lshed 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.2.1 — 2026-09-02
+
+- `lshed list [--unused]` shows everything in the shed and which profiles use it.
+- `lshed remove <key>` deletes a component or package from the shed. Refused while any profile still references it. Packages leave the manifest and lock only; the local clone stays.
+- `lshed prune [--yes]` removes everything no profile uses. Lists without `--yes`.
+- Manifest edits preserve your comments. Empty `packages:` is no longer written.
+
+## 0.2.0 — 2026-09-02
+
+A harness holds three kinds of things, and 0.1 treated them all the same. Running against a real `~/.claude` showed that 55 of 62 "skills" were files generated by one toolkit's installer, and the toolkit itself was a git clone.
+
+- **Packages.** A `packages:` list in `lshed.yaml` records things you *installed* by source and version instead of copying them: `source: github:owner/repo@ref` (or `git:<url>#ref`), `into: <path under the agent root>`, optional `install: <command>`. `restore` clones a missing package at the commit pinned in `lshed.lock`; a package already present is never touched.
+- **Generated files are skipped.** `init` recognises a directory as a package when it contains a `.git` with a remote, and recognises a stub as generated when one of its symlinks points inside a package. Both are left out of the shed and the managed set. Aliases that an installer creates without symlinks are not detected; use `init --exclude`.
+- **`lshed.lock`** pins each package to a commit. Written by `init` from the existing clone, by `restore` on first clone, and by `update`.
+- **`lshed update [ids...]`** fast-forwards packages and refreshes the lock.
+- **Install commands run only with `--yes`.** Without it, `restore` and `update` print the commands and stop. A shed can be cloned from anywhere; running its shell commands should be a deliberate act.
+- `git:` source scheme for non-GitHub remotes.
+
+Packages are additive: switching to a profile that does not list one leaves it on disk. Removing a clone with a backup would mean copying a repository, which is the wrong tool for that job.
+
+## 0.1.1 — 2026-09-02
+
+Both fixes came from running 0.1.0 against a real 62-skill `~/.claude`.
+
+- Skip regenerable directories when copying: `node_modules`, `.git`, `__pycache__`, `.venv`, cache dirs, `*.log`. A real harness went from 1.6 GB to 6.2 MB. Build output such as `dist/` is **not** ignored by default, because for some skills it is the deliverable.
+- Extend the list with `ignore:` in `lshed.yaml`; the same list applies to `diff`, `save` and backups, so ignored files never show up as drift.
+- Follow symlinks. A skill symlinked into `~/.claude/skills` used to be skipped silently; it is now captured and copied by content. Broken links are skipped.
+- `init --exclude <id...>` leaves out components that do not belong in a shed, such as a toolkit with its own installer.
+
 ## 0.1.0 — 2026-09-02
 
 First working release. Claude Code only.

package/README.md

@@ -76,24 +76,70 @@ profiles:
     instructions: [base]
 ```
 
-- `source` accepts `file:<path relative to the shed>`. `github:owner/repo@ref` is parsed and reserved for a future release; using it today is an error, not silent misbehaviour.
+- Component `source` accepts `file:<path relative to the shed>`. Package `source` accepts `github:owner/repo@ref` or `git:<url>#ref`.
 - Category names come from the adapter. For Claude Code: `skills`, `agents`, `commands`, `instructions`.
+- `ignore:` at the top level adds to the built-in list of things never copied: `node_modules`, `.git`, `__pycache__`, `.venv`, cache directories, `*.log`. Build output like `dist/` is not ignored by default, since some skills ship it. Add it yourself if your parts rebuild from source.
 - Instructions are not merged. `restore` writes a `CLAUDE.md` that `@`-imports each fragment in order, so a fragment edit shows up without re-running anything. Your original `CLAUDE.md` is backed up the first time.
 
+## Three kinds of things
+
+A real `~/.claude` mixes three kinds of content, and they need different handling:
+
+| Kind | Example | What lshed does |
+|---|---|---|
+| **Authored** | a skill you wrote, your `CLAUDE.md` | copies it into the shed |
+| **Installed** | a toolkit you `git clone`d, a plugin | records source + commit; `restore` clones it back |
+| **Generated** | stub skills an installer wrote for you | skips them; they return when the installer runs |
+
+`init` sorts this out for you. A directory with a `.git` and a remote becomes a **package**. A skill whose symlink points inside a package is treated as generated and skipped. Everything else is authored and copied.
+
+```yaml
+packages:
+  - id: gstack
+    source: github:garrytan/gstack@main   # git:<url>#ref for other hosts
+    into: skills/gstack                   # where it lives under ~/.claude
+    install: ./setup                      # optional; run after clone, only with --yes
+
+profiles:
+  default:
+    packages: [gstack]
+    skills: [add-drivers, domain-modeling]
+```
+
+`lshed.lock` pins each package to a commit, so a fresh machine gets the same version you had. `lshed update` moves it forward.
+
+Rules that keep this safe:
+
+- A package that is already present is never touched by `restore`. Your local checkout is yours.
+- `install:` is a shell command. `restore` and `update` **print it and stop** unless you pass `--yes`.
+- Packages are not part of the managed set. Switching profiles never deletes a clone.
+- Installers sometimes create aliases without symlinks, which `init` cannot tell from authored skills. Leave those out with `--exclude`:
+
+```bash
+lshed init --shed ~/harness --exclude _gstack-command connect-chrome
+```
+
 ## Commands
 
 ```
-lshed init [--shed <dir>] [--profile <name>]   scan the current environment into a shed
-lshed restore [profile] [--dry-run] [--no-backup]
-lshed status                                    applied profile, managed paths, drift
+lshed init [--shed <dir>] [--profile <name>] [--exclude <id...>]
+lshed restore [profile] [--dry-run] [--no-backup] [--yes]
+lshed update [ids...] [--dry-run] [--yes]       pull packages forward, refresh lshed.lock
+lshed status                                    applied profile, managed paths, drift, packages
 lshed diff                                      files that differ between local and shed
 lshed save [ids...]                             copy local edits back into the shed
+lshed list [--unused]                           what is in the shed, and which profiles use it
+lshed remove <key>                              drop a component or package from the shed
+lshed prune [--yes]                             drop everything no profile uses
 ```
 
+`remove` and `prune` delete from the shed without a backup. The shed is meant to live in git; commit before you prune. Both refuse to touch anything a profile still lists, so the way to retire a part is to take it out of the profiles first.
+
 Global options: `--shed <dir>` (or `LSHED_HOME`; after the first restore lshed remembers it), `--root <dir>` (agent config root, default `~/.claude`).
 
 ### What `restore` does
 
+0. Clones any package in the profile that is missing, at the commit in `lshed.lock`.
 1. Removes paths that the **previous** profile placed and the new one doesn't need.
 2. Copies every part of the new profile into place.
 3. Regenerates the instructions file.
@@ -102,7 +148,7 @@ Anything it overwrites or removes is backed up first under `~/.claude/lshed/back
 
 ### Ownership
 
-The shed is the source of truth. `save` copies local edits back for `file:` parts only. Remote parts will be read-only and refreshed with `update` once remote sources land.
+The shed is the source of truth for authored parts: `save` copies local edits back for `file:` components. Packages are owned by their upstream: `update` pulls them, `save` ignores them.
 
 ## Where things live
 
@@ -124,7 +170,8 @@ The shed is the source of truth. `save` copies local edits back for `file:` part
 
 - MCP servers and secrets. Planned: the manifest names the keys, values are injected locally, nothing secret enters the shed.
