lshed 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.3.0 — 2026-09-02
+
+Claude Code plugins are packages now. On the machine this was built against, the five installed plugins were the only thing a fresh `restore` still left out, and two of them carry MCP servers.
+
+- `init` records each user-scope plugin as `claude-plugin:<name>@<marketplace>` and each GitHub-backed marketplace as `claude-marketplace:<owner/repo>`. Project-scope plugins belong to their project and are skipped.
+- `restore` adds missing marketplaces first, then installs missing plugins through `claude plugin install`. Both are the agent's own package manager, so they run without `--yes`; `--yes` is forwarded as `-y` to accept a marketplace-declared install command.
+- Plugins cannot be pinned. `lshed.lock` records the version that actually got installed and `status` shows when it differs from what another machine had. `update` runs `claude plugin update`.
+- Installers are an interface now. `github:`/`git:` live in core; an adapter contributes its own (`ClaudeCodeAdapter` provides the two above). Install order follows installer priority, then manifest order.
+- Lock entries use `rev` instead of `commit`. Old locks still read.
+
 ## 0.2.1 — 2026-09-02
 
 - `lshed list [--unused]` shows everything in the shed and which profiles use it.

package/README.md

@@ -108,10 +108,22 @@ profiles:
 
 `lshed.lock` pins each package to a commit, so a fresh machine gets the same version you had. `lshed update` moves it forward.
 
+Claude Code plugins are packages too, with their own scheme. `init` finds them in `~/.claude/plugins`:
+
+```yaml
+packages:
+  - id: claude-plugins-official
+    source: claude-marketplace:anthropics/claude-plugins-official
+  - id: exa
+    source: claude-plugin:exa@claude-plugins-official
+```
+
+`restore` adds the marketplace, then runs `claude plugin install exa@claude-plugins-official`. Plugins cannot be pinned to a version, so the lock records whatever got installed and `status` tells you when it differs from the machine you came from. Plugins that bundle MCP servers bring them along.
+
 Rules that keep this safe:
 
 - A package that is already present is never touched by `restore`. Your local checkout is yours.
-- `install:` is a shell command. `restore` and `update` **print it and stop** unless you pass `--yes`.
+- `install:` is a shell command. `restore` and `update` **print it and stop** unless you pass `--yes`. Plugin installs go through Claude Code's own package manager and run without it; `--yes` is forwarded as `-y` for plugins that declare an install command.
 - Packages are not part of the managed set. Switching profiles never deletes a clone.
 - Installers sometimes create aliases without symlinks, which `init` cannot tell from authored skills. Leave those out with `--exclude`:
 
@@ -171,7 +183,7 @@ The shed is the source of truth for authored parts: `save` copies local edits ba
 - MCP servers and secrets. Planned: the manifest names the keys, values are injected locally, nothing secret enters the shed.
 - `settings.json` merging (hooks, permissions).
 - `sync` (a git pull/push wrapper). Use git in the shed directly for now.
-- Plugins installed through Claude Code's marketplace. They are packages too; recording them is next.
+- MCP servers configured by hand in `~/.claude.json`. Plugin-bundled ones are covered.
 - Windows and macOS have not been tested. The code avoids platform-specific paths, but treat 0.1 as Linux/WSL.
 
 ## Troubleshooting

package/dist/cli.js

@@ -4,12 +4,169 @@
 import { Command } from "commander";
 import { createRequire } from "module";
 import os2 from "os";
-import path13 from "path";
+import path15 from "path";
 
 // src/adapters/claude-code.ts
+import { promises as fs2 } from "fs";
+import path2 from "path";
+import os from "os";
+
+// src/installers/claude-plugin.ts
 import { promises as fs } from "fs";
 import path from "path";
-import os from "os";
+
+// src/source.ts
+var GITHUB_RE = /^([\w.-]+)\/([\w.-]+)(?:@([^#]+))?(?:#(.+))?$/;
+function parseSource(raw) {
+  const idx = raw.indexOf(":");
+  if (idx <= 0) {
+    throw new Error(`source\uC5D0 \uC2A4\uD0B4\uC774 \uC5C6\uC2B5\uB2C8\uB2E4: "${raw}" (\uC608: file:./skills/x, github:user/repo@v1)`);
+  }
+  const scheme = raw.slice(0, idx);
+  const rest2 = raw.slice(idx + 1);
+  switch (scheme) {
+    case "file":
+      if (!rest2) throw new Error(`file: \uB4A4\uC5D0 \uACBD\uB85C\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4: "${raw}"`);
+      return { scheme, path: rest2 };
+    case "github": {
+      const m = GITHUB_RE.exec(rest2);
+      if (!m) throw new Error(`github: \uD615\uC2DD\uC774 \uC544\uB2D9\uB2C8\uB2E4: "${raw}" (\uC608: github:user/repo@v1.0#sub/path)`);
+      const [, owner, repo, ref, subpath] = m;
+      return { scheme, owner, repo, ref, subpath };
+    }
+    case "git": {
+      const hash = rest2.lastIndexOf("#");
+      const url = hash >= 0 ? rest2.slice(0, hash) : rest2;
+      const ref = hash >= 0 ? rest2.slice(hash + 1) : void 0;
+      if (!url) throw new Error(`git: \uB4A4\uC5D0 URL \uC774 \uC5C6\uC2B5\uB2C8\uB2E4: "${raw}"`);
+      return { scheme, url, ref: ref || void 0 };
+    }
+    default:
+      if (!/^[a-z][\w-]*$/.test(scheme)) throw new Error(`\uC54C \uC218 \uC5C6\uB294 \uC2A4\uD0B4 "${scheme}": "${raw}"`);
+      return { scheme: "other", name: scheme, rest: rest2 };
+  }
+}
+function isComponentSource(s) {
+  return s.scheme === "file" || s.scheme === "github" || s.scheme === "git";
+}
+function formatSource(s) {
+  switch (s.scheme) {
+    case "file":
+      return `file:${s.path}`;
+    case "github":
+      return `github:${s.owner}/${s.repo}${s.ref ? `@${s.ref}` : ""}${s.subpath ? `#${s.subpath}` : ""}`;
+    case "git":
+      return `git:${s.url}${s.ref ? `#${s.ref}` : ""}`;
+    case "other":
+      return `${s.name}:${s.rest}`;
+  }
+}
+function cloneTarget(s) {
+  if (s.scheme === "github") return { url: `https://github.com/${s.owner}/${s.repo}.git`, ref: s.ref };
+  if (s.scheme === "git") return { url: s.url, ref: s.ref };
+  throw new Error(`file: \uCD9C\uCC98\uB294 clone \uB300\uC0C1\uC774 \uC544\uB2D9\uB2C8\uB2E4`);
+}
+function sourceFromRemote(url, ref) {
+  const m = /^(?:https?:\/\/github\.com\/|git@github\.com:)([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url);
+  if (m) return formatSource({ scheme: "github", owner: m[1], repo: m[2], ref });
+  return formatSource({ scheme: "git", url, ref });
+}
+
+// src/installers/claude-plugin.ts
+async function readJson(p, fallback) {
+  try {
+    return JSON.parse(await fs.readFile(p, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+var installedPath = (ctx) => path.join(ctx.adapter.root, "plugins", "installed_plugins.json");
+var marketplacesPath = (ctx) => path.join(ctx.adapter.root, "plugins", "known_marketplaces.json");
+function rest(pkg) {
+  const s = parseSource(pkg.source);
+  if (s.scheme !== "other") throw new Error(`package ${pkg.id}: ${pkg.source} \uB294 \uD50C\uB7EC\uADF8\uC778 \uCD9C\uCC98\uAC00 \uC544\uB2D9\uB2C8\uB2E4`);
+  return s.rest;
+}
+async function claude(ctx, args) {
+  try {
+    await ctx.exec("claude", args);
+  } catch (e) {
+    if (e.code === "ENOENT") throw new Error("claude CLI \uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. Claude Code \uAC00 \uC124\uCE58\uB418\uC5B4 \uC788\uC5B4\uC57C \uD50C\uB7EC\uADF8\uC778\uC744 \uBCF5\uC6D0\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4.");
+    throw e;
+  }
+}
+var marketplaceInstaller = {
+  name: "claude-marketplace",
+  schemes: ["claude-marketplace"],
+  priority: 10,
+  async detect(ctx) {
+    const m = await readJson(marketplacesPath(ctx), {});
+    const out = [];
+    for (const [name, v] of Object.entries(m)) {
+      const src = v.source;
+      if (src.source === "github" && src.repo) out.push({ id: name, source: `claude-marketplace:${src.repo}`, rev: src.repo });
+      else ctx.log(`  ! marketplace ${name}: ${src.source} \uCD9C\uCC98\uB294 \uC544\uC9C1 \uAE30\uB85D\uD558\uC9C0 \uBABB\uD569\uB2C8\uB2E4 (\uAC74\uB108\uB700)`);
+    }
+    return out;
+  },
+  async status(ctx, pkg) {
+    const m = await readJson(marketplacesPath(ctx), {});
+    const v = m[pkg.id];
+    return { present: !!v, rev: v?.source.repo };
+  },
+  async install(ctx, pkg, _locked, _opts) {
+    const repo = rest(pkg);
+    await claude(ctx, ["plugin", "marketplace", "add", repo, "--scope", "user"]);
+    return repo;
+  },
+  async update(ctx, pkg) {
+    await claude(ctx, ["plugin", "marketplace", "update", pkg.id]);
+    return rest(pkg);
+  },
+  describe(pkg) {
+    return `claude plugin marketplace add ${rest(pkg)}`;
+  },
+  cwd(ctx) {
+    return ctx.adapter.root;
+  }
+};
+var pluginInstaller = {
+  name: "claude-plugin",
+  schemes: ["claude-plugin"],
+  priority: 20,
+  async detect(ctx) {
+    const f = await readJson(installedPath(ctx), { version: 2, plugins: {} });
+    const out = [];
+    for (const [key, entries] of Object.entries(f.plugins)) {
+      const e = entries.find((x2) => x2.scope === "user");
+      if (!e) continue;
+      const [name] = key.split("@");
+      out.push({ id: name, source: `claude-plugin:${key}`, rev: e.version });
+    }
+    return out;
+  },
+  async status(ctx, pkg) {
+    const f = await readJson(installedPath(ctx), { version: 2, plugins: {} });
+    const e = f.plugins[rest(pkg)]?.find((x2) => x2.scope === "user");
+    return { present: !!e, rev: e?.version };
+  },
+  async install(ctx, pkg, _locked, opts) {
+    await claude(ctx, ["plugin", "install", rest(pkg), "--scope", "user", ...opts.yes ? ["-y"] : []]);
+    return (await this.status(ctx, pkg)).rev ?? "?";
+  },
+  async update(ctx, pkg) {
+    await claude(ctx, ["plugin", "update", rest(pkg)]);
+    return (await this.status(ctx, pkg)).rev ?? "?";
+  },
+  describe(pkg, locked) {
+    return `claude plugin install ${rest(pkg)}${locked ? `  (\uC804\uC5D0 ${locked}; \uACE0\uC815\uC740 \uC548 \uB428)` : ""}`;
+  },
+  cwd(ctx) {
+    return ctx.adapter.root;
+  }
+};
+
+// src/adapters/claude-code.ts
 var CATEGORIES = [
   { name: "skills", root: "skills", kind: "dir" },
   { name: "agents", root: "agents", kind: "file" },
@@ -20,7 +177,7 @@ var ClaudeCodeAdapter = class {
   name = "claude-code";
   root;
   constructor(root) {
-    this.root = root ?? path.join(os.homedir(), ".claude");
+    this.root = root ?? path2.join(os.homedir(), ".claude");
   }
   categories() {
     return CATEGORIES;
@@ -31,22 +188,25 @@ var ClaudeCodeAdapter = class {
   instructionsFileName() {
     return "CLAUDE.md";
   }
+  installers() {
+    return [marketplaceInstaller, pluginInstaller];
+  }
   async scan() {
     const out = [];
     for (const cat of CATEGORIES) {
-      const dir = path.join(this.root, cat.root);
+      const dir = path2.join(this.root, cat.root);
       let entries;
       try {
-        entries = await fs.readdir(dir, { withFileTypes: true });
+        entries = await fs2.readdir(dir, { withFileTypes: true });
       } catch {
         continue;
       }
       for (const e of entries) {
         if (e.name.startsWith(".")) continue;
-        const full = path.join(dir, e.name);
+        const full = path2.join(dir, e.name);
         let st;
         try {
-          st = await fs.stat(full);
+          st = await fs2.stat(full);
         } catch {
           continue;
         }
@@ -61,70 +221,208 @@ var ClaudeCodeAdapter = class {
   }
 };
 
