oathbound 0.15.1 → 0.16.0

package/dist/cli.cjs

@@ -14157,6 +14157,7 @@ __export(exports_cli, {
   mergeClaudeSettings: () => mergeClaudeSettings,
   isNewer: () => isNewer,
   installDevDependency: () => installDevDependency,
+  findSkillsDirs: () => findSkillsDirs,
   addPrepareScript: () => addPrepareScript
 });
 module.exports = __toCommonJS(exports_cli);
@@ -16478,9 +16479,9 @@ if (shouldShowDeprecationWarning())
 
 // cli.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_child_process2 = require("node:child_process");
-var import_node_fs8 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs9 = require("node:fs");
+var import_node_path9 = require("node:path");
 var import_node_os4 = require("node:os");
 
 // node_modules/@clack/core/dist/index.mjs
@@ -17094,9 +17095,9 @@ function usage(exitCode = 1) {
 ${BOLD}oathbound${RESET} — install, verify, and publish skills & agents
 
 ${DIM}Usage:${RESET}
-  oathbound init                ${DIM}Setup wizard — configure project${RESET}
-  oathbound pull <namespace/skill-name[@version]>
-  oathbound install <namespace/skill-name[@version]>
+  oathbound init [--global|--local]  ${DIM}Setup wizard (default: global + local)${RESET}
+  oathbound pull <namespace/skill-name[@version]> [--global]
+  oathbound install <namespace/skill-name[@version]> [--global]
   oathbound push [path] [--private]  ${DIM}Publish a skill to the registry${RESET}
   oathbound search [query]            ${DIM}Search skills in the registry${RESET}
   oathbound list                      ${DIM}List all public skills${RESET}
@@ -17256,8 +17257,9 @@ function hasOathboundHooks(settings) {
   }
   return false;
 }
-function mergeClaudeSettings() {
-  const claudeDir = import_node_path.join(process.cwd(), ".claude");
+function mergeClaudeSettings(targetDir) {
+  const baseDir = targetDir ?? process.cwd();
+  const claudeDir = import_node_path.join(baseDir, ".claude");
   const settingsPath = import_node_path.join(claudeDir, "settings.json");
   if (!import_node_fs.existsSync(settingsPath)) {
     import_node_fs.mkdirSync(claudeDir, { recursive: true });
@@ -17380,8 +17382,8 @@ function compareSemver(a, b) {
 }
 
 // verify.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path5 = require("node:path");
 var import_node_os2 = require("node:os");
 var import_yaml = __toESM(require_dist(), 1);
 
@@ -17424,9 +17426,66 @@ function hashSkillDir(skillDir) {
   return contentHash(files);
 }
 
+// project-setup.ts
+var import_node_child_process = require("node:child_process");
+var import_node_fs4 = require("node:fs");
+var import_node_path4 = require("node:path");
+function detectPackageManager() {
+  if (import_node_fs4.existsSync(import_node_path4.join(process.cwd(), "bun.lockb")) || import_node_fs4.existsSync(import_node_path4.join(process.cwd(), "bun.lock")))
+    return "bun";
+  if (import_node_fs4.existsSync(import_node_path4.join(process.cwd(), "pnpm-lock.yaml")))
+    return "pnpm";
+  if (import_node_fs4.existsSync(import_node_path4.join(process.cwd(), "yarn.lock")))
+    return "yarn";
+  return "npm";
+}
+function installDevDependency() {
+  const pkgPath = import_node_path4.join(process.cwd(), "package.json");
+  if (!import_node_fs4.existsSync(pkgPath))
+    return "no-package-json";
+  try {
+    const pkg = JSON.parse(import_node_fs4.readFileSync(pkgPath, "utf-8"));
+    if (pkg.devDependencies?.oathbound || pkg.dependencies?.oathbound)
+      return "skipped";
+  } catch {}
+  const pm = detectPackageManager();
+  const cmds = {
+    bun: ["bun", ["add", "--dev", "oathbound"]],
+    pnpm: ["pnpm", ["add", "--save-dev", "oathbound"]],
+    yarn: ["yarn", ["add", "--dev", "oathbound"]],
+    npm: ["npm", ["install", "--save-dev", "oathbound"]]
+  };
+  const [bin, args] = cmds[pm];
+  try {
+    import_node_child_process.execFileSync(bin, args, { stdio: "pipe", cwd: process.cwd() });
+    return "installed";
+  } catch {
+    return "failed";
+  }
+}
+function addPrepareScript() {
+  const pkgPath = import_node_path4.join(process.cwd(), "package.json");
+  if (!import_node_fs4.existsSync(pkgPath))
+    return "skipped";
+  let pkg;
+  try {
+    pkg = JSON.parse(import_node_fs4.readFileSync(pkgPath, "utf-8"));
+  } catch {
+    return "skipped";
+  }
+  const prepare = pkg.scripts?.prepare ?? "";
+  if (prepare.includes("oathbound setup"))
+    return "skipped";