 - `settings.json` merging (hooks, permissions).
-- Remote sources (`github:`), lock file, `update`, `list --unused`, `prune`.
+- `sync` (a git pull/push wrapper). Use git in the shed directly for now.
+- Plugins installed through Claude Code's marketplace. They are packages too; recording them is next.
 - Windows and macOS have not been tested. The code avoids platform-specific paths, but treat 0.1 as Linux/WSL.
 
 ## Troubleshooting

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { Command } from "commander";
 import { createRequire } from "module";
 import os2 from "os";
-import path9 from "path";
+import path13 from "path";
 
 // src/adapters/claude-code.ts
 import { promises as fs } from "fs";
@@ -43,10 +43,17 @@ var ClaudeCodeAdapter = class {
       }
       for (const e of entries) {
         if (e.name.startsWith(".")) continue;
-        if (cat.kind === "dir" && e.isDirectory()) {
-          out.push({ category: cat.name, id: e.name, path: path.join(dir, e.name) });
-        } else if (cat.kind === "file" && e.isFile() && e.name.endsWith(".md")) {
-          out.push({ category: cat.name, id: e.name.slice(0, -3), path: path.join(dir, e.name) });
+        const full = path.join(dir, e.name);
+        let st;
+        try {
+          st = await fs.stat(full);
+        } catch {
+          continue;
+        }
+        if (cat.kind === "dir" && st.isDirectory()) {
+          out.push({ category: cat.name, id: e.name, path: full });
+        } else if (cat.kind === "file" && st.isFile() && e.name.endsWith(".md")) {
+          out.push({ category: cat.name, id: e.name.slice(0, -3), path: full });
         }
       }
     }
@@ -55,8 +62,8 @@ var ClaudeCodeAdapter = class {
 };
 
 // src/core/init.ts
-import { promises as fs5 } from "fs";
-import path7 from "path";
+import { promises as fs7 } from "fs";
+import path10 from "path";
 
 // src/core/context.ts
 import { promises as fs3 } from "fs";
@@ -85,10 +92,37 @@ function parseSource(raw) {
       const [, owner, repo, ref, subpath] = m;
       return { scheme, owner, repo, ref, subpath };
     }
+    case "git": {
+      const hash = rest.lastIndexOf("#");
+      const url = hash >= 0 ? rest.slice(0, hash) : rest;
+      const ref = hash >= 0 ? rest.slice(hash + 1) : void 0;
+      if (!url) throw new Error(`git: \uB4A4\uC5D0 URL \uC774 \uC5C6\uC2B5\uB2C8\uB2E4: "${raw}"`);
+      return { scheme, url, ref: ref || void 0 };
+    }
     default:
       throw new Error(`\uC54C \uC218 \uC5C6\uB294 \uC2A4\uD0B4 "${scheme}": "${raw}"`);
   }
 }
+function formatSource(s) {
+  switch (s.scheme) {
+    case "file":
+      return `file:${s.path}`;
+    case "github":
+      return `github:${s.owner}/${s.repo}${s.ref ? `@${s.ref}` : ""}${s.subpath ? `#${s.subpath}` : ""}`;
+    case "git":
+      return `git:${s.url}${s.ref ? `#${s.ref}` : ""}`;
+  }
+}
+function cloneTarget(s) {
+  if (s.scheme === "github") return { url: `https://github.com/${s.owner}/${s.repo}.git`, ref: s.ref };
+  if (s.scheme === "git") return { url: s.url, ref: s.ref };
+  throw new Error(`file: \uCD9C\uCC98\uB294 clone \uB300\uC0C1\uC774 \uC544\uB2D9\uB2C8\uB2E4`);
+}
+function sourceFromRemote(url, ref) {
+  const m = /^(?:https?:\/\/github\.com\/|git@github\.com:)([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url);
+  if (m) return formatSource({ scheme: "github", owner: m[1], repo: m[2], ref });
+  return formatSource({ scheme: "git", url, ref });
+}
 
 // src/manifest.ts
 var ComponentSchema = z.object({
@@ -96,12 +130,22 @@ var ComponentSchema = z.object({
   source: z.string().optional(),
   tags: z.array(z.string()).optional()
 });
+var PackageSchema = z.object({
+  id: z.string().regex(/^[\w.-]+$/, "id\uB294 \uC601\uBB38\xB7\uC22B\uC790\xB7._- \uB9CC \uD5C8\uC6A9"),
+  source: z.string(),
+  into: z.string().regex(/^[^/\\][^\\]*$/, "into \uB294 \uB8E8\uD2B8 \uAE30\uC900 \uC0C1\uB300 \uACBD\uB85C (POSIX)"),
+  install: z.string().optional()
+});
+var PACKAGES = "packages";
 var ComponentsSchema = z.record(z.string(), z.array(ComponentSchema));
 var ProfileSchema = z.record(z.string(), z.array(z.string()));
 var ManifestSchema = z.object({
   version: z.literal(1),
   agent: z.string().default("claude-code"),
+  /** 창고에 담지 않을 이름들. 기본값(DEFAULT_IGNORE)에 더해진다. */
+  ignore: z.array(z.string()).optional(),
   components: ComponentsSchema.default({}),
+  packages: z.array(PackageSchema).default([]),
   profiles: z.record(z.string(), ProfileSchema).default({})
 });
 var ManifestError = class extends Error {
@@ -131,8 +175,22 @@ ${lines.join("\n")}`);
       }
     }
   }
+  const pkgIds = /* @__PURE__ */ new Set();
+  for (const p of m.packages) {
+    if (pkgIds.has(p.id)) problems.push(`packages: id "${p.id}" \uC911\uBCF5`);
+    pkgIds.add(p.id);
+    try {
+      if (parseSource(p.source).scheme === "file") problems.push(`packages/${p.id}: \uD328\uD0A4\uC9C0 \uCD9C\uCC98\uB294 github: \uB610\uB294 git: \uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4`);
+    } catch (e) {
+      problems.push(`packages/${p.id}: ${e.message}`);
+    }
+  }
   for (const [profile, cats] of Object.entries(m.profiles)) {
     for (const [cat, ids] of Object.entries(cats)) {
+      if (cat === PACKAGES) {
+        for (const id of ids) if (!pkgIds.has(id)) problems.push(`profiles.${profile}.packages: "${id}" \uB294 packages \uC5D0 \uC5C6\uC74C`);
+        continue;
+      }
       const available = new Set((m.components[cat] ?? []).map((c) => c.id));
       for (const id of ids) {
         if (!available.has(id)) problems.push(`profiles.${profile}.${cat}: "${id}" \uB294 components\uC5D0 \uC5C6\uC74C`);
@@ -147,7 +205,14 @@ function effectiveSource(category, c, kind = "dir") {
   return c.source ?? `file:./${category}/${c.id}${kind === "file" ? ".md" : ""}`;
 }
 function stringifyManifest(m) {
-  return YAML.stringify(m, { lineWidth: 0 });
+  const out = { ...m };
+  if (!m.packages.length) delete out.packages;
+  if (!m.ignore?.length) delete out.ignore;
+  return YAML.stringify(out, { lineWidth: 0 });
+}
+function packagesOf(m, profile) {
+  const ids = m.profiles[profile]?.[PACKAGES] ?? [];
+  return ids.map((id) => m.packages.find((p) => p.id === id));
 }
 
 // src/resolvers/file.ts