-// src/core/init.ts
-import { promises as fs7 } from "fs";
-import path10 from "path";
-
 // src/core/context.ts
-import { promises as fs3 } from "fs";
+import { promises as fs6 } from "fs";
+import path8 from "path";
+import { spawn as spawn2 } from "child_process";
+
+// src/installers/git.ts
+import { promises as fs4 } from "fs";
+import path5 from "path";
+
+// src/git.ts
+import { execFile, spawn } from "child_process";
+import { promisify } from "util";
 import path4 from "path";
 
-// src/manifest.ts
-import { z } from "zod";
-import YAML from "yaml";
+// src/fsutil.ts
+import { promises as fs3 } from "fs";
+import { createHash } from "crypto";
+import path3 from "path";
 
-// src/source.ts
-var GITHUB_RE = /^([\w.-]+)\/([\w.-]+)(?:@([^#]+))?(?:#(.+))?$/;
-function parseSource(raw) {
-  const idx = raw.indexOf(":");
-  if (idx <= 0) {
-    throw new Error(`source\uC5D0 \uC2A4\uD0B4\uC774 \uC5C6\uC2B5\uB2C8\uB2E4: "${raw}" (\uC608: file:./skills/x, github:user/repo@v1)`);
+// src/ignore.ts
+var DEFAULT_IGNORE = [
+  "node_modules",
+  ".git",
+  "__pycache__",
+  ".venv",
+  ".mypy_cache",
+  ".pytest_cache",
+  ".DS_Store",
+  "*.log"
+];
+function matches(name, pattern) {
+  if (pattern.startsWith("*.")) return name.endsWith(pattern.slice(1));
+  return name === pattern;
+}
+function isIgnored(rel, patterns) {
+  if (!rel) return false;
+  return rel.split("/").some((seg) => patterns.some((p) => matches(seg, p)));
+}
+
+// src/fsutil.ts
+async function exists(p) {
+  try {
+    await fs3.access(p);
+    return true;
+  } catch {
+    return false;
   }
-  const scheme = raw.slice(0, idx);
-  const rest = raw.slice(idx + 1);
-  switch (scheme) {
-    case "file":
-      if (!rest) throw new Error(`file: \uB4A4\uC5D0 \uACBD\uB85C\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4: "${raw}"`);
-      return { scheme, path: rest };
-    case "github": {
-      const m = GITHUB_RE.exec(rest);
-      if (!m) throw new Error(`github: \uD615\uC2DD\uC774 \uC544\uB2D9\uB2C8\uB2E4: "${raw}" (\uC608: github:user/repo@v1.0#sub/path)`);
-      const [, owner, repo, ref, subpath] = m;
-      return { scheme, owner, repo, ref, subpath };
-    }
-    case "git": {
-      const hash = rest.lastIndexOf("#");
-      const url = hash >= 0 ? rest.slice(0, hash) : rest;
-      const ref = hash >= 0 ? rest.slice(hash + 1) : void 0;
-      if (!url) throw new Error(`git: \uB4A4\uC5D0 URL \uC774 \uC5C6\uC2B5\uB2C8\uB2E4: "${raw}"`);
-      return { scheme, url, ref: ref || void 0 };
+}
+async function isDir(p) {
+  try {
+    return (await fs3.stat(p)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function listFiles(root, ignore = DEFAULT_IGNORE) {
+  if (!await exists(root)) return [];
+  if (!await isDir(root)) return [""];
+  const out = [];
+  async function walk(dir, rel) {
+    const entries = await fs3.readdir(dir, { withFileTypes: true });
+    for (const e of entries) {
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (isIgnored(r, ignore)) continue;
+      const full = path3.join(dir, e.name);
+      let st;
+      try {
+        st = await fs3.stat(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) await walk(full, r);
+      else if (st.isFile()) out.push(r);
     }
-    default:
-      throw new Error(`\uC54C \uC218 \uC5C6\uB294 \uC2A4\uD0B4 "${scheme}": "${raw}"`);
   }
+  await walk(root, "");
+  return out.sort();
 }
-function formatSource(s) {
-  switch (s.scheme) {
-    case "file":
-      return `file:${s.path}`;
-    case "github":
-      return `github:${s.owner}/${s.repo}${s.ref ? `@${s.ref}` : ""}${s.subpath ? `#${s.subpath}` : ""}`;
-    case "git":
-      return `git:${s.url}${s.ref ? `#${s.ref}` : ""}`;
+async function hashFile(p) {
+  return createHash("sha256").update(await fs3.readFile(p)).digest("hex");
+}
+async function hashTree(root, ignore = DEFAULT_IGNORE) {
+  if (!await exists(root)) return null;
+  const h = createHash("sha256");
+  for (const rel of await listFiles(root, ignore)) {
+    h.update(rel).update("\0").update(await fs3.readFile(rel ? path3.join(root, rel) : root)).update("\0");
   }
+  return h.digest("hex");
 }
-function cloneTarget(s) {
-  if (s.scheme === "github") return { url: `https://github.com/${s.owner}/${s.repo}.git`, ref: s.ref };
-  if (s.scheme === "git") return { url: s.url, ref: s.ref };
-  throw new Error(`file: \uCD9C\uCC98\uB294 clone \uB300\uC0C1\uC774 \uC544\uB2D9\uB2C8\uB2E4`);
+async function copyTree(src, dst, ignore = DEFAULT_IGNORE) {
+  await fs3.rm(dst, { recursive: true, force: true });
+  await fs3.mkdir(path3.dirname(dst), { recursive: true });
+  const srcRoot = path3.resolve(src);
+  await fs3.cp(src, dst, {
+    recursive: true,
+    dereference: true,
+    filter: async (from) => {
+      const rel = path3.relative(srcRoot, path3.resolve(from)).split(path3.sep).join("/");
+      if (isIgnored(rel, ignore)) return false;
+      try {
+        if ((await fs3.lstat(from)).isSymbolicLink()) await fs3.stat(from);
+      } catch {
+        return false;
+      }
+      return true;
+    }
+  });
 }
-function sourceFromRemote(url, ref) {
-  const m = /^(?:https?:\/\/github\.com\/|git@github\.com:)([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url);
-  if (m) return formatSource({ scheme: "github", owner: m[1], repo: m[2], ref });
-  return formatSource({ scheme: "git", url, ref });
+async function removeTree(p) {
+  await fs3.rm(p, { recursive: true, force: true });
+}
+async function diffTrees(local, shed, ignore = DEFAULT_IGNORE) {
+  const l = new Set(await listFiles(local, ignore));
+  const s = new Set(await listFiles(shed, ignore));
+  const out = [];
+  for (const f of [.../* @__PURE__ */ new Set([...l, ...s])].sort()) {
+    const lp = f ? path3.join(local, f) : local;
+    const sp = f ? path3.join(shed, f) : shed;
+    if (l.has(f) && !s.has(f)) out.push({ status: "A", file: f });
+    else if (!l.has(f) && s.has(f)) out.push({ status: "D", file: f });
+    else if (await hashFile(lp) !== await hashFile(sp)) out.push({ status: "M", file: f });
+  }
+  return out;
+}
+
+// src/git.ts
+var x = promisify(execFile);
+async function git(args, cwd) {
+  const { stdout } = await x("git", args, { cwd, maxBuffer: 1 << 24 });
+  return stdout.trim();
+}
+var isRepo = (dir) => exists(path4.join(dir, ".git"));
+var remoteUrl = (dir) => git(["remote", "get-url", "origin"], dir).catch(() => null);
+var head = (dir) => git(["rev-parse", "HEAD"], dir);
+var branch = async (dir) => {
+  const b = await git(["rev-parse", "--abbrev-ref", "HEAD"], dir);
+  return b === "HEAD" ? void 0 : b;
+};
+var clone = (url, dir, ref) => git(["clone", "--quiet", ...ref ? ["--branch", ref] : [], url, dir]);
+var resetHard = (dir, sha) => git(["reset", "--hard", "--quiet", sha], dir);
+var pullFf = (dir) => git(["pull", "--ff-only", "--quiet"], dir);
+function runShell(cmd, cwd) {
+  return new Promise((resolve, reject) => {
+    const p = spawn("sh", ["-c", cmd], { cwd, stdio: "inherit" });
+    p.on("error", reject);
+    p.on("close", (code) => code === 0 ? resolve() : reject(new Error(`\uBA85\uB839\uC774 ${code} \uB85C \uB05D\uB0AC\uC2B5\uB2C8\uB2E4: ${cmd}`)));
+  });
 }
 