+  const newPrepare = prepare ? `${prepare} && oathbound setup` : "oathbound setup";
+  pkg.scripts = { ...pkg.scripts ?? {}, prepare: newPrepare };
+  import_node_fs4.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + `
+`);
+  return prepare ? "appended" : "added";
+}
+
 // verify.ts
 function sessionStatePath(sessionId) {
-  return import_node_path4.join(import_node_os2.tmpdir(), `oathbound-${sessionId}.json`);
+  return import_node_path5.join(import_node_os2.tmpdir(), `oathbound-${sessionId}.json`);
 }
 async function readStdin() {
   const chunks = [];
@@ -17435,45 +17494,113 @@ async function readStdin() {
   }
   return Buffer.concat(chunks).toString("utf-8");
 }
-function findSkillsDir() {
+function resolveLocalSkillsDir() {
   const cwd = process.cwd();
   const normalized = cwd.replace(/\/+$/, "");
   if (normalized.endsWith(".claude/skills"))
     return cwd;
   if (normalized.endsWith(".claude")) {
-    const skills = import_node_path4.join(cwd, "skills");
-    if (import_node_fs4.existsSync(skills))
+    const skills = import_node_path5.join(cwd, "skills");
+    if (import_node_fs5.existsSync(skills))
       return skills;
   }
-  const direct = import_node_path4.join(cwd, ".claude", "skills");
-  if (import_node_fs4.existsSync(direct))
+  const direct = import_node_path5.join(cwd, ".claude", "skills");
+  if (import_node_fs5.existsSync(direct))
     return direct;
   const SKIP = new Set(["node_modules", ".git", "dist", "build", ".next"]);
   function search(dir, depth) {
     if (depth <= 0)
       return null;
     try {
-      const entries = import_node_fs4.readdirSync(dir, { withFileTypes: true });
+      const entries = import_node_fs5.readdirSync(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || SKIP.has(entry.name))
           continue;
         if (entry.name === ".claude") {
-          const skills = import_node_path4.join(dir, ".claude", "skills");
-          if (import_node_fs4.existsSync(skills))
+          const skills = import_node_path5.join(dir, ".claude", "skills");
+          if (import_node_fs5.existsSync(skills))
             return skills;
         }
       }
       for (const entry of entries) {
         if (!entry.isDirectory() || SKIP.has(entry.name) || entry.name.startsWith("."))
           continue;
-        const result = search(import_node_path4.join(dir, entry.name), depth - 1);
+        const result = search(import_node_path5.join(dir, entry.name), depth - 1);
         if (result)
           return result;
       }
     } catch {}
     return null;
   }
-  return search(cwd, 5) ?? cwd;
+  return search(cwd, 5);
+}
+function hasSkillSubdirs(dir) {
+  try {
+    const entries = import_node_fs5.readdirSync(dir, { withFileTypes: true });
+    return entries.some((e) => e.isDirectory() && !e.name.startsWith("."));
+  } catch {
+    return false;
+  }
+}
+function findSkillsDirs() {
+  const results = [];
+  const globalDir = import_node_path5.join(import_node_os2.homedir(), ".claude", "skills");
+  if (import_node_fs5.existsSync(globalDir) && hasSkillSubdirs(globalDir)) {
+    results.push({ path: globalDir, source: "global" });
+  }
+  const localDir = resolveLocalSkillsDir();
+  if (localDir && hasSkillSubdirs(localDir)) {
+    results.push({ path: localDir, source: "local" });
+  }
+  return results;
+}
+function propagateToProject() {
+  try {
+    const cwd = process.cwd();
+    const localSkills = import_node_path5.join(cwd, ".claude", "skills");
+    if (!import_node_fs5.existsSync(localSkills))
+      return;
+    if (!hasSkillSubdirs(localSkills))
+      return;
+    if (import_node_fs5.existsSync(import_node_path5.join(cwd, ".oathbound.jsonc")))
+      return;
+    const pkgPath = import_node_path5.join(cwd, "package.json");
+    if (!import_node_fs5.existsSync(pkgPath))
+      return;
+    writeOathboundConfig("warn");
+    const raw = import_node_fs5.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    if (!pkg.devDependencies?.oathbound && !pkg.dependencies?.oathbound) {
+      pkg.devDependencies = { ...pkg.devDependencies ?? {}, oathbound: "latest" };
+      const indent = raw.match(/^(\s+)/m)?.[1]?.length ?? 2;
+      import_node_fs5.writeFileSync(pkgPath, JSON.stringify(pkg, null, indent) + `
+`);
+    }
+    addPrepareScript();
+    mergeClaudeSettings();
+    process.stderr.write(`
+Oathbound: configured project for team verification.