@@ -191,6 +256,26 @@ async function writeState(adapter, state) {
   await fs2.writeFile(p, JSON.stringify(state, null, 2) + "\n");
 }
 
+// src/ignore.ts
+var DEFAULT_IGNORE = [
+  "node_modules",
+  ".git",
+  "__pycache__",
+  ".venv",
+  ".mypy_cache",
+  ".pytest_cache",
+  ".DS_Store",
+  "*.log"
+];
+function matches(name, pattern) {
+  if (pattern.startsWith("*.")) return name.endsWith(pattern.slice(1));
+  return name === pattern;
+}
+function isIgnored(rel, patterns) {
+  if (!rel) return false;
+  return rel.split("/").some((seg) => patterns.some((p) => matches(seg, p)));
+}
+
 // src/core/context.ts
 var MANIFEST_FILE = "lshed.yaml";
 var INSTRUCTIONS = "instructions";
@@ -209,7 +294,12 @@ async function loadManifest(ctx) {
     throw new Error(`\uCC3D\uACE0\uC5D0 ${MANIFEST_FILE} \uC774 \uC5C6\uC2B5\uB2C8\uB2E4: ${ctx.shed}
   \uBA3C\uC800 'lshed init --shed ${ctx.shed}' \uB97C \uC2E4\uD589\uD558\uC138\uC694.`);
   }
-  return parseManifest(text, knownCategories(ctx.adapter));
+  const m = parseManifest(text, knownCategories(ctx.adapter));
+  ctx.ignore = [...DEFAULT_IGNORE, ...m.ignore ?? []];
+  return m;
+}
+function ignoreOf(ctx) {
+  return ctx.ignore ?? DEFAULT_IGNORE;
 }
 function targetRel(cat, id) {
   if (cat === INSTRUCTIONS) return `${FRAGMENTS_DIR}/${id}.md`;
@@ -221,7 +311,7 @@ function sourcePath(ctx, category, c) {
   return resolveSource(ctx.shed, effectiveSource(category, c, kind));
 }
 function findComponent(m, category, id) {
-  const c = (m.components[category] ?? []).find((x) => x.id === id);
+  const c = (m.components[category] ?? []).find((x2) => x2.id === id);
   if (!c) throw new Error(`${category}/${id} \uB294 components \uC5D0 \uC5C6\uC2B5\uB2C8\uB2E4`);
   return c;
 }
@@ -233,6 +323,7 @@ function planProfile(ctx, m, profile) {
   }
   const items = [];
   for (const [category, ids] of Object.entries(p)) {
+    if (category === PACKAGES) continue;
     const cat = category === INSTRUCTIONS ? INSTRUCTIONS : ctx.adapter.categories().find((k) => k.name === category);
     if (!cat) throw new Error(`\uD504\uB85C\uD544 "${profile}": \uC5B4\uB311\uD130 ${ctx.adapter.name} \uC740 \uCE74\uD14C\uACE0\uB9AC "${category}" \uB97C \uBAA8\uB985\uB2C8\uB2E4`);
     for (const id of ids) {
@@ -265,7 +356,7 @@ async function isDir(p) {
     return false;
   }
 }
-async function listFiles(root) {
+async function listFiles(root, ignore = DEFAULT_IGNORE) {
   if (!await exists(root)) return [];
   if (!await isDir(root)) return [""];
   const out = [];
@@ -273,8 +364,16 @@ async function listFiles(root) {
     const entries = await fs4.readdir(dir, { withFileTypes: true });
     for (const e of entries) {
       const r = rel ? `${rel}/${e.name}` : e.name;
-      if (e.isDirectory()) await walk(path5.join(dir, e.name), r);
-      else if (e.isFile()) out.push(r);
+      if (isIgnored(r, ignore)) continue;
+      const full = path5.join(dir, e.name);
+      let st;
+      try {
+        st = await fs4.stat(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) await walk(full, r);
+      else if (st.isFile()) out.push(r);
     }
   }
   await walk(root, "");
@@ -283,25 +382,39 @@ async function listFiles(root) {
 async function hashFile(p) {
   return createHash("sha256").update(await fs4.readFile(p)).digest("hex");
 }
-async function hashTree(root) {
+async function hashTree(root, ignore = DEFAULT_IGNORE) {
   if (!await exists(root)) return null;
   const h = createHash("sha256");
-  for (const rel of await listFiles(root)) {
+  for (const rel of await listFiles(root, ignore)) {
     h.update(rel).update("\0").update(await fs4.readFile(rel ? path5.join(root, rel) : root)).update("\0");
   }
   return h.digest("hex");
 }
-async function copyTree(src, dst) {
+async function copyTree(src, dst, ignore = DEFAULT_IGNORE) {
   await fs4.rm(dst, { recursive: true, force: true });
   await fs4.mkdir(path5.dirname(dst), { recursive: true });
-  await fs4.cp(src, dst, { recursive: true });
+  const srcRoot = path5.resolve(src);
+  await fs4.cp(src, dst, {
+    recursive: true,
+    dereference: true,
+    filter: async (from) => {
+      const rel = path5.relative(srcRoot, path5.resolve(from)).split(path5.sep).join("/");
+      if (isIgnored(rel, ignore)) return false;
+      try {
+        if ((await fs4.lstat(from)).isSymbolicLink()) await fs4.stat(from);
+      } catch {
+        return false;
+      }
+      return true;
+    }
+  });
 }
 async function removeTree(p) {
   await fs4.rm(p, { recursive: true, force: true });
 }
-async function diffTrees(local, shed) {
-  const l = new Set(await listFiles(local));
-  const s = new Set(await listFiles(shed));
+async function diffTrees(local, shed, ignore = DEFAULT_IGNORE) {
+  const l = new Set(await listFiles(local, ignore));
+  const s = new Set(await listFiles(shed, ignore));
   const out = [];
   for (const f of [.../* @__PURE__ */ new Set([...l, ...s])].sort()) {
     const lp = f ? path5.join(local, f) : local;
@@ -323,37 +436,229 @@ function isGenerated(text) {
   return text.trimStart().startsWith(MARKER);
 }
 function renderInstructions(ctx, profile, fragments) {
-  const head = `${MARKER}; profile: ${profile} -->
+  const head2 = `${MARKER}; profile: ${profile} -->
 <!-- Do not edit this file. Edit the fragments in your shed and run 'lshed restore'. -->
 
 `;
   if (ctx.adapter.instructionsStrategy() === "import") {
-    return head + fragments.map((f) => `@${FRAGMENTS_DIR}/${f.id}.md`).join("\n") + "\n";
+    return head2 + fragments.map((f) => `@${FRAGMENTS_DIR}/${f.id}.md`).join("\n") + "\n";
   }
-  return head + fragments.map((f) => `<!-- ${f.id} -->
+  return head2 + fragments.map((f) => `<!-- ${f.id} -->
 ${f.content.trimEnd()}
 `).join("\n");
 }
 
+// src/core/packages.ts
+import { promises as fs6 } from "fs";
+import path9 from "path";
+
+// src/git.ts
+import { execFile, spawn } from "child_process";
+import { promisify } from "util";
+import path7 from "path";
+var x = promisify(execFile);
+async function git(args, cwd) {
+  const { stdout } = await x("git", args, { cwd, maxBuffer: 1 << 24 });
+  return stdout.trim();
+}
+var isRepo = (dir) => exists(path7.join(dir, ".git"));