+// src/installers/git.ts
+function dirOf(ctx, pkg) {
+  if (!pkg.into) throw new Error(`package ${pkg.id}: git \uACC4\uC5F4 \uD328\uD0A4\uC9C0\uB294 into \uAC00 \uD544\uC694\uD569\uB2C8\uB2E4`);
+  return path5.join(ctx.adapter.root, ...pkg.into.split("/"));
+}
+var gitInstaller = {
+  name: "git",
+  schemes: ["github", "git"],
+  priority: 0,
+  async detect(ctx, found) {
+    const out = [];
+    for (const f of found) {
+      if (!await isRepo(f.path)) continue;
+      const url = await remoteUrl(f.path);
+      if (!url) continue;
+      const into = path5.relative(ctx.adapter.root, f.path).split(path5.sep).join("/");
+      out.push({ id: f.id, into, source: sourceFromRemote(url, await branch(f.path)), rev: await head(f.path), path: f.path });
+    }
+    return out;
+  },
+  async status(ctx, pkg) {
+    const dir = dirOf(ctx, pkg);
+    const present = await isRepo(dir);
+    return { present, rev: present ? await head(dir) : void 0 };
+  },
+  async install(ctx, pkg, locked, _opts) {
+    const dir = dirOf(ctx, pkg);
+    if (await exists(dir)) throw new Error(`package ${pkg.id}: ${dir} \uAC00 \uC788\uC9C0\uB9CC git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4. \uCE58\uC6B0\uAC70\uB098 into \uB97C \uBC14\uAFB8\uC138\uC694.`);
+    const { url, ref } = cloneTarget(parseSource(pkg.source));
+    await fs4.mkdir(path5.dirname(dir), { recursive: true });
+    await clone(url, dir, ref);
+    if (locked) {
+      await resetHard(dir, locked).catch(() => {
+        throw new Error(`package ${pkg.id}: \uB77D\uC758 \uCEE4\uBC0B ${locked.slice(0, 7)} \uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. 'lshed update ${pkg.id}' \uB85C \uB77D\uC744 \uAC31\uC2E0\uD558\uC138\uC694.`);
+      });
+    }
+    return head(dir);
+  },
+  async update(ctx, pkg) {
+    const dir = dirOf(ctx, pkg);
+    await pullFf(dir);
+    return head(dir);
+  },
+  describe(pkg, locked) {
+    const { url, ref } = cloneTarget(parseSource(pkg.source));
+    return `clone ${url}${ref ? ` @${ref}` : ""}${locked ? ` \u2192 ${locked.slice(0, 7)}` : ""}`;
+  },
+  cwd: dirOf
+};
+
 // src/manifest.ts
+import { z } from "zod";
+import YAML from "yaml";
 var ComponentSchema = z.object({
   id: z.string().regex(/^[\w.-]+$/, "id\uB294 \uC601\uBB38\xB7\uC22B\uC790\xB7._- \uB9CC \uD5C8\uC6A9"),
   source: z.string().optional(),
@@ -133,7 +431,9 @@ var ComponentSchema = z.object({
 var PackageSchema = z.object({
   id: z.string().regex(/^[\w.-]+$/, "id\uB294 \uC601\uBB38\xB7\uC22B\uC790\xB7._- \uB9CC \uD5C8\uC6A9"),
   source: z.string(),
-  into: z.string().regex(/^[^/\\][^\\]*$/, "into \uB294 \uB8E8\uD2B8 \uAE30\uC900 \uC0C1\uB300 \uACBD\uB85C (POSIX)"),
+  /** git 계열 패키지의 위치 (어댑터 루트 기준). 어댑터 설치기 스킴은 필요 없다 */
+  into: z.string().regex(/^[^/\\][^\\]*$/, "into \uB294 \uB8E8\uD2B8 \uAE30\uC900 \uC0C1\uB300 \uACBD\uB85C (POSIX)").optional(),
+  /** 설치 후 실행할 셸 명령. --yes 일 때만 실행 */
   install: z.string().optional()
 });
 var PACKAGES = "packages";
@@ -150,7 +450,7 @@ var ManifestSchema = z.object({
 });
 var ManifestError = class extends Error {
 };
-function parseManifest(text, knownCategories2) {
+function parseManifest(text, knownCategories2, knownSchemes) {
   const raw = YAML.parse(text);
   const result = ManifestSchema.safeParse(raw);
   if (!result.success) {
@@ -169,7 +469,7 @@ ${lines.join("\n")}`);
       if (seen.has(c.id)) problems.push(`${cat}: id "${c.id}" \uC911\uBCF5`);
       seen.add(c.id);
       try {
-        parseSource(effectiveSource(cat, c));
+        if (!isComponentSource(parseSource(effectiveSource(cat, c)))) problems.push(`${cat}/${c.id}: \uBD80\uD488 \uCD9C\uCC98\uB294 file:/github:/git: \uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4`);
       } catch (e) {
         problems.push(`${cat}/${c.id}: ${e.message}`);
       }
@@ -180,7 +480,11 @@ ${lines.join("\n")}`);
     if (pkgIds.has(p.id)) problems.push(`packages: id "${p.id}" \uC911\uBCF5`);
     pkgIds.add(p.id);
     try {
-      if (parseSource(p.source).scheme === "file") problems.push(`packages/${p.id}: \uD328\uD0A4\uC9C0 \uCD9C\uCC98\uB294 github: \uB610\uB294 git: \uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4`);
+      const src = parseSource(p.source);
+      const scheme = src.scheme === "other" ? src.name : src.scheme;
+      if (scheme === "file") problems.push(`packages/${p.id}: \uD328\uD0A4\uC9C0 \uCD9C\uCC98\uB294 file: \uC77C \uC218 \uC5C6\uC2B5\uB2C8\uB2E4`);
+      else if (knownSchemes && !knownSchemes.includes(scheme)) problems.push(`packages/${p.id}: \uC2A4\uD0B4 "${scheme}" \uC744 \uB2E4\uB8F0 \uC124\uCE58\uAE30\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4 (${knownSchemes.join(", ")})`);
+      if ((scheme === "github" || scheme === "git") && !p.into) problems.push(`packages/${p.id}: ${scheme}: \uD328\uD0A4\uC9C0\uB294 into \uAC00 \uD544\uC694\uD569\uB2C8\uB2E4`);
     } catch (e) {
       problems.push(`packages/${p.id}: ${e.message}`);
     }
@@ -216,10 +520,10 @@ function packagesOf(m, profile) {
 }
 
 // src/resolvers/file.ts
-import path2 from "path";
+import path6 from "path";
 function resolveSource(shed, raw) {
   const s = parseSource(raw);
-  if (s.scheme === "file") return path2.resolve(shed, s.path);
+  if (s.scheme === "file") return path6.resolve(shed, s.path);
   throw new Error(`"${raw}": ${s.scheme}: \uCD9C\uCC98\uB294 v0.2\uC5D0\uC11C \uC9C0\uC6D0\uB429\uB2C8\uB2E4. \uC9C0\uAE08\uC740 file: \uB9CC \uC0AC\uC6A9\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4.`);
 }
 function isSaveable(raw) {
@@ -227,8 +531,8 @@ function isSaveable(raw) {
 }
 
 // src/state.ts
-import { promises as fs2 } from "fs";
-import path3 from "path";
+import { promises as fs5 } from "fs";
+import path7 from "path";
 import { z as z2 } from "zod";
 var StateSchema = z2.object({
   profile: z2.string(),
@@ -239,11 +543,11 @@ var StateSchema = z2.object({
 });
 var LSHED_DIR = "lshed";
 function statePath(adapter) {
-  return path3.join(adapter.root, LSHED_DIR, "state.json");
+  return path7.join(adapter.root, LSHED_DIR, "state.json");
 }
 async function readState(adapter) {
   try {
-    const raw = JSON.parse(await fs2.readFile(statePath(adapter), "utf8"));
+    const raw = JSON.parse(await fs5.readFile(statePath(adapter), "utf8"));
     return StateSchema.parse(raw);
   } catch (e) {
     if (e.code === "ENOENT") return null;
@@ -252,36 +556,33 @@ async function readState(adapter) {
 }
 async function writeState(adapter, state) {
   const p = statePath(adapter);
-  await fs2.mkdir(path3.dirname(p), { recursive: true });
-  await fs2.writeFile(p, JSON.stringify(state, null, 2) + "\n");
+  await fs5.mkdir(path7.dirname(p), { recursive: true });
+  await fs5.writeFile(p, JSON.stringify(state, null, 2) + "\n");
 }
 
-// src/ignore.ts
-var DEFAULT_IGNORE = [
-  "node_modules",
-  ".git",
-  "__pycache__",
-  ".venv",
-  ".mypy_cache",
-  ".pytest_cache",
-  ".DS_Store",
-  "*.log"
-];
-function matches(name, pattern) {
-  if (pattern.startsWith("*.")) return name.endsWith(pattern.slice(1));
-  return name === pattern;
+// src/core/context.ts
+function spawnExec(cmd, args, cwd) {
+  return new Promise((resolve, reject) => {
+    const p = spawn2(cmd, args, { cwd, stdio: "inherit" });
+    p.on("error", reject);
+    p.on("close", (code) => code === 0 ? resolve() : reject(new Error(`${cmd} ${args.join(" ")} \uAC00 ${code} \uB85C \uB05D\uB0AC\uC2B5\uB2C8\uB2E4`)));
+  });
 }
-function isIgnored(rel, patterns) {
-  if (!rel) return false;
-  return rel.split("/").some((seg) => patterns.some((p) => matches(seg, p)));
+function installersFor(ctx) {
+  return [gitInstaller, ...ctx.adapter.installers()].sort((a, b) => a.priority - b.priority);
+}
+function installerFor(ctx, source) {
+  const s = parseSource(source);
+  const scheme = s.scheme === "other" ? s.name : s.scheme;
+  const inst = installersFor(ctx).find((i) => i.schemes.includes(scheme));
+  if (!inst) throw new Error(`"${source}": \uC2A4\uD0B4 ${scheme} \uC744 \uB2E4\uB8F0 \uC124\uCE58\uAE30\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4`);
+  return inst;
 }
-
-// src/core/context.ts
 var MANIFEST_FILE = "lshed.yaml";
 var INSTRUCTIONS = "instructions";
 var FRAGMENTS_DIR = `${LSHED_DIR}/instructions`;
 function manifestPath(ctx) {
-  return path4.join(ctx.shed, MANIFEST_FILE);
+  return path8.join(ctx.shed, MANIFEST_FILE);
 }
 function knownCategories(adapter) {
   return [...adapter.categories().map((c) => c.name), INSTRUCTIONS];
@@ -289,12 +590,12 @@ function knownCategories(adapter) {
 async function loadManifest(ctx) {
   let text;
   try {
-    text = await fs3.readFile(manifestPath(ctx), "utf8");
+    text = await fs6.readFile(manifestPath(ctx), "utf8");
   } catch {
     throw new Error(`\uCC3D\uACE0\uC5D0 ${MANIFEST_FILE} \uC774 \uC5C6\uC2B5\uB2C8\uB2E4: ${ctx.shed}
   \uBA3C\uC800 'lshed init --shed ${ctx.shed}' \uB97C \uC2E4\uD589\uD558\uC138\uC694.`);
   }
-  const m = parseManifest(text, knownCategories(ctx.adapter));
+  const m = parseManifest(text, knownCategories(ctx.adapter), installersFor(ctx).flatMap((i) => [...i.schemes]));
   ctx.ignore = [...DEFAULT_IGNORE, ...m.ignore ?? []];
   return m;
 }
@@ -334,103 +635,18 @@ function planProfile(ctx, m, profile) {
   return items;
 }
 function abs(ctx, rel) {
-  return path4.join(ctx.adapter.root, ...rel.split("/"));
+  return path8.join(ctx.adapter.root, ...rel.split("/"));
 }
 