+`);
+    process.stderr.write(`  Created .oathbound.jsonc
+`);
+    process.stderr.write(`  Added oathbound to devDependencies
+`);
+    process.stderr.write(`  Added prepare script to package.json
+
+`);
+    process.stderr.write(`  Commit these changes to protect your team:
+`);
+    process.stderr.write(`    git add .oathbound.jsonc package.json .claude/settings.json
+
+`);
+    process.stderr.write(`  Then run: npm install (or bun/pnpm install)
+
+`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "Unknown error";
+    process.stderr.write(`oathbound: auto-propagation warning: ${msg}
+`);
+  }
 }
 function skillNameFromPath(filePath) {
   const marker = ".claude/skills/";
@@ -17516,30 +17643,34 @@ ${TEAL}${BOLD}⬡ oathbound${RESET} ${YELLOW}⚠ Warning:${RESET} skill ${BOLD}"
 `);
   process.exit(0);
 }
-function isExternalSkillAccess(toolName, toolInput, skillsDir, baseName) {
-  const resolvedSkillsDir = import_node_path4.resolve(skillsDir);
+function isExternalSkillAccess(toolName, toolInput, knownDirs, baseName) {
+  const resolvedDirs = knownDirs.map((d) => import_node_path5.resolve(d));
+  const isUnderKnownDir = (p) => {
+    const rp = import_node_path5.resolve(p);
+    return resolvedDirs.some((d) => rp.startsWith(d));
+  };
   if (toolName === "Read") {
     const p = String(toolInput.file_path ?? "");
-    if (p && !import_node_path4.resolve(p).startsWith(resolvedSkillsDir))
+    if (p && !isUnderKnownDir(p))
       return true;
   }
   if (toolName === "Glob" || toolName === "Grep") {
     const p = String(toolInput.path ?? "");
-    if (p && !import_node_path4.resolve(p).startsWith(resolvedSkillsDir))
+    if (p && !isUnderKnownDir(p))
       return true;
   }
   if (toolName === "Bash") {
     const cmd = String(toolInput.command ?? "");
-    if (cmd.includes("/.claude/skills/" + baseName) && !cmd.includes(resolvedSkillsDir))
+    if (cmd.includes("/.claude/skills/" + baseName) && !resolvedDirs.some((d) => cmd.includes(d)))
       return true;
   }
   return false;
 }
 function parseSkillVersion(skillDir) {
-  const skillMdPath = import_node_path4.join(skillDir, "SKILL.md");
-  if (!import_node_fs4.existsSync(skillMdPath))
+  const skillMdPath = import_node_path5.join(skillDir, "SKILL.md");
+  if (!import_node_fs5.existsSync(skillMdPath))
     return null;
-  const content = import_node_fs4.readFileSync(skillMdPath, "utf-8");
+  const content = import_node_fs5.readFileSync(skillMdPath, "utf-8");
   const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
   if (!match)
     return null;
@@ -17569,28 +17700,32 @@ async function verify(supabaseUrl, supabaseAnonKey) {
 `);
     process.exit(1);
   }
-  const skillsDir = findSkillsDir();
-  if (!skillsDir.endsWith(".claude/skills") && !skillsDir.includes(".claude/skills")) {
+  const skillsDirs = findSkillsDirs();
+  propagateToProject();
+  if (skillsDirs.length === 0) {
     const state2 = { verified: {}, rejected: [], ok: true };
-    import_node_fs4.writeFileSync(sessionStatePath(sessionId), JSON.stringify(state2));
-    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: "Oathbound: no .claude/skills/ directory found — nothing to verify." } }));
+    import_node_fs5.writeFileSync(sessionStatePath(sessionId), JSON.stringify(state2));
+    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: "Oathbound: no skills found — nothing to verify." } }));
     process.exit(0);
   }
-  const entries = import_node_fs4.readdirSync(skillsDir, { withFileTypes: true });
-  const skillDirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith("."));
-  if (skillDirs.length === 0) {
+  const localSkills = {};
+  for (const { path: dir } of skillsDirs) {
+    const entries = import_node_fs5.readdirSync(dir, { withFileTypes: true });
+    for (const e of entries.filter((e2) => e2.isDirectory() && !e2.name.startsWith("."))) {
+      const fullPath = import_node_path5.join(dir, e.name);
+      localSkills[e.name] = {
+        hash: hashSkillDir(fullPath),
+        version: parseSkillVersion(fullPath) ?? "1.0.0",
+        dir: fullPath
+      };
+    }
+  }