+var remoteUrl = (dir) => git(["remote", "get-url", "origin"], dir).catch(() => null);
+var head = (dir) => git(["rev-parse", "HEAD"], dir);
+var branch = async (dir) => {
+  const b = await git(["rev-parse", "--abbrev-ref", "HEAD"], dir);
+  return b === "HEAD" ? void 0 : b;
+};
+var clone = (url, dir, ref) => git(["clone", "--quiet", ...ref ? ["--branch", ref] : [], url, dir]);
+var resetHard = (dir, sha) => git(["reset", "--hard", "--quiet", sha], dir);
+var pullFf = (dir) => git(["pull", "--ff-only", "--quiet"], dir);
+function runShell(cmd, cwd) {
+  return new Promise((resolve, reject) => {
+    const p = spawn("sh", ["-c", cmd], { cwd, stdio: "inherit" });
+    p.on("error", reject);
+    p.on("close", (code) => code === 0 ? resolve() : reject(new Error(`\uBA85\uB839\uC774 ${code} \uB85C \uB05D\uB0AC\uC2B5\uB2C8\uB2E4: ${cmd}`)));
+  });
+}
+
+// src/lock.ts
+import { promises as fs5 } from "fs";
+import path8 from "path";
+import YAML2 from "yaml";
+import { z as z3 } from "zod";
+var LockSchema = z3.object({
+  version: z3.literal(1),
+  packages: z3.record(z3.string(), z3.object({ source: z3.string(), commit: z3.string() })).default({})
+});
+var LOCK_FILE = "lshed.lock";
+async function readLock(shed) {
+  try {
+    return LockSchema.parse(YAML2.parse(await fs5.readFile(path8.join(shed, LOCK_FILE), "utf8")));
+  } catch (e) {
+    if (e.code === "ENOENT") return { version: 1, packages: {} };
+    throw new Error(`${LOCK_FILE} \uC744 \uC77D\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${e.message}`);
+  }
+}
+async function writeLock(shed, lock) {
+  const sorted = { version: 1, packages: Object.fromEntries(Object.entries(lock.packages).sort()) };
+  await fs5.writeFile(path8.join(shed, LOCK_FILE), "# generated by lshed \u2014 do not edit; 'lshed update' refreshes it\n" + YAML2.stringify(sorted));
+}
+
+// src/core/packages.ts
+async function detectPackages(ctx, found) {
+  const out = [];
+  for (const f of found) {
+    if (!await isRepo(f.path)) continue;
+    const url = await remoteUrl(f.path);
+    if (!url) continue;
+    const into = path9.relative(ctx.adapter.root, f.path).split(path9.sep).join("/");
+    out.push({ id: f.id, into, source: sourceFromRemote(url, await branch(f.path)), commit: await head(f.path), path: f.path });
+  }
+  return out;
+}
+async function detectGenerated(found, pkgs) {
+  const out = /* @__PURE__ */ new Map();
+  if (!pkgs.length) return out;
+  const roots = await Promise.all(pkgs.map(async (p) => ({ id: p.id, real: await fs6.realpath(p.path) })));
+  for (const f of found) {
+    if (pkgs.some((p) => p.path === f.path)) continue;
+    let entries;
+    try {
+      if (!(await fs6.stat(f.path)).isDirectory()) continue;
+      entries = await fs6.readdir(f.path);
+    } catch {
+      continue;
+    }
+    for (const name of entries) {
+      const p = path9.join(f.path, name);
+      let target;
+      try {
+        if (!(await fs6.lstat(p)).isSymbolicLink()) continue;
+        target = await fs6.realpath(p).catch(async () => path9.resolve(f.path, await fs6.readlink(p)));
+      } catch {
+        continue;
+      }
+      const owner = roots.find((r) => target === r.real || target.startsWith(r.real + path9.sep));
+      if (owner) {
+        out.set(`${f.category}/${f.id}`, owner.id);
+        break;
+      }
+    }
+  }
+  return out;
+}
+async function packageStatus(ctx, pkg, lock) {
+  const dir = abs(ctx, pkg.into);
+  const present = await isRepo(dir);
+  return { pkg, dir, present, head: present ? await head(dir) : void 0, locked: lock.packages[pkg.id]?.commit };
+}
+async function ensurePackages(ctx, pkgs, opts = {}) {
+  const lock = await readLock(ctx.shed);
+  const res = { cloned: [], pendingInstalls: [], lockChanged: false };
+  for (const pkg of pkgs) {
+    const st = await packageStatus(ctx, pkg, lock);
+    if (st.present) {
+      const note = st.locked && st.head !== st.locked ? `  (HEAD ${st.head.slice(0, 7)} \u2260 lock ${st.locked.slice(0, 7)})` : "";
+      ctx.log(`  = package ${pkg.id}${note}`);
+      continue;
+    }
+    if (await exists(st.dir)) throw new Error(`package ${pkg.id}: ${st.dir} \uAC00 \uC788\uC9C0\uB9CC git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4. \uCE58\uC6B0\uAC70\uB098 into \uB97C \uBC14\uAFB8\uC138\uC694.`);
+    const { url, ref } = cloneTarget(parseSource(pkg.source));
+    ctx.log(`  + package ${pkg.id}  (clone ${url}${ref ? ` @${ref}` : ""}${st.locked ? ` \u2192 ${st.locked.slice(0, 7)}` : ""})`);
+    if (opts.dryRun) continue;
+    await fs6.mkdir(path9.dirname(st.dir), { recursive: true });
+    await clone(url, st.dir, ref);
+    if (st.locked) {
+      await resetHard(st.dir, st.locked).catch(() => {
+        throw new Error(`package ${pkg.id}: \uB77D\uC758 \uCEE4\uBC0B ${st.locked.slice(0, 7)} \uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. 'lshed update ${pkg.id}' \uB85C \uB77D\uC744 \uAC31\uC2E0\uD558\uC138\uC694.`);
+      });
+    } else {
+      lock.packages[pkg.id] = { source: pkg.source, commit: await head(st.dir) };
+      res.lockChanged = true;
+    }
+    res.cloned.push(pkg.id);
+    if (pkg.install) await maybeInstall(ctx, pkg, st.dir, opts, res);
+  }
+  if (res.lockChanged) await writeLock(ctx.shed, lock);
+  return res;
+}
+async function maybeInstall(ctx, pkg, dir, opts, res) {
+  if (!pkg.install) return;
+  if (opts.yes) {
+    ctx.log(`  $ (${pkg.into}) ${pkg.install}`);
+    await runShell(pkg.install, dir);
+  } else {
+    res.pendingInstalls.push({ id: pkg.id, dir, cmd: pkg.install });
+  }
+}
+function reportPending(ctx, res) {
+  if (!res.pendingInstalls.length) return;
+  ctx.log(`
+\uC124\uCE58 \uBA85\uB839 ${res.pendingInstalls.length}\uAC1C\uB97C \uC2E4\uD589\uD558\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. \uD655\uC778 \uD6C4 '--yes' \uB85C \uB2E4\uC2DC \uC2E4\uD589\uD558\uAC70\uB098 \uC9C1\uC811 \uB3CC\uB9AC\uC138\uC694:`);
+  for (const p of res.pendingInstalls) ctx.log(`  cd ${p.dir} && ${p.cmd}`);
+}
+async function updatePackages(ctx, pkgs, opts = {}) {
+  const lock = await readLock(ctx.shed);
+  const res = { cloned: [], pendingInstalls: [], lockChanged: false };
+  for (const pkg of pkgs) {
+    const st = await packageStatus(ctx, pkg, lock);
+    if (!st.present) {