-// src/fsutil.ts
-import { promises as fs4 } from "fs";
-import { createHash } from "crypto";
-import path5 from "path";
-async function exists(p) {
-  try {
-    await fs4.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function isDir(p) {
-  try {
-    return (await fs4.stat(p)).isDirectory();
-  } catch {
-    return false;
-  }
-}
-async function listFiles(root, ignore = DEFAULT_IGNORE) {
-  if (!await exists(root)) return [];
-  if (!await isDir(root)) return [""];
-  const out = [];
-  async function walk(dir, rel) {
-    const entries = await fs4.readdir(dir, { withFileTypes: true });
-    for (const e of entries) {
-      const r = rel ? `${rel}/${e.name}` : e.name;
-      if (isIgnored(r, ignore)) continue;
-      const full = path5.join(dir, e.name);
-      let st;
-      try {
-        st = await fs4.stat(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) await walk(full, r);
-      else if (st.isFile()) out.push(r);
-    }
-  }
-  await walk(root, "");
-  return out.sort();
-}
-async function hashFile(p) {
-  return createHash("sha256").update(await fs4.readFile(p)).digest("hex");
-}
-async function hashTree(root, ignore = DEFAULT_IGNORE) {
-  if (!await exists(root)) return null;
-  const h = createHash("sha256");
-  for (const rel of await listFiles(root, ignore)) {
-    h.update(rel).update("\0").update(await fs4.readFile(rel ? path5.join(root, rel) : root)).update("\0");
-  }
-  return h.digest("hex");
-}
-async function copyTree(src, dst, ignore = DEFAULT_IGNORE) {
-  await fs4.rm(dst, { recursive: true, force: true });
-  await fs4.mkdir(path5.dirname(dst), { recursive: true });
-  const srcRoot = path5.resolve(src);
-  await fs4.cp(src, dst, {
-    recursive: true,
-    dereference: true,
-    filter: async (from) => {
-      const rel = path5.relative(srcRoot, path5.resolve(from)).split(path5.sep).join("/");
-      if (isIgnored(rel, ignore)) return false;
-      try {
-        if ((await fs4.lstat(from)).isSymbolicLink()) await fs4.stat(from);
-      } catch {
-        return false;
-      }
-      return true;
-    }
-  });
-}
-async function removeTree(p) {
-  await fs4.rm(p, { recursive: true, force: true });
-}
-async function diffTrees(local, shed, ignore = DEFAULT_IGNORE) {
-  const l = new Set(await listFiles(local, ignore));
-  const s = new Set(await listFiles(shed, ignore));
-  const out = [];
-  for (const f of [.../* @__PURE__ */ new Set([...l, ...s])].sort()) {
-    const lp = f ? path5.join(local, f) : local;
-    const sp = f ? path5.join(shed, f) : shed;
-    if (l.has(f) && !s.has(f)) out.push({ status: "A", file: f });
-    else if (!l.has(f) && s.has(f)) out.push({ status: "D", file: f });
-    else if (await hashFile(lp) !== await hashFile(sp)) out.push({ status: "M", file: f });
-  }
-  return out;
-}
+// src/core/init.ts
+import { promises as fs9 } from "fs";
+import path12 from "path";
 
 // src/core/instructions.ts
-import path6 from "path";
+import path9 from "path";
 var MARKER = "<!-- generated by lshed";
 function instructionsFile(ctx) {
-  return path6.join(ctx.adapter.root, ctx.adapter.instructionsFileName());
+  return path9.join(ctx.adapter.root, ctx.adapter.instructionsFileName());
 }
 function isGenerated(text) {
   return text.trimStart().startsWith(MARKER);
@@ -449,49 +665,23 @@ ${f.content.trimEnd()}
 }
 
 // src/core/packages.ts
-import { promises as fs6 } from "fs";
-import path9 from "path";
-
-// src/git.ts
-import { execFile, spawn } from "child_process";
-import { promisify } from "util";
-import path7 from "path";
-var x = promisify(execFile);
-async function git(args, cwd) {
-  const { stdout } = await x("git", args, { cwd, maxBuffer: 1 << 24 });
-  return stdout.trim();
-}
-var isRepo = (dir) => exists(path7.join(dir, ".git"));
-var remoteUrl = (dir) => git(["remote", "get-url", "origin"], dir).catch(() => null);
-var head = (dir) => git(["rev-parse", "HEAD"], dir);
-var branch = async (dir) => {
-  const b = await git(["rev-parse", "--abbrev-ref", "HEAD"], dir);
-  return b === "HEAD" ? void 0 : b;
-};
-var clone = (url, dir, ref) => git(["clone", "--quiet", ...ref ? ["--branch", ref] : [], url, dir]);
-var resetHard = (dir, sha) => git(["reset", "--hard", "--quiet", sha], dir);
-var pullFf = (dir) => git(["pull", "--ff-only", "--quiet"], dir);
-function runShell(cmd, cwd) {
-  return new Promise((resolve, reject) => {
-    const p = spawn("sh", ["-c", cmd], { cwd, stdio: "inherit" });
-    p.on("error", reject);
-    p.on("close", (code) => code === 0 ? resolve() : reject(new Error(`\uBA85\uB839\uC774 ${code} \uB85C \uB05D\uB0AC\uC2B5\uB2C8\uB2E4: ${cmd}`)));
-  });
-}
+import { promises as fs8 } from "fs";
+import path11 from "path";
 
 // src/lock.ts
-import { promises as fs5 } from "fs";
-import path8 from "path";
+import { promises as fs7 } from "fs";
+import path10 from "path";
 import YAML2 from "yaml";
 import { z as z3 } from "zod";
+var EntrySchema = z3.object({ source: z3.string(), rev: z3.string().optional(), commit: z3.string().optional() }).transform((e) => ({ source: e.source, rev: e.rev ?? e.commit ?? "" }));
 var LockSchema = z3.object({
   version: z3.literal(1),
-  packages: z3.record(z3.string(), z3.object({ source: z3.string(), commit: z3.string() })).default({})
+  packages: z3.record(z3.string(), EntrySchema).default({})
 });
 var LOCK_FILE = "lshed.lock";
 async function readLock(shed) {
   try {
-    return LockSchema.parse(YAML2.parse(await fs5.readFile(path8.join(shed, LOCK_FILE), "utf8")));
+    return LockSchema.parse(YAML2.parse(await fs7.readFile(path10.join(shed, LOCK_FILE), "utf8")));
   } catch (e) {
     if (e.code === "ENOENT") return { version: 1, packages: {} };
     throw new Error(`${LOCK_FILE} \uC744 \uC77D\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${e.message}`);
@@ -499,44 +689,39 @@ async function readLock(shed) {
 }
 async function writeLock(shed, lock) {
   const sorted = { version: 1, packages: Object.fromEntries(Object.entries(lock.packages).sort()) };
-  await fs5.writeFile(path8.join(shed, LOCK_FILE), "# generated by lshed \u2014 do not edit; 'lshed update' refreshes it\n" + YAML2.stringify(sorted));
+  await fs7.writeFile(path10.join(shed, LOCK_FILE), "# generated by lshed \u2014 do not edit; 'lshed update' refreshes it\n" + YAML2.stringify(sorted));
 }
 