+  if (Object.keys(localSkills).length === 0) {
     const state2 = { verified: {}, rejected: [], ok: true };
-    import_node_fs4.writeFileSync(sessionStatePath(sessionId), JSON.stringify(state2));
+    import_node_fs5.writeFileSync(sessionStatePath(sessionId), JSON.stringify(state2));
     console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: "Oathbound: no skills installed — nothing to verify." } }));
     process.exit(0);
   }
-  const localSkills = {};
-  for (const dir of skillDirs) {
-    const fullPath = import_node_path4.join(skillsDir, dir.name);
-    const hash = hashSkillDir(fullPath);
-    const version3 = parseSkillVersion(fullPath) ?? "1.0.0";
-    localSkills[dir.name] = { hash, version: version3 };
-  }
   const config = readOathboundConfig();
   const enforcement = config?.enforcement ?? "warn";
   const supabase = createClient(supabaseUrl, supabaseAnonKey);
@@ -17651,8 +17786,12 @@ async function verify(supabaseUrl, supabaseAnonKey) {
     }
   }
   const ok = rejected.length === 0;
-  const state = { verified, rejected, ok };
-  import_node_fs4.writeFileSync(sessionStatePath(sessionId), JSON.stringify(state));
+  const skillDirsMap = {};
+  for (const [name, { dir }] of Object.entries(localSkills)) {
+    skillDirsMap[name] = dir;
+  }
+  const state = { verified, rejected, ok, skillDirs: skillDirsMap };
+  import_node_fs5.writeFileSync(sessionStatePath(sessionId), JSON.stringify(state));
   if (ok && warnings.length === 0) {
     const names = Object.keys(verified).join(", ");
     console.log(JSON.stringify({
@@ -17726,23 +17865,42 @@ async function verifyCheck() {
     process.exit(0);
   const config = readOathboundConfig();
   const enforcement = config?.enforcement ?? "warn";
-  const skillsDir = findSkillsDir();
-  if (isExternalSkillAccess(toolName, toolInput, skillsDir, baseName)) {
-    process.exit(0);
-  }
   const stateFile = sessionStatePath(sessionId);
-  if (!import_node_fs4.existsSync(stateFile))
+  if (!import_node_fs5.existsSync(stateFile))
     process.exit(0);
   let state;
   try {
-    state = JSON.parse(import_node_fs4.readFileSync(stateFile, "utf-8"));
+    state = JSON.parse(import_node_fs5.readFileSync(stateFile, "utf-8"));
   } catch {
     process.stderr.write(`oathbound verify --check: corrupt session state file
 `);
     process.exit(1);
   }
-  const skillDir = import_node_path4.join(skillsDir, baseName);
-  if (!import_node_fs4.existsSync(skillDir) || !import_node_fs4.statSync(skillDir).isDirectory()) {
+  let skillDir = null;
+  if (state.skillDirs?.[baseName]) {
+    skillDir = state.skillDirs[baseName];
+  } else {
+    for (const { path: dir } of findSkillsDirs()) {
+      const candidate = import_node_path5.join(dir, baseName);
+      if (import_node_fs5.existsSync(candidate) && import_node_fs5.statSync(candidate).isDirectory()) {
+        skillDir = candidate;
+      }
+    }
+  }
+  const knownDirs = [];
+  if (state.skillDirs) {
+    const parentDirs = new Set;
+    for (const d of Object.values(state.skillDirs)) {
+      parentDirs.add(import_node_path5.join(d, ".."));
+    }
+    knownDirs.push(...parentDirs);
+  } else {
+    knownDirs.push(...findSkillsDirs().map((e) => e.path));
+  }
+  if (knownDirs.length > 0 && isExternalSkillAccess(toolName, toolInput, knownDirs, baseName)) {
+    process.exit(0);
+  }
+  if (!skillDir || !import_node_fs5.existsSync(skillDir) || !import_node_fs5.statSync(skillDir).isDirectory()) {
     if (enforcement === "warn") {
       warnSkill(baseName, "not installed locally");
     } else {
@@ -17771,38 +17929,38 @@ async function verifyCheck() {
 }
 
 // auth.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs5 = require("node:fs");
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs6 = require("node:fs");
 var import_node_http = require("node:http");
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 var import_node_os3 = require("node:os");
 var SUPABASE_URL = "https://mjnfqagwuewhgwbtrdgs.supabase.co";
 var SUPABASE_ANON_KEY = "sb_publishable_T-rk0azNRqAMLLGCyadyhQ_ulk9685n";