+      ctx.log(`  ! package ${pkg.id}: \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC74C. \uBA3C\uC800 restore \uD558\uC138\uC694`);
+      continue;
+    }
+    if (opts.dryRun) {
+      ctx.log(`  ~ package ${pkg.id}  (git pull --ff-only)`);
+      continue;
+    }
+    await pullFf(st.dir);
+    const now = await head(st.dir);
+    const before = lock.packages[pkg.id]?.commit;
+    if (now !== before) {
+      lock.packages[pkg.id] = { source: pkg.source, commit: now };
+      res.lockChanged = true;
+      ctx.log(`  \u2191 package ${pkg.id}  ${before ? before.slice(0, 7) : "(\uC5C6\uC74C)"} \u2192 ${now.slice(0, 7)}`);
+      await maybeInstall(ctx, pkg, st.dir, opts, res);
+    } else {
+      ctx.log(`  = package ${pkg.id}  ${now.slice(0, 7)} (\uCD5C\uC2E0)`);
+    }
+  }
+  if (res.lockChanged) await writeLock(ctx.shed, lock);
+  return res;
+}
+
 // src/core/init.ts
 async function init(ctx, opts = {}) {
   const profileName = opts.profile ?? "default";
+  const exclude = opts.exclude ?? [];
+  const skipped = [];
   if (await exists(manifestPath(ctx))) {
     throw new Error(`\uC774\uBBF8 \uCD08\uAE30\uD654\uB41C \uCC3D\uACE0\uC785\uB2C8\uB2E4: ${manifestPath(ctx)}
   \uB2E4\uB978 \uD658\uACBD\uC758 \uC124\uC815\uC744 \uC774 \uCC3D\uACE0\uB85C \uAC00\uC838\uC624\uB824\uBA74 'lshed restore' \uD6C4 'lshed save' \uB97C \uC4F0\uC138\uC694.`);
   }
-  const found = await ctx.adapter.scan();
-  const m = { version: 1, agent: ctx.adapter.name, components: {}, profiles: { [profileName]: {} } };
+  const all = await ctx.adapter.scan();
+  const m = { version: 1, agent: ctx.adapter.name, components: {}, packages: [], profiles: { [profileName]: {} } };
+  const isExcluded = (cat, id) => exclude.some((e) => e === id || e === `${cat}/${id}`);
+  const pkgs = (await detectPackages(ctx, all)).filter((p) => !isExcluded("", p.id));
+  const generated = await detectGenerated(all, pkgs);
+  const found = all.filter((f) => !pkgs.some((p) => p.path === f.path) && !generated.has(`${f.category}/${f.id}`));
+  for (const p of pkgs) {
+    m.packages.push({ id: p.id, source: p.source, into: p.into });
+    ctx.log(`  \u2261 package ${p.id}  ${p.source} @${p.commit.slice(0, 7)}  (\uCC38\uC870\uB9CC \uAE30\uB85D)`);
+  }
+  if (pkgs.length) m.profiles[profileName][PACKAGES] = pkgs.map((p) => p.id);
+  for (const [key, by] of generated) ctx.log(`  \xB7 ${key}  (${by} \uAC00 \uC0DD\uC131\uD55C \uAC83 \u2192 \uAC74\uB108\uB700)`);
   const managed = [];
   let copied = 0;
   for (const cat of ctx.adapter.categories()) {
-    const mine = found.filter((f) => f.category === cat.name);
+    const mine = found.filter((f) => f.category === cat.name && !isExcluded(f.category, f.id));
+    for (const f of found.filter((f2) => f2.category === cat.name && isExcluded(f2.category, f2.id))) {
+      skipped.push(`${f.category}/${f.id}`);
+      ctx.log(`  - ${f.category}/${f.id}  (--exclude)`);
+    }
     if (!mine.length) continue;
     m.components[cat.name] = [];
     m.profiles[profileName][cat.name] = [];
     for (const f of mine) {
-      const dst = path7.join(ctx.shed, cat.root, cat.kind === "dir" ? f.id : `${f.id}.md`);
-      await copyTree(f.path, dst);
+      const dst = path10.join(ctx.shed, cat.root, cat.kind === "dir" ? f.id : `${f.id}.md`);
+      await copyTree(f.path, dst, ignoreOf(ctx));
       m.components[cat.name].push({ id: f.id });
       m.profiles[profileName][cat.name].push(f.id);
       managed.push(targetRel(cat, f.id));
@@ -363,32 +668,47 @@ async function init(ctx, opts = {}) {
   }
   const instr = instructionsFile(ctx);
   if (await exists(instr)) {
-    const text = await fs5.readFile(instr, "utf8");
+    const text = await fs7.readFile(instr, "utf8");
     if (!isGenerated(text)) {
-      const dst = path7.join(ctx.shed, INSTRUCTIONS, "main.md");
-      await fs5.mkdir(path7.dirname(dst), { recursive: true });
-      await fs5.writeFile(dst, text);
+      const dst = path10.join(ctx.shed, INSTRUCTIONS, "main.md");
+      await fs7.mkdir(path10.dirname(dst), { recursive: true });
+      await fs7.writeFile(dst, text);
       const fragRel = targetRel(INSTRUCTIONS, "main");
-      await copyTree(dst, abs(ctx, fragRel));
+      await copyTree(dst, abs(ctx, fragRel), ignoreOf(ctx));
       managed.push(fragRel);
       m.components[INSTRUCTIONS] = [{ id: "main" }];
       m.profiles[profileName][INSTRUCTIONS] = ["main"];
       copied++;
-      ctx.log(`  + ${INSTRUCTIONS}/main  (${path7.basename(instr)})`);
+      ctx.log(`  + ${INSTRUCTIONS}/main  (${path10.basename(instr)})`);
     }
   }
-  await fs5.mkdir(ctx.shed, { recursive: true });
-  await fs5.writeFile(manifestPath(ctx), `# lshed manifest \u2014 edit freely. Reference: https://github.com/LeeSongHeon-LSH/lshed
-` + stringifyManifest(m));
+  await fs7.mkdir(ctx.shed, { recursive: true });
+  let yamlText = stringifyManifest(m);
+  for (const p of pkgs) {
+    yamlText = yamlText.replace(`    into: ${p.into}
+`, `    into: ${p.into}
+    # install: ./setup    # \u2190 \uBCF5\uC6D0 \uD6C4 \uC2E4\uD589\uD560 \uBA85\uB839\uC774 \uC788\uC73C\uBA74 \uCC44\uC6B0\uC138\uC694 (--yes \uB85C \uC2E4\uD589)
+`);
+  }
+  await fs7.writeFile(manifestPath(ctx), `# lshed manifest \u2014 edit freely. Reference: https://github.com/LeeSongHeon-LSH/lshed
+` + yamlText);
+  if (pkgs.length) {
+    await writeLock(ctx.shed, { version: 1, packages: Object.fromEntries(pkgs.map((p) => [p.id, { source: p.source, commit: p.commit }])) });
+  }
   await writeState(ctx.adapter, { profile: profileName, shed: ctx.shed, managed, appliedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  const parts = [`\uBD80\uD488 ${copied}\uAC1C`];
+  if (pkgs.length) parts.push(`\uD328\uD0A4\uC9C0 ${pkgs.length}\uAC1C`);
+  if (generated.size) parts.push(`\uC0DD\uC131\uBB3C ${generated.size}\uAC1C \uAC74\uB108\uB700`);
+  if (skipped.length) parts.push(`\uC81C\uC678 ${skipped.length}\uAC1C`);
   ctx.log(`
-${MANIFEST_FILE} \uC0DD\uC131: ${manifestPath(ctx)}  (\uBD80\uD488 ${copied}\uAC1C, \uD504\uB85C\uD544 "${profileName}")`);
-  return { manifest: m, copied };
+${MANIFEST_FILE} \uC0DD\uC131: ${manifestPath(ctx)}  (${parts.join(", ")}, \uD504\uB85C\uD544 "${profileName}")`);