 // src/core/packages.ts
 async function detectPackages(ctx, found) {
   const out = [];
-  for (const f of found) {
-    if (!await isRepo(f.path)) continue;
-    const url = await remoteUrl(f.path);
-    if (!url) continue;
-    const into = path9.relative(ctx.adapter.root, f.path).split(path9.sep).join("/");
-    out.push({ id: f.id, into, source: sourceFromRemote(url, await branch(f.path)), commit: await head(f.path), path: f.path });
-  }
+  for (const inst of installersFor(ctx)) out.push(...await inst.detect(ctx, found));
   return out;
 }
 async function detectGenerated(found, pkgs) {
   const out = /* @__PURE__ */ new Map();
-  if (!pkgs.length) return out;
-  const roots = await Promise.all(pkgs.map(async (p) => ({ id: p.id, real: await fs6.realpath(p.path) })));
+  const located = pkgs.filter((p) => p.path);
+  if (!located.length) return out;
+  const roots = await Promise.all(located.map(async (p) => ({ id: p.id, real: await fs8.realpath(p.path) })));
   for (const f of found) {
-    if (pkgs.some((p) => p.path === f.path)) continue;
+    if (located.some((p) => p.path === f.path)) continue;
     let entries;
     try {
-      if (!(await fs6.stat(f.path)).isDirectory()) continue;
-      entries = await fs6.readdir(f.path);
+      if (!(await fs8.stat(f.path)).isDirectory()) continue;
+      entries = await fs8.readdir(f.path);
     } catch {
       continue;
     }
     for (const name of entries) {
-      const p = path9.join(f.path, name);
+      const p = path11.join(f.path, name);
       let target;
       try {
-        if (!(await fs6.lstat(p)).isSymbolicLink()) continue;
-        target = await fs6.realpath(p).catch(async () => path9.resolve(f.path, await fs6.readlink(p)));
+        if (!(await fs8.lstat(p)).isSymbolicLink()) continue;
+        target = await fs8.realpath(p).catch(async () => path11.resolve(f.path, await fs8.readlink(p)));
       } catch {
         continue;
       }
-      const owner = roots.find((r) => target === r.real || target.startsWith(r.real + path9.sep));
+      const owner = roots.find((r) => target === r.real || target.startsWith(r.real + path11.sep));
       if (owner) {
         out.set(`${f.category}/${f.id}`, owner.id);
         break;
@@ -546,36 +731,34 @@ async function detectGenerated(found, pkgs) {
   return out;
 }
 async function packageStatus(ctx, pkg, lock) {
-  const dir = abs(ctx, pkg.into);
-  const present = await isRepo(dir);
-  return { pkg, dir, present, head: present ? await head(dir) : void 0, locked: lock.packages[pkg.id]?.commit };
+  const st = await installerFor(ctx, pkg.source).status(ctx, pkg);
+  return { pkg, ...st, locked: lock.packages[pkg.id]?.rev || void 0 };
+}
+var short = (r) => r && /^[0-9a-f]{40}$/.test(r) ? r.slice(0, 7) : r;
+function ordered(ctx, pkgs) {
+  return pkgs.map((p, i) => ({ p, i, pr: installerFor(ctx, p.source).priority })).sort((a, b) => a.pr - b.pr || a.i - b.i).map((x2) => x2.p);
 }
 async function ensurePackages(ctx, pkgs, opts = {}) {
   const lock = await readLock(ctx.shed);
-  const res = { cloned: [], pendingInstalls: [], lockChanged: false };
-  for (const pkg of pkgs) {
+  const res = { installed: [], pendingInstalls: [], lockChanged: false };
+  for (const pkg of ordered(ctx, pkgs)) {
+    const inst = installerFor(ctx, pkg.source);
     const st = await packageStatus(ctx, pkg, lock);
     if (st.present) {
-      const note = st.locked && st.head !== st.locked ? `  (HEAD ${st.head.slice(0, 7)} \u2260 lock ${st.locked.slice(0, 7)})` : "";
+      const note = st.locked && st.rev !== st.locked ? `  (${short(st.rev)} \u2260 lock ${short(st.locked)})` : "";
       ctx.log(`  = package ${pkg.id}${note}`);
       continue;
     }
-    if (await exists(st.dir)) throw new Error(`package ${pkg.id}: ${st.dir} \uAC00 \uC788\uC9C0\uB9CC git \uC800\uC7A5\uC18C\uAC00 \uC544\uB2D9\uB2C8\uB2E4. \uCE58\uC6B0\uAC70\uB098 into \uB97C \uBC14\uAFB8\uC138\uC694.`);
-    const { url, ref } = cloneTarget(parseSource(pkg.source));
-    ctx.log(`  + package ${pkg.id}  (clone ${url}${ref ? ` @${ref}` : ""}${st.locked ? ` \u2192 ${st.locked.slice(0, 7)}` : ""})`);
+    ctx.log(`  + package ${pkg.id}  (${inst.describe(pkg, st.locked)})`);
     if (opts.dryRun) continue;
-    await fs6.mkdir(path9.dirname(st.dir), { recursive: true });
-    await clone(url, st.dir, ref);
-    if (st.locked) {
-      await resetHard(st.dir, st.locked).catch(() => {
-        throw new Error(`package ${pkg.id}: \uB77D\uC758 \uCEE4\uBC0B ${st.locked.slice(0, 7)} \uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4. 'lshed update ${pkg.id}' \uB85C \uB77D\uC744 \uAC31\uC2E0\uD558\uC138\uC694.`);
-      });
-    } else {
-      lock.packages[pkg.id] = { source: pkg.source, commit: await head(st.dir) };
+    const rev = await inst.install(ctx, pkg, st.locked, opts);
+    if (rev !== st.locked) {
+      if (st.locked) ctx.log(`    \uB77D\uC740 ${short(st.locked)} \uC774\uC9C0\uB9CC ${short(rev)} \uC774 \uC124\uCE58\uB428. \uB77D\uC744 \uB530\uB77C\uAC00\uAC8C \uAC31\uC2E0`);
+      lock.packages[pkg.id] = { source: pkg.source, rev };
       res.lockChanged = true;
     }
-    res.cloned.push(pkg.id);
-    if (pkg.install) await maybeInstall(ctx, pkg, st.dir, opts, res);
+    res.installed.push(pkg.id);
+    await maybeInstall(ctx, pkg, inst.cwd(ctx, pkg), opts, res);
   }
   if (res.lockChanged) await writeLock(ctx.shed, lock);
   return res;
@@ -583,7 +766,7 @@ async function ensurePackages(ctx, pkgs, opts = {}) {
 async function maybeInstall(ctx, pkg, dir, opts, res) {
   if (!pkg.install) return;
   if (opts.yes) {
-    ctx.log(`  $ (${pkg.into}) ${pkg.install}`);
+    ctx.log(`  $ (${path11.relative(ctx.adapter.root, dir) || "."}) ${pkg.install}`);
     await runShell(pkg.install, dir);
   } else {
     res.pendingInstalls.push({ id: pkg.id, dir, cmd: pkg.install });
@@ -597,27 +780,27 @@ function reportPending(ctx, res) {
 }
 async function updatePackages(ctx, pkgs, opts = {}) {
   const lock = await readLock(ctx.shed);
-  const res = { cloned: [], pendingInstalls: [], lockChanged: false };