 var API_BASE = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
-var AUTH_DIR = import_node_path5.join(import_node_os3.homedir(), ".oathbound");
-var AUTH_FILE = import_node_path5.join(AUTH_DIR, "auth.json");
+var AUTH_DIR = import_node_path6.join(import_node_os3.homedir(), ".oathbound");
+var AUTH_FILE = import_node_path6.join(AUTH_DIR, "auth.json");
 function saveSession(session) {
-  import_node_fs5.mkdirSync(AUTH_DIR, { recursive: true, mode: 448 });
-  import_node_fs5.writeFileSync(AUTH_FILE, JSON.stringify(session, null, 2), { mode: 384 });
+  import_node_fs6.mkdirSync(AUTH_DIR, { recursive: true, mode: 448 });
+  import_node_fs6.writeFileSync(AUTH_FILE, JSON.stringify(session, null, 2), { mode: 384 });
 }
 function loadSession() {
-  if (!import_node_fs5.existsSync(AUTH_FILE))
+  if (!import_node_fs6.existsSync(AUTH_FILE))
     return null;
   try {
-    return JSON.parse(import_node_fs5.readFileSync(AUTH_FILE, "utf-8"));
+    return JSON.parse(import_node_fs6.readFileSync(AUTH_FILE, "utf-8"));
   } catch {
     return null;
   }
 }
 function clearSession() {
-  if (import_node_fs5.existsSync(AUTH_FILE))
-    import_node_fs5.unlinkSync(AUTH_FILE);
+  if (import_node_fs6.existsSync(AUTH_FILE))
+    import_node_fs6.unlinkSync(AUTH_FILE);
 }
 function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    import_node_child_process.spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+    import_node_child_process2.spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
   } catch {}
 }
 var SUCCESS_HTML = `<!DOCTYPE html>
@@ -17936,16 +18094,16 @@ ${BRAND}`);
 }
 
 // push.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path7 = require("node:path");
 var import_yaml2 = __toESM(require_dist(), 1);
 var API_BASE2 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
 async function push(pathArg, options) {
   Wt2(BRAND);
   const skillDir = resolveSkillDir(pathArg);
   console.log(`${DIM}   directory: ${skillDir}${RESET}`);
-  if (!import_node_fs6.existsSync(import_node_path6.join(skillDir, "SKILL.md"))) {
-    fail("No SKILL.md found", `Expected at ${import_node_path6.join(skillDir, "SKILL.md")}`);
+  if (!import_node_fs7.existsSync(import_node_path7.join(skillDir, "SKILL.md"))) {
+    fail("No SKILL.md found", `Expected at ${import_node_path7.join(skillDir, "SKILL.md")}`);
   }
   const rawFiles = collectFiles(skillDir);
   const skillMdFile = rawFiles.find((f) => f.path === "SKILL.md");
@@ -18017,13 +18175,13 @@ async function push(pathArg, options) {
 }
 function resolveSkillDir(pathArg) {
   if (pathArg) {
-    const resolved = import_node_path6.resolve(pathArg);
-    if (!import_node_fs6.existsSync(resolved) || !import_node_fs6.statSync(resolved).isDirectory()) {
+    const resolved = import_node_path7.resolve(pathArg);
+    if (!import_node_fs7.existsSync(resolved) || !import_node_fs7.statSync(resolved).isDirectory()) {
       fail("Invalid path", `${resolved} is not a directory`);
     }
     return resolved;
   }
-  if (import_node_fs6.existsSync(import_node_path6.join(process.cwd(), "SKILL.md"))) {
+  if (import_node_fs7.existsSync(import_node_path7.join(process.cwd(), "SKILL.md"))) {
     return process.cwd();
   }
   fail("No skill directory found", "Run from within a skill directory or pass a path: oathbound push ./my-skill");
@@ -18146,8 +18304,8 @@ ${BRAND} ${TEAL}${showing}${RESET}
 }
 
 // agent-push.ts
-var import_node_fs7 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs8 = require("node:fs");
+var import_node_path8 = require("node:path");
 var import_yaml3 = __toESM(require_dist(), 1);
 var API_BASE4 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
 function parseAgentFrontmatter(content) {
@@ -18160,11 +18318,11 @@ function parseAgentFrontmatter(content) {
 }
 function resolveAgentFile(pathArg) {
   if (pathArg) {
-    const resolved = import_node_path7.resolve(pathArg);
-    if (!import_node_fs7.existsSync(resolved)) {
+    const resolved = import_node_path8.resolve(pathArg);
+    if (!import_node_fs8.existsSync(resolved)) {
       fail("File not found", resolved);
     }