+  if (pkgs.length) ctx.log(`\uD328\uD0A4\uC9C0\uC758 \uC124\uCE58 \uBA85\uB839(install:)\uC740 lshed.yaml \uC5D0\uC11C \uC9C1\uC811 \uCC44\uC6B0\uC138\uC694.`);
+  return { manifest: m, copied, skipped, packages: pkgs.map((p) => p.id), generated: [...generated.keys()] };
 }
 
 // src/core/restore.ts
-import { promises as fs6 } from "fs";
-import path8 from "path";
+import { promises as fs8 } from "fs";
+import path11 from "path";
 async function restore(ctx, profileArg, opts = {}) {
   const backup = opts.backup ?? true;
   const state = await readState(ctx.adapter);
@@ -399,6 +719,7 @@ async function restore(ctx, profileArg, opts = {}) {
   for (const it of plan) {
     if (!await exists(it.src)) throw new Error(`${it.category}/${it.id}: \uCC3D\uACE0\uC5D0 \uD30C\uC77C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4: ${it.src}`);
   }
+  const pkgRes = await ensurePackages(ctx, packagesOf(m, profile), { dryRun: opts.dryRun, yes: opts.yes });
   const instrRel = ctx.adapter.instructionsFileName();
   const fragments = plan.filter((p) => p.category === INSTRUCTIONS);
   const newManaged = new Set(plan.map((p) => p.rel));
@@ -406,7 +727,7 @@ async function restore(ctx, profileArg, opts = {}) {
   const oldManaged = new Set(state?.managed ?? []);
   const toRemove = [...oldManaged].filter((r) => !newManaged.has(r)).sort();
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupDir = path8.join(ctx.adapter.root, LSHED_DIR, "backups", stamp);
+  const backupDir = path11.join(ctx.adapter.root, LSHED_DIR, "backups", stamp);
   const backedUp = [];
   const placed = [];
   async function backUp(rel) {
@@ -414,7 +735,7 @@ async function restore(ctx, profileArg, opts = {}) {
     if (!await exists(from)) return;
     backedUp.push(rel);
     if (opts.dryRun || !backup) return;
-    await copyTree(from, path8.join(backupDir, ...rel.split("/")));
+    await copyTree(from, path11.join(backupDir, ...rel.split("/")), ignoreOf(ctx));
   }
   for (const rel of toRemove) {
     ctx.log(`  - ${rel}`);
@@ -423,7 +744,7 @@ async function restore(ctx, profileArg, opts = {}) {
   }
   for (const it of plan) {
     const target = abs(ctx, it.rel);
-    const same = await hashTree(target) === await hashTree(it.src);
+    const same = await hashTree(target, ignoreOf(ctx)) === await hashTree(it.src, ignoreOf(ctx));
     const mark = same ? "=" : await exists(target) ? "~" : "+";
     ctx.log(`  ${mark} ${it.rel}`);
     if (same) {
@@ -431,20 +752,20 @@ async function restore(ctx, profileArg, opts = {}) {
       continue;
     }
     if (await exists(target)) await backUp(it.rel);
-    if (!opts.dryRun) await copyTree(it.src, target);
+    if (!opts.dryRun) await copyTree(it.src, target, ignoreOf(ctx));
     placed.push(it.rel);
   }
   const instrPath = instructionsFile(ctx);
   if (fragments.length) {
     const contents = [];
-    for (const f of fragments) contents.push({ id: f.id, content: await fs6.readFile(f.src, "utf8") });
+    for (const f of fragments) contents.push({ id: f.id, content: await fs8.readFile(f.src, "utf8") });
     const rendered = renderInstructions(ctx, profile, contents);
-    const existing = await exists(instrPath) ? await fs6.readFile(instrPath, "utf8") : null;
+    const existing = await exists(instrPath) ? await fs8.readFile(instrPath, "utf8") : null;
     if (existing !== rendered) {
       const mark = existing === null ? "+" : "~";
       ctx.log(`  ${mark} ${instrRel}${existing !== null && !isGenerated(existing) ? "  (\uAE30\uC874 \uD30C\uC77C\uC740 lshed \uC0DD\uC131\uBB3C\uC774 \uC544\uB2D8 \u2192 \uBC31\uC5C5)" : ""}`);
       if (existing !== null) await backUp(instrRel);
-      if (!opts.dryRun) await fs6.writeFile(instrPath, rendered);
+      if (!opts.dryRun) await fs8.writeFile(instrPath, rendered);
     } else {
       ctx.log(`  = ${instrRel}`);
     }
@@ -453,12 +774,14 @@ async function restore(ctx, profileArg, opts = {}) {
   if (opts.dryRun) {
     ctx.log(`
 (dry-run) \uBCC0\uACBD \uC5C6\uC74C. \uBC30\uCE58 ${placed.length}, \uC81C\uAC70 ${toRemove.length}, \uBC31\uC5C5 \uC608\uC815 ${backedUp.length}`);
+    reportPending(ctx, pkgRes);
     return { profile, placed, removed: toRemove, backedUp, backupDir: null };
   }
   await writeState(ctx.adapter, { profile, shed: ctx.shed, managed: [...newManaged].sort(), appliedAt: (/* @__PURE__ */ new Date()).toISOString() });
   const bdir = backup && backedUp.length ? backupDir : null;
   ctx.log(`
-\uD504\uB85C\uD544 "${profile}" \uC801\uC6A9: \uBC30\uCE58 ${placed.length}, \uC81C\uAC70 ${toRemove.length}${bdir ? `, \uBC31\uC5C5 ${backedUp.length} \u2192 ${bdir}` : ""}`);
+\uD504\uB85C\uD544 "${profile}" \uC801\uC6A9: \uBC30\uCE58 ${placed.length}, \uC81C\uAC70 ${toRemove.length}${pkgRes.cloned.length ? `, \uD328\uD0A4\uC9C0 clone ${pkgRes.cloned.length}` : ""}${bdir ? `, \uBC31\uC5C5 ${backedUp.length} \u2192 ${bdir}` : ""}`);
+  reportPending(ctx, pkgRes);
   return { profile, placed, removed: toRemove, backedUp, backupDir: bdir };
 }
 
@@ -469,7 +792,7 @@ async function diff(ctx) {
   const m = await loadManifest(ctx);
   const out = [];
   for (const item of planProfile(ctx, m, state.profile)) {
-    const changes = await diffTrees(abs(ctx, item.rel), item.src);
+    const changes = await diffTrees(abs(ctx, item.rel), item.src, ignoreOf(ctx));
     if (changes.length) out.push({ item, changes });
   }
   return out;
@@ -488,9 +811,12 @@ function formatDiff(diffs) {
 // src/core/status.ts
 async function status(ctx) {
   const state = await readState(ctx.adapter);
-  if (!state) return { state: null, drifted: [] };
+  if (!state) return { state: null, drifted: [], packages: [] };
   const d = await diff(ctx);
-  return { state, drifted: d.map((x) => `${x.item.category}/${x.item.id}`) };
+  const m = await loadManifest(ctx);
+  const lock = await readLock(ctx.shed);
+  const packages = await Promise.all(packagesOf(m, state.profile).map((p) => packageStatus(ctx, p, lock)));
+  return { state, drifted: d.map((x2) => `${x2.item.category}/${x2.item.id}`), packages };
 }
 function formatStatus(s, adapterRoot) {
   if (!s.state) return `\uC801\uC6A9\uB41C \uD504\uB85C\uD544\uC774 \uC5C6\uC2B5\uB2C8\uB2E4 (${adapterRoot}).