-  for (const pkg of pkgs) {
+  const res = { installed: [], pendingInstalls: [], lockChanged: false };
+  for (const pkg of ordered(ctx, pkgs)) {
+    const inst = installerFor(ctx, pkg.source);
     const st = await packageStatus(ctx, pkg, lock);
     if (!st.present) {
       ctx.log(`  ! package ${pkg.id}: \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC74C. \uBA3C\uC800 restore \uD558\uC138\uC694`);
       continue;
     }
     if (opts.dryRun) {
-      ctx.log(`  ~ package ${pkg.id}  (git pull --ff-only)`);
+      ctx.log(`  ~ package ${pkg.id}  (${inst.name} update)`);
       continue;
     }
-    await pullFf(st.dir);
-    const now = await head(st.dir);
-    const before = lock.packages[pkg.id]?.commit;
+    const now = await inst.update(ctx, pkg, opts);
+    const before = lock.packages[pkg.id]?.rev;
     if (now !== before) {
-      lock.packages[pkg.id] = { source: pkg.source, commit: now };
+      lock.packages[pkg.id] = { source: pkg.source, rev: now };
       res.lockChanged = true;
-      ctx.log(`  \u2191 package ${pkg.id}  ${before ? before.slice(0, 7) : "(\uC5C6\uC74C)"} \u2192 ${now.slice(0, 7)}`);
-      await maybeInstall(ctx, pkg, st.dir, opts, res);
+      ctx.log(`  \u2191 package ${pkg.id}  ${before ? short(before) : "(\uC5C6\uC74C)"} \u2192 ${short(now)}`);
+      await maybeInstall(ctx, pkg, inst.cwd(ctx, pkg), opts, res);
     } else {
-      ctx.log(`  = package ${pkg.id}  ${now.slice(0, 7)} (\uCD5C\uC2E0)`);
+      ctx.log(`  = package ${pkg.id}  ${short(now)} (\uCD5C\uC2E0)`);
     }
   }
   if (res.lockChanged) await writeLock(ctx.shed, lock);
@@ -640,8 +823,9 @@ async function init(ctx, opts = {}) {
   const generated = await detectGenerated(all, pkgs);
   const found = all.filter((f) => !pkgs.some((p) => p.path === f.path) && !generated.has(`${f.category}/${f.id}`));
   for (const p of pkgs) {
-    m.packages.push({ id: p.id, source: p.source, into: p.into });
-    ctx.log(`  \u2261 package ${p.id}  ${p.source} @${p.commit.slice(0, 7)}  (\uCC38\uC870\uB9CC \uAE30\uB85D)`);
+    m.packages.push(p.into ? { id: p.id, source: p.source, into: p.into } : { id: p.id, source: p.source });
+    const rev = /^[0-9a-f]{40}$/.test(p.rev) ? p.rev.slice(0, 7) : p.rev;
+    ctx.log(`  \u2261 package ${p.id}  ${p.source} @${rev}  (\uCC38\uC870\uB9CC \uAE30\uB85D)`);
   }
   if (pkgs.length) m.profiles[profileName][PACKAGES] = pkgs.map((p) => p.id);
   for (const [key, by] of generated) ctx.log(`  \xB7 ${key}  (${by} \uAC00 \uC0DD\uC131\uD55C \uAC83 \u2192 \uAC74\uB108\uB700)`);
@@ -657,7 +841,7 @@ async function init(ctx, opts = {}) {
     m.components[cat.name] = [];
     m.profiles[profileName][cat.name] = [];
     for (const f of mine) {
-      const dst = path10.join(ctx.shed, cat.root, cat.kind === "dir" ? f.id : `${f.id}.md`);
+      const dst = path12.join(ctx.shed, cat.root, cat.kind === "dir" ? f.id : `${f.id}.md`);
       await copyTree(f.path, dst, ignoreOf(ctx));
       m.components[cat.name].push({ id: f.id });
       m.profiles[profileName][cat.name].push(f.id);
@@ -668,32 +852,33 @@ async function init(ctx, opts = {}) {
   }
   const instr = instructionsFile(ctx);
   if (await exists(instr)) {
-    const text = await fs7.readFile(instr, "utf8");
+    const text = await fs9.readFile(instr, "utf8");
     if (!isGenerated(text)) {
-      const dst = path10.join(ctx.shed, INSTRUCTIONS, "main.md");
-      await fs7.mkdir(path10.dirname(dst), { recursive: true });
-      await fs7.writeFile(dst, text);
+      const dst = path12.join(ctx.shed, INSTRUCTIONS, "main.md");
+      await fs9.mkdir(path12.dirname(dst), { recursive: true });
+      await fs9.writeFile(dst, text);
       const fragRel = targetRel(INSTRUCTIONS, "main");
       await copyTree(dst, abs(ctx, fragRel), ignoreOf(ctx));
       managed.push(fragRel);
       m.components[INSTRUCTIONS] = [{ id: "main" }];
       m.profiles[profileName][INSTRUCTIONS] = ["main"];
       copied++;
-      ctx.log(`  + ${INSTRUCTIONS}/main  (${path10.basename(instr)})`);
+      ctx.log(`  + ${INSTRUCTIONS}/main  (${path12.basename(instr)})`);
     }
   }
-  await fs7.mkdir(ctx.shed, { recursive: true });
+  await fs9.mkdir(ctx.shed, { recursive: true });
   let yamlText = stringifyManifest(m);
   for (const p of pkgs) {
+    if (!p.into) continue;
     yamlText = yamlText.replace(`    into: ${p.into}
 `, `    into: ${p.into}
     # install: ./setup    # \u2190 \uBCF5\uC6D0 \uD6C4 \uC2E4\uD589\uD560 \uBA85\uB839\uC774 \uC788\uC73C\uBA74 \uCC44\uC6B0\uC138\uC694 (--yes \uB85C \uC2E4\uD589)
 `);
   }
-  await fs7.writeFile(manifestPath(ctx), `# lshed manifest \u2014 edit freely. Reference: https://github.com/LeeSongHeon-LSH/lshed
+  await fs9.writeFile(manifestPath(ctx), `# lshed manifest \u2014 edit freely. Reference: https://github.com/LeeSongHeon-LSH/lshed
 ` + yamlText);
   if (pkgs.length) {
-    await writeLock(ctx.shed, { version: 1, packages: Object.fromEntries(pkgs.map((p) => [p.id, { source: p.source, commit: p.commit }])) });
+    await writeLock(ctx.shed, { version: 1, packages: Object.fromEntries(pkgs.map((p) => [p.id, { source: p.source, rev: p.rev }])) });
   }
   await writeState(ctx.adapter, { profile: profileName, shed: ctx.shed, managed, appliedAt: (/* @__PURE__ */ new Date()).toISOString() });
   const parts = [`\uBD80\uD488 ${copied}\uAC1C`];
@@ -702,13 +887,13 @@ async function init(ctx, opts = {}) {
   if (skipped.length) parts.push(`\uC81C\uC678 ${skipped.length}\uAC1C`);
   ctx.log(`
 ${MANIFEST_FILE} \uC0DD\uC131: ${manifestPath(ctx)}  (${parts.join(", ")}, \uD504\uB85C\uD544 "${profileName}")`);
-  if (pkgs.length) ctx.log(`\uD328\uD0A4\uC9C0\uC758 \uC124\uCE58 \uBA85\uB839(install:)\uC740 lshed.yaml \uC5D0\uC11C \uC9C1\uC811 \uCC44\uC6B0\uC138\uC694.`);
+  if (pkgs.some((p) => p.into)) ctx.log(`git \uD328\uD0A4\uC9C0\uC758 \uC124\uCE58 \uBA85\uB839(install:)\uC740 lshed.yaml \uC5D0\uC11C \uC9C1\uC811 \uCC44\uC6B0\uC138\uC694.`);
   return { manifest: m, copied, skipped, packages: pkgs.map((p) => p.id), generated: [...generated.keys()] };
 }
 