-    if (import_node_fs7.statSync(resolved).isDirectory()) {
+    if (import_node_fs8.statSync(resolved).isDirectory()) {
       return findAgentInDir(resolved);
     }
     if (!resolved.endsWith(".md")) {
@@ -18175,11 +18333,11 @@ function resolveAgentFile(pathArg) {
   return findAgentInDir(process.cwd());
 }
 function findAgentInDir(dir) {
-  const mdFiles = import_node_fs7.readdirSync(dir).filter((f) => f.endsWith(".md") && !f.startsWith(".")).map((f) => import_node_path7.join(dir, f));
+  const mdFiles = import_node_fs8.readdirSync(dir).filter((f) => f.endsWith(".md") && !f.startsWith(".")).map((f) => import_node_path8.join(dir, f));
   const agents = [];
   for (const file of mdFiles) {
     try {
-      const content = import_node_fs7.readFileSync(file, "utf-8");
+      const content = import_node_fs8.readFileSync(file, "utf-8");
       const { meta, body } = parseAgentFrontmatter(content);
       if (meta.name && meta.description && body.trim()) {
         agents.push(file);
@@ -18197,7 +18355,7 @@ function findAgentInDir(dir) {
 async function agentPush(pathArg, options) {
   Wt2(BRAND);
   const agentFile = resolveAgentFile(pathArg);
-  const content = import_node_fs7.readFileSync(agentFile, "utf-8");
+  const content = import_node_fs8.readFileSync(agentFile, "utf-8");
   const { meta, body } = parseAgentFrontmatter(content);
   const name = String(meta.name ?? "");
   const description = String(meta.description ?? "");
@@ -18386,7 +18544,7 @@ ${BRAND} ${TEAL}${showing}${RESET}
   }
 }
 // cli.ts
-var VERSION = "0.15.1";
+var VERSION = "0.16.0";
 var SUPABASE_URL2 = "https://mjnfqagwuewhgwbtrdgs.supabase.co";
 var SUPABASE_ANON_KEY2 = "sb_publishable_T-rk0azNRqAMLLGCyadyhQ_ulk9685n";
 var API_BASE6 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
@@ -18407,41 +18565,8 @@ function parseSkillArg(arg) {
     return null;
   return { namespace: arg.slice(0, slash), name, version: vStr };
 }
-function detectPackageManager() {
-  if (import_node_fs8.existsSync(import_node_path8.join(process.cwd(), "bun.lockb")) || import_node_fs8.existsSync(import_node_path8.join(process.cwd(), "bun.lock")))
-    return "bun";
-  if (import_node_fs8.existsSync(import_node_path8.join(process.cwd(), "pnpm-lock.yaml")))
-    return "pnpm";
-  if (import_node_fs8.existsSync(import_node_path8.join(process.cwd(), "yarn.lock")))
-    return "yarn";
-  return "npm";
-}
-function installDevDependency() {
-  const pkgPath = import_node_path8.join(process.cwd(), "package.json");
-  if (!import_node_fs8.existsSync(pkgPath))
-    return "no-package-json";
-  try {
-    const pkg = JSON.parse(import_node_fs8.readFileSync(pkgPath, "utf-8"));
-    if (pkg.devDependencies?.oathbound || pkg.dependencies?.oathbound)
-      return "skipped";
-  } catch {}
-  const pm = detectPackageManager();
-  const cmds = {
-    bun: ["bun", ["add", "--dev", "oathbound"]],
-    pnpm: ["pnpm", ["add", "--save-dev", "oathbound"]],
-    yarn: ["yarn", ["add", "--dev", "oathbound"]],
-    npm: ["npm", ["install", "--save-dev", "oathbound"]]
-  };
-  const [bin, args] = cmds[pm];
-  try {
-    import_node_child_process2.execFileSync(bin, args, { stdio: "pipe", cwd: process.cwd() });
-    return "installed";
-  } catch {
-    return "failed";
-  }
-}
 function setup() {
-  if (!import_node_fs8.existsSync(import_node_path8.join(process.cwd(), ".oathbound.jsonc")))
+  if (!import_node_fs9.existsSync(import_node_path9.join(process.cwd(), ".oathbound.jsonc")))
     return;
   const result = mergeClaudeSettings();
   if (result === "malformed") {
@@ -18450,27 +18575,31 @@ function setup() {
     process.exit(1);
   }
 }
-function addPrepareScript() {
-  const pkgPath = import_node_path8.join(process.cwd(), "package.json");
-  if (!import_node_fs8.existsSync(pkgPath))
-    return "skipped";
-  let pkg;
-  try {
-    pkg = JSON.parse(import_node_fs8.readFileSync(pkgPath, "utf-8"));
-  } catch {
-    return "skipped";
-  }
-  const prepare = pkg.scripts?.prepare ?? "";
-  if (prepare.includes("oathbound setup"))
-    return "skipped";
-  const newPrepare = prepare ? `${prepare} && oathbound setup` : "oathbound setup";