@@ -502,6 +828,10 @@ function formatStatus(s, adapterRoot) {
     `\uAD00\uB9AC \uC911  ${s.state.managed.length}\uAC1C \uACBD\uB85C (${adapterRoot})`
   ];
   lines.push(s.drifted.length ? `\uB4DC\uB9AC\uD504\uD2B8 ${s.drifted.length}\uAC1C: ${s.drifted.join(", ")}  \u2192 lshed diff` : "\uB4DC\uB9AC\uD504\uD2B8 \uC5C6\uC74C");
+  for (const p of s.packages) {
+    const where = !p.present ? "\uC124\uCE58 \uC548 \uB428 \u2192 lshed restore" : !p.locked ? `${p.head.slice(0, 7)} (\uB77D \uC5C6\uC74C)` : p.head === p.locked ? `${p.head.slice(0, 7)} = lock` : `${p.head.slice(0, 7)} \u2260 lock ${p.locked.slice(0, 7)} \u2192 lshed update`;
+    lines.push(`\uD328\uD0A4\uC9C0   ${p.pkg.id}  ${where}`);
+  }
   return lines.join("\n");
 }
 
@@ -533,8 +863,8 @@ async function save(ctx, ids = []) {
       ctx.log(`  ! ${it.category}/${it.id}: \uB85C\uCEEC\uC5D0 \uC5C6\uC74C (\uAC74\uB108\uB700)`);
       continue;
     }
-    if (await hashTree(local) === await hashTree(it.src)) continue;
-    await copyTree(local, it.src);
+    if (await hashTree(local, ignoreOf(ctx)) === await hashTree(it.src, ignoreOf(ctx))) continue;
+    await copyTree(local, it.src, ignoreOf(ctx));
     saved.push(`${it.category}/${it.id}`);
     ctx.log(`  \u2713 ${it.category}/${it.id} \u2192 \uCC3D\uACE0`);
   }
@@ -543,21 +873,115 @@ ${saved.length}\uAC1C \uBC18\uC601. \uCC3D\uACE0\uB97C \uCEE4\uBC0B/\uB3D9\uAE30
   return saved;
 }
 
+// src/core/list.ts
+function listRows(m) {
+  const usedBy = (cat, id) => Object.entries(m.profiles).filter(([, cats]) => (cats[cat] ?? []).includes(id)).map(([name]) => name);
+  const rows = [];
+  for (const [cat, comps] of Object.entries(m.components)) {
+    for (const c of comps) rows.push({ kind: "component", category: cat, id: c.id, usedBy: usedBy(cat, c.id) });
+  }
+  for (const p of m.packages) rows.push({ kind: "package", category: PACKAGES, id: p.id, usedBy: usedBy(PACKAGES, p.id) });
+  return rows;
+}
+function formatRows(rows, m) {
+  if (!rows.length) return "(\uBE44\uC5B4 \uC788\uC74C)";
+  const w = Math.max(...rows.map((r) => `${r.category}/${r.id}`.length));
+  const lines = rows.map((r) => {
+    const key = `${r.category}/${r.id}`.padEnd(w);
+    const use = r.usedBy.length ? r.usedBy.join(", ") : "(\uBBF8\uC0AC\uC6A9)";
+    return `${r.kind === "package" ? "\u2261" : " "} ${key}  ${use}`;
+  });
+  const unused = rows.filter((r) => !r.usedBy.length).length;
+  lines.push("", `${rows.length}\uAC1C, \uD504\uB85C\uD544 ${Object.keys(m.profiles).length}\uAC1C${unused ? `, \uBBF8\uC0AC\uC6A9 ${unused}\uAC1C \u2192 lshed prune` : ""}`);
+  return lines.join("\n");
+}
+
+// src/core/remove.ts
+import { promises as fs9 } from "fs";
+import path12 from "path";
+import YAML3, { isSeq, isMap } from "yaml";
+function resolveKey(m, raw) {
+  const rows = listRows(m);
+  const [a, b] = raw.includes("/") ? raw.split("/", 2) : [void 0, raw];
+  const hits = rows.filter((r) => r.id === b && (a === void 0 || r.category === a));
+  if (!hits.length) throw new Error(`"${raw}" \uB294 \uCC3D\uACE0\uC5D0 \uC5C6\uC2B5\uB2C8\uB2E4`);
+  if (hits.length > 1) throw new Error(`"${raw}" \uAC00 \uBAA8\uD638\uD569\uB2C8\uB2E4: ${hits.map((h) => `${h.category}/${h.id}`).join(", ")}`);
+  return { category: hits[0].category, id: hits[0].id };
+}
+async function remove(ctx, raw) {
+  const m = await loadManifest(ctx);
+  const { category, id } = resolveKey(m, raw);
+  const users = listRows(m).find((r) => r.category === category && r.id === id).usedBy;
+  if (users.length) throw new Error(`${category}/${id} \uB294 \uD504\uB85C\uD544 ${users.join(", ")} \uC774 \uC4F0\uACE0 \uC788\uC2B5\uB2C8\uB2E4. \uBA3C\uC800 \uD504\uB85C\uD544\uC5D0\uC11C \uBE7C\uC138\uC694.`);
+  const text = await fs9.readFile(manifestPath(ctx), "utf8");
+  const doc = YAML3.parseDocument(text);
+  let deleted;
+  if (category === PACKAGES) {
+    const seq = doc.get(PACKAGES);
+    if (!isSeq(seq)) throw new Error("packages \uAC00 \uBAA9\uB85D\uC774 \uC544\uB2D9\uB2C8\uB2E4");
+    const idx = seq.items.findIndex((it) => isMap(it) && it.get("id") === id);
+    seq.delete(idx);
+    if (!seq.items.length) doc.delete(PACKAGES);
+    const lock = await readLock(ctx.shed);
+    if (lock.packages[id]) {
+      delete lock.packages[id];
+      await writeLock(ctx.shed, lock);
+    }
+    ctx.log(`  - package ${id}  (\uB9E4\uB2C8\uD398\uC2A4\uD2B8\xB7\uB77D\uC5D0\uC11C \uC81C\uAC70. \uB85C\uCEEC clone \uC740 \uADF8\uB300\uB85C)`);
+  } else {
+    const seq = doc.getIn(["components", category]);
+    if (!isSeq(seq)) throw new Error(`components.${category} \uAC00 \uBAA9\uB85D\uC774 \uC544\uB2D9\uB2C8\uB2E4`);
+    const idx = seq.items.findIndex((it) => isMap(it) && it.get("id") === id);
+    seq.delete(idx);
+    if (!seq.items.length) doc.deleteIn(["components", category]);
+    const src = sourcePath(ctx, category, findComponent(m, category, id));
+    const inside = !path12.relative(ctx.shed, src).startsWith("..");
+    if (inside && await exists(src)) {
+      await removeTree(src);
+      deleted = src;
+    }
+    ctx.log(`  - ${category}/${id}${deleted ? "" : "  (\uCC3D\uACE0 \uBC16 \uACBD\uB85C\uB77C \uD30C\uC77C\uC740 \uB450\uC5C8\uC74C)"}`);
+  }
+  await fs9.writeFile(manifestPath(ctx), doc.toString());
+  return { category, id, deleted };
+}
+async function prune(ctx, opts = {}) {
+  const m = await loadManifest(ctx);
+  const unused = listRows(m).filter((r) => !r.usedBy.length);
+  if (!unused.length) {
+    ctx.log("\uBBF8\uC0AC\uC6A9 \uD56D\uBAA9\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.");
+    return [];
+  }
+  if (!opts.yes) {
+    ctx.log(`\uBBF8\uC0AC\uC6A9 ${unused.length}\uAC1C (\uC9C0\uC6B0\uB824\uBA74 --yes):`);
+    for (const r of unused) ctx.log(`  ${r.category}/${r.id}`);
+    return [];
+  }
+  const removed = [];
+  for (const r of unused) {
+    await remove(ctx, `${r.category}/${r.id}`);
+    removed.push(`${r.category}/${r.id}`);
+  }
+  ctx.log(`
+${removed.length}\uAC1C \uC81C\uAC70. \uCC3D\uACE0\uB97C \uCEE4\uBC0B\uD558\uC138\uC694: ${ctx.shed}`);
+  return removed;
+}
+
 // src/cli.ts
 var { version } = createRequire(import.meta.url)("../package.json");