 // src/core/restore.ts
-import { promises as fs8 } from "fs";
-import path11 from "path";
+import { promises as fs10 } from "fs";
+import path13 from "path";
 async function restore(ctx, profileArg, opts = {}) {
   const backup = opts.backup ?? true;
   const state = await readState(ctx.adapter);
@@ -727,7 +912,7 @@ async function restore(ctx, profileArg, opts = {}) {
   const oldManaged = new Set(state?.managed ?? []);
   const toRemove = [...oldManaged].filter((r) => !newManaged.has(r)).sort();
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const backupDir = path11.join(ctx.adapter.root, LSHED_DIR, "backups", stamp);
+  const backupDir = path13.join(ctx.adapter.root, LSHED_DIR, "backups", stamp);
   const backedUp = [];
   const placed = [];
   async function backUp(rel) {
@@ -735,7 +920,7 @@ async function restore(ctx, profileArg, opts = {}) {
     if (!await exists(from)) return;
     backedUp.push(rel);
     if (opts.dryRun || !backup) return;
-    await copyTree(from, path11.join(backupDir, ...rel.split("/")), ignoreOf(ctx));
+    await copyTree(from, path13.join(backupDir, ...rel.split("/")), ignoreOf(ctx));
   }
   for (const rel of toRemove) {
     ctx.log(`  - ${rel}`);
@@ -758,14 +943,14 @@ async function restore(ctx, profileArg, opts = {}) {
   const instrPath = instructionsFile(ctx);
   if (fragments.length) {
     const contents = [];
-    for (const f of fragments) contents.push({ id: f.id, content: await fs8.readFile(f.src, "utf8") });
+    for (const f of fragments) contents.push({ id: f.id, content: await fs10.readFile(f.src, "utf8") });
     const rendered = renderInstructions(ctx, profile, contents);
-    const existing = await exists(instrPath) ? await fs8.readFile(instrPath, "utf8") : null;
+    const existing = await exists(instrPath) ? await fs10.readFile(instrPath, "utf8") : null;
     if (existing !== rendered) {
       const mark = existing === null ? "+" : "~";
       ctx.log(`  ${mark} ${instrRel}${existing !== null && !isGenerated(existing) ? "  (\uAE30\uC874 \uD30C\uC77C\uC740 lshed \uC0DD\uC131\uBB3C\uC774 \uC544\uB2D8 \u2192 \uBC31\uC5C5)" : ""}`);
       if (existing !== null) await backUp(instrRel);
-      if (!opts.dryRun) await fs8.writeFile(instrPath, rendered);
+      if (!opts.dryRun) await fs10.writeFile(instrPath, rendered);
     } else {
       ctx.log(`  = ${instrRel}`);
     }
@@ -780,7 +965,7 @@ async function restore(ctx, profileArg, opts = {}) {
   await writeState(ctx.adapter, { profile, shed: ctx.shed, managed: [...newManaged].sort(), appliedAt: (/* @__PURE__ */ new Date()).toISOString() });
   const bdir = backup && backedUp.length ? backupDir : null;
   ctx.log(`
-\uD504\uB85C\uD544 "${profile}" \uC801\uC6A9: \uBC30\uCE58 ${placed.length}, \uC81C\uAC70 ${toRemove.length}${pkgRes.cloned.length ? `, \uD328\uD0A4\uC9C0 clone ${pkgRes.cloned.length}` : ""}${bdir ? `, \uBC31\uC5C5 ${backedUp.length} \u2192 ${bdir}` : ""}`);
+\uD504\uB85C\uD544 "${profile}" \uC801\uC6A9: \uBC30\uCE58 ${placed.length}, \uC81C\uAC70 ${toRemove.length}${pkgRes.installed.length ? `, \uD328\uD0A4\uC9C0 \uC124\uCE58 ${pkgRes.installed.length}` : ""}${bdir ? `, \uBC31\uC5C5 ${backedUp.length} \u2192 ${bdir}` : ""}`);
   reportPending(ctx, pkgRes);
   return { profile, placed, removed: toRemove, backedUp, backupDir: bdir };
 }
@@ -828,8 +1013,9 @@ function formatStatus(s, adapterRoot) {
     `\uAD00\uB9AC \uC911  ${s.state.managed.length}\uAC1C \uACBD\uB85C (${adapterRoot})`
   ];
   lines.push(s.drifted.length ? `\uB4DC\uB9AC\uD504\uD2B8 ${s.drifted.length}\uAC1C: ${s.drifted.join(", ")}  \u2192 lshed diff` : "\uB4DC\uB9AC\uD504\uD2B8 \uC5C6\uC74C");
+  const short2 = (r) => r && /^[0-9a-f]{40}$/.test(r) ? r.slice(0, 7) : r;
   for (const p of s.packages) {
-    const where = !p.present ? "\uC124\uCE58 \uC548 \uB428 \u2192 lshed restore" : !p.locked ? `${p.head.slice(0, 7)} (\uB77D \uC5C6\uC74C)` : p.head === p.locked ? `${p.head.slice(0, 7)} = lock` : `${p.head.slice(0, 7)} \u2260 lock ${p.locked.slice(0, 7)} \u2192 lshed update`;
+    const where = !p.present ? "\uC124\uCE58 \uC548 \uB428 \u2192 lshed restore" : !p.locked ? `${short2(p.rev)} (\uB77D \uC5C6\uC74C)` : p.rev === p.locked ? `${short2(p.rev)} = lock` : `${short2(p.rev)} \u2260 lock ${short2(p.locked)} \u2192 lshed update`;
     lines.push(`\uD328\uD0A4\uC9C0   ${p.pkg.id}  ${where}`);
   }
   return lines.join("\n");
@@ -897,8 +1083,8 @@ function formatRows(rows, m) {
 }
 