-  pkg.scripts = { ...pkg.scripts ?? {}, prepare: newPrepare };
-  import_node_fs8.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + `
+function initGlobal() {
+  const home = import_node_os4.homedir();
+  const mergeResult = mergeClaudeSettings(home);
+  switch (mergeResult) {
+    case "created":
+      process.stderr.write(`${GREEN} ✓ Created ~/.claude/settings.json with hooks${RESET}
 `);
-  return prepare ? "appended" : "added";
+      break;
+    case "merged":
+      process.stderr.write(`${GREEN} ✓ Added hooks to ~/.claude/settings.json${RESET}
+`);
+      break;
+    case "skipped":
+      process.stderr.write(`${DIM}   ~/.claude/settings.json already has oathbound hooks — skipped${RESET}
+`);
+      break;
+    case "malformed":
+      process.stderr.write(`${RED} ✗ ~/.claude/settings.json is malformed JSON — skipped${RESET}
+`);
+      process.stderr.write(`${RED}   Please fix the file manually and re-run oathbound init --global${RESET}
+`);
+      break;
+  }
 }
-async function init() {
-  Wt2(BRAND);
+async function initLocal() {
   const level = "warn";
   let installResult = installDevDependency();
   if (installResult === "no-package-json") {
@@ -18481,8 +18610,8 @@ async function init() {
       Nt("Please run `npx oathbound init` inside of the folder where you want to run Claude Code. Oathbound currently needs an NPM package in order to run.");
       process.exit(1);
     }
-    const dirName = import_node_path8.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9._-]/g, "-").replace(/^[._]+/, "").replace(/-+/g, "-") || "project";
-    import_node_fs8.writeFileSync(import_node_path8.join(process.cwd(), "package.json"), JSON.stringify({
+    const dirName = import_node_path9.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9._-]/g, "-").replace(/^[._]+/, "").replace(/-+/g, "-") || "project";
+    import_node_fs9.writeFileSync(import_node_path9.join(process.cwd(), "package.json"), JSON.stringify({
       name: dirName,
       private: true,
       scripts: { prepare: "oathbound setup" }
@@ -18544,9 +18673,20 @@ async function init() {
 `);
       break;
   }
+}
+async function init(options = {}) {
+  Wt2(BRAND);
+  if (options.global && !options.local) {
+    initGlobal();
+  } else if (options.local && !options.global) {
+    await initLocal();
+  } else {
+    initGlobal();
+    await initLocal();
+  }
   Gt(`\uD83C\uDF89 Oath Bound set up complete!`);
 }
-async function pull(skillArg) {
+async function pull(skillArg, options = {}) {
   const parsed = parseSkillArg(skillArg);
   if (!parsed)
     usage();
@@ -18574,7 +18714,7 @@ ${BRAND} ${TEAL}↓ Pulling ${fullName}${version3 ? `@${version3}` : ""}...${RES
     fail("Download failed", downloadError?.message ?? "Unknown storage error");
   }
   const buffer = Buffer.from(await blob.arrayBuffer());
-  const tarFile = import_node_path8.join(import_node_os4.tmpdir(), `oathbound-${name}-${Date.now()}.tar.gz`);
+  const tarFile = import_node_path9.join(import_node_os4.tmpdir(), `oathbound-${name}-${Date.now()}.tar.gz`);
   const verifySpinner = spinner("Verifying...");
   const hash = import_node_crypto2.createHash("sha256").update(buffer).digest("hex");
   verifySpinner.stop();
@@ -18583,21 +18723,30 @@ ${BRAND} ${TEAL}↓ Pulling ${fullName}${version3 ? `@${version3}` : ""}...${RES
     console.log(`${RED}   expected: ${skill.tar_hash}${RESET}`);
     fail("Verification failed", `Downloaded file does not match expected hash for ${fullName}`);
   }
-  let skillsDir = findSkillsDir();
-  if (!skillsDir.endsWith(".claude/skills") && !skillsDir.includes(".claude/skills")) {
-    skillsDir = import_node_path8.join(process.cwd(), ".claude", "skills");
-    import_node_fs8.mkdirSync(skillsDir, { recursive: true });
-    console.log(`${DIM}   Created ${skillsDir}${RESET}`);
+  let skillsDir;
+  if (options.global) {
+    skillsDir = import_node_path9.join(import_node_os4.homedir(), ".claude", "skills");
+    import_node_fs9.mkdirSync(skillsDir, { recursive: true });
+  } else {
+    const dirs = findSkillsDirs();
