argv,
+		paths: refs
+	});
+}
+export { add, publish, restore };