 // src/core/remove.ts
-import { promises as fs9 } from "fs";
-import path12 from "path";
+import { promises as fs11 } from "fs";
+import path14 from "path";
 import YAML3, { isSeq, isMap } from "yaml";
 function resolveKey(m, raw) {
   const rows = listRows(m);
@@ -913,7 +1099,7 @@ async function remove(ctx, raw) {
   const { category, id } = resolveKey(m, raw);
   const users = listRows(m).find((r) => r.category === category && r.id === id).usedBy;
   if (users.length) throw new Error(`${category}/${id} \uB294 \uD504\uB85C\uD544 ${users.join(", ")} \uC774 \uC4F0\uACE0 \uC788\uC2B5\uB2C8\uB2E4. \uBA3C\uC800 \uD504\uB85C\uD544\uC5D0\uC11C \uBE7C\uC138\uC694.`);
-  const text = await fs9.readFile(manifestPath(ctx), "utf8");
+  const text = await fs11.readFile(manifestPath(ctx), "utf8");
   const doc = YAML3.parseDocument(text);
   let deleted;
   if (category === PACKAGES) {
@@ -935,14 +1121,14 @@ async function remove(ctx, raw) {
     seq.delete(idx);
     if (!seq.items.length) doc.deleteIn(["components", category]);
     const src = sourcePath(ctx, category, findComponent(m, category, id));
-    const inside = !path12.relative(ctx.shed, src).startsWith("..");
+    const inside = !path14.relative(ctx.shed, src).startsWith("..");
     if (inside && await exists(src)) {
       await removeTree(src);
       deleted = src;
     }
     ctx.log(`  - ${category}/${id}${deleted ? "" : "  (\uCC3D\uACE0 \uBC16 \uACBD\uB85C\uB77C \uD30C\uC77C\uC740 \uB450\uC5C8\uC74C)"}`);
   }
-  await fs9.writeFile(manifestPath(ctx), doc.toString());
+  await fs11.writeFile(manifestPath(ctx), doc.toString());
   return { category, id, deleted };
 }
 async function prune(ctx, opts = {}) {
@@ -972,16 +1158,16 @@ var { version } = createRequire(import.meta.url)("../package.json");
 var program = new Command().name("lshed").description("Keep your coding-agent harness (skills, agents, commands, instructions) in a shed and restore it anywhere by profile.").version(version).option("--shed <dir>", "shed directory (default: $LSHED_HOME, then the shed recorded by the last restore)").option("--root <dir>", "agent config root (default: ~/.claude)");
 function adapterFromOpts() {
   const { root } = program.opts();
-  return new ClaudeCodeAdapter(root ? path13.resolve(root) : void 0);
+  return new ClaudeCodeAdapter(root ? path15.resolve(root) : void 0);
 }
 async function ctxFor(cmd) {
   const adapter = adapterFromOpts();
   const { shed: flag } = program.opts();
   let shed = flag ?? process.env.LSHED_HOME;
   if (!shed && cmd === "other") shed = (await readState(adapter))?.shed;
-  if (!shed && cmd === "init") shed = path13.join(os2.homedir(), "lshed");
+  if (!shed && cmd === "init") shed = path15.join(os2.homedir(), "lshed");
   if (!shed) throw new Error("\uCC3D\uACE0 \uC704\uCE58\uB97C \uBAA8\uB985\uB2C8\uB2E4. --shed <dir> \uB610\uB294 LSHED_HOME \uC744 \uC9C0\uC815\uD558\uC138\uC694.");
-  return { adapter, shed: path13.resolve(shed), log: (l) => console.log(l) };
+  return { adapter, shed: path15.resolve(shed), log: (l) => console.log(l), exec: spawnExec };
 }
 async function run(fn) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lshed",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Portable harness environment manager for coding agents",
   "license": "MIT",
   "author": "leesongheon <leesongheon1209@gmail.com>",