+    const localEntry = dirs.find((d) => d.source === "local");
+    if (localEntry) {
+      skillsDir = localEntry.path;
+    } else {
+      skillsDir = import_node_path9.join(process.cwd(), ".claude", "skills");
+      import_node_fs9.mkdirSync(skillsDir, { recursive: true });
+      console.log(`${DIM}   Created ${skillsDir}${RESET}`);
+    }
   }
-  import_node_fs8.writeFileSync(tarFile, buffer);
+  import_node_fs9.writeFileSync(tarFile, buffer);
   try {
-    import_node_child_process2.execFileSync("tar", ["-xf", tarFile, "-C", skillsDir], { stdio: "pipe" });
+    import_node_child_process3.execFileSync("tar", ["-xf", tarFile, "-C", skillsDir], { stdio: "pipe" });
   } catch (e) {
-    import_node_fs8.unlinkSync(tarFile);
+    import_node_fs9.unlinkSync(tarFile);
     const msg = e instanceof Error ? e.message : "Unknown error";
     fail("Extraction failed", msg);
   }
-  import_node_fs8.unlinkSync(tarFile);
+  import_node_fs9.unlinkSync(tarFile);
   try {
     const trackRes = await fetch(`${API_BASE6}/api/downloads`, {
       method: "POST",
@@ -18611,7 +18760,7 @@ ${BRAND} ${TEAL}↓ Pulling ${fullName}${version3 ? `@${version3}` : ""}...${RES
   } catch {}
   console.log(`${BOLD}${GREEN} ✓ Skill verified${RESET}`);
   console.log(`${DIM}   ${fullName} v${skill.version}${RESET}`);
-  console.log(`${DIM}   → ${import_node_path8.join(skillsDir, name)}${RESET}`);
+  console.log(`${DIM}   → ${import_node_path9.join(skillsDir, name)}${RESET}`);
 }
 async function agentPull(agentArg) {
   const parsed = parseSkillArg(agentArg);
@@ -18652,9 +18801,9 @@ ${BRAND} ${TEAL}↓ Pulling agent ${fullName}${version3 ? `@${version3}` : ""}..
   if (name.includes("/") || name.includes("\\") || name.includes("..")) {
     fail("Invalid agent name", `Name "${name}" contains path traversal characters`);
   }
-  const agentsDir = import_node_path8.join(process.cwd(), ".claude", "agents");
-  import_node_fs8.mkdirSync(agentsDir, { recursive: true });
-  const targetPath = import_node_path8.join(agentsDir, `${name}.md`);
+  const agentsDir = import_node_path9.join(process.cwd(), ".claude", "agents");
+  import_node_fs9.mkdirSync(agentsDir, { recursive: true });
+  const targetPath = import_node_path9.join(agentsDir, `${name}.md`);
   if (!targetPath.startsWith(agentsDir)) {
     fail("Invalid agent name", `Resolved path escapes agents directory`);
   }
@@ -18682,7 +18831,7 @@ ${YELLOW}${BOLD} ⚠ This agent defines MCP servers (external connections):${RES
       fail("Aborted", "Agent not installed");
     }
   }
-  import_node_fs8.writeFileSync(targetPath, content);
+  import_node_fs9.writeFileSync(targetPath, content);
   try {
     const trackRes = await fetch(`${API_BASE6}/api/downloads`, {
       method: "POST",
@@ -18737,7 +18886,11 @@ if (require.main == module) {
       }
     }
     if (subcommand === "init") {
-      await init().catch((err) => {
+      const initArgs = args.slice(1);
+      await init({
+        global: initArgs.includes("--global"),
+        local: initArgs.includes("--local")
+      }).catch((err) => {
         const msg = err instanceof Error ? err.message : "Unknown error";
         fail("Init failed", msg);
       });
@@ -18788,11 +18941,13 @@ if (require.main == module) {
       });
     } else {
       const PULL_ALIASES = new Set(["pull", "i", "install"]);
-      const skillArg = args[1];
+      const pullArgs = args.slice(1);
+      const isGlobalPull = pullArgs.includes("--global");
+      const skillArg = pullArgs.find((a) => !a.startsWith("--"));
       if (!subcommand || !PULL_ALIASES.has(subcommand) || !skillArg) {
         usage();
       }
-      await pull(skillArg).catch((err) => {
+      await pull(skillArg, { global: isGlobalPull }).catch((err) => {
         const msg = err instanceof Error ? err.message : "Unknown error";
         fail("Unexpected error", msg);
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oathbound",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Install verified Claude Code skills and agents from the Oath Bound registry",
   "license": "MIT",
   "author": "Josh Anderson",