 var program = new Command().name("lshed").description("Keep your coding-agent harness (skills, agents, commands, instructions) in a shed and restore it anywhere by profile.").version(version).option("--shed <dir>", "shed directory (default: $LSHED_HOME, then the shed recorded by the last restore)").option("--root <dir>", "agent config root (default: ~/.claude)");
 function adapterFromOpts() {
   const { root } = program.opts();
-  return new ClaudeCodeAdapter(root ? path9.resolve(root) : void 0);
+  return new ClaudeCodeAdapter(root ? path13.resolve(root) : void 0);
 }
 async function ctxFor(cmd) {
   const adapter = adapterFromOpts();
   const { shed: flag } = program.opts();
   let shed = flag ?? process.env.LSHED_HOME;
   if (!shed && cmd === "other") shed = (await readState(adapter))?.shed;
-  if (!shed && cmd === "init") shed = path9.join(os2.homedir(), "lshed");
+  if (!shed && cmd === "init") shed = path13.join(os2.homedir(), "lshed");
   if (!shed) throw new Error("\uCC3D\uACE0 \uC704\uCE58\uB97C \uBAA8\uB985\uB2C8\uB2E4. --shed <dir> \uB610\uB294 LSHED_HOME \uC744 \uC9C0\uC815\uD558\uC138\uC694.");
-  return { adapter, shed: path9.resolve(shed), log: (l) => console.log(l) };
+  return { adapter, shed: path13.resolve(shed), log: (l) => console.log(l) };
 }
 async function run(fn) {
   try {
@@ -567,22 +991,42 @@ async function run(fn) {
     process.exitCode = 1;
   }
 }
-program.command("init").description("scan the current environment into a shed and write lshed.yaml").option("--profile <name>", "name of the initial profile", "default").action((o) => run(async () => {
+program.command("init").description("scan the current environment into a shed and write lshed.yaml").option("--profile <name>", "name of the initial profile", "default").option("--exclude <id...>", "components to leave out (id or category/id)").action((o) => run(async () => {
   const ctx = await ctxFor("init");
   console.log(`\uC2A4\uCE94: ${ctx.adapter.root}  \u2192  \uCC3D\uACE0: ${ctx.shed}`);
-  await init(ctx, { profile: o.profile });
+  await init(ctx, { profile: o.profile, exclude: o.exclude });
   console.log(`
 \uB2E4\uC74C: \uCC3D\uACE0\uB97C git \uC73C\uB85C \uAD00\uB9AC\uD558\uC138\uC694.  cd ${ctx.shed} && git init`);
 }));
-program.command("restore [profile]").description("apply a profile (defaults to the last applied one)").option("--dry-run", "print what would change without touching anything").option("--no-backup", "skip backing up files that get replaced or removed").action((profile, o) => run(async () => {
+program.command("restore [profile]").description("apply a profile (defaults to the last applied one)").option("--dry-run", "print what would change without touching anything").option("--no-backup", "skip backing up files that get replaced or removed").option("--yes", "run package install commands (they are shown, not run, without this)").action((profile, o) => run(async () => {
   const ctx = await ctxFor("other");
-  await restore(ctx, profile, { dryRun: o.dryRun, backup: o.backup });
+  await restore(ctx, profile, { dryRun: o.dryRun, backup: o.backup, yes: o.yes });
+}));
+program.command("update [ids...]").description("pull packages to their latest upstream and refresh lshed.lock").option("--dry-run", "show what would be updated").option("--yes", "run package install commands after updating").action((ids, o) => run(async () => {
+  const ctx = await ctxFor("other");
+  const state = await readState(ctx.adapter);
+  if (!state) throw new Error("\uC801\uC6A9\uB41C \uD504\uB85C\uD544\uC774 \uC5C6\uC2B5\uB2C8\uB2E4. \uBA3C\uC800 'lshed restore <profile>' \uC744 \uC2E4\uD589\uD558\uC138\uC694.");
+  const m = await loadManifest(ctx);
+  let pkgs = packagesOf(m, state.profile);
+  if (ids.length) {
+    pkgs = ids.map((id) => {
+      const p = m.packages.find((x2) => x2.id === id);
+      if (!p) throw new Error(`\uD328\uD0A4\uC9C0 "${id}" \uAC00 \uC5C6\uC2B5\uB2C8\uB2E4`);
+      return p;
+    });
+  }
+  if (!pkgs.length) {
+    console.log("\uAC31\uC2E0\uD560 \uD328\uD0A4\uC9C0\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.");
+    return;
+  }
+  const res = await updatePackages(ctx, pkgs, { dryRun: o.dryRun, yes: o.yes });
+  reportPending(ctx, res);
 }));
 program.command("status").description("show the applied profile, managed paths and drift").action(() => run(async () => {
   const adapter = adapterFromOpts();
   const state = await readState(adapter);
   if (!state) {
-    console.log(formatStatus({ state: null, drifted: [] }, adapter.root));
+    console.log(formatStatus({ state: null, drifted: [], packages: [] }, adapter.root));
     return;
   }
   const ctx = await ctxFor("other");
@@ -596,6 +1040,20 @@ program.command("save [ids...]").description("copy local edits back into the she
   const ctx = await ctxFor("other");
   await save(ctx, ids);
 }));
+program.command("list").description("everything in the shed and which profiles use it").option("--unused", "only things no profile uses").action((o) => run(async () => {
+  const ctx = await ctxFor("other");
+  const m = await loadManifest(ctx);
+  const rows = listRows(m).filter((r) => !o.unused || !r.usedBy.length);
+  console.log(o.unused && !rows.length ? "\uBBF8\uC0AC\uC6A9 \uD56D\uBAA9\uC774 \uC5C6\uC2B5\uB2C8\uB2E4." : formatRows(rows, m));
+}));
+program.command("remove <key>").description("delete a component or package from the shed (refused while a profile uses it)").action((key) => run(async () => {
+  const ctx = await ctxFor("other");
+  await remove(ctx, key);
+}));
+program.command("prune").description("remove everything no profile uses").option("--yes", "actually delete; without it, just list").action((o) => run(async () => {
+  const ctx = await ctxFor("other");
+  await prune(ctx, { yes: o.yes });
+}));
 program.command("scan").description("(debug) list components found in the agent config root").action(() => run(async () => {
   const adapter = adapterFromOpts();
   const found = await adapter.scan();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lshed",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Portable harness environment manager for coding agents",
   "license": "MIT",
   "author": "leesongheon <leesongheon1209@gmail.com>",